5.10.231-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 5.10.231-rc1 review
This is the start of the stable review cycle for the 5.10.231 release. There are 459 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 14 Dec 2024 14:41:35 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.231-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.231-rc1
Dan Carpenter <[email protected]>
octeontx2-pf: Fix otx2_get_fecparam()
David S. Miller <[email protected]>
octeontx2: Fix condition.
Thadeu Lima de Souza Cascardo <[email protected]>
media: uvcvideo: Require entities to have a non-zero unique ID
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
Damien Le Moal <[email protected]>
scsi: core: Fix scsi_mode_select() buffer length handling
Damien Le Moal <[email protected]>
scsi: sd: Fix sd_do_mode_sense() buffer length handling
Damien Le Moal <[email protected]>
PCI: rockchip-ep: Fix address translation unit programming
Zhang Zekun <[email protected]>
Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()"
Thomas Gleixner <[email protected]>
modpost: Add .irqentry.text to OTHER_SECTIONS
Heming Zhao <[email protected]>
ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume"
Alex Hung <[email protected]>
drm/amd/display: Check BIOS images before it is used
Mathias Nyman <[email protected]>
xhci: dbc: Fix STALL transfer event handling
Richard Weinberger <[email protected]>
jffs2: Fix rtime decompressor
Kinsey Moore <[email protected]>
jffs2: Prevent rtime decompress memory corruption
Kunkun Jiang <[email protected]>
KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE
Kunkun Jiang <[email protected]>
KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device
Jing Zhang <[email protected]>
KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*
Linus Torvalds <[email protected]>
Revert "unicode: Don't special case ignorable code points"
Filipe Manana <[email protected]>
btrfs: fix missing snapshot drew unlock when root is dead during swap activation
K Prateek Nayak <[email protected]>
sched/core: Prevent wakeup of ksoftirqd during idle load balance
K Prateek Nayak <[email protected]>
sched/fair: Check idle_cpu() before need_resched() to detect ilb CPU turning busy
Valentin Schneider <[email protected]>
sched/fair: Add NOHZ balancer flag for nohz.next_balance updates
Vincent Guittot <[email protected]>
sched/fair: Trigger the update of blocked load on newly idle cpu
Vincent Guittot <[email protected]>
sched/fair: Merge for each idle cpu loop of ILB
Vincent Guittot <[email protected]>
sched/fair: Remove unused parameter of update_nohz_stats
Vincent Guittot <[email protected]>
sched/fair: Remove update of blocked load from newidle_balance
K Prateek Nayak <[email protected]>
sched/core: Remove the unnecessary need_resched() check in nohz_csd_func()
Parker Newman <[email protected]>
misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle
Michael Ellerman <[email protected]>
powerpc/prom_init: Fixup missing powermac #size-cells
Xi Ruoyao <[email protected]>
MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a
Xu Yang <[email protected]>
usb: chipidea: udc: handle USB Error Interrupt if IOC not set
Defa Li <[email protected]>
i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock
Mengyuan Lou <[email protected]>
PCI: Add ACS quirk for Wangxun FF5xxx NICs
Keith Busch <[email protected]>
PCI: Add 'reset_subordinate' to reset hierarchy below bridge
Qi Han <[email protected]>
f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
Yi Yang <[email protected]>
nvdimm: rectify the illogical code within nd_dax_probe()
Barnabás Czémán <[email protected]>
pinctrl: qcom-pmic-gpio: add support for PM8937
Kai Mäkisara <[email protected]>
scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset
Kai Mäkisara <[email protected]>
scsi: st: Don't modify unknown block number in MTIOCGET
Mukesh Ojha <[email protected]>
leds: class: Protect brightness_show() with led_cdev->led_access mutex
Yihang Li <[email protected]>
scsi: hisi_sas: Add cond_resched() for no forced preemption model
Uros Bizjak <[email protected]>
tracing: Use atomic64_inc_return() in trace_clock_counter()
Esben Haabendal <[email protected]>
pinctrl: freescale: fix COMPILE_TEST error with PINCTRL_IMX_SCU
Breno Leitao <[email protected]>
netpoll: Use rcu_access_pointer() in __netpoll_setup
Jakub Kicinski <[email protected]>
net/neighbor: clear error in case strict check is not set
Dmitry Antipov <[email protected]>
rocker: fix link status detection in rocker_carrier_init()
Jonas Karlman <[email protected]>
ASoC: hdmi-codec: reorder channel allocation list
Hilda Wu <[email protected]>
Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables
Norbert van Bolhuis <[email protected]>
wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()
Jiapeng Chong <[email protected]>
wifi: ipw2x00: libipw_rx_any(): fix bad alignment
Prike Liang <[email protected]>
drm/amdgpu: set the right AMDGPU sg segment limitation
Victor Zhao <[email protected]>
drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov
Nihar Chaithanya <[email protected]>
jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
Ghanshyam Agrawal <[email protected]>
jfs: fix array-index-out-of-bounds in jfs_readdir
Ghanshyam Agrawal <[email protected]>
jfs: fix shift-out-of-bounds in dbSplit
Ghanshyam Agrawal <[email protected]>
jfs: array-index-out-of-bounds fix in dtReadFirst
Levi Yun <[email protected]>
dma-debug: fix a possible deadlock on radix_lock
Lang Yu <[email protected]>
drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr
Rosen Penev <[email protected]>
wifi: ath5k: add PCI ID for Arcadyan devices
Rosen Penev <[email protected]>
wifi: ath5k: add PCI ID for SX76X
Ignat Korchagin <[email protected]>
net: inet6: do not leave a dangling sk pointer in inet6_create()
Ignat Korchagin <[email protected]>
net: inet: do not leave a dangling sk pointer in inet_create()
Ignat Korchagin <[email protected]>
net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
Ignat Korchagin <[email protected]>
net: af_can: do not leave a dangling sk pointer in can_create()
Ignat Korchagin <[email protected]>
Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
Ignat Korchagin <[email protected]>
af_packet: avoid erroring out after sock_init_data() in packet_create()
Elena Salomatkina <[email protected]>
net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
Simon Horman <[email protected]>
net: ethernet: fs_enet: Use %pa to format resource_size_t
Simon Horman <[email protected]>
net: fec_mpc52xx_phy: Use %pa to format resource_size_t
Zhu Jun <[email protected]>
samples/bpf: Fix a resource leak
Heiner Kallweit <[email protected]>
r8169: don't apply UDP padding quirk on RTL8126A
Igor Artemiev <[email protected]>
drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check()
Liao Chen <[email protected]>
drm/mcde: Enable module autoloading
Joaquín Ignacio Aramendía <[email protected]>
drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model
Dave Stevenson <[email protected]>
drm/vc4: hvs: Set AXI panic modes for the HVS
Rohan Barar <[email protected]>
media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108
David Given <[email protected]>
media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera
Marco Elver <[email protected]>
kcsan: Turn report_filterlist_lock into a raw_spinlock
Mark Brown <[email protected]>
kselftest/arm64: Don't leak pipe fds in pac.exec_sign_all()
Qu Wenruo <[email protected]>
btrfs: avoid unnecessary device path update for the same device
Thomas Richter <[email protected]>
s390/cpum_sf: Handle CPU hotplug remove during sampling
Pratyush Brahma <[email protected]>
iommu/arm-smmu: Defer probe of clients after smmu device bound
Wengang Wang <[email protected]>
ocfs2: update seq_file index in ocfs2_dlm_seq_next
Ulf Hansson <[email protected]>
mmc: core: Further prevent card detect during shutdown
Hans de Goede <[email protected]>
mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10 tablet
Cosmin Tanislav <[email protected]>
regmap: detach regmap from dev on regmap_exit
Christian König <[email protected]>
dma-buf: fix dma_fence_array_signaled v4
Maciej Fijalkowski <[email protected]>
bpf: fix OOB devmap writes when deleting elements
Liequan Che <[email protected]>
bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
Ryusuke Konishi <[email protected]>
nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
Saurav Kashyap <[email protected]>
scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix use after free on unload
Anil Gurumurthy <[email protected]>
scsi: qla2xxx: Supported speed displayed incorrectly for VPorts
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix NVMe and NPIV connect issue
Sahas Leelodharry <[email protected]>
ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360 (NP730QFG)
Nazar Bilinskyi <[email protected]>
ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook 430 G8
Marie Ramlow <[email protected]>
ALSA: usb-audio: add mixer mapping for Corsair HS80
Mark Rutland <[email protected]>
arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL
Kuan-Wei Chiu <[email protected]>
tracing: Fix cmp_entries_dup() to respect sort() comparison rules
Alexander Sverdlin <[email protected]>
watchdog: rti: of: honor timeout-sec property
WangYuli <[email protected]>
HID: wacom: fix when get product name maybe null pointer
Hou Tao <[email protected]>
bpf: Fix exact match conditions in trie_get_next_key()
Hou Tao <[email protected]>
bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie
Tetsuo Handa <[email protected]>
ocfs2: free inode when ocfs2_get_init_inode() fails
Pei Xiao <[email protected]>
spi: mpc52xx: Add cancel_work_sync before module remove
Zijian Zhang <[email protected]>
tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
Pei Xiao <[email protected]>
drm/sti: Add __iomem for mixer_dbg_mxn's parameter
Frank Li <[email protected]>
i3c: master: Fix dynamic address leak when 'assigned-address' is present
Frank Li <[email protected]>
i3c: master: Extend address status bit to 4 and add I3C_ADDR_SLOT_EXT_DESIRED
Frank Li <[email protected]>
i3c: master: Replace hard code 2 with macro I3C_ADDR_SLOT_STATUS_BITS
Jamie Iles <[email protected]>
i3c: fix incorrect address slot lookup on 64-bit
Michal Simek <[email protected]>
dt-bindings: serial: rs485: Fix rs485-rts-delay property
Lino Sanfilippo <[email protected]>
dt_bindings: rs485: Correct delay values
Charles Han <[email protected]>
gpio: grgpio: Add NULL check in grgpio_probe
Bartosz Golaszewski <[email protected]>
gpio: grgpio: use a helper variable to store the address of ofdev->dev
Eric Dumazet <[email protected]>
geneve: do not assume mac header is set in geneve_xmit_skb()
Kory Maincent <[email protected]>
ethtool: Fix wrong mod state in case of verbose and no_mask bitset
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_hash: skip duplicated elements pending gc run
Phil Sutter <[email protected]>
netfilter: ipset: Hold module reference while requesting a module
Xin Long <[email protected]>
net: sched: fix erspan_opt settings in cls_flower
Yuan Can <[email protected]>
igb: Fix potential invalid memory access in igb_init_module()
Louis Leseur <[email protected]>
net/qed: allow old cards not supporting "num_images" to work
Kuniyuki Iwashima <[email protected]>
tipc: Fix use-after-free of kernel socket in cleanup_bearer().
Ivan Solodovnikov <[email protected]>
dccp: Fix memory leak in dccp_feat_change_recv
Jiri Wiesner <[email protected]>
net/ipv6: release expired exception dst cached in socket
Dmitry Antipov <[email protected]>
can: j1939: j1939_session_new(): fix skb reference counting
Eric Dumazet <[email protected]>
net: hsr: avoid potential out-of-bound access in fill_frame_info()
Martin Ottens <[email protected]>
net/sched: tbf: correct backlog statistic for GSO packets
Ajay Kaher <[email protected]>
ptp: Add error handling for adjfine callback in ptp_clock_adjtime
Dmitry Antipov <[email protected]>
netfilter: x_tables: fix LED ID check in led_tg_check()
Jinghao Jia <[email protected]>
ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
Dario Binacchi <[email protected]>
can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
Dario Binacchi <[email protected]>
can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL
Yassine Oudjana <[email protected]>
watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart()
Oleksandr Ocheretnyi <[email protected]>
iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
Lucas Stach <[email protected]>
drm/etnaviv: flush shader L1 cache after user commandstream
Josef Bacik <[email protected]>
btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
Yang Erkun <[email protected]>
nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
Yang Erkun <[email protected]>
nfsd: make sure exp active before svc_export_show
Yuan Can <[email protected]>
dm thin: Add missing destroy_work_on_stack()
Kishon Vijay Abraham I <[email protected]>
PCI: keystone: Add link up check to ks_pcie_other_map_bus()
Frank Li <[email protected]>
i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
Peter Griffin <[email protected]>
scsi: ufs: exynos: Fix hibern8 notify callbacks
Alexandru Ardelean <[email protected]>
util_macros.h: fix/rework find_closest() macros
Zicheng Qu <[email protected]>
ad7780: fix division by zero in ad7780_write_raw()
Filipe Manana <[email protected]>
btrfs: ref-verify: fix use-after-free after invalid ref action
Ojaswin Mujoo <[email protected]>
quota: flush quota_release_work upon quota writeback
Gustavo A. R. Silva <[email protected]>
octeontx2-pf: Fix out-of-bounds read in otx2_get_fecparam()
Shengjiu Wang <[email protected]>
ASoC: fsl_micfil: fix the naming style for mask definition
Dan Carpenter <[email protected]>
sh: intc: Fix use-after-free bug in register_intc_controller()
Liu Jian <[email protected]>
sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
Trond Myklebust <[email protected]>
SUNRPC: Replace internal use of SOCKWQ_ASYNC_NOSPACE
Thiago Rafael Becker <[email protected]>
sunrpc: remove unnecessary test in rpc_task_set_client()
Trond Myklebust <[email protected]>
SUNRPC: Convert rpc_client refcount to use refcount_t
Calum Mackay <[email protected]>
SUNRPC: correct error code comment in xs_tcp_setup_socket()
Li Lingfeng <[email protected]>
nfs: ignore SB_RDONLY when mounting nfs
Masahiro Yamada <[email protected]>
modpost: remove incorrect code in do_eisa_entry()
Maxime Chevallier <[email protected]>
rtc: ab-eoz9: don't fail temperature reads on undervoltage notification
Alex Zenla <[email protected]>
9p/xen: fix release of IRQ
Alex Zenla <[email protected]>
9p/xen: fix init sequence
Christoph Hellwig <[email protected]>
block: return unsigned int from bdev_io_min
Qingfang Deng <[email protected]>
jffs2: fix use of uninitialized variable
Waqar Hameed <[email protected]>
ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit
Zhihao Cheng <[email protected]>
ubi: fastmap: Fix duplicate slab cache names while attaching
Zhihao Cheng <[email protected]>
ubifs: Correct the total block count by deducting journal reservation
Yongliang Gao <[email protected]>
rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
Nobuhiro Iwamatsu <[email protected]>
rtc: abx80x: Fix WDT bit position of the status register
Jinjie Ruan <[email protected]>
rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq()
Trond Myklebust <[email protected]>
NFSv4.0: Fix a use-after-free problem in the asynchronous open()
Tiwei Bie <[email protected]>
um: Always dump trace for specified task in show_stack
Tiwei Bie <[email protected]>
um: Fix the return value of elf_core_copy_task_fpregs
Tiwei Bie <[email protected]>
um: Fix potential integer overflow during physmem setup
Bjorn Andersson <[email protected]>
rpmsg: glink: Propagate TX failures in intentless mode as well
Yang Erkun <[email protected]>
SUNRPC: make sure cache entry active before cache_show
Chuck Lever <[email protected]>
NFSD: Prevent a potential integer overflow
Bartosz Golaszewski <[email protected]>
lib: string_helpers: silence snprintf() output truncation warning
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Fix looping of queued SG entries
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Fix checking for number of TRBs left
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Apply quirk for Medion E15433
Dinesh Kumar <[email protected]>
ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max
Kailang Yang <[email protected]>
ALSA: hda/realtek: Set PCBeep to default value for ALC274
Kailang Yang <[email protected]>
ALSA: hda/realtek: Update ALC225 depop procedure
Hans Verkuil <[email protected]>
media: v4l2-core: v4l2-dv-timings: check cvt/gtf result
Qiu-ji Chen <[email protected]>
media: wl128x: Fix atomicity violation in fmc_send_cmd()
Jason Gerecke <[email protected]>
HID: wacom: Interpret tilt data from Intuos Pro BT as signed values
Muchun Song <[email protected]>
block: fix ordering between checking BLK_MQ_S_STOPPED request adding
Will Deacon <[email protected]>
arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled
Huacai Chen <[email protected]>
sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
Tiwei Bie <[email protected]>
um: vector: Do not use drvdata in release
Bin Liu <[email protected]>
serial: 8250: omap: Move pm_runtime_get_sync
Tiwei Bie <[email protected]>
um: net: Do not use drvdata in release
Tiwei Bie <[email protected]>
um: ubd: Do not use drvdata in release
Zhihao Cheng <[email protected]>
ubi: wl: Put source PEB into correct list if trying locking LEB failed
Javier Carrasco <[email protected]>
platform/chrome: cros_ec_typec: fix missing fwnode reference decrement
Stanislaw Gruszka <[email protected]>
spi: Fix acpi deferred irq probe
Jeongjun Park <[email protected]>
netfilter: ipset: add missing range check in bitmap_ip_uadt
Greg Kroah-Hartman <[email protected]>
Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit"
Claudiu Beznea <[email protected]>
serial: sh-sci: Clean sci_ports[0] after at earlycon exit
Michal Vrastil <[email protected]>
Revert "usb: gadget: composite: fix OS descriptors w_value logic"
Zijun Hu <[email protected]>
driver core: bus: Fix double free in driver API bus_register()
Andrej Shadura <[email protected]>
Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()
Namjae Jeon <[email protected]>
exfat: fix uninit-value in __exfat_get_dentry_set
Ahmed Ehab <[email protected]>
locking/lockdep: Avoid creating new name string literals in lockdep_set_subclass()
Nicolas Bouchinet <[email protected]>
tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler
Jinjie Ruan <[email protected]>
apparmor: test: Fix memory leak for aa_unpack_strdup()
Jann Horn <[email protected]>
comedi: Flush partial mappings in error case
Amir Goldstein <[email protected]>
fsnotify: fix sending inotify event with unexpected filename
Lukas Wunner <[email protected]>
PCI: Fix use-after-free of slot->bus on hot remove
Raghavendra Rao Ananta <[email protected]>
KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status
Eric Biggers <[email protected]>
crypto: x86/aegis128 - access 32-bit arguments as 32-bit
Adrian Hunter <[email protected]>
perf/x86/intel/pt: Fix buffer full but size is 0 case
Qiu-ji Chen <[email protected]>
ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata()
Artem Sadovnikov <[email protected]>
jfs: xattr: check invalid xattr size more strictly
Theodore Ts'o <[email protected]>
ext4: fix FS_IOC_GETFSMAP handling
Jeongjun Park <[email protected]>
ext4: supress data-race warnings in ext4_free_inodes_{count,set}()
Benoît Sevens <[email protected]>
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
Manikanta Mylavarapu <[email protected]>
soc: qcom: socinfo: fix revision check in qcom_socinfo_probe()
Vitalii Mordan <[email protected]>
usb: ehci-spear: fix call balance of sehci clk handling routines
Qiu-ji Chen <[email protected]>
xen: Fix the issue of resource not being properly released in xenbus_dev_probe()
chao liu <[email protected]>
apparmor: fix 'Do simple duplicate message elimination'
Kailang Yang <[email protected]>
ALSA: hda/realtek: Update ALC256 depop procedure
Kailang Yang <[email protected]>
ALSA: hda/realtek - Add type for ALC287
Johan Hovold <[email protected]>
staging: greybus: uart: clean up TIOCGSERIAL
Jinjie Ruan <[email protected]>
misc: apds990x: Fix missing pm_runtime_disable()
Edward Adam Davis <[email protected]>
USB: chaoskey: Fix possible deadlock chaoskey_list_lock
Oliver Neukum <[email protected]>
USB: chaoskey: fail open after removal
Oliver Neukum <[email protected]>
usb: yurex: make waiting on yurex_write interruptible
Jeongjun Park <[email protected]>
usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read()
Christophe JAILLET <[email protected]>
iio: light: al3010: Fix an error handling path in al3010_probe()
Paolo Abeni <[email protected]>
ipmr: fix tables suspicious RCU usage
Eric Dumazet <[email protected]>
ipmr: convert /proc handlers to rcu_read_lock()
Saravanan Vajravel <[email protected]>
bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down
Eric Dumazet <[email protected]>
net: hsr: fix hsr_init_sk() vs network/transport headers.
Alexander Lobakin <[email protected]>
net: introduce a netdev feature for UDP GRO forwarding
Csókás, Bence <[email protected]>
spi: atmel-quadspi: Fix register name in verbose logging function
Maxime Chevallier <[email protected]>
net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken
Vitalii Mordan <[email protected]>
marvell: pxa168_eth: fix call balance of pep->clk handling routines
Oleksij Rempel <[email protected]>
net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration
Pavan Chebbi <[email protected]>
tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets
Oleksij Rempel <[email protected]>
net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device
Barnabás Czémán <[email protected]>
power: supply: bq27xxx: Fix registers of bq27426
Hermes Zhang <[email protected]>
power: supply: bq27xxx: Support CHARGE_NOW for bq27z561/bq28z610/bq34z100
Bart Van Assche <[email protected]>
power: supply: core: Remove might_sleep() from power_supply_put()
Randy Dunlap <[email protected]>
fs_parser: update mount_api doc to match function signature
Avihai Horon <[email protected]>
vfio/pci: Properly hide first-in-list PCIe extended capability
Si-Wei Liu <[email protected]>
vdpa/mlx5: Fix suboptimal range on iotlb iteration
Chuck Lever <[email protected]>
NFSD: Fix nfsd4_shutdown_copy()
Chuck Lever <[email protected]>
NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir()
Chuck Lever <[email protected]>
NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
Sibi Sankar <[email protected]>
remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region
Jonathan Marek <[email protected]>
rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length
Bjorn Andersson <[email protected]>
rpmsg: glink: Fix GLINK command prefix
Arun Kumar Neelakantam <[email protected]>
rpmsg: glink: Send READ_NOTIFY command in FIFO full case
Arun Kumar Neelakantam <[email protected]>
rpmsg: glink: Add TX_DATA_CONT command while sending
Benjamin Peterson <[email protected]>
perf trace: Avoid garbage when not printing a syscall's arguments
Benjamin Peterson <[email protected]>
perf trace: Do not lose last events in a race
Antonio Quartulli <[email protected]>
m68k: coldfire/device.c: only build FEC when HW macros are defined
Jean-Michel Hautbois <[email protected]>
m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x
Benjamin Peterson <[email protected]>
perf trace: avoid garbage when not printing a trace event's arguments
Yongpeng Yang <[email protected]>
f2fs: check curseg->inited before write_sum_page in change_curseg
Christoph Hellwig <[email protected]>
f2fs: remove the unused flush argument to change_curseg
Christoph Hellwig <[email protected]>
f2fs: open code allocate_segment_by_default
Christoph Hellwig <[email protected]>
f2fs: remove struct segment_allocation default_salloc_ops
Chao Yu <[email protected]>
f2fs: avoid using native allocate_segment_by_default()
LongPing Wei <[email protected]>
f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block
Ilpo Järvinen <[email protected]>
PCI: cpqphp: Fix PCIBIOS_* return value confusion
weiyufeng <[email protected]>
PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads
Leo Yan <[email protected]>
perf probe: Correct demangled symbols in C++ program
Ian Rogers <[email protected]>
perf probe: Fix libdw memory leak
James Clark <[email protected]>
perf cs-etm: Don't flush when packet_queue fills up
Nuno Sa <[email protected]>
clk: clk-axi-clkgen: make sure to enable the AXI bus clock
Alexandru Ardelean <[email protected]>
clk: axi-clkgen: use devm_platform_ioremap_resource() short-hand
Nuno Sa <[email protected]>
dt-bindings: clock: axi-clkgen: include AXI clk
Alexandru Ardelean <[email protected]>
dt-bindings: clock: adi,axi-clkgen: convert old binding to yaml format
Zhen Lei <[email protected]>
fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
Thomas Zimmermann <[email protected]>
fbdev/sh7760fb: Alloc DMA memory from hardware device
Zhang Zekun <[email protected]>
powerpc/kexec: Fix return of uninitialized variable
Michal Suchanek <[email protected]>
powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static
Dmitry Antipov <[email protected]>
ocfs2: fix uninitialized value in ocfs2_file_read_iter()
Junxian Huang <[email protected]>
RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg()
Zhen Lei <[email protected]>
scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
Zhen Lei <[email protected]>
scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
Zeng Heng <[email protected]>
scsi: fusion: Remove unused variable 'rc'
Ye Bin <[email protected]>
scsi: bfa: Fix use-after-free in bfad_im_module_exit()
Zhang Changzhong <[email protected]>
mfd: rt5033: Fix missing regmap_del_irq_chip()
Kashyap Desai <[email protected]>
RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey
Michael Ellerman <[email protected]>
powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore
Miquel Raynal <[email protected]>
mtd: rawnand: atmel: Fix possible memory leak
Yuan Can <[email protected]>
cpufreq: loongson2: Unregister platform_driver on failure
Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices
Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device
Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_bxtwc: Use dev_err_probe()
Marcus Folkesson <[email protected]>
mfd: da9052-spi: Change read-mask to write-mask
Jinjie Ruan <[email protected]>
mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race
Christophe Leroy <[email protected]>
powerpc/vdso: Flag VDSO64 entry points as functions
Levi Yun <[email protected]>
trace/trace_event_perf: remove duplicate samples on the first tracepoint event
Hangbin Liu <[email protected]>
wireguard: selftests: load nf_conntrack if not present
Breno Leitao <[email protected]>
netpoll: Use rcu_access_pointer() in netpoll_poll_lock
Dmitry Antipov <[email protected]>
Bluetooth: fix use-after-free in device_for_each_child()
Andy Shevchenko <[email protected]>
driver core: Introduce device_find_any_child() helper
Takashi Iwai <[email protected]>
ALSA: 6fire: Release resources at card release
Takashi Iwai <[email protected]>
ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
Takashi Iwai <[email protected]>
ALSA: us122l: Use snd_card_free_when_closed() at disconnection
Takashi Iwai <[email protected]>
ALSA: usx2y: Use snd_card_free_when_closed() at disconnection
Takashi Iwai <[email protected]>
ALSA: usx2y: Cleanup probe and disconnect callbacks
Takashi Iwai <[email protected]>
ALSA: usx2y: Coding style fixes
Takashi Iwai <[email protected]>
ALSA: usx2y: Fix spaces
Mingwei Zheng <[email protected]>
net: rfkill: gpio: Add check for clk_enable()
Yuan Can <[email protected]>
drm/amdkfd: Fix wrong usage of INIT_WORK()
Paolo Abeni <[email protected]>
selftests: net: really check for bg process completion
Zijian Zhang <[email protected]>
bpf, sockmap: Fix sk_msg_reset_curr
Zijian Zhang <[email protected]>
bpf, sockmap: Several fixes to bpf_msg_pop_data
Zijian Zhang <[email protected]>
bpf, sockmap: Several fixes to bpf_msg_push_data
Zijian Zhang <[email protected]>
selftests/bpf: Add push/pop checking for msg_verify_data in test_sockmap
Zijian Zhang <[email protected]>
selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap
Liu Jian <[email protected]>
selftests, bpf: Add one test for sockmap with strparser
Zijian Zhang <[email protected]>
selftests/bpf: Fix SENDPAGE data logic in test_sockmap
Zijian Zhang <[email protected]>
selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap
Maurice Lambert <[email protected]>
netlink: typographical error in nlmsg_type constants definition
Zichen Xie <[email protected]>
drm/msm/dpu: cast crtc_clk calculation to u64 in _dpu_core_perf_calc_clk()
Yuan Can <[email protected]>
wifi: wfx: Fix error handling in wfx_core_init()
Lucas Stach <[email protected]>
drm/etnaviv: hold GPU lock across perfmon sampling
Doug Brown <[email protected]>
drm/etnaviv: fix power register offset on GC300
Marc Kleine-Budde <[email protected]>
drm/etnaviv: dump: fix sparse warnings
Xiaolei Wang <[email protected]>
drm/etnaviv: Request pages from DMA32 zone on addressing_limited
Lucas Stach <[email protected]>
drm/etnaviv: rework linear window offset calculation
Jinjie Ruan <[email protected]>
drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq()
Steven Price <[email protected]>
drm/panfrost: Remove unused id_mask from struct panfrost_model
Dipendra Khadka <[email protected]>
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
Christina Jacob <[email protected]>
octeontx2-pf: ethtool fec mode support
Felix Manlunas <[email protected]>
octeontx2-af: Add new CGX_CMD to get PHY FEC statistics
Christina Jacob <[email protected]>
octeontx2-af: forward error correction configuration
Subbaraya Sundeep <[email protected]>
octeontx2-pf: Calculate LBK link instead of hardcoding
Subbaraya Sundeep <[email protected]>
octeontx2-af: Mbox changes for 98xx
Matthias Schiffer <[email protected]>
drm: fsl-dcu: enable PIXCLK on LS1021A
Thomas Zimmermann <[email protected]>
drm/fsl-dcu: Convert to Linux IRQ interfaces
Alper Nebi Yasak <[email protected]>
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
Zijian Zhang <[email protected]>
selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap
Zijian Zhang <[email protected]>
selftests/bpf: Fix msg_verify_data in test_sockmap
Tomi Valkeinen <[email protected]>
drm/bridge: tc358767: Fix link properties discovery
Hangbin Liu <[email protected]>
netdevsim: copy addresses for both in and out paths
Leon Romanovsky <[email protected]>
netdevsim: rely on XFRM state direction instead of flags
Leon Romanovsky <[email protected]>
xfrm: store and rely on direction to construct offload flags
Leon Romanovsky <[email protected]>
xfrm: rename xfrm_state_offload struct to allow reuse
Yuan Chen <[email protected]>
bpf: Fix the xdp_adjust_tail sample prog issue
Macpaul Lin <[email protected]>
ASoC: dt-bindings: mt6359: Update generic node name and dmic-mode
Shengjiu Wang <[email protected]>
ASoC: fsl_micfil: fix regmap_write_bits usage
Sascha Hauer <[email protected]>
ASoC: fsl_micfil: use GENMASK to define register bit fields
Sascha Hauer <[email protected]>
ASoC: fsl_micfil: do not define SHIFT/MASK for single bits
Sascha Hauer <[email protected]>
ASoC: fsl_micfil: Drop unnecessary register read
Igor Prusov <[email protected]>
dt-bindings: vendor-prefixes: Add NeoFidelity, Inc
Baochen Qiang <[email protected]>
wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss2
Baochen Qiang <[email protected]>
wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss1
Maíra Canal <[email protected]>
drm/v3d: Address race-condition in MMU flush
Jinjie Ruan <[email protected]>
drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq()
Jinjie Ruan <[email protected]>
drm/imx/dcss: Use IRQF_NO_AUTOEN flag in request_irq()
Jinjie Ruan <[email protected]>
wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq()
Jinjie Ruan <[email protected]>
wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq()
Tomi Valkeinen <[email protected]>
drm/omap: Fix locking in omap_gem_new_dmabuf()
Jeongjun Park <[email protected]>
wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
Andy Shevchenko <[email protected]>
drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused
Li Huafei <[email protected]>
media: atomisp: Add check for rgby_data memory allocation failure
Mauro Carvalho Chehab <[email protected]>
media: atomisp: remove #ifdef HAS_NO_HMEM
Luo Qiu <[email protected]>
firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
Reinette Chatre <[email protected]>
selftests/resctrl: Protect against array overrun during iMC config parsing
Andy Shevchenko <[email protected]>
regmap: irq: Set lockdep class for hierarchical IRQ domains
Zhang Zekun <[email protected]>
pmdomain: ti-sci: Add missing of_node_put() for args.np
Andre Przywara <[email protected]>
ARM: dts: cubieboard4: Fix DCDC5 regulator constraints
Clark Wang <[email protected]>
pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle
Chen Ridong <[email protected]>
cgroup/bpf: only cgroup v2 can be attached by bpf programs
Chen Ridong <[email protected]>
Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline"
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source trackpad
Hsin-Te Yuan <[email protected]>
arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4
Gregory Price <[email protected]>
tpm: fix signed/unsigned bug when checking event logs
Bartosz Golaszewski <[email protected]>
mmc: mmc_spi: drop buggy snprintf()
Dan Carpenter <[email protected]>
soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
Jinjie Ruan <[email protected]>
soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq()
Jinjie Ruan <[email protected]>
spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq()
Alexander Stein <[email protected]>
spi: spi-fsl-lpspi: downgrade log level for pio mode
Mark Brown <[email protected]>
clocksource/drivers:sp804: Make user selectable
Arnd Bergmann <[email protected]>
clkdev: remove CONFIG_CLKDEV_LOOKUP
Marco Elver <[email protected]>
kcsan, seqlock: Fix incorrect assumption in read_seqbegin()
Miguel Ojeda <[email protected]>
time: Fix references to _msecs_to_jiffies() handling of values
Christophe JAILLET <[email protected]>
crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()
Chen Ridong <[email protected]>
crypto: bcm - add error check in the ahash_hmac_init function
Chen Ridong <[email protected]>
crypto: caam - add error check to caam_rsa_set_priv_key_form
Everest K.C <[email protected]>
crypto: cavium - Fix the if condition to exit loop after timeout
Yi Yang <[email protected]>
crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
Priyanka Singh <[email protected]>
EDAC/fsl_ddr: Fix bad bit shift operations
David Thompson <[email protected]>
EDAC/bluefield: Fix potential integer overflow
Yuan Can <[email protected]>
firmware: google: Unregister driver_info on failure
Christophe JAILLET <[email protected]>
crypto: caam - Fix the pointer passed to caam_qi_shutdown()
Thadeu Lima de Souza Cascardo <[email protected]>
hfsplus: don't query the device logical block size multiple times
Masahiro Yamada <[email protected]>
s390/syscalls: Avoid creation of arch/arch/ directory
Aleksandr Mishin <[email protected]>
acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block()
Masahiro Yamada <[email protected]>
arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG
Daniel Palmer <[email protected]>
m68k: mvme147: Reinstate early console
Geert Uytterhoeven <[email protected]>
m68k: mvme16x: Add and use "mvme16x.h"
Daniel Palmer <[email protected]>
m68k: mvme147: Fix SCSI controller IRQ numbers
Christoph Hellwig <[email protected]>
nvme-pci: fix freeing of the HMB descriptor table
David Disseldorp <[email protected]>
initramfs: avoid filename buffer overrun
Jonas Gorski <[email protected]>
mips: asm: fix warning when disabling MIPS_FP_SUPPORT
Josh Poimboeuf <[email protected]>
x86/xen/pvh: Annotate indirect branch as safe
Andre Przywara <[email protected]>
kselftest/arm64: mte: fix printf type warnings about longs
Borislav Petkov (AMD) <[email protected]>
x86/barrier: Do not serialize MSR accesses on AMD
Puranjay Mohan <[email protected]>
nvme: fix metadata handling in nvme-passthrough
Pali Rohár <[email protected]>
cifs: Fix buffer overflow when parsing NFS reparse points
Ard Biesheuvel <[email protected]>
x86/stackprotector: Work around strict Clang TLS symbol requirements
Paul E. McKenney <[email protected]>
rcu-tasks: Idle tasks on offline CPUs are in quiescent states
Breno Leitao <[email protected]>
ipmr: Fix access to mfc_cache_list without lock held
Eryk Zagorski <[email protected]>
ALSA: usb-audio: Fix Yamaha P-125 Quirk Entry
David Wang <[email protected]>
proc/softirqs: replace seq_printf with seq_put_decimal_ull_width
Luo Yifan <[email protected]>
ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div()
Luo Yifan <[email protected]>
ASoC: stm: Prevent potential division by zero in stm32_sai_mclk_round_rate()
Alexander Hölzl <[email protected]>
can: j1939: fix error in J1939 documentation.
Mikhail Rudenko <[email protected]>
regulator: rk808: Add apply_bit for BUCK3 on RK809
Charles Han <[email protected]>
soc: qcom: Add check devm_kasprintf() returned value
Benoît Monin <[email protected]>
net: usb: qmi_wwan: add Quectel RG650V
Arnd Bergmann <[email protected]>
x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB
Piyush Raj Chouhan <[email protected]>
ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13
Li Zhijian <[email protected]>
selftests/watchdog-test: Fix system accidentally reset after watchdog-test
Ben Greear <[email protected]>
mac80211: fix user-power when emulating chanctx
Hans de Goede <[email protected]>
ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet
Lorenzo Stoakes <[email protected]>
mm: resolve faulty mmap_region() error path behaviour
Lorenzo Stoakes <[email protected]>
mm: refactor arch_calc_vm_flag_bits() and arm64 MTE handling
Lorenzo Stoakes <[email protected]>
mm: unconditionally close VMAs on error
Lorenzo Stoakes <[email protected]>
mm: avoid unsafe VMA hook invocation when error arises on mmap hook
Andrew Morton <[email protected]>
mm: revert "mm: shmem: fix data-race in shmem_getattr()"
Chuck Lever <[email protected]>
NFSD: Never decrement pending_async_copies on error
Chuck Lever <[email protected]>
NFSD: Initialize struct nfsd4_copy earlier
Chuck Lever <[email protected]>
NFSD: Limit the number of concurrent async COPY operations
Chuck Lever <[email protected]>
NFSD: Async COPY result needs to return a write verifier
Dai Ngo <[email protected]>
NFSD: initialize copy->cp_clp early in nfsd4_copy for use by trace point
Mauro Carvalho Chehab <[email protected]>
media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
Yang Yingliang <[email protected]>
mmc: core: fix return value check in devm_mmc_alloc_host()
Francesco Dolcini <[email protected]>
drm/bridge: tc358768: Fix DSI command tx
Aurelien Jarno <[email protected]>
Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"
Ryusuke Konishi <[email protected]>
nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
Dmitry Antipov <[email protected]>
ocfs2: fix UBSAN warning in ocfs2_verify_volume()
Ryusuke Konishi <[email protected]>
nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
Sean Christopherson <[email protected]>
KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN
Si-Wei Liu <[email protected]>
vdpa/mlx5: Fix PA offset with unaligned starting iotlb map
Dmitry Antipov <[email protected]>
ocfs2: uncache inode which has failed entering the group
Baoquan He <[email protected]>
x86/mm: Fix a kdump kernel failure on SME system when CONFIG_IMA_KEXEC=y
Dragos Tatulea <[email protected]>
net/mlx5e: kTLS, Fix incorrect page refcounting
Mark Bloch <[email protected]>
net/mlx5: fs, lock FTE when checking if active
Jakub Kicinski <[email protected]>
netlink: terminate outstanding dump on socket close
Gabor Juhos <[email protected]>
clk: qcom: gcc-qcs404: fix initial rate of GPLL3
Michal Vokáč <[email protected]>
leds: lp55xx: Remove redundant test for invalid channel number
guoweikang <[email protected]>
ftrace: Fix regression with module command in stack_trace_filter
Vasiliy Kovalev <[email protected]>
ovl: Filter invalid inodes with missing lookup function
Ricardo Ribalda <[email protected]>
media: uvcvideo: Stop stream during unregister
Gaosheng Cui <[email protected]>
media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
Jinjie Ruan <[email protected]>
media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate()
Jinjie Ruan <[email protected]>
media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled
Li Zetao <[email protected]>
media: ts2020: fix null-ptr-deref in ts2020_probe()
Alexander Shiyan <[email protected]>
media: i2c: tc358743: Fix crash in the probe error path when using polling
Dragan Simic <[email protected]>
arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer
-------------
Diffstat:
Documentation/ABI/testing/sysfs-bus-pci | 11 + .../devicetree/bindings/clock/adi,axi-clkgen.yaml | 67 + .../devicetree/bindings/clock/axi-clkgen.txt | 25 - .../devicetree/bindings/serial/rs485.yaml | 19 +- .../devicetree/bindings/sound/mt6359.yaml | 10 +- .../devicetree/bindings/vendor-prefixes.yaml | 2 + Documentation/filesystems/mount_api.rst | 3 +- Documentation/networking/j1939.rst | 2 +- Makefile | 4 +- arch/arm/Kconfig | 2 - arch/arm/boot/dts/sun9i-a80-cubieboard4.dts | 4 +- .../boot/dts/allwinner/sun50i-a64-pinephone.dtsi | 3 + arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi | 8 + .../boot/dts/mediatek/mt8183-kukui-krane.dtsi | 4 +- arch/arm64/include/asm/mman.h | 10 +- arch/arm64/kernel/process.c | 2 +- arch/arm64/kernel/ptrace.c | 6 +- arch/arm64/kernel/vmlinux.lds.S | 6 +- arch/arm64/kvm/pmu-emul.c | 1 - arch/arm64/kvm/vgic/vgic-its.c | 32 +- arch/arm64/kvm/vgic/vgic.h | 24 + arch/m68k/coldfire/device.c | 8 +- arch/m68k/include/asm/mcfgpio.h | 2 +- arch/m68k/include/asm/mvme147hw.h | 4 +- arch/m68k/kernel/early_printk.c | 9 +- arch/m68k/mvme147/config.c | 30 + arch/m68k/mvme147/mvme147.h | 6 + arch/m68k/mvme16x/config.c | 2 + arch/m68k/mvme16x/mvme16x.h | 6 + arch/mips/Kconfig | 3 - arch/mips/boot/dts/loongson/ls7a-pch.dtsi | 73 +- arch/mips/include/asm/switch_to.h | 2 +- arch/mips/pic32/Kconfig | 1 - arch/powerpc/include/asm/dtl.h | 4 +- arch/powerpc/include/asm/sstep.h | 5 - arch/powerpc/include/asm/vdso.h | 1 + arch/powerpc/kernel/prom_init.c | 29 +- arch/powerpc/kexec/file_load_64.c | 9 +- arch/powerpc/lib/sstep.c | 12 +- arch/powerpc/platforms/pseries/dtl.c | 8 +- arch/powerpc/platforms/pseries/lpar.c | 8 +- arch/s390/kernel/perf_cpum_sf.c | 4 +- arch/s390/kernel/syscalls/Makefile | 2 +- arch/sh/Kconfig | 1 - arch/sh/kernel/cpu/proc.c | 2 +- arch/um/drivers/net_kern.c | 2 +- arch/um/drivers/ubd_kern.c | 2 +- arch/um/drivers/vector_kern.c | 3 +- arch/um/kernel/physmem.c | 6 +- arch/um/kernel/process.c | 2 +- arch/um/kernel/sysrq.c | 2 +- arch/x86/Makefile | 3 +- arch/x86/crypto/aegis128-aesni-asm.S | 29 +- arch/x86/entry/entry.S | 15 + arch/x86/events/intel/pt.c | 11 +- arch/x86/events/intel/pt.h | 2 + arch/x86/include/asm/amd_nb.h | 5 +- arch/x86/include/asm/asm-prototypes.h | 3 + arch/x86/include/asm/barrier.h | 18 - arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/processor.h | 18 + arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kernel/cpu/common.c | 9 + arch/x86/kernel/cpu/hygon.c | 3 + arch/x86/kernel/vmlinux.lds.S | 3 + arch/x86/kvm/vmx/vmx.c | 4 +- arch/x86/mm/ioremap.c | 6 +- arch/x86/platform/pvh/head.S | 2 + block/blk-mq.c | 6 + block/blk-mq.h | 13 + crypto/pcrypt.c | 12 +- drivers/acpi/arm64/gtdt.c | 2 +- drivers/base/bus.c | 2 + drivers/base/core.c | 20 + drivers/base/regmap/regmap-irq.c | 4 + drivers/base/regmap/regmap.c | 12 + drivers/bluetooth/btusb.c | 2 + drivers/clk/Kconfig | 6 +- drivers/clk/Makefile | 3 +- drivers/clk/clk-axi-clkgen.c | 26 +- drivers/clk/qcom/gcc-qcs404.c | 1 + drivers/clocksource/Kconfig | 9 +- drivers/cpufreq/loongson2_cpufreq.c | 4 +- drivers/crypto/bcm/cipher.c | 5 +- drivers/crypto/caam/caampkc.c | 11 +- drivers/crypto/caam/qi.c | 2 +- drivers/crypto/cavium/cpt/cptpf_main.c | 6 +- drivers/dma-buf/dma-fence-array.c | 28 +- drivers/edac/bluefield_edac.c | 2 +- drivers/edac/fsl_ddr_edac.c | 22 +- drivers/firmware/arm_scpi.c | 3 + drivers/firmware/efi/tpm.c | 17 +- drivers/firmware/google/gsmi.c | 6 +- drivers/gpio/gpio-grgpio.c | 26 +- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 5 +- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 5 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 14 + drivers/gpu/drm/bridge/tc358767.c | 7 + drivers/gpu/drm/bridge/tc358768.c | 21 +- drivers/gpu/drm/drm_mm.c | 2 +- drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 + drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 3 +- drivers/gpu/drm/etnaviv/etnaviv_drv.c | 10 + drivers/gpu/drm/etnaviv/etnaviv_dump.c | 13 +- drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 100 +- drivers/gpu/drm/etnaviv/etnaviv_gpu.h | 21 + drivers/gpu/drm/fsl-dcu/Kconfig | 1 + drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 143 +- drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h | 3 + drivers/gpu/drm/imx/dcss/dcss-crtc.c | 6 +- drivers/gpu/drm/imx/ipuv3-crtc.c | 6 +- drivers/gpu/drm/mcde/mcde_drv.c | 1 + drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 4 +- drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 2 +- drivers/gpu/drm/omapdrm/omap_gem.c | 10 +- drivers/gpu/drm/panfrost/panfrost_gpu.c | 1 - drivers/gpu/drm/radeon/r600_cs.c | 2 +- drivers/gpu/drm/sti/sti_mixer.c | 2 +- drivers/gpu/drm/v3d/v3d_mmu.c | 29 +- drivers/gpu/drm/vc4/vc4_hvs.c | 11 + drivers/hid/wacom_sys.c | 3 +- drivers/hid/wacom_wac.c | 4 +- drivers/i3c/master.c | 88 +- drivers/iio/adc/ad7780.c | 2 +- drivers/iio/light/al3010.c | 11 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 +- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 7 +- drivers/iommu/arm/arm-smmu/arm-smmu.c | 11 + drivers/leds/led-class.c | 14 +- drivers/leds/leds-lp55xx-common.c | 3 - drivers/md/bcache/super.c | 2 +- drivers/md/dm-thin.c | 1 + drivers/media/dvb-core/dvbdev.c | 15 +- drivers/media/dvb-frontends/ts2020.c | 8 +- drivers/media/i2c/adv7604.c | 5 +- drivers/media/i2c/adv7842.c | 13 +- drivers/media/i2c/tc358743.c | 4 +- drivers/media/platform/qcom/venus/core.c | 2 +- drivers/media/radio/wl128x/fmdrv_common.c | 3 +- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 15 +- drivers/media/usb/cx231xx/cx231xx-cards.c | 2 + drivers/media/usb/gspca/ov534.c | 2 +- drivers/media/usb/uvc/uvc_driver.c | 106 +- drivers/media/v4l2-core/v4l2-dv-timings.c | 132 +- drivers/message/fusion/mptsas.c | 4 +- drivers/mfd/da9052-spi.c | 2 +- drivers/mfd/intel_soc_pmic_bxtwc.c | 208 +- drivers/mfd/rt5033.c | 4 +- drivers/mfd/tps65010.c | 8 +- drivers/misc/apds990x.c | 12 +- drivers/misc/eeprom/eeprom_93cx6.c | 10 + drivers/mmc/core/bus.c | 2 + drivers/mmc/core/core.c | 3 + drivers/mmc/core/host.c | 6 +- drivers/mmc/host/Kconfig | 4 +- drivers/mmc/host/dw_mmc.c | 4 +- drivers/mmc/host/mmc_spi.c | 9 +- drivers/mmc/host/sdhci-pci-core.c | 72 + drivers/mmc/host/sdhci-pci.h | 1 + drivers/mtd/nand/raw/atmel/pmecc.c | 8 +- drivers/mtd/nand/raw/atmel/pmecc.h | 2 - drivers/mtd/ubi/attach.c | 12 +- drivers/mtd/ubi/wl.c | 9 +- drivers/net/can/sun4i_can.c | 22 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 +- drivers/net/ethernet/broadcom/tg3.c | 3 + drivers/net/ethernet/freescale/fec_mpc52xx_phy.c | 2 +- .../net/ethernet/freescale/fs_enet/mii-bitbang.c | 2 +- drivers/net/ethernet/intel/igb/igb_main.c | 4 + drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 88 + drivers/net/ethernet/marvell/octeontx2/af/cgx.h | 8 + .../net/ethernet/marvell/octeontx2/af/cgx_fw_if.h | 22 +- drivers/net/ethernet/marvell/octeontx2/af/mbox.h | 86 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 85 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 4 + .../net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 65 + .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 4 + .../net/ethernet/marvell/octeontx2/af/rvu_reg.c | 2 +- .../net/ethernet/marvell/octeontx2/af/rvu_struct.h | 2 + .../ethernet/marvell/octeontx2/nic/otx2_common.c | 28 +- .../ethernet/marvell/octeontx2/nic/otx2_common.h | 8 + .../ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 170 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 3 + drivers/net/ethernet/marvell/pxa168_eth.c | 14 +- .../ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c | 8 +- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 19 +- drivers/net/ethernet/qlogic/qed/qed_mcp.c | 4 +- drivers/net/ethernet/realtek/r8169_main.c | 14 +- drivers/net/ethernet/rocker/rocker_main.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 2 + drivers/net/geneve.c | 2 +- drivers/net/netdevsim/ipsec.c | 11 +- drivers/net/usb/lan78xx.c | 11 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wireless/ath/ath10k/mac.c | 4 +- drivers/net/wireless/ath/ath5k/pci.c | 2 + drivers/net/wireless/ath/ath9k/htc_hst.c | 3 + .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 2 +- drivers/net/wireless/intel/ipw2x00/libipw_rx.c | 8 +- drivers/net/wireless/intersil/p54/p54spi.c | 4 +- drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- drivers/net/wireless/marvell/mwifiex/main.c | 4 +- drivers/nvdimm/dax_devs.c | 4 +- drivers/nvdimm/nd.h | 7 + drivers/nvme/host/core.c | 7 +- drivers/nvme/host/pci.c | 16 +- drivers/pci/controller/dwc/pci-keystone.c | 11 + drivers/pci/controller/pcie-rockchip-ep.c | 18 +- drivers/pci/controller/pcie-rockchip.h | 4 + drivers/pci/hotplug/cpqphp_pci.c | 19 +- drivers/pci/pci-sysfs.c | 26 + drivers/pci/pci.c | 2 +- drivers/pci/pci.h | 1 + drivers/pci/quirks.c | 15 +- drivers/pci/slot.c | 4 +- drivers/pinctrl/freescale/Kconfig | 2 +- drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 2 + drivers/platform/chrome/cros_ec_typec.c | 1 + drivers/platform/x86/intel_bxtwc_tmu.c | 22 +- drivers/power/supply/bq27xxx_battery.c | 72 +- drivers/power/supply/power_supply_core.c | 2 - drivers/ptp/ptp_clock.c | 3 +- drivers/pwm/pwm-imx27.c | 98 +- drivers/regulator/rk808-regulator.c | 2 + drivers/remoteproc/qcom_q6v5_mss.c | 3 + drivers/rpmsg/qcom_glink_native.c | 175 +- drivers/rtc/interface.c | 7 +- drivers/rtc/rtc-ab-eoz9.c | 7 - drivers/rtc/rtc-abx80x.c | 2 +- drivers/rtc/rtc-st-lpc.c | 5 +- drivers/scsi/bfa/bfad.c | 3 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 1 + drivers/scsi/qedf/qedf_main.c | 1 + drivers/scsi/qedi/qedi_main.c | 1 + drivers/scsi/qla2xxx/qla_attr.c | 1 + drivers/scsi/qla2xxx/qla_bsg.c | 10 - drivers/scsi/qla2xxx/qla_mid.c | 1 + drivers/scsi/qla2xxx/qla_os.c | 15 +- drivers/scsi/scsi_lib.c | 21 +- drivers/scsi/sd.c | 7 + drivers/scsi/st.c | 31 +- drivers/scsi/ufs/ufs-exynos.c | 16 +- drivers/sh/intc/core.c | 2 +- drivers/soc/qcom/qcom-geni-se.c | 3 +- drivers/soc/qcom/socinfo.c | 8 +- drivers/soc/ti/smartreflex.c | 4 +- drivers/soc/ti/ti_sci_pm_domains.c | 4 + drivers/spi/atmel-quadspi.c | 2 +- drivers/spi/spi-fsl-lpspi.c | 14 +- drivers/spi/spi-mpc52xx.c | 1 + drivers/spi/spi.c | 13 +- drivers/staging/board/Kconfig | 2 +- drivers/staging/comedi/comedi_fops.c | 12 + drivers/staging/greybus/uart.c | 3 - drivers/staging/media/allegro-dvt/allegro-core.c | 4 +- .../pci/isp/kernels/bh/bh_2/ia_css_bh.host.c | 2 - .../raw_aa_binning_1.0/ia_css_raa.host.c | 2 - .../pci/isp/kernels/s3a/s3a_1.0/ia_css_s3a.host.c | 5 - .../media/atomisp/pci/runtime/binary/src/binary.c | 4 - drivers/staging/media/atomisp/pci/sh_css_params.c | 12 +- drivers/staging/wfx/main.c | 17 +- drivers/tty/serial/8250/8250_omap.c | 4 +- drivers/tty/tty_ldisc.c | 2 +- drivers/usb/chipidea/udc.c | 2 +- drivers/usb/dwc3/gadget.c | 15 +- drivers/usb/gadget/composite.c | 18 +- drivers/usb/host/ehci-spear.c | 7 +- drivers/usb/host/xhci-dbgcap.c | 135 +- drivers/usb/host/xhci-dbgcap.h | 2 +- drivers/usb/misc/chaoskey.c | 35 +- drivers/usb/misc/iowarrior.c | 50 +- drivers/usb/misc/yurex.c | 5 +- drivers/usb/typec/tcpm/wcove.c | 4 - drivers/vdpa/mlx5/core/mr.c | 12 +- drivers/vfio/pci/vfio_pci_config.c | 16 +- drivers/video/fbdev/sh7760fb.c | 11 +- drivers/watchdog/iTCO_wdt.c | 21 +- drivers/watchdog/mtk_wdt.c | 6 + drivers/watchdog/rti_wdt.c | 3 +- drivers/xen/xenbus/xenbus_probe.c | 8 +- fs/btrfs/extent-tree.c | 1 - fs/btrfs/inode.c | 1 + fs/btrfs/ref-verify.c | 1 + fs/btrfs/volumes.c | 38 +- fs/cifs/smb2ops.c | 6 + fs/exfat/namei.c | 1 + fs/ext4/fsmap.c | 54 +- fs/ext4/mballoc.c | 18 +- fs/ext4/mballoc.h | 1 + fs/ext4/super.c | 8 +- fs/f2fs/f2fs.h | 2 +- fs/f2fs/file.c | 2 +- fs/f2fs/inode.c | 4 +- fs/f2fs/segment.c | 92 +- fs/f2fs/segment.h | 6 - fs/hfsplus/hfsplus_fs.h | 3 +- fs/hfsplus/wrapper.c | 2 + fs/jffs2/compr_rtime.c | 3 + fs/jffs2/erase.c | 7 +- fs/jfs/jfs_dmap.c | 6 + fs/jfs/jfs_dtree.c | 15 + fs/jfs/xattr.c | 2 +- fs/nfs/internal.h | 2 +- fs/nfs/nfs4proc.c | 8 +- fs/nfsd/export.c | 5 +- fs/nfsd/netns.h | 1 + fs/nfsd/nfs4callback.c | 16 +- fs/nfsd/nfs4proc.c | 43 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4state.c | 20 + fs/nfsd/xdr4.h | 1 + fs/nilfs2/btnode.c | 2 - fs/nilfs2/dir.c | 2 +- fs/nilfs2/gcinode.c | 4 +- fs/nilfs2/mdt.c | 1 - fs/nilfs2/page.c | 2 +- fs/notify/fsnotify.c | 23 +- fs/ocfs2/aops.h | 2 + fs/ocfs2/dlmglue.c | 1 + fs/ocfs2/file.c | 4 + fs/ocfs2/localalloc.c | 19 - fs/ocfs2/namei.c | 4 +- fs/ocfs2/resize.c | 2 + fs/ocfs2/super.c | 13 +- fs/overlayfs/util.c | 3 + fs/proc/softirqs.c | 2 +- fs/quota/dquot.c | 2 + fs/ubifs/super.c | 6 +- fs/ubifs/tnc_commit.c | 2 + fs/unicode/mkutf8data.c | 70 + fs/unicode/utf8data.h_shipped | 6703 ++++++++++---------- include/linux/blkdev.h | 2 +- include/linux/device.h | 2 + include/linux/eeprom_93cx6.h | 11 + include/linux/i3c/master.h | 9 +- include/linux/jiffies.h | 2 +- include/linux/leds.h | 2 +- include/linux/lockdep.h | 2 +- include/linux/mman.h | 7 +- include/linux/netdev_features.h | 4 +- include/linux/netpoll.h | 2 +- include/linux/seqlock.h | 12 +- include/linux/sunrpc/clnt.h | 3 +- include/linux/sunrpc/xprtsock.h | 1 + include/linux/util_macros.h | 56 +- include/media/v4l2-dv-timings.h | 18 +- include/net/xfrm.h | 16 +- include/uapi/linux/rtnetlink.h | 2 +- init/initramfs.c | 15 + kernel/bpf/devmap.c | 6 +- kernel/bpf/lpm_trie.c | 27 +- kernel/cgroup/cgroup.c | 21 +- kernel/dma/debug.c | 8 +- kernel/kcsan/debugfs.c | 74 +- kernel/rcu/tasks.h | 2 +- kernel/sched/core.c | 6 +- kernel/sched/fair.c | 113 +- kernel/sched/idle.c | 6 + kernel/sched/sched.h | 15 +- kernel/time/time.c | 2 +- kernel/trace/ftrace.c | 3 + kernel/trace/trace_clock.c | 2 +- kernel/trace/trace_event_perf.c | 6 + kernel/trace/tracing_map.c | 6 +- lib/string_helpers.c | 2 +- mm/internal.h | 19 + mm/mmap.c | 82 +- mm/nommu.c | 9 +- mm/shmem.c | 5 - mm/util.c | 33 + net/9p/trans_xen.c | 9 +- net/bluetooth/hci_sysfs.c | 15 +- net/bluetooth/l2cap_sock.c | 1 + net/bluetooth/rfcomm/sock.c | 10 +- net/can/af_can.c | 1 + net/can/j1939/transport.c | 2 +- net/core/filter.c | 88 +- net/core/neighbour.c | 1 + net/core/netpoll.c | 2 +- net/dccp/feat.c | 6 +- net/ethtool/bitset.c | 48 +- net/ethtool/common.c | 1 + net/hsr/hsr_device.c | 4 +- net/hsr/hsr_forward.c | 2 + net/ieee802154/socket.c | 12 +- net/ipv4/af_inet.c | 22 +- net/ipv4/ipmr.c | 50 +- net/ipv4/ipmr_base.c | 3 +- net/ipv4/tcp_bpf.c | 11 +- net/ipv6/af_inet6.c | 22 +- net/ipv6/ip6mr.c | 8 +- net/ipv6/route.c | 6 +- net/mac80211/main.c | 2 + net/netfilter/ipset/ip_set_bitmap_ip.c | 7 +- net/netfilter/ipset/ip_set_core.c | 5 + net/netfilter/ipvs/ip_vs_proto.c | 4 +- net/netfilter/nft_set_hash.c | 16 + net/netfilter/xt_LED.c | 4 +- net/netlink/af_netlink.c | 31 +- net/netlink/af_netlink.h | 2 - net/packet/af_packet.c | 12 +- net/rfkill/rfkill-gpio.c | 8 +- net/sched/cls_flower.c | 5 +- net/sched/sch_cbs.c | 2 +- net/sched/sch_tbf.c | 18 +- net/sunrpc/auth_gss/gss_rpc_upcall.c | 2 +- net/sunrpc/cache.c | 4 +- net/sunrpc/clnt.c | 53 +- net/sunrpc/debugfs.c | 2 +- net/sunrpc/rpc_pipe.c | 2 +- net/sunrpc/xprtsock.c | 29 +- net/tipc/udp_media.c | 2 +- net/xfrm/xfrm_device.c | 10 +- net/xfrm/xfrm_state.c | 4 +- net/xfrm/xfrm_user.c | 5 +- samples/bpf/test_cgrp2_sock.c | 4 +- samples/bpf/xdp_adjust_tail_kern.c | 1 + scripts/mod/file2alias.c | 5 +- scripts/mod/modpost.c | 2 +- security/apparmor/capability.c | 2 + security/apparmor/policy_unpack_test.c | 6 + sound/pci/hda/patch_realtek.c | 166 +- sound/soc/codecs/da7219.c | 9 +- sound/soc/codecs/hdmi-codec.c | 144 +- sound/soc/dwc/Kconfig | 2 +- sound/soc/fsl/fsl_micfil.c | 74 +- sound/soc/fsl/fsl_micfil.h | 270 +- sound/soc/intel/boards/bytcr_rt5640.c | 15 + sound/soc/rockchip/Kconfig | 14 +- sound/soc/stm/stm32_sai_sub.c | 6 +- sound/usb/6fire/chip.c | 10 +- sound/usb/caiaq/audio.c | 10 +- sound/usb/caiaq/audio.h | 1 + sound/usb/caiaq/device.c | 19 +- sound/usb/caiaq/input.c | 12 +- sound/usb/caiaq/input.h | 1 + sound/usb/clock.c | 32 +- sound/usb/mixer_maps.c | 10 + sound/usb/quirks-table.h | 14 +- sound/usb/quirks.c | 19 +- sound/usb/usx2y/us122l.c | 66 +- sound/usb/usx2y/us122l.h | 2 +- sound/usb/usx2y/usX2Yhwdep.c | 84 +- sound/usb/usx2y/usX2Yhwdep.h | 2 +- sound/usb/usx2y/usb_stream.c | 75 +- sound/usb/usx2y/usb_stream.h | 23 +- sound/usb/usx2y/usbus428ctldefs.h | 18 +- sound/usb/usx2y/usbusx2y.c | 227 +- sound/usb/usx2y/usbusx2y.h | 8 +- sound/usb/usx2y/usbusx2yaudio.c | 344 +- sound/usb/usx2y/usx2yhwdeppcm.c | 305 +- tools/perf/builtin-trace.c | 16 +- tools/perf/util/cs-etm.c | 25 +- tools/perf/util/probe-finder.c | 21 +- tools/perf/util/probe-finder.h | 4 +- .../selftests/arm64/mte/check_tags_inclusion.c | 4 +- tools/testing/selftests/arm64/pauth/pac.c | 3 + tools/testing/selftests/bpf/test_sockmap.c | 194 +- tools/testing/selftests/net/pmtu.sh | 2 +- tools/testing/selftests/resctrl/resctrl_val.c | 3 +- tools/testing/selftests/vDSO/parse_vdso.c | 3 +- tools/testing/selftests/watchdog/watchdog-test.c | 6 + tools/testing/selftests/wireguard/netns.sh | 1 + 466 files changed, 8576 insertions(+), 6114 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/459 arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragan Simic <[email protected]>
commit 2496b2aaacf137250f4ca449f465e2cadaabb0e8 upstream.
The way InvenSense MPU-6050 accelerometer is mounted on the user-facing side of the Pine64 PinePhone mainboard, which makes it rotated 90 degrees counter- clockwise, [1] requires the accelerometer's x- and y-axis to be swapped, and the direction of the accelerometer's y-axis to be inverted.
Rectify this by adding a mount-matrix to the accelerometer definition in the Pine64 PinePhone dtsi file.
--- arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi +3 -0
@@ -157,6 +157,9 @@ interrupts = <7 5 IRQ_TYPE_EDGE_RISING>; /* PH5 */ vdd-supply = <®_dldo1>; vddio-supply = <®_dldo1>; + mount-matrix = "0", "1", "0", + "-1", "0", "0", + "0", "0", "1"; }; };
Greg Kroah-Hartman
maintainerPATCH 2/459 media: i2c: tc358743: Fix crash in the probe error path when using polling
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shiyan <[email protected]>
commit 869f38ae07f7df829da4951c3d1f7a2be09c2e9a upstream.
If an error occurs in the probe() function, we should remove the polling timer that was alarmed earlier, otherwise the timer is called with arguments that are already freed, which results in a crash.
------------[ cut here ]------------ WARNING: CPU: 3 PID: 0 at kernel/time/timer.c:1830 __run_timers+0x244/0x268 Modules linked in: CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.11.0 #226 Hardware name: Diasom DS-RK3568-SOM-EVB (DT) pstate: 804000c9 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __run_timers+0x244/0x268 lr : __run_timers+0x1d4/0x268
sp : ffffff80eff2baf0
x29: ffffff80eff2bb50 x28: 7fffffffffffffff x27: ffffff80eff2bb00
x26: ffffffc080f669c0 x25: ffffff80efef6bf0 x24: ffffff80eff2bb00
x23: 0000000000000000 x22: dead000000000122 x21: 0000000000000000
x20: ffffff80efef6b80 x19: ffffff80041c8bf8 x18: ffffffffffffffff
x17: ffffffc06f146000 x16: ffffff80eff27dc0 x15: 000000000000003e
x14: 0000000000000000 x13: 00000000000054da x12: 0000000000000000
x11: 00000000000639c0 x10: 000000000000000c x9 : 0000000000000009 x8 : ffffff80eff2cb40 x7 : ffffff80eff2cb40 x6 : ffffff8002bee480 x5 : ffffffc080cb2220 x4 : ffffffc080cb2150 x3 : 00000000000f4240 x2 : 0000000000000102 x1 : ffffff80eff2bb00 x0 : ffffff80041c8bf0
Call trace: __run_timers+0x244/0x268 timer_expire_remote+0x50/0x68 tmigr_handle_remote+0x388/0x39c run_timer_softirq+0x38/0x44 handle_softirqs+0x138/0x298 __do_softirq+0x14/0x20 ____do_softirq+0x10/0x1c call_on_irq_stack+0x24/0x4c do_softirq_own_stack+0x1c/0x2c irq_exit_rcu+0x9c/0xcc el1_interrupt+0x48/0xc0 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x7c/0x80 default_idle_call+0x34/0x68 do_idle+0x23c/0x294 cpu_startup_entry+0x38/0x3c secondary_start_kernel+0x128/0x160 __secondary_switched+0xb8/0xbc ---[ end trace 0000000000000000 ]---
--- drivers/media/i2c/tc358743.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/i2c/tc358743.c +3 -1
@@ -2176,8 +2176,10 @@ static int tc358743_probe(struct i2c_cli err_work_queues:cec_unregister_adapter (state->cec_adap); -if (!state->i2c_client->irq) +if (!state->i2c_client->irq) { +del_timer (&state->timer);flush_work (&state->work_i2c_poll); + }cancel_delayed_work (&state->delayed_work_enable_hotplug);mutex_destroy (&state->confctl_mutex); err_hdl:
Greg Kroah-Hartman
maintainerPATCH 3/459 media: ts2020: fix null-ptr-deref in ts2020_probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zetao <[email protected]>
commit 4a058b34b52ed3feb1f3ff6fd26aefeeeed20cba upstream.
KASAN reported a null-ptr-deref issue when executing the following command:
# echo ts2020 0x20 > /sys/bus/i2c/devices/i2c-0/new_device
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 53 UID: 0 PID: 970 Comm: systemd-udevd Not tainted 6.12.0-rc2+ #24
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009)
RIP: 0010:ts2020_probe+0xad/0xe10 [ts2020]
RSP: 0018:ffffc9000abbf598 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffffc0714809
RDX: 0000000000000002 RSI: ffff88811550be00 RDI: 0000000000000010
RBP: ffff888109868800 R08: 0000000000000001 R09: fffff52001577eb6
R10: 0000000000000000 R11: ffffc9000abbff50 R12: ffffffffc0714790
R13: 1ffff92001577eb8 R14: ffffffffc07190d0 R15: 0000000000000001
FS: 00007f95f13b98c0(0000) GS:ffff888149280000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555d2634b000 CR3: 0000000152236000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ts2020_probe+0xad/0xe10 [ts2020]
i2c_device_probe+0x421/0xb40
really_probe+0x266/0x850
...The cause of the problem is that when using sysfs to dynamically register an i2c device, there is no platform data, but the probe process of ts2020 needs to use platform data, resulting in a null pointer being accessed.
Solve this problem by adding checks to platform data.
--- drivers/media/dvb-frontends/ts2020.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/media/dvb-frontends/ts2020.c +7 -1
@@ -554,13 +554,19 @@ static int ts2020_probe(struct i2c_clien const struct i2c_device_id *id) {struct ts2020_config *pdata = client->dev.platform_data; -struct dvb_frontend *fe = pdata->fe; +struct dvb_frontend *fe;struct ts2020_priv *dev;int ret;u8 u8tmp;unsigned int utmp;char *chip_str; +if (!pdata) { +dev_err (&client->dev,"platform data is mandatory\n" ); +return -EINVAL ; + } + + fe = pdata->fe; dev =kzalloc (sizeof (*dev),GFP_KERNEL );if (!dev) { ret = -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 4/459 media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit 2a20869f7d798aa2b69e45b863eaf1b1ecf98278 upstream.
It is not valid to call pm_runtime_set_suspended() for devices with runtime PM enabled because it returns -EAGAIN if it is enabled already and working. So, call pm_runtime_disable() before to fix it.
--- drivers/media/platform/qcom/venus/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/qcom/venus/core.c +1 -1
@@ -348,8 +348,8 @@ err_of_depopulate:of_platform_depopulate (dev); err_runtime_disable:pm_runtime_put_noidle (dev); -pm_runtime_set_suspended (dev);pm_runtime_disable (dev); +pm_runtime_set_suspended (dev);hfi_destroy (core); err_core_deinit:hfi_core_deinit (core, false);
Greg Kroah-Hartman
maintainerPATCH 5/459 media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit d2842dec577900031826dc44e9bf0c66416d7173 upstream.
In set_frame_rate(), select a rate in rate_0 or rate_1 by checking sd->frame_rate >= r->fps in a loop, but the loop condition terminates when the index reaches zero, which fails to check the last elememt in rate_0 or rate_1.
Check for >= 0 so that the last one in rate_0 or rate_1 is also checked.
--- drivers/media/usb/gspca/ov534.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/gspca/ov534.c +1 -1
@@ -847,7 +847,7 @@ static void set_frame_rate(struct gspca_ r = rate_1; i =ARRAY_SIZE (rate_1); } -while (--i >0 ) { +while (--i >=0 ) {if (sd->frame_rate >= r->fps)break ; r++;
Greg Kroah-Hartman
maintainerPATCH 6/459 media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaosheng Cui <[email protected]>
commit 0f514068fbc5d4d189c817adc7c4e32cffdc2e47 upstream.
The buffer in the loop should be released under the exception path, otherwise there may be a memory leak here.
To mitigate this, free the buffer when allegro_alloc_buffer fails.
--- drivers/staging/media/allegro-dvt/allegro-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/staging/media/allegro-dvt/allegro-core.c +3 -1
@@ -1208,8 +1208,10 @@ static int allocate_buffers_internal(strINIT_LIST_HEAD (&buffer->head); err =allegro_alloc_buffer (dev, buffer, size); -if (err) +if (err) { +kfree (buffer); goto err; + }list_add (&buffer->head, list); }
Greg Kroah-Hartman
maintainerPATCH 7/459 media: uvcvideo: Stop stream during unregister
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
commit c9ec6f1736363b2b2bb4e266997389740f628441 upstream.
uvc_unregister_video() can be called asynchronously from uvc_disconnect(). If the device is still streaming when that happens, a plethora of race conditions can occur.
Make sure that the device has stopped streaming before exiting this function.
If the user still holds handles to the driver's file descriptors, any ioctl will return -ENODEV from the v4l2 core.
This change makes uvc more consistent with the rest of the v4l2 drivers using the vb2_fop_* and vb2_ioctl_* helpers.
This driver (and many other usb drivers) always had this problem, but it wasn't possible to easily fix this until the vb2_video_unregister_device() helper was added. So the Fixes tag points to the creation of that helper.
--- drivers/media/usb/uvc/uvc_driver.c | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-)
drivers/media/usb/uvc/uvc_driver.c +31 -1
@@ -2038,11 +2038,41 @@ static void uvc_unregister_video(structstruct uvc_streaming *stream;list_for_each_entry (stream, &dev->streams, list) { +/* Nothing to do here, continue. */ if (!video_is_registered (&stream->vdev))continue ; +/* +* For stream->vdev we follow the same logic as: +* vb2_video_unregister_device(). +*/ + +/* 1. Take a reference to vdev */ +get_device (&stream->vdev.dev); + +/* 2. Ensure that no new ioctls can be called. */ video_unregister_device (&stream->vdev); -video_unregister_device (&stream->meta.vdev); + +/* 3. Wait for old ioctls to finish. */ +mutex_lock (&stream->mutex); + +/* 4. Stop streaming. */ +uvc_queue_release (&stream->queue); + +mutex_unlock (&stream->mutex); + +put_device (&stream->vdev.dev); + +/* +* For stream->meta.vdev we can directly call: +* vb2_video_unregister_device(). +*/ +vb2_video_unregister_device (&stream->meta.vdev); + +/* +* Now both vdevs are not streaming and all the ioctls will +* return -ENODEV. +*/ uvc_debugfs_cleanup_stream (stream); }
Greg Kroah-Hartman
maintainerPATCH 8/459 ovl: Filter invalid inodes with missing lookup function
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <[email protected]>
commit c8b359dddb418c60df1a69beea01d1b3322bfe83 upstream.
Add a check to the ovl_dentry_weird() function to prevent the processing of directory inodes that lack the lookup function. This is important because such inodes can cause errors in overlayfs when passed to the lowerstack.
--- fs/overlayfs/util.c | 3 +++ 1 file changed, 3 insertions(+)
fs/overlayfs/util.c +3 -0
@@ -131,6 +131,9 @@ void ovl_dentry_init_flags(struct dentrybool ovl_dentry_weird (struct dentry *dentry) { +if (!d_can_lookup (dentry) && !d_is_file (dentry) && !d_is_symlink (dentry)) +return true; + return dentry->d_flags & (DCACHE_NEED_AUTOMOUNT | DCACHE_MANAGE_TRANSIT | DCACHE_OP_HASH |
Greg Kroah-Hartman
maintainerPATCH 9/459 ftrace: Fix regression with module command in stack_trace_filter
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: guoweikang <[email protected]>
commit 45af52e7d3b8560f21d139b3759735eead8b1653 upstream.
When executing the following command:
# echo "write*:mod:ext3" > /sys/kernel/tracing/stack_trace_filter
The current mod command causes a null pointer dereference. While commit 0f17976568b3f ("ftrace: Fix regression with module command in stack_trace_filter") has addressed part of the issue, it left a corner case unhandled, which still results in a kernel crash.
--- kernel/trace/ftrace.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/trace/ftrace.c +3 -0
@@ -4311,6 +4311,9 @@ ftrace_mod_callback(struct trace_array *char *func;int ret; +if (!tr) +return -ENODEV ; +/* match_records() modifies func, and we need the original */ func =kstrdup (func_orig,GFP_KERNEL );if (!func)
Greg Kroah-Hartman
maintainerPATCH 10/459 leds: lp55xx: Remove redundant test for invalid channel number
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Vokáč <[email protected]>
commit 09b1ef9813a0742674f7efe26104403ca94a1b4a upstream.
Since commit 92a81562e695 ("leds: lp55xx: Add multicolor framework support to lp55xx") there are two subsequent tests if the chan_nr (reg property) is in valid range. One in the lp55xx_init_led() function and one in the lp55xx_parse_common_child() function that was added with the mentioned commit.
There are two issues with that.
First is in the lp55xx_parse_common_child() function where the reg property is tested right after it is read from the device tree. Test for the upper range is not correct though. Valid reg values are 0 to (max_channel - 1) so it should be >=.
Second issue is that in case the parsed value is out of the range the probe just fails and no error message is shown as the code never reaches the second test that prints and error message.
Remove the test form lp55xx_parse_common_child() function completely and keep the one in lp55xx_init_led() function to deal with it.
--- drivers/leds/leds-lp55xx-common.c | 3 --- 1 file changed, 3 deletions(-)
drivers/leds/leds-lp55xx-common.c +0 -3
@@ -578,9 +578,6 @@ static int lp55xx_parse_common_child(strif (ret)return ret; -if (*chan_nr <0 || *chan_nr > cfg->max_channel) -return -EINVAL ; -return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 11/459 clk: qcom: gcc-qcs404: fix initial rate of GPLL3
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
commit 36d202241d234fa4ac50743510d098ad52bd193a upstream.
The comment before the config of the GPLL3 PLL says that the PLL should run at 930 MHz. In contrary to this, calculating the frequency from the current configuration values by using 19.2 MHz as input frequency defined in 'qcs404.dtsi', it gives 921.6 MHz:
$ xo=19200000; l=48; alpha=0x0; alpha_hi=0x0 $ echo "$xo * ($((l)) + $(((alpha_hi << 32 | alpha) >> 8)) / 2^32)" | bc -l 921600000.00000000000000000000
Set 'alpha_hi' in the configuration to a value used in downstream kernels [1][2] in order to get the correct output rate:
$ xo=19200000; l=48; alpha=0x0; alpha_hi=0x70 $ echo "$xo * ($((l)) + $(((alpha_hi << 32 | alpha) >> 8)) / 2^32)" | bc -l 930000000.00000000000000000000
The change is based on static code analysis, compile tested only.
[1] https://git.codelinaro.org/clo/la/kernel/msm-5.4/-/blob/kernel.lnx.5.4.r56-rel/drivers/clk/qcom/gcc-qcs404.c?ref_type=heads#L335
[2} https://git.codelinaro.org/clo/la/kernel/msm-5.15/-/blob/kernel.lnx.5.15.r49-rel/drivers/clk/qcom/gcc-qcs404.c?ref_type=heads#L127
--- drivers/clk/qcom/gcc-qcs404.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/qcom/gcc-qcs404.c +1 -0
@@ -337,6 +337,7 @@ static struct clk_alpha_pll gpll1_out_ma/* 930MHz configuration */ static const struct alpha_pll_config gpll3_config = { .l =48 , + .alpha_hi =0x70 , .alpha =0x0 , .alpha_en_mask =BIT (24 ), .post_div_mask =0xf <<8 ,
Greg Kroah-Hartman
maintainerPATCH 12/459 netlink: terminate outstanding dump on socket close
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 1904fb9ebf911441f90a68e96b22aa73e4410505 ]
Netlink supports iterative dumping of data. It provides the families the following ops:
- start - (optional) kicks off the dumping process
- dump - actual dump helper, keeps getting called until it returns 0
- done - (optional) pairs with .start, can be used for cleanup
The whole process is asynchronous and the repeated calls to .dump don't actually happen in a tight loop, but rather are triggered in response to recvmsg() on the socket.
This gives the user full control over the dump, but also means that the user can close the socket without getting to the end of the dump. To make sure .start is always paired with .done we check if there is an ongoing dump before freeing the socket, and if so call .done.
The complication is that sockets can get freed from BH and .done is allowed to sleep. So we use a workqueue to defer the call, when needed.
Unfortunately this does not work correctly. What we defer is not the cleanup but rather releasing a reference on the socket. We have no guarantee that we own the last reference, if someone else holds the socket they may release it in BH and we're back to square one.
The whole dance, however, appears to be unnecessary. Only the user can interact with dumps, so we can clean up when socket is closed. And close always happens in process context. Some async code may still access the socket after close, queue notification skbs to it etc. but no dumps can start, end or otherwise make progress.
Delete the workqueue and flush the dump state directly from the release handler. Note that further cleanup is possible in -next, for instance we now always call .done before releasing the main module reference, so dump doesn't have to take a reference of its own.
--- net/netlink/af_netlink.c | 31 ++++++++----------------------- net/netlink/af_netlink.h | 2 -- 2 files changed, 8 insertions(+), 25 deletions(-)
net/netlink/af_netlink.c +8 -23
@@ -385,15 +385,6 @@ static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)static void netlink_sock_destruct (struct sock *sk) { -struct netlink_sock *nlk =nlk_sk (sk); - -if (nlk->cb_running) { -if (nlk->cb.done) - nlk->cb.done (&nlk->cb); -module_put (nlk->cb.module); -kfree_skb (nlk->cb.skb); - } -skb_queue_purge (&sk->sk_receive_queue);if (!sock_flag (sk,SOCK_DEAD )) {
@@ -406,14 +397,6 @@ static void netlink_sock_destruct(struct sock *sk)WARN_ON (nlk_sk (sk)->groups); } -static void netlink_sock_destruct_work (struct work_struct *work) -{ - struct netlink_sock *nlk = container_of(work, struct netlink_sock, - work); - -sk_free (&nlk->sk); -} -/* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on * SMP. Look, when several writers sleep and reader wakes them up, all but one * immediately hit write lock and grab all the cpus. Exclusive sleep solves
@@ -730,12 +713,6 @@ static void deferred_put_nlk_sk(struct rcu_head *head)if (!refcount_dec_and_test (&sk->sk_refcnt))return ; -if (nlk->cb_running && nlk->cb.done) { -INIT_WORK (&nlk->work, netlink_sock_destruct_work); -schedule_work (&nlk->work); -return ; - } -sk_free (sk); }
@@ -785,6 +762,14 @@ static int netlink_release(struct socket *sock) NETLINK_URELEASE, &n); } +/* Terminate any outstanding dump */ +if (nlk->cb_running) { +if (nlk->cb.done) + nlk->cb.done (&nlk->cb); +module_put (nlk->cb.module); +kfree_skb (nlk->cb.skb); + } +module_put (nlk->module);if (netlink_is_kernel (sk)) {
net/netlink/af_netlink.h +0 -2
@@ -4,7 +4,6 @@#include <linux/rhashtable.h> #include <linux/atomic.h> -#include <linux/workqueue.h> #include <net/sock.h> /* flags */
@@ -46,7 +45,6 @@ struct netlink_sock {struct rhash_head node;struct rcu_head rcu; -struct work_struct work; };static inline struct netlink_sock *nlk_sk (struct sock *sk)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/459 net/mlx5: fs, lock FTE when checking if active
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Bloch <[email protected]>
[ Upstream commit 9ca314419930f9135727e39d77e66262d5f7bef6 ]
The referenced commits introduced a two-step process for deleting FTEs:
- Lock the FTE, delete it from hardware, set the hardware deletion function to NULL and unlock the FTE.
- Lock the parent flow group, delete the software copy of the FTE, and remove it from the xarray.
However, this approach encounters a race condition if a rule with the same match value is added simultaneously. In this scenario, fs_core may set the hardware deletion function to NULL prematurely, causing a panic during subsequent rule deletions.
To prevent this, ensure the active flag of the FTE is checked under a lock, which will prevent the fs_core layer from attaching a new steering rule to an FTE that is in the process of deletion.
[ 438.967589] MOSHE: 2496 mlx5_del_flow_rules del_hw_func [ 438.968205] ------------[ cut here ]------------ [ 438.968654] refcount_t: decrement hit 0; leaking memory. [ 438.969249] WARNING: CPU: 0 PID: 8957 at lib/refcount.c:31 refcount_warn_saturate+0xfb/0x110 [ 438.970054] Modules linked in: act_mirred cls_flower act_gact sch_ingress openvswitch nsh mlx5_vdpa vringh vhost_iotlb vdpa mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core zram zsmalloc fuse [last unloaded: cls_flower] [ 438.973288] CPU: 0 UID: 0 PID: 8957 Comm: tc Not tainted 6.12.0-rc1+ #8 [ 438.973888] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 438.974874] RIP: 0010:refcount_warn_saturate+0xfb/0x110 [ 438.975363] Code: 40 66 3b 82 c6 05 16 e9 4d 01 01 e8 1f 7c a0 ff 0f 0b c3 cc cc cc cc 48 c7 c7 10 66 3b 82 c6 05 fd e8 4d 01 01 e8 05 7c a0 ff <0f> 0b c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 90 [ 438.976947] RSP: 0018:ffff888124a53610 EFLAGS: 00010286 [ 438.977446] RAX: 0000000000000000 RBX: ffff888119d56de0 RCX: 0000000000000000 [ 438.978090] RDX: ffff88852c828700 RSI: ffff88852c81b3c0 RDI: ffff88852c81b3c0 [ 438.978721] RBP: ffff888120fa0e88 R08: 0000000000000000 R09: ffff888124a534b0 [ 438.979353] R10: 0000000000000001 R11: 0000000000000001 R12: ffff888119d56de0 [ 438.979979] R13: ffff888120fa0ec0 R14: ffff888120fa0ee8 R15: ffff888119d56de0 [ 438.980607] FS: 00007fe6dcc0f800(0000) GS:ffff88852c800000(0000) knlGS:0000000000000000 [ 438.983984] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 438.984544] CR2: 00000000004275e0 CR3: 0000000186982001 CR4: 0000000000372eb0 [ 438.985205] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 438.985842] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 438.986507] Call Trace: [ 438.986799] <TASK> [ 438.987070] ? __warn+0x7d/0x110 [ 438.987426] ? refcount_warn_saturate+0xfb/0x110 [ 438.987877] ? report_bug+0x17d/0x190 [ 438.988261] ? prb_read_valid+0x17/0x20 [ 438.988659] ? handle_bug+0x53/0x90 [ 438.989054] ? exc_invalid_op+0x14/0x70 [ 438.989458] ? asm_exc_invalid_op+0x16/0x20 [ 438.989883] ? refcount_warn_saturate+0xfb/0x110 [ 438.990348] mlx5_del_flow_rules+0x2f7/0x340 [mlx5_core] [ 438.990932] __mlx5_eswitch_del_rule+0x49/0x170 [mlx5_core] [ 438.991519] ? mlx5_lag_is_sriov+0x3c/0x50 [mlx5_core] [ 438.992054] ? xas_load+0x9/0xb0 [ 438.992407] mlx5e_tc_rule_unoffload+0x45/0xe0 [mlx5_core] [ 438.993037] mlx5e_tc_del_fdb_flow+0x2a6/0x2e0 [mlx5_core] [ 438.993623] mlx5e_flow_put+0x29/0x60 [mlx5_core] [ 438.994161] mlx5e_delete_flower+0x261/0x390 [mlx5_core] [ 438.994728] tc_setup_cb_destroy+0xb9/0x190 [ 438.995150] fl_hw_destroy_filter+0x94/0xc0 [cls_flower] [ 438.995650] fl_change+0x11a4/0x13c0 [cls_flower] [ 438.996105] tc_new_tfilter+0x347/0xbc0 [ 438.996503] ? ___slab_alloc+0x70/0x8c0 [ 438.996929] rtnetlink_rcv_msg+0xf9/0x3e0 [ 438.997339] ? __netlink_sendskb+0x4c/0x70 [ 438.997751] ? netlink_unicast+0x286/0x2d0 [ 438.998171] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 438.998625] netlink_rcv_skb+0x54/0x100 [ 438.999020] netlink_unicast+0x203/0x2d0 [ 438.999421] netlink_sendmsg+0x1e4/0x420 [ 438.999820] __sock_sendmsg+0xa1/0xb0 [ 439.000203] ____sys_sendmsg+0x207/0x2a0 [ 439.000600] ? copy_msghdr_from_user+0x6d/0xa0 [ 439.001072] ___sys_sendmsg+0x80/0xc0 [ 439.001459] ? ___sys_recvmsg+0x8b/0xc0 [ 439.001848] ? generic_update_time+0x4d/0x60 [ 439.002282] __sys_sendmsg+0x51/0x90 [ 439.002658] do_syscall_64+0x50/0x110 [ 439.003040] entry_SYSCALL_64_after_hwframe+0x76/0x7e
--- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +12 -3
@@ -1799,13 +1799,22 @@ lookup_fte_locked(struct mlx5_flow_group *g, fte_tmp =NULL ; goto out; } + +nested_down_write_ref_node (&fte_tmp->node,FS_LOCK_CHILD ); +if (!fte_tmp->node.active) { +up_write_ref_node (&fte_tmp->node, false); + +if (take_write) +up_write_ref_node (&g->node, false); +else +up_read_ref_node (&g->node); +tree_put_node (&fte_tmp->node, false); - fte_tmp =NULL ; - goto out; + +return NULL ; } -nested_down_write_ref_node (&fte_tmp->node,FS_LOCK_CHILD ); out:if (take_write)up_write_ref_node (&g->node, false);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/459 net/mlx5e: kTLS, Fix incorrect page refcounting
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragos Tatulea <[email protected]>
[ Upstream commit dd6e972cc5890d91d6749bb48e3912721c4e4b25 ]
The kTLS tx handling code is using a mix of get_page() and page_ref_inc() APIs to increment the page reference. But on the release path (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used.
This is an issue when using pages from large folios: the get_page() references are stored on the folio page while the page_ref_inc() references are stored directly in the given page. On release the folio page will be dereferenced too many times.
This was found while doing kTLS testing with sendfile() + ZC when the served file was read from NFS on a kernel with NFS large folios support (commit 49b29a573da8 ("nfs: add support for large folios")).
--- .../net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c +4 -4
@@ -261,7 +261,7 @@ tx_sync_info_get(struct mlx5e_ktls_offload_context_tx *priv_tx,while (remaining >0 ) {skb_frag_t *frag = &record->frags[i]; -get_page (skb_frag_page (frag)); +page_ref_inc (skb_frag_page (frag)); remaining -=skb_frag_size (frag); info->frags[i++] = *frag; }
@@ -348,7 +348,7 @@ void mlx5e_ktls_tx_handle_resync_dump_comp(struct mlx5e_txqsq *sq, stats = sq->stats;mlx5e_tx_dma_unmap (sq->pdev, dma); -put_page (wi->resync_dump_frag_page); +page_ref_dec (wi->resync_dump_frag_page); stats->tls_dump_packets++; stats->tls_dump_bytes += wi->num_bytes; }
@@ -429,12 +429,12 @@ mlx5e_ktls_tx_handle_ooo(struct mlx5e_ktls_offload_context_tx *priv_tx, err_out:for (; i < info.nr_frags; i++) -/* The put_page() here undoes the page ref obtained in tx_sync_info_get(). +/* The page_ref_dec() here undoes the page ref obtained in tx_sync_info_get(). * Page refs obtained for the DUMP WQEs above (by page_ref_add) will be * released only upon their completions (or in mlx5e_free_txqsq_descs, * if channel closes). */ -put_page (skb_frag_page (&info.frags[i])); +page_ref_dec (skb_frag_page (&info.frags[i]));return MLX5E_KTLS_SYNC_FAIL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/459 x86/mm: Fix a kdump kernel failure on SME system when CONFIG_IMA_KEXEC=y
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baoquan He <[email protected]>
commit 8d9ffb2fe65a6c4ef114e8d4f947958a12751bbe upstream.
The kdump kernel is broken on SME systems with CONFIG_IMA_KEXEC=y enabled. Debugging traced the issue back to
b69a2afd5afc ("x86/kexec: Carry forward IMA measurement log on kexec").
Testing was previously not conducted on SME systems with CONFIG_IMA_KEXEC enabled, which led to the oversight, with the following incarnation:
...
ima: No TPM chip found, activating TPM-bypass!
Loading compiled-in module X.509 certificates
Loaded X.509 cert 'Build time autogenerated kernel key: 18ae0bc7e79b64700122bb1d6a904b070fef2656'
ima: Allocated hash algorithm: sha256
Oops: general protection fault, probably for non-canonical address 0xcfacfdfe6660003e: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.11.0-rc2+ #14 Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS 1.20.0 05/03/2023 RIP: 0010:ima_restore_measurement_list Call Trace: <TASK> ? show_trace_log_lvl ? show_trace_log_lvl ? ima_load_kexec_buffer ? __die_body.cold ? die_addr ? exc_general_protection ? asm_exc_general_protection ? ima_restore_measurement_list ? vprintk_emit ? ima_load_kexec_buffer ima_load_kexec_buffer ima_init ? __pfx_init_ima init_ima ? __pfx_init_ima do_one_initcall do_initcalls ? __pfx_kernel_init kernel_init_freeable kernel_init ret_from_fork ? __pfx_kernel_init ret_from_fork_asm </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- ... Kernel panic - not syncing: Fatal exception Kernel Offset: disabled Rebooting in 10 seconds..
Adding debug printks showed that the stored addr and size of ima_kexec buffer are not decrypted correctly like:
ima: ima_load_kexec_buffer, buffer:0xcfacfdfe6660003e, size:0xe48066052d5df359
Three types of setup_data info
— SETUP_EFI,
- SETUP_IMA, and
- SETUP_RNG_SEED
are passed to the kexec/kdump kernel. Only the ima_kexec buffer experienced incorrect decryption. Debugging identified a bug in early_memremap_is_setup_data(), where an incorrect range calculation occurred due to the len variable in struct setup_data ended up only representing the length of the data field, excluding the struct's size, and thus leading to miscalculation.
Address a similar issue in memremap_is_setup_data() while at it.
[ bp: Heavily massage. ]
--- arch/x86/mm/ioremap.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/x86/mm/ioremap.c +4 -2
@@ -660,7 +660,8 @@ static bool memremap_is_setup_data(resou paddr_next = data->next; len = data->len; -if ((phys_addr > paddr) && (phys_addr < (paddr + len))) { +if ((phys_addr > paddr) && + (phys_addr < (paddr +sizeof (struct setup_data ) + len))) {memunmap (data);return true; }
@@ -722,7 +723,8 @@ static bool __init early_memremap_is_set paddr_next = data->next; len = data->len; -if ((phys_addr > paddr) && (phys_addr < (paddr + len))) { +if ((phys_addr > paddr) && + (phys_addr < (paddr +sizeof (struct setup_data ) + len))) {early_memunmap (data,sizeof (*data));return true; }
Greg Kroah-Hartman
maintainerPATCH 16/459 ocfs2: uncache inode which has failed entering the group
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
commit 737f34137844d6572ab7d473c998c7f977ff30eb upstream.
Syzbot has reported the following BUG:
kernel BUG at fs/ocfs2/uptodate.c:509!
...
Call Trace: <TASK> ? __die_body+0x5f/0xb0 ? die+0x9e/0xc0 ? do_trap+0x15a/0x3a0 ? ocfs2_set_new_buffer_uptodate+0x145/0x160 ? do_error_trap+0x1dc/0x2c0 ? ocfs2_set_new_buffer_uptodate+0x145/0x160 ? __pfx_do_error_trap+0x10/0x10 ? handle_invalid_op+0x34/0x40 ? ocfs2_set_new_buffer_uptodate+0x145/0x160 ? exc_invalid_op+0x38/0x50 ? asm_exc_invalid_op+0x1a/0x20 ? ocfs2_set_new_buffer_uptodate+0x2e/0x160 ? ocfs2_set_new_buffer_uptodate+0x144/0x160 ? ocfs2_set_new_buffer_uptodate+0x145/0x160 ocfs2_group_add+0x39f/0x15a0 ? __pfx_ocfs2_group_add+0x10/0x10 ? __pfx_lock_acquire+0x10/0x10 ? mnt_get_write_access+0x68/0x2b0 ? __pfx_lock_release+0x10/0x10 ? rcu_read_lock_any_held+0xb7/0x160 ? __pfx_rcu_read_lock_any_held+0x10/0x10 ? smack_log+0x123/0x540 ? mnt_get_write_access+0x68/0x2b0 ? mnt_get_write_access+0x68/0x2b0 ? mnt_get_write_access+0x226/0x2b0 ocfs2_ioctl+0x65e/0x7d0 ? __pfx_ocfs2_ioctl+0x10/0x10 ? smack_file_ioctl+0x29e/0x3a0 ? __pfx_smack_file_ioctl+0x10/0x10 ? lockdep_hardirqs_on_prepare+0x43d/0x780 ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 ? __pfx_ocfs2_ioctl+0x10/0x10 __se_sys_ioctl+0xfb/0x170 do_syscall_64+0xf3/0x230 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... </TASK>
When 'ioctl(OCFS2_IOC_GROUP_ADD, ...)' has failed for the particular inode in 'ocfs2_verify_group_and_input()', corresponding buffer head remains cached and subsequent call to the same 'ioctl()' for the same inode issues the BUG() in 'ocfs2_set_new_buffer_uptodate()' (trying to cache the same buffer head of that inode). Fix this by uncaching the buffer head with 'ocfs2_remove_from_cache()' on error path in 'ocfs2_group_add()'.
--- fs/ocfs2/resize.c | 2 ++ 1 file changed, 2 insertions(+)
fs/ocfs2/resize.c +2 -0
@@ -568,6 +568,8 @@ out_commit:ocfs2_commit_trans (osb, handle); out_free_group_bh: +if (ret <0 ) +ocfs2_remove_from_cache (INODE_CACHE (inode), group_bh);brelse (group_bh); out_unlock:
Greg Kroah-Hartman
maintainerPATCH 17/459 vdpa/mlx5: Fix PA offset with unaligned starting iotlb map
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Si-Wei Liu <[email protected]>
commit 29ce8b8a4fa74e841342c8b8f8941848a3c6f29f upstream.
When calculating the physical address range based on the iotlb and mr [start,end) ranges, the offset of mr->start relative to map->start is not taken into account. This leads to some incorrect and duplicate mappings.
For the case when mr->start < map->start the code is already correct:
the range in [mr->start, map->start) was handled by a different iteration.
Message-Id: <[email protected]>
--- drivers/vdpa/mlx5/core/mr.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/vdpa/mlx5/core/mr.c +5 -3
@@ -231,7 +231,7 @@ static int map_direct_mr(struct mlx5_vdpstruct page *pg;unsigned int nsg;int sglen; -u64 pa; +u64 pa, offset;u64 paend;struct scatterlist *sg;struct device *dma = mvdev->mdev->device;
@@ -254,8 +254,10 @@ static int map_direct_mr(struct mlx5_vdp sg = mr->sg_head.sgl;for (map =vhost_iotlb_itree_first (iotlb, mr->start, mr->end -1 ); map; map =vhost_iotlb_itree_next (map, mr->start, mr->end -1 )) { - paend = map->addr +maplen (map, mr); -for (pa = map->addr; pa < paend; pa += sglen) { + offset = mr->start > map->start ? mr->start - map->start :0 ; + pa = map->addr + offset; + paend = map->addr + offset +maplen (map, mr); +for (; pa < paend; pa += sglen) { pg =pfn_to_page (__phys_to_pfn (pa));if (!sg) { mlx5_vdpa_warn(mvdev, "sg null. start 0x%llx, end 0x%llx\n",
Greg Kroah-Hartman
maintainerPATCH 18/459 KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit aa0d42cacf093a6fcca872edc954f6f812926a17 upstream.
Hide KVM's pt_mode module param behind CONFIG_BROKEN, i.e. disable support for virtualizing Intel PT via guest/host mode unless BROKEN=y. There are myriad bugs in the implementation, some of which are fatal to the guest, and others which put the stability and health of the host at risk.
For guest fatalities, the most glaring issue is that KVM fails to ensure tracing is disabled, and *stays* disabled prior to VM-Enter, which is necessary as hardware disallows loading (the guest's) RTIT_CTL if tracing is enabled (enforced via a VMX consistency check). Per the SDM:
If the logical processor is operating with Intel PT enabled (if IA32_RTIT_CTL.TraceEn = 1) at the time of VM entry, the "load IA32_RTIT_CTL" VM-entry control must be 0.
On the host side, KVM doesn't validate the guest CPUID configuration provided by userspace, and even worse, uses the guest configuration to decide what MSRs to save/load at VM-Enter and VM-Exit. E.g. configuring guest CPUID to enumerate more address ranges than are supported in hardware will result in KVM trying to passthrough, save, and load non-existent MSRs, which generates a variety of WARNs, ToPA ERRORs in the host, a potential deadlock, etc.
Message-ID: <[email protected]>
--- arch/x86/kvm/vmx/vmx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/x86/kvm/vmx/vmx.c +3 -1
@@ -199,9 +199,11 @@ module_param(ple_window_shrink, uint, 04static unsigned int ple_window_max =KVM_VMX_DEFAULT_PLE_WINDOW_MAX ;module_param (ple_window_max, uint,0444 ); -/* Default is SYSTEM mode, 1 for host-guest mode */ +/* Default is SYSTEM mode, 1 for host-guest mode (which is BROKEN) */ int __read_mostly pt_mode =PT_MODE_SYSTEM ; +#ifdef CONFIG_BROKEN module_param (pt_mode, int,S_IRUGO ); +#endif static DEFINE_STATIC_KEY_FALSE (vmx_l1d_should_flush);static DEFINE_STATIC_KEY_FALSE (vmx_l1d_flush_cond);
Greg Kroah-Hartman
maintainerPATCH 19/459 nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit cd45e963e44b0f10d90b9e6c0e8b4f47f3c92471 upstream.
Patch series "nilfs2: fix null-ptr-deref bugs on block tracepoints".
This series fixes null pointer dereference bugs that occur when using nilfs2 and two block-related tracepoints.
This patch (of 2):
It has been reported that when using "block:block_touch_buffer" tracepoint, touch_buffer() called from __nilfs_get_folio_block() causes a NULL pointer dereference, or a general protection fault when KASAN is enabled.
This happens because since the tracepoint was added in touch_buffer(), it references the dev_t member bh->b_bdev->bd_dev regardless of whether the buffer head has a pointer to a block_device structure. In the current implementation, the block_device structure is set after the function returns to the caller.
Here, touch_buffer() is used to mark the folio/page that owns the buffer head as accessed, but the common search helper for folio/page used by the caller function was optimized to mark the folio/page as accessed when it was reimplemented a long time ago, eliminating the need to call touch_buffer() here in the first place.
So this solves the issue by eliminating the touch_buffer() call itself.
--- fs/nilfs2/page.c | 1 - 1 file changed, 1 deletion(-)
fs/nilfs2/page.c +0 -1
@@ -39,7 +39,6 @@ __nilfs_get_page_block(struct page *page first_block = (unsigned long )index << (PAGE_SHIFT - blkbits); bh =nilfs_page_get_nth_block (page, block - first_block); -touch_buffer (bh);wait_on_buffer (bh);return bh; }
Greg Kroah-Hartman
maintainerPATCH 20/459 ocfs2: fix UBSAN warning in ocfs2_verify_volume()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
commit 23aab037106d46e6168ce1214a958ce9bf317f2e upstream.
Syzbot has reported the following splat triggered by UBSAN:
UBSAN: shift-out-of-bounds in fs/ocfs2/super.c:2336:10 shift exponent 32768 is too large for 32-bit type 'int' CPU: 2 UID: 0 PID: 5255 Comm: repro Not tainted 6.12.0-rc4-syzkaller-00047-gc2ee9f594da8 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x241/0x360 ? __pfx_dump_stack_lvl+0x10/0x10 ? __pfx__printk+0x10/0x10 ? __asan_memset+0x23/0x50 ? lockdep_init_map_type+0xa1/0x910 __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 ocfs2_fill_super+0xf9c/0x5750 ? __pfx_ocfs2_fill_super+0x10/0x10 ? __pfx_validate_chain+0x10/0x10 ? __pfx_validate_chain+0x10/0x10 ? validate_chain+0x11e/0x5920 ? __lock_acquire+0x1384/0x2050 ? __pfx_validate_chain+0x10/0x10 ? string+0x26a/0x2b0 ? widen_string+0x3a/0x310 ? string+0x26a/0x2b0 ? bdev_name+0x2b1/0x3c0 ? pointer+0x703/0x1210 ? __pfx_pointer+0x10/0x10 ? __pfx_format_decode+0x10/0x10 ? __lock_acquire+0x1384/0x2050 ? vsnprintf+0x1ccd/0x1da0 ? snprintf+0xda/0x120 ? __pfx_lock_release+0x10/0x10 ? do_raw_spin_lock+0x14f/0x370 ? __pfx_snprintf+0x10/0x10 ? set_blocksize+0x1f9/0x360 ? sb_set_blocksize+0x98/0xf0 ? setup_bdev_super+0x4e6/0x5d0 mount_bdev+0x20c/0x2d0 ? __pfx_ocfs2_fill_super+0x10/0x10 ? __pfx_mount_bdev+0x10/0x10 ? vfs_parse_fs_string+0x190/0x230 ? __pfx_vfs_parse_fs_string+0x10/0x10 legacy_get_tree+0xf0/0x190 ? __pfx_ocfs2_mount+0x10/0x10 vfs_get_tree+0x92/0x2b0 do_new_mount+0x2be/0xb40 ? __pfx_do_new_mount+0x10/0x10 __se_sys_mount+0x2d6/0x3c0 ? __pfx___se_sys_mount+0x10/0x10 ? do_syscall_64+0x100/0x230 ? __x64_sys_mount+0x20/0xc0 do_syscall_64+0xf3/0x230 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f37cae96fda Code: 48 8b 0d 51 ce 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1e ce 0c 00 f7 d8 64 89 01 48 RSP: 002b:00007fff6c1aa228 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fff6c1aa240 RCX: 00007f37cae96fda RDX: 00000000200002c0 RSI: 0000000020000040 RDI: 00007fff6c1aa240 RBP: 0000000000000004 R08: 00007fff6c1aa280 R09: 0000000000000000 R10: 00000000000008c0 R11: 0000000000000206 R12: 00000000000008c0 R13: 00007fff6c1aa280 R14: 0000000000000003 R15: 0000000001000000 </TASK>
For a really damaged superblock, the value of 'i_super.s_blocksize_bits' may exceed the maximum possible shift for an underlying 'int'. So add an extra check whether the aforementioned field represents the valid block size, which is 512 bytes, 1K, 2K, or 4K.
--- fs/ocfs2/super.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
fs/ocfs2/super.c +9 -4
@@ -2329,6 +2329,7 @@ static int ocfs2_verify_volume(struct oc struct ocfs2_blockcheck_stats *stats) {int status = -EAGAIN ; +u32 blksz_bits;if (memcmp (di->i_signature,OCFS2_SUPER_BLOCK_SIGNATURE ,strlen (OCFS2_SUPER_BLOCK_SIGNATURE )) ==0 ) {
@@ -2343,11 +2344,15 @@ static int ocfs2_verify_volume(struct oc goto out; } status = -EINVAL ; -if ((1 <<le32_to_cpu (di->id2.i_super.s_blocksize_bits)) != blksz) { +/* Acceptable block sizes are 512 bytes, 1K, 2K and 4K. */ + blksz_bits =le32_to_cpu (di->id2.i_super.s_blocksize_bits); +if (blksz_bits <9 || blksz_bits >12 ) {mlog (ML_ERROR ,"found superblock with incorrect block " -"size: found %u, should be %u\n" , -1 <<le32_to_cpu (di->id2.i_super.s_blocksize_bits), - blksz); +"size bits: found %u, should be 9, 10, 11, or 12\n" , + blksz_bits); + }else if ((1 <<le32_to_cpu (blksz_bits)) != blksz) { +mlog (ML_ERROR ,"found superblock with incorrect block " +"size: found %u, should be %u\n" ,1 << blksz_bits, blksz); }else if (le16_to_cpu (di->id2.i_super.s_major_rev_level) !=OCFS2_MAJOR_REV_LEVEL || le16_to_cpu(di->id2.i_super.s_minor_rev_level) !=
Greg Kroah-Hartman
maintainerPATCH 21/459 nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit 2026559a6c4ce34db117d2db8f710fe2a9420d5a upstream.
When using the "block:block_dirty_buffer" tracepoint, mark_buffer_dirty() may cause a NULL pointer dereference, or a general protection fault when KASAN is enabled.
This happens because, since the tracepoint was added in mark_buffer_dirty(), it references the dev_t member bh->b_bdev->bd_dev regardless of whether the buffer head has a pointer to a block_device structure.
In the current implementation, nilfs_grab_buffer(), which grabs a buffer to read (or create) a block of metadata, including b-tree node blocks, does not set the block device, but instead does so only if the buffer is not in the "uptodate" state for each of its caller block reading functions. However, if the uptodate flag is set on a folio/page, and the buffer heads are detached from it by try_to_free_buffers(), and new buffer heads are then attached by create_empty_buffers(), the uptodate flag may be restored to each buffer without the block device being set to bh->b_bdev, and mark_buffer_dirty() may be called later in that state, resulting in the bug mentioned above.
Fix this issue by making nilfs_grab_buffer() always set the block device of the super block structure to the buffer head, regardless of the state of the buffer's uptodate flag.
--- fs/nilfs2/btnode.c | 2 -- fs/nilfs2/gcinode.c | 4 +--- fs/nilfs2/mdt.c | 1 - fs/nilfs2/page.c | 1 + 4 files changed, 2 insertions(+), 6 deletions(-)
fs/nilfs2/btnode.c +0 -2
@@ -68,7 +68,6 @@ nilfs_btnode_create_block(struct address goto failed; }memset (bh->b_data,0 ,i_blocksize (inode)); - bh->b_bdev = inode->i_sb->s_bdev; bh->b_blocknr = blocknr;set_buffer_mapped (bh);set_buffer_uptodate (bh);
@@ -133,7 +132,6 @@ int nilfs_btnode_submit_block(struct add goto found; }set_buffer_mapped (bh); - bh->b_bdev = inode->i_sb->s_bdev; bh->b_blocknr = pblocknr;/* set block address for read */ bh->b_end_io = end_buffer_read_sync;get_bh (bh);
fs/nilfs2/gcinode.c +1 -3
@@ -83,10 +83,8 @@ int nilfs_gccache_submit_read_data(struc goto out; } -if (!buffer_mapped (bh)) { - bh->b_bdev = inode->i_sb->s_bdev; +if (!buffer_mapped (bh))set_buffer_mapped (bh); - } bh->b_blocknr = pbn; bh->b_end_io = end_buffer_read_sync;get_bh (bh);
fs/nilfs2/mdt.c +0 -1
@@ -89,7 +89,6 @@ static int nilfs_mdt_create_block(structif (buffer_uptodate (bh)) goto failed_bh; - bh->b_bdev = sb->s_bdev; err =nilfs_mdt_insert_new_block (inode, block, bh, init_block);if (likely (!err)) {get_bh (bh);
fs/nilfs2/page.c +1 -0
@@ -63,6 +63,7 @@ struct buffer_head *nilfs_grab_buffer(stput_page (page);return NULL ; } + bh->b_bdev = inode->i_sb->s_bdev;return bh; }
Greg Kroah-Hartman
maintainerPATCH 22/459 Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aurelien Jarno <[email protected]>
commit 1635e407a4a64d08a8517ac59ca14ad4fc785e75 upstream.
The commit 8396c793ffdf ("mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K") increased the max_req_size, even for 4K pages, causing various issues:
- Panic booting the kernel/rootfs from an SD card on Rockchip RK3566
- Panic booting the kernel/rootfs from an SD card on StarFive JH7100
- "swiotlb buffer is full" and data corruption on StarFive JH7110
At this stage no fix have been found, so it's probably better to just revert the change.
This reverts commit 8396c793ffdf28bb8aee7cfe0891080f8cab7890.
Message-ID: <[email protected]>
--- drivers/mmc/host/dw_mmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mmc/host/dw_mmc.c +2 -2
@@ -2826,8 +2826,8 @@ static int dw_mci_init_slot(struct dw_mcif (host->use_dma ==TRANS_MODE_IDMAC ) { mmc->max_segs = host->ring_size; mmc->max_blk_size =65535 ; - mmc->max_req_size =DW_MCI_DESC_DATA_LENGTH * host->ring_size; - mmc->max_seg_size = mmc->max_req_size; + mmc->max_seg_size =0x1000 ; + mmc->max_req_size = mmc->max_seg_size * host->ring_size; mmc->max_blk_count = mmc->max_req_size /512 ; }else if (host->use_dma ==TRANS_MODE_EDMAC ) { mmc->max_segs =64 ;
Greg Kroah-Hartman
maintainerPATCH 23/459 drm/bridge: tc358768: Fix DSI command tx
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <[email protected]>
commit 32c4514455b2b8fde506f8c0962f15c7e4c26f1d upstream.
Wait for the command transmission to be completed in the DSI transfer function polling for the dc_start bit to go back to idle state after the transmission is started.
This is documented in the datasheet and failures to do so lead to commands corruption.
--- drivers/gpu/drm/bridge/tc358768.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-)
drivers/gpu/drm/bridge/tc358768.c +19 -2
@@ -124,6 +124,9 @@#define TC358768_DSI_CONFW_MODE_CLR (6 << 29)#define TC358768_DSI_CONFW_ADDR_DSI_CONTROL (0x3 << 24) +/* TC358768_DSICMD_TX (0x0600) register */ +#define TC358768_DSI_CMDTX_DC_START BIT(0) +static const char *const tc358768_supplies[] = {"vddc" ,"vddmipi" ,"vddio" };
@@ -227,6 +230,21 @@ static void tc358768_update_bits(structtc358768_write (priv, reg, tmp); } +static void tc358768_dsicmd_tx (struct tc358768_priv *priv) +{ +u32 val; + +/* start transfer */ +tc358768_write (priv,TC358768_DSICMD_TX ,TC358768_DSI_CMDTX_DC_START ); +if (priv->error) +return ; + +/* wait transfer completion */ + priv->error =regmap_read_poll_timeout (priv->regmap,TC358768_DSICMD_TX , val, + (val &TC358768_DSI_CMDTX_DC_START ) ==0 , +100 ,100000 ); +} +static int tc358768_sw_reset (struct tc358768_priv *priv) {/* Assert Reset */
@@ -507,8 +525,7 @@ static ssize_t tc358768_dsi_host_transfe } } -/* start transfer */ -tc358768_write (priv,TC358768_DSICMD_TX ,1 ); +tc358768_dsicmd_tx (priv); ret =tc358768_clear_error (priv);if (ret)
Greg Kroah-Hartman
maintainerPATCH 24/459 mmc: core: fix return value check in devm_mmc_alloc_host()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <[email protected]>
commit 71d04535e853305a76853b28a01512a62006351d upstream.
mmc_alloc_host() returns NULL pointer not PTR_ERR(), if it fails, so replace the IS_ERR() check with NULL pointer check.
In commit 418f7c2de133 ("mmc: meson-gx: use devm_mmc_alloc_host"), it checks NULL pointer not PTR_ERR, if devm_mmc_alloc_host() fails, so make it to return NULL pointer to keep same with mmc_alloc_host(), the drivers don't need to change the error handle when switch to use devm_mmc_alloc_host().
--- drivers/mmc/core/host.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/mmc/core/host.c +3 -3
@@ -523,12 +523,12 @@ struct mmc_host *devm_mmc_alloc_host(str dr =devres_alloc (devm_mmc_host_release,sizeof (*dr),GFP_KERNEL );if (!dr) -return ERR_PTR (-ENOMEM ); +return NULL ; host =mmc_alloc_host (extra, dev); -if (IS_ERR (host)) { +if (!host) {devres_free (dr); -return host; +return NULL ; } *dr = host;
Greg Kroah-Hartman
maintainerPATCH 25/459 media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
commit a4aebaf6e6efff548b01a3dc49b4b9074751c15b upstream.
When CONFIG_DVB_DYNAMIC_MINORS, ret is not initialized, and a semaphore is left at the wrong state, in case of errors.
Make the code simpler and avoid mistakes by having just one error check logic used weather DVB_DYNAMIC_MINORS is used or not.
--- drivers/media/dvb-core/dvbdev.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-)
drivers/media/dvb-core/dvbdev.c +4 -11
@@ -544,6 +544,9 @@ int dvb_register_device(struct dvb_adaptfor (minor =0 ; minor <MAX_DVB_MINORS ; minor++)if (dvb_minors[minor] ==NULL )break ; +#else + minor =nums2minor (adap->num, type, id); +#endif if (minor >=MAX_DVB_MINORS ) {if (new_node) {list_del (&new_node->list_head);
@@ -557,17 +560,7 @@ int dvb_register_device(struct dvb_adaptmutex_unlock (&dvbdev_register_lock);return -EINVAL ; } -#else - minor =nums2minor (adap->num, type, id); -if (minor >=MAX_DVB_MINORS ) { -dvb_media_device_free (dvbdev); -list_del (&dvbdev->list_head); -kfree (dvbdev); - *pdvbdev =NULL ; -mutex_unlock (&dvbdev_register_lock); -return ret; - } -#endif + dvbdev->minor = minor; dvb_minors[minor] =dvb_device_get (dvbdev);up_write (&minor_rwsem);
Greg Kroah-Hartman
maintainerPATCH 26/459 NFSD: initialize copy->cp_clp early in nfsd4_copy for use by trace point
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dai Ngo <[email protected]>
[ Upstream commit 15d1975b7279693d6f09398e0e2e31aca2310275 ]
Prepare for adding server copy trace points.
Stable-dep-of: 9ed666eba4e0 ("NFSD: Async COPY result needs to return a write verifier")
--- fs/nfsd/nfs4proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfsd/nfs4proc.c +1 -1
@@ -1769,6 +1769,7 @@ nfsd4_copy(struct svc_rqst *rqstp, struc__be32 status;struct nfsd4_copy *async_copy =NULL ; + copy->cp_clp = cstate->clp;if (nfsd4_ssc_is_inter (copy)) {if (!inter_copy_offload_enable ||nfsd4_copy_is_sync (copy)) { status = nfserr_notsupp;
@@ -1783,7 +1784,6 @@ nfsd4_copy(struct svc_rqst *rqstp, strucreturn status; } - copy->cp_clp = cstate->clp;memcpy (©->fh, &cstate->current_fh.fh_handle,sizeof (struct knfsd_fh ));if (nfsd4_copy_is_async (copy)) {
Greg Kroah-Hartman
maintainerPATCH 27/459 NFSD: Async COPY result needs to return a write verifier
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 9ed666eba4e0a2bb8ffaa3739d830b64d4f2aaad ]
Currently, when NFSD handles an asynchronous COPY, it returns a zero write verifier, relying on the subsequent CB_OFFLOAD callback to pass the write verifier and a stable_how4 value to the client.
However, if the CB_OFFLOAD never arrives at the client (for example, if a network partition occurs just as the server sends the CB_OFFLOAD operation), the client will never receive this verifier. Thus, if the client sends a follow-up COMMIT, there is no way for the client to assess the COMMIT result.
The usual recovery for a missing CB_OFFLOAD is for the client to send an OFFLOAD_STATUS operation, but that operation does not carry a write verifier in its result. Neither does it carry a stable_how4 value, so the client /must/ send a COMMIT in this case -- which will always fail because currently there's still no write verifier in the COPY result.
Thus the server needs to return a normal write verifier in its COPY result even if the COPY operation is to be performed asynchronously.
If the server recognizes the callback stateid in subsequent OFFLOAD_STATUS operations, then obviously it has not restarted, and the write verifier the client received in the COPY result is still valid and can be used to assess a COMMIT of the copied data, if one is needed.
--- fs/nfsd/nfs4proc.c | 23 ++++++++--------------- 1 file changed, 8 insertions(+), 15 deletions(-)
fs/nfsd/nfs4proc.c +8 -15
@@ -718,15 +718,6 @@ nfsd4_access(struct svc_rqst *rqstp, str &access->ac_supported); } -static void gen_boot_verifier (nfs4_verifier *verifier,struct net *net) -{ -__be32 *verf = (__be32 *)verifier->data; - -BUILD_BUG_ON (2 *sizeof (*verf) !=sizeof (verifier->data)); - -nfsd_copy_write_verifier (verf,net_generic (net, nfsd_net_id)); -} -static __be32 nfsd4_commit (struct svc_rqst *rqstp,struct nfsd4_compound_state *cstate,union nfsd4_op_u *u)
@@ -1594,7 +1585,6 @@ static void nfsd4_init_copy_res(struct ntest_bit (NFSD4_COPY_F_COMMITTED , ©->cp_flags) ?NFS_FILE_SYNC :NFS_UNSTABLE ;nfsd4_copy_set_sync (copy, sync); -gen_boot_verifier (©->cp_res.wr_verifier, copy->cp_clp->net); } static ssize_t _nfsd_copy_file_range(struct nfsd4_copy *copy,
@@ -1765,9 +1755,14 @@ static __be32 nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, union nfsd4_op_u *u) { + struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id); +struct nfsd4_copy *async_copy =NULL ;struct nfsd4_copy *copy = &u->copy; +struct nfsd42_write_res *result;__be32 status; -struct nfsd4_copy *async_copy =NULL ; + + result = ©->cp_res; +nfsd_copy_write_verifier ((__be32 *)&result->wr_verifier.data, nn); copy->cp_clp = cstate->clp;if (nfsd4_ssc_is_inter (copy)) {
@@ -1787,8 +1782,6 @@ nfsd4_copy(struct svc_rqst *rqstp, strucmemcpy (©->fh, &cstate->current_fh.fh_handle,sizeof (struct knfsd_fh ));if (nfsd4_copy_is_async (copy)) { -struct nfsd_net *nn =net_generic (SVC_NET (rqstp), nfsd_net_id); - status =nfserrno (-ENOMEM ); async_copy =kzalloc (sizeof (struct nfsd4_copy ),GFP_KERNEL );if (!async_copy)
@@ -1800,8 +1793,8 @@ nfsd4_copy(struct svc_rqst *rqstp, struc goto out_err;if (!nfs4_init_copy_state (nn, copy)) goto out_err; -memcpy (©->cp_res.cb_stateid, ©->cp_stateid.cs_stid, -sizeof (copy->cp_res.cb_stateid)); +memcpy (&result->cb_stateid, ©->cp_stateid.cs_stid, +sizeof (result->cb_stateid));dup_copy_fields (copy, async_copy); async_copy->copy_task =kthread_create (nfsd4_do_async_copy, async_copy,"%s" ,"copy thread" );
Greg Kroah-Hartman
maintainerPATCH 28/459 NFSD: Limit the number of concurrent async COPY operations
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit aadc3bbea163b6caaaebfdd2b6c4667fbc726752 ]
Nothing appears to limit the number of concurrent async COPY operations that clients can start. In addition, AFAICT each async COPY can copy an unlimited number of 4MB chunks, so can run for a long time. Thus IMO async COPY can become a DoS vector.
Add a restriction mechanism that bounds the number of concurrent background COPY operations. Start simple and try to be fair -- this patch implements a per-namespace limit.
An async COPY request that occurs while this limit is exceeded gets NFS4ERR_DELAY. The requesting client can choose to send the request again after a delay or fall back to a traditional read/write style copy.
If there is need to make the mechanism more sophisticated, we can visit that in future patches.
--- fs/nfsd/netns.h | 1 + fs/nfsd/nfs4proc.c | 11 +++++++++-- fs/nfsd/nfs4state.c | 1 + fs/nfsd/xdr4.h | 1 + 4 files changed, 12 insertions(+), 2 deletions(-)
fs/nfsd/netns.h +1 -0
@@ -152,6 +152,7 @@ struct nfsd_net {u32 s2s_cp_cl_id;struct idr s2s_cp_stateids;spinlock_t s2s_cp_lock; +atomic_t pending_async_copies;/* * Version information
fs/nfsd/nfs4proc.c +9 -2
@@ -1244,6 +1244,7 @@ static void nfs4_put_copy(struct nfsd4_c {if (!refcount_dec_and_test (©->refcount))return ; +atomic_dec (©->cp_nn->pending_async_copies);kfree (copy->cp_src);kfree (copy); }
@@ -1782,10 +1783,16 @@ nfsd4_copy(struct svc_rqst *rqstp, strucmemcpy (©->fh, &cstate->current_fh.fh_handle,sizeof (struct knfsd_fh ));if (nfsd4_copy_is_async (copy)) { - status =nfserrno (-ENOMEM ); async_copy =kzalloc (sizeof (struct nfsd4_copy ),GFP_KERNEL );if (!async_copy) goto out_err; + async_copy->cp_nn = nn; +/* Arbitrary cap on number of pending async copy operations */ +if (atomic_inc_return (&nn->pending_async_copies) > + (int )rqstp->rq_pool->sp_nrthreads) { +atomic_dec (&nn->pending_async_copies); + goto out_err; + }INIT_LIST_HEAD (&async_copy->copies);refcount_set (&async_copy->refcount,1 ); async_copy->cp_src =kmalloc (sizeof (*async_copy->cp_src),GFP_KERNEL );
@@ -1824,7 +1831,7 @@ out_err: }if (async_copy)cleanup_async_copy (async_copy); - status =nfserrno (-ENOMEM ); + status = nfserr_jukebox; goto out; }
fs/nfsd/nfs4state.c +1 -0
@@ -8088,6 +8088,7 @@ static int nfs4_state_create_net(structspin_lock_init (&nn->client_lock);spin_lock_init (&nn->s2s_cp_lock);idr_init (&nn->s2s_cp_stateids); +atomic_set (&nn->pending_async_copies,0 );spin_lock_init (&nn->blocked_locks_lock);INIT_LIST_HEAD (&nn->blocked_locks_lru);
fs/nfsd/xdr4.h +1 -0
@@ -574,6 +574,7 @@ struct nfsd4_copy {struct nfsd4_ssc_umount_item *ss_nsui;struct nfs_fh c_fh;nfs4_stateid stateid; +struct nfsd_net *cp_nn; };static inline void nfsd4_copy_set_sync (struct nfsd4_copy *copy,bool sync)
Greg Kroah-Hartman
maintainerPATCH 29/459 NFSD: Initialize struct nfsd4_copy earlier
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 63fab04cbd0f96191b6e5beedc3b643b01c15889 ]
Ensure the refcount and async_copies fields are initialized early. cleanup_async_copy() will reference these fields if an error occurs in nfsd4_copy(). If they are not correctly initialized, at the very least, a refcount underflow occurs.
--- fs/nfsd/nfs4proc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/nfsd/nfs4proc.c +2 -2
@@ -1787,14 +1787,14 @@ nfsd4_copy(struct svc_rqst *rqstp, strucif (!async_copy) goto out_err; async_copy->cp_nn = nn; +INIT_LIST_HEAD (&async_copy->copies); +refcount_set (&async_copy->refcount,1 );/* Arbitrary cap on number of pending async copy operations */ if (atomic_inc_return (&nn->pending_async_copies) > (int )rqstp->rq_pool->sp_nrthreads) {atomic_dec (&nn->pending_async_copies); goto out_err; } -INIT_LIST_HEAD (&async_copy->copies); -refcount_set (&async_copy->refcount,1 ); async_copy->cp_src =kmalloc (sizeof (*async_copy->cp_src),GFP_KERNEL );if (!async_copy->cp_src) goto out_err;
Greg Kroah-Hartman
maintainerPATCH 30/459 NFSD: Never decrement pending_async_copies on error
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 8286f8b622990194207df9ab852e0f87c60d35e9 ]
The error flow in nfsd4_copy() calls cleanup_async_copy(), which already decrements nn->pending_async_copies.
--- fs/nfsd/nfs4proc.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
fs/nfsd/nfs4proc.c +1 -3
@@ -1791,10 +1791,8 @@ nfsd4_copy(struct svc_rqst *rqstp, strucrefcount_set (&async_copy->refcount,1 );/* Arbitrary cap on number of pending async copy operations */ if (atomic_inc_return (&nn->pending_async_copies) > - (int )rqstp->rq_pool->sp_nrthreads) { -atomic_dec (&nn->pending_async_copies); + (int )rqstp->rq_pool->sp_nrthreads) goto out_err; - } async_copy->cp_src =kmalloc (sizeof (*async_copy->cp_src),GFP_KERNEL );if (!async_copy->cp_src) goto out_err;
Greg Kroah-Hartman
maintainerPATCH 31/459 mm: revert "mm: shmem: fix data-race in shmem_getattr()"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Morton <[email protected]>
commit d1aa0c04294e29883d65eac6c2f72fe95cc7c049 upstream.
Revert d949d1d14fa2 ("mm: shmem: fix data-race in shmem_getattr()") as suggested by Chuck [1]. It is causing deadlocks when accessing tmpfs over NFS.
As Hugh commented, "added just to silence a syzbot sanitizer splat: added where there has never been any practical problem".
--- mm/shmem.c | 2 -- 1 file changed, 2 deletions(-)
mm/shmem.c +0 -2
@@ -1077,9 +1077,7 @@ static int shmem_getattr(const struct pashmem_recalc_inode (inode);spin_unlock_irq (&info->lock); } -inode_lock_shared (inode);generic_fillattr (inode, stat); -inode_unlock_shared (inode);if (is_huge_enabled (sb_info)) stat->blksize =HPAGE_PMD_SIZE ;
Greg Kroah-Hartman
maintainerPATCH 32/459 mm: avoid unsafe VMA hook invocation when error arises on mmap hook
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes <[email protected]>
[ Upstream commit 3dd6ed34ce1f2356a77fb88edafb5ec96784e3cf ]
Patch series "fix error handling in mmap_region() and refactor (hotfixes)", v4.
mmap_region() is somewhat terrifying, with spaghetti-like control flow and numerous means by which issues can arise and incomplete state, memory leaks and other unpleasantness can occur.
A large amount of the complexity arises from trying to handle errors late in the process of mapping a VMA, which forms the basis of recently observed issues with resource leaks and observable inconsistent state.
This series goes to great lengths to simplify how mmap_region() works and to avoid unwinding errors late on in the process of setting up the VMA for the new mapping, and equally avoids such operations occurring while the VMA is in an inconsistent state.
The patches in this series comprise the minimal changes required to resolve existing issues in mmap_region() error handling, in order that they can be hotfixed and backported. There is additionally a follow up series which goes further, separated out from the v1 series and sent and updated separately.
This patch (of 5):
After an attempted mmap() fails, we are no longer in a situation where we can safely interact with VMA hooks. This is currently not enforced, meaning that we need complicated handling to ensure we do not incorrectly call these hooks.
We can avoid the whole issue by treating the VMA as suspect the moment that the file->f_ops->mmap() function reports an error by replacing whatever VMA operations were installed with a dummy empty set of VMA operations.
We do so through a new helper function internal to mm - mmap_file() - which is both more logically named than the existing call_mmap() function and correctly isolates handling of the vm_op reassignment to mm.
All the existing invocations of call_mmap() outside of mm are ultimately nested within the call_mmap() from mm, which we now replace.
It is therefore safe to leave call_mmap() in place as a convenience
function (and to avoid churn). The invokers are:
ovl_file_operations -> mmap -> ovl_mmap() -> backing_file_mmap()
coda_file_operations -> mmap -> coda_file_mmap()
shm_file_operations -> shm_mmap()
shm_file_operations_huge -> shm_mmap()
dma_buf_fops -> dma_buf_mmap_internal -> i915_dmabuf_ops
-> i915_gem_dmabuf_mmap()None of these callers interact with vm_ops or mappings in a problematic way on error, quickly exiting out.
--- mm/internal.h | 12 ++++++++++++ mm/mmap.c | 4 ++-- mm/nommu.c | 4 ++-- mm/util.c | 18 ++++++++++++++++++ 4 files changed, 34 insertions(+), 4 deletions(-)
mm/internal.h +12 -0
@@ -34,6 +34,18 @@void page_writeback_init (void ); +/* +* This is a file-backed mapping, and is about to be memory mapped - invoke its +* mmap hook and safely handle error conditions. On error, VMA hooks will be +* mutated. +* +* @file: File which backs the mapping. +* @vma: VMA which we are mapping. +* +* Returns: 0 if success, error otherwise. +*/ +int mmap_file (struct file *file,struct vm_area_struct *vma); +vm_fault_t do_swap_page (struct vm_fault *vmf); void free_pgtables(struct mmu_gather *tlb, struct vm_area_struct *start_vma,
mm/mmap.c +2 -2
@@ -1808,7 +1808,7 @@ unsigned long mmap_region(struct file *f* new file must not have been exposed to user-space, yet. */ vma->vm_file =get_file (file); - error =call_mmap (file, vma); + error =mmap_file (file, vma);if (error) goto unmap_and_free_vma;
@@ -1823,7 +1823,7 @@ unsigned long mmap_region(struct file *f addr = vma->vm_start; -/* If vm_flags changed after call_mmap(), we should try merge vma again +/* If vm_flags changed after mmap_file(), we should try merge vma again * as we may succeed this time. */ if (unlikely (vm_flags != vma->vm_flags && prev)) {
mm/nommu.c +2 -2
@@ -955,7 +955,7 @@ static int do_mmap_shared_file(struct vm {int ret; - ret =call_mmap (vma->vm_file, vma); + ret =mmap_file (vma->vm_file, vma);if (ret ==0 ) { vma->vm_region->vm_top = vma->vm_region->vm_end;return 0 ;
@@ -986,7 +986,7 @@ static int do_mmap_private(struct vm_are* - VM_MAYSHARE will be set if it may attempt to share */ if (capabilities &NOMMU_MAP_DIRECT ) { - ret =call_mmap (vma->vm_file, vma); + ret =mmap_file (vma->vm_file, vma);if (ret ==0 ) {/* shouldn't return success if we're not sharing */ BUG_ON (!(vma->vm_flags &VM_MAYSHARE ));
mm/util.c +18 -0
@@ -1073,3 +1073,21 @@ int __weak memcmp_pages(struct page *pagkunmap_atomic (addr1);return ret; } + +int mmap_file (struct file *file,struct vm_area_struct *vma) +{ +static const struct vm_operations_struct dummy_vm_ops = {}; +int err =call_mmap (file, vma); + +if (likely (!err)) +return 0 ; + +/* +* OK, we tried to call the file hook for mmap(), but an error +* arose. The mapping is in an inconsistent state and we most not invoke +* any further hooks on it. +*/ + vma->vm_ops = &dummy_vm_ops; + +return err; +}
Greg Kroah-Hartman
maintainerPATCH 33/459 mm: unconditionally close VMAs on error
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes <[email protected]>
[ Upstream commit 4080ef1579b2413435413988d14ac8c68e4d42c8 ]
Incorrect invocation of VMA callbacks when the VMA is no longer in a consistent state is bug prone and risky to perform.
With regards to the important vm_ops->close() callback We have gone to great lengths to try to track whether or not we ought to close VMAs.
Rather than doing so and risking making a mistake somewhere, instead unconditionally close and reset vma->vm_ops to an empty dummy operations set with a NULL .close operator.
We introduce a new function to do so - vma_close() - and simplify existing vms logic which tracked whether we needed to close or not.
This simplifies the logic, avoids incorrect double-calling of the .close() callback and allows us to update error paths to simply call vma_close() unconditionally - making VMA closure idempotent.
--- mm/internal.h | 7 +++++++ mm/mmap.c | 9 +++------ mm/nommu.c | 3 +-- mm/util.c | 15 +++++++++++++++ 4 files changed, 26 insertions(+), 8 deletions(-)
mm/internal.h +7 -0
@@ -46,6 +46,13 @@ void page_writeback_init(void);*/ int mmap_file (struct file *file,struct vm_area_struct *vma); +/* +* If the VMA has a close hook then close it, and since closing it might leave +* it in an inconsistent state which makes the use of any hooks suspect, clear +* them down by installing dummy empty hooks. +*/ +void vma_close (struct vm_area_struct *vma); +vm_fault_t do_swap_page (struct vm_fault *vmf); void free_pgtables(struct mmu_gather *tlb, struct vm_area_struct *start_vma,
mm/mmap.c +3 -6
@@ -176,8 +176,7 @@ static struct vm_area_struct *remove_vmastruct vm_area_struct *next = vma->vm_next;might_sleep (); -if (vma->vm_ops && vma->vm_ops->close) - vma->vm_ops->close (vma); +vma_close (vma);if (vma->vm_file)fput (vma->vm_file);mpol_put (vma_policy (vma));
@@ -1901,8 +1900,7 @@ out:return addr; close_and_free_vma: -if (vma->vm_ops && vma->vm_ops->close) - vma->vm_ops->close (vma); +vma_close (vma); unmap_and_free_vma: vma->vm_file =NULL ;fput (file);
@@ -2788,8 +2786,7 @@ int __split_vma(struct mm_struct *mm, streturn 0 ;/* Clean everything up if vma_adjust failed. */ -if (new->vm_ops && new->vm_ops->close) - new->vm_ops->close (new); +vma_close (new);if (new->vm_file)fput (new->vm_file);unlink_anon_vmas (new);
mm/nommu.c +1 -2
@@ -662,8 +662,7 @@ static void delete_vma_from_mm(struct vm*/ static void delete_vma (struct mm_struct *mm,struct vm_area_struct *vma) { -if (vma->vm_ops && vma->vm_ops->close) - vma->vm_ops->close (vma); +vma_close (vma);if (vma->vm_file)fput (vma->vm_file);put_nommu_region (vma->vm_region);
mm/util.c +15 -0
@@ -1091,3 +1091,18 @@ int mmap_file(struct file *file, structreturn err; } + +void vma_close (struct vm_area_struct *vma) +{ +static const struct vm_operations_struct dummy_vm_ops = {}; + +if (vma->vm_ops && vma->vm_ops->close) { + vma->vm_ops->close (vma); + +/* +* The mapping is in an inconsistent state, and no further hooks +* may be invoked upon it. +*/ + vma->vm_ops = &dummy_vm_ops; + } +}
Greg Kroah-Hartman
maintainerPATCH 34/459 mm: refactor arch_calc_vm_flag_bits() and arm64 MTE handling
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes <[email protected]>
[ Upstream commit 5baf8b037debf4ec60108ccfeccb8636d1dbad81 ]
Currently MTE is permitted in two circumstances (desiring to use MTE having been specified by the VM_MTE flag) - where MAP_ANONYMOUS is specified, as checked by arch_calc_vm_flag_bits() and actualised by setting the VM_MTE_ALLOWED flag, or if the file backing the mapping is shmem, in which case we set VM_MTE_ALLOWED in shmem_mmap() when the mmap hook is activated in mmap_region().
The function that checks that, if VM_MTE is set, VM_MTE_ALLOWED is also set is the arm64 implementation of arch_validate_flags().
Unfortunately, we intend to refactor mmap_region() to perform this check earlier, meaning that in the case of a shmem backing we will not have invoked shmem_mmap() yet, causing the mapping to fail spuriously.
It is inappropriate to set this architecture-specific flag in general mm code anyway, so a sensible resolution of this issue is to instead move the check somewhere else.
We resolve this by setting VM_MTE_ALLOWED much earlier in do_mmap(), via the arch_calc_vm_flag_bits() call.
This is an appropriate place to do this as we already check for the MAP_ANONYMOUS case here, and the shmem file case is simply a variant of the same idea - we permit RAM-backed memory.
This requires a modification to the arch_calc_vm_flag_bits() signature to pass in a pointer to the struct file associated with the mapping, however this is not too egregious as this is only used by two architectures anyway
- arm64 and parisc.
So this patch performs this adjustment and removes the unnecessary assignment of VM_MTE_ALLOWED in shmem_mmap().
--- arch/arm64/include/asm/mman.h | 10 +++++++--- include/linux/mman.h | 7 ++++--- mm/mmap.c | 2 +- mm/nommu.c | 2 +- mm/shmem.c | 3 --- 5 files changed, 13 insertions(+), 11 deletions(-)
arch/arm64/include/asm/mman.h +7 -3
@@ -3,6 +3,8 @@#define __ASM_MMAN_H__#include <linux/compiler.h> +#include <linux/fs.h> +#include <linux/shmem_fs.h> #include <linux/types.h> #include <uapi/asm/mman.h>
@@ -21,19 +23,21 @@ static inline unsigned long arch_calc_vm }#define arch_calc_vm_prot_bits (prot, pkey) arch_calc_vm_prot_bits(prot, pkey) -static inline unsigned long arch_calc_vm_flag_bits (unsigned long flags) +static inline unsigned long arch_calc_vm_flag_bits (struct file *file, +unsigned long flags) {/* * Only allow MTE on anonymous mappings as these are guaranteed to be * backed by tags-capable memory. The vm_flags may be overridden by a * filesystem supporting MTE (RAM-based). */ -if (system_supports_mte () && (flags &MAP_ANONYMOUS )) +if (system_supports_mte () && + ((flags &MAP_ANONYMOUS ) ||shmem_file (file)))return VM_MTE_ALLOWED ;return 0 ; } -#define arch_calc_vm_flag_bits (flags) arch_calc_vm_flag_bits(flags) +#define arch_calc_vm_flag_bits (file, flags) arch_calc_vm_flag_bits(file, flags)static inline pgprot_t arch_vm_get_page_prot (unsigned long vm_flags) {
include/linux/mman.h +4 -3
@@ -2,6 +2,7 @@#ifndef _LINUX_MMAN_H#define _LINUX_MMAN_H +#include <linux/fs.h> #include <linux/mm.h> #include <linux/percpu_counter.h>
@@ -87,7 +88,7 @@ static inline void vm_unacct_memory(long#endif #ifndef arch_calc_vm_flag_bits -#define arch_calc_vm_flag_bits (flags) 0 +#define arch_calc_vm_flag_bits (file, flags) 0#endif #ifndef arch_vm_get_page_prot
@@ -148,13 +149,13 @@ calc_vm_prot_bits(unsigned long prot, un* Combine the mmap "flags" argument into "vm_flags" used internally. */ static inline unsigned long -calc_vm_flag_bits (unsigned long flags) +calc_vm_flag_bits (struct file *file,unsigned long flags) {return _calc_vm_trans (flags,MAP_GROWSDOWN ,VM_GROWSDOWN ) |_calc_vm_trans (flags,MAP_DENYWRITE ,VM_DENYWRITE ) |_calc_vm_trans (flags,MAP_LOCKED ,VM_LOCKED ) |_calc_vm_trans (flags,MAP_SYNC ,VM_SYNC ) | -arch_calc_vm_flag_bits (flags); +arch_calc_vm_flag_bits (file, flags); }unsigned long vm_commit_limit (void );
mm/mmap.c +1 -1
@@ -1468,7 +1468,7 @@ unsigned long do_mmap(struct file *file,* to. we assume access permissions have been handled by the open * of the memory object, so we don't do any here. */ - vm_flags =calc_vm_prot_bits (prot, pkey) |calc_vm_flag_bits (flags) | + vm_flags =calc_vm_prot_bits (prot, pkey) |calc_vm_flag_bits (file, flags) | mm->def_flags |VM_MAYREAD |VM_MAYWRITE |VM_MAYEXEC ;if (flags &MAP_LOCKED )
mm/nommu.c +1 -1
@@ -919,7 +919,7 @@ static unsigned long determine_vm_flags( {unsigned long vm_flags; - vm_flags =calc_vm_prot_bits (prot,0 ) |calc_vm_flag_bits (flags); + vm_flags =calc_vm_prot_bits (prot,0 ) |calc_vm_flag_bits (file, flags);/* vm_flags |= mm->def_flags; */ if (!(capabilities &NOMMU_MAP_DIRECT )) {
mm/shmem.c +0 -3
@@ -2267,9 +2267,6 @@ static int shmem_mmap(struct file *file,if (ret)return ret; -/* arm64 - allow memory tagging on RAM-based files */ - vma->vm_flags |=VM_MTE_ALLOWED ; -file_accessed (file); vma->vm_ops = &shmem_vm_ops; if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) &&
Greg Kroah-Hartman
maintainerPATCH 35/459 mm: resolve faulty mmap_region() error path behaviour
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes <[email protected]>
[ Upstream commit 5de195060b2e251a835f622759550e6202167641 ]
The mmap_region() function is somewhat terrifying, with spaghetti-like control flow and numerous means by which issues can arise and incomplete state, memory leaks and other unpleasantness can occur.
A large amount of the complexity arises from trying to handle errors late in the process of mapping a VMA, which forms the basis of recently observed issues with resource leaks and observable inconsistent state.
Taking advantage of previous patches in this series we move a number of checks earlier in the code, simplifying things by moving the core of the logic into a static internal function __mmap_region().
Doing this allows us to perform a number of checks up front before we do any real work, and allows us to unwind the writable unmap check unconditionally as required and to perform a CONFIG_DEBUG_VM_MAPLE_TREE validation unconditionally also.
We move a number of things here:
1. We preallocate memory for the iterator before we call the file-backed memory hook, allowing us to exit early and avoid having to perform complicated and error-prone close/free logic. We carefully free iterator state on both success and error paths.
2. The enclosing mmap_region() function handles the mapping_map_writable() logic early. Previously the logic had the mapping_map_writable() at the point of mapping a newly allocated file-backed VMA, and a matching mapping_unmap_writable() on success and error paths.
We now do this unconditionally if this is a file-backed, shared writable mapping. If a driver changes the flags to eliminate VM_MAYWRITE, however doing so does not invalidate the seal check we just performed, and we in any case always decrement the counter in the wrapper.
We perform a debug assert to ensure a driver does not attempt to do the opposite.
3. We also move arch_validate_flags() up into the mmap_region() function. This is only relevant on arm64 and sparc64, and the check is only meaningful for SPARC with ADI enabled. We explicitly add a warning for this arch if a driver invalidates this check, though the code ought eventually to be fixed to eliminate the need for this.
With all of these measures in place, we no longer need to explicitly close the VMA on error paths, as we place all checks which might fail prior to a call to any driver mmap hook.
This eliminates an entire class of errors, makes the code easier to reason about and more robust.
--- mm/mmap.c | 69 ++++++++++++++++++++++++++++++++++++++++---------------------- 1 file changed, 45 insertions(+), 24 deletions(-)
mm/mmap.c +45 -24
@@ -1726,7 +1726,7 @@ static inline int accountable_mapping(streturn (vm_flags & (VM_NORESERVE |VM_SHARED |VM_WRITE )) ==VM_WRITE ; } -unsigned long mmap_region (struct file *file,unsigned long addr, +static unsigned long __mmap_region (struct file *file,unsigned long addr,unsigned long len,vm_flags_t vm_flags,unsigned long pgoff,struct list_head *uf) {
@@ -1795,11 +1795,6 @@ unsigned long mmap_region(struct file *fif (error) goto free_vma; } -if (vm_flags &VM_SHARED ) { - error =mapping_map_writable (file->f_mapping); -if (error) - goto allow_write_and_free_vma; - }/* ->mmap() can change vma->vm_file, but must guarantee that * vma_link() below can deny write-access if VM_DENYWRITE is set
@@ -1809,7 +1804,7 @@ unsigned long mmap_region(struct file *f vma->vm_file =get_file (file); error =mmap_file (file, vma);if (error) - goto unmap_and_free_vma; + goto unmap_and_free_file_vma;/* Can addr have changed?? *
@@ -1820,6 +1815,14 @@ unsigned long mmap_region(struct file *f*/ WARN_ON_ONCE (addr != vma->vm_start); +/* +* Drivers should not permit writability when previously it was +* disallowed. +*/ +VM_WARN_ON_ONCE (vm_flags != vma->vm_flags && + !(vm_flags &VM_MAYWRITE ) && + (vma->vm_flags &VM_MAYWRITE )); + addr = vma->vm_start;/* If vm_flags changed after mmap_file(), we should try merge vma again
@@ -1851,21 +1854,14 @@ unsigned long mmap_region(struct file *fvma_set_anonymous (vma); } -/* Allow architectures to sanity-check the vm_flags */ -if (!arch_validate_flags (vma->vm_flags)) { - error = -EINVAL ; -if (file) - goto close_and_free_vma; -else - goto free_vma; - } +#ifdef CONFIG_SPARC64 +/* TODO: Fix SPARC ADI! */ +WARN_ON_ONCE (!arch_validate_flags (vm_flags)); +#endif vma_link (mm, vma, prev, rb_link, rb_parent); -/* Once vma denies write, undo our temporary denial count */ if (file) { unmap_writable: -if (vm_flags &VM_SHARED ) -mapping_unmap_writable (file->f_mapping);if (vm_flags &VM_DENYWRITE )allow_write_access (file); }
@@ -1899,17 +1895,12 @@ out:return addr; -close_and_free_vma: -vma_close (vma); -unmap_and_free_vma: +unmap_and_free_file_vma: vma->vm_file =NULL ;fput (file);/* Undo any partial mapping done by a device driver. */ unmap_region (mm, vma, prev, vma->vm_start, vma->vm_end); -if (vm_flags &VM_SHARED ) -mapping_unmap_writable (file->f_mapping); -allow_write_and_free_vma:if (vm_flags &VM_DENYWRITE )allow_write_access (file); free_vma:
@@ -2931,6 +2922,36 @@ int do_munmap(struct mm_struct *mm, unsireturn __do_munmap (mm, start, len, uf, false); } +unsigned long mmap_region (struct file *file,unsigned long addr, +unsigned long len,vm_flags_t vm_flags,unsigned long pgoff, +struct list_head *uf) +{ +unsigned long ret; +bool writable_file_mapping = false; + +/* Allow architectures to sanity-check the vm_flags. */ +if (!arch_validate_flags (vm_flags)) +return -EINVAL ; + +/* Map writable and ensure this isn't a sealed memfd. */ +if (file && (vm_flags &VM_SHARED )) { +int error =mapping_map_writable (file->f_mapping); + +if (error) +return error; + writable_file_mapping = true; + } + + ret =__mmap_region (file, addr, len, vm_flags, pgoff, uf); + +/* Clear our write mapping regardless of error. */ +if (writable_file_mapping) +mapping_unmap_writable (file->f_mapping); + +validate_mm (current->mm); +return ret; +} +static int __vm_munmap (unsigned long start,size_t len,bool downgrade) {int ret;
Greg Kroah-Hartman
maintainerPATCH 36/459 ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 0107f28f135231da22a9ad5756bb16bd5cada4d5 ]
The Vexia Edu Atla 10 tablet mostly uses the BYTCR tablet defaults, but as happens on more models it is using IN1 instead of IN3 for its internal mic and JD_SRC_JD2_IN4N instead of JD_SRC_JD1_IN4P for jack-detection.
Add a DMI quirk for this to fix the internal-mic and jack-detection.
--- sound/soc/intel/boards/bytcr_rt5640.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
sound/soc/intel/boards/bytcr_rt5640.c +15 -0
@@ -935,6 +935,21 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {BYT_RT5640_SSP0_AIF2 | BYT_RT5640_MCLK_EN), }, + { /* Vexia Edu Atla 10 tablet */ + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"AMI Corporation" ), +DMI_MATCH (DMI_BOARD_NAME ,"Aptio CRB" ), +/* Above strings are too generic, also match on BIOS date */ + DMI_MATCH(DMI_BIOS_DATE, "08/25/2014"), + }, + .driver_data = (void *)(BYT_RT5640_IN1_MAP | +BYT_RT5640_JD_SRC_JD2_IN4N | +BYT_RT5640_OVCD_TH_2000UA | +BYT_RT5640_OVCD_SF_0P75 | +BYT_RT5640_DIFF_MIC | +BYT_RT5640_SSP0_AIF2 | + BYT_RT5640_MCLK_EN), + }, { /* Voyo Winpad A15 */ .matches = { DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/459 mac80211: fix user-power when emulating chanctx
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Greear <[email protected]>
[ Upstream commit 9b15c6cf8d2e82c8427cd06f535d8de93b5b995c ]
ieee80211_calc_hw_conf_chan was ignoring the configured user_txpower. If it is set, use it to potentially decrease txpower as requested.
--- net/mac80211/main.c | 2 ++ 1 file changed, 2 insertions(+)
net/mac80211/main.c +2 -0
@@ -144,6 +144,8 @@ static u32 ieee80211_hw_conf_chan(struct ieee80211_local *local) } power =ieee80211_chandef_max_power (&chandef); +if (local->user_power_level !=IEEE80211_UNSET_POWER_LEVEL ) + power =min (local->user_power_level, power);rcu_read_lock ();list_for_each_entry_rcu (sdata, &local->interfaces, list) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/459 selftests/watchdog-test: Fix system accidentally reset after watchdog-test
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zhijian <[email protected]>
[ Upstream commit dc1308bee1ed03b4d698d77c8bd670d399dcd04d ]
When running watchdog-test with 'make run_tests', the watchdog-test will be terminated by a timeout signal(SIGTERM) due to the test timemout.
And then, a system reboot would happen due to watchdog not stop. see the dmesg as below:
``` [ 1367.185172] watchdog: watchdog0: watchdog did not stop! ```
Fix it by registering more signals(including SIGTERM) in watchdog-test, where its signal handler will stop the watchdog.
After that
# timeout 1 ./watchdog-test Watchdog Ticking Away! . Stopping watchdog ticks...
--- tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++ 1 file changed, 6 insertions(+)
tools/testing/selftests/watchdog/watchdog-test.c +6 -0
@@ -242,7 +242,13 @@ int main(int argc, char *argv[])printf ("Watchdog Ticking Away!\n" ); +/* +* Register the signals +*/ signal (SIGINT , term); +signal (SIGTERM , term); +signal (SIGKILL , term); +signal (SIGQUIT , term);while (1 ) {keep_alive ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/459 ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Piyush Raj Chouhan <[email protected]>
[ Upstream commit ef5fbdf732a158ec27eeba69d8be851351f29f73 ]
Infinix ZERO BOOK 13 has a 2+2 speaker system which isn't probed correctly. This patch adds a quirk with the proper pin connections.
Also The mic in this laptop suffers too high gain resulting in mostly fan noise being recorded,
This patch Also limit mic boost.
HW Probe for device; https://linux-hardware.org/?probe=a2e892c47b
Test: All 4 speaker works, Mic has low noise.
--- sound/pci/hda/patch_realtek.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
sound/pci/hda/patch_realtek.c +12 -0
@@ -6877,6 +6877,7 @@ enum {ALC290_FIXUP_SUBWOOFER_HSJACK ,ALC269_FIXUP_THINKPAD_ACPI ,ALC269_FIXUP_DMIC_THINKPAD_ACPI , +ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13 ,ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO ,ALC255_FIXUP_ACER_MIC_NO_PRESENCE , ALC255_FIXUP_ASUS_MIC_NO_PRESENCE,
@@ -7178,6 +7179,16 @@ static const struct hda_fixup alc269_fixups[] = { .type = HDA_FIXUP_FUNC, .v.func = alc269_fixup_pincfg_U7x7_headset_mic, }, + [ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x14 ,0x90170151 },/* use as internal speaker (LFE) */ + {0x1b ,0x90170152 },/* use as internal speaker (back) */ + { } + }, + .chained = true, + .chain_id =ALC269_FIXUP_LIMIT_INT_MIC_BOOST + }, [ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO] = { .type = HDA_FIXUP_PINS, .v.pins = (const struct hda_pintbl []) {
@@ -9449,6 +9460,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1d72 ,0x1945 ,"Redmi G" ,ALC256_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1d72 ,0x1947 ,"RedmiBook Air" ,ALC255_FIXUP_XIAOMI_HEADSET_MIC ),SND_PCI_QUIRK (0x2782 ,0x0214 ,"VAIO VJFE-CL" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ), +SND_PCI_QUIRK (0x2782 ,0x0228 ,"Infinix ZERO BOOK 13" ,ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13 ),SND_PCI_QUIRK (0x2782 ,0x0232 ,"CHUWI CoreBook XPro" ,ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO ),SND_PCI_QUIRK (0x2782 ,0x1707 ,"Vaio VJFE-ADL" ,ALC298_FIXUP_SPK_VOLUME ), SND_PCI_QUIRK(0x8086, 0x2074, "Intel NUC 8", ALC233_FIXUP_INTEL_NUC8_DMIC),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/459 x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit fce9642c765a18abd1db0339a7d832c29b68456a ]
node_to_amd_nb() is defined to NULL in non-AMD configs:
drivers/platform/x86/amd/hsmp/plat.c: In function 'init_platform_device':
drivers/platform/x86/amd/hsmp/plat.c:165:68: error: dereferencing 'void *' pointer [-Werror]
165 | sock->root = node_to_amd_nb(i)->root;
| ^~ drivers/platform/x86/amd/hsmp/plat.c:165:68: error: request for member 'root' in something not a structure or union
Users of the interface who also allow COMPILE_TEST will cause the above build error so provide an inline stub to fix that.
[ bp: Massage commit message. ]
--- arch/x86/include/asm/amd_nb.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/x86/include/asm/amd_nb.h +4 -1
@@ -118,7 +118,10 @@ static inline bool amd_gart_present(void)#define amd_nb_num (x) 0#define amd_nb_has_feature (x) false -#define node_to_amd_nb (x) NULL +static inline struct amd_northbridge *node_to_amd_nb (int node) +{ +return NULL ; +}#define amd_gart_present (x) false#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/459 net: usb: qmi_wwan: add Quectel RG650V
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benoît Monin <[email protected]>
[ Upstream commit 6b3f18a76be6bbd237c7594cf0bf2912b68084fe ]
Add support for Quectel RG650V which is based on Qualcomm SDX65 chip. The composition is DIAG / NMEA / AT / AT / QMI.
T: Bus=02 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=5000 MxCh= 0
D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
P: Vendor=2c7c ProdID=0122 Rev=05.15
S: Manufacturer=Quectel
S: Product=RG650V-EU
S: SerialNumber=xxxxxxx
C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=896mA
I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=9ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=9ms
I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=87(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=9ms
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1020,6 +1020,7 @@ static const struct usb_device_id products[] = { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x581d, USB_CLASS_VENDOR_SPEC, 1, 7), .driver_info = (unsigned long )&qmi_wwan_info, }, + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0122)}, /* Quectel RG650V */ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0125)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0306)}, /* Quectel EP06/EG06/EM06 */ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/459 soc: qcom: Add check devm_kasprintf() returned value
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Han <[email protected]>
[ Upstream commit e694d2b5c58ba2d1e995d068707c8d966e7f5f2a ]
devm_kasprintf() can return a NULL pointer on failure but this returned value in qcom_socinfo_probe() is not checked.
--- drivers/soc/qcom/socinfo.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/soc/qcom/socinfo.c +7 -1
@@ -507,10 +507,16 @@ static int qcom_socinfo_probe(struct platform_device *pdev) qs->attr.revision =devm_kasprintf (&pdev->dev,GFP_KERNEL ,"%u.%u" ,SOCINFO_MAJOR (le32_to_cpu (info->ver)),SOCINFO_MINOR (le32_to_cpu (info->ver))); -if (offsetof(struct socinfo , serial_num) <= item_size) +if (!qs->attr.soc_id || qs->attr.revision) +return -ENOMEM ; + +if (offsetof(struct socinfo , serial_num) <= item_size) { qs->attr.serial_number =devm_kasprintf (&pdev->dev,GFP_KERNEL ,"%u" ,le32_to_cpu (info->serial_num)); +if (!qs->attr.serial_number) +return -ENOMEM ; + } qs->soc_dev =soc_device_register (&qs->attr);if (IS_ERR (qs->soc_dev))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/459 regulator: rk808: Add apply_bit for BUCK3 on RK809
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Rudenko <[email protected]>
[ Upstream commit 5e53e4a66bc7430dd2d11c18a86410e3a38d2940 ]
Currently, RK809's BUCK3 regulator is modelled in the driver as a configurable regulator with 0.5-2.4V voltage range. But the voltage setting is not actually applied, because when bit 6 of PMIC_POWER_CONFIG register is set to 0 (default), BUCK3 output voltage is determined by the external feedback resistor. Fix this, by setting bit 6 when voltage selection is set. Existing users which do not specify voltage constraints in their device trees will not be affected by this change, since no voltage setting is applied in those cases, and bit 6 is not enabled.
--- drivers/regulator/rk808-regulator.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/regulator/rk808-regulator.c +2 -0
@@ -944,6 +944,8 @@ static const struct regulator_desc rk809_reg[] = { .n_linear_ranges = ARRAY_SIZE(rk817_buck1_voltage_ranges), .vsel_reg = RK817_BUCK3_ON_VSEL_REG, .vsel_mask = RK817_BUCK_VSEL_MASK, + .apply_reg = RK817_POWER_CONFIG, + .apply_bit = RK817_BUCK3_FB_RES_INTER, .enable_reg = RK817_POWER_EN_REG(0), .enable_mask = ENABLE_MASK(RK817_ID_DCDC3), .enable_val = ENABLE_MASK(RK817_ID_DCDC3),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/459 can: j1939: fix error in J1939 documentation.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Hölzl <[email protected]>
[ Upstream commit b6ec62e01aa4229bc9d3861d1073806767ea7838 ]
The description of PDU1 format usage mistakenly referred to PDU2 format.
--- Documentation/networking/j1939.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/networking/j1939.rst +1 -1
@@ -83,7 +83,7 @@ format, the Group Extension is set in the PS-field. On the other hand, when using PDU1 format, the PS-field contains a so-called Destination Address, which is _not_ part of the PGN. When communicating a PGN -from user space to kernel (or vice versa) and PDU2 format is used, the PS-field +from user space to kernel (or vice versa) and PDU1 format is used, the PS-field of the PGN shall be set to zero. The Destination Address shall be set elsewhere.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/459 ASoC: stm: Prevent potential division by zero in stm32_sai_mclk_round_rate()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luo Yifan <[email protected]>
[ Upstream commit 63c1c87993e0e5bb11bced3d8224446a2bc62338 ]
This patch checks if div is less than or equal to zero (div <= 0). If div is zero or negative, the function returns -EINVAL, ensuring the division operation (*prate / div) is safe to perform.
--- sound/soc/stm/stm32_sai_sub.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/stm/stm32_sai_sub.c +2 -2
@@ -380,8 +380,8 @@ static long stm32_sai_mclk_round_rate(struct clk_hw *hw, unsigned long rate,int div; div =stm32_sai_get_clk_div (sai, *prate, rate); -if (div <0 ) -return div; +if (div <=0 ) +return -EINVAL ; mclk->freq = *prate / div;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/459 ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luo Yifan <[email protected]>
[ Upstream commit 23569c8b314925bdb70dd1a7b63cfe6100868315 ]
This patch checks if div is less than or equal to zero (div <= 0). If div is zero or negative, the function returns -EINVAL, ensuring the division operation is safe to perform.
--- sound/soc/stm/stm32_sai_sub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/stm/stm32_sai_sub.c +1 -1
@@ -319,7 +319,7 @@ static int stm32_sai_get_clk_div(struct stm32_sai_sub_data *sai,int div; div =DIV_ROUND_CLOSEST (input_rate, output_rate); -if (div >SAI_XCR1_MCKDIV_MAX (version)) { +if (div >SAI_XCR1_MCKDIV_MAX (version) || div <=0 ) {dev_err (&sai->pdev->dev,"Divider %d out of range\n" , div);return -EINVAL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/459 proc/softirqs: replace seq_printf with seq_put_decimal_ull_width
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Wang <[email protected]>
[ Upstream commit 84b9749a3a704dcc824a88aa8267247c801d51e4 ]
seq_printf is costy, on a system with n CPUs, reading /proc/softirqs would yield 10*n decimal values, and the extra cost parsing format string grows linearly with number of cpus. Replace seq_printf with seq_put_decimal_ull_width have significant performance improvement. On an 8CPUs system, reading /proc/softirqs show ~40% performance gain with this patch.
--- fs/proc/softirqs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/proc/softirqs.c +1 -1
@@ -19,7 +19,7 @@ static int show_softirqs(struct seq_file *p, void *v)for (i =0 ; i <NR_SOFTIRQS ; i++) {seq_printf (p,"%12s:" , softirq_to_name[i]);for_each_possible_cpu (j) -seq_printf (p," %10u" ,kstat_softirqs_cpu (i, j)); +seq_put_decimal_ull_width (p," " ,kstat_softirqs_cpu (i, j),10 );seq_putc (p,'\n' ); }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/459 ALSA: usb-audio: Fix Yamaha P-125 Quirk Entry
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eryk Zagorski <[email protected]>
[ Upstream commit 6f891ca15b017707840c9e7f5afd9fc6cfd7d8b1 ]
This patch switches the P-125 quirk entry to use a composite quirk as the P-125 supplies both MIDI and Audio like many of the other Yamaha keyboards
--- sound/usb/quirks-table.h | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
sound/usb/quirks-table.h +13 -1
@@ -350,7 +350,6 @@ YAMAHA_DEVICE(0x105a, NULL), YAMAHA_DEVICE(0x105b, NULL), YAMAHA_DEVICE(0x105c, NULL), YAMAHA_DEVICE(0x105d, NULL), -YAMAHA_DEVICE(0x1718, "P-125"), { USB_DEVICE(0x0499, 0x1503), .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
@@ -485,6 +484,19 @@ YAMAHA_DEVICE(0x1718, "P-125"), } } }, +{ +USB_DEVICE (0x0499 ,0x1718 ), + QUIRK_DRIVER_INFO { +/* .vendor_name = "Yamaha", */ +/* .product_name = "P-125", */ + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + { QUIRK_DATA_MIDI_YAMAHA(3) }, + QUIRK_COMPOSITE_END + } + } +},YAMAHA_DEVICE (0x2000 ,"DGP-7" ),YAMAHA_DEVICE (0x2001 ,"DGP-5" ), YAMAHA_DEVICE(0x2002, NULL),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/459 ipmr: Fix access to mfc_cache_list without lock held
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit e28acc9c1ccfcb24c08e020828f69d0a915b06ae ]
Accessing mr_table->mfc_cache_list is protected by an RCU lock. In the following code flow, the RCU read lock is not held, causing the following error when RCU_PROVE is not held. The same problem might show up in the IPv6 code path.
6.12.0-rc5-kbuilder-01145-gbac17284bdcb #33 Tainted: G E N
-----------------------------
net/ipv4/ipmr_base.c:313 RCU-list traversed in non-reader section!!
rcu_scheduler_active = 2, debug_locks = 1
2 locks held by RetransmitAggre/3519:
#0: ffff88816188c6c0 (nlk_cb_mutex-ROUTE){+.+.}-{3:3}, at: __netlink_dump_start+0x8a/0x290
#1: ffffffff83fcf7a8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_dumpit+0x6b/0x90
stack backtrace:
lockdep_rcu_suspicious
mr_table_dump
ipmr_rtm_dumproute
rtnl_dump_all
rtnl_dumpit
netlink_dump
__netlink_dump_start
rtnetlink_rcv_msg
netlink_rcv_skb
netlink_unicast
netlink_sendmsgThis is not a problem per see, since the RTNL lock is held here, so, it is safe to iterate in the list without the RCU read lock, as suggested by Eric.
To alleviate the concern, modify the code to use list_for_each_entry_rcu() with the RTNL-held argument.
The annotation will raise an error only if RTNL or RCU read lock are missing during iteration, signaling a legitimate problem, otherwise it will avoid this false positive.
This will solve the IPv6 case as well, since ip6mr_rtm_dumproute() calls this function as well.
--- net/ipv4/ipmr_base.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv4/ipmr_base.c +2 -1
@@ -301,7 +301,8 @@ int mr_table_dump(struct mr_table *mrt, struct sk_buff *skb,if (filter->filter_set) flags |=NLM_F_DUMP_FILTERED ; -list_for_each_entry_rcu (mfc, &mrt->mfc_cache_list, list) { +list_for_each_entry_rcu (mfc, &mrt->mfc_cache_list, list, +lockdep_rtnl_is_held ()) {if (e < s_e) goto next_entry; if (filter->dev &&
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/459 rcu-tasks: Idle tasks on offline CPUs are in quiescent states
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul E. McKenney <[email protected]>
commit 5c9a9ca44fda41c5e82f50efced5297a9c19760d upstream.
Any idle task corresponding to an offline CPU is in an RCU Tasks Trace quiescent state. This commit causes rcu_tasks_trace_postscan() to ignore idle tasks for offline CPUs, which it can do safely due to CPU-hotplug operations being disabled.
--- kernel/rcu/tasks.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/rcu/tasks.h +1 -1
@@ -1007,7 +1007,7 @@ static void rcu_tasks_trace_postscan(struct list_head *hop) {int cpu; -for_each_possible_cpu (cpu) +for_each_online_cpu (cpu)rcu_tasks_trace_pertask (idle_task (cpu), hop);// Re-enable CPU hotplug now that the tasklist scan has completed.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/459 x86/stackprotector: Work around strict Clang TLS symbol requirements
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
[ Upstream commit 577c134d311b9b94598d7a0c86be1f431f823003 ]
GCC and Clang both implement stack protector support based on Thread Local Storage (TLS) variables, and this is used in the kernel to implement per-task stack cookies, by copying a task's stack cookie into a per-CPU variable every time it is scheduled in.
Both now also implement -mstack-protector-guard-symbol=, which permits the TLS variable to be specified directly. This is useful because it will allow to move away from using a fixed offset of 40 bytes into the per-CPU area on x86_64, which requires a lot of special handling in the per-CPU code and the runtime relocation code.
However, while GCC is rather lax in its implementation of this command line option, Clang actually requires that the provided symbol name refers to a TLS variable (i.e., one declared with __thread), although it also permits the variable to be undeclared entirely, in which case it will use an implicit declaration of the right type.
The upshot of this is that Clang will emit the correct references to the stack cookie variable in most cases, e.g.,
10d: 64 a1 00 00 00 00 mov %fs:0x0,%eax
10f: R_386_32 __stack_chk_guard
However, if a non-TLS definition of the symbol in question is visible in the same compilation unit (which amounts to the whole of vmlinux if LTO is enabled), it will drop the per-CPU prefix and emit a load from a bogus address.
Work around this by using a symbol name that never occurs in C code, and emit it as an alias in the linker script.
--- arch/x86/Makefile | 3 ++- arch/x86/entry/entry.S | 15 +++++++++++++++ arch/x86/include/asm/asm-prototypes.h | 3 +++ arch/x86/kernel/cpu/common.c | 2 ++ arch/x86/kernel/vmlinux.lds.S | 3 +++ 5 files changed, 25 insertions(+), 1 deletion(-)
arch/x86/Makefile +2 -1
@@ -90,7 +90,8 @@ ifeq ($(CONFIG_X86_32),y) ifeq ($(CONFIG_STACKPROTECTOR),y) ifeq ($(CONFIG_SMP),y) - KBUILD_CFLAGS += -mstack-protector-guard-reg=fs -mstack-protector-guard-symbol=__stack_chk_guard + KBUILD_CFLAGS += -mstack-protector-guard-reg=fs \ + -mstack-protector-guard-symbol=__ref_stack_chk_guard else KBUILD_CFLAGS += -mstack-protector-guard=global endif
arch/x86/entry/entry.S +15 -0
@@ -48,3 +48,18 @@ EXPORT_SYMBOL_GPL(mds_verw_sel); .popsection +#ifndef CONFIG_X86_64 +/* + * Clang's implementation of TLS stack cookies requires the variable in + * question to be a TLS variable. If the variable happens to be defined as an + * ordinary variable with external linkage in the same compilation unit (which + * amounts to the whole of vmlinux with LTO enabled), Clang will drop the + * segment register prefix from the references, resulting in broken code. Work + * around this by avoiding the symbol used in -mstack-protector-guard-symbol= + * entirely in the C code, and use an alias emitted by the linker script + * instead. + */ +#ifdef CONFIG_STACKPROTECTOR +EXPORT_SYMBOL(__ref_stack_chk_guard); +#endif +#endif
arch/x86/include/asm/asm-prototypes.h +3 -0
@@ -18,3 +18,6 @@extern void cmpxchg8b_emu (void );#endif +#if defined(__GENKSYMS__) && defined(CONFIG_STACKPROTECTOR ) +extern unsigned long __ref_stack_chk_guard; +#endif
arch/x86/kernel/cpu/common.c +2 -0
@@ -1974,8 +1974,10 @@ EXPORT_PER_CPU_SYMBOL(cpu_current_top_of_stack);#ifdef CONFIG_STACKPROTECTOR DEFINE_PER_CPU(unsigned long, __stack_chk_guard); +#ifndef CONFIG_SMP EXPORT_PER_CPU_SYMBOL (__stack_chk_guard);#endif +#endif #endif /* CONFIG_X86_64 */
arch/x86/kernel/vmlinux.lds.S +3 -0
@@ -490,6 +490,9 @@ SECTIONS ASSERT(SIZEOF(.rela.dyn) == 0, "Unexpected run-time relocations (.rela) detected!") } +/* needed for Clang - see arch/x86/entry/entry.S */ +PROVIDE(__ref_stack_chk_guard = __stack_chk_guard); + #ifdef CONFIG_X86_32 /* * The ASSERT() sink to . is intentional, for binutils 2.14 compatibility:
Signature · 1 line
2.43.0
Ard Biesheuvel
NAKRe: [PATCH 5.10 051/459] x86/stackprotector: Work around strict Clang TLS symbol requirements
NAK
See other replies re this backport
Quoted 140 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
[ Upstream commit
577c134d311b9b94598d7a0c86be1f431f823003]GCC and Clang both implement stack protector support based on Thread Local Storage (TLS) variables, and this is used in the kernel to implement per-task stack cookies, by copying a task's stack cookie into a per-CPU variable every time it is scheduled in.
Both now also implement -mstack-protector-guard-symbol=, which permits the TLS variable to be specified directly. This is useful because it will allow to move away from using a fixed offset of 40 bytes into the per-CPU area on
x86_64, which requires a lot of special handling in the per-CPU code and the runtime relocation code.However, while GCC is rather lax in its implementation of this command line option, Clang actually requires that the provided symbol name refers to a TLS variable (i.e., one declared with
__thread), although it also permits the variable to be undeclared entirely, in which case it will use an implicit declaration of the right type.The upshot of this is that Clang will emit the correct references to the stack cookie variable in most cases, e.g.,
10d: 64 a1 00 00 00 00 mov %fs:0x0,%eax
10f: R_386_32 __stack_chk_guardHowever, if a non-TLS definition of the symbol in question is visible in the same compilation unit (which amounts to the whole of vmlinux if LTO is enabled), it will drop the per-CPU prefix and emit a load from a bogus address.
Work around this by using a symbol name that never occurs in C code, and emit it as an alias in the linker script.
Fixes 3fb0fdb3bbe7 ("x86/stackprotector/32: Make the canary into a regular percpu variable")Signed-off-by Ard Biesheuvel <[email protected]>Signed-off-by Brian Gerst <[email protected]>Signed-off-by Borislav Petkov (AMD) <[email protected]>Reviewed-by Nathan Chancellor <[email protected]>Tested-by Nathan Chancellor <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- arch/x86/Makefile | 3 ++- arch/x86/entry/entry.S | 15 +++++++++++++++ arch/x86/include/asm/asm-prototypes.h | 3 +++ arch/x86/kernel/cpu/common.c | 2 ++ arch/x86/kernel/vmlinux.lds.S | 3 +++ 5 files changed, 25 insertions(+), 1 deletion(-)arch/x86/Makefile +2
-1@@ -90,7 +90,8 @@ ifeq ($(CONFIG_X86_32),y) ifeq ($(CONFIG_STACKPROTECTOR),y) ifeq ($(CONFIG_SMP),y) - KBUILD_CFLAGS += -mstack-protector-guard-reg=fs -mstack-protector-guard-symbol=__stack_chk_guard + KBUILD_CFLAGS += -mstack-protector-guard-reg=fs \ + -mstack-protector-guard-symbol=__ref_stack_chk_guard else KBUILD_CFLAGS += -mstack-protector-guard=global endifarch/x86/entry/entry.S +15
-0@@ -48,3 +48,18 @@ EXPORT_SYMBOL_GPL(mds_verw_sel); .popsection +#ifndef CONFIG_X86_64 +/* + * Clang's implementation of TLS stack cookies requires the variable in + * question to be a TLS variable. If the variable happens to be defined as an + * ordinary variable with external linkage in the same compilation unit (which + * amounts to the whole of vmlinux with LTO enabled), Clang will drop the + * segment register prefix from the references, resulting in broken code. Work + * around this by avoiding the symbol used in -mstack-protector-guard-symbol= + * entirely in the C code, and use an alias emitted by the linker script + * instead. + */ +#ifdef CONFIG_STACKPROTECTOR +EXPORT_SYMBOL(__ref_stack_chk_guard); +#endif +#endifarch/x86/include/asm/asm-prototypes.h +3
-0@@ -18,3 +18,6 @@extern void cmpxchg8b_emu (void );#endif +#if defined(__GENKSYMS__) && defined(CONFIG_STACKPROTECTOR ) +extern unsigned long __ref_stack_chk_guard; +#endif arch/x86/kernel/cpu/common.c +2
-0@@ -1974,8 +1974,10 @@ EXPORT_PER_CPU_SYMBOL(cpu_current_top_of_stack);#ifdef CONFIG_STACKPROTECTOR DEFINE_PER_CPU(unsigned long, __stack_chk_guard); +#ifndef CONFIG_SMP EXPORT_PER_CPU_SYMBOL (__stack_chk_guard);#endif +#endif #endif /* CONFIG_X86_64 */ arch/x86/kernel/vmlinux.lds.S +3
-1@@ -490,6 +490,9 @@ SECTIONS ASSERT(SIZEOF(.rela.dyn) == 0, "Unexpected run-time relocations (.rela) detected!") } +/* needed for Clang - see arch/x86/entry/entry.S */ +PROVIDE(__ref_stack_chk_guard = __stack_chk_guard); + #ifdef CONFIG_X86_32 /* * The ASSERT() sink to . is intentional, for binutils 2.14 compatibility: --2.43.0
Greg Kroah-Hartman
maintainerRe: [PATCH 5.10 051/459] x86/stackprotector: Work around strict Clang TLS symbol requirements
Quoted 3 lines · Ard Biesheuvel
NAK
See other replies re this backport
Dropped from all queues now, thanks!
greg k-h
Greg Kroah-Hartman
maintainerPATCH 52/459 cifs: Fix buffer overflow when parsing NFS reparse points
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pali Rohár <[email protected]>
commit e2a8910af01653c1c268984855629d71fb81f404 upstream.
ReparseDataLength is sum of the InodeType size and DataBuffer size. So to get DataBuffer size it is needed to subtract InodeType's size from ReparseDataLength.
Function cifs_strndup_from_utf16() is currentlly accessing buf->DataBuffer at position after the end of the buffer because it does not subtract InodeType size from the length. Fix this problem and correctly subtract variable len.
Member InodeType is present only when reparse buffer is large enough. Check for ReparseDataLength before accessing InodeType to prevent another invalid memory access.
Major and minor rdev values are present also only when reparse buffer is large enough. Check for reparse buffer size before calling reparse_mkdev().
[use variable name symlink_buf, the other buf->InodeType accesses are not used in current version so skip]
--- fs/cifs/smb2ops.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/cifs/smb2ops.c +6 -0
@@ -2807,6 +2807,12 @@ parse_reparse_posix(struct reparse_posix_data *symlink_buf,/* See MS-FSCC 2.1.2.6 for the 'NFS' style reparse tags */ len =le16_to_cpu (symlink_buf->ReparseDataLength); +if (len <sizeof (symlink_buf->InodeType)) { +cifs_dbg (VFS ,"srv returned malformed nfs buffer\n" ); +return -EIO ; + } + + len -=sizeof (symlink_buf->InodeType);if (le64_to_cpu (symlink_buf->InodeType) !=NFS_SPECFILE_LNK ) { cifs_dbg(VFS, "%lld not a supported symlink type\n",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/459 nvme: fix metadata handling in nvme-passthrough
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Puranjay Mohan <[email protected]>
[ Upstream commit 7c2fd76048e95dd267055b5f5e0a48e6e7c81fd9 ]
On an NVMe namespace that does not support metadata, it is possible to send an IO command with metadata through io-passthru. This allows issues like [1] to trigger in the completion code path. nvme_map_user_request() doesn't check if the namespace supports metadata before sending it forward. It also allows admin commands with metadata to be processed as it ignores metadata when bdev == NULL and may report success.
Reject an IO command with metadata when the NVMe namespace doesn't support it and reject an admin command if it has metadata.
[1] https://lore.kernel.org/all/[email protected]/
[ Move the changes from nvme_map_user_request() to nvme_submit_user_cmd()
to make it work on 5.10 ]
--- drivers/nvme/host/core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/nvme/host/core.c +6 -1
@@ -1121,11 +1121,16 @@ static int nvme_submit_user_cmd(struct request_queue *q,bool write =nvme_is_write (cmd);struct nvme_ns *ns = q->queuedata;struct gendisk *disk = ns ? ns->disk :NULL ; +bool supports_metadata = disk &&blk_get_integrity (disk); +bool has_metadata = meta_buffer && meta_len;struct request *req;struct bio *bio =NULL ;void *meta =NULL ;int ret; +if (has_metadata && !supports_metadata) +return -EINVAL ; + req =nvme_alloc_request (q, cmd,0 );if (IS_ERR (req))return PTR_ERR (req);
@@ -1141,7 +1146,7 @@ static int nvme_submit_user_cmd(struct request_queue *q, goto out; bio = req->bio; bio->bi_disk = disk; -if (disk && meta_buffer && meta_len) { +if (has_metadata) { meta =nvme_add_user_metadata (bio, meta_buffer, meta_len, meta_seed, write);if (IS_ERR (meta)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/459 x86/barrier: Do not serialize MSR accesses on AMD
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
commit 04c3024560d3a14acd18d0a51a1d0a89d29b7eb5 upstream.
AMD does not have the requirement for a synchronization barrier when acccessing a certain group of MSRs. Do not incur that unnecessary penalty there.
There will be a CPUID bit which explicitly states that a MFENCE is not needed. Once that bit is added to the APM, this will be extended with it.
While at it, move to processor.h to avoid include hell. Untangling that file properly is a matter for another day.
Some notes on the performance aspect of why this is relevant, courtesy of Kishon VijayAbraham <[email protected]>:
On a AMD Zen4 system with 96 cores, a modified ipi-bench[1] on a VM shows x2AVIC IPI rate is 3% to 4% lower than AVIC IPI rate. The ipi-bench is modified so that the IPIs are sent between two vCPUs in the same CCX. This also requires to pin the vCPU to a physical core to prevent any latencies. This simulates the use case of pinning vCPUs to the thread of a single CCX to avoid interrupt IPI latency.
In order to avoid run-to-run variance (for both x2AVIC and AVIC), the below configurations are done:
1) Disable Power States in BIOS (to prevent the system from going to lower power state)
2) Run the system at fixed frequency 2500MHz (to prevent the system from increasing the frequency when the load is more)
With the above configuration:
*) Performance measured using ipi-bench for AVIC:
Average Latency: 1124.98ns [Time to send IPI from one vCPU to another vCPU]
Cumulative throughput: 42.6759M/s [Total number of IPIs sent in a second from
48 vCPUs simultaneously]
*) Performance measured using ipi-bench for x2AVIC:
Average Latency: 1172.42ns [Time to send IPI from one vCPU to another vCPU]
Cumulative throughput: 40.9432M/s [Total number of IPIs sent in a second from
48 vCPUs simultaneously]
Quoted 1 line
From above, x2AVIC latency is ~4% more than AVIC. However, the expectation is
x2AVIC performance to be better or equivalent to AVIC. Upon analyzing the perf captures, it is observed significant time is spent in weak_wrmsr_fence() invoked by x2apic_send_IPI().
With the fix to skip weak_wrmsr_fence()
*) Performance measured using ipi-bench for x2AVIC:
Average Latency: 1117.44ns [Time to send IPI from one vCPU to another vCPU]
Cumulative throughput: 42.9608M/s [Total number of IPIs sent in a second from
48 vCPUs simultaneously]
Comparing the performance of x2AVIC with and without the fix, it can be seen the performance improves by ~4%.
Performance captured using an unmodified ipi-bench using the 'mesh-ipi' option with and without weak_wrmsr_fence() on a Zen4 system also showed significant performance improvement without weak_wrmsr_fence(). The 'mesh-ipi' option ignores CCX or CCD and just picks random vCPU.
Average throughput (10 iterations) with weak_wrmsr_fence(),
Cumulative throughput: 4933374 IPI/s
Average throughput (10 iterations) without weak_wrmsr_fence(),
Cumulative throughput: 6355156 IPI/s
[1] https://github.com/bytedance/kvm-utils/tree/master/microbenchmark/ipi-bench
--- arch/x86/include/asm/barrier.h | 18 ------------------ arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/processor.h | 18 ++++++++++++++++++ arch/x86/kernel/cpu/amd.c | 3 +++ arch/x86/kernel/cpu/common.c | 7 +++++++ arch/x86/kernel/cpu/hygon.c | 3 +++ 6 files changed, 32 insertions(+), 18 deletions(-)
arch/x86/include/asm/barrier.h +0 -18
@@ -84,22 +84,4 @@ do { \#include <asm-generic/barrier.h> -/* -* Make previous memory operations globally visible before -* a WRMSR. -* -* MFENCE makes writes visible, but only affects load/store -* instructions. WRMSR is unfortunately not a load/store -* instruction and is unaffected by MFENCE. The LFENCE ensures -* that the WRMSR is not reordered. -* -* Most WRMSRs are full serializing instructions themselves and -* do not require this barrier. This is only required for the -* IA32_TSC_DEADLINE and X2APIC MSRs. -*/ -static inline void weak_wrmsr_fence (void ) -{ - asmvolatile ("mfence; lfence" : : :"memory" ); -} -#endif /* _ASM_X86_BARRIER_H */
arch/x86/include/asm/cpufeatures.h +1 -0
@@ -305,6 +305,7 @@#define X86_FEATURE_SRSO (11*32+24)/* "" AMD BTB untrain RETs */ #define X86_FEATURE_SRSO_ALIAS (11*32+25)/* "" AMD BTB untrain RETs through aliasing */ #define X86_FEATURE_IBPB_ON_VMEXIT (11*32+26)/* "" Issue an IBPB only on VMEXIT */ +#define X86_FEATURE_APIC_MSRS_FENCE (11*32+27)/* "" IA32_TSC_DEADLINE and X2APIC MSRs need fencing */ /* Intel-defined CPU features, CPUID level 0x00000007:1 (EAX), word 12 */ #define X86_FEATURE_AVX512_BF16 (12*32+ 5)/* AVX512 BFLOAT16 instructions */
arch/x86/include/asm/processor.h +18 -0
@@ -858,4 +858,22 @@ enum mds_mitigations {extern bool gds_ucode_mitigated (void ); +/* +* Make previous memory operations globally visible before +* a WRMSR. +* +* MFENCE makes writes visible, but only affects load/store +* instructions. WRMSR is unfortunately not a load/store +* instruction and is unaffected by MFENCE. The LFENCE ensures +* that the WRMSR is not reordered. +* +* Most WRMSRs are full serializing instructions themselves and +* do not require this barrier. This is only required for the +* IA32_TSC_DEADLINE and X2APIC MSRs. +*/ +static inline void weak_wrmsr_fence (void ) +{ +alternative ("mfence; lfence" ,"" ,ALT_NOT (X86_FEATURE_APIC_MSRS_FENCE )); +} +#endif /* _ASM_X86_PROCESSOR_H */
arch/x86/kernel/cpu/amd.c +3 -0
@@ -1186,6 +1186,9 @@ static void init_amd(struct cpuinfo_x86 *c)if (!cpu_has (c,X86_FEATURE_HYPERVISOR ) &&cpu_has_amd_erratum (c, amd_erratum_1485))msr_set_bit (MSR_ZEN4_BP_CFG ,MSR_ZEN4_BP_CFG_SHARED_BTB_FIX_BIT ); + +/* AMD CPUs don't need fencing after x2APIC/TSC_DEADLINE MSR writes. */ +clear_cpu_cap (c,X86_FEATURE_APIC_MSRS_FENCE ); }#ifdef CONFIG_X86_32
arch/x86/kernel/cpu/common.c +7 -0
@@ -1716,6 +1716,13 @@ static void identify_cpu(struct cpuinfo_x86 *c) c->apicid = apic->phys_pkg_id (c->initial_apicid,0 );#endif + +/* +* Set default APIC and TSC_DEADLINE MSR fencing flag. AMD and +* Hygon will clear it in ->c_init() below. +*/ +set_cpu_cap (c,X86_FEATURE_APIC_MSRS_FENCE ); +/* * Vendor-specific initialization. In this section we * canonicalize the feature flags, meaning if there are
arch/x86/kernel/cpu/hygon.c +3 -0
@@ -363,6 +363,9 @@ static void init_hygon(struct cpuinfo_x86 *c)set_cpu_bug (c,X86_BUG_SYSRET_SS_ATTRS );check_null_seg_clears_base (c); + +/* Hygon CPUs don't need fencing after x2APIC/TSC_DEADLINE MSR writes. */ +clear_cpu_cap (c,X86_FEATURE_APIC_MSRS_FENCE ); }static void cpu_detect_tlb_hygon (struct cpuinfo_x86 *c)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/459 kselftest/arm64: mte: fix printf type warnings about longs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andre Przywara <[email protected]>
[ Upstream commit 96dddb7b9406259baace9a1831e8da155311be6f ]
When checking MTE tags, we print some diagnostic messages when the tests fail. Some variables uses there are "longs", however we only use "%x" for the format specifier.
Update the format specifiers to "%lx", to match the variable types they are supposed to print.
--- tools/testing/selftests/arm64/mte/check_tags_inclusion.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/arm64/mte/check_tags_inclusion.c +2 -2
@@ -57,7 +57,7 @@ static int check_single_included_tags(int mem_type, int mode) ptr = (char *)mte_insert_tags (ptr,BUFFER_SIZE );/* Check tag value */ if (MT_FETCH_TAG ((uintptr_t )ptr) == tag) { -ksft_print_msg ("FAIL: wrong tag = 0x%x with include mask=0x%x\n" , +ksft_print_msg ("FAIL: wrong tag = 0x%lx with include mask=0x%x\n" ,MT_FETCH_TAG ((uintptr_t )ptr),MT_INCLUDE_VALID_TAG (tag)); result =KSFT_FAIL ;
@@ -89,7 +89,7 @@ static int check_multiple_included_tags(int mem_type, int mode) ptr = (char *)mte_insert_tags (ptr,BUFFER_SIZE );/* Check tag value */ if (MT_FETCH_TAG ((uintptr_t )ptr) < tag) { -ksft_print_msg ("FAIL: wrong tag = 0x%x with include mask=0x%x\n" , +ksft_print_msg ("FAIL: wrong tag = 0x%lx with include mask=0x%lx\n" ,MT_FETCH_TAG ((uintptr_t )ptr),MT_INCLUDE_VALID_TAGS (excl_mask)); result =KSFT_FAIL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/459 x86/xen/pvh: Annotate indirect branch as safe
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit 82694854caa8badab7c5d3a19c0139e8b471b1d3 ]
This indirect jump is harmless; annotate it to keep objtool's retpoline validation happy.
Stable-dep-of: e8fbc0d9cab6 ("x86/pvh: Call C code via the kernel virtual mapping")
--- arch/x86/platform/pvh/head.S | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/platform/pvh/head.S +2 -0
@@ -16,6 +16,7 @@ #include <asm/boot.h> #include <asm/processor-flags.h> #include <asm/msr.h> +#include <asm/nospec-branch.h> #include <xen/interface/elfnote.h> __HEAD
@@ -103,6 +104,7 @@ SYM_CODE_START_LOCAL(pvh_start_xen) /* startup_64 expects boot_params in %rsi. */ mov $_pa(pvh_bootparams), %rsi mov $_pa(startup_64), %rax + ANNOTATE_RETPOLINE_SAFE jmp *%rax #else /* CONFIG_X86_64 */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/459 mips: asm: fix warning when disabling MIPS_FP_SUPPORT
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit da09935975c8f8c90d6f57be2422dee5557206cd ]
When MIPS_FP_SUPPORT is disabled, __sanitize_fcr31() is defined as nothing, which triggers a gcc warning:
In file included from kernel/sched/core.c:79:
kernel/sched/core.c: In function 'context_switch':
./arch/mips/include/asm/switch_to.h:114:39: warning: suggest braces around empty body in an 'if' statement [-Wempty-body]
114 | __sanitize_fcr31(next); \
| ^
kernel/sched/core.c:5316:9: note: in expansion of macro 'switch_to'
5316 | switch_to(prev, next, prev);
| ^~~~~~~~~
Fix this by providing an empty body for __sanitize_fcr31() like one is defined for __mips_mt_fpaff_switch_to().
--- arch/mips/include/asm/switch_to.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/include/asm/switch_to.h +1 -1
@@ -97,7 +97,7 @@ do { \ } \ } while (0)#else -# define __sanitize_fcr31 (next) +# define __sanitize_fcr31 (next) do { (void) (next); } while (0)#endif /*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/459 initramfs: avoid filename buffer overrun
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Disseldorp <[email protected]>
[ Upstream commit e017671f534dd3f568db9e47b0583e853d2da9b5 ]
The initramfs filename field is defined in Documentation/driver-api/early-userspace/buffer-format.rst as:
37 cpio_file := ALGN(4) + cpio_header + filename + "\0" + ALGN(4) + data
...
55 ============= ================== =========================
56 Field name Field size Meaning
57 ============= ================== =========================
...
70 c_namesize 8 bytes Length of filename, including final \0
When extracting an initramfs cpio archive, the kernel's do_name() path handler assumes a zero-terminated path at @collected, passing it directly to filp_open() / init_mkdir() / init_mknod().
If a specially crafted cpio entry carries a non-zero-terminated filename and is followed by uninitialized memory, then a file may be created with trailing characters that represent the uninitialized memory. The ability to create an initramfs entry would imply already having full control of the system, so the buffer overrun shouldn't be considered a security vulnerability.
Append the output of the following bash script to an existing initramfs and observe any created /initramfs_test_fname_overrunAA* path. E.g.
./reproducer.sh | gzip >> /myinitramfs
It's easiest to observe non-zero uninitialized memory when the output is gzipped, as it'll overflow the heap allocated @out_buf in __gunzip(), rather than the initrd_start+initrd_size block.
---- reproducer.sh ----
nilchar="A" # change to "\0" to properly zero terminate / pad
magic="070701"
ino=1
mode=$(( 0100777 ))
uid=0
gid=0
nlink=1
mtime=1
filesize=0
devmajor=0
devminor=1
rdevmajor=0
rdevminor=0
csum=0
fname="initramfs_test_fname_overrun"
namelen=$(( ${#fname} + 1 )) # plus one to account for terminator
printf "%s%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%s" \ $magic $ino $mode $uid $gid $nlink $mtime $filesize \ $devmajor $devminor $rdevmajor $rdevminor $namelen $csum $fname
termpadlen=$(( 1 + ((4 - ((110 + $namelen) & 3)) % 4) )) printf "%.s${nilchar}" $(seq 1 $termpadlen) ---- reproducer.sh ----
Symlink filename fields handled in do_symlink() won't overrun past the data segment, due to the explicit zero-termination of the symlink target.
Fix filename buffer overrun by aborting the initramfs FSM if any cpio entry doesn't carry a zero-terminator at the expected (name_len - 1) offset.
--- init/initramfs.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
init/initramfs.c +15 -0
@@ -325,6 +325,15 @@ static int __init do_name(void) { state = SkipIt; next_state = Reset; + +/* name_len > 0 && name_len <= PATH_MAX checked in do_header */ +if (collected[name_len -1 ] !='\0' ) { +pr_err ("initramfs name without nulterm: %.*s\n" , + (int )name_len, collected); +error ("malformed archive" ); +return 1 ; + } +if (strcmp (collected,"TRAILER!!!" ) ==0 ) {free_hash ();return 0 ;
@@ -390,6 +399,12 @@ static int __init do_copy(void)static int __init do_symlink (void ) { +if (collected[name_len -1 ] !='\0' ) { +pr_err ("initramfs symlink without nulterm: %.*s\n" , + (int )name_len, collected); +error ("malformed archive" ); +return 1 ; + } collected[N_ALIGN (name_len) + body_len] ='\0' ;clean_path (collected,0 );init_symlink (collected +N_ALIGN (name_len), collected);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/459 nvme-pci: fix freeing of the HMB descriptor table
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 3c2fb1ca8086eb139b2a551358137525ae8e0d7a ]
The HMB descriptor table is sized to the maximum number of descriptors that could be used for a given device, but __nvme_alloc_host_mem could break out of the loop earlier on memory allocation failure and end up using less descriptors than planned for, which leads to an incorrect size passed to dma_free_coherent.
In practice this was not showing up because the number of descriptors tends to be low and the dma coherent allocator always allocates and frees at least a page.
--- drivers/nvme/host/pci.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/nvme/host/pci.c +9 -7
@@ -147,6 +147,7 @@ struct nvme_dev {/* host memory buffer support: */ u64 host_mem_size;u32 nr_host_mem_descs; +u32 host_mem_descs_size;dma_addr_t host_mem_descs_dma;struct nvme_host_mem_buf_desc *host_mem_descs;void **host_mem_desc_bufs;
@@ -1925,10 +1926,10 @@ static void nvme_free_host_mem(struct nvme_dev *dev)kfree (dev->host_mem_desc_bufs); dev->host_mem_desc_bufs =NULL ; -dma_free_coherent (dev->dev, - dev->nr_host_mem_descs *sizeof (*dev->host_mem_descs), +dma_free_coherent (dev->dev, dev->host_mem_descs_size, dev->host_mem_descs, dev->host_mem_descs_dma); dev->host_mem_descs =NULL ; + dev->host_mem_descs_size =0 ; dev->nr_host_mem_descs =0 ; }
@@ -1936,7 +1937,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, u32 chunk_size) {struct nvme_host_mem_buf_desc *descs; -u32 max_entries, len; +u32 max_entries, len, descs_size;dma_addr_t descs_dma;int i =0 ;void **bufs;
@@ -1949,8 +1950,9 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred,if (dev->ctrl.hmmaxd && dev->ctrl.hmmaxd < max_entries) max_entries = dev->ctrl.hmmaxd; - descs =dma_alloc_coherent (dev->dev, max_entries *sizeof (*descs), - &descs_dma,GFP_KERNEL ); + descs_size = max_entries *sizeof (*descs); + descs =dma_alloc_coherent (dev->dev, descs_size, &descs_dma, +GFP_KERNEL );if (!descs) goto out;
@@ -1979,6 +1981,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, dev->host_mem_size = size; dev->host_mem_descs = descs; dev->host_mem_descs_dma = descs_dma; + dev->host_mem_descs_size = descs_size; dev->host_mem_desc_bufs = bufs;return 0 ;
@@ -1993,8 +1996,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred,kfree (bufs); out_free_descs: -dma_free_coherent (dev->dev, max_entries *sizeof (*descs), descs, - descs_dma); +dma_free_coherent (dev->dev, descs_size, descs, descs_dma); out: dev->host_mem_descs =NULL ;return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/459 m68k: mvme147: Fix SCSI controller IRQ numbers
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <[email protected]>
[ Upstream commit 47bc874427382018fa2e3e982480e156271eee70 ]
Sometime long ago the m68k IRQ code was refactored and the interrupt numbers for SCSI controller on this board ended up wrong, and it hasn't worked since.
The PCC adds 0x40 to the vector for its interrupts so they end up in the user interrupt range. Hence, the kernel number should be the kernel offset for user interrupt range + the PCC interrupt number.
--- arch/m68k/include/asm/mvme147hw.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/m68k/include/asm/mvme147hw.h +2 -2
@@ -93,8 +93,8 @@ struct pcc_regs {#define M147_SCC_B_ADDR 0xfffe3000#define M147_SCC_PCLK 5000000 -#define MVME147_IRQ_SCSI_PORT (IRQ_USER+0x45) -#define MVME147_IRQ_SCSI_DMA (IRQ_USER+0x46) +#define MVME147_IRQ_SCSI_PORT (IRQ_USER + 5) +#define MVME147_IRQ_SCSI_DMA (IRQ_USER + 6)/* SCC interrupts, for MVME147 */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/459 m68k: mvme16x: Add and use "mvme16x.h"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit dcec33c1fc4ab63983d93ffb0d82b68fc5775b88 ]
When building with W=1:
arch/m68k/mvme16x/config.c:208:6: warning: no previous prototype for ‘mvme16x_cons_write’ [-Wmissing-prototypes]
208 | void mvme16x_cons_write(struct console *co, const char *str, unsigned count)
| ^~~~~~~~~~~~~~~~~~
Fix this by introducing a new header file "mvme16x.h" for holding the prototypes of functions implemented in arch/m68k/mvme16x/.
Stable-dep-of: 077b33b9e283 ("m68k: mvme147: Reinstate early console")
--- arch/m68k/kernel/early_printk.c | 4 ++-- arch/m68k/mvme16x/config.c | 2 ++ arch/m68k/mvme16x/mvme16x.h | 6 ++++++ 3 files changed, 10 insertions(+), 2 deletions(-) create mode 100644 arch/m68k/mvme16x/mvme16x.h
arch/m68k/kernel/early_printk.c +2 -2
@@ -12,8 +12,8 @@#include <linux/string.h> #include <asm/setup.h> -extern void mvme16x_cons_write (struct console *co, -const char *str,unsigned count); + +#include "../mvme16x/mvme16x.h" asmlinkage void __init debug_cons_nputs(const char *s, unsigned n);
arch/m68k/mvme16x/config.c +2 -0
@@ -38,6 +38,8 @@#include <asm/machdep.h> #include <asm/mvme16xhw.h> +#include "mvme16x.h" +extern t_bdid mvme_bdid;static MK48T08ptr_t volatile rtc = (MK48T08ptr_t )MVME_RTC_BASE ;
arch/m68k/mvme16x/mvme16x.h new file +6 -0
@@ -0,0 +1,6 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +struct console ; + +/* config.c */ +void mvme16x_cons_write (struct console *co,const char *str,unsigned count);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/459 m68k: mvme147: Reinstate early console
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <[email protected]>
[ Upstream commit 077b33b9e2833ff25050d986178a2c4c4036cbac ]
Commit a38eaa07a0ce ("m68k/mvme147: config.c - Remove unused functions"), removed the console functionality for the mvme147 instead of wiring it up to an early console. Put the console write function back and wire it up like mvme16x does so it's possible to see Linux boot on this fine hardware once more.
--- arch/m68k/kernel/early_printk.c | 5 ++++- arch/m68k/mvme147/config.c | 30 ++++++++++++++++++++++++++++++ arch/m68k/mvme147/mvme147.h | 6 ++++++ 3 files changed, 40 insertions(+), 1 deletion(-) create mode 100644 arch/m68k/mvme147/mvme147.h
arch/m68k/kernel/early_printk.c +4 -1
@@ -13,6 +13,7 @@#include <asm/setup.h> +#include "../mvme147/mvme147.h" #include "../mvme16x/mvme16x.h" asmlinkage void __init debug_cons_nputs(const char *s, unsigned n);
@@ -22,7 +23,9 @@ static void __ref debug_cons_write(struct console *c, {#if !(defined(CONFIG_SUN3 ) || defined(CONFIG_M68000 ) || \ defined(CONFIG_COLDFIRE )) -if (MACH_IS_MVME16x) +if (MACH_IS_MVME147 ) +mvme147_scc_write (c, s, n); +else if (MACH_IS_MVME16x)mvme16x_cons_write (c, s, n);else debug_cons_nputs (s, n);
arch/m68k/mvme147/config.c +30 -0
@@ -35,6 +35,7 @@#include <asm/machdep.h> #include <asm/mvme147hw.h> +#include "mvme147.h" static void mvme147_get_model (char *model);extern void mvme147_sched_init (irq_handler_t handler);
@@ -188,3 +189,32 @@ int mvme147_hwclk(int op, struct rtc_time *t) }return 0 ; } + +static void scc_delay (void ) +{ + __asm__ __volatile__ ("nop; nop;" ); +} + +static void scc_write (char ch) +{ +do { +scc_delay (); + }while (!(in_8 (M147_SCC_A_ADDR ) &BIT (2 ))); +scc_delay (); +out_8 (M147_SCC_A_ADDR ,8 ); +scc_delay (); +out_8 (M147_SCC_A_ADDR , ch); +} + +void mvme147_scc_write (struct console *co,const char *str,unsigned int count) +{ +unsigned long flags; + +local_irq_save (flags); +while (count--) { +if (*str =='\n' ) +scc_write ('\r' ); +scc_write (*str++); + } +local_irq_restore (flags); +}
arch/m68k/mvme147/mvme147.h new file +6 -0
@@ -0,0 +1,6 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +struct console ; + +/* config.c */ +void mvme147_scc_write (struct console *co,const char *str,unsigned int count);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/459 arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit 340fd66c856651d8c1d29f392dd26ad674d2db0e ]
Commit be2881824ae9 ("arm64/build: Assert for unwanted sections") introduced an assertion to ensure that the .data.rel.ro section does not exist.
However, this check does not work when CONFIG_LTO_CLANG is enabled, because .data.rel.ro matches the .data.[0-9a-zA-Z_]* pattern in the DATA_MAIN macro.
Move the ASSERT() above the RW_DATA() line.
--- arch/arm64/kernel/vmlinux.lds.S | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/kernel/vmlinux.lds.S +3 -3
@@ -228,6 +228,9 @@ SECTIONS __initdata_end = .; __init_end = .; + .data.rel.ro : { *(.data.rel.ro) } + ASSERT(SIZEOF(.data.rel.ro) == 0, "Unexpected RELRO detected!") + _data = .; _sdata = .; RW_DATA(L1_CACHE_BYTES, PAGE_SIZE, THREAD_ALIGN)
@@ -279,9 +282,6 @@ SECTIONS *(.plt) *(.plt.*) *(.iplt) *(.igot .igot.plt) } ASSERT(SIZEOF(.plt) == 0, "Unexpected run-time procedure linkages detected!") - - .data.rel.ro : { *(.data.rel.ro) } - ASSERT(SIZEOF(.data.rel.ro) == 0, "Unexpected RELRO detected!") } #include "image-vars.h"
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/459 acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit 1a9de2f6fda69d5f105dd8af776856a66abdaa64 ]
In case of error in gtdt_parse_timer_block() invalid 'gtdt_frame' will be used in 'do {} while (i-- >= 0 && gtdt_frame--);' statement block because do{} block will be executed even if 'i == 0'.
Adjust error handling procedure by replacing 'i-- >= 0' with 'i-- > 0'.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/acpi/arm64/gtdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/arm64/gtdt.c +1 -1
@@ -283,7 +283,7 @@ static int __init gtdt_parse_timer_block(struct acpi_gtdt_timer_block *block,if (frame->virt_irq >0 )acpi_unregister_gsi (gtdt_frame->virtual_timer_interrupt); frame->virt_irq =0 ; - }while (i-- >=0 && gtdt_frame--); + }while (i-- >0 && gtdt_frame--);return -EINVAL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/459 s390/syscalls: Avoid creation of arch/arch/ directory
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit 0708967e2d56e370231fd07defa0d69f9ad125e8 ]
Building the kernel with ARCH=s390 creates a weird arch/arch/ directory.
$ find arch/arch arch/arch arch/arch/s390 arch/arch/s390/include arch/arch/s390/include/generated arch/arch/s390/include/generated/asm arch/arch/s390/include/generated/uapi arch/arch/s390/include/generated/uapi/asm
The root cause is 'targets' in arch/s390/kernel/syscalls/Makefile, where the relative path is incorrect.
Strictly speaking, 'targets' was not necessary in the first place because this Makefile uses 'filechk' instead of 'if_changed'.
However, this commit keeps it, as it will be useful when converting 'filechk' to 'if_changed' later.
--- arch/s390/kernel/syscalls/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/kernel/syscalls/Makefile +1 -1
@@ -12,7 +12,7 @@ kapi-hdrs-y := $(kapi)/unistd_nr.h uapi-hdrs-y := $(uapi)/unistd_32.h uapi-hdrs-y += $(uapi)/unistd_64.h -targets += $(addprefix ../../../,$(gen-y) $(kapi-hdrs-y) $(uapi-hdrs-y)) +targets += $(addprefix ../../../../,$(gen-y) $(kapi-hdrs-y) $(uapi-hdrs-y)) PHONY += kapi uapi
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/459 hfsplus: dont query the device logical block size multiple times
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
[ Upstream commit 1c82587cb57687de3f18ab4b98a8850c789bedcf ]
Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE.
While this may cause other issues like IO being rejected, in the case of hfsplus, it will allocate a block by using that size and potentially write out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the latter function reads a different io_size.
Using a new min_io_size initally set to sb_min_blocksize works for the purposes of the original fix, since it will be set to the max between HFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the max between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not initialized.
Tested by mounting an hfsplus filesystem with loop block sizes 512, 1024 and 4096.
The produced KASAN report before the fix looks like this:
[ 419.944641] ================================================================== [ 419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a [ 419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678 [ 419.947612] [ 419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84 [ 419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 419.950035] Call Trace: [ 419.950384] <TASK> [ 419.950676] dump_stack_lvl+0x57/0x78 [ 419.951212] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.951830] print_report+0x14c/0x49e [ 419.952361] ? __virt_addr_valid+0x267/0x278 [ 419.952979] ? kmem_cache_debug_flags+0xc/0x1d [ 419.953561] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.954231] kasan_report+0x89/0xb0 [ 419.954748] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.955367] hfsplus_read_wrapper+0x659/0xa0a [ 419.955948] ? __pfx_hfsplus_read_wrapper+0x10/0x10 [ 419.956618] ? do_raw_spin_unlock+0x59/0x1a9 [ 419.957214] ? _raw_spin_unlock+0x1a/0x2e [ 419.957772] hfsplus_fill_super+0x348/0x1590 [ 419.958355] ? hlock_class+0x4c/0x109 [ 419.958867] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.959499] ? __pfx_string+0x10/0x10 [ 419.960006] ? lock_acquire+0x3e2/0x454 [ 419.960532] ? bdev_name.constprop.0+0xce/0x243 [ 419.961129] ? __pfx_bdev_name.constprop.0+0x10/0x10 [ 419.961799] ? pointer+0x3f0/0x62f [ 419.962277] ? __pfx_pointer+0x10/0x10 [ 419.962761] ? vsnprintf+0x6c4/0xfba [ 419.963178] ? __pfx_vsnprintf+0x10/0x10 [ 419.963621] ? setup_bdev_super+0x376/0x3b3 [ 419.964029] ? snprintf+0x9d/0xd2 [ 419.964344] ? __pfx_snprintf+0x10/0x10 [ 419.964675] ? lock_acquired+0x45c/0x5e9 [ 419.965016] ? set_blocksize+0x139/0x1c1 [ 419.965381] ? sb_set_blocksize+0x6d/0xae [ 419.965742] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.966179] mount_bdev+0x12f/0x1bf [ 419.966512] ? __pfx_mount_bdev+0x10/0x10 [ 419.966886] ? vfs_parse_fs_string+0xce/0x111 [ 419.967293] ? __pfx_vfs_parse_fs_string+0x10/0x10 [ 419.967702] ? __pfx_hfsplus_mount+0x10/0x10 [ 419.968073] legacy_get_tree+0x104/0x178 [ 419.968414] vfs_get_tree+0x86/0x296 [ 419.968751] path_mount+0xba3/0xd0b [ 419.969157] ? __pfx_path_mount+0x10/0x10 [ 419.969594] ? kmem_cache_free+0x1e2/0x260 [ 419.970311] do_mount+0x99/0xe0 [ 419.970630] ? __pfx_do_mount+0x10/0x10 [ 419.971008] __do_sys_mount+0x199/0x1c9 [ 419.971397] do_syscall_64+0xd0/0x135 [ 419.971761] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 419.972233] RIP: 0033:0x7c3cb812972e [ 419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48 [ 419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e [ 419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI: 00007ffe306325d0 [ 419.976363] RBP: 00007ffe30632720 R08: 00007ffe30632610 R09: 0000000000000000 [ 419.977034] R10: 0000000000200008 R11: 0000000000000286 R12: 0000000000000000 [ 419.977713] R13: 00007ffe306328e8 R14: 00005a0eb298bc68 R15: 00007c3cb8356000 [ 419.978375] </TASK> [ 419.978589]
--- fs/hfsplus/hfsplus_fs.h | 3 ++- fs/hfsplus/wrapper.c | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-)
fs/hfsplus/hfsplus_fs.h +2 -1
@@ -156,6 +156,7 @@ struct hfsplus_sb_info {/* Runtime variables */ u32 blockoffset; +u32 min_io_size;sector_t part_start;sector_t sect_count;int fs_shift;
@@ -306,7 +307,7 @@ struct hfsplus_readdir_data {*/ static inline unsigned short hfsplus_min_io_size (struct super_block *sb) { - return max_t(unsigned short, bdev_logical_block_size(sb->s_bdev), + return max_t(unsigned short, HFSPLUS_SB(sb)->min_io_size,HFSPLUS_SECTOR_SIZE ); }
fs/hfsplus/wrapper.c +2 -0
@@ -173,6 +173,8 @@ int hfsplus_read_wrapper(struct super_block *sb)if (!blocksize) goto out; + sbi->min_io_size = blocksize; +if (hfsplus_get_last_session (sb, &part_start, &part_size)) goto out;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/459 crypto: caam - Fix the pointer passed to caam_qi_shutdown()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit ad980b04f51f7fb503530bd1cb328ba5e75a250e ]
The type of the last parameter given to devm_add_action_or_reset() is "struct caam_drv_private *", but in caam_qi_shutdown(), it is casted to "struct device *".
Pass the correct parameter to devm_add_action_or_reset() so that the resources are released as expected.
--- drivers/crypto/caam/qi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/caam/qi.c +1 -1
@@ -768,7 +768,7 @@ int caam_qi_init(struct platform_device *caam_pdev)caam_debugfs_qi_init (ctrlpriv); - err =devm_add_action_or_reset (qidev, caam_qi_shutdown, ctrlpriv); + err =devm_add_action_or_reset (qidev, caam_qi_shutdown, qidev);if (err)return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/459 firmware: google: Unregister driver_info on failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Can <[email protected]>
[ Upstream commit 32b0901e141f6d4cf49d820b53eb09b88b1f72f7 ]
When platform_device_register_full() returns error, the gsmi_init() returns without unregister gsmi_driver_info, fix by add missing platform_driver_unregister() when platform_device_register_full() failed.
--- drivers/firmware/google/gsmi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/firmware/google/gsmi.c +4 -2
@@ -917,7 +917,8 @@ static __init int gsmi_init(void) gsmi_dev.pdev =platform_device_register_full (&gsmi_dev_info);if (IS_ERR (gsmi_dev.pdev)) {printk (KERN_ERR "gsmi: unable to register platform device\n" ); -return PTR_ERR (gsmi_dev.pdev); + ret =PTR_ERR (gsmi_dev.pdev); + goto out_unregister; }/* SMI access needs to be serialized */
@@ -1044,10 +1045,11 @@ static __init int gsmi_init(void)gsmi_buf_free (gsmi_dev.name_buf);dma_pool_destroy (gsmi_dev.dma_pool);platform_device_unregister (gsmi_dev.pdev); -pr_info ("gsmi: failed to load: %d\n" , ret); +out_unregister:#ifdef CONFIG_PM platform_driver_unregister (&gsmi_driver_info);#endif +pr_info ("gsmi: failed to load: %d\n" , ret);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/459 EDAC/bluefield: Fix potential integer overflow
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thompson <[email protected]>
[ Upstream commit 1fe774a93b46bb029b8f6fa9d1f25affa53f06c6 ]
The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx left-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx defined as 32-bits wide the left-shift operation truncates the upper 16 bits of information during the calculation of the SMC argument.
The mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any potential integer overflow, i.e. loss of data from upper 16 bits.
--- drivers/edac/bluefield_edac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/edac/bluefield_edac.c +1 -1
@@ -180,7 +180,7 @@ static void bluefield_edac_check(struct mem_ctl_info *mci)static void bluefield_edac_init_dimms (struct mem_ctl_info *mci) {struct bluefield_edac_priv *priv = mci->pvt_info; -int mem_ctrl_idx = mci->mc_idx; +u64 mem_ctrl_idx = mci->mc_idx;struct dimm_info *dimm;u64 smc_info, smc_arg;int is_empty =1 , i;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/459 EDAC/fsl_ddr: Fix bad bit shift operations
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Priyanka Singh <[email protected]>
[ Upstream commit 9ec22ac4fe766c6abba845290d5139a3fbe0153b ]
Fix undefined behavior caused by left-shifting a negative value in the expression:
cap_high ^ (1 << (bad_data_bit - 32))
The variable bad_data_bit ranges from 0 to 63. When it is less than 32, bad_data_bit - 32 becomes negative, and left-shifting by a negative value in C is undefined behavior.
Fix this by combining cap_high and cap_low into a 64-bit variable.
[ bp: Massage commit message, simplify error bits handling. ]
--- drivers/edac/fsl_ddr_edac.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-)
drivers/edac/fsl_ddr_edac.c +13 -9
@@ -331,21 +331,25 @@ static void fsl_mc_check(struct mem_ctl_info *mci)* TODO: Add support for 32-bit wide buses */ if ((err_detect &DDR_EDE_SBE ) && (bus_width ==64 )) { +u64 cap = (u64 )cap_high <<32 | cap_low; +u32 s = syndrome; +sbe_ecc_decode (cap_high, cap_low, syndrome, &bad_data_bit, &bad_ecc_bit); -if (bad_data_bit !=-1 ) -fsl_mc_printk (mci,KERN_ERR , -"Faulty Data bit: %d\n" , bad_data_bit); -if (bad_ecc_bit !=-1 ) -fsl_mc_printk (mci,KERN_ERR , -"Faulty ECC bit: %d\n" , bad_ecc_bit); +if (bad_data_bit >=0 ) { +fsl_mc_printk (mci,KERN_ERR ,"Faulty Data bit: %d\n" , bad_data_bit); + cap ^=1ULL << bad_data_bit; + } + +if (bad_ecc_bit >=0 ) { +fsl_mc_printk (mci,KERN_ERR ,"Faulty ECC bit: %d\n" , bad_ecc_bit); + s ^=1 << bad_ecc_bit; + }fsl_mc_printk (mci,KERN_ERR ,"Expected Data / ECC:\t%#8.8x_%08x / %#2.2x\n" , - cap_high ^ (1 << (bad_data_bit -32 )), - cap_low ^ (1 << bad_data_bit), - syndrome ^ (1 << bad_ecc_bit)); +upper_32_bits (cap),lower_32_bits (cap), s); } fsl_mc_printk(mci, KERN_ERR,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/459 crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Yang <[email protected]>
[ Upstream commit 662f2f13e66d3883b9238b0b96b17886179e60e2 ]
Since commit 8f4f68e788c3 ("crypto: pcrypt - Fix hungtask for PADATA_RESET"), the pcrypt encryption and decryption operations return -EAGAIN when the CPU goes online or offline. In alg_test(), a WARN is generated when pcrypt_aead_decrypt() or pcrypt_aead_encrypt() returns -EAGAIN, the unnecessary panic will occur when panic_on_warn set 1. Fix this issue by calling crypto layer directly without parallelization in that case.
--- crypto/pcrypt.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
crypto/pcrypt.c +8 -4
@@ -117,8 +117,10 @@ static int pcrypt_aead_encrypt(struct aead_request *req) err =padata_do_parallel (ictx->psenc, padata, &ctx->cb_cpu);if (!err)return -EINPROGRESS ; -if (err == -EBUSY ) -return -EAGAIN ; +if (err == -EBUSY ) { +/* try non-parallel mode */ +return crypto_aead_encrypt (creq); + }return err; }
@@ -166,8 +168,10 @@ static int pcrypt_aead_decrypt(struct aead_request *req) err =padata_do_parallel (ictx->psdec, padata, &ctx->cb_cpu);if (!err)return -EINPROGRESS ; -if (err == -EBUSY ) -return -EAGAIN ; +if (err == -EBUSY ) { +/* try non-parallel mode */ +return crypto_aead_decrypt (creq); + }return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/459 crypto: cavium - Fix the if condition to exit loop after timeout
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Everest K.C <[email protected]>
[ Upstream commit 53d91ca76b6c426c546542a44c78507b42008c9e ]
The while loop breaks in the first run because of incorrect if condition. It also causes the statements after the if to appear dead.
Fix this by changing the condition from if(timeout--) to if(!timeout--).
This bug was reported by Coverity Scan.
Report:
CID 1600859: (#1 of 1): Logically dead code (DEADCODE)dead_error_line: Execution cannot reach this statement: udelay(30UL);
--- drivers/crypto/cavium/cpt/cptpf_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/crypto/cavium/cpt/cptpf_main.c +2 -2
@@ -45,7 +45,7 @@ static void cpt_disable_cores(struct cpt_device *cpt, u64 coremask,dev_err (dev,"Cores still busy %llx" , coremask); grp =cpt_read_csr64 (cpt->reg_base,CPTX_PF_EXEC_BUSY (0 )); -if (timeout--) +if (!timeout--)break ;udelay (CSR_DELAY );
@@ -395,7 +395,7 @@ static void cpt_disable_all_cores(struct cpt_device *cpt)dev_err (dev,"Cores still busy" ); grp =cpt_read_csr64 (cpt->reg_base,CPTX_PF_EXEC_BUSY (0 )); -if (timeout--) +if (!timeout--)break ;udelay (CSR_DELAY );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/459 crypto: caam - add error check to caam_rsa_set_priv_key_form
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
[ Upstream commit b64140c74e954f1db6eae5548ca3a1f41b6fad79 ]
The caam_rsa_set_priv_key_form did not check for memory allocation errors. Add the checks to the caam_rsa_set_priv_key_form functions.
--- drivers/crypto/caam/caampkc.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/crypto/caam/caampkc.c +7 -4
@@ -975,7 +975,7 @@ static int caam_rsa_set_pub_key(struct crypto_akcipher *tfm, const void *key,return -ENOMEM ; } -static void caam_rsa_set_priv_key_form (struct caam_rsa_ctx *ctx, +static int caam_rsa_set_priv_key_form (struct caam_rsa_ctx *ctx,struct rsa_key *raw_key) {struct caam_rsa_key *rsa_key = &ctx->key;
@@ -984,7 +984,7 @@ static void caam_rsa_set_priv_key_form(struct caam_rsa_ctx *ctx, rsa_key->p =caam_read_raw_data (raw_key->p, &p_sz);if (!rsa_key->p) -return ; +return -ENOMEM ; rsa_key->p_sz = p_sz; rsa_key->q =caam_read_raw_data (raw_key->q, &q_sz);
@@ -1017,7 +1017,7 @@ static void caam_rsa_set_priv_key_form(struct caam_rsa_ctx *ctx, rsa_key->priv_form =FORM3 ; -return ; +return 0 ; free_dq:kfree_sensitive (rsa_key->dq);
@@ -1031,6 +1031,7 @@ static void caam_rsa_set_priv_key_form(struct caam_rsa_ctx *ctx,kfree_sensitive (rsa_key->q); free_p:kfree_sensitive (rsa_key->p); +return -ENOMEM ; } static int caam_rsa_set_priv_key(struct crypto_akcipher *tfm, const void *key,
@@ -1076,7 +1077,9 @@ static int caam_rsa_set_priv_key(struct crypto_akcipher *tfm, const void *key, rsa_key->e_sz = raw_key.e_sz; rsa_key->n_sz = raw_key.n_sz; -caam_rsa_set_priv_key_form (ctx, &raw_key); + ret =caam_rsa_set_priv_key_form (ctx, &raw_key); +if (ret) + goto err;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/459 crypto: bcm - add error check in the ahash_hmac_init function
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
[ Upstream commit 19630cf57233e845b6ac57c9c969a4888925467b ]
The ahash_init functions may return fails. The ahash_hmac_init should not return ok when ahash_init returns error. For an example, ahash_init will return -ENOMEM when allocation memory is error.
--- drivers/crypto/bcm/cipher.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/crypto/bcm/cipher.c +4 -1
@@ -2417,6 +2417,7 @@ static int ahash_hmac_setkey(struct crypto_ahash *ahash, const u8 *key,static int ahash_hmac_init (struct ahash_request *req) { +int ret;struct iproc_reqctx_s *rctx =ahash_request_ctx (req);struct crypto_ahash *tfm =crypto_ahash_reqtfm (req);struct iproc_ctx_s *ctx =crypto_ahash_ctx (tfm);
@@ -2426,7 +2427,9 @@ static int ahash_hmac_init(struct ahash_request *req)flow_log ("ahash_hmac_init()\n" );/* init the context as a hash */ -ahash_init (req); + ret =ahash_init (req); +if (ret) +return ret;if (!spu_no_incr_hash (ctx)) {/* SPU-M can do incr hashing but needs sw for outer HMAC */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/459 crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 572b7cf08403b6c67dfe0dc3e0f2efb42443254f ]
If do_cpt_init() fails, a previous dma_alloc_coherent() call needs to be undone.
Add the needed dma_free_coherent() before returning.
--- drivers/crypto/cavium/cpt/cptpf_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/crypto/cavium/cpt/cptpf_main.c +2 -0
@@ -303,6 +303,8 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae) ret =do_cpt_init (cpt, mcode);if (ret) { +dma_free_coherent (&cpt->pdev->dev, mcode->code_size, + mcode->code, mcode->phys_base);dev_err (dev,"do_cpt_init failed with ret: %d\n" , ret); goto fw_release; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/459 time: Fix references to _msecs_to_jiffies() handling of values
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
[ Upstream commit 92b043fd995a63a57aae29ff85a39b6f30cd440c ]
The details about the handling of the "normal" values were moved to the _msecs_to_jiffies() helpers in commit ca42aaf0c861 ("time:
Refactor msecs_to_jiffies"). However, the same commit still mentioned __msecs_to_jiffies() in the added documentation.
Thus point to _msecs_to_jiffies() instead.
--- include/linux/jiffies.h | 2 +- kernel/time/time.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
include/linux/jiffies.h +1 -1
@@ -349,7 +349,7 @@ static inline unsigned long _msecs_to_jiffies(const unsigned int m)* - all other values are converted to jiffies by either multiplying * the input value by a factor or dividing it with a factor and * handling any 32-bit overflows. -* for the details see __msecs_to_jiffies() +* for the details see _msecs_to_jiffies() * * msecs_to_jiffies() checks for the passed in value being a constant * via __builtin_constant_p() allowing gcc to eliminate most of the
kernel/time/time.c +1 -1
@@ -539,7 +539,7 @@ EXPORT_SYMBOL(ns_to_timespec64);* - all other values are converted to jiffies by either multiplying * the input value by a factor or dividing it with a factor and * handling any 32-bit overflows. -* for the details see __msecs_to_jiffies() +* for the details see _msecs_to_jiffies() * * msecs_to_jiffies() checks for the passed in value being a constant * via __builtin_constant_p() allowing gcc to eliminate most of the
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/459 kcsan, seqlock: Fix incorrect assumption in read_seqbegin()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Elver <[email protected]>
[ Upstream commit 183ec5f26b2fc97a4a9871865bfe9b33c41fddb2 ]
During testing of the preceding changes, I noticed that in some cases, current->kcsan_ctx.in_flat_atomic remained true until task exit. This is obviously wrong, because _all_ accesses for the given task will be treated as atomic, resulting in false negatives i.e. missed data races.
Debugging led to fs/dcache.c, where we can see this usage of seqlock:
struct dentry *d_lookup(const struct dentry *parent, const struct qstr *name)
{
struct dentry *dentry;
unsigned seq;
do {
seq = read_seqbegin(&rename_lock);
dentry = __d_lookup(parent, name);
if (dentry)
break;
} while (read_seqretry(&rename_lock, seq));
[...]As can be seen, read_seqretry() is never called if dentry != NULL; consequently, current->kcsan_ctx.in_flat_atomic will never be reset to false by read_seqretry().
Give up on the wrong assumption of "assume closing read_seqretry()", and rely on the already-present annotations in read_seqcount_begin/retry().
--- include/linux/seqlock.h | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-)
include/linux/seqlock.h +1 -11
@@ -832,11 +832,7 @@ typedef struct {*/ static inline unsigned read_seqbegin (const seqlock_t *sl) { -unsigned ret =read_seqcount_begin (&sl->seqcount); - -kcsan_atomic_next (0 );/* non-raw usage, assume closing read_seqretry() */ -kcsan_flat_atomic_begin (); -return ret; +return read_seqcount_begin (&sl->seqcount); }/**
@@ -852,12 +848,6 @@ static inline unsigned read_seqbegin(const seqlock_t *sl)*/ static inline unsigned read_seqretry (const seqlock_t *sl,unsigned start) { -/* -* Assume not nested: read_seqretry() may be called multiple times when -* completing read critical section. -*/ -kcsan_flat_atomic_end (); -return read_seqcount_retry (&sl->seqcount, start); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/459 clkdev: remove CONFIG_CLKDEV_LOOKUP
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 2f4574dd6dd19eb3e8ab0415a3ae960d04be3a65 ]
This option is now synonymous with CONFIG_HAVE_CLK, so use the latter globally. Any out-of-tree platform ports that still use a private clk_get()/clk_put() implementation should move to CONFIG_COMMON_CLK.
Stable-dep-of: 0309f714a090 ("clocksource/drivers:sp804: Make user selectable")
--- arch/arm/Kconfig | 2 -- arch/mips/Kconfig | 3 --- arch/mips/pic32/Kconfig | 1 - arch/sh/Kconfig | 1 - drivers/clk/Kconfig | 6 +----- drivers/clk/Makefile | 3 +-- drivers/clocksource/Kconfig | 6 +++--- drivers/mmc/host/Kconfig | 4 ++-- drivers/staging/board/Kconfig | 2 +- sound/soc/dwc/Kconfig | 2 +- sound/soc/rockchip/Kconfig | 14 +++++++------- 11 files changed, 16 insertions(+), 28 deletions(-)
arch/arm/Kconfig +0 -2
@@ -366,7 +366,6 @@ config ARCH_EP93XX imply ARM_PATCH_PHYS_VIRT select ARM_VIC select AUTO_ZRELADDR - select CLKDEV_LOOKUP select CLKSRC_MMIO select CPU_ARM920T select GENERIC_CLOCKEVENTS
@@ -523,7 +522,6 @@ config ARCH_OMAP1 bool "TI OMAP1" depends on MMU select ARCH_OMAP - select CLKDEV_LOOKUP select CLKSRC_MMIO select GENERIC_CLOCKEVENTS select GENERIC_IRQ_CHIP
arch/mips/Kconfig +0 -3
@@ -327,7 +327,6 @@ config BCM63XX select SWAP_IO_SPACE select GPIOLIB select MIPS_L1_CACHE_SHIFT_4 - select CLKDEV_LOOKUP select HAVE_LEGACY_CLK help Support for BCM63XX based boards
@@ -442,7 +441,6 @@ config LANTIQ select GPIOLIB select SWAP_IO_SPACE select BOOT_RAW - select CLKDEV_LOOKUP select HAVE_LEGACY_CLK select USE_OF select PINCTRL
@@ -627,7 +625,6 @@ config RALINK select SYS_SUPPORTS_MIPS16 select SYS_SUPPORTS_ZBOOT select SYS_HAS_EARLY_PRINTK - select CLKDEV_LOOKUP select ARCH_HAS_RESET_CONTROLLER select RESET_CONTROLLER
arch/mips/pic32/Kconfig +0 -1
@@ -17,7 +17,6 @@ config PIC32MZDA select SYS_SUPPORTS_LITTLE_ENDIAN select GPIOLIB select COMMON_CLK - select CLKDEV_LOOKUP select LIBFDT select USE_OF select PINCTRL
arch/sh/Kconfig +0 -1
@@ -13,7 +13,6 @@ config SUPERH select ARCH_HIBERNATION_POSSIBLE if MMU select ARCH_MIGHT_HAVE_PC_PARPORT select ARCH_WANT_IPC_PARSE_VERSION - select CLKDEV_LOOKUP select CPU_NO_EFFICIENT_FFS select DMA_DECLARE_COHERENT select GENERIC_ATOMIC64
drivers/clk/Kconfig +1 -5
@@ -6,10 +6,6 @@ config HAVE_CLK The <linux/clk.h> calls support software clock gating and thus are a key power management tool on many systems. -config CLKDEV_LOOKUP - bool - select HAVE_CLK - config HAVE_CLK_PREPARE bool
@@ -26,7 +22,7 @@ menuconfig COMMON_CLK bool "Common Clock Framework" depends on !HAVE_LEGACY_CLK select HAVE_CLK_PREPARE - select CLKDEV_LOOKUP + select HAVE_CLK select SRCU select RATIONAL help
drivers/clk/Makefile +1 -2
@@ -1,7 +1,6 @@ # SPDX-License-Identifier: GPL-2.0 # common clock types -obj-$(CONFIG_HAVE_CLK) += clk-devres.o clk-bulk.o -obj-$(CONFIG_CLKDEV_LOOKUP) += clkdev.o +obj-$(CONFIG_HAVE_CLK) += clk-devres.o clk-bulk.o clkdev.o obj-$(CONFIG_COMMON_CLK) += clk.o obj-$(CONFIG_COMMON_CLK) += clk-divider.o obj-$(CONFIG_COMMON_CLK) += clk-fixed-factor.o
drivers/clocksource/Kconfig +3 -3
@@ -399,7 +399,7 @@ config ARM_GLOBAL_TIMER config ARM_TIMER_SP804 bool "Support for Dual Timer SP804 module" if COMPILE_TEST - depends on GENERIC_SCHED_CLOCK && CLKDEV_LOOKUP + depends on GENERIC_SCHED_CLOCK && HAVE_CLK select CLKSRC_MMIO select TIMER_OF if OF
@@ -617,12 +617,12 @@ config H8300_TPU config CLKSRC_IMX_GPT bool "Clocksource using i.MX GPT" if COMPILE_TEST - depends on (ARM || ARM64) && CLKDEV_LOOKUP + depends on (ARM || ARM64) && HAVE_CLK select CLKSRC_MMIO config CLKSRC_IMX_TPM bool "Clocksource using i.MX TPM" if COMPILE_TEST - depends on (ARM || ARM64) && CLKDEV_LOOKUP + depends on (ARM || ARM64) && HAVE_CLK select CLKSRC_MMIO select TIMER_OF help
drivers/mmc/host/Kconfig +2 -2
@@ -326,7 +326,7 @@ config MMC_SDHCI_SIRF config MMC_SDHCI_PXAV3 tristate "Marvell MMP2 SD Host Controller support (PXAV3)" - depends on CLKDEV_LOOKUP + depends on HAVE_CLK depends on MMC_SDHCI_PLTFM depends on ARCH_BERLIN || ARCH_MMP || ARCH_MVEBU || COMPILE_TEST default CPU_MMP2
@@ -339,7 +339,7 @@ config MMC_SDHCI_PXAV3 config MMC_SDHCI_PXAV2 tristate "Marvell PXA9XX SD Host Controller support (PXAV2)" - depends on CLKDEV_LOOKUP + depends on HAVE_CLK depends on MMC_SDHCI_PLTFM depends on ARCH_MMP || COMPILE_TEST default CPU_PXA910
drivers/staging/board/Kconfig +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 config STAGING_BOARD bool "Staging Board Support" - depends on OF_ADDRESS && OF_IRQ && CLKDEV_LOOKUP + depends on OF_ADDRESS && OF_IRQ && HAVE_CLK help Select to enable per-board staging support code.
sound/soc/dwc/Kconfig +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0-only config SND_DESIGNWARE_I2S tristate "Synopsys I2S Device Driver" - depends on CLKDEV_LOOKUP + depends on HAVE_CLK select SND_SOC_GENERIC_DMAENGINE_PCM help Say Y or M if you want to add support for I2S driver for
sound/soc/rockchip/Kconfig +7 -7
@@ -9,7 +9,7 @@ config SND_SOC_ROCKCHIP config SND_SOC_ROCKCHIP_I2S tristate "Rockchip I2S Device Driver" - depends on CLKDEV_LOOKUP && SND_SOC_ROCKCHIP + depends on HAVE_CLK && SND_SOC_ROCKCHIP select SND_SOC_GENERIC_DMAENGINE_PCM help Say Y or M if you want to add support for I2S driver for
@@ -18,7 +18,7 @@ config SND_SOC_ROCKCHIP_I2S config SND_SOC_ROCKCHIP_PDM tristate "Rockchip PDM Controller Driver" - depends on CLKDEV_LOOKUP && SND_SOC_ROCKCHIP + depends on HAVE_CLK && SND_SOC_ROCKCHIP select SND_SOC_GENERIC_DMAENGINE_PCM select RATIONAL help
@@ -28,7 +28,7 @@ config SND_SOC_ROCKCHIP_PDM config SND_SOC_ROCKCHIP_SPDIF tristate "Rockchip SPDIF Device Driver" - depends on CLKDEV_LOOKUP && SND_SOC_ROCKCHIP + depends on HAVE_CLK && SND_SOC_ROCKCHIP select SND_SOC_GENERIC_DMAENGINE_PCM help Say Y or M if you want to add support for SPDIF driver for
@@ -36,7 +36,7 @@ config SND_SOC_ROCKCHIP_SPDIF config SND_SOC_ROCKCHIP_MAX98090 tristate "ASoC support for Rockchip boards using a MAX98090 codec" - depends on SND_SOC_ROCKCHIP && I2C && GPIOLIB && CLKDEV_LOOKUP + depends on SND_SOC_ROCKCHIP && I2C && GPIOLIB && HAVE_CLK select SND_SOC_ROCKCHIP_I2S select SND_SOC_MAX98090 select SND_SOC_TS3A227E
@@ -47,7 +47,7 @@ config SND_SOC_ROCKCHIP_MAX98090 config SND_SOC_ROCKCHIP_RT5645 tristate "ASoC support for Rockchip boards using a RT5645/RT5650 codec" - depends on SND_SOC_ROCKCHIP && I2C && GPIOLIB && CLKDEV_LOOKUP + depends on SND_SOC_ROCKCHIP && I2C && GPIOLIB && HAVE_CLK select SND_SOC_ROCKCHIP_I2S select SND_SOC_RT5645 help
@@ -56,7 +56,7 @@ config SND_SOC_ROCKCHIP_RT5645 config SND_SOC_RK3288_HDMI_ANALOG tristate "ASoC support multiple codecs for Rockchip RK3288 boards" - depends on SND_SOC_ROCKCHIP && I2C && GPIOLIB && CLKDEV_LOOKUP + depends on SND_SOC_ROCKCHIP && I2C && GPIOLIB && HAVE_CLK select SND_SOC_ROCKCHIP_I2S select SND_SOC_HDMI_CODEC select SND_SOC_ES8328_I2C
@@ -68,7 +68,7 @@ config SND_SOC_RK3288_HDMI_ANALOG config SND_SOC_RK3399_GRU_SOUND tristate "ASoC support multiple codecs for Rockchip RK3399 GRU boards" - depends on SND_SOC_ROCKCHIP && I2C && GPIOLIB && CLKDEV_LOOKUP && SPI + depends on SND_SOC_ROCKCHIP && I2C && GPIOLIB && HAVE_CLK && SPI select SND_SOC_ROCKCHIP_I2S select SND_SOC_MAX98357A select SND_SOC_RT5514
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/459 clocksource/drivers:sp804: Make user selectable
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit 0309f714a0908e947af1c902cf6a330cb593e75e ]
The sp804 is currently only user selectable if COMPILE_TEST, this was done by commit dfc82faad725 ("clocksource/drivers/sp804: Add COMPILE_TEST to CONFIG_ARM_TIMER_SP804") in order to avoid it being spuriously offered on platforms that won't have the hardware since it's generally only seen on Arm based platforms. This config is overly restrictive, while platforms that rely on the SP804 do select it in their Kconfig there are others such as the Arm fast models which have a SP804 available but currently unused by Linux. Relax the dependency to allow it to be user selectable on arm and arm64 to avoid surprises and in case someone comes up with a use for extra timer hardware.
--- drivers/clocksource/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/clocksource/Kconfig +2 -1
@@ -398,7 +398,8 @@ config ARM_GLOBAL_TIMER This option enables support for the ARM global timer unit. config ARM_TIMER_SP804 - bool "Support for Dual Timer SP804 module" if COMPILE_TEST + bool "Support for Dual Timer SP804 module" + depends on ARM || ARM64 || COMPILE_TEST depends on GENERIC_SCHED_CLOCK && HAVE_CLK select CLKSRC_MMIO select TIMER_OF if OF
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/459 spi: spi-fsl-lpspi: downgrade log level for pio mode
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit d5786c88cacbb859f465e8e93c26154585c1008d ]
Having no DMA is not an error. The simplest reason is not having it configured. SPI will still be usable, so raise a warning instead to get still some attention.
Stable-dep-of: 003c7e01916c ("spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq()")
--- drivers/spi/spi-fsl-lpspi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-fsl-lpspi.c +1 -1
@@ -909,7 +909,7 @@ static int fsl_lpspi_probe(struct platform_device *pdev)if (ret == -EPROBE_DEFER ) goto out_pm_get;if (ret <0 ) -dev_err (&pdev->dev,"dma setup error %d, use pio\n" , ret); +dev_warn (&pdev->dev,"dma setup error %d, use pio\n" , ret);else /* * disable LPSPI module IRQ when enable DMA mode successfully,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/459 spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 003c7e01916c5e2af95add9b0cbda2e6163873e8 ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/spi/spi-fsl-lpspi.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
drivers/spi/spi-fsl-lpspi.c +4 -8
@@ -871,7 +871,7 @@ static int fsl_lpspi_probe(struct platform_device *pdev) goto out_controller_put; } - ret =devm_request_irq (&pdev->dev, irq, fsl_lpspi_isr,0 , + ret =devm_request_irq (&pdev->dev, irq, fsl_lpspi_isr,IRQF_NO_AUTOEN ,dev_name (&pdev->dev), fsl_lpspi);if (ret) {dev_err (&pdev->dev,"can't get irq%d: %d\n" , irq, ret);
@@ -908,14 +908,10 @@ static int fsl_lpspi_probe(struct platform_device *pdev) ret =fsl_lpspi_dma_init (&pdev->dev, fsl_lpspi, controller);if (ret == -EPROBE_DEFER ) goto out_pm_get; -if (ret <0 ) +if (ret <0 ) {dev_warn (&pdev->dev,"dma setup error %d, use pio\n" , ret); -else -/* -* disable LPSPI module IRQ when enable DMA mode successfully, -* to prevent the unexpected LPSPI module IRQ events. -*/ -disable_irq (irq); +enable_irq (irq); + } ret =devm_spi_register_controller (&pdev->dev, controller);if (ret <0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/459 soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 16a0a69244240cfa32c525c021c40f85e090557a ]
If request_irq() fails in sr_late_init(), there is no need to enable the irq, and if it succeeds, disable_irq() after request_irq() still has a time gap in which interrupts can come.
request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/soc/ti/smartreflex.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/soc/ti/smartreflex.c +2 -2
@@ -213,10 +213,10 @@ static int sr_late_init(struct omap_sr *sr_info)if (sr_class->notify && sr_class->notify_flags && sr_info->irq) { ret =devm_request_irq (&sr_info->pdev->dev, sr_info->irq, - sr_interrupt,0 , sr_info->name, sr_info); + sr_interrupt,IRQF_NO_AUTOEN , + sr_info->name, sr_info);if (ret) goto error; -disable_irq (sr_info->irq); }if (pdata && pdata->enable_on_init)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/459 soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 78261cb08f06c93d362cab5c5034bf5899bc7552 ]
This loop is supposed to break if the frequency returned from clk_round_rate() is the same as on the previous iteration. However, that check doesn't make sense on the first iteration through the loop. It leads to reading before the start of these->clk_perf_tbl[] array.
--- drivers/soc/qcom/qcom-geni-se.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/soc/qcom/qcom-geni-se.c +2 -1
@@ -553,7 +553,8 @@ int geni_se_clk_tbl_get(struct geni_se *se, unsigned long **tbl)for (i =0 ; i <MAX_CLK_PERF_LEVEL ; i++) { freq =clk_round_rate (se->clk, freq +1 ); -if (freq <=0 || freq == se->clk_perf_tbl[i -1 ]) +if (freq <=0 || + (i >0 && freq == se->clk_perf_tbl[i -1 ]))break ; se->clk_perf_tbl[i] = freq; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/459 mmc: mmc_spi: drop buggy snprintf()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit 328bda09cc91b3d93bc64f4a4dadc44313dd8140 ]
GCC 13 complains about the truncated output of snprintf():
drivers/mmc/host/mmc_spi.c: In function ‘mmc_spi_response_get’:drivers/mmc/host/mmc_spi.c:227:64: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
227 | snprintf(tag, sizeof(tag), " ... CMD%d response SPI_%s",
| ^drivers/mmc/host/mmc_spi.c:227:9: note: ‘snprintf’ output between 26 and 43 bytes into a destination of size 32
227 | snprintf(tag, sizeof(tag), " ... CMD%d response SPI_%s",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
228 | cmd->opcode, maptype(cmd));Drop it and fold the string it generates into the only place where it's emitted - the dev_dbg() call at the end of the function.
--- drivers/mmc/host/mmc_spi.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/mmc/host/mmc_spi.c +3 -6
@@ -230,10 +230,6 @@ static int mmc_spi_response_get(struct mmc_spi_host *host,u8 leftover =0 ;unsigned short rotator;int i; -char tag[32 ]; - -snprintf (tag,sizeof (tag)," ... CMD%d response SPI_%s" , - cmd->opcode,maptype (cmd));/* Except for data block reads, the whole response will already * be stored in the scratch buffer. It's somewhere after the
@@ -386,8 +382,9 @@ static int mmc_spi_response_get(struct mmc_spi_host *host, }if (value <0 ) -dev_dbg (&host->spi->dev,"%s: resp %04x %08x\n" , - tag, cmd->resp[0 ], cmd->resp[1 ]); +dev_dbg (&host->spi->dev, +" ... CMD%d response SPI_%s: resp %04x %08x\n" , + cmd->opcode,maptype (cmd), cmd->resp[0 ], cmd->resp[1 ]);/* disable chipselect on errors and some success cases */ if (value >=0 && cs_on)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/459 tpm: fix signed/unsigned bug when checking event logs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <[email protected]>
[ Upstream commit e6d654e9f5a97742cfe794b1c4bb5d3fb2d25e98 ]
A prior bugfix that fixes a signed/unsigned error causes another signed unsigned error.
A situation where log_tbl->size is invalid can cause the size passed to memblock_reserve to become negative.
log_size from the main event log is an unsigned int, and the code reduces to the following
u64 value = (int)unsigned_value;
This results in sign extension, and the value sent to memblock_reserve becomes effectively negative.
--- drivers/firmware/efi/tpm.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/firmware/efi/tpm.c +9 -8
@@ -40,7 +40,8 @@ int __init efi_tpm_eventlog_init(void) {struct linux_efi_tpm_eventlog *log_tbl;struct efi_tcg2_final_events_table *final_tbl; -int tbl_size; +unsigned int tbl_size; +int final_tbl_size;int ret =0 ;if (efi.tpm_log ==EFI_INVALID_TABLE_ADDR ) {
@@ -80,26 +81,26 @@ int __init efi_tpm_eventlog_init(void) goto out; } - tbl_size =0 ; + final_tbl_size =0 ;if (final_tbl->nr_events !=0 ) {void *events = (void *)efi.tpm_final_log +sizeof (final_tbl->version) +sizeof (final_tbl->nr_events); - tbl_size =tpm2_calc_event_log_size (events, - final_tbl->nr_events, - log_tbl->log); + final_tbl_size =tpm2_calc_event_log_size (events, + final_tbl->nr_events, + log_tbl->log); } -if (tbl_size <0 ) { +if (final_tbl_size <0 ) {pr_err (FW_BUG "Failed to parse event in TPM Final Events Log\n" ); ret = -EINVAL ; goto out_calc; }memblock_reserve (efi.tpm_final_log, - tbl_size +sizeof (*final_tbl)); - efi_tpm_final_log_size = tbl_size; + final_tbl_size +sizeof (*final_tbl)); + efi_tpm_final_log_size = final_tbl_size; out_calc:early_memunmap (final_tbl,sizeof (*final_tbl));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/459 arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hsin-Te Yuan <[email protected]>
[ Upstream commit e9c60c34948662b5d47573490ee538439b29e462 ]
The address of eeprom should be 50.
--- arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi +2 -2
@@ -85,9 +85,9 @@ &i2c4 { status = "okay"; clock-frequency = <400000>; - eeprom@54 { + eeprom@50 { compatible = "atmel,24c32"; - reg = <0x54>; + reg = <0x50>; pagesize = <32>; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/459 arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source trackpad
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit f766fae08f6a2eaeb45d8d2c053724c91526835c ]
The Hana device has a second source option trackpad, but it is missing its regulator supply. It only works because the regulator is marked as always-on.
Add the regulator supply, but leave out the post-power-on delay. Instead, document the post-power-on delay along with the reason for not adding it in a comment.
--- arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi +8 -0
@@ -43,6 +43,14 @@ trackpad2: trackpad@2c { interrupts = <117 IRQ_TYPE_LEVEL_LOW>; reg = <0x2c>; hid-descr-addr = <0x0020>; + /* + * The trackpad needs a post-power-on delay of 100ms, + * but at time of writing, the power supply for it on + * this board is always on. The delay is therefore not + * added to avoid impacting the readiness of the + * trackpad. + */ + vdd-supply = <&mt6397_vgp6_reg>; wakeup-source; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/459 Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
[ Upstream commit feb301c60970bd2a1310a53ce2d6e4375397a51b ]
This reverts commit 04f8ef5643bcd8bcde25dfdebef998aea480b2ba.
Only cgroup v2 can be attached by cgroup by BPF programs. Revert this commit and cgroup_bpf_inherit and cgroup_bpf_offline won't be called in cgroup v1. The memory leak issue will be fixed with next patch.
--- kernel/cgroup/cgroup.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
kernel/cgroup/cgroup.c +1 -3
@@ -2187,10 +2187,8 @@ static void cgroup_kill_sb(struct super_block *sb)* And don't kill the default root. */ if (list_empty (&root->cgrp.self.children) && root != &cgrp_dfl_root && - !percpu_ref_is_dying (&root->cgrp.self.refcnt)) { -cgroup_bpf_offline (&root->cgrp); + !percpu_ref_is_dying (&root->cgrp.self.refcnt))percpu_ref_kill (&root->cgrp.self.refcnt); - }cgroup_put (&root->cgrp);kernfs_kill_sb (sb); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/459 cgroup/bpf: only cgroup v2 can be attached by bpf programs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
[ Upstream commit 2190df6c91373fdec6db9fc07e427084f232f57e ]
Only cgroup v2 can be attached by bpf programs, so this patch introduces that cgroup_bpf_inherit and cgroup_bpf_offline can only be called in cgroup v2, and this can fix the memleak mentioned by commit 04f8ef5643bc ("cgroup: Fix memory leak caused by missing cgroup_bpf_offline"), which has been reverted.
--- kernel/cgroup/cgroup.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
kernel/cgroup/cgroup.c +11 -6
@@ -2018,8 +2018,10 @@ int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask)if (ret) goto destroy_root; - ret =cgroup_bpf_inherit (root_cgrp); -WARN_ON_ONCE (ret); +if (root == &cgrp_dfl_root) { + ret =cgroup_bpf_inherit (root_cgrp); +WARN_ON_ONCE (ret); + }trace_cgroup_setup_root (root);
@@ -5355,9 +5357,11 @@ static struct cgroup *cgroup_create(struct cgroup *parent, const char *name,if (ret) goto out_kernfs_remove; - ret =cgroup_bpf_inherit (cgrp); -if (ret) - goto out_psi_free; +if (cgrp->root == &cgrp_dfl_root) { + ret =cgroup_bpf_inherit (cgrp); +if (ret) + goto out_psi_free; + }/* * New cgroup inherits effective freeze counter, and
@@ -5676,7 +5680,8 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)cgroup1_check_for_release (parent); -cgroup_bpf_offline (cgrp); +if (cgrp->root == &cgrp_dfl_root) +cgroup_bpf_offline (cgrp);/* put the base reference */ percpu_ref_kill (&cgrp->self.refcnt);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/459 pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clark Wang <[email protected]>
[ Upstream commit a25351e4c7740eb22561a3ee4ef17611c6f410b0 ]
Implement workaround for ERR051198
(https://www.nxp.com/docs/en/errata/IMX8MN_0N14Y.pdf)
PWM output may not function correctly if the FIFO is empty when a new SAR value is programmed.
Description:
When the PWM FIFO is empty, a new value programmed to the PWM Sample register (PWM_PWMSAR) will be directly applied even if the current timer period has not expired. If the new SAMPLE value programmed in the PWM_PWMSAR register is less than the previous value, and the PWM counter register (PWM_PWMCNR) that contains the current COUNT value is greater than the new programmed SAMPLE value, the current period will not flip the level. This may result in an output pulse with a duty cycle of 100%.
Workaround:
Program the current SAMPLE value in the PWM_PWMSAR register before updating the new duty cycle to the SAMPLE value in the PWM_PWMSAR register. This will ensure that the new SAMPLE value is modified during a non-empty FIFO, and can be successfully updated after the period expires.
Write the old SAR value before updating the new duty cycle to SAR. This avoids writing the new value into an empty FIFO.
This only resolves the issue when the PWM period is longer than 2us (or <500kHz) because write register is not quick enough when PWM period is very short.
Reproduce steps:
cd /sys/class/pwm/pwmchip1/pwm0
echo 2000000000 > period # It is easy to observe by using long period
echo 1000000000 > duty_cycle
echo 1 > enable
echo 8000 > duty_cycle # One full high pulse will be seen by scope
--- drivers/pwm/pwm-imx27.c | 98 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 96 insertions(+), 2 deletions(-)
drivers/pwm/pwm-imx27.c +96 -2
@@ -26,6 +26,7 @@#define MX3_PWMSR 0x04/* PWM Status Register */ #define MX3_PWMSAR 0x0C/* PWM Sample Register */ #define MX3_PWMPR 0x10/* PWM Period Register */ +#define MX3_PWMCNR 0x14/* PWM Counter Register */ #define MX3_PWMCR_FWM GENMASK(27, 26)#define MX3_PWMCR_STOPEN BIT(25)
@@ -215,11 +216,13 @@ static void pwm_imx27_wait_fifo_slot(struct pwm_chip *chip,static int pwm_imx27_apply (struct pwm_chip *chip,struct pwm_device *pwm,const struct pwm_state *state) { -unsigned long period_cycles, duty_cycles, prescale; +unsigned long period_cycles, duty_cycles, prescale, period_us, tmp;struct pwm_imx27_chip *imx =to_pwm_imx27_chip (chip);struct pwm_state cstate;unsigned long long c;unsigned long long clkrate; +unsigned long flags; +int val;int ret;u32 cr;
@@ -262,7 +265,98 @@ static int pwm_imx27_apply(struct pwm_chip *chip, struct pwm_device *pwm,pwm_imx27_sw_reset (chip); } -writel (duty_cycles, imx->mmio_base +MX3_PWMSAR ); + val =readl (imx->mmio_base +MX3_PWMPR ); + val = val >=MX3_PWMPR_MAX ?MX3_PWMPR_MAX : val; + cr =readl (imx->mmio_base +MX3_PWMCR ); + tmp =NSEC_PER_SEC * (u64)(val +2 ) *MX3_PWMCR_PRESCALER_GET (cr); + tmp =DIV_ROUND_UP_ULL (tmp, clkrate); + period_us =DIV_ROUND_UP_ULL (tmp,1000 ); + +/* +* ERR051198: +* PWM: PWM output may not function correctly if the FIFO is empty when +* a new SAR value is programmed +* +* Description: +* When the PWM FIFO is empty, a new value programmed to the PWM Sample +* register (PWM_PWMSAR) will be directly applied even if the current +* timer period has not expired. +* +* If the new SAMPLE value programmed in the PWM_PWMSAR register is +* less than the previous value, and the PWM counter register +* (PWM_PWMCNR) that contains the current COUNT value is greater than +* the new programmed SAMPLE value, the current period will not flip +* the level. This may result in an output pulse with a duty cycle of +* 100%. +* +* Consider a change from +* ________ +* / \______/ +* ^ * ^ +* to +* ____ +* / \__________/ +* ^ ^ +* At the time marked by *, the new write value will be directly applied +* to SAR even the current period is not over if FIFO is empty. +* +* ________ ____________________ +* / \______/ \__________/ +* ^ ^ * ^ ^ +* |<-- old SAR -->| |<-- new SAR -->| +* +* That is the output is active for a whole period. +* +* Workaround: +* Check new SAR less than old SAR and current counter is in errata +* windows, write extra old SAR into FIFO and new SAR will effect at +* next period. +* +* Sometime period is quite long, such as over 1 second. If add old SAR +* into FIFO unconditional, new SAR have to wait for next period. It +* may be too long. +* +* Turn off the interrupt to ensure that not IRQ and schedule happen +* during above operations. If any irq and schedule happen, counter +* in PWM will be out of data and take wrong action. +* +* Add a safety margin 1.5us because it needs some time to complete +* IO write. +* +* Use writel_relaxed() to minimize the interval between two writes to +* the SAR register to increase the fastest PWM frequency supported. +* +* When the PWM period is longer than 2us(or <500kHz), this workaround +* can solve this problem. No software workaround is available if PWM +* period is shorter than IO write. Just try best to fill old data +* into FIFO. +*/ + c = clkrate *1500 ; +do_div (c,NSEC_PER_SEC ); + +local_irq_save (flags); + val =FIELD_GET (MX3_PWMSR_FIFOAV ,readl_relaxed (imx->mmio_base +MX3_PWMSR )); + +if (duty_cycles < imx->duty_cycle && (cr &MX3_PWMCR_EN )) { +if (period_us <2 ) {/* 2us = 500 kHz */ +/* Best effort attempt to fix up >500 kHz case */ +udelay (3 * period_us); +writel_relaxed (imx->duty_cycle, imx->mmio_base +MX3_PWMSAR ); +writel_relaxed (imx->duty_cycle, imx->mmio_base +MX3_PWMSAR ); + }else if (val <MX3_PWMSR_FIFOAV_2WORDS ) { + val =readl_relaxed (imx->mmio_base +MX3_PWMCNR ); +/* +* If counter is close to period, controller may roll over when +* next IO write. +*/ +if ((val + c >= duty_cycles && val < imx->duty_cycle) || + val + c >= period_cycles) +writel_relaxed (imx->duty_cycle, imx->mmio_base +MX3_PWMSAR ); + } + } +writel_relaxed (duty_cycles, imx->mmio_base +MX3_PWMSAR ); +local_irq_restore (flags); +writel (period_cycles, imx->mmio_base +MX3_PWMPR );/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/459 ARM: dts: cubieboard4: Fix DCDC5 regulator constraints
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andre Przywara <[email protected]>
[ Upstream commit dd36ad71ad65968f97630808bc8d605c929b128e ]
The DCDC5 voltage rail in the X-Powers AXP809 PMIC has a resolution of 50mV, so the currently enforced limits of 1.475 and 1.525 volts cannot be set, when the existing regulator value is beyond this range.
This will lead to the whole regulator driver to give up and fail probing, which in turn will hang the system, as essential devices depend on the PMIC.
In this case a bug in U-Boot set the voltage to 1.75V (meant for DCDC4), and the AXP driver's attempt to correct this lead to this error:
==================
[ 4.447653] axp20x-rsb sunxi-rsb-3a3: AXP20X driver loaded [ 4.450066] vcc-dram: Bringing 1750000uV into 1575000-1575000uV [ 4.460272] vcc-dram: failed to apply 1575000-1575000uV constraint: -EINVAL [ 4.474788] axp20x-regulator axp20x-regulator.0: Failed to register dcdc5 [ 4.482276] axp20x-regulator axp20x-regulator.0: probe with driver axp20x-regulator failed with error -22
==================
Set the limits to values that can be programmed, so any correction will be successful.
--- arch/arm/boot/dts/sun9i-a80-cubieboard4.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/sun9i-a80-cubieboard4.dts +2 -2
@@ -280,8 +280,8 @@ reg_dcdc4: dcdc4 { reg_dcdc5: dcdc5 { regulator-always-on; - regulator-min-microvolt = <1425000>; - regulator-max-microvolt = <1575000>; + regulator-min-microvolt = <1450000>; + regulator-max-microvolt = <1550000>; regulator-name = "vcc-dram"; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/459 pmdomain: ti-sci: Add missing of_node_put() for args.np
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Zekun <[email protected]>
[ Upstream commit afc2331ef81657493c074592c409dac7c3cb8ccc ]
of_parse_phandle_with_args() needs to call of_node_put() to decrement the refcount of args.np. So, Add the missing of_node_put() in the loop.
Message-ID: <[email protected]>
--- drivers/soc/ti/ti_sci_pm_domains.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/soc/ti/ti_sci_pm_domains.c +4 -0
@@ -165,6 +165,7 @@ static int ti_sci_pm_domain_probe(struct platform_device *pdev)break ;if (args.args_count >=1 && args.np == dev->of_node) { +of_node_put (args.np);if (args.args[0 ] > max_id) { max_id = args.args[0 ]; }else {
@@ -192,7 +193,10 @@ static int ti_sci_pm_domain_probe(struct platform_device *pdev)pm_genpd_init (&pd->pd,NULL , true);list_add (&pd->node, &pd_provider->pd_list); + }else { +of_node_put (args.np); } + index++; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/459 regmap: irq: Set lockdep class for hierarchical IRQ domains
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 953e549471cabc9d4980f1da2e9fa79f4c23da06 ]
Lockdep gives a false positive splat as it can't distinguish the lock which is taken by different IRQ descriptors from different IRQ chips that are organized in a way of a hierarchy:
======================================================
WARNING: possible circular locking dependency detected
6.12.0-rc5-next-20241101-00148-g9fabf8160b53 #562 Tainted: G W
------------------------------------------------------
modprobe/141 is trying to acquire lock:
ffff899446947868 (intel_soc_pmic_bxtwc:502:(&bxtwc_regmap_config)->lock){+.+.}-{4:4}, at: regmap_update_bits_base+0x33/0x90
but task is already holding lock:
ffff899446947c68 (&d->lock){+.+.}-{4:4}, at: __setup_irq+0x682/0x790
which lock already depends on the new lock.
-> #3 (&d->lock){+.+.}-{4:4}:
-> #2 (&desc->request_mutex){+.+.}-{4:4}:
-> #1 (ipclock){+.+.}-{4:4}:
-> #0 (intel_soc_pmic_bxtwc:502:(&bxtwc_regmap_config)->lock){+.+.}-{4:4}:
Chain exists of:
intel_soc_pmic_bxtwc:502:(&bxtwc_regmap_config)->lock --> &desc->request_mutex --> &d->lock
Possible unsafe locking scenario: CPU0 CPU1
---- ----
lock(&d->lock);
lock(&desc->request_mutex);
lock(&d->lock);
lock(intel_soc_pmic_bxtwc:502:(&bxtwc_regmap_config)->lock);
*** DEADLOCK ***3 locks held by modprobe/141:
#0: ffff8994419368f8 (&dev->mutex){....}-{4:4}, at: __driver_attach+0xf6/0x250
#1: ffff89944690b250 (&desc->request_mutex){+.+.}-{4:4}, at: __setup_irq+0x1a2/0x790
#2: ffff899446947c68 (&d->lock){+.+.}-{4:4}, at: __setup_irq+0x682/0x790Set a lockdep class when we map the IRQ so that it doesn't warn about a lockdep bug that doesn't exist.
--- drivers/base/regmap/regmap-irq.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/base/regmap/regmap-irq.c +4 -0
@@ -539,12 +539,16 @@ static irqreturn_t regmap_irq_thread(int irq, void *d)return IRQ_NONE ; } +static struct lock_class_key regmap_irq_lock_class; +static struct lock_class_key regmap_irq_request_class; +static int regmap_irq_map (struct irq_domain *h,unsigned int virq,irq_hw_number_t hw) {struct regmap_irq_chip_data *data = h->host_data;irq_set_chip_data (virq, data); +irq_set_lockdep_class (virq, ®map_irq_lock_class, ®map_irq_request_class);irq_set_chip (virq, &data->irq_chip);irq_set_nested_thread (virq,1 );irq_set_parent (virq, data->irq);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/459 selftests/resctrl: Protect against array overrun during iMC config parsing
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Reinette Chatre <[email protected]>
[ Upstream commit 48ed4e799e8fbebae838dca404a8527763d41191 ]
The MBM and MBA tests need to discover the event and umask with which to configure the performance event used to measure read memory bandwidth. This is done by parsing the /sys/bus/event_source/devices/uncore_imc_<imc instance>/events/cas_count_read file for each iMC instance that contains the formatted
output: "event=<event>,umask=<umask>"
Parsing of cas_count_read contents is done by initializing an array of MAX_TOKENS elements with tokens (deliminated by "=,") from this file. Remove the unnecessary append of a delimiter to the string needing to be parsed. Per the strtok() man page: "delimiter bytes at the start or end of the string are ignored". This has no impact on the token placement within the array.
After initialization, the actual event and umask is determined by parsing the tokens directly following the "event" and "umask" tokens respectively.
Iterating through the array up to index "i < MAX_TOKENS" but then accessing index "i + 1" risks array overrun during the final iteration. Avoid array overrun by ensuring that the index used within for loop will always be valid.
--- tools/testing/selftests/resctrl/resctrl_val.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
tools/testing/selftests/resctrl/resctrl_val.c +1 -2
@@ -102,13 +102,12 @@ void get_event_and_umask(char *cas_count_cfg, int count, bool op)char *token[MAX_TOKENS ];int i =0 ; -strcat (cas_count_cfg,"," ); token[0 ] =strtok (cas_count_cfg,"=," );for (i =1 ; i <MAX_TOKENS ; i++) token[i] =strtok (NULL ,"=," ); -for (i =0 ; i <MAX_TOKENS ; i++) { +for (i =0 ; i <MAX_TOKENS -1 ; i++) {if (!token[i])break ;if (strcmp (token[i],"event" ) ==0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/459 firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luo Qiu <[email protected]>
[ Upstream commit 109aa654f85c5141e813b2cd1bd36d90be678407 ]
Fix a kernel crash with the below call trace when the SCPI firmware returns OPP count of zero.
dvfs_info.opp_count may be zero on some platforms during the reboot test, and the kernel will crash after dereferencing the pointer to kcalloc(info->count, sizeof(*opp), GFP_KERNEL).
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 | Mem abort info: | ESR = 0x96000004 | Exception class = DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | Data abort info: | ISV = 0, ISS = 0x00000004 | CM = 0, WnR = 0 | user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000faefa08c | [0000000000000028] pgd=0000000000000000 | Internal error: Oops: 96000004 [#1] SMP | scpi-hwmon: probe of PHYT000D:00 failed with error -110 | Process systemd-udevd (pid: 1701, stack limit = 0x00000000aaede86c) | CPU: 2 PID: 1701 Comm: systemd-udevd Not tainted 4.19.90+ #1 | Hardware name: PHYTIUM LTD Phytium FT2000/4/Phytium FT2000/4, BIOS | pstate: 60000005 (nZCv daif -PAN -UAO) | pc : scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi] | lr : clk_register+0x438/0x720 | Call trace: | scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi] | devm_clk_hw_register+0x50/0xa0 | scpi_clk_ops_init.isra.2+0xa0/0x138 [clk_scpi] | scpi_clocks_probe+0x528/0x70c [clk_scpi] | platform_drv_probe+0x58/0xa8 | really_probe+0x260/0x3d0 | driver_probe_device+0x12c/0x148 | device_driver_attach+0x74/0x98 | __driver_attach+0xb4/0xe8 | bus_for_each_dev+0x88/0xe0 | driver_attach+0x30/0x40 | bus_add_driver+0x178/0x2b0 | driver_register+0x64/0x118 | __platform_driver_register+0x54/0x60 | scpi_clocks_driver_init+0x24/0x1000 [clk_scpi] | do_one_initcall+0x54/0x220 | do_init_module+0x54/0x1c8 | load_module+0x14a4/0x1668 | __se_sys_finit_module+0xf8/0x110 | __arm64_sys_finit_module+0x24/0x30 | el0_svc_common+0x78/0x170 | el0_svc_handler+0x38/0x78 | el0_svc+0x8/0x340 | Code: 937d7c00 a94153f3 a8c27bfd f9400421 (b8606820) | ---[ end trace 06feb22469d89fa8 ]--- | Kernel panic - not syncing: Fatal exception | SMP: stopping secondary CPUs | Kernel Offset: disabled | CPU features: 0x10,a0002008 | Memory Limit: none
Message-Id: <[email protected]>
--- drivers/firmware/arm_scpi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/firmware/arm_scpi.c +3 -0
@@ -627,6 +627,9 @@ static struct scpi_dvfs_info *scpi_dvfs_get_info(u8 domain)if (ret)return ERR_PTR (ret); +if (!buf.opp_count) +return ERR_PTR (-ENOENT ); + info =kmalloc (sizeof (*info),GFP_KERNEL );if (!info)return ERR_PTR (-ENOMEM );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/459 media: atomisp: remove #ifdef HAS_NO_HMEM
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
[ Upstream commit 63705da3dfc8922a2dbfc3c805a5faadb4416954 ]
This is not defined anywhere, so, solve the ifdefs, getting rid of them.
Stable-dep-of: ed61c5913950 ("media: atomisp: Add check for rgby_data memory allocation failure")
--- .../atomisp/pci/isp/kernels/bh/bh_2/ia_css_bh.host.c | 2 -- .../raw_aa_binning_1.0/ia_css_raa.host.c | 2 -- .../pci/isp/kernels/s3a/s3a_1.0/ia_css_s3a.host.c | 5 ----- .../media/atomisp/pci/runtime/binary/src/binary.c | 4 ---- drivers/staging/media/atomisp/pci/sh_css_params.c | 10 ---------- 5 files changed, 23 deletions(-)
drivers/staging/media/atomisp/pci/isp/kernels/bh/bh_2/ia_css_bh.host.c +0 -2
@@ -13,7 +13,6 @@* more details. */ -#if !defined(HAS_NO_HMEM )#include "ia_css_types.h" #include "sh_css_internal.h"
@@ -63,4 +62,3 @@ ia_css_bh_encode(uDIGIT_FITTING (from->ae_y_coef_b,16 ,SH_CSS_AE_YCOEF_SHIFT ); } -#endif
drivers/staging/media/atomisp/pci/isp/kernels/raw_aa_binning/raw_aa_binning_1.0/ia_css_raa.host.c +0 -2
@@ -13,7 +13,6 @@* more details. */ -#if !defined(HAS_NO_HMEM )#include "ia_css_types.h" #include "sh_css_internal.h"
@@ -32,4 +31,3 @@ ia_css_raa_encode( (void )from; } -#endif
drivers/staging/media/atomisp/pci/isp/kernels/s3a/s3a_1.0/ia_css_s3a.host.c +0 -5
@@ -227,10 +227,6 @@ ia_css_s3a_hmem_decode(struct ia_css_3a_statistics *host_stats, const struct ia_css_bh_table *hmem_buf) { -#if defined(HAS_NO_HMEM ) - (void )host_stats; - (void )hmem_buf; -#else struct ia_css_3a_rgby_output *out_ptr;int i;
@@ -291,7 +287,6 @@ ia_css_s3a_hmem_decode( out_ptr[0 ].g -= diff; out_ptr[0 ].b -= diff; out_ptr[0 ].y -= diff; -#endif }void
drivers/staging/media/atomisp/pci/runtime/binary/src/binary.c +0 -4
@@ -805,11 +805,7 @@ ia_css_binary_3a_grid_info(const struct ia_css_binary *binary, s3a_info->deci_factor_log2 = binary->deci_factor_log2; s3a_info->elem_bit_depth =SH_CSS_BAYER_BITS ; s3a_info->use_dmem = binary->info->sp.s3a.s3atbl_use_dmem; -#if defined(HAS_NO_HMEM ) - s3a_info->has_histogram =1 ; -#else s3a_info->has_histogram =0 ; -#endif IA_CSS_LEAVE_ERR_PRIVATE (err);return err; }
drivers/staging/media/atomisp/pci/sh_css_params.c +0 -10
@@ -16,12 +16,10 @@#include "gdc_device.h" /* gdc_lut_store(), ... */ #include "isp.h" /* ISP_VEC_ELEMBITS */ #include "vamem.h" -#if !defined(HAS_NO_HMEM )#ifndef __INLINE_HMEM__#define __INLINE_HMEM__#endif #include "hmem.h" -#endif /* !defined(HAS_NO_HMEM) */ #define IA_CSS_INCLUDE_PARAMETERS #define IA_CSS_INCLUDE_ACC_PARAMETERS
@@ -1513,10 +1511,8 @@ ia_css_translate_3a_statistics(ia_css_s3a_vmem_decode (host_stats, isp_stats->vmem_stats_hi, isp_stats->vmem_stats_lo); } -#if !defined(HAS_NO_HMEM )IA_CSS_LOG ("3A: HMEM" );ia_css_s3a_hmem_decode (host_stats, isp_stats->hmem_stats); -#endif IA_CSS_LEAVE ("void" ); }
@@ -2255,9 +2251,7 @@ ia_css_isp_3a_statistics_allocate(const struct ia_css_3a_grid_info *grid) me->vmem_size =ISP_S3ATBL_HI_LO_STRIDE_BYTES * grid->aligned_height; } -#if !defined(HAS_NO_HMEM ) me->hmem_size =sizeof_hmem (HMEM0_ID ); -#endif /* All subsections need to be aligned to the system bus width */ me->dmem_size =CEIL_MUL (me->dmem_size,HIVE_ISP_DDR_WORD_BYTES );
@@ -4360,12 +4354,8 @@ ia_css_3a_statistics_allocate(const struct ia_css_3a_grid_info *grid) me->data =kvmalloc (grid_size *sizeof (*me->data),GFP_KERNEL );if (!me->data) goto err; -#if !defined(HAS_NO_HMEM )/* No weighted histogram, no structure, treat the histogram data as a byte dump in a byte array */ me->rgby_data =kvmalloc (sizeof_hmem (HMEM0_ID ),GFP_KERNEL ); -#else - me->rgby_data =NULL ; -#endif IA_CSS_LEAVE ("return=%p" , me);return me;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/459 media: atomisp: Add check for rgby_data memory allocation failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Huafei <[email protected]>
[ Upstream commit ed61c59139509f76d3592683c90dc3fdc6e23cd6 ]
In ia_css_3a_statistics_allocate(), there is no check on the allocation result of the rgby_data memory. If rgby_data is not successfully allocated, it may trigger the assert(host_stats->rgby_data) assertion in ia_css_s3a_hmem_decode(). Adding a check to fix this potential issue.
--- drivers/staging/media/atomisp/pci/sh_css_params.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/staging/media/atomisp/pci/sh_css_params.c +2 -0
@@ -4356,6 +4356,8 @@ ia_css_3a_statistics_allocate(const struct ia_css_3a_grid_info *grid) goto err;/* No weighted histogram, no structure, treat the histogram data as a byte dump in a byte array */ me->rgby_data =kvmalloc (sizeof_hmem (HMEM0_ID ),GFP_KERNEL ); +if (!me->rgby_data) + goto err;IA_CSS_LEAVE ("return=%p" , me);return me;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/459 drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 53bd7c1c0077db533472ae32799157758302ef48 ]
The INTERVAL_TREE_DEFINE() uncoditionally provides a bunch of helper functions which in some cases may be not used. This, in particular, prevents kernel builds with clang, make W=1 and CONFIG_WERROR=y:
.../drm/drm_mm.c:152:1: error: unused function 'drm_mm_interval_tree_insert' [-Werror,-Wunused-function]
152 | INTERVAL_TREE_DEFINE(struct drm_mm_node, rb,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
153 | u64, __subtree_last,
| ~~~~~~~~~~~~~~~~~~~~
154 | START, LAST, static inline, drm_mm_interval_tree)
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Fix this by marking drm_mm_interval_tree*() functions with __maybe_unused.
See also commit 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build").
--- drivers/gpu/drm/drm_mm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/drm_mm.c +1 -1
@@ -154,7 +154,7 @@ static void show_leaks(struct drm_mm *mm) { } INTERVAL_TREE_DEFINE(struct drm_mm_node, rb, u64, __subtree_last, - START, LAST, static inline, drm_mm_interval_tree) + START, LAST, static inline __maybe_unused, drm_mm_interval_tree)struct drm_mm_node *__drm_mm_interval_first (const struct drm_mm *mm,u64 start,u64 last)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/459 wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
[ Upstream commit 8619593634cbdf5abf43f5714df49b04e4ef09ab ]
I found the following bug in my fuzzer:
UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51 index 255 is out of range for type 'htc_endpoint [22]' CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.11.0-rc6-dirty #14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events request_firmware_work_func Call Trace: <TASK> dump_stack_lvl+0x180/0x1b0 __ubsan_handle_out_of_bounds+0xd4/0x130 htc_issue_send.constprop.0+0x20c/0x230 ? _raw_spin_unlock_irqrestore+0x3c/0x70 ath9k_wmi_cmd+0x41d/0x610 ? mark_held_locks+0x9f/0xe0 ...
Since this bug has been confirmed to be caused by insufficient verification of conn_rsp_epid, I think it would be appropriate to add a range check for conn_rsp_epid to htc_connect_service() to prevent the bug from occurring.
--- drivers/net/wireless/ath/ath9k/htc_hst.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/ath/ath9k/htc_hst.c +3 -0
@@ -294,6 +294,9 @@ int htc_connect_service(struct htc_target *target,return -ETIMEDOUT ; } +if (target->conn_rsp_epid <0 || target->conn_rsp_epid >=ENDPOINT_MAX ) +return -EINVAL ; + *conn_rsp_epid = target->conn_rsp_epid;return 0 ; err:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/459 drm/omap: Fix locking in omap_gem_new_dmabuf()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit e6a1c4037227539373c8cf484ace83833e2ad6a2 ]
omap_gem_new_dmabuf() creates the new gem object, and then takes and holds the omap_obj->lock for the rest of the function. This has two issues:
- omap_gem_free_object(), which is called in the error paths, also takes the same lock, leading to deadlock
- Even if the above wouldn't happen, in the error cases omap_gem_new_dmabuf() still unlocks omap_obj->lock, even after the omap_obj has already been freed.
Furthermore, I don't think there's any reason to take the lock at all, as the object was just created and not yet shared with anyone else.
To fix all this, drop taking the lock.
--- drivers/gpu/drm/omapdrm/omap_gem.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-)
drivers/gpu/drm/omapdrm/omap_gem.c +2 -8
@@ -1289,8 +1289,6 @@ struct drm_gem_object *omap_gem_new_dmabuf(struct drm_device *dev, size_t size, omap_obj =to_omap_bo (obj); -mutex_lock (&omap_obj->lock); - omap_obj->sgt = sgt;if (sgt->orig_nents ==1 ) {
@@ -1305,8 +1303,7 @@ struct drm_gem_object *omap_gem_new_dmabuf(struct drm_device *dev, size_t size, pages =kcalloc (npages,sizeof (*pages),GFP_KERNEL );if (!pages) {omap_gem_free_object (obj); - obj =ERR_PTR (-ENOMEM ); - goto done; +return ERR_PTR (-ENOMEM ); } omap_obj->pages = pages;
@@ -1314,13 +1311,10 @@ struct drm_gem_object *omap_gem_new_dmabuf(struct drm_device *dev, size_t size, npages);if (ret) {omap_gem_free_object (obj); - obj =ERR_PTR (-ENOMEM ); - goto done; +return ERR_PTR (-ENOMEM ); } } -done: -mutex_unlock (&omap_obj->lock);return obj; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/459 wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit bcd1371bd85e560ccc9159b7747f94bfe43b77a6 ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/net/wireless/intersil/p54/p54spi.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/wireless/intersil/p54/p54spi.c +1 -3
@@ -623,7 +623,7 @@ static int p54spi_probe(struct spi_device *spi)gpio_direction_input (p54spi_gpio_irq); ret =request_irq (gpio_to_irq (p54spi_gpio_irq), - p54spi_interrupt,0 ,"p54spi" , + p54spi_interrupt,IRQF_NO_AUTOEN ,"p54spi" , priv->spi);if (ret <0 ) {dev_err (&priv->spi->dev,"request_irq() failed" );
@@ -632,8 +632,6 @@ static int p54spi_probe(struct spi_device *spi)irq_set_irq_type (gpio_to_irq (p54spi_gpio_irq),IRQ_TYPE_EDGE_RISING ); -disable_irq (gpio_to_irq (p54spi_gpio_irq)); -INIT_WORK (&priv->work, p54spi_work);init_completion (&priv->fw_comp);INIT_LIST_HEAD (&priv->tx_pending);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/459 wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 9a98dd48b6d834d7a3fe5e8e7b8c3a1d006f9685 ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/net/wireless/marvell/mwifiex/main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/marvell/mwifiex/main.c +2 -2
@@ -1600,7 +1600,8 @@ static void mwifiex_probe_of(struct mwifiex_adapter *adapter) } ret =devm_request_irq (dev, adapter->irq_wakeup, - mwifiex_irq_wakeup_handler,IRQF_TRIGGER_LOW , + mwifiex_irq_wakeup_handler, +IRQF_TRIGGER_LOW |IRQF_NO_AUTOEN ,"wifi_wake" , adapter);if (ret) { dev_err(dev, "Failed to request irq_wakeup %d (%d)\n",
@@ -1608,7 +1609,6 @@ static void mwifiex_probe_of(struct mwifiex_adapter *adapter) goto err_exit; } -disable_irq (adapter->irq_wakeup);if (device_init_wakeup (dev, true)) {dev_err (dev,"fail to init wakeup for mwifiex\n" ); goto err_exit;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/459 drm/imx/dcss: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 1af01e14db7e0b45ae502d822776a58c86688763 ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/gpu/drm/imx/dcss/dcss-crtc.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/gpu/drm/imx/dcss/dcss-crtc.c +2 -4
@@ -201,15 +201,13 @@ int dcss_crtc_init(struct dcss_crtc *crtc, struct drm_device *drm)if (crtc->irq <0 )return crtc->irq; - ret =request_irq (crtc->irq, dcss_crtc_irq_handler, -0 ,"dcss_drm" , crtc); + ret =request_irq (crtc->irq, dcss_crtc_irq_handler,IRQF_NO_AUTOEN , +"dcss_drm" , crtc);if (ret) {dev_err (dcss->dev,"irq request failed with %d.\n" , ret);return ret; } -disable_irq (crtc->irq); -return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/459 drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 40004709a3d3b07041a473a163ca911ef04ab8bd ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/gpu/drm/imx/ipuv3-crtc.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/gpu/drm/imx/ipuv3-crtc.c +2 -4
@@ -406,14 +406,12 @@ static int ipu_crtc_init(struct ipu_crtc *ipu_crtc, } ipu_crtc->irq =ipu_plane_irq (ipu_crtc->plane[0 ]); - ret =devm_request_irq (ipu_crtc->dev, ipu_crtc->irq, ipu_irq_handler,0 , -"imx_drm" , ipu_crtc); + ret =devm_request_irq (ipu_crtc->dev, ipu_crtc->irq, ipu_irq_handler, +IRQF_NO_AUTOEN ,"imx_drm" , ipu_crtc);if (ret <0 ) {dev_err (ipu_crtc->dev,"irq request failed with %d.\n" , ret); goto err_put_plane1_res; } -/* Only enable IRQ when we actually need it to trigger work. */ -disable_irq (ipu_crtc->irq);return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/459 drm/v3d: Address race-condition in MMU flush
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maíra Canal <[email protected]>
[ Upstream commit cf1becb7f996a0a23ea2c270cf6bb0911ec3ca1a ]
We must first flush the MMU cache and then, flush the TLB, not the other way around. Currently, we can see a race condition between the MMU cache and the TLB when running multiple rendering processes at the same time. This is evidenced by MMU errors triggered by the IRQ.
Fix the MMU flush order by flushing the MMU cache and then the TLB. Also, in order to address the race condition, wait for the MMU cache flush to finish before starting the TLB flush.
--- drivers/gpu/drm/v3d/v3d_mmu.c | 29 ++++++++++------------------- 1 file changed, 10 insertions(+), 19 deletions(-)
drivers/gpu/drm/v3d/v3d_mmu.c +10 -19
@@ -34,32 +34,23 @@ static int v3d_mmu_flush_all(struct v3d_dev *v3d) {int ret; -/* Make sure that another flush isn't already running when we -* start this one. -*/ - ret =wait_for (!(V3D_READ (V3D_MMU_CTL ) & -V3D_MMU_CTL_TLB_CLEARING ),100 ); -if (ret) -dev_err (v3d->drm.dev,"TLB clear wait idle pre-wait failed\n" ); - -V3D_WRITE (V3D_MMU_CTL ,V3D_READ (V3D_MMU_CTL ) | -V3D_MMU_CTL_TLB_CLEAR ); - -V3D_WRITE (V3D_MMUC_CONTROL , -V3D_MMUC_CONTROL_FLUSH | +V3D_WRITE (V3D_MMUC_CONTROL ,V3D_MMUC_CONTROL_FLUSH |V3D_MMUC_CONTROL_ENABLE ); - ret =wait_for (!(V3D_READ (V3D_MMU_CTL ) & -V3D_MMU_CTL_TLB_CLEARING ),100 ); + ret =wait_for (!(V3D_READ (V3D_MMUC_CONTROL ) & +V3D_MMUC_CONTROL_FLUSHING ),100 );if (ret) { -dev_err (v3d->drm.dev,"TLB clear wait idle failed\n" ); +dev_err (v3d->drm.dev,"MMUC flush wait idle failed\n" );return ret; } - ret =wait_for (!(V3D_READ (V3D_MMUC_CONTROL ) & -V3D_MMUC_CONTROL_FLUSHING ),100 ); +V3D_WRITE (V3D_MMU_CTL ,V3D_READ (V3D_MMU_CTL ) | +V3D_MMU_CTL_TLB_CLEAR ); + + ret =wait_for (!(V3D_READ (V3D_MMU_CTL ) & +V3D_MMU_CTL_TLB_CLEARING ),100 );if (ret) -dev_err (v3d->drm.dev,"MMUC flush wait idle failed\n" ); +dev_err (v3d->drm.dev,"MMU TLB clear wait idle failed\n" );return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/459 wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss1
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit d50886b27850447d90c0cd40c725238097909d1e ]
In supported_vht_mcs_rate_nss1, the rate for MCS9 & VHT20 is defined as {780, 867}, this does not align with firmware's definition and therefore fails the verification in ath10k_mac_get_rate_flags_vht():
invalid vht params rate 960 100kbps nss 1 mcs 9
Change it to {865, 960} to align with firmware, so this issue could be fixed.
Since ath10k_hw_params::supports_peer_stats_info is enabled only for QCA6174, this change does not affect other chips.
Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1
--- drivers/net/wireless/ath/ath10k/mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath10k/mac.c +1 -1
@@ -8955,7 +8955,7 @@ static const struct ath10k_index_vht_data_rate_type supported_vht_mcs_rate_nss1[ {6, {2633, 2925}, {1215, 1350}, {585, 650} }, {7, {2925, 3250}, {1350, 1500}, {650, 722} }, {8, {3510, 3900}, {1620, 1800}, {780, 867} }, - {9, {3900, 4333}, {1800, 2000}, {780, 867} } + {9, {3900, 4333}, {1800, 2000}, {865, 960} } };/*MCS parameters with Nss = 2 */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/459 wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss2
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit 52db16ec5bae7bd027804265b968259d1a6c3970 ]
In supported_vht_mcs_rate_nss2, the rate for MCS9 & VHT20 is defined as {1560, 1733}, this does not align with firmware's definition and therefore fails the verification in ath10k_mac_get_rate_flags_vht():
invalid vht params rate 1730 100kbps nss 2 mcs 9
and:
invalid vht params rate 1920 100kbps nss 2 mcs 9
Change it to {1730, 1920} to align with firmware to fix the issue.
Since ath10k_hw_params::supports_peer_stats_info is enabled only for QCA6174, this change does not affect other chips.
Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1
--- drivers/net/wireless/ath/ath10k/mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath10k/mac.c +1 -1
@@ -8970,7 +8970,7 @@ static const struct ath10k_index_vht_data_rate_type supported_vht_mcs_rate_nss2[ {6, {5265, 5850}, {2430, 2700}, {1170, 1300} }, {7, {5850, 6500}, {2700, 3000}, {1300, 1444} }, {8, {7020, 7800}, {3240, 3600}, {1560, 1733} }, - {9, {7800, 8667}, {3600, 4000}, {1560, 1733} } + {9, {7800, 8667}, {3600, 4000}, {1730, 1920} } }; static void ath10k_mac_get_rate_flags_ht(struct ath10k *ar, u32 rate, u8 nss, u8 mcs,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/459 dt-bindings: vendor-prefixes: Add NeoFidelity, Inc
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Prusov <[email protected]>
[ Upstream commit 5d9e6d6fc1b98c8c22d110ee931b3b233d43cd13 ]
Add vendor prefix for NeoFidelity, Inc
--- Documentation/devicetree/bindings/vendor-prefixes.yaml | 2 ++ 1 file changed, 2 insertions(+)
Documentation/devicetree/bindings/vendor-prefixes.yaml +2 -0
@@ -718,6 +718,8 @@ patternProperties: description: National Semiconductor "^nec,.*": description: NEC LCD Technologies, Ltd. + "^neofidelity,.*": + description: Neofidelity Inc. "^neonode,.*": description: Neonode Inc. "^netgear,.*":
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/459 ASoC: fsl_micfil: Drop unnecessary register read
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sascha Hauer <[email protected]>
[ Upstream commit c808e277bcdfce37aed80a443be305ac1aec1623 ]
in get_pdm_clk() REG_MICFIL_CTRL2 is read twice. Drop second read.
Stable-dep-of: 06df673d2023 ("ASoC: fsl_micfil: fix regmap_write_bits usage")
--- sound/soc/fsl/fsl_micfil.c | 2 -- 1 file changed, 2 deletions(-)
sound/soc/fsl/fsl_micfil.c +0 -2
@@ -117,8 +117,6 @@ static inline int get_pdm_clk(struct fsl_micfil *micfil,regmap_read (micfil->regmap,REG_MICFIL_CTRL2 , &ctrl2_reg); osr =16 - ((ctrl2_reg &MICFIL_CTRL2_CICOSR_MASK ) >>MICFIL_CTRL2_CICOSR_SHIFT ); - -regmap_read (micfil->regmap,REG_MICFIL_CTRL2 , &ctrl2_reg); qsel = ctrl2_reg &MICFIL_CTRL2_QSEL_MASK ;switch (qsel) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/459 ASoC: fsl_micfil: do not define SHIFT/MASK for single bits
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sascha Hauer <[email protected]>
[ Upstream commit bd2cffd10d79eb9280cb8f5b7cb441f206c1e6ac ]
No need to have defines for the mask of single bits. Also shift is unused. Drop all these unnecessary defines.
Stable-dep-of: 06df673d2023 ("ASoC: fsl_micfil: fix regmap_write_bits usage")
--- sound/soc/fsl/fsl_micfil.c | 18 +++--- sound/soc/fsl/fsl_micfil.h | 125 +++++++++---------------------------- 2 files changed, 40 insertions(+), 103 deletions(-)
sound/soc/fsl/fsl_micfil.c +9 -9
@@ -172,7 +172,7 @@ static int fsl_micfil_reset(struct device *dev) ret =regmap_update_bits (micfil->regmap,REG_MICFIL_CTRL1 , -MICFIL_CTRL1_MDIS_MASK , +MICFIL_CTRL1_MDIS ,0 );if (ret) {dev_err (dev,"failed to clear MDIS bit %d\n" , ret);
@@ -181,7 +181,7 @@ static int fsl_micfil_reset(struct device *dev) ret =regmap_update_bits (micfil->regmap,REG_MICFIL_CTRL1 , -MICFIL_CTRL1_SRES_MASK , +MICFIL_CTRL1_SRES ,MICFIL_CTRL1_SRES );if (ret) {dev_err (dev,"failed to reset MICFIL: %d\n" , ret);
@@ -274,7 +274,7 @@ static int fsl_micfil_trigger(struct snd_pcm_substream *substream, int cmd,/* Enable the module */ ret =regmap_update_bits (micfil->regmap,REG_MICFIL_CTRL1 , -MICFIL_CTRL1_PDMIEN_MASK , +MICFIL_CTRL1_PDMIEN ,MICFIL_CTRL1_PDMIEN );if (ret) {dev_err (dev,"failed to enable the module\n" );
@@ -287,7 +287,7 @@ static int fsl_micfil_trigger(struct snd_pcm_substream *substream, int cmd,case SNDRV_PCM_TRIGGER_PAUSE_PUSH :/* Disable the module */ ret =regmap_update_bits (micfil->regmap,REG_MICFIL_CTRL1 , -MICFIL_CTRL1_PDMIEN_MASK , +MICFIL_CTRL1_PDMIEN ,0 );if (ret) {dev_err (dev,"failed to enable the module\n" );
@@ -353,7 +353,7 @@ static int fsl_micfil_hw_params(struct snd_pcm_substream *substream,/* 1. Disable the module */ ret =regmap_update_bits (micfil->regmap,REG_MICFIL_CTRL1 , -MICFIL_CTRL1_PDMIEN_MASK ,0 ); +MICFIL_CTRL1_PDMIEN ,0 );if (ret) {dev_err (dev,"failed to disable the module\n" );return ret;
@@ -636,16 +636,16 @@ static irqreturn_t micfil_err_isr(int irq, void *devid)regmap_read (micfil->regmap,REG_MICFIL_STAT , &stat_reg); -if (stat_reg &MICFIL_STAT_BSY_FIL_MASK ) +if (stat_reg &MICFIL_STAT_BSY_FIL )dev_dbg (&pdev->dev,"isr: Decimation Filter is running\n" ); -if (stat_reg &MICFIL_STAT_FIR_RDY_MASK ) +if (stat_reg &MICFIL_STAT_FIR_RDY )dev_dbg (&pdev->dev,"isr: FIR Filter Data ready\n" ); -if (stat_reg &MICFIL_STAT_LOWFREQF_MASK ) { +if (stat_reg &MICFIL_STAT_LOWFREQF ) {dev_dbg (&pdev->dev,"isr: ipg_clk_app is too low\n" );regmap_write_bits (micfil->regmap,REG_MICFIL_STAT , -MICFIL_STAT_LOWFREQF_MASK ,1 ); +MICFIL_STAT_LOWFREQF ,1 ); }return IRQ_HANDLED ;
sound/soc/fsl/fsl_micfil.h +31 -94
169 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/459 ASoC: fsl_micfil: use GENMASK to define register bit fields
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sascha Hauer <[email protected]>
[ Upstream commit 17f2142bae4b6f2e27f19ce57d79fc42ba5ef659 ]
Use GENMASK along with FIELD_PREP and FIELD_GET to access bitfields in registers to straighten register access and to drop a lot of defines.
Stable-dep-of: 06df673d2023 ("ASoC: fsl_micfil: fix regmap_write_bits usage")
--- sound/soc/fsl/fsl_micfil.c | 52 ++++++------- sound/soc/fsl/fsl_micfil.h | 147 ++++++++----------------------------- 2 files changed, 58 insertions(+), 141 deletions(-)
sound/soc/fsl/fsl_micfil.c +26 -26
@@ -1,6 +1,7 @@// SPDX-License-Identifier: GPL-2.0 // Copyright 2018 NXP +#include <linux/bitfield.h> #include <linux/clk.h> #include <linux/device.h> #include <linux/interrupt.h>
@@ -115,23 +116,22 @@ static inline int get_pdm_clk(struct fsl_micfil *micfil,int bclk;regmap_read (micfil->regmap,REG_MICFIL_CTRL2 , &ctrl2_reg); - osr =16 - ((ctrl2_reg &MICFIL_CTRL2_CICOSR_MASK ) - >>MICFIL_CTRL2_CICOSR_SHIFT ); - qsel = ctrl2_reg &MICFIL_CTRL2_QSEL_MASK ; + osr =16 -FIELD_GET (MICFIL_CTRL2_CICOSR , ctrl2_reg); + qsel =FIELD_GET (MICFIL_CTRL2_QSEL , ctrl2_reg);switch (qsel) { -case MICFIL_HIGH_QUALITY : +case MICFIL_QSEL_HIGH_QUALITY : bclk = rate *8 * osr /2 ;/* kfactor = 0.5 */ break ; -case MICFIL_MEDIUM_QUALITY : -case MICFIL_VLOW0_QUALITY : +case MICFIL_QSEL_MEDIUM_QUALITY : +case MICFIL_QSEL_VLOW0_QUALITY : bclk = rate *4 * osr *1 ;/* kfactor = 1 */ break ; -case MICFIL_LOW_QUALITY : -case MICFIL_VLOW1_QUALITY : +case MICFIL_QSEL_LOW_QUALITY : +case MICFIL_QSEL_VLOW1_QUALITY : bclk = rate *2 * osr *2 ;/* kfactor = 2 */ break ; -case MICFIL_VLOW2_QUALITY : +case MICFIL_QSEL_VLOW2_QUALITY : bclk = rate * osr *4 ;/* kfactor = 4 */ break ;default :
@@ -265,8 +265,8 @@ static int fsl_micfil_trigger(struct snd_pcm_substream *substream, int cmd,* 11 - reserved */ ret =regmap_update_bits (micfil->regmap,REG_MICFIL_CTRL1 , -MICFIL_CTRL1_DISEL_MASK , - (1 <<MICFIL_CTRL1_DISEL_SHIFT )); +MICFIL_CTRL1_DISEL , +FIELD_PREP (MICFIL_CTRL1_DISEL ,MICFIL_CTRL1_DISEL_DMA ));if (ret) {dev_err (dev,"failed to update DISEL bits\n" );return ret;
@@ -295,8 +295,8 @@ static int fsl_micfil_trigger(struct snd_pcm_substream *substream, int cmd, } ret =regmap_update_bits (micfil->regmap,REG_MICFIL_CTRL1 , -MICFIL_CTRL1_DISEL_MASK , - (0 <<MICFIL_CTRL1_DISEL_SHIFT )); +MICFIL_CTRL1_DISEL , +FIELD_PREP (MICFIL_CTRL1_DISEL ,MICFIL_CTRL1_DISEL_DISABLE ));if (ret) {dev_err (dev,"failed to update DISEL bits\n" );return ret;
@@ -321,8 +321,8 @@ static int fsl_set_clock_params(struct device *dev, unsigned int rate)/* set CICOSR */ ret |=regmap_update_bits (micfil->regmap,REG_MICFIL_CTRL2 , -MICFIL_CTRL2_CICOSR_MASK , -MICFIL_CTRL2_OSR_DEFAULT ); +MICFIL_CTRL2_CICOSR , +FIELD_PREP (MICFIL_CTRL2_CICOSR ,MICFIL_CTRL2_CICOSR_DEFAULT ));if (ret)dev_err (dev,"failed to set CICOSR in reg 0x%X\n" ,REG_MICFIL_CTRL2 );
@@ -333,7 +333,8 @@ static int fsl_set_clock_params(struct device *dev, unsigned int rate) ret = -EINVAL ; ret |=regmap_update_bits (micfil->regmap,REG_MICFIL_CTRL2 , -MICFIL_CTRL2_CLKDIV_MASK , clk_div); +MICFIL_CTRL2_CLKDIV , +FIELD_PREP (MICFIL_CTRL2_CLKDIV , clk_div));if (ret)dev_err (dev,"failed to set CLKDIV in reg 0x%X\n" ,REG_MICFIL_CTRL2 );
@@ -409,13 +410,13 @@ static int fsl_micfil_dai_probe(struct snd_soc_dai *cpu_dai) {struct fsl_micfil *micfil =dev_get_drvdata (cpu_dai->dev);struct device *dev = cpu_dai->dev; -unsigned int val;int ret;int i;/* set qsel to medium */ ret =regmap_update_bits (micfil->regmap,REG_MICFIL_CTRL2 , -MICFIL_CTRL2_QSEL_MASK ,MICFIL_MEDIUM_QUALITY ); +MICFIL_CTRL2_QSEL , +FIELD_PREP (MICFIL_CTRL2_QSEL ,MICFIL_QSEL_MEDIUM_QUALITY ));if (ret) {dev_err (dev,"failed to set quality mode bits, reg 0x%X\n" ,REG_MICFIL_CTRL2 );
@@ -431,10 +432,9 @@ static int fsl_micfil_dai_probe(struct snd_soc_dai *cpu_dai) &micfil->dma_params_rx);/* FIFO Watermark Control - FIFOWMK*/ - val =MICFIL_FIFO_CTRL_FIFOWMK (micfil->soc->fifo_depth) -1 ; ret =regmap_update_bits (micfil->regmap,REG_MICFIL_FIFO_CTRL , -MICFIL_FIFO_CTRL_FIFOWMK_MASK , - val); +MICFIL_FIFO_CTRL_FIFOWMK , +FIELD_PREP (MICFIL_FIFO_CTRL_FIFOWMK , micfil->soc->fifo_depth -1 ));if (ret) {dev_err (dev,"failed to set FIFOWMK\n" );return ret;
@@ -596,11 +596,11 @@ static irqreturn_t micfil_isr(int irq, void *devid)regmap_read (micfil->regmap,REG_MICFIL_CTRL1 , &ctrl1_reg);regmap_read (micfil->regmap,REG_MICFIL_FIFO_STAT , &fifo_stat_reg); - dma_enabled =MICFIL_DMA_ENABLED (ctrl1_reg); + dma_enabled =FIELD_GET (MICFIL_CTRL1_DISEL , ctrl1_reg) ==MICFIL_CTRL1_DISEL_DMA ;/* Channel 0-7 Output Data Flags */ for (i =0 ; i <MICFIL_OUTPUT_CHANNELS ; i++) { -if (stat_reg &MICFIL_STAT_CHXF_MASK (i)) +if (stat_reg &MICFIL_STAT_CHXF (i))dev_dbg (&pdev->dev,"Data available in Data Channel %d\n" , i);/* if DMA is not enabled, field must be written with 1
@@ -609,17 +609,17 @@ static irqreturn_t micfil_isr(int irq, void *devid)if (!dma_enabled)regmap_write_bits (micfil->regmap,REG_MICFIL_STAT , -MICFIL_STAT_CHXF_MASK (i), +MICFIL_STAT_CHXF (i),1 ); }for (i =0 ; i <MICFIL_FIFO_NUM ; i++) { -if (fifo_stat_reg &MICFIL_FIFO_STAT_FIFOX_OVER_MASK (i)) +if (fifo_stat_reg &MICFIL_FIFO_STAT_FIFOX_OVER (i))dev_dbg (&pdev->dev,"FIFO Overflow Exception flag for channel %d\n" , i); -if (fifo_stat_reg &MICFIL_FIFO_STAT_FIFOX_UNDER_MASK (i)) +if (fifo_stat_reg &MICFIL_FIFO_STAT_FIFOX_UNDER (i))dev_dbg (&pdev->dev,"FIFO Underflow Exception flag for channel %d\n" , i);
sound/soc/fsl/fsl_micfil.h +32 -115
197 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/459 ASoC: fsl_micfil: fix regmap_write_bits usage
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit 06df673d20230afb0e383e39235a4fa8b9a62464 ]
The last parameter 1 means BIT(0), which should be the correct BIT(X).
--- sound/soc/fsl/fsl_micfil.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/fsl/fsl_micfil.c +2 -2
@@ -610,7 +610,7 @@ static irqreturn_t micfil_isr(int irq, void *devid)regmap_write_bits (micfil->regmap,REG_MICFIL_STAT ,MICFIL_STAT_CHXF (i), -1 ); +MICFIL_STAT_CHXF (i)); }for (i =0 ; i <MICFIL_FIFO_NUM ; i++) {
@@ -645,7 +645,7 @@ static irqreturn_t micfil_err_isr(int irq, void *devid)if (stat_reg &MICFIL_STAT_LOWFREQF ) {dev_dbg (&pdev->dev,"isr: ipg_clk_app is too low\n" );regmap_write_bits (micfil->regmap,REG_MICFIL_STAT , -MICFIL_STAT_LOWFREQF ,1 ); +MICFIL_STAT_LOWFREQF ,MICFIL_STAT_LOWFREQF ); }return IRQ_HANDLED ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/459 ASoC: dt-bindings: mt6359: Update generic node name and dmic-mode
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Macpaul Lin <[email protected]>
[ Upstream commit 4649cbd97fdae5069e9a71cd7669b62b90e03669 ]
Some fix and updates in the following items:
1. examples:
Update generic node name to 'audio-codec' to comply with the coming change in 'mt6359.dtsi'. This change is necessary to fix the dtbs_check error:
pmic: 'mt6359codec' does not match any of the regexes: 'pinctrl-[0-9]+'
2. mediatek,dmic-mode:
After inspecting the .dts and .dtsi files using 'mt6359-codec', it was discovered that the definitions of 'two wires' and 'one wire' are inverted compared to the DT schema.
For example, the following boards using MT6359 PMIC:
- mt8192-asurada.dtsi
- mt8195-cherry.dtsi
These boards use the same definitions of 'dmic-mode' as other boards using MT6358 PMIC. The meaning of '0' or '1' has been noted as comments in the device trees.
Upon examining the code in [1] and [2], it was confirmed that the definitions of 'dmic-mode' are consistent between "MT6359 PMIC" and "MT6358 PMIC". Therefore, the DT Schema should be correct as is.
References:
[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/sound/soc/codecs/mt6358.c#n1875
[2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/sound/soc/codecs/mt6359.c#L1515
--- Documentation/devicetree/bindings/sound/mt6359.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
Documentation/devicetree/bindings/sound/mt6359.yaml +5 -5
@@ -23,8 +23,8 @@ properties: Indicates how many data pins are used to transmit two channels of PDM signal. 0 means two wires, 1 means one wire. Default value is 0. enum: - - 0 # one wire - - 1 # two wires + - 0 # two wires + - 1 # one wire mediatek,mic-type-0: $ref: /schemas/types.yaml#/definitions/uint32
@@ -53,9 +53,9 @@ additionalProperties: false examples: - | - mt6359codec: mt6359codec { - mediatek,dmic-mode = <0>; - mediatek,mic-type-0 = <2>; + mt6359codec: audio-codec { + mediatek,dmic-mode = <0>; + mediatek,mic-type-0 = <2>; }; ...
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/459 bpf: Fix the xdp_adjust_tail sample prog issue
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Chen <[email protected]>
[ Upstream commit 4236f114a3ffbbfd217436c08852e94cae372f57 ]
During the xdp_adjust_tail test, probabilistic failure occurs and SKB package is discarded by the kernel. After checking the issues by tracking SKB package, it is identified that they were caused by checksum errors. Refer to checksum of the arch/arm64/include/asm/checksum.h for fixing.
v2: Based on Alexei Starovoitov's suggestions, it is necessary to keep the code
implementation consistent.
--- samples/bpf/xdp_adjust_tail_kern.c | 1 + 1 file changed, 1 insertion(+)
samples/bpf/xdp_adjust_tail_kern.c +1 -0
@@ -57,6 +57,7 @@ static __always_inline void swap_mac(void *data, struct ethhdr *orig_eth) static __always_inline __u16 csum_fold_helper(__u32 csum) { + csum = (csum &0xffff ) + (csum >>16 );return ~((csum &0xffff ) + (csum >>16 )); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/459 xfrm: rename xfrm_state_offload struct to allow reuse
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 87e0a94e60ea2e29be9dec6bc146fbc9861a4055 ]
The struct xfrm_state_offload has all fields needed to hold information for offloaded policies too. In order to do not create new struct with same fields, let's rename existing one and reuse it later.
Stable-dep-of: 2cf567f421db ("netdevsim: copy addresses for both in and out paths")
--- include/net/xfrm.h | 10 +++++----- net/xfrm/xfrm_device.c | 2 +- net/xfrm/xfrm_state.c | 4 ++-- net/xfrm/xfrm_user.c | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-)
include/net/xfrm.h +5 -5
@@ -126,7 +126,7 @@ struct xfrm_state_walk {struct xfrm_address_filter *filter; }; -struct xfrm_state_offload { +struct xfrm_dev_offload {struct net_device *dev;struct net_device *real_dev;unsigned long offload_handle;
@@ -240,7 +240,7 @@ struct xfrm_state {struct xfrm_lifetime_cur curlft;struct hrtimer mtimer; -struct xfrm_state_offload xso; +struct xfrm_dev_offload xso;/* used to fix curlft->add_time when changing date */ long saved_tmo;
@@ -1892,7 +1892,7 @@ bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x);static inline void xfrm_dev_state_advance_esn (struct xfrm_state *x) { -struct xfrm_state_offload *xso = &x->xso; +struct xfrm_dev_offload *xso = &x->xso;if (xso->dev && xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn) xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn (x);
@@ -1918,7 +1918,7 @@ static inline bool xfrm_dst_offload_ok(struct dst_entry *dst)static inline void xfrm_dev_state_delete (struct xfrm_state *x) { -struct xfrm_state_offload *xso = &x->xso; +struct xfrm_dev_offload *xso = &x->xso;if (xso->dev) xso->dev->xfrmdev_ops->xdo_dev_state_delete (x);
@@ -1926,7 +1926,7 @@ static inline void xfrm_dev_state_delete(struct xfrm_state *x)static inline void xfrm_dev_state_free (struct xfrm_state *x) { -struct xfrm_state_offload *xso = &x->xso; +struct xfrm_dev_offload *xso = &x->xso;struct net_device *dev = xso->dev;if (dev && dev->xfrmdev_ops) {
net/xfrm/xfrm_device.c +1 -1
@@ -225,7 +225,7 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,int err;struct dst_entry *dst;struct net_device *dev; -struct xfrm_state_offload *xso = &x->xso; +struct xfrm_dev_offload *xso = &x->xso;xfrm_address_t *saddr;xfrm_address_t *daddr;
net/xfrm/xfrm_state.c +2 -2
@@ -726,7 +726,7 @@ xfrm_dev_state_flush_secctx_check(struct net *net, struct net_device *dev, boolfor (i =0 ; i <= net->xfrm.state_hmask; i++) {struct xfrm_state *x; -struct xfrm_state_offload *xso; +struct xfrm_dev_offload *xso;hlist_for_each_entry (x, net->xfrm.state_bydst+i, bydst) { xso = &x->xso;
@@ -810,7 +810,7 @@ int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_vali err = -ESRCH ;for (i =0 ; i <= net->xfrm.state_hmask; i++) {struct xfrm_state *x; -struct xfrm_state_offload *xso; +struct xfrm_dev_offload *xso; restart:hlist_for_each_entry (x, net->xfrm.state_bydst+i, bydst) { xso = &x->xso;
net/xfrm/xfrm_user.c +1 -1
@@ -843,7 +843,7 @@ static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)return 0 ; } -static int copy_user_offload (struct xfrm_state_offload *xso,struct sk_buff *skb) +static int copy_user_offload (struct xfrm_dev_offload *xso,struct sk_buff *skb) {struct xfrm_user_offload *xuo;struct nlattr *attr;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/459 xfrm: store and rely on direction to construct offload flags
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 482db2f1dd211f73ad9d71e33ae15c1df6379982 ]
XFRM state doesn't need anything from flags except to understand direction, so store it separately. For future patches, such change will allow us to reuse xfrm_dev_offload for policy offload too, which has three possible directions instead of two.
Stable-dep-of: 2cf567f421db ("netdevsim: copy addresses for both in and out paths")
--- include/net/xfrm.h | 6 ++++++ net/xfrm/xfrm_device.c | 8 +++++++- net/xfrm/xfrm_user.c | 3 ++- 3 files changed, 15 insertions(+), 2 deletions(-)
include/net/xfrm.h +6 -0
@@ -126,12 +126,18 @@ struct xfrm_state_walk {struct xfrm_address_filter *filter; }; +enum { +XFRM_DEV_OFFLOAD_IN =1 , +XFRM_DEV_OFFLOAD_OUT , +}; +struct xfrm_dev_offload {struct net_device *dev;struct net_device *real_dev;unsigned long offload_handle;unsigned int num_exthdrs;u8 flags; +u8 dir :2 ; };struct xfrm_mode {
net/xfrm/xfrm_device.c +7 -1
@@ -129,7 +129,7 @@ struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t featur sp =skb_sec_path (skb); x = sp->xvec[sp->len -1 ]; -if (xo->flags &XFRM_GRO || x->xso.flags &XFRM_OFFLOAD_INBOUND ) +if (xo->flags &XFRM_GRO || x->xso.dir ==XFRM_DEV_OFFLOAD_IN )return skb;/* This skb was already validated on the upper/virtual dev */
@@ -285,11 +285,17 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,/* Don't forward bit that is not implemented */ xso->flags = xuo->flags & ~XFRM_OFFLOAD_IPV6 ; +if (xuo->flags &XFRM_OFFLOAD_INBOUND ) + xso->dir =XFRM_DEV_OFFLOAD_IN ; +else + xso->dir =XFRM_DEV_OFFLOAD_OUT ; + err = dev->xfrmdev_ops->xdo_dev_state_add (x);if (err) { xso->num_exthdrs =0 ; xso->flags =0 ; xso->dev =NULL ; + xso->dir =0 ; xso->real_dev =NULL ;dev_put (dev);
net/xfrm/xfrm_user.c +2 -1
@@ -855,7 +855,8 @@ static int copy_user_offload(struct xfrm_dev_offload *xso, struct sk_buff *skb) xuo =nla_data (attr);memset (xuo,0 ,sizeof (*xuo)); xuo->ifindex = xso->dev->ifindex; - xuo->flags = xso->flags; +if (xso->dir ==XFRM_DEV_OFFLOAD_IN ) + xuo->flags =XFRM_OFFLOAD_INBOUND ;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/459 netdevsim: rely on XFRM state direction instead of flags
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 55e2f83afb1c142885da63c5a9ce2998b6f6ab21 ]
Make sure that netdevsim relies on direction and not on flags.
Stable-dep-of: 2cf567f421db ("netdevsim: copy addresses for both in and out paths")
--- drivers/net/netdevsim/ipsec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/netdevsim/ipsec.c +1 -1
@@ -171,7 +171,7 @@ static int nsim_ipsec_add_sa(struct xfrm_state *xs)return ret; } -if (xs->xso.flags &XFRM_OFFLOAD_INBOUND ) { +if (xs->xso.dir ==XFRM_DEV_OFFLOAD_IN ) { sa.rx = true;if (xs->props.family ==AF_INET6 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/459 netdevsim: copy addresses for both in and out paths
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 2cf567f421dbfe7e53b7e5ddee9400da10efb75d ]
The current code only copies the address for the in path, leaving the out path address set to 0. This patch corrects the issue by copying the addresses for both the in and out paths. Before this patch:
# cat /sys/kernel/debug/netdevsim/netdevsim0/ports/0/ipsec SA count=2 tx=20 sa[0] tx ipaddr=0.0.0.0 sa[0] spi=0x00000100 proto=0x32 salt=0x0adecc3a crypt=1 sa[0] key=0x3167608a ca4f1397 43565909 941fa627 sa[1] rx ipaddr=192.168.0.1 sa[1] spi=0x00000101 proto=0x32 salt=0x0adecc3a crypt=1 sa[1] key=0x3167608a ca4f1397 43565909 941fa627
After this patch:
= cat /sys/kernel/debug/netdevsim/netdevsim0/ports/0/ipsec SA count=2 tx=20
sa[0] tx ipaddr=192.168.0.2
sa[0] spi=0x00000100 proto=0x32 salt=0x0adecc3a crypt=1
sa[0] key=0x3167608a ca4f1397 43565909 941fa627
sa[1] rx ipaddr=192.168.0.1
sa[1] spi=0x00000101 proto=0x32 salt=0x0adecc3a crypt=1
sa[1] key=0x3167608a ca4f1397 43565909 941fa627
--- drivers/net/netdevsim/ipsec.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/net/netdevsim/ipsec.c +5 -6
@@ -171,14 +171,13 @@ static int nsim_ipsec_add_sa(struct xfrm_state *xs)return ret; } -if (xs->xso.dir ==XFRM_DEV_OFFLOAD_IN ) { +if (xs->xso.dir ==XFRM_DEV_OFFLOAD_IN ) sa.rx = true; -if (xs->props.family ==AF_INET6 ) -memcpy (sa.ipaddr, &xs->id.daddr.a6,16 ); -else -memcpy (&sa.ipaddr[3 ], &xs->id.daddr.a4,4 ); - } +if (xs->props.family ==AF_INET6 ) +memcpy (sa.ipaddr, &xs->id.daddr.a6,16 ); +else +memcpy (&sa.ipaddr[3 ], &xs->id.daddr.a4,4 );/* the preparations worked, so save the info */ memcpy (&ipsec->sa[sa_idx], &sa,sizeof (sa));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/459 drm/bridge: tc358767: Fix link properties discovery
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 2d343723c7e1f9f6d64f721f07cfdfc2993758d1 ]
When a display controller driver uses DRM_BRIDGE_ATTACH_NO_CONNECTOR, tc358767 will behave properly and skip the creation of the connector.
However, tc_get_display_props(), which is used to find out about the DP monitor and link, is only called from two places: .atomic_enable() and tc_connector_get_modes(). The latter is only used when tc358767 creates its own connector, i.e. when DRM_BRIDGE_ATTACH_NO_CONNECTOR is _not_ set.
Thus, the driver never finds out the link properties before get_edid() is called. With num_lanes of 0 and link_rate of 0 there are not many valid modes...
Fix this by adding tc_get_display_props() call at the beginning of get_edid(), so that we have up to date information before looking at the modes.
--- drivers/gpu/drm/bridge/tc358767.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/gpu/drm/bridge/tc358767.c +7 -0
@@ -1319,6 +1319,13 @@ static struct edid *tc_get_edid(struct drm_bridge *bridge, struct drm_connector *connector) {struct tc_data *tc =bridge_to_tc (bridge); +int ret; + + ret =tc_get_display_props (tc); +if (ret <0 ) { +dev_err (tc->dev,"failed to read display props: %d\n" , ret); +return 0 ; + }return drm_get_edid (connector, &tc->aux.ddc); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/459 selftests/bpf: Fix msg_verify_data in test_sockmap
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit ee9b352ce4650ffc0d8ca0ac373d7c009c7e561e ]
Function msg_verify_data should have context of bytes_cnt and k instead of assuming they are zero. Otherwise, test_sockmap with data integrity test will report some errors. I also fix the logic related to size and index j
1/ 6 sockmap::txmsg test passthrough:FAIL 2/ 6 sockmap::txmsg test redirect:FAIL 7/12 sockmap::txmsg test apply:FAIL 10/11 sockmap::txmsg test push_data:FAIL 11/17 sockmap::txmsg test pull-data:FAIL 12/ 9 sockmap::txmsg test pop-data:FAIL 13/ 1 sockmap::txmsg test push/pop data:FAIL
...
Pass: 24 Fail: 52
After applying this patch, some of the errors are solved, but for push, pull and pop, we may need more fixes to msg_verify_data, added a TODO
10/11 sockmap::txmsg test push_data:FAIL 11/17 sockmap::txmsg test pull-data:FAIL 12/ 9 sockmap::txmsg test pop-data:FAIL
...
Pass: 37 Fail: 15
Besides, added a custom errno EDATAINTEGRITY for msg_verify_data, we shall not ignore the error in txmsg_cork case.
--- tools/testing/selftests/bpf/test_sockmap.c | 30 ++++++++++++++-------- 1 file changed, 20 insertions(+), 10 deletions(-)
tools/testing/selftests/bpf/test_sockmap.c +20 -10
@@ -58,6 +58,8 @@ static void running_handler(int a);#define BPF_SOCKHASH_FILENAME "test_sockhash_kern.o"#define CG_PATH "/sockmap" +#define EDATAINTEGRITY 2001 +/* global sockets */ int s1, s2, c1, c2, p1, p2;int test_cnt;
@@ -509,23 +511,25 @@ static int msg_alloc_iov(struct msghdr *msg,return -ENOMEM ; } -static int msg_verify_data (struct msghdr *msg,int size,int chunk_sz) +/* TODO: Add verification logic for push, pull and pop data */ +static int msg_verify_data (struct msghdr *msg,int size,int chunk_sz, +unsigned char *k_p,int *bytes_cnt_p) { -int i, j =0 , bytes_cnt =0 ; -unsigned char k =0 ; +int i, j, bytes_cnt = *bytes_cnt_p; +unsigned char k = *k_p; -for (i =0 ; i < msg->msg_iovlen; i++) { +for (i =0 , j =0 ; i < msg->msg_iovlen && size; i++, j =0 ) {unsigned char *d = msg->msg_iov[i].iov_base;/* Special case test for skb ingress + ktls */ if (i ==0 && txmsg_ktls_skb) {if (msg->msg_iov[i].iov_len <4 ) -return -EIO ; +return -EDATAINTEGRITY ;if (memcmp (d,"PASS" ,4 ) !=0 ) {fprintf (stderr,"detected skb data error with skb ingress update @iov[%i]:%i \"%02x %02x %02x %02x\" != \"PASS\"\n" , i,0 , d[0 ], d[1 ], d[2 ], d[3 ]); -return -EIO ; +return -EDATAINTEGRITY ; } j =4 ;/* advance index past PASS header */ }
@@ -535,7 +539,7 @@ static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz)fprintf (stderr,"detected data corruption @iov[%i]:%i %02x != %02x, %02x ?= %02x\n" , i, j, d[j], k -1 , d[j+1 ], k); -return -EIO ; +return -EDATAINTEGRITY ; } bytes_cnt++;if (bytes_cnt == chunk_sz) {
@@ -545,6 +549,8 @@ static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz) size--; } } + *k_p = k; + *bytes_cnt_p = bytes_cnt;return 0 ; }
@@ -593,6 +599,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,float total_bytes, txmsg_pop_total;int fd_flags =O_NONBLOCK ;struct timeval timeout; +unsigned char k =0 ; +int bytes_cnt =0 ;fd_set w;fcntl (fd, fd_flags);
@@ -671,7 +679,7 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, iov_length * cnt :iov_length * iov_count; - errno =msg_verify_data (&msg, recv, chunk_sz); + errno =msg_verify_data (&msg, recv, chunk_sz, &k, &bytes_cnt);if (errno) {perror ("data verify msg failed" ); goto out_errno;
@@ -679,7 +687,9 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,if (recvp) { errno =msg_verify_data (&msg_peek, recvp, - chunk_sz); + chunk_sz, + &k, + &bytes_cnt);if (errno) {perror ("data verify msg_peek failed" ); goto out_errno;
@@ -770,7 +780,7 @@ static int sendmsg_test(struct sockmap_options *opt) s.bytes_sent, sent_Bps, sent_Bps/giga, s.bytes_recvd, recvd_Bps, recvd_Bps/giga, peek_flag ? "(peek_msg)" : ""); -if (err && txmsg_cork) +if (err && err != -EDATAINTEGRITY && txmsg_cork) err =0 ;exit (err ?1 :0 ); }else if (rxpid ==-1 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/459 selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit b29e231d66303c12b7b8ac3ac2a057df06b161e8 ]
txmsg_redir in "Test pull + redirect" case of test_txmsg_pull should be 1 instead of 0.
--- tools/testing/selftests/bpf/test_sockmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/test_sockmap.c +1 -1
@@ -1557,7 +1557,7 @@ static void test_txmsg_pull(int cgrp, struct sockmap_options *opt)test_send_large (opt, cgrp);/* Test pull + redirect */ - txmsg_redir =0 ; + txmsg_redir =1 ; txmsg_start =1 ; txmsg_end =2 ;test_send (opt, cgrp);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/459 wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alper Nebi Yasak <[email protected]>
[ Upstream commit d241a139c2e9f8a479f25c75ebd5391e6a448500 ]
Replace one-element array with a flexible-array member in struct mwifiex_ie_types_wildcard_ssid_params to fix the following warning on a MT8173 Chromebook (mt8173-elm-hana):
[ 356.775250] ------------[ cut here ]------------ [ 356.784543] memcpy: detected field-spanning write (size 6) of single field "wildcard_ssid_tlv->ssid" at drivers/net/wireless/marvell/mwifiex/scan.c:904 (size 1) [ 356.813403] WARNING: CPU: 3 PID: 742 at drivers/net/wireless/marvell/mwifiex/scan.c:904 mwifiex_scan_networks+0x4fc/0xf28 [mwifiex]
The "(size 6)" above is exactly the length of the SSID of the network this device was connected to. The source of the warning looks like:
ssid_len = user_scan_in->ssid_list[i].ssid_len;
[...]
memcpy(wildcard_ssid_tlv->ssid,
user_scan_in->ssid_list[i].ssid, ssid_len);There is a #define WILDCARD_SSID_TLV_MAX_SIZE that uses sizeof() on this struct, but it already didn't account for the size of the one-element array, so it doesn't need to be changed.
--- drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/marvell/mwifiex/fw.h +1 -1
@@ -854,7 +854,7 @@ struct mwifiex_ietypes_chanstats {struct mwifiex_ie_types_wildcard_ssid_params {struct mwifiex_ie_types_header header;u8 max_ssid_length; -u8 ssid[1 ]; +u8 ssid[]; } __packed;#define TSF_DATA_SIZE 8
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/459 drm/fsl-dcu: Convert to Linux IRQ interfaces
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
[ Upstream commit 03ac16e584e496230903ba20f2b4bbfd942a16b4 ]
Drop the DRM IRQ midlayer in favor of Linux IRQ interfaces. DRM's IRQ helpers are mostly useful for UMS drivers. Modern KMS drivers don't benefit from using it. DRM IRQ callbacks are now being called directly or inlined.
Stable-dep-of: ffcde9e44d3e ("drm: fsl-dcu: enable PIXCLK on LS1021A")
--- drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 78 +++++++++++++---------- 1 file changed, 46 insertions(+), 32 deletions(-)
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c +46 -32
@@ -23,7 +23,6 @@#include <drm/drm_fb_cma_helper.h> #include <drm/drm_fb_helper.h> #include <drm/drm_gem_cma_helper.h> -#include <drm/drm_irq.h> #include <drm/drm_modeset_helper.h> #include <drm/drm_probe_helper.h> #include <drm/drm_vblank.h>
@@ -51,7 +50,7 @@ static const struct regmap_config fsl_dcu_regmap_config = { .volatile_reg = fsl_dcu_drm_is_volatile_reg, }; -static void fsl_dcu_irq_uninstall (struct drm_device *dev) +static void fsl_dcu_irq_reset (struct drm_device *dev) {struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
@@ -59,6 +58,45 @@ static void fsl_dcu_irq_uninstall(struct drm_device *dev)regmap_write (fsl_dev->regmap,DCU_INT_MASK , ~0 ); } +static irqreturn_t fsl_dcu_drm_irq (int irq,void *arg) +{ +struct drm_device *dev = arg; +struct fsl_dcu_drm_device *fsl_dev = dev->dev_private; +unsigned int int_status; +int ret; + + ret =regmap_read (fsl_dev->regmap,DCU_INT_STATUS , &int_status); +if (ret) { +dev_err (dev->dev,"read DCU_INT_STATUS failed\n" ); +return IRQ_NONE ; + } + +if (int_status &DCU_INT_STATUS_VBLANK ) +drm_handle_vblank (dev,0 ); + +regmap_write (fsl_dev->regmap,DCU_INT_STATUS , int_status); + +return IRQ_HANDLED ; +} + +static int fsl_dcu_irq_install (struct drm_device *dev,unsigned int irq) +{ +if (irq ==IRQ_NOTCONNECTED ) +return -ENOTCONN ; + +fsl_dcu_irq_reset (dev); + +return request_irq (irq, fsl_dcu_drm_irq,0 , dev->driver->name, dev); +} + +static void fsl_dcu_irq_uninstall (struct drm_device *dev) +{ +struct fsl_dcu_drm_device *fsl_dev = dev->dev_private; + +fsl_dcu_irq_reset (dev); +free_irq (fsl_dev->irq, dev); +} +static int fsl_dcu_load (struct drm_device *dev,unsigned long flags) {struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
@@ -73,13 +111,13 @@ static int fsl_dcu_load(struct drm_device *dev, unsigned long flags) ret =drm_vblank_init (dev, dev->mode_config.num_crtc);if (ret <0 ) {dev_err (dev->dev,"failed to initialize vblank\n" ); - goto done; + goto done_vblank; } - ret =drm_irq_install (dev, fsl_dev->irq); + ret =fsl_dcu_irq_install (dev, fsl_dev->irq);if (ret <0 ) {dev_err (dev->dev,"failed to install IRQ handler\n" ); - goto done; + goto done_irq; } if (legacyfb_depth != 16 && legacyfb_depth != 24 &&
@@ -90,11 +128,11 @@ static int fsl_dcu_load(struct drm_device *dev, unsigned long flags) }return 0 ; -done: +done_irq:drm_kms_helper_poll_fini (dev);drm_mode_config_cleanup (dev); -drm_irq_uninstall (dev); +done_vblank: dev->dev_private =NULL ;return ret;
@@ -106,41 +144,17 @@ static void fsl_dcu_unload(struct drm_device *dev)drm_kms_helper_poll_fini (dev);drm_mode_config_cleanup (dev); -drm_irq_uninstall (dev); +fsl_dcu_irq_uninstall (dev); dev->dev_private =NULL ; } -static irqreturn_t fsl_dcu_drm_irq (int irq,void *arg) -{ -struct drm_device *dev = arg; -struct fsl_dcu_drm_device *fsl_dev = dev->dev_private; -unsigned int int_status; -int ret; - - ret =regmap_read (fsl_dev->regmap,DCU_INT_STATUS , &int_status); -if (ret) { -dev_err (dev->dev,"read DCU_INT_STATUS failed\n" ); -return IRQ_NONE ; - } - -if (int_status &DCU_INT_STATUS_VBLANK ) -drm_handle_vblank (dev,0 ); - -regmap_write (fsl_dev->regmap,DCU_INT_STATUS , int_status); - -return IRQ_HANDLED ; -} -DEFINE_DRM_GEM_CMA_FOPS (fsl_dcu_drm_fops);static struct drm_driver fsl_dcu_drm_driver = { .driver_features =DRIVER_GEM |DRIVER_MODESET |DRIVER_ATOMIC , .load = fsl_dcu_load, .unload = fsl_dcu_unload, - .irq_handler = fsl_dcu_drm_irq, - .irq_preinstall = fsl_dcu_irq_uninstall, - .irq_uninstall = fsl_dcu_irq_uninstall,DRM_GEM_CMA_DRIVER_OPS , .fops = &fsl_dcu_drm_fops, .name ="fsl-dcu-drm" ,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/459 drm: fsl-dcu: enable PIXCLK on LS1021A
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Schiffer <[email protected]>
[ Upstream commit ffcde9e44d3e18fde3d18bfff8d9318935413bfd ]
The PIXCLK needs to be enabled in SCFG before accessing certain DCU registers, or the access will hang. For simplicity, the PIXCLK is enabled unconditionally, resulting in increased power consumption.
--- drivers/gpu/drm/fsl-dcu/Kconfig | 1 + drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 15 +++++++++++++++ drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h | 3 +++ 3 files changed, 19 insertions(+)
drivers/gpu/drm/fsl-dcu/Kconfig +1 -0
@@ -8,6 +8,7 @@ config DRM_FSL_DCU select DRM_PANEL select REGMAP_MMIO select VIDEOMODE_HELPERS + select MFD_SYSCON if SOC_LS1021A help Choose this option if you have an Freescale DCU chipset. If M is selected the module will be called fsl-dcu-drm.
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c +15 -0
@@ -100,6 +100,7 @@ static void fsl_dcu_irq_uninstall(struct drm_device *dev)static int fsl_dcu_load (struct drm_device *dev,unsigned long flags) {struct fsl_dcu_drm_device *fsl_dev = dev->dev_private; +struct regmap *scfg;int ret; ret =fsl_dcu_drm_modeset_init (fsl_dev);
@@ -108,6 +109,20 @@ static int fsl_dcu_load(struct drm_device *dev, unsigned long flags)return ret; } + scfg =syscon_regmap_lookup_by_compatible ("fsl,ls1021a-scfg" ); +if (PTR_ERR (scfg) != -ENODEV ) { +/* +* For simplicity, enable the PIXCLK unconditionally, +* resulting in increased power consumption. Disabling +* the clock in PM or on unload could be implemented as +* a future improvement. +*/ + ret =regmap_update_bits (scfg,SCFG_PIXCLKCR ,SCFG_PIXCLKCR_PXCEN , +SCFG_PIXCLKCR_PXCEN ); +if (ret <0 ) +return dev_err_probe (dev->dev, ret,"failed to enable pixclk\n" ); + } + ret =drm_vblank_init (dev, dev->mode_config.num_crtc);if (ret <0 ) {dev_err (dev->dev,"failed to initialize vblank\n" );
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h +3 -0
@@ -160,6 +160,9 @@#define FSL_DCU_ARGB4444 12#define FSL_DCU_YUV422 14 +#define SCFG_PIXCLKCR 0x28 +#define SCFG_PIXCLKCR_PXCEN BIT(31) +#define VF610_LAYER_REG_NUM 9#define LS1021A_LAYER_REG_NUM 10
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/459 octeontx2-af: Mbox changes for 98xx
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Subbaraya Sundeep <[email protected]>
[ Upstream commit a84cdcea3b4feb46730c88454b5f85e828429c2b ]
This patch puts together all mailbox changes for 98xx silicon:
Attach ->
Modify resource attach mailbox handler to request LFs from a block address out of multiple blocks of same type. If a PF/VF need LFs from two blocks of same type then attach mbox should be called twice.
Example:
struct rsrc_attach *attach;
.. Allocate memory for message ..
attach->cptlfs = 3; /* 3 LFs from CPT0 */
.. Send message ..
.. Allocate memory for message ..
attach->modify = 1;
attach->cpt_blkaddr = BLKADDR_CPT1;
attach->cptlfs = 2; /* 2 LFs from CPT1 */
.. Send message ..Detach ->
Update detach mailbox and its handler to detach resources from CPT1 and NIX1 blocks.
MSIX ->
Updated the MSIX mailbox and its handler to return MSIX offsets for the new block CPT1.
Free resources ->
Update free_rsrc mailbox and its handler to return the free resources count of new blocks NIX1 and CPT1
Links ->
Number of CGX,LBK and SDP links may vary between platforms. For example, in 98xx number of CGX and LBK links are more than 96xx. Hence the info about number of links present in hardware is useful for consumers to request link configuration properly. This patch sends this info in nix_lf_alloc_rsp.
Stable-dep-of: e26f8eac6bb2 ("octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c")
--- .../net/ethernet/marvell/octeontx2/af/mbox.h | 19 ++++- .../net/ethernet/marvell/octeontx2/af/rvu.c | 85 +++++++++++++++---- .../ethernet/marvell/octeontx2/af/rvu_nix.c | 4 + .../ethernet/marvell/octeontx2/af/rvu_reg.c | 2 +- .../marvell/octeontx2/af/rvu_struct.h | 2 + 5 files changed, 94 insertions(+), 18 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/mbox.h +18 -1
@@ -86,7 +86,7 @@ struct mbox_msghdr {#define OTX2_MBOX_REQ_SIG (0xdead)#define OTX2_MBOX_RSP_SIG (0xbeef)u16 sig;/* Signature, for validating corrupted msgs */ -#define OTX2_MBOX_VERSION (0x0001) +#define OTX2_MBOX_VERSION (0x0007)u16 ver;/* Version of msg's structure for this ID */ u16 next_msgoff;/* Offset of next msg within mailbox region */ int rc;/* Msg process'ed response code */
@@ -271,6 +271,17 @@ struct ready_msg_rsp {* or to detach partial of a cetain resource type. * Rest of the fields specify how many of what type to * be attached. +* To request LFs from two blocks of same type this mailbox +* can be sent twice as below: +* struct rsrc_attach *attach; +* .. Allocate memory for message .. +* attach->cptlfs = 3; <3 LFs from CPT0> +* .. Send message .. +* .. Allocate memory for message .. +* attach->modify = 1; +* attach->cpt_blkaddr = BLKADDR_CPT1; +* attach->cptlfs = 2; <2 LFs from CPT1> +* .. Send message .. */ struct rsrc_attach {struct mbox_msghdr hdr;
@@ -281,6 +292,7 @@ struct rsrc_attach {u16 ssow;u16 timlfs;u16 cptlfs; +int cpt_blkaddr;/* BLKADDR_CPT0/BLKADDR_CPT1 or 0 for BLKADDR_CPT0 */ };/* Structure for relinquishing resources.
@@ -314,6 +326,8 @@ struct msix_offset_rsp {u16 ssow_msixoff[MAX_RVU_BLKLF_CNT ];u16 timlf_msixoff[MAX_RVU_BLKLF_CNT ];u16 cptlf_msixoff[MAX_RVU_BLKLF_CNT ]; +u8 cpt1_lfs; +u16 cpt1_lf_msixoff[MAX_RVU_BLKLF_CNT ]; };struct get_hw_cap_rsp {
@@ -491,6 +505,9 @@ struct nix_lf_alloc_rsp {u8 lf_tx_stats;/* NIX_AF_CONST1::LF_TX_STATS */ u16 cints;/* NIX_AF_CONST2::CINTS */ u16 qints;/* NIX_AF_CONST2::QINTS */ +u8 cgx_links;/* No. of CGX links present in HW */ +u8 lbk_links;/* No. of LBK links present in HW */ +u8 sdp_links;/* No. of SDP links present in HW */ };/* NIX AQ enqueue msg */
drivers/net/ethernet/marvell/octeontx2/af/rvu.c +69 -16
185 lines not on this page · raw message
drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +4 -0
@@ -1179,6 +1179,10 @@ int rvu_mbox_handler_nix_lf_alloc(struct rvu *rvu, cfg =rvu_read64 (rvu, blkaddr,NIX_AF_CONST2 ); rsp->qints = ((cfg >>12 ) &0xFFF ); rsp->cints = ((cfg >>24 ) &0xFFF ); + rsp->cgx_links = hw->cgx_links; + rsp->lbk_links = hw->lbk_links; + rsp->sdp_links = hw->sdp_links; +return rc; }
drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.c +1 -1
@@ -35,7 +35,7 @@ static struct hw_reg_map txsch_reg_map[NIX_TXSCH_LVL_CNT] = { {0x1200, 0x12E0} } }, {NIX_TXSCH_LVL_TL3, 3, 0xFFFF, {{0x1000, 0x10E0}, {0x1600, 0x1608}, {0x1610, 0x1618} } }, - {NIX_TXSCH_LVL_TL2, 2, 0xFFFF, {{0x0E00, 0x0EE0}, {0x1700, 0x1768} } }, + {NIX_TXSCH_LVL_TL2, 2, 0xFFFF, {{0x0E00, 0x0EE0}, {0x1700, 0x17B0} } }, {NIX_TXSCH_LVL_TL1, 1, 0xFFFF, {{0x0C00, 0x0D98} } }, };
drivers/net/ethernet/marvell/octeontx2/af/rvu_struct.h +2 -0
@@ -14,6 +14,8 @@/* RVU Block revision IDs */ #define RVU_BLK_RVUM_REVID 0x01 +#define RVU_MULTI_BLK_VER 0x7ULL +/* RVU Block Address Enumeration */ enum rvu_block_addr_e {BLKADDR_RVUM =0x0ULL ,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/459 octeontx2-pf: Calculate LBK link instead of hardcoding
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Subbaraya Sundeep <[email protected]>
[ Upstream commit 8bcf5ced6526e1c4c8a2703f9ca9135fef7409d6 ]
CGX links are followed by LBK links but number of
CGX and LBK links varies between platforms. Hence
get the number of links present in hardware from
AF and use it to calculate LBK link number.
Stable-dep-of: e26f8eac6bb2 ("octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c")
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 8 ++++++-- drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h | 2 ++ 2 files changed, 8 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +6 -2
@@ -532,8 +532,10 @@ static int otx2_get_link(struct otx2_nic *pfvf) link =4 * ((map >>8 ) &0xF ) + ((map >>4 ) &0xF ); }/* LBK channel */ -if (pfvf->hw.tx_chan_base <SDP_CHAN_BASE ) - link =12 ; +if (pfvf->hw.tx_chan_base <SDP_CHAN_BASE ) { + map = pfvf->hw.tx_chan_base &0x7FF ; + link = pfvf->hw.cgx_links | ((map >>8 ) &0xF ); + }return link; }
@@ -1519,6 +1521,8 @@ void mbox_handler_nix_lf_alloc(struct otx2_nic *pfvf, pfvf->hw.tx_chan_base = rsp->tx_chan_base; pfvf->hw.lso_tsov4_idx = rsp->lso_tsov4_idx; pfvf->hw.lso_tsov6_idx = rsp->lso_tsov6_idx; + pfvf->hw.cgx_links = rsp->cgx_links; + pfvf->hw.lbk_links = rsp->lbk_links; }EXPORT_SYMBOL (mbox_handler_nix_lf_alloc);
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h +2 -0
@@ -197,6 +197,8 @@ struct otx2_hw {struct otx2_drv_stats drv_stats;u64 cgx_rx_stats[CGX_RX_STATS_COUNT ];u64 cgx_tx_stats[CGX_TX_STATS_COUNT ]; +u8 cgx_links;/* No. of CGX links present in HW */ +u8 lbk_links;/* No. of LBK links present in HW */ };struct otx2_vf_config {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/459 octeontx2-af: forward error correction configuration
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christina Jacob <[email protected]>
[ Upstream commit 84c4f9cab4f99e774a8d9bbee299d288bdb2d792 ]
CGX block supports forward error correction modes baseR and RS. This patch adds support to set encoding mode and to read corrected/uncorrected block counters
Adds new mailbox handlers set_fec to configure encoding modes and fec_stats to read counters and also increase mbox timeout to accomdate firmware command response timeout.
Along with new CGX_CMD_SET_FEC command add other commands to sync with kernel enum list with firmware.
Stable-dep-of: e26f8eac6bb2 ("octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c")
--- .../net/ethernet/marvell/octeontx2/af/cgx.c | 76 +++++++++++++++++++ .../net/ethernet/marvell/octeontx2/af/cgx.h | 7 ++ .../ethernet/marvell/octeontx2/af/cgx_fw_if.h | 17 ++++- .../net/ethernet/marvell/octeontx2/af/mbox.h | 24 +++++- .../ethernet/marvell/octeontx2/af/rvu_cgx.c | 33 ++++++++ 5 files changed, 155 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/cgx.c +76 -0
@@ -340,6 +340,60 @@ int cgx_get_tx_stats(void *cgxd, int lmac_id, int idx, u64 *tx_stat)return 0 ; } +static int cgx_set_fec_stats_count (struct cgx_link_user_info *linfo) +{ +if (!linfo->fec) +return 0 ; + +switch (linfo->lmac_type_id) { +case LMAC_MODE_SGMII : +case LMAC_MODE_XAUI : +case LMAC_MODE_RXAUI : +case LMAC_MODE_QSGMII : +return 0 ; +case LMAC_MODE_10G_R : +case LMAC_MODE_25G_R : +case LMAC_MODE_100G_R : +case LMAC_MODE_USXGMII : +return 1 ; +case LMAC_MODE_40G_R : +return 4 ; +case LMAC_MODE_50G_R : +if (linfo->fec ==OTX2_FEC_BASER ) +return 2 ; +else +return 1 ; +default : +return 0 ; + } +} + +int cgx_get_fec_stats (void *cgxd,int lmac_id,struct cgx_fec_stats_rsp *rsp) +{ +int stats, fec_stats_count =0 ; +int corr_reg, uncorr_reg; +struct cgx *cgx = cgxd; + +if (!cgx || lmac_id >= cgx->lmac_count) +return -ENODEV ; + fec_stats_count = +cgx_set_fec_stats_count (&cgx->lmac_idmap[lmac_id]->link_info); +if (cgx->lmac_idmap[lmac_id]->link_info.fec ==OTX2_FEC_BASER ) { + corr_reg =CGXX_SPUX_LNX_FEC_CORR_BLOCKS ; + uncorr_reg =CGXX_SPUX_LNX_FEC_UNCORR_BLOCKS ; + }else { + corr_reg =CGXX_SPUX_RSFEC_CORR ; + uncorr_reg =CGXX_SPUX_RSFEC_UNCORR ; + } +for (stats =0 ; stats < fec_stats_count; stats++) { + rsp->fec_corr_blks += +cgx_read (cgx, lmac_id, corr_reg + (stats *8 )); + rsp->fec_uncorr_blks += +cgx_read (cgx, lmac_id, uncorr_reg + (stats *8 )); + } +return 0 ; +} +int cgx_lmac_rx_tx_enable (void *cgxd,int lmac_id,bool enable) {struct cgx *cgx = cgxd;
@@ -620,6 +674,7 @@ static inline void link_status_user_format(u64 lstat, linfo->link_up =FIELD_GET (RESP_LINKSTAT_UP , lstat); linfo->full_duplex =FIELD_GET (RESP_LINKSTAT_FDUPLEX , lstat); linfo->speed = cgx_speed_mbps[FIELD_GET (RESP_LINKSTAT_SPEED , lstat)]; + linfo->fec =FIELD_GET (RESP_LINKSTAT_FEC , lstat); linfo->lmac_type_id =cgx_get_lmac_type (cgx, lmac_id); lmac_string = cgx_lmactype_string[linfo->lmac_type_id];strncpy (linfo->lmac_type, lmac_string,LMACTYPE_STR_LEN -1 );
@@ -790,6 +845,27 @@ int cgx_get_fwdata_base(u64 *base)return err; } +int cgx_set_fec (u64 fec,int cgx_id,int lmac_id) +{ +u64 req =0 , resp; +struct cgx *cgx; +int err =0 ; + + cgx =cgx_get_pdata (cgx_id); +if (!cgx) +return -ENXIO ; + + req =FIELD_SET (CMDREG_ID ,CGX_CMD_SET_FEC , req); + req =FIELD_SET (CMDSETFEC , fec, req); + err =cgx_fwi_cmd_generic (req, &resp, cgx, lmac_id); +if (err) +return err; + + cgx->lmac_idmap[lmac_id]->link_info.fec = +FIELD_GET (RESP_LINKSTAT_FEC , resp); +return cgx->lmac_idmap[lmac_id]->link_info.fec; +} +static int cgx_fwi_link_change (struct cgx *cgx,int lmac_id,bool enable) {u64 req =0 ;
drivers/net/ethernet/marvell/octeontx2/af/cgx.h +7 -0
@@ -55,6 +55,11 @@#define CGXX_SCRATCH1_REG 0x1058#define CGX_CONST 0x2000#define CGXX_SPUX_CONTROL1 0x10000 +#define CGXX_SPUX_LNX_FEC_CORR_BLOCKS 0x10700 +#define CGXX_SPUX_LNX_FEC_UNCORR_BLOCKS 0x10800 +#define CGXX_SPUX_RSFEC_CORR 0x10088 +#define CGXX_SPUX_RSFEC_UNCORR 0x10090 +#define CGXX_SPUX_CONTROL1_LBK BIT_ULL(14)#define CGXX_GMP_PCS_MRX_CTL 0x30000#define CGXX_GMP_PCS_MRX_CTL_LBK BIT_ULL(14)
@@ -146,5 +151,7 @@ int cgx_lmac_set_pause_frm(void *cgxd, int lmac_id, u8 tx_pause, u8 rx_pause);void cgx_lmac_ptp_config (void *cgxd,int lmac_id,bool enable);u8 cgx_lmac_get_p2x (int cgx_id,int lmac_id); +int cgx_set_fec (u64 fec,int cgx_id,int lmac_id); +int cgx_get_fec_stats (void *cgxd,int lmac_id,struct cgx_fec_stats_rsp *rsp);#endif /* CGX_H */
drivers/net/ethernet/marvell/octeontx2/af/cgx_fw_if.h +16 -1
@@ -81,6 +81,14 @@ enum cgx_cmd_id {CGX_CMD_GET_MKEX_PRFL_SIZE ,CGX_CMD_GET_MKEX_PRFL_ADDR ,CGX_CMD_GET_FWD_BASE ,/* get base address of shared FW data */ +CGX_CMD_GET_LINK_MODES ,/* Supported Link Modes */ +CGX_CMD_SET_LINK_MODE , +CGX_CMD_GET_SUPPORTED_FEC , +CGX_CMD_SET_FEC , +CGX_CMD_GET_AN , +CGX_CMD_SET_AN , +CGX_CMD_GET_ADV_LINK_MODES , + CGX_CMD_GET_ADV_FEC, };/* async event ids */
@@ -171,13 +179,19 @@ struct cgx_lnk_sts { uint64_t full_duplex:1; uint64_t speed:4; /* cgx_link_speed */ uint64_t err_type:10; - uint64_t reserved2:39; + uint64_t an:1; /* AN supported or not */ + uint64_t fec:2; /* FEC type if enabled, if not 0 */ + uint64_t port:8; + uint64_t reserved2:28; };#define RESP_LINKSTAT_UP GENMASK_ULL(9, 9)#define RESP_LINKSTAT_FDUPLEX GENMASK_ULL(10, 10)#define RESP_LINKSTAT_SPEED GENMASK_ULL(14, 11)#define RESP_LINKSTAT_ERRTYPE GENMASK_ULL(24, 15) +#define RESP_LINKSTAT_AN GENMASK_ULL(25, 25) +#define RESP_LINKSTAT_FEC GENMASK_ULL(27, 26) +#define RESP_LINKSTAT_PORT GENMASK_ULL(35, 28)/* scratchx(1) CSR used for non-secure SW->ATF communication * This CSR acts as a command register
@@ -199,4 +213,5 @@ struct cgx_lnk_sts {#define CMDLINKCHANGE_FULLDPLX BIT_ULL(9)#define CMDLINKCHANGE_SPEED GENMASK_ULL(13, 10) +#define CMDSETFEC GENMASK_ULL(9, 8)#endif /* __CGX_FW_INTF_H__ */
drivers/net/ethernet/marvell/octeontx2/af/mbox.h +23 -1
@@ -36,7 +36,7 @@#define INTR_MASK (pfvfs) ((pfvfs < 64) ? (BIT_ULL(pfvfs) - 1) : (~0ull)) -#define MBOX_RSP_TIMEOUT 2000/* Time(ms) to wait for mbox response */ +#define MBOX_RSP_TIMEOUT 3000/* Time(ms) to wait for mbox response */ #define MBOX_MSG_ALIGN 16/* Align mbox msg start to 16bytes */
@@ -149,6 +149,9 @@ M(CGX_PTP_RX_ENABLE, 0x20C, cgx_ptp_rx_enable, msg_req, msg_rsp) \ M(CGX_PTP_RX_DISABLE, 0x20D, cgx_ptp_rx_disable, msg_req, msg_rsp) \M (CGX_CFG_PAUSE_FRM ,0x20E , cgx_cfg_pause_frm, cgx_pause_frm_cfg, \ cgx_pause_frm_cfg) \ +M(CGX_FEC_SET, 0x210, cgx_set_fec_param, fec_mode, fec_mode) \ +M (CGX_FEC_STATS ,0x211 , cgx_fec_stats, msg_req, cgx_fec_stats_rsp) \ +/* NPA mbox IDs (range 0x400 - 0x5FF) */ \ /* NPA mbox IDs (range 0x400 - 0x5FF) */ \M (NPA_LF_ALLOC ,0x400 , npa_lf_alloc, \ npa_lf_alloc_req, npa_lf_alloc_rsp) \
@@ -346,6 +349,11 @@ struct cgx_stats_rsp {u64 tx_stats[CGX_TX_STATS_COUNT ]; }; +struct cgx_fec_stats_rsp { +struct mbox_msghdr hdr; +u64 fec_corr_blks; +u64 fec_uncorr_blks; +};/* Structure for requesting the operation for * setting/getting mac address in the CGX interface */
@@ -359,6 +367,7 @@ struct cgx_link_user_info { uint64_t full_duplex:1; uint64_t lmac_type_id:4; uint64_t speed:20; /* speed in Mbps */ + uint64_t fec:2; /* FEC type if enabled else 0 */#define LMACTYPE_STR_LEN 16char lmac_type[LMACTYPE_STR_LEN ]; };
@@ -377,6 +386,19 @@ struct cgx_pause_frm_cfg {u8 tx_pause; }; +enum fec_type { +OTX2_FEC_NONE , +OTX2_FEC_BASER , +OTX2_FEC_RS , +OTX2_FEC_STATS_CNT =2 , +OTX2_FEC_OFF , +}; + +struct fec_mode { +struct mbox_msghdr hdr; +int fec; +}; +/* NPA mbox message formats */ /* NPA mailbox error codes
drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +33 -0
@@ -462,6 +462,22 @@ int rvu_mbox_handler_cgx_stats(struct rvu *rvu, struct msg_req *req,return 0 ; } +int rvu_mbox_handler_cgx_fec_stats (struct rvu *rvu, +struct msg_req *req, +struct cgx_fec_stats_rsp *rsp) +{ +int pf =rvu_get_pf (req->hdr.pcifunc); +u8 cgx_idx, lmac; +void *cgxd; + +if (!is_cgx_config_permitted (rvu, req->hdr.pcifunc)) +return -EPERM ; +rvu_get_cgx_lmac_id (rvu->pf2cgxlmac_map[pf], &cgx_idx, &lmac); + + cgxd =rvu_cgx_pdata (cgx_idx, rvu); +return cgx_get_fec_stats (cgxd, lmac, rsp); +} +int rvu_mbox_handler_cgx_mac_addr_set (struct rvu *rvu,struct cgx_mac_addr_set_or_get *req,struct cgx_mac_addr_set_or_get *rsp)
@@ -767,3 +783,20 @@ int rvu_cgx_start_stop_io(struct rvu *rvu, u16 pcifunc, bool start)mutex_unlock (&rvu->cgx_cfg_lock);return err; } + +int rvu_mbox_handler_cgx_set_fec_param (struct rvu *rvu, +struct fec_mode *req, +struct fec_mode *rsp) +{ +int pf =rvu_get_pf (req->hdr.pcifunc); +u8 cgx_id, lmac_id; + +if (!is_pf_cgxmapped (rvu, pf)) +return -EPERM ; + +if (req->fec ==OTX2_FEC_OFF ) + req->fec =OTX2_FEC_NONE ; +rvu_get_cgx_lmac_id (rvu->pf2cgxlmac_map[pf], &cgx_id, &lmac_id); + rsp->fec =cgx_set_fec (req->fec, cgx_id, lmac_id); +return 0 ; +}
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/459 octeontx2-af: Add new CGX_CMD to get PHY FEC statistics
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Manlunas <[email protected]>
[ Upstream commit bd74d4ea29cc3c0520d9af109bb7a7c769325746 ]
This patch adds support to fetch fec stats from PHY. The stats are put in the shared data struct fwdata. A PHY driver indicates that it has FEC stats by setting the flag fwdata.phy.misc.has_fec_stats
Besides CGX_CMD_GET_PHY_FEC_STATS, also add CGX_CMD_PRBS and CGX_CMD_DISPLAY_EYE to enum cgx_cmd_id so that Linux's enum list is in sync with firmware's enum list.
Stable-dep-of: e26f8eac6bb2 ("octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c")
--- .../net/ethernet/marvell/octeontx2/af/cgx.c | 12 ++++++ .../net/ethernet/marvell/octeontx2/af/cgx.h | 1 + .../ethernet/marvell/octeontx2/af/cgx_fw_if.h | 5 +++ .../net/ethernet/marvell/octeontx2/af/mbox.h | 43 +++++++++++++++++++ .../net/ethernet/marvell/octeontx2/af/rvu.h | 4 ++ .../ethernet/marvell/octeontx2/af/rvu_cgx.c | 32 ++++++++++++++ 6 files changed, 97 insertions(+)
drivers/net/ethernet/marvell/octeontx2/af/cgx.c +12 -0
@@ -866,6 +866,18 @@ int cgx_set_fec(u64 fec, int cgx_id, int lmac_id)return cgx->lmac_idmap[lmac_id]->link_info.fec; } +int cgx_get_phy_fec_stats (void *cgxd,int lmac_id) +{ +struct cgx *cgx = cgxd; +u64 req =0 , resp; + +if (!cgx) +return -ENODEV ; + + req =FIELD_SET (CMDREG_ID ,CGX_CMD_GET_PHY_FEC_STATS , req); +return cgx_fwi_cmd_generic (req, &resp, cgx, lmac_id); +} +static int cgx_fwi_link_change (struct cgx *cgx,int lmac_id,bool enable) {u64 req =0 ;
drivers/net/ethernet/marvell/octeontx2/af/cgx.h +1 -0
@@ -153,5 +153,6 @@ void cgx_lmac_ptp_config(void *cgxd, int lmac_id, bool enable);u8 cgx_lmac_get_p2x (int cgx_id,int lmac_id);int cgx_set_fec (u64 fec,int cgx_id,int lmac_id);int cgx_get_fec_stats (void *cgxd,int lmac_id,struct cgx_fec_stats_rsp *rsp); +int cgx_get_phy_fec_stats (void *cgxd,int lmac_id);#endif /* CGX_H */
drivers/net/ethernet/marvell/octeontx2/af/cgx_fw_if.h +5 -0
@@ -89,6 +89,11 @@ enum cgx_cmd_id {CGX_CMD_SET_AN ,CGX_CMD_GET_ADV_LINK_MODES ,CGX_CMD_GET_ADV_FEC , +CGX_CMD_GET_PHY_MOD_TYPE ,/* line-side modulation type: NRZ or PAM4 */ +CGX_CMD_SET_PHY_MOD_TYPE , +CGX_CMD_PRBS , +CGX_CMD_DISPLAY_EYE , + CGX_CMD_GET_PHY_FEC_STATS, };/* async event ids */
drivers/net/ethernet/marvell/octeontx2/af/mbox.h +43 -0
55 lines not on this page · raw message
drivers/net/ethernet/marvell/octeontx2/af/rvu.h +4 -0
@@ -291,6 +291,10 @@ struct rvu_fwdata {u64 msixtr_base;#define FWDATA_RESERVED_MEM 1023u64 reserved[FWDATA_RESERVED_MEM ]; +#define CGX_MAX 5 +#define CGX_LMACS_MAX 4 +struct cgx_lmac_fwdata_s cgx_fw_data[CGX_MAX ][CGX_LMACS_MAX ]; +/* Do not add new fields below this line */ };struct ptp ;
drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +32 -0
@@ -692,6 +692,19 @@ int rvu_mbox_handler_cgx_cfg_pause_frm(struct rvu *rvu,return 0 ; } +int rvu_mbox_handler_cgx_get_phy_fec_stats (struct rvu *rvu,struct msg_req *req, +struct msg_rsp *rsp) +{ +int pf =rvu_get_pf (req->hdr.pcifunc); +u8 cgx_id, lmac_id; + +if (!is_pf_cgxmapped (rvu, pf)) +return -EPERM ; + +rvu_get_cgx_lmac_id (rvu->pf2cgxlmac_map[pf], &cgx_id, &lmac_id); +return cgx_get_phy_fec_stats (rvu_cgx_pdata (cgx_id, rvu), lmac_id); +} +/* Finds cumulative status of NIX rx/tx counters from LF of a PF and those * from its VFs as well. ie. NIX rx/tx counters at the CGX port level */
@@ -800,3 +813,22 @@ int rvu_mbox_handler_cgx_set_fec_param(struct rvu *rvu, rsp->fec =cgx_set_fec (req->fec, cgx_id, lmac_id);return 0 ; } + +int rvu_mbox_handler_cgx_get_aux_link_info (struct rvu *rvu,struct msg_req *req, +struct cgx_fw_data *rsp) +{ +int pf =rvu_get_pf (req->hdr.pcifunc); +u8 cgx_id, lmac_id; + +if (!rvu->fwdata) +return -ENXIO ; + +if (!is_pf_cgxmapped (rvu, pf)) +return -EPERM ; + +rvu_get_cgx_lmac_id (rvu->pf2cgxlmac_map[pf], &cgx_id, &lmac_id); + +memcpy (&rsp->fwdata, &rvu->fwdata->cgx_fw_data[cgx_id][lmac_id], +sizeof (struct cgx_lmac_fwdata_s )); +return 0 ; +}
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/459 octeontx2-pf: ethtool fec mode support
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christina Jacob <[email protected]>
[ Upstream commit d0cf9503e908ee7b235a5efecedeb74aabc482f3 ]
Add ethtool support to configure fec modes baser/rs and support to fecth FEC stats from CGX as well PHY.
Configure fec mode
- ethtool --set-fec eth0 encoding rs/baser/off/auto
Query fec mode
- ethtool --show-fec eth0
Stable-dep-of: e26f8eac6bb2 ("octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c")
--- .../marvell/octeontx2/nic/otx2_common.c | 20 +++ .../marvell/octeontx2/nic/otx2_common.h | 6 + .../marvell/octeontx2/nic/otx2_ethtool.c | 160 +++++++++++++++++- .../ethernet/marvell/octeontx2/nic/otx2_pf.c | 3 + 4 files changed, 188 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +20 -0
@@ -60,6 +60,19 @@ void otx2_update_lmac_stats(struct otx2_nic *pfvf)mutex_unlock (&pfvf->mbox.lock); } +void otx2_update_lmac_fec_stats (struct otx2_nic *pfvf) +{ +struct msg_req *req; + +if (!netif_running (pfvf->netdev)) +return ; +mutex_lock (&pfvf->mbox.lock); + req =otx2_mbox_alloc_msg_cgx_fec_stats (&pfvf->mbox); +if (req) +otx2_sync_mbox_msg (&pfvf->mbox); +mutex_unlock (&pfvf->mbox.lock); +} +int otx2_update_rq_stats (struct otx2_nic *pfvf,int qidx) {struct otx2_rcv_queue *rq = &pfvf->qset.rq[qidx];
@@ -1492,6 +1505,13 @@ void mbox_handler_cgx_stats(struct otx2_nic *pfvf, pfvf->hw.cgx_tx_stats[id] = rsp->tx_stats[id]; } +void mbox_handler_cgx_fec_stats (struct otx2_nic *pfvf, +struct cgx_fec_stats_rsp *rsp) +{ + pfvf->hw.cgx_fec_corr_blks += rsp->fec_corr_blks; + pfvf->hw.cgx_fec_uncorr_blks += rsp->fec_uncorr_blks; +} +void mbox_handler_nix_txsch_alloc (struct otx2_nic *pf,struct nix_txsch_alloc_rsp *rsp) {
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h +6 -0
@@ -197,6 +197,8 @@ struct otx2_hw {struct otx2_drv_stats drv_stats;u64 cgx_rx_stats[CGX_RX_STATS_COUNT ];u64 cgx_tx_stats[CGX_TX_STATS_COUNT ]; +u64 cgx_fec_corr_blks; +u64 cgx_fec_uncorr_blks;u8 cgx_links;/* No. of CGX links present in HW */ u8 lbk_links;/* No. of LBK links present in HW */ };
@@ -627,6 +629,9 @@ void mbox_handler_nix_txsch_alloc(struct otx2_nic *pf, struct nix_txsch_alloc_rsp *rsp);void mbox_handler_cgx_stats (struct otx2_nic *pfvf,struct cgx_stats_rsp *rsp); +void mbox_handler_cgx_fec_stats (struct otx2_nic *pfvf, +struct cgx_fec_stats_rsp *rsp); +void otx2_set_fec_stats_count (struct otx2_nic *pfvf);void mbox_handler_nix_bp_enable (struct otx2_nic *pfvf,struct nix_bp_cfg_rsp *rsp);
@@ -635,6 +640,7 @@ void otx2_get_dev_stats(struct otx2_nic *pfvf);void otx2_get_stats64 (struct net_device *netdev,struct rtnl_link_stats64 *stats);void otx2_update_lmac_stats (struct otx2_nic *pfvf); +void otx2_update_lmac_fec_stats (struct otx2_nic *pfvf);int otx2_update_rq_stats (struct otx2_nic *pfvf,int qidx);int otx2_update_sq_stats (struct otx2_nic *pfvf,int qidx);void otx2_set_ethtool_ops (struct net_device *netdev);
drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c +159 -1
209 lines not on this page · raw message
drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +3 -0
@@ -787,6 +787,9 @@ static void otx2_process_pfaf_mbox_msg(struct otx2_nic *pf,case MBOX_MSG_CGX_STATS :mbox_handler_cgx_stats (pf, (struct cgx_stats_rsp *)msg);break ; +case MBOX_MSG_CGX_FEC_STATS : +mbox_handler_cgx_fec_stats (pf, (struct cgx_fec_stats_rsp *)msg); +break ;default :if (msg->rc) dev_err(pf->dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/459 octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dipendra Khadka <[email protected]>
[ Upstream commit e26f8eac6bb20b20fdb8f7dc695711ebce4c7c5c ]
Add error pointer check after calling otx2_mbox_get_rsp().
--- .../net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c +10 -0
@@ -317,6 +317,11 @@ static void otx2_get_pauseparam(struct net_device *netdev,if (!otx2_sync_mbox_msg (&pfvf->mbox)) { rsp = (struct cgx_pause_frm_cfg *)otx2_mbox_get_rsp (&pfvf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) { +mutex_unlock (&pfvf->mbox.lock); +return ; + } + pause->rx_pause = rsp->rx_pause; pause->tx_pause = rsp->tx_pause; }
@@ -847,6 +852,11 @@ static int otx2_set_fecparam(struct net_device *netdev, rsp = (struct fec_mode *)otx2_mbox_get_rsp (&pfvf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) { + err =PTR_ERR (rsp); + goto end; + } +if (rsp->fec >=0 ) pfvf->linfo.fec = rsp->fec;else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/459 drm/panfrost: Remove unused id_mask from struct panfrost_model
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Price <[email protected]>
[ Upstream commit 581d1f8248550f2b67847e6d84f29fbe3751ea0a ]
The id_mask field of struct panfrost_model has never been used.
--- drivers/gpu/drm/panfrost/panfrost_gpu.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/panfrost/panfrost_gpu.c +0 -1
@@ -158,7 +158,6 @@ static void panfrost_gpu_init_quirks(struct panfrost_device *pfdev)struct panfrost_model {const char *name;u32 id; -u32 id_mask;u64 features;u64 issues;struct {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/459 drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 394679f322649d06fea3c646ba65f5a0887f52c3 ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
Patchwork: https://patchwork.freedesktop.org/patch/614075/
--- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/gpu/drm/msm/adreno/a6xx_gmu.c +1 -3
@@ -1407,15 +1407,13 @@ static int a6xx_gmu_get_irq(struct a6xx_gmu *gmu, struct platform_device *pdev, irq =platform_get_irq_byname (pdev, name); - ret =request_irq (irq, handler,IRQF_TRIGGER_HIGH , name, gmu); + ret =request_irq (irq, handler,IRQF_TRIGGER_HIGH |IRQF_NO_AUTOEN , name, gmu);if (ret) {DRM_DEV_ERROR (&pdev->dev,"Unable to get interrupt %s %d\n" , name, ret);return ret; } -disable_irq (irq); -return irq; }
Signature · 1 line
2.43.0