6.16.4-rc1 review
Subsystems (6)
Greg Kroah-Hartman
maintainercover 6.16.4-rc1 review
This is the start of the stable review cycle for the 6.16.4 release. There are 457 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 28 Aug 2025 11:08:27 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.16.4-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.16.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.16.4-rc1
Christoph Manszewski <[email protected]>
drm/xe: Fix vm_bind_ioctl double free bug
Piotr Piórkowski <[email protected]>
drm/xe: Move ASID allocation and user PT BO tracking into xe_vm_create
Florian Westphal <[email protected]>
netfilter: nf_reject: don't leak dst refcount for loopback packets
Peter Oberparleiter <[email protected]>
s390/hypfs: Enable limited access during lockdown
Peter Oberparleiter <[email protected]>
s390/hypfs: Avoid unnecessary ioctl registration in debugfs
Takashi Iwai <[email protected]>
ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
Armen Ratner <[email protected]>
net/mlx5e: Preserve shared buffer capacity during headroom updates
Alexei Lazar <[email protected]>
net/mlx5e: Query FW for buffer ownership
Oren Sidi <[email protected]>
net/mlx5: Add IFC bits and enums for buf_ownership
Daniel Jurgens <[email protected]>
net/mlx5: Base ECVF devlink port attrs from 0
Hariprasad Kelam <[email protected]>
Octeontx2-af: Skip overlap check for SPI field
Nilay Shroff <[email protected]>
block: avoid cpu_hotplug_lock depedency on freeze_lock
Nilay Shroff <[email protected]>
block: skip q->rq_qos check in rq_qos_done_bio()
Nilay Shroff <[email protected]>
block: decrement block_rq_qos static key in rq_qos_del()
Ming Lei <[email protected]>
blk-mq: fix lockdep warning in __blk_mq_update_nr_hw_queues
Nilay Shroff <[email protected]>
block: fix potential deadlock while running nr_hw_queue update
Nilay Shroff <[email protected]>
block: fix lockdep warning caused by lock dependency in elv_iosched_store
Nilay Shroff <[email protected]>
block: move elevator queue allocation logic into blk_mq_init_sched
Lorenzo Bianconi <[email protected]>
net: airoha: ppe: Do not invalid PPE entries in case of SW hash collision
Hangbin Liu <[email protected]>
bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU
Hangbin Liu <[email protected]>
bonding: update LACP activity flag after setting lacp_active
Dewei Meng <[email protected]>
ALSA: timer: fix ida_free call while not allocated
William Liu <[email protected]>
net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate
William Liu <[email protected]>
net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
Tristram Ha <[email protected]>
net: dsa: microchip: Fix KSZ9477 HSR port setup issue
ValdikSS <[email protected]>
igc: fix disabling L1.2 PCI-E link substate on I226 on init
Jason Xing <[email protected]>
ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
Song Gao <[email protected]>
LoongArch: KVM: Use kvm_get_vcpu_by_id() instead of kvm_get_vcpu()
Bibo Mao <[email protected]>
LoongArch: KVM: Use standard bitops API with eiointc
Heiko Carstens <[email protected]>
s390/mm: Do not map lowcore with identity mapping
Stefan Binding <[email protected]>
ASoC: cs35l56: Remove SoundWire Clock Divider workaround for CS35L63
Richard Fitzgerald <[email protected]>
ASoC: cs35l56: Handle new algorithms IDs for CS35L63
Stefan Binding <[email protected]>
ASoC: cs35l56: Update Firmware Addresses for CS35L63 for production silicon
Kanglong Wang <[email protected]>
LoongArch: Optimize module load time by optimizing PLT/GOT counting
Tiezhu Yang <[email protected]>
LoongArch: Pass annotate-tablejump option if LTO is enabled
Tiezhu Yang <[email protected]>
objtool/LoongArch: Get table size correctly if LTO is enabled
Parthiban Veerasooran <[email protected]>
microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1
Parthiban Veerasooran <[email protected]>
microchip: lan865x: fix missing netif_start_queue() call on device open
Vlad Dogaru <[email protected]>
net/mlx5: CT: Use the correct counter offset
Alex Vesker <[email protected]>
net/mlx5: HWS, Fix table creation UID
Yevgeny Kliteynik <[email protected]>
net/mlx5: HWS, fix complex rules rehash error flow
Yevgeny Kliteynik <[email protected]>
net/mlx5: HWS, fix bad parameter in CQ creation
D. Wythe <[email protected]>
net/smc: fix UAF on smcsk after smc_listen_out()
Yao Zi <[email protected]>
net: stmmac: thead: Enable TX clock before MAC initialization
Jordan Rhee <[email protected]>
gve: prevent ethtool ops after shutdown
Yuichiro Tsuji <[email protected]>
net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
Horatiu Vultur <[email protected]>
phy: mscc: Fix timestamping for vsc8584
David Howells <[email protected]>
cifs: Fix oops due to uninitialised variable
Dan Carpenter <[email protected]>
regulator: tps65219: regulator: tps65219: Fix error codes in probe()
Piotr Piórkowski <[email protected]>
drm/xe: Assign ioctl xe file handler to vm in xe_vm_create
MD Danish Anwar <[email protected]>
net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload.
Qingfang Deng <[email protected]>
ppp: fix race conditions in ppp_fill_forward_path
Qingfang Deng <[email protected]>
net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path
Nitin Rawat <[email protected]>
scsi: ufs: ufs-qcom: Fix ESI null pointer dereference
Bao D. Nguyen <[email protected]>
scsi: ufs: ufs-qcom: Update esi_vec_mask for HW major version >= 6
Bart Van Assche <[email protected]>
scsi: ufs: core: Remove WARN_ON_ONCE() call from ufshcd_uic_cmd_compl()
Bart Van Assche <[email protected]>
scsi: ufs: core: Fix IRQ lock inversion for the SCSI host lock
Michael Chan <[email protected]>
bnxt_en: Fix lockdep warning during rmmod
Minhong He <[email protected]>
ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
Jakub Ramaseuski <[email protected]>
net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
Timur Kristóf <[email protected]>
drm/amd/display: Don't print errors for nonexistent connectors
Timur Kristóf <[email protected]>
drm/amd/display: Adjust DCE 8-10 clock, don't overclock by 15%
Chenyuan Yang <[email protected]>
drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session()
Peng Fan <[email protected]>
regulator: pca9450: Use devm_register_sys_off_handler
Dan Carpenter <[email protected]>
ALSA: usb-audio: Fix size validation in convert_chmap_v3()
Baihan Li <[email protected]>
drm/hisilicon/hibmc: fix dp and vga cannot show together
Baihan Li <[email protected]>
drm/hisilicon/hibmc: fix rare monitors cannot display problem
Baihan Li <[email protected]>
drm/hisilicon/hibmc: fix the hibmc loaded failed bug
Baihan Li <[email protected]>
drm/hisilicon/hibmc: fix irq_request()'s irq name variable is local
Baihan Li <[email protected]>
drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed
Miguel Ojeda <[email protected]>
rust: alloc: fix rusttest by providing Cmalloc::aligned_layout too
Zheng Qixing <[email protected]>
md: fix sync_action incorrect display during resync
Zheng Qixing <[email protected]>
md: add helper rdev_needs_recovery()
Li Nan <[email protected]>
md: rename recovery_cp to resync_offset
Miguel Ojeda <[email protected]>
drm: nova-drm: fix 32-bit arm build
Ido Schimmel <[email protected]>
mlxsw: spectrum: Forward packets with an IPv4 link-local source IP
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_core: Fix not accounting for BIS/CIS/PA links separately
Yang Li <[email protected]>
Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections
Sergey Shtylyov <[email protected]>
Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
Pauli Virtanen <[email protected]>
Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established
Yang Li <[email protected]>
Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_core: Fix using ll_privacy_capable for current settings
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_core: Fix using {cis,bis}_capable for current settings
Jiande Lu <[email protected]>
Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sync: Fix scan state after PA Sync has been established
Kees Cook <[email protected]>
iommu/amd: Avoid stack buffer overflow from kernel cmdline
Dan Carpenter <[email protected]>
scsi: qla4xxx: Prevent a potential error pointer dereference
Justin Lai <[email protected]>
rtase: Fix Rx descriptor CRC error bit definition
William Liu <[email protected]>
net/sched: Fix backlog accounting in qdisc_dequeue_internal
Wang Liang <[email protected]>
net: bridge: fix soft lockup in br_multicast_query_expired()
Suraj Gupta <[email protected]>
net: xilinx: axienet: Fix RX skb ring management in DMAengine mode
Junxian Huang <[email protected]>
RDMA/hns: Fix dip entries leak on devices newer than hip09
Akhilesh Patil <[email protected]>
RDMA/core: Free pfn_list with appropriate kvfree call
Anantha Prabhu <[email protected]>
RDMA/bnxt_re: Fix to initialize the PBL array
Kalesh AP <[email protected]>
RDMA/bnxt_re: Fix a possible memory leak in the driver
Kashyap Desai <[email protected]>
RDMA/bnxt_re: Fix to remove workload check in SRQ limit path
Kashyap Desai <[email protected]>
RDMA/bnxt_re: Fix to do SRQ armena by default
wenglianfa <[email protected]>
RDMA/hns: Fix querying wrong SCC context for DIP algorithm
Boshi Yu <[email protected]>
RDMA/erdma: Fix unset QPN of GSI QP
Boshi Yu <[email protected]>
RDMA/erdma: Fix ignored return value of init_kernel_qp
Suma Hegde <[email protected]>
platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL
Jocelyn Falempe <[email protected]>
drm/panic: Add a u64 divide by 10 for arm32
Danilo Krummrich <[email protected]>
rust: drm: don't pass the address of drm::Device to drm_dev_put()
Danilo Krummrich <[email protected]>
rust: drm: remove pin annotations from drm::Device
Danilo Krummrich <[email protected]>
rust: drm: ensure kmalloc() compatible Layout
Danilo Krummrich <[email protected]>
rust: alloc: replace aligned_size() with Kmalloc::aligned_layout()
Nitin Gote <[email protected]>
iosys-map: Fix undefined behavior in iosys_map_clear()
José Expósito <[email protected]>
drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian
Thomas Zimmermann <[email protected]>
drm/tests: Do not use drm_fb_blit() in format-helper tests
José Expósito <[email protected]>
drm/tests: Fix endian warning
Waiman Long <[email protected]>
cgroup/cpuset: Fix a partition error with CPU hotplug
Waiman Long <[email protected]>
cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key
Fanhua Li <[email protected]>
drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor().
Gabor Juhos <[email protected]>
spi: spi-qpic-snand: fix calculating of ECC OOB regions' properties
Stefan Wahren <[email protected]>
spi: spi-fsl-lpspi: Clamp too high speed_hz
Gabor Juhos <[email protected]>
spi: spi-qpic-snand: use correct CW_PER_PAGE value for OOB write
Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: change invalid data error to -EBUSY
Andy Shevchenko <[email protected]>
iio: imu: inv_icm42600: Convert to uXX and sXX integer types
David Lechner <[email protected]>
iio: imu: inv_icm42600: use = { } instead of memset()Jedrzej Jagielski <[email protected]>
ixgbe: prevent from unwanted interface name changes
Jedrzej Jagielski <[email protected]>
devlink: let driver opt out of automatic phys_port_name generation
Sven Eckelmann <[email protected]>
i2c: rtl9300: Add missing count byte for SMBus Block Ops
Sven Eckelmann <[email protected]>
i2c: rtl9300: Increase timeout for transfer polling
Harshal Gohel <[email protected]>
i2c: rtl9300: Fix multi-byte I2C write
Alex Guo <[email protected]>
i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer
Tianxiang Peng <[email protected]>
x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
Yazen Ghannam <[email protected]>
x86/CPU/AMD: Ignore invalid reset reason value
Jakub Kicinski <[email protected]>
tls: fix handling of zero-length records on the rx_list
Niklas Cassel <[email protected]>
PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up
NeilBrown <[email protected]>
ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp()
Pu Lehui <[email protected]>
tracing: Limit access to parser->buffer when trace_get_user failed
Steven Rostedt <[email protected]>
tracing: Remove unneeded goto out logic
Heikki Krogerus <[email protected]>
usb: dwc3: pci: add support for the Intel Wildcat Lake
Selvarasu Ganesan <[email protected]>
usb: dwc3: Remove WARN_ON for device endpoint command timeouts
Kuen-Han Tsai <[email protected]>
usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
Niklas Neronin <[email protected]>
usb: xhci: fix host not responding after suspend and resume
Weitao Wang <[email protected]>
usb: xhci: Fix slot_id resource race conflict
Amit Sunil Dhamne <[email protected]>
usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean
Amit Sunil Dhamne <[email protected]>
usb: typec: maxim_contaminant: disable low power mode when reading comparator values
Zenm Chen <[email protected]>
USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
Thorsten Blum <[email protected]>
usb: storage: realtek_cr: Use correct byte order for bcs->Residue
Mael GUERIN <[email protected]>
USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
Marek Vasut <[email protected]>
usb: renesas-xhci: Fix External ROM access timeouts
Xu Yang <[email protected]>
usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test
Ian Abbott <[email protected]>
comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl()
Edward Adam Davis <[email protected]>
comedi: pcl726: Prevent invalid irq number
Ian Abbott <[email protected]>
comedi: Make insn_rw_emulate_bits() do insn->n samples
Miao Li <[email protected]>
usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
Thorsten Blum <[email protected]>
cdx: Fix off-by-one error in cdx_rpmsg_probe()
Sebastian Andrzej Siewior <[email protected]>
kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq()
Miaoqian Lin <[email protected]>
most: core: Drop device reference after usage in get_channel()
Claudiu Beznea <[email protected]>
iio: adc: rzg2l: Cleanup suspend/resume path
David Lechner <[email protected]>
iio: proximity: isl29501: fix buffered read on big-endian systems
David Lechner <[email protected]>
iio: adc: ad7173: prevent scan if too many setups requested
Matti Vaittinen <[email protected]>
iio: adc: bd79124: Add GPIOLIB dependency
Claudiu Beznea <[email protected]>
iio: adc: rzg2l_adc: Set driver data before enabling runtime PM
Salah Triki <[email protected]>
iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
Jonathan Cameron <[email protected]>
iio: light: as73211: Ensure buffer holes are zeroed
David Lechner <[email protected]>
iio: adc: ad7124: fix channel lookup in syscalib functions
David Lechner <[email protected]>
iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read()
Steven Rostedt <[email protected]>
ftrace: Also allocate and copy hash for reading of filter files
David Lechner <[email protected]>
iio: accel: sca3300: fix uninitialized iio scan data
David Lechner <[email protected]>
iio: adc: ad7380: fix missing max_conversion_rate_hz on adaq4381-4
Xu Yilun <[email protected]>
fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
Imre Deak <[email protected]>
drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
Mario Limonciello <[email protected]>
drm/amd: Restore cached manual clock settings during resume
Robin Murphy <[email protected]>
iommu/virtio: Make instance lookup robust
Jason Gunthorpe <[email protected]>
iommu: Remove ops.pgsize_bitmap from drivers that don't use it
Al Viro <[email protected]>
use uniform permission checks for all mount propagation changes
Adrian Huang (Lenovo) <[email protected]>
signal: Fix memory leak for PIDFD_SELF* sentinels
Ye Bin <[email protected]>
fs/buffer: fix use-after-free when call bh_read() helper
Stefan Metzmacher <[email protected]>
smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy()
Christian Brauner <[email protected]>
libfs: massage path_from_stashed() to allow custom stashing behavior
Thomas Bertschinger <[email protected]>
fhandle: do_handle_open() should get FD with user flags
Naohiro Aota <[email protected]>
btrfs: zoned: fix data relocation block group reservation
Yuntao Wang <[email protected]>
fs: fix incorrect lflags value in the move_mount syscall
Charalampos Mitrodimas <[email protected]>
debugfs: fix mount options not being applied
Miguel Ojeda <[email protected]>
rust: faux: fix C header link
Christoph Hellwig <[email protected]>
xfs: fix frozen file system assert in xfs_trans_alloc
Dan Carpenter <[email protected]>
soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()
Liu01 Tong <[email protected]>
drm/amdgpu: fix task hang from failed job submission during process kill
Geraldo Nascimento <[email protected]>
PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining
Geraldo Nascimento <[email protected]>
PCI: rockchip: Use standard PCIe definitions
Ranjan Kumar <[email protected]>
scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems
Ranjan Kumar <[email protected]>
scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers
Timur Kristóf <[email protected]>
drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs
Timur Kristóf <[email protected]>
drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs
Timur Kristóf <[email protected]>
drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
Tom Chung <[email protected]>
drm/amd/display: Fix Xorg desktop unresponsive on Replay panel
Timur Kristóf <[email protected]>
drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
Timur Kristóf <[email protected]>
drm/amd/display: Don't overclock DCE 6 by 15%
Mario Limonciello <[email protected]>
drm/amd/display: Avoid a NULL pointer dereference
Imre Deak <[email protected]>
drm/i915/icl+/tc: Convert AUX powered WARN to a debug message
Imre Deak <[email protected]>
drm/i915/lnl+/tc: Use the cached max lane count value
Imre Deak <[email protected]>
drm/i915/lnl+/tc: Fix max lane count HW readout
Imre Deak <[email protected]>
drm/i915/icl+/tc: Cache the max lane count value
Imre Deak <[email protected]>
drm/i915/lnl+/tc: Fix handling of an enabled/disconnected dp-alt sink
Sebastian Brzezinka <[email protected]>
drm/i915/gt: Relocate compression repacking WA for JSL/EHL
Qianfeng Rong <[email protected]>
drm/nouveau/gsp: fix mismatched alloc/free for kvmalloc()
Jani Nikula <[email protected]>
drm/i915: silence rpm wakeref asserts on GEN11_GU_MISC_IIR access
Alex Deucher <[email protected]>
drm/amdgpu/swm14: Update power limit logic
Thorsten Blum <[email protected]>
accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc()
Jan Beulich <[email protected]>
compiler: remove __ADDRESSABLE_ASM{_STR,}() again
Srinivas Pandruvada <[email protected]>
platform/x86/intel-uncore-freq: Check write blocked for ELC
Peter Oberparleiter <[email protected]>
s390/sclp: Fix SCCB present check
Zhu Yanjun <[email protected]>
RDMA/rxe: Flush delayed SKBs while releasing RXE resources
Evgeniy Harchenko <[email protected]>
ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6
Takashi Iwai <[email protected]>
ALSA: hda: tas2781: Fix wrong reference of tasdevice_priv
David Hildenbrand <[email protected]>
mm/mremap: fix WARN with uffd that has remap events disabled
Jinjiang Tu <[email protected]>
mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn
Herton R. Krzesinski <[email protected]>
mm/debug_vm_pgtable: clear page table entries at destroy_args()
Sang-Heon Jeon <[email protected]>
mm/damon/core: fix damos_commit_filter not changing allow
Phillip Lougher <[email protected]>
squashfs: fix memory leak in squashfs_fill_super
Trond Myklebust <[email protected]>
NFS: Fix a race when updating an existing write
Judith Mendez <[email protected]>
mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1
Victor Shih <[email protected]>
mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency
Victor Shih <[email protected]>
mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER
Jiayi Li <[email protected]>
memstick: Fix deadlock by moving removing flag earlier
Pasha Tatashin <[email protected]>
kho: warn if KHO is disabled due to an error
Pasha Tatashin <[email protected]>
kho: mm: don't allow deferred struct page with KHO
Pasha Tatashin <[email protected]>
kho: init new_physxa->phys_bits to fix lockdep
Victor Shih <[email protected]>
mmc: sdhci-pci-gli: Add a new function to simplify the code
Sai Krishna Potthuri <[email protected]>
mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up
Sang-Heon Jeon <[email protected]>
mm/damon/core: fix commit_ops_filters by using correct nth function
Nicolin Chen <[email protected]>
iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement
Dominique Martinet <[email protected]>
iov_iter: iterate_folioq: fix handling of offset >= folio size
Jens Axboe <[email protected]>
io_uring/futex: ensure io_futex_wait() cleans up properly on failure
XianLiang Huang <[email protected]>
iommu/riscv: prevent NULL deref in iova_to_phys
Eric Biggers <[email protected]>
crypto: acomp - Fix CFI failure due to type punning
Geert Uytterhoeven <[email protected]>
erofs: Do not select tristate symbols from bool symbols
Bo Liu (OpenAnolis) <[email protected]>
erofs: fix build error with CONFIG_EROFS_FS_ZIP_ACCEL=y
Alan Huang <[email protected]>
xfs: Remove unused label in xfs_dax_notify_dev_failure
Christoph Hellwig <[email protected]>
xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
Christoph Hellwig <[email protected]>
xfs: improve the comments in xfs_select_zone_nowait
Christoph Hellwig <[email protected]>
xfs: return the allocated transaction from xfs_trans_alloc_empty
Christoph Hellwig <[email protected]>
xfs: decouple xfs_trans_alloc_empty from xfs_trans_alloc
Naohiro Aota <[email protected]>
btrfs: subpage: keep TOWRITE tag until folio is cleaned
Qu Wenruo <[email protected]>
btrfs: rename btrfs_subpage structure
Qu Wenruo <[email protected]>
btrfs: add comments on the extra btrfs specific subpage bitmaps
Leo Martins <[email protected]>
btrfs: fix subpage deadlock in try_release_subpage_extent_buffer()
Filipe Manana <[email protected]>
btrfs: use refcount_t type for the extent buffer reference counter
Filipe Manana <[email protected]>
btrfs: add comment for optimization in free_extent_buffer()
Filipe Manana <[email protected]>
btrfs: reorganize logic at free_extent_buffer() for better readability
Filipe Manana <[email protected]>
btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()
Filipe Manana <[email protected]>
btrfs: always abort transaction on failure to add block group to free space tree
David Sterba <[email protected]>
btrfs: move transaction aborts to the error site in add_block_group_free_space()
SeongJae Park <[email protected]>
mm/damon/ops-common: ignore migration request to invalid nodes
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: sockopt: fix C23 extension warning
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: connect: fix C23 extension warning
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: pm: check flush doesn't reset limits
Geliang Tang <[email protected]>
mptcp: disable add_addr retransmission when timeout is 0
Geliang Tang <[email protected]>
mptcp: remove duplicate sk_reset_timer call
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: kernel: flush: do not reset ADD_ADDR limit
Christoph Paasch <[email protected]>
mptcp: drop skb if MPTCP skb extension allocation fails
Uwe Kleine-König <[email protected]>
ACPI: APEI: EINJ: Fix resource leak by remove callback in .exit.text
Chen Yu <[email protected]>
ACPI: pfr_update: Fix the driver update version check
Rafael J. Wysocki <[email protected]>
cpuidle: governors: menu: Avoid selecting states with too much latency
JP Kobryn <[email protected]>
cgroup: avoid null de-ref in css_rstat_exit()
Eric Biggers <[email protected]>
ipv6: sr: Fix MAC comparison to be constant-time
Andrea Righi <[email protected]>
sched/ext: Fix invalid task state transitions on class switch
Jakub Acs <[email protected]>
net, hsr: reject HSR frame if skb can't hold tag
Bibo Mao <[email protected]>
LoongArch: KVM: Add address alignment check in pch_pic register access
Bibo Mao <[email protected]>
LoongArch: KVM: Fix stack protector issue in send_ipi_data()
Bibo Mao <[email protected]>
LoongArch: KVM: Make function kvm_own_lbt() robust
Timur Kristóf <[email protected]>
drm/amd/display: Don't overwrite dce60_clk_mgr
Mario Limonciello <[email protected]>
drm/amd/display: Revert "drm/amd/display: Fix AMDGPU_MAX_BL_LEVEL value"
Mario Limonciello <[email protected]>
drm/amd/display: Pass up errors for reset GPU that fails to init HW
Lauri Tirkkonen <[email protected]>
drm/amd/display: fix initial backlight brightness calculation
Timur Kristóf <[email protected]>
drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming.
Siyang Liu <[email protected]>
drm/amd/display: fix a Null pointer dereference vulnerability
Michel Dänzer <[email protected]>
drm/amd/display: Add primary plane to commits for correct VRR handling
David Yat Sin <[email protected]>
drm/amdkfd: Fix checkpoint-restore on multi-xcc
Amber Lin <[email protected]>
drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
Lijo Lazar <[email protected]>
drm/amdgpu: Update supported modes for GC v9.5.0
Alex Deucher <[email protected]>
drm/amdgpu: update mmhub 4.1.0 client id mappings
Alex Deucher <[email protected]>
drm/amdgpu: update mmhub 3.3 client id mappings
Alex Deucher <[email protected]>
drm/amdgpu: update mmhub 3.0.1 client id mappings
Lijo Lazar <[email protected]>
drm/amdgpu: Update external revid for GC v9.5.0
Alex Deucher <[email protected]>
drm/amdgpu: track whether a queue is a kernel queue in amdgpu_mqd_prop
YuanShang <[email protected]>
drm/amdgpu: Retain job->vm in amdgpu_job_prepare_job
Nathan Chancellor <[email protected]>
drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram()
Peter Shkenev <[email protected]>
drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities
Gang Ba <[email protected]>
drm/amdgpu: Avoid extra evict-restore process.
Alex Deucher <[email protected]>
drm/amdgpu: add missing vram lost check for LEGACY RESET
Frank Min <[email protected]>
drm/amdgpu: add kicker fws loading for gfx12/smu14/psp14
Mario Limonciello <[email protected]>
drm/amd: Restore cached power limit during resume
Alex Deucher <[email protected]>
drm/amdgpu/discovery: fix fw based ip discovery
Yang Wang <[email protected]>
drm/amd/amdgpu: fix missing lock for cper.ring->rptr/wptr access
Thomas Hellström <[email protected]>
drm/xe: Defer buffer object shrinker write-backs and GPU waits
Vodapalli, Ravi Kumar <[email protected]>
drm/xe/bmg: Add one additional PCI ID
Dikshita Agarwal <[email protected]>
media: iris: Remove unnecessary re-initialization of flush completion
Dikshita Agarwal <[email protected]>
media: iris: Verify internal buffer release on close
Dikshita Agarwal <[email protected]>
media: iris: Update CAPTURE format info based on OUTPUT format
Dikshita Agarwal <[email protected]>
media: iris: Track flush responses to prevent premature completion
Dikshita Agarwal <[email protected]>
media: iris: Skip flush on first sequence change
Dikshita Agarwal <[email protected]>
media: iris: Skip destroying internal buffer if not dequeued
Dikshita Agarwal <[email protected]>
media: iris: Send V4L2_BUF_FLAG_ERROR for capture buffers with 0 filled length
Dikshita Agarwal <[email protected]>
media: iris: Remove error check for non-zero v4l2 controls
Dikshita Agarwal <[email protected]>
media: iris: Remove deprecated property setting to firmware
Dikshita Agarwal <[email protected]>
media: iris: Prevent HFI queue writes when core is in deinit state
Dikshita Agarwal <[email protected]>
media: iris: Fix typo in depth variable
Dikshita Agarwal <[email protected]>
media: iris: Fix NULL pointer dereference
Dikshita Agarwal <[email protected]>
media: iris: Fix missing function pointer initialization
Dikshita Agarwal <[email protected]>
media: iris: Fix buffer preparation failure during resolution change
Dikshita Agarwal <[email protected]>
media: iris: Drop port check for session property response
Dikshita Agarwal <[email protected]>
media: iris: Avoid updating frame size to firmware during reconfig
Ricardo Ribalda <[email protected]>
media: venus: venc: Clamp param smaller than 1fps and bigger than 240
Ricardo Ribalda <[email protected]>
media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
Jorge Ramirez-Ortiz <[email protected]>
media: venus: protect against spurious interrupts during probe
Jorge Ramirez-Ortiz <[email protected]>
media: venus: hfi: explicitly release IRQ during teardown
Konrad Dybcio <[email protected]>
media: venus: Fix MSM8998 frequency table
Vedang Nagar <[email protected]>
media: venus: Add a check for packet size after reading from shared memory
Bryan O'Donoghue <[email protected]>
media: qcom: camss: Remove extraneous -supply postfix on supply names
Vladimir Zapolskiy <[email protected]>
media: qcom: camss: cleanup media device allocated resource on error path
Bryan O'Donoghue <[email protected]>
media: qcom: camss: csiphy-3ph: Fix inadvertent dropping of SDM660/SDM670 phy init
Hans de Goede <[email protected]>
media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls
Mathis Foerst <[email protected]>
media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval
Zhang Shurong <[email protected]>
media: ov2659: Fix memory leaks in ov2659_probe()
Jacopo Mondi <[email protected]>
media: pisp_be: Fix pm_runtime underrun in probe
Gui-Dong Han <[email protected]>
media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
Ludwig Disterhof <[email protected]>
media: usbtv: Lock resolution while streaming
Sakari Ailus <[email protected]>
media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
Nicolas Dufresne <[email protected]>
media: verisilicon: Fix AV1 decoder clock frequency
Hans Verkuil <[email protected]>
media: vivid: fix wrong pixel_array control size
Sakari Ailus <[email protected]>
media: ipu6: isys: Use correct pads for xlate_streams()
Haoxiang Li <[email protected]>
media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init()
Bingbu Cao <[email protected]>
media: hi556: correct the test pattern configuration
Dan Carpenter <[email protected]>
media: gspca: Add bounds checking to firmware parser
John David Anglin <[email protected]>
parisc: Update comments in make_insert_tlb
John David Anglin <[email protected]>
parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault()
John David Anglin <[email protected]>
parisc: Revise gateway LWS calls to probe user read access
John David Anglin <[email protected]>
parisc: Revise __get_user() to probe user read access
John David Anglin <[email protected]>
parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c
Randy Dunlap <[email protected]>
parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers
John David Anglin <[email protected]>
parisc: Drop WARN_ON_ONCE() from flush_cache_vmap
John David Anglin <[email protected]>
parisc: Define and use set_pte_at()
John David Anglin <[email protected]>
parisc: Check region is readable by user in raw_copy_from_user()
Jon Hunter <[email protected]>
soc/tegra: pmc: Ensure power-domains are in a known state
Jialin Wang <[email protected]>
proc: proc_maps_open allow proc_mem_open to return NULL
Aleksa Sarai <[email protected]>
open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE
Simon Richter <[email protected]>
Mark xe driver as BROKEN if kernel page size is not 4kB
Thomas Weißschuh <[email protected]>
kbuild: userprogs: use correct linker when mixing clang and GNU ld
Jann Horn <[email protected]>
kasan/test: fix protection against compiler elision
Baokun Li <[email protected]>
jbd2: prevent softlockup in jbd2_log_do_checkpoint()
Jan Kara <[email protected]>
iomap: Fix broken data integrity guarantees for O_SYNC writes
Kathiravan Thirumoorthy <[email protected]>
i2c: qcom-geni: fix I2C frequency table to achieve accurate bus rates
Chao Yu <[email protected]>
f2fs: fix to avoid out-of-boundary access in dnode page
Julian Sun <[email protected]>
block: restore default wbt enablement
Muhammad Usama Anjum <[email protected]>
ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context
Xaver Hugl <[email protected]>
amdgpu/amdgpu_discovery: increase timeout limit for IFWI init
Kathiravan Thirumoorthy <[email protected]>
phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence
Will Deacon <[email protected]>
vhost/vsock: Avoid allocating arbitrarily-sized SKBs
Will Deacon <[email protected]>
vsock/virtio: Validate length in packet header before skb_put()
Richard Zhu <[email protected]>
PCI: imx6: Delay link start until configfs 'start' written
Richard Zhu <[email protected]>
PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset
Richard Zhu <[email protected]>
PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features
Richard Zhu <[email protected]>
PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features
Damien Le Moal <[email protected]>
PCI: endpoint: Fix configfs group removal on driver teardown
Damien Le Moal <[email protected]>
PCI: endpoint: Fix configfs group list head handling
Jiwei Sun <[email protected]>
PCI: Fix link speed calculation on retrain failure
Lukas Wunner <[email protected]>
PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge
Chi Zhiling <[email protected]>
readahead: fix return value of page_cache_next_miss() when no hole is found
Dmitry Torokhov <[email protected]>
mfd: mt6397: Do not use generic name for keypad sub-devices
Thomas Fourier <[email protected]>
mtd: rawnand: renesas: Add missing check after DMA map
Thomas Fourier <[email protected]>
mtd: rawnand: fsmc: Add missing check after DMA map
Gabor Juhos <[email protected]>
mtd: spinand: propagate spinand_wait() errors from spinand_write_page()
Michael Walle <[email protected]>
mtd: spi-nor: Fix spi_nor_try_unlock_all()
Tim Harvey <[email protected]>
hwmon: (gsc-hwmon) fix fan pwm setpoint show functions
Uwe Kleine-König <[email protected]>
pwm: mediatek: Fix duty and period setting
Uwe Kleine-König <[email protected]>
pwm: mediatek: Handle hardware enable and clock enable separately
Laurentiu Mihalcea <[email protected]>
pwm: imx-tpm: Reset counter if CMOD is 0
Johan Hovold <[email protected]>
wifi: ath11k: fix dest ring-buffer corruption when ring is full
Johan Hovold <[email protected]>
wifi: ath11k: fix source ring-buffer corruption
Johan Hovold <[email protected]>
wifi: ath11k: fix dest ring-buffer corruption
Johan Hovold <[email protected]>
wifi: ath12k: fix dest ring-buffer corruption when ring is full
Johan Hovold <[email protected]>
wifi: ath12k: fix source ring-buffer corruption
Johan Hovold <[email protected]>
wifi: ath12k: fix dest ring-buffer corruption
Nathan Chancellor <[email protected]>
wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table()
David Lechner <[email protected]>
iio: adc: ad7173: fix setting ODR in probe
David Lechner <[email protected]>
iio: adc: ad7173: fix calibration channel
David Lechner <[email protected]>
iio: adc: ad7173: fix channels index for syscalib_mode
David Lechner <[email protected]>
iio: adc: ad_sigma_delta: change to buffer predisable
David Lechner <[email protected]>
iio: imu: bno055: fix OOB access of hw_xlate array
Marek Szyprowski <[email protected]>
zynq_fpga: use sgtable-based scatterlist wrappers
Bjorn Andersson <[email protected]>
soc: qcom: mdt_loader: Ensure we don't read past the ELF header
Igor Pylypiv <[email protected]>
ata: libata-scsi: Fix CDL control
Adrian Hunter <[email protected]>
scsi: ufs: ufs-pci: Fix default runtime and system PM levels
Archana Patni <[email protected]>
scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers
Damien Le Moal <[email protected]>
ata: libata-scsi: Return aborted command when missing sense and result TF
Damien Le Moal <[email protected]>
ata: libata-scsi: Fix ata_to_sense_error() status handling
Ranjan Kumar <[email protected]>
scsi: mpi3mr: Fix race between config read submit and interrupt completion
André Draszik <[email protected]>
scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
Macpaul Lin <[email protected]>
scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host
Cristian Ciocaltea <[email protected]>
dt-bindings: display: vop2: Add optional PLL clock property for rk3576
Krzysztof Kozlowski <[email protected]>
dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints
Krzysztof Kozlowski <[email protected]>
dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints
Helge Deller <[email protected]>
apparmor: Fix 8-byte alignment for initial dfa blob streams
Sam Edwards <[email protected]>
arm64: dts: rockchip: Remove workaround that prevented Turing RK1 GPU power regulator control
Emanuele Ghidoli <[email protected]>
arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses
Kaustabh Chakraborty <[email protected]>
arm64: dts: exynos7870-on7xelte: reduce memory ranges to base amount
Judith Mendez <[email protected]>
arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file
Hong Guan <[email protected]>
arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1
Peter Griffin <[email protected]>
arm64: dts: exynos: gs101: ufs: add dma-coherent property
Cristian Ciocaltea <[email protected]>
arm64: dts: rockchip: Enable HDMI PHY clk provider on rk3576
Cristian Ciocaltea <[email protected]>
arm64: dts: rockchip: Add HDMI PHY PLL clock source to VOP2 on rk3576
Kaustabh Chakraborty <[email protected]>
arm64: dts: exynos7870: add quirk to disable USB2 LPM in gadget mode
Alexander Sverdlin <[email protected]>
arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default
Kaustabh Chakraborty <[email protected]>
arm64: dts: exynos7870-j6lte: reduce memory ranges to base amount
Judith Mendez <[email protected]>
arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support
Nick Chan <[email protected]>
arm64: dts: apple: t8012-j132: Include touchbar framebuffer node
Kyoji Ogasawara <[email protected]>
btrfs: fix printing of mount info messages for NODATACOW/NODATASUM
Kyoji Ogasawara <[email protected]>
btrfs: restore mount option info messages during mount
Kyoji Ogasawara <[email protected]>
btrfs: fix incorrect log message for nobarrier mount option
Naohiro Aota <[email protected]>
btrfs: zoned: fix write time activation failure for metadata block group
Zhang Yi <[email protected]>
ext4: fix hole length calculation overflow in non-extent inodes
Liao Yuanhong <[email protected]>
ext4: use kmalloc_array() for array space allocation
Theodore Ts'o <[email protected]>
ext4: don't try to clear the orphan_present feature block device is r/o
Ojaswin Mujoo <[email protected]>
ext4: fix reserved gdt blocks handling in fsmap
Ojaswin Mujoo <[email protected]>
ext4: fix fsmap end of range reporting with bigalloc
Andreas Dilger <[email protected]>
ext4: check fast symlink for ea_inode correctly
Baokun Li <[email protected]>
ext4: preserve SB_I_VERSION on remount
Masami Hiramatsu (Google) <[email protected]>
tracing: fprobe-event: Sanitize wildcard for fprobe event name
Namjae Jeon <[email protected]>
ksmbd: extend the connection limiting mechanism to support IPv6
Ziyan Xu <[email protected]>
ksmbd: fix refcount leak causing resource not released
Helge Deller <[email protected]>
Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
Herbert Xu <[email protected]>
crypto: hash - Increase HASH_MAX_DESCSIZE for hmac(sha3-224-s390)
Bharat Bhushan <[email protected]>
crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0
Bharat Bhushan <[email protected]>
crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2
Bharat Bhushan <[email protected]>
crypto: octeontx2 - Fix address alignment issue on ucode loading
Eric Biggers <[email protected]>
crypto: x86/aegis - Add missing error checks
Eric Biggers <[email protected]>
crypto: x86/aegis - Fix sleeping when disallowed on PREEMPT_RT
Giovanni Cabiddu <[email protected]>
crypto: qat - flush misc workqueue during device shutdown
John Ernberg <[email protected]>
crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP
Ashish Kalra <[email protected]>
crypto: ccp - Fix SNP panic notifier unregistration
Giovanni Cabiddu <[email protected]>
crypto: qat - lower priority for skcipher and aead algorithms
Eric Biggers <[email protected]>
lib/crypto: arm64/poly1305: Fix register corruption in no-SIMD contexts
Eric Biggers <[email protected]>
lib/crypto: arm/poly1305: Fix register corruption in no-SIMD contexts
Eric Biggers <[email protected]>
lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap
David Howells <[email protected]>
netfs: Fix unbuffered write error handling
Myrrh Periwinkle <[email protected]>
vt: defkeymap: Map keycodes above 127 to K_HOLE
Myrrh Periwinkle <[email protected]>
vt: keyboard: Don't process Unicode characters in K_OFF mode
Youssef Samir <[email protected]>
bus: mhi: host: Detect events pointing to unexpected TREs
Alexander Wilhelm <[email protected]>
bus: mhi: host: Fix endianness of BHI vector table
Johan Hovold <[email protected]>
usb: dwc3: imx8mp: fix device leak at unbind
Johan Hovold <[email protected]>
usb: dwc3: meson-g12a: fix device leaks at unbind
Johan Hovold <[email protected]>
usb: musb: omap2430: fix device leak at unbind
Johan Hovold <[email protected]>
usb: gadget: udc: renesas_usb3: fix device leak at unbind
Nathan Chancellor <[email protected]>
usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
David Lechner <[email protected]>
iio: adc: ad7173: fix num_slots
Finn Thain <[email protected]>
m68k: Fix lost column on framebuffer debug console
Damien Le Moal <[email protected]>
dm: Check for forbidden splitting of zone write operations
Damien Le Moal <[email protected]>
dm: dm-crypt: Do not partially accept write BIOs with zoned targets
Rafael J. Wysocki <[email protected]>
PM: runtime: Take active children into account in pm_runtime_get_if_in_use()
Tzung-Bi Shih <[email protected]>
platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
Dan Carpenter <[email protected]>
cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
Damien Le Moal <[email protected]>
ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
Yunhui Cui <[email protected]>
serial: 8250: fix panic due to PSLVERR
-------------
Diffstat:
.../bindings/display/rockchip/rockchip-vop2.yaml | 56 ++++- .../bindings/display/sprd/sprd,sharkl3-dpu.yaml | 2 +- .../display/sprd/sprd,sharkl3-dsi-host.yaml | 2 +- .../devicetree/bindings/ufs/mediatek,ufs.yaml | 4 + Documentation/networking/mptcp-sysctl.rst | 2 + Makefile | 6 +- arch/arm/lib/crypto/poly1305-glue.c | 3 +- arch/arm64/boot/dts/apple/t8012-j132.dts | 1 + arch/arm64/boot/dts/exynos/exynos7870-j6lte.dts | 2 +- arch/arm64/boot/dts/exynos/exynos7870-on7xelte.dts | 2 +- arch/arm64/boot/dts/exynos/exynos7870.dtsi | 1 + arch/arm64/boot/dts/exynos/google/gs101.dtsi | 1 + arch/arm64/boot/dts/rockchip/rk3576.dtsi | 7 +- .../arm64/boot/dts/rockchip/rk3588-turing-rk1.dtsi | 11 - arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts | 24 ++ arch/arm64/boot/dts/ti/k3-am62-main.dtsi | 1 - arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 12 +- arch/arm64/boot/dts/ti/k3-am625-sk.dts | 24 ++ arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 4 +- arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi | 24 -- arch/arm64/boot/dts/ti/k3-pinctrl.h | 15 +- arch/arm64/lib/crypto/poly1305-glue.c | 3 +- arch/loongarch/Makefile | 6 + arch/loongarch/kernel/module-sections.c | 38 +-- arch/loongarch/kvm/intc/eiointc.c | 32 +-- arch/loongarch/kvm/intc/ipi.c | 8 +- arch/loongarch/kvm/intc/pch_pic.c | 10 + arch/loongarch/kvm/vcpu.c | 8 +- arch/m68k/kernel/head.S | 31 ++- arch/mips/lib/crypto/chacha-core.S | 20 +- arch/parisc/Makefile | 4 +- arch/parisc/include/asm/pgtable.h | 7 +- arch/parisc/include/asm/special_insns.h | 28 +++ arch/parisc/include/asm/uaccess.h | 21 +- arch/parisc/kernel/cache.c | 6 +- arch/parisc/kernel/entry.S | 17 +- arch/parisc/kernel/syscall.S | 30 ++- arch/parisc/lib/memcpy.c | 19 +- arch/parisc/mm/fault.c | 4 + arch/s390/boot/vmem.c | 3 + arch/s390/hypfs/hypfs_dbfs.c | 19 +- arch/x86/crypto/aegis128-aesni-glue.c | 40 +++- arch/x86/include/asm/xen/hypercall.h | 5 +- arch/x86/kernel/cpu/amd.c | 8 +- arch/x86/kernel/cpu/hygon.c | 3 + block/bfq-iosched.c | 13 +- block/blk-mq-debugfs.c | 1 + block/blk-mq-sched.c | 223 ++++++++++++------ block/blk-mq-sched.h | 12 +- block/blk-mq.c | 29 ++- block/blk-rq-qos.c | 8 +- block/blk-rq-qos.h | 48 ++-- block/blk-sysfs.c | 2 +- block/blk.h | 4 +- block/elevator.c | 38 ++- block/elevator.h | 16 +- block/kyber-iosched.c | 11 +- block/mq-deadline.c | 14 +- crypto/deflate.c | 7 +- drivers/accel/habanalabs/gaudi2/gaudi2.c | 2 +- drivers/acpi/apei/einj-core.c | 12 +- drivers/acpi/pfr_update.c | 2 +- drivers/ata/Kconfig | 32 ++- drivers/ata/libata-scsi.c | 49 ++-- drivers/base/power/runtime.c | 27 ++- drivers/bluetooth/btmtk.c | 7 +- drivers/bus/mhi/host/boot.c | 8 +- drivers/bus/mhi/host/internal.h | 4 +- drivers/bus/mhi/host/main.c | 12 +- drivers/cdx/controller/cdx_rpmsg.c | 3 +- drivers/comedi/comedi_fops.c | 5 + drivers/comedi/drivers.c | 27 +-- drivers/comedi/drivers/pcl726.c | 3 +- drivers/cpufreq/armada-8k-cpufreq.c | 2 +- drivers/cpuidle/governors/menu.c | 29 +-- drivers/crypto/caam/ctrl.c | 5 +- drivers/crypto/caam/intern.h | 1 + drivers/crypto/ccp/sev-dev.c | 10 +- .../crypto/intel/qat/qat_common/adf_common_drv.h | 1 + drivers/crypto/intel/qat/qat_common/adf_init.c | 1 + drivers/crypto/intel/qat/qat_common/adf_isr.c | 5 + drivers/crypto/intel/qat/qat_common/qat_algs.c | 12 +- drivers/crypto/marvell/octeontx2/otx2_cpt_reqmgr.h | 125 +++++++--- .../crypto/marvell/octeontx2/otx2_cptpf_ucode.c | 35 +-- drivers/fpga/zynq-fpga.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 76 +++--- drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 7 - drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 21 +- drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 5 +- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 14 +- drivers/gpu/drm/amd/amdgpu/imu_v12_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c | 57 +++-- drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c | 121 +++++++++- drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c | 34 ++- drivers/gpu/drm/amd/amdgpu/psp_v14_0.c | 2 + drivers/gpu/drm/amd/amdgpu/soc15.c | 2 + .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_module.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 61 ++++- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 20 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 19 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 28 +++ .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 5 +- .../gpu/drm/amd/display/dc/bios/command_table.c | 2 +- drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c | 1 - .../amd/display/dc/clk_mgr/dce100/dce_clk_mgr.c | 19 +- .../amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c | 40 ++-- .../amd/display/dc/clk_mgr/dce60/dce60_clk_mgr.c | 31 +-- drivers/gpu/drm/amd/display/dc/core/dc.c | 34 ++- .../amd/display/dc/resource/dce60/dce60_resource.c | 34 +-- .../gpu/drm/amd/display/modules/hdcp/hdcp_psp.c | 3 + drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 16 ++ drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 11 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 30 ++- drivers/gpu/drm/display/drm_dp_helper.c | 2 +- drivers/gpu/drm/drm_format_helper.c | 108 ++++++++- drivers/gpu/drm/drm_format_internal.h | 8 + drivers/gpu/drm/drm_panic_qr.rs | 22 +- drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c | 14 +- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 22 +- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h | 1 + drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c | 5 + drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c | 11 +- drivers/gpu/drm/i915/display/intel_display_irq.c | 4 + drivers/gpu/drm/i915/display/intel_tc.c | 93 ++++++-- drivers/gpu/drm/i915/gt/intel_workarounds.c | 20 +- drivers/gpu/drm/nouveau/nvif/vmm.c | 3 +- .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c | 4 +- drivers/gpu/drm/nova/file.rs | 3 +- drivers/gpu/drm/tests/drm_format_helper_test.c | 111 ++------- drivers/gpu/drm/xe/Kconfig | 1 + drivers/gpu/drm/xe/xe_migrate.c | 2 +- drivers/gpu/drm/xe/xe_pxp_submit.c | 2 +- drivers/gpu/drm/xe/xe_shrinker.c | 51 +++- drivers/gpu/drm/xe/xe_vm.c | 48 ++-- drivers/gpu/drm/xe/xe_vm.h | 2 +- drivers/hwmon/gsc-hwmon.c | 4 +- drivers/i2c/busses/i2c-qcom-geni.c | 6 +- drivers/i2c/busses/i2c-rtl9300.c | 20 +- drivers/iio/accel/sca3300.c | 2 +- drivers/iio/adc/Kconfig | 2 +- drivers/iio/adc/ad7124.c | 14 +- drivers/iio/adc/ad7173.c | 137 ++++++++--- drivers/iio/adc/ad7380.c | 1 + drivers/iio/adc/ad_sigma_delta.c | 4 +- drivers/iio/adc/rzg2l_adc.c | 33 +-- drivers/iio/imu/bno055/bno055.c | 11 +- drivers/iio/imu/inv_icm42600/inv_icm42600.h | 8 +- drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 31 ++- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 22 +- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h | 10 +- drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 6 +- drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 41 ++-- drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c | 12 +- drivers/iio/light/as73211.c | 2 +- drivers/iio/pressure/bmp280-core.c | 9 +- drivers/iio/proximity/isl29501.c | 14 +- drivers/iio/temperature/maxim_thermocouple.c | 26 ++- drivers/infiniband/core/umem_odp.c | 4 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 +- drivers/infiniband/hw/bnxt_re/main.c | 23 ++ drivers/infiniband/hw/bnxt_re/qplib_fp.c | 30 +-- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 - drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 + drivers/infiniband/hw/erdma/erdma_verbs.c | 6 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 6 +- drivers/infiniband/hw/hns/hns_roce_restrack.c | 9 +- drivers/infiniband/sw/rxe/rxe_net.c | 29 +-- drivers/infiniband/sw/rxe/rxe_qp.c | 2 +- drivers/iommu/amd/init.c | 4 +- drivers/iommu/apple-dart.c | 1 - drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +- drivers/iommu/intel/iommu.c | 1 - drivers/iommu/iommufd/selftest.c | 1 - drivers/iommu/riscv/iommu.c | 3 +- drivers/iommu/virtio-iommu.c | 19 +- drivers/md/dm-crypt.c | 47 +++- drivers/md/dm-raid.c | 42 ++-- drivers/md/dm.c | 17 +- drivers/md/md-bitmap.c | 8 +- drivers/md/md-cluster.c | 16 +- drivers/md/md.c | 110 ++++++--- drivers/md/md.h | 2 +- drivers/md/raid0.c | 6 +- drivers/md/raid1-10.c | 2 +- drivers/md/raid1.c | 10 +- drivers/md/raid10.c | 16 +- drivers/md/raid5-ppl.c | 6 +- drivers/md/raid5.c | 30 +-- drivers/media/cec/usb/rainshadow/rainshadow-cec.c | 3 +- drivers/media/i2c/hi556.c | 26 ++- drivers/media/i2c/mt9m114.c | 8 - drivers/media/i2c/ov2659.c | 3 +- drivers/media/pci/intel/ipu6/ipu6-isys-csi2.c | 12 +- drivers/media/pci/intel/ivsc/mei_ace.c | 2 + drivers/media/pci/intel/ivsc/mei_csi.c | 2 + .../platform/qcom/camss/camss-csiphy-3ph-1-0.c | 3 +- drivers/media/platform/qcom/camss/camss.c | 20 +- drivers/media/platform/qcom/iris/iris_buffer.c | 20 +- drivers/media/platform/qcom/iris/iris_buffer.h | 3 +- drivers/media/platform/qcom/iris/iris_ctrls.c | 7 +- .../platform/qcom/iris/iris_hfi_gen1_command.c | 27 +-- .../platform/qcom/iris/iris_hfi_gen1_defines.h | 1 - .../platform/qcom/iris/iris_hfi_gen1_response.c | 20 +- .../platform/qcom/iris/iris_hfi_gen2_command.c | 4 +- .../platform/qcom/iris/iris_hfi_gen2_response.c | 11 +- drivers/media/platform/qcom/iris/iris_hfi_queue.c | 2 +- drivers/media/platform/qcom/iris/iris_instance.h | 2 + .../platform/qcom/iris/iris_platform_common.h | 2 +- .../platform/qcom/iris/iris_platform_sm8250.c | 9 - drivers/media/platform/qcom/iris/iris_state.c | 2 +- drivers/media/platform/qcom/iris/iris_state.h | 1 + drivers/media/platform/qcom/iris/iris_vb2.c | 15 +- drivers/media/platform/qcom/iris/iris_vdec.c | 9 +- drivers/media/platform/qcom/iris/iris_vidc.c | 33 ++- drivers/media/platform/qcom/venus/core.c | 18 +- drivers/media/platform/qcom/venus/core.h | 2 + drivers/media/platform/qcom/venus/hfi_venus.c | 5 + drivers/media/platform/qcom/venus/vdec.c | 5 +- drivers/media/platform/qcom/venus/venc.c | 5 +- drivers/media/platform/raspberrypi/pisp_be/Kconfig | 1 + .../media/platform/raspberrypi/pisp_be/pisp_be.c | 5 +- .../media/platform/verisilicon/rockchip_vpu_hw.c | 9 - drivers/media/test-drivers/vivid/vivid-ctrls.c | 3 +- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 4 +- drivers/media/usb/gspca/vicam.c | 10 +- drivers/media/usb/usbtv/usbtv-video.c | 4 + drivers/media/v4l2-core/v4l2-ctrls-core.c | 1 - drivers/memstick/core/memstick.c | 1 - drivers/memstick/host/rtsx_usb_ms.c | 1 + drivers/mfd/mt6397-core.c | 12 +- drivers/mmc/host/sdhci-of-arasan.c | 33 ++- drivers/mmc/host/sdhci-pci-gli.c | 37 +-- drivers/mmc/host/sdhci_am654.c | 18 ++ drivers/most/core.c | 2 +- drivers/mtd/nand/raw/fsmc_nand.c | 2 + drivers/mtd/nand/raw/renesas-nand-controller.c | 6 + drivers/mtd/nand/spi/core.c | 5 +- drivers/mtd/spi-nor/swp.c | 19 +- drivers/net/bonding/bond_3ad.c | 67 ++++-- drivers/net/bonding/bond_options.c | 1 + drivers/net/dsa/microchip/ksz_common.c | 6 + drivers/net/ethernet/airoha/airoha_ppe.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- drivers/net/ethernet/google/gve/gve_main.c | 2 + drivers/net/ethernet/intel/igc/igc_main.c | 14 +- drivers/net/ethernet/intel/ixgbe/devlink/devlink.c | 1 + drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c | 4 +- .../net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c | 4 +- drivers/net/ethernet/mediatek/mtk_ppe_offload.c | 2 + drivers/net/ethernet/mellanox/mlx5/core/en/dcbnl.h | 1 - .../ethernet/mellanox/mlx5/core/en/port_buffer.c | 18 +- .../ethernet/mellanox/mlx5/core/en/tc/ct_fs_hmfs.c | 2 + drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 12 +- .../ethernet/mellanox/mlx5/core/esw/devlink_port.c | 4 +- .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 2 + drivers/net/ethernet/mellanox/mlx5/core/port.c | 20 ++ .../mellanox/mlx5/core/steering/hws/bwc_complex.c | 41 ++-- .../ethernet/mellanox/mlx5/core/steering/hws/cmd.c | 1 + .../ethernet/mellanox/mlx5/core/steering/hws/cmd.h | 1 + .../mellanox/mlx5/core/steering/hws/fs_hws.c | 1 + .../mellanox/mlx5/core/steering/hws/matcher.c | 5 +- .../mellanox/mlx5/core/steering/hws/mlx5hws.h | 1 + .../mellanox/mlx5/core/steering/hws/send.c | 1 - .../mellanox/mlx5/core/steering/hws/table.c | 13 +- .../mellanox/mlx5/core/steering/hws/table.h | 3 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 + drivers/net/ethernet/mellanox/mlxsw/trap.h | 1 + drivers/net/ethernet/microchip/lan865x/lan865x.c | 21 ++ drivers/net/ethernet/realtek/rtase/rtase.h | 2 +- drivers/net/ethernet/stmicro/stmmac/dwmac-thead.c | 9 +- drivers/net/ethernet/ti/icssg/icssg_prueth.c | 72 +++--- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 8 +- drivers/net/phy/mscc/mscc.h | 12 + drivers/net/phy/mscc/mscc_main.c | 12 + drivers/net/phy/mscc/mscc_ptp.c | 49 +++- drivers/net/ppp/ppp_generic.c | 17 +- drivers/net/usb/asix_devices.c | 2 +- drivers/net/wireless/ath/ath11k/ce.c | 3 - drivers/net/wireless/ath/ath11k/dp_rx.c | 3 - drivers/net/wireless/ath/ath11k/hal.c | 33 ++- drivers/net/wireless/ath/ath12k/ce.c | 3 - drivers/net/wireless/ath/ath12k/hal.c | 38 ++- .../broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | 2 +- drivers/pci/controller/dwc/pci-imx6.c | 12 +- drivers/pci/controller/dwc/pcie-designware.c | 8 + drivers/pci/controller/pcie-rockchip-ep.c | 4 +- drivers/pci/controller/pcie-rockchip-host.c | 49 ++-- drivers/pci/controller/pcie-rockchip.h | 12 +- drivers/pci/endpoint/pci-ep-cfs.c | 1 + drivers/pci/endpoint/pci-epf-core.c | 2 +- drivers/pci/pci.h | 32 +-- drivers/pci/pcie/portdrv.c | 2 +- drivers/phy/qualcomm/phy-qcom-m31.c | 14 +- drivers/platform/chrome/cros_ec.c | 3 + drivers/platform/x86/amd/hsmp/hsmp.c | 5 + .../intel/uncore-frequency/uncore-frequency-tpmi.c | 5 + drivers/pwm/pwm-imx-tpm.c | 9 + drivers/pwm/pwm-mediatek.c | 71 +++--- drivers/regulator/pca9450-regulator.c | 13 +- drivers/regulator/tps65219-regulator.c | 12 +- drivers/s390/char/sclp.c | 11 +- drivers/scsi/mpi3mr/mpi3mr.h | 6 +- drivers/scsi/mpi3mr/mpi3mr_fw.c | 17 +- drivers/scsi/mpi3mr/mpi3mr_os.c | 2 + drivers/scsi/qla4xxx/ql4_os.c | 2 + drivers/soc/qcom/mdt_loader.c | 43 ++++ drivers/soc/tegra/pmc.c | 51 ++-- drivers/spi/spi-fsl-lpspi.c | 8 +- drivers/spi/spi-qpic-snand.c | 22 +- drivers/staging/media/imx/imx-media-csc-scaler.c | 2 +- drivers/tty/serial/8250/8250_port.c | 3 +- drivers/tty/vt/defkeymap.c_shipped | 112 +++++++++ drivers/tty/vt/keyboard.c | 2 +- drivers/ufs/core/ufshcd.c | 10 +- drivers/ufs/host/ufs-exynos.c | 4 +- drivers/ufs/host/ufs-qcom.c | 42 ++-- drivers/ufs/host/ufshcd-pci.c | 42 +++- drivers/usb/atm/cxacru.c | 172 +++++++------- drivers/usb/core/hcd.c | 20 +- drivers/usb/core/quirks.c | 1 + drivers/usb/dwc3/dwc3-imx8mp.c | 7 +- drivers/usb/dwc3/dwc3-meson-g12a.c | 3 + drivers/usb/dwc3/dwc3-pci.c | 2 + drivers/usb/dwc3/ep0.c | 20 +- drivers/usb/dwc3/gadget.c | 19 +- drivers/usb/gadget/udc/renesas_usb3.c | 1 + drivers/usb/host/xhci-hub.c | 3 +- drivers/usb/host/xhci-mem.c | 22 +- drivers/usb/host/xhci-pci-renesas.c | 7 +- drivers/usb/host/xhci-ring.c | 9 +- drivers/usb/host/xhci.c | 23 +- drivers/usb/host/xhci.h | 3 +- drivers/usb/musb/omap2430.c | 14 +- drivers/usb/storage/realtek_cr.c | 2 +- drivers/usb/storage/unusual_devs.h | 29 +++ drivers/usb/typec/tcpm/maxim_contaminant.c | 58 +++++ drivers/usb/typec/tcpm/tcpci_maxim.h | 1 + drivers/vhost/vsock.c | 6 +- drivers/video/console/vgacon.c | 2 +- fs/btrfs/ctree.c | 23 +- fs/btrfs/extent-tree.c | 2 +- fs/btrfs/extent_io.c | 94 ++++---- fs/btrfs/extent_io.h | 2 +- fs/btrfs/fiemap.c | 2 +- fs/btrfs/free-space-tree.c | 17 +- fs/btrfs/inode.c | 8 +- fs/btrfs/print-tree.c | 2 +- fs/btrfs/qgroup.c | 6 +- fs/btrfs/relocation.c | 4 +- fs/btrfs/subpage.c | 258 +++++++++++---------- fs/btrfs/subpage.h | 45 +++- fs/btrfs/super.c | 13 +- fs/btrfs/tree-log.c | 4 +- fs/btrfs/zoned.c | 70 ++++-- fs/buffer.c | 2 +- fs/debugfs/inode.c | 11 +- fs/erofs/Kconfig | 18 +- fs/ext4/fsmap.c | 23 +- fs/ext4/indirect.c | 4 +- fs/ext4/inode.c | 2 +- fs/ext4/orphan.c | 5 +- fs/ext4/super.c | 8 +- fs/f2fs/node.c | 10 + fs/fhandle.c | 2 +- fs/internal.h | 3 + fs/iomap/direct-io.c | 14 +- fs/jbd2/checkpoint.c | 1 + fs/libfs.c | 27 ++- fs/namespace.c | 69 +++--- fs/netfs/read_collect.c | 4 +- fs/netfs/write_collect.c | 10 +- fs/netfs/write_issue.c | 4 +- fs/nfs/pagelist.c | 9 +- fs/nfs/write.c | 29 +-- fs/overlayfs/copy_up.c | 2 +- fs/proc/task_mmu.c | 4 +- fs/smb/client/smb2ops.c | 2 +- fs/smb/server/connection.c | 3 +- fs/smb/server/connection.h | 7 +- fs/smb/server/oplock.c | 13 +- fs/smb/server/transport_rdma.c | 5 +- fs/smb/server/transport_rdma.h | 4 +- fs/smb/server/transport_tcp.c | 26 ++- fs/splice.c | 3 + fs/squashfs/super.c | 14 +- fs/xfs/libxfs/xfs_refcount.c | 4 +- fs/xfs/scrub/common.c | 3 +- fs/xfs/scrub/repair.c | 12 +- fs/xfs/scrub/scrub.c | 5 +- fs/xfs/xfs_attr_item.c | 5 +- fs/xfs/xfs_discard.c | 12 +- fs/xfs/xfs_fsmap.c | 4 +- fs/xfs/xfs_icache.c | 5 +- fs/xfs/xfs_inode.c | 7 +- fs/xfs/xfs_itable.c | 24 +- fs/xfs/xfs_iwalk.c | 11 +- fs/xfs/xfs_notify_failure.c | 6 +- fs/xfs/xfs_qm.c | 10 +- fs/xfs/xfs_rtalloc.c | 13 +- fs/xfs/xfs_trans.c | 56 ++--- fs/xfs/xfs_trans.h | 3 +- fs/xfs/xfs_zone_alloc.c | 10 +- fs/xfs/xfs_zone_gc.c | 5 +- include/crypto/hash.h | 2 +- include/crypto/internal/acompress.h | 5 +- include/drm/drm_format_helper.h | 9 + include/drm/intel/pciids.h | 1 + include/linux/blkdev.h | 1 + include/linux/compiler.h | 8 - include/linux/iosys-map.h | 7 +- include/linux/iov_iter.h | 20 +- include/linux/kcov.h | 47 +--- include/linux/mlx5/mlx5_ifc.h | 14 +- include/linux/netfs.h | 1 + include/linux/nfs_page.h | 1 + include/net/bluetooth/bluetooth.h | 4 +- include/net/bluetooth/hci.h | 1 + include/net/bluetooth/hci_core.h | 54 ++++- include/net/bond_3ad.h | 1 + include/net/devlink.h | 6 +- include/net/sch_generic.h | 11 +- include/sound/cs35l56.h | 5 +- include/trace/events/btrfs.h | 2 +- include/uapi/linux/pfrut.h | 1 + include/uapi/linux/raid/md_p.h | 2 +- io_uring/futex.c | 3 + kernel/Kconfig.kexec | 1 + kernel/cgroup/cpuset.c | 9 +- kernel/cgroup/rstat.c | 3 + kernel/kexec_handover.c | 29 ++- kernel/sched/ext.c | 4 + kernel/signal.c | 6 +- kernel/trace/ftrace.c | 19 +- kernel/trace/trace.c | 34 ++- kernel/trace/trace.h | 10 +- mm/damon/core.c | 15 +- mm/damon/paddr.c | 4 + mm/debug_vm_pgtable.c | 9 +- mm/filemap.c | 3 +- mm/kasan/kasan_test_c.c | 2 +- mm/memory-failure.c | 8 + mm/mremap.c | 41 ++-- net/bluetooth/hci_conn.c | 17 +- net/bluetooth/hci_core.c | 27 ++- net/bluetooth/hci_event.c | 15 +- net/bluetooth/hci_sync.c | 33 +-- net/bluetooth/iso.c | 20 +- net/bluetooth/mgmt.c | 13 +- net/bridge/br_multicast.c | 16 ++ net/bridge/br_private.h | 2 + net/core/dev.c | 12 + net/devlink/port.c | 2 +- net/hsr/hsr_slave.c | 8 +- net/ipv4/netfilter/nf_reject_ipv4.c | 6 +- net/ipv6/netfilter/nf_reject_ipv6.c | 5 +- net/ipv6/seg6_hmac.c | 6 +- net/mptcp/options.c | 6 +- net/mptcp/pm.c | 18 +- net/mptcp/pm_kernel.c | 1 - net/sched/sch_cake.c | 14 +- net/sched/sch_codel.c | 12 +- net/sched/sch_fq.c | 12 +- net/sched/sch_fq_codel.c | 12 +- net/sched/sch_fq_pie.c | 12 +- net/sched/sch_hhf.c | 12 +- net/sched/sch_htb.c | 2 +- net/sched/sch_pie.c | 12 +- net/smc/af_smc.c | 3 +- net/tls/tls_sw.c | 7 +- net/vmw_vsock/virtio_transport.c | 12 +- rust/kernel/alloc/allocator.rs | 30 ++- rust/kernel/alloc/allocator_test.rs | 11 + rust/kernel/drm/device.rs | 32 ++- rust/kernel/faux.rs | 2 +- security/apparmor/lsm.c | 4 +- sound/core/timer.c | 4 +- sound/pci/hda/patch_realtek.c | 2 + sound/pci/hda/tas2781_hda_i2c.c | 2 +- sound/soc/codecs/cs35l56-sdw.c | 69 ------ sound/soc/codecs/cs35l56-shared.c | 29 ++- sound/soc/codecs/cs35l56.c | 2 +- sound/soc/codecs/cs35l56.h | 3 - sound/soc/sof/amd/acp-loader.c | 6 +- sound/usb/stream.c | 2 +- sound/usb/validate.c | 2 +- tools/objtool/arch/loongarch/special.c | 23 ++ tools/testing/selftests/net/mptcp/mptcp_connect.c | 5 +- tools/testing/selftests/net/mptcp/mptcp_inq.c | 5 +- tools/testing/selftests/net/mptcp/mptcp_sockopt.c | 5 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 1 + 498 files changed, 4907 insertions(+), 2746 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/457 serial: 8250: fix panic due to PSLVERR
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunhui Cui <[email protected]>
commit 7f8fdd4dbffc05982b96caf586f77a014b2a9353 upstream.
When the PSLVERR_RESP_EN parameter is set to 1, the device generates an error response if an attempt is made to read an empty RBR (Receive Buffer Register) while the FIFO is enabled.
In serial8250_do_startup(), calling serial_port_out(port, UART_LCR, UART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes dw8250_force_idle() and serial8250_clear_and_reinit_fifos(). The latter function enables the FIFO via serial_out(p, UART_FCR, p->fcr). Execution proceeds to the serial_port_in(port, UART_RX). This satisfies the PSLVERR trigger condition.
When another CPU (e.g., using printk()) is accessing the UART (UART is busy), the current CPU fails the check (value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR) in dw8250_check_lcr(), causing it to enter dw8250_force_idle().
Put serial_port_out(port, UART_LCR, UART_LCR_WLEN8) under the port->lock to fix this issue.
Panic backtrace:
[ 0.442336] Oops - unknown exception [#1] [ 0.442343] epc : dw8250_serial_in32+0x1e/0x4a [ 0.442351] ra : serial8250_do_startup+0x2c8/0x88e ... [ 0.442416] console_on_rootfs+0x26/0x70
--- drivers/tty/serial/8250/8250_port.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/tty/serial/8250/8250_port.c +1 -2
@@ -2376,9 +2376,8 @@ int serial8250_do_startup(struct uart_po/* * Now, initialize the UART */ -serial_port_out (port,UART_LCR ,UART_LCR_WLEN8 ); -uart_port_lock_irqsave (port, &flags); +serial_port_out (port,UART_LCR ,UART_LCR_WLEN8 );if (up->port.flags &UPF_FOURPORT ) {if (!up->port.irq) up->port.mctrl |=TIOCM_OUT1 ;
Greg Kroah-Hartman
maintainerPATCH 2/457 ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit ed62a62a18bc144f73eadf866ae46842e8f6606e upstream.
Improve the description of the possible default SATA link power management policies and add the missing description for policy 5. No functional changes.
--- drivers/ata/Kconfig | 32 ++++++++++++++++++++++++-------- 1 file changed, 24 insertions(+), 8 deletions(-)
drivers/ata/Kconfig +24 -8
@@ -117,23 +117,39 @@ config SATA_AHCI config SATA_MOBILE_LPM_POLICY int "Default SATA Link Power Management policy" - range 0 4 + range 0 5 default 3 depends on SATA_AHCI help Select the Default SATA Link Power Management (LPM) policy to use for chipsets / "South Bridges" supporting low-power modes. Such chipsets are ubiquitous across laptops, desktops and servers. + Each policy combines power saving states and features: + - Partial: The Phy logic is powered but is in a reduced power + state. The exit latency from this state is no longer than + 10us). + - Slumber: The Phy logic is powered but is in an even lower power + state. The exit latency from this state is potentially + longer, but no longer than 10ms. + - DevSleep: The Phy logic may be powered down. The exit latency from + this state is no longer than 20 ms, unless otherwise + specified by DETO in the device Identify Device Data log. + - HIPM: Host Initiated Power Management (host automatically + transitions to partial and slumber). + - DIPM: Device Initiated Power Management (device automatically + transitions to partial and slumber). - The value set has the following meanings: + The possible values for the default SATA link power management + policies are: 0 => Keep firmware settings - 1 => Maximum performance - 2 => Medium power - 3 => Medium power with Device Initiated PM enabled - 4 => Minimum power + 1 => No power savings (maximum performance) + 2 => HIPM (Partial) + 3 => HIPM (Partial) and DIPM (Partial and Slumber) + 4 => HIPM (Partial and DevSleep) and DIPM (Partial and Slumber) + 5 => HIPM (Slumber and DevSleep) and DIPM (Partial and Slumber) - Note "Minimum power" is known to cause issues, including disk - corruption, with some disks and should not be used. + Excluding the value 0, higher values represent policies with higher + power savings. config SATA_AHCI_PLATFORM tristate "Platform AHCI SATA support"
Greg Kroah-Hartman
maintainerPATCH 3/457 cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 4a26df233266a628157d7f0285451d8655defdfc upstream.
The freq_tables[] array has num_possible_cpus() elements so, to avoid an out of bounds access, this loop should be capped at "< nb_cpus" instead of "<= nb_cpus". The freq_tables[] array is allocated in armada_8k_cpufreq_init().
--- drivers/cpufreq/armada-8k-cpufreq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cpufreq/armada-8k-cpufreq.c +1 -1
@@ -103,7 +103,7 @@ static void armada_8k_cpufreq_free_table {int opps_index, nb_cpus =num_possible_cpus (); -for (opps_index =0 ; opps_index <= nb_cpus; opps_index++) { +for (opps_index =0 ; opps_index < nb_cpus; opps_index++) {int i;/* If cpu_dev is NULL then we reached the end of the array */
Greg Kroah-Hartman
maintainerPATCH 4/457 platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <[email protected]>
commit e2374953461947eee49f69b3e3204ff080ef31b1 upstream.
The blocking notifier is registered in cros_ec_register(); however, it isn't unregistered in cros_ec_unregister().
Fix it.
--- drivers/platform/chrome/cros_ec.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/platform/chrome/cros_ec.c +3 -0
@@ -318,6 +318,9 @@ EXPORT_SYMBOL(cros_ec_register);*/ void cros_ec_unregister (struct cros_ec_device *ec_dev) { +if (ec_dev->mkbp_event_supported) +blocking_notifier_chain_unregister (&ec_dev->event_notifier, + &ec_dev->notifier_ready);platform_device_unregister (ec_dev->pd);platform_device_unregister (ec_dev->ec);mutex_destroy (&ec_dev->lock);
Greg Kroah-Hartman
maintainerPATCH 5/457 PM: runtime: Take active children into account in pm_runtime_get_if_in_use()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit 51888393cc64dd0462d0b96c13ab94873abbc030 upstream.
For all practical purposes, there is no difference between the situation in which a given device is not ignoring children and its active child count is nonzero and the situation in which its runtime PM usage counter is nonzero. However, pm_runtime_get_if_in_use() will only increment the device's usage counter and return 1 in the latter case.
For consistency, make it do so in the former case either by adjusting pm_runtime_get_conditional() and update the related kerneldoc comments accordingly.
--- drivers/base/power/runtime.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-)
drivers/base/power/runtime.c +18 -9
@@ -1191,10 +1191,12 @@ EXPORT_SYMBOL_GPL(__pm_runtime_resume);* * Return -EINVAL if runtime PM is disabled for @dev. * -* Otherwise, if the runtime PM status of @dev is %RPM_ACTIVE and either -* @ign_usage_count is %true or the runtime PM usage counter of @dev is not -* zero, increment the usage counter of @dev and return 1. Otherwise, return 0 -* without changing the usage counter. +* Otherwise, if its runtime PM status is %RPM_ACTIVE and (1) @ign_usage_count +* is set, or (2) @dev is not ignoring children and its active child count is +* nonero, or (3) the runtime PM usage counter of @dev is not zero, increment +* the usage counter of @dev and return 1. +* +* Otherwise, return 0 without changing the usage counter. * * If @ign_usage_count is %true, this function can be used to prevent suspending * the device when its runtime PM status is %RPM_ACTIVE.
@@ -1216,7 +1218,8 @@ static int pm_runtime_get_conditional(st retval = -EINVAL ; }else if (dev->power.runtime_status !=RPM_ACTIVE ) { retval =0 ; - }else if (ign_usage_count) { + }else if (ign_usage_count || (!dev->power.ignore_children && +atomic_read (&dev->power.child_count) >0 )) { retval =1 ;atomic_inc (&dev->power.usage_count); }else {
@@ -1249,10 +1252,16 @@ EXPORT_SYMBOL_GPL(pm_runtime_get_if_acti* @dev: Target device. * * Increment the runtime PM usage counter of @dev if its runtime PM status is -* %RPM_ACTIVE and its runtime PM usage counter is greater than 0, in which case -* it returns 1. If the device is in a different state or its usage_count is 0, -* 0 is returned. -EINVAL is returned if runtime PM is disabled for the device, -* in which case also the usage_count will remain unmodified. +* %RPM_ACTIVE and its runtime PM usage counter is greater than 0 or it is not +* ignoring children and its active child count is nonzero. 1 is returned in +* this case. +* +* If @dev is in a different state or it is not in use (that is, its usage +* counter is 0, or it is ignoring children, or its active child count is 0), +* 0 is returned. +* +* -EINVAL is returned if runtime PM is disabled for the device, in which case +* also the usage counter of @dev is not updated. */ int pm_runtime_get_if_in_use (struct device *dev) {
Greg Kroah-Hartman
maintainerPATCH 6/457 dm: dm-crypt: Do not partially accept write BIOs with zoned targets
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit e549663849e5bb3b985dc2d293069f0d9747ae72 upstream.
Read and write operations issued to a dm-crypt target may be split according to the dm-crypt internal limits defined by the max_read_size and max_write_size module parameters (default is 128 KB). The intent is to improve processing time of large BIOs by splitting them into smaller operations that can be parallelized on different CPUs.
For zoned dm-crypt targets, this BIO splitting is still done but without the parallel execution to ensure that the issuing order of write operations to the underlying devices remains sequential. However, the splitting itself causes other problems:
1) Since dm-crypt relies on the block layer zone write plugging to handle zone append emulation using regular write operations, the reminder of a split write BIO will always be plugged into the target zone write plugged. Once the on-going write BIO finishes, this reminder BIO is unplugged and issued from the zone write plug work. If this reminder BIO itself needs to be split, the reminder will be re-issued and plugged again, but that causes a call to a blk_queue_enter(), which may block if a queue freeze operation was initiated. This results in a deadlock as DM submission still holds BIOs that the queue freeze side is waiting for.
2) dm-crypt relies on the emulation done by the block layer using regular write operations for processing zone append operations. This still requires to properly return the written sector as the BIO sector of the original BIO. However, this can be done correctly only and only if there is a single clone BIO used for processing the original zone append operation issued by the user. If the size of a zone append operation is larger than dm-crypt max_write_size, then the orginal BIO will be split and processed as a chain of regular write operations. Such chaining result in an incorrect written sector being returned to the zone append issuer using the original BIO sector. This in turn results in file system data corruptions using xfs or btrfs.
Fix this by modifying get_max_request_size() to always return the size of the BIO to avoid it being split with dm_accpet_partial_bio() in crypt_map(). get_max_request_size() is renamed to get_max_request_sectors() to clarify the unit of the value returned and its interface is changed to take a struct dm_target pointer and a pointer to the struct bio being processed. In addition to this change, to ensure that crypt_alloc_buffer() works correctly, set the dm-crypt device max_hw_sectors limit to be at mostBIO_MAX_VECS << PAGE_SECTORS_SHIFT (1 MB with a 4KB page architecture). This forces DM core to split write BIOs before passing them to crypt_map(), and thus guaranteeing that dm-crypt can always accept an entire write BIO without needing to split it.
This change does not have any effect on the read path of dm-crypt. Read operations can still be split and the BIO fragments processed in parallel. There is also no impact on the performance of the write path given that all zone write BIOs were already processed inline instead of in parallel.
This change also does not affect in any way regular dm-crypt block devices.
--- drivers/md/dm-crypt.c | 47 ++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 38 insertions(+), 9 deletions(-)
drivers/md/dm-crypt.c +38 -9
@@ -253,17 +253,35 @@ MODULE_PARM_DESC(max_read_size, "Maximumstatic unsigned int max_write_size =0 ;module_param (max_write_size, uint,0644 );MODULE_PARM_DESC (max_write_size,"Maximum size of a write request" ); -static unsigned get_max_request_size (struct crypt_config *cc,bool wrt) + +static unsigned get_max_request_sectors (struct dm_target *ti,struct bio *bio) { +struct crypt_config *cc = ti->private;unsigned val, sector_align; - val = !wrt ?READ_ONCE (max_read_size) :READ_ONCE (max_write_size); -if (likely (!val)) - val = !wrt ?DM_CRYPT_DEFAULT_MAX_READ_SIZE :DM_CRYPT_DEFAULT_MAX_WRITE_SIZE ; -if (wrt || cc->used_tag_size) { -if (unlikely (val >BIO_MAX_VECS <<PAGE_SHIFT )) - val =BIO_MAX_VECS <<PAGE_SHIFT ; +bool wrt =op_is_write (bio_op (bio)); + +if (wrt) { +/* +* For zoned devices, splitting write operations creates the +* risk of deadlocking queue freeze operations with zone write +* plugging BIO work when the reminder of a split BIO is +* issued. So always allow the entire BIO to proceed. +*/ +if (ti->emulate_zone_append) +return bio_sectors (bio); + + val =min_not_zero (READ_ONCE (max_write_size), +DM_CRYPT_DEFAULT_MAX_WRITE_SIZE ); + }else { + val =min_not_zero (READ_ONCE (max_read_size), +DM_CRYPT_DEFAULT_MAX_READ_SIZE ); } - sector_align =max (bdev_logical_block_size (cc->dev->bdev), (unsigned )cc->sector_size); + +if (wrt || cc->used_tag_size) + val =min (val,BIO_MAX_VECS <<PAGE_SHIFT ); + + sector_align =max (bdev_logical_block_size (cc->dev->bdev), + (unsigned )cc->sector_size); val =round_down (val, sector_align);if (unlikely (!val)) val = sector_align;
@@ -3496,7 +3514,7 @@ static int crypt_map(struct dm_target *t/* * Check if bio is too large, split as needed. */ - max_sectors =get_max_request_size (cc,bio_data_dir (bio) ==WRITE ); + max_sectors =get_max_request_sectors (ti, bio);if (unlikely (bio_sectors (bio) > max_sectors))dm_accept_partial_bio (bio, max_sectors);
@@ -3733,6 +3751,17 @@ static void crypt_io_hints(struct dm_tar max_t(unsigned int, limits->physical_block_size, cc->sector_size); limits->io_min = max_t(unsigned int, limits->io_min, cc->sector_size); limits->dma_alignment = limits->logical_block_size -1 ; + +/* +* For zoned dm-crypt targets, there will be no internal splitting of +* write BIOs to avoid exceeding BIO_MAX_VECS vectors per BIO. But +* without respecting this limit, crypt_alloc_buffer() will trigger a +* BUG(). Avoid this by forcing DM core to split write BIOs to this +* limit. +*/ +if (ti->emulate_zone_append) + limits->max_hw_sectors =min (limits->max_hw_sectors, +BIO_MAX_VECS <<PAGE_SECTORS_SHIFT ); }static struct target_type crypt_target = {
Greg Kroah-Hartman
maintainerPATCH 7/457 dm: Check for forbidden splitting of zone write operations
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit 409f9287dab3b53bffe8d28d883a529028aa6a42 upstream.
DM targets must not split zone append and write operations using dm_accept_partial_bio() as doing so is forbidden for zone append BIOs, breaks zone append emulation using regular write BIOs and potentially creates deadlock situations with queue freeze operations.
Modify dm_accept_partial_bio() to add missing BUG_ON() checks for all these cases, that is, check that the BIO is a write or write zeroes operation. This change packs all the zone related checks together under a static_branch_unlikely(&zoned_enabled) and done only if the target is a zoned device.
--- drivers/md/dm.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
drivers/md/dm.c +13 -4
@@ -1293,8 +1293,9 @@ out:/* * A target may call dm_accept_partial_bio only from the map routine. It is * allowed for all bio types except REQ_PREFLUSH, REQ_OP_ZONE_* zone management -* operations, REQ_OP_ZONE_APPEND (zone append writes) and any bio serviced by -* __send_duplicate_bios(). +* operations, zone append writes (native with REQ_OP_ZONE_APPEND or emulated +* with write BIOs flagged with BIO_EMULATES_ZONE_APPEND) and any bio serviced +* by __send_duplicate_bios(). * * dm_accept_partial_bio informs the dm that the target only wants to process * additional n_sectors sectors of the bio and the rest of the data should be
@@ -1327,11 +1328,19 @@ void dm_accept_partial_bio(struct bio *bunsigned int bio_sectors =bio_sectors (bio);BUG_ON (dm_tio_flagged (tio,DM_TIO_IS_DUPLICATE_BIO )); -BUG_ON (op_is_zone_mgmt (bio_op (bio))); -BUG_ON (bio_op (bio) ==REQ_OP_ZONE_APPEND );BUG_ON (bio_sectors > *tio->len_ptr);BUG_ON (n_sectors > bio_sectors); +if (static_branch_unlikely (&zoned_enabled) && +unlikely (bdev_is_zoned (bio->bi_bdev))) { +enum req_op op =bio_op (bio); + +BUG_ON (op_is_zone_mgmt (op)); +BUG_ON (op ==REQ_OP_WRITE ); +BUG_ON (op ==REQ_OP_WRITE_ZEROES ); +BUG_ON (op ==REQ_OP_ZONE_APPEND ); + } + *tio->len_ptr -= bio_sectors - n_sectors; bio->bi_iter.bi_size = n_sectors <<SECTOR_SHIFT ;
Greg Kroah-Hartman
maintainerPATCH 8/457 m68k: Fix lost column on framebuffer debug console
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
commit 210a1ce8ed4391b64a888b3fb4b5611a13f5ccc7 upstream.
Move the cursor position rightward after rendering the character, not before. This avoids complications that arise when the recursive console_putc call has to wrap the line and/or scroll the display. This also fixes the linewrap bug that crops off the rightmost column.
When the cursor is at the bottom of the display, a linefeed will not move the cursor position further downward. Instead, the display scrolls upward. Avoid the repeated add/subtract sequence by way of a single subtraction at the initialization of console_struct_num_rows.
--- arch/m68k/kernel/head.S | 31 +++++++++++++++++++++---------- 1 file changed, 21 insertions(+), 10 deletions(-)
arch/m68k/kernel/head.S +21 -10
@@ -3400,6 +3400,7 @@ L(console_clear_loop): movel %d4,%d1 /* screen height in pixels */ divul %a0@(FONT_DESC_HEIGHT),%d1 /* d1 = max num rows */ + subql #1,%d1 /* row range is 0 to num - 1 */ movel %d0,%a2@(Lconsole_struct_num_columns) movel %d1,%a2@(Lconsole_struct_num_rows)
@@ -3546,15 +3547,14 @@ func_start console_putc,%a0/%a1/%d0-%d7 cmpib #10,%d7 jne L(console_not_lf) movel %a0@(Lconsole_struct_cur_row),%d0 - addil #1,%d0 - movel %d0,%a0@(Lconsole_struct_cur_row) movel %a0@(Lconsole_struct_num_rows),%d1 cmpl %d1,%d0 jcs 1f - subil #1,%d0 - movel %d0,%a0@(Lconsole_struct_cur_row) console_scroll + jra L(console_exit) 1: + addql #1,%d0 + movel %d0,%a0@(Lconsole_struct_cur_row) jra L(console_exit) L(console_not_lf):
@@ -3581,12 +3581,6 @@ L(console_not_cr): */ L(console_not_home): movel %a0@(Lconsole_struct_cur_column),%d0 - addql #1,%a0@(Lconsole_struct_cur_column) - movel %a0@(Lconsole_struct_num_columns),%d1 - cmpl %d1,%d0 - jcs 1f - console_putc #'\n' /* recursion is OK! */ -1: movel %a0@(Lconsole_struct_cur_row),%d1 /*
@@ -3633,6 +3627,23 @@ L(console_do_font_scanline): addq #1,%d1 dbra %d7,L(console_read_char_scanline) + /* + * Register usage in the code below: + * a0 = pointer to console globals + * d0 = cursor column + * d1 = cursor column limit + */ + + lea %pc@(L(console_globals)),%a0 + + movel %a0@(Lconsole_struct_cur_column),%d0 + addql #1,%d0 + movel %d0,%a0@(Lconsole_struct_cur_column) /* Update cursor pos */ + movel %a0@(Lconsole_struct_num_columns),%d1 + cmpl %d1,%d0 + jcs L(console_exit) + console_putc #'\n' /* Line wrap using tail recursion */ + L(console_exit): func_return console_putc
Greg Kroah-Hartman
maintainerPATCH 9/457 iio: adc: ad7173: fix num_slots
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
commit 92c247216918fcaa64244248ee38a0f1d342278c upstream.
Fix the num_slots value for most chips in the ad7173 driver. The correct value is the number of CHANNELx registers on the chip.
In commit 4310e15b3140 ("iio: adc: ad7173: don't make copy of ad_sigma_delta_info struct"), we refactored struct ad_sigma_delta_info to be static const data instead of being dynamically populated during driver probe. However, there was an existing bug in commit 76a1e6a42802 ("iio: adc: ad7173: add AD7173 driver") where num_slots was incorrectly set to the number of CONFIGx registers instead of the number of CHANNELx registers. This bug was partially propagated to the refactored code in that the 16-channel chips were only given 8 slots instead of 16 although we did managed to fix the 8-channel chips and one of the 4-channel chips in that commit. However, we botched two of the 4-channel chips and ended up incorrectly giving them 8 slots during the refactoring.
This patch fixes that mistake on the 4-channel chips and also corrects the 16-channel chips to have 16 slots.
--- drivers/iio/adc/ad7173.c | 36 ++++++++++++++++++++++++++---------- 1 file changed, 26 insertions(+), 10 deletions(-)
drivers/iio/adc/ad7173.c +26 -10
@@ -772,10 +772,26 @@ static const struct ad_sigma_delta_info .num_slots = 8, }; +static const struct ad_sigma_delta_info ad7173_sigma_delta_info_16_slots = { + .set_channel = ad7173_set_channel, + .append_status = ad7173_append_status, + .disable_all = ad7173_disable_all, + .disable_one = ad7173_disable_one, + .set_mode = ad7173_set_mode, + .has_registers = true, + .has_named_irqs = true, + .addr_shift =0 , + .read_mask =BIT (6 ), + .status_ch_mask =GENMASK (3 ,0 ), + .data_reg =AD7173_REG_DATA , + .num_resetclks =64 , + .num_slots =16 , +}; +static const struct ad7173_device_info ad4111_device_info = { .name ="ad4111" , .id =AD4111_ID , - .sd_info = &ad7173_sigma_delta_info_8_slots, + .sd_info = &ad7173_sigma_delta_info_16_slots, .num_voltage_in_div =8 , .num_channels =16 , .num_configs =8 ,
@@ -797,7 +813,7 @@ static const struct ad7173_device_info astatic const struct ad7173_device_info ad4112_device_info = { .name ="ad4112" , .id =AD4112_ID , - .sd_info = &ad7173_sigma_delta_info_8_slots, + .sd_info = &ad7173_sigma_delta_info_16_slots, .num_voltage_in_div =8 , .num_channels =16 , .num_configs =8 ,
@@ -818,7 +834,7 @@ static const struct ad7173_device_info astatic const struct ad7173_device_info ad4113_device_info = { .name ="ad4113" , .id =AD4113_ID , - .sd_info = &ad7173_sigma_delta_info_8_slots, + .sd_info = &ad7173_sigma_delta_info_16_slots, .num_voltage_in_div =8 , .num_channels =16 , .num_configs =8 ,
@@ -837,7 +853,7 @@ static const struct ad7173_device_info astatic const struct ad7173_device_info ad4114_device_info = { .name ="ad4114" , .id =AD4114_ID , - .sd_info = &ad7173_sigma_delta_info_8_slots, + .sd_info = &ad7173_sigma_delta_info_16_slots, .num_voltage_in_div =16 , .num_channels =16 , .num_configs =8 ,
@@ -856,7 +872,7 @@ static const struct ad7173_device_info astatic const struct ad7173_device_info ad4115_device_info = { .name ="ad4115" , .id =AD4115_ID , - .sd_info = &ad7173_sigma_delta_info_8_slots, + .sd_info = &ad7173_sigma_delta_info_16_slots, .num_voltage_in_div =16 , .num_channels =16 , .num_configs =8 ,
@@ -875,7 +891,7 @@ static const struct ad7173_device_info astatic const struct ad7173_device_info ad4116_device_info = { .name ="ad4116" , .id =AD4116_ID , - .sd_info = &ad7173_sigma_delta_info_8_slots, + .sd_info = &ad7173_sigma_delta_info_16_slots, .num_voltage_in_div =11 , .num_channels =16 , .num_configs =8 ,
@@ -894,7 +910,7 @@ static const struct ad7173_device_info astatic const struct ad7173_device_info ad7172_2_device_info = { .name ="ad7172-2" , .id =AD7172_2_ID , - .sd_info = &ad7173_sigma_delta_info_8_slots, + .sd_info = &ad7173_sigma_delta_info_4_slots, .num_voltage_in =5 , .num_channels =4 , .num_configs =4 ,
@@ -927,7 +943,7 @@ static const struct ad7173_device_info astatic const struct ad7173_device_info ad7173_8_device_info = { .name ="ad7173-8" , .id =AD7173_ID , - .sd_info = &ad7173_sigma_delta_info_8_slots, + .sd_info = &ad7173_sigma_delta_info_16_slots, .num_voltage_in =17 , .num_channels =16 , .num_configs =8 ,
@@ -944,7 +960,7 @@ static const struct ad7173_device_info astatic const struct ad7173_device_info ad7175_2_device_info = { .name ="ad7175-2" , .id =AD7175_2_ID , - .sd_info = &ad7173_sigma_delta_info_8_slots, + .sd_info = &ad7173_sigma_delta_info_4_slots, .num_voltage_in =5 , .num_channels =4 , .num_configs =4 ,
@@ -961,7 +977,7 @@ static const struct ad7173_device_info astatic const struct ad7173_device_info ad7175_8_device_info = { .name ="ad7175-8" , .id =AD7175_8_ID , - .sd_info = &ad7173_sigma_delta_info_8_slots, + .sd_info = &ad7173_sigma_delta_info_16_slots, .num_voltage_in =17 , .num_channels =16 , .num_configs =8 ,
Greg Kroah-Hartman
maintainerPATCH 10/457 usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit 8d1b02e5d7e3a6d2acffb1f4c094678fda9e3456 upstream.
After a recent change in clang to expose uninitialized warnings from const variables [1], there is a warning in cxacru_heavy_init():
drivers/usb/atm/cxacru.c:1104:6: error: variable 'bp' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized]
1104 | if (instance->modem_type->boot_rom_patch) {
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/usb/atm/cxacru.c:1113:39: note: uninitialized use occurs here
1113 | cxacru_upload_firmware(instance, fw, bp);
| ^~
drivers/usb/atm/cxacru.c:1104:2: note: remove the 'if' if its condition is always true
1104 | if (instance->modem_type->boot_rom_patch) {
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/usb/atm/cxacru.c:1095:32: note: initialize the variable 'bp' to silence this warning
1095 | const struct firmware *fw, *bp;
| ^
| = NULLWhile the warning is technically correct that bp is conditionally passed uninitialized to cxacru_upload_firmware(), it is ultimately a false positive warning on the uninitialized use of bp because the same condition that initializes bp, instance->modem_type->boot_rom_patch, is the same one that gates the use of bp within cxacru_upload_firmware(). As this warning occurs in clang's frontend before inlining occurs, it cannot know that these conditions are indentical to avoid the warning.
Manually inline cxacru_upload_firmware() into cxacru_heavy_init(), as that is its only callsite, so that clang can see that bp is initialized and used under the same condition, clearing up the warning without any functional changes to the code (LLVM was already doing this inlining later).
--- drivers/usb/atm/cxacru.c | 106 +++++++++++++++++++++-------------------------- 1 file changed, 49 insertions(+), 57 deletions(-)
drivers/usb/atm/cxacru.c +49 -57
@@ -980,25 +980,60 @@ cleanup:return ret; } -static void cxacru_upload_firmware (struct cxacru_data *instance, -const struct firmware *fw, -const struct firmware *bp) + +static int cxacru_find_firmware (struct cxacru_data *instance, +char *phase,const struct firmware **fw_p) { -int ret; +struct usbatm_data *usbatm = instance->usbatm; +struct device *dev = &usbatm->usb_intf->dev; +char buf[16 ]; + +sprintf (buf,"cxacru-%s.bin" , phase); +usb_dbg (usbatm,"cxacru_find_firmware: looking for %s\n" , buf); + +if (request_firmware (fw_p, buf, dev)) { +usb_dbg (usbatm,"no stage %s firmware found\n" , phase); +return -ENOENT ; + } + +usb_info (usbatm,"found firmware %s\n" , buf); + +return 0 ; +} + +static int cxacru_heavy_init (struct usbatm_data *usbatm_instance, +struct usb_interface *usb_intf) +{ +const struct firmware *fw, *bp; +struct cxacru_data *instance = usbatm_instance->driver_data;struct usbatm_data *usbatm = instance->usbatm;struct usb_device *usb_dev = usbatm->usb_dev;__le16 signature[] = { usb_dev->descriptor.idVendor, usb_dev->descriptor.idProduct };__le32 val; +int ret; + + ret =cxacru_find_firmware (instance,"fw" , &fw); +if (ret) { +usb_warn (usbatm_instance,"firmware (cxacru-fw.bin) unavailable (system misconfigured?)\n" ); +return ret; + } -usb_dbg (usbatm,"%s\n" , __func__); +if (instance->modem_type->boot_rom_patch) { + ret =cxacru_find_firmware (instance,"bp" , &bp); +if (ret) { +usb_warn (usbatm_instance,"boot ROM patch (cxacru-bp.bin) unavailable (system misconfigured?)\n" ); +release_firmware (fw); +return ret; + } + }/* FirmwarePllFClkValue */ val =cpu_to_le32 (instance->modem_type->pll_f_clk); ret =cxacru_fw (usb_dev,FW_WRITE_MEM ,0x2 ,0x0 ,PLLFCLK_ADDR , (u8 *) &val,4 );if (ret) {usb_err (usbatm,"FirmwarePllFClkValue failed: %d\n" , ret); -return ; + goto done; }/* FirmwarePllBClkValue */
@@ -1006,7 +1041,7 @@ static void cxacru_upload_firmware(struc ret =cxacru_fw (usb_dev,FW_WRITE_MEM ,0x2 ,0x0 ,PLLBCLK_ADDR , (u8 *) &val,4 );if (ret) {usb_err (usbatm,"FirmwarePllBClkValue failed: %d\n" , ret); -return ; + goto done; }/* Enable SDRAM */
@@ -1014,7 +1049,7 @@ static void cxacru_upload_firmware(struc ret =cxacru_fw (usb_dev,FW_WRITE_MEM ,0x2 ,0x0 ,SDRAMEN_ADDR , (u8 *) &val,4 );if (ret) {usb_err (usbatm,"Enable SDRAM failed: %d\n" , ret); -return ; + goto done; }/* Firmware */
@@ -1022,7 +1057,7 @@ static void cxacru_upload_firmware(struc ret =cxacru_fw (usb_dev,FW_WRITE_MEM ,0x2 ,0x0 ,FW_ADDR , fw->data, fw->size);if (ret) {usb_err (usbatm,"Firmware upload failed: %d\n" , ret); -return ; + goto done; }/* Boot ROM patch */
@@ -1031,7 +1066,7 @@ static void cxacru_upload_firmware(struc ret =cxacru_fw (usb_dev,FW_WRITE_MEM ,0x2 ,0x0 ,BR_ADDR , bp->data, bp->size);if (ret) {usb_err (usbatm,"Boot ROM patching failed: %d\n" , ret); -return ; + goto done; } }
@@ -1039,7 +1074,7 @@ static void cxacru_upload_firmware(struc ret =cxacru_fw (usb_dev,FW_WRITE_MEM ,0x2 ,0x0 ,SIG_ADDR , (u8 *) signature,4 );if (ret) {usb_err (usbatm,"Signature storing failed: %d\n" , ret); -return ; + goto done; }usb_info (usbatm,"starting device\n" );
@@ -1051,7 +1086,7 @@ static void cxacru_upload_firmware(struc }if (ret) {usb_err (usbatm,"Passing control to firmware failed: %d\n" , ret); -return ; + goto done; }/* Delay to allow firmware to start up. */
@@ -1065,53 +1100,10 @@ static void cxacru_upload_firmware(struc ret =cxacru_cm (instance,CM_REQUEST_CARD_GET_STATUS ,NULL ,0 ,NULL ,0 );if (ret <0 ) {usb_err (usbatm,"modem failed to initialize: %d\n" , ret); -return ; - } -} - -static int cxacru_find_firmware (struct cxacru_data *instance, -char *phase,const struct firmware **fw_p) -{ -struct usbatm_data *usbatm = instance->usbatm; -struct device *dev = &usbatm->usb_intf->dev; -char buf[16 ]; - -sprintf (buf,"cxacru-%s.bin" , phase); -usb_dbg (usbatm,"cxacru_find_firmware: looking for %s\n" , buf); - -if (request_firmware (fw_p, buf, dev)) { -usb_dbg (usbatm,"no stage %s firmware found\n" , phase); -return -ENOENT ; + goto done; } -usb_info (usbatm,"found firmware %s\n" , buf); - -return 0 ; -} - -static int cxacru_heavy_init (struct usbatm_data *usbatm_instance, -struct usb_interface *usb_intf) -{ -const struct firmware *fw, *bp; -struct cxacru_data *instance = usbatm_instance->driver_data; -int ret =cxacru_find_firmware (instance,"fw" , &fw); - -if (ret) { -usb_warn (usbatm_instance,"firmware (cxacru-fw.bin) unavailable (system misconfigured?)\n" ); -return ret; - } - -if (instance->modem_type->boot_rom_patch) { - ret =cxacru_find_firmware (instance,"bp" , &bp); -if (ret) { -usb_warn (usbatm_instance,"boot ROM patch (cxacru-bp.bin) unavailable (system misconfigured?)\n" ); -release_firmware (fw); -return ret; - } - } - -cxacru_upload_firmware (instance, fw, bp); - +done:if (instance->modem_type->boot_rom_patch)release_firmware (bp);release_firmware (fw);
Greg Kroah-Hartman
maintainerPATCH 11/457 usb: gadget: udc: renesas_usb3: fix device leak at unbind
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 868837b0a94c6b1b1fdbc04d3ba218ca83432393 upstream.
Make sure to drop the reference to the companion device taken during probe when the driver is unbound.
--- drivers/usb/gadget/udc/renesas_usb3.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/gadget/udc/renesas_usb3.c +1 -0
@@ -2657,6 +2657,7 @@ static void renesas_usb3_remove(struct pstruct renesas_usb3 *usb3 =platform_get_drvdata (pdev);debugfs_remove_recursive (usb3->dentry); +put_device (usb3->host_dev);device_remove_file (&pdev->dev, &dev_attr_role);cancel_work_sync (&usb3->role_work);
Greg Kroah-Hartman
maintainerPATCH 12/457 usb: musb: omap2430: fix device leak at unbind
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 1473e9e7679bd4f5a62d1abccae894fb86de280f upstream.
Make sure to drop the reference to the control device taken by of_find_device_by_node() during probe when the driver is unbound.
--- drivers/usb/musb/omap2430.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
drivers/usb/musb/omap2430.c +9 -5
@@ -400,7 +400,7 @@ static int omap2430_probe(struct platfor ret =platform_device_add_resources (musb, pdev->resource, pdev->num_resources);if (ret) {dev_err (&pdev->dev,"failed to add resources\n" ); - goto err2; + goto err_put_control_otghs; }if (populate_irqs) {
@@ -413,7 +413,7 @@ static int omap2430_probe(struct platfor res =platform_get_resource (pdev,IORESOURCE_MEM ,0 );if (!res) { ret = -EINVAL ; - goto err2; + goto err_put_control_otghs; } musb_res[i].start = res->start;
@@ -441,14 +441,14 @@ static int omap2430_probe(struct platfor ret =platform_device_add_resources (musb, musb_res, i);if (ret) {dev_err (&pdev->dev,"failed to add IRQ resources\n" ); - goto err2; + goto err_put_control_otghs; } } ret =platform_device_add_data (musb, pdata,sizeof (*pdata));if (ret) {dev_err (&pdev->dev,"failed to add platform_data\n" ); - goto err2; + goto err_put_control_otghs; }pm_runtime_enable (glue->dev);
@@ -463,7 +463,9 @@ static int omap2430_probe(struct platfor err3:pm_runtime_disable (glue->dev); - +err_put_control_otghs: +if (!IS_ERR (glue->control_otghs)) +put_device (glue->control_otghs); err2:platform_device_put (musb);
@@ -477,6 +479,8 @@ static void omap2430_remove(struct platfplatform_device_unregister (glue->musb);pm_runtime_disable (glue->dev); +if (!IS_ERR (glue->control_otghs)) +put_device (glue->control_otghs); }#ifdef CONFIG_PM
Greg Kroah-Hartman
maintainerPATCH 13/457 usb: dwc3: meson-g12a: fix device leaks at unbind
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 93b400f4951404d040197943a25d6fef9f8ccabb upstream.
Make sure to drop the references taken to the child devices by of_find_device_by_node() during probe on driver unbind.
--- drivers/usb/dwc3/dwc3-meson-g12a.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/dwc3/dwc3-meson-g12a.c +3 -0
@@ -837,6 +837,9 @@ static void dwc3_meson_g12a_remove(strucusb_role_switch_unregister (priv->role_switch); +put_device (priv->switch_desc.udc); +put_device (priv->switch_desc.usb2_port); +of_platform_depopulate (dev);for (i =0 ; i <PHY_COUNT ; ++i) {
Greg Kroah-Hartman
maintainerPATCH 14/457 usb: dwc3: imx8mp: fix device leak at unbind
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 086a0e516f7b3844e6328a5c69e2708b66b0ce18 upstream.
Make sure to drop the reference to the dwc3 device taken by of_find_device_by_node() on probe errors and on driver unbind.
--- drivers/usb/dwc3/dwc3-imx8mp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/usb/dwc3/dwc3-imx8mp.c +6 -1
@@ -244,7 +244,7 @@ static int dwc3_imx8mp_probe(struct plat IRQF_ONESHOT, dev_name(dev), dwc3_imx);if (err) {dev_err (dev,"failed to request IRQ #%d --> %d\n" , irq, err); - goto depopulate; + goto put_dwc3; }device_set_wakeup_capable (dev, true);
@@ -252,6 +252,8 @@ static int dwc3_imx8mp_probe(struct platreturn 0 ; +put_dwc3: +put_device (&dwc3_imx->dwc3->dev); depopulate:of_platform_depopulate (dev); remove_swnode:
@@ -265,8 +267,11 @@ disable_rpm:static void dwc3_imx8mp_remove (struct platform_device *pdev) { +struct dwc3_imx8mp *dwc3_imx =platform_get_drvdata (pdev);struct device *dev = &pdev->dev; +put_device (&dwc3_imx->dwc3->dev); +pm_runtime_get_sync (dev);of_platform_depopulate (dev);device_remove_software_node (dev);
Greg Kroah-Hartman
maintainerPATCH 15/457 bus: mhi: host: Fix endianness of BHI vector table
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Wilhelm <[email protected]>
commit f471578e8b1a90623674433a01a8845110bc76ce upstream.
On big endian platform like PowerPC, the MHI bus (which is little endian) does not start properly. The following example shows the error messages by using QCN9274 WLAN device with ath12k driver:
ath12k_pci 0001:01:00.0: BAR 0: assigned [mem 0xc00000000-0xc001fffff 64bit]
ath12k_pci 0001:01:00.0: MSI vectors: 1
ath12k_pci 0001:01:00.0: Hardware name: qcn9274 hw2.0
ath12k_pci 0001:01:00.0: failed to set mhi state: POWER_ON(2)
ath12k_pci 0001:01:00.0: failed to start mhi: -110
ath12k_pci 0001:01:00.0: failed to power up :-110
ath12k_pci 0001:01:00.0: failed to create soc core: -110
ath12k_pci 0001:01:00.0: failed to init core: -110
ath12k_pci: probe of 0001:01:00.0 failed with error -110The issue seems to be with the incorrect DMA address/size used for transferring the firmware image over BHI. So fix it by converting the DMA address and size of the BHI vector table to little endian format before sending them to the device.
--- drivers/bus/mhi/host/boot.c | 8 ++++---- drivers/bus/mhi/host/internal.h | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-)
drivers/bus/mhi/host/boot.c +4 -4
@@ -31,8 +31,8 @@ int mhi_rddm_prepare(struct mhi_controllint ret;for (i =0 ; i < img_info->entries -1 ; i++, mhi_buf++, bhi_vec++) { - bhi_vec->dma_addr = mhi_buf->dma_addr; - bhi_vec->size = mhi_buf->len; + bhi_vec->dma_addr =cpu_to_le64 (mhi_buf->dma_addr); + bhi_vec->size =cpu_to_le64 (mhi_buf->len); }dev_dbg (dev,"BHIe programming for RDDM\n" );
@@ -431,8 +431,8 @@ static void mhi_firmware_copy_bhie(strucwhile (remainder) { to_cpy =min (remainder, mhi_buf->len);memcpy (mhi_buf->buf, buf, to_cpy); - bhi_vec->dma_addr = mhi_buf->dma_addr; - bhi_vec->size = to_cpy; + bhi_vec->dma_addr =cpu_to_le64 (mhi_buf->dma_addr); + bhi_vec->size =cpu_to_le64 (to_cpy); buf += to_cpy; remainder -= to_cpy;
drivers/bus/mhi/host/internal.h +2 -2
@@ -25,8 +25,8 @@ struct mhi_ctxt { };struct bhi_vec_entry { -u64 dma_addr; -u64 size; +__le64 dma_addr; +__le64 size; };enum mhi_fw_load_type {
Greg Kroah-Hartman
maintainerPATCH 16/457 bus: mhi: host: Detect events pointing to unexpected TREs
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Youssef Samir <[email protected]>
commit 5bd398e20f0833ae8a1267d4f343591a2dd20185 upstream.
When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to process all of the TREs between it and the host's local copy of the ring's read pointer. This works when processing completion for chained transactions, but can lead to nasty results if the device sends an event for a single-element transaction with a read pointer that is multiple elements ahead of the host's read pointer.
For instance, if the host accesses an event ring while the device is updating it, the pointer inside of the event might still point to an old TRE. If the host uses the channel's xfer_cb() to directly free the buffer pointed to by the TRE, the buffer will be double-freed.
This behavior was observed on an ep that used upstream EP stack without 'commit 6f18d174b73d ("bus: mhi: ep: Update read pointer only after buffer is written")'. Where the device updated the events ring pointer before updating the event contents, so it left a window where the host was able to access the stale data the event pointed to, before the device had the chance to update them. The usual pattern was that the host received an event pointing to a TRE that is not immediately after the last processed one, so it got treated as if it was a chained transaction, processing all of the TREs in between the two read pointers.
This commit aims to harden the host by ensuring transactions where the event points to a TRE that isn't local_rp + 1 are chained.
--- drivers/bus/mhi/host/main.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/bus/mhi/host/main.c +11 -1
@@ -602,7 +602,7 @@ static int parse_xfer_event(struct mhi_c {dma_addr_t ptr =MHI_TRE_GET_EV_PTR (event);struct mhi_ring_element *local_rp, *ev_tre; -void *dev_rp; +void *dev_rp, *next_rp;struct mhi_buf_info *buf_info;u16 xfer_len;
@@ -621,6 +621,16 @@ static int parse_xfer_event(struct mhi_c result.dir = mhi_chan->dir; local_rp = tre_ring->rp; + + next_rp = local_rp +1 ; +if (next_rp >= tre_ring->base + tre_ring->len) + next_rp = tre_ring->base; +if (dev_rp != next_rp && !MHI_TRE_DATA_GET_CHAIN (local_rp)) { +dev_err (&mhi_cntrl->mhi_dev->dev, +"Event element points to an unexpected TRE\n" ); +break ; + } +while (local_rp != dev_rp) { buf_info = buf_ring->rp;/* If it's the last TRE, get length from the event */
Greg Kroah-Hartman
maintainerPATCH 17/457 vt: keyboard: Dont process Unicode characters in K_OFF mode
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myrrh Periwinkle <[email protected]>
commit b1cc2092ea7a52e2c435aee6d2b1bcb773202663 upstream.
We don't process Unicode characters if the virtual terminal is in raw mode, so there's no reason why we shouldn't do the same for K_OFF (especially since people would expect K_OFF to actually turn off all VT key processing).
--- drivers/tty/vt/keyboard.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/vt/keyboard.c +1 -1
@@ -1487,7 +1487,7 @@ static void kbd_keycode(unsigned int key rc =atomic_notifier_call_chain (&keyboard_notifier_list,KBD_UNICODE , ¶m);if (rc !=NOTIFY_STOP ) -if (down && !raw_mode) +if (down && !(raw_mode || kbd->kbdmode ==VC_OFF ))k_unicode (vc, keysym, !down);return ; }
Greg Kroah-Hartman
maintainerPATCH 18/457 vt: defkeymap: Map keycodes above 127 to K_HOLE
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myrrh Periwinkle <[email protected]>
commit b43cb4ff85da5cf29c4cd351ef1d7dd8210780f7 upstream.
The maximum number of keycodes got bumped to 256 a very long time ago, but the default keymaps were never adjusted to match. This is causing the kernel to interpret keycodes above 127 as U+0000 if the shipped generated keymap is used.
Fix this by mapping all keycodes above 127 to K_HOLE so the kernel ignores them.
The contents of this patche were generated by rerunning loadkeys --mktable --unicode and only including the changes to map keycodes above 127 to K_HOLE.
--- drivers/tty/vt/defkeymap.c_shipped | 112 +++++++++++++++++++++++++++++++++++++ 1 file changed, 112 insertions(+)
drivers/tty/vt/defkeymap.c_shipped +112 -0
@@ -23,6 +23,22 @@ unsigned short plain_map[NR_KEYS] = { 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, }; static unsigned short shift_map[NR_KEYS] = {
@@ -42,6 +58,22 @@ static unsigned short shift_map[NR_KEYS] 0xf20b, 0xf601, 0xf602, 0xf117, 0xf600, 0xf20a, 0xf115, 0xf116, 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, }; static unsigned short altgr_map[NR_KEYS] = {
@@ -61,6 +93,22 @@ static unsigned short altgr_map[NR_KEYS] 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, }; static unsigned short ctrl_map[NR_KEYS] = {
@@ -80,6 +128,22 @@ static unsigned short ctrl_map[NR_KEYS] 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, }; static unsigned short shift_ctrl_map[NR_KEYS] = {
@@ -99,6 +163,22 @@ static unsigned short shift_ctrl_map[NR_ 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, }; static unsigned short alt_map[NR_KEYS] = {
@@ -118,6 +198,22 @@ static unsigned short alt_map[NR_KEYS] = 0xf118, 0xf210, 0xf211, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, }; static unsigned short ctrl_alt_map[NR_KEYS] = {
@@ -137,6 +233,22 @@ static unsigned short ctrl_alt_map[NR_KE 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf20c, 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, }; unsigned short *key_maps[MAX_NR_KEYMAPS] = {
Greg Kroah-Hartman
maintainerPATCH 19/457 netfs: Fix unbuffered write error handling
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
commit a3de58b12ce074ec05b8741fa28d62ccb1070468 upstream.
If all the subrequests in an unbuffered write stream fail, the subrequest collector doesn't update the stream->transferred value and it retains its initial LONG_MAX value. Unfortunately, if all active streams fail, then we take the smallest value of { LONG_MAX, LONG_MAX, ... } as the value to set in wreq->transferred - which is then returned from ->write_iter().
LONG_MAX was chosen as the initial value so that all the streams can be quickly assessed by taking the smallest value of all stream->transferred - but this only works if we've set any of them.
Fix this by adding a flag to indicate whether the value in stream->transferred is valid and checking that when we integrate the values. stream->transferred can then be initialised to zero.
This was found by running the generic/750 xfstest against cifs with cache=none. It splices data to the target file. Once (if) it has used up all the available scratch space, the writes start failing with ENOSPC. This causes ->write_iter() to fail. However, it was returning wreq->transferred, i.e. LONG_MAX, rather than an error (because it thought the amount transferred was non-zero) and iter_file_splice_write() would then try to clean up that amount of pipe bufferage - leading to an oops when it overran. The kernel log showed:
CIFS: VFS: Send error in write = -28
followed by:
BUG: kernel NULL pointer dereference, address: 0000000000000008
with:
RIP: 0010:iter_file_splice_write+0x3a4/0x520
do_splice+0x197/0x4e0or:
RIP: 0010:pipe_buf_release (include/linux/pipe_fs_i.h:282)
iter_file_splice_write (fs/splice.c:755)Also put a warning check into splice to announce if ->write_iter() returned that it had written more than it was asked to.
--- fs/netfs/read_collect.c | 4 +++- fs/netfs/write_collect.c | 10 ++++++++-- fs/netfs/write_issue.c | 4 ++-- fs/splice.c | 3 +++ include/linux/netfs.h | 1 + 5 files changed, 17 insertions(+), 5 deletions(-)
fs/netfs/read_collect.c +3 -1
@@ -281,8 +281,10 @@ reassess: }else if (test_bit (NETFS_RREQ_SHORT_TRANSFER , &rreq->flags)) { notes |=MADE_PROGRESS ; }else { -if (!stream->failed) +if (!stream->failed) { stream->transferred += transferred; + stream->transferred_valid = true; + }if (front->transferred < front->len)set_bit (NETFS_RREQ_SHORT_TRANSFER , &rreq->flags); notes |=MADE_PROGRESS ;
fs/netfs/write_collect.c +8 -2
@@ -254,6 +254,7 @@ reassess_streams:if (front->start + front->transferred > stream->collected_to) { stream->collected_to = front->start + front->transferred; stream->transferred = stream->collected_to - wreq->start; + stream->transferred_valid = true; notes |=MADE_PROGRESS ; }if (test_bit (NETFS_SREQ_FAILED , &front->flags)) {
@@ -356,6 +357,7 @@ bool netfs_write_collection(struct netfs {struct netfs_inode *ictx =netfs_inode (wreq->inode);size_t transferred; +bool transferred_valid = false;int s;_enter ("R=%x" , wreq->debug_id);
@@ -376,12 +378,16 @@ bool netfs_write_collection(struct netfscontinue ;if (!list_empty (&stream->subrequests))return false; -if (stream->transferred < transferred) +if (stream->transferred_valid && + stream->transferred < transferred) { transferred = stream->transferred; + transferred_valid = true; + } }/* Okay, declare that all I/O is complete. */ - wreq->transferred = transferred; +if (transferred_valid) + wreq->transferred = transferred;trace_netfs_rreq (wreq, netfs_rreq_trace_write_done); if (wreq->io_streams[1].active &&
fs/netfs/write_issue.c +2 -2
@@ -118,12 +118,12 @@ struct netfs_io_request *netfs_create_wr wreq->io_streams[0 ].prepare_write = ictx->ops->prepare_write; wreq->io_streams[0 ].issue_write = ictx->ops->issue_write; wreq->io_streams[0 ].collected_to = start; - wreq->io_streams[0 ].transferred =LONG_MAX ; + wreq->io_streams[0 ].transferred =0 ; wreq->io_streams[1 ].stream_nr =1 ; wreq->io_streams[1 ].source =NETFS_WRITE_TO_CACHE ; wreq->io_streams[1 ].collected_to = start; - wreq->io_streams[1 ].transferred =LONG_MAX ; + wreq->io_streams[1 ].transferred =0 ;if (fscache_resources_valid (&wreq->cache_resources)) { wreq->io_streams[1 ].avail = true; wreq->io_streams[1 ].active = true;
fs/splice.c +3 -0
@@ -739,6 +739,9 @@ iter_file_splice_write(struct pipe_inode sd.pos = kiocb.ki_pos;if (ret <=0 )break ; +WARN_ONCE (ret > sd.total_len - left, +"Splice Exceeded! ret=%zd tot=%zu left=%zu\n" , + ret, sd.total_len, left); sd.num_spliced += ret; sd.total_len -= ret;
include/linux/netfs.h +1 -0
@@ -150,6 +150,7 @@ struct netfs_io_stream {bool active;/* T if stream is active */ bool need_retry;/* T if this stream needs retrying */ bool failed;/* T if this stream failed */ +bool transferred_valid;/* T is ->transferred is valid */ };/*
Greg Kroah-Hartman
maintainerPATCH 20/457 lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 22375adaa0d9fbba9646c8e2b099c6e87c97bfae upstream.
The MIPS32r2 ChaCha code has never been buildable with the clang assembler. First, clang doesn't support the 'rotl' pseudo-instruction:
error: unknown instruction, did you mean: rol, rotr?
Second, clang requires that both operands of the 'wsbh' instruction be explicitly given:
error: too few operands for instruction
To fix this, align the code with the real instruction set by (1) using the real instruction 'rotr' instead of the nonstandard pseudo- instruction 'rotl', and (2) explicitly giving both operands to 'wsbh'.
To make removing the use of 'rotl' a bit easier, also remove the unnecessary special-casing for big endian CPUs at .Lchacha_mips_xor_bytes. The tail handling is actually endian-independent since it processes one byte at a time. On big endian CPUs the old code byte-swapped SAVED_X, then iterated through it in reverse order. But the byteswap and reverse iteration canceled out.
Tested with chacha20poly1305-selftest in QEMU using "-M malta" with both little endian and big endian mips32r2 kernels.
--- arch/mips/lib/crypto/chacha-core.S | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-)
arch/mips/lib/crypto/chacha-core.S +7 -13
@@ -55,17 +55,13 @@ #if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__ #define MSB 0 #define LSB 3 -#define ROTx rotl -#define ROTR(n) rotr n, 24 #define CPU_TO_LE32(n) \ - wsbh n; \ + wsbh n, n; \ rotr n, 16; #else #define MSB 3 #define LSB 0 -#define ROTx rotr #define CPU_TO_LE32(n) -#define ROTR(n) #endif #define FOR_EACH_WORD(x) \
@@ -192,10 +188,10 @@ CONCAT3(.Lchacha_mips_xor_aligned_, PLUS xor X(W), X(B); \ xor X(Y), X(C); \ xor X(Z), X(D); \ - rotl X(V), S; \ - rotl X(W), S; \ - rotl X(Y), S; \ - rotl X(Z), S; + rotr X(V), 32 - S; \ + rotr X(W), 32 - S; \ + rotr X(Y), 32 - S; \ + rotr X(Z), 32 - S; .text .set reorder
@@ -372,21 +368,19 @@ chacha_crypt_arch: /* First byte */ lbu T1, 0(IN) addiu $at, BYTES, 1 - CPU_TO_LE32(SAVED_X) - ROTR(SAVED_X) xor T1, SAVED_X sb T1, 0(OUT) beqz $at, .Lchacha_mips_xor_done /* Second byte */ lbu T1, 1(IN) addiu $at, BYTES, 2 - ROTx SAVED_X, 8 + rotr SAVED_X, 8 xor T1, SAVED_X sb T1, 1(OUT) beqz $at, .Lchacha_mips_xor_done /* Third byte */ lbu T1, 2(IN) - ROTx SAVED_X, 8 + rotr SAVED_X, 8 xor T1, SAVED_X sb T1, 2(OUT) b .Lchacha_mips_xor_done
Greg Kroah-Hartman
maintainerPATCH 21/457 lib/crypto: arm/poly1305: Fix register corruption in no-SIMD contexts
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 52c3e242f4d0043186b70d65460ba1767f27494a upstream.
Restore the SIMD usability check that was removed by commit 773426f4771b ("crypto: arm/poly1305 - Add block-only interface").
This safety check is cheap and is well worth eliminating a footgun. While the Poly1305 functions should not be called when SIMD registers are unusable, if they are anyway, they should just do the right thing instead of corrupting random tasks' registers and/or computing incorrect MACs. Fixing this is also needed for poly1305_kunit to pass.
Just use may_use_simd() instead of the original crypto_simd_usable(), since poly1305_kunit won't rely on crypto_simd_disabled_for_test.
--- arch/arm/lib/crypto/poly1305-glue.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm/lib/crypto/poly1305-glue.c +2 -1
@@ -7,6 +7,7 @@#include <asm/hwcap.h> #include <asm/neon.h> +#include <asm/simd.h> #include <crypto/internal/poly1305.h> #include <linux/cpufeature.h> #include <linux/jump_label.h>
@@ -39,7 +40,7 @@ void poly1305_blocks_arch(struct poly130 { len =round_down (len,POLY1305_BLOCK_SIZE );if (IS_ENABLED (CONFIG_KERNEL_MODE_NEON ) && -static_branch_likely (&have_neon)) { +static_branch_likely (&have_neon) &&likely (may_use_simd ())) { do { unsigned int todo = min_t(unsigned int, len, SZ_4K);
Greg Kroah-Hartman
maintainerPATCH 22/457 lib/crypto: arm64/poly1305: Fix register corruption in no-SIMD contexts
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit eec76ea5a7213c48529a46eed1b343e5cee3aaab upstream.
Restore the SIMD usability check that was removed by commit a59e5468a921 ("crypto: arm64/poly1305 - Add block-only interface").
This safety check is cheap and is well worth eliminating a footgun. While the Poly1305 functions should not be called when SIMD registers are unusable, if they are anyway, they should just do the right thing instead of corrupting random tasks' registers and/or computing incorrect MACs. Fixing this is also needed for poly1305_kunit to pass.
Just use may_use_simd() instead of the original crypto_simd_usable(), since poly1305_kunit won't rely on crypto_simd_disabled_for_test.
--- arch/arm64/lib/crypto/poly1305-glue.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm64/lib/crypto/poly1305-glue.c +2 -1
@@ -7,6 +7,7 @@#include <asm/hwcap.h> #include <asm/neon.h> +#include <asm/simd.h> #include <crypto/internal/poly1305.h> #include <linux/cpufeature.h> #include <linux/jump_label.h>
@@ -33,7 +34,7 @@ void poly1305_blocks_arch(struct poly130 unsigned int len, u32 padbit) { len =round_down (len,POLY1305_BLOCK_SIZE ); -if (static_branch_likely (&have_neon)) { +if (static_branch_likely (&have_neon) &&likely (may_use_simd ())) { do { unsigned int todo = min_t(unsigned int, len, SZ_4K);
Greg Kroah-Hartman
maintainerPATCH 23/457 crypto: qat - lower priority for skcipher and aead algorithms
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giovanni Cabiddu <[email protected]>
commit 8024774190a5ef2af2c5846f60a50b23e0980a32 upstream.
Most kernel applications utilizing the crypto API operate synchronously and on small buffer sizes, therefore do not benefit from QAT acceleration.
Reduce the priority of QAT implementations for both skcipher and aead algorithms, allowing more suitable alternatives to be selected by default.
--- drivers/crypto/intel/qat/qat_common/qat_algs.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/crypto/intel/qat/qat_common/qat_algs.c +6 -6
@@ -1277,7 +1277,7 @@ static struct aead_alg qat_aeads[] = { { .base = { .cra_name = "authenc(hmac(sha1),cbc(aes))", .cra_driver_name = "qat_aes_cbc_hmac_sha1", - .cra_priority = 4001, + .cra_priority = 100, .cra_flags = CRYPTO_ALG_ASYNC | CRYPTO_ALG_ALLOCATES_MEMORY, .cra_blocksize = AES_BLOCK_SIZE, .cra_ctxsize = sizeof(struct qat_alg_aead_ctx),
@@ -1294,7 +1294,7 @@ static struct aead_alg qat_aeads[] = { { .base = { .cra_name = "authenc(hmac(sha256),cbc(aes))", .cra_driver_name = "qat_aes_cbc_hmac_sha256", - .cra_priority = 4001, + .cra_priority = 100, .cra_flags = CRYPTO_ALG_ASYNC | CRYPTO_ALG_ALLOCATES_MEMORY, .cra_blocksize = AES_BLOCK_SIZE, .cra_ctxsize = sizeof(struct qat_alg_aead_ctx),
@@ -1311,7 +1311,7 @@ static struct aead_alg qat_aeads[] = { { .base = { .cra_name = "authenc(hmac(sha512),cbc(aes))", .cra_driver_name = "qat_aes_cbc_hmac_sha512", - .cra_priority = 4001, + .cra_priority = 100, .cra_flags = CRYPTO_ALG_ASYNC | CRYPTO_ALG_ALLOCATES_MEMORY, .cra_blocksize = AES_BLOCK_SIZE, .cra_ctxsize = sizeof(struct qat_alg_aead_ctx),
@@ -1329,7 +1329,7 @@ static struct aead_alg qat_aeads[] = { {static struct skcipher_alg qat_skciphers[] = { { .base.cra_name ="cbc(aes)" , .base.cra_driver_name ="qat_aes_cbc" , - .base.cra_priority =4001 , + .base.cra_priority =100 , .base.cra_flags =CRYPTO_ALG_ASYNC |CRYPTO_ALG_ALLOCATES_MEMORY , .base.cra_blocksize =AES_BLOCK_SIZE , .base.cra_ctxsize =sizeof (struct qat_alg_skcipher_ctx ),
@@ -1347,7 +1347,7 @@ static struct skcipher_alg qat_skciphers }, { .base.cra_name = "ctr(aes)", .base.cra_driver_name = "qat_aes_ctr", - .base.cra_priority = 4001, + .base.cra_priority = 100, .base.cra_flags = CRYPTO_ALG_ASYNC | CRYPTO_ALG_ALLOCATES_MEMORY, .base.cra_blocksize = 1, .base.cra_ctxsize = sizeof(struct qat_alg_skcipher_ctx),
@@ -1365,7 +1365,7 @@ static struct skcipher_alg qat_skciphers }, { .base.cra_name = "xts(aes)", .base.cra_driver_name = "qat_aes_xts", - .base.cra_priority = 4001, + .base.cra_priority = 100, .base.cra_flags =CRYPTO_ALG_ASYNC |CRYPTO_ALG_NEED_FALLBACK | CRYPTO_ALG_ALLOCATES_MEMORY, .base.cra_blocksize = AES_BLOCK_SIZE,
Greg Kroah-Hartman
maintainerPATCH 24/457 crypto: ccp - Fix SNP panic notifier unregistration
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ashish Kalra <[email protected]>
commit ab8b9fd39c45b7760093528cbef93e7353359d82 upstream.
Panic notifiers are invoked with RCU read lock held and when the SNP panic notifier tries to unregister itself from the panic notifier callback itself it causes a deadlock as notifier unregistration does RCU synchronization.
Code flow for SNP panic notifier:snp_shutdown_on_panic() -> __sev_firmware_shutdown() -> __sev_snp_shutdown_locked() -> atomic_notifier_chain_unregister(.., &snp_panic_notifier)
Fix SNP panic notifier to unregister itself during SNP shutdown only if panic is not in progress.
--- drivers/crypto/ccp/sev-dev.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/crypto/ccp/sev-dev.c +8 -2
@@ -1787,8 +1787,14 @@ static int __sev_snp_shutdown_locked(int *error, bool panic) sev->snp_initialized = false;dev_dbg (sev->dev,"SEV-SNP firmware shutdown\n" ); -atomic_notifier_chain_unregister (&panic_notifier_list, - &snp_panic_notifier); +/* +* __sev_snp_shutdown_locked() deadlocks when it tries to unregister +* itself during panic as the panic notifier is called with RCU read +* lock held and notifier unregistration does RCU synchronization. +*/ +if (!panic) +atomic_notifier_chain_unregister (&panic_notifier_list, + &snp_panic_notifier);/* Reset TMR size back to default */ sev_es_tmr_size =SEV_TMR_SIZE ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 25/457 crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Ernberg <[email protected]>
commit 5ffc47feddcf8eb4d8ac7b42111a02c8e8146512 upstream.
Since the CAAM on these SoCs is managed by another ARM core, called the SECO (Security Controller) on iMX8QM and Secure Enclave on iMX8ULP, which also reserves access to register page 0 suspend operations cannot touch this page.
This is similar to when running OPTEE, where OPTEE will reserve page 0.
Track this situation using a new state variable no_page0, reflecting if page 0 is reserved elsewhere, either by other management cores in SoC or by OPTEE.
Replace the optee_en check in suspend/resume with the new check.
optee_en cannot go away as it's needed elsewhere to gate OPTEE specific situations.
Fixes the following splat at suspend:
Internal error: synchronous external abort: 0000000096000010 [#1] SMP
Hardware name: Freescale i.MX8QXP ACU6C (DT)
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : readl+0x0/0x18
lr : rd_reg32+0x18/0x3c
sp : ffffffc08192ba20
x29: ffffffc08192ba20 x28: ffffff8025190000 x27: 0000000000000000
x26: ffffffc0808ae808 x25: ffffffc080922338 x24: ffffff8020e89090
x23: 0000000000000000 x22: ffffffc080922000 x21: ffffff8020e89010
x20: ffffffc080387ef8 x19: ffffff8020e89010 x18: 000000005d8000d5
x17: 0000000030f35963 x16: 000000008f785f3f x15: 000000003b8ef57c
x14: 00000000c418aef8 x13: 00000000f5fea526 x12: 0000000000000001
x11: 0000000000000002 x10: 0000000000000001 x9 : 0000000000000000
x8 : ffffff8025190870 x7 : ffffff8021726880 x6 : 0000000000000002
x5 : ffffff80217268f0 x4 : ffffff8021726880 x3 : ffffffc081200000
x2 : 0000000000000001 x1 : ffffff8020e89010 x0 : ffffffc081200004
Call trace:
readl+0x0/0x18
caam_ctrl_suspend+0x30/0xdc
dpm_run_callback.constprop.0+0x24/0x5c
device_suspend+0x170/0x2e8
dpm_suspend+0xa0/0x104
dpm_suspend_start+0x48/0x50
suspend_devices_and_enter+0x7c/0x45c
pm_suspend+0x148/0x160
state_store+0xb4/0xf8
kobj_attr_store+0x14/0x24
sysfs_kf_write+0x38/0x48
kernfs_fop_write_iter+0xb4/0x178
vfs_write+0x118/0x178
ksys_write+0x6c/0xd0
__arm64_sys_write+0x14/0x1c
invoke_syscall.constprop.0+0x64/0xb0
do_el0_svc+0x90/0xb0
el0_svc+0x18/0x44
el0t_64_sync_handler+0x88/0x124
el0t_64_sync+0x150/0x154
Code: 88dffc21 88dffc21 5ac00800 d65f03c0 (b9400000)--- drivers/crypto/caam/ctrl.c | 5 +++-- drivers/crypto/caam/intern.h | 1 + 2 files changed, 4 insertions(+), 2 deletions(-)
drivers/crypto/caam/ctrl.c +3 -2
@@ -831,7 +831,7 @@ static int caam_ctrl_suspend(struct devi {const struct caam_drv_private *ctrlpriv =dev_get_drvdata (dev); -if (ctrlpriv->caam_off_during_pm && !ctrlpriv->optee_en) +if (ctrlpriv->caam_off_during_pm && !ctrlpriv->no_page0)caam_state_save (dev);return 0 ;
@@ -842,7 +842,7 @@ static int caam_ctrl_resume(struct devicstruct caam_drv_private *ctrlpriv =dev_get_drvdata (dev);int ret =0 ; -if (ctrlpriv->caam_off_during_pm && !ctrlpriv->optee_en) { +if (ctrlpriv->caam_off_during_pm && !ctrlpriv->no_page0) {caam_state_restore (dev);/* HW and rng will be reset so deinstantiation can be removed */
@@ -908,6 +908,7 @@ static int caam_probe(struct platform_de imx_soc_data = imx_soc_match->data; reg_access = reg_access && imx_soc_data->page0_access; + ctrlpriv->no_page0 = !reg_access;/* * CAAM clocks cannot be controlled from kernel. */
drivers/crypto/caam/intern.h +1 -0
@@ -115,6 +115,7 @@ struct caam_drv_private {u8 blob_present;/* Nonzero if BLOB support present in device */ u8 mc_en;/* Nonzero if MC f/w is active */ u8 optee_en;/* Nonzero if OP-TEE f/w is active */ +u8 no_page0;/* Nonzero if register page 0 is not controlled by Linux */ bool pr_support;/* RNG prediction resistance available */ int secvio_irq;/* Security violation interrupt number */ int virt_en;/* Virtualization enabled in CAAM */
Greg Kroah-Hartman
maintainerPATCH 26/457 crypto: qat - flush misc workqueue during device shutdown
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giovanni Cabiddu <[email protected]>
commit 3d4df408ba9bad2b205c7fb8afc1836a6a4ca88a upstream.
Repeated loading and unloading of a device specific QAT driver, for example qat_4xxx, in a tight loop can lead to a crash due to a use-after-free scenario. This occurs when a power management (PM) interrupt triggers just before the device-specific driver (e.g., qat_4xxx.ko) is unloaded, while the core driver (intel_qat.ko) remains loaded.
Since the driver uses a shared workqueue (qat_misc_wq) across all devices and owned by intel_qat.ko, a deferred routine from the device-specific driver may still be pending in the queue. If this routine executes after the driver is unloaded, it can dereference freed memory, resulting in a page fault and kernel crash like the following:
BUG: unable to handle page fault for address: ffa000002e50a01c
#PF: supervisor read access in kernel mode
RIP: 0010:pm_bh_handler+0x1d2/0x250 [intel_qat]
Call Trace:
pm_bh_handler+0x1d2/0x250 [intel_qat]
process_one_work+0x171/0x340
worker_thread+0x277/0x3a0
kthread+0xf0/0x120
ret_from_fork+0x2d/0x50To prevent this, flush the misc workqueue during device shutdown to ensure that all pending work items are completed before the driver is unloaded.
Note: This approach may slightly increase shutdown latency if the workqueue contains jobs from other devices, but it ensures correctness and stability.
--- drivers/crypto/intel/qat/qat_common/adf_common_drv.h | 1 + drivers/crypto/intel/qat/qat_common/adf_init.c | 1 + drivers/crypto/intel/qat/qat_common/adf_isr.c | 5 +++++ 3 files changed, 7 insertions(+)
drivers/crypto/intel/qat/qat_common/adf_common_drv.h +1 -0
@@ -189,6 +189,7 @@ void adf_exit_misc_wq(void);bool adf_misc_wq_queue_work (struct work_struct *work);bool adf_misc_wq_queue_delayed_work (struct delayed_work *work,unsigned long delay); +void adf_misc_wq_flush (void );#if defined(CONFIG_PCI_IOV )int adf_sriov_configure (struct pci_dev *pdev,int numvfs);void adf_disable_sriov (struct adf_accel_dev *accel_dev);
drivers/crypto/intel/qat/qat_common/adf_init.c +1 -0
@@ -404,6 +404,7 @@ static void adf_dev_shutdown(struct adf_ hw_data->exit_admin_comms (accel_dev);adf_cleanup_etr_data (accel_dev); +adf_misc_wq_flush ();adf_dev_restore (accel_dev); }
drivers/crypto/intel/qat/qat_common/adf_isr.c +5 -0
@@ -407,3 +407,8 @@ bool adf_misc_wq_queue_delayed_work(stru {return queue_delayed_work (adf_misc_wq, work, delay); } + +void adf_misc_wq_flush (void ) +{ +flush_workqueue (adf_misc_wq); +}
Greg Kroah-Hartman
maintainerPATCH 27/457 crypto: x86/aegis - Fix sleeping when disallowed on PREEMPT_RT
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit c7f49dadfcdf27e1f747442e874e9baa52ab7674 upstream.
skcipher_walk_done() can call kfree(), which takes a spinlock, which makes it incorrect to call while preemption is disabled on PREEMPT_RT. Therefore, end the kernel-mode FPU section before calling skcipher_walk_done(), and restart it afterwards.
Moreover, pass atomic=false to skcipher_walk_aead_encrypt() instead of atomic=true. The point of atomic=true was to make skcipher_walk_done() safe to call while in a kernel-mode FPU section, but that does not actually work. So just use the usual atomic=false.
--- arch/x86/crypto/aegis128-aesni-glue.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
arch/x86/crypto/aegis128-aesni-glue.c +6 -2
@@ -119,7 +119,9 @@ crypto_aegis128_aesni_process_crypt(stru walk->dst.virt.addr,round_down (walk->nbytes, AEGIS128_BLOCK_SIZE)); +kernel_fpu_end ();skcipher_walk_done (walk, walk->nbytes %AEGIS128_BLOCK_SIZE ); +kernel_fpu_begin (); }if (walk->nbytes) {
@@ -131,7 +133,9 @@ crypto_aegis128_aesni_process_crypt(struaegis128_aesni_dec_tail (state, walk->src.virt.addr, walk->dst.virt.addr, walk->nbytes); +kernel_fpu_end ();skcipher_walk_done (walk,0 ); +kernel_fpu_begin (); } }
@@ -176,9 +180,9 @@ crypto_aegis128_aesni_crypt(struct aead_struct aegis_state state;if (enc) -skcipher_walk_aead_encrypt (&walk, req, true); +skcipher_walk_aead_encrypt (&walk, req, false);else -skcipher_walk_aead_decrypt (&walk, req, true); +skcipher_walk_aead_decrypt (&walk, req, false);kernel_fpu_begin ();
Greg Kroah-Hartman
maintainerPATCH 28/457 crypto: x86/aegis - Add missing error checks
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 3d9eb180fbe8828cce43bce4c370124685b205c3 upstream.
The skcipher_walk functions can allocate memory and can fail, so checking for errors is necessary.
--- arch/x86/crypto/aegis128-aesni-glue.c | 36 +++++++++++++++++++++++----------- 1 file changed, 25 insertions(+), 11 deletions(-)
arch/x86/crypto/aegis128-aesni-glue.c +25 -11
@@ -104,10 +104,12 @@ static void crypto_aegis128_aesni_proces } } -static __always_inline void +static __always_inline intcrypto_aegis128_aesni_process_crypt (struct aegis_state *state,struct skcipher_walk *walk,bool enc) { +int err =0 ; +while (walk->nbytes >=AEGIS128_BLOCK_SIZE ) {if (enc) aegis128_aesni_enc(state, walk->src.virt.addr,
@@ -120,7 +122,8 @@ crypto_aegis128_aesni_process_crypt(struround_down (walk->nbytes, AEGIS128_BLOCK_SIZE));kernel_fpu_end (); -skcipher_walk_done (walk, walk->nbytes %AEGIS128_BLOCK_SIZE ); + err =skcipher_walk_done (walk, + walk->nbytes %AEGIS128_BLOCK_SIZE );kernel_fpu_begin (); }
@@ -134,9 +137,10 @@ crypto_aegis128_aesni_process_crypt(stru walk->dst.virt.addr, walk->nbytes);kernel_fpu_end (); -skcipher_walk_done (walk,0 ); + err =skcipher_walk_done (walk,0 );kernel_fpu_begin (); } +return err; }static struct aegis_ctx *crypto_aegis128_aesni_ctx (struct crypto_aead *aead)
@@ -169,7 +173,7 @@ static int crypto_aegis128_aesni_setauthreturn 0 ; } -static __always_inline void +static __always_inline intcrypto_aegis128_aesni_crypt (struct aead_request *req,struct aegis_block *tag_xor,unsigned int cryptlen,bool enc)
@@ -178,20 +182,24 @@ crypto_aegis128_aesni_crypt(struct aead_struct aegis_ctx *ctx =crypto_aegis128_aesni_ctx (tfm);struct skcipher_walk walk;struct aegis_state state; +int err;if (enc) -skcipher_walk_aead_encrypt (&walk, req, false); + err =skcipher_walk_aead_encrypt (&walk, req, false);else -skcipher_walk_aead_decrypt (&walk, req, false); + err =skcipher_walk_aead_decrypt (&walk, req, false); +if (err) +return err;kernel_fpu_begin ();aegis128_aesni_init (&state, &ctx->key, req->iv);crypto_aegis128_aesni_process_ad (&state, req->src, req->assoclen); -crypto_aegis128_aesni_process_crypt (&state, &walk, enc); -aegis128_aesni_final (&state, tag_xor, req->assoclen, cryptlen); - + err =crypto_aegis128_aesni_process_crypt (&state, &walk, enc); +if (err ==0 ) +aegis128_aesni_final (&state, tag_xor, req->assoclen, cryptlen);kernel_fpu_end (); +return err; }static int crypto_aegis128_aesni_encrypt (struct aead_request *req)
@@ -200,8 +208,11 @@ static int crypto_aegis128_aesni_encryptstruct aegis_block tag = {};unsigned int authsize =crypto_aead_authsize (tfm);unsigned int cryptlen = req->cryptlen; +int err; -crypto_aegis128_aesni_crypt (req, &tag, cryptlen, true); + err =crypto_aegis128_aesni_crypt (req, &tag, cryptlen, true); +if (err) +return err;scatterwalk_map_and_copy (tag.bytes, req->dst, req->assoclen + cryptlen, authsize,1 );
@@ -216,11 +227,14 @@ static int crypto_aegis128_aesni_decryptstruct aegis_block tag;unsigned int authsize =crypto_aead_authsize (tfm);unsigned int cryptlen = req->cryptlen - authsize; +int err;scatterwalk_map_and_copy (tag.bytes, req->src, req->assoclen + cryptlen, authsize,0 ); -crypto_aegis128_aesni_crypt (req, &tag, cryptlen, false); + err =crypto_aegis128_aesni_crypt (req, &tag, cryptlen, false); +if (err) +return err;return crypto_memneq (tag.bytes, zeros.bytes, authsize) ? -EBADMSG :0 ; }
Greg Kroah-Hartman
maintainerPATCH 29/457 crypto: octeontx2 - Fix address alignment issue on ucode loading
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bharat Bhushan <[email protected]>
commit b7b88b4939e71ef2aed8238976a2bbabcb63a790 upstream.
octeontx2 crypto driver allocates memory using kmalloc/kzalloc, and uses this memory for dma (does dma_map_single()). It assumes that kmalloc/kzalloc will return 128-byte aligned address. But kmalloc/kzalloc returns 8-byte aligned address after below changes:
"9382bc44b5f5 arm64: allow kmalloc() caches aligned to the
smaller cache_line_size()"
Completion address should be 32-Byte alignment when loading microcode.
--- drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c | 35 ++++++++++++-------- 1 file changed, 21 insertions(+), 14 deletions(-)
drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c +21 -14
@@ -1491,12 +1491,13 @@ int otx2_cpt_discover_eng_capabilities(sunion otx2_cpt_opcode opcode;union otx2_cpt_res_s *result;union otx2_cpt_inst_s inst; +dma_addr_t result_baddr;dma_addr_t rptr_baddr;struct pci_dev *pdev; -u32 len, compl_rlen;int timeout =10000 ; +void *base, *rptr;int ret, etype; -void *rptr; +u32 len;/* * We don't get capabilities if it was already done
@@ -1519,22 +1520,28 @@ int otx2_cpt_discover_eng_capabilities(sif (ret) goto delete_grps; - compl_rlen =ALIGN (sizeof (union otx2_cpt_res_s ),OTX2_CPT_DMA_MINALIGN ); - len = compl_rlen +LOADFVC_RLEN ; +/* Allocate extra memory for "rptr" and "result" pointer alignment */ + len =LOADFVC_RLEN +ARCH_DMA_MINALIGN + +sizeof (union otx2_cpt_res_s ) +OTX2_CPT_RES_ADDR_ALIGN ; - result =kzalloc (len,GFP_KERNEL ); -if (!result) { + base =kzalloc (len,GFP_KERNEL ); +if (!base) { ret = -ENOMEM ; goto lf_cleanup; } - rptr_baddr =dma_map_single (&pdev->dev, (void *)result, len, -DMA_BIDIRECTIONAL ); + + rptr =PTR_ALIGN (base,ARCH_DMA_MINALIGN ); + rptr_baddr =dma_map_single (&pdev->dev, rptr, len,DMA_BIDIRECTIONAL );if (dma_mapping_error (&pdev->dev, rptr_baddr)) {dev_err (&pdev->dev,"DMA mapping failed\n" ); ret = -EFAULT ; - goto free_result; + goto free_rptr; } - rptr = (u8 *)result + compl_rlen; + + result = (union otx2_cpt_res_s *)PTR_ALIGN (rptr +LOADFVC_RLEN , +OTX2_CPT_RES_ADDR_ALIGN ); + result_baddr =ALIGN (rptr_baddr +LOADFVC_RLEN , +OTX2_CPT_RES_ADDR_ALIGN );/* Fill in the command */ opcode.s.major =LOADFVC_MAJOR_OP ;
@@ -1546,14 +1553,14 @@ int otx2_cpt_discover_eng_capabilities(s/* 64-bit swap for microcode data reads, not needed for addresses */ cpu_to_be64s (&iq_cmd.cmd.u); iq_cmd.dptr =0 ; - iq_cmd.rptr = rptr_baddr + compl_rlen; + iq_cmd.rptr = rptr_baddr; iq_cmd.cptr.u =0 ;for (etype =1 ; etype <OTX2_CPT_MAX_ENG_TYPES ; etype++) { result->s.compcode =OTX2_CPT_COMPLETION_CODE_INIT ; iq_cmd.cptr.s.grp =otx2_cpt_get_eng_grp (&cptpf->eng_grps, etype); -otx2_cpt_fill_inst (&inst, &iq_cmd, rptr_baddr); +otx2_cpt_fill_inst (&inst, &iq_cmd, result_baddr); lfs->ops->send_cmd (&inst,1 , &cptpf->lfs.lf[0 ]); timeout =10000 ;
@@ -1576,8 +1583,8 @@ int otx2_cpt_discover_eng_capabilities(s error_no_response:dma_unmap_single (&pdev->dev, rptr_baddr, len,DMA_BIDIRECTIONAL ); -free_result: -kfree (result); +free_rptr: +kfree (base); lf_cleanup:otx2_cptlf_shutdown (lfs); delete_grps:
Greg Kroah-Hartman
maintainerPATCH 30/457 crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bharat Bhushan <[email protected]>
commit 2e13163b43e6bb861182ea999a80dd1d893c0cbf upstream.
octeontx2 crypto driver allocates memory using kmalloc/kzalloc, and uses this memory for dma (does dma_map_single()). It assumes that kmalloc/kzalloc will return 128-byte aligned address. But kmalloc/kzalloc returns 8-byte aligned address after below changes:
"9382bc44b5f5 arm64: allow kmalloc() caches aligned to the
smaller cache_line_size()
Memory allocated are used for following purpose:
- Input data or scatter list address - 8-Byte alignment
- Output data or gather list address - 8-Byte alignment
- Completion address - 32-Byte alignment.
This patch ensures all addresses are aligned as mentioned above.
--- drivers/crypto/marvell/octeontx2/otx2_cpt_reqmgr.h | 66 ++++++++++++++++----- 1 file changed, 51 insertions(+), 15 deletions(-)
drivers/crypto/marvell/octeontx2/otx2_cpt_reqmgr.h +51 -15
@@ -34,6 +34,9 @@#define SG_COMP_2 2#define SG_COMP_1 1 +#define OTX2_CPT_DPTR_RPTR_ALIGN 8 +#define OTX2_CPT_RES_ADDR_ALIGN 32 +union otx2_cpt_opcode {u16 flags;struct {
@@ -417,10 +420,9 @@ static inline struct otx2_cpt_inst_info otx2_sg_info_create(struct pci_dev *pdev, struct otx2_cpt_req_info *req, gfp_t gfp) { - int align = OTX2_CPT_DMA_MINALIGN; struct otx2_cpt_inst_info *info; -u32 dlen, align_dlen, info_len; -u16 g_sz_bytes, s_sz_bytes; +u32 dlen, info_len; +u16 g_len, s_len;u32 total_mem_len; if (unlikely(req->in_cnt > OTX2_CPT_MAX_SG_IN_CNT ||
@@ -429,22 +431,54 @@ otx2_sg_info_create(struct pci_dev *pdevreturn NULL ; } - g_sz_bytes = ((req->in_cnt +3 ) /4 ) * -sizeof (struct otx2_cpt_sglist_component ); - s_sz_bytes = ((req->out_cnt +3 ) /4 ) * -sizeof (struct otx2_cpt_sglist_component ); +/* Allocate memory to meet below alignment requirement: +* ------------------------------------ +* | struct otx2_cpt_inst_info | +* | (No alignment required) | +* | --------------------------------| +* | | padding for ARCH_DMA_MINALIGN | +* | | alignment | +* |------------------------------------| +* | SG List Header of 8 Byte | +* |------------------------------------| +* | SG List Gather/Input memory | +* | Length = multiple of 32Bytes | +* | Alignment = 8Byte | +* |---------------------------------- | +* | SG List Scatter/Output memory | +* | Length = multiple of 32Bytes | +* | Alignment = 8Byte | +* | -------------------------------| +* | | padding for 32B alignment | +* |------------------------------------| +* | Result response memory | +* | Alignment = 32Byte | +* ------------------------------------ +*/ - dlen = g_sz_bytes + s_sz_bytes +SG_LIST_HDR_SIZE ; - align_dlen =ALIGN (dlen, align); - info_len =ALIGN (sizeof (*info), align); - total_mem_len = align_dlen + info_len +sizeof (union otx2_cpt_res_s ); + info_len =sizeof (*info); + + g_len = ((req->in_cnt +3 ) /4 ) * +sizeof (struct otx2_cpt_sglist_component ); + s_len = ((req->out_cnt +3 ) /4 ) * +sizeof (struct otx2_cpt_sglist_component ); + + dlen = g_len + s_len +SG_LIST_HDR_SIZE ; + +/* Allocate extra memory for SG and response address alignment */ + total_mem_len =ALIGN (info_len,OTX2_CPT_DPTR_RPTR_ALIGN ); + total_mem_len += (ARCH_DMA_MINALIGN -1 ) & + ~(OTX2_CPT_DPTR_RPTR_ALIGN -1 ); + total_mem_len +=ALIGN (dlen,OTX2_CPT_RES_ADDR_ALIGN ); + total_mem_len +=sizeof (union otx2_cpt_res_s ); info =kzalloc (total_mem_len, gfp);if (unlikely (!info))return NULL ; info->dlen = dlen; - info->in_buffer = (u8 *)info + info_len; + info->in_buffer =PTR_ALIGN ((u8 *)info + info_len,ARCH_DMA_MINALIGN ); + info->out_buffer = info->in_buffer +SG_LIST_HDR_SIZE + g_len; ((u16 *)info->in_buffer)[0 ] = req->out_cnt; ((u16 *)info->in_buffer)[1 ] = req->in_cnt;
@@ -460,7 +494,7 @@ otx2_sg_info_create(struct pci_dev *pdev }if (setup_sgio_components (pdev, req->out, req->out_cnt, - &info->in_buffer[8 + g_sz_bytes])) { + info->out_buffer)) {dev_err (&pdev->dev,"Failed to setup scatter list\n" ); goto destroy_info; }
@@ -476,8 +510,10 @@ otx2_sg_info_create(struct pci_dev *pdev* Get buffer for union otx2_cpt_res_s response * structure and its physical address */ - info->completion_addr = info->in_buffer + align_dlen; - info->comp_baddr = info->dptr_baddr + align_dlen; + info->completion_addr =PTR_ALIGN ((info->in_buffer + dlen), +OTX2_CPT_RES_ADDR_ALIGN ); + info->comp_baddr =ALIGN ((info->dptr_baddr + dlen), +OTX2_CPT_RES_ADDR_ALIGN );return info;
Greg Kroah-Hartman
maintainerPATCH 31/457 crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bharat Bhushan <[email protected]>
commit a091a58b8a1eba2f243b0c05bcc82bdc2a4a338d upstream.
octeontx2 crypto driver allocates memory using kmalloc/kzalloc, and uses this memory for dma (does dma_map_single()). It assumes that kmalloc/kzalloc will return 128-byte aligned address. But kmalloc/kzalloc returns 8-byte aligned address after below changes:
"9382bc44b5f5 arm64: allow kmalloc() caches aligned to the
smaller cache_line_size()
Memory allocated are used for following purpose:
- Input data or scatter list address - 8-Byte alignment
- Output data or gather list address - 8-Byte alignment
- Completion address - 32-Byte alignment.
This patch ensures all addresses are aligned as mentioned above.
--- drivers/crypto/marvell/octeontx2/otx2_cpt_reqmgr.h | 61 +++++++++++++++------ 1 file changed, 45 insertions(+), 16 deletions(-)
drivers/crypto/marvell/octeontx2/otx2_cpt_reqmgr.h +45 -16
@@ -350,22 +350,48 @@ static inline struct otx2_cpt_inst_info cn10k_sgv2_info_create(struct pci_dev *pdev, struct otx2_cpt_req_info *req, gfp_t gfp) { - u32 dlen = 0, g_len, sg_len, info_len; -int align =OTX2_CPT_DMA_MINALIGN ; + u32 dlen = 0, g_len, s_len, sg_len, info_len;struct otx2_cpt_inst_info *info; -u16 g_sz_bytes, s_sz_bytes;u32 total_mem_len;int i; - g_sz_bytes = ((req->in_cnt +2 ) /3 ) * -sizeof (struct cn10kb_cpt_sglist_component ); - s_sz_bytes = ((req->out_cnt +2 ) /3 ) * -sizeof (struct cn10kb_cpt_sglist_component ); - - g_len =ALIGN (g_sz_bytes, align); - sg_len =ALIGN (g_len + s_sz_bytes, align); - info_len =ALIGN (sizeof (*info), align); - total_mem_len = sg_len + info_len +sizeof (union otx2_cpt_res_s ); +/* Allocate memory to meet below alignment requirement: +* ------------------------------------ +* | struct otx2_cpt_inst_info | +* | (No alignment required) | +* | --------------------------------| +* | | padding for ARCH_DMA_MINALIGN | +* | | alignment | +* |------------------------------------| +* | SG List Gather/Input memory | +* | Length = multiple of 32Bytes | +* | Alignment = 8Byte | +* |---------------------------------- | +* | SG List Scatter/Output memory | +* | Length = multiple of 32Bytes | +* | Alignment = 8Byte | +* | -------------------------------| +* | | padding for 32B alignment | +* |------------------------------------| +* | Result response memory | +* | Alignment = 32Byte | +* ------------------------------------ +*/ + + info_len =sizeof (*info); + + g_len = ((req->in_cnt +2 ) /3 ) * +sizeof (struct cn10kb_cpt_sglist_component ); + s_len = ((req->out_cnt +2 ) /3 ) * +sizeof (struct cn10kb_cpt_sglist_component ); + sg_len = g_len + s_len; + +/* Allocate extra memory for SG and response address alignment */ + total_mem_len =ALIGN (info_len,OTX2_CPT_DPTR_RPTR_ALIGN ); + total_mem_len += (ARCH_DMA_MINALIGN -1 ) & + ~(OTX2_CPT_DPTR_RPTR_ALIGN -1 ); + total_mem_len +=ALIGN (sg_len,OTX2_CPT_RES_ADDR_ALIGN ); + total_mem_len +=sizeof (union otx2_cpt_res_s ); info =kzalloc (total_mem_len, gfp);if (unlikely (!info))
@@ -375,7 +401,8 @@ cn10k_sgv2_info_create(struct pci_dev *p dlen += req->in[i].size; info->dlen = dlen; - info->in_buffer = (u8 *)info + info_len; + info->in_buffer =PTR_ALIGN ((u8 *)info + info_len,ARCH_DMA_MINALIGN ); + info->out_buffer = info->in_buffer + g_len; info->gthr_sz = req->in_cnt; info->sctr_sz = req->out_cnt;
@@ -387,7 +414,7 @@ cn10k_sgv2_info_create(struct pci_dev *p }if (sgv2io_components_setup (pdev, req->out, req->out_cnt, - &info->in_buffer[g_len])) { + info->out_buffer)) {dev_err (&pdev->dev,"Failed to setup scatter list\n" ); goto destroy_info; }
@@ -404,8 +431,10 @@ cn10k_sgv2_info_create(struct pci_dev *p* Get buffer for union otx2_cpt_res_s response * structure and its physical address */ - info->completion_addr = info->in_buffer + sg_len; - info->comp_baddr = info->dptr_baddr + sg_len; + info->completion_addr =PTR_ALIGN ((info->in_buffer + sg_len), +OTX2_CPT_RES_ADDR_ALIGN ); + info->comp_baddr =ALIGN ((info->dptr_baddr + sg_len), +OTX2_CPT_RES_ADDR_ALIGN );return info;
Greg Kroah-Hartman
maintainerPATCH 32/457 crypto: hash - Increase HASH_MAX_DESCSIZE for hmac(sha3-224-s390)
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit 9d9b193ed73a65ec47cf1fd39925b09da8216461 upstream.
The value of HASH_MAX_DESCSIZE is off by one for hmac(sha3-224-s390). Fix this so that hmac(sha3-224-s390) can be registered.
--- include/crypto/hash.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/crypto/hash.h +1 -1
@@ -184,7 +184,7 @@ struct shash_desc {* Worst case is hmac(sha3-224-s390). Its context is a nested 'shash_desc' * containing a 'struct s390_sha_ctx'. */ -#define HASH_MAX_DESCSIZE (sizeof(struct shash_desc) + 360) +#define HASH_MAX_DESCSIZE (sizeof(struct shash_desc) + 361)#define MAX_SYNC_HASH_REQSIZE (sizeof(struct ahash_request) + \ HASH_MAX_DESCSIZE)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 33/457 Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit e4fc307d8e24f122402907ebf585248cad52841d upstream.
This reverts commit 864f9963ec6b4b76d104d595ba28110b87158003.
The patch is wrong as it checks vc_origin against vc_screenbuf, while in text mode it should compare against vga_vram_base.
As such it broke VGA text scrolling, which can be reproduced like this:
(1) boot a kernel that is configured to use text mode VGA-console
(2) type commands: ls -l /usr/bin | less -S
(3) scroll up/down with cursor-down/up keys
--- drivers/video/console/vgacon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/console/vgacon.c +1 -1
@@ -1168,7 +1168,7 @@ static bool vgacon_scroll(struct vc_data c->vc_screenbuf_size - delta); c->vc_origin = vga_vram_end - c->vc_screenbuf_size; vga_rolled_over =0 ; - }else if (oldo - delta >= (unsigned long )c->vc_screenbuf) + }else c->vc_origin -= delta; c->vc_scr_end = c->vc_origin + c->vc_screenbuf_size; scr_memsetw((u16 *) (c->vc_origin), c->vc_video_erase_char,
Greg Kroah-Hartman
maintainerPATCH 34/457 ksmbd: fix refcount leak causing resource not released
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyan Xu <[email protected]>
commit 89bb430f621124af39bb31763c4a8b504c9651e2 upstream.
When ksmbd_conn_releasing(opinfo->conn) returns true,the refcount was not decremented properly, causing a refcount leak that prevents the count from reaching zero and the memory from being released.
--- fs/smb/server/oplock.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
fs/smb/server/oplock.c +10 -3
@@ -1102,8 +1102,10 @@ void smb_send_parent_lease_break_noti(stif (!atomic_inc_not_zero (&opinfo->refcount))continue ; -if (ksmbd_conn_releasing (opinfo->conn)) +if (ksmbd_conn_releasing (opinfo->conn)) { +opinfo_put (opinfo);continue ; + }oplock_break (opinfo,SMB2_OPLOCK_LEVEL_NONE ,NULL );opinfo_put (opinfo);
@@ -1139,8 +1141,11 @@ void smb_lazy_parent_lease_break_close(sif (!atomic_inc_not_zero (&opinfo->refcount))continue ; -if (ksmbd_conn_releasing (opinfo->conn)) +if (ksmbd_conn_releasing (opinfo->conn)) { +opinfo_put (opinfo);continue ; + } +oplock_break (opinfo,SMB2_OPLOCK_LEVEL_NONE ,NULL );opinfo_put (opinfo); }
@@ -1343,8 +1348,10 @@ void smb_break_all_levII_oplock(struct kif (!atomic_inc_not_zero (&brk_op->refcount))continue ; -if (ksmbd_conn_releasing (brk_op->conn)) +if (ksmbd_conn_releasing (brk_op->conn)) { +opinfo_put (brk_op);continue ; + } if (brk_op->is_lease && (brk_op->o_lease->state & (~(SMB2_LEASE_READ_CACHING_LE |
Greg Kroah-Hartman
maintainerPATCH 35/457 ksmbd: extend the connection limiting mechanism to support IPv6
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
commit c0d41112f1a5828c194b59cca953114bc3776ef2 upstream.
Update the connection tracking logic to handle both IPv4 and IPv6 address families.
--- fs/smb/server/connection.h | 7 ++++++- fs/smb/server/transport_tcp.c | 26 +++++++++++++++++++++++--- 2 files changed, 29 insertions(+), 4 deletions(-)
fs/smb/server/connection.h +6 -1
@@ -46,7 +46,12 @@ struct ksmbd_conn {struct mutex srv_mutex;int status;unsigned int cli_cap; -__be32 inet_addr; +union { +__be32 inet_addr; +#if IS_ENABLED (CONFIG_IPV6 ) +u8 inet6_addr[16 ]; +#endif + };char *request_buf;struct ksmbd_transport *transport;struct nls_table *local_nls;
fs/smb/server/transport_tcp.c +23 -3
@@ -87,7 +87,14 @@ static struct tcp_transport *alloc_transreturn NULL ; } +#if IS_ENABLED (CONFIG_IPV6 ) +if (client_sk->sk->sk_family ==AF_INET6 ) +memcpy (&conn->inet6_addr, &client_sk->sk->sk_v6_daddr,16 ); +else + conn->inet_addr =inet_sk (client_sk->sk)->inet_daddr; +#else conn->inet_addr =inet_sk (client_sk->sk)->inet_daddr; +#endif conn->transport =KSMBD_TRANS (t);KSMBD_TRANS (t)->conn = conn;KSMBD_TRANS (t)->ops = &ksmbd_tcp_transport_ops;
@@ -231,7 +238,6 @@ static int ksmbd_kthread_fn(void *p) {struct socket *client_sk =NULL ;struct interface *iface = (struct interface *)p; -struct inet_sock *csk_inet;struct ksmbd_conn *conn;int ret;
@@ -254,13 +260,27 @@ static int ksmbd_kthread_fn(void *p)/* * Limits repeated connections from clients with the same IP. */ - csk_inet =inet_sk (client_sk->sk);down_read (&conn_list_lock); list_for_each_entry(conn, &conn_list, conns_list) -if (csk_inet->inet_daddr == conn->inet_addr) { +#if IS_ENABLED (CONFIG_IPV6 ) +if (client_sk->sk->sk_family ==AF_INET6 ) { +if (memcmp (&client_sk->sk->sk_v6_daddr, + &conn->inet6_addr,16 ) ==0 ) { + ret = -EAGAIN ; +break ; + } + }else if (inet_sk (client_sk->sk)->inet_daddr == + conn->inet_addr) { ret = -EAGAIN ;break ; } +#else +if (inet_sk (client_sk->sk)->inet_daddr == + conn->inet_addr) { + ret = -EAGAIN ; +break ; + } +#endif up_read (&conn_list_lock);if (ret == -EAGAIN )continue ;
Greg Kroah-Hartman
maintainerPATCH 36/457 tracing: fprobe-event: Sanitize wildcard for fprobe event name
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
commit ec879e1a0be8007aa232ffedcf6a6445dfc1a3d7 upstream.
Fprobe event accepts wildcards for the target functions, but unless user specifies its event name, it makes an event with the wildcards.
/sys/kernel/tracing # echo 'f mutex*' >> dynamic_events /sys/kernel/tracing # cat dynamic_events f:fprobes/mutex*__entry mutex* /sys/kernel/tracing # ls events/fprobes/
enable filter mutex*__entry
To fix this, replace the wildcard ('*') with an underscore.
--- kernel/trace/trace.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/trace.h +1 -1
@@ -2204,7 +2204,7 @@ static inline bool is_good_system_name(cstatic inline void sanitize_event_name (char *name) {while (*name++ !='\0' ) -if (*name ==':' || *name =='.' ) +if (*name ==':' || *name =='.' || *name =='*' ) *name ='_' ; }
Greg Kroah-Hartman
maintainerPATCH 37/457 ext4: preserve SB_I_VERSION on remount
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
commit f2326fd14a224e4cccbab89e14c52279ff79b7ec upstream.
IMA testing revealed that after an ext4 remount, file accesses triggered full measurements even without modifications, instead of skipping as expected when i_version is unchanged.
Debugging showed SB_I_VERSION was cleared in reconfigure_super() during remount due to commit 1ff20307393e ("ext4: unconditionally enable the i_version counter") removing the fix from commit 960e0ab63b2e ("ext4: fix i_version handling on remount").
To rectify this, SB_I_VERSION is always set for fc->sb_flags in ext4_init_fs_context(), instead of sb->s_flags in __ext4_fill_super(), ensuring it persists across all mounts.
--- fs/ext4/super.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/ext4/super.c +3 -3
@@ -1998,6 +1998,9 @@ int ext4_init_fs_context(struct fs_conte fc->fs_private = ctx; fc->ops = &ext4_context_ops; +/* i_version is always enabled now */ + fc->sb_flags |=SB_I_VERSION ; +return 0 ; }
@@ -5314,9 +5317,6 @@ static int __ext4_fill_super(struct fs_c sb->s_flags = (sb->s_flags & ~SB_POSIXACL ) | (test_opt (sb,POSIX_ACL ) ?SB_POSIXACL :0 ); -/* i_version is always enabled now */ - sb->s_flags |=SB_I_VERSION ; -/* HSM events are allowed by default. */ sb->s_iflags |=SB_I_ALLOW_HSM ;
Greg Kroah-Hartman
maintainerPATCH 38/457 ext4: check fast symlink for ea_inode correctly
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Dilger <[email protected]>
commit b4cc4a4077268522e3d0d34de4b2dc144e2330fa upstream.
The check for a fast symlink in the presence of only an external xattr inode is incorrect. If a fast symlink does not have an xattr block (i_file_acl == 0), but does have an external xattr inode that increases inode i_blocks, then the check for a fast symlink will incorrectly fail and __ext4_iget()->ext4_ind_check_inode() will report the inode is corrupt when it "validates" i_data[] on the next read:
# ln -s foo /mnt/tmp/bar
# setfattr -h -n trusted.test \
-v "$(yes | head -n 4000)" /mnt/tmp/bar
# umount /mnt/tmp
# mount /mnt/tmp
# ls -l /mnt/tmp
ls: cannot access '/mnt/tmp/bar': Structure needs cleaning
total 4
? l?????????? ? ? ? ? ? bar
# dmesg | tail -1
EXT4-fs error (device dm-8): __ext4_iget:5098:
inode #24578: block 7303014: comm ls: invalid block(note that "block 7303014" = 0x6f6f66 = "foo" in LE order).
ext4_inode_is_fast_symlink() should check the superblock EXT4_FEATURE_INCOMPAT_EA_INODE feature flag, not the inode EXT4_EA_INODE_FL, since the latter is only set on the xattr inode itself, and not on the inode that uses this xattr.
Reviewed-on: https://review.whamcloud.com/59879
Lustre-bug-id: https://jira.whamcloud.com/browse/LU-19121
--- fs/ext4/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/inode.c +1 -1
@@ -146,7 +146,7 @@ static inline int ext4_begin_ordered_tru*/ int ext4_inode_is_fast_symlink (struct inode *inode) { -if (!(EXT4_I (inode)->i_flags &EXT4_EA_INODE_FL )) { +if (!ext4_has_feature_ea_inode (inode->i_sb)) {int ea_blocks =EXT4_I (inode)->i_file_acl ?EXT4_CLUSTER_SIZE (inode->i_sb) >>9 :0 ;
Greg Kroah-Hartman
maintainerPATCH 39/457 ext4: fix fsmap end of range reporting with bigalloc
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ojaswin Mujoo <[email protected]>
commit bae76c035bf0852844151e68098c9b7cd63ef238 upstream.
With bigalloc enabled, the logic to report last extent has a bug since we try to use cluster units instead of block units. This can cause an issue where extra incorrect entries might be returned back to the user. This was flagged by generic/365 with 64k bs and -O bigalloc.
** Details of issue **
The issue was noticed on 5G 64k blocksize FS with -O bigalloc which has only 1 bg.
$ xfs_io -c "fsmap -d" /mnt/scratch
0: 253:48 [0..127]: static fs metadata 128 /* sb */
1: 253:48 [128..255]: special 102:1 128 /* gdt */ 3: 253:48 [256..383]: special 102:3 128 /* block bitmap */ 4: 253:48 [384..2303]: unknown 1920 /* flex bg empty space */
5: 253:48 [2304..2431]: special 102:4 128 /* inode bitmap */
6: 253:48 [2432..4351]: unknown 1920 /* flex bg empty space */
7: 253:48 [4352..6911]: inodes 2560
8: 253:48 [6912..538623]: unknown 531712 9: 253:48 [538624..10485759]: free space 9947136
The issue can be seen with:
$ xfs_io -c "fsmap -d 0 3" /mnt/scratch
0: 253:48 [0..127]: static fs metadata 128
1: 253:48 [384..2047]: unknown 1664
Only the first entry was expected to be returned but we get 2. This is because:
ext4_getfsmap_datadev()
first_cluster, last_cluster = 0
...
info->gfi_last = true;
ext4_getfsmap_datadev_helper(sb, end_ag, last_cluster + 1, 0, info);
fsb = C2B(1) = 16
fslen = 0
...
/* Merge in any relevant extents from the meta_list */
list_for_each_entry_safe(p, tmp, &info->gfi_meta_list, fmr_list) {
...
// since fsb = 16, considers all metadata which starts before 16 blockno
iter 1: error = ext4_getfsmap_helper(sb, info, p); // p = sb (0,1), nop
info->gfi_next_fsblk = 1
iter 2: error = ext4_getfsmap_helper(sb, info, p); // p = gdt (1,2), nop
info->gfi_next_fsblk = 2
iter 3: error = ext4_getfsmap_helper(sb, info, p); // p = blk bitmap (2,3), nop
info->gfi_next_fsblk = 3
iter 4: error = ext4_getfsmap_helper(sb, info, p); // p = ino bitmap (18,19)
if (rec_blk > info->gfi_next_fsblk) { // (18 > 3)
// emits an extra entry ** BUG **
}
}Fix this by directly calling ext4_getfsmap_datadev() with a dummy record that has fmr_physical set to (end_fsb + 1) instead of last_cluster + 1. By using the block instead of cluster we get the correct behavior.
Replacing ext4_getfsmap_datadev_helper() with ext4_getfsmap_helper() is okay since the gfi_lastfree and metadata checks in ext4_getfsmap_datadev_helper() are anyways redundant when we only want to emit the last allocated block of the range, as we have already taken care of emitting metadata and any last free blocks.
--- fs/ext4/fsmap.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
fs/ext4/fsmap.c +12 -3
@@ -526,6 +526,7 @@ static int ext4_getfsmap_datadev(structext4_group_t end_ag;ext4_grpblk_t first_cluster;ext4_grpblk_t last_cluster; +struct ext4_fsmap irec;int error =0 ; bofs =le32_to_cpu (sbi->s_es->s_first_data_block);
@@ -609,10 +610,18 @@ static int ext4_getfsmap_datadev(struct goto err; } -/* Report any gaps at the end of the bg */ +/* +* The dummy record below will cause ext4_getfsmap_helper() to report +* any allocated blocks at the end of the range. +*/ + irec.fmr_device =0 ; + irec.fmr_physical = end_fsb +1 ; + irec.fmr_length =0 ; + irec.fmr_owner =EXT4_FMR_OWN_FREE ; + irec.fmr_flags =0 ; + info->gfi_last = true; - error =ext4_getfsmap_datadev_helper (sb, end_ag, last_cluster +1 , -0 , info); + error =ext4_getfsmap_helper (sb, info, &irec);if (error) goto err;
Greg Kroah-Hartman
maintainerPATCH 40/457 ext4: fix reserved gdt blocks handling in fsmap
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ojaswin Mujoo <[email protected]>
commit 3ffbdd1f1165f1b2d6a94d1b1aabef57120deaf7 upstream.
In some cases like small FSes with no meta_bg and where the resize doesn't need extra gdt blocks as it can fit in the current one, s_reserved_gdt_blocks is set as 0, which causes fsmap to emit a 0 length entry, which is incorrect.
$ mkfs.ext4 -b 65536 -O bigalloc /dev/sda 5G $ mount /dev/sda /mnt/scratch $ xfs_io -c "fsmap -d" /mnt/scartch
0: 253:48 [0..127]: static fs metadata 128
1: 253:48 [128..255]: special 102:1 128
2: 253:48 [256..255]: special 102:2 0 <---- 0 len entry
3: 253:48 [256..383]: special 102:3 128Fix this by adding a check for this case.
--- fs/ext4/fsmap.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/ext4/fsmap.c +8 -0
@@ -393,6 +393,14 @@ static unsigned int ext4_getfsmap_find_s/* Reserved GDT blocks */ if (!ext4_has_feature_meta_bg (sb) || metagroup < first_meta_bg) { len =le16_to_cpu (sbi->s_es->s_reserved_gdt_blocks); + +/* +* mkfs.ext4 can set s_reserved_gdt_blocks as 0 in some cases, +* check for that. +*/ +if (!len) +return 0 ; + error =ext4_getfsmap_fill (meta_list, fsb, len,EXT4_FMR_OWN_RESV_GDT );if (error)
Greg Kroah-Hartman
maintainerPATCH 41/457 ext4: dont try to clear the orphan_present feature block device is r/o
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit c5e104a91e7b6fa12c1dc2d8bf84abb7ef9b89ad upstream.
When the file system is frozen in preparation for taking an LVM snapshot, the journal is checkpointed and if the orphan_file feature is enabled, and the orphan file is empty, we clear the orphan_present feature flag. But if there are pending inodes that need to be removed the orphan_present feature flag can't be cleared.
The problem comes if the block device is read-only. In that case, we can't process the orphan inode list, so it is skipped in ext4_orphan_cleanup(). But then in ext4_mark_recovery_complete(), this results in the ext4 error "Orphan file not empty on read-only fs" firing and the file system mount is aborted.
Fix this by clearing the needs_recovery flag in the block device is read-only. We do this after the call to ext4_load_and_init-journal() since there are some error checks need to be done in case the journal needs to be replayed and the block device is read-only, or if the block device containing the externa journal is read-only, etc.
--- fs/ext4/super.c | 2 ++ 1 file changed, 2 insertions(+)
fs/ext4/super.c +2 -0
@@ -5414,6 +5414,8 @@ static int __ext4_fill_super(struct fs_c err =ext4_load_and_init_journal (sb, es, ctx);if (err) goto failed_mount3a; +if (bdev_read_only (sb->s_bdev)) + needs_recovery =0 ; }else if (test_opt (sb,NOLOAD ) && !sb_rdonly (sb) &&ext4_has_feature_journal_needs_recovery (sb)) { ext4_msg(sb, KERN_ERR, "required journal recovery "
Greg Kroah-Hartman
maintainerPATCH 42/457 ext4: use kmalloc_array() for array space allocation
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Yuanhong <[email protected]>
commit 76dba1fe277f6befd6ef650e1946f626c547387a upstream.
Replace kmalloc(size * sizeof) with kmalloc_array() for safer memory allocation and overflow prevention.
--- fs/ext4/orphan.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/ext4/orphan.c +3 -2
@@ -589,8 +589,9 @@ int ext4_init_orphan_info(struct super_b } oi->of_blocks = inode->i_size >> sb->s_blocksize_bits; oi->of_csum_seed =EXT4_I (inode)->i_csum_seed; - oi->of_binfo =kmalloc (oi->of_blocks*sizeof (struct ext4_orphan_block ), -GFP_KERNEL ); + oi->of_binfo =kmalloc_array (oi->of_blocks, +sizeof (struct ext4_orphan_block ), +GFP_KERNEL );if (!oi->of_binfo) { ret = -ENOMEM ; goto out_put;
Greg Kroah-Hartman
maintainerPATCH 43/457 ext4: fix hole length calculation overflow in non-extent inodes
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
commit 02c7f7219ac0e2277b3379a3a0e9841ef464b6d4 upstream.
In a filesystem with a block size larger than 4KB, the hole length calculation for a non-extent inode in ext4_ind_map_blocks() can easily exceed INT_MAX. Then it could return a zero length hole and trigger the following waring and infinite in the iomap infrastructure.
------------[ cut here ]------------ WARNING: CPU: 3 PID: 434101 at fs/iomap/iter.c:34 iomap_iter_done+0x148/0x190 CPU: 3 UID: 0 PID: 434101 Comm: fsstress Not tainted 6.16.0-rc7+ #128 PREEMPT(voluntary) Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : iomap_iter_done+0x148/0x190 lr : iomap_iter+0x174/0x230 sp : ffff8000880af740 x29: ffff8000880af740 x28: ffff0000db8e6840 x27: 0000000000000000 x26: 0000000000000000 x25: ffff8000880af830 x24: 0000004000000000 x23: 0000000000000002 x22: 000001bfdbfa8000 x21: ffffa6a41c002e48 x20: 0000000000000001 x19: ffff8000880af808 x18: 0000000000000000 x17: 0000000000000000 x16: ffffa6a495ee6cd0 x15: 0000000000000000 x14: 00000000000003d4 x13: 00000000fa83b2da x12: 0000b236fc95f18c x11: ffffa6a4978b9c08 x10: 0000000000001da0 x9 : ffffa6a41c1a2a44 x8 : ffff8000880af5c8 x7 : 0000000001000000 x6 : 0000000000000000 x5 : 0000000000000004 x4 : 000001bfdbfa8000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000004004030000 x0 : 0000000000000000 Call trace: iomap_iter_done+0x148/0x190 (P) iomap_iter+0x174/0x230 iomap_fiemap+0x154/0x1d8 ext4_fiemap+0x110/0x140 [ext4] do_vfs_ioctl+0x4b8/0xbc0 __arm64_sys_ioctl+0x8c/0x120 invoke_syscall+0x6c/0x100 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x38/0x120 el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x1a0 ---[ end trace 0000000000000000 ]---
--- fs/ext4/indirect.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ext4/indirect.c +2 -2
@@ -539,7 +539,7 @@ int ext4_ind_map_blocks(handle_t *handleint indirect_blks;int blocks_to_boundary =0 ;int depth; -int count =0 ; +u64 count =0 ;ext4_fsblk_t first_block =0 ;trace_ext4_ind_map_blocks_enter (inode, map->m_lblk, map->m_len, flags);
@@ -588,7 +588,7 @@ int ext4_ind_map_blocks(handle_t *handle count++;/* Fill in size of a hole we found */ map->m_pblk =0 ; - map->m_len = min_t(unsigned int, map->m_len, count); + map->m_len =umin (map->m_len, count); goto cleanup; }
Greg Kroah-Hartman
maintainerPATCH 44/457 btrfs: zoned: fix write time activation failure for metadata block group
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <[email protected]>
commit 5c4b93f4c8e5c53574c1a48d66a27a2c68b414af upstream.
Since commit 13bb483d32ab ("btrfs: zoned: activate metadata block group on write time"), we activate a metadata block group at the write time. If the zone capacity is small enough, we can allocate the entire region before the first write. Then, we hit the btrfs_zoned_bg_is_full() in btrfs_zone_activate() and the activation fails.
For a data block group, we activate it at the allocation time and we should check the fullness condition in the caller side. Add, a WARN to check the fullness condition.
For a metadata block group, we don't need the fullness check because we activate it at the write time. Instead, activating it once it is written should be invalid. Catch that with a WARN too.
--- fs/btrfs/zoned.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
fs/btrfs/zoned.c +9 -4
@@ -2169,10 +2169,15 @@ bool btrfs_zone_activate(struct btrfs_bl goto out_unlock; } -/* No space left */ -if (btrfs_zoned_bg_is_full (block_group)) { - ret = false; - goto out_unlock; +if (block_group->flags &BTRFS_BLOCK_GROUP_DATA ) { +/* The caller should check if the block group is full. */ +if (WARN_ON_ONCE (btrfs_zoned_bg_is_full (block_group))) { + ret = false; + goto out_unlock; + } + }else { +/* Since it is already written, it should have been active. */ +WARN_ON_ONCE (block_group->meta_write_pointer != block_group->start); }for (i =0 ; i < map->num_stripes; i++) {
Greg Kroah-Hartman
maintainerPATCH 45/457 btrfs: fix incorrect log message for nobarrier mount option
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyoji Ogasawara <[email protected]>
commit edf842abe4368ce3c423343cf4b23b210fcf1622 upstream.
Fix a wrong log message that appears when the "nobarrier" mount option is unset. When "nobarrier" is unset, barrier is actually enabled. However, the log incorrectly stated "turning off barriers".
--- fs/btrfs/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/super.c +1 -1
@@ -1453,7 +1453,7 @@ static void btrfs_emit_options(struct btbtrfs_info_if_unset (info, old,NODATACOW ,"setting datacow" );btrfs_info_if_unset (info, old,SSD ,"not using ssd optimizations" );btrfs_info_if_unset (info, old,SSD_SPREAD ,"not using spread ssd allocation scheme" ); -btrfs_info_if_unset (info, old,NOBARRIER ,"turning off barriers" ); +btrfs_info_if_unset (info, old,NOBARRIER ,"turning on barriers" );btrfs_info_if_unset (info, old,NOTREELOG ,"enabling tree log" );btrfs_info_if_unset (info, old,SPACE_CACHE ,"disabling disk space caching" );btrfs_info_if_unset (info, old,FREE_SPACE_TREE ,"disabling free space tree" );
Greg Kroah-Hartman
maintainerPATCH 46/457 btrfs: restore mount option info messages during mount
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyoji Ogasawara <[email protected]>
commit b435ab556bea875c088485f271ef2709ca1d75f5 upstream.
After the fsconfig migration in 6.8, mount option info messages are no longer displayed during mount operations because btrfs_emit_options() is only called during remount, not during initial mount.
Fix this by calling btrfs_emit_options() in btrfs_fill_super() after open_ctree() succeeds. Additionally, prevent log duplication by ensuring btrfs_check_options() handles validation with warn-level and err-level messages, while btrfs_emit_options() provides info-level messages.
--- fs/btrfs/super.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
fs/btrfs/super.c +5 -3
@@ -88,6 +88,9 @@ struct btrfs_fs_context {refcount_t refs; }; +static void btrfs_emit_options (struct btrfs_fs_info *info, +struct btrfs_fs_context *old); +enum { Opt_acl, Opt_clear_cache,
@@ -689,12 +692,9 @@ bool btrfs_check_options(const struct btif (!test_bit (BTRFS_FS_STATE_REMOUNTING , &info->fs_state)) {if (btrfs_raw_test_opt (*mount_opt,SPACE_CACHE )) { -btrfs_info (info,"disk space caching is enabled" );btrfs_warn (info,"space cache v1 is being deprecated and will be removed in a future release, please use -o space_cache=v2" ); } -if (btrfs_raw_test_opt (*mount_opt,FREE_SPACE_TREE )) -btrfs_info (info,"using free-space-tree" ); }return ret;
@@ -971,6 +971,8 @@ static int btrfs_fill_super(struct superreturn err; } +btrfs_emit_options (fs_info,NULL ); + inode =btrfs_iget (BTRFS_FIRST_FREE_OBJECTID , fs_info->fs_root);if (IS_ERR (inode)) { err =PTR_ERR (inode);
Greg Kroah-Hartman
maintainerPATCH 47/457 btrfs: fix printing of mount info messages for NODATACOW/NODATASUM
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyoji Ogasawara <[email protected]>
commit 74857fdc5dd2cdcdeb6e99bdf26976fd9299d2bb upstream.
The NODATASUM message was printed twice by mistake and the NODATACOW was missing from the 'unset' part. Fix the duplication and make the output look the same.
--- fs/btrfs/super.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/btrfs/super.c +2 -1
@@ -1430,7 +1430,7 @@ static void btrfs_emit_options(struct bt {btrfs_info_if_set (info, old,NODATASUM ,"setting nodatasum" );btrfs_info_if_set (info, old,DEGRADED ,"allowing degraded mounts" ); -btrfs_info_if_set (info, old,NODATASUM ,"setting nodatasum" ); +btrfs_info_if_set (info, old,NODATACOW ,"setting nodatacow" );btrfs_info_if_set (info, old,SSD ,"enabling ssd optimizations" );btrfs_info_if_set (info, old,SSD_SPREAD ,"using spread ssd allocation scheme" );btrfs_info_if_set (info, old,NOBARRIER ,"turning off barriers" );
@@ -1452,6 +1452,7 @@ static void btrfs_emit_options(struct btbtrfs_info_if_set (info, old,IGNOREMETACSUMS ,"ignoring meta csums" );btrfs_info_if_set (info, old,IGNORESUPERFLAGS ,"ignoring unknown super block flags" ); +btrfs_info_if_unset (info, old,NODATASUM ,"setting datasum" );btrfs_info_if_unset (info, old,NODATACOW ,"setting datacow" );btrfs_info_if_unset (info, old,SSD ,"not using ssd optimizations" );btrfs_info_if_unset (info, old,SSD_SPREAD ,"not using spread ssd allocation scheme" );
Greg Kroah-Hartman
maintainerPATCH 48/457 arm64: dts: apple: t8012-j132: Include touchbar framebuffer node
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Chan <[email protected]>
commit ef68a0e1087882850628000f28078e1c4df917ee upstream.
Apple T2 MacBookPro15,2 (j132) has a touchbar so include the framebuffer node.
--- arch/arm64/boot/dts/apple/t8012-j132.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/apple/t8012-j132.dts +1 -0
@@ -7,6 +7,7 @@ /dts-v1/; #include "t8012-jxxx.dtsi" +#include "t8012-touchbar.dtsi" / { model = "Apple T2 MacBookPro15,2 (j132)";
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 49/457 arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <[email protected]>
commit 265f70af805f33a0dfc90f50cc0f116f702c3811 upstream.
For eMMC, High Speed DDR mode is not supported [0], so remove mmc-ddr-1_8v flag which adds the capability.
[0] https://www.ti.com/lit/gpn/am625
--- arch/arm64/boot/dts/ti/k3-am62-main.dtsi | 1 - 1 file changed, 1 deletion(-)
arch/arm64/boot/dts/ti/k3-am62-main.dtsi +0 -1
@@ -553,7 +553,6 @@ clocks = <&k3_clks 57 5>, <&k3_clks 57 6>; clock-names = "clk_ahb", "clk_xin"; bus-width = <8>; - mmc-ddr-1_8v; mmc-hs200-1_8v; ti,clkbuf-sel = <0x7>; ti,otap-del-sel-legacy = <0x0>;
Greg Kroah-Hartman
maintainerPATCH 50/457 arm64: dts: exynos7870-j6lte: reduce memory ranges to base amount
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaustabh Chakraborty <[email protected]>
commit 49a27c6c392dec46c826ee586f7ec8973acaeed7 upstream.
The device is available in multiple variants with differing RAM capacities. The memory range defined in the 0x80000000 bank exceeds the address range of the memory controller, which eventually leads to ARM SError crashes. Reduce the bank size to a value which is available to all devices.
The bootloader must be responsible for identifying the RAM capacity and editing the memory node accordingly.
--- arch/arm64/boot/dts/exynos/exynos7870-j6lte.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/exynos/exynos7870-j6lte.dts +1 -1
@@ -89,7 +89,7 @@ memory@40000000 { device_type = "memory"; reg = <0x0 0x40000000 0x3d800000>, - <0x0 0x80000000 0x7d800000>; + <0x0 0x80000000 0x40000000>; }; pwrseq_mmc1: pwrseq-mmc1 {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 51/457 arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <[email protected]>
commit 5b272127884bded21576a6ddceca13725a351c63 upstream.
Switch Schmitt Trigger functions for PIN_INPUT* macros by default. This is HW PoR configuration, the slew rate requirements without ST enabled are pretty tough for these devices. We've noticed spurious GPIO interrupts even with noise-free edges but not meeting slew rate requirements (3.3E+6 V/s for 3.3v LVCMOS).
It's not obvious why one might want to disable the PoR-enabled ST on any pin. Just enable it by default. As it's not possible to provide OR-able macros to disable the ST, shall anyone require it, provide a set of new macros with _NOST suffix.
--- arch/arm64/boot/dts/ti/k3-pinctrl.h | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
arch/arm64/boot/dts/ti/k3-pinctrl.h +12 -3
@@ -8,6 +8,7 @@#ifndef DTS_ARM64_TI_K3_PINCTRL_H #define DTS_ARM64_TI_K3_PINCTRL_H +#define ST_EN_SHIFT (14)#define PULLUDEN_SHIFT (16)#define PULLTYPESEL_SHIFT (17)#define RXACTIVE_SHIFT (18)
@@ -19,6 +20,10 @@#define DS_PULLUD_EN_SHIFT (27)#define DS_PULLTYPE_SEL_SHIFT (28) +/* Schmitt trigger configuration */ +#define ST_DISABLE (0 << ST_EN_SHIFT) +#define ST_ENABLE (1 << ST_EN_SHIFT) +#define PULL_DISABLE (1 << PULLUDEN_SHIFT)#define PULL_ENABLE (0 << PULLUDEN_SHIFT)
@@ -32,9 +37,13 @@#define PIN_OUTPUT (INPUT_DISABLE | PULL_DISABLE)#define PIN_OUTPUT_PULLUP (INPUT_DISABLE | PULL_UP)#define PIN_OUTPUT_PULLDOWN (INPUT_DISABLE | PULL_DOWN) -#define PIN_INPUT (INPUT_EN | PULL_DISABLE) -#define PIN_INPUT_PULLUP (INPUT_EN | PULL_UP) -#define PIN_INPUT_PULLDOWN (INPUT_EN | PULL_DOWN) +#define PIN_INPUT (INPUT_EN | ST_ENABLE | PULL_DISABLE) +#define PIN_INPUT_PULLUP (INPUT_EN | ST_ENABLE | PULL_UP) +#define PIN_INPUT_PULLDOWN (INPUT_EN | ST_ENABLE | PULL_DOWN) +/* Input configurations with Schmitt Trigger disabled */ +#define PIN_INPUT_NOST (INPUT_EN | PULL_DISABLE) +#define PIN_INPUT_PULLUP_NOST (INPUT_EN | PULL_UP) +#define PIN_INPUT_PULLDOWN_NOST (INPUT_EN | PULL_DOWN)#define PIN_DEBOUNCE_DISABLE (0 << DEBOUNCE_SHIFT)#define PIN_DEBOUNCE_CONF1 (1 << DEBOUNCE_SHIFT)
Greg Kroah-Hartman
maintainerPATCH 52/457 arm64: dts: exynos7870: add quirk to disable USB2 LPM in gadget mode
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaustabh Chakraborty <[email protected]>
commit e9355e894aebcbeacffd284644749190cc5f33a4 upstream.
In gadget mode, USB connections are sluggish. The device won't send packets to the host unless the host sends packets to the device. For instance, SSH-ing through the USB network would apparently not work unless you're flood-pinging the device's IP.
Add the property snps,usb2-gadget-lpm-disable to the dwc3 node, which seems to solve this issue.
--- arch/arm64/boot/dts/exynos/exynos7870.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/exynos/exynos7870.dtsi +1 -0
@@ -327,6 +327,7 @@ phys = <&usbdrd_phy 0>; usb-role-switch; + snps,usb2-gadget-lpm-disable; }; };
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 53/457 arm64: dts: rockchip: Add HDMI PHY PLL clock source to VOP2 on rk3576
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
commit 4ab8b8ac952fb08d03655e1da0cfee07589e428f upstream.
Since commit c871a311edf0 ("phy: rockchip: samsung-hdptx: Setup TMDS char rate via phy_configure_opts_hdmi"), the workaround of passing the rate from DW HDMI QP bridge driver via phy_set_bus_width() became partially broken, as it cannot reliably handle mode switches anymore.
Attempting to fix this up at PHY level would not only introduce additional hacks, but it would also fail to adequately resolve the display issues that are a consequence of the system CRU limitations.
Instead, proceed with the solution already implemented for RK3588: make use of the HDMI PHY PLL as a better suited DCLK source for VOP2. This will not only address the aforementioned problem, but it should also facilitate the proper operation of display modes up to 4K@60Hz.
It's worth noting that anything above 4K@30Hz still requires high TMDS clock ratio and scrambling support, which hasn't been mainlined yet.
--- arch/arm64/boot/dts/rockchip/rk3576.dtsi | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/rockchip/rk3576.dtsi +4 -2
@@ -1155,12 +1155,14 @@ <&cru HCLK_VOP>, <&cru DCLK_VP0>, <&cru DCLK_VP1>, - <&cru DCLK_VP2>; + <&cru DCLK_VP2>, + <&hdptxphy>; clock-names = "aclk", "hclk", "dclk_vp0", "dclk_vp1", - "dclk_vp2"; + "dclk_vp2", + "pll_hdmiphy0"; iommus = <&vop_mmu>; power-domains = <&power RK3576_PD_VOP>; rockchip,grf = <&sys_grf>;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 54/457 arm64: dts: rockchip: Enable HDMI PHY clk provider on rk3576
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
commit aba7987a536cee67fb0cb724099096fd8f8f5350 upstream.
As with the RK3588 SoC, the HDMI PHY PLL on RK3576 can be used as a more accurate pixel clock source for VOP2, which is actually mandatory to ensure proper support for display modes handling.
Add the missing #clock-cells property to allow using the clock provider functionality of HDMI PHY.
--- arch/arm64/boot/dts/rockchip/rk3576.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/rockchip/rk3576.dtsi +1 -0
@@ -2393,6 +2393,7 @@ reg = <0x0 0x2b000000 0x0 0x2000>; clocks = <&cru CLK_PHY_REF_SRC>, <&cru PCLK_HDPTX_APB>; clock-names = "ref", "apb"; + #clock-cells = <0>; resets = <&cru SRST_P_HDPTX_APB>, <&cru SRST_HDPTX_INIT>, <&cru SRST_HDPTX_CMN>, <&cru SRST_HDPTX_LANE>; reset-names = "apb", "init", "cmn", "lane";
Greg Kroah-Hartman
maintainerPATCH 55/457 arm64: dts: exynos: gs101: ufs: add dma-coherent property
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Griffin <[email protected]>
commit 4292564c71cffd8094abcc52dd4840870d05cd30 upstream.
ufs-exynos driver configures the sysreg shareability as cacheable for gs101 so we need to set the dma-coherent property so the descriptors are also allocated cacheable.
This fixes the UFS stability issues we have seen with the upstream UFS driver on gs101.
--- arch/arm64/boot/dts/exynos/google/gs101.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/exynos/google/gs101.dtsi +1 -0
@@ -1371,6 +1371,7 @@ <&cmu_hsi2 CLK_GOUT_HSI2_SYSREG_HSI2_PCLK>; clock-names = "core_clk", "sclk_unipro_main", "fmp", "aclk", "pclk", "sysreg"; + dma-coherent; freq-table-hz = <0 0>, <0 0>, <0 0>, <0 0>, <0 0>, <0 0>; pinctrl-0 = <&ufs_rst_n &ufs_refclk_out>; pinctrl-names = "default";
Greg Kroah-Hartman
maintainerPATCH 56/457 arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hong Guan <[email protected]>
commit 8e44ac61abaae56fc6eb537a04ed78b458c5b984 upstream.
main_uart1 reserved for TIFS firmware traces is routed to the onboard FT4232 via a FET switch which is connected to pin A21 and B21 of the SoC and not E17 and C17. Fix it.
--- arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/ti/k3-am62a7-sk.dts +2 -2
@@ -301,8 +301,8 @@ main_uart1_pins_default: main-uart1-default-pins { pinctrl-single,pins = < - AM62AX_IOPAD(0x01e8, PIN_INPUT, 1) /* (C17) I2C1_SCL.UART1_RXD */ - AM62AX_IOPAD(0x01ec, PIN_OUTPUT, 1) /* (E17) I2C1_SDA.UART1_TXD */ + AM62AX_IOPAD(0x01ac, PIN_INPUT, 2) /* (B21) MCASP0_AFSR.UART1_RXD */ + AM62AX_IOPAD(0x01b0, PIN_OUTPUT, 2) /* (A21) MCASP0_ACLKR.UART1_TXD */ AM62AX_IOPAD(0x0194, PIN_INPUT, 2) /* (C19) MCASP0_AXR3.UART1_CTSn */ AM62AX_IOPAD(0x0198, PIN_OUTPUT, 2) /* (B19) MCASP0_AXR2.UART1_RTSn */ >;
Greg Kroah-Hartman
maintainerPATCH 57/457 arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <[email protected]>
commit a0b8da04153eb61cc2eaeeea5cc404e91e557f6b upstream.
This moves pinmux child nodes for sdhci0 node from k3-am62x-sk-common to each top level board file. This is needed since we require internal pullups for AM62x SK and not for AM62 LP SK since it has external pullups on DATA 1-7.
Internal pulls are required for AM62 SK as per JESD84 spec recommendation to prevent unconnected lines floating.
--- arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts | 24 ++++++++++++++++++++++++ arch/arm64/boot/dts/ti/k3-am625-sk.dts | 24 ++++++++++++++++++++++++ arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi | 24 ------------------------ 3 files changed, 48 insertions(+), 24 deletions(-)
arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts +24 -0
@@ -74,6 +74,22 @@ }; &main_pmx0 { + main_mmc0_pins_default: main-mmc0-default-pins { + bootph-all; + pinctrl-single,pins = < + AM62X_IOPAD(0x220, PIN_INPUT, 0) /* (V3) MMC0_CMD */ + AM62X_IOPAD(0x218, PIN_INPUT, 0) /* (Y1) MMC0_CLK */ + AM62X_IOPAD(0x214, PIN_INPUT, 0) /* (V2) MMC0_DAT0 */ + AM62X_IOPAD(0x210, PIN_INPUT, 0) /* (V1) MMC0_DAT1 */ + AM62X_IOPAD(0x20c, PIN_INPUT, 0) /* (W2) MMC0_DAT2 */ + AM62X_IOPAD(0x208, PIN_INPUT, 0) /* (W1) MMC0_DAT3 */ + AM62X_IOPAD(0x204, PIN_INPUT, 0) /* (Y2) MMC0_DAT4 */ + AM62X_IOPAD(0x200, PIN_INPUT, 0) /* (W3) MMC0_DAT5 */ + AM62X_IOPAD(0x1fc, PIN_INPUT, 0) /* (W4) MMC0_DAT6 */ + AM62X_IOPAD(0x1f8, PIN_INPUT, 0) /* (V4) MMC0_DAT7 */ + >; + }; + vddshv_sdio_pins_default: vddshv-sdio-default-pins { pinctrl-single,pins = < AM62X_IOPAD(0x07c, PIN_OUTPUT, 7) /* (M19) GPMC0_CLK.GPIO0_31 */
@@ -144,6 +160,14 @@ }; }; +&sdhci0 { + bootph-all; + non-removable; + pinctrl-names = "default"; + pinctrl-0 = <&main_mmc0_pins_default>; + status = "okay"; +}; + &sdhci1 { vmmc-supply = <&vdd_mmc1>; vqmmc-supply = <&vddshv_sdio>;
arch/arm64/boot/dts/ti/k3-am625-sk.dts +24 -0
@@ -106,6 +106,22 @@ }; &main_pmx0 { + main_mmc0_pins_default: main-mmc0-default-pins { + bootph-all; + pinctrl-single,pins = < + AM62X_IOPAD(0x220, PIN_INPUT, 0) /* (Y3) MMC0_CMD */ + AM62X_IOPAD(0x218, PIN_INPUT, 0) /* (AB1) MMC0_CLK */ + AM62X_IOPAD(0x214, PIN_INPUT, 0) /* (AA2) MMC0_DAT0 */ + AM62X_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (AA1) MMC0_DAT1 */ + AM62X_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (AA3) MMC0_DAT2 */ + AM62X_IOPAD(0x208, PIN_INPUT_PULLUP, 0) /* (Y4) MMC0_DAT3 */ + AM62X_IOPAD(0x204, PIN_INPUT_PULLUP, 0) /* (AB2) MMC0_DAT4 */ + AM62X_IOPAD(0x200, PIN_INPUT_PULLUP, 0) /* (AC1) MMC0_DAT5 */ + AM62X_IOPAD(0x1fc, PIN_INPUT_PULLUP, 0) /* (AD2) MMC0_DAT6 */ + AM62X_IOPAD(0x1f8, PIN_INPUT_PULLUP, 0) /* (AC2) MMC0_DAT7 */ + >; + }; + main_rgmii2_pins_default: main-rgmii2-default-pins { bootph-all; pinctrl-single,pins = <
@@ -195,6 +211,14 @@ }; }; +&sdhci0 { + bootph-all; + non-removable; + pinctrl-names = "default"; + pinctrl-0 = <&main_mmc0_pins_default>; + status = "okay"; +}; + &sdhci1 { vmmc-supply = <&vdd_mmc1>; vqmmc-supply = <&vdd_sd_dv>;
arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi +0 -24
@@ -203,22 +203,6 @@ >; }; - main_mmc0_pins_default: main-mmc0-default-pins { - bootph-all; - pinctrl-single,pins = < - AM62X_IOPAD(0x220, PIN_INPUT, 0) /* (Y3/V3) MMC0_CMD */ - AM62X_IOPAD(0x218, PIN_INPUT, 0) /* (AB1/Y1) MMC0_CLK */ - AM62X_IOPAD(0x214, PIN_INPUT, 0) /* (AA2/V2) MMC0_DAT0 */ - AM62X_IOPAD(0x210, PIN_INPUT, 0) /* (AA1/V1) MMC0_DAT1 */ - AM62X_IOPAD(0x20c, PIN_INPUT, 0) /* (AA3/W2) MMC0_DAT2 */ - AM62X_IOPAD(0x208, PIN_INPUT, 0) /* (Y4/W1) MMC0_DAT3 */ - AM62X_IOPAD(0x204, PIN_INPUT, 0) /* (AB2/Y2) MMC0_DAT4 */ - AM62X_IOPAD(0x200, PIN_INPUT, 0) /* (AC1/W3) MMC0_DAT5 */ - AM62X_IOPAD(0x1fc, PIN_INPUT, 0) /* (AD2/W4) MMC0_DAT6 */ - AM62X_IOPAD(0x1f8, PIN_INPUT, 0) /* (AC2/V4) MMC0_DAT7 */ - >; - }; - main_mmc1_pins_default: main-mmc1-default-pins { bootph-all; pinctrl-single,pins = <
@@ -457,14 +441,6 @@ clock-frequency = <400000>; }; -&sdhci0 { - bootph-all; - status = "okay"; - non-removable; - pinctrl-names = "default"; - pinctrl-0 = <&main_mmc0_pins_default>; -}; - &sdhci1 { /* SD/MMC */ bootph-all;
Greg Kroah-Hartman
maintainerPATCH 58/457 arm64: dts: exynos7870-on7xelte: reduce memory ranges to base amount
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaustabh Chakraborty <[email protected]>
commit 2bdfa35a7bb6e3a319e7a290baa44720bc96e5e4 upstream.
The device is available in multiple variants with differing RAM capacities. The memory range defined in the 0x80000000 bank exceeds the address range of the memory controller, which eventually leads to ARM SError crashes. Reduce the bank size to a value which is available to all devices.
The bootloader must be responsible for identifying the RAM capacity and editing the memory node accordingly.
--- arch/arm64/boot/dts/exynos/exynos7870-on7xelte.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/exynos/exynos7870-on7xelte.dts +1 -1
@@ -78,7 +78,7 @@ memory@40000000 { device_type = "memory"; reg = <0x0 0x40000000 0x3e400000>, - <0x0 0x80000000 0xbe400000>; + <0x0 0x80000000 0x80000000>; }; pwrseq_mmc1: pwrseq-mmc1 {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 59/457 arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emanuele Ghidoli <[email protected]>
commit bdf4252f736cc1d2a8e3e633c70fe6c728f0756e upstream.
Enable internal bias pull-ups on the SoC-side I2C buses that do not have external pull resistors populated on the SoM. This ensures proper default line levels.
--- arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi +6 -6
@@ -507,16 +507,16 @@ /* Verdin I2C_2_DSI */ pinctrl_i2c2: main-i2c2-default-pins { pinctrl-single,pins = < - AM62X_IOPAD(0x00b0, PIN_INPUT, 1) /* (K22) GPMC0_CSn2.I2C2_SCL */ /* SODIMM 55 */ - AM62X_IOPAD(0x00b4, PIN_INPUT, 1) /* (K24) GPMC0_CSn3.I2C2_SDA */ /* SODIMM 53 */ + AM62X_IOPAD(0x00b0, PIN_INPUT_PULLUP, 1) /* (K22) GPMC0_CSn2.I2C2_SCL */ /* SODIMM 55 */ + AM62X_IOPAD(0x00b4, PIN_INPUT_PULLUP, 1) /* (K24) GPMC0_CSn3.I2C2_SDA */ /* SODIMM 53 */ >; }; /* Verdin I2C_4_CSI */ pinctrl_i2c3: main-i2c3-default-pins { pinctrl-single,pins = < - AM62X_IOPAD(0x01d0, PIN_INPUT, 2) /* (A15) UART0_CTSn.I2C3_SCL */ /* SODIMM 95 */ - AM62X_IOPAD(0x01d4, PIN_INPUT, 2) /* (B15) UART0_RTSn.I2C3_SDA */ /* SODIMM 93 */ + AM62X_IOPAD(0x01d0, PIN_INPUT_PULLUP, 2) /* (A15) UART0_CTSn.I2C3_SCL */ /* SODIMM 95 */ + AM62X_IOPAD(0x01d4, PIN_INPUT_PULLUP, 2) /* (B15) UART0_RTSn.I2C3_SDA */ /* SODIMM 93 */ >; };
@@ -786,8 +786,8 @@ /* Verdin I2C_3_HDMI */ pinctrl_mcu_i2c0: mcu-i2c0-default-pins { pinctrl-single,pins = < - AM62X_MCU_IOPAD(0x0044, PIN_INPUT, 0) /* (A8) MCU_I2C0_SCL */ /* SODIMM 59 */ - AM62X_MCU_IOPAD(0x0048, PIN_INPUT, 0) /* (D10) MCU_I2C0_SDA */ /* SODIMM 57 */ + AM62X_MCU_IOPAD(0x0044, PIN_INPUT_PULLUP, 0) /* (A8) MCU_I2C0_SCL */ /* SODIMM 59 */ + AM62X_MCU_IOPAD(0x0048, PIN_INPUT_PULLUP, 0) /* (D10) MCU_I2C0_SDA */ /* SODIMM 57 */ >; };
Greg Kroah-Hartman
maintainerPATCH 60/457 arm64: dts: rockchip: Remove workaround that prevented Turing RK1 GPU power regulator control
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam Edwards <[email protected]>
commit de5b39d16318f9345f1ba7c1b684ba0c1cb6fdad upstream.
The RK3588 GPU power domain cannot be activated unless the external power regulator is already on. When GPU support was added to this DT, we had no way to represent this requirement, so regulator-always-on was added to the vdd_gpu_s0 regulator in order to ensure stability. A later patch series (see "Fixes:" commit) resolved this shortcoming, but that commit left the workaround -- and rendered the comment above it no longer correct.
Remove the workaround to allow the GPU power regulator to power off, now that the DT includes the necessary information to power it back on correctly.
--- arch/arm64/boot/dts/rockchip/rk3588-turing-rk1.dtsi | 11 ----------- 1 file changed, 11 deletions(-)
arch/arm64/boot/dts/rockchip/rk3588-turing-rk1.dtsi +0 -11
@@ -398,17 +398,6 @@ regulators { vdd_gpu_s0: vdd_gpu_mem_s0: dcdc-reg1 { - /* - * RK3588's GPU power domain cannot be enabled - * without this regulator active, but it - * doesn't have to be on when the GPU PD is - * disabled. Because the PD binding does not - * currently allow us to express this - * relationship, we have no choice but to do - * this instead: - */ - regulator-always-on; - regulator-boot-on; regulator-min-microvolt = <550000>; regulator-max-microvolt = <950000>;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 61/457 apparmor: Fix 8-byte alignment for initial dfa blob streams
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit c567de2c4f5fe6e079672e074e1bc6122bf7e444 upstream.
The dfa blob stream for the aa_dfa_unpack() function is expected to be aligned on a 8 byte boundary.
The static nulldfa_src[] and stacksplitdfa_src[] arrays store the initial apparmor dfa blob streams, but since they are declared as an array-of-chars the compiler and linker will only ensure a "char" (1-byte) alignment.
Add an __aligned(8) annotation to the arrays to tell the linker to always align them on a 8-byte boundary. This avoids runtime warnings at startup on alignment-sensitive platforms like parisc such as:
Kernel: unaligned access to 0x7f2a584a in aa_dfa_unpack+0x124/0x788 (iir 0xca0109f)
Kernel: unaligned access to 0x7f2a584e in aa_dfa_unpack+0x210/0x788 (iir 0xca8109c)
Kernel: unaligned access to 0x7f2a586a in aa_dfa_unpack+0x278/0x788 (iir 0xcb01090)
--- security/apparmor/lsm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
security/apparmor/lsm.c +2 -2
@@ -2149,12 +2149,12 @@ static int __init apparmor_nf_ip_init(vo__initcall (apparmor_nf_ip_init);#endif -static char nulldfa_src[] = { +static char nulldfa_src[]__aligned(8) = { #include "nulldfa.in" };static struct aa_dfa *nulldfa; -static char stacksplitdfa_src[] = { +static char stacksplitdfa_src[]__aligned(8) = { #include "stacksplitdfa.in" };struct aa_dfa *stacksplitdfa;
Greg Kroah-Hartman
maintainerPATCH 62/457 dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 934da599e694d476f493d3927a30414e98a81561 upstream.
'minItems' alone does not impose upper bound, unlike 'maxItems' which implies lower bound. Add missing clock constraint so the list will have exact number of items (clocks).
--- Documentation/devicetree/bindings/display/sprd/sprd,sharkl3-dpu.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/display/sprd/sprd,sharkl3-dpu.yaml +1 -1
@@ -25,7 +25,7 @@ properties: maxItems: 1 clocks: - minItems: 2 + maxItems: 2 clock-names: items:
Greg Kroah-Hartman
maintainerPATCH 63/457 dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 2558df8c13ae3bd6c303b28f240ceb0189519c91 upstream.
'minItems' alone does not impose upper bound, unlike 'maxItems' which implies lower bound. Add missing clock constraint so the list will have exact number of items (clocks).
--- Documentation/devicetree/bindings/display/sprd/sprd,sharkl3-dsi-host.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/display/sprd/sprd,sharkl3-dsi-host.yaml +1 -1
@@ -20,7 +20,7 @@ properties: maxItems: 2 clocks: - minItems: 1 + maxItems: 1 clock-names: items:
Greg Kroah-Hartman
maintainerPATCH 64/457 dt-bindings: display: vop2: Add optional PLL clock property for rk3576
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
commit 3832dc42aed9b047ccecebf5917d008bd2dac940 upstream.
As with the RK3588 SoC, RK3576 also allows the use of HDMI PHY PLL as an alternative and more accurate pixel clock source for VOP2.
Document the optional PLL clock property.
Moreover, given that this is part of a series intended to address some recent display problems, provide the appropriate tags to facilitate backporting.
--- Documentation/devicetree/bindings/display/rockchip/rockchip-vop2.yaml | 56 +++++++--- 1 file changed, 44 insertions(+), 12 deletions(-)
Documentation/devicetree/bindings/display/rockchip/rockchip-vop2.yaml +44 -12
@@ -64,10 +64,10 @@ properties: - description: Pixel clock for video port 0. - description: Pixel clock for video port 1. - description: Pixel clock for video port 2. - - description: Pixel clock for video port 3. - - description: Peripheral(vop grf/dsi) clock. - - description: Alternative pixel clock provided by HDMI0 PHY PLL. - - description: Alternative pixel clock provided by HDMI1 PHY PLL. + - {} + - {} + - {} + - {} clock-names: minItems: 5
@@ -77,10 +77,10 @@ properties: - const: dclk_vp0 - const: dclk_vp1 - const: dclk_vp2 - - const: dclk_vp3 - - const: pclk_vop - - const: pll_hdmiphy0 - - const: pll_hdmiphy1 + - {} + - {} + - {} + - {} rockchip,grf: $ref: /schemas/types.yaml#/definitions/phandle
@@ -175,10 +175,24 @@ allOf: then: properties: clocks: - maxItems: 5 + minItems: 5 + items: + - {} + - {} + - {} + - {} + - {} + - description: Alternative pixel clock provided by HDMI PHY PLL. clock-names: - maxItems: 5 + minItems: 5 + items: + - {} + - {} + - {} + - {} + - {} + - const: pll_hdmiphy0 interrupts: minItems: 4
@@ -208,11 +222,29 @@ allOf: properties: clocks: minItems: 7 - maxItems: 9 + items: + - {} + - {} + - {} + - {} + - {} + - description: Pixel clock for video port 3. + - description: Peripheral(vop grf/dsi) clock. + - description: Alternative pixel clock provided by HDMI0 PHY PLL. + - description: Alternative pixel clock provided by HDMI1 PHY PLL. clock-names: minItems: 7 - maxItems: 9 + items: + - {} + - {} + - {} + - {} + - {} + - const: dclk_vp3 + - const: pclk_vop + - const: pll_hdmiphy0 + - const: pll_hdmiphy1 interrupts: maxItems: 1
Greg Kroah-Hartman
maintainerPATCH 65/457 scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Macpaul Lin <[email protected]>
commit 794ff7a0a6e76af93c5ec09a49b86fe73373ca59 upstream.
Add the 'mediatek,ufs-disable-mcq' property to the UFS device-tree bindings. This flag corresponds to the UFS_MTK_CAP_DISABLE_MCQ host capability recently introduced in the UFS host driver, allowing it to disable the Multiple Circular Queue (MCQ) feature when present. The binding schema has also been updated to resolve DTBS check errors.
--- Documentation/devicetree/bindings/ufs/mediatek,ufs.yaml | 4 ++++ 1 file changed, 4 insertions(+)
Documentation/devicetree/bindings/ufs/mediatek,ufs.yaml +4 -0
@@ -33,6 +33,10 @@ properties: vcc-supply: true + mediatek,ufs-disable-mcq: + $ref: /schemas/types.yaml#/definitions/flag + description: The mask to disable MCQ (Multi-Circular Queue) for UFS host. + required: - compatible - clocks
Greg Kroah-Hartman
maintainerPATCH 66/457 scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Draszik <[email protected]>
commit 01aad16c2257ab8ff33b152b972c9f2e1af47912 upstream.
On Google gs101, the number of UTP transfer request slots (nutrs) is 32, and in this case the driver ends up programming the UTRL_NEXUS_TYPE incorrectly as 0.
This is because the left hand side of the shift is 1, which is of type int, i.e. 31 bits wide. Shifting by more than that width results in undefined behaviour.
Fix this by switching to the BIT() macro, which applies correct type casting as required. This ensures the correct value is written to UTRL_NEXUS_TYPE (0xffffffff on gs101), and it also fixes a UBSAN shift warning:
UBSAN: shift-out-of-bounds in drivers/ufs/host/ufs-exynos.c:1113:21
shift exponent 32 is too large for 32-bit type 'int'For consistency, apply the same change to the nutmrs / UTMRL_NEXUS_TYPE write.
--- drivers/ufs/host/ufs-exynos.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/ufs/host/ufs-exynos.c +2 -2
@@ -1110,8 +1110,8 @@ static int exynos_ufs_post_link(struct uhci_writel (ufs, val,HCI_TXPRDT_ENTRY_SIZE );hci_writel (ufs,ilog2 (DATA_UNIT_SIZE ),HCI_RXPRDT_ENTRY_SIZE ); -hci_writel (ufs, (1 << hba->nutrs) -1 ,HCI_UTRL_NEXUS_TYPE ); -hci_writel (ufs, (1 << hba->nutmrs) -1 ,HCI_UTMRL_NEXUS_TYPE ); +hci_writel (ufs,BIT (hba->nutrs) -1 ,HCI_UTRL_NEXUS_TYPE ); +hci_writel (ufs,BIT (hba->nutmrs) -1 ,HCI_UTMRL_NEXUS_TYPE );hci_writel (ufs,0xf ,HCI_AXIDMA_RWDATA_BURST_LEN );if (ufs->opts &EXYNOS_UFS_OPT_SKIP_CONNECTION_ESTAB )
Greg Kroah-Hartman
maintainerPATCH 67/457 scsi: mpi3mr: Fix race between config read submit and interrupt completion
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranjan Kumar <[email protected]>
commit e6327c4acf925bb6d6d387d76fc3bd94471e10d8 upstream.
The "is_waiting" flag was updated after calling complete(), which could lead to a race where the waiting thread wakes up before the flag is cleared. This may cause a missed wakeup or stale state check.
Reorder the operations to update "is_waiting" before signaling completion to ensure consistent state.
--- drivers/scsi/mpi3mr/mpi3mr_fw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/mpi3mr/mpi3mr_fw.c +1 -1
@@ -428,8 +428,8 @@ static void mpi3mr_process_admin_reply_d MPI3MR_SENSE_BUF_SZ); }if (cmdptr->is_waiting) { -complete (&cmdptr->done); cmdptr->is_waiting =0 ; +complete (&cmdptr->done); }else if (cmdptr->callback) cmdptr->callback (mrioc, cmdptr); }
Greg Kroah-Hartman
maintainerPATCH 68/457 ata: libata-scsi: Fix ata_to_sense_error() status handling
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit cf3fc037623c54de48d2ec1a1ee686e2d1de2d45 upstream.
Commit 8ae720449fca ("libata: whitespace fixes in ata_to_sense_error()") inadvertantly added the entry 0x40 (ATA_DRDY) to the stat_table array in the function ata_to_sense_error(). This entry ties a failed qc which has a status filed equal to ATA_DRDY to the sense key ILLEGAL REQUEST with the additional sense code UNALIGNED WRITE COMMAND. This entry will be used to generate a failed qc sense key and sense code when the qc is missing sense data and there is no match for the qc error field in the sense_table array of ata_to_sense_error().
As a result, for a failed qc for which we failed to get sense data (e.g. read log 10h failed if qc is an NCQ command, or REQUEST SENSE EXT command failed for the non-ncq case, the user very often end up seeing the completely misleading "unaligned write command" error, even if qc was not a write command. E.g.:
sd 0:0:0:0: [sda] tag#12 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s sd 0:0:0:0: [sda] tag#12 Sense Key : Illegal Request [current]
sd 0:0:0:0: [sda] tag#12 Add. Sense: Unaligned write command
sd 0:0:0:0: [sda] tag#12 CDB: Read(10) 28 00 00 00 10 00 00 00 08 00
I/O error, dev sda, sector 4096 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0
Fix this by removing the ATA_DRDY entry from the stat_table array so that we default to always returning ABORTED COMMAND without any additional sense code, since we do not know any better. The entry 0x08 (ATA_DRQ) is also removed since signaling ABORTED COMMAND with a parity error is also misleading (as a parity error would likely be signaled through a bus error). So for this case, also default to returning ABORTED COMMAND without any additional sense code. With this, the previous example error case becomes:
sd 0:0:0:0: [sda] tag#17 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s sd 0:0:0:0: [sda] tag#17 Sense Key : Aborted Command [current]
sd 0:0:0:0: [sda] tag#17 Add. Sense: No additional sense information
sd 0:0:0:0: [sda] tag#17 CDB: Read(10) 28 00 00 00 10 00 00 00 08 00
I/O error, dev sda, sector 4096 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0
Together with these fixes, refactor stat_table to make it more readable by putting the entries comments in front of the entries and using the defined status bits macros instead of hardcoded values.
--- drivers/ata/libata-scsi.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-)
drivers/ata/libata-scsi.c +8 -12
@@ -859,18 +859,14 @@ static void ata_to_sense_error(u8 drv_st {0xFF, 0xFF, 0xFF, 0xFF}, // END mark };static const unsigned char stat_table[][4 ] = { -/* Must be first because BUSY means no other bits valid */ - {0x80 ,ABORTED_COMMAND ,0x47 ,0x00 }, -// Busy, fake parity for now - {0x40 ,ILLEGAL_REQUEST ,0x21 ,0x04 }, -// Device ready, unaligned write command - {0x20 ,HARDWARE_ERROR ,0x44 ,0x00 }, -// Device fault, internal target failure - {0x08 ,ABORTED_COMMAND ,0x47 ,0x00 }, -// Timed out in xfer, fake parity for now - {0x04 ,RECOVERED_ERROR ,0x11 ,0x00 }, -// Recovered ECC error Medium error, recovered - {0xFF ,0xFF ,0xFF ,0xFF },// END mark +/* Busy: must be first because BUSY means no other bits valid */ + {ATA_BUSY ,ABORTED_COMMAND ,0x00 ,0x00 }, +/* Device fault: INTERNAL TARGET FAILURE */ + {ATA_DF ,HARDWARE_ERROR ,0x44 ,0x00 }, +/* Corrected data error */ + {ATA_CORR ,RECOVERED_ERROR ,0x00 ,0x00 }, + + {0xFF ,0xFF ,0xFF ,0xFF },/* END mark */ };/*
Greg Kroah-Hartman
maintainerPATCH 69/457 ata: libata-scsi: Return aborted command when missing sense and result TF
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit d2be9ea9a75550a35c5127a6c2633658bc38c76b upstream.
ata_gen_ata_sense() is always called for a failed qc missing sense data so that a sense key, code and code qualifier can be generated using ata_to_sense_error() from the qc status and error fields of its result task file. However, if the qc does not have its result task file filled, ata_gen_ata_sense() returns early without setting a sense key.
Improve this by defaulting to returning ABORTED COMMAND without any additional sense code, since we do not know the reason for the failure. The same fix is also applied in ata_gen_passthru_sense() with the additional check that the qc failed (qc->err_mask is set).
--- drivers/ata/libata-scsi.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
drivers/ata/libata-scsi.c +11 -7
@@ -938,6 +938,8 @@ static void ata_gen_passthru_sense(strucif (!(qc->flags &ATA_QCFLAG_RTF_FILLED )) {ata_dev_dbg (dev,"missing result TF: can't generate ATA PT sense data\n" ); +if (qc->err_mask) +ata_scsi_set_sense (dev, cmd,ABORTED_COMMAND ,0 ,0 );return ; }
@@ -992,8 +994,8 @@ static void ata_gen_ata_sense(struct ataif (!(qc->flags &ATA_QCFLAG_RTF_FILLED )) {ata_dev_dbg (dev, -"missing result TF: can't generate sense data\n" ); -return ; +"Missing result TF: reporting aborted command\n" ); + goto aborted; }/* Use ata_to_sense_error() to map status register bits
@@ -1004,13 +1006,15 @@ static void ata_gen_ata_sense(struct ataata_to_sense_error (tf->status, tf->error, &sense_key, &asc, &ascq);ata_scsi_set_sense (dev, cmd, sense_key, asc, ascq); - }else { -/* Could not decode error */ -ata_dev_warn (dev,"could not decode error status 0x%x err_mask 0x%x\n" , - tf->status, qc->err_mask); -ata_scsi_set_sense (dev, cmd,ABORTED_COMMAND ,0 ,0 );return ; } + +/* Could not decode error */ +ata_dev_warn (dev, +"Could not decode error 0x%x, status 0x%x (err_mask=0x%x)\n" , + tf->error, tf->status, qc->err_mask); +aborted: +ata_scsi_set_sense (dev, cmd,ABORTED_COMMAND ,0 ,0 ); }void ata_scsi_sdev_config (struct scsi_device *sdev)
Greg Kroah-Hartman
maintainerPATCH 70/457 scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Archana Patni <[email protected]>
commit 4428ddea832cfdb63e476eb2e5c8feb5d36057fe upstream.
UFSHCD core disables the UIC completion interrupt when issuing UIC hibernation commands, and re-enables it afterwards if it was enabled to start with, refer ufshcd_uic_pwr_ctrl(). For Intel MTL-like host controllers, accessing the register to re-enable the interrupt disrupts the state transition.
Use hibern8_notify variant operation to disable the interrupt during the entire hibernation, thereby preventing the disruption.
--- drivers/ufs/host/ufshcd-pci.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)
drivers/ufs/host/ufshcd-pci.c +27 -0
@@ -216,6 +216,32 @@ out:return ret; } +static void ufs_intel_ctrl_uic_compl (struct ufs_hba *hba,bool enable) +{ +u32 set =ufshcd_readl (hba,REG_INTERRUPT_ENABLE ); + +if (enable) + set |=UIC_COMMAND_COMPL ; +else + set &= ~UIC_COMMAND_COMPL ; +ufshcd_writel (hba, set,REG_INTERRUPT_ENABLE ); +} + +static void ufs_intel_mtl_h8_notify (struct ufs_hba *hba, +enum uic_cmd_dme cmd, +enum ufs_notify_change_status status) +{ +/* +* Disable UIC COMPL INTR to prevent access to UFSHCI after +* checking HCS.UPMCRS +*/ +if (status ==PRE_CHANGE && cmd ==UIC_CMD_DME_HIBER_ENTER ) +ufs_intel_ctrl_uic_compl (hba, false); + +if (status ==POST_CHANGE && cmd ==UIC_CMD_DME_HIBER_EXIT ) +ufs_intel_ctrl_uic_compl (hba, true); +} +#define INTEL_ACTIVELTR 0x804#define INTEL_IDLELTR 0x808
@@ -533,6 +559,7 @@ static struct ufs_hba_variant_ops ufs_in .init = ufs_intel_mtl_init, .exit = ufs_intel_common_exit, .hce_enable_notify = ufs_intel_hce_enable_notify, + .hibern8_notify = ufs_intel_mtl_h8_notify, .link_startup_notify = ufs_intel_link_startup_notify, .resume = ufs_intel_resume, .device_reset = ufs_intel_device_reset,
Greg Kroah-Hartman
maintainerPATCH 71/457 scsi: ufs: ufs-pci: Fix default runtime and system PM levels
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit 6de7435e6b81fe52c0ab4c7e181f6b5decd18eb1 upstream.
Intel MTL-like host controllers support auto-hibernate. Using auto-hibernate with manual (driver initiated) hibernate produces more complex operation. For example, the host controller will have to exit auto-hibernate simply to allow the driver to enter hibernate state manually. That is not recommended.
The default rpm_lvl and spm_lvl is 3, which includes manual hibernate.
Change the default values to 2, which does not.
Note, to be simpler to backport to stable kernels, utilize the UFS PCI driver's ->late_init() call back. Recent commits have made it possible to set up a controller-specific default in the regular ->init() call back, but not all stable kernels have those changes.
--- drivers/ufs/host/ufshcd-pci.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
drivers/ufs/host/ufshcd-pci.c +14 -1
@@ -468,10 +468,23 @@ static int ufs_intel_adl_init(struct ufsreturn ufs_intel_common_init (hba); } +static void ufs_intel_mtl_late_init (struct ufs_hba *hba) +{ + hba->rpm_lvl =UFS_PM_LVL_2 ; + hba->spm_lvl =UFS_PM_LVL_2 ; +} +static int ufs_intel_mtl_init (struct ufs_hba *hba) { +struct ufs_host *ufs_host; +int err; + hba->caps |=UFSHCD_CAP_CRYPTO |UFSHCD_CAP_WB_EN ; -return ufs_intel_common_init (hba); + err =ufs_intel_common_init (hba); +/* Get variant after it is set in ufs_intel_common_init() */ + ufs_host =ufshcd_get_variant (hba); + ufs_host->late_init = ufs_intel_mtl_late_init; +return err; }static int ufs_qemu_get_hba_mac (struct ufs_hba *hba)
Greg Kroah-Hartman
maintainerPATCH 72/457 ata: libata-scsi: Fix CDL control
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Pylypiv <[email protected]>
commit 58768b0563916ddcb73d8ed26ede664915f8df31 upstream.
Delete extra checks for the ATA_DFLAG_CDL_ENABLED flag that prevent SET FEATURES command from being issued to a drive when NCQ commands are active.
ata_mselect_control_ata_feature() sets / clears the ATA_DFLAG_CDL_ENABLED flag during the translation of MODE SELECT to SET FEATURES. If SET FEATURES gets deferred due to outstanding NCQ commands, the original MODE SELECT command will be re-queued. When the re-queued MODE SELECT goes through the ata_mselect_control_ata_feature() translation again, SET FEATURES will not be issued because ATA_DFLAG_CDL_ENABLED has been already set or cleared by the initial translation of MODE SELECT.
The ATA_DFLAG_CDL_ENABLED checks in ata_mselect_control_ata_feature() are safe to remove because scsi_cdl_enable() implements a similar logic that avoids enabling CDL if it has been enabled already.
--- drivers/ata/libata-scsi.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-)
drivers/ata/libata-scsi.c +3 -8
@@ -3905,21 +3905,16 @@ static int ata_mselect_control_ata_featu/* Check cdl_ctrl */ switch (buf[0 ] &0x03 ) {case 0 : -/* Disable CDL if it is enabled */ -if (!(dev->flags &ATA_DFLAG_CDL_ENABLED )) -return 0 ; +/* Disable CDL */ ata_dev_dbg (dev,"Disabling CDL\n" ); cdl_action =0 ; dev->flags &= ~ATA_DFLAG_CDL_ENABLED ;break ;case 0x02 :/* -* Enable CDL if not already enabled. Since this is mutually -* exclusive with NCQ priority, allow this only if NCQ priority -* is disabled. +* Enable CDL. Since CDL is mutually exclusive with NCQ +* priority, allow this only if NCQ priority is disabled. */ -if (dev->flags &ATA_DFLAG_CDL_ENABLED ) -return 0 ;if (dev->flags &ATA_DFLAG_NCQ_PRIO_ENABLED ) {ata_dev_err (dev,"NCQ priority must be disabled to enable CDL\n" );
Greg Kroah-Hartman
maintainerPATCH 73/457 soc: qcom: mdt_loader: Ensure we dont read past the ELF header
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Andersson <[email protected]>
commit 9f9967fed9d066ed3dae9372b45ffa4f6fccfeef upstream.
When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients.
Validate the size of the firmware buffer to ensure that we don't read past the end as we iterate over the header. e_phentsize and e_shentsize are validated as well, to ensure that the assumptions about step size in the traversal are valid.
--- drivers/soc/qcom/mdt_loader.c | 43 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+)
drivers/soc/qcom/mdt_loader.c +43 -0
@@ -18,6 +18,37 @@#include <linux/slab.h> #include <linux/soc/qcom/mdt_loader.h> +static bool mdt_header_valid (const struct firmware *fw) +{ +const struct elf32_hdr *ehdr; +size_t phend; +size_t shend; + +if (fw->size <sizeof (*ehdr)) +return false; + + ehdr = (struct elf32_hdr *)fw->data; + +if (memcmp (ehdr->e_ident,ELFMAG ,SELFMAG )) +return false; + +if (ehdr->e_phentsize !=sizeof (struct elf32_phdr )) +return -EINVAL ; + + phend =size_add (size_mul (sizeof (struct elf32_phdr ), ehdr->e_phnum), ehdr->e_phoff); +if (phend > fw->size) +return false; + +if (ehdr->e_shentsize !=sizeof (struct elf32_shdr )) +return -EINVAL ; + + shend =size_add (size_mul (sizeof (struct elf32_shdr ), ehdr->e_shnum), ehdr->e_shoff); +if (shend > fw->size) +return false; + +return true; +} +static bool mdt_phdr_valid (const struct elf32_phdr *phdr) {if (phdr->p_type !=PT_LOAD )
@@ -82,6 +113,9 @@ ssize_t qcom_mdt_get_size(const struct fphys_addr_t max_addr =0 ;int i; +if (!mdt_header_valid (fw)) +return -EINVAL ; + ehdr = (struct elf32_hdr *)fw->data; phdrs = (struct elf32_phdr *)(fw->data + ehdr->e_phoff);
@@ -134,6 +168,9 @@ void *qcom_mdt_read_metadata(const strucssize_t ret;void *data; +if (!mdt_header_valid (fw)) +return ERR_PTR (-EINVAL ); + ehdr = (struct elf32_hdr *)fw->data; phdrs = (struct elf32_phdr *)(fw->data + ehdr->e_phoff);
@@ -214,6 +251,9 @@ int qcom_mdt_pas_init(struct device *devint ret;int i; +if (!mdt_header_valid (fw)) +return -EINVAL ; + ehdr = (struct elf32_hdr *)fw->data; phdrs = (struct elf32_phdr *)(fw->data + ehdr->e_phoff);
@@ -310,6 +350,9 @@ static int __qcom_mdt_load(struct deviceif (!fw || !mem_region || !mem_phys || !mem_size)return -EINVAL ; +if (!mdt_header_valid (fw)) +return -EINVAL ; + is_split =qcom_mdt_bins_are_split (fw, fw_name); ehdr = (struct elf32_hdr *)fw->data; phdrs = (struct elf32_phdr *)(fw->data + ehdr->e_phoff);
Greg Kroah-Hartman
maintainerPATCH 74/457 zynq_fpga: use sgtable-based scatterlist wrappers
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit 37e00703228ab44d0aacc32a97809a4f6f58df1b upstream.
Use common wrappers operating directly on the struct sg_table objects to fix incorrect use of statterlists related calls. dma_unmap_sg() function has to be called with the number of elements originally passed to the dma_map_sg() function, not the one returned in sgtable's nents.
--- drivers/fpga/zynq-fpga.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/fpga/zynq-fpga.c +2 -2
@@ -406,7 +406,7 @@ static int zynq_fpga_ops_write(struct fp } priv->dma_nelms = -dma_map_sg (mgr->dev.parent, sgt->sgl, sgt->nents,DMA_TO_DEVICE ); +dma_map_sgtable (mgr->dev.parent, sgt,DMA_TO_DEVICE ,0 );if (priv->dma_nelms ==0 ) {dev_err (&mgr->dev,"Unable to DMA map (TO_DEVICE)\n" );return -ENOMEM ;
@@ -478,7 +478,7 @@ out_clk:clk_disable (priv->clk); out_free: -dma_unmap_sg (mgr->dev.parent, sgt->sgl, sgt->nents,DMA_TO_DEVICE ); +dma_unmap_sgtable (mgr->dev.parent, sgt,DMA_TO_DEVICE ,0 );return err; }
Greg Kroah-Hartman
maintainerPATCH 75/457 iio: imu: bno055: fix OOB access of hw_xlate array
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
commit 399b883ec828e436f1a721bf8551b4da8727e65b upstream.
Fix a potential out-of-bounds array access of the hw_xlate array in bno055.c.
In bno055_get_regmask(), hw_xlate was iterated over the length of the vals array instead of the length of the hw_xlate array. In the case of bno055_gyr_scale, the vals array is larger than the hw_xlate array, so this could result in an out-of-bounds access. In practice, this shouldn't happen though because a match should always be found which breaks out of the for loop before it iterates beyond the end of the hw_xlate array.
By adding a new hw_xlate_len field to the bno055_sysfs_attr, we can be sure we are iterating over the correct length.
--- drivers/iio/imu/bno055/bno055.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/iio/imu/bno055/bno055.c +8 -3
@@ -118,6 +118,7 @@ struct bno055_sysfs_attr {int len;int *fusion_vals;int *hw_xlate; +int hw_xlate_len;int type; };
@@ -170,20 +171,24 @@ static int bno055_gyr_scale_vals[] = { 1000, 1877467, 2000, 1877467, }; +static int bno055_gyr_scale_hw_xlate[] = {0 ,1 ,2 ,3 ,4 };static struct bno055_sysfs_attr bno055_gyr_scale = { .vals = bno055_gyr_scale_vals, .len =ARRAY_SIZE (bno055_gyr_scale_vals), .fusion_vals = (int []){1 ,900 }, - .hw_xlate = (int []){4 ,3 ,2 ,1 ,0 }, + .hw_xlate = bno055_gyr_scale_hw_xlate, + .hw_xlate_len =ARRAY_SIZE (bno055_gyr_scale_hw_xlate), .type =IIO_VAL_FRACTIONAL , };static int bno055_gyr_lpf_vals[] = {12 ,23 ,32 ,47 ,64 ,116 ,230 ,523 }; +static int bno055_gyr_lpf_hw_xlate[] = {5 ,4 ,7 ,3 ,6 ,2 ,1 ,0 };static struct bno055_sysfs_attr bno055_gyr_lpf = { .vals = bno055_gyr_lpf_vals, .len =ARRAY_SIZE (bno055_gyr_lpf_vals), .fusion_vals = (int []){32 }, - .hw_xlate = (int []){5 ,4 ,7 ,3 ,6 ,2 ,1 ,0 }, + .hw_xlate = bno055_gyr_lpf_hw_xlate, + .hw_xlate_len =ARRAY_SIZE (bno055_gyr_lpf_hw_xlate), .type =IIO_VAL_INT , };
@@ -561,7 +566,7 @@ static int bno055_get_regmask(struct bno idx = (hwval & mask) >> shift;if (attr->hw_xlate) -for (i =0 ; i < attr->len; i++) +for (i =0 ; i < attr->hw_xlate_len; i++)if (attr->hw_xlate[i] == idx) { idx = i;break ;
Greg Kroah-Hartman
maintainerPATCH 76/457 iio: adc: ad_sigma_delta: change to buffer predisable
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
commit 66d4374d97f85516b5a22418c5e798aed2606dec upstream.
Change the buffer disable callback from postdisable to predisable. This balances the existing posteanble callback. Using postdisable with posteanble can be problematic, for example, if update_scan_mode fails, it would call postdisable without ever having called posteanble, so the drivers using this would be in an unexpected state when postdisable was called.
--- drivers/iio/adc/ad_sigma_delta.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iio/adc/ad_sigma_delta.c +2 -2
@@ -520,7 +520,7 @@ err_unlock:return ret; } -static int ad_sd_buffer_postdisable (struct iio_dev *indio_dev) +static int ad_sd_buffer_predisable (struct iio_dev *indio_dev) {struct ad_sigma_delta *sigma_delta =iio_device_get_drvdata (indio_dev);
@@ -644,7 +644,7 @@ static bool ad_sd_validate_scan_mask(strstatic const struct iio_buffer_setup_ops ad_sd_buffer_setup_ops = { .postenable = &ad_sd_buffer_postenable, - .postdisable = &ad_sd_buffer_postdisable, + .predisable = &ad_sd_buffer_predisable, .validate_scan_mask = &ad_sd_validate_scan_mask, };
Greg Kroah-Hartman
maintainerPATCH 77/457 iio: adc: ad7173: fix channels index for syscalib_mode
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
commit 0eb8d7b25397330beab8ee62c681975b79f37223 upstream.
Fix the index used to look up the channel when accessing the syscalib_mode attribute. The address field is a 0-based index (same as scan_index) that it used to access the channel in the ad7173_channels array throughout the driver. The channels field, on the other hand, may not match the address field depending on the channel configuration specified in the device tree and could result in an out-of-bounds access.
--- drivers/iio/adc/ad7173.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/iio/adc/ad7173.c +3 -3
@@ -319,7 +319,7 @@ static int ad7173_set_syscalib_mode(stru {struct ad7173_state *st =iio_priv (indio_dev); - st->channels[chan->channel].syscalib_mode = mode; + st->channels[chan->address].syscalib_mode = mode;return 0 ; }
@@ -329,7 +329,7 @@ static int ad7173_get_syscalib_mode(stru {struct ad7173_state *st =iio_priv (indio_dev); -return st->channels[chan->channel].syscalib_mode; +return st->channels[chan->address].syscalib_mode; } static ssize_t ad7173_write_syscalib(struct iio_dev *indio_dev,
@@ -348,7 +348,7 @@ static ssize_t ad7173_write_syscalib(strif (!iio_device_claim_direct (indio_dev))return -EBUSY ; - mode = st->channels[chan->channel].syscalib_mode; + mode = st->channels[chan->address].syscalib_mode;if (sys_calib) {if (mode ==AD7173_SYSCALIB_ZERO_SCALE ) ret = ad_sd_calibrate(&st->sd, AD7173_MODE_CAL_SYS_ZERO,
Greg Kroah-Hartman
maintainerPATCH 78/457 iio: adc: ad7173: fix calibration channel
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
commit 1d9a21ffb43b6fd326ead98f0d0afd6d104b739a upstream.
Fix the channel index values passed to ad_sd_calibrate() in ad7173_calibrate_all().
ad7173_calibrate_all() expects these values to be that of the CHANNELx register assigned to the channel, not the datasheet INPUTx number of the channel. The incorrect values were causing register writes to fail for some channels because they set the WEN bit that must always be 0 for register access and set the R/W bit to read instead of write. For other channels, the channel number was just wrong because the CHANNELx registers are generally assigned in reverse order and so almost never match the INPUTx numbers.
--- drivers/iio/adc/ad7173.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/iio/adc/ad7173.c +2 -3
@@ -392,13 +392,12 @@ static int ad7173_calibrate_all(struct aif (indio_dev->channels[i].type !=IIO_VOLTAGE )continue ; - ret =ad_sd_calibrate (&st->sd,AD7173_MODE_CAL_INT_ZERO , st->channels[i].ain); + ret =ad_sd_calibrate (&st->sd,AD7173_MODE_CAL_INT_ZERO , i);if (ret <0 )return ret;if (st->info->has_internal_fs_calibration) { - ret =ad_sd_calibrate (&st->sd,AD7173_MODE_CAL_INT_FULL , - st->channels[i].ain); + ret =ad_sd_calibrate (&st->sd,AD7173_MODE_CAL_INT_FULL , i);if (ret <0 )return ret; }
Greg Kroah-Hartman
maintainerPATCH 79/457 iio: adc: ad7173: fix setting ODR in probe
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
commit 6fa908abd19cc35c205f343b79c67ff38dbc9b76 upstream.
Fix the setting of the ODR register value in the probe function for AD7177. The AD7177 chip has a different ODR value after reset than the other chips (0x7 vs. 0x0) and 0 is a reserved value on that chip.
The driver already has this information available in odr_start_value and uses it when checking valid values when writing to the sampling_frequency attribute, but failed to set the correct initial value in the probe function.
--- drivers/iio/adc/ad7173.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/iio/adc/ad7173.c +2 -1
@@ -1595,6 +1595,7 @@ static int ad7173_fw_parse_channel_confi chan_st_priv->cfg.bipolar = false; chan_st_priv->cfg.input_buf = st->info->has_input_buf; chan_st_priv->cfg.ref_sel =AD7173_SETUP_REF_SEL_INT_REF ; + chan_st_priv->cfg.odr = st->info->odr_start_value; chan_st_priv->cfg.openwire_comp_chan =-1 ; st->adc_mode |=AD7173_ADC_MODE_REF_EN ;if (st->info->data_reg_only_16bit)
@@ -1661,7 +1662,7 @@ static int ad7173_fw_parse_channel_confi chan->scan_index = chan_index; chan->channel = ain[0 ]; chan_st_priv->cfg.input_buf = st->info->has_input_buf; - chan_st_priv->cfg.odr =0 ; + chan_st_priv->cfg.odr = st->info->odr_start_value; chan_st_priv->cfg.openwire_comp_chan =-1 ; chan_st_priv->cfg.bipolar =fwnode_property_read_bool (child,"bipolar" );
Greg Kroah-Hartman
maintainerPATCH 80/457 wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit 81284e86bf8849f8e98e8ead3ff5811926b2107f upstream.
A new warning in clang [1] complains that diq_start in wlc_lcnphy_tx_iqlo_cal() is passed uninitialized as a const pointer to wlc_lcnphy_common_read_table():
drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c:2728:13: error: variable 'diq_start' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
2728 | &diq_start, 1, 16, 69);
| ^~~~~~~~~
The table pointer passed to wlc_lcnphy_common_read_table() should not be considered constant, as wlc_phy_read_table() is ultimately going to update it. Remove the const qualifier from the tbl_ptr to clear up the warning.
--- drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c +1 -1
@@ -919,7 +919,7 @@ void wlc_lcnphy_read_table(struct brcms_static void wlc_lcnphy_common_read_table (struct brcms_phy *pi,u32 tbl_id, -const u16 *tbl_ptr,u32 tbl_len, +u16 *tbl_ptr,u32 tbl_len,u32 tbl_width,u32 tbl_offset) {struct phytbl_info tab;
Greg Kroah-Hartman
maintainerPATCH 81/457 wifi: ath12k: fix dest ring-buffer corruption
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 8157ce533a60521f21d466eb4de45d9735b19484 upstream.
Add the missing memory barrier to make sure that destination ring descriptors are read after the head pointers to avoid using stale data on weakly ordered architectures like aarch64.
The barrier is added to the ath12k_hal_srng_access_begin() helper for symmetry with follow-on fixes for source ring buffer corruption which will add barriers to ath12k_hal_srng_access_end().
Tested-on: WCN7850 hw2.0 WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
--- drivers/net/wireless/ath/ath12k/ce.c | 3 --- drivers/net/wireless/ath/ath12k/hal.c | 17 ++++++++++++++--- 2 files changed, 14 insertions(+), 6 deletions(-)
drivers/net/wireless/ath/ath12k/ce.c +0 -3
@@ -433,9 +433,6 @@ static int ath12k_ce_completed_recv_next goto err; } -/* Make sure descriptor is read after the head pointer. */ -dma_rmb (); - *nbytes =ath12k_hal_ce_dst_status_get_length (desc); *skb = pipe->dest_ring->skb[sw_index];
drivers/net/wireless/ath/ath12k/hal.c +14 -3
@@ -2143,13 +2143,24 @@ void *ath12k_hal_srng_src_get_next_reapevoid ath12k_hal_srng_access_begin (struct ath12k_base *ab,struct hal_srng *srng) { +u32 hp; +lockdep_assert_held (&srng->lock); -if (srng->ring_dir ==HAL_SRNG_DIR_SRC ) +if (srng->ring_dir ==HAL_SRNG_DIR_SRC ) { srng->u.src_ring.cached_tp = *(volatile u32 *)srng->u.src_ring.tp_addr; -else - srng->u.dst_ring.cached_hp =READ_ONCE (*srng->u.dst_ring.hp_addr); + }else { + hp =READ_ONCE (*srng->u.dst_ring.hp_addr); + +if (hp != srng->u.dst_ring.cached_hp) { + srng->u.dst_ring.cached_hp = hp; +/* Make sure descriptor is read after the head +* pointer. +*/ +dma_rmb (); + } + } }/* Update cached ring head/tail pointers to HW. ath12k_hal_srng_access_begin()
Greg Kroah-Hartman
maintainerPATCH 82/457 wifi: ath12k: fix source ring-buffer corruption
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit e834da4cbd6fe1d24f89368bf0c80adcad212726 upstream.
Add the missing memory barrier to make sure that LMAC source ring descriptors are written before updating the head pointer to avoid passing stale data to the firmware on weakly ordered architectures like aarch64.
Note that non-LMAC rings use MMIO write accessors which have the required write memory barrier.
Tested-on: WCN7850 hw2.0 WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
--- drivers/net/wireless/ath/ath12k/hal.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath12k/hal.c +9 -1
@@ -2178,7 +2178,11 @@ void ath12k_hal_srng_access_end(struct aif (srng->ring_dir ==HAL_SRNG_DIR_SRC ) { srng->u.src_ring.last_tp = *(volatile u32 *)srng->u.src_ring.tp_addr; - *srng->u.src_ring.hp_addr = srng->u.src_ring.hp; +/* Make sure descriptor is written before updating the +* head pointer. +*/ +dma_wmb (); +WRITE_ONCE (*srng->u.src_ring.hp_addr, srng->u.src_ring.hp); }else { srng->u.dst_ring.last_hp = *srng->u.dst_ring.hp_addr; *srng->u.dst_ring.tp_addr = srng->u.dst_ring.tp;
@@ -2187,6 +2191,10 @@ void ath12k_hal_srng_access_end(struct aif (srng->ring_dir ==HAL_SRNG_DIR_SRC ) { srng->u.src_ring.last_tp = *(volatile u32 *)srng->u.src_ring.tp_addr; +/* Assume implementation use an MMIO write accessor +* which has the required wmb() so that the descriptor +* is written before the updating the head pointer. +*/ ath12k_hif_write32(ab, (unsigned long)srng->u.src_ring.hp_addr - (unsigned long)ab->mem,
Greg Kroah-Hartman
maintainerPATCH 83/457 wifi: ath12k: fix dest ring-buffer corruption when ring is full
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit ed32169be1ccb9b1a295275ba7746dc6bf103e80 upstream.
Add the missing memory barriers to make sure that destination ring descriptors are read before updating the tail pointer (and passing ownership to the device) to avoid memory corruption on weakly ordered architectures like aarch64 when the ring is full.
Tested-on: WCN7850 hw2.0 WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
--- drivers/net/wireless/ath/ath12k/hal.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath12k/hal.c +9 -2
@@ -2170,7 +2170,6 @@ void ath12k_hal_srng_access_end(struct a {lockdep_assert_held (&srng->lock); -/* TODO: See if we need a write memory barrier here */ if (srng->flags &HAL_SRNG_FLAGS_LMAC_RING ) {/* For LMAC rings, ring pointer updates are done through FW and * hence written to a shared memory location that is read by FW
@@ -2185,7 +2184,11 @@ void ath12k_hal_srng_access_end(struct aWRITE_ONCE (*srng->u.src_ring.hp_addr, srng->u.src_ring.hp); }else { srng->u.dst_ring.last_hp = *srng->u.dst_ring.hp_addr; - *srng->u.dst_ring.tp_addr = srng->u.dst_ring.tp; +/* Make sure descriptor is read before updating the +* tail pointer. +*/ +dma_mb (); +WRITE_ONCE (*srng->u.dst_ring.tp_addr, srng->u.dst_ring.tp); } }else {if (srng->ring_dir ==HAL_SRNG_DIR_SRC ) {
@@ -2201,6 +2204,10 @@ void ath12k_hal_srng_access_end(struct a srng->u.src_ring.hp); }else { srng->u.dst_ring.last_hp = *srng->u.dst_ring.hp_addr; +/* Make sure descriptor is read before updating the +* tail pointer. +*/ +mb (); ath12k_hif_write32(ab, (unsigned long)srng->u.dst_ring.tp_addr - (unsigned long)ab->mem,
Greg Kroah-Hartman
maintainerPATCH 84/457 wifi: ath11k: fix dest ring-buffer corruption
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 8c1ba5091fa9a2d1478da63173b16a701bdf86bb upstream.
Add the missing memory barrier to make sure that destination ring descriptors are read after the head pointers to avoid using stale data on weakly ordered architectures like aarch64.
The barrier is added to the ath11k_hal_srng_access_begin() helper for symmetry with follow-on fixes for source ring buffer corruption which will add barriers to ath11k_hal_srng_access_end().
Tested-on: WCN6855 hw2.1 WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
--- drivers/net/wireless/ath/ath11k/ce.c | 3 --- drivers/net/wireless/ath/ath11k/dp_rx.c | 3 --- drivers/net/wireless/ath/ath11k/hal.c | 12 +++++++++++- 3 files changed, 11 insertions(+), 7 deletions(-)
drivers/net/wireless/ath/ath11k/ce.c +0 -3
@@ -393,9 +393,6 @@ static int ath11k_ce_completed_recv_next goto err; } -/* Make sure descriptor is read after the head pointer. */ -dma_rmb (); - *nbytes =ath11k_hal_ce_dst_status_get_length (desc); *skb = pipe->dest_ring->skb[sw_index];
drivers/net/wireless/ath/ath11k/dp_rx.c +0 -3
@@ -2650,9 +2650,6 @@ int ath11k_dp_process_rx(struct ath11k_b try_again:ath11k_hal_srng_access_begin (ab, srng); -/* Make sure descriptor is read after the head pointer. */ -dma_rmb (); -while (likely (desc = (struct hal_reo_dest_ring *)ath11k_hal_srng_dst_get_next_entry (ab, srng))) {
drivers/net/wireless/ath/ath11k/hal.c +11 -1
@@ -823,13 +823,23 @@ u32 *ath11k_hal_srng_src_peek(struct athvoid ath11k_hal_srng_access_begin (struct ath11k_base *ab,struct hal_srng *srng) { +u32 hp; +lockdep_assert_held (&srng->lock);if (srng->ring_dir ==HAL_SRNG_DIR_SRC ) { srng->u.src_ring.cached_tp = *(volatile u32 *)srng->u.src_ring.tp_addr; }else { - srng->u.dst_ring.cached_hp =READ_ONCE (*srng->u.dst_ring.hp_addr); + hp =READ_ONCE (*srng->u.dst_ring.hp_addr); + +if (hp != srng->u.dst_ring.cached_hp) { + srng->u.dst_ring.cached_hp = hp; +/* Make sure descriptor is read after the head +* pointer. +*/ +dma_rmb (); + }/* Try to prefetch the next descriptor in the ring */ if (srng->flags &HAL_SRNG_FLAGS_CACHED )
Greg Kroah-Hartman
maintainerPATCH 85/457 wifi: ath11k: fix source ring-buffer corruption
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 6efa0df54022c6c9fd4d294b87622c7fcdc418c8 upstream.
Add the missing memory barrier to make sure that LMAC source ring descriptors are written before updating the head pointer to avoid passing stale data to the firmware on weakly ordered architectures like aarch64.
Note that non-LMAC rings use MMIO write accessors which have the required write memory barrier.
Tested-on: WCN6855 hw2.1 WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
--- drivers/net/wireless/ath/ath11k/hal.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath11k/hal.c +9 -1
@@ -862,7 +862,11 @@ void ath11k_hal_srng_access_end(struct aif (srng->ring_dir ==HAL_SRNG_DIR_SRC ) { srng->u.src_ring.last_tp = *(volatile u32 *)srng->u.src_ring.tp_addr; - *srng->u.src_ring.hp_addr = srng->u.src_ring.hp; +/* Make sure descriptor is written before updating the +* head pointer. +*/ +dma_wmb (); +WRITE_ONCE (*srng->u.src_ring.hp_addr, srng->u.src_ring.hp); }else { srng->u.dst_ring.last_hp = *srng->u.dst_ring.hp_addr; *srng->u.dst_ring.tp_addr = srng->u.dst_ring.tp;
@@ -871,6 +875,10 @@ void ath11k_hal_srng_access_end(struct aif (srng->ring_dir ==HAL_SRNG_DIR_SRC ) { srng->u.src_ring.last_tp = *(volatile u32 *)srng->u.src_ring.tp_addr; +/* Assume implementation use an MMIO write accessor +* which has the required wmb() so that the descriptor +* is written before the updating the head pointer. +*/ ath11k_hif_write32(ab, (unsigned long)srng->u.src_ring.hp_addr - (unsigned long)ab->mem,
Greg Kroah-Hartman
maintainerPATCH 86/457 wifi: ath11k: fix dest ring-buffer corruption when ring is full
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit aa6956150f820e6a6deba44be325ddfcb5b10f88 upstream.
Add the missing memory barriers to make sure that destination ring descriptors are read before updating the tail pointer (and passing ownership to the device) to avoid memory corruption on weakly ordered architectures like aarch64 when the ring is full.
Tested-on: WCN6855 hw2.1 WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
--- drivers/net/wireless/ath/ath11k/hal.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath11k/hal.c +9 -2
@@ -854,7 +854,6 @@ void ath11k_hal_srng_access_end(struct a {lockdep_assert_held (&srng->lock); -/* TODO: See if we need a write memory barrier here */ if (srng->flags &HAL_SRNG_FLAGS_LMAC_RING ) {/* For LMAC rings, ring pointer updates are done through FW and * hence written to a shared memory location that is read by FW
@@ -869,7 +868,11 @@ void ath11k_hal_srng_access_end(struct aWRITE_ONCE (*srng->u.src_ring.hp_addr, srng->u.src_ring.hp); }else { srng->u.dst_ring.last_hp = *srng->u.dst_ring.hp_addr; - *srng->u.dst_ring.tp_addr = srng->u.dst_ring.tp; +/* Make sure descriptor is read before updating the +* tail pointer. +*/ +dma_mb (); +WRITE_ONCE (*srng->u.dst_ring.tp_addr, srng->u.dst_ring.tp); } }else {if (srng->ring_dir ==HAL_SRNG_DIR_SRC ) {
@@ -885,6 +888,10 @@ void ath11k_hal_srng_access_end(struct a srng->u.src_ring.hp); }else { srng->u.dst_ring.last_hp = *srng->u.dst_ring.hp_addr; +/* Make sure descriptor is read before updating the +* tail pointer. +*/ +mb (); ath11k_hif_write32(ab, (unsigned long)srng->u.dst_ring.tp_addr - (unsigned long)ab->mem,
Greg Kroah-Hartman
maintainerPATCH 87/457 pwm: imx-tpm: Reset counter if CMOD is 0
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurentiu Mihalcea <[email protected]>
commit 65c6f742ab14ab1a2679fba72b82dcc0289d96f1 upstream.
As per the i.MX93 TRM, section 67.3.2.1 "MOD register update", the value of the TPM counter does NOT get updated when writing MOD.MOD unless SC.CMOD != 0. Therefore, with the current code, assuming the following sequence:
1) pwm_disable()
2) pwm_apply_might_sleep() /* period is changed here */
3) pwm_enable()
and assuming only one channel is active, if CNT.COUNT is higher than the MOD.MOD value written during the pwm_apply_might_sleep() call then, when re-enabling the PWM during pwm_enable(), the counter will end up resetting after UINT32_MAX - CNT.COUNT + MOD.MOD cycles instead of MOD.MOD cycles as normally expected.
Fix this problem by forcing a reset of the TPM counter before MOD.MOD is written.
--- drivers/pwm/pwm-imx-tpm.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/pwm/pwm-imx-tpm.c +9 -0
@@ -205,6 +205,15 @@ static int pwm_imx_tpm_apply_hw(struct pwritel (val, tpm->base +PWM_IMX_TPM_SC );/* +* if the counter is disabled (CMOD == 0), programming the new +* period length (MOD) will not reset the counter (CNT). If +* CNT.COUNT happens to be bigger than the new MOD value then +* the counter will end up being reset way too late. Therefore, +* manually reset it to 0. +*/ +if (!cmod) +writel (0x0 , tpm->base +PWM_IMX_TPM_CNT ); +/* * set period count: * if the PWM is disabled (CMOD[1:0] = 2b00), then MOD register * is updated when MOD register is written.
Greg Kroah-Hartman
maintainerPATCH 88/457 pwm: mediatek: Handle hardware enable and clock enable separately
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
commit 704d918341c378c5f9505dfdf32d315e256d3846 upstream.
Stop handling the clocks in pwm_mediatek_enable() and pwm_mediatek_disable(). This is a preparing change for the next commit that requires that clocks and the enable bit are handled separately.
Also move these two functions a bit further up in the source file to make them usable in pwm_mediatek_config(), which is needed in the next commit, too.
--- drivers/pwm/pwm-mediatek.c | 60 +++++++++++++++++++++------------------------ 1 file changed, 28 insertions(+), 32 deletions(-)
drivers/pwm/pwm-mediatek.c +28 -32
@@ -115,6 +115,26 @@ static inline void pwm_mediatek_writel(swritel (value, chip->regs + chip->soc->reg_offset[num] + offset); } +static void pwm_mediatek_enable (struct pwm_chip *chip,struct pwm_device *pwm) +{ +struct pwm_mediatek_chip *pc =to_pwm_mediatek_chip (chip); +u32 value; + + value =readl (pc->regs); + value |=BIT (pwm->hwpwm); +writel (value, pc->regs); +} + +static void pwm_mediatek_disable (struct pwm_chip *chip,struct pwm_device *pwm) +{ +struct pwm_mediatek_chip *pc =to_pwm_mediatek_chip (chip); +u32 value; + + value =readl (pc->regs); + value &= ~BIT (pwm->hwpwm); +writel (value, pc->regs); +} +static int pwm_mediatek_config (struct pwm_chip *chip,struct pwm_device *pwm,int duty_ns,int period_ns) {
@@ -177,35 +197,6 @@ out:return ret; } -static int pwm_mediatek_enable (struct pwm_chip *chip,struct pwm_device *pwm) -{ -struct pwm_mediatek_chip *pc =to_pwm_mediatek_chip (chip); -u32 value; -int ret; - - ret =pwm_mediatek_clk_enable (chip, pwm); -if (ret <0 ) -return ret; - - value =readl (pc->regs); - value |=BIT (pwm->hwpwm); -writel (value, pc->regs); - -return 0 ; -} - -static void pwm_mediatek_disable (struct pwm_chip *chip,struct pwm_device *pwm) -{ -struct pwm_mediatek_chip *pc =to_pwm_mediatek_chip (chip); -u32 value; - - value =readl (pc->regs); - value &= ~BIT (pwm->hwpwm); -writel (value, pc->regs); - -pwm_mediatek_clk_disable (chip, pwm); -} -static int pwm_mediatek_apply (struct pwm_chip *chip,struct pwm_device *pwm,const struct pwm_state *state) {
@@ -215,8 +206,10 @@ static int pwm_mediatek_apply(struct pwmreturn -EINVAL ;if (!state->enabled) { -if (pwm->state.enabled) +if (pwm->state.enabled) {pwm_mediatek_disable (chip, pwm); +pwm_mediatek_clk_disable (chip, pwm); + }return 0 ; }
@@ -225,8 +218,11 @@ static int pwm_mediatek_apply(struct pwmif (err)return err; -if (!pwm->state.enabled) - err =pwm_mediatek_enable (chip, pwm); +if (!pwm->state.enabled) { + err =pwm_mediatek_clk_enable (chip, pwm); +if (!err) +pwm_mediatek_enable (chip, pwm); + }return err; }
Greg Kroah-Hartman
maintainerPATCH 89/457 pwm: mediatek: Fix duty and period setting
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
commit f21d136caf8171f94159d975ea4620c164431bd9 upstream.
The period generated by the hardware is
(PWMDWIDTH + 1) << CLKDIV) / freq
according to my tests with a signal analyser and also the documentation.
The current algorithm doesn't consider the + 1 part and so configures slightly too high periods. The same issue exists for the duty cycle setting. So subtract 1 from both the register values for period and duty cycle. If period is 0, bail out, if duty_cycle is 0, just disable the PWM which results in a constant low output.
--- drivers/pwm/pwm-mediatek.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
drivers/pwm/pwm-mediatek.c +14 -7
@@ -164,7 +164,10 @@ static int pwm_mediatek_config(struct pwdo_div (resolution, clk_rate); cnt_period =DIV_ROUND_CLOSEST_ULL ((u64 )period_ns *1000 , resolution); -while (cnt_period >8191 ) { +if (!cnt_period) +return -EINVAL ; + +while (cnt_period >8192 ) { resolution *=2 ; clkdiv++; cnt_period = DIV_ROUND_CLOSEST_ULL((u64)period_ns * 1000,
@@ -187,9 +190,16 @@ static int pwm_mediatek_config(struct pw } cnt_duty =DIV_ROUND_CLOSEST_ULL ((u64 )duty_ns *1000 , resolution); +pwm_mediatek_writel (pc, pwm->hwpwm,PWMCON ,BIT (15 ) | clkdiv); -pwm_mediatek_writel (pc, pwm->hwpwm, reg_width, cnt_period); -pwm_mediatek_writel (pc, pwm->hwpwm, reg_thres, cnt_duty); +pwm_mediatek_writel (pc, pwm->hwpwm, reg_width, cnt_period -1 ); + +if (cnt_duty) { +pwm_mediatek_writel (pc, pwm->hwpwm, reg_thres, cnt_duty -1 ); +pwm_mediatek_enable (chip, pwm); + }else { +pwm_mediatek_disable (chip, pwm); + } out:pwm_mediatek_clk_disable (chip, pwm);
@@ -218,11 +228,8 @@ static int pwm_mediatek_apply(struct pwmif (err)return err; -if (!pwm->state.enabled) { +if (!pwm->state.enabled) err =pwm_mediatek_clk_enable (chip, pwm); -if (!err) -pwm_mediatek_enable (chip, pwm); - }return err; }
Greg Kroah-Hartman
maintainerPATCH 90/457 hwmon: (gsc-hwmon) fix fan pwm setpoint show functions
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Harvey <[email protected]>
commit 9c62e2282900332c8b711d9f9e37af369a8ef71b upstream.
The Linux hwmon sysfs API values for pwmX_auto_pointY_pwm represent an integer value between 0 (0%) to 255 (100%) and the pwmX_auto_pointY_temp represent millidegrees Celcius.
Commit a6d80df47ee2 ("hwmon: (gsc-hwmon) fix fan pwm temperature scaling") properly addressed the incorrect scaling in the pwm_auto_point_temp_store implementation but erroneously scaled the pwm_auto_point_pwm_show (pwm value) instead of the pwm_auto_point_temp_show (temp value) resulting in:
# cat /sys/class/hwmon/hwmon0/pwm1_auto_point6_pwm 25500 # cat /sys/class/hwmon/hwmon0/pwm1_auto_point6_temp 4500
Fix the scaling of these attributes:
# cat /sys/class/hwmon/hwmon0/pwm1_auto_point6_pwm 255 # cat /sys/class/hwmon/hwmon0/pwm1_auto_point6_temp 45000
--- drivers/hwmon/gsc-hwmon.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/gsc-hwmon.c +2 -2
@@ -64,7 +64,7 @@ static ssize_t pwm_auto_point_temp_show(return ret; ret = regs[0 ] | regs[1 ] <<8 ; -return sprintf (buf,"%d\n" , ret *10 ); +return sprintf (buf,"%d\n" , ret *100 ); } static ssize_t pwm_auto_point_temp_store(struct device *dev,
@@ -99,7 +99,7 @@ static ssize_t pwm_auto_point_pwm_show(s {struct sensor_device_attribute *attr =to_sensor_dev_attr (devattr); -return sprintf (buf,"%d\n" ,255 * (50 + (attr->index *10 ))); +return sprintf (buf,"%d\n" ,255 * (50 + (attr->index *10 )) /100 ); } static SENSOR_DEVICE_ATTR_RO(pwm1_auto_point1_pwm, pwm_auto_point_pwm, 0);
Greg Kroah-Hartman
maintainerPATCH 91/457 mtd: spi-nor: Fix spi_nor_try_unlock_all()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
commit 2e3a7476ec3989e77270b9481e76e137824b17c0 upstream.
Commit ff67592cbdfc ("mtd: spi-nor: Introduce spi_nor_set_mtd_info()") moved all initialization of the mtd fields at the end of spi_nor_scan(). Normally, the mtd info is only needed for the mtd ops on the device, with one exception: spi_nor_try_unlock_all(), which will also make use of the mtd->size parameter. With that commit, the size will always be zero because it is not initialized. Fix that by not using the size of the mtd_info struct, but use the size from struct spi_nor_flash_parameter.
--- drivers/mtd/spi-nor/swp.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-)
drivers/mtd/spi-nor/swp.c +8 -11
@@ -56,7 +56,6 @@ static u64 spi_nor_get_min_prot_length_sstatic void spi_nor_get_locked_range_sr (struct spi_nor *nor,u8 sr,loff_t *ofs,u64 *len) { -struct mtd_info *mtd = &nor->mtd;u64 min_prot_len;u8 mask =spi_nor_get_sr_bp_mask (nor);u8 tb_mask =spi_nor_get_sr_tb_mask (nor);
@@ -77,13 +76,13 @@ static void spi_nor_get_locked_range_sr( min_prot_len =spi_nor_get_min_prot_length_sr (nor); *len = min_prot_len << (bp -1 ); -if (*len > mtd->size) - *len = mtd->size; +if (*len > nor->params->size) + *len = nor->params->size;if (nor->flags &SNOR_F_HAS_SR_TB && sr & tb_mask) *ofs =0 ;else - *ofs = mtd->size - *len; + *ofs = nor->params->size - *len; }/*
@@ -158,7 +157,6 @@ static bool spi_nor_is_unlocked_sr(struc*/ static int spi_nor_sr_lock (struct spi_nor *nor,loff_t ofs,u64 len) { -struct mtd_info *mtd = &nor->mtd;u64 min_prot_len;int ret, status_old, status_new;u8 mask =spi_nor_get_sr_bp_mask (nor);
@@ -183,7 +181,7 @@ static int spi_nor_sr_lock(struct spi_no can_be_bottom = false;/* If anything above us is unlocked, we can't use 'top' protection */ -if (!spi_nor_is_locked_sr (nor, ofs + len, mtd->size - (ofs + len), +if (!spi_nor_is_locked_sr (nor, ofs + len, nor->params->size - (ofs + len), status_old)) can_be_top = false;
@@ -195,11 +193,11 @@ static int spi_nor_sr_lock(struct spi_no/* lock_len: length of region that should end up locked */ if (use_top) - lock_len = mtd->size - ofs; + lock_len = nor->params->size - ofs;else lock_len = ofs + len; -if (lock_len == mtd->size) { +if (lock_len == nor->params->size) { val = mask; }else { min_prot_len =spi_nor_get_min_prot_length_sr (nor);
@@ -248,7 +246,6 @@ static int spi_nor_sr_lock(struct spi_no*/ static int spi_nor_sr_unlock (struct spi_nor *nor,loff_t ofs,u64 len) { -struct mtd_info *mtd = &nor->mtd;u64 min_prot_len;int ret, status_old, status_new;u8 mask =spi_nor_get_sr_bp_mask (nor);
@@ -273,7 +270,7 @@ static int spi_nor_sr_unlock(struct spi_ can_be_top = false;/* If anything above us is locked, we can't use 'bottom' protection */ -if (!spi_nor_is_unlocked_sr (nor, ofs + len, mtd->size - (ofs + len), +if (!spi_nor_is_unlocked_sr (nor, ofs + len, nor->params->size - (ofs + len), status_old)) can_be_bottom = false;
@@ -285,7 +282,7 @@ static int spi_nor_sr_unlock(struct spi_/* lock_len: length of region that should remain locked */ if (use_top) - lock_len = mtd->size - (ofs + len); + lock_len = nor->params->size - (ofs + len);else lock_len = ofs;
Greg Kroah-Hartman
maintainerPATCH 92/457 mtd: spinand: propagate spinand_wait() errors from spinand_write_page()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
commit 091d9e35b85b0f8f7e1c73535299f91364a5c73a upstream.
Since commit 3d1f08b032dc ("mtd: spinand: Use the external ECC engine logic") the spinand_write_page() function ignores the errors returned by spinand_wait(). Change the code to propagate those up to the stack as it was done before the offending change.
--- drivers/mtd/nand/spi/core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/mtd/nand/spi/core.c +4 -1
@@ -688,7 +688,10 @@ int spinand_write_page(struct spinand_deSPINAND_WRITE_INITIAL_DELAY_US ,SPINAND_WRITE_POLL_DELAY_US , &status); -if (!ret && (status &STATUS_PROG_FAILED )) +if (ret) +return ret; + +if (status &STATUS_PROG_FAILED )return -EIO ;return nand_ecc_finish_io_req (nand, (struct nand_page_io_req *)req);
Greg Kroah-Hartman
maintainerPATCH 93/457 mtd: rawnand: fsmc: Add missing check after DMA map
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit 6c4dab38431fee3d39a841d66ba6f2890b31b005 upstream.
The DMA map functions can fail and should be tested for errors.
Rule: add
--- drivers/mtd/nand/raw/fsmc_nand.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mtd/nand/raw/fsmc_nand.c +2 -0
@@ -503,6 +503,8 @@ static int dma_xfer(struct fsmc_nand_dat dma_dev = chan->device; dma_addr =dma_map_single (dma_dev->dev, buffer, len, direction); +if (dma_mapping_error (dma_dev->dev, dma_addr)) +return -EINVAL ;if (direction ==DMA_TO_DEVICE ) { dma_src = dma_addr;
Greg Kroah-Hartman
maintainerPATCH 94/457 mtd: rawnand: renesas: Add missing check after DMA map
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit 79e441ee47949376e3bc20f085cf017b70523d0f upstream.
The DMA map functions can fail and should be tested for errors.
--- drivers/mtd/nand/raw/renesas-nand-controller.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/mtd/nand/raw/renesas-nand-controller.c +6 -0
@@ -426,6 +426,9 @@ static int rnandc_read_page_hw_ecc(struc/* Configure DMA */ dma_addr =dma_map_single (rnandc->dev, rnandc->buf, mtd->writesize,DMA_FROM_DEVICE ); +if (dma_mapping_error (rnandc->dev, dma_addr)) +return -ENOMEM ; +writel (dma_addr, rnandc->regs +DMA_ADDR_LOW_REG );writel (mtd->writesize, rnandc->regs +DMA_CNT_REG );writel (DMA_TLVL_MAX , rnandc->regs +DMA_TLVL_REG );
@@ -606,6 +609,9 @@ static int rnandc_write_page_hw_ecc(stru/* Configure DMA */ dma_addr =dma_map_single (rnandc->dev, (void *)rnandc->buf, mtd->writesize,DMA_TO_DEVICE ); +if (dma_mapping_error (rnandc->dev, dma_addr)) +return -ENOMEM ; +writel (dma_addr, rnandc->regs +DMA_ADDR_LOW_REG );writel (mtd->writesize, rnandc->regs +DMA_CNT_REG );writel (DMA_TLVL_MAX , rnandc->regs +DMA_TLVL_REG );
Greg Kroah-Hartman
maintainerPATCH 95/457 mfd: mt6397: Do not use generic name for keypad sub-devices
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 92ab1e41569416c639643cd75eea2379190a65f2 upstream.
Do not use "mtk-pmic-keys" when creating sub-device for the keypad to make sure the keypad driver will only bind to the sub-device if it has support for the variant/has matching compatible.
--- drivers/mfd/mt6397-core.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/mfd/mt6397-core.c +6 -6
@@ -136,7 +136,7 @@ static const struct mfd_cell mt6323_devs .name = "mt6323-led", .of_compatible ="mediatek,mt6323-led" }, { - .name = "mtk-pmic-keys", + .name = "mt6323-keys", .num_resources = ARRAY_SIZE(mt6323_keys_resources), .resources = mt6323_keys_resources, .of_compatible = "mediatek,mt6323-keys"
@@ -153,7 +153,7 @@ static const struct mfd_cell mt6328_devs .name = "mt6328-regulator", .of_compatible ="mediatek,mt6328-regulator" }, { - .name = "mtk-pmic-keys", + .name = "mt6328-keys", .num_resources = ARRAY_SIZE(mt6328_keys_resources), .resources = mt6328_keys_resources, .of_compatible = "mediatek,mt6328-keys"
@@ -175,7 +175,7 @@ static const struct mfd_cell mt6357_devs .name = "mt6357-sound", .of_compatible ="mediatek,mt6357-sound" }, { - .name = "mtk-pmic-keys", + .name = "mt6357-keys", .num_resources = ARRAY_SIZE(mt6357_keys_resources), .resources = mt6357_keys_resources, .of_compatible = "mediatek,mt6357-keys"
@@ -196,7 +196,7 @@ static const struct mfd_cell mt6331_mt63 .name = "mt6332-regulator", .of_compatible ="mediatek,mt6332-regulator" }, { - .name = "mtk-pmic-keys", + .name = "mt6331-keys", .num_resources = ARRAY_SIZE(mt6331_keys_resources), .resources = mt6331_keys_resources, .of_compatible = "mediatek,mt6331-keys"
@@ -240,7 +240,7 @@ static const struct mfd_cell mt6359_devs }, { .name = "mt6359-sound", }, { - .name = "mtk-pmic-keys", + .name = "mt6359-keys", .num_resources = ARRAY_SIZE(mt6359_keys_resources), .resources = mt6359_keys_resources, .of_compatible = "mediatek,mt6359-keys"
@@ -272,7 +272,7 @@ static const struct mfd_cell mt6397_devs .name = "mt6397-pinctrl", .of_compatible = "mediatek,mt6397-pinctrl", }, { - .name = "mtk-pmic-keys", + .name = "mt6397-keys", .num_resources = ARRAY_SIZE(mt6397_keys_resources), .resources = mt6397_keys_resources, .of_compatible = "mediatek,mt6397-keys"
Greg Kroah-Hartman
maintainerPATCH 96/457 readahead: fix return value of page_cache_next_miss() when no hole is found
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chi Zhiling <[email protected]>
commit bbcaee20e03ecaeeecba32a703816a0d4502b6c4 upstream.
max_scan in page_cache_next_miss always decreases to zero when no hole is found, causing the return value to be index + 0.
Fix this by preserving the max_scan value throughout the loop.
Jan said "From what I know and have seen in the past, wrong responses from page_cache_next_miss() can lead to readahead window reduction and thus reduced read speeds."
--- mm/filemap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
mm/filemap.c +2 -1
@@ -1778,8 +1778,9 @@ pgoff_t page_cache_next_miss(struct addr pgoff_t index, unsigned long max_scan) { XA_STATE(xas, &mapping->i_pages, index); +unsigned long nr = max_scan; -while (max_scan--) { +while (nr--) {void *entry =xas_next (&xas);if (!entry ||xa_is_value (entry))return xas.xa_index;
Greg Kroah-Hartman
maintainerPATCH 97/457 PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit 1d60796a62f327cd9e0a6a0865ded7656d2c67f9 upstream.
The PCIe port driver erroneously creates a subdevice for hotplug on ACPI slots which are handled by the ACPI hotplug driver.
Avoid by checking the is_pciehp flag instead of is_hotplug_bridge when deciding whether to create a subdevice. The latter encompasses ACPI slots whereas the former doesn't.
The superfluous subdevice has no real negative impact, it occupies memory and interrupt resources but otherwise just sits there waiting for interrupts from the slot that are never signaled.
--- drivers/pci/pcie/portdrv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/pcie/portdrv.c +1 -1
@@ -220,7 +220,7 @@ static int get_port_device_capability(ststruct pci_host_bridge *host =pci_find_host_bridge (dev->bus);int services =0 ; -if (dev->is_hotplug_bridge && +if (dev->is_pciehp && (pci_pcie_type (dev) ==PCI_EXP_TYPE_ROOT_PORT ||pci_pcie_type (dev) ==PCI_EXP_TYPE_DOWNSTREAM ) && (pcie_ports_native || host->native_pcie_hotplug)) {
Greg Kroah-Hartman
maintainerPATCH 98/457 PCI: Fix link speed calculation on retrain failure
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiwei Sun <[email protected]>
commit 9989e0ca7462c62f93dbc62f684448aa2efb9226 upstream.
When pcie_failed_link_retrain() fails to retrain, it tries to revert to the previous link speed. However it calculates that speed from the Link Control 2 register without masking out non-speed bits first.
PCIE_LNKCTL2_TLS2SPEED() converts such incorrect values to PCI_SPEED_UNKNOWN (0xff), which in turn causes a WARN splat in pcie_set_target_speed():
pci 0000:00:01.1: [1022:14ed] type 01 class 0x060400 PCIe Root Port
pci 0000:00:01.1: broken device, retraining non-functional downstream link at 2.5GT/s pci 0000:00:01.1: retraining failed
WARNING: CPU: 1 PID: 1 at drivers/pci/pcie/bwctrl.c:168 pcie_set_target_speed RDX: 0000000000000001 RSI: 00000000000000ff RDI: ffff9acd82efa000 pcie_failed_link_retrain pci_device_add pci_scan_single_device
Mask out the non-speed bits in PCIE_LNKCTL2_TLS2SPEED() and PCIE_LNKCAP_SLS2SPEED() so they don't incorrectly return PCI_SPEED_UNKNOWN.
--- drivers/pci/pci.h | 32 +++++++++++++++++++------------- 1 file changed, 19 insertions(+), 13 deletions(-)
drivers/pci/pci.h +19 -13
@@ -391,12 +391,14 @@ void pci_bus_put(struct pci_bus *bus);#define PCIE_LNKCAP_SLS2SPEED (lnkcap) \ ({ \ - ((lnkcap) == PCI_EXP_LNKCAP_SLS_64_0GB ? PCIE_SPEED_64_0GT : \ - (lnkcap) == PCI_EXP_LNKCAP_SLS_32_0GB ? PCIE_SPEED_32_0GT : \ - (lnkcap) == PCI_EXP_LNKCAP_SLS_16_0GB ? PCIE_SPEED_16_0GT : \ - (lnkcap) == PCI_EXP_LNKCAP_SLS_8_0GB ? PCIE_SPEED_8_0GT : \ - (lnkcap) == PCI_EXP_LNKCAP_SLS_5_0GB ? PCIE_SPEED_5_0GT : \ - (lnkcap) == PCI_EXP_LNKCAP_SLS_2_5GB ? PCIE_SPEED_2_5GT : \ + u32 lnkcap_sls = (lnkcap) & PCI_EXP_LNKCAP_SLS; \ + \ + (lnkcap_sls == PCI_EXP_LNKCAP_SLS_64_0GB ? PCIE_SPEED_64_0GT : \ + lnkcap_sls == PCI_EXP_LNKCAP_SLS_32_0GB ? PCIE_SPEED_32_0GT : \ + lnkcap_sls == PCI_EXP_LNKCAP_SLS_16_0GB ? PCIE_SPEED_16_0GT : \ + lnkcap_sls == PCI_EXP_LNKCAP_SLS_8_0GB ? PCIE_SPEED_8_0GT : \ + lnkcap_sls == PCI_EXP_LNKCAP_SLS_5_0GB ? PCIE_SPEED_5_0GT : \ + lnkcap_sls == PCI_EXP_LNKCAP_SLS_2_5GB ? PCIE_SPEED_2_5GT : \ PCI_SPEED_UNKNOWN); \ })
@@ -411,13 +413,17 @@ void pci_bus_put(struct pci_bus *bus); PCI_SPEED_UNKNOWN)#define PCIE_LNKCTL2_TLS2SPEED (lnkctl2) \ - ((lnkctl2) == PCI_EXP_LNKCTL2_TLS_64_0GT ? PCIE_SPEED_64_0GT : \ - (lnkctl2) == PCI_EXP_LNKCTL2_TLS_32_0GT ? PCIE_SPEED_32_0GT : \ - (lnkctl2) == PCI_EXP_LNKCTL2_TLS_16_0GT ? PCIE_SPEED_16_0GT : \ - (lnkctl2) == PCI_EXP_LNKCTL2_TLS_8_0GT ? PCIE_SPEED_8_0GT : \ - (lnkctl2) == PCI_EXP_LNKCTL2_TLS_5_0GT ? PCIE_SPEED_5_0GT : \ - (lnkctl2) == PCI_EXP_LNKCTL2_TLS_2_5GT ? PCIE_SPEED_2_5GT : \ - PCI_SPEED_UNKNOWN) +({ \ + u16 lnkctl2_tls = (lnkctl2) & PCI_EXP_LNKCTL2_TLS; \ + \ + (lnkctl2_tls == PCI_EXP_LNKCTL2_TLS_64_0GT ? PCIE_SPEED_64_0GT : \ + lnkctl2_tls == PCI_EXP_LNKCTL2_TLS_32_0GT ? PCIE_SPEED_32_0GT : \ + lnkctl2_tls == PCI_EXP_LNKCTL2_TLS_16_0GT ? PCIE_SPEED_16_0GT : \ + lnkctl2_tls == PCI_EXP_LNKCTL2_TLS_8_0GT ? PCIE_SPEED_8_0GT : \ + lnkctl2_tls == PCI_EXP_LNKCTL2_TLS_5_0GT ? PCIE_SPEED_5_0GT : \ + lnkctl2_tls == PCI_EXP_LNKCTL2_TLS_2_5GT ? PCIE_SPEED_2_5GT : \ + PCI_SPEED_UNKNOWN); \ +})/* PCIe speed to Mb/s reduced by encoding overhead */ #define PCIE_SPEED2MBS_ENC (speed) \
Greg Kroah-Hartman
maintainerPATCH 99/457 PCI: endpoint: Fix configfs group list head handling
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit d79123d79a8154b4318529b7b2ff7e15806f480b upstream.
Doing a list_del() on the epf_group field of struct pci_epf_driver in pci_epf_remove_cfs() is not correct as this field is a list head, not a list entry. This list_del() call triggers a KASAN warning when an endpoint function driver which has a configfs attribute group is torn down:
==================================================================
BUG: KASAN: slab-use-after-free in pci_epf_remove_cfs+0x17c/0x198 Write of size 8 at addr ffff00010f4a0d80 by task rmmod/319 CPU: 3 UID: 0 PID: 319 Comm: rmmod Not tainted 6.16.0-rc2 #1 NONE Hardware name: Radxa ROCK 5B (DT) Call trace: show_stack+0x2c/0x84 (C) dump_stack_lvl+0x70/0x98 print_report+0x17c/0x538 kasan_report+0xb8/0x190 __asan_report_store8_noabort+0x20/0x2c pci_epf_remove_cfs+0x17c/0x198 pci_epf_unregister_driver+0x18/0x30 nvmet_pci_epf_cleanup_module+0x24/0x30 [nvmet_pci_epf] __arm64_sys_delete_module+0x264/0x424 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xac/0x230 do_el0_svc+0x40/0x58 el0_svc+0x48/0xdc el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x19c
...
Remove this incorrect list_del() call from pci_epf_remove_cfs().
--- drivers/pci/endpoint/pci-epf-core.c | 1 - 1 file changed, 1 deletion(-)
drivers/pci/endpoint/pci-epf-core.c +0 -1
@@ -338,7 +338,6 @@ static void pci_epf_remove_cfs(struct pcmutex_lock (&pci_epf_mutex);list_for_each_entry_safe (group, tmp, &driver->epf_group, group_entry)pci_ep_cfs_remove_epf_group (group); -list_del (&driver->epf_group);mutex_unlock (&pci_epf_mutex); }
Greg Kroah-Hartman
maintainerPATCH 100/457 PCI: endpoint: Fix configfs group removal on driver teardown
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit 910bdb8197f9322790c738bb32feaa11dba26909 upstream.
An endpoint driver configfs attributes group is added to the epf_group list of struct pci_epf_driver by pci_epf_add_cfs() but an added group is not removed from this list when the attribute group is unregistered with pci_ep_cfs_remove_epf_group().
Add the missing list_del() call in pci_ep_cfs_remove_epf_group() to correctly remove the attribute group from the driver list.
With this change, once the loop over all attribute groups in pci_epf_remove_cfs() completes, the driver epf_group list should be empty. Add a WARN_ON() to make sure of that.
--- drivers/pci/endpoint/pci-ep-cfs.c | 1 + drivers/pci/endpoint/pci-epf-core.c | 1 + 2 files changed, 2 insertions(+)
drivers/pci/endpoint/pci-ep-cfs.c +1 -0
@@ -691,6 +691,7 @@ void pci_ep_cfs_remove_epf_group(structif (IS_ERR_OR_NULL (group))return ; +list_del (&group->group_entry);configfs_unregister_default_group (group); }EXPORT_SYMBOL (pci_ep_cfs_remove_epf_group);
drivers/pci/endpoint/pci-epf-core.c +1 -0
@@ -338,6 +338,7 @@ static void pci_epf_remove_cfs(struct pcmutex_lock (&pci_epf_mutex);list_for_each_entry_safe (group, tmp, &driver->epf_group, group_entry)pci_ep_cfs_remove_epf_group (group); +WARN_ON (!list_empty (&driver->epf_group));mutex_unlock (&pci_epf_mutex); }
Greg Kroah-Hartman
maintainerPATCH 101/457 PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Zhu <[email protected]>
commit c523fa63ac1d452abeeb4e699560ec3365037f32 upstream.
IMX8MQ_EP has three 64-bit BAR0/2/4 capable and programmable BARs. For IMX8MQ_EP, use imx8q_pcie_epc_features (64-bit BARs 0, 2, 4) instead of imx8m_pcie_epc_features (64-bit BARs 0, 2).
--- drivers/pci/controller/dwc/pci-imx6.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/controller/dwc/pci-imx6.c +1 -1
@@ -1912,7 +1912,7 @@ static const struct imx_pcie_drvdata drv .mode_mask[0] = IMX6Q_GPR12_DEVICE_TYPE, .mode_off[1] = IOMUXC_GPR12, .mode_mask[1] = IMX8MQ_GPR12_PCIE2_CTRL_DEVICE_TYPE, - .epc_features = &imx8m_pcie_epc_features, + .epc_features = &imx8q_pcie_epc_features, .init_phy = imx8mq_pcie_init_phy, .enable_ref_clk = imx8mm_pcie_enable_ref_clk, },
Greg Kroah-Hartman
maintainerPATCH 102/457 PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Zhu <[email protected]>
commit 399444a87acdea5d21c218bc8e9b621fea1cd218 upstream.
For IMX8MM_EP and IMX8MP_EP, add fixed 256-byte BAR 4 and reserved BAR 5 in imx8m_pcie_epc_features.
--- drivers/pci/controller/dwc/pci-imx6.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/controller/dwc/pci-imx6.c +2 -0
@@ -1385,6 +1385,8 @@ static const struct pci_epc_features imx .msix_capable = false, .bar[BAR_1] = { .type = BAR_RESERVED, }, .bar[BAR_3] = { .type = BAR_RESERVED, }, + .bar[BAR_4] = { .type = BAR_FIXED, .fixed_size = SZ_256, }, + .bar[BAR_5] = { .type = BAR_RESERVED, }, .align = SZ_64K, };
Greg Kroah-Hartman
maintainerPATCH 103/457 PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Zhu <[email protected]>
commit d31eb217425591e100b475fad6360cd3da2073c6 upstream.
apps_reset corresponds to LTSSM_EN in i.MX7, i.MX8MQ, i.MX8MM and i.MX8MP platforms. Since assertion/de-assertion of apps_reset is done in imx_pcie_ltssm_enable() and imx_pcie_ltssm_disable(), remove it from imx_pcie_assert_core_reset() and imx_pcie_deassert_core_reset().
This also fixes a failure in enumerating the PI7C9X2G608GP (hotplug) chip reliably on i.MX8MM, as reported by Tim.
It should be noted that only i.MX7D, i.MX8MQ, i.MX8MM, and i.MX8MP platforms have the apps_reset logic, so this change doesn't have any effect on other platforms.
--- drivers/pci/controller/dwc/pci-imx6.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/pci/controller/dwc/pci-imx6.c +3 -2
@@ -860,7 +860,6 @@ static int imx95_pcie_core_reset(structstatic void imx_pcie_assert_core_reset (struct imx_pcie *imx_pcie) {reset_control_assert (imx_pcie->pciephy_reset); -reset_control_assert (imx_pcie->apps_reset);if (imx_pcie->drvdata->core_reset) imx_pcie->drvdata->core_reset (imx_pcie, true);
@@ -872,7 +871,6 @@ static void imx_pcie_assert_core_reset(sstatic int imx_pcie_deassert_core_reset (struct imx_pcie *imx_pcie) {reset_control_deassert (imx_pcie->pciephy_reset); -reset_control_deassert (imx_pcie->apps_reset);if (imx_pcie->drvdata->core_reset) imx_pcie->drvdata->core_reset (imx_pcie, false);
@@ -1247,6 +1245,9 @@ static int imx_pcie_host_init(struct dw_ } } +/* Make sure that PCIe LTSSM is cleared */ +imx_pcie_ltssm_disable (dev); + ret =imx_pcie_deassert_core_reset (imx_pcie);if (ret <0 ) {dev_err (dev,"pcie deassert core reset failed: %d\n" , ret);
Greg Kroah-Hartman
maintainerPATCH 104/457 PCI: imx6: Delay link start until configfs start written
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Zhu <[email protected]>
commit 2e6ea70690ddd1ffa422423fd0d4523e4dfe4b62 upstream.
According to Documentation/PCI/endpoint/pci-endpoint-cfs.rst, the Endpoint controller (EPC) should only start the link when userspace writes '1' to the '/sys/kernel/config/pci_ep/controllers/<EPC>/start' attribute, which ultimately results in calling imx_pcie_start_link() via pci_epc_start_store().
To align with the documented behavior, do not start the link automatically when adding the EP controller.
--- drivers/pci/controller/dwc/pci-imx6.c | 3 --- 1 file changed, 3 deletions(-)
drivers/pci/controller/dwc/pci-imx6.c +0 -3
@@ -1468,9 +1468,6 @@ static int imx_add_pcie_ep(struct imx_pcpci_epc_init_notify (ep->epc); -/* Start LTSSM. */ -imx_pcie_ltssm_enable (dev); -return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 105/457 vsock/virtio: Validate length in packet header before skb_put()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit 0dab92484474587b82e8e0455839eaf5ac7bf894 upstream.
When receiving a vsock packet in the guest, only the virtqueue buffer size is validated prior to virtio_vsock_skb_rx_put(). Unfortunately, virtio_vsock_skb_rx_put() uses the length from the packet header as the length argument to skb_put(), potentially resulting in SKB overflow if the host has gone wonky.
Validate the length as advertised by the packet header before calling virtio_vsock_skb_rx_put().
Message-Id: <[email protected]>
--- net/vmw_vsock/virtio_transport.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
net/vmw_vsock/virtio_transport.c +10 -2
@@ -624,8 +624,9 @@ static void virtio_transport_rx_work(str do { virtqueue_disable_cb(vq); for (;;) { + unsigned int len, payload_len; + struct virtio_vsock_hdr *hdr; struct sk_buff *skb; - unsigned int len; if (!virtio_transport_more_replies(vsock)) { /* Stop rx until the device processes already
@@ -642,11 +643,18 @@ static void virtio_transport_rx_work(str vsock->rx_buf_nr--;/* Drop short/long packets */ -if (unlikely (len <sizeof (struct virtio_vsock_hdr ) || +if (unlikely (len <sizeof (*hdr) || len >virtio_vsock_skb_len (skb))) {kfree_skb (skb);continue ; } + + hdr =virtio_vsock_hdr (skb); + payload_len =le32_to_cpu (hdr->len); +if (unlikely (payload_len > len -sizeof (*hdr))) { +kfree_skb (skb); +continue ; + }virtio_vsock_skb_rx_put (skb);virtio_transport_deliver_tap_pkt (skb);
Greg Kroah-Hartman
maintainerPATCH 106/457 vhost/vsock: Avoid allocating arbitrarily-sized SKBs
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit 10a886aaed293c4db3417951f396827216299e3d upstream.
vhost_vsock_alloc_skb() returns NULL for packets advertising a length larger than VIRTIO_VSOCK_MAX_PKT_BUF_SIZE in the packet header. However, this is only checked once the SKB has been allocated and, if the length in the packet header is zero, the SKB may not be freed immediately.
Hoist the size check before the SKB allocation so that an iovec larger than VIRTIO_VSOCK_MAX_PKT_BUF_SIZE + the header size is rejected outright. The subsequent check on the length field in the header can then simply check that the allocated SKB is indeed large enough to hold the packet.
Message-Id: <[email protected]>
--- drivers/vhost/vsock.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/vhost/vsock.c +4 -2
@@ -344,6 +344,9 @@ vhost_vsock_alloc_skb(struct vhost_virtq len =iov_length (vq->iov, out); +if (len >VIRTIO_VSOCK_MAX_PKT_BUF_SIZE +VIRTIO_VSOCK_SKB_HEADROOM ) +return NULL ; +/* len contains both payload and hdr */ skb =virtio_vsock_alloc_skb (len,GFP_KERNEL );if (!skb)
@@ -367,8 +370,7 @@ vhost_vsock_alloc_skb(struct vhost_virtqreturn skb;/* The pkt is too big or the length in the header is invalid */ -if (payload_len >VIRTIO_VSOCK_MAX_PKT_BUF_SIZE || - payload_len +sizeof (*hdr) > len) { +if (payload_len +sizeof (*hdr) > len) {kfree_skb (skb);return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 107/457 phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kathiravan Thirumoorthy <[email protected]>
commit 4a3556b81b99f0c8c0358f7cc6801a62b4538fe2 upstream.
The current configuration used for the IPQ5332 M31 USB PHY fails the Near End High Speed Signal Quality compliance test. To resolve this, update the initialization sequence as specified in the Hardware Design Document.
--- drivers/phy/qualcomm/phy-qcom-m31.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/phy/qualcomm/phy-qcom-m31.c +10 -4
@@ -58,14 +58,16 @@#define USB2_0_TX_ENABLE BIT(2)#define USB2PHY_USB_PHY_M31_XCFGI_4 0xc8 -#define HSTX_SLEW_RATE_565PS GENMASK(1, 0) +#define HSTX_SLEW_RATE_400PS GENMASK(2, 0)#define PLL_CHARGING_PUMP_CURRENT_35UA GENMASK(4, 3)#define ODT_VALUE_38_02_OHM GENMASK(7, 6)#define USB2PHY_USB_PHY_M31_XCFGI_5 0xcc -#define ODT_VALUE_45_02_OHM BIT(2)#define HSTX_PRE_EMPHASIS_LEVEL_0_55MA BIT(0) +#define USB2PHY_USB_PHY_M31_XCFGI_9 0xdc +#define HSTX_CURRENT_17_1MA_385MV BIT(1) +#define USB2PHY_USB_PHY_M31_XCFGI_11 0xe4#define XCFG_COARSE_TUNE_NUM BIT(1)#define XCFG_FINE_TUNE_NUM BIT(3)
@@ -164,7 +166,7 @@ static struct m31_phy_regs m31_ipq5332_r }, {USB2PHY_USB_PHY_M31_XCFGI_4 , -HSTX_SLEW_RATE_565PS |PLL_CHARGING_PUMP_CURRENT_35UA |ODT_VALUE_38_02_OHM , +HSTX_SLEW_RATE_400PS |PLL_CHARGING_PUMP_CURRENT_35UA |ODT_VALUE_38_02_OHM ,0 }, {
@@ -174,10 +176,14 @@ static struct m31_phy_regs m31_ipq5332_r }, {USB2PHY_USB_PHY_M31_XCFGI_5 , -ODT_VALUE_45_02_OHM |HSTX_PRE_EMPHASIS_LEVEL_0_55MA , +HSTX_PRE_EMPHASIS_LEVEL_0_55MA ,4 }, { +USB2PHY_USB_PHY_M31_XCFGI_9 , +HSTX_CURRENT_17_1MA_385MV , + }, + {USB_PHY_UTMI_CTRL5 ,0x0 ,0
Greg Kroah-Hartman
maintainerPATCH 108/457 amdgpu/amdgpu_discovery: increase timeout limit for IFWI init
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xaver Hugl <[email protected]>
commit 928587381b54b1b6c62736486b1dc6cb16c568c2 upstream.
With a timeout of only 1 second, my rx 5700XT fails to initialize, so this increases the timeout to 2s.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +2 -2
@@ -276,7 +276,7 @@ static int amdgpu_discovery_read_binary_u32 msg;if (!amdgpu_sriov_vf (adev)) { -/* It can take up to a second for IFWI init to complete on some dGPUs, +/* It can take up to two second for IFWI init to complete on some dGPUs, * but generally it should be in the 60-100ms range. Normally this starts * as soon as the device gets power so by the time the OS loads this has long * completed. However, when a card is hotplugged via e.g., USB4, we need to
@@ -284,7 +284,7 @@ static int amdgpu_discovery_read_binary_* continue. */ -for (i =0 ; i <1000 ; i++) { +for (i =0 ; i <2000 ; i++) { msg =RREG32 (mmMP0_SMN_C2PMSG_33);if (msg &0x80000000 )break ;
Greg Kroah-Hartman
maintainerPATCH 109/457 ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Usama Anjum <[email protected]>
commit eb3bb145280b6c857a748731a229698e4a7cf37b upstream.
Replace GFP_ATOMIC with GFP_KERNEL for dma_alloc_coherent() calls. This change improves memory allocation reliability during firmware loading, particularly during system resume when memory pressure is high. Because of using GFP_KERNEL, reclaim can happen which can reduce the probability of failure.
Fixes memory allocation failures observed during system resume with fragmented memory conditions.
snd_sof_amd_vangogh 0000:04:00.5: error: failed to load DSP firmware after resume -12
--- sound/soc/sof/amd/acp-loader.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/soc/sof/amd/acp-loader.c +3 -3
@@ -65,7 +65,7 @@ int acp_dsp_block_write(struct snd_sof_d dma_size = page_count *ACP_PAGE_SIZE ; adata->bin_buf =dma_alloc_coherent (&pci->dev, dma_size, &adata->sha_dma_addr, -GFP_ATOMIC ); +GFP_KERNEL );if (!adata->bin_buf)return -ENOMEM ; }
@@ -77,7 +77,7 @@ int acp_dsp_block_write(struct snd_sof_d adata->data_buf =dma_alloc_coherent (&pci->dev,ACP_DEFAULT_DRAM_LENGTH , &adata->dma_addr, -GFP_ATOMIC ); +GFP_KERNEL );if (!adata->data_buf)return -ENOMEM ; }
@@ -90,7 +90,7 @@ int acp_dsp_block_write(struct snd_sof_d adata->sram_data_buf =dma_alloc_coherent (&pci->dev,ACP_DEFAULT_SRAM_LENGTH , &adata->sram_dma_addr, -GFP_ATOMIC ); +GFP_KERNEL );if (!adata->sram_data_buf)return -ENOMEM ; }
Greg Kroah-Hartman
maintainerPATCH 110/457 block: restore default wbt enablement
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Sun <[email protected]>
commit 8f5845e0743bf3512b71b3cb8afe06c192d6acc4 upstream.
The commit 245618f8e45f ("block: protect wbt_lat_usec using q->elevator_lock") protected wbt_enable_default() with q->elevator_lock; however, it also placed wbt_enable_default() before blk_queue_flag_set(QUEUE_FLAG_REGISTERED, q);, resulting in wbt failing to be enabled.
Moreover, the protection of wbt_enable_default() by q->elevator_lock was removed in commit 78c271344b6f ("block: move wbt_enable_default() out of queue freezing from sched ->exit()"), so we can directly fix this issue by placing wbt_enable_default() after blk_queue_flag_set(QUEUE_FLAG_REGISTERED, q);.
Additionally, this issue also causes the inability to read the wbt_lat_usec file, and the scenario is as follows:
root@q:/sys/block/sda/queue# cat wbt_lat_usec cat: wbt_lat_usec: Invalid argument
root@q:/data00/sjc/linux# ls /sys/kernel/debug/block/sda/rqos cannot access '/sys/kernel/debug/block/sda/rqos': No such file or directory
root@q:/data00/sjc/linux# find /sys -name wbt /sys/kernel/debug/tracing/events/wbt
After testing with this patch, wbt can be enabled normally.
--- block/blk-sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/blk-sysfs.c +1 -1
@@ -876,9 +876,9 @@ int blk_register_queue(struct gendisk *dif (queue_is_mq (q))elevator_set_default (q); -wbt_enable_default (disk);blk_queue_flag_set (QUEUE_FLAG_REGISTERED , q); +wbt_enable_default (disk);/* Now everything is ready and send out KOBJ_ADD uevent */ kobject_uevent (&disk->queue_kobj,KOBJ_ADD );
Greg Kroah-Hartman
maintainerPATCH 111/457 f2fs: fix to avoid out-of-boundary access in dnode page
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
commit 77de19b6867f2740cdcb6c9c7e50d522b47847a4 upstream.
As Jiaming Zhang reported:
<TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x1c1/0x2a0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x17e/0x800 mm/kasan/report.c:480 kasan_report+0x147/0x180 mm/kasan/report.c:593 data_blkaddr fs/f2fs/f2fs.h:3053 [inline] f2fs_data_blkaddr fs/f2fs/f2fs.h:3058 [inline] f2fs_get_dnode_of_data+0x1a09/0x1c40 fs/f2fs/node.c:855 f2fs_reserve_block+0x53/0x310 fs/f2fs/data.c:1195 prepare_write_begin fs/f2fs/data.c:3395 [inline] f2fs_write_begin+0xf39/0x2190 fs/f2fs/data.c:3594 generic_perform_write+0x2c7/0x910 mm/filemap.c:4112 f2fs_buffered_write_iter fs/f2fs/file.c:4988 [inline] f2fs_file_write_iter+0x1ec8/0x2410 fs/f2fs/file.c:5216 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x546/0xa90 fs/read_write.c:686 ksys_write+0x149/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x3d0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
The root cause is in the corrupted image, there is a dnode has the same node id w/ its inode, so during f2fs_get_dnode_of_data(), it tries to access block address in dnode at offset 934, however it parses the dnode as inode node, so that get_dnode_addr() returns 360, then it tries to access page address from 360 + 934 * 4 = 4096 w/ 4 bytes.
To fix this issue, let's add sanity check for node id of all direct nodes during f2fs_get_dnode_of_data().
--- fs/f2fs/node.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
fs/f2fs/node.c +10 -0
@@ -816,6 +816,16 @@ int f2fs_get_dnode_of_data(struct dnode_for (i =1 ; i <= level; i++) {bool done = false; +if (nids[i] && nids[i] == dn->inode->i_ino) { + err = -EFSCORRUPTED ; +f2fs_err_ratelimited (sbi, +"inode mapping table is corrupted, run fsck to fix it, " +"ino:%lu, nid:%u, level:%d, offset:%d" , + dn->inode->i_ino, nids[i], level, offset[level]); +set_sbi_flag (sbi,SBI_NEED_FSCK ); + goto release_pages; + } +if (!nids[i] && mode ==ALLOC_NODE ) {/* alloc new node */ if (!f2fs_alloc_nid (sbi, &(nids[i]))) {
Greg Kroah-Hartman
maintainerPATCH 112/457 i2c: qcom-geni: fix I2C frequency table to achieve accurate bus rates
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kathiravan Thirumoorthy <[email protected]>
commit 85c34532849dae0fdcf880900ac9d7718a73fd1b upstream.
Update the I2C frequency table to match the recommended values specified in the I2C hardware programming guide. In the current IPQ5424 configuration where 32MHz is the source clock, the I2C bus frequencies do not meet expectations—for instance, 363KHz is achieved instead of the expected 400KHz.
--- drivers/i2c/busses/i2c-qcom-geni.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/i2c/busses/i2c-qcom-geni.c +3 -3
@@ -155,9 +155,9 @@ static const struct geni_i2c_clk_fld gen/* source_clock = 32 MHz */ static const struct geni_i2c_clk_fld geni_i2c_clk_map_32mhz[] = { - {I2C_MAX_STANDARD_MODE_FREQ ,8 ,14 ,18 ,40 }, - {I2C_MAX_FAST_MODE_FREQ ,4 ,3 ,11 ,20 }, - {I2C_MAX_FAST_MODE_PLUS_FREQ ,2 ,3 ,6 ,15 }, + {I2C_MAX_STANDARD_MODE_FREQ ,8 ,14 ,18 ,38 }, + {I2C_MAX_FAST_MODE_FREQ ,4 ,3 ,9 ,19 }, + {I2C_MAX_FAST_MODE_PLUS_FREQ ,2 ,3 ,5 ,15 }, {} };
Greg Kroah-Hartman
maintainerPATCH 113/457 iomap: Fix broken data integrity guarantees for O_SYNC writes
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 6b65028e2b51c023a816eabffea88980fdd5564e upstream.
Commit d279c80e0bac ("iomap: inline iomap_dio_bio_opflags()") has broken the logic in iomap_dio_bio_iter() in a way that when the device does support FUA (or has no writeback cache) and the direct IO happens to freshly allocated or unwritten extents, we will *not* issue fsync after completing direct IO O_SYNC / O_DSYNC write because the IOMAP_DIO_WRITE_THROUGH flag stays mistakenly set. Fix the problem by clearing IOMAP_DIO_WRITE_THROUGH whenever we do not perform FUA write as it was originally intended.
--- fs/iomap/direct-io.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
fs/iomap/direct-io.c +7 -7
@@ -368,14 +368,14 @@ static int iomap_dio_bio_iter(struct iomif (iomap->flags &IOMAP_F_SHARED ) dio->flags |=IOMAP_DIO_COW ; -if (iomap->flags &IOMAP_F_NEW ) { +if (iomap->flags &IOMAP_F_NEW ) need_zeroout = true; - }else if (iomap->type ==IOMAP_MAPPED ) { -if (iomap_dio_can_use_fua (iomap, dio)) - bio_opf |=REQ_FUA ; -else - dio->flags &= ~IOMAP_DIO_WRITE_THROUGH ; - } +else if (iomap->type ==IOMAP_MAPPED && +iomap_dio_can_use_fua (iomap, dio)) + bio_opf |=REQ_FUA ; + +if (!(bio_opf &REQ_FUA )) + dio->flags &= ~IOMAP_DIO_WRITE_THROUGH ;/* * We can only do deferred completion for pure overwrites that
Greg Kroah-Hartman
maintainerPATCH 114/457 jbd2: prevent softlockup in jbd2_log_do_checkpoint()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
commit 9d98cf4632258720f18265a058e62fde120c0151 upstream.
Both jbd2_log_do_checkpoint() and jbd2_journal_shrink_checkpoint_list() periodically release j_list_lock after processing a batch of buffers to avoid long hold times on the j_list_lock. However, since both functions contend for j_list_lock, the combined time spent waiting and processing can be significant.
jbd2_journal_shrink_checkpoint_list() explicitly calls cond_resched() when need_resched() is true to avoid softlockups during prolonged operations. But jbd2_log_do_checkpoint() only exits its loop when need_resched() is true, relying on potentially sleeping functions like __flush_batch() or wait_on_buffer() to trigger rescheduling. If those functions do not sleep, the kernel may hit a softlockup.
watchdog: BUG: soft lockup - CPU#3 stuck for 156s! [kworker/u129:2:373] CPU: 3 PID: 373 Comm: kworker/u129:2 Kdump: loaded Not tainted 6.6.0+ #10 Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.27 06/13/2017 Workqueue: writeback wb_workfn (flush-7:2) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : native_queued_spin_lock_slowpath+0x358/0x418 lr : jbd2_log_do_checkpoint+0x31c/0x438 [jbd2] Call trace: native_queued_spin_lock_slowpath+0x358/0x418 jbd2_log_do_checkpoint+0x31c/0x438 [jbd2] __jbd2_log_wait_for_space+0xfc/0x2f8 [jbd2] add_transaction_credits+0x3bc/0x418 [jbd2] start_this_handle+0xf8/0x560 [jbd2] jbd2__journal_start+0x118/0x228 [jbd2] __ext4_journal_start_sb+0x110/0x188 [ext4] ext4_do_writepages+0x3dc/0x740 [ext4] ext4_writepages+0xa4/0x190 [ext4] do_writepages+0x94/0x228 __writeback_single_inode+0x48/0x318 writeback_sb_inodes+0x204/0x590 __writeback_inodes_wb+0x54/0xf8 wb_writeback+0x2cc/0x3d8 wb_do_writeback+0x2e0/0x2f8 wb_workfn+0x80/0x2a8 process_one_work+0x178/0x3e8 worker_thread+0x234/0x3b8 kthread+0xf0/0x108 ret_from_fork+0x10/0x20
So explicitly call cond_resched() in jbd2_log_do_checkpoint() to avoid softlockup.
--- fs/jbd2/checkpoint.c | 1 + 1 file changed, 1 insertion(+)
fs/jbd2/checkpoint.c +1 -0
@@ -285,6 +285,7 @@ restart: retry:if (batch_count)__flush_batch (journal, &batch_count); +cond_resched ();spin_lock (&journal->j_list_lock); goto restart; }
Greg Kroah-Hartman
maintainerPATCH 115/457 kasan/test: fix protection against compiler elision
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit 475356fe2814f2f0b188da8bf0f1fcc579d81272 upstream.
The kunit test is using assignments to
"static volatile void *kasan_ptr_result" to prevent elision of memory loads, but that's not working:
In this variable definition, the "volatile" applies to the "void", not to the pointer.
To make "volatile" apply to the pointer as intended, it must follow after the "*".
This makes the kasan_memchr test pass again on my system. The kasan_strings test is still failing because all the definitions of load_unaligned_zeropad() are lacking explicit instrumentation hooks and ASAN does not instrument asm() memory operands.
--- mm/kasan/kasan_test_c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/kasan/kasan_test_c.c +1 -1
@@ -47,7 +47,7 @@ static struct {* Some tests use these global variables to store return values from function * calls that could otherwise be eliminated by the compiler as dead code. */ -static volatile void *kasan_ptr_result; +static void *volatile kasan_ptr_result;static volatile int kasan_int_result;/* Probe for console output: obtains test_status lines of interest. */
Greg Kroah-Hartman
maintainerPATCH 116/457 kbuild: userprogs: use correct linker when mixing clang and GNU ld
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
commit 936599ca514973d44a766b7376c6bbdc96b6a8cc upstream.
The userprogs infrastructure does not expect clang being used with GNU ld and in that case uses /usr/bin/ld for linking, not the configured $(LD). This fallback is problematic as it will break when cross-compiling. Mixing clang and GNU ld is used for example when building for SPARC64, as ld.lld is not sufficient; see Documentation/kbuild/llvm.rst.
Relax the check around --ld-path so it gets used for all linkers.
--- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Makefile +1 -1
@@ -1134,7 +1134,7 @@ KBUILD_USERCFLAGS += $(filter -m32 -m64 KBUILD_USERLDFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS)) # userspace programs are linked via the compiler, use the correct linker -ifeq ($(CONFIG_CC_IS_CLANG)$(CONFIG_LD_IS_LLD),yy) +ifdef CONFIG_CC_IS_CLANG KBUILD_USERLDFLAGS += --ld-path=$(LD) endif
Greg Kroah-Hartman
maintainerPATCH 117/457 Mark xe driver as BROKEN if kernel page size is not 4kB
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Richter <[email protected]>
commit 022906afdf90327bce33d52fb4fb41b6c7d618fb upstream.
This driver, for the time being, assumes that the kernel page size is 4kB, so it fails on loong64 and aarch64 with 16kB pages, and ppc64el with 64kB pages.
--- drivers/gpu/drm/xe/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/xe/Kconfig +1 -0
@@ -5,6 +5,7 @@ config DRM_XE depends on KUNIT || !KUNIT depends on INTEL_VSEC || !INTEL_VSEC depends on X86_PLATFORM_DEVICES || !(X86 && ACPI) + depends on PAGE_SIZE_4KB || COMPILE_TEST || BROKEN select INTERVAL_TREE # we need shmfs for the swappable backing store, and in particular # the shmem_readpage() which depends upon tmpfs
Greg Kroah-Hartman
maintainerPATCH 118/457 open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksa Sarai <[email protected]>
commit 9308366f062129d52e0ee3f7a019f7dd41db33df upstream.
As described in commit 7a54947e727b ('Merge patch series "fs: allow changing idmappings"'), open_tree_attr(2) was necessary in order to allow for a detached mount to be created and have its idmappings changed without the risk of any racing threads operating on it. For this reason, mount_setattr(2) still does not allow for id-mappings to be changed.
However, there was a bug in commit 2462651ffa76 ("fs: allow changing idmappings") which allowed users to bypass this restriction by calling open_tree_attr(2) *without* OPEN_TREE_CLONE.
can_idmap_mount() prevented this bug from allowing an attached mountpoint's id-mapping from being modified (thanks to an is_anon_ns() check), but this still allows for detached (but visible) mounts to have their be id-mapping changed. This risks the same UAF and locking issues as described in the merge commit, and was likely unintentional.
--- fs/namespace.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/namespace.c +2 -1
@@ -5302,7 +5302,8 @@ SYSCALL_DEFINE5(open_tree_attr, int, dfdint ret;struct mount_kattr kattr = {}; - kattr.kflags =MOUNT_KATTR_IDMAP_REPLACE ; +if (flags &OPEN_TREE_CLONE ) + kattr.kflags =MOUNT_KATTR_IDMAP_REPLACE ;if (flags &AT_RECURSIVE ) kattr.kflags |=MOUNT_KATTR_RECURSE ;
Greg Kroah-Hartman
maintainerPATCH 119/457 proc: proc_maps_open allow proc_mem_open to return NULL
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jialin Wang <[email protected]>
commit c0e1b774f68bdbea1618e356e30672c7f1e32509 upstream.
The commit 65c66047259f ("proc: fix the issue of proc_mem_open returning NULL") caused proc_maps_open() to return -ESRCH when proc_mem_open() returns NULL. This breaks legitimate /proc/<pid>/maps access for kernel threads since kernel threads have NULL mm_struct.
The regression causes perf to fail and exit when profiling a kernel thread:
# perf record -v -g -p $(pgrep kswapd0) ... couldn't open /proc/65/task/65/maps
This patch partially reverts the commit to fix it.
--- fs/proc/task_mmu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/proc/task_mmu.c +2 -2
@@ -212,8 +212,8 @@ static int proc_maps_open(struct inode * priv->inode = inode; priv->mm =proc_mem_open (inode,PTRACE_MODE_READ ); -if (IS_ERR_OR_NULL (priv->mm)) { -int err = priv->mm ?PTR_ERR (priv->mm) : -ESRCH ; +if (IS_ERR (priv->mm)) { +int err =PTR_ERR (priv->mm);seq_release_private (inode, file);return err;
Greg Kroah-Hartman
maintainerPATCH 120/457 soc/tegra: pmc: Ensure power-domains are in a known state
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Hunter <[email protected]>
commit b6bcbce3359619d05bf387d4f5cc3af63668dbaa upstream.
After commit 13a4b7fb6260 ("pmdomain: core: Leave powered-on genpds on until late_initcall_sync") was applied, the Tegra210 Jetson TX1 board failed to boot. Looking into this issue, before this commit was applied, if any of the Tegra power-domains were in 'on' state when the kernel booted, they were being turned off by the genpd core before any driver had chance to request them. This was purely by luck and a consequence of the power-domains being turned off earlier during boot. After this commit was applied, any power-domains in the 'on' state are kept on for longer during boot and therefore, may never transitioned to the off state before they are requested/used. The hang on the Tegra210 Jetson TX1 is caused because devices in some power-domains are accessed without the power-domain being turned off and on, indicating that the power-domain is not in a completely on state.
Quoted 1 line
From reviewing the Tegra PMC driver code, if a power-domain is in the
'on' state there is no guarantee that all the necessary clocks associated with the power-domain are on and even if they are they would not have been requested via the clock framework and so could be turned off later. Some power-domains also have a 'clamping' register that needs to be configured as well. In short, if a power-domain is already 'on' it is difficult to know if it has been configured correctly. Given that the power-domains happened to be switched off during boot previously, to ensure that they are in a good known state on boot, fix this by switching off any power-domains that are on initially when registering the power-domains with the genpd framework.
Note that commit 05cfb988a4d0 ("soc/tegra: pmc: Initialise resets associated with a power partition") updated the tegra_powergate_of_get_resets() function to pass the 'off' to ensure that the resets for the power-domain are in the correct state on boot. However, now that we may power off a domain on boot, if it is on, it is better to move this logic into the tegra_powergate_add() function so that there is a single place where we are handling the initial state of the power-domain.
--- drivers/soc/tegra/pmc.c | 51 +++++++++++++++++++++++++++--------------------- 1 file changed, 29 insertions(+), 22 deletions(-)
drivers/soc/tegra/pmc.c +29 -22
@@ -1234,7 +1234,7 @@ err: }static int tegra_powergate_of_get_resets (struct tegra_powergate *pg, -struct device_node *np,bool off) +struct device_node *np) {struct device *dev = pg->pmc->dev;int err;
@@ -1249,22 +1249,6 @@ static int tegra_powergate_of_get_resets err =reset_control_acquire (pg->reset);if (err <0 ) {pr_err ("failed to acquire resets: %d\n" , err); - goto out; - } - -if (off) { - err =reset_control_assert (pg->reset); - }else { - err =reset_control_deassert (pg->reset); -if (err <0 ) - goto out; - -reset_control_release (pg->reset); - } - -out: -if (err) { -reset_control_release (pg->reset);reset_control_put (pg->reset); }
@@ -1309,20 +1293,43 @@ static int tegra_powergate_add(struct te goto set_available; } - err =tegra_powergate_of_get_resets (pg, np, off); + err =tegra_powergate_of_get_resets (pg, np);if (err <0 ) {dev_err (dev,"failed to get resets for %pOFn: %d\n" , np, err); goto remove_clks; } -if (!IS_ENABLED (CONFIG_PM_GENERIC_DOMAINS )) { -if (off) -WARN_ON (tegra_powergate_power_up (pg, true)); +/* +* If the power-domain is off, then ensure the resets are asserted. +* If the power-domain is on, then power down to ensure that when is +* it turned on the power-domain, clocks and resets are all in the +* expected state. +*/ +if (off) { + err =reset_control_assert (pg->reset); +if (err) { +pr_err ("failed to assert resets: %d\n" , err); + goto remove_resets; + } + }else { + err =tegra_powergate_power_down (pg); +if (err) { +dev_err (dev,"failed to turn off PM domain %s: %d\n" , + pg->genpd.name, err); + goto remove_resets; + } + } +/* +* If PM_GENERIC_DOMAINS is not enabled, power-on +* the domain and skip the genpd registration. +*/ +if (!IS_ENABLED (CONFIG_PM_GENERIC_DOMAINS )) { +WARN_ON (tegra_powergate_power_up (pg, true)); goto remove_resets; } - err =pm_genpd_init (&pg->genpd,NULL , off); + err =pm_genpd_init (&pg->genpd,NULL , true);if (err <0 ) {dev_err (dev,"failed to initialise PM domain %pOFn: %d\n" , np, err);
Greg Kroah-Hartman
maintainerPATCH 121/457 parisc: Check region is readable by user in raw_copy_from_user()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: John David Anglin <[email protected]>
commit 91428ca9320edbab1211851d82429d33b9cd73ef upstream.
Because of the way the _PAGE_READ is handled in the parisc PTE, an access interruption is not generated when the kernel reads from a region where the _PAGE_READ is zero. The current code was written assuming read access faults would also occur in the kernel.
This change adds user access checks to raw_copy_from_user(). The prober_user() define checks whether user code has read access to a virtual address. Note that page faults are not handled in the exception support for the probe instruction. For this reason, we precede the probe by a ldb access check.
--- arch/parisc/include/asm/special_insns.h | 28 ++++++++++++++++++++++++++++ arch/parisc/lib/memcpy.c | 19 ++++++++++++++++++- 2 files changed, 46 insertions(+), 1 deletion(-)
arch/parisc/include/asm/special_insns.h +28 -0
@@ -32,6 +32,34 @@ pa; \ }) +/** +* prober_user() - Probe user read access +* @sr: Space regster. +* @va: Virtual address. +* +* Return: Non-zero if address is accessible. +* +* Due to the way _PAGE_READ is handled in TLB entries, we need +* a special check to determine whether a user address is accessible. +* The ldb instruction does the initial access check. If it is +* successful, the probe instruction checks user access rights. +*/ +#define prober_user (sr, va) ({ \ + unsigned long read_allowed; \ + __asm__ __volatile__( \ + "copy %%r0,%0\n" \ + "8:\tldb 0(%%sr%1,%2),%%r0\n" \ + "\tproberi (%%sr%1,%2),%3,%0\n" \ + "9:\n" \ + ASM_EXCEPTIONTABLE_ENTRY(8b, 9b, \ + "or %%r0,%%r0,%%r0") \ + : "=&r" (read_allowed) \ + : "i" (sr), "r" (va), "i" (PRIV_USER) \ + : "memory" \ + ); \ + read_allowed; \ +}) +#define CR_EIEM 15/* External Interrupt Enable Mask */ #define CR_CR16 16/* CR16 Interval Timer */ #define CR_EIRR 23/* External Interrupt Request Register */
arch/parisc/lib/memcpy.c +18 -1
@@ -12,6 +12,7 @@#include <linux/module.h> #include <linux/compiler.h> #include <linux/uaccess.h> +#include <linux/mm.h> #define get_user_space () mfsp(SR_USER)#define get_kernel_space () SR_KERNEL
@@ -32,9 +33,25 @@ EXPORT_SYMBOL(raw_copy_to_user);unsigned long raw_copy_from_user (void *dst,const void __user *src,unsigned long len) { +unsigned long start = (unsigned long ) src; +unsigned long end = start + len; +unsigned long newlen = len; +mtsp (get_user_space (),SR_TEMP1 );mtsp (get_kernel_space (),SR_TEMP2 ); -return pa_memcpy (dst, (void __force *)src, len); + +/* Check region is user accessible */ +if (start) +while (start < end) { +if (!prober_user (SR_TEMP1 , start)) { + newlen = (start - (unsigned long ) src); +break ; + } + start +=PAGE_SIZE ; +/* align to page boundry which may have different permission */ + start =PAGE_ALIGN_DOWN (start); + } +return len - newlen +pa_memcpy (dst, (void __force *)src, newlen); }EXPORT_SYMBOL (raw_copy_from_user);
Greg Kroah-Hartman
maintainerPATCH 122/457 parisc: Define and use set_pte_at()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: John David Anglin <[email protected]>
commit 802e55488bc2cc1ab6423b720255a785ccac42ce upstream.
When a PTE is changed, we need to flush the PTE. set_pte_at() was lost in the folio update. PA-RISC version is the same as the generic version.
--- arch/parisc/include/asm/pgtable.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
arch/parisc/include/asm/pgtable.h +4 -3
@@ -276,7 +276,7 @@ extern unsigned long *empty_zero_page;#define pte_none (x) (pte_val(x) == 0)#define pte_present (x) (pte_val(x) & _PAGE_PRESENT)#define pte_user (x) (pte_val(x) & _PAGE_USER) -#define pte_clear (mm, addr, xp) set_pte(xp, __pte(0)) +#define pte_clear (mm, addr, xp) set_pte_at((mm), (addr), (xp), __pte(0))#define pmd_flag (x) (pmd_val(x) & PxD_FLAG_MASK)#define pmd_address (x) ((unsigned long)(pmd_val(x) &~ PxD_FLAG_MASK) << PxD_VALUE_SHIFT)
@@ -392,6 +392,7 @@ static inline void set_ptes(struct mm_st } }#define set_ptes set_ptes +#define set_pte_at (mm, addr, ptep, pte) set_ptes(mm, addr, ptep, pte, 1)/* Used for deferring calls to flush_dcache_page() */
@@ -456,7 +457,7 @@ static inline int ptep_test_and_clear_yoif (!pte_young (pte)) {return 0 ; } -set_pte (ptep,pte_mkold (pte)); +set_pte_at (vma->vm_mm, addr, ptep,pte_mkold (pte));return 1 ; }
@@ -466,7 +467,7 @@ pte_t ptep_clear_flush(struct vm_area_ststruct mm_struct ;static inline void ptep_set_wrprotect (struct mm_struct *mm,unsigned long addr,pte_t *ptep) { -set_pte (ptep,pte_wrprotect (*ptep)); +set_pte_at (mm, addr, ptep,pte_wrprotect (*ptep)); }#define pte_same (A ,B ) (pte_val(A) == pte_val(B))
Greg Kroah-Hartman
maintainerPATCH 123/457 parisc: Drop WARN_ON_ONCE() from flush_cache_vmap
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: John David Anglin <[email protected]>
commit 4eab1c27ce1f0e89ab67b01bf1e4e4c75215708a upstream.
I have observed warning to occassionally trigger.
--- arch/parisc/kernel/cache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/parisc/kernel/cache.c +1 -1
@@ -841,7 +841,7 @@ void flush_cache_vmap(unsigned long star } vm =find_vm_area ((void *)start); -if (WARN_ON_ONCE (!vm)) { +if (!vm) {flush_cache_all ();return ; }
Greg Kroah-Hartman
maintainerPATCH 124/457 parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
commit 305ab0a748c52eeaeb01d8cff6408842d19e5cb5 upstream.
For building a 64-bit kernel, both 32-bit and 64-bit VDSO binaries are built, so both 32-bit and 64-bit compilers (and tools) should be in the PATH environment variable.
--- arch/parisc/Makefile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/parisc/Makefile +3 -1
@@ -39,7 +39,9 @@ endif export LD_BFD -# Set default 32 bits cross compilers for vdso +# Set default 32 bits cross compilers for vdso. +# This means that for 64BIT, both the 64-bit tools and the 32-bit tools +# need to be in the path. CC_ARCHES_32 = hppa hppa2.0 hppa1.1 CC_SUFFIXES = linux linux-gnu unknown-linux-gnu suse-linux CROSS32_COMPILE := $(call cc-cross-prefix, \
Greg Kroah-Hartman
maintainerPATCH 125/457 parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: John David Anglin <[email protected]>
commit 52ce9406a9625c4498c4eaa51e7a7ed9dcb9db16 upstream.
The local name used in cache.c conflicts the declaration in include/asm-generic/tlb.h.
--- arch/parisc/kernel/cache.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/parisc/kernel/cache.c +2 -2
@@ -429,7 +429,7 @@ static inline pte_t *get_ptep(struct mm_return ptep; } -static inline bool pte_needs_flush (pte_t pte) +static inline bool pte_needs_cache_flush (pte_t pte) {return (pte_val (pte) & (_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_NO_CACHE)) == (_PAGE_PRESENT | _PAGE_ACCESSED);
@@ -630,7 +630,7 @@ static void flush_cache_page_if_present( ptep =get_ptep (vma->vm_mm, vmaddr);if (ptep) { pte =ptep_get (ptep); - needs_flush =pte_needs_flush (pte); + needs_flush =pte_needs_cache_flush (pte);pte_unmap (ptep); }if (needs_flush)
Greg Kroah-Hartman
maintainerPATCH 126/457 parisc: Revise __get_user() to probe user read access
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: John David Anglin <[email protected]>
commit 89f686a0fb6e473a876a9a60a13aec67a62b9a7e upstream.
Because of the way read access support is implemented, read access interruptions are only triggered at privilege levels 2 and 3. The kernel executes at privilege level 0, so __get_user() never triggers a read access interruption (code 26). Thus, it is currently possible for user code to access a read protected address via a system call.
Fix this by probing read access rights at privilege level 3 (PRIV_USER) and setting __gu_err to -EFAULT (-14) if access isn't allowed.
Note the cmpiclr instruction does a 32-bit compare because COND macro doesn't work inside asm.
--- arch/parisc/include/asm/uaccess.h | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
arch/parisc/include/asm/uaccess.h +18 -3
@@ -42,9 +42,24 @@ __gu_err; \ }) -#define __get_user (val, ptr) \ -({ \ - __get_user_internal(SR_USER, val, ptr); \ +#define __probe_user_internal (sr, error, ptr) \ +({ \ + __asm__("\tproberi (%%sr%1,%2),%3,%0\n" \ + "\tcmpiclr,= 1,%0,%0\n" \ + "\tldi %4,%0\n" \ + : "=r"(error) \ + : "i"(sr), "r"(ptr), "i"(PRIV_USER), \ + "i"(-EFAULT)); \ +}) + +#define __get_user (val, ptr) \ +({ \ + register long __gu_err; \ + \ + __gu_err = __get_user_internal(SR_USER, val, ptr); \ + if (likely(!__gu_err)) \ + __probe_user_internal(SR_USER, __gu_err, ptr); \ + __gu_err; \ })#define __get_user_asm (sr, val, ldx, ptr) \
Greg Kroah-Hartman
maintainerPATCH 127/457 parisc: Revise gateway LWS calls to probe user read access
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: John David Anglin <[email protected]>
commit f6334f4ae9a4e962ba74b026e1d965dfdf8cbef8 upstream.
We use load and stbys,e instructions to trigger memory reference interruptions without writing to memory. Because of the way read access support is implemented, read access interruptions are only triggered at privilege levels 2 and 3. The kernel and gateway page execute at privilege level 0, so this code never triggers a read access interruption. Thus, it is currently possible for user code to execute a LWS compare and swap operation at an address that is read protected at privilege level 3 (PRIV_USER).
Fix this by probing read access rights at privilege level 3 and branching to lws_fault if access isn't allowed.
--- arch/parisc/kernel/syscall.S | 30 +++++++++++++++++++++--------- 1 file changed, 21 insertions(+), 9 deletions(-)
arch/parisc/kernel/syscall.S +21 -9
@@ -613,6 +613,9 @@ lws_compare_and_swap32: lws_compare_and_swap: /* Trigger memory reference interruptions without writing to memory */ 1: ldw 0(%r26), %r28 + proberi (%r26), PRIV_USER, %r28 + comb,=,n %r28, %r0, lws_fault /* backwards, likely not taken */ + nop 2: stbys,e %r0, 0(%r26) /* Calculate 8-bit hash index from virtual address */
@@ -767,6 +770,9 @@ cas2_lock_start: copy %r26, %r28 depi_safe 0, 31, 2, %r28 10: ldw 0(%r28), %r1 + proberi (%r28), PRIV_USER, %r1 + comb,=,n %r1, %r0, lws_fault /* backwards, likely not taken */ + nop 11: stbys,e %r0, 0(%r28) /* Calculate 8-bit hash index from virtual address */
@@ -951,41 +957,47 @@ atomic_xchg_begin: /* 8-bit exchange */ 1: ldb 0(%r24), %r20 + proberi (%r24), PRIV_USER, %r20 + comb,=,n %r20, %r0, lws_fault /* backwards, likely not taken */ + nop copy %r23, %r20 depi_safe 0, 31, 2, %r20 b atomic_xchg_start 2: stbys,e %r0, 0(%r20) - nop - nop - nop /* 16-bit exchange */ 3: ldh 0(%r24), %r20 + proberi (%r24), PRIV_USER, %r20 + comb,=,n %r20, %r0, lws_fault /* backwards, likely not taken */ + nop copy %r23, %r20 depi_safe 0, 31, 2, %r20 b atomic_xchg_start 4: stbys,e %r0, 0(%r20) - nop - nop - nop /* 32-bit exchange */ 5: ldw 0(%r24), %r20 + proberi (%r24), PRIV_USER, %r20 + comb,=,n %r20, %r0, lws_fault /* backwards, likely not taken */ + nop b atomic_xchg_start 6: stbys,e %r0, 0(%r23) nop nop - nop - nop - nop /* 64-bit exchange */ #ifdef CONFIG_64BIT 7: ldd 0(%r24), %r20 + proberi (%r24), PRIV_USER, %r20 + comb,=,n %r20, %r0, lws_fault /* backwards, likely not taken */ + nop 8: stdby,e %r0, 0(%r23) #else 7: ldw 0(%r24), %r20 8: ldw 4(%r24), %r20 + proberi (%r24), PRIV_USER, %r20 + comb,=,n %r20, %r0, lws_fault /* backwards, likely not taken */ + nop copy %r23, %r20 depi_safe 0, 31, 2, %r20 9: stbys,e %r0, 0(%r20)
Greg Kroah-Hartman
maintainerPATCH 128/457 parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: John David Anglin <[email protected]>
commit f92a5e36b0c45cd12ac0d1bc44680c0dfae34543 upstream.
--- arch/parisc/mm/fault.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/parisc/mm/fault.c +4 -0
@@ -363,6 +363,10 @@ bad_area:mmap_read_unlock (mm); bad_area_nosemaphore: +if (!user_mode (regs) &&fixup_exception (regs)) { +return ; + } +if (user_mode (regs)) {int signo, si_code;
Greg Kroah-Hartman
maintainerPATCH 129/457 parisc: Update comments in make_insert_tlb
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: John David Anglin <[email protected]>
commit cb22f247f371bd206a88cf0e0c05d80b8b62fb26 upstream.
The following testcase exposed a problem with our read access checks in get_user() and raw_copy_from_user():
#include <stdint.h>
#include <stddef.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <sys/mman.h>
#include <sys/types.h>
int main(int argc, char **argv)
{
unsigned long page_size = sysconf(_SC_PAGESIZE); char *p = malloc(3 * page_size);
char *p_aligned;
/* initialize memory region. If not initialized, write syscall below will correctly return EFAULT. */ if (1)
memset(p, 'X', 3 * page_size);
p_aligned = (char *) ((((uintptr_t) p) + (2*page_size - 1)) & ~(page_size - 1)); /* Drop PROT_READ protection. Kernel and userspace should fault when accessing that memory region */ mprotect(p_aligned, page_size, PROT_NONE);
/* the following write() should return EFAULT, since PROT_READ was dropped by previous mprotect() */ int ret = write(2, p_aligned, 1);
if (!ret || errno != EFAULT)
printf("\n FAILURE: write() did not returned expected EFAULT value\n"); return 0;
}
Because of the way _PAGE_READ is handled, kernel code never generates a read access fault when it access a page as the kernel privilege level is always less than PL1 in the PTE.
This patch reworks the comments in the make_insert_tlb macro to try to make this clearer.
--- arch/parisc/kernel/entry.S | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
arch/parisc/kernel/entry.S +12 -5
@@ -499,6 +499,12 @@ * this happens is quite subtle, read below */ .macro make_insert_tlb spc,pte,prot,tmp space_to_prot \spc \prot /* create prot id from space */ + +#if _PAGE_SPECIAL_BIT == _PAGE_DMB_BIT + /* need to drop DMB bit, as it's used as SPECIAL flag */ + depi 0,_PAGE_SPECIAL_BIT,1,\pte +#endif + /* The following is the real subtlety. This is depositing * T <-> _PAGE_REFTRAP * D <-> _PAGE_DIRTY
@@ -511,17 +517,18 @@ * Finally, _PAGE_READ goes in the top bit of PL1 (so we * trigger an access rights trap in user space if the user * tries to read an unreadable page */ -#if _PAGE_SPECIAL_BIT == _PAGE_DMB_BIT - /* need to drop DMB bit, as it's used as SPECIAL flag */ - depi 0,_PAGE_SPECIAL_BIT,1,\pte -#endif depd \pte,8,7,\prot /* PAGE_USER indicates the page can be read with user privileges, * so deposit X1|11 to PL1|PL2 (remember the upper bit of PL1 - * contains _PAGE_READ) */ + * contains _PAGE_READ). While the kernel can't directly write + * user pages which have _PAGE_WRITE zero, it can read pages + * which have _PAGE_READ zero (PL <= PL1). Thus, the kernel + * exception fault handler doesn't trigger when reading pages + * that aren't user read accessible */ extrd,u,*= \pte,_PAGE_USER_BIT+32,1,%r0 depdi 7,11,3,\prot + /* If we're a gateway page, drop PL2 back to zero for promotion * to kernel privilege (so we can execute the page as kernel). * Any privilege promotion page always denys read and write */
Greg Kroah-Hartman
maintainerPATCH 130/457 media: gspca: Add bounds checking to firmware parser
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit aef89c0b2417da79cb2062a95476288f9f203ab0 upstream.
This sd_init() function reads the firmware. The firmware data holds a series of records and the function reads each record and sends the data to the device. The request_ihex_firmware() function
calls ihex_validate_fw() which ensures that the total length of all the records won't read out of bounds of the fw->data[].
However, a potential issue is if there is a single very large record (larger than PAGE_SIZE) and that would result in memory corruption. Generally we trust the firmware, but it's always better to double check.
--- drivers/media/usb/gspca/vicam.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/media/usb/gspca/vicam.c +8 -2
@@ -227,6 +227,7 @@ static int sd_init(struct gspca_dev *gspconst struct ihex_binrec *rec;const struct firmware *fw;u8 *firmware_buf; +int len; ret =request_ihex_firmware (&fw,VICAM_FIRMWARE , &gspca_dev->dev->dev);
@@ -241,9 +242,14 @@ static int sd_init(struct gspca_dev *gsp goto exit; }for (rec = (void *)fw->data; rec; rec =ihex_next_binrec (rec)) { -memcpy (firmware_buf, rec->data,be16_to_cpu (rec->len)); + len =be16_to_cpu (rec->len); +if (len >PAGE_SIZE ) { + ret = -EINVAL ; +break ; + } +memcpy (firmware_buf, rec->data, len); ret =vicam_control_msg (gspca_dev,0xff ,0 ,0 , firmware_buf, -be16_to_cpu (rec->len)); + len);if (ret <0 )break ; }
Greg Kroah-Hartman
maintainerPATCH 131/457 media: hi556: correct the test pattern configuration
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bingbu Cao <[email protected]>
commit 020f602b068c9ce18d5056d02c8302199377d98d upstream.
Hynix hi556 support 8 test pattern modes:
hi556_test_pattern_menu[] = {
{
"Disabled",
"Solid Colour",
"100% Colour Bars",
"Fade To Grey Colour Bars",
"PN9",
"Gradient Horizontal",
"Gradient Vertical",
"Check Board",
"Slant Pattern",
}The test pattern is set by a 8-bit register according to the specification.
+--------+-------------------------------+ | BIT[0] | Solid color | +--------+-------------------------------+ | BIT[1] | Color bar | +--------+-------------------------------+ | BIT[2] | Fade to grey color bar | +--------+-------------------------------+ | BIT[3] | PN9 | +--------+-------------------------------+ | BIT[4] | Gradient horizontal | +--------+-------------------------------+ | BIT[5] | Gradient vertical | +--------+-------------------------------+ | BIT[6] | Check board | +--------+-------------------------------+ | BIT[7] | Slant pattern | +--------+-------------------------------+
Based on function above, current test pattern programming is wrong. This patch fixes it by 'BIT(pattern - 1)'. If pattern is 0, driver will disable the test pattern generation and set the pattern to 0.
--- drivers/media/i2c/hi556.c | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-)
drivers/media/i2c/hi556.c +15 -13
@@ -756,21 +756,23 @@ static int hi556_test_pattern(struct hi5int ret;u32 val; -if (pattern) { - ret =hi556_read_reg (hi556,HI556_REG_ISP , -HI556_REG_VALUE_08BIT , &val); -if (ret) -return ret; - - ret =hi556_write_reg (hi556,HI556_REG_ISP , -HI556_REG_VALUE_08BIT , - val |HI556_REG_ISP_TPG_EN ); -if (ret) -return ret; - } + ret =hi556_read_reg (hi556,HI556_REG_ISP , +HI556_REG_VALUE_08BIT , &val); +if (ret) +return ret; + + val = pattern ? (val |HI556_REG_ISP_TPG_EN ) : + (val & ~HI556_REG_ISP_TPG_EN ); + + ret =hi556_write_reg (hi556,HI556_REG_ISP , +HI556_REG_VALUE_08BIT , val); +if (ret) +return ret; + + val = pattern ?BIT (pattern -1 ) :0 ;return hi556_write_reg (hi556,HI556_REG_TEST_PATTERN , -HI556_REG_VALUE_08BIT , pattern); +HI556_REG_VALUE_08BIT , val); }static int hi556_set_ctrl (struct v4l2_ctrl *ctrl)
Greg Kroah-Hartman
maintainerPATCH 132/457 media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit fc5f8aec77704373ee804b5dba0e0e5029c0f180 upstream.
Add video_device_release() in label 'err_m2m' to release the memory allocated by video_device_alloc() and prevent potential memory leaks. Remove the reduntant code in label 'err_m2m'.
--- drivers/staging/media/imx/imx-media-csc-scaler.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/media/imx/imx-media-csc-scaler.c +1 -1
@@ -912,7 +912,7 @@ imx_media_csc_scaler_device_init(structreturn &priv->vdev; err_m2m: -video_set_drvdata (vfd,NULL ); +video_device_release (vfd); err_vfd:kfree (priv);return ERR_PTR (ret);
Greg Kroah-Hartman
maintainerPATCH 133/457 media: ipu6: isys: Use correct pads for xlate_streams()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
commit ff49672a28f3a856717f09d61380e524e243121f upstream.
The pad argument to v4l2_subdev_state_xlate_streams() is incorrect, static pad number is used for the source pad even though the pad number is dependent on the stream. Fix it.
--- drivers/media/pci/intel/ipu6/ipu6-isys-csi2.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/media/pci/intel/ipu6/ipu6-isys-csi2.c +6 -6
@@ -354,9 +354,9 @@ static int ipu6_isys_csi2_enable_streams remote_pad =media_pad_remote_pad_first (&sd->entity.pads[CSI2_PAD_SINK ]); remote_sd =media_entity_to_v4l2_subdev (remote_pad->entity); - sink_streams =v4l2_subdev_state_xlate_streams (state,CSI2_PAD_SRC , -CSI2_PAD_SINK , - &streams_mask); + sink_streams = +v4l2_subdev_state_xlate_streams (state, pad,CSI2_PAD_SINK , + &streams_mask); ret =ipu6_isys_csi2_calc_timing (csi2, &timing,CSI2_ACCINV );if (ret)
@@ -384,9 +384,9 @@ static int ipu6_isys_csi2_disable_streamstruct media_pad *remote_pad;u64 sink_streams; - sink_streams =v4l2_subdev_state_xlate_streams (state,CSI2_PAD_SRC , -CSI2_PAD_SINK , - &streams_mask); + sink_streams = +v4l2_subdev_state_xlate_streams (state, pad,CSI2_PAD_SINK , + &streams_mask); remote_pad =media_pad_remote_pad_first (&sd->entity.pads[CSI2_PAD_SINK ]); remote_sd =media_entity_to_v4l2_subdev (remote_pad->entity);
Greg Kroah-Hartman
maintainerPATCH 134/457 media: vivid: fix wrong pixel_array control size
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
commit 3e43442d4994c9e1e202c98129a87e330f7faaed upstream.
The pixel_array control size was calculated incorrectly:
the dimensions were swapped (dims[0] should be the height), and the values should be the width or height divided by PIXEL_ARRAY_DIV and rounded up. So don't use roundup, but use DIV_ROUND_UP instead.
This bug is harmless in the sense that nothing will break, except that it consumes way too much memory for this control.
--- drivers/media/test-drivers/vivid/vivid-ctrls.c | 3 ++- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-)
drivers/media/test-drivers/vivid/vivid-ctrls.c +2 -1
@@ -244,7 +244,8 @@ static const struct v4l2_ctrl_config viv .min = 0x00, .max = 0xff, .step = 1, - .dims = { 640 / PIXEL_ARRAY_DIV, 360 / PIXEL_ARRAY_DIV }, + .dims = { DIV_ROUND_UP(360, PIXEL_ARRAY_DIV), + DIV_ROUND_UP(640, PIXEL_ARRAY_DIV) }, }; static const struct v4l2_ctrl_config vivid_ctrl_s32_array = {
drivers/media/test-drivers/vivid/vivid-vid-cap.c +2 -2
@@ -454,8 +454,8 @@ void vivid_update_format_cap(struct viviif (keep_controls)return ; - dims[0 ] =roundup (dev->src_rect.width,PIXEL_ARRAY_DIV ); - dims[1 ] =roundup (dev->src_rect.height,PIXEL_ARRAY_DIV ); + dims[0 ] =DIV_ROUND_UP (dev->src_rect.height,PIXEL_ARRAY_DIV ); + dims[1 ] =DIV_ROUND_UP (dev->src_rect.width,PIXEL_ARRAY_DIV );v4l2_ctrl_modify_dimensions (dev->pixel_array, dims); }
Greg Kroah-Hartman
maintainerPATCH 135/457 media: verisilicon: Fix AV1 decoder clock frequency
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Dufresne <[email protected]>
commit 01350185fe02ae3ea2c12d578e06af0d5186f33e upstream.
The desired clock frequency was correctly set to 400MHz in the device tree but was lowered by the driver to 300MHz breaking 4K 60Hz content playback. Fix the issue by removing the driver call to clk_set_rate(), which reduce the amount of board specific code.
--- drivers/media/platform/verisilicon/rockchip_vpu_hw.c | 9 --------- 1 file changed, 9 deletions(-)
drivers/media/platform/verisilicon/rockchip_vpu_hw.c +0 -9
@@ -17,7 +17,6 @@#define RK3066_ACLK_MAX_FREQ (300 * 1000 * 1000)#define RK3288_ACLK_MAX_FREQ (400 * 1000 * 1000) -#define RK3588_ACLK_MAX_FREQ (300 * 1000 * 1000)#define ROCKCHIP_VPU981_MIN_SIZE 64
@@ -454,13 +453,6 @@ static int rk3066_vpu_hw_init(struct hanreturn 0 ; } -static int rk3588_vpu981_hw_init (struct hantro_dev *vpu) -{ -/* Bump ACLKs to max. possible freq. to improve performance. */ -clk_set_rate (vpu->clocks[0 ].clk,RK3588_ACLK_MAX_FREQ ); -return 0 ; -} -static int rockchip_vpu_hw_init (struct hantro_dev *vpu) {/* Bump ACLK to max. possible freq. to improve performance. */
@@ -821,7 +813,6 @@ const struct hantro_variant rk3588_vpu98 .codec_ops = rk3588_vpu981_codec_ops, .irqs = rk3588_vpu981_irqs, .num_irqs = ARRAY_SIZE(rk3588_vpu981_irqs), - .init = rk3588_vpu981_hw_init, .clk_names = rk3588_vpu981_vpu_clk_names, .num_clocks = ARRAY_SIZE(rk3588_vpu981_vpu_clk_names) };
Greg Kroah-Hartman
maintainerPATCH 136/457 media: v4l2-ctrls: Dont reset handlers error in v4l2_ctrl_handler_free()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
commit 5a0400aca5fa7c6b8ba456c311a460e733571c88 upstream.
It's a common pattern in drivers to free the control handler's resources and then return the handler's error code on drivers' error handling paths. Alas, the v4l2_ctrl_handler_free() function also zeroes the error field, effectively indicating successful return to the caller.
There's no apparent need to touch the error field while releasing the control handler's resources and cleaning up stale pointers. Not touching the handler's error field is a more certain way to address this problem than changing all the users, in which case the pattern would be likely to re-emerge in new drivers.
Do just that, don't touch the control handler's error field in v4l2_ctrl_handler_free().
--- drivers/media/v4l2-core/v4l2-ctrls-core.c | 1 - 1 file changed, 1 deletion(-)
drivers/media/v4l2-core/v4l2-ctrls-core.c +0 -1
@@ -1661,7 +1661,6 @@ void v4l2_ctrl_handler_free(struct v4l2_kvfree (hdl->buckets); hdl->buckets =NULL ; hdl->cached =NULL ; - hdl->error =0 ;mutex_unlock (hdl->lock);mutex_destroy (&hdl->_lock); }
Greg Kroah-Hartman
maintainerPATCH 137/457 media: usbtv: Lock resolution while streaming
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ludwig Disterhof <[email protected]>
commit 7e40e0bb778907b2441bff68d73c3eb6b6cd319f upstream.
When an program is streaming (ffplay) and another program (qv4l2) changes the TV standard from NTSC to PAL, the kernel crashes due to trying to copy to unmapped memory.
Changing from NTSC to PAL increases the resolution in the usbtv struct, but the video plane buffer isn't adjusted, so it overflows.
--- drivers/media/usb/usbtv/usbtv-video.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/media/usb/usbtv/usbtv-video.c +4 -0
@@ -73,6 +73,10 @@ static int usbtv_configure_for_norm(stru }if (params) { +if (vb2_is_busy (&usbtv->vb2q) && + (usbtv->width != params->cap_width || + usbtv->height != params->cap_height)) +return -EBUSY ; usbtv->width = params->cap_width; usbtv->height = params->cap_height; usbtv->n_chunks = usbtv->width * usbtv->height
Greg Kroah-Hartman
maintainerPATCH 138/457 media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <[email protected]>
commit 7af160aea26c7dc9e6734d19306128cce156ec40 upstream.
In the interrupt handler rain_interrupt(), the buffer full check on rain->buf_len is performed before acquiring rain->buf_lock. This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as rain->buf_len is concurrently accessed and modified in the work handler rain_irq_work_handler() under the same lock.
Multiple interrupt invocations can race, with each reading buf_len before it becomes full and then proceeding. This can lead to both interrupts attempting to write to the buffer, incrementing buf_len beyond its capacity (DATA_SIZE) and causing a buffer overflow.
Fix this bug by moving the spin_lock() to before the buffer full check. This ensures that the check and the subsequent buffer modification are performed atomically, preventing the race condition. An corresponding spin_unlock() is added to the overflow path to correctly release the lock.
This possible bug was found by an experimental static analysis tool developed by our team.
--- drivers/media/cec/usb/rainshadow/rainshadow-cec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/media/cec/usb/rainshadow/rainshadow-cec.c +2 -1
@@ -171,11 +171,12 @@ static irqreturn_t rain_interrupt(struct {struct rain *rain =serio_get_drvdata (serio); +spin_lock (&rain->buf_lock);if (rain->buf_len ==DATA_SIZE ) { +spin_unlock (&rain->buf_lock);dev_warn_once (rain->dev,"buffer overflow\n" );return IRQ_HANDLED ; } -spin_lock (&rain->buf_lock); rain->buf_len++; rain->buf[rain->buf_wr_idx] = data; rain->buf_wr_idx = (rain->buf_wr_idx +1 ) &0xff ;
Greg Kroah-Hartman
maintainerPATCH 139/457 media: pisp_be: Fix pm_runtime underrun in probe
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacopo Mondi <[email protected]>
commit e9bb2eacc7222ff8210903eb3b7d56709cc53228 upstream.
During the probe() routine, the PiSP BE driver needs to power up the interface in order to identify and initialize the hardware.
The driver resumes the interface by calling the pispbe_runtime_resume() function directly, without going through the pm_runtime helpers, but later suspends it by calling pm_runtime_put_autosuspend().
This causes a PM usage count imbalance at probe time, notified by the runtime_pm framework with the below message in the system log:
pispbe 1000880000.pisp_be: Runtime PM usage count underflow!
Fix this by resuming the interface using the pm runtime helpers instead of calling the resume function directly and use the pm_runtime framework in the probe() error path. While at it, remove manual suspend of the interface in the remove() function. The driver cannot be unloaded if in use, so simply disable runtime pm.
To simplify the implementation, make the driver depend on PM as the RPI5 platform where the ISP is integrated in uses the PM framework by default.
--- drivers/media/platform/raspberrypi/pisp_be/Kconfig | 1 + drivers/media/platform/raspberrypi/pisp_be/pisp_be.c | 5 ++--- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/media/platform/raspberrypi/pisp_be/Kconfig +1 -0
@@ -3,6 +3,7 @@ config VIDEO_RASPBERRYPI_PISP_BE depends on V4L_PLATFORM_DRIVERS depends on VIDEO_DEV depends on ARCH_BCM2835 || COMPILE_TEST + depends on PM select VIDEO_V4L2_SUBDEV_API select MEDIA_CONTROLLER select VIDEOBUF2_DMA_CONTIG
drivers/media/platform/raspberrypi/pisp_be/pisp_be.c +2 -3
@@ -1726,7 +1726,7 @@ static int pispbe_probe(struct platform_pm_runtime_use_autosuspend (pispbe->dev);pm_runtime_enable (pispbe->dev); - ret =pispbe_runtime_resume (pispbe->dev); + ret =pm_runtime_resume_and_get (pispbe->dev);if (ret) goto pm_runtime_disable_err;
@@ -1748,7 +1748,7 @@ static int pispbe_probe(struct platform_ disable_devs_err:pispbe_destroy_devices (pispbe); pm_runtime_suspend_err: -pispbe_runtime_suspend (pispbe->dev); +pm_runtime_put (pispbe->dev); pm_runtime_disable_err:pm_runtime_dont_use_autosuspend (pispbe->dev);pm_runtime_disable (pispbe->dev);
@@ -1762,7 +1762,6 @@ static void pispbe_remove(struct platforpispbe_destroy_devices (pispbe); -pispbe_runtime_suspend (pispbe->dev);pm_runtime_dont_use_autosuspend (pispbe->dev);pm_runtime_disable (pispbe->dev); }
Greg Kroah-Hartman
maintainerPATCH 140/457 media: ov2659: Fix memory leaks in ov2659_probe()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Shurong <[email protected]>
commit 76142b137b968d47b35cdd8d1dc924677d319c8b upstream.
ov2659_probe() doesn't properly free control handler resources in failure paths, causing memory leaks. Add v4l2_ctrl_handler_free() to prevent these memory leaks and reorder the ctrl_handler assignment for better code flow.
--- drivers/media/i2c/ov2659.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/media/i2c/ov2659.c +2 -1
@@ -1469,14 +1469,15 @@ static int ov2659_probe(struct i2c_clienV4L2_CID_TEST_PATTERN ,ARRAY_SIZE (ov2659_test_pattern_menu) -1 , 0, 0, ov2659_test_pattern_menu); - ov2659->sd.ctrl_handler = &ov2659->ctrls;if (ov2659->ctrls.error) {dev_err (&client->dev,"%s: control initialization error %d\n" , __func__, ov2659->ctrls.error); +v4l2_ctrl_handler_free (&ov2659->ctrls);return ov2659->ctrls.error; } + ov2659->sd.ctrl_handler = &ov2659->ctrls; sd = &ov2659->sd; client->flags |=I2C_CLIENT_SCCB ;
Greg Kroah-Hartman
maintainerPATCH 141/457 media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathis Foerst <[email protected]>
commit 298d1471cf83d5a2a05970e41822a2403f451086 upstream.
Getting / Setting the frame interval using the V4L2 subdev pad ops get_frame_interval/set_frame_interval causes a deadlock, as the subdev state is locked in the [1] but also in the driver itself.
In [2] it's described that the caller is responsible to acquire and release the lock in this case. Therefore, acquiring the lock in the driver is wrong.
Remove the lock acquisitions/releases from mt9m114_ifp_get_frame_interval() and mt9m114_ifp_set_frame_interval().
[1] drivers/media/v4l2-core/v4l2-subdev.c - line 1129
[2] Documentation/driver-api/media/v4l2-subdev.rst
--- drivers/media/i2c/mt9m114.c | 8 -------- 1 file changed, 8 deletions(-)
drivers/media/i2c/mt9m114.c +0 -8
@@ -1599,13 +1599,9 @@ static int mt9m114_ifp_get_frame_intervaif (interval->which !=V4L2_SUBDEV_FORMAT_ACTIVE )return -EINVAL ; -mutex_lock (sensor->ifp.hdl.lock); - ival->numerator =1 ; ival->denominator = sensor->ifp.frame_rate; -mutex_unlock (sensor->ifp.hdl.lock); -return 0 ; }
@@ -1624,8 +1620,6 @@ static int mt9m114_ifp_set_frame_intervaif (interval->which !=V4L2_SUBDEV_FORMAT_ACTIVE )return -EINVAL ; -mutex_lock (sensor->ifp.hdl.lock); -if (ival->numerator !=0 && ival->denominator !=0 ) sensor->ifp.frame_rate = min_t(unsigned int, ival->denominator / ival->numerator,
@@ -1639,8 +1633,6 @@ static int mt9m114_ifp_set_frame_intervaif (sensor->streaming) ret =mt9m114_set_frame_rate (sensor); -mutex_unlock (sensor->ifp.hdl.lock); -return ret; }
Greg Kroah-Hartman
maintainerPATCH 142/457 media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 0c92c49fc688cfadacc47ae99b06a31237702e9e upstream.
Both the ACE and CSI driver are missing a mei_cldev_disable() call in their remove() function.
This causes the mei_cl client to stay part of the mei_device->file_list list even though its memory is freed by mei_cl_bus_dev_release() calling kfree(cldev->cl).
This leads to a use-after-free when mei_vsc_remove() runs mei_stop() which first removes all mei bus devices calling mei_ace_remove() and mei_csi_remove() followed by mei_cl_bus_dev_release() and then calls mei_cl_all_disconnect() which walks over mei_device->file_list dereferecing the just freed cldev->cl.
And mei_vsc_remove() it self is run at shutdown because of the platform_device_unregister(tp->pdev) in vsc_tp_shutdown()
When building a kernel with KASAN this leads to the following KASAN report:
[ 106.634504] ================================================================== [ 106.634623] BUG: KASAN: slab-use-after-free in mei_cl_set_disconnected (drivers/misc/mei/client.c:783) mei [ 106.634683] Read of size 4 at addr ffff88819cb62018 by task systemd-shutdow/1 [ 106.634729] [ 106.634767] Tainted: [E]=UNSIGNED_MODULE [ 106.634770] Hardware name: Dell Inc. XPS 16 9640/09CK4V, BIOS 1.12.0 02/10/2025 [ 106.634773] Call Trace: [ 106.634777] <TASK> ... [ 106.634871] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:636) [ 106.634901] mei_cl_set_disconnected (drivers/misc/mei/client.c:783) mei [ 106.634921] mei_cl_all_disconnect (drivers/misc/mei/client.c:2165 (discriminator 4)) mei [ 106.634941] mei_reset (drivers/misc/mei/init.c:163) mei ... [ 106.635042] mei_stop (drivers/misc/mei/init.c:348) mei [ 106.635062] mei_vsc_remove (drivers/misc/mei/mei_dev.h:784 drivers/misc/mei/platform-vsc.c:393) mei_vsc [ 106.635066] platform_remove (drivers/base/platform.c:1424)
Add the missing mei_cldev_disable() calls so that the mei_cl gets removed from mei_device->file_list before it is freed to fix this.
--- drivers/media/pci/intel/ivsc/mei_ace.c | 2 ++ drivers/media/pci/intel/ivsc/mei_csi.c | 2 ++ 2 files changed, 4 insertions(+)
drivers/media/pci/intel/ivsc/mei_ace.c +2 -0
@@ -529,6 +529,8 @@ static void mei_ace_remove(struct mei_clace_set_camera_owner (ace,ACE_CAMERA_IVSC ); +mei_cldev_disable (cldev); +mutex_destroy (&ace->lock); }
drivers/media/pci/intel/ivsc/mei_csi.c +2 -0
@@ -760,6 +760,8 @@ static void mei_csi_remove(struct mei_clpm_runtime_disable (&cldev->dev); +mei_cldev_disable (cldev); +mutex_destroy (&csi->lock); }
Greg Kroah-Hartman
maintainerPATCH 143/457 media: qcom: camss: csiphy-3ph: Fix inadvertent dropping of SDM660/SDM670 phy init
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryan O'Donoghue <[email protected]>
commit 868423c834a29981fe3a77d32caf645c6b91a4c5 upstream.
The moving of init sequence hook from gen2() to subdev_init() doesn't account for gen1 devices such as SDM660 and SDM670. The switch should find the right offset for gen2 PHYs only, not reject gen1. Remove the default error case to restore gen1 CSIPHY support.
--- drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c +1 -2
@@ -849,8 +849,7 @@ static int csiphy_init(struct csiphy_device *csiphy) regs->offset =0x1000 ;break ;default : -WARN (1 ,"unknown csiphy version\n" ); -return -ENODEV ; +break ; }return 0 ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 144/457 media: qcom: camss: cleanup media device allocated resource on error path
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
commit 69080ec3d0daba8a894025476c98ab16b5a505a4 upstream.
A call to media_device_init() requires media_device_cleanup() counterpart to complete cleanup and release any allocated resources.
This has been done in the driver .remove() right from the beginning, but error paths on .probe() shall also be fixed.
--- drivers/media/platform/qcom/camss/camss.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/platform/qcom/camss/camss.c +3 -1
@@ -3625,7 +3625,7 @@ static int camss_probe(struct platform_d ret =v4l2_device_register (camss->dev, &camss->v4l2_dev);if (ret <0 ) {dev_err (dev,"Failed to register V4L2 device: %d\n" , ret); - goto err_genpd_cleanup; + goto err_media_device_cleanup; }v4l2_async_nf_init (&camss->notifier, &camss->v4l2_dev);
@@ -3680,6 +3680,8 @@ err_v4l2_device_unregister:v4l2_device_unregister (&camss->v4l2_dev);v4l2_async_nf_cleanup (&camss->notifier);pm_runtime_disable (dev); +err_media_device_cleanup: +media_device_cleanup (&camss->media_dev); err_genpd_cleanup:camss_genpd_cleanup (camss);