6.1.113-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 6.1.113-rc1 review
This is the start of the stable review cycle for the 6.1.113 release. There are 798 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 16 Oct 2024 14:09:57 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.113-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.113-rc1
Jack Wang <[email protected]>
Revert "iommu/vt-d: Retrieve IOMMU perfmon capability information"
Yu Kuai <[email protected]>
block, bfq: fix uaf for accessing waker_bfqq after splitting
Arnaldo Carvalho de Melo <[email protected]>
perf lock: Don't pass an ERR_PTR() directly to perf_session__delete()
Linus Walleij <[email protected]>
net: ethernet: cortina: Restore TSO support
Patrick Roy <[email protected]>
secretmem: disable memfd_secret() if arch cannot set direct map
Frederic Weisbecker <[email protected]>
kthread: unpark only parked kthread
Yonatan Maman <[email protected]>
nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error
Kun(llfl) <[email protected]>
device-dax: correct pgoff align in dax_set_mapping()
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: do not remove closing subflows
Paolo Abeni <[email protected]>
mptcp: handle consistently DSS corruption
Anatolij Gustschin <[email protected]>
net: dsa: lan9303: ensure chip reset and wait for READY status
Anastasia Kovaleva <[email protected]>
net: Fix an unsafe loop on the list
Ignat Korchagin <[email protected]>
net: explicitly clear the sk pointer, when pf->create fails
Niklas Cassel <[email protected]>
ata: libata: avoid superfluous disk spin down + spin up during hibernation
Matthieu Baerts (NGI0) <[email protected]>
mptcp: fallback when MPTCP opts are dropped after 1st data
Daniel Palmer <[email protected]>
scsi: wd33c93: Don't use stale scsi_pointer value
Maíra Canal <[email protected]>
drm/vc4: Stop the active perfmon before being destroyed
Maíra Canal <[email protected]>
drm/v3d: Stop the active perfmon before being destroyed
SurajSonawane2415 <[email protected]>
hid: intel-ish-hid: Fix uninitialized variable 'rv' in ish_fw_xfer_direct_dma
John Keeping <[email protected]>
usb: gadget: core: force synchronous registration
Icenowy Zheng <[email protected]>
usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip
Jose Alberto Reguero <[email protected]>
usb: xhci: Fix problem with xhci resume from suspend
Selvarasu Ganesan <[email protected]>
usb: dwc3: core: Stop processing of pending events if controller is halted
Oliver Neukum <[email protected]>
Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant"
Wade Wang <[email protected]>
HID: plantronics: Workaround for an unexcepted opposite volume key
Basavaraj Natikar <[email protected]>
HID: amd_sfh: Switch to device-managed dmam_alloc_coherent()
Sasha Levin <[email protected]>
Revert "net: ibm/emac: allocate dummy net_device dynamically"
Javier Carrasco <[email protected]>
hwmon: (adt7470) Add missing dependency on REGMAP_I2C
Javier Carrasco <[email protected]>
hwmon: (adm9240) Add missing dependency on REGMAP_I2C
Guenter Roeck <[email protected]>
hwmon: (tmp513) Add missing dependency on REGMAP_I2C
Kenton Groombridge <[email protected]>
wifi: mac80211: Avoid address calculations via out of bounds array indexing
Shay Drory <[email protected]>
net/mlx5: Always drain health in shutdown callback
He Lugang <[email protected]>
HID: multitouch: Add support for lenovo Y9000P Touchpad
Boqun Feng <[email protected]>
rust: macros: provide correct provenance when constructing THIS_MODULE
Eric Dumazet <[email protected]>
slip: make slhc_remember() more robust against malicious packets
Eric Dumazet <[email protected]>
ppp: fix ppp_async_encode() illegal access
Kuniyuki Iwashima <[email protected]>
mctp: Handle error of rtnl_register_module().
Kuniyuki Iwashima <[email protected]>
vxlan: Handle error of rtnl_register_module().
Kuniyuki Iwashima <[email protected]>
rtnetlink: Add bulk registration helpers for rtnetlink message handlers.
Rosen Penev <[email protected]>
net: ibm: emac: mal: add dcr_unmap to _remove
Breno Leitao <[email protected]>
net: ibm/emac: allocate dummy net_device dynamically
Florian Westphal <[email protected]>
netfilter: fib: check correct rtable in vrf setups
Florian Westphal <[email protected]>
netfilter: xtables: avoid NFPROTO_UNSPEC where needed
Xin Long <[email protected]>
sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start
Filipe Manana <[email protected]>
btrfs: zoned: fix missing RCU locking in error message when loading zone info
Rosen Penev <[email protected]>
net: ibm: emac: mal: fix wrong goto
Eric Dumazet <[email protected]>
net/sched: accept TCA_STAB only for root qdisc
Mohamed Khalfella <[email protected]>
igb: Do not bring the device up after non-fatal error
Aleksandr Loktionov <[email protected]>
i40e: Fix macvlan leak by synchronizing access to mac_filter_hash
Marcin Szycik <[email protected]>
ice: Fix netif_is_ice() in Safe Mode
Billy Tsai <[email protected]>
gpio: aspeed: Use devm_clk api to manage clock source
Billy Tsai <[email protected]>
gpio: aspeed: Add the flush write to ensure the write complete.
Jonas Gorski <[email protected]>
net: dsa: b53: fix jumbo frames on 10/100 ports
Jonas Gorski <[email protected]>
net: dsa: b53: allow lower MTUs on BCM5325/5365
Jonas Gorski <[email protected]>
net: dsa: b53: fix max MTU for BCM5325/BCM5365
Jonas Gorski <[email protected]>
net: dsa: b53: fix max MTU for 1g switches
Jonas Gorski <[email protected]>
net: dsa: b53: fix jumbo frame mtu check
Christophe JAILLET <[email protected]>
net: ethernet: adi: adin1110: Fix some error handling path in adin1110_read_fifo()
Jakub Kicinski <[email protected]>
Revert "net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled"
Zhang Rui <[email protected]>
thermal: intel: int340x: processor: Fix warning during module unload
Srinivas Pandruvada <[email protected]>
thermal: int340x: processor_thermal: Set feature mask before proc_thermal_add
Christophe JAILLET <[email protected]>
net: phy: bcm84881: Fix some error handling paths
Luiz Augusto von Dentz <[email protected]>
Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
Kacper Ludwinski <[email protected]>
selftests: net: no_forwarding: fix VID for $swp2 in one_bridge_two_pvids() test
Andy Roulin <[email protected]>
netfilter: br_netfilter: fix panic with metadata_dst skb
Neal Cardwell <[email protected]>
tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe
Neal Cardwell <[email protected]>
tcp: fix to allow timestamp undo if no retransmits were sent
Ingo van Lil <[email protected]>
net: phy: dp83869: fix memory corruption when enabling fiber
Yanjun Zhang <[email protected]>
NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
Dan Carpenter <[email protected]>
SUNRPC: Fix integer overflow in decode_rc_list()
Dave Ertman <[email protected]>
ice: fix VLAN replay after reset
Chuck Lever <[email protected]>
NFSD: Mark filecache "down" if init fails
Val Packett <[email protected]>
drm/rockchip: vop: enable VOP_FEATURE_INTERNAL_RGB on RK3066
Sascha Hauer <[email protected]>
drm/rockchip: vop: limit maximum resolution to hardware capabilities
Andrey Shumilin <[email protected]>
fbdev: sisfb: Fix strbuf array overflow
Qianqiang Liu <[email protected]>
fbcon: Fix a NULL pointer dereference issue in fbcon_putcs
Alex Hung <[email protected]>
drm/amd/display: Check null pointer before dereferencing se
Justin Tee <[email protected]>
scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance
Justin Tee <[email protected]>
scsi: lpfc: Add ELS_RSP cmd to the list of WQEs to flush in lpfc_els_flush_cmd()
Zijun Hu <[email protected]>
driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute
Riyan Dhiman <[email protected]>
staging: vme_user: added bound check to geoid
Zhu Jun <[email protected]>
tools/iio: Add memory allocation failure check for trigger_name
Philip Chen <[email protected]>
virtio_pmem: Check device status before requesting flush
Simon Horman <[email protected]>
netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n
Wentao Guan <[email protected]>
LoongArch: Fix memleak in pci_acpi_scan_root()
Ruffalo Lavoisier <[email protected]>
comedi: ni_routing: tools: Check when the file could not be opened
Shawn Shao <[email protected]>
usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the Crashkernel Scenario
Xu Yang <[email protected]>
usb: chipidea: udc: enable suspend interrupt after usb reset
Peng Fan <[email protected]>
clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D
Peng Fan <[email protected]>
remoteproc: imx_rproc: Use imx specific hook for find_loaded_rsc_table
Yunke Cao <[email protected]>
media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put()
Ying Sun <[email protected]>
riscv/kexec_file: Fix relocation type R_RISCV_ADD16 and R_RISCV_SUB16 unknown
Michael Guralnik <[email protected]>
RDMA/mlx5: Enforce umem boundaries for explicit ODP page faults
Kaixin Wang <[email protected]>
ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
Jens Axboe <[email protected]>
io_uring: check if we need to reschedule during overflow flush
Palmer Dabbelt <[email protected]>
RISC-V: Don't have MAX_PHYSMEM_BITS exceed phys_addr_t
Alex Williamson <[email protected]>
PCI: Mark Creative Labs EMU20k2 INTx masking as broken
Hans de Goede <[email protected]>
i2c: i801: Use a different adapter-name for IDF adapters
Subramanian Ananthanarayanan <[email protected]>
PCI: Add ACS quirk for Qualcomm SA8775P
Krzysztof Kozlowski <[email protected]>
clk: bcm: bcm53573: fix OF node leak in init
Md Haris Iqbal <[email protected]>
RDMA/rtrs-srv: Avoid null pointer deref during path establishment
WangYuli <[email protected]>
PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
Saravanan Vajravel <[email protected]>
RDMA/mad: Improve handling of timed out WRs of mad agent
Daniel Jordan <[email protected]>
ktest.pl: Avoid false positives with grub2 skip regex
Heiko Carstens <[email protected]>
s390/traps: Handle early warnings gracefully
Thomas Richter <[email protected]>
s390/cpum_sf: Remove WARN_ON_ONCE statements
Wojciech Gładysz <[email protected]>
ext4: nested locking for xattr inode
Jan Kara <[email protected]>
ext4: don't set SB_RDONLY after filesystem errors
Yonghong Song <[email protected]>
bpf, x64: Fix a jit convergence issue
Gerald Schaefer <[email protected]>
s390/mm: Add cond_resched() to cmm_alloc/free_pages()
Heiko Carstens <[email protected]>
s390/facility: Disable compile time optimization for decompressor code
Heiko Carstens <[email protected]>
s390/boot: Compile all files with the same march flag
Tao Chen <[email protected]>
bpf: Check percpu map value size first
Mathias Krause <[email protected]>
Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal
Michael S. Tsirkin <[email protected]>
virtio_console: fix misc probe bugs
Konstantin Komarov <[email protected]>
fs/ntfs3: Refactor enum_rstbl to suppress static checker
Konstantin Komarov <[email protected]>
fs/ntfs3: Fix sparse warning in ni_fiemap
Konstantin Komarov <[email protected]>
fs/ntfs3: Do not call file_modified if collapse range failed
Luiz Augusto von Dentz <[email protected]>
Bluetooth: Fix usage of __hci_cmd_sync_status
Benjamin Poirier <[email protected]>
selftests: net: Remove executable bits from library scripts
Aditya Gupta <[email protected]>
libsubcmd: Don't free the usage string
Yang Jihong <[email protected]>
perf sched: Move curr_pid and cpu_last_switched initialization to perf_sched__{lat|map|replay}()
Yang Jihong <[email protected]>
perf sched: Move curr_thread initialization to perf_sched__map()
Yang Jihong <[email protected]>
perf sched: Fix memory leak in perf_sched__map()
Yang Jihong <[email protected]>
perf sched: Move start_work_mutex and work_done_wait_mutex initialization to perf_sched__replay()
Ian Rogers <[email protected]>
perf sched: Avoid large stack allocations
Ian Rogers <[email protected]>
perf lock: Dynamically allocate lockhash_table
Masami Hiramatsu (Google) <[email protected]>
bootconfig: Fix the kerneldoc of _xbc_exit()
Steven Rostedt (Google) <[email protected]>
tracing: Have saved_cmdlines arrays all in one allocation
Rob Clark <[email protected]>
drm/crtc: fix uninitialized variable use even harder
Jean-Loïc Charroud <[email protected]>
ALSA: hda/realtek: cs35l41: Fix device ID / model name
Jean-Loïc Charroud <[email protected]>
ALSA: hda/realtek: cs35l41: Fix order and duplicates in quirks table
Steven Rostedt (Google) <[email protected]>
tracing: Remove precision vsnprintf() check from print event
Linus Walleij <[email protected]>
net: ethernet: cortina: Drop TSO support
Gabriel Krisman Bertazi <[email protected]>
unicode: Don't special case ignorable code points
Shiyang Ruan <[email protected]>
fsdax: unshare: zero destination if srcmap is HOLE or UNWRITTEN
Oleksij Rempel <[email protected]>
clk: imx6ul: fix "failed to get parent" error
Shiyang Ruan <[email protected]>
fsdax: dax_unshare_iter() should return a valid length
Namhyung Kim <[email protected]>
perf report: Fix segfault when 'sym' sort key is not used
Haoran Zhang <[email protected]>
vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
Gao Xiang <[email protected]>
erofs: fix incorrect symlink detection in fast symlink
Jingbo Xu <[email protected]>
erofs: set block size to the on-disk block size
Jingbo Xu <[email protected]>
erofs: avoid hardcoded blocksize for subpage block support
Gao Xiang <[email protected]>
erofs: get rid of z_erofs_do_map_blocks() forward declaration
Gao Xiang <[email protected]>
erofs: get rid of erofs_inode_datablocks()
Sumit Semwal <[email protected]>
Revert "arm64: dts: qcom: sm8250: switch UFS QMP PHY to new style of bindings"
Armin Wolf <[email protected]>
ACPI: battery: Fix possible crash when unregistering a battery hook
Armin Wolf <[email protected]>
ACPI: battery: Simplify battery hook locking
Satya Priya Kakitapalli <[email protected]>
clk: qcom: gcc-sc8180x: Add GPLL9 support
Heiner Kallweit <[email protected]>
r8169: add tally counter fields added with RTL8125
Colin Ian King <[email protected]>
r8169: Fix spelling mistake: "tx_underun" -> "tx_underrun"
David Virag <[email protected]>
clk: samsung: exynos7885: Update CLKS_NR_FSYS after bindings fix
Krzysztof Kozlowski <[email protected]>
clk: samsung: exynos7885: do not define number of clocks in bindings
Satya Priya Kakitapalli <[email protected]>
dt-bindings: clock: qcom: Add GPLL9 support on gcc-sc8180x
Manivannan Sadhasivam <[email protected]>
dt-bindings: clock: qcom: Add missing UFS QREF clocks
Udit Kumar <[email protected]>
remoteproc: k3-r5: Delay notification of wakeup event
Beleswar Padhi <[email protected]>
remoteproc: k3-r5: Acquire mailbox handle during probe routine
Umang Jain <[email protected]>
media: imx335: Fix reset-gpio handling
Kieran Bingham <[email protected]>
media: i2c: imx335: Enable regulator supplies
Michel Alex <[email protected]>
clk: imx6ul: fix clock parent for IMX6UL_CLK_ENETx_REF_SEL
Alexander Stein <[email protected]>
clk: imx6ul: retain early UART clocks during kernel init
Oleksij Rempel <[email protected]>
clk: imx6ul: add ethernet refclock mux support
Oleksij Rempel <[email protected]>
clk: imx6ul: fix enet1 gate configuration
Johannes Weiner <[email protected]>
sched: psi: fix bogus pressure spikes from aggregation race
Wang Yong <[email protected]>
delayacct: improve the average delay precision of getdelay tool to microsecond
Yanteng Si <[email protected]>
docs/zh_CN: Update the translation of delay-accounting to 6.1-rc8
Andrii Nakryiko <[email protected]>
lib/buildid: harden build ID parsing logic
Alexey Dobriyan <[email protected]>
build-id: require program headers to be right after ELF header
Mario Limonciello <[email protected]>
drm/amd/display: Allow backlight to go below AMDGPU_DM_DEFAULT_MIN_BACKLIGHT
Yosry Ahmed <[email protected]>
mm: z3fold: deprecate CONFIG_Z3FOLD
Oleg Nesterov <[email protected]>
uprobes: fix kernel info leak via "[uprobes]" vma
Jens Axboe <[email protected]>
io_uring/net: harden multishot termination case for recv
Mark Rutland <[email protected]>
arm64: errata: Expand speculative SSBS workaround once more
Mark Rutland <[email protected]>
arm64: cputype: Add Neoverse-N3 definitions
Anshuman Khandual <[email protected]>
arm64: Add Cortex-715 CPU part definition
Jinjie Ruan <[email protected]>
spi: bcm63xx: Fix missing pm_runtime_disable()
David Virag <[email protected]>
dt-bindings: clock: exynos7885: Fix duplicated binding
Jinjie Ruan <[email protected]>
i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled
Andi Shyti <[email protected]>
i2c: xiic: Use devm_clk_get_enabled()
Heiner Kallweit <[email protected]>
i2c: core: Lock address during client device instantiation
Wolfram Sang <[email protected]>
i2c: create debugfs entry per adapter
Masahiro Yamada <[email protected]>
kconfig: qconf: fix buffer overflow in debug links
Uwe Kleine-König <[email protected]>
cpufreq: intel_pstate: Make hwp_notify_lock a raw spinlock
Tom Chung <[email protected]>
drm/amd/display: Fix system hang while resume with TBT monitor
Tvrtko Ursulin <[email protected]>
drm/sched: Add locking to drm_sched_entity_modify_sched
Jani Nikula <[email protected]>
drm/i915/gem: fix bitwise and logical AND mixup
Al Viro <[email protected]>
close_range(): fix the logics in descriptor table trimming
Wei Li <[email protected]>
tracing/timerlat: Fix a race during cpuhp processing
Wei Li <[email protected]>
tracing/hwlat: Fix a race during cpuhp processing
Patrick Donnelly <[email protected]>
ceph: fix cap ref leak via netfs init_request
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE
Emanuele Ghidoli <[email protected]>
gpio: davinci: fix lazy disable
Filipe Manana <[email protected]>
btrfs: wait for fixup workers before stopping cleaner kthread during umount
Filipe Manana <[email protected]>
btrfs: send: fix invalid clone operation for file that got its size decreased
Qu Wenruo <[email protected]>
btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
Hans de Goede <[email protected]>
ACPI: resource: Add Asus ExpertBook B2502CVA to irq1_level_low_skip_override[]
Hans de Goede <[email protected]>
ACPI: resource: Add Asus Vivobook X1704VAP to irq1_level_low_skip_override[]
Baokun Li <[email protected]>
cachefiles: fix dentry leak in cachefiles_open_file()
Nuno Sa <[email protected]>
Input: adp5589-keys - fix adp5589_gpio_get_value()
Nuno Sa <[email protected]>
Input: adp5589-keys - fix NULL pointer dereference
Krzysztof Kozlowski <[email protected]>
rtc: at91sam9: fix OF node leak in probe() error path
KhaiWenTan <[email protected]>
net: stmmac: Fix zero-division error when disabling tc cbs
Tetsuo Handa <[email protected]>
tomoyo: fallback to realpath if symlink's pathname does not exist
Willem de Bruijn <[email protected]>
gso: fix udp gso fraglist segmentation after pull from frag_list
Barnabás Czémán <[email protected]>
iio: magnetometer: ak8975: Fix reading for ak099xx sensors
wangrong <[email protected]>
smb: client: use actual path when queryfs
Ajit Pandey <[email protected]>
clk: qcom: clk-alpha-pll: Fix CAL_L_VAL override for LUCID EVO PLL
Satya Priya Kakitapalli <[email protected]>
clk: qcom: gcc-sc8180x: Fix the sdcc2 and sdcc4 clocks freq table
Bryan O'Donoghue <[email protected]>
media: qcom: camss: Fix ordering of pm_runtime_enable
Manivannan Sadhasivam <[email protected]>
clk: qcom: gcc-sm8250: Do not turn off PCIe GDSCs during gdsc_disable()
Zheng Wang <[email protected]>
media: venus: fix use after free bug in venus_remove due to race condition
Satya Priya Kakitapalli <[email protected]>
clk: qcom: gcc-sm8150: De-register gcc_cpuss_ahb_clk_src
Mike Tipton <[email protected]>
clk: qcom: clk-rpmh: Fix overflow in BCM vote
Hans Verkuil <[email protected]>
media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
Manivannan Sadhasivam <[email protected]>
clk: qcom: gcc-sm8450: Do not turn off PCIe GDSCs during gdsc_disable()
Laurent Pinchart <[email protected]>
media: sun4i_csi: Implement link validate for sun4i_csi subdev
Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8250: use CLK_SET_RATE_PARENT for branch clocks
Jan Kiszka <[email protected]>
remoteproc: k3-r5: Fix error handling when power-up failed
Sebastian Reichel <[email protected]>
clk: rockchip: fix error for unknown clocks
Chun-Yi Lee <[email protected]>
aoe: fix the potential use-after-free problem in more places
Chuck Lever <[email protected]>
NFSD: Fix NFSv4's PUTPUBFH operation
Li Lingfeng <[email protected]>
nfsd: map the EBADMSG to nfserr_io to avoid warning
NeilBrown <[email protected]>
nfsd: fix delegation_blocked() to block correctly for at least 30 seconds
Matt Fleming <[email protected]>
perf hist: Update hist symbol when updating maps
Yuezhang Mo <[email protected]>
exfat: fix memory leak in exfat_load_bitmap()
Jisheng Zhang <[email protected]>
riscv: define ILLEGAL_POINTER_VALUE for 64bit
Lizhi Xu <[email protected]>
ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
Julian Sun <[email protected]>
ocfs2: fix null-ptr-deref when journal load failed.
Lizhi Xu <[email protected]>
ocfs2: remove unreasonable unlock in ocfs2_read_blocks
Joseph Qi <[email protected]>
ocfs2: cancel dqi_sync_work before freeing oinfo
Gautham Ananthakrishna <[email protected]>
ocfs2: reserve space for inline xattr before attaching reflink tree
Joseph Qi <[email protected]>
ocfs2: fix uninit-value in ocfs2_get_block()
Heming Zhao <[email protected]>
ocfs2: fix the la space leak when unmounting an ocfs2 volume
Danilo Krummrich <[email protected]>
mm: krealloc: consider spare memory for __GFP_ZERO
Kemeng Shi <[email protected]>
jbd2: correctly compare tids with tid_geq function in jbd2_fc_begin_commit
Baokun Li <[email protected]>
jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
Huang Ying <[email protected]>
resource: fix region_intersects() vs add_memory_driver_managed()
Ma Ke <[email protected]>
drm: omapdrm: Add missing check for alloc_ordered_workqueue
Andrew Jones <[email protected]>
of/irq: Support #msi-cells=<0> in of_msi_get_domain
Val Packett <[email protected]>
drm/rockchip: vop: clear DMA stop bit on RK3066
Helge Deller <[email protected]>
parisc: Fix stack start for ADDR_NO_RANDOMIZE personality
Helge Deller <[email protected]>
parisc: Fix 64-bit userspace syscall path
Luis Henriques (SUSE) <[email protected]>
ext4: mark fc as ineligible using an handle in ext4_xattr_set()
Luis Henriques (SUSE) <[email protected]>
ext4: use handle to mark fc as ineligible in __track_dentry_update()
Luis Henriques (SUSE) <[email protected]>
ext4: fix fast commit inode enqueueing during a full journal commit
Luis Henriques (SUSE) <[email protected]>
ext4: fix incorrect tid assumption in jbd2_journal_shrink_checkpoint_list()
Luis Henriques (SUSE) <[email protected]>
ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit()
Baokun Li <[email protected]>
ext4: update orig_path in ext4_find_extent()
Baokun Li <[email protected]>
ext4: fix double brelse() the buffer of the extents path
Baokun Li <[email protected]>
ext4: aovid use-after-free in ext4_ext_insert_extent()
Baokun Li <[email protected]>
ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
Luis Henriques (SUSE) <[email protected]>
ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space()
Zhihao Cheng <[email protected]>
ext4: dax: fix overflowing extents beyond inode size when partially writing
Luis Henriques (SUSE) <[email protected]>
ext4: fix incorrect tid assumption in ext4_fc_mark_ineligible()
Baokun Li <[email protected]>
ext4: propagate errors from ext4_find_extent() in ext4_insert_range()
Baokun Li <[email protected]>
ext4: fix slab-use-after-free in ext4_split_extent_at()
yao.ly <[email protected]>
ext4: correct encrypted dentry name hash when not casefolded
Edward Adam Davis <[email protected]>
ext4: no need to continue when the number of entries is 1
Abhishek Tamboli <[email protected]>
ALSA: hda/realtek: Add a quirk for HP Pavilion 15z-ec200
Ai Chao <[email protected]>
ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9
Hans P. Moller <[email protected]>
ALSA: line6: add hw monitor volume control to POD HD500X
Jan Lalinsky <[email protected]>
ALSA: usb-audio: Add native DSD support for Luxman D-08u
Lianqin Hu <[email protected]>
ALSA: usb-audio: Add delay quirk for VIVO USB-C HEADSET
Jaroslav Kysela <[email protected]>
ALSA: core: add isascii() check to card ID generator
Thomas Zimmermann <[email protected]>
drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS
Helge Deller <[email protected]>
parisc: Fix itlb miss handler for 64-bit programs
Luo Gengkun <[email protected]>
perf/core: Fix small negative period being ignored
Hans de Goede <[email protected]>
power: supply: hwmon: Fix missing temp1_max_alarm attribute
Jinjie Ruan <[email protected]>
spi: bcm63xx: Fix module autoloading
Krzysztof Kozlowski <[email protected]>
firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()
Alexander Shiyan <[email protected]>
media: i2c: ar0521: Use cansleep version of gpiod_set_value()
Robert Hancock <[email protected]>
i2c: xiic: Wait for TX empty to avoid missed TX NAKs
Jinjie Ruan <[email protected]>
i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq()
Marek Vasut <[email protected]>
i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
Zach Wade <[email protected]>
platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
Takashi Iwai <[email protected]>
Revert "ALSA: hda: Conditionally use snooping for AMD HDMI"
Heiko Carstens <[email protected]>
selftests: vDSO: fix vdso_config for s390
Jens Remus <[email protected]>
selftests: vDSO: fix ELF hash table entry size for s390x
Christophe Leroy <[email protected]>
powerpc/vdso: Fix VDSO data access when running in a non-root time namespace
David Hildenbrand <[email protected]>
selftests/mm: fix charge_reserved_hugetlb.sh test
Christophe Leroy <[email protected]>
selftests: vDSO: fix vDSO symbols lookup for powerpc64
Christophe Leroy <[email protected]>
selftests: vDSO: fix vdso_config for powerpc
Christophe Leroy <[email protected]>
selftests: vDSO: fix vDSO name for powerpc
Yifei Liu <[email protected]>
selftests: breakpoints: use remaining time to check if suspend succeed
Ben Dooks <[email protected]>
spi: s3c64xx: fix timeout counters in flush_fifo
Jinjie Ruan <[email protected]>
spi: spi-imx: Fix pm_runtime_set_suspended() with runtime pm enabled
Thomas Weißschuh <[email protected]>
blk-integrity: register sysfs attributes on struct device
Thomas Weißschuh <[email protected]>
blk-integrity: convert to struct device_attribute
Thomas Weißschuh <[email protected]>
blk-integrity: use sysfs_emit
Christoph Hellwig <[email protected]>
iomap: handle a post-direct I/O invalidate race in iomap_write_delalloc_release
Artem Sadovnikov <[email protected]>
ext4: fix i_data_sem unlock order in ext4_ind_migrate()
Baokun Li <[email protected]>
ext4: avoid use-after-free in ext4_ext_show_leaf()
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: ext4_search_dir should return a proper error
Haren Myneni <[email protected]>
powerpc/pseries: Use correct data types from pseries_hp_errorlog struct
Geert Uytterhoeven <[email protected]>
of/irq: Refer to actual buffer size in of_irq_parse_one()
Tim Huang <[email protected]>
drm/amd/pm: ensure the fw_info is not null before using it
Geert Uytterhoeven <[email protected]>
drm/radeon/r100: Handle unknown family in r100_cp_init_microcode()
Finn Thain <[email protected]>
scsi: NCR5380: Initialize buffer for MSG IN and STATUS transfers
Tim Huang <[email protected]>
drm/amdgpu: fix unchecked return value warning for amdgpu_gfx
Justin Tee <[email protected]>
scsi: lpfc: Update PRLO handling in direct attached topology
Kees Cook <[email protected]>
scsi: aacraid: Rearrange order of struct aac_srb_unit
Andrii Nakryiko <[email protected]>
perf,x86: avoid missing caller address in stack traces captured in uprobe
Matthew Brost <[email protected]>
drm/printer: Allow NULL data in devcoredump printer
Alex Hung <[email protected]>
drm/amd/display: Initialize get_bytes_per_element's default to 1
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix index out of bounds in DCN30 color transformation
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix index out of bounds in degamma hardware format translation
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
Alex Hung <[email protected]>
drm/amd/display: Check stream before comparing them
Yannick Fertre <[email protected]>
drm/stm: ltdc: reset plane transparency after plane disable
Ckath <[email protected]>
platform/x86: touchscreen_dmi: add nanote-next quirk
Vishnu Sankar <[email protected]>
HID: multitouch: Add support for Thinkpad X12 Gen 2 Kbd Portfolio
Jesse Zhang <[email protected]>
drm/amdkfd: Fix resource leak in criu restore queue
Peng Liu <[email protected]>
drm/amdgpu: enable gfxoff quirk on HP 705G4
Peng Liu <[email protected]>
drm/amdgpu: add raven1 gfxoff quirk
Zhao Mengmeng <[email protected]>
jfs: Fix uninit-value access of new_ea in ea_buffer
Mahesh Rajashekhara <[email protected]>
scsi: smartpqi: correct stream detection
Edward Adam Davis <[email protected]>
jfs: check if leafidx greater than num leaves per dmap tree
Edward Adam Davis <[email protected]>
jfs: Fix uaf in dbFreeBits
Remington Brasga <[email protected]>
jfs: UBSAN: shift-out-of-bounds in dbFindBits
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for 'afb' in amdgpu_dm_plane_handle_cursor_update (v2)
Alex Hung <[email protected]>
drm/amd/display: Check null pointers before using dc->clk_mgr
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream'
Damien Le Moal <[email protected]>
ata: sata_sil: Rename sil_blacklist to sil_quirks
Damien Le Moal <[email protected]>
ata: pata_serverworks: Do not use the term blacklist
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
Pierre-Eric Pelloux-Prayer <[email protected]>
drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit
Katya Orlova <[email protected]>
drm/stm: Avoid use-after-free issues with crtc and plane
Sanjay K Kumar <[email protected]>
iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
Lu Baolu <[email protected]>
iommu/vt-d: Always reserve a domain ID for identity setup
Andrew Davis <[email protected]>
power: reset: brcmstb: Do not go into infinite loop if reset fails
Marc Gonzalez <[email protected]>
iommu/arm-smmu-qcom: hide last LPASS SMMU context bank from linux
Paul E. McKenney <[email protected]>
rcuscale: Provide clear error when async specified without primitives
Kaixin Wang <[email protected]>
fbdev: pxafb: Fix possible use after free in pxafb_task()
Kees Cook <[email protected]>
x86/syscall: Avoid memcpy() for ia32 syscall_get_arguments()
Thomas Weißschuh <[email protected]>
selftests/nolibc: avoid passing NULL to printf("%s")
Takashi Iwai <[email protected]>
ALSA: hdsp: Break infinite MIDI input flush loop
Takashi Iwai <[email protected]>
ALSA: asihpi: Fix potential OOB array access
Tao Liu <[email protected]>
x86/kexec: Add EFI config table identity mapping for kexec kernel
Ahmed S. Darwish <[email protected]>
tools/x86/kcpuid: Protect against faulty "max subleaf" values
Krzysztof Kozlowski <[email protected]>
ASoC: codecs: wsa883x: Handle reading version failure
Joshua Pius <[email protected]>
ALSA: usb-audio: Add logitech Audio profile quirk
Takashi Iwai <[email protected]>
ALSA: usb-audio: Replace complex quirk lines with macros
Takashi Iwai <[email protected]>
ALSA: usb-audio: Define macros for quirk table entries
Thomas Gleixner <[email protected]>
x86/ioapic: Handle allocation failures gracefully
Takashi Iwai <[email protected]>
ALSA: usb-audio: Add input value sanity checks for standard types
Jinjie Ruan <[email protected]>
nfp: Use IRQF_NO_AUTOEN flag in request_irq()
Gustavo A. R. Silva <[email protected]>
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
Felix Fietkau <[email protected]>
wifi: mt76: mt7915: hold dev->mt76.mutex while disabling tx worker
Adrian Ratiu <[email protected]>
proc: add config & param to block forcing mem writes
Aleksandrs Vinarskis <[email protected]>
ACPICA: iasl: handle empty connection_node
Johannes Berg <[email protected]>
wifi: mac80211: fix RCU list iterations
Jason Xing <[email protected]>
tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process
Herbert Xu <[email protected]>
crypto: simd - Do not call crypto_alloc_tfm during registration
Simon Horman <[email protected]>
net: atlantic: Avoid warning about potential string truncation
Ido Schimmel <[email protected]>
ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family
Ping-Ke Shih <[email protected]>
wifi: rtw89: correct base HT rate mask for firmware
Kuniyuki Iwashima <[email protected]>
ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR).
Simon Horman <[email protected]>
bnxt_en: Extend maximum length of version string by 1 byte
Simon Horman <[email protected]>
net: mvpp2: Increase size of queue_name buffer
Simon Horman <[email protected]>
tipc: guard against string buffer overrun
Pei Xiao <[email protected]>
ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()
Rafael J. Wysocki <[email protected]>
ACPI: EC: Do not release locks during operation region accesses
Zong-Zhe Yang <[email protected]>
wifi: rtw88: select WANT_DEV_COREDUMP
Karthikeyan Periyasamy <[email protected]>
wifi: ath11k: fix array out-of-bound access in SoC stats
Keith Busch <[email protected]>
nvme-pci: qdepth 1 quirk
Konstantin Ovsepian <[email protected]>
blk_iocost: fix more out of bound shifts
Hans de Goede <[email protected]>
ACPI: video: Add force_vendor quirk for Panasonic Toughbook CF-18
Hilda Wu <[email protected]>
Bluetooth: btusb: Add Realtek RTL8852C support ID 0x0489:0xe122
Dmitry Antipov <[email protected]>
net: sched: consistently use rcu_replace_pointer() in taprio_change()
Felix Fietkau <[email protected]>
wifi: mt76: mt7915: disable tx worker during tx BA session enable/disable
Armin Wolf <[email protected]>
ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
Armin Wolf <[email protected]>
ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
Seiji Nishikawa <[email protected]>
ACPI: PAD: fix crash in exit_round_robin()
Krzysztof Kozlowski <[email protected]>
net: hisilicon: hns_mdio: fix OF node leak in probe()
Krzysztof Kozlowski <[email protected]>
net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info()
Krzysztof Kozlowski <[email protected]>
net: hisilicon: hip04: fix OF node leak in probe()
Jeongjun Park <[email protected]>
net/xen-netback: prevent UAF in xenvif_flush_hash()
Issam Hamdi <[email protected]>
wifi: cfg80211: Set correct chandef when starting CAC
Ilan Peer <[email protected]>
wifi: iwlwifi: mvm: Fix a race in scan abort flow
Aleksandr Mishin <[email protected]>
ice: Adjust over allocation of memory in ice_sched_add_root_node() and ice_sched_add_node()
Toke Høiland-Jørgensen <[email protected]>
wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
Dmitry Kandybka <[email protected]>
wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats()
Jann Horn <[email protected]>
f2fs: Require FMODE_WRITE for atomic write ioctls
Takashi Iwai <[email protected]>
ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
Hui Wang <[email protected]>
ASoC: imx-card: Set card.owner to avoid a warning calltrace if SND=m
Takashi Iwai <[email protected]>
ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
Oder Chiou <[email protected]>
ALSA: hda/realtek: Fix the push button function for the ALC257
Christophe JAILLET <[email protected]>
ALSA: mixer_oss: Remove some incorrect kfree_const() usages
Andrei Simion <[email protected]>
ASoC: atmel: mchp-pdmc: Skip ALSA restoration if substream runtime is uninitialized
Benjamin Gaignard <[email protected]>
media: usbtv: Remove useless locks in usbtv_video_free()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sock: Fix not validating setsockopt user input
Christoph Hellwig <[email protected]>
loop: don't set QUEUE_FLAG_NOMERGES
Robert Hancock <[email protected]>
i2c: xiic: Try re-initialization on bus busy timeout
Marc Ferland <[email protected]>
i2c: xiic: improve error message when transfer fails to start
Xin Long <[email protected]>
sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
Darrick J. Wong <[email protected]>
iomap: constrain the file range passed to iomap_file_unshare
Shiyang Ruan <[email protected]>
fsdax,xfs: port unshare to fsdax
Eric Dumazet <[email protected]>
ppp: do not assume bh is held in ppp_channel_bridge_input()
Anton Danilov <[email protected]>
ipv4: ip_gre: Fix drops of small packets in ipgre_xmit
Shenwei Wang <[email protected]>
net: stmmac: dwmac4: extend timeout for VLAN Tag register busy bit check
Eric Dumazet <[email protected]>
net: add more sanity checks to qdisc_pkt_len_init()
Eric Dumazet <[email protected]>
net: avoid potential underflow in qdisc_pkt_len_init() with UFO
Aleksander Jan Bajkowski <[email protected]>
net: ethernet: lantiq_etop: fix memory disclosure
Jinjie Ruan <[email protected]>
Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq()
Eric Dumazet <[email protected]>
netfilter: nf_tables: prevent nf_skb_duplicated corruption
Phil Sutter <[email protected]>
selftests: netfilter: Fix nft_audit.sh for newer nft binaries
Jinjie Ruan <[email protected]>
net: wwan: qcom_bam_dmux: Fix missing pm_runtime_disable()
Jinjie Ruan <[email protected]>
net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq()
Phil Sutter <[email protected]>
netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED
Elena Salomatkina <[email protected]>
net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc()
Mohamed Khalfella <[email protected]>
net/mlx5: Added cond_resched() to crdump collection
Gerd Bayer <[email protected]>
net/mlx5: Fix error path in multi-packet WQE transmit
Aakash Menon <[email protected]>
net: sparx5: Fix invalid timestamps
Jinjie Ruan <[email protected]>
ieee802154: Fix build error
Xiubo Li <[email protected]>
ceph: remove the incorrect Fw reference check when dirtying pages
Stefan Wahren <[email protected]>
mailbox: bcm2835: Fix timeout during suspend mode
Liao Chen <[email protected]>
mailbox: rockchip: fix a typo in module autoloading
Daniel Wagner <[email protected]>
scsi: pm8001: Do not overwrite PCI queue mapping
Peter Zijlstra <[email protected]>
jump_label: Fix static_key_slow_dec() yet again
Thomas Gleixner <[email protected]>
jump_label: Simplify and clarify static_key_fast_inc_cpus_locked()
Thomas Gleixner <[email protected]>
static_call: Replace pointless WARN_ON() in static_call_module_notify()
Thomas Gleixner <[email protected]>
static_call: Handle module init failure correctly in static_call_del_module()
Lorenzo Bianconi <[email protected]>
wifi: mt76: do not run mt76_unregister_device() on unregistered hw
Alexey Gladkov (Intel) <[email protected]>
x86/tdx: Fix "in-kernel MMIO" check
Mika Westerberg <[email protected]>
PCI/PM: Mark devices disconnected if upstream PCIe link is down on resume
Nathan Chancellor <[email protected]>
powerpc: Allow CONFIG_PPC64_BIG_ENDIAN_ELF_ABI_V2 with ld.lld 15+
André Apitzsch <[email protected]>
iio: magnetometer: ak8975: Fix 'Unexpected device' error
Robin Murphy <[email protected]>
perf/arm-cmn: Fail DTC counter allocation correctly
Harshit Mogalapalli <[email protected]>
usb: yurex: Fix inconsistent locking bug in yurex_read()
Andy Shevchenko <[email protected]>
i2c: isch: Add missed 'else'
Tommy Huang <[email protected]>
i2c: aspeed: Update the stop sw state when the bus recovery occurs
Liam R. Howlett <[email protected]>
mm/damon/vaddr: protect vma traversal in __damon_va_thre_regions() with rcu read lock
Dmitry Vyukov <[email protected]>
module: Fix KCOV-ignored file name
David Gow <[email protected]>
mm: only enforce minimum stack gap size if it's sensible
Zhiguo Niu <[email protected]>
lockdep: fix deadlock issue between lockdep and rcu
Song Liu <[email protected]>
bpf: lsm: Set bpf_lsm_blob_sizes.lbs_task to 0
Eric Dumazet <[email protected]>
icmp: change the order of rate limits
Jamie Bainbridge <[email protected]>
icmp: Add counters for rate limits
Kairui Song <[email protected]>
mm/filemap: optimize filemap folio adding
Kairui Song <[email protected]>
lib/xarray: introduce a new helper xas_get_order
Kairui Song <[email protected]>
mm/filemap: return early if failed to allocate memory for split
Dmitry Vyukov <[email protected]>
x86/entry: Remove unwanted instrumentation in common_interrupt()
Xin Li <[email protected]>
x86/idtentry: Incorporate definitions/declarations of the FRED entries
Ma Ke <[email protected]>
pps: add an error check in parport_attach
Christophe JAILLET <[email protected]>
pps: remove usage of the deprecated ida_simple_xx() API
Pawel Laszczak <[email protected]>
usb: xhci: fix loss of data on Cadence xHC
Daehwan Jung <[email protected]>
xhci: Add a quirk for writing ERST in high-low order
Lukas Wunner <[email protected]>
xhci: Preserve RsvdP bits in ERSTBA register correctly
Mathias Nyman <[email protected]>
xhci: Refactor interrupter code for initial multi interrupter support.
Mathias Nyman <[email protected]>
xhci: remove xhci_test_trb_in_td_math early development check
Mathias Nyman <[email protected]>
xhci: fix event ring segment table related masks and variables in header
Oliver Neukum <[email protected]>
USB: misc: yurex: fix race between read and write
Lee Jones <[email protected]>
usb: yurex: Replace snprintf() with the safer scnprintf() variant
Michael Ellerman <[email protected]>
powerpc/atomic: Use YZ constraints for DS-form instructions
Nicholas Piggin <[email protected]>
powerpc/64: Add support to build with prefixed instructions
Nicholas Piggin <[email protected]>
powerpc/64: Option to build big-endian with ELFv2 ABI
Krzysztof Kozlowski <[email protected]>
soc: versatile: realview: fix soc_dev leak during device remove
Krzysztof Kozlowski <[email protected]>
soc: versatile: realview: fix memory leak during device remove
VanGiang Nguyen <[email protected]>
padata: use integer wrap around to prevent deadlock on seq_nr overflow
Qiuxu Zhuo <[email protected]>
EDAC/igen6: Fix conversion of system address to physical memory address
Li Lingfeng <[email protected]>
nfs: fix memory leak in error path of nfs4_do_reclaim
Mickaël Salaün <[email protected]>
fs: Fix file_set_fowner LSM hook inconsistencies
Julian Sun <[email protected]>
vfs: fix race between evice_inodes() and find_inode()&iput()
Dragan Simic <[email protected]>
arm64: dts: rockchip: Correct the Pinebook Pro battery design capacity
Dragan Simic <[email protected]>
arm64: dts: rockchip: Raise Pinebook Pro's panel backlight PWM frequency
Gaosheng Cui <[email protected]>
hwrng: cctrng - Add missing clk_disable_unprepare in cctrng_resume
Gaosheng Cui <[email protected]>
hwrng: bcm2835 - Add missing clk_disable_unprepare in bcm2835_rng_init
Guoqing Jiang <[email protected]>
hwrng: mtk - Use devm_pm_runtime_enable
Chao Yu <[email protected]>
f2fs: fix to check atomic_file in f2fs ioctl interfaces
Nikita Zhandarovich <[email protected]>
f2fs: avoid potential int overflow in sanity_check_area_boundary()
Nikita Zhandarovich <[email protected]>
f2fs: prevent possible int overflow in dir_block_index()
Nikita Zhandarovich <[email protected]>
f2fs: fix several potential integer overflows in file offsets
Zhen Lei <[email protected]>
debugobjects: Fix conditions in fill_pool()
Ma Ke <[email protected]>
wifi: mt76: mt7615: check devm_kasprintf() returned value
Bitterblue Smith <[email protected]>
wifi: rtw88: 8822c: Fix reported RX band width
Adrian Hunter <[email protected]>
perf/x86/intel/pt: Fix sampling synchronization
Ard Biesheuvel <[email protected]>
efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
Werner Sembach <[email protected]>
ACPI: resource: Add another DMI match for the TongFang GMxXGxx
Thomas Weißschuh <[email protected]>
ACPI: sysfs: validate return type of _STR method
Mikhail Lobanov <[email protected]>
drbd: Add NULL check for net_conf to prevent dereference in state validation
Qiu-ji Chen <[email protected]>
drbd: Fix atomicity violation in drbd_uuid_set_bm()
Pavan Kumar Paluri <[email protected]>
crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure
Mathias Nyman <[email protected]>
xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them.
Florian Fainelli <[email protected]>
tty: rp2: Fix reset with non forgiving PCIe host bridges
Jann Horn <[email protected]>
firmware_loader: Block path traversal
Fabio Porcedda <[email protected]>
bus: mhi: host: pci_generic: Fix the name for the Telit FE990A
Krzysztof Kozlowski <[email protected]>
bus: integrator-lm: fix OF node leak in probe()
Tomas Marek <[email protected]>
usb: dwc2: drd: fix clock gating on USB role switch
Pawel Laszczak <[email protected]>
usb: cdnsp: Fix incorrect usb_request status
Oliver Neukum <[email protected]>
USB: class: CDC-ACM: fix race between get_serial and set_serial
Oliver Neukum <[email protected]>
USB: misc: cypress_cy7c63: check for short transfer
Oliver Neukum <[email protected]>
USB: appledisplay: close race between probe and completion handler
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8195-cherry: Mark USB 3.0 on xhci1 as disabled
Oliver Neukum <[email protected]>
usbnet: fix cyclical race on disconnect with work queue
Finn Thain <[email protected]>
scsi: mac_scsi: Disallow bus errors during PDMA send
Finn Thain <[email protected]>
scsi: mac_scsi: Refactor polling loop
Finn Thain <[email protected]>
scsi: mac_scsi: Revise printk(KERN_DEBUG ...) messages
Martin Wilck <[email protected]>
scsi: sd: Fix off-by-one error in sd_read_block_characteristics()
Namjae Jeon <[email protected]>
ksmbd: handle caseless file creation
Namjae Jeon <[email protected]>
ksmbd: allow write with FILE_APPEND_DATA
Hobin Woo <[email protected]>
ksmbd: make __dir_empty() compatible with POSIX
Chuck Lever <[email protected]>
fs: Create a generic is_dot_dotdot() utility
Roman Smirnov <[email protected]>
KEYS: prevent NULL pointer dereference in find_asymmetric_key()
Mario Limonciello <[email protected]>
drm/amd/display: Validate backlight caps are sane
Robin Chen <[email protected]>
drm/amd/display: Round calculated vtotal
Fangzhi Zuo <[email protected]>
drm/amd/display: Skip Recompute DSC Params if no Stream on Link
Sean Christopherson <[email protected]>
KVM: x86: Move x2APIC ICR helper above kvm_apic_write_nodecode()
Sean Christopherson <[email protected]>
KVM: x86: Enforce x2APIC's must-be-zero reserved ICR bits
Werner Sembach <[email protected]>
Input: i8042 - add another board name for TUXEDO Stellaris Gen5 AMD line
Werner Sembach <[email protected]>
Input: i8042 - add TUXEDO Stellaris 15 Slim Gen6 AMD to i8042 quirk table
Werner Sembach <[email protected]>
Input: i8042 - add TUXEDO Stellaris 16 Gen5 AMD to i8042 quirk table
Nuno Sa <[email protected]>
Input: adp5588-keys - fix check on return code
Roman Smirnov <[email protected]>
Revert "media: tuners: fix error return code of hybrid_tuner_request_state()"
Krzysztof Kozlowski <[email protected]>
soc: versatile: integrator: fix OF node leak in probe() error path
Ma Ke <[email protected]>
ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer the error
Sean Anderson <[email protected]>
PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler
Frank Li <[email protected]>
PCI: imx6: Fix missing call to phy_power_off() in error handling
Laurent Pinchart <[email protected]>
Remove *.orig pattern from .gitignore
Felix Moessbauer <[email protected]>
io_uring/sqpoll: do not put cpumask on stack
Jens Axboe <[email protected]>
io_uring/sqpoll: retain test for whether the CPU is valid
Zack Rusin <[email protected]>
drm/vmwgfx: Prevent unmapping active read buffers
Scott Mayhew <[email protected]>
selinux,smack: don't bypass permissions check in inode_setsecctx hook
Ye Bin <[email protected]>
vfio/pci: fix potential memory leak in vfio_intx_enable()
Felix Moessbauer <[email protected]>
io_uring/io-wq: inherit cpuset of cgroup in io worker
Felix Moessbauer <[email protected]>
io_uring/io-wq: do not allow pinning outside of cpuset
Fangzhi Zuo <[email protected]>
drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination
Felix Moessbauer <[email protected]>
io_uring/sqpoll: do not allow pinning outside of cpuset
Simon Horman <[email protected]>
netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS
Phil Sutter <[email protected]>
netfilter: nf_tables: Keep deleted flowtable hooks until after RCU
Furong Xu <[email protected]>
net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled
Jiwon Kim <[email protected]>
bonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave()
Youssef Samir <[email protected]>
net: qrtr: Update packets cloning when broadcasting
Josh Hunt <[email protected]>
tcp: check skb is non-NULL in tcp_rto_delta_us()
Thomas Weißschuh <[email protected]>
net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL
Kaixin Wang <[email protected]>
net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
Eric Dumazet <[email protected]>
netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
Sean Anderson <[email protected]>
net: xilinx: axienet: Fix packet counting
Sean Anderson <[email protected]>
net: xilinx: axienet: Schedule NAPI in two steps
Mikulas Patocka <[email protected]>
Revert "dm: requeue IO if mapping table not yet available"
Dan Carpenter <[email protected]>
ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()
Jason Wang <[email protected]>
vhost_vdpa: assign irq bypass producer token correctly
Xie Yongji <[email protected]>
vdpa: Add eventfd for the vdpa callback
Yanfei Xu <[email protected]>
cxl/pci: Fix to record only non-zero ranges
Dave Jiang <[email protected]>
cxl/pci: Break out range register decoding from cxl_hdm_decode_init()
Suzuki K Poulose <[email protected]>
coresight: tmc: sg: Do not leak sg_table
Krzysztof Kozlowski <[email protected]>
dt-bindings: iio: asahi-kasei,ak8975: drop incorrect AK09116 compatible
Krzysztof Kozlowski <[email protected]>
iio: magnetometer: ak8975: drop incorrect AK09116 compatible
Biju Das <[email protected]>
iio: magnetometer: ak8975: Convert enum->pointer for data in the match tables
Vasileios Amoiridis <[email protected]>
iio: chemical: bme680: Fix read/write ops to device by adding mutexes
Antoniu Miclaus <[email protected]>
ABI: testing: fix admv8818 attr description
Guillaume Stols <[email protected]>
iio: adc: ad7606: fix standby gpio state to match the documentation
Guillaume Stols <[email protected]>
iio: adc: ad7606: fix oversampling gpio array
Hannes Reinecke <[email protected]>
nvme-multipath: system fails to create generic nvme device
Ming Lei <[email protected]>
lib/sbitmap: define swap_lock as raw_spinlock_t
Jinjie Ruan <[email protected]>
spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
Jinjie Ruan <[email protected]>
spi: atmel-quadspi: Undo runtime PM changes at driver exit time
Chao Yu <[email protected]>
f2fs: get rid of online repaire on corrupted directory
Chao Yu <[email protected]>
f2fs: clean up w/ dotdot_name
Chao Yu <[email protected]>
f2fs: atomic: fix to truncate pagecache before on-disk metadata truncation
Chao Yu <[email protected]>
f2fs: fix to wait page writeback before setting gcing flag
Chao Yu <[email protected]>
f2fs: fix to avoid racing in between read and OPU dio write
Christoph Hellwig <[email protected]>
f2fs: factor the read/write tracing logic into a helper
Chao Yu <[email protected]>
f2fs: reduce expensive checkpoint trigger frequency
Chao Yu <[email protected]>
f2fs: remove unneeded check condition in __f2fs_setxattr()
Chao Yu <[email protected]>
f2fs: fix to update i_ctime in __f2fs_setxattr()
Li Lingfeng <[email protected]>
nfsd: return -EINVAL when namelen is 0
Guoqing Jiang <[email protected]>
nfsd: call cache_put if xdr_reserve_space returns NULL
Dave Jiang <[email protected]>
ntb: Force physically contiguous allocation of rx ring buffers
Max Hawking <[email protected]>
ntb_perf: Fix printk format
Jinjie Ruan <[email protected]>
ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
Vitaliy Shevtsov <[email protected]>
RDMA/irdma: fix error message in irdma_modify_qp_roce()
Mikhail Lobanov <[email protected]>
RDMA/cxgb4: Added NULL check for lookup_atid
Jinjie Ruan <[email protected]>
riscv: Fix fp alignment bug in perf_callchain_user()
Junxian Huang <[email protected]>
RDMA/hns: Optimize hem allocation performance
Chengchang Tang <[email protected]>
RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS
Junxian Huang <[email protected]>
RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler
Chengchang Tang <[email protected]>
RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
wenglianfa <[email protected]>
RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()
wenglianfa <[email protected]>
RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08
Junxian Huang <[email protected]>
RDMA/hns: Don't modify rq next block addr in HIP09 QPC
Jonas Blixt <[email protected]>
watchdog: imx_sc_wdt: Don't disable WDT in suspend
Cheng Xu <[email protected]>
RDMA/erdma: Return QP state in erdma_query_qp
Alexandra Diupina <[email protected]>
PCI: kirin: Fix buffer overflow in kirin_pcie_parse_port()
Patrisious Haddad <[email protected]>
IB/core: Fix ib_cache_setup_one error flow cleanup
Wang Jianzheng <[email protected]>
pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function
Yangtao Li <[email protected]>
pinctrl: mvebu: Use devm_platform_get_and_ioremap_resource()
Jeff Layton <[email protected]>
nfsd: fix refcount leak when file is unhashed after being found
Jeff Layton <[email protected]>
nfsd: remove unneeded EEXIST error check in nfsd_do_file_acquire
David Lechner <[email protected]>
clk: ti: dra7-atl: Fix leak of of_nodes
Md Haris Iqbal <[email protected]>
RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
Jack Wang <[email protected]>
RDMA/rtrs: Reset hb_missed_cnt after receiving other traffic from peer
Yang Yingliang <[email protected]>
pinctrl: single: fix missing error code in pcs_probe()
Zhu Yanjun <[email protected]>
RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
Sean Anderson <[email protected]>
PCI: xilinx-nwl: Clean up clock on probe failure/removal
Sean Anderson <[email protected]>
PCI: xilinx-nwl: Fix register misspelling
Li Zhijian <[email protected]>
nvdimm: Fix devs leaks in scan_labels()
Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8250: use special function for Lucid 5LPE PLL
Dan Carpenter <[email protected]>
PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
Ilpo Järvinen <[email protected]>
PCI: Wait for Link before restoring Downstream Buses
Mika Westerberg <[email protected]>
PCI/PM: Drop pci_bridge_wait_for_secondary_bus() timeout parameter
Mika Westerberg <[email protected]>
PCI/PM: Increase wait time after resume
Junlin Li <[email protected]>
drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
Junlin Li <[email protected]>
drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
Emanuele Ghidoli <[email protected]>
Input: ilitek_ts_i2c - add report id message validation
Emanuele Ghidoli <[email protected]>
Input: ilitek_ts_i2c - avoid wrong input subsystem sync
Jonas Karlman <[email protected]>
clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228
Peng Fan <[email protected]>
remoteproc: imx_rproc: Initialize workqueue earlier
Peng Fan <[email protected]>
remoteproc: imx_rproc: Correct ddr alias for i.MX8M
Peng Fan <[email protected]>
clk: imx: imx8qxp: Parent should be initialized earlier than the clock
Peng Fan <[email protected]>
clk: imx: imx8qxp: Register dc0_bypass0_clk before disp clk
Zhipeng Wang <[email protected]>
clk: imx: imx8mp: fix clock tree update of TF-A managed clocks
Pengfei Li <[email protected]>
clk: imx: fracn-gppll: fix fractional part of PLL getting lost
Peng Fan <[email protected]>
clk: imx: fracn-gppll: support integer pll
Ye Li <[email protected]>
clk: imx: composite-7ulp: Check the PCC present bit
Peng Fan <[email protected]>
clk: imx: composite-8m: Enable gate clk with mcore_booted
Markus Elfring <[email protected]>
clk: imx: composite-8m: Less function calls in __imx8m_clk_hw_composite() after error detection
Ian Rogers <[email protected]>
perf time-utils: Fix 32-bit nsec parsing
Yang Jihong <[email protected]>
perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time
Yicong Yang <[email protected]>
perf stat: Display iostat headers correctly
Yang Jihong <[email protected]>
perf sched timehist: Fix missing free of session in perf_sched__timehist()
Ian Rogers <[email protected]>
perf inject: Fix leader sampling inserting additional samples
Namhyung Kim <[email protected]>
perf mem: Free the allocated sort string, fixing a leak
Daniel Borkmann <[email protected]>
bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
Daniel Borkmann <[email protected]>
bpf: Improve check_raw_mode_ok test for MEM_UNINIT-tagged types
Daniel Borkmann <[email protected]>
bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
Ryusuke Konishi <[email protected]>
nilfs2: fix potential oob read in nilfs_btree_check_delete()
Ryusuke Konishi <[email protected]>
nilfs2: determine empty node blocks as corrupted
Ryusuke Konishi <[email protected]>
nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: avoid OOB when system.data xattr changes underneath the filesystem
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: return error on ext4_find_inline_entry
Kemeng Shi <[email protected]>
ext4: avoid negative min_clusters in find_group_orlov()
Kemeng Shi <[email protected]>
ext4: avoid potential buffer_head leak in __ext4_new_inode()
Kemeng Shi <[email protected]>
ext4: avoid buffer_head leak in ext4_mark_inode_used()
Jiawei Ye <[email protected]>
smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso
yangerkun <[email protected]>
ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard
Chen Yu <[email protected]>
kthread: fix task state in kthread worker if being frozen
Lasse Collin <[email protected]>
xz: cleanup CRC32 edits from 2018
Eduard Zingerman <[email protected]>
bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos
Tony Ambardar <[email protected]>
selftests/bpf: Fix compile if backtrace support missing in libc
Jiri Olsa <[email protected]>
selftests/bpf: Move test_progs helpers to testing_helpers object
Jiri Olsa <[email protected]>
selftests/bpf: Replace extract_build_id with read_build_id
Tony Ambardar <[email protected]>
selftests/bpf: Fix C++ compile error from missing _Bool type
Tony Ambardar <[email protected]>
selftests/bpf: Fix error compiling test_lru_map.c
Tony Ambardar <[email protected]>
selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling core_reloc.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling tcp_rtt.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling flow_dissector.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling kfree_skb.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix include of <sys/fcntl.h>
Yonghong Song <[email protected]>
selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test
Yonghong Song <[email protected]>
selftests/bpf: Refactor out some functions in ns_current_pid_tgid test
Yonghong Song <[email protected]>
selftests/bpf: Replace CHECK with ASSERT_* in ns_current_pid_tgid test
Tony Ambardar <[email protected]>
selftests/bpf: Fix missing BUILD_BUG_ON() declaration
Tony Ambardar <[email protected]>
selftests/bpf: Fix missing UINT_MAX definitions in benchmarks
Tony Ambardar <[email protected]>
selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c
Tony Ambardar <[email protected]>
selftests/bpf: Fix error compiling bpf_iter_setsockopt.c with musl libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c
Tony Ambardar <[email protected]>
selftests/bpf: Use pid_t consistently in test_progs.c
Alexei Starovoitov <[email protected]>
selftests/bpf: Workaround strict bpf_lsm return value check.
Roberto Sassu <[email protected]>
selftests/bpf: Add tests for _opts variants of bpf_*_get_fd_by_id()
Yonghong Song <[email protected]>
selftests/bpf: Add selftest deny_namespace to s390x deny list
Jonathan McDowell <[email protected]>
tpm: Clean up TPM space after command failure
Juergen Gross <[email protected]>
xen/swiotlb: fix allocated size
Juergen Gross <[email protected]>
xen/swiotlb: add alignment check for dma buffers
Jason Gerecke <[email protected]>
HID: wacom: Do not warn about dropped packets for first packet
Jason Gerecke <[email protected]>
HID: wacom: Support sequence numbers smaller than 16-bit
Juergen Gross <[email protected]>
xen: use correct end address of kernel for conflict checking
Yuesong Li <[email protected]>
drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind()
Sherry Yang <[email protected]>
drm/msm: fix %s null argument error
Wolfram Sang <[email protected]>
ipmi: docs: don't advertise deprecated sysfs entries
Vladimir Lypak <[email protected]>
drm/msm/a5xx: workaround early ring-buffer emptiness check
Vladimir Lypak <[email protected]>
drm/msm/a5xx: fix races in preemption evaluation stage
Vladimir Lypak <[email protected]>
drm/msm/a5xx: properly clear preemption records on resume
Vladimir Lypak <[email protected]>
drm/msm/a5xx: disable preemption in submits by default
Aleksandr Mishin <[email protected]>
drm/msm: Fix incorrect file name output in adreno_request_fw()
Christophe Leroy <[email protected]>
powerpc/8xx: Fix kernel vs user address comparison
Christophe Leroy <[email protected]>
powerpc/8xx: Fix initial memory mapping
Fei Shao <[email protected]>
drm/mediatek: Use spin_lock_irqsave() for CRTC event lock
Jason-JH.Lin <[email protected]>
drm/mediatek: Fix missing configuration flags in mtk_crtc_ddp_config()
Jeongjun Park <[email protected]>
jfs: fix out-of-bounds in dbNextAG() and diAlloc()
Dan Carpenter <[email protected]>
scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del()
Stefan Wahren <[email protected]>
drm/vc4: hdmi: Handle error case of pm_runtime_resume_and_get
Liu Ying <[email protected]>
drm/bridge: lontium-lt8912b: Validate mode in drm_bridge_funcs::mode_valid()
Nikita Zhandarovich <[email protected]>
drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets
Jonas Karlman <[email protected]>
drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode
Alex Bee <[email protected]>
drm/rockchip: vop: Allow 4096px width scaling
WangYuli <[email protected]>
drm/amd/amdgpu: Properly tune the size of struct
Finn Thain <[email protected]>
scsi: NCR5380: Check for phase match during PDMA fixup
Gilbert Wu <[email protected]>
scsi: smartpqi: revert propagate-the-multipath-failure-to-SML-quickly
Alex Deucher <[email protected]>
drm/radeon: properly handle vbios fake edid sizing
Paulo Miguel Almeida <[email protected]>
drm/radeon: Replace one-element array with flexible-array member
Alex Deucher <[email protected]>
drm/amdgpu: properly handle vbios fake edid sizing
Paulo Miguel Almeida <[email protected]>
drm/amdgpu: Replace one-element array with flexible-array member
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
Claudiu Beznea <[email protected]>
drm/stm: ltdc: check memory returned by devm_kzalloc()
Christophe JAILLET <[email protected]>
drm/stm: Fix an error handling path in stm_drm_platform_probe()
Geert Uytterhoeven <[email protected]>
pmdomain: core: Harden inter-column space in debug summary
Miquel Raynal <[email protected]>
mtd: rawnand: mtk: Fix init error path
Miquel Raynal <[email protected]>
mtd: rawnand: mtk: Factorize out the logic cleaning mtk chips
Jinjie Ruan <[email protected]>
mtd: rawnand: mtk: Use for_each_child_of_node_scoped()
Frederic Weisbecker <[email protected]>
rcu/nocb: Fix RT throttling hrtimer armed from offline CPU
Charles Han <[email protected]>
mtd: powernv: Add check devm_kasprintf() returned value
Jason Gunthorpe <[email protected]>
iommu/amd: Do not set the D bit on AMD v2 table entries
Christophe JAILLET <[email protected]>
fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
Artur Weber <[email protected]>
power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense
Chris Morgan <[email protected]>
power: supply: axp20x_battery: Remove design from min and max voltage
Yuntao Liu <[email protected]>
hwmon: (ntc_thermistor) fix module autoloading
Mirsad Todorovac <[email protected]>
mtd: slram: insert break after errors in parsing the map
Guenter Roeck <[email protected]>
hwmon: (max16065) Fix alarm attributes
Andrew Davis <[email protected]>
hwmon: (max16065) Remove use of i2c_match_id()
Biju Das <[email protected]>
i2c: Add i2c_get_match_data()
Guenter Roeck <[email protected]>
hwmon: (max16065) Fix overflows seen when writing limits
Finn Thain <[email protected]>
m68k: Fix kernel_clone_args.flags in m68k_clone()
Yuntao Liu <[email protected]>
ALSA: hda: cs35l41: fix module autoloading
Ma Ke <[email protected]>
ASoC: rt5682s: Return devm_of_clk_add_hw_provider to transfer the error
Ankit Agrawal <[email protected]>
clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init()
Krzysztof Kozlowski <[email protected]>
reset: k210: fix OF node leak in probe() error path
Krzysztof Kozlowski <[email protected]>
reset: berlin: fix OF node leak in probe() error path
Krzysztof Kozlowski <[email protected]>
ARM: versatile: fix OF node leak in CPUs prepare
Krzysztof Kozlowski <[email protected]>
ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property
Claudiu Beznea <[email protected]>
ARM: dts: microchip: sama7g5: Fix RTT clock
Andrew Davis <[email protected]>
arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations
Alexander Dahl <[email protected]>
ARM: dts: microchip: sam9x60: Fix rtc/rtt clocks
Lad Prabhakar <[email protected]>
arm64: dts: renesas: r9a07g044: Correct GICD and GICR sizes
Lad Prabhakar <[email protected]>
arm64: dts: renesas: r9a07g054: Correct GICD and GICR sizes
Lad Prabhakar <[email protected]>
arm64: dts: renesas: r9a07g043u: Correct GICD and GICR sizes
Chen-Yu Tsai <[email protected]>
regulator: Return actual error in of_regulator_bulk_get_all()
Andy Shevchenko <[email protected]>
spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ
Cristian Marussi <[email protected]>
firmware: arm_scmi: Fix double free in OPTEE transport
David Virag <[email protected]>
arm64: dts: exynos: exynos7885-jackpotlte: Correct RAM amount to 4GB
Ma Ke <[email protected]>
spi: ppc4xx: handle irq_of_parse_and_map() errors
Riyan Dhiman <[email protected]>
block: fix potential invalid pointer dereference in blk_add_partition
Christian Heusel <[email protected]>
block: print symbolic error name instead of error code
Yu Kuai <[email protected]>
block, bfq: don't break merge chain in bfq_split_bfqq()
Yu Kuai <[email protected]>
block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator()
Yu Kuai <[email protected]>
block, bfq: fix possible UAF for bfqq->bic with merge chain
Ming Lei <[email protected]>
nbd: fix race between timeout and normal completion
Eric Dumazet <[email protected]>
ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
Su Hui <[email protected]>
net: tipc: avoid possible garbage value
Justin Iurman <[email protected]>
net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input
Heiner Kallweit <[email protected]>
r8169: disable ALDPS per default for RTL8125
Jinjie Ruan <[email protected]>
net: enetc: Use IRQF_NO_AUTOEN flag in request_irq()
Guillaume Nault <[email protected]>
bareudp: Pull inner IP header on xmit.
Guillaume Nault <[email protected]>
bareudp: Pull inner IP header in bareudp_udp_encap_recv().
Luiz Augusto von Dentz <[email protected]>
Bluetooth: btusb: Fix not handling ZPL/short-transfer
Marc Kleine-Budde <[email protected]>
can: m_can: m_can_close(): stop clocks after device has been shut down
Jake Hamby <[email protected]>
can: m_can: enable NAPI before enabling interrupts
Markus Schneider-Pargmann <[email protected]>
can: m_can: Remove repeated check for is_peripheral
Kuniyuki Iwashima <[email protected]>
can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
Eric Dumazet <[email protected]>
sock_map: Add a cond_resched() in sock_hash_free()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sync: Ignore errors from HCI_OP_REMOTE_NAME_REQ_CANCEL
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_core: Fix sending MGMT_EV_CONNECT_FAILED
Jiawei Ye <[email protected]>
wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param
Dmitry Antipov <[email protected]>
wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
Dmitry Antipov <[email protected]>
wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
Howard Hsu <[email protected]>
wifi: mt76: mt7915: fix rx filter setting for bfee functionality
Dmitry Antipov <[email protected]>
wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
Weili Qian <[email protected]>
crypto: hisilicon/qm - inject error before stopping queue
Weili Qian <[email protected]>
crypto: hisilicon/qm - reset device before enabling it
Weili Qian <[email protected]>
crypto: hisilicon/qm - fix coding style issues
Weili Qian <[email protected]>
crypto: hisilicon/hpre - mask cluster timeout error
Weili Qian <[email protected]>
crypto: hisilicon/hpre - enable sva error interrupt event
Aaron Lu <[email protected]>
x86/sgx: Fix deadlock in SGX NUMA node search
Nishanth Menon <[email protected]>
cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately
Robin Murphy <[email protected]>
perf/arm-cmn: Ensure dtm_idx is big enough
Robin Murphy <[email protected]>
perf/arm-cmn: Refactor node ID handling. Again.
Robin Murphy <[email protected]>
perf/arm-cmn: Improve debugfs pretty-printing for large configs
Robin Murphy <[email protected]>
perf/arm-cmn: Rework DTC counters (again)
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: remove annotation to access set timeout while holding lock
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject expiration higher than timeout
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject element expiration with no timeout
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
Clément Léger <[email protected]>
ACPI: CPPC: Fix MASK_VAL() usage
Zhang Changzhong <[email protected]>
can: j1939: use correct function name in comment
Mark Brown <[email protected]>
kselftest/arm64: Actually test SME vector length changes via sigreturn
Yicong Yang <[email protected]>
drivers/perf: hisi_pcie: Record hardware counts correctly
Kamlesh Gurudasani <[email protected]>
padata: Honor the caller's alignment in case of chunk_size 0
Vasily Khoruzhick <[email protected]>
ACPICA: executer/exsystem: Don't nag user about every Stall() violating the spec
Vasily Khoruzhick <[email protected]>
ACPICA: Implement ACPI_WARNING_ONCE and ACPI_ERROR_ONCE
Avraham Stern <[email protected]>
wifi: iwlwifi: mvm: increase the time between ranging measurements
Ping-Ke Shih <[email protected]>
wifi: mac80211: don't use rate mask for offchannel TX either
Jing Zhang <[email protected]>
drivers/perf: Fix ali_drw_pmu driver interrupt status clearing
Andre Przywara <[email protected]>
kselftest/arm64: signal: fix/refactor SVE vector length enumeration
Mark Brown <[email protected]>
kselftest/arm64: Fix enumeration of systems without 128 bit SME for SSVE+ZA
Mark Brown <[email protected]>
kselftest/arm64: Verify simultaneous SSVE and ZA context generation
Mark Brown <[email protected]>
kselftest/arm64: Don't pass headers to the compiler as source
Olaf Hering <[email protected]>
mount: handle OOM on mnt_warn_timestamp_expiry
Andy Shevchenko <[email protected]>
fs/namespace: fnic: Switch to use %ptTd
Andrew Jones <[email protected]>
RISC-V: KVM: Fix sbiret init before forwarding to userspace
Dmitry Kandybka <[email protected]>
wifi: rtw88: remove CPT execution branch never used
Yanteng Si <[email protected]>
net: stmmac: dwmac-loongson: Init ref and PTP clocks rate
Toke Høiland-Jørgensen <[email protected]>
wifi: ath9k: Remove error checks when creating debugfs entries
Minjie Du <[email protected]>
wifi: ath9k: fix parameter check in ath9k_init_debug()
Aleksandr Mishin <[email protected]>
ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
Helge Deller <[email protected]>
crypto: xor - fix template benchmarking
Dmitry Antipov <[email protected]>
wifi: rtw88: always wait for both firmware loading attempts
Shubhrajyoti Datta <[email protected]>
EDAC/synopsys: Fix error injection on Zynq UltraScale+
Serge Semin <[email protected]>
EDAC/synopsys: Fix ECC status and IRQ control race condition
-------------
Diffstat:
.gitignore | 1 - .../ABI/testing/sysfs-bus-iio-filter-admv8818 | 2 +- Documentation/accounting/delay-accounting.rst | 14 +- Documentation/admin-guide/kernel-parameters.txt | 10 + Documentation/arm64/silicon-errata.rst | 4 + .../iio/magnetometer/asahi-kasei,ak8975.yaml | 1 - Documentation/driver-api/ipmi.rst | 2 +- .../zh_CN/accounting/delay-accounting.rst | 17 +- Makefile | 4 +- arch/arm/boot/dts/imx7d-zii-rmu2.dts | 2 +- arch/arm/boot/dts/sam9x60.dtsi | 4 +- arch/arm/boot/dts/sama7g5.dtsi | 2 +- arch/arm/crypto/aes-ce-glue.c | 2 +- arch/arm/crypto/aes-neonbs-glue.c | 2 +- arch/arm/mach-ep93xx/clock.c | 2 +- arch/arm/mach-versatile/platsmp-realview.c | 1 + arch/arm64/Kconfig | 2 + .../boot/dts/exynos/exynos7885-jackpotlte.dts | 2 +- arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi | 1 + arch/arm64/boot/dts/qcom/sm8250.dtsi | 20 +- arch/arm64/boot/dts/renesas/r9a07g043u.dtsi | 4 +- arch/arm64/boot/dts/renesas/r9a07g044.dtsi | 4 +- arch/arm64/boot/dts/renesas/r9a07g054.dtsi | 4 +- .../boot/dts/rockchip/rk3399-pinebook-pro.dts | 4 +- arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 4 +- arch/arm64/include/asm/cputype.h | 4 + arch/arm64/kernel/cpu_errata.c | 2 + arch/loongarch/configs/loongson3_defconfig | 1 - arch/loongarch/pci/acpi.c | 1 + arch/m68k/kernel/process.c | 2 +- arch/parisc/kernel/entry.S | 6 +- arch/parisc/kernel/syscall.S | 14 +- arch/powerpc/Kconfig | 23 + arch/powerpc/Makefile | 4 + arch/powerpc/include/asm/asm-compat.h | 6 + arch/powerpc/include/asm/atomic.h | 25 +- arch/powerpc/include/asm/io.h | 37 + arch/powerpc/include/asm/uaccess.h | 33 +- arch/powerpc/include/asm/vdso_datapage.h | 15 + arch/powerpc/kernel/asm-offsets.c | 2 + arch/powerpc/kernel/head_8xx.S | 6 +- arch/powerpc/kernel/trace/ftrace.c | 2 + arch/powerpc/kernel/vdso/cacheflush.S | 2 +- arch/powerpc/kernel/vdso/datapage.S | 4 +- arch/powerpc/mm/nohash/8xx.c | 4 +- arch/powerpc/platforms/Kconfig.cputype | 24 +- arch/powerpc/platforms/pseries/dlpar.c | 17 - arch/powerpc/platforms/pseries/hotplug-cpu.c | 2 +- arch/powerpc/platforms/pseries/hotplug-memory.c | 16 +- arch/powerpc/platforms/pseries/pmem.c | 2 +- arch/riscv/Kconfig | 5 + arch/riscv/include/asm/sparsemem.h | 2 +- arch/riscv/kernel/elf_kexec.c | 6 + arch/riscv/kernel/perf_callchain.c | 2 +- arch/riscv/kvm/vcpu_sbi.c | 4 +- arch/s390/boot/Makefile | 19 +- arch/s390/include/asm/facility.h | 6 +- arch/s390/kernel/early.c | 17 +- arch/s390/kernel/perf_cpum_sf.c | 12 +- arch/s390/mm/cmm.c | 18 +- arch/x86/coco/tdx/tdx.c | 6 + arch/x86/events/core.c | 63 + arch/x86/events/intel/pt.c | 15 +- arch/x86/include/asm/hardirq.h | 8 +- arch/x86/include/asm/idtentry.h | 73 +- arch/x86/include/asm/syscall.h | 7 +- arch/x86/kernel/apic/io_apic.c | 46 +- arch/x86/kernel/cpu/sgx/main.c | 27 +- arch/x86/kernel/machine_kexec_64.c | 27 + arch/x86/kvm/lapic.c | 35 +- arch/x86/net/bpf_jit_comp.c | 54 +- arch/x86/xen/setup.c | 2 +- block/bfq-iosched.c | 44 +- block/blk-integrity.c | 175 +- block/blk-iocost.c | 8 +- block/blk.h | 10 +- block/genhd.c | 12 +- block/partitions/core.c | 8 +- crypto/asymmetric_keys/asymmetric_type.c | 7 +- crypto/simd.c | 76 +- crypto/xor.c | 31 +- drivers/acpi/acpi_pad.c | 6 +- drivers/acpi/acpica/dbconvert.c | 2 + drivers/acpi/acpica/exprep.c | 3 + drivers/acpi/acpica/exsystem.c | 11 +- drivers/acpi/acpica/psargs.c | 47 + drivers/acpi/battery.c | 28 +- drivers/acpi/cppc_acpi.c | 43 +- drivers/acpi/device_sysfs.c | 5 +- drivers/acpi/ec.c | 55 +- drivers/acpi/pmic/tps68470_pmic.c | 6 +- drivers/acpi/resource.c | 20 + drivers/acpi/video_detect.c | 8 + drivers/ata/libata-eh.c | 18 +- drivers/ata/pata_serverworks.c | 16 +- drivers/ata/sata_sil.c | 12 +- drivers/base/bus.c | 6 +- drivers/base/firmware_loader/main.c | 30 + drivers/base/power/domain.c | 2 +- drivers/block/aoe/aoecmd.c | 13 +- drivers/block/drbd/drbd_main.c | 8 +- drivers/block/drbd/drbd_state.c | 2 +- drivers/block/loop.c | 15 +- drivers/block/nbd.c | 13 +- drivers/bluetooth/btmrvl_sdio.c | 3 +- drivers/bluetooth/btusb.c | 7 +- drivers/bus/arm-integrator-lm.c | 1 + drivers/bus/mhi/host/pci_generic.c | 13 +- drivers/char/hw_random/bcm2835-rng.c | 4 +- drivers/char/hw_random/cctrng.c | 1 + drivers/char/hw_random/mtk-rng.c | 2 +- drivers/char/tpm/tpm-dev-common.c | 2 + drivers/char/tpm/tpm2-space.c | 3 + drivers/char/virtio_console.c | 18 +- drivers/clk/bcm/clk-bcm53573-ilp.c | 2 +- drivers/clk/imx/clk-composite-7ulp.c | 7 + drivers/clk/imx/clk-composite-8m.c | 61 +- drivers/clk/imx/clk-fracn-gppll.c | 72 +- drivers/clk/imx/clk-imx6ul.c | 37 +- drivers/clk/imx/clk-imx7d.c | 4 +- drivers/clk/imx/clk-imx8mp.c | 4 +- drivers/clk/imx/clk-imx8qxp.c | 10 +- drivers/clk/imx/clk.h | 7 + drivers/clk/qcom/clk-alpha-pll.c | 54 +- drivers/clk/qcom/clk-alpha-pll.h | 2 + drivers/clk/qcom/clk-rpmh.c | 2 + drivers/clk/qcom/dispcc-sm8250.c | 12 +- drivers/clk/qcom/gcc-sc8180x.c | 88 +- drivers/clk/qcom/gcc-sm8250.c | 6 +- drivers/clk/qcom/gcc-sm8450.c | 4 +- drivers/clk/rockchip/clk-rk3228.c | 2 +- drivers/clk/rockchip/clk.c | 3 +- drivers/clk/samsung/clk-exynos7885.c | 14 +- drivers/clk/ti/clk-dra7-atl.c | 1 + drivers/clocksource/timer-qcom.c | 7 +- .../drivers/ni_routing/tools/convert_c_to_py.c | 5 + drivers/cpufreq/intel_pstate.c | 20 +- drivers/cpufreq/ti-cpufreq.c | 10 +- drivers/crypto/ccp/sev-dev.c | 2 + drivers/crypto/hisilicon/hpre/hpre_main.c | 57 +- drivers/crypto/hisilicon/qm.c | 180 +- drivers/crypto/hisilicon/sec2/sec_main.c | 16 +- drivers/crypto/hisilicon/sgl.c | 1 - drivers/crypto/hisilicon/zip/zip_main.c | 23 +- drivers/cxl/core/pci.c | 60 +- drivers/dax/device.c | 2 +- drivers/edac/igen6_edac.c | 2 +- drivers/edac/synopsys_edac.c | 85 +- drivers/firmware/arm_scmi/optee.c | 7 + drivers/firmware/efi/libstub/tpm.c | 2 +- drivers/firmware/tegra/bpmp.c | 6 - drivers/gpio/gpio-aspeed.c | 4 +- drivers/gpio/gpio-davinci.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 18 +- drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h | 4 +- drivers/gpu/drm/amd/amdgpu/atombios_encoders.c | 26 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 4 + .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 1 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 22 + .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 5 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 3 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 8 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 6 +- .../gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 2 + .../gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c | 4 + drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 6 +- .../dc/dml/dcn20/display_rq_dlg_calc_20v2.c | 2 +- .../display/dc/dml/dcn21/display_rq_dlg_calc_21.c | 2 +- .../drm/amd/display/modules/freesync/freesync.c | 2 +- drivers/gpu/drm/amd/include/atombios.h | 2 +- .../drm/amd/pm/powerplay/hwmgr/processpptables.c | 2 + drivers/gpu/drm/bridge/lontium-lt8912b.c | 35 +- drivers/gpu/drm/drm_atomic_uapi.c | 2 +- drivers/gpu/drm/drm_crtc.c | 1 + drivers/gpu/drm/drm_print.c | 13 +- drivers/gpu/drm/exynos/exynos_drm_gsc.c | 2 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 2 +- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 32 +- drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 12 +- drivers/gpu/drm/msm/adreno/a5xx_gpu.h | 2 + drivers/gpu/drm/msm/adreno/a5xx_preempt.c | 30 +- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c | 2 +- drivers/gpu/drm/nouveau/nouveau_dmem.c | 2 +- drivers/gpu/drm/omapdrm/omap_drv.c | 5 + drivers/gpu/drm/radeon/atombios.h | 2 +- drivers/gpu/drm/radeon/evergreen_cs.c | 62 +- drivers/gpu/drm/radeon/r100.c | 70 +- drivers/gpu/drm/radeon/radeon_atombios.c | 26 +- drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c | 2 + drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 20 +- drivers/gpu/drm/rockchip/rockchip_drm_vop.h | 7 + drivers/gpu/drm/rockchip/rockchip_drm_vop2.h | 5 - drivers/gpu/drm/rockchip/rockchip_vop_reg.c | 20 + drivers/gpu/drm/scheduler/sched_entity.c | 2 + drivers/gpu/drm/stm/drv.c | 7 +- drivers/gpu/drm/stm/ltdc.c | 78 +- drivers/gpu/drm/v3d/v3d_perfmon.c | 9 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 8 +- drivers/gpu/drm/vc4/vc4_perfmon.c | 7 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 12 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 3 + drivers/hid/amd-sfh-hid/amd_sfh_client.c | 14 +- drivers/hid/hid-ids.h | 4 + drivers/hid/hid-multitouch.c | 14 +- drivers/hid/hid-plantronics.c | 23 + drivers/hid/intel-ish-hid/ishtp-fw-loader.c | 2 +- drivers/hid/wacom_wac.c | 13 +- drivers/hid/wacom_wac.h | 2 +- drivers/hwmon/Kconfig | 3 + drivers/hwmon/max16065.c | 27 +- drivers/hwmon/ntc_thermistor.c | 1 + drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 +- drivers/i2c/busses/i2c-aspeed.c | 16 +- drivers/i2c/busses/i2c-i801.c | 9 +- drivers/i2c/busses/i2c-isch.c | 3 +- drivers/i2c/busses/i2c-qcom-geni.c | 4 +- drivers/i2c/busses/i2c-stm32f7.c | 6 +- drivers/i2c/busses/i2c-xiic.c | 89 +- drivers/i2c/i2c-core-base.c | 58 + drivers/iio/adc/ad7606.c | 8 +- drivers/iio/adc/ad7606_spi.c | 5 +- drivers/iio/chemical/bme680_core.c | 7 + drivers/iio/magnetometer/ak8975.c | 117 +- drivers/infiniband/core/cache.c | 4 +- drivers/infiniband/core/iwcm.c | 2 +- drivers/infiniband/core/mad.c | 14 +- drivers/infiniband/hw/cxgb4/cm.c | 5 + drivers/infiniband/hw/erdma/erdma_verbs.c | 25 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 22 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 29 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 16 +- drivers/infiniband/hw/irdma/verbs.c | 2 +- drivers/infiniband/hw/mlx5/odp.c | 25 +- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 9 +- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 14 +- drivers/input/keyboard/adp5588-keys.c | 2 +- drivers/input/keyboard/adp5589-keys.c | 22 +- drivers/input/rmi4/rmi_driver.c | 6 +- drivers/input/serio/i8042-acpipnpio.h | 37 + drivers/input/touchscreen/ilitek_ts_i2c.c | 18 +- drivers/iommu/amd/io_pgtable_v2.c | 2 +- drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 7 + drivers/iommu/intel/Kconfig | 11 - drivers/iommu/intel/Makefile | 1 - drivers/iommu/intel/dmar.c | 23 +- drivers/iommu/intel/iommu.c | 6 +- drivers/iommu/intel/iommu.h | 43 +- drivers/iommu/intel/perfmon.c | 172 - drivers/iommu/intel/perfmon.h | 40 - drivers/mailbox/bcm2835-mailbox.c | 3 +- drivers/mailbox/rockchip-mailbox.c | 2 +- drivers/md/dm-rq.c | 4 +- drivers/md/dm.c | 11 +- drivers/media/common/videobuf2/videobuf2-core.c | 8 +- drivers/media/dvb-frontends/rtl2830.c | 2 +- drivers/media/dvb-frontends/rtl2832.c | 2 +- drivers/media/i2c/ar0521.c | 5 +- drivers/media/i2c/imx335.c | 43 +- drivers/media/platform/qcom/camss/camss.c | 5 +- drivers/media/platform/qcom/venus/core.c | 1 + drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c | 5 + drivers/media/tuners/tuner-i2c.h | 4 +- drivers/media/usb/usbtv/usbtv-video.c | 7 - drivers/mtd/devices/powernv_flash.c | 3 + drivers/mtd/devices/slram.c | 2 + drivers/mtd/nand/raw/mtk_nand.c | 36 +- drivers/net/bareudp.c | 26 +- drivers/net/bonding/bond_main.c | 6 +- drivers/net/can/m_can/m_can.c | 18 +- drivers/net/dsa/b53/b53_common.c | 17 +- drivers/net/dsa/lan9303-core.c | 29 + drivers/net/ethernet/adi/adin1110.c | 4 +- .../net/ethernet/aquantia/atlantic/aq_ethtool.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- drivers/net/ethernet/cortina/gemini.c | 32 +- drivers/net/ethernet/freescale/enetc/enetc.c | 3 +- drivers/net/ethernet/hisilicon/hip04_eth.c | 1 + drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 1 + drivers/net/ethernet/hisilicon/hns_mdio.c | 1 + drivers/net/ethernet/ibm/emac/mal.c | 4 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 1 + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 2 + drivers/net/ethernet/intel/ice/ice_main.c | 3 +- drivers/net/ethernet/intel/ice/ice_sched.c | 6 +- drivers/net/ethernet/intel/ice/ice_switch.c | 2 - drivers/net/ethernet/intel/igb/igb_main.c | 4 + drivers/net/ethernet/lantiq_etop.c | 4 +- drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en/tir.c | 3 + drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 1 - .../net/ethernet/mellanox/mlx5/core/lib/pci_vsc.c | 10 + drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 +- .../ethernet/mellanox/mlx5/core/sf/dev/driver.c | 1 + .../net/ethernet/microchip/sparx5/sparx5_packet.c | 6 +- .../net/ethernet/netronome/nfp/nfp_net_common.c | 5 +- drivers/net/ethernet/realtek/r8169_main.c | 31 +- drivers/net/ethernet/realtek/r8169_phy_config.c | 2 + drivers/net/ethernet/seeq/ether3.c | 2 + .../net/ethernet/stmicro/stmmac/dwmac-loongson.c | 3 + drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 18 +- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 1 + drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 37 +- drivers/net/ieee802154/Kconfig | 1 + drivers/net/ieee802154/mcr20a.c | 5 +- drivers/net/phy/bcm84881.c | 4 +- drivers/net/phy/dp83869.c | 1 - drivers/net/ppp/ppp_async.c | 2 +- drivers/net/ppp/ppp_generic.c | 4 +- drivers/net/slip/slhc.c | 57 +- drivers/net/usb/usbnet.c | 37 +- drivers/net/vxlan/vxlan_core.c | 6 +- drivers/net/vxlan/vxlan_private.h | 2 +- drivers/net/vxlan/vxlan_vnifilter.c | 19 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 2 +- drivers/net/wireless/ath/ath9k/debug.c | 6 +- drivers/net/wireless/ath/ath9k/hif_usb.c | 6 +- drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 - drivers/net/wireless/intel/iwlwifi/fw/api/scan.h | 13 + drivers/net/wireless/intel/iwlwifi/mvm/constants.h | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 42 +- drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- drivers/net/wireless/marvell/mwifiex/scan.c | 3 +- drivers/net/wireless/mediatek/mt76/mac80211.c | 8 + drivers/net/wireless/mediatek/mt76/mt76.h | 1 + drivers/net/wireless/mediatek/mt76/mt7615/init.c | 3 + drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7915/main.c | 3 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 10 +- drivers/net/wireless/microchip/wilc1000/hif.c | 4 +- drivers/net/wireless/realtek/rtw88/Kconfig | 1 + drivers/net/wireless/realtek/rtw88/coex.c | 38 +- drivers/net/wireless/realtek/rtw88/main.c | 7 +- drivers/net/wireless/realtek/rtw88/rtw8822c.c | 12 +- drivers/net/wireless/realtek/rtw89/phy.c | 4 +- drivers/net/wwan/qcom_bam_dmux.c | 11 +- drivers/net/xen-netback/hash.c | 5 +- drivers/ntb/hw/intel/ntb_hw_gen1.c | 2 +- drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 1 + drivers/ntb/ntb_transport.c | 23 +- drivers/ntb/test/ntb_perf.c | 2 +- drivers/nvdimm/namespace_devs.c | 34 +- drivers/nvdimm/nd_virtio.c | 9 + drivers/nvme/host/multipath.c | 2 +- drivers/nvme/host/nvme.h | 5 + drivers/nvme/host/pci.c | 18 +- drivers/of/irq.c | 38 +- drivers/pci/controller/dwc/pci-imx6.c | 7 +- drivers/pci/controller/dwc/pci-keystone.c | 2 +- drivers/pci/controller/dwc/pcie-kirin.c | 4 +- drivers/pci/controller/pcie-xilinx-nwl.c | 39 +- drivers/pci/pci-driver.c | 15 +- drivers/pci/pci.c | 26 +- drivers/pci/pci.h | 9 +- drivers/pci/pcie/dpc.c | 3 +- drivers/pci/quirks.c | 8 + drivers/perf/alibaba_uncore_drw_pmu.c | 2 +- drivers/perf/arm-cmn.c | 232 +- drivers/perf/hisilicon/hisi_pcie_pmu.c | 14 + drivers/pinctrl/mvebu/pinctrl-dove.c | 45 +- drivers/pinctrl/pinctrl-single.c | 3 +- .../x86/intel/speed_select_if/isst_if_common.c | 4 +- drivers/platform/x86/touchscreen_dmi.c | 26 + drivers/power/reset/brcmstb-reboot.c | 3 - drivers/power/supply/axp20x_battery.c | 16 +- drivers/power/supply/max17042_battery.c | 5 +- drivers/power/supply/power_supply_hwmon.c | 3 +- drivers/pps/clients/pps_parport.c | 14 +- drivers/regulator/of_regulator.c | 2 +- drivers/remoteproc/imx_rproc.c | 19 +- drivers/remoteproc/ti_k3_r5_remoteproc.c | 86 +- drivers/reset/reset-berlin.c | 3 +- drivers/reset/reset-k210.c | 3 +- drivers/rtc/rtc-at91sam9.c | 1 + drivers/scsi/NCR5380.c | 82 +- drivers/scsi/aacraid/aacraid.h | 2 +- drivers/scsi/elx/libefc/efc_nport.c | 2 +- drivers/scsi/lpfc/lpfc_ct.c | 12 + drivers/scsi/lpfc/lpfc_disc.h | 7 + drivers/scsi/lpfc/lpfc_els.c | 34 +- drivers/scsi/lpfc/lpfc_nportdisc.c | 22 +- drivers/scsi/lpfc/lpfc_vport.c | 43 +- drivers/scsi/mac_scsi.c | 166 +- drivers/scsi/pm8001/pm8001_init.c | 6 +- drivers/scsi/sd.c | 2 +- drivers/scsi/smartpqi/smartpqi_init.c | 22 +- drivers/scsi/wd33c93.c | 2 +- drivers/soc/versatile/soc-integrator.c | 1 + drivers/soc/versatile/soc-realview.c | 20 +- drivers/spi/atmel-quadspi.c | 1 + drivers/spi/spi-bcm63xx.c | 9 +- drivers/spi/spi-fsl-lpspi.c | 1 + drivers/spi/spi-imx.c | 2 +- drivers/spi/spi-ppc4xx.c | 7 +- drivers/spi/spi-s3c64xx.c | 4 +- drivers/staging/vme_user/vme_fake.c | 6 + drivers/staging/vme_user/vme_tsi148.c | 6 + .../int340x_thermal/processor_thermal_device_pci.c | 23 +- drivers/tty/serial/rp2.c | 2 +- drivers/usb/cdns3/cdnsp-ring.c | 6 +- drivers/usb/cdns3/host.c | 4 +- drivers/usb/chipidea/udc.c | 8 +- drivers/usb/class/cdc-acm.c | 2 + drivers/usb/dwc2/drd.c | 9 + drivers/usb/dwc2/platform.c | 26 +- drivers/usb/dwc3/core.c | 22 +- drivers/usb/dwc3/core.h | 4 - drivers/usb/dwc3/gadget.c | 11 - drivers/usb/gadget/udc/core.c | 1 + drivers/usb/host/xhci-debugfs.c | 2 +- drivers/usb/host/xhci-mem.c | 331 +- drivers/usb/host/xhci-pci.c | 22 +- drivers/usb/host/xhci-ring.c | 82 +- drivers/usb/host/xhci.c | 54 +- drivers/usb/host/xhci.h | 32 +- drivers/usb/misc/appledisplay.c | 15 +- drivers/usb/misc/cypress_cy7c63.c | 4 + drivers/usb/misc/yurex.c | 5 +- drivers/usb/storage/unusual_devs.h | 11 + drivers/vfio/pci/vfio_pci_intrs.c | 4 +- drivers/vhost/scsi.c | 25 +- drivers/vhost/vdpa.c | 18 +- drivers/video/fbdev/core/fbcon.c | 2 + drivers/video/fbdev/hpfb.c | 1 + drivers/video/fbdev/pxafb.c | 1 + drivers/video/fbdev/sis/sis_main.c | 2 +- drivers/virtio/virtio_vdpa.c | 1 + drivers/watchdog/imx_sc_wdt.c | 24 - drivers/xen/swiotlb-xen.c | 10 +- fs/btrfs/disk-io.c | 11 + fs/btrfs/relocation.c | 2 +- fs/btrfs/send.c | 23 +- fs/btrfs/zoned.c | 2 +- fs/cachefiles/namei.c | 7 +- fs/ceph/addr.c | 6 +- fs/crypto/fname.c | 8 +- fs/dax.c | 62 + fs/ecryptfs/crypto.c | 10 - fs/erofs/data.c | 50 +- fs/erofs/decompressor.c | 6 +- fs/erofs/decompressor_lzma.c | 4 +- fs/erofs/dir.c | 22 +- fs/erofs/erofs_fs.h | 5 +- fs/erofs/fscache.c | 7 +- fs/erofs/inode.c | 37 +- fs/erofs/internal.h | 34 +- fs/erofs/namei.c | 30 +- fs/erofs/super.c | 72 +- fs/erofs/xattr.c | 40 +- fs/erofs/xattr.h | 10 +- fs/erofs/zdata.c | 16 +- fs/erofs/zmap.c | 263 +- fs/exec.c | 3 +- fs/exfat/balloc.c | 10 +- fs/ext4/dir.c | 14 +- fs/ext4/extents.c | 55 +- fs/ext4/fast_commit.c | 49 +- fs/ext4/file.c | 8 +- fs/ext4/ialloc.c | 14 +- fs/ext4/inline.c | 35 +- fs/ext4/inode.c | 11 +- fs/ext4/mballoc.c | 10 +- fs/ext4/migrate.c | 2 +- fs/ext4/move_extent.c | 1 - fs/ext4/namei.c | 14 +- fs/ext4/super.c | 9 +- fs/ext4/xattr.c | 7 +- fs/f2fs/dir.c | 3 +- fs/f2fs/extent_cache.c | 4 +- fs/f2fs/f2fs.h | 24 +- fs/f2fs/file.c | 96 +- fs/f2fs/namei.c | 69 - fs/f2fs/super.c | 4 +- fs/f2fs/xattr.c | 18 +- fs/fcntl.c | 14 +- fs/file.c | 93 +- fs/inode.c | 4 + fs/iomap/buffered-io.c | 16 +- fs/jbd2/checkpoint.c | 21 +- fs/jbd2/journal.c | 4 +- fs/jfs/jfs_discard.c | 11 +- fs/jfs/jfs_dmap.c | 11 +- fs/jfs/jfs_imap.c | 2 +- fs/jfs/xattr.c | 2 + fs/namei.c | 6 +- fs/namespace.c | 21 +- fs/nfs/callback_xdr.c | 2 + fs/nfs/client.c | 1 + fs/nfs/nfs42proc.c | 2 +- fs/nfs/nfs4state.c | 3 +- fs/nfsd/filecache.c | 7 +- fs/nfsd/nfs4idmap.c | 13 +- fs/nfsd/nfs4recover.c | 8 + fs/nfsd/nfs4state.c | 5 +- fs/nfsd/nfs4xdr.c | 10 +- fs/nfsd/vfs.c | 1 + fs/nilfs2/btree.c | 12 +- fs/ntfs3/file.c | 4 +- fs/ntfs3/frecord.c | 21 +- fs/ntfs3/fslog.c | 19 +- fs/ocfs2/aops.c | 5 +- fs/ocfs2/buffer_head_io.c | 4 +- fs/ocfs2/journal.c | 7 +- fs/ocfs2/localalloc.c | 19 + fs/ocfs2/quota_local.c | 8 +- fs/ocfs2/refcounttree.c | 26 +- fs/ocfs2/xattr.c | 11 +- fs/proc/base.c | 61 +- fs/smb/client/cifsfs.c | 13 +- fs/smb/client/cifsglob.h | 2 +- fs/smb/client/smb1ops.c | 2 +- fs/smb/client/smb2ops.c | 19 +- fs/smb/server/vfs.c | 19 +- fs/unicode/mkutf8data.c | 70 - fs/unicode/utf8data.c_shipped | 6703 ++++++++++---------- fs/xfs/xfs_reflink.c | 8 +- include/acpi/acoutput.h | 5 + include/acpi/cppc_acpi.h | 2 + include/crypto/internal/simd.h | 12 +- include/drm/drm_print.h | 54 +- include/dt-bindings/clock/exynos7885.h | 4 +- include/dt-bindings/clock/imx6ul-clock.h | 7 +- include/dt-bindings/clock/qcom,gcc-sc8180x.h | 3 + include/linux/blkdev.h | 3 - include/linux/dax.h | 2 + include/linux/f2fs_fs.h | 2 +- include/linux/fdtable.h | 8 +- include/linux/fs.h | 11 + include/linux/i2c.h | 7 + include/linux/mfd/syscon/imx6q-iomuxc-gpr.h | 6 +- include/linux/nfs_fs_sb.h | 1 + include/linux/pci_ids.h | 2 + include/linux/sbitmap.h | 2 +- include/linux/uprobes.h | 2 + include/linux/usb/usbnet.h | 15 + include/linux/vdpa.h | 6 + include/linux/xarray.h | 6 + include/net/bluetooth/hci_core.h | 4 +- include/net/ip.h | 2 + include/net/mac80211.h | 7 +- include/net/mctp.h | 2 +- include/net/rtnetlink.h | 17 + include/net/sch_generic.h | 1 - include/net/sock.h | 2 + include/net/tcp.h | 21 +- include/trace/events/erofs.h | 4 +- include/trace/events/f2fs.h | 3 +- include/uapi/linux/cec.h | 6 +- include/uapi/linux/netfilter/nf_tables.h | 2 +- include/uapi/linux/snmp.h | 3 + io_uring/io-wq.c | 33 +- io_uring/io_uring.c | 15 + io_uring/net.c | 4 +- io_uring/sqpoll.c | 12 + kernel/bpf/arraymap.c | 3 + kernel/bpf/btf.c | 8 + kernel/bpf/hashtab.c | 3 + kernel/bpf/helpers.c | 6 +- kernel/bpf/syscall.c | 1 + kernel/bpf/verifier.c | 16 +- kernel/events/core.c | 6 +- kernel/events/uprobes.c | 4 +- kernel/fork.c | 30 +- kernel/jump_label.c | 52 +- kernel/kthread.c | 12 +- kernel/locking/lockdep.c | 50 +- kernel/module/Makefile | 2 +- kernel/padata.c | 6 +- kernel/rcu/rcuscale.c | 4 +- kernel/rcu/tree_nocb.h | 5 +- kernel/resource.c | 58 +- kernel/sched/psi.c | 26 +- kernel/static_call_inline.c | 13 +- kernel/trace/trace.c | 18 +- kernel/trace/trace_hwlat.c | 2 + kernel/trace/trace_osnoise.c | 2 + kernel/trace/trace_output.c | 6 +- lib/bootconfig.c | 3 +- lib/buildid.c | 88 +- lib/debugobjects.c | 5 +- lib/sbitmap.c | 4 +- lib/test_xarray.c | 93 + lib/xarray.c | 53 +- lib/xz/xz_crc32.c | 2 +- lib/xz/xz_private.h | 4 - mm/Kconfig | 25 +- mm/damon/vaddr.c | 2 + mm/filemap.c | 50 +- mm/secretmem.c | 4 +- mm/slab_common.c | 7 + mm/util.c | 2 +- net/bluetooth/hci_conn.c | 6 +- net/bluetooth/hci_core.c | 27 +- net/bluetooth/hci_event.c | 13 +- net/bluetooth/hci_sock.c | 21 +- net/bluetooth/hci_sync.c | 5 +- net/bluetooth/mgmt.c | 13 +- net/bluetooth/rfcomm/sock.c | 2 - net/bridge/br_netfilter_hooks.c | 5 + net/can/bcm.c | 4 +- net/can/j1939/transport.c | 8 +- net/core/dev.c | 12 +- net/core/filter.c | 44 +- net/core/rtnetlink.c | 29 + net/core/sock_map.c | 1 + net/ipv4/devinet.c | 6 +- net/ipv4/fib_frontend.c | 2 +- net/ipv4/icmp.c | 106 +- net/ipv4/ip_gre.c | 6 +- net/ipv4/netfilter/nf_dup_ipv4.c | 7 +- net/ipv4/netfilter/nf_reject_ipv4.c | 10 +- net/ipv4/netfilter/nft_fib_ipv4.c | 4 +- net/ipv4/proc.c | 8 +- net/ipv4/tcp_input.c | 31 +- net/ipv4/tcp_ipv4.c | 3 + net/ipv4/udp_offload.c | 22 +- net/ipv6/Kconfig | 1 + net/ipv6/icmp.c | 32 +- net/ipv6/netfilter/nf_dup_ipv6.c | 7 +- net/ipv6/netfilter/nf_reject_ipv6.c | 19 +- net/ipv6/netfilter/nft_fib_ipv6.c | 5 +- net/ipv6/proc.c | 1 + net/ipv6/route.c | 2 +- net/ipv6/rpl_iptunnel.c | 12 +- net/mac80211/chan.c | 4 +- net/mac80211/iface.c | 17 +- net/mac80211/mlme.c | 2 +- net/mac80211/offchannel.c | 1 + net/mac80211/rate.c | 2 +- net/mac80211/scan.c | 21 +- net/mac80211/tx.c | 2 +- net/mac80211/util.c | 4 +- net/mctp/af_mctp.c | 6 +- net/mctp/device.c | 32 +- net/mctp/neigh.c | 29 +- net/mctp/route.c | 33 +- net/mptcp/mib.c | 2 + net/mptcp/mib.h | 2 + net/mptcp/pm_netlink.c | 3 +- net/mptcp/protocol.c | 24 +- net/mptcp/subflow.c | 6 +- net/netfilter/nf_conntrack_netlink.c | 7 +- net/netfilter/nf_tables_api.c | 14 +- net/netfilter/xt_CHECKSUM.c | 33 +- net/netfilter/xt_CLASSIFY.c | 16 +- net/netfilter/xt_CONNSECMARK.c | 36 +- net/netfilter/xt_CT.c | 148 +- net/netfilter/xt_IDLETIMER.c | 59 +- net/netfilter/xt_LED.c | 39 +- net/netfilter/xt_NFLOG.c | 36 +- net/netfilter/xt_RATEEST.c | 39 +- net/netfilter/xt_SECMARK.c | 27 +- net/netfilter/xt_TRACE.c | 35 +- net/netfilter/xt_addrtype.c | 15 +- net/netfilter/xt_cluster.c | 33 +- net/netfilter/xt_connbytes.c | 4 +- net/netfilter/xt_connlimit.c | 39 +- net/netfilter/xt_connmark.c | 28 +- net/netfilter/xt_mark.c | 42 +- net/netlink/af_netlink.c | 3 +- net/qrtr/af_qrtr.c | 2 +- net/sched/sch_api.c | 7 +- net/sched/sch_taprio.c | 4 +- net/sctp/socket.c | 20 +- net/socket.c | 7 +- net/tipc/bcast.c | 2 +- net/tipc/bearer.c | 8 +- net/wireless/nl80211.c | 18 +- net/wireless/scan.c | 6 +- net/wireless/sme.c | 3 +- rust/macros/module.rs | 6 +- scripts/kconfig/qconf.cc | 2 +- security/Kconfig | 32 + security/bpf/hooks.c | 1 - security/selinux/hooks.c | 4 +- security/smack/smack_lsm.c | 4 +- security/smack/smackfs.c | 2 +- security/tomoyo/domain.c | 9 +- sound/core/init.c | 14 +- sound/core/oss/mixer_oss.c | 4 +- sound/pci/asihpi/hpimsgx.c | 2 +- sound/pci/hda/cs35l41_hda_spi.c | 1 + sound/pci/hda/hda_controller.h | 2 +- sound/pci/hda/hda_generic.c | 4 +- sound/pci/hda/hda_intel.c | 12 +- sound/pci/hda/patch_conexant.c | 24 +- sound/pci/hda/patch_realtek.c | 10 +- sound/pci/rme9652/hdsp.c | 6 +- sound/pci/rme9652/hdspm.c | 6 +- sound/soc/atmel/mchp-pdmc.c | 3 + sound/soc/codecs/rt5682.c | 4 +- sound/soc/codecs/rt5682s.c | 4 +- sound/soc/codecs/wsa883x.c | 16 +- sound/soc/fsl/imx-card.c | 1 + sound/usb/card.c | 6 + sound/usb/line6/podhd.c | 2 +- sound/usb/mixer.c | 35 +- sound/usb/mixer.h | 1 + sound/usb/quirks-table.h | 2283 ++----- sound/usb/quirks.c | 4 + tools/accounting/getdelays.c | 24 +- tools/arch/x86/kcpuid/kcpuid.c | 12 +- tools/iio/iio_generic_buffer.c | 4 + tools/lib/subcmd/parse-options.c | 8 +- tools/perf/builtin-inject.c | 1 + tools/perf/builtin-kmem.c | 2 + tools/perf/builtin-kvm.c | 3 + tools/perf/builtin-kwork.c | 3 + tools/perf/builtin-lock.c | 24 +- tools/perf/builtin-mem.c | 4 + tools/perf/builtin-sched.c | 160 +- tools/perf/util/hist.c | 7 +- tools/perf/util/session.c | 3 + tools/perf/util/stat-display.c | 3 +- tools/perf/util/time-utils.c | 4 +- tools/perf/util/tool.h | 1 + tools/testing/ktest/ktest.pl | 2 +- tools/testing/selftests/arm64/signal/Makefile | 8 +- tools/testing/selftests/arm64/signal/sve_helpers.c | 56 + tools/testing/selftests/arm64/signal/sve_helpers.h | 21 + .../testcases/fake_sigreturn_sme_change_vl.c | 46 +- .../testcases/fake_sigreturn_sve_change_vl.c | 30 +- .../selftests/arm64/signal/testcases/ssve_regs.c | 36 +- .../arm64/signal/testcases/ssve_za_regs.c | 146 + .../selftests/arm64/signal/testcases/sve_regs.c | 32 +- .../selftests/arm64/signal/testcases/za_no_regs.c | 32 +- .../selftests/arm64/signal/testcases/za_regs.c | 36 +- tools/testing/selftests/bpf/DENYLIST.s390x | 2 + tools/testing/selftests/bpf/bench.c | 1 + tools/testing/selftests/bpf/bench.h | 1 + .../selftests/bpf/map_tests/sk_storage_map.c | 2 +- .../selftests/bpf/prog_tests/bpf_iter_setsockopt.c | 2 +- .../testing/selftests/bpf/prog_tests/core_reloc.c | 1 + .../selftests/bpf/prog_tests/flow_dissector.c | 1 + tools/testing/selftests/bpf/prog_tests/kfree_skb.c | 1 + .../bpf/prog_tests/libbpf_get_fd_by_id_opts.c | 87 + .../selftests/bpf/prog_tests/ns_current_pid_tgid.c | 156 +- .../selftests/bpf/prog_tests/stacktrace_build_id.c | 19 +- .../bpf/prog_tests/stacktrace_build_id_nmi.c | 17 +- tools/testing/selftests/bpf/prog_tests/tcp_rtt.c | 1 + .../selftests/bpf/prog_tests/user_ringbuf.c | 1 + .../testing/selftests/bpf/progs/cg_storage_multi.h | 2 - .../bpf/progs/test_libbpf_get_fd_by_id_opts.c | 37 + .../selftests/bpf/progs/test_ns_current_pid_tgid.c | 17 +- tools/testing/selftests/bpf/test_cpp.cpp | 4 + tools/testing/selftests/bpf/test_lru_map.c | 3 +- tools/testing/selftests/bpf/test_progs.c | 110 +- tools/testing/selftests/bpf/test_progs.h | 2 - tools/testing/selftests/bpf/testing_helpers.c | 63 + tools/testing/selftests/bpf/testing_helpers.h | 9 + .../breakpoints/step_after_suspend_test.c | 5 +- .../selftests/net/forwarding/no_forwarding.sh | 2 +- tools/testing/selftests/net/net_helper.sh | 0 tools/testing/selftests/net/setup_loopback.sh | 0 tools/testing/selftests/netfilter/nft_audit.sh | 57 +- tools/testing/selftests/nolibc/nolibc-test.c | 4 +- tools/testing/selftests/vDSO/parse_vdso.c | 17 +- tools/testing/selftests/vDSO/vdso_config.h | 10 +- .../testing/selftests/vDSO/vdso_test_correctness.c | 6 + .../selftests/vm/charge_reserved_hugetlb.sh | 2 +- tools/testing/selftests/vm/write_to_hugetlbfs.c | 23 +- 762 files changed, 11900 insertions(+), 9631 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/798 EDAC/synopsys: Fix ECC status and IRQ control race condition
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serge Semin <[email protected]>
[ Upstream commit 591c946675d88dcc0ae9ff54be9d5caaee8ce1e3 ]
The race condition around the ECCCLR register access happens in the IRQ disable method called in the device remove() procedure and in the ECC IRQ handler:
1. Enable IRQ:
a. ECCCLR = EN_CE | EN_UE
2. Disable IRQ:
a. ECCCLR = 0
3. IRQ handler:
a. ECCCLR = CLR_CE | CLR_CE_CNT | CLR_CE | CLR_CE_CNT b. ECCCLR = 0
c. ECCCLR = EN_CE | EN_UE
So if the IRQ disabling procedure is called concurrently with the IRQ handler method the IRQ might be actually left enabled due to the statement 3c.
The root cause of the problem is that ECCCLR register (which since v3.10a has been called as ECCCTL) has intermixed ECC status data clear flags and the IRQ enable/disable flags. Thus the IRQ disabling (clear EN flags) and handling (write 1 to clear ECC status data) procedures must be serialised around the ECCCTL register modification to prevent the race.
So fix the problem described above by adding the spin-lock around the ECCCLR modifications and preventing the IRQ-handler from modifying the IRQs enable flags (there is no point in disabling the IRQ and then re-enabling it again within a single IRQ handler call, see the statements 3a/3b and 3c above).
Stable-dep-of: 35e6dbfe1846 ("EDAC/synopsys: Fix error injection on Zynq UltraScale+")
--- drivers/edac/synopsys_edac.c | 50 ++++++++++++++++++++++++++---------- 1 file changed, 37 insertions(+), 13 deletions(-)
drivers/edac/synopsys_edac.c +37 -13
@@ -9,6 +9,7 @@#include <linux/edac.h> #include <linux/module.h> #include <linux/platform_device.h> +#include <linux/spinlock.h> #include <linux/interrupt.h> #include <linux/of.h> #include <linux/of_device.h>
@@ -300,6 +301,7 @@ struct synps_ecc_status {/** * struct synps_edac_priv - DDR memory controller private instance data. * @baseaddr: Base address of the DDR controller. +* @reglock: Concurrent CSRs access lock. * @message: Buffer for framing the event specific info. * @stat: ECC status information. * @p_data: Platform data.
@@ -314,6 +316,7 @@ struct synps_ecc_status {*/ struct synps_edac_priv {void __iomem *baseaddr; +spinlock_t reglock;char message[SYNPS_EDAC_MSG_SIZE ];struct synps_ecc_status stat;const struct synps_platform_data *p_data;
@@ -409,7 +412,8 @@ static int zynq_get_error_info(struct synps_edac_priv *priv)static int zynqmp_get_error_info (struct synps_edac_priv *priv) {struct synps_ecc_status *p; -u32 regval, clearval =0 ; +u32 regval, clearval; +unsigned long flags;void __iomem *base; base = priv->baseaddr;
@@ -453,10 +457,14 @@ static int zynqmp_get_error_info(struct synps_edac_priv *priv) p->ueinfo.blknr = (regval &ECC_CEADDR1_BLKNR_MASK ); p->ueinfo.data =readl (base +ECC_UESYND0_OFST ); out: - clearval =ECC_CTRL_CLR_CE_ERR |ECC_CTRL_CLR_CE_ERRCNT ; - clearval |=ECC_CTRL_CLR_UE_ERR |ECC_CTRL_CLR_UE_ERRCNT ; +spin_lock_irqsave (&priv->reglock, flags); + + clearval =readl (base +ECC_CLR_OFST ) | +ECC_CTRL_CLR_CE_ERR |ECC_CTRL_CLR_CE_ERRCNT | +ECC_CTRL_CLR_UE_ERR |ECC_CTRL_CLR_UE_ERRCNT ;writel (clearval, base +ECC_CLR_OFST ); -writel (0x0 , base +ECC_CLR_OFST ); + +spin_unlock_irqrestore (&priv->reglock, flags);return 0 ; }
@@ -516,24 +524,41 @@ static void handle_error(struct mem_ctl_info *mci, struct synps_ecc_status *p)static void enable_intr (struct synps_edac_priv *priv) { +unsigned long flags; +/* Enable UE/CE Interrupts */ -if (priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR ) -writel (DDR_UE_MASK |DDR_CE_MASK , - priv->baseaddr +ECC_CLR_OFST ); -else +if (!(priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR )) {writel (DDR_QOSUE_MASK |DDR_QOSCE_MASK , priv->baseaddr +DDR_QOS_IRQ_EN_OFST ); +return ; + } + +spin_lock_irqsave (&priv->reglock, flags); + +writel (DDR_UE_MASK |DDR_CE_MASK , + priv->baseaddr +ECC_CLR_OFST ); + +spin_unlock_irqrestore (&priv->reglock, flags); }static void disable_intr (struct synps_edac_priv *priv) { +unsigned long flags; +/* Disable UE/CE Interrupts */ -if (priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR ) -writel (0x0 , priv->baseaddr +ECC_CLR_OFST ); -else +if (!(priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR )) {writel (DDR_QOSUE_MASK |DDR_QOSCE_MASK , priv->baseaddr +DDR_QOS_IRQ_DB_OFST ); + +return ; + } + +spin_lock_irqsave (&priv->reglock, flags); + +writel (0 , priv->baseaddr +ECC_CLR_OFST ); + +spin_unlock_irqrestore (&priv->reglock, flags); }/**
@@ -577,8 +602,6 @@ static irqreturn_t intr_handler(int irq, void *dev_id)/* v3.0 of the controller does not have this register */ if (!(priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR ))writel (regval, priv->baseaddr +DDR_QOS_IRQ_STAT_OFST ); -else -enable_intr (priv);return IRQ_HANDLED ; }
@@ -1360,6 +1383,7 @@ static int mc_probe(struct platform_device *pdev) priv = mci->pvt_info; priv->baseaddr = baseaddr; priv->p_data = p_data; +spin_lock_init (&priv->reglock);mc_init (mci, pdev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/798 EDAC/synopsys: Fix error injection on Zynq UltraScale+
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shubhrajyoti Datta <[email protected]>
[ Upstream commit 35e6dbfe1846caeafabb49b7575adb36b0aa2269 ]
The Zynq UltraScale+ MPSoC DDR has a disjoint memory from 2GB to 32GB. The DDR host interface has a contiguous memory so while injecting errors, the driver should remove the hole else the injection fails as the address translation is incorrect.
Introduce a get_mem_info() function pointer and set it for Zynq UltraScale+ platform to return host address.
--- drivers/edac/synopsys_edac.c | 35 ++++++++++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-)
drivers/edac/synopsys_edac.c +34 -1
@@ -10,6 +10,7 @@#include <linux/module.h> #include <linux/platform_device.h> #include <linux/spinlock.h> +#include <linux/sizes.h> #include <linux/interrupt.h> #include <linux/of.h> #include <linux/of_device.h>
@@ -338,6 +339,7 @@ struct synps_edac_priv {* @get_mtype: Get mtype. * @get_dtype: Get dtype. * @get_ecc_state: Get ECC state. +* @get_mem_info: Get EDAC memory info * @quirks: To differentiate IPs. */ struct synps_platform_data {
@@ -345,6 +347,9 @@ struct synps_platform_data {enum mem_type (*get_mtype)(const void __iomem *base);enum dev_type (*get_dtype)(const void __iomem *base);bool (*get_ecc_state)(void __iomem *base); +#ifdef CONFIG_EDAC_DEBUG +u64 (*get_mem_info)(struct synps_edac_priv *priv); +#endif int quirks; };
@@ -403,6 +408,25 @@ static int zynq_get_error_info(struct synps_edac_priv *priv)return 0 ; } +#ifdef CONFIG_EDAC_DEBUG +/** +* zynqmp_get_mem_info - Get the current memory info. +* @priv: DDR memory controller private instance data. +* +* Return: host interface address. +*/ +static u64 zynqmp_get_mem_info (struct synps_edac_priv *priv) +{ +u64 hif_addr =0 , linear_addr; + + linear_addr = priv->poison_addr; +if (linear_addr >=SZ_32G ) + linear_addr = linear_addr -SZ_32G +SZ_2G ; + hif_addr = linear_addr >>3 ; +return hif_addr; +} +#endif +/** * zynqmp_get_error_info - Get the current ECC error info. * @priv: DDR memory controller private instance data.
@@ -923,6 +947,9 @@ static const struct synps_platform_data zynqmp_edac_def = { .get_mtype = zynqmp_get_mtype, .get_dtype = zynqmp_get_dtype, .get_ecc_state = zynqmp_get_ecc_state, +#ifdef CONFIG_EDAC_DEBUG + .get_mem_info = zynqmp_get_mem_info, +#endif .quirks = (DDR_ECC_INTR_SUPPORT #ifdef CONFIG_EDAC_DEBUG | DDR_ECC_DATA_POISON_SUPPORT
@@ -976,10 +1003,16 @@ MODULE_DEVICE_TABLE(of, synps_edac_match);static void ddr_poison_setup (struct synps_edac_priv *priv) {int col =0 , row =0 , bank =0 , bankgrp =0 , rank =0 , regval; +const struct synps_platform_data *p_data;int index;ulong hif_addr =0 ; - hif_addr = priv->poison_addr >>3 ; + p_data = priv->p_data; + +if (p_data->get_mem_info) + hif_addr = p_data->get_mem_info (priv); +else + hif_addr = priv->poison_addr >>3 ;for (index =0 ; index <DDR_MAX_ROW_SHIFT ; index++) {if (priv->row_shift[index])
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/798 wifi: rtw88: always wait for both firmware loading attempts
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 0e735a4c6137262bcefe45bb52fde7b1f5fc6c4d ]
In 'rtw_wait_firmware_completion()', always wait for both (regular and wowlan) firmware loading attempts. Otherwise if 'rtw_usb_intf_init()' has failed in 'rtw_usb_probe()', 'rtw_usb_disconnect()' may issue 'ieee80211_free_hw()' when one of 'rtw_load_firmware_cb()' (usually the wowlan one) is still in progress, causing UAF detected by KASAN.
--- drivers/net/wireless/realtek/rtw88/main.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/wireless/realtek/rtw88/main.c +4 -3
@@ -1286,20 +1286,21 @@ static int rtw_wait_firmware_completion(struct rtw_dev *rtwdev) {const struct rtw_chip_info *chip = rtwdev->chip;struct rtw_fw_state *fw; +int ret =0 ; fw = &rtwdev->fw;wait_for_completion (&fw->completion);if (!fw->firmware) -return -EINVAL ; + ret = -EINVAL ;if (chip->wow_fw_name) { fw = &rtwdev->wow_fw;wait_for_completion (&fw->completion);if (!fw->firmware) -return -EINVAL ; + ret = -EINVAL ; } -return 0 ; +return ret; } static enum rtw_lps_deep_mode rtw_update_lps_deep_mode(struct rtw_dev *rtwdev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/798 crypto: xor - fix template benchmarking
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
[ Upstream commit ab9a244c396aae4aaa34b2399b82fc15ec2df8c1 ]
Commit c055e3eae0f1 ("crypto: xor - use ktime for template benchmarking") switched from using jiffies to ktime-based performance benchmarking.
This works nicely on machines which have a fine-grained ktime() clocksource as e.g. x86 machines with TSC.
But other machines, e.g. my 4-way HP PARISC server, don't have such fine-grained clocksources, which is why it seems that 800 xor loops take zero seconds, which then shows up in the logs as:
xor: measuring software checksum speed
8regs : -1018167296 MB/sec
8regs_prefetch : -1018167296 MB/sec
32regs : -1018167296 MB/sec
32regs_prefetch : -1018167296 MB/secFix this with some small modifications to the existing code to improve the algorithm to always produce correct results without introducing major delays for architectures with a fine-grained ktime() clocksource:
a) Delay start of the timing until ktime() just advanced. On machines with a fast ktime() this should be just one additional ktime() call.
b) Count the number of loops. Run at minimum 800 loops and finish earliest when the ktime() counter has progressed.
With that the throughput can now be calculated more accurately under all conditions.
v2:
- clean up coding style (noticed & suggested by Herbert Xu)
- rephrased & fixed typo in commit message
--- crypto/xor.c | 31 ++++++++++++++----------------- 1 file changed, 14 insertions(+), 17 deletions(-)
crypto/xor.c +14 -17
@@ -83,33 +83,30 @@ static void __init do_xor_speed(struct xor_block_template *tmpl, void *b1, void *b2) { int speed; -int i, j; -ktime_t min, start, diff; +unsigned long reps; +ktime_t min, start, t0; tmpl->next = template_list; template_list = tmpl;preempt_disable (); - min = (ktime_t )S64_MAX ; -for (i =0 ; i <3 ; i++) { - start =ktime_get (); -for (j =0 ; j <REPS ; j++) { -mb ();/* prevent loop optimization */ - tmpl->do_2 (BENCH_SIZE , b1, b2); -mb (); - } - diff =ktime_sub (ktime_get (), start); -if (diff < min) - min = diff; - } + reps =0 ; + t0 =ktime_get (); +/* delay start until time has advanced */ +while ((start =ktime_get ()) == t0) +cpu_relax (); +do { +mb ();/* prevent loop optimization */ + tmpl->do_2 (BENCH_SIZE , b1, b2); +mb (); + }while (reps++ <REPS || (t0 =ktime_get ()) == start); + min =ktime_sub (t0, start);preempt_enable ();// bytes/ns == GB/s, multiply by 1000 to get MB/s [not MiB/s] -if (!min) - min =1 ; - speed = (1000 *REPS *BENCH_SIZE ) / (unsigned int )ktime_to_ns (min); + speed = (1000 * reps *BENCH_SIZE ) / (unsigned int )ktime_to_ns (min); tmpl->speed = speed;pr_info (" %-16s: %5d MB/sec\n" , tmpl->name, speed);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/798 ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit 07442c46abad1d50ac82af5e0f9c5de2732c4592 ]
In tps68470_pmic_opregion_probe() pointer 'dev' is compared to NULL which is useless.
Fix this issue by removing unneeded check.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/acpi/pmic/tps68470_pmic.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/acpi/pmic/tps68470_pmic.c +2 -4
@@ -376,10 +376,8 @@ static int tps68470_pmic_opregion_probe(struct platform_device *pdev)struct tps68470_pmic_opregion *opregion;acpi_status status; -if (!dev || !tps68470_regmap) { -dev_warn (dev,"dev or regmap is NULL\n" ); -return -EINVAL ; - } +if (!tps68470_regmap) +return dev_err_probe (dev, -EINVAL ,"regmap is missing\n" );if (!handle) {dev_warn (dev,"acpi handle is NULL\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/798 wifi: ath9k: fix parameter check in ath9k_init_debug()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minjie Du <[email protected]>
[ Upstream commit 6edb4ba6fb5b946d112259f54f4657f82eb71e89 ]
Make IS_ERR() judge the debugfs_create_dir() function return in ath9k_init_debug()
Stable-dep-of: f6ffe7f01847 ("wifi: ath9k: Remove error checks when creating debugfs entries")
--- drivers/net/wireless/ath/ath9k/debug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/debug.c +1 -1
@@ -1420,7 +1420,7 @@ int ath9k_init_debug(struct ath_hw *ah) sc->debug.debugfs_phy =debugfs_create_dir ("ath9k" , sc->hw->wiphy->debugfsdir); -if (!sc->debug.debugfs_phy) +if (IS_ERR (sc->debug.debugfs_phy))return -ENOMEM ;#ifdef CONFIG_ATH_DEBUG
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/798 wifi: ath9k: Remove error checks when creating debugfs entries
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit f6ffe7f0184792c2f99aca6ae5b916683973d7d3 ]
We should not be checking the return values from debugfs creation at all: the debugfs functions are designed to handle errors of previously called functions and just transparently abort the creation of debugfs entries when debugfs is disabled. If we check the return value and abort driver initialisation, we break the driver if debugfs is disabled (such as when booting with debugfs=off).
Earlier versions of ath9k accidentally did the right thing by checking the return value, but only for NULL, not for IS_ERR(). This was "fixed" by the two commits referenced below, breaking ath9k with debugfs=off starting from the 6.6 kernel (as reported in the Bugzilla linked below).
Restore functionality by just getting rid of the return value check entirely.
--- drivers/net/wireless/ath/ath9k/debug.c | 2 -- drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 -- 2 files changed, 4 deletions(-)
drivers/net/wireless/ath/ath9k/debug.c +0 -2
@@ -1420,8 +1420,6 @@ int ath9k_init_debug(struct ath_hw *ah) sc->debug.debugfs_phy =debugfs_create_dir ("ath9k" , sc->hw->wiphy->debugfsdir); -if (IS_ERR (sc->debug.debugfs_phy)) -return -ENOMEM ;#ifdef CONFIG_ATH_DEBUG debugfs_create_file("debug", 0600, sc->debug.debugfs_phy,
drivers/net/wireless/ath/ath9k/htc_drv_debug.c +0 -2
@@ -491,8 +491,6 @@ int ath9k_htc_init_debug(struct ath_hw *ah) priv->debug.debugfs_phy =debugfs_create_dir (KBUILD_MODNAME , priv->hw->wiphy->debugfsdir); -if (IS_ERR (priv->debug.debugfs_phy)) -return -ENOMEM ;ath9k_cmn_spectral_init_debug (&priv->spec_priv, priv->debug.debugfs_phy);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/798 net: stmmac: dwmac-loongson: Init ref and PTP clocks rate
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yanteng Si <[email protected]>
[ Upstream commit c70f3163681381c15686bdd2fe56bf4af9b8aaaa ]
Reference and PTP clocks rate of the Loongson GMAC devices is 125MHz. (So is in the GNET devices which support is about to be added.) Set the respective plat_stmmacenet_data field up in accordance with that so to have the coalesce command and timestamping work correctly.
--- drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c +3 -0
@@ -35,6 +35,9 @@ static int loongson_default_data(struct plat_stmmacenet_data *plat)/* Disable RX queues routing by default */ plat->rx_queues_cfg[0 ].pkt_route =0x0 ; + plat->clk_ref_rate =125000000 ; + plat->clk_ptp_rate =125000000 ; +/* Default to phy auto-detection */ plat->phy_addr =-1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/798 wifi: rtw88: remove CPT execution branch never used
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Kandybka <[email protected]>
[ Upstream commit 77c977327dfaa9ae2e154964cdb89ceb5c7b7cf1 ]
In 'rtw_coex_action_bt_a2dp_pan', 'wl_cpt_test' and 'bt_cpt_test' are hardcoded to false, so corresponding 'table_case' and 'tdma_case' assignments are never met.
Also 'rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[1])' is never executed. Assuming that CPT was never fully implemented, remove lookalike leftovers. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/realtek/rtw88/coex.c | 38 ++++++----------------- 1 file changed, 10 insertions(+), 28 deletions(-)
drivers/net/wireless/realtek/rtw88/coex.c +10 -28
@@ -2195,7 +2195,6 @@ static void rtw_coex_action_bt_a2dp_pan(struct rtw_dev *rtwdev)struct rtw_coex_stat *coex_stat = &coex->stat;struct rtw_efuse *efuse = &rtwdev->efuse;u8 table_case, tdma_case; -bool wl_cpt_test = false, bt_cpt_test = false;rtw_dbg (rtwdev,RTW_DBG_COEX ,"[BTCoex], %s()\n" , __func__);
@@ -2203,29 +2202,16 @@ static void rtw_coex_action_bt_a2dp_pan(struct rtw_dev *rtwdev)rtw_coex_set_rf_para (rtwdev, chip->wl_rf_para_rx[0 ]);if (efuse->share_ant) {/* Shared-Ant */ -if (wl_cpt_test) { -if (coex_stat->wl_gl_busy) { - table_case =20 ; - tdma_case =17 ; - }else { - table_case =10 ; - tdma_case =15 ; - } - }else if (bt_cpt_test) { - table_case =26 ; - tdma_case =26 ; - }else { -if (coex_stat->wl_gl_busy && - coex_stat->wl_noisy_level ==0 ) - table_case =14 ; -else - table_case =10 ; +if (coex_stat->wl_gl_busy && + coex_stat->wl_noisy_level ==0 ) + table_case =14 ; +else + table_case =10 ; -if (coex_stat->wl_gl_busy) - tdma_case =15 ; -else - tdma_case =20 ; - } +if (coex_stat->wl_gl_busy) + tdma_case =15 ; +else + tdma_case =20 ; }else {/* Non-Shared-Ant */ table_case =112 ;
@@ -2236,11 +2222,7 @@ static void rtw_coex_action_bt_a2dp_pan(struct rtw_dev *rtwdev) tdma_case =120 ; } -if (wl_cpt_test) -rtw_coex_set_rf_para (rtwdev, chip->wl_rf_para_rx[1 ]); -else -rtw_coex_set_rf_para (rtwdev, chip->wl_rf_para_rx[0 ]); - +rtw_coex_set_rf_para (rtwdev, chip->wl_rf_para_rx[0 ]);rtw_coex_table (rtwdev, false, table_case);rtw_coex_tdma (rtwdev, false, tdma_case); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/798 RISC-V: KVM: Fix sbiret init before forwarding to userspace
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Jones <[email protected]>
[ Upstream commit 6b7b282e6baea06ba65b55ae7d38326ceb79cebf ]
When forwarding SBI calls to userspace ensure sbiret.error is initialized to SBI_ERR_NOT_SUPPORTED first, in case userspace neglects to set it to anything. If userspace neglects it then we can't be sure it did anything else either, so we just report it didn't do or try anything. Just init sbiret.value to zero, which is the preferred value to return when nothing special is specified.
KVM was already initializing both sbiret.error and sbiret.value, but the values used appear to come from a copy+paste of the __sbi_ecall() implementation, i.e. a0 and a1, which don't apply prior to the call being executed, nor at all when forwarding to userspace.
--- arch/riscv/kvm/vcpu_sbi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/riscv/kvm/vcpu_sbi.c +2 -2
@@ -67,8 +67,8 @@ void kvm_riscv_vcpu_sbi_forward(struct kvm_vcpu *vcpu, struct kvm_run *run) run->riscv_sbi.args[3 ] = cp->a3; run->riscv_sbi.args[4 ] = cp->a4; run->riscv_sbi.args[5 ] = cp->a5; - run->riscv_sbi.ret[0 ] = cp->a0; - run->riscv_sbi.ret[1 ] = cp->a1; + run->riscv_sbi.ret[0 ] =SBI_ERR_NOT_SUPPORTED ; + run->riscv_sbi.ret[1 ] =0 ; } void kvm_riscv_vcpu_sbi_system_reset(struct kvm_vcpu *vcpu,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/798 fs/namespace: fnic: Switch to use %ptTd
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 74e60b8b2f0fe3702710e648a31725ee8224dbdf ]
Use %ptTd instead of open-coded variant to print contents of time64_t type in human readable form.
Stable-dep-of: 4bcda1eaf184 ("mount: handle OOM on mnt_warn_timestamp_expiry")
--- fs/namespace.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
fs/namespace.c +3 -6
@@ -2615,15 +2615,12 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount * (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {char *buf = (char *)__get_free_page (GFP_KERNEL );char *mntpath = buf ?d_path (mountpoint, buf,PAGE_SIZE ) :ERR_PTR (-ENOMEM ); -struct tm tm; -time64_to_tm (sb->s_time_max,0 , &tm); - -pr_warn ("%s filesystem being %s at %s supports timestamps until %04ld (0x%llx)\n" , +pr_warn ("%s filesystem being %s at %s supports timestamps until %ptTd (0x%llx)\n" , sb->s_type->name,is_mounted (mnt) ?"remounted" :"mounted" , - mntpath, - tm.tm_year+1900 , (unsigned long long )sb->s_time_max); + mntpath, &sb->s_time_max, + (unsigned long long )sb->s_time_max);free_page ((unsigned long )buf); sb->s_iflags |=SB_I_TS_EXPIRY_WARNED ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/798 mount: handle OOM on mnt_warn_timestamp_expiry
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olaf Hering <[email protected]>
[ Upstream commit 4bcda1eaf184e308f07f9c61d3a535f9ce477ce8 ]
If no page could be allocated, an error pointer was used as format string in pr_warn.
Rearrange the code to return early in case of OOM. Also add a check for the return value of d_path.
--- fs/namespace.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
fs/namespace.c +11 -3
@@ -2613,8 +2613,15 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *if (!__mnt_is_readonly (mnt) && (!(sb->s_iflags &SB_I_TS_EXPIRY_WARNED )) && (ktime_get_real_seconds () +TIME_UPTIME_SEC_MAX > sb->s_time_max)) { -char *buf = (char *)__get_free_page (GFP_KERNEL ); -char *mntpath = buf ?d_path (mountpoint, buf,PAGE_SIZE ) :ERR_PTR (-ENOMEM ); +char *buf, *mntpath; + + buf = (char *)__get_free_page (GFP_KERNEL ); +if (buf) + mntpath =d_path (mountpoint, buf,PAGE_SIZE ); +else + mntpath =ERR_PTR (-ENOMEM ); +if (IS_ERR (mntpath)) + mntpath ="(unknown)" ; pr_warn("%s filesystem being %s at %s supports timestamps until %ptTd (0x%llx)\n", sb->s_type->name,
@@ -2622,8 +2629,9 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount * mntpath, &sb->s_time_max, (unsigned long long)sb->s_time_max); -free_page ((unsigned long )buf); sb->s_iflags |=SB_I_TS_EXPIRY_WARNED ; +if (buf) +free_page ((unsigned long )buf); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/798 kselftest/arm64: Dont pass headers to the compiler as source
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit a884f7970e57aef78c6011561e29d238e46b3a9f ]
The signal Makefile rules pass all the dependencies for each executable, including headers, to the compiler which GCC is happy enough with but clang rejects:
clang --target=aarch64-none-linux-gnu -fintegrated-as -Wall -O2 -g -I/home/broonie/git/linux/tools/testing/selftests/ -isystem /home/broonie/git/linux/usr/include -D_GNU_SOURCE -std=gnu99 -I. test_signals.c test_signals_utils.c testcases/testcases.c signals.S testcases/fake_sigreturn_bad_magic.c test_signals.h test_signals_utils.h testcases/testcases.h -o testcases/fake_sigreturn_bad_magic
clang: error: cannot specify -o when generating multiple output files
This happens because clang gets confused about what to do with the header files, failing to identify them as source. This is not amazing behaviour on clang's part and should ideally be fixed but even if that happens we'd still need a new clang release so let's instead rework the Makefile so we use variables for the lists of header and source files, allowing us to only pass the source files to the compiler and keep clang happy.
As a bonus the resulting Makefile is a bit easier to read.
Stable-dep-of: 5225b6562b9a ("kselftest/arm64: signal: fix/refactor SVE vector length enumeration")
--- tools/testing/selftests/arm64/signal/Makefile | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
tools/testing/selftests/arm64/signal/Makefile +6 -2
@@ -22,6 +22,10 @@ $(TEST_GEN_PROGS): $(PROGS) # Common test-unit targets to build common-layout test-cases executables # Needs secondary expansion to properly include the testcase c-file in pre-reqs +COMMON_SOURCES := test_signals.c test_signals_utils.c testcases/testcases.c \ + signals.S +COMMON_HEADERS := test_signals.h test_signals_utils.h testcases/testcases.h + .SECONDEXPANSION: -$(PROGS): test_signals.c test_signals_utils.c testcases/testcases.c signals.S [email protected] test_signals.h test_signals_utils.h testcases/testcases.h - $(CC) $(CFLAGS) $^ -o $@ +$(PROGS): [email protected] ${COMMON_SOURCES} ${COMMON_HEADERS} + $(CC) $(CFLAGS) ${@}.c ${COMMON_SOURCES} -o $@
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/798 kselftest/arm64: Verify simultaneous SSVE and ZA context generation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit bc69da5ff087c40d1fc4f30596f1ee1b71924577 ]
Add a test that generates SSVE and ZA context in a single signal frame to ensure that nothing is going wrong in that case for any reason.
Stable-dep-of: 5225b6562b9a ("kselftest/arm64: signal: fix/refactor SVE vector length enumeration")
--- .../arm64/signal/testcases/ssve_za_regs.c | 162 ++++++++++++++++++ 1 file changed, 162 insertions(+) create mode 100644 tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c
tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c new file +162 -0
@@ -0,0 +1,162 @@ +// SPDX-License-Identifier: GPL-2.0 +/* +* Copyright (C) 2021 ARM Limited +* +* Verify that both the streaming SVE and ZA register context in +* signal frames is set up as expected when enabled simultaneously. +*/ + +#include <signal.h> +#include <ucontext.h> +#include <sys/prctl.h> + +#include "test_signals_utils.h" +#include "testcases.h" + +static union { +ucontext_t uc; +char buf[1024 *128 ]; +} context; +static unsigned int vls[SVE_VQ_MAX ]; +unsigned int nvls =0 ; + +static bool sme_get_vls (struct tdescr *td) +{ +int vq, vl; + +/* +* Enumerate up to SVE_VQ_MAX vector lengths +*/ +for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { + vl =prctl (PR_SME_SET_VL , vq *16 ); +if (vl ==-1 ) +return false; + + vl &=PR_SME_VL_LEN_MASK ; + +/* Skip missing VLs */ + vq =sve_vq_from_vl (vl); + + vls[nvls++] = vl; + } + +/* We need at least one VL */ +if (nvls <1 ) { +fprintf (stderr,"Only %d VL supported\n" , nvls); +return false; + } + +return true; +} + +static void setup_regs (void ) +{ +/* smstart sm; real data is TODO */ + asmvolatile (".inst 0xd503437f" : : : ); + +/* smstart za; real data is TODO */ + asmvolatile (".inst 0xd503457f" : : : ); +} + +static char zeros[ZA_SIG_REGS_SIZE (SVE_VQ_MAX )]; + +static int do_one_sme_vl (struct tdescr *td,siginfo_t *si,ucontext_t *uc, +unsigned int vl) +{ +size_t offset; +struct _aarch64_ctx *head =GET_BUF_RESV_HEAD (context); +struct _aarch64_ctx *regs; +struct sve_context *ssve; +struct za_context *za; +int ret; + +fprintf (stderr,"Testing VL %d\n" , vl); + + ret =prctl (PR_SME_SET_VL , vl); +if (ret != vl) { +fprintf (stderr,"Failed to set VL, got %d\n" , ret); +return 1 ; + } + +/* +* Get a signal context which should have the SVE and ZA +* frames in it. +*/ +setup_regs (); +if (!get_current_context (td, &context.uc,sizeof (context))) +return 1 ; + + regs =get_header (head,SVE_MAGIC ,GET_BUF_RESV_SIZE (context), + &offset); +if (!regs) { +fprintf (stderr,"No SVE context\n" ); +return 1 ; + } + + ssve = (struct sve_context *)regs; +if (ssve->vl != vl) { +fprintf (stderr,"Got SSVE VL %d, expected %d\n" , ssve->vl, vl); +return 1 ; + } + +if (!(ssve->flags &SVE_SIG_FLAG_SM )) { +fprintf (stderr,"SVE_SIG_FLAG_SM not set in SVE record\n" ); +return 1 ; + } + +fprintf (stderr,"Got expected SSVE size %u and VL %d\n" , + regs->size, ssve->vl); + + regs =get_header (head,ZA_MAGIC ,GET_BUF_RESV_SIZE (context), + &offset); +if (!regs) { +fprintf (stderr,"No ZA context\n" ); +return 1 ; + } + + za = (struct za_context *)regs; +if (za->vl != vl) { +fprintf (stderr,"Got ZA VL %d, expected %d\n" , za->vl, vl); +return 1 ; + } + +fprintf (stderr,"Got expected ZA size %u and VL %d\n" , + regs->size, za->vl); + +/* We didn't load any data into ZA so it should be all zeros */ +if (memcmp (zeros, (char *)za +ZA_SIG_REGS_OFFSET , +ZA_SIG_REGS_SIZE (sve_vq_from_vl (za->vl))) !=0 ) { +fprintf (stderr,"ZA data invalid\n" ); +return 1 ; + } + +return 0 ; +} + +static int sme_regs (struct tdescr *td,siginfo_t *si,ucontext_t *uc) +{ +int i; + +for (i =0 ; i < nvls; i++) { +if (do_one_sme_vl (td, si, uc, vls[i])) +return 1 ; + } + + td->pass =1 ; + +return 0 ; +} + +struct tdescr tde = { + .name ="Streaming SVE registers" , + .descr ="Check that we get the right Streaming SVE registers reported" , +/* +* We shouldn't require FA64 but things like memset() used in the +* helpers might use unsupported instructions so for now disable +* the test unless we've got the full instruction set. +*/ + .feats_required =FEAT_SME |FEAT_SME_FA64 , + .timeout =3 , + .init = sme_get_vls, + .run = sme_regs, +};
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/798 kselftest/arm64: Fix enumeration of systems without 128 bit SME for SSVE+ZA
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit a7db82f18cd3d85ea8ef70fca5946b441187ed6d ]
The current signal handling tests for SME do not account for the fact that unlike SVE all SME vector lengths are optional so we can't guarantee that we will encounter the minimum possible VL, they will hang enumerating VLs on such systems. Abort enumeration when we find the lowest VL in the newly added ssve_za_regs test.
Stable-dep-of: 5225b6562b9a ("kselftest/arm64: signal: fix/refactor SVE vector length enumeration")
--- tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c | 4 ++++ 1 file changed, 4 insertions(+)
tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c +4 -0
@@ -34,6 +34,10 @@ static bool sme_get_vls(struct tdescr *td) vl &=PR_SME_VL_LEN_MASK ; +/* Did we find the lowest supported VL? */ +if (vq <sve_vq_from_vl (vl)) +break ; +/* Skip missing VLs */ vq =sve_vq_from_vl (vl);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/798 kselftest/arm64: signal: fix/refactor SVE vector length enumeration
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andre Przywara <[email protected]>
[ Upstream commit 5225b6562b9a7dc808d5a1e465aaf5e2ebb220cd ]
Currently a number of SVE/SME related tests have almost identical functions to enumerate all supported vector lengths. However over time the copy&pasted code has diverged, allowing some bugs to creep in:
- fake_sigreturn_sme_change_vl reports a failure, not a SKIP if only one vector length is supported (but the SVE version is fine)
- fake_sigreturn_sme_change_vl tries to set the SVE vector length, not the SME one (but the other SME tests are fine)
- za_no_regs keeps iterating forever if only one vector length is supported (but za_regs is correct)
Since those bugs seem to be mostly copy&paste ones, let's consolidate the enumeration loop into one shared function, and just call that from each test. That should fix the above bugs, and prevent similar issues from happening again.
--- tools/testing/selftests/arm64/signal/Makefile | 2 +- .../selftests/arm64/signal/sve_helpers.c | 56 +++++++++++++++++++ .../selftests/arm64/signal/sve_helpers.h | 21 +++++++ .../testcases/fake_sigreturn_sme_change_vl.c | 32 +++-------- .../testcases/fake_sigreturn_sve_change_vl.c | 30 ++-------- .../arm64/signal/testcases/ssve_regs.c | 36 +++--------- .../arm64/signal/testcases/ssve_za_regs.c | 36 +++--------- .../arm64/signal/testcases/sve_regs.c | 32 +++-------- .../arm64/signal/testcases/za_no_regs.c | 32 +++-------- .../arm64/signal/testcases/za_regs.c | 36 +++--------- 10 files changed, 132 insertions(+), 181 deletions(-) create mode 100644 tools/testing/selftests/arm64/signal/sve_helpers.c create mode 100644 tools/testing/selftests/arm64/signal/sve_helpers.h
tools/testing/selftests/arm64/signal/Makefile +1 -1
@@ -23,7 +23,7 @@ $(TEST_GEN_PROGS): $(PROGS) # Common test-unit targets to build common-layout test-cases executables # Needs secondary expansion to properly include the testcase c-file in pre-reqs COMMON_SOURCES := test_signals.c test_signals_utils.c testcases/testcases.c \ - signals.S + signals.S sve_helpers.c COMMON_HEADERS := test_signals.h test_signals_utils.h testcases/testcases.h .SECONDEXPANSION:
tools/testing/selftests/arm64/signal/sve_helpers.c new file +56 -0
56 lines not on this page · raw message
tools/testing/selftests/arm64/signal/sve_helpers.h new file +21 -0
@@ -0,0 +1,21 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* +* Copyright (C) 2024 ARM Limited +* +* Common helper functions for SVE and SME functionality. +*/ + +#ifndef __SVE_HELPERS_H__ +#define __SVE_HELPERS_H__ + +#include <stdbool.h> + +#define VLS_USE_SVE false +#define VLS_USE_SME true + +extern unsigned int vls[]; +extern unsigned int nvls; + +int sve_fill_vls (bool use_sme,int min_vls); + +#endif
tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sme_change_vl.c +8 -24
@@ -6,44 +6,28 @@* handler, this is not supported and is expected to segfault. */ +#include <kselftest.h> #include <signal.h> #include <ucontext.h> #include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" struct fake_sigframe sf; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sme_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SME ,2 ); -/* -* Enumerate up to SVE_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SVE_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; +if (!res) +return true; - vl &=PR_SME_VL_LEN_MASK ; +if (res ==KSFT_SKIP ) + td->result =KSFT_SKIP ; -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); - - vls[nvls++] = vl; - } - -/* We need at least two VLs */ -if (nvls <2 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); -return false; - } - -return true; +return false; } static int fake_sigreturn_ssve_change_vl(struct tdescr *td,
tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sve_change_vl.c +6 -24
@@ -12,40 +12,22 @@#include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" struct fake_sigframe sf; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sve_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SVE ,2 ); -/* -* Enumerate up to SVE_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SVE_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; +if (!res) +return true; - vl &=PR_SVE_VL_LEN_MASK ; - -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); - - vls[nvls++] = vl; - } - -/* We need at least two VLs */ -if (nvls <2 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); +if (res ==KSFT_SKIP ) td->result =KSFT_SKIP ; -return false; - } -return true; +return false; } static int fake_sigreturn_sve_change_vl(struct tdescr *td,
tools/testing/selftests/arm64/signal/testcases/ssve_regs.c +8 -28
@@ -6,51 +6,31 @@* set up as expected. */ +#include <kselftest.h> #include <signal.h> #include <ucontext.h> #include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" static union {ucontext_t uc;char buf[1024 *64 ]; } context; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sme_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SME ,1 ); -/* -* Enumerate up to SVE_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SME_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; - - vl &=PR_SME_VL_LEN_MASK ; - -/* Did we find the lowest supported VL? */ -if (vq <sve_vq_from_vl (vl)) -break ; +if (!res) +return true; -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); - - vls[nvls++] = vl; - } - -/* We need at least one VL */ -if (nvls <1 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); -return false; - } +if (res ==KSFT_SKIP ) + td->result =KSFT_SKIP ; -return true; +return false; }static void setup_ssve_regs (void )
tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c +8 -28
@@ -6,51 +6,31 @@* signal frames is set up as expected when enabled simultaneously. */ +#include <kselftest.h> #include <signal.h> #include <ucontext.h> #include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" static union {ucontext_t uc;char buf[1024 *128 ]; } context; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sme_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SME ,1 ); -/* -* Enumerate up to SVE_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SME_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; - - vl &=PR_SME_VL_LEN_MASK ; - -/* Did we find the lowest supported VL? */ -if (vq <sve_vq_from_vl (vl)) -break ; +if (!res) +return true; -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); - - vls[nvls++] = vl; - } - -/* We need at least one VL */ -if (nvls <1 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); -return false; - } +if (res ==KSFT_SKIP ) + td->result =KSFT_SKIP ; -return true; +return false; }static void setup_regs (void )
tools/testing/selftests/arm64/signal/testcases/sve_regs.c +8 -24
@@ -6,47 +6,31 @@* expected. */ +#include <kselftest.h> #include <signal.h> #include <ucontext.h> #include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" static union {ucontext_t uc;char buf[1024 *64 ]; } context; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sve_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SVE ,1 ); -/* -* Enumerate up to SVE_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SVE_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; - - vl &=PR_SVE_VL_LEN_MASK ; - -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); +if (!res) +return true; - vls[nvls++] = vl; - } - -/* We need at least one VL */ -if (nvls <1 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); -return false; - } +if (res ==KSFT_SKIP ) + td->result =KSFT_SKIP ; -return true; +return false; }static void setup_sve_regs (void )
tools/testing/selftests/arm64/signal/testcases/za_no_regs.c +8 -24
@@ -6,47 +6,31 @@* expected. */ +#include <kselftest.h> #include <signal.h> #include <ucontext.h> #include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" static union {ucontext_t uc;char buf[1024 *128 ]; } context; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sme_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SME ,1 ); -/* -* Enumerate up to SME_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SME_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; - - vl &=PR_SME_VL_LEN_MASK ; - -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); +if (!res) +return true; - vls[nvls++] = vl; - } - -/* We need at least one VL */ -if (nvls <1 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); -return false; - } +if (res ==KSFT_SKIP ) + td->result =KSFT_SKIP ; -return true; +return false; } static int do_one_sme_vl(struct tdescr *td, siginfo_t *si, ucontext_t *uc,
tools/testing/selftests/arm64/signal/testcases/za_regs.c +8 -28
@@ -6,51 +6,31 @@* expected. */ +#include <kselftest.h> #include <signal.h> #include <ucontext.h> #include <sys/prctl.h> #include "test_signals_utils.h" +#include "sve_helpers.h" #include "testcases.h" static union {ucontext_t uc;char buf[1024 *128 ]; } context; -static unsigned int vls[SVE_VQ_MAX ]; -unsigned int nvls =0 ;static bool sme_get_vls (struct tdescr *td) { -int vq, vl; +int res =sve_fill_vls (VLS_USE_SME ,1 ); -/* -* Enumerate up to SME_VQ_MAX vector lengths -*/ -for (vq =SVE_VQ_MAX ; vq >0 ; --vq) { - vl =prctl (PR_SME_SET_VL , vq *16 ); -if (vl ==-1 ) -return false; - - vl &=PR_SME_VL_LEN_MASK ; - -/* Did we find the lowest supported VL? */ -if (vq <sve_vq_from_vl (vl)) -break ; +if (!res) +return true; -/* Skip missing VLs */ - vq =sve_vq_from_vl (vl); - - vls[nvls++] = vl; - } - -/* We need at least one VL */ -if (nvls <1 ) { -fprintf (stderr,"Only %d VL supported\n" , nvls); -return false; - } +if (res ==KSFT_SKIP ) + td->result =KSFT_SKIP ; -return true; +return false; }static void setup_za_regs (void )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/798 drivers/perf: Fix ali_drw_pmu driver interrupt status clearing
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jing Zhang <[email protected]>
[ Upstream commit a3dd920977dccc453c550260c4b7605b280b79c3 ]
The alibaba_uncore_pmu driver forgot to clear all interrupt status in the interrupt processing function. After the PMU counter overflow interrupt occurred, an interrupt storm occurred, causing the system to hang.
Therefore, clear the correct interrupt status in the interrupt handling function to fix it.
--- drivers/perf/alibaba_uncore_drw_pmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/perf/alibaba_uncore_drw_pmu.c +1 -1
@@ -381,7 +381,7 @@ static irqreturn_t ali_drw_pmu_isr(int irq_num, void *data) }/* clear common counter intr status */ - clr_status =FIELD_PREP (ALI_DRW_PMCOM_CNT_OV_INTR_MASK ,1 ); + clr_status =FIELD_PREP (ALI_DRW_PMCOM_CNT_OV_INTR_MASK , status);writel (clr_status, drw_pmu->cfg_base +ALI_DRW_PMU_OV_INTR_CLR ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/798 wifi: mac80211: dont use rate mask for offchannel TX either
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <[email protected]>
[ Upstream commit e7a7ef9a0742dbd0818d5b15fba2c5313ace765b ]
Like the commit ab9177d83c04 ("wifi: mac80211: don't use rate mask for scanning"), ignore incorrect settings to avoid no supported rate warning reported by syzbot.
The syzbot did bisect and found cause is commit 9df66d5b9f45 ("cfg80211:
fix default HE tx bitrate mask in 2G band"), which however corrects bitmask of HE MCS and recognizes correctly settings of empty legacy rate plus HE MCS rate instead of returning -EINVAL.
As suggestions [1], follow the change of SCAN TX to consider this case of offchannel TX as well.
--- include/net/mac80211.h | 7 ++++--- net/mac80211/offchannel.c | 1 + net/mac80211/rate.c | 2 +- net/mac80211/scan.c | 2 +- net/mac80211/tx.c | 2 +- 5 files changed, 8 insertions(+), 6 deletions(-)
include/net/mac80211.h +4 -3
@@ -885,8 +885,9 @@ enum mac80211_tx_info_flags {* of their QoS TID or other priority field values. * @IEEE80211_TX_CTRL_MCAST_MLO_FIRST_TX: first MLO TX, used mostly internally * for sequence number assignment -* @IEEE80211_TX_CTRL_SCAN_TX: Indicates that this frame is transmitted -* due to scanning, not in normal operation on the interface. +* @IEEE80211_TX_CTRL_DONT_USE_RATE_MASK: Don't use rate mask for this frame +* which is transmitted due to scanning or offchannel TX, not in normal +* operation on the interface. * @IEEE80211_TX_CTRL_MLO_LINK: If not @IEEE80211_LINK_UNSPECIFIED, this * frame should be transmitted on the specific link. This really is * only relevant for frames that do not have data present, and is
@@ -907,7 +908,7 @@ enum mac80211_tx_control_flags {IEEE80211_TX_CTRL_NO_SEQNO =BIT (7 ),IEEE80211_TX_CTRL_DONT_REORDER =BIT (8 ),IEEE80211_TX_CTRL_MCAST_MLO_FIRST_TX =BIT (9 ), -IEEE80211_TX_CTRL_SCAN_TX =BIT (10 ), +IEEE80211_TX_CTRL_DONT_USE_RATE_MASK =BIT (10 ), IEEE80211_TX_CTRL_MLO_LINK = 0xf0000000, };
net/mac80211/offchannel.c +1 -0
@@ -940,6 +940,7 @@ int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev, }IEEE80211_SKB_CB (skb)->flags = flags; +IEEE80211_SKB_CB (skb)->control.flags |=IEEE80211_TX_CTRL_DONT_USE_RATE_MASK ; skb->dev = sdata->dev;
net/mac80211/rate.c +1 -1
@@ -890,7 +890,7 @@ void ieee80211_get_tx_rates(struct ieee80211_vif *vif,if (ieee80211_is_tx_data (skb))rate_control_apply_mask (sdata, sta, sband, dest, max_rates); -if (!(info->control.flags &IEEE80211_TX_CTRL_SCAN_TX )) +if (!(info->control.flags &IEEE80211_TX_CTRL_DONT_USE_RATE_MASK )) mask = sdata->rc_rateidx_mask[info->band];if (dest[0 ].idx <0 )
net/mac80211/scan.c +1 -1
@@ -647,7 +647,7 @@ static void ieee80211_send_scan_probe_req(struct ieee80211_sub_if_data *sdata,cpu_to_le16 (IEEE80211_SN_TO_SEQ (sn)); }IEEE80211_SKB_CB (skb)->flags |= tx_flags; -IEEE80211_SKB_CB (skb)->control.flags |=IEEE80211_TX_CTRL_SCAN_TX ; +IEEE80211_SKB_CB (skb)->control.flags |=IEEE80211_TX_CTRL_DONT_USE_RATE_MASK ;ieee80211_tx_skb_tid_band (sdata, skb,7 , channel->band); } }
net/mac80211/tx.c +1 -1
@@ -721,7 +721,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx) txrc.skb = tx->skb; txrc.reported_rate.idx =-1 ; -if (unlikely (info->control.flags &IEEE80211_TX_CTRL_SCAN_TX )) { +if (unlikely (info->control.flags &IEEE80211_TX_CTRL_DONT_USE_RATE_MASK )) { txrc.rate_idx_mask = ~0 ; }else { txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[info->band];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/798 wifi: iwlwifi: mvm: increase the time between ranging measurements
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avraham Stern <[email protected]>
[ Upstream commit 3a7ee94559dfd640604d0265739e86dec73b64e8 ]
The algo running in fw may take a little longer than 5 milliseconds, (e.g. measurement on 80MHz while associated). Increase the minimum time between measurements to 7 milliseconds.
--- drivers/net/wireless/intel/iwlwifi/mvm/constants.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/constants.h +1 -1
@@ -103,7 +103,7 @@#define IWL_MVM_FTM_INITIATOR_SECURE_LTF false#define IWL_MVM_FTM_RESP_NDP_SUPPORT true#define IWL_MVM_FTM_RESP_LMR_FEEDBACK_SUPPORT true -#define IWL_MVM_FTM_NON_TB_MIN_TIME_BETWEEN_MSR 5 +#define IWL_MVM_FTM_NON_TB_MIN_TIME_BETWEEN_MSR 7#define IWL_MVM_FTM_NON_TB_MAX_TIME_BETWEEN_MSR 1000#define IWL_MVM_D3_DEBUG false#define IWL_MVM_USE_TWT true
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/798 ACPICA: Implement ACPI_WARNING_ONCE and ACPI_ERROR_ONCE
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Khoruzhick <[email protected]>
[ Upstream commit 632b746b108e3c62e0795072d00ed597371c738a ]
ACPICA commit 2ad4e6e7c4118f4cdfcad321c930b836cec77406
In some cases it is not practical nor useful to nag user about some firmware errors that they cannot fix. Add a macro that will print a warning or error only once to be used in these cases.
Stable-dep-of: c82c507126c9 ("ACPICA: executer/exsystem: Don't nag user about every Stall() violating the spec")
--- include/acpi/acoutput.h | 5 +++++ 1 file changed, 5 insertions(+)
include/acpi/acoutput.h +5 -0
@@ -193,6 +193,7 @@*/ #ifndef ACPI_NO_ERROR_MESSAGES #define AE_INFO _acpi_module_name, __LINE__ +#define ACPI_ONCE (_fn, _plist) { static char _done; if (!_done) { _done = 1; _fn _plist; } }/* * Error reporting. Callers module and line number are inserted by AE_INFO,
@@ -201,8 +202,10 @@*/ #define ACPI_INFO (plist) acpi_info plist#define ACPI_WARNING (plist) acpi_warning plist +#define ACPI_WARNING_ONCE (plist) ACPI_ONCE(acpi_warning, plist)#define ACPI_EXCEPTION (plist) acpi_exception plist#define ACPI_ERROR (plist) acpi_error plist +#define ACPI_ERROR_ONCE (plist) ACPI_ONCE(acpi_error, plist)#define ACPI_BIOS_WARNING (plist) acpi_bios_warning plist#define ACPI_BIOS_EXCEPTION (plist) acpi_bios_exception plist#define ACPI_BIOS_ERROR (plist) acpi_bios_error plist
@@ -214,8 +217,10 @@#define ACPI_INFO (plist)#define ACPI_WARNING (plist) +#define ACPI_WARNING_ONCE (plist)#define ACPI_EXCEPTION (plist)#define ACPI_ERROR (plist) +#define ACPI_ERROR_ONCE (plist)#define ACPI_BIOS_WARNING (plist)#define ACPI_BIOS_EXCEPTION (plist)#define ACPI_BIOS_ERROR (plist)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/798 ACPICA: executer/exsystem: Dont nag user about every Stall() violating the spec
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Khoruzhick <[email protected]>
[ Upstream commit c82c507126c9c9db350be28f14c83fad1c7969ae ]
ACPICA commit 129b75516fc49fe1fd6b8c5798f86c13854630b3
Stop nagging user about every Stall() that violates the spec
On my Dell XPS 15 7590 I get hundreds of these warnings after few hours of uptime:
$ dmesg | grep "fix the firmware" | wc -l 261
I cannot fix the firmware and I doubt that Dell cares about 4 year old laptop either
--- drivers/acpi/acpica/exsystem.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/acpi/acpica/exsystem.c +6 -5
@@ -133,14 +133,15 @@ acpi_status acpi_ex_system_do_stall(u32 how_long_us)* (ACPI specifies 100 usec as max, but this gives some slack in * order to support existing BIOSs) */ -ACPI_ERROR ((AE_INFO , -"Time parameter is too large (%u)" , how_long_us)); +ACPI_ERROR_ONCE ((AE_INFO , +"Time parameter is too large (%u)" , + how_long_us)); status =AE_AML_OPERAND_VALUE ; }else {if (how_long_us >100 ) { -ACPI_WARNING ((AE_INFO , -"Time parameter %u us > 100 us violating ACPI spec, please fix the firmware." , - how_long_us)); +ACPI_WARNING_ONCE ((AE_INFO , +"Time parameter %u us > 100 us violating ACPI spec, please fix the firmware." , + how_long_us)); }acpi_os_stall (how_long_us); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/798 padata: Honor the callers alignment in case of chunk_size 0
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamlesh Gurudasani <[email protected]>
[ Upstream commit 24cc57d8faaa4060fd58adf810b858fcfb71a02f ]
In the case where we are forcing the ps.chunk_size to be at least 1, we are ignoring the caller's alignment.
Move the forcing of ps.chunk_size to be at least 1 before rounding it up to caller's alignment, so that caller's alignment is honored.
While at it, use max() to force the ps.chunk_size to be at least 1 to improve readability.
--- kernel/padata.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/padata.c +3 -0
@@ -503,9 +503,12 @@ void __init padata_do_multithreaded(struct padata_mt_job *job)* thread function. Load balance large jobs between threads by * increasing the number of chunks, guarantee at least the minimum * chunk size from the caller, and honor the caller's alignment. +* Ensure chunk_size is at least 1 to prevent divide-by-0 +* panic in padata_mt_helper(). */ ps.chunk_size = job->size / (ps.nworks * load_balance_factor); ps.chunk_size =max (ps.chunk_size, job->min_chunk); + ps.chunk_size =max (ps.chunk_size,1ul ); ps.chunk_size =roundup (ps.chunk_size, job->align);/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/798 drivers/perf: hisi_pcie: Record hardware counts correctly
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yicong Yang <[email protected]>
[ Upstream commit daecd3373a16a039ad241086e30a1ec46fc9d61f ]
Currently we set the period and record it as the initial value of the counter without checking it's set to the hardware successfully or not. However the counter maybe unwritable if the target event is unsupported by the device. In such case we will pass user a wrong count:
[start counts when setting the period]hwc->prev_count = 0x8000000000000000 device.counter_value = 0 // the counter is not set as the period [when user reads the counter]event->count = device.counter_value - hwc->prev_count
= 0x8000000000000000 // wrong. should be 0.
Fix this by record the hardware counter counts correctly when setting the period.
--- drivers/perf/hisilicon/hisi_pcie_pmu.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/perf/hisilicon/hisi_pcie_pmu.c +14 -0
@@ -447,10 +447,24 @@ static void hisi_pcie_pmu_set_period(struct perf_event *event)struct hisi_pcie_pmu *pcie_pmu =to_pcie_pmu (event->pmu);struct hw_perf_event *hwc = &event->hw;int idx = hwc->idx; +u64 orig_cnt, cnt; + + orig_cnt =hisi_pcie_pmu_read_counter (event);local64_set (&hwc->prev_count,HISI_PCIE_INIT_VAL );hisi_pcie_pmu_writeq (pcie_pmu,HISI_PCIE_CNT , idx,HISI_PCIE_INIT_VAL );hisi_pcie_pmu_writeq (pcie_pmu,HISI_PCIE_EXT_CNT , idx,HISI_PCIE_INIT_VAL ); + +/* +* The counter maybe unwritable if the target event is unsupported. +* Check this by comparing the counts after setting the period. If +* the counts stay unchanged after setting the period then update +* the hwc->prev_count correctly. Otherwise the final counts user +* get maybe totally wrong. +*/ + cnt =hisi_pcie_pmu_read_counter (event); +if (orig_cnt == cnt) +local64_set (&hwc->prev_count, cnt); }static void hisi_pcie_pmu_enable_counter (struct hisi_pcie_pmu *pcie_pmu,struct hw_perf_event *hwc)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/798 kselftest/arm64: Actually test SME vector length changes via sigreturn
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit 6f0315330af7a57c1c00587fdfb69c7778bf1c50 ]
The test case for SME vector length changes via sigreturn use a bit too much cut'n'paste and only actually changed the SVE vector length in the test itself. Andre's recent factoring out of the initialisation code caused this to be exposed and the test to start failing. Fix the test to actually cover the thing it's supposed to test.
--- .../testcases/fake_sigreturn_sme_change_vl.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sme_change_vl.c +7 -7
@@ -35,30 +35,30 @@ static int fake_sigreturn_ssve_change_vl(struct tdescr *td, {size_t resv_sz, offset;struct _aarch64_ctx *head =GET_SF_RESV_HEAD (sf); -struct sve_context *sve; +struct za_context *za;/* Get a signal context with a SME ZA frame in it */ if (!get_current_context (td, &sf.uc,sizeof (sf.uc)))return 1 ; resv_sz =GET_SF_RESV_SIZE (sf); - head =get_header (head,SVE_MAGIC , resv_sz, &offset); + head =get_header (head,ZA_MAGIC , resv_sz, &offset);if (!head) { -fprintf (stderr,"No SVE context\n" ); +fprintf (stderr,"No ZA context\n" );return 1 ; } -if (head->size !=sizeof (struct sve_context )) { +if (head->size !=sizeof (struct za_context )) {fprintf (stderr,"Register data present, aborting\n" );return 1 ; } - sve = (struct sve_context *)head; + za = (struct za_context *)head;/* No changes are supported; init left us at minimum VL so go to max */ fprintf (stderr,"Attempting to change VL from %d to %d\n" , - sve->vl, vls[0 ]); - sve->vl = vls[0 ]; + za->vl, vls[0 ]); + za->vl = vls[0 ];fake_sigreturn (&sf,sizeof (sf),0 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/798 can: j1939: use correct function name in comment
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Changzhong <[email protected]>
[ Upstream commit dc2ddcd136fe9b6196a7dd01f75f824beb02d43f ]
The function j1939_cancel_all_active_sessions() was renamed to j1939_cancel_active_session() but name in comment wasn't updated.
--- net/can/j1939/transport.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/can/j1939/transport.c +4 -4
@@ -1179,10 +1179,10 @@ static enum hrtimer_restart j1939_tp_txtimer(struct hrtimer *hrtimer)break ;case -ENETDOWN :/* In this case we should get a netdev_event(), all active -* sessions will be cleared by -* j1939_cancel_all_active_sessions(). So handle this as an -* error, but let j1939_cancel_all_active_sessions() do the -* cleanup including propagation of the error to user space. +* sessions will be cleared by j1939_cancel_active_session(). +* So handle this as an error, but let +* j1939_cancel_active_session() do the cleanup including +* propagation of the error to user space. */ break ;case -EOVERFLOW :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/798 ACPI: CPPC: Fix MASK_VAL() usage
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Léger <[email protected]>
[ Upstream commit 60949b7b805424f21326b450ca4f1806c06d982e ]
MASK_VAL() was added as a way to handle bit_offset and bit_width for registers located in system memory address space. However, while suited for reading, it does not work for writing and result in corrupted registers when writing values with bit_offset > 0. Moreover, when a register is collocated with another one at the same address but with a different mask, the current code results in the other registers being overwritten with 0s. The write procedure for SYSTEM_MEMORY registers should actually read the value, mask it, update it and write it with the updated value. Moreover, since registers can be located in the same word, we must take care of locking the access before doing it. We should potentially use a global lock since we don't know in if register addresses aren't shared with another _CPC package but better not encourage vendors to do so. Assume that registers can use the same word inside a _CPC package and thus, use a per _CPC package lock.
--- drivers/acpi/cppc_acpi.c | 43 ++++++++++++++++++++++++++++++++++++---- include/acpi/cppc_acpi.h | 2 ++ 2 files changed, 41 insertions(+), 4 deletions(-)
drivers/acpi/cppc_acpi.c +39 -4
@@ -167,8 +167,11 @@ show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time);#define GET_BIT_WIDTH (reg) ((reg)->access_width ? (8 << ((reg)->access_width - 1)) : (reg)->bit_width)/* Shift and apply the mask for CPC reads/writes */ -#define MASK_VAL (reg, val) (((val) >> (reg)->bit_offset) & \ +#define MASK_VAL_READ (reg, val) (((val) >> (reg)->bit_offset) & \ GENMASK(((reg)->bit_width) - 1, 0)) +#define MASK_VAL_WRITE (reg, prev_val, val) \ + ((((val) & GENMASK(((reg)->bit_width) - 1, 0)) << (reg)->bit_offset) | \ + ((prev_val) & ~(GENMASK(((reg)->bit_width) - 1, 0) << (reg)->bit_offset))) \static ssize_t show_feedback_ctrs (struct kobject *kobj,struct kobj_attribute *attr,char *buf)
@@ -851,6 +854,7 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr)/* Store CPU Logical ID */ cpc_ptr->cpu_id = pr->id; +spin_lock_init (&cpc_ptr->rmw_lock);/* Parse PSD data for this CPU */ ret =acpi_get_psd (cpc_ptr, handle);
@@ -1056,7 +1060,7 @@ static int cpc_read(int cpu, struct cpc_register_resource *reg_res, u64 *val) }if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) - *val =MASK_VAL (reg, *val); + *val =MASK_VAL_READ (reg, *val);return 0 ; }
@@ -1065,9 +1069,11 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val) {int ret_val =0 ;int size; +u64 prev_val;void __iomem *vaddr =NULL ;int pcc_ss_id =per_cpu (cpu_pcc_subspace_idx, cpu);struct cpc_reg *reg = ®_res->cpc_entry.reg; +struct cpc_desc *cpc_desc; size =GET_BIT_WIDTH (reg);
@@ -1100,8 +1106,34 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)return acpi_os_write_memory ((acpi_physical_address )reg->address, val, size); -if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) - val =MASK_VAL (reg, val); +if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) { + cpc_desc =per_cpu (cpc_desc_ptr, cpu); +if (!cpc_desc) { +pr_debug ("No CPC descriptor for CPU:%d\n" , cpu); +return -ENODEV ; + } + +spin_lock (&cpc_desc->rmw_lock); +switch (size) { +case 8 : + prev_val =readb_relaxed (vaddr); +break ; +case 16 : + prev_val =readw_relaxed (vaddr); +break ; +case 32 : + prev_val =readl_relaxed (vaddr); +break ; +case 64 : + prev_val =readq_relaxed (vaddr); +break ; +default : +spin_unlock (&cpc_desc->rmw_lock); +return -EFAULT ; + } + val =MASK_VAL_WRITE (reg, prev_val, val); + val |= prev_val; + }switch (size) {case 8 :
@@ -1128,6 +1160,9 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)break ; } +if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) +spin_unlock (&cpc_desc->rmw_lock); +return ret_val; }
include/acpi/cppc_acpi.h +2 -0
@@ -64,6 +64,8 @@ struct cpc_desc {int cpu_id;int write_cmd_status;int write_cmd_id; +/* Lock used for RMW operations in cpc_write() */ +spinlock_t rmw_lock;struct cpc_register_resource cpc_regs[MAX_CPC_REG_ENT ];struct acpi_psd_package domain_info;struct kobject kobj;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/798 netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit e0c47281723f301894c14e6f5cd5884fdfb813f9 ]
Element timeout that is below CONFIG_HZ never expires because the timeout extension is not allocated given that nf_msecs_to_jiffies64() returns 0. Set timeout to the minimum value to honor timeout.
--- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +1 -1
@@ -4223,7 +4223,7 @@ int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)return -ERANGE ; ms *=NSEC_PER_MSEC ; - *result =nsecs_to_jiffies64 (ms); + *result =nsecs_to_jiffies64 (ms) ? : !!ms;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/798 netfilter: nf_tables: reject element expiration with no timeout
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit d2dc429ecb4e79ad164028d965c00f689e6f6d06 ]
If element timeout is unset and set provides no default timeout, the element expiration is silently ignored, reject this instead to let user know this is unsupported.
Also prepare for supporting timeout that never expire, where zero timeout and expiration must be also rejected.
--- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nf_tables_api.c +3 -0
@@ -6411,6 +6411,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,if (nla[NFTA_SET_ELEM_EXPIRATION ] !=NULL ) {if (!(set->flags &NFT_SET_TIMEOUT ))return -EINVAL ; +if (timeout ==0 ) +return -EOPNOTSUPP ; + err =nf_msecs_to_jiffies64 (nla[NFTA_SET_ELEM_EXPIRATION ], &expiration);if (err)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/798 netfilter: nf_tables: reject expiration higher than timeout
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit c0f38a8c60174368aed1d0f9965d733195f15033 ]
Report ERANGE to userspace if user specifies an expiration larger than the timeout.
--- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nf_tables_api.c +3 -0
@@ -6418,6 +6418,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, &expiration);if (err)return err; + +if (expiration > timeout) +return -ERANGE ; }if (nla[NFTA_SET_ELEM_EXPR ]) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/798 netfilter: nf_tables: remove annotation to access set timeout while holding lock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 15d8605c0cf4fc9cf4386cae658c68a0fd4bdb92 ]
Mutex is held when adding an element, no need for READ_ONCE, remove it.
--- net/netfilter/nf_tables_api.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +2 -2
@@ -6404,7 +6404,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,return err; }else if (set->flags &NFT_SET_TIMEOUT && !(flags &NFT_SET_ELEM_INTERVAL_END )) { - timeout =READ_ONCE (set->timeout); + timeout = set->timeout; } expiration =0 ;
@@ -6511,7 +6511,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,if (err <0 ) goto err_parse_key_end; -if (timeout !=READ_ONCE (set->timeout)) { +if (timeout != set->timeout) { err =nft_set_ext_add (&tmpl,NFT_SET_EXT_TIMEOUT );if (err <0 ) goto err_parse_key_end;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/798 perf/arm-cmn: Rework DTC counters (again)
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
[ Upstream commit 7633ec2c262fab3e7c5bf3cd3876b5748f584a57 ]
The bitmap-based scheme for tracking DTC counter usage turns out to be a complete dead-end for its imagined purpose, since by the time we have to keep track of a per-DTC counter index anyway, we already have enough information to make the bitmap itself redundant. Revert the remains of it back to almost the original scheme, but now expanded to track per-DTC indices, in preparation for making use of them in anger.
Note that since cycle count events always use a dedicated counter on a single DTC, we reuse the field to encode their DTC index directly.
Stable-dep-of: e79634b53e39 ("perf/arm-cmn: Refactor node ID handling. Again.")
--- drivers/perf/arm-cmn.c | 126 +++++++++++++++++++++-------------------- 1 file changed, 64 insertions(+), 62 deletions(-)
drivers/perf/arm-cmn.c +64 -62
@@ -273,16 +273,13 @@ struct arm_cmn_node {u16 id, logid;enum cmn_node_type type; -int dtm; -union { -/* DN/HN-F/CXHA */ -struct { -u8 val :4 ; -u8 count :4 ; - } occupid[SEL_MAX ]; -/* XP */ -u8 dtc; - }; +u8 dtm; +s8 dtc; +/* DN/HN-F/CXHA */ +struct { +u8 val :4 ; +u8 count :4 ; + } occupid[SEL_MAX ];union {u8 event[4 ];__le32 event_sel;
@@ -532,12 +529,12 @@ static int arm_cmn_map_show(struct seq_file *s, void *data)seq_puts (s,"\n |" );for (x =0 ; x < cmn->mesh_x; x++) { -u8 dtc = cmn->xps[xp_base + x].dtc; +s8 dtc = cmn->xps[xp_base + x].dtc; -if (dtc & (dtc -1 )) +if (dtc <0 )seq_puts (s," DTC ?? |" );else -seq_printf (s," DTC %ld |" ,__ffs (dtc)); +seq_printf (s," DTC %d |" , dtc); }seq_puts (s,"\n |" );for (x =0 ; x < cmn->mesh_x; x++)
@@ -581,8 +578,7 @@ static void arm_cmn_debugfs_init(struct arm_cmn *cmn, int id) {}struct arm_cmn_hw_event {struct arm_cmn_node *dn;u64 dtm_idx[4 ]; -unsigned int dtc_idx; -u8 dtcs_used; +s8 dtc_idx[CMN_MAX_DTCS ];u8 num_dns;u8 dtm_offset;bool wide_sel;
@@ -592,6 +588,10 @@ struct arm_cmn_hw_event {#define for_each_hw_dn (hw, dn, i) \ for (i = 0, dn = hw->dn; i < hw->num_dns; i++, dn++) +/* @i is the DTC number, @idx is the counter index on that DTC */ +#define for_each_hw_dtc_idx (hw, i, idx) \ + for (int i = 0, idx; i < CMN_MAX_DTCS; i++) if ((idx = hw->dtc_idx[i]) >= 0) +static struct arm_cmn_hw_event *to_cmn_hw (struct perf_event *event) {BUILD_BUG_ON (sizeof (struct arm_cmn_hw_event ) > offsetof(struct hw_perf_event , target));
@@ -1311,12 +1311,11 @@ static void arm_cmn_init_counter(struct perf_event *event) {struct arm_cmn *cmn =to_cmn (event->pmu);struct arm_cmn_hw_event *hw =to_cmn_hw (event); -unsigned int i, pmevcnt =CMN_DT_PMEVCNT (hw->dtc_idx);u64 count; -for (i =0 ; hw->dtcs_used & (1U << i); i++) { -writel_relaxed (CMN_COUNTER_INIT , cmn->dtc[i].base + pmevcnt); - cmn->dtc[i].counters[hw->dtc_idx] = event; +for_each_hw_dtc_idx (hw, i, idx) { +writel_relaxed (CMN_COUNTER_INIT , cmn->dtc[i].base +CMN_DT_PMEVCNT (idx)); + cmn->dtc[i].counters[idx] = event; } count =arm_cmn_read_dtm (cmn, hw, false);
@@ -1329,11 +1328,9 @@ static void arm_cmn_event_read(struct perf_event *event)struct arm_cmn_hw_event *hw =to_cmn_hw (event);u64 delta, new, prev;unsigned long flags; -unsigned int i; -if (hw->dtc_idx ==CMN_DT_NUM_COUNTERS ) { - i =__ffs (hw->dtcs_used); - delta =arm_cmn_read_cc (cmn->dtc + i); +if (CMN_EVENT_TYPE (event) ==CMN_TYPE_DTC ) { + delta =arm_cmn_read_cc (cmn->dtc + hw->dtc_idx[0 ]);local64_add (delta, &event->count);return ; }
@@ -1343,8 +1340,8 @@ static void arm_cmn_event_read(struct perf_event *event) delta = new - prev;local_irq_save (flags); -for (i =0 ; hw->dtcs_used & (1U << i); i++) { - new =arm_cmn_read_counter (cmn->dtc + i, hw->dtc_idx); +for_each_hw_dtc_idx (hw, i, idx) { + new =arm_cmn_read_counter (cmn->dtc + i, idx); delta += new <<16 ; }local_irq_restore (flags);
@@ -1396,7 +1393,7 @@ static void arm_cmn_event_start(struct perf_event *event, int flags)int i;if (type ==CMN_TYPE_DTC ) { - i =__ffs (hw->dtcs_used); + i = hw->dtc_idx[0 ];writeq_relaxed (CMN_CC_INIT , cmn->dtc[i].base +CMN_DT_PMCCNTR ); cmn->dtc[i].cc_active = true; }else if (type ==CMN_TYPE_WP ) {
@@ -1427,7 +1424,7 @@ static void arm_cmn_event_stop(struct perf_event *event, int flags)int i;if (type ==CMN_TYPE_DTC ) { - i =__ffs (hw->dtcs_used); + i = hw->dtc_idx[0 ]; cmn->dtc[i].cc_active = false; }else if (type ==CMN_TYPE_WP ) {int wp_idx =arm_cmn_wp_idx (event);
@@ -1613,12 +1610,19 @@ static int arm_cmn_event_init(struct perf_event *event) hw->dn =arm_cmn_node (cmn, type);if (!hw->dn)return -EINVAL ; + +memset (hw->dtc_idx,-1 ,sizeof (hw->dtc_idx));for (dn = hw->dn; dn->type == type; dn++) {if (bynodeid && dn->id != nodeid) { hw->dn++;continue ; } hw->num_dns++; +if (dn->dtc <0 ) +memset (hw->dtc_idx,0 , cmn->num_dtcs); +else + hw->dtc_idx[dn->dtc] =0 ; +if (bynodeid)break ; }
@@ -1630,12 +1634,6 @@ static int arm_cmn_event_init(struct perf_event *event) nodeid, nid.x, nid.y, nid.port, nid.dev, type);return -EINVAL ; } -/* -* Keep assuming non-cycles events count in all DTC domains; turns out -* it's hard to make a worthwhile optimisation around this, short of -* going all-in with domain-local counter allocation as well. -*/ - hw->dtcs_used = (1U << cmn->num_dtcs) -1 ;return arm_cmn_validate_group (cmn, event); }
@@ -1661,28 +1659,25 @@ static void arm_cmn_event_clear(struct arm_cmn *cmn, struct perf_event *event, }memset (hw->dtm_idx,0 ,sizeof (hw->dtm_idx)); -for (i =0 ; hw->dtcs_used & (1U << i); i++) - cmn->dtc[i].counters[hw->dtc_idx] =NULL ; +for_each_hw_dtc_idx (hw, j, idx) + cmn->dtc[j].counters[idx] =NULL ; }static int arm_cmn_event_add (struct perf_event *event,int flags) {struct arm_cmn *cmn =to_cmn (event->pmu);struct arm_cmn_hw_event *hw =to_cmn_hw (event); -struct arm_cmn_dtc *dtc = &cmn->dtc[0 ];struct arm_cmn_node *dn;enum cmn_node_type type =CMN_EVENT_TYPE (event); -unsigned int i, dtc_idx, input_sel; +unsigned int input_sel, i =0 ;if (type ==CMN_TYPE_DTC ) { - i =0 ;while (cmn->dtc[i].cycles)if (++i == cmn->num_dtcs)return -ENOSPC ; cmn->dtc[i].cycles = event; - hw->dtc_idx =CMN_DT_NUM_COUNTERS ; - hw->dtcs_used =1U << i; + hw->dtc_idx[0 ] = i;if (flags &PERF_EF_START )arm_cmn_event_start (event,0 );
@@ -1690,17 +1685,22 @@ static int arm_cmn_event_add(struct perf_event *event, int flags) }/* Grab a free global counter first... */ - dtc_idx =0 ; -while (dtc->counters[dtc_idx]) -if (++dtc_idx ==CMN_DT_NUM_COUNTERS ) -return -ENOSPC ; - - hw->dtc_idx = dtc_idx; +for_each_hw_dtc_idx (hw, j, idx) { +if (j >0 ) { + idx = hw->dtc_idx[0 ]; + }else { + idx =0 ; +while (cmn->dtc[j].counters[idx]) +if (++idx ==CMN_DT_NUM_COUNTERS ) + goto free_dtms; + } + hw->dtc_idx[j] = idx; + }/* ...then the local counters to feed it. */ for_each_hw_dn (hw, dn, i) {struct arm_cmn_dtm *dtm = &cmn->dtms[dn->dtm] + hw->dtm_offset; -unsigned int dtm_idx, shift; +unsigned int dtm_idx, shift, d =0 ;u64 reg; dtm_idx =0 ;
@@ -1719,11 +1719,11 @@ static int arm_cmn_event_add(struct perf_event *event, int flags) tmp = dtm->wp_event[wp_idx ^1 ];if (tmp >=0 &&CMN_EVENT_WP_COMBINE (event) != -CMN_EVENT_WP_COMBINE (dtc->counters[tmp])) +CMN_EVENT_WP_COMBINE (cmn->dtc[d].counters[tmp])) goto free_dtms; input_sel =CMN__PMEVCNT0_INPUT_SEL_WP + wp_idx; - dtm->wp_event[wp_idx] = dtc_idx; + dtm->wp_event[wp_idx] = hw->dtc_idx[d];writel_relaxed (cfg, dtm->base +CMN_DTM_WPn_CONFIG (wp_idx)); }else {struct arm_cmn_nodeid nid =arm_cmn_nid (cmn, dn->id);
@@ -1743,7 +1743,7 @@ static int arm_cmn_event_add(struct perf_event *event, int flags) dtm->input_sel[dtm_idx] = input_sel; shift =CMN__PMEVCNTn_GLOBAL_NUM_SHIFT (dtm_idx); dtm->pmu_config_low &= ~(CMN__PMEVCNT0_GLOBAL_NUM << shift); - dtm->pmu_config_low |=FIELD_PREP (CMN__PMEVCNT0_GLOBAL_NUM , dtc_idx) << shift; + dtm->pmu_config_low |=FIELD_PREP (CMN__PMEVCNT0_GLOBAL_NUM , hw->dtc_idx[d]) << shift; dtm->pmu_config_low |=CMN__PMEVCNT_PAIRED (dtm_idx); reg = (u64 )le32_to_cpu (dtm->pmu_config_high) <<32 | dtm->pmu_config_low;writeq_relaxed (reg, dtm->base +CMN_DTM_PMU_CONFIG );
@@ -1771,7 +1771,7 @@ static void arm_cmn_event_del(struct perf_event *event, int flags)arm_cmn_event_stop (event,PERF_EF_UPDATE );if (type ==CMN_TYPE_DTC ) - cmn->dtc[__ffs (hw->dtcs_used)].cycles =NULL ; + cmn->dtc[hw->dtc_idx[0 ]].cycles =NULL ;else arm_cmn_event_clear (cmn, event, hw->num_dns); }
@@ -1951,7 +1951,6 @@ static int arm_cmn_init_dtcs(struct arm_cmn *cmn) {struct arm_cmn_node *dn, *xp;int dtc_idx =0 ; -u8 dtcs_present = (1 << cmn->num_dtcs) -1 ; cmn->dtc =devm_kcalloc (cmn->dev, cmn->num_dtcs,sizeof (cmn->dtc[0 ]),GFP_KERNEL );if (!cmn->dtc)
@@ -1961,23 +1960,26 @@ static int arm_cmn_init_dtcs(struct arm_cmn *cmn) cmn->xps =arm_cmn_node (cmn,CMN_TYPE_XP ); +if (cmn->part ==PART_CMN600 && cmn->num_dtcs >1 ) { +/* We do at least know that a DTC's XP must be in that DTC's domain */ + dn =arm_cmn_node (cmn,CMN_TYPE_DTC ); +for (int i =0 ; i < cmn->num_dtcs; i++) +arm_cmn_node_to_xp (cmn, dn + i)->dtc = i; + } +for (dn = cmn->dns; dn->type; dn++) { -if (dn->type ==CMN_TYPE_XP ) { - dn->dtc &= dtcs_present; +if (dn->type ==CMN_TYPE_XP )continue ; - } xp =arm_cmn_node_to_xp (cmn, dn); + dn->dtc = xp->dtc; dn->dtm = xp->dtm;if (cmn->multi_dtm) dn->dtm +=arm_cmn_nid (cmn, dn->id).port /2 ;if (dn->type ==CMN_TYPE_DTC ) { -int err; -/* We do at least know that a DTC's XP must be in that DTC's domain */ -if (xp->dtc ==0xf ) - xp->dtc =1 << dtc_idx; - err =arm_cmn_init_dtc (cmn, dn, dtc_idx++); +int err =arm_cmn_init_dtc (cmn, dn, dtc_idx++); +if (err)return err; }
@@ -2135,9 +2137,9 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset) cmn->mesh_x = xp->logid;if (cmn->part ==PART_CMN600 ) - xp->dtc =0xf ; + xp->dtc =-1 ;else - xp->dtc =1 <<arm_cmn_dtc_domain (cmn, xp_region); + xp->dtc =arm_cmn_dtc_domain (cmn, xp_region); xp->dtm = dtm - cmn->dtms;arm_cmn_init_dtm (dtm++, xp,0 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/798 perf/arm-cmn: Improve debugfs pretty-printing for large configs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
[ Upstream commit a1083ee717e9bde012268782e084d343314490a4 ]
The debugfs pretty-printer was written for the CMN-600 assumptions of a maximum 8x8 mesh, but CMN-700 now allows coordinates and ID values up to 12 and 128 respectively, which can overflow the format strings, mess up the alignment of the table and hurt overall readability. This table does prove useful for double-checking that the driver is picking up the topology of new systems correctly and for verifying user expectations, so tweak the formatting to stay nice and readable with wider values.
Stable-dep-of: e79634b53e39 ("perf/arm-cmn: Refactor node ID handling. Again.")
--- drivers/perf/arm-cmn.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/perf/arm-cmn.c +5 -4
@@ -485,6 +485,7 @@ static void arm_cmn_show_logid(struct seq_file *s, int x, int y, int p, int d)for (dn = cmn->dns; dn->type; dn++) {struct arm_cmn_nodeid nid =arm_cmn_nid (cmn, dn->id); +int pad = dn->logid <10 ;if (dn->type ==CMN_TYPE_XP )continue ;
@@ -495,7 +496,7 @@ static void arm_cmn_show_logid(struct seq_file *s, int x, int y, int p, int d)if (nid.x != x || nid.y != y || nid.port != p || nid.dev != d)continue ; -seq_printf (s," #%-2d |" , dn->logid); +seq_printf (s," %*c#%-*d |" , pad +1 ,' ' ,3 - pad, dn->logid);return ; }seq_puts (s," |" );
@@ -508,7 +509,7 @@ static int arm_cmn_map_show(struct seq_file *s, void *data)seq_puts (s," X" );for (x =0 ; x < cmn->mesh_x; x++) -seq_printf (s," %d " , x); +seq_printf (s," %-2d " , x);seq_puts (s,"\nY P D+" ); y = cmn->mesh_y;while (y--) {
@@ -518,13 +519,13 @@ static int arm_cmn_map_show(struct seq_file *s, void *data)for (x =0 ; x < cmn->mesh_x; x++)seq_puts (s,"--------+" ); -seq_printf (s,"\n%d |" , y); +seq_printf (s,"\n%-2d |" , y);for (x =0 ; x < cmn->mesh_x; x++) {struct arm_cmn_node *xp = cmn->xps + xp_base + x;for (p =0 ; p <CMN_MAX_PORTS ; p++) port[p][x] =arm_cmn_device_connect_info (cmn, xp, p); -seq_printf (s," XP #%-2d |" , xp_base + x); +seq_printf (s," XP #%-3d|" , xp_base + x); }seq_puts (s,"\n |" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/798 perf/arm-cmn: Refactor node ID handling. Again.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
[ Upstream commit e79634b53e398966c49f803c49701bc74dc3ccf8 ]
The scope of the "extra device ports" configuration is not made clear by the CMN documentation - so far we've assumed it applies globally, based on the sole example which suggests as much. However it transpires that this is incorrect, and the format does in fact vary based on each individual XP's port configuration. As a consequence, we're currenly liable to decode the port/device indices from a node ID incorrectly, thus program the wrong event source in the DTM leading to bogus event counts, and also show device topology on the wrong ports in debugfs.
To put this right, rework node IDs yet again to carry around the additional data necessary to decode them properly per-XP. At this point the notion of fully decomposing an ID becomes more impractical than it's worth, so unabstracting the XY mesh coordinates (where 2/3 users were just debug anyway) ends up leaving things a bit simpler overall.
--- drivers/perf/arm-cmn.c | 94 ++++++++++++++++++------------------------ 1 file changed, 40 insertions(+), 54 deletions(-)
drivers/perf/arm-cmn.c +40 -54
@@ -24,14 +24,6 @@#define CMN_NI_NODE_ID GENMASK_ULL(31, 16)#define CMN_NI_LOGICAL_ID GENMASK_ULL(47, 32) -#define CMN_NODEID_DEVID (reg) ((reg) & 3) -#define CMN_NODEID_EXT_DEVID (reg) ((reg) & 1) -#define CMN_NODEID_PID (reg) (((reg) >> 2) & 1) -#define CMN_NODEID_EXT_PID (reg) (((reg) >> 1) & 3) -#define CMN_NODEID_1x1_PID (reg) (((reg) >> 2) & 7) -#define CMN_NODEID_X (reg, bits) ((reg) >> (3 + (bits))) -#define CMN_NODEID_Y (reg, bits) (((reg) >> 3) & ((1U << (bits)) - 1)) -#define CMN_CHILD_INFO 0x0080#define CMN_CI_CHILD_COUNT GENMASK_ULL(15, 0)#define CMN_CI_CHILD_PTR_OFFSET GENMASK_ULL(31, 16)
@@ -273,8 +265,11 @@ struct arm_cmn_node {u16 id, logid;enum cmn_node_type type; +/* XP properties really, but replicated to children for convenience */ u8 dtm;s8 dtc; + u8 portid_bits:4; + u8 deviceid_bits:4;/* DN/HN-F/CXHA */ struct {u8 val :4 ;
@@ -350,49 +345,33 @@ struct arm_cmn {static int arm_cmn_hp_state;struct arm_cmn_nodeid { -u8 x; -u8 y;u8 port;u8 dev; };static int arm_cmn_xyidbits (const struct arm_cmn *cmn) { -return fls ((cmn->mesh_x -1 ) | (cmn->mesh_y -1 ) |2 ); +return fls ((cmn->mesh_x -1 ) | (cmn->mesh_y -1 )); } -static struct arm_cmn_nodeid arm_cmn_nid (const struct arm_cmn *cmn,u16 id) +static struct arm_cmn_nodeid arm_cmn_nid (const struct arm_cmn_node *dn) {struct arm_cmn_nodeid nid; -if (cmn->num_xps ==1 ) { - nid.x =0 ; - nid.y =0 ; - nid.port =CMN_NODEID_1x1_PID (id); - nid.dev =CMN_NODEID_DEVID (id); - }else { -int bits =arm_cmn_xyidbits (cmn); - - nid.x =CMN_NODEID_X (id, bits); - nid.y =CMN_NODEID_Y (id, bits); -if (cmn->ports_used &0xc ) { - nid.port =CMN_NODEID_EXT_PID (id); - nid.dev =CMN_NODEID_EXT_DEVID (id); - }else { - nid.port =CMN_NODEID_PID (id); - nid.dev =CMN_NODEID_DEVID (id); - } - } + nid.dev = dn->id & ((1U << dn->deviceid_bits) -1 ); + nid.port = (dn->id >> dn->deviceid_bits) & ((1U << dn->portid_bits) -1 );return nid; }static struct arm_cmn_node *arm_cmn_node_to_xp (const struct arm_cmn *cmn,const struct arm_cmn_node *dn) { -struct arm_cmn_nodeid nid =arm_cmn_nid (cmn, dn->id); -int xp_idx = cmn->mesh_x * nid.y + nid.x; +int id = dn->id >> (dn->portid_bits + dn->deviceid_bits); +int bits =arm_cmn_xyidbits (cmn); +int x = id >> bits; +int y = id & ((1U << bits) -1 ); -return cmn->xps + xp_idx; +return cmn->xps + cmn->mesh_x * y + x; }static struct arm_cmn_node *arm_cmn_node (const struct arm_cmn *cmn,enum cmn_node_type type)
@@ -478,13 +457,13 @@ static const char *arm_cmn_device_type(u8 type) } } -static void arm_cmn_show_logid (struct seq_file *s,int x,int y,int p,int d) +static void arm_cmn_show_logid (struct seq_file *s,const struct arm_cmn_node *xp,int p,int d) {struct arm_cmn *cmn = s->private;struct arm_cmn_node *dn; +u16 id = xp->id | d | (p << xp->deviceid_bits);for (dn = cmn->dns; dn->type; dn++) { -struct arm_cmn_nodeid nid =arm_cmn_nid (cmn, dn->id);int pad = dn->logid <10 ;if (dn->type ==CMN_TYPE_XP )
@@ -493,7 +472,7 @@ static void arm_cmn_show_logid(struct seq_file *s, int x, int y, int p, int d)if (dn->type <CMN_TYPE_HNI )continue ; -if (nid.x != x || nid.y != y || nid.port != p || nid.dev != d) +if (dn->id != id)continue ;seq_printf (s," %*c#%-*d |" , pad +1 ,' ' ,3 - pad, dn->logid);
@@ -514,6 +493,7 @@ static int arm_cmn_map_show(struct seq_file *s, void *data) y = cmn->mesh_y;while (y--) {int xp_base = cmn->mesh_x * y; +struct arm_cmn_node *xp = cmn->xps + xp_base;u8 port[CMN_MAX_PORTS ][CMN_MAX_DIMENSION ];for (x =0 ; x < cmn->mesh_x; x++)
@@ -521,16 +501,14 @@ static int arm_cmn_map_show(struct seq_file *s, void *data)seq_printf (s,"\n%-2d |" , y);for (x =0 ; x < cmn->mesh_x; x++) { -struct arm_cmn_node *xp = cmn->xps + xp_base + x; -for (p =0 ; p <CMN_MAX_PORTS ; p++) - port[p][x] =arm_cmn_device_connect_info (cmn, xp, p); + port[p][x] =arm_cmn_device_connect_info (cmn, xp + x, p);seq_printf (s," XP #%-3d|" , xp_base + x); }seq_puts (s,"\n |" );for (x =0 ; x < cmn->mesh_x; x++) { -s8 dtc = cmn->xps[xp_base + x].dtc; +s8 dtc = xp[x].dtc;if (dtc <0 )seq_puts (s," DTC ?? |" );
@@ -547,10 +525,10 @@ static int arm_cmn_map_show(struct seq_file *s, void *data)seq_puts (s,arm_cmn_device_type (port[p][x]));seq_puts (s,"\n 0|" );for (x =0 ; x < cmn->mesh_x; x++) -arm_cmn_show_logid (s, x, y, p,0 ); +arm_cmn_show_logid (s, xp + x, p,0 );seq_puts (s,"\n 1|" );for (x =0 ; x < cmn->mesh_x; x++) -arm_cmn_show_logid (s, x, y, p,1 ); +arm_cmn_show_logid (s, xp + x, p,1 ); }seq_puts (s,"\n-----+" ); }
@@ -1629,10 +1607,7 @@ static int arm_cmn_event_init(struct perf_event *event) }if (!hw->num_dns) { -struct arm_cmn_nodeid nid =arm_cmn_nid (cmn, nodeid); - -dev_dbg (cmn->dev,"invalid node 0x%x (%d,%d,%d,%d) type 0x%x\n" , - nodeid, nid.x, nid.y, nid.port, nid.dev, type); +dev_dbg (cmn->dev,"invalid node 0x%x type 0x%x\n" , nodeid, type);return -EINVAL ; }
@@ -1727,7 +1702,7 @@ static int arm_cmn_event_add(struct perf_event *event, int flags) dtm->wp_event[wp_idx] = hw->dtc_idx[d];writel_relaxed (cfg, dtm->base +CMN_DTM_WPn_CONFIG (wp_idx)); }else { -struct arm_cmn_nodeid nid =arm_cmn_nid (cmn, dn->id); +struct arm_cmn_nodeid nid =arm_cmn_nid (dn);if (cmn->multi_dtm) nid.port %=2 ;
@@ -1973,10 +1948,12 @@ static int arm_cmn_init_dtcs(struct arm_cmn *cmn)continue ; xp =arm_cmn_node_to_xp (cmn, dn); + dn->portid_bits = xp->portid_bits; + dn->deviceid_bits = xp->deviceid_bits; dn->dtc = xp->dtc; dn->dtm = xp->dtm;if (cmn->multi_dtm) - dn->dtm +=arm_cmn_nid (cmn, dn->id).port /2 ; + dn->dtm +=arm_cmn_nid (dn).port /2 ;if (dn->type ==CMN_TYPE_DTC ) {int err =arm_cmn_init_dtc (cmn, dn, dtc_idx++);
@@ -2146,18 +2123,27 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)arm_cmn_init_dtm (dtm++, xp,0 );/* * Keeping track of connected ports will let us filter out -* unnecessary XP events easily. We can also reliably infer the -* "extra device ports" configuration for the node ID format -* from this, since in that case we will see at least one XP -* with port 2 connected, for the HN-D. +* unnecessary XP events easily, and also infer the per-XP +* part of the node ID format. */ for (int p =0 ; p <CMN_MAX_PORTS ; p++)if (arm_cmn_device_connect_info (cmn, xp, p)) xp_ports |=BIT (p); -if (cmn->multi_dtm && (xp_ports &0xc )) +if (cmn->num_xps ==1 ) { + xp->portid_bits =3 ; + xp->deviceid_bits =2 ; + }else if (xp_ports >0x3 ) { + xp->portid_bits =2 ; + xp->deviceid_bits =1 ; + }else { + xp->portid_bits =1 ; + xp->deviceid_bits =2 ; + } + +if (cmn->multi_dtm && (xp_ports >0x3 ))arm_cmn_init_dtm (dtm++, xp,1 ); -if (cmn->multi_dtm && (xp_ports &0x30 )) +if (cmn->multi_dtm && (xp_ports >0xf ))arm_cmn_init_dtm (dtm++, xp,2 ); cmn->ports_used |= xp_ports;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/798 perf/arm-cmn: Ensure dtm_idx is big enough
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
[ Upstream commit 359414b33e00bae91e4eabf3e4ef8e76024c7673 ]
While CMN_MAX_DIMENSION was bumped to 12 for CMN-650, that only supports up to a 10x10 mesh, so bumping dtm_idx to 256 bits at the time worked out OK in practice. However CMN-700 did finally support up to 144 XPs, and thus needs a worst-case 288 bits of dtm_idx for an aggregated XP event on a maxed-out config. Oops.
--- drivers/perf/arm-cmn.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/perf/arm-cmn.c +4 -1
@@ -35,6 +35,9 @@#define CMN_MAX_XPS (CMN_MAX_DIMENSION * CMN_MAX_DIMENSION)#define CMN_MAX_DTMS (CMN_MAX_XPS + (CMN_MAX_DIMENSION - 1) * 4) +/* Currently XPs are the node type we can have most of; others top out at 128 */ +#define CMN_MAX_NODES_PER_EVENT CMN_MAX_XPS +/* The CFG node has various info besides the discovery tree */ #define CMN_CFGM_PERIPH_ID_01 0x0008#define CMN_CFGM_PID0_PART_0 GENMASK_ULL(7, 0)
@@ -556,7 +559,7 @@ static void arm_cmn_debugfs_init(struct arm_cmn *cmn, int id) {}struct arm_cmn_hw_event {struct arm_cmn_node *dn; -u64 dtm_idx[4 ]; +u64 dtm_idx[DIV_ROUND_UP (CMN_MAX_NODES_PER_EVENT *2 ,64 )];s8 dtc_idx[CMN_MAX_DTCS ];u8 num_dns;u8 dtm_offset;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/798 cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Menon <[email protected]>
[ Upstream commit abc00ffda43bd4ba85896713464c7510c39f8165 ]
Commit b4bc9f9e27ed ("cpufreq: ti-cpufreq: add support for omap34xx and omap36xx") introduced special handling for OMAP3 class devices where syscon node may not be present. However, this also creates a bug where the syscon node is present, however the offset used to read is beyond the syscon defined range.
Fix this by providing a quirk option that is populated when such special handling is required. This allows proper failure for all other platforms when the syscon node and efuse offsets are mismatched.
--- drivers/cpufreq/ti-cpufreq.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/cpufreq/ti-cpufreq.c +8 -2
@@ -53,6 +53,9 @@ struct ti_cpufreq_soc_data {unsigned long efuse_shift;unsigned long rev_offset;bool multi_regulator; +/* Backward compatibility hack: Might have missing syscon */ +#define TI_QUIRK_SYSCON_MAY_BE_MISSING 0x1 +u8 quirks; };struct ti_cpufreq_data {
@@ -155,6 +158,7 @@ static struct ti_cpufreq_soc_data omap34xx_soc_data = { .efuse_mask = BIT(3), .rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE, .multi_regulator = false, + .quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING, };/*
@@ -182,6 +186,7 @@ static struct ti_cpufreq_soc_data omap36xx_soc_data = { .efuse_mask = BIT(9), .rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE, .multi_regulator = true, + .quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING, };/*
@@ -196,6 +201,7 @@ static struct ti_cpufreq_soc_data am3517_soc_data = { .efuse_mask = 0, .rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE, .multi_regulator = false, + .quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING, };
@@ -215,7 +221,7 @@ static int ti_cpufreq_get_efuse(struct ti_cpufreq_data *opp_data, ret =regmap_read (opp_data->syscon, opp_data->soc_data->efuse_offset, &efuse); -if (ret == -EIO ) { +if (opp_data->soc_data->quirks &TI_QUIRK_SYSCON_MAY_BE_MISSING && ret == -EIO ) {/* not a syscon register! */ void __iomem *regs =ioremap (OMAP3_SYSCON_BASE + opp_data->soc_data->efuse_offset,4 );
@@ -256,7 +262,7 @@ static int ti_cpufreq_get_rev(struct ti_cpufreq_data *opp_data, ret =regmap_read (opp_data->syscon, opp_data->soc_data->rev_offset, &revision); -if (ret == -EIO ) { +if (opp_data->soc_data->quirks &TI_QUIRK_SYSCON_MAY_BE_MISSING && ret == -EIO ) {/* not a syscon register! */ void __iomem *regs =ioremap (OMAP3_SYSCON_BASE + opp_data->soc_data->rev_offset,4 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/798 x86/sgx: Fix deadlock in SGX NUMA node search
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Lu <[email protected]>
[ Upstream commit 9c936844010466535bd46ea4ce4656ef17653644 ]
When the current node doesn't have an EPC section configured by firmware and all other EPC sections are used up, CPU can get stuck inside the while loop that looks for an available EPC page from remote nodes indefinitely, leading to a soft lockup. Note how nid_of_current will never be equal to nid in that while loop because nid_of_current is not set in sgx_numa_mask.
Also worth mentioning is that it's perfectly fine for the firmware not to setup an EPC section on a node. While setting up an EPC section on each node can enhance performance, it is not a requirement for functionality.
Rework the loop to start and end on *a* node that has SGX memory. This avoids the deadlock looking for the current SGX-lacking node to show up in the loop when it never will.
--- arch/x86/kernel/cpu/sgx/main.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-)
arch/x86/kernel/cpu/sgx/main.c +14 -13
@@ -474,24 +474,25 @@ struct sgx_epc_page *__sgx_alloc_epc_page(void) {struct sgx_epc_page *page;int nid_of_current =numa_node_id (); -int nid = nid_of_current; +int nid_start, nid; -if (node_isset (nid_of_current, sgx_numa_mask)) { - page =__sgx_alloc_epc_page_from_node (nid_of_current); -if (page) -return page; - } - -/* Fall back to the non-local NUMA nodes: */ -while (true) { - nid =next_node_in (nid, sgx_numa_mask); -if (nid == nid_of_current) -break ; +/* +* Try local node first. If it doesn't have an EPC section, +* fall back to the non-local NUMA nodes. +*/ +if (node_isset (nid_of_current, sgx_numa_mask)) + nid_start = nid_of_current; +else + nid_start =next_node_in (nid_of_current, sgx_numa_mask); + nid = nid_start; +do { page =__sgx_alloc_epc_page_from_node (nid);if (page)return page; - } + + nid =next_node_in (nid, sgx_numa_mask); + }while (nid != nid_start);return ERR_PTR (-ENOMEM ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/798 crypto: hisilicon/hpre - enable sva error interrupt event
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <[email protected]>
[ Upstream commit 391dde6e48ff84687395a0a4e84f7e1540301e4e ]
Enable sva error interrupt event. When an error occurs on the sva module, the device reports an abnormal interrupt to the driver.
Stable-dep-of: 145013f72394 ("crypto: hisilicon/hpre - mask cluster timeout error")
--- drivers/crypto/hisilicon/hpre/hpre_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/crypto/hisilicon/hpre/hpre_main.c +4 -1
@@ -203,7 +203,7 @@ static const struct hisi_qm_cap_info hpre_basic_info[] = { {HPRE_QM_RESET_MASK_CAP, 0x3128, 0, GENMASK(31, 0), 0x0, 0xC37, 0x6C37}, {HPRE_QM_OOO_SHUTDOWN_MASK_CAP, 0x3128, 0, GENMASK(31, 0), 0x0, 0x4, 0x6C37}, {HPRE_QM_CE_MASK_CAP, 0x312C, 0, GENMASK(31, 0), 0x0, 0x8, 0x8}, - {HPRE_NFE_MASK_CAP, 0x3130, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0xFFFFFE}, + {HPRE_NFE_MASK_CAP, 0x3130, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0x1FFFFFE}, {HPRE_RESET_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0xBFFFFE}, {HPRE_OOO_SHUTDOWN_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x22, 0xBFFFFE}, {HPRE_CE_MASK_CAP, 0x3138, 0, GENMASK(31, 0), 0x0, 0x1, 0x1},
@@ -283,6 +283,9 @@ static const struct hpre_hw_error hpre_hw_errors[] = { }, { .int_msk = BIT(23), .msg = "sva_fsm_timeout_int_set" + }, { + .int_msk = BIT(24), + .msg = "sva_int_set" }, {/* sentinel */ }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/798 crypto: hisilicon/hpre - mask cluster timeout error
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <[email protected]>
[ Upstream commit 145013f723947c83b1a5f76a0cf6e7237d59e973 ]
The timeout threshold of the hpre cluster is 16ms. When the CPU and device share virtual address, page fault processing time may exceed the threshold.
In the current test, there is a high probability that the cluster times out. However, the cluster is waiting for the completion of memory access, which is not an error, the device does not need to be reset. If an error occurs in the cluster, qm also reports the error. Therefore, the cluster timeout error of hpre can be masked.
--- drivers/crypto/hisilicon/hpre/hpre_main.c | 22 ++++++---------------- 1 file changed, 6 insertions(+), 16 deletions(-)
drivers/crypto/hisilicon/hpre/hpre_main.c +6 -16
@@ -14,9 +14,7 @@#include <linux/uacce.h> #include "hpre.h" -#define HPRE_QM_ABNML_INT_MASK 0x100004#define HPRE_CTRL_CNT_CLR_CE_BIT BIT(0) -#define HPRE_COMM_CNT_CLR_CE 0x0#define HPRE_CTRL_CNT_CLR_CE 0x301000#define HPRE_FSM_MAX_CNT 0x301008#define HPRE_VFG_AXQOS 0x30100c
@@ -43,7 +41,6 @@#define HPRE_HAC_INT_SET 0x301500#define HPRE_RNG_TIMEOUT_NUM 0x301A34#define HPRE_CORE_INT_ENABLE 0 -#define HPRE_CORE_INT_DISABLE GENMASK(21, 0)#define HPRE_RDCHN_INI_ST 0x301a00#define HPRE_CLSTR_BASE 0x302000#define HPRE_CORE_EN_OFFSET 0x04
@@ -67,7 +64,6 @@#define HPRE_CLSTR_ADDR_INTRVL 0x1000#define HPRE_CLUSTER_INQURY 0x100#define HPRE_CLSTR_ADDR_INQRY_RSLT 0x104 -#define HPRE_TIMEOUT_ABNML_BIT 6#define HPRE_PASID_EN_BIT 9#define HPRE_REG_RD_INTVRL_US 10#define HPRE_REG_RD_TMOUT_US 1000
@@ -203,9 +199,9 @@ static const struct hisi_qm_cap_info hpre_basic_info[] = { {HPRE_QM_RESET_MASK_CAP, 0x3128, 0, GENMASK(31, 0), 0x0, 0xC37, 0x6C37}, {HPRE_QM_OOO_SHUTDOWN_MASK_CAP, 0x3128, 0, GENMASK(31, 0), 0x0, 0x4, 0x6C37}, {HPRE_QM_CE_MASK_CAP, 0x312C, 0, GENMASK(31, 0), 0x0, 0x8, 0x8}, - {HPRE_NFE_MASK_CAP, 0x3130, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0x1FFFFFE}, - {HPRE_RESET_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0xBFFFFE}, - {HPRE_OOO_SHUTDOWN_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x22, 0xBFFFFE}, + {HPRE_NFE_MASK_CAP, 0x3130, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0x1FFFC3E}, + {HPRE_RESET_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0xBFFC3E}, + {HPRE_OOO_SHUTDOWN_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x22, 0xBFFC3E}, {HPRE_CE_MASK_CAP, 0x3138, 0, GENMASK(31, 0), 0x0, 0x1, 0x1}, {HPRE_CLUSTER_NUM_CAP, 0x313c, 20, GENMASK(3, 0), 0x0, 0x4, 0x1}, {HPRE_CORE_TYPE_NUM_CAP, 0x313c, 16, GENMASK(3, 0), 0x0, 0x2, 0x2},
@@ -654,11 +650,6 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm)writel (HPRE_QM_USR_CFG_MASK , qm->io_base +QM_AWUSER_M_CFG_ENABLE );writel_relaxed (HPRE_QM_AXI_CFG_MASK , qm->io_base +QM_AXI_M_CFG ); -/* HPRE need more time, we close this interrupt */ - val =readl_relaxed (qm->io_base +HPRE_QM_ABNML_INT_MASK ); - val |=BIT (HPRE_TIMEOUT_ABNML_BIT ); -writel_relaxed (val, qm->io_base +HPRE_QM_ABNML_INT_MASK ); -if (qm->ver >=QM_HW_V3 )writel (HPRE_RSA_ENB |HPRE_ECC_ENB , qm->io_base +HPRE_TYPES_ENB );
@@ -667,9 +658,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm)writel (HPRE_QM_VFG_AX_MASK , qm->io_base +HPRE_VFG_AXCACHE );writel (0x0 , qm->io_base +HPRE_BD_ENDIAN ); -writel (0x0 , qm->io_base +HPRE_INT_MASK );writel (0x0 , qm->io_base +HPRE_POISON_BYPASS ); -writel (0x0 , qm->io_base +HPRE_COMM_CNT_CLR_CE );writel (0x0 , qm->io_base +HPRE_ECC_BYPASS );writel (HPRE_BD_USR_MASK , qm->io_base +HPRE_BD_ARUSR_CFG );
@@ -759,7 +748,7 @@ static void hpre_hw_error_disable(struct hisi_qm *qm)static void hpre_hw_error_enable (struct hisi_qm *qm) { -u32 ce, nfe; +u32 ce, nfe, err_en; ce =hisi_qm_get_hw_info (qm, hpre_basic_info,HPRE_CE_MASK_CAP , qm->cap_ver); nfe =hisi_qm_get_hw_info (qm, hpre_basic_info,HPRE_NFE_MASK_CAP , qm->cap_ver);
@@ -776,7 +765,8 @@ static void hpre_hw_error_enable(struct hisi_qm *qm)hpre_master_ooo_ctrl (qm, true);/* enable hpre hw error interrupts */ -writel (HPRE_CORE_INT_ENABLE , qm->io_base +HPRE_INT_MASK ); + err_en = ce | nfe |HPRE_HAC_RAS_FE_ENABLE ; +writel (~err_en, qm->io_base +HPRE_INT_MASK ); }static inline struct hisi_qm *hpre_file_to_qm (struct hpre_debugfs_file *file)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/798 crypto: hisilicon/qm - fix coding style issues
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <[email protected]>
[ Upstream commit ced18fd1794787d57acff1a4d1b2816d5ec99fbc ]
1. Remove extra blank lines.
2. Remove extra spaces.
3. Use spaces instead of tabs around '=' and '\',
to ensure consistent coding styles.
4. Macros should be capital letters, change 'QM_SQC_VFT_NUM_MASK_v2' to 'QM_SQC_VFT_NUM_MASK_V2'.
Stable-dep-of: b04f06fc0243 ("crypto: hisilicon/qm - inject error before stopping queue")
--- drivers/crypto/hisilicon/qm.c | 29 ++++++++++++----------------- drivers/crypto/hisilicon/sgl.c | 1 - 2 files changed, 12 insertions(+), 18 deletions(-)
drivers/crypto/hisilicon/qm.c +12 -17
@@ -118,7 +118,7 @@#define QM_SQC_VFT_BASE_SHIFT_V2 28#define QM_SQC_VFT_BASE_MASK_V2 GENMASK(15, 0)#define QM_SQC_VFT_NUM_SHIFT_V2 45 -#define QM_SQC_VFT_NUM_MASK_v2 GENMASK(9, 0) +#define QM_SQC_VFT_NUM_MASK_V2 GENMASK(9, 0)#define QM_ABNORMAL_INT_SOURCE 0x100000#define QM_ABNORMAL_INT_MASK 0x100004
@@ -240,23 +240,23 @@#define QM_DEV_ALG_MAX_LEN 256#define QM_MK_CQC_DW3_V1 (hop_num, pg_sz, buf_sz, cqe_sz) \ - (((hop_num) << QM_CQ_HOP_NUM_SHIFT) | \ - ((pg_sz) << QM_CQ_PAGE_SIZE_SHIFT) | \ - ((buf_sz) << QM_CQ_BUF_SIZE_SHIFT) | \ + (((hop_num) << QM_CQ_HOP_NUM_SHIFT) | \ + ((pg_sz) << QM_CQ_PAGE_SIZE_SHIFT) | \ + ((buf_sz) << QM_CQ_BUF_SIZE_SHIFT) | \ ((cqe_sz) << QM_CQ_CQE_SIZE_SHIFT))#define QM_MK_CQC_DW3_V2 (cqe_sz, cq_depth) \ ((((u32)cq_depth) - 1) | ((cqe_sz) << QM_CQ_CQE_SIZE_SHIFT))#define QM_MK_SQC_W13 (priority, orders, alg_type) \ - (((priority) << QM_SQ_PRIORITY_SHIFT) | \ - ((orders) << QM_SQ_ORDERS_SHIFT) | \ + (((priority) << QM_SQ_PRIORITY_SHIFT) | \ + ((orders) << QM_SQ_ORDERS_SHIFT) | \ (((alg_type) & QM_SQ_TYPE_MASK) << QM_SQ_TYPE_SHIFT))#define QM_MK_SQC_DW3_V1 (hop_num, pg_sz, buf_sz, sqe_sz) \ - (((hop_num) << QM_SQ_HOP_NUM_SHIFT) | \ - ((pg_sz) << QM_SQ_PAGE_SIZE_SHIFT) | \ - ((buf_sz) << QM_SQ_BUF_SIZE_SHIFT) | \ + (((hop_num) << QM_SQ_HOP_NUM_SHIFT) | \ + ((pg_sz) << QM_SQ_PAGE_SIZE_SHIFT) | \ + ((buf_sz) << QM_SQ_BUF_SIZE_SHIFT) | \ ((u32)ilog2(sqe_sz) << QM_SQ_SQE_SIZE_SHIFT))#define QM_MK_SQC_DW3_V2 (sqe_sz, sq_depth) \
@@ -720,7 +720,7 @@ static void qm_db_v2(struct hisi_qm *qm, u16 qn, u8 cmd, u16 index, u8 priority) doorbell = qn | ((u64 )cmd <<QM_DB_CMD_SHIFT_V2 ) | ((u64 )randata <<QM_DB_RAND_SHIFT_V2 ) | - ((u64 )index <<QM_DB_INDEX_SHIFT_V2 ) | + ((u64 )index <<QM_DB_INDEX_SHIFT_V2 ) | ((u64 )priority <<QM_DB_PRIORITY_SHIFT_V2 );writeq (doorbell, io_base);
@@ -1354,7 +1354,7 @@ static int qm_get_vft_v2(struct hisi_qm *qm, u32 *base, u32 *number) sqc_vft =readl (qm->io_base +QM_MB_CMD_DATA_ADDR_L ) | ((u64 )readl (qm->io_base +QM_MB_CMD_DATA_ADDR_H ) <<32 ); *base =QM_SQC_VFT_BASE_MASK_V2 & (sqc_vft >>QM_SQC_VFT_BASE_SHIFT_V2 ); - *number = (QM_SQC_VFT_NUM_MASK_v2 & + *number = (QM_SQC_VFT_NUM_MASK_V2 & (sqc_vft >>QM_SQC_VFT_NUM_SHIFT_V2 )) +1 ;return 0 ;
@@ -3123,7 +3123,6 @@ static int qm_stop_started_qp(struct hisi_qm *qm)return 0 ; } -/** * qm_clear_queues() - Clear all queues memory in a qm. * @qm: The qm in which the queues will be cleared.
@@ -3609,7 +3608,7 @@ static ssize_t qm_algqos_read(struct file *filp, char __user *buf, qos_val = ir /QM_QOS_RATE ; ret =scnprintf (tbuf,QM_DBG_READ_LEN ,"%u\n" , qos_val); - ret =simple_read_from_buffer (buf, count, pos, tbuf, ret); + ret =simple_read_from_buffer (buf, count, pos, tbuf, ret); err_get_status:clear_bit (QM_RESETTING , &qm->misc_ctl);
@@ -4116,13 +4115,10 @@ static void qm_dev_ecc_mbit_handle(struct hisi_qm *qm)if (!qm->err_status.is_dev_ecc_mbit && qm->err_status.is_qm_ecc_mbit && qm->err_ini->close_axi_master_ooo) { - qm->err_ini->close_axi_master_ooo (qm); - }else if (qm->err_status.is_dev_ecc_mbit && !qm->err_status.is_qm_ecc_mbit && !qm->err_ini->close_axi_master_ooo) { - nfe_enb =readl (qm->io_base +QM_RAS_NFE_ENABLE );writel (nfe_enb &QM_RAS_NFE_MBIT_DISABLE , qm->io_base +QM_RAS_NFE_ENABLE );
@@ -4566,7 +4562,6 @@ static irqreturn_t qm_abnormal_irq(int irq, void *data)return IRQ_HANDLED ; } -/** * hisi_qm_dev_shutdown() - Shutdown device. * @pdev: The device will be shutdown.
drivers/crypto/hisilicon/sgl.c +0 -1
@@ -249,7 +249,6 @@ hisi_acc_sg_buf_map_to_hw_sgl(struct device *dev,dev_err (dev,"Get SGL error!\n" );dma_unmap_sg (dev, sgl, sg_n,DMA_BIDIRECTIONAL );return ERR_PTR (-ENOMEM ); - } curr_hw_sgl->entry_length_in_sgl =cpu_to_le16 (pool->sge_nr); curr_hw_sge = curr_hw_sgl->sge_entries;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/798 crypto: hisilicon/qm - reset device before enabling it
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <[email protected]>
[ Upstream commit 5d2d1ee0874c26b8010ddf7f57e2f246e848af38 ]
Before the device is enabled again, the device may still store the previously processed data. If an error occurs in the previous task, the device may fail to be enabled again. Therefore, before enabling device, reset the device to restore the initial state.
Stable-dep-of: b04f06fc0243 ("crypto: hisilicon/qm - inject error before stopping queue")
--- drivers/crypto/hisilicon/hpre/hpre_main.c | 32 +++--- drivers/crypto/hisilicon/qm.c | 114 +++++++++++++++------- drivers/crypto/hisilicon/sec2/sec_main.c | 16 ++- drivers/crypto/hisilicon/zip/zip_main.c | 23 +++-- 4 files changed, 121 insertions(+), 64 deletions(-)
drivers/crypto/hisilicon/hpre/hpre_main.c +19 -13
@@ -354,6 +354,8 @@ static struct dfx_diff_registers hpre_diff_regs[] = { }, }; +static const struct hisi_qm_err_ini hpre_err_ini; +bool hpre_check_alg_support (struct hisi_qm *qm,u32 alg) {u32 cap_val;
@@ -1152,6 +1154,7 @@ static int hpre_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) qm->qp_num = pf_q_num; qm->debug.curr_qm_qp_num = pf_q_num; qm->qm_list = &hpre_devices; + qm->err_ini = &hpre_err_ini;if (pf_q_num_flag)set_bit (QM_MODULE_PARAM , &qm->misc_ctl); }
@@ -1341,8 +1344,6 @@ static int hpre_pf_probe_init(struct hpre *hpre)hpre_open_sva_prefetch (qm); - qm->err_ini = &hpre_err_ini; - qm->err_ini->err_info_init (qm);hisi_qm_dev_err_init (qm); ret =hpre_show_last_regs_init (qm);if (ret)
@@ -1371,6 +1372,18 @@ static int hpre_probe_init(struct hpre *hpre)return 0 ; } +static void hpre_probe_uninit (struct hisi_qm *qm) +{ +if (qm->fun_type ==QM_HW_VF ) +return ; + +hpre_cnt_regs_clear (qm); + qm->debug.curr_qm_qp_num =0 ; +hpre_show_last_regs_uninit (qm); +hpre_close_sva_prefetch (qm); +hisi_qm_dev_err_uninit (qm); +} +static int hpre_probe (struct pci_dev *pdev,const struct pci_device_id *id) {struct hisi_qm *qm;
@@ -1396,7 +1409,7 @@ static int hpre_probe(struct pci_dev *pdev, const struct pci_device_id *id) ret =hisi_qm_start (qm);if (ret) - goto err_with_err_init; + goto err_with_probe_init; ret =hpre_debugfs_init (qm);if (ret)
@@ -1433,9 +1446,8 @@ static int hpre_probe(struct pci_dev *pdev, const struct pci_device_id *id)hpre_debugfs_exit (qm);hisi_qm_stop (qm,QM_NORMAL ); -err_with_err_init: -hpre_show_last_regs_uninit (qm); -hisi_qm_dev_err_uninit (qm); +err_with_probe_init: +hpre_probe_uninit (qm); err_with_qm_init:hisi_qm_uninit (qm);
@@ -1456,13 +1468,7 @@ static void hpre_remove(struct pci_dev *pdev)hpre_debugfs_exit (qm);hisi_qm_stop (qm,QM_NORMAL ); -if (qm->fun_type ==QM_HW_PF ) { -hpre_cnt_regs_clear (qm); - qm->debug.curr_qm_qp_num =0 ; -hpre_show_last_regs_uninit (qm); -hisi_qm_dev_err_uninit (qm); - } - +hpre_probe_uninit (qm);hisi_qm_uninit (qm); }
drivers/crypto/hisilicon/qm.c +80 -34
183 lines not on this page · raw message
drivers/crypto/hisilicon/sec2/sec_main.c +7 -9
@@ -1063,9 +1063,6 @@ static int sec_pf_probe_init(struct sec_dev *sec)struct hisi_qm *qm = &sec->qm;int ret; - qm->err_ini = &sec_err_ini; - qm->err_ini->err_info_init (qm); - ret =sec_set_user_domain_and_cache (qm);if (ret)return ret;
@@ -1120,6 +1117,7 @@ static int sec_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) qm->qp_num = pf_q_num; qm->debug.curr_qm_qp_num = pf_q_num; qm->qm_list = &sec_devices; + qm->err_ini = &sec_err_ini;if (pf_q_num_flag)set_bit (QM_MODULE_PARAM , &qm->misc_ctl); }else if (qm->fun_type ==QM_HW_VF && qm->ver ==QM_HW_V1 ) {
@@ -1184,6 +1182,12 @@ static int sec_probe_init(struct sec_dev *sec)static void sec_probe_uninit (struct hisi_qm *qm) { +if (qm->fun_type ==QM_HW_VF ) +return ; + +sec_debug_regs_clear (qm); +sec_show_last_regs_uninit (qm); +sec_close_sva_prefetch (qm);hisi_qm_dev_err_uninit (qm); }
@@ -1276,7 +1280,6 @@ static int sec_probe(struct pci_dev *pdev, const struct pci_device_id *id)sec_debugfs_exit (qm);hisi_qm_stop (qm,QM_NORMAL ); err_probe_uninit: -sec_show_last_regs_uninit (qm);sec_probe_uninit (qm); err_qm_uninit:sec_qm_uninit (qm);
@@ -1298,11 +1301,6 @@ static void sec_remove(struct pci_dev *pdev)sec_debugfs_exit (qm); (void )hisi_qm_stop (qm,QM_NORMAL ); - -if (qm->fun_type ==QM_HW_PF ) -sec_debug_regs_clear (qm); -sec_show_last_regs_uninit (qm); -sec_probe_uninit (qm);sec_qm_uninit (qm);
drivers/crypto/hisilicon/zip/zip_main.c +15 -8
@@ -1151,8 +1151,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip) hisi_zip->ctrl = ctrl; ctrl->hisi_zip = hisi_zip; - qm->err_ini = &hisi_zip_err_ini; - qm->err_ini->err_info_init (qm); ret =hisi_zip_set_user_domain_and_cache (qm);if (ret)
@@ -1213,6 +1211,7 @@ static int hisi_zip_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) qm->qp_num = pf_q_num; qm->debug.curr_qm_qp_num = pf_q_num; qm->qm_list = &zip_devices; + qm->err_ini = &hisi_zip_err_ini;if (pf_q_num_flag)set_bit (QM_MODULE_PARAM , &qm->misc_ctl); }else if (qm->fun_type ==QM_HW_VF && qm->ver ==QM_HW_V1 ) {
@@ -1279,6 +1278,16 @@ static int hisi_zip_probe_init(struct hisi_zip *hisi_zip)return 0 ; } +static void hisi_zip_probe_uninit (struct hisi_qm *qm) +{ +if (qm->fun_type ==QM_HW_VF ) +return ; + +hisi_zip_show_last_regs_uninit (qm); +hisi_zip_close_sva_prefetch (qm); +hisi_qm_dev_err_uninit (qm); +} +static int hisi_zip_probe (struct pci_dev *pdev,const struct pci_device_id *id) {struct hisi_zip *hisi_zip;
@@ -1305,7 +1314,7 @@ static int hisi_zip_probe(struct pci_dev *pdev, const struct pci_device_id *id) ret =hisi_qm_start (qm);if (ret) - goto err_dev_err_uninit; + goto err_probe_uninit; ret =hisi_zip_debugfs_init (qm);if (ret)
@@ -1342,9 +1351,8 @@ static int hisi_zip_probe(struct pci_dev *pdev, const struct pci_device_id *id)hisi_zip_debugfs_exit (qm);hisi_qm_stop (qm,QM_NORMAL ); -err_dev_err_uninit: -hisi_zip_show_last_regs_uninit (qm); -hisi_qm_dev_err_uninit (qm); +err_probe_uninit: +hisi_zip_probe_uninit (qm); err_qm_uninit:hisi_zip_qm_uninit (qm);
@@ -1365,8 +1373,7 @@ static void hisi_zip_remove(struct pci_dev *pdev)hisi_zip_debugfs_exit (qm);hisi_qm_stop (qm,QM_NORMAL ); -hisi_zip_show_last_regs_uninit (qm); -hisi_qm_dev_err_uninit (qm); +hisi_zip_probe_uninit (qm);hisi_zip_qm_uninit (qm); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/798 crypto: hisilicon/qm - inject error before stopping queue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <[email protected]>
[ Upstream commit b04f06fc0243600665b3b50253869533b7938468 ]
The master ooo cannot be completely closed when the accelerator core reports memory error. Therefore, the driver needs to inject the qm error to close the master ooo. Currently, the qm error is injected after stopping queue, memory may be released immediately after stopping queue, causing the device to access the released memory. Therefore, error is injected to close master ooo before stopping queue to ensure that the device does not access the released memory.
--- drivers/crypto/hisilicon/qm.c | 47 ++++++++++++++++++----------------- 1 file changed, 24 insertions(+), 23 deletions(-)
drivers/crypto/hisilicon/qm.c +24 -23
@@ -4017,6 +4017,28 @@ static int qm_set_vf_mse(struct hisi_qm *qm, bool set)return -ETIMEDOUT ; } +static void qm_dev_ecc_mbit_handle (struct hisi_qm *qm) +{ +u32 nfe_enb =0 ; + +/* Kunpeng930 hardware automatically close master ooo when NFE occurs */ +if (qm->ver >=QM_HW_V3 ) +return ; + +if (!qm->err_status.is_dev_ecc_mbit && + qm->err_status.is_qm_ecc_mbit && + qm->err_ini->close_axi_master_ooo) { + qm->err_ini->close_axi_master_ooo (qm); + }else if (qm->err_status.is_dev_ecc_mbit && + !qm->err_status.is_qm_ecc_mbit && + !qm->err_ini->close_axi_master_ooo) { + nfe_enb =readl (qm->io_base +QM_RAS_NFE_ENABLE ); +writel (nfe_enb &QM_RAS_NFE_MBIT_DISABLE , + qm->io_base +QM_RAS_NFE_ENABLE ); +writel (QM_ECC_MBIT , qm->io_base +QM_ABNORMAL_INT_SET ); + } +} +static int qm_vf_reset_prepare (struct hisi_qm *qm,enum qm_stop_reason stop_reason) {
@@ -4081,6 +4103,8 @@ static int qm_controller_reset_prepare(struct hisi_qm *qm)return ret; } +qm_dev_ecc_mbit_handle (qm); +/* PF obtains the information of VF by querying the register. */ qm_cmd_uninit (qm);
@@ -4121,28 +4145,6 @@ static int qm_master_ooo_check(struct hisi_qm *qm)return ret; } -static void qm_dev_ecc_mbit_handle (struct hisi_qm *qm) -{ -u32 nfe_enb =0 ; - -/* Kunpeng930 hardware automatically close master ooo when NFE occurs */ -if (qm->ver >=QM_HW_V3 ) -return ; - -if (!qm->err_status.is_dev_ecc_mbit && - qm->err_status.is_qm_ecc_mbit && - qm->err_ini->close_axi_master_ooo) { - qm->err_ini->close_axi_master_ooo (qm); - }else if (qm->err_status.is_dev_ecc_mbit && - !qm->err_status.is_qm_ecc_mbit && - !qm->err_ini->close_axi_master_ooo) { - nfe_enb =readl (qm->io_base +QM_RAS_NFE_ENABLE ); -writel (nfe_enb &QM_RAS_NFE_MBIT_DISABLE , - qm->io_base +QM_RAS_NFE_ENABLE ); -writel (QM_ECC_MBIT , qm->io_base +QM_ABNORMAL_INT_SET ); - } -} -static int qm_soft_reset_prepare (struct hisi_qm *qm) {struct pci_dev *pdev = qm->pdev;
@@ -4167,7 +4169,6 @@ static int qm_soft_reset_prepare(struct hisi_qm *qm)return ret; } -qm_dev_ecc_mbit_handle (qm); ret =qm_master_ooo_check (qm);if (ret)return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/798 wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit a26a5107bc52922cf5f67361e307ad66547b51c7 ]
Looking at https://syzkaller.appspot.com/bug?extid=1a3986bbd3169c307819
and running reproducer with CONFIG_UBSAN_BOUNDS, I've noticed the following:
[ T4985] UBSAN: array-index-out-of-bounds in net/wireless/scan.c:3479:25 [ T4985] index 164 is out of range for type 'struct ieee80211_channel *[]' <...skipped...>
[ T4985] Call Trace:
[ T4985] <TASK> [ T4985] dump_stack_lvl+0x1c2/0x2a0 [ T4985] ? __pfx_dump_stack_lvl+0x10/0x10 [ T4985] ? __pfx__printk+0x10/0x10 [ T4985] __ubsan_handle_out_of_bounds+0x127/0x150 [ T4985] cfg80211_wext_siwscan+0x11a4/0x1260
<...the rest is not too useful...>
Even if we do 'creq->n_channels = n_channels' before 'creq->ssids = (void *)&creq->channels[n_channels]', UBSAN treats the latter as off-by-one error. Fix this by using pointer arithmetic rather than an expression with explicit array indexing and use convenient 'struct_size()' to simplify the math here and in 'kzalloc()' above.
--- net/wireless/scan.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/wireless/scan.c +3 -3
@@ -2750,8 +2750,8 @@ int cfg80211_wext_siwscan(struct net_device *dev, n_channels =ieee80211_get_num_supported_channels (wiphy); } - creq =kzalloc (sizeof (*creq) +sizeof (struct cfg80211_ssid ) + - n_channels *sizeof (void *), + creq =kzalloc (struct_size (creq, channels, n_channels) + +sizeof (struct cfg80211_ssid ),GFP_ATOMIC );if (!creq)return -ENOMEM ;
@@ -2759,7 +2759,7 @@ int cfg80211_wext_siwscan(struct net_device *dev, creq->wiphy = wiphy; creq->wdev = dev->ieee80211_ptr;/* SSIDs come after channels */ - creq->ssids = (void *)&creq->channels[n_channels]; + creq->ssids = (void *)creq +struct_size (creq, channels, n_channels); creq->n_channels = n_channels; creq->n_ssids =1 ; creq->scan_start = jiffies;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/798 wifi: mt76: mt7915: fix rx filter setting for bfee functionality
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Howard Hsu <[email protected]>
[ Upstream commit 6ac80fce713e875a316a58975b830720a3e27721 ]
Fix rx filter setting to prevent dropping NDPA frames. Without this change, bfee functionality may behave abnormally.
--- drivers/net/wireless/mediatek/mt76/mt7915/main.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/main.c +1 -2
@@ -540,8 +540,7 @@ static void mt7915_configure_filter(struct ieee80211_hw *hw,MT76_FILTER (CONTROL ,MT_WF_RFCR_DROP_CTS |MT_WF_RFCR_DROP_RTS | -MT_WF_RFCR_DROP_CTL_RSV | -MT_WF_RFCR_DROP_NDPA ); +MT_WF_RFCR_DROP_CTL_RSV ); *total_flags = flags;mt76_wr (dev,MT_WF_RFCR (band), phy->rxfilter);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/798 wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 15ea13b1b1fbf6364d4cd568e65e4c8479632999 ]
Although not reproduced in practice, these two cases may be considered by UBSAN as off-by-one errors. So fix them in the same way as in commit a26a5107bc52 ("wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()").
--- net/wireless/nl80211.c | 3 ++- net/wireless/sme.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
net/wireless/nl80211.c +2 -1
@@ -9465,7 +9465,8 @@ nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,return ERR_PTR (-ENOMEM );if (n_ssids) - request->ssids = (void *)&request->channels[n_channels]; + request->ssids = (void *)request + +struct_size (request, channels, n_channels); request->n_ssids = n_ssids;if (ie_len) {if (n_ssids)
net/wireless/sme.c +2 -1
@@ -115,7 +115,8 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev) n_channels = i; } request->n_channels = n_channels; - request->ssids = (void *)&request->channels[n_channels]; + request->ssids = (void *)request + +struct_size (request, channels, n_channels); request->n_ssids =1 ; memcpy(request->ssids[0].ssid, wdev->conn->params.ssid,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/798 wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 9d301de12da6e1bb069a9835c38359b8e8135121 ]
Since '__dev_queue_xmit()' should be called with interrupts enabled, the following backtrace:
ieee80211_do_stop()
...
spin_lock_irqsave(&local->queue_stop_reason_lock, flags)
...
ieee80211_free_txskb()
ieee80211_report_used_skb()
ieee80211_report_ack_skb()
cfg80211_mgmt_tx_status_ext()
nl80211_frame_tx_status()
genlmsg_multicast_netns()
genlmsg_multicast_netns_filtered()
nlmsg_multicast_filtered()
netlink_broadcast_filtered()
do_one_broadcast()
netlink_broadcast_deliver()
__netlink_sendskb()
netlink_deliver_tap()
__netlink_deliver_tap_skb()
dev_queue_xmit()
__dev_queue_xmit() ; with IRQS disabled ...
spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags)
issues the warning (as reported by syzbot reproducer):
WARNING: CPU: 2 PID: 5128 at kernel/softirq.c:362 __local_bh_enable_ip+0xc3/0x120
Fix this by implementing a two-phase skb reclamation in 'ieee80211_do_stop()', where actual work is performed outside of a section with interrupts disabled.
--- net/mac80211/iface.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
net/mac80211/iface.c +16 -1
@@ -466,6 +466,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do {struct ieee80211_local *local = sdata->local;unsigned long flags; +struct sk_buff_head freeq;struct sk_buff *skb, *tmp;u32 hw_reconf_flags =0 ;int i, flushed;
@@ -658,18 +659,32 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_doskb_queue_purge (&sdata->status_queue); } +/* +* Since ieee80211_free_txskb() may issue __dev_queue_xmit() +* which should be called with interrupts enabled, reclamation +* is done in two phases: +*/ +__skb_queue_head_init (&freeq); + +/* unlink from local queues... */ spin_lock_irqsave (&local->queue_stop_reason_lock, flags);for (i =0 ; i <IEEE80211_MAX_QUEUES ; i++) { skb_queue_walk_safe(&local->pending[i], skb, tmp) {struct ieee80211_tx_info *info =IEEE80211_SKB_CB (skb);if (info->control.vif == &sdata->vif) {__skb_unlink (skb, &local->pending[i]); -ieee80211_free_txskb (&local->hw, skb); +__skb_queue_tail (&freeq, skb); } } }spin_unlock_irqrestore (&local->queue_stop_reason_lock, flags); +/* ... and perform actual reclamation with interrupts enabled. */ + skb_queue_walk_safe(&freeq, skb, tmp) { +__skb_unlink (skb, &freeq); +ieee80211_free_txskb (&local->hw, skb); + } +if (sdata->vif.type ==NL80211_IFTYPE_AP_VLAN )ieee80211_txq_remove_vlan (local, sdata);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/798 wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawei Ye <[email protected]>
[ Upstream commit 6d7c6ae1efb1ff68bc01d79d94fdf0388f86cdd8 ]
In the wilc_parse_join_bss_param function, the TSF field of the ies structure is accessed after the RCU read-side critical section is unlocked. According to RCU usage rules, this is illegal. Reusing this pointer can lead to unpredictable behavior, including accessing memory that has been updated or causing use-after-free issues.
This possible bug was identified using a static analysis tool developed by myself, specifically designed to detect RCU-related issues.
To address this, the TSF value is now stored in a local variable ies_tsf before the RCU lock is released. The param->tsf_lo field is then assigned using this local variable, ensuring that the TSF value is safely accessed.
--- drivers/net/wireless/microchip/wilc1000/hif.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/microchip/wilc1000/hif.c +3 -1
@@ -381,6 +381,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,struct wilc_join_bss_param *param;u8 rates_len =0 ;int ies_len; +u64 ies_tsf;int ret; param =kzalloc (sizeof (*param),GFP_KERNEL );
@@ -396,6 +397,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,return NULL ; } ies_len = ies->len; + ies_tsf = ies->tsf;rcu_read_unlock (); param->beacon_period =cpu_to_le16 (bss->beacon_interval);
@@ -451,7 +453,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,IEEE80211_P2P_ATTR_ABSENCE_NOTICE , (u8 *)&noa_attr, sizeof(noa_attr));if (ret >0 ) { - param->tsf_lo =cpu_to_le32 (ies->tsf); + param->tsf_lo =cpu_to_le32 (ies_tsf); param->noa_enabled =1 ; param->idx = noa_attr.index;if (noa_attr.oppps_ctwindow &IEEE80211_P2P_OPPPS_ENABLE_BIT ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/798 Bluetooth: hci_core: Fix sending MGMT_EV_CONNECT_FAILED
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit d47da6bd4cfa982fe903f33423b9e2ec541e9496 ]
If HCI_CONN_MGMT_CONNECTED has been set then the event shall be HCI_CONN_MGMT_DISCONNECTED.
--- include/net/bluetooth/hci_core.h | 4 ++-- net/bluetooth/hci_conn.c | 6 ++---- net/bluetooth/mgmt.c | 13 +++++++++---- 3 files changed, 13 insertions(+), 10 deletions(-)
include/net/bluetooth/hci_core.h +2 -2
@@ -2071,8 +2071,8 @@ void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, bool mgmt_connected);void mgmt_disconnect_failed (struct hci_dev *hdev,bdaddr_t *bdaddr,u8 link_type,u8 addr_type,u8 status); -void mgmt_connect_failed (struct hci_dev *hdev,bdaddr_t *bdaddr,u8 link_type, -u8 addr_type,u8 status); +void mgmt_connect_failed (struct hci_dev *hdev,struct hci_conn *conn, +u8 status);void mgmt_pin_code_request (struct hci_dev *hdev,bdaddr_t *bdaddr,u8 secure);void mgmt_pin_code_reply_complete (struct hci_dev *hdev,bdaddr_t *bdaddr,u8 status);
net/bluetooth/hci_conn.c +2 -4
@@ -107,8 +107,7 @@ static void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status)* where a timeout + cancel does indicate an actual failure. */ if (status && status !=HCI_ERROR_UNKNOWN_CONN_ID ) -mgmt_connect_failed (hdev, &conn->dst, conn->type, - conn->dst_type, status); +mgmt_connect_failed (hdev, conn, status);/* The connection attempt was doing scan for new RPA, and is * in scan phase. If params are not associated with any other
@@ -1181,8 +1180,7 @@ void hci_conn_failed(struct hci_conn *conn, u8 status)hci_le_conn_failed (conn, status);break ;case ACL_LINK : -mgmt_connect_failed (hdev, &conn->dst, conn->type, - conn->dst_type, status); +mgmt_connect_failed (hdev, conn, status);break ; }
net/bluetooth/mgmt.c +9 -4
@@ -9816,13 +9816,18 @@ void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,mgmt_pending_remove (cmd); } -void mgmt_connect_failed (struct hci_dev *hdev,bdaddr_t *bdaddr,u8 link_type, -u8 addr_type,u8 status) +void mgmt_connect_failed (struct hci_dev *hdev,struct hci_conn *conn,u8 status) {struct mgmt_ev_connect_failed ev; -bacpy (&ev.addr.bdaddr, bdaddr); - ev.addr.type =link_to_bdaddr (link_type, addr_type); +if (test_and_clear_bit (HCI_CONN_MGMT_CONNECTED , &conn->flags)) { +mgmt_device_disconnected (hdev, &conn->dst, conn->type, + conn->dst_type, status, true); +return ; + } + +bacpy (&ev.addr.bdaddr, &conn->dst); + ev.addr.type =link_to_bdaddr (conn->type, conn->dst_type); ev.status =mgmt_status (status);mgmt_event (MGMT_EV_CONNECT_FAILED , hdev, &ev,sizeof (ev),NULL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/798 Bluetooth: hci_sync: Ignore errors from HCI_OP_REMOTE_NAME_REQ_CANCEL
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit cfbfeee61582e638770a1a10deef866c9adb38f5 ]
This ignores errors from HCI_OP_REMOTE_NAME_REQ_CANCEL since it shouldn't interfere with the stopping of discovery and in certain conditions it seems to be failing.
--- net/bluetooth/hci_sync.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/bluetooth/hci_sync.c +4 -1
@@ -5256,7 +5256,10 @@ int hci_stop_discovery_sync(struct hci_dev *hdev)if (!e)return 0 ; -return hci_remote_name_cancel_sync (hdev, &e->data.bdaddr); +/* Ignore cancel errors since it should interfere with stopping +* of the discovery. +*/ +hci_remote_name_cancel_sync (hdev, &e->data.bdaddr); }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/798 sock_map: Add a cond_resched() in sock_hash_free()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit b1339be951ad31947ae19bc25cb08769bf255100 ]
Several syzbot soft lockup reports all have in common sock_hash_free()
If a map with a large number of buckets is destroyed, we need to yield the cpu when needed.
--- net/core/sock_map.c | 1 + 1 file changed, 1 insertion(+)
net/core/sock_map.c +1 -0
@@ -1172,6 +1172,7 @@ static void sock_hash_free(struct bpf_map *map)sock_put (elem->sk);sock_hash_free_elem (htab, elem); } +cond_resched (); }/* wait for psock readers accessing its map link */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/798 can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 94b0818fa63555a65f6ba107080659ea6bcca63e ]
syzbot reported a warning in bcm_release(). [0]
The blamed change fixed another warning that is triggered when connect() is issued again for a socket whose connect()ed device has been unregistered.
However, if the socket is just close()d without the 2nd connect(), the remaining bo->bcm_proc_read triggers unnecessary remove_proc_entry() in bcm_release().
Let's clear bo->bcm_proc_read after remove_proc_entry() in bcm_notify().
[0]
name '4986'
WARNING: CPU: 0 PID: 5234 at fs/proc/generic.c:711 remove_proc_entry+0x2e7/0x5d0 fs/proc/generic.c:711 Modules linked in: CPU: 0 UID: 0 PID: 5234 Comm: syz-executor606 Not tainted 6.11.0-rc5-syzkaller-00178-g5517ae241919 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:remove_proc_entry+0x2e7/0x5d0 fs/proc/generic.c:711 Code: ff eb 05 e8 cb 1e 5e ff 48 8b 5c 24 10 48 c7 c7 e0 f7 aa 8e e8 2a 38 8e 09 90 48 c7 c7 60 3a 1b 8c 48 89 de e8 da 42 20 ff 90 <0f> 0b 90 90 48 8b 44 24 18 48 c7 44 24 40 0e 36 e0 45 49 c7 04 07 RSP: 0018:ffffc9000345fa20 EFLAGS: 00010246 RAX: 2a2d0aee2eb64600 RBX: ffff888032f1f548 RCX: ffff888029431e00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000345fb08 R08: ffffffff8155b2f2 R09: 1ffff1101710519a R10: dffffc0000000000 R11: ffffed101710519b R12: ffff888011d38640 R13: 0000000000000004 R14: 0000000000000000 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcfb52722f0 CR3: 000000000e734000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> bcm_release+0x250/0x880 net/can/bcm.c:1578 __sock_release net/socket.c:659 [inline] sock_close+0xbc/0x240 net/socket.c:1421 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x27f0 kernel/exit.c:882 do_group_exit+0x207/0x2c0 kernel/exit.c:1031 __do_sys_exit_group kernel/exit.c:1042 [inline] __se_sys_exit_group kernel/exit.c:1040 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fcfb51ee969 Code: Unable to access opcode bytes at 0x7fcfb51ee93f. RSP: 002b:00007ffce0109ca8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fcfb51ee969 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 RBP: 00007fcfb526f3b0 R08: ffffffffffffffb8 R09: 0000555500000000 R10: 0000555500000000 R11: 0000000000000246 R12: 00007fcfb526f3b0 R13: 0000000000000000 R14: 00007fcfb5271ee0 R15: 00007fcfb51bf160 </TASK>
--- net/can/bcm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/can/bcm.c +3 -1
@@ -1429,8 +1429,10 @@ static void bcm_notify(struct bcm_sock *bo, unsigned long msg,/* remove device reference, if this is our bound device */ if (bo->bound && bo->ifindex == dev->ifindex) {#if IS_ENABLED (CONFIG_PROC_FS ) -if (sock_net (sk)->can.bcmproc_dir && bo->bcm_proc_read) +if (sock_net (sk)->can.bcmproc_dir && bo->bcm_proc_read) {remove_proc_entry (bo->procname,sock_net (sk)->can.bcmproc_dir); + bo->bcm_proc_read =NULL ; + }#endif bo->bound =0 ; bo->ifindex =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/798 can: m_can: Remove repeated check for is_peripheral
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Schneider-Pargmann <[email protected]>
[ Upstream commit 73042934e4a30d9f45ff9cb0b3b029a01dbe7130 ]
Merge both if-blocks to fix this.
Stable-dep-of: 801ad2f87b0c ("can: m_can: enable NAPI before enabling interrupts")
--- drivers/net/can/m_can/m_can.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/can/m_can/m_can.c +1 -3
@@ -1566,10 +1566,8 @@ static int m_can_close(struct net_device *dev) cdev->tx_skb =NULL ;destroy_workqueue (cdev->tx_wq); cdev->tx_wq =NULL ; - } - -if (cdev->is_peripheral)can_rx_offload_disable (&cdev->offload); + }close_candev (dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/798 can: m_can: enable NAPI before enabling interrupts
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jake Hamby <[email protected]>
[ Upstream commit 801ad2f87b0c6d0c34a75a4efd6bfd3a2d9f9298 ]
If an interrupt (RX-complete or error flag) is set when bringing up the CAN device, e.g. due to CAN bus traffic before initializing the device, when m_can_start() is called and interrupts are enabled, m_can_isr() is called immediately, which disables all CAN interrupts and calls napi_schedule().
Because napi_enable() isn't called until later in m_can_open(), the call to napi_schedule() never schedules the m_can_poll() callback and the device is left with interrupts disabled and can't receive any CAN packets until rebooted.
This can be verified by running "cansend" from another device before setting the bitrate and calling "ip link set up can0" on the test device. Adding debug lines to m_can_isr() shows it's called with flags (IR_EP | IR_EW | IR_CRCE), which calls m_can_disable_all_interrupts() and napi_schedule(), and then m_can_poll() is never called.
Move the call to napi_enable() above the call to m_can_start() to enable any initial interrupt flags to be handled by m_can_poll() so that interrupts are reenabled. Add a call to napi_disable() in the error handling section of m_can_open(), to handle the case where later functions return errors.
Also, in m_can_close(), move the call to napi_disable() below the call to m_can_stop() to ensure all interrupts are handled when bringing down the device. This race condition is much less likely to occur.
Tested on a Microchip SAMA7G54 MPU. The fix should be applicable to any SoC with a Bosch M_CAN controller.
--- drivers/net/can/m_can/m_can.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/net/can/m_can/m_can.c +6 -6
@@ -1555,9 +1555,6 @@ static int m_can_close(struct net_device *dev)netif_stop_queue (dev); -if (!cdev->is_peripheral) -napi_disable (&cdev->napi); -m_can_stop (dev);m_can_clk_stop (cdev);free_irq (dev->irq, dev);
@@ -1567,6 +1564,8 @@ static int m_can_close(struct net_device *dev)destroy_workqueue (cdev->tx_wq); cdev->tx_wq =NULL ;can_rx_offload_disable (&cdev->offload); + }else { +napi_disable (&cdev->napi); }close_candev (dev);
@@ -1784,6 +1783,8 @@ static int m_can_open(struct net_device *dev)if (cdev->is_peripheral)can_rx_offload_enable (&cdev->offload); +else +napi_enable (&cdev->napi);/* register interrupt handler */ if (cdev->is_peripheral) {
@@ -1815,9 +1816,6 @@ static int m_can_open(struct net_device *dev)if (err) goto exit_start_fail; -if (!cdev->is_peripheral) -napi_enable (&cdev->napi); -netif_start_queue (dev);return 0 ;
@@ -1831,6 +1829,8 @@ static int m_can_open(struct net_device *dev) out_wq_fail:if (cdev->is_peripheral)can_rx_offload_disable (&cdev->offload); +else +napi_disable (&cdev->napi);close_candev (dev); exit_disable_clks:m_can_clk_stop (cdev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/798 can: m_can: m_can_close(): stop clocks after device has been shut down
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit 2c09b50efcad985cf920ca88baa9aa52b1999dcc ]
After calling m_can_stop() an interrupt may be pending or NAPI might still be executed. This means the driver might still touch registers of the IP core after the clocks have been disabled. This is not good practice and might lead to aborts depending on the SoC integration.
To avoid these potential problems, make m_can_close() symmetric to m_can_open(), i.e. stop the clocks at the end, right before shutting down the transceiver.
--- drivers/net/can/m_can/m_can.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/m_can/m_can.c +1 -1
@@ -1556,7 +1556,6 @@ static int m_can_close(struct net_device *dev)netif_stop_queue (dev);m_can_stop (dev); -m_can_clk_stop (cdev);free_irq (dev->irq, dev);if (cdev->is_peripheral) {
@@ -1570,6 +1569,7 @@ static int m_can_close(struct net_device *dev)close_candev (dev); +m_can_clk_stop (cdev);phy_power_off (cdev->transceiver);return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/798 Bluetooth: btusb: Fix not handling ZPL/short-transfer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 7b05933340f4490ef5b09e84d644d12484b05fdf ]
Requesting transfers of the exact same size of wMaxPacketSize may result in ZPL/short-transfer since the USB stack cannot handle it as we are limiting the buffer size to be the same as wMaxPacketSize.
Also, in terms of throughput this change has the same effect to interrupt endpoint as 290ba200815f "Bluetooth: Improve USB driver throughput by increasing the frame size" had for the bulk endpoint, so users of the advertisement bearer (e.g. BT Mesh) may benefit from this change.
--- drivers/bluetooth/btusb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/bluetooth/btusb.c +4 -1
@@ -1189,7 +1189,10 @@ static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)if (!urb)return -ENOMEM ; - size =le16_to_cpu (data->intr_ep->wMaxPacketSize); +/* Use maximum HCI Event size so the USB stack handles +* ZPL/short-transfer automatically. +*/ + size =HCI_MAX_EVENT_SIZE ; buf =kmalloc (size, mem_flags);if (!buf) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/798 bareudp: Pull inner IP header in bareudp_udp_encap_recv().
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit 45fa29c85117170b0508790f878b13ec6593c888 ]
Bareudp reads the inner IP header to get the ECN value. Therefore, it needs to ensure that it's part of the skb's linear data.
This is similar to the vxlan and geneve fixes for that same problem:
* commit f7789419137b ("vxlan: Pull inner IP header in vxlan_rcv().")
* commit 1ca1ba465e55 ("geneve: make sure to pull inner header in
geneve_rx()")
--- drivers/net/bareudp.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-)
drivers/net/bareudp.c +18 -2
@@ -67,6 +67,7 @@ static int bareudp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)__be16 proto;void *oiph;int err; +int nh; bareudp =rcu_dereference_sk_user_data (sk);if (!bareudp)
@@ -144,10 +145,25 @@ static int bareudp_udp_encap_recv(struct sock *sk, struct sk_buff *skb) }skb_dst_set (skb, &tun_dst->dst); skb->dev = bareudp->dev; - oiph =skb_network_header (skb); -skb_reset_network_header (skb);skb_reset_mac_header (skb); +/* Save offset of outer header relative to skb->head, +* because we are going to reset the network header to the inner header +* and might change skb->head. +*/ + nh =skb_network_header (skb) - skb->head; + +skb_reset_network_header (skb); + +if (!pskb_inet_may_pull (skb)) { +DEV_STATS_INC (bareudp->dev, rx_length_errors); +DEV_STATS_INC (bareudp->dev, rx_errors); + goto drop; + } + +/* Get the outer header. */ + oiph = skb->head + nh; +if (!ipv6_mod_enabled () || family ==AF_INET ) err =IP_ECN_decapsulate (oiph, skb);else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/798 bareudp: Pull inner IP header on xmit.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit c471236b2359e6b27388475dd04fff0a5e2bf922 ]
Both bareudp_xmit_skb() and bareudp6_xmit_skb() read their skb's inner IP header to get its ECN value (with ip_tunnel_ecn_encap()). Therefore we need to ensure that the inner IP header is part of the skb's linear data.
--- drivers/net/bareudp.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/bareudp.c +6 -0
@@ -319,6 +319,9 @@ static int bareudp_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be32 saddr;int err; +if (!skb_vlan_inet_prepare (skb, skb->protocol !=htons (ETH_P_TEB ))) +return -EINVAL ; +if (!sock)return -ESHUTDOWN ;
@@ -382,6 +385,9 @@ static int bareudp6_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be16 sport;int err; +if (!skb_vlan_inet_prepare (skb, skb->protocol !=htons (ETH_P_TEB ))) +return -EINVAL ; +if (!sock)return -ESHUTDOWN ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/798 net: enetc: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 799a9225997799f7b1b579bc50a93b78b4fb2a01 ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/net/ethernet/freescale/enetc/enetc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/freescale/enetc/enetc.c +1 -2
@@ -2181,12 +2181,11 @@ static int enetc_setup_irqs(struct enetc_ndev_priv *priv)snprintf (v->name,sizeof (v->name),"%s-rxtx%d" , priv->ndev->name, i); - err =request_irq (irq, enetc_msix,0 , v->name, v); + err =request_irq (irq, enetc_msix,IRQF_NO_AUTOEN , v->name, v);if (err) {dev_err (priv->dev,"request_irq() failed!\n" ); goto irq_err; } -disable_irq (irq); v->tbier_base = hw->reg +ENETC_BDR (TX ,0 ,ENETC_TBIER ); v->rbier = hw->reg +ENETC_BDR (RX , i,ENETC_RBIER );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/798 r8169: disable ALDPS per default for RTL8125
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
[ Upstream commit b9c7ac4fe22c608acf6153a3329df2b6b6cd416c ]
En-Wei reported that traffic breaks if cable is unplugged for more than 3s and then re-plugged. This was supposed to be fixed by 621735f59064 ("r8169: fix rare issue with broken rx after link-down on RTL8125"). But apparently this didn't fix the issue for everybody. The 3s threshold rang a bell, as this is the delay after which ALDPS kicks in. And indeed disabling ALDPS fixes the issue for this user. Maybe this fixes the issue in general. In a follow-up step we could remove the first fix attempt and see whether anybody complains.
--- drivers/net/ethernet/realtek/r8169_phy_config.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/realtek/r8169_phy_config.c +2 -0
@@ -1060,6 +1060,7 @@ static void rtl8125a_2_hw_phy_config(struct rtl8169_private *tp,phy_modify_paged (phydev,0xa86 ,0x15 ,0x0001 ,0x0000 );rtl8168g_enable_gphy_10m (phydev); +rtl8168g_disable_aldps (phydev);rtl8125a_config_eee_phy (phydev); }
@@ -1099,6 +1100,7 @@ static void rtl8125b_hw_phy_config(struct rtl8169_private *tp,phy_modify_paged (phydev,0xbf8 ,0x12 ,0xe000 ,0xa000 );rtl8125_legacy_force_mode (phydev); +rtl8168g_disable_aldps (phydev);rtl8125b_config_eee_phy (phydev); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/798 net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Iurman <[email protected]>
[ Upstream commit 2c84b0aa28b9e73e8c4b4ce038269469434ae372 ]
Free the skb before returning from rpl_input when skb_cow_head() fails. Use a "drop" label and goto instructions.
--- net/ipv6/rpl_iptunnel.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
net/ipv6/rpl_iptunnel.c +7 -5
@@ -263,10 +263,8 @@ static int rpl_input(struct sk_buff *skb) rlwt =rpl_lwt_lwtunnel (orig_dst->lwtstate); err =rpl_do_srh (skb, rlwt); -if (unlikely (err)) { -kfree_skb (skb); -return err; - } +if (unlikely (err)) + goto drop;local_bh_disable (); dst =dst_cache_get (&rlwt->cache);
@@ -287,9 +285,13 @@ static int rpl_input(struct sk_buff *skb) err =skb_cow_head (skb,LL_RESERVED_SPACE (dst->dev));if (unlikely (err)) -return err; + goto drop;return dst_input (skb); + +drop: +kfree_skb (skb); +return err; } static int nla_put_rpl_srh(struct sk_buff *skb, int attrtype,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/798 net: tipc: avoid possible garbage value
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit 99655a304e450baaae6b396cb942b9e47659d644 ]
Clang static checker (scan-build) warning:net/tipc/bcast.c:305:4:
The expression is an uninitialized value. The computed value will also be garbage [core.uninitialized.Assign]
305 | (*cong_link_cnt)++;
| ^~~~~~~~~~~~~~~~~~tipc_rcast_xmit() will increase cong_link_cnt's value, but cong_link_cnt is uninitialized. Although it won't really cause a problem, it's better to fix it.
--- net/tipc/bcast.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tipc/bcast.c +1 -1
@@ -320,8 +320,8 @@ static int tipc_mcast_send_sync(struct net *net, struct sk_buff *skb, {struct tipc_msg *hdr, *_hdr;struct sk_buff_head tmpq; +u16 cong_link_cnt =0 ;struct sk_buff *_skb; -u16 cong_link_cnt;int rc =0 ;/* Is a cluster supporting with new capabilities ? */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/798 ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 04ccecfa959d3b9ae7348780d8e379c6486176ac ]
Blamed commit accidentally removed a check for rt->rt6i_idev being NULL, as spotted by syzbot:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 UID: 0 PID: 10998 Comm: syz-executor Not tainted 6.11.0-rc6-syzkaller-00208-g625403177711 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline] RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914 Code: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06 RSP: 0018:ffffc900047374e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0 RBP: ffffc900047375d0 R08: 0000000000000003 R09: fffff520008e6e8c R10: dffffc0000000000 R11: fffff520008e6e8c R12: 1ffff1100fdf8f18 R13: ffff88807efc7998 R14: 0000000000000000 R15: ffff88807efc7930 FS: 0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002a80 CR3: 0000000022f62000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> addrconf_ifdown+0x15d/0x1bd0 net/ipv6/addrconf.c:3856 addrconf_notify+0x3cb/0x1020 notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93 call_netdevice_notifiers_extack net/core/dev.c:2032 [inline] call_netdevice_notifiers net/core/dev.c:2046 [inline] unregister_netdevice_many_notify+0xd81/0x1c40 net/core/dev.c:11352 unregister_netdevice_many net/core/dev.c:11414 [inline] unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11289 unregister_netdevice include/linux/netdevice.h:3129 [inline] __tun_detach+0x6b9/0x1600 drivers/net/tun.c:685 tun_detach drivers/net/tun.c:701 [inline] tun_chr_close+0x108/0x1b0 drivers/net/tun.c:3510 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x27f0 kernel/exit.c:882 do_group_exit+0x207/0x2c0 kernel/exit.c:1031 __do_sys_exit_group kernel/exit.c:1042 [inline] __se_sys_exit_group kernel/exit.c:1040 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1acc77def9 Code: Unable to access opcode bytes at 0x7f1acc77decf. RSP: 002b:00007ffeb26fa738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1acc77def9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043 RBP: 00007f1acc7dd508 R08: 00007ffeb26f84d7 R09: 0000000000000003 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000000003 R14: 00000000ffffffff R15: 00007ffeb26fa8e0 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline] RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914 Code: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06 RSP: 0018:ffffc900047374e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0 RBP: ffffc900047375d0 R08: 0000000000000003 R09: fffff520008e6e8c R10: dffffc0000000000 R11: fffff520008e6e8c R12: 1ffff1100fdf8f18 R13: ffff88807efc7998 R14: 0000000000000000 R15: ffff88807efc7930 FS: 0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002a80 CR3: 0000000022f62000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
--- net/ipv6/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/route.c +1 -1
@@ -175,7 +175,7 @@ static void rt6_uncached_list_flush_dev(struct net_device *dev)struct net_device *rt_dev = rt->dst.dev;bool handled = false; -if (rt_idev->dev == dev) { +if (rt_idev && rt_idev->dev == dev) { rt->rt6i_idev =in6_dev_get (blackhole_netdev);in6_dev_put (rt_idev); handled = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/798 nbd: fix race between timeout and normal completion
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
[ Upstream commit c9ea57c91f03bcad415e1a20113bdb2077bcf990 ]
If request timetout is handled by nbd_requeue_cmd(), normal completion has to be stopped for avoiding to complete this requeued request, other use-after-free can be triggered.
Fix the race by clearing NBD_CMD_INFLIGHT in nbd_requeue_cmd(), meantime make sure that cmd->lock is grabbed for clearing the flag and the requeue.
--- drivers/block/nbd.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/block/nbd.c +12 -1
@@ -181,6 +181,17 @@ static void nbd_requeue_cmd(struct nbd_cmd *cmd) {struct request *req =blk_mq_rq_from_pdu (cmd); +lockdep_assert_held (&cmd->lock); + +/* +* Clear INFLIGHT flag so that this cmd won't be completed in +* normal completion path +* +* INFLIGHT flag will be set when the cmd is queued to nbd next +* time. +*/ +__clear_bit (NBD_CMD_INFLIGHT , &cmd->flags); +if (!test_and_set_bit (NBD_CMD_REQUEUED , &cmd->flags))blk_mq_requeue_request (req, true); }
@@ -445,8 +456,8 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req)nbd_mark_nsock_dead (nbd, nsock,1 );mutex_unlock (&nsock->tx_lock); } -mutex_unlock (&cmd->lock);nbd_requeue_cmd (cmd); +mutex_unlock (&cmd->lock);nbd_config_put (nbd);return BLK_EH_DONE ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/798 block, bfq: fix possible UAF for bfqq->bic with merge chain
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 18ad4df091dd5d067d2faa8fce1180b79f7041a7 ]
1) initial state, three tasks:
Process 1 Process 2 Process 3
(BIC1) (BIC2) (BIC3)
| Λ | Λ | Λ
| | | | | |
V | V | V |
bfqq1 bfqq2 bfqq3
process ref: 1 1 1
2) bfqq1 merged to bfqq2:
Process 1 Process 2 Process 3 (BIC1) (BIC2) (BIC3) | | | Λ \--------------\| | | V V | bfqq1--------->bfqq2 bfqq3
process ref: 0 2 1
3) bfqq2 merged to bfqq3:
Process 1 Process 2 Process 3 (BIC1) (BIC2) (BIC3) here -> Λ | | \--------------\ \-------------\| V V bfqq1--------->bfqq2---------->bfqq3
process ref: 0 1 3
In this case, IO from Process 1 will get bfqq2 from BIC1 first, and then get bfqq3 through merge chain, and finially handle IO by bfqq3. Howerver, current code will think bfqq2 is owned by BIC1, like initial state, and set bfqq2->bic to BIC1.
bfq_insert_request
-> by Process 1
bfqq = bfq_init_rq(rq)
bfqq = bfq_get_bfqq_handle_split
bfqq = bic_to_bfqq
-> get bfqq2 from BIC1
bfqq->ref++
rq->elv.priv[0] = bic
rq->elv.priv[1] = bfqq
if (bfqq_process_refs(bfqq) == 1)
bfqq->bic = bic
-> record BIC1 to bfqq2
__bfq_insert_request
new_bfqq = bfq_setup_cooperator
-> get bfqq3 from bfqq2->new_bfqq
bfqq_request_freed(bfqq)
new_bfqq->ref++
rq->elv.priv[1] = new_bfqq
-> handle IO by bfqq3
Fix the problem by checking bfqq is from merge chain fist. And this might fix a following problem reported by our syzkaller(unreproducible):
==================================================================
BUG: KASAN: slab-use-after-free in bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline] BUG: KASAN: slab-use-after-free in bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline] BUG: KASAN: slab-use-after-free in bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889 Write of size 1 at addr ffff888123839eb8 by task kworker/0:1H/18595 CPU: 0 PID: 18595 Comm: kworker/0:1H Tainted: G L 6.6.0-07439-gba2303cacfda #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Workqueue: kblockd blk_mq_requeue_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0x10d/0x610 mm/kasan/report.c:475 kasan_report+0x8e/0xc0 mm/kasan/report.c:588 bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline] bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline] bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889 bfq_get_bfqq_handle_split+0x169/0x5d0 block/bfq-iosched.c:6757 bfq_init_rq block/bfq-iosched.c:6876 [inline] bfq_insert_request block/bfq-iosched.c:6254 [inline] bfq_insert_requests+0x1112/0x5cf0 block/bfq-iosched.c:6304 blk_mq_insert_request+0x290/0x8d0 block/blk-mq.c:2593 blk_mq_requeue_work+0x6bc/0xa70 block/blk-mq.c:1502 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 kthread+0x33c/0x440 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 </TASK> Allocated by task 20776: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook mm/slab.h:763 [inline] slab_alloc_node mm/slub.c:3458 [inline] kmem_cache_alloc_node+0x1a4/0x6f0 mm/slub.c:3503 ioc_create_icq block/blk-ioc.c:370 [inline] ioc_find_get_icq+0x180/0xaa0 block/blk-ioc.c:436 bfq_prepare_request+0x39/0xf0 block/bfq-iosched.c:6812 blk_mq_rq_ctx_init.isra.7+0x6ac/0xa00 block/blk-mq.c:403 __blk_mq_alloc_requests+0xcc0/0x1070 block/blk-mq.c:517 blk_mq_get_new_requests block/blk-mq.c:2940 [inline] blk_mq_submit_bio+0x624/0x27c0 block/blk-mq.c:3042 __submit_bio+0x331/0x6f0 block/blk-core.c:624 __submit_bio_noacct_mq block/blk-core.c:703 [inline] submit_bio_noacct_nocheck+0x816/0xb40 block/blk-core.c:732 submit_bio_noacct+0x7a6/0x1b50 block/blk-core.c:826 xlog_write_iclog+0x7d5/0xa00 fs/xfs/xfs_log.c:1958 xlog_state_release_iclog+0x3b8/0x720 fs/xfs/xfs_log.c:619 xlog_cil_push_work+0x19c5/0x2270 fs/xfs/xfs_log_cil.c:1330 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 kthread+0x33c/0x440 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 Freed by task 946: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x50 mm/kasan/generic.c:522 ____kasan_slab_free mm/kasan/common.c:236 [inline] __kasan_slab_free+0x12c/0x1c0 mm/kasan/common.c:244 kasan_slab_free include/linux/kasan.h:164 [inline] slab_free_hook mm/slub.c:1815 [inline] slab_free_freelist_hook mm/slub.c:1841 [inline] slab_free mm/slub.c:3786 [inline] kmem_cache_free+0x118/0x6f0 mm/slub.c:3808 rcu_do_batch+0x35c/0xe30 kernel/rcu/tree.c:2189 rcu_core+0x819/0xd90 kernel/rcu/tree.c:2462 __do_softirq+0x1b0/0x7a2 kernel/softirq.c:553 Last potentially related work creation: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 __kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492 __call_rcu_common kernel/rcu/tree.c:2712 [inline] call_rcu+0xce/0x1020 kernel/rcu/tree.c:2826 ioc_destroy_icq+0x54c/0x830 block/blk-ioc.c:105 ioc_release_fn+0xf0/0x360 block/blk-ioc.c:124 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 kthread+0x33c/0x440 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 Second to last potentially related work creation: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 __kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492 __call_rcu_common kernel/rcu/tree.c:2712 [inline] call_rcu+0xce/0x1020 kernel/rcu/tree.c:2826 ioc_destroy_icq+0x54c/0x830 block/blk-ioc.c:105 ioc_release_fn+0xf0/0x360 block/blk-ioc.c:124 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 kthread+0x33c/0x440 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 The buggy address belongs to the object at ffff888123839d68 which belongs to the cache bfq_io_cq of size 1360
The buggy address is located 336 bytes inside of
freed 1360-byte region [ffff888123839d68, ffff88812383a2b8)
The buggy address belongs to the physical page:
page:ffffea00048e0e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88812383f588 pfn:0x123838 head:ffffea00048e0e00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x17ffffc0000a40(workingset|slab|head|node=0|zone=2|lastcpupid=0x1fffff)page_type: 0xffffffff()
raw: 0017ffffc0000a40 ffff88810588c200 ffffea00048ffa10 ffff888105889488
raw: ffff88812383f588 0000000000150006 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888123839d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888123839e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888123839e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888123839f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888123839f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================--- block/bfq-iosched.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
block/bfq-iosched.c +2 -1
@@ -6831,7 +6831,8 @@ static struct bfq_queue *bfq_init_rq(struct request *rq)* addition, if the queue has also just been split, we have to * resume its state. */ -if (likely (bfqq != &bfqd->oom_bfqq) &&bfqq_process_refs (bfqq) ==1 ) { +if (likely (bfqq != &bfqd->oom_bfqq) && !bfqq->new_bfqq && +bfqq_process_refs (bfqq) ==1 ) { bfqq->bic = bic;if (split) {/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/798 block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 0e456dba86c7f9a19792204a044835f1ca2c8dbb ]
Consider the following merge chain:
Process 1 Process 2 Process 3 Process 4
(BIC1) (BIC2) (BIC3) (BIC4)
Λ | | |
\--------------\ \-------------\ \-------------\|
V V V
bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
IO from Process 1 will get bfqf2 from BIC1 first, then bfq_setup_cooperator() will found bfqq2 already merged to bfqq3 and then handle this IO from bfqq3. However, the merge chain can be much deeper and bfqq3 can be merged to other bfqq as well.
Fix this problem by iterating to the last bfqq inbfq_setup_cooperator().
--- block/bfq-iosched.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
block/bfq-iosched.c +6 -2
@@ -2889,8 +2889,12 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,struct bfq_queue *in_service_bfqq, *new_bfqq;/* if a merge has already been setup, then proceed with that first */ -if (bfqq->new_bfqq) -return bfqq->new_bfqq; + new_bfqq = bfqq->new_bfqq; +if (new_bfqq) { +while (new_bfqq->new_bfqq) + new_bfqq = new_bfqq->new_bfqq; +return new_bfqq; + }/* * Check delayed stable merge for rotational or non-queueing
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/798 block, bfq: dont break merge chain in bfq_split_bfqq()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 42c306ed723321af4003b2a41bb73728cab54f85 ]
Consider the following scenario:
Process 1 Process 2 Process 3 Process 4
(BIC1) (BIC2) (BIC3) (BIC4)
Λ | | |
\-------------\ \-------------\ \--------------\|
V V V
bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
ref 0 1 2 4
If Process 1 issue a new IO and bfqq2 is found, and then bfq_init_rq() decide to spilt bfqq2 by bfq_split_bfqq(). Howerver, procress reference of bfqq2 is 1 and bfq_split_bfqq() just clear the coop flag, which will break the merge chain.
Expected result: caller will allocate a new bfqq for BIC1
Process 1 Process 2 Process 3 Process 4
(BIC1) (BIC2) (BIC3) (BIC4)
| | |
\-------------\ \--------------\|
V V
bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
ref 0 0 1 3
Since the condition is only used for the last bfqq4 when the previous bfqq2 and bfqq3 are already splited. Fix the problem by checking if bfqq is the last one in the merge chain as well.
--- block/bfq-iosched.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/bfq-iosched.c +1 -1
@@ -6628,7 +6628,7 @@ bfq_split_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq) {bfq_log_bfqq (bfqq->bfqd, bfqq,"splitting queue" ); -if (bfqq_process_refs (bfqq) ==1 ) { +if (bfqq_process_refs (bfqq) ==1 && !bfqq->new_bfqq) { bfqq->pid = current->pid;bfq_clear_bfqq_coop (bfqq);bfq_clear_bfqq_split_coop (bfqq);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/798 block: print symbolic error name instead of error code
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Heusel <[email protected]>
[ Upstream commit 25c1772a0493463408489b1fae65cf77fe46cac1 ]
Utilize the %pe print specifier to get the symbolic error name as a string (i.e "-ENOMEM") in the log message instead of the error code to increase its readablility.
This change was suggested in
https://lore.kernel.org/all/[email protected]/
Stable-dep-of: 26e197b7f924 ("block: fix potential invalid pointer dereference in blk_add_partition")
--- block/partitions/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
block/partitions/core.c +2 -2
@@ -581,8 +581,8 @@ static bool blk_add_partition(struct gendisk *disk, part =add_partition (disk, p, from, size, state->parts[p].flags, &state->parts[p].info);if (IS_ERR (part) &&PTR_ERR (part) != -ENXIO ) { -printk (KERN_ERR " %s: p%d could not be added: %ld\n" , - disk->disk_name, p, -PTR_ERR (part)); +printk (KERN_ERR " %s: p%d could not be added: %pe\n" , + disk->disk_name, p, part);return true; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/798 block: fix potential invalid pointer dereference in blk_add_partition
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Riyan Dhiman <[email protected]>
[ Upstream commit 26e197b7f9240a4ac301dd0ad520c0c697c2ea7d ]
The blk_add_partition() function initially used a single if-condition (IS_ERR(part)) to check for errors when adding a partition. This was modified to handle the specific case of -ENXIO separately, allowing the function to proceed without logging the error in this case. However, this change unintentionally left a path where md_autodetect_dev() could be called without confirming that part is a valid pointer.
This commit separates the error handling logic by splitting the initial if-condition, improving code readability and handling specific error scenarios explicitly. The function now distinguishes the general error case from -ENXIO without altering the existing behavior of md_autodetect_dev() calls.
--- block/partitions/core.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
block/partitions/core.c +5 -3
@@ -580,9 +580,11 @@ static bool blk_add_partition(struct gendisk *disk, part =add_partition (disk, p, from, size, state->parts[p].flags, &state->parts[p].info); -if (IS_ERR (part) &&PTR_ERR (part) != -ENXIO ) { -printk (KERN_ERR " %s: p%d could not be added: %pe\n" , - disk->disk_name, p, part); +if (IS_ERR (part)) { +if (PTR_ERR (part) != -ENXIO ) { +printk (KERN_ERR " %s: p%d could not be added: %pe\n" , + disk->disk_name, p, part); + }return true; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/798 spi: ppc4xx: handle irq_of_parse_and_map() errors
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit 0f245463b01ea254ae90e1d0389e90b0e7d8dc75 ]
Zero and negative number is not a valid IRQ for in-kernel code and the irq_of_parse_and_map() function returns zero on error. So this check for valid IRQs should only accept values > 0.
--- drivers/spi/spi-ppc4xx.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/spi/spi-ppc4xx.c +3 -0
@@ -411,6 +411,9 @@ static int spi_ppc4xx_of_probe(struct platform_device *op)/* Request IRQ */ hw->irqnum =irq_of_parse_and_map (np,0 ); +if (hw->irqnum <=0 ) + goto free_host; + ret =request_irq (hw->irqnum, spi_ppc4xx_int,0 ,"spi_ppc4xx_of" , (void *)hw);if (ret) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/798 arm64: dts: exynos: exynos7885-jackpotlte: Correct RAM amount to 4GB
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Virag <[email protected]>
[ Upstream commit d281814b8f7a710a75258da883fb0dfe1329c031 ]
All known jackpotlte variants have 4GB of RAM, let's use it all. RAM was set to 3GB from a mistake in the vendor provided DTS file.
--- arch/arm64/boot/dts/exynos/exynos7885-jackpotlte.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/exynos/exynos7885-jackpotlte.dts +1 -1
@@ -31,7 +31,7 @@ memory@80000000 { device_type = "memory"; reg = <0x0 0x80000000 0x3da00000>, <0x0 0xc0000000 0x40000000>, - <0x8 0x80000000 0x40000000>; + <0x8 0x80000000 0x80000000>; }; gpio-keys {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/798 firmware: arm_scmi: Fix double free in OPTEE transport
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Marussi <[email protected]>
[ Upstream commit e98dba934b2fc587eafb83f47ad64d9053b18ae0 ]
Channels can be shared between protocols, avoid freeing the same channel descriptors twice when unloading the stack.
Message-Id: <[email protected]>
--- drivers/firmware/arm_scmi/optee.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/firmware/arm_scmi/optee.c +7 -0
@@ -467,6 +467,13 @@ static int scmi_optee_chan_free(int id, void *p, void *data)struct scmi_chan_info *cinfo = p;struct scmi_optee_channel *channel = cinfo->transport_info; +/* +* Different protocols might share the same chan info, so a previous +* call might have already freed the structure. +*/ +if (!channel) +return 0 ; +mutex_lock (&scmi_optee_private->mu);list_del (&channel->link);mutex_unlock (&scmi_optee_private->mu);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/798 spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 7781f1d120fec8624fc654eda900fc8748262082 ]
0 is incorrect error code when failed to parse and map IRQ. Replace OF specific old API for IRQ retrieval with a generic one to fix this issue.
--- drivers/spi/spi-ppc4xx.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/spi/spi-ppc4xx.c +3 -3
@@ -26,7 +26,6 @@#include <linux/errno.h> #include <linux/wait.h> #include <linux/of_address.h> -#include <linux/of_irq.h> #include <linux/of_platform.h> #include <linux/interrupt.h> #include <linux/delay.h>
@@ -410,9 +409,10 @@ static int spi_ppc4xx_of_probe(struct platform_device *op) }/* Request IRQ */ - hw->irqnum =irq_of_parse_and_map (np,0 ); -if (hw->irqnum <=0 ) + ret =platform_get_irq (op,0 ); +if (ret <0 ) goto free_host; + hw->irqnum = ret; ret =request_irq (hw->irqnum, spi_ppc4xx_int,0 ,"spi_ppc4xx_of" , (void *)hw);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/798 regulator: Return actual error in of_regulator_bulk_get_all()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 395a41a1d3e377462f3eea8a205ee72be8885ff6 ]
If regulator_get() in of_regulator_bulk_get_all() returns an error, that error gets overridden and -EINVAL is always passed out. This masks probe deferral requests and likely won't work properly in all cases.
Fix this by letting of_regulator_bulk_get_all() return the original error code.
--- drivers/regulator/of_regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/of_regulator.c +1 -1
@@ -768,7 +768,7 @@ int of_regulator_bulk_get_all(struct device *dev, struct device_node *np, name[i] ='\0' ; tmp =regulator_get (dev, name);if (IS_ERR (tmp)) { - ret = -EINVAL ; + ret =PTR_ERR (tmp); goto error; } (*consumers)[n].consumer = tmp;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/798 arm64: dts: renesas: r9a07g043u: Correct GICD and GICR sizes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
[ Upstream commit ab39547f739236e7f16b8b0a51fdca95cc9cadd3 ]
The RZ/G2UL SoC is equipped with the GIC-600. The GICD is 64KiB + 64KiB for the MBI alias (in total 128KiB), and the GICR is 128KiB per CPU.
Despite the RZ/G2UL SoC being single-core, it has two instances of GICR.
--- arch/arm64/boot/dts/renesas/r9a07g043u.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/renesas/r9a07g043u.dtsi +2 -2
@@ -135,8 +135,8 @@ gic: interrupt-controller@11900000 { #interrupt-cells = <3>; #address-cells = <0>; interrupt-controller; - reg = <0x0 0x11900000 0 0x40000>, - <0x0 0x11940000 0 0x60000>; + reg = <0x0 0x11900000 0 0x20000>, + <0x0 0x11940000 0 0x40000>; interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_LOW>; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/798 arm64: dts: renesas: r9a07g054: Correct GICD and GICR sizes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
[ Upstream commit 45afa9eacb59b258d2e53c7f63430ea1e8344803 ]
The RZ/V2L SoC is equipped with the GIC-600. The GICD is 64KiB + 64KiB for the MBI alias (in total 128KiB), and the GICR is 128KiB per CPU.
--- arch/arm64/boot/dts/renesas/r9a07g054.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/renesas/r9a07g054.dtsi +2 -2
@@ -794,8 +794,8 @@ gic: interrupt-controller@11900000 { #interrupt-cells = <3>; #address-cells = <0>; interrupt-controller; - reg = <0x0 0x11900000 0 0x40000>, - <0x0 0x11940000 0 0x60000>; + reg = <0x0 0x11900000 0 0x20000>, + <0x0 0x11940000 0 0x40000>; interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_LOW>; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/798 arm64: dts: renesas: r9a07g044: Correct GICD and GICR sizes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
[ Upstream commit 833948fb2b63155847ab691a54800f801555429b ]
The RZ/G2L(C) SoC is equipped with the GIC-600. The GICD is 64KiB + 64KiB for the MBI alias (in total 128KiB), and the GICR is 128KiB per CPU.
--- arch/arm64/boot/dts/renesas/r9a07g044.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/renesas/r9a07g044.dtsi +2 -2
@@ -788,8 +788,8 @@ gic: interrupt-controller@11900000 { #interrupt-cells = <3>; #address-cells = <0>; interrupt-controller; - reg = <0x0 0x11900000 0 0x40000>, - <0x0 0x11940000 0 0x60000>; + reg = <0x0 0x11900000 0 0x20000>, + <0x0 0x11940000 0 0x40000>; interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_LOW>; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/798 ARM: dts: microchip: sam9x60: Fix rtc/rtt clocks
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Dahl <[email protected]>
[ Upstream commit d355c895fa4ddd8bec15569eee540baeed7df8c5 ]
The RTC and RTT peripherals use the timing domain slow clock (TD_SLCK), sourced from the 32.768 kHz crystal oscillator or slow rc oscillator.
The previously used Monitoring domain slow clock (MD_SLCK) is sourced from an internal RC oscillator which is most probably not precise enough for real time clock purposes.
[claudiu.beznea: removed () around the last commit description paragraph,
removed " in front of "timing domain slow clock", described that TD_SLCK can also be sourced from slow rc oscillator]
--- arch/arm/boot/dts/sam9x60.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/sam9x60.dtsi +2 -2
@@ -690,7 +690,7 @@ rtt: rtc@fffffe20 { compatible = "microchip,sam9x60-rtt", "atmel,at91sam9260-rtt"; reg = <0xfffffe20 0x20>; interrupts = <1 IRQ_TYPE_LEVEL_HIGH 7>; - clocks = <&clk32k 0>; + clocks = <&clk32k 1>; }; pit: timer@fffffe40 {
@@ -716,7 +716,7 @@ rtc: rtc@fffffea8 { compatible = "microchip,sam9x60-rtc", "atmel,at91sam9x5-rtc"; reg = <0xfffffea8 0x100>; interrupts = <1 IRQ_TYPE_LEVEL_HIGH 7>; - clocks = <&clk32k 0>; + clocks = <&clk32k 1>; }; watchdog: watchdog@ffffff80 {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/798 arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Davis <[email protected]>
[ Upstream commit 9f3814a7c06b7c7296cf8c1622078ad71820454b ]
The DMA carveout for the C6x core 0 is at 0xa6000000 and core 1 is at 0xa7000000. These are reversed in DT. While both C6x can access either region, so this is not normally a problem, but if we start restricting the memory each core can access (such as with firewalls) the cores accessing the regions for the wrong core will not work. Fix this here.
--- arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/ti/k3-j721e-sk.dts +2 -2
@@ -111,7 +111,7 @@ main_r5fss1_core1_memory_region: r5f-memory@a5100000 { no-map; }; - c66_1_dma_memory_region: c66-dma-memory@a6000000 { + c66_0_dma_memory_region: c66-dma-memory@a6000000 { compatible = "shared-dma-pool"; reg = <0x00 0xa6000000 0x00 0x100000>; no-map;
@@ -123,7 +123,7 @@ c66_0_memory_region: c66-memory@a6100000 { no-map; }; - c66_0_dma_memory_region: c66-dma-memory@a7000000 { + c66_1_dma_memory_region: c66-dma-memory@a7000000 { compatible = "shared-dma-pool"; reg = <0x00 0xa7000000 0x00 0x100000>; no-map;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/798 ARM: dts: microchip: sama7g5: Fix RTT clock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
[ Upstream commit 867bf1923200e6ad82bad0289f43bf20b4ac7ff9 ]
According to datasheet, Chapter 34. Clock Generator, section 34.2, Embedded characteristics, source clock for RTT is the TD_SLCK, registered with ID 1 by the slow clock controller driver. Fix RTT clock.
--- arch/arm/boot/dts/sama7g5.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/sama7g5.dtsi +1 -1
@@ -221,7 +221,7 @@ rtt: rtc@e001d020 { compatible = "microchip,sama7g5-rtt", "microchip,sam9x60-rtt", "atmel,at91sam9260-rtt"; reg = <0xe001d020 0x30>; interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>; - clocks = <&clk32k 0>; + clocks = <&clk32k 1>; }; clk32k: clock-controller@e001d050 {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/798 ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 0e49cfe364dea4345551516eb2fe53135a10432b ]
There is no "fsl,phy" property in pin controller pincfg nodes:
imx7d-zii-rmu2.dtb: pinctrl@302c0000: enet1phyinterruptgrp: 'fsl,pins' is a required property imx7d-zii-rmu2.dtb: pinctrl@302c0000: enet1phyinterruptgrp: 'fsl,phy' does not match any of the regexes: 'pinctrl-[0-9]+'
--- arch/arm/boot/dts/imx7d-zii-rmu2.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imx7d-zii-rmu2.dts +1 -1
@@ -350,7 +350,7 @@ MX7D_PAD_SD3_RESET_B__SD3_RESET_B 0x59 &iomuxc_lpsr { pinctrl_enet1_phy_interrupt: enet1phyinterruptgrp { - fsl,phy = < + fsl,pins = < MX7D_PAD_LPSR_GPIO1_IO02__GPIO1_IO2 0x08 >; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/798 ARM: versatile: fix OF node leak in CPUs prepare
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit f2642d97f2105ed17b2ece0c597450f2ff95d704 ]
Machine code is leaking OF node reference from of_find_matching_node() in realview_smp_prepare_cpus().
--- arch/arm/mach-versatile/platsmp-realview.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-versatile/platsmp-realview.c +1 -0
@@ -66,6 +66,7 @@ static void __init realview_smp_prepare_cpus(unsigned int max_cpus)return ; } map =syscon_node_to_regmap (np); +of_node_put (np);if (IS_ERR (map)) {pr_err ("PLATSMP: No syscon regmap\n" );return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/798 reset: berlin: fix OF node leak in probe() error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 5f58a88cc91075be38cec69b7cb70aaa4ba69e8b ]
Driver is leaking OF node reference on memory allocation failure. Acquire the OF node reference after memory allocation to fix this and keep it simple.
--- drivers/reset/reset-berlin.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/reset/reset-berlin.c +2 -1
@@ -68,13 +68,14 @@ static int berlin_reset_xlate(struct reset_controller_dev *rcdev,static int berlin2_reset_probe (struct platform_device *pdev) { -struct device_node *parent_np =of_get_parent (pdev->dev.of_node); +struct device_node *parent_np;struct berlin_reset_priv *priv; priv =devm_kzalloc (&pdev->dev,sizeof (*priv),GFP_KERNEL );if (!priv)return -ENOMEM ; + parent_np =of_get_parent (pdev->dev.of_node); priv->regmap =syscon_node_to_regmap (parent_np);of_node_put (parent_np);if (IS_ERR (priv->regmap))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/798 reset: k210: fix OF node leak in probe() error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit b14e40f5dc7cd0dd7e958010e6ca9ad32ff2ddad ]
Driver is leaking OF node reference on memory allocation failure. Acquire the OF node reference after memory allocation to fix this and keep it simple.
--- drivers/reset/reset-k210.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/reset/reset-k210.c +2 -1
@@ -91,7 +91,7 @@ static const struct reset_control_ops k210_rst_ops = {static int k210_rst_probe (struct platform_device *pdev) {struct device *dev = &pdev->dev; -struct device_node *parent_np =of_get_parent (dev->of_node); +struct device_node *parent_np;struct k210_rst *ksr;dev_info (dev,"K210 reset controller\n" );
@@ -100,6 +100,7 @@ static int k210_rst_probe(struct platform_device *pdev)if (!ksr)return -ENOMEM ; + parent_np =of_get_parent (dev->of_node); ksr->map =syscon_node_to_regmap (parent_np);of_node_put (parent_np);if (IS_ERR (ksr->map))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/798 clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ankit Agrawal <[email protected]>
[ Upstream commit ca140a0dc0a18acd4653b56db211fec9b2339986 ]
Add the missing iounmap() when clock frequency fails to get read by the of_property_read_u32() call, or if the call to msm_timer_init() fails.
--- drivers/clocksource/timer-qcom.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/clocksource/timer-qcom.c +6 -1
@@ -233,6 +233,7 @@ static int __init msm_dt_timer_init(struct device_node *np) }if (of_property_read_u32 (np,"clock-frequency" , &freq)) { +iounmap (cpu0_base);pr_err ("Unknown frequency\n" );return -EINVAL ; }
@@ -243,7 +244,11 @@ static int __init msm_dt_timer_init(struct device_node *np) freq /=4 ;writel_relaxed (DGT_CLK_CTL_DIV_4 , source_base +DGT_CLK_CTL ); -return msm_timer_init (freq,32 , irq, !!percpu_offset); + ret =msm_timer_init (freq,32 , irq, !!percpu_offset); +if (ret) +iounmap (cpu0_base); + +return ret; }TIMER_OF_DECLARE (kpss_timer,"qcom,kpss-timer" , msm_dt_timer_init);TIMER_OF_DECLARE (scss_timer,"qcom,scss-timer" , msm_dt_timer_init);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/798 ASoC: rt5682s: Return devm_of_clk_add_hw_provider to transfer the error
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit 3ff810b9bebe5578a245cfa97c252ab602e703f1 ]
Return devm_of_clk_add_hw_provider() in order to transfer the error, if it fails due to resource allocation failure or device tree clock provider registration failure.
--- sound/soc/codecs/rt5682s.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/soc/codecs/rt5682s.c +3 -1
@@ -2828,7 +2828,9 @@ static int rt5682s_register_dai_clks(struct snd_soc_component *component) }if (dev->of_node) { -devm_of_clk_add_hw_provider (dev, of_clk_hw_simple_get, dai_clk_hw); + ret =devm_of_clk_add_hw_provider (dev, of_clk_hw_simple_get, dai_clk_hw); +if (ret) +return ret; }else { ret =devm_clk_hw_register_clkdev (dev, dai_clk_hw, init.name,dev_name (dev));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/798 ALSA: hda: cs35l41: fix module autoloading
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Liu <[email protected]>
[ Upstream commit 48f1434a4632c7da1a6a94e159512ebddbe13392 ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from spi_device_id table.
--- sound/pci/hda/cs35l41_hda_spi.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/cs35l41_hda_spi.c +1 -0
@@ -38,6 +38,7 @@ static const struct spi_device_id cs35l41_hda_spi_id[] = { { "cs35l41-hda", 0 }, {} }; +MODULE_DEVICE_TABLE (spi, cs35l41_hda_spi_id);static const struct acpi_device_id cs35l41_acpi_hda_match[] = { { "CSC3551", 0 },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/798 m68k: Fix kernel_clone_args.flags in m68k_clone()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
[ Upstream commit 09b3d870faa7bc3e96c0978ab3cf4e96e4b15571 ]
Stan Johnson recently reported a failure from the 'dump' command:
DUMP: Date of this level 0 dump: Fri Aug 9 23:37:15 2024
DUMP: Dumping /dev/sda (an unlisted file system) to /dev/null
DUMP: Label: none
DUMP: Writing 10 Kilobyte records
DUMP: mapping (Pass I) [regular files]
DUMP: mapping (Pass II) [directories]
DUMP: estimated 3595695 blocks.
DUMP: Context save fork fails in parent 671
The dump program uses the clone syscall with the CLONE_IO flag, that is, flags == 0x80000000. When that value is promoted from long int to u64 by m68k_clone(), it undergoes sign-extension. The new value includes CLONE_INTO_CGROUP so the validation in cgroup_css_set_fork() fails and the syscall returns -EBADF. Avoid sign-extension by casting to u32.
--- arch/m68k/kernel/process.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/m68k/kernel/process.c +1 -1
@@ -115,7 +115,7 @@ asmlinkage int m68k_clone(struct pt_regs *regs) {/* regs will be equal to current_pt_regs() */ struct kernel_clone_args args = { - .flags = regs->d1 & ~CSIGNAL , + .flags = (u32)(regs->d1) & ~CSIGNAL , .pidfd = (int __user *)regs->d3, .child_tid = (int __user *)regs->d4, .parent_tid = (int __user *)regs->d3,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/798 hwmon: (max16065) Fix overflows seen when writing limits
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 744ec4477b11c42e2c8de9eb8364675ae7a0bd81 ]
Writing large limits resulted in overflows as reported by module tests.
in0_lcrit: Suspected overflow: [max=5538, read 0, written 2147483647]in0_crit: Suspected overflow: [max=5538, read 0, written 2147483647]in0_min: Suspected overflow: [max=5538, read 0, written 2147483647]
Fix the problem by clamping prior to multiplications and the use of DIV_ROUND_CLOSEST, and by using consistent variable types.
--- drivers/hwmon/max16065.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/hwmon/max16065.c +3 -2
@@ -114,9 +114,10 @@ static inline int LIMIT_TO_MV(int limit, int range)return limit * range /256 ; } -static inline int MV_TO_LIMIT (int mv,int range) +static inline int MV_TO_LIMIT (unsigned long mv,int range) { -return clamp_val (DIV_ROUND_CLOSEST (mv *256 , range),0 ,255 ); + mv =clamp_val (mv,0 ,ULONG_MAX /256 ); +return DIV_ROUND_CLOSEST (clamp_val (mv *256 ,0 , range *255 ), range); }static inline int ADC_TO_CURR (int adc,int gain)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/798 i2c: Add i2c_get_match_data()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 564d73c4d9201526bd976b9379d2aaf1a7133e84 ]
Add i2c_get_match_data() to get match data for I2C, ACPI and DT-based matching, so that we can optimize the driver code.
Stable-dep-of: 119abf7d1815 ("hwmon: (max16065) Fix alarm attributes")
--- drivers/i2c/i2c-core-base.c | 19 +++++++++++++++++++ include/linux/i2c.h | 2 ++ 2 files changed, 21 insertions(+)
drivers/i2c/i2c-core-base.c +19 -0
@@ -113,6 +113,25 @@ const struct i2c_device_id *i2c_match_id(const struct i2c_device_id *id, }EXPORT_SYMBOL_GPL (i2c_match_id); +const void *i2c_get_match_data (const struct i2c_client *client) +{ +struct i2c_driver *driver =to_i2c_driver (client->dev.driver); +const struct i2c_device_id *match; +const void *data; + + data =device_get_match_data (&client->dev); +if (!data) { + match =i2c_match_id (driver->id_table, client); +if (!match) +return NULL ; + + data = (const void *)match->driver_data; + } + +return data; +} +EXPORT_SYMBOL (i2c_get_match_data); +static int i2c_device_match (struct device *dev,struct device_driver *drv) {struct i2c_client *client =i2c_verify_client (dev);
include/linux/i2c.h +2 -0
@@ -362,6 +362,8 @@ struct i2c_adapter *i2c_verify_adapter(struct device *dev);const struct i2c_device_id *i2c_match_id (const struct i2c_device_id *id,const struct i2c_client *client); +const void *i2c_get_match_data (const struct i2c_client *client); +static inline struct i2c_client *kobj_to_i2c_client (struct kobject *kobj) {struct device *const dev =kobj_to_dev (kobj);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/798 hwmon: (max16065) Remove use of i2c_match_id()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Davis <[email protected]>
[ Upstream commit 5a71654b398e3471f0169c266a3587cf09e1200c ]
The function i2c_match_id() is used to fetch the matching ID from the i2c_device_id table. This is often used to then retrieve the matching driver_data. This can be done in one step with the helper i2c_get_match_data().
This helper has a couple other benefits:
* It doesn't need the i2c_device_id passed in so we do not need to have that forward declared, allowing us to remove those or move the i2c_device_id table down to its more natural spot with the other module info.
* It also checks for device match data, which allows for OF and ACPI based probing. That means we do not have to manually check those first and can remove those checks.
Stable-dep-of: 119abf7d1815 ("hwmon: (max16065) Fix alarm attributes")
--- drivers/hwmon/max16065.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/hwmon/max16065.c +4 -6
@@ -494,8 +494,6 @@ static const struct attribute_group max16065_max_group = { .is_visible = max16065_secondary_is_visible, }; -static const struct i2c_device_id max16065_id[]; -static int max16065_probe (struct i2c_client *client) {struct i2c_adapter *adapter = client->adapter;
@@ -506,7 +504,7 @@ static int max16065_probe(struct i2c_client *client)bool have_secondary;/* true if chip has secondary limits */ bool secondary_is_max = false;/* secondary limits reflect max */ int groups =0 ; -const struct i2c_device_id *id =i2c_match_id (max16065_id, client); +enum chips chip = (uintptr_t )i2c_get_match_data (client);if (!i2c_check_functionality (adapter,I2C_FUNC_SMBUS_BYTE_DATA |I2C_FUNC_SMBUS_READ_WORD_DATA ))
@@ -519,9 +517,9 @@ static int max16065_probe(struct i2c_client *client) data->client = client;mutex_init (&data->update_lock); - data->num_adc = max16065_num_adc[id->driver_data]; - data->have_current = max16065_have_current[id->driver_data]; - have_secondary = max16065_have_secondary[id->driver_data]; + data->num_adc = max16065_num_adc[chip]; + data->have_current = max16065_have_current[chip]; + have_secondary = max16065_have_secondary[chip];if (have_secondary) { val =i2c_smbus_read_byte_data (client,MAX16065_SW_ENABLE );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/798 hwmon: (max16065) Fix alarm attributes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 119abf7d1815f098f7f91ae7abc84324a19943d7 ]
Chips reporting overcurrent alarms report it in the second alarm register. That means the second alarm register has to be read, even if the chip only supports 8 or fewer ADC channels.
MAX16067 and MAX16068 report undervoltage and overvoltage alarms in separate registers. Fold register contents together to report both with the existing alarm attribute. This requires actually storing the chip type in struct max16065_data. Rename the variable 'chip' to match the variable name used in the probe function.
--- drivers/hwmon/max16065.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/hwmon/max16065.c +10 -2
@@ -79,7 +79,7 @@ static const bool max16065_have_current[] = { };struct max16065_data { -enum chips type; +enum chips chip;struct i2c_client *client;const struct attribute_group *groups[4 ];struct mutex update_lock;
@@ -162,10 +162,17 @@ static struct max16065_data *max16065_update_device(struct device *dev) MAX16065_CURR_SENSE); } -for (i =0 ; i <DIV_ROUND_UP (data->num_adc,8 ); i++) +for (i =0 ; i <2 ; i++) data->fault[i] =i2c_smbus_read_byte_data (client,MAX16065_FAULT (i)); +/* +* MAX16067 and MAX16068 have separate undervoltage and +* overvoltage alarm bits. Squash them together. +*/ +if (data->chip == max16067 || data->chip == max16068) + data->fault[0 ] |= data->fault[1 ]; + data->last_updated = jiffies; data->valid = true; }
@@ -514,6 +521,7 @@ static int max16065_probe(struct i2c_client *client)if (unlikely (!data))return -ENOMEM ; + data->chip = chip; data->client = client;mutex_init (&data->update_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/798 mtd: slram: insert break after errors in parsing the map
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mirsad Todorovac <[email protected]>
[ Upstream commit 336c218dd7f0588ed8a7345f367975a00a4f003f ]
GCC 12.3.0 compiler on linux-next next-20240709 tree found the execution path in which, due to lazy evaluation, devlength isn't initialised with the parsed string:
289 while (map) {
290 devname = devstart = devlength = NULL;
291
292 if (!(devname = strsep(&map, ","))) {
293 E("slram: No devicename specified.\n");
294 break;
295 }
296 T("slram: devname = %s\n", devname);
297 if ((!map) || (!(devstart = strsep(&map, ",")))) {
298 E("slram: No devicestart specified.\n");
299 }
300 T("slram: devstart = %s\n", devstart);
→ 301 if ((!map) || (!(devlength = strsep(&map, ",")))) {
302 E("slram: No devicelength / -end specified.\n");
303 }
→ 304 T("slram: devlength = %s\n", devlength);
305 if (parse_cmdline(devname, devstart, devlength) != 0) {
306 return(-EINVAL);
307 }
Parsing should be finished after map == NULL, so a break is best inserted after each E("slram: ... \n") error message.
--- drivers/mtd/devices/slram.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mtd/devices/slram.c +2 -0
@@ -296,10 +296,12 @@ static int __init init_slram(void)T ("slram: devname = %s\n" , devname);if ((!map) || (!(devstart =strsep (&map,"," )))) {E ("slram: No devicestart specified.\n" ); +break ; }T ("slram: devstart = %s\n" , devstart);if ((!map) || (!(devlength =strsep (&map,"," )))) {E ("slram: No devicelength / -end specified.\n" ); +break ; }T ("slram: devlength = %s\n" , devlength);if (parse_cmdline (devname, devstart, devlength) !=0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/798 hwmon: (ntc_thermistor) fix module autoloading
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Liu <[email protected]>
[ Upstream commit b6964d66a07a9003868e428a956949e17ab44d7e ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table.
Message-ID: <[email protected]>
--- drivers/hwmon/ntc_thermistor.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/ntc_thermistor.c +1 -0
@@ -62,6 +62,7 @@ static const struct platform_device_id ntc_thermistor_id[] = { [NTC_SSG1404001221] = { "ssg1404_001221", TYPE_NCPXXWB473 }, [NTC_LAST ] = { }, }; +MODULE_DEVICE_TABLE (platform ,ntc_thermistor_id );/* * A compensation table should be sorted by the values of .ohm
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/798 power: supply: axp20x_battery: Remove design from min and max voltage
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Morgan <[email protected]>
[ Upstream commit 61978807b00f8a1817b0e5580981af1cd2f428a5 ]
The POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN and POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN values should be immutable properties of the battery, but for this driver they are writable values and used as the minimum and maximum values for charging. Remove the DESIGN designation from these values.
--- drivers/power/supply/axp20x_battery.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/power/supply/axp20x_battery.c +8 -8
@@ -304,11 +304,11 @@ static int axp20x_battery_get_prop(struct power_supply *psy, val->intval = reg &AXP209_FG_PERCENT ;break ; -case POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN : +case POWER_SUPPLY_PROP_VOLTAGE_MAX :return axp20x_batt->data->get_max_voltage (axp20x_batt, &val->intval); -case POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN : +case POWER_SUPPLY_PROP_VOLTAGE_MIN : ret =regmap_read (axp20x_batt->regmap,AXP20X_V_OFF , ®);if (ret)return ret;
@@ -456,10 +456,10 @@ static int axp20x_battery_set_prop(struct power_supply *psy,struct axp20x_batt_ps *axp20x_batt =power_supply_get_drvdata (psy);switch (psp) { -case POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN : +case POWER_SUPPLY_PROP_VOLTAGE_MIN :return axp20x_set_voltage_min_design (axp20x_batt, val->intval); -case POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN : +case POWER_SUPPLY_PROP_VOLTAGE_MAX :return axp20x_batt->data->set_max_voltage (axp20x_batt, val->intval);case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT :
@@ -494,8 +494,8 @@ static enum power_supply_property axp20x_battery_props[] = {POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT ,POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT_MAX ,POWER_SUPPLY_PROP_HEALTH , -POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN , -POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN , +POWER_SUPPLY_PROP_VOLTAGE_MAX , +POWER_SUPPLY_PROP_VOLTAGE_MIN , POWER_SUPPLY_PROP_CAPACITY, };
@@ -503,8 +503,8 @@ static int axp20x_battery_prop_writeable(struct power_supply *psy, enum power_supply_property psp) {return psp ==POWER_SUPPLY_PROP_STATUS || - psp ==POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN || - psp ==POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN || + psp ==POWER_SUPPLY_PROP_VOLTAGE_MIN || + psp ==POWER_SUPPLY_PROP_VOLTAGE_MAX || psp ==POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT || psp ==POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT_MAX ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/798 power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artur Weber <[email protected]>
[ Upstream commit 3a3acf839b2cedf092bdd1ff65b0e9895df1656b ]
Commit 223a3b82834f ("power: supply: max17042_battery: use VFSOC for capacity when no rsns") made it so that capacity on systems without current sensing would be read from VFSOC instead of RepSOC. However, the SOC threshold calculation still read RepSOC to get the SOC regardless of the current sensing option state.
Fix this by applying the same conditional to determine which register should be read.
This also seems to be the intended behavior as per the datasheet - SOC alert config value in MiscCFG on setups without current sensing is set to a value of 0b11, indicating SOC alerts being generated based on VFSOC, instead of 0b00 which indicates SOC alerts being generated based on RepSOC.
This fixes an issue on the Galaxy S3/Midas boards, where the alert interrupt would be constantly retriggered, causing high CPU usage on idle (around ~12%-15%).
--- drivers/power/supply/max17042_battery.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/power/supply/max17042_battery.c +4 -1
@@ -858,7 +858,10 @@ static void max17042_set_soc_threshold(struct max17042_chip *chip, u16 off)/* program interrupt thresholds such that we should * get interrupt for every 'off' perc change in the soc */ -regmap_read (map, MAX17042_RepSOC, &soc); +if (chip->pdata->enable_current_sense) +regmap_read (map, MAX17042_RepSOC, &soc); +else +regmap_read (map,MAX17042_VFSOC , &soc); soc >>=8 ; soc_tr = (soc + off) <<8 ;if (off < soc)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/798 fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit aa578e897520f32ae12bec487f2474357d01ca9c ]
If an error occurs after request_mem_region(), a corresponding release_mem_region() should be called, as already done in the remove function.
--- drivers/video/fbdev/hpfb.c | 1 + 1 file changed, 1 insertion(+)
drivers/video/fbdev/hpfb.c +1 -0
@@ -344,6 +344,7 @@ static int hpfb_dio_probe(struct dio_dev *d, const struct dio_device_id *ent)if (hpfb_init_one (paddr, vaddr)) {if (d->scode >=DIOII_SCBASE )iounmap ((void *)vaddr); +release_mem_region (d->resource.start,resource_size (&d->resource));return -ENOMEM ; }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/798 iommu/amd: Do not set the D bit on AMD v2 table entries
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
[ Upstream commit 2910a7fa1be090fc7637cef0b2e70bcd15bf5469 ]
The manual says that bit 6 is IGN for all Page-Table Base Address pointers, don't set it.
--- drivers/iommu/amd/io_pgtable_v2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/amd/io_pgtable_v2.c +1 -1
@@ -56,7 +56,7 @@ static inline u64 set_pgtable_attr(u64 *page)u64 prot; prot =IOMMU_PAGE_PRESENT |IOMMU_PAGE_RW |IOMMU_PAGE_USER ; - prot |=IOMMU_PAGE_ACCESS |IOMMU_PAGE_DIRTY ; + prot |=IOMMU_PAGE_ACCESS ;return (iommu_virt_to_phys (page) | prot); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/798 mtd: powernv: Add check devm_kasprintf() returned value
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Han <[email protected]>
[ Upstream commit 395999829880a106bb95f0ce34e6e4c2b43c6a5d ]
devm_kasprintf() can return a NULL pointer on failure but this returned value is not checked.
--- drivers/mtd/devices/powernv_flash.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mtd/devices/powernv_flash.c +3 -0
@@ -207,6 +207,9 @@ static int powernv_flash_set_driver_info(struct device *dev,* get them */ mtd->name =devm_kasprintf (dev,GFP_KERNEL ,"%pOFP" , dev->of_node); +if (!mtd->name) +return -ENOMEM ; + mtd->type =MTD_NORFLASH ; mtd->flags =MTD_WRITEABLE ; mtd->size = size;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/798 rcu/nocb: Fix RT throttling hrtimer armed from offline CPU
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Weisbecker <[email protected]>
[ Upstream commit 9139f93209d1ffd7f489ab19dee01b7c3a1a43d2 ]
After a CPU is marked offline and until it reaches its final trip to idle, rcuo has several opportunities to be woken up, either because a callback has been queued in the meantime or because rcutree_report_cpu_dead() has issued the final deferred NOCB wake up.
If RCU-boosting is enabled, RCU kthreads are set to SCHED_FIFO policy. And if RT-bandwidth is enabled, the related hrtimer might be armed. However this then happens after hrtimers have been migrated at the CPUHP_AP_HRTIMERS_DYING stage, which is broken as reported by the following warning:
Call trace: enqueue_hrtimer+0x7c/0xf8 hrtimer_start_range_ns+0x2b8/0x300 enqueue_task_rt+0x298/0x3f0 enqueue_task+0x94/0x188 ttwu_do_activate+0xb4/0x27c try_to_wake_up+0x2d8/0x79c wake_up_process+0x18/0x28 __wake_nocb_gp+0x80/0x1a0 do_nocb_deferred_wakeup_common+0x3c/0xcc rcu_report_dead+0x68/0x1ac cpuhp_report_idle_dead+0x48/0x9c do_idle+0x288/0x294 cpu_startup_entry+0x34/0x3c secondary_start_kernel+0x138/0x158
Fix this with waking up rcuo using an IPI if necessary. Since the existing API to deal with this situation only handles swait queue, rcuo is only woken up from offline CPUs if it's not already waiting on a grace period. In the worst case some callbacks will just wait for a grace period to complete before being assigned to a subsequent one.
--- kernel/rcu/tree_nocb.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/rcu/tree_nocb.h +4 -1
@@ -220,7 +220,10 @@ static bool __wake_nocb_gp(struct rcu_data *rdp_gp,raw_spin_unlock_irqrestore (&rdp_gp->nocb_gp_lock, flags);if (needwake) {trace_rcu_nocb_wake (rcu_state.name, rdp->cpu,TPS ("DoWake" )); -wake_up_process (rdp_gp->nocb_gp_kthread); +if (cpu_is_offline (raw_smp_processor_id ())) +swake_up_one_online (&rdp_gp->nocb_gp_wq); +else +wake_up_process (rdp_gp->nocb_gp_kthread); }return needwake;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/798 mtd: rawnand: mtk: Use for_each_child_of_node_scoped()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 8795952679494b111b7b2ba08bb54ac408daca3b ]
Avoids the need for manual cleanup of_node_put() in early exits from the loop.
Stable-dep-of: 2073ae37d550 ("mtd: rawnand: mtk: Fix init error path")
--- drivers/mtd/nand/raw/mtk_nand.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/mtd/nand/raw/mtk_nand.c +2 -5
@@ -1459,15 +1459,12 @@ static int mtk_nfc_nand_chip_init(struct device *dev, struct mtk_nfc *nfc,static int mtk_nfc_nand_chips_init (struct device *dev,struct mtk_nfc *nfc) {struct device_node *np = dev->of_node; -struct device_node *nand_np;int ret; -for_each_child_of_node (np, nand_np) { +for_each_child_of_node_scoped (np, nand_np) { ret =mtk_nfc_nand_chip_init (dev, nfc, nand_np); -if (ret) { -of_node_put (nand_np); +if (ret)return ret; - } }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/798 mtd: rawnand: mtk: Factorize out the logic cleaning mtk chips
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <[email protected]>
[ Upstream commit 81cb3be3261e766a1f8efab9e3154a4f4fd9d03d ]
There are some un-freed resources in one of the error path which would benefit from a helper going through all the registered mtk chips one by one and perform all the necessary cleanup. This is precisely what the remove path does, so let's extract the logic in a helper.
There is no functional change.
Stable-dep-of: 2073ae37d550 ("mtd: rawnand: mtk: Fix init error path")
--- drivers/mtd/nand/raw/mtk_nand.c | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-)
drivers/mtd/nand/raw/mtk_nand.c +18 -13
@@ -1456,6 +1456,23 @@ static int mtk_nfc_nand_chip_init(struct device *dev, struct mtk_nfc *nfc,return 0 ; } +static void mtk_nfc_nand_chips_cleanup (struct mtk_nfc *nfc) +{ +struct mtk_nfc_nand_chip *mtk_chip; +struct nand_chip *chip; +int ret; + +while (!list_empty (&nfc->chips)) { + mtk_chip =list_first_entry (&nfc->chips, + struct mtk_nfc_nand_chip, node); + chip = &mtk_chip->nand; + ret =mtd_device_unregister (nand_to_mtd (chip)); +WARN_ON (ret); +nand_cleanup (chip); +list_del (&mtk_chip->node); + } +} +static int mtk_nfc_nand_chips_init (struct device *dev,struct mtk_nfc *nfc) {struct device_node *np = dev->of_node;
@@ -1601,20 +1618,8 @@ static int mtk_nfc_probe(struct platform_device *pdev)static int mtk_nfc_remove (struct platform_device *pdev) {struct mtk_nfc *nfc =platform_get_drvdata (pdev); -struct mtk_nfc_nand_chip *mtk_chip; -struct nand_chip *chip; -int ret; - -while (!list_empty (&nfc->chips)) { - mtk_chip =list_first_entry (&nfc->chips, - struct mtk_nfc_nand_chip, node); - chip = &mtk_chip->nand; - ret =mtd_device_unregister (nand_to_mtd (chip)); -WARN_ON (ret); -nand_cleanup (chip); -list_del (&mtk_chip->node); - } +mtk_nfc_nand_chips_cleanup (nfc);mtk_ecc_release (nfc->ecc);mtk_nfc_disable_clk (&nfc->clk);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/798 mtd: rawnand: mtk: Fix init error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <[email protected]>
[ Upstream commit 2073ae37d550ea32e8545edaa94ef10b4fef7235 ]
Reviewing a series converting the for_each_chil_of_node() loops into their _scoped variants made me realize there was no cleanup of the already registered NAND devices upon error which may leak memory on systems with more than a chip when this error occurs. We should call the _nand_chips_cleanup() function when this happens.
--- drivers/mtd/nand/raw/mtk_nand.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/mtd/nand/raw/mtk_nand.c +3 -1
@@ -1480,8 +1480,10 @@ static int mtk_nfc_nand_chips_init(struct device *dev, struct mtk_nfc *nfc)for_each_child_of_node_scoped (np, nand_np) { ret =mtk_nfc_nand_chip_init (dev, nfc, nand_np); -if (ret) +if (ret) { +mtk_nfc_nand_chips_cleanup (nfc);return ret; + } }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/798 pmdomain: core: Harden inter-column space in debug summary
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 692c20c4d075bd452acfbbc68200fc226c7c9496 ]
The inter-column space in the debug summary is two spaces. However, in one case, the extra space is handled implicitly in a field width specifier. Make inter-column space explicit to ease future maintenance.
--- drivers/base/power/domain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/power/domain.c +1 -1
@@ -3119,7 +3119,7 @@ static int genpd_summary_one(struct seq_file *s,else snprintf (state,sizeof (state),"%s" , status_lookup[genpd->status]); -seq_printf (s,"%-30s %-50s %u" , genpd->name, state, genpd->performance_state); +seq_printf (s,"%-30s %-49s %u" , genpd->name, state, genpd->performance_state);/* * Modifications on the list require holding locks on both
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/798 drm/stm: Fix an error handling path in stm_drm_platform_probe()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit ce7c90bfda2656418c69ba0dd8f8a7536b8928d4 ]
If drm_dev_register() fails, a call to drv_load() must be undone, as already done in the remove function.
--- drivers/gpu/drm/stm/drv.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/stm/drv.c +3 -1
@@ -201,12 +201,14 @@ static int stm_drm_platform_probe(struct platform_device *pdev) ret =drm_dev_register (ddev,0 );if (ret) - goto err_put; + goto err_unload;drm_fbdev_generic_setup (ddev,16 );return 0 ; +err_unload: +drv_unload (ddev); err_put:drm_dev_put (ddev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/798 drm/stm: ltdc: check memory returned by devm_kzalloc()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
[ Upstream commit fd39730c58890cd7f0a594231e19bb357f28877c ]
devm_kzalloc() can fail and return NULL pointer. Check its return status. Identified with Coccinelle (kmerr.cocci script).
--- drivers/gpu/drm/stm/ltdc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/stm/ltdc.c +2 -0
@@ -1581,6 +1581,8 @@ static struct drm_plane *ltdc_plane_create(struct drm_device *ddev,ARRAY_SIZE (ltdc_drm_fmt_ycbcr_sp) + ARRAY_SIZE(ltdc_drm_fmt_ycbcr_fp)) * sizeof(*formats), GFP_KERNEL); +if (!formats) +return NULL ;for (i =0 ; i < ldev->caps.pix_fmt_nb; i++) { drm_fmt = ldev->caps.pix_fmt_drm[i];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/798 drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 08ae395ea22fb3d9b318c8bde28c0dfd2f5fa4d2 ]
This commit adds a null check for the set_output_gamma function pointer in the dcn30_set_output_transfer_func function. Previously, set_output_gamma was being checked for nullity at line 386, but then it was being dereferenced without any nullity check at line 401. This could potentially lead to a null pointer dereference error if set_output_gamma is indeed null.
To fix this, we now ensure that set_output_gamma is not null before dereferencing it. We do this by adding a nullity check for set_output_gamma before the call to set_output_gamma at line 401. If set_output_gamma is null, we log an error message and do not call the function.
This fix prevents a potential null pointer dereference error.
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:401 dcn30_set_output_transfer_func()
error: we previously assumed 'mpc->funcs->set_output_gamma' could be null (see line 386)
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c
373 bool dcn30_set_output_transfer_func(struct dc *dc,
374 struct pipe_ctx *pipe_ctx,
375 const struct dc_stream_state *stream)
376 {
377 int mpcc_id = pipe_ctx->plane_res.hubp->inst;
378 struct mpc *mpc = pipe_ctx->stream_res.opp->ctx->dc->res_pool->mpc;
379 const struct pwl_params *params = NULL;
380 bool ret = false;
381
382 /* program OGAM or 3DLUT only for the top pipe*/
383 if (pipe_ctx->top_pipe == NULL) {
384 /*program rmu shaper and 3dlut in MPC*/
385 ret = dcn30_set_mpc_shaper_3dlut(pipe_ctx, stream);
386 if (ret == false && mpc->funcs->set_output_gamma) {
^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If this is NULL
387 if (stream->out_transfer_func.type == TF_TYPE_HWPWL)
388 params = &stream->out_transfer_func.pwl;
389 else if (pipe_ctx->stream->out_transfer_func.type ==
390 TF_TYPE_DISTRIBUTED_POINTS &&
391 cm3_helper_translate_curve_to_hw_format(
392 &stream->out_transfer_func,
393 &mpc->blender_params, false))
394 params = &mpc->blender_params;
395 /* there are no ROM LUTs in OUTGAM */
396 if (stream->out_transfer_func.type == TF_TYPE_PREDEFINED)
397 BREAK_TO_DEBUGGER();
398 }
399 }
400
--> 401 mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Then it will crash
402 return ret;
403 }--- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c +5 -1
@@ -215,7 +215,11 @@ bool dcn30_set_output_transfer_func(struct dc *dc, } } - mpc->funcs->set_output_gamma (mpc, mpcc_id, params); +if (mpc->funcs->set_output_gamma) + mpc->funcs->set_output_gamma (mpc, mpcc_id, params); +else +DC_LOG_ERROR ("%s: set_output_gamma function pointer is NULL.\n" , __func__); +return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/798 drm/amdgpu: Replace one-element array with flexible-array member
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Miguel Almeida <[email protected]>
[ Upstream commit 320e2590e281d0a7865e861f50155b5b435e9813 ]
One-element arrays are deprecated, and we are replacing them with flexible array members instead. So, replace one-element array with flexible-array member in struct _ATOM_FAKE_EDID_PATCH_RECORD and refactor the rest of the code accordingly.
Important to mention is that doing a build before/after this patch results in no binary output differences.
This helps with the ongoing efforts to tighten the FORTIFY_SOURCE routines on memcpy() and help us make progress towards globally enabling -fstrict-flex-arrays=3 [1].
Stable-dep-of: 8155566a26b8 ("drm/amdgpu: properly handle vbios fake edid sizing")
--- drivers/gpu/drm/amd/amdgpu/atombios_encoders.c | 7 +++++-- drivers/gpu/drm/amd/include/atombios.h | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/atombios_encoders.c +5 -2
@@ -2081,8 +2081,11 @@ amdgpu_atombios_encoder_get_lcd_info(struct amdgpu_encoder *encoder) } } record += fake_edid_record->ucFakeEDIDLength ? - fake_edid_record->ucFakeEDIDLength +2 : -sizeof (ATOM_FAKE_EDID_PATCH_RECORD ); +struct_size (fake_edid_record, + ucFakeEDIDString, + fake_edid_record->ucFakeEDIDLength) : +/* empty fake edid record must be 3 bytes long */ +sizeof (ATOM_FAKE_EDID_PATCH_RECORD ) +1 ;break ;case LCD_PANEL_RESOLUTION_RECORD_TYPE : panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
drivers/gpu/drm/amd/include/atombios.h +1 -1
@@ -4107,7 +4107,7 @@ typedef struct _ATOM_FAKE_EDID_PATCH_RECORD {UCHAR ucRecordType;UCHAR ucFakeEDIDLength;// = 128 means EDID length is 128 bytes, otherwise the EDID length = ucFakeEDIDLength*128 -UCHAR ucFakeEDIDString[1 ];// This actually has ucFakeEdidLength elements. +UCHAR ucFakeEDIDString[];// This actually has ucFakeEdidLength elements. }ATOM_FAKE_EDID_PATCH_RECORD ; typedef struct _ATOM_PANEL_RESOLUTION_PATCH_RECORD
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/798 drm/amdgpu: properly handle vbios fake edid sizing
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 8155566a26b8d6c1dd914f06a0c652e4e2f2adf1 ]
The comment in the vbios structure says:
// = 128 means EDID length is 128 bytes, otherwise the EDID length = ucFakeEDIDLength*128
This fake edid struct has not been used in a long time, so I'm not sure if there were actually any boards out there with a non-128 byte EDID, but align the code with the comment.
--- .../gpu/drm/amd/amdgpu/atombios_encoders.c | 29 ++++++++++--------- 1 file changed, 16 insertions(+), 13 deletions(-)
drivers/gpu/drm/amd/amdgpu/atombios_encoders.c +16 -13
@@ -2066,26 +2066,29 @@ amdgpu_atombios_encoder_get_lcd_info(struct amdgpu_encoder *encoder) fake_edid_record = (ATOM_FAKE_EDID_PATCH_RECORD *)record;if (fake_edid_record->ucFakeEDIDLength) {struct edid *edid; -int edid_size = -max ((int )EDID_LENGTH , (int )fake_edid_record->ucFakeEDIDLength); - edid =kmalloc (edid_size,GFP_KERNEL ); +int edid_size; + +if (fake_edid_record->ucFakeEDIDLength ==128 ) + edid_size = fake_edid_record->ucFakeEDIDLength; +else + edid_size = fake_edid_record->ucFakeEDIDLength *128 ; + edid =kmemdup (&fake_edid_record->ucFakeEDIDString[0 ], + edid_size,GFP_KERNEL );if (edid) { -memcpy ((u8 *)edid, (u8 *)&fake_edid_record->ucFakeEDIDString[0 ], - fake_edid_record->ucFakeEDIDLength); -if (drm_edid_is_valid (edid)) { adev->mode_info.bios_hardcoded_edid = edid; adev->mode_info.bios_hardcoded_edid_size = edid_size; - }else + }else {kfree (edid); + } } + record +=struct_size (fake_edid_record, + ucFakeEDIDString, + edid_size); + }else { +/* empty fake edid record must be 3 bytes long */ + record +=sizeof (ATOM_FAKE_EDID_PATCH_RECORD ) +1 ; } - record += fake_edid_record->ucFakeEDIDLength ? -struct_size (fake_edid_record, - ucFakeEDIDString, - fake_edid_record->ucFakeEDIDLength) : -/* empty fake edid record must be 3 bytes long */ -sizeof (ATOM_FAKE_EDID_PATCH_RECORD ) +1 ;break ;case LCD_PANEL_RESOLUTION_RECORD_TYPE : panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/798 drm/radeon: Replace one-element array with flexible-array member
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Miguel Almeida <[email protected]>
[ Upstream commit c81c5bd5cf2f428867e0bcfcccd4e4d2f8c68f51 ]
One-element arrays are deprecated, and we are replacing them with flexible array members instead. So, replace one-element array with flexible-array member in struct _ATOM_FAKE_EDID_PATCH_RECORD and refactor the rest of the code accordingly.
It's worth mentioning that doing a build before/after this patch results in no binary output differences.
This helps with the ongoing efforts to tighten the FORTIFY_SOURCE routines on memcpy() and help us make progress towards globally enabling -fstrict-flex-arrays=3 [1].
Stable-dep-of: 17c6baff3d5f ("drm/radeon: properly handle vbios fake edid sizing")
--- drivers/gpu/drm/radeon/atombios.h | 2 +- drivers/gpu/drm/radeon/radeon_atombios.c | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-)
drivers/gpu/drm/radeon/atombios.h +1 -1
@@ -3615,7 +3615,7 @@ typedef struct _ATOM_FAKE_EDID_PATCH_RECORD {UCHAR ucRecordType;UCHAR ucFakeEDIDLength; -UCHAR ucFakeEDIDString[1 ];// This actually has ucFakeEdidLength elements. +UCHAR ucFakeEDIDString[];// This actually has ucFakeEdidLength elements. }ATOM_FAKE_EDID_PATCH_RECORD ; typedef struct _ATOM_PANEL_RESOLUTION_PATCH_RECORD
drivers/gpu/drm/radeon/radeon_atombios.c +5 -2
@@ -1727,8 +1727,11 @@ struct radeon_encoder_atom_dig *radeon_atombios_get_lvds_info(struct } } record += fake_edid_record->ucFakeEDIDLength ? - fake_edid_record->ucFakeEDIDLength +2 : -sizeof (ATOM_FAKE_EDID_PATCH_RECORD ); +struct_size (fake_edid_record, + ucFakeEDIDString, + fake_edid_record->ucFakeEDIDLength) : +/* empty fake edid record must be 3 bytes long */ +sizeof (ATOM_FAKE_EDID_PATCH_RECORD ) +1 ;break ;case LCD_PANEL_RESOLUTION_RECORD_TYPE : panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/798 drm/radeon: properly handle vbios fake edid sizing
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 17c6baff3d5f65c8da164137a58742541a060b2f ]
The comment in the vbios structure says:
// = 128 means EDID length is 128 bytes, otherwise the EDID length = ucFakeEDIDLength*128
This fake edid struct has not been used in a long time, so I'm not sure if there were actually any boards out there with a non-128 byte EDID, but align the code with the comment.
--- drivers/gpu/drm/radeon/radeon_atombios.c | 29 +++++++++++++----------- 1 file changed, 16 insertions(+), 13 deletions(-)
drivers/gpu/drm/radeon/radeon_atombios.c +16 -13
@@ -1712,26 +1712,29 @@ struct radeon_encoder_atom_dig *radeon_atombios_get_lvds_info(struct fake_edid_record = (ATOM_FAKE_EDID_PATCH_RECORD *)record;if (fake_edid_record->ucFakeEDIDLength) {struct edid *edid; -int edid_size = -max ((int )EDID_LENGTH , (int )fake_edid_record->ucFakeEDIDLength); - edid =kmalloc (edid_size,GFP_KERNEL ); +int edid_size; + +if (fake_edid_record->ucFakeEDIDLength ==128 ) + edid_size = fake_edid_record->ucFakeEDIDLength; +else + edid_size = fake_edid_record->ucFakeEDIDLength *128 ; + edid =kmemdup (&fake_edid_record->ucFakeEDIDString[0 ], + edid_size,GFP_KERNEL );if (edid) { -memcpy ((u8 *)edid, (u8 *)&fake_edid_record->ucFakeEDIDString[0 ], - fake_edid_record->ucFakeEDIDLength); -if (drm_edid_is_valid (edid)) { rdev->mode_info.bios_hardcoded_edid = edid; rdev->mode_info.bios_hardcoded_edid_size = edid_size; - }else + }else {kfree (edid); + } } + record +=struct_size (fake_edid_record, + ucFakeEDIDString, + edid_size); + }else { +/* empty fake edid record must be 3 bytes long */ + record +=sizeof (ATOM_FAKE_EDID_PATCH_RECORD ) +1 ; } - record += fake_edid_record->ucFakeEDIDLength ? -struct_size (fake_edid_record, - ucFakeEDIDString, - fake_edid_record->ucFakeEDIDLength) : -/* empty fake edid record must be 3 bytes long */ -sizeof (ATOM_FAKE_EDID_PATCH_RECORD ) +1 ;break ;case LCD_PANEL_RESOLUTION_RECORD_TYPE : panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/798 scsi: smartpqi: revert propagate-the-multipath-failure-to-SML-quickly
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gilbert Wu <[email protected]>
[ Upstream commit f1393d52e6cda9c20f12643cbecf1e1dc357e0e2 ]
Correct a rare multipath failure issue by reverting commit 94a68c814328 ("scsi: smartpqi: Quickly propagate path failures to SCSI midlayer") [1].
Reason for revert: The patch propagated the path failure to SML quickly when one of the path fails during IO and AIO path gets disabled for a multipath device.
But it created a new issue: when creating a volume on an encryption-enabled controller, the firmware reports the AIO path is disabled, which cause the driver to report a path failure to SML for a multipath device.
There will be a new fix to handle "Illegal request" and "Invalid field in parameter list" on RAID path when the AIO path is disabled on a multipath device.
[1] https://lore.kernel.org/all/[email protected]/
--- drivers/scsi/smartpqi/smartpqi_init.c | 20 ++------------------ 1 file changed, 2 insertions(+), 18 deletions(-)
drivers/scsi/smartpqi/smartpqi_init.c +2 -18
@@ -2334,14 +2334,6 @@ static inline void pqi_mask_device(u8 *scsi3addr) scsi3addr[3 ] |=0xc0 ; } -static inline bool pqi_is_multipath_device (struct pqi_scsi_dev *device) -{ -if (pqi_is_logical_device (device)) -return false; - -return (device->path_map & (device->path_map -1 )) !=0 ; -} -static inline bool pqi_expose_device (struct pqi_scsi_dev *device) {return !device->is_physical_device || !pqi_skip_device (device->scsi3addr);
@@ -3238,14 +3230,12 @@ static void pqi_process_aio_io_error(struct pqi_io_request *io_request)int residual_count;int xfer_count;bool device_offline; -struct pqi_scsi_dev *device; scmd = io_request->scmd; error_info = io_request->error_info; host_byte =DID_OK ; sense_data_length =0 ; device_offline = false; - device = scmd->device->hostdata;switch (error_info->service_response) {case PQI_AIO_SERV_RESPONSE_COMPLETE :
@@ -3270,14 +3260,8 @@ static void pqi_process_aio_io_error(struct pqi_io_request *io_request)break ;case PQI_AIO_STATUS_AIO_PATH_DISABLED :pqi_aio_path_disabled (io_request); -if (pqi_is_multipath_device (device)) { -pqi_device_remove_start (device); - host_byte =DID_NO_CONNECT ; - scsi_status =SAM_STAT_CHECK_CONDITION ; - }else { - scsi_status =SAM_STAT_GOOD ; - io_request->status = -EAGAIN ; - } + scsi_status =SAM_STAT_GOOD ; + io_request->status = -EAGAIN ;break ;case PQI_AIO_STATUS_NO_PATH_TO_DEVICE :case PQI_AIO_STATUS_INVALID_DEVICE :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/798 scsi: NCR5380: Check for phase match during PDMA fixup
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
[ Upstream commit 5768718da9417331803fc4bc090544c2a93b88dc ]
It's not an error for a target to change the bus phase during a transfer. Unfortunately, the FLAG_DMA_FIXUP workaround does not allow for that -- a phase change produces a DRQ timeout error and the device borken flag will be set.
Check the phase match bit during FLAG_DMA_FIXUP processing. Don't forget to decrement the command residual. While we are here, change shost_printk() into scmd_printk() for better consistency with other DMA error messages.
--- drivers/scsi/NCR5380.c | 78 +++++++++++++++++++++--------------------- 1 file changed, 39 insertions(+), 39 deletions(-)
drivers/scsi/NCR5380.c +39 -39
@@ -1485,6 +1485,7 @@ static int NCR5380_transfer_dma(struct Scsi_Host *instance, unsigned char **data) {struct NCR5380_hostdata *hostdata =shost_priv (instance); +struct NCR5380_cmd *ncmd =NCR5380_to_ncmd (hostdata->connected);int c = *count;unsigned char p = *phase;unsigned char *d = *data;
@@ -1496,7 +1497,7 @@ static int NCR5380_transfer_dma(struct Scsi_Host *instance,return -1 ; } -NCR5380_to_ncmd (hostdata->connected)->phase = p; + ncmd->phase = p;if (p &SR_IO ) {if (hostdata->read_overruns)
@@ -1608,45 +1609,44 @@ static int NCR5380_transfer_dma(struct Scsi_Host *instance,* request. */ -if (hostdata->flags &FLAG_DMA_FIXUP ) { -if (p &SR_IO ) { -/* -* The workaround was to transfer fewer bytes than we -* intended to with the pseudo-DMA read function, wait for -* the chip to latch the last byte, read it, and then disable -* pseudo-DMA mode. -* -* After REQ is asserted, the NCR5380 asserts DRQ and ACK. -* REQ is deasserted when ACK is asserted, and not reasserted -* until ACK goes false. Since the NCR5380 won't lower ACK -* until DACK is asserted, which won't happen unless we twiddle -* the DMA port or we take the NCR5380 out of DMA mode, we -* can guarantee that we won't handshake another extra -* byte. -*/ - -if (NCR5380_poll_politely (hostdata,BUS_AND_STATUS_REG , -BASR_DRQ ,BASR_DRQ ,0 ) <0 ) { - result =-1 ; -shost_printk (KERN_ERR , instance,"PDMA read: DRQ timeout\n" ); - } -if (NCR5380_poll_politely (hostdata,STATUS_REG , -SR_REQ ,0 ,0 ) <0 ) { - result =-1 ; -shost_printk (KERN_ERR , instance,"PDMA read: !REQ timeout\n" ); - } - d[*count -1 ] =NCR5380_read (INPUT_DATA_REG ); - }else { -/* -* Wait for the last byte to be sent. If REQ is being asserted for -* the byte we're interested, we'll ACK it and it will go false. -*/ -if (NCR5380_poll_politely2 (hostdata, -BUS_AND_STATUS_REG ,BASR_DRQ ,BASR_DRQ , -BUS_AND_STATUS_REG ,BASR_PHASE_MATCH ,0 ,0 ) <0 ) { - result =-1 ; -shost_printk (KERN_ERR , instance,"PDMA write: DRQ and phase timeout\n" ); +if ((hostdata->flags &FLAG_DMA_FIXUP ) && + (NCR5380_read (BUS_AND_STATUS_REG ) &BASR_PHASE_MATCH )) { +/* +* The workaround was to transfer fewer bytes than we +* intended to with the pseudo-DMA receive function, wait for +* the chip to latch the last byte, read it, and then disable +* DMA mode. +* +* After REQ is asserted, the NCR5380 asserts DRQ and ACK. +* REQ is deasserted when ACK is asserted, and not reasserted +* until ACK goes false. Since the NCR5380 won't lower ACK +* until DACK is asserted, which won't happen unless we twiddle +* the DMA port or we take the NCR5380 out of DMA mode, we +* can guarantee that we won't handshake another extra +* byte. +* +* If sending, wait for the last byte to be sent. If REQ is +* being asserted for the byte we're interested, we'll ACK it +* and it will go false. +*/ +if (!NCR5380_poll_politely (hostdata,BUS_AND_STATUS_REG , +BASR_DRQ ,BASR_DRQ ,0 )) { +if ((p &SR_IO ) && + (NCR5380_read (BUS_AND_STATUS_REG ) &BASR_PHASE_MATCH )) { +if (!NCR5380_poll_politely (hostdata,STATUS_REG , +SR_REQ ,0 ,0 )) { + d[c] =NCR5380_read (INPUT_DATA_REG ); + --ncmd->this_residual; + }else { + result =-1 ; +scmd_printk (KERN_ERR , hostdata->connected, +"PDMA fixup: !REQ timeout\n" ); + } } + }else if (NCR5380_read (BUS_AND_STATUS_REG ) &BASR_PHASE_MATCH ) { + result =-1 ; +scmd_printk (KERN_ERR , hostdata->connected, +"PDMA fixup: DRQ timeout\n" ); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/798 drm/amd/amdgpu: Properly tune the size of struct
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: WangYuli <[email protected]>
[ Upstream commit 0cee47cde41e22712c034ae961076067d4ac13a0 ]
The struct assertion is failed because sparse cannot parse #pragma pack(push, 1) and #pragma pack(pop) correctly. GCC's output is still 1-byte-aligned. No harm to memory layout.
The error can be filtered out by sparse-diff, but sometimes multiple lines queezed into one, making the sparse-diff thinks its a new error. I'm trying to aviod this by fixing errors.
--- drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h +2 -2
@@ -209,7 +209,7 @@ struct amd_sriov_msg_pf2vf_info {uint32_t pcie_atomic_ops_support_flags;/* reserved */ uint32_t reserved[256 -AMD_SRIOV_MSG_PF2VF_INFO_FILLED_SIZE ]; -}; +} __packed;struct amd_sriov_msg_vf2pf_info_header {/* the total structure size in byte */
@@ -267,7 +267,7 @@ struct amd_sriov_msg_vf2pf_info {/* reserved */ uint32_t reserved[256 -AMD_SRIOV_MSG_VF2PF_INFO_FILLED_SIZE ]; -}; +} __packed;/* mailbox message send from guest to host */ enum amd_sriov_mailbox_request_message {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/798 drm/rockchip: vop: Allow 4096px width scaling
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Bee <[email protected]>
[ Upstream commit 0ef968d91a20b5da581839f093f98f7a03a804f7 ]
There is no reason to limit VOP scaling to 3840px width, the limit of RK3288, when there are newer VOP versions that support 4096px width.
Change to enforce a maximum of 4096px width plane scaling, the maximum supported output width of the VOP versions supported by this driver.
--- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/rockchip/rockchip_drm_vop.c +2 -2
@@ -385,8 +385,8 @@ static void scl_vop_cal_scl_fac(struct vop *vop, const struct vop_win_data *win,if (info->is_yuv) is_yuv = true; -if (dst_w >3840 ) { -DRM_DEV_ERROR (vop->dev,"Maximum dst width (3840) exceeded\n" ); +if (dst_w >4096 ) { +DRM_DEV_ERROR (vop->dev,"Maximum dst width (4096) exceeded\n" );return ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/798 drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <[email protected]>
[ Upstream commit a5d024541ec466f428e6c514577d511a40779c7b ]
EDID cannot be read on RK3328 until after read_hpd has been called and correct io voltage has been configured based on connection status.
When a forced mode is used, e.g. video=1920x1080@60e, the connector detect ops, that in turn normally calls the read_hpd, never gets called.
This result in reading EDID to fail in connector get_modes ops.
Call dw_hdmi_rk3328_read_hpd at end of dw_hdmi_rk3328_setup_hpd to correct io voltage and allow reading EDID after setup_hpd.
--- drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c +2 -0
@@ -410,6 +410,8 @@ static void dw_hdmi_rk3328_setup_hpd(struct dw_hdmi *dw_hdmi, void *data)HIWORD_UPDATE (RK3328_HDMI_SDAIN_MSK |RK3328_HDMI_SCLIN_MSK ,RK3328_HDMI_SDAIN_MSK |RK3328_HDMI_SCLIN_MSK | RK3328_HDMI_HPD_IOE)); + +dw_hdmi_rk3328_read_hpd (dw_hdmi, data); }static const struct dw_hdmi_phy_ops rk3228_hdmi_phy_ops = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/798 drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
[ Upstream commit 3fbaf475a5b8361ebee7da18964db809e37518b7 ]
Several cs track offsets (such as 'track->db_s_read_offset') either are initialized with or plainly take big enough values that, once shifted 8 bits left, may be hit with integer overflow if the resulting values end up going over u32 limit.
Same goes for a few instances of 'surf.layer_size * mslice' multiplications that are added to 'offset' variable - they may potentially overflow as well and need to be validated properly.
While some debug prints in this code section take possible overflow issues into account, simply casting to (unsigned long) may be erroneous in its own way, as depending on CPU architecture one is liable to get different results.
Fix said problems by:
- casting 'offset' to fixed u64 data type instead of ambiguous unsigned long.
- casting one of the operands in vulnerable to integer overflow cases to u64.
- adjust format specifiers in debug prints to properly represent 'offset' values.
Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.
--- drivers/gpu/drm/radeon/evergreen_cs.c | 62 +++++++++++++-------------- 1 file changed, 31 insertions(+), 31 deletions(-)
drivers/gpu/drm/radeon/evergreen_cs.c +31 -31
@@ -395,7 +395,7 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned istruct evergreen_cs_track *track = p->track;struct eg_surface surf;unsigned pitch, slice, mslice; -unsigned long offset; +u64 offset;int r; mslice =G_028C6C_SLICE_MAX (track->cb_color_view[id]) +1 ;
@@ -433,14 +433,14 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned ireturn r; } - offset = track->cb_color_bo_offset[id] <<8 ; + offset = (u64 )track->cb_color_bo_offset[id] <<8 ;if (offset & (surf.base_align -1 )) { -dev_warn (p->dev,"%s:%d cb[%d] bo base %ld not aligned with %ld\n" , +dev_warn (p->dev,"%s:%d cb[%d] bo base %llu not aligned with %ld\n" , __func__, __LINE__, id, offset, surf.base_align);return -EINVAL ; } - offset += surf.layer_size * mslice; + offset += (u64 )surf.layer_size * mslice;if (offset >radeon_bo_size (track->cb_color_bo[id])) {/* old ddx are broken they allocate bo with w*h*bpp but * program slice with ALIGN(h, 8), catch this and patch
@@ -448,14 +448,14 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i*/ if (!surf.mode) {uint32_t *ib = p->ib.ptr; -unsigned long tmp, nby, bsize, size, min =0 ; +u64 tmp, nby, bsize, size, min =0 ;/* find the height the ddx wants */ if (surf.nby >8 ) { min = surf.nby -8 ; } bsize =radeon_bo_size (track->cb_color_bo[id]); - tmp = track->cb_color_bo_offset[id] <<8 ; + tmp = (u64 )track->cb_color_bo_offset[id] <<8 ;for (nby = surf.nby; nby > min; nby--) { size = nby * surf.nbx * surf.bpe * surf.nsamples;if ((tmp + size * mslice) <= bsize) {
@@ -467,7 +467,7 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i slice = ((nby * surf.nbx) /64 ) -1 ;if (!evergreen_surface_check (p, &surf,"cb" )) {/* check if this one works */ - tmp += surf.layer_size * mslice; + tmp += (u64 )surf.layer_size * mslice;if (tmp <= bsize) { ib[track->cb_color_slice_idx[id]] = slice; goto old_ddx_ok;
@@ -476,9 +476,9 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i } }dev_warn (p->dev,"%s:%d cb[%d] bo too small (layer size %d, " -"offset %d, max layer %d, bo size %ld, slice %d)\n" , +"offset %llu, max layer %d, bo size %ld, slice %d)\n" , __func__, __LINE__, id, surf.layer_size, - track->cb_color_bo_offset[id] <<8 , mslice, + (u64 )track->cb_color_bo_offset[id] <<8 , mslice,radeon_bo_size (track->cb_color_bo[id]), slice); dev_warn(p->dev, "%s:%d problematic surf: (%d %d) (%d %d %d %d %d %d %d)\n", __func__, __LINE__, surf.nbx, surf.nby,
@@ -562,7 +562,7 @@ static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)struct evergreen_cs_track *track = p->track;struct eg_surface surf;unsigned pitch, slice, mslice; -unsigned long offset; +u64 offset;int r; mslice =G_028008_SLICE_MAX (track->db_depth_view) +1 ;
@@ -608,18 +608,18 @@ static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)return r; } - offset = track->db_s_read_offset <<8 ; + offset = (u64 )track->db_s_read_offset <<8 ;if (offset & (surf.base_align -1 )) { -dev_warn (p->dev,"%s:%d stencil read bo base %ld not aligned with %ld\n" , +dev_warn (p->dev,"%s:%d stencil read bo base %llu not aligned with %ld\n" , __func__, __LINE__, offset, surf.base_align);return -EINVAL ; } - offset += surf.layer_size * mslice; + offset += (u64 )surf.layer_size * mslice;if (offset >radeon_bo_size (track->db_s_read_bo)) {dev_warn (p->dev,"%s:%d stencil read bo too small (layer size %d, " -"offset %ld, max layer %d, bo size %ld)\n" , +"offset %llu, max layer %d, bo size %ld)\n" , __func__, __LINE__, surf.layer_size, - (unsigned long )track->db_s_read_offset <<8 , mslice, + (u64 )track->db_s_read_offset <<8 , mslice,radeon_bo_size (track->db_s_read_bo)); dev_warn(p->dev, "%s:%d stencil invalid (0x%08x 0x%08x 0x%08x 0x%08x)\n", __func__, __LINE__, track->db_depth_size,
@@ -627,18 +627,18 @@ static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)return -EINVAL ; } - offset = track->db_s_write_offset <<8 ; + offset = (u64 )track->db_s_write_offset <<8 ;if (offset & (surf.base_align -1 )) { -dev_warn (p->dev,"%s:%d stencil write bo base %ld not aligned with %ld\n" , +dev_warn (p->dev,"%s:%d stencil write bo base %llu not aligned with %ld\n" , __func__, __LINE__, offset, surf.base_align);return -EINVAL ; } - offset += surf.layer_size * mslice; + offset += (u64 )surf.layer_size * mslice;if (offset >radeon_bo_size (track->db_s_write_bo)) {dev_warn (p->dev,"%s:%d stencil write bo too small (layer size %d, " -"offset %ld, max layer %d, bo size %ld)\n" , +"offset %llu, max layer %d, bo size %ld)\n" , __func__, __LINE__, surf.layer_size, - (unsigned long )track->db_s_write_offset <<8 , mslice, + (u64 )track->db_s_write_offset <<8 , mslice,radeon_bo_size (track->db_s_write_bo));return -EINVAL ; }
@@ -659,7 +659,7 @@ static int evergreen_cs_track_validate_depth(struct radeon_cs_parser *p)struct evergreen_cs_track *track = p->track;struct eg_surface surf;unsigned pitch, slice, mslice; -unsigned long offset; +u64 offset;int r; mslice =G_028008_SLICE_MAX (track->db_depth_view) +1 ;
@@ -706,34 +706,34 @@ static int evergreen_cs_track_validate_depth(struct radeon_cs_parser *p)return r; } - offset = track->db_z_read_offset <<8 ; + offset = (u64 )track->db_z_read_offset <<8 ;if (offset & (surf.base_align -1 )) { -dev_warn (p->dev,"%s:%d stencil read bo base %ld not aligned with %ld\n" , +dev_warn (p->dev,"%s:%d stencil read bo base %llu not aligned with %ld\n" , __func__, __LINE__, offset, surf.base_align);return -EINVAL ; } - offset += surf.layer_size * mslice; + offset += (u64 )surf.layer_size * mslice;if (offset >radeon_bo_size (track->db_z_read_bo)) {dev_warn (p->dev,"%s:%d depth read bo too small (layer size %d, " -"offset %ld, max layer %d, bo size %ld)\n" , +"offset %llu, max layer %d, bo size %ld)\n" , __func__, __LINE__, surf.layer_size, - (unsigned long )track->db_z_read_offset <<8 , mslice, + (u64 )track->db_z_read_offset <<8 , mslice,radeon_bo_size (track->db_z_read_bo));return -EINVAL ; } - offset = track->db_z_write_offset <<8 ; + offset = (u64 )track->db_z_write_offset <<8 ;if (offset & (surf.base_align -1 )) { -dev_warn (p->dev,"%s:%d stencil write bo base %ld not aligned with %ld\n" , +dev_warn (p->dev,"%s:%d stencil write bo base %llu not aligned with %ld\n" , __func__, __LINE__, offset, surf.base_align);return -EINVAL ; } - offset += surf.layer_size * mslice; + offset += (u64 )surf.layer_size * mslice;if (offset >radeon_bo_size (track->db_z_write_bo)) {dev_warn (p->dev,"%s:%d depth write bo too small (layer size %d, " -"offset %ld, max layer %d, bo size %ld)\n" , +"offset %llu, max layer %d, bo size %ld)\n" , __func__, __LINE__, surf.layer_size, - (unsigned long )track->db_z_write_offset <<8 , mslice, + (u64 )track->db_z_write_offset <<8 , mslice,radeon_bo_size (track->db_z_write_bo));return -EINVAL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/798 drm/bridge: lontium-lt8912b: Validate mode in drm_bridge_funcs::mode_valid()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Ying <[email protected]>
[ Upstream commit fe828fbd87786238b30f44cafd698d975d956c97 ]
If the bridge is attached with the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag set, this driver won't initialize a connector and hence display mode won't be validated in drm_connector_helper_funcs::mode_valid(). So, move the mode validation from drm_connector_helper_funcs::mode_valid() to drm_bridge_funcs::mode_valid(), because the mode validation is always done for the bridge.
--- drivers/gpu/drm/bridge/lontium-lt8912b.c | 35 ++++++++++++------------ 1 file changed, 18 insertions(+), 17 deletions(-)
drivers/gpu/drm/bridge/lontium-lt8912b.c +18 -17
@@ -411,22 +411,6 @@ static const struct drm_connector_funcs lt8912_connector_funcs = { .atomic_destroy_state = drm_atomic_helper_connector_destroy_state, }; -static enum drm_mode_status -lt8912_connector_mode_valid (struct drm_connector *connector, -struct drm_display_mode *mode) -{ -if (mode->clock >150000 ) -return MODE_CLOCK_HIGH ; - -if (mode->hdisplay >1920 ) -return MODE_BAD_HVALUE ; - -if (mode->vdisplay >1080 ) -return MODE_BAD_VVALUE ; - -return MODE_OK ; -} -static int lt8912_connector_get_modes (struct drm_connector *connector) {struct edid *edid;
@@ -454,7 +438,6 @@ static int lt8912_connector_get_modes(struct drm_connector *connector)static const struct drm_connector_helper_funcs lt8912_connector_helper_funcs = { .get_modes = lt8912_connector_get_modes, - .mode_valid = lt8912_connector_mode_valid, }; static void lt8912_bridge_mode_set(struct drm_bridge *bridge,
@@ -596,6 +579,23 @@ static void lt8912_bridge_detach(struct drm_bridge *bridge)drm_bridge_hpd_disable (lt->hdmi_port); } +static enum drm_mode_status +lt8912_bridge_mode_valid (struct drm_bridge *bridge, +const struct drm_display_info *info, +const struct drm_display_mode *mode) +{ +if (mode->clock >150000 ) +return MODE_CLOCK_HIGH ; + +if (mode->hdisplay >1920 ) +return MODE_BAD_HVALUE ; + +if (mode->vdisplay >1080 ) +return MODE_BAD_VVALUE ; + +return MODE_OK ; +} +static enum drm_connector_status lt8912_bridge_detect (struct drm_bridge *bridge) {
@@ -626,6 +626,7 @@ static struct edid *lt8912_bridge_get_edid(struct drm_bridge *bridge,static const struct drm_bridge_funcs lt8912_bridge_funcs = { .attach = lt8912_bridge_attach, .detach = lt8912_bridge_detach, + .mode_valid = lt8912_bridge_mode_valid, .mode_set = lt8912_bridge_mode_set, .enable = lt8912_bridge_enable, .detect = lt8912_bridge_detect,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/798 drm/vc4: hdmi: Handle error case of pm_runtime_resume_and_get
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
[ Upstream commit f1a54e860b1bc8d824925b5a77f510913880e8d6 ]
The commit 0f5251339eda ("drm/vc4: hdmi: Make sure the controller is powered in detect") introduced the necessary power management handling to avoid register access while controller is powered down. Unfortunately it just print a warning if pm_runtime_resume_and_get() fails and proceed anyway.
This could happen during suspend to idle. So we must assume it is unsafe to access the HDMI register. So bail out properly.
--- drivers/gpu/drm/vc4/vc4_hdmi.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/gpu/drm/vc4/vc4_hdmi.c +7 -1
@@ -448,6 +448,7 @@ static int vc4_hdmi_connector_detect_ctx(struct drm_connector *connector, {struct vc4_hdmi *vc4_hdmi =connector_to_vc4_hdmi (connector);enum drm_connector_status status = connector_status_disconnected; +int ret;/* * NOTE: This function should really take vc4_hdmi->mutex, but
@@ -460,7 +461,12 @@ static int vc4_hdmi_connector_detect_ctx(struct drm_connector *connector,* the lock for now. */ -WARN_ON (pm_runtime_resume_and_get (&vc4_hdmi->pdev->dev)); + ret =pm_runtime_resume_and_get (&vc4_hdmi->pdev->dev); +if (ret) { +drm_err_once (connector->dev,"Failed to retain HDMI power domain: %d\n" , + ret); +return connector_status_unknown; + }if (vc4_hdmi->hpd_gpio) {if (gpiod_get_value_cansleep (vc4_hdmi->hpd_gpio))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/798 scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 2e4b02fad094976763af08fec2c620f4f8edd9ae ]
The kref_put() function will call nport->release if the refcount drops to zero. The nport->release release function is _efc_nport_free() which frees "nport". But then we dereference "nport" on the next line which is a use after free. Re-order these lines to avoid the use after free.
--- drivers/scsi/elx/libefc/efc_nport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/elx/libefc/efc_nport.c +1 -1
@@ -705,9 +705,9 @@ efc_nport_vport_del(struct efc *efc, struct efc_domain *domain,spin_lock_irqsave (&efc->lock, flags);list_for_each_entry (nport, &domain->nport_list, list_entry) {if (nport->wwpn == wwpn && nport->wwnn == wwnn) { -kref_put (&nport->ref, nport->release);/* Shutdown this NPORT */ efc_sm_post_event (&nport->sm,EFC_EVT_SHUTDOWN ,NULL ); +kref_put (&nport->ref, nport->release);break ; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/798 jfs: fix out-of-bounds in dbNextAG() and diAlloc()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
[ Upstream commit e63866a475562810500ea7f784099bfe341e761a ]
In dbNextAG() , there is no check for the case where bmp->db_numag is greater or same than MAXAG due to a polluted image, which causes an out-of-bounds. Therefore, a bounds check should be added in dbMount().
And in dbNextAG(), a check for the case where agpref is greater than bmp->db_numag should be added, so an out-of-bounds exception should be prevented.
Additionally, a check for the case where agno is greater or same than MAXAG should be added in diAlloc() to prevent out-of-bounds.
--- fs/jfs/jfs_dmap.c | 4 ++-- fs/jfs/jfs_imap.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
fs/jfs/jfs_dmap.c +2 -2
@@ -187,7 +187,7 @@ int dbMount(struct inode *ipbmap) } bmp->db_numag =le32_to_cpu (dbmp_le->dn_numag); -if (!bmp->db_numag) { +if (!bmp->db_numag || bmp->db_numag >=MAXAG ) { err = -EINVAL ; goto err_release_metapage; }
@@ -652,7 +652,7 @@ int dbNextAG(struct inode *ipbmap)* average free space. */ for (i =0 ; i < bmp->db_numag; i++, agpref++) { -if (agpref == bmp->db_numag) +if (agpref >= bmp->db_numag) agpref =0 ;if (atomic_read (&bmp->db_active[agpref]))
fs/jfs/jfs_imap.c +1 -1
@@ -1360,7 +1360,7 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)/* get the ag number of this iag */ agno =BLKTOAG (JFS_IP (pip)->agstart,JFS_SBI (pip->i_sb)); dn_numag =JFS_SBI (pip->i_sb)->bmap->db_numag; -if (agno <0 || agno > dn_numag) +if (agno <0 || agno > dn_numag || agno >=MAXAG )return -EIO ;if (atomic_read (&JFS_SBI (pip->i_sb)->bmap->db_active[agno])) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/798 drm/mediatek: Fix missing configuration flags in mtk_crtc_ddp_config()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason-JH.Lin <[email protected]>
[ Upstream commit fe30bae552ce27b9fefe0b12db1544e73d07325f ]
In mtk_crtc_ddp_config(), mtk_crtc will use some configuration flags to generate instructions to cmdq_handle, such as:
state->pending_config
mtk_crtc->pending_planes
plane_state->pending.config
mtk_crtc->pending_async_planes plane_state->pending.async_config
These configuration flags may be set to false when a GCE IRQ comes calling ddp_cmdq_cb(). This may result in missing prepare instructions, especially if mtk_crtc_update_config() with the flase need_vblank (no need to wait for vblank) cases.
Therefore, the mtk_crtc->config_updating flag is set at the beginning of mtk_crtc_update_config() to ensure that these configuration flags won't be changed when the mtk_crtc_ddp_config() is preparing instructions. But somehow the ddp_cmdq_cb() didn't use the mtk_crtc->config_updating flag to prevent those pending config flags from being cleared.
To avoid missing the configuration when generating the config instruction, the config_updating flag should be added into ddp_cmdq_cb() and be protected with spin_lock.
--- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 27 +++++++++++++++++++++++++ 1 file changed, 27 insertions(+)
drivers/gpu/drm/mediatek/mtk_drm_crtc.c +27 -0
@@ -65,6 +65,8 @@ struct mtk_drm_crtc {/* lock for display hardware access */ struct mutex hw_lock;bool config_updating; +/* lock for config_updating to cmd buffer */ +spinlock_t config_lock; };struct mtk_crtc_state {
@@ -102,11 +104,16 @@ static void mtk_drm_crtc_finish_page_flip(struct mtk_drm_crtc *mtk_crtc)static void mtk_drm_finish_page_flip (struct mtk_drm_crtc *mtk_crtc) { +unsigned long flags; +drm_crtc_handle_vblank (&mtk_crtc->base); + +spin_lock_irqsave (&mtk_crtc->config_lock, flags);if (!mtk_crtc->config_updating && mtk_crtc->pending_needs_vblank) {mtk_drm_crtc_finish_page_flip (mtk_crtc); mtk_crtc->pending_needs_vblank = false; } +spin_unlock_irqrestore (&mtk_crtc->config_lock, flags); }#if IS_REACHABLE (CONFIG_MTK_CMDQ )
@@ -289,12 +296,19 @@ static void ddp_cmdq_cb(struct mbox_client *cl, void *mssg) struct mtk_drm_crtc *mtk_crtc = container_of(cmdq_cl, struct mtk_drm_crtc, cmdq_client);struct mtk_crtc_state *state;unsigned int i; +unsigned long flags;if (data->sta <0 )return ; state =to_mtk_crtc_state (mtk_crtc->base.state); +spin_lock_irqsave (&mtk_crtc->config_lock, flags); +if (mtk_crtc->config_updating) { +spin_unlock_irqrestore (&mtk_crtc->config_lock, flags); + goto ddp_cmdq_cb_out; + } + state->pending_config = false;if (mtk_crtc->pending_planes) {
@@ -321,6 +335,10 @@ static void ddp_cmdq_cb(struct mbox_client *cl, void *mssg) mtk_crtc->pending_async_planes = false; } +spin_unlock_irqrestore (&mtk_crtc->config_lock, flags); + +ddp_cmdq_cb_out: + mtk_crtc->cmdq_vblank_cnt =0 ;wake_up (&mtk_crtc->cb_blocking_queue); }
@@ -544,9 +562,14 @@ static void mtk_drm_crtc_update_config(struct mtk_drm_crtc *mtk_crtc,struct mtk_drm_private *priv = crtc->dev->dev_private;unsigned int pending_planes =0 , pending_async_planes =0 ;int i; +unsigned long flags;mutex_lock (&mtk_crtc->hw_lock); + +spin_lock_irqsave (&mtk_crtc->config_lock, flags); mtk_crtc->config_updating = true; +spin_unlock_irqrestore (&mtk_crtc->config_lock, flags); +if (needs_vblank) mtk_crtc->pending_needs_vblank = true;
@@ -600,7 +623,10 @@ static void mtk_drm_crtc_update_config(struct mtk_drm_crtc *mtk_crtc, mbox_client_txdone(mtk_crtc->cmdq_client.chan, 0); }#endif +spin_lock_irqsave (&mtk_crtc->config_lock, flags); mtk_crtc->config_updating = false; +spin_unlock_irqrestore (&mtk_crtc->config_lock, flags); +mutex_unlock (&mtk_crtc->hw_lock); }
@@ -971,6 +997,7 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,drm_crtc_enable_color_mgmt (&mtk_crtc->base,0 , has_ctm, gamma_lut_size); priv->num_pipes++;mutex_init (&mtk_crtc->hw_lock); +spin_lock_init (&mtk_crtc->config_lock);#if IS_REACHABLE (CONFIG_MTK_CMDQ ) mtk_crtc->cmdq_client.client.dev = mtk_crtc->mmsys_dev;
Signature · 1 line
2.43.0