6.6.117-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 6.6.117-rc1 review
This is the start of the stable review cycle for the 6.6.117 release. There are 529 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 23 Nov 2025 13:01:08 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.117-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.117-rc1
Breno Leitao <[email protected]>
memcg: fix data-race KCSAN bug in rstats
Dave Jiang <[email protected]>
ACPI: HMAT: Remove register of memory node for generic target
Yosry Ahmed <[email protected]>
mm: memcg: optimize parent iteration in memcg_rstat_updated()
Li Zhijian <[email protected]>
mm/memory-tier: fix abstract distance calculation overflow
Ying Huang <[email protected]>
memory tiers: use default_dram_perf_ref_source in log message
Nhat Pham <[email protected]>
cachestat: do not flush stats in recency check
John Sperbeck <[email protected]>
net: netpoll: ensure skb_pool list is always initialized
Abdun Nihaal <[email protected]>
isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
Lance Yang <[email protected]>
mm/secretmem: fix use-after-free race in fault handler
Kiryl Shutsemau <[email protected]>
mm/truncate: unmap large folio on split failure
Kiryl Shutsemau <[email protected]>
mm/memory: do not populate page table entries beyond i_size
Pankaj Raghav <[email protected]>
filemap: cap PTE range to be created to allowed zero fill in folio_map_range()
Yosry Ahmed <[email protected]>
mm: memcg: restore subtree stats flushing
Yosry Ahmed <[email protected]>
mm: workingset: move the stats flush into workingset_test_recent()
Yosry Ahmed <[email protected]>
mm: memcg: make stats flushing threshold per-memcg
Yosry Ahmed <[email protected]>
mm: memcg: move vmstats structs definition above flushing code
Yosry Ahmed <[email protected]>
mm: memcg: change flush_next_time to flush_last_time
Domenico Cerasuolo <[email protected]>
mm: memcg: add per-memcg zswap writeback stat
Xin Hao <[email protected]>
mm: memcg: add THP swap out info for anonymous reclaim
Adrian Hunter <[email protected]>
scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL
Adrian Hunter <[email protected]>
scsi: ufs: core: Add a quirk to suppress link_startup_again
Manivannan Sadhasivam <[email protected]>
scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register
Eric Biggers <[email protected]>
scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT
Eric Biggers <[email protected]>
scsi: ufs: core: Add fill_crypto_prdt variant op
Eric Biggers <[email protected]>
scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE
Eric Biggers <[email protected]>
scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller
Eric Biggers <[email protected]>
scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE
Qingfang Deng <[email protected]>
net: stmmac: Fix accessing freed irq affinity_hint
Chao Yu <[email protected]>
f2fs: fix to avoid overflow while left shift operation
Breno Leitao <[email protected]>
net: netpoll: fix incorrect refcount handling causing incorrect cleanup
Breno Leitao <[email protected]>
net: netpoll: flush skb pool during cleanup
Breno Leitao <[email protected]>
net: netpoll: Individualize the skb pool
Eric Dumazet <[email protected]>
netpoll: remove netpoll_srcu
Michal Hocko <[email protected]>
mm, percpu: do not consider sleepable allocations atomic
Jason Gunthorpe <[email protected]>
iommufd: Don't overflow during division for dirty tracking
Qu Wenruo <[email protected]>
btrfs: ensure no dirty metadata is written back for an fs with errors
Ariel D'Alessandro <[email protected]>
drm/mediatek: Disable AFBC support on Mediatek DRM driver
jingxian.li <[email protected]>
Revert "perf dso: Add missed dso__put to dso__load_kcore"
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: connect: trunc: read all recv data
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: rm: set backup flag
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: connect: fix fallback note due to OoO
André Draszik <[email protected]>
pmdomain: samsung: plug potential memleak during probe
Filipe Manana <[email protected]>
btrfs: do not update last_log_commit when logging inode due to a new name
Zilin Guan <[email protected]>
btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe()
Niravkumar L Rabara <[email protected]>
EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
Niravkumar L Rabara <[email protected]>
EDAC/altera: Handle OCRAM ECC enable after warm reset
Huacai Chen <[email protected]>
LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY
Ankit Khushwaha <[email protected]>
selftests/user_events: fix type cast for write_index packed member in perf_test
Borislav Petkov (AMD) <[email protected]>
x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev
Hans de Goede <[email protected]>
spi: Try to get ACPI GPIO IRQ earlier
Henrique Carvalho <[email protected]>
smb: client: fix cifs_pick_channel when channel needs reconnect
Miaoqian Lin <[email protected]>
crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value
Edward Adam Davis <[email protected]>
cifs: client: fix memory leak in smb3_fs_context_parse_param
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
Shawn Lin <[email protected]>
mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4
Isaac J. Manjarres <[email protected]>
mm/mm_init: fix hash table order logging in alloc_large_system_hash()
Wei Yang <[email protected]>
fs/proc: fix uaf in proc_readdir_de()
Johannes Berg <[email protected]>
wifi: mac80211: reject address change while connecting
Steven Rostedt <[email protected]>
selftests/tracing: Run sample events to clear page cache events
Chuang Wang <[email protected]>
ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
Tianyang Zhang <[email protected]>
LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY
Huacai Chen <[email protected]>
LoongArch: Use correct accessor to read FWPC/MWPC
Qinxin Xia <[email protected]>
dma-mapping: benchmark: Restore padding to ensure uABI remained consistent
Nate Karstens <[email protected]>
strparser: Fix signed/unsigned mismatch bug
Joshua Rogers <[email protected]>
ksmbd: close accepted socket when per-IP limit rejects connection
Peter Oberparleiter <[email protected]>
gcov: add support for GCC 15
Olga Kornievskaia <[email protected]>
NFSD: free copynotify stateid in nfs4_free_ol_stateid()
Yosry Ahmed <[email protected]>
KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated
Abdun Nihaal <[email protected]>
HID: uclogic: Fix potential memory leak in error path
Rafał Miłecki <[email protected]>
ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY
Masami Ichikawa <[email protected]>
HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
Jihed Chaibi <[email protected]>
ARM: dts: imx51-zii-rdu1: Fix audmux node names
Anand Moon <[email protected]>
arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject duplicate device on updates
Dan Carpenter <[email protected]>
mtd: onenand: Pass correct pointer to IRQ handler
Arseniy Krasnov <[email protected]>
Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
Eric Biggers <[email protected]>
lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN
Sabrina Dubroca <[email protected]>
espintcp: fix skb leaks
Vladimir Oltean <[email protected]>
net: dsa: improve shutdown sequence
Paolo Abeni <[email protected]>
net: allow small head cache usage with large MAX_SKB_FRAGS values
Wang Liang <[email protected]>
net: fix NULL pointer dereference in l3mdev_l3_rcv
Nick Hu <[email protected]>
irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops
Eduard Zingerman <[email protected]>
bpf: account for current allocated stack depth in widen_imprecise_scalars()
Eric Dumazet <[email protected]>
bpf: Add bpf_prog_run_data_pointers()
Dave Jiang <[email protected]>
acpi/hmat: Fix lockdep warning for hmem_register_resource()
Dave Jiang <[email protected]>
base/node / ACPI: Enumerate node access class for 'struct access_coordinate'
Dave Jiang <[email protected]>
acpi: numa: Add setting of generic port system locality attributes
Dave Jiang <[email protected]>
acpi: Break out nesting for hmat_parse_locality()
Dave Jiang <[email protected]>
acpi: numa: Add genport target allocation to the HMAT parsing
Dave Jiang <[email protected]>
acpi: numa: Create enum for memory_target access coordinates indexing
Dave Jiang <[email protected]>
base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates'
Huang Ying <[email protected]>
acpi, hmat: calculate abstract distance with HMAT
Huang Ying <[email protected]>
acpi, hmat: refactor hmat_register_target_initiators()
Huang Ying <[email protected]>
memory tiering: add abstract distance calculation algorithms management
Haein Lee <[email protected]>
ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
Trond Myklebust <[email protected]>
NFSv4: Fix an incorrect parameter when calling nfs4_call_sync()
Yang Xiuwei <[email protected]>
NFS: sysfs: fix leak when nfs_client kobject add fails
Trond Myklebust <[email protected]>
pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS
Trond Myklebust <[email protected]>
NFS: enable nconnect for RDMA
Trond Myklebust <[email protected]>
pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect()
Shenghao Ding <[email protected]>
ASoC: tas2781: fix getting the wrong device number
Ian Forbes <[email protected]>
drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
Haotian Zhang <[email protected]>
ASoC: codecs: va-macro: fix resource leak in probe error path
Haotian Zhang <[email protected]>
ASoC: cs4271: Fix regulator leak on probe failure
Haotian Zhang <[email protected]>
regulator: fixed: fix GPIO descriptor leak on register failure
Shuai Xue <[email protected]>
acpi,srat: Fix incorrect device handle check for Generic Initiator
David Howells <[email protected]>
cifs: Fix uncached read into ITER_KVEC iterator
Shyam Prasad N <[email protected]>
cifs: stop writeback extension when change of size is detected
Pauli Virtanen <[email protected]>
Bluetooth: L2CAP: export l2cap_chan_hold for modules
Gautham R. Shenoy <[email protected]>
ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs
Gautham R. Shenoy <[email protected]>
ACPI: CPPC: Perform fast check switch only for online CPUs
Gautham R. Shenoy <[email protected]>
ACPI: CPPC: Check _CPC validity for only the online CPUs
Felix Maurer <[email protected]>
hsr: Fix supervision frame sending on HSRv0
Xuan Zhuo <[email protected]>
virtio-net: fix incorrect flags recording in big mode
Eric Dumazet <[email protected]>
net_sched: limit try_bulk_dequeue_skb() batches
Gal Pressman <[email protected]>
net/mlx5e: Fix potentially misleading debug message
Gal Pressman <[email protected]>
net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
Gal Pressman <[email protected]>
net/mlx5e: Fix maxrate wraparound in threshold between units
Ranganath V N <[email protected]>
net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
Ranganath V N <[email protected]>
net: sched: act_connmark: initialize struct tc_ife to fix kernel leak
Eric Dumazet <[email protected]>
net_sched: act_connmark: use RCU in tcf_connmark_dump()
Kuniyuki Iwashima <[email protected]>
af_unix: Initialise scc_index in unix_add_edge().
Benjamin Berg <[email protected]>
wifi: mac80211: skip rate verification for not captured PSDUs
Buday Csaba <[email protected]>
net: mdio: fix resource leak in mdiobus_register_device()
Kuniyuki Iwashima <[email protected]>
tipc: Fix use-after-free in tipc_mon_reinit_self().
Zilin Guan <[email protected]>
net/handshake: Fix memory leak in tls_handshake_accept()
D. Wythe <[email protected]>
net/smc: fix mismatch between CLC header and proposal
Eric Dumazet <[email protected]>
sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
Raphael Pinsonneault-Thibeault <[email protected]>
Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
Pauli Virtanen <[email protected]>
Bluetooth: MGMT: cancel mesh send timer when hdev removed
Wei Fang <[email protected]>
net: fec: correct rx_bytes statistic for the case SHIFT16 is set
Alexander Sverdlin <[email protected]>
selftests: net: local_termination: Wait for interfaces to come up
Nicolas Escande <[email protected]>
wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp()
Sharique Mohammad <[email protected]>
ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
ZhangGuoDong <[email protected]>
smb/server: fix possible refcount leak in smb2_sess_setup()
ZhangGuoDong <[email protected]>
smb/server: fix possible memory leak in smb2_read()
Oleg Makarenko <[email protected]>
HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel
Scott Mayhew <[email protected]>
NFS: check if suid/sgid was cleared after a write as needed
Tristan Lobb <[email protected]>
HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
Joshua Watt <[email protected]>
NFS4: Fix state renewals missing after boot
Jesse.Zhang <[email protected]>
drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices
Timur Kristóf <[email protected]>
drm/amd/pm: Disable MCLK switching on SI at high pixel clocks
Han Gao <[email protected]>
riscv: acpi: avoid errors caused by probing DT devices when ACPI is used
Danil Skrebenkov <[email protected]>
RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors
Peter Zijlstra <[email protected]>
compiler_types: Move unused static inline functions warning to W=2
Mario Limonciello <[email protected]>
drm/amd: Fix suspend failure with secure display TA
Jason Gunthorpe <[email protected]>
iommufd: Make vfio_compat's unmap succeed if the range is already empty
Shuhao Fu <[email protected]>
smb: client: fix refcount leak in smb2_set_path_attr
Umesh Nerlige Ramappa <[email protected]>
drm/i915: Fix conversion between clock ticks and nanoseconds
Janusz Krzysztofik <[email protected]>
drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
Jakub Kicinski <[email protected]>
selftests: netdevsim: set test timeout to 10 minutes
Clément Léger <[email protected]>
riscv: stacktrace: fix backtracing through exceptions
Alex Hung <[email protected]>
drm/amd/display: Fix black screen with HDMI outputs
Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Fix function header names in amdgpu_connectors.c
Krzysztof Kozlowski <[email protected]>
extcon: adc-jack: Cleanup wakeup source only if it was enabled
Adrian Hunter <[email protected]>
scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers
Nathan Chancellor <[email protected]>
lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC
Bui Quang Minh <[email protected]>
virtio-net: fix received length check in big packets
Henrique Carvalho <[email protected]>
smb: client: fix potential UAF in smb2_close_cached_fid()
Joshua Rogers <[email protected]>
smb: client: validate change notify buffer before copy
Mario Limonciello (AMD) <[email protected]>
x86/microcode/AMD: Add more known models to entry sign checking
Yuta Hayama <[email protected]>
rtc: rx8025: fix incorrect register reference
Ilia Gavrilov <[email protected]>
Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()
Pierre-Eric Pelloux-Prayer <[email protected]>
drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb
Wayne Lin <[email protected]>
drm/amd/display: Enable mst when it's detected but yet to be initialized
Zilin Guan <[email protected]>
tracing: Fix memory leaks in create_field_var()
Nikolay Aleksandrov <[email protected]>
net: bridge: fix MST static key usage
Nikolay Aleksandrov <[email protected]>
net: bridge: fix use-after-free due to MST port state bypass
Horatiu Vultur <[email protected]>
lan966x: Fix sleeping in atomic context
Tristram Ha <[email protected]>
net: dsa: microchip: Fix reserved multicast address table programming
Dragos Tatulea <[email protected]>
net/mlx5e: SHAMPO, Fix skb size check for 64K pages
Gal Pressman <[email protected]>
net/mlx5e: Fix return value in case of module EEPROM read error
Gal Pressman <[email protected]>
net/mlx5e: Use extack in get module eeprom by page callback
Martin Willi <[email protected]>
wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup
Kalesh AP <[email protected]>
bnxt_en: Fix a possible memory leak in bnxt_ptp_init
Qendrim Maxhuni <[email protected]>
net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
Stefan Wiehler <[email protected]>
sctp: Hold sock lock while iterating over address list
Stefan Wiehler <[email protected]>
sctp: Prevent TOCTOU out-of-bounds write
Stefan Wiehler <[email protected]>
sctp: Hold RCU read lock while iterating over address list
Jonas Gorski <[email protected]>
net: dsa: b53: stop reading ARL entries if search is done
Jonas Gorski <[email protected]>
net: dsa: b53: fix enabling ip multicast
Jonas Gorski <[email protected]>
net: dsa: b53: fix resetting speed and pause on forced link
Hangbin Liu <[email protected]>
net: vlan: sync VLAN features with lower device
Wang Liang <[email protected]>
selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh
David Wei <[email protected]>
netdevsim: add Makefile for selftests
Anubhav Singh <[email protected]>
selftests/net: use destination options instead of hop-by-hop
Richard Gobert <[email protected]>
selftests/net: fix GRO coalesce test and add ext header coalesce tests
Anubhav Singh <[email protected]>
selftests/net: fix out-of-order delivery of FIN in gro:tcp test
Jonas Gorski <[email protected]>
net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx
Abdun Nihaal <[email protected]>
Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2()
Raphael Pinsonneault-Thibeault <[email protected]>
Bluetooth: hci_event: validate skb length for unknown CC opcode
Josephine Pfeiffer <[email protected]>
riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro
Chunyan Zhang <[email protected]>
riscv: stacktrace: Disable KASAN checks for non-current tasks
Anton Blanchard <[email protected]>
riscv: Improve exception and system call latency
Jiawen Wu <[email protected]>
net: libwx: fix device bus LAN ID
Baochen Qiang <[email protected]>
Revert "wifi: ath10k: avoid unnecessary wait for service ready message"
Ricardo Ribalda <[email protected]>
media: uvcvideo: Use heuristic to find stream entity
Kailang Yang <[email protected]>
ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again
Viacheslav Dubeyko <[email protected]>
ceph: refactor wake_up_bit() pattern of calling
Viacheslav Dubeyko <[email protected]>
ceph: add checking of wait_for_completion_killable() return value
Valerio Setti <[email protected]>
ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
Geert Uytterhoeven <[email protected]>
kbuild: uapi: Strip comments before size type check
Bruno Thomsen <[email protected]>
rtc: pcf2127: fix watchdog interrupt mask on pcf2131
Albin Babu Varghese <[email protected]>
fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
Sascha Hauer <[email protected]>
tools: lib: thermal: use pkg-config to locate libnl3
Emil Dahl Juhl <[email protected]>
tools: lib: thermal: don't preserve owner in install
Ian Rogers <[email protected]>
tools bitmap: Add missing asm-generic/bitsperlong.h include
Sakari Ailus <[email protected]>
ACPI: property: Return present device nodes only on fwnode interface
Hoyoung Seo <[email protected]>
scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS
Randall P. Embry <[email protected]>
9p: sysfs_init: don't hardcode error to ENOMEM
Aaron Kling <[email protected]>
cpufreq: tegra186: Initialize all cores to max frequencies
Randall P. Embry <[email protected]>
9p: fix /sys/fs/9p/caches overwriting itself
Jerome Brunet <[email protected]>
NTB: epf: Allow arbitrary BAR mapping
Matthias Schiffer <[email protected]>
clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled
Nicolas Ferre <[email protected]>
clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register
Ryan Wanner <[email protected]>
clk: at91: clk-master: Add check for divide by 3
Nicolas Ferre <[email protected]>
ARM: at91: pm: save and restore ACR during PLL disable/enable
Josua Mayer <[email protected]>
rtc: pcf2127: clear minute/second interrupt
Chen-Yu Tsai <[email protected]>
clk: sunxi-ng: sun6i-rtc: Add A523 specifics
Tiwei Bie <[email protected]>
um: Fix help message for ssl-non-raw
Yikang Yue <[email protected]>
fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
austinchang <[email protected]>
btrfs: mark dirty extent range for out of bound prealloc extents
Junxian Huang <[email protected]>
RDMA/hns: Fix wrong WQE data when QP wraps around
wenglianfa <[email protected]>
RDMA/hns: Fix the modification of max_send_sge
Jacob Moroni <[email protected]>
RDMA/irdma: Set irdma_cq cq_num field during CQ create
Jacob Moroni <[email protected]>
RDMA/irdma: Remove unused struct irdma_cq fields
Jacob Moroni <[email protected]>
RDMA/irdma: Fix SD index calculation
Saket Dumbre <[email protected]>
ACPICA: Update dsmethod.c to get rid of unused variable warning
Thadeu Lima de Souza Cascardo <[email protected]>
char: misc: restrict the dynamic range to exclude reserved minors
Coiby Xu <[email protected]>
ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
Fiona Ebner <[email protected]>
smb: client: transport: avoid reconnects triggered by pending task work
Namjae Jeon <[email protected]>
ksmbd: use sock_create_kern interface to create kernel socket
Vladimir Riabchun <[email protected]>
ftrace: Fix softlockup in ftrace_module_enable
Mike Marshall <[email protected]>
orangefs: fix xattr related buffer overflow...
Dragos Tatulea <[email protected]>
page_pool: Clamp pool size to max 16K pages
Qingfang Deng <[email protected]>
6pack: drop redundant locking and refcounting
Chi Zhiling <[email protected]>
exfat: limit log print for IO error
Roy Vegard Ovesen <[email protected]>
ALSA: usb-audio: add mono main switch to Presonus S1824c
Ivan Pravdin <[email protected]>
Bluetooth: bcsp: receive data only if registered
Luiz Augusto von Dentz <[email protected]>
Bluetooth: SCO: Fix UAF on sco_conn_free
Arkadiusz Bokowy <[email protected]>
Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames
Théo Lebrun <[email protected]>
net: macb: avoid dealing with endianness in macb_set_hwaddr()
Carolina Jubran <[email protected]>
net/mlx5e: Don't query FEC statistics when FEC is disabled
Primoz Fiser <[email protected]>
ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007
Olivier Moysan <[email protected]>
ASoC: stm32: sai: manage context in set_sysclk callback
Yifan Zhang <[email protected]>
amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw
Julian Sun <[email protected]>
ext4: increase IO priority of fastcommit
chuguangqing <[email protected]>
fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
Moti Haimovski <[email protected]>
accel/habanalabs: support mapping cb with vmalloc-backed coherent memory
Konstantin Sinyuk <[email protected]>
accel/habanalabs/gaudi2: read preboot status after recovering from dirty state
Tomer Tayar <[email protected]>
accel/habanalabs: return ENOMEM if less than requested pages were pinned
Ranjan Kumar <[email protected]>
scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate
Vered Yavniely <[email protected]>
accel/habanalabs/gaudi2: fix BMON disable configuration
Alok Tiwari <[email protected]>
scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()
Petr Machata <[email protected]>
net: bridge: Install FDB for bridge MAC on VLAN 0
Al Viro <[email protected]>
nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing
Anthony Iliopoulos <[email protected]>
NFSv4.1: fix mount hang after CREATE_SESSION failure
Olga Kornievskaia <[email protected]>
NFSv4: handle ERR_GRACE on delegation recalls
Karthi Kandasamy <[email protected]>
drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream
Nithyanantham Paramasivam <[email protected]>
wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256
Stephan Gerhold <[email protected]>
remoteproc: qcom: q6v5: Avoid handling handover twice
Mario Limonciello <[email protected]>
PCI/PM: Skip resuming to D0 if device is disconnected
Alex Mastro <[email protected]>
vfio: return -ENOTTY for unsupported device feature
Al Viro <[email protected]>
sparc64: fix prototypes of reads[bwl]()
Koakuma <[email protected]>
sparc/module: Add R_SPARC_UA64 relocation handling
Chen Wang <[email protected]>
PCI: cadence: Check for the existence of cdns_pcie::ops before using it
ChunHao Lin <[email protected]>
r8169: set EEE speed down ratio to 1
Brahmajit Das <[email protected]>
net: intel: fm10k: Fix parameter idx set but not used
Loic Poulain <[email protected]>
wifi: ath10k: Fix connection after GTK rekeying
Seyediman Seyedarab <[email protected]>
iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot()
Robert Marko <[email protected]>
net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X
Oleksij Rempel <[email protected]>
net: phy: clear link parameters on admin link down
Alexey Klimov <[email protected]>
ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup()
Shaurya Rane <[email protected]>
jfs: fix uninitialized waitqueue in transaction manager
Tetsuo Handa <[email protected]>
jfs: Verify inode mode when loading from disk
Tatyana Nikolova <[email protected]>
RDMA/irdma: Update Kconfig
Eric Dumazet <[email protected]>
ipv6: np->rxpmtu race annotation
wangzijie <[email protected]>
f2fs: fix infinite loop in __insert_extent_tree()
Krishna Kurapati <[email protected]>
usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
Forest Crossman <[email protected]>
usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
Al Viro <[email protected]>
allow finish_no_open(file, ERR_PTR(-E...))
Justin Tee <[email protected]>
scsi: lpfc: Define size of debugfs entry for xri rebalancing
Justin Tee <[email protected]>
scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup
Justin Tee <[email protected]>
scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET
Bart Van Assche <[email protected]>
scsi: ufs: core: Disable timestamp functionality if not supported
Nai-Chen Cheng <[email protected]>
selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
Christian König <[email protected]>
drm/amdgpu: reject gang submissions under SRIOV
Mario Limonciello (AMD) <[email protected]>
HID: i2c-hid: Resolve touchpad issues on Dell systems during S4
Stefan Wahren <[email protected]>
ethernet: Extend device_get_mac_address() to use NVMEM
Jakub Kicinski <[email protected]>
page_pool: always add GFP_NOWARN for ATOMIC allocations
Timur Kristóf <[email protected]>
drm/amd/display: Disable VRR on DCE 6
Timur Kristóf <[email protected]>
drm/amd/display: Fix DVI-D/HDMI adapters
Mario Limonciello (AMD) <[email protected]>
drm/amd: Avoid evicting resources at S5
Tvrtko Ursulin <[email protected]>
drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl
John Keeping <[email protected]>
ALSA: serial-generic: remove shared static buffer
Benjamin Lin <[email protected]>
wifi: mt76: mt7996: Temporarily disable EPCS
Quan Zhou <[email protected]>
wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device
Yafang Shao <[email protected]>
net/cls_cgroup: Fix task_get_classid() during qdisc run
Gaurav Jain <[email protected]>
crypto: caam - double the entropy delay interval for retry
Niklas Cassel <[email protected]>
PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify()
Ovidiu Panait <[email protected]>
crypto: sun8i-ce - remove channel timeout field
Sangwook Shin <[email protected]>
watchdog: s3c2410_wdt: Fix max_timeout being calculated larger
Antheas Kapenekakis <[email protected]>
HID: asus: add Z13 folio to generic group for multitouch to work
Alok Tiwari <[email protected]>
udp_tunnel: use netdev_warn() instead of netdev_WARN()
David Ahern <[email protected]>
selftests: Replace sleep with slowwait
Daniel Palmer <[email protected]>
eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP
David Ahern <[email protected]>
selftests: Disable dad for ipv6 in fcnal-test.sh
Li RongQing <[email protected]>
x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT
Florian Westphal <[email protected]>
netfilter: nf_reject: don't reply to icmp error messages
Ido Schimmel <[email protected]>
selftests: traceroute: Use require_command()
Qianfeng Rong <[email protected]>
media: redrat3: use int type to store negative error codes
Jakub Kicinski <[email protected]>
selftests: net: replace sleeps in fcnal-test with waits
Niklas Söderlund <[email protected]>
net: sh_eth: Disable WoL if system can not suspend
Michael Riesch <[email protected]>
phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0
Michael Dege <[email protected]>
phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet
Harikrishna Shenoy <[email protected]>
phy: cadence: cdns-dphy: Enable lower resolutions in dphy
Ilan Peer <[email protected]>
wifi: mac80211: Fix HE capabilities element check
Tetsuo Handa <[email protected]>
ntfs3: pretend $Extend records as regular files
Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes
Rohan G Thomas <[email protected]>
net: phy: marvell: Fix 88e1510 downshift counter errata
Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure
Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Enhance recovery on resume failure
Vladimir Zapolskiy <[email protected]>
media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer
Hao Yao <[email protected]>
media: ov08x40: Fix the horizontal flip control
Xion Wang <[email protected]>
char: Use list_del_init() in misc_deregister() to reinitialize list pointer
Antonino Maniscalco <[email protected]>
drm/msm: make sure to not queue up recovery more than once
Chen Yufeng <[email protected]>
usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget
William Wu <[email protected]>
usb: gadget: f_hid: Fix zero length packet transfer
Alex Deucher <[email protected]>
drm/amdgpu: add support for cyan skillfish gpu_info
Alex Deucher <[email protected]>
drm/amdgpu: don't enable SMU on cyan skillfish
Alex Deucher <[email protected]>
drm/amd: add more cyan skillfish PCI ids
Hector Martin <[email protected]>
iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs
Ashish Kalra <[email protected]>
iommu/amd: Skip enabling command/event buffers for kdump
Colin Foster <[email protected]>
smsc911x: add second read of EEPROM mac when possible corruption seen
Eric Dumazet <[email protected]>
net: call cond_resched() less often in __release_sock()
Cryolitia PukNgae <[email protected]>
ALSA: usb-audio: apply quirk for MOONDROP Quark2
Paul Kocialkowski <[email protected]>
media: verisilicon: Explicitly disable selection api ioctls for decoders
Niklas Söderlund <[email protected]>
media: adv7180: Only validate format in querystd
Niklas Söderlund <[email protected]>
media: adv7180: Do not write format to device in set_fmt
Niklas Söderlund <[email protected]>
media: adv7180: Add missing lock in suspend callback
Juraj Šarinay <[email protected]>
net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
Yue Haibing <[email protected]>
ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
David Francis <[email protected]>
drm/amdgpu: Allow kfd CRIU with no buffer objects
Krzysztof Kozlowski <[email protected]>
drm/msm/dsi/phy_7nm: Fix missing initial VCO rate
Krzysztof Kozlowski <[email protected]>
drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL
Devendra K Verma <[email protected]>
dmaengine: dw-edma: Set status for callback_result
Rosen Penev <[email protected]>
dmaengine: mv_xor: match alloc_wc and free_wc
Thomas Andreatta <[email protected]>
dmaengine: sh: setup_xref error handling
Miroslav Lichvar <[email protected]>
ptp: Limit time setting of PTP clocks
Qianfeng Rong <[email protected]>
scsi: pm8001: Use int instead of u32 to store error codes
Qianfeng Rong <[email protected]>
crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof()
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: danube: rename stp node on EASY50712 reference board
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: xway: sysctrl: rename stp clock
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: danube: add missing device_type in pci node
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: danube: add model to EASY50712 dts
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: danube: add missing properties to cpu node
Timur Kristóf <[email protected]>
drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)
Chelsy Ratnawat <[email protected]>
media: fix uninitialized symbol warnings
Amber Lin <[email protected]>
drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
Eric Huang <[email protected]>
drm/amdkfd: fix vram allocation failure for a special case
Miklos Szeredi <[email protected]>
fuse: zero initialize inode private data
Heiner Kallweit <[email protected]>
net: phy: fixed_phy: let fixed_phy_unregister free the phy_device
Andrew Davis <[email protected]>
remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper
Krzysztof Kozlowski <[email protected]>
extcon: adc-jack: Fix wakeup source leaks on device unbind
Francisco Gutierrez <[email protected]>
scsi: pm80xx: Fix race condition caused by static variables
Chandrakanth Patil <[email protected]>
scsi: mpi3mr: Fix controller init failure on fault during queue creation
Ujwal Kundur <[email protected]>
rds: Fix endianness annotation for RDS_MPATH_HASH
Takashi Iwai <[email protected]>
ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
Sungho Kim <[email protected]>
PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
Kuniyuki Iwashima <[email protected]>
net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
Oleksij Rempel <[email protected]>
net: stmmac: Correctly handle Rx checksum offload errors
Christoph Paasch <[email protected]>
net: When removing nexthops, don't call synchronize_net if it is not necessary
Zijun Hu <[email protected]>
char: misc: Does not request module for miscdevice with dynamic minor
Zijun Hu <[email protected]>
char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor
raub camaioni <[email protected]>
usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
Haibo Chen <[email protected]>
iio: adc: imx93_adc: load calibrated values even calibration failed
Rodrigo Gobbi <[email protected]>
iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
Kent Russell <[email protected]>
drm/amdkfd: Handle lack of READ permissions in SVM mapping
Dmitry Baryshkov <[email protected]>
drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts
Tetsuo Handa <[email protected]>
media: imon: make send_packet() more robust
Charalampos Mitrodimas <[email protected]>
net: ipv6: fix field-spanning memcpy warning in AH output
Alice Chao <[email protected]>
scsi: ufs: host: mediatek: Fix invalid access in vccqx handling
Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Change reset sequence for improved stability
Alice Chao <[email protected]>
scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change
Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration
Ido Schimmel <[email protected]>
bridge: Redirect to backup port when port is administratively down
Niklas Schnelle <[email protected]>
s390/pci: Use pci_uevent_ers() in PCI recovery
Niklas Schnelle <[email protected]>
powerpc/eeh: Use result of error_detected() in uevent
Lukas Wunner <[email protected]>
thunderbolt: Use is_pciehp instead of is_hotplug_bridge
Thomas Weißschuh <[email protected]>
ice: Don't use %pK through printk or tracepoints
Tiezhu Yang <[email protected]>
net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
Kirill A. Shutemov <[email protected]>
x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
Mehdi Djait <[email protected]>
media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR
Jayesh Choudhary <[email protected]>
drm/tidss: Set crtc modesetting parameters with adjusted mode
Tomi Valkeinen <[email protected]>
drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST
Tomi Valkeinen <[email protected]>
drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value
Tomi Valkeinen <[email protected]>
drm/tidss: Use the crtc_* timings when programming the HW
Laurent Pinchart <[email protected]>
media: amphion: Delete v4l2_fh synchronously in .release()
Laurent Pinchart <[email protected]>
media: pci: ivtv: Don't create fake v4l2_fh
Geoffrey McRae <[email protected]>
drm/amdkfd: return -ENOTTY for unsupported IOCTLs
Ping-Ke Shih <[email protected]>
wifi: rtw88: sdio: use indirect IO for device registers before power-on
Wake Liu <[email protected]>
selftests/net: Ensure assert() triggers in psock_tpacket.c
Wake Liu <[email protected]>
selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
Marcos Del Sol Vives <[email protected]>
PCI: Disable MSI on RDC PCI to PCIe bridges
Seyediman Seyedarab <[email protected]>
drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
Sathishkumar S <[email protected]>
drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
Lijo Lazar <[email protected]>
drm/amd/pm: Use cached metrics data on arcturus
Lijo Lazar <[email protected]>
drm/amd/pm: Use cached metrics data on aldebaran
Paul Hsieh <[email protected]>
drm/amd/display: update dpp/disp clock from smu clock table
Alex Deucher <[email protected]>
drm/amd/display: add more cyan skillfish devices
Michael Strauss <[email protected]>
drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration
Clay King <[email protected]>
drm/amd/display: ensure committing streams is seamless
Jens Kehne <[email protected]>
mfd: da9063: Split chip variant reading in two bus transactions
Arnd Bergmann <[email protected]>
mfd: madera: Work around false-positive -Wininitialized warning
Alexander Stein <[email protected]>
mfd: stmpe-i2c: Add missing MODULE_LICENSE
Alexander Stein <[email protected]>
mfd: stmpe: Remove IRQ domain upon removal
Len Brown <[email protected]>
tools/power x86_energy_perf_policy: Prefer driver HWP limits
Len Brown <[email protected]>
tools/power x86_energy_perf_policy: Enhance HWP enable
Kaushlendra Kumar <[email protected]>
tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
Kaushlendra Kumar <[email protected]>
tools/cpupower: Fix incorrect size in cpuidle_state_disable()
Armin Wolf <[email protected]>
hwmon: (dell-smm) Add support for Dell OptiPlex 7040
Ben Copeland <[email protected]>
hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
Jiri Olsa <[email protected]>
uprobe: Do not emulate/sstep original instruction when ip is changed
Alistair Francis <[email protected]>
nvme: Use non zero KATO for persistent discovery connections
Amery Hung <[email protected]>
bpf: Clear pfmemalloc flag when freeing all fragments
Chenghao Duan <[email protected]>
riscv: bpf: Fix uninitialized symbol 'retval_off'
Yu Kuai <[email protected]>
blk-cgroup: fix possible deadlock while configuring policy
Daniel Lezcano <[email protected]>
clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
Biju Das <[email protected]>
spi: rpc-if: Add resume support for RZ/G3E
Pranav Tyagi <[email protected]>
futex: Don't leak robust_list pointer on exec race
Rafael J. Wysocki <[email protected]>
cpuidle: Fail cpuidle device registration if there is one already
Tom Stellard <[email protected]>
bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
Fenglin Wu <[email protected]>
power: supply: qcom_battmgr: handle charging state change notifications
Janne Grunau <[email protected]>
pmdomain: apple: Add "apple,t8103-pmgr-pwrstate"
Kaushlendra Kumar <[email protected]>
tools/cpupower: fix error return value in cpupower_write_sysfs()
Svyatoslav Ryhel <[email protected]>
video: backlight: lp855x_bl: Set correct EPROM start for LP8556
Kumar Kartikeya Dwivedi <[email protected]>
bpf: Do not limit bpf_cgroup_from_id to current's namespace
Daniel Wagner <[email protected]>
nvme-fc: use lock accessing port_state and rport state
Daniel Wagner <[email protected]>
nvmet-fc: avoid scheduling association deletion twice
Amirreza Zarrabi <[email protected]>
tee: allow a driver to allocate a tee_device without a pool
Hans de Goede <[email protected]>
ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
Sarthak Garg <[email protected]>
mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
Svyatoslav Ryhel <[email protected]>
ARM: tegra: transformer-20: fix audio-codec interrupt
Svyatoslav Ryhel <[email protected]>
ARM: tegra: transformer-20: add missing magnetometer interrupt
Svyatoslav Ryhel <[email protected]>
soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
Radhey Shyam Pandey <[email protected]>
arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106
Ming Wang <[email protected]>
irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller
Andreas Kemnade <[email protected]>
hwmon: sy7636a: add alias
Fabien Proriol <[email protected]>
power: supply: sbs-charger: Support multiple devices
Bartosz Golaszewski <[email protected]>
pinctrl: keembay: release allocated memory in detach path
Chuande Chen <[email protected]>
hwmon: (sbtsi_temp) AMD CPU extended temperature range support
Rong Zhang <[email protected]>
hwmon: (k10temp) Add device ID for Strix Halo
Avadhut Naik <[email protected]>
hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models
Christopher Ruehl <[email protected]>
power: supply: qcom_battmgr: add OOI chemistry
Hans de Goede <[email protected]>
ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
Shang song (Lenovo) <[email protected]>
ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
Christian Bruel <[email protected]>
irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
Ricardo B. Marlière <[email protected]>
selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh
Kees Cook <[email protected]>
arc: Fix __fls() const-foldability via __builtin_clzl()
Dennis Beier <[email protected]>
cpufreq/longhaul: handle NULL policy in longhaul_exit
Ricardo B. Marlière <[email protected]>
selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
Inochi Amaoto <[email protected]>
irqchip/sifive-plic: Respect mask state when setting affinity
Jiayi Li <[email protected]>
memstick: Add timeout to prevent indefinite waiting
Biju Das <[email protected]>
mmc: host: renesas_sdhi: Fix the actual clock
Chi Zhang <[email protected]>
pinctrl: single: fix bias pull up/down handling in pin_config_set
Thomas Weißschuh <[email protected]>
bpf: Don't use %pK through printk
Thomas Weißschuh <[email protected]>
spi: loopback-test: Don't use %pK through printk
Jens Reidel <[email protected]>
soc: qcom: smem: Fix endian-unaware access of num_entries
Ryan Chen <[email protected]>
soc: aspeed: socinfo: Add AST27xx silicon IDs
Owen Gu <[email protected]>
usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
Gerd Bayer <[email protected]>
s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump
Thomas Zimmermann <[email protected]>
drm/sysfb: Do not dereference NULL pointer in plane reset
Philipp Stanner <[email protected]>
drm/sched: Fix race in drm_sched_entity_select_rq()
Heiko Carstens <[email protected]>
s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
Pierre Gondois <[email protected]>
sched/fair: Use all little CPUs for CPU-bound workloads
Vincent Guittot <[email protected]>
sched/pelt: Avoid underestimation of task utilization
Emanuele Ghidoli <[email protected]>
net: phy: dp83867: Disable EEE support as not implemented
Rafael J. Wysocki <[email protected]>
cpuidle: governors: menu: Select polling state in some more cases
Rafael J. Wysocki <[email protected]>
cpuidle: governors: menu: Rearrange main loop in menu_select()
Farhan Ali <[email protected]>
s390/pci: Restore IRQ unconditionally for the zPCI device
Paolo Abeni <[email protected]>
mptcp: fix MSG_PEEK stream corruption
Johan Hovold <[email protected]>
drm/mediatek: Fix device use-after-free on unbind
Alexey Klimov <[email protected]>
regmap: slimbus: fix bus_context pointer in regmap init calls
Damien Le Moal <[email protected]>
block: make REQ_OP_ZONE_OPEN a write operation
Damien Le Moal <[email protected]>
block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
John Smith <[email protected]>
drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
John Smith <[email protected]>
drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
Yang Wang <[email protected]>
drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
Abdun Nihaal <[email protected]>
sfc: fix potential memory leak in efx_mae_process_mport()
Jijie Shao <[email protected]>
net: hns3: return error code when function fails
Tomeu Vizoso <[email protected]>
drm/etnaviv: fix flush sequence logic
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_core: Fix tracking of periodic advertisement
Luiz Augusto von Dentz <[email protected]>
Bluetooth: ISO: Fix another instance of dst_type handling
Luiz Augusto von Dentz <[email protected]>
Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00
Chris Lu <[email protected]>
Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset
Cen Zhang <[email protected]>
Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
Lizhi Xu <[email protected]>
usbnet: Prevents free active kevent
Andrii Nakryiko <[email protected]>
libbpf: Fix powerpc's stack register definition in bpf_tracing.h
Shengjiu Wang <[email protected]>
ASoC: fsl_sai: fix bit order for DSD format
Cezary Rojewski <[email protected]>
ASoC: Intel: avs: Unprepare a stream when XRUN occurs
Haotian Zhang <[email protected]>
crypto: aspeed - fix double free caused by devm
Uwe Kleine-König <[email protected]>
crypto: aspeed-acry - Convert to platform remove callback returning void
Ondrej Mosnacek <[email protected]>
bpf: Do not audit capability check in do_jit()
Wonkon Kim <[email protected]>
scsi: ufs: core: Initialize value of an attribute returned by uic cmd
Noorain Eqbal <[email protected]>
bpf: Sync pending IRQ work before freeing ring buffer
Roy Vegard Ovesen <[email protected]>
ALSA: usb-audio: fix control pipe direction
Akhil P Oommen <[email protected]>
drm/msm/a6xx: Fix GMU firmware parser
Karthik M <[email protected]>
wifi: ath12k: free skb during idr cleanup callback
Mark Pearson <[email protected]>
wifi: ath11k: Add missing platform IDs for quirk table
Loic Poulain <[email protected]>
wifi: ath10k: Fix memory leak on unsupported WMI command
Chang S. Bae <[email protected]>
x86/fpu: Ensure XFD state on signal delivery
Henrique Carvalho <[email protected]>
smb: client: fix potential cfid UAF in smb2_query_info_compound
Srinivas Kandagatla <[email protected]>
ASoC: qdsp6: q6asm: do not sleep while atomic
Paolo Abeni <[email protected]>
mptcp: restore window probe
Paolo Abeni <[email protected]>
mptcp: drop bogus optimization in __mptcp_check_push()
Miaoqian Lin <[email protected]>
fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
Florian Fuchs <[email protected]>
fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
Gokul Sivakumar <[email protected]>
wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
Johan Hovold <[email protected]>
Bluetooth: rfcomm: fix modem control handling
Junjie Cao <[email protected]>
fbdev: bitblit: bound-check glyph index in bit_putcs*
Kaushlendra Kumar <[email protected]>
ACPI: button: Call input_free_device() on failing input device registration
Yuhao Jiang <[email protected]>
ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
Daniel Palmer <[email protected]>
fbdev: atyfb: Check if pll_ops->init_pll failed
Quanmin Yan <[email protected]>
fbcon: Set fb_display[i]->mode to NULL when the mode is released
Miaoqian Lin <[email protected]>
net: usb: asix_devices: Check return value of usbnet_get_endpoints
Chuck Lever <[email protected]>
NFSD: Fix crash in nfsd4_read_release()
-------------
Diffstat:
Documentation/admin-guide/cgroup-v2.rst | 9 + MAINTAINERS | 1 + Makefile | 4 +- arch/arc/include/asm/bitops.h | 2 + .../boot/dts/broadcom/bcm47189-luxul-xap-1440.dts | 4 +- arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts | 5 +- arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts | 4 +- arch/arm/crypto/Kconfig | 2 +- arch/arm/mach-at91/pm_suspend.S | 8 +- arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts | 2 + arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts | 4 +- arch/loongarch/include/asm/hw_breakpoint.h | 4 +- arch/loongarch/include/asm/pgtable.h | 11 +- arch/loongarch/kernel/traps.c | 4 +- arch/mips/boot/dts/lantiq/danube.dtsi | 6 + arch/mips/boot/dts/lantiq/danube_easy50712.dts | 4 +- arch/mips/lantiq/xway/sysctrl.c | 2 +- arch/powerpc/kernel/eeh_driver.c | 2 +- arch/riscv/kernel/cpu-hotplug.c | 1 + arch/riscv/kernel/entry.S | 18 +- arch/riscv/kernel/setup.c | 7 +- arch/riscv/kernel/stacktrace.c | 27 +- arch/riscv/mm/ptdump.c | 2 +- arch/riscv/net/bpf_jit_comp64.c | 5 +- arch/s390/Kconfig | 1 - arch/s390/include/asm/pci.h | 1 - arch/s390/pci/pci_event.c | 7 +- arch/s390/pci/pci_irq.c | 9 +- arch/sparc/include/asm/elf_64.h | 1 + arch/sparc/include/asm/io_64.h | 6 +- arch/sparc/kernel/module.c | 1 + arch/um/drivers/ssl.c | 5 +- arch/x86/entry/vsyscall/vsyscall_64.c | 17 +- arch/x86/kernel/cpu/microcode/amd.c | 3 + arch/x86/kernel/fpu/core.c | 3 + arch/x86/kernel/kvm.c | 20 +- arch/x86/kvm/svm/svm.c | 4 + arch/x86/net/bpf_jit_comp.c | 2 +- block/blk-cgroup.c | 23 +- drivers/accel/habanalabs/common/memory.c | 2 +- drivers/accel/habanalabs/gaudi/gaudi.c | 19 + drivers/accel/habanalabs/gaudi2/gaudi2.c | 15 +- drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c | 2 +- drivers/acpi/acpi_video.c | 4 +- drivers/acpi/acpica/dsmethod.c | 10 +- drivers/acpi/button.c | 4 +- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/numa/hmat.c | 322 ++++++++++----- drivers/acpi/numa/srat.c | 2 +- drivers/acpi/prmt.c | 19 +- drivers/acpi/property.c | 24 +- drivers/acpi/scan.c | 2 + drivers/base/node.c | 18 +- drivers/base/regmap/regmap-slimbus.c | 6 +- drivers/bluetooth/btmtksdio.c | 12 + drivers/bluetooth/btrtl.c | 4 +- drivers/bluetooth/btusb.c | 30 +- drivers/bluetooth/hci_bcsp.c | 3 + drivers/char/misc.c | 40 +- drivers/clk/at91/clk-master.c | 3 + drivers/clk/at91/clk-sam9x60-pll.c | 75 ++-- drivers/clk/sunxi-ng/ccu-sun6i-rtc.c | 11 + drivers/clk/ti/clk-33xx.c | 2 + drivers/clocksource/timer-vf-pit.c | 22 +- drivers/cpufreq/longhaul.c | 3 + drivers/cpufreq/tegra186-cpufreq.c | 27 +- drivers/cpuidle/cpuidle.c | 8 +- drivers/cpuidle/governors/menu.c | 79 ++-- .../crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 5 +- drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c | 2 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 2 +- drivers/crypto/aspeed/aspeed-acry.c | 8 +- drivers/crypto/caam/ctrl.c | 4 +- drivers/crypto/hisilicon/qm.c | 2 + drivers/crypto/intel/qat/qat_common/qat_uclo.c | 2 +- drivers/dma/dw-edma/dw-edma-core.c | 22 ++ drivers/dma/mv_xor.c | 4 +- drivers/dma/sh/shdma-base.c | 25 +- drivers/dma/sh/shdmac.c | 17 +- drivers/edac/altera_edac.c | 22 +- drivers/extcon/extcon-adc-jack.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 66 +++- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 23 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 + drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 19 +- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 9 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 23 ++ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 +- .../drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c | 16 + drivers/gpu/drm/amd/display/dc/core/dc.c | 19 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 14 +- drivers/gpu/drm/amd/display/dc/dc_helper.c | 5 + drivers/gpu/drm/amd/display/dc/dc_stream.h | 3 + drivers/gpu/drm/amd/display/dc/dm_services.h | 2 + .../gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c | 20 +- .../gpu/drm/amd/display/dc/link/link_detection.c | 5 + .../display/dc/link/protocols/link_dp_training.c | 9 +- drivers/gpu/drm/amd/display/include/dal_asic_id.h | 5 + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 + .../gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c | 2 +- .../drm/amd/pm/powerplay/smumgr/iceland_smumgr.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 2 +- drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 12 +- drivers/gpu/drm/bridge/display-connector.c | 3 +- drivers/gpu/drm/drm_gem_atomic_helper.c | 6 +- drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 2 +- drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c | 4 +- drivers/gpu/drm/i915/i915_vma.c | 16 +- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 10 - drivers/gpu/drm/mediatek/mtk_drm_plane.c | 24 +- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 5 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 3 + drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 10 + drivers/gpu/drm/nouveau/nvkm/core/enum.c | 2 +- drivers/gpu/drm/scheduler/sched_entity.c | 37 +- drivers/gpu/drm/tidss/tidss_crtc.c | 7 +- drivers/gpu/drm/tidss/tidss_dispc.c | 16 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 5 + drivers/hid/hid-asus.c | 6 +- drivers/hid/hid-ids.h | 6 +- drivers/hid/hid-ntrig.c | 7 +- drivers/hid/hid-quirks.c | 2 + drivers/hid/hid-uclogic-params.c | 4 +- drivers/hid/i2c-hid/i2c-hid-acpi.c | 8 + drivers/hid/i2c-hid/i2c-hid-core.c | 28 +- drivers/hid/i2c-hid/i2c-hid.h | 2 + drivers/hwmon/asus-ec-sensors.c | 2 +- drivers/hwmon/dell-smm-hwmon.c | 7 + drivers/hwmon/k10temp.c | 10 + drivers/hwmon/sbtsi_temp.c | 46 ++- drivers/hwmon/sy7636a-hwmon.c | 1 + drivers/iio/adc/imx93_adc.c | 18 +- drivers/iio/adc/spear_adc.c | 9 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 11 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 2 - drivers/infiniband/hw/irdma/Kconfig | 7 +- drivers/infiniband/hw/irdma/pble.c | 2 +- drivers/infiniband/hw/irdma/verbs.c | 4 +- drivers/infiniband/hw/irdma/verbs.h | 8 +- drivers/iommu/amd/init.c | 28 +- drivers/iommu/apple-dart.c | 5 + drivers/iommu/intel/debugfs.c | 10 +- drivers/iommu/intel/perf.c | 10 +- drivers/iommu/intel/perf.h | 5 +- drivers/iommu/iommufd/io_pagetable.c | 12 +- drivers/iommu/iommufd/ioas.c | 4 + drivers/irqchip/irq-gic-v2m.c | 13 +- drivers/irqchip/irq-loongson-pch-lpc.c | 9 +- drivers/irqchip/irq-riscv-intc.c | 3 +- drivers/irqchip/irq-sifive-plic.c | 6 +- drivers/isdn/hardware/mISDN/hfcsusb.c | 18 +- drivers/media/i2c/Kconfig | 2 +- drivers/media/i2c/adv7180.c | 48 +-- drivers/media/i2c/ir-kbd-i2c.c | 6 +- drivers/media/i2c/og01a1b.c | 6 +- drivers/media/i2c/ov08x40.c | 2 +- drivers/media/pci/ivtv/ivtv-alsa-pcm.c | 2 - drivers/media/pci/ivtv/ivtv-driver.h | 3 +- drivers/media/pci/ivtv/ivtv-fileops.c | 18 +- drivers/media/pci/ivtv/ivtv-irq.c | 4 +- drivers/media/platform/amphion/vpu_v4l2.c | 7 +- drivers/media/platform/verisilicon/hantro_drv.c | 2 + drivers/media/platform/verisilicon/hantro_v4l2.c | 6 +- drivers/media/rc/imon.c | 61 +-- drivers/media/rc/redrat3.c | 2 +- drivers/media/tuners/xc4000.c | 8 +- drivers/media/tuners/xc5000.c | 12 +- drivers/media/usb/uvc/uvc_driver.c | 15 +- drivers/memstick/core/memstick.c | 8 +- drivers/mfd/da9063-i2c.c | 27 +- drivers/mfd/madera-core.c | 4 +- drivers/mfd/stmpe-i2c.c | 1 + drivers/mfd/stmpe.c | 3 + drivers/mmc/host/renesas_sdhi_core.c | 6 +- drivers/mmc/host/sdhci-msm.c | 15 + drivers/mmc/host/sdhci-of-dwcmshc.c | 2 +- drivers/mtd/nand/onenand/onenand_samsung.c | 2 +- drivers/net/dsa/b53/b53_common.c | 15 +- drivers/net/dsa/b53/b53_regs.h | 3 +- drivers/net/dsa/dsa_loop.c | 9 +- drivers/net/dsa/microchip/ksz9477.c | 98 ++++- drivers/net/dsa/microchip/ksz9477_reg.h | 3 +- drivers/net/dsa/microchip/ksz_common.c | 4 + drivers/net/dsa/microchip/ksz_common.h | 2 + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 4 +- drivers/net/ethernet/cadence/macb_main.c | 4 +- drivers/net/ethernet/freescale/fec_main.c | 2 + .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c | 9 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h | 2 +- drivers/net/ethernet/intel/fm10k/fm10k_common.c | 5 +- drivers/net/ethernet/intel/fm10k/fm10k_common.h | 2 +- drivers/net/ethernet/intel/fm10k/fm10k_pf.c | 2 +- drivers/net/ethernet/intel/fm10k/fm10k_vf.c | 2 +- drivers/net/ethernet/intel/ice/ice_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_trace.h | 10 +- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 33 +- .../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 10 +- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 5 +- drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 12 +- .../ethernet/microchip/lan966x/lan966x_ethtool.c | 18 +- .../net/ethernet/microchip/lan966x/lan966x_main.c | 2 - .../net/ethernet/microchip/lan966x/lan966x_main.h | 4 +- .../ethernet/microchip/lan966x/lan966x_vcap_impl.c | 8 +- drivers/net/ethernet/microchip/sparx5/Kconfig | 2 +- drivers/net/ethernet/realtek/Kconfig | 2 +- drivers/net/ethernet/realtek/r8169_main.c | 6 +- drivers/net/ethernet/renesas/sh_eth.c | 4 + drivers/net/ethernet/sfc/mae.c | 4 + drivers/net/ethernet/smsc/smsc911x.c | 14 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 23 +- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 3 +- drivers/net/ethernet/wangxun/libwx/wx_type.h | 4 +- drivers/net/hamradio/6pack.c | 57 +-- drivers/net/ipvlan/ipvlan_l3s.c | 1 - drivers/net/mdio/of_mdio.c | 1 - drivers/net/phy/dp83867.c | 8 + drivers/net/phy/fixed_phy.c | 1 + drivers/net/phy/marvell.c | 39 +- drivers/net/phy/mdio_bus.c | 5 +- drivers/net/phy/phy.c | 13 + drivers/net/usb/asix_devices.c | 12 +- drivers/net/usb/qmi_wwan.c | 6 + drivers/net/usb/usbnet.c | 2 + drivers/net/virtio_net.c | 41 +- drivers/net/wireless/ath/ath10k/mac.c | 12 +- drivers/net/wireless/ath/ath10k/wmi.c | 40 +- drivers/net/wireless/ath/ath11k/core.c | 54 ++- drivers/net/wireless/ath/ath11k/wmi.c | 3 + drivers/net/wireless/ath/ath12k/dp.h | 2 +- drivers/net/wireless/ath/ath12k/mac.c | 34 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +- .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 28 +- .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.h | 3 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 2 + drivers/net/wireless/mediatek/mt76/mt7996/init.c | 1 - drivers/net/wireless/realtek/rtw88/sdio.c | 4 + drivers/net/wireless/virtual/mac80211_hwsim.c | 7 +- drivers/ntb/hw/epf/ntb_hw_epf.c | 103 ++--- drivers/nvme/host/core.c | 8 +- drivers/nvme/host/fc.c | 10 +- drivers/nvme/target/fc.c | 16 +- drivers/pci/controller/cadence/pcie-cadence-host.c | 2 +- drivers/pci/controller/cadence/pcie-cadence.c | 4 +- drivers/pci/controller/cadence/pcie-cadence.h | 6 +- drivers/pci/controller/dwc/pcie-designware.c | 4 +- drivers/pci/p2pdma.c | 2 +- drivers/pci/pci-driver.c | 2 +- drivers/pci/pci.c | 5 + drivers/pci/quirks.c | 3 +- drivers/phy/cadence/cdns-dphy.c | 4 +- drivers/phy/renesas/r8a779f0-ether-serdes.c | 28 ++ drivers/phy/rockchip/phy-rockchip-inno-csidphy.c | 5 +- drivers/pinctrl/pinctrl-keembay.c | 7 +- drivers/pinctrl/pinctrl-single.c | 4 +- drivers/pmdomain/apple/pmgr-pwrstate.c | 1 + drivers/pmdomain/samsung/exynos-pm-domains.c | 11 +- drivers/power/supply/qcom_battmgr.c | 8 +- drivers/power/supply/sbs-charger.c | 16 +- drivers/ptp/ptp_clock.c | 13 +- drivers/regulator/fixed.c | 1 + drivers/remoteproc/qcom_q6v5.c | 5 + drivers/remoteproc/wkup_m3_rproc.c | 6 +- drivers/rtc/rtc-pcf2127.c | 19 +- drivers/rtc/rtc-rx8025.c | 2 +- drivers/scsi/libfc/fc_encode.h | 2 +- drivers/scsi/lpfc/lpfc_debugfs.h | 3 + drivers/scsi/lpfc/lpfc_els.c | 6 +- drivers/scsi/lpfc/lpfc_init.c | 7 - drivers/scsi/lpfc/lpfc_scsi.c | 14 +- drivers/scsi/mpi3mr/mpi3mr_fw.c | 10 + drivers/scsi/mpt3sas/mpt3sas_transport.c | 3 + drivers/scsi/pm8001/pm8001_ctl.c | 24 +- drivers/scsi/pm8001/pm8001_init.c | 1 + drivers/scsi/pm8001/pm8001_sas.h | 4 + drivers/soc/aspeed/aspeed-socinfo.c | 4 + drivers/soc/qcom/smem.c | 2 +- drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++ drivers/spi/spi-loopback-test.c | 12 +- drivers/spi/spi-rpc-if.c | 2 + drivers/spi/spi.c | 10 + drivers/tee/tee_core.c | 2 +- drivers/thunderbolt/tb.c | 2 +- drivers/ufs/core/ufshcd-crypto.c | 34 +- drivers/ufs/core/ufshcd-crypto.h | 36 ++ drivers/ufs/core/ufshcd.c | 25 +- drivers/ufs/host/ufs-mediatek.c | 179 +++++++-- drivers/ufs/host/ufshcd-pci.c | 70 +++- drivers/usb/cdns3/cdnsp-gadget.c | 8 +- drivers/usb/gadget/function/f_fs.c | 8 +- drivers/usb/gadget/function/f_hid.c | 4 +- drivers/usb/gadget/function/f_ncm.c | 3 +- drivers/usb/host/xhci-plat.c | 1 + drivers/usb/mon/mon_bin.c | 14 +- drivers/vfio/iova_bitmap.c | 5 +- drivers/vfio/vfio_main.c | 2 +- drivers/video/backlight/lp855x_bl.c | 2 +- drivers/video/fbdev/aty/atyfb_base.c | 8 +- drivers/video/fbdev/core/bitblit.c | 33 +- drivers/video/fbdev/core/fbcon.c | 19 + drivers/video/fbdev/core/fbmem.c | 1 + drivers/video/fbdev/pvr2fb.c | 2 +- drivers/video/fbdev/valkyriefb.c | 2 + drivers/watchdog/s3c2410_wdt.c | 10 +- fs/9p/v9fs.c | 9 +- fs/btrfs/extent_io.c | 8 + fs/btrfs/file.c | 10 + fs/btrfs/scrub.c | 2 + fs/btrfs/tree-log.c | 2 +- fs/ceph/dir.c | 3 +- fs/ceph/file.c | 6 +- fs/ceph/locks.c | 5 +- fs/exfat/fatent.c | 11 +- fs/ext4/fast_commit.c | 2 +- fs/ext4/xattr.c | 2 +- fs/f2fs/compress.c | 2 +- fs/f2fs/extent_cache.c | 6 + fs/fuse/inode.c | 11 +- fs/hpfs/namei.c | 18 +- fs/jfs/inode.c | 8 +- fs/jfs/jfs_txnmgr.c | 9 +- fs/nfs/nfs3client.c | 15 +- fs/nfs/nfs4client.c | 17 +- fs/nfs/nfs4proc.c | 15 +- fs/nfs/nfs4state.c | 3 + fs/nfs/pnfs_nfs.c | 34 +- fs/nfs/sysfs.c | 1 + fs/nfs/write.c | 3 +- fs/nfsd/nfs4proc.c | 7 +- fs/nfsd/nfs4state.c | 3 +- fs/ntfs3/inode.c | 1 + fs/open.c | 10 +- fs/orangefs/xattr.c | 12 +- fs/proc/generic.c | 12 +- fs/smb/client/cached_dir.c | 16 +- fs/smb/client/file.c | 115 +++++- fs/smb/client/fs_context.c | 2 + fs/smb/client/smb2inode.c | 2 + fs/smb/client/smb2ops.c | 3 +- fs/smb/client/smb2pdu.c | 7 +- fs/smb/client/transport.c | 12 +- fs/smb/server/smb2pdu.c | 2 + fs/smb/server/transport_tcp.c | 12 +- include/linux/blk_types.h | 11 +- include/linux/cgroup.h | 1 + include/linux/compiler_types.h | 5 +- include/linux/fbcon.h | 2 + include/linux/filter.h | 22 +- include/linux/map_benchmark.h | 1 + include/linux/memcontrol.h | 8 +- include/linux/memory-tiers.h | 39 +- include/linux/netpoll.h | 1 + include/linux/node.h | 26 +- include/linux/pci.h | 2 +- include/linux/shdma-base.h | 2 +- include/linux/swap.h | 3 +- include/linux/vm_event_item.h | 1 + include/net/bluetooth/hci.h | 1 + include/net/bluetooth/hci_core.h | 8 + include/net/bluetooth/mgmt.h | 2 +- include/net/cls_cgroup.h | 2 +- include/net/gro.h | 3 + include/net/nfc/nci_core.h | 2 +- include/net/tc_act/tc_connmark.h | 1 + include/net/xdp.h | 5 + include/ufs/ufs_quirks.h | 3 + include/ufs/ufshcd.h | 44 +++ include/ufs/ufshci.h | 4 +- kernel/bpf/helpers.c | 2 +- kernel/bpf/ringbuf.c | 2 + kernel/bpf/verifier.c | 6 +- kernel/cgroup/cgroup.c | 24 +- kernel/events/uprobes.c | 7 + kernel/futex/syscalls.c | 106 ++--- kernel/gcov/gcc_4_7.c | 4 +- kernel/sched/fair.c | 15 +- kernel/trace/ftrace.c | 2 + kernel/trace/trace_events_hist.c | 6 +- lib/crypto/Makefile | 2 +- mm/filemap.c | 24 +- mm/memcontrol.c | 292 ++++++++------ mm/memory-tiers.c | 162 +++++++- mm/memory.c | 24 +- mm/mm_init.c | 2 +- mm/page_io.c | 8 +- mm/percpu.c | 8 +- mm/secretmem.c | 2 +- mm/truncate.c | 27 +- mm/vmscan.c | 3 +- mm/vmstat.c | 1 + mm/workingset.c | 54 ++- mm/zswap.c | 4 + net/8021q/vlan.c | 2 + net/bluetooth/6lowpan.c | 103 +++-- net/bluetooth/hci_event.c | 18 +- net/bluetooth/hci_sync.c | 23 +- net/bluetooth/iso.c | 8 +- net/bluetooth/l2cap_core.c | 1 + net/bluetooth/mgmt.c | 7 +- net/bluetooth/rfcomm/tty.c | 26 +- net/bluetooth/sco.c | 7 + net/bridge/br.c | 5 + net/bridge/br_forward.c | 5 +- net/bridge/br_if.c | 1 + net/bridge/br_input.c | 4 +- net/bridge/br_mst.c | 10 +- net/bridge/br_private.h | 13 +- net/core/filter.c | 1 + net/core/gro.c | 3 - net/core/netpoll.c | 71 ++-- net/core/page_pool.c | 12 +- net/core/skbuff.c | 10 +- net/core/sock.c | 15 +- net/dsa/dsa.c | 7 + net/dsa/tag_brcm.c | 10 +- net/ethernet/eth.c | 5 +- net/handshake/tlshd.c | 1 + net/hsr/hsr_device.c | 3 + net/ipv4/esp4.c | 4 +- net/ipv4/netfilter/nf_reject_ipv4.c | 25 ++ net/ipv4/nexthop.c | 6 + net/ipv4/route.c | 5 + net/ipv4/udp_tunnel_nic.c | 2 +- net/ipv6/addrconf.c | 4 +- net/ipv6/ah6.c | 50 ++- net/ipv6/esp6.c | 4 +- net/ipv6/netfilter/nf_reject_ipv6.c | 30 ++ net/ipv6/raw.c | 2 +- net/ipv6/udp.c | 2 +- net/mac80211/iface.c | 14 +- net/mac80211/mlme.c | 2 +- net/mac80211/rx.c | 10 +- net/mptcp/protocol.c | 54 ++- net/mptcp/protocol.h | 2 +- net/netfilter/nf_tables_api.c | 30 ++ net/rds/rds.h | 2 +- net/sched/act_bpf.c | 6 +- net/sched/act_connmark.c | 30 +- net/sched/act_ife.c | 12 +- net/sched/cls_bpf.c | 6 +- net/sched/sch_generic.c | 17 +- net/sctp/diag.c | 23 +- net/sctp/transport.c | 13 +- net/smc/smc_clc.c | 1 + net/strparser/strparser.c | 2 +- net/tipc/net.c | 2 + net/unix/garbage.c | 14 +- net/xfrm/espintcp.c | 4 +- security/integrity/ima/ima_appraise.c | 23 +- sound/drivers/serial-generic.c | 12 +- sound/pci/hda/patch_realtek.c | 17 +- sound/soc/codecs/cs4271.c | 10 +- sound/soc/codecs/lpass-va-macro.c | 2 +- sound/soc/codecs/max98090.c | 6 +- sound/soc/codecs/tas2781-i2c.c | 9 +- sound/soc/codecs/tlv320aic3x.c | 32 +- sound/soc/fsl/fsl_sai.c | 3 +- sound/soc/intel/avs/pcm.c | 2 + sound/soc/meson/aiu-encoder-i2s.c | 9 +- sound/soc/qcom/qdsp6/q6asm.c | 2 +- sound/soc/qcom/sc8280xp.c | 3 + sound/soc/stm/stm32_sai_sub.c | 8 + sound/usb/endpoint.c | 5 + sound/usb/mixer.c | 9 + sound/usb/mixer_s1810c.c | 28 +- sound/usb/validate.c | 9 +- tools/bpf/bpftool/btf_dumper.c | 2 +- tools/bpf/bpftool/prog.c | 2 +- tools/include/linux/bitmap.h | 1 + tools/lib/bpf/bpf_tracing.h | 2 +- tools/lib/thermal/Makefile | 9 +- tools/perf/util/symbol.c | 1 - tools/power/cpupower/lib/cpuidle.c | 5 +- tools/power/cpupower/lib/cpupower.c | 2 +- .../x86_energy_perf_policy.c | 30 +- tools/testing/selftests/Makefile | 2 +- tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +- tools/testing/selftests/bpf/test_xsk.sh | 2 + .../selftests/drivers/net/netdevsim/Makefile | 21 + .../selftests/drivers/net/netdevsim/settings | 1 + .../ftrace/test.d/filter/event-filter-function.tc | 4 + tools/testing/selftests/iommu/iommufd.c | 2 + tools/testing/selftests/net/fcnal-test.sh | 432 +++++++++++---------- .../selftests/net/forwarding/local_termination.sh | 2 + tools/testing/selftests/net/gro.c | 101 ++++- tools/testing/selftests/net/mptcp/mptcp_connect.c | 18 +- tools/testing/selftests/net/mptcp/mptcp_connect.sh | 2 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 54 +-- tools/testing/selftests/net/psock_tpacket.c | 4 +- tools/testing/selftests/net/traceroute.sh | 13 +- tools/testing/selftests/user_events/perf_test.c | 2 +- usr/include/headers_check.pl | 2 + 504 files changed, 4874 insertions(+), 2090 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/529 NFSD: Fix crash in nfsd4_read_release()
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
commit abb1f08a2121dd270193746e43b2a9373db9ad84 upstream.
When tracing is enabled, the trace_nfsd_read_done trace point crashes during the pynfs read.testNoFh test.
--- fs/nfsd/nfs4proc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/nfsd/nfs4proc.c +4 -3
@@ -978,10 +978,11 @@ nfsd4_read(struct svc_rqst *rqstp, strucstatic void nfsd4_read_release (union nfsd4_op_u *u) { -if (u->read.rd_nf) +if (u->read.rd_nf) { +trace_nfsd_read_done (u->read.rd_rqstp, u->read.rd_fhp, + u->read.rd_offset, u->read.rd_length);nfsd_file_put (u->read.rd_nf); -trace_nfsd_read_done (u->read.rd_rqstp, u->read.rd_fhp, - u->read.rd_offset, u->read.rd_length); + } } static __be32
Greg Kroah-Hartman
maintainerPATCH 2/529 net: usb: asix_devices: Check return value of usbnet_get_endpoints
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit dc89548c6926d68dfdda11bebc1a5258bc41d887 upstream.
The code did not check the return value of usbnet_get_endpoints. Add checks and return the error if it fails to transfer the error.
Found via static anlaysis and this is similar to
commit 07161b2416f7 ("sr9800: Add check for usbnet_get_endpoints").
--- drivers/net/usb/asix_devices.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/net/usb/asix_devices.c +9 -3
@@ -230,7 +230,9 @@ static int ax88172_bind(struct usbnet *dint i;unsigned long gpio_bits = dev->driver_info->data; -usbnet_get_endpoints (dev,intf); + ret =usbnet_get_endpoints (dev, intf); +if (ret) + goto out;/* Toggle the GPIOs in a manufacturer/model specific way */ for (i =2 ; i >=0 ; i--) {
@@ -848,7 +850,9 @@ static int ax88772_bind(struct usbnet *d dev->driver_priv = priv; -usbnet_get_endpoints (dev, intf); + ret =usbnet_get_endpoints (dev, intf); +if (ret) +return ret;/* Maybe the boot loader passed the MAC address via device tree */ if (!eth_platform_get_mac_address (&dev->udev->dev, buf)) {
@@ -1281,7 +1285,9 @@ static int ax88178_bind(struct usbnet *dint ret;u8 buf[ETH_ALEN ] = {0 }; -usbnet_get_endpoints (dev,intf); + ret =usbnet_get_endpoints (dev, intf); +if (ret) +return ret;/* Get the MAC address */ ret =asix_read_cmd (dev,AX_CMD_READ_NODE_ID ,0 ,0 ,ETH_ALEN , buf,0 );
Greg Kroah-Hartman
maintainerPATCH 3/529 fbcon: Set fb_display[i]->mode to NULL when the mode is released
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quanmin Yan <[email protected]>
commit a1f3058930745d2b938b6b4f5bd9630dc74b26b7 upstream.
Recently, we discovered the following issue through syzkaller:
BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0 Read of size 4 at addr ff11000001b3c69c by task syz.xxx ... Call Trace: <TASK> dump_stack_lvl+0xab/0xe0 print_address_description.constprop.0+0x2c/0x390 print_report+0xb9/0x280 kasan_report+0xb8/0xf0 fb_mode_is_equal+0x285/0x2f0 fbcon_mode_deleted+0x129/0x180 fb_set_var+0xe7f/0x11d0 do_fb_ioctl+0x6a0/0x750 fb_ioctl+0xe0/0x140 __x64_sys_ioctl+0x193/0x210 do_syscall_64+0x5f/0x9c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
Based on experimentation and analysis, during framebuffer unregistration, only the memory of fb_info->modelist is freed, without setting the corresponding fb_display[i]->mode to NULL for the freed modes. This leads to UAF issues during subsequent accesses. Here's an example of reproduction steps:
1. With /dev/fb0 already registered in the system, load a kernel module to register a new device /dev/fb1;
2. Set fb1's mode to the global fb_display[] array (via FBIOPUT_CON2FBMAP);
3. Switch console from fb to VGA (to allow normal rmmod of the ko);
4. Unload the kernel module, at this point fb1's modelist is freed, leaving a wild pointer in fb_display[];
5. Trigger the bug via system calls through fb0 attempting to delete a mode from fb0.
Add a check in do_unregister_framebuffer(): if the mode to be freed exists in fb_display[], set the corresponding mode pointer to NULL.
--- drivers/video/fbdev/core/fbcon.c | 19 +++++++++++++++++++ drivers/video/fbdev/core/fbmem.c | 1 + include/linux/fbcon.h | 2 ++ 3 files changed, 22 insertions(+)
drivers/video/fbdev/core/fbcon.c +19 -0
@@ -2824,6 +2824,25 @@ int fbcon_mode_deleted(struct fb_info *ireturn found; } +static void fbcon_delete_mode (struct fb_videomode *m) +{ +struct fbcon_display *p; + +for (int i = first_fb_vc; i <= last_fb_vc; i++) { + p = &fb_display[i]; +if (p->mode == m) + p->mode =NULL ; + } +} + +void fbcon_delete_modelist (struct list_head *head) +{ +struct fb_modelist *modelist; + +list_for_each_entry (modelist, head, list) +fbcon_delete_mode (&modelist->mode); +} +#ifdef CONFIG_VT_HW_CONSOLE_BINDING static void fbcon_unbind (void ) {
drivers/video/fbdev/core/fbmem.c +1 -0
@@ -1030,6 +1030,7 @@ static void do_unregister_framebuffer(st fb_info->pixmap.addr =NULL ; } +fbcon_delete_modelist (&fb_info->modelist);fb_destroy_modelist (&fb_info->modelist); registered_fb[fb_info->node] =NULL ; num_registered_fb--;
include/linux/fbcon.h +2 -0
@@ -11,6 +11,7 @@ void fbcon_suspended(struct fb_info *infvoid fbcon_resumed (struct fb_info *info);int fbcon_mode_deleted (struct fb_info *info,struct fb_videomode *mode); +void fbcon_delete_modelist (struct list_head *head);void fbcon_new_modelist (struct fb_info *info);void fbcon_get_requirement (struct fb_info *info,struct fb_blit_caps *caps);
@@ -31,6 +32,7 @@ static inline void fbcon_suspended(strucstatic inline void fbcon_resumed (struct fb_info *info) {}static inline int fbcon_mode_deleted (struct fb_info *info,struct fb_videomode *mode) {return 0 ; } +static inline void fbcon_delete_modelist (struct list_head *head) {}static inline void fbcon_new_modelist (struct fb_info *info) {}static inline void fbcon_get_requirement (struct fb_info *info,struct fb_blit_caps *caps) {}
Greg Kroah-Hartman
maintainerPATCH 4/529 fbdev: atyfb: Check if pll_ops->init_pll failed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <[email protected]>
commit 7073c7fc8d8ba47194e5fc58fcafc0efe7586e9b upstream.
Actually check the return value from pll_ops->init_pll() as it can return an error.
If the card's BIOS didn't run because it's not the primary VGA card the fact that the xclk source is unsupported is printed as shown below but the driver continues on regardless and on my machine causes a hard lock up.
[ 61.470088] atyfb 0000:03:05.0: enabling device (0080 -> 0083) [ 61.476191] atyfb: using auxiliary register aperture [ 61.481239] atyfb: 3D RAGE XL (Mach64 GR, PCI-33) [0x4752 rev 0x27] [ 61.487569] atyfb: 512K SGRAM (1:1), 14.31818 MHz XTAL, 230 MHz PLL, 83 Mhz MCLK, 63 MHz XCLK [ 61.496112] atyfb: Unsupported xclk source: 5.
--- drivers/video/fbdev/aty/atyfb_base.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/video/fbdev/aty/atyfb_base.c +6 -2
@@ -2611,8 +2611,12 @@ static int aty_init(struct fb_info *info pr_cont("\n"); }#endif -if (par->pll_ops->init_pll) - par->pll_ops->init_pll (info, &par->pll); +if (par->pll_ops->init_pll) { + ret = par->pll_ops->init_pll (info, &par->pll); +if (ret) +return ret; + } +if (par->pll_ops->resume_pll) par->pll_ops->resume_pll (info, &par->pll);
Greg Kroah-Hartman
maintainerPATCH 5/529 ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuhao Jiang <[email protected]>
commit 8f067aa59430266386b83c18b983ca583faa6a11 upstream.
The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal.
If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight.
Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed.
--- drivers/acpi/acpi_video.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/acpi/acpi_video.c +3 -1
@@ -1952,8 +1952,10 @@ static void acpi_video_bus_remove_notifystruct acpi_video_device *dev;mutex_lock (&video->device_list_lock); -list_for_each_entry (dev, &video->video_device_list, entry) +list_for_each_entry (dev, &video->video_device_list, entry) {acpi_video_dev_remove_notify_handler (dev); +cancel_delayed_work_sync (&dev->switch_brightness_work); + }mutex_unlock (&video->device_list_lock);acpi_video_bus_stop_devices (video);
Greg Kroah-Hartman
maintainerPATCH 6/529 ACPI: button: Call input_free_device() on failing input device registration
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <[email protected]>
commit 20594cd104abaaabb676c7a2915b150ae5ff093d upstream.
Make acpi_button_add() call input_free_device() when input_register_device() fails as required according to the documentation of the latter.
--- drivers/acpi/button.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/acpi/button.c +3 -1
@@ -603,8 +603,10 @@ static int acpi_button_add(struct acpi_dinput_set_drvdata (input, device); error =input_register_device (input); -if (error) +if (error) { +input_free_device (input); goto err_remove_fs; + }switch (device->device_type) {case ACPI_BUS_TYPE_POWER_BUTTON :
Greg Kroah-Hartman
maintainerPATCH 7/529 fbdev: bitblit: bound-check glyph index in bit_putcs*
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junjie Cao <[email protected]>
commit 18c4ef4e765a798b47980555ed665d78b71aeadf upstream.
bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the built-in font array. Clamp the index to the actual glyph count before computing the address.
This fixes a global out-of-bounds read reported by syzbot.
--- drivers/video/fbdev/core/bitblit.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/video/fbdev/core/bitblit.c +12 -4
@@ -79,12 +79,16 @@ static inline void bit_putcs_aligned(str struct fb_image *image, u8 *buf, u8 *dst) { u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff; +unsigned int charcnt = vc->vc_font.charcount;u32 idx = vc->vc_font.width >>3 ;u8 *src;while (cnt--) { - src = vc->vc_font.data + (scr_readw (s++)& - charmask)*cellsize; +u16 ch =scr_readw (s++) & charmask; + +if (ch >= charcnt) + ch =0 ; + src = vc->vc_font.data + (unsigned int )ch * cellsize;if (attr) {update_attr (buf, src, attr, vc);
@@ -112,14 +116,18 @@ static inline void bit_putcs_unaligned(s u8 *dst) {u16 charmask = vc->vc_hi_font_mask ?0x1ff :0xff ; +unsigned int charcnt = vc->vc_font.charcount;u32 shift_low =0 , mod = vc->vc_font.width %8 ;u32 shift_high =8 ;u32 idx = vc->vc_font.width >>3 ;u8 *src;while (cnt--) { - src = vc->vc_font.data + (scr_readw (s++)& - charmask)*cellsize; +u16 ch =scr_readw (s++) & charmask; + +if (ch >= charcnt) + ch =0 ; + src = vc->vc_font.data + (unsigned int )ch * cellsize;if (attr) {update_attr (buf, src, attr, vc);
Greg Kroah-Hartman
maintainerPATCH 8/529 Bluetooth: rfcomm: fix modem control handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 91d35ec9b3956d6b3cf789c1593467e58855b03a upstream.
The RFCOMM driver confuses the local and remote modem control signals, which specifically means that the reported DTR and RTS state will instead reflect the remote end (i.e. DSR and CTS).
This issue dates back to the original driver (and a follow-on update) merged in 2002, which resulted in a non-standard implementation of TIOCMSET that allowed controlling also the TS07.10 IC and DV signals by mapping them to the RI and DCD input flags, while TIOCMGET failed to return the actual state of DTR and RTS.
Note that the bogus control of input signals in tiocmset() is just dead code as those flags will have been masked out by the tty layer since 2003.
--- net/bluetooth/rfcomm/tty.c | 26 +++++++++++--------------- 1 file changed, 11 insertions(+), 15 deletions(-)
net/bluetooth/rfcomm/tty.c +11 -15
@@ -651,8 +651,8 @@ static void rfcomm_dev_modem_status(strutty_port_tty_hangup (&dev->port, true); dev->modem_status = - ((v24_sig &RFCOMM_V24_RTC ) ? (TIOCM_DSR |TIOCM_DTR ) :0 ) | - ((v24_sig &RFCOMM_V24_RTR ) ? (TIOCM_RTS |TIOCM_CTS ) :0 ) | + ((v24_sig &RFCOMM_V24_RTC ) ?TIOCM_DSR :0 ) | + ((v24_sig &RFCOMM_V24_RTR ) ?TIOCM_CTS :0 ) | ((v24_sig &RFCOMM_V24_IC ) ?TIOCM_RI :0 ) | ((v24_sig &RFCOMM_V24_DV ) ?TIOCM_CD :0 ); }
@@ -1063,10 +1063,14 @@ static void rfcomm_tty_hangup(struct ttystatic int rfcomm_tty_tiocmget (struct tty_struct *tty) {struct rfcomm_dev *dev = tty->driver_data; +struct rfcomm_dlc *dlc = dev->dlc; +u8 v24_sig;BT_DBG ("tty %p dev %p" , tty, dev); -return dev->modem_status; +rfcomm_dlc_get_modem_status (dlc, &v24_sig); + +return (v24_sig & (TIOCM_DTR |TIOCM_RTS )) | dev->modem_status; }static int rfcomm_tty_tiocmset (struct tty_struct *tty,unsigned int set,unsigned int clear)
@@ -1079,23 +1083,15 @@ static int rfcomm_tty_tiocmset(struct ttrfcomm_dlc_get_modem_status (dlc, &v24_sig); -if (set &TIOCM_DSR || set &TIOCM_DTR ) +if (set &TIOCM_DTR ) v24_sig |=RFCOMM_V24_RTC ; -if (set &TIOCM_RTS || set &TIOCM_CTS ) +if (set &TIOCM_RTS ) v24_sig |=RFCOMM_V24_RTR ; -if (set &TIOCM_RI ) - v24_sig |=RFCOMM_V24_IC ; -if (set &TIOCM_CD ) - v24_sig |=RFCOMM_V24_DV ; -if (clear &TIOCM_DSR || clear &TIOCM_DTR ) +if (clear &TIOCM_DTR ) v24_sig &= ~RFCOMM_V24_RTC ; -if (clear &TIOCM_RTS || clear &TIOCM_CTS ) +if (clear &TIOCM_RTS ) v24_sig &= ~RFCOMM_V24_RTR ; -if (clear &TIOCM_RI ) - v24_sig &= ~RFCOMM_V24_IC ; -if (clear &TIOCM_CD ) - v24_sig &= ~RFCOMM_V24_DV ;rfcomm_dlc_set_modem_status (dlc, v24_sig);
Greg Kroah-Hartman
maintainerPATCH 9/529 wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gokul Sivakumar <[email protected]>
commit 3776c685ebe5f43e9060af06872661de55e80b9a upstream.
Currently, whenever there is a need to transmit an Action frame, the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to firmware. The P2P interfaces were available when wpa_supplicant is managing the wlan interface.
However, the P2P interfaces are not created/initialized when only hostapd is managing the wlan interface. And if hostapd receives an ANQP Query REQ Action frame even from an un-associated STA, the brcmfmac driver tries to use an uninitialized P2P vif pointer for sending the IOVAR to firmware. This NULL pointer dereferencing triggers a driver crash.
[ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [...] [ 1417.075188] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT) [...] [ 1417.075653] Call trace: [ 1417.075662] brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac] [ 1417.075738] brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac] [ 1417.075810] cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211] [ 1417.076067] nl80211_tx_mgmt+0x238/0x388 [cfg80211] [ 1417.076281] genl_family_rcv_msg_doit+0xe0/0x158 [ 1417.076302] genl_rcv_msg+0x220/0x2a0 [ 1417.076317] netlink_rcv_skb+0x68/0x140 [ 1417.076330] genl_rcv+0x40/0x60 [ 1417.076343] netlink_unicast+0x330/0x3b8 [ 1417.076357] netlink_sendmsg+0x19c/0x3f8 [ 1417.076370] __sock_sendmsg+0x64/0xc0 [ 1417.076391] ____sys_sendmsg+0x268/0x2a0 [ 1417.076408] ___sys_sendmsg+0xb8/0x118 [ 1417.076427] __sys_sendmsg+0x90/0xf8 [ 1417.076445] __arm64_sys_sendmsg+0x2c/0x40 [ 1417.076465] invoke_syscall+0x50/0x120 [ 1417.076486] el0_svc_common.constprop.0+0x48/0xf0 [ 1417.076506] do_el0_svc+0x24/0x38 [ 1417.076525] el0_svc+0x30/0x100 [ 1417.076548] el0t_64_sync_handler+0x100/0x130 [ 1417.076569] el0t_64_sync+0x190/0x198 [ 1417.076589] Code: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000)
Fix this, by always using the vif corresponding to the wdev on which the Action frame Transmission request was initiated by the userspace. This way, even if P2P vif is not available, the IOVAR is sent to firmware on AP vif and the ANQP Query RESP Action frame is transmitted without crashing the driver.
Move init_completion() for "send_af_done" from brcmf_p2p_create_p2pdev() to brcmf_p2p_attach(). Because the former function would not get executed when only hostapd is managing wlan interface, and it is not safe to do reinit_completion() later in brcmf_p2p_tx_action_frame(), without any prior init_completion().
And in the brcmf_p2p_tx_action_frame() function, the condition check for P2P Presence response frame is not needed, since the wpa_supplicant is properly sending the P2P Presense Response frame on the P2P-GO vif instead of the P2P-Device vif.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 - drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 28 ++++-------- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h | 3 - 3 files changed, 12 insertions(+), 22 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +1 -2
@@ -5594,8 +5594,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wipbrcmf_dbg (TRACE ,"Action frame, cookie=%lld, len=%d, freq=%d\n" , *cookie,le16_to_cpu (action_frame->len), freq); - ack =brcmf_p2p_send_action_frame (cfg,cfg_to_ndev (cfg), - af_params); + ack =brcmf_p2p_send_action_frame (vif->ifp, af_params);cfg80211_mgmt_tx_status (wdev, *cookie, buf, len, ack,GFP_KERNEL );
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c +10 -18
@@ -1529,6 +1529,7 @@ int brcmf_p2p_notify_action_tx_complete(/** * brcmf_p2p_tx_action_frame() - send action frame over fil. * +* @ifp: interface to transmit on. * @p2p: p2p info struct for vif. * @af_params: action frame data/info. *
@@ -1538,12 +1539,11 @@ int brcmf_p2p_notify_action_tx_complete(* The WLC_E_ACTION_FRAME_COMPLETE event will be received when the action * frame is transmitted. */ -static s32 brcmf_p2p_tx_action_frame (struct brcmf_p2p_info *p2p, +static s32 brcmf_p2p_tx_action_frame (struct brcmf_if *ifp, +struct brcmf_p2p_info *p2p,struct brcmf_fil_af_params_le *af_params) {struct brcmf_pub *drvr = p2p->cfg->pub; -struct brcmf_cfg80211_vif *vif; -struct brcmf_p2p_action_frame *p2p_af;s32 err =0 ;brcmf_dbg (TRACE ,"Enter\n" );
@@ -1552,14 +1552,7 @@ static s32 brcmf_p2p_tx_action_frame(strclear_bit (BRCMF_P2P_STATUS_ACTION_TX_COMPLETED , &p2p->status);clear_bit (BRCMF_P2P_STATUS_ACTION_TX_NOACK , &p2p->status); -/* check if it is a p2p_presence response */ - p2p_af = (struct brcmf_p2p_action_frame *)af_params->action_frame.data; -if (p2p_af->subtype ==P2P_AF_PRESENCE_RSP ) - vif = p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION ].vif; -else - vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE ].vif; - - err =brcmf_fil_bsscfg_data_set (vif->ifp,"actframe" , af_params, + err =brcmf_fil_bsscfg_data_set (ifp,"actframe" , af_params,sizeof (*af_params));if (err) {bphy_err (drvr," sending action frame has failed\n" );
@@ -1711,16 +1704,14 @@ static bool brcmf_p2p_check_dwell_overfl/** * brcmf_p2p_send_action_frame() - send action frame . * -* @cfg: driver private data for cfg80211 interface. -* @ndev: net device to transmit on. +* @ifp: interface to transmit on. * @af_params: configuration data for action frame. */ -bool brcmf_p2p_send_action_frame (struct brcmf_cfg80211_info *cfg, -struct net_device *ndev, +bool brcmf_p2p_send_action_frame (struct brcmf_if *ifp,struct brcmf_fil_af_params_le *af_params) { +struct brcmf_cfg80211_info *cfg = ifp->drvr->config;struct brcmf_p2p_info *p2p = &cfg->p2p; -struct brcmf_if *ifp =netdev_priv (ndev);struct brcmf_fil_action_frame_le *action_frame;struct brcmf_config_af_params config_af_params;struct afx_hdl *afx_hdl = &p2p->afx_hdl;
@@ -1857,7 +1848,7 @@ bool brcmf_p2p_send_action_frame(structif (af_params->channel)msleep (P2P_AF_RETRY_DELAY_TIME ); - ack = !brcmf_p2p_tx_action_frame (p2p, af_params); + ack = !brcmf_p2p_tx_action_frame (ifp, p2p, af_params); tx_retry++; dwell_overflow =brcmf_p2p_check_dwell_overflow (requested_dwell, dwell_jiffies);
@@ -2217,7 +2208,6 @@ static struct wireless_dev *brcmf_p2p_crWARN_ON (p2p_ifp->bsscfgidx != bsscfgidx); -init_completion (&p2p->send_af_done);INIT_WORK (&p2p->afx_hdl.afx_work, brcmf_p2p_afx_handler);init_completion (&p2p->afx_hdl.act_frm_scan);init_completion (&p2p->wait_next_af);
@@ -2513,6 +2503,8 @@ s32 brcmf_p2p_attach(struct brcmf_cfg802 pri_ifp =brcmf_get_ifp (cfg->pub,0 ); p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY ].vif = pri_ifp->vif; +init_completion (&p2p->send_af_done); +if (p2pdev_forced) { err_ptr =brcmf_p2p_create_p2pdev (p2p,NULL ,NULL );if (IS_ERR (err_ptr)) {
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h +1 -2
@@ -168,8 +168,7 @@ int brcmf_p2p_notify_action_frame_rx(strint brcmf_p2p_notify_action_tx_complete (struct brcmf_if *ifp,const struct brcmf_event_msg *e,void *data); -bool brcmf_p2p_send_action_frame (struct brcmf_cfg80211_info *cfg, -struct net_device *ndev, +bool brcmf_p2p_send_action_frame (struct brcmf_if *ifp,struct brcmf_fil_af_params_le *af_params);bool brcmf_p2p_scan_finding_common_channel (struct brcmf_cfg80211_info *cfg,struct brcmf_bss_info_le *bi);
Greg Kroah-Hartman
maintainerPATCH 10/529 fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fuchs <[email protected]>
commit 5f566c0ac51cd2474e47da68dbe719d3acf7d999 upstream.
Commit e24cca19babe ("sh: Kill off MAX_DMA_ADDRESS leftovers.") removed the define ONCHIP_NR_DMA_CHANNELS. So that the leftover reference needs to be replaced by CONFIG_NR_ONCHIP_DMA_CHANNELS to compile successfully with CONFIG_PVR2_DMA enabled.
--- drivers/video/fbdev/pvr2fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/pvr2fb.c +1 -1
@@ -192,7 +192,7 @@ static unsigned long pvr2fb_map;#ifdef CONFIG_PVR2_DMA static unsigned int shdma =PVR2_CASCADE_CHAN ; -static unsigned int pvr2dma =ONCHIP_NR_DMA_CHANNELS ; +static unsigned int pvr2dma =CONFIG_NR_ONCHIP_DMA_CHANNELS ;#endif static struct fb_videomode pvr2_modedb[] = {
Greg Kroah-Hartman
maintainerPATCH 11/529 fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit eb53368f8d6e2dfba84c8a94d245719bcf9ae270 upstream.
The of_find_node_by_name() function returns a device tree node with its reference count incremented. The caller is responsible for calling of_node_put() to release this reference when done.
Found via static analysis.
--- drivers/video/fbdev/valkyriefb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/video/fbdev/valkyriefb.c +2 -0
@@ -329,11 +329,13 @@ static int __init valkyriefb_init(void)if (of_address_to_resource (dp,0 , &r)) {printk (KERN_ERR "can't find address for valkyrie\n" ); +of_node_put (dp);return 0 ; } frame_buffer_phys = r.start; cmap_regs_phys = r.start +0x304000 ; + of_node_put(dp); }#endif /* ppc (!CONFIG_MAC) */
Greg Kroah-Hartman
maintainerPATCH 12/529 mptcp: drop bogus optimization in __mptcp_check_push()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit 27b0e701d3872ba59c5b579a9e8a02ea49ad3d3b upstream.
Accessing the transmit queue without owning the msk socket lock is inherently racy, hence __mptcp_check_push() could actually quit early even when there is pending data.
That in turn could cause unexpected tx lock and timeout.
Dropping the early check avoids the race, implicitly relaying on later tests under the relevant lock. With such change, all the other mptcp_send_head() call sites are now under the msk socket lock and we can additionally drop the now unneeded annotation on the transmit head pointer accesses.
--- net/mptcp/protocol.c | 11 ++++------- net/mptcp/protocol.h | 2 +- 2 files changed, 5 insertions(+), 8 deletions(-)
net/mptcp/protocol.c +4 -7
@@ -1044,7 +1044,7 @@ static void __mptcp_clean_una(struct socif (WARN_ON_ONCE (!msk->recovery))break ; -WRITE_ONCE (msk->first_pending,mptcp_send_next (sk)); + msk->first_pending =mptcp_send_next (sk); }dfrag_clear (sk, dfrag);
@@ -1588,7 +1588,7 @@ static int __subflow_push_pending(structmptcp_update_post_push (msk, dfrag, ret); } -WRITE_ONCE (msk->first_pending,mptcp_send_next (sk)); + msk->first_pending =mptcp_send_next (sk); if (msk->snd_burst <= 0 || !sk_stream_memory_free(ssk) ||
@@ -1900,7 +1900,7 @@ static int mptcp_sendmsg(struct sock *skget_page (dfrag->page);list_add_tail (&dfrag->list, &msk->rtx_queue);if (!msk->first_pending) -WRITE_ONCE (msk->first_pending, dfrag); + msk->first_pending = dfrag; } pr_debug("msk=%p dfrag at seq=%llu len=%u sent=%u new=%d\n", msk, dfrag->data_seq, dfrag->data_len, dfrag->already_sent,
@@ -2899,7 +2899,7 @@ static void __mptcp_clear_xmit(struct sostruct mptcp_sock *msk =mptcp_sk (sk);struct mptcp_data_frag *dtmp, *dfrag; -WRITE_ONCE (msk->first_pending,NULL ); + msk->first_pending =NULL ;list_for_each_entry_safe (dfrag, dtmp, &msk->rtx_queue, list)dfrag_clear (sk, dfrag); }
@@ -3456,9 +3456,6 @@ void __mptcp_data_acked(struct sock *sk)void __mptcp_check_push (struct sock *sk,struct sock *ssk) { -if (!mptcp_send_head (sk)) -return ; -if (!sock_owned_by_user (sk))__mptcp_subflow_push_pending (sk, ssk, false);else
net/mptcp/protocol.h +1 -1
@@ -379,7 +379,7 @@ static inline struct mptcp_data_frag *mp {const struct mptcp_sock *msk =mptcp_sk (sk); -return READ_ONCE (msk->first_pending); +return msk->first_pending; }static inline struct mptcp_data_frag *mptcp_send_next (struct sock *sk)
Greg Kroah-Hartman
maintainerPATCH 13/529 mptcp: restore window probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit a824084b98d8a1dbd6e85d0842a8eb5e73467f59 upstream.
Since commit 72377ab2d671 ("mptcp: more conservative check for zero probes") the MPTCP-level zero window probe check is always disabled, as the TCP-level write queue always contains at least the newly allocated skb.
Refine the relevant check tacking in account that the above condition and that such skb can have zero length.
--- net/mptcp/protocol.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/mptcp/protocol.c +6 -1
@@ -1335,7 +1335,12 @@ alloc_skb:if (copy ==0 ) {u64 snd_una =READ_ONCE (msk->snd_una); -if (snd_una != msk->snd_nxt ||tcp_write_queue_tail (ssk)) { +/* No need for zero probe if there are any data pending +* either at the msk or ssk level; skb is the current write +* queue tail and can be empty at this point. +*/ +if (snd_una != msk->snd_nxt || skb->len || + skb !=tcp_send_head (ssk)) {tcp_remove_empty_skb (ssk);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 14/529 ASoC: qdsp6: q6asm: do not sleep while atomic
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
commit fdbb53d318aa94a094434e5f226617f0eb1e8f22 upstream.
For some reason we ended up kfree between spinlock lock and unlock, which can sleep.
move the kfree out of spinlock section.
--- sound/soc/qcom/qdsp6/q6asm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/qcom/qdsp6/q6asm.c +1 -1
@@ -376,9 +376,9 @@ static void q6asm_audio_client_free_buf(spin_lock_irqsave (&ac->lock, flags); port->num_periods =0 ; +spin_unlock_irqrestore (&ac->lock, flags);kfree (port->buf); port->buf =NULL ; -spin_unlock_irqrestore (&ac->lock, flags); }/**
Greg Kroah-Hartman
maintainerPATCH 15/529 smb: client: fix potential cfid UAF in smb2_query_info_compound
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrique Carvalho <[email protected]>
commit 5c76f9961c170552c1d07c830b5e145475151600 upstream.
When smb2_query_info_compound() retries, a previously allocated cfid may have been freed in the first attempt.
Because cfid wasn't reset on replay, later cleanup could act on a stale pointer, leading to a potential use-after-free.
Reinitialize cfid to NULL under the replay label.
Example trace (trimmed):
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 11224 at ../lib/refcount.c:28 refcount_warn_saturate+0x9c/0x110 [...] RIP: 0010:refcount_warn_saturate+0x9c/0x110 [...] Call Trace: <TASK> smb2_query_info_compound+0x29c/0x5c0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] ? step_into+0x10d/0x690 ? __legitimize_path+0x28/0x60 smb2_queryfs+0x6a/0xf0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] smb311_queryfs+0x12d/0x140 [cifs f90b72658819bd21c94769b6a652029a07a7172f] ? kmem_cache_alloc+0x18a/0x340 ? getname_flags+0x46/0x1e0 cifs_statfs+0x9f/0x2b0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] statfs_by_dentry+0x67/0x90 vfs_statfs+0x16/0xd0 user_statfs+0x54/0xa0 __do_sys_statfs+0x20/0x50 do_syscall_64+0x58/0x80
--- fs/smb/client/smb2ops.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/smb/client/smb2ops.c +2 -1
@@ -2663,11 +2663,12 @@ smb2_query_info_compound(const unsignedstruct cifs_fid fid;int rc;__le16 *utf16_path; -struct cached_fid *cfid =NULL ; +struct cached_fid *cfid;int retries =0 , cur_sleep =1 ; replay_again:/* reinitialize for possible replay */ + cfid =NULL ; flags =CIFS_CP_CREATE_CLOSE_OP ; oplock =SMB2_OPLOCK_LEVEL_NONE ; server =cifs_pick_channel (ses);
Greg Kroah-Hartman
maintainerPATCH 16/529 x86/fpu: Ensure XFD state on signal delivery
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chang S. Bae <[email protected]>
commit 388eff894d6bc5f921e9bfff0e4b0ab2684a96e9 upstream.
Sean reported [1] the following splat when running KVM tests:
WARNING: CPU: 232 PID: 15391 at xfd_validate_state+0x65/0x70
Call Trace:
<TASK>
fpu__clear_user_states+0x9c/0x100
arch_do_signal_or_restart+0x142/0x210
exit_to_user_mode_loop+0x55/0x100
do_syscall_64+0x205/0x2c0
entry_SYSCALL_64_after_hwframe+0x4b/0x53Chao further identified [2] a reproducible scenario involving signal
delivery: a non-AMX task is preempted by an AMX-enabled task which modifies the XFD MSR.
When the non-AMX task resumes and reloads XSTATE with init values, a warning is triggered due to a mismatch between fpstate::xfd and the CPU's current XFD state. fpu__clear_user_states() does not currently re-synchronize the XFD state after such preemption.
Invoke xfd_update_state() which detects and corrects the mismatch if there is a dynamic feature.
This also benefits the sigreturn path, as fpu__restore_sig() may call fpu__clear_user_states() when the sigframe is inaccessible.
[ dhansen: minor changelog munging ]
--- arch/x86/kernel/fpu/core.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kernel/fpu/core.c +3 -0
@@ -757,6 +757,9 @@ void fpu__clear_user_states(struct fpu * !fpregs_state_valid(fpu, smp_processor_id()))os_xrstor_supervisor (fpu->fpstate); +/* Ensure XFD state is in sync before reloading XSTATE */ +xfd_update_state (fpu->fpstate); +/* Reset user states in registers. */ restore_fpregs_from_init_fpstate (XFEATURE_MASK_USER_RESTORE );
Greg Kroah-Hartman
maintainerPATCH 17/529 wifi: ath10k: Fix memory leak on unsupported WMI command
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <[email protected]>
[ Upstream commit 2e9c1da4ee9d0acfca2e0a3d78f3d8cb5802da1b ]
ath10k_wmi_cmd_send takes ownership of the passed buffer (skb) and has the responsibility to release it in case of error. This patch fixes missing free in case of early error due to unhandled WMI command ID.
Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1
--- drivers/net/wireless/ath/ath10k/wmi.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/ath/ath10k/wmi.c +1 -0
@@ -1936,6 +1936,7 @@ int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id)if (cmd_id ==WMI_CMD_UNSUPPORTED ) {ath10k_warn (ar,"wmi command %d is not supported by firmware\n" , cmd_id); +dev_kfree_skb_any (skb);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/529 wifi: ath11k: Add missing platform IDs for quirk table
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Pearson <[email protected]>
[ Upstream commit 0eb002c93c3b47f88244cecb1e356eaeab61a6bf ]
Lenovo platforms can come with one of two different IDs. The pm_quirk table was missing the second ID for each platform.
Add missing ID and some extra platform identification comments. Reported on https://bugzilla.kernel.org/show_bug.cgi?id=219196
Tested-on: P14s G4 AMD.
--- drivers/net/wireless/ath/ath11k/core.c | 54 +++++++++++++++++++++++--- 1 file changed, 48 insertions(+), 6 deletions(-)
drivers/net/wireless/ath/ath11k/core.c +48 -6
@@ -707,42 +707,84 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {static const struct dmi_system_id ath11k_pm_quirk_table[] = { { .driver_data = (void *)ATH11K_PM_WOW , - .matches = { + .matches = {/* X13 G4 AMD #1 */ +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"21J3" ), + }, + }, + { + .driver_data = (void *)ATH11K_PM_WOW , + .matches = {/* X13 G4 AMD #2 */ DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ),DMI_MATCH (DMI_PRODUCT_NAME ,"21J4" ), }, }, { .driver_data = (void *)ATH11K_PM_WOW , - .matches = { + .matches = {/* T14 G4 AMD #1 */ +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"21K3" ), + }, + }, + { + .driver_data = (void *)ATH11K_PM_WOW , + .matches = {/* T14 G4 AMD #2 */ DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ),DMI_MATCH (DMI_PRODUCT_NAME ,"21K4" ), }, }, { .driver_data = (void *)ATH11K_PM_WOW , - .matches = { + .matches = {/* P14s G4 AMD #1 */ +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"21K5" ), + }, + }, + { + .driver_data = (void *)ATH11K_PM_WOW , + .matches = {/* P14s G4 AMD #2 */ DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ),DMI_MATCH (DMI_PRODUCT_NAME ,"21K6" ), }, }, { .driver_data = (void *)ATH11K_PM_WOW , - .matches = { + .matches = {/* T16 G2 AMD #1 */ +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"21K7" ), + }, + }, + { + .driver_data = (void *)ATH11K_PM_WOW , + .matches = {/* T16 G2 AMD #2 */ DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ),DMI_MATCH (DMI_PRODUCT_NAME ,"21K8" ), }, }, { .driver_data = (void *)ATH11K_PM_WOW , - .matches = { + .matches = {/* P16s G2 AMD #1 */ +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"21K9" ), + }, + }, + { + .driver_data = (void *)ATH11K_PM_WOW , + .matches = {/* P16s G2 AMD #2 */ DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ),DMI_MATCH (DMI_PRODUCT_NAME ,"21KA" ), }, }, { .driver_data = (void *)ATH11K_PM_WOW , - .matches = { + .matches = {/* T14s G4 AMD #1 */ +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"21F8" ), + }, + }, + { + .driver_data = (void *)ATH11K_PM_WOW , + .matches = {/* T14s G4 AMD #2 */ DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ),DMI_MATCH (DMI_PRODUCT_NAME ,"21F9" ), },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/529 wifi: ath12k: free skb during idr cleanup callback
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karthik M <[email protected]>
[ Upstream commit 92282074e1d2e7b6da5c05fe38a7cc974187fe14 ]
ath12k just like ath11k [1] did not handle skb cleanup during idr cleanup callback. Both ath12k_mac_vif_txmgmt_idr_remove() and ath12k_mac_tx_mgmt_pending_free() performed idr cleanup and DMA unmapping for skb but only ath12k_mac_tx_mgmt_pending_free() freed skb. As a result, during vdev deletion a memory leak occurs.
Refactor all clean up steps into a new function. New function ath12k_mac_tx_mgmt_free() creates a centralized area where idr cleanup, DMA unmapping for skb and freeing skb is performed. Utilize skb pointer given by idr_remove(), instead of passed as a function argument because IDR will be protected by locking. This will prevent concurrent modification of the same IDR.
Now ath12k_mac_tx_mgmt_pending_free() and ath12k_mac_vif_txmgmt_idr_remove() call ath12k_mac_tx_mgmt_free().
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath12k/mac.c | 34 ++++++++++++++------------- 1 file changed, 18 insertions(+), 16 deletions(-)
drivers/net/wireless/ath/ath12k/mac.c +18 -16
@@ -4743,23 +4743,32 @@ static void ath12k_mgmt_over_wmi_tx_drop(struct ath12k *ar, struct sk_buff *skb)wake_up (&ar->txmgmt_empty_waitq); } -int ath12k_mac_tx_mgmt_pending_free (int buf_id,void *skb,void *ctx) +static void ath12k_mac_tx_mgmt_free (struct ath12k *ar,int buf_id) { -struct sk_buff *msdu = skb; +struct sk_buff *msdu;struct ieee80211_tx_info *info; -struct ath12k *ar = ctx; -struct ath12k_base *ab = ar->ab;spin_lock_bh (&ar->txmgmt_idr_lock); -idr_remove (&ar->txmgmt_idr, buf_id); + msdu =idr_remove (&ar->txmgmt_idr, buf_id);spin_unlock_bh (&ar->txmgmt_idr_lock); -dma_unmap_single (ab->dev,ATH12K_SKB_CB (msdu)->paddr, msdu->len, + +if (!msdu) +return ; + +dma_unmap_single (ar->ab->dev,ATH12K_SKB_CB (msdu)->paddr, msdu->len,DMA_TO_DEVICE ); info =IEEE80211_SKB_CB (msdu);memset (&info->status,0 ,sizeof (info->status)); -ath12k_mgmt_over_wmi_tx_drop (ar, skb); +ath12k_mgmt_over_wmi_tx_drop (ar, msdu); +} + +int ath12k_mac_tx_mgmt_pending_free (int buf_id,void *skb,void *ctx) +{ +struct ath12k *ar = ctx; + +ath12k_mac_tx_mgmt_free (ar, buf_id);return 0 ; }
@@ -4768,17 +4777,10 @@ static int ath12k_mac_vif_txmgmt_idr_remove(int buf_id, void *skb, void *ctx) {struct ieee80211_vif *vif = ctx;struct ath12k_skb_cb *skb_cb =ATH12K_SKB_CB (skb); -struct sk_buff *msdu = skb;struct ath12k *ar = skb_cb->ar; -struct ath12k_base *ab = ar->ab; -if (skb_cb->vif == vif) { -spin_lock_bh (&ar->txmgmt_idr_lock); -idr_remove (&ar->txmgmt_idr, buf_id); -spin_unlock_bh (&ar->txmgmt_idr_lock); -dma_unmap_single (ab->dev, skb_cb->paddr, msdu->len, -DMA_TO_DEVICE ); - } +if (skb_cb->vif == vif) +ath12k_mac_tx_mgmt_free (ar, buf_id);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/529 drm/msm/a6xx: Fix GMU firmware parser
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil P Oommen <[email protected]>
[ Upstream commit b4789aac9d3441d9f830f0a4022d8dc122d6cab3 ]
Current parser logic for GMU firmware assumes a dword aligned payload size for every block. This is not true for all GMU firmwares. So, fix this by using correct 'size' value in the calculation for the offset for the next block's header.
Patchwork: https://patchwork.freedesktop.org/patch/674040/
Message-ID: <[email protected]>
--- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/a6xx_gmu.c +4 -1
@@ -693,6 +693,9 @@ static bool fw_block_mem(struct a6xx_gmu_bo *bo, const struct block_header *blk)return true; } +#define NEXT_BLK (blk) \ + ((const struct block_header *)((const char *)(blk) + sizeof(*(blk)) + (blk)->size)) +static int a6xx_gmu_fw_load (struct a6xx_gmu *gmu) { struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
@@ -723,7 +726,7 @@ static int a6xx_gmu_fw_load(struct a6xx_gmu *gmu)for (blk = (const struct block_header *) fw_image->data; (const u8 *) blk < fw_image->data + fw_image->size; - blk = (const struct block_header *) &blk->data[blk->size >>2 ]) { + blk =NEXT_BLK (blk)) {if (blk->size ==0 )continue ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/529 ALSA: usb-audio: fix control pipe direction
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roy Vegard Ovesen <[email protected]>
[ Upstream commit 7963891f7c9c6f759cc9ab7da71406b4234f3dd6 ]
Since the requesttype has USB_DIR_OUT the pipe should be constructed with usb_sndctrlpipe().
--- sound/usb/mixer_s1810c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/mixer_s1810c.c +1 -1
@@ -181,7 +181,7 @@ snd_sc1810c_get_status_field(struct usb_device *dev, pkt_out.fields[SC1810C_STATE_F1_IDX ] =SC1810C_SET_STATE_F1 ; pkt_out.fields[SC1810C_STATE_F2_IDX ] =SC1810C_SET_STATE_F2 ; - ret =snd_usb_ctl_msg (dev,usb_rcvctrlpipe (dev,0 ), + ret =snd_usb_ctl_msg (dev,usb_sndctrlpipe (dev,0 ),SC1810C_SET_STATE_REQ ,SC1810C_SET_STATE_REQTYPE , (*seqnum),0 , &pkt_out,sizeof (pkt_out));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/529 bpf: Sync pending IRQ work before freeing ring buffer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Noorain Eqbal <[email protected]>
[ Upstream commit 4e9077638301816a7d73fa1e1b4c1db4a7e3b59c ]
Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes.
In the syzbot reproducer, a BPF program attached to sched_switch triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer is freed before this work executes, the irq_work thread may accesses freed memory.
Calling irq_work_sync(&rb->work) ensures that all pending irq_work complete before freeing the buffer.
--- kernel/bpf/ringbuf.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/bpf/ringbuf.c +2 -0
@@ -215,6 +215,8 @@ static struct bpf_map *ringbuf_map_alloc(union bpf_attr *attr)static void bpf_ringbuf_free (struct bpf_ringbuf *rb) { +irq_work_sync (&rb->work); +/* copy pages pointer and nr_pages to local variable, as we are going * to unmap rb itself with vunmap() below */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/529 scsi: ufs: core: Initialize value of an attribute returned by uic cmd
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wonkon Kim <[email protected]>
[ Upstream commit 6fe4c679dde3075cb481beb3945269bb2ef8b19a ]
If ufshcd_send_cmd() fails, *mib_val may have a garbage value. It can get an unintended value of an attribute.
Make ufshcd_dme_get_attr() always initialize *mib_val.
--- drivers/ufs/core/ufshcd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/ufs/core/ufshcd.c +2 -2
@@ -4176,8 +4176,8 @@ int ufshcd_dme_get_attr(struct ufs_hba *hba, u32 attr_sel, get,UIC_GET_ATTR_ID (attr_sel), UFS_UIC_COMMAND_RETRIES - retries); -if (mib_val && !ret) - *mib_val = uic_cmd.argument3; +if (mib_val) + *mib_val = ret ==0 ? uic_cmd.argument3 :0 ;if (peer && (hba->quirks &UFSHCD_QUIRK_DME_PEER_ACCESS_AUTO_MODE ) && pwr_mode_change)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/529 bpf: Do not audit capability check in do_jit()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Mosnacek <[email protected]>
[ Upstream commit 881a9c9cb7856b24e390fad9f59acfd73b98b3b2 ]
The failure of this check only results in a security mitigation being applied, slightly affecting performance of the compiled BPF program. It doesn't result in a failed syscall, an thus auditing a failed LSM permission check for it is unwanted. For example with SELinux, it causes a denial to be reported for confined processes running as root, which tends to be flagged as a problem to be fixed in the policy. Yet dontauditing or allowing CAP_SYS_ADMIN to the domain may not be desirable, as it would allow/silence also other checks - either going against the principle of least privilege or making debugging potentially harder.
Fix it by changing it from capable() to ns_capable_noaudit(), which instructs the LSMs to not audit the resulting denials.
--- arch/x86/net/bpf_jit_comp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/net/bpf_jit_comp.c +1 -1
@@ -1995,7 +1995,7 @@ st: if (is_imm8(insn->off)) ctx->cleanup_addr = proglen;if (bpf_prog_was_classic (bpf_prog) && - !capable (CAP_SYS_ADMIN )) { + !ns_capable_noaudit (&init_user_ns,CAP_SYS_ADMIN )) {u8 *ip = image + addrs[i -1 ];if (emit_spectre_bhb_barrier (&prog, ip, bpf_prog))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/529 crypto: aspeed-acry - Convert to platform remove callback returning void
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 8819da7e685008de2c1926c067a388b1ecaeb8aa ]
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks.
To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove().
Trivially convert this driver from always returning zero in the remove callback to the void returning variant.
Stable-dep-of: 3c9bf72cc1ce ("crypto: aspeed - fix double free caused by devm")
--- drivers/crypto/aspeed/aspeed-acry.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/crypto/aspeed/aspeed-acry.c +2 -4
@@ -794,7 +794,7 @@ static int aspeed_acry_probe(struct platform_device *pdev)return rc; } -static int aspeed_acry_remove (struct platform_device *pdev) +static void aspeed_acry_remove (struct platform_device *pdev) {struct aspeed_acry_dev *acry_dev =platform_get_drvdata (pdev);
@@ -802,15 +802,13 @@ static int aspeed_acry_remove(struct platform_device *pdev)crypto_engine_exit (acry_dev->crypt_engine_rsa);tasklet_kill (&acry_dev->done_task);clk_disable_unprepare (acry_dev->clk); - -return 0 ; }MODULE_DEVICE_TABLE (of, aspeed_acry_of_matches);static struct platform_driver aspeed_acry_driver = { .probe = aspeed_acry_probe, - .remove = aspeed_acry_remove, + .remove_new = aspeed_acry_remove, .driver = { .name =KBUILD_MODNAME , .of_match_table = aspeed_acry_of_matches,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/529 crypto: aspeed - fix double free caused by devm
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 3c9bf72cc1ced1297b235f9422d62b613a3fdae9 ]
The clock obtained via devm_clk_get_enabled() is automatically managed by devres and will be disabled and freed on driver detach. Manually calling clk_disable_unprepare() in error path and remove function causes double free.
Remove the manual clock cleanup in both aspeed_acry_probe()'s error path and aspeed_acry_remove().
--- drivers/crypto/aspeed/aspeed-acry.c | 2 -- 1 file changed, 2 deletions(-)
drivers/crypto/aspeed/aspeed-acry.c +0 -2
@@ -789,7 +789,6 @@ static int aspeed_acry_probe(struct platform_device *pdev) err_engine_rsa_start:crypto_engine_exit (acry_dev->crypt_engine_rsa); clk_exit: -clk_disable_unprepare (acry_dev->clk);return rc; }
@@ -801,7 +800,6 @@ static void aspeed_acry_remove(struct platform_device *pdev)aspeed_acry_unregister (acry_dev);crypto_engine_exit (acry_dev->crypt_engine_rsa);tasklet_kill (&acry_dev->done_task); -clk_disable_unprepare (acry_dev->clk); }MODULE_DEVICE_TABLE (of, aspeed_acry_of_matches);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/529 ASoC: Intel: avs: Unprepare a stream when XRUN occurs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cezary Rojewski <[email protected]>
[ Upstream commit cfca1637bc2b6b1e4f191d2f0b25f12402fbbb26 ]
The pcm->prepare() function may be called multiple times in a row by the userspace, as mentioned in the documentation. The driver shall take that into account and prevent redundancy. However, the exact same function is called during XRUNs and in such case, the particular stream shall be reset and setup anew.
--- sound/soc/intel/avs/pcm.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/intel/avs/pcm.c +2 -0
@@ -611,6 +611,8 @@ static int avs_dai_fe_prepare(struct snd_pcm_substream *substream, struct snd_so data =snd_soc_dai_get_dma_data (dai, substream); host_stream = data->host_stream; +if (runtime->state ==SNDRV_PCM_STATE_XRUN ) +hdac_stream (host_stream)->prepared = false;if (hdac_stream (host_stream)->prepared)return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/529 ASoC: fsl_sai: fix bit order for DSD format
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit d9fbe5b0bf7e2d1e20d53e4e2274f9f61bdcca98 ]
The DSD little endian format requires the msb first, because oldest bit is in msb.
found this issue by testing with pipewire.
--- sound/soc/fsl/fsl_sai.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/soc/fsl/fsl_sai.c +1 -2
@@ -322,7 +322,6 @@ static int fsl_sai_set_dai_fmt_tr(struct snd_soc_dai *cpu_dai,break ;case SND_SOC_DAIFMT_PDM : val_cr2 |=FSL_SAI_CR2_BCP ; - val_cr4 &= ~FSL_SAI_CR4_MF ; sai->is_pdm_mode = true;break ;case SND_SOC_DAIFMT_RIGHT_J :
@@ -597,7 +596,7 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream, val_cr5 |=FSL_SAI_CR5_WNW (slot_width); val_cr5 |=FSL_SAI_CR5_W0W (slot_width); -if (sai->is_lsb_first || sai->is_pdm_mode) +if (sai->is_lsb_first) val_cr5 |=FSL_SAI_CR5_FBT (0 );else val_cr5 |=FSL_SAI_CR5_FBT (word_width -1 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/529 libbpf: Fix powerpcs stack register definition in bpf_tracing.h
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit 7221b9caf84b3294688228a19273d74ea19a2ee4 ]
retsnoop's build on powerpc (ppc64le) architecture ([0]) failed due to wrong definition of PT_REGS_SP() macro. Looking at powerpc's implementation of stack unwinding in perf_callchain_user_64() clearly shows that stack pointer register is gpr[1].
Fix libbpf's definition of __PT_SP_REG for powerpc to fix all this.
[0] https://kojipkgs.fedoraproject.org/work/tasks/1544/137921544/build.log
--- tools/lib/bpf/bpf_tracing.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/lib/bpf/bpf_tracing.h +1 -1
@@ -311,7 +311,7 @@ struct pt_regs___arm64 {#define __PT_RET_REG regs[31]#define __PT_FP_REG __unsupported__#define __PT_RC_REG gpr[3] -#define __PT_SP_REG sp +#define __PT_SP_REG gpr[1]#define __PT_IP_REG nip#elif defined(bpf_target_sparc)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/529 usbnet: Prevents free active kevent
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Xu <[email protected]>
[ Upstream commit 420c84c330d1688b8c764479e5738bbdbf0a33de ]
The root cause of this issue are:
1. When probing the usbnet device, executing usbnet_link_change(dev, 0, 0); put the kevent work in global workqueue. However, the kevent has not yet been scheduled when the usbnet device is unregistered. Therefore, executing free_netdev() results in the "free active object (kevent)" error reported here.
2. Another factor is that when calling usbnet_disconnect()->unregister_netdev(), if the usbnet device is up, ndo_stop() is executed to cancel the kevent. However, because the device is not up, ndo_stop() is not executed.
The solution to this problem is to cancel the kevent before executing free_netdev().
--- drivers/net/usb/usbnet.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/usbnet.c +2 -0
@@ -1650,6 +1650,8 @@ void usbnet_disconnect (struct usb_interface *intf) net = dev->net;unregister_netdev (net); +cancel_work_sync (&dev->kevent); +while ((urb =usb_get_from_anchor (&dev->deferred))) {dev_kfree_skb (urb->context);kfree (urb->sg);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/529 Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <[email protected]>
[ Upstream commit 09b0cd1297b4dbfe736aeaa0ceeab2265f47f772 ]
hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and "UAF".
Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently.
--- net/bluetooth/hci_sync.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
net/bluetooth/hci_sync.c +9 -3
@@ -881,11 +881,17 @@ bool hci_cmd_sync_dequeue_once(struct hci_dev *hdev, {struct hci_cmd_sync_work_entry *entry; - entry =hci_cmd_sync_lookup_entry (hdev, func, data, destroy); -if (!entry) +mutex_lock (&hdev->cmd_sync_work_lock); + + entry =_hci_cmd_sync_lookup_entry (hdev, func, data, destroy); +if (!entry) { +mutex_unlock (&hdev->cmd_sync_work_lock);return false; + } -hci_cmd_sync_cancel_entry (hdev, entry); +_hci_cmd_sync_cancel_entry (hdev, entry, -ECANCELED ); + +mutex_unlock (&hdev->cmd_sync_work_lock);return true; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/529 Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lu <[email protected]>
[ Upstream commit 77343b8b4f87560f8f03e77b98a81ff3a147b262 ]
This patch adds logic to handle power management control when the Bluetooth function is closed during the SDIO reset sequence.
Specifically, if BT is closed before reset, the driver enables the SDIO function and sets driver pmctrl. After reset, if BT remains closed, the driver sets firmware pmctrl and disables the SDIO function.
These changes ensure proper power management and device state consistency across the reset flow.
--- drivers/bluetooth/btmtksdio.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/bluetooth/btmtksdio.c +12 -0
@@ -1257,6 +1257,12 @@ static void btmtksdio_cmd_timeout(struct hci_dev *hdev)sdio_claim_host (bdev->func); +/* set drv_pmctrl if BT is closed before doing reset */ +if (!test_bit (BTMTKSDIO_FUNC_ENABLED , &bdev->tx_state)) { +sdio_enable_func (bdev->func); +btmtksdio_drv_pmctrl (bdev); + } +sdio_writel (bdev->func,C_INT_EN_CLR ,MTK_REG_CHLPCR ,NULL );skb_queue_purge (&bdev->txq);cancel_work_sync (&bdev->txrx_work);
@@ -1272,6 +1278,12 @@ static void btmtksdio_cmd_timeout(struct hci_dev *hdev) goto err; } +/* set fw_pmctrl back if BT is closed after doing reset */ +if (!test_bit (BTMTKSDIO_FUNC_ENABLED , &bdev->tx_state)) { +btmtksdio_fw_pmctrl (bdev); +sdio_disable_func (bdev->func); + } +clear_bit (BTMTKSDIO_PATCH_ENABLED , &bdev->tx_state); err:sdio_release_host (bdev->func);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/529 Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 0d92808024b4e9868cef68d16f121d509843e80e ]
This fixes the state tracking of advertisement set/instance 0x00 which is considered a legacy instance and is not tracked individually by adv_instances list, previously it was assumed that hci_dev itself would track it via HCI_LE_ADV but that is a global state not specifc to instance 0x00, so to fix it a new flag is introduced that only tracks the state of instance 0x00.
--- include/net/bluetooth/hci.h | 1 + net/bluetooth/hci_event.c | 4 ++++ net/bluetooth/hci_sync.c | 5 ++--- 3 files changed, 7 insertions(+), 3 deletions(-)
include/net/bluetooth/hci.h +1 -0
@@ -392,6 +392,7 @@ enum {HCI_USER_CHANNEL ,HCI_EXT_CONFIGURED ,HCI_LE_ADV , +HCI_LE_ADV_0 ,HCI_LE_PER_ADV ,HCI_LE_SCAN , HCI_SSP_ENABLED,
net/bluetooth/hci_event.c +4 -0
@@ -1598,6 +1598,8 @@ static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data,if (adv && !adv->periodic) adv->enabled = true; +else if (!set->handle) +hci_dev_set_flag (hdev,HCI_LE_ADV_0 ); conn =hci_lookup_le_connect (hdev);if (conn)
@@ -1608,6 +1610,8 @@ static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data,if (cp->num_of_sets) {if (adv) adv->enabled = false; +else if (!set->handle) +hci_dev_clear_flag (hdev,HCI_LE_ADV_0 );/* If just one instance was disabled check if there are * any other instance enabled before clearing HCI_LE_ADV
net/bluetooth/hci_sync.c +2 -3
@@ -2651,9 +2651,8 @@ static int hci_resume_advertising_sync(struct hci_dev *hdev)/* If current advertising instance is set to instance 0x00 * then we need to re-enable it. */ -if (!hdev->cur_adv_instance) - err =hci_enable_ext_advertising_sync (hdev, - hdev->cur_adv_instance); +if (hci_dev_test_and_clear_flag (hdev,HCI_LE_ADV_0 )) + err =hci_enable_ext_advertising_sync (hdev,0x00 ); }else {/* Schedule for most recent instance to be restarted and begin * the software rotation loop
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/529 Bluetooth: ISO: Fix another instance of dst_type handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit c403da5e98b04a2aec9cfb25cbeeb28d7ce29975 ]
Socket dst_type cannot be directly assigned to hci_conn->type since there domain is different which may lead to the wrong address type being used.
--- net/bluetooth/iso.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/bluetooth/iso.c +7 -1
@@ -1782,7 +1782,13 @@ static void iso_conn_ready(struct iso_conn *conn) }bacpy (&iso_pi (sk)->dst, &hcon->dst); -iso_pi (sk)->dst_type = hcon->dst_type; + +/* Convert from HCI to three-value type */ +if (hcon->dst_type ==ADDR_LE_DEV_PUBLIC ) +iso_pi (sk)->dst_type =BDADDR_LE_PUBLIC ; +else +iso_pi (sk)->dst_type =BDADDR_LE_RANDOM ; +iso_pi (sk)->sync_handle =iso_pi (parent)->sync_handle;memcpy (iso_pi (sk)->base,iso_pi (parent)->base,iso_pi (parent)->base_len);iso_pi (sk)->base_len =iso_pi (parent)->base_len;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/529 Bluetooth: hci_core: Fix tracking of periodic advertisement
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 751463ceefc3397566d03c8b64ef4a77f5fd88ac ]
Periodic advertising enabled flag cannot be tracked by the enabled flag since advertising and periodic advertising each can be enabled/disabled separately from one another causing the states to be inconsistent when for example an advertising set is disabled its enabled flag is set to false which is then used for periodic which has not being disabled.
--- include/net/bluetooth/hci_core.h | 1 + net/bluetooth/hci_event.c | 7 +++++-- net/bluetooth/hci_sync.c | 4 ++-- 3 files changed, 8 insertions(+), 4 deletions(-)
include/net/bluetooth/hci_core.h +1 -0
@@ -240,6 +240,7 @@ struct adv_info {bool enabled;bool pending;bool periodic; +bool periodic_enabled;__u8 mesh;__u8 instance;__u32 flags;
net/bluetooth/hci_event.c +5 -2
@@ -1596,7 +1596,7 @@ static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data,hci_dev_set_flag (hdev,HCI_LE_ADV ); -if (adv && !adv->periodic) +if (adv) adv->enabled = true;else if (!set->handle)hci_dev_set_flag (hdev,HCI_LE_ADV_0 );
@@ -3953,8 +3953,11 @@ static u8 hci_cc_le_set_per_adv_enable(struct hci_dev *hdev, void *data,hci_dev_set_flag (hdev,HCI_LE_PER_ADV );if (adv) - adv->enabled = true; + adv->periodic_enabled = true; }else { +if (adv) + adv->periodic_enabled = false; +/* If just one instance was disabled check if there are * any other instance enabled before clearing HCI_LE_PER_ADV. * The current periodic adv instance will be marked as
net/bluetooth/hci_sync.c +2 -2
@@ -1631,7 +1631,7 @@ int hci_disable_per_advertising_sync(struct hci_dev *hdev, u8 instance)/* If periodic advertising already disabled there is nothing to do. */ adv =hci_find_adv_instance (hdev, instance); -if (!adv || !adv->periodic || !adv->enabled) +if (!adv || !adv->periodic_enabled)return 0 ;memset (&cp,0 ,sizeof (cp));
@@ -1700,7 +1700,7 @@ static int hci_enable_per_advertising_sync(struct hci_dev *hdev, u8 instance)/* If periodic advertising already enabled there is nothing to do. */ adv =hci_find_adv_instance (hdev, instance); -if (adv && adv->periodic && adv->enabled) +if (adv && adv->periodic_enabled)return 0 ;memset (&cp,0 ,sizeof (cp));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/529 drm/etnaviv: fix flush sequence logic
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomeu Vizoso <[email protected]>
[ Upstream commit a042beac6e6f8ac1e923784cfff98b47cbabb185 ]
The current logic uses the flush sequence from the current address space. This is harmless when deducing the flush requirements for the current submit, as either the incoming address space is the same one as the currently active one or we switch context, in which case the flush is unconditional.
However, this sequence is also stored as the current flush sequence of the GPU. If we switch context the stored flush sequence will no longer belong to the currently active address space. This incoherency can then cause missed flushes, resulting in translation errors.
--- drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/etnaviv/etnaviv_buffer.c +1 -1
@@ -347,7 +347,7 @@ void etnaviv_buffer_queue(struct etnaviv_gpu *gpu, u32 exec_state,u32 link_target, link_dwords;bool switch_context = gpu->exec_state != exec_state;bool switch_mmu_context = gpu->mmu_context != mmu_context; -unsigned int new_flush_seq =READ_ONCE (gpu->mmu_context->flush_seq); +unsigned int new_flush_seq =READ_ONCE (mmu_context->flush_seq);bool need_flush = switch_mmu_context || gpu->flush_seq != new_flush_seq;bool has_blt = !!(gpu->identity.minor_features5 & chipMinorFeatures5_BLT_ENGINE);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/529 net: hns3: return error code when function fails
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jijie Shao <[email protected]>
[ Upstream commit 03ca7c8c42be913529eb9f188278114430c6abbd ]
Currently, in hclge_mii_ioctl(), the operation to read the PHY register (SIOCGMIIREG) always returns 0.
This patch changes the return type of hclge_read_phy_reg(), returning an error code when the function fails.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 +-- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c | 9 ++++++--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h | 2 +- 3 files changed, 8 insertions(+), 6 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +1 -2
@@ -9346,8 +9346,7 @@ static int hclge_mii_ioctl(struct hclge_dev *hdev, struct ifreq *ifr, int cmd)/* this command reads phy id and register at the same time */ fallthrough;case SIOCGMIIREG : - data->val_out =hclge_read_phy_reg (hdev, data->reg_num); -return 0 ; +return hclge_read_phy_reg (hdev, data->reg_num, &data->val_out);case SIOCSMIIREG :return hclge_write_phy_reg (hdev, data->reg_num, data->val_in);
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c +6 -3
@@ -274,7 +274,7 @@ void hclge_mac_stop_phy(struct hclge_dev *hdev)phy_stop (phydev); } -u16 hclge_read_phy_reg (struct hclge_dev *hdev,u16 reg_addr) +int hclge_read_phy_reg (struct hclge_dev *hdev,u16 reg_addr,u16 *val) {struct hclge_phy_reg_cmd *req;struct hclge_desc desc;
@@ -286,11 +286,14 @@ u16 hclge_read_phy_reg(struct hclge_dev *hdev, u16 reg_addr) req->reg_addr =cpu_to_le16 (reg_addr); ret =hclge_cmd_send (&hdev->hw, &desc,1 ); -if (ret) +if (ret) {dev_err (&hdev->pdev->dev,"failed to read phy reg, ret = %d.\n" , ret); +return ret; + } -return le16_to_cpu (req->reg_val); + *val =le16_to_cpu (req->reg_val); +return 0 ; }int hclge_write_phy_reg (struct hclge_dev *hdev,u16 reg_addr,u16 val)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h +1 -1
@@ -13,7 +13,7 @@ int hclge_mac_connect_phy(struct hnae3_handle *handle);void hclge_mac_disconnect_phy (struct hnae3_handle *handle);void hclge_mac_start_phy (struct hclge_dev *hdev);void hclge_mac_stop_phy (struct hclge_dev *hdev); -u16 hclge_read_phy_reg (struct hclge_dev *hdev,u16 reg_addr); +int hclge_read_phy_reg (struct hclge_dev *hdev,u16 reg_addr,u16 *val);int hclge_write_phy_reg (struct hclge_dev *hdev,u16 reg_addr,u16 val);#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/529 sfc: fix potential memory leak in efx_mae_process_mport()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 46a499aaf8c27476fd05e800f3e947bfd71aa724 ]
In efx_mae_enumerate_mports(), memory allocated for mae_mport_desc is passed as a argument to efx_mae_process_mport(), but when the error path in efx_mae_process_mport() gets executed, the memory allocated for desc gets leaked.
Fix that by freeing the memory allocation before returning error.
--- drivers/net/ethernet/sfc/mae.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/sfc/mae.c +4 -0
@@ -1101,6 +1101,9 @@ void efx_mae_remove_mport(void *desc, void *arg)kfree (mport); } +/* +* Takes ownership of @desc, even if it returns an error +*/ static int efx_mae_process_mport (struct efx_nic *efx,struct mae_mport_desc *desc) {
@@ -1111,6 +1114,7 @@ static int efx_mae_process_mport(struct efx_nic *efx,if (!IS_ERR_OR_NULL (mport)) {netif_err (efx, drv, efx->net_dev,"mport with id %u does exist!!!\n" , desc->mport_id); +kfree (desc);return -EEXIST ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/529 drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
[ Upstream commit 238d468d3ed18a324bb9d8c99f18c665dbac0511 ]
'table_index' is a variable defined by the smu driver (kmd) 'table_id' is a variable defined by the hw smu (pmfw)
This code should use table_index as a bounds check.
--- drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c +1 -1
@@ -870,7 +870,7 @@ int smu_cmn_update_table(struct smu_context *smu, table_index);uint32_t table_size;int ret =0 ; -if (!table_data || table_id >=SMU_TABLE_COUNT || table_id <0 ) +if (!table_data || table_index >=SMU_TABLE_COUNT || table_id <0 )return -EINVAL ; table_size = smu_table->tables[table_index].size;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/529 drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Smith <[email protected]>
[ Upstream commit 07a13f913c291d6ec72ee4fc848d13ecfdc0e705 ]
Previously this was initialized with zero which represented PCIe Gen 1.0 instead of using the
maximum value from the speed table which is the behaviour of all other smumgr implementations.
--- drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c +1 -1
@@ -2024,7 +2024,7 @@ static int fiji_init_smc_table(struct pp_hwmgr *hwmgr) table->VoltageResponseTime =0 ; table->PhaseResponseTime =0 ; table->MemoryThermThrottleEnable =1 ; - table->PCIeBootLinkLevel =0 ;/* 0:Gen1 1:Gen2 2:Gen3*/ + table->PCIeBootLinkLevel = (uint8_t ) (data->dpm_table.pcie_speed_table.count); table->PCIeGenInterval =1 ; table->VRConfig =0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/529 drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Smith <[email protected]>
[ Upstream commit 501672e3c1576aa9a8364144213c77b98a31a42c ]
Previously this was initialized with zero which represented PCIe Gen 1.0 instead of using the
maximum value from the speed table which is the behaviour of all other smumgr implementations.
--- drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c +1 -1
@@ -2028,7 +2028,7 @@ static int iceland_init_smc_table(struct pp_hwmgr *hwmgr) table->VoltageResponseTime =0 ; table->PhaseResponseTime =0 ; table->MemoryThermThrottleEnable =1 ; - table->PCIeBootLinkLevel =0 ; + table->PCIeBootLinkLevel = (uint8_t ) (data->dpm_table.pcie_speed_table.count); table->PCIeGenInterval =1 ; result =iceland_populate_smc_svi2_config (hwmgr, table);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/529 block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit 12a1c9353c47c0fb3464eba2d78cdf649dee1cf7 upstream.
REQ_OP_ZONE_RESET_ALL is a zone management request. Fix op_is_zone_mgmt() to return true for that operation, like it already does for REQ_OP_ZONE_RESET.
While no problems were reported without this fix, this change allows strengthening checks in various block device drivers (scsi sd, virtioblk, DM) where op_is_zone_mgmt() is used to verify that a zone management command is not being issued to a regular block device.
--- include/linux/blk_types.h | 1 + 1 file changed, 1 insertion(+)
include/linux/blk_types.h +1 -0
@@ -517,6 +517,7 @@ static inline bool op_is_zone_mgmt(enum {switch (op &REQ_OP_MASK ) {case REQ_OP_ZONE_RESET : +case REQ_OP_ZONE_RESET_ALL :case REQ_OP_ZONE_OPEN :case REQ_OP_ZONE_CLOSE :case REQ_OP_ZONE_FINISH :
Greg Kroah-Hartman
maintainerPATCH 43/529 block: make REQ_OP_ZONE_OPEN a write operation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit 19de03b312d69a7e9bacb51c806c6e3f4207376c upstream.
A REQ_OP_OPEN_ZONE request changes the condition of a sequential zone of a zoned block device to the explicitly open condition (BLK_ZONE_COND_EXP_OPEN). As such, it should be considered a write operation.
Change this operation code to be an odd number to reflect this. The following operation numbers are changed to keep the numbering compact.
No problems were reported without this change as this operation has no data. However, this unifies the zone operation to reflect that they modify the device state and also allows strengthening checks in the block layer, e.g. checking if this operation is not issued against a read-only device.
--- include/linux/blk_types.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
include/linux/blk_types.h +5 -5
@@ -384,15 +384,15 @@ enum req_op {/* write the zero filled sector many times */ REQ_OP_WRITE_ZEROES = (__force blk_opf_t )9 ,/* Open a zone */ -REQ_OP_ZONE_OPEN = (__force blk_opf_t )10 , +REQ_OP_ZONE_OPEN = (__force blk_opf_t )11 ,/* Close a zone */ -REQ_OP_ZONE_CLOSE = (__force blk_opf_t )11 , +REQ_OP_ZONE_CLOSE = (__force blk_opf_t )13 ,/* Transition a zone to full */ -REQ_OP_ZONE_FINISH = (__force blk_opf_t )13 , +REQ_OP_ZONE_FINISH = (__force blk_opf_t )15 ,/* reset a zone write pointer */ -REQ_OP_ZONE_RESET = (__force blk_opf_t )15 , +REQ_OP_ZONE_RESET = (__force blk_opf_t )17 ,/* reset all the zone present on the device */ -REQ_OP_ZONE_RESET_ALL = (__force blk_opf_t )17 , +REQ_OP_ZONE_RESET_ALL = (__force blk_opf_t )19 ,/* Driver private requests */ REQ_OP_DRV_IN = (__force blk_opf_t)34,
Greg Kroah-Hartman
maintainerPATCH 44/529 regmap: slimbus: fix bus_context pointer in regmap init calls
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Klimov <[email protected]>
commit 434f7349a1f00618a620b316f091bd13a12bc8d2 upstream.
Commit 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()") revealed the problem in the slimbus regmap. That commit breaks audio playback, for instance, on sdm845 Thundercomm Dragonboard 845c board:
Unable to handle kernel paging request at virtual address ffff8000847cbad4 ... CPU: 5 UID: 0 PID: 776 Comm: aplay Not tainted 6.18.0-rc1-00028-g7ea30958b305 #11 PREEMPT Hardware name: Thundercomm Dragonboard 845c (DT) ... Call trace: slim_xfer_msg+0x24/0x1ac [slimbus] (P) slim_read+0x48/0x74 [slimbus] regmap_slimbus_read+0x18/0x24 [regmap_slimbus] _regmap_raw_read+0xe8/0x174 _regmap_bus_read+0x44/0x80 _regmap_read+0x60/0xd8 _regmap_update_bits+0xf4/0x140 _regmap_select_page+0xa8/0x124 _regmap_raw_write_impl+0x3b8/0x65c _regmap_bus_raw_write+0x60/0x80 _regmap_write+0x58/0xc0 regmap_write+0x4c/0x80 wcd934x_hw_params+0x494/0x8b8 [snd_soc_wcd934x] snd_soc_dai_hw_params+0x3c/0x7c [snd_soc_core] __soc_pcm_hw_params+0x22c/0x634 [snd_soc_core] dpcm_be_dai_hw_params+0x1d4/0x38c [snd_soc_core] dpcm_fe_dai_hw_params+0x9c/0x17c [snd_soc_core] snd_pcm_hw_params+0x124/0x464 [snd_pcm] snd_pcm_common_ioctl+0x110c/0x1820 [snd_pcm] snd_pcm_ioctl+0x34/0x4c [snd_pcm] __arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x104 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xec el0t_64_sync_handler+0xa0/0xf0 el0t_64_sync+0x198/0x19c
The __devm_regmap_init_slimbus() started to be used instead of __regmap_init_slimbus() after the commit mentioned above and turns out the incorrect bus_context pointer (3rd argument) was used in __devm_regmap_init_slimbus(). It should be just "slimbus" (which is equal to &slimbus->dev). Correct it. The wcd934x codec seems to be the only or the first user of devm_regmap_init_slimbus() but we should fix it till the point where __devm_regmap_init_slimbus() was introduced therefore two "Fixes" tags.
While at this, also correct the same argument in __regmap_init_slimbus().
--- drivers/base/regmap/regmap-slimbus.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/base/regmap/regmap-slimbus.c +2 -4
@@ -48,8 +48,7 @@ struct regmap *__regmap_init_slimbus(strif (IS_ERR (bus))return ERR_CAST (bus); -return __regmap_init (&slimbus->dev, bus, &slimbus->dev, config, - lock_key, lock_name); +return __regmap_init (&slimbus->dev, bus, slimbus, config, lock_key, lock_name); }EXPORT_SYMBOL_GPL (__regmap_init_slimbus);
@@ -63,8 +62,7 @@ struct regmap *__devm_regmap_init_slimbuif (IS_ERR (bus))return ERR_CAST (bus); -return __devm_regmap_init (&slimbus->dev, bus, &slimbus, config, - lock_key, lock_name); +return __devm_regmap_init (&slimbus->dev, bus, slimbus, config, lock_key, lock_name); }EXPORT_SYMBOL_GPL (__devm_regmap_init_slimbus);
Greg Kroah-Hartman
maintainerPATCH 45/529 drm/mediatek: Fix device use-after-free on unbind
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 926d002e6d7e2f1fd5c1b53cf6208153ee7d380d upstream.
A recent change fixed device reference leaks when looking up drm platform device driver data during bind() but failed to remove a partial fix which had been added by commit 80805b62ea5b ("drm/mediatek: Fix kobject put for component sub-drivers").
This results in a reference imbalance on component bind() failures and on unbind() which could lead to a user-after-free.
Make sure to only drop the references after retrieving the driver data by effectively reverting the previous partial fix.
Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference.
--- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 10 ---------- 1 file changed, 10 deletions(-)
drivers/gpu/drm/mediatek/mtk_drm_drv.c +0 -10
@@ -655,10 +655,6 @@ err_free:for (i =0 ; i < private->data->mmsys_dev_num; i++) private->all_drm_private[i]->drm =NULL ; err_put_dev: -for (i =0 ; i < private->data->mmsys_dev_num; i++) { -/* For device_find_child in mtk_drm_get_all_priv() */ -put_device (private->all_drm_private[i]->dev); - }put_device (private->mutex_dev);return ret; }
@@ -666,18 +662,12 @@ err_put_dev:static void mtk_drm_unbind (struct device *dev) {struct mtk_drm_private *private =dev_get_drvdata (dev); -int i;/* for multi mmsys dev, unregister drm dev in mmsys master */ if (private->drm_master) {drm_dev_unregister (private->drm);mtk_drm_kms_deinit (private->drm);drm_dev_put (private->drm); - -for (i =0 ; i < private->data->mmsys_dev_num; i++) { -/* For device_find_child in mtk_drm_get_all_priv() */ -put_device (private->all_drm_private[i]->dev); - }put_device (private->mutex_dev); } private->mtk_drm_bound = false;
Greg Kroah-Hartman
maintainerPATCH 46/529 mptcp: fix MSG_PEEK stream corruption
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit 8e04ce45a8db7a080220e86e249198fa676b83dc ]
If a MSG_PEEK | MSG_WAITALL read operation consumes all the bytes in the receive queue and recvmsg() need to waits for more data - i.e. it's a blocking one - upon arrival of the next packet the MPTCP protocol will start again copying the oldest data present in the receive queue, corrupting the data stream.
Address the issue explicitly tracking the peeked sequence number, restarting from the last peeked byte.
--- net/mptcp/protocol.c | 36 +++++++++++++++++++++++++----------- 1 file changed, 25 insertions(+), 11 deletions(-)
net/mptcp/protocol.c +25 -11
@@ -1940,19 +1940,35 @@ static void mptcp_rcv_space_adjust(strucstatic int __mptcp_recvmsg_mskq (struct mptcp_sock *msk,struct msghdr *msg, -size_t len,int flags, +size_t len,int flags,int copied_total,struct scm_timestamping_internal *tss,int *cmsg_flags) {struct sk_buff *skb, *tmp; +int total_data_len =0 ;int copied =0 ; skb_queue_walk_safe(&msk->receive_queue, skb, tmp) { -u32 offset =MPTCP_SKB_CB (skb)->offset; +u32 delta, offset =MPTCP_SKB_CB (skb)->offset;u32 data_len = skb->len - offset; -u32 count =min_t (size_t, len - copied, data_len); +u32 count;int err; +if (flags &MSG_PEEK ) { +/* skip already peeked skbs */ +if (total_data_len + data_len <= copied_total) { + total_data_len += data_len; +continue ; + } + +/* skip the already peeked data in the current skb */ + delta = copied_total - total_data_len; + offset += delta; + data_len -= delta; + } + + count =min_t (size_t, len - copied, data_len); +if (!(flags &MSG_TRUNC )) { err =skb_copy_datagram_msg (skb, offset, msg, count);if (unlikely (err <0 )) {
@@ -1969,22 +1985,19 @@ static int __mptcp_recvmsg_mskq(struct m copied += count; -if (count < data_len) { -if (!(flags &MSG_PEEK )) { +if (!(flags &MSG_PEEK )) { + msk->bytes_consumed += count; +if (count < data_len) {MPTCP_SKB_CB (skb)->offset += count;MPTCP_SKB_CB (skb)->map_seq += count; - msk->bytes_consumed += count; +break ; } -break ; - } -if (!(flags &MSG_PEEK )) {/* we will bulk release the skb memory later */ skb->destructor =NULL ;WRITE_ONCE (msk->rmem_released, msk->rmem_released + skb->truesize);__skb_unlink (skb, &msk->receive_queue);__kfree_skb (skb); - msk->bytes_consumed += count; }if (copied >= len)
@@ -2208,7 +2221,8 @@ static int mptcp_recvmsg(struct sock *skwhile (copied < len) {int err, bytes_read; - bytes_read =__mptcp_recvmsg_mskq (msk, msg, len - copied, flags, &tss, &cmsg_flags); + bytes_read =__mptcp_recvmsg_mskq (msk, msg, len - copied, flags, + copied, &tss, &cmsg_flags);if (unlikely (bytes_read <0 )) {if (!copied) copied = bytes_read;
Greg Kroah-Hartman
maintainerPATCH 47/529 s390/pci: Restore IRQ unconditionally for the zPCI device
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Farhan Ali <[email protected]>
[ Upstream commit b45873c3f09153d1ad9b3a7bf9e5c0b0387fd2ea ]
Commit c1e18c17bda6 ("s390/pci: add zpci_set_irq()/zpci_clear_irq()"), introduced the zpci_set_irq() and zpci_clear_irq(), to be used while resetting a zPCI device.
Commit da995d538d3a ("s390/pci: implement reset_slot for hotplug slot"), mentions zpci_clear_irq() being called in the path for zpci_hot_reset_device(). But that is not the case anymore and these functions are not called outside of this file. Instead zpci_hot_reset_device() relies on zpci_disable_device() also clearing the IRQs, but misses to reset the zdev->irqs_registered flag.
However after a CLP disable/enable reset, the device's IRQ are unregistered, but the flag zdev->irq_registered does not get cleared. It creates an inconsistent state and so arch_restore_msi_irqs() doesn't correctly restore the device's IRQ. This becomes a problem when a PCI driver tries to restore the state of the device through pci_restore_state(). Restore IRQ unconditionally for the device and remove the irq_registered flag as its redundant.
--- arch/s390/include/asm/pci.h | 1 - arch/s390/pci/pci_irq.c | 9 +-------- 2 files changed, 1 insertion(+), 9 deletions(-)
arch/s390/include/asm/pci.h +0 -1
@@ -138,7 +138,6 @@ struct zpci_dev { u8 has_resources : 1; u8 is_physfn : 1; u8 util_str_avail : 1; - u8 irqs_registered : 1; u8 reserved : 2;unsigned int devfn;/* DEVFN part of the RID*/
arch/s390/pci/pci_irq.c +1 -8
@@ -107,9 +107,6 @@ static int zpci_set_irq(struct zpci_develse rc =zpci_set_airq (zdev); -if (!rc) - zdev->irqs_registered =1 ; -return rc; }
@@ -123,9 +120,6 @@ static int zpci_clear_irq(struct zpci_deelse rc =zpci_clear_airq (zdev); -if (!rc) - zdev->irqs_registered =0 ; -return rc; }
@@ -427,8 +421,7 @@ bool arch_restore_msi_irqs(struct pci_de {struct zpci_dev *zdev =to_zpci (pdev); -if (!zdev->irqs_registered) -zpci_set_irq (zdev); +zpci_set_irq (zdev);return true; }
Greg Kroah-Hartman
maintainerPATCH 48/529 cpuidle: governors: menu: Rearrange main loop in menu_select()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <[email protected]>
[ Upstream commit 17224c1d2574d29668c4879e1fbf36d6f68cd22b ]
Reduce the indentation level in the main loop of menu_select() by rearranging some checks and assignments in it.
No intentional functional impact.
Stable-dep-of: db86f55bf81a ("cpuidle: governors: menu: Select polling state in some more cases")
--- drivers/cpuidle/governors/menu.c | 70 ++++++++++++++++++++------------------- 1 file changed, 36 insertions(+), 34 deletions(-)
drivers/cpuidle/governors/menu.c +36 -34
@@ -348,45 +348,47 @@ static int menu_select(struct cpuidle_drif (s->exit_latency_ns > latency_req)break ; -if (s->target_residency_ns > predicted_ns) { -/* -* Use a physical idle state, not busy polling, unless -* a timer is going to trigger soon enough. -*/ -if ((drv->states[idx].flags &CPUIDLE_FLAG_POLLING ) && - s->target_residency_ns <= data->next_timer_ns) { - predicted_ns = s->target_residency_ns; - idx = i; -break ; - } -if (predicted_ns <TICK_NSEC ) -break ; - -if (!tick_nohz_tick_stopped ()) { -/* -* If the state selected so far is shallow, -* waking up early won't hurt, so retain the -* tick in that case and let the governor run -* again in the next iteration of the loop. -*/ - predicted_ns = drv->states[idx].target_residency_ns; -break ; - } +if (s->target_residency_ns <= predicted_ns) { + idx = i; +continue ; + } + +/* +* Use a physical idle state, not busy polling, unless a timer +* is going to trigger soon enough. +*/ +if ((drv->states[idx].flags &CPUIDLE_FLAG_POLLING ) && + s->target_residency_ns <= data->next_timer_ns) { + predicted_ns = s->target_residency_ns; + idx = i; +break ; + } +if (predicted_ns <TICK_NSEC ) +break ; + +if (!tick_nohz_tick_stopped ()) {/* -* If the state selected so far is shallow and this -* state's target residency matches the time till the -* closest timer event, select this one to avoid getting -* stuck in the shallow one for too long. +* If the state selected so far is shallow, waking up +* early won't hurt, so retain the tick in that case and +* let the governor run again in the next iteration of +* the idle loop. */ -if (drv->states[idx].target_residency_ns <TICK_NSEC && - s->target_residency_ns <= delta_tick) - idx = i; - -return idx; + predicted_ns = drv->states[idx].target_residency_ns; +break ; } - idx = i; +/* +* If the state selected so far is shallow and this state's +* target residency matches the time till the closest timer +* event, select this one to avoid getting stuck in the shallow +* one for too long. +*/ +if (drv->states[idx].target_residency_ns <TICK_NSEC && + s->target_residency_ns <= delta_tick) + idx = i; + +return idx; }if (idx ==-1 )
Greg Kroah-Hartman
maintainerPATCH 49/529 cpuidle: governors: menu: Select polling state in some more cases
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <[email protected]>
[ Upstream commit db86f55bf81a3a297be05ee8775ae9a8c6e3a599 ]
A throughput regression of 11% introduced by commit 779b1a1cb13a ("cpuidle:
governors: menu: Avoid selecting states with too much latency") has been reported and it is related to the case when the menu governor checks if selecting a proper idle state instead of a polling one makes sense.
In particular, it is questionable to do so if the exit latency of the idle state in question exceeds the predicted idle duration, so add a check for that, which is sufficient to make the reported regression go away, and update the related code comment accordingly.
--- drivers/cpuidle/governors/menu.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/cpuidle/governors/menu.c +5 -2
@@ -355,10 +355,13 @@ static int menu_select(struct cpuidle_dr/* * Use a physical idle state, not busy polling, unless a timer -* is going to trigger soon enough. +* is going to trigger soon enough or the exit latency of the +* idle state in question is greater than the predicted idle +* duration. */ if ((drv->states[idx].flags &CPUIDLE_FLAG_POLLING ) && - s->target_residency_ns <= data->next_timer_ns) { + s->target_residency_ns <= data->next_timer_ns && + s->exit_latency_ns <= predicted_ns) { predicted_ns = s->target_residency_ns; idx = i;break ;
Greg Kroah-Hartman
maintainerPATCH 50/529 net: phy: dp83867: Disable EEE support as not implemented
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emanuele Ghidoli <[email protected]>
[ Upstream commit 84a905290cb4c3d9a71a9e3b2f2e02e031e7512f ]
While the DP83867 PHYs report EEE capability through their feature registers, the actual hardware does not support EEE (see Links). When the connected MAC enables EEE, it causes link instability and communication failures.
The issue is reproducible with a iMX8MP and relevant stmmac ethernet port. Since the introduction of phylink-managed EEE support in the stmmac driver, EEE is now enabled by default, leading to issues on systems using the DP83867 PHY.
Call phy_disable_eee during phy initialization to prevent EEE from being enabled on DP83867 PHYs.
--- drivers/net/phy/dp83867.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/phy/dp83867.c +8 -0
@@ -774,6 +774,14 @@ static int dp83867_config_init(struct phreturn ret; } +/* Although the DP83867 reports EEE capability through the +* MDIO_PCS_EEE_ABLE and MDIO_AN_EEE_ADV registers, the feature +* is not actually implemented in hardware. +*/ +linkmode_zero (phydev->supported_eee); +linkmode_zero (phydev->advertising_eee); + phydev->eee_enabled = false; +if (phy_interface_is_rgmii (phydev) || phydev->interface ==PHY_INTERFACE_MODE_SGMII ) { val =phy_read (phydev,MII_DP83867_PHYCTRL );
Greg Kroah-Hartman
maintainerPATCH 51/529 sched/pelt: Avoid underestimation of task utilization
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Guittot <[email protected]>
commit 50181c0cff31281b9f1071575ffba8a102375ece upstream.
Lukasz Luba reported that a thread's util_est can significantly decrease as a result of sharing the CPU with other threads.
The use case can be easily reproduced with a periodic task TA that runs 1ms and sleeps 100us. When the task is alone on the CPU, its max utilization and its util_est is around 888. If another similar task starts to run on the same CPU, TA will have to share the CPU runtime and its maximum utilization will decrease around half the CPU capacity (512) then TA's util_est will follow this new maximum trend which is only the result of sharing the CPU with others tasks.
Such situation can be detected with runnable_avg wich is close or equal to util_avg when TA is alone, but increases above util_avg when TA shares the CPU with other threads and wait on the runqueue.
[ We prefer an util_est that overestimate rather than under estimate
because in 1st case we will not provide enough performance to the task which will remain under-provisioned, whereas in the other case we will create some idle time which will enable to reduce contention and as a result reduces the util_est so the overestimate will be transient whereas the underestimate will remain. ]
[ mingo: Refined the changelog, added comments from the LKML discussion. ]
--- kernel/sched/fair.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
kernel/sched/fair.c +13 -0
@@ -4836,6 +4836,11 @@ static inline unsigned long task_util(streturn READ_ONCE (p->se.avg.util_avg); } +static inline unsigned long task_runnable (struct task_struct *p) +{ +return READ_ONCE (p->se.avg.runnable_avg); +} +static inline unsigned long _task_util_est (struct task_struct *p) {struct util_est ue =READ_ONCE (p->se.avg.util_est);
@@ -4955,6 +4960,14 @@ static inline void util_est_update(strucreturn ;/* +* To avoid underestimate of task utilization, skip updates of EWMA if +* we cannot grant that thread got all CPU time it wanted. +*/ +if ((ue.enqueued +UTIL_EST_MARGIN ) <task_runnable (p)) + goto done; + + +/* * Update Task's estimated utilization * * When *p completes an activation we can consolidate another sample
Re: [PATCH 6.6 051/529] sched/pelt: Avoid underestimation of task utilization
Hi Greg,
Quoted 1 line · Greg Kroah-Hartman
6.6-stable review patch. If anyone has any objections, please let me know.
No objections, just for history linking...
Quoted 64 lines
------------------
From: Vincent Guittot <[email protected]>
commit
50181c0cff31281b9f1071575ffba8a102375eceupstream.Lukasz Luba reported that a thread's
util_estcan significantly decrease as a result of sharing the CPU with other threads.The use case can be easily reproduced with a periodic task TA that runs 1ms and sleeps 100us. When the task is alone on the CPU, its max utilization and its
util_estis around 888. If another similar task starts to run on the same CPU, TA will have to share the CPU runtime and its maximum utilization will decrease around half the CPU capacity (512) then TA'sutil_estwill follow this new maximum trend which is only the result of sharing the CPU with others tasks.Such situation can be detected with
runnable_avgwich is close or equal toutil_avgwhen TA is alone, but increases aboveutil_avgwhen TA shares the CPU with other threads and wait on the runqueue.[ We prefer an
util_estthat overestimate rather than under estimate
because in 1st case we will not provide enough performance to the task which will remain under-provisioned, whereas in the other case we will create some idle time which will enable to reduce contention and as a result reduces theutil_estso the overestimate will be transient whereas the underestimate will remain. ][ mingo: Refined the changelog, added comments from the LKML discussion. ]
Reported-by Lukasz Luba <[email protected]>Signed-off-by Vincent Guittot <[email protected]>Signed-off-by Ingo Molnar <[email protected]>Link https://lore.kernel.org/lkml/CAKfTPtDd-HhF-YiNTtL9i5k0PfJbF819Yxu4YquzfXgwi7voyw@mail.gmail.com/#t open hereCc Hongyan Xia <[email protected]>Cc John Stultz <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- kernel/sched/fair.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)kernel/sched/fair.c +6
-0@@ -4836,6 +4836,11 @@ static inline unsigned long task_util(streturn READ_ONCE (p->se.avg.util_avg); } +static inline unsigned long task_runnable (struct task_struct *p) +{ +return READ_ONCE (p->se.avg.runnable_avg); +} +static inline unsigned long _task_util_est (struct task_struct *p) {struct util_est ue =READ_ONCE (p->se.avg.util_est);@@ -4955,6 +4960,14 @@ static inline void util_est_update(strucreturn ;/* +* To avoid underestimate of task utilization, skip updates of EWMA if
kernel/sched/fair.c static inline void util_est_update(struc · line 4973
Quoted 10 lines
kernel/sched/fair.c +7
-0+* we cannot grant that thread got all CPU time it wanted. +*/ +if ((ue.enqueued +UTIL_EST_MARGIN ) <task_runnable (p)) + goto done; + + +/* * Update Task's estimated utilization * * When *p completes an activation we can consolidate another sample
I've pointed ChromeOS folks to this patch backport. They have tested the patch in their 6.6 kernel and posted the results (speedometer 2.1)
- which are really good [1].
I thought it would be worth to link this here as well.
Regards,
Lukasz
[1] https://lore.kernel.org/lkml/CAKchOA31NGBWMdeSjky7MwOjU=dYmHVLbE7uUQHUXSZOzUHUeA@mail.gmail.com/
Greg Kroah-Hartman
maintainerPATCH 52/529 sched/fair: Use all little CPUs for CPU-bound workloads
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Gondois <[email protected]>
commit 3af7524b14198f5159a86692d57a9f28ec9375ce upstream.
Running N CPU-bound tasks on an N CPUs platform:
- with asymmetric CPU capacity
- not being a DynamIq system (i.e. having a PKG level sched domain without the SD_SHARE_PKG_RESOURCES flag set)
.. might result in a task placement where two tasks run on a big CPU and none on a little CPU. This placement could be more optimal by using all CPUs.
Testing platform:
Juno-r2:
- 2 big CPUs (1-2), maximum capacity of 1024
- 4 little CPUs (0,3-5), maximum capacity of 383
Testing workload ([1]):
Spawn 6 CPU-bound tasks. During the first 100ms (step 1), each tasks is affine to a CPU, except for:
- one little CPU which is left idle.
- one big CPU which has 2 tasks affine.
After the 100ms (step 2), remove the cpumask affinity.
Behavior before the patch:
During step 2, the load balancer running from the idle CPU tags sched domains as:
- little CPUs: 'group_has_spare'. Cf. group_has_capacity() and group_is_overloaded(), 3 CPU-bound tasks run on a 4 CPUs sched-domain, and the idle CPU provides enough spare capacity regarding the imbalance_pct
- big CPUs: 'group_overloaded'. Indeed, 3 tasks run on a 2 CPUs sched-domain, so the following path is used:
group_is_overloaded()
\-if (sgs->sum_nr_running <= sgs->group_weight) return true;
The following path which would change the migration type to 'migrate_task' is not taken:
calculate_imbalance()
\-if (env->idle != CPU_NOT_IDLE && env->imbalance == 0)
as the local group has some spare capacity, so the imbalance is not 0.
The migration type requested is 'migrate_util' and the busiest runqueue is the big CPU's runqueue having 2 tasks (each having a utilization of 512). The idle little CPU cannot pull one of these task as its capacity is too small for the task. The following path is used:
detach_tasks()
\-case migrate_util:
\-if (util > env->imbalance) goto next;After the patch:
As the number of failed balancing attempts grows (with 'nr_balance_failed'), progressively make it easier to migrate a big task to the idling little CPU. A similar mechanism is used for the 'migrate_load' migration type.
Improvement:
Running the testing workload [1] with the step 2 representing a ~10s load for a big CPU:
Before patch: ~19.3s
After patch: ~18s (-6.7%)
Similar issue reported at:
https://lore.kernel.org/lkml/[email protected]/
--- kernel/sched/fair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/fair.c +1 -1
@@ -9165,7 +9165,7 @@ static int detach_tasks(struct lb_env *ecase migrate_util: util =task_util_est (p); -if (util > env->imbalance) +if (shr_bound (util, env->sd->nr_balance_failed) > env->imbalance) goto next; env->imbalance -= util;
Greg Kroah-Hartman
maintainerPATCH 53/529 s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit 64e2f60f355e556337fcffe80b9bcff1b22c9c42 ]
As reported by Luiz Capitulino enabling HVO on s390 leads to reproducible crashes. The problem is that kernel page tables are modified without flushing corresponding TLB entries.
Even if it looks like the empty flush_tlb_all() implementation on s390 is the problem, it is actually a different problem: on s390 it is not allowed to replace an active/valid page table entry with another valid page table entry without the detour over an invalid entry. A direct replacement may lead to random crashes and/or data corruption.
In order to invalidate an entry special instructions have to be used (e.g. ipte or idte). Alternatively there are also special instructions available which allow to replace a valid entry with a different valid entry (e.g. crdte or cspg).
Given that the HVO code currently does not provide the hooks to allow for an implementation which is compliant with the s390 architecture requirements, disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP again, which is basically a revert of the original patch which enabled it.
--- arch/s390/Kconfig | 1 - 1 file changed, 1 deletion(-)
arch/s390/Kconfig +0 -1
@@ -128,7 +128,6 @@ config S390 select ARCH_WANT_DEFAULT_BPF_JIT select ARCH_WANT_IPC_PARSE_VERSION select ARCH_WANT_KERNEL_PMD_MKWRITE - select ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP select BUILDTIME_TABLE_SORT select CLONE_BACKWARDS2 select DMA_OPS if PCI
Greg Kroah-Hartman
maintainerPATCH 54/529 drm/sched: Fix race in drm_sched_entity_select_rq()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Stanner <[email protected]>
[ Upstream commit d25e3a610bae03bffc5c14b5d944a5d0cd844678 ]
In a past bug fix it was forgotten that entity access must be protected by the entity lock. That's a data race and potentially UB.
Move the spin_unlock() to the appropriate position.
--- drivers/gpu/drm/scheduler/sched_entity.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/scheduler/sched_entity.c +2 -1
@@ -531,10 +531,11 @@ void drm_sched_entity_select_rq(struct ddrm_sched_rq_remove_entity (entity->rq, entity); entity->rq = rq; } -spin_unlock (&entity->rq_lock);if (entity->num_sched_list ==1 ) entity->sched_list =NULL ; + +spin_unlock (&entity->rq_lock); }/**
Greg Kroah-Hartman
maintainerPATCH 55/529 drm/sysfb: Do not dereference NULL pointer in plane reset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
[ Upstream commit 14e02ed3876f4ab0ed6d3f41972175f8b8df3d70 ]
The plane state in __drm_gem_reset_shadow_plane() can be NULL. Do not deref that pointer, but forward NULL to the other plane-reset helpers. Clears plane->state to NULL.
v2:
- fix typo in commit description (Javier)
--- drivers/gpu/drm/drm_gem_atomic_helper.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/drm_gem_atomic_helper.c +5 -1
@@ -301,7 +301,11 @@ EXPORT_SYMBOL(drm_gem_destroy_shadow_plavoid __drm_gem_reset_shadow_plane (struct drm_plane *plane,struct drm_shadow_plane_state *shadow_plane_state) { -__drm_atomic_helper_plane_reset (plane, &shadow_plane_state->base); +if (shadow_plane_state) { +__drm_atomic_helper_plane_reset (plane, &shadow_plane_state->base); + }else { +__drm_atomic_helper_plane_reset (plane,NULL ); + } }EXPORT_SYMBOL (__drm_gem_reset_shadow_plane);
Greg Kroah-Hartman
maintainerPATCH 56/529 s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerd Bayer <[email protected]>
[ Upstream commit 0fd20f65df6aa430454a0deed8f43efa91c54835 ]
Do not block PCI config accesses through pci_cfg_access_lock() when executing the s390 variant of PCI error recovery: Acquire just device_lock() instead of pci_dev_lock() as powerpc's EEH and generig PCI AER processing do.
During error recovery testing a pair of tasks was reported to be hung:
mlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working
INFO: task kmcheck:72 blocked for more than 122 seconds.
Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kmcheck state:D stack:0 pid:72 tgid:72 ppid:2 flags:0x00000000
Call Trace:
[<000000065256f030>] __schedule+0x2a0/0x590
[<000000065256f356>] schedule+0x36/0xe0
[<000000065256f572>] schedule_preempt_disabled+0x22/0x30
[<0000000652570a94>] __mutex_lock.constprop.0+0x484/0x8a8
[<000003ff800673a4>] mlx5_unload_one+0x34/0x58 [mlx5_core]
[<000003ff8006745c>] mlx5_pci_err_detected+0x94/0x140 [mlx5_core]
[<0000000652556c5a>] zpci_event_attempt_error_recovery+0xf2/0x398
[<0000000651b9184a>] __zpci_event_error+0x23a/0x2c0
INFO: task kworker/u1664:6:1514 blocked for more than 122 seconds.
Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u1664:6 state:D stack:0 pid:1514 tgid:1514 ppid:2 flags:0x00000000
Workqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core]
Call Trace:
[<000000065256f030>] __schedule+0x2a0/0x590
[<000000065256f356>] schedule+0x36/0xe0
[<0000000652172e28>] pci_wait_cfg+0x80/0xe8
[<0000000652172f94>] pci_cfg_access_lock+0x74/0x88
[<000003ff800916b6>] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core]
[<000003ff80098824>] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core]
[<000003ff80074b62>] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core]
[<0000000652512242>] devlink_health_do_dump.part.0+0x82/0x168
[<0000000652513212>] devlink_health_report+0x19a/0x230
[<000003ff80075a12>] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core]No kernel log of the exact same error with an upstream kernel is available - but the very same deadlock situation can be constructed there, too:
- task: kmcheck
mlx5_unload_one() tries to acquire devlink lock while the PCI error recovery code has set pdev->block_cfg_access by way of pci_cfg_access_lock()
- task: kworker
mlx5_crdump_collect() tries to set block_cfg_access through pci_cfg_access_lock() while devlink_health_report() had acquired the devlink lock.
A similar deadlock situation can be reproduced by requesting a crdump with
Quoted 1 line
devlink health dump show pci/<BDF> reporter
fw_fatal
while PCI error recovery is executed on the same <BDF> physical function by mlx5_core's pci_error_handlers. On s390 this can be injected with
Quoted 1 line
zpcictl --reset-fw <BDF>
Tests with this patch failed to reproduce that second deadlock situation, the devlink command is rejected with "kernel answers: Permission denied" - and we get a kernel log message of:
mlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5
because the config read of VSC_SEMAPHORE is rejected by the underlying hardware.
Two prior attempts to address this issue have been discussed and ultimately rejected [see link], with the primary argument that s390's implementation of PCI error recovery is imposing restrictions that neither powerpc's EEH nor PCI AER handling need. Tests show that PCI error recovery on s390 is running to completion even without blocking access to PCI config space.
--- arch/s390/pci/pci_event.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/s390/pci/pci_event.c +2 -2
@@ -173,7 +173,7 @@ static pci_ers_result_t zpci_event_attem* is unbound or probed and that userspace can't access its * configuration space while we perform recovery. */ -pci_dev_lock (pdev); +device_lock (&pdev->dev);if (pdev->error_state == pci_channel_io_perm_failure) { ers_res =PCI_ERS_RESULT_DISCONNECT ; goto out_unlock;
@@ -221,7 +221,7 @@ static pci_ers_result_t zpci_event_attemif (driver->err_handler->resume) driver->err_handler->resume (pdev); out_unlock: -pci_dev_unlock (pdev); +device_unlock (&pdev->dev);return ers_res; }
Greg Kroah-Hartman
maintainerPATCH 57/529 usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Owen Gu <[email protected]>
commit cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4 upstream.
A race condition occurs when ffs_func_eps_enable() runs concurrently with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset() sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading to a NULL pointer dereference when accessing epfile->ep in ffs_func_eps_enable() after successful usb_ep_enable().
The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and ffs_data_close() functions, and its modification is protected by the spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function is also protected by ffs->eps_lock.
Thus, add NULL pointer handling for ffs->epfiles in the ffs_func_eps_enable() function to fix issues
--- drivers/usb/gadget/function/f_fs.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/f_fs.c +7 -1
@@ -1941,7 +1941,12 @@ static int ffs_func_eps_enable(struct ff ep = func->eps; epfile = ffs->epfiles; count = ffs->eps_count; -while (count--) { +if (!epfile) { + ret = -ENOMEM ; + goto done; + } + +while (count--) { ep->ep->driver_data = ep; ret =config_ep_by_speed (func->gadget, &func->function, ep->ep);
@@ -1965,6 +1970,7 @@ static int ffs_func_eps_enable(struct ff }wake_up_interruptible (&ffs->wait); +done:spin_unlock_irqrestore (&func->ffs->eps_lock, flags);return ret;
Greg Kroah-Hartman
maintainerPATCH 58/529 soc: aspeed: socinfo: Add AST27xx silicon IDs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Chen <[email protected]>
[ Upstream commit c30dcfd4b5a0f0e3fe7138bf287f6de6b1b00278 ]
Extend the ASPEED SoC info driver to support AST27XX silicon IDs.
--- drivers/soc/aspeed/aspeed-socinfo.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/soc/aspeed/aspeed-socinfo.c +4 -0
@@ -27,6 +27,10 @@ static struct { { "AST2620", 0x05010203 }, { "AST2605", 0x05030103 }, { "AST2625", 0x05030403 }, +/* AST2700 */ + { "AST2750", 0x06000003 }, + { "AST2700", 0x06000103 }, + { "AST2720", 0x06000203 }, };static const char *siliconid_to_name (u32 siliconid)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/529 soc: qcom: smem: Fix endian-unaware access of num_entries
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Reidel <[email protected]>
[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
Add a missing le32_to_cpu when accessing num_entries, which is always a little endian integer.
Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
--- drivers/soc/qcom/smem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/smem.c +1 -1
@@ -870,7 +870,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)if (IS_ERR_OR_NULL (ptable))return SMEM_ITEM_COUNT ; - info = (struct smem_info *)&ptable->entry[ptable->num_entries]; + info = (struct smem_info *)&ptable->entry[le32_to_cpu (ptable->num_entries)];if (memcmp (info->magic,SMEM_INFO_MAGIC ,sizeof (info->magic)))return SMEM_ITEM_COUNT ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/529 spi: loopback-test: Dont use %pK through printk
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and easier to reason about.
There are still a few users of %pK left, but these use it through seq_file, for which its usage is safe.
--- drivers/spi/spi-loopback-test.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/spi/spi-loopback-test.c +6 -6
@@ -447,7 +447,7 @@ static void spi_test_dump_message(struct spi_device *spi,int i;u8 b; -dev_info (&spi->dev," spi_msg@%pK\n" , msg); +dev_info (&spi->dev," spi_msg@%p\n" , msg);if (msg->status)dev_info (&spi->dev," status: %i\n" , msg->status);
@@ -457,15 +457,15 @@ static void spi_test_dump_message(struct spi_device *spi, msg->actual_length);list_for_each_entry (xfer, &msg->transfers, transfer_list) { -dev_info (&spi->dev," spi_transfer@%pK\n" , xfer); +dev_info (&spi->dev," spi_transfer@%p\n" , xfer);dev_info (&spi->dev," len: %i\n" , xfer->len); -dev_info (&spi->dev," tx_buf: %pK\n" , xfer->tx_buf); +dev_info (&spi->dev," tx_buf: %p\n" , xfer->tx_buf);if (dump_data && xfer->tx_buf)spi_test_print_hex_dump (" TX: " , xfer->tx_buf, xfer->len); -dev_info (&spi->dev," rx_buf: %pK\n" , xfer->rx_buf); +dev_info (&spi->dev," rx_buf: %p\n" , xfer->rx_buf);if (dump_data && xfer->rx_buf) spi_test_print_hex_dump(" RX: ", xfer->rx_buf,
@@ -559,7 +559,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,/* if still not found then something has modified too much */ /* we could list the "closest" transfer here... */ dev_err (&spi->dev, -"loopback strangeness - rx changed outside of allowed range at: %pK\n" , +"loopback strangeness - rx changed outside of allowed range at: %p\n" , addr);/* do not return, only set ret, * so that we list all addresses
@@ -697,7 +697,7 @@ static int spi_test_translate(struct spi_device *spi, }dev_err (&spi->dev, -"PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n" , +"PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n" , *ptr, *ptr + len,RX (0 ),RX (SPI_TEST_MAX_SIZE ),TX (0 ),TX (SPI_TEST_MAX_SIZE ));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/529 bpf: Dont use %pK through printk
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and easier to reason about.
--- include/linux/filter.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/filter.h +1 -1
@@ -1065,7 +1065,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);static inline void bpf_jit_dump (unsigned int flen,unsigned int proglen,u32 pass,void *image) { -pr_err ("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n" , flen, +pr_err ("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n" , flen, proglen, pass, image, current->comm,task_pid_nr (current));if (image)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/529 pinctrl: single: fix bias pull up/down handling in pin_config_set
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chi Zhang <[email protected]>
[ Upstream commit 236152dd9b1675a35eee912e79e6c57ca6b6732f ]
In the pin_config_set function, when handling PIN_CONFIG_BIAS_PULL_DOWN or PIN_CONFIG_BIAS_PULL_UP, the function calls pcs_pinconf_clear_bias() which writes the register. However, the subsequent operations continue using the stale 'data' value from before the register write, effectively causing the bias clear operation to be overwritten and not take effect.
Fix this by reading the 'data' value from the register after calling pcs_pinconf_clear_bias().
This bug seems to have existed when this code was first merged in commit 9dddb4df90d1 ("pinctrl: single: support generic pinconf").
--- drivers/pinctrl/pinctrl-single.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/pinctrl/pinctrl-single.c +3 -1
@@ -587,8 +587,10 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev,break ;case PIN_CONFIG_BIAS_PULL_DOWN :case PIN_CONFIG_BIAS_PULL_UP : -if (arg) +if (arg) {pcs_pinconf_clear_bias (pctldev, pin); + data = pcs->read (pcs->base + offset); + } fallthrough;case PIN_CONFIG_INPUT_SCHMITT_ENABLE : data &= ~func->conf[i].mask;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/529 mmc: host: renesas_sdhi: Fix the actual clock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
Wrong actual clock reported, if the SD clock division ratio is other than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
On high speed mode, cat /sys/kernel/debug/mmc1/ios Without the patch:
clock: 50000000 Hz actual clock: 200000000 Hz
After the fix:
clock: 50000000 Hz actual clock: 50000000 Hz
--- drivers/mmc/host/renesas_sdhi_core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/mmc/host/renesas_sdhi_core.c +5 -1
@@ -220,7 +220,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host, clk &= ~0xff ; } -sd_ctrl_write16 (host,CTL_SD_CARD_CLK_CTL , clk &CLK_CTL_DIV_MASK ); + clock = clk &CLK_CTL_DIV_MASK ; +if (clock !=0xff ) + host->mmc->actual_clock /= (1 << (ffs (clock) +1 )); + +sd_ctrl_write16 (host,CTL_SD_CARD_CLK_CTL , clock);if (!(host->pdata->flags &TMIO_MMC_MIN_RCAR2 ))usleep_range (10000 ,11000 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/529 memstick: Add timeout to prevent indefinite waiting
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayi Li <[email protected]>
[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
Add timeout handling to wait_for_completion calls in memstick_set_rw_addr() and memstick_alloc_card() to prevent indefinite blocking in case of hardware or communication failures.
--- drivers/memstick/core/memstick.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/memstick/core/memstick.c +6 -2
@@ -367,7 +367,9 @@ int memstick_set_rw_addr(struct memstick_dev *card) { card->next_request = h_memstick_set_rw_addr;memstick_new_req (card->host); -wait_for_completion (&card->mrq_complete); +if (!wait_for_completion_timeout (&card->mrq_complete, +msecs_to_jiffies (500 ))) + card->current_mrq.error = -ETIMEDOUT ;return card->current_mrq.error; }
@@ -401,7 +403,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host) card->next_request = h_memstick_read_dev_id;memstick_new_req (host); -wait_for_completion (&card->mrq_complete); +if (!wait_for_completion_timeout (&card->mrq_complete, +msecs_to_jiffies (500 ))) + card->current_mrq.error = -ETIMEDOUT ;if (card->current_mrq.error) goto err_out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/529 irqchip/sifive-plic: Respect mask state when setting affinity
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Inochi Amaoto <[email protected]>
[ Upstream commit adecf78df945f4c7a1d29111b0002827f487df51 ]
plic_set_affinity() always calls plic_irq_enable(), which clears up the priority setting even the interrupt is only masked. This unmasks the interrupt unexpectly.
Replace the plic_irq_enable/disable() with plic_irq_toggle() to avoid changing the priority setting.
--- drivers/irqchip/irq-sifive-plic.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/irqchip/irq-sifive-plic.c +4 -2
@@ -176,12 +176,14 @@ static int plic_set_affinity(struct irq_data *d,if (cpu >= nr_cpu_ids)return -EINVAL ; -plic_irq_disable (d); +/* Invalidate the original routing entry */ +plic_irq_toggle (irq_data_get_effective_affinity_mask (d), d,0 );irq_data_update_effective_affinity (d,cpumask_of (cpu)); +/* Setting the new routing entry if irq is enabled */ if (!irqd_irq_disabled (d)) -plic_irq_enable (d); +plic_irq_toggle (irq_data_get_effective_affinity_mask (d), d,1 );return IRQ_SET_MASK_OK_DONE ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/529 selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <[email protected]>
[ Upstream commit 98857d111c53954aa038fcbc4cf48873e4240f7c ]
Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt the usage in test_lirc_mode2_user.c.
--- tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/test_lirc_mode2_user.c +1 -1
@@ -74,7 +74,7 @@ int main(int argc, char **argv)/* Let's try detach it before it was ever attached */ ret =bpf_prog_detach2 (progfd, lircfd,BPF_LIRC_MODE2 ); -if (ret !=-1 || errno !=ENOENT ) { +if (ret != -ENOENT ) {printf ("bpf_prog_detach2 not attached should fail: %m\n" );return 1 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/529 cpufreq/longhaul: handle NULL policy in longhaul_exit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Beier <[email protected]>
[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
longhaul_exit() was calling cpufreq_cpu_get(0) without checking for a NULL policy pointer. On some systems, this could lead to a NULL dereference and a kernel warning or panic.
This patch adds a check using unlikely() and returns early if the policy is NULL.
Bugzilla: #219962
--- drivers/cpufreq/longhaul.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/cpufreq/longhaul.c +3 -0
@@ -953,6 +953,9 @@ static void __exit longhaul_exit(void)struct cpufreq_policy *policy =cpufreq_cpu_get (0 );int i; +if (unlikely (!policy)) +return ; +for (i =0 ; i < numscales; i++) {if (mults[i] == maxmult) {struct cpufreq_freqs freqs;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/529 arc: Fix __fls() const-foldability via __builtin_clzl()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results).
For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function uses __builtin_arc_fls() which lacks GCC's const attribute, preventing compile-time constant folding, and KUnit testing of ffs/fls fails on arc[3]. A patch[2] to GCC to solve this has been sent.
Add a fix for this by handling compile-time constants with the standard __builtin_clzl() builtin (which has const attribute) while preserving the optimized arc-specific builtin for runtime cases. This has the added benefit of skipping runtime calculation of compile-time constant values. Even with the GCC bug fixed (which is about "attribute const") this is a good change to avoid needless runtime costs, and should be done regardless of the state of GCC's bug.
Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
--- arch/arc/include/asm/bitops.h | 2 ++ 1 file changed, 2 insertions(+)
arch/arc/include/asm/bitops.h +2 -0
@@ -133,6 +133,8 @@ static inline __attribute__ ((const)) int fls(unsigned int x)*/ static inline __attribute__ ((const))unsigned long __fls (unsigned long x) { +if (__builtin_constant_p (x)) +return x ?BITS_PER_LONG -1 -__builtin_clzl (x) :0 ;/* FLS insn has exactly same semantics as the API */ return __builtin_arc_fls (x); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/529 selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <[email protected]>
[ Upstream commit 2a912258c90e895363c0ffc0be8a47f112ab67b7 ]
Currently, even if some subtests fails, the end result will still yield "ok 1 selftests: bpf: test_xsk.sh". Fix it by exiting with 1 if there are any failures.
--- tools/testing/selftests/bpf/test_xsk.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/bpf/test_xsk.sh +2 -0
@@ -203,4 +203,6 @@ done if [ $failures -eq 0 ]; then echo "All tests successful!" +else + exit 1 fi
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/529 irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Bruel <[email protected]>
[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the low-order bits of the MSI Message DATA register to encode nr_irqs interrupt numbers in the log2(nr_irqs) bits for the domain.
The problem arises if the base vector (GICV2m base spi) is not aligned with nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base vector conflict with the nr_irqs masking, causing the wrong MSI interrupt to be identified.
To fix this, use bitmap_find_next_zero_area_off() instead of bitmap_find_free_region() to align the initial base vector with nr_irqs.
--- drivers/irqchip/irq-gic-v2m.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/irqchip/irq-gic-v2m.c +9 -4
@@ -179,14 +179,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq, {msi_alloc_info_t *info = args;struct v2m_data *v2m =NULL , *tmp; -int hwirq, offset, i, err =0 ; +int hwirq, i, err =0 ; +unsigned long offset; +unsigned long align_mask = nr_irqs -1 ;spin_lock (&v2m_lock);list_for_each_entry (tmp, &v2m_nodes, entry) { - offset =bitmap_find_free_region (tmp->bm, tmp->nr_spis, -get_count_order (nr_irqs)); -if (offset >=0 ) { +unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask); + + offset =bitmap_find_next_zero_area_off (tmp->bm, tmp->nr_spis,0 , + nr_irqs, align_mask, align_off); +if (offset < tmp->nr_spis) { v2m = tmp; +bitmap_set (v2m->bm, offset, nr_irqs);break ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/529 ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shang song (Lenovo) <[email protected]>
[ Upstream commit 311942ce763e21dacef7e53996d5a1e19b8adab1 ]
If handler_address or mapped VA is NULL, the related buffer address and VA can be ignored, so make acpi_parse_prmt() skip the current handler in those cases.
--- drivers/acpi/prmt.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
drivers/acpi/prmt.c +16 -3
@@ -150,15 +150,28 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end) th = &tm->handlers[cur_handler];guid_copy (&th->guid, (guid_t *)handler_info->handler_guid); + +/* +* Print an error message if handler_address is NULL, the parse of VA also +* can be skipped. +*/ +if (unlikely (!handler_info->handler_address)) { +pr_info ("Skipping handler with NULL address for GUID: %pUL" , + (guid_t *)handler_info->handler_guid); +continue ; + } + th->handler_addr = (void *)efi_pa_va_lookup (&th->guid, handler_info->handler_address);/* -* Print a warning message if handler_addr is zero which is not expected to -* ever happen. +* Print a warning message and skip the parse of VA if handler_addr is zero +* which is not expected to ever happen. */ -if (unlikely (!th->handler_addr)) +if (unlikely (!th->handler_addr)) {pr_warn ("Failed to find VA of handler for GUID: %pUL, PA: 0x%llx" , &th->guid, handler_info->handler_address); +continue ; + } th->static_data_buffer_addr =efi_pa_va_lookup (&th->guid, handler_info->static_data_buffer_address);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/529 ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 4405a214df146775338a1e6232701a29024b82e1 ]
Some x86/ACPI laptops with MIPI cameras have a INTC10DE or INTC10E0 ACPI device in the _DEP dependency list of the ACPI devices for the camera- sensors (which have flags.honor_deps set).
These devices are for an Intel Vision CVS chip for which an out of tree driver is available [1].
The camera sensor works fine without a driver being loaded for this ACPI device on the 2 laptops this was tested on:
ThinkPad X1 Carbon Gen 12 (Meteor Lake)
ThinkPad X1 2-in-1 Gen 10 (Arrow Lake)
For now add these HIDs to acpi_ignore_dep_ids[] so that acpi_dev_ready_for_enumeration() will return true once the other _DEP dependencies are met and an i2c_client for the camera sensor will get instantiated.
--- drivers/acpi/scan.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/acpi/scan.c +2 -0
@@ -784,6 +784,8 @@ static bool acpi_info_matches_ids(struct acpi_device_info *info,static const char *const acpi_ignore_dep_ids[] = {"PNP0D80" ,/* Windows-compatible System Power Management Controller */ "INT33BD" ,/* Intel Baytrail Mailbox Device */ +"INTC10DE" ,/* Intel CVS LNL */ +"INTC10E0" ,/* Intel CVS ARL */ "LATT2021" ,/* Lattice FW Update Client Driver */ NULL };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/529 power: supply: qcom_battmgr: add OOI chemistry
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christopher Ruehl <[email protected]>
[ Upstream commit fee0904441325d83e7578ca457ec65a9d3f21264 ]
The ASUS S15 xElite model report the Li-ion battery with an OOI, hence this update the detection and return the appropriate type.
--- drivers/power/supply/qcom_battmgr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/power/supply/qcom_battmgr.c +2 -1
@@ -975,7 +975,8 @@ static void qcom_battmgr_sc8280xp_strcpy(char *dest, const char *src)static unsigned int qcom_battmgr_sc8280xp_parse_technology (const char *chemistry) { -if (!strncmp (chemistry,"LIO" ,BATTMGR_CHEMISTRY_LEN )) +if ((!strncmp (chemistry,"LIO" ,BATTMGR_CHEMISTRY_LEN )) || + (!strncmp (chemistry,"OOI" ,BATTMGR_CHEMISTRY_LEN )))return POWER_SUPPLY_TECHNOLOGY_LION ;if (!strncmp (chemistry,"LIP" ,BATTMGR_CHEMISTRY_LEN ))return POWER_SUPPLY_TECHNOLOGY_LIPO ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/529 hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avadhut Naik <[email protected]>
[ Upstream commit f116af2eb51ed9df24911537fda32a033f1c58da ]
Add thermal info support for newer AMD Family 1Ah-based models.
--- drivers/hwmon/k10temp.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/hwmon/k10temp.c +9 -0
@@ -84,6 +84,13 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);*/ #define AMD_I3255_STR "3255" +/* +* PCI Device IDs for AMD's Family 1Ah-based SOCs. +* Defining locally as IDs are not shared. +*/ +#define PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3 0x12cb +#define PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3 0x127b +struct k10temp_data {struct pci_dev *pdev;void (*read_htcreg)(struct pci_dev *pdev,u32 *regval);
@@ -545,7 +552,9 @@ static const struct pci_device_id k10temp_id_table[] = { { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_19H_M78H_DF_F3) }, { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M00H_DF_F3) }, { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3) }, { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3) }, { PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) }, {} };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/529 hwmon: (k10temp) Add device ID for Strix Halo
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rong Zhang <[email protected]>
[ Upstream commit e5d1e313d7b6272d6dfda983906d99f97ad9062b ]
The device ID of Strix Halo Data Fabric Function 3 has been in the tree since commit 0e640f0a47d8 ("x86/amd_nb: Add new PCI IDs for AMD family 0x1a"), but is somehow missing from k10temp_id_table.
Add it so that it works out of the box.
Tested on Beelink GTR9 Pro Mini PC.
--- drivers/hwmon/k10temp.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/k10temp.c +1 -0
@@ -554,6 +554,7 @@ static const struct pci_device_id k10temp_id_table[] = { { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) }, { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3) }, { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M70H_DF_F3) }, { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3) }, { PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) }, {}
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 76/529 hwmon: (sbtsi_temp) AMD CPU extended temperature range support
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuande Chen <[email protected]>
[ Upstream commit d9d61f1da35038793156c04bb13f0a1350709121 ]
Many AMD CPUs can support this feature now. We would get a wrong CPU DIE temperature if don't consider this. In low-temperature environments, the CPU die temperature can drop below zero. So many platforms would like to make extended temperature range as their default configuration. Default temperature range (0C to 255.875C).
Extended temperature range (-49C to +206.875C).
Ref Doc: AMD V3000 PPR (Doc ID #56558).
--- drivers/hwmon/sbtsi_temp.c | 46 +++++++++++++++++++++++++------------- 1 file changed, 31 insertions(+), 15 deletions(-)
drivers/hwmon/sbtsi_temp.c +31 -15
@@ -14,6 +14,7 @@#include <linux/module.h> #include <linux/mutex.h> #include <linux/of.h> +#include <linux/bitfield.h> /* * SB-TSI registers only support SMBus byte data access. "_INT" registers are
@@ -29,8 +30,22 @@#define SBTSI_REG_TEMP_HIGH_DEC 0x13/* RW */ #define SBTSI_REG_TEMP_LOW_DEC 0x14/* RW */ +/* +* Bit for reporting value with temperature measurement range. +* bit == 0: Use default temperature range (0C to 255.875C). +* bit == 1: Use extended temperature range (-49C to +206.875C). +*/ +#define SBTSI_CONFIG_EXT_RANGE_SHIFT 2 +/* +* ReadOrder bit specifies the reading order of integer and decimal part of +* CPU temperature for atomic reads. If bit == 0, reading integer part triggers +* latching of the decimal part, so integer part should be read first. +* If bit == 1, read order should be reversed. +*/ #define SBTSI_CONFIG_READ_ORDER_SHIFT 5 +#define SBTSI_TEMP_EXT_RANGE_ADJ 49000 +#define SBTSI_TEMP_MIN 0#define SBTSI_TEMP_MAX 255875
@@ -38,6 +53,8 @@struct sbtsi_data {struct i2c_client *client;struct mutex lock; +bool ext_range_mode; +bool read_order; };/*
@@ -74,23 +91,11 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type, {struct sbtsi_data *data =dev_get_drvdata (dev);s32 temp_int, temp_dec; -int err;switch (attr) {case hwmon_temp_input: -/* -* ReadOrder bit specifies the reading order of integer and -* decimal part of CPU temp for atomic reads. If bit == 0, -* reading integer part triggers latching of the decimal part, -* so integer part should be read first. If bit == 1, read -* order should be reversed. -*/ - err =i2c_smbus_read_byte_data (data->client,SBTSI_REG_CONFIG ); -if (err <0 ) -return err; -mutex_lock (&data->lock); -if (err &BIT (SBTSI_CONFIG_READ_ORDER_SHIFT )) { +if (data->read_order) { temp_dec =i2c_smbus_read_byte_data (data->client,SBTSI_REG_TEMP_DEC ); temp_int =i2c_smbus_read_byte_data (data->client,SBTSI_REG_TEMP_INT ); }else {
@@ -122,6 +127,8 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,return temp_dec; *val =sbtsi_reg_to_mc (temp_int, temp_dec); +if (data->ext_range_mode) + *val -=SBTSI_TEMP_EXT_RANGE_ADJ ;return 0 ; }
@@ -146,6 +153,8 @@ static int sbtsi_write(struct device *dev, enum hwmon_sensor_types type,return -EINVAL ; } +if (data->ext_range_mode) + val +=SBTSI_TEMP_EXT_RANGE_ADJ ; val =clamp_val (val,SBTSI_TEMP_MIN ,SBTSI_TEMP_MAX );sbtsi_mc_to_reg (val, &temp_int, &temp_dec);
@@ -203,6 +212,7 @@ static int sbtsi_probe(struct i2c_client *client)struct device *dev = &client->dev;struct device *hwmon_dev;struct sbtsi_data *data; +int err; data =devm_kzalloc (dev,sizeof (struct sbtsi_data ),GFP_KERNEL );if (!data)
@@ -211,8 +221,14 @@ static int sbtsi_probe(struct i2c_client *client) data->client = client;mutex_init (&data->lock); - hwmon_dev =devm_hwmon_device_register_with_info (dev, client->name, data, &sbtsi_chip_info, -NULL ); + err =i2c_smbus_read_byte_data (data->client,SBTSI_REG_CONFIG ); +if (err <0 ) +return err; + data->ext_range_mode =FIELD_GET (BIT (SBTSI_CONFIG_EXT_RANGE_SHIFT ), err); + data->read_order =FIELD_GET (BIT (SBTSI_CONFIG_READ_ORDER_SHIFT ), err); + + hwmon_dev =devm_hwmon_device_register_with_info (dev, client->name, data, + &sbtsi_chip_info,NULL );return PTR_ERR_OR_ZERO (hwmon_dev); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 77/529 pinctrl: keembay: release allocated memory in detach path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit aae7a2876c3b39d07aa7655ea082af8e7862f3a5 ]
Unlike all the other allocations in this driver, the memory for storing the pin function descriptions allocated with kcalloc() and later resized with krealloc() is never freed. Use devres like elsewhere to handle that. While at it - replace krealloc() with more suitable devm_krealloc_array().
Note: the logic in this module is pretty convoluted and could probably use some revisiting, we should probably be able to calculate the exact amount of memory needed in advance or even skip the allocation altogether and just add each function to the radix tree separately.
--- drivers/pinctrl/pinctrl-keembay.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/pinctrl/pinctrl-keembay.c +5 -2
@@ -1606,7 +1606,8 @@ static int keembay_build_functions(struct keembay_pinctrl *kpc)* being part of 8 (hw maximum) globally unique muxes. */ kpc->nfuncs =0 ; - keembay_funcs =kcalloc (kpc->npins *8 ,sizeof (*keembay_funcs),GFP_KERNEL ); + keembay_funcs =devm_kcalloc (kpc->dev, kpc->npins *8 , +sizeof (*keembay_funcs),GFP_KERNEL );if (!keembay_funcs)return -ENOMEM ;
@@ -1637,7 +1638,9 @@ static int keembay_build_functions(struct keembay_pinctrl *kpc) }/* Reallocate memory based on actual number of functions */ - new_funcs =krealloc (keembay_funcs, kpc->nfuncs *sizeof (*new_funcs),GFP_KERNEL ); + new_funcs =devm_krealloc_array (kpc->dev, keembay_funcs, + kpc->nfuncs,sizeof (*new_funcs), +GFP_KERNEL );if (!new_funcs) {kfree (keembay_funcs);return -ENOMEM ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 78/529 power: supply: sbs-charger: Support multiple devices
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabien Proriol <[email protected]>
[ Upstream commit 3ec600210849cf122606e24caab85f0b936cf63c ]
If we have 2 instances of sbs-charger in the DTS, the driver probe for the second instance will fail:
[ 8.012874] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered [ 8.039094] sbs-charger 18-0009: ltc4100: smart charger device registered [ 8.112911] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered [ 8.134533] sysfs: cannot create duplicate filename '/class/power_supply/sbs-charger' [ 8.143871] CPU: 3 PID: 295 Comm: systemd-udevd Tainted: G O 5.10.147 #22 [ 8.151974] Hardware name: ALE AMB (DT) [ 8.155828] Call trace: [ 8.158292] dump_backtrace+0x0/0x1d4 [ 8.161960] show_stack+0x18/0x6c [ 8.165280] dump_stack+0xcc/0x128 [ 8.168687] sysfs_warn_dup+0x60/0x7c [ 8.172353] sysfs_do_create_link_sd+0xf0/0x100 [ 8.176886] sysfs_create_link+0x20/0x40 [ 8.180816] device_add+0x270/0x7a4 [ 8.184311] __power_supply_register+0x304/0x560 [ 8.188930] devm_power_supply_register+0x54/0xa0 [ 8.193644] sbs_probe+0xc0/0x214 [sbs_charger] [ 8.198183] i2c_device_probe+0x2dc/0x2f4 [ 8.202196] really_probe+0xf0/0x510 [ 8.205774] driver_probe_device+0xfc/0x160 [ 8.209960] device_driver_attach+0xc0/0xcc [ 8.214146] __driver_attach+0xc0/0x170 [ 8.218002] bus_for_each_dev+0x74/0xd4 [ 8.221862] driver_attach+0x24/0x30 [ 8.225444] bus_add_driver+0x148/0x250 [ 8.229283] driver_register+0x78/0x130 [ 8.233140] i2c_register_driver+0x4c/0xe0 [ 8.237250] sbs_driver_init+0x20/0x1000 [sbs_charger] [ 8.242424] do_one_initcall+0x50/0x1b0 [ 8.242434] do_init_module+0x44/0x230 [ 8.242438] load_module+0x2200/0x27c0 [ 8.242442] __do_sys_finit_module+0xa8/0x11c [ 8.242447] __arm64_sys_finit_module+0x20/0x30 [ 8.242457] el0_svc_common.constprop.0+0x64/0x154 [ 8.242464] do_el0_svc+0x24/0x8c [ 8.242474] el0_svc+0x10/0x20 [ 8.242481] el0_sync_handler+0x108/0x114 [ 8.242485] el0_sync+0x180/0x1c0 [ 8.243847] sbs-charger 20-0009: Failed to register power supply [ 8.287934] sbs-charger: probe of 20-0009 failed with error -17
This is mainly because the "name" field of power_supply_desc is a constant. This patch fixes the issue by reusing the same approach as sbs-battery. With this patch, the result is:
[ 7.819532] sbs-charger 18-0009: ltc4100: smart charger device registered [ 7.825305] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered [ 7.887423] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered [ 7.893501] sbs-charger 20-0009: ltc4100: smart charger device registered
--- drivers/power/supply/sbs-charger.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/power/supply/sbs-charger.c +13 -3
@@ -154,8 +154,7 @@ static const struct regmap_config sbs_regmap = { .val_format_endian = REGMAP_ENDIAN_LITTLE, /* since based on SMBus */ }; -static const struct power_supply_desc sbs_desc = { - .name ="sbs-charger" , +static const struct power_supply_desc sbs_default_desc = { .type =POWER_SUPPLY_TYPE_MAINS , .properties = sbs_properties, .num_properties =ARRAY_SIZE (sbs_properties),
@@ -165,9 +164,20 @@ static const struct power_supply_desc sbs_desc = {static int sbs_probe (struct i2c_client *client) {struct power_supply_config psy_cfg = {}; +struct power_supply_desc *sbs_desc;struct sbs_info *chip;int ret, val; + sbs_desc =devm_kmemdup (&client->dev, &sbs_default_desc, +sizeof (*sbs_desc),GFP_KERNEL ); +if (!sbs_desc) +return -ENOMEM ; + + sbs_desc->name =devm_kasprintf (&client->dev,GFP_KERNEL ,"sbs-%s" , +dev_name (&client->dev)); +if (!sbs_desc->name) +return -ENOMEM ; + chip =devm_kzalloc (&client->dev,sizeof (struct sbs_info ),GFP_KERNEL );if (!chip)return -ENOMEM ;
@@ -191,7 +201,7 @@ static int sbs_probe(struct i2c_client *client)return dev_err_probe (&client->dev, ret,"Failed to get device status\n" ); chip->last_state = val; - chip->power_supply =devm_power_supply_register (&client->dev, &sbs_desc, &psy_cfg); + chip->power_supply =devm_power_supply_register (&client->dev, sbs_desc, &psy_cfg);if (IS_ERR (chip->power_supply))return dev_err_probe (&client->dev,PTR_ERR (chip->power_supply),"Failed to register power supply\n" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/529 hwmon: sy7636a: add alias
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Kemnade <[email protected]>
[ Upstream commit 80038a758b7fc0cdb6987532cbbf3f75b13e0826 ]
Add module alias to have it autoloaded.
--- drivers/hwmon/sy7636a-hwmon.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/sy7636a-hwmon.c +1 -0
@@ -104,3 +104,4 @@ module_platform_driver(sy7636a_sensor_driver);MODULE_DESCRIPTION ("SY7636A sensor driver" );MODULE_LICENSE ("GPL" ); +MODULE_ALIAS ("platform:sy7636a-temperature" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 80/529 irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Wang <[email protected]>
[ Upstream commit c33c43f71bda362b292a6e57ac41b64342dc87b3 ]
On certain Loongson platforms, drivers attempting to request a legacy ISA IRQ directly via request_irq() (e.g., IRQ 4) may fail. The virtual IRQ descriptor is not fully initialized and lacks a valid irqchip.
This issue does not affect ACPI-enumerated devices described in DSDT, as their interrupts are properly mapped via the GSI translation path. This indicates the LPC irqdomain itself is functional but is not correctly handling direct VIRQ-to-HWIRQ mappings.
The root cause is the use of irq_domain_create_linear(). This API sets up a domain for dynamic, on-demand mapping, typically triggered by a GSI request. It does not pre-populate the mappings for the legacy VIRQ range (0-15). Consequently, if no ACPI device claims a specific GSI (e.g., GSI 4), the corresponding VIRQ (e.g., VIRQ 4) is never mapped to the LPC domain. A direct call to request_irq(4, ...) then fails because the kernel cannot resolve this VIRQ to a hardware interrupt managed by the LPC controller.
The PCH-LPC interrupt controller is an i8259-compatible legacy device that requires a deterministic, static 1-to-1 mapping for IRQs 0-15 to support legacy drivers.
Fix this by replacing irq_domain_create_linear() with irq_domain_create_legacy(). This API is specifically designed for such controllers. It establishes the required static 1-to-1 VIRQ-to-HWIRQ mapping for the entire legacy range (0-15) immediately upon domain creation. This ensures that any VIRQ in this range is always resolvable, making direct calls to request_irq() for legacy IRQs function correctly.
--- drivers/irqchip/irq-loongson-pch-lpc.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/irqchip/irq-loongson-pch-lpc.c +7 -2
@@ -198,8 +198,13 @@ int __init pch_lpc_acpi_init(struct irq_domain *parent, goto iounmap_base; } - priv->lpc_domain =irq_domain_create_linear (irq_handle,LPC_COUNT , - &pch_lpc_domain_ops, priv); +/* +* The LPC interrupt controller is a legacy i8259-compatible device, +* which requires a static 1:1 mapping for IRQs 0-15. +* Use irq_domain_create_legacy to establish this static mapping early. +*/ + priv->lpc_domain =irq_domain_create_legacy (irq_handle,LPC_COUNT ,0 ,0 , + &pch_lpc_domain_ops, priv);if (!priv->lpc_domain) {pr_err ("Failed to create IRQ domain\n" ); goto free_irq_handle;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/529 arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radhey Shyam Pandey <[email protected]>
[ Upstream commit 767ecf9da7b31e5c0c22c273001cb2784705fe8c ]
On a few zcu106 boards USB devices (Dell MS116 USB Optical Mouse, Dell USB Entry Keyboard) are not enumerated on linux boot due to commit 'b8745e7eb488 ("arm64: zynqmp: Fix usb node drive strength and slew rate")'.
To fix it as a workaround revert to working version and then investigate at board level why drive strength from 12mA to 4mA and slew from fast to slow is not working.
--- arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts +2 -2
@@ -808,8 +808,8 @@ pins = "MIO54", "MIO56", "MIO57", "MIO58", "MIO59", "MIO60", "MIO61", "MIO62", "MIO63"; bias-disable; - drive-strength = <4>; - slew-rate = <SLEW_RATE_SLOW>; + drive-strength = <12>; + slew-rate = <SLEW_RATE_FAST>; }; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/529 soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Svyatoslav Ryhel <[email protected]>
[ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
Add missing Tegra114 nvmem cells and fuse lookups which were added for Tegra124+ but omitted for Tegra114.
--- drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++++++++++++++++++++++ 1 file changed, 122 insertions(+)
drivers/soc/tegra/fuse/fuse-tegra30.c +122 -0
@@ -116,6 +116,124 @@ const struct tegra_fuse_soc tegra30_fuse_soc = {#endif #ifdef CONFIG_ARCH_TEGRA_114_SOC +static const struct nvmem_cell_info tegra114_fuse_cells[] = { + { + .name ="tsensor-cpu1" , + .offset =0x084 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-cpu2" , + .offset =0x088 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-common" , + .offset =0x08c , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-cpu0" , + .offset =0x098 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="xusb-pad-calibration" , + .offset =0x0f0 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-cpu3" , + .offset =0x12c , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-gpu" , + .offset =0x154 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-mem0" , + .offset =0x158 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-mem1" , + .offset =0x15c , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-pllx" , + .offset =0x160 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, +}; + +static const struct nvmem_cell_lookup tegra114_fuse_lookups[] = { + { + .nvmem_name ="fuse" , + .cell_name ="xusb-pad-calibration" , + .dev_id ="7009f000.padctl" , + .con_id ="calibration" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-common" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="common" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-cpu0" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="cpu0" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-cpu1" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="cpu1" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-cpu2" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="cpu2" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-cpu3" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="cpu3" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-mem0" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="mem0" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-mem1" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="mem1" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-gpu" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="gpu" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-pllx" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="pllx" , + }, +}; +static const struct tegra_fuse_info tegra114_fuse_info = { .read = tegra30_fuse_read, .size = 0x2a0,
@@ -126,6 +244,10 @@ const struct tegra_fuse_soc tegra114_fuse_soc = { .init = tegra30_fuse_init, .speedo_init = tegra114_init_speedo_data, .info = &tegra114_fuse_info, + .lookups = tegra114_fuse_lookups, + .num_lookups = ARRAY_SIZE(tegra114_fuse_lookups), + .cells = tegra114_fuse_cells, + .num_cells = ARRAY_SIZE(tegra114_fuse_cells), .soc_attr_group = &tegra_soc_attr_group, .clk_suspend_on = false, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 83/529 ARM: tegra: transformer-20: add missing magnetometer interrupt
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Svyatoslav Ryhel <[email protected]>
[ Upstream commit cca41614d15ce2bbc2c661362d3eafe53c9990af ]
Add missing interrupt to magnetometer node.
--- arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts | 3 +++ 1 file changed, 3 insertions(+)
arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts +3 -0
@@ -502,6 +502,9 @@ compatible = "asahi-kasei,ak8974"; reg = <0xe>; + interrupt-parent = <&gpio>; + interrupts = <TEGRA_GPIO(N, 5) IRQ_TYPE_EDGE_RISING>; + avdd-supply = <&vdd_3v3_sys>; dvdd-supply = <&vdd_1v8_sys>;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/529 ARM: tegra: transformer-20: fix audio-codec interrupt
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Svyatoslav Ryhel <[email protected]>
[ Upstream commit 3f973d78d176768fa7456def97f0b9824235024f ]
Correct audio-codec interrupt should be PX3 while PX1 is used for external microphone detection.
--- arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts +1 -1
@@ -518,7 +518,7 @@ reg = <0x1a>; interrupt-parent = <&gpio>; - interrupts = <TEGRA_GPIO(X, 1) IRQ_TYPE_EDGE_BOTH>; + interrupts = <TEGRA_GPIO(X, 3) IRQ_TYPE_EDGE_BOTH>; gpio-controller; #gpio-cells = <2>;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/529 mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarthak Garg <[email protected]>
[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
For Qualcomm SoCs which needs level shifter for SD card, extra delay is seen on receiver data path.
To compensate this delay enable tuning for SDR50 mode for targets which has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets with level shifter on Qualcomm SOC's.
--- drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/mmc/host/sdhci-msm.c +15 -0
@@ -81,6 +81,7 @@#define CORE_IO_PAD_PWR_SWITCH_EN BIT(15)#define CORE_IO_PAD_PWR_SWITCH BIT(16)#define CORE_HC_SELECT_IN_EN BIT(18) +#define CORE_HC_SELECT_IN_SDR50 (4 << 19)#define CORE_HC_SELECT_IN_HS400 (6 << 19)#define CORE_HC_SELECT_IN_MASK (7 << 19)
@@ -1133,6 +1134,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host) {struct mmc_ios *ios = &host->mmc->ios; +if (ios->timing ==MMC_TIMING_UHS_SDR50 && + host->flags &SDHCI_SDR50_NEEDS_TUNING ) +return true; +/* * Tuning is required for SDR104, HS200 and HS400 cards and * if clock frequency is greater than 100MHz in these modes.
@@ -1201,6 +1206,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)struct mmc_ios ios = host->mmc->ios;struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host);struct sdhci_msm_host *msm_host =sdhci_pltfm_priv (pltfm_host); +const struct sdhci_msm_offset *msm_offset = msm_host->offset; +u32 config;if (!sdhci_msm_is_tuning_needed (host)) { msm_host->use_cdr = false;
@@ -1217,6 +1224,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)*/ msm_host->tuning_done =0 ; +if (ios.timing ==MMC_TIMING_UHS_SDR50 && + host->flags &SDHCI_SDR50_NEEDS_TUNING ) { + config =readl_relaxed (host->ioaddr + msm_offset->core_vendor_spec); + config &= ~CORE_HC_SELECT_IN_MASK ; + config |=CORE_HC_SELECT_IN_EN |CORE_HC_SELECT_IN_SDR50 ; +writel_relaxed (config, host->ioaddr + msm_offset->core_vendor_spec); + } +/* * For HS400 tuning in HS200 timing requires: * - select MCLK/2 in VENDOR_SPEC
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 86/529 ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
When deleting the previous walkstate operand stack acpi_ds_call_control_method() was deleting obj_desc->Method.param_count operands. But Method.param_count does not necessarily match this_walk_state->num_operands, it may be either less or more.
After correcting the for loop to check i < this_walk_state->num_operands the code is identical to acpi_ds_clear_operands(), so just outright replace the code with acpi_ds_clear_operands() to fix this.
--- drivers/acpi/acpica/dsmethod.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
drivers/acpi/acpica/dsmethod.c +1 -8
@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,* Delete the operands on the previous walkstate operand stack * (they were copied to new objects) */ -for (i =0 ; i < obj_desc->method.param_count; i++) { -acpi_ut_remove_reference (this_walk_state->operands[i]); - this_walk_state->operands[i] =NULL ; - } - -/* Clear the operand stack */ - - this_walk_state->num_operands =0 ; +acpi_ds_clear_operands (this_walk_state); ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH, "**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 87/529 tee: allow a driver to allocate a tee_device without a pool
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amirreza Zarrabi <[email protected]>
[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
A TEE driver doesn't always need to provide a pool if it doesn't support memory sharing ioctls and can allocate memory for TEE messages in another way. Although this is mentioned in the documentation for tee_device_alloc(), it is not handled correctly.
--- drivers/tee/tee_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tee/tee_core.c +1 -1
@@ -889,7 +889,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,if (!teedesc || !teedesc->name || !teedesc->ops || !teedesc->ops->get_version || !teedesc->ops->open || - !teedesc->ops->release || !pool) + !teedesc->ops->release)return ERR_PTR (-EINVAL ); teedev =kzalloc (sizeof (*teedev),GFP_KERNEL );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 88/529 nvmet-fc: avoid scheduling association deletion twice
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <[email protected]>
[ Upstream commit f2537be4f8421f6495edfa0bc284d722f253841d ]
When forcefully shutting down a port via the configfs interface, nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and then nvmet_disable_port(). Both functions will eventually schedule all remaining associations for deletion.
The current implementation checks whether an association is about to be removed, but only after the work item has already been scheduled. As a result, it is possible for the first scheduled work item to free all resources, and then for the same work item to be scheduled again for deletion.
Because the association list is an RCU list, it is not possible to take a lock and remove the list entry directly, so it cannot be looked up again. Instead, a flag (terminating) must be used to determine whether the association is already in the process of being deleted.
--- drivers/nvme/target/fc.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/nvme/target/fc.c +9 -7
@@ -1090,6 +1090,14 @@ nvmet_fc_delete_assoc_work(struct work_struct *work)static void nvmet_fc_schedule_delete_assoc (struct nvmet_fc_tgt_assoc *assoc) { +int terminating; + + terminating =atomic_xchg (&assoc->terminating,1 ); + +/* if already terminating, do nothing */ +if (terminating) +return ; +nvmet_fc_tgtport_get (assoc->tgtport);if (!queue_work (nvmet_wq, &assoc->del_work))nvmet_fc_tgtport_put (assoc->tgtport);
@@ -1209,13 +1217,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc) {struct nvmet_fc_tgtport *tgtport = assoc->tgtport;unsigned long flags; -int i, terminating; - - terminating =atomic_xchg (&assoc->terminating,1 ); - -/* if already terminating, do nothing */ -if (terminating) -return ; +int i;spin_lock_irqsave (&tgtport->lock, flags);list_del_rcu (&assoc->a_list);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/529 nvme-fc: use lock accessing port_state and rport state
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <[email protected]>
[ Upstream commit 891cdbb162ccdb079cd5228ae43bdeebce8597ad ]
nvme_fc_unregister_remote removes the remote port on a lport object at any point in time when there is no active association. This races with with the reconnect logic, because nvme_fc_create_association is not taking a lock to check the port_state and atomically increase the active count on the rport.
--- drivers/nvme/host/fc.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/nvme/host/fc.c +8 -2
@@ -3024,11 +3024,17 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl) ++ctrl->ctrl.nr_reconnects; -if (ctrl->rport->remoteport.port_state !=FC_OBJSTATE_ONLINE ) +spin_lock_irqsave (&ctrl->rport->lock, flags); +if (ctrl->rport->remoteport.port_state !=FC_OBJSTATE_ONLINE ) { +spin_unlock_irqrestore (&ctrl->rport->lock, flags);return -ENODEV ; + } -if (nvme_fc_ctlr_active_on_rport (ctrl)) +if (nvme_fc_ctlr_active_on_rport (ctrl)) { +spin_unlock_irqrestore (&ctrl->rport->lock, flags);return -ENOTUNIQ ; + } +spin_unlock_irqrestore (&ctrl->rport->lock, flags);dev_info (ctrl->ctrl.device, "NVME-FC{%d}: create association : host wwpn 0x%016llx "
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 90/529 bpf: Do not limit bpf_cgroup_from_id to currents namespace
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Kartikeya Dwivedi <[email protected]>
[ Upstream commit 2c895133950646f45e5cf3900b168c952c8dbee8 ]
The bpf_cgroup_from_id kfunc relies on cgroup_get_from_id to obtain the cgroup corresponding to a given cgroup ID. This helper can be called in a lot of contexts where the current thread can be random. A recent example was its use in sched_ext's ops.tick(), to obtain the root cgroup pointer. Since the current task can be whatever random user space task preempted by the timer tick, this makes the behavior of the helper unreliable.
Refactor out __cgroup_get_from_id as the non-namespace aware version of cgroup_get_from_id, and change bpf_cgroup_from_id to make use of it.
There is no compatibility breakage here, since changing the namespace against which the lookup is being done to the root cgroup namespace only permits a wider set of lookups to succeed now. The cgroup IDs across namespaces are globally unique, and thus don't need to be retranslated.
--- include/linux/cgroup.h | 1 + kernel/bpf/helpers.c | 2 +- kernel/cgroup/cgroup.c | 24 ++++++++++++++++++++---- 3 files changed, 22 insertions(+), 5 deletions(-)
include/linux/cgroup.h +1 -0
@@ -633,6 +633,7 @@ static inline void cgroup_kthread_ready(void) }void cgroup_path_from_kernfs_id (u64 id,char *buf,size_t buflen); +struct cgroup *__cgroup_get_from_id (u64 id);struct cgroup *cgroup_get_from_id (u64 id);#else /* !CONFIG_CGROUPS */
kernel/bpf/helpers.c +1 -1
@@ -2276,7 +2276,7 @@ __bpf_kfunc struct cgroup *bpf_cgroup_from_id(u64 cgid) {struct cgroup *cgrp; - cgrp =cgroup_get_from_id (cgid); + cgrp =__cgroup_get_from_id (cgid);if (IS_ERR (cgrp))return NULL ;return cgrp;
kernel/cgroup/cgroup.c +20 -4
@@ -6220,15 +6220,15 @@ void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen) }/* -* cgroup_get_from_id : get the cgroup associated with cgroup id +* __cgroup_get_from_id : get the cgroup associated with cgroup id * @id: cgroup id * On success return the cgrp or ERR_PTR on failure -* Only cgroups within current task's cgroup NS are valid. +* There are no cgroup NS restrictions. */ -struct cgroup *cgroup_get_from_id (u64 id) +struct cgroup *__cgroup_get_from_id (u64 id) {struct kernfs_node *kn; -struct cgroup *cgrp, *root_cgrp; +struct cgroup *cgrp; kn =kernfs_find_and_get_node_by_id (cgrp_dfl_root.kf_root, id);if (!kn)
@@ -6250,6 +6250,22 @@ struct cgroup *cgroup_get_from_id(u64 id)if (!cgrp)return ERR_PTR (-ENOENT ); +return cgrp; +} + +/* +* cgroup_get_from_id : get the cgroup associated with cgroup id +* @id: cgroup id +* On success return the cgrp or ERR_PTR on failure +* Only cgroups within current task's cgroup NS are valid. +*/ +struct cgroup *cgroup_get_from_id (u64 id) +{ +struct cgroup *cgrp, *root_cgrp; + + cgrp =__cgroup_get_from_id (id); +if (IS_ERR (cgrp)) +return cgrp; root_cgrp =current_cgns_cgroup_dfl ();if (!cgroup_is_descendant (cgrp, root_cgrp)) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 91/529 video: backlight: lp855x_bl: Set correct EPROM start for LP8556
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Svyatoslav Ryhel <[email protected]>
[ Upstream commit 07c7efda24453e05951fb2879f5452b720b91169 ]
According to LP8556 datasheet EPROM region starts at 0x98 so adjust value in the driver accordingly.
--- drivers/video/backlight/lp855x_bl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/backlight/lp855x_bl.c +1 -1
@@ -22,7 +22,7 @@#define LP855X_DEVICE_CTRL 0x01#define LP855X_EEPROM_START 0xA0#define LP855X_EEPROM_END 0xA7 -#define LP8556_EPROM_START 0xA0 +#define LP8556_EPROM_START 0x98#define LP8556_EPROM_END 0xAF/* LP8555/7 Registers */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/529 tools/cpupower: fix error return value in cpupower_write_sysfs()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <[email protected]>
[ Upstream commit 57b100d4cf14276e0340eecb561005c07c129eb8 ]
The cpupower_write_sysfs() function currently returns -1 on write failure, but the function signature indicates it should return an unsigned int. Returning -1 from an unsigned function results in a large positive value rather than indicating an error condition.
Fix this by returning 0 on failure, which is more appropriate for an unsigned return type and maintains consistency with typical success/failure semantics where 0 indicates failure and non-zero indicates success (bytes written).
--- tools/power/cpupower/lib/cpupower.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/power/cpupower/lib/cpupower.c +1 -1
@@ -55,7 +55,7 @@ unsigned int cpupower_write_sysfs(const char *path, char *buf, size_t buflen)if (numwritten <1 ) {perror (path);close (fd); -return -1 ; +return 0 ; }close (fd);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/529 pmdomain: apple: Add "apple,t8103-pmgr-pwrstate"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janne Grunau <[email protected]>
[ Upstream commit 442816f97a4f84cb321d3359177a3b9b0ce48a60 ]
After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,pmgr-pwrstate" anymore [1]. Use "apple,t8103-pmgr-pwrstate" as base compatible as it is the SoC the driver and bindings were written for.
[1]: https://lore.kernel.org/asahi/[email protected]/
--- drivers/pmdomain/apple/pmgr-pwrstate.c | 1 + 1 file changed, 1 insertion(+)
drivers/pmdomain/apple/pmgr-pwrstate.c +1 -0
@@ -306,6 +306,7 @@ static int apple_pmgr_ps_probe(struct platform_device *pdev) }static const struct of_device_id apple_pmgr_ps_of_match[] = { + { .compatible ="apple,t8103-pmgr-pwrstate" }, { .compatible ="apple,pmgr-pwrstate" }, {} };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/529 power: supply: qcom_battmgr: handle charging state change notifications
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fenglin Wu <[email protected]>
[ Upstream commit 41307ec7df057239aae3d0f089cc35a0d735cdf8 ]
The X1E80100 battery management firmware sends a notification with code 0x83 when the battery charging state changes, such as switching between fast charge, taper charge, end of charge, or any other error charging states.
The same notification code is used with bit[8] set when charging stops because the charge control end threshold is reached. Additionally, a 2-bit value is included in bit[10:9] with the same code to indicate the charging source capability, which is determined by the calculated power from voltage and current readings from PDOs: 2 means a strong charger over 60W, 1 indicates a weak charger, and 0 means there is no charging source.
These 3-MSB [10:8] in the notification code is not much useful for now, hence just ignore them and trigger a power supply change event whenever 0x83 notification code is received. This helps to eliminate the unknown notification error messages.
--- drivers/power/supply/qcom_battmgr.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/power/supply/qcom_battmgr.c +4 -1
@@ -29,8 +29,9 @@ enum qcom_battmgr_variant {#define NOTIF_BAT_PROPERTY 0x30#define NOTIF_USB_PROPERTY 0x32#define NOTIF_WLS_PROPERTY 0x34 -#define NOTIF_BAT_INFO 0x81#define NOTIF_BAT_STATUS 0x80 +#define NOTIF_BAT_INFO 0x81 +#define NOTIF_BAT_CHARGING_STATE 0x83#define BATTMGR_BAT_INFO 0x9
@@ -940,12 +941,14 @@ static void qcom_battmgr_notification(struct qcom_battmgr *battmgr, } notification =le32_to_cpu (msg->notification); + notification &=0xff ;switch (notification) {case NOTIF_BAT_INFO : battmgr->info.valid = false; fallthrough;case NOTIF_BAT_STATUS :case NOTIF_BAT_PROPERTY : +case NOTIF_BAT_CHARGING_STATE :power_supply_changed (battmgr->bat_psy);break ;case NOTIF_USB_PROPERTY :
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 95/529 bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Stellard <[email protected]>
[ Upstream commit 5612ea8b554375d45c14cbb0f8ea93ec5d172891 ]
This fixes the build with -Werror -Wall.
btf_dumper.c:71:31: error: variable 'finfo' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
71 | info.func_info = ptr_to_u64(&finfo);
| ^~~~~
prog.c:2294:31: error: variable 'func_info' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
2294 | info.func_info = ptr_to_u64(&func_info);
|v2:
- Initialize instead of using memset.
--- tools/bpf/bpftool/btf_dumper.c | 2 +- tools/bpf/bpftool/prog.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
tools/bpf/bpftool/btf_dumper.c +1 -1
@@ -38,7 +38,7 @@ static int dump_prog_id_as_func_ptr(const struct btf_dumper *d,__u32 info_len =sizeof (info);const char *prog_name =NULL ;struct btf *prog_btf =NULL ; -struct bpf_func_info finfo; +struct bpf_func_info finfo = {};__u32 finfo_rec_size;char prog_str[1024 ];int err;
tools/bpf/bpftool/prog.c +1 -1
@@ -2203,7 +2203,7 @@ static void profile_print_readings(void)static char *profile_target_name (int tgt_fd) { -struct bpf_func_info func_info; +struct bpf_func_info func_info = {};struct bpf_prog_info info = {};__u32 info_len =sizeof (info);const struct btf_type *t;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/529 cpuidle: Fail cpuidle device registration if there is one already
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 7b1b7961170e4fcad488755e5ffaaaf9bd527e8f ]
Refuse to register a cpuidle device if the given CPU has a cpuidle device already and print a message regarding it.
Without this, an attempt to register a new cpuidle device without unregistering the existing one leads to the removal of the existing cpuidle device without removing its sysfs interface.
--- drivers/cpuidle/cpuidle.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/cpuidle/cpuidle.c +7 -1
@@ -634,8 +634,14 @@ static void __cpuidle_device_init(struct cpuidle_device *dev)static int __cpuidle_register_device (struct cpuidle_device *dev) {struct cpuidle_driver *drv =cpuidle_get_cpu_driver (dev); +unsigned int cpu = dev->cpu;int i, ret; +if (per_cpu (cpuidle_devices, cpu)) { +pr_info ("CPU%d: cpuidle device already registered\n" , cpu); +return -EEXIST ; + } +if (!try_module_get (drv->owner))return -EINVAL ;
@@ -647,7 +653,7 @@ static int __cpuidle_register_device(struct cpuidle_device *dev) dev->states_usage[i].disable |=CPUIDLE_STATE_DISABLED_BY_USER ; } -per_cpu (cpuidle_devices, dev->cpu) = dev; +per_cpu (cpuidle_devices, cpu) = dev;list_add (&dev->device_list, &cpuidle_detected_devices); ret =cpuidle_coupled_register_device (dev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/529 futex: Dont leak robust_list pointer on exec race
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pranav Tyagi <[email protected]>
[ Upstream commit 6b54082c3ed4dc9821cdf0edb17302355cc5bb45 ]
sys_get_robust_list() and compat_get_robust_list() use ptrace_may_access() to check if the calling task is allowed to access another task's robust_list pointer. This check is racy against a concurrent exec() in the target process.
During exec(), a task may transition from a non-privileged binary to a privileged one (e.g., setuid binary) and its credentials/memory mappings may change. If get_robust_list() performs ptrace_may_access() before this transition, it may erroneously allow access to sensitive information after the target becomes privileged.
A racy access allows an attacker to exploit a window during which ptrace_may_access() passes before a target process transitions to a privileged state via exec().
For example, consider a non-privileged task T that is about to execute a setuid-root binary. An attacker task A calls get_robust_list(T) while T is still unprivileged. Since ptrace_may_access() checks permissions based on current credentials, it succeeds. However, if T begins exec immediately afterwards, it becomes privileged and may change its memory mappings. Because get_robust_list() proceeds to access T->robust_list without synchronizing with exec() it may read user-space pointers from a now-privileged process.
This violates the intended post-exec access restrictions and could expose sensitive memory addresses or be used as a primitive in a larger exploit chain. Consequently, the race can lead to unauthorized disclosure of information across privilege boundaries and poses a potential security risk.
Take a read lock on signal->exec_update_lock prior to invoking ptrace_may_access() and accessing the robust_list/compat_robust_list. This ensures that the target task's exec state remains stable during the check, allowing for consistent and synchronized validation of credentials.
--- kernel/futex/syscalls.c | 106 +++++++++++++++++++++------------------- 1 file changed, 56 insertions(+), 50 deletions(-)
kernel/futex/syscalls.c +56 -50
@@ -40,6 +40,56 @@ SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,return 0 ; } +static inline void __user *futex_task_robust_list (struct task_struct *p,bool compat) +{ +#ifdef CONFIG_COMPAT +if (compat) +return p->compat_robust_list; +#endif +return p->robust_list; +} + +static void __user *futex_get_robust_list_common (int pid,bool compat) +{ +struct task_struct *p = current; +void __user *head; +int ret; + +scoped_guard (rcu) { +if (pid) { + p =find_task_by_vpid (pid); +if (!p) +return (void __user *)ERR_PTR (-ESRCH ); + } +get_task_struct (p); + } + +/* +* Hold exec_update_lock to serialize with concurrent exec() +* so ptrace_may_access() is checked against stable credentials +*/ + ret =down_read_killable (&p->signal->exec_update_lock); +if (ret) + goto err_put; + + ret = -EPERM ; +if (!ptrace_may_access (p,PTRACE_MODE_READ_REALCREDS )) + goto err_unlock; + + head =futex_task_robust_list (p, compat); + +up_read (&p->signal->exec_update_lock); +put_task_struct (p); + +return head; + +err_unlock: +up_read (&p->signal->exec_update_lock); +err_put: +put_task_struct (p); +return (void __user *)ERR_PTR (ret); +} +/** * sys_get_robust_list() - Get the robust-futex list head of a task * @pid: pid of the process [zero for current task]
@@ -50,36 +100,14 @@ SYSCALL_DEFINE3(get_robust_list, int, pid, struct robust_list_head __user * __user *, head_ptr, size_t __user *, len_ptr) { - struct robust_list_head __user *head; -unsigned long ret; -struct task_struct *p; - -rcu_read_lock (); - - ret = -ESRCH ; -if (!pid) - p = current; -else { - p =find_task_by_vpid (pid); -if (!p) - goto err_unlock; - } - - ret = -EPERM ; -if (!ptrace_may_access (p,PTRACE_MODE_READ_REALCREDS )) - goto err_unlock; + struct robust_list_head __user *head = futex_get_robust_list_common(pid, false); - head = p->robust_list; -rcu_read_unlock (); +if (IS_ERR (head)) +return PTR_ERR (head);if (put_user (sizeof (*head), len_ptr))return -EFAULT ;return put_user (head, head_ptr); - -err_unlock: -rcu_read_unlock (); - -return ret; } long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
@@ -322,36 +350,14 @@ COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid, compat_uptr_t __user *, head_ptr, compat_size_t __user *, len_ptr) { -struct compat_robust_list_head __user *head; -unsigned long ret; -struct task_struct *p; - -rcu_read_lock (); - - ret = -ESRCH ; -if (!pid) - p = current; -else { - p =find_task_by_vpid (pid); -if (!p) - goto err_unlock; - } - - ret = -EPERM ; -if (!ptrace_may_access (p,PTRACE_MODE_READ_REALCREDS )) - goto err_unlock; +struct compat_robust_list_head __user *head =futex_get_robust_list_common (pid, true); - head = p->compat_robust_list; -rcu_read_unlock (); +if (IS_ERR (head)) +return PTR_ERR (head);if (put_user (sizeof (*head), len_ptr))return -EFAULT ;return put_user (ptr_to_compat (head), head_ptr); - -err_unlock: -rcu_read_unlock (); - -return ret; }#endif /* CONFIG_COMPAT */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/529 spi: rpc-if: Add resume support for RZ/G3E
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit ad4728740bd68d74365a43acc25a65339a9b2173 ]
On RZ/G3E using PSCI, s2ram powers down the SoC. After resume, reinitialize the hardware for SPI operations.
--- drivers/spi/spi-rpc-if.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/spi/spi-rpc-if.c +2 -0
@@ -193,6 +193,8 @@ static int __maybe_unused rpcif_spi_resume(struct device *dev) {struct spi_controller *ctlr =dev_get_drvdata (dev); +rpcif_hw_init (dev, false); +return spi_controller_resume (ctlr); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/529 clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Lezcano <[email protected]>
[ Upstream commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c ]
The driver uses the raw_readl() and raw_writel() functions. Those are not for MMIO devices. Replace them with readl() and writel()
[ dlezcano: Fixed typo in the subject s/reald/readl/ ]
--- drivers/clocksource/timer-vf-pit.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
drivers/clocksource/timer-vf-pit.c +11 -11
@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy;static inline void pit_timer_enable (void ) { -__raw_writel (PITTCTRL_TEN |PITTCTRL_TIE , clkevt_base +PITTCTRL ); +writel (PITTCTRL_TEN |PITTCTRL_TIE , clkevt_base +PITTCTRL ); }static inline void pit_timer_disable (void ) { -__raw_writel (0 , clkevt_base +PITTCTRL ); +writel (0 , clkevt_base +PITTCTRL ); }static inline void pit_irq_acknowledge (void ) { -__raw_writel (PITTFLG_TIF , clkevt_base +PITTFLG ); +writel (PITTFLG_TIF , clkevt_base +PITTFLG ); } static u64 notrace pit_read_sched_clock(void) { -return ~__raw_readl (clksrc_base +PITCVAL ); +return ~readl (clksrc_base +PITCVAL ); }static int __init pit_clocksource_init (unsigned long rate) {/* set the max load value and start the clock source counter */ -__raw_writel (0 , clksrc_base +PITTCTRL ); -__raw_writel (~0UL , clksrc_base +PITLDVAL ); -__raw_writel (PITTCTRL_TEN , clksrc_base +PITTCTRL ); +writel (0 , clksrc_base +PITTCTRL ); +writel (~0UL , clksrc_base +PITLDVAL ); +writel (PITTCTRL_TEN , clksrc_base +PITTCTRL );sched_clock_register (pit_read_sched_clock,32 , rate); return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta,* hardware requirement. */ pit_timer_disable (); -__raw_writel (delta -1 , clkevt_base +PITLDVAL ); +writel (delta -1 , clkevt_base +PITLDVAL );pit_timer_enable ();return 0 ;
@@ -125,8 +125,8 @@ static struct clock_event_device clockevent_pit = {static int __init pit_clockevent_init (unsigned long rate,int irq) { -__raw_writel (0 , clkevt_base +PITTCTRL ); -__raw_writel (PITTFLG_TIF , clkevt_base +PITTFLG ); +writel (0 , clkevt_base +PITTCTRL ); +writel (PITTFLG_TIF , clkevt_base +PITTFLG );BUG_ON (request_irq (irq, pit_timer_interrupt,IRQF_TIMER |IRQF_IRQPOLL ,"VF pit timer" , &clockevent_pit));
@@ -183,7 +183,7 @@ static int __init pit_timer_init(struct device_node *np) cycle_per_jiffy = clk_rate / (HZ );/* enable the pit module */ -__raw_writel (~PITMCR_MDIS , timer_base +PITMCR ); +writel (~PITMCR_MDIS , timer_base +PITMCR ); ret =pit_clocksource_init (clk_rate);if (ret)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/529 blk-cgroup: fix possible deadlock while configuring policy
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 5d726c4dbeeddef612e6bed27edd29733f4d13af ]
Following deadlock can be triggered easily by lockdep:
WARNING: possible circular locking dependency detected 6.17.0-rc3-00124-ga12c2658ced0 #1665 Not tainted
------------------------------------------------------
check/1334 is trying to acquire lock:ff1100011d9d0678 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_unregister_queue+0x53/0x180
but task is already holding lock:ff1100011d9d00e0 (&q->q_usage_counter(queue)#3){++++}-{0:0}, at: del_gendisk+0xba/0x110
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&q->q_usage_counter(queue)#3){++++}-{0:0}:
blk_queue_enter+0x40b/0x470
blkg_conf_prep+0x7b/0x3c0
tg_set_limit+0x10a/0x3e0
cgroup_file_write+0xc6/0x420
kernfs_fop_write_iter+0x189/0x280
vfs_write+0x256/0x490
ksys_write+0x83/0x190
__x64_sys_write+0x21/0x30
x64_sys_call+0x4608/0x4630
do_syscall_64+0xdb/0x6b0
entry_SYSCALL_64_after_hwframe+0x76/0x7e-> #1 (&q->rq_qos_mutex){+.+.}-{4:4}:
__mutex_lock+0xd8/0xf50
mutex_lock_nested+0x2b/0x40
wbt_init+0x17e/0x280
wbt_enable_default+0xe9/0x140
blk_register_queue+0x1da/0x2e0
__add_disk+0x38c/0x5d0
add_disk_fwnode+0x89/0x250
device_add_disk+0x18/0x30
virtblk_probe+0x13a3/0x1800
virtio_dev_probe+0x389/0x610
really_probe+0x136/0x620
__driver_probe_device+0xb3/0x230
driver_probe_device+0x2f/0xe0
__driver_attach+0x158/0x250
bus_for_each_dev+0xa9/0x130
driver_attach+0x26/0x40
bus_add_driver+0x178/0x3d0
driver_register+0x7d/0x1c0
__register_virtio_driver+0x2c/0x60
virtio_blk_init+0x6f/0xe0
do_one_initcall+0x94/0x540
kernel_init_freeable+0x56a/0x7b0
kernel_init+0x2b/0x270
ret_from_fork+0x268/0x4c0
ret_from_fork_asm+0x1a/0x30-> #0 (&q->sysfs_lock){+.+.}-{4:4}:
__lock_acquire+0x1835/0x2940
lock_acquire+0xf9/0x450
__mutex_lock+0xd8/0xf50
mutex_lock_nested+0x2b/0x40
blk_unregister_queue+0x53/0x180
__del_gendisk+0x226/0x690
del_gendisk+0xba/0x110
sd_remove+0x49/0xb0 [sd_mod]
device_remove+0x87/0xb0
device_release_driver_internal+0x11e/0x230
device_release_driver+0x1a/0x30
bus_remove_device+0x14d/0x220
device_del+0x1e1/0x5a0
__scsi_remove_device+0x1ff/0x2f0
scsi_remove_device+0x37/0x60
sdev_store_delete+0x77/0x100
dev_attr_store+0x1f/0x40
sysfs_kf_write+0x65/0x90
kernfs_fop_write_iter+0x189/0x280
vfs_write+0x256/0x490
ksys_write+0x83/0x190
__x64_sys_write+0x21/0x30
x64_sys_call+0x4608/0x4630
do_syscall_64+0xdb/0x6b0
entry_SYSCALL_64_after_hwframe+0x76/0x7eother info that might help us debug this:
Chain exists of: &q->sysfs_lock --> &q->rq_qos_mutex --> &q->q_usage_counter(queue)#3 Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&q->q_usage_counter(queue)#3);
lock(&q->rq_qos_mutex);
lock(&q->q_usage_counter(queue)#3); lock(&q->sysfs_lock);
Root cause is that queue_usage_counter is grabbed with rq_qos_mutex held in blkg_conf_prep(), while queue should be freezed before rq_qos_mutex from other context.
The blk_queue_enter() from blkg_conf_prep() is used to protect against policy deactivation, which is already protected with blkcg_mutex, hence convert blk_queue_enter() to blkcg_mutex to fix this problem. Meanwhile, consider that blkcg_mutex is held after queue is freezed from policy deactivation, also convert blkg_alloc() to use GFP_NOIO.
--- block/blk-cgroup.c | 23 ++++++++--------------- 1 file changed, 8 insertions(+), 15 deletions(-)
block/blk-cgroup.c +8 -15
@@ -848,14 +848,8 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, disk = ctx->bdev->bd_disk; q = disk->queue; -/* -* blkcg_deactivate_policy() requires queue to be frozen, we can grab -* q_usage_counter to prevent concurrent with blkcg_deactivate_policy(). -*/ - ret =blk_queue_enter (q,0 ); -if (ret) - goto fail; - +/* Prevent concurrent with blkcg_deactivate_policy() */ +mutex_lock (&q->blkcg_mutex);spin_lock_irq (&q->queue_lock);if (!blkcg_policy_enabled (q, pol)) {
@@ -885,16 +879,16 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,/* Drop locks to do new blkg allocation with GFP_KERNEL. */ spin_unlock_irq (&q->queue_lock); - new_blkg =blkg_alloc (pos, disk,GFP_KERNEL ); + new_blkg =blkg_alloc (pos, disk,GFP_NOIO );if (unlikely (!new_blkg)) { ret = -ENOMEM ; - goto fail_exit_queue; + goto fail_exit; }if (radix_tree_preload (GFP_KERNEL )) {blkg_free (new_blkg); ret = -ENOMEM ; - goto fail_exit_queue; + goto fail_exit; }spin_lock_irq (&q->queue_lock);
@@ -922,7 +916,7 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, goto success; } success: -blk_queue_exit (q); +mutex_unlock (&q->blkcg_mutex); ctx->blkg = blkg;return 0 ;
@@ -930,9 +924,8 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,radix_tree_preload_end (); fail_unlock:spin_unlock_irq (&q->queue_lock); -fail_exit_queue: -blk_queue_exit (q); -fail: +fail_exit: +mutex_unlock (&q->blkcg_mutex);/* * If queue was bypassing, we should retry. Do so after a * short msleep(). It isn't strictly necessary but queue
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/529 riscv: bpf: Fix uninitialized symbol retval_off
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenghao Duan <[email protected]>
[ Upstream commit d0bf7cd5df18466d969bb60e8890b74cf96081ca ]
In the __arch_prepare_bpf_trampoline() function, retval_off is only meaningful when save_ret is true, so the current logic is correct. However, in the original logic, retval_off is only initialized under certain conditions; for example, in the fmod_ret logic, the compiler is not aware that the flags of the fmod_ret program (prog) have set BPF_TRAMP_F_CALL_ORIG, which results in an uninitialized symbol compilation warning.
So initialize retval_off unconditionally to fix it.
--- arch/riscv/net/bpf_jit_comp64.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
arch/riscv/net/bpf_jit_comp64.c +2 -3
@@ -855,10 +855,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, stack_size +=16 ; save_ret = flags & (BPF_TRAMP_F_CALL_ORIG |BPF_TRAMP_F_RET_FENTRY_RET ); -if (save_ret) { +if (save_ret) stack_size +=16 ;/* Save both A5 (BPF R0) and A0 */ - retval_off = stack_size; - } + retval_off = stack_size; stack_size += nregs *8 ; args_off = stack_size;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/529 bpf: Clear pfmemalloc flag when freeing all fragments
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amery Hung <[email protected]>
[ Upstream commit 8f12d1137c2382c80aada8e05d7cc650cd4e403c ]
It is possible for bpf_xdp_adjust_tail() to free all fragments. The kfunc currently clears the XDP_FLAGS_HAS_FRAGS bit, but not XDP_FLAGS_FRAGS_PF_MEMALLOC. So far, this has not caused a issue when building sk_buff from xdp_buff since all readers of xdp_buff->flags use the flag only when there are fragments. Clear the XDP_FLAGS_FRAGS_PF_MEMALLOC bit as well to make the flags correct.
--- include/net/xdp.h | 5 +++++ net/core/filter.c | 1 + 2 files changed, 6 insertions(+)
include/net/xdp.h +5 -0
@@ -113,6 +113,11 @@ static __always_inline void xdp_buff_set_frag_pfmemalloc(struct xdp_buff *xdp) xdp->flags |=XDP_FLAGS_FRAGS_PF_MEMALLOC ; } +static __always_inline void xdp_buff_clear_frag_pfmemalloc(struct xdp_buff *xdp) +{ + xdp->flags &= ~XDP_FLAGS_FRAGS_PF_MEMALLOC ; +} + static __always_inline voidxdp_init_buff (struct xdp_buff *xdp,u32 frame_sz,struct xdp_rxq_info *rxq) {
net/core/filter.c +1 -0
@@ -4203,6 +4203,7 @@ static int bpf_xdp_frags_shrink_tail(struct xdp_buff *xdp, int offset)if (unlikely (!sinfo->nr_frags)) {xdp_buff_clear_frags_flag (xdp); +xdp_buff_clear_frag_pfmemalloc (xdp); xdp->data_end -= offset; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/529 nvme: Use non zero KATO for persistent discovery connections
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alistair Francis <[email protected]>
[ Upstream commit 2e482655019ab6fcfe8865b62432c6d03f0b5f80 ]
The NVMe Base Specification 2.1 states that:
"""
A host requests an explicit persistent connection ... by specifying a non-zero Keep Alive Timer value in the Connect command. """
As such if we are starting a persistent connection to a discovery controller and the KATO is currently 0 we need to update KATO to a non zero value to avoid continuous timeouts on the target.
--- drivers/nvme/host/core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/nvme/host/core.c +7 -1
@@ -4414,8 +4414,14 @@ void nvme_start_ctrl(struct nvme_ctrl *ctrl)* checking that they started once before, hence are reconnecting back. */ if (test_bit (NVME_CTRL_STARTED_ONCE , &ctrl->flags) && -nvme_discovery_ctrl (ctrl)) +nvme_discovery_ctrl (ctrl)) { +if (!ctrl->kato) { +nvme_stop_keep_alive (ctrl); + ctrl->kato =NVME_DEFAULT_KATO ; +nvme_start_keep_alive (ctrl); + }nvme_change_uevent (ctrl,"NVME_EVENT=rediscover" ); + }if (ctrl->queue_count >1 ) {nvme_queue_scan (ctrl);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/529 uprobe: Do not emulate/sstep original instruction when ip is changed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]
If uprobe handler changes instruction pointer we still execute single step) or emulate the original instruction and increment the (new) ip with its length.
This makes the new instruction pointer bogus and application will likely crash on illegal instruction execution.
If user decided to take execution elsewhere, it makes little sense to execute the original instruction, so let's skip it.
--- kernel/events/uprobes.c | 7 +++++++ 1 file changed, 7 insertions(+)
kernel/events/uprobes.c +7 -0
@@ -2255,6 +2255,13 @@ static void handle_swbp(struct pt_regs *regs)handler_chain (uprobe, regs); +/* +* If user decided to take execution elsewhere, it makes little sense +* to execute the original instruction, so let's skip it. +*/ +if (instruction_pointer (regs) != bp_vaddr) + goto out; +if (arch_uprobe_skip_sstep (&uprobe->arch, regs)) goto out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 105/529 hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Copeland <[email protected]>
[ Upstream commit 584d55be66ef151e6ef9ccb3dcbc0a2155559be1 ]
Some motherboards require more time to acquire the ACPI mutex, causing "Failed to acquire mutex" messages to appear in the kernel log. Increase the timeout from 500ms to 800ms to accommodate these cases.
--- drivers/hwmon/asus-ec-sensors.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/asus-ec-sensors.c +1 -1
@@ -49,7 +49,7 @@ static char *mutex_path_override;*/ #define ASUS_EC_MAX_BANK 3 -#define ACPI_LOCK_DELAY_MS 500 +#define ACPI_LOCK_DELAY_MS 800/* ACPI mutex for locking access to the EC for the firmware */ #define ASUS_HW_ACCESS_MUTEX_ASMX "\\AMW0.ASMX"
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 106/529 hwmon: (dell-smm) Add support for Dell OptiPlex 7040
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 53d3bd48ef6ff1567a75ca77728968f5ab493cb4 ]
The Dell OptiPlex 7040 supports the legacy SMM interface for reading sensors and performing fan control. Whitelist this machine so that this driver loads automatically.
--- drivers/hwmon/dell-smm-hwmon.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/hwmon/dell-smm-hwmon.c +7 -0
@@ -1158,6 +1158,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = { }, .driver_data = (void *)&i8k_config_data[DELL_PRECISION_490], }, + { + .ident = "Dell OptiPlex 7040", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7040"), + }, + }, { .ident ="Dell Precision" , .matches = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 107/529 tools/cpupower: Fix incorrect size in cpuidle_state_disable()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <[email protected]>
[ Upstream commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 ]
Fix incorrect size parameter passed to cpuidle_state_write_file() in cpuidle_state_disable().
The function was incorrectly using sizeof(disable) which returns the size of the unsigned int variable (4 bytes) instead of the actual length of the string stored in the 'value' buffer.
Since 'value' is populated with snprintf() to contain the string representation of the disable value, we should use the length returned by snprintf() to get the correct string length for writing to the sysfs file.
This ensures the correct number of bytes is written to the cpuidle state disable file in sysfs.
--- tools/power/cpupower/lib/cpuidle.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
tools/power/cpupower/lib/cpuidle.c +3 -2
@@ -231,6 +231,7 @@ int cpuidle_state_disable(unsigned int cpu, {char value[SYSFS_PATH_MAX ];int bytes_written; +int len;if (cpuidle_state_count (cpu) <= idlestate)return -1 ;
@@ -239,10 +240,10 @@ int cpuidle_state_disable(unsigned int cpu, idlestate_value_files[IDLESTATE_DISABLE]))return -2 ; -snprintf (value,SYSFS_PATH_MAX ,"%u" , disable); + len =snprintf (value,SYSFS_PATH_MAX ,"%u" , disable); bytes_written =cpuidle_state_write_file (cpu, idlestate,"disable" , - value,sizeof (disable)); + value, len);if (bytes_written)return 0 ;return -3 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 108/529 tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <[email protected]>
[ Upstream commit 62127655b7ab7b8c2997041aca48a81bf5c6da0c ]
The fopen_or_die() function was previously hardcoded to open files in read-only mode ("r"), ignoring the mode parameter passed to it. This patch corrects fopen_or_die() to use the provided mode argument, allowing for flexible file access as intended.
Additionally, the call to fopen_or_die() inerr_on_hypervisor() incorrectly used the mode
"ro", which is not a valid fopen mode. This is
fixed to use the correct "r" mode.
--- .../power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c +2 -2
@@ -630,7 +630,7 @@ void cmdline(int argc, char **argv)*/ FILE *fopen_or_die (const char *path,const char *mode) { -FILE *filep =fopen (path,"r" ); +FILE *filep =fopen (path, mode);if (!filep)err (1 ,"%s: open failed" , path);
@@ -644,7 +644,7 @@ void err_on_hypervisor(void)char *buffer;/* On VMs /proc/cpuinfo contains a "flags" entry for hypervisor */ - cpuinfo =fopen_or_die ("/proc/cpuinfo" ,"ro" ); + cpuinfo =fopen_or_die ("/proc/cpuinfo" ,"r" ); buffer =malloc (4096 );if (!buffer) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 109/529 tools/power x86_energy_perf_policy: Enhance HWP enable
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Len Brown <[email protected]>
[ Upstream commit c97c057d357c4b39b153e9e430bbf8976e05bd4e ]
On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE.
Also, skip writing the MSR_PM_ENABLE if HWP is already enabled.
--- .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c +9 -4
@@ -1166,13 +1166,18 @@ int update_hwp_request_pkg(int pkg)int enable_hwp_on_cpu (int cpu) { -unsigned long long msr; +unsigned long long old_msr, new_msr; + +get_msr (cpu,MSR_PM_ENABLE , &old_msr); + +if (old_msr &1 ) +return 0 ;/* already enabled */ -get_msr (cpu,MSR_PM_ENABLE , &msr); -put_msr (cpu,MSR_PM_ENABLE ,1 ); + new_msr = old_msr |1 ; +put_msr (cpu,MSR_PM_ENABLE , new_msr);if (verbose) -printf ("cpu%d: MSR_PM_ENABLE old: %d new: %d\n" , cpu, (unsigned int ) msr,1 ); +printf ("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n" , cpu, old_msr, new_msr);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 110/529 tools/power x86_energy_perf_policy: Prefer driver HWP limits
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Len Brown <[email protected]>
[ Upstream commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 ]
When we are successful in using cpufreq min/max limits, skip setting the raw MSR limits entirely.
This is necessary to avoid undoing any modification that the cpufreq driver makes to our sysfs request.
eg. intel_pstate may take our request for a limit that is valid according to HWP.CAP.MIN/MAX and clip it to be within the range available in PLATFORM_INFO.
--- .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c +9 -4
@@ -62,6 +62,7 @@ unsigned char turbo_update_value;unsigned char update_hwp_epp;unsigned char update_hwp_min;unsigned char update_hwp_max; +unsigned char hwp_limits_done_via_sysfs;unsigned char update_hwp_desired;unsigned char update_hwp_window;unsigned char update_hwp_use_pkg;
@@ -951,8 +952,10 @@ int ratio_2_sysfs_khz(int ratio) }/* * If HWP is enabled and cpufreq sysfs attribtes are present, -* then update sysfs, so that it will not become -* stale when we write to MSRs. +* then update via sysfs. The intel_pstate driver may modify (clip) +* this request, say, when HWP_CAP is outside of PLATFORM_INFO limits, +* and the driver-chosen value takes precidence. +* * (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq, * so we don't have to touch that.) */
@@ -1007,6 +1010,8 @@ int update_sysfs(int cpu)if (update_hwp_max)update_cpufreq_scaling_freq (1 , cpu, req_update.hwp_max); + hwp_limits_done_via_sysfs =1 ; +return 0 ; }
@@ -1085,10 +1090,10 @@ int update_hwp_request(int cpu)if (debug)print_hwp_request (cpu, &req,"old: " ); -if (update_hwp_min) +if (update_hwp_min && !hwp_limits_done_via_sysfs) req.hwp_min = req_update.hwp_min; -if (update_hwp_max) +if (update_hwp_max && !hwp_limits_done_via_sysfs) req.hwp_max = req_update.hwp_max;if (update_hwp_desired)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 111/529 mfd: stmpe: Remove IRQ domain upon removal
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d ]
The IRQ domain is (optionally) added during stmpe_probe, but never removed. Add the call to stmpe_remove.
--- drivers/mfd/stmpe.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mfd/stmpe.c +3 -0
@@ -1485,6 +1485,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)void stmpe_remove (struct stmpe *stmpe) { +if (stmpe->domain) +irq_domain_remove (stmpe->domain); +if (!IS_ERR (stmpe->vio) &®ulator_is_enabled (stmpe->vio))regulator_disable (stmpe->vio);if (!IS_ERR (stmpe->vcc) &®ulator_is_enabled (stmpe->vcc))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 112/529 mfd: stmpe-i2c: Add missing MODULE_LICENSE
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 ]
This driver is licensed GPL-2.0-only, so add the corresponding module flag.
--- drivers/mfd/stmpe-i2c.c | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/stmpe-i2c.c +1 -0
@@ -137,3 +137,4 @@ module_exit(stmpe_exit);MODULE_DESCRIPTION ("STMPE MFD I2C Interface Driver" );MODULE_AUTHOR ("Rabin Vincent <[email protected]>" ); +MODULE_LICENSE ("GPL" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 113/529 mfd: madera: Work around false-positive -Wininitialized warning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 ]
clang-21 warns about one uninitialized variable getting dereferenced in madera_dev_init:
drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized]
739 | mfd_devs, n_devs,
| ^~~~~~~~
drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning
459 | const struct mfd_cell *mfd_devs;
| ^
| = NULLThe code is actually correct here because n_devs is only nonzero when mfd_devs is a valid pointer, but this is impossible for the compiler to see reliably.
Change the logic to check for the pointer as well, to make this easier for the compiler to follow.
--- drivers/mfd/madera-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mfd/madera-core.c +2 -2
@@ -456,7 +456,7 @@ int madera_dev_init(struct madera *madera)struct device *dev = madera->dev;unsigned int hwid;int (*patch_fn)(struct madera *) =NULL ; -const struct mfd_cell *mfd_devs; +const struct mfd_cell *mfd_devs =NULL ;int n_devs =0 ;int i, ret;
@@ -670,7 +670,7 @@ int madera_dev_init(struct madera *madera) goto err_reset; } -if (!n_devs) { +if (!n_devs || !mfd_devs) {dev_err (madera->dev,"Device ID 0x%x not a %s\n" , hwid, madera->type_name); ret = -ENODEV ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 114/529 mfd: da9063: Split chip variant reading in two bus transactions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Kehne <[email protected]>
[ Upstream commit 9ac4890ac39352ccea132109e32911495574c3ec ]
We observed the initial probe of the da9063 failing in da9063_get_device_type in about 30% of boots on a Xilinx ZynqMP based board. The problem originates in da9063_i2c_blockreg_read, which uses a single bus transaction to turn the register page and then read a register. On the bus, this should translate to a write to register 0, followed by a read to the target register, separated by a repeated start. However, we found that after the write to register 0, the controller sometimes continues directly with the register address of the read request, without sending the chip address or a repeated start in between, which makes the read request invalid.
To fix this, separate turning the page and reading the register into two separate transactions. This brings the initialization code in line with the rest of the driver, which uses register maps (which to my knowledge do not use repeated starts after turning the page). This has been included in our kernel for several months and was recently included in a shipped product. For us, it reliably fixes the issue, and we have not observed any new issues.
While the underlying problem is probably with the i2c controller or its driver, I still propose a change here in the interest of
robustness: First, I'm not sure this issue can be fixed on the controller side, since there are other issues related to repeated start which can't (AR# 60695, AR# 61664). Second, similar problems might exist with other controllers.
--- drivers/mfd/da9063-i2c.c | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-)
drivers/mfd/da9063-i2c.c +21 -6
@@ -37,9 +37,13 @@ enum da9063_page_sel_buf_fmt { DA9063_PAGE_SEL_BUF_SIZE, }; +enum da9063_page_sel_msgs { +DA9063_PAGE_SEL_MSG =0 , +DA9063_PAGE_SEL_CNT , +}; +enum da9063_paged_read_msgs { -DA9063_PAGED_READ_MSG_PAGE_SEL =0 , -DA9063_PAGED_READ_MSG_REG_SEL , +DA9063_PAGED_READ_MSG_REG_SEL =0 ,DA9063_PAGED_READ_MSG_DATA ,DA9063_PAGED_READ_MSG_CNT , };
@@ -65,10 +69,21 @@ static int da9063_i2c_blockreg_read(struct i2c_client *client, u16 addr, (page_num <<DA9063_I2C_PAGE_SEL_SHIFT ) &DA9063_REG_PAGE_MASK ;/* Write reg address, page selection */ - xfer[DA9063_PAGED_READ_MSG_PAGE_SEL ].addr = client->addr; - xfer[DA9063_PAGED_READ_MSG_PAGE_SEL ].flags =0 ; - xfer[DA9063_PAGED_READ_MSG_PAGE_SEL ].len =DA9063_PAGE_SEL_BUF_SIZE ; - xfer[DA9063_PAGED_READ_MSG_PAGE_SEL ].buf = page_sel_buf; + xfer[DA9063_PAGE_SEL_MSG ].addr = client->addr; + xfer[DA9063_PAGE_SEL_MSG ].flags =0 ; + xfer[DA9063_PAGE_SEL_MSG ].len =DA9063_PAGE_SEL_BUF_SIZE ; + xfer[DA9063_PAGE_SEL_MSG ].buf = page_sel_buf; + + ret =i2c_transfer (client->adapter, xfer,DA9063_PAGE_SEL_CNT ); +if (ret <0 ) { +dev_err (&client->dev,"Page switch failed: %d\n" , ret); +return ret; + } + +if (ret !=DA9063_PAGE_SEL_CNT ) { +dev_err (&client->dev,"Page switch failed to complete\n" ); +return -EIO ; + }/* Select register address */ xfer[DA9063_PAGED_READ_MSG_REG_SEL ].addr = client->addr;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 115/529 drm/amd/display: ensure committing streams is seamless
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clay King <[email protected]>
[ Upstream commit ca74cc428f2b9d0170c56b473dbcfd7fa01daf2d ]
[Why]
When transitioning between topologies such as multi-display to single display ODM 2:1, pipes might not be freed before use.
[How]
In dc_commit_streams, commit an additional, minimal transition if original transition is not seamless to ensure pipes are freed.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/gpu/drm/amd/display/dc/core/dc.c +12 -0
@@ -2068,6 +2068,18 @@ enum dc_status dc_commit_streams(struct dc *dc, goto fail; } +/* +* If not already seamless, make transition seamless by inserting intermediate minimal transition +*/ +if (dc->hwss.is_pipe_topology_transition_seamless && + !dc->hwss.is_pipe_topology_transition_seamless (dc, dc->current_state, context)) { + res =commit_minimal_transition_state (dc, context); +if (res !=DC_OK ) { +BREAK_TO_DEBUGGER (); + goto fail; + } + } + res =dc_commit_state_no_check (dc, context);for (i =0 ; i < stream_count; i++) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 116/529 drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Strauss <[email protected]>
[ Upstream commit e3419e1e44b87d4176fb98679a77301b1ca40f63 ]
[WHY]
In the worst case, AUX intra-hop done can take hundreds of milliseconds as each retimer in a link might have to wait a full AUX_RD_INTERVAL to send LT abort downstream.
[HOW]
Wait 300ms for each retimer in a link to allow time to propagate a LT abort without infinitely waiting on intra-hop done.
For no-retimer case, keep the max duration at 10ms.
--- .../drm/amd/display/dc/link/protocols/link_dp_training.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c +7 -2
@@ -974,14 +974,19 @@ void repeater_training_done(struct dc_link *link, uint32_t offset)static void dpcd_exit_training_mode (struct dc_link *link,enum dp_link_encoding encoding) {uint8_t sink_status =0 ; -uint8_t i; +uint32_t i; +uint8_t lttpr_count =dp_parse_lttpr_repeater_count (link->dpcd_caps.lttpr_caps.phy_repeater_cnt); +uint32_t intra_hop_disable_time_ms = (lttpr_count >0 ? lttpr_count *300 :10 ); + +// Each hop could theoretically take over 256ms (max 128b/132b AUX RD INTERVAL) +// To be safe, allow 300ms per LTTPR and 10ms for no LTTPR case /* clear training pattern set */ dpcd_set_training_pattern (link,DP_TRAINING_PATTERN_VIDEOIDLE );if (encoding == DP_128b_132b_ENCODING) {/* poll for intra-hop disable */ -for (i =0 ; i <10 ; i++) { +for (i =0 ; i < intra_hop_disable_time_ms; i++) {if ((core_link_read_dpcd (link,DP_SINK_STATUS , &sink_status,1 ) ==DC_OK ) && (sink_status &DP_INTRA_HOP_AUX_REPLY_INDICATION ) ==0 )break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 117/529 drm/amd/display: add more cyan skillfish devices
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 3cf06bd4cf2512d564fdb451b07de0cebe7b138d ]
Add PCI IDs to support display probe for cyan skillfish family of SOCs.
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 8 +++++++- drivers/gpu/drm/amd/display/include/dal_asic_id.h | 5 +++++ 2 files changed, 12 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +7 -1
@@ -150,7 +150,13 @@ enum dce_version resource_parse_asic_id(struct hw_asic_id asic_id)case FAMILY_NV : dc_version =DCN_VERSION_2_0 ; -if (asic_id.chip_id ==DEVICE_ID_NV_13FE || asic_id.chip_id ==DEVICE_ID_NV_143F ) { +if (asic_id.chip_id ==DEVICE_ID_NV_13FE || + asic_id.chip_id ==DEVICE_ID_NV_143F || + asic_id.chip_id ==DEVICE_ID_NV_13F9 || + asic_id.chip_id ==DEVICE_ID_NV_13FA || + asic_id.chip_id ==DEVICE_ID_NV_13FB || + asic_id.chip_id ==DEVICE_ID_NV_13FC || + asic_id.chip_id ==DEVICE_ID_NV_13DB ) { dc_version =DCN_VERSION_2_01 ;break ; }
drivers/gpu/drm/amd/display/include/dal_asic_id.h +5 -0
@@ -213,6 +213,11 @@ enum {#endif #define DEVICE_ID_NV_13FE 0x13FE // CYAN_SKILLFISH#define DEVICE_ID_NV_143F 0x143F +#define DEVICE_ID_NV_13F9 0x13F9 +#define DEVICE_ID_NV_13FA 0x13FA +#define DEVICE_ID_NV_13FB 0x13FB +#define DEVICE_ID_NV_13FC 0x13FC +#define DEVICE_ID_NV_13DB 0x13DB#define FAMILY_VGH 144#define DEVICE_ID_VGH_163F 0x163F#define DEVICE_ID_VGH_1435 0x1435
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 118/529 drm/amd/display: update dpp/disp clock from smu clock table
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Hsieh <[email protected]>
[ Upstream commit 2e72fdba8a32ce062a86571edff4592710c26215 ]
[Why]
The reason some high-resolution monitors fail to display properly is that this platform does not support sufficiently high DPP and DISP clock frequencies
[How]
Update DISP and DPP clocks from the smu clock table then DML can filter these mode if not support.
--- .../display/dc/clk_mgr/dcn301/vg_clk_mgr.c | 16 +++++++++++++++ .../amd/display/dc/dml/dcn301/dcn301_fpu.c | 20 ++++++++++++++++--- 2 files changed, 33 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c +16 -0
@@ -561,6 +561,7 @@ static void vg_clk_mgr_helper_populate_bw_params( {int i, j;struct clk_bw_params *bw_params = clk_mgr->base.bw_params; +uint32_t max_dispclk =0 , max_dppclk =0 ; j =-1 ;
@@ -581,6 +582,15 @@ static void vg_clk_mgr_helper_populate_bw_params(return ; } +/* dispclk and dppclk can be max at any voltage, same number of levels for both */ +if (clock_table->NumDispClkLevelsEnabled <=VG_NUM_DISPCLK_DPM_LEVELS && + clock_table->NumDispClkLevelsEnabled <=VG_NUM_DPPCLK_DPM_LEVELS ) { + max_dispclk =find_max_clk_value (clock_table->DispClocks, clock_table->NumDispClkLevelsEnabled); + max_dppclk =find_max_clk_value (clock_table->DppClocks, clock_table->NumDispClkLevelsEnabled); + }else { +ASSERT (0 ); + } + bw_params->clk_table.num_entries = j +1 ;for (i =0 ; i < bw_params->clk_table.num_entries -1 ; i++, j--) {
@@ -588,11 +598,17 @@ static void vg_clk_mgr_helper_populate_bw_params( bw_params->clk_table.entries[i].memclk_mhz = clock_table->DfPstateTable[j].memclk; bw_params->clk_table.entries[i].voltage = clock_table->DfPstateTable[j].voltage; bw_params->clk_table.entries[i].dcfclk_mhz =find_dcfclk_for_voltage (clock_table, clock_table->DfPstateTable[j].voltage); + +/* Now update clocks we do read */ + bw_params->clk_table.entries[i].dispclk_mhz = max_dispclk; + bw_params->clk_table.entries[i].dppclk_mhz = max_dppclk; } bw_params->clk_table.entries[i].fclk_mhz = clock_table->DfPstateTable[j].fclk; bw_params->clk_table.entries[i].memclk_mhz = clock_table->DfPstateTable[j].memclk; bw_params->clk_table.entries[i].voltage = clock_table->DfPstateTable[j].voltage; bw_params->clk_table.entries[i].dcfclk_mhz =find_max_clk_value (clock_table->DcfClocks,VG_NUM_DCFCLK_DPM_LEVELS ); + bw_params->clk_table.entries[i].dispclk_mhz =find_max_clk_value (clock_table->DispClocks,VG_NUM_DISPCLK_DPM_LEVELS ); + bw_params->clk_table.entries[i].dppclk_mhz =find_max_clk_value (clock_table->DppClocks,VG_NUM_DPPCLK_DPM_LEVELS ); bw_params->vram_type = bios_info->memory_type; bw_params->num_channels = bios_info->ma_channel_number;
drivers/gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c +17 -3
@@ -326,7 +326,7 @@ void dcn301_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_paramstruct dcn301_resource_pool *pool =TO_DCN301_RES_POOL (dc->res_pool);struct clk_limit_table *clk_table = &bw_params->clk_table;unsigned int i, closest_clk_lvl; -int j; +int j =0 , max_dispclk_mhz =0 , max_dppclk_mhz =0 ;dc_assert_fp_enabled ();
@@ -338,6 +338,15 @@ void dcn301_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_param dcn3_01_soc.num_chans = bw_params->num_channels;ASSERT (clk_table->num_entries); + +/* Prepass to find max clocks independent of voltage level. */ +for (i =0 ; i < clk_table->num_entries; ++i) { +if (clk_table->entries[i].dispclk_mhz > max_dispclk_mhz) + max_dispclk_mhz = clk_table->entries[i].dispclk_mhz; +if (clk_table->entries[i].dppclk_mhz > max_dppclk_mhz) + max_dppclk_mhz = clk_table->entries[i].dppclk_mhz; + } +for (i =0 ; i < clk_table->num_entries; i++) {/* loop backwards*/ for (closest_clk_lvl =0 , j = dcn3_01_soc.num_states -1 ; j >=0 ; j--) {
@@ -353,8 +362,13 @@ void dcn301_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_param s[i].socclk_mhz = clk_table->entries[i].socclk_mhz; s[i].dram_speed_mts = clk_table->entries[i].memclk_mhz *2 ; - s[i].dispclk_mhz = dcn3_01_soc.clock_limits[closest_clk_lvl].dispclk_mhz; - s[i].dppclk_mhz = dcn3_01_soc.clock_limits[closest_clk_lvl].dppclk_mhz; +/* Clocks independent of voltage level. */ + s[i].dispclk_mhz = max_dispclk_mhz ? max_dispclk_mhz : + dcn3_01_soc.clock_limits[closest_clk_lvl].dispclk_mhz; + + s[i].dppclk_mhz = max_dppclk_mhz ? max_dppclk_mhz : + dcn3_01_soc.clock_limits[closest_clk_lvl].dppclk_mhz; + s[i].dram_bw_per_chan_gbps = dcn3_01_soc.clock_limits[closest_clk_lvl].dram_bw_per_chan_gbps; s[i].dscclk_mhz = dcn3_01_soc.clock_limits[closest_clk_lvl].dscclk_mhz;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 119/529 drm/amd/pm: Use cached metrics data on aldebaran
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <[email protected]>
[ Upstream commit e87577ef6daa0cfb10ca139c720f0c57bd894174 ]
Cached metrics data validity is 1ms on aldebaran. It's not reasonable for any client to query gpu_metrics at a faster rate and constantly interrupt PMFW.
--- drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c +1 -1
@@ -1737,7 +1737,7 @@ static ssize_t aldebaran_get_gpu_metrics(struct smu_context *smu, ret =smu_cmn_get_metrics_table (smu, &metrics, - true); + false);if (ret)return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 120/529 drm/amd/pm: Use cached metrics data on arcturus
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <[email protected]>
[ Upstream commit 2f3b1ccf83be83a3330e38194ddfd1a91fec69be ]
Cached metrics data validity is 1ms on arcturus. It's not reasonable for any client to query gpu_metrics at a faster rate and constantly interrupt PMFW.
--- drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c +1 -1
@@ -2376,7 +2376,7 @@ static ssize_t arcturus_get_gpu_metrics(struct smu_context *smu, ret =smu_cmn_get_metrics_table (smu, &metrics, - true); + false);if (ret)return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 121/529 drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sathishkumar S <[email protected]>
[ Upstream commit 0e7581eda8c76d1ca4cf519631a4d4eb9f82b94c ]
Acquire jpeg_pg_lock before changes to jpeg power state and release it after power off from idle work handler.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c +4 -2
@@ -87,10 +87,12 @@ static void amdgpu_jpeg_idle_work_handler(struct work_struct *work) fences +=amdgpu_fence_count_emitted (&adev->jpeg.inst[i].ring_dec[j]); } -if (!fences && !atomic_read (&adev->jpeg.total_submission_cnt)) +if (!fences && !atomic_read (&adev->jpeg.total_submission_cnt)) { +mutex_lock (&adev->jpeg.jpeg_pg_lock);amdgpu_device_ip_set_powergating_state (adev,AMD_IP_BLOCK_TYPE_JPEG ,AMD_PG_STATE_GATE ); -else +mutex_unlock (&adev->jpeg.jpeg_pg_lock); + }else schedule_delayed_work (&adev->jpeg.idle_work,JPEG_IDLE_TIMEOUT ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 122/529 drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seyediman Seyedarab <[email protected]>
[ Upstream commit 6510b62fe9303aaf48ff136ff69186bcfc32172d ]
snprintf() returns the number of characters that *would* have been written, which can overestimate how much you actually wrote to the buffer in case of truncation. That leads to 'data += this' advancing the pointer past the end of the buffer and size going negative.
Switching to scnprintf() prevents potential buffer overflows and ensures consistent behavior when building the output string.
--- drivers/gpu/drm/nouveau/nvkm/core/enum.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/core/enum.c +1 -1
@@ -44,7 +44,7 @@ nvkm_snprintbf(char *data, int size, const struct nvkm_bitfield *bf, u32 value)bool space = false;while (size >=1 && bf->name) {if (value & bf->mask) { -int this =snprintf (data, size,"%s%s" , +int this =scnprintf (data, size,"%s%s" , space ?" " :"" , bf->name); size -= this; data += this;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 123/529 PCI: Disable MSI on RDC PCI to PCIe bridges
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcos Del Sol Vives <[email protected]>
[ Upstream commit ebc7086b39e5e4f3d3ca82caaea20538c9b62d42 ]
RDC PCI to PCIe bridges, present on Vortex86DX3 and Vortex86EX2 SoCs, do not support MSIs. If enabled, interrupts generated by PCIe devices never reach the processor.
I have contacted the manufacturer (DM&P) and they confirmed that PCI MSIs need to be disabled for them.
--- drivers/pci/quirks.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/quirks.c +1 -0
@@ -2712,6 +2712,7 @@ static void quirk_disable_msi(struct pci_dev *dev)DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_AMD ,PCI_DEVICE_ID_AMD_8131_BRIDGE , quirk_disable_msi);DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_VIA ,0xa238 , quirk_disable_msi);DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_ATI ,0x5a3f , quirk_disable_msi); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_RDC ,0x1031 , quirk_disable_msi);/* * The APC bridge device in AMD 780 family northbridges has some random
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 124/529 selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wake Liu <[email protected]>
[ Upstream commit c36748e8733ef9c5f4cd1d7c4327994e5b88b8df ]
The __WORDSIZE macro, defined in the non-standard <bits/wordsize.h> header, is a GNU extension and not universally available with all toolchains, such as Clang when used with musl libc.
This can lead to build failures in environments where this header is missing.
The intention of the code is to determine the bit width of a C long. Replace the non-portable __WORDSIZE with the standard and portable sizeof(long) * 8 expression to achieve the same result.
This change also removes the inclusion of the now-unused <bits/wordsize.h> header.
--- tools/testing/selftests/net/psock_tpacket.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
tools/testing/selftests/net/psock_tpacket.c +1 -2
@@ -33,7 +33,6 @@#include <ctype.h> #include <fcntl.h> #include <unistd.h> -#include <bits/wordsize.h> #include <net/ethernet.h> #include <netinet/ip.h> #include <arpa/inet.h>
@@ -785,7 +784,7 @@ static int test_kernel_bit_width(void)static int test_user_bit_width (void ) { -return __WORDSIZE; +return sizeof (long ) *8 ; }static const char *tpacket_str[] = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 125/529 selftests/net: Ensure assert() triggers in psock_tpacket.c
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wake Liu <[email protected]>
[ Upstream commit bc4c0a48bdad7f225740b8e750fdc1da6d85e1eb ]
The get_next_frame() function in psock_tpacket.c was missing a return statement in its default switch case, leading to a compiler warning.
This was caused by a bug_on(1) call, which is defined as an assert(), being compiled out because NDEBUG is defined during the build.
Instead of adding a return NULL; which would silently hide the error and could lead to crashes later, this change restores the original author's intent. By adding #undef NDEBUG before including <assert.h>, we ensure the assertion is active and will cause the test to abort if this unreachable code is ever executed.
--- tools/testing/selftests/net/psock_tpacket.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/net/psock_tpacket.c +1 -0
@@ -22,6 +22,7 @@* - TPACKET_V3: RX_RING */ +#undef NDEBUG#include <stdio.h> #include <stdlib.h> #include <sys/types.h>
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 126/529 wifi: rtw88: sdio: use indirect IO for device registers before power-on
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <[email protected]>
[ Upstream commit 58de1f91e033b1fface8d8948984583125f93736 ]
The register REG_SYS_CFG1 is used to determine chip basic information as arguments of following flows, such as download firmware and load PHY parameters, so driver read the value early (before power-on).
However, the direct IO is disallowed before power-on, or it causes wrong values, which driver recognizes a chip as a wrong type RF_1T1R, but actually RF_2T2R, causing driver warns:
rtw88_8822cs mmc1:0001:1: unsupported rf path (1)
Fix it by using indirect IO before power-on.
--- drivers/net/wireless/realtek/rtw88/sdio.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/realtek/rtw88/sdio.c +4 -0
@@ -143,6 +143,10 @@ static u32 rtw_sdio_to_io_address(struct rtw_dev *rtwdev, u32 addr,static bool rtw_sdio_use_direct_io (struct rtw_dev *rtwdev,u32 addr) { +if (!test_bit (RTW_FLAG_POWERON , rtwdev->flags) && + !rtw_sdio_is_bus_addr (addr)) +return false; +return !rtw_sdio_is_sdio30_supported (rtwdev) ||rtw_sdio_is_bus_addr (addr); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 127/529 drm/amdkfd: return -ENOTTY for unsupported IOCTLs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geoffrey McRae <[email protected]>
[ Upstream commit 57af162bfc8c05332a28c4d458d246cc46d2746d ]
Some kfd ioctls may not be available depending on the kernel version the user is running, as such we need to report -ENOTTY so userland can determine the cause of the ioctl failure.
--- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +6 -2
@@ -3252,8 +3252,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)int retcode = -EINVAL ;bool ptrace_attached = false; -if (nr >=AMDKFD_CORE_IOCTL_COUNT ) +if (nr >=AMDKFD_CORE_IOCTL_COUNT ) { + retcode = -ENOTTY ; goto err_i1; + }if ((nr >=AMDKFD_COMMAND_START ) && (nr <AMDKFD_COMMAND_END )) {u32 amdkfd_size;
@@ -3266,8 +3268,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg) asize = amdkfd_size; cmd = ioctl->cmd; - }else + }else { + retcode = -ENOTTY ; goto err_i1; + }dev_dbg (kfd_device,"ioctl cmd 0x%x (#0x%x), arg 0x%lx\n" , cmd, nr, arg);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 128/529 media: pci: ivtv: Dont create fake v4l2_fh
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <[email protected]>
[ Upstream commit cc6e8d1ccea792d8550428e0831e3a35b0ccfddc ]
The ivtv driver has a structure named ivtv_open_id that models an open file handle for the device. It embeds a v4l2_fh instance for file handles that correspond to a V4L2 video device, and stores a pointer to that v4l2_fh in struct ivtv_stream to identify which open file handle owns a particular stream.
In addition to video devices, streams can be owned by ALSA PCM devices. Those devices do not make use of the v4l2_fh instance for obvious reasons, but the snd_ivtv_pcm_capture_open() function still initializes a "fake" v4l2_fh for the sole purpose of using it as an open file handle identifier. The v4l2_fh is not properly destroyed when the ALSA PCM device is closed, leading to possible resource leaks.
Fortunately, the v4l2_fh instance pointed to by ivtv_stream is not accessed, only the pointer value is used for comparison. Replace it with a pointer to the ivtv_open_id structure that embeds the v4l2_fh, and don't initialize the v4l2_fh for ALSA PCM devices.
--- drivers/media/pci/ivtv/ivtv-alsa-pcm.c | 2 -- drivers/media/pci/ivtv/ivtv-driver.h | 3 ++- drivers/media/pci/ivtv/ivtv-fileops.c | 18 +++++++++--------- drivers/media/pci/ivtv/ivtv-irq.c | 4 ++-- 4 files changed, 13 insertions(+), 14 deletions(-)
drivers/media/pci/ivtv/ivtv-alsa-pcm.c +0 -2
@@ -148,14 +148,12 @@ static int snd_ivtv_pcm_capture_open(struct snd_pcm_substream *substream) s = &itv->streams[IVTV_ENC_STREAM_TYPE_PCM ]; -v4l2_fh_init (&item.fh, &s->vdev); item.itv = itv; item.type = s->type;/* See if the stream is available */ if (ivtv_claim_stream (&item, item.type)) {/* No, it's already in use */ -v4l2_fh_exit (&item.fh);snd_ivtv_unlock (itvsc);return -EBUSY ; }
drivers/media/pci/ivtv/ivtv-driver.h +2 -1
@@ -322,6 +322,7 @@ struct ivtv_queue { };struct ivtv ;/* forward reference */ +struct ivtv_open_id ;struct ivtv_stream {/* These first four fields are always set, even if the stream
@@ -331,7 +332,7 @@ struct ivtv_stream {const char *name;/* name of the stream */ int type;/* stream type */ -struct v4l2_fh *fh;/* pointer to the streaming filehandle */ +struct ivtv_open_id *id;/* pointer to the streaming ivtv_open_id */ spinlock_t qlock;/* locks access to the queues */ unsigned long s_flags;/* status flags, see above */ int dma;/* can be PCI_DMA_TODEVICE, PCI_DMA_FROMDEVICE or PCI_DMA_NONE */
drivers/media/pci/ivtv/ivtv-fileops.c +9 -9
@@ -38,16 +38,16 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)if (test_and_set_bit (IVTV_F_S_CLAIMED , &s->s_flags)) {/* someone already claimed this stream */ -if (s->fh == &id->fh) { +if (s->id == id) {/* yes, this file descriptor did. So that's OK. */ return 0 ; } -if (s->fh ==NULL && (type ==IVTV_DEC_STREAM_TYPE_VBI || +if (s->id ==NULL && (type ==IVTV_DEC_STREAM_TYPE_VBI || type ==IVTV_ENC_STREAM_TYPE_VBI )) {/* VBI is handled already internally, now also assign the file descriptor to this stream for external reading of the stream. */ - s->fh = &id->fh; + s->id = id;IVTV_DEBUG_INFO ("Start Read VBI\n" );return 0 ; }
@@ -55,7 +55,7 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)IVTV_DEBUG_INFO ("Stream %d is busy\n" , type);return -EBUSY ; } - s->fh = &id->fh; + s->id = id;if (type ==IVTV_DEC_STREAM_TYPE_VBI ) {/* Enable reinsertion interrupt */ ivtv_clear_irq_mask (itv,IVTV_IRQ_DEC_VBI_RE_INSERT );
@@ -93,7 +93,7 @@ void ivtv_release_stream(struct ivtv_stream *s)struct ivtv *itv = s->itv;struct ivtv_stream *s_vbi; - s->fh =NULL ; + s->id =NULL ;if ((s->type ==IVTV_DEC_STREAM_TYPE_VBI || s->type ==IVTV_ENC_STREAM_TYPE_VBI ) &&test_bit (IVTV_F_S_INTERNAL_USE , &s->s_flags)) {/* this stream is still in use internally */
@@ -125,7 +125,7 @@ void ivtv_release_stream(struct ivtv_stream *s)/* was already cleared */ return ; } -if (s_vbi->fh) { +if (s_vbi->id) {/* VBI stream still claimed by a file descriptor */ return ; }
@@ -349,7 +349,7 @@ static ssize_t ivtv_read(struct ivtv_stream *s, char __user *ubuf, size_t tot_cosize_t tot_written =0 ;int single_frame =0 ; -if (atomic_read (&itv->capturing) ==0 && s->fh ==NULL ) { +if (atomic_read (&itv->capturing) ==0 && s->id ==NULL ) {/* shouldn't happen */ IVTV_DEBUG_WARN ("Stream %s not initialized before read\n" , s->name);return -EIO ;
@@ -819,7 +819,7 @@ void ivtv_stop_capture(struct ivtv_open_id *id, int gop_end) id->type == IVTV_ENC_STREAM_TYPE_VBI) && test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) { /* Also used internally, don't stop capturing */ - s->fh = NULL; + s->id = NULL; } else {ivtv_stop_v4l2_encode_stream (s, gop_end);
@@ -903,7 +903,7 @@ int ivtv_v4l2_close(struct file *filp)v4l2_fh_exit (fh);/* Easy case first: this stream was never claimed by us */ -if (s->fh != &id->fh) +if (s->id != id) goto close_done;/* 'Unclaim' this stream */
drivers/media/pci/ivtv/ivtv-irq.c +2 -2
@@ -305,7 +305,7 @@ static void dma_post(struct ivtv_stream *s)ivtv_process_vbi_data (itv, buf,0 , s->type); s->q_dma.bytesused += buf->bytesused; } -if (s->fh ==NULL ) { +if (s->id ==NULL ) {ivtv_queue_move (s, &s->q_dma,NULL , &s->q_free,0 );return ; }
@@ -330,7 +330,7 @@ static void dma_post(struct ivtv_stream *s)set_bit (IVTV_F_I_HAVE_WORK , &itv->i_flags); } -if (s->fh) +if (s->id)wake_up (&s->waitq); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 129/529 media: amphion: Delete v4l2_fh synchronously in .release()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <[email protected]>
[ Upstream commit 19fb9c5b815f70eb90d5b545f65b83bc9c490ecd ]
The v4l2_fh initialized and added in vpu_v4l2_open() is delete and cleaned up when the last reference to the vpu_inst is released. This may happen later than at vpu_v4l2_close() time.
Not deleting and cleaning up the v4l2_fh when closing the file handle to the video device is not ideal, as the v4l2_fh will still be present in the video device's fh_list, and will store a copy of events queued to the video device. There may also be other side effects of keeping alive an object that represents an open file handle after the file handle is closed.
The v4l2_fh instance is embedded in the vpu_inst structure, and is accessed in two different ways:
- in vpu_notify_eos() and vpu_notify_source_change(), to queue V4L2 events to the file handle ; and
- through the driver to access the v4l2_fh.m2m_ctx pointer.
The v4l2_fh.m2m_ctx pointer is not touched by v4l2_fh_del() and v4l2_fh_exit(). It is set to NULL by the driver when closing the file handle, in vpu_v4l2_close().
The vpu_notify_eos() and vpu_notify_source_change() functions are called in vpu_set_last_buffer_dequeued() and vdec_handle_resolution_change() respectively, only if the v4l2_fh.m2m_ctx pointer is not NULL. There is therefore a guarantee that no new event will be queued to the v4l2_fh after vpu_v4l2_close() destroys the m2m_ctx.
The vpu_notify_eos() function is also called from vpu_vb2_buf_finish(), which is guaranteed to be called for all queued buffers when vpu_v4l2_close() calls v4l2_m2m_ctx_release(), and will not be called later.
It is therefore safe to assume that the driver will not touch the v4l2_fh, except to check the m2m_ctx pointer, after vpu_v4l2_close() destroys the m2m_ctx. We can safely delete and cleanup the v4l2_fh synchronously in vpu_v4l2_close().
--- drivers/media/platform/amphion/vpu_v4l2.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/media/platform/amphion/vpu_v4l2.c +5 -2
@@ -693,8 +693,6 @@ static int vpu_v4l2_release(struct vpu_inst *inst)v4l2_ctrl_handler_free (&inst->ctrl_handler);mutex_destroy (&inst->lock); -v4l2_fh_del (&inst->fh); -v4l2_fh_exit (&inst->fh);call_void_vop (inst, cleanup);
@@ -763,6 +761,8 @@ int vpu_v4l2_open(struct file *file, struct vpu_inst *inst)return 0 ; error: +v4l2_fh_del (&inst->fh); +v4l2_fh_exit (&inst->fh);vpu_inst_put (inst);return ret; }
@@ -782,6 +782,9 @@ int vpu_v4l2_close(struct file *file)call_void_vop (inst, release);vpu_inst_unlock (inst); +v4l2_fh_del (&inst->fh); +v4l2_fh_exit (&inst->fh); +vpu_inst_unregister (inst);vpu_inst_put (inst);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 130/529 drm/tidss: Use the crtc_* timings when programming the HW
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 478306edc23eec4f0ec24a46222485910c66212d ]
Use the crtc_* fields from drm_display_mode, instead of the "logical" fields. This shouldn't change anything in practice, but afaiu the crtc_* fields are the correct ones to use here.
--- drivers/gpu/drm/tidss/tidss_crtc.c | 2 +- drivers/gpu/drm/tidss/tidss_dispc.c | 16 ++++++++-------- 2 files changed, 9 insertions(+), 9 deletions(-)
drivers/gpu/drm/tidss/tidss_crtc.c +1 -1
@@ -229,7 +229,7 @@ static void tidss_crtc_atomic_enable(struct drm_crtc *crtc,tidss_runtime_get (tidss); r =dispc_vp_set_clk_rate (tidss->dispc, tcrtc->hw_videoport, - mode->clock *1000 ); + mode->crtc_clock *1000 );if (r !=0 )return ;
drivers/gpu/drm/tidss/tidss_dispc.c +8 -8
@@ -1030,13 +1030,13 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport,dispc_set_num_datalines (dispc, hw_videoport, fmt->data_width); - hfp = mode->hsync_start - mode->hdisplay; - hsw = mode->hsync_end - mode->hsync_start; - hbp = mode->htotal - mode->hsync_end; + hfp = mode->crtc_hsync_start - mode->crtc_hdisplay; + hsw = mode->crtc_hsync_end - mode->crtc_hsync_start; + hbp = mode->crtc_htotal - mode->crtc_hsync_end; - vfp = mode->vsync_start - mode->vdisplay; - vsw = mode->vsync_end - mode->vsync_start; - vbp = mode->vtotal - mode->vsync_end; + vfp = mode->crtc_vsync_start - mode->crtc_vdisplay; + vsw = mode->crtc_vsync_end - mode->crtc_vsync_start; + vbp = mode->crtc_vtotal - mode->crtc_vsync_end; dispc_vp_write(dispc, hw_videoport, DISPC_VP_TIMING_H, FLD_VAL(hsw - 1, 7, 0) |
@@ -1078,8 +1078,8 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport, FLD_VAL(ivs, 12, 12));dispc_vp_write (dispc, hw_videoport,DISPC_VP_SIZE_SCREEN , -FLD_VAL (mode->hdisplay -1 ,11 ,0 ) | -FLD_VAL (mode->vdisplay -1 ,27 ,16 )); +FLD_VAL (mode->crtc_hdisplay -1 ,11 ,0 ) | +FLD_VAL (mode->crtc_vdisplay -1 ,27 ,16 ));VP_REG_FLD_MOD (dispc, hw_videoport,DISPC_VP_CONTROL ,1 ,0 ,0 ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 131/529 drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit eea4f89b6461294ed6bea1d3285bb3f79c09a041 ]
The driver tries to calculate the value for REG_WAKEUP_TIME. However, the calculation itself is not correct, and to add on it, the resulting value is almost always larger than the field's size, so the actual result is more or less random.
According to the docs, figuring out the value for REG_WAKEUP_TIME requires HW characterization and there's no way to have a generic algorithm to come up with the value. That doesn't help at all...
However, we know that the value must be smaller than the line time, and, at least in my understanding, the proper value for it is quite small. Testing shows that setting it to 1/10 of the line time seems to work well. All video modes from my HDMI monitor work with this algorithm.
Hopefully we'll get more information on how to calculate the value, and we can then update this.
--- drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c +7 -1
@@ -833,7 +833,13 @@ static void cdns_dsi_bridge_enable(struct drm_bridge *bridge) tx_byte_period =DIV_ROUND_DOWN_ULL ((u64 )NSEC_PER_SEC *8 , phy_cfg->hs_clk_rate); - reg_wakeup = (phy_cfg->hs_prepare + phy_cfg->hs_zero) / tx_byte_period; + +/* +* Estimated time [in clock cycles] to perform LP->HS on D-PHY. +* It is not clear how to calculate this, so for now, +* set it to 1/10 of the total number of clocks in a line. +*/ + reg_wakeup = dsi_cfg.htotal / nlanes /10 ;writel (REG_WAKEUP_TIME (reg_wakeup) |REG_LINE_DURATION (tmp), dsi->regs +VID_DPHY_TIME );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 132/529 drm/bridge: cdns-dsi: Dont fail on MIPI_DSI_MODE_VIDEO_BURST
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 7070f55f294745c5a3c033623b76309f3512be67 ]
While the cdns-dsi does not support DSI burst mode, the burst mode is essentially DSI event mode with more versatile clocking and timings. Thus cdns-dsi doesn't need to fail if the DSI peripheral driver requests MIPI_DSI_MODE_VIDEO_BURST.
In my particular use case, this allows the use of ti-sn65dsi83 driver.
--- drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c +0 -4
@@ -959,10 +959,6 @@ static int cdns_dsi_attach(struct mipi_dsi_host *host,if (output->dev)return -EBUSY ; -/* We do not support burst mode yet. */ -if (dev->mode_flags &MIPI_DSI_MODE_VIDEO_BURST ) -return -ENOTSUPP ; -/* * The host <-> device link might be described using an OF-graph * representation, in this case we extract the device of_node from
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 133/529 drm/tidss: Set crtc modesetting parameters with adjusted mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jayesh Choudhary <[email protected]>
[ Upstream commit cfb29225db20c56432a8525366321c0c09edfb2e ]
TIDSS uses crtc_* fields to propagate its registers and set the clock rates. So set the CRTC modesetting timing parameters with the adjusted mode when needed, to set correct values.
--- drivers/gpu/drm/tidss/tidss_crtc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/tidss/tidss_crtc.c +4 -1
@@ -91,7 +91,7 @@ static int tidss_crtc_atomic_check(struct drm_crtc *crtc,struct dispc_device *dispc = tidss->dispc;struct tidss_crtc *tcrtc =to_tidss_crtc (crtc);u32 hw_videoport = tcrtc->hw_videoport; -const struct drm_display_mode *mode; +struct drm_display_mode *mode;enum drm_mode_status ok;dev_dbg (ddev->dev,"%s\n" , __func__);
@@ -108,6 +108,9 @@ static int tidss_crtc_atomic_check(struct drm_crtc *crtc,return -EINVAL ; } +if (drm_atomic_crtc_needs_modeset (crtc_state)) +drm_mode_set_crtcinfo (mode,0 ); +return dispc_vp_bus_check (dispc, hw_videoport, crtc_state); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 134/529 media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mehdi Djait <[email protected]>
[ Upstream commit 2d240b124cc9df62ccccee6054bc3d1d19018758 ]
Both ACPI and DT-based systems are required to obtain the external camera sensor clock using the new devm_v4l2_sensor_clk_get() helper function.
Ensure a dependency on HAVE_CLK when config VIDEO_CAMERA_SENSOR is enabled.
--- drivers/media/i2c/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/Kconfig +1 -1
@@ -27,7 +27,7 @@ config VIDEO_IR_I2C menuconfig VIDEO_CAMERA_SENSOR bool "Camera sensor devices" - depends on MEDIA_CAMERA_SUPPORT && I2C + depends on MEDIA_CAMERA_SUPPORT && I2C && HAVE_CLK select MEDIA_CONTROLLER select V4L2_FWNODE select VIDEO_V4L2_SUBDEV_API
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 135/529 x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill A. Shutemov <[email protected]>
[ Upstream commit 8ba38a7a9a699905b84fa97578a8291010dec273 ]
emulate_vsyscall() expects to see X86_PF_INSTR in PFEC on a vsyscall page fault, but the CPU does not report X86_PF_INSTR if neither X86_FEATURE_NX nor X86_FEATURE_SMEP are enabled.
X86_FEATURE_NX should be enabled on nearly all 64-bit CPUs, except for early P4 processors that did not support this feature.
Instead of explicitly checking for X86_PF_INSTR, compare the fault address to RIP.
On machines with X86_FEATURE_NX enabled, issue a warning if RIP is equal to fault address but X86_PF_INSTR is absent.
[ dhansen: flesh out code comments ]
--- arch/x86/entry/vsyscall/vsyscall_64.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-)
arch/x86/entry/vsyscall/vsyscall_64.c +14 -3
@@ -124,7 +124,12 @@ bool emulate_vsyscall(unsigned long error_code,if ((error_code & (X86_PF_WRITE |X86_PF_USER )) !=X86_PF_USER )return false; -if (!(error_code &X86_PF_INSTR )) { +/* +* Assume that faults at regs->ip are because of an +* instruction fetch. Return early and avoid +* emulation for faults during data accesses: +*/ +if (address != regs->ip) {/* Failed vsyscall read */ if (vsyscall_mode ==EMULATE )return false;
@@ -136,13 +141,19 @@ bool emulate_vsyscall(unsigned long error_code,return false; } +/* +* X86_PF_INSTR is only set when NX is supported. When +* available, use it to double-check that the emulation code +* is only being used for instruction fetches: +*/ +if (cpu_feature_enabled (X86_FEATURE_NX )) +WARN_ON_ONCE (!(error_code &X86_PF_INSTR )); +/* * No point in checking CS -- the only way to get here is a user mode * trap to a high address, which means that we're in 64-bit user code. */ -WARN_ON_ONCE (address != regs->ip); -if (vsyscall_mode ==NONE ) {warn_bad_vsyscall (KERN_INFO , regs,"vsyscall attempted with vsyscall=none" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 136/529 net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <[email protected]>
[ Upstream commit 6896c2449a1858acb643014894d01b3a1223d4e5 ]
stmmac_hw_setup() may return 0 on success and an appropriate negative integer as defined in errno.h file on failure, just check it and then return early if failed in stmmac_resume().
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +8 -1
@@ -7901,7 +7901,14 @@ int stmmac_resume(struct device *dev)stmmac_free_tx_skbufs (priv);stmmac_clear_descriptors (priv, &priv->dma_conf); -stmmac_hw_setup (ndev, false); + ret =stmmac_hw_setup (ndev, false); +if (ret <0 ) { +netdev_err (priv->dev,"%s: Hw setup failed\n" , __func__); +mutex_unlock (&priv->lock); +rtnl_unlock (); +return ret; + } +stmmac_init_coalesce (priv);stmmac_set_rx_mode (ndev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 137/529 ice: Dont use %pK through printk or tracepoints
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 66ceb45b7d7e9673254116eefe5b6d3a44eba267 ]
In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and easier to reason about.
There are still a few users of %pK left, but these use it through seq_file, for which its usage is safe.
--- drivers/net/ethernet/intel/ice/ice_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_trace.h | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-)
drivers/net/ethernet/intel/ice/ice_main.c +1 -1
@@ -8765,7 +8765,7 @@ static int ice_create_q_channels(struct ice_vsi *vsi)list_add_tail (&ch->list, &vsi->ch_list); vsi->tc_map_vsi[i] = ch->ch_vsi;dev_dbg (ice_pf_to_dev (pf), -"successfully created channel: VSI %pK\n" , ch->ch_vsi); +"successfully created channel: VSI %p\n" , ch->ch_vsi); }return 0 ;
drivers/net/ethernet/intel/ice/ice_trace.h +5 -5
@@ -130,7 +130,7 @@ DECLARE_EVENT_CLASS(ice_tx_template, __entry->buf = buf; __assign_str(devname, ring->netdev->name);), -TP_printk ("netdev: %s ring: %pK desc: %pK buf %pK" ,__get_str (devname), +TP_printk ("netdev: %s ring: %p desc: %p buf %p" ,__get_str (devname), __entry->ring, __entry->desc, __entry->buf) );
@@ -158,7 +158,7 @@ DECLARE_EVENT_CLASS(ice_rx_template, __entry->desc = desc; __assign_str(devname, ring->netdev->name);), -TP_printk ("netdev: %s ring: %pK desc: %pK" ,__get_str (devname), +TP_printk ("netdev: %s ring: %p desc: %p" ,__get_str (devname), __entry->ring, __entry->desc) ); DEFINE_EVENT(ice_rx_template, ice_clean_rx_irq,
@@ -182,7 +182,7 @@ DECLARE_EVENT_CLASS(ice_rx_indicate_template, __entry->skb = skb; __assign_str(devname, ring->netdev->name);), -TP_printk ("netdev: %s ring: %pK desc: %pK skb %pK" ,__get_str (devname), +TP_printk ("netdev: %s ring: %p desc: %p skb %p" ,__get_str (devname), __entry->ring, __entry->desc, __entry->skb) );
@@ -205,7 +205,7 @@ DECLARE_EVENT_CLASS(ice_xmit_template, __entry->skb = skb; __assign_str(devname, ring->netdev->name);), -TP_printk ("netdev: %s skb: %pK ring: %pK" ,__get_str (devname), +TP_printk ("netdev: %s skb: %p ring: %p" ,__get_str (devname), __entry->skb, __entry->ring) );
@@ -228,7 +228,7 @@ DECLARE_EVENT_CLASS(ice_tx_tstamp_template, TP_fast_assign(__entry->skb = skb; __entry->idx = idx;), -TP_printk ("skb %pK idx %d" , +TP_printk ("skb %p idx %d" , __entry->skb, __entry->idx) );#define DEFINE_TX_TSTAMP_OP_EVENT (name) \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 138/529 thunderbolt: Use is_pciehp instead of is_hotplug_bridge
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
[ Upstream commit 5d03847175e81e86d4865456c15638faaf7c0634 ]
The thunderbolt driver sets up device link dependencies from hotplug ports to the Host Router (aka Native Host Interface, NHI). When resuming from system sleep, this allows the Host Router to re-establish tunnels to attached Thunderbolt devices before the hotplug ports resume.
To identify the hotplug ports, the driver utilizes the is_hotplug_bridge flag which also encompasses ACPI slots handled by the ACPI hotplug driver.
Thunderbolt hotplug ports are always Hot-Plug Capable PCIe ports, so it is more apt to identify them with the is_pciehp flag.
Similarly, hotplug ports on older Thunderbolt controllers have broken MSI support and are quirked to use legacy INTx interrupts instead. The quirk identifies them with is_hotplug_bridge, even though all affected ports are also matched by is_pciehp. So use is_pciehp here as well.
--- drivers/pci/quirks.c | 2 +- drivers/thunderbolt/tb.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/pci/quirks.c +1 -1
@@ -3825,7 +3825,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcf80, quirk_no_pm_reset);*/ static void quirk_thunderbolt_hotplug_msi (struct pci_dev *pdev) { -if (pdev->is_hotplug_bridge && +if (pdev->is_pciehp && (pdev->device !=PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C || pdev->revision <=1 )) pdev->no_msi =1 ;
drivers/thunderbolt/tb.c +1 -1
@@ -3022,7 +3022,7 @@ static bool tb_apple_add_links(struct tb_nhi *nhi)if (!pci_is_pcie (pdev))continue ;if (pci_pcie_type (pdev) !=PCI_EXP_TYPE_DOWNSTREAM || - !pdev->is_hotplug_bridge) + !pdev->is_pciehp)continue ; link = device_link_add(&pdev->dev, &nhi->pdev->dev,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 139/529 powerpc/eeh: Use result of error_detected() in uevent
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <[email protected]>
[ Upstream commit 704e5dd1c02371dfc7d22e1520102b197a3b628b ]
Ever since uevent support was added for AER and EEH with commit 856e1eb9bdd4 ("PCI/AER: Add uevents in AER and EEH error/resume"), it reported PCI_ERS_RESULT_NONE as uevent when recovery begins.
Commit 7b42d97e99d3 ("PCI/ERR: Always report current recovery status for udev") subsequently amended AER to report the actual return value of error_detected().
Make the same change to EEH to align it with AER and s390.
--- arch/powerpc/kernel/eeh_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/eeh_driver.c +1 -1
@@ -334,7 +334,7 @@ static enum pci_ers_result eeh_report_error(struct eeh_dev *edev, rc = driver->err_handler->error_detected (pdev, pci_channel_io_frozen); edev->in_error = true; -pci_uevent_ers (pdev,PCI_ERS_RESULT_NONE ); +pci_uevent_ers (pdev, rc);return rc; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 140/529 s390/pci: Use pci_uevent_ers() in PCI recovery
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <[email protected]>
[ Upstream commit dab32f2576a39d5f54f3dbbbc718d92fa5109ce9 ]
Issue uevents on s390 during PCI recovery using pci_uevent_ers() as done by EEH and AER PCIe recovery routines.
--- arch/s390/pci/pci_event.c | 3 +++ drivers/pci/pci-driver.c | 2 +- include/linux/pci.h | 2 +- 3 files changed, 5 insertions(+), 2 deletions(-)
arch/s390/pci/pci_event.c +3 -0
@@ -83,6 +83,7 @@ static pci_ers_result_t zpci_event_notify_error_detected(struct pci_dev *pdev,pci_ers_result_t ers_res =PCI_ERS_RESULT_DISCONNECT ; ers_res = driver->err_handler->error_detected (pdev, pdev->error_state); +pci_uevent_ers (pdev, ers_res);if (ers_result_indicates_abort (ers_res))pr_info ("%s: Automatic recovery failed after initial reporting\n" ,pci_name (pdev));else if (ers_res ==PCI_ERS_RESULT_NEED_RESET )
@@ -212,6 +213,7 @@ static pci_ers_result_t zpci_event_attempt_error_recovery(struct pci_dev *pdev) ers_res =zpci_event_do_reset (pdev, driver);if (ers_res !=PCI_ERS_RESULT_RECOVERED ) { +pci_uevent_ers (pdev,PCI_ERS_RESULT_DISCONNECT );pr_err ("%s: Automatic recovery failed; operator intervention is required\n" ,pci_name (pdev)); goto out_unlock;
@@ -220,6 +222,7 @@ static pci_ers_result_t zpci_event_attempt_error_recovery(struct pci_dev *pdev)pr_info ("%s: The device is ready to resume operations\n" ,pci_name (pdev));if (driver->err_handler->resume) driver->err_handler->resume (pdev); +pci_uevent_ers (pdev,PCI_ERS_RESULT_RECOVERED ); out_unlock:device_unlock (&pdev->dev);
drivers/pci/pci-driver.c +1 -1
@@ -1598,7 +1598,7 @@ static int pci_uevent(const struct device *dev, struct kobj_uevent_env *env)return 0 ; } -#if defined(CONFIG_PCIEAER ) || defined(CONFIG_EEH ) +#if defined(CONFIG_PCIEAER ) || defined(CONFIG_EEH ) || defined(CONFIG_S390 )/** * pci_uevent_ers - emit a uevent during recovery path of PCI device * @pdev: PCI device undergoing error recovery
include/linux/pci.h +1 -1
@@ -2667,7 +2667,7 @@ static inline bool pci_is_thunderbolt_attached(struct pci_dev *pdev)return false; } -#if defined(CONFIG_PCIEPORTBUS ) || defined(CONFIG_EEH ) +#if defined(CONFIG_PCIEPORTBUS ) || defined(CONFIG_EEH ) || defined(CONFIG_S390 )void pci_uevent_ers (struct pci_dev *pdev,enum pci_ers_result err_type);#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 141/529 bridge: Redirect to backup port when port is administratively down
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 3d05b24429e1de7a17c8fdccb04a04dbc8ad297b ]
If a backup port is configured for a bridge port, the bridge will redirect known unicast traffic towards the backup port when the primary port is administratively up but without a carrier. This is useful, for example, in MLAG configurations where a system is connected to two switches and there is a peer link between both switches. The peer link serves as the backup port in case one of the switches loses its connection to the multi-homed system.
In order to avoid flooding when the primary port loses its carrier, the bridge does not flush dynamic FDB entries pointing to the port upon STP disablement, if the port has a backup port.
The above means that known unicast traffic destined to the primary port will be blackholed when the port is put administratively down, until the FDB entries pointing to it are aged-out.
Given that the current behavior is quite weird and unlikely to be depended on by anyone, amend the bridge to redirect to the backup port also when the primary port is administratively down and not only when it does not have a carrier.
The change is motivated by a report from a user who expected traffic to be redirected to the backup port when the primary port was put administratively down while debugging a network issue.
--- net/bridge/br_forward.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/bridge/br_forward.c +2 -1
@@ -148,7 +148,8 @@ void br_forward(const struct net_bridge_port *to, goto out;/* redirect to backup link if the destination port is down */ -if (rcu_access_pointer (to->backup_port) && !netif_carrier_ok (to->dev)) { +if (rcu_access_pointer (to->backup_port) && + (!netif_carrier_ok (to->dev) || !netif_running (to->dev))) {struct net_bridge_port *backup_port; backup_port =rcu_dereference (to->backup_port);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 142/529 scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Wang <[email protected]>
[ Upstream commit aa86602a483ba48f51044fbaefa1ebbf6da194a4 ]
Move the configuration of the Auto-Hibern8 (AHIT) timer from the post-link stage to the 'fixup_dev_quirks' function. This change allows setting the AHIT based on the vendor requirements:
(a) Samsung: 3.5 ms
(b) Micron: 2 ms
(c) Others: 1 ms
Additionally, the clock gating timer is adjusted based on the AHIT scale, with a maximum setting of 10 ms. This ensures that the clock gating delay is appropriately configured to match the AHIT settings.
--- drivers/ufs/host/ufs-mediatek.c | 86 ++++++++++++++++++++++++--------- 1 file changed, 64 insertions(+), 22 deletions(-)
drivers/ufs/host/ufs-mediatek.c +64 -22
@@ -847,6 +847,69 @@ static void ufs_mtk_vreg_fix_vccqx(struct ufs_hba *hba) } } +static void ufs_mtk_setup_clk_gating (struct ufs_hba *hba) +{ +unsigned long flags; +u32 ah_ms =10 ; +u32 ah_scale, ah_timer; +u32 scale_us[] = {1 ,10 ,100 ,1000 ,10000 ,100000 }; + +if (ufshcd_is_clkgating_allowed (hba)) { +if (ufshcd_is_auto_hibern8_supported (hba) && hba->ahit) { + ah_scale =FIELD_GET (UFSHCI_AHIBERN8_SCALE_MASK , + hba->ahit); + ah_timer =FIELD_GET (UFSHCI_AHIBERN8_TIMER_MASK , + hba->ahit); +if (ah_scale <=5 ) + ah_ms = ah_timer * scale_us[ah_scale] /1000 ; + } + +spin_lock_irqsave (hba->host->host_lock, flags); + hba->clk_gating.delay_ms =max (ah_ms,10U ); +spin_unlock_irqrestore (hba->host->host_lock, flags); + } +} + +/* Convert microseconds to Auto-Hibernate Idle Timer register value */ +static u32 ufs_mtk_us_to_ahit (unsigned int timer) +{ +unsigned int scale; + +for (scale =0 ; timer >UFSHCI_AHIBERN8_TIMER_MASK ; ++scale) + timer /=UFSHCI_AHIBERN8_SCALE_FACTOR ; + +return FIELD_PREP (UFSHCI_AHIBERN8_TIMER_MASK , timer) | +FIELD_PREP (UFSHCI_AHIBERN8_SCALE_MASK , scale); +} + +static void ufs_mtk_fix_ahit (struct ufs_hba *hba) +{ +unsigned int us; + +if (ufshcd_is_auto_hibern8_supported (hba)) { +switch (hba->dev_info.wmanufacturerid) { +case UFS_VENDOR_SAMSUNG : +/* configure auto-hibern8 timer to 3.5 ms */ + us =3500 ; +break ; + +case UFS_VENDOR_MICRON : +/* configure auto-hibern8 timer to 2 ms */ + us =2000 ; +break ; + +default : +/* configure auto-hibern8 timer to 1 ms */ + us =1000 ; +break ; + } + + hba->ahit =ufs_mtk_us_to_ahit (us); + } + +ufs_mtk_setup_clk_gating (hba); +} +static void ufs_mtk_init_mcq_irq (struct ufs_hba *hba) {struct ufs_mtk_host *host =ufshcd_get_variant (hba);
@@ -1119,32 +1182,10 @@ static int ufs_mtk_pre_link(struct ufs_hba *hba)return ret; } - -static void ufs_mtk_setup_clk_gating (struct ufs_hba *hba) -{ -u32 ah_ms; - -if (ufshcd_is_clkgating_allowed (hba)) { -if (ufshcd_is_auto_hibern8_supported (hba) && hba->ahit) - ah_ms =FIELD_GET (UFSHCI_AHIBERN8_TIMER_MASK , - hba->ahit); -else - ah_ms =10 ; -ufshcd_clkgate_delay_set (hba->dev, ah_ms +5 ); - } -} -static void ufs_mtk_post_link (struct ufs_hba *hba) {/* enable unipro clock gating feature */ ufs_mtk_cfg_unipro_cg (hba, true); - -/* will be configured during probe hba */ -if (ufshcd_is_auto_hibern8_supported (hba)) - hba->ahit =FIELD_PREP (UFSHCI_AHIBERN8_TIMER_MASK ,10 ) | -FIELD_PREP (UFSHCI_AHIBERN8_SCALE_MASK ,3 ); - -ufs_mtk_setup_clk_gating (hba); } static int ufs_mtk_link_startup_notify(struct ufs_hba *hba,
@@ -1444,6 +1485,7 @@ static void ufs_mtk_fixup_dev_quirks(struct ufs_hba *hba)ufs_mtk_vreg_fix_vcc (hba);ufs_mtk_vreg_fix_vccqx (hba); +ufs_mtk_fix_ahit (hba); } static void ufs_mtk_event_notify(struct ufs_hba *hba,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 143/529 scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Chao <[email protected]>
[ Upstream commit 979feee0cf43b32d288931649d7c6d9a5524ea55 ]
Assign power mode userdata settings before transitioning to FASTAUTO power mode. This ensures that default timeout values are set for various parameters, enhancing the reliability and performance of the power mode change process.
--- drivers/ufs/host/ufs-mediatek.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
drivers/ufs/host/ufs-mediatek.c +22 -0
@@ -1091,6 +1091,28 @@ static int ufs_mtk_pre_pwr_change(struct ufs_hba *hba,ufshcd_dme_set (hba,UIC_ARG_MIB (PA_TXHSADAPTTYPE ),PA_NO_ADAPT ); +if (!(hba->quirks &UFSHCD_QUIRK_SKIP_DEF_UNIPRO_TIMEOUT_SETTING )) { +ufshcd_dme_set (hba,UIC_ARG_MIB (PA_PWRMODEUSERDATA0 ), + DL_FC0ProtectionTimeOutVal_Default); +ufshcd_dme_set (hba,UIC_ARG_MIB (PA_PWRMODEUSERDATA1 ), + DL_TC0ReplayTimeOutVal_Default); +ufshcd_dme_set (hba,UIC_ARG_MIB (PA_PWRMODEUSERDATA2 ), + DL_AFC0ReqTimeOutVal_Default); +ufshcd_dme_set (hba,UIC_ARG_MIB (PA_PWRMODEUSERDATA3 ), + DL_FC1ProtectionTimeOutVal_Default); +ufshcd_dme_set (hba,UIC_ARG_MIB (PA_PWRMODEUSERDATA4 ), + DL_TC1ReplayTimeOutVal_Default); +ufshcd_dme_set (hba,UIC_ARG_MIB (PA_PWRMODEUSERDATA5 ), + DL_AFC1ReqTimeOutVal_Default); + +ufshcd_dme_set (hba,UIC_ARG_MIB (DME_LocalFC0ProtectionTimeOutVal), + DL_FC0ProtectionTimeOutVal_Default); +ufshcd_dme_set (hba,UIC_ARG_MIB (DME_LocalTC0ReplayTimeOutVal), + DL_TC0ReplayTimeOutVal_Default); +ufshcd_dme_set (hba,UIC_ARG_MIB (DME_LocalAFC0ReqTimeOutVal), + DL_AFC0ReqTimeOutVal_Default); + } + ret =ufshcd_uic_change_pwr_mode (hba,FASTAUTO_MODE <<4 |FASTAUTO_MODE );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 144/529 scsi: ufs: host: mediatek: Change reset sequence for improved stability
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Wang <[email protected]>
[ Upstream commit 878ed88c50bfb14d972dd3b86a1c8188c58de4e5 ]
Modify the reset sequence to ensure that the device reset pin is set low before the host is disabled. This change enhances the stability of the reset process by ensuring the correct order of operations.
--- drivers/ufs/host/ufs-mediatek.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/ufs/host/ufs-mediatek.c +3 -3
@@ -1234,11 +1234,11 @@ static int ufs_mtk_device_reset(struct ufs_hba *hba) {struct arm_smccc_res res; -/* disable hba before device reset */ -ufshcd_hba_stop (hba); -ufs_mtk_device_reset_ctrl (0 , res); +/* disable hba in middle of device reset */ +ufshcd_hba_stop (hba); +/* * The reset signal is active low. UFS devices shall detect * more than or equal to 1us of positive or negative RST_n
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 145/529 scsi: ufs: host: mediatek: Fix invalid access in vccqx handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Chao <[email protected]>
[ Upstream commit 5863638598f5e4f64d2f85b03f376383ca1f2ab7 ]
Add a NULL check before accessing the 'vccqx' pointer to prevent invalid memory access. This ensures that the function safely handles cases where 'vccq' and 'vccq2' are not initialized, improving the robustness of the power management code.
--- drivers/ufs/host/ufs-mediatek.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/ufs/host/ufs-mediatek.c +3 -0
@@ -1316,6 +1316,9 @@ static void ufs_mtk_vccqx_set_lpm(struct ufs_hba *hba, bool lpm) {struct ufs_vreg *vccqx =NULL ; +if (!hba->vreg_info.vccq && !hba->vreg_info.vccq2) +return ; +if (hba->vreg_info.vccq) vccqx = hba->vreg_info.vccq;else
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 146/529 net: ipv6: fix field-spanning memcpy warning in AH output
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charalampos Mitrodimas <[email protected]>
[ Upstream commit 2327a3d6f65ce2fe2634546dde4a25ef52296fec ]
Fix field-spanning memcpy warnings in ah6_output() and ah6_output_done() where extension headers are copied to/from IPv6 address fields, triggering fortify-string warnings about writes beyond the 16-byte address fields.
memcpy: detected field-spanning write (size 40) of single field "&top_iph->saddr" at net/ipv6/ah6.c:439 (size 16)
WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439
The warnings are false positives as the extension headers are intentionally placed after the IPv6 header in memory. Fix by properly copying addresses and extension headers separately, and introduce helper functions to avoid code duplication.
--- net/ipv6/ah6.c | 50 +++++++++++++++++++++++++++++++------------------- 1 file changed, 31 insertions(+), 19 deletions(-)
net/ipv6/ah6.c +31 -19
@@ -46,6 +46,34 @@ struct ah_skb_cb {#define AH_SKB_CB (__skb) ((struct ah_skb_cb *)&((__skb)->cb[0])) +/* Helper to save IPv6 addresses and extension headers to temporary storage */ +static inline void ah6_save_hdrs (struct tmp_ext *iph_ext, +struct ipv6hdr *top_iph,int extlen) +{ +if (!extlen) +return ; + +#if IS_ENABLED (CONFIG_IPV6_MIP6 ) + iph_ext->saddr = top_iph->saddr; +#endif + iph_ext->daddr = top_iph->daddr; +memcpy (&iph_ext->hdrs, top_iph +1 , extlen -sizeof (*iph_ext)); +} + +/* Helper to restore IPv6 addresses and extension headers from temporary storage */ +static inline void ah6_restore_hdrs (struct ipv6hdr *top_iph, +struct tmp_ext *iph_ext,int extlen) +{ +if (!extlen) +return ; + +#if IS_ENABLED (CONFIG_IPV6_MIP6 ) + top_iph->saddr = iph_ext->saddr; +#endif + top_iph->daddr = iph_ext->daddr; +memcpy (top_iph +1 , &iph_ext->hdrs, extlen -sizeof (*iph_ext)); +} +static void *ah_alloc_tmp (struct crypto_ahash *ahash,int nfrags,unsigned int size) {
@@ -304,13 +332,7 @@ static void ah6_output_done(void *data, int err)memcpy (ah->auth_data, icv, ahp->icv_trunc_len);memcpy (top_iph, iph_base,IPV6HDR_BASELEN ); -if (extlen) { -#if IS_ENABLED (CONFIG_IPV6_MIP6 ) -memcpy (&top_iph->saddr, iph_ext, extlen); -#else -memcpy (&top_iph->daddr, iph_ext, extlen); -#endif - } +ah6_restore_hdrs (top_iph, iph_ext, extlen);kfree (AH_SKB_CB (skb)->tmp);xfrm_output_resume (skb->sk, skb, err);
@@ -381,12 +403,8 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)*/ memcpy (iph_base, top_iph,IPV6HDR_BASELEN ); +ah6_save_hdrs (iph_ext, top_iph, extlen);if (extlen) { -#if IS_ENABLED (CONFIG_IPV6_MIP6 ) -memcpy (iph_ext, &top_iph->saddr, extlen); -#else -memcpy (iph_ext, &top_iph->daddr, extlen); -#endif err = ipv6_clear_mutable_options(top_iph, extlen - sizeof(*iph_ext) + sizeof(*top_iph),
@@ -437,13 +455,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)memcpy (ah->auth_data, icv, ahp->icv_trunc_len);memcpy (top_iph, iph_base,IPV6HDR_BASELEN ); -if (extlen) { -#if IS_ENABLED (CONFIG_IPV6_MIP6 ) -memcpy (&top_iph->saddr, iph_ext, extlen); -#else -memcpy (&top_iph->daddr, iph_ext, extlen); -#endif - } +ah6_restore_hdrs (top_iph, iph_ext, extlen); out_free:kfree (iph_base);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 147/529 media: imon: make send_packet() more robust
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit eecd203ada43a4693ce6fdd3a58ae10c7819252c ]
syzbot is reporting that imon has three problems which result in hung tasks due to forever holding device lock [1].
First problem is that when usb_rx_callback_intf0() once got -EPROTO error after ictx->dev_present_intf0 became true, usb_rx_callback_intf0() resubmits urb after printk(), and resubmitted urb causes usb_rx_callback_intf0() to again get -EPROTO error. This results in printk() flooding (RCU stalls).
Alan Stern commented [2] that
In theory it's okay to resubmit _if_ the driver has a robust error-recovery scheme (such as giving up after some fixed limit on the number of errors or after some fixed time has elapsed, perhaps with a time delay to prevent a flood of errors). Most drivers don't bother to do this; they simply give up right away. This makes them more vulnerable to short-term noise interference during USB transfers, but in reality such interference is quite rare. There's nothing really wrong with giving up right away.
but imon has a poor error-recovery scheme which just retries forever; this behavior should be fixed.
Since I'm not sure whether it is safe for imon users to give up upon any error code, this patch takes care of only union of error codes chosen from modules in drivers/media/rc/ directory which handle -EPROTO error (i.e. ir_toy, mceusb and igorplugusb).
Second problem is that when usb_rx_callback_intf0() once got -EPROTO error before ictx->dev_present_intf0 becomes true, usb_rx_callback_intf0() always resubmits urb due to commit 8791d63af0cf ("[media] imon: don't wedge hardware after early callbacks"). Move the ictx->dev_present_intf0 test introduced by commit 6f6b90c9231a ("[media] imon: don't parse scancodes until intf configured") to immediately before imon_incoming_packet(), or the first problem explained above happens without printk() flooding (i.e. hung task).
Third problem is that when usb_rx_callback_intf0() is not called for some reason (e.g. flaky hardware; the reproducer for this problem sometimes prevents usb_rx_callback_intf0() from being called), wait_for_completion_interruptible() in send_packet() never returns (i.e. hung task). As a workaround for such situation, change send_packet() to wait for completion with timeout of 10 seconds.
--- drivers/media/rc/imon.c | 61 +++++++++++++++++++++++++---------------- 1 file changed, 37 insertions(+), 24 deletions(-)
drivers/media/rc/imon.c +37 -24
@@ -650,12 +650,15 @@ static int send_packet(struct imon_context *ictx)smp_rmb ();/* ensure later readers know we're not busy */ pr_err_ratelimited ("error submitting urb(%d)\n" , retval); }else { -/* Wait for transmission to complete (or abort) */ - retval =wait_for_completion_interruptible ( - &ictx->tx.finished); -if (retval) { +/* Wait for transmission to complete (or abort or timeout) */ + retval =wait_for_completion_interruptible_timeout (&ictx->tx.finished,10 *HZ ); +if (retval <=0 ) {usb_kill_urb (ictx->tx_urb);pr_err_ratelimited ("task interrupted\n" ); +if (retval <0 ) + ictx->tx.status = retval; +else + ictx->tx.status = -ETIMEDOUT ; } ictx->tx.busy = false;
@@ -1754,14 +1757,6 @@ static void usb_rx_callback_intf0(struct urb *urb)if (!ictx)return ; -/* -* if we get a callback before we're done configuring the hardware, we -* can't yet process the data, as there's nowhere to send it, but we -* still need to submit a new rx URB to avoid wedging the hardware -*/ -if (!ictx->dev_present_intf0) - goto out; -switch (urb->status) {case -ENOENT :/* usbcore unlink successful! */ return ;
@@ -1770,16 +1765,29 @@ static void usb_rx_callback_intf0(struct urb *urb)break ;case 0 : -imon_incoming_packet (ictx, urb, intfnum); +/* +* if we get a callback before we're done configuring the hardware, we +* can't yet process the data, as there's nowhere to send it, but we +* still need to submit a new rx URB to avoid wedging the hardware +*/ +if (ictx->dev_present_intf0) +imon_incoming_packet (ictx, urb, intfnum);break ; +case -ECONNRESET : +case -EILSEQ : +case -EPROTO : +case -EPIPE : +dev_warn (ictx->dev,"imon %s: status(%d)\n" , + __func__, urb->status); +return ; +default :dev_warn (ictx->dev,"imon %s: status(%d): ignored\n" , __func__, urb->status);break ; } -out:usb_submit_urb (ictx->rx_urb_intf0,GFP_ATOMIC ); }
@@ -1795,14 +1803,6 @@ static void usb_rx_callback_intf1(struct urb *urb)if (!ictx)return ; -/* -* if we get a callback before we're done configuring the hardware, we -* can't yet process the data, as there's nowhere to send it, but we -* still need to submit a new rx URB to avoid wedging the hardware -*/ -if (!ictx->dev_present_intf1) - goto out; -switch (urb->status) {case -ENOENT :/* usbcore unlink successful! */ return ;
@@ -1811,16 +1811,29 @@ static void usb_rx_callback_intf1(struct urb *urb)break ;case 0 : -imon_incoming_packet (ictx, urb, intfnum); +/* +* if we get a callback before we're done configuring the hardware, we +* can't yet process the data, as there's nowhere to send it, but we +* still need to submit a new rx URB to avoid wedging the hardware +*/ +if (ictx->dev_present_intf1) +imon_incoming_packet (ictx, urb, intfnum);break ; +case -ECONNRESET : +case -EILSEQ : +case -EPROTO : +case -EPIPE : +dev_warn (ictx->dev,"imon %s: status(%d)\n" , + __func__, urb->status); +return ; +default :dev_warn (ictx->dev,"imon %s: status(%d): ignored\n" , __func__, urb->status);break ; } -out:usb_submit_urb (ictx->rx_urb_intf1,GFP_ATOMIC ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 148/529 drm/bridge: display-connector: dont set OP_DETECT for DisplayPorts
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit cb640b2ca54617f4a9d4d6efd5ff2afd6be11f19 ]
Detecting the monitor for DisplayPort targets is more complicated than just reading the HPD pin level: it requires reading the DPCD in order to check what kind of device is attached to the port and whether there is an actual display attached.
In order to let DRM framework handle such configurations, disable DRM_BRIDGE_OP_DETECT for dp-connector devices, letting the actual DP driver perform detection. This still keeps DRM_BRIDGE_OP_HPD enabled, so it is valid for the bridge to report HPD events.
Currently inside the kernel there are only two targets which list hpd-gpios for dp-connector devices: arm64/qcom/qcs6490-rb3gen2 and arm64/qcom/sa8295p-adp. Both should be fine with this change.
--- drivers/gpu/drm/bridge/display-connector.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/bridge/display-connector.c +2 -1
@@ -363,7 +363,8 @@ static int display_connector_probe(struct platform_device *pdev)if (conn->bridge.ddc) conn->bridge.ops |=DRM_BRIDGE_OP_EDID |DRM_BRIDGE_OP_DETECT ; -if (conn->hpd_gpio) +/* Detecting the monitor requires reading DPCD */ +if (conn->hpd_gpio && type != DRM_MODE_CONNECTOR_DisplayPort) conn->bridge.ops |=DRM_BRIDGE_OP_DETECT ;if (conn->hpd_irq >=0 ) conn->bridge.ops |=DRM_BRIDGE_OP_HPD ;
Signature · 1 line
2.51.0