6.13.11-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 6.13.11-rc1 review
This is the start of the stable review cycle for the 6.13.11 release. There are 499 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 10 Apr 2025 10:47:53 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.13.11-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.13.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.13.11-rc1
Dan Carpenter <[email protected]>
platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc()
Arnd Bergmann <[email protected]>
ASoC: cs42l43: convert to SYSTEM_SLEEP_PM_OPS
Chuck Lever <[email protected]>
NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up
Chuck Lever <[email protected]>
NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory
Chuck Lever <[email protected]>
NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs()
Olga Kornievskaia <[email protected]>
nfsd: fix management of listener transports
Li Lingfeng <[email protected]>
nfsd: put dl_stid if fail to queue dl_recall
Jeff Layton <[email protected]>
nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid()
Murad Masimov <[email protected]>
media: streamzap: fix race between device disconnection and urb callback
Nikita Zhandarovich <[email protected]>
media: vimc: skip .s_stream() for stopped entities
Oleg Nesterov <[email protected]>
exec: fix the racy usage of fs_struct->in_exec
Yosry Ahmed <[email protected]>
mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead()
Roman Smirnov <[email protected]>
jfs: add index corruption check to DT_GETPAGE()
Qasim Ijaz <[email protected]>
jfs: fix slab-out-of-bounds read in ea_get()
Lukas Wunner <[email protected]>
PCI/bwctrl: Fix NULL pointer dereference on bus number exhaustion
Acs, Jakub <[email protected]>
ext4: fix OOB read when checking dotdot dir
Theodore Ts'o <[email protected]>
ext4: don't over-report free space or inodes in statvfs
Ming Yen Hsieh <[email protected]>
wifi: mt76: mt7921: fix kernel panic due to null pointer dereference
Angelos Oikonomopoulos <[email protected]>
arm64: Don't call NULL in do_compat_alignment_fixup()
David Hildenbrand <[email protected]>
mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs
Steven Rostedt <[email protected]>
tracing: Verify event formats that have "%*p.."
Ran Xiaokai <[email protected]>
tracing/osnoise: Fix possible recursive locking for cpus_read_lock()
Douglas Raillard <[email protected]>
tracing: Fix synth event printk format for str fields
Douglas Raillard <[email protected]>
tracing: Ensure module defining synth event cannot be unloaded while tracing
Tengda Wu <[email protected]>
tracing: Fix use-after-free in print_graph_function_flags during tracer switching
Sungjong Seo <[email protected]>
exfat: fix potential wrong error return from get_block
Sungjong Seo <[email protected]>
exfat: fix random stack corruption after get_block
Namjae Jeon <[email protected]>
ksmbd: fix null pointer dereference in alloc_preauth_hash()
Norbert Szetei <[email protected]>
ksmbd: validate zero num_subauth before sub_auth is accessed
Norbert Szetei <[email protected]>
ksmbd: fix overflow in dacloffset bounds check
Namjae Jeon <[email protected]>
ksmbd: fix session use-after-free in multichannel connection
Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in ksmbd_sessions_deregister()
Norbert Szetei <[email protected]>
ksmbd: add bounds check for create lease context
Namjae Jeon <[email protected]>
ksmbd: add bounds check for durable handle context
Sean Christopherson <[email protected]>
KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error
Ulf Hansson <[email protected]>
mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD
Karel Balej <[email protected]>
mmc: sdhci-pxav3: set NEED_RSP_BUSY capability
Miaoqian Lin <[email protected]>
mmc: omap: Fix memory leak in mmc_omap_new_slot
Candice Li <[email protected]>
Remove unnecessary firmware version check for gc v9_4_2
Robin Murphy <[email protected]>
media: omap3isp: Handle ARM dma_iommu_mapping
Christian Eggers <[email protected]>
ARM: 9444/1: add KEEP() keyword to ARM_VECTORS
Gergo Koteles <[email protected]>
ACPI: video: Handle fetching EDID as ACPI_TYPE_PACKAGE
Paul Menzel <[email protected]>
ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP
Murad Masimov <[email protected]>
acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
Ming Yen Hsieh <[email protected]>
wifi: mt76: mt7925: remove unused acpi function for clc
Jann Horn <[email protected]>
x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
Guilherme G. Piccoli <[email protected]>
x86/tsc: Always save/restore TSC sched_clock() on suspend/resume
Arnd Bergmann <[email protected]>
x86/Kconfig: Add cmpxchg8b support back to Geode CPUs
Jiri Olsa <[email protected]>
uprobes/x86: Harden uretprobe syscall trampoline check
Kan Liang <[email protected]>
perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read
Peter Zijlstra (Intel) <[email protected]>
perf/x86/intel: Apply static call for drain_pebs
Markus Elfring <[email protected]>
ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk()
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Correct command storage data length
Eduard Christian Dumitrescu <[email protected]>
platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560
Hans de Goede <[email protected]>
ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers
Vishal Annapurve <[email protected]>
x86/tdx: Fix arch_safe_halt() execution for TDX VMs
Shuai Xue <[email protected]>
x86/mce: use is_copy_from_user() to determine copy-from-user context
Boris Ostrovsky <[email protected]>
x86/microcode/AMD: Fix __apply_microcode_amd()'s return value
Paolo Bonzini <[email protected]>
KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected
Tianyu Lan <[email protected]>
x86/hyperv: Fix check of return value from snp_set_vmsa()
Hengqi Chen <[email protected]>
LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC
Hengqi Chen <[email protected]>
LoongArch: BPF: Don't override subprog's return value
Hengqi Chen <[email protected]>
LoongArch: BPF: Fix off-by-one error in build_prologue()
Huacai Chen <[email protected]>
LoongArch: Increase MAX_IO_PICS up to 8
Huacai Chen <[email protected]>
LoongArch: Increase ARCH_DMA_MINALIGN up to 16
WANG Rui <[email protected]>
rust: Fix enabling Rust and building with GCC for LoongArch
Ying Lu <[email protected]>
usbnet:fix NPE during rx_complete
Alexander Wetzel <[email protected]>
wifi: mac80211: Fix sparse warning for monitor_sdata
Sherry Sun <[email protected]>
tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: use port struct directly to simply code
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: Use u32 and u8 for register variables
Dave Penkler <[email protected]>
staging: gpib: Fix Oops after disconnect in agilent usb
Dave Penkler <[email protected]>
staging: gpib: agilent usb console messaging cleanup
Dave Penkler <[email protected]>
staging: gpib: Agilent usb code cleanup
Dave Penkler <[email protected]>
staging: gpib: Fix NULL pointer dereference in detach
Dave Penkler <[email protected]>
staging: gpib: Add missing mutex unlock in agilent usb driver
Nihar Chaithanya <[email protected]>
staging: gpib: agilent_82357a: Handle gpib_register_driver() errors
Dave Penkler <[email protected]>
staging: gpib: Fix Oops after disconnect in ni_usb
Dave Penkler <[email protected]>
staging: gpib: ni_usb console messaging cleanup
Nihar Chaithanya <[email protected]>
staging: gpib: ni_usb: Handle gpib_register_driver() errors
Nihar Chaithanya <[email protected]>
staging: gpib: Modify gpib_register_driver() to return error if it fails
Santosh Mahto <[email protected]>
staging: gpib: Replace semaphore with completion for one-time signaling
Dragan Simic <[email protected]>
arm64: dts: rockchip: Add missing PCIe supplies to RockPro64 board dtsi
Tengda Wu <[email protected]>
tracing: Correct the refcount if the hist/hist_debug file fails to open
Masami Hiramatsu (Google) <[email protected]>
tracing/hist: Support POLLPRI event for poll on histogram
Masami Hiramatsu (Google) <[email protected]>
tracing/hist: Add poll(POLLIN) support on hist file
Steven Rostedt <[email protected]>
tracing: Switch trace_events_hist.c code over to use guard()
Zhang Rui <[email protected]>
tools/power turbostat: Restore GFX sysfs fflush() call
Len Brown <[email protected]>
tools/power turbostat: report CoreThr per measurement interval
Yeoreum Yun <[email protected]>
perf/core: Fix child_total_time_enabled accounting bug at task exit
Alex Deucher <[email protected]>
drm/amdgpu/gfx12: fix num_mec
Alex Deucher <[email protected]>
drm/amdgpu/gfx11: fix num_mec
Yue Haibing <[email protected]>
drm/xe: Fix unmet direct dependencies warning
Alexandru Gagniuc <[email protected]>
kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally
Dave Marquardt <[email protected]>
net: ibmveth: make veth_pool_store stop hanging
Henry Martin <[email protected]>
arcnet: Add NULL check in com20020pci_probe()
Ido Schimmel <[email protected]>
ipv6: Do not consider link down nexthops in path selection
Ido Schimmel <[email protected]>
ipv6: Start path selection from the first nexthop
Lin Ma <[email protected]>
net: fix geneve_opt length integer overflow
David Oberhollenzer <[email protected]>
net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy
Fernando Fernandez Mancera <[email protected]>
ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS
Lin Ma <[email protected]>
netfilter: nft_tunnel: fix geneve_opt type confusion addition
Antoine Tenart <[email protected]>
net: decrease cached dst counters in dst_release
Wang Liang <[email protected]>
xsk: Fix __xsk_generic_xmit() error code when cq is full
Guillaume Nault <[email protected]>
tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu().
Stefano Garzarella <[email protected]>
vsock: avoid timeout during connect() if the socket is closing
Kuniyuki Iwashima <[email protected]>
udp: Fix memory accounting leak.
Kuniyuki Iwashima <[email protected]>
udp: Fix multiple wraparounds of sk->sk_rmem_alloc.
Kuniyuki Iwashima <[email protected]>
rtnetlink: Use register_pernet_subsys() in rtnl_net_debug_init().
Tobias Waldekranz <[email protected]>
net: mvpp2: Prevent parser TCAM memory corruption
Eric Dumazet <[email protected]>
sctp: add mutual exclusion in proc_sctp_do_udp_port()
Cong Wang <[email protected]>
net_sched: skbprio: Remove overly strict queue assertions
Debin Zhu <[email protected]>
netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
Florian Westphal <[email protected]>
netfilter: nf_tables: don't unregister hook when table is dormant
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only
Emil Tantilov <[email protected]>
idpf: fix adapter NULL pointer dereference on reboot
Vitaly Lifshits <[email protected]>
e1000e: change k1 configuration on MTP and later platforms
Florian Fainelli <[email protected]>
spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model
Florian Fainelli <[email protected]>
spi: bcm2835: Do not call gpiod_put() on invalid descriptor
Henry Martin <[email protected]>
ASoC: imx-card: Add NULL check in imx_card_probe()
Maurizio Lombardi <[email protected]>
nvme-pci: skip nvme_write_sq_db on empty rqlist
Caleb Sander Mateos <[email protected]>
nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer
Björn Töpel <[email protected]>
riscv/purgatory: 4B align purgatory_start
Yao Zi <[email protected]>
riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator
Alexandre Ghiti <[email protected]>
riscv: Fix hugetlb retrieval of number of ptes in case of !present pte
Josh Poimboeuf <[email protected]>
spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock()
Christophe JAILLET <[email protected]>
ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe()
Sven Schnelle <[email protected]>
s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation
Ming Lei <[email protected]>
ublk: make sure ubq->canceling is set when queue is frozen
Herton R. Krzesinski <[email protected]>
x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs
Palmer Dabbelt <[email protected]>
RISC-V: errata: Use medany for relocatable builds
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA
Richard Fitzgerald <[email protected]>
firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success
Andrew Jones <[email protected]>
riscv: Fix check_unaligned_access_all_cpus
Andrew Jones <[email protected]>
riscv: Fix riscv_online_cpu_vec
Andrew Jones <[email protected]>
riscv: Annotate unaligned access init functions
Nikita Shubin <[email protected]>
ntb: intel: Fix using link status DB's
Yajun Deng <[email protected]>
ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
Alexandre Ghiti <[email protected]>
riscv: Fix missing __free_pages() in check_vector_unaligned_access()
Tingbo Liao <[email protected]>
riscv: Fix the __riscv_copy_vec_words_unaligned implementation
Juhan Jin <[email protected]>
riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra
Christian Schoenebeck <[email protected]>
fs/9p: fix NULL pointer dereference on mkdir
Al Viro <[email protected]>
spufs: fix a leak in spufs_create_context()
Al Viro <[email protected]>
spufs: fix gang directory lifetimes
Al Viro <[email protected]>
spufs: fix a leak on spufs_new_file() failure
Claudiu Beznea <[email protected]>
rtc: renesas-rtca3: Disable interrupts only if the RTC is enabled
David Howells <[email protected]>
netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int
Lo-an Chen <[email protected]>
drm/amd/display: Fix incorrect fw_state address in dmub_srv
Paulo Alcantara <[email protected]>
smb: client: don't retry IO on failed negprotos with soft mounts
Tasos Sahanidis <[email protected]>
hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9}Roger Quadros <[email protected]>
memory: omap-gpmc: drop no compatible check
Oliver Hartkopp <[email protected]>
can: statistics: use atomic access in hot path
Navon John Lukose <[email protected]>
ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx
Florian Westphal <[email protected]>
selftests: netfilter: skip br_netfilter queue tests if kernel is tainted
Lukas Hetzenecker <[email protected]>
platform/surface: aggregator_registry: Add Support for Surface Pro 11
Taehee Yoo <[email protected]>
net: devmem: do not WARN conditionally after netdev_rx_queue_restart()
Mario Limonciello <[email protected]>
drm/amd: Keep display off while going into S4
Keith Busch <[email protected]>
nvme-pci: fix stuck reset on concurrent DPC and HP
Rodrigo Vivi <[email protected]>
drm/xe/guc_pc: Retry and wait longer for GuC PC start
Vladis Dronov <[email protected]>
x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled
Michael Kelley <[email protected]>
x86/hyperv: Fix output argument to hypercall that changes page visibility
Waiman Long <[email protected]>
locking/semaphore: Use wake_q to wake up processes outside lock critical section
Johannes Berg <[email protected]>
wifi: mac80211: fix SA Query processing in MLO
Emmanuel Grumbach <[email protected]>
wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state
Bard Liao <[email protected]>
ASoC: rt1320: set wake_capable = 0 explicitly
Maciej Strozek <[email protected]>
ASoC: cs42l43: Add jack delay debounce after suspend
Alexey Klimov <[email protected]>
ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius
Naman Jain <[email protected]>
x86/hyperv/vtl: Stop kernel from probing VTL0 low memory
Shrikanth Hegde <[email protected]>
sched/deadline: Use online cpus for validating runtime
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA
Yuezhang Mo <[email protected]>
exfat: add a check for invalid data size
Shyam Sundar S K <[email protected]>
platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA
Shyam Sundar S K <[email protected]>
platform/x86/amd/pmf: Propagate PMF-TA return codes
Wentao Guan <[email protected]>
HID: i2c-hid: improve i2c_hid_get_report error message
Jakub Kicinski <[email protected]>
net: dsa: rtl8366rb: don't prompt users for LED control
David E. Box <[email protected]>
platform/x86/intel/vsec: Add Diamond Rapids support
Dmitry Panchenko <[email protected]>
platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet
Namjae Jeon <[email protected]>
cifs: fix incorrect validation for num_aces field of smb_acl
Namjae Jeon <[email protected]>
smb: common: change the data type of num_aces to le16
Peter Zijlstra <[email protected]>
perf/core: Fix perf_pmu_register() vs. perf_init_event()
Daniel Bárta <[email protected]>
ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0
Antheas Kapenekakis <[email protected]>
ALSA: hda/realtek: Fix Asus Z13 2025 audio
Simon Tatham <[email protected]>
affs: don't write overlarge OFS data block size fields
Simon Tatham <[email protected]>
affs: generate OFS sequence numbers starting at 1
Matthias Proske <[email protected]>
wifi: brcmfmac: keep power during suspend if board requires it
Icenowy Zheng <[email protected]>
nvme-pci: skip CMB blocks incompatible with PCI P2P DMA
Icenowy Zheng <[email protected]>
nvme-pci: clean up CMBMSC when registering CMB fails
Sagi Grimberg <[email protected]>
nvme-tcp: fix possible UAF in nvme_tcp_poll
Mike Lothian <[email protected]>
ntsync: Set the permissions to be 0666
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: use the right version of the rate API
Johannes Berg <[email protected]>
wifi: iwlwifi: fw: allocate chained SG tables for dump
Alexander Wetzel <[email protected]>
wifi: mac80211: remove debugfs dir for virtual monitor
Alexander Wetzel <[email protected]>
wifi: mac80211: Cleanup sta TXQs on flush
Dan Carpenter <[email protected]>
nfs: Add missing release on error in nfs_lock_and_join_requests()
Josh Poimboeuf <[email protected]>
objtool/loongarch: Add unwind hints in prepare_frametrace()
Josh Poimboeuf <[email protected]>
rcu-tasks: Always inline rcu_irq_work_resched()
Josh Poimboeuf <[email protected]>
context_tracking: Always inline ct_{nmi,irq}_{enter,exit}()
Josh Poimboeuf <[email protected]>
sched/smt: Always inline sched_smt_active()
David Laight <[email protected]>
objtool: Fix verbose disassembly if CROSS_COMPILE isn't set
Geetha sowjanya <[email protected]>
octeontx2-af: Free NIX_AF_INT_VEC_GEN irq
Geetha sowjanya <[email protected]>
octeontx2-af: Fix mbox INTR handler when num VFs > 64
Jim Liu <[email protected]>
net: phy: broadcom: Correct BCM5221 PHY model detection
Giovanni Gherdovich <[email protected]>
ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid
Yuli Wang <[email protected]>
LoongArch: Rework the arch_kgdb_breakpoint() implementation
Miaoqian Lin <[email protected]>
LoongArch: Fix device node refcount leak in fdt_cpu_clk_init()
谢致邦 (XIE Zhibang) <[email protected]>
LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig
Josh Poimboeuf <[email protected]>
objtool: Fix segfault in ignore_unreachable_insn()
Feng Yang <[email protected]>
ring-buffer: Fix bytes_dropped calculation issue
Lama Kayal <[email protected]>
net/mlx5e: SHAMPO, Make reserved size independent of page size
Namjae Jeon <[email protected]>
ksmbd: fix r_count dec/increment mismatch
Namjae Jeon <[email protected]>
ksmbd: fix multichannel connection failure
Miaoqian Lin <[email protected]>
ksmbd: use aead_request_free to match aead_request_alloc
Lubomir Rintel <[email protected]>
rndis_host: Flag RNDIS modems as WWAN devices
Mark Zhang <[email protected]>
rtnetlink: Allocate vfinfo size for VF GUIDs when supported
Yuezhang Mo <[email protected]>
exfat: fix missing shutdown check
Yuezhang Mo <[email protected]>
exfat: fix the infinite loop in exfat_find_last_cluster()
Wang Zhaolong <[email protected]>
smb: client: Fix netns refcount imbalance causing leaks and use-after-free
Trond Myklebust <[email protected]>
NFS: Shut down the nfs_client only after all the superblocks
Josh Poimboeuf <[email protected]>
objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
Josh Poimboeuf <[email protected]>
objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show()
xueqin Luo <[email protected]>
thermal: core: Remove duplicate struct declaration
Namhyung Kim <[email protected]>
perf bpf-filter: Fix a parsing error with comma
Marcus Meissner <[email protected]>
perf tools: annotate asm_pure_loop.S
Likhitha Korrapati <[email protected]>
perf tools: Fix is_compat_mode build break in ppc64
Bart Van Assche <[email protected]>
fs/procfs: fix the comment above proc_pid_wchan()
Ilkka Koskinen <[email protected]>
perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation
Jiri Slaby (SUSE) <[email protected]>
tty: n_tty: use uint for space returned by tty_write_room()
Stefan Wahren <[email protected]>
staging: vchiq_arm: Stop kthreads if vchiq cdev register fails
Stefan Wahren <[email protected]>
staging: vchiq_arm: Fix possible NPR of keep-alive thread
Stefan Wahren <[email protected]>
staging: vchiq_arm: Register debugfs after cdev
谢致邦 (XIE Zhibang) <[email protected]>
staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES
James Clark <[email protected]>
perf: intel-tpebs: Fix incorrect usage of zfree()
Stephen Brennan <[email protected]>
perf dso: fix dso__is_kallsyms() check
Arnaldo Carvalho de Melo <[email protected]>
perf python: Check if there is space to copy all the event
Arnaldo Carvalho de Melo <[email protected]>
perf python: Don't keep a raw_data pointer to consumed ring buffer space
Arnaldo Carvalho de Melo <[email protected]>
perf python: Decrement the refcount of just created event on failure
Arnaldo Carvalho de Melo <[email protected]>
perf python: Fixup description of sample.id event member
Stanley Chu <[email protected]>
i3c: master: svc: Fix missing the IBI rules
Benjamin Berg <[email protected]>
um: hostfs: avoid issues on inode number reuse by host
Benjamin Berg <[email protected]>
um: remove copy_from_kernel_nofault_allowed
David Gow <[email protected]>
um: Pass the correct Rust target and options with gcc
Cyan Yang <[email protected]>
selftests/mm/cow: fix the incorrect error handling
Alistair Popple <[email protected]>
fuse: fix dax truncate/punch_hole fault path
NeilBrown <[email protected]>
NFS: fix open_owner_id_maxsz and related fields.
Trond Myklebust <[email protected]>
NFSv4: Avoid unnecessary scans of filesystems for delayed delegations
Trond Myklebust <[email protected]>
NFSv4: Avoid unnecessary scans of filesystems for expired delegations
Trond Myklebust <[email protected]>
NFSv4: Avoid unnecessary scans of filesystems for returning delegations
Trond Myklebust <[email protected]>
NFSv4: Don't trigger uneccessary scans for return-on-close delegations
Anshuman Khandual <[email protected]>
arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig
Vasiliy Kovalev <[email protected]>
ocfs2: validate l_tree_depth to avoid out-of-bounds access
Sourabh Jain <[email protected]>
kexec: initialize ELF lowest address to ULONG_MAX
David Hildenbrand <[email protected]>
kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page()
Veronika Molnarova <[email protected]>
perf test stat_all_pmu.sh: Correctly check 'perf stat' result
Arnaldo Carvalho de Melo <[email protected]>
perf units: Fix insufficient array space
Dapeng Mi <[email protected]>
perf x86/topdown: Fix topdown leader sampling test error on hybrid
Ian Rogers <[email protected]>
perf evlist: Add success path to evlist__create_syswide_maps
Ian Rogers <[email protected]>
perf debug: Avoid stack overflow in recursive error message
Karan Sanghavi <[email protected]>
iio: light: Add check for array bounds in veml6075_read_int_time_ms
Jonathan Santos <[email protected]>
iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset
Uwe Kleine-König <[email protected]>
iio: adc: ad7173: Fix comparison of channel configs
Uwe Kleine-König <[email protected]>
iio: adc: ad7124: Fix comparison of channel configs
Uwe Kleine-König <[email protected]>
iio: adc: ad4130: Fix comparison of channel setups
Peng Fan <[email protected]>
dmaengine: fsl-edma: free irq correctly in remove path
Peng Fan <[email protected]>
dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister
Dan Carpenter <[email protected]>
fs/ntfs3: Prevent integer overflow in hdr_first_de()
Dan Carpenter <[email protected]>
fs/ntfs3: Fix a couple integer overflows on 32bit systems
Niklas Neronin <[email protected]>
usb: xhci: correct debug message page size calculation
Thomas Richter <[email protected]>
perf bench: Fix perf bench syscall loop count
Leo Yan <[email protected]>
perf arm-spe: Fix load-store operation checking
Nuno Sá <[email protected]>
iio: backend: make sure to NULL terminate stack buffer
Jonathan Cameron <[email protected]>
iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails.
Jonathan Cameron <[email protected]>
iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio
Mario Limonciello <[email protected]>
ucsi_ccg: Don't show failed to get FW build information error
Luca Ceresoli <[email protected]>
perf build: Fix in-tree build due to symbolic link
Ian Rogers <[email protected]>
tools/x86: Fix linux/unaligned.h include path in lib/insn.c
James Clark <[email protected]>
perf pmu: Don't double count common sysfs and json events
Yuanfang Zhang <[email protected]>
coresight-etm4x: add isb() before reading the TRCSTATR
Mike Christie <[email protected]>
vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
Ilkka Koskinen <[email protected]>
coresight: catu: Fix number of pages while using 64k pages
Wentao Liang <[email protected]>
greybus: gb-beagleplay: Add error handling for gb_greybus_init
Namhyung Kim <[email protected]>
perf report: Switch data file correctly in TUI
Dave Penkler <[email protected]>
staging: gpib: Fix cb7210 pcmcia Oops
Joe Hattori <[email protected]>
soundwire: slave: fix an OF node reference leak in soundwire slave device
James Clark <[email protected]>
perf tests: Fix Tool PMU test segfault
Qasim Ijaz <[email protected]>
isofs: fix KMSAN uninit-value bug in do_isofs_readdir()
Kan Liang <[email protected]>
perf tools: Add skip check in tool_pmu__event_to_str()
Heiko Stuebner <[email protected]>
phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id
Konstantin Komarov <[email protected]>
fs/ntfs3: Update inode->i_mapping->a_ops on compression state
Ian Rogers <[email protected]>
perf stat: Don't merge counters purely on name
Thomas Richter <[email protected]>
perf test: Fix Hwmon PMU test endianess issue
Angelo Dureghello <[email protected]>
iio: dac: adi-axi-dac: modify stream enable
Dave Penkler <[email protected]>
staging: gpib: Fix pr_err format warning
Chenyuan Yang <[email protected]>
w1: fix NULL pointer dereference in probe
James Clark <[email protected]>
perf: Always feature test reallocarray
Ian Rogers <[email protected]>
perf stat: Fix find_stat for mixed legacy/non-legacy events
Tony Ambardar <[email protected]>
libbpf: Fix accessing BTF.ext core_relo header
Barnabás Czémán <[email protected]>
clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock
Andy Shevchenko <[email protected]>
pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm()
Wenkai Lin <[email protected]>
crypto: hisilicon/sec2 - fix for aead auth key length
Wang Liang <[email protected]>
RDMA/core: Fix use-after-free when rename device name
Jann Horn <[email protected]>
x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
Remi Pommarel <[email protected]>
leds: Fix LED_OFF brightness race
Nikita Zhandarovich <[email protected]>
mfd: sm501: Switch to BIT() to mitigate integer overflows
Manikanta Mylavarapu <[email protected]>
clk: qcom: ipq5424: fix software and hardware flow control error of UART
Fabrizio Castro <[email protected]>
pinctrl: renesas: rzv2m: Fix missing of_node_put() call
Patrisious Haddad <[email protected]>
RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
Jiayuan Chen <[email protected]>
bpf: Fix array bounds error with may_goto
Neil Armstrong <[email protected]>
clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable()
Herbert Xu <[email protected]>
crypto: nx - Fix uninitialised hv_nxc on error
Artur Weber <[email protected]>
power: supply: max77693: Fix wrong conversion of charge input threshold value
Jann Horn <[email protected]>
x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1
Jerome Brunet <[email protected]>
clk: amlogic: g12a: fix mmc A peripheral clock
Laurentiu Mihalcea <[email protected]>
clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents
Bairavi Alagappan <[email protected]>
crypto: qat - remove access to parity register for QAT GEN4
Jinghao Jia <[email protected]>
samples/bpf: Fix broken vmlinux path for VMLINUX_BTF
Andy Shevchenko <[email protected]>
pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment
Charles Han <[email protected]>
clk: mmp: Fix NULL vs IS_ERR() check
Ian Rogers <[email protected]>
libbpf: Add namespace for errstr making it libbpf_errstr
Nathan Chancellor <[email protected]>
crypto: tegra - Fix format specifier in tegra_sha_prep_cmd()
Alice Ryhl <[email protected]>
rust: fix signature of rust_fmt_argument
Saket Kumar Bhaskar <[email protected]>
selftests/bpf: Select NUMA_NO_NODE to create map
Jerome Brunet <[email protected]>
clk: amlogic: gxbb: drop non existing 32k clock parent
Jerome Brunet <[email protected]>
clk: amlogic: g12b: fix cluster A parent data
Prathamesh Shete <[email protected]>
pinctrl: tegra: Set SFIO mode to Mux Register
Maher Sanalla <[email protected]>
IB/mad: Check available slots before posting receive WRs
Herbert Xu <[email protected]>
crypto: api - Fix larval relookup type and mask
Sicelo A. Mhlongo <[email protected]>
power: supply: bq27xxx_battery: do not update cached flags prematurely
Luca Weiss <[email protected]>
remoteproc: qcom_q6v5_mss: Handle platforms with one power domain
Cheng Xu <[email protected]>
RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
Chiara Meiohas <[email protected]>
RDMA/mlx5: Fix calculation of total invalidated pages
Roman Gushchin <[email protected]>
RDMA/core: Don't expose hw_counters outside of init net namespace
Peter Geis <[email protected]>
clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent
Tengda Wu <[email protected]>
selftests/bpf: Fix freplace_link segfault in tailcalls prog test
Michael Guralnik <[email protected]>
RDMA/mlx5: Fix MR cache initialization error flow
Fabrizio Castro <[email protected]>
pinctrl: renesas: rzg2l: Fix missing of_node_put() call
Fabrizio Castro <[email protected]>
pinctrl: renesas: rza2: Fix missing of_node_put() call
Tanya Agarwal <[email protected]>
lib: 842: Improve error handling in sw842_compress()
Hou Tao <[email protected]>
bpf: Use preempt_count() directly in bpf_send_signal_common()
Akhil R <[email protected]>
crypto: tegra - Reserve keyslots to allocate dynamically
Akhil R <[email protected]>
crypto: tegra - finalize crypto req on error
Konrad Dybcio <[email protected]>
clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK
Luca Weiss <[email protected]>
remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226
Akhil R <[email protected]>
crypto: tegra - Set IV to NULL explicitly for AES ECB
Kees Bakker <[email protected]>
RDMA/mana_ib: Ensure variable err is initialized
Niklas Schnelle <[email protected]>
s390: Remove ioremap_wt() and pgprot_writethrough()
Tony Ambardar <[email protected]>
selftests/bpf: Fix runqslower cross-endian build
Vladimir Lypak <[email protected]>
clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock
Akhil R <[email protected]>
crypto: tegra - Fix CMAC intermediate result handling
Yue Haibing <[email protected]>
pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw()
Will McVicker <[email protected]>
clk: samsung: Fix UBSAN panic in samsung_clk_init()
Luca Weiss <[email protected]>
remoteproc: qcom: pas: add minidump_id to SC7280 WPSS
Claudiu Beznea <[email protected]>
clk: renesas: r8a08g045: Check the source of the CPU PLL settings
David Hildenbrand <[email protected]>
x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()
Viktor Malik <[email protected]>
selftests/bpf: Fix string read in strncmp benchmark
Manikanta Mylavarapu <[email protected]>
drivers: clk: qcom: ipq5424: fix the freq table of sdcc1_apps clock
Andrii Nakryiko <[email protected]>
libbpf: Fix hypothetical STT_SECTION extern NULL deref case
Luca Weiss <[email protected]>
remoteproc: qcom_q6v5_pas: Make single-PD handling more robust
Claudiu Beznea <[email protected]>
pinctrl: renesas: rzg2l: Suppress binding attributes
Zijun Hu <[email protected]>
of: property: Increase NR_FWNODE_REFERENCE_ARGS
Peng Fan <[email protected]>
remoteproc: core: Clear table_sz when rproc_shutdown
Michael Guralnik <[email protected]>
RDMA/mlx5: Fix page_size variable overflow
Wenkai Lin <[email protected]>
crypto: hisilicon/sec2 - fix for sec spec check
Wenkai Lin <[email protected]>
crypto: hisilicon/sec2 - fix for aead authsize alignment
Jerome Brunet <[email protected]>
clk: amlogic: gxbb: drop incorrect flag on 32k clock
Akhil R <[email protected]>
crypto: tegra - Use HMAC fallback when keyslots are full
Arnd Bergmann <[email protected]>
crypto: bpf - Add MODULE_DESCRIPTION for skcipher
Akhil R <[email protected]>
crypto: tegra - Fix HASH intermediate result handling
Akhil R <[email protected]>
crypto: tegra - Transfer HASH init function to crypto engine
Akhil R <[email protected]>
crypto: tegra - check return value for hash do_one_req
Akhil R <[email protected]>
crypto: tegra - Do not use fixed size buffers
Akhil R <[email protected]>
crypto: tegra - Use separate buffer for setkey
Bairavi Alagappan <[email protected]>
crypto: qat - set parity error mask for qat_420xx
Herbert Xu <[email protected]>
crypto: iaa - Test the correct request flag
Danila Chernetsov <[email protected]>
fbdev: sm501fb: Add some geometry checks.
Arnd Bergmann <[email protected]>
mdacon: rework dependency list
Arnd Bergmann <[email protected]>
dummycon: fix default rows/cols
Markus Elfring <[email protected]>
fbdev: au1100fb: Move a variable assignment behind a null pointer check
Shay Drory <[email protected]>
PCI: Fix NULL dereference in SR-IOV VF creation error path
Caleb Sander Mateos <[email protected]>
io_uring/net: only import send_zc buffer once
Jens Axboe <[email protected]>
io_uring/net: improve recv bundles
Ilpo Järvinen <[email protected]>
PCI/bwctrl: Fix pcie_bwctrl_select_speed() return type
Ilpo Järvinen <[email protected]>
PCI: pciehp: Don't enable HPIE when resuming in poll mode
Ilpo Järvinen <[email protected]>
PCI: Fix BAR resizing when VF BARs are assigned
Christophe JAILLET <[email protected]>
PCI: histb: Fix an error handling path in histb_pcie_probe()
Dan Carpenter <[email protected]>
PCI: dwc: ep: Return -ENOMEM for allocation failures
Thadeu Lima de Souza Cascardo <[email protected]>
drm/amd/display: avoid NPD when ASIC does not support DMUB
Dan Carpenter <[email protected]>
drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer()
Douglas Anderson <[email protected]>
drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr
Jason-JH Lin <[email protected]>
drm/mediatek: Fix config_updating flag never false when no mbox channel
Thippeswamy Havalige <[email protected]>
PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe
Dan Carpenter <[email protected]>
PCI: Remove stray put_device() in pci_register_host_bridge()
Christophe Leroy <[email protected]>
powerpc/kexec: fix physical address calculation in clear_utlb_entry()
Christophe Leroy <[email protected]>
crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD
Vaibhav Jain <[email protected]>
powerpc/perf: Fix ref-counting on the PMU 'vpa_pmu'
Rob Clark <[email protected]>
drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump
Vitaliy Shevtsov <[email protected]>
drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters()
Steven Price <[email protected]>
drm/panthor: Clean up FW version information display
Ashley Smith <[email protected]>
drm/panthor: Update CS_STATUS_ defines to correct values
Nishanth Aravamudan <[email protected]>
PCI: Avoid reset when disabled via sysfs
Feng Tang <[email protected]>
PCI/portdrv: Only disable pciehp interrupts early when needed
Yi Lai <[email protected]>
selftests/pcie_bwctrl: Add 'set_pcie_speed.sh' to TEST_PROGS
Jim Quinlan <[email protected]>
PCI: brcmstb: Fix potential premature regulator disabling
Jim Quinlan <[email protected]>
PCI: brcmstb: Fix error path after a call to regulator_bulk_get()
Jim Quinlan <[email protected]>
PCI: brcmstb: Use internal register to change link capability
Jim Quinlan <[email protected]>
PCI: brcmstb: Set generation limit before PCIe link up
Hans Zhang <[email protected]>
PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload
Srinivasan Shanmugam <[email protected]>
drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables'
Marijn Suijten <[email protected]>
drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host
Marijn Suijten <[email protected]>
drm/msm/dsi: Use existing per-interface slice count in DSC timing
Krzysztof Kozlowski <[email protected]>
drm/msm/dsi/phy: Program clock inverters in correct register
Dmitry Baryshkov <[email protected]>
drm/msm/dpu: don't use active in atomic_check()
Aurabindo Pillai <[email protected]>
drm/amd/display: fix an indent issue in DML21
Tushar Dave <[email protected]>
PCI/ACS: Fix 'pci=config_acs=' parameter
John Keeping <[email protected]>
drm/panel: ilitek-ili9882t: fix GPIO name in error message
Daniel Stodden <[email protected]>
PCI/ASPM: Fix link state exit during switch upstream function removal
Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV
AngeloGioacchino Del Regno <[email protected]>
drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
AngeloGioacchino Del Regno <[email protected]>
drm/mediatek: mtk_hdmi: Unregister audio platform device on failure
Ilpo Järvinen <[email protected]>
PCI: Remove add_align overwrite unrelated to size0
Kai-Heng Feng <[email protected]>
PCI: Use downstream bridges for distributing resources
Alex Deucher <[email protected]>
drm/amdgpu/umsch: fix ucode check
Yang Wang <[email protected]>
drm/amdgpu: refine smu send msg debug log format
Vitalii Mordan <[email protected]>
gpu: cdns-mhdp8546: fix call balance of mhdp->clk handling routines
José Expósito <[email protected]>
drm/vkms: Fix use after free and double free on init error
Bart Van Assche <[email protected]>
drm: zynqmp_dp: Fix a deadlock in zynqmp_dp_ignore_hpd_set()
Tomi Valkeinen <[email protected]>
drm: xlnx: zynqmp: Fix max dma segment size
Adrián Larumbe <[email protected]>
drm/panthor: Fix race condition when gathering fdinfo group samples
Hermes Wu <[email protected]>
drm/bridge: it6505: fix HDCP V match check is not performed correctly
Wayne Lin <[email protected]>
drm/dp_mst: Fix drm RAD print
John Keeping <[email protected]>
drm/ssd130x: ensure ssd132x pitch is correct
John Keeping <[email protected]>
drm/ssd130x: fix ssd132x encoding
Javier Martinez Canillas <[email protected]>
drm/ssd130x: Set SPI .id_table to prevent an SPI core warning
Geert Uytterhoeven <[email protected]>
drm/bridge: ti-sn65dsi86: Fix multiple instances
Takashi Iwai <[email protected]>
ALSA: timer: Don't take register_mutex with copy_from/to_user()
Olivia Mackintosh <[email protected]>
ALSA: usb-audio: separate DJM-A9 cap lvl options
Jayesh Choudhary <[email protected]>
ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible
Ritu Chaudhary <[email protected]>
ASoC: tegra: Use non-atomic timeout for ADX status register
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Always honor no_shutup_pins
Maud Spierings <[email protected]>
dt-bindings: vendor-prefixes: add GOcontroll
Jiri Kosina <[email protected]>
HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER
Venkata Prasad Potturu <[email protected]>
ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry
Vitaliy Shevtsov <[email protected]>
ASoC: cs35l41: check the return value from spi_setup()
Armin Wolf <[email protected]>
platform/x86: dell-ddv: Fix temperature calculation
Ilpo Järvinen <[email protected]>
platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static
Ilpo Järvinen <[email protected]>
platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static
Andy Shevchenko <[email protected]>
auxdisplay: panel: Fix an API misuse in panel.c
Joe Hattori <[email protected]>
media: platform: allgro-dvt: unregister v4l2_device on the error path
Benjamin Gaignard <[email protected]>
media: verisilicon: HEVC: Initialize start_bit field
Geert Uytterhoeven <[email protected]>
auxdisplay: MAX6959 should select BITREVERSE
Frieder Schrempf <[email protected]>
regulator: pca9450: Fix enable register for LDO5
Atish Patra <[email protected]>
RISC-V: KVM: Teardown riscv specific bits after kvm_exit
Vitaly Kuznetsov <[email protected]>
x86/entry: Add __init to ia32_emulation_override_cmdline()
Chao Gao <[email protected]>
x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures
Josh Poimboeuf <[email protected]>
x86/traps: Make exc_double_fault() consistently noreturn
Tao Chen <[email protected]>
perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
Jacky Bai <[email protected]>
cpufreq: Init cpufreq only for present CPUs
Sebastian Andrzej Siewior <[email protected]>
lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*()
Rafael J. Wysocki <[email protected]>
PM: sleep: Fix handling devices with direct_complete set on errors
Chenyuan Yang <[email protected]>
thermal: int340x: Add NULL check for adev
Jacky Bai <[email protected]>
cpuidle: Init cpuidle only for present CPUs
James Morse <[email protected]>
x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors
Suzuki K Poulose <[email protected]>
arm64: realm: Use aliased addresses for device DMA to shared buffers
Suzuki K Poulose <[email protected]>
dma: Introduce generic dma_addr_*crypted helpers
Suzuki K Poulose <[email protected]>
dma: Fix encryption bit clearing for dma_to_phys
Qiuxu Zhuo <[email protected]>
EDAC/ie31200: Fix the error path order of ie31200_init()
Qiuxu Zhuo <[email protected]>
EDAC/ie31200: Fix the DIMM size mask for several SoCs
Qiuxu Zhuo <[email protected]>
EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
Tim Schumacher <[email protected]>
selinux: Chain up tool resolving errors in install_policy.sh
Maksim Davydov <[email protected]>
x86/split_lock: Fix the delayed detection logic
Li Huafei <[email protected]>
watchdog/hardlockup/perf: Fix perf_event memory leak
Kees Cook <[email protected]>
kunit/stackinit: Use fill byte different from Clang i386 pattern
Atish Patra <[email protected]>
RISC-V: KVM: Disable the kernel perf counter during configure
Aaron Kling <[email protected]>
cpufreq: tegra194: Allow building for Tegra234
Rafael J. Wysocki <[email protected]>
PM: sleep: Adjust check before setting power.must_resume
Peter Zijlstra <[email protected]>
lockdep/mm: Fix might_fault() lockdep check of current->mm->mmap_lock
Kevin Loughlin <[email protected]>
x86/sev: Add missing RIP_REL_REF() invocations during sme_enable()
Arnd Bergmann <[email protected]>
x86/platform: Only allow CONFIG_EISA for 32-bit
Benjamin Berg <[email protected]>
x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct()
Stanislav Spassov <[email protected]>
x86/fpu: Fix guest FPU state buffer allocation size
Thomas Weißschuh <[email protected]>
x86/vdso: Fix latent bug in vclock_pages calculation
Qiuxu Zhuo <[email protected]>
EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids
Qiuxu Zhuo <[email protected]>
EDAC/igen6: Fix the flood of invalid error reports
Jie Zhan <[email protected]>
cpufreq: governor: Fix negative 'idle_time' handling in dbs_update()
Tianchen Ding <[email protected]>
sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks
zihan zhou <[email protected]>
sched: Cancel the slice protection of the idle entity
Konstantin Andreev <[email protected]>
smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label
Konstantin Andreev <[email protected]>
smack: dont compile ipv6 code unless ipv6 is configured
Oleg Nesterov <[email protected]>
seccomp: fix the __secure_computing() stub for !HAVE_ARCH_SECCOMP_FILTER
zuoqian <[email protected]>
cpufreq: scpi: compare kHz instead of Hz
Mike Rapoport (Microsoft) <[email protected]>
x86/mm/pat: cpa-test: fix length for CPA_ARRAY test
Eric Sandeen <[email protected]>
watch_queue: fix pipe accounting mismatch
Christian Brauner <[email protected]>
fs: support O_PATH fds with FSCONFIG_SET_FD
-------------
Diffstat:
.../devicetree/bindings/vendor-prefixes.yaml | 2 + Makefile | 4 +- arch/arm/include/asm/vmlinux.lds.h | 6 +- arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dtsi | 2 + arch/arm64/include/asm/mem_encrypt.h | 11 + arch/arm64/kernel/compat_alignment.c | 2 + arch/loongarch/Kconfig | 4 +- arch/loongarch/include/asm/cache.h | 2 + arch/loongarch/include/asm/irq.h | 2 +- arch/loongarch/include/asm/stacktrace.h | 3 + arch/loongarch/include/asm/unwind_hints.h | 10 +- arch/loongarch/kernel/env.c | 2 + arch/loongarch/kernel/kgdb.c | 5 +- arch/loongarch/net/bpf_jit.c | 12 +- arch/loongarch/net/bpf_jit.h | 5 + arch/powerpc/configs/mpc885_ads_defconfig | 2 +- arch/powerpc/crypto/Makefile | 1 + arch/powerpc/kexec/relocate_32.S | 7 +- arch/powerpc/perf/vpa-pmu.c | 1 + arch/powerpc/platforms/cell/spufs/gang.c | 1 + arch/powerpc/platforms/cell/spufs/inode.c | 63 ++- arch/powerpc/platforms/cell/spufs/spufs.h | 2 + arch/riscv/errata/Makefile | 6 +- arch/riscv/include/asm/cpufeature.h | 4 +- arch/riscv/include/asm/ftrace.h | 4 +- arch/riscv/kernel/elf_kexec.c | 3 + arch/riscv/kernel/traps_misaligned.c | 14 +- arch/riscv/kernel/unaligned_access_speed.c | 36 +- arch/riscv/kernel/vec-copy-unaligned.S | 2 +- arch/riscv/kvm/main.c | 4 +- arch/riscv/kvm/vcpu_pmu.c | 1 + arch/riscv/mm/hugetlbpage.c | 74 +-- arch/riscv/purgatory/entry.S | 1 + arch/s390/include/asm/io.h | 2 - arch/s390/include/asm/pgtable.h | 3 - arch/s390/kernel/entry.S | 2 +- arch/s390/mm/pgtable.c | 10 - arch/um/include/shared/os.h | 1 - arch/um/kernel/Makefile | 2 +- arch/um/kernel/maccess.c | 19 - arch/um/os-Linux/process.c | 51 -- arch/x86/Kconfig | 3 +- arch/x86/Kconfig.cpu | 2 +- arch/x86/Makefile.um | 7 +- arch/x86/coco/tdx/tdx.c | 26 +- arch/x86/entry/calling.h | 2 + arch/x86/entry/common.c | 2 +- arch/x86/entry/vdso/vdso-layout.lds.S | 2 +- arch/x86/entry/vdso/vma.c | 2 +- arch/x86/events/intel/core.c | 47 +- arch/x86/events/intel/ds.c | 13 +- arch/x86/events/perf_event.h | 3 +- arch/x86/hyperv/hv_vtl.c | 1 + arch/x86/hyperv/ivm.c | 5 +- arch/x86/include/asm/tdx.h | 4 +- arch/x86/include/asm/tlbflush.h | 2 +- arch/x86/include/asm/vdso/vsyscall.h | 1 + arch/x86/kernel/cpu/bus_lock.c | 20 +- arch/x86/kernel/cpu/mce/severity.c | 11 +- arch/x86/kernel/cpu/microcode/amd.c | 2 +- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 3 +- arch/x86/kernel/cpu/sgx/driver.c | 10 +- arch/x86/kernel/dumpstack.c | 5 +- arch/x86/kernel/fpu/core.c | 6 +- arch/x86/kernel/process.c | 9 +- arch/x86/kernel/traps.c | 18 +- arch/x86/kernel/tsc.c | 4 +- arch/x86/kernel/uprobes.c | 14 +- arch/x86/kvm/svm/sev.c | 13 +- arch/x86/kvm/x86.c | 15 +- arch/x86/lib/copy_user_64.S | 18 + arch/x86/mm/mem_encrypt_identity.c | 4 +- arch/x86/mm/pat/cpa-test.c | 2 +- arch/x86/mm/pat/memtype.c | 52 +- crypto/api.c | 17 +- crypto/bpf_crypto_skcipher.c | 1 + drivers/acpi/acpi_video.c | 9 +- drivers/acpi/nfit/core.c | 2 +- drivers/acpi/processor_idle.c | 4 + drivers/acpi/resource.c | 7 + drivers/acpi/x86/utils.c | 3 +- drivers/auxdisplay/Kconfig | 1 + drivers/auxdisplay/panel.c | 4 +- drivers/base/power/main.c | 21 +- drivers/base/power/runtime.c | 2 +- drivers/block/ublk_drv.c | 41 +- drivers/clk/imx/clk-imx8mp-audiomix.c | 6 +- drivers/clk/meson/g12a.c | 38 +- drivers/clk/meson/gxbb.c | 14 +- drivers/clk/mmp/clk-pxa1908-apmu.c | 4 +- drivers/clk/qcom/gcc-ipq5424.c | 24 +- drivers/clk/qcom/gcc-msm8953.c | 2 +- drivers/clk/qcom/gcc-sm8650.c | 4 +- drivers/clk/qcom/gcc-x1e80100.c | 30 -- drivers/clk/qcom/mmcc-sdm660.c | 2 +- drivers/clk/renesas/r9a08g045-cpg.c | 5 +- drivers/clk/renesas/rzg2l-cpg.c | 13 +- drivers/clk/renesas/rzg2l-cpg.h | 10 +- drivers/clk/rockchip/clk-rk3328.c | 2 +- drivers/clk/samsung/clk.c | 2 +- drivers/cpufreq/Kconfig.arm | 2 +- drivers/cpufreq/armada-8k-cpufreq.c | 2 +- drivers/cpufreq/cpufreq-dt.c | 2 +- drivers/cpufreq/cpufreq_governor.c | 45 +- drivers/cpufreq/mediatek-cpufreq-hw.c | 2 +- drivers/cpufreq/mediatek-cpufreq.c | 2 +- drivers/cpufreq/mvebu-cpufreq.c | 2 +- drivers/cpufreq/qcom-cpufreq-hw.c | 2 +- drivers/cpufreq/qcom-cpufreq-nvmem.c | 8 +- drivers/cpufreq/scmi-cpufreq.c | 2 +- drivers/cpufreq/scpi-cpufreq.c | 7 +- drivers/cpufreq/sun50i-cpufreq-nvmem.c | 6 +- drivers/cpufreq/virtual-cpufreq.c | 2 +- drivers/cpuidle/cpuidle-arm.c | 8 +- drivers/cpuidle/cpuidle-big_little.c | 2 +- drivers/cpuidle/cpuidle-psci.c | 4 +- drivers/cpuidle/cpuidle-qcom-spm.c | 2 +- drivers/cpuidle/cpuidle-riscv-sbi.c | 4 +- drivers/crypto/hisilicon/sec2/sec.h | 1 - drivers/crypto/hisilicon/sec2/sec_crypto.c | 125 ++--- drivers/crypto/intel/iaa/iaa_crypto_main.c | 4 +- .../crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c | 1 + drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c | 59 +-- drivers/crypto/nx/nx-common-pseries.c | 37 +- drivers/crypto/tegra/tegra-se-aes.c | 401 ++++++++++----- drivers/crypto/tegra/tegra-se-hash.c | 287 +++++++---- drivers/crypto/tegra/tegra-se-key.c | 29 +- drivers/crypto/tegra/tegra-se-main.c | 16 +- drivers/crypto/tegra/tegra-se.h | 39 +- drivers/dma/fsl-edma-main.c | 14 +- drivers/edac/i10nm_base.c | 2 + drivers/edac/ie31200_edac.c | 19 +- drivers/edac/igen6_edac.c | 21 +- drivers/edac/skx_common.c | 33 ++ drivers/edac/skx_common.h | 11 + drivers/firmware/cirrus/cs_dsp.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_umsch_mm.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 3 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 1 + .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 15 - .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 16 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 + .../gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c | 4 + .../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 12 +- .../dc/dml2/dml21/src/dml2_core/dml2_core_dcn4.c | 3 +- drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 3 +- .../gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 12 +- drivers/gpu/drm/bridge/ite-it6505.c | 7 +- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 2 + drivers/gpu/drm/display/drm_dp_mst_topology.c | 8 +- drivers/gpu/drm/mediatek/mtk_crtc.c | 7 +- drivers/gpu/drm/mediatek/mtk_dp.c | 6 +- drivers/gpu/drm/mediatek/mtk_dsi.c | 6 +- drivers/gpu/drm/mediatek/mtk_hdmi.c | 33 +- drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 + drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 4 - drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 3 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 8 +- drivers/gpu/drm/msm/dsi/dsi_manager.c | 32 +- drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 2 +- drivers/gpu/drm/msm/msm_dsc_helper.h | 11 - drivers/gpu/drm/panel/panel-ilitek-ili9882t.c | 2 +- drivers/gpu/drm/panthor/panthor_fw.c | 9 +- drivers/gpu/drm/panthor/panthor_fw.h | 6 +- drivers/gpu/drm/panthor/panthor_sched.c | 2 + drivers/gpu/drm/solomon/ssd130x-spi.c | 7 +- drivers/gpu/drm/solomon/ssd130x.c | 6 +- drivers/gpu/drm/vkms/vkms_drv.c | 15 +- drivers/gpu/drm/xe/Kconfig | 2 +- drivers/gpu/drm/xe/xe_guc_pc.c | 53 +- drivers/gpu/drm/xlnx/zynqmp_dp.c | 2 +- drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 2 + drivers/greybus/gb-beagleplay.c | 4 +- drivers/hid/Makefile | 1 - drivers/hid/i2c-hid/i2c-hid-core.c | 2 +- drivers/hwmon/nct6775-core.c | 4 +- drivers/hwtracing/coresight/coresight-catu.c | 2 +- drivers/hwtracing/coresight/coresight-core.c | 20 +- drivers/hwtracing/coresight/coresight-etm4x-core.c | 48 +- drivers/i3c/master/svc-i3c-master.c | 2 +- drivers/iio/accel/mma8452.c | 10 +- drivers/iio/accel/msa311.c | 28 +- drivers/iio/adc/ad4130.c | 41 +- drivers/iio/adc/ad7124.c | 35 +- drivers/iio/adc/ad7173.c | 25 +- drivers/iio/adc/ad7768-1.c | 15 + drivers/iio/dac/adi-axi-dac.c | 8 + drivers/iio/industrialio-backend.c | 4 +- drivers/iio/light/veml6075.c | 8 +- drivers/infiniband/core/device.c | 18 +- drivers/infiniband/core/mad.c | 38 +- drivers/infiniband/core/sysfs.c | 1 + drivers/infiniband/hw/erdma/erdma_cm.c | 1 - drivers/infiniband/hw/mana/main.c | 2 +- drivers/infiniband/hw/mlx5/cq.c | 2 +- drivers/infiniband/hw/mlx5/mr.c | 41 +- drivers/infiniband/hw/mlx5/odp.c | 10 +- drivers/leds/led-core.c | 22 +- drivers/media/dvb-frontends/dib8000.c | 5 +- drivers/media/platform/allegro-dvt/allegro-core.c | 1 + drivers/media/platform/ti/omap3isp/isp.c | 7 + .../platform/verisilicon/hantro_g2_hevc_dec.c | 1 + drivers/media/rc/streamzap.c | 2 +- drivers/media/test-drivers/vimc/vimc-streamer.c | 6 + drivers/memory/omap-gpmc.c | 20 - drivers/mfd/sm501.c | 6 +- drivers/misc/ntsync.c | 1 + drivers/mmc/host/omap.c | 19 +- drivers/mmc/host/sdhci-omap.c | 4 +- drivers/mmc/host/sdhci-pxav3.c | 1 + drivers/net/arcnet/com20020-pci.c | 17 +- drivers/net/dsa/mv88e6xxx/chip.c | 11 +- drivers/net/dsa/mv88e6xxx/phy.c | 3 + drivers/net/dsa/realtek/Kconfig | 2 +- drivers/net/ethernet/ibm/ibmveth.c | 39 +- drivers/net/ethernet/intel/e1000e/defines.h | 3 + drivers/net/ethernet/intel/e1000e/ich8lan.c | 80 ++- drivers/net/ethernet/intel/e1000e/ich8lan.h | 4 + drivers/net/ethernet/intel/idpf/idpf_main.c | 6 +- drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 3 + drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 3 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c | 201 +++++--- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- .../ethernet/marvell/octeontx2/af/rvu_devlink.c | 2 +- .../net/ethernet/mellanox/mlx5/core/en/params.c | 8 +- drivers/net/phy/broadcom.c | 6 +- drivers/net/usb/rndis_host.c | 16 +- drivers/net/usb/usbnet.c | 6 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 20 +- drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 86 ++-- drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 8 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 1 + drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 1 - drivers/ntb/hw/intel/ntb_hw_gen3.c | 3 + drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 2 +- drivers/ntb/test/ntb_perf.c | 4 +- drivers/nvme/host/ioctl.c | 2 +- drivers/nvme/host/pci.c | 37 +- drivers/nvme/host/tcp.c | 5 +- drivers/nvme/target/debugfs.c | 2 +- drivers/pci/controller/cadence/pcie-cadence-ep.c | 3 +- drivers/pci/controller/cadence/pcie-cadence.h | 2 +- drivers/pci/controller/dwc/pcie-designware-ep.c | 1 + drivers/pci/controller/dwc/pcie-histb.c | 12 +- drivers/pci/controller/pcie-brcmstb.c | 16 +- drivers/pci/controller/pcie-xilinx-cpm.c | 10 +- drivers/pci/hotplug/pciehp_hpc.c | 4 +- drivers/pci/iov.c | 48 +- drivers/pci/pci-sysfs.c | 4 +- drivers/pci/pci.c | 22 +- drivers/pci/pcie/aspm.c | 17 +- drivers/pci/pcie/bwctrl.c | 6 +- drivers/pci/pcie/portdrv.c | 8 +- drivers/pci/probe.c | 5 +- drivers/pci/setup-bus.c | 4 +- drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c | 50 +- drivers/pinctrl/intel/pinctrl-intel.c | 1 - drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c | 10 +- drivers/pinctrl/renesas/pinctrl-rza2.c | 2 + drivers/pinctrl/renesas/pinctrl-rzg2l.c | 3 + drivers/pinctrl/renesas/pinctrl-rzv2m.c | 2 + drivers/pinctrl/tegra/pinctrl-tegra.c | 3 + .../platform/surface/surface_aggregator_registry.c | 5 +- drivers/platform/x86/amd/pmf/pmf.h | 5 +- drivers/platform/x86/amd/pmf/tee-if.c | 82 +++- drivers/platform/x86/dell/dell-uart-backlight.c | 2 +- drivers/platform/x86/dell/dell-wmi-ddv.c | 6 +- drivers/platform/x86/intel/hid.c | 7 + .../x86/intel/speed_select_if/isst_if_common.c | 2 +- drivers/platform/x86/intel/vsec.c | 7 + .../x86/lenovo-yoga-tab2-pro-1380-fastcharger.c | 2 +- drivers/platform/x86/thinkpad_acpi.c | 11 + drivers/power/supply/bq27xxx_battery.c | 1 - drivers/power/supply/max77693_charger.c | 2 +- drivers/regulator/pca9450-regulator.c | 6 +- drivers/remoteproc/qcom_q6v5_mss.c | 21 +- drivers/remoteproc/qcom_q6v5_pas.c | 13 +- drivers/remoteproc/remoteproc_core.c | 1 + drivers/rtc/rtc-renesas-rtca3.c | 15 +- drivers/soundwire/slave.c | 1 + drivers/spi/spi-bcm2835.c | 18 +- drivers/spi/spi-cadence-xspi.c | 2 +- .../staging/gpib/agilent_82357a/agilent_82357a.c | 513 +++++++++---------- drivers/staging/gpib/cb7210/cb7210.c | 2 +- drivers/staging/gpib/common/gpib_os.c | 7 +- drivers/staging/gpib/hp_82341/hp_82341.c | 2 +- drivers/staging/gpib/include/gpibP.h | 2 +- drivers/staging/gpib/ni_usb/ni_usb_gpib.c | 545 +++++++++++---------- drivers/staging/gpib/ni_usb/ni_usb_gpib.h | 2 +- drivers/staging/rtl8723bs/Kconfig | 1 + .../vc04_services/interface/vchiq_arm/vchiq_arm.c | 28 +- .../intel/int340x_thermal/int3402_thermal.c | 3 + drivers/tty/n_tty.c | 13 +- drivers/tty/serial/fsl_lpuart.c | 312 ++++++------ drivers/usb/host/xhci-mem.c | 6 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 +- drivers/vhost/scsi.c | 25 +- drivers/video/console/Kconfig | 6 +- drivers/video/fbdev/au1100fb.c | 4 +- drivers/video/fbdev/sm501fb.c | 7 + drivers/w1/masters/w1-uart.c | 4 +- fs/9p/vfs_inode_dotl.c | 2 +- fs/affs/file.c | 9 +- fs/autofs/autofs_i.h | 2 + fs/exec.c | 15 +- fs/exfat/fatent.c | 2 +- fs/exfat/file.c | 29 +- fs/exfat/inode.c | 41 +- fs/exfat/namei.c | 5 + fs/ext4/dir.c | 3 + fs/ext4/super.c | 27 +- fs/fsopen.c | 2 +- fs/fuse/dax.c | 1 - fs/fuse/dir.c | 2 +- fs/fuse/file.c | 4 +- fs/hostfs/hostfs.h | 2 +- fs/hostfs/hostfs_kern.c | 7 +- fs/hostfs/hostfs_user.c | 59 ++- fs/isofs/dir.c | 3 +- fs/jfs/jfs_dtree.c | 3 +- fs/jfs/xattr.c | 13 +- fs/netfs/direct_read.c | 6 +- fs/nfs/delegation.c | 63 ++- fs/nfs/nfs4xdr.c | 18 +- fs/nfs/sysfs.c | 22 +- fs/nfs/write.c | 4 +- fs/nfsd/nfs4state.c | 37 +- fs/nfsd/nfsctl.c | 44 +- fs/nfsd/vfs.c | 28 +- fs/ntfs3/attrib.c | 3 +- fs/ntfs3/file.c | 22 +- fs/ntfs3/frecord.c | 6 +- fs/ntfs3/index.c | 4 +- fs/ntfs3/ntfs.h | 2 +- fs/ocfs2/alloc.c | 8 + fs/proc/base.c | 2 +- fs/smb/client/cifsacl.c | 34 +- fs/smb/client/cifssmb.c | 46 +- fs/smb/client/connect.c | 16 +- fs/smb/client/smb2pdu.c | 96 ++-- fs/smb/common/smbacl.h | 3 +- fs/smb/server/auth.c | 6 +- fs/smb/server/connection.h | 11 + fs/smb/server/mgmt/user_session.c | 37 +- fs/smb/server/mgmt/user_session.h | 2 + fs/smb/server/oplock.c | 12 +- fs/smb/server/smb2pdu.c | 54 +- fs/smb/server/smbacl.c | 50 +- fs/smb/server/smbacl.h | 2 +- include/drm/display/drm_dp_mst_helper.h | 7 + include/linux/context_tracking_irq.h | 8 +- include/linux/coresight.h | 4 + include/linux/dma-direct.h | 13 +- include/linux/fwnode.h | 2 +- include/linux/interrupt.h | 8 +- include/linux/mem_encrypt.h | 23 + include/linux/nfs_fs_sb.h | 4 + include/linux/nmi.h | 4 - include/linux/pgtable.h | 28 +- include/linux/pm_runtime.h | 2 + include/linux/rcupdate.h | 2 +- include/linux/sched/smt.h | 2 +- include/linux/seccomp.h | 8 +- include/linux/thermal.h | 2 - include/linux/trace_events.h | 14 + include/linux/uprobes.h | 2 + include/rdma/ib_verbs.h | 1 + io_uring/net.c | 23 +- kernel/bpf/core.c | 19 +- kernel/bpf/verifier.c | 7 + kernel/cpu.c | 5 - kernel/events/core.c | 46 +- kernel/events/ring_buffer.c | 2 +- kernel/events/uprobes.c | 15 +- kernel/fork.c | 4 + kernel/kexec_elf.c | 2 +- kernel/locking/semaphore.c | 13 +- kernel/sched/deadline.c | 2 +- kernel/sched/fair.c | 50 +- kernel/seccomp.c | 14 +- kernel/trace/bpf_trace.c | 2 +- kernel/trace/ring_buffer.c | 4 +- kernel/trace/trace_events.c | 21 + kernel/trace/trace_events_hist.c | 133 ++++- kernel/trace/trace_events_synth.c | 32 +- kernel/trace/trace_functions_graph.c | 1 + kernel/trace/trace_irqsoff.c | 2 - kernel/trace/trace_osnoise.c | 1 - kernel/trace/trace_sched_wakeup.c | 2 - kernel/watch_queue.c | 9 + kernel/watchdog.c | 25 - kernel/watchdog_perf.c | 28 +- lib/842/842_compress.c | 2 + lib/stackinit_kunit.c | 30 +- lib/vsprintf.c | 2 +- mm/gup.c | 3 + mm/memory.c | 13 +- mm/zswap.c | 30 +- net/can/af_can.c | 12 +- net/can/af_can.h | 12 +- net/can/proc.c | 46 +- net/core/devmem.c | 4 +- net/core/dst.c | 8 + net/core/rtnetlink.c | 3 + net/core/rtnl_net_debug.c | 2 +- net/ipv4/ip_tunnel_core.c | 4 +- net/ipv4/udp.c | 42 +- net/ipv6/addrconf.c | 37 +- net/ipv6/calipso.c | 21 +- net/ipv6/route.c | 42 +- net/mac80211/driver-ops.c | 10 +- net/mac80211/iface.c | 11 +- net/mac80211/rx.c | 10 +- net/mac80211/sta_info.c | 20 +- net/mac80211/util.c | 5 +- net/netfilter/nf_tables_api.c | 4 +- net/netfilter/nft_set_hash.c | 3 +- net/netfilter/nft_tunnel.c | 6 +- net/openvswitch/actions.c | 6 - net/sched/act_tunnel_key.c | 2 +- net/sched/cls_flower.c | 2 +- net/sched/sch_skbprio.c | 3 - net/sctp/sysctl.c | 4 + net/vmw_vsock/af_vsock.c | 6 +- net/xdp/xsk.c | 5 +- rust/Makefile | 4 +- rust/kernel/print.rs | 7 +- samples/bpf/Makefile | 2 +- samples/trace_events/trace-events-sample.h | 8 +- scripts/package/debian/rules | 6 +- scripts/selinux/install_policy.sh | 15 +- security/smack/smack.h | 6 + security/smack/smack_lsm.c | 34 +- sound/core/timer.c | 147 +++--- sound/pci/hda/patch_realtek.c | 50 +- sound/soc/amd/acp/acp-legacy-common.c | 10 +- sound/soc/codecs/cs35l41-spi.c | 5 +- sound/soc/codecs/cs42l43-jack.c | 13 +- sound/soc/codecs/cs42l43.c | 15 +- sound/soc/codecs/cs42l43.h | 3 + sound/soc/codecs/rt1320-sdw.c | 3 + sound/soc/codecs/rt5665.c | 24 +- sound/soc/codecs/wsa884x.c | 4 +- sound/soc/fsl/imx-card.c | 4 + sound/soc/tegra/tegra210_adx.c | 6 +- sound/soc/ti/j721e-evm.c | 2 + sound/usb/mixer_quirks.c | 7 +- tools/arch/x86/lib/insn.c | 2 +- tools/bpf/runqslower/Makefile | 3 +- tools/lib/bpf/btf.c | 4 +- tools/lib/bpf/linker.c | 2 +- tools/lib/bpf/str_error.c | 2 +- tools/lib/bpf/str_error.h | 7 +- tools/objtool/check.c | 35 +- tools/perf/Makefile.config | 10 +- tools/perf/Makefile.perf | 2 +- tools/perf/arch/powerpc/util/header.c | 4 +- tools/perf/arch/x86/util/topdown.c | 2 +- tools/perf/bench/syscall.c | 22 +- tools/perf/builtin-report.c | 2 +- .../arch/arm64/ampere/ampereonex/metrics.json | 10 +- tools/perf/tests/hwmon_pmu.c | 16 +- .../shell/coresight/asm_pure_loop/asm_pure_loop.S | 2 + tools/perf/tests/shell/record_bpf_filter.sh | 4 +- tools/perf/tests/shell/stat_all_pmu.sh | 48 +- tools/perf/tests/tool_pmu.c | 4 +- tools/perf/util/arm-spe.c | 8 +- tools/perf/util/bpf-filter.l | 2 +- tools/perf/util/comm.c | 2 + tools/perf/util/debug.c | 2 +- tools/perf/util/dso.h | 4 +- tools/perf/util/evlist.c | 13 +- tools/perf/util/expr.c | 2 + tools/perf/util/hwmon_pmu.c | 14 - tools/perf/util/hwmon_pmu.h | 16 + tools/perf/util/intel-tpebs.c | 2 +- tools/perf/util/pmu.c | 7 +- tools/perf/util/pmu.h | 5 + tools/perf/util/pmus.c | 20 +- tools/perf/util/python.c | 17 +- tools/perf/util/stat-shadow.c | 3 +- tools/perf/util/stat.c | 13 +- tools/perf/util/tool_pmu.c | 3 +- tools/perf/util/units.c | 2 +- tools/power/x86/turbostat/turbostat.8 | 2 + tools/power/x86/turbostat/turbostat.c | 3 +- tools/testing/selftests/bpf/Makefile | 1 + .../selftests/bpf/prog_tests/bloom_filter_map.c | 5 + tools/testing/selftests/bpf/prog_tests/tailcalls.c | 1 + tools/testing/selftests/bpf/progs/strncmp_bench.c | 5 +- tools/testing/selftests/mm/cow.c | 2 +- .../selftests/net/netfilter/br_netfilter.sh | 7 + .../selftests/net/netfilter/br_netfilter_queue.sh | 7 + tools/testing/selftests/net/netfilter/nft_queue.sh | 1 + tools/testing/selftests/pcie_bwctrl/Makefile | 2 +- 501 files changed, 5049 insertions(+), 3056 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/499 fs: support O_PATH fds with FSCONFIG_SET_FD
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <[email protected]>
[ Upstream commit 0ff053b98a0f039e52c2bd8d0cb38f2831edfaf5 ]
Let FSCONFIG_SET_FD handle O_PATH file descriptors. This is particularly useful in the context of overlayfs where layers can be specified via file descriptors instead of paths. But userspace must currently use non-O_PATH file desriptors which is often pointless especially if the file descriptors have been created via open_tree(OPEN_TREE_CLONE).
--- fs/autofs/autofs_i.h | 2 ++ fs/fsopen.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-)
fs/autofs/autofs_i.h +2 -0
@@ -218,6 +218,8 @@ void autofs_clean_ino(struct autofs_info *);static inline int autofs_check_pipe (struct file *pipe) { +if (pipe->f_mode &FMODE_PATH ) +return -EINVAL ;if (!(pipe->f_mode &FMODE_CAN_WRITE ))return -EINVAL ;if (!S_ISFIFO (file_inode (pipe)->i_mode))
fs/fsopen.c +1 -1
@@ -453,7 +453,7 @@ SYSCALL_DEFINE5(fsconfig,case FSCONFIG_SET_FD : param.type = fs_value_is_file; ret = -EBADF ; - param.file =fget (aux); + param.file =fget_raw (aux);if (!param.file) goto out_key; param.dirfd = aux;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 2/499 watch_queue: fix pipe accounting mismatch
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Sandeen <[email protected]>
[ Upstream commit f13abc1e8e1a3b7455511c4e122750127f6bc9b0 ]
Currently, watch_queue_set_size() modifies the pipe buffers charged to user->pipe_bufs without updating the pipe->nr_accounted on the pipe itself, due to the if (!pipe_has_watch_queue()) test in pipe_resize_ring(). This means that when the pipe is ultimately freed, we decrement user->pipe_bufs by something other than what than we had charged to it, potentially leading to an underflow. This in turn can cause subsequent too_many_pipe_buffers_soft() tests to fail with -EPERM.
To remedy this, explicitly account for the pipe usage in watch_queue_set_size() to match the number set via account_pipe_buffers()
(It's unclear why watch_queue_set_size() does not update nr_accounted; it may be due to intentional overprovisioning in watch_queue_set_size()?)
--- kernel/watch_queue.c | 9 +++++++++ 1 file changed, 9 insertions(+)
kernel/watch_queue.c +9 -0
@@ -269,6 +269,15 @@ long watch_queue_set_size(struct pipe_inode_info *pipe, unsigned int nr_notes)if (ret <0 ) goto error; +/* +* pipe_resize_ring() does not update nr_accounted for watch_queue +* pipes, because the above vastly overprovisions. Set nr_accounted on +* and max_usage this pipe to the number that was actually charged to +* the user above via account_pipe_buffers. +*/ + pipe->max_usage = nr_pages; + pipe->nr_accounted = nr_pages; + ret = -ENOMEM ; pages =kcalloc (nr_pages,sizeof (struct page *),GFP_KERNEL );if (!pages)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 3/499 x86/mm/pat: cpa-test: fix length for CPA_ARRAY test
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport (Microsoft) <[email protected]>
[ Upstream commit 33ea120582a638b2f2e380a50686c2b1d7cce795 ]
The CPA_ARRAY test always uses len[1] as numpages argument to change_page_attr_set() although the addresses array is different each iteration of the test loop.
Replace len[1] with len[i] to have numpages matching the addresses array.
--- arch/x86/mm/pat/cpa-test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/mm/pat/cpa-test.c +1 -1
@@ -183,7 +183,7 @@ static int pageattr_test(void)break ;case 1 : - err =change_page_attr_set (addrs, len[1 ],PAGE_CPA_TEST ,1 ); + err =change_page_attr_set (addrs, len[i],PAGE_CPA_TEST ,1 );break ;case 2 :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 4/499 cpufreq: scpi: compare kHz instead of Hz
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: zuoqian <[email protected]>
[ Upstream commit 4742da9774a416908ef8e3916164192c15c0e2d1 ]
The CPU rate from clk_get_rate() may not be divisible by 1000 (e.g., 133333333). But the rate calculated from frequency(kHz) is always divisible by 1000 (e.g., 133333000).
Comparing the rate causes a warning during CPU scaling:
"cpufreq: __target_index: Failed to change cpu frequency: -5". When we choose to compare kHz here, the issue does not occur.
--- drivers/cpufreq/scpi-cpufreq.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/cpufreq/scpi-cpufreq.c +3 -2
@@ -39,8 +39,9 @@ static unsigned int scpi_cpufreq_get_rate(unsigned int cpu)static int scpi_cpufreq_set_target (struct cpufreq_policy *policy,unsigned int index) { -u64 rate = policy->freq_table[index].frequency *1000 ; +unsigned long freq_khz = policy->freq_table[index].frequency;struct scpi_data *priv = policy->driver_data; +unsigned long rate = freq_khz *1000 ;int ret; ret =clk_set_rate (priv->clk, rate);
@@ -48,7 +49,7 @@ scpi_cpufreq_set_target(struct cpufreq_policy *policy, unsigned int index)if (ret)return ret; -if (clk_get_rate (priv->clk) != rate) +if (clk_get_rate (priv->clk) /1000 != freq_khz)return -EIO ;return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 5/499 seccomp: fix the __secure_computing() stub for !HAVE_ARCH_SECCOMP_FILTER
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
[ Upstream commit b37778bec82ba82058912ca069881397197cd3d5 ]
Depending on CONFIG_HAVE_ARCH_SECCOMP_FILTER, __secure_computing(NULL) will crash or not. This is not consistent/safe, especially considering that after the previous change __secure_computing(sd) is always called with sd == NULL.
Fortunately, if CONFIG_HAVE_ARCH_SECCOMP_FILTER=n, __secure_computing() has no callers, these architectures use secure_computing_strict(). Yet it make sense make __secure_computing(NULL) safe in this case.
Note also that with this change we can unexport secure_computing_strict() and change the current callers to use __secure_computing(NULL).
--- include/linux/seccomp.h | 8 ++------ kernel/seccomp.c | 14 ++++++++++---- 2 files changed, 12 insertions(+), 10 deletions(-)
include/linux/seccomp.h +2 -6
@@ -22,8 +22,9 @@#include <linux/atomic.h> #include <asm/seccomp.h> -#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER extern int __secure_computing (const struct seccomp_data *sd); + +#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER static inline int secure_computing (void ) {if (unlikely (test_syscall_work (SECCOMP )))
@@ -32,11 +33,6 @@ static inline int secure_computing(void) }#else extern void secure_computing_strict (int this_syscall); -static inline int __secure_computing (const struct seccomp_data *sd) -{ -secure_computing_strict (sd->nr); -return 0 ; -}#endif extern long prctl_get_seccomp (void );
kernel/seccomp.c +10 -4
@@ -29,13 +29,11 @@#include <linux/syscalls.h> #include <linux/sysctl.h> +#include <asm/syscall.h> +/* Not exposed in headers: strictly internal use only. */ #define SECCOMP_MODE_DEAD (SECCOMP_MODE_FILTER + 1) -#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER -#include <asm/syscall.h> -#endif -#ifdef CONFIG_SECCOMP_FILTER #include <linux/file.h> #include <linux/filter.h>
@@ -1074,6 +1072,14 @@ void secure_computing_strict(int this_syscall) else BUG(); } +int __secure_computing (const struct seccomp_data *sd) +{ +int this_syscall = sd ? sd->nr : +syscall_get_nr (current,current_pt_regs ()); + +secure_computing_strict (this_syscall); +return 0 ; +}#else #ifdef CONFIG_SECCOMP_FILTER
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 6/499 smack: dont compile ipv6 code unless ipv6 is configured
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Andreev <[email protected]>
[ Upstream commit bfcf4004bcbce2cb674b4e8dbd31ce0891766bac ]
I want to be sure that ipv6-specific code
is not compiled in kernel binaries
if ipv6 is not configured.
[1] was getting rid of "unused variable" warning, but, with that, it also mandated compilation of a handful ipv6- specific functions in ipv4-only kernel configurations:
smk_ipv6_localhost, smack_ipv6host_label, smk_ipv6_check.
Their compiled bodies are likely to be removed by compiler from the resulting binary, but, to be on the safe side, I remove them from the compiler view.
--- security/smack/smack.h | 6 ++++++ security/smack/smack_lsm.c | 10 +++++++++- 2 files changed, 15 insertions(+), 1 deletion(-)
security/smack/smack.h +6 -0
@@ -152,6 +152,7 @@ struct smk_net4addr {struct smack_known *smk_label;/* label */ }; +#if IS_ENABLED (CONFIG_IPV6 )/* * An entry in the table identifying IPv6 hosts. */
@@ -162,7 +163,9 @@ struct smk_net6addr {int smk_masks;/* mask size */ struct smack_known *smk_label; /* label */ }; +#endif /* CONFIG_IPV6 */ +#ifdef SMACK_IPV6_PORT_LABELING /* * An entry in the table identifying ports. */
@@ -175,6 +178,7 @@ struct smk_port_label {short smk_sock_type;/* Socket type */ short smk_can_reuse; }; +#endif /* SMACK_IPV6_PORT_LABELING */ struct smack_known_list_elem {struct list_head list;
@@ -314,7 +318,9 @@ extern struct smack_known smack_known_web;extern struct mutex smack_known_lock;extern struct list_head smack_known_list;extern struct list_head smk_net4addr_list; +#if IS_ENABLED (CONFIG_IPV6 )extern struct list_head smk_net6addr_list; +#endif /* CONFIG_IPV6 */ extern struct mutex smack_onlycap_lock;extern struct list_head smack_onlycap_list;
security/smack/smack_lsm.c +9 -1
@@ -2508,6 +2508,7 @@ static struct smack_known *smack_ipv4host_label(struct sockaddr_in *sip)return NULL ; } +#if IS_ENABLED (CONFIG_IPV6 )/* * smk_ipv6_localhost - Check for local ipv6 host address * @sip: the address
@@ -2575,6 +2576,7 @@ static struct smack_known *smack_ipv6host_label(struct sockaddr_in6 *sip) return NULL; } +#endif /* CONFIG_IPV6 */ /** * smack_netlbl_add - Set the secattr on a socket
@@ -2679,6 +2681,7 @@ static int smk_ipv4_check(struct sock *sk, struct sockaddr_in *sap)return rc; } +#if IS_ENABLED (CONFIG_IPV6 )/** * smk_ipv6_check - check Smack access * @subject: subject Smack label
@@ -2711,6 +2714,7 @@ static int smk_ipv6_check(struct smack_known *subject, rc =smk_bu_note ("IPv6 check" , subject, object,MAY_WRITE , rc); return rc; } +#endif /* CONFIG_IPV6 */ #ifdef SMACK_IPV6_PORT_LABELING /**
@@ -3043,7 +3047,9 @@ static int smack_socket_connect(struct socket *sock, struct sockaddr *sap,return 0 ; if (addrlen < offsetofend(struct sockaddr, sa_family))return 0 ; -if (IS_ENABLED (CONFIG_IPV6 ) && sap->sa_family ==AF_INET6 ) { + +#if IS_ENABLED (CONFIG_IPV6 ) +if (sap->sa_family ==AF_INET6 ) {struct sockaddr_in6 *sip = (struct sockaddr_in6 *)sap;struct smack_known *rsp =NULL ;
@@ -3063,6 +3069,8 @@ static int smack_socket_connect(struct socket *sock, struct sockaddr *sap, return rc; } +#endif /* CONFIG_IPV6 */ +if (sap->sa_family !=AF_INET || addrlen <sizeof (struct sockaddr_in ))return 0 ; rc =smk_ipv4_check (sock->sk, (struct sockaddr_in *)sap);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 7/499 smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Andreev <[email protected]>
[ Upstream commit 6cce0cc3861337b3ad8d4ac131d6e47efa0954ec ]
Since inception [1], SMACK initializes ipv* child socket security for connection-oriented communications (tcp/sctp/dccp) during accept() syscall, in the security_sock_graft() hook:
| void smack_sock_graft(struct sock *sk, ...)
| {
| // only ipv4 and ipv6 are eligible here
| // ...
| ssp = sk->sk_security; // socket security
| ssp->smk_in = skp; // process label: smk_of_current()
| ssp->smk_out = skp; // process label: smk_of_current()
| }This approach is incorrect for two reasons:
A) initialization occurs too late for child socket security:
The child socket is created by the kernel once the handshake completes (e.g., for tcp: after receiving ack for syn+ack).
Data can legitimately start arriving to the child socket immediately, long before the application calls accept() on the socket.
Those data are (currently — were) processed by SMACK using incorrect child socket security attributes.
B) Incoming connection requests are handled using the listening socket's security, hence, the child socket must inherit the listening socket's security attributes.
smack_sock_graft() initilizes the child socket's security with a process label, as is done for a new socket()
But ... the process label is not necessarily the same as the listening socket label. A privileged application may legitimately set other in/out labels for a listening socket.
When this happens, SMACK processes incoming packets using incorrect socket security attributes.
In [2] Michael Lontke noticed (A) and fixed it in [3] by adding socket initialization into security_sk_clone_security() hook like
| void smack_sk_clone_security(struct sock *oldsk, struct sock *newsk)
| {
| *(struct socket_smack *)newsk->sk_security =
| *(struct socket_smack *)oldsk->sk_security;
| }This initializes the child socket security with the parent (listening) socket security at the appropriate time.
I was forced to revisit this old story because
smack_sock_graft() was left in place by [3] and continues overwriting the child socket's labels with the process label,
and there might be a reason for this, so I undertook a study.
If the process label differs from the listening socket's labels, the following occurs for ipv4:
assigning the smk_out is not accompanied by netlbl_sock_setattr, so the outgoing packet's cipso label does not change.
So, the only effect of this assignment for interhost communications is a divergence between the program-visible “out” socket label and the cipso network label. For intrahost communications this label, however, becomes visible via secmark netfilter marking, and is checked for access rights by the client, receiving side.
Assigning the smk_in affects both interhost and intrahost
communications: the server begins to check access rights against an wrong label.
Access check against wrong label (smk_in or smk_out), unsurprisingly fails, breaking the connection.
The above affects protocols that calls security_sock_graft() during accept(), namely: {tcp,dccp,sctp}/{ipv4,ipv6}
One extra security_sock_graft() caller, crypto/af_alg.c`af_alg_accept is not affected, because smack_sock_graft() does nothing for PF_ALG.
To reproduce, assign non-default in/out labels to a listening socket, setup rules between these labels and client label, attempt to connect and send some data.
Ipv6 specific: ipv6 packets do not convey SMACK labels. To reproduce the issue in interhost communications set opposite labels in /smack/ipv6host on both hosts.
Ipv6 intrahost communications do not require tricking, because SMACK labels are conveyed via secmark netfilter marking.
So, currently smack_sock_graft() is not useful, but harmful, therefore, I have removed it.
This fixes the issue for {tcp,dccp}/{ipv4,ipv6},
but not sctp/{ipv4,ipv6}.
Although this change is necessary for sctp+smack to function correctly, it is not sufficient because:
sctp/ipv4 does not call security_sk_clone() and sctp/ipv6 ignores SMACK completely.
These are separate issues, belong to other subsystem, and should be addressed separately.
[1] 2008-02-04,
[2] Michael Lontke, 2022-08-31, SMACK LSM checks wrong object label during ingress network traffic
[3] 2022-08-31, michael.lontke,
commit 4ca165fc6c49 ("SMACK: Add sk_clone_security LSM hook")
--- security/smack/smack_lsm.c | 24 ------------------------ 1 file changed, 24 deletions(-)
security/smack/smack_lsm.c +0 -24
@@ -4366,29 +4366,6 @@ static int smack_socket_getpeersec_dgram(struct socket *sock,return 0 ; } -/** -* smack_sock_graft - Initialize a newly created socket with an existing sock -* @sk: child sock -* @parent: parent socket -* -* Set the smk_{in,out} state of an existing sock based on the process that -* is creating the new socket. -*/ -static void smack_sock_graft (struct sock *sk,struct socket *parent) -{ -struct socket_smack *ssp; -struct smack_known *skp =smk_of_current (); - -if (sk ==NULL || - (sk->sk_family !=PF_INET && sk->sk_family !=PF_INET6 )) -return ; - - ssp =smack_sock (sk); - ssp->smk_in = skp; - ssp->smk_out = skp; -/* cssp->smk_packet is already set in smack_inet_csk_clone() */ -} -/** * smack_inet_conn_request - Smack access check on connect * @sk: socket involved
@@ -5195,7 +5172,6 @@ static struct security_hook_list smack_hooks[] __ro_after_init = {LSM_HOOK_INIT (sk_free_security, smack_sk_free_security), #endifLSM_HOOK_INIT (sk_clone_security, smack_sk_clone_security), -LSM_HOOK_INIT (sock_graft, smack_sock_graft),LSM_HOOK_INIT (inet_conn_request, smack_inet_conn_request), LSM_HOOK_INIT(inet_csk_clone, smack_inet_csk_clone),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 8/499 sched: Cancel the slice protection of the idle entity
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: zihan zhou <[email protected]>
[ Upstream commit f553741ac8c0e467a3b873e305f34b902e50b86d ]
A wakeup non-idle entity should preempt idle entity at any time, but because of the slice protection of the idle entity, the non-idle entity has to wait, so just cancel it.
This patch is aimed at minimizing the impact of SCHED_IDLE on SCHED_NORMAL. For example, a task with SCHED_IDLE policy that sleeps for 1s and then runs for 3 ms, running cyclictest on the same cpu, has a maximum latency of 3 ms, which is caused by the slice protection of the idle entity. It is unreasonable. With this patch, the cyclictest latency under the same conditions is basically the same on the cpu with idle processes and on empty cpu.
--- kernel/sched/fair.c | 46 ++++++++++++++++++++++++++++++++------------- 1 file changed, 33 insertions(+), 13 deletions(-)
kernel/sched/fair.c +33 -13
@@ -880,6 +880,26 @@ struct sched_entity *__pick_first_entity(struct cfs_rq *cfs_rq)return __node_2_se (left); } +/* +* HACK, stash a copy of deadline at the point of pick in vlag, +* which isn't used until dequeue. +*/ +static inline void set_protect_slice (struct sched_entity *se) +{ + se->vlag = se->deadline; +} + +static inline bool protect_slice (struct sched_entity *se) +{ +return se->vlag == se->deadline; +} + +static inline void cancel_protect_slice (struct sched_entity *se) +{ +if (protect_slice (se)) + se->vlag = se->deadline +1 ; +} +/* * Earliest Eligible Virtual Deadline First *
@@ -916,11 +936,7 @@ static struct sched_entity *pick_eevdf(struct cfs_rq *cfs_rq)if (curr && (!curr->on_rq || !entity_eligible (cfs_rq, curr))) curr =NULL ; -/* -* Once selected, run a task until it either becomes non-eligible or -* until it gets a new slice. See the HACK in set_next_entity(). -*/ -if (sched_feat (RUN_TO_PARITY ) && curr && curr->vlag == curr->deadline) +if (sched_feat (RUN_TO_PARITY ) && curr &&protect_slice (curr))return curr;/* Pick the leftmost entity if it's eligible */
@@ -5517,11 +5533,8 @@ set_next_entity(struct cfs_rq *cfs_rq, struct sched_entity *se)update_stats_wait_end_fair (cfs_rq, se);__dequeue_entity (cfs_rq, se);update_load_avg (cfs_rq, se,UPDATE_TG ); -/* -* HACK, stash a copy of deadline at the point of pick in vlag, -* which isn't used until dequeue. -*/ - se->vlag = se->deadline; + +set_protect_slice (se); }update_stats_curr_start (cfs_rq, se);
@@ -8767,8 +8780,15 @@ static void check_preempt_wakeup_fair(struct rq *rq, struct task_struct *p, int* Preempt an idle entity in favor of a non-idle entity (and don't preempt * in the inverse case). */ -if (cse_is_idle && !pse_is_idle) +if (cse_is_idle && !pse_is_idle) { +/* +* When non-idle entity preempt an idle entity, +* don't give idle entity slice protection. +*/ +cancel_protect_slice (se); goto preempt; + } +if (cse_is_idle != pse_is_idle)return ;
@@ -8787,8 +8807,8 @@ static void check_preempt_wakeup_fair(struct rq *rq, struct task_struct *p, int* Note that even if @p does not turn out to be the most eligible * task at this moment, current's slice protection will be lost. */ -if (do_preempt_short (cfs_rq, pse, se) && se->vlag == se->deadline) - se->vlag = se->deadline +1 ; +if (do_preempt_short (cfs_rq, pse, se)) +cancel_protect_slice (se);/* * If @p has become the most eligible task, force preemption.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 9/499 sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tianchen Ding <[email protected]>
[ Upstream commit 563bc2161b94571ea425bbe2cf69fd38e24cdedf ]
When a task is enqueued and its parent cgroup se is already on_rq, this parent cgroup se will not be enqueued again, and hence the root->min_slice leaves unchanged. The same issue happens when a task is dequeued and its parent cgroup se has other runnable entities, and the parent cgroup se will not be dequeued.
Force propagating min_slice when se doesn't need to be enqueued or dequeued. Ensure the se hierarchy always get the latest min_slice.
--- kernel/sched/fair.c | 4 ++++ 1 file changed, 4 insertions(+)
kernel/sched/fair.c +4 -0
@@ -6988,6 +6988,8 @@ enqueue_task_fair(struct rq *rq, struct task_struct *p, int flags)update_cfs_group (se); se->slice = slice; +if (se != cfs_rq->curr) +min_vruntime_cb_propagate (&se->run_node,NULL ); slice =cfs_rq_min_slice (cfs_rq); cfs_rq->h_nr_running++;
@@ -7117,6 +7119,8 @@ static int dequeue_entities(struct rq *rq, struct sched_entity *se, int flags)update_cfs_group (se); se->slice = slice; +if (se != cfs_rq->curr) +min_vruntime_cb_propagate (&se->run_node,NULL ); slice =cfs_rq_min_slice (cfs_rq); cfs_rq->h_nr_running -= h_nr_running;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 10/499 cpufreq: governor: Fix negative idle_time handling in dbs_update()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Zhan <[email protected]>
[ Upstream commit 3698dd6b139dc37b35a9ad83d9330c1f99666c02 ]
We observed an issue that the CPU frequency can't raise up with a 100% CPU load when NOHZ is off and the 'conservative' governor is selected.
'idle_time' can be negative if it's obtained from get_cpu_idle_time_jiffy() when NOHZ is off. This was found and explained in commit 9485e4ca0b48 ("cpufreq: governor: Fix handling of special cases in dbs_update()").
However, commit 7592019634f8 ("cpufreq: governors: Fix long idle detection logic in load calculation") introduced a comparison between 'idle_time' and 'samling_rate' to detect a long idle interval. While 'idle_time' is converted to int before comparison, it's actually promoted to unsigned again when compared with an unsigned 'sampling_rate'. Hence, this leads to wrong idle interval detection when it's in fact 100% busy and sets policy_dbs->idle_periods to a very large value. 'conservative' adjusts the frequency to minimum because of the large 'idle_periods', such that the frequency can't raise up. 'Ondemand' doesn't use policy_dbs->idle_periods so it fortunately avoids the issue.
Correct negative 'idle_time' to 0 before any use of it in dbs_update().
--- drivers/cpufreq/cpufreq_governor.c | 45 +++++++++++++++--------------- 1 file changed, 23 insertions(+), 22 deletions(-)
drivers/cpufreq/cpufreq_governor.c +23 -22
@@ -145,7 +145,23 @@ unsigned int dbs_update(struct cpufreq_policy *policy) time_elapsed = update_time - j_cdbs->prev_update_time; j_cdbs->prev_update_time = update_time; - idle_time = cur_idle_time - j_cdbs->prev_cpu_idle; +/* +* cur_idle_time could be smaller than j_cdbs->prev_cpu_idle if +* it's obtained from get_cpu_idle_time_jiffy() when NOHZ is +* off, where idle_time is calculated by the difference between +* time elapsed in jiffies and "busy time" obtained from CPU +* statistics. If a CPU is 100% busy, the time elapsed and busy +* time should grow with the same amount in two consecutive +* samples, but in practice there could be a tiny difference, +* making the accumulated idle time decrease sometimes. Hence, +* in this case, idle_time should be regarded as 0 in order to +* make the further process correct. +*/ +if (cur_idle_time > j_cdbs->prev_cpu_idle) + idle_time = cur_idle_time - j_cdbs->prev_cpu_idle; +else + idle_time =0 ; + j_cdbs->prev_cpu_idle = cur_idle_time;if (ignore_nice) {
@@ -162,7 +178,7 @@ unsigned int dbs_update(struct cpufreq_policy *policy)* calls, so the previous load value can be used then. */ load = j_cdbs->prev_load; - }else if (unlikely ((int )idle_time >2 * sampling_rate && + }else if (unlikely (idle_time >2 * sampling_rate && j_cdbs->prev_load)) {/* * If the CPU had gone completely idle and a task has
@@ -189,30 +205,15 @@ unsigned int dbs_update(struct cpufreq_policy *policy) load = j_cdbs->prev_load; j_cdbs->prev_load =0 ; }else { -if (time_elapsed >= idle_time) { +if (time_elapsed > idle_time) load =100 * (time_elapsed - idle_time) / time_elapsed; - }else { -/* -* That can happen if idle_time is returned by -* get_cpu_idle_time_jiffy(). In that case -* idle_time is roughly equal to the difference -* between time_elapsed and "busy time" obtained -* from CPU statistics. Then, the "busy time" -* can end up being greater than time_elapsed -* (for example, if jiffies_64 and the CPU -* statistics are updated by different CPUs), -* so idle_time may in fact be negative. That -* means, though, that the CPU was busy all -* the time (on the rough average) during the -* last sampling interval and 100 can be -* returned as the load. -*/ - load = (int )idle_time <0 ?100 :0 ; - } +else + load =0 ; + j_cdbs->prev_load = load; } -if (unlikely ((int )idle_time >2 * sampling_rate)) { +if (unlikely (idle_time >2 * sampling_rate)) {unsigned int periods = idle_time / sampling_rate;if (periods < idle_periods)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/499 EDAC/igen6: Fix the flood of invalid error reports
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit 267e5b1d267539d9a927dc04aab6f15aca57da92 ]
The ECC_ERROR_LOG register of certain SoCs may contain the invalid value ~0, which results in a flood of invalid error reports in polling mode.
Fix the flood of invalid error reports by skipping the invalid ECC error log value ~0.
--- drivers/edac/igen6_edac.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)
drivers/edac/igen6_edac.c +15 -6
@@ -785,13 +785,22 @@ static u64 ecclog_read_and_clear(struct igen6_imc *imc) {u64 ecclog =readq (imc->window +ECC_ERROR_LOG_OFFSET ); -if (ecclog & (ECC_ERROR_LOG_CE |ECC_ERROR_LOG_UE )) { -/* Clear CE/UE bits by writing 1s */ -writeq (ecclog, imc->window +ECC_ERROR_LOG_OFFSET ); -return ecclog; - } +/* +* Quirk: The ECC_ERROR_LOG register of certain SoCs may contain +* the invalid value ~0. This will result in a flood of invalid +* error reports in polling mode. Skip it. +*/ +if (ecclog == ~0 ) +return 0 ; -return 0 ; +/* Neither a CE nor a UE. Skip it.*/ +if (!(ecclog & (ECC_ERROR_LOG_CE |ECC_ERROR_LOG_UE ))) +return 0 ; + +/* Clear CE/UE bits by writing 1s */ +writeq (ecclog, imc->window +ECC_ERROR_LOG_OFFSET ); + +return ecclog; }static void errsts_clear (struct igen6_imc *imc)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/499 EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit d9207cf7760f5f5599e9ff7eb0fedf56821a1d59 ]
When doing error injection to some memory DIMMs on certain Intel Emerald Rapids servers, the i10nm_edac missed error reports for some memory DIMMs.
Certain BIOS configurations may hide some memory controllers, and the i10nm_edac doesn't enumerate these hidden memory controllers. However, the ADXL decodes memory errors using memory controller physical indices even if there are hidden memory controllers. Therefore, the memory controller physical indices reported by the ADXL may mismatch the logical indices enumerated by the i10nm_edac, resulting in missed error reports for some memory DIMMs.
Fix this issue by creating a mapping table from memory controller physical indices (used by the ADXL) to logical indices (used by the i10nm_edac) and using it to convert the physical indices to the logical indices during the error handling process.
--- drivers/edac/i10nm_base.c | 2 ++ drivers/edac/skx_common.c | 33 +++++++++++++++++++++++++++++++++ drivers/edac/skx_common.h | 11 +++++++++++ 3 files changed, 46 insertions(+)
drivers/edac/i10nm_base.c +2 -0
@@ -751,6 +751,8 @@ static int i10nm_get_ddr_munits(void)continue ; }else { d->imc[lmc].mdev = mdev; +if (res_cfg->type ==SPR ) +skx_set_mc_mapping (d, i, lmc); lmc++; } }
drivers/edac/skx_common.c +33 -0
@@ -120,6 +120,35 @@ void skx_adxl_put(void) }EXPORT_SYMBOL_GPL (skx_adxl_put); +static void skx_init_mc_mapping (struct skx_dev *d) +{ +/* +* By default, the BIOS presents all memory controllers within each +* socket to the EDAC driver. The physical indices are the same as +* the logical indices of the memory controllers enumerated by the +* EDAC driver. +*/ +for (int i =0 ; i <NUM_IMC ; i++) + d->mc_mapping[i] = i; +} + +void skx_set_mc_mapping (struct skx_dev *d,u8 pmc,u8 lmc) +{ +edac_dbg (0 ,"Set the mapping of mc phy idx to logical idx: %02d -> %02d\n" , + pmc, lmc); + + d->mc_mapping[pmc] = lmc; +} +EXPORT_SYMBOL_GPL (skx_set_mc_mapping); + +static u8 skx_get_mc_mapping (struct skx_dev *d,u8 pmc) +{ +edac_dbg (0 ,"Get the mapping of mc phy idx to logical idx: %02d -> %02d\n" , + pmc, d->mc_mapping[pmc]); + +return d->mc_mapping[pmc]; +} +static bool skx_adxl_decode (struct decoded_addr *res,enum error_source err_src) {struct skx_dev *d;
@@ -187,6 +216,8 @@ static bool skx_adxl_decode(struct decoded_addr *res, enum error_source err_src)return false; } + res->imc =skx_get_mc_mapping (d, res->imc); +for (i =0 ; i < adxl_component_count; i++) {if (adxl_values[i] == ~0x0ull )continue ;
@@ -307,6 +338,8 @@ int skx_get_all_bus_mappings(struct res_config *cfg, struct list_head **list) d->bus[0], d->bus[1], d->bus[2], d->bus[3]);list_add_tail (&d->list, &dev_edac_list); prev = pdev; + +skx_init_mc_mapping (d); }if (list)
drivers/edac/skx_common.h +11 -0
@@ -93,6 +93,16 @@ struct skx_dev {struct pci_dev *uracu;/* for i10nm CPU */ struct pci_dev *pcu_cr3;/* for HBM memory detection */ u32 mcroute; +/* +* Some server BIOS may hide certain memory controllers, and the +* EDAC driver skips those hidden memory controllers. However, the +* ADXL still decodes memory error address using physical memory +* controller indices. The mapping table is used to convert the +* physical indices (reported by ADXL) to the logical indices +* (used the EDAC driver) of present memory controllers during the +* error handling process. +*/ +u8 mc_mapping[NUM_IMC ];struct skx_imc {struct mem_ctl_info *mci;struct pci_dev *mdev;/* for i10nm CPU */
@@ -242,6 +252,7 @@ void skx_adxl_put(void);void skx_set_decode (skx_decode_f decode,skx_show_retry_log_f show_retry_log);void skx_set_mem_cfg (bool mem_cfg_2lm);void skx_set_res_cfg (struct res_config *cfg); +void skx_set_mc_mapping (struct skx_dev *d,u8 pmc,u8 lmc);int skx_get_src_id (struct skx_dev *d,int off,u8 *id);int skx_get_node_id (struct skx_dev *d,u8 *id);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/499 x86/vdso: Fix latent bug in vclock_pages calculation
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 3ef32d90cdaa0cfa6c4ffd18f8d646a658163e3d ]
The vclock pages are *after* the non-vclock pages. Currently there are both two vclock and two non-vclock pages so the existing logic works by accident. As soon as the number of pages changes it will break however. This will be the case with the introduction of the generic vDSO data storage.
Use a macro to keep the calculation understandable and in sync between the linker script and mapping code.
--- arch/x86/entry/vdso/vdso-layout.lds.S | 2 +- arch/x86/entry/vdso/vma.c | 2 +- arch/x86/include/asm/vdso/vsyscall.h | 1 + 3 files changed, 3 insertions(+), 2 deletions(-)
arch/x86/entry/vdso/vdso-layout.lds.S +1 -1
@@ -24,7 +24,7 @@ SECTIONS timens_page = vvar_start + PAGE_SIZE; - vclock_pages = vvar_start + VDSO_NR_VCLOCK_PAGES * PAGE_SIZE; + vclock_pages = VDSO_VCLOCK_PAGES_START(vvar_start); pvclock_page = vclock_pages + VDSO_PAGE_PVCLOCK_OFFSET * PAGE_SIZE; hvclock_page = vclock_pages + VDSO_PAGE_HVCLOCK_OFFSET * PAGE_SIZE;
arch/x86/entry/vdso/vma.c +1 -1
@@ -290,7 +290,7 @@ static int map_vdso(const struct vdso_image *image, unsigned long addr) } vma = _install_special_mapping(mm, - addr + (__VVAR_PAGES - VDSO_NR_VCLOCK_PAGES) * PAGE_SIZE, + VDSO_VCLOCK_PAGES_START(addr), VDSO_NR_VCLOCK_PAGES * PAGE_SIZE, VM_READ|VM_MAYREAD|VM_IO|VM_DONTDUMP| VM_PFNMAP,
arch/x86/include/asm/vdso/vsyscall.h +1 -0
@@ -6,6 +6,7 @@#define __VVAR_PAGES 4#define VDSO_NR_VCLOCK_PAGES 2 +#define VDSO_VCLOCK_PAGES_START (_b) ((_b) + (__VVAR_PAGES - VDSO_NR_VCLOCK_PAGES) * PAGE_SIZE)#define VDSO_PAGE_PVCLOCK_OFFSET 0#define VDSO_PAGE_HVCLOCK_OFFSET 1
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/499 x86/fpu: Fix guest FPU state buffer allocation size
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Spassov <[email protected]>
[ Upstream commit 1937e18cc3cf27e2b3ef70e8c161437051ab7608 ]
Ongoing work on an optimization to batch-preallocate vCPU state buffers for KVM revealed a mismatch between the allocation sizes used in fpu_alloc_guest_fpstate() and fpstate_realloc(). While the former allocates a buffer sized to fit the default set of XSAVE features in UABI form (as per fpu_user_cfg), the latter uses its ksize argument derived (for the requested set of features) in the same way as the sizes found in fpu_kernel_cfg, i.e. using the compacted in-kernel representation.
The correct size to use for guest FPU state should indeed be the kernel one as seen in fpstate_realloc(). The original issue likely went unnoticed through a combination of UABI size typically being larger than or equal to kernel size, and/or both amounting to the same number of allocated 4K pages.
--- arch/x86/kernel/fpu/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/fpu/core.c +1 -1
@@ -220,7 +220,7 @@ bool fpu_alloc_guest_fpstate(struct fpu_guest *gfpu)struct fpstate *fpstate;unsigned int size; - size = fpu_user_cfg.default_size +ALIGN (offsetof(struct fpstate , regs),64 ); + size = fpu_kernel_cfg.default_size +ALIGN (offsetof(struct fpstate , regs),64 ); fpstate =vzalloc (size);if (!fpstate)return false;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/499 x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit 5d3b81d4d8520efe888536b6906dc10fd1a228a8 ]
The init_task instance of struct task_struct is statically allocated and may not contain the full FP state for userspace. As such, limit the copy to the valid area of both init_task and 'dst' and ensure all memory is initialized.
Note that the FP state is only needed for userspace, and as such it is entirely reasonable for init_task to not contain parts of it.
----
v2:
- Fix code if arch_task_struct_size < sizeof(init_task) by using memcpy_and_pad.
--- arch/x86/kernel/process.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/x86/kernel/process.c +6 -1
@@ -92,7 +92,12 @@ EXPORT_PER_CPU_SYMBOL_GPL(__tss_limit_invalid);*/ int arch_dup_task_struct (struct task_struct *dst,struct task_struct *src) { -memcpy (dst, src, arch_task_struct_size); +/* init_task is not dynamically sized (incomplete FPU state) */ +if (unlikely (src == &init_task)) +memcpy_and_pad (dst, arch_task_struct_size, src,sizeof (init_task),0 ); +else +memcpy (dst, src, arch_task_struct_size); +#ifdef CONFIG_VM86 dst->thread.vm86 =NULL ;#endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/499 x86/platform: Only allow CONFIG_EISA for 32-bit
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 976ba8da2f3c2f1e997f4f620da83ae65c0e3728 ]
The CONFIG_EISA menu was cleaned up in 2018, but this inadvertently brought the option back on 64-bit machines: ISA remains guarded by a CONFIG_X86_32 check, but EISA no longer depends on ISA.
The last Intel machines ith EISA support used a 82375EB PCI/EISA bridge from 1993 that could be paired with the 440FX chipset on early Pentium-II CPUs, long before the first x86-64 products.
--- arch/x86/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/Kconfig +1 -1
@@ -229,7 +229,7 @@ config X86 select HAVE_SAMPLE_FTRACE_DIRECT_MULTI if X86_64 select HAVE_EBPF_JIT select HAVE_EFFICIENT_UNALIGNED_ACCESS - select HAVE_EISA + select HAVE_EISA if X86_32 select HAVE_EXIT_THREAD select HAVE_GUP_FAST select HAVE_FENTRY if X86_64 || DYNAMIC_FTRACE
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/499 x86/sev: Add missing RIP_REL_REF() invocations during sme_enable()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Loughlin <[email protected]>
[ Upstream commit 72dafb567760320f2de7447cd6e979bf9d4e5d17 ]
The following commit:
1c811d403afd ("x86/sev: Fix position dependent variable references in startup code")
introduced RIP_REL_REF() to force RIP-relative accesses to global variables, as needed to prevent crashes during early SEV/SME startup code.
For completeness, RIP_REL_REF() should be used with additional variables during sme_enable():
https://lore.kernel.org/all/CAMj1kXHnA0fJu6zh634=fbJswp59kSRAbhW+ubDGj1+NYwZJ-Q@mail.gmail.com/
Access these vars with RIP_REL_REF() to prevent problem reoccurence.
--- arch/x86/mm/mem_encrypt_identity.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/mm/mem_encrypt_identity.c +2 -2
@@ -565,7 +565,7 @@ void __head sme_enable(struct boot_params *bp) }RIP_REL_REF (sme_me_mask) = me_mask; - physical_mask &= ~me_mask; - cc_vendor =CC_VENDOR_AMD ; +RIP_REL_REF (physical_mask) &= ~me_mask; +RIP_REL_REF (cc_vendor) =CC_VENDOR_AMD ;cc_set_mask (me_mask); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/499 lockdep/mm: Fix might_fault() lockdep check of current->mm->mmap_lock
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit a1b65f3f7c6f7f0a08a7dba8be458c6415236487 ]
Turns out that this commit, about 10 years ago:
9ec23531fd48 ("sched/preempt, mm/fault: Trigger might_sleep() in might_fault() with disabled pagefaults")
... accidentally (and unnessecarily) put the lockdep part of __might_fault() under CONFIG_DEBUG_ATOMIC_SLEEP=y.
This is potentially notable because large distributions such as Ubuntu are running with !CONFIG_DEBUG_ATOMIC_SLEEP.
Restore the debug check.
[ mingo: Update changelog. ]
--- mm/memory.c | 2 -- 1 file changed, 2 deletions(-)
mm/memory.c +0 -2
@@ -6753,10 +6753,8 @@ void __might_fault(const char *file, int line)if (pagefault_disabled ())return ;__might_sleep (file, line); -#if defined(CONFIG_DEBUG_ATOMIC_SLEEP )if (current->mm) might_lock_read(¤t->mm->mmap_lock); -#endif }EXPORT_SYMBOL (__might_fault);#endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/499 PM: sleep: Adjust check before setting power.must_resume
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit eeb87d17aceab7803a5a5bcb6cf2817b745157cf ]
The check before setting power.must_resume in device_suspend_noirq() does not take power.child_count into account, but it should do that, so use pm_runtime_need_not_resume() in it for this purpose and adjust the comment next to it accordingly.
--- drivers/base/power/main.c | 13 ++++++------- drivers/base/power/runtime.c | 2 +- include/linux/pm_runtime.h | 2 ++ 3 files changed, 9 insertions(+), 8 deletions(-)
drivers/base/power/main.c +6 -7
@@ -1254,14 +1254,13 @@ static int device_suspend_noirq(struct device *dev, pm_message_t state, bool asy dev->power.is_noirq_suspended = true;/* -* Skipping the resume of devices that were in use right before the -* system suspend (as indicated by their PM-runtime usage counters) -* would be suboptimal. Also resume them if doing that is not allowed -* to be skipped. +* Devices must be resumed unless they are explicitly allowed to be left +* in suspend, but even in that case skipping the resume of devices that +* were in use right before the system suspend (as indicated by their +* runtime PM usage counters and child counters) would be suboptimal. */ -if (atomic_read (&dev->power.usage_count) >1 || - !(dev_pm_test_driver_flags (dev,DPM_FLAG_MAY_SKIP_RESUME ) && - dev->power.may_skip_resume)) +if (!(dev_pm_test_driver_flags (dev,DPM_FLAG_MAY_SKIP_RESUME ) && + dev->power.may_skip_resume) || !pm_runtime_need_not_resume (dev)) dev->power.must_resume = true;if (dev->power.must_resume)
drivers/base/power/runtime.c +1 -1
@@ -1874,7 +1874,7 @@ void pm_runtime_drop_link(struct device_link *link)pm_request_idle (link->supplier); } -static bool pm_runtime_need_not_resume (struct device *dev) +bool pm_runtime_need_not_resume (struct device *dev) { return atomic_read(&dev->power.usage_count) <= 1 && (atomic_read(&dev->power.child_count) == 0 ||
include/linux/pm_runtime.h +2 -0
@@ -66,6 +66,7 @@ static inline bool queue_pm_work(struct work_struct *work)extern int pm_generic_runtime_suspend (struct device *dev);extern int pm_generic_runtime_resume (struct device *dev); +extern bool pm_runtime_need_not_resume (struct device *dev);extern int pm_runtime_force_suspend (struct device *dev);extern int pm_runtime_force_resume (struct device *dev);
@@ -241,6 +242,7 @@ static inline bool queue_pm_work(struct work_struct *work) { return false; }static inline int pm_generic_runtime_suspend (struct device *dev) {return 0 ; }static inline int pm_generic_runtime_resume (struct device *dev) {return 0 ; } +static inline bool pm_runtime_need_not_resume (struct device *dev) {return true; }static inline int pm_runtime_force_suspend (struct device *dev) {return 0 ; }static inline int pm_runtime_force_resume (struct device *dev) {return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/499 cpufreq: tegra194: Allow building for Tegra234
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Kling <[email protected]>
[ Upstream commit 4a1e3bf61fc78ad100018adb573355303915dca3 ]
Support was added for Tegra234 in the referenced commit, but the Kconfig was not updated to allow building for the arch.
--- drivers/cpufreq/Kconfig.arm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cpufreq/Kconfig.arm +1 -1
@@ -245,7 +245,7 @@ config ARM_TEGRA186_CPUFREQ config ARM_TEGRA194_CPUFREQ tristate "Tegra194 CPUFreq support" - depends on ARCH_TEGRA_194_SOC || (64BIT && COMPILE_TEST) + depends on ARCH_TEGRA_194_SOC || ARCH_TEGRA_234_SOC || (64BIT && COMPILE_TEST) depends on TEGRA_BPMP default y help
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/499 RISC-V: KVM: Disable the kernel perf counter during configure
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Atish Patra <[email protected]>
[ Upstream commit bbb622488749478955485765ddff9d56be4a7e4b ]
The perf event should be marked disabled during the creation as it is not ready to be scheduled until there is SBI PMU start call or config matching is called with auto start. Otherwise, event add/start gets called during perf_event_create_kernel_counter function. It will be enabled and scheduled to run via perf_event_enable during either the above mentioned scenario.
--- arch/riscv/kvm/vcpu_pmu.c | 1 + 1 file changed, 1 insertion(+)
arch/riscv/kvm/vcpu_pmu.c +1 -0
@@ -666,6 +666,7 @@ int kvm_riscv_vcpu_pmu_ctr_cfg_match(struct kvm_vcpu *vcpu, unsigned long ctr_ba .type = etype, .size = sizeof(struct perf_event_attr), .pinned = true, + .disabled = true,/* * It should never reach here if the platform doesn't support the sscofpmf * extension as mode filtering won't work without it.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/499 kunit/stackinit: Use fill byte different from Clang i386 pattern
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit d985e4399adffb58e10b38dbb5479ef29d53cde6 ]
The byte initialization values used with -ftrivial-auto-var-init=pattern (CONFIG_INIT_STACK_ALL_PATTERN=y) depends on the compiler, architecture, and byte position relative to struct member types. On i386 with Clang, this includes the 0xFF value, which means it looks like nothing changes between the leaf byte filling pass and the expected "stack wiping" pass of the stackinit test.
Use the byte fill value of 0x99 instead, fixing the test for i386 Clang builds.
--- lib/stackinit_kunit.c | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-)
lib/stackinit_kunit.c +20 -10
@@ -146,6 +146,15 @@ static bool stackinit_range_contains(char *haystack_start, size_t haystack_size,#define INIT_STRUCT_assigned_copy (var_type) \ ; var = *(arg) +/* +* The "did we actually fill the stack?" check value needs +* to be neither 0 nor any of the "pattern" bytes. The +* pattern bytes are compiler, architecture, and type based, +* so we have to pick a value that never appears for those +* combinations. Use 0x99 which is not 0xFF, 0xFE, nor 0xAA. +*/ +#define FILL_BYTE 0x99 +/* * @name: unique string name for the test * @var_type: type to be tested for zeroing initialization
@@ -168,12 +177,12 @@ static noinline void test_ ## name (struct kunit *test) \ ZERO_CLONE_ ## which(zero); \ /* Clear entire check buffer for 0xFF overlap test. */ \memset (check_buf,0x00 ,sizeof (check_buf)); \ -/* Fill stack with 0xFF. */ \ +/* Fill stack with FILL_BYTE. */ \ ignored = leaf_ ##name((unsigned long)&ignored, 1, \ FETCH_ARG_ ## which(zero)); \ -/* Verify all bytes overwritten with 0xFF. */ \ +/* Verify all bytes overwritten with FILL_BYTE. */ \for (sum =0 , i =0 ; i < target_size; i++) \ - sum += (check_buf[i] !=0xFF ); \ + sum += (check_buf[i] !=FILL_BYTE ); \/* Clear entire check buffer for later bit tests. */ \memset (check_buf,0x00 ,sizeof (check_buf)); \/* Extract stack-defined variable contents. */ \
@@ -184,7 +193,8 @@ static noinline void test_ ## name (struct kunit *test) \* possible between the two leaf function calls. \ */ \KUNIT_ASSERT_EQ_MSG (test, sum,0 , \ -"leaf fill was not 0xFF!?\n" ); \ +"leaf fill was not 0x%02X!?\n" , \ +FILL_BYTE ); \ \/* Validate that compiler lined up fill and target. */ \ KUNIT_ASSERT_TRUE_MSG(test, \
@@ -196,9 +206,9 @@ static noinline void test_ ## name (struct kunit *test) \ (int )((ssize_t )(uintptr_t )fill_start - \ (ssize_t)(uintptr_t)target_start)); \ \ -/* Look for any bytes still 0xFF in check region. */ \ +/* Validate check region has no FILL_BYTE bytes. */ \for (sum =0 , i =0 ; i < target_size; i++) \ - sum += (check_buf[i] ==0xFF ); \ + sum += (check_buf[i] ==FILL_BYTE ); \ \if (sum !=0 && xfail) \ kunit_skip(test, \
@@ -233,12 +243,12 @@ static noinline int leaf_ ## name(unsigned long sp, bool fill, \* stack frame of SOME kind... \ */ \memset (buf, (char )(sp &0xff ),sizeof (buf)); \ -/* Fill variable with 0xFF. */ \ +/* Fill variable with FILL_BYTE. */ \if (fill) { \ fill_start = &var; \ fill_size =sizeof (var); \memset (fill_start, \ - (char )((sp &0xff ) | forced_mask), \ +FILL_BYTE & forced_mask, \ fill_size); \ } \ \
@@ -380,7 +390,7 @@ static int noinline __leaf_switch_none(int path, bool fill) fill_start = &var; fill_size =sizeof (var); -memset (fill_start, forced_mask |0x55 , fill_size); +memset (fill_start, (forced_mask |0x55 ) &FILL_BYTE , fill_size); }memcpy (check_buf, target_start, target_size);break ;
@@ -391,7 +401,7 @@ static int noinline __leaf_switch_none(int path, bool fill) fill_start = &var; fill_size =sizeof (var); -memset (fill_start, forced_mask |0xaa , fill_size); +memset (fill_start, (forced_mask |0xaa ) &FILL_BYTE , fill_size); }memcpy (check_buf, target_start, target_size);break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 23/499 watchdog/hardlockup/perf: Fix perf_event memory leak
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Huafei <[email protected]>
[ Upstream commit d6834d9c990333bfa433bc1816e2417f268eebbe ]
During stress-testing, we found a kmemleak report for perf_event:
unreferenced object 0xff110001410a33e0 (size 1328):
comm "kworker/4:11", pid 288, jiffies 4294916004
hex dump (first 32 bytes):
b8 be c2 3b 02 00 11 ff 22 01 00 00 00 00 ad de ...;....".......
f0 33 0a 41 01 00 11 ff f0 33 0a 41 01 00 11 ff .3.A.....3.A....
backtrace (crc 24eb7b3a):
[<00000000e211b653>] kmem_cache_alloc_node_noprof+0x269/0x2e0
[<000000009d0985fa>] perf_event_alloc+0x5f/0xcf0
[<00000000084ad4a2>] perf_event_create_kernel_counter+0x38/0x1b0
[<00000000fde96401>] hardlockup_detector_event_create+0x50/0xe0
[<0000000051183158>] watchdog_hardlockup_enable+0x17/0x70
[<00000000ac89727f>] softlockup_start_fn+0x15/0x40
...Our stress test includes CPU online and offline cycles, and updating the watchdog configuration.
After reading the code, I found that there may be a race between cleaning up perf_event after updating watchdog and disabling event when the CPU goes offline:
CPU0 CPU1 CPU2
(update watchdog) (hotplug offline CPU1)
... _cpu_down(CPU1)
cpus_read_lock() // waiting for cpu lock
softlockup_start_all
smp_call_on_cpu(CPU1)
softlockup_start_fn
...
watchdog_hardlockup_enable(CPU1)
perf create E1
watchdog_ev[CPU1] = E1
cpus_read_unlock()
cpus_write_lock()
cpuhp_kick_ap_work(CPU1)
cpuhp_thread_fun
...
watchdog_hardlockup_disable(CPU1)
watchdog_ev[CPU1] = NULL
dead_event[CPU1] = E1 __lockup_detector_cleanup
for each dead_events_mask
release each dead_event
/*
* CPU1 has not been added to
* dead_events_mask, then E1
* will not be released
*/
CPU1 -> dead_events_mask
cpumask_clear(&dead_events_mask)
// dead_events_mask is cleared, E1 is leaked
In this case, the leaked perf_event E1 matches the perf_event leak reported by kmemleak. Due to the low probability of problem recurrence (only reported once), I added some hack delays in the code:
static void __lockup_detector_reconfigure(void)
{
...
watchdog_hardlockup_start();
cpus_read_unlock();
+ mdelay(100);
/*
* Must be called outside the cpus locked section to prevent
* recursive locking in the perf code.
...
}
void watchdog_hardlockup_disable(unsigned int cpu)
{
...
perf_event_disable(event);
this_cpu_write(watchdog_ev, NULL);
this_cpu_write(dead_event, event);
+ mdelay(100);
cpumask_set_cpu(smp_processor_id(), &dead_events_mask);
atomic_dec(&watchdog_cpus);
...
}
void hardlockup_detector_perf_cleanup(void)
{
...
perf_event_release_kernel(event);
per_cpu(dead_event, cpu) = NULL;
}
+ mdelay(100);
cpumask_clear(&dead_events_mask);
}Then, simultaneously performing CPU on/off and switching watchdog, it is almost certain to reproduce this leak.
The problem here is that releasing perf_event is not within the CPU hotplug read-write lock. Commit:
941154bd6937 ("watchdog/hardlockup/perf: Prevent CPU hotplug deadlock")
introduced deferred release to solve the deadlock caused by calling get_online_cpus() when releasing perf_event. Later, commit:
efe951d3de91 ("perf/x86: Fix perf,x86,cpuhp deadlock")
removed the get_online_cpus() call on the perf_event release path to solve another deadlock problem.
Therefore, it is now possible to move the release of perf_event back into the CPU hotplug read-write lock, and release the event immediately after disabling it.
--- include/linux/nmi.h | 4 ---- kernel/cpu.c | 5 ----- kernel/watchdog.c | 25 ------------------------- kernel/watchdog_perf.c | 28 +--------------------------- 4 files changed, 1 insertion(+), 61 deletions(-)
include/linux/nmi.h +0 -4
@@ -17,7 +17,6 @@void lockup_detector_init (void );void lockup_detector_retry_init (void );void lockup_detector_soft_poweroff (void ); -void lockup_detector_cleanup (void );extern int watchdog_user_enabled;extern int watchdog_thresh;
@@ -37,7 +36,6 @@ extern int sysctl_hardlockup_all_cpu_backtrace;static inline void lockup_detector_init (void ) { }static inline void lockup_detector_retry_init (void ) { }static inline void lockup_detector_soft_poweroff (void ) { } -static inline void lockup_detector_cleanup (void ) { }#endif /* !CONFIG_LOCKUP_DETECTOR */ #ifdef CONFIG_SOFTLOCKUP_DETECTOR
@@ -104,12 +102,10 @@ void watchdog_hardlockup_check(unsigned int cpu, struct pt_regs *regs);#if defined(CONFIG_HARDLOCKUP_DETECTOR_PERF )extern void hardlockup_detector_perf_stop (void );extern void hardlockup_detector_perf_restart (void ); -extern void hardlockup_detector_perf_cleanup (void );extern void hardlockup_config_perf_event (const char *str);#else static inline void hardlockup_detector_perf_stop (void ) { }static inline void hardlockup_detector_perf_restart (void ) { } -static inline void hardlockup_detector_perf_cleanup (void ) { }static inline void hardlockup_config_perf_event (const char *str) { }#endif
kernel/cpu.c +0 -5
@@ -1452,11 +1452,6 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen, out:cpus_write_unlock (); -/* -* Do post unplug cleanup. This is still protected against -* concurrent CPU hotplug via cpu_add_remove_lock. -*/ -lockup_detector_cleanup ();arch_smt_update ();return ret; }
kernel/watchdog.c +0 -25
@@ -347,8 +347,6 @@ static int __init watchdog_thresh_setup(char *str) }__setup ("watchdog_thresh=" , watchdog_thresh_setup); -static void __lockup_detector_cleanup (void ); -#ifdef CONFIG_SOFTLOCKUP_DETECTOR_INTR_STORM enum stats_per_group { STATS_SYSTEM,
@@ -886,11 +884,6 @@ static void __lockup_detector_reconfigure(void)watchdog_hardlockup_start ();cpus_read_unlock (); -/* -* Must be called outside the cpus locked section to prevent -* recursive locking in the perf code. -*/ -__lockup_detector_cleanup (); }void lockup_detector_reconfigure (void )
@@ -940,24 +933,6 @@ static inline void lockup_detector_setup(void) }#endif /* !CONFIG_SOFTLOCKUP_DETECTOR */ -static void __lockup_detector_cleanup (void ) -{ -lockdep_assert_held (&watchdog_mutex); -hardlockup_detector_perf_cleanup (); -} - -/** -* lockup_detector_cleanup - Cleanup after cpu hotplug or sysctl changes -* -* Caller must not hold the cpu hotplug rwsem. -*/ -void lockup_detector_cleanup (void ) -{ -mutex_lock (&watchdog_mutex); -__lockup_detector_cleanup (); -mutex_unlock (&watchdog_mutex); -} -/** * lockup_detector_soft_poweroff - Interface to stop lockup detector(s) *
kernel/watchdog_perf.c +1 -27
@@ -21,8 +21,6 @@#include <linux/perf_event.h> static DEFINE_PER_CPU(struct perf_event *, watchdog_ev); -static DEFINE_PER_CPU(struct perf_event *, dead_event); -static struct cpumask dead_events_mask;static atomic_t watchdog_cpus =ATOMIC_INIT (0 );
@@ -181,36 +179,12 @@ void watchdog_hardlockup_disable(unsigned int cpu)if (event) {perf_event_disable (event); +perf_event_release_kernel (event);this_cpu_write (watchdog_ev,NULL ); -this_cpu_write (dead_event, event); -cpumask_set_cpu (smp_processor_id (), &dead_events_mask);atomic_dec (&watchdog_cpus); } } -/** -* hardlockup_detector_perf_cleanup - Cleanup disabled events and destroy them -* -* Called from lockup_detector_cleanup(). Serialized by the caller. -*/ -void hardlockup_detector_perf_cleanup (void ) -{ -int cpu; - -for_each_cpu (cpu, &dead_events_mask) { -struct perf_event *event =per_cpu (dead_event, cpu); - -/* -* Required because for_each_cpu() reports unconditionally -* CPU0 as set on UP kernels. Sigh. -*/ -if (event) -perf_event_release_kernel (event); -per_cpu (dead_event, cpu) =NULL ; - } -cpumask_clear (&dead_events_mask); -} -/** * hardlockup_detector_perf_stop - Globally stop watchdog events *
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 24/499 x86/split_lock: Fix the delayed detection logic
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maksim Davydov <[email protected]>
[ Upstream commit c929d08df8bee855528b9d15b853c892c54e1eee ]
If the warning mode with disabled mitigation mode is used, then on each CPU where the split lock occurred detection will be disabled in order to make progress and delayed work will be scheduled, which then will enable detection back.
Now it turns out that all CPUs use one global delayed work structure. This leads to the fact that if a split lock occurs on several CPUs at the same time (within 2 jiffies), only one CPU will schedule delayed work, but the rest will not.
The return value of schedule_delayed_work_on() would have shown this, but it is not checked in the code.
A diagram that can help to understand the bug reproduction:
- sld_update_msr() enables/disables SLD on both CPUs on the same core
- schedule_delayed_work_on() internally checks WORK_STRUCT_PENDING_BIT. If a work has the 'pending' status, then schedule_delayed_work_on() will return an error code and, most importantly, the work will not be placed in the workqueue.
Let's say we have a multicore system on which split_lock_mitigate=0 and a multithreaded application is running that calls splitlock in multiple threads. Due to the fact that sld_update_msr() affects the entire core (both CPUs), we will consider 2 CPUs from different cores. Let the 2 threads of this application schedule to CPU0 (core 0) and to CPU 2 (core 1), then:
| || | | CPU 0 (core 0) || CPU 2 (core 1) | |_________________________________||___________________________________| | || | | 1) SPLIT LOCK occured || | | || | | 2) split_lock_warn() || | | || | | 3) sysctl_sld_mitigate == 0 || | | (work = &sl_reenable) || | | || | | 4) schedule_delayed_work_on() || | | (reenable will be called || | | after 2 jiffies on CPU 0) || | | || | | 5) disable SLD for core 0 || | | || | | ------------------------- || | | || | | || 6) SPLIT LOCK occured | | || | | || 7) split_lock_warn() | | || | | || 8) sysctl_sld_mitigate == 0 | | || (work = &sl_reenable, | | || the same address as in 3) ) | | || | | 2 jiffies || 9) schedule_delayed_work_on() | | || fials because the work is in | | || the pending state since 4). | | || The work wasn't placed to the | | || workqueue. reenable won't be | | || called on CPU 2 | | || | | || 10) disable SLD for core 0 | | || | | || From now on SLD will | | || never be reenabled on core 1 | | || | | ------------------------- || | | || | | 11) enable SLD for core 0 by || | | __split_lock_reenable || | | || |
If the application threads can be scheduled to all processor cores, then over time there will be only one core left, on which SLD will be enabled and split lock will be able to be detected; and on all other cores SLD will be disabled all the time.
Most likely, this bug has not been noticed for so long because sysctl_sld_mitigate default value is 1, and in this case a semaphore is used that does not allow 2 different cores to have SLD disabled at the same time, that is, strictly only one work is placed in the workqueue.
In order to fix the warning mode with disabled mitigation mode, delayed work has to be per-CPU. Implement it.
--- arch/x86/kernel/cpu/bus_lock.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
arch/x86/kernel/cpu/bus_lock.c +16 -4
@@ -192,7 +192,13 @@ static void __split_lock_reenable(struct work_struct *work) {sld_update_msr (true); } -static DECLARE_DELAYED_WORK(sl_reenable, __split_lock_reenable); +/* +* In order for each CPU to schedule its delayed work independently of the +* others, delayed work struct must be per-CPU. This is not required when +* sysctl_sld_mitigate is enabled because of the semaphore that limits +* the number of simultaneously scheduled delayed works to 1. +*/ +static DEFINE_PER_CPU(struct delayed_work, sl_reenable);/* * If a CPU goes offline with pending delayed work to re-enable split lock
@@ -213,7 +219,7 @@ static int splitlock_cpu_offline(unsigned int cpu)static void split_lock_warn (unsigned long ip) { -struct delayed_work *work; +struct delayed_work *work =NULL ;int cpu;if (!current->reported_split_lock)
@@ -235,11 +241,17 @@ static void split_lock_warn(unsigned long ip)if (down_interruptible (&buslock_sem) == -EINTR )return ; work = &sl_reenable_unlock; - }else { - work = &sl_reenable; } cpu =get_cpu (); + +if (!work) { + work =this_cpu_ptr (&sl_reenable); +/* Deferred initialization of per-CPU struct */ +if (!work->work.func) +INIT_DELAYED_WORK (work, __split_lock_reenable); + } +schedule_delayed_work_on (cpu, work,2 );/* Disable split lock detection on this CPU to make progress */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 25/499 selinux: Chain up tool resolving errors in install_policy.sh
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Schumacher <[email protected]>
[ Upstream commit 6ae0042f4d3f331e841495eb0a3d51598e593ec2 ]
Subshell evaluations are not exempt from errexit, so if a command is not available, which will fail and exit the script as a whole. This causes the helpful error messages to not be printed if they are tacked on using a $? comparison.
Resolve the issue by using chains of logical operators, which are not subject to the effects of errexit.
--- scripts/selinux/install_policy.sh | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
scripts/selinux/install_policy.sh +6 -9
@@ -6,27 +6,24 @@ if [ `id -u` -ne 0 ]; then exit 1 fi -SF=`which setfiles` -if [ $? -eq 1 ]; then +SF=`which setfiles` || { echo "Could not find setfiles" echo "Do you have policycoreutils installed?" exit 1 -fi +} -CP=`which checkpolicy` -if [ $? -eq 1 ]; then +CP=`which checkpolicy` || { echo "Could not find checkpolicy" echo "Do you have checkpolicy installed?" exit 1 -fi +} VERS=`$CP -V | awk '{print $1}'` -ENABLED=`which selinuxenabled` -if [ $? -eq 1 ]; then +ENABLED=`which selinuxenabled` || { echo "Could not find selinuxenabled" echo "Do you have libselinux-utils installed?" exit 1 -fi +} if selinuxenabled; then echo "SELinux is already enabled"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 26/499 EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit d59d844e319d97682c8de29b88d2d60922a683b3 ]
The EDAC_MC_LAYER_CHIP_SELECT layer pertains to the rank, not the DIMM. Fix its size to reflect the number of ranks instead of the number of DIMMs. Also delete the unused macros IE31200_{DIMMS,RANKS}.
--- drivers/edac/ie31200_edac.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/edac/ie31200_edac.c +1 -3
@@ -94,8 +94,6 @@ (((did) & PCI_DEVICE_ID_INTEL_IE31200_HB_CFL_MASK) == \ PCI_DEVICE_ID_INTEL_IE31200_HB_CFL_MASK)) -#define IE31200_DIMMS 4 -#define IE31200_RANKS 8#define IE31200_RANKS_PER_CHANNEL 4#define IE31200_DIMMS_PER_CHANNEL 2#define IE31200_CHANNELS 2
@@ -429,7 +427,7 @@ static int ie31200_probe1(struct pci_dev *pdev, int dev_idx) nr_channels =how_many_channels (pdev); layers[0 ].type =EDAC_MC_LAYER_CHIP_SELECT ; - layers[0 ].size =IE31200_DIMMS ; + layers[0 ].size =IE31200_RANKS_PER_CHANNEL ; layers[0 ].is_virt_csrow = true; layers[1 ].type =EDAC_MC_LAYER_CHANNEL ; layers[1 ].size = nr_channels;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 27/499 EDAC/ie31200: Fix the DIMM size mask for several SoCs
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit 3427befbbca6b19fe0e37f91d66ce5221de70bf1 ]
The DIMM size mask for {Sky, Kaby, Coffee} Lake is not bits{7:0}, but bits{5:0}. Fix it.
--- drivers/edac/ie31200_edac.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/edac/ie31200_edac.c +2 -1
@@ -165,6 +165,7 @@#define IE31200_MAD_DIMM_0_OFFSET 0x5004#define IE31200_MAD_DIMM_0_OFFSET_SKL 0x500C#define IE31200_MAD_DIMM_SIZE GENMASK_ULL(7, 0) +#define IE31200_MAD_DIMM_SIZE_SKL GENMASK_ULL(5, 0)#define IE31200_MAD_DIMM_A_RANK BIT(17)#define IE31200_MAD_DIMM_A_RANK_SHIFT 17#define IE31200_MAD_DIMM_A_RANK_SKL BIT(10)
@@ -378,7 +379,7 @@ static void __iomem *ie31200_map_mchbar(struct pci_dev *pdev)static void __skl_populate_dimm_info (struct dimm_data *dd,u32 addr_decode,int chan) { - dd->size = (addr_decode >> (chan <<4 )) &IE31200_MAD_DIMM_SIZE ; + dd->size = (addr_decode >> (chan <<4 )) &IE31200_MAD_DIMM_SIZE_SKL ; dd->dual_rank = (addr_decode & (IE31200_MAD_DIMM_A_RANK_SKL << (chan <<4 ))) ?1 :0 ; dd->x16_width = ((addr_decode & (IE31200_MAD_DIMM_A_WIDTH_SKL << (chan <<4 ))) >> (IE31200_MAD_DIMM_A_WIDTH_SKL_SHIFT + (chan <<4 )));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 28/499 EDAC/ie31200: Fix the error path order of ie31200_init()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit 231e341036d9988447e3b3345cf741a98139199e ]
The error path order of ie31200_init() is incorrect, fix it.
--- drivers/edac/ie31200_edac.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/edac/ie31200_edac.c +7 -5
@@ -621,7 +621,7 @@ static int __init ie31200_init(void) pci_rc =pci_register_driver (&ie31200_driver);if (pci_rc <0 ) - goto fail0; +return pci_rc;if (!mci_pdev) { ie31200_registered =0 ;
@@ -632,11 +632,13 @@ static int __init ie31200_init(void)if (mci_pdev)break ; } +if (!mci_pdev) {edac_dbg (0 ,"ie31200 pci_get_device fail\n" ); pci_rc = -ENODEV ; - goto fail1; + goto fail0; } + pci_rc =ie31200_init_one (mci_pdev, &ie31200_pci_tbl[i]);if (pci_rc <0 ) {edac_dbg (0 ,"ie31200 init fail\n" );
@@ -644,12 +646,12 @@ static int __init ie31200_init(void) goto fail1; } } -return 0 ; +return 0 ; fail1: -pci_unregister_driver (&ie31200_driver); -fail0:pci_dev_put (mci_pdev); +fail0: +pci_unregister_driver (&ie31200_driver);return pci_rc; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 29/499 dma: Fix encryption bit clearing for dma_to_phys
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suzuki K Poulose <[email protected]>
[ Upstream commit c380931712d16e23f6aa90703f438330139e9731 ]
phys_to_dma() sets the encryption bit on the translated DMA address. But dma_to_phys() clears the encryption bit after it has been translated back to the physical address, which could fail if the device uses DMA ranges.
AMD SME doesn't use the DMA ranges and thus this is harmless. But as we are about to add support for other architectures, let us fix this.
--- include/linux/dma-direct.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/linux/dma-direct.h +2 -1
@@ -101,12 +101,13 @@ static inline phys_addr_t dma_to_phys(struct device *dev, dma_addr_t dma_addr) {phys_addr_t paddr; + dma_addr =__sme_clr (dma_addr);if (dev->dma_range_map) paddr =translate_dma_to_phys (dev, dma_addr);else paddr = dma_addr; -return __sme_clr (paddr); +return paddr; }#endif /* !CONFIG_ARCH_HAS_PHYS_TO_DMA */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 30/499 dma: Introduce generic dma_addr_*crypted helpers
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suzuki K Poulose <[email protected]>
[ Upstream commit b66e2ee7b6c8d45bbe4b6f6885ee27511506812c ]
AMD SME added __sme_set/__sme_clr primitives to modify the DMA address for encrypted/decrypted traffic. However this doesn't fit in with other models, e.g., Arm CCA where the meanings are the opposite. i.e., "decrypted" traffic has a bit set and "encrypted" traffic has the top bit cleared.
In preparation for adding the support for Arm CCA DMA conversions, convert the existing primitives to more generic ones that can be provided by the backends. i.e., add helpers to
1. dma_addr_encrypted - Convert a DMA address to "encrypted" [ == __sme_set() ]
2. dma_addr_unencrypted - Convert a DMA address to "decrypted" [ None exists today ]
3. dma_addr_canonical - Clear any "encryption"/"decryption" bits from DMA address [ SME uses __sme_clr() ] and convert to a canonical DMA address.
Since the original __sme_xxx helpers come from linux/mem_encrypt.h, use that as the home for the new definitions and provide dummy ones when none is provided by the architectures.
With the above, phys_to_dma_unencrypted() uses the newly added dma_addr_unencrypted() helper and to make it a bit more easier to read and avoid double conversion, provide __phys_to_dma().
--- include/linux/dma-direct.h | 12 ++++++++---- include/linux/mem_encrypt.h | 23 +++++++++++++++++++++++ 2 files changed, 31 insertions(+), 4 deletions(-)
include/linux/dma-direct.h +8 -4
@@ -78,14 +78,18 @@ static inline dma_addr_t dma_range_map_max(const struct bus_dma_region *map)#define phys_to_dma_unencrypted phys_to_dma#endif #else -static inline dma_addr_t phys_to_dma_unencrypted (struct device *dev, -phys_addr_t paddr) +static inline dma_addr_t __phys_to_dma (struct device *dev,phys_addr_t paddr) {if (dev->dma_range_map)return translate_phys_to_dma (dev, paddr);return paddr; } +static inline dma_addr_t phys_to_dma_unencrypted (struct device *dev, +phys_addr_t paddr) +{ +return dma_addr_unencrypted (__phys_to_dma (dev, paddr)); +}/* * If memory encryption is supported, phys_to_dma will set the memory encryption * bit in the DMA address, and dma_to_phys will clear it.
@@ -94,14 +98,14 @@ static inline dma_addr_t phys_to_dma_unencrypted(struct device *dev,*/ static inline dma_addr_t phys_to_dma (struct device *dev,phys_addr_t paddr) { -return __sme_set (phys_to_dma_unencrypted (dev, paddr)); +return dma_addr_encrypted (__phys_to_dma (dev, paddr)); }static inline phys_addr_t dma_to_phys (struct device *dev,dma_addr_t dma_addr) {phys_addr_t paddr; - dma_addr =__sme_clr (dma_addr); + dma_addr =dma_addr_canonical (dma_addr);if (dev->dma_range_map) paddr =translate_dma_to_phys (dev, dma_addr);else
include/linux/mem_encrypt.h +23 -0
@@ -26,11 +26,34 @@*/ #define __sme_set (x) ((x) | sme_me_mask)#define __sme_clr (x) ((x) & ~sme_me_mask) + +#define dma_addr_encrypted (x) __sme_set(x) +#define dma_addr_canonical (x) __sme_clr(x) +#else #define __sme_set (x) (x)#define __sme_clr (x) (x)#endif +/* +* dma_addr_encrypted() and dma_addr_unencrypted() are for converting a given DMA +* address to the respective type of addressing. +* +* dma_addr_canonical() is used to reverse any conversions for encrypted/decrypted +* back to the canonical address. +*/ +#ifndef dma_addr_encrypted +#define dma_addr_encrypted (x) (x) +#endif + +#ifndef dma_addr_unencrypted +#define dma_addr_unencrypted (x) (x) +#endif + +#ifndef dma_addr_canonical +#define dma_addr_canonical (x) (x) +#endif +#endif /* __ASSEMBLY__ */ #endif /* __MEM_ENCRYPT_H__ */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 31/499 arm64: realm: Use aliased addresses for device DMA to shared buffers
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suzuki K Poulose <[email protected]>
[ Upstream commit 7d953a06241624ee2efb172d037a4168978f4147 ]
When a device performs DMA to a shared buffer using physical addresses, (without Stage1 translation), the device must use the "{I}PA address" with the top bit set in Realm. This is to make sure that a trusted device will be able to write to shared buffers as well as the protected buffers. Thus, a Realm must always program the full address including the "protection" bit, like AMD SME encryption bits.
Enable this by providing arm64 specific dma_addr_{encrypted, canonical} helpers for Realms. Please note that the VMM needs to similarly make sure that the SMMU Stage2 in the Non-secure world is setup accordingly to map IPA at the unprotected alias.
--- arch/arm64/include/asm/mem_encrypt.h | 11 +++++++++++ 1 file changed, 11 insertions(+)
arch/arm64/include/asm/mem_encrypt.h +11 -0
@@ -21,4 +21,15 @@ static inline bool force_dma_unencrypted(struct device *dev) return is_realm_world(); } +/* +* For Arm CCA guests, canonical addresses are "encrypted", so no changes +* required for dma_addr_encrypted(). +* The unencrypted DMA buffers must be accessed via the unprotected IPA, +* "top IPA bit" set. +*/ +#define dma_addr_unencrypted (x) ((x) | PROT_NS_SHARED) + +/* Clear the "top" IPA bit while converting back */ +#define dma_addr_canonical (x) ((x) & ~PROT_NS_SHARED) +#endif /* __ASM_MEM_ENCRYPT_H */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 32/499 x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Morse <[email protected]>
[ Upstream commit a121798ae669351ec0697c94f71c3a692b2a755b ]
Commit
6eac36bb9eb0 ("x86/resctrl: Allocate the cleanest CLOSID by searching closid_num_dirty_rmid")
added logic that causes resctrl to search for the CLOSID with the fewest dirty cache lines when creating a new control group, if requested by the arch code. This depends on the values read from the llc_occupancy counters. The logic is applicable to architectures where the CLOSID effectively forms part of the monitoring identifier and so do not allow complete freedom to choose an unused monitoring identifier for a given CLOSID.
This support missed that some platforms may not have these counters. This causes a NULL pointer dereference when creating a new control group as the array was not allocated by dom_data_init().
As this feature isn't necessary on platforms that don't have cache occupancy monitors, add this to the check that occurs when a new control group is allocated.
--- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/kernel/cpu/resctrl/rdtgroup.c +2 -1
@@ -148,7 +148,8 @@ static int closid_alloc(void)lockdep_assert_held (&rdtgroup_mutex); -if (IS_ENABLED (CONFIG_RESCTRL_RMID_DEPENDS_ON_CLOSID )) { +if (IS_ENABLED (CONFIG_RESCTRL_RMID_DEPENDS_ON_CLOSID ) && +is_llc_occupancy_enabled ()) { cleanest_closid =resctrl_find_cleanest_closid ();if (cleanest_closid <0 )return cleanest_closid;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 33/499 cpuidle: Init cpuidle only for present CPUs
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacky Bai <[email protected]>
[ Upstream commit 68cb0139fec8e05b93978dc0ef1bc8df90a86419 ]
for_each_possible_cpu() is currently used to initialize cpuidle in below cpuidle drivers:
drivers/cpuidle/cpuidle-arm.c drivers/cpuidle/cpuidle-big_little.c drivers/cpuidle/cpuidle-psci.c drivers/cpuidle/cpuidle-qcom-spm.c drivers/cpuidle/cpuidle-riscv-sbi.c
However, in cpu_dev_register_generic(), for_each_present_cpu() is used to register CPU devices which means the CPU devices are only registered for present CPUs and not all possible CPUs.
With nosmp or maxcpus=0, only the boot CPU is present, lead to the failure:
| Failed to register cpuidle device for cpu1
Then rollback to cancel all CPUs' cpuidle registration.
Change for_each_possible_cpu() to for_each_present_cpu() in the above cpuidle drivers to ensure it only registers cpuidle devices for CPUs that are actually present.
--- drivers/cpuidle/cpuidle-arm.c | 8 ++++---- drivers/cpuidle/cpuidle-big_little.c | 2 +- drivers/cpuidle/cpuidle-psci.c | 4 ++-- drivers/cpuidle/cpuidle-qcom-spm.c | 2 +- drivers/cpuidle/cpuidle-riscv-sbi.c | 4 ++-- 5 files changed, 10 insertions(+), 10 deletions(-)
drivers/cpuidle/cpuidle-arm.c +4 -4
@@ -137,9 +137,9 @@ static int __init arm_idle_init_cpu(int cpu)/* * arm_idle_init - Initializes arm cpuidle driver * -* Initializes arm cpuidle driver for all CPUs, if any CPU fails -* to register cpuidle driver then rollback to cancel all CPUs -* registration. +* Initializes arm cpuidle driver for all present CPUs, if any +* CPU fails to register cpuidle driver then rollback to cancel +* all CPUs registration. */ static int __init arm_idle_init (void ) {
@@ -147,7 +147,7 @@ static int __init arm_idle_init(void)struct cpuidle_driver *drv;struct cpuidle_device *dev; -for_each_possible_cpu (cpu) { +for_each_present_cpu (cpu) { ret =arm_idle_init_cpu (cpu);if (ret) goto out_fail;
drivers/cpuidle/cpuidle-big_little.c +1 -1
@@ -148,7 +148,7 @@ static int __init bl_idle_driver_init(struct cpuidle_driver *drv, int part_id)if (!cpumask)return -ENOMEM ; -for_each_possible_cpu (cpu) +for_each_present_cpu (cpu)if (smp_cpuid_part (cpu) == part_id)cpumask_set_cpu (cpu, cpumask);
drivers/cpuidle/cpuidle-psci.c +2 -2
@@ -400,7 +400,7 @@ static int psci_idle_init_cpu(struct device *dev, int cpu)/* * psci_idle_probe - Initializes PSCI cpuidle driver * -* Initializes PSCI cpuidle driver for all CPUs, if any CPU fails +* Initializes PSCI cpuidle driver for all present CPUs, if any CPU fails * to register cpuidle driver then rollback to cancel all CPUs * registration. */
@@ -410,7 +410,7 @@ static int psci_cpuidle_probe(struct platform_device *pdev)struct cpuidle_driver *drv;struct cpuidle_device *dev; -for_each_possible_cpu (cpu) { +for_each_present_cpu (cpu) { ret =psci_idle_init_cpu (&pdev->dev, cpu);if (ret) goto out_fail;
drivers/cpuidle/cpuidle-qcom-spm.c +1 -1
@@ -135,7 +135,7 @@ static int spm_cpuidle_drv_probe(struct platform_device *pdev)if (ret)return dev_err_probe (&pdev->dev, ret,"set warm boot addr failed" ); -for_each_possible_cpu (cpu) { +for_each_present_cpu (cpu) { ret =spm_cpuidle_register (&pdev->dev, cpu);if (ret && ret != -ENODEV ) { dev_err(&pdev->dev,
drivers/cpuidle/cpuidle-riscv-sbi.c +2 -2
@@ -529,8 +529,8 @@ static int sbi_cpuidle_probe(struct platform_device *pdev)return ret; } -/* Initialize CPU idle driver for each CPU */ -for_each_possible_cpu (cpu) { +/* Initialize CPU idle driver for each present CPU */ +for_each_present_cpu (cpu) { ret =sbi_cpuidle_init_cpu (&pdev->dev, cpu);if (ret) { pr_debug("HART%ld: idle driver init failed\n",
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 34/499 thermal: int340x: Add NULL check for adev
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenyuan Yang <[email protected]>
[ Upstream commit 2542a3f70e563a9e70e7ded314286535a3321bdb ]
Not all devices have an ACPI companion fwnode, so adev might be NULL. This is similar to the commit cd2fd6eab480
("platform/x86: int3472: Check for adev == NULL").
Add a check for adev not being set and return -ENODEV in that case to avoid a possible NULL pointer deref in int3402_thermal_probe().
Note, under the same directory, int3400_thermal_probe() has such a check.
--- drivers/thermal/intel/int340x_thermal/int3402_thermal.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/thermal/intel/int340x_thermal/int3402_thermal.c +3 -0
@@ -45,6 +45,9 @@ static int int3402_thermal_probe(struct platform_device *pdev)struct int3402_thermal_data *d;int ret; +if (!adev) +return -ENODEV ; +if (!acpi_has_method (adev->handle,"_TMP" ))return -ENODEV ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 35/499 PM: sleep: Fix handling devices with direct_complete set on errors
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 03f1444016b71feffa1dfb8a51f15ba592f94b13 ]
When dpm_suspend() fails, some devices with power.direct_complete set may not have been handled by device_suspend() yet, so runtime PM has not been disabled for them yet even though power.direct_complete is set.
Since device_resume() expects that runtime PM has been disabled for all devices with power.direct_complete set, it will attempt to reenable runtime PM for the devices that have not been processed by device_suspend() which does not make sense. Had those devices had runtime PM disabled before device_suspend() had run, device_resume() would have inadvertently enable runtime PM for them, but this is not expected to happen because it would require ->prepare() callbacks to return positive values for devices with runtime PM disabled, which would be invalid.
In practice, this issue is most likely benign because pm_runtime_enable() will not allow the "disable depth" counter to underflow, but it causes a warning message to be printed for each affected device.
To allow device_resume() to distinguish the "direct complete" devices that have been processed by device_suspend() from those which have not been handled by it, make device_suspend() set power.is_suspended for "direct complete" devices.
Next, move the power.is_suspended check in device_resume() before the power.direct_complete check in it to make it skip the "direct complete" devices that have not been handled by device_suspend().
This change is based on a preliminary patch from Saravana Kannan.
--- drivers/base/power/main.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/base/power/main.c +4 -4
@@ -913,6 +913,9 @@ static void device_resume(struct device *dev, pm_message_t state, bool async)if (dev->power.syscore) goto Complete; +if (!dev->power.is_suspended) + goto Complete; +if (dev->power.direct_complete) {/* Match the pm_runtime_disable() in __device_suspend(). */ pm_runtime_enable (dev);
@@ -931,9 +934,6 @@ static void device_resume(struct device *dev, pm_message_t state, bool async)*/ dev->power.is_prepared = false; -if (!dev->power.is_suspended) - goto Unlock; -if (dev->pm_domain) { info ="power domain " ; callback =pm_op (&dev->pm_domain->ops, state);
@@ -973,7 +973,6 @@ static void device_resume(struct device *dev, pm_message_t state, bool async) error =dpm_run_callback (callback, dev, state, info); dev->power.is_suspended = false; - Unlock:device_unlock (dev);dpm_watchdog_clear (&wd);
@@ -1627,6 +1626,7 @@ static int device_suspend(struct device *dev, pm_message_t state, bool async)pm_runtime_disable (dev);if (pm_runtime_status_suspended (dev)) {pm_dev_dbg (dev, state,"direct-complete " ); + dev->power.is_suspended = true; goto Complete; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 36/499 lockdep: Dont disable interrupts on RT in disable_irq_nosync_lockdep.*()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 87886b32d669abc11c7be95ef44099215e4f5788 ]
disable_irq_nosync_lockdep() disables interrupts with lockdep enabled to avoid false positive reports by lockdep that a certain lock has not been acquired with disabled interrupts. The user of this macros expects that a lock can be acquried without disabling interrupts because the IRQ line triggering the interrupt is disabled.
This triggers a warning on PREEMPT_RT because after disable_irq_nosync_lockdep.*() the following spinlock_t now is acquired with disabled interrupts.
On PREEMPT_RT there is no difference between spin_lock() and spin_lock_irq() so avoiding disabling interrupts in this case works for the two remaining callers as of today.
Don't disable interrupts on PREEMPT_RT in disable_irq_nosync_lockdep.*().
--- include/linux/interrupt.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
include/linux/interrupt.h +4 -4
@@ -448,7 +448,7 @@ irq_calc_affinity_vectors(unsigned int minvec, unsigned int maxvec,static inline void disable_irq_nosync_lockdep (unsigned int irq) {disable_irq_nosync (irq); -#ifdef CONFIG_LOCKDEP +#if defined(CONFIG_LOCKDEP ) && !defined(CONFIG_PREEMPT_RT )local_irq_disable ();#endif }
@@ -456,7 +456,7 @@ static inline void disable_irq_nosync_lockdep(unsigned int irq)static inline void disable_irq_nosync_lockdep_irqsave (unsigned int irq,unsigned long *flags) {disable_irq_nosync (irq); -#ifdef CONFIG_LOCKDEP +#if defined(CONFIG_LOCKDEP ) && !defined(CONFIG_PREEMPT_RT )local_irq_save (*flags);#endif }
@@ -471,7 +471,7 @@ static inline void disable_irq_lockdep(unsigned int irq)static inline void enable_irq_lockdep (unsigned int irq) { -#ifdef CONFIG_LOCKDEP +#if defined(CONFIG_LOCKDEP ) && !defined(CONFIG_PREEMPT_RT )local_irq_enable ();#endif enable_irq (irq);
@@ -479,7 +479,7 @@ static inline void enable_irq_lockdep(unsigned int irq)static inline void enable_irq_lockdep_irqrestore (unsigned int irq,unsigned long *flags) { -#ifdef CONFIG_LOCKDEP +#if defined(CONFIG_LOCKDEP ) && !defined(CONFIG_PREEMPT_RT )local_irq_restore (*flags);#endif enable_irq (irq);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 37/499 cpufreq: Init cpufreq only for present CPUs
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacky Bai <[email protected]>
[ Upstream commit 45f589b7167f36290d29c79e3a442dc0b13c086a ]
for_each_possible_cpu() is currently used to initialize cpufreq. However, in cpu_dev_register_generic(), for_each_present_cpu() is used to register CPU devices which means the CPU devices are only registered for present CPUs and not all possible CPUs.
With nosmp or maxcpus=0, only the boot CPU is present, lead to the cpufreq probe failure or defer probe due to no cpu device available for not present CPUs.
Change for_each_possible_cpu() to for_each_present_cpu() in the above cpufreq drivers to ensure it only registers cpufreq for CPUs that are actually present.
--- drivers/cpufreq/armada-8k-cpufreq.c | 2 +- drivers/cpufreq/cpufreq-dt.c | 2 +- drivers/cpufreq/mediatek-cpufreq-hw.c | 2 +- drivers/cpufreq/mediatek-cpufreq.c | 2 +- drivers/cpufreq/mvebu-cpufreq.c | 2 +- drivers/cpufreq/qcom-cpufreq-hw.c | 2 +- drivers/cpufreq/qcom-cpufreq-nvmem.c | 8 ++++---- drivers/cpufreq/scmi-cpufreq.c | 2 +- drivers/cpufreq/scpi-cpufreq.c | 2 +- drivers/cpufreq/sun50i-cpufreq-nvmem.c | 6 +++--- drivers/cpufreq/virtual-cpufreq.c | 2 +- 11 files changed, 16 insertions(+), 16 deletions(-)
drivers/cpufreq/armada-8k-cpufreq.c +1 -1
@@ -47,7 +47,7 @@ static void __init armada_8k_get_sharing_cpus(struct clk *cur_clk, {int cpu; -for_each_possible_cpu (cpu) { +for_each_present_cpu (cpu) {struct device *cpu_dev;struct clk *clk;
drivers/cpufreq/cpufreq-dt.c +1 -1
@@ -303,7 +303,7 @@ static int dt_cpufreq_probe(struct platform_device *pdev)int ret, cpu;/* Request resources early so we can return in case of -EPROBE_DEFER */ -for_each_possible_cpu (cpu) { +for_each_present_cpu (cpu) { ret =dt_cpufreq_early_init (&pdev->dev, cpu);if (ret) goto err;
drivers/cpufreq/mediatek-cpufreq-hw.c +1 -1
@@ -304,7 +304,7 @@ static int mtk_cpufreq_hw_driver_probe(struct platform_device *pdev)struct regulator *cpu_reg;/* Make sure that all CPU supplies are available before proceeding. */ -for_each_possible_cpu (cpu) { +for_each_present_cpu (cpu) { cpu_dev =get_cpu_device (cpu);if (!cpu_dev) return dev_err_probe(&pdev->dev, -EPROBE_DEFER,
drivers/cpufreq/mediatek-cpufreq.c +1 -1
@@ -632,7 +632,7 @@ static int mtk_cpufreq_probe(struct platform_device *pdev)return dev_err_probe (&pdev->dev, -ENODEV ,"failed to get mtk cpufreq platform data\n" ); -for_each_possible_cpu (cpu) { +for_each_present_cpu (cpu) { info =mtk_cpu_dvfs_info_lookup (cpu);if (info)continue ;
drivers/cpufreq/mvebu-cpufreq.c +1 -1
@@ -56,7 +56,7 @@ static int __init armada_xp_pmsu_cpufreq_init(void)* it), and registers the clock notifier that will take care * of doing the PMSU part of a frequency transition. */ -for_each_possible_cpu (cpu) { +for_each_present_cpu (cpu) {struct device *cpu_dev;struct clk *clk;int ret;
drivers/cpufreq/qcom-cpufreq-hw.c +1 -1
@@ -306,7 +306,7 @@ static void qcom_get_related_cpus(int index, struct cpumask *m)struct of_phandle_args args;int cpu, ret; -for_each_possible_cpu (cpu) { +for_each_present_cpu (cpu) { cpu_np =of_cpu_device_node_get (cpu);if (!cpu_np)continue ;
drivers/cpufreq/qcom-cpufreq-nvmem.c +4 -4
@@ -489,7 +489,7 @@ static int qcom_cpufreq_probe(struct platform_device *pdev)nvmem_cell_put (speedbin_nvmem); } -for_each_possible_cpu (cpu) { +for_each_present_cpu (cpu) {struct dev_pm_opp_config config = { .supported_hw =NULL , };
@@ -543,7 +543,7 @@ static int qcom_cpufreq_probe(struct platform_device *pdev)dev_err (cpu_dev,"Failed to register platform device\n" ); free_opp: -for_each_possible_cpu (cpu) { +for_each_present_cpu (cpu) {dev_pm_domain_detach_list (drv->cpus[cpu].pd_list);dev_pm_opp_clear_config (drv->cpus[cpu].opp_token); }
@@ -557,7 +557,7 @@ static void qcom_cpufreq_remove(struct platform_device *pdev)platform_device_unregister (cpufreq_dt_pdev); -for_each_possible_cpu (cpu) { +for_each_present_cpu (cpu) {dev_pm_domain_detach_list (drv->cpus[cpu].pd_list);dev_pm_opp_clear_config (drv->cpus[cpu].opp_token); }
@@ -568,7 +568,7 @@ static int qcom_cpufreq_suspend(struct device *dev)struct qcom_cpufreq_drv *drv =dev_get_drvdata (dev);unsigned int cpu; -for_each_possible_cpu (cpu) +for_each_present_cpu (cpu)qcom_cpufreq_suspend_pd_devs (drv, cpu);return 0 ;
drivers/cpufreq/scmi-cpufreq.c +1 -1
@@ -101,7 +101,7 @@ scmi_get_sharing_cpus(struct device *cpu_dev, int domain,int cpu, tdomain;struct device *tcpu_dev; -for_each_possible_cpu (cpu) { +for_each_present_cpu (cpu) {if (cpu == cpu_dev->id)continue ;
drivers/cpufreq/scpi-cpufreq.c +1 -1
@@ -65,7 +65,7 @@ scpi_get_sharing_cpus(struct device *cpu_dev, struct cpumask *cpumask)if (domain <0 )return domain; -for_each_possible_cpu (cpu) { +for_each_present_cpu (cpu) {if (cpu == cpu_dev->id)continue ;
drivers/cpufreq/sun50i-cpufreq-nvmem.c +3 -3
@@ -262,7 +262,7 @@ static int sun50i_cpufreq_nvmem_probe(struct platform_device *pdev)snprintf (name,sizeof (name),"speed%d" , speed); config.prop_name = name; -for_each_possible_cpu (cpu) { +for_each_present_cpu (cpu) {struct device *cpu_dev =get_cpu_device (cpu);if (!cpu_dev) {
@@ -288,7 +288,7 @@ static int sun50i_cpufreq_nvmem_probe(struct platform_device *pdev)pr_err ("Failed to register platform device\n" ); free_opp: -for_each_possible_cpu (cpu) +for_each_present_cpu (cpu)dev_pm_opp_clear_config (opp_tokens[cpu]);kfree (opp_tokens);
@@ -302,7 +302,7 @@ static void sun50i_cpufreq_nvmem_remove(struct platform_device *pdev)platform_device_unregister (cpufreq_dt_pdev); -for_each_possible_cpu (cpu) +for_each_present_cpu (cpu)dev_pm_opp_clear_config (opp_tokens[cpu]);kfree (opp_tokens);
drivers/cpufreq/virtual-cpufreq.c +1 -1
@@ -138,7 +138,7 @@ static int virt_cpufreq_get_sharing_cpus(struct cpufreq_policy *policy) cur_perf_domain =readl_relaxed (base + policy->cpu *PER_CPU_OFFSET +REG_PERF_DOMAIN_OFFSET ); -for_each_possible_cpu (cpu) { +for_each_present_cpu (cpu) { cpu_dev =get_cpu_device (cpu);if (!cpu_dev)continue ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 38/499 perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Chen <[email protected]>
[ Upstream commit c96fff391c095c11dc87dab35be72dee7d217cde ]
The poll man page says POLLRDNORM is equivalent to POLLIN. For poll(), it seems that if user sets pollfd with POLLRDNORM in userspace, perf_poll will not return until timeout even if perf_output_wakeup called, whereas POLLIN returns.
--- kernel/events/ring_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/ring_buffer.c +1 -1
@@ -19,7 +19,7 @@static void perf_output_wakeup (struct perf_output_handle *handle) { -atomic_set (&handle->rb->poll,EPOLLIN ); +atomic_set (&handle->rb->poll,EPOLLIN |EPOLLRDNORM ); handle->event->pending_wakeup =1 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 39/499 x86/traps: Make exc_double_fault() consistently noreturn
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit 8085fcd78c1a3dbdf2278732579009d41ce0bc4e ]
The CONFIG_X86_ESPFIX64 version of exc_double_fault() can return to its caller, but the !CONFIG_X86_ESPFIX64 version never does. In the latter case the compiler and/or objtool may consider it to be implicitly noreturn.
However, due to the currently inflexible way objtool detects noreturns, a function's noreturn status needs to be consistent across configs.
The current workaround for this issue is to suppress unreachable warnings for exc_double_fault()'s callers. Unfortunately that can result in ORC coverage gaps and potentially worse issues like inert static calls and silently disabled CPU mitigations.
Instead, prevent exc_double_fault() from ever being implicitly marked noreturn by forcing a return behind a never-taken conditional.
Until a more integrated noreturn detection method exists, this is likely the least objectionable workaround.
--- arch/x86/kernel/traps.c | 18 +++++++++++++++++- tools/objtool/check.c | 31 +------------------------------ 2 files changed, 18 insertions(+), 31 deletions(-)
arch/x86/kernel/traps.c +17 -1
@@ -379,6 +379,21 @@ __visible void __noreturn handle_stack_overflow(struct pt_regs *regs, }#endif +/* +* Prevent the compiler and/or objtool from marking the !CONFIG_X86_ESPFIX64 +* version of exc_double_fault() as noreturn. Otherwise the noreturn mismatch +* between configs triggers objtool warnings. +* +* This is a temporary hack until we have compiler or plugin support for +* annotating noreturns. +*/ +#ifdef CONFIG_X86_ESPFIX64 +#define always_true () true +#else +bool always_true (void ); +bool __weak always_true (void ) {return true; } +#endif +/* * Runs on an IST stack for x86_64 and on a special task stack for x86_32. *
@@ -514,7 +529,8 @@ DEFINE_IDTENTRY_DF(exc_double_fault)pr_emerg ("PANIC: double fault, error_code: 0x%lx\n" , error_code);die ("double fault" , regs, error_code); -panic ("Machine halted." ); +if (always_true ()) +panic ("Machine halted." );instrumentation_end (); }
tools/objtool/check.c +1 -30
@@ -4594,35 +4594,6 @@ static int validate_sls(struct objtool_file *file)return warnings; } -static bool ignore_noreturn_call (struct instruction *insn) -{ -struct symbol *call_dest =insn_call_dest (insn); - -/* -* FIXME: hack, we need a real noreturn solution -* -* Problem is, exc_double_fault() may or may not return, depending on -* whether CONFIG_X86_ESPFIX64 is set. But objtool has no visibility -* to the kernel config. -* -* Other potential ways to fix it: -* -* - have compiler communicate __noreturn functions somehow -* - remove CONFIG_X86_ESPFIX64 -* - read the .config file -* - add a cmdline option -* - create a generic objtool annotation format (vs a bunch of custom -* formats) and annotate it -*/ -if (!strcmp (call_dest->name,"exc_double_fault" )) { -/* prevent further unreachable warnings for the caller */ - insn->sym->warned =1 ; -return true; - } - -return false; -} -static int validate_reachable_instructions (struct objtool_file *file) {struct instruction *insn, *prev_insn;
@@ -4639,7 +4610,7 @@ static int validate_reachable_instructions(struct objtool_file *file) prev_insn =prev_insn_same_sec (file, insn);if (prev_insn && prev_insn->dead_end) { call_dest =insn_call_dest (prev_insn); -if (call_dest && !ignore_noreturn_call (prev_insn)) { +if (call_dest) {WARN_INSN (insn,"%s() is missing a __noreturn annotation" , call_dest->name); warnings++;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 40/499 x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Gao <[email protected]>
[ Upstream commit dda366083e5ff307a4a728757db874bbfe7550be ]
Guest FPUs manage vCPU FPU states. They are allocated via fpu_alloc_guest_fpstate() and are resized in fpstate_realloc() when XFD features are enabled.
Since the introduction of guest FPUs, there have been inconsistencies in the kernel buffer size and xfeatures:
1. fpu_alloc_guest_fpstate() uses fpu_user_cfg since its introduction. See:
69f6ed1d14c6 ("x86/fpu: Provide infrastructure for KVM FPU cleanup") 36487e6228c4 ("x86/fpu: Prepare guest FPU for dynamically enabled FPU features")
2. __fpstate_reset() references fpu_kernel_cfg to set storage attributes.
3. fpu->guest_perm uses fpu_kernel_cfg, affecting fpstate_realloc().
A recent commit in the tip:x86/fpu tree partially addressed the inconsistency between (1) and (3) by using fpu_kernel_cfg for size calculation in (1), but left fpu_guest->xfeatures and fpu_guest->perm still referencing fpu_user_cfg:
https://lore.kernel.org/all/[email protected]/
1937e18cc3cf ("x86/fpu: Fix guest FPU state buffer allocation size")
The inconsistencies within fpu_alloc_guest_fpstate() and across the mentioned functions cause confusion.
Fix them by using fpu_kernel_cfg consistently in fpu_alloc_guest_fpstate(), except for fields related to the UABI buffer. Referencing fpu_kernel_cfg won't impact functionalities, as:
1. fpu_guest->perm is overwritten shortly in fpu_init_guest_permissions()
with fpstate->guest_perm, which already uses fpu_kernel_cfg.
2. fpu_guest->xfeatures is solely used to check if XFD features are enabled. Including supervisor xfeatures doesn't affect the check.
--- arch/x86/kernel/fpu/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/kernel/fpu/core.c +2 -2
@@ -232,8 +232,8 @@ bool fpu_alloc_guest_fpstate(struct fpu_guest *gfpu) fpstate->is_guest = true; gfpu->fpstate = fpstate; - gfpu->xfeatures = fpu_user_cfg.default_features; - gfpu->perm = fpu_user_cfg.default_features; + gfpu->xfeatures = fpu_kernel_cfg.default_features; + gfpu->perm = fpu_kernel_cfg.default_features;/* * KVM sets the FP+SSE bits in the XSAVE header when copying FPU state
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 41/499 x86/entry: Add __init to ia32_emulation_override_cmdline()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Kuznetsov <[email protected]>
[ Upstream commit d55f31e29047f2f987286d55928ae75775111fe7 ]
ia32_emulation_override_cmdline() is an early_param() arg and these are only needed at boot time. In fact, all other early_param() functions in arch/x86 seem to have '__init' annotation and ia32_emulation_override_cmdline() is the only exception.
--- arch/x86/entry/common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/entry/common.c +1 -1
@@ -142,7 +142,7 @@ static __always_inline int syscall_32_enter(struct pt_regs *regs)#ifdef CONFIG_IA32_EMULATION bool __ia32_enabled__ro_after_init = !IS_ENABLED (CONFIG_IA32_EMULATION_DEFAULT_DISABLED ); -static int ia32_emulation_override_cmdline (char *arg) +static int __init ia32_emulation_override_cmdline (char *arg) {return kstrtobool (arg, &__ia32_enabled); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 42/499 RISC-V: KVM: Teardown riscv specific bits after kvm_exit
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Atish Patra <[email protected]>
[ Upstream commit 2d117e67f318303f6ab699a5511d1fac3f170545 ]
During a module removal, kvm_exit invokes arch specific disable call which disables AIA. However, we invoke aia_exit before kvm_exit resulting in the following warning. KVM kernel module can't be inserted afterwards due to inconsistent state of IRQ.
[25469.031389] percpu IRQ 31 still enabled on CPU0! [25469.031732] WARNING: CPU: 3 PID: 943 at kernel/irq/manage.c:2476 __free_percpu_irq+0xa2/0x150 [25469.031804] Modules linked in: kvm(-) [25469.031848] CPU: 3 UID: 0 PID: 943 Comm: rmmod Not tainted 6.14.0-rc5-06947-g91c763118f47-dirty #2 [25469.031905] Hardware name: riscv-virtio,qemu (DT) [25469.031928] epc : __free_percpu_irq+0xa2/0x150 [25469.031976] ra : __free_percpu_irq+0xa2/0x150 [25469.032197] epc : ffffffff8007db1e ra : ffffffff8007db1e sp : ff2000000088bd50 [25469.032241] gp : ffffffff8131cef8 tp : ff60000080b96400 t0 : ff2000000088baf8 [25469.032285] t1 : fffffffffffffffc t2 : 5249207570637265 s0 : ff2000000088bd90 [25469.032329] s1 : ff60000098b21080 a0 : 037d527a15eb4f00 a1 : 037d527a15eb4f00 [25469.032372] a2 : 0000000000000023 a3 : 0000000000000001 a4 : ffffffff8122dbf8 [25469.032410] a5 : 0000000000000fff a6 : 0000000000000000 a7 : ffffffff8122dc10 [25469.032448] s2 : ff60000080c22eb0 s3 : 0000000200000022 s4 : 000000000000001f [25469.032488] s5 : ff60000080c22e00 s6 : ffffffff80c351c0 s7 : 0000000000000000 [25469.032582] s8 : 0000000000000003 s9 : 000055556b7fb490 s10: 00007ffff0e12fa0 [25469.032621] s11: 00007ffff0e13e9a t3 : ffffffff81354ac7 t4 : ffffffff81354ac7 [25469.032664] t5 : ffffffff81354ac8 t6 : ffffffff81354ac7 [25469.032698] status: 0000000200000100 badaddr: ffffffff8007db1e cause: 0000000000000003 [25469.032738] [<ffffffff8007db1e>] __free_percpu_irq+0xa2/0x150 [25469.032797] [<ffffffff8007dbfc>] free_percpu_irq+0x30/0x5e [25469.032856] [<ffffffff013a57dc>] kvm_riscv_aia_exit+0x40/0x42 [kvm] [25469.033947] [<ffffffff013b4e82>] cleanup_module+0x10/0x32 [kvm] [25469.035300] [<ffffffff8009b150>] __riscv_sys_delete_module+0x18e/0x1fc [25469.035374] [<ffffffff8000c1ca>] syscall_handler+0x3a/0x46 [25469.035456] [<ffffffff809ec9a4>] do_trap_ecall_u+0x72/0x134 [25469.035536] [<ffffffff809f5e18>] handle_exception+0x148/0x156
Invoke aia_exit and other arch specific cleanup functions after kvm_exit so that disable gets a chance to be called first before exit.
--- arch/riscv/kvm/main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/riscv/kvm/main.c +2 -2
@@ -172,8 +172,8 @@ module_init(riscv_kvm_init); static void __exit riscv_kvm_exit(void) { -kvm_riscv_teardown (); -kvm_exit (); + +kvm_riscv_teardown (); }module_exit (riscv_kvm_exit);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 43/499 regulator: pca9450: Fix enable register for LDO5
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frieder Schrempf <[email protected]>
[ Upstream commit f5aab0438ef17f01c5ecd25e61ae6a03f82a4586 ]
The LDO5 regulator has two configuration registers, but only LDO5CTRL_L contains the bits for enabling/disabling the regulator.
--- drivers/regulator/pca9450-regulator.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/regulator/pca9450-regulator.c +3 -3
@@ -454,7 +454,7 @@ static const struct pca9450_regulator_desc pca9450a_regulators[] = { .n_linear_ranges = ARRAY_SIZE(pca9450_ldo5_volts), .vsel_reg = PCA9450_REG_LDO5CTRL_H, .vsel_mask = LDO5HOUT_MASK, - .enable_reg = PCA9450_REG_LDO5CTRL_H, + .enable_reg = PCA9450_REG_LDO5CTRL_L, .enable_mask = LDO5H_EN_MASK, .owner = THIS_MODULE, },
@@ -663,7 +663,7 @@ static const struct pca9450_regulator_desc pca9450bc_regulators[] = { .n_linear_ranges = ARRAY_SIZE(pca9450_ldo5_volts), .vsel_reg = PCA9450_REG_LDO5CTRL_H, .vsel_mask = LDO5HOUT_MASK, - .enable_reg = PCA9450_REG_LDO5CTRL_H, + .enable_reg = PCA9450_REG_LDO5CTRL_L, .enable_mask = LDO5H_EN_MASK, .owner = THIS_MODULE, },
@@ -835,7 +835,7 @@ static const struct pca9450_regulator_desc pca9451a_regulators[] = { .n_linear_ranges = ARRAY_SIZE(pca9450_ldo5_volts), .vsel_reg = PCA9450_REG_LDO5CTRL_H, .vsel_mask = LDO5HOUT_MASK, - .enable_reg = PCA9450_REG_LDO5CTRL_H, + .enable_reg = PCA9450_REG_LDO5CTRL_L, .enable_mask = LDO5H_EN_MASK, .owner = THIS_MODULE, },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 44/499 auxdisplay: MAX6959 should select BITREVERSE
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit fce85f3da08b76c1b052f53a9f6f9c40a8a10660 ]
If CONFIG_BITREVERSE is not enabled:
max6959.c:(.text+0x92): undefined reference to `byte_rev_table'
--- drivers/auxdisplay/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/auxdisplay/Kconfig +1 -0
@@ -503,6 +503,7 @@ config HT16K33 config MAX6959 tristate "Maxim MAX6958/6959 7-segment LED controller" depends on I2C + select BITREVERSE select REGMAP_I2C select LINEDISP help
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 45/499 media: verisilicon: HEVC: Initialize start_bit field
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Gaignard <[email protected]>
[ Upstream commit 7fcb42b3835e90ef18d68555934cf72adaf58402 ]
The HEVC driver needs to set the start_bit field explicitly to avoid causing corrupted frames when the VP9 decoder is used in parallel. The reason for this problem is that the VP9 and the HEVC decoder share this register.
--- drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c +1 -0
@@ -518,6 +518,7 @@ static void set_buffers(struct hantro_ctx *ctx)hantro_reg_write (vpu, &g2_stream_len, src_len);hantro_reg_write (vpu, &g2_strm_buffer_len, src_buf_len);hantro_reg_write (vpu, &g2_strm_start_offset,0 ); +hantro_reg_write (vpu, &g2_start_bit,0 );hantro_reg_write (vpu, &g2_write_mvs_e,1 );hantro_write_addr (vpu,G2_TILE_SIZES_ADDR , ctx->hevc_dec.tile_sizes.dma);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 46/499 media: platform: allgro-dvt: unregister v4l2_device on the error path
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
[ Upstream commit c2b96a6818159fba8a3bcc38262da9e77f9b3ec7 ]
In allegro_probe(), the v4l2 device is not unregistered in the error path, which results in a memory leak. Fix it by calling v4l2_device_unregister() before returning error.
--- drivers/media/platform/allegro-dvt/allegro-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/allegro-dvt/allegro-core.c +1 -0
@@ -3912,6 +3912,7 @@ static int allegro_probe(struct platform_device *pdev)if (ret <0 ) {v4l2_err (&dev->v4l2_dev,"failed to request firmware: %d\n" , ret); +v4l2_device_unregister (&dev->v4l2_dev);return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 47/499 auxdisplay: panel: Fix an API misuse in panel.c
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 72e1c440c848624ad4cfac93d69d8a999a20355b ]
Variable allocated by charlcd_alloc() should be released by charlcd_free(). The following patch changed kfree() to charlcd_free() to fix an API misuse.
--- drivers/auxdisplay/panel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/auxdisplay/panel.c +2 -2
@@ -1664,7 +1664,7 @@ static void panel_attach(struct parport *port)if (lcd.enabled)charlcd_unregister (lcd.charlcd); err_unreg_device: -kfree (lcd.charlcd); +charlcd_free (lcd.charlcd); lcd.charlcd =NULL ;parport_unregister_device (pprt); pprt =NULL ;
@@ -1692,7 +1692,7 @@ static void panel_detach(struct parport *port)charlcd_unregister (lcd.charlcd); lcd.initialized = false;kfree (lcd.charlcd->drvdata); -kfree (lcd.charlcd); +charlcd_free (lcd.charlcd); lcd.charlcd =NULL ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 48/499 platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 886ca11a0c70efe5627a18557062e8a44370d78f ]
Sparse reports:
lenovo-yoga-tab2-pro-1380-fastcharger.c:222:29: warning: symbol 'yt2_1380_fc_serdev_driver' was not declared. Should it be static?
Fix that by making the symbol static.
--- drivers/platform/x86/lenovo-yoga-tab2-pro-1380-fastcharger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/lenovo-yoga-tab2-pro-1380-fastcharger.c +1 -1
@@ -219,7 +219,7 @@ static int yt2_1380_fc_serdev_probe(struct serdev_device *serdev)return 0 ; } -struct serdev_device_driver yt2_1380_fc_serdev_driver = { +static struct serdev_device_driver yt2_1380_fc_serdev_driver = { .probe = yt2_1380_fc_serdev_probe, .driver = { .name =KBUILD_MODNAME ,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 49/499 platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 4878e0b14c3e31a87ab147bd2dae443394cb5a2c ]
Sparse reports:
dell-uart-backlight.c:328:29: warning: symbol 'dell_uart_bl_serdev_driver' was not declared. Should it be static?
Fix it by making the symbol static.
--- drivers/platform/x86/dell/dell-uart-backlight.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/dell/dell-uart-backlight.c +1 -1
@@ -325,7 +325,7 @@ static int dell_uart_bl_serdev_probe(struct serdev_device *serdev)return PTR_ERR_OR_ZERO (dell_bl->bl); } -struct serdev_device_driver dell_uart_bl_serdev_driver = { +static struct serdev_device_driver dell_uart_bl_serdev_driver = { .probe = dell_uart_bl_serdev_probe, .driver = { .name =KBUILD_MODNAME ,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 50/499 platform/x86: dell-ddv: Fix temperature calculation
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 7a248294a3145bc65eb0d8980a0a8edbb1b92db4 ]
On the Dell Inspiron 3505 the battery temperature is always 0.1 degrees larger than the temperature show inside the OEM application.
Emulate this behaviour to avoid showing strange looking values like 29.1 degrees.
--- drivers/platform/x86/dell/dell-wmi-ddv.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/platform/x86/dell/dell-wmi-ddv.c +4 -2
@@ -665,8 +665,10 @@ static ssize_t temp_show(struct device *dev, struct device_attribute *attr, charif (ret <0 )return ret; -/* Use 2731 instead of 2731.5 to avoid unnecessary rounding */ -return sysfs_emit (buf,"%d\n" , value -2731 ); +/* Use 2732 instead of 2731.5 to avoid unnecessary rounding and to emulate +* the behaviour of the OEM application which seems to round down the result. +*/ +return sysfs_emit (buf,"%d\n" , value -2732 ); }static ssize_t eppid_show (struct device *dev,struct device_attribute *attr,char *buf)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 51/499 ASoC: cs35l41: check the return value from spi_setup()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaliy Shevtsov <[email protected]>
[ Upstream commit ad5a0970f86d82e39ebd06d45a1f7aa48a1316f8 ]
Currently the return value from spi_setup() is not checked for a failure. It is unlikely it will ever fail in this particular case but it is still better to add this check for the sake of completeness and correctness. This is cheap since it is performed once when the device is being probed.
Handle spi_setup() return value.
Found by Linux Verification Center (linuxtesting.org) with Svace.
--- sound/soc/codecs/cs35l41-spi.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
sound/soc/codecs/cs35l41-spi.c +4 -1
@@ -32,13 +32,16 @@ static int cs35l41_spi_probe(struct spi_device *spi)const struct regmap_config *regmap_config = &cs35l41_regmap_spi;struct cs35l41_hw_cfg *hw_cfg =dev_get_platdata (&spi->dev);struct cs35l41_private *cs35l41; +int ret; cs35l41 =devm_kzalloc (&spi->dev,sizeof (struct cs35l41_private ),GFP_KERNEL );if (!cs35l41)return -ENOMEM ; spi->max_speed_hz =CS35L41_SPI_MAX_FREQ ; -spi_setup (spi); + ret =spi_setup (spi); +if (ret <0 ) +return ret;spi_set_drvdata (spi, cs35l41); cs35l41->regmap =devm_regmap_init_spi (spi, regmap_config);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 52/499 ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Venkata Prasad Potturu <[email protected]>
[ Upstream commit 02e1cf7a352a3ba5f768849f2b4fcaaaa19f89e3 ]
Add condition check to register ACP PDM sound card by reading _WOV acpi entry.
--- sound/soc/amd/acp/acp-legacy-common.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
sound/soc/amd/acp/acp-legacy-common.c +9 -1
@@ -13,6 +13,7 @@*/ #include "amd.h" +#include <linux/acpi.h> #include <linux/pci.h> #include <linux/export.h>
@@ -445,7 +446,9 @@ void check_acp_config(struct pci_dev *pci, struct acp_chip_info *chip) {struct acpi_device *pdm_dev;const union acpi_object *obj; -u32 pdm_addr; +acpi_handle handle; +acpi_integer dmic_status; +u32 pdm_addr, ret;switch (chip->acp_rev) {case ACP_RN_PCI_ID :
@@ -477,6 +480,11 @@ void check_acp_config(struct pci_dev *pci, struct acp_chip_info *chip) obj->integer.value == pdm_addr) chip->is_pdm_dev = true; } + + handle =ACPI_HANDLE (&pci->dev); + ret =acpi_evaluate_integer (handle,"_WOV" ,NULL , &dmic_status); +if (!ACPI_FAILURE (ret)) + chip->is_pdm_dev = dmic_status; } }EXPORT_SYMBOL_NS_GPL (check_acp_config,"SND_SOC_ACP_COMMON" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 53/499 HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <[email protected]>
[ Upstream commit fe0fb58325e519008e2606a5aa2cff7ad23e212d ]
The line
obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER) += intel-ish-hid/
in top-level HID Makefile is both superfluous (as CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER depends on CONFIG_INTEL_ISH_HID, which contains intel-ish-hid/ already) and wrong (as it's missing the CONFIG_ prefix).
Just remove it.
--- drivers/hid/Makefile | 1 - 1 file changed, 1 deletion(-)
drivers/hid/Makefile +0 -1
@@ -166,7 +166,6 @@ obj-$(CONFIG_USB_KBD) += usbhid/ obj-$(CONFIG_I2C_HID_CORE) += i2c-hid/ obj-$(CONFIG_INTEL_ISH_HID) += intel-ish-hid/ -obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER) += intel-ish-hid/ obj-$(CONFIG_AMD_SFH_HID) += amd-sfh-hid/
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 54/499 dt-bindings: vendor-prefixes: add GOcontroll
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maud Spierings <[email protected]>
[ Upstream commit 5f0d2de417166698c8eba433b696037ce04730da ]
GOcontroll produces embedded linux systems and IO modules to use in these systems, add its prefix.
--- Documentation/devicetree/bindings/vendor-prefixes.yaml | 2 ++ 1 file changed, 2 insertions(+)
Documentation/devicetree/bindings/vendor-prefixes.yaml +2 -0
@@ -589,6 +589,8 @@ patternProperties: description: GlobalTop Technology, Inc. "^gmt,.*": description: Global Mixed-mode Technology, Inc. + "^gocontroll,.*": + description: GOcontroll Modular Embedded Electronics B.V. "^goldelico,.*": description: Golden Delicious Computers GmbH & Co. KG "^goodix,.*":
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 55/499 ALSA: hda/realtek: Always honor no_shutup_pins
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 5a0c72c1da3cbc0cd4940a95d1be2830104c6edf ]
The workaround for Dell machines to skip the pin-shutup for mic pins introduced alc_headset_mic_no_shutup() that is replaced from the generic snd_hda_shutup_pins() for certain codecs. The problem is that the call is done unconditionally even if spec->no_shutup_pins is set. This seems causing problems on other platforms like Lenovo.
This patch corrects the behavior and the driver honors always spec->no_shutup_pins flag and skips alc_headset_mic_no_shutup() if it's set.
--- sound/pci/hda/patch_realtek.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/pci/hda/patch_realtek.c +4 -2
@@ -586,6 +586,9 @@ static void alc_shutup_pins(struct hda_codec *codec) {struct alc_spec *spec = codec->spec; +if (spec->no_shutup_pins) +return ; +switch (codec->core.vendor_id) {case 0x10ec0236 :case 0x10ec0256 :
@@ -601,8 +604,7 @@ static void alc_shutup_pins(struct hda_codec *codec)alc_headset_mic_no_shutup (codec);break ;default : -if (!spec->no_shutup_pins) -snd_hda_shutup_pins (codec); +snd_hda_shutup_pins (codec);break ; } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 56/499 ASoC: tegra: Use non-atomic timeout for ADX status register
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ritu Chaudhary <[email protected]>
[ Upstream commit f1d742c35b659fb0122da0a8ff09ad9309cb29d8 ]
ADX startup() callback uses atomic poll timeout on ADX status register.
This is unnecessary because:
- The startup() callback itself is non-atomic.
- The subsequent timeout call in the same function already uses a non-atomic version.
Using atomic version can hog CPU when it is not really needed, so replace it with non-atomic version.
--- sound/soc/tegra/tegra210_adx.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/soc/tegra/tegra210_adx.c +3 -3
@@ -1,5 +1,5 @@// SPDX-License-Identifier: GPL-2.0-only -// SPDX-FileCopyrightText: Copyright (c) 2021-2024 NVIDIA CORPORATION & AFFILIATES. +// SPDX-FileCopyrightText: Copyright (c) 2021-2025 NVIDIA CORPORATION & AFFILIATES. // All rights reserved. // // tegra210_adx.c - Tegra210 ADX driver
@@ -57,8 +57,8 @@ static int tegra210_adx_startup(struct snd_pcm_substream *substream,int err;/* Ensure if ADX status is disabled */ - err =regmap_read_poll_timeout_atomic (adx->regmap,TEGRA210_ADX_STATUS , - val, !(val &0x1 ),10 ,10000 ); + err =regmap_read_poll_timeout (adx->regmap,TEGRA210_ADX_STATUS , + val, !(val &0x1 ),10 ,10000 );if (err <0 ) {dev_err (dai->dev,"failed to stop ADX, err = %d\n" , err);return err;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 57/499 ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jayesh Choudhary <[email protected]>
[ Upstream commit 45ff65e30deb919604e68faed156ad96ce7474d9 ]
For 'ti,j7200-cpb-audio' compatible, there is support for only one PLL for 48k. For 11025, 22050, 44100 and 88200 sampling rates, due to absence of J721E_CLK_PARENT_44100, we get EINVAL while running any audio application. Add support for these rates by using the 48k parent clock and adjusting the clock for these rates later in j721e_configure_refclk.
--- sound/soc/ti/j721e-evm.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/ti/j721e-evm.c +2 -0
@@ -182,6 +182,8 @@ static int j721e_configure_refclk(struct j721e_priv *priv, clk_id =J721E_CLK_PARENT_48000 ; else if (!(rate % 11025) && priv->pll_rates[J721E_CLK_PARENT_44100]) clk_id =J721E_CLK_PARENT_44100 ; + else if (!(rate % 11025) && priv->pll_rates[J721E_CLK_PARENT_48000]) + clk_id =J721E_CLK_PARENT_48000 ; else return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 58/499 ALSA: usb-audio: separate DJM-A9 cap lvl options
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olivia Mackintosh <[email protected]>
[ Upstream commit 38e94cefbf45c1edc5b751ab90a3088f7c6fac1a ]
Mixer quicks for the Pioneer DJM-A9 mixer was added in 5289d00 with additional capture level values added to the common DJM array of values.
This breaks the existing DJM mixers however as alsa-utils relies on enumeration of the actual mixer options based on the value array which results in error when storing state.
This commit just separates the A9 values into a separate array and references them in the corresponding mixer control.
--- sound/usb/mixer_quirks.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
sound/usb/mixer_quirks.c +4 -3
@@ -3687,8 +3687,7 @@ static const char *snd_djm_get_label(u8 device_idx, u16 wvalue, u16 windex)// common DJM capture level option values static const u16 snd_djm_opts_cap_level[] = { -0x0000 ,0x0100 ,0x0200 ,0x0300 ,0x400 ,0x500 }; - +0x0000 ,0x0100 ,0x0200 ,0x0300 };// DJM-250MK2 static const u16 snd_djm_opts_250mk2_cap1[] = {
@@ -3830,6 +3829,8 @@ static const struct snd_djm_ctl snd_djm_ctls_750mk2[] = {// DJM-A9 +static const u16 snd_djm_opts_a9_cap_level[] = { +0x0000 ,0x0100 ,0x0200 ,0x0300 ,0x0400 ,0x0500 };static const u16 snd_djm_opts_a9_cap1[] = {0x0107 ,0x0108 ,0x0109 ,0x010a ,0x010e ,0x111 ,0x112 ,0x113 ,0x114 ,0x0131 ,0x132 ,0x133 ,0x134 };
@@ -3843,7 +3844,7 @@ static const u16 snd_djm_opts_a9_cap5[] = { 0x0501, 0x0502, 0x0503, 0x0505, 0x0506, 0x0507, 0x0508, 0x0509, 0x050a, 0x050e };static const struct snd_djm_ctl snd_djm_ctls_a9[] = { -SND_DJM_CTL ("Capture Level" , cap_level,0 ,SND_DJM_WINDEX_CAPLVL ), +SND_DJM_CTL ("Capture Level" , a9_cap_level,0 ,SND_DJM_WINDEX_CAPLVL ),SND_DJM_CTL ("Master Input" , a9_cap1,3 ,SND_DJM_WINDEX_CAP ),SND_DJM_CTL ("Ch1 Input" , a9_cap2,2 ,SND_DJM_WINDEX_CAP ),SND_DJM_CTL ("Ch2 Input" , a9_cap3,2 ,SND_DJM_WINDEX_CAP ),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 59/499 ALSA: timer: Dont take register_mutex with copy_from/to_user()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 3424c8f53bc63c87712a7fc22dc13d0cc85fb0d6 ]
The infamous mmap_lock taken in copy_from/to_user() can be often problematic when it's called inside another mutex, as they might lead to deadlocks.
In the case of ALSA timer code, the bad pattern is with guard(mutex)(®ister_mutex) that covers copy_from/to_user() -- which was mistakenly introduced at converting to guard(), and it had been carefully worked around in the past.
This patch fixes those pieces simply by moving copy_from/to_user() out of the register mutex lock again.
--- sound/core/timer.c | 147 ++++++++++++++++++++++++--------------------- 1 file changed, 77 insertions(+), 70 deletions(-)
sound/core/timer.c +77 -70
@@ -1515,91 +1515,97 @@ static void snd_timer_user_copy_id(struct snd_timer_id *id, struct snd_timer *ti id->subdevice = timer->tmr_subdevice; } -static int snd_timer_user_next_device (struct snd_timer_id __user *_tid) +static void get_next_device (struct snd_timer_id *id) { -struct snd_timer_id id;struct snd_timer *timer;struct list_head *p; -if (copy_from_user (&id, _tid,sizeof (id))) -return -EFAULT ; -guard (mutex)(®ister_mutex); -if (id.dev_class <0 ) {/* first item */ +if (id->dev_class <0 ) {/* first item */ if (list_empty (&snd_timer_list)) -snd_timer_user_zero_id (&id); +snd_timer_user_zero_id (id);else { timer =list_entry (snd_timer_list.next, struct snd_timer, device_list); -snd_timer_user_copy_id (&id, timer); +snd_timer_user_copy_id (id, timer); } }else { -switch (id.dev_class) { +switch (id->dev_class) {case SNDRV_TIMER_CLASS_GLOBAL : - id.device = id.device <0 ?0 : id.device +1 ; + id->device = id->device <0 ?0 : id->device +1 ;list_for_each (p, &snd_timer_list) { timer = list_entry(p, struct snd_timer, device_list);if (timer->tmr_class >SNDRV_TIMER_CLASS_GLOBAL ) { -snd_timer_user_copy_id (&id, timer); +snd_timer_user_copy_id (id, timer);break ; } -if (timer->tmr_device >= id.device) { -snd_timer_user_copy_id (&id, timer); +if (timer->tmr_device >= id->device) { +snd_timer_user_copy_id (id, timer);break ; } }if (p == &snd_timer_list) -snd_timer_user_zero_id (&id); +snd_timer_user_zero_id (id);break ;case SNDRV_TIMER_CLASS_CARD :case SNDRV_TIMER_CLASS_PCM : -if (id.card <0 ) { - id.card =0 ; +if (id->card <0 ) { + id->card =0 ; }else { -if (id.device <0 ) { - id.device =0 ; +if (id->device <0 ) { + id->device =0 ; }else { -if (id.subdevice <0 ) - id.subdevice =0 ; -else if (id.subdevice <INT_MAX ) - id.subdevice++; +if (id->subdevice <0 ) + id->subdevice =0 ; +else if (id->subdevice <INT_MAX ) + id->subdevice++; } }list_for_each (p, &snd_timer_list) { timer = list_entry(p, struct snd_timer, device_list); -if (timer->tmr_class > id.dev_class) { -snd_timer_user_copy_id (&id, timer); +if (timer->tmr_class > id->dev_class) { +snd_timer_user_copy_id (id, timer);break ; } -if (timer->tmr_class < id.dev_class) +if (timer->tmr_class < id->dev_class)continue ; -if (timer->card->number > id.card) { -snd_timer_user_copy_id (&id, timer); +if (timer->card->number > id->card) { +snd_timer_user_copy_id (id, timer);break ; } -if (timer->card->number < id.card) +if (timer->card->number < id->card)continue ; -if (timer->tmr_device > id.device) { -snd_timer_user_copy_id (&id, timer); +if (timer->tmr_device > id->device) { +snd_timer_user_copy_id (id, timer);break ; } -if (timer->tmr_device < id.device) +if (timer->tmr_device < id->device)continue ; -if (timer->tmr_subdevice > id.subdevice) { -snd_timer_user_copy_id (&id, timer); +if (timer->tmr_subdevice > id->subdevice) { +snd_timer_user_copy_id (id, timer);break ; } -if (timer->tmr_subdevice < id.subdevice) +if (timer->tmr_subdevice < id->subdevice)continue ; -snd_timer_user_copy_id (&id, timer); +snd_timer_user_copy_id (id, timer);break ; }if (p == &snd_timer_list) -snd_timer_user_zero_id (&id); +snd_timer_user_zero_id (id);break ;default : -snd_timer_user_zero_id (&id); +snd_timer_user_zero_id (id); } } +} + +static int snd_timer_user_next_device (struct snd_timer_id __user *_tid) +{ +struct snd_timer_id id; + +if (copy_from_user (&id, _tid,sizeof (id))) +return -EFAULT ; + scoped_guard(mutex, ®ister_mutex) +get_next_device (&id);if (copy_to_user (_tid, &id,sizeof (*_tid)))return -EFAULT ;return 0 ;
@@ -1620,23 +1626,24 @@ static int snd_timer_user_ginfo(struct file *file, tid = ginfo->tid;memset (ginfo,0 ,sizeof (*ginfo)); ginfo->tid = tid; -guard (mutex)(®ister_mutex); - t =snd_timer_find (&tid); -if (!t) -return -ENODEV ; - ginfo->card = t->card ? t->card->number :-1 ; -if (t->hw.flags &SNDRV_TIMER_HW_SLAVE ) - ginfo->flags |=SNDRV_TIMER_FLG_SLAVE ; -strscpy (ginfo->id, t->id,sizeof (ginfo->id)); -strscpy (ginfo->name, t->name,sizeof (ginfo->name)); -scoped_guard (spinlock_irq, &t->lock) - ginfo->resolution = snd_timer_hw_resolution(t); -if (t->hw.resolution_min >0 ) { - ginfo->resolution_min = t->hw.resolution_min; - ginfo->resolution_max = t->hw.resolution_max; - } -list_for_each (p, &t->open_list_head) { - ginfo->clients++; + scoped_guard(mutex, ®ister_mutex) { + t =snd_timer_find (&tid); +if (!t) +return -ENODEV ; + ginfo->card = t->card ? t->card->number :-1 ; +if (t->hw.flags &SNDRV_TIMER_HW_SLAVE ) + ginfo->flags |=SNDRV_TIMER_FLG_SLAVE ; +strscpy (ginfo->id, t->id,sizeof (ginfo->id)); +strscpy (ginfo->name, t->name,sizeof (ginfo->name)); +scoped_guard (spinlock_irq, &t->lock) + ginfo->resolution = snd_timer_hw_resolution(t); +if (t->hw.resolution_min >0 ) { + ginfo->resolution_min = t->hw.resolution_min; + ginfo->resolution_max = t->hw.resolution_max; + } +list_for_each (p, &t->open_list_head) { + ginfo->clients++; + } }if (copy_to_user (_ginfo, ginfo,sizeof (*ginfo)))return -EFAULT ;
@@ -1674,31 +1681,31 @@ static int snd_timer_user_gstatus(struct file *file,struct snd_timer_gstatus gstatus;struct snd_timer_id tid;struct snd_timer *t; -int err =0 ;if (copy_from_user (&gstatus, _gstatus,sizeof (gstatus)))return -EFAULT ; tid = gstatus.tid;memset (&gstatus,0 ,sizeof (gstatus)); gstatus.tid = tid; -guard (mutex)(®ister_mutex); - t =snd_timer_find (&tid); -if (t !=NULL ) { -guard (spinlock_irq)(&t->lock); - gstatus.resolution =snd_timer_hw_resolution (t); -if (t->hw.precise_resolution) { - t->hw.precise_resolution (t, &gstatus.resolution_num, - &gstatus.resolution_den); + scoped_guard(mutex, ®ister_mutex) { + t =snd_timer_find (&tid); +if (t !=NULL ) { +guard (spinlock_irq)(&t->lock); + gstatus.resolution =snd_timer_hw_resolution (t); +if (t->hw.precise_resolution) { + t->hw.precise_resolution (t, &gstatus.resolution_num, + &gstatus.resolution_den); + }else { + gstatus.resolution_num = gstatus.resolution; + gstatus.resolution_den =1000000000uL ; + } }else { - gstatus.resolution_num = gstatus.resolution; - gstatus.resolution_den =1000000000uL ; +return -ENODEV ; } - }else { - err = -ENODEV ; } -if (err >=0 &©_to_user (_gstatus, &gstatus,sizeof (gstatus))) - err = -EFAULT ; -return err; +if (copy_to_user (_gstatus, &gstatus,sizeof (gstatus))) +return -EFAULT ; +return 0 ; } static int snd_timer_user_tselect(struct file *file,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 60/499 drm/bridge: ti-sn65dsi86: Fix multiple instances
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 574f5ee2c85a00a579549d50e9fc9c6c072ee4c4 ]
Each bridge instance creates up to four auxiliary devices with different names. However, their IDs are always zero, causing duplicate filename errors when a system has multiple bridges:
sysfs: cannot create duplicate filename '/bus/auxiliary/devices/ti_sn65dsi86.gpio.0'
Fix this by using a unique instance ID per bridge instance. The instance ID is derived from the I2C adapter number and the bridge's I2C address, to support multiple instances on the same bus.
--- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/bridge/ti-sn65dsi86.c +2 -0
@@ -480,6 +480,7 @@ static int ti_sn65dsi86_add_aux_device(struct ti_sn65dsi86 *pdata, const char *name) {struct device *dev = pdata->dev; +const struct i2c_client *client =to_i2c_client (dev);struct auxiliary_device *aux;int ret;
@@ -488,6 +489,7 @@ static int ti_sn65dsi86_add_aux_device(struct ti_sn65dsi86 *pdata,return -ENOMEM ; aux->name = name; + aux->id = (client->adapter->nr <<10 ) | client->addr; aux->dev.parent = dev; aux->dev.release = ti_sn65dsi86_aux_device_release;device_set_of_node_from_dev (&aux->dev, dev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 61/499 drm/ssd130x: Set SPI .id_table to prevent an SPI core warning
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Martinez Canillas <[email protected]>
[ Upstream commit 5d40d4fae6f2fb789f48207a9d4772bbee970b5c ]
The only reason for the ssd130x-spi driver to have an spi_device_id table is that the SPI core always reports an "spi:" MODALIAS, even when the SPI device has been registered via a Device Tree Blob.
Without spi_device_id table information in the module's metadata, module autoloading would not work because there won't be an alias that matches the MODALIAS reported by the SPI core.
This spi_device_id table is not needed for device matching though, since the of_device_id table is always used in this case. For this reason, the struct spi_driver .id_table member is currently not set in the SPI driver.
Because the spi_device_id table is always required for module autoloading, the SPI core checks during driver registration that both an of_device_id table and a spi_device_id table are present and that they contain the same entries for all the SPI devices.
Not setting the .id_table member in the driver then confuses the core and leads to the following warning when the ssd130x-spi driver is registered:
[ 41.091198] SPI driver ssd130x-spi has no spi_device_id for sinowealth,sh1106 [ 41.098614] SPI driver ssd130x-spi has no spi_device_id for solomon,ssd1305 [ 41.105862] SPI driver ssd130x-spi has no spi_device_id for solomon,ssd1306 [ 41.113062] SPI driver ssd130x-spi has no spi_device_id for solomon,ssd1307 [ 41.120247] SPI driver ssd130x-spi has no spi_device_id for solomon,ssd1309 [ 41.127449] SPI driver ssd130x-spi has no spi_device_id for solomon,ssd1322 [ 41.134627] SPI driver ssd130x-spi has no spi_device_id for solomon,ssd1325 [ 41.141784] SPI driver ssd130x-spi has no spi_device_id for solomon,ssd1327 [ 41.149021] SPI driver ssd130x-spi has no spi_device_id for solomon,ssd1331
To prevent the warning, set the .id_table even though it's not necessary.
Since the check is done even for built-in drivers, drop the condition to only define the ID table when the driver is built as a module. Finally, rename the variable to use the "_spi_id" convention used for ID tables.
--- drivers/gpu/drm/solomon/ssd130x-spi.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/gpu/drm/solomon/ssd130x-spi.c +3 -4
@@ -151,7 +151,6 @@ static const struct of_device_id ssd130x_of_match[] = { };MODULE_DEVICE_TABLE (of, ssd130x_of_match); -#if IS_MODULE (CONFIG_DRM_SSD130X_SPI )/* * The SPI core always reports a MODALIAS uevent of the form "spi:<dev>", even * if the device was registered via OF. This means that the module will not be
@@ -160,7 +159,7 @@ MODULE_DEVICE_TABLE(of, ssd130x_of_match);* To workaround this issue, add a SPI device ID table. Even when this should * not be needed for this driver to match the registered SPI devices. */ -static const struct spi_device_id ssd130x_spi_table[] = { +static const struct spi_device_id ssd130x_spi_id[] = {/* ssd130x family */ {"sh1106" ,SH1106_ID }, {"ssd1305" ,SSD1305_ID },
@@ -175,14 +174,14 @@ static const struct spi_device_id ssd130x_spi_table[] = { { "ssd1331", SSD1331_ID }, {/* sentinel */ } }; -MODULE_DEVICE_TABLE (spi, ssd130x_spi_table); -#endif +MODULE_DEVICE_TABLE (spi, ssd130x_spi_id);static struct spi_driver ssd130x_spi_driver = { .driver = { .name =DRIVER_NAME , .of_match_table = ssd130x_of_match, }, + .id_table = ssd130x_spi_id, .probe = ssd130x_spi_probe, .remove = ssd130x_spi_remove, .shutdown = ssd130x_spi_shutdown,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 62/499 drm/ssd130x: fix ssd132x encoding
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <[email protected]>
[ Upstream commit 1e14484677c8e87548f5f0d4eb8800e408004404 ]
The ssd132x buffer is encoded one pixel per nibble, with two pixels in each byte. When encoding an 8-bit greyscale input, take the top 4-bits as the value and ensure the two pixels are distinct and do not overwrite each other.
--- drivers/gpu/drm/solomon/ssd130x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/solomon/ssd130x.c +1 -1
@@ -881,7 +881,7 @@ static int ssd132x_update_rect(struct ssd130x_device *ssd130x,u8 n1 = buf[i * width + j];u8 n2 = buf[i * width + j +1 ]; - data_array[array_idx++] = (n2 <<4 ) | n1; + data_array[array_idx++] = (n2 &0xf0 ) | (n1 >>4 ); } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 63/499 drm/ssd130x: ensure ssd132x pitch is correct
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <[email protected]>
[ Upstream commit 229adcffdb54b13332d2afd2dc5d203418d50908 ]
The bounding rectangle is adjusted to ensure it aligns to SSD132X_SEGMENT_WIDTH, which may adjust the pitch. Calculate the pitch after aligning the left and right edge.
--- drivers/gpu/drm/solomon/ssd130x.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/solomon/ssd130x.c +3 -1
@@ -1038,7 +1038,7 @@ static int ssd132x_fb_blit_rect(struct drm_framebuffer *fb, struct drm_format_conv_state *fmtcnv_state) {struct ssd130x_device *ssd130x =drm_to_ssd130x (fb->dev); -unsigned int dst_pitch =drm_rect_width (rect); +unsigned int dst_pitch;struct iosys_map dst;int ret =0 ;
@@ -1047,6 +1047,8 @@ static int ssd132x_fb_blit_rect(struct drm_framebuffer *fb, rect->x2 = min_t(unsigned int, round_up(rect->x2, SSD132X_SEGMENT_WIDTH), ssd130x->width); + dst_pitch =drm_rect_width (rect); + ret =drm_gem_fb_begin_cpu_access (fb,DMA_FROM_DEVICE );if (ret)return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 64/499 drm/dp_mst: Fix drm RAD print
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Lin <[email protected]>
[ Upstream commit 6bbce873a9c97cb12f5455c497be279ac58e707f ]
[Why]
The RAD of sideband message printed today is incorrect.
For RAD stored within MST branch
- If MST branch LCT is 1, it's RAD array is untouched and remained as 0.
- If MST branch LCT is larger than 1, use nibble to store the up facing port number in cascaded sequence as illustrated below:
u8 RAD[0] = (LCT_2_UFP << 4) | LCT_3_UFP
RAD[1] = (LCT_4_UFP << 4) | LCT_5_UFP
...In drm_dp_mst_rad_to_str(), it wrongly to use BIT_MASK(4) to fetch the port number of one nibble.
[How]
Adjust the code by:
- RAD array items are valuable only for LCT >= 1.
- Use 0xF as the mask to replace BIT_MASK(4)
V2:
- Document how RAD is constructed (Imre)
V3:
- Adjust the comment for rad[] so kdoc formats it properly (Lyude)
--- drivers/gpu/drm/display/drm_dp_mst_topology.c | 8 ++++---- include/drm/display/drm_dp_mst_helper.h | 7 +++++++ 2 files changed, 11 insertions(+), 4 deletions(-)
drivers/gpu/drm/display/drm_dp_mst_topology.c +4 -4
@@ -179,13 +179,13 @@ static int drm_dp_mst_rad_to_str(const u8 rad[8], u8 lct, char *out, size_t len) { int i; -u8 unpacked_rad[16 ]; +u8 unpacked_rad[16 ] = {}; -for (i =0 ; i < lct; i++) { +for (i =1 ; i < lct; i++) {if (i %2 ) - unpacked_rad[i] = rad[i /2 ] >>4 ; + unpacked_rad[i] = rad[(i -1 ) /2 ] >>4 ;else - unpacked_rad[i] = rad[i /2 ] &BIT_MASK (4 ); + unpacked_rad[i] = rad[(i -1 ) /2 ] &0xF ; }/* TODO: Eventually add something to printk so we can format the rad
include/drm/display/drm_dp_mst_helper.h +7 -0
@@ -222,6 +222,13 @@ struct drm_dp_mst_branch {*/ struct list_head destroy_next; +/** +* @rad: Relative Address of the MST branch. +* For &drm_dp_mst_topology_mgr.mst_primary, it's rad[8] are all 0, +* unset and unused. For MST branches connected after mst_primary, +* in each element of rad[] the nibbles are ordered by the most +* signifcant 4 bits first and the least significant 4 bits second. +*/ u8 rad[8 ];u8 lct;int num_ports;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/499 drm/bridge: it6505: fix HDCP V match check is not performed correctly
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hermes Wu <[email protected]>
[ Upstream commit a5072fc77fb9e38fa9fd883642c83c3720049159 ]
Fix a typo where V compare incorrectly compares av[] with av[] itself, which can result in HDCP failure.
The loop of V compare is expected to iterate for 5 times which compare V array form av[0][] to av[4][].
It should check loop counter reach the last statement "i == 5" before return true
--- drivers/gpu/drm/bridge/ite-it6505.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/gpu/drm/bridge/ite-it6505.c +4 -3
@@ -2042,12 +2042,13 @@ static bool it6505_hdcp_part2_ksvlist_check(struct it6505 *it6505)continue ; } -for (i =0 ; i <5 ; i++) { +for (i =0 ; i <5 ; i++)if (bv[i][3 ] != av[i][0 ] || bv[i][2 ] != av[i][1 ] || - av[i][1 ] != av[i][2 ] || bv[i][0 ] != av[i][3 ]) + bv[i][1 ] != av[i][2 ] || bv[i][0 ] != av[i][3 ])break ; -DRM_DEV_DEBUG_DRIVER (dev,"V' all match!! %d, %d" , retry, i); +if (i ==5 ) { +DRM_DEV_DEBUG_DRIVER (dev,"V' all match!! %d" , retry);return true; } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/499 drm/panthor: Fix race condition when gathering fdinfo group samples
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrián Larumbe <[email protected]>
[ Upstream commit 0590c94c3596d6c1a3d549ae611366f2ad4e1d8d ]
Commit e16635d88fa0 ("drm/panthor: add DRM fdinfo support") failed to protect access to groups with an xarray lock, which could lead to use-after-free errors.
--- drivers/gpu/drm/panthor/panthor_sched.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/panthor/panthor_sched.c +2 -0
@@ -2862,6 +2862,7 @@ void panthor_fdinfo_gather_group_samples(struct panthor_file *pfile)if (IS_ERR_OR_NULL (gpool))return ; +xa_lock (&gpool->xa);xa_for_each (&gpool->xa, i, group) {mutex_lock (&group->fdinfo.lock); pfile->stats.cycles += group->fdinfo.data.cycles;
@@ -2870,6 +2871,7 @@ void panthor_fdinfo_gather_group_samples(struct panthor_file *pfile) group->fdinfo.data.time =0 ;mutex_unlock (&group->fdinfo.lock); } +xa_unlock (&gpool->xa); }static void group_sync_upd_work (struct work_struct *work)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/499 drm: xlnx: zynqmp: Fix max dma segment size
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 28b529a98525123acd37372a04d21e87ec2edcf7 ]
Fix "mapping sg segment longer than device claims to support" warning by setting the max segment size.
--- drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/xlnx/zynqmp_dpsub.c +2 -0
@@ -231,6 +231,8 @@ static int zynqmp_dpsub_probe(struct platform_device *pdev)if (ret)return ret; +dma_set_max_seg_size (&pdev->dev,DMA_BIT_MASK (32 )); +/* Try the reserved memory. Proceed if there's none. */ of_reserved_mem_device_init (&pdev->dev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/499 drm: zynqmp_dp: Fix a deadlock in zynqmp_dp_ignore_hpd_set()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
[ Upstream commit f887685ee0eb4ef716391355568181230338f6eb ]
Instead of attempting the same mutex twice, lock and unlock it.
This bug has been detected by the Clang thread-safety analyzer.
--- drivers/gpu/drm/xlnx/zynqmp_dp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xlnx/zynqmp_dp.c +1 -1
@@ -2272,7 +2272,7 @@ static int zynqmp_dp_ignore_hpd_set(void *data, u64 val)mutex_lock (&dp->lock); dp->ignore_hpd = val; -mutex_lock (&dp->lock); +mutex_unlock (&dp->lock);return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/499 drm/vkms: Fix use after free and double free on init error
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: José Expósito <[email protected]>
[ Upstream commit ed15511a773df86205bda66c37193569575ae828 ]
If the driver initialization fails, the vkms_exit() function might access an uninitialized or freed default_config pointer and it might double free it.
Fix both possible errors by initializing default_config only when the driver initialization succeeded.
--- drivers/gpu/drm/vkms/vkms_drv.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/gpu/drm/vkms/vkms_drv.c +9 -6
@@ -247,17 +247,19 @@ static int __init vkms_init(void)if (!config)return -ENOMEM ; - default_config = config; - config->cursor = enable_cursor; config->writeback = enable_writeback; config->overlay = enable_overlay; ret =vkms_create (config); -if (ret) +if (ret) {kfree (config); +return ret; + } -return ret; + default_config = config; + +return 0 ; }static void vkms_destroy (struct vkms_config *config)
@@ -281,9 +283,10 @@ static void vkms_destroy(struct vkms_config *config) static void __exit vkms_exit(void) { -if (default_config->dev) -vkms_destroy (default_config); +if (!default_config) +return ; +vkms_destroy (default_config);kfree (default_config); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 70/499 gpu: cdns-mhdp8546: fix call balance of mhdp->clk handling routines
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitalii Mordan <[email protected]>
[ Upstream commit f65727be3fa5f252c8d982d15023aab8255ded19 ]
If the clock mhdp->clk was not enabled in cdns_mhdp_probe(), it should not be disabled in any path.
The return value of clk_prepare_enable() is not checked. If mhdp->clk was not enabled, it may be disabled in the error path of cdns_mhdp_probe() (e.g., if cdns_mhdp_load_firmware() fails) or in cdns_mhdp_remove() after a successful cdns_mhdp_probe() call.
Use the devm_clk_get_enabled() helper function to ensure proper call balance for mhdp->clk.
Found by Linux Verification Center (linuxtesting.org) with Klever.
--- drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-)
drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +3 -9
@@ -2463,9 +2463,9 @@ static int cdns_mhdp_probe(struct platform_device *pdev)if (!mhdp)return -ENOMEM ; - clk =devm_clk_get (dev,NULL ); + clk =devm_clk_get_enabled (dev,NULL );if (IS_ERR (clk)) { -dev_err (dev,"couldn't get clk: %ld\n" ,PTR_ERR (clk)); +dev_err (dev,"couldn't get and enable clk: %ld\n" ,PTR_ERR (clk));return PTR_ERR (clk); }
@@ -2504,14 +2504,12 @@ static int cdns_mhdp_probe(struct platform_device *pdev) mhdp->info =of_device_get_match_data (dev); -clk_prepare_enable (clk); -pm_runtime_enable (dev); ret =pm_runtime_resume_and_get (dev);if (ret <0 ) {dev_err (dev,"pm_runtime_resume_and_get failed\n" );pm_runtime_disable (dev); - goto clk_disable; +return ret; }if (mhdp->info && mhdp->info->ops && mhdp->info->ops->init) {
@@ -2590,8 +2588,6 @@ static int cdns_mhdp_probe(struct platform_device *pdev) runtime_put:pm_runtime_put_sync (dev);pm_runtime_disable (dev); -clk_disable: -clk_disable_unprepare (mhdp->clk);return ret; }
@@ -2632,8 +2628,6 @@ static void cdns_mhdp_remove(struct platform_device *pdev)cancel_work_sync (&mhdp->modeset_retry_work);flush_work (&mhdp->hpd_work);/* Ignoring mhdp->hdcp.check_work and mhdp->hdcp.prop_work here. */ - -clk_disable_unprepare (mhdp->clk); }static const struct of_device_id mhdp_ids[] = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/499 drm/amdgpu: refine smu send msg debug log format
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
[ Upstream commit 8c6631234557515a7567c6251505a98e9793c8a6 ]
remove unnecessary line breaks.
[ 51.280860] amdgpu 0000:24:00.0: amdgpu: smu send message: GetEnabledSmuFeaturesHigh(13) param: 0x00000000, resp: 0x00000001, readval: 0x00003763
--- drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c +1 -2
@@ -459,8 +459,7 @@ int smu_cmn_send_smc_msg_with_param(struct smu_context *smu, }if (read_arg) {smu_cmn_read_arg (smu, read_arg); -dev_dbg (adev->dev,"smu send message: %s(%d) param: 0x%08x, resp: 0x%08x,\ -readval: 0x%08x\n" , +dev_dbg (adev->dev,"smu send message: %s(%d) param: 0x%08x, resp: 0x%08x, readval: 0x%08x\n" ,smu_get_message_name (smu, msg), index, param, reg, *read_arg); }else { dev_dbg(adev->dev, "smu send message: %s(%d) param: 0x%08x, resp: 0x%08x\n",
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/499 drm/amdgpu/umsch: fix ucode check
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit c917e39cbdcd9fff421184db6cc461cc58d52c17 ]
Return an error if the IP version doesn't match otherwise we end up passing a NULL string to amdgpu_ucode_request. We should never hit this in practice today since we only enable the umsch code on the supported IP versions, but add a check to be safe.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_umsch_mm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_umsch_mm.c +1 -1
@@ -584,7 +584,7 @@ int amdgpu_umsch_mm_init_microcode(struct amdgpu_umsch_mm *umsch) fw_name ="amdgpu/umsch_mm_4_0_0.bin" ;break ;default : -break ; +return -EINVAL ; } r =amdgpu_ucode_request (adev, &adev->umsch_mm.fw,"%s" , fw_name);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/499 PCI: Use downstream bridges for distributing resources
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <[email protected]>
[ Upstream commit 1a596ad00ffe9b37fc60a93cbdd4daead3bf95f3 ]
7180c1d08639 ("PCI: Distribute available resources for root buses, too") breaks BAR assignment on some devices:
pci 0006:03:00.0: BAR 0 [mem 0x6300c0000000-0x6300c1ffffff 64bit pref]: assigned pci 0006:03:00.1: BAR 0 [mem 0x6300c2000000-0x6300c3ffffff 64bit pref]: assigned pci 0006:03:00.2: BAR 0 [mem size 0x00800000 64bit pref]: can't assign; no space pci 0006:03:00.0: VF BAR 0 [mem size 0x02000000 64bit pref]: can't assign; no space pci 0006:03:00.1: VF BAR 0 [mem size 0x02000000 64bit pref]: can't assign; no space
The apertures of domain 0006 before 7180c1d08639:
6300c0000000-63ffffffffff : PCI Bus 0006:00
6300c0000000-6300c9ffffff : PCI Bus 0006:01
6300c0000000-6300c9ffffff : PCI Bus 0006:02 # 160MB
6300c0000000-6300c8ffffff : PCI Bus 0006:03 # 144MB
6300c0000000-6300c1ffffff : 0006:03:00.0 # 32MB
6300c2000000-6300c3ffffff : 0006:03:00.1 # 32MB
6300c4000000-6300c47fffff : 0006:03:00.2 # 8MB
6300c4800000-6300c67fffff : 0006:03:00.0 # 32MB
6300c6800000-6300c87fffff : 0006:03:00.1 # 32MB
6300c9000000-6300c9bfffff : PCI Bus 0006:04 # 12MB
6300c9000000-6300c9bfffff : PCI Bus 0006:05 # 12MB
6300c9000000-6300c91fffff : PCI Bus 0006:06 # 2MB
6300c9200000-6300c93fffff : PCI Bus 0006:07 # 2MB
6300c9400000-6300c95fffff : PCI Bus 0006:08 # 2MB
6300c9600000-6300c97fffff : PCI Bus 0006:09 # 2MBAfter 7180c1d08639:
6300c0000000-63ffffffffff : PCI Bus 0006:00
6300c0000000-6300c9ffffff : PCI Bus 0006:01
6300c0000000-6300c9ffffff : PCI Bus 0006:02 # 160MB
6300c0000000-6300c43fffff : PCI Bus 0006:03 # 68MB
6300c0000000-6300c1ffffff : 0006:03:00.0 # 32MB
6300c2000000-6300c3ffffff : 0006:03:00.1 # 32MB
--- no space --- : 0006:03:00.2 # 8MB
--- no space --- : 0006:03:00.0 # 32MB
--- no space --- : 0006:03:00.1 # 32MB
6300c4400000-6300c4dfffff : PCI Bus 0006:04 # 10MB
6300c4400000-6300c4dfffff : PCI Bus 0006:05 # 10MB
6300c4400000-6300c45fffff : PCI Bus 0006:06 # 2MB
6300c4600000-6300c47fffff : PCI Bus 0006:07 # 2MB
6300c4800000-6300c49fffff : PCI Bus 0006:08 # 2MB
6300c4a00000-6300c4bfffff : PCI Bus 0006:09 # 2MBWe can see that the window to 0006:03 gets shrunken too much and 0006:04 eats away the window for 0006:03:00.2.
The offending commit distributes the upstream bridge's resources multiple times to every downstream bridge, hence makes the aperture smaller than desired because calculation of io_per_b, mmio_per_b and mmio_pref_per_b becomes incorrect.
Instead, distribute downstream bridges' own resources to resolve the issue.
--- drivers/pci/setup-bus.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/pci/setup-bus.c +1 -2
@@ -2102,8 +2102,7 @@ pci_root_bus_distribute_available_resources(struct pci_bus *bus,* in case of root bus. */ if (bridge &&pci_bridge_resources_not_assigned (dev)) -pci_bridge_distribute_available_resources (bridge, - add_list); +pci_bridge_distribute_available_resources (dev, add_list);else pci_root_bus_distribute_available_resources (b, add_list); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/499 PCI: Remove add_align overwrite unrelated to size0
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit d06cc1e3809040e8250f69a4c656e3717e6b963c ]
Commit 566f1dd52816 ("PCI: Relax bridge window tail sizing rules") relaxed bridge window tail alignment rule for the non-optional part (size0, no add_size/add_align). The change, however, also overwrote add_align, which is only related to case where optional size1 related entry is added into realloc head.
Correct this by removing the add_align overwrite.
--- drivers/pci/setup-bus.c | 1 - 1 file changed, 1 deletion(-)
drivers/pci/setup-bus.c +0 -1
@@ -1149,7 +1149,6 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask, min_align =1ULL << (max_order +__ffs (SZ_1M )); min_align =max (min_align, win_align); size0 =calculate_memsize (size, min_size,0 ,0 ,resource_size (b_res), win_align); - add_align = win_align;pci_info (bus->self,"bridge window %pR to %pR requires relaxed alignment rules\n" , b_res, &bus->busn_res); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/499 drm/mediatek: mtk_hdmi: Unregister audio platform device on failure
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 0be123cafc06eed0fd1227166a66e786434b0c50 ]
The probe function of this driver may fail after registering the audio platform device: in that case, the state is not getting cleaned up, leaving this device registered.
Adding up to the mix, should the probe function of this driver return a probe deferral for N times, we're registering up to N audio platform devices and, again, never freeing them up.
To fix this, add a pointer to the audio platform device in the mtk_hdmi structure, and add a devm action to unregister it upon driver removal or probe failure.
--- drivers/gpu/drm/mediatek/mtk_hdmi.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-)
drivers/gpu/drm/mediatek/mtk_hdmi.c +19 -6
@@ -173,6 +173,7 @@ struct mtk_hdmi {unsigned int sys_offset;void __iomem *regs;enum hdmi_colorspace csp; +struct platform_device *audio_pdev;struct hdmi_audio_param aud_param;bool audio_enable;bool powered;
@@ -1663,6 +1664,11 @@ static const struct hdmi_codec_ops mtk_hdmi_audio_codec_ops = { .no_capture_mute = 1, }; +static void mtk_hdmi_unregister_audio_driver (void *data) +{ +platform_device_unregister (data); +} +static int mtk_hdmi_register_audio_driver (struct device *dev) {struct mtk_hdmi *hdmi =dev_get_drvdata (dev);
@@ -1672,13 +1678,20 @@ static int mtk_hdmi_register_audio_driver(struct device *dev) .i2s = 1, .data = hdmi, }; -struct platform_device *pdev; +int ret; - pdev =platform_device_register_data (dev,HDMI_CODEC_DRV_NAME , -PLATFORM_DEVID_AUTO , &codec_data, -sizeof (codec_data)); -if (IS_ERR (pdev)) -return PTR_ERR (pdev); + hdmi->audio_pdev =platform_device_register_data (dev, +HDMI_CODEC_DRV_NAME , +PLATFORM_DEVID_AUTO , + &codec_data, +sizeof (codec_data)); +if (IS_ERR (hdmi->audio_pdev)) +return PTR_ERR (hdmi->audio_pdev); + + ret =devm_add_action_or_reset (dev, mtk_hdmi_unregister_audio_driver, + hdmi->audio_pdev); +if (ret) +return ret;DRM_INFO ("%s driver bound to HDMI\n" ,HDMI_CODEC_DRV_NAME );return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/499 drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 72fcb88e7bbc053ed4fc74cebb0315b98a0f20c3 ]
Rename member aud_sampe_size of struct hdmi_audio_param to aud_sample_size to fix a typo and enhance readability.
This commit brings no functional changes.
--- drivers/gpu/drm/mediatek/mtk_hdmi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/mediatek/mtk_hdmi.c +4 -4
@@ -137,7 +137,7 @@ enum hdmi_aud_channel_swap_type {struct hdmi_audio_param {enum hdmi_audio_coding_type aud_codec; -enum hdmi_audio_sample_size aud_sampe_size; +enum hdmi_audio_sample_size aud_sample_size;enum hdmi_aud_input_type aud_input_type;enum hdmi_aud_i2s_fmt aud_i2s_fmt;enum hdmi_aud_mclk aud_mclk;
@@ -1075,7 +1075,7 @@ static int mtk_hdmi_output_init(struct mtk_hdmi *hdmi) hdmi->csp =HDMI_COLORSPACE_RGB ; aud_param->aud_codec =HDMI_AUDIO_CODING_TYPE_PCM ; - aud_param->aud_sampe_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; + aud_param->aud_sample_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; aud_param->aud_input_type =HDMI_AUD_INPUT_I2S ; aud_param->aud_i2s_fmt =HDMI_I2S_MODE_I2S_24BIT ; aud_param->aud_mclk =HDMI_AUD_MCLK_128FS ;
@@ -1573,14 +1573,14 @@ static int mtk_hdmi_audio_hw_params(struct device *dev, void *data,switch (daifmt->fmt) {case HDMI_I2S : hdmi_params.aud_codec =HDMI_AUDIO_CODING_TYPE_PCM ; - hdmi_params.aud_sampe_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; + hdmi_params.aud_sample_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; hdmi_params.aud_input_type =HDMI_AUD_INPUT_I2S ; hdmi_params.aud_i2s_fmt =HDMI_I2S_MODE_I2S_24BIT ; hdmi_params.aud_mclk =HDMI_AUD_MCLK_128FS ;break ;case HDMI_SPDIF : hdmi_params.aud_codec =HDMI_AUDIO_CODING_TYPE_PCM ; - hdmi_params.aud_sampe_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; + hdmi_params.aud_sample_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; hdmi_params.aud_input_type =HDMI_AUD_INPUT_SPDIF ;break ;default :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/499 drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit dc0297f3198bd60108ccbd167ee5d9fa4af31ed0 ]
RLCG Register Access is a way for virtual functions to safely access GPU registers in a virtualized environment., including TLB flushes and register reads. When multiple threads or VFs try to access the same registers simultaneously, it can lead to race conditions. By using the RLCG interface, the driver can serialize access to the registers. This means that only one thread can access the registers at a time, preventing conflicts and ensuring that operations are performed correctly. Additionally, when a low-priority task holds a mutex that a high-priority task needs, ie., If a thread holding a spinlock tries to acquire a mutex, it can lead to priority inversion. register access in amdgpu_virt_rlcg_reg_rw especially in a fast code path is critical.
The call stack shows that the function amdgpu_virt_rlcg_reg_rw is being called, which attempts to acquire the mutex. This function is invoked from amdgpu_sriov_wreg, which in turn is called from gmc_v11_0_flush_gpu_tlb.
The [ BUG: Invalid wait context ] indicates that a thread is trying to acquire a mutex while it is in a context that does not allow it to sleep (like holding a spinlock).
Fixes the below:
[ 253.013423] =============================
[ 253.013434] [ BUG: Invalid wait context ]
[ 253.013446] 6.12.0-amdstaging-drm-next-lol-050225 #14 Tainted: G U OE
[ 253.013464] -----------------------------
[ 253.013475] kworker/0:1/10 is trying to lock:
[ 253.013487] ffff9f30542e3cf8 (&adev->virt.rlcg_reg_lock){+.+.}-{3:3}, at: amdgpu_virt_rlcg_reg_rw+0xf6/0x330 [amdgpu]
[ 253.013815] other info that might help us debug this:
[ 253.013827] context-{4:4}
[ 253.013835] 3 locks held by kworker/0:1/10:
[ 253.013847] #0: ffff9f3040050f58 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x3f5/0x680
[ 253.013877] #1: ffffb789c008be40 ((work_completion)(&wfc.work)){+.+.}-{0:0}, at: process_one_work+0x1d6/0x680
[ 253.013905] #2: ffff9f3054281838 (&adev->gmc.invalidate_lock){+.+.}-{2:2}, at: gmc_v11_0_flush_gpu_tlb+0x198/0x4f0 [amdgpu]
[ 253.014154] stack backtrace:
[ 253.014164] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Tainted: G U OE 6.12.0-amdstaging-drm-next-lol-050225 #14
[ 253.014189] Tainted: [U]=USER, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[ 253.014203] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 11/18/2024
[ 253.014224] Workqueue: events work_for_cpu_fn
[ 253.014241] Call Trace:
[ 253.014250] <TASK>
[ 253.014260] dump_stack_lvl+0x9b/0xf0
[ 253.014275] dump_stack+0x10/0x20
[ 253.014287] __lock_acquire+0xa47/0x2810
[ 253.014303] ? srso_alias_return_thunk+0x5/0xfbef5
[ 253.014321] lock_acquire+0xd1/0x300
[ 253.014333] ? amdgpu_virt_rlcg_reg_rw+0xf6/0x330 [amdgpu]
[ 253.014562] ? __lock_acquire+0xa6b/0x2810
[ 253.014578] __mutex_lock+0x85/0xe20
[ 253.014591] ? amdgpu_virt_rlcg_reg_rw+0xf6/0x330 [amdgpu]
[ 253.014782] ? sched_clock_noinstr+0x9/0x10
[ 253.014795] ? srso_alias_return_thunk+0x5/0xfbef5
[ 253.014808] ? local_clock_noinstr+0xe/0xc0
[ 253.014822] ? amdgpu_virt_rlcg_reg_rw+0xf6/0x330 [amdgpu]
[ 253.015012] ? srso_alias_return_thunk+0x5/0xfbef5
[ 253.015029] mutex_lock_nested+0x1b/0x30
[ 253.015044] ? mutex_lock_nested+0x1b/0x30
[ 253.015057] amdgpu_virt_rlcg_reg_rw+0xf6/0x330 [amdgpu]
[ 253.015249] amdgpu_sriov_wreg+0xc5/0xd0 [amdgpu]
[ 253.015435] gmc_v11_0_flush_gpu_tlb+0x44b/0x4f0 [amdgpu]
[ 253.015667] gfx_v11_0_hw_init+0x499/0x29c0 [amdgpu]
[ 253.015901] ? __pfx_smu_v13_0_update_pcie_parameters+0x10/0x10 [amdgpu]
[ 253.016159] ? srso_alias_return_thunk+0x5/0xfbef5
[ 253.016173] ? smu_hw_init+0x18d/0x300 [amdgpu]
[ 253.016403] amdgpu_device_init+0x29ad/0x36a0 [amdgpu]
[ 253.016614] amdgpu_driver_load_kms+0x1a/0xc0 [amdgpu]
[ 253.017057] amdgpu_pci_probe+0x1c2/0x660 [amdgpu]
[ 253.017493] local_pci_probe+0x4b/0xb0
[ 253.017746] work_for_cpu_fn+0x1a/0x30
[ 253.017995] process_one_work+0x21e/0x680
[ 253.018248] worker_thread+0x190/0x330
[ 253.018500] ? __pfx_worker_thread+0x10/0x10
[ 253.018746] kthread+0xe7/0x120
[ 253.018988] ? __pfx_kthread+0x10/0x10
[ 253.019231] ret_from_fork+0x3c/0x60
[ 253.019468] ? __pfx_kthread+0x10/0x10
[ 253.019701] ret_from_fork_asm+0x1a/0x30
[ 253.019939] </TASK>v2: s/spin_trylock/spin_lock_irqsave to be safe (Christian).
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 5 +++-- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 3 ++- 3 files changed, 6 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +1 -1
@@ -4219,7 +4219,6 @@ int amdgpu_device_init(struct amdgpu_device *adev,mutex_init (&adev->grbm_idx_mutex);mutex_init (&adev->mn_lock);mutex_init (&adev->virt.vf_errors.lock); -mutex_init (&adev->virt.rlcg_reg_lock);hash_init (adev->mn_hash);mutex_init (&adev->psp.mutex);mutex_init (&adev->notifier_lock);
@@ -4245,6 +4244,7 @@ int amdgpu_device_init(struct amdgpu_device *adev,spin_lock_init (&adev->se_cac_idx_lock);spin_lock_init (&adev->audio_endpt_idx_lock);spin_lock_init (&adev->mm_stats.lock); +spin_lock_init (&adev->virt.rlcg_reg_lock);spin_lock_init (&adev->wb.lock);INIT_LIST_HEAD (&adev->reset_list);
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +3 -2
@@ -1017,6 +1017,7 @@ u32 amdgpu_virt_rlcg_reg_rw(struct amdgpu_device *adev, u32 offset, u32 v, u32 fvoid *scratch_reg2;void *scratch_reg3;void *spare_int; +unsigned long flags;if (!adev->gfx.rlc.rlcg_reg_access_supported) { dev_err(adev->dev,
@@ -1038,7 +1039,7 @@ u32 amdgpu_virt_rlcg_reg_rw(struct amdgpu_device *adev, u32 offset, u32 v, u32 f scratch_reg2 = (void __iomem *)adev->rmmio +4 * reg_access_ctrl->scratch_reg2; scratch_reg3 = (void __iomem *)adev->rmmio +4 * reg_access_ctrl->scratch_reg3; -mutex_lock (&adev->virt.rlcg_reg_lock); +spin_lock_irqsave (&adev->virt.rlcg_reg_lock, flags);if (reg_access_ctrl->spare_int) spare_int = (void __iomem *)adev->rmmio +4 * reg_access_ctrl->spare_int;
@@ -1097,7 +1098,7 @@ u32 amdgpu_virt_rlcg_reg_rw(struct amdgpu_device *adev, u32 offset, u32 v, u32 f ret =readl (scratch_reg0); -mutex_unlock (&adev->virt.rlcg_reg_lock); +spin_unlock_irqrestore (&adev->virt.rlcg_reg_lock, flags);return ret; }
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h +2 -1
@@ -279,7 +279,8 @@ struct amdgpu_virt {/* the ucode id to signal the autoload */ uint32_t autoload_ucode_id; -struct mutex rlcg_reg_lock; +/* Spinlock to protect access to the RLCG register interface */ +spinlock_t rlcg_reg_lock;union amd_sriov_ras_caps ras_en_caps;union amd_sriov_ras_caps ras_telemetry_en_caps;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/499 PCI/ASPM: Fix link state exit during switch upstream function removal
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Stodden <[email protected]>
[ Upstream commit cbf937dcadfd571a434f8074d057b32cd14fbea5 ]
Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free"), we would free the ASPM link only after the last function on the bus pertaining to the given link was removed.
That was too late. If function 0 is removed before sibling function, link->downstream would point to free'd memory after.
After above change, we freed the ASPM parent link state upon any function removal on the bus pertaining to a given link.
That is too early. If the link is to a PCIe switch with MFD on the upstream port, then removing functions other than 0 first would free a link which still remains parent_link to the remaining downstream ports.
The resulting GPFs are especially frequent during hot-unplug, because pciehp removes devices on the link bus in reverse order.
On that switch, function 0 is the virtual P2P bridge to the internal bus. Free exactly when function 0 is removed -- before the parent link is obsolete, but after all subordinate links are gone.
--- drivers/pci/pcie/aspm.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/pci/pcie/aspm.c +9 -8
@@ -1250,16 +1250,16 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) parent_link = link->parent;/* -* link->downstream is a pointer to the pci_dev of function 0. If -* we remove that function, the pci_dev is about to be deallocated, -* so we can't use link->downstream again. Free the link state to -* avoid this. +* Free the parent link state, no later than function 0 (i.e. +* link->downstream) being removed. * -* If we're removing a non-0 function, it's possible we could -* retain the link state, but PCIe r6.0, sec 7.5.3.7, recommends -* programming the same ASPM Control value for all functions of -* multi-function devices, so disable ASPM for all of them. +* Do not free the link state any earlier. If function 0 is a +* switch upstream port, this link state is parent_link to all +* subordinate ones. */ +if (pdev != link->downstream) + goto out; +pcie_config_aspm_link (link,0 );list_del (&link->sibling);free_link_state (link);
@@ -1270,6 +1270,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev)pcie_config_aspm_path (parent_link); } + out:mutex_unlock (&aspm_lock);up_read (&pci_bus_sem); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/499 drm/panel: ilitek-ili9882t: fix GPIO name in error message
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <[email protected]>
[ Upstream commit 4ce2c7e201c265df1c62a9190a98a98803208b8f ]
This driver uses the enable-gpios property and it is confusing that the error message refers to reset-gpios. Use the correct name when the enable GPIO is not found.
--- drivers/gpu/drm/panel/panel-ilitek-ili9882t.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/panel/panel-ilitek-ili9882t.c +1 -1
@@ -607,7 +607,7 @@ static int ili9882t_add(struct ili9882t *ili) ili->enable_gpio =devm_gpiod_get (dev,"enable" ,GPIOD_OUT_LOW );if (IS_ERR (ili->enable_gpio)) { -dev_err (dev,"cannot get reset-gpios %ld\n" , +dev_err (dev,"cannot get enable-gpios %ld\n" ,PTR_ERR (ili->enable_gpio));return PTR_ERR (ili->enable_gpio); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/499 PCI/ACS: Fix pci=config_acs= parameter
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tushar Dave <[email protected]>
[ Upstream commit 9cf8a952d57b422d3ff8a9a0163f8adf694f4b2b ]
Commit 47c8846a49ba ("PCI: Extend ACS configurability") introduced bugs that fail to configure ACS ctrl to the value specified by the kernel parameter. Essentially there are two bugs:
1) When ACS is configured for multiple PCI devices using 'config_acs' kernel parameter, it results into error "PCI: Can't parse ACS command line parameter". This is due to a bug that doesn't preserve the ACS mask, but instead overwrites the mask with value 0.
For example, using 'config_acs' to configure ACS ctrl for multiple BDFs fails:
Kernel command line: pci=config_acs=1111011@0020:02:00.0;101xxxx@0039:00:00.0 "dyndbg=file drivers/pci/pci.c +p"
PCI: Can't parse ACS command line parameter
pci 0020:02:00.0: ACS mask = 0x007f
pci 0020:02:00.0: ACS flags = 0x007b
pci 0020:02:00.0: Configured ACS to 0x007bAfter this fix:
Kernel command line: pci=config_acs=1111011@0020:02:00.0;101xxxx@0039:00:00.0 "dyndbg=file drivers/pci/pci.c +p"
pci 0020:02:00.0: ACS mask = 0x007f
pci 0020:02:00.0: ACS flags = 0x007b
pci 0020:02:00.0: ACS control = 0x005f
pci 0020:02:00.0: ACS fw_ctrl = 0x0053
pci 0020:02:00.0: Configured ACS to 0x007b
pci 0039:00:00.0: ACS mask = 0x0070
pci 0039:00:00.0: ACS flags = 0x0050
pci 0039:00:00.0: ACS control = 0x001d
pci 0039:00:00.0: ACS fw_ctrl = 0x0000
pci 0039:00:00.0: Configured ACS to 0x00502) In the bit manipulation logic, we copy the bit from the firmware settings when mask bit 0.
For example, 'disable_acs_redir' fails to clear all three ACS P2P redir bits due to the wrong bit fiddling:
Kernel command line: pci=disable_acs_redir=0020:02:00.0;0030:02:00.0;0039:00:00.0 "dyndbg=file drivers/pci/pci.c +p"
pci 0020:02:00.0: ACS mask = 0x002c
pci 0020:02:00.0: ACS flags = 0xffd3
pci 0020:02:00.0: Configured ACS to 0xfffb
pci 0030:02:00.0: ACS mask = 0x002c
pci 0030:02:00.0: ACS flags = 0xffd3
pci 0030:02:00.0: Configured ACS to 0xffdf
pci 0039:00:00.0: ACS mask = 0x002c
pci 0039:00:00.0: ACS flags = 0xffd3
pci 0039:00:00.0: Configured ACS to 0xffd3After this fix:
Kernel command line: pci=disable_acs_redir=0020:02:00.0;0030:02:00.0;0039:00:00.0 "dyndbg=file drivers/pci/pci.c +p"
pci 0020:02:00.0: ACS mask = 0x002c
pci 0020:02:00.0: ACS flags = 0xffd3
pci 0020:02:00.0: ACS control = 0x007f
pci 0020:02:00.0: ACS fw_ctrl = 0x007b
pci 0020:02:00.0: Configured ACS to 0x0053
pci 0030:02:00.0: ACS mask = 0x002c
pci 0030:02:00.0: ACS flags = 0xffd3
pci 0030:02:00.0: ACS control = 0x005f
pci 0030:02:00.0: ACS fw_ctrl = 0x005f
pci 0030:02:00.0: Configured ACS to 0x0053
pci 0039:00:00.0: ACS mask = 0x002c
pci 0039:00:00.0: ACS flags = 0xffd3
pci 0039:00:00.0: ACS control = 0x001d
pci 0039:00:00.0: ACS fw_ctrl = 0x0000
pci 0039:00:00.0: Configured ACS to 0x0000--- drivers/pci/pci.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
drivers/pci/pci.c +13 -5
@@ -955,8 +955,10 @@ struct pci_acs { };static void __pci_config_acs (struct pci_dev *dev,struct pci_acs *caps, -const char *p,u16 mask,u16 flags) +const char *p,const u16 acs_mask,const u16 acs_flags) { +u16 flags = acs_flags; +u16 mask = acs_mask;char *delimit;int ret =0 ;
@@ -964,7 +966,7 @@ static void __pci_config_acs(struct pci_dev *dev, struct pci_acs *caps,return ;while (*p) { -if (!mask) { +if (!acs_mask) {/* Check for ACS flags */ delimit =strstr (p,"@" );if (delimit) {
@@ -972,6 +974,8 @@ static void __pci_config_acs(struct pci_dev *dev, struct pci_acs *caps,u32 shift =0 ; end = delimit - p -1 ; + mask =0 ; + flags =0 ;while (end >-1 ) {if (*(p + end) =='0' ) {
@@ -1028,10 +1032,14 @@ static void __pci_config_acs(struct pci_dev *dev, struct pci_acs *caps,pci_dbg (dev,"ACS mask = %#06x\n" , mask);pci_dbg (dev,"ACS flags = %#06x\n" , flags); +pci_dbg (dev,"ACS control = %#06x\n" , caps->ctrl); +pci_dbg (dev,"ACS fw_ctrl = %#06x\n" , caps->fw_ctrl); -/* If mask is 0 then we copy the bit from the firmware setting. */ - caps->ctrl = (caps->ctrl & ~mask) | (caps->fw_ctrl & mask); - caps->ctrl |= flags; +/* +* For mask bits that are 0, copy them from the firmware setting +* and apply flags for all the mask bits that are 1. +*/ + caps->ctrl = (caps->fw_ctrl & ~mask) | (flags & mask);pci_info (dev,"Configured ACS to %#06x\n" , caps->ctrl); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/499 drm/amd/display: fix an indent issue in DML21
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aurabindo Pillai <[email protected]>
[ Upstream commit a1addcf8499a566496847f1e36e1cf0b4ad72a26 ]
Remove extraneous tab and newline in dml2_core_dcn4.c that was reported by the bot
--- .../amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4.c +1 -2
@@ -139,9 +139,8 @@ bool core_dcn4_initialize(struct dml2_core_initialize_in_out *in_out) core->clean_me_up.mode_lib.ip.subvp_fw_processing_delay_us = core_dcn4_ip_caps_base.subvp_pstate_allow_width_us; core->clean_me_up.mode_lib.ip.subvp_swath_height_margin_lines = core_dcn4_ip_caps_base.subvp_swath_height_margin_lines; }else { -memcpy (&core->clean_me_up.mode_lib.ip, &core_dcn4_ip_caps_base,sizeof (struct dml2_core_ip_params )); +memcpy (&core->clean_me_up.mode_lib.ip, &core_dcn4_ip_caps_base,sizeof (struct dml2_core_ip_params ));patch_ip_params_with_ip_caps (&core->clean_me_up.mode_lib.ip, in_out->ip_caps); - core->clean_me_up.mode_lib.ip.imall_supported = false; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/499 drm/msm/dpu: dont use active in atomic_check()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 25b4614843bcc56ba150f7c99905125a019e656c ]
The driver isn't supposed to consult crtc_state->active/active_check for resource allocation. Instead all resources should be allocated if crtc_state->enabled is set. Stop consulting active / active_changed in order to determine whether the hardware resources should be (re)allocated.
Patchwork: https://patchwork.freedesktop.org/patch/633393/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 4 ---- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 3 +-- 2 files changed, 1 insertion(+), 6 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +0 -4
@@ -1214,10 +1214,6 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc,DRM_DEBUG_ATOMIC ("%s: check\n" , dpu_crtc->name); -/* force a full mode set if active state changed */ -if (crtc_state->active_changed) - crtc_state->mode_changed = true; -if (cstate->num_mixers) { rc =_dpu_crtc_check_and_setup_lm_bounds (crtc, crtc_state);if (rc)
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +1 -2
@@ -793,12 +793,11 @@ static int dpu_encoder_virt_atomic_check( crtc_state->mode_changed = true;/* * Release and Allocate resources on every modeset -* Dont allocate when active is false. */ if (drm_atomic_crtc_needs_modeset (crtc_state)) {dpu_rm_release (global_state, drm_enc); -if (!crtc_state->active_changed || crtc_state->enable) +if (crtc_state->enable) ret =dpu_rm_reserve (&dpu_kms->rm, global_state, drm_enc, crtc_state, topology);if (!ret)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/499 drm/msm/dsi/phy: Program clock inverters in correct register
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit baf49072877726616c7f5943a6b45eb86bfeca0a ]
Since SM8250 all downstream sources program clock inverters in PLL_CLOCK_INVERTERS_1 register and leave the PLL_CLOCK_INVERTERS as reset value (0x0). The most recent Hardware Programming Guide for 3 nm, 4 nm, 5 nm and 7 nm PHYs also mention PLL_CLOCK_INVERTERS_1.
Patchwork: https://patchwork.freedesktop.org/patch/634489/
--- drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c +1 -1
@@ -305,7 +305,7 @@ static void dsi_pll_commit(struct dsi_pll_7nm *pll, struct dsi_pll_config *confiwritel (pll->phy->cphy_mode ?0x00 :0x10 , base + REG_DSI_7nm_PHY_PLL_CMODE_1);writel (config->pll_clock_inverters, - base + REG_DSI_7nm_PHY_PLL_CLOCK_INVERTERS); + base + REG_DSI_7nm_PHY_PLL_CLOCK_INVERTERS_1); } static int dsi_pll_7nm_vco_set_rate(struct clk_hw *hw, unsigned long rate,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/499 drm/msm/dsi: Use existing per-interface slice count in DSC timing
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marijn Suijten <[email protected]>
[ Upstream commit 14ad809ceb66d0874cbe4bd5ca9edf0de8d9ad96 ]
When configuring the timing of DSI hosts (interfaces) in dsi_timing_setup() all values written to registers are taking bonded-mode into account by dividing the original mode width by 2 (half the data is sent over each of the two DSI hosts), but the full width instead of the interface width is passed as hdisplay parameter to dsi_update_dsc_timing().
Currently only msm_dsc_get_slices_per_intf() is called within dsi_update_dsc_timing() with the hdisplay argument which clearly documents that it wants the width of a single interface (which, again, in bonded DSI mode is half the total width of the mode) resulting in all subsequent values to be completely off.
However, as soon as we start to pass the halved hdisplay into dsi_update_dsc_timing() we might as well discard msm_dsc_get_slices_per_intf() since the value it calculates is already available in dsc->slice_count which is per-interface by the current design of MSM DPU/DSI implementations and their use of the DRM DSC helpers.
Patchwork: https://patchwork.freedesktop.org/patch/637648/
--- drivers/gpu/drm/msm/dsi/dsi_host.c | 8 ++++---- drivers/gpu/drm/msm/msm_dsc_helper.h | 11 ----------- 2 files changed, 4 insertions(+), 15 deletions(-)
drivers/gpu/drm/msm/dsi/dsi_host.c +4 -4
@@ -846,7 +846,7 @@ static void dsi_ctrl_enable(struct msm_dsi_host *msm_host,dsi_write (msm_host,REG_DSI_CPHY_MODE_CTRL ,BIT (0 )); } -static void dsi_update_dsc_timing (struct msm_dsi_host *msm_host,bool is_cmd_mode,u32 hdisplay) +static void dsi_update_dsc_timing (struct msm_dsi_host *msm_host,bool is_cmd_mode) {struct drm_dsc_config *dsc = msm_host->dsc;u32 reg, reg_ctrl, reg_ctrl2;
@@ -858,7 +858,7 @@ static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mod/* first calculate dsc parameters and then program * compress mode registers */ - slice_per_intf =msm_dsc_get_slices_per_intf (dsc, hdisplay); + slice_per_intf = dsc->slice_count; total_bytes_per_intf = dsc->slice_chunk_size * slice_per_intf; bytes_per_pkt = dsc->slice_chunk_size;/* * slice_per_pkt; */
@@ -991,7 +991,7 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi)if (msm_host->mode_flags &MIPI_DSI_MODE_VIDEO ) {if (msm_host->dsc) -dsi_update_dsc_timing (msm_host, false, mode->hdisplay); +dsi_update_dsc_timing (msm_host, false); dsi_write(msm_host, REG_DSI_ACTIVE_H, DSI_ACTIVE_H_START(ha_start) |
@@ -1012,7 +1012,7 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi) DSI_ACTIVE_VSYNC_VPOS_END(vs_end)); }else {/* command mode */ if (msm_host->dsc) -dsi_update_dsc_timing (msm_host, true, mode->hdisplay); +dsi_update_dsc_timing (msm_host, true);/* image data and 1 byte write_memory_start cmd */ if (!msm_host->dsc)
drivers/gpu/drm/msm/msm_dsc_helper.h +0 -11
@@ -12,17 +12,6 @@#include <linux/math.h> #include <drm/display/drm_dsc_helper.h> -/** -* msm_dsc_get_slices_per_intf() - calculate number of slices per interface -* @dsc: Pointer to drm dsc config struct -* @intf_width: interface width in pixels -* Returns: Integer representing the number of slices for the given interface -*/ -static inline u32 msm_dsc_get_slices_per_intf (const struct drm_dsc_config *dsc,u32 intf_width) -{ -return DIV_ROUND_UP (intf_width, dsc->slice_width); -} -/** * msm_dsc_get_bytes_per_line() - calculate bytes per line * @dsc: Pointer to drm dsc config struct
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/499 drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marijn Suijten <[email protected]>
[ Upstream commit 660c396c98c061f9696bebacc178b74072e80054 ]
Ordering issues here cause an uninitialized (default STANDALONE) usecase to be programmed (which appears to be a MUX) in some cases when msm_dsi_host_register() is called, leading to the slave PLL in bonded-DSI mode to source from a clock parent (dsi1vco) that is off.
This should seemingly not be a problem as the actual dispcc clocks from DSI1 that are muxed in the clock tree of DSI0 are way further down, this bit still seems to have an effect on them somehow and causes the right side of the panel controlled by DSI1 to not function.
In an ideal world this code is refactored to no longer have such error-prone calls "across subsystems", and instead model the "PLL src" register field as a regular mux so that changing the clock parents programmatically or in DTS via assigned-clock-parents has the desired effect.
But for the avid reader, the clocks that we *are* muxing into DSI0's tree are way further down, so if this bit turns out to be a simple mux between dsiXvco and out_div, that shouldn't have any effect as this whole tree is off anyway.
Patchwork: https://patchwork.freedesktop.org/patch/637650/
--- drivers/gpu/drm/msm/dsi/dsi_manager.c | 32 ++++++++++++++++++--------- 1 file changed, 21 insertions(+), 11 deletions(-)
drivers/gpu/drm/msm/dsi/dsi_manager.c +21 -11
@@ -74,17 +74,35 @@ static int dsi_mgr_setup_components(int id)int ret;if (!IS_BONDED_DSI ()) { +/* +* Set the usecase before calling msm_dsi_host_register(), which would +* already program the PLL source mux based on a default usecase. +*/ +msm_dsi_phy_set_usecase (msm_dsi->phy,MSM_DSI_PHY_STANDALONE ); +msm_dsi_host_set_phy_mode (msm_dsi->host, msm_dsi->phy); + ret =msm_dsi_host_register (msm_dsi->host);if (ret)return ret; - -msm_dsi_phy_set_usecase (msm_dsi->phy,MSM_DSI_PHY_STANDALONE ); -msm_dsi_host_set_phy_mode (msm_dsi->host, msm_dsi->phy); }else if (other_dsi) {struct msm_dsi *master_link_dsi =IS_MASTER_DSI_LINK (id) ? msm_dsi : other_dsi;struct msm_dsi *slave_link_dsi =IS_MASTER_DSI_LINK (id) ? other_dsi : msm_dsi; + +/* +* PLL0 is to drive both DSI link clocks in bonded DSI mode. +* +* Set the usecase before calling msm_dsi_host_register(), which would +* already program the PLL source mux based on a default usecase. +*/ +msm_dsi_phy_set_usecase (clk_master_dsi->phy, +MSM_DSI_PHY_MASTER ); +msm_dsi_phy_set_usecase (clk_slave_dsi->phy, +MSM_DSI_PHY_SLAVE ); +msm_dsi_host_set_phy_mode (msm_dsi->host, msm_dsi->phy); +msm_dsi_host_set_phy_mode (other_dsi->host, other_dsi->phy); +/* Register slave host first, so that slave DSI device * has a chance to probe, and do not block the master * DSI device's probe.
@@ -98,14 +116,6 @@ static int dsi_mgr_setup_components(int id) ret =msm_dsi_host_register (master_link_dsi->host);if (ret)return ret; - -/* PLL0 is to drive both 2 DSI link clocks in bonded DSI mode. */ -msm_dsi_phy_set_usecase (clk_master_dsi->phy, -MSM_DSI_PHY_MASTER ); -msm_dsi_phy_set_usecase (clk_slave_dsi->phy, -MSM_DSI_PHY_SLAVE ); -msm_dsi_host_set_phy_mode (msm_dsi->host, msm_dsi->phy); -msm_dsi_host_set_phy_mode (other_dsi->host, other_dsi->phy); }return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/499 drm/amdkfd: Fix Circular Locking Dependency in svm_range_cpu_invalidate_pagetables
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit fddc45026311c05a5355fd34b9dc0a1d7eaef4a2 ]
This commit addresses a circular locking dependency in the svm_range_cpu_invalidate_pagetables function. The function previously held a lock while determining whether to perform an unmap or eviction operation, which could lead to deadlocks.
Fixes the below:
[ 223.418794] ======================================================
[ 223.418820] WARNING: possible circular locking dependency detected
[ 223.418845] 6.12.0-amdstaging-drm-next-lol-050225 #14 Tainted: G U OE
[ 223.418869] ------------------------------------------------------
[ 223.418889] kfdtest/3939 is trying to acquire lock:
[ 223.418906] ffff8957552eae38 (&dqm->lock_hidden){+.+.}-{3:3}, at: evict_process_queues_cpsch+0x43/0x210 [amdgpu]
[ 223.419302]
but task is already holding lock:
[ 223.419303] ffff8957556b83b0 (&prange->lock){+.+.}-{3:3}, at: svm_range_cpu_invalidate_pagetables+0x9d/0x850 [amdgpu]
[ 223.419447] Console: switching to colour dummy device 80x25
[ 223.419477] [IGT] amd_basic: executing
[ 223.419599]
which lock already depends on the new lock.[ 223.419611]
the existing dependency chain (in reverse order) is:
[ 223.419621]
-> #2 (&prange->lock){+.+.}-{3:3}:
[ 223.419636] __mutex_lock+0x85/0xe20
[ 223.419647] mutex_lock_nested+0x1b/0x30
[ 223.419656] svm_range_validate_and_map+0x2f1/0x15b0 [amdgpu]
[ 223.419954] svm_range_set_attr+0xe8c/0x1710 [amdgpu]
[ 223.420236] svm_ioctl+0x46/0x50 [amdgpu]
[ 223.420503] kfd_ioctl_svm+0x50/0x90 [amdgpu]
[ 223.420763] kfd_ioctl+0x409/0x6d0 [amdgpu]
[ 223.421024] __x64_sys_ioctl+0x95/0xd0
[ 223.421036] x64_sys_call+0x1205/0x20d0
[ 223.421047] do_syscall_64+0x87/0x140
[ 223.421056] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 223.421068]
-> #1 (reservation_ww_class_mutex){+.+.}-{3:3}:
[ 223.421084] __ww_mutex_lock.constprop.0+0xab/0x1560
[ 223.421095] ww_mutex_lock+0x2b/0x90
[ 223.421103] amdgpu_amdkfd_alloc_gtt_mem+0xcc/0x2b0 [amdgpu]
[ 223.421361] add_queue_mes+0x3bc/0x440 [amdgpu]
[ 223.421623] unhalt_cpsch+0x1ae/0x240 [amdgpu]
[ 223.421888] kgd2kfd_start_sched+0x5e/0xd0 [amdgpu]
[ 223.422148] amdgpu_amdkfd_start_sched+0x3d/0x50 [amdgpu]
[ 223.422414] amdgpu_gfx_enforce_isolation_handler+0x132/0x270 [amdgpu]
[ 223.422662] process_one_work+0x21e/0x680
[ 223.422673] worker_thread+0x190/0x330
[ 223.422682] kthread+0xe7/0x120
[ 223.422690] ret_from_fork+0x3c/0x60
[ 223.422699] ret_from_fork_asm+0x1a/0x30
[ 223.422708]
-> #0 (&dqm->lock_hidden){+.+.}-{3:3}:
[ 223.422723] __lock_acquire+0x16f4/0x2810
[ 223.422734] lock_acquire+0xd1/0x300
[ 223.422742] __mutex_lock+0x85/0xe20
[ 223.422751] mutex_lock_nested+0x1b/0x30
[ 223.422760] evict_process_queues_cpsch+0x43/0x210 [amdgpu]
[ 223.423025] kfd_process_evict_queues+0x8a/0x1d0 [amdgpu]
[ 223.423285] kgd2kfd_quiesce_mm+0x43/0x90 [amdgpu]
[ 223.423540] svm_range_cpu_invalidate_pagetables+0x4a7/0x850 [amdgpu]
[ 223.423807] __mmu_notifier_invalidate_range_start+0x1f5/0x250
[ 223.423819] copy_page_range+0x1e94/0x1ea0
[ 223.423829] copy_process+0x172f/0x2ad0
[ 223.423839] kernel_clone+0x9c/0x3f0
[ 223.423847] __do_sys_clone+0x66/0x90
[ 223.423856] __x64_sys_clone+0x25/0x30
[ 223.423864] x64_sys_call+0x1d7c/0x20d0
[ 223.423872] do_syscall_64+0x87/0x140
[ 223.423880] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 223.423891]
other info that might help us debug this:[ 223.423903] Chain exists of:
&dqm->lock_hidden --> reservation_ww_class_mutex --> &prange->lock[ 223.423926] Possible unsafe locking scenario:
[ 223.423935] CPU0 CPU1
[ 223.423942] ---- ----
[ 223.423949] lock(&prange->lock);
[ 223.423958] lock(reservation_ww_class_mutex);
[ 223.423970] lock(&prange->lock);
[ 223.423981] lock(&dqm->lock_hidden);
[ 223.423990]
*** DEADLOCK ***[ 223.423999] 5 locks held by kfdtest/3939:
[ 223.424006] #0: ffffffffb82b4fc0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_process+0x1387/0x2ad0
[ 223.424026] #1: ffff89575eda81b0 (&mm->mmap_lock){++++}-{3:3}, at: copy_process+0x13a8/0x2ad0
[ 223.424046] #2: ffff89575edaf3b0 (&mm->mmap_lock/1){+.+.}-{3:3}, at: copy_process+0x13e4/0x2ad0
[ 223.424066] #3: ffffffffb82e76e0 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at: copy_page_range+0x1cea/0x1ea0
[ 223.424088] #4: ffff8957556b83b0 (&prange->lock){+.+.}-{3:3}, at: svm_range_cpu_invalidate_pagetables+0x9d/0x850 [amdgpu]
[ 223.424365]
stack backtrace:
[ 223.424374] CPU: 0 UID: 0 PID: 3939 Comm: kfdtest Tainted: G U OE 6.12.0-amdstaging-drm-next-lol-050225 #14
[ 223.424392] Tainted: [U]=USER, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[ 223.424401] Hardware name: Gigabyte Technology Co., Ltd. X570 AORUS PRO WIFI/X570 AORUS PRO WIFI, BIOS F36a 02/16/2022
[ 223.424416] Call Trace:
[ 223.424423] <TASK>
[ 223.424430] dump_stack_lvl+0x9b/0xf0
[ 223.424441] dump_stack+0x10/0x20
[ 223.424449] print_circular_bug+0x275/0x350
[ 223.424460] check_noncircular+0x157/0x170
[ 223.424469] ? __bfs+0xfd/0x2c0
[ 223.424481] __lock_acquire+0x16f4/0x2810
[ 223.424490] ? srso_return_thunk+0x5/0x5f
[ 223.424505] lock_acquire+0xd1/0x300
[ 223.424514] ? evict_process_queues_cpsch+0x43/0x210 [amdgpu]
[ 223.424783] __mutex_lock+0x85/0xe20
[ 223.424792] ? evict_process_queues_cpsch+0x43/0x210 [amdgpu]
[ 223.425058] ? srso_return_thunk+0x5/0x5f
[ 223.425067] ? mark_held_locks+0x54/0x90
[ 223.425076] ? evict_process_queues_cpsch+0x43/0x210 [amdgpu]
[ 223.425339] ? srso_return_thunk+0x5/0x5f
[ 223.425350] mutex_lock_nested+0x1b/0x30
[ 223.425358] ? mutex_lock_nested+0x1b/0x30
[ 223.425367] evict_process_queues_cpsch+0x43/0x210 [amdgpu]
[ 223.425631] kfd_process_evict_queues+0x8a/0x1d0 [amdgpu]
[ 223.425893] kgd2kfd_quiesce_mm+0x43/0x90 [amdgpu]
[ 223.426156] svm_range_cpu_invalidate_pagetables+0x4a7/0x850 [amdgpu]
[ 223.426423] ? srso_return_thunk+0x5/0x5f
[ 223.426436] __mmu_notifier_invalidate_range_start+0x1f5/0x250
[ 223.426450] copy_page_range+0x1e94/0x1ea0
[ 223.426461] ? srso_return_thunk+0x5/0x5f
[ 223.426474] ? srso_return_thunk+0x5/0x5f
[ 223.426484] ? lock_acquire+0xd1/0x300
[ 223.426494] ? copy_process+0x1718/0x2ad0
[ 223.426502] ? srso_return_thunk+0x5/0x5f
[ 223.426510] ? sched_clock_noinstr+0x9/0x10
[ 223.426519] ? local_clock_noinstr+0xe/0xc0
[ 223.426528] ? copy_process+0x1718/0x2ad0
[ 223.426537] ? srso_return_thunk+0x5/0x5f
[ 223.426550] copy_process+0x172f/0x2ad0
[ 223.426569] kernel_clone+0x9c/0x3f0
[ 223.426577] ? __schedule+0x4c9/0x1b00
[ 223.426586] ? srso_return_thunk+0x5/0x5f
[ 223.426594] ? sched_clock_noinstr+0x9/0x10
[ 223.426602] ? srso_return_thunk+0x5/0x5f
[ 223.426610] ? local_clock_noinstr+0xe/0xc0
[ 223.426619] ? schedule+0x107/0x1a0
[ 223.426629] __do_sys_clone+0x66/0x90
[ 223.426643] __x64_sys_clone+0x25/0x30
[ 223.426652] x64_sys_call+0x1d7c/0x20d0
[ 223.426661] do_syscall_64+0x87/0x140
[ 223.426671] ? srso_return_thunk+0x5/0x5f
[ 223.426679] ? common_nsleep+0x44/0x50
[ 223.426690] ? srso_return_thunk+0x5/0x5f
[ 223.426698] ? trace_hardirqs_off+0x52/0xd0
[ 223.426709] ? srso_return_thunk+0x5/0x5f
[ 223.426717] ? syscall_exit_to_user_mode+0xcc/0x200
[ 223.426727] ? srso_return_thunk+0x5/0x5f
[ 223.426736] ? do_syscall_64+0x93/0x140
[ 223.426748] ? srso_return_thunk+0x5/0x5f
[ 223.426756] ? up_write+0x1c/0x1e0
[ 223.426765] ? srso_return_thunk+0x5/0x5f
[ 223.426775] ? srso_return_thunk+0x5/0x5f
[ 223.426783] ? trace_hardirqs_off+0x52/0xd0
[ 223.426792] ? srso_return_thunk+0x5/0x5f
[ 223.426800] ? syscall_exit_to_user_mode+0xcc/0x200
[ 223.426810] ? srso_return_thunk+0x5/0x5f
[ 223.426818] ? do_syscall_64+0x93/0x140
[ 223.426826] ? syscall_exit_to_user_mode+0xcc/0x200
[ 223.426836] ? srso_return_thunk+0x5/0x5f
[ 223.426844] ? do_syscall_64+0x93/0x140
[ 223.426853] ? srso_return_thunk+0x5/0x5f
[ 223.426861] ? irqentry_exit+0x6b/0x90
[ 223.426869] ? srso_return_thunk+0x5/0x5f
[ 223.426877] ? exc_page_fault+0xa7/0x2c0
[ 223.426888] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 223.426898] RIP: 0033:0x7f46758eab57
[ 223.426906] Code: ba 04 00 f3 0f 1e fa 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 41 41 89 c0 85 c0 75 2c 64 48 8b 04 25 10 00
[ 223.426930] RSP: 002b:00007fff5c3e5188 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
[ 223.426943] RAX: ffffffffffffffda RBX: 00007f4675f8c040 RCX: 00007f46758eab57
[ 223.426954] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
[ 223.426965] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 223.426975] R10: 00007f4675e81a50 R11: 0000000000000246 R12: 0000000000000001
[ 223.426986] R13: 00007fff5c3e5470 R14: 00007fff5c3e53e0 R15: 00007fff5c3e5410
[ 223.427004] </TASK>v2: To resolve this issue, the allocation of the process context buffer (proc_ctx_bo) has been moved from the add_queue_mes function to the pqm_create_queue function. This change ensures that the buffer is allocated only when the first queue for a process is created and only if the Micro Engine Scheduler (MES) is enabled. (Felix)
v3: Fix typo s/Memory Execution Scheduler (MES)/Micro Engine Scheduler in commit message. (Lijo)
--- .../drm/amd/amdkfd/kfd_device_queue_manager.c | 15 --------------- .../drm/amd/amdkfd/kfd_process_queue_manager.c | 16 ++++++++++++++++ 2 files changed, 16 insertions(+), 15 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +0 -15
@@ -207,21 +207,6 @@ static int add_queue_mes(struct device_queue_manager *dqm, struct queue *q,if (!down_read_trylock (&adev->reset_domain->sem))return -EIO ; -if (!pdd->proc_ctx_cpu_ptr) { - r =amdgpu_amdkfd_alloc_gtt_mem (adev, -AMDGPU_MES_PROC_CTX_SIZE , - &pdd->proc_ctx_bo, - &pdd->proc_ctx_gpu_addr, - &pdd->proc_ctx_cpu_ptr, - false); -if (r) { -dev_err (adev->dev, -"failed to allocate process context bo\n" ); -return r; - } -memset (pdd->proc_ctx_cpu_ptr,0 ,AMDGPU_MES_PROC_CTX_SIZE ); - } -memset (&queue_input,0x0 ,sizeof (struct mes_add_queue_input )); queue_input.process_id = qpd->pqm->process->pasid; queue_input.page_table_base_addr = qpd->page_table_base;
drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +16 -0
@@ -360,10 +360,26 @@ int pqm_create_queue(struct process_queue_manager *pqm,if (retval !=0 )return retval; +/* Register process if this is the first queue */ if (list_empty (&pdd->qpd.queues_list) &&list_empty (&pdd->qpd.priv_queue_list)) dev->dqm->ops.register_process (dev->dqm, &pdd->qpd); +/* Allocate proc_ctx_bo only if MES is enabled and this is the first queue */ +if (!pdd->proc_ctx_cpu_ptr && dev->kfd->shared_resources.enable_mes) { + retval =amdgpu_amdkfd_alloc_gtt_mem (dev->adev, +AMDGPU_MES_PROC_CTX_SIZE , + &pdd->proc_ctx_bo, + &pdd->proc_ctx_gpu_addr, + &pdd->proc_ctx_cpu_ptr, + false); +if (retval) { +dev_err (dev->adev->dev,"failed to allocate process context bo\n" ); +return retval; + } +memset (pdd->proc_ctx_cpu_ptr,0 ,AMDGPU_MES_PROC_CTX_SIZE ); + } + pqn =kzalloc (sizeof (*pqn),GFP_KERNEL );if (!pqn) { retval = -ENOMEM ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/499 PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Zhang <[email protected]>
[ Upstream commit 3ac47fbf4f6e8c3a7c3855fac68cc3246f90f850 ]
Per the Cadence's "PCIe Controller IP for AX14" user guide, Version 1.04, Section 9.1.7.1, "AXI Subordinate to PCIe Address Translation Registers", Table 9.4, the bit 16 of the AXI Subordinate Address (axi_s_awaddr) when set corresponds to MSG with data, and when not set, to MSG without data.
However, the driver is currently doing the opposite and due to this, the INTx is never received on the host.
So, fix the driver to reflect the documentation and also make INTx work.
--- drivers/pci/controller/cadence/pcie-cadence-ep.c | 3 +-- drivers/pci/controller/cadence/pcie-cadence.h | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-)
drivers/pci/controller/cadence/pcie-cadence-ep.c +1 -2
@@ -352,8 +352,7 @@ static void cdns_pcie_ep_assert_intx(struct cdns_pcie_ep *ep, u8 fn, u8 intx,spin_unlock_irqrestore (&ep->lock, flags); offset =CDNS_PCIE_NORMAL_MSG_ROUTING (MSG_ROUTING_LOCAL ) | -CDNS_PCIE_NORMAL_MSG_CODE (msg_code) | -CDNS_PCIE_MSG_NO_DATA ; +CDNS_PCIE_NORMAL_MSG_CODE (msg_code);writel (0 , ep->irq_cpu_addr + offset); }
drivers/pci/controller/cadence/pcie-cadence.h +1 -1
@@ -246,7 +246,7 @@ struct cdns_pcie_rp_ib_bar {#define CDNS_PCIE_NORMAL_MSG_CODE_MASK GENMASK(15, 8)#define CDNS_PCIE_NORMAL_MSG_CODE (code) \ (((code) << 8) & CDNS_PCIE_NORMAL_MSG_CODE_MASK) -#define CDNS_PCIE_MSG_NO_DATA BIT(16) +#define CDNS_PCIE_MSG_DATA BIT(16)struct cdns_pcie ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/499 PCI: brcmstb: Set generation limit before PCIe link up
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Quinlan <[email protected]>
[ Upstream commit 72d36589c6b7bef6b30eb99fcb7082f72faca37f ]
When the user elects to limit the PCIe generation via the appropriate devicetree property, apply the settings before the PCIe link up, not after.
--- drivers/pci/controller/pcie-brcmstb.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/pci/controller/pcie-brcmstb.c +4 -3
@@ -1276,6 +1276,10 @@ static int brcm_pcie_start_link(struct brcm_pcie *pcie)bool ssc_good = false;int ret, i; +/* Limit the generation if specified */ +if (pcie->gen) +brcm_pcie_set_gen (pcie, pcie->gen); +/* Unassert the fundamental reset */ ret = pcie->perst_set (pcie,0 );if (ret)
@@ -1302,9 +1306,6 @@ static int brcm_pcie_start_link(struct brcm_pcie *pcie)brcm_config_clkreq (pcie); -if (pcie->gen) -brcm_pcie_set_gen (pcie, pcie->gen); -if (pcie->ssc) { ret =brcm_pcie_set_ssc (pcie);if (ret ==0 )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 89/499 PCI: brcmstb: Use internal register to change link capability
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Quinlan <[email protected]>
[ Upstream commit 0c97321e11e0e9e18546f828492758f6aaecec59 ]
The driver has been mistakenly writing to a read-only (RO) configuration space register (PCI_EXP_LNKCAP) to change the PCIe link capability.
Although harmless in this case, the proper write destination is an internal register that is reflected by PCI_EXP_LNKCAP.
Thus, fix the brcm_pcie_set_gen() function to correctly update the link capability.
--- drivers/pci/controller/pcie-brcmstb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/controller/pcie-brcmstb.c +2 -2
@@ -403,10 +403,10 @@ static int brcm_pcie_set_ssc(struct brcm_pcie *pcie)static void brcm_pcie_set_gen (struct brcm_pcie *pcie,int gen) {u16 lnkctl2 =readw (pcie->base +BRCM_PCIE_CAP_REGS +PCI_EXP_LNKCTL2 ); -u32 lnkcap =readl (pcie->base +BRCM_PCIE_CAP_REGS +PCI_EXP_LNKCAP ); +u32 lnkcap =readl (pcie->base +PCIE_RC_CFG_PRIV1_LINK_CAPABILITY ); lnkcap = (lnkcap & ~PCI_EXP_LNKCAP_SLS ) | gen; -writel (lnkcap, pcie->base +BRCM_PCIE_CAP_REGS +PCI_EXP_LNKCAP ); +writel (lnkcap, pcie->base +PCIE_RC_CFG_PRIV1_LINK_CAPABILITY ); lnkctl2 = (lnkctl2 & ~0xf ) | gen;writew (lnkctl2, pcie->base +BRCM_PCIE_CAP_REGS +PCI_EXP_LNKCTL2 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 90/499 PCI: brcmstb: Fix error path after a call to regulator_bulk_get()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Quinlan <[email protected]>
[ Upstream commit 3651ad5249c51cf7eee078e12612557040a6bdb4 ]
If the regulator_bulk_get() returns an error and no regulators are created, we need to set their number to zero.
If we don't do this and the PCIe link up fails, a call to the regulator_bulk_free() will result in a kernel panic.
While at it, print the error value, as we cannot return an error upwards as the kernel will WARN() on an error from add_bus().
[kwilczynski: commit log, use comma in the message to match style with other similar messages]
--- drivers/pci/controller/pcie-brcmstb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pci/controller/pcie-brcmstb.c +2 -1
@@ -1368,7 +1368,8 @@ static int brcm_pcie_add_bus(struct pci_bus *bus) ret =regulator_bulk_get (dev, sr->num_supplies, sr->supplies);if (ret) { -dev_info (dev,"No regulators for downstream device\n" ); +dev_info (dev,"Did not get regulators, err=%d\n" , ret); + pcie->sr =NULL ; goto no_regulators; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/499 PCI: brcmstb: Fix potential premature regulator disabling
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Quinlan <[email protected]>
[ Upstream commit b7de1b60ecab2f7b6f05d8116e93228a0bbb8563 ]
The platform supports enabling and disabling regulators only on ports below the Root Complex.
Thus, we need to verify this both when adding and removing the bus, otherwise regulators may be disabled prematurely when a bus further down the topology is removed.
--- drivers/pci/controller/pcie-brcmstb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/controller/pcie-brcmstb.c +1 -1
@@ -1392,7 +1392,7 @@ static void brcm_pcie_remove_bus(struct pci_bus *bus)struct subdev_regulators *sr = pcie->sr;struct device *dev = &bus->dev; -if (!sr) +if (!sr || !bus->parent || !pci_is_root_bus (bus->parent))return ;if (regulator_bulk_disable (sr->num_supplies, sr->supplies))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/499 selftests/pcie_bwctrl: Add set_pcie_speed.sh to TEST_PROGS
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Lai <[email protected]>
[ Upstream commit df6f8c4d72aebaf66aaa8658c723fd360c272e59 ]
The test shell script "set_pcie_speed.sh" is not installed in INSTALL_PATH. Attempting to execute set_pcie_cooling_state.sh shows warning:
./set_pcie_cooling_state.sh: line 119: ./set_pcie_speed.sh: No such file or directory
Add "set_pcie_speed.sh" to TEST_PROGS.
--- tools/testing/selftests/pcie_bwctrl/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/pcie_bwctrl/Makefile +1 -1
@@ -1,2 +1,2 @@ -TEST_PROGS = set_pcie_cooling_state.sh +TEST_PROGS = set_pcie_cooling_state.sh set_pcie_speed.sh include ../lib.mk
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 93/499 PCI/portdrv: Only disable pciehp interrupts early when needed
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Tang <[email protected]>
[ Upstream commit 9d7db4db19827380e225914618c0c1bf435ed2f5 ]
Firmware developers reported that Linux issues two PCIe hotplug commands in very short intervals on an ARM server, which doesn't comply with the PCIe spec. According to PCIe r6.1, sec 6.7.3.2, if the Command Completed event is supported, software must wait for a command to complete or wait at least 1 second before sending a new command.
In the failure case, the first PCIe hotplug command is from get_port_device_capability(), which sends a command to disable PCIe hotplug interrupts without waiting for its completion, and the second command comes from pcie_enable_notification() of pciehp driver, which enables hotplug interrupts again.
Fix this by only disabling the hotplug interrupts when the pciehp driver is not enabled.
--- drivers/pci/pcie/portdrv.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/pci/pcie/portdrv.c +5 -3
@@ -228,10 +228,12 @@ static int get_port_device_capability(struct pci_dev *dev)/* * Disable hot-plug interrupts in case they have been enabled -* by the BIOS and the hot-plug service driver is not loaded. +* by the BIOS and the hot-plug service driver won't be loaded +* to handle them. */ -pcie_capability_clear_word (dev,PCI_EXP_SLTCTL , -PCI_EXP_SLTCTL_CCIE |PCI_EXP_SLTCTL_HPIE ); +if (!IS_ENABLED (CONFIG_HOTPLUG_PCI_PCIE )) +pcie_capability_clear_word (dev,PCI_EXP_SLTCTL , +PCI_EXP_SLTCTL_CCIE |PCI_EXP_SLTCTL_HPIE ); }#ifdef CONFIG_PCIEAER
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 94/499 PCI: Avoid reset when disabled via sysfs
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Aravamudan <[email protected]>
[ Upstream commit 479380efe1625e251008d24b2810283db60d6fcd ]
After d88f521da3ef ("PCI: Allow userspace to query and set device reset mechanism"), userspace can disable reset of specific PCI devices by writing an empty string to the sysfs reset_method file.
However, pci_slot_resettable() does not check pci_reset_supported(), which means that pci_reset_function() will still reset the device even if userspace has disabled all the reset methods.
I was able to reproduce this issue with a vfio device passed to a qemu guest, where I had disabled PCI reset via sysfs.
Add an explicit check of pci_reset_supported() in both pci_slot_resettable() and pci_bus_resettable() to ensure both the reset status and reset execution are bypassed if an administrator disables it for a device.
--- drivers/pci/pci.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/pci/pci.c +4 -0
@@ -5534,6 +5534,8 @@ static bool pci_bus_resettable(struct pci_bus *bus)return false;list_for_each_entry (dev, &bus->devices, bus_list) { +if (!pci_reset_supported (dev)) +return false;if (dev->dev_flags &PCI_DEV_FLAGS_NO_BUS_RESET || (dev->subordinate && !pci_bus_resettable (dev->subordinate)))return false;
@@ -5610,6 +5612,8 @@ static bool pci_slot_resettable(struct pci_slot *slot)list_for_each_entry (dev, &slot->bus->devices, bus_list) {if (!dev->slot || dev->slot != slot)continue ; +if (!pci_reset_supported (dev)) +return false;if (dev->dev_flags &PCI_DEV_FLAGS_NO_BUS_RESET || (dev->subordinate && !pci_bus_resettable (dev->subordinate)))return false;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 95/499 drm/panthor: Update CS_STATUS_ defines to correct values
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ashley Smith <[email protected]>
[ Upstream commit c82734fbdc50dc9e568e8686622eaa4498acb81e ]
Values for SC_STATUS_BLOCKED_REASON_ are documented in the G610 "Odin" GPU specification (CS_STATUS_BLOCKED_REASON register).
This change updates the defines to the correct values.
--- drivers/gpu/drm/panthor/panthor_fw.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/panthor/panthor_fw.h +3 -3
@@ -102,9 +102,9 @@ struct panthor_fw_cs_output_iface {#define CS_STATUS_BLOCKED_REASON_SB_WAIT 1#define CS_STATUS_BLOCKED_REASON_PROGRESS_WAIT 2#define CS_STATUS_BLOCKED_REASON_SYNC_WAIT 3 -#define CS_STATUS_BLOCKED_REASON_DEFERRED 5 -#define CS_STATUS_BLOCKED_REASON_RES 6 -#define CS_STATUS_BLOCKED_REASON_FLUSH 7 +#define CS_STATUS_BLOCKED_REASON_DEFERRED 4 +#define CS_STATUS_BLOCKED_REASON_RESOURCE 5 +#define CS_STATUS_BLOCKED_REASON_FLUSH 6#define CS_STATUS_BLOCKED_REASON_MASK GENMASK(3, 0)u32 status_blocked_reason;u32 status_wait_sync_value_hi;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 96/499 drm/panthor: Clean up FW version information display
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Price <[email protected]>
[ Upstream commit 3b87886bfb038de2c62e627079472ba612e89410 ]
Assigning a string to an array which is too small to include the NUL byte at the end causes a warning on some compilers. But this function also has some other oddities like the 'header' array which is only ever used within sizeof().
Tidy up the function by removing the 'header' array, allow the NUL byte to be present in git_sha_header, and calculate the length directly from git_sha_header.
--- drivers/gpu/drm/panthor/panthor_fw.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/gpu/drm/panthor/panthor_fw.c +4 -5
@@ -647,8 +647,8 @@ static int panthor_fw_read_build_info(struct panthor_device *ptdev, u32 ehdr) {struct panthor_fw_build_info_hdr hdr; -char header[9 ]; -const char git_sha_header[sizeof (header)] ="git_sha: " ; +static const char git_sha_header[] ="git_sha: " ; +const int header_len =sizeof (git_sha_header) -1 ;int ret; ret =panthor_fw_binary_iter_read (ptdev, iter, &hdr,sizeof (hdr));
@@ -662,8 +662,7 @@ static int panthor_fw_read_build_info(struct panthor_device *ptdev,return 0 ; } -if (memcmp (git_sha_header, fw->data + hdr.meta_start, -sizeof (git_sha_header))) { +if (memcmp (git_sha_header, fw->data + hdr.meta_start, header_len)) {/* Not the expected header, this isn't metadata we understand */ return 0 ; }
@@ -676,7 +675,7 @@ static int panthor_fw_read_build_info(struct panthor_device *ptdev, }drm_info (&ptdev->base,"Firmware git sha: %s\n" , - fw->data + hdr.meta_start +sizeof (git_sha_header)); + fw->data + hdr.meta_start + header_len);return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 97/499 drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaliy Shevtsov <[email protected]>
[ Upstream commit c3c584c18c90a024a54716229809ba36424f9660 ]
There is a type mismatch between what CalculateDynamicMetadataParameters() takes and what is passed to it. Currently this function accepts several args as signed long but it's called with unsigned integers and integer. On some systems where long is 32 bits and one of these unsigned int params is greater than INT_MAX it may cause passing input params as negative values.
Fix this by changing these argument types from long to unsigned int and to int respectively. Also this will align the function's definition with similar functions in other dcn* drivers.
Found by Linux Verification Center (linuxtesting.org) with Svace.
--- .../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c +6 -6
@@ -281,10 +281,10 @@ static void CalculateDynamicMetadataParameters(double DISPCLK , double DCFClkDeepSleep, double PixelClock, - long HTotal, - long VBlank, - long DynamicMetadataTransmittedBytes, - long DynamicMetadataLinesBeforeActiveRequired, + unsigned int HTotal, + unsigned int VBlank, + unsigned int DynamicMetadataTransmittedBytes, + int DynamicMetadataLinesBeforeActiveRequired, int InterlaceEnable, bool ProgressiveToInterlaceUnitInOPP, double *Tsetup,
@@ -3265,8 +3265,8 @@ static double CalculateWriteBackDelay(static void CalculateDynamicMetadataParameters (int MaxInterDCNTileRepeaters,double DPPCLK ,double DISPCLK , -double DCFClkDeepSleep,double PixelClock,long HTotal,long VBlank,long DynamicMetadataTransmittedBytes, -long DynamicMetadataLinesBeforeActiveRequired,int InterlaceEnable,bool ProgressiveToInterlaceUnitInOPP, +double DCFClkDeepSleep,double PixelClock,unsigned int HTotal,unsigned int VBlank,unsigned int DynamicMetadataTransmittedBytes, +int DynamicMetadataLinesBeforeActiveRequired,int InterlaceEnable,bool ProgressiveToInterlaceUnitInOPP,double *Tsetup,double *Tdmbf,double *Tdmec,double *Tdmsks) {double TotalRepeaterDelayTime =0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 98/499 drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit 06dd5d86c6aef1c7609ca3a5ffa4097e475e2213 ]
Somehow, possibly as a result of rebase gone badly, setting nr_indexed_regs for pre-a650 a6xx devices lost the setting of nr_indexed_regs, resulting in values getting snapshot, but omitted from the devcoredump.
Patchwork: https://patchwork.freedesktop.org/patch/640289/
--- drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c +2 -0
@@ -1507,6 +1507,8 @@ static void a6xx_get_indexed_registers(struct msm_gpu *gpu,/* Restore the size in the hardware */ gpu_write (gpu,REG_A6XX_CP_MEM_POOL_SIZE , mempool_size); + + a6xx_state->nr_indexed_regs = count; } static void a7xx_get_indexed_registers(struct msm_gpu *gpu,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 99/499 powerpc/perf: Fix ref-counting on the PMU vpa_pmu
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vaibhav Jain <[email protected]>
[ Upstream commit ff99d5b6a246715f2257123cdf6c4a29cb33aa78 ]
Commit 176cda0619b6 ("powerpc/perf: Add perf interface to expose vpa counters") introduced 'vpa_pmu' to expose Book3s-HV nested APIv2 provided L1<->L2 context switch latency counters to L1 user-space via perf-events. However the newly introduced PMU named 'vpa_pmu' doesn't assign ownership of the PMU to the module 'vpa_pmu'. Consequently the module 'vpa_pmu' can be unloaded while one of the perf-events are still active, which can lead to kernel oops and panic of the form below on a Pseries-LPAR:
BUG: Kernel NULL pointer dereference on read at 0x00000058 <snip> NIP [c000000000506cb8] event_sched_out+0x40/0x258 LR [c00000000050e8a4] __perf_remove_from_context+0x7c/0x2b0 Call Trace: [c00000025fc3fc30] [c00000025f8457a8] 0xc00000025f8457a8 (unreliable) [c00000025fc3fc80] [fffffffffffffee0] 0xfffffffffffffee0 [c00000025fc3fcd0] [c000000000501e70] event_function+0xa8/0x120 <snip> Kernel panic - not syncing: Aiee, killing interrupt handler!
Fix this by adding the module ownership to 'vpa_pmu' so that the module 'vpa_pmu' is ref-counted and prevented from being unloaded when perf-events are initialized.
--- arch/powerpc/perf/vpa-pmu.c | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/perf/vpa-pmu.c +1 -0
@@ -156,6 +156,7 @@ static void vpa_pmu_del(struct perf_event *event, int flags) }static struct pmu vpa_pmu = { + .module =THIS_MODULE , .task_ctx_nr = perf_sw_context, .name ="vpa_pmu" , .event_init = vpa_pmu_event_init,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 100/499 crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 1e4d73d06c98f5a1af4f7591cf7c2c4eee5b94fa ]
The following build warning has been reported:
arch/powerpc/crypto/ghashp8-ppc.o: warning: objtool: .text+0x22c: unannotated intra-function call
This happens due to commit bb7f054f4de2 ("objtool/powerpc: Add support for decoding all types of uncond branches")
Disassembly of arch/powerpc/crypto/ghashp8-ppc.o shows:
arch/powerpc/crypto/ghashp8-ppc.o: file format elf64-powerpcle
Disassembly of section .text:
0000000000000140 <gcm_ghash_p8>:
140: f8 ff 00 3c lis r0,-8
...
20c: 20 00 80 4e blr 210: 00 00 00 00 .long 0x0 214: 00 0c 14 00 .long 0x140c00 218: 00 00 04 00 .long 0x40000 21c: 00 00 00 00 .long 0x0 220: 47 48 41 53 rlwimi. r1,r26,9,1,3 224: 48 20 66 6f xoris r6,r27,8264 228: 72 20 50 6f xoris r16,r26,8306 22c: 77 65 72 49 bla 1726574 <gcm_ghash_p8+0x1726434> <==
...
It corresponds to the following code in ghashp8-ppc.o :
_GLOBAL(gcm_ghash_p8)
lis 0,0xfff8
...
blr
.long 0
.byte 0,12,0x14,0,0,0,4,0
.long 0
.size gcm_ghash_p8,.-gcm_ghash_p8 .byte 71,72,65,83,72,32,102,111,114,32,80,111,119,101,114,73,83,65,32,50,46,48,55,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
.align 2
.align 2
In fact this is raw data that is after the function end and that is not text so shouldn't be disassembled as text. But ghashp8-ppc.S is generated by a perl script and should have been marked as OBJECT_FILES_NON_STANDARD.
Now that 'bla' is understood as a call instruction, that raw data is mis-interpreted as an infra-function call.
Mark ghashp8-ppc.o as a OBJECT_FILES_NON_STANDARD to avoid this warning.
--- arch/powerpc/crypto/Makefile | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/crypto/Makefile +1 -0
@@ -56,3 +56,4 @@ $(obj)/aesp8-ppc.S $(obj)/ghashp8-ppc.S: $(obj)/%.S: $(src)/%.pl FORCE OBJECT_FILES_NON_STANDARD_aesp10-ppc.o := y OBJECT_FILES_NON_STANDARD_ghashp10-ppc.o := y OBJECT_FILES_NON_STANDARD_aesp8-ppc.o := y +OBJECT_FILES_NON_STANDARD_ghashp8-ppc.o := y
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 101/499 powerpc/kexec: fix physical address calculation in clear_utlb_entry()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 861efb8a48ee8b73ae4e8817509cd4e82fd52bc4 ]
In relocate_32.S, function clear_utlb_entry() goes into real mode. To do so, it has to calculate the physical address based on the virtual address. To get the virtual address it uses 'bl' which is problematic (see commit c974809a26a1 ("powerpc/vdso: Avoid link stack corruption in __get_datapage()")). In addition, the calculation is done on a wrong address because 'bl' loads LR with the address of the following instruction, not the address of the target. So when the target is not the instruction following the 'bl' instruction, it may lead to unexpected behaviour.
Fix it by re-writing the code so that is goes via another path which is based 'bcl 20,31,.+4' which is the right instruction to use for that.
--- arch/powerpc/kexec/relocate_32.S | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
arch/powerpc/kexec/relocate_32.S +2 -5
@@ -348,16 +348,13 @@ write_utlb: rlwinm r10, r24, 0, 22, 27 cmpwi r10, PPC47x_TLB0_4K - bne 0f li r10, 0x1000 /* r10 = 4k */ - ANNOTATE_INTRA_FUNCTION_CALL - bl 1f + beq 0f -0: /* Defaults to 256M */ lis r10, 0x1000 - bcl 20,31,$+4 +0: bcl 20,31,$+4 1: mflr r4 addi r4, r4, (2f-1b) /* virtual address of 2f */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 102/499 PCI: Remove stray put_device() in pci_register_host_bridge()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 6e8d06e5096c80cbf41313b4a204f43071ca42be ]
This put_device() was accidentally left over from when we changed the code from using device_register() to calling device_add(). Delete it.
--- drivers/pci/probe.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/pci/probe.c +2 -3
@@ -952,10 +952,9 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge)/* Temporarily move resources off the list */ list_splice_init (&bridge->windows, &resources); err =device_add (&bridge->dev); -if (err) { -put_device (&bridge->dev); +if (err) goto free; - } + bus->bridge =get_device (&bridge->dev);device_enable_async_suspend (bus->bridge);pci_set_bus_of_node (bus);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 103/499 PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thippeswamy Havalige <[email protected]>
[ Upstream commit 57b0302240741e73fe51f88404b3866e0d2933ad ]
The IRQ domain allocated for the PCIe controller is not freed if resource_list_first_type() returns NULL, leading to a resource leak.
This fix ensures properly cleaning up the allocated IRQ domain in the error path.
--- drivers/pci/controller/pcie-xilinx-cpm.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/pci/controller/pcie-xilinx-cpm.c +6 -4
@@ -570,15 +570,17 @@ static int xilinx_cpm_pcie_probe(struct platform_device *pdev)return err; bus =resource_list_first_type (&bridge->windows,IORESOURCE_BUS ); -if (!bus) -return -ENODEV ; +if (!bus) { + err = -ENODEV ; + goto err_free_irq_domains; + } port->variant =of_device_get_match_data (dev); err =xilinx_cpm_pcie_parse_dt (port, bus->res);if (err) {dev_err (dev,"Parsing DT failed\n" ); - goto err_parse_dt; + goto err_free_irq_domains; }xilinx_cpm_pcie_init_port (port);
@@ -602,7 +604,7 @@ static int xilinx_cpm_pcie_probe(struct platform_device *pdev)xilinx_cpm_free_interrupts (port); err_setup_irq:pci_ecam_free (port->cfg); -err_parse_dt: +err_free_irq_domains:xilinx_cpm_free_irq_domains (port);return err; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 104/499 drm/mediatek: Fix config_updating flag never false when no mbox channel
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason-JH Lin <[email protected]>
[ Upstream commit 4ba973c8bad04d59fd4efa62512f4d9cee131714 ]
When CONFIG_MTK_CMDQ is enabled, if the display is controlled by the CPU while other hardware is controlled by the GCE, the display will encounter a mbox request channel failure.
However, it will still enter the CONFIG_MTK_CMDQ statement, causing the config_updating flag to never be set to false. As a result, no page flip event is sent back to user space, and the screen does not update.
--- drivers/gpu/drm/mediatek/mtk_crtc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpu/drm/mediatek/mtk_crtc.c +5 -2
@@ -620,13 +620,16 @@ static void mtk_crtc_update_config(struct mtk_crtc *mtk_crtc, bool needs_vblank)mbox_send_message (mtk_crtc->cmdq_client.chan, cmdq_handle);mbox_client_txdone (mtk_crtc->cmdq_client.chan,0 ); + goto update_config_out; } -#else +#endif spin_lock_irqsave (&mtk_crtc->config_lock, flags); mtk_crtc->config_updating = false;spin_unlock_irqrestore (&mtk_crtc->config_lock, flags); -#endif +#if IS_REACHABLE (CONFIG_MTK_CMDQ ) +update_config_out: +#endif mutex_unlock (&mtk_crtc->hw_lock); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 105/499 drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 106a6de46cf4887d535018185ec528ce822d6d84 ]
The function mtk_dp_wait_hpd_asserted() may be called before the mtk_dp->drm_dev pointer is assigned in mtk_dp_bridge_attach(). Specifically it can be called via this callpath:
- mtk_edp_wait_hpd_asserted
- [panel probe]
- dp_aux_ep_probe
Using "drm" level prints anywhere in this callpath causes a NULL pointer dereference. Change the error message directly in mtk_dp_wait_hpd_asserted() to dev_err() to avoid this. Also change the error messages in mtk_dp_parse_capabilities(), which is called by mtk_dp_wait_hpd_asserted().
While touching these prints, also add the error code to them to make future debugging easier.
--- drivers/gpu/drm/mediatek/mtk_dp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/mediatek/mtk_dp.c +3 -3
@@ -1746,7 +1746,7 @@ static int mtk_dp_parse_capabilities(struct mtk_dp *mtk_dp) ret =drm_dp_dpcd_readb (&mtk_dp->aux,DP_MSTM_CAP , &val);if (ret <1 ) { -drm_err (mtk_dp->drm_dev,"Read mstm cap failed\n" ); +dev_err (mtk_dp->dev,"Read mstm cap failed: %zd\n" , ret);return ret ==0 ? -EIO : ret; }
@@ -1756,7 +1756,7 @@ static int mtk_dp_parse_capabilities(struct mtk_dp *mtk_dp)DP_DEVICE_SERVICE_IRQ_VECTOR_ESI0 , &val);if (ret <1 ) { -drm_err (mtk_dp->drm_dev,"Read irq vector failed\n" ); +dev_err (mtk_dp->dev,"Read irq vector failed: %zd\n" , ret);return ret ==0 ? -EIO : ret; }
@@ -2039,7 +2039,7 @@ static int mtk_dp_wait_hpd_asserted(struct drm_dp_aux *mtk_aux, unsigned long wa ret =mtk_dp_parse_capabilities (mtk_dp);if (ret) { -drm_err (mtk_dp->drm_dev,"Can't parse capabilities\n" ); +dev_err (mtk_dp->dev,"Can't parse capabilities: %d\n" , ret);return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 106/499 drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit dcb166ee43c3d594e7b73a24f6e8cf5663eeff2c ]
There is a type bug because the return statement:
return ret < 0 ? ret : recv_cnt;
The issue is that ret is an int, recv_cnt is a u32 and the function returns ssize_t, which is a signed long. The way that the type promotion works is that the negative error codes are first cast to u32 and then to signed long. The error codes end up being positive instead of negative and the callers treat them as success.
--- drivers/gpu/drm/mediatek/mtk_dsi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/mediatek/mtk_dsi.c +3 -3
@@ -1116,12 +1116,12 @@ static ssize_t mtk_dsi_host_transfer(struct mipi_dsi_host *host, const struct mipi_dsi_msg *msg) {struct mtk_dsi *dsi =host_to_dsi (host); -u32 recv_cnt, i; +ssize_t recv_cnt;u8 read_data[16 ];void *src_addr;u8 irq_flag =CMD_DONE_INT_FLAG ;u32 dsi_mode; -int ret; +int ret, i; dsi_mode =readl (dsi->regs +DSI_MODE_CTRL );if (dsi_mode &MODE ) {
@@ -1170,7 +1170,7 @@ static ssize_t mtk_dsi_host_transfer(struct mipi_dsi_host *host,if (recv_cnt)memcpy (msg->rx_buf, src_addr, recv_cnt); -DRM_INFO ("dsi get %d byte data from the panel address(0x%x)\n" , +DRM_INFO ("dsi get %zd byte data from the panel address(0x%x)\n" , recv_cnt, *((u8 *)(msg->tx_buf))); restore_dsi_mode:
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 107/499 drm/amd/display: avoid NPD when ASIC does not support DMUB
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
[ Upstream commit 42d9d7bed270247f134190ba0cb05bbd072f58c2 ]
ctx->dmub_srv will de NULL if the ASIC does not support DMUB, which is tested in dm_dmub_sw_init.
However, it will be dereferenced in dmub_hw_lock_mgr_cmd if should_use_dmub_lock returns true.
This has been the case since dmub support has been added for PSR1.
Fix this by checking for dmub_srv in should_use_dmub_lock.
[ 37.440832] BUG: kernel NULL pointer dereference, address: 0000000000000058 [ 37.447808] #PF: supervisor read access in kernel mode [ 37.452959] #PF: error_code(0x0000) - not-present page [ 37.458112] PGD 0 P4D 0 [ 37.460662] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI [ 37.465553] CPU: 2 UID: 1000 PID: 1745 Comm: DrmThread Not tainted 6.14.0-rc1-00003-gd62e938120f0 #23 99720e1cb1e0fc4773b8513150932a07de3c6e88 [ 37.478324] Hardware name: Google Morphius/Morphius, BIOS Google_Morphius.13434.858.0 10/26/2023 [ 37.487103] RIP: 0010:dmub_hw_lock_mgr_cmd+0x77/0xb0 [ 37.492074] Code: 44 24 0e 00 00 00 00 48 c7 04 24 45 00 00 0c 40 88 74 24 0d 0f b6 02 88 44 24 0c 8b 01 89 44 24 08 85 f6 75 05 c6 44 24 0e 01 <48> 8b 7f 58 48 89 e6 ba 01 00 00 00 e8 08 3c 2a 00 65 48 8b 04 5 [ 37.510822] RSP: 0018:ffff969442853300 EFLAGS: 00010202 [ 37.516052] RAX: 0000000000000000 RBX: ffff92db03000000 RCX: ffff969442853358 [ 37.523185] RDX: ffff969442853368 RSI: 0000000000000001 RDI: 0000000000000000 [ 37.530322] RBP: 0000000000000001 R08: 00000000000004a7 R09: 00000000000004a5 [ 37.537453] R10: 0000000000000476 R11: 0000000000000062 R12: ffff92db0ade8000 [ 37.544589] R13: ffff92da01180ae0 R14: ffff92da011802a8 R15: ffff92db03000000 [ 37.551725] FS: 0000784a9cdfc6c0(0000) GS:ffff92db2af00000(0000) knlGS:0000000000000000 [ 37.559814] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.565562] CR2: 0000000000000058 CR3: 0000000112b1c000 CR4: 00000000003506f0 [ 37.572697] Call Trace: [ 37.575152] <TASK> [ 37.577258] ? __die_body+0x66/0xb0 [ 37.580756] ? page_fault_oops+0x3e7/0x4a0 [ 37.584861] ? exc_page_fault+0x3e/0xe0 [ 37.588706] ? exc_page_fault+0x5c/0xe0 [ 37.592550] ? asm_exc_page_fault+0x22/0x30 [ 37.596742] ? dmub_hw_lock_mgr_cmd+0x77/0xb0 [ 37.601107] dcn10_cursor_lock+0x1e1/0x240 [ 37.605211] program_cursor_attributes+0x81/0x190 [ 37.609923] commit_planes_for_stream+0x998/0x1ef0 [ 37.614722] update_planes_and_stream_v2+0x41e/0x5c0 [ 37.619703] dc_update_planes_and_stream+0x78/0x140 [ 37.624588] amdgpu_dm_atomic_commit_tail+0x4362/0x49f0 [ 37.629832] ? srso_return_thunk+0x5/0x5f [ 37.633847] ? mark_held_locks+0x6d/0xd0 [ 37.637774] ? _raw_spin_unlock_irq+0x24/0x50 [ 37.642135] ? srso_return_thunk+0x5/0x5f [ 37.646148] ? lockdep_hardirqs_on+0x95/0x150 [ 37.650510] ? srso_return_thunk+0x5/0x5f [ 37.654522] ? _raw_spin_unlock_irq+0x2f/0x50 [ 37.658883] ? srso_return_thunk+0x5/0x5f [ 37.662897] ? wait_for_common+0x186/0x1c0 [ 37.666998] ? srso_return_thunk+0x5/0x5f [ 37.671009] ? drm_crtc_next_vblank_start+0xc3/0x170 [ 37.675983] commit_tail+0xf5/0x1c0 [ 37.679478] drm_atomic_helper_commit+0x2a2/0x2b0 [ 37.684186] drm_atomic_commit+0xd6/0x100 [ 37.688199] ? __cfi___drm_printfn_info+0x10/0x10 [ 37.692911] drm_atomic_helper_update_plane+0xe5/0x130 [ 37.698054] drm_mode_cursor_common+0x501/0x670 [ 37.702600] ? __cfi_drm_mode_cursor_ioctl+0x10/0x10 [ 37.707572] drm_mode_cursor_ioctl+0x48/0x70 [ 37.711851] drm_ioctl_kernel+0xf2/0x150 [ 37.715781] drm_ioctl+0x363/0x590 [ 37.719189] ? __cfi_drm_mode_cursor_ioctl+0x10/0x10 [ 37.724165] amdgpu_drm_ioctl+0x41/0x80 [ 37.728013] __se_sys_ioctl+0x7f/0xd0 [ 37.731685] do_syscall_64+0x87/0x100 [ 37.735355] ? vma_end_read+0x12/0xe0 [ 37.739024] ? srso_return_thunk+0x5/0x5f [ 37.743041] ? find_held_lock+0x47/0xf0 [ 37.746884] ? vma_end_read+0x12/0xe0 [ 37.750552] ? srso_return_thunk+0x5/0x5f [ 37.754565] ? lock_release+0x1c4/0x2e0 [ 37.758406] ? vma_end_read+0x12/0xe0 [ 37.762079] ? exc_page_fault+0x84/0xe0 [ 37.765921] ? srso_return_thunk+0x5/0x5f [ 37.769938] ? lockdep_hardirqs_on+0x95/0x150 [ 37.774303] ? srso_return_thunk+0x5/0x5f [ 37.778317] ? exc_page_fault+0x84/0xe0 [ 37.782163] entry_SYSCALL_64_after_hwframe+0x55/0x5d [ 37.787218] RIP: 0033:0x784aa5ec3059 [ 37.790803] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 77 1d 48 8b 45 c8 64 48 2b 04 25 28 00 0 [ 37.809553] RSP: 002b:0000784a9cdf90e0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 37.817121] RAX: ffffffffffffffda RBX: 0000784a9cdf917c RCX: 0000784aa5ec3059 [ 37.824256] RDX: 0000784a9cdf917c RSI: 00000000c01c64a3 RDI: 0000000000000020 [ 37.831391] RBP: 0000784a9cdf9130 R08: 0000000000000100 R09: 0000000000ff0000 [ 37.838525] R10: 0000000000000000 R11: 0000000000000246 R12: 0000025c01606ed0 [ 37.845657] R13: 0000025c00030200 R14: 00000000c01c64a3 R15: 0000000000000020 [ 37.852799] </TASK> [ 37.854992] Modules linked in: [ 37.864546] gsmi: Log Shutdown Reason 0x03 [ 37.868656] CR2: 0000000000000058 [ 37.871979] ---[ end trace 0000000000000000 ]--- [ 37.880976] RIP: 0010:dmub_hw_lock_mgr_cmd+0x77/0xb0 [ 37.885954] Code: 44 24 0e 00 00 00 00 48 c7 04 24 45 00 00 0c 40 88 74 24 0d 0f b6 02 88 44 24 0c 8b 01 89 44 24 08 85 f6 75 05 c6 44 24 0e 01 <48> 8b 7f 58 48 89 e6 ba 01 00 00 00 e8 08 3c 2a 00 65 48 8b 04 5 [ 37.904703] RSP: 0018:ffff969442853300 EFLAGS: 00010202 [ 37.909933] RAX: 0000000000000000 RBX: ffff92db03000000 RCX: ffff969442853358 [ 37.917068] RDX: ffff969442853368 RSI: 0000000000000001 RDI: 0000000000000000 [ 37.924201] RBP: 0000000000000001 R08: 00000000000004a7 R09: 00000000000004a5 [ 37.931336] R10: 0000000000000476 R11: 0000000000000062 R12: ffff92db0ade8000 [ 37.938469] R13: ffff92da01180ae0 R14: ffff92da011802a8 R15: ffff92db03000000 [ 37.945602] FS: 0000784a9cdfc6c0(0000) GS:ffff92db2af00000(0000) knlGS:0000000000000000 [ 37.953689] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.959435] CR2: 0000000000000058 CR3: 0000000112b1c000 CR4: 00000000003506f0 [ 37.966570] Kernel panic - not syncing: Fatal exception [ 37.971901] Kernel Offset: 0x30200000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 37.982840] gsmi: Log Shutdown Reason 0x02
--- drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c +4 -0
@@ -63,6 +63,10 @@ void dmub_hw_lock_mgr_inbox0_cmd(struct dc_dmub_srv *dmub_srv,bool should_use_dmub_lock (struct dc_link *link) { +/* ASIC doesn't support DMUB */ +if (!link->ctx->dmub_srv) +return false; +if (link->psr_settings.psr_version ==DC_PSR_VERSION_SU_1 )return true;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 108/499 PCI: dwc: ep: Return -ENOMEM for allocation failures
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 8189aa56dbed0bfb46b7b30d4d231f57ab17b3f4 ]
If the bitmap or memory allocations fail, then dw_pcie_ep_init_registers() will incorrectly return a success.
Return -ENOMEM instead.
--- drivers/pci/controller/dwc/pcie-designware-ep.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/controller/dwc/pcie-designware-ep.c +1 -0
@@ -771,6 +771,7 @@ int dw_pcie_ep_init_registers(struct dw_pcie_ep *ep)if (ret)return ret; + ret = -ENOMEM ;if (!ep->ib_window_map) { ep->ib_window_map =devm_bitmap_zalloc (dev, pci->num_ib_windows,GFP_KERNEL );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 109/499 PCI: histb: Fix an error handling path in histb_pcie_probe()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit b36fb50701619efca5f5450b355d42575cf532ed ]
If an error occurs after a successful phy_init() call, then phy_exit() should be called.
Add the missing call, as already done in the remove function.
[kwilczynski: remove unnecessary hipcie->phy NULL check from histb_pcie_probe() and squash a patch that removes similar NULL check for hipcie-phy from histb_pcie_remove() from
https://lore.kernel.org/linux-pci/c369b5d25e17a44984ae5a889ccc28a59a0737f7.1742058005.git.christophe.jaillet@wanadoo.fr]
--- drivers/pci/controller/dwc/pcie-histb.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/pci/controller/dwc/pcie-histb.c +8 -4
@@ -409,16 +409,21 @@ static int histb_pcie_probe(struct platform_device *pdev) ret =histb_pcie_host_enable (pp);if (ret) {dev_err (dev,"failed to enable host\n" ); -return ret; + goto err_exit_phy; } ret =dw_pcie_host_init (pp);if (ret) {dev_err (dev,"failed to initialize host\n" ); -return ret; + goto err_exit_phy; }return 0 ; + +err_exit_phy: +phy_exit (hipcie->phy); + +return ret; }static void histb_pcie_remove (struct platform_device *pdev)
@@ -427,8 +432,7 @@ static void histb_pcie_remove(struct platform_device *pdev)histb_pcie_host_disable (hipcie); -if (hipcie->phy) -phy_exit (hipcie->phy); +phy_exit (hipcie->phy); }static const struct of_device_id histb_pcie_of_match[] = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 110/499 PCI: Fix BAR resizing when VF BARs are assigned
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 9ec19bfa78bd788945e2445b09de7b4482dee432 ]
__resource_resize_store() attempts to release all resources of the device before attempting the resize. The loop, however, only covers standard BARs (< PCI_STD_NUM_BARS). If a device has VF BARs that are assigned, pci_reassign_bridge_resources() finds the bridge window still has some assigned child resources and returns -NOENT which makes pci_resize_resource() to detect an error and abort the resize.
Change the release loop to cover all resources up to VF BARs which allows the resize operation to release the bridge windows and attempt to assigned them again with the different size.
If SR-IOV is enabled, disallow resize as it requires releasing also IOV resources.
--- drivers/pci/pci-sysfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/pci-sysfs.c +2 -2
@@ -1448,7 +1448,7 @@ static ssize_t __resource_resize_store(struct device *dev, int n,return -EINVAL ;device_lock (dev); -if (dev->driver) { +if (dev->driver ||pci_num_vf (pdev)) { ret = -EBUSY ; goto unlock; }
@@ -1470,7 +1470,7 @@ static ssize_t __resource_resize_store(struct device *dev, int n,pci_remove_resource_files (pdev); -for (i =0 ; i <PCI_STD_NUM_BARS ; i++) { +for (i =0 ; i <PCI_BRIDGE_RESOURCES ; i++) {if (pci_resource_len (pdev, i) &&pci_resource_flags (pdev, i) == flags)pci_release_resource (pdev, i);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 111/499 PCI: pciehp: Dont enable HPIE when resuming in poll mode
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 527664f738afb6f2c58022cd35e63801e5dc7aec ]
PCIe hotplug can operate in poll mode without interrupt handlers using a polling kthread only. eb34da60edee ("PCI: pciehp: Disable hotplug interrupt during suspend") failed to consider that and enables HPIE (Hot-Plug Interrupt Enable) unconditionally when resuming the Port.
Only set HPIE if non-poll mode is in use. This makes pcie_enable_interrupt() match how pcie_enable_notification() already handles HPIE.
--- drivers/pci/hotplug/pciehp_hpc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/pci/hotplug/pciehp_hpc.c +3 -1
@@ -842,7 +842,9 @@ void pcie_enable_interrupt(struct controller *ctrl) {u16 mask; - mask =PCI_EXP_SLTCTL_HPIE |PCI_EXP_SLTCTL_DLLSCE ; + mask =PCI_EXP_SLTCTL_DLLSCE ; +if (!pciehp_poll_mode) + mask |=PCI_EXP_SLTCTL_HPIE ;pcie_write_cmd (ctrl, mask, mask); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 112/499 PCI/bwctrl: Fix pcie_bwctrl_select_speed() return type
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 026e4bffb0af9632f5a0bbf8d594f2aace44cf07 ]
pcie_bwctrl_select_speed() should take __fls() of the speed bit, not return it as a raw value. Instead of directly returning 2.5GT/s speed bit, simply assign the fallback speed (2.5GT/s) into supported_speeds variable to share the normal return path that calls pcie_supported_speeds2target_speed() to calculate __fls().
This code path is not very likely to execute because pcie_get_supported_speeds() should provide valid ->supported_speeds but a spec violating device could fail to synthesize any speed in pcie_get_supported_speeds(). It could also happen in case the supported_speeds intersection is empty (also a violation of the current PCIe specs).
--- drivers/pci/pcie/bwctrl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/pcie/bwctrl.c +1 -1
@@ -113,7 +113,7 @@ static u16 pcie_bwctrl_select_speed(struct pci_dev *port, enum pci_bus_speed speup_read (&pci_bus_sem); }if (!supported_speeds) -return PCI_EXP_LNKCAP2_SLS_2_5GB ; + supported_speeds =PCI_EXP_LNKCAP2_SLS_2_5GB ;return pcie_supported_speeds2target_speed (supported_speeds & desired_speeds); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 113/499 io_uring/net: improve recv bundles
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
[ Upstream commit 7c71a0af81ba72de9b2c501065e4e718aba9a271 ]
Current recv bundles are only supported for multishot receives, and additionally they also always post at least 2 CQEs if more data is available than what a buffer will hold. This happens because the initial bundle recv will do a single buffer, and then do the rest of what is in the socket as a followup receive. As shown in a test program, if 1k buffers are available and 32k is available to receive in the socket, you'd get the following completions:
bundle=1, mshot=0
cqe res 1024
cqe res 1024
[...]
cqe res 1024
bundle=1, mshot=1
cqe res 1024
cqe res 31744
where bundle=1 && mshot=0 will post 32 1k completions, and bundle=1 && mshot=1 will post a 1k completion and then a 31k completion.
To support bundle recv without multishot, it's possible to simply retry the recv immediately and post a single completion, rather than split it into two completions. With the below patch, the same test looks as follows:
bundle=1, mshot=0
cqe res 32768
bundle=1, mshot=1
cqe res 32768
where mshot=0 works fine for bundles, and both of them post just a single 32k completion rather than split it into separate completions. Posting fewer completions is always a nice win, and not needing multishot for proper bundle efficiency is nice for cases that can't necessarily use multishot.
--- io_uring/net.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
io_uring/net.c +18 -0
@@ -76,6 +76,7 @@ struct io_sr_msg {/* initialised and used only by !msg send variants */ u16 buf_group;u16 buf_index; +bool retry;void __user *msg_control;/* used only for send zerocopy */ struct io_kiocb *notif;
@@ -202,6 +203,7 @@ static inline void io_mshot_prep_retry(struct io_kiocb *req, req->flags &= ~REQ_F_BL_EMPTY ; sr->done_io =0 ; + sr->retry = false; sr->len =0 ;/* get from the provided buffer */ req->buf_index = sr->buf_group; }
@@ -416,6 +418,7 @@ int io_sendmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg); sr->done_io =0 ; + sr->retry = false;if (req->opcode !=IORING_OP_SEND ) {if (sqe->addr2 || sqe->file_index)
@@ -785,6 +788,7 @@ int io_recvmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg); sr->done_io =0 ; + sr->retry = false;if (unlikely (sqe->file_index || sqe->addr2))return -EINVAL ;
@@ -833,6 +837,9 @@ int io_recvmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)return io_recvmsg_prep_setup (req); } +/* bits to clear in old and inherit in new cflags on bundle retry */ +#define CQE_F_MASK (IORING_CQE_F_SOCK_NONEMPTY|IORING_CQE_F_MORE) +/* * Finishes io_recv and io_recvmsg. *
@@ -852,9 +859,19 @@ static inline bool io_recv_finish(struct io_kiocb *req, int *ret,if (sr->flags &IORING_RECVSEND_BUNDLE ) { cflags |=io_put_kbufs (req, *ret,io_bundle_nbufs (kmsg, *ret), issue_flags); +if (sr->retry) + cflags = req->cqe.flags | (cflags &CQE_F_MASK );/* bundle with no more immediate buffers, we're done */ if (req->flags &REQ_F_BL_EMPTY ) goto finish; +/* if more is available, retry and append to this one */ +if (!sr->retry && kmsg->msg.msg_inq >0 && *ret >0 ) { + req->cqe.flags = cflags & ~CQE_F_MASK ; + sr->len = kmsg->msg.msg_inq; + sr->done_io += *ret; + sr->retry = true; +return false; + } }else { cflags |=io_put_kbuf (req, *ret, issue_flags); }
@@ -1233,6 +1250,7 @@ int io_send_zc_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)struct io_kiocb *notif; zc->done_io =0 ; + zc->retry = false; req->flags |=REQ_F_POLL_NO_LAZY ;if (unlikely (READ_ONCE (sqe->__pad2[0 ]) ||READ_ONCE (sqe->addr3)))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 114/499 io_uring/net: only import send_zc buffer once
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Caleb Sander Mateos <[email protected]>
[ Upstream commit 8e3100fcc5cbba03518b8b5c059624aba5c29d50 ]
io_send_zc() guards its call to io_send_zc_import() with if (!done_io) in an attempt to avoid calling it redundantly on the same req. However, if the initial non-blocking issue returns -EAGAIN, done_io will stay 0. This causes the subsequent issue to unnecessarily re-import the buffer.
Add an explicit flag "imported" to io_sr_msg to track if its buffer has already been imported. Clear the flag in io_send_zc_prep(). Call io_send_zc_import() and set the flag in io_send_zc() if it is unset.
--- io_uring/net.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
io_uring/net.c +4 -1
@@ -77,6 +77,7 @@ struct io_sr_msg {u16 buf_group;u16 buf_index;bool retry; +bool imported;/* only for io_send_zc */ void __user *msg_control;/* used only for send zerocopy */ struct io_kiocb *notif;
@@ -1251,6 +1252,7 @@ int io_send_zc_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) zc->done_io =0 ; zc->retry = false; + zc->imported = false; req->flags |=REQ_F_POLL_NO_LAZY ;if (unlikely (READ_ONCE (sqe->__pad2[0 ]) ||READ_ONCE (sqe->addr3)))
@@ -1413,7 +1415,8 @@ int io_send_zc(struct io_kiocb *req, unsigned int issue_flags) (zc->flags & IORING_RECVSEND_POLL_FIRST))return -EAGAIN ; -if (!zc->done_io) { +if (!zc->imported) { + zc->imported = true; ret =io_send_zc_import (req, issue_flags);if (unlikely (ret))return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 115/499 PCI: Fix NULL dereference in SR-IOV VF creation error path
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shay Drory <[email protected]>
[ Upstream commit 04d50d953ab46d96b0b32d5ad955fceaa28622db ]
Clean up when virtfn setup fails to prevent NULL pointer dereference during device removal. The kernel oops below occurred due to incorrect error handling flow when pci_setup_device() fails.
Add pci_iov_scan_device(), which handles virtfn allocation and setup and cleans up if pci_setup_device() fails, so pci_iov_add_virtfn() doesn't need to call pci_stop_and_remove_bus_device(). This prevents accessing partially initialized virtfn devices during removal.
BUG: kernel NULL pointer dereference, address: 00000000000000d0 RIP: 0010:device_del+0x3d/0x3d0 Call Trace: pci_remove_bus_device+0x7c/0x100 pci_iov_add_virtfn+0xfa/0x200 sriov_enable+0x208/0x420 mlx5_core_sriov_configure+0x6a/0x160 [mlx5_core] sriov_numvfs_store+0xae/0x1a0
--- drivers/pci/iov.c | 48 +++++++++++++++++++++++++++++++++-------------- 1 file changed, 34 insertions(+), 14 deletions(-)
drivers/pci/iov.c +34 -14
@@ -285,23 +285,16 @@ const struct attribute_group sriov_vf_dev_attr_group = { .is_visible = sriov_vf_attrs_are_visible, }; -int pci_iov_add_virtfn (struct pci_dev *dev,int id) +static struct pci_dev *pci_iov_scan_device (struct pci_dev *dev,int id, +struct pci_bus *bus) { -int i; -int rc = -ENOMEM ; -u64 size; -struct pci_dev *virtfn; -struct resource *res;struct pci_sriov *iov = dev->sriov; -struct pci_bus *bus; - - bus =virtfn_add_bus (dev->bus,pci_iov_virtfn_bus (dev, id)); -if (!bus) - goto failed; +struct pci_dev *virtfn; +int rc; virtfn =pci_alloc_dev (bus);if (!virtfn) - goto failed0; +return ERR_PTR (-ENOMEM ); virtfn->devfn =pci_iov_virtfn_devfn (dev, id); virtfn->vendor = dev->vendor;
@@ -314,8 +307,35 @@ int pci_iov_add_virtfn(struct pci_dev *dev, int id)pci_read_vf_config_common (virtfn); rc =pci_setup_device (virtfn); -if (rc) - goto failed1; +if (rc) { +pci_dev_put (dev); +pci_bus_put (virtfn->bus); +kfree (virtfn); +return ERR_PTR (rc); + } + +return virtfn; +} + +int pci_iov_add_virtfn (struct pci_dev *dev,int id) +{ +struct pci_bus *bus; +struct pci_dev *virtfn; +struct resource *res; +int rc, i; +u64 size; + + bus =virtfn_add_bus (dev->bus,pci_iov_virtfn_bus (dev, id)); +if (!bus) { + rc = -ENOMEM ; + goto failed; + } + + virtfn =pci_iov_scan_device (dev, id, bus); +if (IS_ERR (virtfn)) { + rc =PTR_ERR (virtfn); + goto failed0; + } virtfn->dev.parent = dev->dev.parent; virtfn->multifunction =0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 116/499 fbdev: au1100fb: Move a variable assignment behind a null pointer check
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Elfring <[email protected]>
[ Upstream commit 2df2c0caaecfd869b49e14f2b8df822397c5dd7f ]
The address of a data structure member was determined before a corresponding null pointer check in the implementation of the function “au1100fb_setmode”.
This issue was detected by using the Coccinelle software.
--- drivers/video/fbdev/au1100fb.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/video/fbdev/au1100fb.c +3 -1
@@ -137,13 +137,15 @@ static int au1100fb_fb_blank(int blank_mode, struct fb_info *fbi)*/ int au1100fb_setmode (struct au1100fb_device *fbdev) { -struct fb_info *info = &fbdev->info; +struct fb_info *info;u32 words;int index;if (!fbdev)return -EINVAL ; + info = &fbdev->info; +/* Update var-dependent FB info */ if (panel_is_active (fbdev->panel) ||panel_is_color (fbdev->panel)) {if (info->var.bits_per_pixel <=8 ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 117/499 dummycon: fix default rows/cols
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit beefaba1978c04ea2950d34236f58fe6cf6a7f58 ]
dummycon fails to build on ARM/footbridge when the VGA console is disabled, since I got the dependencies slightly wrong in a previous patch:
drivers/video/console/dummycon.c: In function 'dummycon_init':drivers/video/console/dummycon.c:27:25: error: 'CONFIG_DUMMY_CONSOLE_COLUMNS' undeclared (first use in this function); did you mean 'CONFIG_DUMMY_CONSOLE'?
27 | #define DUMMY_COLUMNS CONFIG_DUMMY_CONSOLE_COLUMNSdrivers/video/console/dummycon.c:28:25: error: 'CONFIG_DUMMY_CONSOLE_ROWS' undeclared (first use in this function); did you mean 'CONFIG_DUMMY_CONSOLE'?
28 | #define DUMMY_ROWS CONFIG_DUMMY_CONSOLE_ROWS
This only showed up after many thousand randconfig builds on Arm, and doesn't matter in practice, but should still be fixed. Address it by using the default row/columns on footbridge after all in that corner case.
--- drivers/video/console/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/video/console/Kconfig +2 -2
@@ -52,7 +52,7 @@ config DUMMY_CONSOLE config DUMMY_CONSOLE_COLUMNS int "Initial number of console screen columns" - depends on DUMMY_CONSOLE && !ARCH_FOOTBRIDGE + depends on DUMMY_CONSOLE && !(ARCH_FOOTBRIDGE && VGA_CONSOLE) default 160 if PARISC default 80 help
@@ -62,7 +62,7 @@ config DUMMY_CONSOLE_COLUMNS config DUMMY_CONSOLE_ROWS int "Initial number of console screen rows" - depends on DUMMY_CONSOLE && !ARCH_FOOTBRIDGE + depends on DUMMY_CONSOLE && !(ARCH_FOOTBRIDGE && VGA_CONSOLE) default 64 if PARISC default 30 if ARM default 25
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 118/499 mdacon: rework dependency list
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 5bbcc7645f4b244ffb5ac6563fbe9d3d42194447 ]
mdacon has roughly the same dependencies as vgacon but expresses them as a negative list instead of a positive list, with the only practical difference being PowerPC/CHRP, which uses vga16fb instead of vgacon.
The CONFIG_MDA_CONSOLE description advises to only turn it on when vgacon is also used because MDA/Hercules-only systems should be using vgacon instead, so just change the list to enforce that directly for simplicity.
The probing was broken from 2002 to 2008, this improves on the fix that was added then: If vgacon is a loadable module, then mdacon cannot be built-in now, and the list of systems that support vgacon is carried over.
--- drivers/video/console/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/console/Kconfig +1 -1
@@ -24,7 +24,7 @@ config VGA_CONSOLE Say Y. config MDA_CONSOLE - depends on !M68K && !PARISC && ISA + depends on VGA_CONSOLE && ISA tristate "MDA text console (dual-headed)" help Say Y here if you have an old MDA or monochrome Hercules graphics
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 119/499 fbdev: sm501fb: Add some geometry checks.
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danila Chernetsov <[email protected]>
[ Upstream commit aee50bd88ea5fde1ff4cc021385598f81a65830c ]
Added checks for xoffset, yoffset settings. Incorrect settings of these parameters can lead to errors in sm501fb_pan_ functions.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/video/fbdev/sm501fb.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/video/fbdev/sm501fb.c +7 -0
@@ -326,6 +326,13 @@ static int sm501fb_check_var(struct fb_var_screeninfo *var,if (var->xres_virtual >4096 || var->yres_virtual >2048 )return -EINVAL ; +/* geometry sanity checks */ +if (var->xres + var->xoffset > var->xres_virtual) +return -EINVAL ; + +if (var->yres + var->yoffset > var->yres_virtual) +return -EINVAL ; +/* can cope with 8,16 or 32bpp */ if (var->bits_per_pixel <=8 )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 120/499 crypto: iaa - Test the correct request flag
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit fc4bd01d9ff592f620c499686245c093440db0e8 ]
Test the correct flags for the MAY_SLEEP bit.
--- drivers/crypto/intel/iaa/iaa_crypto_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/crypto/intel/iaa/iaa_crypto_main.c +2 -2
@@ -1537,7 +1537,7 @@ static int iaa_comp_acompress(struct acomp_req *req) iaa_wq =idxd_wq_get_private (wq);if (!req->dst) { -gfp_t flags = req->flags &CRYPTO_TFM_REQ_MAY_SLEEP ?GFP_KERNEL :GFP_ATOMIC ; +gfp_t flags = req->base.flags &CRYPTO_TFM_REQ_MAY_SLEEP ?GFP_KERNEL :GFP_ATOMIC ;/* incompressible data will always be < 2 * slen */ req->dlen =2 * req->slen;
@@ -1619,7 +1619,7 @@ static int iaa_comp_acompress(struct acomp_req *req)static int iaa_comp_adecompress_alloc_dest (struct acomp_req *req) { -gfp_t flags = req->flags &CRYPTO_TFM_REQ_MAY_SLEEP ? +gfp_t flags = req->base.flags &CRYPTO_TFM_REQ_MAY_SLEEP ?GFP_KERNEL :GFP_ATOMIC ;struct crypto_tfm *tfm = req->base.tfm;dma_addr_t src_addr, dst_addr;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 121/499 crypto: qat - set parity error mask for qat_420xx
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bairavi Alagappan <[email protected]>
[ Upstream commit f9555d18084985c80a91baa4fdb7d205b401a754 ]
The field parerr_wat_wcp_mask in the structure adf_dev_err_mask enables the detection and reporting of parity errors for the wireless cipher and wireless authentication accelerators.
Set the parerr_wat_wcp_mask field, which was inadvertently omitted during the initial enablement of the qat_420xx driver, to ensure that parity errors are enabled for those accelerators.
In addition, fix the string used to report such errors that was inadvertently set to "ath_cph" (authentication and cipher).
--- drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c | 1 + drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-)
drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c +1 -0
@@ -420,6 +420,7 @@ static void adf_gen4_set_err_mask(struct adf_dev_err_mask *dev_err_mask) dev_err_mask->parerr_cpr_xlt_mask =ADF_420XX_PARITYERRORMASK_CPR_XLT_MASK ; dev_err_mask->parerr_dcpr_ucs_mask =ADF_420XX_PARITYERRORMASK_DCPR_UCS_MASK ; dev_err_mask->parerr_pke_mask =ADF_420XX_PARITYERRORMASK_PKE_MASK ; + dev_err_mask->parerr_wat_wcp_mask =ADF_420XX_PARITYERRORMASK_WAT_WCP_MASK ; dev_err_mask->ssmfeatren_mask =ADF_420XX_SSMFEATREN_MASK ; }
drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c +1 -1
@@ -695,7 +695,7 @@ static bool adf_handle_slice_hang_error(struct adf_accel_dev *accel_dev,if (err_mask->parerr_wat_wcp_mask)adf_poll_slicehang_csr (accel_dev, csr,ADF_GEN4_SLICEHANGSTATUS_WAT_WCP , -"ath_cph" ); +"wat_wcp" );return false; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 122/499 crypto: tegra - Use separate buffer for setkey
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil R <[email protected]>
[ Upstream commit bcfc8fc53f3acb3213fb9d28675244aa4ce208e0 ]
The buffer which sends the commands to host1x was shared for all tasks in the engine. This causes a problem with the setkey() function as it gets called asynchronous to the crypto engine queue. Modifying the same cmdbuf in setkey() will corrupt the ongoing host1x task and in turn break the encryption/decryption operation. Hence use a separate cmdbuf for setkey().
--- drivers/crypto/tegra/tegra-se-aes.c | 16 ++++++++-------- drivers/crypto/tegra/tegra-se-hash.c | 13 +++++++------ drivers/crypto/tegra/tegra-se-key.c | 10 ++++++++-- drivers/crypto/tegra/tegra-se-main.c | 16 ++++++++++++---- drivers/crypto/tegra/tegra-se.h | 3 ++- 5 files changed, 37 insertions(+), 21 deletions(-)
drivers/crypto/tegra/tegra-se-aes.c +8 -8
@@ -282,7 +282,7 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq)/* Prepare the command and submit for execution */ cmdlen =tegra_aes_prep_cmd (ctx, rctx); - ret =tegra_se_host1x_submit (se, cmdlen); + ret =tegra_se_host1x_submit (se, se->cmdbuf, cmdlen);/* Copy the result */ tegra_aes_update_iv (req, ctx);
@@ -719,7 +719,7 @@ static int tegra_gcm_do_gmac(struct tegra_aead_ctx *ctx, struct tegra_aead_reqct cmdlen =tegra_gmac_prep_cmd (ctx, rctx); -return tegra_se_host1x_submit (se, cmdlen); +return tegra_se_host1x_submit (se, se->cmdbuf, cmdlen); }static int tegra_gcm_do_crypt (struct tegra_aead_ctx *ctx,struct tegra_aead_reqctx *rctx)
@@ -736,7 +736,7 @@ static int tegra_gcm_do_crypt(struct tegra_aead_ctx *ctx, struct tegra_aead_reqc/* Prepare command and submit */ cmdlen =tegra_gcm_crypt_prep_cmd (ctx, rctx); - ret =tegra_se_host1x_submit (se, cmdlen); + ret =tegra_se_host1x_submit (se, se->cmdbuf, cmdlen);if (ret)return ret;
@@ -759,7 +759,7 @@ static int tegra_gcm_do_final(struct tegra_aead_ctx *ctx, struct tegra_aead_reqc/* Prepare command and submit */ cmdlen =tegra_gcm_prep_final_cmd (se, cpuvaddr, rctx); - ret =tegra_se_host1x_submit (se, cmdlen); + ret =tegra_se_host1x_submit (se, se->cmdbuf, cmdlen);if (ret)return ret;
@@ -891,7 +891,7 @@ static int tegra_ccm_do_cbcmac(struct tegra_aead_ctx *ctx, struct tegra_aead_req/* Prepare command and submit */ cmdlen =tegra_cbcmac_prep_cmd (ctx, rctx); -return tegra_se_host1x_submit (se, cmdlen); +return tegra_se_host1x_submit (se, se->cmdbuf, cmdlen); }static int tegra_ccm_set_msg_len (u8 *block,unsigned int msglen,int csize)
@@ -1098,7 +1098,7 @@ static int tegra_ccm_do_ctr(struct tegra_aead_ctx *ctx, struct tegra_aead_reqctx/* Prepare command and submit */ cmdlen =tegra_ctr_prep_cmd (ctx, rctx); - ret =tegra_se_host1x_submit (se, cmdlen); + ret =tegra_se_host1x_submit (se, se->cmdbuf, cmdlen);if (ret)return ret;
@@ -1519,8 +1519,8 @@ static int tegra_cmac_do_update(struct ahash_request *req)tegra_cmac_paste_result (ctx->se, rctx); cmdlen =tegra_cmac_prep_cmd (ctx, rctx); + ret =tegra_se_host1x_submit (se, se->cmdbuf, cmdlen); - ret =tegra_se_host1x_submit (se, cmdlen);/* * If this is not the final update, copy the intermediate results * from the registers so that it can be used in the next 'update'
@@ -1553,7 +1553,7 @@ static int tegra_cmac_do_final(struct ahash_request *req)/* Prepare command and submit */ cmdlen =tegra_cmac_prep_cmd (ctx, rctx); - ret =tegra_se_host1x_submit (se, cmdlen); + ret =tegra_se_host1x_submit (se, se->cmdbuf, cmdlen);if (ret) goto out;
drivers/crypto/tegra/tegra-se-hash.c +7 -6
@@ -300,8 +300,9 @@ static int tegra_sha_do_update(struct ahash_request *req) {struct tegra_sha_ctx *ctx =crypto_ahash_ctx (crypto_ahash_reqtfm (req));struct tegra_sha_reqctx *rctx =ahash_request_ctx (req); +struct tegra_se *se = ctx->se;unsigned int nblks, nresidue, size, ret; -u32 *cpuvaddr = ctx->se->cmdbuf->addr; +u32 *cpuvaddr = se->cmdbuf->addr; nresidue = (req->nbytes + rctx->residue.size) % rctx->blk_size; nblks = (req->nbytes + rctx->residue.size) / rctx->blk_size;
@@ -353,11 +354,11 @@ static int tegra_sha_do_update(struct ahash_request *req)* This is to support the import/export functionality. */ if (!(rctx->task &SHA_FIRST )) -tegra_sha_paste_hash_result (ctx->se, rctx); +tegra_sha_paste_hash_result (se, rctx); - size =tegra_sha_prep_cmd (ctx->se, cpuvaddr, rctx); + size =tegra_sha_prep_cmd (se, cpuvaddr, rctx); - ret =tegra_se_host1x_submit (ctx->se, size); + ret =tegra_se_host1x_submit (se, se->cmdbuf, size);/* * If this is not the final update, copy the intermediate results
@@ -365,7 +366,7 @@ static int tegra_sha_do_update(struct ahash_request *req)* call. This is to support the import/export functionality. */ if (!(rctx->task &SHA_FINAL )) -tegra_sha_copy_hash_result (ctx->se, rctx); +tegra_sha_copy_hash_result (se, rctx);return ret; }
@@ -388,7 +389,7 @@ static int tegra_sha_do_final(struct ahash_request *req) size =tegra_sha_prep_cmd (se, cpuvaddr, rctx); - ret =tegra_se_host1x_submit (se, size); + ret =tegra_se_host1x_submit (se, se->cmdbuf, size);if (ret) goto out;
drivers/crypto/tegra/tegra-se-key.c +8 -2
@@ -115,11 +115,17 @@ static int tegra_key_insert(struct tegra_se *se, const u8 *key, u32 keylen, u16 slot, u32 alg) { const u32 *keyval = (u32 *)key; -u32 *addr = se->cmdbuf->addr, size; +u32 *addr = se->keybuf->addr, size; +int ret; + +mutex_lock (&kslt_lock); size =tegra_key_prep_ins_cmd (se, addr, keyval, keylen, slot, alg); + ret =tegra_se_host1x_submit (se, se->keybuf, size); -return tegra_se_host1x_submit (se, size); +mutex_unlock (&kslt_lock); + +return ret; }void tegra_key_invalidate (struct tegra_se *se,u32 keyid,u32 alg)
drivers/crypto/tegra/tegra-se-main.c +12 -4
@@ -141,7 +141,7 @@ static struct tegra_se_cmdbuf *tegra_se_host1x_bo_alloc(struct tegra_se *se, ssireturn cmdbuf; } -int tegra_se_host1x_submit (struct tegra_se *se,u32 size) +int tegra_se_host1x_submit (struct tegra_se *se,struct tegra_se_cmdbuf *cmdbuf,u32 size) {struct host1x_job *job;int ret;
@@ -160,9 +160,9 @@ int tegra_se_host1x_submit(struct tegra_se *se, u32 size) job->engine_fallback_streamid = se->stream_id; job->engine_streamid_offset =SE_STREAM_ID ; - se->cmdbuf->words = size; + cmdbuf->words = size; -host1x_job_add_gather (job, &se->cmdbuf->bo, size,0 ); +host1x_job_add_gather (job, &cmdbuf->bo, size,0 ); ret =host1x_job_pin (job, se->dev);if (ret) {
@@ -220,14 +220,22 @@ static int tegra_se_client_init(struct host1x_client *client) goto syncpt_put; } + se->keybuf =tegra_se_host1x_bo_alloc (se,SZ_4K ); +if (!se->keybuf) { + ret = -ENOMEM ; + goto cmdbuf_put; + } + ret = se->hw->init_alg (se);if (ret) {dev_err (se->dev,"failed to register algorithms\n" ); - goto cmdbuf_put; + goto keybuf_put; }return 0 ; +keybuf_put: +tegra_se_cmdbuf_put (&se->keybuf->bo); cmdbuf_put:tegra_se_cmdbuf_put (&se->cmdbuf->bo); syncpt_put:
drivers/crypto/tegra/tegra-se.h +2 -1
@@ -420,6 +420,7 @@ struct tegra_se {struct host1x_client client;struct host1x_channel *channel;struct tegra_se_cmdbuf *cmdbuf; +struct tegra_se_cmdbuf *keybuf;struct crypto_engine *engine;struct host1x_syncpt *syncpt;struct device *dev;
@@ -502,7 +503,7 @@ void tegra_deinit_hash(struct tegra_se *se);int tegra_key_submit (struct tegra_se *se,const u8 *key,u32 keylen,u32 alg,u32 *keyid);void tegra_key_invalidate (struct tegra_se *se,u32 keyid,u32 alg); -int tegra_se_host1x_submit (struct tegra_se *se,u32 size); +int tegra_se_host1x_submit (struct tegra_se *se,struct tegra_se_cmdbuf *cmdbuf,u32 size);/* HOST1x OPCODES */ static inline u32 host1x_opcode_setpayload (unsigned int payload)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 123/499 crypto: tegra - Do not use fixed size buffers
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil R <[email protected]>
[ Upstream commit 1cb328da4e8f34350c61a2b6548766c79b4bb64c ]
Allocate the buffer based on the request instead of a fixed buffer length. In operations which may require larger buffer size, a fixed buffer may fail.
--- drivers/crypto/tegra/tegra-se-aes.c | 124 ++++++++++++++------------- drivers/crypto/tegra/tegra-se-hash.c | 38 +++++--- drivers/crypto/tegra/tegra-se.h | 2 - 3 files changed, 89 insertions(+), 75 deletions(-)
drivers/crypto/tegra/tegra-se-aes.c +64 -60
@@ -263,12 +263,6 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq)unsigned int cmdlen;int ret; - rctx->datbuf.buf =dma_alloc_coherent (se->dev,SE_AES_BUFLEN , - &rctx->datbuf.addr,GFP_KERNEL ); -if (!rctx->datbuf.buf) -return -ENOMEM ; - - rctx->datbuf.size =SE_AES_BUFLEN ; rctx->iv = (u32 *)req->iv; rctx->len = req->cryptlen;
@@ -278,6 +272,12 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq) rctx->len +=AES_BLOCK_SIZE - (rctx->len %AES_BLOCK_SIZE ); } + rctx->datbuf.size = rctx->len; + rctx->datbuf.buf =dma_alloc_coherent (se->dev, rctx->datbuf.size, + &rctx->datbuf.addr,GFP_KERNEL ); +if (!rctx->datbuf.buf) +return -ENOMEM ; +scatterwalk_map_and_copy (rctx->datbuf.buf, req->src,0 , req->cryptlen,0 );/* Prepare the command and submit for execution */
@@ -289,7 +289,7 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq)scatterwalk_map_and_copy (rctx->datbuf.buf, req->dst,0 , req->cryptlen,1 );/* Free the buffer */ -dma_free_coherent (ctx->se->dev,SE_AES_BUFLEN , +dma_free_coherent (ctx->se->dev, rctx->datbuf.size, rctx->datbuf.buf, rctx->datbuf.addr);crypto_finalize_skcipher_request (se->engine, req, ret);
@@ -1117,6 +1117,11 @@ static int tegra_ccm_crypt_init(struct aead_request *req, struct tegra_se *se, rctx->assoclen = req->assoclen; rctx->authsize =crypto_aead_authsize (tfm); +if (rctx->encrypt) + rctx->cryptlen = req->cryptlen; +else + rctx->cryptlen = req->cryptlen - rctx->authsize; +memcpy (iv, req->iv,16 ); ret =tegra_ccm_check_iv (iv);
@@ -1145,30 +1150,26 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq)struct tegra_se *se = ctx->se;int ret; + ret =tegra_ccm_crypt_init (req, se, rctx); +if (ret) +return ret; +/* Allocate buffers required */ - rctx->inbuf.buf =dma_alloc_coherent (ctx->se->dev,SE_AES_BUFLEN , + rctx->inbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen +100 ; + rctx->inbuf.buf =dma_alloc_coherent (ctx->se->dev, rctx->inbuf.size, &rctx->inbuf.addr,GFP_KERNEL );if (!rctx->inbuf.buf)return -ENOMEM ; - rctx->inbuf.size =SE_AES_BUFLEN ; - - rctx->outbuf.buf =dma_alloc_coherent (ctx->se->dev,SE_AES_BUFLEN , + rctx->outbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen +100 ; + rctx->outbuf.buf =dma_alloc_coherent (ctx->se->dev, rctx->outbuf.size, &rctx->outbuf.addr,GFP_KERNEL );if (!rctx->outbuf.buf) { ret = -ENOMEM ; goto outbuf_err; } - rctx->outbuf.size =SE_AES_BUFLEN ; - - ret =tegra_ccm_crypt_init (req, se, rctx); -if (ret) - goto out; -if (rctx->encrypt) { - rctx->cryptlen = req->cryptlen; -/* CBC MAC Operation */ ret =tegra_ccm_compute_auth (ctx, rctx);if (ret)
@@ -1179,8 +1180,6 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq)if (ret) goto out; }else { - rctx->cryptlen = req->cryptlen - ctx->authsize; -/* CTR operation */ ret =tegra_ccm_do_ctr (ctx, rctx);if (ret)
@@ -1193,11 +1192,11 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq) } out: -dma_free_coherent (ctx->se->dev,SE_AES_BUFLEN , +dma_free_coherent (ctx->se->dev, rctx->inbuf.size, rctx->outbuf.buf, rctx->outbuf.addr); outbuf_err: -dma_free_coherent (ctx->se->dev,SE_AES_BUFLEN , +dma_free_coherent (ctx->se->dev, rctx->outbuf.size, rctx->inbuf.buf, rctx->inbuf.addr);crypto_finalize_aead_request (ctx->se->engine, req, ret);
@@ -1213,23 +1212,6 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq)struct tegra_aead_reqctx *rctx =aead_request_ctx (req);int ret; -/* Allocate buffers required */ - rctx->inbuf.buf =dma_alloc_coherent (ctx->se->dev,SE_AES_BUFLEN , - &rctx->inbuf.addr,GFP_KERNEL ); -if (!rctx->inbuf.buf) -return -ENOMEM ; - - rctx->inbuf.size =SE_AES_BUFLEN ; - - rctx->outbuf.buf =dma_alloc_coherent (ctx->se->dev,SE_AES_BUFLEN , - &rctx->outbuf.addr,GFP_KERNEL ); -if (!rctx->outbuf.buf) { - ret = -ENOMEM ; - goto outbuf_err; - } - - rctx->outbuf.size =SE_AES_BUFLEN ; - rctx->src_sg = req->src; rctx->dst_sg = req->dst; rctx->assoclen = req->assoclen;
@@ -1243,6 +1225,21 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq)memcpy (rctx->iv, req->iv,GCM_AES_IV_SIZE ); rctx->iv[3 ] = (1 <<24 ); +/* Allocate buffers required */ + rctx->inbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen; + rctx->inbuf.buf =dma_alloc_coherent (ctx->se->dev, rctx->inbuf.size, + &rctx->inbuf.addr,GFP_KERNEL ); +if (!rctx->inbuf.buf) +return -ENOMEM ; + + rctx->outbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen; + rctx->outbuf.buf =dma_alloc_coherent (ctx->se->dev, rctx->outbuf.size, + &rctx->outbuf.addr,GFP_KERNEL ); +if (!rctx->outbuf.buf) { + ret = -ENOMEM ; + goto outbuf_err; + } +/* If there is associated data perform GMAC operation */ if (rctx->assoclen) { ret =tegra_gcm_do_gmac (ctx, rctx);
@@ -1266,11 +1263,11 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq) ret =tegra_gcm_do_verify (ctx->se, rctx); out: -dma_free_coherent (ctx->se->dev,SE_AES_BUFLEN , +dma_free_coherent (ctx->se->dev, rctx->outbuf.size, rctx->outbuf.buf, rctx->outbuf.addr); outbuf_err: -dma_free_coherent (ctx->se->dev,SE_AES_BUFLEN , +dma_free_coherent (ctx->se->dev, rctx->inbuf.size, rctx->inbuf.buf, rctx->inbuf.addr);/* Finalize the request if there are no errors */
@@ -1497,6 +1494,11 @@ static int tegra_cmac_do_update(struct ahash_request *req)return 0 ; } + rctx->datbuf.buf =dma_alloc_coherent (se->dev, rctx->datbuf.size, + &rctx->datbuf.addr,GFP_KERNEL ); +if (!rctx->datbuf.buf) +return -ENOMEM ; +/* Copy the previous residue first */ if (rctx->residue.size)memcpy (rctx->datbuf.buf, rctx->residue.buf, rctx->residue.size);
@@ -1529,6 +1531,9 @@ static int tegra_cmac_do_update(struct ahash_request *req)if (!(rctx->task &SHA_FINAL ))tegra_cmac_copy_result (ctx->se, rctx); +dma_free_coherent (ctx->se->dev, rctx->datbuf.size, + rctx->datbuf.buf, rctx->datbuf.addr); +return ret; }
@@ -1543,10 +1548,20 @@ static int tegra_cmac_do_final(struct ahash_request *req)if (!req->nbytes && !rctx->total_len && ctx->fallback_tfm) {return crypto_shash_tfm_digest (ctx->fallback_tfm, - rctx->datbuf.buf,0 , req->result); +NULL ,0 , req->result); + } + +if (rctx->residue.size) { + rctx->datbuf.buf =dma_alloc_coherent (se->dev, rctx->residue.size, + &rctx->datbuf.addr,GFP_KERNEL ); +if (!rctx->datbuf.buf) { + ret = -ENOMEM ; + goto out_free; + } + +memcpy (rctx->datbuf.buf, rctx->residue.buf, rctx->residue.size); } -memcpy (rctx->datbuf.buf, rctx->residue.buf, rctx->residue.size); rctx->datbuf.size = rctx->residue.size; rctx->total_len += rctx->residue.size; rctx->config =tegra234_aes_cfg (SE_ALG_CMAC ,0 );
@@ -1565,8 +1580,10 @@ static int tegra_cmac_do_final(struct ahash_request *req)writel (0 , se->base + se->hw->regs->result + (i *4 )); out: -dma_free_coherent (se->dev,SE_SHA_BUFLEN , - rctx->datbuf.buf, rctx->datbuf.addr); +if (rctx->residue.size) +dma_free_coherent (se->dev, rctx->datbuf.size, + rctx->datbuf.buf, rctx->datbuf.addr); +out_free:dma_free_coherent (se->dev,crypto_ahash_blocksize (tfm) *2 , rctx->residue.buf, rctx->residue.addr);return ret;
@@ -1672,28 +1689,15 @@ static int tegra_cmac_init(struct ahash_request *req) rctx->residue.buf =dma_alloc_coherent (se->dev, rctx->blk_size *2 , &rctx->residue.addr,GFP_KERNEL );if (!rctx->residue.buf) - goto resbuf_fail; +return -ENOMEM ; rctx->residue.size =0 ; - rctx->datbuf.buf =dma_alloc_coherent (se->dev,SE_SHA_BUFLEN , - &rctx->datbuf.addr,GFP_KERNEL ); -if (!rctx->datbuf.buf) - goto datbuf_fail; - - rctx->datbuf.size =0 ; -/* Clear any previous result */ for (i =0 ; i <CMAC_RESULT_REG_COUNT ; i++)writel (0 , se->base + se->hw->regs->result + (i *4 ));return 0 ; - -datbuf_fail: -dma_free_coherent (se->dev, rctx->blk_size, rctx->residue.buf, - rctx->residue.addr); -resbuf_fail: -return -ENOMEM ; } static int tegra_cmac_setkey(struct crypto_ahash *tfm, const u8 *key,
drivers/crypto/tegra/tegra-se-hash.c +25 -13
@@ -332,6 +332,11 @@ static int tegra_sha_do_update(struct ahash_request *req)return 0 ; } + rctx->datbuf.buf =dma_alloc_coherent (ctx->se->dev, rctx->datbuf.size, + &rctx->datbuf.addr,GFP_KERNEL ); +if (!rctx->datbuf.buf) +return -ENOMEM ; +/* Copy the previous residue first */ if (rctx->residue.size)memcpy (rctx->datbuf.buf, rctx->residue.buf, rctx->residue.size);
@@ -368,6 +373,9 @@ static int tegra_sha_do_update(struct ahash_request *req)if (!(rctx->task &SHA_FINAL ))tegra_sha_copy_hash_result (se, rctx); +dma_free_coherent (ctx->se->dev, rctx->datbuf.size, + rctx->datbuf.buf, rctx->datbuf.addr); +return ret; }
@@ -380,7 +388,17 @@ static int tegra_sha_do_final(struct ahash_request *req)u32 *cpuvaddr = se->cmdbuf->addr;int size, ret =0 ; -memcpy (rctx->datbuf.buf, rctx->residue.buf, rctx->residue.size); +if (rctx->residue.size) { + rctx->datbuf.buf =dma_alloc_coherent (se->dev, rctx->residue.size, + &rctx->datbuf.addr,GFP_KERNEL ); +if (!rctx->datbuf.buf) { + ret = -ENOMEM ; + goto out_free; + } + +memcpy (rctx->datbuf.buf, rctx->residue.buf, rctx->residue.size); + } + rctx->datbuf.size = rctx->residue.size; rctx->total_len += rctx->residue.size;
@@ -397,8 +415,10 @@ static int tegra_sha_do_final(struct ahash_request *req)memcpy (req->result, rctx->digest.buf, rctx->digest.size); out: -dma_free_coherent (se->dev,SE_SHA_BUFLEN , - rctx->datbuf.buf, rctx->datbuf.addr); +if (rctx->residue.size) +dma_free_coherent (se->dev, rctx->datbuf.size, + rctx->datbuf.buf, rctx->datbuf.addr); +out_free:dma_free_coherent (se->dev,crypto_ahash_blocksize (tfm), rctx->residue.buf, rctx->residue.addr); dma_free_coherent(se->dev, rctx->digest.size, rctx->digest.buf,
@@ -527,19 +547,11 @@ static int tegra_sha_init(struct ahash_request *req)if (!rctx->residue.buf) goto resbuf_fail; - rctx->datbuf.buf =dma_alloc_coherent (se->dev,SE_SHA_BUFLEN , - &rctx->datbuf.addr,GFP_KERNEL ); -if (!rctx->datbuf.buf) - goto datbuf_fail; -return 0 ; -datbuf_fail: -dma_free_coherent (se->dev, rctx->blk_size, rctx->residue.buf, - rctx->residue.addr); resbuf_fail: -dma_free_coherent (se->dev,SE_SHA_BUFLEN , rctx->datbuf.buf, - rctx->datbuf.addr); +dma_free_coherent (se->dev, rctx->digest.size, rctx->digest.buf, + rctx->digest.addr); digbuf_fail:return -ENOMEM ; }
drivers/crypto/tegra/tegra-se.h +0 -2
@@ -340,8 +340,6 @@#define SE_CRYPTO_CTR_REG_COUNT 4#define SE_MAX_KEYSLOT 15#define SE_MAX_MEM_ALLOC SZ_4M -#define SE_AES_BUFLEN 0x8000 -#define SE_SHA_BUFLEN 0x2000#define SHA_FIRST BIT(0)#define SHA_UPDATE BIT(1)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 124/499 crypto: tegra - check return value for hash do_one_req
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil R <[email protected]>
[ Upstream commit dcf8b7e49b86738296c77fb58c123dd2d74a22a7 ]
Initialize and check the return value in hash *do_one_req() functions and exit the function if there is an error. This fixes the 'uninitialized variable' warnings reported by testbots.
--- drivers/crypto/tegra/tegra-se-aes.c | 10 ++++++++-- drivers/crypto/tegra/tegra-se-hash.c | 7 +++++++ 2 files changed, 15 insertions(+), 2 deletions(-)
drivers/crypto/tegra/tegra-se-aes.c +8 -2
@@ -1596,18 +1596,24 @@ static int tegra_cmac_do_one_req(struct crypto_engine *engine, void *areq)struct crypto_ahash *tfm =crypto_ahash_reqtfm (req);struct tegra_cmac_ctx *ctx =crypto_ahash_ctx (tfm);struct tegra_se *se = ctx->se; -int ret; +int ret =0 ;if (rctx->task &SHA_UPDATE ) { ret =tegra_cmac_do_update (req); +if (ret) + goto out; + rctx->task &= ~SHA_UPDATE ; }if (rctx->task &SHA_FINAL ) { ret =tegra_cmac_do_final (req); +if (ret) + goto out; + rctx->task &= ~SHA_FINAL ; } - +out:crypto_finalize_hash_request (se->engine, req, ret);return 0 ;
drivers/crypto/tegra/tegra-se-hash.c +7 -0
@@ -437,14 +437,21 @@ static int tegra_sha_do_one_req(struct crypto_engine *engine, void *areq)if (rctx->task &SHA_UPDATE ) { ret =tegra_sha_do_update (req); +if (ret) + goto out; + rctx->task &= ~SHA_UPDATE ; }if (rctx->task &SHA_FINAL ) { ret =tegra_sha_do_final (req); +if (ret) + goto out; + rctx->task &= ~SHA_FINAL ; } +out:crypto_finalize_hash_request (se->engine, req, ret);return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 125/499 crypto: tegra - Transfer HASH init function to crypto engine
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil R <[email protected]>
[ Upstream commit 97ee15ea101629d2ffe21d3c5dc03b8d8be43603 ]
Ahash init() function was called asynchronous to the crypto engine queue. This could corrupt the request context if there is any ongoing operation for the same request. Queue the init function as well to the crypto engine queue so that this scenario can be avoided.
--- drivers/crypto/tegra/tegra-se-aes.c | 81 ++++++++++++--------- drivers/crypto/tegra/tegra-se-hash.c | 101 +++++++++++++++------------ drivers/crypto/tegra/tegra-se.h | 5 +- 3 files changed, 109 insertions(+), 78 deletions(-)
drivers/crypto/tegra/tegra-se-aes.c +48 -33
@@ -1453,6 +1453,34 @@ static void tegra_cmac_paste_result(struct tegra_se *se, struct tegra_cmac_reqct se->base + se->hw->regs->result + (i * 4)); } +static int tegra_cmac_do_init (struct ahash_request *req) +{ +struct tegra_cmac_reqctx *rctx =ahash_request_ctx (req); +struct crypto_ahash *tfm =crypto_ahash_reqtfm (req); +struct tegra_cmac_ctx *ctx =crypto_ahash_ctx (tfm); +struct tegra_se *se = ctx->se; +int i; + + rctx->total_len =0 ; + rctx->datbuf.size =0 ; + rctx->residue.size =0 ; + rctx->task |=SHA_FIRST ; + rctx->blk_size =crypto_ahash_blocksize (tfm); + + rctx->residue.buf =dma_alloc_coherent (se->dev, rctx->blk_size *2 , + &rctx->residue.addr,GFP_KERNEL ); +if (!rctx->residue.buf) +return -ENOMEM ; + + rctx->residue.size =0 ; + +/* Clear any previous result */ +for (i =0 ; i <CMAC_RESULT_REG_COUNT ; i++) +writel (0 , se->base + se->hw->regs->result + (i *4 )); + +return 0 ; +} +static int tegra_cmac_do_update (struct ahash_request *req) {struct tegra_cmac_reqctx *rctx =ahash_request_ctx (req);
@@ -1598,6 +1626,14 @@ static int tegra_cmac_do_one_req(struct crypto_engine *engine, void *areq)struct tegra_se *se = ctx->se;int ret =0 ; +if (rctx->task &SHA_INIT ) { + ret =tegra_cmac_do_init (req); +if (ret) + goto out; + + rctx->task &= ~SHA_INIT ; + } +if (rctx->task &SHA_UPDATE ) { ret =tegra_cmac_do_update (req);if (ret)
@@ -1678,34 +1714,6 @@ static void tegra_cmac_cra_exit(struct crypto_tfm *tfm)tegra_key_invalidate (ctx->se, ctx->key_id, ctx->alg); } -static int tegra_cmac_init (struct ahash_request *req) -{ -struct tegra_cmac_reqctx *rctx =ahash_request_ctx (req); -struct crypto_ahash *tfm =crypto_ahash_reqtfm (req); -struct tegra_cmac_ctx *ctx =crypto_ahash_ctx (tfm); -struct tegra_se *se = ctx->se; -int i; - - rctx->total_len =0 ; - rctx->datbuf.size =0 ; - rctx->residue.size =0 ; - rctx->task =SHA_FIRST ; - rctx->blk_size =crypto_ahash_blocksize (tfm); - - rctx->residue.buf =dma_alloc_coherent (se->dev, rctx->blk_size *2 , - &rctx->residue.addr,GFP_KERNEL ); -if (!rctx->residue.buf) -return -ENOMEM ; - - rctx->residue.size =0 ; - -/* Clear any previous result */ -for (i =0 ; i <CMAC_RESULT_REG_COUNT ; i++) -writel (0 , se->base + se->hw->regs->result + (i *4 )); - -return 0 ; -} -static int tegra_cmac_setkey (struct crypto_ahash *tfm,const u8 *key,unsigned int keylen) {
@@ -1722,6 +1730,17 @@ static int tegra_cmac_setkey(struct crypto_ahash *tfm, const u8 *key,return tegra_key_submit (ctx->se, key, keylen, ctx->alg, &ctx->key_id); } +static int tegra_cmac_init (struct ahash_request *req) +{ +struct crypto_ahash *tfm =crypto_ahash_reqtfm (req); +struct tegra_cmac_ctx *ctx =crypto_ahash_ctx (tfm); +struct tegra_cmac_reqctx *rctx =ahash_request_ctx (req); + + rctx->task =SHA_INIT ; + +return crypto_transfer_hash_request_to_engine (ctx->se->engine, req); +} +static int tegra_cmac_update (struct ahash_request *req) {struct crypto_ahash *tfm =crypto_ahash_reqtfm (req);
@@ -1760,13 +1779,9 @@ static int tegra_cmac_digest(struct ahash_request *req)struct crypto_ahash *tfm =crypto_ahash_reqtfm (req);struct tegra_cmac_ctx *ctx =crypto_ahash_ctx (tfm);struct tegra_cmac_reqctx *rctx =ahash_request_ctx (req); -int ret; - ret =tegra_cmac_init (req); -if (ret) -return ret; + rctx->task |=SHA_INIT |SHA_UPDATE |SHA_FINAL ; - rctx->task |=SHA_UPDATE |SHA_FINAL ;return crypto_transfer_hash_request_to_engine (ctx->se->engine, req); }
drivers/crypto/tegra/tegra-se-hash.c +58 -43
136 lines not on this page · raw message
drivers/crypto/tegra/tegra-se.h +3 -2
@@ -342,8 +342,9 @@#define SE_MAX_MEM_ALLOC SZ_4M#define SHA_FIRST BIT(0) -#define SHA_UPDATE BIT(1) -#define SHA_FINAL BIT(2) +#define SHA_INIT BIT(1) +#define SHA_UPDATE BIT(2) +#define SHA_FINAL BIT(3)/* Security Engine operation modes */ enum se_aes_alg {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 126/499 crypto: tegra - Fix HASH intermediate result handling
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil R <[email protected]>
[ Upstream commit ff4b7df0b511b6121f3386607f02c16fb5d41192 ]
The intermediate hash values generated during an update task were handled incorrectly in the driver. The values have a defined format for each algorithm. Copying and pasting from the HASH_RESULT register balantly would not work for all the supported algorithms. This incorrect handling causes failures when there is a context switch between multiple operations.
To handle the expected format correctly, add a separate buffer for storing the intermediate results for each request. Remove the previous copy/paste functions which read/wrote to the registers directly. Instead configure the hardware to get the intermediate result copied to the buffer and use host1x path to restore the intermediate hash results.
--- drivers/crypto/tegra/tegra-se-hash.c | 149 +++++++++++++++++---------- drivers/crypto/tegra/tegra-se.h | 1 + 2 files changed, 98 insertions(+), 52 deletions(-)
drivers/crypto/tegra/tegra-se-hash.c +97 -52
@@ -34,6 +34,7 @@ struct tegra_sha_reqctx {struct tegra_se_datbuf datbuf;struct tegra_se_datbuf residue;struct tegra_se_datbuf digest; +struct tegra_se_datbuf intr_res;unsigned int alg;unsigned int config;unsigned int total_len;
@@ -211,9 +212,62 @@ static int tegra_sha_fallback_export(struct ahash_request *req, void *out)return crypto_ahash_export (&rctx->fallback_req, out); } -static int tegra_sha_prep_cmd (struct tegra_se *se,u32 *cpuvaddr, +static int tegra_se_insert_hash_result (struct tegra_sha_ctx *ctx,u32 *cpuvaddr, +struct tegra_sha_reqctx *rctx) +{ +__be32 *res_be = (__be32 *)rctx->intr_res.buf; +u32 *res = (u32 *)rctx->intr_res.buf; +int i =0 , j; + + cpuvaddr[i++] =0 ; + cpuvaddr[i++] =host1x_opcode_setpayload (HASH_RESULT_REG_COUNT ); + cpuvaddr[i++] =se_host1x_opcode_incr_w (SE_SHA_HASH_RESULT ); + +for (j =0 ; j <HASH_RESULT_REG_COUNT ; j++) { +int idx = j; + +/* +* The initial, intermediate and final hash value of SHA-384, SHA-512 +* in SHA_HASH_RESULT registers follow the below layout of bytes. +* +* +---------------+------------+ +* | HASH_RESULT_0 | B4...B7 | +* +---------------+------------+ +* | HASH_RESULT_1 | B0...B3 | +* +---------------+------------+ +* | HASH_RESULT_2 | B12...B15 | +* +---------------+------------+ +* | HASH_RESULT_3 | B8...B11 | +* +---------------+------------+ +* | ...... | +* +---------------+------------+ +* | HASH_RESULT_14| B60...B63 | +* +---------------+------------+ +* | HASH_RESULT_15| B56...B59 | +* +---------------+------------+ +* +*/ +if (ctx->alg ==SE_ALG_SHA384 || ctx->alg ==SE_ALG_SHA512 ) + idx = (j %2 ) ? j -1 : j +1 ; + +/* For SHA-1, SHA-224, SHA-256, SHA-384, SHA-512 the initial +* intermediate and final hash value when stored in +* SHA_HASH_RESULT registers, the byte order is NOT in +* little-endian. +*/ +if (ctx->alg <=SE_ALG_SHA512 ) + cpuvaddr[i++] =be32_to_cpu (res_be[idx]); +else + cpuvaddr[i++] = res[idx]; + } + +return i; +} + +static int tegra_sha_prep_cmd (struct tegra_sha_ctx *ctx,u32 *cpuvaddr,struct tegra_sha_reqctx *rctx) { +struct tegra_se *se = ctx->se;u64 msg_len, msg_left;int i =0 ;
@@ -241,7 +295,7 @@ static int tegra_sha_prep_cmd(struct tegra_se *se, u32 *cpuvaddr, cpuvaddr[i++] =upper_32_bits (msg_left); cpuvaddr[i++] =0 ; cpuvaddr[i++] =0 ; - cpuvaddr[i++] =host1x_opcode_setpayload (6 ); + cpuvaddr[i++] =host1x_opcode_setpayload (2 ); cpuvaddr[i++] =se_host1x_opcode_incr_w (SE_SHA_CFG ); cpuvaddr[i++] = rctx->config;
@@ -249,15 +303,29 @@ static int tegra_sha_prep_cmd(struct tegra_se *se, u32 *cpuvaddr, cpuvaddr[i++] =SE_SHA_TASK_HASH_INIT ; rctx->task &= ~SHA_FIRST ; }else { - cpuvaddr[i++] =0 ; +/* +* If it isn't the first task, program the HASH_RESULT register +* with the intermediate result from the previous task +*/ + i +=tegra_se_insert_hash_result (ctx, cpuvaddr + i, rctx); } + cpuvaddr[i++] =host1x_opcode_setpayload (4 ); + cpuvaddr[i++] =se_host1x_opcode_incr_w (SE_SHA_IN_ADDR ); cpuvaddr[i++] = rctx->datbuf.addr; cpuvaddr[i++] = (u32)(SE_ADDR_HI_MSB (upper_32_bits (rctx->datbuf.addr)) |SE_ADDR_HI_SZ (rctx->datbuf.size)); - cpuvaddr[i++] = rctx->digest.addr; - cpuvaddr[i++] = (u32)(SE_ADDR_HI_MSB (upper_32_bits (rctx->digest.addr)) | -SE_ADDR_HI_SZ (rctx->digest.size)); + +if (rctx->task &SHA_UPDATE ) { + cpuvaddr[i++] = rctx->intr_res.addr; + cpuvaddr[i++] = (u32)(SE_ADDR_HI_MSB (upper_32_bits (rctx->intr_res.addr)) | +SE_ADDR_HI_SZ (rctx->intr_res.size)); + }else { + cpuvaddr[i++] = rctx->digest.addr; + cpuvaddr[i++] = (u32)(SE_ADDR_HI_MSB (upper_32_bits (rctx->digest.addr)) | +SE_ADDR_HI_SZ (rctx->digest.size)); + } +if (rctx->key_id) { cpuvaddr[i++] =host1x_opcode_setpayload (1 ); cpuvaddr[i++] =se_host1x_opcode_nonincr_w (SE_SHA_CRYPTO_CFG );
@@ -266,36 +334,18 @@ static int tegra_sha_prep_cmd(struct tegra_se *se, u32 *cpuvaddr, cpuvaddr[i++] =host1x_opcode_setpayload (1 ); cpuvaddr[i++] =se_host1x_opcode_nonincr_w (SE_SHA_OPERATION ); - cpuvaddr[i++] =SE_SHA_OP_WRSTALL | -SE_SHA_OP_START | + cpuvaddr[i++] =SE_SHA_OP_WRSTALL |SE_SHA_OP_START |SE_SHA_OP_LASTBUF ; cpuvaddr[i++] =se_host1x_opcode_nonincr (host1x_uclass_incr_syncpt_r (),1 ); cpuvaddr[i++] =host1x_uclass_incr_syncpt_cond_f (1 ) |host1x_uclass_incr_syncpt_indx_f (se->syncpt_id); -dev_dbg (se->dev,"msg len %llu msg left %llu cfg %#x" , - msg_len, msg_left, rctx->config); +dev_dbg (se->dev,"msg len %llu msg left %llu sz %lu cfg %#x" , + msg_len, msg_left, rctx->datbuf.size, rctx->config);return i; } -static void tegra_sha_copy_hash_result (struct tegra_se *se,struct tegra_sha_reqctx *rctx) -{ -int i; - -for (i =0 ; i <HASH_RESULT_REG_COUNT ; i++) - rctx->result[i] =readl (se->base + se->hw->regs->result + (i *4 )); -} - -static void tegra_sha_paste_hash_result (struct tegra_se *se,struct tegra_sha_reqctx *rctx) -{ -int i; - -for (i =0 ; i <HASH_RESULT_REG_COUNT ; i++) -writel (rctx->result[i], - se->base + se->hw->regs->result + (i *4 )); -} -static int tegra_sha_do_init (struct ahash_request *req) {struct tegra_sha_reqctx *rctx =ahash_request_ctx (req);
@@ -325,8 +375,17 @@ static int tegra_sha_do_init(struct ahash_request *req)if (!rctx->residue.buf) goto resbuf_fail; + rctx->intr_res.size =HASH_RESULT_REG_COUNT *4 ; + rctx->intr_res.buf =dma_alloc_coherent (se->dev, rctx->intr_res.size, + &rctx->intr_res.addr,GFP_KERNEL ); +if (!rctx->intr_res.buf) + goto intr_res_fail; +return 0 ; +intr_res_fail: +dma_free_coherent (se->dev, rctx->residue.size, rctx->residue.buf, + rctx->residue.addr); resbuf_fail:dma_free_coherent (se->dev, rctx->digest.size, rctx->digest.buf, rctx->digest.addr);
@@ -356,7 +415,6 @@ static int tegra_sha_do_update(struct ahash_request *req) rctx->src_sg = req->src; rctx->datbuf.size = (req->nbytes + rctx->residue.size) - nresidue; - rctx->total_len += rctx->datbuf.size;/* * If nbytes are less than a block size, copy it residue and
@@ -365,12 +423,12 @@ static int tegra_sha_do_update(struct ahash_request *req)if (nblks <1 ) {scatterwalk_map_and_copy (rctx->residue.buf + rctx->residue.size, rctx->src_sg,0 , req->nbytes,0 ); - rctx->residue.size += req->nbytes; +return 0 ; } - rctx->datbuf.buf =dma_alloc_coherent (ctx->se->dev, rctx->datbuf.size, + rctx->datbuf.buf =dma_alloc_coherent (se->dev, rctx->datbuf.size, &rctx->datbuf.addr,GFP_KERNEL );if (!rctx->datbuf.buf)return -ENOMEM ;
@@ -387,31 +445,15 @@ static int tegra_sha_do_update(struct ahash_request *req)/* Update residue value with the residue after current block */ rctx->residue.size = nresidue; + rctx->total_len += rctx->datbuf.size; rctx->config =tegra_sha_get_config (rctx->alg) | -SE_SHA_DST_HASH_REG ; - -/* -* If this is not the first 'update' call, paste the previous copied -* intermediate results to the registers so that it gets picked up. -* This is to support the import/export functionality. -*/ -if (!(rctx->task &SHA_FIRST )) -tegra_sha_paste_hash_result (se, rctx); - - size =tegra_sha_prep_cmd (se, cpuvaddr, rctx); +SE_SHA_DST_MEMORY ; + size =tegra_sha_prep_cmd (ctx, cpuvaddr, rctx); ret =tegra_se_host1x_submit (se, se->cmdbuf, size); -/* -* If this is not the final update, copy the intermediate results -* from the registers so that it can be used in the next 'update' -* call. This is to support the import/export functionality. -*/ -if (!(rctx->task &SHA_FINAL )) -tegra_sha_copy_hash_result (se, rctx); - -dma_free_coherent (ctx->se->dev, rctx->datbuf.size, +dma_free_coherent (se->dev, rctx->datbuf.size, rctx->datbuf.buf, rctx->datbuf.addr);return ret;
@@ -443,8 +485,7 @@ static int tegra_sha_do_final(struct ahash_request *req) rctx->config =tegra_sha_get_config (rctx->alg) |SE_SHA_DST_MEMORY ; - size =tegra_sha_prep_cmd (se, cpuvaddr, rctx); - + size =tegra_sha_prep_cmd (ctx, cpuvaddr, rctx); ret =tegra_se_host1x_submit (se, se->cmdbuf, size);if (ret) goto out;
@@ -461,6 +502,10 @@ static int tegra_sha_do_final(struct ahash_request *req) rctx->residue.buf, rctx->residue.addr);dma_free_coherent (se->dev, rctx->digest.size, rctx->digest.buf, rctx->digest.addr); + +dma_free_coherent (se->dev, rctx->intr_res.size, rctx->intr_res.buf, + rctx->intr_res.addr); +return ret; }
drivers/crypto/tegra/tegra-se.h +1 -0
@@ -24,6 +24,7 @@#define SE_STREAM_ID 0x90#define SE_SHA_CFG 0x4004 +#define SE_SHA_IN_ADDR 0x400c#define SE_SHA_KEY_ADDR 0x4094#define SE_SHA_KEY_DATA 0x4098#define SE_SHA_KEYMANIFEST 0x409c
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 127/499 crypto: bpf - Add MODULE_DESCRIPTION for skcipher
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit f307c87ea06c64b87fcd3221a682cd713cde51e9 ]
All modules should have a description, building with extra warnings enabled prints this outfor the for bpf_crypto_skcipher module:
WARNING: modpost: missing MODULE_DESCRIPTION() in crypto/bpf_crypto_skcipher.o
Add a description line.
--- crypto/bpf_crypto_skcipher.c | 1 + 1 file changed, 1 insertion(+)
crypto/bpf_crypto_skcipher.c +1 -0
@@ -80,3 +80,4 @@ static void __exit bpf_crypto_skcipher_exit(void)module_init (bpf_crypto_skcipher_init);module_exit (bpf_crypto_skcipher_exit);MODULE_LICENSE ("GPL" ); +MODULE_DESCRIPTION ("Symmetric key cipher support for BPF" );
Signature · 1 line
2.39.5