5.15.185-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 5.15.185-rc1 review
This is the start of the stable review cycle for the 5.15.185 release. There are 207 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 04 Jun 2025 13:42:20 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.185-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.185-rc1
Robin Murphy <[email protected]>
perf/arm-cmn: Initialise cmn->cpu earlier
Mark Pearson <[email protected]>
platform/x86: thinkpad_acpi: Ignore battery threshold change event notification
Valtteri Koskivuori <[email protected]>
platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys
Michal Suchanek <[email protected]>
tpm: tis: Double the timeout B to 4s
Ilya Guterman <[email protected]>
nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro
Alessandro Grassi <[email protected]>
spi: spi-sun4i: fix early activation
Masahiro Yamada <[email protected]>
um: let 'make clean' properly clean underlying SUBARCH as well
John Chau <[email protected]>
platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS
Jeff Layton <[email protected]>
nfs: don't share pNFS DS connections between net namespaces
Milton Barrera <[email protected]>
HID: quirks: Add ADATA XPG alpha wireless mouse support
Christian Brauner <[email protected]>
coredump: hand a pidfd to the usermode coredump helper
Christian Brauner <[email protected]>
fork: use pidfd_prepare()
Christian Brauner <[email protected]>
pid: add pidfd_prepare()
Christian Brauner <[email protected]>
coredump: fix error handling for replace_fd()
Pedro Tammela <[email protected]>
net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
Alok Tiwari <[email protected]>
arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node
Wang Zhaolong <[email protected]>
smb: client: Reset all search buffer pointers when releasing buffer
Wang Zhaolong <[email protected]>
smb: client: Fix use-after-free in cifs_fill_dirent
Pawan Gupta <[email protected]>
x86/its: Fix undefined reference to cpu_wants_rethunk_at()
Jani Nikula <[email protected]>
drm/i915/gvt: fix unterminated-string-initialization warning
Juergen Gross <[email protected]>
xen/swiotlb: relax alignment requirements
Nathan Chancellor <[email protected]>
i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work()
Nathan Chancellor <[email protected]>
kbuild: Disable -Wdefault-const-init-unsafe
Larisa Grigore <[email protected]>
spi: spi-fsl-dspi: Reset SR flags before sending a new message
Bogdan-Gabriel Roman <[email protected]>
spi: spi-fsl-dspi: Halt the module after a new message transfer
Larisa Grigore <[email protected]>
spi: spi-fsl-dspi: restrict register range for regmap access
Jernej Skrabec <[email protected]>
Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection"
Tianyang Zhang <[email protected]>
mm/page_alloc.c: avoid infinite retries caused by cpuset race
Breno Leitao <[email protected]>
memcg: always call cond_resched() after fn()
Mario Limonciello <[email protected]>
Revert "drm/amd: Keep display off while going into S4"
feijuan.li <[email protected]>
drm/edid: fixed the bug that hdr metadata was not reset
Vladimir Moskovkin <[email protected]>
platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store()
Ilia Gavrilov <[email protected]>
llc: fix data loss when reading from a socket in llc_ui_recvmsg()
Takashi Iwai <[email protected]>
ALSA: pcm: Fix race of buffer access at PCM OSS layer
Oliver Hartkopp <[email protected]>
can: bcm: add missing rcu read protection for procfs content
Oliver Hartkopp <[email protected]>
can: bcm: add locking for bcm_op runtime updates
Dominik Grzegorzek <[email protected]>
padata: do not leak refcount in reorder_work
Ivan Pravdin <[email protected]>
crypto: algif_hash - fix double free in hash_accept
Subbaraya Sundeep <[email protected]>
octeontx2-af: Set LMT_ENA bit for APR table entries
Wang Liang <[email protected]>
net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
Cong Wang <[email protected]>
sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
Paul Kocialkowski <[email protected]>
net: dwmac-sun8i: Use parsed internal PHY address instead of 1
Ido Schimmel <[email protected]>
bridge: netfilter: Fix forwarding of fragmented packets
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix not checking l2cap_chan security level
Paul Chaignon <[email protected]>
xfrm: Sanitize marks before insert
Matti Lehtimäki <[email protected]>
remoteproc: qcom_wcnss: Fix on platforms without fallback regulators
Al Viro <[email protected]>
__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
Jason Andryuk <[email protected]>
xenbus: Allow PVH dom0 a non-local xenstore
Goldwyn Rodrigues <[email protected]>
btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
Alistair Francis <[email protected]>
nvmet-tcp: don't restore null sk_state_change
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx
Takashi Iwai <[email protected]>
ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013
Martin Blumenstingl <[email protected]>
pinctrl: meson: define the pull up/down resistor value as 60 kOhm
Chenyuan Yang <[email protected]>
ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of()
Jessica Zhang <[email protected]>
drm: Add valid clones check
Simona Vetter <[email protected]>
drm/atomic: clarify the rules around drm_atomic_state->allow_modeset
Rosen Penev <[email protected]>
wifi: ath9k: return by of_get_mac_address
Isaac Scott <[email protected]>
regulator: ad5398: Add device tree support
Sean Anderson <[email protected]>
spi: zynqmp-gqspi: Always acknowledge interrupts
Bitterblue Smith <[email protected]>
wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate
Ravi Bangoria <[email protected]>
perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt
Viktor Malik <[email protected]>
bpftool: Fix readlink usage in get_fd_type
Thomas Zimmermann <[email protected]>
drm/ast: Find VBIOS mode from regular display size
junan <[email protected]>
HID: usbkbd: Fix the bit shift number for LED_KANA
Kai Mäkisara <[email protected]>
scsi: st: Restore some drive settings after reset
Justin Tee <[email protected]>
scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine
Konstantin Taranov <[email protected]>
net/mana: fix warning in the writer of client oob
Ankur Arora <[email protected]>
rcu: fix header guard for rcu_all_qs()
Ankur Arora <[email protected]>
rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y
Heiner Kallweit <[email protected]>
r8169: don't scan PHY addresses > 0
Ido Schimmel <[email protected]>
vxlan: Annotate FDB data races
Depeng Shao <[email protected]>
media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available
Andrey Vatoropin <[email protected]>
hwmon: (xgene-hwmon) use appropriate type for the latency value
Jordan Crouse <[email protected]>
clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs
Bitterblue Smith <[email protected]>
wifi: rtw88: Fix download_firmware_validate() for RTL8814AU
Aleksander Jan Bajkowski <[email protected]>
r8152: add vendor/device ID pair for Dell Alienware AW1022z
Kuniyuki Iwashima <[email protected]>
ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure().
Athira Rajeev <[email protected]>
arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src
Johannes Berg <[email protected]>
wifi: mac80211: remove misplaced drv_mgd_complete_tx() call
Johannes Berg <[email protected]>
wifi: mac80211: don't unconditionally call drv_mgd_complete_tx()
William Tu <[email protected]>
net/mlx5e: reduce rep rxq depth to 256 for ECPF
William Tu <[email protected]>
net/mlx5e: set the tx_queue_len for pfifo_fast
Alexei Lazar <[email protected]>
net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB
Tom Chung <[email protected]>
drm/amd/display: Initial psr_version with correct setting
Jiang Liu <[email protected]>
drm/amdgpu: reset psp->cmd to NULL after releasing the buffer
Dmitry Baryshkov <[email protected]>
phy: core: don't require set_mode() callback for phy_get_mode() to work
Kees Cook <[email protected]>
net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
Sakari Ailus <[email protected]>
media: v4l: Memset argument to 0 before calling get_mbus_config pad op
Konstantin Andreev <[email protected]>
smack: recognize ipv4 CIPSO w/o categories
Valentin Caron <[email protected]>
pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map
Kuninori Morimoto <[email protected]>
ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot()
Hector Martin <[email protected]>
ASoC: tas2764: Power up/down amp on mute ops
Martin Povišer <[email protected]>
ASoC: ops: Enforce platform maximum on initial value
Shahar Shitrit <[email protected]>
net/mlx5: Apply rate-limiting to high temperature warning
Shahar Shitrit <[email protected]>
net/mlx5: Modify LSB bitmask in temperature event to include only the first bit
Xiaofei Tan <[email protected]>
ACPI: HED: Always initialize before evged
Ilpo Järvinen <[email protected]>
PCI: Fix old_size lower bound in calculate_iosize() too
Jakub Kicinski <[email protected]>
eth: mlx4: don't try to complete XDP frames in netpoll
Krzysztof Kozlowski <[email protected]>
can: c_can: Use of_property_present() to test existence of DT property
Michael Margolin <[email protected]>
RDMA/core: Fix best page size finding when it can cross SG entries
Arnd Bergmann <[email protected]>
EDAC/ie31200: work around false positive build warning
Peter Seiderer <[email protected]>
net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
Bitterblue Smith <[email protected]>
wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31
Bitterblue Smith <[email protected]>
wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
Bitterblue Smith <[email protected]>
wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU
Shivasharan S <[email protected]>
scsi: mpt3sas: Send a diag reset if target reset fails
Paul Burton <[email protected]>
clocksource: mips-gic-timer: Enable counter when CPUs start
Paul Burton <[email protected]>
MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core
Bibo Mao <[email protected]>
MIPS: Use arch specific syscall name match function
Balbir Singh <[email protected]>
x86/kaslr: Reduce KASLR entropy on most x86 systems
Nandakumar Edamana <[email protected]>
libbpf: Fix out-of-bound read
Rafael J. Wysocki <[email protected]>
cpuidle: menu: Avoid discarding useful information
Waiman Long <[email protected]>
x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus()
Yihan Zhu <[email protected]>
drm/amd/display: handle max_downscale_src_width fail check
Nir Lichtman <[email protected]>
x86/build: Fix broken copy command in genimage.sh when making isoimage
Andrew Davis <[email protected]>
soc: ti: k3-socinfo: Do not use syscon helper to build regmap
Hangbin Liu <[email protected]>
bonding: report duplicate MAC address in all situations
Arnd Bergmann <[email protected]>
net: xgene-v2: remove incorrect ACPI_PTR annotation
Philip Yang <[email protected]>
drm/amdkfd: KFD release_work possible circular locking
Kevin Krakauer <[email protected]>
selftests/net: have gro.sh -t return a correct exit code
Moshe Shemesh <[email protected]>
net/mlx5: Avoid report two health errors on same syndrome
Viresh Kumar <[email protected]>
firmware: arm_ffa: Set dma_mask for ffa devices
Stanimir Varbanov <[email protected]>
PCI: brcmstb: Add a softdep to MIP MSI-X driver
Stanimir Varbanov <[email protected]>
PCI: brcmstb: Expand inbound window size up to 64GB
Kuhanh Murugasen Krishnan <[email protected]>
fpga: altera-cvp: Increase credit timeout
AngeloGioacchino Del Regno <[email protected]>
drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence
Li Bin <[email protected]>
ARM: at91: pm: fix at91_suspend_finish for ZQ calibration
Alexander Stein <[email protected]>
hwmon: (gpio-fan) Add missing mutex locks
Breno Leitao <[email protected]>
x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2
Ahmad Fatoum <[email protected]>
clk: imx8mp: inform CCF of maximum frequency of clocks
Ricardo Ribalda <[email protected]>
media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map
Kuniyuki Iwashima <[email protected]>
ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config().
Peter Seiderer <[email protected]>
net: pktgen: fix mpls maximum labels list parsing
Alexander Sverdlin <[email protected]>
net: ethernet: ti: cpsw_new: populate netdev of_node
Artur Weber <[email protected]>
pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned"
Hans Verkuil <[email protected]>
media: cx231xx: set device_caps for 417
Victor Lu <[email protected]>
drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c
Matti Lehtimäki <[email protected]>
remoteproc: qcom_wcnss: Handle platforms with only single power domain
Matthew Wilcox (Oracle) <[email protected]>
orangefs: Do not truncate file size
Ming-Hung Tsai <[email protected]>
dm cache: prevent BUG_ON by blocking retries on failed device resumes
Markus Elfring <[email protected]>
media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe()
Svyatoslav Ryhel <[email protected]>
ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114
Andy Shevchenko <[email protected]>
ieee802154: ca8210: Use proper setters and getters for bitwise types
Alexandre Belloni <[email protected]>
rtc: ds1307: stop disabling alarms on probe
Eric Dumazet <[email protected]>
tcp: bring back NUMA dispersion in inet_ehash_locks_alloc()
Andreas Schwab <[email protected]>
powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7
Diogo Ivo <[email protected]>
arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator
Herbert Xu <[email protected]>
crypto: lzo - Fix compression buffer overrun
Aaron Kling <[email protected]>
cpufreq: tegra186: Share policy per cluster
Alexey Klimov <[email protected]>
ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup()
Andy Shevchenko <[email protected]>
auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common"
Willem de Bruijn <[email protected]>
ipv6: save dontfrag in cork
Erick Shepherd <[email protected]>
mmc: sdhci: Disable SD card clock before changing parameters
Ryan Roberts <[email protected]>
arm64/mm: Check PUD_TYPE_TABLE in pud_bad()
Nicolas Bouchinet <[email protected]>
netfilter: conntrack: Bound nf_conntrack sysctl writes
Thomas Weißschuh <[email protected]>
timer_list: Don't use %pK through printk()
Eric Dumazet <[email protected]>
posix-timers: Add cond_resched() to posix_timer_add() search loop
Maher Sanalla <[email protected]>
RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject()
Frediano Ziglio <[email protected]>
xen: Add support for XenServer 6.1 platform device
Mikulas Patocka <[email protected]>
dm: restrict dm device size to 2^63-512 bytes
Shashank Gupta <[email protected]>
crypto: octeontx2 - suppress auth failure screaming due to negative tests
Seyediman Seyedarab <[email protected]>
kbuild: fix argument parsing in scripts/config
Nícolas F. R. A. Prado <[email protected]>
ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect
Alexandre Belloni <[email protected]>
rtc: rv3032: fix EERD location
Ilpo Järvinen <[email protected]>
tcp: reorganize tcp_in_ack_event() and tcp_count_delivered()
Alex Williamson <[email protected]>
vfio/pci: Handle INTx IRQ_NOTCONNECTED
Kai Mäkisara <[email protected]>
scsi: st: ERASE does not change tape location
Kai Mäkisara <[email protected]>
scsi: st: Tighten the page format heuristics with MODE SELECT
Christian Göttsche <[email protected]>
ext4: reorder capability check last
Tiwei Bie <[email protected]>
um: Update min_low_pfn to match changes in uml_reserved
Benjamin Berg <[email protected]>
um: Store full CSGSFS and SS register from mcontext
Nick Hu <[email protected]>
clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug
Heming Zhao <[email protected]>
dlm: make tcp still work in multi-link env
Stanley Chu <[email protected]>
i3c: master: svc: Fix missing STOP for master request
Filipe Manana <[email protected]>
btrfs: send: return -ENAMETOOLONG when attempting a path that is too long
Filipe Manana <[email protected]>
btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work()
Mark Harmstone <[email protected]>
btrfs: avoid linker error in btrfs_find_create_tree_block()
Boris Burkov <[email protected]>
btrfs: make btrfs_discard_workfn() block_group ref explicit
Vitalii Mordan <[email protected]>
i2c: pxa: fix call balance of i2c->clk handling routines
Stephan Gerhold <[email protected]>
i2c: qup: Vote for interconnect bandwidth to DRAM
Felix Fietkau <[email protected]>
wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2
Erick Shepherd <[email protected]>
mmc: host: Wait for Vdd to settle on card power off
Robert Richter <[email protected]>
libnvdimm/labels: Fix divide error in nd_label_data_init()
Roger Pau Monne <[email protected]>
PCI: vmd: Disable MSI remapping bypass under Xen
Trond Myklebust <[email protected]>
pNFS/flexfiles: Report ENETDOWN as a connection error
Ian Rogers <[email protected]>
tools/build: Don't pass test log files to linker
Frank Li <[email protected]>
PCI: dwc: ep: Ensure proper iteration over outbound map windows
Ryo Takakura <[email protected]>
lockdep: Fix wait context check on softirq for PREEMPT_RT
Jing Su <[email protected]>
dql: Fix dql->limit value when reset.
Alice Guo <[email protected]>
thermal/drivers/qoriq: Power down TMU on system suspend
Trond Myklebust <[email protected]>
SUNRPC: rpcbind should never reset the port to the value '0'
Trond Myklebust <[email protected]>
SUNRPC: rpc_clnt_set_transport() must not change the autobind setting
Trond Myklebust <[email protected]>
NFSv4: Treat ENETUNREACH errors as fatal for state recovery
Zsolt Kajtar <[email protected]>
fbdev: core: tileblit: Implement missing margin clearing for tileblit
Zsolt Kajtar <[email protected]>
fbcon: Use correct erase colour for clearing in fbcon
Shixiong Ou <[email protected]>
fbdev: fsl-diu-fb: add missing device_remove_file()
Tudor Ambarus <[email protected]>
mailbox: use error ret code of of_parse_phandle_with_args()
Andy Shevchenko <[email protected]>
tracing: Mark binary printing functions with __printf() attribute
Trond Myklebust <[email protected]>
NFSv4: Check for delegation validity in nfs_start_delegation_return_locked()
Daniel Gomez <[email protected]>
kconfig: merge_config: use an empty file as initfile
Haoran Jiang <[email protected]>
samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora
Brandon Kammerdiener <[email protected]>
bpf: fix possible endless loop in BPF map iteration
Vladimir Oltean <[email protected]>
net: enetc: refactor bulk flipping of RX buffers to separate function
gaoxu <[email protected]>
cgroup: Fix compilation issue due to cgroup_mutex not being exported
Marek Szyprowski <[email protected]>
dma-mapping: avoid potential unused data compilation warning
Zhongqiu Han <[email protected]>
virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN
Dmitry Bogdanov <[email protected]>
scsi: target: iscsi: Fix timeout on deleted connection
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 2 + Makefile | 16 ++- arch/arm/boot/dts/tegra114.dtsi | 2 +- arch/arm/mach-at91/pm.c | 21 +-- .../boot/dts/allwinner/sun50i-h6-beelink-gs1.dts | 38 +++--- .../boot/dts/allwinner/sun50i-h6-orangepi-3.dts | 14 +- .../boot/dts/allwinner/sun50i-h6-orangepi.dtsi | 22 +-- arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi | 2 +- arch/arm64/boot/dts/qcom/sm8350.dtsi | 2 +- arch/arm64/include/asm/pgtable.h | 3 +- arch/mips/include/asm/ftrace.h | 16 +++ arch/mips/kernel/pm-cps.c | 30 ++-- arch/powerpc/kernel/prom_init.c | 4 +- arch/powerpc/perf/core-book3s.c | 20 +++ arch/powerpc/perf/isa207-common.c | 4 +- arch/um/Makefile | 1 + arch/um/kernel/mem.c | 1 + arch/x86/boot/genimage.sh | 5 +- arch/x86/events/amd/ibs.c | 3 +- arch/x86/include/asm/alternative.h | 2 +- arch/x86/include/asm/nmi.h | 2 + arch/x86/include/asm/perf_event.h | 1 + arch/x86/kernel/cpu/bugs.c | 10 +- arch/x86/kernel/nmi.c | 42 ++++++ arch/x86/kernel/reboot.c | 10 +- arch/x86/mm/kaslr.c | 10 +- arch/x86/um/os-Linux/mcontext.c | 3 +- crypto/algif_hash.c | 4 - crypto/lzo-rle.c | 2 +- crypto/lzo.c | 2 +- drivers/acpi/Kconfig | 2 +- drivers/acpi/hed.c | 7 +- drivers/auxdisplay/charlcd.c | 5 +- drivers/auxdisplay/charlcd.h | 5 +- drivers/auxdisplay/hd44780.c | 2 +- drivers/auxdisplay/lcd2s.c | 2 +- drivers/auxdisplay/panel.c | 2 +- drivers/char/tpm/tpm_tis_core.h | 2 +- drivers/clk/imx/clk-imx8mp.c | 151 +++++++++++++++++++++ drivers/clk/qcom/camcc-sm8250.c | 56 ++++---- drivers/clocksource/mips-gic-timer.c | 6 +- drivers/clocksource/timer-riscv.c | 6 + drivers/cpufreq/tegra186-cpufreq.c | 7 + drivers/cpuidle/governors/menu.c | 13 +- .../crypto/marvell/octeontx2/otx2_cptvf_reqmgr.c | 7 +- drivers/edac/ie31200_edac.c | 28 ++-- drivers/firmware/arm_ffa/bus.c | 1 + drivers/fpga/altera-cvp.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 +- drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 16 +-- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 - drivers/gpu/drm/amd/display/dc/core/dc.c | 1 + drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c | 11 +- drivers/gpu/drm/ast/ast_mode.c | 10 +- drivers/gpu/drm/drm_atomic_helper.c | 28 ++++ drivers/gpu/drm/drm_edid.c | 1 + drivers/gpu/drm/i915/gvt/opregion.c | 8 +- drivers/gpu/drm/mediatek/mtk_dpi.c | 5 +- drivers/hid/hid-ids.h | 4 + drivers/hid/hid-quirks.c | 2 + drivers/hid/usbhid/usbkbd.c | 2 +- drivers/hwmon/gpio-fan.c | 16 ++- drivers/hwmon/xgene-hwmon.c | 2 +- drivers/i2c/busses/i2c-pxa.c | 5 +- drivers/i2c/busses/i2c-qup.c | 36 +++++ drivers/i3c/master/svc-i3c-master.c | 2 + drivers/infiniband/core/umem.c | 36 +++-- drivers/infiniband/core/uverbs_cmd.c | 144 ++++++++++---------- drivers/infiniband/core/verbs.c | 11 +- drivers/mailbox/mailbox.c | 7 +- drivers/md/dm-cache-target.c | 24 ++++ drivers/md/dm-table.c | 4 + drivers/media/platform/qcom/camss/camss-csid.c | 64 +++++---- .../media/platform/sti/c8sectpfe/c8sectpfe-core.c | 3 +- drivers/media/usb/cx231xx/cx231xx-417.c | 2 + drivers/media/usb/uvc/uvc_v4l2.c | 6 + drivers/media/v4l2-core/v4l2-subdev.c | 2 + drivers/mmc/host/sdhci-pci-core.c | 6 +- drivers/mmc/host/sdhci.c | 9 +- drivers/net/bonding/bond_main.c | 2 +- drivers/net/can/c_can/c_can_platform.c | 2 +- drivers/net/ethernet/apm/xgene-v2/main.c | 4 +- drivers/net/ethernet/freescale/enetc/enetc.c | 16 ++- .../net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 15 +- drivers/net/ethernet/mellanox/mlx4/alloc.c | 6 +- drivers/net/ethernet/mellanox/mlx4/en_tx.c | 2 + drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 5 + .../net/ethernet/mellanox/mlx5/core/en_selftest.c | 3 + drivers/net/ethernet/mellanox/mlx5/core/events.c | 11 +- drivers/net/ethernet/mellanox/mlx5/core/health.c | 1 + drivers/net/ethernet/microsoft/mana/gdma_main.c | 2 +- drivers/net/ethernet/realtek/r8169_main.c | 1 + drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 2 +- drivers/net/ethernet/ti/cpsw_new.c | 1 + drivers/net/ieee802154/ca8210.c | 9 +- drivers/net/usb/r8152.c | 1 + drivers/net/vxlan/vxlan_core.c | 18 +-- drivers/net/wireless/ath/ath9k/init.c | 4 +- drivers/net/wireless/mediatek/mt76/mt76.h | 1 + drivers/net/wireless/mediatek/mt76/mt76x0/pci.c | 3 +- drivers/net/wireless/mediatek/mt76/mt76x0/usb.c | 3 +- drivers/net/wireless/mediatek/mt76/mt76x2/pci.c | 3 +- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 3 +- drivers/net/wireless/mediatek/mt76/tx.c | 3 +- drivers/net/wireless/realtek/rtw88/main.c | 40 ++---- drivers/net/wireless/realtek/rtw88/reg.h | 3 +- drivers/net/wireless/realtek/rtw88/rtw8822b.c | 14 +- drivers/net/wireless/realtek/rtw88/util.c | 3 +- drivers/nvdimm/label.c | 3 +- drivers/nvme/host/pci.c | 2 + drivers/nvme/target/tcp.c | 3 + drivers/pci/Kconfig | 6 + drivers/pci/controller/dwc/pcie-designware-ep.c | 2 +- drivers/pci/controller/pcie-brcmstb.c | 5 +- drivers/pci/controller/vmd.c | 20 +++ drivers/pci/setup-bus.c | 6 +- drivers/perf/arm-cmn.c | 2 +- drivers/phy/phy-core.c | 7 +- drivers/pinctrl/bcm/pinctrl-bcm281xx.c | 44 +++--- drivers/pinctrl/devicetree.c | 10 +- drivers/pinctrl/meson/pinctrl-meson.c | 2 +- .../x86/dell/dell-wmi-sysman/passobj-attributes.c | 2 +- drivers/platform/x86/fujitsu-laptop.c | 33 ++++- drivers/platform/x86/thinkpad_acpi.c | 7 + drivers/regulator/ad5398.c | 12 +- drivers/remoteproc/qcom_wcnss.c | 34 ++++- drivers/rtc/rtc-ds1307.c | 4 +- drivers/rtc/rtc-rv3032.c | 2 +- drivers/scsi/lpfc/lpfc_hbadisc.c | 17 ++- drivers/scsi/mpt3sas/mpt3sas_ctl.c | 12 +- drivers/scsi/st.c | 29 +++- drivers/scsi/st.h | 2 + drivers/soc/ti/k3-socinfo.c | 13 +- drivers/spi/spi-fsl-dspi.c | 46 ++++++- drivers/spi/spi-sun4i.c | 5 +- drivers/spi/spi-zynqmp-gqspi.c | 22 ++- drivers/target/iscsi/iscsi_target.c | 2 +- drivers/thermal/qoriq_thermal.c | 13 ++ drivers/vfio/pci/vfio_pci_config.c | 3 +- drivers/vfio/pci/vfio_pci_core.c | 10 +- drivers/vfio/pci/vfio_pci_intrs.c | 2 +- drivers/video/fbdev/core/bitblit.c | 5 +- drivers/video/fbdev/core/fbcon.c | 10 +- drivers/video/fbdev/core/fbcon.h | 38 +----- drivers/video/fbdev/core/fbcon_ccw.c | 5 +- drivers/video/fbdev/core/fbcon_cw.c | 5 +- drivers/video/fbdev/core/fbcon_ud.c | 5 +- drivers/video/fbdev/core/tileblit.c | 45 +++++- drivers/video/fbdev/fsl-diu-fb.c | 1 + drivers/virtio/virtio_ring.c | 2 +- drivers/xen/platform-pci.c | 4 + drivers/xen/swiotlb-xen.c | 18 ++- drivers/xen/xenbus/xenbus_probe.c | 14 +- fs/btrfs/block-group.c | 18 ++- fs/btrfs/discard.c | 34 +++-- fs/btrfs/extent_io.c | 7 +- fs/btrfs/send.c | 6 +- fs/cifs/readdir.c | 7 +- fs/coredump.c | 80 ++++++++++- fs/dlm/lowcomms.c | 4 +- fs/ext4/balloc.c | 4 +- fs/namespace.c | 6 +- fs/nfs/delegation.c | 3 +- fs/nfs/filelayout/filelayoutdev.c | 6 +- fs/nfs/flexfilelayout/flexfilelayout.c | 1 + fs/nfs/flexfilelayout/flexfilelayoutdev.c | 6 +- fs/nfs/nfs4state.c | 10 +- fs/nfs/pnfs.h | 4 +- fs/nfs/pnfs_nfs.c | 9 +- fs/orangefs/inode.c | 7 +- include/drm/drm_atomic.h | 23 +++- include/linux/binfmts.h | 1 + include/linux/dma-mapping.h | 12 +- include/linux/ipv6.h | 1 + include/linux/lzo.h | 8 ++ include/linux/mlx4/device.h | 2 +- include/linux/pid.h | 1 + include/linux/rcutree.h | 2 +- include/linux/tpm.h | 2 +- include/linux/trace.h | 4 +- include/linux/trace_seq.h | 8 +- include/linux/usb/r8152.h | 1 + include/media/v4l2-subdev.h | 4 +- include/rdma/uverbs_std_types.h | 2 +- include/sound/pcm.h | 2 + include/trace/events/btrfs.h | 2 +- kernel/bpf/hashtab.c | 2 +- kernel/cgroup/cgroup.c | 2 +- kernel/fork.c | 98 +++++++++++-- kernel/padata.c | 3 +- kernel/rcu/tree_plugin.h | 11 +- kernel/softirq.c | 18 +++ kernel/time/posix-timers.c | 1 + kernel/time/timer_list.c | 4 +- kernel/trace/trace.c | 11 +- kernel/trace/trace.h | 16 ++- lib/dynamic_queue_limits.c | 2 +- lib/lzo/Makefile | 2 +- lib/lzo/lzo1x_compress.c | 102 ++++++++++---- lib/lzo/lzo1x_compress_safe.c | 18 +++ mm/memcontrol.c | 6 +- mm/page_alloc.c | 8 ++ net/bluetooth/l2cap_core.c | 15 +- net/bridge/br_nf_core.c | 7 +- net/bridge/br_private.h | 1 + net/can/bcm.c | 79 +++++++---- net/core/pktgen.c | 13 +- net/ipv4/fib_frontend.c | 18 ++- net/ipv4/fib_rules.c | 4 +- net/ipv4/fib_trie.c | 22 --- net/ipv4/inet_hashtables.c | 37 +++-- net/ipv4/tcp_input.c | 56 ++++---- net/ipv6/fib6_rules.c | 4 +- net/ipv6/ip6_output.c | 9 +- net/llc/af_llc.c | 8 +- net/mac80211/mlme.c | 4 +- net/netfilter/nf_conntrack_standalone.c | 12 +- net/sched/sch_hfsc.c | 15 +- net/sunrpc/clnt.c | 3 - net/sunrpc/rpcb_clnt.c | 5 +- net/tipc/crypto.c | 5 + net/xfrm/xfrm_policy.c | 3 + net/xfrm/xfrm_state.c | 3 + samples/bpf/Makefile | 2 +- scripts/config | 26 ++-- scripts/kconfig/merge_config.sh | 4 +- security/smack/smackfs.c | 4 + sound/core/oss/pcm_oss.c | 3 +- sound/core/pcm_native.c | 11 ++ sound/pci/hda/patch_realtek.c | 42 ++++++ sound/soc/codecs/mt6359-accdet.h | 9 ++ sound/soc/codecs/tas2764.c | 51 +++---- sound/soc/fsl/imx-card.c | 2 +- sound/soc/intel/boards/bytcr_rt5640.c | 13 ++ sound/soc/qcom/sm8250.c | 3 + sound/soc/soc-dai.c | 8 +- sound/soc/soc-ops.c | 29 +++- tools/bpf/bpftool/common.c | 3 +- tools/build/Makefile.build | 6 +- tools/lib/bpf/libbpf.c | 2 +- tools/testing/selftests/net/gro.sh | 3 +- 242 files changed, 2053 insertions(+), 882 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/207 scsi: target: iscsi: Fix timeout on deleted connection
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Bogdanov <[email protected]>
[ Upstream commit 7f533cc5ee4c4436cee51dc58e81dfd9c3384418 ]
NOPIN response timer may expire on a deleted connection and crash with such logs:
Did not receive response to NOPIN on CID: 0, failing connection for I_T Nexus (null),i,0x00023d000125,iqn.2017-01.com.iscsi.target,t,0x3d
BUG: Kernel NULL pointer dereference on read at 0x00000000 NIP strlcpy+0x8/0xb0 LR iscsit_fill_cxn_timeout_err_stats+0x5c/0xc0 [iscsi_target_mod] Call Trace: iscsit_handle_nopin_response_timeout+0xfc/0x120 [iscsi_target_mod] call_timer_fn+0x58/0x1f0 run_timer_softirq+0x740/0x860 __do_softirq+0x16c/0x420 irq_exit+0x188/0x1c0 timer_interrupt+0x184/0x410
That is because nopin response timer may be re-started on nopin timer expiration.
Stop nopin timer before stopping the nopin response timer to be sure that no one of them will be re-started.
--- drivers/target/iscsi/iscsi_target.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/target/iscsi/iscsi_target.c +1 -1
@@ -4170,8 +4170,8 @@ int iscsit_close_connection(spin_unlock (&iscsit_global->ts_bitmap_lock);iscsit_stop_timers_for_cmds (conn); -iscsit_stop_nopin_response_timer (conn);iscsit_stop_nopin_timer (conn); +iscsit_stop_nopin_response_timer (conn);if (conn->conn_transport->iscsit_wait_conn) conn->conn_transport->iscsit_wait_conn (conn);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 2/207 virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhongqiu Han <[email protected]>
[ Upstream commit 2e2f925fe737576df2373931c95e1a2b66efdfef ]
syzbot reports a data-race when accessing the event_triggered, here is the simplified stack when the issue occurred:
==================================================================
BUG: KCSAN: data-race in virtqueue_disable_cb / virtqueue_enable_cb_delayed
write to 0xffff8881025bc452 of 1 bytes by task 3288 on cpu 0:
virtqueue_enable_cb_delayed+0x42/0x3c0 drivers/virtio/virtio_ring.c:2653 start_xmit+0x230/0x1310 drivers/net/virtio_net.c:3264 __netdev_start_xmit include/linux/netdevice.h:5151 [inline] netdev_start_xmit include/linux/netdevice.h:5160 [inline] xmit_one net/core/dev.c:3800 [inline]
read to 0xffff8881025bc452 of 1 bytes by interrupt on cpu 1:
virtqueue_disable_cb_split drivers/virtio/virtio_ring.c:880 [inline] virtqueue_disable_cb+0x92/0x180 drivers/virtio/virtio_ring.c:2566 skb_xmit_done+0x5f/0x140 drivers/net/virtio_net.c:777 vring_interrupt+0x161/0x190 drivers/virtio/virtio_ring.c:2715 __handle_irq_event_percpu+0x95/0x490 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
value changed: 0x01 -> 0x00
==================================================================
When the data race occurs, the function virtqueue_enable_cb_delayed() sets event_triggered to false, and virtqueue_disable_cb_split/packed() reads it as false due to the race condition. Since event_triggered is an unreliable hint used for optimization, this should only cause the driver temporarily suggest that the device not send an interrupt notification when the event index is used.
Fix this KCSAN reported data-race issue by explicitly tagging the access as data_racy.
Message-Id: <[email protected]>
--- drivers/virtio/virtio_ring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/virtio/virtio_ring.c +1 -1
@@ -2125,7 +2125,7 @@ bool virtqueue_enable_cb_delayed(struct virtqueue *_vq)struct vring_virtqueue *vq =to_vvq (_vq);if (vq->event_triggered) - vq->event_triggered = false; +data_race (vq->event_triggered = false);return vq->packed_ring ?virtqueue_enable_cb_delayed_packed (_vq) :virtqueue_enable_cb_delayed_split (_vq);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 3/207 dma-mapping: avoid potential unused data compilation warning
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
[ Upstream commit c9b19ea63036fc537a69265acea1b18dabd1cbd3 ]
When CONFIG_NEED_DMA_MAP_STATE is not defined, dma-mapping clients might report unused data compilation warnings for dma_unmap_*() calls arguments. Redefine macros for those calls to let compiler to notice that it is okay when the provided arguments are not used.
--- include/linux/dma-mapping.h | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
include/linux/dma-mapping.h +8 -4
@@ -595,10 +595,14 @@ static inline int dma_mmap_wc(struct device *dev,#else #define DEFINE_DMA_UNMAP_ADDR (ADDR_NAME )#define DEFINE_DMA_UNMAP_LEN (LEN_NAME ) -#define dma_unmap_addr (PTR ,ADDR_NAME ) (0) -#define dma_unmap_addr_set (PTR ,ADDR_NAME ,VAL ) do { } while (0) -#define dma_unmap_len (PTR ,LEN_NAME ) (0) -#define dma_unmap_len_set (PTR ,LEN_NAME ,VAL ) do { } while (0) +#define dma_unmap_addr (PTR ,ADDR_NAME ) \ + ({ typeof(PTR) __p __maybe_unused = PTR; 0; }) +#define dma_unmap_addr_set (PTR ,ADDR_NAME ,VAL ) \ + do { typeof(PTR) __p __maybe_unused = PTR; } while (0) +#define dma_unmap_len (PTR ,LEN_NAME ) \ + ({ typeof(PTR) __p __maybe_unused = PTR; 0; }) +#define dma_unmap_len_set (PTR ,LEN_NAME ,VAL ) \ + do { typeof(PTR) __p __maybe_unused = PTR; } while (0)#endif #endif /* _LINUX_DMA_MAPPING_H */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 4/207 cgroup: Fix compilation issue due to cgroup_mutex not being exported
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: gaoxu <[email protected]>
[ Upstream commit 87c259a7a359e73e6c52c68fcbec79988999b4e6 ]
When adding folio_memcg function call in the zram module for Android16-6.12, the following error occurs during compilation:
ERROR: modpost: "cgroup_mutex" [../soc-repo/zram.ko] undefined!
This error is caused by the indirect call to lockdep_is_held(&cgroup_mutex) within folio_memcg. The export setting for cgroup_mutex is controlled by the CONFIG_PROVE_RCU macro. If CONFIG_LOCKDEP is enabled while CONFIG_PROVE_RCU is not, this compilation error will occur.
To resolve this issue, add a parallel macro CONFIG_LOCKDEP control to ensure cgroup_mutex is properly exported when needed.
--- kernel/cgroup/cgroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/cgroup/cgroup.c +1 -1
@@ -89,7 +89,7 @@DEFINE_MUTEX (cgroup_mutex);DEFINE_SPINLOCK (css_set_lock); -#ifdef CONFIG_PROVE_RCU +#if (definedCONFIG_PROVE_RCU || definedCONFIG_LOCKDEP )EXPORT_SYMBOL_GPL (cgroup_mutex);EXPORT_SYMBOL_GPL (css_set_lock);#endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 5/207 net: enetc: refactor bulk flipping of RX buffers to separate function
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit 1d587faa5be7e9785b682cc5f58ba8f4100c13ea ]
This small snippet of code ensures that we do something with the array of RX software buffer descriptor elements after passing the skb to the stack. In this case, we see if the other half of the page is reusable, and if so, we "turn around" the buffers, making them directly usable by enetc_refill_rx_ring() without going to enetc_new_page().
We will need to perform this kind of buffer flipping from a new code path, i.e. from XDP_PASS. Currently, enetc_build_skb() does it there buffer by buffer, but in a subsequent change we will stop using enetc_build_skb() for XDP_PASS.
--- drivers/net/ethernet/freescale/enetc/enetc.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
drivers/net/ethernet/freescale/enetc/enetc.c +11 -5
@@ -1264,6 +1264,16 @@ static void enetc_xdp_drop(struct enetc_bdr *rx_ring, int rx_ring_first, } } +static void enetc_bulk_flip_buff (struct enetc_bdr *rx_ring,int rx_ring_first, +int rx_ring_last) +{ +while (rx_ring_first != rx_ring_last) { +enetc_flip_rx_buff (rx_ring, + &rx_ring->rx_swbd[rx_ring_first]); +enetc_bdr_idx_inc (rx_ring, &rx_ring_first); + } +} +static int enetc_clean_rx_ring_xdp (struct enetc_bdr *rx_ring,struct napi_struct *napi,int work_limit,struct bpf_prog *prog)
@@ -1379,11 +1389,7 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring,enetc_xdp_drop (rx_ring, orig_i, i); rx_ring->stats.xdp_redirect_failures++; }else { -while (orig_i != i) { -enetc_flip_rx_buff (rx_ring, - &rx_ring->rx_swbd[orig_i]); -enetc_bdr_idx_inc (rx_ring, &orig_i); - } +enetc_bulk_flip_buff (rx_ring, orig_i, i); xdp_redirect_frm_cnt++; rx_ring->stats.xdp_redirect++; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 6/207 bpf: fix possible endless loop in BPF map iteration
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brandon Kammerdiener <[email protected]>
[ Upstream commit 75673fda0c557ae26078177dd14d4857afbf128d ]
The _safe variant used here gets the next element before running the callback, avoiding the endless loop condition.
--- kernel/bpf/hashtab.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/bpf/hashtab.c +1 -1
@@ -2102,7 +2102,7 @@ static int bpf_for_each_hash_elem(struct bpf_map *map, void *callback_fn, b = &htab->buckets[i];rcu_read_lock (); head = &b->head; -hlist_nulls_for_each_entry_rcu (elem, n, head, hash_node) { +hlist_nulls_for_each_entry_safe (elem, n, head, hash_node) { key = elem->key;if (is_percpu) {/* current cpu value for percpu map */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 7/207 samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoran Jiang <[email protected]>
[ Upstream commit 548762f05d19c5542db7590bcdfb9be1fb928376 ]
When building the latest samples/bpf on LoongArch Fedora
make M=samples/bpf
There are compilation errors as follows:
In file included from ./linux/samples/bpf/sockex2_kern.c:2:
In file included from ./include/uapi/linux/in.h:25:
In file included from ./include/linux/socket.h:8:
In file included from ./include/linux/uio.h:9:
In file included from ./include/linux/thread_info.h:60:
In file included from ./arch/loongarch/include/asm/thread_info.h:15:
In file included from ./arch/loongarch/include/asm/processor.h:13:
In file included from ./arch/loongarch/include/asm/cpu-info.h:11:./arch/loongarch/include/asm/loongarch.h:13:10: fatal error: 'larchintrin.h' file not found
^~~~~~~~~~~~~~~
1 error generated.
larchintrin.h is included in /usr/lib64/clang/14.0.6/include, and the header file location is specified at compile time.
Test on LoongArch Fedora:
https://github.com/fedora-remix-loongarch/releases-info
--- samples/bpf/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
samples/bpf/Makefile +1 -1
@@ -438,7 +438,7 @@ $(obj)/%.o: $(src)/%.c @echo " CLANG-bpf " $@ $(Q)$(CLANG) $(NOSTDINC_FLAGS) $(LINUXINCLUDE) $(BPF_EXTRA_CFLAGS) \ -I$(obj) -I$(srctree)/tools/testing/selftests/bpf/ \ - -I$(LIBBPF_INCLUDE) \ + -I$(LIBBPF_INCLUDE) $(CLANG_SYS_INCLUDES) \ -D__KERNEL__ -D__BPF_TRACING__ -Wno-unused-value -Wno-pointer-sign \ -D__TARGET_ARCH_$(SRCARCH) -Wno-compare-distinct-pointer-types \ -Wno-gnu-variable-sized-type-not-at-end \
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 8/207 kconfig: merge_config: use an empty file as initfile
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Gomez <[email protected]>
[ Upstream commit a26fe287eed112b4e21e854f173c8918a6a8596d ]
The scripts/kconfig/merge_config.sh script requires an existing $INITFILE (or the $1 argument) as a base file for merging Kconfig fragments. However, an empty $INITFILE can serve as an initial starting point, later referenced by the KCONFIG_ALLCONFIG Makefile variable if -m is not used. This variable can point to any configuration file containing preset config symbols (the merged output) as stated in Documentation/kbuild/kconfig.rst. When -m is used $INITFILE will contain just the merge output requiring the user to run make (i.e. KCONFIG_ALLCONFIG=<$INITFILE> make <allnoconfig/alldefconfig> or make olddefconfig).
Instead of failing when $INITFILE is missing, create an empty file and use it as the starting point for merges.
--- scripts/kconfig/merge_config.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
scripts/kconfig/merge_config.sh +2 -2
@@ -105,8 +105,8 @@ INITFILE=$1 shift; if [ ! -r "$INITFILE" ]; then - echo "The base file '$INITFILE' does not exist. Exit." >&2 - exit 1 + echo "The base file '$INITFILE' does not exist. Creating one..." >&2 + touch "$INITFILE" fi MERGE_LIST=$*
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 9/207 NFSv4: Check for delegation validity in nfs_start_delegation_return_locked()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 9e8f324bd44c1fe026b582b75213de4eccfa1163 ]
Check that the delegation is still attached after taking the spin lock in nfs_start_delegation_return_locked().
--- fs/nfs/delegation.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nfs/delegation.c +2 -1
@@ -297,7 +297,8 @@ nfs_start_delegation_return_locked(struct nfs_inode *nfsi)if (delegation ==NULL ) goto out;spin_lock (&delegation->lock); -if (!test_and_set_bit (NFS_DELEGATION_RETURNING , &delegation->flags)) { +if (delegation->inode && + !test_and_set_bit (NFS_DELEGATION_RETURNING , &delegation->flags)) {clear_bit (NFS_DELEGATION_RETURN_DELAYED , &delegation->flags);/* Refcount matched in nfs_end_delegation_return() */ ret =nfs_get_delegation (delegation);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 10/207 tracing: Mark binary printing functions with __printf() attribute
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 196a062641fe68d9bfe0ad36b6cd7628c99ad22c ]
Binary printing functions are using printf() type of format, and compiler is not happy about them as is:
kernel/trace/trace.c:3292:9: error: function ‘trace_vbprintk’ might be a candidate for ‘gnu_printf’ format attribute [-Werror=suggest-attribute=format] kernel/trace/trace_seq.c:182:9: error: function ‘trace_seq_bprintf’ might be a candidate for ‘gnu_printf’ format attribute [-Werror=suggest-attribute=format]
Fix the compilation errors by adding __printf() attribute.
While at it, move existing __printf() attributes from the implementations to the declarations. IT also fixes incorrect attribute parameters that are used for trace_array_printk().
--- include/linux/trace.h | 4 ++-- include/linux/trace_seq.h | 8 ++++---- kernel/trace/trace.c | 11 +++-------- kernel/trace/trace.h | 16 +++++++++------- 4 files changed, 18 insertions(+), 21 deletions(-)
include/linux/trace.h +2 -2
@@ -72,8 +72,8 @@ static inline int unregister_ftrace_export(struct trace_export *export)static inline void trace_printk_init_buffers (void ) { } -static inline int trace_array_printk (struct trace_array *tr,unsigned long ip, -const char *fmt, ...) +static inline __printf(3, 4) +int trace_array_printk(struct trace_array *tr, unsigned long ip, const char *fmt, ...) {return 0 ; }
include/linux/trace_seq.h +4 -4
@@ -77,8 +77,8 @@ extern __printf(2, 3)void trace_seq_printf (struct trace_seq *s,const char *fmt, ...); extern __printf(2, 0) void trace_seq_vprintf(struct trace_seq *s, const char *fmt, va_list args); -extern void -trace_seq_bprintf(struct trace_seq *s, const char *fmt, const u32 *binary); +extern __printf(2, 0) +void trace_seq_bprintf(struct trace_seq *s, const char *fmt, const u32 *binary); extern int trace_print_seq(struct seq_file *m, struct trace_seq *s); extern int trace_seq_to_user(struct trace_seq *s, char __user *ubuf, int cnt);
@@ -100,8 +100,8 @@ extern int trace_seq_hex_dump(struct trace_seq *s, const char *prefix_str,static inline void trace_seq_printf (struct trace_seq *s,const char *fmt, ...) { } -static inline void -trace_seq_bprintf (struct trace_seq *s,const char *fmt,const u32 *binary) +static inline __printf(2, 0) +void trace_seq_bprintf(struct trace_seq *s, const char *fmt, const u32 *binary) { }
kernel/trace/trace.c +3 -8
@@ -3402,10 +3402,9 @@ int trace_vbprintk(unsigned long ip, const char *fmt, va_list args) }EXPORT_SYMBOL_GPL (trace_vbprintk); -__printf(3, 0) -static int -__trace_array_vprintk (struct trace_buffer *buffer, -unsigned long ip,const char *fmt,va_list args) +static __printf(3, 0) +int __trace_array_vprintk(struct trace_buffer *buffer, + unsigned long ip, const char *fmt, va_list args) { struct trace_event_call *call = &event_print;struct ring_buffer_event *event;
@@ -3458,7 +3457,6 @@ __trace_array_vprintk(struct trace_buffer *buffer,return len; } -__printf(3, 0)int trace_array_vprintk (struct trace_array *tr,unsigned long ip,const char *fmt,va_list args) {
@@ -3485,7 +3483,6 @@ int trace_array_vprintk(struct trace_array *tr,* Note, trace_array_init_printk() must be called on @tr before this * can be used. */ -__printf(3, 0)int trace_array_printk (struct trace_array *tr,unsigned long ip,const char *fmt, ...) {
@@ -3530,7 +3527,6 @@ int trace_array_init_printk(struct trace_array *tr) }EXPORT_SYMBOL_GPL (trace_array_init_printk); -__printf(3, 4)int trace_array_printk_buf (struct trace_buffer *buffer,unsigned long ip,const char *fmt, ...) {
@@ -3546,7 +3542,6 @@ int trace_array_printk_buf(struct trace_buffer *buffer,return ret; } -__printf(2, 0)int trace_vprintk (unsigned long ip,const char *fmt,va_list args) {return trace_array_vprintk (&global_trace, ip, fmt, args);
kernel/trace/trace.h +9 -7
@@ -781,13 +781,15 @@ static inline void __init disable_tracing_selftest(const char *reason)extern void *head_page (struct trace_array_cpu *data);extern unsigned long long ns2usecs (u64 nsec); -extern int -trace_vbprintk (unsigned long ip,const char *fmt,va_list args); -extern int -trace_vprintk (unsigned long ip,const char *fmt,va_list args); -extern int -trace_array_vprintk (struct trace_array *tr, -unsigned long ip,const char *fmt,va_list args); + +__printf(2, 0) +int trace_vbprintk (unsigned long ip,const char *fmt,va_list args); +__printf(2, 0) +int trace_vprintk (unsigned long ip,const char *fmt,va_list args); +__printf(3, 0) +int trace_array_vprintk (struct trace_array *tr, +unsigned long ip,const char *fmt,va_list args); +__printf(3, 4)int trace_array_printk_buf (struct trace_buffer *buffer,unsigned long ip,const char *fmt, ...);void trace_printk_seq (struct trace_seq *s);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/207 mailbox: use error ret code of of_parse_phandle_with_args()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tudor Ambarus <[email protected]>
[ Upstream commit 24fdd5074b205cfb0ef4cd0751a2d03031455929 ]
In case of error, of_parse_phandle_with_args() returns -EINVAL when the passed index is negative, or -ENOENT when the index is for an empty phandle. The mailbox core overwrote the error return code with a less precise -ENODEV. Use the error returned code from of_parse_phandle_with_args().
--- drivers/mailbox/mailbox.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/mailbox/mailbox.c +4 -3
@@ -350,11 +350,12 @@ struct mbox_chan *mbox_request_channel(struct mbox_client *cl, int index)mutex_lock (&con_mutex); -if (of_parse_phandle_with_args (dev->of_node,"mboxes" , -"#mbox-cells" , index, &spec)) { + ret =of_parse_phandle_with_args (dev->of_node,"mboxes" ,"#mbox-cells" , + index, &spec); +if (ret) {dev_dbg (dev,"%s: can't parse \"mboxes\" property\n" , __func__);mutex_unlock (&con_mutex); -return ERR_PTR (-ENODEV ); +return ERR_PTR (ret); } chan =ERR_PTR (-EPROBE_DEFER );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/207 fbdev: fsl-diu-fb: add missing device_remove_file()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shixiong Ou <[email protected]>
[ Upstream commit 86d16cd12efa547ed43d16ba7a782c1251c80ea8 ]
Call device_remove_file() when driver remove.
--- drivers/video/fbdev/fsl-diu-fb.c | 1 + 1 file changed, 1 insertion(+)
drivers/video/fbdev/fsl-diu-fb.c +1 -0
@@ -1829,6 +1829,7 @@ static int fsl_diu_remove(struct platform_device *pdev)int i; data =dev_get_drvdata (&pdev->dev); +device_remove_file (&pdev->dev, &data->dev_attr);disable_lcdc (&data->fsl_diu_info[0 ]);free_irq (data->irq, data->diu_reg);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/207 fbcon: Use correct erase colour for clearing in fbcon
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zsolt Kajtar <[email protected]>
[ Upstream commit 892c788d73fe4a94337ed092cb998c49fa8ecaf4 ]
The erase colour calculation for fbcon clearing should use get_color instead of attr_col_ec, like everything else. The latter is similar but is not correct. For example it's missing the depth dependent remapping and doesn't care about blanking.
The problem can be reproduced by setting up the background colour to grey (vt.color=0x70) and having an fbcon console set to 2bpp (4 shades of gray). Now the background attribute should be 1 (dark gray) on the console.
If the screen is scrolled when pressing enter in a shell prompt at the bottom line then the new line is cleared using colour 7 instead of 1. That's not something fillrect likes (at 2bbp it expect 0-3) so the result is interesting.
This patch switches to get_color with vc_video_erase_char to determine the erase colour from attr_col_ec. That makes the latter function redundant as no other users were left.
Use correct erase colour for clearing in fbcon
--- drivers/video/fbdev/core/bitblit.c | 5 ++-- drivers/video/fbdev/core/fbcon.c | 10 +++++--- drivers/video/fbdev/core/fbcon.h | 38 +--------------------------- drivers/video/fbdev/core/fbcon_ccw.c | 5 ++-- drivers/video/fbdev/core/fbcon_cw.c | 5 ++-- drivers/video/fbdev/core/fbcon_ud.c | 5 ++-- drivers/video/fbdev/core/tileblit.c | 8 +++--- 7 files changed, 18 insertions(+), 58 deletions(-)
drivers/video/fbdev/core/bitblit.c +2 -3
@@ -59,12 +59,11 @@ static void bit_bmove(struct vc_data *vc, struct fb_info *info, int sy, }static void bit_clear (struct vc_data *vc,struct fb_info *info,int sy, -int sx,int height,int width) +int sx,int height,int width,int fg,int bg) { -int bgshift = (vc->vc_hi_font_mask) ?13 :12 ;struct fb_fillrect region; - region.color =attr_bgcol_ec (bgshift, vc, info); + region.color = bg; region.dx = sx * vc->vc_font.width; region.dy = sy * vc->vc_font.height; region.width = width * vc->vc_font.width;
drivers/video/fbdev/core/fbcon.c +6 -4
@@ -1249,7 +1249,7 @@ static void fbcon_clear(struct vc_data *vc, int sy, int sx, int height, {struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]];struct fbcon_ops *ops = info->fbcon_par; - +int fg, bg;struct fbcon_display *p = &fb_display[vc->vc_num];u_int y_break;
@@ -1270,16 +1270,18 @@ static void fbcon_clear(struct vc_data *vc, int sy, int sx, int height,fbcon_clear_margins (vc,0 ); } + fg =get_color (vc, info, vc->vc_video_erase_char,1 ); + bg =get_color (vc, info, vc->vc_video_erase_char,0 );/* Split blits that cross physical y_wrap boundary */ y_break = p->vrows - p->yscroll;if (sy < y_break && sy + height -1 >= y_break) {u_int b = y_break - sy; - ops->clear (vc, info,real_y (p, sy), sx, b, width); + ops->clear (vc, info,real_y (p, sy), sx, b, width, fg, bg); ops->clear (vc, info,real_y (p, sy + b), sx, height - b, - width); + width, fg, bg); }else - ops->clear (vc, info,real_y (p, sy), sx, height, width); + ops->clear (vc, info,real_y (p, sy), sx, height, width, fg, bg); } static void fbcon_putcs(struct vc_data *vc, const unsigned short *s,
drivers/video/fbdev/core/fbcon.h +1 -37
@@ -57,7 +57,7 @@ struct fbcon_ops {void (*bmove)(struct vc_data *vc,struct fb_info *info,int sy,int sx,int dy,int dx,int height,int width);void (*clear)(struct vc_data *vc,struct fb_info *info,int sy, -int sx,int height,int width); +int sx,int height,int width,int fb,int bg);void (*putcs)(struct vc_data *vc,struct fb_info *info,const unsigned short *s,int count,int yy,int xx,int fg,int bg);
@@ -118,42 +118,6 @@ static inline int mono_col(const struct fb_info *info)return (~(0xfff << max_len)) &0xff ; } -static inline int attr_col_ec (int shift,struct vc_data *vc, -struct fb_info *info,int is_fg) -{ -int is_mono01; -int col; -int fg; -int bg; - -if (!vc) -return 0 ; - -if (vc->vc_can_do_color) -return is_fg ?attr_fgcol (shift,vc->vc_video_erase_char) - :attr_bgcol (shift,vc->vc_video_erase_char); - -if (!info) -return 0 ; - - col =mono_col (info); - is_mono01 = info->fix.visual ==FB_VISUAL_MONO01 ; - -if (attr_reverse (vc->vc_video_erase_char)) { - fg = is_mono01 ? col :0 ; - bg = is_mono01 ?0 : col; - } -else { - fg = is_mono01 ?0 : col; - bg = is_mono01 ? col :0 ; - } - -return is_fg ? fg : bg; -} - -#define attr_bgcol_ec (bgshift, vc, info) attr_col_ec(bgshift, vc, info, 0) -#define attr_fgcol_ec (fgshift, vc, info) attr_col_ec(fgshift, vc, info, 1) -/* * Scroll Method */
drivers/video/fbdev/core/fbcon_ccw.c +2 -3
@@ -78,14 +78,13 @@ static void ccw_bmove(struct vc_data *vc, struct fb_info *info, int sy, }static void ccw_clear (struct vc_data *vc,struct fb_info *info,int sy, -int sx,int height,int width) +int sx,int height,int width,int fg,int bg) {struct fbcon_ops *ops = info->fbcon_par;struct fb_fillrect region; -int bgshift = (vc->vc_hi_font_mask) ?13 :12 ;u32 vyres =GETVYRES (ops->p, info); - region.color =attr_bgcol_ec (bgshift,vc,info); + region.color = bg; region.dx = sy * vc->vc_font.height; region.dy = vyres - ((sx + width) * vc->vc_font.width); region.height = width * vc->vc_font.width;
drivers/video/fbdev/core/fbcon_cw.c +2 -3
@@ -63,14 +63,13 @@ static void cw_bmove(struct vc_data *vc, struct fb_info *info, int sy, }static void cw_clear (struct vc_data *vc,struct fb_info *info,int sy, -int sx,int height,int width) +int sx,int height,int width,int fg,int bg) {struct fbcon_ops *ops = info->fbcon_par;struct fb_fillrect region; -int bgshift = (vc->vc_hi_font_mask) ?13 :12 ;u32 vxres =GETVXRES (ops->p, info); - region.color =attr_bgcol_ec (bgshift,vc,info); + region.color = bg; region.dx = vxres - ((sy + height) * vc->vc_font.height); region.dy = sx * vc->vc_font.width; region.height = width * vc->vc_font.width;
drivers/video/fbdev/core/fbcon_ud.c +2 -3
@@ -64,15 +64,14 @@ static void ud_bmove(struct vc_data *vc, struct fb_info *info, int sy, }static void ud_clear (struct vc_data *vc,struct fb_info *info,int sy, -int sx,int height,int width) +int sx,int height,int width,int fg,int bg) {struct fbcon_ops *ops = info->fbcon_par;struct fb_fillrect region; -int bgshift = (vc->vc_hi_font_mask) ?13 :12 ;u32 vyres =GETVYRES (ops->p, info);u32 vxres =GETVXRES (ops->p, info); - region.color =attr_bgcol_ec (bgshift,vc,info); + region.color = bg; region.dy = vyres - ((sy + height) * vc->vc_font.height); region.dx = vxres - ((sx + width) * vc->vc_font.width); region.width = width * vc->vc_font.width;
drivers/video/fbdev/core/tileblit.c +3 -5
@@ -32,16 +32,14 @@ static void tile_bmove(struct vc_data *vc, struct fb_info *info, int sy, }static void tile_clear (struct vc_data *vc,struct fb_info *info,int sy, -int sx,int height,int width) +int sx,int height,int width,int fg,int bg) {struct fb_tilerect rect; -int bgshift = (vc->vc_hi_font_mask) ?13 :12 ; -int fgshift = (vc->vc_hi_font_mask) ?9 :8 ; rect.index = vc->vc_video_erase_char & ((vc->vc_hi_font_mask) ?0x1ff :0xff ); - rect.fg =attr_fgcol_ec (fgshift, vc, info); - rect.bg =attr_bgcol_ec (bgshift, vc, info); + rect.fg = fg; + rect.bg = bg; rect.sx = sx; rect.sy = sy; rect.width = width;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/207 fbdev: core: tileblit: Implement missing margin clearing for tileblit
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zsolt Kajtar <[email protected]>
[ Upstream commit 76d3ca89981354e1f85a3e0ad9ac4217d351cc72 ]
I was wondering why there's garbage at the bottom of the screen when tile blitting is used with an odd mode like 1080, 600 or 200. Sure there's only space for half a tile but the same area is clean when the buffer is bitmap.
Then later I found that it's supposed to be cleaned but that's not implemented. So I took what's in bitblit and adapted it for tileblit.
This implementation was tested for both the horizontal and vertical case, and now does the same as what's done for bitmap buffers.
If anyone is interested to reproduce the problem then I could bet that'd be on a S3 or Ark. Just set up a mode with an odd line count and make sure that the virtual size covers the complete tile at the bottom. E.g. for 600 lines that's 608 virtual lines for a 16 tall tile. Then the bottom area should be cleaned.
For the right side it's more difficult as there the drivers won't let an odd size happen, unless the code is modified. But once it reports back a few pixel columns short then fbcon won't use the last column. With the patch that column is now clean.
Btw. the virtual size should be rounded up by the driver for both axes (not only the horizontal) so that it's dividable by the tile size. That's a driver bug but correcting it is not in scope for this patch.
Implement missing margin clearing for tileblit
--- drivers/video/fbdev/core/tileblit.c | 37 ++++++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-)
drivers/video/fbdev/core/tileblit.c +36 -1
@@ -74,7 +74,42 @@ static void tile_putcs(struct vc_data *vc, struct fb_info *info,static void tile_clear_margins (struct vc_data *vc,struct fb_info *info,int color,int bottom_only) { -return ; +unsigned int cw = vc->vc_font.width; +unsigned int ch = vc->vc_font.height; +unsigned int rw = info->var.xres - (vc->vc_cols*cw); +unsigned int bh = info->var.yres - (vc->vc_rows*ch); +unsigned int rs = info->var.xres - rw; +unsigned int bs = info->var.yres - bh; +unsigned int vwt = info->var.xres_virtual / cw; +unsigned int vht = info->var.yres_virtual / ch; +struct fb_tilerect rect; + + rect.index = vc->vc_video_erase_char & + ((vc->vc_hi_font_mask) ?0x1ff :0xff ); + rect.fg = color; + rect.bg = color; + +if ((int ) rw >0 && !bottom_only) { + rect.sx = (info->var.xoffset + rs + cw -1 ) / cw; + rect.sy =0 ; + rect.width = (rw + cw -1 ) / cw; + rect.height = vht; +if (rect.width + rect.sx > vwt) + rect.width = vwt - rect.sx; +if (rect.sx < vwt) + info->tileops->fb_tilefill (info, &rect); + } + +if ((int ) bh >0 ) { + rect.sx = info->var.xoffset / cw; + rect.sy = (info->var.yoffset + bs) / ch; + rect.width = rs / cw; + rect.height = (bh + ch -1 ) / ch; +if (rect.height + rect.sy > vht) + rect.height = vht - rect.sy; +if (rect.sy < vht) + info->tileops->fb_tilefill (info, &rect); + } } static void tile_cursor(struct vc_data *vc, struct fb_info *info, int mode,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/207 NFSv4: Treat ENETUNREACH errors as fatal for state recovery
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 0af5fb5ed3d2fd9e110c6112271f022b744a849a ]
If a containerised process is killed and causes an ENETUNREACH or ENETDOWN error to be propagated to the state manager, then mark the nfs_client as being dead so that we don't loop in functions that are expecting recovery to succeed.
--- fs/nfs/nfs4state.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
fs/nfs/nfs4state.c +9 -1
@@ -2726,7 +2726,15 @@ static void nfs4_state_manager(struct nfs_client *clp)pr_warn_ratelimited ("NFS: state manager%s%s failed on NFSv4 server %s" " with error %d\n" , section_sep, section, clp->cl_hostname, -status); -ssleep (1 ); +switch (status) { +case -ENETDOWN : +case -ENETUNREACH : +nfs_mark_client_ready (clp, -EIO ); +break ; +default : +ssleep (1 ); +break ; + } out_drain:memalloc_nofs_restore (memflags);nfs4_end_drain_session (clp);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/207 SUNRPC: rpc_clnt_set_transport() must not change the autobind setting
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit bf9be373b830a3e48117da5d89bb6145a575f880 ]
The autobind setting was supposed to be determined in rpc_create(), since commit c2866763b402 ("SUNRPC: use sockaddr + size when creating remote transport endpoints").
--- net/sunrpc/clnt.c | 3 --- 1 file changed, 3 deletions(-)
net/sunrpc/clnt.c +0 -3
@@ -275,9 +275,6 @@ static struct rpc_xprt *rpc_clnt_set_transport(struct rpc_clnt *clnt, old =rcu_dereference_protected (clnt->cl_xprt,lockdep_is_held (&clnt->cl_lock)); -if (!xprt_bound (xprt)) - clnt->cl_autobind =1 ; - clnt->cl_timeout = timeout;rcu_assign_pointer (clnt->cl_xprt, xprt);spin_unlock (&clnt->cl_lock);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/207 SUNRPC: rpcbind should never reset the port to the value 0
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 214c13e380ad7636631279f426387f9c4e3c14d9 ]
If we already had a valid port number for the RPC service, then we should not allow the rpcbind client to set it to the invalid value '0'.
--- net/sunrpc/rpcb_clnt.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/sunrpc/rpcb_clnt.c +3 -2
@@ -797,9 +797,10 @@ static void rpcb_getport_done(struct rpc_task *child, void *data) }trace_rpcb_setport (child, map->r_status, map->r_port); - xprt->ops->set_port (xprt, map->r_port); -if (map->r_port) +if (map->r_port) { + xprt->ops->set_port (xprt, map->r_port);xprt_set_bound (xprt); + } }/*
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/207 thermal/drivers/qoriq: Power down TMU on system suspend
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Guo <[email protected]>
[ Upstream commit 229f3feb4b0442835b27d519679168bea2de96c2 ]
Enable power-down of TMU (Thermal Management Unit) for TMU version 2 during system suspend to save power. Save approximately 4.3mW on VDD_ANA_1P8 on i.MX93 platforms.
--- drivers/thermal/qoriq_thermal.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/thermal/qoriq_thermal.c +13 -0
@@ -19,6 +19,7 @@#define SITES_MAX 16#define TMR_DISABLE 0x0#define TMR_ME 0x80000000 +#define TMR_CMD BIT(29)#define TMR_ALPF 0x0c000000#define TMR_ALPF_V2 0x03000000#define TMTMIR_DEFAULT 0x0000000f
@@ -345,6 +346,12 @@ static int __maybe_unused qoriq_tmu_suspend(struct device *dev)if (ret)return ret; +if (data->ver >TMU_VER1 ) { + ret =regmap_set_bits (data->regmap,REGS_TMR ,TMR_CMD ); +if (ret) +return ret; + } +clk_disable_unprepare (data->clk);return 0 ;
@@ -359,6 +366,12 @@ static int __maybe_unused qoriq_tmu_resume(struct device *dev)if (ret)return ret; +if (data->ver >TMU_VER1 ) { + ret =regmap_clear_bits (data->regmap,REGS_TMR ,TMR_CMD ); +if (ret) +return ret; + } +/* Enable monitoring */ return regmap_update_bits (data->regmap,REGS_TMR ,TMR_ME ,TMR_ME ); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/207 dql: Fix dql->limit value when reset.
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jing Su <[email protected]>
[ Upstream commit 3a17f23f7c36bac3a3584aaf97d3e3e0b2790396 ]
Executing dql_reset after setting a non-zero value for limit_min can lead to an unreasonable situation where dql->limit is less than dql->limit_min.
For instance, after setting /sys/class/net/eth*/queues/tx-0/byte_queue_limits/limit_min, an ifconfig down/up operation might cause the ethernet driver to call netdev_tx_reset_queue, which in turn invokes dql_reset.
In this case, dql->limit is reset to 0 while dql->limit_min remains non-zero value, which is unexpected. The limit should always be greater than or equal to limit_min.
--- lib/dynamic_queue_limits.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/dynamic_queue_limits.c +1 -1
@@ -116,7 +116,7 @@ EXPORT_SYMBOL(dql_completed);void dql_reset (struct dql *dql) {/* Reset all dynamic values */ - dql->limit =0 ; + dql->limit = dql->min_limit; dql->num_queued =0 ; dql->num_completed =0 ; dql->last_obj_cnt =0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/207 lockdep: Fix wait context check on softirq for PREEMPT_RT
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryo Takakura <[email protected]>
[ Upstream commit 61c39d8c83e2077f33e0a2c8980a76a7f323f0ce ]
Since:
0c1d7a2c2d32 ("lockdep: Remove softirq accounting on PREEMPT_RT.")
the wait context test for mutex usage within "in softirq context" fails as it references @softirq_context:
| wait context tests |
--------------------------------------------------------------------------
| rcu | raw | spin |mutex |
--------------------------------------------------------------------------
in hardirq context: ok | ok | ok | ok |
in hardirq context (not threaded): ok | ok | ok | ok |
in softirq context: ok | ok | ok |FAILED|As a fix, add lockdep map for BH disabled section. This fixes the issue by letting us catch cases when local_bh_disable() gets called with preemption disabled where local_lock doesn't get acquired. In the case of "in softirq context" selftest, local_bh_disable() was being called with preemption disable as it's early in the boot.
[ boqun: Move the lockdep annotations into __local_bh_*() to avoid false
positives because of unpaired local_bh_disable() reported by Borislav Petkov and Peter Zijlstra, and make bh_lock_map only exist for PREEMPT_RT. ]
[ mingo: Restored authorship and improved the bh_lock_map definition. ]
--- kernel/softirq.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
kernel/softirq.c +18 -0
@@ -140,6 +140,18 @@ static DEFINE_PER_CPU(struct softirq_ctrl, softirq_ctrl) = { .lock = INIT_LOCAL_LOCK(softirq_ctrl.lock), }; +#ifdef CONFIG_DEBUG_LOCK_ALLOC +static struct lock_class_key bh_lock_key; +struct lockdep_map bh_lock_map = { + .name ="local_bh" , + .key = &bh_lock_key, + .wait_type_outer =LD_WAIT_FREE , + .wait_type_inner =LD_WAIT_CONFIG ,/* PREEMPT_RT makes BH preemptible. */ + .lock_type =LD_LOCK_PERCPU , +}; +EXPORT_SYMBOL_GPL (bh_lock_map); +#endif +/** * local_bh_blocked() - Check for idle whether BH processing is blocked *
@@ -162,6 +174,8 @@ void __local_bh_disable_ip(unsigned long ip, unsigned int cnt)WARN_ON_ONCE (in_hardirq ()); +lock_map_acquire_read (&bh_lock_map); +/* First entry of a task into a BH disabled section? */ if (!current->softirq_disable_cnt) {if (preemptible ()) {
@@ -225,6 +239,8 @@ void __local_bh_enable_ip(unsigned long ip, unsigned int cnt)WARN_ON_ONCE (in_irq ());lockdep_assert_irqs_enabled (); +lock_map_release (&bh_lock_map); +local_irq_save (flags); curcnt =__this_cpu_read (softirq_ctrl.cnt);
@@ -275,6 +291,8 @@ static inline void ksoftirqd_run_begin(void)/* Counterpart to ksoftirqd_run_begin() */ static inline void ksoftirqd_run_end (void ) { +/* pairs with the lock_map_acquire_read() in ksoftirqd_run_begin() */ +lock_map_release (&bh_lock_map);__local_bh_enable (SOFTIRQ_OFFSET , true);WARN_ON_ONCE (in_interrupt ());local_irq_enable ();
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/207 PCI: dwc: ep: Ensure proper iteration over outbound map windows
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
[ Upstream commit f3e1dccba0a0833fc9a05fb838ebeb6ea4ca0e1a ]
Most systems' PCIe outbound map windows have non-zero physical addresses, but the possibility of encountering zero increased after following commit ("PCI: dwc: Use parent_bus_offset").
'ep->outbound_addr[n]', representing 'parent_bus_address', might be 0 on some hardware, which trims high address bits through bus fabric before sending to the PCIe controller.
Replace the iteration logic with 'for_each_set_bit()' to ensure only allocated map windows are iterated when determining the ATU index from a given address.
--- drivers/pci/controller/dwc/pcie-designware-ep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/controller/dwc/pcie-designware-ep.c +1 -1
@@ -267,7 +267,7 @@ static int dw_pcie_find_index(struct dw_pcie_ep *ep, phys_addr_t addr,u32 index;struct dw_pcie *pci =to_dw_pcie_from_ep (ep); -for (index =0 ; index < pci->num_ob_windows; index++) { +for_each_set_bit (index, ep->ob_window_map, pci->num_ob_windows) {if (ep->outbound_addr[index] != addr)continue ; *atu_index = index;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/207 tools/build: Dont pass test log files to linker
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 935e7cb5bb80106ff4f2fe39640f430134ef8cd8 ]
Separate test log files from object files. Depend on test log output but don't pass to the linker.
--- tools/build/Makefile.build | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
tools/build/Makefile.build +5 -1
@@ -130,6 +130,10 @@ objprefix := $(subst ./,,$(OUTPUT)$(dir)/) obj-y := $(addprefix $(objprefix),$(obj-y)) subdir-obj-y := $(addprefix $(objprefix),$(subdir-obj-y)) +# Separate out test log files from real build objects. +test-y := $(filter %_log, $(obj-y)) +obj-y := $(filter-out %_log, $(obj-y)) + # Final '$(obj)-in.o' object in-target := $(objprefix)$(obj)-in.o
@@ -140,7 +144,7 @@ $(subdir-y): $(sort $(subdir-obj-y)): $(subdir-y) ; -$(in-target): $(obj-y) FORCE +$(in-target): $(obj-y) $(test-y) FORCE $(call rule_mkdir) $(call if_changed,$(host)ld_multi)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 23/207 pNFS/flexfiles: Report ENETDOWN as a connection error
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit aa42add73ce9b9e3714723d385c254b75814e335 ]
If the client should see an ENETDOWN when trying to connect to the data server, it might still be able to talk to the metadata server through another NIC. If so, report the error.
--- fs/nfs/flexfilelayout/flexfilelayout.c | 1 + 1 file changed, 1 insertion(+)
fs/nfs/flexfilelayout/flexfilelayout.c +1 -0
@@ -1258,6 +1258,7 @@ static void ff_layout_io_track_ds_error(struct pnfs_layout_segment *lseg,case -ECONNRESET :case -EHOSTDOWN :case -EHOSTUNREACH : +case -ENETDOWN :case -ENETUNREACH :case -EADDRINUSE :case -ENOBUFS :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 24/207 PCI: vmd: Disable MSI remapping bypass under Xen
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Pau Monne <[email protected]>
[ Upstream commit 6c4d5aadf5df31ea0ac025980670eee9beaf466b ]
MSI remapping bypass (directly configuring MSI entries for devices on the VMD bus) won't work under Xen, as Xen is not aware of devices in such bus, and hence cannot configure the entries using the pIRQ interface in the PV case, and in the PVH case traps won't be setup for MSI entries for such devices.
Until Xen is aware of devices in the VMD bus prevent the VMD_FEAT_CAN_BYPASS_MSI_REMAP capability from being used when running as any kind of Xen guest.
The MSI remapping bypass is an optional feature of VMD bridges, and hence when running under Xen it will be masked and devices will be forced to redirect its interrupts from the VMD bridge. That mode of operation must always be supported by VMD bridges and works when Xen is not aware of devices behind the VMD bridge.
Message-ID: <[email protected]>
--- drivers/pci/controller/vmd.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/pci/controller/vmd.c +20 -0
@@ -17,6 +17,8 @@#include <linux/rculist.h> #include <linux/rcupdate.h> +#include <xen/xen.h> +#include <asm/irqdomain.h> #include <asm/device.h> #include <asm/msi.h>
@@ -826,6 +828,24 @@ static int vmd_probe(struct pci_dev *dev, const struct pci_device_id *id)struct vmd_dev *vmd;int err; +if (xen_domain ()) { +/* +* Xen doesn't have knowledge about devices in the VMD bus +* because the config space of devices behind the VMD bridge is +* not known to Xen, and hence Xen cannot discover or configure +* them in any way. +* +* Bypass of MSI remapping won't work in that case as direct +* write by Linux to the MSI entries won't result in functional +* interrupts, as Xen is the entity that manages the host +* interrupt controller and must configure interrupts. However +* multiplexing of interrupts by the VMD bridge will work under +* Xen, so force the usage of that mode which must always be +* supported by VMD bridges. +*/ + features &= ~VMD_FEAT_CAN_BYPASS_MSI_REMAP ; + } +if (resource_size (&dev->resource[VMD_CFGBAR ]) < (1 <<20 ))return -ENOMEM ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 25/207 libnvdimm/labels: Fix divide error in nd_label_data_init()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Richter <[email protected]>
[ Upstream commit ef1d3455bbc1922f94a91ed58d3d7db440652959 ]
If a faulty CXL memory device returns a broken zero LSA size in its memory device information (Identify Memory Device (Opcode 4000h), CXL spec. 3.1, 8.2.9.9.1.1), a divide error occurs in the libnvdimm driver:
Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:nd_label_data_init+0x10e/0x800 [libnvdimm]
Code and flow:
1) CXL Command 4000h returns LSA size = 0
2) config_size is assigned to zero LSA size (CXL pmem driver):
drivers/cxl/pmem.c: .config_size = mds->lsa_size,
3) max_xfer is set to zero (nvdimm driver):
drivers/nvdimm/label.c: max_xfer = min_t(size_t, ndd->nsarea.max_xfer, config_size);
4) A subsequent DIV_ROUND_UP() causes a division by zero:
drivers/nvdimm/label.c: /* Make our initial read size a multiple of max_xfer size */ drivers/nvdimm/label.c: read_size = min(DIV_ROUND_UP(read_size, max_xfer) * max_xfer,drivers/nvdimm/label.c- config_size);
Fix this by checking the config size parameter by extending an existing check.
--- drivers/nvdimm/label.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvdimm/label.c +2 -1
@@ -437,7 +437,8 @@ int nd_label_data_init(struct nvdimm_drvdata *ndd)if (ndd->data)return 0 ; -if (ndd->nsarea.status || ndd->nsarea.max_xfer ==0 ) { +if (ndd->nsarea.status || ndd->nsarea.max_xfer ==0 || + ndd->nsarea.config_size ==0 ) {dev_dbg (ndd->dev,"failed to init config data area: (%u:%u)\n" , ndd->nsarea.max_xfer, ndd->nsarea.config_size);return -ENXIO ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 26/207 mmc: host: Wait for Vdd to settle on card power off
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erick Shepherd <[email protected]>
[ Upstream commit 31e75ed964582257f59156ce6a42860e1ae4cc39 ]
The SD spec version 6.0 section 6.4.1.5 requires that Vdd must be lowered to less than 0.5V for a minimum of 1 ms when powering off a card. Increase wait to 15 ms so that voltage has time to drain down to 0.5V and cards can power off correctly. Issues with voltage drain time were only observed on Apollo Lake and Bay Trail host controllers so this fix is limited to those devices.
--- drivers/mmc/host/sdhci-pci-core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/mmc/host/sdhci-pci-core.c +5 -1
@@ -677,8 +677,12 @@ static void sdhci_intel_set_power(struct sdhci_host *host, unsigned char mode,sdhci_set_power (host, mode, vdd); -if (mode ==MMC_POWER_OFF ) +if (mode ==MMC_POWER_OFF ) { +if (slot->chip->pdev->device ==PCI_DEVICE_ID_INTEL_APL_SD || + slot->chip->pdev->device ==PCI_DEVICE_ID_INTEL_BYT_SD ) +usleep_range (15000 ,17500 );return ; + }/* * Bus power might not enable after D3 -> D0 transition due to the
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 27/207 wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 0c5a89ceddc1728a40cb3313948401dd70e3c649 ]
The interrupt status polling is unreliable, which can cause status events to get lost. On all newer chips, txs-timeout is an indication that the packet was either never sent, or never acked.
Fixes issues with inactivity polling.
--- drivers/net/wireless/mediatek/mt76/mt76.h | 1 + drivers/net/wireless/mediatek/mt76/mt76x0/pci.c | 3 ++- drivers/net/wireless/mediatek/mt76/mt76x0/usb.c | 3 ++- drivers/net/wireless/mediatek/mt76/mt76x2/pci.c | 3 ++- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 3 ++- drivers/net/wireless/mediatek/mt76/tx.c | 3 ++- 6 files changed, 11 insertions(+), 5 deletions(-)
drivers/net/wireless/mediatek/mt76/mt76.h +1 -0
@@ -345,6 +345,7 @@ struct mt76_hw_cap {#define MT_DRV_RX_DMA_HDR BIT(3)#define MT_DRV_HW_MGMT_TXQ BIT(4)#define MT_DRV_AMSDU_OFFLOAD BIT(5) +#define MT_DRV_IGNORE_TXS_FAILED BIT(6)struct mt76_driver_ops {u32 drv_flags;
drivers/net/wireless/mediatek/mt76/mt76x0/pci.c +2 -1
@@ -151,7 +151,8 @@ mt76x0e_probe(struct pci_dev *pdev, const struct pci_device_id *id)static const struct mt76_driver_ops drv_ops = { .txwi_size =sizeof (struct mt76x02_txwi ), .drv_flags =MT_DRV_TX_ALIGNED4_SKBS | -MT_DRV_SW_RX_AIRTIME , +MT_DRV_SW_RX_AIRTIME | +MT_DRV_IGNORE_TXS_FAILED , .survey_flags =SURVEY_INFO_TIME_TX , .update_survey = mt76x02_update_channel, .tx_prepare_skb = mt76x02_tx_prepare_skb,
drivers/net/wireless/mediatek/mt76/mt76x0/usb.c +2 -1
@@ -209,7 +209,8 @@ static int mt76x0u_probe(struct usb_interface *usb_intf, const struct usb_device_id *id) {static const struct mt76_driver_ops drv_ops = { - .drv_flags =MT_DRV_SW_RX_AIRTIME , + .drv_flags =MT_DRV_SW_RX_AIRTIME | +MT_DRV_IGNORE_TXS_FAILED , .survey_flags =SURVEY_INFO_TIME_TX , .update_survey = mt76x02_update_channel, .tx_prepare_skb = mt76x02u_tx_prepare_skb,
drivers/net/wireless/mediatek/mt76/mt76x2/pci.c +2 -1
@@ -22,7 +22,8 @@ mt76x2e_probe(struct pci_dev *pdev, const struct pci_device_id *id)static const struct mt76_driver_ops drv_ops = { .txwi_size =sizeof (struct mt76x02_txwi ), .drv_flags =MT_DRV_TX_ALIGNED4_SKBS | -MT_DRV_SW_RX_AIRTIME , +MT_DRV_SW_RX_AIRTIME | +MT_DRV_IGNORE_TXS_FAILED , .survey_flags =SURVEY_INFO_TIME_TX , .update_survey = mt76x02_update_channel, .tx_prepare_skb = mt76x02_tx_prepare_skb,
drivers/net/wireless/mediatek/mt76/mt76x2/usb.c +2 -1
@@ -29,7 +29,8 @@ static int mt76x2u_probe(struct usb_interface *intf, const struct usb_device_id *id) {static const struct mt76_driver_ops drv_ops = { - .drv_flags =MT_DRV_SW_RX_AIRTIME , + .drv_flags =MT_DRV_SW_RX_AIRTIME | +MT_DRV_IGNORE_TXS_FAILED , .survey_flags =SURVEY_INFO_TIME_TX , .update_survey = mt76x02_update_channel, .tx_prepare_skb = mt76x02u_tx_prepare_skb,
drivers/net/wireless/mediatek/mt76/tx.c +2 -1
@@ -93,7 +93,8 @@ __mt76_tx_status_skb_done(struct mt76_dev *dev, struct sk_buff *skb, u8 flags,__skb_unlink (skb, &dev->status_list);/* Tx status can be unreliable. if it fails, mark the frame as ACKed */ -if (flags &MT_TX_CB_TXS_FAILED ) { +if (flags &MT_TX_CB_TXS_FAILED && + (dev->drv->drv_flags &MT_DRV_IGNORE_TXS_FAILED )) { info->status.rates[0 ].count =0 ; info->status.rates[0 ].idx =-1 ; info->flags |=IEEE80211_TX_STAT_ACK ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 28/207 i2c: qup: Vote for interconnect bandwidth to DRAM
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
[ Upstream commit d4f35233a6345f62637463ef6e0708f44ffaa583 ]
When the I2C QUP controller is used together with a DMA engine it needs to vote for the interconnect path to the DRAM. Otherwise it may be unable to access the memory quickly enough.
The requested peak bandwidth is dependent on the I2C core clock.
To avoid sending votes too often the bandwidth is always requested when a DMA transfer starts, but dropped only on runtime suspend. Runtime suspend should only happen if no transfer is active. After resumption we can defer the next vote until the first DMA transfer actually happens.
The implementation is largely identical to the one introduced for spi-qup in commit ecdaa9473019 ("spi: qup: Vote for interconnect bandwidth to DRAM") since both drivers represent the same hardware block.
--- drivers/i2c/busses/i2c-qup.c | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+)
drivers/i2c/busses/i2c-qup.c +36 -0
@@ -14,6 +14,7 @@#include <linux/dma-mapping.h> #include <linux/err.h> #include <linux/i2c.h> +#include <linux/interconnect.h> #include <linux/interrupt.h> #include <linux/io.h> #include <linux/module.h>
@@ -150,6 +151,8 @@/* TAG length for DATA READ in RX FIFO */ #define READ_RX_TAGS_LEN 2 +#define QUP_BUS_WIDTH 8 +static unsigned int scl_freq;module_param_named (scl_freq, scl_freq, uint,0444 );MODULE_PARM_DESC (scl_freq,"SCL frequency override" );
@@ -227,6 +230,7 @@ struct qup_i2c_dev {int irq;struct clk *clk;struct clk *pclk; +struct icc_path *icc_path;struct i2c_adapter adap;int clk_ctl;
@@ -255,6 +259,10 @@ struct qup_i2c_dev {/* To configure when bus is in run state */ u32 config_run; +/* bandwidth votes */ +u32 src_clk_freq; +u32 cur_bw_clk_freq; +/* dma parameters */ bool is_dma;/* To check if the current transfer is using DMA */
@@ -453,6 +461,23 @@ static int qup_i2c_bus_active(struct qup_i2c_dev *qup, int len)return ret; } +static int qup_i2c_vote_bw (struct qup_i2c_dev *qup,u32 clk_freq) +{ +u32 needed_peak_bw; +int ret; + +if (qup->cur_bw_clk_freq == clk_freq) +return 0 ; + + needed_peak_bw =Bps_to_icc (clk_freq *QUP_BUS_WIDTH ); + ret =icc_set_bw (qup->icc_path,0 , needed_peak_bw); +if (ret) +return ret; + + qup->cur_bw_clk_freq = clk_freq; +return 0 ; +} +static void qup_i2c_write_tx_fifo_v1 (struct qup_i2c_dev *qup) {struct qup_i2c_block *blk = &qup->blk;
@@ -840,6 +865,10 @@ static int qup_i2c_bam_xfer(struct i2c_adapter *adap, struct i2c_msg *msg,int ret =0 ;int idx =0 ; + ret =qup_i2c_vote_bw (qup, qup->src_clk_freq); +if (ret) +return ret; +enable_irq (qup->irq); ret =qup_i2c_req_dma (qup);
@@ -1645,6 +1674,7 @@ static void qup_i2c_disable_clocks(struct qup_i2c_dev *qup) config =readl (qup->base +QUP_CONFIG ); config |=QUP_CLOCK_AUTO_GATE ;writel (config, qup->base +QUP_CONFIG ); +qup_i2c_vote_bw (qup,0 );clk_disable_unprepare (qup->pclk); }
@@ -1745,6 +1775,11 @@ static int qup_i2c_probe(struct platform_device *pdev) goto fail_dma; } qup->is_dma = true; + + qup->icc_path =devm_of_icc_get (&pdev->dev,NULL ); +if (IS_ERR (qup->icc_path)) +return dev_err_probe (&pdev->dev,PTR_ERR (qup->icc_path), +"failed to get interconnect path\n" ); } nodma:
@@ -1793,6 +1828,7 @@ static int qup_i2c_probe(struct platform_device *pdev)qup_i2c_enable_clocks (qup); src_clk_freq =clk_get_rate (qup->clk); } + qup->src_clk_freq = src_clk_freq;/* * Bootloaders might leave a pending interrupt on certain QUP's,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 29/207 i2c: pxa: fix call balance of i2c->clk handling routines
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitalii Mordan <[email protected]>
[ Upstream commit be7113d2e2a6f20cbee99c98d261a1fd6fd7b549 ]
If the clock i2c->clk was not enabled in i2c_pxa_probe(), it should not be disabled in any path.
Found by Linux Verification Center (linuxtesting.org) with Klever.
--- drivers/i2c/busses/i2c-pxa.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-pxa.c +4 -1
@@ -1508,7 +1508,10 @@ static int i2c_pxa_probe(struct platform_device *dev) i2c->adap.name); } -clk_prepare_enable (i2c->clk); + ret =clk_prepare_enable (i2c->clk); +if (ret) +return dev_err_probe (&dev->dev, ret, +"failed to enable clock\n" );if (i2c->use_pio) { i2c->adap.algo = &i2c_pxa_pio_algorithm;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 30/207 btrfs: make btrfs_discard_workfn() block_group ref explicit
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
[ Upstream commit 895c6721d310c036dcfebb5ab845822229fa35eb ]
Currently, the async discard machinery owns a ref to the block_group when the block_group is queued on a discard list. However, to handle races with discard cancellation and the discard workfn, we have a specific logic to detect that the block_group is *currently* running in the workfn, to protect the workfn's usage amidst cancellation.
As far as I can tell, this doesn't have any overt bugs (though finish_discard_pass() and remove_from_discard_list() racing can have a surprising outcome for the caller of remove_from_discard_list() in that it is again added at the end).
But it is needlessly complicated to rely on locking and the nullity of discard_ctl->block_group. Simplify this significantly by just taking a refcount while we are in the workfn and unconditionally drop it in both the remove and workfn paths, regardless of if they race.
--- fs/btrfs/discard.c | 34 ++++++++++++++++------------------ 1 file changed, 16 insertions(+), 18 deletions(-)
fs/btrfs/discard.c +16 -18
@@ -152,13 +152,7 @@ static bool remove_from_discard_list(struct btrfs_discard_ctl *discard_ctl, block_group->discard_eligible_time =0 ; queued = !list_empty (&block_group->discard_list);list_del_init (&block_group->discard_list); -/* -* If the block group is currently running in the discard workfn, we -* don't want to deref it, since it's still being used by the workfn. -* The workfn will notice this case and deref the block group when it is -* finished. -*/ -if (queued && !running) +if (queued)btrfs_put_block_group (block_group);spin_unlock (&discard_ctl->lock);
@@ -256,9 +250,10 @@ static struct btrfs_block_group *peek_discard_list( block_group->discard_cursor = block_group->start; block_group->discard_state =BTRFS_DISCARD_EXTENTS ; } - discard_ctl->block_group = block_group; }if (block_group) { +btrfs_get_block_group (block_group); + discard_ctl->block_group = block_group; *discard_state = block_group->discard_state; *discard_index = block_group->discard_index; }
@@ -482,9 +477,20 @@ static void btrfs_discard_workfn(struct work_struct *work) block_group =peek_discard_list (discard_ctl, &discard_state, &discard_index, now); -if (!block_group || !btrfs_run_discard_work (discard_ctl)) +if (!block_group)return ; +if (!btrfs_run_discard_work (discard_ctl)) { +spin_lock (&discard_ctl->lock); +btrfs_put_block_group (block_group); + discard_ctl->block_group =NULL ; +spin_unlock (&discard_ctl->lock); +return ; + }if (now < block_group->discard_eligible_time) { +spin_lock (&discard_ctl->lock); +btrfs_put_block_group (block_group); + discard_ctl->block_group =NULL ; +spin_unlock (&discard_ctl->lock);btrfs_discard_schedule_work (discard_ctl, false);return ; }
@@ -536,15 +542,7 @@ static void btrfs_discard_workfn(struct work_struct *work)spin_lock (&discard_ctl->lock); discard_ctl->prev_discard = trimmed; discard_ctl->prev_discard_time = now; -/* -* If the block group was removed from the discard list while it was -* running in this workfn, then we didn't deref it, since this function -* still owned that reference. But we set the discard_ctl->block_group -* back to NULL, so we can use that condition to know that now we need -* to deref the block_group. -*/ -if (discard_ctl->block_group ==NULL ) -btrfs_put_block_group (block_group); +btrfs_put_block_group (block_group); discard_ctl->block_group =NULL ;__btrfs_discard_schedule_work (discard_ctl, now, false);spin_unlock (&discard_ctl->lock);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 31/207 btrfs: avoid linker error in btrfs_find_create_tree_block()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Harmstone <[email protected]>
[ Upstream commit 7ef3cbf17d2734ca66c4ed8573be45f4e461e7ee ]
The inline function btrfs_is_testing() is hardcoded to return 0 if CONFIG_BTRFS_FS_RUN_SANITY_TESTS is not set. Currently we're relying on the compiler optimizing out the call to alloc_test_extent_buffer() in btrfs_find_create_tree_block(), as it's not been defined (it's behind an
#ifdef).
Add a stub version of alloc_test_extent_buffer() to avoid linker errors on non-standard optimization levels. This problem was seen on GCC 14 with -O0 and is helps to see symbols that would be otherwise optimized out.
--- fs/btrfs/extent_io.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/btrfs/extent_io.c +5 -2
@@ -6024,10 +6024,10 @@ struct extent_buffer *find_extent_buffer(struct btrfs_fs_info *fs_info,return eb; } -#ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS struct extent_buffer *alloc_test_extent_buffer (struct btrfs_fs_info *fs_info,u64 start) { +#ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS struct extent_buffer *eb, *exists =NULL ;int ret;
@@ -6063,8 +6063,11 @@ struct extent_buffer *alloc_test_extent_buffer(struct btrfs_fs_info *fs_info, free_eb:btrfs_release_extent_buffer (eb);return exists; -} +#else +/* Stub to avoid linker error when compiled with optimizations turned off. */ +return NULL ;#endif +}static struct extent_buffer *grab_extent_buffer (struct btrfs_fs_info *fs_info,struct page *page)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 32/207 btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 1283b8c125a83bf7a7dbe90c33d3472b6d7bf612 ]
At btrfs_reclaim_bgs_work(), we are grabbing a block group's zone unusable bytes while not under the protection of the block group's spinlock, so this can trigger race reports from KCSAN (or similar tools) since that field is typically updated while holding the lock, such as at __btrfs_add_free_space_zoned() for example.
Fix this by grabbing the zone unusable bytes while we are still in the critical section holding the block group's spinlock, which is right above where we are currently grabbing it.
--- fs/btrfs/block-group.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
fs/btrfs/block-group.c +11 -7
@@ -1543,6 +1543,17 @@ void btrfs_reclaim_bgs_work(struct work_struct *work)up_write (&space_info->groups_sem); goto next; } + +/* +* Cache the zone_unusable value before turning the block group +* to read only. As soon as the block group is read only it's +* zone_unusable value gets moved to the block group's read-only +* bytes and isn't available for calculations anymore. We also +* cache it before unlocking the block group, to prevent races +* (reports from KCSAN and such tools) with tasks updating it. +*/ + zone_unusable = bg->zone_unusable; +spin_unlock (&bg->lock);/*
@@ -1558,13 +1569,6 @@ void btrfs_reclaim_bgs_work(struct work_struct *work) goto next; } -/* -* Cache the zone_unusable value before turning the block group -* to read only. As soon as the blog group is read only it's -* zone_unusable value gets moved to the block group's read-only -* bytes and isn't available for calculations anymore. -*/ - zone_unusable = bg->zone_unusable; ret =inc_block_group_ro (bg,0 );up_write (&space_info->groups_sem);if (ret <0 )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 33/207 btrfs: send: return -ENAMETOOLONG when attempting a path that is too long
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit a77749b3e21813566cea050bbb3414ae74562eba ]
When attempting to build a too long path we are currently returning -ENOMEM, which is very odd and misleading. So update fs_path_ensure_buf() to return -ENAMETOOLONG instead. Also, while at it, move the WARN_ON() into the if statement's expression, as it makes it clear what is being tested and also has the effect of adding 'unlikely' to the statement, which allows the compiler to generate better code as this condition is never expected to happen.
--- fs/btrfs/send.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
fs/btrfs/send.c +2 -4
@@ -400,10 +400,8 @@ static int fs_path_ensure_buf(struct fs_path *p, int len)if (p->buf_len >= len)return 0 ; -if (len >PATH_MAX ) { -WARN_ON (1 ); -return -ENOMEM ; - } +if (WARN_ON (len >PATH_MAX )) +return -ENAMETOOLONG ; path_len = p->end - p->start; old_buf_len = p->buf_len;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 34/207 i3c: master: svc: Fix missing STOP for master request
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanley Chu <[email protected]>
[ Upstream commit 0430bf9bc1ac068c8b8c540eb93e5751872efc51 ]
The controller driver nacked the master request but didn't emit a STOP to end the transaction. The driver shall refuse the unsupported requests and return the controller state to IDLE by emitting a STOP.
--- drivers/i3c/master/svc-i3c-master.c | 1 + 1 file changed, 1 insertion(+)
drivers/i3c/master/svc-i3c-master.c +1 -0
@@ -437,6 +437,7 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)queue_work (master->base.wq, &master->hj_work);break ;case SVC_I3C_MSTATUS_IBITYPE_MASTER_REQUEST : +svc_i3c_master_emit_stop (master);default :break ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 35/207 dlm: make tcp still work in multi-link env
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heming Zhao <[email protected]>
[ Upstream commit 03d2b62208a336a3bb984b9465ef6d89a046ea22 ]
This patch bypasses multi-link errors in TCP mode, allowing dlm to operate on the first tcp link.
--- fs/dlm/lowcomms.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/dlm/lowcomms.c +2 -2
@@ -1852,8 +1852,8 @@ static int dlm_tcp_listen_validate(void) {/* We don't support multi-homed hosts */ if (dlm_local_count >1 ) { -log_print ("TCP protocol can't handle multi-homed hosts, try SCTP" ); -return -EINVAL ; +log_print ("Detect multi-homed hosts but use only the first IP address." ); +log_print ("Try SCTP, if you want to enable multi-link." ); }return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 36/207 clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Hu <[email protected]>
[ Upstream commit 70c93b026ed07078e933583591aa9ca6701cd9da ]
Stop the timer when the cpu is going to be offline otherwise the timer interrupt may be pending while performing power-down.
--- drivers/clocksource/timer-riscv.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/clocksource/timer-riscv.c +6 -0
@@ -75,7 +75,13 @@ static int riscv_timer_starting_cpu(unsigned int cpu)static int riscv_timer_dying_cpu (unsigned int cpu) { +/* +* Stop the timer when the cpu is going to be offline otherwise +* the timer interrupt may be pending while performing power-down. +*/ +riscv_clock_event_stop ();disable_percpu_irq (riscv_clock_event_irq); +return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 37/207 um: Store full CSGSFS and SS register from mcontext
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit cef721e0d53d2b64f2ba177c63a0dfdd7c0daf17 ]
Doing this allows using registers as retrieved from an mcontext to be pushed to a process using PTRACE_SETREGS.
It is not entirely clear to me why CSGSFS was masked. Doing so creates issues when using the mcontext as process state in seccomp and simply copying the register appears to work perfectly fine for ptrace.
--- arch/x86/um/os-Linux/mcontext.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/x86/um/os-Linux/mcontext.c +1 -2
@@ -26,7 +26,6 @@ void get_regs_from_mc(struct uml_pt_regs *regs, mcontext_t *mc)COPY (RIP );COPY2 (EFLAGS ,EFL );COPY2 (CS ,CSGSFS ); - regs->gp[CS /sizeof (unsigned long )] &=0xffff ; - regs->gp[CS /sizeof (unsigned long )] |=3 ; + regs->gp[SS /sizeof (unsigned long )] = mc->gregs[REG_CSGSFS ] >>48 ;#endif }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 38/207 um: Update min_low_pfn to match changes in uml_reserved
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiwei Bie <[email protected]>
[ Upstream commit e82cf3051e6193f61e03898f8dba035199064d36 ]
When uml_reserved is updated, min_low_pfn must also be updated accordingly. Otherwise, min_low_pfn will not accurately reflect the lowest available PFN.
--- arch/um/kernel/mem.c | 1 + 1 file changed, 1 insertion(+)
arch/um/kernel/mem.c +1 -0
@@ -49,6 +49,7 @@ void __init mem_init(void)map_memory (brk_end,__pa (brk_end), uml_reserved - brk_end,1 ,1 ,0 );memblock_free (__pa (brk_end), uml_reserved - brk_end); uml_reserved = brk_end; + min_low_pfn =PFN_UP (__pa (uml_reserved));/* this will put all low memory onto the freelists */ memblock_free_all ();
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 39/207 ext4: reorder capability check last
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Göttsche <[email protected]>
[ Upstream commit 1b419c889c0767a5b66d0a6c566cae491f1cb0f7 ]
capable() calls refer to enabled LSMs whether to permit or deny the request. This is relevant in connection with SELinux, where a capability check results in a policy decision and by default a denial message on insufficient permission is issued.
It can lead to three undesired cases:
1. A denial message is generated, even in case the operation was an unprivileged one and thus the syscall succeeded, creating noise.
2. To avoid the noise from 1. the policy writer adds a rule to ignore those denial messages, hiding future syscalls, where the task performs an actual privileged operation, leading to hidden limited functionality of that task.
3. To avoid the noise from 1. the policy writer adds a rule to permit the task the requested capability, while it does not need it, violating the principle of least privilege.
--- fs/ext4/balloc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ext4/balloc.c +2 -2
@@ -637,8 +637,8 @@ static int ext4_has_free_clusters(struct ext4_sb_info *sbi,/* Hm, nope. Are (enough) root reserved clusters available? */ if (uid_eq (sbi->s_resuid,current_fsuid ()) || (!gid_eq (sbi->s_resgid,GLOBAL_ROOT_GID ) &&in_group_p (sbi->s_resgid)) || -capable (CAP_SYS_RESOURCE ) || - (flags &EXT4_MB_USE_ROOT_BLOCKS )) { + (flags &EXT4_MB_USE_ROOT_BLOCKS ) || +capable (CAP_SYS_RESOURCE )) {if (free_clusters >= (nclusters + dirty_clusters + resv_clusters))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 40/207 scsi: st: Tighten the page format heuristics with MODE SELECT
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai Mäkisara <[email protected]>
[ Upstream commit 8db816c6f176321e42254badd5c1a8df8bfcfdb4 ]
In the days when SCSI-2 was emerging, some drives did claim SCSI-2 but did not correctly implement it. The st driver first tries MODE SELECT with the page format bit set to set the block descriptor. If not successful, the non-page format is tried.
The test only tests the sense code and this triggers also from illegal parameter in the parameter list. The test is limited to "old" devices and made more strict to remove false alarms.
--- drivers/scsi/st.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/st.c +3 -1
@@ -3071,7 +3071,9 @@ static int st_int_ioctl(struct scsi_tape *STp, unsigned int cmd_in, unsigned lon cmd_in == MTSETDRVBUFFER || cmd_in == SET_DENS_AND_BLK) {if (cmdstatp->sense_hdr.sense_key ==ILLEGAL_REQUEST && - !(STp->use_pf &PF_TESTED )) { + cmdstatp->sense_hdr.asc ==0x24 && + (STp->device)->scsi_level <=SCSI_2 && + !(STp->use_pf &PF_TESTED )) {/* Try the other possible state of Page Format if not already tried */ STp->use_pf = (STp->use_pf ^USE_PF ) |PF_TESTED ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 41/207 scsi: st: ERASE does not change tape location
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai Mäkisara <[email protected]>
[ Upstream commit ad77cebf97bd42c93ab4e3bffd09f2b905c1959a ]
The SCSI ERASE command erases from the current position onwards. Don't clear the position variables.
--- drivers/scsi/st.c | 1 - 1 file changed, 1 deletion(-)
drivers/scsi/st.c +0 -1
@@ -2884,7 +2884,6 @@ static int st_int_ioctl(struct scsi_tape *STp, unsigned int cmd_in, unsigned lon timeout = STp->long_timeout *8 ;DEBC_printk (STp,"Erasing tape.\n" ); - fileno = blkno = at_sm =0 ;break ;case MTSETBLK :/* Set block length */ case MTSETDENSITY :/* Set tape density */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 42/207 vfio/pci: Handle INTx IRQ_NOTCONNECTED
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
[ Upstream commit 860be250fc32de9cb24154bf21b4e36f40925707 ]
Some systems report INTx as not routed by setting pdev->irq to IRQ_NOTCONNECTED, resulting in a -ENOTCONN error when trying to setup eventfd signaling. Include this in the set of conditions for which the PIN register is virtualized to zero.
Additionally consolidate vfio_pci_get_irq_count() to use this virtualized value in reporting INTx support via ioctl and sanity checking ioctl paths since pdev->irq is re-used when the device is in MSI mode.
The combination of these results in both the config space of the device and the ioctl interface behaving as if the device does not support INTx.
--- drivers/vfio/pci/vfio_pci_config.c | 3 ++- drivers/vfio/pci/vfio_pci_core.c | 10 +--------- drivers/vfio/pci/vfio_pci_intrs.c | 2 +- 3 files changed, 4 insertions(+), 11 deletions(-)
drivers/vfio/pci/vfio_pci_config.c +2 -1
@@ -1756,7 +1756,8 @@ int vfio_config_init(struct vfio_pci_core_device *vdev)cpu_to_le16 (PCI_COMMAND_MEMORY ); } -if (!IS_ENABLED (CONFIG_VFIO_PCI_INTX ) || vdev->nointx) +if (!IS_ENABLED (CONFIG_VFIO_PCI_INTX ) || vdev->nointx || + vdev->pdev->irq ==IRQ_NOTCONNECTED ) vconfig[PCI_INTERRUPT_PIN ] =0 ; ret =vfio_cap_init (vdev);
drivers/vfio/pci/vfio_pci_core.c +1 -9
@@ -481,15 +481,7 @@ EXPORT_SYMBOL_GPL(vfio_pci_core_finish_enable);static int vfio_pci_get_irq_count (struct vfio_pci_core_device *vdev,int irq_type) {if (irq_type ==VFIO_PCI_INTX_IRQ_INDEX ) { -u8 pin; - -if (!IS_ENABLED (CONFIG_VFIO_PCI_INTX ) || - vdev->nointx || vdev->pdev->is_virtfn) -return 0 ; - -pci_read_config_byte (vdev->pdev,PCI_INTERRUPT_PIN , &pin); - -return pin ?1 :0 ; +return vdev->vconfig[PCI_INTERRUPT_PIN ] ?1 :0 ; }else if (irq_type ==VFIO_PCI_MSI_IRQ_INDEX ) {u8 pos;u16 flags;
drivers/vfio/pci/vfio_pci_intrs.c +1 -1
@@ -173,7 +173,7 @@ static int vfio_intx_enable(struct vfio_pci_core_device *vdev,if (!is_irq_none (vdev))return -EINVAL ; -if (!pdev->irq) +if (!pdev->irq || pdev->irq ==IRQ_NOTCONNECTED )return -ENODEV ; name =kasprintf (GFP_KERNEL ,"vfio-intx(%s)" ,pci_name (pdev));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 43/207 tcp: reorganize tcp_in_ack_event() and tcp_count_delivered()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 149dfb31615e22271d2525f078c95ea49bc4db24 ]
- Move tcp_count_delivered() earlier and split tcp_count_delivered_ce() out of it
- Move tcp_in_ack_event() later
- While at it, remove the inline from tcp_in_ack_event() and let the compiler to decide
Accurate ECN's heuristics does not know if there is going to be ACE field based CE counter increase or not until after rtx queue has been processed. Only then the number of ACKed bytes/pkts is available. As CE or not affects presence of FLAG_ECE, that information for tcp_in_ack_event is not yet available in the old location of the call to tcp_in_ack_event().
--- net/ipv4/tcp_input.c | 56 +++++++++++++++++++++++++------------------- 1 file changed, 32 insertions(+), 24 deletions(-)
net/ipv4/tcp_input.c +32 -24
@@ -404,6 +404,20 @@ static bool tcp_ecn_rcv_ecn_echo(const struct tcp_sock *tp, const struct tcphdrreturn false; } +static void tcp_count_delivered_ce (struct tcp_sock *tp,u32 ecn_count) +{ + tp->delivered_ce += ecn_count; +} + +/* Updates the delivered and delivered_ce counts */ +static void tcp_count_delivered (struct tcp_sock *tp,u32 delivered, +bool ece_ack) +{ + tp->delivered += delivered; +if (ece_ack) +tcp_count_delivered_ce (tp, delivered); +} +/* Buffer size and advertised window tuning. * * 1. Tuning sk->sk_sndbuf, when connection enters established state.
@@ -1112,15 +1126,6 @@ void tcp_mark_skb_lost(struct sock *sk, struct sk_buff *skb) } } -/* Updates the delivered and delivered_ce counts */ -static void tcp_count_delivered (struct tcp_sock *tp,u32 delivered, -bool ece_ack) -{ - tp->delivered += delivered; -if (ece_ack) - tp->delivered_ce += delivered; -} -/* This procedure tags the retransmission queue when SACKs arrive. * * We have three tag bits: SACKED(S), RETRANS(R) and LOST(L).
@@ -3776,12 +3781,23 @@ static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag) } } -static inline void tcp_in_ack_event (struct sock *sk,u32 flags) +static void tcp_in_ack_event (struct sock *sk,int flag) {const struct inet_connection_sock *icsk =inet_csk (sk); -if (icsk->icsk_ca_ops->in_ack_event) - icsk->icsk_ca_ops->in_ack_event (sk, flags); +if (icsk->icsk_ca_ops->in_ack_event) { +u32 ack_ev_flags =0 ; + +if (flag &FLAG_WIN_UPDATE ) + ack_ev_flags |=CA_ACK_WIN_UPDATE ; +if (flag &FLAG_SLOWPATH ) { + ack_ev_flags |=CA_ACK_SLOWPATH ; +if (flag &FLAG_ECE ) + ack_ev_flags |=CA_ACK_ECE ; + } + + icsk->icsk_ca_ops->in_ack_event (sk, ack_ev_flags); + } }/* Congestion control has updated the cwnd already. So if we're in
@@ -3898,12 +3914,8 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)tcp_snd_una_update (tp, ack); flag |=FLAG_WIN_UPDATE ; -tcp_in_ack_event (sk,CA_ACK_WIN_UPDATE ); -NET_INC_STATS (sock_net (sk),LINUX_MIB_TCPHPACKS ); }else { -u32 ack_ev_flags =CA_ACK_SLOWPATH ; -if (ack_seq !=TCP_SKB_CB (skb)->end_seq) flag |=FLAG_DATA ;else
@@ -3915,19 +3927,12 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) flag |=tcp_sacktag_write_queue (sk, skb, prior_snd_una, &sack_state); -if (tcp_ecn_rcv_ecn_echo (tp,tcp_hdr (skb))) { +if (tcp_ecn_rcv_ecn_echo (tp,tcp_hdr (skb))) flag |=FLAG_ECE ; - ack_ev_flags |=CA_ACK_ECE ; - }if (sack_state.sack_delivered)tcp_count_delivered (tp, sack_state.sack_delivered, flag &FLAG_ECE ); - -if (flag &FLAG_WIN_UPDATE ) - ack_ev_flags |=CA_ACK_WIN_UPDATE ; - -tcp_in_ack_event (sk, ack_ev_flags); }/* This is a deviation from RFC3168 since it states that:
@@ -3954,6 +3959,8 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)tcp_rack_update_reo_wnd (sk, &rs); +tcp_in_ack_event (sk, flag); +if (tp->tlp_high_seq)tcp_process_tlp_ack (sk, ack, flag);
@@ -3985,6 +3992,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)return 1 ; no_queue: +tcp_in_ack_event (sk, flag);/* If data was DSACKed, see if we can undo a cwnd reduction. */ if (flag &FLAG_DSACKING_ACK ) { tcp_fastretrans_alert(sk, prior_snd_una, num_dupack, &flag,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 44/207 rtc: rv3032: fix EERD location
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Belloni <[email protected]>
[ Upstream commit b0f9cb4a0706b0356e84d67e48500b77b343debe ]
EERD is bit 2 in CTRL1
--- drivers/rtc/rtc-rv3032.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rtc/rtc-rv3032.c +1 -1
@@ -69,7 +69,7 @@#define RV3032_CLKOUT2_FD_MSK GENMASK(6, 5)#define RV3032_CLKOUT2_OS BIT(7) -#define RV3032_CTRL1_EERD BIT(3) +#define RV3032_CTRL1_EERD BIT(2)#define RV3032_CTRL1_WADA BIT(5)#define RV3032_CTRL2_STOP BIT(0)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 45/207 ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nícolas F. R. A. Prado <[email protected]>
[ Upstream commit 0116a7d84b32537a10d9bea1fd1bfc06577ef527 ]
Add a stub for mt6359_accdet_enable_jack_detect() to prevent linker failures in the machine sound drivers calling it when CONFIG_SND_SOC_MT6359_ACCDET is not enabled.
--- sound/soc/codecs/mt6359-accdet.h | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/soc/codecs/mt6359-accdet.h +9 -0
@@ -123,6 +123,15 @@ struct mt6359_accdet { struct workqueue_struct *jd_workqueue; }; +#if IS_ENABLED (CONFIG_SND_SOC_MT6359_ACCDET )int mt6359_accdet_enable_jack_detect (struct snd_soc_component *component,struct snd_soc_jack *jack); +#else +static inline int +mt6359_accdet_enable_jack_detect (struct snd_soc_component *component, +struct snd_soc_jack *jack) +{ +return -EOPNOTSUPP ; +} +#endif #endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 46/207 kbuild: fix argument parsing in scripts/config
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seyediman Seyedarab <[email protected]>
[ Upstream commit f757f6011c92b5a01db742c39149bed9e526478f ]
The script previously assumed --file was always the first argument, which caused issues when it appeared later. This patch updates the parsing logic to scan all arguments to find --file, sets the config file correctly, and resets the argument list with the remaining commands.
It also fixes --refresh to respect --file by passing KCONFIG_CONFIG=$FN to make oldconfig.
--- scripts/config | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-)
scripts/config +16 -10
@@ -32,6 +32,7 @@ commands: Disable option directly after other option --module-after|-M beforeopt option Turn option into module directly after other option + --refresh Refresh the config using old settings commands can be repeated multiple times
@@ -124,16 +125,22 @@ undef_var() { txt_delete "^# $name is not set" "$FN" } -if [ "$1" = "--file" ]; then - FN="$2" - if [ "$FN" = "" ] ; then - usage +FN=.config +CMDS=() +while [[ $# -gt 0 ]]; do + if [ "$1" = "--file" ]; then + if [ "$2" = "" ]; then + usage + fi + FN="$2" + shift 2 + else + CMDS+=("$1") + shift fi - shift 2 -else - FN=.config -fi +done +set -- "${CMDS[@]}" if [ "$1" = "" ] ; then usage fi
@@ -217,9 +224,8 @@ while [ "$1" != "" ] ; do set_var "${CONFIG_}$B" "${CONFIG_}$B=m" "${CONFIG_}$A" ;; - # undocumented because it ignores --file (fixme) --refresh) - yes "" | make oldconfig + yes "" | make oldconfig KCONFIG_CONFIG=$FN ;; *)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 47/207 crypto: octeontx2 - suppress auth failure screaming due to negative tests
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shashank Gupta <[email protected]>
[ Upstream commit 64b7871522a4cba99d092e1c849d6f9092868aaa ]
This patch addresses an issue where authentication failures were being erroneously reported due to negative test failures in the "ccm(aes)" selftest.pr_debug suppress unnecessary screaming of these tests.
--- drivers/crypto/marvell/octeontx2/otx2_cptvf_reqmgr.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/crypto/marvell/octeontx2/otx2_cptvf_reqmgr.c +4 -3
@@ -410,9 +410,10 @@ static int cpt_process_ccode(struct otx2_cptlfs_info *lfs,break ; } -dev_err (&pdev->dev, -"Request failed with software error code 0x%x\n" , - cpt_status->s.uc_compcode); +pr_debug ("Request failed with software error code 0x%x: algo = %s driver = %s\n" , + cpt_status->s.uc_compcode, + info->req->areq->tfm->__crt_alg->cra_name, + info->req->areq->tfm->__crt_alg->cra_driver_name);otx2_cpt_dump_sg_list (pdev, info->req);break ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 48/207 dm: restrict dm device size to 2^63-512 bytes
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
[ Upstream commit 45fc728515c14f53f6205789de5bfd72a95af3b8 ]
The devices with size >= 2^63 bytes can't be used reliably by userspace because the type off_t is a signed 64-bit integer.
Therefore, we limit the maximum size of a device mapper device to 2^63-512 bytes.
--- drivers/md/dm-table.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/md/dm-table.c +4 -0
@@ -661,6 +661,10 @@ int dm_table_add_target(struct dm_table *t, const char *type,DMERR ("%s: zero-length target" ,dm_device_name (t->md));return -EINVAL ; } +if (start + len < start || start + len >LLONG_MAX >>SECTOR_SHIFT ) { +DMERR ("%s: too large device" ,dm_device_name (t->md)); +return -EINVAL ; + } tgt->type =dm_get_target_type (type);if (!tgt->type) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 49/207 xen: Add support for XenServer 6.1 platform device
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frediano Ziglio <[email protected]>
[ Upstream commit 2356f15caefc0cc63d9cc5122641754f76ef9b25 ]
On XenServer on Windows machine a platform device with ID 2 instead of 1 is used.
This device is mainly identical to device 1 but due to some Windows update behaviour it was decided to use a device with a different ID.
This causes compatibility issues with Linux which expects, if Xen is detected, to find a Xen platform device (5853:0001) otherwise code will crash due to some missing initialization (specifically grant tables). Specifically from dmesg
RIP: 0010:gnttab_expand+0x29/0x210
Code: 90 0f 1f 44 00 00 55 31 d2 48 89 e5 41 57 41 56 41 55 41 89 fd
41 54 53 48 83 ec 10 48 8b 05 7e 9a 49 02 44 8b 35 a7 9a 49 02
<8b> 48 04 8d 44 39 ff f7 f1 45 8d 24 06 89 c3 e8 43 fe ff ff
44 39
RSP: 0000:ffffba34c01fbc88 EFLAGS: 00010086
...The device 2 is presented by Xapi adding device specification to Qemu command line.
Message-ID: <[email protected]>
--- drivers/xen/platform-pci.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/xen/platform-pci.c +4 -0
@@ -26,6 +26,8 @@#define DRV_NAME "xen-platform-pci" +#define PCI_DEVICE_ID_XEN_PLATFORM_XS61 0x0002 +static unsigned long platform_mmio;static unsigned long platform_mmio_alloc;static unsigned long platform_mmiolen;
@@ -174,6 +176,8 @@ static int platform_pci_probe(struct pci_dev *pdev,static const struct pci_device_id platform_pci_tbl[] = { {PCI_VENDOR_ID_XEN ,PCI_DEVICE_ID_XEN_PLATFORM ,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 ,0 }, + {PCI_VENDOR_ID_XEN ,PCI_DEVICE_ID_XEN_PLATFORM_XS61 , +PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 ,0 }, {0 ,} };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 50/207 RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maher Sanalla <[email protected]>
[ Upstream commit 81f8f7454ad9e0bf95efdec6542afdc9a6ab1e24 ]
Currently, the IB uverbs API calls uobj_get_uobj_read(), which in turn uses the rdma_lookup_get_uobject() helper to retrieve user objects. In case of failure, uobj_get_uobj_read() returns NULL, overriding the error code from rdma_lookup_get_uobject(). The IB uverbs API then translates this NULL to -EINVAL, masking the actual error and complicating debugging. For example, applications calling ibv_modify_qp that fails with EBUSY when retrieving the QP uobject will see the overridden error code EINVAL instead, masking the actual error.
Furthermore, based on rdma-core commit:
"2a22f1ced5f3 ("Merge pull request #1568 from jakemoroni/master")" Kernel's IB uverbs return values are either ignored and passed on as is to application or overridden with other errnos in a few cases.
Thus, to improve error reporting and debuggability, propagate the original error from rdma_lookup_get_uobject() instead of replacing it with EINVAL.
--- drivers/infiniband/core/uverbs_cmd.c | 144 ++++++++++++++------------- include/rdma/uverbs_std_types.h | 2 +- 2 files changed, 77 insertions(+), 69 deletions(-)
drivers/infiniband/core/uverbs_cmd.c +76 -68
@@ -718,8 +718,8 @@ static int ib_uverbs_reg_mr(struct uverbs_attr_bundle *attrs) goto err_free; pd =uobj_get_obj_read (pd,UVERBS_OBJECT_PD , cmd.pd_handle, attrs); -if (!pd) { - ret = -EINVAL ; +if (IS_ERR (pd)) { + ret =PTR_ERR (pd); goto err_free; }
@@ -809,8 +809,8 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs)if (cmd.flags &IB_MR_REREG_PD ) { new_pd =uobj_get_obj_read (pd,UVERBS_OBJECT_PD , cmd.pd_handle, attrs); -if (!new_pd) { - ret = -EINVAL ; +if (IS_ERR (new_pd)) { + ret =PTR_ERR (new_pd); goto put_uobjs; } }else {
@@ -919,8 +919,8 @@ static int ib_uverbs_alloc_mw(struct uverbs_attr_bundle *attrs)return PTR_ERR (uobj); pd =uobj_get_obj_read (pd,UVERBS_OBJECT_PD , cmd.pd_handle, attrs); -if (!pd) { - ret = -EINVAL ; +if (IS_ERR (pd)) { + ret =PTR_ERR (pd); goto err_free; }
@@ -1127,8 +1127,8 @@ static int ib_uverbs_resize_cq(struct uverbs_attr_bundle *attrs)return ret; cq =uobj_get_obj_read (cq,UVERBS_OBJECT_CQ , cmd.cq_handle, attrs); -if (!cq) -return -EINVAL ; +if (IS_ERR (cq)) +return PTR_ERR (cq); ret = cq->device->ops.resize_cq (cq, cmd.cqe, &attrs->driver_udata);if (ret)
@@ -1189,8 +1189,8 @@ static int ib_uverbs_poll_cq(struct uverbs_attr_bundle *attrs)return ret; cq =uobj_get_obj_read (cq,UVERBS_OBJECT_CQ , cmd.cq_handle, attrs); -if (!cq) -return -EINVAL ; +if (IS_ERR (cq)) +return PTR_ERR (cq);/* we copy a struct ib_uverbs_poll_cq_resp to user space */ header_ptr = attrs->ucore.outbuf;
@@ -1238,8 +1238,8 @@ static int ib_uverbs_req_notify_cq(struct uverbs_attr_bundle *attrs)return ret; cq =uobj_get_obj_read (cq,UVERBS_OBJECT_CQ , cmd.cq_handle, attrs); -if (!cq) -return -EINVAL ; +if (IS_ERR (cq)) +return PTR_ERR (cq);ib_req_notify_cq (cq, cmd.solicited_only ?IB_CQ_SOLICITED :IB_CQ_NEXT_COMP );
@@ -1321,8 +1321,8 @@ static int create_qp(struct uverbs_attr_bundle *attrs, ind_tbl =uobj_get_obj_read (rwq_ind_table,UVERBS_OBJECT_RWQ_IND_TBL , cmd->rwq_ind_tbl_handle, attrs); -if (!ind_tbl) { - ret = -EINVAL ; +if (IS_ERR (ind_tbl)) { + ret =PTR_ERR (ind_tbl); goto err_put; }
@@ -1360,8 +1360,10 @@ static int create_qp(struct uverbs_attr_bundle *attrs,if (cmd->is_srq) { srq =uobj_get_obj_read (srq,UVERBS_OBJECT_SRQ , cmd->srq_handle, attrs); -if (!srq || srq->srq_type ==IB_SRQT_XRC ) { - ret = -EINVAL ; +if (IS_ERR (srq) || + srq->srq_type ==IB_SRQT_XRC ) { + ret =IS_ERR (srq) ?PTR_ERR (srq) : + -EINVAL ; goto err_put; } }
@@ -1371,23 +1373,29 @@ static int create_qp(struct uverbs_attr_bundle *attrs, rcq =uobj_get_obj_read ( cq,UVERBS_OBJECT_CQ , cmd->recv_cq_handle, attrs); -if (!rcq) { - ret = -EINVAL ; +if (IS_ERR (rcq)) { + ret =PTR_ERR (rcq); goto err_put; } } } } -if (has_sq) +if (has_sq) { scq =uobj_get_obj_read (cq,UVERBS_OBJECT_CQ , cmd->send_cq_handle, attrs); +if (IS_ERR (scq)) { + ret =PTR_ERR (scq); + goto err_put; + } + } +if (!ind_tbl && cmd->qp_type !=IB_QPT_XRC_INI ) rcq = rcq ?: scq; pd =uobj_get_obj_read (pd,UVERBS_OBJECT_PD , cmd->pd_handle, attrs); -if (!pd || (!scq && has_sq)) { - ret = -EINVAL ; +if (IS_ERR (pd)) { + ret =PTR_ERR (pd); goto err_put; }
@@ -1483,18 +1491,18 @@ static int create_qp(struct uverbs_attr_bundle *attrs, err_put:if (!IS_ERR (xrcd_uobj))uobj_put_read (xrcd_uobj); -if (pd) +if (!IS_ERR_OR_NULL (pd))uobj_put_obj_read (pd); -if (scq) +if (!IS_ERR_OR_NULL (scq))rdma_lookup_put_uobject (&scq->uobject->uevent.uobject,UVERBS_LOOKUP_READ ); -if (rcq && rcq != scq) +if (!IS_ERR_OR_NULL (rcq) && rcq != scq)rdma_lookup_put_uobject (&rcq->uobject->uevent.uobject,UVERBS_LOOKUP_READ ); -if (srq) +if (!IS_ERR_OR_NULL (srq))rdma_lookup_put_uobject (&srq->uobject->uevent.uobject,UVERBS_LOOKUP_READ ); -if (ind_tbl) +if (!IS_ERR_OR_NULL (ind_tbl))uobj_put_obj_read (ind_tbl);uobj_alloc_abort (&obj->uevent.uobject, attrs);
@@ -1656,8 +1664,8 @@ static int ib_uverbs_query_qp(struct uverbs_attr_bundle *attrs) } qp =uobj_get_obj_read (qp,UVERBS_OBJECT_QP , cmd.qp_handle, attrs); -if (!qp) { - ret = -EINVAL ; +if (IS_ERR (qp)) { + ret =PTR_ERR (qp); goto out; }
@@ -1762,8 +1770,8 @@ static int modify_qp(struct uverbs_attr_bundle *attrs, qp =uobj_get_obj_read (qp,UVERBS_OBJECT_QP , cmd->base.qp_handle, attrs); -if (!qp) { - ret = -EINVAL ; +if (IS_ERR (qp)) { + ret =PTR_ERR (qp); goto out; }
@@ -2028,8 +2036,8 @@ static int ib_uverbs_post_send(struct uverbs_attr_bundle *attrs)return -ENOMEM ; qp =uobj_get_obj_read (qp,UVERBS_OBJECT_QP , cmd.qp_handle, attrs); -if (!qp) { - ret = -EINVAL ; +if (IS_ERR (qp)) { + ret =PTR_ERR (qp); goto out; }
@@ -2066,9 +2074,9 @@ static int ib_uverbs_post_send(struct uverbs_attr_bundle *attrs) ud->ah =uobj_get_obj_read (ah,UVERBS_OBJECT_AH , user_wr->wr.ud.ah, attrs); -if (!ud->ah) { +if (IS_ERR (ud->ah)) { + ret =PTR_ERR (ud->ah);kfree (ud); - ret = -EINVAL ; goto out_put; } ud->remote_qpn = user_wr->wr.ud.remote_qpn;
@@ -2305,8 +2313,8 @@ static int ib_uverbs_post_recv(struct uverbs_attr_bundle *attrs)return PTR_ERR (wr); qp =uobj_get_obj_read (qp,UVERBS_OBJECT_QP , cmd.qp_handle, attrs); -if (!qp) { - ret = -EINVAL ; +if (IS_ERR (qp)) { + ret =PTR_ERR (qp); goto out; }
@@ -2356,8 +2364,8 @@ static int ib_uverbs_post_srq_recv(struct uverbs_attr_bundle *attrs)return PTR_ERR (wr); srq =uobj_get_obj_read (srq,UVERBS_OBJECT_SRQ , cmd.srq_handle, attrs); -if (!srq) { - ret = -EINVAL ; +if (IS_ERR (srq)) { + ret =PTR_ERR (srq); goto out; }
@@ -2413,8 +2421,8 @@ static int ib_uverbs_create_ah(struct uverbs_attr_bundle *attrs) } pd =uobj_get_obj_read (pd,UVERBS_OBJECT_PD , cmd.pd_handle, attrs); -if (!pd) { - ret = -EINVAL ; +if (IS_ERR (pd)) { + ret =PTR_ERR (pd); goto err; }
@@ -2483,8 +2491,8 @@ static int ib_uverbs_attach_mcast(struct uverbs_attr_bundle *attrs)return ret; qp =uobj_get_obj_read (qp,UVERBS_OBJECT_QP , cmd.qp_handle, attrs); -if (!qp) -return -EINVAL ; +if (IS_ERR (qp)) +return PTR_ERR (qp); obj = qp->uobject;
@@ -2533,8 +2541,8 @@ static int ib_uverbs_detach_mcast(struct uverbs_attr_bundle *attrs)return ret; qp =uobj_get_obj_read (qp,UVERBS_OBJECT_QP , cmd.qp_handle, attrs); -if (!qp) -return -EINVAL ; +if (IS_ERR (qp)) +return PTR_ERR (qp); obj = qp->uobject;mutex_lock (&obj->mcast_lock);
@@ -2668,8 +2676,8 @@ static int kern_spec_to_ib_spec_action(struct uverbs_attr_bundle *attrs,UVERBS_OBJECT_FLOW_ACTION , kern_spec->action.handle, attrs); -if (!ib_spec->action.act) -return -EINVAL ; +if (IS_ERR (ib_spec->action.act)) +return PTR_ERR (ib_spec->action.act); ib_spec->action.size =sizeof (struct ib_flow_spec_action_handle ); flow_resources_add(uflow_res,
@@ -2686,8 +2694,8 @@ static int kern_spec_to_ib_spec_action(struct uverbs_attr_bundle *attrs,UVERBS_OBJECT_COUNTERS , kern_spec->flow_count.handle, attrs); -if (!ib_spec->flow_count.counters) -return -EINVAL ; +if (IS_ERR (ib_spec->flow_count.counters)) +return PTR_ERR (ib_spec->flow_count.counters); ib_spec->flow_count.size =sizeof (struct ib_flow_spec_action_count ); flow_resources_add(uflow_res,
@@ -2905,14 +2913,14 @@ static int ib_uverbs_ex_create_wq(struct uverbs_attr_bundle *attrs)return PTR_ERR (obj); pd =uobj_get_obj_read (pd,UVERBS_OBJECT_PD , cmd.pd_handle, attrs); -if (!pd) { - err = -EINVAL ; +if (IS_ERR (pd)) { + err =PTR_ERR (pd); goto err_uobj; } cq =uobj_get_obj_read (cq,UVERBS_OBJECT_CQ , cmd.cq_handle, attrs); -if (!cq) { - err = -EINVAL ; +if (IS_ERR (cq)) { + err =PTR_ERR (cq); goto err_put_pd; }
@@ -3013,8 +3021,8 @@ static int ib_uverbs_ex_modify_wq(struct uverbs_attr_bundle *attrs)return -EINVAL ; wq =uobj_get_obj_read (wq,UVERBS_OBJECT_WQ , cmd.wq_handle, attrs); -if (!wq) -return -EINVAL ; +if (IS_ERR (wq)) +return PTR_ERR (wq);if (cmd.attr_mask &IB_WQ_FLAGS ) { wq_attr.flags = cmd.flags;
@@ -3097,8 +3105,8 @@ static int ib_uverbs_ex_create_rwq_ind_table(struct uverbs_attr_bundle *attrs) num_read_wqs++) { wq =uobj_get_obj_read (wq,UVERBS_OBJECT_WQ , wqs_handles[num_read_wqs], attrs); -if (!wq) { - err = -EINVAL ; +if (IS_ERR (wq)) { + err =PTR_ERR (wq); goto put_wqs; }
@@ -3253,8 +3261,8 @@ static int ib_uverbs_ex_create_flow(struct uverbs_attr_bundle *attrs) } qp =uobj_get_obj_read (qp,UVERBS_OBJECT_QP , cmd.qp_handle, attrs); -if (!qp) { - err = -EINVAL ; +if (IS_ERR (qp)) { + err =PTR_ERR (qp); goto err_uobj; }
@@ -3400,15 +3408,15 @@ static int __uverbs_create_xsrq(struct uverbs_attr_bundle *attrs,if (ib_srq_has_cq (cmd->srq_type)) { attr.ext.cq =uobj_get_obj_read (cq,UVERBS_OBJECT_CQ , cmd->cq_handle, attrs); -if (!attr.ext.cq) { - ret = -EINVAL ; +if (IS_ERR (attr.ext.cq)) { + ret =PTR_ERR (attr.ext.cq); goto err_put_xrcd; } } pd =uobj_get_obj_read (pd,UVERBS_OBJECT_PD , cmd->pd_handle, attrs); -if (!pd) { - ret = -EINVAL ; +if (IS_ERR (pd)) { + ret =PTR_ERR (pd); goto err_put_cq; }
@@ -3515,8 +3523,8 @@ static int ib_uverbs_modify_srq(struct uverbs_attr_bundle *attrs)return ret; srq =uobj_get_obj_read (srq,UVERBS_OBJECT_SRQ , cmd.srq_handle, attrs); -if (!srq) -return -EINVAL ; +if (IS_ERR (srq)) +return PTR_ERR (srq); attr.max_wr = cmd.max_wr; attr.srq_limit = cmd.srq_limit;
@@ -3543,8 +3551,8 @@ static int ib_uverbs_query_srq(struct uverbs_attr_bundle *attrs)return ret; srq =uobj_get_obj_read (srq,UVERBS_OBJECT_SRQ , cmd.srq_handle, attrs); -if (!srq) -return -EINVAL ; +if (IS_ERR (srq)) +return PTR_ERR (srq); ret =ib_query_srq (srq, &attr);
@@ -3669,8 +3677,8 @@ static int ib_uverbs_ex_modify_cq(struct uverbs_attr_bundle *attrs)return -EOPNOTSUPP ; cq =uobj_get_obj_read (cq,UVERBS_OBJECT_CQ , cmd.cq_handle, attrs); -if (!cq) -return -EINVAL ; +if (IS_ERR (cq)) +return PTR_ERR (cq); ret =rdma_set_cq_moderation (cq, cmd.attr.cq_count, cmd.attr.cq_period);
include/rdma/uverbs_std_types.h +1 -1
@@ -34,7 +34,7 @@static inline void *_uobj_get_obj_read (struct ib_uobject *uobj) {if (IS_ERR (uobj)) -return NULL ; +return ERR_CAST (uobj);return uobj->object; }#define uobj_get_obj_read (_object, _type, _id, _attrs) \
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 51/207 posix-timers: Add cond_resched() to posix_timer_add() search loop
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 5f2909c6cd13564a07ae692a95457f52295c4f22 ]
With a large number of POSIX timers the search for a valid ID might cause a soft lockup on PREEMPT_NONE/VOLUNTARY kernels.
Add cond_resched() to the loop to prevent that.
[ tglx: Split out from Eric's series ]
--- kernel/time/posix-timers.c | 1 + 1 file changed, 1 insertion(+)
kernel/time/posix-timers.c +1 -0
@@ -161,6 +161,7 @@ static int posix_timer_add(struct k_itimer *timer)return id; }spin_unlock (&hash_lock); +cond_resched (); }/* POSIX return code when no timer ID could be allocated */ return -EAGAIN ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 52/207 timer_list: Dont use %pK through printk()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit a52067c24ccf6ee4c85acffa0f155e9714f9adce ]
This reverts commit f590308536db ("timer debug: Hide kernel addresses via %pK in /proc/timer_list")
The timer list helper SEQ_printf() uses either the real seq_printf() for procfs output or vprintk() to print to the kernel log, when invoked from SysRq-q. It uses %pK for printing pointers.
In the past %pK was prefered over %p as it would not leak raw pointer values into the kernel log. Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue.
Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping looks in atomic contexts.
Switch to the regular pointer formatting which is safer, easier to reason about and sufficient here.
--- kernel/time/timer_list.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/time/timer_list.c +2 -2
@@ -46,7 +46,7 @@ static void print_timer(struct seq_file *m, struct hrtimer *taddr, struct hrtimer *timer, int idx, u64 now) { - SEQ_printf(m, " #%d: <%pK>, %ps", idx, taddr, timer->function); + SEQ_printf(m, " #%d: <%p>, %ps", idx, taddr, timer->function);SEQ_printf (m,", S:%02x" , timer->state);SEQ_printf (m,"\n" ); SEQ_printf(m, " # expires at %Lu-%Lu nsecs [in %Ld to %Ld nsecs]\n",
@@ -98,7 +98,7 @@ print_active_timers(struct seq_file *m, struct hrtimer_clock_base *base,static void print_base (struct seq_file *m,struct hrtimer_clock_base *base,u64 now) { -SEQ_printf (m," .base: %pK\n" , base); +SEQ_printf (m," .base: %p\n" , base);SEQ_printf (m," .index: %d\n" , base->index);SEQ_printf (m," .resolution: %u nsecs\n" , hrtimer_resolution);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 53/207 netfilter: conntrack: Bound nf_conntrack sysctl writes
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Bouchinet <[email protected]>
[ Upstream commit 8b6861390ffee6b8ed78b9395e3776c16fec6579 ]
nf_conntrack_max and nf_conntrack_expect_max sysctls were authorized to be written any negative value, which would then be stored in the unsigned int variables nf_conntrack_max and nf_ct_expect_max variables.
While the do_proc_dointvec_conv function is supposed to limit writing handled by proc_dointvec proc_handler to INT_MAX. Such a negative value being written in an unsigned int leads to a very high value, exceeding this limit.
Moreover, the nf_conntrack_expect_max sysctl documentation specifies the minimum value is 1.
The proc_handlers have thus been updated to proc_dointvec_minmax in order to specify the following write bounds :
* Bound nf_conntrack_max sysctl writings between SYSCTL_ZERO and SYSCTL_INT_MAX.
* Bound nf_conntrack_expect_max sysctl writings between SYSCTL_ONE and SYSCTL_INT_MAX as defined in the sysctl documentation.
With this patch applied, sysctl writes outside the defined in the bound will thus lead to a write error :
``` sysctl -w net.netfilter.nf_conntrack_expect_max=-1 sysctl: setting key "net.netfilter.nf_conntrack_expect_max": Invalid argument ```
--- net/netfilter/nf_conntrack_standalone.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
net/netfilter/nf_conntrack_standalone.c +9 -3
@@ -629,7 +629,9 @@ static struct ctl_table nf_ct_sysctl_table[] = { .data = &nf_conntrack_max, .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + .extra2 = SYSCTL_INT_MAX, }, [NF_SYSCTL_CT_COUNT] = { .procname = "nf_conntrack_count",
@@ -665,7 +667,9 @@ static struct ctl_table nf_ct_sysctl_table[] = { .data = &nf_ct_expect_max, .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ONE, + .extra2 = SYSCTL_INT_MAX, }, [NF_SYSCTL_CT_ACCT] = { .procname = "nf_conntrack_acct",
@@ -976,7 +980,9 @@ static struct ctl_table nf_ct_netfilter_table[] = { .data = &nf_conntrack_max, .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + .extra2 = SYSCTL_INT_MAX, }, { } };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 54/207 arm64/mm: Check PUD_TYPE_TABLE in pud_bad()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Roberts <[email protected]>
[ Upstream commit bfb1d2b9021c21891427acc86eb848ccedeb274e ]
pud_bad() is currently defined in terms of pud_table(). Although for some configs, pud_table() is hard-coded to true i.e. when using 64K base pages or when page table levels are less than 3.
pud_bad() is intended to check that the pud is configured correctly. Hence let's open-code the same check that the full version of pud_table() uses into pud_bad(). Then it always performs the check regardless of the config.
--- arch/arm64/include/asm/pgtable.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm64/include/asm/pgtable.h +2 -1
@@ -623,7 +623,8 @@ static inline unsigned long pmd_page_vaddr(pmd_t pmd) pr_err("%s:%d: bad pmd %016llx.\n", __FILE__, __LINE__, pmd_val(e))#define pud_none (pud) (!pud_val(pud)) -#define pud_bad (pud) (!pud_table(pud)) +#define pud_bad (pud) ((pud_val(pud) & PUD_TYPE_MASK) != \ + PUD_TYPE_TABLE)#define pud_present (pud) pte_present(pud_pte(pud))#define pud_leaf (pud) (pud_present(pud) && !pud_table(pud))#define pud_valid (pud) pte_valid(pud_pte(pud))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 55/207 mmc: sdhci: Disable SD card clock before changing parameters
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erick Shepherd <[email protected]>
[ Upstream commit fb3bbc46c94f261b6156ee863c1b06c84cf157dc ]
Per the SD Host Controller Simplified Specification v4.20 §3.2.3, change the SD card clock parameters only after first disabling the external card clock. Doing this fixes a spurious clock pulse on Baytrail and Apollo Lake SD controllers which otherwise breaks voltage switching with a specific Swissbit SD card.
--- drivers/mmc/host/sdhci.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/mmc/host/sdhci.c +7 -2
@@ -2009,10 +2009,15 @@ void sdhci_set_clock(struct sdhci_host *host, unsigned int clock) host->mmc->actual_clock =0 ; -sdhci_writew (host,0 ,SDHCI_CLOCK_CONTROL ); + clk =sdhci_readw (host,SDHCI_CLOCK_CONTROL ); +if (clk &SDHCI_CLOCK_CARD_EN ) +sdhci_writew (host, clk & ~SDHCI_CLOCK_CARD_EN , +SDHCI_CLOCK_CONTROL ); -if (clock ==0 ) +if (clock ==0 ) { +sdhci_writew (host,0 ,SDHCI_CLOCK_CONTROL );return ; + } clk =sdhci_calc_clk (host, clock, &host->mmc->actual_clock);sdhci_enable_clk (host, clk);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 56/207 ipv6: save dontfrag in cork
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <[email protected]>
[ Upstream commit a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a ]
When spanning datagram construction over multiple send calls using MSG_MORE, per datagram settings are configured on the first send.
That is when ip(6)_setup_cork stores these settings for subsequent use in __ip(6)_append_data and others.
The only flag that escaped this was dontfrag. As a result, a datagram could be constructed with df=0 on the first sendmsg, but df=1 on a next. Which is what cmsg_ip.sh does in an upcoming MSG_MORE test in the "diff" scenario.
Changing datagram conditions in the middle of constructing an skb makes this already complex code path even more convoluted. It is here unintentional. Bring this flag in line with expected sockopt/cmsg behavior.
And stop passing ipc6 to __ip6_append_data, to avoid such issues in the future. This is already the case for __ip_append_data.
inet6_cork had a 6 byte hole, so the 1B flag has no impact.
--- include/linux/ipv6.h | 1 + net/ipv6/ip6_output.c | 9 +++++---- 2 files changed, 6 insertions(+), 4 deletions(-)
include/linux/ipv6.h +1 -0
@@ -195,6 +195,7 @@ struct inet6_cork {struct ipv6_txoptions *opt;u8 hop_limit;u8 tclass; + u8 dontfrag:1; };/**
net/ipv6/ip6_output.c +5 -4
@@ -1428,6 +1428,7 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork, cork->fl.u.ip6 = *fl6; v6_cork->hop_limit = ipc6->hlimit; v6_cork->tclass = ipc6->tclass; + v6_cork->dontfrag = ipc6->dontfrag;if (rt->dst.flags &DST_XFRM_TUNNEL ) mtu = np->pmtudisc >=IPV6_PMTUDISC_PROBE ?READ_ONCE (rt->dst.dev->mtu) :dst_mtu (&rt->dst);
@@ -1462,7 +1463,7 @@ static int __ip6_append_data(struct sock *sk,int getfrag (void *from,char *to,int offset,int len,int odd,struct sk_buff *skb), void *from, size_t length, int transhdrlen, - unsigned int flags, struct ipcm6_cookie *ipc6) + unsigned int flags) { struct sk_buff *skb, *skb_prev = NULL;unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu, pmtu;
@@ -1519,7 +1520,7 @@ static int __ip6_append_data(struct sock *sk,if (headersize + transhdrlen > mtu) goto emsgsize; -if (cork->length + length > mtu - headersize && ipc6->dontfrag && +if (cork->length + length > mtu - headersize && v6_cork->dontfrag && (sk->sk_protocol ==IPPROTO_UDP || sk->sk_protocol ==IPPROTO_RAW )) { ipv6_local_rxpmtu(sk, fl6, mtu - headersize +
@@ -1836,7 +1837,7 @@ int ip6_append_data(struct sock *sk,return __ip6_append_data (sk, fl6, &sk->sk_write_queue, &inet->cork.base, &np->cork,sk_page_frag (sk), getfrag, - from, length, transhdrlen, flags, ipc6); + from, length, transhdrlen, flags); }EXPORT_SYMBOL_GPL (ip6_append_data);
@@ -2031,7 +2032,7 @@ struct sk_buff *ip6_make_skb(struct sock *sk, err =__ip6_append_data (sk, fl6, &queue, &cork->base, &v6_cork, ¤t->task_frag, getfrag, from, length + exthdrlen, transhdrlen + exthdrlen, - flags, ipc6); + flags);if (err) {__ip6_flush_pending_frames (sk, &queue, cork, &v6_cork);return ERR_PTR (err);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 57/207 auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 09965a142078080fe7807bab0f6f1890cb5987a4 ]
Commit 2545c1c948a6 ("auxdisplay: Move hwidth and bwidth to struct hd44780_common") makes charlcd_alloc() argument-less effectively dropping the single allocation for the struct charlcd_priv object along with the driver specific one. Restore that behaviour here.
--- drivers/auxdisplay/charlcd.c | 5 +++-- drivers/auxdisplay/charlcd.h | 5 +++-- drivers/auxdisplay/hd44780.c | 2 +- drivers/auxdisplay/lcd2s.c | 2 +- drivers/auxdisplay/panel.c | 2 +- 5 files changed, 9 insertions(+), 7 deletions(-)
drivers/auxdisplay/charlcd.c +3 -2
@@ -594,18 +594,19 @@ static int charlcd_init(struct charlcd *lcd)return 0 ; } -struct charlcd *charlcd_alloc (void ) +struct charlcd *charlcd_alloc (unsigned int drvdata_size) {struct charlcd_priv *priv;struct charlcd *lcd; - priv =kzalloc (sizeof (*priv),GFP_KERNEL ); + priv =kzalloc (sizeof (*priv) + drvdata_size,GFP_KERNEL );if (!priv)return NULL ; priv->esc_seq.len =-1 ; lcd = &priv->lcd; + lcd->drvdata = priv->drvdata;return lcd; }
drivers/auxdisplay/charlcd.h +3 -2
@@ -49,7 +49,7 @@ struct charlcd {unsigned long y; } addr; -void *drvdata; +void *drvdata;/* Set by charlcd_alloc() */ };/**
@@ -93,7 +93,8 @@ struct charlcd_ops { };void charlcd_backlight (struct charlcd *lcd,enum charlcd_onoff on); -struct charlcd *charlcd_alloc (void ); + +struct charlcd *charlcd_alloc (unsigned int drvdata_size);void charlcd_free (struct charlcd *lcd);int charlcd_register (struct charlcd *lcd);
drivers/auxdisplay/hd44780.c +1 -1
@@ -226,7 +226,7 @@ static int hd44780_probe(struct platform_device *pdev)if (!hdc)return -ENOMEM ; - lcd =charlcd_alloc (); + lcd =charlcd_alloc (0 );if (!lcd) goto fail1;
drivers/auxdisplay/lcd2s.c +1 -1
@@ -307,7 +307,7 @@ static int lcd2s_i2c_probe(struct i2c_client *i2c,if (err <0 )return err; - lcd =charlcd_alloc (); + lcd =charlcd_alloc (0 );if (!lcd)return -ENOMEM ;
drivers/auxdisplay/panel.c +1 -1
@@ -835,7 +835,7 @@ static void lcd_init(void)if (!hdc)return ; - charlcd =charlcd_alloc (); + charlcd =charlcd_alloc (0 );if (!charlcd) {kfree (hdc);return ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 58/207 ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Klimov <[email protected]>
[ Upstream commit 89be3c15a58b2ccf31e969223c8ac93ca8932d81 ]
Setting format to s16le is required for compressed playback on compatible soundcards.
--- sound/soc/qcom/sm8250.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/qcom/sm8250.c +3 -0
@@ -7,6 +7,7 @@#include <sound/soc.h> #include <sound/soc-dapm.h> #include <sound/pcm.h> +#include <sound/pcm_params.h> #include <linux/soundwire/sdw.h> #include "qdsp6/q6afe.h" #include "common.h"
@@ -27,9 +28,11 @@ static int sm8250_be_hw_params_fixup(struct snd_soc_pcm_runtime *rtd, SNDRV_PCM_HW_PARAM_RATE);struct snd_interval *channels =hw_param_interval (params,SNDRV_PCM_HW_PARAM_CHANNELS ); +struct snd_mask *fmt =hw_param_mask (params,SNDRV_PCM_HW_PARAM_FORMAT ); rate->min = rate->max =48000 ; channels->min = channels->max =2 ; +snd_mask_set_format (fmt,SNDRV_PCM_FORMAT_S16_LE );return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 59/207 cpufreq: tegra186: Share policy per cluster
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Kling <[email protected]>
[ Upstream commit be4ae8c19492cd6d5de61ccb34ffb3f5ede5eec8 ]
This functionally brings tegra186 in line with tegra210 and tegra194, sharing a cpufreq policy between all cores in a cluster.
--- drivers/cpufreq/tegra186-cpufreq.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/cpufreq/tegra186-cpufreq.c +7 -0
@@ -73,11 +73,18 @@ static int tegra186_cpufreq_init(struct cpufreq_policy *policy) {struct tegra186_cpufreq_data *data =cpufreq_get_driver_data ();unsigned int cluster = data->cpus[policy->cpu].bpmp_cluster_id; +u32 cpu; policy->freq_table = data->clusters[cluster].table; policy->cpuinfo.transition_latency =300 *1000 ; policy->driver_data =NULL ; +/* set same policy for all cpus in a cluster */ +for (cpu =0 ; cpu <ARRAY_SIZE (tegra186_cpus); cpu++) { +if (data->cpus[cpu].bpmp_cluster_id == cluster) +cpumask_set_cpu (cpu, policy->cpus); + } +return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 60/207 crypto: lzo - Fix compression buffer overrun
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit cc47f07234f72cbd8e2c973cdbf2a6730660a463 ]
Unlike the decompression code, the compression code in LZO never checked for output overruns. It instead assumes that the caller always provides enough buffer space, disregarding the buffer length provided by the caller.
Add a safe compression interface that checks for the end of buffer before each write. Use the safe interface in crypto/lzo.
--- crypto/lzo-rle.c | 2 +- crypto/lzo.c | 2 +- include/linux/lzo.h | 8 +++ lib/lzo/Makefile | 2 +- lib/lzo/lzo1x_compress.c | 102 +++++++++++++++++++++++++--------- lib/lzo/lzo1x_compress_safe.c | 18 ++++++ 6 files changed, 106 insertions(+), 28 deletions(-) create mode 100644 lib/lzo/lzo1x_compress_safe.c
crypto/lzo-rle.c +1 -1
@@ -55,7 +55,7 @@ static int __lzorle_compress(const u8 *src, unsigned int slen,size_t tmp_len = *dlen;/* size_t(ulong) <-> uint on 64 bit */ int err; - err =lzorle1x_1_compress (src, slen, dst, &tmp_len, ctx); + err =lzorle1x_1_compress_safe (src, slen, dst, &tmp_len, ctx);if (err !=LZO_E_OK )return -EINVAL ;
crypto/lzo.c +1 -1
@@ -55,7 +55,7 @@ static int __lzo_compress(const u8 *src, unsigned int slen,size_t tmp_len = *dlen;/* size_t(ulong) <-> uint on 64 bit */ int err; - err =lzo1x_1_compress (src, slen, dst, &tmp_len, ctx); + err =lzo1x_1_compress_safe (src, slen, dst, &tmp_len, ctx);if (err !=LZO_E_OK )return -EINVAL ;
include/linux/lzo.h +8 -0
@@ -24,10 +24,18 @@int lzo1x_1_compress (const unsigned char *src,size_t src_len,unsigned char *dst,size_t *dst_len,void *wrkmem); +/* Same as above but does not write more than dst_len to dst. */ +int lzo1x_1_compress_safe (const unsigned char *src,size_t src_len, +unsigned char *dst,size_t *dst_len,void *wrkmem); +/* This requires 'wrkmem' of size LZO1X_1_MEM_COMPRESS */ int lzorle1x_1_compress (const unsigned char *src,size_t src_len,unsigned char *dst,size_t *dst_len,void *wrkmem); +/* Same as above but does not write more than dst_len to dst. */ +int lzorle1x_1_compress_safe (const unsigned char *src,size_t src_len, +unsigned char *dst,size_t *dst_len,void *wrkmem); +/* safe decompression with overrun testing */ int lzo1x_decompress_safe (const unsigned char *src,size_t src_len,unsigned char *dst,size_t *dst_len);
lib/lzo/Makefile +1 -1
@@ -1,5 +1,5 @@ # SPDX-License-Identifier: GPL-2.0-only -lzo_compress-objs := lzo1x_compress.o +lzo_compress-objs := lzo1x_compress.o lzo1x_compress_safe.o lzo_decompress-objs := lzo1x_decompress_safe.o obj-$(CONFIG_LZO_COMPRESS) += lzo_compress.o
lib/lzo/lzo1x_compress.c +77 -25
241 lines not on this page · raw message
lib/lzo/lzo1x_compress_safe.c new file +18 -0
@@ -0,0 +1,18 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* +* LZO1X Compressor from LZO +* +* Copyright (C) 1996-2012 Markus F.X.J. Oberhumer <[email protected]> +* +* The full LZO package can be found at: +* http://www.oberhumer.com/opensource/lzo/ +* +* Changed for Linux kernel use by: +* Nitin Gupta <[email protected]> +* Richard Purdie <[email protected]> +*/ + +#define LZO_SAFE (name) name##_safe +#define HAVE_OP (x) ((size_t)(op_end - op) >= (size_t)(x)) + +#include "lzo1x_compress.c"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 61/207 arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diogo Ivo <[email protected]>
[ Upstream commit f34621f31e3be81456c903287f7e4c0609829e29 ]
According to the board schematics the enable pin of this regulator is connected to gpio line #9 of the first instance of the TCA9539 GPIO expander, so adjust it.
--- arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi +1 -1
@@ -1638,7 +1638,7 @@ vdd_1v8_dis: regulator@7 { regulator-min-microvolt = <1800000>; regulator-max-microvolt = <1800000>; regulator-always-on; - gpio = <&exp1 14 GPIO_ACTIVE_HIGH>; + gpio = <&exp1 9 GPIO_ACTIVE_HIGH>; enable-active-high; vin-supply = <&vdd_1v8>; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 62/207 powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Schwab <[email protected]>
[ Upstream commit 7e67ef889c9ab7246547db73d524459f47403a77 ]
Similar to the PowerMac3,1, the PowerBook6,7 is missing the #size-cells property on the i2s node.
Depends-on: commit 045b14ca5c36 ("of: WARN on deprecated #address-cells/#size-cells handling")
--- arch/powerpc/kernel/prom_init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/kernel/prom_init.c +2 -2
@@ -2978,11 +2978,11 @@ static void __init fixup_device_tree_pmac(void)char type[8 ];phandle node; -// Some pmacs are missing #size-cells on escc nodes +// Some pmacs are missing #size-cells on escc or i2s nodes for (node =0 ;prom_next_node (&node); ) { type[0 ] ='\0' ;prom_getprop (node,"device_type" , type,sizeof (type)); -if (prom_strcmp (type,"escc" )) +if (prom_strcmp (type,"escc" ) &&prom_strcmp (type,"i2s" ))continue ;if (prom_getproplen (node,"#size-cells" ) !=PROM_ERROR )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 63/207 tcp: bring back NUMA dispersion in inet_ehash_locks_alloc()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit f8ece40786c9342249aa0a1b55e148ee23b2a746 ]
We have platforms with 6 NUMA nodes and 480 cpus.
inet_ehash_locks_alloc() currently allocates a single 64KB page to hold all ehash spinlocks. This adds more pressure on a single node.
Change inet_ehash_locks_alloc() to use vmalloc() to spread the spinlocks on all online nodes, driven by NUMA policies.
At boot time, NUMA policy is interleave=all, meaning that tcp_hashinfo.ehash_locks gets hash dispersion on all nodes.
Tested:
lack5:~# grep inet_ehash_locks_alloc /proc/vmallocinfo 0x00000000d9aec4d1-0x00000000a828b652 69632 inet_ehash_locks_alloc+0x90/0x100 pages=16 vmalloc N0=2 N1=3 N2=3 N3=3 N4=3 N5=2
lack5:~# echo 8192 >/proc/sys/net/ipv4/tcp_child_ehash_entries lack5:~# numactl --interleave=all unshare -n bash -c "grep inet_ehash_locks_alloc /proc/vmallocinfo" 0x000000004e99d30c-0x00000000763f3279 36864 inet_ehash_locks_alloc+0x90/0x100 pages=8 vmalloc N0=1 N1=2 N2=2 N3=1 N4=1 N5=1 0x00000000d9aec4d1-0x00000000a828b652 69632 inet_ehash_locks_alloc+0x90/0x100 pages=16 vmalloc N0=2 N1=3 N2=3 N3=3 N4=3 N5=2
lack5:~# numactl --interleave=0,5 unshare -n bash -c "grep inet_ehash_locks_alloc /proc/vmallocinfo" 0x00000000fd73a33e-0x0000000004b9a177 36864 inet_ehash_locks_alloc+0x90/0x100 pages=8 vmalloc N0=4 N5=4 0x00000000d9aec4d1-0x00000000a828b652 69632 inet_ehash_locks_alloc+0x90/0x100 pages=16 vmalloc N0=2 N1=3 N2=3 N3=3 N4=3 N5=2
lack5:~# echo 1024 >/proc/sys/net/ipv4/tcp_child_ehash_entries lack5:~# numactl --interleave=all unshare -n bash -c "grep inet_ehash_locks_alloc /proc/vmallocinfo" 0x00000000db07d7a2-0x00000000ad697d29 8192 inet_ehash_locks_alloc+0x90/0x100 pages=1 vmalloc N2=1 0x00000000d9aec4d1-0x00000000a828b652 69632 inet_ehash_locks_alloc+0x90/0x100 pages=16 vmalloc N0=2 N1=3 N2=3 N3=3 N4=3 N5=2
--- net/ipv4/inet_hashtables.c | 37 ++++++++++++++++++++++++++----------- 1 file changed, 26 insertions(+), 11 deletions(-)
net/ipv4/inet_hashtables.c +26 -11
@@ -879,22 +879,37 @@ int inet_ehash_locks_alloc(struct inet_hashinfo *hashinfo) {unsigned int locksz =sizeof (spinlock_t);unsigned int i, nblocks =1 ; +spinlock_t *ptr =NULL ; -if (locksz !=0 ) { -/* allocate 2 cache lines or at least one spinlock per cpu */ - nblocks =max (2U *L1_CACHE_BYTES / locksz,1U ); - nblocks =roundup_pow_of_two (nblocks *num_possible_cpus ()); +if (locksz ==0 ) + goto set_mask; -/* no more locks than number of hash buckets */ - nblocks =min (nblocks, hashinfo->ehash_mask +1 ); +/* Allocate 2 cache lines or at least one spinlock per cpu. */ + nblocks =max (2U *L1_CACHE_BYTES / locksz,1U ) *num_possible_cpus (); - hashinfo->ehash_locks =kvmalloc_array (nblocks, locksz,GFP_KERNEL ); -if (!hashinfo->ehash_locks) -return -ENOMEM ; +/* At least one page per NUMA node. */ + nblocks =max (nblocks,num_online_nodes () *PAGE_SIZE / locksz); + + nblocks =roundup_pow_of_two (nblocks); + +/* No more locks than number of hash buckets. */ + nblocks =min (nblocks, hashinfo->ehash_mask +1 ); -for (i =0 ; i < nblocks; i++) -spin_lock_init (&hashinfo->ehash_locks[i]); +if (num_online_nodes () >1 ) { +/* Use vmalloc() to allow NUMA policy to spread pages +* on all available nodes if desired. +*/ + ptr =vmalloc_array (nblocks, locksz); + } +if (!ptr) { + ptr =kvmalloc_array (nblocks, locksz,GFP_KERNEL ); +if (!ptr) +return -ENOMEM ; } +for (i =0 ; i < nblocks; i++) +spin_lock_init (&ptr[i]); + hashinfo->ehash_locks = ptr; +set_mask: hashinfo->ehash_locks_mask = nblocks -1 ;return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 64/207 rtc: ds1307: stop disabling alarms on probe
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Belloni <[email protected]>
[ Upstream commit dcec12617ee61beed928e889607bf37e145bf86b ]
It is a bad practice to disable alarms on probe or remove as this will prevent alarms across reboots.
--- drivers/rtc/rtc-ds1307.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/rtc/rtc-ds1307.c +1 -3
@@ -1802,10 +1802,8 @@ static int ds1307_probe(struct i2c_client *client,* For some variants, be sure alarms can trigger when we're * running on Vbackup (BBSQI/BBSQW) */ -if (want_irq || ds1307_can_wakeup_device) { +if (want_irq || ds1307_can_wakeup_device) regs[0 ] |=DS1337_BIT_INTCN | chip->bbsqi_bit; - regs[0 ] &= ~(DS1337_BIT_A2IE |DS1337_BIT_A1IE ); - }regmap_write (ds1307->regmap,DS1337_REG_CONTROL , regs[0 ]);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/207 ieee802154: ca8210: Use proper setters and getters for bitwise types
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 169b2262205836a5d1213ff44dca2962276bece1 ]
Sparse complains that the driver doesn't respect the bitwise types:
drivers/net/ieee802154/ca8210.c:1796:27: warning: incorrect type in assignment (different base types)drivers/net/ieee802154/ca8210.c:1796:27: expected restricted __le16 [addressable] [assigned] [usertype] pan_iddrivers/net/ieee802154/ca8210.c:1796:27: got unsigned short [usertype]drivers/net/ieee802154/ca8210.c:1801:25: warning: incorrect type in assignment (different base types)drivers/net/ieee802154/ca8210.c:1801:25: expected restricted __le16 [addressable] [assigned] [usertype] pan_iddrivers/net/ieee802154/ca8210.c:1801:25: got unsigned short [usertype]drivers/net/ieee802154/ca8210.c:1928:28: warning: incorrect type in argument 3 (different base types)drivers/net/ieee802154/ca8210.c:1928:28: expected unsigned short [usertype] dst_pan_iddrivers/net/ieee802154/ca8210.c:1928:28: got restricted __le16 [addressable] [usertype] pan_id
Use proper setters and getters for bitwise types.
Note, in accordance with [1] the protocol is little endian.
--- drivers/net/ieee802154/ca8210.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/net/ieee802154/ca8210.c +4 -5
@@ -1488,8 +1488,7 @@ static u8 mcps_data_request( command.pdata.data_req.src_addr_mode = src_addr_mode; command.pdata.data_req.dst.mode = dst_address_mode;if (dst_address_mode !=MAC_MODE_NO_ADDR ) { - command.pdata.data_req.dst.pan_id[0 ] =LS_BYTE (dst_pan_id); - command.pdata.data_req.dst.pan_id[1 ] =MS_BYTE (dst_pan_id); +put_unaligned_le16 (dst_pan_id, command.pdata.data_req.dst.pan_id);if (dst_address_mode ==MAC_MODE_SHORT_ADDR ) { command.pdata.data_req.dst.address[0 ] =LS_BYTE ( dst_addr->short_address
@@ -1838,12 +1837,12 @@ static int ca8210_skb_rx( } hdr.source.mode = data_ind[0 ];dev_dbg (&priv->spi->dev,"srcAddrMode: %#03x\n" , hdr.source.mode); - hdr.source.pan_id = *(u16 *)&data_ind[1 ]; + hdr.source.pan_id =cpu_to_le16 (get_unaligned_le16 (&data_ind[1 ]));dev_dbg (&priv->spi->dev,"srcPanId: %#06x\n" , hdr.source.pan_id);memcpy (&hdr.source.extended_addr, &data_ind[3 ],8 ); hdr.dest.mode = data_ind[11 ];dev_dbg (&priv->spi->dev,"dstAddrMode: %#03x\n" , hdr.dest.mode); - hdr.dest.pan_id = *(u16 *)&data_ind[12 ]; + hdr.dest.pan_id =cpu_to_le16 (get_unaligned_le16 (&data_ind[12 ]));dev_dbg (&priv->spi->dev,"dstPanId: %#06x\n" , hdr.dest.pan_id);memcpy (&hdr.dest.extended_addr, &data_ind[14 ],8 );
@@ -1970,7 +1969,7 @@ static int ca8210_skb_tx( status = mcps_data_request( header.source.mode, header.dest.mode, - header.dest.pan_id, + le16_to_cpu(header.dest.pan_id), (union macaddr *)&header.dest.extended_addr, skb->len - mac_len, &skb->data[mac_len],
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/207 ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Svyatoslav Ryhel <[email protected]>
[ Upstream commit 2b3db788f2f614b875b257cdb079adadedc060f3 ]
PLLD is usually used as parent clock for internal video devices, like DSI for example, while PLLD2 is used as parent for HDMI.
--- arch/arm/boot/dts/tegra114.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/tegra114.dtsi +1 -1
@@ -126,7 +126,7 @@ dsi@54400000 { reg = <0x54400000 0x00040000>; clocks = <&tegra_car TEGRA114_CLK_DSIB>, <&tegra_car TEGRA114_CLK_DSIBLP>, - <&tegra_car TEGRA114_CLK_PLL_D2_OUT0>; + <&tegra_car TEGRA114_CLK_PLL_D_OUT0>; clock-names = "dsi", "lp", "parent"; resets = <&tegra_car 82>; reset-names = "dsi";
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/207 media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Elfring <[email protected]>
[ Upstream commit b773530a34df0687020520015057075f8b7b4ac4 ]
An of_node_put(i2c_bus) call was immediately used after a pointer check for an of_find_i2c_adapter_by_node() call in this function implementation. Thus call such a function only once instead directly before the check.
This issue was transformed by using the Coccinelle software.
--- drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +1 -2
@@ -811,13 +811,12 @@ static int c8sectpfe_probe(struct platform_device *pdev) } tsin->i2c_adapter =of_find_i2c_adapter_by_node (i2c_bus); +of_node_put (i2c_bus);if (!tsin->i2c_adapter) {dev_err (&pdev->dev,"No i2c adapter found\n" ); -of_node_put (i2c_bus); ret = -ENODEV ; goto err_node_put; } -of_node_put (i2c_bus); tsin->rst_gpio =of_get_named_gpio (child,"reset-gpios" ,0 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/207 dm cache: prevent BUG_ON by blocking retries on failed device resumes
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming-Hung Tsai <[email protected]>
[ Upstream commit 5da692e2262b8f81993baa9592f57d12c2703dea ]
A cache device failing to resume due to mapping errors should not be retried, as the failure leaves a partially initialized policy object. Repeating the resume operation risks triggering BUG_ON when reloading cache mappings into the incomplete policy object.
Reproduce steps:
1. create a cache metadata consisting of 512 or more cache blocks, with some mappings stored in the first array block of the mapping array. Here we use cache_restore v1.0 to build the metadata.
cat <<EOF >> cmeta.xml
<superblock uuid="" block_size="128" nr_cache_blocks="512" \
policy="smq" hint_width="4">
<mappings>
<mapping cache_block="0" origin_block="0" dirty="false"/>
</mappings>
</superblock>
EOF
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" cache_restore -i cmeta.xml -o /dev/mapper/cmeta --metadata-version=2 dmsetup remove cmeta
2. wipe the second array block of the mapping array to simulate data degradations.
mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \
2>/dev/null | hexdump -e '1/8 "%u\n"')
ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \
2>/dev/null | hexdump -e '1/8 "%u\n"')
dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock
3. try bringing up the cache device. The resume is expected to fail due to the broken array block.
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dmsetup create cache --notable
dmsetup load cache --table "0 524288 cache /dev/mapper/cmeta \/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" dmsetup resume cache
4. try resuming the cache again. An unexpected BUG_ON is triggered while loading cache mappings.
dmsetup resume cache
Kernel logs:
(snip)
------------[ cut here ]------------ kernel BUG at drivers/md/dm-cache-policy-smq.c:752! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 UID: 0 PID: 332 Comm: dmsetup Not tainted 6.13.4 #3 RIP: 0010:smq_load_mapping+0x3e5/0x570
Fix by disallowing resume operations for devices that failed the initial attempt.
--- drivers/md/dm-cache-target.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
drivers/md/dm-cache-target.c +24 -0
@@ -2883,6 +2883,27 @@ static dm_cblock_t get_cache_dev_size(struct cache *cache)return to_cblock (size); } +static bool can_resume (struct cache *cache) +{ +/* +* Disallow retrying the resume operation for devices that failed the +* first resume attempt, as the failure leaves the policy object partially +* initialized. Retrying could trigger BUG_ON when loading cache mappings +* into the incomplete policy object. +*/ +if (cache->sized && !cache->loaded_mappings) { +if (get_cache_mode (cache) !=CM_WRITE ) +DMERR ("%s: unable to resume a failed-loaded cache, please check metadata." , +cache_device_name (cache)); +else +DMERR ("%s: unable to resume cache due to missing proper cache table reload" , +cache_device_name (cache)); +return false; + } + +return true; +} +static bool can_resize (struct cache *cache,dm_cblock_t new_size) {if (from_cblock (new_size) >from_cblock (cache->cache_size)) {
@@ -2931,6 +2952,9 @@ static int cache_preresume(struct dm_target *ti)struct cache *cache = ti->private;dm_cblock_t csize =get_cache_dev_size (cache); +if (!can_resume (cache)) +return -EINVAL ; +/* * Check to see if the cache has resized. */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/207 orangefs: Do not truncate file size
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit 062e8093592fb866b8e016641a8b27feb6ac509d ]
'len' is used to store the result of i_size_read(), so making 'len' a size_t results in truncation to 4GiB on 32-bit systems.
--- fs/orangefs/inode.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
fs/orangefs/inode.c +3 -4
@@ -23,9 +23,9 @@ static int orangefs_writepage_locked(struct page *page,struct orangefs_write_range *wr =NULL ;struct iov_iter iter;struct bio_vec bv; -size_t len, wlen; +size_t wlen;ssize_t ret; -loff_t off; +loff_t len, off;set_page_writeback (page);
@@ -94,8 +94,7 @@ static int orangefs_writepages_work(struct orangefs_writepages *ow,struct orangefs_write_range *wrp, wr;struct iov_iter iter;ssize_t ret; -size_t len; -loff_t off; +loff_t len, off;int i; len =i_size_read (inode);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 70/207 remoteproc: qcom_wcnss: Handle platforms with only single power domain
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matti Lehtimäki <[email protected]>
[ Upstream commit 65991ea8a6d1e68effdc01d95ebe39f1653f7b71 ]
Both MSM8974 and MSM8226 have only CX as power domain with MX & PX being handled as regulators. Handle this case by reodering pd_names to have CX first, and handling that the driver core will already attach a single power domain internally.
--- drivers/remoteproc/qcom_wcnss.c | 33 ++++++++++++++++++++++++++------- 1 file changed, 26 insertions(+), 7 deletions(-)
drivers/remoteproc/qcom_wcnss.c +26 -7
@@ -118,10 +118,10 @@ static const struct wcnss_data pronto_v1_data = { .pmu_offset = 0x1004, .spare_offset = 0x1088, - .pd_names = { "mx", "cx" }, + .pd_names = { "cx", "mx" }, .vregs = (struct wcnss_vreg_info[]) { - {"vddmx" ,950000 ,1150000 ,0 }, {"vddcx" , .super_turbo = true}, + {"vddmx" ,950000 ,1150000 ,0 }, {"vddpx" ,1800000 ,1800000 ,0 }, }, .num_pd_vregs = 2,
@@ -132,10 +132,10 @@ static const struct wcnss_data pronto_v2_data = { .pmu_offset = 0x1004, .spare_offset = 0x1088, - .pd_names = { "mx", "cx" }, + .pd_names = { "cx", "mx" }, .vregs = (struct wcnss_vreg_info[]) { - {"vddmx" ,1287500 ,1287500 ,0 }, {"vddcx" , .super_turbo = true }, + {"vddmx" ,1287500 ,1287500 ,0 }, {"vddpx" ,1800000 ,1800000 ,0 }, }, .num_pd_vregs = 2,
@@ -387,8 +387,17 @@ static irqreturn_t wcnss_stop_ack_interrupt(int irq, void *dev)static int wcnss_init_pds (struct qcom_wcnss *wcnss,const char *const pd_names[WCNSS_MAX_PDS ]) { +struct device *dev = wcnss->dev;int i, ret; +/* Handle single power domain */ +if (dev->pm_domain) { + wcnss->pds[0 ] = dev; + wcnss->num_pds =1 ; +pm_runtime_enable (dev); +return 0 ; + } +for (i =0 ; i <WCNSS_MAX_PDS ; i++) {if (!pd_names[i])break ;
@@ -408,8 +417,15 @@ static int wcnss_init_pds(struct qcom_wcnss *wcnss,static void wcnss_release_pds (struct qcom_wcnss *wcnss) { +struct device *dev = wcnss->dev;int i; +/* Handle single power domain */ +if (wcnss->num_pds ==1 && dev->pm_domain) { +pm_runtime_disable (dev); +return ; + } +for (i =0 ; i < wcnss->num_pds; i++)dev_pm_domain_detach (wcnss->pds[i], false); }
@@ -427,10 +443,13 @@ static int wcnss_init_regulators(struct qcom_wcnss *wcnss,* the regulators for the power domains. For old device trees we need to * reserve extra space to manage them through the regulator interface. */ -if (wcnss->num_pds) - info += num_pd_vregs; -else +if (wcnss->num_pds) { + info += wcnss->num_pds; +/* Handle single power domain case */ + num_vregs += num_pd_vregs - wcnss->num_pds; + }else { num_vregs += num_pd_vregs; + } bulk = devm_kcalloc(wcnss->dev, num_vregs, sizeof(struct regulator_bulk_data),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/207 drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Victor Lu <[email protected]>
[ Upstream commit 057fef20b8401110a7bc1c2fe9d804a8a0bf0d24 ]
SRIOV VF does not have write access to AGP BAR regs. Skip the writes to avoid a dmesg warning.
--- drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c +5 -5
@@ -92,12 +92,12 @@ static void gfxhub_v1_0_init_system_aperture_regs(struct amdgpu_device *adev) {uint64_t value; -/* Program the AGP BAR */ -WREG32_SOC15_RLC (GC ,0 , mmMC_VM_AGP_BASE,0 ); -WREG32_SOC15_RLC (GC ,0 , mmMC_VM_AGP_BOT, adev->gmc.agp_start >>24 ); -WREG32_SOC15_RLC (GC ,0 , mmMC_VM_AGP_TOP, adev->gmc.agp_end >>24 ); -if (!amdgpu_sriov_vf (adev) || adev->asic_type <=CHIP_VEGA10 ) { +/* Program the AGP BAR */ +WREG32_SOC15_RLC (GC ,0 , mmMC_VM_AGP_BASE,0 ); +WREG32_SOC15_RLC (GC ,0 , mmMC_VM_AGP_BOT, adev->gmc.agp_start >>24 ); +WREG32_SOC15_RLC (GC ,0 , mmMC_VM_AGP_TOP, adev->gmc.agp_end >>24 ); +/* Program the system aperture low logical page number. */ WREG32_SOC15_RLC (GC ,0 , mmMC_VM_SYSTEM_APERTURE_LOW_ADDR,min (adev->gmc.fb_start, adev->gmc.agp_start) >>18 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/207 media: cx231xx: set device_caps for 417
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit a79efc44b51432490538a55b9753a721f7d3ea42 ]
The video_device for the MPEG encoder did not set device_caps.
Add this, otherwise the video device can't be registered (you get a WARN_ON instead).
Not seen before since currently 417 support is disabled, but I found this while experimenting with it.
--- drivers/media/usb/cx231xx/cx231xx-417.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/usb/cx231xx/cx231xx-417.c +2 -0
@@ -1722,6 +1722,8 @@ static void cx231xx_video_dev_init( vfd->lock = &dev->lock; vfd->release = video_device_release_empty; vfd->ctrl_handler = &dev->mpeg_ctrl_handler.hdl; + vfd->device_caps =V4L2_CAP_READWRITE |V4L2_CAP_STREAMING | +V4L2_CAP_VIDEO_CAPTURE ;video_set_drvdata (vfd, dev);if (dev->tuner_type ==TUNER_ABSENT ) {v4l2_disable_ioctl (vfd,VIDIOC_G_FREQUENCY );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/207 pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artur Weber <[email protected]>
[ Upstream commit 07b5a2a13f4704c5eae3be7277ec54ffdba45f72 ]
Replace uses of bare "unsigned" with "unsigned int" to fix checkpatch warnings. No functional change.
--- drivers/pinctrl/bcm/pinctrl-bcm281xx.c | 44 +++++++++++++------------- 1 file changed, 22 insertions(+), 22 deletions(-)
drivers/pinctrl/bcm/pinctrl-bcm281xx.c +22 -22
@@ -79,7 +79,7 @@ static enum bcm281xx_pin_type hdmi_pin = BCM281XX_PIN_TYPE_HDMI;struct bcm281xx_pin_function {const char *name;const char *const *groups; -const unsigned ngroups; +const unsigned int ngroups; };/*
@@ -91,10 +91,10 @@ struct bcm281xx_pinctrl_data {/* List of all pins */ const struct pinctrl_pin_desc *pins; -const unsigned npins; +const unsigned int npins;const struct bcm281xx_pin_function *functions; -const unsigned nfunctions; +const unsigned int nfunctions;struct regmap *regmap; };
@@ -948,7 +948,7 @@ static struct bcm281xx_pinctrl_data bcm281xx_pinctrl = { };static inline enum bcm281xx_pin_type pin_type_get (struct pinctrl_dev *pctldev, -unsigned pin) +unsigned int pin) {struct bcm281xx_pinctrl_data *pdata =pinctrl_dev_get_drvdata (pctldev);
@@ -992,7 +992,7 @@ static int bcm281xx_pinctrl_get_groups_count(struct pinctrl_dev *pctldev) }static const char *bcm281xx_pinctrl_get_group_name (struct pinctrl_dev *pctldev, -unsigned group) +unsigned int group) {struct bcm281xx_pinctrl_data *pdata =pinctrl_dev_get_drvdata (pctldev);
@@ -1000,9 +1000,9 @@ static const char *bcm281xx_pinctrl_get_group_name(struct pinctrl_dev *pctldev, }static int bcm281xx_pinctrl_get_group_pins (struct pinctrl_dev *pctldev, -unsigned group, +unsigned int group,const unsigned **pins, -unsigned *num_pins) +unsigned int *num_pins) {struct bcm281xx_pinctrl_data *pdata =pinctrl_dev_get_drvdata (pctldev);
@@ -1014,7 +1014,7 @@ static int bcm281xx_pinctrl_get_group_pins(struct pinctrl_dev *pctldev,static void bcm281xx_pinctrl_pin_dbg_show (struct pinctrl_dev *pctldev,struct seq_file *s, -unsigned offset) +unsigned int offset) {seq_printf (s," %s" ,dev_name (pctldev->dev)); }
@@ -1036,7 +1036,7 @@ static int bcm281xx_pinctrl_get_fcns_count(struct pinctrl_dev *pctldev) }static const char *bcm281xx_pinctrl_get_fcn_name (struct pinctrl_dev *pctldev, -unsigned function) +unsigned int function) {struct bcm281xx_pinctrl_data *pdata =pinctrl_dev_get_drvdata (pctldev);
@@ -1044,9 +1044,9 @@ static const char *bcm281xx_pinctrl_get_fcn_name(struct pinctrl_dev *pctldev, }static int bcm281xx_pinctrl_get_fcn_groups (struct pinctrl_dev *pctldev, -unsigned function, +unsigned int function,const char *const **groups, -unsigned *const num_groups) +unsigned int *const num_groups) {struct bcm281xx_pinctrl_data *pdata =pinctrl_dev_get_drvdata (pctldev);
@@ -1057,8 +1057,8 @@ static int bcm281xx_pinctrl_get_fcn_groups(struct pinctrl_dev *pctldev, }static int bcm281xx_pinmux_set (struct pinctrl_dev *pctldev, -unsigned function, -unsigned group) +unsigned int function, +unsigned int group) {struct bcm281xx_pinctrl_data *pdata =pinctrl_dev_get_drvdata (pctldev);const struct bcm281xx_pin_function *f = &pdata->functions[function];
@@ -1089,7 +1089,7 @@ static const struct pinmux_ops bcm281xx_pinctrl_pinmux_ops = { };static int bcm281xx_pinctrl_pin_config_get (struct pinctrl_dev *pctldev, -unsigned pin, +unsigned int pin,unsigned long *config) {return -ENOTSUPP ;
@@ -1098,9 +1098,9 @@ static int bcm281xx_pinctrl_pin_config_get(struct pinctrl_dev *pctldev,/* Goes through the configs and update register val/mask */ static int bcm281xx_std_pin_update (struct pinctrl_dev *pctldev, -unsigned pin, +unsigned int pin,unsigned long *configs, -unsigned num_configs, +unsigned int num_configs,u32 *val,u32 *mask) {
@@ -1214,9 +1214,9 @@ static const u16 bcm281xx_pullup_map[] = {/* Goes through the configs and update register val/mask */ static int bcm281xx_i2c_pin_update (struct pinctrl_dev *pctldev, -unsigned pin, +unsigned int pin,unsigned long *configs, -unsigned num_configs, +unsigned int num_configs,u32 *val,u32 *mask) {
@@ -1284,9 +1284,9 @@ static int bcm281xx_i2c_pin_update(struct pinctrl_dev *pctldev,/* Goes through the configs and update register val/mask */ static int bcm281xx_hdmi_pin_update (struct pinctrl_dev *pctldev, -unsigned pin, +unsigned int pin,unsigned long *configs, -unsigned num_configs, +unsigned int num_configs,u32 *val,u32 *mask) {
@@ -1328,9 +1328,9 @@ static int bcm281xx_hdmi_pin_update(struct pinctrl_dev *pctldev, }static int bcm281xx_pinctrl_pin_config_set (struct pinctrl_dev *pctldev, -unsigned pin, +unsigned int pin,unsigned long *configs, -unsigned num_configs) +unsigned int num_configs) {struct bcm281xx_pinctrl_data *pdata =pinctrl_dev_get_drvdata (pctldev);enum bcm281xx_pin_type pin_type;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/207 net: ethernet: ti: cpsw_new: populate netdev of_node
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <[email protected]>
[ Upstream commit 7ff1c88fc89688c27f773ba956f65f0c11367269 ]
So that of_find_net_device_by_node() can find CPSW ports and other DSA switches can be stacked downstream. Tested in conjunction with KSZ8873.
--- drivers/net/ethernet/ti/cpsw_new.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/ti/cpsw_new.c +1 -0
@@ -1418,6 +1418,7 @@ static int cpsw_create_ports(struct cpsw_common *cpsw) ndev->netdev_ops = &cpsw_netdev_ops; ndev->ethtool_ops = &cpsw_ethtool_ops;SET_NETDEV_DEV (ndev, dev); + ndev->dev.of_node = slave_data->slave_node;if (!napi_ndev) {/* CPSW Host port CPDMA interface is shared between
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/207 net: pktgen: fix mpls maximum labels list parsing
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Seiderer <[email protected]>
[ Upstream commit 2b15a0693f70d1e8119743ee89edbfb1271b3ea8 ]
Fix mpls maximum labels list parsing up to MAX_MPLS_LABELS entries (instead of up to MAX_MPLS_LABELS - 1).
Addresses the following:
$ echo "mpls 00000f00,00000f01,00000f02,00000f03,00000f04,00000f05,00000f06,00000f07,00000f08,00000f09,00000f0a,00000f0b,00000f0c,00000f0d,00000f0e,00000f0f" > /proc/net/pktgen/lo\@0 -bash: echo: write error: Argument list too long
--- net/core/pktgen.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/core/pktgen.c +4 -2
@@ -896,6 +896,10 @@ static ssize_t get_labels(const char __user *buffer, struct pktgen_dev *pkt_dev) pkt_dev->nr_labels =0 ; do { __u32 tmp; + + if (n >= MAX_MPLS_LABELS) + return -E2BIG; + len = hex32_arg(&buffer[i], 8, &tmp); if (len <= 0) return len;
@@ -907,8 +911,6 @@ static ssize_t get_labels(const char __user *buffer, struct pktgen_dev *pkt_dev)return -EFAULT ; i++; n++; -if (n >=MAX_MPLS_LABELS ) -return -E2BIG ; }while (c ==',' ); pkt_dev->nr_labels = n;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/207 ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config().
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 254ba7e6032d3fc738050d500b0c1d8197af90ca ]
fib_valid_key_len() is called in the beginning of fib_table_insert() or fib_table_delete() to check if the prefix length is valid.
fib_table_insert() and fib_table_delete() are called from 3 paths
- ip_rt_ioctl()
- inet_rtm_newroute() / inet_rtm_delroute()
- fib_magic()
In the first ioctl() path, rtentry_to_fib_config() checks the prefix length with bad_mask(). Also, fib_magic() always passes the correct
prefix: 32 or ifa->ifa_prefixlen, which is already validated.
Let's move fib_valid_key_len() to the rtnetlink path, rtm_to_fib_config().
While at it, 2 direct returns in rtm_to_fib_config() are changed to goto to match other places in the same function
--- net/ipv4/fib_frontend.c | 18 ++++++++++++++++-- net/ipv4/fib_trie.c | 22 ---------------------- 2 files changed, 16 insertions(+), 24 deletions(-)
net/ipv4/fib_frontend.c +16 -2
@@ -817,19 +817,33 @@ static int rtm_to_fib_config(struct net *net, struct sk_buff *skb, } } +if (cfg->fc_dst_len >32 ) { +NL_SET_ERR_MSG (extack,"Invalid prefix length" ); + err = -EINVAL ; + goto errout; + } + +if (cfg->fc_dst_len <32 && (ntohl (cfg->fc_dst) << cfg->fc_dst_len)) { +NL_SET_ERR_MSG (extack,"Invalid prefix for given prefix length" ); + err = -EINVAL ; + goto errout; + } +if (cfg->fc_nh_id) {if (cfg->fc_oif || cfg->fc_gw_family || cfg->fc_encap || cfg->fc_mp) {NL_SET_ERR_MSG (extack,"Nexthop specification and nexthop id are mutually exclusive" ); -return -EINVAL ; + err = -EINVAL ; + goto errout; } }if (has_gw && has_via) {NL_SET_ERR_MSG (extack,"Nexthop configuration can not contain both GATEWAY and VIA" ); -return -EINVAL ; + err = -EINVAL ; + goto errout; }if (!cfg->fc_table)
net/ipv4/fib_trie.c +0 -22
@@ -1187,22 +1187,6 @@ static int fib_insert_alias(struct trie *t, struct key_vector *tp,return 0 ; } -static bool fib_valid_key_len (u32 key,u8 plen,struct netlink_ext_ack *extack) -{ -if (plen >KEYLENGTH ) { -NL_SET_ERR_MSG (extack,"Invalid prefix length" ); -return false; - } - -if ((plen <KEYLENGTH ) && (key << plen)) { -NL_SET_ERR_MSG (extack, -"Invalid prefix for given prefix length" ); -return false; - } - -return true; -} -static void fib_remove_alias (struct trie *t,struct key_vector *tp,struct key_vector *l,struct fib_alias *old);
@@ -1223,9 +1207,6 @@ int fib_table_insert(struct net *net, struct fib_table *tb, key =ntohl (cfg->fc_dst); -if (!fib_valid_key_len (key, plen, extack)) -return -EINVAL ; -pr_debug ("Insert table=%u %08x/%d\n" , tb->tb_id, key, plen); fi =fib_create_info (cfg, extack);
@@ -1715,9 +1696,6 @@ int fib_table_delete(struct net *net, struct fib_table *tb, key =ntohl (cfg->fc_dst); -if (!fib_valid_key_len (key, plen, extack)) -return -EINVAL ; - l =fib_find_node (t, &tp, key);if (!l)return -ESRCH ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/207 media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 990262fdfce24d6055df9711424343d94d829e6a ]
Do not process unknown data types.
--- drivers/media/usb/uvc/uvc_v4l2.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/media/usb/uvc/uvc_v4l2.c +6 -0
@@ -35,6 +35,12 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain,unsigned int size;int ret; +if (xmap->data_type >UVC_CTRL_DATA_TYPE_BITMASK ) { +uvc_dbg (chain->dev,CONTROL , +"Unsupported UVC data type %u\n" , xmap->data_type); +return -EINVAL ; + } + map =kzalloc (sizeof (*map),GFP_KERNEL );if (map ==NULL )return -ENOMEM ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/207 clk: imx8mp: inform CCF of maximum frequency of clocks
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmad Fatoum <[email protected]>
[ Upstream commit 06a61b5cb6a8638fa8823cd09b17233b29696fa2 ]
The IMX8MPCEC datasheet lists maximum frequencies allowed for different modules. Some of these limits are universal, but some depend on whether the SoC is operating in nominal or in overdrive mode.
The imx8mp.dtsi currently assumes overdrive mode and configures some clocks in accordance with this. Boards wishing to make use of nominal mode will need to override some of the clock rates manually.
As operating the clocks outside of their allowed range can lead to difficult to debug issues, it makes sense to register the maximum rates allowed in the driver, so the CCF can take them into account.
--- drivers/clk/imx/clk-imx8mp.c | 151 +++++++++++++++++++++++++++++++++++ 1 file changed, 151 insertions(+)
drivers/clk/imx/clk-imx8mp.c +151 -0
@@ -8,6 +8,7 @@#include <linux/err.h> #include <linux/io.h> #include <linux/module.h> +#include <linux/units.h> #include <linux/of_address.h> #include <linux/platform_device.h> #include <linux/slab.h>
@@ -405,11 +406,151 @@ static const char * const imx8mp_clkout_sels[] = {"audio_pll1_out", "audio_pll2_static struct clk_hw **hws;static struct clk_hw_onecell_data *clk_hw_data; +struct imx8mp_clock_constraints { +unsigned int clkid; +u32 maxrate; +}; + +/* +* Below tables are taken from IMX8MPCEC Rev. 2.1, 07/2023 +* Table 13. Maximum frequency of modules. +* Probable typos fixed are marked with a comment. +*/ +static const struct imx8mp_clock_constraints imx8mp_clock_common_constraints[] = { + {IMX8MP_CLK_A53_DIV ,1000 *HZ_PER_MHZ }, + {IMX8MP_CLK_ENET_AXI ,266666667 },/* Datasheet claims 266MHz */ + {IMX8MP_CLK_NAND_USDHC_BUS ,266666667 },/* Datasheet claims 266MHz */ + {IMX8MP_CLK_MEDIA_APB ,200 *HZ_PER_MHZ }, + {IMX8MP_CLK_HDMI_APB ,133333333 },/* Datasheet claims 133MHz */ + {IMX8MP_CLK_ML_AXI ,800 *HZ_PER_MHZ }, + {IMX8MP_CLK_AHB ,133333333 }, + {IMX8MP_CLK_IPG_ROOT ,66666667 }, + {IMX8MP_CLK_AUDIO_AHB ,400 *HZ_PER_MHZ }, + {IMX8MP_CLK_MEDIA_DISP2_PIX ,170 *HZ_PER_MHZ }, + {IMX8MP_CLK_DRAM_ALT ,666666667 }, + {IMX8MP_CLK_DRAM_APB ,200 *HZ_PER_MHZ }, + {IMX8MP_CLK_CAN1 ,80 *HZ_PER_MHZ }, + {IMX8MP_CLK_CAN2 ,80 *HZ_PER_MHZ }, + {IMX8MP_CLK_PCIE_AUX ,10 *HZ_PER_MHZ }, + {IMX8MP_CLK_I2C5 ,66666667 },/* Datasheet claims 66MHz */ + {IMX8MP_CLK_I2C6 ,66666667 },/* Datasheet claims 66MHz */ + {IMX8MP_CLK_SAI1 ,66666667 },/* Datasheet claims 66MHz */ + {IMX8MP_CLK_SAI2 ,66666667 },/* Datasheet claims 66MHz */ + {IMX8MP_CLK_SAI3 ,66666667 },/* Datasheet claims 66MHz */ + {IMX8MP_CLK_SAI5 ,66666667 },/* Datasheet claims 66MHz */ + {IMX8MP_CLK_SAI6 ,66666667 },/* Datasheet claims 66MHz */ + {IMX8MP_CLK_ENET_QOS ,125 *HZ_PER_MHZ }, + {IMX8MP_CLK_ENET_QOS_TIMER ,200 *HZ_PER_MHZ }, + {IMX8MP_CLK_ENET_REF ,125 *HZ_PER_MHZ }, + {IMX8MP_CLK_ENET_TIMER ,125 *HZ_PER_MHZ }, + {IMX8MP_CLK_ENET_PHY_REF ,125 *HZ_PER_MHZ }, + {IMX8MP_CLK_NAND ,500 *HZ_PER_MHZ }, + {IMX8MP_CLK_QSPI ,400 *HZ_PER_MHZ }, + {IMX8MP_CLK_USDHC1 ,400 *HZ_PER_MHZ }, + {IMX8MP_CLK_USDHC2 ,400 *HZ_PER_MHZ }, + {IMX8MP_CLK_I2C1 ,66666667 },/* Datasheet claims 66MHz */ + {IMX8MP_CLK_I2C2 ,66666667 },/* Datasheet claims 66MHz */ + {IMX8MP_CLK_I2C3 ,66666667 },/* Datasheet claims 66MHz */ + {IMX8MP_CLK_I2C4 ,66666667 },/* Datasheet claims 66MHz */ + {IMX8MP_CLK_UART1 ,80 *HZ_PER_MHZ }, + {IMX8MP_CLK_UART2 ,80 *HZ_PER_MHZ }, + {IMX8MP_CLK_UART3 ,80 *HZ_PER_MHZ }, + {IMX8MP_CLK_UART4 ,80 *HZ_PER_MHZ }, + {IMX8MP_CLK_ECSPI1 ,80 *HZ_PER_MHZ }, + {IMX8MP_CLK_ECSPI2 ,80 *HZ_PER_MHZ }, + {IMX8MP_CLK_PWM1 ,66666667 },/* Datasheet claims 66MHz */ + {IMX8MP_CLK_PWM2 ,66666667 },/* Datasheet claims 66MHz */ + {IMX8MP_CLK_PWM3 ,66666667 },/* Datasheet claims 66MHz */ + {IMX8MP_CLK_PWM4 ,66666667 },/* Datasheet claims 66MHz */ + {IMX8MP_CLK_GPT1 ,100 *HZ_PER_MHZ }, + {IMX8MP_CLK_GPT2 ,100 *HZ_PER_MHZ }, + {IMX8MP_CLK_GPT3 ,100 *HZ_PER_MHZ }, + {IMX8MP_CLK_GPT4 ,100 *HZ_PER_MHZ }, + {IMX8MP_CLK_GPT5 ,100 *HZ_PER_MHZ }, + {IMX8MP_CLK_GPT6 ,100 *HZ_PER_MHZ }, + {IMX8MP_CLK_WDOG ,66666667 },/* Datasheet claims 66MHz */ + {IMX8MP_CLK_IPP_DO_CLKO1 ,200 *HZ_PER_MHZ }, + {IMX8MP_CLK_IPP_DO_CLKO2 ,200 *HZ_PER_MHZ }, + {IMX8MP_CLK_HDMI_REF_266M ,266 *HZ_PER_MHZ }, + {IMX8MP_CLK_USDHC3 ,400 *HZ_PER_MHZ }, + {IMX8MP_CLK_MEDIA_MIPI_PHY1_REF ,300 *HZ_PER_MHZ }, + {IMX8MP_CLK_MEDIA_DISP1_PIX ,250 *HZ_PER_MHZ }, + {IMX8MP_CLK_MEDIA_CAM2_PIX ,277 *HZ_PER_MHZ }, + {IMX8MP_CLK_MEDIA_LDB ,595 *HZ_PER_MHZ }, + {IMX8MP_CLK_MEDIA_MIPI_TEST_BYTE ,200 *HZ_PER_MHZ }, + {IMX8MP_CLK_ECSPI3 ,80 *HZ_PER_MHZ }, + {IMX8MP_CLK_PDM ,200 *HZ_PER_MHZ }, + {IMX8MP_CLK_SAI7 ,66666667 },/* Datasheet claims 66MHz */ + {IMX8MP_CLK_MAIN_AXI ,400 *HZ_PER_MHZ }, + {/* Sentinel */ } +}; + +static const struct imx8mp_clock_constraints imx8mp_clock_nominal_constraints[] = { + {IMX8MP_CLK_M7_CORE ,600 *HZ_PER_MHZ }, + {IMX8MP_CLK_ML_CORE ,800 *HZ_PER_MHZ }, + {IMX8MP_CLK_GPU3D_CORE ,800 *HZ_PER_MHZ }, + {IMX8MP_CLK_GPU3D_SHADER_CORE ,800 *HZ_PER_MHZ }, + {IMX8MP_CLK_GPU2D_CORE ,800 *HZ_PER_MHZ }, + {IMX8MP_CLK_AUDIO_AXI_SRC ,600 *HZ_PER_MHZ }, + {IMX8MP_CLK_HSIO_AXI ,400 *HZ_PER_MHZ }, + {IMX8MP_CLK_MEDIA_ISP ,400 *HZ_PER_MHZ }, + {IMX8MP_CLK_VPU_BUS ,600 *HZ_PER_MHZ }, + {IMX8MP_CLK_MEDIA_AXI ,400 *HZ_PER_MHZ }, + {IMX8MP_CLK_HDMI_AXI ,400 *HZ_PER_MHZ }, + {IMX8MP_CLK_GPU_AXI ,600 *HZ_PER_MHZ }, + {IMX8MP_CLK_GPU_AHB ,300 *HZ_PER_MHZ }, + {IMX8MP_CLK_NOC ,800 *HZ_PER_MHZ }, + {IMX8MP_CLK_NOC_IO ,600 *HZ_PER_MHZ }, + {IMX8MP_CLK_ML_AHB ,300 *HZ_PER_MHZ }, + {IMX8MP_CLK_VPU_G1 ,600 *HZ_PER_MHZ }, + {IMX8MP_CLK_VPU_G2 ,500 *HZ_PER_MHZ }, + {IMX8MP_CLK_MEDIA_CAM1_PIX ,400 *HZ_PER_MHZ }, + {IMX8MP_CLK_VPU_VC8000E ,400 *HZ_PER_MHZ },/* Datasheet claims 500MHz */ + {IMX8MP_CLK_DRAM_CORE ,800 *HZ_PER_MHZ }, + {IMX8MP_CLK_GIC ,400 *HZ_PER_MHZ }, + {/* Sentinel */ } +}; + +static const struct imx8mp_clock_constraints imx8mp_clock_overdrive_constraints[] = { + {IMX8MP_CLK_M7_CORE ,800 *HZ_PER_MHZ }, + {IMX8MP_CLK_ML_CORE ,1000 *HZ_PER_MHZ }, + {IMX8MP_CLK_GPU3D_CORE ,1000 *HZ_PER_MHZ }, + {IMX8MP_CLK_GPU3D_SHADER_CORE ,1000 *HZ_PER_MHZ }, + {IMX8MP_CLK_GPU2D_CORE ,1000 *HZ_PER_MHZ }, + {IMX8MP_CLK_AUDIO_AXI_SRC ,800 *HZ_PER_MHZ }, + {IMX8MP_CLK_HSIO_AXI ,500 *HZ_PER_MHZ }, + {IMX8MP_CLK_MEDIA_ISP ,500 *HZ_PER_MHZ }, + {IMX8MP_CLK_VPU_BUS ,800 *HZ_PER_MHZ }, + {IMX8MP_CLK_MEDIA_AXI ,500 *HZ_PER_MHZ }, + {IMX8MP_CLK_HDMI_AXI ,500 *HZ_PER_MHZ }, + {IMX8MP_CLK_GPU_AXI ,800 *HZ_PER_MHZ }, + {IMX8MP_CLK_GPU_AHB ,400 *HZ_PER_MHZ }, + {IMX8MP_CLK_NOC ,1000 *HZ_PER_MHZ }, + {IMX8MP_CLK_NOC_IO ,800 *HZ_PER_MHZ }, + {IMX8MP_CLK_ML_AHB ,400 *HZ_PER_MHZ }, + {IMX8MP_CLK_VPU_G1 ,800 *HZ_PER_MHZ }, + {IMX8MP_CLK_VPU_G2 ,700 *HZ_PER_MHZ }, + {IMX8MP_CLK_MEDIA_CAM1_PIX ,500 *HZ_PER_MHZ }, + {IMX8MP_CLK_VPU_VC8000E ,500 *HZ_PER_MHZ },/* Datasheet claims 400MHz */ + {IMX8MP_CLK_DRAM_CORE ,1000 *HZ_PER_MHZ }, + {IMX8MP_CLK_GIC ,500 *HZ_PER_MHZ }, + {/* Sentinel */ } +}; + +static void imx8mp_clocks_apply_constraints (const struct imx8mp_clock_constraints constraints[]) +{ +const struct imx8mp_clock_constraints *constr; + +for (constr = constraints; constr->clkid; constr++) +clk_hw_set_rate_range (hws[constr->clkid],0 , constr->maxrate); +} +static int imx8mp_clocks_probe (struct platform_device *pdev) {struct device *dev = &pdev->dev;struct device_node *np;void __iomem *anatop_base, *ccm_base; +const char *opmode;int err; np =of_find_compatible_node (NULL ,NULL ,"fsl,imx8mp-anatop" );
@@ -720,6 +861,16 @@ static int imx8mp_clocks_probe(struct platform_device *pdev)imx_check_clk_hws (hws,IMX8MP_CLK_END ); +imx8mp_clocks_apply_constraints (imx8mp_clock_common_constraints); + + err =of_property_read_string (np,"fsl,operating-mode" , &opmode); +if (!err) { +if (!strcmp (opmode,"nominal" )) +imx8mp_clocks_apply_constraints (imx8mp_clock_nominal_constraints); +else if (!strcmp (opmode,"overdrive" )) +imx8mp_clocks_apply_constraints (imx8mp_clock_overdrive_constraints); + } + err =of_clk_add_hw_provider (np, of_clk_hw_onecell_get, clk_hw_data);if (err <0 ) {dev_err (dev,"failed to register hws for i.MX8MP\n" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/207 x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit 98fdaeb296f51ef08e727a7cc72e5b5c864c4f4d ]
Change the default value of spectre v2 in user mode to respect the CONFIG_MITIGATION_SPECTRE_V2 config option.
Currently, user mode spectre v2 is set to auto
(SPECTRE_V2_USER_CMD_AUTO) by default, even ifCONFIG_MITIGATION_SPECTRE_V2 is disabled.
Set the spectre_v2 value to auto (SPECTRE_V2_USER_CMD_AUTO) if the Spectre v2 config (CONFIG_MITIGATION_SPECTRE_V2) is enabled, otherwise set the value to none (SPECTRE_V2_USER_CMD_NONE).
Important to say the command line argument "spectre_v2_user" overwrites the default value in both cases.
When CONFIG_MITIGATION_SPECTRE_V2 is not set, users have the flexibility to opt-in for specific mitigations independently. In this scenario, setting spectre_v2= will not enable spectre_v2_user=, and command line options spectre_v2_user and spectre_v2 are independent when CONFIG_MITIGATION_SPECTRE_V2=n.
--- Documentation/admin-guide/kernel-parameters.txt | 2 ++ arch/x86/kernel/cpu/bugs.c | 10 +++++++--- 2 files changed, 9 insertions(+), 3 deletions(-)
Documentation/admin-guide/kernel-parameters.txt +2 -0
@@ -5445,6 +5445,8 @@ Selecting 'on' will also enable the mitigation against user space to user space task attacks. + Selecting specific mitigation does not force enable + user mitigations. Selecting 'off' will disable both the kernel and the user space protections.
arch/x86/kernel/cpu/bugs.c +7 -3
@@ -1382,9 +1382,13 @@ static __ro_after_init enum spectre_v2_mitigation_cmd spectre_v2_cmd;static enum spectre_v2_user_cmd __init spectre_v2_parse_user_cmdline (void ) { +enum spectre_v2_user_cmd mode;char arg[20 ];int ret, i; + mode =IS_ENABLED (CONFIG_MITIGATION_SPECTRE_V2 ) ? +SPECTRE_V2_USER_CMD_AUTO :SPECTRE_V2_USER_CMD_NONE ; +switch (spectre_v2_cmd) {case SPECTRE_V2_CMD_NONE :return SPECTRE_V2_USER_CMD_NONE ;
@@ -1397,7 +1401,7 @@ spectre_v2_parse_user_cmdline(void) ret =cmdline_find_option (boot_command_line,"spectre_v2_user" , arg,sizeof (arg));if (ret <0 ) -return SPECTRE_V2_USER_CMD_AUTO ; +return mode;for (i =0 ; i <ARRAY_SIZE (v2_user_options); i++) {if (match_option (arg, ret, v2_user_options[i].option)) {
@@ -1407,8 +1411,8 @@ spectre_v2_parse_user_cmdline(void) } } -pr_err ("Unknown user space protection option (%s). Switching to AUTO select\n" , arg); -return SPECTRE_V2_USER_CMD_AUTO ; +pr_err ("Unknown user space protection option (%s). Switching to default\n" , arg); +return mode; }static inline bool spectre_v2_in_eibrs_mode (enum spectre_v2_mitigation mode)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/207 hwmon: (gpio-fan) Add missing mutex locks
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 9fee7d19bab635f89223cc40dfd2c8797fdc4988 ]
set_fan_speed() is expected to be called with fan_data->lock being locked. Add locking for proper synchronization.
--- drivers/hwmon/gpio-fan.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/hwmon/gpio-fan.c +15 -1
@@ -394,7 +394,12 @@ static int gpio_fan_set_cur_state(struct thermal_cooling_device *cdev,if (state >= fan_data->num_speed)return -EINVAL ; +mutex_lock (&fan_data->lock); +set_fan_speed (fan_data, state); + +mutex_unlock (&fan_data->lock); +return 0 ; }
@@ -490,7 +495,11 @@ MODULE_DEVICE_TABLE(of, of_gpio_fan_match);static void gpio_fan_stop (void *data) { +struct gpio_fan_data *fan_data = data; + +mutex_lock (&fan_data->lock);set_fan_speed (data,0 ); +mutex_unlock (&fan_data->lock); }static int gpio_fan_probe (struct platform_device *pdev)
@@ -564,7 +573,9 @@ static int gpio_fan_suspend(struct device *dev)if (fan_data->gpios) { fan_data->resume_speed = fan_data->speed_index; +mutex_lock (&fan_data->lock);set_fan_speed (fan_data,0 ); +mutex_unlock (&fan_data->lock); }return 0 ;
@@ -574,8 +585,11 @@ static int gpio_fan_resume(struct device *dev) {struct gpio_fan_data *fan_data =dev_get_drvdata (dev); -if (fan_data->gpios) +if (fan_data->gpios) { +mutex_lock (&fan_data->lock);set_fan_speed (fan_data, fan_data->resume_speed); +mutex_unlock (&fan_data->lock); + }return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/207 ARM: at91: pm: fix at91_suspend_finish for ZQ calibration
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Bin <[email protected]>
[ Upstream commit bc4722c3598d0e2c2dbf9609a3d3198993093e2b ]
For sama7g5 and sama7d65 backup mode, we encountered a "ZQ calibrate error" during recalibrating the impedance in BootStrap.
We found that the impedance value saved in at91_suspend_finish() before the DDR entered self-refresh mode did not match the resistor values. The ZDATA field in the DDR3PHY_ZQ0CR0 register uses a modified gray code to select the different impedance setting.
But these gray code are incorrect, a workaournd from design team fixed the bug in the calibration logic. The ZDATA contains four independent impedance elements, but the algorithm combined the four elements into one. The elements were fixed using properly shifted offsets.
--- arch/arm/mach-at91/pm.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
arch/arm/mach-at91/pm.c +11 -10
@@ -350,11 +350,12 @@ extern u32 at91_pm_suspend_in_sram_sz;static int at91_suspend_finish (unsigned long val) { -unsigned char modified_gray_code[] = { -0x00 ,0x01 ,0x02 ,0x03 ,0x06 ,0x07 ,0x04 ,0x05 ,0x0c ,0x0d , -0x0e ,0x0f ,0x0a ,0x0b ,0x08 ,0x09 ,0x18 ,0x19 ,0x1a ,0x1b , -0x1e ,0x1f ,0x1c ,0x1d ,0x14 ,0x15 ,0x16 ,0x17 ,0x12 ,0x13 , -0x10 ,0x11 , +/* SYNOPSYS workaround to fix a bug in the calibration logic */ +unsigned char modified_fix_code[] = { +0x00 ,0x01 ,0x01 ,0x06 ,0x07 ,0x0c ,0x06 ,0x07 ,0x0b ,0x18 , +0x0a ,0x0b ,0x0c ,0x0d ,0x0d ,0x0a ,0x13 ,0x13 ,0x12 ,0x13 , +0x14 ,0x15 ,0x15 ,0x12 ,0x18 ,0x19 ,0x19 ,0x1e ,0x1f ,0x14 , +0x1e ,0x1f , };unsigned int tmp, index;int i;
@@ -365,25 +366,25 @@ static int at91_suspend_finish(unsigned long val)* restore the ZQ0SR0 with the value saved here. But the * calibration is buggy and restoring some values from ZQ0SR0 * is forbidden and risky thus we need to provide processed -* values for these (modified gray code values). +* values for these. */ tmp =readl (soc_pm.data.ramc_phy +DDR3PHY_ZQ0SR0 );/* Store pull-down output impedance select. */ index = (tmp >>DDR3PHY_ZQ0SR0_PDO_OFF ) &0x1f ; - soc_pm.bu->ddr_phy_calibration[0 ] = modified_gray_code[index]; + soc_pm.bu->ddr_phy_calibration[0 ] = modified_fix_code[index] <<DDR3PHY_ZQ0SR0_PDO_OFF ;/* Store pull-up output impedance select. */ index = (tmp >>DDR3PHY_ZQ0SR0_PUO_OFF ) &0x1f ; - soc_pm.bu->ddr_phy_calibration[0 ] |= modified_gray_code[index]; + soc_pm.bu->ddr_phy_calibration[0 ] |= modified_fix_code[index] <<DDR3PHY_ZQ0SR0_PUO_OFF ;/* Store pull-down on-die termination impedance select. */ index = (tmp >>DDR3PHY_ZQ0SR0_PDODT_OFF ) &0x1f ; - soc_pm.bu->ddr_phy_calibration[0 ] |= modified_gray_code[index]; + soc_pm.bu->ddr_phy_calibration[0 ] |= modified_fix_code[index] <<DDR3PHY_ZQ0SR0_PDODT_OFF ;/* Store pull-up on-die termination impedance select. */ index = (tmp >>DDR3PHY_ZQ0SRO_PUODT_OFF ) &0x1f ; - soc_pm.bu->ddr_phy_calibration[0 ] |= modified_gray_code[index]; + soc_pm.bu->ddr_phy_calibration[0 ] |= modified_fix_code[index] <<DDR3PHY_ZQ0SRO_PUODT_OFF ;/* * The 1st 8 words of memory might get corrupted in the process
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/207 drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 8c9da7cd0bbcc90ab444454fecf535320456a312 ]
In preparation for adding support for newer DPI instances which do support direct-pin but do not have any H_FRE_CON register, like the one found in MT8195 and MT8188, add a branch to check if the reg_h_fre_con variable was declared in the mtk_dpi_conf structure for the probed SoC DPI version.
As a note, this is useful specifically only for cases in which the support_direct_pin variable is true, so mt8195-dpintf is not affected by any issue.
--- drivers/gpu/drm/mediatek/mtk_dpi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/mediatek/mtk_dpi.c +3 -2
@@ -346,12 +346,13 @@ static void mtk_dpi_config_swap_input(struct mtk_dpi *dpi, bool enable)static void mtk_dpi_config_2n_h_fre (struct mtk_dpi *dpi) { -mtk_dpi_mask (dpi, dpi->conf->reg_h_fre_con,H_FRE_2N ,H_FRE_2N ); +if (dpi->conf->reg_h_fre_con) +mtk_dpi_mask (dpi, dpi->conf->reg_h_fre_con,H_FRE_2N ,H_FRE_2N ); }static void mtk_dpi_config_disable_edge (struct mtk_dpi *dpi) { -if (dpi->conf->edge_sel_en) +if (dpi->conf->edge_sel_en && dpi->conf->reg_h_fre_con)mtk_dpi_mask (dpi, dpi->conf->reg_h_fre_con,0 ,EDGE_SEL_EN ); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/207 fpga: altera-cvp: Increase credit timeout
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuhanh Murugasen Krishnan <[email protected]>
[ Upstream commit 0f05886a40fdc55016ba4d9ae0a9c41f8312f15b ]
Increase the timeout for SDM (Secure device manager) data credits from 20ms to 40ms. Internal stress tests running at 500 loops failed with the current timeout of 20ms. At the start of a FPGA configuration, the CVP host driver reads the transmit credits from SDM. It then sends bitstream FPGA data to SDM based on the total credits. Each credit allows the CVP host driver to send 4kBytes of data. There are situations whereby, the SDM did not respond in time during testing.
--- drivers/fpga/altera-cvp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/fpga/altera-cvp.c +1 -1
@@ -52,7 +52,7 @@/* V2 Defines */ #define VSE_CVP_TX_CREDITS 0x49/* 8bit */ -#define V2_CREDIT_TIMEOUT_US 20000 +#define V2_CREDIT_TIMEOUT_US 40000#define V2_CHECK_CREDIT_US 10#define V2_POLL_TIMEOUT_US 1000000#define V2_USER_TIMEOUT_US 500000
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/207 PCI: brcmstb: Expand inbound window size up to 64GB
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanimir Varbanov <[email protected]>
[ Upstream commit 25a98c727015638baffcfa236e3f37b70cedcf87 ]
The BCM2712 memory map can support up to 64GB of system memory, thus expand the inbound window size in calculation helper function.
The change is safe for the currently supported SoCs that have smaller inbound window sizes.
--- drivers/pci/controller/pcie-brcmstb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/controller/pcie-brcmstb.c +2 -2
@@ -308,8 +308,8 @@ static int brcm_pcie_encode_ibar_size(u64 size)if (log2_in >=12 && log2_in <=15 )/* Covers 4KB to 32KB (inclusive) */ return (log2_in -12 ) +0x1c ; -else if (log2_in >=16 && log2_in <=35 ) -/* Covers 64KB to 32GB, (inclusive) */ +else if (log2_in >=16 && log2_in <=36 ) +/* Covers 64KB to 64GB, (inclusive) */ return log2_in -15 ;/* Something is awry so disable */ return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/207 PCI: brcmstb: Add a softdep to MIP MSI-X driver
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanimir Varbanov <[email protected]>
[ Upstream commit 2294059118c550464dd8906286324d90c33b152b ]
Then the brcmstb PCIe driver and MIP MSI-X interrupt controller drivers are built as modules there could be a race in probing.
To avoid this, add a softdep to MIP driver to guarantee that MIP driver will be load first.
--- drivers/pci/controller/pcie-brcmstb.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/controller/pcie-brcmstb.c +1 -0
@@ -1352,3 +1352,4 @@ module_platform_driver(brcm_pcie_driver);MODULE_LICENSE ("GPL" );MODULE_DESCRIPTION ("Broadcom STB PCIe RC driver" );MODULE_AUTHOR ("Broadcom" ); +MODULE_SOFTDEP ("pre: irq_bcm2712_mip" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/207 firmware: arm_ffa: Set dma_mask for ffa devices
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <[email protected]>
[ Upstream commit cc0aac7ca17e0ea3ca84b552fc79f3e86fd07f53 ]
Set dma_mask for FFA devices, otherwise DMA allocation using the device pointer lead to following warning:
WARNING: CPU: 1 PID: 1 at kernel/dma/mapping.c:597 dma_alloc_attrs+0xe0/0x124
Message-Id: <e3dd8042ac680bd74b6580c25df855d092079c18.1737107520.git.viresh.kumar@linaro.org>
--- drivers/firmware/arm_ffa/bus.c | 1 + 1 file changed, 1 insertion(+)
drivers/firmware/arm_ffa/bus.c +1 -0
@@ -190,6 +190,7 @@ struct ffa_device *ffa_device_register(const uuid_t *uuid, int vm_id) dev = &ffa_dev->dev; dev->bus = &ffa_bus_type; dev->release = ffa_release_device; + dev->dma_mask = &dev->coherent_dma_mask;dev_set_name (&ffa_dev->dev,"arm-ffa-%d" , id); ffa_dev->id = id;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/207 net/mlx5: Avoid report two health errors on same syndrome
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moshe Shemesh <[email protected]>
[ Upstream commit b5d7b2f04ebcff740f44ef4d295b3401aeb029f4 ]
In case health counter has not increased for few polling intervals, miss counter will reach max misses threshold and health report will be triggered for FW health reporter. In case syndrome found on same health poll another health report will be triggered.
Avoid two health reports on same syndrome by marking this syndrome as already known.
--- drivers/net/ethernet/mellanox/mlx5/core/health.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlx5/core/health.c +1 -0
@@ -737,6 +737,7 @@ static void poll_health(struct timer_list *t) health->prev = count;if (health->miss_counter ==MAX_MISSES ) {mlx5_core_err (dev,"device's health compromised - reached miss count\n" ); + health->synd =ioread8 (&h->synd);print_health_info (dev);queue_work (health->wq, &health->report_work); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/207 selftests/net: have `gro.sh -t` return a correct exit code
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Krakauer <[email protected]>
[ Upstream commit 784e6abd99f24024a8998b5916795f0bec9d2fd9 ]
Modify gro.sh to return a useful exit code when the -t flag is used. It formerly returned 0 no matter what.
Tested: Ran gro.sh -t large and verified that test failures return 1.
--- tools/testing/selftests/net/gro.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/net/gro.sh +2 -1
@@ -95,5 +95,6 @@ trap cleanup EXIT if [[ "${test}" == "all" ]]; then run_all_tests else - run_test "${proto}" "${test}" + exit_code=$(run_test "${proto}" "${test}") + exit $exit_code fi;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 89/207 drm/amdkfd: KFD release_work possible circular locking
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Yang <[email protected]>
[ Upstream commit 1b9366c601039d60546794c63fbb83ce8e53b978 ]
If waiting for gpu reset done in KFD release_work, thers is WARNING:
possible circular locking dependency detected
#2 kfd_create_process
kfd_process_mutex
flush kfd release work
#1 kfd release work
wait for amdgpu reset work
#0 amdgpu_device_gpu_reset
kgd2kfd_pre_reset
kfd_process_mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock((work_completion)(&p->release_work));
lock((wq_completion)kfd_process_wq);
lock((work_completion)(&p->release_work));lock((wq_completion)amdgpu-reset-dev);
To fix this, KFD create process move flush release work outside kfd_process_mutex.
--- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_process.c +8 -8
@@ -807,6 +807,14 @@ struct kfd_process *kfd_create_process(struct file *filep)if (thread->group_leader->mm != thread->mm)return ERR_PTR (-EINVAL ); +/* If the process just called exec(3), it is possible that the +* cleanup of the kfd_process (following the release of the mm +* of the old process image) is still in the cleanup work queue. +* Make sure to drain any job before trying to recreate any +* resource for this process. +*/ +flush_workqueue (kfd_process_wq); +/* * take kfd processes mutex before starting of process creation * so there won't be a case where two threads of the same process
@@ -819,14 +827,6 @@ struct kfd_process *kfd_create_process(struct file *filep)if (process) {pr_debug ("Process already found\n" ); }else { -/* If the process just called exec(3), it is possible that the -* cleanup of the kfd_process (following the release of the mm -* of the old process image) is still in the cleanup work queue. -* Make sure to drain any job before trying to recreate any -* resource for this process. -*/ -flush_workqueue (kfd_process_wq); - process =create_process (thread);if (IS_ERR (process)) goto out;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 90/207 net: xgene-v2: remove incorrect ACPI_PTR annotation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 01358e8fe922f716c05d7864ac2213b2440026e7 ]
Building with W=1 shows a warning about xge_acpi_match being unused when CONFIG_ACPI is disabled:
drivers/net/ethernet/apm/xgene-v2/main.c:723:36: error: unused variable 'xge_acpi_match' [-Werror,-Wunused-const-variable]
--- drivers/net/ethernet/apm/xgene-v2/main.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/ethernet/apm/xgene-v2/main.c +1 -3
@@ -9,8 +9,6 @@#include "main.h" -static const struct acpi_device_id xge_acpi_match[]; -static int xge_get_resources (struct xge_pdata *pdata) {struct platform_device *pdev;
@@ -733,7 +731,7 @@ MODULE_DEVICE_TABLE(acpi, xge_acpi_match);static struct platform_driver xge_driver = { .driver = { .name ="xgene-enet-v2" , - .acpi_match_table =ACPI_PTR (xge_acpi_match), + .acpi_match_table = xge_acpi_match, }, .probe = xge_probe, .remove = xge_remove,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/207 bonding: report duplicate MAC address in all situations
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 28d68d396a1cd21591e8c6d74afbde33a7ea107e ]
Normally, a bond uses the MAC address of the first added slave as the bond’s MAC address. And the bond will set active slave’s MAC address to bond’s address if fail_over_mac is set to none (0) or follow (2).
When the first slave is removed, the bond will still use the removed slave’s MAC address, which can lead to a duplicate MAC address and potentially cause issues with the switch. To avoid confusion, let's warn the user in all situations, including when fail_over_mac is set to 2 or not in active-backup mode.
--- drivers/net/bonding/bond_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/bonding/bond_main.c +1 -1
@@ -2355,7 +2355,7 @@ static int __bond_release_one(struct net_device *bond_dev,RCU_INIT_POINTER (bond->current_arp_slave,NULL ); -if (!all && (!bond->params.fail_over_mac || +if (!all && (bond->params.fail_over_mac !=BOND_FOM_ACTIVE ||BOND_MODE (bond) !=BOND_MODE_ACTIVEBACKUP )) {if (ether_addr_equal_64bits (bond_dev->dev_addr, slave->perm_hwaddr) &&bond_has_slaves (bond))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/207 soc: ti: k3-socinfo: Do not use syscon helper to build regmap
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Davis <[email protected]>
[ Upstream commit a5caf03188e44388e8c618dcbe5fffad1a249385 ]
The syscon helper device_node_to_regmap() is used to fetch a regmap registered to a device node. It also currently creates this regmap if the node did not already have a regmap associated with it. This should only be used on "syscon" nodes. This driver is not such a device and instead uses device_node_to_regmap() on its own node as a hacky way to create a regmap for itself.
This will not work going forward and so we should create our regmap the normal way by defining our regmap_config, fetching our memory resource, then using the normal regmap_init_mmio() function.
--- drivers/soc/ti/k3-socinfo.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/soc/ti/k3-socinfo.c +12 -1
@@ -58,6 +58,12 @@ k3_chipinfo_partno_to_names(unsigned int partno,return -EINVAL ; } +static const struct regmap_config k3_chipinfo_regmap_cfg = { + .reg_bits =32 , + .val_bits =32 , + .reg_stride =4 , +}; +static int k3_chipinfo_probe (struct platform_device *pdev) {struct device_node *node = pdev->dev.of_node;
@@ -65,13 +71,18 @@ static int k3_chipinfo_probe(struct platform_device *pdev)struct device *dev = &pdev->dev;struct soc_device *soc_dev;struct regmap *regmap; +void __iomem *base;u32 partno_id;u32 variant;u32 jtag_id;u32 mfg;int ret; - regmap =device_node_to_regmap (node); + base =devm_platform_ioremap_resource (pdev,0 ); +if (IS_ERR (base)) +return PTR_ERR (base); + + regmap =regmap_init_mmio (dev, base, &k3_chipinfo_regmap_cfg);if (IS_ERR (regmap))return PTR_ERR (regmap);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 93/207 x86/build: Fix broken copy command in genimage.sh when making isoimage
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nir Lichtman <[email protected]>
[ Upstream commit e451630226bd09dc730eedb4e32cab1cc7155ae8 ]
Problem: Currently when running the "make isoimage" command there is an error related to wrong parameters passed to the cp command:
"cp: missing destination file operand after 'arch/x86/boot/isoimage/'"
This is caused because FDINITRDS is an empty array.
Solution: Check if FDINITRDS is empty before executing the "cp" command, similar to how it is done in the case of hdimage.
--- arch/x86/boot/genimage.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/x86/boot/genimage.sh +4 -1
@@ -22,6 +22,7 @@ # This script requires: # bash # syslinux +# genisoimage # mtools (for fdimage* and hdimage) # edk2/OVMF (for hdimage) #
@@ -250,7 +251,9 @@ geniso() { cp "$isolinux" "$ldlinux" "$tmp_dir" cp "$FBZIMAGE" "$tmp_dir"/linux echo default linux "$KCMDLINE" > "$tmp_dir"/isolinux.cfg - cp "${FDINITRDS[@]}" "$tmp_dir"/ + if [ ${#FDINITRDS[@]} -gt 0 ]; then + cp "${FDINITRDS[@]}" "$tmp_dir"/ + fi genisoimage -J -r -appid 'LINUX_BOOT' -input-charset=utf-8 \ -quiet -o "$FIMAGE" -b isolinux.bin \ -c boot.cat -no-emul-boot -boot-load-size 4 \
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 94/207 drm/amd/display: handle max_downscale_src_width fail check
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihan Zhu <[email protected]>
[ Upstream commit 02a940da2ccc0cc0299811379580852b405a0ea2 ]
[WHY]
If max_downscale_src_width check fails, we exit early from TAP calculation and left a NULL value to the scaling data structure to cause the zero divide in the DML validation.
[HOW]
Call set default TAP calculation before early exit in get_optimal_number_of_taps due to max downscale limit exceed.
--- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c +6 -5
@@ -386,11 +386,6 @@ bool dpp3_get_optimal_number_of_taps(int min_taps_y, min_taps_c;enum lb_memory_config lb_config; -if (scl_data->viewport.width > scl_data->h_active && - dpp->ctx->dc->debug.max_downscale_src_width !=0 && - scl_data->viewport.width > dpp->ctx->dc->debug.max_downscale_src_width) -return false; -/* * Set default taps if none are provided * From programming guide: taps = min{ ceil(2*H_RATIO,1), 8} for downscaling
@@ -428,6 +423,12 @@ bool dpp3_get_optimal_number_of_taps(else scl_data->taps.h_taps_c = in_taps->h_taps_c; +// Avoid null data in the scl data with this early return, proceed non-adaptive calcualtion first +if (scl_data->viewport.width > scl_data->h_active && + dpp->ctx->dc->debug.max_downscale_src_width !=0 && + scl_data->viewport.width > dpp->ctx->dc->debug.max_downscale_src_width) +return false; +/*Ensure we can support the requested number of vtaps*/ min_taps_y =dc_fixpt_ceil (scl_data->ratios.vert); min_taps_c =dc_fixpt_ceil (scl_data->ratios.vert_c);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 95/207 x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Waiman Long <[email protected]>
[ Upstream commit fe37c699ae3eed6e02ee55fbf5cb9ceb7fcfd76c ]
Depending on the type of panics, it was found that the __register_nmi_handler() function can be called in NMI context from nmi_shootdown_cpus() leading to a lockdep splat:
WARNING: inconsistent lock state
inconsistent {INITIAL USE} -> {IN-NMI} usage.
lock(&nmi_desc[0].lock);
<Interrupt>
lock(&nmi_desc[0].lock); Call Trace:
_raw_spin_lock_irqsave
__register_nmi_handler
nmi_shootdown_cpus
kdump_nmi_shootdown_cpus
native_machine_crash_shutdown
__crash_kexecIn this particular case, the following panic message was printed before:
Kernel panic - not syncing: Fatal hardware error!
This message seemed to be given out from __ghes_panic() running in NMI context.
The __register_nmi_handler() function which takes the nmi_desc lock with irq disabled shouldn't be called from NMI context as this can lead to deadlock.
The nmi_shootdown_cpus() function can only be invoked once. After the first invocation, all other CPUs should be stuck in the newly added crash_nmi_callback() and cannot respond to a second NMI.
Fix it by adding a new emergency NMI handler to the nmi_desc structure and provide a new set_emergency_nmi_handler() helper to set crash_nmi_callback() in any context. The new emergency handler will preempt other handlers in the linked list. That will eliminate the need to take any lock and serve the panic in NMI use case.
--- arch/x86/include/asm/nmi.h | 2 ++ arch/x86/kernel/nmi.c | 42 ++++++++++++++++++++++++++++++++++++++ arch/x86/kernel/reboot.c | 10 +++------ 3 files changed, 47 insertions(+), 7 deletions(-)
arch/x86/include/asm/nmi.h +2 -0
@@ -58,6 +58,8 @@ int __register_nmi_handler(unsigned int, struct nmiaction *);void unregister_nmi_handler (unsigned int ,const char *); +void set_emergency_nmi_handler (unsigned int type,nmi_handler_t handler); +void stop_nmi (void );void restart_nmi (void );void local_touch_nmi (void );
arch/x86/kernel/nmi.c +42 -0
65 lines not on this page · raw message
arch/x86/kernel/reboot.c +3 -7
@@ -874,15 +874,11 @@ void nmi_shootdown_cpus(nmi_shootdown_cb callback) shootdown_callback = callback;atomic_set (&waiting_for_crash_ipi,num_online_cpus () -1 ); -/* Would it be better to replace the trap vector here? */ -if (register_nmi_handler (NMI_LOCAL , crash_nmi_callback, -NMI_FLAG_FIRST ,"crash" )) -return ;/* Return what? */ +/* -* Ensure the new callback function is set before sending -* out the NMI +* Set emergency handler to preempt other handlers. */ -wmb (); +set_emergency_nmi_handler (NMI_LOCAL , crash_nmi_callback);apic_send_IPI_allbutself (NMI_VECTOR );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 96/207 cpuidle: menu: Avoid discarding useful information
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 85975daeaa4d6ec560bfcd354fc9c08ad7f38888 ]
When giving up on making a high-confidence prediction, get_typical_interval() always returns UINT_MAX which means that the next idle interval prediction will be based entirely on the time till the next timer. However, the information represented by the most recent intervals may not be completely useless in those cases.
Namely, the largest recent idle interval is an upper bound on the recently observed idle duration, so it is reasonable to assume that the next idle duration is unlikely to exceed it. Moreover, this is still true after eliminating the suspected outliers if the sample set still under consideration is at least as large as 50% of the maximum sample set size.
Accordingly, make get_typical_interval() return the current maximum recent interval value in that case instead of UINT_MAX.
--- drivers/cpuidle/governors/menu.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/cpuidle/governors/menu.c +12 -1
@@ -249,8 +249,19 @@ static unsigned int get_typical_interval(struct menu_device *data,* This can deal with workloads that have long pauses interspersed * with sporadic activity with a bunch of short pauses. */ -if ((divisor *4 ) <=INTERVALS *3 ) +if (divisor *4 <=INTERVALS *3 ) { +/* +* If there are sufficiently many data points still under +* consideration after the outliers have been eliminated, +* returning without a prediction would be a mistake because it +* is likely that the next interval will not exceed the current +* maximum, so return the latter in that case. +*/ +if (divisor >=INTERVALS /2 ) +return max; +return UINT_MAX ; + } thresh = max -1 ; goto again;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 97/207 libbpf: Fix out-of-bound read
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nandakumar Edamana <[email protected]>
[ Upstream commit 236d3910117e9f97ebf75e511d8bcc950f1a4e5f ]
In set_kcfg_value_str, an untrusted string is accessed with the assumption that it will be at least two characters long due to the presence of checks for opening and closing quotes. But the check for the closing quote (value[len - 1] != '"') misses the fact that it could be checking the opening quote itself in case of an invalid input that consists of just the opening quote.
This commit adds an explicit check to make sure the string is at least two characters long.
--- tools/lib/bpf/libbpf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/lib/bpf/libbpf.c +1 -1
@@ -1567,7 +1567,7 @@ static int set_kcfg_value_str(struct extern_desc *ext, char *ext_val, } len =strlen (value); -if (value[len -1 ] !='"' ) { +if (len <2 || value[len -1 ] !='"' ) {pr_warn ("extern (kcfg) '%s': invalid string config '%s'\n" , ext->name, value);return -EINVAL ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 98/207 x86/kaslr: Reduce KASLR entropy on most x86 systems
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balbir Singh <[email protected]>
[ Upstream commit 7ffb791423c7c518269a9aad35039ef824a40adb ]
When CONFIG_PCI_P2PDMA=y (which is basically enabled on all large x86 distros), it maps the PFN's via a ZONE_DEVICE mapping using devm_memremap_pages(). The mapped virtual address range corresponds to the pci_resource_start() of the BAR address and size corresponding to the BAR length.
When KASLR is enabled, the direct map range of the kernel is reduced to the size of physical memory plus additional padding. If the BAR address is beyond this limit, PCI peer to peer DMA mappings fail.
Fix this by not shrinking the size of the direct map when CONFIG_PCI_P2PDMA=y.
This reduces the total available entropy, but it's better than the current work around of having to disable KASLR completely.
[ mingo: Clarified the changelog to point out the broad impact ... ]
--
arch/x86/mm/kaslr.c | 10 ++++++++-- drivers/pci/Kconfig | 6 ++++++ 2 files changed, 14 insertions(+), 2 deletions(-)
--- arch/x86/mm/kaslr.c | 10 ++++++++-- drivers/pci/Kconfig | 6 ++++++ 2 files changed, 14 insertions(+), 2 deletions(-)
arch/x86/mm/kaslr.c +8 -2
@@ -96,8 +96,14 @@ void __init kernel_randomize_memory(void) memory_tb =DIV_ROUND_UP (max_pfn <<PAGE_SHIFT ,1UL <<TB_SHIFT ) +CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING ; -/* Adapt physical memory region size based on available memory */ -if (memory_tb < kaslr_regions[0 ].size_tb) +/* +* Adapt physical memory region size based on available memory, +* except when CONFIG_PCI_P2PDMA is enabled. P2PDMA exposes the +* device BAR space assuming the direct map space is large enough +* for creating a ZONE_DEVICE mapping in the direct map corresponding +* to the physical BAR address. +*/ +if (!IS_ENABLED (CONFIG_PCI_P2PDMA ) && (memory_tb < kaslr_regions[0 ].size_tb)) kaslr_regions[0 ].size_tb = memory_tb;/*
drivers/pci/Kconfig +6 -0
@@ -176,6 +176,12 @@ config PCI_P2PDMA P2P DMA transactions must be between devices behind the same root port. + Enabling this option will reduce the entropy of x86 KASLR memory + regions. For example - on a 46 bit system, the entropy goes down + from 16 bits to 15 bits. The actual reduction in entropy depends + on the physical address bits, on processor features, kernel config + (5 level page table) and physical memory present on the system. + If unsure, say N. config PCI_LABEL
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 99/207 MIPS: Use arch specific syscall name match function
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bibo Mao <[email protected]>
[ Upstream commit 756276ce78d5624dc814f9d99f7d16c8fd51076e ]
On MIPS system, most of the syscall function name begin with prefix sys_. Some syscalls are special such as clone/fork, function name of these begin with __sys_. Since scratch registers need be saved in stack when these system calls happens.
With ftrace system call method, system call functions are declared with SYSCALL_DEFINEx, metadata of the system call symbol name begins with sys_. Here mips specific function arch_syscall_match_sym_name is used to compare function name between sys_call_table[] and metadata of syscall symbol.
--- arch/mips/include/asm/ftrace.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
arch/mips/include/asm/ftrace.h +16 -0
@@ -87,4 +87,20 @@ struct dyn_arch_ftrace {#endif /* CONFIG_DYNAMIC_FTRACE */ #endif /* __ASSEMBLY__ */ #endif /* CONFIG_FUNCTION_TRACER */ + +#ifdef CONFIG_FTRACE_SYSCALLS +#ifndef __ASSEMBLY__ +/* +* Some syscall entry functions on mips start with "__sys_" (fork and clone, +* for instance). We should also match the sys_ variant with those. +*/ +#define ARCH_HAS_SYSCALL_MATCH_SYM_NAME +static inline bool arch_syscall_match_sym_name (const char *sym, +const char *name) +{ +return !strcmp (sym, name) || + (!strncmp (sym,"__sys_" ,6 ) && !strcmp (sym +6 , name +4 )); +} +#endif /* __ASSEMBLY__ */ +#endif /* CONFIG_FTRACE_SYSCALLS */ #endif /* _ASM_MIPS_FTRACE_H */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 100/207 MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Burton <[email protected]>
[ Upstream commit 00a134fc2bb4a5f8fada58cf7ff4259149691d64 ]
The pm-cps code has up until now used per-CPU variables indexed by core, rather than CPU number, in order to share data amongst sibling CPUs (ie. VPs/threads in a core). This works fine for single cluster systems, but with multi-cluster systems a core number is no longer unique in the system, leading to sharing between CPUs that are not actually siblings.
Avoid this issue by using per-CPU variables as they are more generally used - ie. access them using CPU numbers rather than core numbers. Sharing between siblings is then accomplished by:
- Assigning the same pointer to entries for each sibling CPU for the nc_asm_enter & ready_count variables, which allow this by virtue of being per-CPU pointers.
- Indexing by the first CPU set in a CPUs cpu_sibling_map in the case of pm_barrier, for which we can't use the previous approach because the per-CPU variable is not a pointer.
--- arch/mips/kernel/pm-cps.c | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-)
arch/mips/kernel/pm-cps.c +17 -13
@@ -56,10 +56,7 @@ static DEFINE_PER_CPU_ALIGNED(u32*, ready_count);/* Indicates online CPUs coupled with the current CPU */ static DEFINE_PER_CPU_ALIGNED(cpumask_t, online_coupled); -/* -* Used to synchronize entry to deep idle states. Actually per-core rather -* than per-CPU. -*/ +/* Used to synchronize entry to deep idle states */ static DEFINE_PER_CPU_ALIGNED(atomic_t, pm_barrier);/* Saved CPU state across the CPS_PM_POWER_GATED state */
@@ -118,9 +115,10 @@ int cps_pm_enter_state(enum cps_pm_state state)cps_nc_entry_fn entry;struct core_boot_config *core_cfg;struct vpe_boot_config *vpe_cfg; +atomic_t *barrier;/* Check that there is an entry function for this state */ - entry =per_cpu (nc_asm_enter, core)[state]; + entry =per_cpu (nc_asm_enter, cpu)[state];if (!entry)return -EINVAL ;
@@ -156,7 +154,7 @@ int cps_pm_enter_state(enum cps_pm_state state)smp_mb__after_atomic ();/* Create a non-coherent mapping of the core ready_count */ - core_ready_count =per_cpu (ready_count, core); + core_ready_count =per_cpu (ready_count, cpu); nc_addr =kmap_noncoherent (virt_to_page (core_ready_count), (unsigned long )core_ready_count); nc_addr += ((unsigned long )core_ready_count & ~PAGE_MASK );
@@ -164,7 +162,8 @@ int cps_pm_enter_state(enum cps_pm_state state)/* Ensure ready_count is zero-initialised before the assembly runs */ WRITE_ONCE (*nc_core_ready_count,0 ); -coupled_barrier (&per_cpu (pm_barrier, core), online); + barrier = &per_cpu (pm_barrier,cpumask_first (&cpu_sibling_map[cpu])); +coupled_barrier (barrier, online);/* Run the generated entry code */ left =entry (online, nc_core_ready_count);
@@ -635,12 +634,14 @@ static void *cps_gen_entry_code(unsigned cpu, enum cps_pm_state state)static int cps_pm_online_cpu (unsigned int cpu) { -enum cps_pm_state state; -unsigned core =cpu_core (&cpu_data[cpu]); +unsigned int sibling, core;void *entry_fn, *core_rc; +enum cps_pm_state state; + + core =cpu_core (&cpu_data[cpu]);for (state =CPS_PM_NC_WAIT ; state <CPS_PM_STATE_COUNT ; state++) { -if (per_cpu (nc_asm_enter, core)[state]) +if (per_cpu (nc_asm_enter, cpu)[state])continue ;if (!test_bit (state, state_support))continue ;
@@ -652,16 +653,19 @@ static int cps_pm_online_cpu(unsigned int cpu)clear_bit (state, state_support); } -per_cpu (nc_asm_enter, core)[state] = entry_fn; +for_each_cpu (sibling, &cpu_sibling_map[cpu]) +per_cpu (nc_asm_enter, sibling)[state] = entry_fn; } -if (!per_cpu (ready_count, core)) { +if (!per_cpu (ready_count, cpu)) { core_rc =kmalloc (sizeof (u32),GFP_KERNEL );if (!core_rc) {pr_err ("Failed allocate core %u ready_count\n" , core);return -ENOMEM ; } -per_cpu (ready_count, core) = core_rc; + +for_each_cpu (sibling, &cpu_sibling_map[cpu]) +per_cpu (ready_count, sibling) = core_rc; }return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 101/207 clocksource: mips-gic-timer: Enable counter when CPUs start
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Burton <[email protected]>
[ Upstream commit 3128b0a2e0cf6e07aa78e5f8cf7dd9cd59dc8174 ]
In multi-cluster MIPS I6500 systems there is a GIC in each cluster, each with its own counter. When a cluster powers up the counter will be stopped, with the COUNTSTOP bit set in the GIC_CONFIG register.
In single cluster systems, it has been fine to clear COUNTSTOP once in gic_clocksource_of_init() to start the counter. In multi-cluster systems, this will only have started the counter in the boot cluster, and any CPUs in other clusters will find their counter stopped which will break the GIC clock_event_device.
Resolve this by having CPUs clear the COUNTSTOP bit when they come online, using the existing gic_starting_cpu() CPU hotplug callback. This will allow CPUs in secondary clusters to ensure that the cluster's GIC counter is running as expected.
--- drivers/clocksource/mips-gic-timer.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/clocksource/mips-gic-timer.c +3 -3
@@ -119,6 +119,9 @@ static void gic_update_frequency(void *data)static int gic_starting_cpu (unsigned int cpu) { +/* Ensure the GIC counter is running */ +clear_gic_config (GIC_CONFIG_COUNTSTOP ); +gic_clockevent_cpu_init (cpu,this_cpu_ptr (&gic_clockevent_device));return 0 ; }
@@ -253,9 +256,6 @@ static int __init gic_clocksource_of_init(struct device_node *node)pr_warn ("Unable to register clock notifier\n" ); } -/* And finally start the counter */ -clear_gic_config (GIC_CONFIG_COUNTSTOP ); -/* * It's safe to use the MIPS GIC timer as a sched clock source only if * its ticks are stable, which is true on either the platforms with
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 102/207 scsi: mpt3sas: Send a diag reset if target reset fails
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shivasharan S <[email protected]>
[ Upstream commit 5612d6d51ed2634a033c95de2edec7449409cbb9 ]
When an IOCTL times out and driver issues a target reset, if firmware fails the task management elevate the recovery by issuing a diag reset to controller.
--- drivers/scsi/mpt3sas/mpt3sas_ctl.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/scsi/mpt3sas/mpt3sas_ctl.c +10 -2
@@ -678,6 +678,7 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg,size_t data_in_sz =0 ;long ret;u16 device_handle =MPT3SAS_INVALID_DEVICE_HANDLE ; +int tm_ret; issue_reset =0 ;
@@ -1111,18 +1112,25 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg,if (pcie_device && (!ioc->tm_custom_handling) && (!(mpt3sas_scsih_is_pcie_scsi_device ( pcie_device->device_info)))) -mpt3sas_scsih_issue_locked_tm (ioc, + tm_ret =mpt3sas_scsih_issue_locked_tm (ioc,le16_to_cpu (mpi_request->FunctionDependent1),0 ,0 ,0 ,MPI2_SCSITASKMGMT_TASKTYPE_TARGET_RESET ,0 ,0 , pcie_device->reset_timeout,MPI26_SCSITASKMGMT_MSGFLAGS_PROTOCOL_LVL_RST_PCIE );else -mpt3sas_scsih_issue_locked_tm (ioc, + tm_ret =mpt3sas_scsih_issue_locked_tm (ioc,le16_to_cpu (mpi_request->FunctionDependent1),0 ,0 ,0 ,MPI2_SCSITASKMGMT_TASKTYPE_TARGET_RESET ,0 ,0 ,30 ,MPI2_SCSITASKMGMT_MSGFLAGS_LINK_RESET ); + +if (tm_ret !=SUCCESS ) { +ioc_info (ioc, +"target reset failed, issue hard reset: handle (0x%04x)\n" , +le16_to_cpu (mpi_request->FunctionDependent1)); +mpt3sas_base_hard_reset_handler (ioc,FORCE_BIG_HAMMER ); + } }else mpt3sas_base_hard_reset_handler (ioc,FORCE_BIG_HAMMER ); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 103/207 wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bitterblue Smith <[email protected]>
[ Upstream commit 6be7544d19fcfcb729495e793bc6181f85bb8949 ]
Set the MCS maps and the highest rates according to the number of spatial streams the chip has. For RTL8814AU that is 3.
--- drivers/net/wireless/realtek/rtw88/main.c | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-)
drivers/net/wireless/realtek/rtw88/main.c +9 -14
@@ -1366,8 +1366,9 @@ static void rtw_init_vht_cap(struct rtw_dev *rtwdev, struct ieee80211_sta_vht_cap *vht_cap) {struct rtw_efuse *efuse = &rtwdev->efuse; -u16 mcs_map; +u16 mcs_map =0 ;__le16 highest; +int i;if (efuse->hw_cap.ptcl !=EFUSE_HW_CAP_IGNORE && efuse->hw_cap.ptcl !=EFUSE_HW_CAP_PTCL_VHT )
@@ -1390,21 +1391,15 @@ static void rtw_init_vht_cap(struct rtw_dev *rtwdev,if (rtw_chip_has_rx_ldpc (rtwdev)) vht_cap->cap |=IEEE80211_VHT_CAP_RXLDPC ; - mcs_map =IEEE80211_VHT_MCS_SUPPORT_0_9 <<0 | -IEEE80211_VHT_MCS_NOT_SUPPORTED <<4 | -IEEE80211_VHT_MCS_NOT_SUPPORTED <<6 | -IEEE80211_VHT_MCS_NOT_SUPPORTED <<8 | -IEEE80211_VHT_MCS_NOT_SUPPORTED <<10 | -IEEE80211_VHT_MCS_NOT_SUPPORTED <<12 | -IEEE80211_VHT_MCS_NOT_SUPPORTED <<14 ; -if (efuse->hw_cap.nss >1 ) { - highest =cpu_to_le16 (780 ); - mcs_map |=IEEE80211_VHT_MCS_SUPPORT_0_9 <<2 ; - }else { - highest =cpu_to_le16 (390 ); - mcs_map |=IEEE80211_VHT_MCS_NOT_SUPPORTED <<2 ; +for (i =0 ; i <8 ; i++) { +if (i < efuse->hw_cap.nss) + mcs_map |=IEEE80211_VHT_MCS_SUPPORT_0_9 << (i *2 ); +else + mcs_map |=IEEE80211_VHT_MCS_NOT_SUPPORTED << (i *2 ); } + highest =cpu_to_le16 (390 * efuse->hw_cap.nss); + vht_cap->vht_mcs.rx_mcs_map =cpu_to_le16 (mcs_map); vht_cap->vht_mcs.tx_mcs_map =cpu_to_le16 (mcs_map); vht_cap->vht_mcs.rx_highest = highest;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 104/207 wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bitterblue Smith <[email protected]>
[ Upstream commit c7eea1ba05ca5b0dbf77a27cf2e1e6e2fb3c0043 ]
Set the RX mask and the highest RX rate according to the number of spatial streams the chip can receive. For RTL8814AU that is 3.
--- drivers/net/wireless/realtek/rtw88/main.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-)
drivers/net/wireless/realtek/rtw88/main.c +6 -11
@@ -1330,6 +1330,7 @@ static void rtw_init_ht_cap(struct rtw_dev *rtwdev, struct ieee80211_sta_ht_cap *ht_cap) {struct rtw_efuse *efuse = &rtwdev->efuse; +int i; ht_cap->ht_supported = true; ht_cap->cap =0 ;
@@ -1349,17 +1350,11 @@ static void rtw_init_ht_cap(struct rtw_dev *rtwdev, ht_cap->ampdu_factor =IEEE80211_HT_MAX_AMPDU_64K ; ht_cap->ampdu_density =IEEE80211_HT_MPDU_DENSITY_16 ; ht_cap->mcs.tx_params =IEEE80211_HT_MCS_TX_DEFINED ; -if (efuse->hw_cap.nss >1 ) { - ht_cap->mcs.rx_mask[0 ] =0xFF ; - ht_cap->mcs.rx_mask[1 ] =0xFF ; - ht_cap->mcs.rx_mask[4 ] =0x01 ; - ht_cap->mcs.rx_highest =cpu_to_le16 (300 ); - }else { - ht_cap->mcs.rx_mask[0 ] =0xFF ; - ht_cap->mcs.rx_mask[1 ] =0x00 ; - ht_cap->mcs.rx_mask[4 ] =0x01 ; - ht_cap->mcs.rx_highest =cpu_to_le16 (150 ); - } + +for (i =0 ; i < efuse->hw_cap.nss; i++) + ht_cap->mcs.rx_mask[i] =0xFF ; + ht_cap->mcs.rx_mask[4 ] =0x01 ; + ht_cap->mcs.rx_highest =cpu_to_le16 (150 * efuse->hw_cap.nss); } static void rtw_init_vht_cap(struct rtw_dev *rtwdev,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 105/207 wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bitterblue Smith <[email protected]>
[ Upstream commit 86d04f8f991a0509e318fe886d5a1cf795736c7d ]
This function translates the rate number reported by the hardware into something mac80211 can understand. It was ignoring the 3SS and 4SS HT rates. Translate them too.
Also set *nss to 0 for the HT rates, just to make sure it's initialised.
--- drivers/net/wireless/realtek/rtw88/util.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtw88/util.c +2 -1
@@ -101,7 +101,8 @@ void rtw_desc_to_mcsrate(u16 rate, u8 *mcs, u8 *nss) *nss =4 ; *mcs = rate -DESC_RATEVHT4SS_MCS0 ; }else if (rate >=DESC_RATEMCS0 && - rate <=DESC_RATEMCS15 ) { + rate <=DESC_RATEMCS31 ) { + *nss =0 ; *mcs = rate -DESC_RATEMCS0 ; } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 106/207 net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Seiderer <[email protected]>
[ Upstream commit 425e64440ad0a2f03bdaf04be0ae53dededbaa77 ]
Honour the user given buffer size for the strn_len() calls (otherwise strn_len() will access memory outside of the user given buffer).
--- net/core/pktgen.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/core/pktgen.c +4 -3
@@ -1876,8 +1876,8 @@ static ssize_t pktgen_thread_write(struct file *file, i = len;/* Read variable name */ - - len =strn_len (&user_buffer[i],sizeof (name) -1 ); + max =min (sizeof (name) -1 , count - i); + len =strn_len (&user_buffer[i], max);if (len <0 )return len;
@@ -1907,7 +1907,8 @@ static ssize_t pktgen_thread_write(struct file *file,if (!strcmp (name,"add_device" )) {char f[32 ];memset (f,0 ,32 ); - len =strn_len (&user_buffer[i],sizeof (f) -1 ); + max =min (sizeof (f) -1 , count - i); + len =strn_len (&user_buffer[i], max);if (len <0 ) { ret = len; goto out;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 107/207 EDAC/ie31200: work around false positive build warning
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit c29dfd661fe2f8d1b48c7f00590929c04b25bf40 ]
gcc-14 produces a bogus warning in some configurations:
drivers/edac/ie31200_edac.c: In function 'ie31200_probe1.isra':drivers/edac/ie31200_edac.c:412:26: error: 'dimm_info' is used uninitialized [-Werror=uninitialized]
412 | struct dimm_data dimm_info[IE31200_CHANNELS][IE31200_DIMMS_PER_CHANNEL];
| ^~~~~~~~~
drivers/edac/ie31200_edac.c:412:26: note: 'dimm_info' declared here
412 | struct dimm_data dimm_info[IE31200_CHANNELS][IE31200_DIMMS_PER_CHANNEL];
| ^~~~~~~~~I don't see any way the unintialized access could really happen here, but I can see why the compiler gets confused by the two loops.
Instead, rework the two nested loops to only read the addr_decode registers and then keep only one instance of the dimm info structure.
[Tony: Qiuxu pointed out that the "populate DIMM info" comment was left behind in the refactor and suggested moving it. I deleted the comment as unnecessry in front os a call to populate_dimm_info(). That seems pretty self-describing.]
--- drivers/edac/ie31200_edac.c | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-)
drivers/edac/ie31200_edac.c +13 -15
@@ -397,10 +397,9 @@ static int ie31200_probe1(struct pci_dev *pdev, int dev_idx)int i, j, ret;struct mem_ctl_info *mci =NULL ;struct edac_mc_layer layers[2 ]; -struct dimm_data dimm_info[IE31200_CHANNELS ][IE31200_DIMMS_PER_CHANNEL ];void __iomem *window;struct ie31200_priv *priv; -u32 addr_decode, mad_offset; +u32 addr_decode[IE31200_CHANNELS ], mad_offset;/* * Kaby Lake, Coffee Lake seem to work like Skylake. Please re-visit
@@ -458,19 +457,10 @@ static int ie31200_probe1(struct pci_dev *pdev, int dev_idx) mad_offset =IE31200_MAD_DIMM_0_OFFSET ; } -/* populate DIMM info */ for (i =0 ; i <IE31200_CHANNELS ; i++) { - addr_decode =readl (window + mad_offset + + addr_decode[i] =readl (window + mad_offset + (i *4 )); -edac_dbg (0 ,"addr_decode: 0x%x\n" , addr_decode); -for (j =0 ; j <IE31200_DIMMS_PER_CHANNEL ; j++) { -populate_dimm_info (&dimm_info[i][j], addr_decode, j, - skl); -edac_dbg (0 ,"size: 0x%x, rank: %d, width: %d\n" , - dimm_info[i][j].size, - dimm_info[i][j].dual_rank, - dimm_info[i][j].x16_width); - } +edac_dbg (0 ,"addr_decode: 0x%x\n" , addr_decode[i]); }/*
@@ -481,14 +471,22 @@ static int ie31200_probe1(struct pci_dev *pdev, int dev_idx)*/ for (i =0 ; i <IE31200_DIMMS_PER_CHANNEL ; i++) {for (j =0 ; j <IE31200_CHANNELS ; j++) { +struct dimm_data dimm_info;struct dimm_info *dimm;unsigned long nr_pages; - nr_pages =IE31200_PAGES (dimm_info[j][i].size, skl); +populate_dimm_info (&dimm_info, addr_decode[j], i, + skl); +edac_dbg (0 ,"size: 0x%x, rank: %d, width: %d\n" , + dimm_info.size, + dimm_info.dual_rank, + dimm_info.x16_width); + + nr_pages =IE31200_PAGES (dimm_info.size, skl);if (nr_pages ==0 )continue ; -if (dimm_info[j][i].dual_rank) { +if (dimm_info.dual_rank) { nr_pages = nr_pages /2 ; dimm =edac_get_dimm (mci, (i *2 ) +1 , j,0 ); dimm->nr_pages = nr_pages;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 108/207 RDMA/core: Fix best page size finding when it can cross SG entries
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Margolin <[email protected]>
[ Upstream commit 486055f5e09df959ad4e3aa4ee75b5c91ddeec2e ]
A single scatter-gather entry is limited by a 32 bits "length" field that is practically 4GB - PAGE_SIZE. This means that even when the memory is physically contiguous, we might need more than one entry to represent it. Additionally when using dmabuf, the sg_table might be originated outside the subsystem and optimized for other needs.
For instance an SGT of 16GB GPU continuous memory might look like this:
(a real life example)
dma_address 34401400000, length fffff000dma_address 345013ff000, length fffff000dma_address 346013fe000, length fffff000dma_address 347013fd000, length fffff000dma_address 348013fc000, length 4000
Since ib_umem_find_best_pgsz works within SG entries, in the above case we will result with the worst possible 4KB page size.
Fix this by taking into consideration only the alignment of addresses of real discontinuity points rather than treating SG entries as such, and adjust the page iterator to correctly handle cross SG entry pages.
There is currently an assumption that drivers do not ask for pages bigger than maximal DMA size supported by their devices.
--- drivers/infiniband/core/umem.c | 36 ++++++++++++++++++++++++--------- drivers/infiniband/core/verbs.c | 11 +++++----- 2 files changed, 32 insertions(+), 15 deletions(-)
drivers/infiniband/core/umem.c +26 -10
@@ -80,9 +80,12 @@ unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, unsigned long pgsz_bitmap, unsigned long virt) { -struct scatterlist *sg; +unsigned long curr_len =0 ; +dma_addr_t curr_base = ~0 ;unsigned long va, pgoff; +struct scatterlist *sg;dma_addr_t mask; +dma_addr_t end;int i; umem->iova = va = virt;
@@ -107,17 +110,30 @@ unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, pgoff = umem->address & ~PAGE_MASK ;for_each_sgtable_dma_sg (&umem->sgt_append.sgt, sg, i) { -/* Walk SGL and reduce max page size if VA/PA bits differ -* for any address. +/* If the current entry is physically contiguous with the previous +* one, no need to take its start addresses into consideration. */ - mask |= (sg_dma_address (sg) + pgoff) ^ va; +if (check_add_overflow (curr_base, curr_len, &end) || + end !=sg_dma_address (sg)) { + + curr_base =sg_dma_address (sg); + curr_len =0 ; + +/* Reduce max page size if VA/PA bits differ */ + mask |= (curr_base + pgoff) ^ va; + +/* The alignment of any VA matching a discontinuity point +* in the physical memory sets the maximum possible page +* size as this must be a starting point of a new page that +* needs to be aligned. +*/ +if (i !=0 ) + mask |= va; + } + + curr_len +=sg_dma_len (sg); va +=sg_dma_len (sg) - pgoff; -/* Except for the last entry, the ending iova alignment sets -* the maximum possible page size as the low bits of the iova -* must be zero when starting the next chunk. -*/ -if (i != (umem->sgt_append.sgt.nents -1 )) - mask |= va; + pgoff =0 ; }
drivers/infiniband/core/verbs.c +6 -5
@@ -2967,22 +2967,23 @@ EXPORT_SYMBOL(__rdma_block_iter_start);bool __rdma_block_iter_next (struct ib_block_iter *biter) {unsigned int block_offset; -unsigned int sg_delta; +unsigned int delta;if (!biter->__sg_nents || !biter->__sg)return false; biter->__dma_addr =sg_dma_address (biter->__sg) + biter->__sg_advance; block_offset = biter->__dma_addr & (BIT_ULL (biter->__pg_bit) -1 ); - sg_delta =BIT_ULL (biter->__pg_bit) - block_offset; + delta =BIT_ULL (biter->__pg_bit) - block_offset; -if (sg_dma_len (biter->__sg) - biter->__sg_advance > sg_delta) { - biter->__sg_advance += sg_delta; - }else { +while (biter->__sg_nents && biter->__sg && +sg_dma_len (biter->__sg) - biter->__sg_advance <= delta) { + delta -=sg_dma_len (biter->__sg) - biter->__sg_advance; biter->__sg_advance =0 ; biter->__sg =sg_next (biter->__sg); biter->__sg_nents--; } + biter->__sg_advance += delta;return true; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 109/207 can: c_can: Use of_property_present() to test existence of DT property
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit ab1bc2290fd8311d49b87c29f1eb123fcb581bee ]
of_property_read_bool() should be used only on boolean properties.
--- drivers/net/can/c_can/c_can_platform.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/c_can/c_can_platform.c +1 -1
@@ -334,7 +334,7 @@ static int c_can_plat_probe(struct platform_device *pdev)/* Check if we need custom RAMINIT via syscon. Mostly for TI * platforms. Only supported with DT boot. */ -if (np &&of_property_read_bool (np,"syscon-raminit" )) { +if (np &&of_property_present (np,"syscon-raminit" )) {u32 id;struct c_can_raminit *raminit = &priv->raminit_sys;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 110/207 eth: mlx4: dont try to complete XDP frames in netpoll
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 8fdeafd66edaf420ea0063a1f13442fe3470fe70 ]
mlx4 doesn't support ndo_xdp_xmit / XDP_REDIRECT and wasn't using page pool until now, so it could run XDP completions in netpoll (NAPI budget == 0) just fine. Page pool has calling context requirements, make sure we don't try to call it from what is potentially HW IRQ context.
--- drivers/net/ethernet/mellanox/mlx4/en_tx.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/mellanox/mlx4/en_tx.c +2 -0
@@ -445,6 +445,8 @@ int mlx4_en_process_tx_cq(struct net_device *dev,if (unlikely (!priv->port_up))return 0 ; +if (unlikely (!napi_budget) && cq->type ==TX_XDP ) +return 0 ;netdev_txq_bql_complete_prefetchw (ring->tx_queue);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 111/207 PCI: Fix old_size lower bound in calculate_iosize() too
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit ff61f380de5652e723168341480cc7adf1dd6213 ]
Commit 903534fa7d30 ("PCI: Fix resource double counting on remove & rescan") fixed double counting of mem resources because of old_size being applied too early.
Fix a similar counting bug on the io resource side.
--- drivers/pci/setup-bus.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/pci/setup-bus.c +2 -4
@@ -806,11 +806,9 @@ static resource_size_t calculate_iosize(resource_size_t size, size = (size &0xff ) + ((size & ~0xffUL ) <<2 );#endif size = size + size1; -if (size < old_size) - size = old_size; - size =ALIGN (max (size, add_size) + children_add_size, align); -return size; + size =max (size, add_size) + children_add_size; +return ALIGN (max (size, old_size), align); } static resource_size_t calculate_memsize(resource_size_t size,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 112/207 ACPI: HED: Always initialize before evged
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaofei Tan <[email protected]>
[ Upstream commit cccf6ee090c8c133072d5d5b52ae25f3bc907a16 ]
When the HED driver is built-in, it initializes after evged because they both are at the same initcall level, so the initialization ordering depends on the Makefile order. However, this prevents RAS records coming in between the evged driver initialization and the HED driver initialization from being handled.
If the number of such RAS records is above the APEI HEST error source number, the HEST resources may be exhausted, and that may affect subsequent RAS error reporting.
To fix this issue, change the initcall level of HED to subsys_initcall and prevent the driver from being built as a module by changing ACPI_HED in Kconfig from "tristate" to "bool".
--- drivers/acpi/Kconfig | 2 +- drivers/acpi/hed.c | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-)
drivers/acpi/Kconfig +1 -1
@@ -437,7 +437,7 @@ config ACPI_SBS the modules will be called sbs and sbshc. config ACPI_HED - tristate "Hardware Error Device" + bool "Hardware Error Device" help This driver supports the Hardware Error Device (PNP0C33), which is used to report some hardware errors notified via
drivers/acpi/hed.c +6 -1
@@ -72,7 +72,12 @@ static struct acpi_driver acpi_hed_driver = { .notify = acpi_hed_notify, }, }; -module_acpi_driver (acpi_hed_driver); + +static int __init acpi_hed_driver_init (void ) +{ +return acpi_bus_register_driver (&acpi_hed_driver); +} +subsys_initcall (acpi_hed_driver_init);MODULE_AUTHOR ("Huang Ying" );MODULE_DESCRIPTION ("ACPI Hardware Error Device Driver" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 113/207 net/mlx5: Modify LSB bitmask in temperature event to include only the first bit
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shahar Shitrit <[email protected]>
[ Upstream commit 633f16d7e07c129a36b882c05379e01ce5bdb542 ]
In the sensor_count field of the MTEWE register, bits 1-62 are supported only for unmanaged switches, not for NICs, and bit 63 is reserved for internal use.
To prevent confusing output that may include set bits that are not relevant to NIC sensors, we update the bitmask to retain only the first bit, which corresponds to the sensor ASIC.
--- drivers/net/ethernet/mellanox/mlx5/core/events.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/events.c +4 -0
@@ -160,6 +160,10 @@ static int temp_warn(struct notifier_block *nb, unsigned long type, void *data)u64 value_msb; value_lsb =be64_to_cpu (eqe->data.temp_warning.sensor_warning_lsb); +/* bit 1-63 are not supported for NICs, +* hence read only bit 0 (asic) from lsb. +*/ + value_lsb &=0x1 ; value_msb =be64_to_cpu (eqe->data.temp_warning.sensor_warning_msb); mlx5_core_warn(events->dev,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 114/207 net/mlx5: Apply rate-limiting to high temperature warning
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shahar Shitrit <[email protected]>
[ Upstream commit 9dd3d5d258aceb37bdf09c8b91fa448f58ea81f0 ]
Wrap the high temperature warning in a temperature event with a call to net_ratelimit() to prevent flooding the kernel log with repeated warning messages when temperature exceeds the threshold multiple times within a short duration.
--- drivers/net/ethernet/mellanox/mlx5/core/events.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/events.c +4 -3
@@ -166,9 +166,10 @@ static int temp_warn(struct notifier_block *nb, unsigned long type, void *data) value_lsb &=0x1 ; value_msb =be64_to_cpu (eqe->data.temp_warning.sensor_warning_msb); -mlx5_core_warn (events->dev, -"High temperature on sensors with bit set %llx %llx" , - value_msb, value_lsb); +if (net_ratelimit ()) +mlx5_core_warn (events->dev, +"High temperature on sensors with bit set %llx %llx" , + value_msb, value_lsb);return NOTIFY_OK ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 115/207 ASoC: ops: Enforce platform maximum on initial value
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Povišer <[email protected]>
[ Upstream commit 783db6851c1821d8b983ffb12b99c279ff64f2ee ]
Lower the volume if it is violating the platform maximum at its initial value (i.e. at the time of the 'snd_soc_limit_volume' call).
--- sound/soc/soc-ops.c | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-)
sound/soc/soc-ops.c +28 -1
@@ -621,6 +621,33 @@ int snd_soc_get_volsw_range(struct snd_kcontrol *kcontrol, }EXPORT_SYMBOL_GPL (snd_soc_get_volsw_range); +static int snd_soc_clip_to_platform_max (struct snd_kcontrol *kctl) +{ +struct soc_mixer_control *mc = (struct soc_mixer_control *)kctl->private_value; +struct snd_ctl_elem_value uctl; +int ret; + +if (!mc->platform_max) +return 0 ; + + ret = kctl->get (kctl, &uctl); +if (ret <0 ) +return ret; + +if (uctl.value.integer.value[0 ] > mc->platform_max) + uctl.value.integer.value[0 ] = mc->platform_max; + +if (snd_soc_volsw_is_stereo (mc) && + uctl.value.integer.value[1 ] > mc->platform_max) + uctl.value.integer.value[1 ] = mc->platform_max; + + ret = kctl->put (kctl, &uctl); +if (ret <0 ) +return ret; + +return 0 ; +} +/** * snd_soc_limit_volume - Set new limit to an existing volume control. *
@@ -645,7 +672,7 @@ int snd_soc_limit_volume(struct snd_soc_card *card,struct soc_mixer_control *mc = (struct soc_mixer_control *)kctl->private_value;if (max <= mc->max - mc->min) { mc->platform_max = max; - ret =0 ; + ret =snd_soc_clip_to_platform_max (kctl); } }return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 116/207 ASoC: tas2764: Power up/down amp on mute ops
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hector Martin <[email protected]>
[ Upstream commit 1c3b5f37409682184669457a5bdf761268eafbe5 ]
The ASoC convention is that clocks are removed after codec mute, and power up/down is more about top level power management. For these chips, the "mute" state still expects a TDM clock, and yanking the clock in this state will trigger clock errors. So, do the full shutdown<->mute<->active transition on the mute operation, so the amp is in software shutdown by the time the clocks are removed.
This fixes TDM clock errors when streams are stopped.
--- sound/soc/codecs/tas2764.c | 51 ++++++++++++++++---------------------- 1 file changed, 21 insertions(+), 30 deletions(-)
sound/soc/codecs/tas2764.c +21 -30
@@ -130,33 +130,6 @@ static SOC_ENUM_SINGLE_DECL(static const struct snd_kcontrol_new tas2764_asi1_mux =SOC_DAPM_ENUM ("ASI1 Source" , tas2764_ASI1_src_enum); -static int tas2764_dac_event (struct snd_soc_dapm_widget *w, -struct snd_kcontrol *kcontrol,int event) -{ -struct snd_soc_component *component =snd_soc_dapm_to_component (w->dapm); -struct tas2764_priv *tas2764 =snd_soc_component_get_drvdata (component); -int ret; - -switch (event) { -case SND_SOC_DAPM_POST_PMU : - tas2764->dac_powered = true; - ret =tas2764_update_pwr_ctrl (tas2764); -break ; -case SND_SOC_DAPM_PRE_PMD : - tas2764->dac_powered = false; - ret =tas2764_update_pwr_ctrl (tas2764); -break ; -default : -dev_err (tas2764->dev,"Unsupported event\n" ); -return -EINVAL ; - } - -if (ret <0 ) -return ret; - -return 0 ; -} -static const struct snd_kcontrol_new isense_switch =SOC_DAPM_SINGLE ("Switch" ,TAS2764_PWR_CTRL ,TAS2764_ISENSE_POWER_EN ,1 ,1 ); static const struct snd_kcontrol_new vsense_switch =
@@ -169,8 +142,7 @@ static const struct snd_soc_dapm_widget tas2764_dapm_widgets[] = { 1, &isense_switch),SND_SOC_DAPM_SWITCH ("VSENSE" ,TAS2764_PWR_CTRL ,TAS2764_VSENSE_POWER_EN ,1 , &vsense_switch), -SND_SOC_DAPM_DAC_E ("DAC" ,NULL ,SND_SOC_NOPM ,0 ,0 , tas2764_dac_event, -SND_SOC_DAPM_POST_PMU |SND_SOC_DAPM_PRE_PMD ), +SND_SOC_DAPM_DAC ("DAC" ,NULL ,SND_SOC_NOPM ,0 ,0 ),SND_SOC_DAPM_OUTPUT ("OUT" ),SND_SOC_DAPM_SIGGEN ("VMON" ),SND_SOC_DAPM_SIGGEN ("IMON" )
@@ -191,9 +163,28 @@ static int tas2764_mute(struct snd_soc_dai *dai, int mute, int direction) {struct tas2764_priv *tas2764 =snd_soc_component_get_drvdata (dai->component); +int ret; + +if (!mute) { + tas2764->dac_powered = true; + ret =tas2764_update_pwr_ctrl (tas2764); +if (ret) +return ret; + } tas2764->unmuted = !mute; -return tas2764_update_pwr_ctrl (tas2764); + ret =tas2764_update_pwr_ctrl (tas2764); +if (ret) +return ret; + +if (mute) { + tas2764->dac_powered = false; + ret =tas2764_update_pwr_ctrl (tas2764); +if (ret) +return ret; + } + +return 0 ; }static int tas2764_set_bitwidth (struct tas2764_priv *tas2764,int bitwidth)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 117/207 ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <[email protected]>
[ Upstream commit 7f1186a8d738661b941b298fd6d1d5725ed71428 ]
snd_soc_dai_set_tdm_slot() calls .xlate_tdm_slot_mask() or snd_soc_xlate_tdm_slot_mask(), but didn't check its return value. Let's check it.
This patch might break existing driver. In such case, let's makes each func to void instead of int.
--- sound/soc/soc-dai.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
sound/soc/soc-dai.c +5 -3
@@ -271,10 +271,11 @@ int snd_soc_dai_set_tdm_slot(struct snd_soc_dai *dai,if (dai->driver->ops && dai->driver->ops->xlate_tdm_slot_mask) - dai->driver->ops->xlate_tdm_slot_mask (slots, - &tx_mask, &rx_mask); + ret = dai->driver->ops->xlate_tdm_slot_mask (slots, &tx_mask, &rx_mask);else -snd_soc_xlate_tdm_slot_mask (slots, &tx_mask, &rx_mask); + ret =snd_soc_xlate_tdm_slot_mask (slots, &tx_mask, &rx_mask); +if (ret) + goto err; dai->tx_mask = tx_mask; dai->rx_mask = rx_mask;
@@ -283,6 +284,7 @@ int snd_soc_dai_set_tdm_slot(struct snd_soc_dai *dai, dai->driver->ops->set_tdm_slot) ret = dai->driver->ops->set_tdm_slot (dai, tx_mask, rx_mask, slots, slot_width); +err:return soc_dai_ret (dai, ret); }EXPORT_SYMBOL_GPL (snd_soc_dai_set_tdm_slot);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 118/207 pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Valentin Caron <[email protected]>
[ Upstream commit c98868e816209e568c9d72023ba0bc1e4d96e611 ]
Cross case in pinctrl framework make impossible to an hogged pin and another, not hogged, used within the same device-tree node. For example with this simplified device-tree :
&pinctrl {
pinctrl_pin_1: pinctrl-pin-1 {
pins = "dummy-pinctrl-pin";
};
};
&rtc {
pinctrl-names = "default"
pinctrl-0 = <&pinctrl_pin_1 &rtc_pin_1> rtc_pin_1: rtc-pin-1 {
pins = "dummy-rtc-pin";
};};
"pinctrl_pin_1" configuration is never set. This produces this path in the code:
really_probe()
pinctrl_bind_pins()
| devm_pinctrl_get()
| pinctrl_get()
| create_pinctrl()
| pinctrl_dt_to_map()
| // Hog pin create an abort for all pins of the node
| ret = dt_to_map_one_config()
| | /* Do not defer probing of hogs (circular loop) */
| | if (np_pctldev == p->dev->of_node)
| | return -ENODEV;
| if (ret)
| goto err
|
call_driver_probe()
stm32_rtc_probe()
pinctrl_enable()
pinctrl_claim_hogs()
create_pinctrl()
for_each_maps(maps_node, i, map)
// Not hog pin is skipped
if (pctldev && strcmp(dev_name(pctldev->dev),
map->ctrl_dev_name))
continue;At the first call of create_pinctrl() the hogged pin produces an abort to avoid a defer of hogged pins. All other pin configurations are trashed.
At the second call, create_pinctrl is now called with pctldev parameter to get hogs, but in this context only hogs are set. And other pins are skipped.
To handle this, do not produce an abort in the first call of create_pinctrl(). Classic pin configuration will be set in pinctrl_bind_pins() context. And the hogged pin configuration will be set in pinctrl_claim_hogs() context.
--- drivers/pinctrl/devicetree.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/pinctrl/devicetree.c +8 -2
@@ -143,10 +143,14 @@ static int dt_to_map_one_config(struct pinctrl *p, pctldev =get_pinctrl_dev_from_of_node (np_pctldev);if (pctldev)break ; -/* Do not defer probing of hogs (circular loop) */ +/* +* Do not defer probing of hogs (circular loop) +* +* Return 1 to let the caller catch the case. +*/ if (np_pctldev == p->dev->of_node) {of_node_put (np_pctldev); -return -ENODEV ; +return 1 ; } }of_node_put (np_pctldev);
@@ -265,6 +269,8 @@ int pinctrl_dt_to_map(struct pinctrl *p, struct pinctrl_dev *pctldev) ret =dt_to_map_one_config (p, pctldev, statename, np_config);of_node_put (np_config); +if (ret ==1 ) +continue ;if (ret <0 ) goto err; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 119/207 smack: recognize ipv4 CIPSO w/o categories
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Andreev <[email protected]>
[ Upstream commit a158a937d864d0034fea14913c1f09c6d5f574b8 ]
If SMACK label has CIPSO representation w/o categories, e.g.:
| # cat /smack/cipso2 | foo 10 | @ 250/2 | ...
then SMACK does not recognize such CIPSO in input ipv4 packets and substitues '*' label instead. Audit records may look like
| lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied
| subject="*" object="_" requested=w pid=0 comm="swapper/1" ...
This happens in two steps:
1) security/smack/smackfs.c`smk_set_cipso does not clear NETLBL_SECATTR_MLS_CAT
from (struct smack_known *)skp->smk_netlabel.flags on assigning CIPSO w/o categories:
| rcu_assign_pointer(skp->smk_netlabel.attr.mls.cat, ncats.attr.mls.cat); | skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl;
2) security/smack/smack_lsm.c`smack_from_secattr
can not match skp->smk_netlabel with input packet's struct netlbl_lsm_secattr *sap
because sap->flags have not NETLBL_SECATTR_MLS_CAT (what is correct) but skp->smk_netlabel.flags have (what is incorrect):
| if ((sap->flags & NETLBL_SECATTR_MLS_CAT) == 0) {
| if ((skp->smk_netlabel.flags &
| NETLBL_SECATTR_MLS_CAT) == 0)
| found = 1;
| break;
| }This commit sets/clears NETLBL_SECATTR_MLS_CAT in skp->smk_netlabel.flags according to the presense of CIPSO categories. The update of smk_netlabel is not atomic, so input packets processing still may be incorrect during short time while update proceeds.
--- security/smack/smackfs.c | 4 ++++ 1 file changed, 4 insertions(+)
security/smack/smackfs.c +4 -0
@@ -921,6 +921,10 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,if (rc >=0 ) { old_cat = skp->smk_netlabel.attr.mls.cat;rcu_assign_pointer (skp->smk_netlabel.attr.mls.cat, ncats.attr.mls.cat); +if (ncats.attr.mls.cat) + skp->smk_netlabel.flags |=NETLBL_SECATTR_MLS_CAT ; +else + skp->smk_netlabel.flags &= ~(u32 )NETLBL_SECATTR_MLS_CAT ; skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl;synchronize_rcu ();netlbl_catmap_free (old_cat);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 120/207 media: v4l: Memset argument to 0 before calling get_mbus_config pad op
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
[ Upstream commit 91d6a99acfa5ce9f95ede775074b80f7193bd717 ]
Memset the config argument to get_mbus_config V4L2 sub-device pad operation to zero before calling the operation. This ensures the callers don't need to bother with it nor the implementations need to set all fields that may not be relevant to them.
--- drivers/media/v4l2-core/v4l2-subdev.c | 2 ++ include/media/v4l2-subdev.h | 4 +++- 2 files changed, 5 insertions(+), 1 deletion(-)
drivers/media/v4l2-core/v4l2-subdev.c +2 -0
@@ -314,6 +314,8 @@ static int call_enum_dv_timings(struct v4l2_subdev *sd,static int call_get_mbus_config (struct v4l2_subdev *sd,unsigned int pad,struct v4l2_mbus_config *config) { +memset (config,0 ,sizeof (*config)); +return check_pad (sd, pad) ? : sd->ops->pad->get_mbus_config (sd, pad, config); }
include/media/v4l2-subdev.h +3 -1
@@ -714,7 +714,9 @@ struct v4l2_subdev_state {* possible configuration from the remote end, likely calling * this operation as close as possible to stream on time. The * operation shall fail if the pad index it has been called on -* is not valid or in case of unrecoverable failures. +* is not valid or in case of unrecoverable failures. The +* config argument has been memset to 0 just before calling +* the op. * * @set_mbus_config: set the media bus configuration of a remote sub-device. * This operations is intended to allow, in combination with
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 121/207 net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 4a6f18f28627e121bd1f74b5fcc9f945d6dbeb1e ]
GCC can see that the value range for "order" is capped, but this leads it to consider that it might be negative, leading to a false positive warning (with GCC 15 with -Warray-bounds -fdiagnostics-details):
../drivers/net/ethernet/mellanox/mlx4/alloc.c:691:47: error: array subscript -1 is below array bounds of 'long unsigned int *[2]' [-Werror=array-bounds=]
691 | i = find_first_bit(pgdir->bits[o], MLX4_DB_PER_PAGE >> o);
| ~~~~~~~~~~~^~~
'mlx4_alloc_db_from_pgdir': events 1-2
691 | i = find_first_bit(pgdir->bits[o], MLX4_DB_PER_PAGE >> o); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | | | | (2) out of array bounds here
| (1) when the condition is evaluated to true In file included from ../drivers/net/ethernet/mellanox/mlx4/mlx4.h:53,
from ../drivers/net/ethernet/mellanox/mlx4/alloc.c:42:../include/linux/mlx4/device.h:664:33: note: while referencing 'bits'
664 | unsigned long *bits[2];
| ^~~~
Switch the argument to unsigned int, which removes the compiler needing to consider negative values.
--- drivers/net/ethernet/mellanox/mlx4/alloc.c | 6 +++--- include/linux/mlx4/device.h | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/mellanox/mlx4/alloc.c +3 -3
@@ -682,9 +682,9 @@ static struct mlx4_db_pgdir *mlx4_alloc_db_pgdir(struct device *dma_device) }static int mlx4_alloc_db_from_pgdir (struct mlx4_db_pgdir *pgdir, -struct mlx4_db *db,int order) +struct mlx4_db *db,unsigned int order) { -int o; +unsigned int o;int i;for (o = order; o <=1 ; ++o) {
@@ -712,7 +712,7 @@ static int mlx4_alloc_db_from_pgdir(struct mlx4_db_pgdir *pgdir,return 0 ; } -int mlx4_db_alloc (struct mlx4_dev *dev,struct mlx4_db *db,int order) +int mlx4_db_alloc (struct mlx4_dev *dev,struct mlx4_db *db,unsigned int order) {struct mlx4_priv *priv =mlx4_priv (dev);struct mlx4_db_pgdir *pgdir;
include/linux/mlx4/device.h +1 -1
@@ -1115,7 +1115,7 @@ int mlx4_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt,int mlx4_buf_write_mtt (struct mlx4_dev *dev,struct mlx4_mtt *mtt,struct mlx4_buf *buf); -int mlx4_db_alloc (struct mlx4_dev *dev,struct mlx4_db *db,int order); +int mlx4_db_alloc (struct mlx4_dev *dev,struct mlx4_db *db,unsigned int order);void mlx4_db_free (struct mlx4_dev *dev,struct mlx4_db *db); int mlx4_alloc_hwq_res(struct mlx4_dev *dev, struct mlx4_hwq_resources *wqres,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 122/207 phy: core: dont require set_mode() callback for phy_get_mode() to work
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit d58c04e305afbaa9dda7969151f06c4efe2c98b0 ]
As reported by Damon Ding, the phy_get_mode() call doesn't work as expected unless the PHY driver has a .set_mode() call. This prompts PHY drivers to have empty stubs for .set_mode() for the sake of being able to get the mode.
Make .set_mode() callback truly optional and update PHY's mode even if it there is none.
--- drivers/phy/phy-core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/phy/phy-core.c +4 -3
@@ -360,13 +360,14 @@ EXPORT_SYMBOL_GPL(phy_power_off);int phy_set_mode_ext (struct phy *phy,enum phy_mode mode,int submode) { -int ret; +int ret =0 ; -if (!phy || !phy->ops->set_mode) +if (!phy)return 0 ;mutex_lock (&phy->mutex); - ret = phy->ops->set_mode (phy, mode, submode); +if (phy->ops->set_mode) + ret = phy->ops->set_mode (phy, mode, submode);if (!ret) phy->attrs.mode = mode;mutex_unlock (&phy->mutex);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 123/207 drm/amdgpu: reset psp->cmd to NULL after releasing the buffer
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiang Liu <[email protected]>
[ Upstream commit e92f3f94cad24154fd3baae30c6dfb918492278d ]
Reset psp->cmd to NULL after releasing the buffer in function psp_sw_fini().
--- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +2 -3
@@ -353,7 +353,6 @@ static int psp_sw_fini(void *handle) {struct amdgpu_device *adev = (struct amdgpu_device *)handle;struct psp_context *psp = &adev->psp; -struct psp_gfx_cmd_resp *cmd = psp->cmd;psp_memory_training_fini (psp);if (psp->sos_fw) {
@@ -373,8 +372,8 @@ static int psp_sw_fini(void *handle) adev->asic_type == CHIP_SIENNA_CICHLID)psp_sysfs_fini (adev); -kfree (cmd); - cmd =NULL ; +kfree (psp->cmd); + psp->cmd =NULL ;amdgpu_bo_free_kernel (&psp->fw_pri_bo, &psp->fw_pri_mc_addr, &psp->fw_pri_buf);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 124/207 drm/amd/display: Initial psr_version with correct setting
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Chung <[email protected]>
[ Upstream commit d8c782cac5007e68e7484d420168f12d3490def6 ]
[Why & How]
The initial setting for psr_version is not correct while create a virtual link.
The default psr_version should be DC_PSR_VERSION_UNSUPPORTED.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/display/dc/core/dc.c +1 -0
@@ -248,6 +248,7 @@ static bool create_links( link->link_id.type =OBJECT_TYPE_CONNECTOR ; link->link_id.id =CONNECTOR_ID_VIRTUAL ; link->link_id.enum_id =ENUM_ID_1 ; + link->psr_settings.psr_version =DC_PSR_VERSION_UNSUPPORTED ; link->link_enc =kzalloc (sizeof (*link->link_enc),GFP_KERNEL );if (!link->link_enc) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 125/207 net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Lazar <[email protected]>
[ Upstream commit 95b9606b15bb3ce1198d28d2393dd0e1f0a5f3e9 ]
Current loopback test validation ignores non-linear SKB case in the SKB access, which can lead to failures in scenarios such as when HW GRO is enabled.
Linearize the SKB so both cases will be handled.
--- drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c +3 -0
@@ -188,6 +188,9 @@ mlx5e_test_loopback_validate(struct sk_buff *skb,struct udphdr *udph;struct iphdr *iph; +if (skb_linearize (skb)) + goto out; +/* We are only going to peek, no need to clone the SKB */ if (MLX5E_TEST_PKT_SIZE -ETH_HLEN >skb_headlen (skb)) goto out;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 126/207 net/mlx5e: set the tx_queue_len for pfifo_fast
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Tu <[email protected]>
[ Upstream commit a38cc5706fb9f7dc4ee3a443f61de13ce1e410ed ]
By default, the mq netdev creates a pfifo_fast qdisc. On a system with 16 core, the pfifo_fast with 3 bands consumes 16 * 3 * 8 (size of pointer) * 1024 (default tx queue len) = 393KB. The patch sets the tx qlen to representor default value, 128 (1<<MLX5E_REP_PARAMS_DEF_LOG_SQ_SIZE), which consumes 16 * 3 * 8 * 128 = 49KB, saving 344KB for each representor at ECPF.
--- drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +2 -0
@@ -642,6 +642,8 @@ static void mlx5e_build_rep_netdev(struct net_device *netdev, netdev->ethtool_ops = &mlx5e_rep_ethtool_ops; netdev->watchdog_timeo =15 *HZ ; +if (mlx5_core_is_ecpf (mdev)) + netdev->tx_queue_len =1 <<MLX5E_REP_PARAMS_DEF_LOG_SQ_SIZE ;#if IS_ENABLED (CONFIG_MLX5_CLS_ACT ) netdev->hw_features |=NETIF_F_HW_TC ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 127/207 net/mlx5e: reduce rep rxq depth to 256 for ECPF
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Tu <[email protected]>
[ Upstream commit b9cc8f9d700867aaa77aedddfea85e53d5e5d584 ]
By experiments, a single queue representor netdev consumes kernel memory around 2.8MB, and 1.8MB out of the 2.8MB is due to page pool for the RXQ. Scaling to a thousand representors consumes 2.8GB, which becomes a memory pressure issue for embedded devices such as BlueField-2 16GB / BlueField-3 32GB memory.
Since representor netdevs mostly handles miss traffic, and ideally, most of the traffic will be offloaded, reduce the default non-uplink rep netdev's RXQ default depth from 1024 to 256 if mdev is ecpf eswitch manager. This saves around 1MB of memory per regular RQ, (1024 - 256) * 2KB, allocated from page pool.
With rxq depth of 256, the netlink page pool tool reports $./tools/net/ynl/cli.py --spec Documentation/netlink/specs/netdev.yaml \
--dump page-pool-get
{'id': 277,
'ifindex': 9,
'inflight': 128,
'inflight-mem': 786432,
'napi-id': 775}]
This is due to mtu 1500 + headroom consumes half pages, so 256 rxq entries consumes around 128 pages (thus create a page pool with size 128), shown above at inflight.
Note that each netdev has multiple types of RQs, including Regular RQ, XSK, PTP, Drop, Trap RQ. Since non-uplink representor only supports regular rq, this patch only changes the regular RQ's default depth.
--- drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +3 -0
@@ -58,6 +58,7 @@#define MLX5E_REP_PARAMS_DEF_LOG_SQ_SIZE \ max(0x7, MLX5E_PARAMS_MINIMUM_LOG_SQ_SIZE)#define MLX5E_REP_PARAMS_DEF_NUM_CHANNELS 1 +#define MLX5E_REP_PARAMS_DEF_LOG_RQ_SIZE 0x8static const char mlx5e_rep_driver_name[] ="mlx5e_rep" ;
@@ -615,6 +616,8 @@ static void mlx5e_build_rep_params(struct net_device *netdev)/* RQ */ mlx5e_build_rq_params (mdev, params); +if (!mlx5e_is_uplink_rep (priv) &&mlx5_core_is_ecpf (mdev)) + params->log_rq_mtu_frames =MLX5E_REP_PARAMS_DEF_LOG_RQ_SIZE ;/* CQ moderation params */ params->rx_dim_enabled =MLX5_CAP_GEN (mdev, cq_moderation);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 128/207 wifi: mac80211: dont unconditionally call drv_mgd_complete_tx()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 1798271b3604b902d45033ec569f2bf77e94ecc2 ]
We might not have called drv_mgd_prepare_tx(), so only call drv_mgd_complete_tx() under the same conditions.
--- net/mac80211/mlme.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/mac80211/mlme.c +2 -1
@@ -2336,7 +2336,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,if (tx)ieee80211_flush_queues (local, sdata, false); -drv_mgd_complete_tx (sdata->local, sdata, &info); +if (tx || frame_buf) +drv_mgd_complete_tx (sdata->local, sdata, &info);/* clear bssid only after building the needed mgmt frames */ eth_zero_addr (ifmgd->bssid);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 129/207 wifi: mac80211: remove misplaced drv_mgd_complete_tx() call
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit f4995cdc4d02d0abc8e9fcccad5c71ce676c1e3f ]
In the original commit 15fae3410f1d ("mac80211: notify driver on mgd TX completion") I evidently made a mistake and placed the call in the "associated" if, rather than the "assoc_data". Later I noticed the missing call and placed it in commit c042600c17d8 ("wifi: mac80211: adding missing drv_mgd_complete_tx() call"), but didn't remove the wrong one. Remove it now.
--- net/mac80211/mlme.c | 1 - 1 file changed, 1 deletion(-)
net/mac80211/mlme.c +0 -1
@@ -5952,7 +5952,6 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,ieee80211_report_disconnect (sdata, frame_buf,sizeof (frame_buf), true, req->reason_code, false); -drv_mgd_complete_tx (sdata->local, sdata, &info);return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 130/207 arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Athira Rajeev <[email protected]>
[ Upstream commit 2ffb26afa64261139e608bf087a0c1fe24d76d4d ]
perf mem report aborts as below sometimes (during some corner case) in powerpc:
# ./perf mem report 1>out *** stack smashing detected ***: terminated Aborted (core dumped)
The backtrace is as below:
__pthread_kill_implementation ()
raise ()
abort ()
__libc_message
__fortify_fail
__stack_chk_fail
hist_entry.lvl_snprintf
__sort__hpp_entry
__hist_entry__snprintf
hists.fprintf
cmd_report
cmd_mem
Snippet of code which triggers the issue
from tools/perf/util/sort.c
static int hist_entry__lvl_snprintf(struct hist_entry *he, char *bf,
size_t size, unsigned int width)
{
char out[64]; perf_mem__lvl_scnprintf(out, sizeof(out), he->mem_info);
return repsep_snprintf(bf, size, "%-*s", width, out);}
The value of "out" is filled from perf_mem_data_src value. Debugging this further showed that for some corner cases, the value of "data_src" was pointing to wrong value. This resulted in bigger size of string and causing stack check fail.
The perf mem data source values are captured in the sample via isa207_get_mem_data_src function. The initial check is to fetch the type of sampled instruction. If the type of instruction is not valid (not a load/store instruction), the function returns.
Since 'commit e16fd7f2cb1a ("perf: Use sample_flags for data_src")', data_src field is not initialized by the perf_sample_data_init() function. If the PMU driver doesn't set the data_src value to zero if type is not valid, this will result in uninitailised value for data_src. The uninitailised value of data_src resulted in stack check fail followed by abort for "perf mem report".
When requesting for data source information in the sample, the instruction type is expected to be load or store instruction. In ISA v3.0, due to hardware limitation, there are corner cases where the instruction type other than load or store is observed. In ISA v3.0 and before values "0" and "7" are considered reserved. In ISA v3.1, value "7" has been used to indicate "larx/stcx". Drop the sample if instruction type has reserved values for this field with a ISA version check. Initialize data_src to zero in isa207_get_mem_data_src if the instruction type is not load/store.
--- arch/powerpc/perf/core-book3s.c | 20 ++++++++++++++++++++ arch/powerpc/perf/isa207-common.c | 4 +++- 2 files changed, 23 insertions(+), 1 deletion(-)
arch/powerpc/perf/core-book3s.c +20 -0
@@ -2183,6 +2183,10 @@ static struct pmu power_pmu = {#define PERF_SAMPLE_ADDR_TYPE (PERF_SAMPLE_ADDR | \ PERF_SAMPLE_PHYS_ADDR | \ PERF_SAMPLE_DATA_PAGE_SIZE) + +#define SIER_TYPE_SHIFT 15 +#define SIER_TYPE_MASK (0x7ull << SIER_TYPE_SHIFT) +/* * A counter has overflowed; update its count and record * things if requested. Note that interrupts are hard-disabled
@@ -2251,6 +2255,22 @@ static void record_and_restart(struct perf_event *event, unsigned long val, is_kernel_addr(mfspr(SPRN_SIAR))) record =0 ; +/* +* SIER[46-48] presents instruction type of the sampled instruction. +* In ISA v3.0 and before values "0" and "7" are considered reserved. +* In ISA v3.1, value "7" has been used to indicate "larx/stcx". +* Drop the sample if "type" has reserved values for this field with a +* ISA version check. +*/ +if (event->attr.sample_type &PERF_SAMPLE_DATA_SRC && + ppmu->get_mem_data_src) { + val = (regs->dar &SIER_TYPE_MASK ) >>SIER_TYPE_SHIFT ; +if (val ==0 || (val ==7 && !cpu_has_feature (CPU_FTR_ARCH_31 ))) { + record =0 ; +atomic64_inc (&event->lost_samples); + } + } +/* * Finally record data if requested. */
arch/powerpc/perf/isa207-common.c +3 -1
@@ -275,8 +275,10 @@ void isa207_get_mem_data_src(union perf_mem_data_src *dsrc, u32 flags, sier =mfspr (SPRN_SIER ); val = (sier &ISA207_SIER_TYPE_MASK ) >>ISA207_SIER_TYPE_SHIFT ; -if (val !=1 && val !=2 && !(val ==7 &&cpu_has_feature (CPU_FTR_ARCH_31 ))) +if (val !=1 && val !=2 && !(val ==7 &&cpu_has_feature (CPU_FTR_ARCH_31 ))) { + dsrc->val =0 ;return ; + } idx = (sier &ISA207_SIER_LDST_MASK ) >>ISA207_SIER_LDST_SHIFT ; sub_idx = (sier &ISA207_SIER_DATA_SRC_MASK ) >>ISA207_SIER_DATA_SRC_SHIFT ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 131/207 ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure().
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 5a1ccffd30a08f5a2428cd5fbb3ab03e8eb6c66d ]
The following patch will not set skb->sk from VRF path.
Let's fetch net from fib_rule->fr_net instead of sock_net(skb->sk) in fib[46]_rule_configure().
--- net/ipv4/fib_rules.c | 4 ++-- net/ipv6/fib6_rules.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
net/ipv4/fib_rules.c +2 -2
@@ -226,9 +226,9 @@ static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,struct nlattr **tb, struct netlink_ext_ack *extack) { - struct net *net = sock_net(skb->sk); + struct fib4_rule *rule4 = (struct fib4_rule *)rule; +struct net *net = rule->fr_net;int err = -EINVAL ; -struct fib4_rule *rule4 = (struct fib4_rule *) rule;if (frh->tos & ~IPTOS_TOS_MASK ) {NL_SET_ERR_MSG (extack,"Invalid tos" );
net/ipv6/fib6_rules.c +2 -2
@@ -353,9 +353,9 @@ static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,struct nlattr **tb, struct netlink_ext_ack *extack) { + struct fib6_rule *rule6 = (struct fib6_rule *)rule; +struct net *net = rule->fr_net;int err = -EINVAL ; -struct net *net =sock_net (skb->sk); -struct fib6_rule *rule6 = (struct fib6_rule *) rule;if (rule->action ==FR_ACT_TO_TBL && !rule->l3mdev) {if (rule->table ==RT6_TABLE_UNSPEC ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 132/207 r8152: add vendor/device ID pair for Dell Alienware AW1022z
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit 848b09d53d923b4caee5491f57a5c5b22d81febc ]
The Dell AW1022z is an RTL8156B based 2.5G Ethernet controller.
Add the vendor and product ID values to the driver. This makes Ethernet work with the adapter.
--- drivers/net/usb/r8152.c | 1 + include/linux/usb/r8152.h | 1 + 2 files changed, 2 insertions(+)
drivers/net/usb/r8152.c +1 -0
@@ -9853,6 +9853,7 @@ static const struct usb_device_id rtl8152_table[] = { { USB_DEVICE(VENDOR_ID_NVIDIA, 0x09ff) }, { USB_DEVICE(VENDOR_ID_TPLINK, 0x0601) }, { USB_DEVICE(VENDOR_ID_DLINK, 0xb301) }, + { USB_DEVICE(VENDOR_ID_DELL, 0xb097) }, { USB_DEVICE(VENDOR_ID_ASUS, 0x1976) }, {} };
include/linux/usb/r8152.h +1 -0
@@ -30,6 +30,7 @@#define VENDOR_ID_NVIDIA 0x0955#define VENDOR_ID_TPLINK 0x2357#define VENDOR_ID_DLINK 0x2001 +#define VENDOR_ID_DELL 0x413c#define VENDOR_ID_ASUS 0x0b05#if IS_REACHABLE (CONFIG_USB_RTL8152 )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 133/207 wifi: rtw88: Fix download_firmware_validate() for RTL8814AU
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bitterblue Smith <[email protected]>
[ Upstream commit 9e8243025cc06abc975c876dffda052073207ab3 ]
After the firmware is uploaded, download_firmware_validate() checks some bits in REG_MCUFW_CTRL to see if everything went okay. The RTL8814AU power on sequence sets bits 13 and 12 to 2, which this function does not expect, so it thinks the firmware upload failed.
Make download_firmware_validate() ignore bits 13 and 12.
--- drivers/net/wireless/realtek/rtw88/reg.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtw88/reg.h +2 -1
@@ -107,6 +107,7 @@#define BIT_SHIFT_ROM_PGE 16#define BIT_FW_INIT_RDY BIT(15)#define BIT_FW_DW_RDY BIT(14) +#define BIT_CPU_CLK_SEL (BIT(12) | BIT(13))#define BIT_RPWM_TOGGLE BIT(7)#define BIT_RAM_DL_SEL BIT(7)/* legacy only */ #define BIT_DMEM_CHKSUM_OK BIT(6)
@@ -124,7 +125,7 @@ BIT_CHECK_SUM_OK)#define FW_READY_LEGACY (BIT_MCUFWDL_RDY | BIT_FWDL_CHK_RPT | \ BIT_WINTINI_RDY | BIT_RAM_DL_SEL) -#define FW_READY_MASK 0xffff +#define FW_READY_MASK (0xffff & ~BIT_CPU_CLK_SEL)#define REG_MCU_TST_CFG 0x84#define VAL_FW_TRIGGER 0x1
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 134/207 clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Crouse <[email protected]>
[ Upstream commit 52b10b591f83dc6d9a1d6c2dc89433470a787ecd ]
Update some RCGs on the sm8250 camera clock controller to use clk_rcg2_shared_ops. The shared_ops ensure the RCGs get parked to the XO during clock disable to prevent the clocks from locking up when the GDSC is enabled. These mirror similar fixes for other controllers such as commit e5c359f70e4b ("clk: qcom: camcc: Update the clock ops for the SC7180").
--- drivers/clk/qcom/camcc-sm8250.c | 56 ++++++++++++++++----------------- 1 file changed, 28 insertions(+), 28 deletions(-)
drivers/clk/qcom/camcc-sm8250.c +28 -28
@@ -411,7 +411,7 @@ static struct clk_rcg2 cam_cc_bps_clk_src = { .parent_data = cam_cc_parent_data_0, .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -433,7 +433,7 @@ static struct clk_rcg2 cam_cc_camnoc_axi_clk_src = { .parent_data = cam_cc_parent_data_0, .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -454,7 +454,7 @@ static struct clk_rcg2 cam_cc_cci_0_clk_src = { .parent_data = cam_cc_parent_data_0, .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -469,7 +469,7 @@ static struct clk_rcg2 cam_cc_cci_1_clk_src = { .parent_data = cam_cc_parent_data_0, .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -490,7 +490,7 @@ static struct clk_rcg2 cam_cc_cphy_rx_clk_src = { .parent_data = cam_cc_parent_data_0, .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -511,7 +511,7 @@ static struct clk_rcg2 cam_cc_csi0phytimer_clk_src = { .parent_data = cam_cc_parent_data_0, .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -526,7 +526,7 @@ static struct clk_rcg2 cam_cc_csi1phytimer_clk_src = { .parent_data = cam_cc_parent_data_0, .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -556,7 +556,7 @@ static struct clk_rcg2 cam_cc_csi3phytimer_clk_src = { .parent_data = cam_cc_parent_data_0, .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -571,7 +571,7 @@ static struct clk_rcg2 cam_cc_csi4phytimer_clk_src = { .parent_data = cam_cc_parent_data_0, .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -586,7 +586,7 @@ static struct clk_rcg2 cam_cc_csi5phytimer_clk_src = { .parent_data = cam_cc_parent_data_0, .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -611,7 +611,7 @@ static struct clk_rcg2 cam_cc_fast_ahb_clk_src = { .parent_data = cam_cc_parent_data_0, .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -634,7 +634,7 @@ static struct clk_rcg2 cam_cc_fd_core_clk_src = { .parent_data = cam_cc_parent_data_0, .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -649,7 +649,7 @@ static struct clk_rcg2 cam_cc_icp_clk_src = { .parent_data = cam_cc_parent_data_0, .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -673,7 +673,7 @@ static struct clk_rcg2 cam_cc_ife_0_clk_src = { .parent_data = cam_cc_parent_data_2, .num_parents = ARRAY_SIZE(cam_cc_parent_data_2), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -710,7 +710,7 @@ static struct clk_rcg2 cam_cc_ife_0_csid_clk_src = { .parent_data = cam_cc_parent_data_0, .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -734,7 +734,7 @@ static struct clk_rcg2 cam_cc_ife_1_clk_src = { .parent_data = cam_cc_parent_data_3, .num_parents = ARRAY_SIZE(cam_cc_parent_data_3), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -749,7 +749,7 @@ static struct clk_rcg2 cam_cc_ife_1_csid_clk_src = { .parent_data = cam_cc_parent_data_0, .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -771,7 +771,7 @@ static struct clk_rcg2 cam_cc_ife_lite_clk_src = { .parent_data = cam_cc_parent_data_0, .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -786,7 +786,7 @@ static struct clk_rcg2 cam_cc_ife_lite_csid_clk_src = { .parent_data = cam_cc_parent_data_0, .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -810,7 +810,7 @@ static struct clk_rcg2 cam_cc_ipe_0_clk_src = { .parent_data = cam_cc_parent_data_4, .num_parents = ARRAY_SIZE(cam_cc_parent_data_4), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -825,7 +825,7 @@ static struct clk_rcg2 cam_cc_jpeg_clk_src = { .parent_data = cam_cc_parent_data_0, .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -847,7 +847,7 @@ static struct clk_rcg2 cam_cc_mclk0_clk_src = { .parent_data = cam_cc_parent_data_1, .num_parents = ARRAY_SIZE(cam_cc_parent_data_1), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -862,7 +862,7 @@ static struct clk_rcg2 cam_cc_mclk1_clk_src = { .parent_data = cam_cc_parent_data_1, .num_parents = ARRAY_SIZE(cam_cc_parent_data_1), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -877,7 +877,7 @@ static struct clk_rcg2 cam_cc_mclk2_clk_src = { .parent_data = cam_cc_parent_data_1, .num_parents = ARRAY_SIZE(cam_cc_parent_data_1), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -892,7 +892,7 @@ static struct clk_rcg2 cam_cc_mclk3_clk_src = { .parent_data = cam_cc_parent_data_1, .num_parents = ARRAY_SIZE(cam_cc_parent_data_1), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -907,7 +907,7 @@ static struct clk_rcg2 cam_cc_mclk4_clk_src = { .parent_data = cam_cc_parent_data_1, .num_parents = ARRAY_SIZE(cam_cc_parent_data_1), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -922,7 +922,7 @@ static struct clk_rcg2 cam_cc_mclk5_clk_src = { .parent_data = cam_cc_parent_data_1, .num_parents = ARRAY_SIZE(cam_cc_parent_data_1), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -993,7 +993,7 @@ static struct clk_rcg2 cam_cc_slow_ahb_clk_src = { .parent_data = cam_cc_parent_data_0, .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 135/207 hwmon: (xgene-hwmon) use appropriate type for the latency value
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Vatoropin <[email protected]>
[ Upstream commit 8df0f002827e18632dcd986f7546c1abf1953a6f ]
The expression PCC_NUM_RETRIES * pcc_chan->latency is currently being evaluated using 32-bit arithmetic.
Since a value of type 'u64' is used to store the eventual result, and this result is later sent to the function usecs_to_jiffies with input parameter unsigned int, the current data type is too wide to store the value of ctx->usecs_lat.
Change the data type of "usecs_lat" to a more suitable (narrower) type.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/hwmon/xgene-hwmon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/xgene-hwmon.c +1 -1
@@ -110,7 +110,7 @@ struct xgene_hwmon_dev {phys_addr_t comm_base_addr;void *pcc_comm_addr; -u64 usecs_lat; +unsigned int usecs_lat; };/*
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 136/207 media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Depeng Shao <[email protected]>
[ Upstream commit 2f1361f862a68063f37362f1beb400e78e289581 ]
There is no CSID TPG on some SoCs, so the v4l2 ctrl in CSID driver shouldn't be registered. Checking the supported TPG modes to indicate if the TPG hardware exists or not and only registering v4l2 ctrl for CSID only when the TPG hardware is present.
--- .../media/platform/qcom/camss/camss-csid.c | 60 +++++++++++-------- 1 file changed, 35 insertions(+), 25 deletions(-)
drivers/media/platform/qcom/camss/camss-csid.c +35 -25
@@ -219,11 +219,13 @@ static int csid_set_stream(struct v4l2_subdev *sd, int enable)int ret;if (enable) { - ret =v4l2_ctrl_handler_setup (&csid->ctrls); -if (ret <0 ) { -dev_err (csid->camss->dev, -"could not sync v4l2 controls: %d\n" , ret); -return ret; +if (csid->testgen.nmodes !=CSID_PAYLOAD_MODE_DISABLED ) { + ret =v4l2_ctrl_handler_setup (&csid->ctrls); +if (ret <0 ) { +dev_err (csid->camss->dev, +"could not sync v4l2 controls: %d\n" , ret); +return ret; + } } if (!csid->testgen.enabled &&
@@ -298,7 +300,8 @@ static void csid_try_format(struct csid_device *csid,break ;case MSM_CSID_PAD_SRC : -if (csid->testgen_mode->cur.val ==0 ) { +if (csid->testgen.nmodes ==CSID_PAYLOAD_MODE_DISABLED || + csid->testgen_mode->cur.val ==0 ) {/* Test generator is disabled, */ /* keep pad formats in sync */ u32 code = fmt->code;
@@ -348,7 +351,8 @@ static int csid_enum_mbus_code(struct v4l2_subdev *sd, code->code = csid->formats[code->index].code; }else { -if (csid->testgen_mode->cur.val ==0 ) { +if (csid->testgen.nmodes ==CSID_PAYLOAD_MODE_DISABLED || + csid->testgen_mode->cur.val ==0 ) {struct v4l2_mbus_framefmt *sink_fmt; sink_fmt = __csid_get_format(csid, sd_state,
@@ -707,7 +711,8 @@ static int csid_link_setup(struct media_entity *entity,/* If test generator is enabled */ /* do not allow a link from CSIPHY to CSID */ -if (csid->testgen_mode->cur.val !=0 ) +if (csid->testgen.nmodes !=CSID_PAYLOAD_MODE_DISABLED && + csid->testgen_mode->cur.val !=0 )return -EBUSY ; sd =media_entity_to_v4l2_subdev (remote->entity);
@@ -800,24 +805,27 @@ int msm_csid_register_entity(struct csid_device *csid, MSM_CSID_NAME, csid->id);v4l2_set_subdevdata (sd, csid); - ret =v4l2_ctrl_handler_init (&csid->ctrls,1 ); -if (ret <0 ) { -dev_err (dev,"Failed to init ctrl handler: %d\n" , ret); -return ret; - } +if (csid->testgen.nmodes !=CSID_PAYLOAD_MODE_DISABLED ) { + ret =v4l2_ctrl_handler_init (&csid->ctrls,1 ); +if (ret <0 ) { +dev_err (dev,"Failed to init ctrl handler: %d\n" , ret); +return ret; + } - csid->testgen_mode =v4l2_ctrl_new_std_menu_items (&csid->ctrls, - &csid_ctrl_ops,V4L2_CID_TEST_PATTERN , - csid->testgen.nmodes,0 ,0 , - csid->testgen.modes); + csid->testgen_mode = +v4l2_ctrl_new_std_menu_items (&csid->ctrls, + &csid_ctrl_ops,V4L2_CID_TEST_PATTERN , + csid->testgen.nmodes,0 ,0 , + csid->testgen.modes); -if (csid->ctrls.error) { -dev_err (dev,"Failed to init ctrl: %d\n" , csid->ctrls.error); - ret = csid->ctrls.error; - goto free_ctrl; - } +if (csid->ctrls.error) { +dev_err (dev,"Failed to init ctrl: %d\n" , csid->ctrls.error); + ret = csid->ctrls.error; + goto free_ctrl; + } - csid->subdev.ctrl_handler = &csid->ctrls; + csid->subdev.ctrl_handler = &csid->ctrls; + } ret =csid_init_formats (sd,NULL );if (ret <0 ) {
@@ -848,7 +856,8 @@ int msm_csid_register_entity(struct csid_device *csid, media_cleanup:media_entity_cleanup (&sd->entity); free_ctrl: -v4l2_ctrl_handler_free (&csid->ctrls); +if (csid->testgen.nmodes !=CSID_PAYLOAD_MODE_DISABLED ) +v4l2_ctrl_handler_free (&csid->ctrls);return ret; }
@@ -861,5 +870,6 @@ void msm_csid_unregister_entity(struct csid_device *csid) {v4l2_device_unregister_subdev (&csid->subdev);media_entity_cleanup (&csid->subdev.entity); -v4l2_ctrl_handler_free (&csid->ctrls); +if (csid->testgen.nmodes !=CSID_PAYLOAD_MODE_DISABLED ) +v4l2_ctrl_handler_free (&csid->ctrls); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 137/207 vxlan: Annotate FDB data races
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit f6205f8215f12a96518ac9469ff76294ae7bd612 ]
The 'used' and 'updated' fields in the FDB entry structure can be accessed concurrently by multiple threads, leading to reports such as [1]. Can be reproduced using [2].
Suppress these reports by annotating these accesses using READ_ONCE() / WRITE_ONCE().
[1]
BUG: KCSAN: data-race in vxlan_xmit / vxlan_xmit
write to 0xffff942604d263a8 of 8 bytes by task 286 on cpu 0:
vxlan_xmit+0xb29/0x2380 dev_hard_start_xmit+0x84/0x2f0 __dev_queue_xmit+0x45a/0x1650 packet_xmit+0x100/0x150 packet_sendmsg+0x2114/0x2ac0 __sys_sendto+0x318/0x330 __x64_sys_sendto+0x76/0x90 x64_sys_call+0x14e8/0x1c00 do_syscall_64+0x9e/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
read to 0xffff942604d263a8 of 8 bytes by task 287 on cpu 2:
vxlan_xmit+0xadf/0x2380 dev_hard_start_xmit+0x84/0x2f0 __dev_queue_xmit+0x45a/0x1650 packet_xmit+0x100/0x150 packet_sendmsg+0x2114/0x2ac0 __sys_sendto+0x318/0x330 __x64_sys_sendto+0x76/0x90 x64_sys_call+0x14e8/0x1c00 do_syscall_64+0x9e/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
value changed: 0x00000000fffbac6e -> 0x00000000fffbac6f
Reported by Kernel Concurrency Sanitizer on:
CPU: 2 UID: 0 PID: 287 Comm: mausezahn Not tainted 6.13.0-rc7-01544-gb4b270f11a02 #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014
[2]
#!/bin/bash
set +H
echo whitelist > /sys/kernel/debug/kcsan
echo !vxlan_xmit > /sys/kernel/debug/kcsan
ip link add name vx0 up type vxlan id 10010 dstport 4789 local 192.0.2.1 bridge fdb add 00:11:22:33:44:55 dev vx0 self static dst 198.51.100.1 taskset -c 0 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q & taskset -c 2 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q &
--- drivers/net/vxlan/vxlan_core.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/net/vxlan/vxlan_core.c +9 -9
@@ -334,9 +334,9 @@ static int vxlan_fdb_info(struct sk_buff *skb, struct vxlan_dev *vxlan, be32_to_cpu(fdb->vni))) goto nla_put_failure; - ci.ndm_used =jiffies_to_clock_t (now - fdb->used); + ci.ndm_used =jiffies_to_clock_t (now -READ_ONCE (fdb->used)); ci.ndm_confirmed =0 ; - ci.ndm_updated =jiffies_to_clock_t (now - fdb->updated); + ci.ndm_updated =jiffies_to_clock_t (now -READ_ONCE (fdb->updated)); ci.ndm_refcnt =0 ;if (nla_put (skb,NDA_CACHEINFO ,sizeof (ci), &ci))
@@ -542,8 +542,8 @@ static struct vxlan_fdb *vxlan_find_mac(struct vxlan_dev *vxlan,struct vxlan_fdb *f; f =__vxlan_find_mac (vxlan, mac, vni); -if (f && f->used != jiffies) - f->used = jiffies; +if (f &&READ_ONCE (f->used) != jiffies) +WRITE_ONCE (f->used, jiffies);return f; }
@@ -1073,12 +1073,12 @@ static int vxlan_fdb_update_existing(struct vxlan_dev *vxlan, !(f->flags & NTF_VXLAN_ADDED_BY_USER)) {if (f->state != state) { f->state = state; - f->updated = jiffies; +WRITE_ONCE (f->updated, jiffies); notify =1 ; }if (f->flags != fdb_flags) { f->flags = fdb_flags; - f->updated = jiffies; +WRITE_ONCE (f->updated, jiffies); notify =1 ; } }
@@ -1112,7 +1112,7 @@ static int vxlan_fdb_update_existing(struct vxlan_dev *vxlan, }if (ndm_flags &NTF_USE ) - f->used = jiffies; +WRITE_ONCE (f->used, jiffies);if (notify) {if (rd ==NULL )
@@ -1525,7 +1525,7 @@ static bool vxlan_snoop(struct net_device *dev, src_mac, &rdst->remote_ip.sa, &src_ip->sa); rdst->remote_ip = *src_ip; - f->updated = jiffies; +WRITE_ONCE (f->updated, jiffies);vxlan_fdb_notify (vxlan, f, rdst,RTM_NEWNEIGH , true,NULL ); }else {u32 hash_index =fdb_head_index (vxlan, src_mac, vni);
@@ -3000,7 +3000,7 @@ static void vxlan_cleanup(struct timer_list *t)if (f->flags &NTF_EXT_LEARNED )continue ; - timeout = f->used + vxlan->cfg.age_interval *HZ ; + timeout =READ_ONCE (f->used) + vxlan->cfg.age_interval *HZ ;if (time_before_eq (timeout, jiffies)) { netdev_dbg(vxlan->dev, "garbage collect %pM\n",
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 138/207 r8169: dont scan PHY addresses > 0
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
[ Upstream commit faac69a4ae5abb49e62c79c66b51bb905c9aa5ec ]
The PHY address is a dummy, because r8169 PHY access registers don't support a PHY address. Therefore scan address 0 only.
--- drivers/net/ethernet/realtek/r8169_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/realtek/r8169_main.c +1 -0
@@ -5185,6 +5185,7 @@ static int r8169_mdio_register(struct rtl8169_private *tp) new_bus->priv = tp; new_bus->parent = &pdev->dev; new_bus->irq[0 ] =PHY_MAC_INTERRUPT ; + new_bus->phy_mask =GENMASK (31 ,1 );snprintf (new_bus->id,MII_BUS_ID_SIZE ,"r8169-%x-%x" ,pci_domain_nr (pdev->bus),pci_dev_id (pdev));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 139/207 rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ankur Arora <[email protected]>
[ Upstream commit 83b28cfe796464ebbde1cf7916c126da6d572685 ]
With PREEMPT_RCU=n, cond_resched() provides urgently needed quiescent states for read-side critical sections via rcu_all_qs(). One reason why this was needed: lacking preempt-count, the tick handler has no way of knowing whether it is executing in a read-side critical section or not.
With (PREEMPT_LAZY=y, PREEMPT_DYNAMIC=n), we get (PREEMPT_COUNT=y, PREEMPT_RCU=n). In this configuration cond_resched() is a stub and does not provide quiescent states via rcu_all_qs(). (PREEMPT_RCU=y provides this information via rcu_read_unlock() and its nesting counter.)
So, use the availability of preempt_count() to report quiescent states in rcu_flavor_sched_clock_irq().
--- kernel/rcu/tree_plugin.h | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
kernel/rcu/tree_plugin.h +7 -4
@@ -945,13 +945,16 @@ static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp)*/ static void rcu_flavor_sched_clock_irq (int user) { -if (user ||rcu_is_cpu_rrupt_from_idle ()) { +if (user ||rcu_is_cpu_rrupt_from_idle () || + (IS_ENABLED (CONFIG_PREEMPT_COUNT ) && + (preempt_count () ==HARDIRQ_OFFSET ))) {/* * Get here if this CPU took its interrupt from user -* mode or from the idle loop, and if this is not a -* nested interrupt. In this case, the CPU is in -* a quiescent state, so note it. +* mode, from the idle loop without this being a nested +* interrupt, or while not holding the task preempt count +* (with PREEMPT_COUNT=y). In this case, the CPU is in a +* quiescent state, so note it. * * No memory barrier is required here because rcu_qs() * references only CPU-local variables that other CPUs
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 140/207 rcu: fix header guard for rcu_all_qs()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ankur Arora <[email protected]>
[ Upstream commit ad6b5b73ff565e88aca7a7d1286788d80c97ba71 ]
rcu_all_qs() is defined for !CONFIG_PREEMPT_RCU but the declaration is conditioned on CONFIG_PREEMPTION.
With CONFIG_PREEMPT_LAZY, CONFIG_PREEMPTION=y does not imply CONFIG_PREEMPT_RCU=y.
Decouple the two.
--- include/linux/rcutree.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/rcutree.h +1 -1
@@ -66,7 +66,7 @@ extern int rcu_scheduler_active __read_mostly;void rcu_end_inkernel_boot (void );bool rcu_inkernel_boot_has_ended (void );bool rcu_is_watching (void ); -#ifndef CONFIG_PREEMPTION +#ifndef CONFIG_PREEMPT_RCU void rcu_all_qs (void );#endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 141/207 net/mana: fix warning in the writer of client oob
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Taranov <[email protected]>
[ Upstream commit 5ec7e1c86c441c46a374577bccd9488abea30037 ]
Do not warn on missing pad_data when oob is in sgl.
--- drivers/net/ethernet/microsoft/mana/gdma_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/microsoft/mana/gdma_main.c +1 -1
@@ -957,7 +957,7 @@ static u32 mana_gd_write_client_oob(const struct gdma_wqe_request *wqe_req, header->inline_oob_size_div4 = client_oob_size /sizeof (u32);if (oob_in_sgl) { -WARN_ON_ONCE (!pad_data || wqe_req->num_sge <2 ); +WARN_ON_ONCE (wqe_req->num_sge <2 ); header->client_oob_in_sgl =1 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 142/207 scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 56c3d809b7b450379162d0b8a70bbe71ab8db706 ]
After a port swap between separate fabrics, there may be multiple nodes in the vport's fc_nodes list with the same fabric well known address. Duplication is temporary and eventually resolves itself after dev_loss_tmo expires, but nameserver queries may still occur before dev_loss_tmo. This possibly results in returning stale fabric ndlp objects. Fix by adding an nlp_state check to ensure the ndlp search routine returns the correct newer allocated ndlp fabric object.
--- drivers/scsi/lpfc/lpfc_hbadisc.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
drivers/scsi/lpfc/lpfc_hbadisc.c +12 -5
@@ -5631,6 +5631,7 @@ static struct lpfc_nodelist * __lpfc_findnode_did(struct lpfc_vport *vport, uint32_t did) {struct lpfc_nodelist *ndlp; +struct lpfc_nodelist *np =NULL ;uint32_t data1;list_for_each_entry (ndlp, &vport->fc_nodes, nlp_listp) {
@@ -5645,14 +5646,20 @@ __lpfc_findnode_did(struct lpfc_vport *vport, uint32_t did) ndlp, ndlp->nlp_DID, ndlp->nlp_flag, data1, ndlp->nlp_rpi, ndlp->active_rrqs_xri_bitmap); -return ndlp; + +/* Check for new or potentially stale node */ +if (ndlp->nlp_state !=NLP_STE_UNUSED_NODE ) +return ndlp; + np = ndlp; } } -/* FIND node did <did> NOT FOUND */ -lpfc_printf_vlog (vport,KERN_INFO ,LOG_NODE , -"0932 FIND node did x%x NOT FOUND.\n" , did); -return NULL ; +if (!np) +/* FIND node did <did> NOT FOUND */ +lpfc_printf_vlog (vport,KERN_INFO ,LOG_NODE , +"0932 FIND node did x%x NOT FOUND.\n" , did); + +return np; } struct lpfc_nodelist *
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 143/207 scsi: st: Restore some drive settings after reset
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai Mäkisara <[email protected]>
[ Upstream commit 7081dc75df79696d8322d01821c28e53416c932c ]
Some of the allowed operations put the tape into a known position to continue operation assuming only the tape position has changed. But reset sets partition, density and block size to drive default values. These should be restored to the values before reset.
Normally the current block size and density are stored by the drive. If the settings have been changed, the changed values have to be saved by the driver across reset.
--- drivers/scsi/st.c | 24 +++++++++++++++++++++--- drivers/scsi/st.h | 2 ++ 2 files changed, 23 insertions(+), 3 deletions(-)
drivers/scsi/st.c +21 -3
@@ -947,7 +947,6 @@ static void reset_state(struct scsi_tape *STp) STp->partition =find_partition (STp);if (STp->partition <0 ) STp->partition =0 ; - STp->new_partition = STp->partition; } }
@@ -2916,14 +2915,17 @@ static int st_int_ioctl(struct scsi_tape *STp, unsigned int cmd_in, unsigned lonif (cmd_in ==MTSETDENSITY ) { (STp->buffer)->b_data[4 ] = arg; STp->density_changed =1 ;/* At least we tried ;-) */ + STp->changed_density = arg; }else if (cmd_in ==SET_DENS_AND_BLK ) (STp->buffer)->b_data[4 ] = arg >>24 ;else (STp->buffer)->b_data[4 ] = STp->density;if (cmd_in ==MTSETBLK || cmd_in ==SET_DENS_AND_BLK ) { ltmp = arg &MT_ST_BLKSIZE_MASK ; -if (cmd_in ==MTSETBLK ) +if (cmd_in ==MTSETBLK ) { STp->blksize_changed =1 ;/* At least we tried ;-) */ + STp->changed_blksize = arg; + } }else ltmp = STp->block_size; (STp->buffer)->b_data[9 ] = (ltmp >>16 );
@@ -3624,9 +3626,25 @@ static long st_ioctl(struct file *file, unsigned int cmd_in, unsigned long arg) retval = (-EIO ); goto out; } -reset_state (STp); +reset_state (STp);/* Clears pos_unknown */ /* remove this when the midlevel properly clears was_reset */ STp->device->was_reset =0 ; + +/* Fix the device settings after reset, ignore errors */ +if (mtc.mt_op ==MTREW || mtc.mt_op ==MTSEEK || + mtc.mt_op ==MTEOM ) { +if (STp->can_partitions) { +/* STp->new_partition contains the +* latest partition set +*/ + STp->partition =0 ; +switch_partition (STp); + } +if (STp->density_changed) +st_int_ioctl (STp,MTSETDENSITY , STp->changed_density); +if (STp->blksize_changed) +st_int_ioctl (STp,MTSETBLK , STp->changed_blksize); + } } if (mtc.mt_op != MTNOP && mtc.mt_op != MTSETBLK &&
drivers/scsi/st.h +2 -0
@@ -166,12 +166,14 @@ struct scsi_tape {unsigned char compression_changed;unsigned char drv_buffer;unsigned char density; +unsigned char changed_density;unsigned char door_locked;unsigned char autorew_dev;/* auto-rewind device */ unsigned char rew_at_close;/* rewind necessary at close */ unsigned char inited;unsigned char cleaning_req;/* cleaning requested? */ int block_size; +int changed_blksize;int min_block;int max_block;int recover_count;/* From tape opening */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 144/207 HID: usbkbd: Fix the bit shift number for LED_KANA
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: junan <[email protected]>
[ Upstream commit d73a4bfa2881a6859b384b75a414c33d4898b055 ]
Since "LED_KANA" was defined as "0x04", the shift number should be "4".
--- drivers/hid/usbhid/usbkbd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/usbhid/usbkbd.c +1 -1
@@ -160,7 +160,7 @@ static int usb_kbd_event(struct input_dev *dev, unsigned int type,return -1 ;spin_lock_irqsave (&kbd->leds_lock, flags); - kbd->newleds = (!!test_bit (LED_KANA , dev->led) <<3 ) | (!!test_bit (LED_COMPOSE , dev->led) <<3 ) | + kbd->newleds = (!!test_bit (LED_KANA , dev->led) <<4 ) | (!!test_bit (LED_COMPOSE , dev->led) <<3 ) | (!!test_bit (LED_SCROLLL , dev->led) <<2 ) | (!!test_bit (LED_CAPSL , dev->led) <<1 ) | (!!test_bit (LED_NUML , dev->led));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 145/207 drm/ast: Find VBIOS mode from regular display size
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
[ Upstream commit c81202906b5cd56db403e95db3d29c9dfc8c74c1 ]
The ast driver looks up supplied display modes from an internal list of display modes supported by the VBIOS.
Do not use the crtc_-prefixed display values from struct drm_display_mode for looking up the VBIOS mode. The fields contain raw values that the driver programs to hardware. They are affected by display settings like double-scan or interlace.
Instead use the regular vdisplay and hdisplay fields for lookup. As the programmed values can now differ from the values used for lookup, set struct drm_display_mode.crtc_vdisplay and .crtc_hdisplay from the VBIOS mode.
--- drivers/gpu/drm/ast/ast_mode.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/gpu/drm/ast/ast_mode.c +6 -4
@@ -105,7 +105,7 @@ static bool ast_get_vbios_mode_info(const struct drm_format_info *format,return false; } -switch (mode->crtc_hdisplay) { +switch (mode->hdisplay) {case 640 : vbios_mode->enh_table = &res_640x480[refresh_rate_index];break ;
@@ -116,7 +116,7 @@ static bool ast_get_vbios_mode_info(const struct drm_format_info *format, vbios_mode->enh_table = &res_1024x768[refresh_rate_index];break ;case 1280 : -if (mode->crtc_vdisplay ==800 ) +if (mode->vdisplay ==800 ) vbios_mode->enh_table = &res_1280x800[refresh_rate_index];else vbios_mode->enh_table = &res_1280x1024[refresh_rate_index];
@@ -128,7 +128,7 @@ static bool ast_get_vbios_mode_info(const struct drm_format_info *format, vbios_mode->enh_table = &res_1440x900[refresh_rate_index];break ;case 1600 : -if (mode->crtc_vdisplay ==900 ) +if (mode->vdisplay ==900 ) vbios_mode->enh_table = &res_1600x900[refresh_rate_index];else vbios_mode->enh_table = &res_1600x1200[refresh_rate_index];
@@ -137,7 +137,7 @@ static bool ast_get_vbios_mode_info(const struct drm_format_info *format, vbios_mode->enh_table = &res_1680x1050[refresh_rate_index];break ;case 1920 : -if (mode->crtc_vdisplay ==1080 ) +if (mode->vdisplay ==1080 ) vbios_mode->enh_table = &res_1920x1080[refresh_rate_index];else vbios_mode->enh_table = &res_1920x1200[refresh_rate_index];
@@ -181,6 +181,7 @@ static bool ast_get_vbios_mode_info(const struct drm_format_info *format, hborder = (vbios_mode->enh_table->flags & HBorder) ?8 :0 ; vborder = (vbios_mode->enh_table->flags & VBorder) ?8 :0 ; + adjusted_mode->crtc_hdisplay = vbios_mode->enh_table->hde; adjusted_mode->crtc_htotal = vbios_mode->enh_table->ht; adjusted_mode->crtc_hblank_start = vbios_mode->enh_table->hde + hborder; adjusted_mode->crtc_hblank_end = vbios_mode->enh_table->ht - hborder;
@@ -190,6 +191,7 @@ static bool ast_get_vbios_mode_info(const struct drm_format_info *format, vbios_mode->enh_table->hfp + vbios_mode->enh_table->hsync); + adjusted_mode->crtc_vdisplay = vbios_mode->enh_table->vde; adjusted_mode->crtc_vtotal = vbios_mode->enh_table->vt; adjusted_mode->crtc_vblank_start = vbios_mode->enh_table->vde + vborder; adjusted_mode->crtc_vblank_end = vbios_mode->enh_table->vt - vborder;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 146/207 bpftool: Fix readlink usage in get_fd_type
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viktor Malik <[email protected]>
[ Upstream commit 0053f7d39d491b6138d7c526876d13885cbb65f1 ]
The readlink(path, buf, sizeof(buf)) call reads at most sizeof(buf) bytes and *does not* append null-terminator to buf. With respect to that, fix two pieces in get_fd_type:
1. Change the truncation check to contain sizeof(buf) rather than sizeof(path).
2. Append null-terminator to buf.
Reported by Coverity.
--- tools/bpf/bpftool/common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/bpf/bpftool/common.c +2 -1
@@ -318,10 +318,11 @@ int get_fd_type(int fd)p_err ("can't read link type: %s" ,strerror (errno));return -1 ; } -if (n ==sizeof (path)) { +if (n ==sizeof (buf)) {p_err ("can't read link type: path too long!" );return -1 ; } + buf[n] ='\0' ;if (strstr (buf,"bpf-map" ))return BPF_OBJ_MAP ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 147/207 perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ravi Bangoria <[email protected]>
[ Upstream commit 46dcf85566170d4528b842bf83ffc350d71771fa ]
IBS Op uses two counters: MaxCnt and CurCnt. MaxCnt is programmed with the desired sample period. IBS hw generates sample when CurCnt reaches to MaxCnt. The size of these counter used to be 20 bits but later they were extended to 27 bits. The 7 bit extension is indicated by CPUID Fn8000_001B_EAX[6 / OpCntExt].
perf_ibs->cnt_mask variable contains bit masks for MaxCnt and CurCnt. But IBS driver does not set upper 7 bits of CurCnt in cnt_mask even when OpCntExt CPUID bit is set. Fix this.
IBS driver uses cnt_mask[CurCnt] bits only while disabling an event. Fortunately, CurCnt bits are not read from MSR while re-enabling the event, instead MaxCnt is programmed with desired period and CurCnt is set to 0. Hence, we did not see any issues so far.
--- arch/x86/events/amd/ibs.c | 3 ++- arch/x86/include/asm/perf_event.h | 1 + 2 files changed, 3 insertions(+), 1 deletion(-)
arch/x86/events/amd/ibs.c +2 -1
@@ -803,7 +803,8 @@ static __init int perf_event_ibs_init(void)if (ibs_caps &IBS_CAPS_OPCNTEXT ) { perf_ibs_op.max_period |=IBS_OP_MAX_CNT_EXT_MASK ; perf_ibs_op.config_mask |=IBS_OP_MAX_CNT_EXT_MASK ; - perf_ibs_op.cnt_mask |=IBS_OP_MAX_CNT_EXT_MASK ; + perf_ibs_op.cnt_mask |= (IBS_OP_MAX_CNT_EXT_MASK | +IBS_OP_CUR_CNT_EXT_MASK ); } ret =perf_ibs_pmu_init (&perf_ibs_op,"ibs_op" );
arch/x86/include/asm/perf_event.h +1 -0
@@ -417,6 +417,7 @@ struct pebs_xmm {*/ #define IBS_OP_CUR_CNT (0xFFF80ULL<<32)#define IBS_OP_CUR_CNT_RAND (0x0007FULL<<32) +#define IBS_OP_CUR_CNT_EXT_MASK (0x7FULL<<52)#define IBS_OP_CNT_CTL (1ULL<<19)#define IBS_OP_VAL (1ULL<<18)#define IBS_OP_ENABLE (1ULL<<17)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 148/207 wifi: rtw88: Dont use static local variable in rtw8822b_set_tx_power_index_by_rate
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bitterblue Smith <[email protected]>
[ Upstream commit 00451eb3bec763f708e7e58326468c1e575e5a66 ]
Some users want to plug two identical USB devices at the same time. This static variable could theoretically cause them to use incorrect TX power values.
Move the variable to the caller and pass a pointer to it to rtw8822b_set_tx_power_index_by_rate().
--- drivers/net/wireless/realtek/rtw88/rtw8822b.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/net/wireless/realtek/rtw88/rtw8822b.c +8 -6
@@ -954,11 +954,11 @@ static void rtw8822b_query_rx_desc(struct rtw_dev *rtwdev, u8 *rx_desc, }static void -rtw8822b_set_tx_power_index_by_rate (struct rtw_dev *rtwdev,u8 path,u8 rs) +rtw8822b_set_tx_power_index_by_rate (struct rtw_dev *rtwdev,u8 path, +u8 rs,u32 *phy_pwr_idx) {struct rtw_hal *hal = &rtwdev->hal;static const u32 offset_txagc[2 ] = {0x1d00 ,0x1d80 }; -static u32 phy_pwr_idx;u8 rate, rate_idx, pwr_index, shift;int j;
@@ -966,12 +966,12 @@ rtw8822b_set_tx_power_index_by_rate(struct rtw_dev *rtwdev, u8 path, u8 rs) rate = rtw_rate_section[rs][j]; pwr_index = hal->tx_pwr_tbl[path][rate]; shift = rate &0x3 ; - phy_pwr_idx |= ((u32 )pwr_index << (shift *8 )); + *phy_pwr_idx |= ((u32 )pwr_index << (shift *8 ));if (shift ==0x3 ) { rate_idx = rate &0xfc ;rtw_write32 (rtwdev, offset_txagc[path] + rate_idx, - phy_pwr_idx); - phy_pwr_idx =0 ; + *phy_pwr_idx); + *phy_pwr_idx =0 ; } } }
@@ -979,11 +979,13 @@ rtw8822b_set_tx_power_index_by_rate(struct rtw_dev *rtwdev, u8 path, u8 rs)static void rtw8822b_set_tx_power_index (struct rtw_dev *rtwdev) {struct rtw_hal *hal = &rtwdev->hal; +u32 phy_pwr_idx =0 ;int rs, path;for (path =0 ; path < hal->rf_path_num; path++) {for (rs =0 ; rs <RTW_RATE_SECTION_MAX ; rs++) -rtw8822b_set_tx_power_index_by_rate (rtwdev, path, rs); +rtw8822b_set_tx_power_index_by_rate (rtwdev, path, rs, + &phy_pwr_idx); } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 149/207 spi: zynqmp-gqspi: Always acknowledge interrupts
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit 89785306453ce6d949e783f6936821a0b7649ee2 ]
RXEMPTY can cause an IRQ, even though we may not do anything about it (such as if we are waiting for more received data). We must still handle these IRQs because we can tell they were caused by the device.
--- drivers/spi/spi-zynqmp-gqspi.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-)
drivers/spi/spi-zynqmp-gqspi.c +8 -12
@@ -691,7 +691,6 @@ static void zynqmp_process_dma_irq(struct zynqmp_qspi *xqspi)static irqreturn_t zynqmp_qspi_irq (int irq,void *dev_id) {struct zynqmp_qspi *xqspi = (struct zynqmp_qspi *)dev_id; -irqreturn_t ret =IRQ_NONE ;u32 status, mask, dma_status =0 ; status =zynqmp_gqspi_read (xqspi,GQSPI_ISR_OFST );
@@ -706,27 +705,24 @@ static irqreturn_t zynqmp_qspi_irq(int irq, void *dev_id) dma_status); } -if (mask &GQSPI_ISR_TXNOT_FULL_MASK ) { +if (!mask && !dma_status) +return IRQ_NONE ; + +if (mask &GQSPI_ISR_TXNOT_FULL_MASK )zynqmp_qspi_filltxfifo (xqspi,GQSPI_TX_FIFO_FILL ); - ret =IRQ_HANDLED ; - } -if (dma_status &GQSPI_QSPIDMA_DST_I_STS_DONE_MASK ) { +if (dma_status &GQSPI_QSPIDMA_DST_I_STS_DONE_MASK )zynqmp_process_dma_irq (xqspi); - ret =IRQ_HANDLED ; - }else if (!(mask &GQSPI_IER_RXEMPTY_MASK ) && - (mask &GQSPI_IER_GENFIFOEMPTY_MASK )) { +else if (!(mask &GQSPI_IER_RXEMPTY_MASK ) && + (mask &GQSPI_IER_GENFIFOEMPTY_MASK ))zynqmp_qspi_readrxfifo (xqspi,GQSPI_RX_FIFO_FILL ); - ret =IRQ_HANDLED ; - }if (xqspi->bytes_to_receive ==0 && xqspi->bytes_to_transfer ==0 && ((status &GQSPI_IRQ_MASK ) ==GQSPI_IRQ_MASK )) {zynqmp_gqspi_write (xqspi,GQSPI_IDR_OFST ,GQSPI_ISR_IDR_MASK );complete (&xqspi->data_completion); - ret =IRQ_HANDLED ; } -return ret; +return IRQ_HANDLED ; }/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 150/207 regulator: ad5398: Add device tree support
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Isaac Scott <[email protected]>
[ Upstream commit 5a6a461079decea452fdcae955bccecf92e07e97 ]
Previously, the ad5398 driver used only platform_data, which is deprecated in favour of device tree. This caused the AD5398 to fail to probe as it could not load its init_data. If the AD5398 has a device tree node, pull the init_data from there using of_get_regulator_init_data.
--- drivers/regulator/ad5398.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/regulator/ad5398.c +9 -3
@@ -14,6 +14,7 @@#include <linux/platform_device.h> #include <linux/regulator/driver.h> #include <linux/regulator/machine.h> +#include <linux/regulator/of_regulator.h> #define AD5398_CURRENT_EN_MASK 0x8000
@@ -221,15 +222,20 @@ static int ad5398_probe(struct i2c_client *client,const struct ad5398_current_data_format *df = (struct ad5398_current_data_format *)id->driver_data; -if (!init_data) -return -EINVAL ; - chip =devm_kzalloc (&client->dev,sizeof (*chip),GFP_KERNEL );if (!chip)return -ENOMEM ; config.dev = &client->dev; +if (client->dev.of_node) + init_data =of_get_regulator_init_data (&client->dev, + client->dev.of_node, + &ad5398_reg); +if (!init_data) +return -EINVAL ; + config.init_data = init_data; + config.of_node = client->dev.of_node; config.driver_data = chip; chip->client = client;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 151/207 wifi: ath9k: return by of_get_mac_address
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit dfffb317519f88534bb82797f055f0a2fd867e7b ]
When using nvmem, ath9k could potentially be loaded before nvmem, which loads after mtd. This is an issue if DT contains an nvmem mac address.
If nvmem is not ready in time for ath9k, -EPROBE_DEFER is returned. Pass it to _probe so that ath9k can properly grab a potentially present MAC address.
--- drivers/net/wireless/ath/ath9k/init.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/init.c +3 -1
@@ -639,7 +639,9 @@ static int ath9k_of_init(struct ath_softc *sc) ah->ah_flags |=AH_NO_EEP_SWAP ; } -of_get_mac_address (np, common->macaddr); + ret =of_get_mac_address (np, common->macaddr); +if (ret == -EPROBE_DEFER ) +return ret;return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 152/207 drm/atomic: clarify the rules around drm_atomic_state->allow_modeset
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simona Vetter <[email protected]>
[ Upstream commit c5e3306a424b52e38ad2c28c7f3399fcd03e383d ]
msm is automagically upgrading normal commits to full modesets, and that's a big no-no:
- for one this results in full on->off->on transitions on all these crtc, at least if you're using the usual helpers. Which seems to be the case, and is breaking uapi
- further even if the ctm change itself would not result in flicker, this can hide modesets for other reasons. Which again breaks the uapi
v2: I forgot the case of adding unrelated crtc state. Add that case and link to the existing kerneldoc explainers. This has come up in an irc discussion with Manasi and Ville about intel's bigjoiner mode. Also cc everyone involved in the msm irc discussion, more people joined after I sent out v1.
v3: Wording polish from Pekka and Thomas
--- include/drm/drm_atomic.h | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-)
include/drm/drm_atomic.h +21 -2
@@ -353,8 +353,27 @@ struct drm_atomic_state {* * Allow full modeset. This is used by the ATOMIC IOCTL handler to * implement the DRM_MODE_ATOMIC_ALLOW_MODESET flag. Drivers should -* never consult this flag, instead looking at the output of -* drm_atomic_crtc_needs_modeset(). +* generally not consult this flag, but instead look at the output of +* drm_atomic_crtc_needs_modeset(). The detailed rules are: +* +* - Drivers must not consult @allow_modeset in the atomic commit path. +* Use drm_atomic_crtc_needs_modeset() instead. +* +* - Drivers must consult @allow_modeset before adding unrelated struct +* drm_crtc_state to this commit by calling +* drm_atomic_get_crtc_state(). See also the warning in the +* documentation for that function. +* +* - Drivers must never change this flag, it is under the exclusive +* control of userspace. +* +* - Drivers may consult @allow_modeset in the atomic check path, if +* they have the choice between an optimal hardware configuration +* which requires a modeset, and a less optimal configuration which +* can be committed without a modeset. An example would be suboptimal +* scanout FIFO allocation resulting in increased idle power +* consumption. This allows userspace to avoid flickering and delays +* for the normal composition loop at reasonable cost. */ bool allow_modeset : 1;/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 153/207 drm: Add valid clones check
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jessica Zhang <[email protected]>
[ Upstream commit 41b4b11da02157c7474caf41d56baae0e941d01a ]
Check that all encoders attached to a given CRTC are valid possible_clones of each other.
--- drivers/gpu/drm/drm_atomic_helper.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
drivers/gpu/drm/drm_atomic_helper.c +28 -0
@@ -563,6 +563,30 @@ mode_valid(struct drm_atomic_state *state)return 0 ; } +static int drm_atomic_check_valid_clones (struct drm_atomic_state *state, +struct drm_crtc *crtc) +{ +struct drm_encoder *drm_enc; +struct drm_crtc_state *crtc_state =drm_atomic_get_new_crtc_state (state, + crtc); + +drm_for_each_encoder_mask (drm_enc, crtc->dev, crtc_state->encoder_mask) { +if (!drm_enc->possible_clones) { +DRM_DEBUG ("enc%d possible_clones is 0\n" , drm_enc->base.id); +continue ; + } + +if ((crtc_state->encoder_mask & drm_enc->possible_clones) != + crtc_state->encoder_mask) { +DRM_DEBUG ("crtc%d failed valid clone check for mask 0x%x\n" , + crtc->base.id, crtc_state->encoder_mask); +return -EINVAL ; + } + } + +return 0 ; +} +/** * drm_atomic_helper_check_modeset - validate state object for modeset changes * @dev: DRM device
@@ -729,6 +753,10 @@ drm_atomic_helper_check_modeset(struct drm_device *dev, ret =drm_atomic_add_affected_planes (state, crtc);if (ret !=0 )return ret; + + ret =drm_atomic_check_valid_clones (state, crtc); +if (ret !=0 ) +return ret; }/*
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 154/207 ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenyuan Yang <[email protected]>
[ Upstream commit a9a69c3b38c89d7992fb53db4abb19104b531d32 ]
Incorrect types are used as sizeof() arguments in devm_kcalloc(). It should be sizeof(dai_link_data) for link_data instead of sizeof(snd_soc_dai_link).
This is found by our static analysis tool.
--- sound/soc/fsl/imx-card.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/fsl/imx-card.c +1 -1
@@ -517,7 +517,7 @@ static int imx_card_parse_of(struct imx_card_data *data)if (!card->dai_link)return -ENOMEM ; - data->link_data =devm_kcalloc (dev, num_links,sizeof (*link),GFP_KERNEL ); + data->link_data =devm_kcalloc (dev, num_links,sizeof (*link_data),GFP_KERNEL );if (!data->link_data)return -ENOMEM ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 155/207 pinctrl: meson: define the pull up/down resistor value as 60 kOhm
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Blumenstingl <[email protected]>
[ Upstream commit e56088a13708757da68ad035269d69b93ac8c389 ]
The public datasheets of the following Amlogic SoCs describe a typical resistor value for the built-in pull up/down resistor:
- Meson8/8b/8m2: not documented
- GXBB (S905): 60 kOhm
- GXL (S905X): 60 kOhm
- GXM (S912): 60 kOhm
- G12B (S922X): 60 kOhm
- SM1 (S905D3): 60 kOhm
The public G12B and SM1 datasheets additionally state min and max values:
- min value: 50 kOhm for both, pull-up and pull-down
- max value for the pull-up: 70 kOhm
- max value for the pull-down: 130 kOhm
Use 60 kOhm in the pinctrl-meson driver as well so it's shown in the debugfs output. It may not be accurate for Meson8/8b/8m2 but in reality 60 kOhm is closer to the actual value than 1 Ohm.
--- drivers/pinctrl/meson/pinctrl-meson.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/meson/pinctrl-meson.c +1 -1
@@ -486,7 +486,7 @@ static int meson_pinconf_get(struct pinctrl_dev *pcdev, unsigned int pin,case PIN_CONFIG_BIAS_PULL_DOWN :case PIN_CONFIG_BIAS_PULL_UP :if (meson_pinconf_get_pull (pc, pin) == param) - arg =1 ; + arg =60000 ;else return -EINVAL ;break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 156/207 ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit a549b927ea3f5e50b1394209b64e6e17e31d4db8 ]
Acer Aspire SW3-013 requires the very same quirk as other Acer Aspire model for making it working.
--- sound/soc/intel/boards/bytcr_rt5640.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
sound/soc/intel/boards/bytcr_rt5640.c +13 -0
@@ -573,6 +573,19 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {BYT_RT5640_SSP0_AIF2 | BYT_RT5640_MCLK_EN), }, + { /* Acer Aspire SW3-013 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), + DMI_MATCH(DMI_PRODUCT_NAME, "Aspire SW3-013"), + }, + .driver_data = (void *)(BYT_RT5640_DMIC1_MAP | +BYT_RT5640_JD_SRC_JD2_IN4N | +BYT_RT5640_OVCD_TH_2000UA | +BYT_RT5640_OVCD_SF_0P75 | +BYT_RT5640_DIFF_MIC | +BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, { .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 157/207 ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit be0c40da888840fe91b45474cb70779e6cbaf7ca ]
HP Spectre x360 15-df1xxx with SSID 13c:863e requires similar workarounds that were applied to another HP Spectre x360 models; it has a mute LED only, no micmute LEDs, and needs the speaker GPIO seup.
--- sound/pci/hda/patch_realtek.c | 42 +++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+)
sound/pci/hda/patch_realtek.c +42 -0
@@ -6758,6 +6758,41 @@ static void alc285_fixup_hp_spectre_x360_eb1(struct hda_codec *codec, } } +/* GPIO1 = amplifier on/off */ +static void alc285_fixup_hp_spectre_x360_df1 (struct hda_codec *codec, +const struct hda_fixup *fix, +int action) +{ +struct alc_spec *spec = codec->spec; +static const hda_nid_t conn[] = {0x02 }; +static const struct hda_pintbl pincfgs[] = { + {0x14 ,0x90170110 },/* front/high speakers */ + {0x17 ,0x90170130 },/* back/bass speakers */ + { } + }; + +// enable mute led +alc285_fixup_hp_mute_led_coefbit (codec, fix, action); + +switch (action) { +case HDA_FIXUP_ACT_PRE_PROBE : +/* needed for amp of back speakers */ + spec->gpio_mask |=0x01 ; + spec->gpio_dir |=0x01 ; +snd_hda_apply_pincfgs (codec, pincfgs); +/* share DAC to have unified volume control */ +snd_hda_override_conn_list (codec,0x14 ,ARRAY_SIZE (conn), conn); +snd_hda_override_conn_list (codec,0x17 ,ARRAY_SIZE (conn), conn); +break ; +case HDA_FIXUP_ACT_INIT : +/* need to toggle GPIO to enable the amp of back speakers */ +alc_update_gpio_data (codec,0x01 , true); +msleep (100 ); +alc_update_gpio_data (codec,0x01 , false); +break ; + } +} +static void alc285_fixup_hp_spectre_x360 (struct hda_codec *codec,const struct hda_fixup *fix,int action) {
@@ -7040,6 +7075,7 @@ enum {ALC280_FIXUP_HP_9480M ,ALC245_FIXUP_HP_X360_AMP ,ALC285_FIXUP_HP_SPECTRE_X360_EB1 , +ALC285_FIXUP_HP_SPECTRE_X360_DF1 ,ALC285_FIXUP_HP_ENVY_X360 ,ALC288_FIXUP_DELL_HEADSET_MODE , ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
@@ -8881,6 +8917,10 @@ static const struct hda_fixup alc269_fixups[] = { .type = HDA_FIXUP_FUNC, .v.func = alc285_fixup_hp_spectre_x360_eb1 }, + [ALC285_FIXUP_HP_SPECTRE_X360_DF1] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_hp_spectre_x360_df1 + }, [ALC285_FIXUP_HP_ENVY_X360] = { .type = HDA_FIXUP_FUNC, .v.func = alc285_fixup_hp_envy_x360,
@@ -9286,6 +9326,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x86c1 ,"HP Laptop 15-da3001TU" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ),SND_PCI_QUIRK (0x103c ,0x86c7 ,"HP Envy AiO 32" ,ALC274_FIXUP_HP_ENVY_GPIO ),SND_PCI_QUIRK (0x103c ,0x86e7 ,"HP Spectre x360 15-eb0xxx" ,ALC285_FIXUP_HP_SPECTRE_X360_EB1 ), +SND_PCI_QUIRK (0x103c ,0x863e ,"HP Spectre x360 15-df1xxx" ,ALC285_FIXUP_HP_SPECTRE_X360_DF1 ),SND_PCI_QUIRK (0x103c ,0x86e8 ,"HP Spectre x360 15-eb0xxx" ,ALC285_FIXUP_HP_SPECTRE_X360_EB1 ),SND_PCI_QUIRK (0x103c ,0x86f9 ,"HP Spectre x360 13-aw0xxx" ,ALC285_FIXUP_HP_SPECTRE_X360_MUTE_LED ), SND_PCI_QUIRK(0x103c, 0x8716, "HP Elite Dragonfly G2 Notebook PC", ALC285_FIXUP_HP_GPIO_AMP_INIT),
@@ -9832,6 +9873,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { {.id = ALC295_FIXUP_HP_OMEN, .name = "alc295-hp-omen"}, {.id = ALC285_FIXUP_HP_SPECTRE_X360, .name = "alc285-hp-spectre-x360"}, {.id = ALC285_FIXUP_HP_SPECTRE_X360_EB1, .name = "alc285-hp-spectre-x360-eb1"}, + {.id = ALC285_FIXUP_HP_SPECTRE_X360_DF1, .name = "alc285-hp-spectre-x360-df1"}, {.id = ALC285_FIXUP_HP_ENVY_X360, .name = "alc285-hp-envy-x360"}, {.id = ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP, .name = "alc287-ideapad-bass-spk-amp"}, {.id = ALC623_FIXUP_LENOVO_THINKSTATION_P340, .name = "alc623-lenovo-thinkstation-p340"},
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 158/207 nvmet-tcp: dont restore null sk_state_change
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alistair Francis <[email protected]>
[ Upstream commit 46d22b47df2741996af277a2838b95f130436c13 ]
queue->state_change is set as part of nvmet_tcp_set_queue_sock(), but if the TCP connection isn't established when nvmet_tcp_set_queue_sock() is called then queue->state_change isn't set and sock->sk->sk_state_change isn't replaced.
As such we don't need to restore sock->sk->sk_state_change if queue->state_change is NULL.
This avoids NULL pointer dereferences such as this:
[ 286.462026][ C0] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 286.462814][ C0] #PF: supervisor instruction fetch in kernel mode [ 286.463796][ C0] #PF: error_code(0x0010) - not-present page [ 286.464392][ C0] PGD 8000000140620067 P4D 8000000140620067 PUD 114201067 PMD 0 [ 286.465086][ C0] Oops: Oops: 0010 [#1] SMP KASAN PTI [ 286.465559][ C0] CPU: 0 UID: 0 PID: 1628 Comm: nvme Not tainted 6.15.0-rc2+ #11 PREEMPT(voluntary) [ 286.466393][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 [ 286.467147][ C0] RIP: 0010:0x0 [ 286.467420][ C0] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 286.467977][ C0] RSP: 0018:ffff8883ae008580 EFLAGS: 00010246 [ 286.468425][ C0] RAX: 0000000000000000 RBX: ffff88813fd34100 RCX: ffffffffa386cc43 [ 286.469019][ C0] RDX: 1ffff11027fa68b6 RSI: 0000000000000008 RDI: ffff88813fd34100 [ 286.469545][ C0] RBP: ffff88813fd34160 R08: 0000000000000000 R09: ffffed1027fa682c [ 286.470072][ C0] R10: ffff88813fd34167 R11: 0000000000000000 R12: ffff88813fd344c3 [ 286.470585][ C0] R13: ffff88813fd34112 R14: ffff88813fd34aec R15: ffff888132cdd268 [ 286.471070][ C0] FS: 00007fe3c04c7d80(0000) GS:ffff88840743f000(0000) knlGS:0000000000000000 [ 286.471644][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 286.472543][ C0] CR2: ffffffffffffffd6 CR3: 000000012daca000 CR4: 00000000000006f0 [ 286.473500][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 286.474467][ C0] DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7: 0000000000000400 [ 286.475453][ C0] Call Trace: [ 286.476102][ C0] <IRQ> [ 286.476719][ C0] tcp_fin+0x2bb/0x440 [ 286.477429][ C0] tcp_data_queue+0x190f/0x4e60 [ 286.478174][ C0] ? __build_skb_around+0x234/0x330 [ 286.478940][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.479659][ C0] ? __pfx_tcp_data_queue+0x10/0x10 [ 286.480431][ C0] ? tcp_try_undo_loss+0x640/0x6c0 [ 286.481196][ C0] ? seqcount_lockdep_reader_access.constprop.0+0x82/0x90 [ 286.482046][ C0] ? kvm_clock_get_cycles+0x14/0x30 [ 286.482769][ C0] ? ktime_get+0x66/0x150 [ 286.483433][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.484146][ C0] tcp_rcv_established+0x6e4/0x2050 [ 286.484857][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.485523][ C0] ? ipv4_dst_check+0x160/0x2b0 [ 286.486203][ C0] ? __pfx_tcp_rcv_established+0x10/0x10 [ 286.486917][ C0] ? lock_release+0x217/0x2c0 [ 286.487595][ C0] tcp_v4_do_rcv+0x4d6/0x9b0 [ 286.488279][ C0] tcp_v4_rcv+0x2af8/0x3e30 [ 286.488904][ C0] ? raw_local_deliver+0x51b/0xad0 [ 286.489551][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.490198][ C0] ? __pfx_tcp_v4_rcv+0x10/0x10 [ 286.490813][ C0] ? __pfx_raw_local_deliver+0x10/0x10 [ 286.491487][ C0] ? __pfx_nf_confirm+0x10/0x10 [nf_conntrack] [ 286.492275][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.492900][ C0] ip_protocol_deliver_rcu+0x8f/0x370 [ 286.493579][ C0] ip_local_deliver_finish+0x297/0x420 [ 286.494268][ C0] ip_local_deliver+0x168/0x430 [ 286.494867][ C0] ? __pfx_ip_local_deliver+0x10/0x10 [ 286.495498][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 286.496204][ C0] ? ip_rcv_finish_core+0x19a/0x1f20 [ 286.496806][ C0] ? lock_release+0x217/0x2c0 [ 286.497414][ C0] ip_rcv+0x455/0x6e0 [ 286.497945][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 286.498550][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.499137][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 286.499763][ C0] ? lock_release+0x217/0x2c0 [ 286.500327][ C0] ? dl_scaled_delta_exec+0xd1/0x2c0 [ 286.500922][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 286.501480][ C0] __netif_receive_skb_one_core+0x166/0x1b0 [ 286.502173][ C0] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 286.502903][ C0] ? lock_acquire+0x2b2/0x310 [ 286.503487][ C0] ? process_backlog+0x372/0x1350 [ 286.504087][ C0] ? lock_release+0x217/0x2c0 [ 286.504642][ C0] process_backlog+0x3b9/0x1350 [ 286.505214][ C0] ? process_backlog+0x372/0x1350 [ 286.505779][ C0] __napi_poll.constprop.0+0xa6/0x490 [ 286.506363][ C0] net_rx_action+0x92e/0xe10 [ 286.506889][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 286.507437][ C0] ? timerqueue_add+0x1f0/0x320 [ 286.507977][ C0] ? sched_clock_cpu+0x68/0x540 [ 286.508492][ C0] ? lock_acquire+0x2b2/0x310 [ 286.509043][ C0] ? kvm_sched_clock_read+0xd/0x20 [ 286.509607][ C0] ? handle_softirqs+0x1aa/0x7d0 [ 286.510187][ C0] handle_softirqs+0x1f2/0x7d0 [ 286.510754][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 286.511348][ C0] ? irqtime_account_irq+0x181/0x290 [ 286.511937][ C0] ? __dev_queue_xmit+0x85d/0x3450 [ 286.512510][ C0] do_softirq.part.0+0x89/0xc0 [ 286.513100][ C0] </IRQ> [ 286.513548][ C0] <TASK> [ 286.513953][ C0] __local_bh_enable_ip+0x112/0x140 [ 286.514522][ C0] ? __dev_queue_xmit+0x85d/0x3450 [ 286.515072][ C0] __dev_queue_xmit+0x872/0x3450 [ 286.515619][ C0] ? nft_do_chain+0xe16/0x15b0 [nf_tables] [ 286.516252][ C0] ? __pfx___dev_queue_xmit+0x10/0x10 [ 286.516817][ C0] ? selinux_ip_postroute+0x43c/0xc50 [ 286.517433][ C0] ? __pfx_selinux_ip_postroute+0x10/0x10 [ 286.518061][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.518606][ C0] ? ip_output+0x164/0x4a0 [ 286.519149][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.519671][ C0] ? ip_finish_output2+0x17d5/0x1fb0 [ 286.520258][ C0] ip_finish_output2+0xb4b/0x1fb0 [ 286.520787][ C0] ? __pfx_ip_finish_output2+0x10/0x10 [ 286.521355][ C0] ? __ip_finish_output+0x15d/0x750 [ 286.521890][ C0] ip_output+0x164/0x4a0 [ 286.522372][ C0] ? __pfx_ip_output+0x10/0x10 [ 286.522872][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.523402][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x60 [ 286.524031][ C0] ? __pfx_ip_finish_output+0x10/0x10 [ 286.524605][ C0] ? __ip_queue_xmit+0x999/0x2260 [ 286.525200][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.525744][ C0] ? ipv4_dst_check+0x16a/0x2b0 [ 286.526279][ C0] ? lock_release+0x217/0x2c0 [ 286.526793][ C0] __ip_queue_xmit+0x1883/0x2260 [ 286.527324][ C0] ? __skb_clone+0x54c/0x730 [ 286.527827][ C0] __tcp_transmit_skb+0x209b/0x37a0 [ 286.528374][ C0] ? __pfx___tcp_transmit_skb+0x10/0x10 [ 286.528952][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.529472][ C0] ? seqcount_lockdep_reader_access.constprop.0+0x82/0x90 [ 286.530152][ C0] ? trace_hardirqs_on+0x12/0x120 [ 286.530691][ C0] tcp_write_xmit+0xb81/0x88b0 [ 286.531224][ C0] ? mod_memcg_state+0x4d/0x60 [ 286.531736][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.532253][ C0] __tcp_push_pending_frames+0x90/0x320 [ 286.532826][ C0] tcp_send_fin+0x141/0xb50 [ 286.533352][ C0] ? __pfx_tcp_send_fin+0x10/0x10 [ 286.533908][ C0] ? __local_bh_enable_ip+0xab/0x140 [ 286.534495][ C0] inet_shutdown+0x243/0x320 [ 286.535077][ C0] nvme_tcp_alloc_queue+0xb3b/0x2590 [nvme_tcp] [ 286.535709][ C0] ? do_raw_spin_lock+0x129/0x260 [ 286.536314][ C0] ? __pfx_nvme_tcp_alloc_queue+0x10/0x10 [nvme_tcp] [ 286.536996][ C0] ? do_raw_spin_unlock+0x54/0x1e0 [ 286.537550][ C0] ? _raw_spin_unlock+0x29/0x50 [ 286.538127][ C0] ? do_raw_spin_lock+0x129/0x260 [ 286.538664][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 286.539249][ C0] ? nvme_tcp_alloc_admin_queue+0xd5/0x340 [nvme_tcp] [ 286.539892][ C0] ? __wake_up+0x40/0x60 [ 286.540392][ C0] nvme_tcp_alloc_admin_queue+0xd5/0x340 [nvme_tcp] [ 286.541047][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.541589][ C0] nvme_tcp_setup_ctrl+0x8b/0x7a0 [nvme_tcp] [ 286.542254][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x60 [ 286.542887][ C0] ? __pfx_nvme_tcp_setup_ctrl+0x10/0x10 [nvme_tcp] [ 286.543568][ C0] ? trace_hardirqs_on+0x12/0x120 [ 286.544166][ C0] ? _raw_spin_unlock_irqrestore+0x35/0x60 [ 286.544792][ C0] ? nvme_change_ctrl_state+0x196/0x2e0 [nvme_core] [ 286.545477][ C0] nvme_tcp_create_ctrl+0x839/0xb90 [nvme_tcp] [ 286.546126][ C0] nvmf_dev_write+0x3db/0x7e0 [nvme_fabrics] [ 286.546775][ C0] ? rw_verify_area+0x69/0x520 [ 286.547334][ C0] vfs_write+0x218/0xe90 [ 286.547854][ C0] ? do_syscall_64+0x9f/0x190 [ 286.548408][ C0] ? trace_hardirqs_on_prepare+0xdb/0x120 [ 286.549037][ C0] ? syscall_exit_to_user_mode+0x93/0x280 [ 286.549659][ C0] ? __pfx_vfs_write+0x10/0x10 [ 286.550259][ C0] ? do_syscall_64+0x9f/0x190 [ 286.550840][ C0] ? syscall_exit_to_user_mode+0x8e/0x280 [ 286.551516][ C0] ? trace_hardirqs_on_prepare+0xdb/0x120 [ 286.552180][ C0] ? syscall_exit_to_user_mode+0x93/0x280 [ 286.552834][ C0] ? ksys_read+0xf5/0x1c0 [ 286.553386][ C0] ? __pfx_ksys_read+0x10/0x10 [ 286.553964][ C0] ksys_write+0xf5/0x1c0 [ 286.554499][ C0] ? __pfx_ksys_write+0x10/0x10 [ 286.555072][ C0] ? trace_hardirqs_on_prepare+0xdb/0x120 [ 286.555698][ C0] ? syscall_exit_to_user_mode+0x93/0x280 [ 286.556319][ C0] ? do_syscall_64+0x54/0x190 [ 286.556866][ C0] do_syscall_64+0x93/0x190 [ 286.557420][ C0] ? rcu_read_unlock+0x17/0x60 [ 286.557986][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.558526][ C0] ? lock_release+0x217/0x2c0 [ 286.559087][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.559659][ C0] ? count_memcg_events.constprop.0+0x4a/0x60 [ 286.560476][ C0] ? exc_page_fault+0x7a/0x110 [ 286.561064][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.561647][ C0] ? lock_release+0x217/0x2c0 [ 286.562257][ C0] ? do_user_addr_fault+0x171/0xa00 [ 286.562839][ C0] ? do_user_addr_fault+0x4a2/0xa00 [ 286.563453][ C0] ? irqentry_exit_to_user_mode+0x84/0x270 [ 286.564112][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.564677][ C0] ? irqentry_exit_to_user_mode+0x84/0x270 [ 286.565317][ C0] ? trace_hardirqs_on_prepare+0xdb/0x120 [ 286.565922][ C0] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 286.566542][ C0] RIP: 0033:0x7fe3c05e6504 [ 286.567102][ C0] Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d c5 8b 10 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89 [ 286.568931][ C0] RSP: 002b:00007fff76444f58 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 286.569807][ C0] RAX: ffffffffffffffda RBX: 000000003b40d930 RCX: 00007fe3c05e6504 [ 286.570621][ C0] RDX: 00000000000000cf RSI: 000000003b40d930 RDI: 0000000000000003 [ 286.571443][ C0] RBP: 0000000000000003 R08: 00000000000000cf R09: 000000003b40d930 [ 286.572246][ C0] R10: 0000000000000000 R11: 0000000000000202 R12: 000000003b40cd60 [ 286.573069][ C0] R13: 00000000000000cf R14: 00007fe3c07417f8 R15: 00007fe3c073502e [ 286.573886][ C0] </TASK>
--- drivers/nvme/target/tcp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/nvme/target/tcp.c +3 -0
@@ -1425,6 +1425,9 @@ static void nvmet_tcp_restore_socket_callbacks(struct nvmet_tcp_queue *queue) {struct socket *sock = queue->sock; +if (!queue->state_change) +return ; +write_lock_bh (&sock->sk->sk_callback_lock); sock->sk->sk_data_ready = queue->data_ready; sock->sk->sk_state_change = queue->state_change;
Signature · 1 line
2.39.5