6.12.23-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 6.12.23-rc1 review
This is the start of the stable review cycle for the 6.12.23 release. There are 423 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 10 Apr 2025 10:47:53 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.23-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.23-rc1
Chuck Lever <[email protected]>
NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up
Chuck Lever <[email protected]>
NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory
Chuck Lever <[email protected]>
NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs()
Olga Kornievskaia <[email protected]>
nfsd: fix management of listener transports
Li Lingfeng <[email protected]>
nfsd: put dl_stid if fail to queue dl_recall
Jeff Layton <[email protected]>
nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid()
Murad Masimov <[email protected]>
media: streamzap: fix race between device disconnection and urb callback
Nikita Zhandarovich <[email protected]>
media: vimc: skip .s_stream() for stopped entities
Oleg Nesterov <[email protected]>
exec: fix the racy usage of fs_struct->in_exec
Yosry Ahmed <[email protected]>
mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead()
Roman Smirnov <[email protected]>
jfs: add index corruption check to DT_GETPAGE()
Qasim Ijaz <[email protected]>
jfs: fix slab-out-of-bounds read in ea_get()
Acs, Jakub <[email protected]>
ext4: fix OOB read when checking dotdot dir
Theodore Ts'o <[email protected]>
ext4: don't over-report free space or inodes in statvfs
Ming Yen Hsieh <[email protected]>
wifi: mt76: mt7921: fix kernel panic due to null pointer dereference
Angelos Oikonomopoulos <[email protected]>
arm64: Don't call NULL in do_compat_alignment_fixup()
David Hildenbrand <[email protected]>
mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs
Ran Xiaokai <[email protected]>
tracing/osnoise: Fix possible recursive locking for cpus_read_lock()
Douglas Raillard <[email protected]>
tracing: Fix synth event printk format for str fields
Douglas Raillard <[email protected]>
tracing: Ensure module defining synth event cannot be unloaded while tracing
Tengda Wu <[email protected]>
tracing: Fix use-after-free in print_graph_function_flags during tracer switching
Sungjong Seo <[email protected]>
exfat: fix potential wrong error return from get_block
Sungjong Seo <[email protected]>
exfat: fix random stack corruption after get_block
Namjae Jeon <[email protected]>
ksmbd: fix null pointer dereference in alloc_preauth_hash()
Norbert Szetei <[email protected]>
ksmbd: validate zero num_subauth before sub_auth is accessed
Norbert Szetei <[email protected]>
ksmbd: fix overflow in dacloffset bounds check
Namjae Jeon <[email protected]>
ksmbd: fix session use-after-free in multichannel connection
Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in ksmbd_sessions_deregister()
Norbert Szetei <[email protected]>
ksmbd: add bounds check for create lease context
Namjae Jeon <[email protected]>
ksmbd: add bounds check for durable handle context
Sean Christopherson <[email protected]>
KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error
Ulf Hansson <[email protected]>
mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD
Karel Balej <[email protected]>
mmc: sdhci-pxav3: set NEED_RSP_BUSY capability
Miaoqian Lin <[email protected]>
mmc: omap: Fix memory leak in mmc_omap_new_slot
Candice Li <[email protected]>
Remove unnecessary firmware version check for gc v9_4_2
Robin Murphy <[email protected]>
media: omap3isp: Handle ARM dma_iommu_mapping
Christian Eggers <[email protected]>
ARM: 9444/1: add KEEP() keyword to ARM_VECTORS
Paul Menzel <[email protected]>
ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP
Murad Masimov <[email protected]>
acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
Ming Yen Hsieh <[email protected]>
wifi: mt76: mt7925: remove unused acpi function for clc
Jann Horn <[email protected]>
x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
Guilherme G. Piccoli <[email protected]>
x86/tsc: Always save/restore TSC sched_clock() on suspend/resume
Arnd Bergmann <[email protected]>
x86/Kconfig: Add cmpxchg8b support back to Geode CPUs
Joe Damato <[email protected]>
idpf: Don't hard code napi_struct size
Jiri Olsa <[email protected]>
uprobes/x86: Harden uretprobe syscall trampoline check
Kan Liang <[email protected]>
perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read
Peter Zijlstra (Intel) <[email protected]>
perf/x86/intel: Apply static call for drain_pebs
Markus Elfring <[email protected]>
ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk()
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Correct command storage data length
Eduard Christian Dumitrescu <[email protected]>
platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560
Hans de Goede <[email protected]>
ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers
Vishal Annapurve <[email protected]>
x86/tdx: Fix arch_safe_halt() execution for TDX VMs
Shuai Xue <[email protected]>
x86/mce: use is_copy_from_user() to determine copy-from-user context
Boris Ostrovsky <[email protected]>
x86/microcode/AMD: Fix __apply_microcode_amd()'s return value
Paolo Bonzini <[email protected]>
KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected
Tianyu Lan <[email protected]>
x86/hyperv: Fix check of return value from snp_set_vmsa()
Hengqi Chen <[email protected]>
LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC
Hengqi Chen <[email protected]>
LoongArch: BPF: Don't override subprog's return value
Hengqi Chen <[email protected]>
LoongArch: BPF: Fix off-by-one error in build_prologue()
Huacai Chen <[email protected]>
LoongArch: Increase MAX_IO_PICS up to 8
Huacai Chen <[email protected]>
LoongArch: Increase ARCH_DMA_MINALIGN up to 16
WANG Rui <[email protected]>
rust: Fix enabling Rust and building with GCC for LoongArch
Ying Lu <[email protected]>
usbnet:fix NPE during rx_complete
Alexander Wetzel <[email protected]>
wifi: mac80211: Fix sparse warning for monitor_sdata
Sherry Sun <[email protected]>
tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: use port struct directly to simply code
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: Use u32 and u8 for register variables
Abel Wu <[email protected]>
cgroup/rstat: Fix forceidle time in cpu.stat
Joshua Hahn <[email protected]>
cgroup/rstat: Tracking cgroup-level niced CPU time
Dragan Simic <[email protected]>
arm64: dts: rockchip: Add missing PCIe supplies to RockPro64 board dtsi
Tengda Wu <[email protected]>
tracing: Correct the refcount if the hist/hist_debug file fails to open
Masami Hiramatsu (Google) <[email protected]>
tracing/hist: Support POLLPRI event for poll on histogram
Masami Hiramatsu (Google) <[email protected]>
tracing/hist: Add poll(POLLIN) support on hist file
Steven Rostedt <[email protected]>
tracing: Switch trace_events_hist.c code over to use guard()
Len Brown <[email protected]>
tools/power turbostat: report CoreThr per measurement interval
Yeoreum Yun <[email protected]>
perf/core: Fix child_total_time_enabled accounting bug at task exit
Alex Deucher <[email protected]>
drm/amdgpu/gfx12: fix num_mec
Alex Deucher <[email protected]>
drm/amdgpu/gfx11: fix num_mec
Alexandru Gagniuc <[email protected]>
kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally
Dave Marquardt <[email protected]>
net: ibmveth: make veth_pool_store stop hanging
Henry Martin <[email protected]>
arcnet: Add NULL check in com20020pci_probe()
Ido Schimmel <[email protected]>
ipv6: Do not consider link down nexthops in path selection
Ido Schimmel <[email protected]>
ipv6: Start path selection from the first nexthop
Lin Ma <[email protected]>
net: fix geneve_opt length integer overflow
David Oberhollenzer <[email protected]>
net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy
Fernando Fernandez Mancera <[email protected]>
ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS
Lin Ma <[email protected]>
netfilter: nft_tunnel: fix geneve_opt type confusion addition
Antoine Tenart <[email protected]>
net: decrease cached dst counters in dst_release
Guillaume Nault <[email protected]>
tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu().
Stefano Garzarella <[email protected]>
vsock: avoid timeout during connect() if the socket is closing
Kuniyuki Iwashima <[email protected]>
udp: Fix memory accounting leak.
Kuniyuki Iwashima <[email protected]>
udp: Fix multiple wraparounds of sk->sk_rmem_alloc.
Tobias Waldekranz <[email protected]>
net: mvpp2: Prevent parser TCAM memory corruption
Eric Dumazet <[email protected]>
sctp: add mutual exclusion in proc_sctp_do_udp_port()
Cong Wang <[email protected]>
net_sched: skbprio: Remove overly strict queue assertions
Debin Zhu <[email protected]>
netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
Florian Westphal <[email protected]>
netfilter: nf_tables: don't unregister hook when table is dormant
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only
Emil Tantilov <[email protected]>
idpf: fix adapter NULL pointer dereference on reboot
Vitaly Lifshits <[email protected]>
e1000e: change k1 configuration on MTP and later platforms
Florian Fainelli <[email protected]>
spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model
Florian Fainelli <[email protected]>
spi: bcm2835: Do not call gpiod_put() on invalid descriptor
Henry Martin <[email protected]>
ASoC: imx-card: Add NULL check in imx_card_probe()
Caleb Sander Mateos <[email protected]>
nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer
Björn Töpel <[email protected]>
riscv/purgatory: 4B align purgatory_start
Yao Zi <[email protected]>
riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator
Alexandre Ghiti <[email protected]>
riscv: Fix hugetlb retrieval of number of ptes in case of !present pte
Josh Poimboeuf <[email protected]>
spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock()
Christophe JAILLET <[email protected]>
ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe()
Sven Schnelle <[email protected]>
s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation
Ming Lei <[email protected]>
ublk: make sure ubq->canceling is set when queue is frozen
Herton R. Krzesinski <[email protected]>
x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs
Palmer Dabbelt <[email protected]>
RISC-V: errata: Use medany for relocatable builds
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA
Richard Fitzgerald <[email protected]>
firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success
Nikita Shubin <[email protected]>
ntb: intel: Fix using link status DB's
Yajun Deng <[email protected]>
ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
Juhan Jin <[email protected]>
riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra
Christian Schoenebeck <[email protected]>
fs/9p: fix NULL pointer dereference on mkdir
Al Viro <[email protected]>
spufs: fix a leak in spufs_create_context()
Al Viro <[email protected]>
spufs: fix gang directory lifetimes
Al Viro <[email protected]>
spufs: fix a leak on spufs_new_file() failure
David Howells <[email protected]>
netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int
Tasos Sahanidis <[email protected]>
hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9}Roger Quadros <[email protected]>
memory: omap-gpmc: drop no compatible check
Oliver Hartkopp <[email protected]>
can: statistics: use atomic access in hot path
Navon John Lukose <[email protected]>
ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx
Florian Westphal <[email protected]>
selftests: netfilter: skip br_netfilter queue tests if kernel is tainted
Taehee Yoo <[email protected]>
net: devmem: do not WARN conditionally after netdev_rx_queue_restart()
Mario Limonciello <[email protected]>
drm/amd: Keep display off while going into S4
Keith Busch <[email protected]>
nvme-pci: fix stuck reset on concurrent DPC and HP
Vladis Dronov <[email protected]>
x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled
Michael Kelley <[email protected]>
x86/hyperv: Fix output argument to hypercall that changes page visibility
Waiman Long <[email protected]>
locking/semaphore: Use wake_q to wake up processes outside lock critical section
Johannes Berg <[email protected]>
wifi: mac80211: fix SA Query processing in MLO
Emmanuel Grumbach <[email protected]>
wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state
Bard Liao <[email protected]>
ASoC: rt1320: set wake_capable = 0 explicitly
Alexey Klimov <[email protected]>
ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius
Naman Jain <[email protected]>
x86/hyperv/vtl: Stop kernel from probing VTL0 low memory
Shrikanth Hegde <[email protected]>
sched/deadline: Use online cpus for validating runtime
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA
Yuezhang Mo <[email protected]>
exfat: add a check for invalid data size
Shyam Sundar S K <[email protected]>
platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA
Shyam Sundar S K <[email protected]>
platform/x86/amd/pmf: Propagate PMF-TA return codes
Wentao Guan <[email protected]>
HID: i2c-hid: improve i2c_hid_get_report error message
Jakub Kicinski <[email protected]>
net: dsa: rtl8366rb: don't prompt users for LED control
David E. Box <[email protected]>
platform/x86/intel/vsec: Add Diamond Rapids support
Dmitry Panchenko <[email protected]>
platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet
Namjae Jeon <[email protected]>
cifs: fix incorrect validation for num_aces field of smb_acl
Namjae Jeon <[email protected]>
smb: common: change the data type of num_aces to le16
Peter Zijlstra <[email protected]>
perf/core: Fix perf_pmu_register() vs. perf_init_event()
Daniel Bárta <[email protected]>
ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0
Antheas Kapenekakis <[email protected]>
ALSA: hda/realtek: Fix Asus Z13 2025 audio
Simon Tatham <[email protected]>
affs: don't write overlarge OFS data block size fields
Simon Tatham <[email protected]>
affs: generate OFS sequence numbers starting at 1
Matthias Proske <[email protected]>
wifi: brcmfmac: keep power during suspend if board requires it
Icenowy Zheng <[email protected]>
nvme-pci: skip CMB blocks incompatible with PCI P2P DMA
Icenowy Zheng <[email protected]>
nvme-pci: clean up CMBMSC when registering CMB fails
Sagi Grimberg <[email protected]>
nvme-tcp: fix possible UAF in nvme_tcp_poll
Mike Lothian <[email protected]>
ntsync: Set the permissions to be 0666
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: use the right version of the rate API
Johannes Berg <[email protected]>
wifi: iwlwifi: fw: allocate chained SG tables for dump
Alexander Wetzel <[email protected]>
wifi: mac80211: remove debugfs dir for virtual monitor
Alexander Wetzel <[email protected]>
wifi: mac80211: Cleanup sta TXQs on flush
Dan Carpenter <[email protected]>
nfs: Add missing release on error in nfs_lock_and_join_requests()
Josh Poimboeuf <[email protected]>
objtool/loongarch: Add unwind hints in prepare_frametrace()
Josh Poimboeuf <[email protected]>
rcu-tasks: Always inline rcu_irq_work_resched()
Josh Poimboeuf <[email protected]>
context_tracking: Always inline ct_{nmi,irq}_{enter,exit}()
Josh Poimboeuf <[email protected]>
sched/smt: Always inline sched_smt_active()
David Laight <[email protected]>
objtool: Fix verbose disassembly if CROSS_COMPILE isn't set
Geetha sowjanya <[email protected]>
octeontx2-af: Free NIX_AF_INT_VEC_GEN irq
Geetha sowjanya <[email protected]>
octeontx2-af: Fix mbox INTR handler when num VFs > 64
Jim Liu <[email protected]>
net: phy: broadcom: Correct BCM5221 PHY model detection
Giovanni Gherdovich <[email protected]>
ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid
Yuli Wang <[email protected]>
LoongArch: Rework the arch_kgdb_breakpoint() implementation
Miaoqian Lin <[email protected]>
LoongArch: Fix device node refcount leak in fdt_cpu_clk_init()
谢致邦 (XIE Zhibang) <[email protected]>
LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig
Josh Poimboeuf <[email protected]>
objtool: Fix segfault in ignore_unreachable_insn()
Feng Yang <[email protected]>
ring-buffer: Fix bytes_dropped calculation issue
Lama Kayal <[email protected]>
net/mlx5e: SHAMPO, Make reserved size independent of page size
Namjae Jeon <[email protected]>
ksmbd: fix r_count dec/increment mismatch
Namjae Jeon <[email protected]>
ksmbd: fix multichannel connection failure
Miaoqian Lin <[email protected]>
ksmbd: use aead_request_free to match aead_request_alloc
Lubomir Rintel <[email protected]>
rndis_host: Flag RNDIS modems as WWAN devices
Mark Zhang <[email protected]>
rtnetlink: Allocate vfinfo size for VF GUIDs when supported
Yuezhang Mo <[email protected]>
exfat: fix missing shutdown check
Yuezhang Mo <[email protected]>
exfat: fix the infinite loop in exfat_find_last_cluster()
Wang Zhaolong <[email protected]>
smb: client: Fix netns refcount imbalance causing leaks and use-after-free
Trond Myklebust <[email protected]>
NFS: Shut down the nfs_client only after all the superblocks
Josh Poimboeuf <[email protected]>
objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
Josh Poimboeuf <[email protected]>
objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show()
xueqin Luo <[email protected]>
thermal: core: Remove duplicate struct declaration
Namhyung Kim <[email protected]>
perf bpf-filter: Fix a parsing error with comma
Marcus Meissner <[email protected]>
perf tools: annotate asm_pure_loop.S
Bart Van Assche <[email protected]>
fs/procfs: fix the comment above proc_pid_wchan()
Ilkka Koskinen <[email protected]>
perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation
Jiri Slaby (SUSE) <[email protected]>
tty: n_tty: use uint for space returned by tty_write_room()
Stefan Wahren <[email protected]>
staging: vchiq_arm: Fix possible NPR of keep-alive thread
Stefan Wahren <[email protected]>
staging: vchiq_arm: Register debugfs after cdev
谢致邦 (XIE Zhibang) <[email protected]>
staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES
James Clark <[email protected]>
perf: intel-tpebs: Fix incorrect usage of zfree()
Stephen Brennan <[email protected]>
perf dso: fix dso__is_kallsyms() check
Arnaldo Carvalho de Melo <[email protected]>
perf python: Check if there is space to copy all the event
Arnaldo Carvalho de Melo <[email protected]>
perf python: Don't keep a raw_data pointer to consumed ring buffer space
Arnaldo Carvalho de Melo <[email protected]>
perf python: Decrement the refcount of just created event on failure
Arnaldo Carvalho de Melo <[email protected]>
perf python: Fixup description of sample.id event member
Stanley Chu <[email protected]>
i3c: master: svc: Fix missing the IBI rules
Benjamin Berg <[email protected]>
um: hostfs: avoid issues on inode number reuse by host
Benjamin Berg <[email protected]>
um: remove copy_from_kernel_nofault_allowed
David Gow <[email protected]>
um: Pass the correct Rust target and options with gcc
Cyan Yang <[email protected]>
selftests/mm/cow: fix the incorrect error handling
Alistair Popple <[email protected]>
fuse: fix dax truncate/punch_hole fault path
NeilBrown <[email protected]>
NFS: fix open_owner_id_maxsz and related fields.
Trond Myklebust <[email protected]>
NFSv4: Avoid unnecessary scans of filesystems for delayed delegations
Trond Myklebust <[email protected]>
NFSv4: Avoid unnecessary scans of filesystems for expired delegations
Trond Myklebust <[email protected]>
NFSv4: Avoid unnecessary scans of filesystems for returning delegations
Trond Myklebust <[email protected]>
NFSv4: Don't trigger uneccessary scans for return-on-close delegations
Anshuman Khandual <[email protected]>
arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig
Vasiliy Kovalev <[email protected]>
ocfs2: validate l_tree_depth to avoid out-of-bounds access
Sourabh Jain <[email protected]>
kexec: initialize ELF lowest address to ULONG_MAX
David Hildenbrand <[email protected]>
kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page()
Arnaldo Carvalho de Melo <[email protected]>
perf units: Fix insufficient array space
Ian Rogers <[email protected]>
perf evlist: Add success path to evlist__create_syswide_maps
Ian Rogers <[email protected]>
perf debug: Avoid stack overflow in recursive error message
Karan Sanghavi <[email protected]>
iio: light: Add check for array bounds in veml6075_read_int_time_ms
Jonathan Santos <[email protected]>
iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset
Uwe Kleine-König <[email protected]>
iio: adc: ad7173: Fix comparison of channel configs
Uwe Kleine-König <[email protected]>
iio: adc: ad7124: Fix comparison of channel configs
Uwe Kleine-König <[email protected]>
iio: adc: ad4130: Fix comparison of channel setups
Peng Fan <[email protected]>
dmaengine: fsl-edma: free irq correctly in remove path
Peng Fan <[email protected]>
dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister
Dan Carpenter <[email protected]>
fs/ntfs3: Prevent integer overflow in hdr_first_de()
Dan Carpenter <[email protected]>
fs/ntfs3: Fix a couple integer overflows on 32bit systems
Niklas Neronin <[email protected]>
usb: xhci: correct debug message page size calculation
Thomas Richter <[email protected]>
perf bench: Fix perf bench syscall loop count
Leo Yan <[email protected]>
perf arm-spe: Fix load-store operation checking
Nuno Sá <[email protected]>
iio: backend: make sure to NULL terminate stack buffer
Jonathan Cameron <[email protected]>
iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails.
Jonathan Cameron <[email protected]>
iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio
Mario Limonciello <[email protected]>
ucsi_ccg: Don't show failed to get FW build information error
Luca Ceresoli <[email protected]>
perf build: Fix in-tree build due to symbolic link
Ian Rogers <[email protected]>
tools/x86: Fix linux/unaligned.h include path in lib/insn.c
James Clark <[email protected]>
perf pmu: Don't double count common sysfs and json events
Yuanfang Zhang <[email protected]>
coresight-etm4x: add isb() before reading the TRCSTATR
Mike Christie <[email protected]>
vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
Ilkka Koskinen <[email protected]>
coresight: catu: Fix number of pages while using 64k pages
Wentao Liang <[email protected]>
greybus: gb-beagleplay: Add error handling for gb_greybus_init
Namhyung Kim <[email protected]>
perf report: Switch data file correctly in TUI
Joe Hattori <[email protected]>
soundwire: slave: fix an OF node reference leak in soundwire slave device
Qasim Ijaz <[email protected]>
isofs: fix KMSAN uninit-value bug in do_isofs_readdir()
Heiko Stuebner <[email protected]>
phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id
Konstantin Komarov <[email protected]>
fs/ntfs3: Update inode->i_mapping->a_ops on compression state
Chenyuan Yang <[email protected]>
w1: fix NULL pointer dereference in probe
James Clark <[email protected]>
perf: Always feature test reallocarray
Ian Rogers <[email protected]>
perf stat: Fix find_stat for mixed legacy/non-legacy events
Barnabás Czémán <[email protected]>
clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock
Andy Shevchenko <[email protected]>
pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm()
Wenkai Lin <[email protected]>
crypto: hisilicon/sec2 - fix for aead auth key length
Wang Liang <[email protected]>
RDMA/core: Fix use-after-free when rename device name
Jann Horn <[email protected]>
x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
Remi Pommarel <[email protected]>
leds: Fix LED_OFF brightness race
Nikita Zhandarovich <[email protected]>
mfd: sm501: Switch to BIT() to mitigate integer overflows
Fabrizio Castro <[email protected]>
pinctrl: renesas: rzv2m: Fix missing of_node_put() call
Patrisious Haddad <[email protected]>
RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
Jiayuan Chen <[email protected]>
bpf: Fix array bounds error with may_goto
Neil Armstrong <[email protected]>
clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable()
Herbert Xu <[email protected]>
crypto: nx - Fix uninitialised hv_nxc on error
Artur Weber <[email protected]>
power: supply: max77693: Fix wrong conversion of charge input threshold value
Jann Horn <[email protected]>
x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1
Jerome Brunet <[email protected]>
clk: amlogic: g12a: fix mmc A peripheral clock
Laurentiu Mihalcea <[email protected]>
clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents
Bairavi Alagappan <[email protected]>
crypto: qat - remove access to parity register for QAT GEN4
Andy Shevchenko <[email protected]>
pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment
Alice Ryhl <[email protected]>
rust: fix signature of rust_fmt_argument
Saket Kumar Bhaskar <[email protected]>
selftests/bpf: Select NUMA_NO_NODE to create map
Jerome Brunet <[email protected]>
clk: amlogic: gxbb: drop non existing 32k clock parent
Jerome Brunet <[email protected]>
clk: amlogic: g12b: fix cluster A parent data
Prathamesh Shete <[email protected]>
pinctrl: tegra: Set SFIO mode to Mux Register
Maher Sanalla <[email protected]>
IB/mad: Check available slots before posting receive WRs
Herbert Xu <[email protected]>
crypto: api - Fix larval relookup type and mask
Sicelo A. Mhlongo <[email protected]>
power: supply: bq27xxx_battery: do not update cached flags prematurely
Luca Weiss <[email protected]>
remoteproc: qcom_q6v5_mss: Handle platforms with one power domain
Cheng Xu <[email protected]>
RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
Chiara Meiohas <[email protected]>
RDMA/mlx5: Fix calculation of total invalidated pages
Roman Gushchin <[email protected]>
RDMA/core: Don't expose hw_counters outside of init net namespace
Peter Geis <[email protected]>
clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent
Tengda Wu <[email protected]>
selftests/bpf: Fix freplace_link segfault in tailcalls prog test
Michael Guralnik <[email protected]>
RDMA/mlx5: Fix MR cache initialization error flow
Fabrizio Castro <[email protected]>
pinctrl: renesas: rzg2l: Fix missing of_node_put() call
Fabrizio Castro <[email protected]>
pinctrl: renesas: rza2: Fix missing of_node_put() call
Tanya Agarwal <[email protected]>
lib: 842: Improve error handling in sw842_compress()
Hou Tao <[email protected]>
bpf: Use preempt_count() directly in bpf_send_signal_common()
Konrad Dybcio <[email protected]>
clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK
Luca Weiss <[email protected]>
remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226
Akhil R <[email protected]>
crypto: tegra - Set IV to NULL explicitly for AES ECB
Kees Bakker <[email protected]>
RDMA/mana_ib: Ensure variable err is initialized
Niklas Schnelle <[email protected]>
s390: Remove ioremap_wt() and pgprot_writethrough()
Vladimir Lypak <[email protected]>
clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock
Akhil R <[email protected]>
crypto: tegra - Fix CMAC intermediate result handling
Yue Haibing <[email protected]>
pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw()
Will McVicker <[email protected]>
clk: samsung: Fix UBSAN panic in samsung_clk_init()
Luca Weiss <[email protected]>
remoteproc: qcom: pas: add minidump_id to SC7280 WPSS
Claudiu Beznea <[email protected]>
clk: renesas: r8a08g045: Check the source of the CPU PLL settings
David Hildenbrand <[email protected]>
x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()
Viktor Malik <[email protected]>
selftests/bpf: Fix string read in strncmp benchmark
Andrii Nakryiko <[email protected]>
libbpf: Fix hypothetical STT_SECTION extern NULL deref case
Luca Weiss <[email protected]>
remoteproc: qcom_q6v5_pas: Make single-PD handling more robust
Claudiu Beznea <[email protected]>
pinctrl: renesas: rzg2l: Suppress binding attributes
Zijun Hu <[email protected]>
of: property: Increase NR_FWNODE_REFERENCE_ARGS
Peng Fan <[email protected]>
remoteproc: core: Clear table_sz when rproc_shutdown
Michael Guralnik <[email protected]>
RDMA/mlx5: Fix page_size variable overflow
Wenkai Lin <[email protected]>
crypto: hisilicon/sec2 - fix for sec spec check
Wenkai Lin <[email protected]>
crypto: hisilicon/sec2 - fix for aead authsize alignment
Jerome Brunet <[email protected]>
clk: amlogic: gxbb: drop incorrect flag on 32k clock
Akhil R <[email protected]>
crypto: tegra - Use HMAC fallback when keyslots are full
Arnd Bergmann <[email protected]>
crypto: bpf - Add MODULE_DESCRIPTION for skcipher
Akhil R <[email protected]>
crypto: tegra - check return value for hash do_one_req
Akhil R <[email protected]>
crypto: tegra - Use separate buffer for setkey
Bairavi Alagappan <[email protected]>
crypto: qat - set parity error mask for qat_420xx
Herbert Xu <[email protected]>
crypto: iaa - Test the correct request flag
Danila Chernetsov <[email protected]>
fbdev: sm501fb: Add some geometry checks.
Arnd Bergmann <[email protected]>
mdacon: rework dependency list
Arnd Bergmann <[email protected]>
dummycon: fix default rows/cols
Markus Elfring <[email protected]>
fbdev: au1100fb: Move a variable assignment behind a null pointer check
Ilpo Järvinen <[email protected]>
PCI: pciehp: Don't enable HPIE when resuming in poll mode
Ilpo Järvinen <[email protected]>
PCI: Fix BAR resizing when VF BARs are assigned
Christophe JAILLET <[email protected]>
PCI: histb: Fix an error handling path in histb_pcie_probe()
Dan Carpenter <[email protected]>
PCI: dwc: ep: Return -ENOMEM for allocation failures
Thadeu Lima de Souza Cascardo <[email protected]>
drm/amd/display: avoid NPD when ASIC does not support DMUB
Dan Carpenter <[email protected]>
drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer()
Douglas Anderson <[email protected]>
drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr
Jason-JH Lin <[email protected]>
drm/mediatek: Fix config_updating flag never false when no mbox channel
Thippeswamy Havalige <[email protected]>
PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe
Dan Carpenter <[email protected]>
PCI: Remove stray put_device() in pci_register_host_bridge()
Christophe Leroy <[email protected]>
powerpc/kexec: fix physical address calculation in clear_utlb_entry()
Christophe Leroy <[email protected]>
crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD
Rob Clark <[email protected]>
drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump
Vitaliy Shevtsov <[email protected]>
drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters()
Ashley Smith <[email protected]>
drm/panthor: Update CS_STATUS_ defines to correct values
Nishanth Aravamudan <[email protected]>
PCI: Avoid reset when disabled via sysfs
Feng Tang <[email protected]>
PCI/portdrv: Only disable pciehp interrupts early when needed
Jim Quinlan <[email protected]>
PCI: brcmstb: Fix potential premature regulator disabling
Jim Quinlan <[email protected]>
PCI: brcmstb: Fix error path after a call to regulator_bulk_get()
Jim Quinlan <[email protected]>
PCI: brcmstb: Use internal register to change link capability
Jim Quinlan <[email protected]>
PCI: brcmstb: Set generation limit before PCIe link up
Hans Zhang <[email protected]>
PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload
Srinivasan Shanmugam <[email protected]>
drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables'
Marijn Suijten <[email protected]>
drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host
Marijn Suijten <[email protected]>
drm/msm/dsi: Use existing per-interface slice count in DSC timing
Krzysztof Kozlowski <[email protected]>
drm/msm/dsi/phy: Program clock inverters in correct register
Dmitry Baryshkov <[email protected]>
drm/msm/dpu: don't use active in atomic_check()
Aurabindo Pillai <[email protected]>
drm/amd/display: fix an indent issue in DML21
Tushar Dave <[email protected]>
PCI/ACS: Fix 'pci=config_acs=' parameter
John Keeping <[email protected]>
drm/panel: ilitek-ili9882t: fix GPIO name in error message
Daniel Stodden <[email protected]>
PCI/ASPM: Fix link state exit during switch upstream function removal
AngeloGioacchino Del Regno <[email protected]>
drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
AngeloGioacchino Del Regno <[email protected]>
drm/mediatek: mtk_hdmi: Unregister audio platform device on failure
Ilpo Järvinen <[email protected]>
PCI: Remove add_align overwrite unrelated to size0
Kai-Heng Feng <[email protected]>
PCI: Use downstream bridges for distributing resources
Alex Deucher <[email protected]>
drm/amdgpu/umsch: fix ucode check
Yang Wang <[email protected]>
drm/amdgpu: refine smu send msg debug log format
Vitalii Mordan <[email protected]>
gpu: cdns-mhdp8546: fix call balance of mhdp->clk handling routines
José Expósito <[email protected]>
drm/vkms: Fix use after free and double free on init error
Tomi Valkeinen <[email protected]>
drm: xlnx: zynqmp: Fix max dma segment size
Hermes Wu <[email protected]>
drm/bridge: it6505: fix HDCP V match check is not performed correctly
Wayne Lin <[email protected]>
drm/dp_mst: Fix drm RAD print
John Keeping <[email protected]>
drm/ssd130x: ensure ssd132x pitch is correct
John Keeping <[email protected]>
drm/ssd130x: fix ssd132x encoding
Javier Martinez Canillas <[email protected]>
drm/ssd130x: Set SPI .id_table to prevent an SPI core warning
Geert Uytterhoeven <[email protected]>
drm/bridge: ti-sn65dsi86: Fix multiple instances
Takashi Iwai <[email protected]>
ALSA: timer: Don't take register_mutex with copy_from/to_user()
Jayesh Choudhary <[email protected]>
ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Always honor no_shutup_pins
Maud Spierings <[email protected]>
dt-bindings: vendor-prefixes: add GOcontroll
Jiri Kosina <[email protected]>
HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER
Venkata Prasad Potturu <[email protected]>
ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry
Vitaliy Shevtsov <[email protected]>
ASoC: cs35l41: check the return value from spi_setup()
Armin Wolf <[email protected]>
platform/x86: dell-ddv: Fix temperature calculation
Ilpo Järvinen <[email protected]>
platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static
Ilpo Järvinen <[email protected]>
platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static
Andy Shevchenko <[email protected]>
auxdisplay: panel: Fix an API misuse in panel.c
Joe Hattori <[email protected]>
media: platform: allgro-dvt: unregister v4l2_device on the error path
Benjamin Gaignard <[email protected]>
media: verisilicon: HEVC: Initialize start_bit field
Geert Uytterhoeven <[email protected]>
auxdisplay: MAX6959 should select BITREVERSE
Frieder Schrempf <[email protected]>
regulator: pca9450: Fix enable register for LDO5
Vitaly Kuznetsov <[email protected]>
x86/entry: Add __init to ia32_emulation_override_cmdline()
Chao Gao <[email protected]>
x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures
Josh Poimboeuf <[email protected]>
x86/traps: Make exc_double_fault() consistently noreturn
Tao Chen <[email protected]>
perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
Sebastian Andrzej Siewior <[email protected]>
lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*()
Rafael J. Wysocki <[email protected]>
PM: sleep: Fix handling devices with direct_complete set on errors
Chenyuan Yang <[email protected]>
thermal: int340x: Add NULL check for adev
James Morse <[email protected]>
x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors
Qiuxu Zhuo <[email protected]>
EDAC/ie31200: Fix the error path order of ie31200_init()
Qiuxu Zhuo <[email protected]>
EDAC/ie31200: Fix the DIMM size mask for several SoCs
Qiuxu Zhuo <[email protected]>
EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
Tim Schumacher <[email protected]>
selinux: Chain up tool resolving errors in install_policy.sh
Li Huafei <[email protected]>
watchdog/hardlockup/perf: Fix perf_event memory leak
Kees Cook <[email protected]>
kunit/stackinit: Use fill byte different from Clang i386 pattern
Atish Patra <[email protected]>
RISC-V: KVM: Disable the kernel perf counter during configure
Aaron Kling <[email protected]>
cpufreq: tegra194: Allow building for Tegra234
Rafael J. Wysocki <[email protected]>
PM: sleep: Adjust check before setting power.must_resume
Peter Zijlstra <[email protected]>
lockdep/mm: Fix might_fault() lockdep check of current->mm->mmap_lock
Kevin Loughlin <[email protected]>
x86/sev: Add missing RIP_REL_REF() invocations during sme_enable()
Arnd Bergmann <[email protected]>
x86/platform: Only allow CONFIG_EISA for 32-bit
Benjamin Berg <[email protected]>
x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct()
Stanislav Spassov <[email protected]>
x86/fpu: Fix guest FPU state buffer allocation size
Qiuxu Zhuo <[email protected]>
EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids
Jie Zhan <[email protected]>
cpufreq: governor: Fix negative 'idle_time' handling in dbs_update()
Tianchen Ding <[email protected]>
sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks
zihan zhou <[email protected]>
sched: Cancel the slice protection of the idle entity
Konstantin Andreev <[email protected]>
smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label
Konstantin Andreev <[email protected]>
smack: dont compile ipv6 code unless ipv6 is configured
zuoqian <[email protected]>
cpufreq: scpi: compare kHz instead of Hz
Mike Rapoport (Microsoft) <[email protected]>
x86/mm/pat: cpa-test: fix length for CPA_ARRAY test
Eric Sandeen <[email protected]>
watch_queue: fix pipe accounting mismatch
-------------
Diffstat:
.../devicetree/bindings/vendor-prefixes.yaml | 2 + Makefile | 4 +- arch/arm/include/asm/vmlinux.lds.h | 6 +- arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dtsi | 2 + arch/arm64/kernel/compat_alignment.c | 2 + arch/loongarch/Kconfig | 4 +- arch/loongarch/include/asm/cache.h | 2 + arch/loongarch/include/asm/irq.h | 2 +- arch/loongarch/include/asm/stacktrace.h | 3 + arch/loongarch/include/asm/unwind_hints.h | 10 +- arch/loongarch/kernel/env.c | 2 + arch/loongarch/kernel/kgdb.c | 5 +- arch/loongarch/net/bpf_jit.c | 12 +- arch/loongarch/net/bpf_jit.h | 5 + arch/powerpc/configs/mpc885_ads_defconfig | 2 +- arch/powerpc/crypto/Makefile | 1 + arch/powerpc/kexec/relocate_32.S | 7 +- arch/powerpc/platforms/cell/spufs/gang.c | 1 + arch/powerpc/platforms/cell/spufs/inode.c | 63 ++++- arch/powerpc/platforms/cell/spufs/spufs.h | 2 + arch/riscv/errata/Makefile | 6 +- arch/riscv/include/asm/ftrace.h | 4 +- arch/riscv/kernel/elf_kexec.c | 3 + arch/riscv/kvm/vcpu_pmu.c | 1 + arch/riscv/mm/hugetlbpage.c | 74 +++-- arch/riscv/purgatory/entry.S | 1 + arch/s390/include/asm/io.h | 2 - arch/s390/include/asm/pgtable.h | 3 - arch/s390/kernel/entry.S | 2 +- arch/s390/mm/pgtable.c | 10 - arch/um/include/shared/os.h | 1 - arch/um/kernel/Makefile | 2 +- arch/um/kernel/maccess.c | 19 -- arch/um/os-Linux/process.c | 51 ---- arch/x86/Kconfig | 3 +- arch/x86/Kconfig.cpu | 2 +- arch/x86/Makefile.um | 7 +- arch/x86/coco/tdx/tdx.c | 26 +- arch/x86/entry/calling.h | 2 + arch/x86/entry/common.c | 2 +- arch/x86/events/intel/core.c | 47 ++-- arch/x86/events/intel/ds.c | 13 +- arch/x86/events/perf_event.h | 3 +- arch/x86/hyperv/hv_vtl.c | 1 + arch/x86/hyperv/ivm.c | 5 +- arch/x86/include/asm/tdx.h | 4 +- arch/x86/include/asm/tlbflush.h | 2 +- arch/x86/kernel/cpu/mce/severity.c | 11 +- arch/x86/kernel/cpu/microcode/amd.c | 2 +- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 3 +- arch/x86/kernel/cpu/sgx/driver.c | 10 +- arch/x86/kernel/dumpstack.c | 5 +- arch/x86/kernel/fpu/core.c | 6 +- arch/x86/kernel/process.c | 9 +- arch/x86/kernel/traps.c | 18 +- arch/x86/kernel/tsc.c | 4 +- arch/x86/kernel/uprobes.c | 14 +- arch/x86/kvm/svm/sev.c | 13 +- arch/x86/kvm/x86.c | 15 +- arch/x86/lib/copy_user_64.S | 18 ++ arch/x86/mm/mem_encrypt_identity.c | 4 +- arch/x86/mm/pat/cpa-test.c | 2 +- arch/x86/mm/pat/memtype.c | 52 ++-- crypto/api.c | 17 +- crypto/bpf_crypto_skcipher.c | 1 + drivers/acpi/nfit/core.c | 2 +- drivers/acpi/processor_idle.c | 4 + drivers/acpi/resource.c | 7 + drivers/acpi/x86/utils.c | 3 +- drivers/auxdisplay/Kconfig | 1 + drivers/auxdisplay/panel.c | 4 +- drivers/base/power/main.c | 21 +- drivers/base/power/runtime.c | 2 +- drivers/block/ublk_drv.c | 41 ++- drivers/clk/imx/clk-imx8mp-audiomix.c | 6 +- drivers/clk/meson/g12a.c | 38 ++- drivers/clk/meson/gxbb.c | 14 +- drivers/clk/qcom/gcc-msm8953.c | 2 +- drivers/clk/qcom/gcc-sm8650.c | 4 +- drivers/clk/qcom/gcc-x1e80100.c | 30 -- drivers/clk/qcom/mmcc-sdm660.c | 2 +- drivers/clk/renesas/r9a08g045-cpg.c | 5 +- drivers/clk/renesas/rzg2l-cpg.c | 13 +- drivers/clk/renesas/rzg2l-cpg.h | 10 +- drivers/clk/rockchip/clk-rk3328.c | 2 +- drivers/clk/samsung/clk.c | 2 +- drivers/cpufreq/Kconfig.arm | 2 +- drivers/cpufreq/cpufreq_governor.c | 45 +-- drivers/cpufreq/scpi-cpufreq.c | 5 +- drivers/crypto/hisilicon/sec2/sec.h | 1 - drivers/crypto/hisilicon/sec2/sec_crypto.c | 125 ++++----- drivers/crypto/intel/iaa/iaa_crypto_main.c | 4 +- .../crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c | 1 + drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c | 59 +--- drivers/crypto/nx/nx-common-pseries.c | 37 ++- drivers/crypto/tegra/tegra-se-aes.c | 47 ++-- drivers/crypto/tegra/tegra-se-hash.c | 27 +- drivers/crypto/tegra/tegra-se-key.c | 10 +- drivers/crypto/tegra/tegra-se-main.c | 16 +- drivers/crypto/tegra/tegra-se.h | 3 +- drivers/dma/fsl-edma-main.c | 14 +- drivers/edac/i10nm_base.c | 2 + drivers/edac/ie31200_edac.c | 19 +- drivers/edac/skx_common.c | 33 +++ drivers/edac/skx_common.h | 11 + drivers/firmware/cirrus/cs_dsp.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_umsch_mm.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 1 + .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 15 - .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 16 ++ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 + .../gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c | 4 + .../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 12 +- .../dc/dml2/dml21/src/dml2_core/dml2_core_dcn4.c | 3 +- drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 3 +- .../gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 12 +- drivers/gpu/drm/bridge/ite-it6505.c | 7 +- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 2 + drivers/gpu/drm/display/drm_dp_mst_topology.c | 8 +- drivers/gpu/drm/mediatek/mtk_crtc.c | 7 +- drivers/gpu/drm/mediatek/mtk_dp.c | 6 +- drivers/gpu/drm/mediatek/mtk_dsi.c | 6 +- drivers/gpu/drm/mediatek/mtk_hdmi.c | 33 ++- drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 + drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 4 - drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 3 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 8 +- drivers/gpu/drm/msm/dsi/dsi_manager.c | 32 ++- drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 2 +- drivers/gpu/drm/msm/msm_dsc_helper.h | 11 - drivers/gpu/drm/panel/panel-ilitek-ili9882t.c | 2 +- drivers/gpu/drm/panthor/panthor_fw.h | 6 +- drivers/gpu/drm/solomon/ssd130x-spi.c | 7 +- drivers/gpu/drm/solomon/ssd130x.c | 6 +- drivers/gpu/drm/vkms/vkms_drv.c | 15 +- drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 2 + drivers/greybus/gb-beagleplay.c | 4 +- drivers/hid/Makefile | 1 - drivers/hid/i2c-hid/i2c-hid-core.c | 2 +- drivers/hwmon/nct6775-core.c | 4 +- drivers/hwtracing/coresight/coresight-catu.c | 2 +- drivers/hwtracing/coresight/coresight-core.c | 20 +- drivers/hwtracing/coresight/coresight-etm4x-core.c | 48 +++- drivers/i3c/master/svc-i3c-master.c | 2 +- drivers/iio/accel/mma8452.c | 10 +- drivers/iio/accel/msa311.c | 28 +- drivers/iio/adc/ad4130.c | 41 ++- drivers/iio/adc/ad7124.c | 35 ++- drivers/iio/adc/ad7173.c | 25 +- drivers/iio/adc/ad7768-1.c | 15 + drivers/iio/industrialio-backend.c | 4 +- drivers/iio/light/veml6075.c | 8 +- drivers/infiniband/core/device.c | 18 +- drivers/infiniband/core/mad.c | 38 +-- drivers/infiniband/core/sysfs.c | 1 + drivers/infiniband/hw/erdma/erdma_cm.c | 1 - drivers/infiniband/hw/mana/main.c | 2 +- drivers/infiniband/hw/mlx5/cq.c | 2 +- drivers/infiniband/hw/mlx5/mr.c | 41 ++- drivers/infiniband/hw/mlx5/odp.c | 10 +- drivers/leds/led-core.c | 22 +- drivers/media/dvb-frontends/dib8000.c | 5 +- drivers/media/platform/allegro-dvt/allegro-core.c | 1 + drivers/media/platform/ti/omap3isp/isp.c | 7 + .../platform/verisilicon/hantro_g2_hevc_dec.c | 1 + drivers/media/rc/streamzap.c | 2 +- drivers/media/test-drivers/vimc/vimc-streamer.c | 6 + drivers/memory/omap-gpmc.c | 20 -- drivers/mfd/sm501.c | 6 +- drivers/misc/ntsync.c | 1 + drivers/mmc/host/omap.c | 19 +- drivers/mmc/host/sdhci-omap.c | 4 +- drivers/mmc/host/sdhci-pxav3.c | 1 + drivers/net/arcnet/com20020-pci.c | 17 +- drivers/net/dsa/mv88e6xxx/chip.c | 11 +- drivers/net/dsa/mv88e6xxx/phy.c | 3 + drivers/net/dsa/realtek/Kconfig | 2 +- drivers/net/ethernet/ibm/ibmveth.c | 39 ++- drivers/net/ethernet/intel/e1000e/defines.h | 3 + drivers/net/ethernet/intel/e1000e/ich8lan.c | 80 +++++- drivers/net/ethernet/intel/e1000e/ich8lan.h | 4 + drivers/net/ethernet/intel/idpf/idpf_main.c | 6 +- drivers/net/ethernet/intel/idpf/idpf_txrx.h | 3 +- drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 3 + drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 3 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c | 201 ++++++++----- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- .../ethernet/marvell/octeontx2/af/rvu_devlink.c | 2 +- .../net/ethernet/mellanox/mlx5/core/en/params.c | 8 +- drivers/net/phy/broadcom.c | 6 +- drivers/net/usb/rndis_host.c | 16 +- drivers/net/usb/usbnet.c | 6 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 20 +- drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 86 ++++-- drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 8 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 1 + drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 1 - drivers/ntb/hw/intel/ntb_hw_gen3.c | 3 + drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 2 +- drivers/ntb/test/ntb_perf.c | 4 +- drivers/nvme/host/ioctl.c | 2 +- drivers/nvme/host/pci.c | 34 ++- drivers/nvme/host/tcp.c | 5 +- drivers/nvme/target/debugfs.c | 2 +- drivers/pci/controller/cadence/pcie-cadence-ep.c | 3 +- drivers/pci/controller/cadence/pcie-cadence.h | 2 +- drivers/pci/controller/dwc/pcie-designware-ep.c | 1 + drivers/pci/controller/dwc/pcie-histb.c | 12 +- drivers/pci/controller/pcie-brcmstb.c | 16 +- drivers/pci/controller/pcie-xilinx-cpm.c | 10 +- drivers/pci/hotplug/pciehp_hpc.c | 4 +- drivers/pci/pci-sysfs.c | 4 +- drivers/pci/pci.c | 22 +- drivers/pci/pcie/aspm.c | 17 +- drivers/pci/pcie/portdrv.c | 8 +- drivers/pci/probe.c | 5 +- drivers/pci/setup-bus.c | 4 +- drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c | 50 +++- drivers/pinctrl/intel/pinctrl-intel.c | 1 - drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c | 10 +- drivers/pinctrl/renesas/pinctrl-rza2.c | 2 + drivers/pinctrl/renesas/pinctrl-rzg2l.c | 3 + drivers/pinctrl/renesas/pinctrl-rzv2m.c | 2 + drivers/pinctrl/tegra/pinctrl-tegra.c | 3 + drivers/platform/x86/amd/pmf/pmf.h | 5 +- drivers/platform/x86/amd/pmf/tee-if.c | 52 +++- drivers/platform/x86/dell/dell-uart-backlight.c | 2 +- drivers/platform/x86/dell/dell-wmi-ddv.c | 6 +- drivers/platform/x86/intel/hid.c | 7 + .../x86/intel/speed_select_if/isst_if_common.c | 2 +- drivers/platform/x86/intel/vsec.c | 7 + .../x86/lenovo-yoga-tab2-pro-1380-fastcharger.c | 2 +- drivers/platform/x86/thinkpad_acpi.c | 11 + drivers/power/supply/bq27xxx_battery.c | 1 - drivers/power/supply/max77693_charger.c | 2 +- drivers/regulator/pca9450-regulator.c | 6 +- drivers/remoteproc/qcom_q6v5_mss.c | 21 +- drivers/remoteproc/qcom_q6v5_pas.c | 13 +- drivers/remoteproc/remoteproc_core.c | 1 + drivers/soundwire/slave.c | 1 + drivers/spi/spi-bcm2835.c | 18 +- drivers/spi/spi-cadence-xspi.c | 2 +- drivers/staging/rtl8723bs/Kconfig | 1 + .../vc04_services/interface/vchiq_arm/vchiq_arm.c | 7 +- .../intel/int340x_thermal/int3402_thermal.c | 3 + drivers/tty/n_tty.c | 13 +- drivers/tty/serial/fsl_lpuart.c | 312 ++++++++++----------- drivers/usb/host/xhci-mem.c | 6 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 +- drivers/vhost/scsi.c | 25 +- drivers/video/console/Kconfig | 6 +- drivers/video/fbdev/au1100fb.c | 4 +- drivers/video/fbdev/sm501fb.c | 7 + drivers/w1/masters/w1-uart.c | 4 +- fs/9p/vfs_inode_dotl.c | 2 +- fs/affs/file.c | 9 +- fs/exec.c | 15 +- fs/exfat/fatent.c | 2 +- fs/exfat/file.c | 29 +- fs/exfat/inode.c | 41 ++- fs/exfat/namei.c | 5 + fs/ext4/dir.c | 3 + fs/ext4/super.c | 27 +- fs/fuse/dax.c | 1 - fs/fuse/dir.c | 2 +- fs/fuse/file.c | 4 +- fs/hostfs/hostfs.h | 2 +- fs/hostfs/hostfs_kern.c | 7 +- fs/hostfs/hostfs_user.c | 59 ++-- fs/isofs/dir.c | 3 +- fs/jfs/jfs_dtree.c | 3 +- fs/jfs/xattr.c | 13 +- fs/netfs/direct_read.c | 6 +- fs/nfs/delegation.c | 63 +++-- fs/nfs/nfs4xdr.c | 18 +- fs/nfs/sysfs.c | 22 +- fs/nfs/write.c | 4 +- fs/nfsd/nfs4state.c | 37 ++- fs/nfsd/nfsctl.c | 44 ++- fs/nfsd/vfs.c | 28 +- fs/ntfs3/attrib.c | 3 +- fs/ntfs3/file.c | 22 +- fs/ntfs3/frecord.c | 6 +- fs/ntfs3/index.c | 4 +- fs/ntfs3/ntfs.h | 2 +- fs/ocfs2/alloc.c | 8 + fs/proc/base.c | 2 +- fs/smb/client/cifsacl.c | 34 ++- fs/smb/client/connect.c | 16 +- fs/smb/common/smbacl.h | 3 +- fs/smb/server/auth.c | 6 +- fs/smb/server/connection.h | 11 + fs/smb/server/mgmt/user_session.c | 37 ++- fs/smb/server/mgmt/user_session.h | 2 + fs/smb/server/oplock.c | 12 +- fs/smb/server/smb2pdu.c | 54 +++- fs/smb/server/smbacl.c | 50 ++-- fs/smb/server/smbacl.h | 2 +- include/drm/display/drm_dp_mst_helper.h | 7 + include/linux/cgroup-defs.h | 1 + include/linux/context_tracking_irq.h | 8 +- include/linux/coresight.h | 4 + include/linux/fwnode.h | 2 +- include/linux/interrupt.h | 8 +- include/linux/nfs_fs_sb.h | 4 + include/linux/nmi.h | 4 - include/linux/pgtable.h | 28 +- include/linux/pm_runtime.h | 2 + include/linux/rcupdate.h | 2 +- include/linux/sched/smt.h | 2 +- include/linux/thermal.h | 2 - include/linux/trace_events.h | 14 + include/linux/uprobes.h | 2 + include/rdma/ib_verbs.h | 1 + kernel/bpf/core.c | 19 +- kernel/bpf/verifier.c | 7 + kernel/cgroup/rstat.c | 38 +-- kernel/cpu.c | 5 - kernel/events/core.c | 46 ++- kernel/events/ring_buffer.c | 2 +- kernel/events/uprobes.c | 15 +- kernel/fork.c | 4 + kernel/kexec_elf.c | 2 +- kernel/locking/semaphore.c | 13 +- kernel/sched/deadline.c | 2 +- kernel/sched/fair.c | 50 +++- kernel/trace/bpf_trace.c | 2 +- kernel/trace/ring_buffer.c | 4 +- kernel/trace/trace_events.c | 14 + kernel/trace/trace_events_hist.c | 133 +++++++-- kernel/trace/trace_events_synth.c | 32 ++- kernel/trace/trace_functions_graph.c | 1 + kernel/trace/trace_irqsoff.c | 2 - kernel/trace/trace_osnoise.c | 1 - kernel/trace/trace_sched_wakeup.c | 2 - kernel/watch_queue.c | 9 + kernel/watchdog.c | 25 -- kernel/watchdog_perf.c | 28 +- lib/842/842_compress.c | 2 + lib/stackinit_kunit.c | 30 +- lib/vsprintf.c | 2 +- mm/gup.c | 3 + mm/memory.c | 13 +- mm/zswap.c | 30 +- net/can/af_can.c | 12 +- net/can/af_can.h | 12 +- net/can/proc.c | 46 +-- net/core/devmem.c | 4 +- net/core/dst.c | 8 + net/core/rtnetlink.c | 3 + net/ipv4/ip_tunnel_core.c | 4 +- net/ipv4/udp.c | 42 +-- net/ipv6/addrconf.c | 37 ++- net/ipv6/calipso.c | 21 +- net/ipv6/route.c | 42 ++- net/mac80211/driver-ops.c | 10 +- net/mac80211/iface.c | 11 +- net/mac80211/rx.c | 10 +- net/mac80211/sta_info.c | 20 +- net/mac80211/util.c | 5 +- net/netfilter/nf_tables_api.c | 4 +- net/netfilter/nft_set_hash.c | 3 +- net/netfilter/nft_tunnel.c | 6 +- net/openvswitch/actions.c | 6 - net/sched/act_tunnel_key.c | 2 +- net/sched/cls_flower.c | 2 +- net/sched/sch_skbprio.c | 3 - net/sctp/sysctl.c | 4 + net/vmw_vsock/af_vsock.c | 6 +- rust/Makefile | 4 +- rust/kernel/print.rs | 7 +- scripts/package/debian/rules | 6 +- scripts/selinux/install_policy.sh | 15 +- security/smack/smack.h | 6 + security/smack/smack_lsm.c | 34 +-- sound/core/timer.c | 147 +++++----- sound/pci/hda/patch_realtek.c | 50 +++- sound/soc/amd/acp/acp-legacy-common.c | 10 +- sound/soc/codecs/cs35l41-spi.c | 5 +- sound/soc/codecs/rt1320-sdw.c | 3 + sound/soc/codecs/rt5665.c | 24 +- sound/soc/codecs/wsa884x.c | 4 +- sound/soc/fsl/imx-card.c | 4 + sound/soc/ti/j721e-evm.c | 2 + tools/arch/x86/lib/insn.c | 2 +- tools/lib/bpf/linker.c | 2 +- tools/objtool/check.c | 35 +-- tools/perf/Makefile.config | 10 +- tools/perf/Makefile.perf | 2 +- tools/perf/bench/syscall.c | 22 +- tools/perf/builtin-report.c | 2 +- .../arch/arm64/ampere/ampereonex/metrics.json | 10 +- .../shell/coresight/asm_pure_loop/asm_pure_loop.S | 2 + tools/perf/tests/shell/record_bpf_filter.sh | 4 +- tools/perf/util/arm-spe.c | 8 +- tools/perf/util/bpf-filter.l | 2 +- tools/perf/util/comm.c | 2 + tools/perf/util/debug.c | 2 +- tools/perf/util/dso.h | 4 +- tools/perf/util/evlist.c | 13 +- tools/perf/util/intel-tpebs.c | 2 +- tools/perf/util/pmu.c | 7 +- tools/perf/util/pmu.h | 5 + tools/perf/util/pmus.c | 20 +- tools/perf/util/python.c | 17 +- tools/perf/util/stat-shadow.c | 3 +- tools/perf/util/units.c | 2 +- tools/power/x86/turbostat/turbostat.8 | 2 + tools/power/x86/turbostat/turbostat.c | 2 +- .../selftests/bpf/prog_tests/bloom_filter_map.c | 5 + tools/testing/selftests/bpf/prog_tests/tailcalls.c | 1 + tools/testing/selftests/bpf/progs/strncmp_bench.c | 5 +- tools/testing/selftests/mm/cow.c | 2 +- .../selftests/net/netfilter/br_netfilter.sh | 7 + .../selftests/net/netfilter/br_netfilter_queue.sh | 7 + tools/testing/selftests/net/netfilter/nft_queue.sh | 1 + 419 files changed, 3525 insertions(+), 2020 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/423 watch_queue: fix pipe accounting mismatch
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Sandeen <[email protected]>
[ Upstream commit f13abc1e8e1a3b7455511c4e122750127f6bc9b0 ]
Currently, watch_queue_set_size() modifies the pipe buffers charged to user->pipe_bufs without updating the pipe->nr_accounted on the pipe itself, due to the if (!pipe_has_watch_queue()) test in pipe_resize_ring(). This means that when the pipe is ultimately freed, we decrement user->pipe_bufs by something other than what than we had charged to it, potentially leading to an underflow. This in turn can cause subsequent too_many_pipe_buffers_soft() tests to fail with -EPERM.
To remedy this, explicitly account for the pipe usage in watch_queue_set_size() to match the number set via account_pipe_buffers()
(It's unclear why watch_queue_set_size() does not update nr_accounted; it may be due to intentional overprovisioning in watch_queue_set_size()?)
--- kernel/watch_queue.c | 9 +++++++++ 1 file changed, 9 insertions(+)
kernel/watch_queue.c +9 -0
@@ -269,6 +269,15 @@ long watch_queue_set_size(struct pipe_inode_info *pipe, unsigned int nr_notes)if (ret <0 ) goto error; +/* +* pipe_resize_ring() does not update nr_accounted for watch_queue +* pipes, because the above vastly overprovisions. Set nr_accounted on +* and max_usage this pipe to the number that was actually charged to +* the user above via account_pipe_buffers. +*/ + pipe->max_usage = nr_pages; + pipe->nr_accounted = nr_pages; + ret = -ENOMEM ; pages =kcalloc (nr_pages,sizeof (struct page *),GFP_KERNEL );if (!pages)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 2/423 x86/mm/pat: cpa-test: fix length for CPA_ARRAY test
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport (Microsoft) <[email protected]>
[ Upstream commit 33ea120582a638b2f2e380a50686c2b1d7cce795 ]
The CPA_ARRAY test always uses len[1] as numpages argument to change_page_attr_set() although the addresses array is different each iteration of the test loop.
Replace len[1] with len[i] to have numpages matching the addresses array.
--- arch/x86/mm/pat/cpa-test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/mm/pat/cpa-test.c +1 -1
@@ -183,7 +183,7 @@ static int pageattr_test(void)break ;case 1 : - err =change_page_attr_set (addrs, len[1 ],PAGE_CPA_TEST ,1 ); + err =change_page_attr_set (addrs, len[i],PAGE_CPA_TEST ,1 );break ;case 2 :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 3/423 cpufreq: scpi: compare kHz instead of Hz
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: zuoqian <[email protected]>
[ Upstream commit 4742da9774a416908ef8e3916164192c15c0e2d1 ]
The CPU rate from clk_get_rate() may not be divisible by 1000 (e.g., 133333333). But the rate calculated from frequency(kHz) is always divisible by 1000 (e.g., 133333000).
Comparing the rate causes a warning during CPU scaling:
"cpufreq: __target_index: Failed to change cpu frequency: -5". When we choose to compare kHz here, the issue does not occur.
--- drivers/cpufreq/scpi-cpufreq.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/cpufreq/scpi-cpufreq.c +3 -2
@@ -39,8 +39,9 @@ static unsigned int scpi_cpufreq_get_rate(unsigned int cpu)static int scpi_cpufreq_set_target (struct cpufreq_policy *policy,unsigned int index) { -u64 rate = policy->freq_table[index].frequency *1000 ; +unsigned long freq_khz = policy->freq_table[index].frequency;struct scpi_data *priv = policy->driver_data; +unsigned long rate = freq_khz *1000 ;int ret; ret =clk_set_rate (priv->clk, rate);
@@ -48,7 +49,7 @@ scpi_cpufreq_set_target(struct cpufreq_policy *policy, unsigned int index)if (ret)return ret; -if (clk_get_rate (priv->clk) != rate) +if (clk_get_rate (priv->clk) /1000 != freq_khz)return -EIO ;return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 4/423 smack: dont compile ipv6 code unless ipv6 is configured
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Andreev <[email protected]>
[ Upstream commit bfcf4004bcbce2cb674b4e8dbd31ce0891766bac ]
I want to be sure that ipv6-specific code
is not compiled in kernel binaries
if ipv6 is not configured.
[1] was getting rid of "unused variable" warning, but, with that, it also mandated compilation of a handful ipv6- specific functions in ipv4-only kernel configurations:
smk_ipv6_localhost, smack_ipv6host_label, smk_ipv6_check.
Their compiled bodies are likely to be removed by compiler from the resulting binary, but, to be on the safe side, I remove them from the compiler view.
--- security/smack/smack.h | 6 ++++++ security/smack/smack_lsm.c | 10 +++++++++- 2 files changed, 15 insertions(+), 1 deletion(-)
security/smack/smack.h +6 -0
@@ -152,6 +152,7 @@ struct smk_net4addr {struct smack_known *smk_label;/* label */ }; +#if IS_ENABLED (CONFIG_IPV6 )/* * An entry in the table identifying IPv6 hosts. */
@@ -162,7 +163,9 @@ struct smk_net6addr {int smk_masks;/* mask size */ struct smack_known *smk_label; /* label */ }; +#endif /* CONFIG_IPV6 */ +#ifdef SMACK_IPV6_PORT_LABELING /* * An entry in the table identifying ports. */
@@ -175,6 +178,7 @@ struct smk_port_label {short smk_sock_type;/* Socket type */ short smk_can_reuse; }; +#endif /* SMACK_IPV6_PORT_LABELING */ struct smack_known_list_elem {struct list_head list;
@@ -314,7 +318,9 @@ extern struct smack_known smack_known_web;extern struct mutex smack_known_lock;extern struct list_head smack_known_list;extern struct list_head smk_net4addr_list; +#if IS_ENABLED (CONFIG_IPV6 )extern struct list_head smk_net6addr_list; +#endif /* CONFIG_IPV6 */ extern struct mutex smack_onlycap_lock;extern struct list_head smack_onlycap_list;
security/smack/smack_lsm.c +9 -1
@@ -2498,6 +2498,7 @@ static struct smack_known *smack_ipv4host_label(struct sockaddr_in *sip)return NULL ; } +#if IS_ENABLED (CONFIG_IPV6 )/* * smk_ipv6_localhost - Check for local ipv6 host address * @sip: the address
@@ -2565,6 +2566,7 @@ static struct smack_known *smack_ipv6host_label(struct sockaddr_in6 *sip) return NULL; } +#endif /* CONFIG_IPV6 */ /** * smack_netlbl_add - Set the secattr on a socket
@@ -2669,6 +2671,7 @@ static int smk_ipv4_check(struct sock *sk, struct sockaddr_in *sap)return rc; } +#if IS_ENABLED (CONFIG_IPV6 )/** * smk_ipv6_check - check Smack access * @subject: subject Smack label
@@ -2701,6 +2704,7 @@ static int smk_ipv6_check(struct smack_known *subject, rc =smk_bu_note ("IPv6 check" , subject, object,MAY_WRITE , rc); return rc; } +#endif /* CONFIG_IPV6 */ #ifdef SMACK_IPV6_PORT_LABELING /**
@@ -3033,7 +3037,9 @@ static int smack_socket_connect(struct socket *sock, struct sockaddr *sap,return 0 ; if (addrlen < offsetofend(struct sockaddr, sa_family))return 0 ; -if (IS_ENABLED (CONFIG_IPV6 ) && sap->sa_family ==AF_INET6 ) { + +#if IS_ENABLED (CONFIG_IPV6 ) +if (sap->sa_family ==AF_INET6 ) {struct sockaddr_in6 *sip = (struct sockaddr_in6 *)sap;struct smack_known *rsp =NULL ;
@@ -3053,6 +3059,8 @@ static int smack_socket_connect(struct socket *sock, struct sockaddr *sap, return rc; } +#endif /* CONFIG_IPV6 */ +if (sap->sa_family !=AF_INET || addrlen <sizeof (struct sockaddr_in ))return 0 ; rc =smk_ipv4_check (sock->sk, (struct sockaddr_in *)sap);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 5/423 smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Andreev <[email protected]>
[ Upstream commit 6cce0cc3861337b3ad8d4ac131d6e47efa0954ec ]
Since inception [1], SMACK initializes ipv* child socket security for connection-oriented communications (tcp/sctp/dccp) during accept() syscall, in the security_sock_graft() hook:
| void smack_sock_graft(struct sock *sk, ...)
| {
| // only ipv4 and ipv6 are eligible here
| // ...
| ssp = sk->sk_security; // socket security
| ssp->smk_in = skp; // process label: smk_of_current()
| ssp->smk_out = skp; // process label: smk_of_current()
| }This approach is incorrect for two reasons:
A) initialization occurs too late for child socket security:
The child socket is created by the kernel once the handshake completes (e.g., for tcp: after receiving ack for syn+ack).
Data can legitimately start arriving to the child socket immediately, long before the application calls accept() on the socket.
Those data are (currently — were) processed by SMACK using incorrect child socket security attributes.
B) Incoming connection requests are handled using the listening socket's security, hence, the child socket must inherit the listening socket's security attributes.
smack_sock_graft() initilizes the child socket's security with a process label, as is done for a new socket()
But ... the process label is not necessarily the same as the listening socket label. A privileged application may legitimately set other in/out labels for a listening socket.
When this happens, SMACK processes incoming packets using incorrect socket security attributes.
In [2] Michael Lontke noticed (A) and fixed it in [3] by adding socket initialization into security_sk_clone_security() hook like
| void smack_sk_clone_security(struct sock *oldsk, struct sock *newsk)
| {
| *(struct socket_smack *)newsk->sk_security =
| *(struct socket_smack *)oldsk->sk_security;
| }This initializes the child socket security with the parent (listening) socket security at the appropriate time.
I was forced to revisit this old story because
smack_sock_graft() was left in place by [3] and continues overwriting the child socket's labels with the process label,
and there might be a reason for this, so I undertook a study.
If the process label differs from the listening socket's labels, the following occurs for ipv4:
assigning the smk_out is not accompanied by netlbl_sock_setattr, so the outgoing packet's cipso label does not change.
So, the only effect of this assignment for interhost communications is a divergence between the program-visible “out” socket label and the cipso network label. For intrahost communications this label, however, becomes visible via secmark netfilter marking, and is checked for access rights by the client, receiving side.
Assigning the smk_in affects both interhost and intrahost
communications: the server begins to check access rights against an wrong label.
Access check against wrong label (smk_in or smk_out), unsurprisingly fails, breaking the connection.
The above affects protocols that calls security_sock_graft() during accept(), namely: {tcp,dccp,sctp}/{ipv4,ipv6}
One extra security_sock_graft() caller, crypto/af_alg.c`af_alg_accept is not affected, because smack_sock_graft() does nothing for PF_ALG.
To reproduce, assign non-default in/out labels to a listening socket, setup rules between these labels and client label, attempt to connect and send some data.
Ipv6 specific: ipv6 packets do not convey SMACK labels. To reproduce the issue in interhost communications set opposite labels in /smack/ipv6host on both hosts.
Ipv6 intrahost communications do not require tricking, because SMACK labels are conveyed via secmark netfilter marking.
So, currently smack_sock_graft() is not useful, but harmful, therefore, I have removed it.
This fixes the issue for {tcp,dccp}/{ipv4,ipv6},
but not sctp/{ipv4,ipv6}.
Although this change is necessary for sctp+smack to function correctly, it is not sufficient because:
sctp/ipv4 does not call security_sk_clone() and sctp/ipv6 ignores SMACK completely.
These are separate issues, belong to other subsystem, and should be addressed separately.
[1] 2008-02-04,
[2] Michael Lontke, 2022-08-31, SMACK LSM checks wrong object label during ingress network traffic
[3] 2022-08-31, michael.lontke,
commit 4ca165fc6c49 ("SMACK: Add sk_clone_security LSM hook")
--- security/smack/smack_lsm.c | 24 ------------------------ 1 file changed, 24 deletions(-)
security/smack/smack_lsm.c +0 -24
@@ -4357,29 +4357,6 @@ static int smack_socket_getpeersec_dgram(struct socket *sock,return 0 ; } -/** -* smack_sock_graft - Initialize a newly created socket with an existing sock -* @sk: child sock -* @parent: parent socket -* -* Set the smk_{in,out} state of an existing sock based on the process that -* is creating the new socket. -*/ -static void smack_sock_graft (struct sock *sk,struct socket *parent) -{ -struct socket_smack *ssp; -struct smack_known *skp =smk_of_current (); - -if (sk ==NULL || - (sk->sk_family !=PF_INET && sk->sk_family !=PF_INET6 )) -return ; - - ssp =smack_sock (sk); - ssp->smk_in = skp; - ssp->smk_out = skp; -/* cssp->smk_packet is already set in smack_inet_csk_clone() */ -} -/** * smack_inet_conn_request - Smack access check on connect * @sk: socket involved
@@ -5168,7 +5145,6 @@ static struct security_hook_list smack_hooks[] __ro_after_init = {LSM_HOOK_INIT (sk_free_security, smack_sk_free_security), #endifLSM_HOOK_INIT (sk_clone_security, smack_sk_clone_security), -LSM_HOOK_INIT (sock_graft, smack_sock_graft),LSM_HOOK_INIT (inet_conn_request, smack_inet_conn_request), LSM_HOOK_INIT(inet_csk_clone, smack_inet_csk_clone),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 6/423 sched: Cancel the slice protection of the idle entity
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: zihan zhou <[email protected]>
[ Upstream commit f553741ac8c0e467a3b873e305f34b902e50b86d ]
A wakeup non-idle entity should preempt idle entity at any time, but because of the slice protection of the idle entity, the non-idle entity has to wait, so just cancel it.
This patch is aimed at minimizing the impact of SCHED_IDLE on SCHED_NORMAL. For example, a task with SCHED_IDLE policy that sleeps for 1s and then runs for 3 ms, running cyclictest on the same cpu, has a maximum latency of 3 ms, which is caused by the slice protection of the idle entity. It is unreasonable. With this patch, the cyclictest latency under the same conditions is basically the same on the cpu with idle processes and on empty cpu.
--- kernel/sched/fair.c | 46 ++++++++++++++++++++++++++++++++------------- 1 file changed, 33 insertions(+), 13 deletions(-)
kernel/sched/fair.c +33 -13
@@ -885,6 +885,26 @@ struct sched_entity *__pick_first_entity(struct cfs_rq *cfs_rq)return __node_2_se (left); } +/* +* HACK, stash a copy of deadline at the point of pick in vlag, +* which isn't used until dequeue. +*/ +static inline void set_protect_slice (struct sched_entity *se) +{ + se->vlag = se->deadline; +} + +static inline bool protect_slice (struct sched_entity *se) +{ +return se->vlag == se->deadline; +} + +static inline void cancel_protect_slice (struct sched_entity *se) +{ +if (protect_slice (se)) + se->vlag = se->deadline +1 ; +} +/* * Earliest Eligible Virtual Deadline First *
@@ -921,11 +941,7 @@ static struct sched_entity *pick_eevdf(struct cfs_rq *cfs_rq)if (curr && (!curr->on_rq || !entity_eligible (cfs_rq, curr))) curr =NULL ; -/* -* Once selected, run a task until it either becomes non-eligible or -* until it gets a new slice. See the HACK in set_next_entity(). -*/ -if (sched_feat (RUN_TO_PARITY ) && curr && curr->vlag == curr->deadline) +if (sched_feat (RUN_TO_PARITY ) && curr &&protect_slice (curr))return curr;/* Pick the leftmost entity if it's eligible */
@@ -5626,11 +5642,8 @@ set_next_entity(struct cfs_rq *cfs_rq, struct sched_entity *se)update_stats_wait_end_fair (cfs_rq, se);__dequeue_entity (cfs_rq, se);update_load_avg (cfs_rq, se,UPDATE_TG ); -/* -* HACK, stash a copy of deadline at the point of pick in vlag, -* which isn't used until dequeue. -*/ - se->vlag = se->deadline; + +set_protect_slice (se); }update_stats_curr_start (cfs_rq, se);
@@ -8882,8 +8895,15 @@ static void check_preempt_wakeup_fair(struct rq *rq, struct task_struct *p, int* Preempt an idle entity in favor of a non-idle entity (and don't preempt * in the inverse case). */ -if (cse_is_idle && !pse_is_idle) +if (cse_is_idle && !pse_is_idle) { +/* +* When non-idle entity preempt an idle entity, +* don't give idle entity slice protection. +*/ +cancel_protect_slice (se); goto preempt; + } +if (cse_is_idle != pse_is_idle)return ;
@@ -8902,8 +8922,8 @@ static void check_preempt_wakeup_fair(struct rq *rq, struct task_struct *p, int* Note that even if @p does not turn out to be the most eligible * task at this moment, current's slice protection will be lost. */ -if (do_preempt_short (cfs_rq, pse, se) && se->vlag == se->deadline) - se->vlag = se->deadline +1 ; +if (do_preempt_short (cfs_rq, pse, se)) +cancel_protect_slice (se);/* * If @p has become the most eligible task, force preemption.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 7/423 sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tianchen Ding <[email protected]>
[ Upstream commit 563bc2161b94571ea425bbe2cf69fd38e24cdedf ]
When a task is enqueued and its parent cgroup se is already on_rq, this parent cgroup se will not be enqueued again, and hence the root->min_slice leaves unchanged. The same issue happens when a task is dequeued and its parent cgroup se has other runnable entities, and the parent cgroup se will not be dequeued.
Force propagating min_slice when se doesn't need to be enqueued or dequeued. Ensure the se hierarchy always get the latest min_slice.
--- kernel/sched/fair.c | 4 ++++ 1 file changed, 4 insertions(+)
kernel/sched/fair.c +4 -0
@@ -7103,6 +7103,8 @@ enqueue_task_fair(struct rq *rq, struct task_struct *p, int flags)update_cfs_group (se); se->slice = slice; +if (se != cfs_rq->curr) +min_vruntime_cb_propagate (&se->run_node,NULL ); slice =cfs_rq_min_slice (cfs_rq); cfs_rq->h_nr_running++;
@@ -7232,6 +7234,8 @@ static int dequeue_entities(struct rq *rq, struct sched_entity *se, int flags)update_cfs_group (se); se->slice = slice; +if (se != cfs_rq->curr) +min_vruntime_cb_propagate (&se->run_node,NULL ); slice =cfs_rq_min_slice (cfs_rq); cfs_rq->h_nr_running -= h_nr_running;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 8/423 cpufreq: governor: Fix negative idle_time handling in dbs_update()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Zhan <[email protected]>
[ Upstream commit 3698dd6b139dc37b35a9ad83d9330c1f99666c02 ]
We observed an issue that the CPU frequency can't raise up with a 100% CPU load when NOHZ is off and the 'conservative' governor is selected.
'idle_time' can be negative if it's obtained from get_cpu_idle_time_jiffy() when NOHZ is off. This was found and explained in commit 9485e4ca0b48 ("cpufreq: governor: Fix handling of special cases in dbs_update()").
However, commit 7592019634f8 ("cpufreq: governors: Fix long idle detection logic in load calculation") introduced a comparison between 'idle_time' and 'samling_rate' to detect a long idle interval. While 'idle_time' is converted to int before comparison, it's actually promoted to unsigned again when compared with an unsigned 'sampling_rate'. Hence, this leads to wrong idle interval detection when it's in fact 100% busy and sets policy_dbs->idle_periods to a very large value. 'conservative' adjusts the frequency to minimum because of the large 'idle_periods', such that the frequency can't raise up. 'Ondemand' doesn't use policy_dbs->idle_periods so it fortunately avoids the issue.
Correct negative 'idle_time' to 0 before any use of it in dbs_update().
--- drivers/cpufreq/cpufreq_governor.c | 45 +++++++++++++++--------------- 1 file changed, 23 insertions(+), 22 deletions(-)
drivers/cpufreq/cpufreq_governor.c +23 -22
@@ -145,7 +145,23 @@ unsigned int dbs_update(struct cpufreq_policy *policy) time_elapsed = update_time - j_cdbs->prev_update_time; j_cdbs->prev_update_time = update_time; - idle_time = cur_idle_time - j_cdbs->prev_cpu_idle; +/* +* cur_idle_time could be smaller than j_cdbs->prev_cpu_idle if +* it's obtained from get_cpu_idle_time_jiffy() when NOHZ is +* off, where idle_time is calculated by the difference between +* time elapsed in jiffies and "busy time" obtained from CPU +* statistics. If a CPU is 100% busy, the time elapsed and busy +* time should grow with the same amount in two consecutive +* samples, but in practice there could be a tiny difference, +* making the accumulated idle time decrease sometimes. Hence, +* in this case, idle_time should be regarded as 0 in order to +* make the further process correct. +*/ +if (cur_idle_time > j_cdbs->prev_cpu_idle) + idle_time = cur_idle_time - j_cdbs->prev_cpu_idle; +else + idle_time =0 ; + j_cdbs->prev_cpu_idle = cur_idle_time;if (ignore_nice) {
@@ -162,7 +178,7 @@ unsigned int dbs_update(struct cpufreq_policy *policy)* calls, so the previous load value can be used then. */ load = j_cdbs->prev_load; - }else if (unlikely ((int )idle_time >2 * sampling_rate && + }else if (unlikely (idle_time >2 * sampling_rate && j_cdbs->prev_load)) {/* * If the CPU had gone completely idle and a task has
@@ -189,30 +205,15 @@ unsigned int dbs_update(struct cpufreq_policy *policy) load = j_cdbs->prev_load; j_cdbs->prev_load =0 ; }else { -if (time_elapsed >= idle_time) { +if (time_elapsed > idle_time) load =100 * (time_elapsed - idle_time) / time_elapsed; - }else { -/* -* That can happen if idle_time is returned by -* get_cpu_idle_time_jiffy(). In that case -* idle_time is roughly equal to the difference -* between time_elapsed and "busy time" obtained -* from CPU statistics. Then, the "busy time" -* can end up being greater than time_elapsed -* (for example, if jiffies_64 and the CPU -* statistics are updated by different CPUs), -* so idle_time may in fact be negative. That -* means, though, that the CPU was busy all -* the time (on the rough average) during the -* last sampling interval and 100 can be -* returned as the load. -*/ - load = (int )idle_time <0 ?100 :0 ; - } +else + load =0 ; + j_cdbs->prev_load = load; } -if (unlikely ((int )idle_time >2 * sampling_rate)) { +if (unlikely (idle_time >2 * sampling_rate)) {unsigned int periods = idle_time / sampling_rate;if (periods < idle_periods)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 9/423 EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit d9207cf7760f5f5599e9ff7eb0fedf56821a1d59 ]
When doing error injection to some memory DIMMs on certain Intel Emerald Rapids servers, the i10nm_edac missed error reports for some memory DIMMs.
Certain BIOS configurations may hide some memory controllers, and the i10nm_edac doesn't enumerate these hidden memory controllers. However, the ADXL decodes memory errors using memory controller physical indices even if there are hidden memory controllers. Therefore, the memory controller physical indices reported by the ADXL may mismatch the logical indices enumerated by the i10nm_edac, resulting in missed error reports for some memory DIMMs.
Fix this issue by creating a mapping table from memory controller physical indices (used by the ADXL) to logical indices (used by the i10nm_edac) and using it to convert the physical indices to the logical indices during the error handling process.
--- drivers/edac/i10nm_base.c | 2 ++ drivers/edac/skx_common.c | 33 +++++++++++++++++++++++++++++++++ drivers/edac/skx_common.h | 11 +++++++++++ 3 files changed, 46 insertions(+)
drivers/edac/i10nm_base.c +2 -0
@@ -751,6 +751,8 @@ static int i10nm_get_ddr_munits(void)continue ; }else { d->imc[lmc].mdev = mdev; +if (res_cfg->type ==SPR ) +skx_set_mc_mapping (d, i, lmc); lmc++; } }
drivers/edac/skx_common.c +33 -0
@@ -120,6 +120,35 @@ void skx_adxl_put(void) }EXPORT_SYMBOL_GPL (skx_adxl_put); +static void skx_init_mc_mapping (struct skx_dev *d) +{ +/* +* By default, the BIOS presents all memory controllers within each +* socket to the EDAC driver. The physical indices are the same as +* the logical indices of the memory controllers enumerated by the +* EDAC driver. +*/ +for (int i =0 ; i <NUM_IMC ; i++) + d->mc_mapping[i] = i; +} + +void skx_set_mc_mapping (struct skx_dev *d,u8 pmc,u8 lmc) +{ +edac_dbg (0 ,"Set the mapping of mc phy idx to logical idx: %02d -> %02d\n" , + pmc, lmc); + + d->mc_mapping[pmc] = lmc; +} +EXPORT_SYMBOL_GPL (skx_set_mc_mapping); + +static u8 skx_get_mc_mapping (struct skx_dev *d,u8 pmc) +{ +edac_dbg (0 ,"Get the mapping of mc phy idx to logical idx: %02d -> %02d\n" , + pmc, d->mc_mapping[pmc]); + +return d->mc_mapping[pmc]; +} +static bool skx_adxl_decode (struct decoded_addr *res,enum error_source err_src) {struct skx_dev *d;
@@ -187,6 +216,8 @@ static bool skx_adxl_decode(struct decoded_addr *res, enum error_source err_src)return false; } + res->imc =skx_get_mc_mapping (d, res->imc); +for (i =0 ; i < adxl_component_count; i++) {if (adxl_values[i] == ~0x0ull )continue ;
@@ -307,6 +338,8 @@ int skx_get_all_bus_mappings(struct res_config *cfg, struct list_head **list) d->bus[0], d->bus[1], d->bus[2], d->bus[3]);list_add_tail (&d->list, &dev_edac_list); prev = pdev; + +skx_init_mc_mapping (d); }if (list)
drivers/edac/skx_common.h +11 -0
@@ -93,6 +93,16 @@ struct skx_dev {struct pci_dev *uracu;/* for i10nm CPU */ struct pci_dev *pcu_cr3;/* for HBM memory detection */ u32 mcroute; +/* +* Some server BIOS may hide certain memory controllers, and the +* EDAC driver skips those hidden memory controllers. However, the +* ADXL still decodes memory error address using physical memory +* controller indices. The mapping table is used to convert the +* physical indices (reported by ADXL) to the logical indices +* (used the EDAC driver) of present memory controllers during the +* error handling process. +*/ +u8 mc_mapping[NUM_IMC ];struct skx_imc {struct mem_ctl_info *mci;struct pci_dev *mdev;/* for i10nm CPU */
@@ -242,6 +252,7 @@ void skx_adxl_put(void);void skx_set_decode (skx_decode_f decode,skx_show_retry_log_f show_retry_log);void skx_set_mem_cfg (bool mem_cfg_2lm);void skx_set_res_cfg (struct res_config *cfg); +void skx_set_mc_mapping (struct skx_dev *d,u8 pmc,u8 lmc);int skx_get_src_id (struct skx_dev *d,int off,u8 *id);int skx_get_node_id (struct skx_dev *d,u8 *id);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 10/423 x86/fpu: Fix guest FPU state buffer allocation size
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Spassov <[email protected]>
[ Upstream commit 1937e18cc3cf27e2b3ef70e8c161437051ab7608 ]
Ongoing work on an optimization to batch-preallocate vCPU state buffers for KVM revealed a mismatch between the allocation sizes used in fpu_alloc_guest_fpstate() and fpstate_realloc(). While the former allocates a buffer sized to fit the default set of XSAVE features in UABI form (as per fpu_user_cfg), the latter uses its ksize argument derived (for the requested set of features) in the same way as the sizes found in fpu_kernel_cfg, i.e. using the compacted in-kernel representation.
The correct size to use for guest FPU state should indeed be the kernel one as seen in fpstate_realloc(). The original issue likely went unnoticed through a combination of UABI size typically being larger than or equal to kernel size, and/or both amounting to the same number of allocated 4K pages.
--- arch/x86/kernel/fpu/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/fpu/core.c +1 -1
@@ -220,7 +220,7 @@ bool fpu_alloc_guest_fpstate(struct fpu_guest *gfpu)struct fpstate *fpstate;unsigned int size; - size = fpu_user_cfg.default_size +ALIGN (offsetof(struct fpstate , regs),64 ); + size = fpu_kernel_cfg.default_size +ALIGN (offsetof(struct fpstate , regs),64 ); fpstate =vzalloc (size);if (!fpstate)return false;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/423 x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit 5d3b81d4d8520efe888536b6906dc10fd1a228a8 ]
The init_task instance of struct task_struct is statically allocated and may not contain the full FP state for userspace. As such, limit the copy to the valid area of both init_task and 'dst' and ensure all memory is initialized.
Note that the FP state is only needed for userspace, and as such it is entirely reasonable for init_task to not contain parts of it.
----
v2:
- Fix code if arch_task_struct_size < sizeof(init_task) by using memcpy_and_pad.
--- arch/x86/kernel/process.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/x86/kernel/process.c +6 -1
@@ -92,7 +92,12 @@ EXPORT_PER_CPU_SYMBOL_GPL(__tss_limit_invalid);*/ int arch_dup_task_struct (struct task_struct *dst,struct task_struct *src) { -memcpy (dst, src, arch_task_struct_size); +/* init_task is not dynamically sized (incomplete FPU state) */ +if (unlikely (src == &init_task)) +memcpy_and_pad (dst, arch_task_struct_size, src,sizeof (init_task),0 ); +else +memcpy (dst, src, arch_task_struct_size); +#ifdef CONFIG_VM86 dst->thread.vm86 =NULL ;#endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/423 x86/platform: Only allow CONFIG_EISA for 32-bit
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 976ba8da2f3c2f1e997f4f620da83ae65c0e3728 ]
The CONFIG_EISA menu was cleaned up in 2018, but this inadvertently brought the option back on 64-bit machines: ISA remains guarded by a CONFIG_X86_32 check, but EISA no longer depends on ISA.
The last Intel machines ith EISA support used a 82375EB PCI/EISA bridge from 1993 that could be paired with the 440FX chipset on early Pentium-II CPUs, long before the first x86-64 products.
--- arch/x86/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/Kconfig +1 -1
@@ -226,7 +226,7 @@ config X86 select HAVE_SAMPLE_FTRACE_DIRECT_MULTI if X86_64 select HAVE_EBPF_JIT select HAVE_EFFICIENT_UNALIGNED_ACCESS - select HAVE_EISA + select HAVE_EISA if X86_32 select HAVE_EXIT_THREAD select HAVE_GUP_FAST select HAVE_FENTRY if X86_64 || DYNAMIC_FTRACE
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/423 x86/sev: Add missing RIP_REL_REF() invocations during sme_enable()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Loughlin <[email protected]>
[ Upstream commit 72dafb567760320f2de7447cd6e979bf9d4e5d17 ]
The following commit:
1c811d403afd ("x86/sev: Fix position dependent variable references in startup code")
introduced RIP_REL_REF() to force RIP-relative accesses to global variables, as needed to prevent crashes during early SEV/SME startup code.
For completeness, RIP_REL_REF() should be used with additional variables during sme_enable():
https://lore.kernel.org/all/CAMj1kXHnA0fJu6zh634=fbJswp59kSRAbhW+ubDGj1+NYwZJ-Q@mail.gmail.com/
Access these vars with RIP_REL_REF() to prevent problem reoccurence.
--- arch/x86/mm/mem_encrypt_identity.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/mm/mem_encrypt_identity.c +2 -2
@@ -562,7 +562,7 @@ void __head sme_enable(struct boot_params *bp) }RIP_REL_REF (sme_me_mask) = me_mask; - physical_mask &= ~me_mask; - cc_vendor =CC_VENDOR_AMD ; +RIP_REL_REF (physical_mask) &= ~me_mask; +RIP_REL_REF (cc_vendor) =CC_VENDOR_AMD ;cc_set_mask (me_mask); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/423 lockdep/mm: Fix might_fault() lockdep check of current->mm->mmap_lock
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit a1b65f3f7c6f7f0a08a7dba8be458c6415236487 ]
Turns out that this commit, about 10 years ago:
9ec23531fd48 ("sched/preempt, mm/fault: Trigger might_sleep() in might_fault() with disabled pagefaults")
... accidentally (and unnessecarily) put the lockdep part of __might_fault() under CONFIG_DEBUG_ATOMIC_SLEEP=y.
This is potentially notable because large distributions such as Ubuntu are running with !CONFIG_DEBUG_ATOMIC_SLEEP.
Restore the debug check.
[ mingo: Update changelog. ]
--- mm/memory.c | 2 -- 1 file changed, 2 deletions(-)
mm/memory.c +0 -2
@@ -6718,10 +6718,8 @@ void __might_fault(const char *file, int line)if (pagefault_disabled ())return ;__might_sleep (file, line); -#if defined(CONFIG_DEBUG_ATOMIC_SLEEP )if (current->mm) might_lock_read(¤t->mm->mmap_lock); -#endif }EXPORT_SYMBOL (__might_fault);#endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/423 PM: sleep: Adjust check before setting power.must_resume
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit eeb87d17aceab7803a5a5bcb6cf2817b745157cf ]
The check before setting power.must_resume in device_suspend_noirq() does not take power.child_count into account, but it should do that, so use pm_runtime_need_not_resume() in it for this purpose and adjust the comment next to it accordingly.
--- drivers/base/power/main.c | 13 ++++++------- drivers/base/power/runtime.c | 2 +- include/linux/pm_runtime.h | 2 ++ 3 files changed, 9 insertions(+), 8 deletions(-)
drivers/base/power/main.c +6 -7
@@ -1254,14 +1254,13 @@ static int device_suspend_noirq(struct device *dev, pm_message_t state, bool asy dev->power.is_noirq_suspended = true;/* -* Skipping the resume of devices that were in use right before the -* system suspend (as indicated by their PM-runtime usage counters) -* would be suboptimal. Also resume them if doing that is not allowed -* to be skipped. +* Devices must be resumed unless they are explicitly allowed to be left +* in suspend, but even in that case skipping the resume of devices that +* were in use right before the system suspend (as indicated by their +* runtime PM usage counters and child counters) would be suboptimal. */ -if (atomic_read (&dev->power.usage_count) >1 || - !(dev_pm_test_driver_flags (dev,DPM_FLAG_MAY_SKIP_RESUME ) && - dev->power.may_skip_resume)) +if (!(dev_pm_test_driver_flags (dev,DPM_FLAG_MAY_SKIP_RESUME ) && + dev->power.may_skip_resume) || !pm_runtime_need_not_resume (dev)) dev->power.must_resume = true;if (dev->power.must_resume)
drivers/base/power/runtime.c +1 -1
@@ -1874,7 +1874,7 @@ void pm_runtime_drop_link(struct device_link *link)pm_request_idle (link->supplier); } -static bool pm_runtime_need_not_resume (struct device *dev) +bool pm_runtime_need_not_resume (struct device *dev) { return atomic_read(&dev->power.usage_count) <= 1 && (atomic_read(&dev->power.child_count) == 0 ||
include/linux/pm_runtime.h +2 -0
@@ -66,6 +66,7 @@ static inline bool queue_pm_work(struct work_struct *work)extern int pm_generic_runtime_suspend (struct device *dev);extern int pm_generic_runtime_resume (struct device *dev); +extern bool pm_runtime_need_not_resume (struct device *dev);extern int pm_runtime_force_suspend (struct device *dev);extern int pm_runtime_force_resume (struct device *dev);
@@ -241,6 +242,7 @@ static inline bool queue_pm_work(struct work_struct *work) { return false; }static inline int pm_generic_runtime_suspend (struct device *dev) {return 0 ; }static inline int pm_generic_runtime_resume (struct device *dev) {return 0 ; } +static inline bool pm_runtime_need_not_resume (struct device *dev) {return true; }static inline int pm_runtime_force_suspend (struct device *dev) {return 0 ; }static inline int pm_runtime_force_resume (struct device *dev) {return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/423 cpufreq: tegra194: Allow building for Tegra234
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Kling <[email protected]>
[ Upstream commit 4a1e3bf61fc78ad100018adb573355303915dca3 ]
Support was added for Tegra234 in the referenced commit, but the Kconfig was not updated to allow building for the arch.
--- drivers/cpufreq/Kconfig.arm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cpufreq/Kconfig.arm +1 -1
@@ -245,7 +245,7 @@ config ARM_TEGRA186_CPUFREQ config ARM_TEGRA194_CPUFREQ tristate "Tegra194 CPUFreq support" - depends on ARCH_TEGRA_194_SOC || (64BIT && COMPILE_TEST) + depends on ARCH_TEGRA_194_SOC || ARCH_TEGRA_234_SOC || (64BIT && COMPILE_TEST) depends on TEGRA_BPMP default y help
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/423 RISC-V: KVM: Disable the kernel perf counter during configure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Atish Patra <[email protected]>
[ Upstream commit bbb622488749478955485765ddff9d56be4a7e4b ]
The perf event should be marked disabled during the creation as it is not ready to be scheduled until there is SBI PMU start call or config matching is called with auto start. Otherwise, event add/start gets called during perf_event_create_kernel_counter function. It will be enabled and scheduled to run via perf_event_enable during either the above mentioned scenario.
--- arch/riscv/kvm/vcpu_pmu.c | 1 + 1 file changed, 1 insertion(+)
arch/riscv/kvm/vcpu_pmu.c +1 -0
@@ -666,6 +666,7 @@ int kvm_riscv_vcpu_pmu_ctr_cfg_match(struct kvm_vcpu *vcpu, unsigned long ctr_ba .type = etype, .size = sizeof(struct perf_event_attr), .pinned = true, + .disabled = true,/* * It should never reach here if the platform doesn't support the sscofpmf * extension as mode filtering won't work without it.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/423 kunit/stackinit: Use fill byte different from Clang i386 pattern
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit d985e4399adffb58e10b38dbb5479ef29d53cde6 ]
The byte initialization values used with -ftrivial-auto-var-init=pattern (CONFIG_INIT_STACK_ALL_PATTERN=y) depends on the compiler, architecture, and byte position relative to struct member types. On i386 with Clang, this includes the 0xFF value, which means it looks like nothing changes between the leaf byte filling pass and the expected "stack wiping" pass of the stackinit test.
Use the byte fill value of 0x99 instead, fixing the test for i386 Clang builds.
--- lib/stackinit_kunit.c | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-)
lib/stackinit_kunit.c +20 -10
@@ -146,6 +146,15 @@ static bool stackinit_range_contains(char *haystack_start, size_t haystack_size,#define INIT_STRUCT_assigned_copy (var_type) \ ; var = *(arg) +/* +* The "did we actually fill the stack?" check value needs +* to be neither 0 nor any of the "pattern" bytes. The +* pattern bytes are compiler, architecture, and type based, +* so we have to pick a value that never appears for those +* combinations. Use 0x99 which is not 0xFF, 0xFE, nor 0xAA. +*/ +#define FILL_BYTE 0x99 +/* * @name: unique string name for the test * @var_type: type to be tested for zeroing initialization
@@ -168,12 +177,12 @@ static noinline void test_ ## name (struct kunit *test) \ ZERO_CLONE_ ## which(zero); \ /* Clear entire check buffer for 0xFF overlap test. */ \memset (check_buf,0x00 ,sizeof (check_buf)); \ -/* Fill stack with 0xFF. */ \ +/* Fill stack with FILL_BYTE. */ \ ignored = leaf_ ##name((unsigned long)&ignored, 1, \ FETCH_ARG_ ## which(zero)); \ -/* Verify all bytes overwritten with 0xFF. */ \ +/* Verify all bytes overwritten with FILL_BYTE. */ \for (sum =0 , i =0 ; i < target_size; i++) \ - sum += (check_buf[i] !=0xFF ); \ + sum += (check_buf[i] !=FILL_BYTE ); \/* Clear entire check buffer for later bit tests. */ \memset (check_buf,0x00 ,sizeof (check_buf)); \/* Extract stack-defined variable contents. */ \
@@ -184,7 +193,8 @@ static noinline void test_ ## name (struct kunit *test) \* possible between the two leaf function calls. \ */ \KUNIT_ASSERT_EQ_MSG (test, sum,0 , \ -"leaf fill was not 0xFF!?\n" ); \ +"leaf fill was not 0x%02X!?\n" , \ +FILL_BYTE ); \ \/* Validate that compiler lined up fill and target. */ \ KUNIT_ASSERT_TRUE_MSG(test, \
@@ -196,9 +206,9 @@ static noinline void test_ ## name (struct kunit *test) \ (int )((ssize_t )(uintptr_t )fill_start - \ (ssize_t)(uintptr_t)target_start)); \ \ -/* Look for any bytes still 0xFF in check region. */ \ +/* Validate check region has no FILL_BYTE bytes. */ \for (sum =0 , i =0 ; i < target_size; i++) \ - sum += (check_buf[i] ==0xFF ); \ + sum += (check_buf[i] ==FILL_BYTE ); \ \if (sum !=0 && xfail) \ kunit_skip(test, \
@@ -233,12 +243,12 @@ static noinline int leaf_ ## name(unsigned long sp, bool fill, \* stack frame of SOME kind... \ */ \memset (buf, (char )(sp &0xff ),sizeof (buf)); \ -/* Fill variable with 0xFF. */ \ +/* Fill variable with FILL_BYTE. */ \if (fill) { \ fill_start = &var; \ fill_size =sizeof (var); \memset (fill_start, \ - (char )((sp &0xff ) | forced_mask), \ +FILL_BYTE & forced_mask, \ fill_size); \ } \ \
@@ -380,7 +390,7 @@ static int noinline __leaf_switch_none(int path, bool fill) fill_start = &var; fill_size =sizeof (var); -memset (fill_start, forced_mask |0x55 , fill_size); +memset (fill_start, (forced_mask |0x55 ) &FILL_BYTE , fill_size); }memcpy (check_buf, target_start, target_size);break ;
@@ -391,7 +401,7 @@ static int noinline __leaf_switch_none(int path, bool fill) fill_start = &var; fill_size =sizeof (var); -memset (fill_start, forced_mask |0xaa , fill_size); +memset (fill_start, (forced_mask |0xaa ) &FILL_BYTE , fill_size); }memcpy (check_buf, target_start, target_size);break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/423 watchdog/hardlockup/perf: Fix perf_event memory leak
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Huafei <[email protected]>
[ Upstream commit d6834d9c990333bfa433bc1816e2417f268eebbe ]
During stress-testing, we found a kmemleak report for perf_event:
unreferenced object 0xff110001410a33e0 (size 1328):
comm "kworker/4:11", pid 288, jiffies 4294916004
hex dump (first 32 bytes):
b8 be c2 3b 02 00 11 ff 22 01 00 00 00 00 ad de ...;....".......
f0 33 0a 41 01 00 11 ff f0 33 0a 41 01 00 11 ff .3.A.....3.A....
backtrace (crc 24eb7b3a):
[<00000000e211b653>] kmem_cache_alloc_node_noprof+0x269/0x2e0
[<000000009d0985fa>] perf_event_alloc+0x5f/0xcf0
[<00000000084ad4a2>] perf_event_create_kernel_counter+0x38/0x1b0
[<00000000fde96401>] hardlockup_detector_event_create+0x50/0xe0
[<0000000051183158>] watchdog_hardlockup_enable+0x17/0x70
[<00000000ac89727f>] softlockup_start_fn+0x15/0x40
...Our stress test includes CPU online and offline cycles, and updating the watchdog configuration.
After reading the code, I found that there may be a race between cleaning up perf_event after updating watchdog and disabling event when the CPU goes offline:
CPU0 CPU1 CPU2
(update watchdog) (hotplug offline CPU1)
... _cpu_down(CPU1)
cpus_read_lock() // waiting for cpu lock
softlockup_start_all
smp_call_on_cpu(CPU1)
softlockup_start_fn
...
watchdog_hardlockup_enable(CPU1)
perf create E1
watchdog_ev[CPU1] = E1
cpus_read_unlock()
cpus_write_lock()
cpuhp_kick_ap_work(CPU1)
cpuhp_thread_fun
...
watchdog_hardlockup_disable(CPU1)
watchdog_ev[CPU1] = NULL
dead_event[CPU1] = E1 __lockup_detector_cleanup
for each dead_events_mask
release each dead_event
/*
* CPU1 has not been added to
* dead_events_mask, then E1
* will not be released
*/
CPU1 -> dead_events_mask
cpumask_clear(&dead_events_mask)
// dead_events_mask is cleared, E1 is leaked
In this case, the leaked perf_event E1 matches the perf_event leak reported by kmemleak. Due to the low probability of problem recurrence (only reported once), I added some hack delays in the code:
static void __lockup_detector_reconfigure(void)
{
...
watchdog_hardlockup_start();
cpus_read_unlock();
+ mdelay(100);
/*
* Must be called outside the cpus locked section to prevent
* recursive locking in the perf code.
...
}
void watchdog_hardlockup_disable(unsigned int cpu)
{
...
perf_event_disable(event);
this_cpu_write(watchdog_ev, NULL);
this_cpu_write(dead_event, event);
+ mdelay(100);
cpumask_set_cpu(smp_processor_id(), &dead_events_mask);
atomic_dec(&watchdog_cpus);
...
}
void hardlockup_detector_perf_cleanup(void)
{
...
perf_event_release_kernel(event);
per_cpu(dead_event, cpu) = NULL;
}
+ mdelay(100);
cpumask_clear(&dead_events_mask);
}Then, simultaneously performing CPU on/off and switching watchdog, it is almost certain to reproduce this leak.
The problem here is that releasing perf_event is not within the CPU hotplug read-write lock. Commit:
941154bd6937 ("watchdog/hardlockup/perf: Prevent CPU hotplug deadlock")
introduced deferred release to solve the deadlock caused by calling get_online_cpus() when releasing perf_event. Later, commit:
efe951d3de91 ("perf/x86: Fix perf,x86,cpuhp deadlock")
removed the get_online_cpus() call on the perf_event release path to solve another deadlock problem.
Therefore, it is now possible to move the release of perf_event back into the CPU hotplug read-write lock, and release the event immediately after disabling it.
--- include/linux/nmi.h | 4 ---- kernel/cpu.c | 5 ----- kernel/watchdog.c | 25 ------------------------- kernel/watchdog_perf.c | 28 +--------------------------- 4 files changed, 1 insertion(+), 61 deletions(-)
include/linux/nmi.h +0 -4
@@ -17,7 +17,6 @@void lockup_detector_init (void );void lockup_detector_retry_init (void );void lockup_detector_soft_poweroff (void ); -void lockup_detector_cleanup (void );extern int watchdog_user_enabled;extern int watchdog_thresh;
@@ -37,7 +36,6 @@ extern int sysctl_hardlockup_all_cpu_backtrace;static inline void lockup_detector_init (void ) { }static inline void lockup_detector_retry_init (void ) { }static inline void lockup_detector_soft_poweroff (void ) { } -static inline void lockup_detector_cleanup (void ) { }#endif /* !CONFIG_LOCKUP_DETECTOR */ #ifdef CONFIG_SOFTLOCKUP_DETECTOR
@@ -104,12 +102,10 @@ void watchdog_hardlockup_check(unsigned int cpu, struct pt_regs *regs);#if defined(CONFIG_HARDLOCKUP_DETECTOR_PERF )extern void hardlockup_detector_perf_stop (void );extern void hardlockup_detector_perf_restart (void ); -extern void hardlockup_detector_perf_cleanup (void );extern void hardlockup_config_perf_event (const char *str);#else static inline void hardlockup_detector_perf_stop (void ) { }static inline void hardlockup_detector_perf_restart (void ) { } -static inline void hardlockup_detector_perf_cleanup (void ) { }static inline void hardlockup_config_perf_event (const char *str) { }#endif
kernel/cpu.c +0 -5
@@ -1452,11 +1452,6 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen, out:cpus_write_unlock (); -/* -* Do post unplug cleanup. This is still protected against -* concurrent CPU hotplug via cpu_add_remove_lock. -*/ -lockup_detector_cleanup ();arch_smt_update ();return ret; }
kernel/watchdog.c +0 -25
@@ -347,8 +347,6 @@ static int __init watchdog_thresh_setup(char *str) }__setup ("watchdog_thresh=" , watchdog_thresh_setup); -static void __lockup_detector_cleanup (void ); -#ifdef CONFIG_SOFTLOCKUP_DETECTOR_INTR_STORM enum stats_per_group { STATS_SYSTEM,
@@ -878,11 +876,6 @@ static void __lockup_detector_reconfigure(void)watchdog_hardlockup_start ();cpus_read_unlock (); -/* -* Must be called outside the cpus locked section to prevent -* recursive locking in the perf code. -*/ -__lockup_detector_cleanup (); }void lockup_detector_reconfigure (void )
@@ -932,24 +925,6 @@ static inline void lockup_detector_setup(void) }#endif /* !CONFIG_SOFTLOCKUP_DETECTOR */ -static void __lockup_detector_cleanup (void ) -{ -lockdep_assert_held (&watchdog_mutex); -hardlockup_detector_perf_cleanup (); -} - -/** -* lockup_detector_cleanup - Cleanup after cpu hotplug or sysctl changes -* -* Caller must not hold the cpu hotplug rwsem. -*/ -void lockup_detector_cleanup (void ) -{ -mutex_lock (&watchdog_mutex); -__lockup_detector_cleanup (); -mutex_unlock (&watchdog_mutex); -} -/** * lockup_detector_soft_poweroff - Interface to stop lockup detector(s) *
kernel/watchdog_perf.c +1 -27
@@ -21,8 +21,6 @@#include <linux/perf_event.h> static DEFINE_PER_CPU(struct perf_event *, watchdog_ev); -static DEFINE_PER_CPU(struct perf_event *, dead_event); -static struct cpumask dead_events_mask;static atomic_t watchdog_cpus =ATOMIC_INIT (0 );
@@ -181,36 +179,12 @@ void watchdog_hardlockup_disable(unsigned int cpu)if (event) {perf_event_disable (event); +perf_event_release_kernel (event);this_cpu_write (watchdog_ev,NULL ); -this_cpu_write (dead_event, event); -cpumask_set_cpu (smp_processor_id (), &dead_events_mask);atomic_dec (&watchdog_cpus); } } -/** -* hardlockup_detector_perf_cleanup - Cleanup disabled events and destroy them -* -* Called from lockup_detector_cleanup(). Serialized by the caller. -*/ -void hardlockup_detector_perf_cleanup (void ) -{ -int cpu; - -for_each_cpu (cpu, &dead_events_mask) { -struct perf_event *event =per_cpu (dead_event, cpu); - -/* -* Required because for_each_cpu() reports unconditionally -* CPU0 as set on UP kernels. Sigh. -*/ -if (event) -perf_event_release_kernel (event); -per_cpu (dead_event, cpu) =NULL ; - } -cpumask_clear (&dead_events_mask); -} -/** * hardlockup_detector_perf_stop - Globally stop watchdog events *
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/423 selinux: Chain up tool resolving errors in install_policy.sh
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Schumacher <[email protected]>
[ Upstream commit 6ae0042f4d3f331e841495eb0a3d51598e593ec2 ]
Subshell evaluations are not exempt from errexit, so if a command is not available, which will fail and exit the script as a whole. This causes the helpful error messages to not be printed if they are tacked on using a $? comparison.
Resolve the issue by using chains of logical operators, which are not subject to the effects of errexit.
--- scripts/selinux/install_policy.sh | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
scripts/selinux/install_policy.sh +6 -9
@@ -6,27 +6,24 @@ if [ `id -u` -ne 0 ]; then exit 1 fi -SF=`which setfiles` -if [ $? -eq 1 ]; then +SF=`which setfiles` || { echo "Could not find setfiles" echo "Do you have policycoreutils installed?" exit 1 -fi +} -CP=`which checkpolicy` -if [ $? -eq 1 ]; then +CP=`which checkpolicy` || { echo "Could not find checkpolicy" echo "Do you have checkpolicy installed?" exit 1 -fi +} VERS=`$CP -V | awk '{print $1}'` -ENABLED=`which selinuxenabled` -if [ $? -eq 1 ]; then +ENABLED=`which selinuxenabled` || { echo "Could not find selinuxenabled" echo "Do you have libselinux-utils installed?" exit 1 -fi +} if selinuxenabled; then echo "SELinux is already enabled"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/423 EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit d59d844e319d97682c8de29b88d2d60922a683b3 ]
The EDAC_MC_LAYER_CHIP_SELECT layer pertains to the rank, not the DIMM. Fix its size to reflect the number of ranks instead of the number of DIMMs. Also delete the unused macros IE31200_{DIMMS,RANKS}.
--- drivers/edac/ie31200_edac.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/edac/ie31200_edac.c +1 -3
@@ -91,8 +91,6 @@ (((did) & PCI_DEVICE_ID_INTEL_IE31200_HB_CFL_MASK) == \ PCI_DEVICE_ID_INTEL_IE31200_HB_CFL_MASK)) -#define IE31200_DIMMS 4 -#define IE31200_RANKS 8#define IE31200_RANKS_PER_CHANNEL 4#define IE31200_DIMMS_PER_CHANNEL 2#define IE31200_CHANNELS 2
@@ -426,7 +424,7 @@ static int ie31200_probe1(struct pci_dev *pdev, int dev_idx) nr_channels =how_many_channels (pdev); layers[0 ].type =EDAC_MC_LAYER_CHIP_SELECT ; - layers[0 ].size =IE31200_DIMMS ; + layers[0 ].size =IE31200_RANKS_PER_CHANNEL ; layers[0 ].is_virt_csrow = true; layers[1 ].type =EDAC_MC_LAYER_CHANNEL ; layers[1 ].size = nr_channels;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/423 EDAC/ie31200: Fix the DIMM size mask for several SoCs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit 3427befbbca6b19fe0e37f91d66ce5221de70bf1 ]
The DIMM size mask for {Sky, Kaby, Coffee} Lake is not bits{7:0}, but bits{5:0}. Fix it.
--- drivers/edac/ie31200_edac.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/edac/ie31200_edac.c +2 -1
@@ -162,6 +162,7 @@#define IE31200_MAD_DIMM_0_OFFSET 0x5004#define IE31200_MAD_DIMM_0_OFFSET_SKL 0x500C#define IE31200_MAD_DIMM_SIZE GENMASK_ULL(7, 0) +#define IE31200_MAD_DIMM_SIZE_SKL GENMASK_ULL(5, 0)#define IE31200_MAD_DIMM_A_RANK BIT(17)#define IE31200_MAD_DIMM_A_RANK_SHIFT 17#define IE31200_MAD_DIMM_A_RANK_SKL BIT(10)
@@ -375,7 +376,7 @@ static void __iomem *ie31200_map_mchbar(struct pci_dev *pdev)static void __skl_populate_dimm_info (struct dimm_data *dd,u32 addr_decode,int chan) { - dd->size = (addr_decode >> (chan <<4 )) &IE31200_MAD_DIMM_SIZE ; + dd->size = (addr_decode >> (chan <<4 )) &IE31200_MAD_DIMM_SIZE_SKL ; dd->dual_rank = (addr_decode & (IE31200_MAD_DIMM_A_RANK_SKL << (chan <<4 ))) ?1 :0 ; dd->x16_width = ((addr_decode & (IE31200_MAD_DIMM_A_WIDTH_SKL << (chan <<4 ))) >> (IE31200_MAD_DIMM_A_WIDTH_SKL_SHIFT + (chan <<4 )));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 23/423 EDAC/ie31200: Fix the error path order of ie31200_init()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit 231e341036d9988447e3b3345cf741a98139199e ]
The error path order of ie31200_init() is incorrect, fix it.
--- drivers/edac/ie31200_edac.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/edac/ie31200_edac.c +7 -5
@@ -617,7 +617,7 @@ static int __init ie31200_init(void) pci_rc =pci_register_driver (&ie31200_driver);if (pci_rc <0 ) - goto fail0; +return pci_rc;if (!mci_pdev) { ie31200_registered =0 ;
@@ -628,11 +628,13 @@ static int __init ie31200_init(void)if (mci_pdev)break ; } +if (!mci_pdev) {edac_dbg (0 ,"ie31200 pci_get_device fail\n" ); pci_rc = -ENODEV ; - goto fail1; + goto fail0; } + pci_rc =ie31200_init_one (mci_pdev, &ie31200_pci_tbl[i]);if (pci_rc <0 ) {edac_dbg (0 ,"ie31200 init fail\n" );
@@ -640,12 +642,12 @@ static int __init ie31200_init(void) goto fail1; } } -return 0 ; +return 0 ; fail1: -pci_unregister_driver (&ie31200_driver); -fail0:pci_dev_put (mci_pdev); +fail0: +pci_unregister_driver (&ie31200_driver);return pci_rc; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 24/423 x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Morse <[email protected]>
[ Upstream commit a121798ae669351ec0697c94f71c3a692b2a755b ]
Commit
6eac36bb9eb0 ("x86/resctrl: Allocate the cleanest CLOSID by searching closid_num_dirty_rmid")
added logic that causes resctrl to search for the CLOSID with the fewest dirty cache lines when creating a new control group, if requested by the arch code. This depends on the values read from the llc_occupancy counters. The logic is applicable to architectures where the CLOSID effectively forms part of the monitoring identifier and so do not allow complete freedom to choose an unused monitoring identifier for a given CLOSID.
This support missed that some platforms may not have these counters. This causes a NULL pointer dereference when creating a new control group as the array was not allocated by dom_data_init().
As this feature isn't necessary on platforms that don't have cache occupancy monitors, add this to the check that occurs when a new control group is allocated.
--- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/kernel/cpu/resctrl/rdtgroup.c +2 -1
@@ -148,7 +148,8 @@ static int closid_alloc(void)lockdep_assert_held (&rdtgroup_mutex); -if (IS_ENABLED (CONFIG_RESCTRL_RMID_DEPENDS_ON_CLOSID )) { +if (IS_ENABLED (CONFIG_RESCTRL_RMID_DEPENDS_ON_CLOSID ) && +is_llc_occupancy_enabled ()) { cleanest_closid =resctrl_find_cleanest_closid ();if (cleanest_closid <0 )return cleanest_closid;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 25/423 thermal: int340x: Add NULL check for adev
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenyuan Yang <[email protected]>
[ Upstream commit 2542a3f70e563a9e70e7ded314286535a3321bdb ]
Not all devices have an ACPI companion fwnode, so adev might be NULL. This is similar to the commit cd2fd6eab480
("platform/x86: int3472: Check for adev == NULL").
Add a check for adev not being set and return -ENODEV in that case to avoid a possible NULL pointer deref in int3402_thermal_probe().
Note, under the same directory, int3400_thermal_probe() has such a check.
--- drivers/thermal/intel/int340x_thermal/int3402_thermal.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/thermal/intel/int340x_thermal/int3402_thermal.c +3 -0
@@ -45,6 +45,9 @@ static int int3402_thermal_probe(struct platform_device *pdev)struct int3402_thermal_data *d;int ret; +if (!adev) +return -ENODEV ; +if (!acpi_has_method (adev->handle,"_TMP" ))return -ENODEV ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 26/423 PM: sleep: Fix handling devices with direct_complete set on errors
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 03f1444016b71feffa1dfb8a51f15ba592f94b13 ]
When dpm_suspend() fails, some devices with power.direct_complete set may not have been handled by device_suspend() yet, so runtime PM has not been disabled for them yet even though power.direct_complete is set.
Since device_resume() expects that runtime PM has been disabled for all devices with power.direct_complete set, it will attempt to reenable runtime PM for the devices that have not been processed by device_suspend() which does not make sense. Had those devices had runtime PM disabled before device_suspend() had run, device_resume() would have inadvertently enable runtime PM for them, but this is not expected to happen because it would require ->prepare() callbacks to return positive values for devices with runtime PM disabled, which would be invalid.
In practice, this issue is most likely benign because pm_runtime_enable() will not allow the "disable depth" counter to underflow, but it causes a warning message to be printed for each affected device.
To allow device_resume() to distinguish the "direct complete" devices that have been processed by device_suspend() from those which have not been handled by it, make device_suspend() set power.is_suspended for "direct complete" devices.
Next, move the power.is_suspended check in device_resume() before the power.direct_complete check in it to make it skip the "direct complete" devices that have not been handled by device_suspend().
This change is based on a preliminary patch from Saravana Kannan.
--- drivers/base/power/main.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/base/power/main.c +4 -4
@@ -913,6 +913,9 @@ static void device_resume(struct device *dev, pm_message_t state, bool async)if (dev->power.syscore) goto Complete; +if (!dev->power.is_suspended) + goto Complete; +if (dev->power.direct_complete) {/* Match the pm_runtime_disable() in __device_suspend(). */ pm_runtime_enable (dev);
@@ -931,9 +934,6 @@ static void device_resume(struct device *dev, pm_message_t state, bool async)*/ dev->power.is_prepared = false; -if (!dev->power.is_suspended) - goto Unlock; -if (dev->pm_domain) { info ="power domain " ; callback =pm_op (&dev->pm_domain->ops, state);
@@ -973,7 +973,6 @@ static void device_resume(struct device *dev, pm_message_t state, bool async) error =dpm_run_callback (callback, dev, state, info); dev->power.is_suspended = false; - Unlock:device_unlock (dev);dpm_watchdog_clear (&wd);
@@ -1627,6 +1626,7 @@ static int device_suspend(struct device *dev, pm_message_t state, bool async)pm_runtime_disable (dev);if (pm_runtime_status_suspended (dev)) {pm_dev_dbg (dev, state,"direct-complete " ); + dev->power.is_suspended = true; goto Complete; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 27/423 lockdep: Dont disable interrupts on RT in disable_irq_nosync_lockdep.*()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 87886b32d669abc11c7be95ef44099215e4f5788 ]
disable_irq_nosync_lockdep() disables interrupts with lockdep enabled to avoid false positive reports by lockdep that a certain lock has not been acquired with disabled interrupts. The user of this macros expects that a lock can be acquried without disabling interrupts because the IRQ line triggering the interrupt is disabled.
This triggers a warning on PREEMPT_RT because after disable_irq_nosync_lockdep.*() the following spinlock_t now is acquired with disabled interrupts.
On PREEMPT_RT there is no difference between spin_lock() and spin_lock_irq() so avoiding disabling interrupts in this case works for the two remaining callers as of today.
Don't disable interrupts on PREEMPT_RT in disable_irq_nosync_lockdep.*().
--- include/linux/interrupt.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
include/linux/interrupt.h +4 -4
@@ -448,7 +448,7 @@ irq_calc_affinity_vectors(unsigned int minvec, unsigned int maxvec,static inline void disable_irq_nosync_lockdep (unsigned int irq) {disable_irq_nosync (irq); -#ifdef CONFIG_LOCKDEP +#if defined(CONFIG_LOCKDEP ) && !defined(CONFIG_PREEMPT_RT )local_irq_disable ();#endif }
@@ -456,7 +456,7 @@ static inline void disable_irq_nosync_lockdep(unsigned int irq)static inline void disable_irq_nosync_lockdep_irqsave (unsigned int irq,unsigned long *flags) {disable_irq_nosync (irq); -#ifdef CONFIG_LOCKDEP +#if defined(CONFIG_LOCKDEP ) && !defined(CONFIG_PREEMPT_RT )local_irq_save (*flags);#endif }
@@ -471,7 +471,7 @@ static inline void disable_irq_lockdep(unsigned int irq)static inline void enable_irq_lockdep (unsigned int irq) { -#ifdef CONFIG_LOCKDEP +#if defined(CONFIG_LOCKDEP ) && !defined(CONFIG_PREEMPT_RT )local_irq_enable ();#endif enable_irq (irq);
@@ -479,7 +479,7 @@ static inline void enable_irq_lockdep(unsigned int irq)static inline void enable_irq_lockdep_irqrestore (unsigned int irq,unsigned long *flags) { -#ifdef CONFIG_LOCKDEP +#if defined(CONFIG_LOCKDEP ) && !defined(CONFIG_PREEMPT_RT )local_irq_restore (*flags);#endif enable_irq (irq);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 28/423 perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Chen <[email protected]>
[ Upstream commit c96fff391c095c11dc87dab35be72dee7d217cde ]
The poll man page says POLLRDNORM is equivalent to POLLIN. For poll(), it seems that if user sets pollfd with POLLRDNORM in userspace, perf_poll will not return until timeout even if perf_output_wakeup called, whereas POLLIN returns.
--- kernel/events/ring_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/ring_buffer.c +1 -1
@@ -19,7 +19,7 @@static void perf_output_wakeup (struct perf_output_handle *handle) { -atomic_set (&handle->rb->poll,EPOLLIN ); +atomic_set (&handle->rb->poll,EPOLLIN |EPOLLRDNORM ); handle->event->pending_wakeup =1 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 29/423 x86/traps: Make exc_double_fault() consistently noreturn
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit 8085fcd78c1a3dbdf2278732579009d41ce0bc4e ]
The CONFIG_X86_ESPFIX64 version of exc_double_fault() can return to its caller, but the !CONFIG_X86_ESPFIX64 version never does. In the latter case the compiler and/or objtool may consider it to be implicitly noreturn.
However, due to the currently inflexible way objtool detects noreturns, a function's noreturn status needs to be consistent across configs.
The current workaround for this issue is to suppress unreachable warnings for exc_double_fault()'s callers. Unfortunately that can result in ORC coverage gaps and potentially worse issues like inert static calls and silently disabled CPU mitigations.
Instead, prevent exc_double_fault() from ever being implicitly marked noreturn by forcing a return behind a never-taken conditional.
Until a more integrated noreturn detection method exists, this is likely the least objectionable workaround.
--- arch/x86/kernel/traps.c | 18 +++++++++++++++++- tools/objtool/check.c | 31 +------------------------------ 2 files changed, 18 insertions(+), 31 deletions(-)
arch/x86/kernel/traps.c +17 -1
@@ -379,6 +379,21 @@ __visible void __noreturn handle_stack_overflow(struct pt_regs *regs, }#endif +/* +* Prevent the compiler and/or objtool from marking the !CONFIG_X86_ESPFIX64 +* version of exc_double_fault() as noreturn. Otherwise the noreturn mismatch +* between configs triggers objtool warnings. +* +* This is a temporary hack until we have compiler or plugin support for +* annotating noreturns. +*/ +#ifdef CONFIG_X86_ESPFIX64 +#define always_true () true +#else +bool always_true (void ); +bool __weak always_true (void ) {return true; } +#endif +/* * Runs on an IST stack for x86_64 and on a special task stack for x86_32. *
@@ -514,7 +529,8 @@ DEFINE_IDTENTRY_DF(exc_double_fault)pr_emerg ("PANIC: double fault, error_code: 0x%lx\n" , error_code);die ("double fault" , regs, error_code); -panic ("Machine halted." ); +if (always_true ()) +panic ("Machine halted." );instrumentation_end (); }
tools/objtool/check.c +1 -30
@@ -4575,35 +4575,6 @@ static int validate_sls(struct objtool_file *file)return warnings; } -static bool ignore_noreturn_call (struct instruction *insn) -{ -struct symbol *call_dest =insn_call_dest (insn); - -/* -* FIXME: hack, we need a real noreturn solution -* -* Problem is, exc_double_fault() may or may not return, depending on -* whether CONFIG_X86_ESPFIX64 is set. But objtool has no visibility -* to the kernel config. -* -* Other potential ways to fix it: -* -* - have compiler communicate __noreturn functions somehow -* - remove CONFIG_X86_ESPFIX64 -* - read the .config file -* - add a cmdline option -* - create a generic objtool annotation format (vs a bunch of custom -* formats) and annotate it -*/ -if (!strcmp (call_dest->name,"exc_double_fault" )) { -/* prevent further unreachable warnings for the caller */ - insn->sym->warned =1 ; -return true; - } - -return false; -} -static int validate_reachable_instructions (struct objtool_file *file) {struct instruction *insn, *prev_insn;
@@ -4620,7 +4591,7 @@ static int validate_reachable_instructions(struct objtool_file *file) prev_insn =prev_insn_same_sec (file, insn);if (prev_insn && prev_insn->dead_end) { call_dest =insn_call_dest (prev_insn); -if (call_dest && !ignore_noreturn_call (prev_insn)) { +if (call_dest) {WARN_INSN (insn,"%s() is missing a __noreturn annotation" , call_dest->name); warnings++;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 30/423 x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Gao <[email protected]>
[ Upstream commit dda366083e5ff307a4a728757db874bbfe7550be ]
Guest FPUs manage vCPU FPU states. They are allocated via fpu_alloc_guest_fpstate() and are resized in fpstate_realloc() when XFD features are enabled.
Since the introduction of guest FPUs, there have been inconsistencies in the kernel buffer size and xfeatures:
1. fpu_alloc_guest_fpstate() uses fpu_user_cfg since its introduction. See:
69f6ed1d14c6 ("x86/fpu: Provide infrastructure for KVM FPU cleanup") 36487e6228c4 ("x86/fpu: Prepare guest FPU for dynamically enabled FPU features")
2. __fpstate_reset() references fpu_kernel_cfg to set storage attributes.
3. fpu->guest_perm uses fpu_kernel_cfg, affecting fpstate_realloc().
A recent commit in the tip:x86/fpu tree partially addressed the inconsistency between (1) and (3) by using fpu_kernel_cfg for size calculation in (1), but left fpu_guest->xfeatures and fpu_guest->perm still referencing fpu_user_cfg:
https://lore.kernel.org/all/[email protected]/
1937e18cc3cf ("x86/fpu: Fix guest FPU state buffer allocation size")
The inconsistencies within fpu_alloc_guest_fpstate() and across the mentioned functions cause confusion.
Fix them by using fpu_kernel_cfg consistently in fpu_alloc_guest_fpstate(), except for fields related to the UABI buffer. Referencing fpu_kernel_cfg won't impact functionalities, as:
1. fpu_guest->perm is overwritten shortly in fpu_init_guest_permissions()
with fpstate->guest_perm, which already uses fpu_kernel_cfg.
2. fpu_guest->xfeatures is solely used to check if XFD features are enabled. Including supervisor xfeatures doesn't affect the check.
--- arch/x86/kernel/fpu/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/kernel/fpu/core.c +2 -2
@@ -232,8 +232,8 @@ bool fpu_alloc_guest_fpstate(struct fpu_guest *gfpu) fpstate->is_guest = true; gfpu->fpstate = fpstate; - gfpu->xfeatures = fpu_user_cfg.default_features; - gfpu->perm = fpu_user_cfg.default_features; + gfpu->xfeatures = fpu_kernel_cfg.default_features; + gfpu->perm = fpu_kernel_cfg.default_features;/* * KVM sets the FP+SSE bits in the XSAVE header when copying FPU state
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 31/423 x86/entry: Add __init to ia32_emulation_override_cmdline()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Kuznetsov <[email protected]>
[ Upstream commit d55f31e29047f2f987286d55928ae75775111fe7 ]
ia32_emulation_override_cmdline() is an early_param() arg and these are only needed at boot time. In fact, all other early_param() functions in arch/x86 seem to have '__init' annotation and ia32_emulation_override_cmdline() is the only exception.
--- arch/x86/entry/common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/entry/common.c +1 -1
@@ -142,7 +142,7 @@ static __always_inline int syscall_32_enter(struct pt_regs *regs)#ifdef CONFIG_IA32_EMULATION bool __ia32_enabled__ro_after_init = !IS_ENABLED (CONFIG_IA32_EMULATION_DEFAULT_DISABLED ); -static int ia32_emulation_override_cmdline (char *arg) +static int __init ia32_emulation_override_cmdline (char *arg) {return kstrtobool (arg, &__ia32_enabled); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 32/423 regulator: pca9450: Fix enable register for LDO5
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frieder Schrempf <[email protected]>
[ Upstream commit f5aab0438ef17f01c5ecd25e61ae6a03f82a4586 ]
The LDO5 regulator has two configuration registers, but only LDO5CTRL_L contains the bits for enabling/disabling the regulator.
--- drivers/regulator/pca9450-regulator.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/regulator/pca9450-regulator.c +3 -3
@@ -454,7 +454,7 @@ static const struct pca9450_regulator_desc pca9450a_regulators[] = { .n_linear_ranges = ARRAY_SIZE(pca9450_ldo5_volts), .vsel_reg = PCA9450_REG_LDO5CTRL_H, .vsel_mask = LDO5HOUT_MASK, - .enable_reg = PCA9450_REG_LDO5CTRL_H, + .enable_reg = PCA9450_REG_LDO5CTRL_L, .enable_mask = LDO5H_EN_MASK, .owner = THIS_MODULE, },
@@ -663,7 +663,7 @@ static const struct pca9450_regulator_desc pca9450bc_regulators[] = { .n_linear_ranges = ARRAY_SIZE(pca9450_ldo5_volts), .vsel_reg = PCA9450_REG_LDO5CTRL_H, .vsel_mask = LDO5HOUT_MASK, - .enable_reg = PCA9450_REG_LDO5CTRL_H, + .enable_reg = PCA9450_REG_LDO5CTRL_L, .enable_mask = LDO5H_EN_MASK, .owner = THIS_MODULE, },
@@ -835,7 +835,7 @@ static const struct pca9450_regulator_desc pca9451a_regulators[] = { .n_linear_ranges = ARRAY_SIZE(pca9450_ldo5_volts), .vsel_reg = PCA9450_REG_LDO5CTRL_H, .vsel_mask = LDO5HOUT_MASK, - .enable_reg = PCA9450_REG_LDO5CTRL_H, + .enable_reg = PCA9450_REG_LDO5CTRL_L, .enable_mask = LDO5H_EN_MASK, .owner = THIS_MODULE, },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 33/423 auxdisplay: MAX6959 should select BITREVERSE
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit fce85f3da08b76c1b052f53a9f6f9c40a8a10660 ]
If CONFIG_BITREVERSE is not enabled:
max6959.c:(.text+0x92): undefined reference to `byte_rev_table'
--- drivers/auxdisplay/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/auxdisplay/Kconfig +1 -0
@@ -503,6 +503,7 @@ config HT16K33 config MAX6959 tristate "Maxim MAX6958/6959 7-segment LED controller" depends on I2C + select BITREVERSE select REGMAP_I2C select LINEDISP help
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 34/423 media: verisilicon: HEVC: Initialize start_bit field
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Gaignard <[email protected]>
[ Upstream commit 7fcb42b3835e90ef18d68555934cf72adaf58402 ]
The HEVC driver needs to set the start_bit field explicitly to avoid causing corrupted frames when the VP9 decoder is used in parallel. The reason for this problem is that the VP9 and the HEVC decoder share this register.
--- drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c +1 -0
@@ -518,6 +518,7 @@ static void set_buffers(struct hantro_ctx *ctx)hantro_reg_write (vpu, &g2_stream_len, src_len);hantro_reg_write (vpu, &g2_strm_buffer_len, src_buf_len);hantro_reg_write (vpu, &g2_strm_start_offset,0 ); +hantro_reg_write (vpu, &g2_start_bit,0 );hantro_reg_write (vpu, &g2_write_mvs_e,1 );hantro_write_addr (vpu,G2_TILE_SIZES_ADDR , ctx->hevc_dec.tile_sizes.dma);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 35/423 media: platform: allgro-dvt: unregister v4l2_device on the error path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
[ Upstream commit c2b96a6818159fba8a3bcc38262da9e77f9b3ec7 ]
In allegro_probe(), the v4l2 device is not unregistered in the error path, which results in a memory leak. Fix it by calling v4l2_device_unregister() before returning error.
--- drivers/media/platform/allegro-dvt/allegro-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/allegro-dvt/allegro-core.c +1 -0
@@ -3914,6 +3914,7 @@ static int allegro_probe(struct platform_device *pdev)if (ret <0 ) {v4l2_err (&dev->v4l2_dev,"failed to request firmware: %d\n" , ret); +v4l2_device_unregister (&dev->v4l2_dev);return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 36/423 auxdisplay: panel: Fix an API misuse in panel.c
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 72e1c440c848624ad4cfac93d69d8a999a20355b ]
Variable allocated by charlcd_alloc() should be released by charlcd_free(). The following patch changed kfree() to charlcd_free() to fix an API misuse.
--- drivers/auxdisplay/panel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/auxdisplay/panel.c +2 -2
@@ -1664,7 +1664,7 @@ static void panel_attach(struct parport *port)if (lcd.enabled)charlcd_unregister (lcd.charlcd); err_unreg_device: -kfree (lcd.charlcd); +charlcd_free (lcd.charlcd); lcd.charlcd =NULL ;parport_unregister_device (pprt); pprt =NULL ;
@@ -1692,7 +1692,7 @@ static void panel_detach(struct parport *port)charlcd_unregister (lcd.charlcd); lcd.initialized = false;kfree (lcd.charlcd->drvdata); -kfree (lcd.charlcd); +charlcd_free (lcd.charlcd); lcd.charlcd =NULL ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 37/423 platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 886ca11a0c70efe5627a18557062e8a44370d78f ]
Sparse reports:
lenovo-yoga-tab2-pro-1380-fastcharger.c:222:29: warning: symbol 'yt2_1380_fc_serdev_driver' was not declared. Should it be static?
Fix that by making the symbol static.
--- drivers/platform/x86/lenovo-yoga-tab2-pro-1380-fastcharger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/lenovo-yoga-tab2-pro-1380-fastcharger.c +1 -1
@@ -219,7 +219,7 @@ static int yt2_1380_fc_serdev_probe(struct serdev_device *serdev)return 0 ; } -struct serdev_device_driver yt2_1380_fc_serdev_driver = { +static struct serdev_device_driver yt2_1380_fc_serdev_driver = { .probe = yt2_1380_fc_serdev_probe, .driver = { .name =KBUILD_MODNAME ,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 38/423 platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 4878e0b14c3e31a87ab147bd2dae443394cb5a2c ]
Sparse reports:
dell-uart-backlight.c:328:29: warning: symbol 'dell_uart_bl_serdev_driver' was not declared. Should it be static?
Fix it by making the symbol static.
--- drivers/platform/x86/dell/dell-uart-backlight.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/dell/dell-uart-backlight.c +1 -1
@@ -325,7 +325,7 @@ static int dell_uart_bl_serdev_probe(struct serdev_device *serdev)return PTR_ERR_OR_ZERO (dell_bl->bl); } -struct serdev_device_driver dell_uart_bl_serdev_driver = { +static struct serdev_device_driver dell_uart_bl_serdev_driver = { .probe = dell_uart_bl_serdev_probe, .driver = { .name =KBUILD_MODNAME ,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 39/423 platform/x86: dell-ddv: Fix temperature calculation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 7a248294a3145bc65eb0d8980a0a8edbb1b92db4 ]
On the Dell Inspiron 3505 the battery temperature is always 0.1 degrees larger than the temperature show inside the OEM application.
Emulate this behaviour to avoid showing strange looking values like 29.1 degrees.
--- drivers/platform/x86/dell/dell-wmi-ddv.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/platform/x86/dell/dell-wmi-ddv.c +4 -2
@@ -665,8 +665,10 @@ static ssize_t temp_show(struct device *dev, struct device_attribute *attr, charif (ret <0 )return ret; -/* Use 2731 instead of 2731.5 to avoid unnecessary rounding */ -return sysfs_emit (buf,"%d\n" , value -2731 ); +/* Use 2732 instead of 2731.5 to avoid unnecessary rounding and to emulate +* the behaviour of the OEM application which seems to round down the result. +*/ +return sysfs_emit (buf,"%d\n" , value -2732 ); }static ssize_t eppid_show (struct device *dev,struct device_attribute *attr,char *buf)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 40/423 ASoC: cs35l41: check the return value from spi_setup()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaliy Shevtsov <[email protected]>
[ Upstream commit ad5a0970f86d82e39ebd06d45a1f7aa48a1316f8 ]
Currently the return value from spi_setup() is not checked for a failure. It is unlikely it will ever fail in this particular case but it is still better to add this check for the sake of completeness and correctness. This is cheap since it is performed once when the device is being probed.
Handle spi_setup() return value.
Found by Linux Verification Center (linuxtesting.org) with Svace.
--- sound/soc/codecs/cs35l41-spi.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
sound/soc/codecs/cs35l41-spi.c +4 -1
@@ -32,13 +32,16 @@ static int cs35l41_spi_probe(struct spi_device *spi)const struct regmap_config *regmap_config = &cs35l41_regmap_spi;struct cs35l41_hw_cfg *hw_cfg =dev_get_platdata (&spi->dev);struct cs35l41_private *cs35l41; +int ret; cs35l41 =devm_kzalloc (&spi->dev,sizeof (struct cs35l41_private ),GFP_KERNEL );if (!cs35l41)return -ENOMEM ; spi->max_speed_hz =CS35L41_SPI_MAX_FREQ ; -spi_setup (spi); + ret =spi_setup (spi); +if (ret <0 ) +return ret;spi_set_drvdata (spi, cs35l41); cs35l41->regmap =devm_regmap_init_spi (spi, regmap_config);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 41/423 ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Venkata Prasad Potturu <[email protected]>
[ Upstream commit 02e1cf7a352a3ba5f768849f2b4fcaaaa19f89e3 ]
Add condition check to register ACP PDM sound card by reading _WOV acpi entry.
--- sound/soc/amd/acp/acp-legacy-common.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
sound/soc/amd/acp/acp-legacy-common.c +9 -1
@@ -13,6 +13,7 @@*/ #include "amd.h" +#include <linux/acpi.h> #include <linux/pci.h> #include <linux/export.h>
@@ -445,7 +446,9 @@ void check_acp_config(struct pci_dev *pci, struct acp_chip_info *chip) {struct acpi_device *pdm_dev;const union acpi_object *obj; -u32 pdm_addr; +acpi_handle handle; +acpi_integer dmic_status; +u32 pdm_addr, ret;switch (chip->acp_rev) {case ACP3X_DEV :
@@ -477,6 +480,11 @@ void check_acp_config(struct pci_dev *pci, struct acp_chip_info *chip) obj->integer.value == pdm_addr) chip->is_pdm_dev = true; } + + handle =ACPI_HANDLE (&pci->dev); + ret =acpi_evaluate_integer (handle,"_WOV" ,NULL , &dmic_status); +if (!ACPI_FAILURE (ret)) + chip->is_pdm_dev = dmic_status; } }EXPORT_SYMBOL_NS_GPL (check_acp_config,SND_SOC_ACP_COMMON );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 42/423 HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <[email protected]>
[ Upstream commit fe0fb58325e519008e2606a5aa2cff7ad23e212d ]
The line
obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER) += intel-ish-hid/
in top-level HID Makefile is both superfluous (as CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER depends on CONFIG_INTEL_ISH_HID, which contains intel-ish-hid/ already) and wrong (as it's missing the CONFIG_ prefix).
Just remove it.
--- drivers/hid/Makefile | 1 - 1 file changed, 1 deletion(-)
drivers/hid/Makefile +0 -1
@@ -165,7 +165,6 @@ obj-$(CONFIG_USB_KBD) += usbhid/ obj-$(CONFIG_I2C_HID_CORE) += i2c-hid/ obj-$(CONFIG_INTEL_ISH_HID) += intel-ish-hid/ -obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER) += intel-ish-hid/ obj-$(CONFIG_AMD_SFH_HID) += amd-sfh-hid/
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 43/423 dt-bindings: vendor-prefixes: add GOcontroll
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maud Spierings <[email protected]>
[ Upstream commit 5f0d2de417166698c8eba433b696037ce04730da ]
GOcontroll produces embedded linux systems and IO modules to use in these systems, add its prefix.
--- Documentation/devicetree/bindings/vendor-prefixes.yaml | 2 ++ 1 file changed, 2 insertions(+)
Documentation/devicetree/bindings/vendor-prefixes.yaml +2 -0
@@ -581,6 +581,8 @@ patternProperties: description: GlobalTop Technology, Inc. "^gmt,.*": description: Global Mixed-mode Technology, Inc. + "^gocontroll,.*": + description: GOcontroll Modular Embedded Electronics B.V. "^goldelico,.*": description: Golden Delicious Computers GmbH & Co. KG "^goodix,.*":
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 44/423 ALSA: hda/realtek: Always honor no_shutup_pins
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 5a0c72c1da3cbc0cd4940a95d1be2830104c6edf ]
The workaround for Dell machines to skip the pin-shutup for mic pins introduced alc_headset_mic_no_shutup() that is replaced from the generic snd_hda_shutup_pins() for certain codecs. The problem is that the call is done unconditionally even if spec->no_shutup_pins is set. This seems causing problems on other platforms like Lenovo.
This patch corrects the behavior and the driver honors always spec->no_shutup_pins flag and skips alc_headset_mic_no_shutup() if it's set.
--- sound/pci/hda/patch_realtek.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/pci/hda/patch_realtek.c +4 -2
@@ -586,6 +586,9 @@ static void alc_shutup_pins(struct hda_codec *codec) {struct alc_spec *spec = codec->spec; +if (spec->no_shutup_pins) +return ; +switch (codec->core.vendor_id) {case 0x10ec0236 :case 0x10ec0256 :
@@ -601,8 +604,7 @@ static void alc_shutup_pins(struct hda_codec *codec)alc_headset_mic_no_shutup (codec);break ;default : -if (!spec->no_shutup_pins) -snd_hda_shutup_pins (codec); +snd_hda_shutup_pins (codec);break ; } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 45/423 ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jayesh Choudhary <[email protected]>
[ Upstream commit 45ff65e30deb919604e68faed156ad96ce7474d9 ]
For 'ti,j7200-cpb-audio' compatible, there is support for only one PLL for 48k. For 11025, 22050, 44100 and 88200 sampling rates, due to absence of J721E_CLK_PARENT_44100, we get EINVAL while running any audio application. Add support for these rates by using the 48k parent clock and adjusting the clock for these rates later in j721e_configure_refclk.
--- sound/soc/ti/j721e-evm.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/ti/j721e-evm.c +2 -0
@@ -182,6 +182,8 @@ static int j721e_configure_refclk(struct j721e_priv *priv, clk_id =J721E_CLK_PARENT_48000 ; else if (!(rate % 11025) && priv->pll_rates[J721E_CLK_PARENT_44100]) clk_id =J721E_CLK_PARENT_44100 ; + else if (!(rate % 11025) && priv->pll_rates[J721E_CLK_PARENT_48000]) + clk_id =J721E_CLK_PARENT_48000 ; else return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 46/423 ALSA: timer: Dont take register_mutex with copy_from/to_user()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 3424c8f53bc63c87712a7fc22dc13d0cc85fb0d6 ]
The infamous mmap_lock taken in copy_from/to_user() can be often problematic when it's called inside another mutex, as they might lead to deadlocks.
In the case of ALSA timer code, the bad pattern is with guard(mutex)(®ister_mutex) that covers copy_from/to_user() -- which was mistakenly introduced at converting to guard(), and it had been carefully worked around in the past.
This patch fixes those pieces simply by moving copy_from/to_user() out of the register mutex lock again.
--- sound/core/timer.c | 147 ++++++++++++++++++++++++--------------------- 1 file changed, 77 insertions(+), 70 deletions(-)
sound/core/timer.c +77 -70
@@ -1515,91 +1515,97 @@ static void snd_timer_user_copy_id(struct snd_timer_id *id, struct snd_timer *ti id->subdevice = timer->tmr_subdevice; } -static int snd_timer_user_next_device (struct snd_timer_id __user *_tid) +static void get_next_device (struct snd_timer_id *id) { -struct snd_timer_id id;struct snd_timer *timer;struct list_head *p; -if (copy_from_user (&id, _tid,sizeof (id))) -return -EFAULT ; -guard (mutex)(®ister_mutex); -if (id.dev_class <0 ) {/* first item */ +if (id->dev_class <0 ) {/* first item */ if (list_empty (&snd_timer_list)) -snd_timer_user_zero_id (&id); +snd_timer_user_zero_id (id);else { timer =list_entry (snd_timer_list.next, struct snd_timer, device_list); -snd_timer_user_copy_id (&id, timer); +snd_timer_user_copy_id (id, timer); } }else { -switch (id.dev_class) { +switch (id->dev_class) {case SNDRV_TIMER_CLASS_GLOBAL : - id.device = id.device <0 ?0 : id.device +1 ; + id->device = id->device <0 ?0 : id->device +1 ;list_for_each (p, &snd_timer_list) { timer = list_entry(p, struct snd_timer, device_list);if (timer->tmr_class >SNDRV_TIMER_CLASS_GLOBAL ) { -snd_timer_user_copy_id (&id, timer); +snd_timer_user_copy_id (id, timer);break ; } -if (timer->tmr_device >= id.device) { -snd_timer_user_copy_id (&id, timer); +if (timer->tmr_device >= id->device) { +snd_timer_user_copy_id (id, timer);break ; } }if (p == &snd_timer_list) -snd_timer_user_zero_id (&id); +snd_timer_user_zero_id (id);break ;case SNDRV_TIMER_CLASS_CARD :case SNDRV_TIMER_CLASS_PCM : -if (id.card <0 ) { - id.card =0 ; +if (id->card <0 ) { + id->card =0 ; }else { -if (id.device <0 ) { - id.device =0 ; +if (id->device <0 ) { + id->device =0 ; }else { -if (id.subdevice <0 ) - id.subdevice =0 ; -else if (id.subdevice <INT_MAX ) - id.subdevice++; +if (id->subdevice <0 ) + id->subdevice =0 ; +else if (id->subdevice <INT_MAX ) + id->subdevice++; } }list_for_each (p, &snd_timer_list) { timer = list_entry(p, struct snd_timer, device_list); -if (timer->tmr_class > id.dev_class) { -snd_timer_user_copy_id (&id, timer); +if (timer->tmr_class > id->dev_class) { +snd_timer_user_copy_id (id, timer);break ; } -if (timer->tmr_class < id.dev_class) +if (timer->tmr_class < id->dev_class)continue ; -if (timer->card->number > id.card) { -snd_timer_user_copy_id (&id, timer); +if (timer->card->number > id->card) { +snd_timer_user_copy_id (id, timer);break ; } -if (timer->card->number < id.card) +if (timer->card->number < id->card)continue ; -if (timer->tmr_device > id.device) { -snd_timer_user_copy_id (&id, timer); +if (timer->tmr_device > id->device) { +snd_timer_user_copy_id (id, timer);break ; } -if (timer->tmr_device < id.device) +if (timer->tmr_device < id->device)continue ; -if (timer->tmr_subdevice > id.subdevice) { -snd_timer_user_copy_id (&id, timer); +if (timer->tmr_subdevice > id->subdevice) { +snd_timer_user_copy_id (id, timer);break ; } -if (timer->tmr_subdevice < id.subdevice) +if (timer->tmr_subdevice < id->subdevice)continue ; -snd_timer_user_copy_id (&id, timer); +snd_timer_user_copy_id (id, timer);break ; }if (p == &snd_timer_list) -snd_timer_user_zero_id (&id); +snd_timer_user_zero_id (id);break ;default : -snd_timer_user_zero_id (&id); +snd_timer_user_zero_id (id); } } +} + +static int snd_timer_user_next_device (struct snd_timer_id __user *_tid) +{ +struct snd_timer_id id; + +if (copy_from_user (&id, _tid,sizeof (id))) +return -EFAULT ; + scoped_guard(mutex, ®ister_mutex) +get_next_device (&id);if (copy_to_user (_tid, &id,sizeof (*_tid)))return -EFAULT ;return 0 ;
@@ -1620,23 +1626,24 @@ static int snd_timer_user_ginfo(struct file *file, tid = ginfo->tid;memset (ginfo,0 ,sizeof (*ginfo)); ginfo->tid = tid; -guard (mutex)(®ister_mutex); - t =snd_timer_find (&tid); -if (!t) -return -ENODEV ; - ginfo->card = t->card ? t->card->number :-1 ; -if (t->hw.flags &SNDRV_TIMER_HW_SLAVE ) - ginfo->flags |=SNDRV_TIMER_FLG_SLAVE ; -strscpy (ginfo->id, t->id,sizeof (ginfo->id)); -strscpy (ginfo->name, t->name,sizeof (ginfo->name)); -scoped_guard (spinlock_irq, &t->lock) - ginfo->resolution = snd_timer_hw_resolution(t); -if (t->hw.resolution_min >0 ) { - ginfo->resolution_min = t->hw.resolution_min; - ginfo->resolution_max = t->hw.resolution_max; - } -list_for_each (p, &t->open_list_head) { - ginfo->clients++; + scoped_guard(mutex, ®ister_mutex) { + t =snd_timer_find (&tid); +if (!t) +return -ENODEV ; + ginfo->card = t->card ? t->card->number :-1 ; +if (t->hw.flags &SNDRV_TIMER_HW_SLAVE ) + ginfo->flags |=SNDRV_TIMER_FLG_SLAVE ; +strscpy (ginfo->id, t->id,sizeof (ginfo->id)); +strscpy (ginfo->name, t->name,sizeof (ginfo->name)); +scoped_guard (spinlock_irq, &t->lock) + ginfo->resolution = snd_timer_hw_resolution(t); +if (t->hw.resolution_min >0 ) { + ginfo->resolution_min = t->hw.resolution_min; + ginfo->resolution_max = t->hw.resolution_max; + } +list_for_each (p, &t->open_list_head) { + ginfo->clients++; + } }if (copy_to_user (_ginfo, ginfo,sizeof (*ginfo)))return -EFAULT ;
@@ -1674,31 +1681,31 @@ static int snd_timer_user_gstatus(struct file *file,struct snd_timer_gstatus gstatus;struct snd_timer_id tid;struct snd_timer *t; -int err =0 ;if (copy_from_user (&gstatus, _gstatus,sizeof (gstatus)))return -EFAULT ; tid = gstatus.tid;memset (&gstatus,0 ,sizeof (gstatus)); gstatus.tid = tid; -guard (mutex)(®ister_mutex); - t =snd_timer_find (&tid); -if (t !=NULL ) { -guard (spinlock_irq)(&t->lock); - gstatus.resolution =snd_timer_hw_resolution (t); -if (t->hw.precise_resolution) { - t->hw.precise_resolution (t, &gstatus.resolution_num, - &gstatus.resolution_den); + scoped_guard(mutex, ®ister_mutex) { + t =snd_timer_find (&tid); +if (t !=NULL ) { +guard (spinlock_irq)(&t->lock); + gstatus.resolution =snd_timer_hw_resolution (t); +if (t->hw.precise_resolution) { + t->hw.precise_resolution (t, &gstatus.resolution_num, + &gstatus.resolution_den); + }else { + gstatus.resolution_num = gstatus.resolution; + gstatus.resolution_den =1000000000uL ; + } }else { - gstatus.resolution_num = gstatus.resolution; - gstatus.resolution_den =1000000000uL ; +return -ENODEV ; } - }else { - err = -ENODEV ; } -if (err >=0 &©_to_user (_gstatus, &gstatus,sizeof (gstatus))) - err = -EFAULT ; -return err; +if (copy_to_user (_gstatus, &gstatus,sizeof (gstatus))) +return -EFAULT ; +return 0 ; } static int snd_timer_user_tselect(struct file *file,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 47/423 drm/bridge: ti-sn65dsi86: Fix multiple instances
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 574f5ee2c85a00a579549d50e9fc9c6c072ee4c4 ]
Each bridge instance creates up to four auxiliary devices with different names. However, their IDs are always zero, causing duplicate filename errors when a system has multiple bridges:
sysfs: cannot create duplicate filename '/bus/auxiliary/devices/ti_sn65dsi86.gpio.0'
Fix this by using a unique instance ID per bridge instance. The instance ID is derived from the I2C adapter number and the bridge's I2C address, to support multiple instances on the same bus.
--- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/bridge/ti-sn65dsi86.c +2 -0
@@ -480,6 +480,7 @@ static int ti_sn65dsi86_add_aux_device(struct ti_sn65dsi86 *pdata, const char *name) {struct device *dev = pdata->dev; +const struct i2c_client *client =to_i2c_client (dev);struct auxiliary_device *aux;int ret;
@@ -488,6 +489,7 @@ static int ti_sn65dsi86_add_aux_device(struct ti_sn65dsi86 *pdata,return -ENOMEM ; aux->name = name; + aux->id = (client->adapter->nr <<10 ) | client->addr; aux->dev.parent = dev; aux->dev.release = ti_sn65dsi86_aux_device_release;device_set_of_node_from_dev (&aux->dev, dev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 48/423 drm/ssd130x: Set SPI .id_table to prevent an SPI core warning
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Martinez Canillas <[email protected]>
[ Upstream commit 5d40d4fae6f2fb789f48207a9d4772bbee970b5c ]
The only reason for the ssd130x-spi driver to have an spi_device_id table is that the SPI core always reports an "spi:" MODALIAS, even when the SPI device has been registered via a Device Tree Blob.
Without spi_device_id table information in the module's metadata, module autoloading would not work because there won't be an alias that matches the MODALIAS reported by the SPI core.
This spi_device_id table is not needed for device matching though, since the of_device_id table is always used in this case. For this reason, the struct spi_driver .id_table member is currently not set in the SPI driver.
Because the spi_device_id table is always required for module autoloading, the SPI core checks during driver registration that both an of_device_id table and a spi_device_id table are present and that they contain the same entries for all the SPI devices.
Not setting the .id_table member in the driver then confuses the core and leads to the following warning when the ssd130x-spi driver is registered:
[ 41.091198] SPI driver ssd130x-spi has no spi_device_id for sinowealth,sh1106 [ 41.098614] SPI driver ssd130x-spi has no spi_device_id for solomon,ssd1305 [ 41.105862] SPI driver ssd130x-spi has no spi_device_id for solomon,ssd1306 [ 41.113062] SPI driver ssd130x-spi has no spi_device_id for solomon,ssd1307 [ 41.120247] SPI driver ssd130x-spi has no spi_device_id for solomon,ssd1309 [ 41.127449] SPI driver ssd130x-spi has no spi_device_id for solomon,ssd1322 [ 41.134627] SPI driver ssd130x-spi has no spi_device_id for solomon,ssd1325 [ 41.141784] SPI driver ssd130x-spi has no spi_device_id for solomon,ssd1327 [ 41.149021] SPI driver ssd130x-spi has no spi_device_id for solomon,ssd1331
To prevent the warning, set the .id_table even though it's not necessary.
Since the check is done even for built-in drivers, drop the condition to only define the ID table when the driver is built as a module. Finally, rename the variable to use the "_spi_id" convention used for ID tables.
--- drivers/gpu/drm/solomon/ssd130x-spi.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/gpu/drm/solomon/ssd130x-spi.c +3 -4
@@ -151,7 +151,6 @@ static const struct of_device_id ssd130x_of_match[] = { };MODULE_DEVICE_TABLE (of, ssd130x_of_match); -#if IS_MODULE (CONFIG_DRM_SSD130X_SPI )/* * The SPI core always reports a MODALIAS uevent of the form "spi:<dev>", even * if the device was registered via OF. This means that the module will not be
@@ -160,7 +159,7 @@ MODULE_DEVICE_TABLE(of, ssd130x_of_match);* To workaround this issue, add a SPI device ID table. Even when this should * not be needed for this driver to match the registered SPI devices. */ -static const struct spi_device_id ssd130x_spi_table[] = { +static const struct spi_device_id ssd130x_spi_id[] = {/* ssd130x family */ {"sh1106" ,SH1106_ID }, {"ssd1305" ,SSD1305_ID },
@@ -175,14 +174,14 @@ static const struct spi_device_id ssd130x_spi_table[] = { { "ssd1331", SSD1331_ID }, {/* sentinel */ } }; -MODULE_DEVICE_TABLE (spi, ssd130x_spi_table); -#endif +MODULE_DEVICE_TABLE (spi, ssd130x_spi_id);static struct spi_driver ssd130x_spi_driver = { .driver = { .name =DRIVER_NAME , .of_match_table = ssd130x_of_match, }, + .id_table = ssd130x_spi_id, .probe = ssd130x_spi_probe, .remove = ssd130x_spi_remove, .shutdown = ssd130x_spi_shutdown,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 49/423 drm/ssd130x: fix ssd132x encoding
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <[email protected]>
[ Upstream commit 1e14484677c8e87548f5f0d4eb8800e408004404 ]
The ssd132x buffer is encoded one pixel per nibble, with two pixels in each byte. When encoding an 8-bit greyscale input, take the top 4-bits as the value and ensure the two pixels are distinct and do not overwrite each other.
--- drivers/gpu/drm/solomon/ssd130x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/solomon/ssd130x.c +1 -1
@@ -880,7 +880,7 @@ static int ssd132x_update_rect(struct ssd130x_device *ssd130x,u8 n1 = buf[i * width + j];u8 n2 = buf[i * width + j +1 ]; - data_array[array_idx++] = (n2 <<4 ) | n1; + data_array[array_idx++] = (n2 &0xf0 ) | (n1 >>4 ); } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 50/423 drm/ssd130x: ensure ssd132x pitch is correct
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <[email protected]>
[ Upstream commit 229adcffdb54b13332d2afd2dc5d203418d50908 ]
The bounding rectangle is adjusted to ensure it aligns to SSD132X_SEGMENT_WIDTH, which may adjust the pitch. Calculate the pitch after aligning the left and right edge.
--- drivers/gpu/drm/solomon/ssd130x.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/solomon/ssd130x.c +3 -1
@@ -1037,7 +1037,7 @@ static int ssd132x_fb_blit_rect(struct drm_framebuffer *fb, struct drm_format_conv_state *fmtcnv_state) {struct ssd130x_device *ssd130x =drm_to_ssd130x (fb->dev); -unsigned int dst_pitch =drm_rect_width (rect); +unsigned int dst_pitch;struct iosys_map dst;int ret =0 ;
@@ -1046,6 +1046,8 @@ static int ssd132x_fb_blit_rect(struct drm_framebuffer *fb, rect->x2 = min_t(unsigned int, round_up(rect->x2, SSD132X_SEGMENT_WIDTH), ssd130x->width); + dst_pitch =drm_rect_width (rect); + ret =drm_gem_fb_begin_cpu_access (fb,DMA_FROM_DEVICE );if (ret)return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 51/423 drm/dp_mst: Fix drm RAD print
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Lin <[email protected]>
[ Upstream commit 6bbce873a9c97cb12f5455c497be279ac58e707f ]
[Why]
The RAD of sideband message printed today is incorrect.
For RAD stored within MST branch
- If MST branch LCT is 1, it's RAD array is untouched and remained as 0.
- If MST branch LCT is larger than 1, use nibble to store the up facing port number in cascaded sequence as illustrated below:
u8 RAD[0] = (LCT_2_UFP << 4) | LCT_3_UFP
RAD[1] = (LCT_4_UFP << 4) | LCT_5_UFP
...In drm_dp_mst_rad_to_str(), it wrongly to use BIT_MASK(4) to fetch the port number of one nibble.
[How]
Adjust the code by:
- RAD array items are valuable only for LCT >= 1.
- Use 0xF as the mask to replace BIT_MASK(4)
V2:
- Document how RAD is constructed (Imre)
V3:
- Adjust the comment for rad[] so kdoc formats it properly (Lyude)
--- drivers/gpu/drm/display/drm_dp_mst_topology.c | 8 ++++---- include/drm/display/drm_dp_mst_helper.h | 7 +++++++ 2 files changed, 11 insertions(+), 4 deletions(-)
drivers/gpu/drm/display/drm_dp_mst_topology.c +4 -4
@@ -179,13 +179,13 @@ static int drm_dp_mst_rad_to_str(const u8 rad[8], u8 lct, char *out, size_t len) { int i; -u8 unpacked_rad[16 ]; +u8 unpacked_rad[16 ] = {}; -for (i =0 ; i < lct; i++) { +for (i =1 ; i < lct; i++) {if (i %2 ) - unpacked_rad[i] = rad[i /2 ] >>4 ; + unpacked_rad[i] = rad[(i -1 ) /2 ] >>4 ;else - unpacked_rad[i] = rad[i /2 ] &BIT_MASK (4 ); + unpacked_rad[i] = rad[(i -1 ) /2 ] &0xF ; }/* TODO: Eventually add something to printk so we can format the rad
include/drm/display/drm_dp_mst_helper.h +7 -0
@@ -222,6 +222,13 @@ struct drm_dp_mst_branch {*/ struct list_head destroy_next; +/** +* @rad: Relative Address of the MST branch. +* For &drm_dp_mst_topology_mgr.mst_primary, it's rad[8] are all 0, +* unset and unused. For MST branches connected after mst_primary, +* in each element of rad[] the nibbles are ordered by the most +* signifcant 4 bits first and the least significant 4 bits second. +*/ u8 rad[8 ];u8 lct;int num_ports;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 52/423 drm/bridge: it6505: fix HDCP V match check is not performed correctly
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hermes Wu <[email protected]>
[ Upstream commit a5072fc77fb9e38fa9fd883642c83c3720049159 ]
Fix a typo where V compare incorrectly compares av[] with av[] itself, which can result in HDCP failure.
The loop of V compare is expected to iterate for 5 times which compare V array form av[0][] to av[4][].
It should check loop counter reach the last statement "i == 5" before return true
--- drivers/gpu/drm/bridge/ite-it6505.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/gpu/drm/bridge/ite-it6505.c +4 -3
@@ -2042,12 +2042,13 @@ static bool it6505_hdcp_part2_ksvlist_check(struct it6505 *it6505)continue ; } -for (i =0 ; i <5 ; i++) { +for (i =0 ; i <5 ; i++)if (bv[i][3 ] != av[i][0 ] || bv[i][2 ] != av[i][1 ] || - av[i][1 ] != av[i][2 ] || bv[i][0 ] != av[i][3 ]) + bv[i][1 ] != av[i][2 ] || bv[i][0 ] != av[i][3 ])break ; -DRM_DEV_DEBUG_DRIVER (dev,"V' all match!! %d, %d" , retry, i); +if (i ==5 ) { +DRM_DEV_DEBUG_DRIVER (dev,"V' all match!! %d" , retry);return true; } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 53/423 drm: xlnx: zynqmp: Fix max dma segment size
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 28b529a98525123acd37372a04d21e87ec2edcf7 ]
Fix "mapping sg segment longer than device claims to support" warning by setting the max segment size.
--- drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/xlnx/zynqmp_dpsub.c +2 -0
@@ -231,6 +231,8 @@ static int zynqmp_dpsub_probe(struct platform_device *pdev)if (ret)return ret; +dma_set_max_seg_size (&pdev->dev,DMA_BIT_MASK (32 )); +/* Try the reserved memory. Proceed if there's none. */ of_reserved_mem_device_init (&pdev->dev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 54/423 drm/vkms: Fix use after free and double free on init error
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: José Expósito <[email protected]>
[ Upstream commit ed15511a773df86205bda66c37193569575ae828 ]
If the driver initialization fails, the vkms_exit() function might access an uninitialized or freed default_config pointer and it might double free it.
Fix both possible errors by initializing default_config only when the driver initialization succeeded.
--- drivers/gpu/drm/vkms/vkms_drv.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/gpu/drm/vkms/vkms_drv.c +9 -6
@@ -245,17 +245,19 @@ static int __init vkms_init(void)if (!config)return -ENOMEM ; - default_config = config; - config->cursor = enable_cursor; config->writeback = enable_writeback; config->overlay = enable_overlay; ret =vkms_create (config); -if (ret) +if (ret) {kfree (config); +return ret; + } -return ret; + default_config = config; + +return 0 ; }static void vkms_destroy (struct vkms_config *config)
@@ -279,9 +281,10 @@ static void vkms_destroy(struct vkms_config *config) static void __exit vkms_exit(void) { -if (default_config->dev) -vkms_destroy (default_config); +if (!default_config) +return ; +vkms_destroy (default_config);kfree (default_config); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 55/423 gpu: cdns-mhdp8546: fix call balance of mhdp->clk handling routines
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitalii Mordan <[email protected]>
[ Upstream commit f65727be3fa5f252c8d982d15023aab8255ded19 ]
If the clock mhdp->clk was not enabled in cdns_mhdp_probe(), it should not be disabled in any path.
The return value of clk_prepare_enable() is not checked. If mhdp->clk was not enabled, it may be disabled in the error path of cdns_mhdp_probe() (e.g., if cdns_mhdp_load_firmware() fails) or in cdns_mhdp_remove() after a successful cdns_mhdp_probe() call.
Use the devm_clk_get_enabled() helper function to ensure proper call balance for mhdp->clk.
Found by Linux Verification Center (linuxtesting.org) with Klever.
--- drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-)
drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +3 -9
@@ -2463,9 +2463,9 @@ static int cdns_mhdp_probe(struct platform_device *pdev)if (!mhdp)return -ENOMEM ; - clk =devm_clk_get (dev,NULL ); + clk =devm_clk_get_enabled (dev,NULL );if (IS_ERR (clk)) { -dev_err (dev,"couldn't get clk: %ld\n" ,PTR_ERR (clk)); +dev_err (dev,"couldn't get and enable clk: %ld\n" ,PTR_ERR (clk));return PTR_ERR (clk); }
@@ -2504,14 +2504,12 @@ static int cdns_mhdp_probe(struct platform_device *pdev) mhdp->info =of_device_get_match_data (dev); -clk_prepare_enable (clk); -pm_runtime_enable (dev); ret =pm_runtime_resume_and_get (dev);if (ret <0 ) {dev_err (dev,"pm_runtime_resume_and_get failed\n" );pm_runtime_disable (dev); - goto clk_disable; +return ret; }if (mhdp->info && mhdp->info->ops && mhdp->info->ops->init) {
@@ -2590,8 +2588,6 @@ static int cdns_mhdp_probe(struct platform_device *pdev) runtime_put:pm_runtime_put_sync (dev);pm_runtime_disable (dev); -clk_disable: -clk_disable_unprepare (mhdp->clk);return ret; }
@@ -2632,8 +2628,6 @@ static void cdns_mhdp_remove(struct platform_device *pdev)cancel_work_sync (&mhdp->modeset_retry_work);flush_work (&mhdp->hpd_work);/* Ignoring mhdp->hdcp.check_work and mhdp->hdcp.prop_work here. */ - -clk_disable_unprepare (mhdp->clk); }static const struct of_device_id mhdp_ids[] = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 56/423 drm/amdgpu: refine smu send msg debug log format
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
[ Upstream commit 8c6631234557515a7567c6251505a98e9793c8a6 ]
remove unnecessary line breaks.
[ 51.280860] amdgpu 0000:24:00.0: amdgpu: smu send message: GetEnabledSmuFeaturesHigh(13) param: 0x00000000, resp: 0x00000001, readval: 0x00003763
--- drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c +1 -2
@@ -459,8 +459,7 @@ int smu_cmn_send_smc_msg_with_param(struct smu_context *smu, }if (read_arg) {smu_cmn_read_arg (smu, read_arg); -dev_dbg (adev->dev,"smu send message: %s(%d) param: 0x%08x, resp: 0x%08x,\ -readval: 0x%08x\n" , +dev_dbg (adev->dev,"smu send message: %s(%d) param: 0x%08x, resp: 0x%08x, readval: 0x%08x\n" ,smu_get_message_name (smu, msg), index, param, reg, *read_arg); }else { dev_dbg(adev->dev, "smu send message: %s(%d) param: 0x%08x, resp: 0x%08x\n",
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 57/423 drm/amdgpu/umsch: fix ucode check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit c917e39cbdcd9fff421184db6cc461cc58d52c17 ]
Return an error if the IP version doesn't match otherwise we end up passing a NULL string to amdgpu_ucode_request. We should never hit this in practice today since we only enable the umsch code on the supported IP versions, but add a check to be safe.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_umsch_mm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_umsch_mm.c +1 -1
@@ -584,7 +584,7 @@ int amdgpu_umsch_mm_init_microcode(struct amdgpu_umsch_mm *umsch) fw_name ="amdgpu/umsch_mm_4_0_0.bin" ;break ;default : -break ; +return -EINVAL ; } r =amdgpu_ucode_request (adev, &adev->umsch_mm.fw,"%s" , fw_name);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 58/423 PCI: Use downstream bridges for distributing resources
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <[email protected]>
[ Upstream commit 1a596ad00ffe9b37fc60a93cbdd4daead3bf95f3 ]
7180c1d08639 ("PCI: Distribute available resources for root buses, too") breaks BAR assignment on some devices:
pci 0006:03:00.0: BAR 0 [mem 0x6300c0000000-0x6300c1ffffff 64bit pref]: assigned pci 0006:03:00.1: BAR 0 [mem 0x6300c2000000-0x6300c3ffffff 64bit pref]: assigned pci 0006:03:00.2: BAR 0 [mem size 0x00800000 64bit pref]: can't assign; no space pci 0006:03:00.0: VF BAR 0 [mem size 0x02000000 64bit pref]: can't assign; no space pci 0006:03:00.1: VF BAR 0 [mem size 0x02000000 64bit pref]: can't assign; no space
The apertures of domain 0006 before 7180c1d08639:
6300c0000000-63ffffffffff : PCI Bus 0006:00
6300c0000000-6300c9ffffff : PCI Bus 0006:01
6300c0000000-6300c9ffffff : PCI Bus 0006:02 # 160MB
6300c0000000-6300c8ffffff : PCI Bus 0006:03 # 144MB
6300c0000000-6300c1ffffff : 0006:03:00.0 # 32MB
6300c2000000-6300c3ffffff : 0006:03:00.1 # 32MB
6300c4000000-6300c47fffff : 0006:03:00.2 # 8MB
6300c4800000-6300c67fffff : 0006:03:00.0 # 32MB
6300c6800000-6300c87fffff : 0006:03:00.1 # 32MB
6300c9000000-6300c9bfffff : PCI Bus 0006:04 # 12MB
6300c9000000-6300c9bfffff : PCI Bus 0006:05 # 12MB
6300c9000000-6300c91fffff : PCI Bus 0006:06 # 2MB
6300c9200000-6300c93fffff : PCI Bus 0006:07 # 2MB
6300c9400000-6300c95fffff : PCI Bus 0006:08 # 2MB
6300c9600000-6300c97fffff : PCI Bus 0006:09 # 2MBAfter 7180c1d08639:
6300c0000000-63ffffffffff : PCI Bus 0006:00
6300c0000000-6300c9ffffff : PCI Bus 0006:01
6300c0000000-6300c9ffffff : PCI Bus 0006:02 # 160MB
6300c0000000-6300c43fffff : PCI Bus 0006:03 # 68MB
6300c0000000-6300c1ffffff : 0006:03:00.0 # 32MB
6300c2000000-6300c3ffffff : 0006:03:00.1 # 32MB
--- no space --- : 0006:03:00.2 # 8MB
--- no space --- : 0006:03:00.0 # 32MB
--- no space --- : 0006:03:00.1 # 32MB
6300c4400000-6300c4dfffff : PCI Bus 0006:04 # 10MB
6300c4400000-6300c4dfffff : PCI Bus 0006:05 # 10MB
6300c4400000-6300c45fffff : PCI Bus 0006:06 # 2MB
6300c4600000-6300c47fffff : PCI Bus 0006:07 # 2MB
6300c4800000-6300c49fffff : PCI Bus 0006:08 # 2MB
6300c4a00000-6300c4bfffff : PCI Bus 0006:09 # 2MBWe can see that the window to 0006:03 gets shrunken too much and 0006:04 eats away the window for 0006:03:00.2.
The offending commit distributes the upstream bridge's resources multiple times to every downstream bridge, hence makes the aperture smaller than desired because calculation of io_per_b, mmio_per_b and mmio_pref_per_b becomes incorrect.
Instead, distribute downstream bridges' own resources to resolve the issue.
--- drivers/pci/setup-bus.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/pci/setup-bus.c +1 -2
@@ -2105,8 +2105,7 @@ pci_root_bus_distribute_available_resources(struct pci_bus *bus,* in case of root bus. */ if (bridge &&pci_bridge_resources_not_assigned (dev)) -pci_bridge_distribute_available_resources (bridge, - add_list); +pci_bridge_distribute_available_resources (dev, add_list);else pci_root_bus_distribute_available_resources (b, add_list); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 59/423 PCI: Remove add_align overwrite unrelated to size0
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit d06cc1e3809040e8250f69a4c656e3717e6b963c ]
Commit 566f1dd52816 ("PCI: Relax bridge window tail sizing rules") relaxed bridge window tail alignment rule for the non-optional part (size0, no add_size/add_align). The change, however, also overwrote add_align, which is only related to case where optional size1 related entry is added into realloc head.
Correct this by removing the add_align overwrite.
--- drivers/pci/setup-bus.c | 1 - 1 file changed, 1 deletion(-)
drivers/pci/setup-bus.c +0 -1
@@ -1150,7 +1150,6 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask, min_align =1ULL << (max_order +__ffs (SZ_1M )); min_align =max (min_align, win_align); size0 =calculate_memsize (size, min_size,0 ,0 ,resource_size (b_res), win_align); - add_align = win_align;pci_info (bus->self,"bridge window %pR to %pR requires relaxed alignment rules\n" , b_res, &bus->busn_res); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 60/423 drm/mediatek: mtk_hdmi: Unregister audio platform device on failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 0be123cafc06eed0fd1227166a66e786434b0c50 ]
The probe function of this driver may fail after registering the audio platform device: in that case, the state is not getting cleaned up, leaving this device registered.
Adding up to the mix, should the probe function of this driver return a probe deferral for N times, we're registering up to N audio platform devices and, again, never freeing them up.
To fix this, add a pointer to the audio platform device in the mtk_hdmi structure, and add a devm action to unregister it upon driver removal or probe failure.
--- drivers/gpu/drm/mediatek/mtk_hdmi.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-)
drivers/gpu/drm/mediatek/mtk_hdmi.c +19 -6
@@ -173,6 +173,7 @@ struct mtk_hdmi {unsigned int sys_offset;void __iomem *regs;enum hdmi_colorspace csp; +struct platform_device *audio_pdev;struct hdmi_audio_param aud_param;bool audio_enable;bool powered;
@@ -1663,6 +1664,11 @@ static const struct hdmi_codec_ops mtk_hdmi_audio_codec_ops = { .no_capture_mute = 1, }; +static void mtk_hdmi_unregister_audio_driver (void *data) +{ +platform_device_unregister (data); +} +static int mtk_hdmi_register_audio_driver (struct device *dev) {struct mtk_hdmi *hdmi =dev_get_drvdata (dev);
@@ -1672,13 +1678,20 @@ static int mtk_hdmi_register_audio_driver(struct device *dev) .i2s = 1, .data = hdmi, }; -struct platform_device *pdev; +int ret; - pdev =platform_device_register_data (dev,HDMI_CODEC_DRV_NAME , -PLATFORM_DEVID_AUTO , &codec_data, -sizeof (codec_data)); -if (IS_ERR (pdev)) -return PTR_ERR (pdev); + hdmi->audio_pdev =platform_device_register_data (dev, +HDMI_CODEC_DRV_NAME , +PLATFORM_DEVID_AUTO , + &codec_data, +sizeof (codec_data)); +if (IS_ERR (hdmi->audio_pdev)) +return PTR_ERR (hdmi->audio_pdev); + + ret =devm_add_action_or_reset (dev, mtk_hdmi_unregister_audio_driver, + hdmi->audio_pdev); +if (ret) +return ret;DRM_INFO ("%s driver bound to HDMI\n" ,HDMI_CODEC_DRV_NAME );return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 61/423 drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 72fcb88e7bbc053ed4fc74cebb0315b98a0f20c3 ]
Rename member aud_sampe_size of struct hdmi_audio_param to aud_sample_size to fix a typo and enhance readability.
This commit brings no functional changes.
--- drivers/gpu/drm/mediatek/mtk_hdmi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/mediatek/mtk_hdmi.c +4 -4
@@ -137,7 +137,7 @@ enum hdmi_aud_channel_swap_type {struct hdmi_audio_param {enum hdmi_audio_coding_type aud_codec; -enum hdmi_audio_sample_size aud_sampe_size; +enum hdmi_audio_sample_size aud_sample_size;enum hdmi_aud_input_type aud_input_type;enum hdmi_aud_i2s_fmt aud_i2s_fmt;enum hdmi_aud_mclk aud_mclk;
@@ -1075,7 +1075,7 @@ static int mtk_hdmi_output_init(struct mtk_hdmi *hdmi) hdmi->csp =HDMI_COLORSPACE_RGB ; aud_param->aud_codec =HDMI_AUDIO_CODING_TYPE_PCM ; - aud_param->aud_sampe_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; + aud_param->aud_sample_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; aud_param->aud_input_type =HDMI_AUD_INPUT_I2S ; aud_param->aud_i2s_fmt =HDMI_I2S_MODE_I2S_24BIT ; aud_param->aud_mclk =HDMI_AUD_MCLK_128FS ;
@@ -1573,14 +1573,14 @@ static int mtk_hdmi_audio_hw_params(struct device *dev, void *data,switch (daifmt->fmt) {case HDMI_I2S : hdmi_params.aud_codec =HDMI_AUDIO_CODING_TYPE_PCM ; - hdmi_params.aud_sampe_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; + hdmi_params.aud_sample_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; hdmi_params.aud_input_type =HDMI_AUD_INPUT_I2S ; hdmi_params.aud_i2s_fmt =HDMI_I2S_MODE_I2S_24BIT ; hdmi_params.aud_mclk =HDMI_AUD_MCLK_128FS ;break ;case HDMI_SPDIF : hdmi_params.aud_codec =HDMI_AUDIO_CODING_TYPE_PCM ; - hdmi_params.aud_sampe_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; + hdmi_params.aud_sample_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; hdmi_params.aud_input_type =HDMI_AUD_INPUT_SPDIF ;break ;default :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 62/423 PCI/ASPM: Fix link state exit during switch upstream function removal
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Stodden <[email protected]>
[ Upstream commit cbf937dcadfd571a434f8074d057b32cd14fbea5 ]
Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free"), we would free the ASPM link only after the last function on the bus pertaining to the given link was removed.
That was too late. If function 0 is removed before sibling function, link->downstream would point to free'd memory after.
After above change, we freed the ASPM parent link state upon any function removal on the bus pertaining to a given link.
That is too early. If the link is to a PCIe switch with MFD on the upstream port, then removing functions other than 0 first would free a link which still remains parent_link to the remaining downstream ports.
The resulting GPFs are especially frequent during hot-unplug, because pciehp removes devices on the link bus in reverse order.
On that switch, function 0 is the virtual P2P bridge to the internal bus. Free exactly when function 0 is removed -- before the parent link is obsolete, but after all subordinate links are gone.
--- drivers/pci/pcie/aspm.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/pci/pcie/aspm.c +9 -8
@@ -1242,16 +1242,16 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) parent_link = link->parent;/* -* link->downstream is a pointer to the pci_dev of function 0. If -* we remove that function, the pci_dev is about to be deallocated, -* so we can't use link->downstream again. Free the link state to -* avoid this. +* Free the parent link state, no later than function 0 (i.e. +* link->downstream) being removed. * -* If we're removing a non-0 function, it's possible we could -* retain the link state, but PCIe r6.0, sec 7.5.3.7, recommends -* programming the same ASPM Control value for all functions of -* multi-function devices, so disable ASPM for all of them. +* Do not free the link state any earlier. If function 0 is a +* switch upstream port, this link state is parent_link to all +* subordinate ones. */ +if (pdev != link->downstream) + goto out; +pcie_config_aspm_link (link,0 );list_del (&link->sibling);free_link_state (link);
@@ -1262,6 +1262,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev)pcie_config_aspm_path (parent_link); } + out:mutex_unlock (&aspm_lock);up_read (&pci_bus_sem); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 63/423 drm/panel: ilitek-ili9882t: fix GPIO name in error message
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <[email protected]>
[ Upstream commit 4ce2c7e201c265df1c62a9190a98a98803208b8f ]
This driver uses the enable-gpios property and it is confusing that the error message refers to reset-gpios. Use the correct name when the enable GPIO is not found.
--- drivers/gpu/drm/panel/panel-ilitek-ili9882t.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/panel/panel-ilitek-ili9882t.c +1 -1
@@ -607,7 +607,7 @@ static int ili9882t_add(struct ili9882t *ili) ili->enable_gpio =devm_gpiod_get (dev,"enable" ,GPIOD_OUT_LOW );if (IS_ERR (ili->enable_gpio)) { -dev_err (dev,"cannot get reset-gpios %ld\n" , +dev_err (dev,"cannot get enable-gpios %ld\n" ,PTR_ERR (ili->enable_gpio));return PTR_ERR (ili->enable_gpio); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 64/423 PCI/ACS: Fix pci=config_acs= parameter
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tushar Dave <[email protected]>
[ Upstream commit 9cf8a952d57b422d3ff8a9a0163f8adf694f4b2b ]
Commit 47c8846a49ba ("PCI: Extend ACS configurability") introduced bugs that fail to configure ACS ctrl to the value specified by the kernel parameter. Essentially there are two bugs:
1) When ACS is configured for multiple PCI devices using 'config_acs' kernel parameter, it results into error "PCI: Can't parse ACS command line parameter". This is due to a bug that doesn't preserve the ACS mask, but instead overwrites the mask with value 0.
For example, using 'config_acs' to configure ACS ctrl for multiple BDFs fails:
Kernel command line: pci=config_acs=1111011@0020:02:00.0;101xxxx@0039:00:00.0 "dyndbg=file drivers/pci/pci.c +p"
PCI: Can't parse ACS command line parameter
pci 0020:02:00.0: ACS mask = 0x007f
pci 0020:02:00.0: ACS flags = 0x007b
pci 0020:02:00.0: Configured ACS to 0x007bAfter this fix:
Kernel command line: pci=config_acs=1111011@0020:02:00.0;101xxxx@0039:00:00.0 "dyndbg=file drivers/pci/pci.c +p"
pci 0020:02:00.0: ACS mask = 0x007f
pci 0020:02:00.0: ACS flags = 0x007b
pci 0020:02:00.0: ACS control = 0x005f
pci 0020:02:00.0: ACS fw_ctrl = 0x0053
pci 0020:02:00.0: Configured ACS to 0x007b
pci 0039:00:00.0: ACS mask = 0x0070
pci 0039:00:00.0: ACS flags = 0x0050
pci 0039:00:00.0: ACS control = 0x001d
pci 0039:00:00.0: ACS fw_ctrl = 0x0000
pci 0039:00:00.0: Configured ACS to 0x00502) In the bit manipulation logic, we copy the bit from the firmware settings when mask bit 0.
For example, 'disable_acs_redir' fails to clear all three ACS P2P redir bits due to the wrong bit fiddling:
Kernel command line: pci=disable_acs_redir=0020:02:00.0;0030:02:00.0;0039:00:00.0 "dyndbg=file drivers/pci/pci.c +p"
pci 0020:02:00.0: ACS mask = 0x002c
pci 0020:02:00.0: ACS flags = 0xffd3
pci 0020:02:00.0: Configured ACS to 0xfffb
pci 0030:02:00.0: ACS mask = 0x002c
pci 0030:02:00.0: ACS flags = 0xffd3
pci 0030:02:00.0: Configured ACS to 0xffdf
pci 0039:00:00.0: ACS mask = 0x002c
pci 0039:00:00.0: ACS flags = 0xffd3
pci 0039:00:00.0: Configured ACS to 0xffd3After this fix:
Kernel command line: pci=disable_acs_redir=0020:02:00.0;0030:02:00.0;0039:00:00.0 "dyndbg=file drivers/pci/pci.c +p"
pci 0020:02:00.0: ACS mask = 0x002c
pci 0020:02:00.0: ACS flags = 0xffd3
pci 0020:02:00.0: ACS control = 0x007f
pci 0020:02:00.0: ACS fw_ctrl = 0x007b
pci 0020:02:00.0: Configured ACS to 0x0053
pci 0030:02:00.0: ACS mask = 0x002c
pci 0030:02:00.0: ACS flags = 0xffd3
pci 0030:02:00.0: ACS control = 0x005f
pci 0030:02:00.0: ACS fw_ctrl = 0x005f
pci 0030:02:00.0: Configured ACS to 0x0053
pci 0039:00:00.0: ACS mask = 0x002c
pci 0039:00:00.0: ACS flags = 0xffd3
pci 0039:00:00.0: ACS control = 0x001d
pci 0039:00:00.0: ACS fw_ctrl = 0x0000
pci 0039:00:00.0: Configured ACS to 0x0000--- drivers/pci/pci.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
drivers/pci/pci.c +13 -5
@@ -955,8 +955,10 @@ struct pci_acs { };static void __pci_config_acs (struct pci_dev *dev,struct pci_acs *caps, -const char *p,u16 mask,u16 flags) +const char *p,const u16 acs_mask,const u16 acs_flags) { +u16 flags = acs_flags; +u16 mask = acs_mask;char *delimit;int ret =0 ;
@@ -964,7 +966,7 @@ static void __pci_config_acs(struct pci_dev *dev, struct pci_acs *caps,return ;while (*p) { -if (!mask) { +if (!acs_mask) {/* Check for ACS flags */ delimit =strstr (p,"@" );if (delimit) {
@@ -972,6 +974,8 @@ static void __pci_config_acs(struct pci_dev *dev, struct pci_acs *caps,u32 shift =0 ; end = delimit - p -1 ; + mask =0 ; + flags =0 ;while (end >-1 ) {if (*(p + end) =='0' ) {
@@ -1028,10 +1032,14 @@ static void __pci_config_acs(struct pci_dev *dev, struct pci_acs *caps,pci_dbg (dev,"ACS mask = %#06x\n" , mask);pci_dbg (dev,"ACS flags = %#06x\n" , flags); +pci_dbg (dev,"ACS control = %#06x\n" , caps->ctrl); +pci_dbg (dev,"ACS fw_ctrl = %#06x\n" , caps->fw_ctrl); -/* If mask is 0 then we copy the bit from the firmware setting. */ - caps->ctrl = (caps->ctrl & ~mask) | (caps->fw_ctrl & mask); - caps->ctrl |= flags; +/* +* For mask bits that are 0, copy them from the firmware setting +* and apply flags for all the mask bits that are 1. +*/ + caps->ctrl = (caps->fw_ctrl & ~mask) | (flags & mask);pci_info (dev,"Configured ACS to %#06x\n" , caps->ctrl); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/423 drm/amd/display: fix an indent issue in DML21
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aurabindo Pillai <[email protected]>
[ Upstream commit a1addcf8499a566496847f1e36e1cf0b4ad72a26 ]
Remove extraneous tab and newline in dml2_core_dcn4.c that was reported by the bot
--- .../amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4.c +1 -2
@@ -139,9 +139,8 @@ bool core_dcn4_initialize(struct dml2_core_initialize_in_out *in_out) core->clean_me_up.mode_lib.ip.subvp_fw_processing_delay_us = core_dcn4_ip_caps_base.subvp_pstate_allow_width_us; core->clean_me_up.mode_lib.ip.subvp_swath_height_margin_lines = core_dcn4_ip_caps_base.subvp_swath_height_margin_lines; }else { -memcpy (&core->clean_me_up.mode_lib.ip, &core_dcn4_ip_caps_base,sizeof (struct dml2_core_ip_params )); +memcpy (&core->clean_me_up.mode_lib.ip, &core_dcn4_ip_caps_base,sizeof (struct dml2_core_ip_params ));patch_ip_params_with_ip_caps (&core->clean_me_up.mode_lib.ip, in_out->ip_caps); - core->clean_me_up.mode_lib.ip.imall_supported = false; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/423 drm/msm/dpu: dont use active in atomic_check()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 25b4614843bcc56ba150f7c99905125a019e656c ]
The driver isn't supposed to consult crtc_state->active/active_check for resource allocation. Instead all resources should be allocated if crtc_state->enabled is set. Stop consulting active / active_changed in order to determine whether the hardware resources should be (re)allocated.
Patchwork: https://patchwork.freedesktop.org/patch/633393/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 4 ---- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 3 +-- 2 files changed, 1 insertion(+), 6 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +0 -4
@@ -1191,10 +1191,6 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc,DRM_DEBUG_ATOMIC ("%s: check\n" , dpu_crtc->name); -/* force a full mode set if active state changed */ -if (crtc_state->active_changed) - crtc_state->mode_changed = true; -if (cstate->num_mixers) { rc =_dpu_crtc_check_and_setup_lm_bounds (crtc, crtc_state);if (rc)
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +1 -2
@@ -718,12 +718,11 @@ static int dpu_encoder_virt_atomic_check( crtc_state->mode_changed = true;/* * Release and Allocate resources on every modeset -* Dont allocate when active is false. */ if (drm_atomic_crtc_needs_modeset (crtc_state)) {dpu_rm_release (global_state, drm_enc); -if (!crtc_state->active_changed || crtc_state->enable) +if (crtc_state->enable) ret =dpu_rm_reserve (&dpu_kms->rm, global_state, drm_enc, crtc_state, topology);if (!ret)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/423 drm/msm/dsi/phy: Program clock inverters in correct register
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit baf49072877726616c7f5943a6b45eb86bfeca0a ]
Since SM8250 all downstream sources program clock inverters in PLL_CLOCK_INVERTERS_1 register and leave the PLL_CLOCK_INVERTERS as reset value (0x0). The most recent Hardware Programming Guide for 3 nm, 4 nm, 5 nm and 7 nm PHYs also mention PLL_CLOCK_INVERTERS_1.
Patchwork: https://patchwork.freedesktop.org/patch/634489/
--- drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c +1 -1
@@ -305,7 +305,7 @@ static void dsi_pll_commit(struct dsi_pll_7nm *pll, struct dsi_pll_config *confiwritel (pll->phy->cphy_mode ?0x00 :0x10 , base + REG_DSI_7nm_PHY_PLL_CMODE_1);writel (config->pll_clock_inverters, - base + REG_DSI_7nm_PHY_PLL_CLOCK_INVERTERS); + base + REG_DSI_7nm_PHY_PLL_CLOCK_INVERTERS_1); } static int dsi_pll_7nm_vco_set_rate(struct clk_hw *hw, unsigned long rate,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/423 drm/msm/dsi: Use existing per-interface slice count in DSC timing
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marijn Suijten <[email protected]>
[ Upstream commit 14ad809ceb66d0874cbe4bd5ca9edf0de8d9ad96 ]
When configuring the timing of DSI hosts (interfaces) in dsi_timing_setup() all values written to registers are taking bonded-mode into account by dividing the original mode width by 2 (half the data is sent over each of the two DSI hosts), but the full width instead of the interface width is passed as hdisplay parameter to dsi_update_dsc_timing().
Currently only msm_dsc_get_slices_per_intf() is called within dsi_update_dsc_timing() with the hdisplay argument which clearly documents that it wants the width of a single interface (which, again, in bonded DSI mode is half the total width of the mode) resulting in all subsequent values to be completely off.
However, as soon as we start to pass the halved hdisplay into dsi_update_dsc_timing() we might as well discard msm_dsc_get_slices_per_intf() since the value it calculates is already available in dsc->slice_count which is per-interface by the current design of MSM DPU/DSI implementations and their use of the DRM DSC helpers.
Patchwork: https://patchwork.freedesktop.org/patch/637648/
--- drivers/gpu/drm/msm/dsi/dsi_host.c | 8 ++++---- drivers/gpu/drm/msm/msm_dsc_helper.h | 11 ----------- 2 files changed, 4 insertions(+), 15 deletions(-)
drivers/gpu/drm/msm/dsi/dsi_host.c +4 -4
@@ -846,7 +846,7 @@ static void dsi_ctrl_enable(struct msm_dsi_host *msm_host,dsi_write (msm_host,REG_DSI_CPHY_MODE_CTRL ,BIT (0 )); } -static void dsi_update_dsc_timing (struct msm_dsi_host *msm_host,bool is_cmd_mode,u32 hdisplay) +static void dsi_update_dsc_timing (struct msm_dsi_host *msm_host,bool is_cmd_mode) {struct drm_dsc_config *dsc = msm_host->dsc;u32 reg, reg_ctrl, reg_ctrl2;
@@ -858,7 +858,7 @@ static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mod/* first calculate dsc parameters and then program * compress mode registers */ - slice_per_intf =msm_dsc_get_slices_per_intf (dsc, hdisplay); + slice_per_intf = dsc->slice_count; total_bytes_per_intf = dsc->slice_chunk_size * slice_per_intf; bytes_per_pkt = dsc->slice_chunk_size;/* * slice_per_pkt; */
@@ -991,7 +991,7 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi)if (msm_host->mode_flags &MIPI_DSI_MODE_VIDEO ) {if (msm_host->dsc) -dsi_update_dsc_timing (msm_host, false, mode->hdisplay); +dsi_update_dsc_timing (msm_host, false); dsi_write(msm_host, REG_DSI_ACTIVE_H, DSI_ACTIVE_H_START(ha_start) |
@@ -1012,7 +1012,7 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi) DSI_ACTIVE_VSYNC_VPOS_END(vs_end)); }else {/* command mode */ if (msm_host->dsc) -dsi_update_dsc_timing (msm_host, true, mode->hdisplay); +dsi_update_dsc_timing (msm_host, true);/* image data and 1 byte write_memory_start cmd */ if (!msm_host->dsc)
drivers/gpu/drm/msm/msm_dsc_helper.h +0 -11
@@ -12,17 +12,6 @@#include <linux/math.h> #include <drm/display/drm_dsc_helper.h> -/** -* msm_dsc_get_slices_per_intf() - calculate number of slices per interface -* @dsc: Pointer to drm dsc config struct -* @intf_width: interface width in pixels -* Returns: Integer representing the number of slices for the given interface -*/ -static inline u32 msm_dsc_get_slices_per_intf (const struct drm_dsc_config *dsc,u32 intf_width) -{ -return DIV_ROUND_UP (intf_width, dsc->slice_width); -} -/** * msm_dsc_get_bytes_per_line() - calculate bytes per line * @dsc: Pointer to drm dsc config struct
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/423 drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marijn Suijten <[email protected]>
[ Upstream commit 660c396c98c061f9696bebacc178b74072e80054 ]
Ordering issues here cause an uninitialized (default STANDALONE) usecase to be programmed (which appears to be a MUX) in some cases when msm_dsi_host_register() is called, leading to the slave PLL in bonded-DSI mode to source from a clock parent (dsi1vco) that is off.
This should seemingly not be a problem as the actual dispcc clocks from DSI1 that are muxed in the clock tree of DSI0 are way further down, this bit still seems to have an effect on them somehow and causes the right side of the panel controlled by DSI1 to not function.
In an ideal world this code is refactored to no longer have such error-prone calls "across subsystems", and instead model the "PLL src" register field as a regular mux so that changing the clock parents programmatically or in DTS via assigned-clock-parents has the desired effect.
But for the avid reader, the clocks that we *are* muxing into DSI0's tree are way further down, so if this bit turns out to be a simple mux between dsiXvco and out_div, that shouldn't have any effect as this whole tree is off anyway.
Patchwork: https://patchwork.freedesktop.org/patch/637650/
--- drivers/gpu/drm/msm/dsi/dsi_manager.c | 32 ++++++++++++++++++--------- 1 file changed, 21 insertions(+), 11 deletions(-)
drivers/gpu/drm/msm/dsi/dsi_manager.c +21 -11
@@ -74,17 +74,35 @@ static int dsi_mgr_setup_components(int id)int ret;if (!IS_BONDED_DSI ()) { +/* +* Set the usecase before calling msm_dsi_host_register(), which would +* already program the PLL source mux based on a default usecase. +*/ +msm_dsi_phy_set_usecase (msm_dsi->phy,MSM_DSI_PHY_STANDALONE ); +msm_dsi_host_set_phy_mode (msm_dsi->host, msm_dsi->phy); + ret =msm_dsi_host_register (msm_dsi->host);if (ret)return ret; - -msm_dsi_phy_set_usecase (msm_dsi->phy,MSM_DSI_PHY_STANDALONE ); -msm_dsi_host_set_phy_mode (msm_dsi->host, msm_dsi->phy); }else if (other_dsi) {struct msm_dsi *master_link_dsi =IS_MASTER_DSI_LINK (id) ? msm_dsi : other_dsi;struct msm_dsi *slave_link_dsi =IS_MASTER_DSI_LINK (id) ? other_dsi : msm_dsi; + +/* +* PLL0 is to drive both DSI link clocks in bonded DSI mode. +* +* Set the usecase before calling msm_dsi_host_register(), which would +* already program the PLL source mux based on a default usecase. +*/ +msm_dsi_phy_set_usecase (clk_master_dsi->phy, +MSM_DSI_PHY_MASTER ); +msm_dsi_phy_set_usecase (clk_slave_dsi->phy, +MSM_DSI_PHY_SLAVE ); +msm_dsi_host_set_phy_mode (msm_dsi->host, msm_dsi->phy); +msm_dsi_host_set_phy_mode (other_dsi->host, other_dsi->phy); +/* Register slave host first, so that slave DSI device * has a chance to probe, and do not block the master * DSI device's probe.
@@ -98,14 +116,6 @@ static int dsi_mgr_setup_components(int id) ret =msm_dsi_host_register (master_link_dsi->host);if (ret)return ret; - -/* PLL0 is to drive both 2 DSI link clocks in bonded DSI mode. */ -msm_dsi_phy_set_usecase (clk_master_dsi->phy, -MSM_DSI_PHY_MASTER ); -msm_dsi_phy_set_usecase (clk_slave_dsi->phy, -MSM_DSI_PHY_SLAVE ); -msm_dsi_host_set_phy_mode (msm_dsi->host, msm_dsi->phy); -msm_dsi_host_set_phy_mode (other_dsi->host, other_dsi->phy); }return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 70/423 drm/amdkfd: Fix Circular Locking Dependency in svm_range_cpu_invalidate_pagetables
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit fddc45026311c05a5355fd34b9dc0a1d7eaef4a2 ]
This commit addresses a circular locking dependency in the svm_range_cpu_invalidate_pagetables function. The function previously held a lock while determining whether to perform an unmap or eviction operation, which could lead to deadlocks.
Fixes the below:
[ 223.418794] ======================================================
[ 223.418820] WARNING: possible circular locking dependency detected
[ 223.418845] 6.12.0-amdstaging-drm-next-lol-050225 #14 Tainted: G U OE
[ 223.418869] ------------------------------------------------------
[ 223.418889] kfdtest/3939 is trying to acquire lock:
[ 223.418906] ffff8957552eae38 (&dqm->lock_hidden){+.+.}-{3:3}, at: evict_process_queues_cpsch+0x43/0x210 [amdgpu]
[ 223.419302]
but task is already holding lock:
[ 223.419303] ffff8957556b83b0 (&prange->lock){+.+.}-{3:3}, at: svm_range_cpu_invalidate_pagetables+0x9d/0x850 [amdgpu]
[ 223.419447] Console: switching to colour dummy device 80x25
[ 223.419477] [IGT] amd_basic: executing
[ 223.419599]
which lock already depends on the new lock.[ 223.419611]
the existing dependency chain (in reverse order) is:
[ 223.419621]
-> #2 (&prange->lock){+.+.}-{3:3}:
[ 223.419636] __mutex_lock+0x85/0xe20
[ 223.419647] mutex_lock_nested+0x1b/0x30
[ 223.419656] svm_range_validate_and_map+0x2f1/0x15b0 [amdgpu]
[ 223.419954] svm_range_set_attr+0xe8c/0x1710 [amdgpu]
[ 223.420236] svm_ioctl+0x46/0x50 [amdgpu]
[ 223.420503] kfd_ioctl_svm+0x50/0x90 [amdgpu]
[ 223.420763] kfd_ioctl+0x409/0x6d0 [amdgpu]
[ 223.421024] __x64_sys_ioctl+0x95/0xd0
[ 223.421036] x64_sys_call+0x1205/0x20d0
[ 223.421047] do_syscall_64+0x87/0x140
[ 223.421056] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 223.421068]
-> #1 (reservation_ww_class_mutex){+.+.}-{3:3}:
[ 223.421084] __ww_mutex_lock.constprop.0+0xab/0x1560
[ 223.421095] ww_mutex_lock+0x2b/0x90
[ 223.421103] amdgpu_amdkfd_alloc_gtt_mem+0xcc/0x2b0 [amdgpu]
[ 223.421361] add_queue_mes+0x3bc/0x440 [amdgpu]
[ 223.421623] unhalt_cpsch+0x1ae/0x240 [amdgpu]
[ 223.421888] kgd2kfd_start_sched+0x5e/0xd0 [amdgpu]
[ 223.422148] amdgpu_amdkfd_start_sched+0x3d/0x50 [amdgpu]
[ 223.422414] amdgpu_gfx_enforce_isolation_handler+0x132/0x270 [amdgpu]
[ 223.422662] process_one_work+0x21e/0x680
[ 223.422673] worker_thread+0x190/0x330
[ 223.422682] kthread+0xe7/0x120
[ 223.422690] ret_from_fork+0x3c/0x60
[ 223.422699] ret_from_fork_asm+0x1a/0x30
[ 223.422708]
-> #0 (&dqm->lock_hidden){+.+.}-{3:3}:
[ 223.422723] __lock_acquire+0x16f4/0x2810
[ 223.422734] lock_acquire+0xd1/0x300
[ 223.422742] __mutex_lock+0x85/0xe20
[ 223.422751] mutex_lock_nested+0x1b/0x30
[ 223.422760] evict_process_queues_cpsch+0x43/0x210 [amdgpu]
[ 223.423025] kfd_process_evict_queues+0x8a/0x1d0 [amdgpu]
[ 223.423285] kgd2kfd_quiesce_mm+0x43/0x90 [amdgpu]
[ 223.423540] svm_range_cpu_invalidate_pagetables+0x4a7/0x850 [amdgpu]
[ 223.423807] __mmu_notifier_invalidate_range_start+0x1f5/0x250
[ 223.423819] copy_page_range+0x1e94/0x1ea0
[ 223.423829] copy_process+0x172f/0x2ad0
[ 223.423839] kernel_clone+0x9c/0x3f0
[ 223.423847] __do_sys_clone+0x66/0x90
[ 223.423856] __x64_sys_clone+0x25/0x30
[ 223.423864] x64_sys_call+0x1d7c/0x20d0
[ 223.423872] do_syscall_64+0x87/0x140
[ 223.423880] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 223.423891]
other info that might help us debug this:[ 223.423903] Chain exists of:
&dqm->lock_hidden --> reservation_ww_class_mutex --> &prange->lock[ 223.423926] Possible unsafe locking scenario:
[ 223.423935] CPU0 CPU1
[ 223.423942] ---- ----
[ 223.423949] lock(&prange->lock);
[ 223.423958] lock(reservation_ww_class_mutex);
[ 223.423970] lock(&prange->lock);
[ 223.423981] lock(&dqm->lock_hidden);
[ 223.423990]
*** DEADLOCK ***[ 223.423999] 5 locks held by kfdtest/3939:
[ 223.424006] #0: ffffffffb82b4fc0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_process+0x1387/0x2ad0
[ 223.424026] #1: ffff89575eda81b0 (&mm->mmap_lock){++++}-{3:3}, at: copy_process+0x13a8/0x2ad0
[ 223.424046] #2: ffff89575edaf3b0 (&mm->mmap_lock/1){+.+.}-{3:3}, at: copy_process+0x13e4/0x2ad0
[ 223.424066] #3: ffffffffb82e76e0 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at: copy_page_range+0x1cea/0x1ea0
[ 223.424088] #4: ffff8957556b83b0 (&prange->lock){+.+.}-{3:3}, at: svm_range_cpu_invalidate_pagetables+0x9d/0x850 [amdgpu]
[ 223.424365]
stack backtrace:
[ 223.424374] CPU: 0 UID: 0 PID: 3939 Comm: kfdtest Tainted: G U OE 6.12.0-amdstaging-drm-next-lol-050225 #14
[ 223.424392] Tainted: [U]=USER, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[ 223.424401] Hardware name: Gigabyte Technology Co., Ltd. X570 AORUS PRO WIFI/X570 AORUS PRO WIFI, BIOS F36a 02/16/2022
[ 223.424416] Call Trace:
[ 223.424423] <TASK>
[ 223.424430] dump_stack_lvl+0x9b/0xf0
[ 223.424441] dump_stack+0x10/0x20
[ 223.424449] print_circular_bug+0x275/0x350
[ 223.424460] check_noncircular+0x157/0x170
[ 223.424469] ? __bfs+0xfd/0x2c0
[ 223.424481] __lock_acquire+0x16f4/0x2810
[ 223.424490] ? srso_return_thunk+0x5/0x5f
[ 223.424505] lock_acquire+0xd1/0x300
[ 223.424514] ? evict_process_queues_cpsch+0x43/0x210 [amdgpu]
[ 223.424783] __mutex_lock+0x85/0xe20
[ 223.424792] ? evict_process_queues_cpsch+0x43/0x210 [amdgpu]
[ 223.425058] ? srso_return_thunk+0x5/0x5f
[ 223.425067] ? mark_held_locks+0x54/0x90
[ 223.425076] ? evict_process_queues_cpsch+0x43/0x210 [amdgpu]
[ 223.425339] ? srso_return_thunk+0x5/0x5f
[ 223.425350] mutex_lock_nested+0x1b/0x30
[ 223.425358] ? mutex_lock_nested+0x1b/0x30
[ 223.425367] evict_process_queues_cpsch+0x43/0x210 [amdgpu]
[ 223.425631] kfd_process_evict_queues+0x8a/0x1d0 [amdgpu]
[ 223.425893] kgd2kfd_quiesce_mm+0x43/0x90 [amdgpu]
[ 223.426156] svm_range_cpu_invalidate_pagetables+0x4a7/0x850 [amdgpu]
[ 223.426423] ? srso_return_thunk+0x5/0x5f
[ 223.426436] __mmu_notifier_invalidate_range_start+0x1f5/0x250
[ 223.426450] copy_page_range+0x1e94/0x1ea0
[ 223.426461] ? srso_return_thunk+0x5/0x5f
[ 223.426474] ? srso_return_thunk+0x5/0x5f
[ 223.426484] ? lock_acquire+0xd1/0x300
[ 223.426494] ? copy_process+0x1718/0x2ad0
[ 223.426502] ? srso_return_thunk+0x5/0x5f
[ 223.426510] ? sched_clock_noinstr+0x9/0x10
[ 223.426519] ? local_clock_noinstr+0xe/0xc0
[ 223.426528] ? copy_process+0x1718/0x2ad0
[ 223.426537] ? srso_return_thunk+0x5/0x5f
[ 223.426550] copy_process+0x172f/0x2ad0
[ 223.426569] kernel_clone+0x9c/0x3f0
[ 223.426577] ? __schedule+0x4c9/0x1b00
[ 223.426586] ? srso_return_thunk+0x5/0x5f
[ 223.426594] ? sched_clock_noinstr+0x9/0x10
[ 223.426602] ? srso_return_thunk+0x5/0x5f
[ 223.426610] ? local_clock_noinstr+0xe/0xc0
[ 223.426619] ? schedule+0x107/0x1a0
[ 223.426629] __do_sys_clone+0x66/0x90
[ 223.426643] __x64_sys_clone+0x25/0x30
[ 223.426652] x64_sys_call+0x1d7c/0x20d0
[ 223.426661] do_syscall_64+0x87/0x140
[ 223.426671] ? srso_return_thunk+0x5/0x5f
[ 223.426679] ? common_nsleep+0x44/0x50
[ 223.426690] ? srso_return_thunk+0x5/0x5f
[ 223.426698] ? trace_hardirqs_off+0x52/0xd0
[ 223.426709] ? srso_return_thunk+0x5/0x5f
[ 223.426717] ? syscall_exit_to_user_mode+0xcc/0x200
[ 223.426727] ? srso_return_thunk+0x5/0x5f
[ 223.426736] ? do_syscall_64+0x93/0x140
[ 223.426748] ? srso_return_thunk+0x5/0x5f
[ 223.426756] ? up_write+0x1c/0x1e0
[ 223.426765] ? srso_return_thunk+0x5/0x5f
[ 223.426775] ? srso_return_thunk+0x5/0x5f
[ 223.426783] ? trace_hardirqs_off+0x52/0xd0
[ 223.426792] ? srso_return_thunk+0x5/0x5f
[ 223.426800] ? syscall_exit_to_user_mode+0xcc/0x200
[ 223.426810] ? srso_return_thunk+0x5/0x5f
[ 223.426818] ? do_syscall_64+0x93/0x140
[ 223.426826] ? syscall_exit_to_user_mode+0xcc/0x200
[ 223.426836] ? srso_return_thunk+0x5/0x5f
[ 223.426844] ? do_syscall_64+0x93/0x140
[ 223.426853] ? srso_return_thunk+0x5/0x5f
[ 223.426861] ? irqentry_exit+0x6b/0x90
[ 223.426869] ? srso_return_thunk+0x5/0x5f
[ 223.426877] ? exc_page_fault+0xa7/0x2c0
[ 223.426888] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 223.426898] RIP: 0033:0x7f46758eab57
[ 223.426906] Code: ba 04 00 f3 0f 1e fa 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 41 41 89 c0 85 c0 75 2c 64 48 8b 04 25 10 00
[ 223.426930] RSP: 002b:00007fff5c3e5188 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
[ 223.426943] RAX: ffffffffffffffda RBX: 00007f4675f8c040 RCX: 00007f46758eab57
[ 223.426954] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
[ 223.426965] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 223.426975] R10: 00007f4675e81a50 R11: 0000000000000246 R12: 0000000000000001
[ 223.426986] R13: 00007fff5c3e5470 R14: 00007fff5c3e53e0 R15: 00007fff5c3e5410
[ 223.427004] </TASK>v2: To resolve this issue, the allocation of the process context buffer (proc_ctx_bo) has been moved from the add_queue_mes function to the pqm_create_queue function. This change ensures that the buffer is allocated only when the first queue for a process is created and only if the Micro Engine Scheduler (MES) is enabled. (Felix)
v3: Fix typo s/Memory Execution Scheduler (MES)/Micro Engine Scheduler in commit message. (Lijo)
--- .../drm/amd/amdkfd/kfd_device_queue_manager.c | 15 --------------- .../drm/amd/amdkfd/kfd_process_queue_manager.c | 16 ++++++++++++++++ 2 files changed, 16 insertions(+), 15 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +0 -15
@@ -205,21 +205,6 @@ static int add_queue_mes(struct device_queue_manager *dqm, struct queue *q,if (!down_read_trylock (&adev->reset_domain->sem))return -EIO ; -if (!pdd->proc_ctx_cpu_ptr) { - r =amdgpu_amdkfd_alloc_gtt_mem (adev, -AMDGPU_MES_PROC_CTX_SIZE , - &pdd->proc_ctx_bo, - &pdd->proc_ctx_gpu_addr, - &pdd->proc_ctx_cpu_ptr, - false); -if (r) { -dev_err (adev->dev, -"failed to allocate process context bo\n" ); -return r; - } -memset (pdd->proc_ctx_cpu_ptr,0 ,AMDGPU_MES_PROC_CTX_SIZE ); - } -memset (&queue_input,0x0 ,sizeof (struct mes_add_queue_input )); queue_input.process_id = qpd->pqm->process->pasid; queue_input.page_table_base_addr = qpd->page_table_base;
drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +16 -0
@@ -361,10 +361,26 @@ int pqm_create_queue(struct process_queue_manager *pqm,if (retval !=0 )return retval; +/* Register process if this is the first queue */ if (list_empty (&pdd->qpd.queues_list) &&list_empty (&pdd->qpd.priv_queue_list)) dev->dqm->ops.register_process (dev->dqm, &pdd->qpd); +/* Allocate proc_ctx_bo only if MES is enabled and this is the first queue */ +if (!pdd->proc_ctx_cpu_ptr && dev->kfd->shared_resources.enable_mes) { + retval =amdgpu_amdkfd_alloc_gtt_mem (dev->adev, +AMDGPU_MES_PROC_CTX_SIZE , + &pdd->proc_ctx_bo, + &pdd->proc_ctx_gpu_addr, + &pdd->proc_ctx_cpu_ptr, + false); +if (retval) { +dev_err (dev->adev->dev,"failed to allocate process context bo\n" ); +return retval; + } +memset (pdd->proc_ctx_cpu_ptr,0 ,AMDGPU_MES_PROC_CTX_SIZE ); + } + pqn =kzalloc (sizeof (*pqn),GFP_KERNEL );if (!pqn) { retval = -ENOMEM ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/423 PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Zhang <[email protected]>
[ Upstream commit 3ac47fbf4f6e8c3a7c3855fac68cc3246f90f850 ]
Per the Cadence's "PCIe Controller IP for AX14" user guide, Version 1.04, Section 9.1.7.1, "AXI Subordinate to PCIe Address Translation Registers", Table 9.4, the bit 16 of the AXI Subordinate Address (axi_s_awaddr) when set corresponds to MSG with data, and when not set, to MSG without data.
However, the driver is currently doing the opposite and due to this, the INTx is never received on the host.
So, fix the driver to reflect the documentation and also make INTx work.
--- drivers/pci/controller/cadence/pcie-cadence-ep.c | 3 +-- drivers/pci/controller/cadence/pcie-cadence.h | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-)
drivers/pci/controller/cadence/pcie-cadence-ep.c +1 -2
@@ -352,8 +352,7 @@ static void cdns_pcie_ep_assert_intx(struct cdns_pcie_ep *ep, u8 fn, u8 intx,spin_unlock_irqrestore (&ep->lock, flags); offset =CDNS_PCIE_NORMAL_MSG_ROUTING (MSG_ROUTING_LOCAL ) | -CDNS_PCIE_NORMAL_MSG_CODE (msg_code) | -CDNS_PCIE_MSG_NO_DATA ; +CDNS_PCIE_NORMAL_MSG_CODE (msg_code);writel (0 , ep->irq_cpu_addr + offset); }
drivers/pci/controller/cadence/pcie-cadence.h +1 -1
@@ -246,7 +246,7 @@ struct cdns_pcie_rp_ib_bar {#define CDNS_PCIE_NORMAL_MSG_CODE_MASK GENMASK(15, 8)#define CDNS_PCIE_NORMAL_MSG_CODE (code) \ (((code) << 8) & CDNS_PCIE_NORMAL_MSG_CODE_MASK) -#define CDNS_PCIE_MSG_NO_DATA BIT(16) +#define CDNS_PCIE_MSG_DATA BIT(16)struct cdns_pcie ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/423 PCI: brcmstb: Set generation limit before PCIe link up
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Quinlan <[email protected]>
[ Upstream commit 72d36589c6b7bef6b30eb99fcb7082f72faca37f ]
When the user elects to limit the PCIe generation via the appropriate devicetree property, apply the settings before the PCIe link up, not after.
--- drivers/pci/controller/pcie-brcmstb.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/pci/controller/pcie-brcmstb.c +4 -3
@@ -1276,6 +1276,10 @@ static int brcm_pcie_start_link(struct brcm_pcie *pcie)bool ssc_good = false;int ret, i; +/* Limit the generation if specified */ +if (pcie->gen) +brcm_pcie_set_gen (pcie, pcie->gen); +/* Unassert the fundamental reset */ ret = pcie->perst_set (pcie,0 );if (ret)
@@ -1302,9 +1306,6 @@ static int brcm_pcie_start_link(struct brcm_pcie *pcie)brcm_config_clkreq (pcie); -if (pcie->gen) -brcm_pcie_set_gen (pcie, pcie->gen); -if (pcie->ssc) { ret =brcm_pcie_set_ssc (pcie);if (ret ==0 )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/423 PCI: brcmstb: Use internal register to change link capability
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Quinlan <[email protected]>
[ Upstream commit 0c97321e11e0e9e18546f828492758f6aaecec59 ]
The driver has been mistakenly writing to a read-only (RO) configuration space register (PCI_EXP_LNKCAP) to change the PCIe link capability.
Although harmless in this case, the proper write destination is an internal register that is reflected by PCI_EXP_LNKCAP.
Thus, fix the brcm_pcie_set_gen() function to correctly update the link capability.
--- drivers/pci/controller/pcie-brcmstb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/controller/pcie-brcmstb.c +2 -2
@@ -403,10 +403,10 @@ static int brcm_pcie_set_ssc(struct brcm_pcie *pcie)static void brcm_pcie_set_gen (struct brcm_pcie *pcie,int gen) {u16 lnkctl2 =readw (pcie->base +BRCM_PCIE_CAP_REGS +PCI_EXP_LNKCTL2 ); -u32 lnkcap =readl (pcie->base +BRCM_PCIE_CAP_REGS +PCI_EXP_LNKCAP ); +u32 lnkcap =readl (pcie->base +PCIE_RC_CFG_PRIV1_LINK_CAPABILITY ); lnkcap = (lnkcap & ~PCI_EXP_LNKCAP_SLS ) | gen; -writel (lnkcap, pcie->base +BRCM_PCIE_CAP_REGS +PCI_EXP_LNKCAP ); +writel (lnkcap, pcie->base +PCIE_RC_CFG_PRIV1_LINK_CAPABILITY ); lnkctl2 = (lnkctl2 & ~0xf ) | gen;writew (lnkctl2, pcie->base +BRCM_PCIE_CAP_REGS +PCI_EXP_LNKCTL2 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/423 PCI: brcmstb: Fix error path after a call to regulator_bulk_get()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Quinlan <[email protected]>
[ Upstream commit 3651ad5249c51cf7eee078e12612557040a6bdb4 ]
If the regulator_bulk_get() returns an error and no regulators are created, we need to set their number to zero.
If we don't do this and the PCIe link up fails, a call to the regulator_bulk_free() will result in a kernel panic.
While at it, print the error value, as we cannot return an error upwards as the kernel will WARN() on an error from add_bus().
[kwilczynski: commit log, use comma in the message to match style with other similar messages]
--- drivers/pci/controller/pcie-brcmstb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pci/controller/pcie-brcmstb.c +2 -1
@@ -1368,7 +1368,8 @@ static int brcm_pcie_add_bus(struct pci_bus *bus) ret =regulator_bulk_get (dev, sr->num_supplies, sr->supplies);if (ret) { -dev_info (dev,"No regulators for downstream device\n" ); +dev_info (dev,"Did not get regulators, err=%d\n" , ret); + pcie->sr =NULL ; goto no_regulators; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/423 PCI: brcmstb: Fix potential premature regulator disabling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Quinlan <[email protected]>
[ Upstream commit b7de1b60ecab2f7b6f05d8116e93228a0bbb8563 ]
The platform supports enabling and disabling regulators only on ports below the Root Complex.
Thus, we need to verify this both when adding and removing the bus, otherwise regulators may be disabled prematurely when a bus further down the topology is removed.
--- drivers/pci/controller/pcie-brcmstb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/controller/pcie-brcmstb.c +1 -1
@@ -1392,7 +1392,7 @@ static void brcm_pcie_remove_bus(struct pci_bus *bus)struct subdev_regulators *sr = pcie->sr;struct device *dev = &bus->dev; -if (!sr) +if (!sr || !bus->parent || !pci_is_root_bus (bus->parent))return ;if (regulator_bulk_disable (sr->num_supplies, sr->supplies))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/423 PCI/portdrv: Only disable pciehp interrupts early when needed
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Tang <[email protected]>
[ Upstream commit 9d7db4db19827380e225914618c0c1bf435ed2f5 ]
Firmware developers reported that Linux issues two PCIe hotplug commands in very short intervals on an ARM server, which doesn't comply with the PCIe spec. According to PCIe r6.1, sec 6.7.3.2, if the Command Completed event is supported, software must wait for a command to complete or wait at least 1 second before sending a new command.
In the failure case, the first PCIe hotplug command is from get_port_device_capability(), which sends a command to disable PCIe hotplug interrupts without waiting for its completion, and the second command comes from pcie_enable_notification() of pciehp driver, which enables hotplug interrupts again.
Fix this by only disabling the hotplug interrupts when the pciehp driver is not enabled.
--- drivers/pci/pcie/portdrv.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/pci/pcie/portdrv.c +5 -3
@@ -228,10 +228,12 @@ static int get_port_device_capability(struct pci_dev *dev)/* * Disable hot-plug interrupts in case they have been enabled -* by the BIOS and the hot-plug service driver is not loaded. +* by the BIOS and the hot-plug service driver won't be loaded +* to handle them. */ -pcie_capability_clear_word (dev,PCI_EXP_SLTCTL , -PCI_EXP_SLTCTL_CCIE |PCI_EXP_SLTCTL_HPIE ); +if (!IS_ENABLED (CONFIG_HOTPLUG_PCI_PCIE )) +pcie_capability_clear_word (dev,PCI_EXP_SLTCTL , +PCI_EXP_SLTCTL_CCIE |PCI_EXP_SLTCTL_HPIE ); }#ifdef CONFIG_PCIEAER
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/423 PCI: Avoid reset when disabled via sysfs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Aravamudan <[email protected]>
[ Upstream commit 479380efe1625e251008d24b2810283db60d6fcd ]
After d88f521da3ef ("PCI: Allow userspace to query and set device reset mechanism"), userspace can disable reset of specific PCI devices by writing an empty string to the sysfs reset_method file.
However, pci_slot_resettable() does not check pci_reset_supported(), which means that pci_reset_function() will still reset the device even if userspace has disabled all the reset methods.
I was able to reproduce this issue with a vfio device passed to a qemu guest, where I had disabled PCI reset via sysfs.
Add an explicit check of pci_reset_supported() in both pci_slot_resettable() and pci_bus_resettable() to ensure both the reset status and reset execution are bypassed if an administrator disables it for a device.
--- drivers/pci/pci.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/pci/pci.c +4 -0
@@ -5528,6 +5528,8 @@ static bool pci_bus_resettable(struct pci_bus *bus)return false;list_for_each_entry (dev, &bus->devices, bus_list) { +if (!pci_reset_supported (dev)) +return false;if (dev->dev_flags &PCI_DEV_FLAGS_NO_BUS_RESET || (dev->subordinate && !pci_bus_resettable (dev->subordinate)))return false;
@@ -5604,6 +5606,8 @@ static bool pci_slot_resettable(struct pci_slot *slot)list_for_each_entry (dev, &slot->bus->devices, bus_list) {if (!dev->slot || dev->slot != slot)continue ; +if (!pci_reset_supported (dev)) +return false;if (dev->dev_flags &PCI_DEV_FLAGS_NO_BUS_RESET || (dev->subordinate && !pci_bus_resettable (dev->subordinate)))return false;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/423 drm/panthor: Update CS_STATUS_ defines to correct values
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ashley Smith <[email protected]>
[ Upstream commit c82734fbdc50dc9e568e8686622eaa4498acb81e ]
Values for SC_STATUS_BLOCKED_REASON_ are documented in the G610 "Odin" GPU specification (CS_STATUS_BLOCKED_REASON register).
This change updates the defines to the correct values.
--- drivers/gpu/drm/panthor/panthor_fw.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/panthor/panthor_fw.h +3 -3
@@ -102,9 +102,9 @@ struct panthor_fw_cs_output_iface {#define CS_STATUS_BLOCKED_REASON_SB_WAIT 1#define CS_STATUS_BLOCKED_REASON_PROGRESS_WAIT 2#define CS_STATUS_BLOCKED_REASON_SYNC_WAIT 3 -#define CS_STATUS_BLOCKED_REASON_DEFERRED 5 -#define CS_STATUS_BLOCKED_REASON_RES 6 -#define CS_STATUS_BLOCKED_REASON_FLUSH 7 +#define CS_STATUS_BLOCKED_REASON_DEFERRED 4 +#define CS_STATUS_BLOCKED_REASON_RESOURCE 5 +#define CS_STATUS_BLOCKED_REASON_FLUSH 6#define CS_STATUS_BLOCKED_REASON_MASK GENMASK(3, 0)u32 status_blocked_reason;u32 status_wait_sync_value_hi;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/423 drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaliy Shevtsov <[email protected]>
[ Upstream commit c3c584c18c90a024a54716229809ba36424f9660 ]
There is a type mismatch between what CalculateDynamicMetadataParameters() takes and what is passed to it. Currently this function accepts several args as signed long but it's called with unsigned integers and integer. On some systems where long is 32 bits and one of these unsigned int params is greater than INT_MAX it may cause passing input params as negative values.
Fix this by changing these argument types from long to unsigned int and to int respectively. Also this will align the function's definition with similar functions in other dcn* drivers.
Found by Linux Verification Center (linuxtesting.org) with Svace.
--- .../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c +6 -6
@@ -281,10 +281,10 @@ static void CalculateDynamicMetadataParameters(double DISPCLK , double DCFClkDeepSleep, double PixelClock, - long HTotal, - long VBlank, - long DynamicMetadataTransmittedBytes, - long DynamicMetadataLinesBeforeActiveRequired, + unsigned int HTotal, + unsigned int VBlank, + unsigned int DynamicMetadataTransmittedBytes, + int DynamicMetadataLinesBeforeActiveRequired, int InterlaceEnable, bool ProgressiveToInterlaceUnitInOPP, double *Tsetup,
@@ -3277,8 +3277,8 @@ static double CalculateWriteBackDelay(static void CalculateDynamicMetadataParameters (int MaxInterDCNTileRepeaters,double DPPCLK ,double DISPCLK , -double DCFClkDeepSleep,double PixelClock,long HTotal,long VBlank,long DynamicMetadataTransmittedBytes, -long DynamicMetadataLinesBeforeActiveRequired,int InterlaceEnable,bool ProgressiveToInterlaceUnitInOPP, +double DCFClkDeepSleep,double PixelClock,unsigned int HTotal,unsigned int VBlank,unsigned int DynamicMetadataTransmittedBytes, +int DynamicMetadataLinesBeforeActiveRequired,int InterlaceEnable,bool ProgressiveToInterlaceUnitInOPP,double *Tsetup,double *Tdmbf,double *Tdmec,double *Tdmsks) {double TotalRepeaterDelayTime =0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/423 drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit 06dd5d86c6aef1c7609ca3a5ffa4097e475e2213 ]
Somehow, possibly as a result of rebase gone badly, setting nr_indexed_regs for pre-a650 a6xx devices lost the setting of nr_indexed_regs, resulting in values getting snapshot, but omitted from the devcoredump.
Patchwork: https://patchwork.freedesktop.org/patch/640289/
--- drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c +2 -0
@@ -1507,6 +1507,8 @@ static void a6xx_get_indexed_registers(struct msm_gpu *gpu,/* Restore the size in the hardware */ gpu_write (gpu,REG_A6XX_CP_MEM_POOL_SIZE , mempool_size); + + a6xx_state->nr_indexed_regs = count; } static void a7xx_get_indexed_registers(struct msm_gpu *gpu,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/423 crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 1e4d73d06c98f5a1af4f7591cf7c2c4eee5b94fa ]
The following build warning has been reported:
arch/powerpc/crypto/ghashp8-ppc.o: warning: objtool: .text+0x22c: unannotated intra-function call
This happens due to commit bb7f054f4de2 ("objtool/powerpc: Add support for decoding all types of uncond branches")
Disassembly of arch/powerpc/crypto/ghashp8-ppc.o shows:
arch/powerpc/crypto/ghashp8-ppc.o: file format elf64-powerpcle
Disassembly of section .text:
0000000000000140 <gcm_ghash_p8>:
140: f8 ff 00 3c lis r0,-8
...
20c: 20 00 80 4e blr 210: 00 00 00 00 .long 0x0 214: 00 0c 14 00 .long 0x140c00 218: 00 00 04 00 .long 0x40000 21c: 00 00 00 00 .long 0x0 220: 47 48 41 53 rlwimi. r1,r26,9,1,3 224: 48 20 66 6f xoris r6,r27,8264 228: 72 20 50 6f xoris r16,r26,8306 22c: 77 65 72 49 bla 1726574 <gcm_ghash_p8+0x1726434> <==
...
It corresponds to the following code in ghashp8-ppc.o :
_GLOBAL(gcm_ghash_p8)
lis 0,0xfff8
...
blr
.long 0
.byte 0,12,0x14,0,0,0,4,0
.long 0
.size gcm_ghash_p8,.-gcm_ghash_p8 .byte 71,72,65,83,72,32,102,111,114,32,80,111,119,101,114,73,83,65,32,50,46,48,55,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
.align 2
.align 2
In fact this is raw data that is after the function end and that is not text so shouldn't be disassembled as text. But ghashp8-ppc.S is generated by a perl script and should have been marked as OBJECT_FILES_NON_STANDARD.
Now that 'bla' is understood as a call instruction, that raw data is mis-interpreted as an infra-function call.
Mark ghashp8-ppc.o as a OBJECT_FILES_NON_STANDARD to avoid this warning.
--- arch/powerpc/crypto/Makefile | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/crypto/Makefile +1 -0
@@ -56,3 +56,4 @@ $(obj)/aesp8-ppc.S $(obj)/ghashp8-ppc.S: $(obj)/%.S: $(src)/%.pl FORCE OBJECT_FILES_NON_STANDARD_aesp10-ppc.o := y OBJECT_FILES_NON_STANDARD_ghashp10-ppc.o := y OBJECT_FILES_NON_STANDARD_aesp8-ppc.o := y +OBJECT_FILES_NON_STANDARD_ghashp8-ppc.o := y
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/423 powerpc/kexec: fix physical address calculation in clear_utlb_entry()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 861efb8a48ee8b73ae4e8817509cd4e82fd52bc4 ]
In relocate_32.S, function clear_utlb_entry() goes into real mode. To do so, it has to calculate the physical address based on the virtual address. To get the virtual address it uses 'bl' which is problematic (see commit c974809a26a1 ("powerpc/vdso: Avoid link stack corruption in __get_datapage()")). In addition, the calculation is done on a wrong address because 'bl' loads LR with the address of the following instruction, not the address of the target. So when the target is not the instruction following the 'bl' instruction, it may lead to unexpected behaviour.
Fix it by re-writing the code so that is goes via another path which is based 'bcl 20,31,.+4' which is the right instruction to use for that.
--- arch/powerpc/kexec/relocate_32.S | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
arch/powerpc/kexec/relocate_32.S +2 -5
@@ -348,16 +348,13 @@ write_utlb: rlwinm r10, r24, 0, 22, 27 cmpwi r10, PPC47x_TLB0_4K - bne 0f li r10, 0x1000 /* r10 = 4k */ - ANNOTATE_INTRA_FUNCTION_CALL - bl 1f + beq 0f -0: /* Defaults to 256M */ lis r10, 0x1000 - bcl 20,31,$+4 +0: bcl 20,31,$+4 1: mflr r4 addi r4, r4, (2f-1b) /* virtual address of 2f */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/423 PCI: Remove stray put_device() in pci_register_host_bridge()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 6e8d06e5096c80cbf41313b4a204f43071ca42be ]
This put_device() was accidentally left over from when we changed the code from using device_register() to calling device_add(). Delete it.
--- drivers/pci/probe.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/pci/probe.c +2 -3
@@ -950,10 +950,9 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge)/* Temporarily move resources off the list */ list_splice_init (&bridge->windows, &resources); err =device_add (&bridge->dev); -if (err) { -put_device (&bridge->dev); +if (err) goto free; - } + bus->bridge =get_device (&bridge->dev);device_enable_async_suspend (bus->bridge);pci_set_bus_of_node (bus);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/423 PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thippeswamy Havalige <[email protected]>
[ Upstream commit 57b0302240741e73fe51f88404b3866e0d2933ad ]
The IRQ domain allocated for the PCIe controller is not freed if resource_list_first_type() returns NULL, leading to a resource leak.
This fix ensures properly cleaning up the allocated IRQ domain in the error path.
--- drivers/pci/controller/pcie-xilinx-cpm.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/pci/controller/pcie-xilinx-cpm.c +6 -4
@@ -570,15 +570,17 @@ static int xilinx_cpm_pcie_probe(struct platform_device *pdev)return err; bus =resource_list_first_type (&bridge->windows,IORESOURCE_BUS ); -if (!bus) -return -ENODEV ; +if (!bus) { + err = -ENODEV ; + goto err_free_irq_domains; + } port->variant =of_device_get_match_data (dev); err =xilinx_cpm_pcie_parse_dt (port, bus->res);if (err) {dev_err (dev,"Parsing DT failed\n" ); - goto err_parse_dt; + goto err_free_irq_domains; }xilinx_cpm_pcie_init_port (port);
@@ -602,7 +604,7 @@ static int xilinx_cpm_pcie_probe(struct platform_device *pdev)xilinx_cpm_free_interrupts (port); err_setup_irq:pci_ecam_free (port->cfg); -err_parse_dt: +err_free_irq_domains:xilinx_cpm_free_irq_domains (port);return err; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/423 drm/mediatek: Fix config_updating flag never false when no mbox channel
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason-JH Lin <[email protected]>
[ Upstream commit 4ba973c8bad04d59fd4efa62512f4d9cee131714 ]
When CONFIG_MTK_CMDQ is enabled, if the display is controlled by the CPU while other hardware is controlled by the GCE, the display will encounter a mbox request channel failure.
However, it will still enter the CONFIG_MTK_CMDQ statement, causing the config_updating flag to never be set to false. As a result, no page flip event is sent back to user space, and the screen does not update.
--- drivers/gpu/drm/mediatek/mtk_crtc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpu/drm/mediatek/mtk_crtc.c +5 -2
@@ -620,13 +620,16 @@ static void mtk_crtc_update_config(struct mtk_crtc *mtk_crtc, bool needs_vblank)mbox_send_message (mtk_crtc->cmdq_client.chan, cmdq_handle);mbox_client_txdone (mtk_crtc->cmdq_client.chan,0 ); + goto update_config_out; } -#else +#endif spin_lock_irqsave (&mtk_crtc->config_lock, flags); mtk_crtc->config_updating = false;spin_unlock_irqrestore (&mtk_crtc->config_lock, flags); -#endif +#if IS_REACHABLE (CONFIG_MTK_CMDQ ) +update_config_out: +#endif mutex_unlock (&mtk_crtc->hw_lock); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/423 drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 106a6de46cf4887d535018185ec528ce822d6d84 ]
The function mtk_dp_wait_hpd_asserted() may be called before the mtk_dp->drm_dev pointer is assigned in mtk_dp_bridge_attach(). Specifically it can be called via this callpath:
- mtk_edp_wait_hpd_asserted
- [panel probe]
- dp_aux_ep_probe
Using "drm" level prints anywhere in this callpath causes a NULL pointer dereference. Change the error message directly in mtk_dp_wait_hpd_asserted() to dev_err() to avoid this. Also change the error messages in mtk_dp_parse_capabilities(), which is called by mtk_dp_wait_hpd_asserted().
While touching these prints, also add the error code to them to make future debugging easier.
--- drivers/gpu/drm/mediatek/mtk_dp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/mediatek/mtk_dp.c +3 -3
@@ -1746,7 +1746,7 @@ static int mtk_dp_parse_capabilities(struct mtk_dp *mtk_dp) ret =drm_dp_dpcd_readb (&mtk_dp->aux,DP_MSTM_CAP , &val);if (ret <1 ) { -drm_err (mtk_dp->drm_dev,"Read mstm cap failed\n" ); +dev_err (mtk_dp->dev,"Read mstm cap failed: %zd\n" , ret);return ret ==0 ? -EIO : ret; }
@@ -1756,7 +1756,7 @@ static int mtk_dp_parse_capabilities(struct mtk_dp *mtk_dp)DP_DEVICE_SERVICE_IRQ_VECTOR_ESI0 , &val);if (ret <1 ) { -drm_err (mtk_dp->drm_dev,"Read irq vector failed\n" ); +dev_err (mtk_dp->dev,"Read irq vector failed: %zd\n" , ret);return ret ==0 ? -EIO : ret; }
@@ -2039,7 +2039,7 @@ static int mtk_dp_wait_hpd_asserted(struct drm_dp_aux *mtk_aux, unsigned long wa ret =mtk_dp_parse_capabilities (mtk_dp);if (ret) { -drm_err (mtk_dp->drm_dev,"Can't parse capabilities\n" ); +dev_err (mtk_dp->dev,"Can't parse capabilities: %d\n" , ret);return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/423 drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit dcb166ee43c3d594e7b73a24f6e8cf5663eeff2c ]
There is a type bug because the return statement:
return ret < 0 ? ret : recv_cnt;
The issue is that ret is an int, recv_cnt is a u32 and the function returns ssize_t, which is a signed long. The way that the type promotion works is that the negative error codes are first cast to u32 and then to signed long. The error codes end up being positive instead of negative and the callers treat them as success.
--- drivers/gpu/drm/mediatek/mtk_dsi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/mediatek/mtk_dsi.c +3 -3
@@ -1108,12 +1108,12 @@ static ssize_t mtk_dsi_host_transfer(struct mipi_dsi_host *host, const struct mipi_dsi_msg *msg) {struct mtk_dsi *dsi =host_to_dsi (host); -u32 recv_cnt, i; +ssize_t recv_cnt;u8 read_data[16 ];void *src_addr;u8 irq_flag =CMD_DONE_INT_FLAG ;u32 dsi_mode; -int ret; +int ret, i; dsi_mode =readl (dsi->regs +DSI_MODE_CTRL );if (dsi_mode &MODE ) {
@@ -1162,7 +1162,7 @@ static ssize_t mtk_dsi_host_transfer(struct mipi_dsi_host *host,if (recv_cnt)memcpy (msg->rx_buf, src_addr, recv_cnt); -DRM_INFO ("dsi get %d byte data from the panel address(0x%x)\n" , +DRM_INFO ("dsi get %zd byte data from the panel address(0x%x)\n" , recv_cnt, *((u8 *)(msg->tx_buf))); restore_dsi_mode:
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/423 drm/amd/display: avoid NPD when ASIC does not support DMUB
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
[ Upstream commit 42d9d7bed270247f134190ba0cb05bbd072f58c2 ]
ctx->dmub_srv will de NULL if the ASIC does not support DMUB, which is tested in dm_dmub_sw_init.
However, it will be dereferenced in dmub_hw_lock_mgr_cmd if should_use_dmub_lock returns true.
This has been the case since dmub support has been added for PSR1.
Fix this by checking for dmub_srv in should_use_dmub_lock.
[ 37.440832] BUG: kernel NULL pointer dereference, address: 0000000000000058 [ 37.447808] #PF: supervisor read access in kernel mode [ 37.452959] #PF: error_code(0x0000) - not-present page [ 37.458112] PGD 0 P4D 0 [ 37.460662] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI [ 37.465553] CPU: 2 UID: 1000 PID: 1745 Comm: DrmThread Not tainted 6.14.0-rc1-00003-gd62e938120f0 #23 99720e1cb1e0fc4773b8513150932a07de3c6e88 [ 37.478324] Hardware name: Google Morphius/Morphius, BIOS Google_Morphius.13434.858.0 10/26/2023 [ 37.487103] RIP: 0010:dmub_hw_lock_mgr_cmd+0x77/0xb0 [ 37.492074] Code: 44 24 0e 00 00 00 00 48 c7 04 24 45 00 00 0c 40 88 74 24 0d 0f b6 02 88 44 24 0c 8b 01 89 44 24 08 85 f6 75 05 c6 44 24 0e 01 <48> 8b 7f 58 48 89 e6 ba 01 00 00 00 e8 08 3c 2a 00 65 48 8b 04 5 [ 37.510822] RSP: 0018:ffff969442853300 EFLAGS: 00010202 [ 37.516052] RAX: 0000000000000000 RBX: ffff92db03000000 RCX: ffff969442853358 [ 37.523185] RDX: ffff969442853368 RSI: 0000000000000001 RDI: 0000000000000000 [ 37.530322] RBP: 0000000000000001 R08: 00000000000004a7 R09: 00000000000004a5 [ 37.537453] R10: 0000000000000476 R11: 0000000000000062 R12: ffff92db0ade8000 [ 37.544589] R13: ffff92da01180ae0 R14: ffff92da011802a8 R15: ffff92db03000000 [ 37.551725] FS: 0000784a9cdfc6c0(0000) GS:ffff92db2af00000(0000) knlGS:0000000000000000 [ 37.559814] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.565562] CR2: 0000000000000058 CR3: 0000000112b1c000 CR4: 00000000003506f0 [ 37.572697] Call Trace: [ 37.575152] <TASK> [ 37.577258] ? __die_body+0x66/0xb0 [ 37.580756] ? page_fault_oops+0x3e7/0x4a0 [ 37.584861] ? exc_page_fault+0x3e/0xe0 [ 37.588706] ? exc_page_fault+0x5c/0xe0 [ 37.592550] ? asm_exc_page_fault+0x22/0x30 [ 37.596742] ? dmub_hw_lock_mgr_cmd+0x77/0xb0 [ 37.601107] dcn10_cursor_lock+0x1e1/0x240 [ 37.605211] program_cursor_attributes+0x81/0x190 [ 37.609923] commit_planes_for_stream+0x998/0x1ef0 [ 37.614722] update_planes_and_stream_v2+0x41e/0x5c0 [ 37.619703] dc_update_planes_and_stream+0x78/0x140 [ 37.624588] amdgpu_dm_atomic_commit_tail+0x4362/0x49f0 [ 37.629832] ? srso_return_thunk+0x5/0x5f [ 37.633847] ? mark_held_locks+0x6d/0xd0 [ 37.637774] ? _raw_spin_unlock_irq+0x24/0x50 [ 37.642135] ? srso_return_thunk+0x5/0x5f [ 37.646148] ? lockdep_hardirqs_on+0x95/0x150 [ 37.650510] ? srso_return_thunk+0x5/0x5f [ 37.654522] ? _raw_spin_unlock_irq+0x2f/0x50 [ 37.658883] ? srso_return_thunk+0x5/0x5f [ 37.662897] ? wait_for_common+0x186/0x1c0 [ 37.666998] ? srso_return_thunk+0x5/0x5f [ 37.671009] ? drm_crtc_next_vblank_start+0xc3/0x170 [ 37.675983] commit_tail+0xf5/0x1c0 [ 37.679478] drm_atomic_helper_commit+0x2a2/0x2b0 [ 37.684186] drm_atomic_commit+0xd6/0x100 [ 37.688199] ? __cfi___drm_printfn_info+0x10/0x10 [ 37.692911] drm_atomic_helper_update_plane+0xe5/0x130 [ 37.698054] drm_mode_cursor_common+0x501/0x670 [ 37.702600] ? __cfi_drm_mode_cursor_ioctl+0x10/0x10 [ 37.707572] drm_mode_cursor_ioctl+0x48/0x70 [ 37.711851] drm_ioctl_kernel+0xf2/0x150 [ 37.715781] drm_ioctl+0x363/0x590 [ 37.719189] ? __cfi_drm_mode_cursor_ioctl+0x10/0x10 [ 37.724165] amdgpu_drm_ioctl+0x41/0x80 [ 37.728013] __se_sys_ioctl+0x7f/0xd0 [ 37.731685] do_syscall_64+0x87/0x100 [ 37.735355] ? vma_end_read+0x12/0xe0 [ 37.739024] ? srso_return_thunk+0x5/0x5f [ 37.743041] ? find_held_lock+0x47/0xf0 [ 37.746884] ? vma_end_read+0x12/0xe0 [ 37.750552] ? srso_return_thunk+0x5/0x5f [ 37.754565] ? lock_release+0x1c4/0x2e0 [ 37.758406] ? vma_end_read+0x12/0xe0 [ 37.762079] ? exc_page_fault+0x84/0xe0 [ 37.765921] ? srso_return_thunk+0x5/0x5f [ 37.769938] ? lockdep_hardirqs_on+0x95/0x150 [ 37.774303] ? srso_return_thunk+0x5/0x5f [ 37.778317] ? exc_page_fault+0x84/0xe0 [ 37.782163] entry_SYSCALL_64_after_hwframe+0x55/0x5d [ 37.787218] RIP: 0033:0x784aa5ec3059 [ 37.790803] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 77 1d 48 8b 45 c8 64 48 2b 04 25 28 00 0 [ 37.809553] RSP: 002b:0000784a9cdf90e0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 37.817121] RAX: ffffffffffffffda RBX: 0000784a9cdf917c RCX: 0000784aa5ec3059 [ 37.824256] RDX: 0000784a9cdf917c RSI: 00000000c01c64a3 RDI: 0000000000000020 [ 37.831391] RBP: 0000784a9cdf9130 R08: 0000000000000100 R09: 0000000000ff0000 [ 37.838525] R10: 0000000000000000 R11: 0000000000000246 R12: 0000025c01606ed0 [ 37.845657] R13: 0000025c00030200 R14: 00000000c01c64a3 R15: 0000000000000020 [ 37.852799] </TASK> [ 37.854992] Modules linked in: [ 37.864546] gsmi: Log Shutdown Reason 0x03 [ 37.868656] CR2: 0000000000000058 [ 37.871979] ---[ end trace 0000000000000000 ]--- [ 37.880976] RIP: 0010:dmub_hw_lock_mgr_cmd+0x77/0xb0 [ 37.885954] Code: 44 24 0e 00 00 00 00 48 c7 04 24 45 00 00 0c 40 88 74 24 0d 0f b6 02 88 44 24 0c 8b 01 89 44 24 08 85 f6 75 05 c6 44 24 0e 01 <48> 8b 7f 58 48 89 e6 ba 01 00 00 00 e8 08 3c 2a 00 65 48 8b 04 5 [ 37.904703] RSP: 0018:ffff969442853300 EFLAGS: 00010202 [ 37.909933] RAX: 0000000000000000 RBX: ffff92db03000000 RCX: ffff969442853358 [ 37.917068] RDX: ffff969442853368 RSI: 0000000000000001 RDI: 0000000000000000 [ 37.924201] RBP: 0000000000000001 R08: 00000000000004a7 R09: 00000000000004a5 [ 37.931336] R10: 0000000000000476 R11: 0000000000000062 R12: ffff92db0ade8000 [ 37.938469] R13: ffff92da01180ae0 R14: ffff92da011802a8 R15: ffff92db03000000 [ 37.945602] FS: 0000784a9cdfc6c0(0000) GS:ffff92db2af00000(0000) knlGS:0000000000000000 [ 37.953689] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.959435] CR2: 0000000000000058 CR3: 0000000112b1c000 CR4: 00000000003506f0 [ 37.966570] Kernel panic - not syncing: Fatal exception [ 37.971901] Kernel Offset: 0x30200000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 37.982840] gsmi: Log Shutdown Reason 0x02
--- drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c +4 -0
@@ -63,6 +63,10 @@ void dmub_hw_lock_mgr_inbox0_cmd(struct dc_dmub_srv *dmub_srv,bool should_use_dmub_lock (struct dc_link *link) { +/* ASIC doesn't support DMUB */ +if (!link->ctx->dmub_srv) +return false; +if (link->psr_settings.psr_version ==DC_PSR_VERSION_SU_1 )return true;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 89/423 PCI: dwc: ep: Return -ENOMEM for allocation failures
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 8189aa56dbed0bfb46b7b30d4d231f57ab17b3f4 ]
If the bitmap or memory allocations fail, then dw_pcie_ep_init_registers() will incorrectly return a success.
Return -ENOMEM instead.
--- drivers/pci/controller/dwc/pcie-designware-ep.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/controller/dwc/pcie-designware-ep.c +1 -0
@@ -755,6 +755,7 @@ int dw_pcie_ep_init_registers(struct dw_pcie_ep *ep)if (ret)return ret; + ret = -ENOMEM ;if (!ep->ib_window_map) { ep->ib_window_map =devm_bitmap_zalloc (dev, pci->num_ib_windows,GFP_KERNEL );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 90/423 PCI: histb: Fix an error handling path in histb_pcie_probe()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit b36fb50701619efca5f5450b355d42575cf532ed ]
If an error occurs after a successful phy_init() call, then phy_exit() should be called.
Add the missing call, as already done in the remove function.
[kwilczynski: remove unnecessary hipcie->phy NULL check from histb_pcie_probe() and squash a patch that removes similar NULL check for hipcie-phy from histb_pcie_remove() from
https://lore.kernel.org/linux-pci/c369b5d25e17a44984ae5a889ccc28a59a0737f7.1742058005.git.christophe.jaillet@wanadoo.fr]
--- drivers/pci/controller/dwc/pcie-histb.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/pci/controller/dwc/pcie-histb.c +8 -4
@@ -409,16 +409,21 @@ static int histb_pcie_probe(struct platform_device *pdev) ret =histb_pcie_host_enable (pp);if (ret) {dev_err (dev,"failed to enable host\n" ); -return ret; + goto err_exit_phy; } ret =dw_pcie_host_init (pp);if (ret) {dev_err (dev,"failed to initialize host\n" ); -return ret; + goto err_exit_phy; }return 0 ; + +err_exit_phy: +phy_exit (hipcie->phy); + +return ret; }static void histb_pcie_remove (struct platform_device *pdev)
@@ -427,8 +432,7 @@ static void histb_pcie_remove(struct platform_device *pdev)histb_pcie_host_disable (hipcie); -if (hipcie->phy) -phy_exit (hipcie->phy); +phy_exit (hipcie->phy); }static const struct of_device_id histb_pcie_of_match[] = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/423 PCI: Fix BAR resizing when VF BARs are assigned
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 9ec19bfa78bd788945e2445b09de7b4482dee432 ]
__resource_resize_store() attempts to release all resources of the device before attempting the resize. The loop, however, only covers standard BARs (< PCI_STD_NUM_BARS). If a device has VF BARs that are assigned, pci_reassign_bridge_resources() finds the bridge window still has some assigned child resources and returns -NOENT which makes pci_resize_resource() to detect an error and abort the resize.
Change the release loop to cover all resources up to VF BARs which allows the resize operation to release the bridge windows and attempt to assigned them again with the different size.
If SR-IOV is enabled, disallow resize as it requires releasing also IOV resources.
--- drivers/pci/pci-sysfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/pci-sysfs.c +2 -2
@@ -1444,7 +1444,7 @@ static ssize_t __resource_resize_store(struct device *dev, int n,return -EINVAL ;device_lock (dev); -if (dev->driver) { +if (dev->driver ||pci_num_vf (pdev)) { ret = -EBUSY ; goto unlock; }
@@ -1466,7 +1466,7 @@ static ssize_t __resource_resize_store(struct device *dev, int n,pci_remove_resource_files (pdev); -for (i =0 ; i <PCI_STD_NUM_BARS ; i++) { +for (i =0 ; i <PCI_BRIDGE_RESOURCES ; i++) {if (pci_resource_len (pdev, i) &&pci_resource_flags (pdev, i) == flags)pci_release_resource (pdev, i);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/423 PCI: pciehp: Dont enable HPIE when resuming in poll mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 527664f738afb6f2c58022cd35e63801e5dc7aec ]
PCIe hotplug can operate in poll mode without interrupt handlers using a polling kthread only. eb34da60edee ("PCI: pciehp: Disable hotplug interrupt during suspend") failed to consider that and enables HPIE (Hot-Plug Interrupt Enable) unconditionally when resuming the Port.
Only set HPIE if non-poll mode is in use. This makes pcie_enable_interrupt() match how pcie_enable_notification() already handles HPIE.
--- drivers/pci/hotplug/pciehp_hpc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/pci/hotplug/pciehp_hpc.c +3 -1
@@ -842,7 +842,9 @@ void pcie_enable_interrupt(struct controller *ctrl) {u16 mask; - mask =PCI_EXP_SLTCTL_HPIE |PCI_EXP_SLTCTL_DLLSCE ; + mask =PCI_EXP_SLTCTL_DLLSCE ; +if (!pciehp_poll_mode) + mask |=PCI_EXP_SLTCTL_HPIE ;pcie_write_cmd (ctrl, mask, mask); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 93/423 fbdev: au1100fb: Move a variable assignment behind a null pointer check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Elfring <[email protected]>
[ Upstream commit 2df2c0caaecfd869b49e14f2b8df822397c5dd7f ]
The address of a data structure member was determined before a corresponding null pointer check in the implementation of the function “au1100fb_setmode”.
This issue was detected by using the Coccinelle software.
--- drivers/video/fbdev/au1100fb.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/video/fbdev/au1100fb.c +3 -1
@@ -137,13 +137,15 @@ static int au1100fb_fb_blank(int blank_mode, struct fb_info *fbi)*/ int au1100fb_setmode (struct au1100fb_device *fbdev) { -struct fb_info *info = &fbdev->info; +struct fb_info *info;u32 words;int index;if (!fbdev)return -EINVAL ; + info = &fbdev->info; +/* Update var-dependent FB info */ if (panel_is_active (fbdev->panel) ||panel_is_color (fbdev->panel)) {if (info->var.bits_per_pixel <=8 ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 94/423 dummycon: fix default rows/cols
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit beefaba1978c04ea2950d34236f58fe6cf6a7f58 ]
dummycon fails to build on ARM/footbridge when the VGA console is disabled, since I got the dependencies slightly wrong in a previous patch:
drivers/video/console/dummycon.c: In function 'dummycon_init':drivers/video/console/dummycon.c:27:25: error: 'CONFIG_DUMMY_CONSOLE_COLUMNS' undeclared (first use in this function); did you mean 'CONFIG_DUMMY_CONSOLE'?
27 | #define DUMMY_COLUMNS CONFIG_DUMMY_CONSOLE_COLUMNSdrivers/video/console/dummycon.c:28:25: error: 'CONFIG_DUMMY_CONSOLE_ROWS' undeclared (first use in this function); did you mean 'CONFIG_DUMMY_CONSOLE'?
28 | #define DUMMY_ROWS CONFIG_DUMMY_CONSOLE_ROWS
This only showed up after many thousand randconfig builds on Arm, and doesn't matter in practice, but should still be fixed. Address it by using the default row/columns on footbridge after all in that corner case.
--- drivers/video/console/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/video/console/Kconfig +2 -2
@@ -52,7 +52,7 @@ config DUMMY_CONSOLE config DUMMY_CONSOLE_COLUMNS int "Initial number of console screen columns" - depends on DUMMY_CONSOLE && !ARCH_FOOTBRIDGE + depends on DUMMY_CONSOLE && !(ARCH_FOOTBRIDGE && VGA_CONSOLE) default 160 if PARISC default 80 help
@@ -62,7 +62,7 @@ config DUMMY_CONSOLE_COLUMNS config DUMMY_CONSOLE_ROWS int "Initial number of console screen rows" - depends on DUMMY_CONSOLE && !ARCH_FOOTBRIDGE + depends on DUMMY_CONSOLE && !(ARCH_FOOTBRIDGE && VGA_CONSOLE) default 64 if PARISC default 30 if ARM default 25
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 95/423 mdacon: rework dependency list
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 5bbcc7645f4b244ffb5ac6563fbe9d3d42194447 ]
mdacon has roughly the same dependencies as vgacon but expresses them as a negative list instead of a positive list, with the only practical difference being PowerPC/CHRP, which uses vga16fb instead of vgacon.
The CONFIG_MDA_CONSOLE description advises to only turn it on when vgacon is also used because MDA/Hercules-only systems should be using vgacon instead, so just change the list to enforce that directly for simplicity.
The probing was broken from 2002 to 2008, this improves on the fix that was added then: If vgacon is a loadable module, then mdacon cannot be built-in now, and the list of systems that support vgacon is carried over.
--- drivers/video/console/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/console/Kconfig +1 -1
@@ -24,7 +24,7 @@ config VGA_CONSOLE Say Y. config MDA_CONSOLE - depends on !M68K && !PARISC && ISA + depends on VGA_CONSOLE && ISA tristate "MDA text console (dual-headed)" help Say Y here if you have an old MDA or monochrome Hercules graphics
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 96/423 fbdev: sm501fb: Add some geometry checks.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danila Chernetsov <[email protected]>
[ Upstream commit aee50bd88ea5fde1ff4cc021385598f81a65830c ]
Added checks for xoffset, yoffset settings. Incorrect settings of these parameters can lead to errors in sm501fb_pan_ functions.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/video/fbdev/sm501fb.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/video/fbdev/sm501fb.c +7 -0
@@ -326,6 +326,13 @@ static int sm501fb_check_var(struct fb_var_screeninfo *var,if (var->xres_virtual >4096 || var->yres_virtual >2048 )return -EINVAL ; +/* geometry sanity checks */ +if (var->xres + var->xoffset > var->xres_virtual) +return -EINVAL ; + +if (var->yres + var->yoffset > var->yres_virtual) +return -EINVAL ; +/* can cope with 8,16 or 32bpp */ if (var->bits_per_pixel <=8 )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 97/423 crypto: iaa - Test the correct request flag
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit fc4bd01d9ff592f620c499686245c093440db0e8 ]
Test the correct flags for the MAY_SLEEP bit.
--- drivers/crypto/intel/iaa/iaa_crypto_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/crypto/intel/iaa/iaa_crypto_main.c +2 -2
@@ -1527,7 +1527,7 @@ static int iaa_comp_acompress(struct acomp_req *req) iaa_wq =idxd_wq_get_private (wq);if (!req->dst) { -gfp_t flags = req->flags &CRYPTO_TFM_REQ_MAY_SLEEP ?GFP_KERNEL :GFP_ATOMIC ; +gfp_t flags = req->base.flags &CRYPTO_TFM_REQ_MAY_SLEEP ?GFP_KERNEL :GFP_ATOMIC ;/* incompressible data will always be < 2 * slen */ req->dlen =2 * req->slen;
@@ -1609,7 +1609,7 @@ static int iaa_comp_acompress(struct acomp_req *req)static int iaa_comp_adecompress_alloc_dest (struct acomp_req *req) { -gfp_t flags = req->flags &CRYPTO_TFM_REQ_MAY_SLEEP ? +gfp_t flags = req->base.flags &CRYPTO_TFM_REQ_MAY_SLEEP ?GFP_KERNEL :GFP_ATOMIC ;struct crypto_tfm *tfm = req->base.tfm;dma_addr_t src_addr, dst_addr;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 98/423 crypto: qat - set parity error mask for qat_420xx
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bairavi Alagappan <[email protected]>
[ Upstream commit f9555d18084985c80a91baa4fdb7d205b401a754 ]
The field parerr_wat_wcp_mask in the structure adf_dev_err_mask enables the detection and reporting of parity errors for the wireless cipher and wireless authentication accelerators.
Set the parerr_wat_wcp_mask field, which was inadvertently omitted during the initial enablement of the qat_420xx driver, to ensure that parity errors are enabled for those accelerators.
In addition, fix the string used to report such errors that was inadvertently set to "ath_cph" (authentication and cipher).
--- drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c | 1 + drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-)
drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c +1 -0
@@ -420,6 +420,7 @@ static void adf_gen4_set_err_mask(struct adf_dev_err_mask *dev_err_mask) dev_err_mask->parerr_cpr_xlt_mask =ADF_420XX_PARITYERRORMASK_CPR_XLT_MASK ; dev_err_mask->parerr_dcpr_ucs_mask =ADF_420XX_PARITYERRORMASK_DCPR_UCS_MASK ; dev_err_mask->parerr_pke_mask =ADF_420XX_PARITYERRORMASK_PKE_MASK ; + dev_err_mask->parerr_wat_wcp_mask =ADF_420XX_PARITYERRORMASK_WAT_WCP_MASK ; dev_err_mask->ssmfeatren_mask =ADF_420XX_SSMFEATREN_MASK ; }
drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c +1 -1
@@ -695,7 +695,7 @@ static bool adf_handle_slice_hang_error(struct adf_accel_dev *accel_dev,if (err_mask->parerr_wat_wcp_mask)adf_poll_slicehang_csr (accel_dev, csr,ADF_GEN4_SLICEHANGSTATUS_WAT_WCP , -"ath_cph" ); +"wat_wcp" );return false; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 99/423 crypto: tegra - Use separate buffer for setkey
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil R <[email protected]>
[ Upstream commit bcfc8fc53f3acb3213fb9d28675244aa4ce208e0 ]
The buffer which sends the commands to host1x was shared for all tasks in the engine. This causes a problem with the setkey() function as it gets called asynchronous to the crypto engine queue. Modifying the same cmdbuf in setkey() will corrupt the ongoing host1x task and in turn break the encryption/decryption operation. Hence use a separate cmdbuf for setkey().
--- drivers/crypto/tegra/tegra-se-aes.c | 16 ++++++++-------- drivers/crypto/tegra/tegra-se-hash.c | 13 +++++++------ drivers/crypto/tegra/tegra-se-key.c | 10 ++++++++-- drivers/crypto/tegra/tegra-se-main.c | 16 ++++++++++++---- drivers/crypto/tegra/tegra-se.h | 3 ++- 5 files changed, 37 insertions(+), 21 deletions(-)
drivers/crypto/tegra/tegra-se-aes.c +8 -8
@@ -282,7 +282,7 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq)/* Prepare the command and submit for execution */ cmdlen =tegra_aes_prep_cmd (ctx, rctx); - ret =tegra_se_host1x_submit (se, cmdlen); + ret =tegra_se_host1x_submit (se, se->cmdbuf, cmdlen);/* Copy the result */ tegra_aes_update_iv (req, ctx);
@@ -719,7 +719,7 @@ static int tegra_gcm_do_gmac(struct tegra_aead_ctx *ctx, struct tegra_aead_reqct cmdlen =tegra_gmac_prep_cmd (ctx, rctx); -return tegra_se_host1x_submit (se, cmdlen); +return tegra_se_host1x_submit (se, se->cmdbuf, cmdlen); }static int tegra_gcm_do_crypt (struct tegra_aead_ctx *ctx,struct tegra_aead_reqctx *rctx)
@@ -736,7 +736,7 @@ static int tegra_gcm_do_crypt(struct tegra_aead_ctx *ctx, struct tegra_aead_reqc/* Prepare command and submit */ cmdlen =tegra_gcm_crypt_prep_cmd (ctx, rctx); - ret =tegra_se_host1x_submit (se, cmdlen); + ret =tegra_se_host1x_submit (se, se->cmdbuf, cmdlen);if (ret)return ret;
@@ -759,7 +759,7 @@ static int tegra_gcm_do_final(struct tegra_aead_ctx *ctx, struct tegra_aead_reqc/* Prepare command and submit */ cmdlen =tegra_gcm_prep_final_cmd (se, cpuvaddr, rctx); - ret =tegra_se_host1x_submit (se, cmdlen); + ret =tegra_se_host1x_submit (se, se->cmdbuf, cmdlen);if (ret)return ret;
@@ -891,7 +891,7 @@ static int tegra_ccm_do_cbcmac(struct tegra_aead_ctx *ctx, struct tegra_aead_req/* Prepare command and submit */ cmdlen =tegra_cbcmac_prep_cmd (ctx, rctx); -return tegra_se_host1x_submit (se, cmdlen); +return tegra_se_host1x_submit (se, se->cmdbuf, cmdlen); }static int tegra_ccm_set_msg_len (u8 *block,unsigned int msglen,int csize)
@@ -1098,7 +1098,7 @@ static int tegra_ccm_do_ctr(struct tegra_aead_ctx *ctx, struct tegra_aead_reqctx/* Prepare command and submit */ cmdlen =tegra_ctr_prep_cmd (ctx, rctx); - ret =tegra_se_host1x_submit (se, cmdlen); + ret =tegra_se_host1x_submit (se, se->cmdbuf, cmdlen);if (ret)return ret;
@@ -1521,8 +1521,8 @@ static int tegra_cmac_do_update(struct ahash_request *req)tegra_cmac_paste_result (ctx->se, rctx); cmdlen =tegra_cmac_prep_cmd (ctx, rctx); + ret =tegra_se_host1x_submit (se, se->cmdbuf, cmdlen); - ret =tegra_se_host1x_submit (se, cmdlen);/* * If this is not the final update, copy the intermediate results * from the registers so that it can be used in the next 'update'
@@ -1555,7 +1555,7 @@ static int tegra_cmac_do_final(struct ahash_request *req)/* Prepare command and submit */ cmdlen =tegra_cmac_prep_cmd (ctx, rctx); - ret =tegra_se_host1x_submit (se, cmdlen); + ret =tegra_se_host1x_submit (se, se->cmdbuf, cmdlen);if (ret) goto out;
drivers/crypto/tegra/tegra-se-hash.c +7 -6
@@ -300,8 +300,9 @@ static int tegra_sha_do_update(struct ahash_request *req) {struct tegra_sha_ctx *ctx =crypto_ahash_ctx (crypto_ahash_reqtfm (req));struct tegra_sha_reqctx *rctx =ahash_request_ctx (req); +struct tegra_se *se = ctx->se;unsigned int nblks, nresidue, size, ret; -u32 *cpuvaddr = ctx->se->cmdbuf->addr; +u32 *cpuvaddr = se->cmdbuf->addr; nresidue = (req->nbytes + rctx->residue.size) % rctx->blk_size; nblks = (req->nbytes + rctx->residue.size) / rctx->blk_size;
@@ -353,11 +354,11 @@ static int tegra_sha_do_update(struct ahash_request *req)* This is to support the import/export functionality. */ if (!(rctx->task &SHA_FIRST )) -tegra_sha_paste_hash_result (ctx->se, rctx); +tegra_sha_paste_hash_result (se, rctx); - size =tegra_sha_prep_cmd (ctx->se, cpuvaddr, rctx); + size =tegra_sha_prep_cmd (se, cpuvaddr, rctx); - ret =tegra_se_host1x_submit (ctx->se, size); + ret =tegra_se_host1x_submit (se, se->cmdbuf, size);/* * If this is not the final update, copy the intermediate results
@@ -365,7 +366,7 @@ static int tegra_sha_do_update(struct ahash_request *req)* call. This is to support the import/export functionality. */ if (!(rctx->task &SHA_FINAL )) -tegra_sha_copy_hash_result (ctx->se, rctx); +tegra_sha_copy_hash_result (se, rctx);return ret; }
@@ -388,7 +389,7 @@ static int tegra_sha_do_final(struct ahash_request *req) size =tegra_sha_prep_cmd (se, cpuvaddr, rctx); - ret =tegra_se_host1x_submit (se, size); + ret =tegra_se_host1x_submit (se, se->cmdbuf, size);if (ret) goto out;
drivers/crypto/tegra/tegra-se-key.c +8 -2
@@ -115,11 +115,17 @@ static int tegra_key_insert(struct tegra_se *se, const u8 *key, u32 keylen, u16 slot, u32 alg) { const u32 *keyval = (u32 *)key; -u32 *addr = se->cmdbuf->addr, size; +u32 *addr = se->keybuf->addr, size; +int ret; + +mutex_lock (&kslt_lock); size =tegra_key_prep_ins_cmd (se, addr, keyval, keylen, slot, alg); + ret =tegra_se_host1x_submit (se, se->keybuf, size); -return tegra_se_host1x_submit (se, size); +mutex_unlock (&kslt_lock); + +return ret; }void tegra_key_invalidate (struct tegra_se *se,u32 keyid,u32 alg)
drivers/crypto/tegra/tegra-se-main.c +12 -4
@@ -141,7 +141,7 @@ static struct tegra_se_cmdbuf *tegra_se_host1x_bo_alloc(struct tegra_se *se, ssireturn cmdbuf; } -int tegra_se_host1x_submit (struct tegra_se *se,u32 size) +int tegra_se_host1x_submit (struct tegra_se *se,struct tegra_se_cmdbuf *cmdbuf,u32 size) {struct host1x_job *job;int ret;
@@ -160,9 +160,9 @@ int tegra_se_host1x_submit(struct tegra_se *se, u32 size) job->engine_fallback_streamid = se->stream_id; job->engine_streamid_offset =SE_STREAM_ID ; - se->cmdbuf->words = size; + cmdbuf->words = size; -host1x_job_add_gather (job, &se->cmdbuf->bo, size,0 ); +host1x_job_add_gather (job, &cmdbuf->bo, size,0 ); ret =host1x_job_pin (job, se->dev);if (ret) {
@@ -220,14 +220,22 @@ static int tegra_se_client_init(struct host1x_client *client) goto syncpt_put; } + se->keybuf =tegra_se_host1x_bo_alloc (se,SZ_4K ); +if (!se->keybuf) { + ret = -ENOMEM ; + goto cmdbuf_put; + } + ret = se->hw->init_alg (se);if (ret) {dev_err (se->dev,"failed to register algorithms\n" ); - goto cmdbuf_put; + goto keybuf_put; }return 0 ; +keybuf_put: +tegra_se_cmdbuf_put (&se->keybuf->bo); cmdbuf_put:tegra_se_cmdbuf_put (&se->cmdbuf->bo); syncpt_put:
drivers/crypto/tegra/tegra-se.h +2 -1
@@ -420,6 +420,7 @@ struct tegra_se {struct host1x_client client;struct host1x_channel *channel;struct tegra_se_cmdbuf *cmdbuf; +struct tegra_se_cmdbuf *keybuf;struct crypto_engine *engine;struct host1x_syncpt *syncpt;struct device *dev;
@@ -502,7 +503,7 @@ void tegra_deinit_hash(struct tegra_se *se);int tegra_key_submit (struct tegra_se *se,const u8 *key,u32 keylen,u32 alg,u32 *keyid);void tegra_key_invalidate (struct tegra_se *se,u32 keyid,u32 alg); -int tegra_se_host1x_submit (struct tegra_se *se,u32 size); +int tegra_se_host1x_submit (struct tegra_se *se,struct tegra_se_cmdbuf *cmdbuf,u32 size);/* HOST1x OPCODES */ static inline u32 host1x_opcode_setpayload (unsigned int payload)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 100/423 crypto: tegra - check return value for hash do_one_req
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil R <[email protected]>
[ Upstream commit dcf8b7e49b86738296c77fb58c123dd2d74a22a7 ]
Initialize and check the return value in hash *do_one_req() functions and exit the function if there is an error. This fixes the 'uninitialized variable' warnings reported by testbots.
--- drivers/crypto/tegra/tegra-se-aes.c | 10 ++++++++-- drivers/crypto/tegra/tegra-se-hash.c | 7 +++++++ 2 files changed, 15 insertions(+), 2 deletions(-)
drivers/crypto/tegra/tegra-se-aes.c +8 -2
@@ -1581,18 +1581,24 @@ static int tegra_cmac_do_one_req(struct crypto_engine *engine, void *areq)struct crypto_ahash *tfm =crypto_ahash_reqtfm (req);struct tegra_cmac_ctx *ctx =crypto_ahash_ctx (tfm);struct tegra_se *se = ctx->se; -int ret; +int ret =0 ;if (rctx->task &SHA_UPDATE ) { ret =tegra_cmac_do_update (req); +if (ret) + goto out; + rctx->task &= ~SHA_UPDATE ; }if (rctx->task &SHA_FINAL ) { ret =tegra_cmac_do_final (req); +if (ret) + goto out; + rctx->task &= ~SHA_FINAL ; } - +out:crypto_finalize_hash_request (se->engine, req, ret);return 0 ;
drivers/crypto/tegra/tegra-se-hash.c +7 -0
@@ -417,14 +417,21 @@ static int tegra_sha_do_one_req(struct crypto_engine *engine, void *areq)if (rctx->task &SHA_UPDATE ) { ret =tegra_sha_do_update (req); +if (ret) + goto out; + rctx->task &= ~SHA_UPDATE ; }if (rctx->task &SHA_FINAL ) { ret =tegra_sha_do_final (req); +if (ret) + goto out; + rctx->task &= ~SHA_FINAL ; } +out:crypto_finalize_hash_request (se->engine, req, ret);return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 101/423 crypto: bpf - Add MODULE_DESCRIPTION for skcipher
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit f307c87ea06c64b87fcd3221a682cd713cde51e9 ]
All modules should have a description, building with extra warnings enabled prints this outfor the for bpf_crypto_skcipher module:
WARNING: modpost: missing MODULE_DESCRIPTION() in crypto/bpf_crypto_skcipher.o
Add a description line.
--- crypto/bpf_crypto_skcipher.c | 1 + 1 file changed, 1 insertion(+)
crypto/bpf_crypto_skcipher.c +1 -0
@@ -80,3 +80,4 @@ static void __exit bpf_crypto_skcipher_exit(void)module_init (bpf_crypto_skcipher_init);module_exit (bpf_crypto_skcipher_exit);MODULE_LICENSE ("GPL" ); +MODULE_DESCRIPTION ("Symmetric key cipher support for BPF" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 102/423 crypto: tegra - Use HMAC fallback when keyslots are full
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil R <[email protected]>
[ Upstream commit f80a2e2e77bedd0aa645a60f89b4f581c70accda ]
The intermediate results for HMAC is stored in the allocated keyslot by the hardware. Dynamic allocation of keyslot during an operation is hence not possible. As the number of keyslots are limited in the hardware, fallback to the HMAC software implementation if keyslots are not available
--- drivers/crypto/tegra/tegra-se-hash.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/crypto/tegra/tegra-se-hash.c +6 -1
@@ -567,13 +567,18 @@ static int tegra_hmac_setkey(struct crypto_ahash *tfm, const u8 *key, unsigned int keylen) {struct tegra_sha_ctx *ctx =crypto_ahash_ctx (tfm); +int ret;if (aes_check_keylen (keylen))return tegra_hmac_fallback_setkey (ctx, key, keylen); + ret =tegra_key_submit (ctx->se, key, keylen, ctx->alg, &ctx->key_id); +if (ret) +return tegra_hmac_fallback_setkey (ctx, key, keylen); + ctx->fallback = false; -return tegra_key_submit (ctx->se, key, keylen, ctx->alg, &ctx->key_id); +return 0 ; }static int tegra_sha_update (struct ahash_request *req)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 103/423 clk: amlogic: gxbb: drop incorrect flag on 32k clock
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit f38f7fe4830c5cb4eac138249225f119e7939965 ]
gxbb_32k_clk_div sets CLK_DIVIDER_ROUND_CLOSEST in the init_data flag which is incorrect. This is field is not where the divider flags belong.
Thankfully, CLK_DIVIDER_ROUND_CLOSEST maps to bit 4 which is an unused clock flag, so there is no unintended consequence to this error.
Effectively, the clock has been used without CLK_DIVIDER_ROUND_CLOSEST so far, so just drop it.
--- drivers/clk/meson/gxbb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/meson/gxbb.c +1 -1
@@ -1312,7 +1312,7 @@ static struct clk_regmap gxbb_32k_clk_div = { &gxbb_32k_clk_sel.hw }, .num_parents = 1, - .flags = CLK_SET_RATE_PARENT | CLK_DIVIDER_ROUND_CLOSEST, + .flags = CLK_SET_RATE_PARENT, }, };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 104/423 crypto: hisilicon/sec2 - fix for aead authsize alignment
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenkai Lin <[email protected]>
[ Upstream commit a49cc71e219040d771a8c1254879984f98192811 ]
The hardware only supports authentication sizes
that are 4-byte aligned. Therefore, the driver
switches to software computation in this case.
--- drivers/crypto/hisilicon/sec2/sec_crypto.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-)
drivers/crypto/hisilicon/sec2/sec_crypto.c +9 -13
@@ -57,7 +57,6 @@#define SEC_TYPE_MASK 0x0F#define SEC_DONE_MASK 0x0001#define SEC_ICV_MASK 0x000E -#define SEC_SQE_LEN_RATE_MASK 0x3#define SEC_TOTAL_IV_SZ (depth) (SEC_IV_SIZE * (depth))#define SEC_SGL_SGE_NR 128
@@ -80,16 +79,16 @@#define SEC_TOTAL_PBUF_SZ (depth) (PAGE_SIZE * SEC_PBUF_PAGE_NUM(depth) + \ SEC_PBUF_LEFT_SZ(depth)) -#define SEC_SQE_LEN_RATE 4#define SEC_SQE_CFLAG 2#define SEC_SQE_AEAD_FLAG 3#define SEC_SQE_DONE 0x1#define SEC_ICV_ERR 0x2 -#define MIN_MAC_LEN 4#define MAC_LEN_MASK 0x1U#define MAX_INPUT_DATA_LEN 0xFFFE00#define BITS_MASK 0xFF +#define WORD_MASK 0x3#define BYTE_BITS 0x8 +#define BYTES_TO_WORDS (bcount) ((bcount) >> 2)#define SEC_XTS_NAME_SZ 0x3#define IV_CM_CAL_NUM 2#define IV_CL_MASK 0x7
@@ -1175,7 +1174,7 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, goto bad_key; } -if (ctx->a_ctx.a_key_len &SEC_SQE_LEN_RATE_MASK ) { +if (ctx->a_ctx.a_key_len &WORD_MASK ) { ret = -EINVAL ;dev_err (dev,"AUTH key length error!\n" ); goto bad_key;
@@ -1583,11 +1582,10 @@ static void sec_auth_bd_fill_ex(struct sec_auth_ctx *ctx, int dir, sec_sqe->type2.a_key_addr =cpu_to_le64 (ctx->a_key_dma); - sec_sqe->type2.mac_key_alg =cpu_to_le32 (authsize /SEC_SQE_LEN_RATE ); + sec_sqe->type2.mac_key_alg =cpu_to_le32 (BYTES_TO_WORDS (authsize)); sec_sqe->type2.mac_key_alg |= -cpu_to_le32 ((u32)((ctx->a_key_len) / -SEC_SQE_LEN_RATE ) <<SEC_AKEY_OFFSET ); +cpu_to_le32 ((u32 )BYTES_TO_WORDS (ctx->a_key_len) <<SEC_AKEY_OFFSET ); sec_sqe->type2.mac_key_alg |=cpu_to_le32 ((u32)(ctx->a_alg) <<SEC_AEAD_ALG_OFFSET );
@@ -1639,12 +1637,10 @@ static void sec_auth_bd_fill_ex_v3(struct sec_auth_ctx *ctx, int dir, sqe3->a_key_addr =cpu_to_le64 (ctx->a_key_dma); sqe3->auth_mac_key |= -cpu_to_le32 ((u32)(authsize / -SEC_SQE_LEN_RATE ) <<SEC_MAC_OFFSET_V3 ); +cpu_to_le32 (BYTES_TO_WORDS (authsize) <<SEC_MAC_OFFSET_V3 ); sqe3->auth_mac_key |= -cpu_to_le32 ((u32)(ctx->a_key_len / -SEC_SQE_LEN_RATE ) <<SEC_AKEY_OFFSET_V3 ); +cpu_to_le32 ((u32 )BYTES_TO_WORDS (ctx->a_key_len) <<SEC_AKEY_OFFSET_V3 ); sqe3->auth_mac_key |=cpu_to_le32 ((u32)(ctx->a_alg) <<SEC_AUTH_ALG_OFFSET_V3 );
@@ -2234,8 +2230,8 @@ static int sec_aead_spec_check(struct sec_ctx *ctx, struct sec_req *sreq)struct device *dev = ctx->dev;int ret; -/* Hardware does not handle cases where authsize is less than 4 bytes */ -if (unlikely (sz <MIN_MAC_LEN )) { +/* Hardware does not handle cases where authsize is not 4 bytes aligned */ +if (c_mode ==SEC_CMODE_CBC && (sz &WORD_MASK )) { sreq->aead_req.fallback = true;return -EINVAL ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 105/423 crypto: hisilicon/sec2 - fix for sec spec check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenkai Lin <[email protected]>
[ Upstream commit f4f353cb7ae9bb43e34943edb693532a39118eca ]
During encryption and decryption, user requests
must be checked first, if the specifications that
are not supported by the hardware are used, the
software computing is used for processing.
--- drivers/crypto/hisilicon/sec2/sec.h | 1 - drivers/crypto/hisilicon/sec2/sec_crypto.c | 101 ++++++++------------- 2 files changed, 39 insertions(+), 63 deletions(-)
drivers/crypto/hisilicon/sec2/sec.h +0 -1
@@ -37,7 +37,6 @@ struct sec_aead_req {u8 *a_ivin;dma_addr_t a_ivin_dma;struct aead_request *aead_req; -bool fallback; };/* SEC request of Crypto */
drivers/crypto/hisilicon/sec2/sec_crypto.c +39 -62
221 lines not on this page · raw message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 106/423 RDMA/mlx5: Fix page_size variable overflow
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Guralnik <[email protected]>
[ Upstream commit f0c2427412b43cdf1b7b0944749ea17ddb97d5a5 ]
Change all variables storing mlx5_umem_mkc_find_best_pgsz() result to unsigned long to support values larger than 31 and avoid overflow.
For example: If we try to register 4GB of memory that is contiguous in physical memory, the driver will optimize the page_size and try to use an mkey with 4GB entity size. The 'unsigned int' page_size variable will overflow to '0' and we'll hit the WARN_ON() in alloc_cacheable_mr().
WARNING: CPU: 2 PID: 1203 at drivers/infiniband/hw/mlx5/mr.c:1124 alloc_cacheable_mr+0x22/0x580 [mlx5_ib] Modules linked in: mlx5_ib mlx5_core bonding ip6_gre ip6_tunnel tunnel6 ip_gre gre rdma_rxe rdma_ucm ib_uverbs ib_ipoib ib_umad rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm fuse ib_core [last unloaded: mlx5_core] CPU: 2 UID: 70878 PID: 1203 Comm: rdma_resource_l Tainted: G W 6.14.0-rc4-dirty #43 Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:alloc_cacheable_mr+0x22/0x580 [mlx5_ib] Code: 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 41 52 53 48 83 ec 30 f6 46 28 04 4c 8b 77 08 75 21 <0f> 0b 49 c7 c2 ea ff ff ff 48 8d 65 d0 4c 89 d0 5b 41 5a 41 5c 41 RSP: 0018:ffffc900006ffac8 EFLAGS: 00010246 RAX: 0000000004c0d0d0 RBX: ffff888217a22000 RCX: 0000000000100001 RDX: 00007fb7ac480000 RSI: ffff8882037b1240 RDI: ffff8882046f0600 RBP: ffffc900006ffb28 R08: 0000000000000001 R09: 0000000000000000 R10: 00000000000007e0 R11: ffffea0008011d40 R12: ffff8882037b1240 R13: ffff8882046f0600 R14: ffff888217a22000 R15: ffffc900006ffe00 FS: 00007fb7ed013340(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb7ed1d8000 CR3: 00000001fd8f6006 CR4: 0000000000772eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x81/0x130 ? alloc_cacheable_mr+0x22/0x580 [mlx5_ib] ? report_bug+0xfc/0x1e0 ? handle_bug+0x55/0x90 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? alloc_cacheable_mr+0x22/0x580 [mlx5_ib] create_real_mr+0x54/0x150 [mlx5_ib] ib_uverbs_reg_mr+0x17f/0x2a0 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xca/0x140 [ib_uverbs] ib_uverbs_run_method+0x6d0/0x780 [ib_uverbs] ? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs] ib_uverbs_cmd_verbs+0x19b/0x360 [ib_uverbs] ? walk_system_ram_range+0x79/0xd0 ? ___pte_offset_map+0x1b/0x110 ? __pte_offset_map_lock+0x80/0x100 ib_uverbs_ioctl+0xac/0x110 [ib_uverbs] __x64_sys_ioctl+0x94/0xb0 do_syscall_64+0x50/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fb7ecf0737b Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 7d 2a 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffdbe03ecc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffdbe03edb8 RCX: 00007fb7ecf0737b RDX: 00007ffdbe03eda0 RSI: 00000000c0181b01 RDI: 0000000000000003 RBP: 00007ffdbe03ed80 R08: 00007fb7ecc84010 R09: 00007ffdbe03eed4 R10: 0000000000000009 R11: 0000000000000246 R12: 00007ffdbe03eed4 R13: 000000000000000c R14: 000000000000000c R15: 00007fb7ecc84150 </TASK>
--- drivers/infiniband/hw/mlx5/mr.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/infiniband/hw/mlx5/mr.c +4 -4
@@ -56,7 +56,7 @@ static void create_mkey_callback(int status, struct mlx5_async_work *context);static struct mlx5_ib_mr *reg_create (struct ib_pd *pd,struct ib_umem *umem,u64 iova,int access_flags, -unsigned int page_size,bool populate, +unsigned long page_size,bool populate,int access_mode);static int __mlx5_ib_dereg_mr (struct ib_mr *ibmr);
@@ -1115,7 +1115,7 @@ static struct mlx5_ib_mr *alloc_cacheable_mr(struct ib_pd *pd,struct mlx5r_cache_rb_key rb_key = {};struct mlx5_cache_ent *ent;struct mlx5_ib_mr *mr; -unsigned int page_size; +unsigned long page_size;if (umem->is_dmabuf) page_size =mlx5_umem_dmabuf_default_pgsz (umem, iova);
@@ -1219,7 +1219,7 @@ reg_create_crossing_vhca_mr(struct ib_pd *pd, u64 iova, u64 length, int access_f*/ static struct mlx5_ib_mr *reg_create (struct ib_pd *pd,struct ib_umem *umem,u64 iova,int access_flags, -unsigned int page_size,bool populate, +unsigned long page_size,bool populate,int access_mode) {struct mlx5_ib_dev *dev =to_mdev (pd->device);
@@ -1425,7 +1425,7 @@ static struct ib_mr *create_real_mr(struct ib_pd *pd, struct ib_umem *umem, mr =alloc_cacheable_mr (pd, umem, iova, access_flags,MLX5_MKC_ACCESS_MODE_MTT ); }else { -unsigned int page_size = +unsigned long page_size =mlx5_umem_mkc_find_best_pgsz (dev, umem, iova);mutex_lock (&dev->slow_path_mutex);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 107/423 remoteproc: core: Clear table_sz when rproc_shutdown
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit efdde3d73ab25cef4ff2d06783b0aad8b093c0e4 ]
There is case as below could trigger kernel dump:
Use U-Boot to start remote processor(rproc) with resource table published to a fixed address by rproc. After Kernel boots up, stop the rproc, load a new firmware which doesn't have resource table ,and start rproc.
When starting rproc with a firmware not have resource table, memcpy(loaded_table, rproc->cached_table, rproc->table_sz) will trigger dump, because rproc->cache_table is set to NULL during the last stop operation, but rproc->table_sz is still valid.
This issue is found on i.MX8MP and i.MX9.
Dump as below:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=000000010af63000 [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP Modules linked in: CPU: 2 UID: 0 PID: 1060 Comm: sh Not tainted 6.14.0-rc7-next-20250317-dirty #38 Hardware name: NXP i.MX8MPlus EVK board (DT) pstate: a0000005 (NzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __pi_memcpy_generic+0x110/0x22c lr : rproc_start+0x88/0x1e0 Call trace: __pi_memcpy_generic+0x110/0x22c (P) rproc_boot+0x198/0x57c state_store+0x40/0x104 dev_attr_store+0x18/0x2c sysfs_kf_write+0x7c/0x94 kernfs_fop_write_iter+0x120/0x1cc vfs_write+0x240/0x378 ksys_write+0x70/0x108 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x10c el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x30/0xcc el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x19c
Clear rproc->table_sz to address the issue.
--- drivers/remoteproc/remoteproc_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/remoteproc/remoteproc_core.c +1 -0
@@ -2025,6 +2025,7 @@ int rproc_shutdown(struct rproc *rproc)kfree (rproc->cached_table); rproc->cached_table =NULL ; rproc->table_ptr =NULL ; + rproc->table_sz =0 ; out:mutex_unlock (&rproc->lock);return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 108/423 of: property: Increase NR_FWNODE_REFERENCE_ARGS
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit eb50844d728f11e87491f7c7af15a4a737f1159d ]
Currently, the following two macros have different values:
// The maximal argument count for firmware node reference
#define NR_FWNODE_REFERENCE_ARGS 8
// The maximal argument count for DT node reference
#define MAX_PHANDLE_ARGS 16
It may cause firmware node reference's argument count out of range if directly assign DT node reference's argument count to firmware's.
drivers/of/property.c:of_fwnode_get_reference_args() is doing the direct assignment, so may cause firmware's argument count @args->nargs got out of range, namely, in [9, 16].
Fix by increasing NR_FWNODE_REFERENCE_ARGS to 16 to meet DT requirement. Will align both macros later to avoid such inconsistency.
--- include/linux/fwnode.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/fwnode.h +1 -1
@@ -91,7 +91,7 @@ struct fwnode_endpoint {#define SWNODE_GRAPH_PORT_NAME_FMT "port@%u"#define SWNODE_GRAPH_ENDPOINT_NAME_FMT "endpoint@%u" -#define NR_FWNODE_REFERENCE_ARGS 8 +#define NR_FWNODE_REFERENCE_ARGS 16/** * struct fwnode_reference_args - Fwnode reference with additional arguments
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 109/423 pinctrl: renesas: rzg2l: Suppress binding attributes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
[ Upstream commit ea4065345643f3163e812e58ed8add2c75c3ee46 ]
Suppress binding attributes for the rzg2l pinctrl driver, as it is an essential block for Renesas SoCs. Unbinding the driver leads to warnings from __device_links_no_driver() and can eventually render the system inaccessible.
--- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/renesas/pinctrl-rzg2l.c +1 -0
@@ -3180,6 +3180,7 @@ static struct platform_driver rzg2l_pinctrl_driver = { .name = DRV_NAME, .of_match_table = of_match_ptr(rzg2l_pinctrl_of_table), .pm = pm_sleep_ptr(&rzg2l_pinctrl_pm_ops), + .suppress_bind_attrs = true, }, .probe = rzg2l_pinctrl_probe, };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 110/423 remoteproc: qcom_q6v5_pas: Make single-PD handling more robust
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit e917b73234b02aa4966325e7380d2559bf127ba9 ]
Only go into the if condition for single-PD handling when there's actually just one power domain specified there. Otherwise it'll be an issue in the dts and we should fail in the regular code path.
This also mirrors the latest changes in the qcom_q6v5_mss driver.
--- drivers/remoteproc/qcom_q6v5_pas.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/remoteproc/qcom_q6v5_pas.c +5 -5
@@ -509,16 +509,16 @@ static int adsp_pds_attach(struct device *dev, struct device **devs,if (!pd_names)return 0 ; +while (pd_names[num_pds]) + num_pds++; +/* Handle single power domain */ -if (dev->pm_domain) { +if (num_pds ==1 && dev->pm_domain) { devs[0 ] = dev;pm_runtime_enable (dev);return 1 ; } -while (pd_names[num_pds]) - num_pds++; -for (i =0 ; i < num_pds; i++) { devs[i] =dev_pm_domain_attach_by_name (dev, pd_names[i]);if (IS_ERR_OR_NULL (devs[i])) {
@@ -543,7 +543,7 @@ static void adsp_pds_detach(struct qcom_adsp *adsp, struct device **pds,int i;/* Handle single power domain */ -if (dev->pm_domain && pd_count) { +if (pd_count ==1 && dev->pm_domain) {pm_runtime_disable (dev);return ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 111/423 libbpf: Fix hypothetical STT_SECTION extern NULL deref case
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit e0525cd72b5979d8089fe524a071ea93fd011dc9 ]
Fix theoretical NULL dereference in linker when resolving *extern* STT_SECTION symbol against not-yet-existing ELF section. Not sure if it's possible in practice for valid ELF object files (this would require embedded assembly manipulations, at which point BTF will be missing), but fix the s/dst_sym/dst_sec/ typo guarding this condition anyways.
--- tools/lib/bpf/linker.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/lib/bpf/linker.c +1 -1
@@ -2007,7 +2007,7 @@ static int linker_append_elf_sym(struct bpf_linker *linker, struct src_obj *obj, obj->sym_map[src_sym_idx] = dst_sym_idx; -if (sym_type ==STT_SECTION && dst_sym) { +if (sym_type ==STT_SECTION && dst_sec) { dst_sec->sec_sym_idx = dst_sym_idx; dst_sym->st_value =0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 112/423 selftests/bpf: Fix string read in strncmp benchmark
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viktor Malik <[email protected]>
[ Upstream commit de07b182899227d5fd1ca7a1a7d495ecd453d49c ]
The strncmp benchmark uses the bpf_strncmp helper and a hand-written loop to compare two strings. The values of the strings are filled from userspace. One of the strings is non-const (in .bss) while the other is const (in .rodata) since that is the requirement of bpf_strncmp.
The problem is that in the hand-written loop, Clang optimizes the reads from the const string to always return 0 which breaks the benchmark.
Use barrier_var to prevent the optimization.
The effect can be seen on the strncmp-no-helper variant.
Before this change:
# ./bench strncmp-no-helper
Setting up benchmark 'strncmp-no-helper'...
Benchmark 'strncmp-no-helper' started.
Iter 0 (112.309us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Iter 1 (-23.238us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Iter 2 ( 58.994us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Iter 3 (-30.466us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Iter 4 ( 29.996us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Iter 5 ( 16.949us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Iter 6 (-60.035us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Summary: hits 0.000 ± 0.000M/s ( 0.000M/prod), drops 0.000 ± 0.000M/s, total operations 0.000 ± 0.000M/sAfter this change:
# ./bench strncmp-no-helper
Setting up benchmark 'strncmp-no-helper'...
Benchmark 'strncmp-no-helper' started.
Iter 0 ( 77.711us): hits 5.534M/s ( 5.534M/prod), drops 0.000M/s, total operations 5.534M/s
Iter 1 ( 11.215us): hits 6.006M/s ( 6.006M/prod), drops 0.000M/s, total operations 6.006M/s
Iter 2 (-14.253us): hits 5.931M/s ( 5.931M/prod), drops 0.000M/s, total operations 5.931M/s
Iter 3 ( 59.087us): hits 6.005M/s ( 6.005M/prod), drops 0.000M/s, total operations 6.005M/s
Iter 4 (-21.379us): hits 6.010M/s ( 6.010M/prod), drops 0.000M/s, total operations 6.010M/s
Iter 5 (-20.310us): hits 5.861M/s ( 5.861M/prod), drops 0.000M/s, total operations 5.861M/s
Iter 6 ( 53.937us): hits 6.004M/s ( 6.004M/prod), drops 0.000M/s, total operations 6.004M/s
Summary: hits 5.969 ± 0.061M/s ( 5.969M/prod), drops 0.000 ± 0.000M/s, total operations 5.969 ± 0.061M/s--- tools/testing/selftests/bpf/progs/strncmp_bench.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
tools/testing/selftests/bpf/progs/strncmp_bench.c +4 -1
@@ -35,7 +35,10 @@ static __always_inline int local_strncmp(const char *s1, unsigned int sz, SEC("tp/syscalls/sys_enter_getpgid")int strncmp_no_helper (void *ctx) { -if (local_strncmp (str, cmp_str_len +1 , target) <0 ) +const char *target_str = target; + +barrier_var (target_str); +if (local_strncmp (str, cmp_str_len +1 , target_str) <0 )__sync_add_and_fetch (&hits,1 );return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 113/423 x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
[ Upstream commit dc84bc2aba85a1508f04a936f9f9a15f64ebfb31 ]
If track_pfn_copy() fails, we already added the dst VMA to the maple tree. As fork() fails, we'll cleanup the maple tree, and stumble over the dst VMA for which we neither performed any reservation nor copied any page tables.
Consequently untrack_pfn() will see VM_PAT and try obtaining the PAT information from the page table -- which fails because the page table was not copied.
The easiest fix would be to simply clear the VM_PAT flag of the dst VMA if track_pfn_copy() fails. However, the whole thing is about "simply" clearing the VM_PAT flag is shaky as well: if we passed track_pfn_copy() and performed a reservation, but copying the page tables fails, we'll simply clear the VM_PAT flag, not properly undoing the reservation ... which is also wrong.
So let's fix it properly: set the VM_PAT flag only if the reservation succeeded (leaving it clear initially), and undo the reservation if anything goes wrong while copying the page tables: clearing the VM_PAT flag after undoing the reservation.
Note that any copied page table entries will get zapped when the VMA will get removed later, after copy_page_range() succeeded; as VM_PAT is not set then, we won't try cleaning VM_PAT up once more and untrack_pfn() will be happy. Note that leaving these page tables in place without a reservation is not a problem, as we are aborting fork(); this process will never run.
A reproducer can trigger this usually at the first try:
https://gitlab.com/davidhildenbrand/scratchspace/-/raw/main/reproducers/pat_fork.c
WARNING: CPU: 26 PID: 11650 at arch/x86/mm/pat/memtype.c:983 get_pat_info+0xf6/0x110 Modules linked in: ... CPU: 26 UID: 0 PID: 11650 Comm: repro3 Not tainted 6.12.0-rc5+ #92 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:get_pat_info+0xf6/0x110 ... Call Trace: <TASK> ... untrack_pfn+0x52/0x110 unmap_single_vma+0xa6/0xe0 unmap_vmas+0x105/0x1f0 exit_mmap+0xf6/0x460 __mmput+0x4b/0x120 copy_process+0x1bf6/0x2aa0 kernel_clone+0xab/0x440 __do_sys_clone+0x66/0x90 do_syscall_64+0x95/0x180
Likely this case was missed in:
d155df53f310 ("x86/mm/pat: clear VM_PAT if copy_p4d_range failed")
... and instead of undoing the reservation we simply cleared the VM_PAT flag.
Keep the documentation of these functions in include/linux/pgtable.h, one place is more than sufficient -- we should clean that up for the other functions like track_pfn_remap/untrack_pfn separately.
--- arch/x86/mm/pat/memtype.c | 52 +++++++++++++++++++++------------------ include/linux/pgtable.h | 28 ++++++++++++++++----- kernel/fork.c | 4 +++ mm/memory.c | 11 +++------ 4 files changed, 58 insertions(+), 37 deletions(-)
arch/x86/mm/pat/memtype.c +28 -24
@@ -984,29 +984,42 @@ static int get_pat_info(struct vm_area_struct *vma, resource_size_t *paddr,return -EINVAL ; } -/* -* track_pfn_copy is called when vma that is covering the pfnmap gets -* copied through copy_page_range(). -* -* If the vma has a linear pfn mapping for the entire range, we get the prot -* from pte and reserve the entire vma range with single reserve_pfn_range call. -*/ -int track_pfn_copy (struct vm_area_struct *vma) +int track_pfn_copy (struct vm_area_struct *dst_vma, +struct vm_area_struct *src_vma,unsigned long *pfn) { +const unsigned long vma_size = src_vma->vm_end - src_vma->vm_start;resource_size_t paddr; -unsigned long vma_size = vma->vm_end - vma->vm_start;pgprot_t pgprot; +int rc; -if (vma->vm_flags &VM_PAT ) { -if (get_pat_info (vma, &paddr, &pgprot)) -return -EINVAL ; -/* reserve the whole chunk covered by vma. */ -return reserve_pfn_range (paddr, vma_size, &pgprot,1 ); - } +if (!(src_vma->vm_flags &VM_PAT )) +return 0 ; + +/* +* Duplicate the PAT information for the dst VMA based on the src +* VMA. +*/ +if (get_pat_info (src_vma, &paddr, &pgprot)) +return -EINVAL ; + rc =reserve_pfn_range (paddr, vma_size, &pgprot,1 ); +if (rc) +return rc; +/* Reservation for the destination VMA succeeded. */ +vm_flags_set (dst_vma,VM_PAT ); + *pfn =PHYS_PFN (paddr);return 0 ; } +void untrack_pfn_copy (struct vm_area_struct *dst_vma,unsigned long pfn) +{ +untrack_pfn (dst_vma, pfn, dst_vma->vm_end - dst_vma->vm_start, true); +/* +* Reservation was freed, any copied page tables will get cleaned +* up later, but without getting PAT involved again. +*/ +} +/* * prot is passed in as a parameter for the new mapping. If the vma has * a linear pfn mapping for the entire range, or no vma is provided,
@@ -1095,15 +1108,6 @@ void untrack_pfn(struct vm_area_struct *vma, unsigned long pfn, } } -/* -* untrack_pfn_clear is called if the following situation fits: -* -* 1) while mremapping a pfnmap for a new region, with the old vma after -* its pfnmap page table has been removed. The new vma has a new pfnmap -* to the same pfn & cache type with VM_PAT set. -* 2) while duplicating vm area, the new vma fails to copy the pgtable from -* old vma. -*/ void untrack_pfn_clear (struct vm_area_struct *vma) {vm_flags_clear (vma,VM_PAT );
include/linux/pgtable.h +22 -6
@@ -1518,14 +1518,25 @@ static inline void track_pfn_insert(struct vm_area_struct *vma, pgprot_t *prot, }/* -* track_pfn_copy is called when vma that is covering the pfnmap gets -* copied through copy_page_range(). +* track_pfn_copy is called when a VM_PFNMAP VMA is about to get the page +* tables copied during copy_page_range(). On success, stores the pfn to be +* passed to untrack_pfn_copy(). */ -static inline int track_pfn_copy (struct vm_area_struct *vma) +static inline int track_pfn_copy (struct vm_area_struct *dst_vma, +struct vm_area_struct *src_vma,unsigned long *pfn) {return 0 ; } +/* +* untrack_pfn_copy is called when a VM_PFNMAP VMA failed to copy during +* copy_page_range(), but after track_pfn_copy() was already called. +*/ +static inline void untrack_pfn_copy (struct vm_area_struct *dst_vma, +unsigned long pfn) +{ +} +/* * untrack_pfn is called while unmapping a pfnmap for a region. * untrack can be called for a specific region indicated by pfn and size or
@@ -1538,8 +1549,10 @@ static inline void untrack_pfn(struct vm_area_struct *vma, }/* -* untrack_pfn_clear is called while mremapping a pfnmap for a new region -* or fails to copy pgtable during duplicate vm area. +* untrack_pfn_clear is called in the following cases on a VM_PFNMAP VMA: +* +* 1) During mremap() on the src VMA after the page tables were moved. +* 2) During fork() on the dst VMA, immediately after duplicating the src VMA. */ static inline void untrack_pfn_clear (struct vm_area_struct *vma) {
@@ -1550,7 +1563,10 @@ extern int track_pfn_remap(struct vm_area_struct *vma, pgprot_t *prot, unsigned long size);extern void track_pfn_insert (struct vm_area_struct *vma,pgprot_t *prot,pfn_t pfn); -extern int track_pfn_copy (struct vm_area_struct *vma); +extern int track_pfn_copy (struct vm_area_struct *dst_vma, +struct vm_area_struct *src_vma,unsigned long *pfn); +extern void untrack_pfn_copy (struct vm_area_struct *dst_vma, +unsigned long pfn);extern void untrack_pfn (struct vm_area_struct *vma,unsigned long pfn,unsigned long size,bool mm_wr_locked);extern void untrack_pfn_clear (struct vm_area_struct *vma);
kernel/fork.c +4 -0
@@ -505,6 +505,10 @@ struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig)vma_numab_state_init (new);dup_anon_vma_name (orig, new); +/* track_pfn_copy() will later take care of copying internal state. */ +if (unlikely (new->vm_flags &VM_PFNMAP )) +untrack_pfn_clear (new); +return new; }
mm/memory.c +4 -7
@@ -1356,12 +1356,12 @@ int copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma) { pgd_t *src_pgd, *dst_pgd; -unsigned long next;unsigned long addr = src_vma->vm_start;unsigned long end = src_vma->vm_end;struct mm_struct *dst_mm = dst_vma->vm_mm;struct mm_struct *src_mm = src_vma->vm_mm;struct mmu_notifier_range range; +unsigned long next, pfn;bool is_cow;int ret;
@@ -1372,11 +1372,7 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)return copy_hugetlb_page_range (dst_mm, src_mm, dst_vma, src_vma);if (unlikely (src_vma->vm_flags &VM_PFNMAP )) { -/* -* We do not free on error cases below as remove_vma -* gets called on error from higher level routine -*/ - ret =track_pfn_copy (src_vma); + ret =track_pfn_copy (dst_vma, src_vma, &pfn);if (ret)return ret; }
@@ -1413,7 +1409,6 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)continue ;if (unlikely (copy_p4d_range (dst_vma, src_vma, dst_pgd, src_pgd, addr, next))) { -untrack_pfn_clear (dst_vma); ret = -ENOMEM ;break ; }
@@ -1423,6 +1418,8 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)raw_write_seqcount_end (&src_mm->write_protect_seq);mmu_notifier_invalidate_range_end (&range); } +if (ret &&unlikely (src_vma->vm_flags &VM_PFNMAP )) +untrack_pfn_copy (dst_vma, pfn);return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 114/423 clk: renesas: r8a08g045: Check the source of the CPU PLL settings
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
[ Upstream commit dc0f16c1b76293ac942a783e960abfd19e95fdf5 ]
On the RZ/G3S SoC, the CPU PLL settings can be set and retrieved through the CPG_PLL1_CLK1 and CPG_PLL1_CLK2 registers. However, these settings are applied only when CPG_PLL1_SETTING.SEL_PLL1 is set to 0. Otherwise, the CPU PLL operates at the default frequency of 1.1 GHz. Hence add support to the PLL driver for returning the 1.1 GHz frequency when the CPU PLL is configured with the default frequency.
--- drivers/clk/renesas/r9a08g045-cpg.c | 5 +++-- drivers/clk/renesas/rzg2l-cpg.c | 13 ++++++++++++- drivers/clk/renesas/rzg2l-cpg.h | 10 +++++++--- 3 files changed, 22 insertions(+), 6 deletions(-)
drivers/clk/renesas/r9a08g045-cpg.c +3 -2
@@ -50,7 +50,7 @@#define G3S_SEL_SDHI2 SEL_PLL_PACK(G3S_CPG_SDHI_DSEL, 8, 2)/* PLL 1/4/6 configuration registers macro. */ -#define G3S_PLL146_CONF (clk1, clk2) ((clk1) << 22 | (clk2) << 12) +#define G3S_PLL146_CONF (clk1, clk2, setting) ((clk1) << 22 | (clk2) << 12 | (setting))#define DEF_G3S_MUX (_name, _id, _conf, _parent_names, _mux_flags, _clk_flags) \ DEF_TYPE(_name, _id, CLK_TYPE_MUX, .conf = (_conf), \
@@ -133,7 +133,8 @@ static const struct cpg_core_clk r9a08g045_core_clks[] __initconst = {/* Internal Core Clocks */ DEF_FIXED (".osc_div1000" ,CLK_OSC_DIV1000 ,CLK_EXTAL ,1 ,1000 ), -DEF_G3S_PLL (".pll1" ,CLK_PLL1 ,CLK_EXTAL ,G3S_PLL146_CONF (0x4 ,0x8 )), +DEF_G3S_PLL (".pll1" ,CLK_PLL1 ,CLK_EXTAL ,G3S_PLL146_CONF (0x4 ,0x8 ,0x100 ), +1100000000UL ),DEF_FIXED (".pll2" ,CLK_PLL2 ,CLK_EXTAL ,200 ,3 ),DEF_FIXED (".pll3" ,CLK_PLL3 ,CLK_EXTAL ,200 ,3 ), DEF_FIXED(".pll4", CLK_PLL4, CLK_EXTAL, 100, 3),
drivers/clk/renesas/rzg2l-cpg.c +12 -1
@@ -51,6 +51,7 @@#define RZG3S_DIV_M GENMASK(25, 22)#define RZG3S_DIV_NI GENMASK(21, 13)#define RZG3S_DIV_NF GENMASK(12, 1) +#define RZG3S_SEL_PLL BIT(0)#define CLK_ON_R (reg) (reg)#define CLK_MON_R (reg) (0x180 + (reg))
@@ -60,6 +61,7 @@#define GET_REG_OFFSET (val) ((val >> 20) & 0xfff)#define GET_REG_SAMPLL_CLK1 (val) ((val >> 22) & 0xfff)#define GET_REG_SAMPLL_CLK2 (val) ((val >> 12) & 0xfff) +#define GET_REG_SAMPLL_SETTING (val) ((val) & 0xfff)#define CPG_WEN_BIT BIT(16)
@@ -943,6 +945,7 @@ rzg2l_cpg_sipll5_register(const struct cpg_core_clk *core,struct pll_clk {struct clk_hw hw; +unsigned long default_rate;unsigned int conf;unsigned int type;void __iomem *base;
@@ -980,12 +983,19 @@ static unsigned long rzg3s_cpg_pll_clk_recalc_rate(struct clk_hw *hw, {struct pll_clk *pll_clk =to_pll (hw);struct rzg2l_cpg_priv *priv = pll_clk->priv; -u32 nir, nfr, mr, pr, val; +u32 nir, nfr, mr, pr, val, setting;u64 rate;if (pll_clk->type !=CLK_TYPE_G3S_PLL )return parent_rate; + setting =GET_REG_SAMPLL_SETTING (pll_clk->conf); +if (setting) { + val =readl (priv->base + setting); +if (val &RZG3S_SEL_PLL ) +return pll_clk->default_rate; + } + val =readl (priv->base +GET_REG_SAMPLL_CLK1 (pll_clk->conf)); pr =1 <<FIELD_GET (RZG3S_DIV_P , val);
@@ -1038,6 +1048,7 @@ rzg2l_cpg_pll_clk_register(const struct cpg_core_clk *core, pll_clk->base = priv->base; pll_clk->priv = priv; pll_clk->type = core->type; + pll_clk->default_rate = core->default_rate; ret =devm_clk_hw_register (dev, &pll_clk->hw);if (ret)
drivers/clk/renesas/rzg2l-cpg.h +7 -3
@@ -102,7 +102,10 @@ struct cpg_core_clk {const struct clk_div_table *dtable;const u32 *mtable;const unsigned long invalid_rate; -const unsigned long max_rate; +union { +const unsigned long max_rate; +const unsigned long default_rate; + };const char *const *parent_names;notifier_fn_t notifier;u32 flag;
@@ -144,8 +147,9 @@ enum clk_types { DEF_TYPE(_name, _id, _type, .parent = _parent)#define DEF_SAMPLL (_name, _id, _parent, _conf) \ DEF_TYPE(_name, _id, CLK_TYPE_SAM_PLL, .parent = _parent, .conf = _conf) -#define DEF_G3S_PLL (_name, _id, _parent, _conf) \ - DEF_TYPE(_name, _id, CLK_TYPE_G3S_PLL, .parent = _parent, .conf = _conf) +#define DEF_G3S_PLL (_name, _id, _parent, _conf, _default_rate) \ + DEF_TYPE(_name, _id, CLK_TYPE_G3S_PLL, .parent = _parent, .conf = _conf, \ + .default_rate = _default_rate)#define DEF_INPUT (_name, _id) \ DEF_TYPE(_name, _id, CLK_TYPE_IN)#define DEF_FIXED (_name, _id, _parent, _mult, _div) \
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 115/423 remoteproc: qcom: pas: add minidump_id to SC7280 WPSS
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit d2909538bff0189d4d038f4e903c70be5f5c2bfc ]
Add the minidump ID to the wpss resources, based on msm-5.4 devicetree.
--- drivers/remoteproc/qcom_q6v5_pas.c | 1 + 1 file changed, 1 insertion(+)
drivers/remoteproc/qcom_q6v5_pas.c +1 -0
@@ -1356,6 +1356,7 @@ static const struct adsp_data sc7280_wpss_resource = { .crash_reason_smem = 626, .firmware_name = "wpss.mdt", .pas_id = 6, + .minidump_id = 4, .auto_boot = false, .proxy_pd_names = (char *[]){"cx" ,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 116/423 clk: samsung: Fix UBSAN panic in samsung_clk_init()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will McVicker <[email protected]>
[ Upstream commit d19d7345a7bcdb083b65568a11b11adffe0687af ]
With UBSAN_ARRAY_BOUNDS=y, I'm hitting the below panic due to dereferencing ctx->clk_data.hws before setting ctx->clk_data.num = nr_clks. Move that up to fix the crash.
UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP <snip> Call trace: samsung_clk_init+0x110/0x124 (P) samsung_clk_init+0x48/0x124 (L) samsung_cmu_register_one+0x3c/0xa0 exynos_arm64_register_cmu+0x54/0x64 __gs101_cmu_top_of_clk_init_declare+0x28/0x60 ...
--- drivers/clk/samsung/clk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/samsung/clk.c +1 -1
@@ -74,12 +74,12 @@ struct samsung_clk_provider * __init samsung_clk_init(struct device *dev,if (!ctx)panic ("could not allocate clock provider context.\n" ); + ctx->clk_data.num = nr_clks;for (i =0 ; i < nr_clks; ++i) ctx->clk_data.hws[i] =ERR_PTR (-ENOENT ); ctx->dev = dev; ctx->reg_base = base; - ctx->clk_data.num = nr_clks;spin_lock_init (&ctx->lock);return ctx;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 117/423 pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yue Haibing <[email protected]>
[ Upstream commit d6c6fd77e5816e3f6689a2767cdd777797506f24 ]
fwnode_irq_get() was changed to not return 0, fix this by checking for negative error, also update the error log.
--- drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c +2 -2
@@ -2361,8 +2361,8 @@ static int npcm8xx_gpio_fw(struct npcm8xx_pinctrl *pctrl)return dev_err_probe (dev, ret,"gpio-ranges fail for GPIO bank %u\n" , id); ret =fwnode_irq_get (child,0 ); -if (!ret) -return dev_err_probe (dev, ret,"No IRQ for GPIO bank %u\n" , id); +if (ret <0 ) +return dev_err_probe (dev, ret,"Failed to retrieve IRQ for bank %u\n" , id); pctrl->gpio_bank[id].irq = ret; pctrl->gpio_bank[id].irq_chip = npcmgpio_irqchip;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 118/423 crypto: tegra - Fix CMAC intermediate result handling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil R <[email protected]>
[ Upstream commit ce390d6c2675d2e24d798169a1a0e3cdbc076907 ]
Saving and restoring of the intermediate results are needed if there is context switch caused by another ongoing request on the same engine. This is therefore not only to support import/export functionality. Hence, save and restore the intermediate result for every non-first task.
--- drivers/crypto/tegra/tegra-se-aes.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/crypto/tegra/tegra-se-aes.c +9 -9
@@ -1513,9 +1513,8 @@ static int tegra_cmac_do_update(struct ahash_request *req) rctx->residue.size = nresidue;/* -* If this is not the first 'update' call, paste the previous copied +* If this is not the first task, paste the previous copied * intermediate results to the registers so that it gets picked up. -* This is to support the import/export functionality. */ if (!(rctx->task &SHA_FIRST ))tegra_cmac_paste_result (ctx->se, rctx);
@@ -1523,13 +1522,7 @@ static int tegra_cmac_do_update(struct ahash_request *req) cmdlen =tegra_cmac_prep_cmd (ctx, rctx); ret =tegra_se_host1x_submit (se, se->cmdbuf, cmdlen); -/* -* If this is not the final update, copy the intermediate results -* from the registers so that it can be used in the next 'update' -* call. This is to support the import/export functionality. -*/ -if (!(rctx->task &SHA_FINAL )) -tegra_cmac_copy_result (ctx->se, rctx); +tegra_cmac_copy_result (ctx->se, rctx);return ret; }
@@ -1553,6 +1546,13 @@ static int tegra_cmac_do_final(struct ahash_request *req) rctx->total_len += rctx->residue.size; rctx->config =tegra234_aes_cfg (SE_ALG_CMAC ,0 ); +/* +* If this is not the first task, paste the previous copied +* intermediate results to the registers so that it gets picked up. +*/ +if (!(rctx->task &SHA_FIRST )) +tegra_cmac_paste_result (ctx->se, rctx); +/* Prepare command and submit */ cmdlen =tegra_cmac_prep_cmd (ctx, rctx); ret =tegra_se_host1x_submit (se, se->cmdbuf, cmdlen);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 119/423 clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Lypak <[email protected]>
[ Upstream commit cdc59600bccf2cb4c483645438a97d4ec55f326b ]
This clock can't be enable with VENUS_CORE0 GDSC turned off. But that GDSC is under HW control so it can be turned off at any moment. Instead of checking the dependent clock we can just vote for it to enable later when GDSC gets turned on.
--- drivers/clk/qcom/gcc-msm8953.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/qcom/gcc-msm8953.c +1 -1
@@ -3770,7 +3770,7 @@ static struct clk_branch gcc_venus0_axi_clk = {static struct clk_branch gcc_venus0_core0_vcodec0_clk = { .halt_reg =0x4c02c , - .halt_check =BRANCH_HALT , + .halt_check =BRANCH_HALT_SKIP , .clkr = { .enable_reg =0x4c02c , .enable_mask =BIT (0 ),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 120/423 s390: Remove ioremap_wt() and pgprot_writethrough()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <[email protected]>
[ Upstream commit c94bff63e49302d4ce36502a85a2710a67332a4f ]
It turns out that while s390 architecture calls its memory-I/O mapping variants write-through and write-back the implementation of ioremap_wt() and pgprot_writethrough() does not match Linux notion of ioremap_wt().
In particular Linux expects ioremap_wt() to be weaker still than ioremap_wc(), allowing not just gathering and re-ordering but also reads to be served from cache. Instead s390's implementation is equivalent to normal ioremap() while its ioremap_wc() allows re-ordering.
Note that there are no known users of ioremap_wt() on s390 and the resulting behavior is in line with asm-generic defining ioremap_wt() as ioremap(), if undefined, so no breakage is expected.
As s390 does not have a mapping type matching the Linux notion of ioremap_wt() and pgprot_writethrough(), simply drop them and rely on the asm-generic fallbacks instead.
--- arch/s390/include/asm/io.h | 2 -- arch/s390/include/asm/pgtable.h | 3 --- arch/s390/mm/pgtable.c | 10 ---------- 3 files changed, 15 deletions(-)
arch/s390/include/asm/io.h +0 -2
@@ -34,8 +34,6 @@ void unxlate_dev_mem_ptr(phys_addr_t phys, void *addr);#define ioremap_wc (addr, size) \ ioremap_prot((addr), (size), pgprot_val(pgprot_writecombine(PAGE_KERNEL))) -#define ioremap_wt (addr, size) \ - ioremap_prot((addr), (size), pgprot_val(pgprot_writethrough(PAGE_KERNEL)))static inline void __iomem *ioport_map (unsigned long port,unsigned int nr) {
arch/s390/include/asm/pgtable.h +0 -3
@@ -1365,9 +1365,6 @@ void gmap_pmdp_idte_global(struct mm_struct *mm, unsigned long vmaddr);#define pgprot_writecombine pgprot_writecombinepgprot_t pgprot_writecombine (pgprot_t prot); -#define pgprot_writethrough pgprot_writethrough -pgprot_t pgprot_writethrough (pgprot_t prot); -#define PFN_PTE_SHIFT PAGE_SHIFT/*
arch/s390/mm/pgtable.c +0 -10
@@ -34,16 +34,6 @@ pgprot_t pgprot_writecombine(pgprot_t prot) }EXPORT_SYMBOL_GPL (pgprot_writecombine); -pgprot_t pgprot_writethrough (pgprot_t prot) -{ -/* -* mio_wb_bit_mask may be set on a different CPU, but it is only set -* once at init and only read afterwards. -*/ -return __pgprot (pgprot_val (prot) & ~mio_wb_bit_mask); -} -EXPORT_SYMBOL_GPL (pgprot_writethrough); -static inline void ptep_ipte_local (struct mm_struct *mm,unsigned long addr,pte_t *ptep,int nodat) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 121/423 RDMA/mana_ib: Ensure variable err is initialized
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Bakker <[email protected]>
[ Upstream commit be35a3127d60964b338da95c7bfaaf4a01b330d4 ]
In the function mana_ib_gd_create_dma_region if there are no dma blocks to process the variable err remains uninitialized.
--- drivers/infiniband/hw/mana/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/mana/main.c +1 -1
@@ -358,7 +358,7 @@ static int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umemunsigned int tail =0 ;u64 *page_addr_list;void *request_buf; -int err; +int err =0 ; gc =mdev_to_gc (dev); hwc = gc->hwc.driver_data;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 122/423 crypto: tegra - Set IV to NULL explicitly for AES ECB
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil R <[email protected]>
[ Upstream commit bde558220866e74f19450e16d9a2472b488dfedf ]
It may happen that the variable req->iv may have stale values or zero sized buffer by default and may end up getting used during encryption/decryption. This inturn may corrupt the results or break the operation. Set the req->iv variable to NULL explicitly for algorithms like AES-ECB where IV is not used.
--- drivers/crypto/tegra/tegra-se-aes.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/crypto/tegra/tegra-se-aes.c +3 -0
@@ -443,6 +443,9 @@ static int tegra_aes_crypt(struct skcipher_request *req, bool encrypt)if (!req->cryptlen)return 0 ; +if (ctx->alg ==SE_ALG_ECB ) + req->iv =NULL ; + rctx->encrypt = encrypt; rctx->config =tegra234_aes_cfg (ctx->alg, encrypt); rctx->crypto_config =tegra234_aes_crypto_cfg (ctx->alg, encrypt);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 123/423 remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit ba785ff4162a65f18ed501019637a998b752b5ad ]
MSM8226 requires the CX power domain, so use the msm8996_adsp_resource which has cx under proxy_pd_names and is otherwise equivalent.
--- drivers/remoteproc/qcom_q6v5_pas.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/remoteproc/qcom_q6v5_pas.c +1 -1
@@ -1419,7 +1419,7 @@ static const struct adsp_data sm8650_mpss_resource = { };static const struct of_device_id adsp_of_match[] = { - { .compatible ="qcom,msm8226-adsp-pil" , .data = &adsp_resource_init}, + { .compatible ="qcom,msm8226-adsp-pil" , .data = &msm8996_adsp_resource}, { .compatible ="qcom,msm8953-adsp-pil" , .data = &msm8996_adsp_resource}, { .compatible ="qcom,msm8974-adsp-pil" , .data = &adsp_resource_init}, { .compatible ="qcom,msm8996-adsp-pil" , .data = &msm8996_adsp_resource},
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 124/423 clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit b60521eff227ef459e03879cbea2b2bd85a8d7af ]
The GPU clock is required for CPU access to GPUSS registers. It was previously decided (on this and many more platforms) that the added overhead/hassle introduced by keeping track of it would not bring much measurable improvement in the power department.
The display clock is basically the same story over again.
Now, we're past that discussion and this commit is not trying to change that. Instead, the clocks are both force-enabled in .probe *and* registered with the common clock framework, resulting in them being toggled off after ignore_unused.
Unregister said clocks to fix breakage when clk_ignore_unused is absent (as it should be).
--- drivers/clk/qcom/gcc-x1e80100.c | 30 ------------------------------ 1 file changed, 30 deletions(-)
drivers/clk/qcom/gcc-x1e80100.c +0 -30
@@ -2564,19 +2564,6 @@ static struct clk_branch gcc_disp_hf_axi_clk = { }, }; -static struct clk_branch gcc_disp_xo_clk = { - .halt_reg =0x27018 , - .halt_check =BRANCH_HALT , - .clkr = { - .enable_reg =0x27018 , - .enable_mask =BIT (0 ), - .hw.init = &(const struct clk_init_data ) { - .name ="gcc_disp_xo_clk" , - .ops = &clk_branch2_ops, - }, - }, -}; -static struct clk_branch gcc_gp1_clk = { .halt_reg =0x64000 , .halt_check =BRANCH_HALT ,
@@ -2631,21 +2618,6 @@ static struct clk_branch gcc_gp3_clk = { }, }; -static struct clk_branch gcc_gpu_cfg_ahb_clk = { - .halt_reg =0x71004 , - .halt_check =BRANCH_HALT_VOTED , - .hwcg_reg =0x71004 , - .hwcg_bit =1 , - .clkr = { - .enable_reg =0x71004 , - .enable_mask =BIT (0 ), - .hw.init = &(const struct clk_init_data ) { - .name ="gcc_gpu_cfg_ahb_clk" , - .ops = &clk_branch2_ops, - }, - }, -}; -static struct clk_branch gcc_gpu_gpll0_cph_clk_src = { .halt_check =BRANCH_HALT_DELAY , .clkr = {
@@ -6268,7 +6240,6 @@ static struct clk_regmap *gcc_x1e80100_clocks[] = { [GCC_CNOC_PCIE_TUNNEL_CLK] = &gcc_cnoc_pcie_tunnel_clk.clkr, [GCC_DDRSS_GPU_AXI_CLK] = &gcc_ddrss_gpu_axi_clk.clkr, [GCC_DISP_HF_AXI_CLK] = &gcc_disp_hf_axi_clk.clkr, - [GCC_DISP_XO_CLK] = &gcc_disp_xo_clk.clkr, [GCC_GP1_CLK] = &gcc_gp1_clk.clkr, [GCC_GP1_CLK_SRC] = &gcc_gp1_clk_src.clkr, [GCC_GP2_CLK] = &gcc_gp2_clk.clkr,
@@ -6281,7 +6252,6 @@ static struct clk_regmap *gcc_x1e80100_clocks[] = { [GCC_GPLL7] = &gcc_gpll7.clkr, [GCC_GPLL8] = &gcc_gpll8.clkr, [GCC_GPLL9] = &gcc_gpll9.clkr, - [GCC_GPU_CFG_AHB_CLK] = &gcc_gpu_cfg_ahb_clk.clkr, [GCC_GPU_GPLL0_CPH_CLK_SRC] = &gcc_gpu_gpll0_cph_clk_src.clkr, [GCC_GPU_GPLL0_DIV_CPH_CLK_SRC] = &gcc_gpu_gpll0_div_cph_clk_src.clkr, [GCC_GPU_MEMNOC_GFX_CLK] = &gcc_gpu_memnoc_gfx_clk.clkr,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 125/423 bpf: Use preempt_count() directly in bpf_send_signal_common()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <[email protected]>
[ Upstream commit b4a8b5bba712a711d8ca1f7d04646db63f9c88f5 ]
bpf_send_signal_common() uses preemptible() to check whether or not the current context is preemptible. If it is preemptible, it will use irq_work to send the signal asynchronously instead of trying to hold a spin-lock, because spin-lock is sleepable under PREEMPT_RT.
However, preemptible() depends on CONFIG_PREEMPT_COUNT. When CONFIG_PREEMPT_COUNT is turned off (e.g., CONFIG_PREEMPT_VOLUNTARY=y), !preemptible() will be evaluated as 1 and bpf_send_signal_common() will use irq_work unconditionally.
Fix it by unfolding "!preemptible()" and using "preempt_count() != 0 || irqs_disabled()" instead.
--- kernel/trace/bpf_trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/bpf_trace.c +1 -1
@@ -833,7 +833,7 @@ static int bpf_send_signal_common(u32 sig, enum pid_type type)if (unlikely (is_global_init (current)))return -EPERM ; -if (!preemptible ()) { +if (preempt_count () !=0 ||irqs_disabled ()) {/* Do an early check on signal validity. Otherwise, * the error is lost in deferred irq_work. */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 126/423 lib: 842: Improve error handling in sw842_compress()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tanya Agarwal <[email protected]>
[ Upstream commit af324dc0e2b558678aec42260cce38be16cc77ca ]
The static code analysis tool "Coverity Scan" pointed the following implementation details out for further development considerations:
CID 1309755: Unused value
In sw842_compress: A value assigned to a variable is never used. (CWE-563)returned_value: Assigning value from add_repeat_template(p, repeat_count) to ret here, but that stored value is overwritten before it can be used.
Conclusion:
Add error handling for the return value from an add_repeat_template() call.
--- lib/842/842_compress.c | 2 ++ 1 file changed, 2 insertions(+)
lib/842/842_compress.c +2 -0
@@ -532,6 +532,8 @@ int sw842_compress(const u8 *in, unsigned int ilen, }if (repeat_count) { ret =add_repeat_template (p, repeat_count); +if (ret) +return ret; repeat_count =0 ;if (next == last)/* reached max repeat bits */ goto repeat;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 127/423 pinctrl: renesas: rza2: Fix missing of_node_put() call
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabrizio Castro <[email protected]>
[ Upstream commit abcdeb4e299a11ecb5a3ea0cce00e68e8f540375 ]
of_parse_phandle_with_fixed_args() requires its caller to call into of_node_put() on the node pointer from the output structure, but such a call is currently missing.
Call into of_node_put() to rectify that.
--- drivers/pinctrl/renesas/pinctrl-rza2.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pinctrl/renesas/pinctrl-rza2.c +2 -0
@@ -253,6 +253,8 @@ static int rza2_gpio_register(struct rza2_pinctrl_priv *priv)return ret; } +of_node_put (of_args.np); +if ((of_args.args[0 ] !=0 ) || (of_args.args[1 ] !=0 ) || (of_args.args[2 ] != priv->npins)) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 128/423 pinctrl: renesas: rzg2l: Fix missing of_node_put() call
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabrizio Castro <[email protected]>
[ Upstream commit a5779e625e2b377f16a6675c432aaf299ce5028c ]
of_parse_phandle_with_fixed_args() requires its caller to call into of_node_put() on the node pointer from the output structure, but such a call is currently missing.
Call into of_node_put() to rectify that.
--- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pinctrl/renesas/pinctrl-rzg2l.c +2 -0
@@ -2583,6 +2583,8 @@ static int rzg2l_gpio_register(struct rzg2l_pinctrl *pctrl)if (ret)return dev_err_probe (pctrl->dev, ret,"Unable to parse gpio-ranges\n" ); +of_node_put (of_args.np); +if (of_args.args[0 ] !=0 || of_args.args[1 ] !=0 || of_args.args[2 ] != pctrl->data->n_port_pins) return dev_err_probe(pctrl->dev, -EINVAL,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 129/423 RDMA/mlx5: Fix MR cache initialization error flow
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Guralnik <[email protected]>
[ Upstream commit a0130ef84b00c68ba0b79ee974a0f01459741421 ]
Destroy all previously created cache entries and work queue when rolling back the MR cache initialization upon an error.
--- drivers/infiniband/hw/mlx5/mr.c | 33 ++++++++++++++++++++++----------- 1 file changed, 22 insertions(+), 11 deletions(-)
drivers/infiniband/hw/mlx5/mr.c +22 -11
@@ -919,6 +919,25 @@ mlx5r_cache_create_ent_locked(struct mlx5_ib_dev *dev,return ERR_PTR (ret); } +static void mlx5r_destroy_cache_entries (struct mlx5_ib_dev *dev) +{ +struct rb_root *root = &dev->cache.rb_root; +struct mlx5_cache_ent *ent; +struct rb_node *node; + +mutex_lock (&dev->cache.rb_lock); + node =rb_first (root); +while (node) { + ent = rb_entry(node, struct mlx5_cache_ent, node); + node =rb_next (node); +clean_keys (dev, ent); +rb_erase (&ent->node, root); +mlx5r_mkeys_uninit (ent); +kfree (ent); + } +mutex_unlock (&dev->cache.rb_lock); +} +int mlx5_mkey_cache_init (struct mlx5_ib_dev *dev) {struct mlx5_mkey_cache *cache = &dev->cache;
@@ -970,6 +989,8 @@ int mlx5_mkey_cache_init(struct mlx5_ib_dev *dev) err:mutex_unlock (&cache->rb_lock);mlx5_mkey_cache_debugfs_cleanup (dev); +mlx5r_destroy_cache_entries (dev); +destroy_workqueue (cache->wq);mlx5_ib_warn (dev,"failed to create mkey cache entry\n" );return ret; }
@@ -1003,17 +1024,7 @@ void mlx5_mkey_cache_cleanup(struct mlx5_ib_dev *dev)mlx5_cmd_cleanup_async_ctx (&dev->async_ctx);/* At this point all entries are disabled and have no concurrent work. */ -mutex_lock (&dev->cache.rb_lock); - node =rb_first (root); -while (node) { - ent = rb_entry(node, struct mlx5_cache_ent, node); - node =rb_next (node); -clean_keys (dev, ent); -rb_erase (&ent->node, root); -mlx5r_mkeys_uninit (ent); -kfree (ent); - } -mutex_unlock (&dev->cache.rb_lock); +mlx5r_destroy_cache_entries (dev);destroy_workqueue (dev->cache.wq);del_timer_sync (&dev->delay_timer);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 130/423 selftests/bpf: Fix freplace_link segfault in tailcalls prog test
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tengda Wu <[email protected]>
[ Upstream commit a63a631c9b5cb25a1c17dd2cb18c63df91e978b1 ]
There are two bpf_link__destroy(freplace_link) calls in test_tailcall_bpf2bpf_freplace(). After the first bpf_link__destroy() is called, if the following bpf_map_{update,delete}_elem() throws an exception, it will jump to the "out" label and call bpf_link__destroy() again, causing double free and eventually leading to a segfault.
Fix it by directly resetting freplace_link to NULL after the first bpf_link__destroy() call.
--- tools/testing/selftests/bpf/prog_tests/tailcalls.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/bpf/prog_tests/tailcalls.c +1 -0
@@ -1599,6 +1599,7 @@ static void test_tailcall_bpf2bpf_freplace(void) goto out; err =bpf_link__destroy (freplace_link); + freplace_link =NULL ;if (!ASSERT_OK (err,"destroy link" )) goto out;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 131/423 clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Geis <[email protected]>
[ Upstream commit a9e60f1ffe1ca57d6af6a2573e2f950e76efbf5b ]
Correct the clk_ref_usb3otg parent to fix clock control for the usb3 controller on rk3328. Verified against the rk3328 trm, the rk3228h trm, and the rk3328 usb3 phy clock map.
--- drivers/clk/rockchip/clk-rk3328.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/rockchip/clk-rk3328.c +1 -1
@@ -201,7 +201,7 @@ PNAME(mux_aclk_peri_pre_p) = { "cpll_peri","gpll_peri" , "hdmiphy_peri" };PNAME (mux_ref_usb3otg_src_p) = {"xin24m" , -"clk_usb3otg_ref" }; +"clk_ref_usb3otg_src" };PNAME (mux_xin24m_32k_p) = {"xin24m" ,"clk_rtc32k" }; PNAME(mux_mac2io_src_p) = { "clk_mac2io_src",
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 132/423 RDMA/core: Dont expose hw_counters outside of init net namespace
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Gushchin <[email protected]>
[ Upstream commit a1ecb30f90856b0be4168ad51b8875148e285c1f ]
Commit 467f432a521a ("RDMA/core: Split port and device counter sysfs attributes") accidentally almost exposed hw counters to non-init net namespaces. It didn't expose them fully, as an attempt to read any of those counters leads to a crash like this one:
[42021.807566] BUG: kernel NULL pointer dereference, address: 0000000000000028 [42021.814463] #PF: supervisor read access in kernel mode [42021.819549] #PF: error_code(0x0000) - not-present page [42021.824636] PGD 0 P4D 0 [42021.827145] Oops: 0000 [#1] SMP PTI [42021.830598] CPU: 82 PID: 2843922 Comm: switchto-defaul Kdump: loaded Tainted: G S W I XXX [42021.841697] Hardware name: XXX [42021.849619] RIP: 0010:hw_stat_device_show+0x1e/0x40 [ib_core] [42021.855362] Code: 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 49 89 d0 4c 8b 5e 20 48 8b 8f b8 04 00 00 48 81 c7 f0 fa ff ff <48> 8b 41 28 48 29 ce 48 83 c6 d0 48 c1 ee 04 69 d6 ab aa aa aa 48 [42021.873931] RSP: 0018:ffff97fe90f03da0 EFLAGS: 00010287 [42021.879108] RAX: ffff9406988a8c60 RBX: ffff940e1072d438 RCX: 0000000000000000 [42021.886169] RDX: ffff94085f1aa000 RSI: ffff93c6cbbdbcb0 RDI: ffff940c7517aef0 [42021.893230] RBP: ffff97fe90f03e70 R08: ffff94085f1aa000 R09: 0000000000000000 [42021.900294] R10: ffff94085f1aa000 R11: ffffffffc0775680 R12: ffffffff87ca2530 [42021.907355] R13: ffff940651602840 R14: ffff93c6cbbdbcb0 R15: ffff94085f1aa000 [42021.914418] FS: 00007fda1a3b9700(0000) GS:ffff94453fb80000(0000) knlGS:0000000000000000 [42021.922423] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [42021.928130] CR2: 0000000000000028 CR3: 00000042dcfb8003 CR4: 00000000003726f0 [42021.935194] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [42021.942257] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [42021.949324] Call Trace: [42021.951756] <TASK> [42021.953842] [<ffffffff86c58674>] ? show_regs+0x64/0x70 [42021.959030] [<ffffffff86c58468>] ? __die+0x78/0xc0 [42021.963874] [<ffffffff86c9ef75>] ? page_fault_oops+0x2b5/0x3b0 [42021.969749] [<ffffffff87674b92>] ? exc_page_fault+0x1a2/0x3c0 [42021.975549] [<ffffffff87801326>] ? asm_exc_page_fault+0x26/0x30 [42021.981517] [<ffffffffc0775680>] ? __pfx_show_hw_stats+0x10/0x10 [ib_core] [42021.988482] [<ffffffffc077564e>] ? hw_stat_device_show+0x1e/0x40 [ib_core] [42021.995438] [<ffffffff86ac7f8e>] dev_attr_show+0x1e/0x50 [42022.000803] [<ffffffff86a3eeb1>] sysfs_kf_seq_show+0x81/0xe0 [42022.006508] [<ffffffff86a11134>] seq_read_iter+0xf4/0x410 [42022.011954] [<ffffffff869f4b2e>] vfs_read+0x16e/0x2f0 [42022.017058] [<ffffffff869f50ee>] ksys_read+0x6e/0xe0 [42022.022073] [<ffffffff8766f1ca>] do_syscall_64+0x6a/0xa0 [42022.027441] [<ffffffff8780013b>] entry_SYSCALL_64_after_hwframe+0x78/0xe2
The problem can be reproduced using the following steps:
ip netns add foo
ip netns exec foo bash
cat /sys/class/infiniband/mlx4_0/hw_counters/*
The panic occurs because of casting the device pointer into an ib_device pointer using container_of() in hw_stat_device_show() is wrong and leads to a memory corruption.
However the real problem is that hw counters should never been exposed outside of the non-init net namespace.
Fix this by saving the index of the corresponding attribute group (it might be 1 or 2 depending on the presence of driver-specific attributes) and zeroing the pointer to hw_counters group for compat devices during the initialization.
With this fix applied hw_counters are not available in a non-init net namespace:
find /sys/class/infiniband/mlx4_0/ -name hw_counters
/sys/class/infiniband/mlx4_0/ports/1/hw_counters /sys/class/infiniband/mlx4_0/ports/2/hw_counters /sys/class/infiniband/mlx4_0/hw_counters
ip netns add foo
ip netns exec foo bash
find /sys/class/infiniband/mlx4_0/ -name hw_counters
--- drivers/infiniband/core/device.c | 9 +++++++++ drivers/infiniband/core/sysfs.c | 1 + include/rdma/ib_verbs.h | 1 + 3 files changed, 11 insertions(+)
drivers/infiniband/core/device.c +9 -0
@@ -544,6 +544,8 @@ static struct class ib_class = {static void rdma_init_coredev (struct ib_core_device *coredev,struct ib_device *dev,struct net *net) { +bool is_full_dev = &dev->coredev == coredev; +/* This BUILD_BUG_ON is intended to catch layout change * of union of ib_core_device and device. * dev must be the first element as ib_core and providers
@@ -555,6 +557,13 @@ static void rdma_init_coredev(struct ib_core_device *coredev, coredev->dev.class = &ib_class; coredev->dev.groups = dev->groups; + +/* +* Don't expose hw counters outside of the init namespace. +*/ +if (!is_full_dev && dev->hw_stats_attr_index) + coredev->dev.groups[dev->hw_stats_attr_index] =NULL ; +device_initialize (&coredev->dev); coredev->owner = dev;INIT_LIST_HEAD (&coredev->port_list);
drivers/infiniband/core/sysfs.c +1 -0
@@ -988,6 +988,7 @@ int ib_setup_device_attrs(struct ib_device *ibdev)for (i =0 ; i !=ARRAY_SIZE (ibdev->groups); i++)if (!ibdev->groups[i]) { ibdev->groups[i] = &data->group; + ibdev->hw_stats_attr_index = i;return 0 ; }WARN (true,"struct ib_device->groups is too small" );
include/rdma/ib_verbs.h +1 -0
@@ -2737,6 +2737,7 @@ struct ib_device {* It is a NULL terminated array. */ const struct attribute_group *groups[4 ]; +u8 hw_stats_attr_index;u64 uverbs_cmd_mask;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 133/423 RDMA/mlx5: Fix calculation of total invalidated pages
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chiara Meiohas <[email protected]>
[ Upstream commit 79195147644653ebffadece31a42181e4c48c07d ]
When invalidating an address range in mlx5, there is an optimization to do UMR operations in chunks.
Previously, the invalidation counter was incorrectly updated for the same indexes within a chunk. Now, the invalidation counter is updated only when a chunk is complete and mlx5r_umr_update_xlt() is called. This ensures that the counter accurately represents the number of pages invalidated using UMR.
--- drivers/infiniband/hw/mlx5/odp.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/infiniband/hw/mlx5/odp.c +6 -4
@@ -309,9 +309,6 @@ static bool mlx5_ib_invalidate_range(struct mmu_interval_notifier *mni, blk_start_idx = idx; in_block =1 ; } - -/* Count page invalidations */ - invalidations += idx - blk_start_idx +1 ; }else {u64 umr_offset = idx & umr_block_mask;
@@ -321,14 +318,19 @@ static bool mlx5_ib_invalidate_range(struct mmu_interval_notifier *mni,MLX5_IB_UPD_XLT_ZAP | MLX5_IB_UPD_XLT_ATOMIC); in_block =0 ; +/* Count page invalidations */ + invalidations += idx - blk_start_idx +1 ; } } } -if (in_block) +if (in_block) {mlx5r_umr_update_xlt (mr, blk_start_idx, idx - blk_start_idx +1 ,0 ,MLX5_IB_UPD_XLT_ZAP |MLX5_IB_UPD_XLT_ATOMIC ); +/* Count page invalidations */ + invalidations += idx - blk_start_idx +1 ; + }mlx5_update_odp_stats (mr, invalidations, invalidations);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 134/423 RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cheng Xu <[email protected]>
[ Upstream commit 83437689249e6a17b25e27712fbee292e42e7855 ]
After the erdma_cep_put(new_cep) being called, new_cep will be freed, and the following dereference will cause a UAF problem. Fix this issue.
--- drivers/infiniband/hw/erdma/erdma_cm.c | 1 - 1 file changed, 1 deletion(-)
drivers/infiniband/hw/erdma/erdma_cm.c +0 -1
@@ -705,7 +705,6 @@ static void erdma_accept_newconn(struct erdma_cep *cep)erdma_cancel_mpatimer (new_cep);erdma_cep_put (new_cep); - new_cep->sock =NULL ; }if (new_s) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 135/423 remoteproc: qcom_q6v5_mss: Handle platforms with one power domain
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit 4641840341f37dc8231e0840ec1514b4061b4322 ]
For example MSM8974 has mx voltage rail exposed as regulator and only cx voltage rail is exposed as power domain. This power domain (cx) is attached internally in power domain and cannot be attached in this driver.
--- drivers/remoteproc/qcom_q6v5_mss.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-)
drivers/remoteproc/qcom_q6v5_mss.c +17 -4
@@ -1839,6 +1839,13 @@ static int q6v5_pds_attach(struct device *dev, struct device **devs,while (pd_names[num_pds]) num_pds++; +/* Handle single power domain */ +if (num_pds ==1 && dev->pm_domain) { + devs[0 ] = dev; +pm_runtime_enable (dev); +return 1 ; + } +for (i =0 ; i < num_pds; i++) { devs[i] =dev_pm_domain_attach_by_name (dev, pd_names[i]);if (IS_ERR_OR_NULL (devs[i])) {
@@ -1859,8 +1866,15 @@ static int q6v5_pds_attach(struct device *dev, struct device **devs,static void q6v5_pds_detach (struct q6v5 *qproc,struct device **pds,size_t pd_count) { +struct device *dev = qproc->dev;int i; +/* Handle single power domain */ +if (pd_count ==1 && dev->pm_domain) { +pm_runtime_disable (dev); +return ; + } +for (i =0 ; i < pd_count; i++)dev_pm_domain_detach (pds[i], false); }
@@ -2469,13 +2483,13 @@ static const struct rproc_hexagon_res msm8974_mss = { .supply = "pll", .uA = 100000, }, - {} - }, - .fallback_proxy_supply = (struct qcom_mss_reg_res[]) { { .supply = "mx", .uV = 1050000, }, + {} + }, + .fallback_proxy_supply = (struct qcom_mss_reg_res[]) { { .supply ="cx" , .uA =100000 ,
@@ -2501,7 +2515,6 @@ static const struct rproc_hexagon_res msm8974_mss = {NULL }, .proxy_pd_names = (char *[]){ -"mx" ,"cx" ,NULL },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 136/423 power: supply: bq27xxx_battery: do not update cached flags prematurely
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sicelo A. Mhlongo <[email protected]>
[ Upstream commit 45291874a762dbb12a619dc2efaf84598859007a ]
Commit 243f8ffc883a1 ("power: supply: bq27xxx_battery: Notify also about status changes") intended to notify userspace when the status changes, based on the flags register. However, the cached state is updated too early, before the flags are tested for any changes. Remove the premature update.
--- drivers/power/supply/bq27xxx_battery.c | 1 - 1 file changed, 1 deletion(-)
drivers/power/supply/bq27xxx_battery.c +0 -1
@@ -1913,7 +1913,6 @@ static void bq27xxx_battery_update_unlocked(struct bq27xxx_device_info *di) cache.flags =-1 ;/* read error */ if (cache.flags >=0 ) { cache.capacity =bq27xxx_battery_read_soc (di); - di->cache.flags = cache.flags;/* * On gauges with signed current reporting the current must be
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 137/423 crypto: api - Fix larval relookup type and mask
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 7505436e2925d89a13706a295a6734d6cabb4b43 ]
When the lookup is retried after instance construction, it uses the type and mask from the larval, which may not match the values used by the caller. For example, if the caller is requesting for a !NEEDS_FALLBACK algorithm, it may end up getting an algorithm that needs fallbacks.
Fix this by making the caller supply the type/mask and using that for the lookup.
--- crypto/api.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-)
crypto/api.c +7 -10
@@ -36,7 +36,8 @@ EXPORT_SYMBOL_GPL(crypto_chain);DEFINE_STATIC_KEY_FALSE (__crypto_boot_test_finished);#endif -static struct crypto_alg *crypto_larval_wait (struct crypto_alg *alg); +static struct crypto_alg *crypto_larval_wait (struct crypto_alg *alg, +u32 type,u32 mask);static struct crypto_alg *crypto_alg_lookup (const char *name,u32 type,u32 mask);
@@ -145,7 +146,7 @@ static struct crypto_alg *crypto_larval_add(const char *name, u32 type,if (alg != &larval->alg) {kfree (larval);if (crypto_is_larval (alg)) - alg =crypto_larval_wait (alg); + alg =crypto_larval_wait (alg, type, mask); }return alg;
@@ -197,7 +198,8 @@ static void crypto_start_test(struct crypto_larval *larval)crypto_schedule_test (larval); } -static struct crypto_alg *crypto_larval_wait (struct crypto_alg *alg) +static struct crypto_alg *crypto_larval_wait (struct crypto_alg *alg, +u32 type,u32 mask) {struct crypto_larval *larval;long time_left;
@@ -219,12 +221,7 @@ static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg)crypto_larval_kill (larval); alg =ERR_PTR (-ETIMEDOUT ); }else if (!alg) { -u32 type; -u32 mask; - alg = &larval->alg; - type = alg->cra_flags & ~(CRYPTO_ALG_LARVAL |CRYPTO_ALG_DEAD ); - mask = larval->mask; alg =crypto_alg_lookup (alg->cra_name, type, mask) ?:ERR_PTR (-EAGAIN ); }else if (IS_ERR (alg))
@@ -304,7 +301,7 @@ static struct crypto_alg *crypto_larval_lookup(const char *name, u32 type, }if (!IS_ERR_OR_NULL (alg) &&crypto_is_larval (alg)) - alg =crypto_larval_wait (alg); + alg =crypto_larval_wait (alg, type, mask);else if (alg) ;else if (!(mask &CRYPTO_ALG_TESTED ))
@@ -352,7 +349,7 @@ struct crypto_alg *crypto_alg_mod_lookup(const char *name, u32 type, u32 mask) ok =crypto_probing_notify (CRYPTO_MSG_ALG_REQUEST , larval);if (ok ==NOTIFY_STOP ) - alg =crypto_larval_wait (larval); + alg =crypto_larval_wait (larval, type, mask);else {crypto_mod_put (larval); alg =ERR_PTR (-ENOENT );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 138/423 IB/mad: Check available slots before posting receive WRs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maher Sanalla <[email protected]>
[ Upstream commit 37826f0a8c2f6b6add5179003b8597e32a445362 ]
The ib_post_receive_mads() function handles posting receive work requests (WRs) to MAD QPs and is called in two cases:
1) When a MAD port is opened.
2) When a receive WQE is consumed upon receiving a new MAD.
Whereas, if MADs arrive during the port open phase, a race condition might cause an extra WR to be posted, exceeding the QP’s capacity. This leads to failures such as:
infiniband mlx5_0: ib_post_recv failed: -12
infiniband mlx5_0: Couldn't post receive WRs
infiniband mlx5_0: Couldn't start port
infiniband mlx5_0: Couldn't open port 1
Fix this by checking the current receive count before posting a new WR. If the QP’s receive queue is full, do not post additional WRs.
--- drivers/infiniband/core/mad.c | 38 ++++++++++++++++++----------------- 1 file changed, 20 insertions(+), 18 deletions(-)
drivers/infiniband/core/mad.c +20 -18
@@ -2671,11 +2671,11 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, struct ib_mad_private *mad) {unsigned long flags; -int post, ret;struct ib_mad_private *mad_priv;struct ib_sge sg_list;struct ib_recv_wr recv_wr;struct ib_mad_queue *recv_queue = &qp_info->recv_queue; +int ret =0 ;/* Initialize common scatter list fields */ sg_list.lkey = qp_info->port_priv->pd->local_dma_lkey;
@@ -2685,7 +2685,7 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, recv_wr.sg_list = &sg_list; recv_wr.num_sge =1 ; - do { +while (true) {/* Allocate and map receive buffer */ if (mad) { mad_priv = mad;
@@ -2693,10 +2693,8 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, }else { mad_priv =alloc_mad_private (port_mad_size (qp_info->port_priv),GFP_ATOMIC ); -if (!mad_priv) { - ret = -ENOMEM ; -break ; - } +if (!mad_priv) +return -ENOMEM ; } sg_list.length =mad_priv_dma_size (mad_priv); sg_list.addr = ib_dma_map_single(qp_info->port_priv->device,
@@ -2705,37 +2703,41 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, DMA_FROM_DEVICE);if (unlikely (ib_dma_mapping_error (qp_info->port_priv->device, sg_list.addr))) { -kfree (mad_priv); ret = -ENOMEM ; -break ; + goto free_mad_priv; } mad_priv->header.mapping = sg_list.addr; mad_priv->header.mad_list.mad_queue = recv_queue; mad_priv->header.mad_list.cqe.done = ib_mad_recv_done; recv_wr.wr_cqe = &mad_priv->header.mad_list.cqe; - -/* Post receive WR */ spin_lock_irqsave (&recv_queue->lock, flags); - post = (++recv_queue->count < recv_queue->max_active); -list_add_tail (&mad_priv->header.mad_list.list, &recv_queue->list); +if (recv_queue->count >= recv_queue->max_active) { +/* Fully populated the receive queue */ +spin_unlock_irqrestore (&recv_queue->lock, flags); +break ; + } + recv_queue->count++; +list_add_tail (&mad_priv->header.mad_list.list, + &recv_queue->list);spin_unlock_irqrestore (&recv_queue->lock, flags); + ret =ib_post_recv (qp_info->qp, &recv_wr,NULL );if (ret) {spin_lock_irqsave (&recv_queue->lock, flags);list_del (&mad_priv->header.mad_list.list); recv_queue->count--;spin_unlock_irqrestore (&recv_queue->lock, flags); -ib_dma_unmap_single (qp_info->port_priv->device, - mad_priv->header.mapping, -mad_priv_dma_size (mad_priv), -DMA_FROM_DEVICE ); -kfree (mad_priv);dev_err (&qp_info->port_priv->device->dev,"ib_post_recv failed: %d\n" , ret);break ; } - }while (post); + } +ib_dma_unmap_single (qp_info->port_priv->device, + mad_priv->header.mapping, +mad_priv_dma_size (mad_priv),DMA_FROM_DEVICE ); +free_mad_priv: +kfree (mad_priv);return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 139/423 pinctrl: tegra: Set SFIO mode to Mux Register
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prathamesh Shete <[email protected]>
[ Upstream commit 17013f0acb322e5052ff9b9d0fab0ab5a4bfd828 ]
Tegra devices have an 'sfsel' bit field that determines whether a pin operates in SFIO (Special Function I/O) or GPIO mode. Currently, tegra_pinctrl_gpio_disable_free() sets this bit when releasing a GPIO.
However, tegra_pinctrl_set_mux() can be called independently in certain code paths where gpio_disable_free() is not invoked. In such cases, failing to set the SFIO mode could lead to incorrect pin configurations, resulting in functional issues for peripherals relying on SFIO.
This patch ensures that whenever set_mux() is called, the SFIO mode is correctly set in the Mux Register if the 'sfsel' bit is present. This prevents situations where the pin remains in GPIO mode despite being configured for SFIO use.
--- drivers/pinctrl/tegra/pinctrl-tegra.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/pinctrl/tegra/pinctrl-tegra.c +3 -0
@@ -270,6 +270,9 @@ static int tegra_pinctrl_set_mux(struct pinctrl_dev *pctldev, val =pmx_readl (pmx, g->mux_bank, g->mux_reg); val &= ~(0x3 << g->mux_bit); val |= i << g->mux_bit; +/* Set the SFIO/GPIO selection to SFIO when under pinmux control*/ +if (pmx->soc->sfsel_in_mux) + val |= (1 << g->sfsel_bit);pmx_writel (pmx, val, g->mux_bank, g->mux_reg);return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 140/423 clk: amlogic: g12b: fix cluster A parent data
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 8995f8f108c3ac5ad52b12a6cfbbc7b3b32e9a58 ]
Several clocks used by both g12a and g12b use the g12a cpu A clock hw pointer as clock parent. This is incorrect on g12b since the parents of cluster A cpu clock are different. Also the hw clock provided as parent to these children is not even registered clock on g12b.
Fix the problem by reverting to the global namespace and let CCF pick the appropriate, as it is already done for other clocks, such as cpu_clk_trace_div.
--- drivers/clk/meson/g12a.c | 36 ++++++++++++++++++++++++------------ 1 file changed, 24 insertions(+), 12 deletions(-)
drivers/clk/meson/g12a.c +24 -12
@@ -1139,8 +1139,18 @@ static struct clk_regmap g12a_cpu_clk_div16_en = { .hw.init = &(struct clk_init_data) { .name ="cpu_clk_div16_en" , .ops = &clk_regmap_gate_ro_ops, - .parent_hws = (const struct clk_hw *[]) { - &g12a_cpu_clk.hw + .parent_data = &(const struct clk_parent_data ) { +/* +* Note: +* G12A and G12B have different cpu clocks (with +* different struct clk_hw). We fallback to the global +* naming string mechanism so this clock picks +* up the appropriate one. Same goes for the other +* clock using cpu cluster A clock output and present +* on both G12 variant. +*/ + .name ="cpu_clk" , + .index =-1 , }, .num_parents =1 ,/*
@@ -1205,7 +1215,10 @@ static struct clk_regmap g12a_cpu_clk_apb_div = { .hw.init = &(struct clk_init_data){ .name ="cpu_clk_apb_div" , .ops = &clk_regmap_divider_ro_ops, - .parent_hws = (const struct clk_hw *[]) { &g12a_cpu_clk.hw }, + .parent_data = &(const struct clk_parent_data ) { + .name ="cpu_clk" , + .index =-1 , + }, .num_parents =1 , }, };
@@ -1239,7 +1252,10 @@ static struct clk_regmap g12a_cpu_clk_atb_div = { .hw.init = &(struct clk_init_data){ .name ="cpu_clk_atb_div" , .ops = &clk_regmap_divider_ro_ops, - .parent_hws = (const struct clk_hw *[]) { &g12a_cpu_clk.hw }, + .parent_data = &(const struct clk_parent_data ) { + .name ="cpu_clk" , + .index =-1 , + }, .num_parents =1 , }, };
@@ -1273,7 +1289,10 @@ static struct clk_regmap g12a_cpu_clk_axi_div = { .hw.init = &(struct clk_init_data){ .name ="cpu_clk_axi_div" , .ops = &clk_regmap_divider_ro_ops, - .parent_hws = (const struct clk_hw *[]) { &g12a_cpu_clk.hw }, + .parent_data = &(const struct clk_parent_data ) { + .name ="cpu_clk" , + .index =-1 , + }, .num_parents =1 , }, };
@@ -1308,13 +1327,6 @@ static struct clk_regmap g12a_cpu_clk_trace_div = { .name = "cpu_clk_trace_div", .ops = &clk_regmap_divider_ro_ops, .parent_data = &(const struct clk_parent_data ) { -/* -* Note: -* G12A and G12B have different cpu_clks (with -* different struct clk_hw). We fallback to the global -* naming string mechanism so cpu_clk_trace_div picks -* up the appropriate one. -*/ .name ="cpu_clk" , .index =-1 , },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 141/423 clk: amlogic: gxbb: drop non existing 32k clock parent
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 7915d7d5407c026fa9343befb4d3343f7a345f97 ]
The 32k clock reference a parent 'cts_slow_oscin' with a fixme note saying that this clock should be provided by AO controller.
The HW probably has this clock but it does not exist at the moment in any controller implementation. Furthermore, referencing clock by the global name should be avoided whenever possible.
There is no reason to keep this hack around, at least for now.
--- drivers/clk/meson/gxbb.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/clk/meson/gxbb.c +6 -6
@@ -1272,14 +1272,13 @@ static struct clk_regmap gxbb_cts_i958 = { }, }; +/* +* This table skips a clock named 'cts_slow_oscin' in the documentation +* This clock does not exist yet in this controller or the AO one +*/ +static u32 gxbb_32k_clk_parents_val_table[] = {0 ,2 ,3 };static const struct clk_parent_data gxbb_32k_clk_parent_data[] = { { .fw_name ="xtal" , }, -/* -* FIXME: This clock is provided by the ao clock controller but the -* clock is not yet part of the binding of this controller, so string -* name must be use to set this parent. -*/ - { .name ="cts_slow_oscin" , .index =-1 }, { .hw = &gxbb_fclk_div3.hw }, { .hw = &gxbb_fclk_div5.hw }, };
@@ -1289,6 +1288,7 @@ static struct clk_regmap gxbb_32k_clk_sel = { .offset = HHI_32K_CLK_CNTL, .mask = 0x3, .shift = 16, + .table = gxbb_32k_clk_parents_val_table, }, .hw.init = &(struct clk_init_data ){ .name ="32k_clk_sel" ,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 142/423 selftests/bpf: Select NUMA_NO_NODE to create map
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saket Kumar Bhaskar <[email protected]>
[ Upstream commit 4107a1aeb20ed4cdad6a0d49de92ea0f933c71b7 ]
On powerpc, a CPU does not necessarily originate from NUMA node 0. This contrasts with architectures like x86, where CPU 0 is not hot-pluggable, making NUMA node 0 a consistently valid node. This discrepancy can lead to failures when creating a map on NUMA node 0, which is initialized by default, if no CPUs are allocated from NUMA node 0.
This patch fixes the issue by setting NUMA_NO_NODE (-1) for map creation for this selftest.
--- tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c | 5 +++++ 1 file changed, 5 insertions(+)
tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c +5 -0
@@ -6,6 +6,10 @@#include <test_progs.h> #include "bloom_filter_map.skel.h" +#ifndef NUMA_NO_NODE +#define NUMA_NO_NODE (-1) +#endif +static void test_fail_cases (void ) {LIBBPF_OPTS (bpf_map_create_opts, opts);
@@ -69,6 +73,7 @@ static void test_success_cases(void)/* Create a map */ opts.map_flags =BPF_F_ZERO_SEED |BPF_F_NUMA_NODE ; + opts.numa_node =NUMA_NO_NODE ; fd =bpf_map_create (BPF_MAP_TYPE_BLOOM_FILTER ,NULL ,0 ,sizeof (value),100 , &opts);if (!ASSERT_GE (fd,0 ,"bpf_map_create bloom filter success case" ))return ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 143/423 rust: fix signature of rust_fmt_argument
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <[email protected]>
[ Upstream commit 901b3290bd4dc35e613d13abd03c129e754dd3dd ]
Without this change, the rest of this series will emit the following error message:
error[E0308]: if and else have incompatible types
--> <linux>/rust/kernel/print.rs:22:22
|
21 | #[export]
| --------- expected because of this
22 | unsafe extern "C" fn rust_fmt_argument(
| ^^^^^^^^^^^^^^^^^ expected `u8`, found `i8`
|
= note: expected fn item `unsafe extern "C" fn(*mut u8, *mut u8, *mut c_void) -> *mut u8 {bindings::rust_fmt_argument}`
found fn item `unsafe extern "C" fn(*mut i8, *mut i8, *const c_void) -> *mut i8 {print::rust_fmt_argument}`The error may be different depending on the architecture.
To fix this, change the void pointer argument to use a const pointer, and change the imports to use crate::ffi instead of core::ffi for integer types.
--- lib/vsprintf.c | 2 +- rust/kernel/print.rs | 7 +++---- 2 files changed, 4 insertions(+), 5 deletions(-)
lib/vsprintf.c +1 -1
@@ -2255,7 +2255,7 @@ int __init no_hash_pointers_enable(char *str)early_param ("no_hash_pointers" , no_hash_pointers_enable);/* Used for Rust formatting ('%pA'). */ -char *rust_fmt_argument (char *buf,char *end,void *ptr); +char *rust_fmt_argument (char *buf,char *end,const void *ptr);/* * Show a '%p' thing. A kernel extension is that the '%p' is followed
rust/kernel/print.rs +3 -4
@@ -6,12 +6,11 @@//! //! Reference: <https://docs.kernel.org/core-api/printk-basics.html> -use core::{ +use crate ::{ ffi::{c_char, c_void}, - fmt, + str::RawFormatter , }; - -use crate ::str::RawFormatter ; +use core::fmt;// Called from `vsprintf` with format specifier `%pA`. #[expect(clippy::missing_safety_doc)]
Signature · 1 line
2.39.5