6.1.159-rc1 review
Greg Kroah-Hartman
maintainercover 6.1.159-rc1 review
This is the start of the stable review cycle for the 6.1.159 release. There are 568 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.159-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.159-rc1
Alan Stern <[email protected]>
HID: core: Harden s32ton() against conversion to 0 bits
Sudeep Holla <[email protected]>
i2c: xgene-slimpro: Migrate to use generic PCC shmem related macros
Igor Pylypiv <[email protected]>
scsi: pm80xx: Set phy->enable_completion only when we
Jimmy Hu <[email protected]>
usb: gadget: udc: fix use-after-free in usb_gadget_state_work
Kuen-Han Tsai <[email protected]>
usb: udc: Add trace event for usb_gadget_set_state
Jameson Thies <[email protected]>
usb: typec: ucsi: psy: Set max current to zero when disconnected
Sean Heelan <[email protected]>
ksmbd: fix use-after-free in session logoff
Philipp Hortmann <[email protected]>
staging: rtl8712: Remove driver using deprecated API wext
Jiayuan Chen <[email protected]>
mptcp: Fix proto fallback detection with BPF
Paolo Abeni <[email protected]>
mptcp: fix duplicate reset on fastclose
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: endpoints: longer transfer
luoguangfei <[email protected]>
net: macb: fix unregister_netdev call order in macb_remove()
ChiYuan Huang <[email protected]>
iio: adc: rtq6056: Correct the sign bit index
Claudiu Beznea <[email protected]>
usb: renesas_usbhs: Fix synchronous external abort on unbind
Uwe Kleine-König <[email protected]>
usb: renesas_usbhs: Convert to platform remove callback returning void
NeilBrown <[email protected]>
nfsd: Replace clamp_t in nfsd4_get_drc_mem()
ziming zhang <[email protected]>
libceph: replace BUG_ON with bounds check for map->max_osd
ziming zhang <[email protected]>
libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
Ilya Dryomov <[email protected]>
libceph: fix potential use-after-free in have_mon_and_osd_map()
Bastien Curutchet (Schneider Electric) <[email protected]>
net: dsa: microchip: common: Fix checks on irq_find_mapping()
Alex Hung <[email protected]>
drm/amd/display: Check NULL before accessing
Johan Hovold <[email protected]>
drm: sti: fix device leaks at component probe
Vanillan Wang <[email protected]>
USB: serial: option: add support for Rolling RW101R-GL
Oleksandr Suvorov <[email protected]>
USB: serial: ftdi_sio: add support for u-blox EVK-M101
Łukasz Bartosik <[email protected]>
xhci: dbgtty: fix device unregister
Mathias Nyman <[email protected]>
xhci: dbgtty: Fix data corruption when transmitting data form DbC to host
Manish Nagar <[email protected]>
usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths
Owen Gu <[email protected]>
usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer
Tianchu Chen <[email protected]>
usb: storage: sddr55: Reject out-of-bound new_pba
Alan Stern <[email protected]>
USB: storage: Remove subclass and protocol overrides from Novatek quirk
Desnes Nunes <[email protected]>
usb: storage: Fix memory leak in USB bulk transport
Kuen-Han Tsai <[email protected]>
usb: gadget: f_eem: Fix memory leak in eem_unwrap
Miaoqian Lin <[email protected]>
usb: cdns3: Fix double resource release in cdns3_pci_probe
Johan Hovold <[email protected]>
most: usb: fix double free on late probe failure
Miaoqian Lin <[email protected]>
serial: amba-pl011: prefer dma_mapping_error() over explicit address checking
Khairul Anuar Romli <[email protected]>
firmware: stratix10-svc: fix bug in saving controller data
Miaoqian Lin <[email protected]>
slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves
Alan Borzeszkowski <[email protected]>
thunderbolt: Add support for Intel Wildcat Lake
Paulo Alcantara <[email protected]>
smb: client: fix memory leak in cifs_construct_tcon()
Jamie Iles <[email protected]>
drivers/usb/dwc3: fix PCI parent check
Mikulas Patocka <[email protected]>
dm-verity: fix unreliable memory allocation
Marc Kleine-Budde <[email protected]>
can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling
Thomas Mühlbacher <[email protected]>
can: sja1000: fix max irq loop handling
Gui-Dong Han <[email protected]>
atm/fore200e: Fix possible data race in fore200e_open()
Ivan Zhaldak <[email protected]>
ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230
Thomas Bogendoerfer <[email protected]>
MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow
Maciej W. Rozycki <[email protected]>
MIPS: mm: Prevent a TLB shutdown on initial uniquification
David Lechner <[email protected]>
iio: adc: ad7280a: fix ad7280_store_balance_timer()
Valek Andrej <[email protected]>
iio: accel: fix ADXL355 startup race condition
Linus Walleij <[email protected]>
iio: accel: bmc150: Fix irq assumption regression
Christophe JAILLET <[email protected]>
iio:common:ssp_sensors: Fix an error handling path ssp_probe()
Francesco Lavra <[email protected]>
iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields
Jiri Olsa <[email protected]>
Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"
Hang Zhou <[email protected]>
spi: bcm63xx: fix premature CS deassertion on RX-only transactions
Jamie Iles <[email protected]>
mailbox: pcc: don't zero error register
Sudeep Holla <[email protected]>
mailbox: pcc: Refactor error handling in irq handler into separate function
Adam Young <[email protected]>
mailbox: pcc: Check before sending MCTP PCC response ACK
Sudeep Holla <[email protected]>
ACPI: PCC: Add PCC shared memory region command and status bitfields
Huisong Li <[email protected]>
mailbox: pcc: Support shared interrupt for multiple subspaces
Huisong Li <[email protected]>
mailbox: pcc: Add support for platform notification handling
Elliot Berman <[email protected]>
mailbox: pcc: Use mbox_bind_client
Elliot Berman <[email protected]>
mailbox: Allow direct registration to a channel
Haotian Zhang <[email protected]>
mailbox: mailbox-test: Fix debugfs_create_dir error checking
Jiefeng Zhang <[email protected]>
net: atlantic: fix fragment overflow handling in RX path
Vladimir Oltean <[email protected]>
net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic
Russell King (Oracle) <[email protected]>
net: dsa: sja1105: simplify static configuration reload
Alex Deucher <[email protected]>
drm/amdgpu: fix cyan_skillfish2 gpu info fw handling
Alexey Kodanev <[email protected]>
net: sxgbe: fix potential NULL dereference in sxgbe_rx()
Danielle Costantino <[email protected]>
net/mlx5e: Fix validation logic in rate limiting
Horatiu Vultur <[email protected]>
net: lan966x: Fix the initialization of taprio
Kai-Heng Feng <[email protected]>
net: aquantia: Add missing descriptor cache invalidation on ATL2
Dan Carpenter <[email protected]>
platform/x86: intel: punit_ipc: fix memory corruption
Luiz Augusto von Dentz <[email protected]>
Bluetooth: SMP: Fix not generating mackey and ltk when repairing
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs
Seungjin Bae <[email protected]>
can: kvaser_usb: leaf: Fix potential infinite loop in command parsers
Kiryl Shutsemau <[email protected]>
mm/memory: do not populate page table entries beyond i_size
Pankaj Raghav <[email protected]>
filemap: cap PTE range to be created to allowed zero fill in folio_map_range()
Miaoqian Lin <[email protected]>
pmdomain: imx: Fix reference count leak in imx_gpc_remove
Sudeep Holla <[email protected]>
pmdomain: arm: scmi: Fix genpd leak on provider registration failure
André Draszik <[email protected]>
pmdomain: samsung: plug potential memleak during probe
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: connect: fix fallback note due to OoO
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: rm: set backup flag
Mario Limonciello (AMD) <[email protected]>
HID: amd_sfh: Stop sensor before starting
Niklas Cassel <[email protected]>
ata: libata-scsi: Fix system suspend for a security locked drive
Krzysztof Kozlowski <[email protected]>
dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups
Vlastimil Babka <[email protected]>
mm/mempool: fix poisoning order>0 pages with HIGHMEM
Fabio M. De Francesco <[email protected]>
mm/mempool: replace kmap_atomic() with kmap_local_page()
Eric Dumazet <[email protected]>
mptcp: fix a race in mptcp_pm_del_add_timer()
Paolo Abeni <[email protected]>
mptcp: decouple mptcp fastclose from tcp close
Martin Kaiser <[email protected]>
maple_tree: fix tracepoint string pointers
Kiryl Shutsemau <[email protected]>
mm/truncate: unmap large folio on split failure
Long Li <[email protected]>
uio_hv_generic: Set event for all channels on the device
Zhang Chujun <[email protected]>
tracing/tools: Fix incorrcet short option in usage text for --threads
Nishanth Menon <[email protected]>
net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
René Rebe <[email protected]>
ALSA: usb-audio: fix uac2 clock source at terminal parser
Isaac J. Manjarres <[email protected]>
mm/mm_init: fix hash table order logging in alloc_large_system_hash()
Lance Yang <[email protected]>
mm/secretmem: fix use-after-free race in fault handler
Jakub Horký <[email protected]>
kconfig/nconf: Initialize the default locale at startup
Jakub Horký <[email protected]>
kconfig/mconf: Initialize the default locale at startup
Shahar Shitrit <[email protected]>
net: tls: Cancel RX async resync request on rcd_delta overflow
Po-Hsu Lin <[email protected]>
selftests: net: use BASH for bareudp testing
Bart Van Assche <[email protected]>
scsi: core: Fix a regression triggered by scsi_host_busy()
Steve French <[email protected]>
cifs: fix typo in enable_gcm_256 module parameter
Rafał Miłecki <[email protected]>
bcma: don't register devices disabled in OF
Michal Luczaj <[email protected]>
vsock: Ignore signal/timeout on connect() if already established
Pavel Zhigulin <[email protected]>
net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()
Alejandro Colomar <[email protected]>
kernel.h: Move ARRAY_SIZE() to a separate header
Haotian Zhang <[email protected]>
platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos
Aleksei Nikiforov <[email protected]>
s390/ctcm: Fix double-kfree
Shin'ichiro Kawasaki <[email protected]>
nvme-multipath: fix lockdep WARN due to partition scan work
Ilya Maximets <[email protected]>
net: openvswitch: remove never-working support for setting nsh fields
Pavel Zhigulin <[email protected]>
net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get()
Pavel Zhigulin <[email protected]>
net: dsa: hellcreek: fix missing error handling in LED registration
Prateek Agarwal <[email protected]>
drm/tegra: Add call to put_pid()
Mikko Perttunen <[email protected]>
gpu: host1x: Select context device based on attached IOMMU
Zilin Guan <[email protected]>
mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
Jianbo Liu <[email protected]>
xfrm: Determine inner GSO type from packet inner protocol
Yifan Zha <[email protected]>
drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled
Ma Ke <[email protected]>
drm/tegra: dc: Fix reference leak in tegra_dc_couple()
Paolo Abeni <[email protected]>
mptcp: do not fallback when OoO is present
Paolo Abeni <[email protected]>
mptcp: avoid unneeded subflow-level drops
Paolo Abeni <[email protected]>
mptcp: fix premature close in case of fallback
Paolo Abeni <[email protected]>
mptcp: fix ack generation for fallback msk
Eric Dumazet <[email protected]>
mptcp: fix race condition in mptcp_schedule_work()
Huacai Chen <[email protected]>
LoongArch: Don't panic if no valid cache info for PCI
Maciej W. Rozycki <[email protected]>
MIPS: Malta: Fix !EVA SOC-it PCI MMIO
Hamza Mahfooz <[email protected]>
scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
Bart Van Assche <[email protected]>
scsi: sg: Do not sleep in atomic context
Ewan D. Milne <[email protected]>
nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
Seungjin Bae <[email protected]>
Input: pegasus-notetaker - fix potential out-of-bounds access
Dan Carpenter <[email protected]>
Input: imx_sc_key - fix memory corruption on unload
Tzung-Bi Shih <[email protected]>
Input: cros_ec_keyb - fix an invalid memory access
Oleksij Rempel <[email protected]>
net: dsa: microchip: lan937x: Fix RGMII delay tuning
Andrey Vatoropin <[email protected]>
be2net: pass wrb_params in case of OS2BMC
Yihang Li <[email protected]>
ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()
Jiayuan Chen <[email protected]>
mptcp: Disallow MPTCP subflows from sockmap
Yongpeng Yang <[email protected]>
exfat: check return value of sb_min_blocksize in exfat_read_boot_sector
Dan Carpenter <[email protected]>
mtdchar: fix integer overflow in read/write ioctls
Niravkumar L Rabara <[email protected]>
mtd: rawnand: cadence: fix DMA device NULL pointer dereference
Zhang Heng <[email protected]>
HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
Yipeng Zou <[email protected]>
timers: Fix NULL function pointer race in timer_shutdown_sync()
Armen Ratner <[email protected]>
net/mlx5e: Preserve shared buffer capacity during headroom updates
Maher Sanalla <[email protected]>
net/mlx5e: Do not update SBCM when prio2buffer command is invalid
Pedro Tammela <[email protected]>
net/sched: act_connmark: handle errno on tcf_idr_check_alloc
Maher Sanalla <[email protected]>
net/mlx5: Fix memory leak in error flow of port set buffer
Arnd Bergmann <[email protected]>
asm-generic: partially revert "Unify uapi bitsperlong.h for arm64, riscv and loongarch"
Abdun Nihaal <[email protected]>
isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
Michal Hocko <[email protected]>
mm, percpu: do not consider sleepable allocations atomic
Nam Cao <[email protected]>
eventpoll: Replace rwlock with spinlock
Breno Leitao <[email protected]>
net: netpoll: fix incorrect refcount handling causing incorrect cleanup
Yosry Ahmed <[email protected]>
KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated
Jason Gunthorpe <[email protected]>
iommufd: Don't overflow during division for dirty tracking
Adrian Hunter <[email protected]>
scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL
Adrian Hunter <[email protected]>
scsi: ufs: core: Add a quirk to suppress link_startup_again
Bui Quang Minh <[email protected]>
virtio-net: fix received length check in big packets
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: connect: trunc: read all recv data
Filipe Manana <[email protected]>
btrfs: do not update last_log_commit when logging inode due to a new name
Niravkumar L Rabara <[email protected]>
EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
Niravkumar L Rabara <[email protected]>
EDAC/altera: Handle OCRAM ECC enable after warm reset
Huacai Chen <[email protected]>
LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY
Hans de Goede <[email protected]>
spi: Try to get ACPI GPIO IRQ earlier
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
Shawn Lin <[email protected]>
mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4
Wei Yang <[email protected]>
fs/proc: fix uaf in proc_readdir_de()
Johannes Berg <[email protected]>
wifi: mac80211: reject address change while connecting
Chuang Wang <[email protected]>
ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
Tianyang Zhang <[email protected]>
LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY
Qinxin Xia <[email protected]>
dma-mapping: benchmark: Restore padding to ensure uABI remained consistent
Nate Karstens <[email protected]>
strparser: Fix signed/unsigned mismatch bug
Joshua Rogers <[email protected]>
ksmbd: close accepted socket when per-IP limit rejects connection
Peter Oberparleiter <[email protected]>
gcov: add support for GCC 15
Olga Kornievskaia <[email protected]>
NFSD: free copynotify stateid in nfs4_free_ol_stateid()
Masami Ichikawa <[email protected]>
HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject duplicate device on updates
Dan Carpenter <[email protected]>
mtd: onenand: Pass correct pointer to IRQ handler
Tiezhu Yang <[email protected]>
asm-generic: Unify uapi bitsperlong.h for arm64, riscv and loongarch
Eric Biggers <[email protected]>
lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN
Sabrina Dubroca <[email protected]>
espintcp: fix skb leaks
Arseniy Krasnov <[email protected]>
Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
Sumanth Gavini <[email protected]>
softirq: Add trace points for tasklet entry/exit
Eric Dumazet <[email protected]>
bpf: Add bpf_prog_run_data_pointers()
Haein Lee <[email protected]>
ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
Trond Myklebust <[email protected]>
NFSv4: Fix an incorrect parameter when calling nfs4_call_sync()
Ian Forbes <[email protected]>
drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
Haotian Zhang <[email protected]>
ASoC: codecs: va-macro: fix resource leak in probe error path
Haotian Zhang <[email protected]>
ASoC: cs4271: Fix regulator leak on probe failure
Haotian Zhang <[email protected]>
regulator: fixed: fix GPIO descriptor leak on register failure
Shuai Xue <[email protected]>
acpi,srat: Fix incorrect device handle check for Generic Initiator
Pauli Virtanen <[email protected]>
Bluetooth: L2CAP: export l2cap_chan_hold for modules
Gautham R. Shenoy <[email protected]>
ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs
Gautham R. Shenoy <[email protected]>
ACPI: CPPC: Perform fast check switch only for online CPUs
Gautham R. Shenoy <[email protected]>
ACPI: CPPC: Check _CPC validity for only the online CPUs
Felix Maurer <[email protected]>
hsr: Fix supervision frame sending on HSRv0
Eric Dumazet <[email protected]>
net_sched: limit try_bulk_dequeue_skb() batches
Gal Pressman <[email protected]>
net/mlx5e: Fix potentially misleading debug message
Gal Pressman <[email protected]>
net/mlx5e: Remove mlx5e_dbg() and msglvl support
Maher Sanalla <[email protected]>
net/mlx5e: Consider internal buffers size in port buffer calculations
Maher Sanalla <[email protected]>
net/mlx5e: Update shared buffer along with device buffer changes
Maher Sanalla <[email protected]>
net/mlx5e: Add API to query/modify SBPR and SBCM registers
Maher Sanalla <[email protected]>
net/mlx5: Expose shared buffer registers bits and structs
Gal Pressman <[email protected]>
net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
Gal Pressman <[email protected]>
net/mlx5e: Fix maxrate wraparound in threshold between units
Ranganath V N <[email protected]>
net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
Ranganath V N <[email protected]>
net: sched: act_connmark: initialize struct tc_ife to fix kernel leak
Eric Dumazet <[email protected]>
net_sched: act_connmark: use RCU in tcf_connmark_dump()
Pedro Tammela <[email protected]>
net/sched: act_connmark: transition to percpu stats and rcu
Kuniyuki Iwashima <[email protected]>
af_unix: Initialise scc_index in unix_add_edge().
Benjamin Berg <[email protected]>
wifi: mac80211: skip rate verification for not captured PSDUs
Buday Csaba <[email protected]>
net: mdio: fix resource leak in mdiobus_register_device()
Kuniyuki Iwashima <[email protected]>
tipc: Fix use-after-free in tipc_mon_reinit_self().
D. Wythe <[email protected]>
net/smc: fix mismatch between CLC header and proposal
Eric Dumazet <[email protected]>
sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
Raphael Pinsonneault-Thibeault <[email protected]>
Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
Pauli Virtanen <[email protected]>
Bluetooth: MGMT: cancel mesh send timer when hdev removed
Wei Fang <[email protected]>
net: fec: correct rx_bytes statistic for the case SHIFT16 is set
Alexander Sverdlin <[email protected]>
selftests: net: local_termination: Wait for interfaces to come up
Nicolas Escande <[email protected]>
wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp()
Abinaya Kalaiselvan <[email protected]>
wifi: ath11k: Add tx ack signal support for management packets
Sharique Mohammad <[email protected]>
ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
ZhangGuoDong <[email protected]>
smb/server: fix possible refcount leak in smb2_sess_setup()
ZhangGuoDong <[email protected]>
smb/server: fix possible memory leak in smb2_read()
Scott Mayhew <[email protected]>
NFS: check if suid/sgid was cleared after a write as needed
Tristan Lobb <[email protected]>
HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
Joshua Watt <[email protected]>
NFS4: Fix state renewals missing after boot
Jesse.Zhang <[email protected]>
drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices
Timur Kristóf <[email protected]>
drm/amd/pm: Disable MCLK switching on SI at high pixel clocks
Danil Skrebenkov <[email protected]>
RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors
Peter Zijlstra <[email protected]>
compiler_types: Move unused static inline functions warning to W=2
Mario Limonciello <[email protected]>
drm/amd: Fix suspend failure with secure display TA
Shuhao Fu <[email protected]>
smb: client: fix refcount leak in smb2_set_path_attr
Umesh Nerlige Ramappa <[email protected]>
drm/i915: Fix conversion between clock ticks and nanoseconds
Janusz Krzysztofik <[email protected]>
drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
Jakub Kicinski <[email protected]>
selftests: netdevsim: set test timeout to 10 minutes
Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Fix function header names in amdgpu_connectors.c
Krzysztof Kozlowski <[email protected]>
extcon: adc-jack: Cleanup wakeup source only if it was enabled
Adrian Hunter <[email protected]>
scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers
Nathan Chancellor <[email protected]>
lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC
Joshua Rogers <[email protected]>
smb: client: validate change notify buffer before copy
Yuta Hayama <[email protected]>
rtc: rx8025: fix incorrect register reference
Ilia Gavrilov <[email protected]>
Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()
Zilin Guan <[email protected]>
tracing: Fix memory leaks in create_field_var()
Nikolay Aleksandrov <[email protected]>
net: bridge: fix MST static key usage
Nikolay Aleksandrov <[email protected]>
net: bridge: fix use-after-free due to MST port state bypass
Tristram Ha <[email protected]>
net: dsa: microchip: Fix reserved multicast address table programming
Dragos Tatulea <[email protected]>
net/mlx5e: SHAMPO, Fix skb size check for 64K pages
Kalesh AP <[email protected]>
bnxt_en: Fix a possible memory leak in bnxt_ptp_init
Qendrim Maxhuni <[email protected]>
net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
Stefan Wiehler <[email protected]>
sctp: Hold sock lock while iterating over address list
Stefan Wiehler <[email protected]>
sctp: Prevent TOCTOU out-of-bounds write
Stefan Wiehler <[email protected]>
sctp: Hold RCU read lock while iterating over address list
Jonas Gorski <[email protected]>
net: dsa: b53: stop reading ARL entries if search is done
Jonas Gorski <[email protected]>
net: dsa: b53: fix enabling ip multicast
Jonas Gorski <[email protected]>
net: dsa: b53: fix resetting speed and pause on forced link
Hangbin Liu <[email protected]>
net: vlan: sync VLAN features with lower device
Wang Liang <[email protected]>
selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh
David Wei <[email protected]>
netdevsim: add Makefile for selftests
Anubhav Singh <[email protected]>
selftests/net: use destination options instead of hop-by-hop
Richard Gobert <[email protected]>
selftests/net: fix GRO coalesce test and add ext header coalesce tests
Anubhav Singh <[email protected]>
selftests/net: fix out-of-order delivery of FIN in gro:tcp test
Jonas Gorski <[email protected]>
net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx
Raphael Pinsonneault-Thibeault <[email protected]>
Bluetooth: hci_event: validate skb length for unknown CC opcode
Baochen Qiang <[email protected]>
Revert "wifi: ath10k: avoid unnecessary wait for service ready message"
Kailang Yang <[email protected]>
ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again
Viacheslav Dubeyko <[email protected]>
ceph: add checking of wait_for_completion_killable() return value
Valerio Setti <[email protected]>
ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
Geert Uytterhoeven <[email protected]>
kbuild: uapi: Strip comments before size type check
Albin Babu Varghese <[email protected]>
fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
Sascha Hauer <[email protected]>
tools: lib: thermal: use pkg-config to locate libnl3
Emil Dahl Juhl <[email protected]>
tools: lib: thermal: don't preserve owner in install
Ian Rogers <[email protected]>
tools bitmap: Add missing asm-generic/bitsperlong.h include
Sakari Ailus <[email protected]>
ACPI: property: Return present device nodes only on fwnode interface
Hoyoung Seo <[email protected]>
scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS
Randall P. Embry <[email protected]>
9p: sysfs_init: don't hardcode error to ENOMEM
Aaron Kling <[email protected]>
cpufreq: tegra186: Initialize all cores to max frequencies
Randall P. Embry <[email protected]>
9p: fix /sys/fs/9p/caches overwriting itself
Jerome Brunet <[email protected]>
NTB: epf: Allow arbitrary BAR mapping
Matthias Schiffer <[email protected]>
clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled
Nicolas Ferre <[email protected]>
clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register
Ryan Wanner <[email protected]>
clk: at91: clk-master: Add check for divide by 3
Nicolas Ferre <[email protected]>
ARM: at91: pm: save and restore ACR during PLL disable/enable
Josua Mayer <[email protected]>
rtc: pcf2127: clear minute/second interrupt
Chen-Yu Tsai <[email protected]>
clk: sunxi-ng: sun6i-rtc: Add A523 specifics
Tiwei Bie <[email protected]>
um: Fix help message for ssl-non-raw
Yikang Yue <[email protected]>
fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
austinchang <[email protected]>
btrfs: mark dirty extent range for out of bound prealloc extents
Junxian Huang <[email protected]>
RDMA/hns: Fix wrong WQE data when QP wraps around
wenglianfa <[email protected]>
RDMA/hns: Fix the modification of max_send_sge
Jacob Moroni <[email protected]>
RDMA/irdma: Set irdma_cq cq_num field during CQ create
Jacob Moroni <[email protected]>
RDMA/irdma: Remove unused struct irdma_cq fields
Jacob Moroni <[email protected]>
RDMA/irdma: Fix SD index calculation
Saket Dumbre <[email protected]>
ACPICA: Update dsmethod.c to get rid of unused variable warning
Fiona Ebner <[email protected]>
smb: client: transport: avoid reconnects triggered by pending task work
Namjae Jeon <[email protected]>
ksmbd: use sock_create_kern interface to create kernel socket
Vladimir Riabchun <[email protected]>
ftrace: Fix softlockup in ftrace_module_enable
Mike Marshall <[email protected]>
orangefs: fix xattr related buffer overflow...
Dragos Tatulea <[email protected]>
page_pool: Clamp pool size to max 16K pages
Qingfang Deng <[email protected]>
6pack: drop redundant locking and refcounting
Chi Zhiling <[email protected]>
exfat: limit log print for IO error
Roy Vegard Ovesen <[email protected]>
ALSA: usb-audio: add mono main switch to Presonus S1824c
Ivan Pravdin <[email protected]>
Bluetooth: bcsp: receive data only if registered
Luiz Augusto von Dentz <[email protected]>
Bluetooth: SCO: Fix UAF on sco_conn_free
Arkadiusz Bokowy <[email protected]>
Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames
Théo Lebrun <[email protected]>
net: macb: avoid dealing with endianness in macb_set_hwaddr()
Carolina Jubran <[email protected]>
net/mlx5e: Don't query FEC statistics when FEC is disabled
Julian Sun <[email protected]>
ext4: increase IO priority of fastcommit
chuguangqing <[email protected]>
fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
Ranjan Kumar <[email protected]>
scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate
Alok Tiwari <[email protected]>
scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()
Petr Machata <[email protected]>
net: bridge: Install FDB for bridge MAC on VLAN 0
Al Viro <[email protected]>
nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing
Anthony Iliopoulos <[email protected]>
NFSv4.1: fix mount hang after CREATE_SESSION failure
Olga Kornievskaia <[email protected]>
NFSv4: handle ERR_GRACE on delegation recalls
Stephan Gerhold <[email protected]>
remoteproc: qcom: q6v5: Avoid handling handover twice
Mario Limonciello <[email protected]>
PCI/PM: Skip resuming to D0 if device is disconnected
Alex Mastro <[email protected]>
vfio: return -ENOTTY for unsupported device feature
Al Viro <[email protected]>
sparc64: fix prototypes of reads[bwl]()
Koakuma <[email protected]>
sparc/module: Add R_SPARC_UA64 relocation handling
Chen Wang <[email protected]>
PCI: cadence: Check for the existence of cdns_pcie::ops before using it
ChunHao Lin <[email protected]>
r8169: set EEE speed down ratio to 1
Brahmajit Das <[email protected]>
net: intel: fm10k: Fix parameter idx set but not used
Loic Poulain <[email protected]>
wifi: ath10k: Fix connection after GTK rekeying
Seyediman Seyedarab <[email protected]>
iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot()
Robert Marko <[email protected]>
net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X
Alexey Klimov <[email protected]>
ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup()
Shaurya Rane <[email protected]>
jfs: fix uninitialized waitqueue in transaction manager
Tetsuo Handa <[email protected]>
jfs: Verify inode mode when loading from disk
Eric Dumazet <[email protected]>
ipv6: np->rxpmtu race annotation
Krishna Kurapati <[email protected]>
usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
Forest Crossman <[email protected]>
usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
Al Viro <[email protected]>
allow finish_no_open(file, ERR_PTR(-E...))
Justin Tee <[email protected]>
scsi: lpfc: Define size of debugfs entry for xri rebalancing
Justin Tee <[email protected]>
scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup
Justin Tee <[email protected]>
scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET
Nai-Chen Cheng <[email protected]>
selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
Christian König <[email protected]>
drm/amdgpu: reject gang submissions under SRIOV
Stefan Wahren <[email protected]>
ethernet: Extend device_get_mac_address() to use NVMEM
Jakub Kicinski <[email protected]>
page_pool: always add GFP_NOWARN for ATOMIC allocations
Mario Limonciello (AMD) <[email protected]>
drm/amd: Avoid evicting resources at S5
Tvrtko Ursulin <[email protected]>
drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl
John Keeping <[email protected]>
ALSA: serial-generic: remove shared static buffer
Quan Zhou <[email protected]>
wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device
Yafang Shao <[email protected]>
net/cls_cgroup: Fix task_get_classid() during qdisc run
Sangwook Shin <[email protected]>
watchdog: s3c2410_wdt: Fix max_timeout being calculated larger
Alok Tiwari <[email protected]>
udp_tunnel: use netdev_warn() instead of netdev_WARN()
David Ahern <[email protected]>
selftests: Replace sleep with slowwait
Daniel Palmer <[email protected]>
eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP
David Ahern <[email protected]>
selftests: Disable dad for ipv6 in fcnal-test.sh
Li RongQing <[email protected]>
x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT
Florian Westphal <[email protected]>
netfilter: nf_reject: don't reply to icmp error messages
Ido Schimmel <[email protected]>
selftests: traceroute: Use require_command()
Qianfeng Rong <[email protected]>
media: redrat3: use int type to store negative error codes
Jakub Kicinski <[email protected]>
selftests: net: replace sleeps in fcnal-test with waits
Niklas Söderlund <[email protected]>
net: sh_eth: Disable WoL if system can not suspend
Michael Riesch <[email protected]>
phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0
Harikrishna Shenoy <[email protected]>
phy: cadence: cdns-dphy: Enable lower resolutions in dphy
Ilan Peer <[email protected]>
wifi: mac80211: Fix HE capabilities element check
Tetsuo Handa <[email protected]>
ntfs3: pretend $Extend records as regular files
Rohan G Thomas <[email protected]>
net: phy: marvell: Fix 88e1510 downshift counter errata
Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Enhance recovery on resume failure
Vladimir Zapolskiy <[email protected]>
media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer
Antonino Maniscalco <[email protected]>
drm/msm: make sure to not queue up recovery more than once
Chen Yufeng <[email protected]>
usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget
William Wu <[email protected]>
usb: gadget: f_hid: Fix zero length packet transfer
Alex Deucher <[email protected]>
drm/amdgpu: add support for cyan skillfish gpu_info
Alex Deucher <[email protected]>
drm/amdgpu: don't enable SMU on cyan skillfish
Alex Deucher <[email protected]>
drm/amd: add more cyan skillfish PCI ids
Ashish Kalra <[email protected]>
iommu/amd: Skip enabling command/event buffers for kdump
Colin Foster <[email protected]>
smsc911x: add second read of EEPROM mac when possible corruption seen
Eric Dumazet <[email protected]>
net: call cond_resched() less often in __release_sock()
Cryolitia PukNgae <[email protected]>
ALSA: usb-audio: apply quirk for MOONDROP Quark2
Paul Kocialkowski <[email protected]>
media: verisilicon: Explicitly disable selection api ioctls for decoders
Niklas Söderlund <[email protected]>
media: adv7180: Only validate format in querystd
Niklas Söderlund <[email protected]>
media: adv7180: Do not write format to device in set_fmt
Niklas Söderlund <[email protected]>
media: adv7180: Add missing lock in suspend callback
Juraj Šarinay <[email protected]>
net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
Yue Haibing <[email protected]>
ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
David Francis <[email protected]>
drm/amdgpu: Allow kfd CRIU with no buffer objects
Krzysztof Kozlowski <[email protected]>
drm/msm/dsi/phy_7nm: Fix missing initial VCO rate
Krzysztof Kozlowski <[email protected]>
drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL
Devendra K Verma <[email protected]>
dmaengine: dw-edma: Set status for callback_result
Rosen Penev <[email protected]>
dmaengine: mv_xor: match alloc_wc and free_wc
Thomas Andreatta <[email protected]>
dmaengine: sh: setup_xref error handling
Miroslav Lichvar <[email protected]>
ptp: Limit time setting of PTP clocks
Qianfeng Rong <[email protected]>
scsi: pm8001: Use int instead of u32 to store error codes
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: danube: rename stp node on EASY50712 reference board
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: xway: sysctrl: rename stp clock
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: danube: add missing device_type in pci node
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: danube: add model to EASY50712 dts
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: danube: add missing properties to cpu node
Timur Kristóf <[email protected]>
drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)
Chelsy Ratnawat <[email protected]>
media: fix uninitialized symbol warnings
Amber Lin <[email protected]>
drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
Eric Huang <[email protected]>
drm/amdkfd: fix vram allocation failure for a special case
Heiner Kallweit <[email protected]>
net: phy: fixed_phy: let fixed_phy_unregister free the phy_device
Krzysztof Kozlowski <[email protected]>
extcon: adc-jack: Fix wakeup source leaks on device unbind
Francisco Gutierrez <[email protected]>
scsi: pm80xx: Fix race condition caused by static variables
Chandrakanth Patil <[email protected]>
scsi: mpi3mr: Fix controller init failure on fault during queue creation
Ujwal Kundur <[email protected]>
rds: Fix endianness annotation for RDS_MPATH_HASH
Takashi Iwai <[email protected]>
ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
Sungho Kim <[email protected]>
PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
Kuniyuki Iwashima <[email protected]>
net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
Christoph Paasch <[email protected]>
net: When removing nexthops, don't call synchronize_net if it is not necessary
Zijun Hu <[email protected]>
char: misc: Does not request module for miscdevice with dynamic minor
raub camaioni <[email protected]>
usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
Rodrigo Gobbi <[email protected]>
iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
Dmitry Baryshkov <[email protected]>
drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts
Tetsuo Handa <[email protected]>
media: imon: make send_packet() more robust
Charalampos Mitrodimas <[email protected]>
net: ipv6: fix field-spanning memcpy warning in AH output
Alice Chao <[email protected]>
scsi: ufs: host: mediatek: Fix invalid access in vccqx handling
Peter Wang <[email protected]>
scsi: ufs: host: mediatek: Change reset sequence for improved stability
Alice Chao <[email protected]>
scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change
Ido Schimmel <[email protected]>
bridge: Redirect to backup port when port is administratively down
Niklas Schnelle <[email protected]>
s390/pci: Use pci_uevent_ers() in PCI recovery
Niklas Schnelle <[email protected]>
powerpc/eeh: Use result of error_detected() in uevent
Lukas Wunner <[email protected]>
thunderbolt: Use is_pciehp instead of is_hotplug_bridge
Thomas Weißschuh <[email protected]>
ice: Don't use %pK through printk or tracepoints
Tiezhu Yang <[email protected]>
net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
Kirill A. Shutemov <[email protected]>
x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
Mehdi Djait <[email protected]>
media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR
Jayesh Choudhary <[email protected]>
drm/tidss: Set crtc modesetting parameters with adjusted mode
Tomi Valkeinen <[email protected]>
drm/tidss: Use the crtc_* timings when programming the HW
Laurent Pinchart <[email protected]>
media: amphion: Delete v4l2_fh synchronously in .release()
Laurent Pinchart <[email protected]>
media: pci: ivtv: Don't create fake v4l2_fh
Geoffrey McRae <[email protected]>
drm/amdkfd: return -ENOTTY for unsupported IOCTLs
Wake Liu <[email protected]>
selftests/net: Ensure assert() triggers in psock_tpacket.c
Wake Liu <[email protected]>
selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
Marcos Del Sol Vives <[email protected]>
PCI: Disable MSI on RDC PCI to PCIe bridges
Seyediman Seyedarab <[email protected]>
drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
Sathishkumar S <[email protected]>
drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
Lijo Lazar <[email protected]>
drm/amd/pm: Use cached metrics data on arcturus
Lijo Lazar <[email protected]>
drm/amd/pm: Use cached metrics data on aldebaran
Alex Deucher <[email protected]>
drm/amd/display: add more cyan skillfish devices
Jens Kehne <[email protected]>
mfd: da9063: Split chip variant reading in two bus transactions
Arnd Bergmann <[email protected]>
mfd: madera: Work around false-positive -Wininitialized warning
Alexander Stein <[email protected]>
mfd: stmpe-i2c: Add missing MODULE_LICENSE
Alexander Stein <[email protected]>
mfd: stmpe: Remove IRQ domain upon removal
Len Brown <[email protected]>
tools/power x86_energy_perf_policy: Prefer driver HWP limits
Len Brown <[email protected]>
tools/power x86_energy_perf_policy: Enhance HWP enable
Kaushlendra Kumar <[email protected]>
tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
Kaushlendra Kumar <[email protected]>
tools/cpupower: Fix incorrect size in cpuidle_state_disable()
Armin Wolf <[email protected]>
hwmon: (dell-smm) Add support for Dell OptiPlex 7040
Ben Copeland <[email protected]>
hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
Jiri Olsa <[email protected]>
uprobe: Do not emulate/sstep original instruction when ip is changed
Alistair Francis <[email protected]>
nvme: Use non zero KATO for persistent discovery connections
Amery Hung <[email protected]>
bpf: Clear pfmemalloc flag when freeing all fragments
Daniel Lezcano <[email protected]>
clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
Biju Das <[email protected]>
spi: rpc-if: Add resume support for RZ/G3E
Pranav Tyagi <[email protected]>
futex: Don't leak robust_list pointer on exec race
Rafael J. Wysocki <[email protected]>
cpuidle: Fail cpuidle device registration if there is one already
Tom Stellard <[email protected]>
bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
Kaushlendra Kumar <[email protected]>
tools/cpupower: fix error return value in cpupower_write_sysfs()
Svyatoslav Ryhel <[email protected]>
video: backlight: lp855x_bl: Set correct EPROM start for LP8556
Daniel Wagner <[email protected]>
nvme-fc: use lock accessing port_state and rport state
Daniel Wagner <[email protected]>
nvmet-fc: avoid scheduling association deletion twice
Amirreza Zarrabi <[email protected]>
tee: allow a driver to allocate a tee_device without a pool
Hans de Goede <[email protected]>
ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
Sarthak Garg <[email protected]>
mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
Svyatoslav Ryhel <[email protected]>
soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
Ming Wang <[email protected]>
irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller
Andreas Kemnade <[email protected]>
hwmon: sy7636a: add alias
Fabien Proriol <[email protected]>
power: supply: sbs-charger: Support multiple devices
Chuande Chen <[email protected]>
hwmon: (sbtsi_temp) AMD CPU extended temperature range support
Hans de Goede <[email protected]>
ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
Shang song (Lenovo) <[email protected]>
ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
Christian Bruel <[email protected]>
irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
Ricardo B. Marlière <[email protected]>
selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh
Kees Cook <[email protected]>
arc: Fix __fls() const-foldability via __builtin_clzl()
Dennis Beier <[email protected]>
cpufreq/longhaul: handle NULL policy in longhaul_exit
Ricardo B. Marlière <[email protected]>
selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
Inochi Amaoto <[email protected]>
irqchip/sifive-plic: Respect mask state when setting affinity
Jiayi Li <[email protected]>
memstick: Add timeout to prevent indefinite waiting
Biju Das <[email protected]>
mmc: host: renesas_sdhi: Fix the actual clock
Chi Zhang <[email protected]>
pinctrl: single: fix bias pull up/down handling in pin_config_set
Thomas Weißschuh <[email protected]>
bpf: Don't use %pK through printk
Thomas Weißschuh <[email protected]>
soc: ti: pruss: don't use %pK through printk
Thomas Weißschuh <[email protected]>
spi: loopback-test: Don't use %pK through printk
Jens Reidel <[email protected]>
soc: qcom: smem: Fix endian-unaware access of num_entries
Ryan Chen <[email protected]>
soc: aspeed: socinfo: Add AST27xx silicon IDs
Gerd Bayer <[email protected]>
s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump
Philipp Stanner <[email protected]>
drm/sched: Fix race in drm_sched_entity_select_rq()
Thomas Zimmermann <[email protected]>
drm/sysfb: Do not dereference NULL pointer in plane reset
Owen Gu <[email protected]>
usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
Ryusuke Konishi <[email protected]>
nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs()
Darrick J. Wong <[email protected]>
block: fix race between set_blocksize and read paths
Christoph Hellwig <[email protected]>
block: open code __generic_file_write_iter for blkdev writes
Al Viro <[email protected]>
direct_write_fallback(): on error revert the ->ki_pos update from buffered write
Christoph Hellwig <[email protected]>
fs: factor out a direct_write_fallback helper
Christoph Hellwig <[email protected]>
filemap: update ki_pos in generic_perform_write
Christoph Hellwig <[email protected]>
filemap: add a kiocb_invalidate_post_direct_write helper
Christoph Hellwig <[email protected]>
filemap: add a kiocb_invalidate_pages helper
Pierre Gondois <[email protected]>
arm64: tegra: Update cache properties
K Prateek Nayak <[email protected]>
drivers: base: cacheinfo: Update cpu_map_populated during CPU Hotplug
Yicong Yang <[email protected]>
cacheinfo: Fix LLC is not exported through sysfs
Pierre Gondois <[email protected]>
cacheinfo: Initialize variables in fetch_cache_info()
Pierre Gondois <[email protected]>
arch_topology: Build cacheinfo from primary CPU
Pierre Gondois <[email protected]>
ACPI: PPTT: Update acpi_find_last_cache_level() to acpi_get_cache_info()
Pierre Gondois <[email protected]>
ACPI: PPTT: Remove acpi_find_cache_levels()
Pierre Gondois <[email protected]>
cacheinfo: Check 'cache-unified' property to count cache leaves
Pierre Gondois <[email protected]>
cacheinfo: Return error code in init_of_cache_level()
Pierre Gondois <[email protected]>
cacheinfo: Use RISC-V's init_cache_level() as generic OF implementation
Celeste Liu <[email protected]>
can: gs_usb: increase max interface to U8_MAX
Paolo Abeni <[email protected]>
mptcp: drop bogus optimization in __mptcp_check_push()
Geliang Tang <[email protected]>
mptcp: change 'first' as a parameter
Emanuele Ghidoli <[email protected]>
net: phy: dp83867: Disable EEE support as not implemented
Farhan Ali <[email protected]>
s390/pci: Restore IRQ unconditionally for the zPCI device
Alex Deucher <[email protected]>
Reapply "Revert drm/amd/display: Enable Freesync Video Mode by default"
Alexey Klimov <[email protected]>
regmap: slimbus: fix bus_context pointer in regmap init calls
Damien Le Moal <[email protected]>
block: make REQ_OP_ZONE_OPEN a write operation
Damien Le Moal <[email protected]>
block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
John Smith <[email protected]>
drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
John Smith <[email protected]>
drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
Yang Wang <[email protected]>
drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
Jijie Shao <[email protected]>
net: hns3: return error code when function fails
Tomeu Vizoso <[email protected]>
drm/etnaviv: fix flush sequence logic
Luiz Augusto von Dentz <[email protected]>
Bluetooth: ISO: Fix another instance of dst_type handling
Claudia Draghicescu <[email protected]>
Bluetooth: ISO: Add support for periodic adv reports processing
Luiz Augusto von Dentz <[email protected]>
Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00
Chris Lu <[email protected]>
Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset
Cen Zhang <[email protected]>
Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
Lizhi Xu <[email protected]>
usbnet: Prevents free active kevent
Andrii Nakryiko <[email protected]>
libbpf: Fix powerpc's stack register definition in bpf_tracing.h
Shengjiu Wang <[email protected]>
ASoC: fsl_sai: fix bit order for DSD format
Cezary Rojewski <[email protected]>
ASoC: Intel: avs: Unprepare a stream when XRUN occurs
Ondrej Mosnacek <[email protected]>
bpf: Do not audit capability check in do_jit()
Wonkon Kim <[email protected]>
scsi: ufs: core: Initialize value of an attribute returned by uic cmd
Noorain Eqbal <[email protected]>
bpf: Sync pending IRQ work before freeing ring buffer
Roy Vegard Ovesen <[email protected]>
ALSA: usb-audio: fix control pipe direction
Akhil P Oommen <[email protected]>
drm/msm/a6xx: Fix GMU firmware parser
Loic Poulain <[email protected]>
wifi: ath10k: Fix memory leak on unsupported WMI command
Chang S. Bae <[email protected]>
x86/fpu: Ensure XFD state on signal delivery
Srinivas Kandagatla <[email protected]>
ASoC: qdsp6: q6asm: do not sleep while atomic
Paolo Abeni <[email protected]>
mptcp: restore window probe
Miaoqian Lin <[email protected]>
fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
Florian Fuchs <[email protected]>
fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
Gokul Sivakumar <[email protected]>
wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
Junjie Cao <[email protected]>
fbdev: bitblit: bound-check glyph index in bit_putcs*
Yuhao Jiang <[email protected]>
ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
Daniel Palmer <[email protected]>
fbdev: atyfb: Check if pll_ops->init_pll failed
Quanmin Yan <[email protected]>
fbcon: Set fb_display[i]->mode to NULL when the mode is released
Miaoqian Lin <[email protected]>
net: usb: asix_devices: Check return value of usbnet_get_endpoints
Chuck Lever <[email protected]>
NFSD: Fix crash in nfsd4_read_release()
Hugo Villeneuve <[email protected]>
serial: sc16is7xx: remove useless enable of enhanced features
Hugo Villeneuve <[email protected]>
serial: sc16is7xx: refactor EFR lock
Hugo Villeneuve <[email protected]>
serial: sc16is7xx: reorder code to remove prototype declarations
Hugo Villeneuve <[email protected]>
serial: sc16is7xx: remove unused to_sc16is7xx_port macro
Mathias Nyman <[email protected]>
xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event
Mathias Nyman <[email protected]>
xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive.
Mathias Nyman <[email protected]>
xhci: dbc: Improve performance by removing delay in transfer event polling.
Uday M Bhat <[email protected]>
xhci: dbc: Allow users to modify DbC poll interval via sysfs
Mathias Nyman <[email protected]>
xhci: dbc: poll at different rate depending on data transfer activity
Mathias Nyman <[email protected]>
xhci: dbc: Provide sysfs option to configure dbc descriptors
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported
Geliang Tang <[email protected]>
selftests: mptcp: disable add_addr retrans in endpoint_tests
Xu Yang <[email protected]>
dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR
Menglong Dong <[email protected]>
arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c
Filipe Manana <[email protected]>
btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
Filipe Manana <[email protected]>
btrfs: always drop log root tree reference in btrfs_replay_log()
Thorsten Blum <[email protected]>
btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io()
Naohiro Aota <[email protected]>
btrfs: zoned: refine extent allocator hint selection
Avadhut Naik <[email protected]>
EDAC/mc_sysfs: Increase legacy channel support to 16
David Kaplan <[email protected]>
x86/bugs: Fix reporting of LFENCE retpoline
Josh Poimboeuf <[email protected]>
perf: Have get_perf_callchain() return NULL if crosstask and user are set
Xiang Mei <[email protected]>
net/sched: sch_qfq: Fix null-deref in agg_dequeue
-------------
Diffstat:
.../ABI/testing/sysfs-bus-pci-drivers-xhci_hcd | 62 + .../bindings/pinctrl/toshiba,visconti-pinctrl.yaml | 26 +- .../devicetree/bindings/usb/fsl,imx8mp-dwc3.yaml | 10 +- MAINTAINERS | 7 +- Makefile | 4 +- arch/alpha/kernel/asm-offsets.c | 1 + arch/arc/include/asm/bitops.h | 2 + arch/arc/kernel/asm-offsets.c | 1 + arch/arm/crypto/Kconfig | 2 +- arch/arm/kernel/asm-offsets.c | 2 + arch/arm/mach-at91/pm_suspend.S | 8 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 15 + arch/arm64/boot/dts/nvidia/tegra210.dtsi | 1 + arch/arm64/boot/dts/nvidia/tegra234.dtsi | 33 + arch/arm64/kernel/asm-offsets.c | 1 + arch/arm64/kernel/cacheinfo.c | 11 +- arch/csky/kernel/asm-offsets.c | 1 + arch/hexagon/kernel/asm-offsets.c | 1 + arch/loongarch/include/asm/pgtable.h | 11 +- arch/loongarch/include/uapi/asm/bitsperlong.h | 9 - arch/loongarch/kernel/asm-offsets.c | 2 + arch/loongarch/kernel/traps.c | 4 +- arch/loongarch/pci/pci.c | 8 +- arch/m68k/kernel/asm-offsets.c | 1 + arch/microblaze/kernel/asm-offsets.c | 1 + arch/mips/boot/dts/lantiq/danube.dtsi | 6 + arch/mips/boot/dts/lantiq/danube_easy50712.dts | 4 +- arch/mips/kernel/asm-offsets.c | 2 + arch/mips/lantiq/xway/sysctrl.c | 2 +- arch/mips/mm/tlb-r4k.c | 118 +- arch/mips/mti-malta/malta-init.c | 20 +- arch/nios2/kernel/asm-offsets.c | 1 + arch/openrisc/kernel/asm-offsets.c | 1 + arch/parisc/kernel/asm-offsets.c | 1 + arch/powerpc/kernel/asm-offsets.c | 1 + arch/powerpc/kernel/eeh_driver.c | 2 +- arch/riscv/kernel/asm-offsets.c | 1 + arch/riscv/kernel/cacheinfo.c | 42 - arch/riscv/kernel/cpu-hotplug.c | 1 + arch/s390/include/asm/pci.h | 1 - arch/s390/kernel/asm-offsets.c | 1 + arch/s390/pci/pci_event.c | 7 +- arch/s390/pci/pci_irq.c | 9 +- arch/sh/kernel/asm-offsets.c | 1 + arch/sparc/include/asm/elf_64.h | 1 + arch/sparc/include/asm/io_64.h | 6 +- arch/sparc/kernel/asm-offsets.c | 1 + arch/sparc/kernel/module.c | 1 + arch/um/drivers/ssl.c | 5 +- arch/um/kernel/asm-offsets.c | 2 + arch/x86/entry/vsyscall/vsyscall_64.c | 17 +- arch/x86/events/core.c | 10 +- arch/x86/kernel/cpu/bugs.c | 5 +- arch/x86/kernel/fpu/core.c | 3 + arch/x86/kernel/kvm.c | 20 +- arch/x86/kvm/svm/svm.c | 10 +- arch/x86/net/bpf_jit_comp.c | 2 +- arch/xtensa/kernel/asm-offsets.c | 1 + block/bdev.c | 17 + block/blk-zoned.c | 5 +- block/fops.c | 61 +- block/ioctl.c | 6 + drivers/acpi/acpi_video.c | 4 +- drivers/acpi/acpica/dsmethod.c | 10 +- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/numa/srat.c | 2 +- drivers/acpi/pptt.c | 93 +- drivers/acpi/prmt.c | 19 +- drivers/acpi/property.c | 24 +- drivers/acpi/scan.c | 2 + drivers/ata/libata-scsi.c | 12 +- drivers/atm/fore200e.c | 2 + drivers/base/arch_topology.c | 12 +- drivers/base/cacheinfo.c | 168 +- drivers/base/regmap/regmap-slimbus.c | 6 +- drivers/bcma/main.c | 6 + drivers/bluetooth/btmtksdio.c | 12 + drivers/bluetooth/btusb.c | 30 +- drivers/bluetooth/hci_bcsp.c | 3 + drivers/char/misc.c | 8 +- drivers/clk/at91/clk-master.c | 3 + drivers/clk/at91/clk-sam9x60-pll.c | 75 +- drivers/clk/sunxi-ng/ccu-sun6i-rtc.c | 11 + drivers/clk/ti/clk-33xx.c | 2 + drivers/clocksource/timer-vf-pit.c | 22 +- drivers/cpufreq/longhaul.c | 3 + drivers/cpufreq/tegra186-cpufreq.c | 27 +- drivers/cpuidle/cpuidle.c | 8 +- drivers/dma/dw-edma/dw-edma-core.c | 22 + drivers/dma/mv_xor.c | 4 +- drivers/dma/sh/shdma-base.c | 25 +- drivers/dma/sh/shdmac.c | 17 +- drivers/edac/altera_edac.c | 22 +- drivers/edac/edac_mc_sysfs.c | 24 + drivers/extcon/extcon-adc-jack.c | 2 + drivers/firmware/arm_scmi/scmi_pm_domain.c | 13 +- drivers/firmware/stratix10-svc.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 66 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 23 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 10 + drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 4 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 19 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 9 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 8 +- drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 11 +- drivers/gpu/drm/amd/display/include/dal_asic_id.h | 5 + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 + .../gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c | 2 +- .../drm/amd/pm/powerplay/smumgr/iceland_smumgr.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 2 +- drivers/gpu/drm/bridge/display-connector.c | 3 +- drivers/gpu/drm/drm_gem_atomic_helper.c | 6 +- drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 2 +- drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c | 4 +- drivers/gpu/drm/i915/i915_vma.c | 16 +- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 5 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 3 + drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 10 + drivers/gpu/drm/nouveau/nvkm/core/enum.c | 2 +- drivers/gpu/drm/scheduler/sched_entity.c | 3 +- drivers/gpu/drm/sti/sti_vtg.c | 7 +- drivers/gpu/drm/tegra/dc.c | 1 + drivers/gpu/drm/tegra/uapi.c | 7 +- drivers/gpu/drm/tidss/tidss_crtc.c | 7 +- drivers/gpu/drm/tidss/tidss_dispc.c | 16 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 5 + drivers/gpu/host1x/context.c | 4 + drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c | 2 + drivers/hid/hid-core.c | 7 +- drivers/hid/hid-ids.h | 7 +- drivers/hid/hid-ntrig.c | 7 +- drivers/hid/hid-quirks.c | 14 +- drivers/hwmon/asus-ec-sensors.c | 2 +- drivers/hwmon/dell-smm-hwmon.c | 7 + drivers/hwmon/sbtsi_temp.c | 46 +- drivers/hwmon/sy7636a-hwmon.c | 1 + drivers/i2c/busses/i2c-xgene-slimpro.c | 16 +- drivers/iio/accel/adxl355_core.c | 44 +- drivers/iio/accel/bmc150-accel-core.c | 5 + drivers/iio/accel/bmc150-accel.h | 1 + drivers/iio/adc/ad7280a.c | 2 +- drivers/iio/adc/rtq6056.c | 2 +- drivers/iio/adc/spear_adc.c | 9 +- drivers/iio/common/ssp_sensors/ssp_dev.c | 4 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 22 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 11 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 2 - drivers/infiniband/hw/irdma/pble.c | 2 +- drivers/infiniband/hw/irdma/verbs.c | 4 +- drivers/infiniband/hw/irdma/verbs.h | 8 +- drivers/input/keyboard/cros_ec_keyb.c | 6 + drivers/input/keyboard/imx_sc_key.c | 2 +- drivers/input/tablet/pegasus_notetaker.c | 9 + drivers/iommu/amd/init.c | 28 +- drivers/iommu/intel/debugfs.c | 10 +- drivers/iommu/intel/perf.c | 10 +- drivers/iommu/intel/perf.h | 5 +- drivers/irqchip/irq-gic-v2m.c | 13 +- drivers/irqchip/irq-loongson-pch-lpc.c | 9 +- drivers/irqchip/irq-sifive-plic.c | 6 +- drivers/isdn/hardware/mISDN/hfcsusb.c | 18 +- drivers/mailbox/mailbox-test.c | 2 +- drivers/mailbox/mailbox.c | 96 +- drivers/mailbox/pcc.c | 248 ++- drivers/md/dm-verity-fec.c | 6 +- drivers/media/i2c/Kconfig | 2 +- drivers/media/i2c/adv7180.c | 48 +- drivers/media/i2c/ir-kbd-i2c.c | 6 +- drivers/media/i2c/og01a1b.c | 6 +- drivers/media/pci/ivtv/ivtv-alsa-pcm.c | 2 - drivers/media/pci/ivtv/ivtv-driver.h | 3 +- drivers/media/pci/ivtv/ivtv-fileops.c | 18 +- drivers/media/pci/ivtv/ivtv-irq.c | 4 +- drivers/media/platform/amphion/vpu_v4l2.c | 7 +- drivers/media/platform/verisilicon/hantro_drv.c | 2 + drivers/media/platform/verisilicon/hantro_v4l2.c | 6 +- drivers/media/rc/imon.c | 61 +- drivers/media/rc/redrat3.c | 2 +- drivers/media/tuners/xc4000.c | 8 +- drivers/media/tuners/xc5000.c | 12 +- drivers/memstick/core/memstick.c | 8 +- drivers/mfd/da9063-i2c.c | 27 +- drivers/mfd/madera-core.c | 4 +- drivers/mfd/stmpe-i2c.c | 1 + drivers/mfd/stmpe.c | 3 + drivers/mmc/host/renesas_sdhi_core.c | 6 +- drivers/mmc/host/sdhci-msm.c | 15 + drivers/mmc/host/sdhci-of-dwcmshc.c | 2 +- drivers/most/most_usb.c | 14 +- drivers/mtd/mtdchar.c | 6 +- drivers/mtd/nand/onenand/onenand_samsung.c | 2 +- drivers/mtd/nand/raw/cadence-nand-controller.c | 3 +- drivers/net/can/sja1000/sja1000.c | 4 +- drivers/net/can/sun4i_can.c | 4 +- drivers/net/can/usb/gs_usb.c | 64 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 4 +- drivers/net/dsa/b53/b53_common.c | 15 +- drivers/net/dsa/b53/b53_regs.h | 3 +- drivers/net/dsa/dsa_loop.c | 9 +- drivers/net/dsa/hirschmann/hellcreek_ptp.c | 14 +- drivers/net/dsa/microchip/ksz9477.c | 98 +- drivers/net/dsa/microchip/ksz9477_reg.h | 3 +- drivers/net/dsa/microchip/ksz_common.c | 12 +- drivers/net/dsa/microchip/ksz_common.h | 2 + drivers/net/dsa/microchip/lan937x_main.c | 1 + drivers/net/dsa/sja1105/sja1105_main.c | 66 +- .../net/ethernet/aquantia/atlantic/aq_hw_utils.c | 22 + .../net/ethernet/aquantia/atlantic/aq_hw_utils.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 5 + .../ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 19 +- .../ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 4 +- drivers/net/ethernet/cadence/macb_main.c | 6 +- drivers/net/ethernet/emulex/benet/be_main.c | 7 +- drivers/net/ethernet/freescale/fec_main.c | 2 + .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c | 9 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h | 2 +- drivers/net/ethernet/intel/fm10k/fm10k_common.c | 5 +- drivers/net/ethernet/intel/fm10k/fm10k_common.h | 2 +- drivers/net/ethernet/intel/fm10k/fm10k_pf.c | 2 +- drivers/net/ethernet/intel/fm10k/fm10k_vf.c | 2 +- drivers/net/ethernet/intel/ice/ice_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_trace.h | 10 +- drivers/net/ethernet/mellanox/mlx5/core/en.h | 10 - drivers/net/ethernet/mellanox/mlx5/core/en/port.c | 72 + drivers/net/ethernet/mellanox/mlx5/core/en/port.h | 6 + .../ethernet/mellanox/mlx5/core/en/port_buffer.c | 280 ++- .../ethernet/mellanox/mlx5/core/en/port_buffer.h | 7 +- drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c | 8 +- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 62 +- .../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 18 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 5 +- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 5 +- drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 12 +- .../net/ethernet/mellanox/mlxsw/core_linecards.c | 2 + .../net/ethernet/mellanox/mlxsw/spectrum_flower.c | 6 +- .../net/ethernet/microchip/lan966x/lan966x_ptp.c | 5 +- drivers/net/ethernet/microchip/sparx5/Kconfig | 2 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 5 +- drivers/net/ethernet/realtek/Kconfig | 2 +- drivers/net/ethernet/realtek/r8169_main.c | 6 +- drivers/net/ethernet/renesas/sh_eth.c | 4 + drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 4 +- drivers/net/ethernet/smsc/smsc911x.c | 14 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 9 +- drivers/net/ethernet/ti/netcp_core.c | 10 +- drivers/net/hamradio/6pack.c | 57 +- drivers/net/mdio/of_mdio.c | 1 - drivers/net/phy/dp83867.c | 6 + drivers/net/phy/fixed_phy.c | 1 + drivers/net/phy/marvell.c | 39 +- drivers/net/phy/mdio_bus.c | 5 +- drivers/net/usb/asix_devices.c | 12 +- drivers/net/usb/qmi_wwan.c | 6 + drivers/net/usb/usbnet.c | 2 + drivers/net/virtio_net.c | 26 +- drivers/net/wireless/ath/ath10k/mac.c | 12 +- drivers/net/wireless/ath/ath10k/wmi.c | 40 +- drivers/net/wireless/ath/ath11k/hw.c | 1 + drivers/net/wireless/ath/ath11k/mac.c | 5 + drivers/net/wireless/ath/ath11k/wmi.c | 30 +- drivers/net/wireless/ath/ath11k/wmi.h | 3 + .../broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +- .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 28 +- .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.h | 3 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 2 + drivers/ntb/hw/epf/ntb_hw_epf.c | 103 +- drivers/nvme/host/core.c | 8 +- drivers/nvme/host/fc.c | 12 +- drivers/nvme/host/multipath.c | 2 +- drivers/nvme/target/fc.c | 16 +- drivers/pci/controller/cadence/pcie-cadence-host.c | 2 +- drivers/pci/controller/cadence/pcie-cadence.c | 4 +- drivers/pci/controller/cadence/pcie-cadence.h | 6 +- drivers/pci/p2pdma.c | 2 +- drivers/pci/pci-driver.c | 2 +- drivers/pci/pci.c | 5 + drivers/pci/quirks.c | 3 +- drivers/phy/cadence/cdns-dphy.c | 4 +- drivers/phy/rockchip/phy-rockchip-inno-csidphy.c | 5 +- drivers/pinctrl/pinctrl-single.c | 4 +- drivers/platform/x86/intel/punit_ipc.c | 2 +- .../x86/intel/speed_select_if/isst_if_mmio.c | 4 +- drivers/power/supply/sbs-charger.c | 16 +- drivers/ptp/ptp_clock.c | 13 +- drivers/regulator/fixed.c | 1 + drivers/remoteproc/qcom_q6v5.c | 5 + drivers/rtc/rtc-pcf2127.c | 4 +- drivers/rtc/rtc-rx8025.c | 2 +- drivers/s390/net/ctcm_mpc.c | 1 - drivers/scsi/hosts.c | 5 +- drivers/scsi/libfc/fc_encode.h | 2 +- drivers/scsi/lpfc/lpfc_debugfs.h | 3 + drivers/scsi/lpfc/lpfc_els.c | 6 +- drivers/scsi/lpfc/lpfc_init.c | 7 - drivers/scsi/lpfc/lpfc_scsi.c | 14 +- drivers/scsi/mpi3mr/mpi3mr_fw.c | 10 + drivers/scsi/mpt3sas/mpt3sas_transport.c | 3 + drivers/scsi/pm8001/pm8001_ctl.c | 24 +- drivers/scsi/pm8001/pm8001_init.c | 1 + drivers/scsi/pm8001/pm8001_sas.c | 4 +- drivers/scsi/pm8001/pm8001_sas.h | 4 + drivers/scsi/sg.c | 10 +- drivers/slimbus/qcom-ngd-ctrl.c | 1 + drivers/soc/aspeed/aspeed-socinfo.c | 4 + drivers/soc/imx/gpc.c | 2 + drivers/soc/qcom/smem.c | 2 +- drivers/soc/samsung/pm_domains.c | 11 +- drivers/soc/tegra/fuse/fuse-tegra30.c | 122 + drivers/soc/ti/knav_dma.c | 14 +- drivers/soc/ti/pruss.c | 2 +- drivers/spi/spi-bcm63xx.c | 14 + drivers/spi/spi-loopback-test.c | 12 +- drivers/spi/spi-rpc-if.c | 2 + drivers/spi/spi.c | 10 + drivers/staging/Kconfig | 2 - drivers/staging/Makefile | 1 - drivers/staging/rtl8712/Kconfig | 21 - drivers/staging/rtl8712/Makefile | 35 - drivers/staging/rtl8712/TODO | 13 - drivers/staging/rtl8712/basic_types.h | 28 - drivers/staging/rtl8712/drv_types.h | 175 -- drivers/staging/rtl8712/ethernet.h | 21 - drivers/staging/rtl8712/hal_init.c | 401 ---- drivers/staging/rtl8712/ieee80211.c | 415 ---- drivers/staging/rtl8712/ieee80211.h | 165 -- drivers/staging/rtl8712/mlme_linux.c | 160 -- drivers/staging/rtl8712/mlme_osdep.h | 31 - drivers/staging/rtl8712/mp_custom_oid.h | 287 --- drivers/staging/rtl8712/os_intfs.c | 465 ---- drivers/staging/rtl8712/osdep_intf.h | 32 - drivers/staging/rtl8712/osdep_service.h | 60 - drivers/staging/rtl8712/recv_linux.c | 139 -- drivers/staging/rtl8712/recv_osdep.h | 39 - drivers/staging/rtl8712/rtl8712_bitdef.h | 26 - drivers/staging/rtl8712/rtl8712_cmd.c | 409 ---- drivers/staging/rtl8712/rtl8712_cmd.h | 231 -- drivers/staging/rtl8712/rtl8712_cmdctrl_bitdef.h | 95 - drivers/staging/rtl8712/rtl8712_cmdctrl_regdef.h | 19 - drivers/staging/rtl8712/rtl8712_debugctrl_bitdef.h | 41 - drivers/staging/rtl8712/rtl8712_debugctrl_regdef.h | 32 - .../staging/rtl8712/rtl8712_edcasetting_bitdef.h | 65 - .../staging/rtl8712/rtl8712_edcasetting_regdef.h | 24 - drivers/staging/rtl8712/rtl8712_efuse.c | 564 ----- drivers/staging/rtl8712/rtl8712_efuse.h | 43 - drivers/staging/rtl8712/rtl8712_event.h | 86 - drivers/staging/rtl8712/rtl8712_fifoctrl_bitdef.h | 131 -- drivers/staging/rtl8712/rtl8712_fifoctrl_regdef.h | 61 - drivers/staging/rtl8712/rtl8712_gp_bitdef.h | 68 - drivers/staging/rtl8712/rtl8712_gp_regdef.h | 29 - drivers/staging/rtl8712/rtl8712_hal.h | 142 -- drivers/staging/rtl8712/rtl8712_interrupt_bitdef.h | 44 - drivers/staging/rtl8712/rtl8712_io.c | 99 - drivers/staging/rtl8712/rtl8712_led.c | 1830 --------------- .../staging/rtl8712/rtl8712_macsetting_bitdef.h | 31 - .../staging/rtl8712/rtl8712_macsetting_regdef.h | 20 - drivers/staging/rtl8712/rtl8712_powersave_bitdef.h | 39 - drivers/staging/rtl8712/rtl8712_powersave_regdef.h | 26 - drivers/staging/rtl8712/rtl8712_ratectrl_bitdef.h | 36 - drivers/staging/rtl8712/rtl8712_ratectrl_regdef.h | 43 - drivers/staging/rtl8712/rtl8712_recv.c | 1079 --------- drivers/staging/rtl8712/rtl8712_recv.h | 145 -- drivers/staging/rtl8712/rtl8712_regdef.h | 32 - drivers/staging/rtl8712/rtl8712_security_bitdef.h | 34 - drivers/staging/rtl8712/rtl8712_spec.h | 121 - drivers/staging/rtl8712/rtl8712_syscfg_bitdef.h | 163 -- drivers/staging/rtl8712/rtl8712_syscfg_regdef.h | 42 - drivers/staging/rtl8712/rtl8712_timectrl_bitdef.h | 49 - drivers/staging/rtl8712/rtl8712_timectrl_regdef.h | 26 - drivers/staging/rtl8712/rtl8712_wmac_bitdef.h | 49 - drivers/staging/rtl8712/rtl8712_wmac_regdef.h | 36 - drivers/staging/rtl8712/rtl8712_xmit.c | 745 ------- drivers/staging/rtl8712/rtl8712_xmit.h | 108 - drivers/staging/rtl8712/rtl871x_cmd.c | 796 ------- drivers/staging/rtl8712/rtl871x_cmd.h | 761 ------- drivers/staging/rtl8712/rtl871x_debug.h | 130 -- drivers/staging/rtl8712/rtl871x_eeprom.c | 220 -- drivers/staging/rtl8712/rtl871x_eeprom.h | 88 - drivers/staging/rtl8712/rtl871x_event.h | 109 - drivers/staging/rtl8712/rtl871x_ht.h | 33 - drivers/staging/rtl8712/rtl871x_io.c | 147 -- drivers/staging/rtl8712/rtl871x_io.h | 236 -- drivers/staging/rtl8712/rtl871x_ioctl.h | 94 - drivers/staging/rtl8712/rtl871x_ioctl_linux.c | 2330 -------------------- drivers/staging/rtl8712/rtl871x_ioctl_rtl.c | 519 ----- drivers/staging/rtl8712/rtl871x_ioctl_rtl.h | 109 - drivers/staging/rtl8712/rtl871x_ioctl_set.c | 354 --- drivers/staging/rtl8712/rtl871x_ioctl_set.h | 45 - drivers/staging/rtl8712/rtl871x_led.h | 118 - drivers/staging/rtl8712/rtl871x_mlme.c | 1709 -------------- drivers/staging/rtl8712/rtl871x_mlme.h | 205 -- drivers/staging/rtl8712/rtl871x_mp.c | 724 ------ drivers/staging/rtl8712/rtl871x_mp.h | 275 --- drivers/staging/rtl8712/rtl871x_mp_ioctl.c | 883 -------- drivers/staging/rtl8712/rtl871x_mp_ioctl.h | 328 --- drivers/staging/rtl8712/rtl871x_mp_phy_regdef.h | 1034 --------- drivers/staging/rtl8712/rtl871x_pwrctrl.c | 234 -- drivers/staging/rtl8712/rtl871x_pwrctrl.h | 113 - drivers/staging/rtl8712/rtl871x_recv.c | 669 ------ drivers/staging/rtl8712/rtl871x_recv.h | 208 -- drivers/staging/rtl8712/rtl871x_rf.h | 55 - drivers/staging/rtl8712/rtl871x_security.c | 1386 ------------ drivers/staging/rtl8712/rtl871x_security.h | 218 -- drivers/staging/rtl8712/rtl871x_sta_mgt.c | 263 --- drivers/staging/rtl8712/rtl871x_wlan_sme.h | 35 - drivers/staging/rtl8712/rtl871x_xmit.c | 1059 --------- drivers/staging/rtl8712/rtl871x_xmit.h | 288 --- drivers/staging/rtl8712/sta_info.h | 132 -- drivers/staging/rtl8712/usb_halinit.c | 307 --- drivers/staging/rtl8712/usb_intf.c | 638 ------ drivers/staging/rtl8712/usb_ops.c | 195 -- drivers/staging/rtl8712/usb_ops.h | 38 - drivers/staging/rtl8712/usb_ops_linux.c | 515 ----- drivers/staging/rtl8712/usb_osintf.h | 35 - drivers/staging/rtl8712/wifi.h | 196 -- drivers/staging/rtl8712/wlan_bssdef.h | 223 -- drivers/staging/rtl8712/xmit_linux.c | 181 -- drivers/staging/rtl8712/xmit_osdep.h | 52 - drivers/target/loopback/tcm_loop.c | 3 + drivers/tee/tee_core.c | 2 +- drivers/thunderbolt/nhi.c | 2 + drivers/thunderbolt/nhi.h | 1 + drivers/thunderbolt/tb.c | 2 +- drivers/tty/serial/amba-pl011.c | 2 +- drivers/tty/serial/sc16is7xx.c | 185 +- drivers/ufs/core/ufshcd.c | 7 +- drivers/ufs/host/ufs-mediatek.c | 46 +- drivers/ufs/host/ufshcd-pci.c | 70 +- drivers/uio/uio_hv_generic.c | 21 +- drivers/usb/cdns3/cdns3-pci-wrap.c | 5 +- drivers/usb/cdns3/cdnsp-gadget.c | 8 +- drivers/usb/dwc3/core.c | 3 +- drivers/usb/dwc3/ep0.c | 1 + drivers/usb/dwc3/gadget.c | 7 + drivers/usb/gadget/function/f_eem.c | 7 +- drivers/usb/gadget/function/f_fs.c | 8 +- drivers/usb/gadget/function/f_hid.c | 4 +- drivers/usb/gadget/function/f_ncm.c | 3 +- drivers/usb/gadget/udc/core.c | 18 +- drivers/usb/gadget/udc/trace.h | 5 + drivers/usb/host/xhci-dbgcap.c | 261 ++- drivers/usb/host/xhci-dbgcap.h | 12 +- drivers/usb/host/xhci-dbgtty.c | 23 +- drivers/usb/host/xhci-plat.c | 1 + drivers/usb/mon/mon_bin.c | 14 +- drivers/usb/renesas_usbhs/common.c | 18 +- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 1 + drivers/usb/serial/option.c | 10 +- drivers/usb/storage/sddr55.c | 6 + drivers/usb/storage/transport.c | 16 + drivers/usb/storage/uas.c | 5 + drivers/usb/storage/unusual_devs.h | 2 +- drivers/usb/typec/ucsi/psy.c | 5 + drivers/vfio/iova_bitmap.c | 5 +- drivers/vfio/vfio_main.c | 2 +- drivers/video/backlight/lp855x_bl.c | 2 +- drivers/video/fbdev/aty/atyfb_base.c | 8 +- drivers/video/fbdev/core/bitblit.c | 33 +- drivers/video/fbdev/core/fbcon.c | 19 + drivers/video/fbdev/core/fbmem.c | 1 + drivers/video/fbdev/pvr2fb.c | 2 +- drivers/video/fbdev/valkyriefb.c | 2 + drivers/watchdog/s3c2410_wdt.c | 10 +- fs/9p/v9fs.c | 9 +- fs/btrfs/disk-io.c | 2 +- fs/btrfs/extent-tree.c | 6 +- fs/btrfs/file.c | 10 + fs/btrfs/scrub.c | 3 +- fs/btrfs/transaction.c | 2 +- fs/btrfs/tree-log.c | 3 +- fs/ceph/file.c | 2 - fs/ceph/locks.c | 5 +- fs/direct-io.c | 10 +- fs/eventpoll.c | 139 +- fs/exfat/fatent.c | 11 +- fs/exfat/super.c | 5 +- fs/ext4/fast_commit.c | 2 +- fs/ext4/file.c | 9 +- fs/ext4/xattr.c | 2 +- fs/f2fs/file.c | 1 - fs/hpfs/namei.c | 18 +- fs/iomap/direct-io.c | 12 +- fs/jfs/inode.c | 8 +- fs/jfs/jfs_txnmgr.c | 9 +- fs/libfs.c | 42 + fs/nfs/file.c | 1 - fs/nfs/nfs4client.c | 1 + fs/nfs/nfs4proc.c | 15 +- fs/nfs/nfs4state.c | 3 + fs/nfs/write.c | 3 +- fs/nfsd/nfs4proc.c | 7 +- fs/nfsd/nfs4state.c | 9 +- fs/nilfs2/the_nilfs.c | 3 - fs/ntfs3/inode.c | 1 + fs/open.c | 10 +- fs/orangefs/xattr.c | 12 +- fs/proc/generic.c | 12 +- fs/smb/client/cifsfs.c | 2 +- fs/smb/client/connect.c | 1 + fs/smb/client/smb2inode.c | 2 + fs/smb/client/smb2pdu.c | 7 +- fs/smb/client/transport.c | 10 +- fs/smb/server/smb2pdu.c | 6 +- fs/smb/server/transport_tcp.c | 12 +- include/acpi/pcc.h | 20 + include/linux/array_size.h | 13 + include/linux/ata.h | 1 + include/linux/blk_types.h | 11 +- include/linux/cacheinfo.h | 11 +- include/linux/compiler_types.h | 5 +- include/linux/fbcon.h | 2 + include/linux/filter.h | 22 +- include/linux/fs.h | 7 +- include/linux/host1x.h | 2 + include/linux/kernel.h | 7 +- include/linux/mailbox_client.h | 1 + include/linux/map_benchmark.h | 1 + include/linux/mlx5/driver.h | 2 + include/linux/mlx5/mlx5_ifc.h | 61 + include/linux/pagemap.h | 2 + include/linux/pci.h | 2 +- include/linux/shdma-base.h | 2 +- include/linux/string.h | 1 + include/linux/usb/gadget.h | 5 + include/net/bluetooth/hci.h | 12 + include/net/bluetooth/hci_core.h | 8 +- include/net/bluetooth/mgmt.h | 2 +- include/net/cls_cgroup.h | 2 +- include/net/nfc/nci_core.h | 2 +- include/net/pkt_sched.h | 25 +- include/net/tc_act/tc_connmark.h | 10 +- include/net/tls.h | 6 + include/net/xdp.h | 5 + include/net/xfrm.h | 3 +- include/trace/events/irq.h | 47 + include/uapi/asm-generic/bitsperlong.h | 13 +- include/ufs/ufshcd.h | 7 + include/ufs/ufshci.h | 4 +- kernel/bpf/ringbuf.c | 2 + kernel/events/callchain.c | 10 +- kernel/events/uprobes.c | 7 + kernel/futex/syscalls.c | 106 +- kernel/gcov/gcc_4_7.c | 4 +- kernel/softirq.c | 9 +- kernel/time/timer.c | 7 +- kernel/trace/ftrace.c | 2 + kernel/trace/trace_events_hist.c | 6 +- lib/crypto/Makefile | 2 +- lib/maple_tree.c | 30 +- mm/filemap.c | 173 +- mm/memory.c | 24 +- mm/mempool.c | 32 +- mm/page_alloc.c | 2 +- mm/percpu.c | 8 +- mm/secretmem.c | 2 +- mm/truncate.c | 27 +- net/8021q/vlan.c | 2 + net/bluetooth/6lowpan.c | 103 +- net/bluetooth/hci_event.c | 34 + net/bluetooth/hci_sync.c | 19 +- net/bluetooth/iso.c | 36 +- net/bluetooth/l2cap_core.c | 1 + net/bluetooth/mgmt.c | 7 +- net/bluetooth/sco.c | 7 + net/bluetooth/smp.c | 31 +- net/bridge/br.c | 5 + net/bridge/br_forward.c | 5 +- net/bridge/br_if.c | 1 + net/bridge/br_input.c | 4 +- net/bridge/br_mst.c | 10 +- net/bridge/br_private.h | 13 +- net/ceph/auth_x.c | 2 + net/ceph/ceph_common.c | 53 +- net/ceph/debugfs.c | 16 +- net/ceph/osdmap.c | 18 +- net/core/filter.c | 1 + net/core/netpoll.c | 7 +- net/core/page_pool.c | 12 +- net/core/sock.c | 15 +- net/dsa/tag_brcm.c | 10 +- net/ethernet/eth.c | 5 +- net/hsr/hsr_device.c | 3 + net/ipv4/esp4.c | 4 +- net/ipv4/esp4_offload.c | 6 +- net/ipv4/netfilter/nf_reject_ipv4.c | 25 + net/ipv4/nexthop.c | 6 + net/ipv4/route.c | 5 + net/ipv4/udp_tunnel_nic.c | 2 +- net/ipv6/addrconf.c | 4 +- net/ipv6/ah6.c | 50 +- net/ipv6/esp6.c | 4 +- net/ipv6/esp6_offload.c | 6 +- net/ipv6/netfilter/nf_reject_ipv6.c | 30 + net/ipv6/raw.c | 2 +- net/ipv6/udp.c | 2 +- net/mac80211/iface.c | 14 +- net/mac80211/mlme.c | 2 +- net/mac80211/rx.c | 10 +- net/mptcp/options.c | 54 +- net/mptcp/pm_netlink.c | 26 +- net/mptcp/protocol.c | 125 +- net/mptcp/protocol.h | 5 +- net/mptcp/subflow.c | 8 + net/netfilter/nf_tables_api.c | 15 + net/openvswitch/actions.c | 68 +- net/openvswitch/flow_netlink.c | 64 +- net/openvswitch/flow_netlink.h | 2 - net/rds/rds.h | 2 +- net/sched/act_bpf.c | 6 +- net/sched/act_connmark.c | 134 +- net/sched/act_ife.c | 12 +- net/sched/cls_bpf.c | 6 +- net/sched/sch_api.c | 10 - net/sched/sch_generic.c | 17 +- net/sched/sch_hfsc.c | 16 - net/sched/sch_qfq.c | 2 +- net/sctp/diag.c | 23 +- net/sctp/transport.c | 13 +- net/smc/smc_clc.c | 1 + net/strparser/strparser.c | 2 +- net/tipc/net.c | 2 + net/tls/tls_device.c | 4 +- net/unix/garbage.c | 14 +- net/vmw_vsock/af_vsock.c | 40 +- net/xfrm/espintcp.c | 4 +- scripts/kconfig/mconf.c | 3 + scripts/kconfig/nconf.c | 3 + sound/drivers/serial-generic.c | 12 +- sound/pci/hda/patch_realtek.c | 17 +- sound/soc/codecs/cs4271.c | 10 +- sound/soc/codecs/lpass-va-macro.c | 2 +- sound/soc/codecs/max98090.c | 6 +- sound/soc/fsl/fsl_sai.c | 3 +- sound/soc/intel/avs/pcm.c | 2 + sound/soc/meson/aiu-encoder-i2s.c | 9 +- sound/soc/qcom/qdsp6/q6asm.c | 2 +- sound/soc/qcom/sc8280xp.c | 3 + sound/usb/endpoint.c | 5 + sound/usb/mixer.c | 11 +- sound/usb/mixer_s1810c.c | 28 +- sound/usb/quirks.c | 3 + sound/usb/validate.c | 9 +- tools/bpf/bpftool/btf_dumper.c | 2 +- tools/bpf/bpftool/prog.c | 2 +- tools/include/linux/bitmap.h | 1 + tools/include/uapi/asm-generic/bitsperlong.h | 14 +- tools/include/uapi/asm/bitsperlong.h | 6 - tools/lib/bpf/bpf_tracing.h | 2 +- tools/lib/thermal/Makefile | 9 +- tools/power/cpupower/lib/cpuidle.c | 5 +- tools/power/cpupower/lib/cpupower.c | 2 +- .../x86_energy_perf_policy.c | 30 +- tools/testing/selftests/Makefile | 2 +- tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +- tools/testing/selftests/bpf/test_xsk.sh | 2 + .../selftests/drivers/net/netdevsim/Makefile | 21 + .../selftests/drivers/net/netdevsim/settings | 1 + tools/testing/selftests/net/bareudp.sh | 2 +- tools/testing/selftests/net/fcnal-test.sh | 432 ++-- .../selftests/net/forwarding/local_termination.sh | 2 + tools/testing/selftests/net/gro.c | 101 +- tools/testing/selftests/net/mptcp/mptcp_connect.c | 18 +- tools/testing/selftests/net/mptcp/mptcp_connect.sh | 2 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 65 +- tools/testing/selftests/net/psock_tpacket.c | 4 +- tools/testing/selftests/net/traceroute.sh | 13 +- tools/tracing/latency/latency-collector.c | 2 +- usr/include/headers_check.pl | 2 + 679 files changed, 5917 insertions(+), 30300 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/568 net/sched: sch_qfq: Fix null-deref in agg_dequeue
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
commit dd831ac8221e691e9e918585b1003c7071df0379 upstream.
To prevent a potential crash in agg_dequeue (net/sched/sch_qfq.c) when cl->qdisc->ops->peek(cl->qdisc) returns NULL, we check the return value before using it, similar to the existing approach in sch_hfsc.c.
To avoid code duplication, the following changes are made:
1. Changed qdisc_warn_nonwc(include/net/pkt_sched.h) into a static inline function.
2. Moved qdisc_peek_len from net/sched/sch_hfsc.c to include/net/pkt_sched.h so that sch_qfq can reuse it.
3. Applied qdisc_peek_len in agg_dequeue to avoid crashing.
--- include/net/pkt_sched.h | 25 ++++++++++++++++++++++++- net/sched/sch_api.c | 10 ---------- net/sched/sch_hfsc.c | 16 ---------------- net/sched/sch_qfq.c | 2 +- 4 files changed, 25 insertions(+), 28 deletions(-)
include/net/pkt_sched.h +24 -1
@@ -113,7 +113,6 @@ struct qdisc_rate_table *qdisc_get_rtab( struct netlink_ext_ack *extack);void qdisc_put_rtab (struct qdisc_rate_table *tab);void qdisc_put_stab (struct qdisc_size_table *tab); -void qdisc_warn_nonwc (const char *txt,struct Qdisc *qdisc);bool sch_direct_xmit (struct sk_buff *skb,struct Qdisc *q,struct net_device *dev,struct netdev_queue *txq,spinlock_t *root_lock,bool validate);
@@ -247,4 +246,28 @@ static inline bool tc_qdisc_stats_dump(s return true; } +static inline void qdisc_warn_nonwc (const char *txt,struct Qdisc *qdisc) +{ +if (!(qdisc->flags &TCQ_F_WARN_NONWC )) { +pr_warn ("%s: %s qdisc %X: is non-work-conserving?\n" , + txt, qdisc->ops->id, qdisc->handle >>16 ); + qdisc->flags |=TCQ_F_WARN_NONWC ; + } +} + +static inline unsigned int qdisc_peek_len (struct Qdisc *sch) +{ +struct sk_buff *skb; +unsigned int len; + + skb = sch->ops->peek (sch); +if (unlikely (skb ==NULL )) { +qdisc_warn_nonwc ("qdisc_peek_len" , sch); +return 0 ; + } + len =qdisc_pkt_len (skb); + +return len; +} +#endif
net/sched/sch_api.c +0 -10
@@ -598,16 +598,6 @@ out:qdisc_skb_cb (skb)->pkt_len = pkt_len; } -void qdisc_warn_nonwc (const char *txt,struct Qdisc *qdisc) -{ -if (!(qdisc->flags &TCQ_F_WARN_NONWC )) { -pr_warn ("%s: %s qdisc %X: is non-work-conserving?\n" , - txt, qdisc->ops->id, qdisc->handle >>16 ); - qdisc->flags |=TCQ_F_WARN_NONWC ; - } -} -EXPORT_SYMBOL (qdisc_warn_nonwc); -static enum hrtimer_restart qdisc_watchdog (struct hrtimer *timer) { struct qdisc_watchdog *wd = container_of(timer, struct qdisc_watchdog,
net/sched/sch_hfsc.c +0 -16
@@ -836,22 +836,6 @@ update_vf(struct hfsc_class *cl, unsigne } } -static unsigned int -qdisc_peek_len (struct Qdisc *sch) -{ -struct sk_buff *skb; -unsigned int len; - - skb = sch->ops->peek (sch); -if (unlikely (skb ==NULL )) { -qdisc_warn_nonwc ("qdisc_peek_len" , sch); -return 0 ; - } - len =qdisc_pkt_len (skb); - -return len; -} -static void hfsc_adjust_levels (struct hfsc_class *cl) {
net/sched/sch_qfq.c +1 -1
@@ -1001,7 +1001,7 @@ static struct sk_buff *agg_dequeue(strucif (cl->qdisc->q.qlen ==0 )/* no more packets, remove from list */ list_del_init (&cl->alist); -else if (cl->deficit <qdisc_pkt_len (cl->qdisc->ops->peek (cl->qdisc))) { +else if (cl->deficit <qdisc_peek_len (cl->qdisc)) { cl->deficit += agg->lmax;list_move_tail (&cl->alist, &agg->active); }
Greg Kroah-Hartman
maintainerPATCH 2/568 perf: Have get_perf_callchain() return NULL if crosstask and user are set
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit 153f9e74dec230f2e070e16fa061bc7adfd2c450 ]
get_perf_callchain() doesn't support cross-task unwinding for user space stacks, have it return NULL if both the crosstask and user arguments are set.
--- kernel/events/callchain.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
kernel/events/callchain.c +5 -5
@@ -184,6 +184,10 @@ get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user,struct perf_callchain_entry_ctx ctx;int rctx; +/* crosstask is not supported for user stacks */ +if (crosstask && user && !kernel) +return NULL ; + entry =get_callchain_entry (&rctx);if (!entry)return NULL ;
@@ -200,7 +204,7 @@ get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user,perf_callchain_kernel (&ctx, regs); } -if (user) { +if (user && !crosstask) {if (!user_mode (regs)) {if (current->mm) regs =task_pt_regs (current);
@@ -209,9 +213,6 @@ get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user, }if (regs) { -if (crosstask) - goto exit_put; -if (add_mark)perf_callchain_store_context (&ctx,PERF_CONTEXT_USER );
@@ -219,7 +220,6 @@ get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user, } } -exit_put:put_callchain_entry (rctx);return entry;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 3/568 x86/bugs: Fix reporting of LFENCE retpoline
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Kaplan <[email protected]>
[ Upstream commit d1cc1baef67ac6c09b74629ca053bf3fb812f7dc ]
The LFENCE retpoline mitigation is not secure but the kernel prints inconsistent messages about this fact. The dmesg log says 'Mitigation:
LFENCE', implying the system is mitigated. But sysfs reports 'Vulnerable:
LFENCE' implying the system (correctly) is not mitigated.
Fix this by printing a consistent 'Vulnerable: LFENCE' string everywhere when this mitigation is selected.
--- arch/x86/kernel/cpu/bugs.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
arch/x86/kernel/cpu/bugs.c +1 -4
@@ -1539,7 +1539,7 @@ spectre_v2_user_select_mitigation(void)static const char *const spectre_v2_strings[] = { [SPECTRE_V2_NONE ] ="Vulnerable" , [SPECTRE_V2_RETPOLINE ] ="Mitigation: Retpolines" , - [SPECTRE_V2_LFENCE ] ="Mitigation: LFENCE" , + [SPECTRE_V2_LFENCE ] ="Vulnerable: LFENCE" , [SPECTRE_V2_EIBRS ] ="Mitigation: Enhanced / Automatic IBRS" , [SPECTRE_V2_EIBRS_LFENCE ] ="Mitigation: Enhanced / Automatic IBRS + LFENCE" , [SPECTRE_V2_EIBRS_RETPOLINE ] ="Mitigation: Enhanced / Automatic IBRS + Retpolines" ,
@@ -3169,9 +3169,6 @@ static const char *spectre_bhi_state(void)static ssize_t spectre_v2_show_state (char *buf) { -if (spectre_v2_enabled ==SPECTRE_V2_LFENCE ) -return sysfs_emit (buf,"Vulnerable: LFENCE\n" ); -if (spectre_v2_enabled ==SPECTRE_V2_EIBRS &&unprivileged_ebpf_enabled ())return sysfs_emit (buf,"Vulnerable: eIBRS with unprivileged eBPF\n" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 4/568 EDAC/mc_sysfs: Increase legacy channel support to 16
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avadhut Naik <[email protected]>
[ Upstream commit 6e1c2c6c2c40ce99e0d2633b212f43c702c1a002 ]
Newer AMD systems can support up to 16 channels per EDAC "mc" device. These are detected by the EDAC module running on the device, and the current EDAC interface is appropriately enumerated.
The legacy EDAC sysfs interface however, provides device attributes for channels 0 through 11 only. Consequently, the last four channels, 12 through 15, will not be enumerated and will not be visible through the legacy sysfs interface.
Add additional device attributes to ensure that all 16 channels, if present, are enumerated by and visible through the legacy EDAC sysfs interface.
--- drivers/edac/edac_mc_sysfs.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
drivers/edac/edac_mc_sysfs.c +24 -0
@@ -306,6 +306,14 @@ DEVICE_CHANNEL(ch10_dimm_label, S_IRUGO | S_IWUSR, channel_dimm_label_show, channel_dimm_label_store, 10);DEVICE_CHANNEL (ch11_dimm_label,S_IRUGO |S_IWUSR , channel_dimm_label_show, channel_dimm_label_store,11 ); +DEVICE_CHANNEL (ch12_dimm_label,S_IRUGO |S_IWUSR , + channel_dimm_label_show, channel_dimm_label_store,12 ); +DEVICE_CHANNEL (ch13_dimm_label,S_IRUGO |S_IWUSR , + channel_dimm_label_show, channel_dimm_label_store,13 ); +DEVICE_CHANNEL (ch14_dimm_label,S_IRUGO |S_IWUSR , + channel_dimm_label_show, channel_dimm_label_store,14 ); +DEVICE_CHANNEL (ch15_dimm_label,S_IRUGO |S_IWUSR , + channel_dimm_label_show, channel_dimm_label_store,15 );/* Total possible dynamic DIMM Label attribute file table */ static struct attribute *dynamic_csrow_dimm_attr[] = {
@@ -321,6 +329,10 @@ static struct attribute *dynamic_csrow_dimm_attr[] = { &dev_attr_legacy_ch9_dimm_label.attr.attr, &dev_attr_legacy_ch10_dimm_label.attr.attr, &dev_attr_legacy_ch11_dimm_label.attr.attr, + &dev_attr_legacy_ch12_dimm_label.attr.attr, + &dev_attr_legacy_ch13_dimm_label.attr.attr, + &dev_attr_legacy_ch14_dimm_label.attr.attr, + &dev_attr_legacy_ch15_dimm_label.attr.attr, NULL };
@@ -349,6 +361,14 @@ DEVICE_CHANNEL(ch10_ce_count, S_IRUGO, channel_ce_count_show, NULL, 10);DEVICE_CHANNEL (ch11_ce_count,S_IRUGO , channel_ce_count_show,NULL ,11 ); +DEVICE_CHANNEL (ch12_ce_count,S_IRUGO , + channel_ce_count_show,NULL ,12 ); +DEVICE_CHANNEL (ch13_ce_count,S_IRUGO , + channel_ce_count_show,NULL ,13 ); +DEVICE_CHANNEL (ch14_ce_count,S_IRUGO , + channel_ce_count_show,NULL ,14 ); +DEVICE_CHANNEL (ch15_ce_count,S_IRUGO , + channel_ce_count_show,NULL ,15 );/* Total possible dynamic ce_count attribute file table */ static struct attribute *dynamic_csrow_ce_count_attr[] = {
@@ -364,6 +384,10 @@ static struct attribute *dynamic_csrow_ce_count_attr[] = { &dev_attr_legacy_ch9_ce_count.attr.attr, &dev_attr_legacy_ch10_ce_count.attr.attr, &dev_attr_legacy_ch11_ce_count.attr.attr, + &dev_attr_legacy_ch12_ce_count.attr.attr, + &dev_attr_legacy_ch13_ce_count.attr.attr, + &dev_attr_legacy_ch14_ce_count.attr.attr, + &dev_attr_legacy_ch15_ce_count.attr.attr, NULL };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 5/568 btrfs: zoned: refine extent allocator hint selection
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <[email protected]>
[ Upstream commit 0d703963d297964451783e1a0688ebdf74cd6151 ]
The hint block group selection in the extent allocator is wrong in the first place, as it can select the dedicated data relocation block group for the normal data allocation.
Since we separated the normal data space_info and the data relocation space_info, we can easily identify a block group is for data relocation or not. Do not choose it for the normal data allocation.
--- fs/btrfs/extent-tree.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/btrfs/extent-tree.c +4 -2
@@ -4224,7 +4224,8 @@ static int prepare_allocation_clustered(struct btrfs_fs_info *fs_info, }static int prepare_allocation_zoned (struct btrfs_fs_info *fs_info, -struct find_free_extent_ctl *ffe_ctl) +struct find_free_extent_ctl *ffe_ctl, +struct btrfs_space_info *space_info) {if (ffe_ctl->for_treelog) {spin_lock (&fs_info->treelog_bg_lock);
@@ -4248,6 +4249,7 @@ static int prepare_allocation_zoned(struct btrfs_fs_info *fs_info,u64 avail = block_group->zone_capacity - block_group->alloc_offset;if (block_group_bits (block_group, ffe_ctl->flags) && + block_group->space_info == space_info && avail >= ffe_ctl->num_bytes) { ffe_ctl->hint_byte = block_group->start;break ;
@@ -4269,7 +4271,7 @@ static int prepare_allocation(struct btrfs_fs_info *fs_info,return prepare_allocation_clustered (fs_info, ffe_ctl, space_info, ins);case BTRFS_EXTENT_ALLOC_ZONED : -return prepare_allocation_zoned (fs_info, ffe_ctl); +return prepare_allocation_zoned (fs_info, ffe_ctl, space_info);default :BUG (); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 6/568 btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
[ Upstream commit a7f3dfb8293c4cee99743132d69863a92e8f4875 ]
Replace max_t() followed by min_t() with a single clamp().
As was pointed by David Laight in
https://lore.kernel.org/linux-btrfs/20250906122458.75dfc8f0@pumpkin/
the calculation may overflow u32 when the input value is too large, so clamp_t() is not used. In practice the expected values are in range of megabytes to gigabytes (throughput limit) so the bug would not happen.
--- fs/btrfs/scrub.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/btrfs/scrub.c +1 -2
@@ -2191,8 +2191,7 @@ static void scrub_throttle(struct scrub_ctx *sctx)* Slice is divided into intervals when the IO is submitted, adjust by * bwlimit and maximum of 64 intervals. */ - div =max_t (u32,1 , (u32)(bwlimit / (16 *1024 *1024 ))); - div =min_t (u32,64 , div); + div =clamp (bwlimit / (16 *1024 *1024 ),1 ,64 );/* Start new epoch, set deadline */ now =ktime_get ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 7/568 btrfs: always drop log root tree reference in btrfs_replay_log()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 2f5b8095ea47b142c56c09755a8b1e14145a2d30 ]
Currently we have this odd behaviour:
1) At btrfs_replay_log() we drop the reference of the log root tree if the call to btrfs_recover_log_trees() failed;
2) But if the call to btrfs_recover_log_trees() did not fail, we don't drop the reference in btrfs_replay_log() - we expect that btrfs_recover_log_trees() does it in case it returns success.
Let's simplify this and make btrfs_replay_log() always drop the reference on the log root tree, not only this simplifies code as it's what makes sense since it's btrfs_replay_log() who grabbed the reference in the first place.
--- fs/btrfs/disk-io.c | 2 +- fs/btrfs/tree-log.c | 1 - 2 files changed, 1 insertion(+), 2 deletions(-)
fs/btrfs/disk-io.c +1 -1
@@ -2413,10 +2413,10 @@ static int btrfs_replay_log(struct btrfs_fs_info *fs_info,/* returns with log_tree_root freed on success */ ret =btrfs_recover_log_trees (log_tree_root); +btrfs_put_root (log_tree_root);if (ret) {btrfs_handle_fs_error (fs_info, ret,"Failed to recover log tree" ); -btrfs_put_root (log_tree_root);return ret; }
fs/btrfs/tree-log.c +0 -1
@@ -7366,7 +7366,6 @@ int btrfs_recover_log_trees(struct btrfs_root *log_root_tree) log_root_tree->log_root =NULL ;clear_bit (BTRFS_FS_LOG_RECOVERING , &fs_info->flags); -btrfs_put_root (log_root_tree);return 0 ; error:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 8/568 btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 45c222468d33202c07c41c113301a4b9c8451b8f ]
After setting the BTRFS_ROOT_FORCE_COW flag on the root we are doing a full write barrier, smp_wmb(), but we don't need to, all we need is a smp_mb__after_atomic(). The use of the smp_wmb() is from the old days when we didn't use a bit and used instead an int field in the root to signal if cow is forced. After the int field was changed to a bit in the root's state (flags field), we forgot to update the memory barrier in create_pending_snapshot() to smp_mb__after_atomic(), but we did the change in commit_fs_roots() after clearing BTRFS_ROOT_FORCE_COW. That happened in commit 27cdeb7096b8 ("Btrfs: use bitfield instead of integer data type for the some variants in btrfs_root"). On the reader side, in should_cow_block(), we also use the counterpart smp_mb__before_atomic() which generates further confusion.
So change the smp_wmb() to smp_mb__after_atomic(). In fact we don't even need any barrier at all since create_pending_snapshot() is called in the critical section of a transaction commit and therefore no one can concurrently join/attach the transaction, or start a new one, until the transaction is unblocked. By the time someone starts a new transaction and enters should_cow_block(), a lot of implicit memory barriers already took place by having acquired several locks such as fs_info->trans_lock and extent buffer locks on the root node at least. Nevertlheless, for consistency use smp_mb__after_atomic() after setting the force cow bit in create_pending_snapshot().
--- fs/btrfs/transaction.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/transaction.c +1 -1
@@ -1787,7 +1787,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans, }/* see comments in should_cow_block() */ set_bit (BTRFS_ROOT_FORCE_COW , &root->state); -smp_wmb (); +smp_mb__after_atomic ();btrfs_set_root_node (new_root_item, tmp);/* record when the snapshot was created in key.offset */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 9/568 arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Menglong Dong <[email protected]>
[ Upstream commit 35561bab768977c9e05f1f1a9bc00134c85f3e28 ]
The include/generated/asm-offsets.h is generated in Kbuild during compiling from arch/SRCARCH/kernel/asm-offsets.c. When we want to generate another similar offset header file, circular dependency can happen.
For example, we want to generate a offset file include/generated/test.h, which is included in include/sched/sched.h. If we generate asm-offsets.h first, it will fail, as include/sched/sched.h is included in asm-offsets.c and include/generated/test.h doesn't exist; If we generate test.h first, it can't success neither, as include/generated/asm-offsets.h is included by it.
In x86_64, the macro COMPILE_OFFSETS is used to avoid such circular dependency. We can generate asm-offsets.h first, and if the COMPILE_OFFSETS is defined, we don't include the "generated/test.h".
And we define the macro COMPILE_OFFSETS for all the asm-offsets.c for this purpose.
--- arch/alpha/kernel/asm-offsets.c | 1 + arch/arc/kernel/asm-offsets.c | 1 + arch/arm/kernel/asm-offsets.c | 2 ++ arch/arm64/kernel/asm-offsets.c | 1 + arch/csky/kernel/asm-offsets.c | 1 + arch/hexagon/kernel/asm-offsets.c | 1 + arch/loongarch/kernel/asm-offsets.c | 2 ++ arch/m68k/kernel/asm-offsets.c | 1 + arch/microblaze/kernel/asm-offsets.c | 1 + arch/mips/kernel/asm-offsets.c | 2 ++ arch/nios2/kernel/asm-offsets.c | 1 + arch/openrisc/kernel/asm-offsets.c | 1 + arch/parisc/kernel/asm-offsets.c | 1 + arch/powerpc/kernel/asm-offsets.c | 1 + arch/riscv/kernel/asm-offsets.c | 1 + arch/s390/kernel/asm-offsets.c | 1 + arch/sh/kernel/asm-offsets.c | 1 + arch/sparc/kernel/asm-offsets.c | 1 + arch/um/kernel/asm-offsets.c | 2 ++ arch/xtensa/kernel/asm-offsets.c | 1 + 20 files changed, 24 insertions(+)
arch/alpha/kernel/asm-offsets.c +1 -0
@@ -4,6 +4,7 @@* This code generates raw asm output which is post-processed to extract * and format the required data. */ +#define COMPILE_OFFSETS #include <linux/types.h> #include <linux/stddef.h>
arch/arc/kernel/asm-offsets.c +1 -0
@@ -2,6 +2,7 @@/* * Copyright (C) 2004, 2007-2010, 2011-2012 Synopsys, Inc. (www.synopsys.com) */ +#define COMPILE_OFFSETS #include <linux/sched.h> #include <linux/mm.h>
arch/arm/kernel/asm-offsets.c +2 -0
@@ -7,6 +7,8 @@* This code generates raw asm output which is post-processed to extract * and format the required data. */ +#define COMPILE_OFFSETS +#include <linux/compiler.h> #include <linux/sched.h> #include <linux/mm.h>
arch/arm64/kernel/asm-offsets.c +1 -0
@@ -6,6 +6,7 @@* 2001-2002 Keith Owens * Copyright (C) 2012 ARM Ltd. */ +#define COMPILE_OFFSETS #include <linux/arm_sdei.h> #include <linux/sched.h>
arch/csky/kernel/asm-offsets.c +1 -0
@@ -1,5 +1,6 @@// SPDX-License-Identifier: GPL-2.0 // Copyright (C) 2018 Hangzhou C-SKY Microsystems co.,ltd. +#define COMPILE_OFFSETS #include <linux/sched.h> #include <linux/kernel_stat.h>
arch/hexagon/kernel/asm-offsets.c +1 -0
@@ -8,6 +8,7 @@* * Copyright (c) 2010-2012, The Linux Foundation. All rights reserved. */ +#define COMPILE_OFFSETS #include <linux/compat.h> #include <linux/types.h>
arch/loongarch/kernel/asm-offsets.c +2 -0
@@ -4,6 +4,8 @@* * Copyright (C) 2020-2022 Loongson Technology Corporation Limited */ +#define COMPILE_OFFSETS +#include <linux/types.h> #include <linux/sched.h> #include <linux/mm.h>
arch/m68k/kernel/asm-offsets.c +1 -0
@@ -9,6 +9,7 @@* #defines from the assembly-language output. */ +#define COMPILE_OFFSETS #define ASM_OFFSETS_C #include <linux/stddef.h>
arch/microblaze/kernel/asm-offsets.c +1 -0
@@ -7,6 +7,7 @@* License. See the file "COPYING" in the main directory of this archive * for more details. */ +#define COMPILE_OFFSETS #include <linux/init.h> #include <linux/stddef.h>
arch/mips/kernel/asm-offsets.c +2 -0
@@ -9,6 +9,8 @@* Kevin Kissell, [email protected] and Carsten Langgaard, [email protected] * Copyright (C) 2000 MIPS Technologies, Inc. */ +#define COMPILE_OFFSETS +#include <linux/compat.h> #include <linux/types.h> #include <linux/sched.h>
arch/nios2/kernel/asm-offsets.c +1 -0
@@ -2,6 +2,7 @@/* * Copyright (C) 2011 Tobias Klauser <[email protected]> */ +#define COMPILE_OFFSETS #include <linux/stddef.h> #include <linux/sched.h>
arch/openrisc/kernel/asm-offsets.c +1 -0
@@ -18,6 +18,7 @@* compile this file to assembler, and then extract the * #defines from the assembly-language output. */ +#define COMPILE_OFFSETS #include <linux/signal.h> #include <linux/sched.h>
arch/parisc/kernel/asm-offsets.c +1 -0
@@ -13,6 +13,7 @@* Copyright (C) 2002 Randolph Chung <tausq with parisc-linux.org> * Copyright (C) 2003 James Bottomley <jejb at parisc-linux.org> */ +#define COMPILE_OFFSETS #include <linux/types.h> #include <linux/sched.h>
arch/powerpc/kernel/asm-offsets.c +1 -0
@@ -8,6 +8,7 @@* compile this file to assembler, and then extract the * #defines from the assembly-language output. */ +#define COMPILE_OFFSETS #include <linux/compat.h> #include <linux/signal.h>
arch/riscv/kernel/asm-offsets.c +1 -0
@@ -3,6 +3,7 @@* Copyright (C) 2012 Regents of the University of California * Copyright (C) 2017 SiFive */ +#define COMPILE_OFFSETS #include <linux/kbuild.h> #include <linux/mm.h>
arch/s390/kernel/asm-offsets.c +1 -0
@@ -4,6 +4,7 @@* This code generates raw asm output which is post-processed to extract * and format the required data. */ +#define COMPILE_OFFSETS #define ASM_OFFSETS_C
arch/sh/kernel/asm-offsets.c +1 -0
@@ -8,6 +8,7 @@* compile this file to assembler, and then extract the * #defines from the assembly-language output. */ +#define COMPILE_OFFSETS #include <linux/stddef.h> #include <linux/types.h>
arch/sparc/kernel/asm-offsets.c +1 -0
@@ -10,6 +10,7 @@* * On sparc, thread_info data is static and TI_XXX offsets are computed by hand. */ +#define COMPILE_OFFSETS #include <linux/sched.h> #include <linux/mm_types.h>
arch/um/kernel/asm-offsets.c +2 -0
@@ -1 +1,3 @@ +#define COMPILE_OFFSETS +#include <sysdep/kernel-offsets.h>
arch/xtensa/kernel/asm-offsets.c +1 -0
@@ -11,6 +11,7 @@* * Chris Zankel <[email protected]> */ +#define COMPILE_OFFSETS #include <asm/processor.h> #include <asm/coprocessor.h>
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 10/568 mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <[email protected]>
[ Upstream commit e84cb860ac3ce67ec6ecc364433fd5b412c448bc ]
The special C-flag case expects the ADD_ADDR to be received when switching to 'fully-established'. But for various reasons, the ADD_ADDR could be sent after the "4th ACK", and the special case doesn't work.
On NIPA, the new test validating this special case for the C-flag failed a few times, e.g.
102 default limits, server deny join id 0
syn rx [FAIL] got 0 JOIN[s] syn rx expected 2
Server ns stats
(...)
MPTcpExtAddAddrTx 1
MPTcpExtEchoAdd 1
Client ns stats
(...)
MPTcpExtAddAddr 1
MPTcpExtEchoAddTx 1
synack rx [FAIL] got 0 JOIN[s] synack rx expected 2
ack rx [FAIL] got 0 JOIN[s] ack rx expected 2
join Rx [FAIL] see above
syn tx [FAIL] got 0 JOIN[s] syn tx expected 2
join Tx [FAIL] see aboveI had a suspicion about what the issue could be: the ADD_ADDR might have been received after the switch to the 'fully-established' state. The issue was not easy to reproduce. The packet capture shown that the ADD_ADDR can indeed be sent with a delay, and the client would not try to establish subflows to it as expected.
A simple fix is not to mark the endpoints as 'used' in the C-flag case, when looking at creating subflows to the remote initial IP address and port. In this case, there is no need to try.
Note: newly added fullmesh endpoints will still continue to be used as expected, thanks to the conditions behind mptcp_pm_add_addr_c_flag_case.
--- net/mptcp/pm_netlink.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/mptcp/pm_netlink.c +6 -0
@@ -623,6 +623,10 @@ static void mptcp_pm_create_subflow_or_s } subflow: +/* No need to try establishing subflows to remote id0 if not allowed */ +if (mptcp_pm_add_addr_c_flag_case (msk)) + goto exit; +/* check if should create a new subflow */ while (msk->pm.local_addr_used < local_addr_max && msk->pm.subflows < subflows_max) {
@@ -654,6 +658,8 @@ subflow:__mptcp_subflow_connect (sk, &local.addr, &addrs[i]);spin_lock_bh (&msk->pm.lock); } + +exit:mptcp_pm_nl_check_work_pending (msk); }
Greg Kroah-Hartman
maintainerPATCH 11/568 dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
[ Upstream commit 268eb6fb908bc82ce479e4dba9a2cad11f536c9c ]
Only i.MX8MP need dma-range property to let USB controller work properly. Remove dma-range from required list and add limitation for imx8mp.
--- Documentation/devicetree/bindings/usb/fsl,imx8mp-dwc3.yaml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
Documentation/devicetree/bindings/usb/fsl,imx8mp-dwc3.yaml +9 -1
@@ -82,12 +82,20 @@ required: - reg - "#address-cells" - "#size-cells" - - dma-ranges - ranges - clocks - clock-names - interrupts +allOf: + - if: + properties: + compatible: + const: fsl,imx8mp-dwc3 + then: + required: + - dma-ranges + additionalProperties: false examples:
Greg Kroah-Hartman
maintainerPATCH 12/568 selftests: mptcp: disable add_addr retrans in endpoint_tests
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
[ Upstream commit f92199f551e617fae028c5c5905ddd63e3616e18 ]
To prevent test instability in the "delete re-add signal" test caused by ADD_ADDR retransmissions, disable retransmissions for this test by setting net.mptcp.add_addr_timeout to 0.
Stable-dep-of: c3496c052ac3 ("selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported")
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/net/mptcp/mptcp_join.sh +1 -0
@@ -3394,6 +3394,7 @@ endpoint_tests() # remove and re-add if reset_with_events "delete re-add signal" && mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then + ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=0 pm_nl_set_limits $ns1 0 3 pm_nl_set_limits $ns2 3 3 pm_nl_add_endpoint $ns1 10.0.2.1 id 1 flags signal
Greg Kroah-Hartman
maintainerPATCH 13/568 selftests: mptcp: join: mark delete re-add signal as skipped if not supported
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <[email protected]>
[ Upstream commit c3496c052ac36ea98ec4f8e95ae6285a425a2457 ]
The call to 'continue_if' was missing: it properly marks a subtest as 'skipped' if the attached condition is not valid.
Without that, the test is wrongly marked as passed on older kernels.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +1 -1
@@ -3393,7 +3393,7 @@ endpoint_tests() # remove and re-add if reset_with_events "delete re-add signal" && - mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then + continue_if mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=0 pm_nl_set_limits $ns1 0 3 pm_nl_set_limits $ns2 3 3
Greg Kroah-Hartman
maintainerPATCH 14/568 xhci: dbc: Provide sysfs option to configure dbc descriptors
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
[ Upstream commit edf1664f3249a091a2b91182fc087b3253b0b4c2 ]
When DbC is enabled the first port on the xHC host acts as a usb device. xHC provides the descriptors automatically when the DbC device is enumerated. Most of the values are hardcoded, but some fields such as idProduct, idVendor, bcdDevice and bInterfaceProtocol can be modified.
Add sysfs entries that allow userspace to change these.
User can only change them before dbc is enabled, i.e. before writing "enable" to dbc sysfs file as we don't want these values to change while device is connected, or during enumeration.
Add documentation for these entries in Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd
Stable-dep-of: f3d12ec847b9 ("xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event")
--- Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd | 52 ++++ drivers/usb/host/xhci-dbgcap.c | 191 ++++++++++++++- drivers/usb/host/xhci-dbgcap.h | 4 3 files changed, 243 insertions(+), 4 deletions(-)
Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd +52 -0
@@ -23,3 +23,55 @@ Description: Reading this attribute gives the state of the DbC. It can be one of the following states: disabled, enabled, initialized, connected, configured and stalled. + +What: /sys/bus/pci/drivers/xhci_hcd/.../dbc_idVendor +Date: March 2023 +Contact: Mathias Nyman <[email protected]> +Description: + This dbc_idVendor attribute lets us change the idVendor field + presented in the USB device descriptor by this xhci debug + device. + Value can only be changed while debug capability (DbC) is in + disabled state to prevent USB device descriptor change while + connected to a USB host. + The default value is 0x1d6b (Linux Foundation). + It can be any 16-bit integer. + +What: /sys/bus/pci/drivers/xhci_hcd/.../dbc_idProduct +Date: March 2023 +Contact: Mathias Nyman <[email protected]> +Description: + This dbc_idProduct attribute lets us change the idProduct field + presented in the USB device descriptor by this xhci debug + device. + Value can only be changed while debug capability (DbC) is in + disabled state to prevent USB device descriptor change while + connected to a USB host. + The default value is 0x0010. It can be any 16-bit integer. + +What: /sys/bus/pci/drivers/xhci_hcd/.../dbc_bcdDevice +Date: March 2023 +Contact: Mathias Nyman <[email protected]> +Description: + This dbc_bcdDevice attribute lets us change the bcdDevice field + presented in the USB device descriptor by this xhci debug + device. + Value can only be changed while debug capability (DbC) is in + disabled state to prevent USB device descriptor change while + connected to a USB host. + The default value is 0x0010. (device rev 0.10) + It can be any 16-bit integer. + +What: /sys/bus/pci/drivers/xhci_hcd/.../dbc_bInterfaceProtocol +Date: March 2023 +Contact: Mathias Nyman <[email protected]> +Description: + This attribute lets us change the bInterfaceProtocol field + presented in the USB Interface descriptor by the xhci debug + device. + Value can only be changed while debug capability (DbC) is in + disabled state to prevent USB descriptor change while + connected to a USB host. + The default value is 1 (GNU Remote Debug command). + Other permissible value is 0 which is for vendor defined debug + target.
drivers/usb/host/xhci-dbgcap.c +187 -4
224 lines not on this page · raw message
drivers/usb/host/xhci-dbgcap.h +4 -0
@@ -132,6 +132,10 @@ struct xhci_dbc {struct dbc_str_descs *string;dma_addr_t string_dma;size_t string_size; +u16 idVendor; +u16 idProduct; +u16 bcdDevice; +u8 bInterfaceProtocol;enum dbc_state state;struct delayed_work event_work;
Greg Kroah-Hartman
maintainerPATCH 15/568 xhci: dbc: poll at different rate depending on data transfer activity
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
[ Upstream commit fb18e5bb96603cc79d97f03e4c05f3992cf28624 ]
DbC driver starts polling for events immediately when DbC is enabled. The current polling interval is 1ms, which keeps the CPU busy, impacting power management even when there are no active data transfers.
Solve this by polling at a slower rate, with a 64ms interval as default until a transfer request is queued, or if there are still are pending unhandled transfers at event completion.
Stable-dep-of: f3d12ec847b9 ("xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event")
--- drivers/usb/host/xhci-dbgcap.c | 13 +++++++++++-- drivers/usb/host/xhci-dbgcap.h | 2 ++ 2 files changed, 13 insertions(+), 2 deletions(-)
drivers/usb/host/xhci-dbgcap.c +11 -2
@@ -665,7 +665,8 @@ static int xhci_dbc_start(struct xhci_dbreturn ret; } -return mod_delayed_work (system_wq, &dbc->event_work,1 ); +return mod_delayed_work (system_wq, &dbc->event_work, +msecs_to_jiffies (dbc->poll_interval)); }static void xhci_dbc_stop (struct xhci_dbc *dbc)
@@ -964,8 +965,10 @@ static void xhci_dbc_handle_events(strucenum evtreturn evtr;struct xhci_dbc *dbc;unsigned long flags; +unsigned int poll_interval; dbc = container_of(to_delayed_work(work), struct xhci_dbc, event_work); + poll_interval = dbc->poll_interval;spin_lock_irqsave (&dbc->lock, flags); evtr =xhci_dbc_do_handle_events (dbc);
@@ -981,13 +984,18 @@ static void xhci_dbc_handle_events(struc dbc->driver->disconnect (dbc);break ;case EVT_DONE : +/* set fast poll rate if there are pending data transfers */ +if (!list_empty (&dbc->eps[BULK_OUT ].list_pending) || + !list_empty (&dbc->eps[BULK_IN ].list_pending)) + poll_interval =1 ;break ;default :dev_info (dbc->dev,"stop handling dbc events\n" );return ; } -mod_delayed_work (system_wq, &dbc->event_work,1 ); +mod_delayed_work (system_wq, &dbc->event_work, +msecs_to_jiffies (poll_interval)); } static ssize_t dbc_show(struct device *dev,
@@ -1242,6 +1250,7 @@ xhci_alloc_dbc(struct device *dev, void dbc->idVendor =DBC_VENDOR_ID ; dbc->bcdDevice =DBC_DEVICE_REV ; dbc->bInterfaceProtocol =DBC_PROTOCOL ; + dbc->poll_interval =DBC_POLL_INTERVAL_DEFAULT ;if (readl (&dbc->regs->control) &DBC_CTRL_DBC_ENABLE ) goto err;
drivers/usb/host/xhci-dbgcap.h +2 -0
@@ -93,6 +93,7 @@ struct dbc_ep {#define DBC_QUEUE_SIZE 16#define DBC_WRITE_BUF_SIZE 8192 +#define DBC_POLL_INTERVAL_DEFAULT 64/* milliseconds */ /* * Private structure for DbC hardware state:
@@ -139,6 +140,7 @@ struct xhci_dbc {enum dbc_state state;struct delayed_work event_work; +unsigned int poll_interval;/* ms */ unsigned resume_required:1;struct dbc_ep eps[2 ];
Greg Kroah-Hartman
maintainerPATCH 16/568 xhci: dbc: Allow users to modify DbC poll interval via sysfs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uday M Bhat <[email protected]>
[ Upstream commit de3edd47a18fe05a560847cc3165871474e08196 ]
xhci DbC driver polls the host controller for DbC events at a reduced rate when DbC is enabled but there are no active data transfers.
Allow users to modify this reduced poll interval via dbc_poll_interval_ms sysfs entry. Unit is milliseconds and accepted range is 0 to 5000. Max interval of 5000 ms is selected as it matches the common 5 second timeout used in usb stack.
Default value is 64 milliseconds.
A long interval is useful when users know there won't be any activity on systems connected via DbC for long periods, and want to avoid battery drainage due to unnecessary CPU usage.
Example being Android Debugger (ADB) usage over DbC on ChromeOS systems running Android Runtime.
[minor changes and rewording -Mathias]
Stable-dep-of: f3d12ec847b9 ("xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event")
--- Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd | 10 +++ drivers/usb/host/xhci-dbgcap.c | 38 +++++++++++++++ drivers/usb/host/xhci-dbgcap.h | 2 3 files changed, 49 insertions(+), 1 deletion(-)
Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd +10 -0
@@ -75,3 +75,13 @@ Description: The default value is 1 (GNU Remote Debug command). Other permissible value is 0 which is for vendor defined debug target. + +What: /sys/bus/pci/drivers/xhci_hcd/.../dbc_poll_interval_ms +Date: February 2024 +Contact: Mathias Nyman <[email protected]> +Description: + This attribute adjust the polling interval used to check for + DbC events. Unit is milliseconds. Accepted values range from 0 + up to 5000. The default value is 64 ms. + This polling interval is used while DbC is enabled but has no + active data transfers.
drivers/usb/host/xhci-dbgcap.c +38 -0
@@ -1214,11 +1214,48 @@ static ssize_t dbc_bInterfaceProtocol_streturn size; } +static ssize_t dbc_poll_interval_ms_show (struct device *dev, +struct device_attribute *attr, +char *buf) +{ +struct xhci_dbc *dbc; +struct xhci_hcd *xhci; + + xhci =hcd_to_xhci (dev_get_drvdata (dev)); + dbc = xhci->dbc; + +return sysfs_emit (buf,"%u\n" , dbc->poll_interval); +} + +static ssize_t dbc_poll_interval_ms_store (struct device *dev, +struct device_attribute *attr, +const char *buf,size_t size) +{ +struct xhci_dbc *dbc; +struct xhci_hcd *xhci; +u32 value; +int ret; + + ret =kstrtou32 (buf,0 , &value); +if (ret || value >DBC_POLL_INTERVAL_MAX ) +return -EINVAL ; + + xhci =hcd_to_xhci (dev_get_drvdata (dev)); + dbc = xhci->dbc; + + dbc->poll_interval = value; + +mod_delayed_work (system_wq, &dbc->event_work,0 ); + +return size; +} +static DEVICE_ATTR_RW (dbc);static DEVICE_ATTR_RW (dbc_idVendor);static DEVICE_ATTR_RW (dbc_idProduct);static DEVICE_ATTR_RW (dbc_bcdDevice);static DEVICE_ATTR_RW (dbc_bInterfaceProtocol); +static DEVICE_ATTR_RW (dbc_poll_interval_ms);static struct attribute *dbc_dev_attributes[] = { &dev_attr_dbc.attr,
@@ -1226,6 +1263,7 @@ static struct attribute *dbc_dev_attribu &dev_attr_dbc_idProduct.attr, &dev_attr_dbc_bcdDevice.attr, &dev_attr_dbc_bInterfaceProtocol.attr, + &dev_attr_dbc_poll_interval_ms.attr, NULL };
drivers/usb/host/xhci-dbgcap.h +1 -1
@@ -94,7 +94,7 @@ struct dbc_ep {#define DBC_QUEUE_SIZE 16#define DBC_WRITE_BUF_SIZE 8192#define DBC_POLL_INTERVAL_DEFAULT 64/* milliseconds */ - +#define DBC_POLL_INTERVAL_MAX 5000/* milliseconds */ /* * Private structure for DbC hardware state: */
Greg Kroah-Hartman
maintainerPATCH 17/568 xhci: dbc: Improve performance by removing delay in transfer event polling.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
[ Upstream commit 03e3d9c2bd85cda941b3cf78e895c1498ac05c5f ]
Queue event polling work with 0 delay in case there are pending transfers queued up. This is part 2 of a 3 part series that roughly triples dbc performace when using adb push and pull over dbc.
Max/min push rate after patches is 210/118 MB/s, pull rate 171/133 MB/s, tested with large files (300MB-9GB) by Łukasz Bartosik
First performance improvement patch was commit 31128e7492dc ("xhci: dbc: add dbgtty request to end of list once it completes")
Stable-dep-of: f3d12ec847b9 ("xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event")
--- drivers/usb/host/xhci-dbgcap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-dbgcap.c +1 -1
@@ -987,7 +987,7 @@ static void xhci_dbc_handle_events(struc/* set fast poll rate if there are pending data transfers */ if (!list_empty (&dbc->eps[BULK_OUT ].list_pending) || !list_empty (&dbc->eps[BULK_IN ].list_pending)) - poll_interval =1 ; + poll_interval =0 ;break ;default :dev_info (dbc->dev,"stop handling dbc events\n" );
Greg Kroah-Hartman
maintainerPATCH 18/568 xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
[ Upstream commit cab63934c33b12c0d1e9f4da7450928057f2c142 ]
Event polling delay is set to 0 if there are any pending requests in either rx or tx requests lists. Checking for pending requests does not work well for "IN" transfers as the tty driver always queues requests to the list and TRBs to the ring, preparing to receive data from the host.
This causes unnecessary busylooping and cpu hogging.
Only set the event polling delay to 0 if there are pending tx "write" transfers, or if it was less than 10ms since last active data transfer in any direction.
Stable-dep-of: f3d12ec847b9 ("xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event")
--- drivers/usb/host/xhci-dbgcap.c | 19 ++++++++++++++++--- drivers/usb/host/xhci-dbgcap.h | 3 +++ 2 files changed, 19 insertions(+), 3 deletions(-)
drivers/usb/host/xhci-dbgcap.c +16 -3
@@ -855,6 +855,7 @@ static enum evtreturn xhci_dbc_do_handle {dma_addr_t deq;union xhci_trb *evt; +enum evtreturn ret =EVT_DONE ;u32 ctrl, portsc;bool update_erdp = false;
@@ -939,6 +940,7 @@ static enum evtreturn xhci_dbc_do_handlebreak ;case TRB_TYPE (TRB_TRANSFER ):dbc_handle_xfer_event (dbc, evt); + ret =EVT_XFER_DONE ;break ;default :break ;
@@ -957,7 +959,7 @@ static enum evtreturn xhci_dbc_do_handlelo_hi_writeq (deq, &dbc->regs->erdp); } -return EVT_DONE ; +return ret; }static void xhci_dbc_handle_events (struct work_struct *work)
@@ -966,6 +968,7 @@ static void xhci_dbc_handle_events(strucstruct xhci_dbc *dbc;unsigned long flags;unsigned int poll_interval; +unsigned long busypoll_timelimit; dbc = container_of(to_delayed_work(work), struct xhci_dbc, event_work); poll_interval = dbc->poll_interval;
@@ -984,11 +987,21 @@ static void xhci_dbc_handle_events(struc dbc->driver->disconnect (dbc);break ;case EVT_DONE : -/* set fast poll rate if there are pending data transfers */ +/* +* Set fast poll rate if there are pending out transfers, or +* a transfer was recently processed +*/ + busypoll_timelimit = dbc->xfer_timestamp + +msecs_to_jiffies (DBC_XFER_INACTIVITY_TIMEOUT ); +if (!list_empty (&dbc->eps[BULK_OUT ].list_pending) || - !list_empty (&dbc->eps[BULK_IN ].list_pending)) +time_is_after_jiffies (busypoll_timelimit)) poll_interval =0 ;break ; +case EVT_XFER_DONE : + dbc->xfer_timestamp = jiffies; + poll_interval =0 ; +break ;default :dev_info (dbc->dev,"stop handling dbc events\n" );return ;
drivers/usb/host/xhci-dbgcap.h +3 -0
@@ -95,6 +95,7 @@ struct dbc_ep {#define DBC_WRITE_BUF_SIZE 8192#define DBC_POLL_INTERVAL_DEFAULT 64/* milliseconds */ #define DBC_POLL_INTERVAL_MAX 5000/* milliseconds */ +#define DBC_XFER_INACTIVITY_TIMEOUT 10/* milliseconds */ /* * Private structure for DbC hardware state: */
@@ -141,6 +142,7 @@ struct xhci_dbc {enum dbc_state state;struct delayed_work event_work;unsigned int poll_interval;/* ms */ +unsigned long xfer_timestamp; unsigned resume_required:1;struct dbc_ep eps[2 ];
@@ -186,6 +188,7 @@ struct dbc_request {enum evtreturn {EVT_ERR =-1 ,EVT_DONE , +EVT_XFER_DONE ,EVT_GSER ,EVT_DISC , };
Greg Kroah-Hartman
maintainerPATCH 19/568 xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
[ Upstream commit f3d12ec847b945d5d65846c85f062d07d5e73164 ]
DbC may add 1024 bogus bytes to the beginneing of the receiving endpoint if DbC hw triggers a STALL event before any Transfer Blocks (TRBs) for incoming data are queued, but driver handles the event after it queued the TRBs.
This is possible as xHCI DbC hardware may trigger spurious STALL transfer events even if endpoint is empty. The STALL event contains a pointer to the stalled TRB, and "remaining" untransferred data length.
As there are no TRBs queued yet the STALL event will just point to first TRB position of the empty ring, with '0' bytes remaining untransferred.
DbC driver is polling for events, and may not handle the STALL event before /dev/ttyDBC0 is opened and incoming data TRBs are queued.
The DbC event handler will now assume the first queued TRB (length 1024) has stalled with '0' bytes remaining untransferred, and copies the data
This race situation can be practically mitigated by making sure the event handler handles all pending transfer events when DbC reaches configured state, and only then create dev/ttyDbC0, and start queueing transfers. The event handler can this way detect the STALL events on empty rings and discard them before any transfers are queued.
This does in practice solve the issue, but still leaves a small possible gap for the race to trigger.
We still need a way to distinguish spurious STALLs on empty rings with '0' bytes remaing, from actual STALL events with all bytes transmitted.
--- drivers/usb/host/xhci-dbgcap.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/usb/host/xhci-dbgcap.c +4 -2
@@ -880,7 +880,8 @@ static enum evtreturn xhci_dbc_do_handledev_info (dbc->dev,"DbC configured\n" ); portsc =readl (&dbc->regs->portsc);writel (portsc, &dbc->regs->portsc); -return EVT_GSER ; + ret =EVT_GSER ; +break ; }return EVT_DONE ;
@@ -940,7 +941,8 @@ static enum evtreturn xhci_dbc_do_handlebreak ;case TRB_TYPE (TRB_TRANSFER ):dbc_handle_xfer_event (dbc, evt); - ret =EVT_XFER_DONE ; +if (ret !=EVT_GSER ) + ret =EVT_XFER_DONE ;break ;default :break ;
Greg Kroah-Hartman
maintainerPATCH 20/568 serial: sc16is7xx: remove unused to_sc16is7xx_port macro
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <[email protected]>
[ Upstream commit 22a048b0749346b6e3291892d06b95278d5ba84a ]
This macro is not used anywhere.
Stable-dep-of: 1c05bf6c0262 ("serial: sc16is7xx: remove useless enable of enhanced features")
--- drivers/tty/serial/sc16is7xx.c | 1 - 1 file changed, 1 deletion(-)
drivers/tty/serial/sc16is7xx.c +0 -1
@@ -358,7 +358,6 @@ static struct uart_driver sc16is7xx_uartstatic void sc16is7xx_ier_set (struct uart_port *port,u8 bit);static void sc16is7xx_stop_tx (struct uart_port *port); -#define to_sc16is7xx_port (p,e) ((container_of((p), struct sc16is7xx_port, e)))#define to_sc16is7xx_one (p,e) ((container_of((p), struct sc16is7xx_one, e)))static u8 sc16is7xx_port_read (struct uart_port *port,u8 reg)
Greg Kroah-Hartman
maintainerPATCH 21/568 serial: sc16is7xx: reorder code to remove prototype declarations
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <[email protected]>
[ Upstream commit 2de8a1b46756b5a79d8447f99afdfe49e914225a ]
Move/reorder some functions to remove sc16is7xx_ier_set() and sc16is7xx_stop_tx() prototypes declarations.
No functional change.
sc16is7xx_ier_set() was introduced in
commit cc4c1d05eb10 ("sc16is7xx: Properly resume TX after stop").
Stable-dep-of: 1c05bf6c0262 ("serial: sc16is7xx: remove useless enable of enhanced features")
--- drivers/tty/serial/sc16is7xx.c | 75 +++++++++++++++++++---------------------- 1 file changed, 36 insertions(+), 39 deletions(-)
drivers/tty/serial/sc16is7xx.c +36 -39
@@ -355,9 +355,6 @@ static struct uart_driver sc16is7xx_uart .nr = SC16IS7XX_MAX_DEVS, }; -static void sc16is7xx_ier_set (struct uart_port *port,u8 bit); -static void sc16is7xx_stop_tx (struct uart_port *port); -#define to_sc16is7xx_one (p,e) ((container_of((p), struct sc16is7xx_one, e)))static u8 sc16is7xx_port_read (struct uart_port *port,u8 reg)
@@ -415,6 +412,42 @@ static void sc16is7xx_power(struct uart_ on ? 0 : SC16IS7XX_IER_SLEEP_BIT); } +static void sc16is7xx_ier_clear (struct uart_port *port,u8 bit) +{ +struct sc16is7xx_port *s =dev_get_drvdata (port->dev); +struct sc16is7xx_one *one =to_sc16is7xx_one (port, port); + +lockdep_assert_held_once (&port->lock); + + one->config.flags |=SC16IS7XX_RECONF_IER ; + one->config.ier_mask |= bit; + one->config.ier_val &= ~bit; +kthread_queue_work (&s->kworker, &one->reg_work); +} + +static void sc16is7xx_ier_set (struct uart_port *port,u8 bit) +{ +struct sc16is7xx_port *s =dev_get_drvdata (port->dev); +struct sc16is7xx_one *one =to_sc16is7xx_one (port, port); + +lockdep_assert_held_once (&port->lock); + + one->config.flags |=SC16IS7XX_RECONF_IER ; + one->config.ier_mask |= bit; + one->config.ier_val |= bit; +kthread_queue_work (&s->kworker, &one->reg_work); +} + +static void sc16is7xx_stop_tx (struct uart_port *port) +{ +sc16is7xx_ier_clear (port,SC16IS7XX_IER_THRI_BIT ); +} + +static void sc16is7xx_stop_rx (struct uart_port *port) +{ +sc16is7xx_ier_clear (port,SC16IS7XX_IER_RDI_BIT ); +} +static const struct sc16is7xx_devtype sc16is74x_devtype = { .name ="SC16IS74X" , .nr_gpio =0 ,
@@ -891,42 +924,6 @@ static void sc16is7xx_reg_proc(struct ktsc16is7xx_reconf_rs485 (&one->port); } -static void sc16is7xx_ier_clear (struct uart_port *port,u8 bit) -{ -struct sc16is7xx_port *s =dev_get_drvdata (port->dev); -struct sc16is7xx_one *one =to_sc16is7xx_one (port, port); - -lockdep_assert_held_once (&port->lock); - - one->config.flags |=SC16IS7XX_RECONF_IER ; - one->config.ier_mask |= bit; - one->config.ier_val &= ~bit; -kthread_queue_work (&s->kworker, &one->reg_work); -} - -static void sc16is7xx_ier_set (struct uart_port *port,u8 bit) -{ -struct sc16is7xx_port *s =dev_get_drvdata (port->dev); -struct sc16is7xx_one *one =to_sc16is7xx_one (port, port); - -lockdep_assert_held_once (&port->lock); - - one->config.flags |=SC16IS7XX_RECONF_IER ; - one->config.ier_mask |= bit; - one->config.ier_val |= bit; -kthread_queue_work (&s->kworker, &one->reg_work); -} - -static void sc16is7xx_stop_tx (struct uart_port *port) -{ -sc16is7xx_ier_clear (port,SC16IS7XX_IER_THRI_BIT ); -} - -static void sc16is7xx_stop_rx (struct uart_port *port) -{ -sc16is7xx_ier_clear (port,SC16IS7XX_IER_RDI_BIT ); -} -static void sc16is7xx_ms_proc (struct kthread_work *ws) {struct sc16is7xx_one *one =to_sc16is7xx_one (ws, ms_work.work);
Greg Kroah-Hartman
maintainerPATCH 22/568 serial: sc16is7xx: refactor EFR lock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <[email protected]>
[ Upstream commit 0c84bea0cabc4e2b98a3de88eeb4ff798931f056 ]
Move common code for EFR lock/unlock of mutex into functions for code reuse and clarity.
With the addition of old_lcr, move irda_mode within struct sc16is7xx_one to reduce memory usage:
Before: /* size: 752, cachelines: 12, members: 10 */
After: /* size: 744, cachelines: 12, members: 10 */Stable-dep-of: 1c05bf6c0262 ("serial: sc16is7xx: remove useless enable of enhanced features")
--- drivers/tty/serial/sc16is7xx.c | 106 ++++++++++++++++++++++------------------- 1 file changed, 57 insertions(+), 49 deletions(-)
drivers/tty/serial/sc16is7xx.c +57 -49
@@ -329,8 +329,9 @@ struct sc16is7xx_one {struct kthread_work reg_work;struct kthread_delayed_work ms_work;struct sc16is7xx_one_config config; -bool irda_mode;unsigned int old_mctrl; +u8 old_lcr;/* Value before EFR access. */ +bool irda_mode; };struct sc16is7xx_port {
@@ -412,6 +413,49 @@ static void sc16is7xx_power(struct uart_ on ? 0 : SC16IS7XX_IER_SLEEP_BIT); } +/* +* In an amazing feat of design, the Enhanced Features Register (EFR) +* shares the address of the Interrupt Identification Register (IIR). +* Access to EFR is switched on by writing a magic value (0xbf) to the +* Line Control Register (LCR). Any interrupt firing during this time will +* see the EFR where it expects the IIR to be, leading to +* "Unexpected interrupt" messages. +* +* Prevent this possibility by claiming a mutex while accessing the EFR, +* and claiming the same mutex from within the interrupt handler. This is +* similar to disabling the interrupt, but that doesn't work because the +* bulk of the interrupt processing is run as a workqueue job in thread +* context. +*/ +static void sc16is7xx_efr_lock (struct uart_port *port) +{ +struct sc16is7xx_one *one =to_sc16is7xx_one (port, port); + +mutex_lock (&one->efr_lock); + +/* Backup content of LCR. */ + one->old_lcr =sc16is7xx_port_read (port,SC16IS7XX_LCR_REG ); + +/* Enable access to Enhanced register set */ +sc16is7xx_port_write (port,SC16IS7XX_LCR_REG ,SC16IS7XX_LCR_CONF_MODE_B ); + +/* Disable cache updates when writing to EFR registers */ +regcache_cache_bypass (one->regmap, true); +} + +static void sc16is7xx_efr_unlock (struct uart_port *port) +{ +struct sc16is7xx_one *one =to_sc16is7xx_one (port, port); + +/* Re-enable cache updates when writing to normal registers */ +regcache_cache_bypass (one->regmap, false); + +/* Restore original content of LCR */ +sc16is7xx_port_write (port,SC16IS7XX_LCR_REG , one->old_lcr); + +mutex_unlock (&one->efr_lock); +} +static void sc16is7xx_ier_clear (struct uart_port *port,u8 bit) {struct sc16is7xx_port *s =dev_get_drvdata (port->dev);
@@ -538,39 +582,12 @@ static int sc16is7xx_set_baud(struct uar div /= prescaler; } -/* In an amazing feat of design, the Enhanced Features Register shares -* the address of the Interrupt Identification Register, and is -* switched in by writing a magic value (0xbf) to the Line Control -* Register. Any interrupt firing during this time will see the EFR -* where it expects the IIR to be, leading to "Unexpected interrupt" -* messages. -* -* Prevent this possibility by claiming a mutex while accessing the -* EFR, and claiming the same mutex from within the interrupt handler. -* This is similar to disabling the interrupt, but that doesn't work -* because the bulk of the interrupt processing is run as a workqueue -* job in thread context. -*/ -mutex_lock (&one->efr_lock); - - lcr =sc16is7xx_port_read (port,SC16IS7XX_LCR_REG ); - -/* Open the LCR divisors for configuration */ -sc16is7xx_port_write (port,SC16IS7XX_LCR_REG , -SC16IS7XX_LCR_CONF_MODE_B ); -/* Enable enhanced features */ -regcache_cache_bypass (one->regmap, true); +sc16is7xx_efr_lock (port);sc16is7xx_port_update (port,SC16IS7XX_EFR_REG ,SC16IS7XX_EFR_ENABLE_BIT ,SC16IS7XX_EFR_ENABLE_BIT ); - -regcache_cache_bypass (one->regmap, false); - -/* Put LCR back to the normal mode */ -sc16is7xx_port_write (port,SC16IS7XX_LCR_REG , lcr); - -mutex_unlock (&one->efr_lock); +sc16is7xx_efr_unlock (port);/* If bit MCR_CLKSEL is set, the divide by 4 prescaler is activated. */ sc16is7xx_port_update(port, SC16IS7XX_MCR_REG,
@@ -580,7 +597,8 @@ static int sc16is7xx_set_baud(struct uarmutex_lock (&one->efr_lock); -/* Open the LCR divisors for configuration */ +/* Backup LCR and access special register set (DLL/DLH) */ + lcr =sc16is7xx_port_read (port,SC16IS7XX_LCR_REG );sc16is7xx_port_write (port,SC16IS7XX_LCR_REG ,SC16IS7XX_LCR_CONF_MODE_A );
@@ -590,7 +608,7 @@ static int sc16is7xx_set_baud(struct uarsc16is7xx_port_write (port,SC16IS7XX_DLL_REG , div %256 );regcache_cache_bypass (one->regmap, false); -/* Put LCR back to the normal mode */ +/* Restore LCR and access to general register set */ sc16is7xx_port_write (port,SC16IS7XX_LCR_REG , lcr);mutex_unlock (&one->efr_lock);
@@ -1073,17 +1091,7 @@ static void sc16is7xx_set_termios(structif (!(termios->c_cflag &CREAD )) port->ignore_status_mask |=SC16IS7XX_LSR_BRK_ERROR_MASK ; -/* As above, claim the mutex while accessing the EFR. */ -mutex_lock (&one->efr_lock); - -sc16is7xx_port_write (port,SC16IS7XX_LCR_REG , -SC16IS7XX_LCR_CONF_MODE_B ); -/* Configure flow control */ -regcache_cache_bypass (one->regmap, true); -sc16is7xx_port_write (port,SC16IS7XX_XON1_REG , termios->c_cc[VSTART ]); -sc16is7xx_port_write (port,SC16IS7XX_XOFF1_REG , termios->c_cc[VSTOP ]); - port->status &= ~(UPSTAT_AUTOCTS |UPSTAT_AUTORTS );if (termios->c_cflag &CRTSCTS ) { flow |= SC16IS7XX_EFR_AUTOCTS_BIT |
@@ -1095,16 +1103,16 @@ static void sc16is7xx_set_termios(structif (termios->c_iflag &IXOFF ) flow |=SC16IS7XX_EFR_SWFLOW1_BIT ; -sc16is7xx_port_update (port, -SC16IS7XX_EFR_REG , -SC16IS7XX_EFR_FLOWCTRL_BITS , - flow); -regcache_cache_bypass (one->regmap, false); -/* Update LCR register */ sc16is7xx_port_write (port,SC16IS7XX_LCR_REG , lcr); -mutex_unlock (&one->efr_lock); +/* Update EFR registers */ +sc16is7xx_efr_lock (port); +sc16is7xx_port_write (port,SC16IS7XX_XON1_REG , termios->c_cc[VSTART ]); +sc16is7xx_port_write (port,SC16IS7XX_XOFF1_REG , termios->c_cc[VSTOP ]); +sc16is7xx_port_update (port,SC16IS7XX_EFR_REG , +SC16IS7XX_EFR_FLOWCTRL_BITS , flow); +sc16is7xx_efr_unlock (port);/* Get baud rate generator configuration */ baud = uart_get_baud_rate(port, termios, old,
Greg Kroah-Hartman
maintainerPATCH 23/568 serial: sc16is7xx: remove useless enable of enhanced features
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <[email protected]>
[ Upstream commit 1c05bf6c0262f946571a37678250193e46b1ff0f ]
Commit 43c51bb573aa ("sc16is7xx: make sure device is in suspend once probed") permanently enabled access to the enhanced features in sc16is7xx_probe(), and it is never disabled after that.
Therefore, remove re-enable of enhanced features in sc16is7xx_set_baud(). This eliminates a potential useless read + write cycle each time the baud rate is reconfigured.
--- drivers/tty/serial/sc16is7xx.c | 7 ------- 1 file changed, 7 deletions(-)
drivers/tty/serial/sc16is7xx.c +0 -7
@@ -582,13 +582,6 @@ static int sc16is7xx_set_baud(struct uar div /= prescaler; } -/* Enable enhanced features */ -sc16is7xx_efr_lock (port); -sc16is7xx_port_update (port,SC16IS7XX_EFR_REG , -SC16IS7XX_EFR_ENABLE_BIT , -SC16IS7XX_EFR_ENABLE_BIT ); -sc16is7xx_efr_unlock (port); -/* If bit MCR_CLKSEL is set, the divide by 4 prescaler is activated. */ sc16is7xx_port_update(port, SC16IS7XX_MCR_REG, SC16IS7XX_MCR_CLKSEL_BIT,
Greg Kroah-Hartman
maintainerPATCH 24/568 NFSD: Fix crash in nfsd4_read_release()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
commit abb1f08a2121dd270193746e43b2a9373db9ad84 upstream.
When tracing is enabled, the trace_nfsd_read_done trace point crashes during the pynfs read.testNoFh test.
--- fs/nfsd/nfs4proc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/nfsd/nfs4proc.c +4 -3
@@ -944,10 +944,11 @@ nfsd4_read(struct svc_rqst *rqstp, strucstatic void nfsd4_read_release (union nfsd4_op_u *u) { -if (u->read.rd_nf) +if (u->read.rd_nf) { +trace_nfsd_read_done (u->read.rd_rqstp, u->read.rd_fhp, + u->read.rd_offset, u->read.rd_length);nfsd_file_put (u->read.rd_nf); -trace_nfsd_read_done (u->read.rd_rqstp, u->read.rd_fhp, - u->read.rd_offset, u->read.rd_length); + } } static __be32
Greg Kroah-Hartman
maintainerPATCH 25/568 net: usb: asix_devices: Check return value of usbnet_get_endpoints
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit dc89548c6926d68dfdda11bebc1a5258bc41d887 upstream.
The code did not check the return value of usbnet_get_endpoints. Add checks and return the error if it fails to transfer the error.
Found via static anlaysis and this is similar to
commit 07161b2416f7 ("sr9800: Add check for usbnet_get_endpoints").
--- drivers/net/usb/asix_devices.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/net/usb/asix_devices.c +9 -3
@@ -230,7 +230,9 @@ static int ax88172_bind(struct usbnet *dint i;unsigned long gpio_bits = dev->driver_info->data; -usbnet_get_endpoints (dev,intf); + ret =usbnet_get_endpoints (dev, intf); +if (ret) + goto out;/* Toggle the GPIOs in a manufacturer/model specific way */ for (i =2 ; i >=0 ; i--) {
@@ -851,7 +853,9 @@ static int ax88772_bind(struct usbnet *d dev->driver_priv = priv; -usbnet_get_endpoints (dev, intf); + ret =usbnet_get_endpoints (dev, intf); +if (ret) +return ret;/* Maybe the boot loader passed the MAC address via device tree */ if (!eth_platform_get_mac_address (&dev->udev->dev, buf)) {
@@ -1284,7 +1288,9 @@ static int ax88178_bind(struct usbnet *dint ret;u8 buf[ETH_ALEN ] = {0 }; -usbnet_get_endpoints (dev,intf); + ret =usbnet_get_endpoints (dev, intf); +if (ret) +return ret;/* Get the MAC address */ ret =asix_read_cmd (dev,AX_CMD_READ_NODE_ID ,0 ,0 ,ETH_ALEN , buf,0 );
Greg Kroah-Hartman
maintainerPATCH 26/568 fbcon: Set fb_display[i]->mode to NULL when the mode is released
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quanmin Yan <[email protected]>
commit a1f3058930745d2b938b6b4f5bd9630dc74b26b7 upstream.
Recently, we discovered the following issue through syzkaller:
BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0 Read of size 4 at addr ff11000001b3c69c by task syz.xxx ... Call Trace: <TASK> dump_stack_lvl+0xab/0xe0 print_address_description.constprop.0+0x2c/0x390 print_report+0xb9/0x280 kasan_report+0xb8/0xf0 fb_mode_is_equal+0x285/0x2f0 fbcon_mode_deleted+0x129/0x180 fb_set_var+0xe7f/0x11d0 do_fb_ioctl+0x6a0/0x750 fb_ioctl+0xe0/0x140 __x64_sys_ioctl+0x193/0x210 do_syscall_64+0x5f/0x9c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
Based on experimentation and analysis, during framebuffer unregistration, only the memory of fb_info->modelist is freed, without setting the corresponding fb_display[i]->mode to NULL for the freed modes. This leads to UAF issues during subsequent accesses. Here's an example of reproduction steps:
1. With /dev/fb0 already registered in the system, load a kernel module to register a new device /dev/fb1;
2. Set fb1's mode to the global fb_display[] array (via FBIOPUT_CON2FBMAP);
3. Switch console from fb to VGA (to allow normal rmmod of the ko);
4. Unload the kernel module, at this point fb1's modelist is freed, leaving a wild pointer in fb_display[];
5. Trigger the bug via system calls through fb0 attempting to delete a mode from fb0.
Add a check in do_unregister_framebuffer(): if the mode to be freed exists in fb_display[], set the corresponding mode pointer to NULL.
--- drivers/video/fbdev/core/fbcon.c | 19 +++++++++++++++++++ drivers/video/fbdev/core/fbmem.c | 1 + include/linux/fbcon.h | 2 ++ 3 files changed, 22 insertions(+)
drivers/video/fbdev/core/fbcon.c +19 -0
@@ -2830,6 +2830,25 @@ int fbcon_mode_deleted(struct fb_info *ireturn found; } +static void fbcon_delete_mode (struct fb_videomode *m) +{ +struct fbcon_display *p; + +for (int i = first_fb_vc; i <= last_fb_vc; i++) { + p = &fb_display[i]; +if (p->mode == m) + p->mode =NULL ; + } +} + +void fbcon_delete_modelist (struct list_head *head) +{ +struct fb_modelist *modelist; + +list_for_each_entry (modelist, head, list) +fbcon_delete_mode (&modelist->mode); +} +#ifdef CONFIG_VT_HW_CONSOLE_BINDING static void fbcon_unbind (void ) {
drivers/video/fbdev/core/fbmem.c +1 -0
@@ -1650,6 +1650,7 @@ static void do_unregister_framebuffer(st fb_info->pixmap.addr =NULL ; } +fbcon_delete_modelist (&fb_info->modelist);fb_destroy_modelist (&fb_info->modelist); registered_fb[fb_info->node] =NULL ; num_registered_fb--;
include/linux/fbcon.h +2 -0
@@ -11,6 +11,7 @@ void fbcon_suspended(struct fb_info *infvoid fbcon_resumed (struct fb_info *info);int fbcon_mode_deleted (struct fb_info *info,struct fb_videomode *mode); +void fbcon_delete_modelist (struct list_head *head);void fbcon_new_modelist (struct fb_info *info);void fbcon_get_requirement (struct fb_info *info,struct fb_blit_caps *caps);
@@ -31,6 +32,7 @@ static inline void fbcon_suspended(strucstatic inline void fbcon_resumed (struct fb_info *info) {}static inline int fbcon_mode_deleted (struct fb_info *info,struct fb_videomode *mode) {return 0 ; } +static inline void fbcon_delete_modelist (struct list_head *head) {}static inline void fbcon_new_modelist (struct fb_info *info) {}static inline void fbcon_get_requirement (struct fb_info *info,struct fb_blit_caps *caps) {}
Greg Kroah-Hartman
maintainerPATCH 27/568 fbdev: atyfb: Check if pll_ops->init_pll failed
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <[email protected]>
commit 7073c7fc8d8ba47194e5fc58fcafc0efe7586e9b upstream.
Actually check the return value from pll_ops->init_pll() as it can return an error.
If the card's BIOS didn't run because it's not the primary VGA card the fact that the xclk source is unsupported is printed as shown below but the driver continues on regardless and on my machine causes a hard lock up.
[ 61.470088] atyfb 0000:03:05.0: enabling device (0080 -> 0083) [ 61.476191] atyfb: using auxiliary register aperture [ 61.481239] atyfb: 3D RAGE XL (Mach64 GR, PCI-33) [0x4752 rev 0x27] [ 61.487569] atyfb: 512K SGRAM (1:1), 14.31818 MHz XTAL, 230 MHz PLL, 83 Mhz MCLK, 63 MHz XCLK [ 61.496112] atyfb: Unsupported xclk source: 5.
--- drivers/video/fbdev/aty/atyfb_base.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/video/fbdev/aty/atyfb_base.c +6 -2
@@ -2617,8 +2617,12 @@ static int aty_init(struct fb_info *info pr_cont("\n"); }#endif -if (par->pll_ops->init_pll) - par->pll_ops->init_pll (info, &par->pll); +if (par->pll_ops->init_pll) { + ret = par->pll_ops->init_pll (info, &par->pll); +if (ret) +return ret; + } +if (par->pll_ops->resume_pll) par->pll_ops->resume_pll (info, &par->pll);
Greg Kroah-Hartman
maintainerPATCH 28/568 ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuhao Jiang <[email protected]>
commit 8f067aa59430266386b83c18b983ca583faa6a11 upstream.
The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal.
If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight.
Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed.
--- drivers/acpi/acpi_video.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/acpi/acpi_video.c +3 -1
@@ -1965,8 +1965,10 @@ static void acpi_video_bus_remove_notifystruct acpi_video_device *dev;mutex_lock (&video->device_list_lock); -list_for_each_entry (dev, &video->video_device_list, entry) +list_for_each_entry (dev, &video->video_device_list, entry) {acpi_video_dev_remove_notify_handler (dev); +cancel_delayed_work_sync (&dev->switch_brightness_work); + }mutex_unlock (&video->device_list_lock);acpi_video_bus_stop_devices (video);
Greg Kroah-Hartman
maintainerPATCH 29/568 fbdev: bitblit: bound-check glyph index in bit_putcs*
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junjie Cao <[email protected]>
commit 18c4ef4e765a798b47980555ed665d78b71aeadf upstream.
bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the built-in font array. Clamp the index to the actual glyph count before computing the address.
This fixes a global out-of-bounds read reported by syzbot.
--- drivers/video/fbdev/core/bitblit.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/video/fbdev/core/bitblit.c +12 -4
@@ -79,12 +79,16 @@ static inline void bit_putcs_aligned(str struct fb_image *image, u8 *buf, u8 *dst) { u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff; +unsigned int charcnt = vc->vc_font.charcount;u32 idx = vc->vc_font.width >>3 ;u8 *src;while (cnt--) { - src = vc->vc_font.data + (scr_readw (s++)& - charmask)*cellsize; +u16 ch =scr_readw (s++) & charmask; + +if (ch >= charcnt) + ch =0 ; + src = vc->vc_font.data + (unsigned int )ch * cellsize;if (attr) {update_attr (buf, src, attr, vc);
@@ -112,14 +116,18 @@ static inline void bit_putcs_unaligned(s u8 *dst) {u16 charmask = vc->vc_hi_font_mask ?0x1ff :0xff ; +unsigned int charcnt = vc->vc_font.charcount;u32 shift_low =0 , mod = vc->vc_font.width %8 ;u32 shift_high =8 ;u32 idx = vc->vc_font.width >>3 ;u8 *src;while (cnt--) { - src = vc->vc_font.data + (scr_readw (s++)& - charmask)*cellsize; +u16 ch =scr_readw (s++) & charmask; + +if (ch >= charcnt) + ch =0 ; + src = vc->vc_font.data + (unsigned int )ch * cellsize;if (attr) {update_attr (buf, src, attr, vc);
Greg Kroah-Hartman
maintainerPATCH 30/568 wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gokul Sivakumar <[email protected]>
commit 3776c685ebe5f43e9060af06872661de55e80b9a upstream.
Currently, whenever there is a need to transmit an Action frame, the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to firmware. The P2P interfaces were available when wpa_supplicant is managing the wlan interface.
However, the P2P interfaces are not created/initialized when only hostapd is managing the wlan interface. And if hostapd receives an ANQP Query REQ Action frame even from an un-associated STA, the brcmfmac driver tries to use an uninitialized P2P vif pointer for sending the IOVAR to firmware. This NULL pointer dereferencing triggers a driver crash.
[ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [...] [ 1417.075188] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT) [...] [ 1417.075653] Call trace: [ 1417.075662] brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac] [ 1417.075738] brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac] [ 1417.075810] cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211] [ 1417.076067] nl80211_tx_mgmt+0x238/0x388 [cfg80211] [ 1417.076281] genl_family_rcv_msg_doit+0xe0/0x158 [ 1417.076302] genl_rcv_msg+0x220/0x2a0 [ 1417.076317] netlink_rcv_skb+0x68/0x140 [ 1417.076330] genl_rcv+0x40/0x60 [ 1417.076343] netlink_unicast+0x330/0x3b8 [ 1417.076357] netlink_sendmsg+0x19c/0x3f8 [ 1417.076370] __sock_sendmsg+0x64/0xc0 [ 1417.076391] ____sys_sendmsg+0x268/0x2a0 [ 1417.076408] ___sys_sendmsg+0xb8/0x118 [ 1417.076427] __sys_sendmsg+0x90/0xf8 [ 1417.076445] __arm64_sys_sendmsg+0x2c/0x40 [ 1417.076465] invoke_syscall+0x50/0x120 [ 1417.076486] el0_svc_common.constprop.0+0x48/0xf0 [ 1417.076506] do_el0_svc+0x24/0x38 [ 1417.076525] el0_svc+0x30/0x100 [ 1417.076548] el0t_64_sync_handler+0x100/0x130 [ 1417.076569] el0t_64_sync+0x190/0x198 [ 1417.076589] Code: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000)
Fix this, by always using the vif corresponding to the wdev on which the Action frame Transmission request was initiated by the userspace. This way, even if P2P vif is not available, the IOVAR is sent to firmware on AP vif and the ANQP Query RESP Action frame is transmitted without crashing the driver.
Move init_completion() for "send_af_done" from brcmf_p2p_create_p2pdev() to brcmf_p2p_attach(). Because the former function would not get executed when only hostapd is managing wlan interface, and it is not safe to do reinit_completion() later in brcmf_p2p_tx_action_frame(), without any prior init_completion().
And in the brcmf_p2p_tx_action_frame() function, the condition check for P2P Presence response frame is not needed, since the wpa_supplicant is properly sending the P2P Presense Response frame on the P2P-GO vif instead of the P2P-Device vif.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 - drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 28 ++++-------- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h | 3 - 3 files changed, 12 insertions(+), 22 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +1 -2
@@ -5197,8 +5197,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wipbrcmf_dbg (TRACE ,"Action frame, cookie=%lld, len=%d, freq=%d\n" , *cookie,le16_to_cpu (action_frame->len), freq); - ack =brcmf_p2p_send_action_frame (cfg,cfg_to_ndev (cfg), - af_params); + ack =brcmf_p2p_send_action_frame (vif->ifp, af_params);cfg80211_mgmt_tx_status (wdev, *cookie, buf, len, ack,GFP_KERNEL );
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c +10 -18
@@ -1529,6 +1529,7 @@ int brcmf_p2p_notify_action_tx_complete(/** * brcmf_p2p_tx_action_frame() - send action frame over fil. * +* @ifp: interface to transmit on. * @p2p: p2p info struct for vif. * @af_params: action frame data/info. *
@@ -1538,12 +1539,11 @@ int brcmf_p2p_notify_action_tx_complete(* The WLC_E_ACTION_FRAME_COMPLETE event will be received when the action * frame is transmitted. */ -static s32 brcmf_p2p_tx_action_frame (struct brcmf_p2p_info *p2p, +static s32 brcmf_p2p_tx_action_frame (struct brcmf_if *ifp, +struct brcmf_p2p_info *p2p,struct brcmf_fil_af_params_le *af_params) {struct brcmf_pub *drvr = p2p->cfg->pub; -struct brcmf_cfg80211_vif *vif; -struct brcmf_p2p_action_frame *p2p_af;s32 err =0 ;brcmf_dbg (TRACE ,"Enter\n" );
@@ -1552,14 +1552,7 @@ static s32 brcmf_p2p_tx_action_frame(strclear_bit (BRCMF_P2P_STATUS_ACTION_TX_COMPLETED , &p2p->status);clear_bit (BRCMF_P2P_STATUS_ACTION_TX_NOACK , &p2p->status); -/* check if it is a p2p_presence response */ - p2p_af = (struct brcmf_p2p_action_frame *)af_params->action_frame.data; -if (p2p_af->subtype ==P2P_AF_PRESENCE_RSP ) - vif = p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION ].vif; -else - vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE ].vif; - - err =brcmf_fil_bsscfg_data_set (vif->ifp,"actframe" , af_params, + err =brcmf_fil_bsscfg_data_set (ifp,"actframe" , af_params,sizeof (*af_params));if (err) {bphy_err (drvr," sending action frame has failed\n" );
@@ -1711,16 +1704,14 @@ static bool brcmf_p2p_check_dwell_overfl/** * brcmf_p2p_send_action_frame() - send action frame . * -* @cfg: driver private data for cfg80211 interface. -* @ndev: net device to transmit on. +* @ifp: interface to transmit on. * @af_params: configuration data for action frame. */ -bool brcmf_p2p_send_action_frame (struct brcmf_cfg80211_info *cfg, -struct net_device *ndev, +bool brcmf_p2p_send_action_frame (struct brcmf_if *ifp,struct brcmf_fil_af_params_le *af_params) { +struct brcmf_cfg80211_info *cfg = ifp->drvr->config;struct brcmf_p2p_info *p2p = &cfg->p2p; -struct brcmf_if *ifp =netdev_priv (ndev);struct brcmf_fil_action_frame_le *action_frame;struct brcmf_config_af_params config_af_params;struct afx_hdl *afx_hdl = &p2p->afx_hdl;
@@ -1857,7 +1848,7 @@ bool brcmf_p2p_send_action_frame(structif (af_params->channel)msleep (P2P_AF_RETRY_DELAY_TIME ); - ack = !brcmf_p2p_tx_action_frame (p2p, af_params); + ack = !brcmf_p2p_tx_action_frame (ifp, p2p, af_params); tx_retry++; dwell_overflow =brcmf_p2p_check_dwell_overflow (requested_dwell, dwell_jiffies);
@@ -2217,7 +2208,6 @@ static struct wireless_dev *brcmf_p2p_crWARN_ON (p2p_ifp->bsscfgidx != bsscfgidx); -init_completion (&p2p->send_af_done);INIT_WORK (&p2p->afx_hdl.afx_work, brcmf_p2p_afx_handler);init_completion (&p2p->afx_hdl.act_frm_scan);init_completion (&p2p->wait_next_af);
@@ -2509,6 +2499,8 @@ s32 brcmf_p2p_attach(struct brcmf_cfg802 pri_ifp =brcmf_get_ifp (cfg->pub,0 ); p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY ].vif = pri_ifp->vif; +init_completion (&p2p->send_af_done); +if (p2pdev_forced) { err_ptr =brcmf_p2p_create_p2pdev (p2p,NULL ,NULL );if (IS_ERR (err_ptr)) {
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h +1 -2
@@ -168,8 +168,7 @@ int brcmf_p2p_notify_action_frame_rx(strint brcmf_p2p_notify_action_tx_complete (struct brcmf_if *ifp,const struct brcmf_event_msg *e,void *data); -bool brcmf_p2p_send_action_frame (struct brcmf_cfg80211_info *cfg, -struct net_device *ndev, +bool brcmf_p2p_send_action_frame (struct brcmf_if *ifp,struct brcmf_fil_af_params_le *af_params);bool brcmf_p2p_scan_finding_common_channel (struct brcmf_cfg80211_info *cfg,struct brcmf_bss_info_le *bi);
Greg Kroah-Hartman
maintainerPATCH 31/568 fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fuchs <[email protected]>
commit 5f566c0ac51cd2474e47da68dbe719d3acf7d999 upstream.
Commit e24cca19babe ("sh: Kill off MAX_DMA_ADDRESS leftovers.") removed the define ONCHIP_NR_DMA_CHANNELS. So that the leftover reference needs to be replaced by CONFIG_NR_ONCHIP_DMA_CHANNELS to compile successfully with CONFIG_PVR2_DMA enabled.
--- drivers/video/fbdev/pvr2fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/pvr2fb.c +1 -1
@@ -192,7 +192,7 @@ static unsigned long pvr2fb_map;#ifdef CONFIG_PVR2_DMA static unsigned int shdma =PVR2_CASCADE_CHAN ; -static unsigned int pvr2dma =ONCHIP_NR_DMA_CHANNELS ; +static unsigned int pvr2dma =CONFIG_NR_ONCHIP_DMA_CHANNELS ;#endif static struct fb_videomode pvr2_modedb[] = {
Greg Kroah-Hartman
maintainerPATCH 32/568 fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit eb53368f8d6e2dfba84c8a94d245719bcf9ae270 upstream.
The of_find_node_by_name() function returns a device tree node with its reference count incremented. The caller is responsible for calling of_node_put() to release this reference when done.
Found via static analysis.
--- drivers/video/fbdev/valkyriefb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/video/fbdev/valkyriefb.c +2 -0
@@ -331,11 +331,13 @@ static int __init valkyriefb_init(void)if (of_address_to_resource (dp,0 , &r)) {printk (KERN_ERR "can't find address for valkyrie\n" ); +of_node_put (dp);return 0 ; } frame_buffer_phys = r.start; cmap_regs_phys = r.start +0x304000 ; + of_node_put(dp); }#endif /* ppc (!CONFIG_MAC) */
Greg Kroah-Hartman
maintainerPATCH 33/568 mptcp: restore window probe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit a824084b98d8a1dbd6e85d0842a8eb5e73467f59 upstream.
Since commit 72377ab2d671 ("mptcp: more conservative check for zero probes") the MPTCP-level zero window probe check is always disabled, as the TCP-level write queue always contains at least the newly allocated skb.
Refine the relevant check tacking in account that the above condition and that such skb can have zero length.
--- net/mptcp/protocol.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/mptcp/protocol.c +6 -1
@@ -1391,7 +1391,12 @@ alloc_skb:if (copy ==0 ) {u64 snd_una =READ_ONCE (msk->snd_una); -if (snd_una != msk->snd_nxt ||tcp_write_queue_tail (ssk)) { +/* No need for zero probe if there are any data pending +* either at the msk or ssk level; skb is the current write +* queue tail and can be empty at this point. +*/ +if (snd_una != msk->snd_nxt || skb->len || + skb !=tcp_send_head (ssk)) {tcp_remove_empty_skb (ssk);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 34/568 ASoC: qdsp6: q6asm: do not sleep while atomic
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
commit fdbb53d318aa94a094434e5f226617f0eb1e8f22 upstream.
For some reason we ended up kfree between spinlock lock and unlock, which can sleep.
move the kfree out of spinlock section.
--- sound/soc/qcom/qdsp6/q6asm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/qcom/qdsp6/q6asm.c +1 -1
@@ -376,9 +376,9 @@ static void q6asm_audio_client_free_buf(spin_lock_irqsave (&ac->lock, flags); port->num_periods =0 ; +spin_unlock_irqrestore (&ac->lock, flags);kfree (port->buf); port->buf =NULL ; -spin_unlock_irqrestore (&ac->lock, flags); }/**
Greg Kroah-Hartman
maintainerPATCH 35/568 x86/fpu: Ensure XFD state on signal delivery
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chang S. Bae <[email protected]>
commit 388eff894d6bc5f921e9bfff0e4b0ab2684a96e9 upstream.
Sean reported [1] the following splat when running KVM tests:
WARNING: CPU: 232 PID: 15391 at xfd_validate_state+0x65/0x70
Call Trace:
<TASK>
fpu__clear_user_states+0x9c/0x100
arch_do_signal_or_restart+0x142/0x210
exit_to_user_mode_loop+0x55/0x100
do_syscall_64+0x205/0x2c0
entry_SYSCALL_64_after_hwframe+0x4b/0x53Chao further identified [2] a reproducible scenario involving signal
delivery: a non-AMX task is preempted by an AMX-enabled task which modifies the XFD MSR.
When the non-AMX task resumes and reloads XSTATE with init values, a warning is triggered due to a mismatch between fpstate::xfd and the CPU's current XFD state. fpu__clear_user_states() does not currently re-synchronize the XFD state after such preemption.
Invoke xfd_update_state() which detects and corrects the mismatch if there is a dynamic feature.
This also benefits the sigreturn path, as fpu__restore_sig() may call fpu__clear_user_states() when the sigframe is inaccessible.
[ dhansen: minor changelog munging ]
--- arch/x86/kernel/fpu/core.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kernel/fpu/core.c +3 -0
@@ -723,6 +723,9 @@ void fpu__clear_user_states(struct fpu * !fpregs_state_valid(fpu, smp_processor_id()))os_xrstor_supervisor (fpu->fpstate); +/* Ensure XFD state is in sync before reloading XSTATE */ +xfd_update_state (fpu->fpstate); +/* Reset user states in registers. */ restore_fpregs_from_init_fpstate (XFEATURE_MASK_USER_RESTORE );
Greg Kroah-Hartman
maintainerPATCH 36/568 wifi: ath10k: Fix memory leak on unsupported WMI command
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <[email protected]>
[ Upstream commit 2e9c1da4ee9d0acfca2e0a3d78f3d8cb5802da1b ]
ath10k_wmi_cmd_send takes ownership of the passed buffer (skb) and has the responsibility to release it in case of error. This patch fixes missing free in case of early error due to unhandled WMI command ID.
Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1
--- drivers/net/wireless/ath/ath10k/wmi.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/ath/ath10k/wmi.c +1 -0
@@ -1935,6 +1935,7 @@ int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id)if (cmd_id ==WMI_CMD_UNSUPPORTED ) {ath10k_warn (ar,"wmi command %d is not supported by firmware\n" , cmd_id); +dev_kfree_skb_any (skb);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/568 drm/msm/a6xx: Fix GMU firmware parser
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil P Oommen <[email protected]>
[ Upstream commit b4789aac9d3441d9f830f0a4022d8dc122d6cab3 ]
Current parser logic for GMU firmware assumes a dword aligned payload size for every block. This is not true for all GMU firmwares. So, fix this by using correct 'size' value in the calculation for the offset for the next block's header.
Patchwork: https://patchwork.freedesktop.org/patch/674040/
Message-ID: <[email protected]>
--- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/a6xx_gmu.c +4 -1
@@ -689,6 +689,9 @@ static bool fw_block_mem(struct a6xx_gmu_bo *bo, const struct block_header *blk)return true; } +#define NEXT_BLK (blk) \ + ((const struct block_header *)((const char *)(blk) + sizeof(*(blk)) + (blk)->size)) +static int a6xx_gmu_fw_load (struct a6xx_gmu *gmu) { struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
@@ -719,7 +722,7 @@ static int a6xx_gmu_fw_load(struct a6xx_gmu *gmu)for (blk = (const struct block_header *) fw_image->data; (const u8 *) blk < fw_image->data + fw_image->size; - blk = (const struct block_header *) &blk->data[blk->size >>2 ]) { + blk =NEXT_BLK (blk)) {if (blk->size ==0 )continue ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/568 ALSA: usb-audio: fix control pipe direction
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roy Vegard Ovesen <[email protected]>
[ Upstream commit 7963891f7c9c6f759cc9ab7da71406b4234f3dd6 ]
Since the requesttype has USB_DIR_OUT the pipe should be constructed with usb_sndctrlpipe().
--- sound/usb/mixer_s1810c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/mixer_s1810c.c +1 -1
@@ -181,7 +181,7 @@ snd_sc1810c_get_status_field(struct usb_device *dev, pkt_out.fields[SC1810C_STATE_F1_IDX ] =SC1810C_SET_STATE_F1 ; pkt_out.fields[SC1810C_STATE_F2_IDX ] =SC1810C_SET_STATE_F2 ; - ret =snd_usb_ctl_msg (dev,usb_rcvctrlpipe (dev,0 ), + ret =snd_usb_ctl_msg (dev,usb_sndctrlpipe (dev,0 ),SC1810C_SET_STATE_REQ ,SC1810C_SET_STATE_REQTYPE , (*seqnum),0 , &pkt_out,sizeof (pkt_out));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/568 bpf: Sync pending IRQ work before freeing ring buffer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Noorain Eqbal <[email protected]>
[ Upstream commit 4e9077638301816a7d73fa1e1b4c1db4a7e3b59c ]
Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes.
In the syzbot reproducer, a BPF program attached to sched_switch triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer is freed before this work executes, the irq_work thread may accesses freed memory.
Calling irq_work_sync(&rb->work) ensures that all pending irq_work complete before freeing the buffer.
--- kernel/bpf/ringbuf.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/bpf/ringbuf.c +2 -0
@@ -218,6 +218,8 @@ static struct bpf_map *ringbuf_map_alloc(union bpf_attr *attr)static void bpf_ringbuf_free (struct bpf_ringbuf *rb) { +irq_work_sync (&rb->work); +/* copy pages pointer and nr_pages to local variable, as we are going * to unmap rb itself with vunmap() below */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/568 scsi: ufs: core: Initialize value of an attribute returned by uic cmd
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wonkon Kim <[email protected]>
[ Upstream commit 6fe4c679dde3075cb481beb3945269bb2ef8b19a ]
If ufshcd_send_cmd() fails, *mib_val may have a garbage value. It can get an unintended value of an attribute.
Make ufshcd_dme_get_attr() always initialize *mib_val.
--- drivers/ufs/core/ufshcd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/ufs/core/ufshcd.c +2 -2
@@ -4027,8 +4027,8 @@ int ufshcd_dme_get_attr(struct ufs_hba *hba, u32 attr_sel, get,UIC_GET_ATTR_ID (attr_sel), UFS_UIC_COMMAND_RETRIES - retries); -if (mib_val && !ret) - *mib_val = uic_cmd.argument3; +if (mib_val) + *mib_val = ret ==0 ? uic_cmd.argument3 :0 ;if (peer && (hba->quirks &UFSHCD_QUIRK_DME_PEER_ACCESS_AUTO_MODE ) && pwr_mode_change)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/568 bpf: Do not audit capability check in do_jit()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Mosnacek <[email protected]>
[ Upstream commit 881a9c9cb7856b24e390fad9f59acfd73b98b3b2 ]
The failure of this check only results in a security mitigation being applied, slightly affecting performance of the compiled BPF program. It doesn't result in a failed syscall, an thus auditing a failed LSM permission check for it is unwanted. For example with SELinux, it causes a denial to be reported for confined processes running as root, which tends to be flagged as a problem to be fixed in the policy. Yet dontauditing or allowing CAP_SYS_ADMIN to the domain may not be desirable, as it would allow/silence also other checks - either going against the principle of least privilege or making debugging potentially harder.
Fix it by changing it from capable() to ns_capable_noaudit(), which instructs the LSMs to not audit the resulting denials.
--- arch/x86/net/bpf_jit_comp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/net/bpf_jit_comp.c +1 -1
@@ -1809,7 +1809,7 @@ st: if (is_imm8(insn->off)) ctx->cleanup_addr = proglen;if (bpf_prog_was_classic (bpf_prog) && - !capable (CAP_SYS_ADMIN )) { + !ns_capable_noaudit (&init_user_ns,CAP_SYS_ADMIN )) {u8 *ip = image + addrs[i -1 ];if (emit_spectre_bhb_barrier (&prog, ip, bpf_prog))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/568 ASoC: Intel: avs: Unprepare a stream when XRUN occurs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cezary Rojewski <[email protected]>
[ Upstream commit cfca1637bc2b6b1e4f191d2f0b25f12402fbbb26 ]
The pcm->prepare() function may be called multiple times in a row by the userspace, as mentioned in the documentation. The driver shall take that into account and prevent redundancy. However, the exact same function is called during XRUNs and in such case, the particular stream shall be reset and setup anew.
--- sound/soc/intel/avs/pcm.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/intel/avs/pcm.c +2 -0
@@ -556,6 +556,8 @@ static int avs_dai_fe_prepare(struct snd_pcm_substream *substream, struct snd_so data =snd_soc_dai_get_dma_data (dai, substream); host_stream = data->host_stream; +if (runtime->state ==SNDRV_PCM_STATE_XRUN ) +hdac_stream (host_stream)->prepared = false;if (hdac_stream (host_stream)->prepared)return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/568 ASoC: fsl_sai: fix bit order for DSD format
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit d9fbe5b0bf7e2d1e20d53e4e2274f9f61bdcca98 ]
The DSD little endian format requires the msb first, because oldest bit is in msb.
found this issue by testing with pipewire.
--- sound/soc/fsl/fsl_sai.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/soc/fsl/fsl_sai.c +1 -2
@@ -322,7 +322,6 @@ static int fsl_sai_set_dai_fmt_tr(struct snd_soc_dai *cpu_dai,break ;case SND_SOC_DAIFMT_PDM : val_cr2 |=FSL_SAI_CR2_BCP ; - val_cr4 &= ~FSL_SAI_CR4_MF ; sai->is_pdm_mode = true;break ;case SND_SOC_DAIFMT_RIGHT_J :
@@ -597,7 +596,7 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream, val_cr5 |=FSL_SAI_CR5_WNW (slot_width); val_cr5 |=FSL_SAI_CR5_W0W (slot_width); -if (sai->is_lsb_first || sai->is_pdm_mode) +if (sai->is_lsb_first) val_cr5 |=FSL_SAI_CR5_FBT (0 );else val_cr5 |=FSL_SAI_CR5_FBT (word_width -1 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/568 libbpf: Fix powerpcs stack register definition in bpf_tracing.h
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit 7221b9caf84b3294688228a19273d74ea19a2ee4 ]
retsnoop's build on powerpc (ppc64le) architecture ([0]) failed due to wrong definition of PT_REGS_SP() macro. Looking at powerpc's implementation of stack unwinding in perf_callchain_user_64() clearly shows that stack pointer register is gpr[1].
Fix libbpf's definition of __PT_SP_REG for powerpc to fix all this.
[0] https://kojipkgs.fedoraproject.org/work/tasks/1544/137921544/build.log
--- tools/lib/bpf/bpf_tracing.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/lib/bpf/bpf_tracing.h +1 -1
@@ -202,7 +202,7 @@ struct pt_regs___arm64 {#define __PT_RET_REG regs[31]#define __PT_FP_REG __unsupported__#define __PT_RC_REG gpr[3] -#define __PT_SP_REG sp +#define __PT_SP_REG gpr[1]#define __PT_IP_REG nip/* powerpc does not select ARCH_HAS_SYSCALL_WRAPPER. */ #define PT_REGS_SYSCALL_REGS (ctx) ctx
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/568 usbnet: Prevents free active kevent
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Xu <[email protected]>
[ Upstream commit 420c84c330d1688b8c764479e5738bbdbf0a33de ]
The root cause of this issue are:
1. When probing the usbnet device, executing usbnet_link_change(dev, 0, 0); put the kevent work in global workqueue. However, the kevent has not yet been scheduled when the usbnet device is unregistered. Therefore, executing free_netdev() results in the "free active object (kevent)" error reported here.
2. Another factor is that when calling usbnet_disconnect()->unregister_netdev(), if the usbnet device is up, ndo_stop() is executed to cancel the kevent. However, because the device is not up, ndo_stop() is not executed.
The solution to this problem is to cancel the kevent before executing free_netdev().
--- drivers/net/usb/usbnet.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/usbnet.c +2 -0
@@ -1645,6 +1645,8 @@ void usbnet_disconnect (struct usb_interface *intf) net = dev->net;unregister_netdev (net); +cancel_work_sync (&dev->kevent); +while ((urb =usb_get_from_anchor (&dev->deferred))) {dev_kfree_skb (urb->context);kfree (urb->sg);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/568 Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <[email protected]>
[ Upstream commit 09b0cd1297b4dbfe736aeaa0ceeab2265f47f772 ]
hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and "UAF".
Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently.
--- net/bluetooth/hci_sync.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
net/bluetooth/hci_sync.c +9 -3
@@ -838,11 +838,17 @@ bool hci_cmd_sync_dequeue_once(struct hci_dev *hdev, {struct hci_cmd_sync_work_entry *entry; - entry =hci_cmd_sync_lookup_entry (hdev, func, data, destroy); -if (!entry) +mutex_lock (&hdev->cmd_sync_work_lock); + + entry =_hci_cmd_sync_lookup_entry (hdev, func, data, destroy); +if (!entry) { +mutex_unlock (&hdev->cmd_sync_work_lock);return false; + } -hci_cmd_sync_cancel_entry (hdev, entry); +_hci_cmd_sync_cancel_entry (hdev, entry, -ECANCELED ); + +mutex_unlock (&hdev->cmd_sync_work_lock);return true; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/568 Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lu <[email protected]>
[ Upstream commit 77343b8b4f87560f8f03e77b98a81ff3a147b262 ]
This patch adds logic to handle power management control when the Bluetooth function is closed during the SDIO reset sequence.
Specifically, if BT is closed before reset, the driver enables the SDIO function and sets driver pmctrl. After reset, if BT remains closed, the driver sets firmware pmctrl and disables the SDIO function.
These changes ensure proper power management and device state consistency across the reset flow.
--- drivers/bluetooth/btmtksdio.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/bluetooth/btmtksdio.c +12 -0
@@ -1257,6 +1257,12 @@ static void btmtksdio_cmd_timeout(struct hci_dev *hdev)sdio_claim_host (bdev->func); +/* set drv_pmctrl if BT is closed before doing reset */ +if (!test_bit (BTMTKSDIO_FUNC_ENABLED , &bdev->tx_state)) { +sdio_enable_func (bdev->func); +btmtksdio_drv_pmctrl (bdev); + } +sdio_writel (bdev->func,C_INT_EN_CLR ,MTK_REG_CHLPCR ,NULL );skb_queue_purge (&bdev->txq);cancel_work_sync (&bdev->txrx_work);
@@ -1272,6 +1278,12 @@ static void btmtksdio_cmd_timeout(struct hci_dev *hdev) goto err; } +/* set fw_pmctrl back if BT is closed after doing reset */ +if (!test_bit (BTMTKSDIO_FUNC_ENABLED , &bdev->tx_state)) { +btmtksdio_fw_pmctrl (bdev); +sdio_disable_func (bdev->func); + } +clear_bit (BTMTKSDIO_PATCH_ENABLED , &bdev->tx_state); err:sdio_release_host (bdev->func);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/568 Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 0d92808024b4e9868cef68d16f121d509843e80e ]
This fixes the state tracking of advertisement set/instance 0x00 which is considered a legacy instance and is not tracked individually by adv_instances list, previously it was assumed that hci_dev itself would track it via HCI_LE_ADV but that is a global state not specifc to instance 0x00, so to fix it a new flag is introduced that only tracks the state of instance 0x00.
--- include/net/bluetooth/hci.h | 1 + net/bluetooth/hci_event.c | 4 ++++ net/bluetooth/hci_sync.c | 5 ++--- 3 files changed, 7 insertions(+), 3 deletions(-)
include/net/bluetooth/hci.h +1 -0
@@ -372,6 +372,7 @@ enum {HCI_USER_CHANNEL ,HCI_EXT_CONFIGURED ,HCI_LE_ADV , +HCI_LE_ADV_0 ,HCI_LE_PER_ADV ,HCI_LE_SCAN , HCI_SSP_ENABLED,
net/bluetooth/hci_event.c +4 -0
@@ -1655,6 +1655,8 @@ static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data,if (adv) adv->enabled = true; +else if (!set->handle) +hci_dev_set_flag (hdev,HCI_LE_ADV_0 ); conn =hci_lookup_le_connect (hdev);if (conn)
@@ -1665,6 +1667,8 @@ static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data,if (cp->num_of_sets) {if (adv) adv->enabled = false; +else if (!set->handle) +hci_dev_clear_flag (hdev,HCI_LE_ADV_0 );/* If just one instance was disabled check if there are * any other instance enabled before clearing HCI_LE_ADV
net/bluetooth/hci_sync.c +2 -3
@@ -2607,9 +2607,8 @@ static int hci_resume_advertising_sync(struct hci_dev *hdev)/* If current advertising instance is set to instance 0x00 * then we need to re-enable it. */ -if (!hdev->cur_adv_instance) - err =hci_enable_ext_advertising_sync (hdev, - hdev->cur_adv_instance); +if (hci_dev_test_and_clear_flag (hdev,HCI_LE_ADV_0 )) + err =hci_enable_ext_advertising_sync (hdev,0x00 ); }else {/* Schedule for most recent instance to be restarted and begin * the software rotation loop
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/568 Bluetooth: ISO: Add support for periodic adv reports processing
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudia Draghicescu <[email protected]>
[ Upstream commit 9c0826310bfb784c9bac7d1d9454e304185446c5 ]
In the case of a Periodic Synchronized Receiver,
the PA report received from a Broadcaster contains the BASE, which has information about codec and other parameters of a BIG. This isnformation is stored and the application can retrieve it using getsockopt(BT_ISO_BASE).
Stable-dep-of: c403da5e98b0 ("Bluetooth: ISO: Fix another instance of dst_type handling")
--- include/net/bluetooth/hci.h | 11 +++++++++++ net/bluetooth/hci_event.c | 23 +++++++++++++++++++++++ net/bluetooth/iso.c | 28 +++++++++++++++++++++++++++- 3 files changed, 61 insertions(+), 1 deletion(-)
include/net/bluetooth/hci.h +11 -0
@@ -2768,6 +2768,17 @@ struct hci_ev_le_enh_conn_complete {__u8 clk_accurancy; } __packed; +#define HCI_EV_LE_PER_ADV_REPORT 0x0f +struct hci_ev_le_per_adv_report { +__le16 sync_handle; +__u8 tx_power; +__u8 rssi; +__u8 cte_type; +__u8 data_status; +__u8 length; +__u8 data[]; +} __packed; +#define HCI_EV_LE_EXT_ADV_SET_TERM 0x12struct hci_evt_le_ext_adv_set_term {__u8 status;
net/bluetooth/hci_event.c +23 -0
@@ -6469,6 +6469,24 @@ static void hci_le_pa_sync_estabilished_evt(struct hci_dev *hdev, void *data,hci_dev_unlock (hdev); } +static void hci_le_per_adv_report_evt (struct hci_dev *hdev,void *data, +struct sk_buff *skb) +{ +struct hci_ev_le_per_adv_report *ev = data; +int mask = hdev->link_mode; +__u8 flags =0 ; + +bt_dev_dbg (hdev,"sync_handle 0x%4.4x" ,le16_to_cpu (ev->sync_handle)); + +hci_dev_lock (hdev); + + mask |=hci_proto_connect_ind (hdev,BDADDR_ANY ,ISO_LINK , &flags); +if (!(mask &HCI_LM_ACCEPT )) +hci_le_pa_term_sync (hdev, ev->sync_handle); + +hci_dev_unlock (hdev); +} +static void hci_le_remote_feat_complete_evt (struct hci_dev *hdev,void *data,struct sk_buff *skb) {
@@ -7002,6 +7020,11 @@ static const struct hci_le_ev {HCI_LE_EV (HCI_EV_LE_PA_SYNC_ESTABLISHED , hci_le_pa_sync_estabilished_evt,sizeof (struct hci_ev_le_pa_sync_established )), +/* [0x0f = HCI_EV_LE_PER_ADV_REPORT] */ +HCI_LE_EV_VL (HCI_EV_LE_PER_ADV_REPORT , + hci_le_per_adv_report_evt, +sizeof (struct hci_ev_le_per_adv_report ), +HCI_MAX_EVENT_SIZE ),/* [0x12 = HCI_EV_LE_EXT_ADV_SET_TERM] */ HCI_LE_EV (HCI_EV_LE_EXT_ADV_SET_TERM , hci_le_ext_adv_term_evt, sizeof(struct hci_evt_le_ext_adv_set_term)),
net/bluetooth/iso.c +27 -1
@@ -1314,7 +1314,8 @@ static int iso_sock_getsockopt(struct socket *sock, int level, int optname,break ;case BT_ISO_BASE : -if (sk->sk_state ==BT_CONNECTED ) { +if (sk->sk_state ==BT_CONNECTED && + !bacmp (&iso_pi (sk)->dst,BDADDR_ANY )) { base_len =iso_pi (sk)->conn->hcon->le_per_adv_data_len; base =iso_pi (sk)->conn->hcon->le_per_adv_data; }else {
@@ -1487,6 +1488,9 @@ static void iso_conn_ready(struct iso_conn *conn)bacpy (&iso_pi (sk)->dst, &hcon->dst);iso_pi (sk)->dst_type = hcon->dst_type; +iso_pi (sk)->sync_handle =iso_pi (parent)->sync_handle; +memcpy (iso_pi (sk)->base,iso_pi (parent)->base,iso_pi (parent)->base_len); +iso_pi (sk)->base_len =iso_pi (parent)->base_len;hci_conn_hold (hcon);iso_chan_add (conn, sk, parent);
@@ -1517,12 +1521,20 @@ static bool iso_match_sync_handle(struct sock *sk, void *data)return le16_to_cpu (ev->sync_handle) ==iso_pi (sk)->sync_handle; } +static bool iso_match_sync_handle_pa_report (struct sock *sk,void *data) +{ +struct hci_ev_le_per_adv_report *ev = data; + +return le16_to_cpu (ev->sync_handle) ==iso_pi (sk)->sync_handle; +} +/* ----- ISO interface with lower layer (HCI) ----- */ int iso_connect_ind (struct hci_dev *hdev,bdaddr_t *bdaddr,__u8 *flags) {struct hci_ev_le_pa_sync_established *ev1;struct hci_evt_le_big_info_adv_report *ev2; +struct hci_ev_le_per_adv_report *ev3;struct sock *sk;int lm =0 ;
@@ -1538,6 +1550,9 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)* 2. HCI_EVT_LE_BIG_INFO_ADV_REPORT: When connect_ind is triggered by a * a BIG Info it attempts to check if there any listening socket with * the same sync_handle and if it does then attempt to create a sync. +* 3. HCI_EV_LE_PER_ADV_REPORT: When a PA report is received, it is stored +* in iso_pi(sk)->base so it can be passed up to user, in the case of a +* broadcast sink. */ ev1 =hci_recv_event_data (hdev,HCI_EV_LE_PA_SYNC_ESTABLISHED );if (ev1) {
@@ -1570,6 +1585,17 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) sk =NULL ; } } + } + + ev3 =hci_recv_event_data (hdev,HCI_EV_LE_PER_ADV_REPORT ); +if (ev3) { + sk =iso_get_sock_listen (&hdev->bdaddr, bdaddr, + iso_match_sync_handle_pa_report, ev3); + +if (sk) { +memcpy (iso_pi (sk)->base, ev3->data, ev3->length); +iso_pi (sk)->base_len = ev3->length; + } }else { sk =iso_get_sock_listen (&hdev->bdaddr,BDADDR_ANY ,NULL ,NULL ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/568 Bluetooth: ISO: Fix another instance of dst_type handling
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit c403da5e98b04a2aec9cfb25cbeeb28d7ce29975 ]
Socket dst_type cannot be directly assigned to hci_conn->type since there domain is different which may lead to the wrong address type being used.
--- net/bluetooth/iso.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/bluetooth/iso.c +7 -1
@@ -1487,7 +1487,13 @@ static void iso_conn_ready(struct iso_conn *conn) }bacpy (&iso_pi (sk)->dst, &hcon->dst); -iso_pi (sk)->dst_type = hcon->dst_type; + +/* Convert from HCI to three-value type */ +if (hcon->dst_type ==ADDR_LE_DEV_PUBLIC ) +iso_pi (sk)->dst_type =BDADDR_LE_PUBLIC ; +else +iso_pi (sk)->dst_type =BDADDR_LE_RANDOM ; +iso_pi (sk)->sync_handle =iso_pi (parent)->sync_handle;memcpy (iso_pi (sk)->base,iso_pi (parent)->base,iso_pi (parent)->base_len);iso_pi (sk)->base_len =iso_pi (parent)->base_len;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/568 drm/etnaviv: fix flush sequence logic
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomeu Vizoso <[email protected]>
[ Upstream commit a042beac6e6f8ac1e923784cfff98b47cbabb185 ]
The current logic uses the flush sequence from the current address space. This is harmless when deducing the flush requirements for the current submit, as either the incoming address space is the same one as the currently active one or we switch context, in which case the flush is unconditional.
However, this sequence is also stored as the current flush sequence of the GPU. If we switch context the stored flush sequence will no longer belong to the currently active address space. This incoherency can then cause missed flushes, resulting in translation errors.
--- drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/etnaviv/etnaviv_buffer.c +1 -1
@@ -346,7 +346,7 @@ void etnaviv_buffer_queue(struct etnaviv_gpu *gpu, u32 exec_state,u32 link_target, link_dwords;bool switch_context = gpu->exec_state != exec_state;bool switch_mmu_context = gpu->mmu_context != mmu_context; -unsigned int new_flush_seq =READ_ONCE (gpu->mmu_context->flush_seq); +unsigned int new_flush_seq =READ_ONCE (mmu_context->flush_seq);bool need_flush = switch_mmu_context || gpu->flush_seq != new_flush_seq;bool has_blt = !!(gpu->identity.minor_features5 & chipMinorFeatures5_BLT_ENGINE);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/568 net: hns3: return error code when function fails
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jijie Shao <[email protected]>
[ Upstream commit 03ca7c8c42be913529eb9f188278114430c6abbd ]
Currently, in hclge_mii_ioctl(), the operation to read the PHY register (SIOCGMIIREG) always returns 0.
This patch changes the return type of hclge_read_phy_reg(), returning an error code when the function fails.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 +-- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c | 9 ++++++--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h | 2 +- 3 files changed, 8 insertions(+), 6 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +1 -2
@@ -9452,8 +9452,7 @@ static int hclge_mii_ioctl(struct hclge_dev *hdev, struct ifreq *ifr, int cmd)/* this command reads phy id and register at the same time */ fallthrough;case SIOCGMIIREG : - data->val_out =hclge_read_phy_reg (hdev, data->reg_num); -return 0 ; +return hclge_read_phy_reg (hdev, data->reg_num, &data->val_out);case SIOCSMIIREG :return hclge_write_phy_reg (hdev, data->reg_num, data->val_in);
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c +6 -3
@@ -274,7 +274,7 @@ void hclge_mac_stop_phy(struct hclge_dev *hdev)phy_stop (phydev); } -u16 hclge_read_phy_reg (struct hclge_dev *hdev,u16 reg_addr) +int hclge_read_phy_reg (struct hclge_dev *hdev,u16 reg_addr,u16 *val) {struct hclge_phy_reg_cmd *req;struct hclge_desc desc;
@@ -286,11 +286,14 @@ u16 hclge_read_phy_reg(struct hclge_dev *hdev, u16 reg_addr) req->reg_addr =cpu_to_le16 (reg_addr); ret =hclge_cmd_send (&hdev->hw, &desc,1 ); -if (ret) +if (ret) {dev_err (&hdev->pdev->dev,"failed to read phy reg, ret = %d.\n" , ret); +return ret; + } -return le16_to_cpu (req->reg_val); + *val =le16_to_cpu (req->reg_val); +return 0 ; }int hclge_write_phy_reg (struct hclge_dev *hdev,u16 reg_addr,u16 val)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h +1 -1
@@ -13,7 +13,7 @@ int hclge_mac_connect_phy(struct hnae3_handle *handle);void hclge_mac_disconnect_phy (struct hnae3_handle *handle);void hclge_mac_start_phy (struct hclge_dev *hdev);void hclge_mac_stop_phy (struct hclge_dev *hdev); -u16 hclge_read_phy_reg (struct hclge_dev *hdev,u16 reg_addr); +int hclge_read_phy_reg (struct hclge_dev *hdev,u16 reg_addr,u16 *val);int hclge_write_phy_reg (struct hclge_dev *hdev,u16 reg_addr,u16 val);#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/568 drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
[ Upstream commit 238d468d3ed18a324bb9d8c99f18c665dbac0511 ]
'table_index' is a variable defined by the smu driver (kmd) 'table_id' is a variable defined by the hw smu (pmfw)
This code should use table_index as a bounds check.
--- drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c +1 -1
@@ -862,7 +862,7 @@ int smu_cmn_update_table(struct smu_context *smu, table_index);uint32_t table_size;int ret =0 ; -if (!table_data || table_id >=SMU_TABLE_COUNT || table_id <0 ) +if (!table_data || table_index >=SMU_TABLE_COUNT || table_id <0 )return -EINVAL ; table_size = smu_table->tables[table_index].size;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/568 drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Smith <[email protected]>
[ Upstream commit 07a13f913c291d6ec72ee4fc848d13ecfdc0e705 ]
Previously this was initialized with zero which represented PCIe Gen 1.0 instead of using the
maximum value from the speed table which is the behaviour of all other smumgr implementations.
--- drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c +1 -1
@@ -2024,7 +2024,7 @@ static int fiji_init_smc_table(struct pp_hwmgr *hwmgr) table->VoltageResponseTime =0 ; table->PhaseResponseTime =0 ; table->MemoryThermThrottleEnable =1 ; - table->PCIeBootLinkLevel =0 ;/* 0:Gen1 1:Gen2 2:Gen3*/ + table->PCIeBootLinkLevel = (uint8_t ) (data->dpm_table.pcie_speed_table.count); table->PCIeGenInterval =1 ; table->VRConfig =0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/568 drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Smith <[email protected]>
[ Upstream commit 501672e3c1576aa9a8364144213c77b98a31a42c ]
Previously this was initialized with zero which represented PCIe Gen 1.0 instead of using the
maximum value from the speed table which is the behaviour of all other smumgr implementations.
--- drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c +1 -1
@@ -2028,7 +2028,7 @@ static int iceland_init_smc_table(struct pp_hwmgr *hwmgr) table->VoltageResponseTime =0 ; table->PhaseResponseTime =0 ; table->MemoryThermThrottleEnable =1 ; - table->PCIeBootLinkLevel =0 ; + table->PCIeBootLinkLevel = (uint8_t ) (data->dpm_table.pcie_speed_table.count); table->PCIeGenInterval =1 ; result =iceland_populate_smc_svi2_config (hwmgr, table);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/568 block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit 12a1c9353c47c0fb3464eba2d78cdf649dee1cf7 upstream.
REQ_OP_ZONE_RESET_ALL is a zone management request. Fix op_is_zone_mgmt() to return true for that operation, like it already does for REQ_OP_ZONE_RESET.
While no problems were reported without this fix, this change allows strengthening checks in various block device drivers (scsi sd, virtioblk, DM) where op_is_zone_mgmt() is used to verify that a zone management command is not being issued to a regular block device.
--- include/linux/blk_types.h | 1 + 1 file changed, 1 insertion(+)
include/linux/blk_types.h +1 -0
@@ -519,6 +519,7 @@ static inline bool op_is_zone_mgmt(enum {switch (op &REQ_OP_MASK ) {case REQ_OP_ZONE_RESET : +case REQ_OP_ZONE_RESET_ALL :case REQ_OP_ZONE_OPEN :case REQ_OP_ZONE_CLOSE :case REQ_OP_ZONE_FINISH :
Greg Kroah-Hartman
maintainerPATCH 57/568 block: make REQ_OP_ZONE_OPEN a write operation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit 19de03b312d69a7e9bacb51c806c6e3f4207376c upstream.
A REQ_OP_OPEN_ZONE request changes the condition of a sequential zone of a zoned block device to the explicitly open condition (BLK_ZONE_COND_EXP_OPEN). As such, it should be considered a write operation.
Change this operation code to be an odd number to reflect this. The following operation numbers are changed to keep the numbering compact.
No problems were reported without this change as this operation has no data. However, this unifies the zone operation to reflect that they modify the device state and also allows strengthening checks in the block layer, e.g. checking if this operation is not issued against a read-only device.
--- include/linux/blk_types.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
include/linux/blk_types.h +5 -5
@@ -371,15 +371,15 @@ enum req_op {/* write the zero filled sector many times */ REQ_OP_WRITE_ZEROES = (__force blk_opf_t )9 ,/* Open a zone */ -REQ_OP_ZONE_OPEN = (__force blk_opf_t )10 , +REQ_OP_ZONE_OPEN = (__force blk_opf_t )11 ,/* Close a zone */ -REQ_OP_ZONE_CLOSE = (__force blk_opf_t )11 , +REQ_OP_ZONE_CLOSE = (__force blk_opf_t )13 ,/* Transition a zone to full */ -REQ_OP_ZONE_FINISH = (__force blk_opf_t )13 , +REQ_OP_ZONE_FINISH = (__force blk_opf_t )15 ,/* reset a zone write pointer */ -REQ_OP_ZONE_RESET = (__force blk_opf_t )15 , +REQ_OP_ZONE_RESET = (__force blk_opf_t )17 ,/* reset all the zone present on the device */ -REQ_OP_ZONE_RESET_ALL = (__force blk_opf_t )17 , +REQ_OP_ZONE_RESET_ALL = (__force blk_opf_t )19 ,/* Driver private requests */ REQ_OP_DRV_IN = (__force blk_opf_t)34,
Greg Kroah-Hartman
maintainerPATCH 58/568 regmap: slimbus: fix bus_context pointer in regmap init calls
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Klimov <[email protected]>
commit 434f7349a1f00618a620b316f091bd13a12bc8d2 upstream.
Commit 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()") revealed the problem in the slimbus regmap. That commit breaks audio playback, for instance, on sdm845 Thundercomm Dragonboard 845c board:
Unable to handle kernel paging request at virtual address ffff8000847cbad4 ... CPU: 5 UID: 0 PID: 776 Comm: aplay Not tainted 6.18.0-rc1-00028-g7ea30958b305 #11 PREEMPT Hardware name: Thundercomm Dragonboard 845c (DT) ... Call trace: slim_xfer_msg+0x24/0x1ac [slimbus] (P) slim_read+0x48/0x74 [slimbus] regmap_slimbus_read+0x18/0x24 [regmap_slimbus] _regmap_raw_read+0xe8/0x174 _regmap_bus_read+0x44/0x80 _regmap_read+0x60/0xd8 _regmap_update_bits+0xf4/0x140 _regmap_select_page+0xa8/0x124 _regmap_raw_write_impl+0x3b8/0x65c _regmap_bus_raw_write+0x60/0x80 _regmap_write+0x58/0xc0 regmap_write+0x4c/0x80 wcd934x_hw_params+0x494/0x8b8 [snd_soc_wcd934x] snd_soc_dai_hw_params+0x3c/0x7c [snd_soc_core] __soc_pcm_hw_params+0x22c/0x634 [snd_soc_core] dpcm_be_dai_hw_params+0x1d4/0x38c [snd_soc_core] dpcm_fe_dai_hw_params+0x9c/0x17c [snd_soc_core] snd_pcm_hw_params+0x124/0x464 [snd_pcm] snd_pcm_common_ioctl+0x110c/0x1820 [snd_pcm] snd_pcm_ioctl+0x34/0x4c [snd_pcm] __arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x104 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xec el0t_64_sync_handler+0xa0/0xf0 el0t_64_sync+0x198/0x19c
The __devm_regmap_init_slimbus() started to be used instead of __regmap_init_slimbus() after the commit mentioned above and turns out the incorrect bus_context pointer (3rd argument) was used in __devm_regmap_init_slimbus(). It should be just "slimbus" (which is equal to &slimbus->dev). Correct it. The wcd934x codec seems to be the only or the first user of devm_regmap_init_slimbus() but we should fix it till the point where __devm_regmap_init_slimbus() was introduced therefore two "Fixes" tags.
While at this, also correct the same argument in __regmap_init_slimbus().
--- drivers/base/regmap/regmap-slimbus.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/base/regmap/regmap-slimbus.c +2 -4
@@ -48,8 +48,7 @@ struct regmap *__regmap_init_slimbus(strif (IS_ERR (bus))return ERR_CAST (bus); -return __regmap_init (&slimbus->dev, bus, &slimbus->dev, config, - lock_key, lock_name); +return __regmap_init (&slimbus->dev, bus, slimbus, config, lock_key, lock_name); }EXPORT_SYMBOL_GPL (__regmap_init_slimbus);
@@ -63,8 +62,7 @@ struct regmap *__devm_regmap_init_slimbuif (IS_ERR (bus))return ERR_CAST (bus); -return __devm_regmap_init (&slimbus->dev, bus, &slimbus, config, - lock_key, lock_name); +return __devm_regmap_init (&slimbus->dev, bus, slimbus, config, lock_key, lock_name); }EXPORT_SYMBOL_GPL (__devm_regmap_init_slimbus);
Greg Kroah-Hartman
maintainerPATCH 59/568 Reapply "Revert drm/amd/display: Enable Freesync Video Mode by default"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
This reverts commit 11b92df8a2f7f4605ccc764ce6ae4a72760674df.
This conflicts with how compositors want to handle VRR. Now that compositors actually handle VRR, we probably don't need freesync video.
[ Salvatore Bonaccorso: Adjust context due to missing 3e094a287526
("drm/amd/display: Use drm_connector in create_stream_for_sink") in 6.1.y stable series ]
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +7 -5
@@ -6044,7 +6044,8 @@ create_stream_for_sink(struct amdgpu_dm_*/ DRM_DEBUG_DRIVER ("No preferred mode found\n" ); }else { - recalculate_timing =is_freesync_video_mode (&mode, aconnector); + recalculate_timing = amdgpu_freesync_vid_mode && +is_freesync_video_mode (&mode, aconnector);if (recalculate_timing) { freesync_mode =get_highest_refresh_rate_mode (aconnector, false);drm_mode_copy (&saved_mode, &mode);
@@ -7147,7 +7148,7 @@ static void amdgpu_dm_connector_add_freestruct amdgpu_dm_connector *amdgpu_dm_connector =to_amdgpu_dm_connector (connector); -if (!edid) +if (!(amdgpu_freesync_vid_mode && edid))return ;if (amdgpu_dm_connector->max_vfreq - amdgpu_dm_connector->min_vfreq >10 )
@@ -9160,7 +9161,8 @@ static int dm_update_crtc_state(struct a* TODO: Refactor this function to allow this check to work * in all conditions. */ -if (dm_new_crtc_state->stream && +if (amdgpu_freesync_vid_mode && + dm_new_crtc_state->stream &&is_timing_unchanged_for_freesync (new_crtc_state, old_crtc_state)) goto skip_modeset;
@@ -9200,7 +9202,7 @@ static int dm_update_crtc_state(struct a }/* Now check if we should set freesync video mode */ -if (dm_new_crtc_state->stream && +if (amdgpu_freesync_vid_mode && dm_new_crtc_state->stream &&dc_is_stream_unchanged (new_stream, dm_old_crtc_state->stream) &&dc_is_stream_scaling_unchanged (new_stream, dm_old_crtc_state->stream) && is_timing_unchanged_for_freesync(new_crtc_state,
@@ -9213,7 +9215,7 @@ static int dm_update_crtc_state(struct aset_freesync_fixed_config (dm_new_crtc_state); goto skip_modeset; - }else if (aconnector && + }else if (amdgpu_freesync_vid_mode && aconnector &&is_freesync_video_mode (&new_crtc_state->mode, aconnector)) {struct drm_display_mode *high_mode;
Greg Kroah-Hartman
maintainerPATCH 60/568 s390/pci: Restore IRQ unconditionally for the zPCI device
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Farhan Ali <[email protected]>
[ Upstream commit b45873c3f09153d1ad9b3a7bf9e5c0b0387fd2ea ]
Commit c1e18c17bda6 ("s390/pci: add zpci_set_irq()/zpci_clear_irq()"), introduced the zpci_set_irq() and zpci_clear_irq(), to be used while resetting a zPCI device.
Commit da995d538d3a ("s390/pci: implement reset_slot for hotplug slot"), mentions zpci_clear_irq() being called in the path for zpci_hot_reset_device(). But that is not the case anymore and these functions are not called outside of this file. Instead zpci_hot_reset_device() relies on zpci_disable_device() also clearing the IRQs, but misses to reset the zdev->irqs_registered flag.
However after a CLP disable/enable reset, the device's IRQ are unregistered, but the flag zdev->irq_registered does not get cleared. It creates an inconsistent state and so arch_restore_msi_irqs() doesn't correctly restore the device's IRQ. This becomes a problem when a PCI driver tries to restore the state of the device through pci_restore_state(). Restore IRQ unconditionally for the device and remove the irq_registered flag as its redundant.
--- arch/s390/include/asm/pci.h | 1 - arch/s390/pci/pci_irq.c | 9 +-------- 2 files changed, 1 insertion(+), 9 deletions(-)
arch/s390/include/asm/pci.h +0 -1
@@ -136,7 +136,6 @@ struct zpci_dev { u8 has_resources : 1; u8 is_physfn : 1; u8 util_str_avail : 1; - u8 irqs_registered : 1; u8 reserved : 2;unsigned int devfn;/* DEVFN part of the RID*/
arch/s390/pci/pci_irq.c +1 -8
@@ -107,9 +107,6 @@ static int zpci_set_irq(struct zpci_develse rc =zpci_set_airq (zdev); -if (!rc) - zdev->irqs_registered =1 ; -return rc; }
@@ -123,9 +120,6 @@ static int zpci_clear_irq(struct zpci_deelse rc =zpci_clear_airq (zdev); -if (!rc) - zdev->irqs_registered =0 ; -return rc; }
@@ -427,8 +421,7 @@ bool arch_restore_msi_irqs(struct pci_de {struct zpci_dev *zdev =to_zpci (pdev); -if (!zdev->irqs_registered) -zpci_set_irq (zdev); +zpci_set_irq (zdev);return true; }
Greg Kroah-Hartman
maintainerPATCH 61/568 net: phy: dp83867: Disable EEE support as not implemented
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emanuele Ghidoli <[email protected]>
[ Upstream commit 84a905290cb4c3d9a71a9e3b2f2e02e031e7512f ]
While the DP83867 PHYs report EEE capability through their feature registers, the actual hardware does not support EEE (see Links). When the connected MAC enables EEE, it causes link instability and communication failures.
The issue is reproducible with a iMX8MP and relevant stmmac ethernet port. Since the introduction of phylink-managed EEE support in the stmmac driver, EEE is now enabled by default, leading to issues on systems using the DP83867 PHY.
Call phy_disable_eee during phy initialization to prevent EEE from being enabled on DP83867 PHYs.
--- drivers/net/phy/dp83867.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/phy/dp83867.c +6 -0
@@ -743,6 +743,12 @@ static int dp83867_config_init(struct phreturn ret; } +/* Although the DP83867 reports EEE capability through the +* MDIO_PCS_EEE_ABLE and MDIO_AN_EEE_ADV registers, the feature +* is not actually implemented in hardware. +*/ + phydev->eee_broken_modes =MDIO_EEE_100TX |MDIO_EEE_1000T ; +if (phy_interface_is_rgmii (phydev) || phydev->interface ==PHY_INTERFACE_MODE_SGMII ) { val =phy_read (phydev,MII_DP83867_PHYCTRL );
Greg Kroah-Hartman
maintainerPATCH 62/568 mptcp: change first as a parameter
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
[ Upstream commit 73a0052a61f98354f39f461e03f1a7e513b84578 ]
The function mptcp_subflow_process_delegated() uses the input ssk first, while __mptcp_check_push() invokes the packet scheduler first.
So this patch adds a new parameter named 'first' for the function __mptcp_subflow_push_pending() to deal with these two cases separately.
With this change, the code that invokes the packet scheduler in the function __mptcp_check_push() can be removed, and replaced by invoking __mptcp_subflow_push_pending() directly.
Stable-dep-of: 27b0e701d387 ("mptcp: drop bogus optimization in __mptcp_check_push()")
--- net/mptcp/protocol.c | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-)
net/mptcp/protocol.c +6 -14
@@ -1706,7 +1706,7 @@ out:mptcp_check_send_data_fin (sk); } -static void __mptcp_subflow_push_pending (struct sock *sk,struct sock *ssk) +static void __mptcp_subflow_push_pending (struct sock *sk,struct sock *ssk,bool first) {struct mptcp_sock *msk =mptcp_sk (sk);struct mptcp_sendmsg_info info = {
@@ -1715,7 +1715,6 @@ static void __mptcp_subflow_push_pendingstruct mptcp_data_frag *dfrag;struct sock *xmit_ssk;int len, copied =0 ; -bool first = true; info.flags =0 ;while ((dfrag =mptcp_send_head (sk))) {
@@ -1725,8 +1724,7 @@ static void __mptcp_subflow_push_pendingwhile (len >0 ) {int ret =0 ; -/* the caller already invoked the packet scheduler, -* check for a different subflow usage only after +/* check for a different subflow usage only after * spooling the first chunk of data */ xmit_ssk = first ? ssk :mptcp_subflow_get_send (mptcp_sk (sk));
@@ -3501,16 +3499,10 @@ void __mptcp_check_push(struct sock *sk,if (!mptcp_send_head (sk))return ; -if (!sock_owned_by_user (sk)) { -struct sock *xmit_ssk =mptcp_subflow_get_send (mptcp_sk (sk)); - -if (xmit_ssk == ssk) -__mptcp_subflow_push_pending (sk, ssk); -else if (xmit_ssk) -mptcp_subflow_delegate (mptcp_subflow_ctx (xmit_ssk),MPTCP_DELEGATE_SEND ); - }else { +if (!sock_owned_by_user (sk)) +__mptcp_subflow_push_pending (sk, ssk, false); +else __set_bit (MPTCP_PUSH_PENDING , &mptcp_sk (sk)->cb_flags); - } }#define MPTCP_FLAGS_PROCESS_CTX_NEED (BIT(MPTCP_PUSH_PENDING) | \
@@ -3605,7 +3597,7 @@ void mptcp_subflow_process_delegated(strif (status &BIT (MPTCP_DELEGATE_SEND )) {mptcp_data_lock (sk);if (!sock_owned_by_user (sk)) -__mptcp_subflow_push_pending (sk, ssk); +__mptcp_subflow_push_pending (sk, ssk, true);else __set_bit (MPTCP_PUSH_PENDING , &mptcp_sk (sk)->cb_flags);mptcp_data_unlock (sk);
Greg Kroah-Hartman
maintainerPATCH 63/568 mptcp: drop bogus optimization in __mptcp_check_push()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit 27b0e701d3872ba59c5b579a9e8a02ea49ad3d3b ]
Accessing the transmit queue without owning the msk socket lock is inherently racy, hence __mptcp_check_push() could actually quit early even when there is pending data.
That in turn could cause unexpected tx lock and timeout.
Dropping the early check avoids the race, implicitly relaying on later tests under the relevant lock. With such change, all the other mptcp_send_head() call sites are now under the msk socket lock and we can additionally drop the now unneeded annotation on the transmit head pointer accesses.
--- net/mptcp/protocol.c | 13 +++++-------- net/mptcp/protocol.h | 2 +- 2 files changed, 6 insertions(+), 9 deletions(-)
net/mptcp/protocol.c +5 -8
@@ -1101,7 +1101,7 @@ static void __mptcp_clean_una(struct socif (WARN_ON_ONCE (!msk->recovery))break ; -WRITE_ONCE (msk->first_pending,mptcp_send_next (sk)); + msk->first_pending =mptcp_send_next (sk); }dfrag_clear (sk, dfrag);
@@ -1691,7 +1691,7 @@ void __mptcp_push_pending(struct sock *smptcp_update_post_push (msk, dfrag, ret); } -WRITE_ONCE (msk->first_pending,mptcp_send_next (sk)); + msk->first_pending =mptcp_send_next (sk); }/* at this point we held the socket lock for the last subflow we used */
@@ -1747,7 +1747,7 @@ static void __mptcp_subflow_push_pendingmptcp_update_post_push (msk, dfrag, ret); } -WRITE_ONCE (msk->first_pending,mptcp_send_next (sk)); + msk->first_pending =mptcp_send_next (sk); } out:
@@ -1917,7 +1917,7 @@ static int mptcp_sendmsg(struct sock *skget_page (dfrag->page);list_add_tail (&dfrag->list, &msk->rtx_queue);if (!msk->first_pending) -WRITE_ONCE (msk->first_pending, dfrag); + msk->first_pending = dfrag; } pr_debug("msk=%p dfrag at seq=%llu len=%u sent=%u new=%d\n", msk, dfrag->data_seq, dfrag->data_len, dfrag->already_sent,
@@ -2915,7 +2915,7 @@ static void __mptcp_clear_xmit(struct sostruct mptcp_sock *msk =mptcp_sk (sk);struct mptcp_data_frag *dtmp, *dfrag; -WRITE_ONCE (msk->first_pending,NULL ); + msk->first_pending =NULL ;list_for_each_entry_safe (dfrag, dtmp, &msk->rtx_queue, list)dfrag_clear (sk, dfrag); }
@@ -3496,9 +3496,6 @@ void __mptcp_data_acked(struct sock *sk)void __mptcp_check_push (struct sock *sk,struct sock *ssk) { -if (!mptcp_send_head (sk)) -return ; -if (!sock_owned_by_user (sk))__mptcp_subflow_push_pending (sk, ssk, false);else
net/mptcp/protocol.h +1 -1
@@ -360,7 +360,7 @@ static inline struct mptcp_data_frag *mp {const struct mptcp_sock *msk =mptcp_sk (sk); -return READ_ONCE (msk->first_pending); +return msk->first_pending; }static inline struct mptcp_data_frag *mptcp_send_next (struct sock *sk)
Greg Kroah-Hartman
maintainerPATCH 64/568 can: gs_usb: increase max interface to U8_MAX
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Celeste Liu <[email protected]>
commit 2a27f6a8fb5722223d526843040f747e9b0e8060 upstream
This issue was found by Runcheng Lu when develop HSCanT USB to CAN FD converter[1]. The original developers may have only 3 interfaces device to test so they write 3 here and wait for future change.
During the HSCanT development, we actually used 4 interfaces, so the limitation of 3 is not enough now. But just increase one is not future-proofed. Since the channel index type in gs_host_frame is u8, just make canch[] become a flexible array with a u8 index, so it naturally constraint by U8_MAX and avoid statically allocate 256 pointer for every gs_usb device.
[1]: https://github.com/cherry-embedded/HSCanT-hardware
--- drivers/net/can/usb/gs_usb.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-)
drivers/net/can/usb/gs_usb.c +10 -11
@@ -277,10 +277,6 @@ struct gs_host_frame {#define GS_MAX_TX_URBS 10/* Only launch a max of GS_MAX_RX_URBS usb requests at a time. */ #define GS_MAX_RX_URBS 30 -/* Maximum number of interfaces the driver supports per device. -* Current hardware only supports 3 interfaces. The future may vary. -*/ -#define GS_MAX_INTF 3struct gs_tx_context {struct gs_can *dev;
@@ -318,14 +314,15 @@ struct gs_can {/* usb interface struct */ struct gs_usb { -struct gs_can *canch[GS_MAX_INTF ];struct usb_anchor rx_submitted;struct usb_device *udev;unsigned int hf_size_rx;u8 active_channels; +u8 channel_cnt;unsigned int pipe_in;unsigned int pipe_out; +struct gs_can *canch[]; };/* 'allocate' a tx context.
@@ -550,7 +547,7 @@ static void gs_usb_receive_bulk_callback }/* device reports out of range channel id */ -if (hf->channel >=GS_MAX_INTF ) +if (hf->channel >= parent->channel_cnt) goto device_detach; dev = parent->canch[hf->channel];
@@ -653,7 +650,7 @@ resubmit_urb:/* USB failure take down all interfaces */ if (rc == -ENODEV ) { device_detach: -for (rc =0 ; rc <GS_MAX_INTF ; rc++) { +for (rc =0 ; rc < parent->channel_cnt; rc++) {if (parent->canch[rc])netif_device_detach (parent->canch[rc]->netdev); }
@@ -1374,17 +1371,19 @@ static int gs_usb_probe(struct usb_inter icount = dconf.icount +1 ;dev_info (&intf->dev,"Configuring for %u interfaces\n" , icount); -if (icount >GS_MAX_INTF ) { +if (icount >type_max (typeof (parent->channel_cnt))) {dev_err (&intf->dev,"Driver cannot handle more that %u CAN interfaces\n" , -GS_MAX_INTF ); +type_max (typeof (parent->channel_cnt)));return -EINVAL ; } - parent =kzalloc (sizeof (*parent),GFP_KERNEL ); + parent =kzalloc (struct_size (parent, canch, icount),GFP_KERNEL );if (!parent)return -ENOMEM ; + parent->channel_cnt = icount; +init_usb_anchor (&parent->rx_submitted);usb_set_intfdata (intf, parent);
@@ -1445,7 +1444,7 @@ static void gs_usb_disconnect(struct usbreturn ; } -for (i =0 ; i <GS_MAX_INTF ; i++) +for (i =0 ; i < parent->channel_cnt; i++)if (parent->canch[i])gs_destroy_candev (parent->canch[i]);
Greg Kroah-Hartman
maintainerPATCH 65/568 cacheinfo: Use RISC-Vs init_cache_level() as generic OF implementation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Gondois <[email protected]>
[ Upstream commit c3719bd9eeb2edf84bd263d662e36ca0ba262a23 ]
RISC-V's implementation of init_of_cache_level() is following the Devicetree Specification v0.3 regarding caches, cf.:
- s3.7.3 'Internal (L1) Cache Properties'
- s3.8 'Multi-level and Shared Cache Nodes'
Allow reusing the implementation by moving it.
Also make 'levels', 'leaves' and 'level' unsigned int.
--- arch/riscv/kernel/cacheinfo.c | 39 ------------------------------------- drivers/base/cacheinfo.c | 44 ++++++++++++++++++++++++++++++++++++++++++ include/linux/cacheinfo.h | 1 3 files changed, 46 insertions(+), 38 deletions(-)
arch/riscv/kernel/cacheinfo.c +1 -38
@@ -115,44 +115,7 @@ static void fill_cacheinfo(struct cacheiint init_cache_level (unsigned int cpu) { -struct cpu_cacheinfo *this_cpu_ci =get_cpu_cacheinfo (cpu); -struct device_node *np =of_cpu_device_node_get (cpu); -struct device_node *prev =NULL ; -int levels =0 , leaves =0 , level; - -if (of_property_read_bool (np,"cache-size" )) - ++leaves; -if (of_property_read_bool (np,"i-cache-size" )) - ++leaves; -if (of_property_read_bool (np,"d-cache-size" )) - ++leaves; -if (leaves >0 ) - levels =1 ; - - prev = np; -while ((np =of_find_next_cache_node (np))) { -of_node_put (prev); - prev = np; -if (!of_device_is_compatible (np,"cache" )) -break ; -if (of_property_read_u32 (np,"cache-level" , &level)) -break ; -if (level <= levels) -break ; -if (of_property_read_bool (np,"cache-size" )) - ++leaves; -if (of_property_read_bool (np,"i-cache-size" )) - ++leaves; -if (of_property_read_bool (np,"d-cache-size" )) - ++leaves; - levels = level; - } - -of_node_put (np); - this_cpu_ci->num_levels = levels; - this_cpu_ci->num_leaves = leaves; - -return 0 ; +return init_of_cache_level (cpu); }int populate_cache_leaves (unsigned int cpu)
drivers/base/cacheinfo.c +44 -0
52 lines not on this page · raw message
include/linux/cacheinfo.h +1 -0
@@ -80,6 +80,7 @@ struct cpu_cacheinfo {struct cpu_cacheinfo *get_cpu_cacheinfo (unsigned int cpu);int init_cache_level (unsigned int cpu); +int init_of_cache_level (unsigned int cpu);int populate_cache_leaves (unsigned int cpu);int cache_setup_acpi (unsigned int cpu);bool last_level_cache_is_valid (unsigned int cpu);
Greg Kroah-Hartman
maintainerPATCH 66/568 cacheinfo: Return error code in init_of_cache_level()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Gondois <[email protected]>
[ Upstream commit 8844c3df001bc1d8397fddea341308da63855d53 ]
Make init_of_cache_level() return an error code when the cache information parsing fails to help detecting missing information.
init_of_cache_level() is only called for riscv. Returning an error code instead of 0 will prevent detect_cache_attributes() to allocate memory if an incomplete DT is parsed.
--- drivers/base/cacheinfo.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/base/cacheinfo.c +7 -3
@@ -245,11 +245,11 @@ int init_of_cache_level(unsigned int cpuof_node_put (prev); prev = np;if (!of_device_is_compatible (np,"cache" )) -break ; + goto err_out;if (of_property_read_u32 (np,"cache-level" , &level)) -break ; + goto err_out;if (level <= levels) -break ; + goto err_out;if (of_property_read_bool (np,"cache-size" )) ++leaves;if (of_property_read_bool (np,"i-cache-size" ))
@@ -264,6 +264,10 @@ int init_of_cache_level(unsigned int cpu this_cpu_ci->num_leaves = leaves;return 0 ; + +err_out: +of_node_put (np); + return -EINVAL; }#else
Greg Kroah-Hartman
maintainerPATCH 67/568 cacheinfo: Check cache-unified property to count cache leaves
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Gondois <[email protected]>
[ Upstream commit de0df442ee49cb1f6ee58f3fec5dcb5e5eb70aab ]
The DeviceTree Specification v0.3 specifies that the cache node '[d-|i-|]cache-size' property is required. The 'cache-unified' property is specifies whether the cache level is separate or unified.
If the cache-size property is missing, no cache leaves is accounted. This can lead to a 'BUG: KASAN: slab-out-of-bounds' [1] bug.
Check 'cache-unified' property and always account for at least one cache leaf when parsing the device tree.
[1] https://lore.kernel.org/all/[email protected]/
--- drivers/base/cacheinfo.c | 37 ++++++++++++++++++++++++++----------- 1 file changed, 26 insertions(+), 11 deletions(-)
drivers/base/cacheinfo.c +26 -11
@@ -224,12 +224,9 @@ static int cache_setup_of_node(unsignedreturn 0 ; } -int init_of_cache_level (unsigned int cpu) +static int of_count_cache_leaves (struct device_node *np) { -struct cpu_cacheinfo *this_cpu_ci =get_cpu_cacheinfo (cpu); -struct device_node *np =of_cpu_device_node_get (cpu); -struct device_node *prev =NULL ; -unsigned int levels =0 , leaves =0 , level; +unsigned int leaves =0 ;if (of_property_read_bool (np,"cache-size" )) ++leaves;
@@ -237,6 +234,28 @@ int init_of_cache_level(unsigned int cpu ++leaves;if (of_property_read_bool (np,"d-cache-size" )) ++leaves; + +if (!leaves) { +/* The '[i-|d-|]cache-size' property is required, but +* if absent, fallback on the 'cache-unified' property. +*/ +if (of_property_read_bool (np,"cache-unified" )) +return 1 ; +else +return 2 ; + } + +return leaves; +} + +int init_of_cache_level (unsigned int cpu) +{ +struct cpu_cacheinfo *this_cpu_ci =get_cpu_cacheinfo (cpu); +struct device_node *np =of_cpu_device_node_get (cpu); +struct device_node *prev =NULL ; +unsigned int levels =0 , leaves, level; + + leaves =of_count_cache_leaves (np);if (leaves >0 ) levels =1 ;
@@ -250,12 +269,8 @@ int init_of_cache_level(unsigned int cpu goto err_out;if (level <= levels) goto err_out; -if (of_property_read_bool (np,"cache-size" )) - ++leaves; -if (of_property_read_bool (np,"i-cache-size" )) - ++leaves; -if (of_property_read_bool (np,"d-cache-size" )) - ++leaves; + + leaves +=of_count_cache_leaves (np); levels = level; }
Greg Kroah-Hartman
maintainerPATCH 68/568 ACPI: PPTT: Remove acpi_find_cache_levels()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Gondois <[email protected]>
[ Upstream commit fa4d566a605bc4cf32d69f16ef8cf9696635f75a ]
acpi_find_cache_levels() is used at a single place and is short enough to be merged into the calling function. The removal allows an easier renaming of the calling function in the next patch.
Also reorder the local variables in the 'reversed Christmas tree' order.
--- drivers/acpi/pptt.c | 21 ++++++--------------- 1 file changed, 6 insertions(+), 15 deletions(-)
drivers/acpi/pptt.c +6 -15
@@ -286,19 +286,6 @@ static struct acpi_pptt_processor *acpi_return NULL ; } -static int acpi_find_cache_levels (struct acpi_table_header *table_hdr, -u32 acpi_cpu_id) -{ -int number_of_levels =0 ; -struct acpi_pptt_processor *cpu; - - cpu =acpi_find_processor_node (table_hdr, acpi_cpu_id); -if (cpu) - number_of_levels =acpi_count_levels (table_hdr, cpu); - -return number_of_levels; -} -static u8 acpi_cache_type (enum cache_type type) {switch (type) {
@@ -621,9 +608,10 @@ static int check_acpi_cpu_flag(unsigned*/ int acpi_find_last_cache_level (unsigned int cpu) { -u32 acpi_cpu_id; +struct acpi_pptt_processor *cpu_node;struct acpi_table_header *table;int number_of_levels =0 ; +u32 acpi_cpu_id; table =acpi_get_pptt ();if (!table)
@@ -632,7 +620,10 @@ int acpi_find_last_cache_level(unsignedpr_debug ("Cache Setup find last level CPU=%d\n" , cpu); acpi_cpu_id =get_acpi_id_for_cpu (cpu); - number_of_levels =acpi_find_cache_levels (table, acpi_cpu_id); + cpu_node =acpi_find_processor_node (table, acpi_cpu_id); +if (cpu_node) + number_of_levels =acpi_count_levels (table, cpu_node); +pr_debug ("Cache Setup find last level level=%d\n" , number_of_levels);return number_of_levels;
Greg Kroah-Hartman
maintainerPATCH 69/568 ACPI: PPTT: Update acpi_find_last_cache_level() to acpi_get_cache_info()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Gondois <[email protected]>
[ Upstream commit bd500361a937c03a3da57178287ce543c8f3681b ]
acpi_find_last_cache_level() allows to find the last level of cache for a given CPU. The function is only called on arm64 ACPI based platforms to check for cache information that would be missing in the CLIDR_EL1 register.
To allow populating (struct cpu_cacheinfo).num_leaves by only parsing a PPTT, update acpi_find_last_cache_level() to get the 'split_levels', i.e. the number of cache levels being split in data/instruction caches.
It is assumed that there will not be data/instruction caches above a unified cache.
If a split level consist of one data cache and no instruction cache (or opposite), then the missing cache will still be populated by default with minimal cache information, and maximal cpumask (all non-existing caches have the same fw_token).
--- arch/arm64/kernel/cacheinfo.c | 11 +++--- drivers/acpi/pptt.c | 76 +++++++++++++++++++++++++++--------------- include/linux/cacheinfo.h | 9 +++- 3 files changed, 63 insertions(+), 33 deletions(-)
arch/arm64/kernel/cacheinfo.c +7 -4
@@ -46,7 +46,7 @@ static void ci_leaf_init(struct cacheinfint init_cache_level (unsigned int cpu) {unsigned int ctype, level, leaves; -int fw_level; +int fw_level, ret;struct cpu_cacheinfo *this_cpu_ci =get_cpu_cacheinfo (cpu);for (level =1 , leaves =0 ; level <=MAX_CACHE_LEVEL ; level++) {
@@ -59,10 +59,13 @@ int init_cache_level(unsigned int cpu) leaves += (ctype ==CACHE_TYPE_SEPARATE ) ?2 :1 ; } -if (acpi_disabled) +if (acpi_disabled) { fw_level =of_find_last_cache_level (cpu); -else - fw_level =acpi_find_last_cache_level (cpu); + }else { + ret =acpi_get_cache_info (cpu, &fw_level,NULL ); +if (ret <0 ) +return ret; + }if (fw_level <0 )return fw_level;
drivers/acpi/pptt.c +50 -26
157 lines not on this page · raw message
include/linux/cacheinfo.h +6 -3
@@ -88,19 +88,22 @@ bool last_level_cache_is_shared(unsignedint detect_cache_attributes (unsigned int cpu);#ifndef CONFIG_ACPI_PPTT /* -* acpi_find_last_cache_level is only called on ACPI enabled +* acpi_get_cache_info() is only called on ACPI enabled * platforms using the PPTT for topology. This means that if * the platform supports other firmware configuration methods * we need to stub out the call when ACPI is disabled. * ACPI enabled platforms not using PPTT won't be making calls * to this function so we need not worry about them. */ -static inline int acpi_find_last_cache_level (unsigned int cpu) +static inline +int acpi_get_cache_info (unsigned int cpu, +unsigned int *levels,unsigned int *split_levels) {return 0 ; }#else -int acpi_find_last_cache_level (unsigned int cpu); +int acpi_get_cache_info (unsigned int cpu, +unsigned int *levels,unsigned int *split_levels);#endif const struct attribute_group *cache_get_priv_group (struct cacheinfo *this_leaf);
Greg Kroah-Hartman
maintainerPATCH 70/568 arch_topology: Build cacheinfo from primary CPU
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Gondois <[email protected]>
[ Upstream commit 5944ce092b97caed5d86d961e963b883b5c44ee2 ]
commit 3fcbf1c77d08 ("arch_topology: Fix cache attributes detection in the CPU hotplug path")
adds a call to detect_cache_attributes() to populate the cacheinfo before updating the siblings mask. detect_cache_attributes() allocates memory and can take the PPTT mutex (on ACPI platforms). On PREEMPT_RT kernels, on secondary CPUs, this triggers a:
'BUG: sleeping function called from invalid context' [1]
as the code is executed with preemption and interrupts disabled.
The primary CPU was previously storing the cache information using the now removed (struct cpu_topology).llc_id:
commit 5b8dc787ce4a ("arch_topology: Drop LLC identifier stash from the CPU topology")
allocate_cache_info() tries to build the cacheinfo from the primary CPU prior secondary CPUs boot, if the DT/ACPI description contains cache information.
If allocate_cache_info() fails, then fallback to the current state for the cacheinfo allocation. [1] will be triggered in such case.
When unplugging a CPU, the cacheinfo memory cannot be freed. If it was, then the memory would be allocated early by the re-plugged CPU and would trigger [1].
Note that populate_cache_leaves() might be called multiple times due to populate_leaves being moved up. This is required since detect_cache_attributes() might be called with per_cpu_cacheinfo(cpu) being allocated but not populated.
[1]:
| BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46
| in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 0, name: swapper/111
| preempt_count: 1, expected: 0
| RCU nest depth: 1, expected: 1
| 3 locks held by swapper/111/0:
| #0: (&pcp->lock){+.+.}-{3:3}, at: get_page_from_freelist+0x218/0x12c8
| #1: (rcu_read_lock){....}-{1:3}, at: rt_spin_trylock+0x48/0xf0
| #2: (&zone->lock){+.+.}-{3:3}, at: rmqueue_bulk+0x64/0xa80
| irq event stamp: 0
| hardirqs last enabled at (0): 0x0
| hardirqs last disabled at (0): copy_process+0x5dc/0x1ab8
| softirqs last enabled at (0): copy_process+0x5dc/0x1ab8
| softirqs last disabled at (0): 0x0
| Preemption disabled at:
| migrate_enable+0x30/0x130
| CPU: 111 PID: 0 Comm: swapper/111 Tainted: G W 6.0.0-rc4-rt6-[...]
| Call trace:
| __kmalloc+0xbc/0x1e8
| detect_cache_attributes+0x2d4/0x5f0
| update_siblings_masks+0x30/0x368
| store_cpu_topology+0x78/0xb8
| secondary_start_kernel+0xd0/0x198
| __secondary_switched+0xb0/0xb4--- arch/riscv/kernel/cacheinfo.c | 5 -- drivers/base/arch_topology.c | 12 +++++-- drivers/base/cacheinfo.c | 71 +++++++++++++++++++++++++++++++----------- include/linux/cacheinfo.h | 1 4 files changed, 65 insertions(+), 24 deletions(-)
arch/riscv/kernel/cacheinfo.c +0 -5
@@ -113,11 +113,6 @@ static void fill_cacheinfo(struct cachei } } -int init_cache_level (unsigned int cpu) -{ -return init_of_cache_level (cpu); -} -int populate_cache_leaves (unsigned int cpu) {struct cpu_cacheinfo *this_cpu_ci =get_cpu_cacheinfo (cpu);
drivers/base/arch_topology.c +10 -2
@@ -736,7 +736,7 @@ void update_siblings_masks(unsigned int ret =detect_cache_attributes (cpuid);if (ret && ret != -ENOENT ) -pr_info ("Early cacheinfo failed, ret = %d\n" , ret); +pr_info ("Early cacheinfo allocation failed, ret = %d\n" , ret);/* update core and thread sibling masks */ for_each_online_cpu (cpu) {
@@ -825,7 +825,7 @@ __weak int __init parse_acpi_topology(vo#if defined(CONFIG_ARM64 ) || defined(CONFIG_RISCV )void __init init_cpu_topology (void ) { -int ret; +int cpu, ret;reset_cpu_topology (); ret =parse_acpi_topology ();
@@ -840,6 +840,14 @@ void __init init_cpu_topology(void)reset_cpu_topology ();return ; } + +for_each_possible_cpu (cpu) { + ret =fetch_cache_info (cpu); +if (ret) { +pr_err ("Early cacheinfo failed, ret = %d\n" , ret); +break ; + } + } }void store_cpu_topology (unsigned int cpuid)
drivers/base/cacheinfo.c +54 -17
100 lines not on this page · raw message
include/linux/cacheinfo.h +1 -0
@@ -85,6 +85,7 @@ int populate_cache_leaves(unsigned int cint cache_setup_acpi (unsigned int cpu);bool last_level_cache_is_valid (unsigned int cpu);bool last_level_cache_is_shared (unsigned int cpu_x,unsigned int cpu_y); +int fetch_cache_info (unsigned int cpu);int detect_cache_attributes (unsigned int cpu);#ifndef CONFIG_ACPI_PPTT /*
Greg Kroah-Hartman
maintainerPATCH 71/568 cacheinfo: Initialize variables in fetch_cache_info()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Gondois <[email protected]>
[ Upstream commit ecaef469920fd6d2c7687f19081946f47684a423 ]
Set potentially uninitialized variables to 0. This is particularly relevant when CONFIG_ACPI_PPTT is not set.
--- drivers/base/cacheinfo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/cacheinfo.c +1 -1
@@ -440,7 +440,7 @@ int allocate_cache_info(int cpu)int fetch_cache_info (unsigned int cpu) {struct cpu_cacheinfo *this_cpu_ci; -unsigned int levels, split_levels; +unsigned int levels =0 , split_levels =0 ;int ret;if (acpi_disabled) {
Greg Kroah-Hartman
maintainerPATCH 72/568 cacheinfo: Fix LLC is not exported through sysfs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yicong Yang <[email protected]>
[ Upstream commit 5c2712387d4850e0b64121d5fd3e6c4e84ea3266 ]
After entering 6.3-rc1 the LLC cacheinfo is not exported on our ACPI based arm64 server. This is because the LLC cacheinfo is partly reset when secondary CPUs boot up. On arm64 the primary cpu will allocate and setup cacheinfo:init_cpu_topology()
for_each_possible_cpu()
fetch_cache_info() // Allocate cacheinfo and init levelsdetect_cache_attributes()
cache_shared_cpu_map_setup()
if (!last_level_cache_is_valid()) // not valid, setup LLC
cache_setup_properties() // setup LLC
On secondary CPU boot up:detect_cache_attributes()
populate_cache_leaves()
get_cache_type() // Get cache type from clidr_el1,
// for LLC type=CACHE_TYPE_NOCACHE
cache_shared_cpu_map_setup()
if (!last_level_cache_is_valid()) // Valid and won't go to this branch,
// leave LLC's type=CACHE_TYPE_NOCACHE
The last_level_cache_is_valid() use cacheinfo->{attributes, fw_token} to test it's valid or not, but populate_cache_leaves() will only reset LLC's type, so we won't try to re-setup LLC's type and leave it CACHE_TYPE_NOCACHE and won't export it through sysfs.
This patch tries to fix this by not re-populating the cache leaves if the LLC is valid.
--- drivers/base/cacheinfo.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
drivers/base/cacheinfo.c +11 -5
@@ -490,12 +490,18 @@ int detect_cache_attributes(unsigned int populate_leaves:/* -* populate_cache_leaves() may completely setup the cache leaves and -* shared_cpu_map or it may leave it partially setup. +* If LLC is valid the cache leaves were already populated so just go to +* update the cpu map. */ - ret =populate_cache_leaves (cpu); -if (ret) - goto free_ci; +if (!last_level_cache_is_valid (cpu)) { +/* +* populate_cache_leaves() may completely setup the cache leaves and +* shared_cpu_map or it may leave it partially setup. +*/ + ret =populate_cache_leaves (cpu); +if (ret) + goto free_ci; + }/* * For systems using DT for cache hierarchy, fw_token
Greg Kroah-Hartman
maintainerPATCH 73/568 drivers: base: cacheinfo: Update cpu_map_populated during CPU Hotplug
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: K Prateek Nayak <[email protected]>
[ Upstream commit c26fabe73330d983c7ce822c6b6ec0879b4da61f ]
Until commit 5c2712387d48 ("cacheinfo: Fix LLC is not exported through sysfs"), cacheinfo called populate_cache_leaves() for CPU coming online which let the arch specific functions handle (at least on x86) populating the shared_cpu_map. However, with the changes in the aforementioned commit, populate_cache_leaves() is not called when a CPU comes online as a result of hotplug since last_level_cache_is_valid() returns true as the cacheinfo data is not discarded. The CPU coming online is not present in shared_cpu_map, however, it will not be added since the cpu_cacheinfo->cpu_map_populated flag is set (it is set in populate_cache_leaves() when cacheinfo is first populated for x86)
This can lead to inconsistencies in the shared_cpu_map when an offlined CPU comes online again. Example below depicts the inconsistency in the shared_cpu_list in cacheinfo when CPU8 is offlined and onlined again on a 3rd Generation EPYC processor:
# for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done
/sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8-15,136-143# echo 0 > /sys/devices/system/cpu/cpu8/online # echo 1 > /sys/devices/system/cpu/cpu8/online
# for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done
/sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8
/sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8
/sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8
/sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8 # cat /sys/devices/system/cpu/cpu136/cache/index0/shared_cpu_list
136 # cat /sys/devices/system/cpu/cpu136/cache/index3/shared_cpu_list
9-15,136-143Clear the flag when the CPU is removed from shared_cpu_map when cache_shared_cpu_map_remove() is called during CPU hotplug. This will allow cache_shared_cpu_map_setup() to add the CPU coming back online in the shared_cpu_map. Set the flag again when the shared_cpu_map is setup. Following are results of performing the same test as described above with the changes:
# for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done
/sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8-15,136-143# echo 0 > /sys/devices/system/cpu/cpu8/online # echo 1 > /sys/devices/system/cpu/cpu8/online
# for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done
/sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8-15,136-143 # cat /sys/devices/system/cpu/cpu136/cache/index0/shared_cpu_list
8,136 # cat /sys/devices/system/cpu/cpu136/cache/index3/shared_cpu_list
8-15,136-143--- drivers/base/cacheinfo.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/base/cacheinfo.c +6 -0
@@ -365,11 +365,14 @@ static int cache_shared_cpu_map_setup(un coherency_max_size = this_leaf->coherency_line_size; } +/* shared_cpu_map is now populated for the cpu */ + this_cpu_ci->cpu_map_populated = true;return 0 ; }static void cache_shared_cpu_map_remove (unsigned int cpu) { +struct cpu_cacheinfo *this_cpu_ci =get_cpu_cacheinfo (cpu);struct cacheinfo *this_leaf, *sib_leaf;unsigned int sibling, index, sib_index;
@@ -404,6 +407,9 @@ static void cache_shared_cpu_map_remove(if (of_have_populated_dt ())of_node_put (this_leaf->fw_token); } + +/* cpu is no longer populated in the shared map */ + this_cpu_ci->cpu_map_populated = false; }static void free_cache_attributes (unsigned int cpu)
Greg Kroah-Hartman
maintainerPATCH 74/568 arm64: tegra: Update cache properties
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Gondois <[email protected]>
[ Upstream commit 27f1568b1d5fe35014074f92717b250afbe67031 ]
The DeviceTree Specification v0.3 specifies that the cache node 'compatible' and 'cache-level' properties are 'required'. Cf. s3.8 Multi-level and Shared Cache Nodes
The 'cache-unified' property should be present if one of the properties for unified cache is present ('cache-size', ...).
Update the Device Trees accordingly.
--- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 15 ++++++++++++++ arch/arm64/boot/dts/nvidia/tegra210.dtsi | 1 arch/arm64/boot/dts/nvidia/tegra234.dtsi | 33 +++++++++++++++++++++++++++++++ 3 files changed, 49 insertions(+)
arch/arm64/boot/dts/nvidia/tegra194.dtsi +15 -0
@@ -3029,36 +3029,51 @@ }; l2c_0: l2-cache0 { + compatible = "cache"; + cache-unified; cache-size = <2097152>; cache-line-size = <64>; cache-sets = <2048>; + cache-level = <2>; next-level-cache = <&l3c>; }; l2c_1: l2-cache1 { + compatible = "cache"; + cache-unified; cache-size = <2097152>; cache-line-size = <64>; cache-sets = <2048>; + cache-level = <2>; next-level-cache = <&l3c>; }; l2c_2: l2-cache2 { + compatible = "cache"; + cache-unified; cache-size = <2097152>; cache-line-size = <64>; cache-sets = <2048>; + cache-level = <2>; next-level-cache = <&l3c>; }; l2c_3: l2-cache3 { + compatible = "cache"; + cache-unified; cache-size = <2097152>; cache-line-size = <64>; cache-sets = <2048>; + cache-level = <2>; next-level-cache = <&l3c>; }; l3c: l3-cache { + compatible = "cache"; + cache-unified; cache-size = <4194304>; cache-line-size = <64>; + cache-level = <3>; cache-sets = <4096>; }; };
arch/arm64/boot/dts/nvidia/tegra210.dtsi +1 -0
@@ -2005,6 +2005,7 @@ L2: l2-cache { compatible = "cache"; + cache-level = <2>; }; };
arch/arm64/boot/dts/nvidia/tegra234.dtsi +33 -0
@@ -2907,117 +2907,150 @@ }; l2c0_0: l2-cache00 { + compatible = "cache"; cache-size = <262144>; cache-line-size = <64>; cache-sets = <512>; cache-unified; + cache-level = <2>; next-level-cache = <&l3c0>; }; l2c0_1: l2-cache01 { + compatible = "cache"; cache-size = <262144>; cache-line-size = <64>; cache-sets = <512>; cache-unified; + cache-level = <2>; next-level-cache = <&l3c0>; }; l2c0_2: l2-cache02 { + compatible = "cache"; cache-size = <262144>; cache-line-size = <64>; cache-sets = <512>; cache-unified; + cache-level = <2>; next-level-cache = <&l3c0>; }; l2c0_3: l2-cache03 { + compatible = "cache"; cache-size = <262144>; cache-line-size = <64>; cache-sets = <512>; cache-unified; + cache-level = <2>; next-level-cache = <&l3c0>; }; l2c1_0: l2-cache10 { + compatible = "cache"; cache-size = <262144>; cache-line-size = <64>; cache-sets = <512>; cache-unified; + cache-level = <2>; next-level-cache = <&l3c1>; }; l2c1_1: l2-cache11 { + compatible = "cache"; cache-size = <262144>; cache-line-size = <64>; cache-sets = <512>; cache-unified; + cache-level = <2>; next-level-cache = <&l3c1>; }; l2c1_2: l2-cache12 { + compatible = "cache"; cache-size = <262144>; cache-line-size = <64>; cache-sets = <512>; cache-unified; + cache-level = <2>; next-level-cache = <&l3c1>; }; l2c1_3: l2-cache13 { + compatible = "cache"; cache-size = <262144>; cache-line-size = <64>; cache-sets = <512>; cache-unified; + cache-level = <2>; next-level-cache = <&l3c1>; }; l2c2_0: l2-cache20 { + compatible = "cache"; cache-size = <262144>; cache-line-size = <64>; cache-sets = <512>; cache-unified; + cache-level = <2>; next-level-cache = <&l3c2>; }; l2c2_1: l2-cache21 { + compatible = "cache"; cache-size = <262144>; cache-line-size = <64>; cache-sets = <512>; cache-unified; + cache-level = <2>; next-level-cache = <&l3c2>; }; l2c2_2: l2-cache22 { + compatible = "cache"; cache-size = <262144>; cache-line-size = <64>; cache-sets = <512>; cache-unified; + cache-level = <2>; next-level-cache = <&l3c2>; }; l2c2_3: l2-cache23 { + compatible = "cache"; cache-size = <262144>; cache-line-size = <64>; cache-sets = <512>; cache-unified; + cache-level = <2>; next-level-cache = <&l3c2>; }; l3c0: l3-cache0 { + compatible = "cache"; + cache-unified; cache-size = <2097152>; cache-line-size = <64>; cache-sets = <2048>; + cache-level = <3>; }; l3c1: l3-cache1 { + compatible = "cache"; + cache-unified; cache-size = <2097152>; cache-line-size = <64>; cache-sets = <2048>; + cache-level = <3>; }; l3c2: l3-cache2 { + compatible = "cache"; + cache-unified; cache-size = <2097152>; cache-line-size = <64>; cache-sets = <2048>; + cache-level = <3>; }; };
Greg Kroah-Hartman
maintainerPATCH 75/568 filemap: add a kiocb_invalidate_pages helper
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
commit e003f74afbd2feadbb9ffbf9135e2d2fb5d320a5 upstream.
Factor out a helper that calls filemap_write_and_wait_range and invalidate_inode_pages2_range for the range covered by a write kiocb or returns -EAGAIN if the kiocb is marked as nowait and there would be pages to write or invalidate.
--- include/linux/pagemap.h | 1 + mm/filemap.c | 48 ++++++++++++++++++++++++++++-------------------- 2 files changed, 29 insertions(+), 20 deletions(-)
include/linux/pagemap.h +1 -0
@@ -30,6 +30,7 @@ static inline void invalidate_remote_inoint invalidate_inode_pages2 (struct address_space *mapping);int invalidate_inode_pages2_range (struct address_space *mapping,pgoff_t start,pgoff_t end); +int kiocb_invalidate_pages (struct kiocb *iocb,size_t count);int write_inode_now (struct inode *,int sync);int filemap_fdatawrite (struct address_space *);int filemap_flush (struct address_space *);
mm/filemap.c +28 -20
64 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 76/568 filemap: add a kiocb_invalidate_post_direct_write helper
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
commit c402a9a9430b670926decbb284b756ee6f47c1ec upstream.
Add a helper to invalidate page cache after a dio write.
--- fs/direct-io.c | 10 ++-------- fs/iomap/direct-io.c | 12 ++---------- include/linux/fs.h | 5 ----- include/linux/pagemap.h | 1 + mm/filemap.c | 37 ++++++++++++++++++++----------------- 5 files changed, 25 insertions(+), 40 deletions(-)
fs/direct-io.c +2 -8
@@ -286,14 +286,8 @@ static ssize_t dio_complete(struct dio ** zeros from unwritten extents. */ if (flags &DIO_COMPLETE_INVALIDATE && - ret >0 && dio_op ==REQ_OP_WRITE && - dio->inode->i_mapping->nrpages) { - err =invalidate_inode_pages2_range (dio->inode->i_mapping, - offset >>PAGE_SHIFT , - (offset + ret -1 ) >>PAGE_SHIFT ); -if (err) -dio_warn_stale_pagecache (dio->iocb->ki_filp); - } + ret >0 && dio_op ==REQ_OP_WRITE ) +kiocb_invalidate_post_direct_write (dio->iocb, ret);inode_dio_end (dio->inode);
fs/iomap/direct-io.c +2 -10
@@ -81,7 +81,6 @@ ssize_t iomap_dio_complete(struct iomap_ {const struct iomap_dio_ops *dops = dio->dops;struct kiocb *iocb = dio->iocb; -struct inode *inode =file_inode (iocb->ki_filp);loff_t offset = iocb->ki_pos;ssize_t ret = dio->error;
@@ -108,15 +107,8 @@ ssize_t iomap_dio_complete(struct iomap_* ->end_io() when necessary, otherwise a racing buffer read would cache * zeros from unwritten extents. */ -if (!dio->error && dio->size && - (dio->flags &IOMAP_DIO_WRITE ) && inode->i_mapping->nrpages) { -int err; - err =invalidate_inode_pages2_range (inode->i_mapping, - offset >>PAGE_SHIFT , - (offset + dio->size -1 ) >>PAGE_SHIFT ); -if (err) -dio_warn_stale_pagecache (iocb->ki_filp); - } +if (!dio->error && dio->size && (dio->flags &IOMAP_DIO_WRITE )) +kiocb_invalidate_post_direct_write (iocb, dio->size);inode_dio_end (file_inode (iocb->ki_filp));if (ret >0 ) {
include/linux/fs.h +0 -5
@@ -3371,11 +3371,6 @@ static inline void inode_dio_end(structwake_up_bit (&inode->i_state, __I_DIO_WAKEUP); } -/* -* Warn about a page cache invalidation failure diring a direct I/O write. -*/ -void dio_warn_stale_pagecache (struct file *filp); -extern void inode_set_flags (struct inode *inode,unsigned int flags,unsigned int mask);
include/linux/pagemap.h +1 -0
@@ -31,6 +31,7 @@ int invalidate_inode_pages2(struct addreint invalidate_inode_pages2_range (struct address_space *mapping,pgoff_t start,pgoff_t end);int kiocb_invalidate_pages (struct kiocb *iocb,size_t count); +void kiocb_invalidate_post_direct_write (struct kiocb *iocb,size_t count);int write_inode_now (struct inode *,int sync);int filemap_fdatawrite (struct address_space *);int filemap_flush (struct address_space *);
mm/filemap.c +20 -17
@@ -3733,7 +3733,7 @@ EXPORT_SYMBOL(read_cache_page_gfp);/* * Warn about a page cache invalidation failure during a direct I/O write. */ -void dio_warn_stale_pagecache (struct file *filp) +static void dio_warn_stale_pagecache (struct file *filp) { static DEFINE_RATELIMIT_STATE(_rs, 86400 * HZ, DEFAULT_RATELIMIT_BURST);char pathname[128 ];
@@ -3750,19 +3750,23 @@ void dio_warn_stale_pagecache(struct fil } } +void kiocb_invalidate_post_direct_write (struct kiocb *iocb,size_t count) +{ +struct address_space *mapping = iocb->ki_filp->f_mapping; + +if (mapping->nrpages && +invalidate_inode_pages2_range (mapping, + iocb->ki_pos >>PAGE_SHIFT , + (iocb->ki_pos + count -1 ) >>PAGE_SHIFT )) +dio_warn_stale_pagecache (iocb->ki_filp); +} +ssize_t generic_file_direct_write (struct kiocb *iocb,struct iov_iter *from) { -struct file *file = iocb->ki_filp; -struct address_space *mapping = file->f_mapping; -struct inode *inode = mapping->host; -loff_t pos = iocb->ki_pos; -ssize_t written; -size_t write_len; -pgoff_t end; - - write_len =iov_iter_count (from); - end = (pos + write_len -1 ) >>PAGE_SHIFT ; +struct address_space *mapping = iocb->ki_filp->f_mapping; +size_t write_len =iov_iter_count (from); +ssize_t written;/* * If a page can not be invalidated, return 0 to fall back
@@ -3772,7 +3776,7 @@ generic_file_direct_write(struct kiocb *if (written) {if (written == -EBUSY )return 0 ; - goto out; +return written; } written = mapping->a_ops->direct_IO (iocb, from);
@@ -3794,11 +3798,11 @@ generic_file_direct_write(struct kiocb ** * Skip invalidation for async writes or if mapping has no pages. */ -if (written >0 && mapping->nrpages && -invalidate_inode_pages2_range (mapping, pos >>PAGE_SHIFT , end)) -dio_warn_stale_pagecache (file); -if (written >0 ) { +struct inode *inode = mapping->host; +loff_t pos = iocb->ki_pos; + +kiocb_invalidate_post_direct_write (iocb, written); pos += written; write_len -= written;if (pos >i_size_read (inode) && !S_ISBLK (inode->i_mode)) {
@@ -3809,7 +3813,6 @@ generic_file_direct_write(struct kiocb * }if (written != -EIOCBQUEUED )iov_iter_revert (from, write_len -iov_iter_count (from)); -out:return written; }EXPORT_SYMBOL (generic_file_direct_write);
Greg Kroah-Hartman
maintainerPATCH 77/568 filemap: update ki_pos in generic_perform_write
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
commit 182c25e9c157f37bd0ab5a82fe2417e2223df459 upstream.
All callers of generic_perform_write need to updated ki_pos, move it into common code.
--- fs/ceph/file.c | 2 -- fs/ext4/file.c | 9 +++------ fs/f2fs/file.c | 1 - fs/nfs/file.c | 1 - mm/filemap.c | 8 ++++---- 5 files changed, 7 insertions(+), 14 deletions(-)
fs/ceph/file.c +0 -2
@@ -1891,8 +1891,6 @@ retry_snap:* can not run at the same time */ written =generic_perform_write (iocb, from); -if (likely (written >=0 )) - iocb->ki_pos = pos + written;ceph_end_io_write (inode); }
fs/ext4/file.c +3 -6
@@ -287,12 +287,9 @@ static ssize_t ext4_buffered_write_iter( out:inode_unlock (inode); -if (likely (ret >0 )) { - iocb->ki_pos += ret; - ret =generic_write_sync (iocb, ret); - } - -return ret; +if (unlikely (ret <=0 )) +return ret; +return generic_write_sync (iocb, ret); } static ssize_t ext4_handle_inode_extension(struct inode *inode, loff_t offset,
fs/f2fs/file.c +0 -1
@@ -4659,7 +4659,6 @@ static ssize_t f2fs_buffered_write_iter( current->backing_dev_info =NULL ;if (ret >0 ) { - iocb->ki_pos += ret;f2fs_update_iostat (F2FS_I_SB (inode), inode,APP_BUFFERED_IO , ret); }
fs/nfs/file.c +0 -1
@@ -645,7 +645,6 @@ ssize_t nfs_file_write(struct kiocb *ioc goto out; written = result; - iocb->ki_pos += written;nfs_add_stats (inode,NFSIOS_NORMALWRITTENBYTES , written);if (mntflags &NFS_MOUNT_WRITE_EAGER ) {
mm/filemap.c +4 -4
@@ -3891,7 +3891,10 @@ again:balance_dirty_pages_ratelimited (mapping); }while (iov_iter_count (i)); -return written ? written : status; +if (!written) +return status; + iocb->ki_pos += written; +return written; }EXPORT_SYMBOL (generic_perform_write);
@@ -3970,7 +3973,6 @@ ssize_t __generic_file_write_iter(struct endbyte = pos + status -1 ; err =filemap_write_and_wait_range (mapping, pos, endbyte);if (err ==0 ) { - iocb->ki_pos = endbyte +1 ; written += status; invalidate_mapping_pages(mapping, pos >> PAGE_SHIFT,
@@ -3983,8 +3985,6 @@ ssize_t __generic_file_write_iter(struct } }else { written =generic_perform_write (iocb, from); -if (likely (written >0 )) - iocb->ki_pos += written; } out: current->backing_dev_info =NULL ;
Greg Kroah-Hartman
maintainerPATCH 78/568 fs: factor out a direct_write_fallback helper
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
commit 44fff0fa08ec5a6d9d5fb05443a36d854d0ece4d upstream.
Add a helper dealing with handling the syncing of a buffered write fallback for direct I/O.
[backing_dev_info still being used here. do small changes to the patch to keep the out label. Which means replacing all returns to goto out.]
--- fs/libfs.c | 41 +++++++++++++++++++++++++++++++++++ include/linux/fs.h | 2 + mm/filemap.c | 61 ++++++++++++----------------------------------------- 3 files changed, 57 insertions(+), 47 deletions(-)
fs/libfs.c +41 -0
@@ -1582,3 +1582,44 @@ bool inode_maybe_inc_iversion(struct inoreturn true; }EXPORT_SYMBOL (inode_maybe_inc_iversion); + +ssize_t direct_write_fallback (struct kiocb *iocb,struct iov_iter *iter, +ssize_t direct_written,ssize_t buffered_written) +{ +struct address_space *mapping = iocb->ki_filp->f_mapping; +loff_t pos = iocb->ki_pos - buffered_written; +loff_t end = iocb->ki_pos -1 ; +int err; + +/* +* If the buffered write fallback returned an error, we want to return +* the number of bytes which were written by direct I/O, or the error +* code if that was zero. +* +* Note that this differs from normal direct-io semantics, which will +* return -EFOO even if some bytes were written. +*/ +if (unlikely (buffered_written <0 )) { +if (direct_written) +return direct_written; +return buffered_written; + } + +/* +* We need to ensure that the page cache pages are written to disk and +* invalidated to preserve the expected O_DIRECT semantics. +*/ + err =filemap_write_and_wait_range (mapping, pos, end); +if (err <0 ) { +/* +* We don't know how much we wrote, so just return the number of +* bytes which were direct-written +*/ +if (direct_written) +return direct_written; +return err; + } +invalidate_mapping_pages (mapping, pos >>PAGE_SHIFT , end >>PAGE_SHIFT ); +return direct_written + buffered_written; +} +EXPORT_SYMBOL_GPL (direct_write_fallback);
include/linux/fs.h +2 -0
@@ -3278,6 +3278,8 @@ extern ssize_t __generic_file_write_iterextern ssize_t generic_file_write_iter (struct kiocb *,struct iov_iter *);extern ssize_t generic_file_direct_write (struct kiocb *,struct iov_iter *);ssize_t generic_perform_write (struct kiocb *,struct iov_iter *); +ssize_t direct_write_fallback (struct kiocb *iocb,struct iov_iter *iter, +ssize_t direct_written,ssize_t buffered_written);ssize_t vfs_iter_read (struct file *file,struct iov_iter *iter,loff_t *ppos,rwf_t flags);
mm/filemap.c +14 -47
85 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 79/568 direct_write_fallback(): on error revert the ->ki_pos update from buffered write
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit 8287474aa5ffb41df52552c4ae4748e791d2faf2 upstream.
If we fail filemap_write_and_wait_range() on the range the buffered write went into, we only report the "number of bytes which we direct-written", to quote the comment in there. Which is fine, but buffered write has already advanced iocb->ki_pos, so we need to roll that back. Otherwise we end up with e.g. write(2) advancing position by more than the amount it reports having written.
Message-Id: <20230827214518.GU3390869@ZenIV>
--- fs/libfs.c | 1 + 1 file changed, 1 insertion(+)
fs/libfs.c +1 -0
@@ -1615,6 +1615,7 @@ ssize_t direct_write_fallback(struct kio* We don't know how much we wrote, so just return the number of * bytes which were direct-written */ + iocb->ki_pos -= buffered_written;if (direct_written)return direct_written;return err;
Greg Kroah-Hartman
maintainerPATCH 80/568 block: open code __generic_file_write_iter for blkdev writes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
commit 727cfe976758b79f8d2f8051c75a5ccb14539a56 upstream.
Open code __generic_file_write_iter to remove the indirect call into ->direct_IO and to prepare using the iomap based write code.
--- block/fops.c | 45 +++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 43 insertions(+), 2 deletions(-)
block/fops.c +43 -2
@@ -515,6 +515,30 @@ static int blkdev_close(struct inode *inreturn 0 ; } +static ssize_t +blkdev_direct_write (struct kiocb *iocb,struct iov_iter *from) +{ +size_t count =iov_iter_count (from); +ssize_t written; + + written =kiocb_invalidate_pages (iocb, count); +if (written) { +if (written == -EBUSY ) +return 0 ; +return written; + } + + written =blkdev_direct_IO (iocb, from); +if (written >0 ) { +kiocb_invalidate_post_direct_write (iocb, count); + iocb->ki_pos += written; + count -= written; + } +if (written != -EIOCBQUEUED ) +iov_iter_revert (from, count -iov_iter_count (from)); +return written; +} +/* * Write data to the block device. Only intended for the block device itself * and the raw driver which basically is a fake block device.
@@ -524,7 +548,8 @@ static int blkdev_close(struct inode *in*/ static ssize_t blkdev_write_iter (struct kiocb *iocb,struct iov_iter *from) { -struct block_device *bdev = iocb->ki_filp->private_data; +struct file *file = iocb->ki_filp; +struct block_device *bdev = file->private_data;struct inode *bd_inode = bdev->bd_inode;loff_t size =bdev_nr_bytes (bdev);struct blk_plug plug;
@@ -553,7 +578,23 @@ static ssize_t blkdev_write_iter(struct }blk_start_plug (&plug); - ret =__generic_file_write_iter (iocb, from); + ret =file_remove_privs (file); +if (ret) +return ret; + + ret =file_update_time (file); +if (ret) +return ret; + +if (iocb->ki_flags &IOCB_DIRECT ) { + ret =blkdev_direct_write (iocb, from); +if (ret >=0 &&iov_iter_count (from)) + ret =direct_write_fallback (iocb, from, ret, +generic_perform_write (iocb, from)); + }else { + ret =generic_perform_write (iocb, from); + } +if (ret >0 ) ret =generic_write_sync (iocb, ret);iov_iter_reexpand (from,iov_iter_count (from) + shorted);
Greg Kroah-Hartman
maintainerPATCH 81/568 block: fix race between set_blocksize and read paths
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Darrick J. Wong" <[email protected]>
commit c0e473a0d226479e8e925d5ba93f751d8df628e9 upstream.
With the new large sector size support, it's now the case that set_blocksize can change i_blksize and the folio order in a manner that conflicts with a concurrent reader and causes a kernel crash.
Specifically, let's say that udev-worker calls libblkid to detect the labels on a block device. The read call can create an order-0 folio to read the first 4096 bytes from the disk. But then udev is preempted.
Next, someone tries to mount an 8k-sectorsize filesystem from the same block device. The filesystem calls set_blksize, which sets i_blksize to 8192 and the minimum folio order to 1.
Now udev resumes, still holding the order-0 folio it allocated. It then tries to schedule a read bio and do_mpage_readahead tries to create bufferheads for the folio. Unfortunately, blocks_per_folio == 0 because the page size is 4096 but the blocksize is 8192 so no bufferheads are attached and the bh walk never sets bdev. We then submit the bio with a NULL block device and crash.
Therefore, truncate the page cache after flushing but before updating i_blksize. However, that's not enough -- we also need to lock out file IO and page faults during the update. Take both the i_rwsem and the invalidate_lock in exclusive mode for invalidations, and in shared mode for read/write operations.
I don't know if this is the correct fix, but xfs/259 found it.
--- block/bdev.c | 17 +++++++++++++++++ block/blk-zoned.c | 5 ++++- block/fops.c | 16 ++++++++++++++++ block/ioctl.c | 6 ++++++ 4 files changed, 43 insertions(+), 1 deletion(-)
block/bdev.c +17 -0
@@ -147,9 +147,26 @@ int set_blocksize(struct block_device *b/* Don't change the size if it is same as current */ if (bdev->bd_inode->i_blkbits !=blksize_bits (size)) { +/* +* Flush and truncate the pagecache before we reconfigure the +* mapping geometry because folio sizes are variable now. If a +* reader has already allocated a folio whose size is smaller +* than the new min_order but invokes readahead after the new +* min_order becomes visible, readahead will think there are +* "zero" blocks per folio and crash. Take the inode and +* invalidation locks to avoid racing with +* read/write/fallocate. +*/ +inode_lock (bdev->bd_inode); +filemap_invalidate_lock (bdev->bd_inode->i_mapping); +sync_blockdev (bdev); +kill_bdev (bdev); + bdev->bd_inode->i_blkbits =blksize_bits (size);kill_bdev (bdev); +filemap_invalidate_unlock (bdev->bd_inode->i_mapping); +inode_unlock (bdev->bd_inode); }return 0 ; }
block/blk-zoned.c +4 -1
@@ -417,6 +417,7 @@ int blkdev_zone_mgmt_ioctl(struct block_ op =REQ_OP_ZONE_RESET ;/* Invalidate the page cache, including dirty pages. */ +inode_lock (bdev->bd_inode);filemap_invalidate_lock (bdev->bd_inode->i_mapping); ret =blkdev_truncate_zone_range (bdev, mode, &zrange);if (ret)
@@ -439,8 +440,10 @@ int blkdev_zone_mgmt_ioctl(struct block_ GFP_KERNEL); fail: -if (cmd ==BLKRESETZONE ) +if (cmd ==BLKRESETZONE ) {filemap_invalidate_unlock (bdev->bd_inode->i_mapping); +inode_unlock (bdev->bd_inode); + }return ret; }
block/fops.c +16 -0
@@ -592,7 +592,14 @@ static ssize_t blkdev_write_iter(struct ret =direct_write_fallback (iocb, from, ret,generic_perform_write (iocb, from)); }else { +/* +* Take i_rwsem and invalidate_lock to avoid racing with +* set_blocksize changing i_blkbits/folio order and punching +* out the pagecache. +*/ +inode_lock_shared (bd_inode); ret =generic_perform_write (iocb, from); +inode_unlock_shared (bd_inode); }if (ret >0 )
@@ -605,6 +612,7 @@ static ssize_t blkdev_write_iter(structstatic ssize_t blkdev_read_iter (struct kiocb *iocb,struct iov_iter *to) {struct block_device *bdev = iocb->ki_filp->private_data; +struct inode *bd_inode = bdev->bd_inode;loff_t size =bdev_nr_bytes (bdev);loff_t pos = iocb->ki_pos;size_t shorted =0 ;
@@ -652,7 +660,13 @@ static ssize_t blkdev_read_iter(struct k goto reexpand; } +/* +* Take i_rwsem and invalidate_lock to avoid racing with set_blocksize +* changing i_blkbits/folio order and punching out the pagecache. +*/ +inode_lock_shared (bd_inode); ret =filemap_read (iocb, to, ret); +inode_unlock_shared (bd_inode); reexpand:if (unlikely (shorted))
@@ -695,6 +709,7 @@ static long blkdev_fallocate(struct fileif ((start | len) & (bdev_logical_block_size (bdev) -1 ))return -EINVAL ; +inode_lock (inode);filemap_invalidate_lock (inode->i_mapping);/*
@@ -735,6 +750,7 @@ static long blkdev_fallocate(struct file fail:filemap_invalidate_unlock (inode->i_mapping); +inode_unlock (inode);return error; }
block/ioctl.c +6 -0
@@ -114,6 +114,7 @@ static int blk_ioctl_discard(struct bloc end > bdev_nr_bytes(bdev))return -EINVAL ; +inode_lock (inode);filemap_invalidate_lock (inode->i_mapping); err =truncate_bdev_range (bdev, mode, start, end -1 );if (err)
@@ -121,6 +122,7 @@ static int blk_ioctl_discard(struct bloc err =blkdev_issue_discard (bdev, start >>9 , len >>9 ,GFP_KERNEL ); fail:filemap_invalidate_unlock (inode->i_mapping); +inode_unlock (inode);return err; }
@@ -146,12 +148,14 @@ static int blk_ioctl_secure_erase(struct end > bdev_nr_bytes(bdev))return -EINVAL ; +inode_lock (bdev->bd_inode);filemap_invalidate_lock (bdev->bd_inode->i_mapping); err =truncate_bdev_range (bdev, mode, start, end -1 );if (!err) err =blkdev_issue_secure_erase (bdev, start >>9 , len >>9 ,GFP_KERNEL );filemap_invalidate_unlock (bdev->bd_inode->i_mapping); +inode_unlock (bdev->bd_inode);return err; }
@@ -184,6 +188,7 @@ static int blk_ioctl_zeroout(struct blocreturn -EINVAL ;/* Invalidate the page cache, including dirty pages */ +inode_lock (inode);filemap_invalidate_lock (inode->i_mapping); err =truncate_bdev_range (bdev, mode, start, end);if (err)
@@ -194,6 +199,7 @@ static int blk_ioctl_zeroout(struct bloc fail:filemap_invalidate_unlock (inode->i_mapping); +inode_unlock (inode);return err; }
Greg Kroah-Hartman
maintainerPATCH 82/568 nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit fb881cd7604536b17a1927fb0533f9a6982ffcc5 upstream.
After commit c0e473a0d226 ("block: fix race between set_blocksize and read paths") was merged, set_blocksize() called by sb_set_blocksize() now locks the inode of the backing device file. As a result of this change, syzbot started reporting deadlock warnings due to a circular dependency involving the semaphore "ns_sem" of the nilfs object, the inode lock of the backing device file, and the locks that this inode lock is transitively dependent on.
This is caused by a new lock dependency added by the above change, since init_nilfs() calls sb_set_blocksize() in the lock section of "ns_sem". However, these warnings are false positives because init_nilfs() is called in the early stage of the mount operation and the filesystem has not yet started.
The reason why "ns_sem" is locked in init_nilfs() was to avoid a race condition in nilfs_fill_super() caused by sharing a nilfs object among multiple filesystem instances (super block structures) in the early implementation. However, nilfs objects and super block structures have long ago become one-to-one, and there is no longer any need to use the semaphore there.
So, fix this issue by removing the use of the semaphore "ns_sem" in init_nilfs().
--- fs/nilfs2/the_nilfs.c | 3 --- 1 file changed, 3 deletions(-)
fs/nilfs2/the_nilfs.c +0 -3
@@ -680,8 +680,6 @@ int init_nilfs(struct the_nilfs *nilfs,int blocksize;int err; -down_write (&nilfs->ns_sem); - blocksize =sb_min_blocksize (sb,NILFS_MIN_BLOCK_SIZE );if (!blocksize) {nilfs_err (sb,"unable to set blocksize" );
@@ -757,7 +755,6 @@ int init_nilfs(struct the_nilfs *nilfs,set_nilfs_init (nilfs); err =0 ; out: -up_write (&nilfs->ns_sem);return err; failed_sbh:
Greg Kroah-Hartman
maintainerPATCH 83/568 usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Owen Gu <[email protected]>
commit cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4 upstream.
A race condition occurs when ffs_func_eps_enable() runs concurrently with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset() sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading to a NULL pointer dereference when accessing epfile->ep in ffs_func_eps_enable() after successful usb_ep_enable().
The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and ffs_data_close() functions, and its modification is protected by the spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function is also protected by ffs->eps_lock.
Thus, add NULL pointer handling for ffs->epfiles in the ffs_func_eps_enable() function to fix issues
--- drivers/usb/gadget/function/f_fs.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/f_fs.c +7 -1
@@ -2005,7 +2005,12 @@ static int ffs_func_eps_enable(struct ff ep = func->eps; epfile = ffs->epfiles; count = ffs->eps_count; -while (count--) { +if (!epfile) { + ret = -ENOMEM ; + goto done; + } + +while (count--) { ep->ep->driver_data = ep; ret =config_ep_by_speed (func->gadget, &func->function, ep->ep);
@@ -2029,6 +2034,7 @@ static int ffs_func_eps_enable(struct ff }wake_up_interruptible (&ffs->wait); +done:spin_unlock_irqrestore (&func->ffs->eps_lock, flags);return ret;
Greg Kroah-Hartman
maintainerPATCH 84/568 drm/sysfb: Do not dereference NULL pointer in plane reset
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
[ Upstream commit 14e02ed3876f4ab0ed6d3f41972175f8b8df3d70 ]
The plane state in __drm_gem_reset_shadow_plane() can be NULL. Do not deref that pointer, but forward NULL to the other plane-reset helpers. Clears plane->state to NULL.
v2:
- fix typo in commit description (Javier)
--- drivers/gpu/drm/drm_gem_atomic_helper.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/drm_gem_atomic_helper.c +5 -1
@@ -330,7 +330,11 @@ EXPORT_SYMBOL(drm_gem_destroy_shadow_plavoid __drm_gem_reset_shadow_plane (struct drm_plane *plane,struct drm_shadow_plane_state *shadow_plane_state) { -__drm_atomic_helper_plane_reset (plane, &shadow_plane_state->base); +if (shadow_plane_state) { +__drm_atomic_helper_plane_reset (plane, &shadow_plane_state->base); + }else { +__drm_atomic_helper_plane_reset (plane,NULL ); + } }EXPORT_SYMBOL (__drm_gem_reset_shadow_plane);
Greg Kroah-Hartman
maintainerPATCH 85/568 drm/sched: Fix race in drm_sched_entity_select_rq()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Stanner <[email protected]>
[ Upstream commit d25e3a610bae03bffc5c14b5d944a5d0cd844678 ]
In a past bug fix it was forgotten that entity access must be protected by the entity lock. That's a data race and potentially UB.
Move the spin_unlock() to the appropriate position.
--- drivers/gpu/drm/scheduler/sched_entity.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/scheduler/sched_entity.c +2 -1
@@ -471,10 +471,11 @@ void drm_sched_entity_select_rq(struct ddrm_sched_rq_remove_entity (entity->rq, entity); entity->rq = rq; } -spin_unlock (&entity->rq_lock);if (entity->num_sched_list ==1 ) entity->sched_list =NULL ; + +spin_unlock (&entity->rq_lock); }/**
Greg Kroah-Hartman
maintainerPATCH 86/568 s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerd Bayer <[email protected]>
[ Upstream commit 0fd20f65df6aa430454a0deed8f43efa91c54835 ]
Do not block PCI config accesses through pci_cfg_access_lock() when executing the s390 variant of PCI error recovery: Acquire just device_lock() instead of pci_dev_lock() as powerpc's EEH and generig PCI AER processing do.
During error recovery testing a pair of tasks was reported to be hung:
mlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working
INFO: task kmcheck:72 blocked for more than 122 seconds.
Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kmcheck state:D stack:0 pid:72 tgid:72 ppid:2 flags:0x00000000
Call Trace:
[<000000065256f030>] __schedule+0x2a0/0x590
[<000000065256f356>] schedule+0x36/0xe0
[<000000065256f572>] schedule_preempt_disabled+0x22/0x30
[<0000000652570a94>] __mutex_lock.constprop.0+0x484/0x8a8
[<000003ff800673a4>] mlx5_unload_one+0x34/0x58 [mlx5_core]
[<000003ff8006745c>] mlx5_pci_err_detected+0x94/0x140 [mlx5_core]
[<0000000652556c5a>] zpci_event_attempt_error_recovery+0xf2/0x398
[<0000000651b9184a>] __zpci_event_error+0x23a/0x2c0
INFO: task kworker/u1664:6:1514 blocked for more than 122 seconds.
Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u1664:6 state:D stack:0 pid:1514 tgid:1514 ppid:2 flags:0x00000000
Workqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core]
Call Trace:
[<000000065256f030>] __schedule+0x2a0/0x590
[<000000065256f356>] schedule+0x36/0xe0
[<0000000652172e28>] pci_wait_cfg+0x80/0xe8
[<0000000652172f94>] pci_cfg_access_lock+0x74/0x88
[<000003ff800916b6>] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core]
[<000003ff80098824>] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core]
[<000003ff80074b62>] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core]
[<0000000652512242>] devlink_health_do_dump.part.0+0x82/0x168
[<0000000652513212>] devlink_health_report+0x19a/0x230
[<000003ff80075a12>] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core]No kernel log of the exact same error with an upstream kernel is available - but the very same deadlock situation can be constructed there, too:
- task: kmcheck
mlx5_unload_one() tries to acquire devlink lock while the PCI error recovery code has set pdev->block_cfg_access by way of pci_cfg_access_lock()
- task: kworker
mlx5_crdump_collect() tries to set block_cfg_access through pci_cfg_access_lock() while devlink_health_report() had acquired the devlink lock.
A similar deadlock situation can be reproduced by requesting a crdump with
Quoted 1 line
devlink health dump show pci/<BDF> reporter
fw_fatal
while PCI error recovery is executed on the same <BDF> physical function by mlx5_core's pci_error_handlers. On s390 this can be injected with
Quoted 1 line
zpcictl --reset-fw <BDF>
Tests with this patch failed to reproduce that second deadlock situation, the devlink command is rejected with "kernel answers: Permission denied" - and we get a kernel log message of:
mlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5
because the config read of VSC_SEMAPHORE is rejected by the underlying hardware.
Two prior attempts to address this issue have been discussed and ultimately rejected [see link], with the primary argument that s390's implementation of PCI error recovery is imposing restrictions that neither powerpc's EEH nor PCI AER handling need. Tests show that PCI error recovery on s390 is running to completion even without blocking access to PCI config space.
--- arch/s390/pci/pci_event.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/s390/pci/pci_event.c +2 -2
@@ -173,7 +173,7 @@ static pci_ers_result_t zpci_event_attem* is unbound or probed and that userspace can't access its * configuration space while we perform recovery. */ -pci_dev_lock (pdev); +device_lock (&pdev->dev);if (pdev->error_state == pci_channel_io_perm_failure) { ers_res =PCI_ERS_RESULT_DISCONNECT ; goto out_unlock;
@@ -221,7 +221,7 @@ static pci_ers_result_t zpci_event_attemif (driver->err_handler->resume) driver->err_handler->resume (pdev); out_unlock: -pci_dev_unlock (pdev); +device_unlock (&pdev->dev);return ers_res; }
Greg Kroah-Hartman
maintainerPATCH 87/568 soc: aspeed: socinfo: Add AST27xx silicon IDs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Chen <[email protected]>
[ Upstream commit c30dcfd4b5a0f0e3fe7138bf287f6de6b1b00278 ]
Extend the ASPEED SoC info driver to support AST27XX silicon IDs.
--- drivers/soc/aspeed/aspeed-socinfo.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/soc/aspeed/aspeed-socinfo.c +4 -0
@@ -27,6 +27,10 @@ static struct { { "AST2620", 0x05010203 }, { "AST2605", 0x05030103 }, { "AST2625", 0x05030403 }, +/* AST2700 */ + { "AST2750", 0x06000003 }, + { "AST2700", 0x06000103 }, + { "AST2720", 0x06000203 }, };static const char *siliconid_to_name (u32 siliconid)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 88/568 soc: qcom: smem: Fix endian-unaware access of num_entries
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Reidel <[email protected]>
[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
Add a missing le32_to_cpu when accessing num_entries, which is always a little endian integer.
Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
--- drivers/soc/qcom/smem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/smem.c +1 -1
@@ -810,7 +810,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)if (IS_ERR_OR_NULL (ptable))return SMEM_ITEM_COUNT ; - info = (struct smem_info *)&ptable->entry[ptable->num_entries]; + info = (struct smem_info *)&ptable->entry[le32_to_cpu (ptable->num_entries)];if (memcmp (info->magic,SMEM_INFO_MAGIC ,sizeof (info->magic)))return SMEM_ITEM_COUNT ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/568 spi: loopback-test: Dont use %pK through printk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and easier to reason about.
There are still a few users of %pK left, but these use it through seq_file, for which its usage is safe.
--- drivers/spi/spi-loopback-test.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/spi/spi-loopback-test.c +6 -6
@@ -436,7 +436,7 @@ static void spi_test_dump_message(struct spi_device *spi,int i;u8 b; -dev_info (&spi->dev," spi_msg@%pK\n" , msg); +dev_info (&spi->dev," spi_msg@%p\n" , msg);if (msg->status)dev_info (&spi->dev," status: %i\n" , msg->status);
@@ -446,15 +446,15 @@ static void spi_test_dump_message(struct spi_device *spi, msg->actual_length);list_for_each_entry (xfer, &msg->transfers, transfer_list) { -dev_info (&spi->dev," spi_transfer@%pK\n" , xfer); +dev_info (&spi->dev," spi_transfer@%p\n" , xfer);dev_info (&spi->dev," len: %i\n" , xfer->len); -dev_info (&spi->dev," tx_buf: %pK\n" , xfer->tx_buf); +dev_info (&spi->dev," tx_buf: %p\n" , xfer->tx_buf);if (dump_data && xfer->tx_buf)spi_test_print_hex_dump (" TX: " , xfer->tx_buf, xfer->len); -dev_info (&spi->dev," rx_buf: %pK\n" , xfer->rx_buf); +dev_info (&spi->dev," rx_buf: %p\n" , xfer->rx_buf);if (dump_data && xfer->rx_buf) spi_test_print_hex_dump(" RX: ", xfer->rx_buf,
@@ -548,7 +548,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,/* if still not found then something has modified too much */ /* we could list the "closest" transfer here... */ dev_err (&spi->dev, -"loopback strangeness - rx changed outside of allowed range at: %pK\n" , +"loopback strangeness - rx changed outside of allowed range at: %p\n" , addr);/* do not return, only set ret, * so that we list all addresses
@@ -686,7 +686,7 @@ static int spi_test_translate(struct spi_device *spi, }dev_err (&spi->dev, -"PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n" , +"PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n" , *ptr, *ptr + len,RX (0 ),RX (SPI_TEST_MAX_SIZE ),TX (0 ),TX (SPI_TEST_MAX_SIZE ));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 90/568 soc: ti: pruss: dont use %pK through printk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit a5039648f86424885aae37f03dc39bc9cb972ecb ]
In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and easier to reason about.
--- drivers/soc/ti/pruss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/ti/pruss.c +1 -1
@@ -270,7 +270,7 @@ static int pruss_probe(struct platform_device *pdev) pruss->mem_regions[i].pa = res.start; pruss->mem_regions[i].size =resource_size (&res); -dev_dbg (dev,"memory %8s: pa %pa size 0x%zx va %pK\n" , +dev_dbg (dev,"memory %8s: pa %pa size 0x%zx va %p\n" , mem_names[i], &pruss->mem_regions[i].pa, pruss->mem_regions[i].size, pruss->mem_regions[i].va); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 91/568 bpf: Dont use %pK through printk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and easier to reason about.
--- include/linux/filter.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/filter.h +1 -1
@@ -1082,7 +1082,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);static inline void bpf_jit_dump (unsigned int flen,unsigned int proglen,u32 pass,void *image) { -pr_err ("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n" , flen, +pr_err ("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n" , flen, proglen, pass, image, current->comm,task_pid_nr (current));if (image)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/568 pinctrl: single: fix bias pull up/down handling in pin_config_set
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chi Zhang <[email protected]>
[ Upstream commit 236152dd9b1675a35eee912e79e6c57ca6b6732f ]
In the pin_config_set function, when handling PIN_CONFIG_BIAS_PULL_DOWN or PIN_CONFIG_BIAS_PULL_UP, the function calls pcs_pinconf_clear_bias() which writes the register. However, the subsequent operations continue using the stale 'data' value from before the register write, effectively causing the bias clear operation to be overwritten and not take effect.
Fix this by reading the 'data' value from the register after calling pcs_pinconf_clear_bias().
This bug seems to have existed when this code was first merged in commit 9dddb4df90d1 ("pinctrl: single: support generic pinconf").
--- drivers/pinctrl/pinctrl-single.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/pinctrl/pinctrl-single.c +3 -1
@@ -588,8 +588,10 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev,break ;case PIN_CONFIG_BIAS_PULL_DOWN :case PIN_CONFIG_BIAS_PULL_UP : -if (arg) +if (arg) {pcs_pinconf_clear_bias (pctldev, pin); + data = pcs->read (pcs->base + offset); + } fallthrough;case PIN_CONFIG_INPUT_SCHMITT_ENABLE : data &= ~func->conf[i].mask;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/568 mmc: host: renesas_sdhi: Fix the actual clock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
Wrong actual clock reported, if the SD clock division ratio is other than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
On high speed mode, cat /sys/kernel/debug/mmc1/ios Without the patch:
clock: 50000000 Hz actual clock: 200000000 Hz
After the fix:
clock: 50000000 Hz actual clock: 50000000 Hz
--- drivers/mmc/host/renesas_sdhi_core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/mmc/host/renesas_sdhi_core.c +5 -1
@@ -220,7 +220,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host, clk &= ~0xff ; } -sd_ctrl_write16 (host,CTL_SD_CARD_CLK_CTL , clk &CLK_CTL_DIV_MASK ); + clock = clk &CLK_CTL_DIV_MASK ; +if (clock !=0xff ) + host->mmc->actual_clock /= (1 << (ffs (clock) +1 )); + +sd_ctrl_write16 (host,CTL_SD_CARD_CLK_CTL , clock);if (!(host->pdata->flags &TMIO_MMC_MIN_RCAR2 ))usleep_range (10000 ,11000 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/568 memstick: Add timeout to prevent indefinite waiting
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayi Li <[email protected]>
[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
Add timeout handling to wait_for_completion calls in memstick_set_rw_addr() and memstick_alloc_card() to prevent indefinite blocking in case of hardware or communication failures.
--- drivers/memstick/core/memstick.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/memstick/core/memstick.c +6 -2
@@ -367,7 +367,9 @@ int memstick_set_rw_addr(struct memstick_dev *card) { card->next_request = h_memstick_set_rw_addr;memstick_new_req (card->host); -wait_for_completion (&card->mrq_complete); +if (!wait_for_completion_timeout (&card->mrq_complete, +msecs_to_jiffies (500 ))) + card->current_mrq.error = -ETIMEDOUT ;return card->current_mrq.error; }
@@ -401,7 +403,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host) card->next_request = h_memstick_read_dev_id;memstick_new_req (host); -wait_for_completion (&card->mrq_complete); +if (!wait_for_completion_timeout (&card->mrq_complete, +msecs_to_jiffies (500 ))) + card->current_mrq.error = -ETIMEDOUT ;if (card->current_mrq.error) goto err_out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 95/568 irqchip/sifive-plic: Respect mask state when setting affinity
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Inochi Amaoto <[email protected]>
[ Upstream commit adecf78df945f4c7a1d29111b0002827f487df51 ]
plic_set_affinity() always calls plic_irq_enable(), which clears up the priority setting even the interrupt is only masked. This unmasks the interrupt unexpectly.
Replace the plic_irq_enable/disable() with plic_irq_toggle() to avoid changing the priority setting.
--- drivers/irqchip/irq-sifive-plic.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/irqchip/irq-sifive-plic.c +4 -2
@@ -172,12 +172,14 @@ static int plic_set_affinity(struct irq_data *d,if (cpu >= nr_cpu_ids)return -EINVAL ; -plic_irq_disable (d); +/* Invalidate the original routing entry */ +plic_irq_toggle (irq_data_get_effective_affinity_mask (d), d,0 );irq_data_update_effective_affinity (d,cpumask_of (cpu)); +/* Setting the new routing entry if irq is enabled */ if (!irqd_irq_disabled (d)) -plic_irq_enable (d); +plic_irq_toggle (irq_data_get_effective_affinity_mask (d), d,1 );return IRQ_SET_MASK_OK_DONE ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/568 selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <[email protected]>
[ Upstream commit 98857d111c53954aa038fcbc4cf48873e4240f7c ]
Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt the usage in test_lirc_mode2_user.c.
--- tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/test_lirc_mode2_user.c +1 -1
@@ -74,7 +74,7 @@ int main(int argc, char **argv)/* Let's try detach it before it was ever attached */ ret =bpf_prog_detach2 (progfd, lircfd,BPF_LIRC_MODE2 ); -if (ret !=-1 || errno !=ENOENT ) { +if (ret != -ENOENT ) {printf ("bpf_prog_detach2 not attached should fail: %m\n" );return 1 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/568 cpufreq/longhaul: handle NULL policy in longhaul_exit
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Beier <[email protected]>
[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
longhaul_exit() was calling cpufreq_cpu_get(0) without checking for a NULL policy pointer. On some systems, this could lead to a NULL dereference and a kernel warning or panic.
This patch adds a check using unlikely() and returns early if the policy is NULL.
Bugzilla: #219962
--- drivers/cpufreq/longhaul.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/cpufreq/longhaul.c +3 -0
@@ -953,6 +953,9 @@ static void __exit longhaul_exit(void)struct cpufreq_policy *policy =cpufreq_cpu_get (0 );int i; +if (unlikely (!policy)) +return ; +for (i =0 ; i < numscales; i++) {if (mults[i] == maxmult) {struct cpufreq_freqs freqs;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/568 arc: Fix __fls() const-foldability via __builtin_clzl()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results).
For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function uses __builtin_arc_fls() which lacks GCC's const attribute, preventing compile-time constant folding, and KUnit testing of ffs/fls fails on arc[3]. A patch[2] to GCC to solve this has been sent.
Add a fix for this by handling compile-time constants with the standard __builtin_clzl() builtin (which has const attribute) while preserving the optimized arc-specific builtin for runtime cases. This has the added benefit of skipping runtime calculation of compile-time constant values. Even with the GCC bug fixed (which is about "attribute const") this is a good change to avoid needless runtime costs, and should be done regardless of the state of GCC's bug.
Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
--- arch/arc/include/asm/bitops.h | 2 ++ 1 file changed, 2 insertions(+)
arch/arc/include/asm/bitops.h +2 -0
@@ -133,6 +133,8 @@ static inline __attribute__ ((const)) int fls(unsigned int x)*/ static inline __attribute__ ((const))unsigned long __fls (unsigned long x) { +if (__builtin_constant_p (x)) +return x ?BITS_PER_LONG -1 -__builtin_clzl (x) :0 ;/* FLS insn has exactly same semantics as the API */ return __builtin_arc_fls (x); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/568 selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <[email protected]>
[ Upstream commit 2a912258c90e895363c0ffc0be8a47f112ab67b7 ]
Currently, even if some subtests fails, the end result will still yield "ok 1 selftests: bpf: test_xsk.sh". Fix it by exiting with 1 if there are any failures.
--- tools/testing/selftests/bpf/test_xsk.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/bpf/test_xsk.sh +2 -0
@@ -206,4 +206,6 @@ done if [ $failures -eq 0 ]; then echo "All tests successful!" +else + exit 1 fi
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/568 irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Bruel <[email protected]>
[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the low-order bits of the MSI Message DATA register to encode nr_irqs interrupt numbers in the log2(nr_irqs) bits for the domain.
The problem arises if the base vector (GICV2m base spi) is not aligned with nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base vector conflict with the nr_irqs masking, causing the wrong MSI interrupt to be identified.
To fix this, use bitmap_find_next_zero_area_off() instead of bitmap_find_free_region() to align the initial base vector with nr_irqs.
--- drivers/irqchip/irq-gic-v2m.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/irqchip/irq-gic-v2m.c +9 -4
@@ -178,14 +178,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq, {msi_alloc_info_t *info = args;struct v2m_data *v2m =NULL , *tmp; -int hwirq, offset, i, err =0 ; +int hwirq, i, err =0 ; +unsigned long offset; +unsigned long align_mask = nr_irqs -1 ;spin_lock (&v2m_lock);list_for_each_entry (tmp, &v2m_nodes, entry) { - offset =bitmap_find_free_region (tmp->bm, tmp->nr_spis, -get_count_order (nr_irqs)); -if (offset >=0 ) { +unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask); + + offset =bitmap_find_next_zero_area_off (tmp->bm, tmp->nr_spis,0 , + nr_irqs, align_mask, align_off); +if (offset < tmp->nr_spis) { v2m = tmp; +bitmap_set (v2m->bm, offset, nr_irqs);break ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/568 ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shang song (Lenovo) <[email protected]>
[ Upstream commit 311942ce763e21dacef7e53996d5a1e19b8adab1 ]
If handler_address or mapped VA is NULL, the related buffer address and VA can be ignored, so make acpi_parse_prmt() skip the current handler in those cases.
--- drivers/acpi/prmt.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
drivers/acpi/prmt.c +16 -3
@@ -150,15 +150,28 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end) th = &tm->handlers[cur_handler];guid_copy (&th->guid, (guid_t *)handler_info->handler_guid); + +/* +* Print an error message if handler_address is NULL, the parse of VA also +* can be skipped. +*/ +if (unlikely (!handler_info->handler_address)) { +pr_info ("Skipping handler with NULL address for GUID: %pUL" , + (guid_t *)handler_info->handler_guid); +continue ; + } + th->handler_addr = (void *)efi_pa_va_lookup (&th->guid, handler_info->handler_address);/* -* Print a warning message if handler_addr is zero which is not expected to -* ever happen. +* Print a warning message and skip the parse of VA if handler_addr is zero +* which is not expected to ever happen. */ -if (unlikely (!th->handler_addr)) +if (unlikely (!th->handler_addr)) {pr_warn ("Failed to find VA of handler for GUID: %pUL, PA: 0x%llx" , &th->guid, handler_info->handler_address); +continue ; + } th->static_data_buffer_addr =efi_pa_va_lookup (&th->guid, handler_info->static_data_buffer_address);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/568 ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 4405a214df146775338a1e6232701a29024b82e1 ]
Some x86/ACPI laptops with MIPI cameras have a INTC10DE or INTC10E0 ACPI device in the _DEP dependency list of the ACPI devices for the camera- sensors (which have flags.honor_deps set).
These devices are for an Intel Vision CVS chip for which an out of tree driver is available [1].
The camera sensor works fine without a driver being loaded for this ACPI device on the 2 laptops this was tested on:
ThinkPad X1 Carbon Gen 12 (Meteor Lake)
ThinkPad X1 2-in-1 Gen 10 (Arrow Lake)
For now add these HIDs to acpi_ignore_dep_ids[] so that acpi_dev_ready_for_enumeration() will return true once the other _DEP dependencies are met and an i2c_client for the camera sensor will get instantiated.
--- drivers/acpi/scan.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/acpi/scan.c +2 -0
@@ -785,6 +785,8 @@ static bool acpi_info_matches_ids(struct acpi_device_info *info,static const char *const acpi_ignore_dep_ids[] = {"PNP0D80" ,/* Windows-compatible System Power Management Controller */ "INT33BD" ,/* Intel Baytrail Mailbox Device */ +"INTC10DE" ,/* Intel CVS LNL */ +"INTC10E0" ,/* Intel CVS ARL */ "LATT2021" ,/* Lattice FW Update Client Driver */ NULL };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/568 hwmon: (sbtsi_temp) AMD CPU extended temperature range support
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuande Chen <[email protected]>
[ Upstream commit d9d61f1da35038793156c04bb13f0a1350709121 ]
Many AMD CPUs can support this feature now. We would get a wrong CPU DIE temperature if don't consider this. In low-temperature environments, the CPU die temperature can drop below zero. So many platforms would like to make extended temperature range as their default configuration. Default temperature range (0C to 255.875C).
Extended temperature range (-49C to +206.875C).
Ref Doc: AMD V3000 PPR (Doc ID #56558).
--- drivers/hwmon/sbtsi_temp.c | 46 +++++++++++++++++++++++++------------- 1 file changed, 31 insertions(+), 15 deletions(-)
drivers/hwmon/sbtsi_temp.c +31 -15
@@ -15,6 +15,7 @@#include <linux/mutex.h> #include <linux/of_device.h> #include <linux/of.h> +#include <linux/bitfield.h> /* * SB-TSI registers only support SMBus byte data access. "_INT" registers are
@@ -30,8 +31,22 @@#define SBTSI_REG_TEMP_HIGH_DEC 0x13/* RW */ #define SBTSI_REG_TEMP_LOW_DEC 0x14/* RW */ +/* +* Bit for reporting value with temperature measurement range. +* bit == 0: Use default temperature range (0C to 255.875C). +* bit == 1: Use extended temperature range (-49C to +206.875C). +*/ +#define SBTSI_CONFIG_EXT_RANGE_SHIFT 2 +/* +* ReadOrder bit specifies the reading order of integer and decimal part of +* CPU temperature for atomic reads. If bit == 0, reading integer part triggers +* latching of the decimal part, so integer part should be read first. +* If bit == 1, read order should be reversed. +*/ #define SBTSI_CONFIG_READ_ORDER_SHIFT 5 +#define SBTSI_TEMP_EXT_RANGE_ADJ 49000 +#define SBTSI_TEMP_MIN 0#define SBTSI_TEMP_MAX 255875
@@ -39,6 +54,8 @@struct sbtsi_data {struct i2c_client *client;struct mutex lock; +bool ext_range_mode; +bool read_order; };/*
@@ -75,23 +92,11 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type, {struct sbtsi_data *data =dev_get_drvdata (dev);s32 temp_int, temp_dec; -int err;switch (attr) {case hwmon_temp_input: -/* -* ReadOrder bit specifies the reading order of integer and -* decimal part of CPU temp for atomic reads. If bit == 0, -* reading integer part triggers latching of the decimal part, -* so integer part should be read first. If bit == 1, read -* order should be reversed. -*/ - err =i2c_smbus_read_byte_data (data->client,SBTSI_REG_CONFIG ); -if (err <0 ) -return err; -mutex_lock (&data->lock); -if (err &BIT (SBTSI_CONFIG_READ_ORDER_SHIFT )) { +if (data->read_order) { temp_dec =i2c_smbus_read_byte_data (data->client,SBTSI_REG_TEMP_DEC ); temp_int =i2c_smbus_read_byte_data (data->client,SBTSI_REG_TEMP_INT ); }else {
@@ -123,6 +128,8 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,return temp_dec; *val =sbtsi_reg_to_mc (temp_int, temp_dec); +if (data->ext_range_mode) + *val -=SBTSI_TEMP_EXT_RANGE_ADJ ;return 0 ; }
@@ -147,6 +154,8 @@ static int sbtsi_write(struct device *dev, enum hwmon_sensor_types type,return -EINVAL ; } +if (data->ext_range_mode) + val +=SBTSI_TEMP_EXT_RANGE_ADJ ; val =clamp_val (val,SBTSI_TEMP_MIN ,SBTSI_TEMP_MAX );sbtsi_mc_to_reg (val, &temp_int, &temp_dec);
@@ -205,6 +214,7 @@ static int sbtsi_probe(struct i2c_client *client,struct device *dev = &client->dev;struct device *hwmon_dev;struct sbtsi_data *data; +int err; data =devm_kzalloc (dev,sizeof (struct sbtsi_data ),GFP_KERNEL );if (!data)
@@ -213,8 +223,14 @@ static int sbtsi_probe(struct i2c_client *client, data->client = client;mutex_init (&data->lock); - hwmon_dev =devm_hwmon_device_register_with_info (dev, client->name, data, &sbtsi_chip_info, -NULL ); + err =i2c_smbus_read_byte_data (data->client,SBTSI_REG_CONFIG ); +if (err <0 ) +return err; + data->ext_range_mode =FIELD_GET (BIT (SBTSI_CONFIG_EXT_RANGE_SHIFT ), err); + data->read_order =FIELD_GET (BIT (SBTSI_CONFIG_READ_ORDER_SHIFT ), err); + + hwmon_dev =devm_hwmon_device_register_with_info (dev, client->name, data, + &sbtsi_chip_info,NULL );return PTR_ERR_OR_ZERO (hwmon_dev); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/568 power: supply: sbs-charger: Support multiple devices
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabien Proriol <[email protected]>
[ Upstream commit 3ec600210849cf122606e24caab85f0b936cf63c ]
If we have 2 instances of sbs-charger in the DTS, the driver probe for the second instance will fail:
[ 8.012874] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered [ 8.039094] sbs-charger 18-0009: ltc4100: smart charger device registered [ 8.112911] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered [ 8.134533] sysfs: cannot create duplicate filename '/class/power_supply/sbs-charger' [ 8.143871] CPU: 3 PID: 295 Comm: systemd-udevd Tainted: G O 5.10.147 #22 [ 8.151974] Hardware name: ALE AMB (DT) [ 8.155828] Call trace: [ 8.158292] dump_backtrace+0x0/0x1d4 [ 8.161960] show_stack+0x18/0x6c [ 8.165280] dump_stack+0xcc/0x128 [ 8.168687] sysfs_warn_dup+0x60/0x7c [ 8.172353] sysfs_do_create_link_sd+0xf0/0x100 [ 8.176886] sysfs_create_link+0x20/0x40 [ 8.180816] device_add+0x270/0x7a4 [ 8.184311] __power_supply_register+0x304/0x560 [ 8.188930] devm_power_supply_register+0x54/0xa0 [ 8.193644] sbs_probe+0xc0/0x214 [sbs_charger] [ 8.198183] i2c_device_probe+0x2dc/0x2f4 [ 8.202196] really_probe+0xf0/0x510 [ 8.205774] driver_probe_device+0xfc/0x160 [ 8.209960] device_driver_attach+0xc0/0xcc [ 8.214146] __driver_attach+0xc0/0x170 [ 8.218002] bus_for_each_dev+0x74/0xd4 [ 8.221862] driver_attach+0x24/0x30 [ 8.225444] bus_add_driver+0x148/0x250 [ 8.229283] driver_register+0x78/0x130 [ 8.233140] i2c_register_driver+0x4c/0xe0 [ 8.237250] sbs_driver_init+0x20/0x1000 [sbs_charger] [ 8.242424] do_one_initcall+0x50/0x1b0 [ 8.242434] do_init_module+0x44/0x230 [ 8.242438] load_module+0x2200/0x27c0 [ 8.242442] __do_sys_finit_module+0xa8/0x11c [ 8.242447] __arm64_sys_finit_module+0x20/0x30 [ 8.242457] el0_svc_common.constprop.0+0x64/0x154 [ 8.242464] do_el0_svc+0x24/0x8c [ 8.242474] el0_svc+0x10/0x20 [ 8.242481] el0_sync_handler+0x108/0x114 [ 8.242485] el0_sync+0x180/0x1c0 [ 8.243847] sbs-charger 20-0009: Failed to register power supply [ 8.287934] sbs-charger: probe of 20-0009 failed with error -17
This is mainly because the "name" field of power_supply_desc is a constant. This patch fixes the issue by reusing the same approach as sbs-battery. With this patch, the result is:
[ 7.819532] sbs-charger 18-0009: ltc4100: smart charger device registered [ 7.825305] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered [ 7.887423] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered [ 7.893501] sbs-charger 20-0009: ltc4100: smart charger device registered
--- drivers/power/supply/sbs-charger.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/power/supply/sbs-charger.c +13 -3
@@ -154,8 +154,7 @@ static const struct regmap_config sbs_regmap = { .val_format_endian = REGMAP_ENDIAN_LITTLE, /* since based on SMBus */ }; -static const struct power_supply_desc sbs_desc = { - .name ="sbs-charger" , +static const struct power_supply_desc sbs_default_desc = { .type =POWER_SUPPLY_TYPE_MAINS , .properties = sbs_properties, .num_properties =ARRAY_SIZE (sbs_properties),
@@ -166,9 +165,20 @@ static int sbs_probe(struct i2c_client *client, const struct i2c_device_id *id) {struct power_supply_config psy_cfg = {}; +struct power_supply_desc *sbs_desc;struct sbs_info *chip;int ret, val; + sbs_desc =devm_kmemdup (&client->dev, &sbs_default_desc, +sizeof (*sbs_desc),GFP_KERNEL ); +if (!sbs_desc) +return -ENOMEM ; + + sbs_desc->name =devm_kasprintf (&client->dev,GFP_KERNEL ,"sbs-%s" , +dev_name (&client->dev)); +if (!sbs_desc->name) +return -ENOMEM ; + chip =devm_kzalloc (&client->dev,sizeof (struct sbs_info ),GFP_KERNEL );if (!chip)return -ENOMEM ;
@@ -192,7 +202,7 @@ static int sbs_probe(struct i2c_client *client,return dev_err_probe (&client->dev, ret,"Failed to get device status\n" ); chip->last_state = val; - chip->power_supply =devm_power_supply_register (&client->dev, &sbs_desc, &psy_cfg); + chip->power_supply =devm_power_supply_register (&client->dev, sbs_desc, &psy_cfg);if (IS_ERR (chip->power_supply))return dev_err_probe (&client->dev,PTR_ERR (chip->power_supply),"Failed to register power supply\n" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 105/568 hwmon: sy7636a: add alias
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Kemnade <[email protected]>
[ Upstream commit 80038a758b7fc0cdb6987532cbbf3f75b13e0826 ]
Add module alias to have it autoloaded.
--- drivers/hwmon/sy7636a-hwmon.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/sy7636a-hwmon.c +1 -0
@@ -104,3 +104,4 @@ module_platform_driver(sy7636a_sensor_driver);MODULE_DESCRIPTION ("SY7636A sensor driver" );MODULE_LICENSE ("GPL" ); +MODULE_ALIAS ("platform:sy7636a-temperature" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 106/568 irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Wang <[email protected]>
[ Upstream commit c33c43f71bda362b292a6e57ac41b64342dc87b3 ]
On certain Loongson platforms, drivers attempting to request a legacy ISA IRQ directly via request_irq() (e.g., IRQ 4) may fail. The virtual IRQ descriptor is not fully initialized and lacks a valid irqchip.
This issue does not affect ACPI-enumerated devices described in DSDT, as their interrupts are properly mapped via the GSI translation path. This indicates the LPC irqdomain itself is functional but is not correctly handling direct VIRQ-to-HWIRQ mappings.
The root cause is the use of irq_domain_create_linear(). This API sets up a domain for dynamic, on-demand mapping, typically triggered by a GSI request. It does not pre-populate the mappings for the legacy VIRQ range (0-15). Consequently, if no ACPI device claims a specific GSI (e.g., GSI 4), the corresponding VIRQ (e.g., VIRQ 4) is never mapped to the LPC domain. A direct call to request_irq(4, ...) then fails because the kernel cannot resolve this VIRQ to a hardware interrupt managed by the LPC controller.
The PCH-LPC interrupt controller is an i8259-compatible legacy device that requires a deterministic, static 1-to-1 mapping for IRQs 0-15 to support legacy drivers.
Fix this by replacing irq_domain_create_linear() with irq_domain_create_legacy(). This API is specifically designed for such controllers. It establishes the required static 1-to-1 VIRQ-to-HWIRQ mapping for the entire legacy range (0-15) immediately upon domain creation. This ensures that any VIRQ in this range is always resolvable, making direct calls to request_irq() for legacy IRQs function correctly.
--- drivers/irqchip/irq-loongson-pch-lpc.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/irqchip/irq-loongson-pch-lpc.c +7 -2
@@ -176,8 +176,13 @@ int __init pch_lpc_acpi_init(struct irq_domain *parent, goto iounmap_base; } - priv->lpc_domain =irq_domain_create_linear (irq_handle,LPC_COUNT , - &pch_lpc_domain_ops, priv); +/* +* The LPC interrupt controller is a legacy i8259-compatible device, +* which requires a static 1:1 mapping for IRQs 0-15. +* Use irq_domain_create_legacy to establish this static mapping early. +*/ + priv->lpc_domain =irq_domain_create_legacy (irq_handle,LPC_COUNT ,0 ,0 , + &pch_lpc_domain_ops, priv);if (!priv->lpc_domain) {pr_err ("Failed to create IRQ domain\n" ); goto free_irq_handle;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 107/568 soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Svyatoslav Ryhel <[email protected]>
[ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
Add missing Tegra114 nvmem cells and fuse lookups which were added for Tegra124+ but omitted for Tegra114.
--- drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++++++++++++++++++++++ 1 file changed, 122 insertions(+)
drivers/soc/tegra/fuse/fuse-tegra30.c +122 -0
@@ -117,6 +117,124 @@ const struct tegra_fuse_soc tegra30_fuse_soc = {#endif #ifdef CONFIG_ARCH_TEGRA_114_SOC +static const struct nvmem_cell_info tegra114_fuse_cells[] = { + { + .name ="tsensor-cpu1" , + .offset =0x084 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-cpu2" , + .offset =0x088 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-common" , + .offset =0x08c , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-cpu0" , + .offset =0x098 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="xusb-pad-calibration" , + .offset =0x0f0 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-cpu3" , + .offset =0x12c , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-gpu" , + .offset =0x154 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-mem0" , + .offset =0x158 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-mem1" , + .offset =0x15c , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-pllx" , + .offset =0x160 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, +}; + +static const struct nvmem_cell_lookup tegra114_fuse_lookups[] = { + { + .nvmem_name ="fuse" , + .cell_name ="xusb-pad-calibration" , + .dev_id ="7009f000.padctl" , + .con_id ="calibration" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-common" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="common" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-cpu0" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="cpu0" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-cpu1" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="cpu1" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-cpu2" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="cpu2" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-cpu3" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="cpu3" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-mem0" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="mem0" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-mem1" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="mem1" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-gpu" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="gpu" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-pllx" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="pllx" , + }, +}; +static const struct tegra_fuse_info tegra114_fuse_info = { .read = tegra30_fuse_read, .size = 0x2a0,
@@ -127,6 +245,10 @@ const struct tegra_fuse_soc tegra114_fuse_soc = { .init = tegra30_fuse_init, .speedo_init = tegra114_init_speedo_data, .info = &tegra114_fuse_info, + .lookups = tegra114_fuse_lookups, + .num_lookups = ARRAY_SIZE(tegra114_fuse_lookups), + .cells = tegra114_fuse_cells, + .num_cells = ARRAY_SIZE(tegra114_fuse_cells), .soc_attr_group = &tegra_soc_attr_group, .clk_suspend_on = false, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 108/568 mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarthak Garg <[email protected]>
[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
For Qualcomm SoCs which needs level shifter for SD card, extra delay is seen on receiver data path.
To compensate this delay enable tuning for SDR50 mode for targets which has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets with level shifter on Qualcomm SOC's.
--- drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/mmc/host/sdhci-msm.c +15 -0
@@ -79,6 +79,7 @@#define CORE_IO_PAD_PWR_SWITCH_EN BIT(15)#define CORE_IO_PAD_PWR_SWITCH BIT(16)#define CORE_HC_SELECT_IN_EN BIT(18) +#define CORE_HC_SELECT_IN_SDR50 (4 << 19)#define CORE_HC_SELECT_IN_HS400 (6 << 19)#define CORE_HC_SELECT_IN_MASK (7 << 19)
@@ -1129,6 +1130,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host) {struct mmc_ios *ios = &host->mmc->ios; +if (ios->timing ==MMC_TIMING_UHS_SDR50 && + host->flags &SDHCI_SDR50_NEEDS_TUNING ) +return true; +/* * Tuning is required for SDR104, HS200 and HS400 cards and * if clock frequency is greater than 100MHz in these modes.
@@ -1197,6 +1202,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)struct mmc_ios ios = host->mmc->ios;struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host);struct sdhci_msm_host *msm_host =sdhci_pltfm_priv (pltfm_host); +const struct sdhci_msm_offset *msm_offset = msm_host->offset; +u32 config;if (!sdhci_msm_is_tuning_needed (host)) { msm_host->use_cdr = false;
@@ -1213,6 +1220,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)*/ msm_host->tuning_done =0 ; +if (ios.timing ==MMC_TIMING_UHS_SDR50 && + host->flags &SDHCI_SDR50_NEEDS_TUNING ) { + config =readl_relaxed (host->ioaddr + msm_offset->core_vendor_spec); + config &= ~CORE_HC_SELECT_IN_MASK ; + config |=CORE_HC_SELECT_IN_EN |CORE_HC_SELECT_IN_SDR50 ; +writel_relaxed (config, host->ioaddr + msm_offset->core_vendor_spec); + } +/* * For HS400 tuning in HS200 timing requires: * - select MCLK/2 in VENDOR_SPEC
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 109/568 ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
When deleting the previous walkstate operand stack acpi_ds_call_control_method() was deleting obj_desc->Method.param_count operands. But Method.param_count does not necessarily match this_walk_state->num_operands, it may be either less or more.
After correcting the for loop to check i < this_walk_state->num_operands the code is identical to acpi_ds_clear_operands(), so just outright replace the code with acpi_ds_clear_operands() to fix this.
--- drivers/acpi/acpica/dsmethod.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
drivers/acpi/acpica/dsmethod.c +1 -8
@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,* Delete the operands on the previous walkstate operand stack * (they were copied to new objects) */ -for (i =0 ; i < obj_desc->method.param_count; i++) { -acpi_ut_remove_reference (this_walk_state->operands[i]); - this_walk_state->operands[i] =NULL ; - } - -/* Clear the operand stack */ - - this_walk_state->num_operands =0 ; +acpi_ds_clear_operands (this_walk_state); ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH, "**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 110/568 tee: allow a driver to allocate a tee_device without a pool
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amirreza Zarrabi <[email protected]>
[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
A TEE driver doesn't always need to provide a pool if it doesn't support memory sharing ioctls and can allocate memory for TEE messages in another way. Although this is mentioned in the documentation for tee_device_alloc(), it is not handled correctly.
--- drivers/tee/tee_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tee/tee_core.c +1 -1
@@ -889,7 +889,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,if (!teedesc || !teedesc->name || !teedesc->ops || !teedesc->ops->get_version || !teedesc->ops->open || - !teedesc->ops->release || !pool) + !teedesc->ops->release)return ERR_PTR (-EINVAL ); teedev =kzalloc (sizeof (*teedev),GFP_KERNEL );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 111/568 nvmet-fc: avoid scheduling association deletion twice
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <[email protected]>
[ Upstream commit f2537be4f8421f6495edfa0bc284d722f253841d ]
When forcefully shutting down a port via the configfs interface, nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and then nvmet_disable_port(). Both functions will eventually schedule all remaining associations for deletion.
The current implementation checks whether an association is about to be removed, but only after the work item has already been scheduled. As a result, it is possible for the first scheduled work item to free all resources, and then for the same work item to be scheduled again for deletion.
Because the association list is an RCU list, it is not possible to take a lock and remove the list entry directly, so it cannot be looked up again. Instead, a flag (terminating) must be used to determine whether the association is already in the process of being deleted.
--- drivers/nvme/target/fc.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/nvme/target/fc.c +9 -7
@@ -1090,6 +1090,14 @@ nvmet_fc_delete_assoc_work(struct work_struct *work)static void nvmet_fc_schedule_delete_assoc (struct nvmet_fc_tgt_assoc *assoc) { +int terminating; + + terminating =atomic_xchg (&assoc->terminating,1 ); + +/* if already terminating, do nothing */ +if (terminating) +return ; +nvmet_fc_tgtport_get (assoc->tgtport);if (!queue_work (nvmet_wq, &assoc->del_work))nvmet_fc_tgtport_put (assoc->tgtport);
@@ -1209,13 +1217,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc) {struct nvmet_fc_tgtport *tgtport = assoc->tgtport;unsigned long flags; -int i, terminating; - - terminating =atomic_xchg (&assoc->terminating,1 ); - -/* if already terminating, do nothing */ -if (terminating) -return ; +int i;spin_lock_irqsave (&tgtport->lock, flags);list_del_rcu (&assoc->a_list);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 112/568 nvme-fc: use lock accessing port_state and rport state
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <[email protected]>
[ Upstream commit 891cdbb162ccdb079cd5228ae43bdeebce8597ad ]
nvme_fc_unregister_remote removes the remote port on a lport object at any point in time when there is no active association. This races with with the reconnect logic, because nvme_fc_create_association is not taking a lock to check the port_state and atomically increase the active count on the rport.
--- drivers/nvme/host/fc.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/nvme/host/fc.c +8 -2
@@ -3048,11 +3048,17 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl) ++ctrl->ctrl.nr_reconnects; -if (ctrl->rport->remoteport.port_state !=FC_OBJSTATE_ONLINE ) +spin_lock_irqsave (&ctrl->rport->lock, flags); +if (ctrl->rport->remoteport.port_state !=FC_OBJSTATE_ONLINE ) { +spin_unlock_irqrestore (&ctrl->rport->lock, flags);return -ENODEV ; + } -if (nvme_fc_ctlr_active_on_rport (ctrl)) +if (nvme_fc_ctlr_active_on_rport (ctrl)) { +spin_unlock_irqrestore (&ctrl->rport->lock, flags);return -ENOTUNIQ ; + } +spin_unlock_irqrestore (&ctrl->rport->lock, flags);dev_info (ctrl->ctrl.device, "NVME-FC{%d}: create association : host wwpn 0x%016llx "
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 113/568 video: backlight: lp855x_bl: Set correct EPROM start for LP8556
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Svyatoslav Ryhel <[email protected]>
[ Upstream commit 07c7efda24453e05951fb2879f5452b720b91169 ]
According to LP8556 datasheet EPROM region starts at 0x98 so adjust value in the driver accordingly.
--- drivers/video/backlight/lp855x_bl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/backlight/lp855x_bl.c +1 -1
@@ -22,7 +22,7 @@#define LP855X_DEVICE_CTRL 0x01#define LP855X_EEPROM_START 0xA0#define LP855X_EEPROM_END 0xA7 -#define LP8556_EPROM_START 0xA0 +#define LP8556_EPROM_START 0x98#define LP8556_EPROM_END 0xAF/* LP8555/7 Registers */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 114/568 tools/cpupower: fix error return value in cpupower_write_sysfs()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <[email protected]>
[ Upstream commit 57b100d4cf14276e0340eecb561005c07c129eb8 ]
The cpupower_write_sysfs() function currently returns -1 on write failure, but the function signature indicates it should return an unsigned int. Returning -1 from an unsigned function results in a large positive value rather than indicating an error condition.
Fix this by returning 0 on failure, which is more appropriate for an unsigned return type and maintains consistency with typical success/failure semantics where 0 indicates failure and non-zero indicates success (bytes written).
--- tools/power/cpupower/lib/cpupower.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/power/cpupower/lib/cpupower.c +1 -1
@@ -48,7 +48,7 @@ unsigned int cpupower_write_sysfs(const char *path, char *buf, size_t buflen)if (numwritten <1 ) {perror (path);close (fd); -return -1 ; +return 0 ; }close (fd);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 115/568 bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Stellard <[email protected]>
[ Upstream commit 5612ea8b554375d45c14cbb0f8ea93ec5d172891 ]
This fixes the build with -Werror -Wall.
btf_dumper.c:71:31: error: variable 'finfo' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
71 | info.func_info = ptr_to_u64(&finfo);
| ^~~~~
prog.c:2294:31: error: variable 'func_info' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
2294 | info.func_info = ptr_to_u64(&func_info);
|v2:
- Initialize instead of using memset.
--- tools/bpf/bpftool/btf_dumper.c | 2 +- tools/bpf/bpftool/prog.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
tools/bpf/bpftool/btf_dumper.c +1 -1
@@ -38,7 +38,7 @@ static int dump_prog_id_as_func_ptr(const struct btf_dumper *d,__u32 info_len =sizeof (info);const char *prog_name =NULL ;struct btf *prog_btf =NULL ; -struct bpf_func_info finfo; +struct bpf_func_info finfo = {};__u32 finfo_rec_size;char prog_str[1024 ];int err;
tools/bpf/bpftool/prog.c +1 -1
@@ -2104,7 +2104,7 @@ static void profile_print_readings(void)static char *profile_target_name (int tgt_fd) { -struct bpf_func_info func_info; +struct bpf_func_info func_info = {};struct bpf_prog_info info = {};__u32 info_len =sizeof (info);const struct btf_type *t;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 116/568 cpuidle: Fail cpuidle device registration if there is one already
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 7b1b7961170e4fcad488755e5ffaaaf9bd527e8f ]
Refuse to register a cpuidle device if the given CPU has a cpuidle device already and print a message regarding it.
Without this, an attempt to register a new cpuidle device without unregistering the existing one leads to the removal of the existing cpuidle device without removing its sysfs interface.
--- drivers/cpuidle/cpuidle.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/cpuidle/cpuidle.c +7 -1
@@ -602,8 +602,14 @@ static void __cpuidle_device_init(struct cpuidle_device *dev)static int __cpuidle_register_device (struct cpuidle_device *dev) {struct cpuidle_driver *drv =cpuidle_get_cpu_driver (dev); +unsigned int cpu = dev->cpu;int i, ret; +if (per_cpu (cpuidle_devices, cpu)) { +pr_info ("CPU%d: cpuidle device already registered\n" , cpu); +return -EEXIST ; + } +if (!try_module_get (drv->owner))return -EINVAL ;
@@ -615,7 +621,7 @@ static int __cpuidle_register_device(struct cpuidle_device *dev) dev->states_usage[i].disable |=CPUIDLE_STATE_DISABLED_BY_USER ; } -per_cpu (cpuidle_devices, dev->cpu) = dev; +per_cpu (cpuidle_devices, cpu) = dev;list_add (&dev->device_list, &cpuidle_detected_devices); ret =cpuidle_coupled_register_device (dev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 117/568 futex: Dont leak robust_list pointer on exec race
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pranav Tyagi <[email protected]>
[ Upstream commit 6b54082c3ed4dc9821cdf0edb17302355cc5bb45 ]
sys_get_robust_list() and compat_get_robust_list() use ptrace_may_access() to check if the calling task is allowed to access another task's robust_list pointer. This check is racy against a concurrent exec() in the target process.
During exec(), a task may transition from a non-privileged binary to a privileged one (e.g., setuid binary) and its credentials/memory mappings may change. If get_robust_list() performs ptrace_may_access() before this transition, it may erroneously allow access to sensitive information after the target becomes privileged.
A racy access allows an attacker to exploit a window during which ptrace_may_access() passes before a target process transitions to a privileged state via exec().
For example, consider a non-privileged task T that is about to execute a setuid-root binary. An attacker task A calls get_robust_list(T) while T is still unprivileged. Since ptrace_may_access() checks permissions based on current credentials, it succeeds. However, if T begins exec immediately afterwards, it becomes privileged and may change its memory mappings. Because get_robust_list() proceeds to access T->robust_list without synchronizing with exec() it may read user-space pointers from a now-privileged process.
This violates the intended post-exec access restrictions and could expose sensitive memory addresses or be used as a primitive in a larger exploit chain. Consequently, the race can lead to unauthorized disclosure of information across privilege boundaries and poses a potential security risk.
Take a read lock on signal->exec_update_lock prior to invoking ptrace_may_access() and accessing the robust_list/compat_robust_list. This ensures that the target task's exec state remains stable during the check, allowing for consistent and synchronized validation of credentials.
--- kernel/futex/syscalls.c | 106 +++++++++++++++++++++------------------- 1 file changed, 56 insertions(+), 50 deletions(-)
kernel/futex/syscalls.c +56 -50
@@ -40,6 +40,56 @@ SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,return 0 ; } +static inline void __user *futex_task_robust_list (struct task_struct *p,bool compat) +{ +#ifdef CONFIG_COMPAT +if (compat) +return p->compat_robust_list; +#endif +return p->robust_list; +} + +static void __user *futex_get_robust_list_common (int pid,bool compat) +{ +struct task_struct *p = current; +void __user *head; +int ret; + +scoped_guard (rcu) { +if (pid) { + p =find_task_by_vpid (pid); +if (!p) +return (void __user *)ERR_PTR (-ESRCH ); + } +get_task_struct (p); + } + +/* +* Hold exec_update_lock to serialize with concurrent exec() +* so ptrace_may_access() is checked against stable credentials +*/ + ret =down_read_killable (&p->signal->exec_update_lock); +if (ret) + goto err_put; + + ret = -EPERM ; +if (!ptrace_may_access (p,PTRACE_MODE_READ_REALCREDS )) + goto err_unlock; + + head =futex_task_robust_list (p, compat); + +up_read (&p->signal->exec_update_lock); +put_task_struct (p); + +return head; + +err_unlock: +up_read (&p->signal->exec_update_lock); +err_put: +put_task_struct (p); +return (void __user *)ERR_PTR (ret); +} +/** * sys_get_robust_list() - Get the robust-futex list head of a task * @pid: pid of the process [zero for current task]
@@ -50,36 +100,14 @@ SYSCALL_DEFINE3(get_robust_list, int, pid, struct robust_list_head __user * __user *, head_ptr, size_t __user *, len_ptr) { - struct robust_list_head __user *head; -unsigned long ret; -struct task_struct *p; - -rcu_read_lock (); - - ret = -ESRCH ; -if (!pid) - p = current; -else { - p =find_task_by_vpid (pid); -if (!p) - goto err_unlock; - } - - ret = -EPERM ; -if (!ptrace_may_access (p,PTRACE_MODE_READ_REALCREDS )) - goto err_unlock; + struct robust_list_head __user *head = futex_get_robust_list_common(pid, false); - head = p->robust_list; -rcu_read_unlock (); +if (IS_ERR (head)) +return PTR_ERR (head);if (put_user (sizeof (*head), len_ptr))return -EFAULT ;return put_user (head, head_ptr); - -err_unlock: -rcu_read_unlock (); - -return ret; } long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
@@ -322,36 +350,14 @@ COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid, compat_uptr_t __user *, head_ptr, compat_size_t __user *, len_ptr) { -struct compat_robust_list_head __user *head; -unsigned long ret; -struct task_struct *p; - -rcu_read_lock (); - - ret = -ESRCH ; -if (!pid) - p = current; -else { - p =find_task_by_vpid (pid); -if (!p) - goto err_unlock; - } - - ret = -EPERM ; -if (!ptrace_may_access (p,PTRACE_MODE_READ_REALCREDS )) - goto err_unlock; +struct compat_robust_list_head __user *head =futex_get_robust_list_common (pid, true); - head = p->compat_robust_list; -rcu_read_unlock (); +if (IS_ERR (head)) +return PTR_ERR (head);if (put_user (sizeof (*head), len_ptr))return -EFAULT ;return put_user (ptr_to_compat (head), head_ptr); - -err_unlock: -rcu_read_unlock (); - -return ret; }#endif /* CONFIG_COMPAT */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 118/568 spi: rpc-if: Add resume support for RZ/G3E
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit ad4728740bd68d74365a43acc25a65339a9b2173 ]
On RZ/G3E using PSCI, s2ram powers down the SoC. After resume, reinitialize the hardware for SPI operations.
--- drivers/spi/spi-rpc-if.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/spi/spi-rpc-if.c +2 -0
@@ -195,6 +195,8 @@ static int __maybe_unused rpcif_spi_resume(struct device *dev) {struct spi_controller *ctlr =dev_get_drvdata (dev); +rpcif_hw_init (dev, false); +return spi_controller_resume (ctlr); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 119/568 clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Lezcano <[email protected]>
[ Upstream commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c ]
The driver uses the raw_readl() and raw_writel() functions. Those are not for MMIO devices. Replace them with readl() and writel()
[ dlezcano: Fixed typo in the subject s/reald/readl/ ]
--- drivers/clocksource/timer-vf-pit.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
drivers/clocksource/timer-vf-pit.c +11 -11
@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy;static inline void pit_timer_enable (void ) { -__raw_writel (PITTCTRL_TEN |PITTCTRL_TIE , clkevt_base +PITTCTRL ); +writel (PITTCTRL_TEN |PITTCTRL_TIE , clkevt_base +PITTCTRL ); }static inline void pit_timer_disable (void ) { -__raw_writel (0 , clkevt_base +PITTCTRL ); +writel (0 , clkevt_base +PITTCTRL ); }static inline void pit_irq_acknowledge (void ) { -__raw_writel (PITTFLG_TIF , clkevt_base +PITTFLG ); +writel (PITTFLG_TIF , clkevt_base +PITTFLG ); } static u64 notrace pit_read_sched_clock(void) { -return ~__raw_readl (clksrc_base +PITCVAL ); +return ~readl (clksrc_base +PITCVAL ); }static int __init pit_clocksource_init (unsigned long rate) {/* set the max load value and start the clock source counter */ -__raw_writel (0 , clksrc_base +PITTCTRL ); -__raw_writel (~0UL , clksrc_base +PITLDVAL ); -__raw_writel (PITTCTRL_TEN , clksrc_base +PITTCTRL ); +writel (0 , clksrc_base +PITTCTRL ); +writel (~0UL , clksrc_base +PITLDVAL ); +writel (PITTCTRL_TEN , clksrc_base +PITTCTRL );sched_clock_register (pit_read_sched_clock,32 , rate); return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta,* hardware requirement. */ pit_timer_disable (); -__raw_writel (delta -1 , clkevt_base +PITLDVAL ); +writel (delta -1 , clkevt_base +PITLDVAL );pit_timer_enable ();return 0 ;
@@ -125,8 +125,8 @@ static struct clock_event_device clockevent_pit = {static int __init pit_clockevent_init (unsigned long rate,int irq) { -__raw_writel (0 , clkevt_base +PITTCTRL ); -__raw_writel (PITTFLG_TIF , clkevt_base +PITTFLG ); +writel (0 , clkevt_base +PITTCTRL ); +writel (PITTFLG_TIF , clkevt_base +PITTFLG );BUG_ON (request_irq (irq, pit_timer_interrupt,IRQF_TIMER |IRQF_IRQPOLL ,"VF pit timer" , &clockevent_pit));
@@ -183,7 +183,7 @@ static int __init pit_timer_init(struct device_node *np) cycle_per_jiffy = clk_rate / (HZ );/* enable the pit module */ -__raw_writel (~PITMCR_MDIS , timer_base +PITMCR ); +writel (~PITMCR_MDIS , timer_base +PITMCR ); ret =pit_clocksource_init (clk_rate);if (ret)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 120/568 bpf: Clear pfmemalloc flag when freeing all fragments
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amery Hung <[email protected]>
[ Upstream commit 8f12d1137c2382c80aada8e05d7cc650cd4e403c ]
It is possible for bpf_xdp_adjust_tail() to free all fragments. The kfunc currently clears the XDP_FLAGS_HAS_FRAGS bit, but not XDP_FLAGS_FRAGS_PF_MEMALLOC. So far, this has not caused a issue when building sk_buff from xdp_buff since all readers of xdp_buff->flags use the flag only when there are fragments. Clear the XDP_FLAGS_FRAGS_PF_MEMALLOC bit as well to make the flags correct.
--- include/net/xdp.h | 5 +++++ net/core/filter.c | 1 + 2 files changed, 6 insertions(+)
include/net/xdp.h +5 -0
@@ -110,6 +110,11 @@ static __always_inline void xdp_buff_set_frag_pfmemalloc(struct xdp_buff *xdp) xdp->flags |=XDP_FLAGS_FRAGS_PF_MEMALLOC ; } +static __always_inline void xdp_buff_clear_frag_pfmemalloc(struct xdp_buff *xdp) +{ + xdp->flags &= ~XDP_FLAGS_FRAGS_PF_MEMALLOC ; +} + static __always_inline voidxdp_init_buff (struct xdp_buff *xdp,u32 frame_sz,struct xdp_rxq_info *rxq) {
net/core/filter.c +1 -0
@@ -4118,6 +4118,7 @@ static int bpf_xdp_frags_shrink_tail(struct xdp_buff *xdp, int offset)if (unlikely (!sinfo->nr_frags)) {xdp_buff_clear_frags_flag (xdp); +xdp_buff_clear_frag_pfmemalloc (xdp); xdp->data_end -= offset; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 121/568 nvme: Use non zero KATO for persistent discovery connections
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alistair Francis <[email protected]>
[ Upstream commit 2e482655019ab6fcfe8865b62432c6d03f0b5f80 ]
The NVMe Base Specification 2.1 states that:
"""
A host requests an explicit persistent connection ... by specifying a non-zero Keep Alive Timer value in the Connect command. """
As such if we are starting a persistent connection to a discovery controller and the KATO is currently 0 we need to update KATO to a non zero value to avoid continuous timeouts on the target.
--- drivers/nvme/host/core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/nvme/host/core.c +7 -1
@@ -5131,8 +5131,14 @@ void nvme_start_ctrl(struct nvme_ctrl *ctrl)* checking that they started once before, hence are reconnecting back. */ if (test_bit (NVME_CTRL_STARTED_ONCE , &ctrl->flags) && -nvme_discovery_ctrl (ctrl)) +nvme_discovery_ctrl (ctrl)) { +if (!ctrl->kato) { +nvme_stop_keep_alive (ctrl); + ctrl->kato =NVME_DEFAULT_KATO ; +nvme_start_keep_alive (ctrl); + }nvme_change_uevent (ctrl,"NVME_EVENT=rediscover" ); + }if (ctrl->queue_count >1 ) {nvme_queue_scan (ctrl);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 122/568 uprobe: Do not emulate/sstep original instruction when ip is changed
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]
If uprobe handler changes instruction pointer we still execute single step) or emulate the original instruction and increment the (new) ip with its length.
This makes the new instruction pointer bogus and application will likely crash on illegal instruction execution.
If user decided to take execution elsewhere, it makes little sense to execute the original instruction, so let's skip it.
--- kernel/events/uprobes.c | 7 +++++++ 1 file changed, 7 insertions(+)
kernel/events/uprobes.c +7 -0
@@ -2248,6 +2248,13 @@ static void handle_swbp(struct pt_regs *regs)handler_chain (uprobe, regs); +/* +* If user decided to take execution elsewhere, it makes little sense +* to execute the original instruction, so let's skip it. +*/ +if (instruction_pointer (regs) != bp_vaddr) + goto out; +if (arch_uprobe_skip_sstep (&uprobe->arch, regs)) goto out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 123/568 hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Copeland <[email protected]>
[ Upstream commit 584d55be66ef151e6ef9ccb3dcbc0a2155559be1 ]
Some motherboards require more time to acquire the ACPI mutex, causing "Failed to acquire mutex" messages to appear in the kernel log. Increase the timeout from 500ms to 800ms to accommodate these cases.
--- drivers/hwmon/asus-ec-sensors.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/asus-ec-sensors.c +1 -1
@@ -49,7 +49,7 @@ static char *mutex_path_override;*/ #define ASUS_EC_MAX_BANK 3 -#define ACPI_LOCK_DELAY_MS 500 +#define ACPI_LOCK_DELAY_MS 800/* ACPI mutex for locking access to the EC for the firmware */ #define ASUS_HW_ACCESS_MUTEX_ASMX "\\AMW0.ASMX"
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 124/568 hwmon: (dell-smm) Add support for Dell OptiPlex 7040
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 53d3bd48ef6ff1567a75ca77728968f5ab493cb4 ]
The Dell OptiPlex 7040 supports the legacy SMM interface for reading sensors and performing fan control. Whitelist this machine so that this driver loads automatically.
--- drivers/hwmon/dell-smm-hwmon.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/hwmon/dell-smm-hwmon.c +7 -0
@@ -1158,6 +1158,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = { }, .driver_data = (void *)&i8k_config_data[DELL_PRECISION_490], }, + { + .ident = "Dell OptiPlex 7040", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7040"), + }, + }, { .ident ="Dell Precision" , .matches = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 125/568 tools/cpupower: Fix incorrect size in cpuidle_state_disable()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <[email protected]>
[ Upstream commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 ]
Fix incorrect size parameter passed to cpuidle_state_write_file() in cpuidle_state_disable().
The function was incorrectly using sizeof(disable) which returns the size of the unsigned int variable (4 bytes) instead of the actual length of the string stored in the 'value' buffer.
Since 'value' is populated with snprintf() to contain the string representation of the disable value, we should use the length returned by snprintf() to get the correct string length for writing to the sysfs file.
This ensures the correct number of bytes is written to the cpuidle state disable file in sysfs.
--- tools/power/cpupower/lib/cpuidle.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
tools/power/cpupower/lib/cpuidle.c +3 -2
@@ -231,6 +231,7 @@ int cpuidle_state_disable(unsigned int cpu, {char value[SYSFS_PATH_MAX ];int bytes_written; +int len;if (cpuidle_state_count (cpu) <= idlestate)return -1 ;
@@ -239,10 +240,10 @@ int cpuidle_state_disable(unsigned int cpu, idlestate_value_files[IDLESTATE_DISABLE]))return -2 ; -snprintf (value,SYSFS_PATH_MAX ,"%u" , disable); + len =snprintf (value,SYSFS_PATH_MAX ,"%u" , disable); bytes_written =cpuidle_state_write_file (cpu, idlestate,"disable" , - value,sizeof (disable)); + value, len);if (bytes_written)return 0 ;return -3 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 126/568 tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <[email protected]>
[ Upstream commit 62127655b7ab7b8c2997041aca48a81bf5c6da0c ]
The fopen_or_die() function was previously hardcoded to open files in read-only mode ("r"), ignoring the mode parameter passed to it. This patch corrects fopen_or_die() to use the provided mode argument, allowing for flexible file access as intended.
Additionally, the call to fopen_or_die() inerr_on_hypervisor() incorrectly used the mode
"ro", which is not a valid fopen mode. This is
fixed to use the correct "r" mode.
--- .../power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c +2 -2
@@ -630,7 +630,7 @@ void cmdline(int argc, char **argv)*/ FILE *fopen_or_die (const char *path,const char *mode) { -FILE *filep =fopen (path,"r" ); +FILE *filep =fopen (path, mode);if (!filep)err (1 ,"%s: open failed" , path);
@@ -644,7 +644,7 @@ void err_on_hypervisor(void)char *buffer;/* On VMs /proc/cpuinfo contains a "flags" entry for hypervisor */ - cpuinfo =fopen_or_die ("/proc/cpuinfo" ,"ro" ); + cpuinfo =fopen_or_die ("/proc/cpuinfo" ,"r" ); buffer =malloc (4096 );if (!buffer) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 127/568 tools/power x86_energy_perf_policy: Enhance HWP enable
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Len Brown <[email protected]>
[ Upstream commit c97c057d357c4b39b153e9e430bbf8976e05bd4e ]
On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE.
Also, skip writing the MSR_PM_ENABLE if HWP is already enabled.
--- .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c +9 -4
@@ -1166,13 +1166,18 @@ int update_hwp_request_pkg(int pkg)int enable_hwp_on_cpu (int cpu) { -unsigned long long msr; +unsigned long long old_msr, new_msr; + +get_msr (cpu,MSR_PM_ENABLE , &old_msr); + +if (old_msr &1 ) +return 0 ;/* already enabled */ -get_msr (cpu,MSR_PM_ENABLE , &msr); -put_msr (cpu,MSR_PM_ENABLE ,1 ); + new_msr = old_msr |1 ; +put_msr (cpu,MSR_PM_ENABLE , new_msr);if (verbose) -printf ("cpu%d: MSR_PM_ENABLE old: %d new: %d\n" , cpu, (unsigned int ) msr,1 ); +printf ("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n" , cpu, old_msr, new_msr);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 128/568 tools/power x86_energy_perf_policy: Prefer driver HWP limits
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Len Brown <[email protected]>
[ Upstream commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 ]
When we are successful in using cpufreq min/max limits, skip setting the raw MSR limits entirely.
This is necessary to avoid undoing any modification that the cpufreq driver makes to our sysfs request.
eg. intel_pstate may take our request for a limit that is valid according to HWP.CAP.MIN/MAX and clip it to be within the range available in PLATFORM_INFO.
--- .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c +9 -4
@@ -62,6 +62,7 @@ unsigned char turbo_update_value;unsigned char update_hwp_epp;unsigned char update_hwp_min;unsigned char update_hwp_max; +unsigned char hwp_limits_done_via_sysfs;unsigned char update_hwp_desired;unsigned char update_hwp_window;unsigned char update_hwp_use_pkg;
@@ -951,8 +952,10 @@ int ratio_2_sysfs_khz(int ratio) }/* * If HWP is enabled and cpufreq sysfs attribtes are present, -* then update sysfs, so that it will not become -* stale when we write to MSRs. +* then update via sysfs. The intel_pstate driver may modify (clip) +* this request, say, when HWP_CAP is outside of PLATFORM_INFO limits, +* and the driver-chosen value takes precidence. +* * (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq, * so we don't have to touch that.) */
@@ -1007,6 +1010,8 @@ int update_sysfs(int cpu)if (update_hwp_max)update_cpufreq_scaling_freq (1 , cpu, req_update.hwp_max); + hwp_limits_done_via_sysfs =1 ; +return 0 ; }
@@ -1085,10 +1090,10 @@ int update_hwp_request(int cpu)if (debug)print_hwp_request (cpu, &req,"old: " ); -if (update_hwp_min) +if (update_hwp_min && !hwp_limits_done_via_sysfs) req.hwp_min = req_update.hwp_min; -if (update_hwp_max) +if (update_hwp_max && !hwp_limits_done_via_sysfs) req.hwp_max = req_update.hwp_max;if (update_hwp_desired)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 129/568 mfd: stmpe: Remove IRQ domain upon removal
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d ]
The IRQ domain is (optionally) added during stmpe_probe, but never removed. Add the call to stmpe_remove.
--- drivers/mfd/stmpe.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mfd/stmpe.c +3 -0
@@ -1485,6 +1485,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)void stmpe_remove (struct stmpe *stmpe) { +if (stmpe->domain) +irq_domain_remove (stmpe->domain); +if (!IS_ERR (stmpe->vio) &®ulator_is_enabled (stmpe->vio))regulator_disable (stmpe->vio);if (!IS_ERR (stmpe->vcc) &®ulator_is_enabled (stmpe->vcc))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 130/568 mfd: stmpe-i2c: Add missing MODULE_LICENSE
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 ]
This driver is licensed GPL-2.0-only, so add the corresponding module flag.
--- drivers/mfd/stmpe-i2c.c | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/stmpe-i2c.c +1 -0
@@ -139,3 +139,4 @@ module_exit(stmpe_exit);MODULE_LICENSE ("GPL v2" );MODULE_DESCRIPTION ("STMPE MFD I2C Interface Driver" );MODULE_AUTHOR ("Rabin Vincent <[email protected]>" ); +MODULE_LICENSE ("GPL" );
Signature · 1 line
2.51.0