6.6.141-rc1 review
Subsystems (8)
Greg Kroah-Hartman
maintainerPATCH 112/508 padata: Remove cpu online check from cpu add and removal
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuyi Zhou <[email protected]>
[ Upstream commit 73117ea6470dca787f70f33c001f9faf437a1c0b ]
During the CPU offline process, the dying CPU is cleared from the cpu_online_mask in takedown_cpu(). After this step, various CPUHP_*_DEAD callbacks are executed to perform cleanup jobs for the dead CPU, so this cpu online check in padata_cpu_dead() is unnecessary.
Similarly, when executing padata_cpu_online() during the CPUHP_AP_ONLINE_DYN phase, the CPU has already been set in the cpu_online_mask, the action even occurs earlier than the CPUHP_AP_ONLINE_IDLE stage.
Remove this unnecessary cpu online check in __padata_add_cpu() and __padata_remove_cpu().
Stable-dep-of: c8c4a2972f83 ("padata: Put CPU offline callback in ONLINE section to allow failure")
--- kernel/padata.c | 26 ++++++++------------------ 1 file changed, 8 insertions(+), 18 deletions(-)
kernel/padata.c +8 -18
@@ -745,32 +745,22 @@ EXPORT_SYMBOL(padata_set_cpumask);static int __padata_add_cpu (struct padata_instance *pinst,int cpu) { -int err =0 ; - -if (cpumask_test_cpu (cpu, cpu_online_mask)) { - err =padata_replace (pinst); +int err =padata_replace (pinst); -if (padata_validate_cpumask (pinst, pinst->cpumask.pcpu) && -padata_validate_cpumask (pinst, pinst->cpumask.cbcpu)) -__padata_start (pinst); - } +if (padata_validate_cpumask (pinst, pinst->cpumask.pcpu) && +padata_validate_cpumask (pinst, pinst->cpumask.cbcpu)) +__padata_start (pinst);return err; }static int __padata_remove_cpu (struct padata_instance *pinst,int cpu) { -int err =0 ; - -if (!cpumask_test_cpu (cpu, cpu_online_mask)) { -if (!padata_validate_cpumask (pinst, pinst->cpumask.pcpu) || - !padata_validate_cpumask (pinst, pinst->cpumask.cbcpu)) -__padata_stop (pinst); - - err =padata_replace (pinst); - } +if (!padata_validate_cpumask (pinst, pinst->cpumask.pcpu) || + !padata_validate_cpumask (pinst, pinst->cpumask.cbcpu)) +__padata_stop (pinst); -return err; +return padata_replace (pinst); }static inline int pinst_has_cpu (struct padata_instance *pinst,int cpu)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 113/508 padata: Put CPU offline callback in ONLINE section to allow failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Jordan <[email protected]>
[ Upstream commit c8c4a2972f83c8b68ff03b43cecdb898939ff851 ]
syzbot reported the following warning:
DEAD callback error for CPU1
WARNING: kernel/cpu.c:1463 at _cpu_down+0x759/0x1020 kernel/cpu.c:1463, CPU#0: syz.0.1960/14614
at commit 4ae12d8bd9a8 ("Merge tag 'kbuild-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux")
which tglx traced to padata_cpu_dead() given it's the only
sub-CPUHP_TEARDOWN_CPU callback that returns an error.
Failure isn't allowed in hotplug states before CPUHP_TEARDOWN_CPU so move the CPU offline callback to the ONLINE section where failure is possible.
--- include/linux/cpuhotplug.h | 1 - include/linux/padata.h | 8 +-- kernel/padata.c | 120 +++++++++++++++++++------------------ 3 files changed, 65 insertions(+), 64 deletions(-)
include/linux/cpuhotplug.h +0 -1
@@ -98,7 +98,6 @@ enum cpuhp_state {CPUHP_IOMMU_IOVA_DEAD ,CPUHP_LUSTRE_CFS_DEAD ,CPUHP_AP_ARM_CACHE_B15_RAC_DEAD , -CPUHP_PADATA_DEAD ,CPUHP_AP_DTPM_CPU_DEAD ,CPUHP_RANDOM_PREPARE , CPUHP_WORKQUEUE_PREP,
include/linux/padata.h +4 -4
@@ -147,23 +147,23 @@ struct padata_mt_job {/** * struct padata_instance - The overall control structure. * -* @cpu_online_node: Linkage for CPU online callback. -* @cpu_dead_node: Linkage for CPU offline callback. +* @cpuhp_node: Linkage for CPU hotplug callbacks. * @parallel_wq: The workqueue used for parallel work. * @serial_wq: The workqueue used for serial work. * @pslist: List of padata_shell objects attached to this instance. * @cpumask: User supplied cpumasks for parallel and serial works. +* @validate_cpumask: Internal cpumask used to validate @cpumask during hotplug. * @kobj: padata instance kernel object. * @lock: padata instance lock. * @flags: padata flags. */ struct padata_instance { -struct hlist_node cpu_online_node; -struct hlist_node cpu_dead_node; +struct hlist_node cpuhp_node;struct workqueue_struct *parallel_wq;struct workqueue_struct *serial_wq;struct list_head pslist;struct padata_cpumask cpumask; +cpumask_var_t validate_cpumask;struct kobject kobj;struct mutex lock;u8 flags;
kernel/padata.c +61 -59
270 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 114/508 drm/amdgpu/gfx10: look at the right prop for gfx queue priority
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 355d96cdec5c61fd83f7eb54f1a28e38809645d6 ]
Look at hqd_queue_priority rather than hqd_pipe_priority. In practice, it didn't matter as both were always set for kernel queues, but that will change in the future.
Reviewed-by:Jesse Zhang <[email protected]>
--- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +1 -1
@@ -6338,7 +6338,7 @@ static void gfx_v10_0_gfx_mqd_set_priority(struct amdgpu_device *adev,/* set up default queue priority level * 0x0 = low priority, 0x1 = high priority */ -if (prop->hqd_pipe_priority ==AMDGPU_GFX_PIPE_PRIO_HIGH ) +if (prop->hqd_queue_priority ==AMDGPU_GFX_QUEUE_PRIORITY_MAXIMUM ) priority =1 ; tmp =RREG32_SOC15 (GC ,0 , mmCP_GFX_HQD_QUEUE_PRIORITY);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 115/508 spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <[email protected]>
[ Upstream commit 9f61daf2c2debe9f5cf4e1a4471e56a89a6fe45a ]
The hisi_spi_flush_fifo()'s inner while loop that lacks any timeout mechanism. Maybe the hardware never becomes empty, the loop will spin forever, causing the CPU to hang.
Fix this by adding a inner_limit based on loops_per_jiffy. The inner loop now exits after approximately one jiffy if the FIFO remains non-empty, logs a ratelimited warning, and breaks out of the outer loop. Additionally, add a cpu_relax() inside the busy loop to improve power efficiency.
--- drivers/spi/spi-hisi-kunpeng.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/spi/spi-hisi-kunpeng.c +11 -1
@@ -196,8 +196,18 @@ static void hisi_spi_flush_fifo(struct hisi_spi *hs)unsigned long limit = loops_per_jiffy <<1 ;do { -while (hisi_spi_rx_not_empty (hs)) +unsigned long inner_limit = loops_per_jiffy; + +while (hisi_spi_rx_not_empty (hs) && --inner_limit) {readl (hs->regs +HISI_SPI_DOUT ); +cpu_relax (); + } + +if (!inner_limit) { +dev_warn_ratelimited (hs->dev,"RX FIFO flush timeout\n" ); +break ; + } + }while (hisi_spi_busy (hs) && limit--); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 116/508 drm/msm/dpu: fix mismatch between power and frequency
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanjie Yang <[email protected]>
[ Upstream commit bc1dccc518cc5ab5140fba06c27e7188e0ed342b ]
During DPU runtime suspend, calling dev_pm_opp_set_rate(dev, 0) drops the MMCX rail to MIN_SVS while the core clock frequency remains at its original (highest) rate. When runtime resume re-enables the clock, this may result in a mismatch between the rail voltage and the clock rate.
For example, in the DPU bind path, the sequence could be:
cpu0: dev_sync_state -> rpmhpd_sync_state
cpu1: dpu_kms_hw_init
timeline 0 ------------------------------------------------> t
After rpmhpd_sync_state, the voltage performance is no longer guaranteed to stay at the highest level. During dpu_kms_hw_init, calling dev_pm_opp_set_rate(dev, 0) drops the voltage, causing the MMCX rail to fall to MIN_SVS while the core clock is still at its maximum frequency. When the power is re-enabled, only the clock is enabled, leading to a situation where the MMCX rail is at MIN_SVS but the core clock is at its highest rate. In this state, the rail cannot sustain the clock rate, which may cause instability or system crash.
Remove the call to dev_pm_opp_set_rate(dev, 0) from dpu_runtime_suspend to ensure the correct vote is restored when DPU resumes.
Patchwork: https://patchwork.freedesktop.org/patch/710077/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +0 -2
@@ -1316,8 +1316,6 @@ static int __maybe_unused dpu_runtime_suspend(struct device *dev)struct msm_drm_private *priv =platform_get_drvdata (pdev);struct dpu_kms *dpu_kms =to_dpu_kms (priv->kms); -/* Drop the performance state vote */ -dev_pm_opp_set_rate (dev,0 );clk_bulk_disable_unprepare (dpu_kms->num_clocks, dpu_kms->clocks);for (i =0 ; i < dpu_kms->num_paths; i++)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 117/508 drm/msm/dsi: add the missing parameter description
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengyu Luo <[email protected]>
[ Upstream commit 958adefc4c0fddee3b12269da5dd7cb49bac953f ]
Add a description for is_bonded_dsi in dsi_adjust_pclk_for_compression to match the existing kernel-doc comment.
Patchwork: https://patchwork.freedesktop.org/patch/710112/
--- drivers/gpu/drm/msm/dsi/dsi_host.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/msm/dsi/dsi_host.c +1 -0
@@ -533,6 +533,7 @@ void dsi_link_clk_disable_v2(struct msm_dsi_host *msm_host)* dsi_adjust_pclk_for_compression() - Adjust the pclk rate for compression case * @mode: The selected mode for the DSI output * @dsc: DRM DSC configuration for this DSI output +* @is_bonded_dsi: True if two DSI controllers are bonded * * Adjust the pclk rate by calculating a new hdisplay proportional to * the compression ratio such that:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 118/508 drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Koskovich <[email protected]>
[ Upstream commit 913a709dea0eff9c7b2e9470f8c8594b9a0114ab ]
The MSM8998 DSI controller is v2.0.0 as stated in commit 7b8c9e203039 ("drm/msm/dsi: Add support for MSM8998 DSI controller"). The value was always correct just the name was wrong.
Rename and reorder to maintain version sorting.
Patchwork: https://patchwork.freedesktop.org/patch/713717/
--- drivers/gpu/drm/msm/dsi/dsi_cfg.c | 4 ++-- drivers/gpu/drm/msm/dsi/dsi_cfg.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/msm/dsi/dsi_cfg.c +2 -2
@@ -263,10 +263,10 @@ static const struct msm_dsi_cfg_handler dsi_cfg_handlers[] = { &msm8996_dsi_cfg, &msm_dsi_6g_host_ops}, {MSM_DSI_VER_MAJOR_6G ,MSM_DSI_6G_VER_MINOR_V1_4_2 , &msm8976_dsi_cfg, &msm_dsi_6g_host_ops}, + {MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V2_0_0, + &msm8998_dsi_cfg, &msm_dsi_6g_v2_host_ops}, {MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V2_1_0, &sdm660_dsi_cfg, &msm_dsi_6g_v2_host_ops}, - {MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V2_2_0, - &msm8998_dsi_cfg, &msm_dsi_6g_v2_host_ops}, {MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V2_2_1, &sdm845_dsi_cfg, &msm_dsi_6g_v2_host_ops}, {MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V2_3_0,
drivers/gpu/drm/msm/dsi/dsi_cfg.h +1 -1
@@ -19,8 +19,8 @@#define MSM_DSI_6G_VER_MINOR_V1_3_1 0x10030001#define MSM_DSI_6G_VER_MINOR_V1_4_1 0x10040001#define MSM_DSI_6G_VER_MINOR_V1_4_2 0x10040002 +#define MSM_DSI_6G_VER_MINOR_V2_0_0 0x20000000#define MSM_DSI_6G_VER_MINOR_V2_1_0 0x20010000 -#define MSM_DSI_6G_VER_MINOR_V2_2_0 0x20000000#define MSM_DSI_6G_VER_MINOR_V2_2_1 0x20020001#define MSM_DSI_6G_VER_MINOR_V2_3_0 0x20030000#define MSM_DSI_6G_VER_MINOR_V2_4_0 0x20040000
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 119/508 drm/panel: sharp-ls043t1le01: make use of prepare_prev_first
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit c222177d7c7e1b2e0433d9e47ec2da7015345d50 ]
The DSI link must be powered up to let panel driver to talk to the panel during prepare() callback execution. Set the prepare_prev_first flag to guarantee this.
--- drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c +1 -0
@@ -224,6 +224,7 @@ static int sharp_nt_panel_add(struct sharp_nt_panel *sharp_nt)drm_panel_init (&sharp_nt->base, &sharp_nt->dsi->dev, &sharp_nt_panel_funcs,DRM_MODE_CONNECTOR_DSI ); + sharp_nt->base.prepare_prev_first = true; ret =drm_panel_of_backlight (&sharp_nt->base);if (ret)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 120/508 drm/panel: simple: Correct G190EAN01 prepare timing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Reichel <[email protected]>
[ Upstream commit f1080f82570b797598c1ba7e9c800ae9e94aafc6 ]
The prepare timing specified by the G190EAN01 datasheet should be between 30 and 50 ms. Considering it might take some time for the LVDS encoder to enable the signal, we should only wait the min. required time in the panel driver and not the max. allowed time.
--- drivers/gpu/drm/panel/panel-simple.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/panel/panel-simple.c +1 -1
@@ -1157,7 +1157,7 @@ static const struct panel_desc auo_g190ean01 = { .height = 301, }, .delay = { - .prepare = 50, + .prepare = 30, .enable = 200, .disable = 110, .unprepare = 1000,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 121/508 ALSA: core: Validate compress device numbers without dynamic minors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
[ Upstream commit 796e119e9b14763be905ad0d023c71a14bc2e931 ]
Without CONFIG_SND_DYNAMIC_MINORS, ALSA reserves only two fixed minors for compress devices on each card: comprD0 and comprD1.
snd_find_free_minor() currently computes the compress minor as type + dev without validating dev first, so device numbers greater than 1 spill into the HWDEP minor range instead of failing registration.
ASoC passes rtd->id to snd_compress_new(), so this can happen on real non-dynamic-minor builds.
Add a dedicated fixed-minor check for SNDRV_DEVICE_TYPE_COMPRESS in snd_find_free_minor() and reject out-of-range device numbers with -EINVAL before constructing the minor.
Also remove the stale TODO in compress_offload.c that still claims multiple compress nodes are missing.
--- sound/core/compress_offload.c | 7 ------- sound/core/sound.c | 7 +++++++ 2 files changed, 7 insertions(+), 7 deletions(-)
sound/core/compress_offload.c +0 -7
@@ -40,13 +40,6 @@#define COMPR_CODEC_CAPS_OVERFLOW #endif -/* TODO: -* - add substream support for multiple devices in case of -* SND_DYNAMIC_MINORS is not used -* - Multiple node representation -* driver should be able to register multiple nodes -*/ -struct snd_compr_file {unsigned long caps;struct snd_compr_stream stream;
sound/core/sound.c +7 -0
@@ -219,9 +219,16 @@ static int snd_find_free_minor(int type, struct snd_card *card, int dev)case SNDRV_DEVICE_TYPE_RAWMIDI :case SNDRV_DEVICE_TYPE_PCM_PLAYBACK :case SNDRV_DEVICE_TYPE_PCM_CAPTURE : +if (snd_BUG_ON (!card)) +return -EINVAL ; + minor =SNDRV_MINOR (card->number, type + dev); +break ;case SNDRV_DEVICE_TYPE_COMPRESS :if (snd_BUG_ON (!card))return -EINVAL ; +if (dev <0 || + dev >=SNDRV_MINOR_HWDEP -SNDRV_MINOR_COMPRESS ) +return -EINVAL ; minor =SNDRV_MINOR (card->number, type + dev);break ;default :
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 122/508 drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 894f0d34d66cb47fe718fe2ae5c18729d22c5218 ]
When MCLK DPM is disabled for any reason, populate the MCLK table with the highest MCLK DPM level, so that the ASIC can use the highest possible memory clock to get good performance even when MCLK DPM is disabled.
--- drivers/gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c +8 -0
@@ -1322,6 +1322,14 @@ static int ci_populate_all_memory_levels(struct pp_hwmgr *hwmgr)return result; } +if (data->mclk_dpm_key_disabled && dpm_table->mclk_table.count) { +/* Populate the table with the highest MCLK level when MCLK DPM is disabled */ +for (i =0 ; i < dpm_table->mclk_table.count -1 ; i++) { + levels[i] = levels[dpm_table->mclk_table.count -1 ]; + levels[i].DisplayWatermark =PPSMC_DISPLAY_WATERMARK_HIGH ; + } + } + smu_data->smc_state_table.MemoryLevel[0 ].EnabledForActivity =1 ; dev_id = adev->pdev->device;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 123/508 drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 9851f29cb06c09f7dad3867d8b0feec3fc71b6c8 ]
There are two known cases where MCLK DPM can causes issues:
Radeon R9 M380 found in iMac computers from 2015. The SMU in this GPU just hangs as soon as we send it the PPSMC_MSG_MCLKDPM_Enable command, even when MCLK switching is disabled, and even when we only populate one MCLK DPM level. Apply workaround to all devices with the same subsystem ID.
Radeon R7 260X due to old memory controller microcode. We only flash the MC ucode when it isn't set up by the VBIOS, therefore there is no way to make sure that it has the correct ucode version.
I verified that this patch fixes the SMU hang on the R9 M380 which would previously fail to boot. This also fixes the UVD initialization error on that GPU which happened because the SMU couldn't ungate the UVD after it hung.
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c +15 -0
@@ -104,6 +104,21 @@ int hwmgr_early_init(struct pp_hwmgr *hwmgr) PP_GFXOFF_MASK); hwmgr->pp_table_version =PP_TABLE_V0 ; hwmgr->od_enabled = false; +switch (hwmgr->chip_id) { +case CHIP_BONAIRE : +/* R9 M380 in iMac 2015: SMU hangs when enabling MCLK DPM +* R7 260X cards with old MC ucode: MCLK DPM is unstable +*/ +if (adev->pdev->subsystem_vendor ==0x106B || + adev->pdev->device ==0x6658 ) { +dev_info (adev->dev,"disabling MCLK DPM on quirky ASIC" ); + adev->pm.pp_feature &= ~PP_MCLK_DPM_MASK ; + hwmgr->feature_mask &= ~PP_MCLK_DPM_MASK ; + } +break ; +default : +break ; + }smu7_init_function_pointers (hwmgr);break ;case AMDGPU_FAMILY_CZ :
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 124/508 drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 0138610c14130425be53423b35336561829965e0 ]
The DCE (display controller engine) requires a minimum voltage in order to function correctly, depending on which clock level it currently uses.
Add a new table that contains display clock frequency levels and the corresponding required voltages. The clock frequency levels are taken from DC (and the old radeon driver's voltage dependency table for CI in cases where its values were lower). The voltage levels are taken from the following function:phm_initializa_dynamic_state_adjustment_rule_settings(). Furthermore, in case of CI, call smu7_patch_vddc() on the new table to account for leakage voltage (like in radeon).
Use the display clock value from amd_pp_display_configuration to look up the voltage level needed by the DCE. Send the voltage to the SMU via the PPSMC_MSG_VddC_Request command.
The previous implementation of this feature was non-functional because it relied on a "dal_power_level" field which was never assigned; and it was not at all implemented for CI ASICs.
I verified this on a Radeon R9 M380 which previously booted to a black screen with DC enabled (default since Linux 6.19), but now works correctly.
--- .../drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 88 ++++++++++++++++++- drivers/gpu/drm/amd/pm/powerplay/inc/hwmgr.h | 1 + 2 files changed, 86 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +85 -3
@@ -2802,6 +2802,10 @@ static int smu7_patch_dependency_tables_with_leakage(struct pp_hwmgr *hwmgr)if (tmp)return -EINVAL ; + tmp =smu7_patch_vddc (hwmgr, hwmgr->dyn_state.vddc_dependency_on_display_clock); +if (tmp) +return -EINVAL ; + tmp =smu7_patch_vce_vddc (hwmgr, hwmgr->dyn_state.vce_clock_voltage_dependency_table);if (tmp)return -EINVAL ;
@@ -2885,6 +2889,8 @@ static int smu7_hwmgr_backend_fini(struct pp_hwmgr *hwmgr) {kfree (hwmgr->dyn_state.vddc_dep_on_dal_pwrl); hwmgr->dyn_state.vddc_dep_on_dal_pwrl =NULL ; +kfree (hwmgr->dyn_state.vddc_dependency_on_display_clock); + hwmgr->dyn_state.vddc_dependency_on_display_clock =NULL ;kfree (hwmgr->backend); hwmgr->backend =NULL ;
@@ -2955,6 +2961,51 @@ static int smu7_update_edc_leakage_table(struct pp_hwmgr *hwmgr)return ret; } +static int smu7_init_voltage_dependency_on_display_clock_table (struct pp_hwmgr *hwmgr) +{ +struct phm_clock_voltage_dependency_table *table; + +if (!amdgpu_device_ip_get_ip_block (hwmgr->adev,AMD_IP_BLOCK_TYPE_DCE )) +return 0 ; + + table =kzalloc (struct_size (table, entries,4 ),GFP_KERNEL ); +if (!table) +return -ENOMEM ; + +if (hwmgr->chip_id >=CHIP_POLARIS10 ) { + table->entries[0 ].clk =38918 ; + table->entries[1 ].clk =45900 ; + table->entries[2 ].clk =66700 ; + table->entries[3 ].clk =113200 ; + + table->entries[0 ].v =700 ; + table->entries[1 ].v =740 ; + table->entries[2 ].v =800 ; + table->entries[3 ].v =900 ; + }else { +if (hwmgr->chip_family ==AMDGPU_FAMILY_CZ ) { + table->entries[0 ].clk =35200 ; + table->entries[1 ].clk =35200 ; + table->entries[2 ].clk =46700 ; + table->entries[3 ].clk =64300 ; + }else { + table->entries[0 ].clk =0 ; + table->entries[1 ].clk =35200 ; + table->entries[2 ].clk =54000 ; + table->entries[3 ].clk =62500 ; + } + + table->entries[0 ].v =0 ; + table->entries[1 ].v =720 ; + table->entries[2 ].v =810 ; + table->entries[3 ].v =900 ; + } + + table->count =4 ; + hwmgr->dyn_state.vddc_dependency_on_display_clock = table; +return 0 ; +} +static int smu7_hwmgr_backend_init (struct pp_hwmgr *hwmgr) {struct amdgpu_device *adev = hwmgr->adev;
@@ -2983,6 +3034,10 @@ static int smu7_hwmgr_backend_init(struct pp_hwmgr *hwmgr)smu7_get_elb_voltages (hwmgr); } + result =smu7_init_voltage_dependency_on_display_clock_table (hwmgr); +if (result) + goto fail; +if (hwmgr->pp_table_version ==PP_TABLE_V1 ) {smu7_complete_dependency_tables (hwmgr);smu7_set_private_data_based_on_pptable_v1 (hwmgr);
@@ -3079,13 +3134,40 @@ static int smu7_force_dpm_highest(struct pp_hwmgr *hwmgr)return 0 ; } +static uint32_t smu7_lookup_vddc_from_dispclk (struct pp_hwmgr *hwmgr) +{ +const struct amd_pp_display_configuration *cfg = hwmgr->display_config; +const struct phm_clock_voltage_dependency_table *vddc_dep_on_dispclk = + hwmgr->dyn_state.vddc_dependency_on_display_clock; +uint32_t i; + +if (!vddc_dep_on_dispclk || !vddc_dep_on_dispclk->count || + !cfg || !cfg->num_display || !cfg->display_clk) +return 0 ; + +/* Start from 1 because ClocksStateUltraLow should not be used according to DC. */ +for (i =1 ; i < vddc_dep_on_dispclk->count; ++i) +if (vddc_dep_on_dispclk->entries[i].clk >= cfg->display_clk) +return vddc_dep_on_dispclk->entries[i].v; + +return vddc_dep_on_dispclk->entries[vddc_dep_on_dispclk->count -1 ].v; +} + +static void smu7_apply_minimum_dce_voltage_request (struct pp_hwmgr *hwmgr) +{ +uint32_t req_vddc =smu7_lookup_vddc_from_dispclk (hwmgr); + +smum_send_msg_to_smc_with_parameter (hwmgr, + PPSMC_MSG_VddC_Request, + req_vddc *VOLTAGE_SCALE , +NULL ); +} +static int smu7_upload_dpm_level_enable_mask (struct pp_hwmgr *hwmgr) {struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend); -if (hwmgr->pp_table_version ==PP_TABLE_V1 ) -phm_apply_dal_min_voltage_request (hwmgr); -/* TO DO for v0 iceland and Ci*/ +smu7_apply_minimum_dce_voltage_request (hwmgr);if (!data->sclk_dpm_key_disabled) {if (data->dpm_level_enable_mask.sclk_dpm_enable_mask)
drivers/gpu/drm/amd/pm/powerplay/inc/hwmgr.h +1 -0
@@ -632,6 +632,7 @@ struct phm_dynamic_state_info {struct phm_clock_voltage_dependency_table *vddci_dependency_on_mclk;struct phm_clock_voltage_dependency_table *vddc_dependency_on_mclk;struct phm_clock_voltage_dependency_table *mvdd_dependency_on_mclk; +struct phm_clock_voltage_dependency_table *vddc_dependency_on_display_clock;struct phm_clock_voltage_dependency_table *vddc_dep_on_dal_pwrl;struct phm_clock_array *valid_sclk_values;struct phm_clock_array *valid_mclk_values;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 125/508 drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit d784759c07924280f3c313f205fc48eb62d7cb71 ]
There is no AMD GPU with the ID 0x66B0, this looks like a typo. It should be 0x67B0 which is actually part of the PCI ID list, and should use the Hawaii XT powertune defaults according to the old radeon driver.
--- drivers/gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c +1 -1
@@ -245,7 +245,7 @@ static void ci_initialize_power_tune_defaults(struct pp_hwmgr *hwmgr) smu_data->power_tune_defaults = &defaults_hawaii_pro;break ;case 0x67B8 : -case 0x66B0 : +case 0x67B0 : smu_data->power_tune_defaults = &defaults_hawaii_xt;break ;case 0x6640 :
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 126/508 drm/amd/pm/ci: Clear EnabledForActivity field for memory levels
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 5facfd4c4c67e8500116ffec0d9da35d92b9c787 ]
Follow what radeon did and what amdgpu does for other GPUs with SMU7.
--- drivers/gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c +1 -1
@@ -1217,7 +1217,7 @@ static int ci_populate_single_memory_level( } memory_level->EnabledForThrottle =1 ; - memory_level->EnabledForActivity =1 ; + memory_level->EnabledForActivity =0 ; memory_level->UpH = data->current_profile_setting.mclk_up_hyst; memory_level->DownH = data->current_profile_setting.mclk_down_hyst; memory_level->VoltageDownH =0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 127/508 drm/amd/pm/ci: Fill DW8 fields from SMC
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit baf28ec5795c077406d6f52b8ad39e614153bce6 ]
In ci_populate_dw8() we currently just read a value from the SMU and then throw it away. Instead of throwing away the value, we should use it to fill other fields in DW8 (like radeon).
Otherwise the value of the other fiels is just cleared when we copy this data to the SMU later.
--- drivers/gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c +1 -2
@@ -543,12 +543,11 @@ static int ci_populate_dw8(struct pp_hwmgr *hwmgr, uint32_t fuse_table_offset) {struct ci_smumgr *smu_data = (struct ci_smumgr *)(hwmgr->smu_backend);const struct ci_pt_defaults *defaults = smu_data->power_tune_defaults; -uint32_t temp;if (ci_read_smc_sram_dword (hwmgr, fuse_table_offset + offsetof(SMU7_Discrete_PmFuses , TdcWaterfallCtl), - (uint32_t *)&temp,SMC_RAM_END )) + (uint32_t *)&smu_data->power_tune_table.TdcWaterfallCtl,SMC_RAM_END ))PP_ASSERT_WITH_CODE (false,"Attempt to read PmFuses.DW6 (SviLoadLineEn) from SMC Failed!" , return -EINVAL );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 128/508 drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 4724bc5b8d78c34b993594f9406135408ccb312a ]
On a specific Radeon R9 390X board, the GPU can "randomly" hang while gaming. Initially I thought this was a RADV bug and tried to work around this in Mesa:
commit 8ea08747b86b ("radv: Mitigate GPU hang on Hawaii in Dota 2 and RotTR")
However, I got some feedback from other users who are reporting that the above mitigation causes a significant performance regression for them, and they didn't experience the hang on their GPU in the first place.
After some further investigation, it turns out that the problem is that the highest SCLK DPM level on this board isn't stable. Lowering SCLK to 1040 MHz (from 1070 MHz) works around the issue, and has a negligible impact on performance compared to the Mesa patch. (Note that increasing the voltage can also work around it, but we felt that lowering the SCLK is the safer option.)
To solve the above issue, add an "sclk_cap" field to smu7_hwmgr and set this field for the affected board. The capped SCLK value correctly appears on the sysfs interface and shows up in GUI tools such as LACT.
--- .../drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 30 ++++++++++++++++--- .../drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.h | 1 + 2 files changed, 27 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +26 -4
@@ -787,7 +787,7 @@ static int smu7_setup_dpm_tables_v0(struct pp_hwmgr *hwmgr) hwmgr->dyn_state.vddc_dependency_on_mclk;struct phm_cac_leakage_table *std_voltage_table = hwmgr->dyn_state.cac_leakage_table; -uint32_t i; +uint32_t i, clk;PP_ASSERT_WITH_CODE (allowed_vdd_sclk_table !=NULL ,"SCLK dependency table is missing. This table is mandatory" , return -EINVAL );
@@ -804,10 +804,12 @@ static int smu7_setup_dpm_tables_v0(struct pp_hwmgr *hwmgr) data->dpm_table.sclk_table.count =0 ;for (i =0 ; i < allowed_vdd_sclk_table->count; i++) { + clk =min (allowed_vdd_sclk_table->entries[i].clk, data->sclk_cap); +if (i ==0 || data->dpm_table.sclk_table.dpm_levels[data->dpm_table.sclk_table.count-1 ].value != - allowed_vdd_sclk_table->entries[i].clk) { + clk) { data->dpm_table.sclk_table.dpm_levels[data->dpm_table.sclk_table.count].value = - allowed_vdd_sclk_table->entries[i].clk; + clk; data->dpm_table.sclk_table.dpm_levels[data->dpm_table.sclk_table.count].enabled = (i ==0 ) ?1 :0 ; data->dpm_table.sclk_table.count++; }
@@ -3006,6 +3008,25 @@ static int smu7_init_voltage_dependency_on_display_clock_table(struct pp_hwmgr *return 0 ; } +static void smu7_set_sclk_cap (struct pp_hwmgr *hwmgr) +{ +struct amdgpu_device *adev = hwmgr->adev; +struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend); + + data->sclk_cap =0xffffffff ; + +if (hwmgr->od_enabled) +return ; + +/* R9 390X board: last sclk dpm level is unstable, use lower sclk */ +if (adev->pdev->device ==0x67B0 && + adev->pdev->subsystem_vendor ==0x1043 ) + data->sclk_cap =104000 ;/* 1040 MHz */ + +if (data->sclk_cap !=0xffffffff ) +dev_info (adev->dev,"sclk cap: %u kHz on quirky ASIC\n" , data->sclk_cap *10 ); +} +static int smu7_hwmgr_backend_init (struct pp_hwmgr *hwmgr) {struct amdgpu_device *adev = hwmgr->adev;
@@ -3017,6 +3038,7 @@ static int smu7_hwmgr_backend_init(struct pp_hwmgr *hwmgr)return -ENOMEM ; hwmgr->backend = data; +smu7_set_sclk_cap (hwmgr);smu7_patch_voltage_workaround (hwmgr);smu7_init_dpm_defaults (hwmgr);
@@ -3903,7 +3925,7 @@ static int smu7_get_pp_table_entry_callback_func_v0(struct pp_hwmgr *hwmgr,/* Performance levels are arranged from low to high. */ performance_level->memory_clock = memory_clock; - performance_level->engine_clock = engine_clock; + performance_level->engine_clock =min (engine_clock, data->sclk_cap); pcie_gen_from_bios = visland_clk_info->ucPCIEGen;
drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.h +1 -0
@@ -234,6 +234,7 @@ struct smu7_hwmgr {uint32_t pcie_gen_cap;uint32_t pcie_lane_cap;uint32_t pcie_spc_cap; +uint32_t sclk_cap;struct smu7_leakage_voltage vddc_leakage;struct smu7_leakage_voltage vddci_leakage;struct smu7_leakage_voltage vddcgfx_leakage;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 129/508 ALSA: hda/realtek: fix code style (ERROR: else should follow close brace })
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lei Huang <[email protected]>
[ Upstream commit d1888bf848ade6a9e71c7ba516fd215aa1bd8d65 ]
Fix checkpatch code style errors:
ERROR: else should follow close brace '}' #2300: FILE: sound/hda/codecs/realtek/alc269.c:2300:
+ }
+ else
--- sound/pci/hda/patch_realtek.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/patch_realtek.c +2 -2
@@ -6043,9 +6043,9 @@ static void alc_fixup_headset_mode_alc255_no_hp_mic(struct hda_codec *codec,struct alc_spec *spec = codec->spec; spec->parse_flags |=HDA_PINCFG_HEADSET_MIC ;alc255_set_default_jack_type (codec); - } -else + }else {alc_fixup_headset_mode (codec, fix, action); + } } static void alc288_update_headset_jack_cb(struct hda_codec *codec,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 130/508 ASoC: SOF: Intel: hda: Place check before dereference
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Tidmore <[email protected]>
[ Upstream commit 6cbc8360f51a3df2ea16a786b262b9fe44d4c68c ]
The struct hext_stream is dereferenced before it is checked for NULL. Although it can never be NULL due to a check prior to hda_dsp_iccmax_stream_hw_params() being called, this change clears any confusion regarding hext_stream possibly being NULL.
Check hext_stream for NULL and then assign its members.
Detected by Smatch:sound/soc/sof/intel/hda-stream.c:488 hda_dsp_iccmax_stream_hw_params() warn:
variable dereferenced before check 'hext_stream' (see line 486)
--- sound/soc/sof/intel/hda-stream.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
sound/soc/sof/intel/hda-stream.c +7 -3
@@ -415,16 +415,20 @@ int hda_dsp_iccmax_stream_hw_params(struct snd_sof_dev *sdev, struct hdac_ext_ststruct snd_dma_buffer *dmab, struct snd_pcm_hw_params *params) { - struct hdac_stream *hstream = &hext_stream->hstream; -int sd_offset =SOF_STREAM_SD_OFFSET (hstream); + struct hdac_stream *hstream; +int sd_offset;int ret; -u32 mask =0x1 << hstream->index; +u32 mask;if (!hext_stream) {dev_err (sdev->dev,"error: no stream available\n" );return -ENODEV ; } + hstream = &hext_stream->hstream; + sd_offset =SOF_STREAM_SD_OFFSET (hstream); + mask =0x1 << hstream->index; +if (!dmab) {dev_err (sdev->dev,"error: no dma buffer allocated!\n" );return -ENODEV ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 131/508 drm/msm/a6xx: Fix HLSQ register dumping
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit c289a6db9ba6cb974f0317da142e4f665d589566 ]
Fix the bitfield offset of HLSQ_READ_SEL state-type bitfield. Otherwise we are always reading TP state when we wanted SP or HLSQ state.
Patchwork: https://patchwork.freedesktop.org/patch/714236/
Message-ID: <[email protected]>
--- drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c +1 -1
@@ -672,7 +672,7 @@ static void a6xx_get_crashdumper_hlsq_registers(struct msm_gpu *gpu,u64 out = dumper->iova +A6XX_CD_DATA_OFFSET ;int i, regcount =0 ; - in +=CRASHDUMP_WRITE (in,REG_A6XX_HLSQ_DBG_READ_SEL , regs->val1); + in +=CRASHDUMP_WRITE (in,REG_A6XX_HLSQ_DBG_READ_SEL , (regs->val1 &0xff ) <<8 );for (i =0 ; i < regs->count; i +=2 ) {u32 count =RANGE (regs->registers, i);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 132/508 drm/msm/shrinker: Fix can_block() logic
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit df0f439e3926817cf577ca6272aad68468ff7624 ]
The intention here was to allow blocking if DIRECT_RECLAIM or if called from kswapd and KSWAPD_RECLAIM is set.
Reported by Claude code review: https://lore.gitlab.freedesktop.org/drm-ai-reviews/review-patch9-20260309151119.290217-10-boris.brezillon@collabora.com/ on a panthor patch which had copied similar logic.
Patchwork: https://patchwork.freedesktop.org/patch/714238/
Message-ID: <[email protected]>
--- drivers/gpu/drm/msm/msm_gem_shrinker.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/gpu/drm/msm/msm_gem_shrinker.c +2 -3
@@ -26,9 +26,8 @@ static bool can_swap(void)static bool can_block (struct shrink_control *sc) { -if (!(sc->gfp_mask & __GFP_DIRECT_RECLAIM)) -return false; -return current_is_kswapd () || (sc->gfp_mask & __GFP_RECLAIM); +return (sc->gfp_mask & __GFP_DIRECT_RECLAIM) || + (current_is_kswapd () && (sc->gfp_mask & __GFP_KSWAPD_RECLAIM)); } static unsigned long
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 133/508 drm/msm/a6xx: Use barriers while updating HFI Q headers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil P Oommen <[email protected]>
[ Upstream commit dc78b35d5ec09d1b0b8a937e6e640d2c5a030915 ]
To avoid harmful compiler optimizations and IO reordering in the HW, use barriers and READ/WRITE_ONCE helpers as necessary while accessing the HFI queue index variables.
Patchwork: https://patchwork.freedesktop.org/patch/714653/
Message-ID: <[email protected]>
--- drivers/gpu/drm/msm/adreno/a6xx_hfi.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/gpu/drm/msm/adreno/a6xx_hfi.c +10 -4
@@ -29,7 +29,7 @@ static int a6xx_hfi_queue_read(struct a6xx_gmu *gmu,struct a6xx_hfi_queue_header *header = queue->header;u32 i, hdr, index = header->read_index; -if (header->read_index == header->write_index) { +if (header->read_index ==READ_ONCE (header->write_index)) { header->rx_request =1 ;return 0 ; }
@@ -57,7 +57,10 @@ static int a6xx_hfi_queue_read(struct a6xx_gmu *gmu,if (!gmu->legacy) index =ALIGN (index,4 ) % header->size; - header->read_index = index; +/* Ensure all memory operations are complete before updating the read index */ +dma_mb (); + +WRITE_ONCE (header->read_index, index);return HFI_HEADER_SIZE (hdr); }
@@ -69,7 +72,7 @@ static int a6xx_hfi_queue_write(struct a6xx_gmu *gmu,spin_lock (&queue->lock); - space =CIRC_SPACE (header->write_index, header->read_index, + space =CIRC_SPACE (header->write_index,READ_ONCE (header->read_index), header->size);if (space < dwords) { header->dropped++;
@@ -90,7 +93,10 @@ static int a6xx_hfi_queue_write(struct a6xx_gmu *gmu, queue->data[index] =0xfafafafa ; } - header->write_index = index; +/* Ensure all memory operations are complete before updating the write index */ +dma_mb (); + +WRITE_ONCE (header->write_index, index);spin_unlock (&queue->lock);gmu_write (gmu,REG_A6XX_GMU_HOST2GMU_INTR_SET ,0x01 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 134/508 pmdomain: ti: omap_prm: Fix a reference leak on device node
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <[email protected]>
[ Upstream commit 44c28e1c52764fef6dd1c1ada3a248728812e67f ]
When calling of_parse_phandle_with_args(), the caller is responsible to call of_node_put() to release the reference of device node. In omap_prm_domain_attach_dev, it does not release the reference.
--- drivers/pmdomain/ti/omap_prm.c | 1 + 1 file changed, 1 insertion(+)
drivers/pmdomain/ti/omap_prm.c +1 -0
@@ -651,6 +651,7 @@ static int omap_prm_domain_attach_dev(struct generic_pm_domain *domain,if (pd_args.args_count !=0 )dev_warn (dev,"%s: unusupported #power-domain-cells: %i\n" , prmd->pd.name, pd_args.args_count); +of_node_put (pd_args.np); genpd_data =dev_gpd_data (dev); genpd_data->data =NULL ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 135/508 pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <[email protected]>
[ Upstream commit c8e9b6a55702be6c6d034e973d519c52c3848415 ]
When calling of_parse_phandle_with_args(), the caller is responsible to call of_node_put() to release the reference of device node. In imx_sc_pd_get_console_rsrc(), it does not release the reference.
--- drivers/pmdomain/imx/scu-pd.c | 1 + 1 file changed, 1 insertion(+)
drivers/pmdomain/imx/scu-pd.c +1 -0
@@ -326,6 +326,7 @@ static void imx_sc_pd_get_console_rsrc(void)return ; imx_con_rsrc = specs.args[0 ]; +of_node_put (specs.np); }static int imx_sc_get_pd_power (struct device *dev,u32 rsrc)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 136/508 ASoC: fsl_micfil: Add access property for "VAD Detected"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit c7661bfc7422443df394c01e069ae4e5c3a7f04c ]
Add access property SNDRV_CTL_ELEM_ACCESS_READ for control "VAD Detected", which doesn't support put operation, otherwise there will be issue with mixer-test.
--- sound/soc/fsl/fsl_micfil.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
sound/soc/fsl/fsl_micfil.c +7 -1
@@ -395,7 +395,13 @@ static const struct snd_kcontrol_new fsl_micfil_snd_controls[] = {SOC_SINGLE ("HWVAD ZCD Adjustment" ,REG_MICFIL_VAD0_ZCD ,8 ,15 ,0 ),SOC_SINGLE ("HWVAD ZCD And Behavior Switch" , REG_MICFIL_VAD0_ZCD, 4, 1, 0), - SOC_SINGLE_BOOL_EXT("VAD Detected", 0, hwvad_detected, NULL), + { + .iface =SNDRV_CTL_ELEM_IFACE_MIXER , + .access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE, + .name = "VAD Detected", + .info = snd_soc_info_bool_ext, + .get = hwvad_detected, + }, };static int fsl_micfil_use_verid (struct device *dev)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 137/508 ASoC: fsl_micfil: Fix event generation in hwvad_put_enable()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit 59b9061824f2179fe133e2636203548eaba3e528 ]
ALSA controls should return 1 if the value in the control changed but the control put operation hwvad_put_enable() only returns 0 or a negative error code, causing ALSA to not generate any change events.
Add a suitable check in the function before updating the vad_enabled variable.
--- sound/soc/fsl/fsl_micfil.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
sound/soc/fsl/fsl_micfil.c +6 -1
@@ -277,10 +277,15 @@ static int hwvad_put_enable(struct snd_kcontrol *kcontrol,unsigned int *item = ucontrol->value.enumerated.item;struct fsl_micfil *micfil =snd_soc_component_get_drvdata (comp);int val =snd_soc_enum_item_to_val (e, item[0 ]); +bool change = false; +if (val <0 || val >1 ) +return -EINVAL ; + + change = (micfil->vad_enabled != val); micfil->vad_enabled = val; -return 0 ; +return change; } static int hwvad_get_enable(struct snd_kcontrol *kcontrol,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 138/508 ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit 7e226209906906421f0d952d7304e48fdb0adabc ]
ALSA controls should return 1 if the value in the control changed but the control put operation hwvad_put_init_mode() only returns 0 or a negative error code, causing ALSA to not generate any change events.
Add a suitable check in the function before updating the vad_init_mode variable.
--- sound/soc/fsl/fsl_micfil.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
sound/soc/fsl/fsl_micfil.c +6 -1
@@ -307,13 +307,18 @@ static int hwvad_put_init_mode(struct snd_kcontrol *kcontrol,unsigned int *item = ucontrol->value.enumerated.item;struct fsl_micfil *micfil =snd_soc_component_get_drvdata (comp);int val =snd_soc_enum_item_to_val (e, item[0 ]); +bool change = false; + +if (val <MICFIL_HWVAD_ENVELOPE_MODE || val >MICFIL_HWVAD_ENERGY_MODE ) +return -EINVAL ;/* 0 - Envelope-based Mode * 1 - Energy-based Mode */ + change = (micfil->vad_init_mode != val); micfil->vad_init_mode = val; -return 0 ; +return change; } static int hwvad_get_init_mode(struct snd_kcontrol *kcontrol,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 139/508 ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit 7d2bd35100de370dc326b250e8f6b66bee06a2f3 ]
ALSA controls should return 1 if the value in the control changed but the control put operation micfil_put_dc_remover_state() only returns 0 or a negative error code, causing ALSA to not generate any change events.
return the value of snd_soc_component_update_bits() directly, as it has the capability of return check status of changed or not.
Also enable pm runtime before calling the function snd_soc_component_update_bits() to make the regmap cache data align with the value in hardware.
--- sound/soc/fsl/fsl_micfil.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
sound/soc/fsl/fsl_micfil.c +7 -3
@@ -243,6 +243,10 @@ static int micfil_put_dc_remover_state(struct snd_kcontrol *kcontrol,if (val <0 || val >3 )return -EINVAL ; + ret =pm_runtime_resume_and_get (comp->dev); +if (ret) +return ret; + micfil->dc_remover = val;/* Calculate total value for all channels */
@@ -252,10 +256,10 @@ static int micfil_put_dc_remover_state(struct snd_kcontrol *kcontrol,/* Update DC Remover mode for all channels */ ret =snd_soc_component_update_bits (comp,REG_MICFIL_DC_CTRL ,MICFIL_DC_CTRL_CONFIG , reg_val); -if (ret <0 ) -return ret; -return 0 ; +pm_runtime_put_autosuspend (comp->dev); + +return ret; } static int micfil_get_dc_remover_state(struct snd_kcontrol *kcontrol,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 140/508 ASoC: fsl_micfil: Fix event generation in micfil_quality_set()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit e5785093b1b45af7ee57d18619b2854a8aed073a ]
ALSA controls should return 1 if the value in the control changed but the control put operation micfil_quality_set() only returns 0 or a negative error code, causing ALSA to not generate any change events.
Add a suitable check in the function before updating the quality variable.
Also enable pm runtime before calling the function micfil_set_quality() to make the regmap cache data align with the value in hardware.
--- sound/soc/fsl/fsl_micfil.c | 28 ++++++++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-)
sound/soc/fsl/fsl_micfil.c +26 -2
@@ -181,10 +181,34 @@ static int micfil_quality_set(struct snd_kcontrol *kcontrol, {struct snd_soc_component *cmpnt =snd_soc_kcontrol_component (kcontrol);struct fsl_micfil *micfil =snd_soc_component_get_drvdata (cmpnt); +int val = ucontrol->value.integer.value[0 ]; +bool change = false; +int old_val; +int ret; + +if (val <QUALITY_HIGH || val >QUALITY_VLOW2 ) +return -EINVAL ; + +if (micfil->quality != val) { + ret =pm_runtime_resume_and_get (cmpnt->dev); +if (ret) +return ret; + + old_val = micfil->quality; + micfil->quality = val; + ret =micfil_set_quality (micfil); - micfil->quality = ucontrol->value.integer.value[0 ]; +pm_runtime_put_autosuspend (cmpnt->dev); -return micfil_set_quality (micfil); +if (ret) { + micfil->quality = old_val; +return ret; + } + + change = true; + } + +return change; }static const char *const micfil_hwvad_enable[] = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 141/508 ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit 1b61c8103c9317a9c37fe544c2d83cee1c281149 ]
ALSA controls should return 1 if the value in the control changed but the control put operation fsl_xcvr_arc_mode_put() only returns 0 or a negative error code, causing ALSA to not generate any change events.
Add a suitable check in the function before updating the arc_mode variable.
--- sound/soc/fsl/fsl_xcvr.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
sound/soc/fsl/fsl_xcvr.c +9 -2
@@ -98,10 +98,17 @@ static int fsl_xcvr_arc_mode_put(struct snd_kcontrol *kcontrol,struct fsl_xcvr *xcvr =snd_soc_dai_get_drvdata (dai);struct soc_enum *e = (struct soc_enum *)kcontrol->private_value;unsigned int *item = ucontrol->value.enumerated.item; +int val =snd_soc_enum_item_to_val (e, item[0 ]); +int ret; - xcvr->arc_mode =snd_soc_enum_item_to_val (e, item[0 ]); +if (val <0 || val >1 ) +return -EINVAL ; -return 0 ; + ret = (xcvr->arc_mode != val); + + xcvr->arc_mode = val; + +return ret; } static int fsl_xcvr_arc_mode_get(struct snd_kcontrol *kcontrol,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 142/508 ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit 64a496ba976324615b845d60739dfcdae3d57434 ]
ALSA controls should return 1 if the value in the control changed but the control put operation fsl_xcvr_mode_put() only returns 0 or a negative error code, causing ALSA to not generate any change events.
Add a suitable check in the function before updating the mode variable.
--- sound/soc/fsl/fsl_xcvr.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
sound/soc/fsl/fsl_xcvr.c +9 -2
@@ -208,10 +208,17 @@ static int fsl_xcvr_mode_put(struct snd_kcontrol *kcontrol,struct fsl_xcvr *xcvr =snd_soc_dai_get_drvdata (dai);struct soc_enum *e = (struct soc_enum *)kcontrol->private_value;unsigned int *item = ucontrol->value.enumerated.item; +int val =snd_soc_enum_item_to_val (e, item[0 ]);struct snd_soc_card *card = dai->component->card;struct snd_soc_pcm_runtime *rtd; +int ret; + +if (val <FSL_XCVR_MODE_SPDIF || val >FSL_XCVR_MODE_EARC ) +return -EINVAL ; - xcvr->mode =snd_soc_enum_item_to_val (e, item[0 ]); + ret = (xcvr->mode != val); + + xcvr->mode = val;fsl_xcvr_activate_ctl (dai, fsl_xcvr_arc_mode_kctl.name, (xcvr->mode ==FSL_XCVR_MODE_ARC ));
@@ -221,7 +228,7 @@ static int fsl_xcvr_mode_put(struct snd_kcontrol *kcontrol, rtd =snd_soc_get_pcm_runtime (card, card->dai_link); rtd->pcm->streams[SNDRV_PCM_STREAM_PLAYBACK ].substream_count = (xcvr->mode ==FSL_XCVR_MODE_SPDIF ?1 :0 ); -return 0 ; +return ret; } static int fsl_xcvr_mode_get(struct snd_kcontrol *kcontrol,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 143/508 ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit 00541b86fb578d4949cfdd6aff1f82d43fcf07af ]
Add check of input value's range in fsl_easrc_iec958_put_bits(), otherwise the wrong value may be written from user space.
--- sound/soc/fsl/fsl_easrc.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/fsl/fsl_easrc.c +3 -0
@@ -54,6 +54,9 @@ static int fsl_easrc_iec958_put_bits(struct snd_kcontrol *kcontrol,unsigned int regval = ucontrol->value.integer.value[0 ];int ret; +if (regval <EASRC_WIDTH_16_BIT || regval >EASRC_WIDTH_24_BIT ) +return -EINVAL ; + ret = (easrc_priv->bps_iec958[mc->regbase] != regval); easrc_priv->bps_iec958[mc->regbase] = regval;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 144/508 ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit aa21fe4a81458cf469c2615b08cbde5997dde25a ]
The value type of controls "Context 0 IEC958 Bits Per Sample" should be integer, not enumerated, the issue is found by the mixer-test.
--- sound/soc/fsl/fsl_easrc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/fsl/fsl_easrc.c +1 -1
@@ -73,7 +73,7 @@ static int fsl_easrc_iec958_get_bits(struct snd_kcontrol *kcontrol,struct soc_mreg_control *mc = (struct soc_mreg_control *)kcontrol->private_value; - ucontrol->value.enumerated.item[0 ] = easrc_priv->bps_iec958[mc->regbase]; + ucontrol->value.integer.value[0 ] = easrc_priv->bps_iec958[mc->regbase];return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 145/508 ASoC: fsl_easrc: Change the type for iec958 channel status controls
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit 47f28a5bd154a95d5aa563dde02a801bd32ddb81 ]
Use the type SNDRV_CTL_ELEM_TYPE_IEC958 for iec958 channel status controls, the original type will cause mixer-test to iterate all 32bit values, which costs a lot of time. And using IEC958 type can reduce the control numbers.
Also enable pm runtime before updating registers to make the regmap cache data align with the value in hardware.
--- sound/soc/fsl/fsl_easrc.c | 118 +++++++++++++++++++++++++++----------- 1 file changed, 84 insertions(+), 34 deletions(-)
sound/soc/fsl/fsl_easrc.c +84 -34
@@ -78,17 +78,47 @@ static int fsl_easrc_iec958_get_bits(struct snd_kcontrol *kcontrol,return 0 ; } +static int fsl_easrc_iec958_info (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_info *uinfo) +{ + uinfo->type =SNDRV_CTL_ELEM_TYPE_IEC958 ; + uinfo->count =1 ; +return 0 ; +} +static int fsl_easrc_get_reg (struct snd_kcontrol *kcontrol,struct snd_ctl_elem_value *ucontrol) {struct snd_soc_component *component =snd_kcontrol_chip (kcontrol);struct soc_mreg_control *mc = (struct soc_mreg_control *)kcontrol->private_value; -unsigned int regval; +struct fsl_asrc *easrc =snd_soc_component_get_drvdata (component); +unsigned int *regval = (unsigned int *)ucontrol->value.iec958.status; +int ret; + + ret =regmap_read (easrc->regmap,REG_EASRC_CS0 (mc->regbase), ®val[0 ]); +if (ret) +return ret; + + ret =regmap_read (easrc->regmap,REG_EASRC_CS1 (mc->regbase), ®val[1 ]); +if (ret) +return ret; + + ret =regmap_read (easrc->regmap,REG_EASRC_CS2 (mc->regbase), ®val[2 ]); +if (ret) +return ret; - regval =snd_soc_component_read (component, mc->regbase); + ret =regmap_read (easrc->regmap,REG_EASRC_CS3 (mc->regbase), ®val[3 ]); +if (ret) +return ret; + + ret =regmap_read (easrc->regmap,REG_EASRC_CS4 (mc->regbase), ®val[4 ]); +if (ret) +return ret; - ucontrol->value.integer.value[0 ] = regval; + ret =regmap_read (easrc->regmap,REG_EASRC_CS5 (mc->regbase), ®val[5 ]); +if (ret) +return ret;return 0 ; }
@@ -100,22 +130,62 @@ static int fsl_easrc_set_reg(struct snd_kcontrol *kcontrol,struct soc_mreg_control *mc = (struct soc_mreg_control *)kcontrol->private_value;struct fsl_asrc *easrc =snd_soc_component_get_drvdata (component); -unsigned int regval = ucontrol->value.integer.value[0 ]; -bool changed; +unsigned int *regval = (unsigned int *)ucontrol->value.iec958.status; +bool changed, changed_all = false;int ret; - ret =regmap_update_bits_check (easrc->regmap, mc->regbase, -GENMASK (31 ,0 ), regval, &changed); -if (ret !=0 ) + ret =pm_runtime_resume_and_get (component->dev); +if (ret)return ret; -return changed; + ret =regmap_update_bits_check (easrc->regmap,REG_EASRC_CS0 (mc->regbase), +GENMASK (31 ,0 ), regval[0 ], &changed); +if (ret !=0 ) + goto err; + changed_all |= changed; + + ret =regmap_update_bits_check (easrc->regmap,REG_EASRC_CS1 (mc->regbase), +GENMASK (31 ,0 ), regval[1 ], &changed); +if (ret !=0 ) + goto err; + changed_all |= changed; + + ret =regmap_update_bits_check (easrc->regmap,REG_EASRC_CS2 (mc->regbase), +GENMASK (31 ,0 ), regval[2 ], &changed); +if (ret !=0 ) + goto err; + changed_all |= changed; + + ret =regmap_update_bits_check (easrc->regmap,REG_EASRC_CS3 (mc->regbase), +GENMASK (31 ,0 ), regval[3 ], &changed); +if (ret !=0 ) + goto err; + changed_all |= changed; + + ret =regmap_update_bits_check (easrc->regmap,REG_EASRC_CS4 (mc->regbase), +GENMASK (31 ,0 ), regval[4 ], &changed); +if (ret !=0 ) + goto err; + changed_all |= changed; + + ret =regmap_update_bits_check (easrc->regmap,REG_EASRC_CS5 (mc->regbase), +GENMASK (31 ,0 ), regval[5 ], &changed); +if (ret !=0 ) + goto err; + changed_all |= changed; +err: +pm_runtime_put_autosuspend (component->dev); + +if (ret !=0 ) +return ret; +else +return changed_all; }#define SOC_SINGLE_REG_RW (xname, xreg) \ { .iface = SNDRV_CTL_ELEM_IFACE_PCM, .name = (xname), \ .access = SNDRV_CTL_ELEM_ACCESS_READWRITE, \ - .info = snd_soc_info_xr_sx, .get = fsl_easrc_get_reg, \ + .info = fsl_easrc_iec958_info, .get = fsl_easrc_get_reg, \ .put = fsl_easrc_set_reg, \ .private_value = (unsigned long)&(struct soc_mreg_control) \ { .regbase = xreg, .regcount = 1, .nbits = 32, \
@@ -146,30 +216,10 @@ static const struct snd_kcontrol_new fsl_easrc_snd_controls[] = {SOC_SINGLE_VAL_RW ("Context 2 IEC958 Bits Per Sample" ,2 ),SOC_SINGLE_VAL_RW ("Context 3 IEC958 Bits Per Sample" ,3 ), -SOC_SINGLE_REG_RW ("Context 0 IEC958 CS0" ,REG_EASRC_CS0 (0 )), -SOC_SINGLE_REG_RW ("Context 1 IEC958 CS0" ,REG_EASRC_CS0 (1 )), -SOC_SINGLE_REG_RW ("Context 2 IEC958 CS0" ,REG_EASRC_CS0 (2 )), -SOC_SINGLE_REG_RW ("Context 3 IEC958 CS0" ,REG_EASRC_CS0 (3 )), -SOC_SINGLE_REG_RW ("Context 0 IEC958 CS1" ,REG_EASRC_CS1 (0 )), -SOC_SINGLE_REG_RW ("Context 1 IEC958 CS1" ,REG_EASRC_CS1 (1 )), -SOC_SINGLE_REG_RW ("Context 2 IEC958 CS1" ,REG_EASRC_CS1 (2 )), -SOC_SINGLE_REG_RW ("Context 3 IEC958 CS1" ,REG_EASRC_CS1 (3 )), -SOC_SINGLE_REG_RW ("Context 0 IEC958 CS2" ,REG_EASRC_CS2 (0 )), -SOC_SINGLE_REG_RW ("Context 1 IEC958 CS2" ,REG_EASRC_CS2 (1 )), -SOC_SINGLE_REG_RW ("Context 2 IEC958 CS2" ,REG_EASRC_CS2 (2 )), -SOC_SINGLE_REG_RW ("Context 3 IEC958 CS2" ,REG_EASRC_CS2 (3 )), -SOC_SINGLE_REG_RW ("Context 0 IEC958 CS3" ,REG_EASRC_CS3 (0 )), -SOC_SINGLE_REG_RW ("Context 1 IEC958 CS3" ,REG_EASRC_CS3 (1 )), -SOC_SINGLE_REG_RW ("Context 2 IEC958 CS3" ,REG_EASRC_CS3 (2 )), -SOC_SINGLE_REG_RW ("Context 3 IEC958 CS3" ,REG_EASRC_CS3 (3 )), -SOC_SINGLE_REG_RW ("Context 0 IEC958 CS4" ,REG_EASRC_CS4 (0 )), -SOC_SINGLE_REG_RW ("Context 1 IEC958 CS4" ,REG_EASRC_CS4 (1 )), -SOC_SINGLE_REG_RW ("Context 2 IEC958 CS4" ,REG_EASRC_CS4 (2 )), -SOC_SINGLE_REG_RW ("Context 3 IEC958 CS4" ,REG_EASRC_CS4 (3 )), -SOC_SINGLE_REG_RW ("Context 0 IEC958 CS5" ,REG_EASRC_CS5 (0 )), -SOC_SINGLE_REG_RW ("Context 1 IEC958 CS5" ,REG_EASRC_CS5 (1 )), -SOC_SINGLE_REG_RW ("Context 2 IEC958 CS5" ,REG_EASRC_CS5 (2 )), - SOC_SINGLE_REG_RW("Context 3 IEC958 CS5", REG_EASRC_CS5(3)), +SOC_SINGLE_REG_RW ("Context 0 IEC958 CS" ,0 ), +SOC_SINGLE_REG_RW ("Context 1 IEC958 CS" ,1 ), +SOC_SINGLE_REG_RW ("Context 2 IEC958 CS" ,2 ), + SOC_SINGLE_REG_RW("Context 3 IEC958 CS", 3), };/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 146/508 ASoC: qcom: qdsp6: topology: check widget type before accessing data
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
[ Upstream commit d5bfdd28e0cdd45043ae6e0ac168a451d59283dc ]
Check widget type before accessing the private data, as this could a virtual widget which is no associated with a dsp graph, container and module. Accessing witout check could lead to incorrect memory access.
--- sound/soc/qcom/qdsp6/topology.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
sound/soc/qcom/qdsp6/topology.c +5 -3
@@ -903,9 +903,6 @@ static int audioreach_widget_unload(struct snd_soc_component *scomp,struct audioreach_container *cont;struct audioreach_module *mod; - mod = dobj->private; - cont = mod->container; -if (w->id == snd_soc_dapm_mixer) {/* virtual widget */ struct snd_ar_control *scontrol = dobj->private;
@@ -914,6 +911,11 @@ static int audioreach_widget_unload(struct snd_soc_component *scomp,kfree (scontrol);return 0 ; } + mod = dobj->private; +if (!mod) +return 0 ; + + cont = mod->container;mutex_lock (&apm->lock);idr_remove (&apm->modules_idr, mod->instance_id);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 147/508 crypto: qat - use swab32 macro
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giovanni Cabiddu <[email protected]>
[ Upstream commit 35ecb77ae0749a2f1b04872c9978d9d7ddbbeb79 ]
Replace __builtin_bswap32() with swab32 in icp_qat_hw_20_comp.h to fix the following build errors on architectures without native byte-swap support:
alpha-linux-ld: drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.o: in function `adf_gen4_build_decomp_block':
drivers/crypto/intel/qat/qat_common/icp_qat_hw_20_comp.h:141:(.text+0xeec): undefined reference to `__bswapsi2'
alpha-linux-ld: drivers/crypto/intel/qat/qat_common/icp_qat_hw_20_comp.h:141:(.text+0xef8): undefined reference to `__bswapsi2'
alpha-linux-ld: drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.o: in function `adf_gen4_build_comp_block':
drivers/crypto/intel/qat/qat_common/icp_qat_hw_20_comp.h:57:(.text+0xf64): undefined reference to `__bswapsi2'
alpha-linux-ld: drivers/crypto/intel/qat/qat_common/icp_qat_hw_20_comp.h:57:(.text+0xf7c): undefined reference to `__bswapsi2'
--- .../crypto/intel/qat/qat_common/icp_qat_hw_20_comp.h | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/crypto/intel/qat/qat_common/icp_qat_hw_20_comp.h +6 -4
@@ -3,6 +3,8 @@#ifndef _ICP_QAT_HW_20_COMP_H_#define _ICP_QAT_HW_20_COMP_H_ +#include <linux/swab.h> +#include "icp_qat_hw_20_comp_defs.h" #include "icp_qat_fw.h"
@@ -54,7 +56,7 @@ ICP_QAT_FW_COMP_20_BUILD_CONFIG_LOWER(struct icp_qat_hw_comp_20_config_csr_lowerQAT_FIELD_SET (val32, csr.abd,ICP_QAT_HW_COMP_20_CONFIG_CSR_ABD_BITPOS ,ICP_QAT_HW_COMP_20_CONFIG_CSR_ABD_MASK ); -return __builtin_bswap32 (val32); +return swab32 (val32); }struct icp_qat_hw_comp_20_config_csr_upper {
@@ -106,7 +108,7 @@ ICP_QAT_FW_COMP_20_BUILD_CONFIG_UPPER(struct icp_qat_hw_comp_20_config_csr_upperICP_QAT_HW_COMP_20_CONFIG_CSR_NICE_PARAM_BITPOS , ICP_QAT_HW_COMP_20_CONFIG_CSR_NICE_PARAM_MASK); -return __builtin_bswap32 (val32); +return swab32 (val32); }struct icp_qat_hw_decomp_20_config_csr_lower {
@@ -138,7 +140,7 @@ ICP_QAT_FW_DECOMP_20_BUILD_CONFIG_LOWER(struct icp_qat_hw_decomp_20_config_csr_lICP_QAT_HW_DECOMP_20_CONFIG_CSR_LZ4_BLOCK_CHECKSUM_PRESENT_BITPOS , ICP_QAT_HW_DECOMP_20_CONFIG_CSR_LZ4_BLOCK_CHECKSUM_PRESENT_MASK); -return __builtin_bswap32 (val32); +return swab32 (val32); }struct icp_qat_hw_decomp_20_config_csr_upper {
@@ -158,7 +160,7 @@ ICP_QAT_FW_DECOMP_20_BUILD_CONFIG_UPPER(struct icp_qat_hw_decomp_20_config_csr_uICP_QAT_HW_DECOMP_20_CONFIG_CSR_MINI_CAM_CONTROL_BITPOS , ICP_QAT_HW_DECOMP_20_CONFIG_CSR_MINI_CAM_CONTROL_MASK); - return __builtin_bswap32(val32); + return swab32(val32); }#endif
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 148/508 ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Rastyogin <[email protected]>
[ Upstream commit f9e437cddf6cf9e603bdaefe148c1f4792aaf39c ]
component_dais[RSND_MAX_COMPONENT] is initially zero-initialized and later populated in rsnd_dai_of_node(). However, the existing boundary check:
if (i >= RSND_MAX_COMPONENT)
does not guarantee that the last valid element remains zero. As a result, the loop can rely on component_dais[RSND_MAX_COMPONENT] being zero, which may lead to an out-of-bounds access.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- sound/soc/sh/rcar/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/sh/rcar/core.c +1 -1
@@ -1995,7 +1995,7 @@ static int rsnd_probe(struct platform_device *pdev)* asoc register */ ci =0 ; -for (i =0 ; priv->component_dais[i] >0 ; i++) { +for (i =0 ; i <RSND_MAX_COMPONENT && priv->component_dais[i] >0 ; i++) {int nr = priv->component_dais[i]; ret = devm_snd_soc_register_component(dev, &rsnd_soc_component,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 149/508 PCI: Enable AtomicOps only if Root Port supports them
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerd Bayer <[email protected]>
[ Upstream commit 1ae8c4ce157037e266184064a182af9ef9af278b ]
When inspecting the config space of a Connect-X physical function in an s390 system after it was initialized by the mlx5_core device driver, we found the function to be enabled to request AtomicOps despite the Root Port lacking support for completing them:
00:00.1 Ethernet controller: Mellanox Technologies MT2894 Family [ConnectX-6 Lx]
Subsystem: Mellanox Technologies Device 0002
DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis-
AtomicOpsCtl: ReqEn+
On s390 and many virtualized guests, the Endpoint is visible but the Root Port is not. In this case, pci_enable_atomic_ops_to_root() previously enabled AtomicOps in the Endpoint even though it can't tell whether the Root Port supports them as a completer.
Change pci_enable_atomic_ops_to_root() to fail if there's no Root Port or the Root Port doesn't support AtomicOps.
--- drivers/pci/pci.c | 41 ++++++++++++++++++++--------------------- 1 file changed, 20 insertions(+), 21 deletions(-)
drivers/pci/pci.c +20 -21
@@ -3956,8 +3956,7 @@ int pci_rebar_set_size(struct pci_dev *pdev, int bar, int size)*/ int pci_enable_atomic_ops_to_root (struct pci_dev *dev,u32 cap_mask) { -struct pci_bus *bus = dev->bus; -struct pci_dev *bridge; +struct pci_dev *root, *bridge;u32 cap, ctl2;/*
@@ -3987,35 +3986,35 @@ int pci_enable_atomic_ops_to_root(struct pci_dev *dev, u32 cap_mask)return -EINVAL ; } -while (bus->parent) { - bridge = bus->self; + root =pcie_find_root_port (dev); +if (!root) +return -EINVAL ; -pcie_capability_read_dword (bridge,PCI_EXP_DEVCAP2 , &cap); +pcie_capability_read_dword (root,PCI_EXP_DEVCAP2 , &cap); +if ((cap & cap_mask) != cap_mask) +return -EINVAL ; + bridge =pci_upstream_bridge (dev); +while (bridge != root) {switch (pci_pcie_type (bridge)) { -/* Ensure switch ports support AtomicOp routing */ case PCI_EXP_TYPE_UPSTREAM : -case PCI_EXP_TYPE_DOWNSTREAM : -if (!(cap &PCI_EXP_DEVCAP2_ATOMIC_ROUTE )) -return -EINVAL ; -break ; - -/* Ensure root port supports all the sizes we care about */ -case PCI_EXP_TYPE_ROOT_PORT : -if ((cap & cap_mask) != cap_mask) -return -EINVAL ; -break ; - } - -/* Ensure upstream ports don't block AtomicOps on egress */ -if (pci_pcie_type (bridge) ==PCI_EXP_TYPE_UPSTREAM ) { +/* Upstream ports must not block AtomicOps on egress */ pcie_capability_read_dword (bridge,PCI_EXP_DEVCTL2 , &ctl2);if (ctl2 &PCI_EXP_DEVCTL2_ATOMIC_EGRESS_BLOCK )return -EINVAL ; + fallthrough; + +/* All switch ports need to route AtomicOps */ +case PCI_EXP_TYPE_DOWNSTREAM : +pcie_capability_read_dword (bridge,PCI_EXP_DEVCAP2 , + &cap); +if (!(cap &PCI_EXP_DEVCAP2_ATOMIC_ROUTE )) +return -EINVAL ; +break ; } - bus = bus->parent; + bridge =pci_upstream_bridge (bridge); } pcie_capability_set_word(dev, PCI_EXP_DEVCTL2,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 150/508 PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 5573c44cb3fd01a9f62d569ae9ac870ef5f0e0ba ]
In mtk_pcie_setup_irq(), the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the function directly returns an error, without cleaning up the allocated domains.
Hence, reverse the order so that the IRQ domains are allocated after the controller's IRQ is found.
This was flagged by Sashiko during a review of "[PATCH v6 0/7] PCI:
mediatek-gen3: add power control support".
--- drivers/pci/controller/pcie-mediatek-gen3.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/pci/controller/pcie-mediatek-gen3.c +4 -4
@@ -760,14 +760,14 @@ static int mtk_pcie_setup_irq(struct mtk_gen3_pcie *pcie)struct platform_device *pdev =to_platform_device (dev);int err; - err =mtk_pcie_init_irq_domains (pcie); -if (err) -return err; - pcie->irq =platform_get_irq (pdev,0 );if (pcie->irq <0 )return pcie->irq; + err =mtk_pcie_init_irq_domains (pcie); +if (err) +return err; +irq_set_chained_handler_and_data (pcie->irq, mtk_pcie_irq_handler, pcie);return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 151/508 selftests/mm: skip migration tests if NUMA is unavailable
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: AnishMulay <[email protected]>
[ Upstream commit 54218f10dfbe88c8e41c744fd45a756cde60b8c4 ]
Currently, the migration test asserts that numa_available() returns 0. On systems where NUMA is not available (returning -1), such as certain ARM64 configurations or single-node systems, this assertion fails and crashes the test.
Update the test to check the return value of numa_available(). If it is less than 0, skip the test gracefully instead of failing.
This aligns the behavior with other MM selftests (like rmap) that skip when NUMA support is missing.
--- tools/testing/selftests/mm/migration.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/mm/migration.c +2 -1
@@ -33,7 +33,8 @@ FIXTURE_SETUP(migration) {int n; -ASSERT_EQ (numa_available (),0 ); +if (numa_available () <0 ) +SKIP (return,"NUMA not available" ); self->nthreads =numa_num_task_cpus () -1 ; self->n1 =-1 ; self->n2 =-1 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 152/508 Documentation: fix a hugetlbfs reservation statement
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jane Chu <[email protected]>
[ Upstream commit 7a197d346a44384a1a858a98ef03766840e561d4 ]
Documentation/mm/hugetlbfs_reserv.rst has
if (resv_needed <= (resv_huge_pages - free_huge_pages))
resv_huge_pages += resv_needed;
which describes this code in gather_surplus_pages()
needed = (h->resv_huge_pages + delta) - h->free_huge_pages;
if (needed <= 0) {
h->resv_huge_pages += delta;
return 0;
}which means if there are enough free hugepages to account for the new reservation, simply update the global reservation count without further action.
But the description is backwards, it should be
if (resv_needed <= (free_huge_pages - resv_huge_pages))
instead.
--- Documentation/mm/hugetlbfs_reserv.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/mm/hugetlbfs_reserv.rst +1 -1
@@ -155,7 +155,7 @@ are enough free huge pages to accommodate the reservation. If there are, the global reservation count resv_huge_pages is adjusted something like the following:: - if (resv_needed <= (resv_huge_pages - free_huge_pages)) + if (resv_needed <= (free_huge_pages - resv_huge_pages) resv_huge_pages += resv_needed; Note that the global lock hugetlb_lock is held when checking and adjusting
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 153/508 selftest: memcg: skip memcg_sock test if address family not supported
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Waiman Long <[email protected]>
[ Upstream commit 2d028f3e4bbbfd448928a8d3d2814b0b04c214f4 ]
The test_memcg_sock test in memcontrol.c sets up an IPv6 socket and send data over it to consume memory and verify that memory.stat.sock and memory.current values are close.
On systems where IPv6 isn't enabled or not configured to support SOCK_STREAM, the test_memcg_sock test always fails. When the socket() call fails, there is no way we can test the memory consumption and verify the above claim. I believe it is better to just skip the test in this case instead of reporting a test failure hinting that there may be something wrong with the memcg code.
--- tools/testing/selftests/cgroup/test_memcontrol.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
tools/testing/selftests/cgroup/test_memcontrol.c +10 -1
@@ -940,8 +940,11 @@ static int tcp_server(const char *cgroup, void *arg) saddr.sin6_port =htons (srv_args->port); sk =socket (AF_INET6 ,SOCK_STREAM ,0 ); -if (sk <0 ) +if (sk <0 ) { +/* Pass back errno to the ctl_fd */ +write (ctl_fd, &errno,sizeof (errno));return ret; + }if (setsockopt (sk,SOL_SOCKET ,SO_REUSEADDR , &yes,sizeof (yes)) <0 ) goto cleanup;
@@ -1071,6 +1074,12 @@ static int test_memcg_sock(const char *root) goto cleanup;close (args.ctl[0 ]); +/* Skip if address family not supported by protocol */ +if (err ==EAFNOSUPPORT ) { + ret =KSFT_SKIP ; + goto cleanup; + } +if (!err)break ;if (err !=EADDRINUSE )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 154/508 ALSA: scarlett2: Add missing sentinel initializer field
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Panagiotis Petrakopoulos <[email protected]>
[ Upstream commit 2428cd6e8b6fa80c36db4652702ca0acd2ce3f08 ]
A "-Wmissing-field-initializers" warning was emitted when compiling the module using the W=2 option. There is a sentinel initializer field missing in the end of scarlett2_devices[]. Tested using a Scarlett Solo 4th gen.
--- sound/usb/mixer_scarlett2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/mixer_scarlett2.c +1 -1
@@ -1011,7 +1011,7 @@ static const struct scarlett2_device_entry scarlett2_devices[] = { { USB_ID(0x1235, 0x820c), &clarett_8pre_info, "Clarett+" },/* End of list */ - { 0, NULL }, + { 0, NULL, NULL }, };/* get the starting port index number for a given port type/direction */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 155/508 ASoC: SOF: compress: return the configured codec from get_params
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
[ Upstream commit 2c4fdd055f92a2fc8602dcd88bcea08c374b7e8b ]
The SOF compressed offload path accepts codec parameters in sof_compr_set_params() and forwards them to firmware as extended data in the SOF IPC stream params message.
However, sof_compr_get_params() still returns success without filling the snd_codec structure. Since the compress core allocates that structure zeroed and copies it back to userspace on success, SNDRV_COMPRESS_GET_PARAMS returns an all-zero codec description even after the stream has been configured successfully.
The stale TODO in this callback conflates get_params() with capability discovery. Supported codec enumeration belongs in get_caps() and get_codec_caps(). get_params() should report the current codec settings.
Cache the codec accepted by sof_compr_set_params() in the per-stream SOF compress state and return it from sof_compr_get_params().
--- sound/soc/sof/compress.c | 8 +++++--- sound/soc/sof/sof-priv.h | 2 ++ 2 files changed, 7 insertions(+), 3 deletions(-)
sound/soc/sof/compress.c +5 -3
@@ -247,6 +247,7 @@ static int sof_compr_set_params(struct snd_soc_component *component, sstream->sampling_rate = params->codec.sample_rate; sstream->channels = params->codec.ch_out; sstream->sample_container_bytes = pcm->params.sample_container_bytes; + sstream->codec_params = params->codec; spcm->prepared[cstream->direction] = true;
@@ -259,9 +260,10 @@ static int sof_compr_set_params(struct snd_soc_component *component,static int sof_compr_get_params (struct snd_soc_component *component,struct snd_compr_stream *cstream,struct snd_codec *params) { -/* TODO: we don't query the supported codecs for now, if the -* application asks for an unsupported codec the set_params() will fail. -*/ +struct sof_compr_stream *sstream = cstream->runtime->private_data; + + *params = sstream->codec_params; +return 0 ; }
sound/soc/sof/sof-priv.h +2 -0
@@ -17,6 +17,7 @@#include <sound/sof/info.h> #include <sound/sof/pm.h> #include <sound/sof/trace.h> +#include <sound/compress_params.h> #include <uapi/sound/sof/fw.h> #include <sound/sof/ext_manifest.h>
@@ -119,6 +120,7 @@ struct sof_compr_stream {u32 sampling_rate;u16 channels;u16 sample_container_bytes; +struct snd_codec codec_params;size_t posn_offset; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 156/508 PCI: tegra194: Fix polling delay for L2 state
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidya Sagar <[email protected]>
[ Upstream commit adaffed907f14f954096555665ad6af2ae724d83 ]
As per PCIe r7.0, sec 5.3.3.2.1, after sending PME_Turn_Off message, Root Port should wait for 1-10 msec for PME_TO_Ack message. Currently, driver is polling for 10 msec with 1 usec delay which is aggressive. Use existing macro PCIE_PME_TO_L2_TIMEOUT_US to poll for 10 msec with 1 msec delay. Since this function is used in non-atomic context only, use non-atomic poll function.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +4 -5
@@ -205,8 +205,6 @@#define CAP_SPCIE_CAP_OFF_USP_TX_PRESET0_MASK GENMASK(11, 8)#define CAP_SPCIE_CAP_OFF_USP_TX_PRESET0_SHIFT 8 -#define PME_ACK_TIMEOUT 10000 -#define LTSSM_TIMEOUT 50000/* 50ms */ #define GEN3_GEN4_EQ_PRESET_INIT 5
@@ -1583,9 +1581,10 @@ static int tegra_pcie_try_link_l2(struct tegra_pcie_dw *pcie) val |=APPL_PM_XMT_TURNOFF_STATE ;appl_writel (pcie, val,APPL_RADM_STATUS ); -return readl_poll_timeout_atomic (pcie->appl_base +APPL_DEBUG , val, - val &APPL_DEBUG_PM_LINKST_IN_L2_LAT , -1 ,PME_ACK_TIMEOUT ); +return readl_poll_timeout (pcie->appl_base +APPL_DEBUG , val, + val &APPL_DEBUG_PM_LINKST_IN_L2_LAT , +PCIE_PME_TO_L2_TIMEOUT_US /10 , +PCIE_PME_TO_L2_TIMEOUT_US ); }static void tegra_pcie_dw_pme_turnoff (struct tegra_pcie_dw *pcie)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 157/508 PCI: tegra194: Increase LTSSM poll time on surprise link down
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manikanta Maddireddy <[email protected]>
[ Upstream commit 74dd8efe4d6cead433162147333af989a568aac7 ]
On surprise link down, LTSSM state transits from L0 -> Recovery.RcvrLock -> Recovery.RcvrSpeed -> Gen1 Recovery.RcvrLock -> Detect. Recovery.RcvrLock and Recovery.RcvrSpeed transit times are 24 ms and 48 ms respectively, so the total time from L0 to Detect is ~96 ms. Increase the poll timeout to 120 ms to account for this.
While at it, add LTSSM state defines for Detect-related states and use them in the poll condition. Use readl_poll_timeout() instead of readl_poll_timeout_atomic() in tegra_pcie_dw_pme_turnoff() since that path runs in non-atomic context.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 36 +++++++++++++--------- 1 file changed, 21 insertions(+), 15 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +21 -15
@@ -139,7 +139,11 @@#define APPL_DEBUG_PM_LINKST_IN_L0 0x11#define APPL_DEBUG_LTSSM_STATE_MASK GENMASK(8, 3)#define APPL_DEBUG_LTSSM_STATE_SHIFT 3 -#define LTSSM_STATE_PRE_DETECT 5 +#define LTSSM_STATE_DETECT_QUIET 0x00 +#define LTSSM_STATE_DETECT_ACT 0x08 +#define LTSSM_STATE_PRE_DETECT_QUIET 0x28 +#define LTSSM_STATE_DETECT_WAIT 0x30 +#define LTSSM_STATE_L2_IDLE 0xa8#define APPL_RADM_STATUS 0xE4#define APPL_PM_XMT_TURNOFF_STATE BIT(0)
@@ -205,7 +209,8 @@#define CAP_SPCIE_CAP_OFF_USP_TX_PRESET0_MASK GENMASK(11, 8)#define CAP_SPCIE_CAP_OFF_USP_TX_PRESET0_SHIFT 8 -#define LTSSM_TIMEOUT 50000/* 50ms */ +#define LTSSM_DELAY_US 10000/* 10 ms */ +#define LTSSM_TIMEOUT_US 120000/* 120 ms */ #define GEN3_GEN4_EQ_PRESET_INIT 5
@@ -1627,15 +1632,14 @@ static void tegra_pcie_dw_pme_turnoff(struct tegra_pcie_dw *pcie) data &= ~APPL_CTRL_LTSSM_EN ;writel (data, pcie->appl_base +APPL_CTRL ); - err =readl_poll_timeout_atomic (pcie->appl_base +APPL_DEBUG , - data, - ((data & -APPL_DEBUG_LTSSM_STATE_MASK ) >> -APPL_DEBUG_LTSSM_STATE_SHIFT ) == -LTSSM_STATE_PRE_DETECT , -1 ,LTSSM_TIMEOUT ); + err =readl_poll_timeout (pcie->appl_base +APPL_DEBUG , data, + ((data &APPL_DEBUG_LTSSM_STATE_MASK ) ==LTSSM_STATE_DETECT_QUIET ) || + ((data &APPL_DEBUG_LTSSM_STATE_MASK ) ==LTSSM_STATE_DETECT_ACT ) || + ((data &APPL_DEBUG_LTSSM_STATE_MASK ) ==LTSSM_STATE_PRE_DETECT_QUIET ) || + ((data &APPL_DEBUG_LTSSM_STATE_MASK ) ==LTSSM_STATE_DETECT_WAIT ), +LTSSM_DELAY_US ,LTSSM_TIMEOUT_US );if (err) -dev_info (pcie->dev,"Link didn't go to detect state\n" ); +dev_info (pcie->dev,"LTSSM state: 0x%x detect timeout: %d\n" , data, err); }/* * DBI registers may not be accessible after this as PLL-E would be
@@ -1723,12 +1727,14 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie)appl_writel (pcie, val,APPL_CTRL ); ret =readl_poll_timeout (pcie->appl_base +APPL_DEBUG , val, - ((val &APPL_DEBUG_LTSSM_STATE_MASK ) >> -APPL_DEBUG_LTSSM_STATE_SHIFT ) == -LTSSM_STATE_PRE_DETECT , -1 ,LTSSM_TIMEOUT ); + ((val &APPL_DEBUG_LTSSM_STATE_MASK ) ==LTSSM_STATE_DETECT_QUIET ) || + ((val &APPL_DEBUG_LTSSM_STATE_MASK ) ==LTSSM_STATE_DETECT_ACT ) || + ((val &APPL_DEBUG_LTSSM_STATE_MASK ) ==LTSSM_STATE_PRE_DETECT_QUIET ) || + ((val &APPL_DEBUG_LTSSM_STATE_MASK ) ==LTSSM_STATE_DETECT_WAIT ) || + ((val &APPL_DEBUG_LTSSM_STATE_MASK ) ==LTSSM_STATE_L2_IDLE ), +LTSSM_DELAY_US ,LTSSM_TIMEOUT_US );if (ret) -dev_err (pcie->dev,"Failed to go Detect state: %d\n" , ret); +dev_info (pcie->dev,"LTSSM state: 0x%x detect timeout: %d\n" , val, ret);reset_control_assert (pcie->core_rst);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 158/508 PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manikanta Maddireddy <[email protected]>
[ Upstream commit 9fa0c242f8d7acf1b124d4462d18f4023573ac1c ]
After the link reaches a Detect-related LTSSM state, disable LTSSM so it does not keep toggling between Polling and Detect. Do this by polling for the Detect state first, then clearing APPL_CTRL_LTSSM_EN in both tegra_pcie_dw_pme_turnoff() and pex_ep_event_pex_rst_assert().
--- drivers/pci/controller/dwc/pcie-tegra194.c | 29 ++++++++++++---------- 1 file changed, 16 insertions(+), 13 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +16 -13
@@ -1624,14 +1624,6 @@ static void tegra_pcie_dw_pme_turnoff(struct tegra_pcie_dw *pcie) data &= ~APPL_PINMUX_PEX_RST ;appl_writel (pcie, data,APPL_PINMUX ); -/* -* Some cards do not go to detect state even after de-asserting -* PERST#. So, de-assert LTSSM to bring link to detect state. -*/ - data =readl (pcie->appl_base +APPL_CTRL ); - data &= ~APPL_CTRL_LTSSM_EN ; -writel (data, pcie->appl_base +APPL_CTRL ); - err = readl_poll_timeout(pcie->appl_base + APPL_DEBUG, data, ((data & APPL_DEBUG_LTSSM_STATE_MASK) == LTSSM_STATE_DETECT_QUIET) || ((data & APPL_DEBUG_LTSSM_STATE_MASK) == LTSSM_STATE_DETECT_ACT) ||
@@ -1640,6 +1632,14 @@ static void tegra_pcie_dw_pme_turnoff(struct tegra_pcie_dw *pcie) LTSSM_DELAY_US, LTSSM_TIMEOUT_US);if (err)dev_info (pcie->dev,"LTSSM state: 0x%x detect timeout: %d\n" , data, err); + +/* +* Deassert LTSSM state to stop the state toggling between +* Polling and Detect. +*/ + data =readl (pcie->appl_base +APPL_CTRL ); + data &= ~APPL_CTRL_LTSSM_EN ; +writel (data, pcie->appl_base +APPL_CTRL ); }/* * DBI registers may not be accessible after this as PLL-E would be
@@ -1721,11 +1721,6 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie)if (pcie->ep_state ==EP_STATE_DISABLED )return ; -/* Disable LTSSM */ - val =appl_readl (pcie,APPL_CTRL ); - val &= ~APPL_CTRL_LTSSM_EN ; -appl_writel (pcie, val,APPL_CTRL ); - ret = readl_poll_timeout(pcie->appl_base + APPL_DEBUG, val, ((val & APPL_DEBUG_LTSSM_STATE_MASK) == LTSSM_STATE_DETECT_QUIET) || ((val & APPL_DEBUG_LTSSM_STATE_MASK) == LTSSM_STATE_DETECT_ACT) ||
@@ -1736,6 +1731,14 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie)if (ret)dev_info (pcie->dev,"LTSSM state: 0x%x detect timeout: %d\n" , val, ret); +/* +* Deassert LTSSM state to stop the state toggling between +* Polling and Detect. +*/ + val =appl_readl (pcie,APPL_CTRL ); + val &= ~APPL_CTRL_LTSSM_EN ; +appl_writel (pcie, val,APPL_CTRL ); +reset_control_assert (pcie->core_rst);tegra_pcie_disable_phy (pcie);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 159/508 PCI: tegra194: Rename root_bus to root_port_bus in tegra_pcie_downstream_dev_to_D0()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
[ Upstream commit e1bd928479fb1fa60e9034b0fdb1ab9f3fa92f33 ]
In tegra_pcie_downstream_dev_to_D0(), PCI devices are transitioned to D0 state. For iterating over the devices, first the downstream bus of the Root Port is searched from the root bus. But the name of the variable that holds the Root Port downstream bus is named as 'root_bus', which is wrong.
Rename the variable to 'root_port_bus'. Also, move the comment on 'bringing the devices to D0' to where the state is set exactly.
Stable-dep-of: 71d9f67701e1 ("PCI: tegra194: Don't force the device into the D0 state before L2")
--- drivers/pci/controller/dwc/pcie-tegra194.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +6 -6
@@ -1291,7 +1291,7 @@ static int tegra_pcie_bpmp_set_pll_state(struct tegra_pcie_dw *pcie,static void tegra_pcie_downstream_dev_to_D0 (struct tegra_pcie_dw *pcie) {struct dw_pcie_rp *pp = &pcie->pci.pp; -struct pci_bus *child, *root_bus =NULL ; +struct pci_bus *child, *root_port_bus =NULL ;struct pci_dev *pdev;/*
@@ -1304,19 +1304,19 @@ static void tegra_pcie_downstream_dev_to_D0(struct tegra_pcie_dw *pcie)*/ list_for_each_entry (child, &pp->bridge->bus->children, node) { -/* Bring downstream devices to D0 if they are not already in */ if (child->parent == pp->bridge->bus) { - root_bus = child; + root_port_bus = child;break ; } } -if (!root_bus) { -dev_err (pcie->dev,"Failed to find downstream devices\n" ); +if (!root_port_bus) { +dev_err (pcie->dev,"Failed to find downstream bus of Root Port\n" );return ; } -list_for_each_entry (pdev, &root_bus->devices, bus_list) { +/* Bring downstream devices to D0 if they are not already in */ +list_for_each_entry (pdev, &root_port_bus->devices, bus_list) {if (PCI_SLOT (pdev->devfn) ==0 ) {if (pci_set_power_state (pdev,PCI_D0 )) dev_err(pcie->dev,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 160/508 PCI: tegra194: Dont force the device into the D0 state before L2
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidya Sagar <[email protected]>
[ Upstream commit 71d9f67701e1affc82d18ca88ae798c5361beddf ]
As per PCIe CEM r6.0, sec 2.3, the PCIe Endpoint device should be in D3cold to assert WAKE# pin. The previous workaround that forced downstream devices to D0 before taking the link to L2 cited PCIe r4.0, sec 5.2, "Link State Power Management"; however, that spec does not explicitly require putting the device into D0 and only indicates that power removal may be initiated without transitioning to D3hot.
Remove the D0 workaround so that Endpoint devices can use wake functionality (WAKE# from D3). With some Endpoints the link may not enter L2 when they remain in D3, but the Root Port continues with the usual flow after PME timeout, so there is no functional issue.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 41 ---------------------- 1 file changed, 41 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +0 -41
@@ -1288,44 +1288,6 @@ static int tegra_pcie_bpmp_set_pll_state(struct tegra_pcie_dw *pcie,return 0 ; } -static void tegra_pcie_downstream_dev_to_D0 (struct tegra_pcie_dw *pcie) -{ -struct dw_pcie_rp *pp = &pcie->pci.pp; -struct pci_bus *child, *root_port_bus =NULL ; -struct pci_dev *pdev; - -/* -* link doesn't go into L2 state with some of the endpoints with Tegra -* if they are not in D0 state. So, need to make sure that immediate -* downstream devices are in D0 state before sending PME_TurnOff to put -* link into L2 state. -* This is as per PCI Express Base r4.0 v1.0 September 27-2017, -* 5.2 Link State Power Management (Page #428). -*/ - -list_for_each_entry (child, &pp->bridge->bus->children, node) { -if (child->parent == pp->bridge->bus) { - root_port_bus = child; -break ; - } - } - -if (!root_port_bus) { -dev_err (pcie->dev,"Failed to find downstream bus of Root Port\n" ); -return ; - } - -/* Bring downstream devices to D0 if they are not already in */ -list_for_each_entry (pdev, &root_port_bus->devices, bus_list) { -if (PCI_SLOT (pdev->devfn) ==0 ) { -if (pci_set_power_state (pdev,PCI_D0 )) -dev_err (pcie->dev, -"Failed to transition %s to D0 state\n" , -dev_name (&pdev->dev)); - } - } -} -static int tegra_pcie_get_slot_regulators (struct tegra_pcie_dw *pcie) { pcie->slot_ctl_3v3 =devm_regulator_get_optional (pcie->dev,"vpcie3v3" );
@@ -1655,7 +1617,6 @@ static void tegra_pcie_dw_pme_turnoff(struct tegra_pcie_dw *pcie)static void tegra_pcie_deinit_controller (struct tegra_pcie_dw *pcie) { -tegra_pcie_downstream_dev_to_D0 (pcie);dw_pcie_host_deinit (&pcie->pci.pp);tegra_pcie_dw_pme_turnoff (pcie);tegra_pcie_unconfig_controller (pcie);
@@ -2373,7 +2334,6 @@ static int tegra_pcie_dw_suspend_noirq(struct device *dev)if (!pcie->link_state)return 0 ; -tegra_pcie_downstream_dev_to_D0 (pcie);tegra_pcie_dw_pme_turnoff (pcie);tegra_pcie_unconfig_controller (pcie);
@@ -2447,7 +2407,6 @@ static void tegra_pcie_dw_shutdown(struct platform_device *pdev)return ;debugfs_remove_recursive (pcie->debugfs); -tegra_pcie_downstream_dev_to_D0 (pcie);disable_irq (pcie->pci.pp.irq);if (IS_ENABLED (CONFIG_PCI_MSI ))
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 161/508 PCI: tegra194: Disable PERST# IRQ only in Endpoint mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manikanta Maddireddy <[email protected]>
[ Upstream commit 40658a31b6e134169c648041efc84944c4c71dcd ]
The PERST# GPIO interrupt is only registered when the controller is operating in Endpoint mode. In Root Port mode, the PERST# GPIO is configured as an output to control downstream devices, and no interrupt is registered for it.
Currently, tegra_pcie_dw_stop_link() unconditionally calls disable_irq() on pex_rst_irq, which causes issues in Root Port mode where this IRQ is not registered.
Fix this by only disabling the PERST# IRQ when operating in Endpoint mode, where the interrupt is actually registered and used to detect PERST# assertion/deassertion from the host.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pci/controller/dwc/pcie-tegra194.c +2 -1
@@ -1055,7 +1055,8 @@ static void tegra_pcie_dw_stop_link(struct dw_pcie *pci) {struct tegra_pcie_dw *pcie =to_tegra_pcie (pci); -disable_irq (pcie->pex_rst_irq); +if (pcie->of_data->mode ==DW_PCIE_EP_TYPE ) +disable_irq (pcie->pex_rst_irq); }static const struct dw_pcie_ops tegra_dw_pcie_ops = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 162/508 PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidya Sagar <[email protected]>
[ Upstream commit f62bc7917de1374dce86a852ffba8baf9cb7a56a ]
The GPIO DT property "nvidia,refclk-select", to select the PCIe reference clock is optional. Use devm_gpiod_get_optional() to get it.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +3 -3
@@ -1197,9 +1197,9 @@ static int tegra_pcie_dw_parse_dt(struct tegra_pcie_dw *pcie)return err; } - pcie->pex_refclk_sel_gpiod =devm_gpiod_get (pcie->dev, -"nvidia,refclk-select" , -GPIOD_OUT_HIGH ); + pcie->pex_refclk_sel_gpiod =devm_gpiod_get_optional (pcie->dev, +"nvidia,refclk-select" , +GPIOD_OUT_HIGH );if (IS_ERR (pcie->pex_refclk_sel_gpiod)) {int err =PTR_ERR (pcie->pex_refclk_sel_gpiod);const char *level =KERN_ERR ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 163/508 PCI: tegra194: Disable direct speed change for Endpoint mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidya Sagar <[email protected]>
[ Upstream commit 976f6763f57970388bcd7118931f33f447916927 ]
Pre-silicon simulation showed the controller operating in Endpoint mode initiating link speed change after completing Secondary Bus Reset. Ideally, the Root Port or the Switch Downstream Port should initiate the link speed change post SBR, not the Endpoint.
So, as per the hardware team recommendation, disable direct speed change for the Endpoint mode to prevent it from initiating speed change after the physical layer link is up at Gen1, leaving speed change ownership with the host.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/pci/controller/dwc/pcie-tegra194.c +4 -0
@@ -1839,6 +1839,10 @@ static void pex_ep_event_pex_rst_deassert(struct tegra_pcie_dw *pcie)reset_control_deassert (pcie->core_rst); + val =dw_pcie_readl_dbi (pci,PCIE_LINK_WIDTH_SPEED_CONTROL ); + val &= ~PORT_LOGIC_SPEED_CHANGE ; +dw_pcie_writel_dbi (pci,PCIE_LINK_WIDTH_SPEED_CONTROL , val); +if (pcie->update_fc_fixup) { val =dw_pcie_readl_dbi (pci,CFG_TIMER_CTRL_MAX_FUNC_NUM_OFF ); val |=0x1 <<CFG_TIMER_CTRL_ACK_NAK_SHIFT ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 164/508 PCI: tegra194: Allow system suspend when the Endpoint link is not up
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidya Sagar <[email protected]>
[ Upstream commit c76f8eae7d4695b1176c4ea5eb93c17e16a20272 ]
Host software initiates the L2 sequence. PCIe link is kept in L2 state during suspend. If Endpoint mode is enabled and the link is up, the software cannot proceed with suspend. However, when the PCIe Endpoint driver is probed, but the PCIe link is not up, Tegra can go into suspend state. So, allow system to suspend in this case.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 31 +++++++++++++++++----- 1 file changed, 25 insertions(+), 6 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +25 -6
@@ -2307,16 +2307,28 @@ static void tegra_pcie_dw_remove(struct platform_device *pdev)gpiod_set_value (pcie->pex_refclk_sel_gpiod,0 ); } -static int tegra_pcie_dw_suspend_late (struct device *dev) +static int tegra_pcie_dw_suspend (struct device *dev) {struct tegra_pcie_dw *pcie =dev_get_drvdata (dev); -u32 val;if (pcie->of_data->mode ==DW_PCIE_EP_TYPE ) { -dev_err (dev,"Failed to Suspend as Tegra PCIe is in EP mode\n" ); -return -EPERM ; +if (pcie->ep_state ==EP_STATE_ENABLED ) { +dev_err (dev,"Tegra PCIe is in EP mode, suspend not allowed\n" ); +return -EPERM ; + } + +disable_irq (pcie->pex_rst_irq); +return 0 ; } +return 0 ; +} + +static int tegra_pcie_dw_suspend_late (struct device *dev) +{ +struct tegra_pcie_dw *pcie =dev_get_drvdata (dev); +u32 val; +if (!pcie->link_state)return 0 ;
@@ -2336,6 +2348,9 @@ static int tegra_pcie_dw_suspend_noirq(struct device *dev) {struct tegra_pcie_dw *pcie =dev_get_drvdata (dev); +if (pcie->of_data->mode ==DW_PCIE_EP_TYPE ) +return 0 ; +if (!pcie->link_state)return 0 ;
@@ -2350,6 +2365,9 @@ static int tegra_pcie_dw_resume_noirq(struct device *dev)struct tegra_pcie_dw *pcie =dev_get_drvdata (dev);int ret; +if (pcie->of_data->mode ==DW_PCIE_EP_TYPE ) +return 0 ; +if (!pcie->link_state)return 0 ;
@@ -2382,8 +2400,8 @@ static int tegra_pcie_dw_resume_early(struct device *dev)u32 val;if (pcie->of_data->mode ==DW_PCIE_EP_TYPE ) { -dev_err (dev,"Suspend is not supported in EP mode" ); -return -ENOTSUPP ; +enable_irq (pcie->pex_rst_irq); +return 0 ; }if (!pcie->link_state)
@@ -2488,6 +2506,7 @@ static const struct of_device_id tegra_pcie_dw_of_match[] = { };static const struct dev_pm_ops tegra_pcie_dw_pm_ops = { + .suspend = tegra_pcie_dw_suspend, .suspend_late = tegra_pcie_dw_suspend_late, .suspend_noirq = tegra_pcie_dw_suspend_noirq, .resume_noirq = tegra_pcie_dw_resume_noirq,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 165/508 PCI: tegra194: Use DWC IP core version
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manikanta Maddireddy <[email protected]>
[ Upstream commit ea60ca067f0f098043610c96a915d162113c1aac ]
Tegra194 PCIe driver used custom version numbers to detect Tegra194 and Tegra234 IPs. With version detect logic added, version check results in mismatch warnings:
tegra194-pcie 14100000.pcie: Versions don't match (0000562a != 3536322a)
Use HW version numbers which match to PORT_LOGIC.PCIE_VERSION_OFF in Tegra194 driver to avoid these kernel warnings.
--- drivers/pci/controller/dwc/pcie-designware.h | 2 ++ drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-)
drivers/pci/controller/dwc/pcie-designware.h +2 -0
@@ -31,8 +31,10 @@#define DW_PCIE_VER_470A 0x3437302a#define DW_PCIE_VER_480A 0x3438302a#define DW_PCIE_VER_490A 0x3439302a +#define DW_PCIE_VER_500A 0x3530302a#define DW_PCIE_VER_520A 0x3532302a#define DW_PCIE_VER_540A 0x3534302a +#define DW_PCIE_VER_562A 0x3536322a#define __dw_pcie_ver_cmp (_pci, _ver, _op) \ ((_pci)->version _op DW_PCIE_VER_ ## _ver)
drivers/pci/controller/dwc/pcie-tegra194.c +2 -2
@@ -37,8 +37,8 @@#include <soc/tegra/bpmp-abi.h> #include "../../pci.h" -#define TEGRA194_DWC_IP_VER 0x490A -#define TEGRA234_DWC_IP_VER 0x562A +#define TEGRA194_DWC_IP_VER DW_PCIE_VER_500A +#define TEGRA234_DWC_IP_VER DW_PCIE_VER_562A#define APPL_PINMUX 0x0#define APPL_PINMUX_PEX_RST BIT(0)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 166/508 PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manikanta Maddireddy <[email protected]>
[ Upstream commit 40805f32dceadebb7381d911003100bec7b8cd51 ]
The ECRC (TLP digest) workaround was originally added for DesignWare version 4.90a. Tegra234 SoC has 5.00a DWC HW version, which has the same ATU TD override behaviour, so apply the workaround for 5.00a too.
--- drivers/pci/controller/dwc/pcie-designware.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/pci/controller/dwc/pcie-designware.c +8 -8
@@ -426,13 +426,13 @@ static inline void dw_pcie_writel_atu_ob(struct dw_pcie *pci, u32 index, u32 regstatic inline u32 dw_pcie_enable_ecrc (u32 val) {/* -* DesignWare core version 4.90A has a design issue where the 'TD' -* bit in the Control register-1 of the ATU outbound region acts -* like an override for the ECRC setting, i.e., the presence of TLP -* Digest (ECRC) in the outgoing TLPs is solely determined by this -* bit. This is contrary to the PCIe spec which says that the -* enablement of the ECRC is solely determined by the AER -* registers. +* DWC versions 0x3530302a and 0x3536322a have a design issue where +* the 'TD' bit in the Control register-1 of the ATU outbound +* region acts like an override for the ECRC setting, i.e., the +* presence of TLP Digest (ECRC) in the outgoing TLPs is solely +* determined by this bit. This is contrary to the PCIe spec which +* says that the enablement of the ECRC is solely determined by the +* AER registers. * * Because of this, even when the ECRC is enabled through AER * registers, the transactions going through ATU won't have TLP
@@ -502,7 +502,7 @@ static int __dw_pcie_prog_outbound_atu(struct dw_pcie *pci, u8 func_no,if (upper_32_bits (limit_addr) >upper_32_bits (cpu_addr) && dw_pcie_ver_is_ge(pci, 460A)) val |=PCIE_ATU_INCREASE_REGION_SIZE ; - if (dw_pcie_ver_is(pci, 490A)) + if (dw_pcie_ver_is(pci, 490A) || dw_pcie_ver_is(pci, 500A)) val =dw_pcie_enable_ecrc (val);dw_pcie_writel_atu_ob (pci, index,PCIE_ATU_REGION_CTRL1 , val);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 167/508 spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <[email protected]>
[ Upstream commit ab00febad191d7a4400aa1c3468279fb508258d4 ]
mtk_snand_probe() registers the on-host NAND ECC engine, but teardown was missing from both probe unwind and remove-time cleanup. Add a devm cleanup action after successful registration so nand_ecc_unregister_on_host_hw_engine() runs automatically on probe failures and during device removal.
--- drivers/spi/spi-mtk-snfi.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/spi/spi-mtk-snfi.c +14 -0
@@ -1307,6 +1307,13 @@ static const struct spi_controller_mem_caps mtk_snand_mem_caps = { .ecc = true, }; +static void mtk_unregister_ecc_engine (void *data) +{ +struct nand_ecc_engine *eng = data; + +nand_ecc_unregister_on_host_hw_engine (eng); +} +static irqreturn_t mtk_snand_irq (int irq,void *id) {struct mtk_snand *snf = id;
@@ -1487,6 +1494,13 @@ static int mtk_snand_probe(struct platform_device *pdev) goto disable_clk; } + ret =devm_add_action_or_reset (&pdev->dev, mtk_unregister_ecc_engine, + &ms->ecc_eng); +if (ret) { +dev_err_probe (&pdev->dev, ret,"failed to add ECC unregister action\n" ); + goto release_ecc; + } + ctlr->num_chipselect =1 ; ctlr->mem_ops = &mtk_snand_mem_ops; ctlr->mem_caps = &mtk_snand_mem_caps;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 168/508 ALSA: sc6000: Use standard print API
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit e7c475b92043c02c3e6cd0c20e308fbb6f03ebde ]
Use the standard print API with dev_*() instead of the old house-baked one. It gives better information and allows dynamically control of debug prints.
Some functions are changed to receive a device pointer to be passed to dev_*() calls.
Stable-dep-of: fb79bf127ac2 ("ALSA: sc6000: Keep the programmed board state in card-private data")
--- sound/isa/sc6000.c | 177 +++++++++++++++++++++++---------------------- 1 file changed, 90 insertions(+), 87 deletions(-)
sound/isa/sc6000.c +90 -87
@@ -204,7 +204,7 @@ static int sc6000_read(char __iomem *vport) } -static int sc6000_write (char __iomem *vport,int cmd) +static int sc6000_write (struct device *devptr,char __iomem *vport,int cmd) {unsigned char val;int loop =500000 ;
@@ -221,18 +221,19 @@ static int sc6000_write(char __iomem *vport, int cmd)cpu_relax (); }while (loop--); -snd_printk (KERN_ERR "DSP Command (0x%x) timeout.\n" , cmd); +dev_err (devptr,"DSP Command (0x%x) timeout.\n" , cmd);return -EIO ; } -static int sc6000_dsp_get_answer (char __iomem *vport,int command, +static int sc6000_dsp_get_answer (struct device *devptr, +char __iomem *vport,int command,char *data,int data_len) {int len =0 ; -if (sc6000_write (vport, command)) { -snd_printk (KERN_ERR "CMD 0x%x: failed!\n" , command); +if (sc6000_write (devptr, vport, command)) { +dev_err (devptr,"CMD 0x%x: failed!\n" , command);return -EIO ; }
@@ -265,82 +266,86 @@ static int sc6000_dsp_reset(char __iomem *vport) }/* detection and initialization */ -static int sc6000_hw_cfg_write (char __iomem *vport,const int *cfg) +static int sc6000_hw_cfg_write (struct device *devptr, +char __iomem *vport,const int *cfg) { -if (sc6000_write (vport,COMMAND_6C ) <0 ) { -snd_printk (KERN_WARNING "CMD 0x%x: failed!\n" ,COMMAND_6C ); +if (sc6000_write (devptr, vport,COMMAND_6C ) <0 ) { +dev_warn (devptr,"CMD 0x%x: failed!\n" ,COMMAND_6C );return -EIO ; } -if (sc6000_write (vport,COMMAND_5C ) <0 ) { -snd_printk (KERN_ERR "CMD 0x%x: failed!\n" ,COMMAND_5C ); +if (sc6000_write (devptr, vport,COMMAND_5C ) <0 ) { +dev_err (devptr,"CMD 0x%x: failed!\n" ,COMMAND_5C );return -EIO ; } -if (sc6000_write (vport, cfg[0 ]) <0 ) { -snd_printk (KERN_ERR "DATA 0x%x: failed!\n" , cfg[0 ]); +if (sc6000_write (devptr, vport, cfg[0 ]) <0 ) { +dev_err (devptr,"DATA 0x%x: failed!\n" , cfg[0 ]);return -EIO ; } -if (sc6000_write (vport, cfg[1 ]) <0 ) { -snd_printk (KERN_ERR "DATA 0x%x: failed!\n" , cfg[1 ]); +if (sc6000_write (devptr, vport, cfg[1 ]) <0 ) { +dev_err (devptr,"DATA 0x%x: failed!\n" , cfg[1 ]);return -EIO ; } -if (sc6000_write (vport,COMMAND_C5 ) <0 ) { -snd_printk (KERN_ERR "CMD 0x%x: failed!\n" ,COMMAND_C5 ); +if (sc6000_write (devptr, vport,COMMAND_C5 ) <0 ) { +dev_err (devptr,"CMD 0x%x: failed!\n" ,COMMAND_C5 );return -EIO ; }return 0 ; } -static int sc6000_cfg_write (char __iomem *vport,unsigned char softcfg) +static int sc6000_cfg_write (struct device *devptr, +char __iomem *vport,unsigned char softcfg) { -if (sc6000_write (vport,WRITE_MDIRQ_CFG )) { -snd_printk (KERN_ERR "CMD 0x%x: failed!\n" ,WRITE_MDIRQ_CFG ); +if (sc6000_write (devptr, vport,WRITE_MDIRQ_CFG )) { +dev_err (devptr,"CMD 0x%x: failed!\n" ,WRITE_MDIRQ_CFG );return -EIO ; } -if (sc6000_write (vport, softcfg)) { -snd_printk (KERN_ERR "sc6000_cfg_write: failed!\n" ); +if (sc6000_write (devptr, vport, softcfg)) { +dev_err (devptr,"%s: failed!\n" , __func__);return -EIO ; }return 0 ; } -static int sc6000_setup_board (char __iomem *vport,int config) +static int sc6000_setup_board (struct device *devptr, +char __iomem *vport,int config) {int loop =10 ;do { -if (sc6000_write (vport,COMMAND_88 )) { -snd_printk (KERN_ERR "CMD 0x%x: failed!\n" , -COMMAND_88 ); +if (sc6000_write (devptr, vport,COMMAND_88 )) { +dev_err (devptr,"CMD 0x%x: failed!\n" , +COMMAND_88 );return -EIO ; } }while ((sc6000_wait_data (vport) <0 ) && loop--);if (sc6000_read (vport) <0 ) { -snd_printk (KERN_ERR "sc6000_read after CMD 0x%x: failed\n" , -COMMAND_88 ); +dev_err (devptr,"sc6000_read after CMD 0x%x: failed\n" , +COMMAND_88 );return -EIO ; } -if (sc6000_cfg_write (vport, config)) +if (sc6000_cfg_write (devptr, vport, config))return -ENODEV ;return 0 ; } -static int sc6000_init_mss (char __iomem *vport,int config, +static int sc6000_init_mss (struct device *devptr, +char __iomem *vport,int config,char __iomem *vmss_port,int mss_config) { -if (sc6000_write (vport,DSP_INIT_MSS )) { -snd_printk (KERN_ERR "sc6000_init_mss [0x%x]: failed!\n" , -DSP_INIT_MSS ); +if (sc6000_write (devptr, vport,DSP_INIT_MSS )) { +dev_err (devptr,"%s [0x%x]: failed!\n" , __func__, +DSP_INIT_MSS );return -EIO ; }msleep (10 ); -if (sc6000_cfg_write (vport, config)) +if (sc6000_cfg_write (devptr, vport, config))return -EIO ;iowrite8 (mss_config, vmss_port);
@@ -348,7 +353,8 @@ static int sc6000_init_mss(char __iomem *vport, int config,return 0 ; } -static void sc6000_hw_cfg_encode (char __iomem *vport,int *cfg, +static void sc6000_hw_cfg_encode (struct device *devptr, +char __iomem *vport,int *cfg,long xport,long xmpu,long xmss_port,int joystick) {
@@ -367,10 +373,11 @@ static void sc6000_hw_cfg_encode(char __iomem *vport, int *cfg, cfg[0 ] |=0x02 ; cfg[1 ] |=0x80 ;/* enable WSS system */ cfg[1 ] &= ~0x40 ;/* disable IDE */ -snd_printd ("hw cfg %x, %x\n" , cfg[0 ], cfg[1 ]); +dev_dbg (devptr,"hw cfg %x, %x\n" , cfg[0 ], cfg[1 ]); } -static int sc6000_init_board (char __iomem *vport, +static int sc6000_init_board (struct device *devptr, +char __iomem *vport,char __iomem *vmss_port,int dev) {char answer[15 ];
@@ -384,14 +391,14 @@ static int sc6000_init_board(char __iomem *vport, err =sc6000_dsp_reset (vport);if (err <0 ) { -snd_printk (KERN_ERR "sc6000_dsp_reset: failed!\n" ); +dev_err (devptr,"sc6000_dsp_reset: failed!\n" );return err; }memset (answer,0 ,sizeof (answer)); - err =sc6000_dsp_get_answer (vport,GET_DSP_COPYRIGHT , answer,15 ); + err =sc6000_dsp_get_answer (devptr, vport,GET_DSP_COPYRIGHT , answer,15 );if (err <=0 ) { -snd_printk (KERN_ERR "sc6000_dsp_copyright: failed!\n" ); +dev_err (devptr,"sc6000_dsp_copyright: failed!\n" );return -ENODEV ; }/*
@@ -399,52 +406,52 @@ static int sc6000_init_board(char __iomem *vport,* if we have something different, we have to be warned. */ if (strncmp ("SC-6000" , answer,7 )) -snd_printk (KERN_WARNING "Warning: non SC-6000 audio card!\n" ); +dev_warn (devptr,"Warning: non SC-6000 audio card!\n" ); -if (sc6000_dsp_get_answer (vport,GET_DSP_VERSION , version,2 ) <2 ) { -snd_printk (KERN_ERR "sc6000_dsp_version: failed!\n" ); +if (sc6000_dsp_get_answer (devptr, vport,GET_DSP_VERSION , version,2 ) <2 ) { +dev_err (devptr,"sc6000_dsp_version: failed!\n" );return -ENODEV ; } - printk(KERN_INFO PFX "Detected model: %s, DSP version %d.%d\n", +dev_info (devptr,"Detected model: %s, DSP version %d.%d\n" , answer, version[0 ], version[1 ]);/* set configuration */ -sc6000_write (vport,COMMAND_5C ); +sc6000_write (devptr, vport,COMMAND_5C );if (sc6000_read (vport) <0 ) old =1 ;if (!old) {int cfg[2 ]; -sc6000_hw_cfg_encode (vport, &cfg[0 ], port[dev], mpu_port[dev], +sc6000_hw_cfg_encode (devptr, + vport, &cfg[0 ], port[dev], mpu_port[dev], mss_port[dev], joystick[dev]); -if (sc6000_hw_cfg_write (vport, cfg) <0 ) { -snd_printk (KERN_ERR "sc6000_hw_cfg_write: failed!\n" ); +if (sc6000_hw_cfg_write (devptr, vport, cfg) <0 ) { +dev_err (devptr,"sc6000_hw_cfg_write: failed!\n" );return -EIO ; } } - err =sc6000_setup_board (vport, config); + err =sc6000_setup_board (devptr, vport, config);if (err <0 ) { -snd_printk (KERN_ERR "sc6000_setup_board: failed!\n" ); +dev_err (devptr,"sc6000_setup_board: failed!\n" );return -ENODEV ; }sc6000_dsp_reset (vport);if (!old) { -sc6000_write (vport,COMMAND_60 ); -sc6000_write (vport,0x02 ); +sc6000_write (devptr, vport,COMMAND_60 ); +sc6000_write (devptr, vport,0x02 );sc6000_dsp_reset (vport); } - err =sc6000_setup_board (vport, config); + err =sc6000_setup_board (devptr, vport, config);if (err <0 ) { -snd_printk (KERN_ERR "sc6000_setup_board: failed!\n" ); +dev_err (devptr,"sc6000_setup_board: failed!\n" );return -ENODEV ; } - err =sc6000_init_mss (vport, config, vmss_port, mss_config); + err =sc6000_init_mss (devptr, vport, config, vmss_port, mss_config);if (err <0 ) { -snd_printk (KERN_ERR "Cannot initialize " -"Microsoft Sound System mode.\n" ); +dev_err (devptr,"Cannot initialize Microsoft Sound System mode.\n" );return -ENODEV ; }
@@ -491,39 +498,39 @@ static int snd_sc6000_match(struct device *devptr, unsigned int dev)if (!enable[dev])return 0 ;if (port[dev] ==SNDRV_AUTO_PORT ) { - printk(KERN_ERR PFX "specify IO port\n"); +dev_err (devptr,"specify IO port\n" );return 0 ; }if (mss_port[dev] ==SNDRV_AUTO_PORT ) { - printk(KERN_ERR PFX "specify MSS port\n"); +dev_err (devptr,"specify MSS port\n" );return 0 ; }if (port[dev] !=0x220 && port[dev] !=0x240 ) { - printk(KERN_ERR PFX "Port must be 0x220 or 0x240\n"); +dev_err (devptr,"Port must be 0x220 or 0x240\n" );return 0 ; }if (mss_port[dev] !=0x530 && mss_port[dev] !=0xe80 ) { - printk(KERN_ERR PFX "MSS port must be 0x530 or 0xe80\n"); +dev_err (devptr,"MSS port must be 0x530 or 0xe80\n" );return 0 ; }if (irq[dev] !=SNDRV_AUTO_IRQ && !sc6000_irq_to_softcfg (irq[dev])) { - printk(KERN_ERR PFX "invalid IRQ %d\n", irq[dev]); +dev_err (devptr,"invalid IRQ %d\n" , irq[dev]);return 0 ; }if (dma[dev] !=SNDRV_AUTO_DMA && !sc6000_dma_to_softcfg (dma[dev])) { - printk(KERN_ERR PFX "invalid DMA %d\n", dma[dev]); +dev_err (devptr,"invalid DMA %d\n" , dma[dev]);return 0 ; }if (mpu_port[dev] !=SNDRV_AUTO_PORT && (mpu_port[dev] & ~0x30L ) !=0x300 ) { - printk(KERN_ERR PFX "invalid MPU-401 port %lx\n", +dev_err (devptr,"invalid MPU-401 port %lx\n" , mpu_port[dev]);return 0 ; }if (mpu_port[dev] !=SNDRV_AUTO_PORT && mpu_irq[dev] !=SNDRV_AUTO_IRQ && mpu_irq[dev] !=0 && !sc6000_mpu_irq_to_softcfg (mpu_irq[dev])) { - printk(KERN_ERR PFX "invalid MPU-401 IRQ %d\n", mpu_irq[dev]); +dev_err (devptr,"invalid MPU-401 IRQ %d\n" , mpu_irq[dev]);return 0 ; }return 1 ;
@@ -534,7 +541,7 @@ static void snd_sc6000_free(struct snd_card *card)char __iomem *vport = (char __force __iomem *)card->private_data;if (vport) -sc6000_setup_board (vport,0 ); +sc6000_setup_board (card->dev, vport,0 ); }static int __snd_sc6000_probe (struct device *devptr,unsigned int dev)
@@ -558,7 +565,7 @@ static int __snd_sc6000_probe(struct device *devptr, unsigned int dev)if (xirq ==SNDRV_AUTO_IRQ ) { xirq =snd_legacy_find_free_irq (possible_irqs);if (xirq <0 ) { - snd_printk(KERN_ERR PFX "unable to find a free IRQ\n"); +dev_err (devptr,"unable to find a free IRQ\n" );return -EBUSY ; } }
@@ -566,42 +573,39 @@ static int __snd_sc6000_probe(struct device *devptr, unsigned int dev)if (xdma ==SNDRV_AUTO_DMA ) { xdma =snd_legacy_find_free_dma (possible_dmas);if (xdma <0 ) { - snd_printk(KERN_ERR PFX "unable to find a free DMA\n"); +dev_err (devptr,"unable to find a free DMA\n" );return -EBUSY ; } }if (!devm_request_region (devptr, port[dev],0x10 ,DRV_NAME )) { - snd_printk(KERN_ERR PFX - "I/O port region is already in use.\n"); +dev_err (devptr,"I/O port region is already in use.\n" );return -EBUSY ; } vport =devm_ioport_map (devptr, port[dev],0x10 );if (!vport) { - snd_printk(KERN_ERR PFX - "I/O port cannot be iomapped.\n"); +dev_err (devptr,"I/O port cannot be iomapped.\n" );return -EBUSY ; } card->private_data = (void __force *)vport;/* to make it marked as used */ if (!devm_request_region (devptr, mss_port[dev],4 ,DRV_NAME )) { - snd_printk(KERN_ERR PFX - "SC-6000 port I/O port region is already in use.\n"); +dev_err (devptr, +"SC-6000 port I/O port region is already in use.\n" );return -EBUSY ; } vmss_port =devm_ioport_map (devptr, mss_port[dev],4 );if (!vmss_port) { - snd_printk(KERN_ERR PFX - "MSS port I/O cannot be iomapped.\n"); +dev_err (devptr,"MSS port I/O cannot be iomapped.\n" );return -EBUSY ; } -snd_printd ("Initializing BASE[0x%lx] IRQ[%d] DMA[%d] MIRQ[%d]\n" , - port[dev], xirq, xdma, - mpu_irq[dev] ==SNDRV_AUTO_IRQ ?0 : mpu_irq[dev]); +dev_dbg (devptr,"Initializing BASE[0x%lx] IRQ[%d] DMA[%d] MIRQ[%d]\n" , + port[dev], xirq, xdma, + mpu_irq[dev] ==SNDRV_AUTO_IRQ ?0 : mpu_irq[dev]); - err =sc6000_init_board (vport, vmss_port, dev); + err =sc6000_init_board (devptr, vport, vmss_port, dev);if (err <0 )return err; card->private_free = snd_sc6000_free;
@@ -613,25 +617,24 @@ static int __snd_sc6000_probe(struct device *devptr, unsigned int dev) err =snd_wss_pcm (chip,0 );if (err <0 ) { - snd_printk(KERN_ERR PFX - "error creating new WSS PCM device\n"); +dev_err (devptr,"error creating new WSS PCM device\n" );return err; } err =snd_wss_mixer (chip);if (err <0 ) { - snd_printk(KERN_ERR PFX "error creating new WSS mixer\n"); +dev_err (devptr,"error creating new WSS mixer\n" );return err; } err =snd_sc6000_mixer (chip);if (err <0 ) { - snd_printk(KERN_ERR PFX "the mixer rewrite failed\n"); +dev_err (devptr,"the mixer rewrite failed\n" );return err; }if (snd_opl3_create (card,0x388 ,0x388 +2 ,OPL3_HW_AUTO ,0 , &opl3) <0 ) { - snd_printk(KERN_ERR PFX "no OPL device at 0x%x-0x%x ?\n", - 0x388, 0x388 + 2); +dev_err (devptr,"no OPL device at 0x%x-0x%x ?\n" , +0x388 ,0x388 +2 ); }else { err =snd_opl3_hwdep_new (opl3,0 ,1 ,NULL );if (err <0 )
@@ -645,8 +648,8 @@ static int __snd_sc6000_probe(struct device *devptr, unsigned int dev) MPU401_HW_MPU401, mpu_port[dev], 0, mpu_irq[dev], NULL) < 0) -snd_printk (KERN_ERR "no MPU-401 device at 0x%lx ?\n" , - mpu_port[dev]); +dev_err (devptr,"no MPU-401 device at 0x%lx ?\n" , + mpu_port[dev]); }strcpy (card->driver,DRV_NAME );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 169/508 ALSA: sc6000: Keep the programmed board state in card-private data
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
[ Upstream commit fb79bf127ac2577b4876132da6dba768018aad4c ]
The driver may auto-select IRQ and DMA resources at probe time, but sc6000_init_board() still derives the SC-6000 soft configuration from the module parameter arrays. When irq=auto or dma=auto is used, the codec is created with the selected resources while the board is programmed with the unresolved values.
Store the mapped ports and generated SC-6000 board configuration in card-private data, build that configuration from the live probe results instead of the raw module parameters, and keep the probe-time board programming in a shared helper.
This fixes the resource-programming mismatch and leaves the driver with a stable board-state block that can be reused by suspend/resume.
--- sound/isa/sc6000.c | 152 +++++++++++++++++++++++++++------------------ 1 file changed, 92 insertions(+), 60 deletions(-)
sound/isa/sc6000.c +92 -60
@@ -100,6 +100,15 @@ MODULE_PARM_DESC(joystick, "Enable gameport.");#define PFX "sc6000: "#define DRV_NAME "SC-6000" +struct snd_sc6000 { +char __iomem *vport; +char __iomem *vmss_port; +u8 mss_config; +u8 config; +u8 hw_cfg[2 ]; +bool old_dsp; +}; +/* hardware dependent functions */ /*
@@ -267,7 +276,7 @@ static int sc6000_dsp_reset(char __iomem *vport)/* detection and initialization */ static int sc6000_hw_cfg_write (struct device *devptr, -char __iomem *vport,const int *cfg) +char __iomem *vport,const u8 *cfg) {if (sc6000_write (devptr, vport,COMMAND_6C ) <0 ) {dev_warn (devptr,"CMD 0x%x: failed!\n" ,COMMAND_6C );
@@ -353,8 +362,7 @@ static int sc6000_init_mss(struct device *devptr,return 0 ; } -static void sc6000_hw_cfg_encode (struct device *devptr, -char __iomem *vport,int *cfg, +static void sc6000_hw_cfg_encode (struct device *devptr,u8 *cfg,long xport,long xmpu,long xmss_port,int joystick) {
@@ -376,27 +384,83 @@ static void sc6000_hw_cfg_encode(struct device *devptr,dev_dbg (devptr,"hw cfg %x, %x\n" , cfg[0 ], cfg[1 ]); } -static int sc6000_init_board (struct device *devptr, -char __iomem *vport, -char __iomem *vmss_port,int dev) +static void sc6000_prepare_board (struct device *devptr, +struct snd_sc6000 *sc6000, +unsigned int dev,int xirq,int xdma) +{ + sc6000->mss_config =sc6000_irq_to_softcfg (xirq) | +sc6000_dma_to_softcfg (xdma); + sc6000->config = sc6000->mss_config | +sc6000_mpu_irq_to_softcfg (mpu_irq[dev]); +sc6000_hw_cfg_encode (devptr, sc6000->hw_cfg, port[dev], mpu_port[dev], + mss_port[dev], joystick[dev]); +} + +static void sc6000_detect_old_dsp (struct device *devptr, +struct snd_sc6000 *sc6000) +{ +sc6000_write (devptr, sc6000->vport,COMMAND_5C ); + sc6000->old_dsp =sc6000_read (sc6000->vport) <0 ; +} + +static int sc6000_program_board (struct device *devptr, +struct snd_sc6000 *sc6000) +{ +int err; + +if (!sc6000->old_dsp) { +if (sc6000_hw_cfg_write (devptr, sc6000->vport, + sc6000->hw_cfg) <0 ) { +dev_err (devptr,"sc6000_hw_cfg_write: failed!\n" ); +return -EIO ; + } + } + + err =sc6000_setup_board (devptr, sc6000->vport, sc6000->config); +if (err <0 ) { +dev_err (devptr,"sc6000_setup_board: failed!\n" ); +return -ENODEV ; + } + +sc6000_dsp_reset (sc6000->vport); + +if (!sc6000->old_dsp) { +sc6000_write (devptr, sc6000->vport,COMMAND_60 ); +sc6000_write (devptr, sc6000->vport,0x02 ); +sc6000_dsp_reset (sc6000->vport); + } + + err =sc6000_setup_board (devptr, sc6000->vport, sc6000->config); +if (err <0 ) { +dev_err (devptr,"sc6000_setup_board: failed!\n" ); +return -ENODEV ; + } + + err =sc6000_init_mss (devptr, sc6000->vport, sc6000->config, + sc6000->vmss_port, sc6000->mss_config); +if (err <0 ) { +dev_err (devptr,"Cannot initialize Microsoft Sound System mode.\n" ); +return -ENODEV ; + } + +return 0 ; +} + +static int sc6000_init_board (struct device *devptr,struct snd_sc6000 *sc6000) {char answer[15 ];char version[2 ]; -int mss_config =sc6000_irq_to_softcfg (irq[dev]) | -sc6000_dma_to_softcfg (dma[dev]); -int config = mss_config | -sc6000_mpu_irq_to_softcfg (mpu_irq[dev]);int err; -int old =0 ; - err =sc6000_dsp_reset (vport); + err =sc6000_dsp_reset (sc6000->vport);if (err <0 ) {dev_err (devptr,"sc6000_dsp_reset: failed!\n" );return err; }memset (answer,0 ,sizeof (answer)); - err =sc6000_dsp_get_answer (devptr, vport,GET_DSP_COPYRIGHT , answer,15 ); + err =sc6000_dsp_get_answer (devptr, sc6000->vport,GET_DSP_COPYRIGHT , + answer,15 );if (err <=0 ) {dev_err (devptr,"sc6000_dsp_copyright: failed!\n" );return -ENODEV ;
@@ -408,54 +472,17 @@ static int sc6000_init_board(struct device *devptr,if (strncmp ("SC-6000" , answer,7 ))dev_warn (devptr,"Warning: non SC-6000 audio card!\n" ); -if (sc6000_dsp_get_answer (devptr, vport,GET_DSP_VERSION , version,2 ) <2 ) { +if (sc6000_dsp_get_answer (devptr, sc6000->vport, +GET_DSP_VERSION , version,2 ) <2 ) {dev_err (devptr,"sc6000_dsp_version: failed!\n" );return -ENODEV ; }dev_info (devptr,"Detected model: %s, DSP version %d.%d\n" , answer, version[0 ], version[1 ]); -/* set configuration */ -sc6000_write (devptr, vport,COMMAND_5C ); -if (sc6000_read (vport) <0 ) - old =1 ; - -if (!old) { -int cfg[2 ]; -sc6000_hw_cfg_encode (devptr, - vport, &cfg[0 ], port[dev], mpu_port[dev], - mss_port[dev], joystick[dev]); -if (sc6000_hw_cfg_write (devptr, vport, cfg) <0 ) { -dev_err (devptr,"sc6000_hw_cfg_write: failed!\n" ); -return -EIO ; - } - } - err =sc6000_setup_board (devptr, vport, config); -if (err <0 ) { -dev_err (devptr,"sc6000_setup_board: failed!\n" ); -return -ENODEV ; - } - -sc6000_dsp_reset (vport); - -if (!old) { -sc6000_write (devptr, vport,COMMAND_60 ); -sc6000_write (devptr, vport,0x02 ); -sc6000_dsp_reset (vport); - } +sc6000_detect_old_dsp (devptr, sc6000); - err =sc6000_setup_board (devptr, vport, config); -if (err <0 ) { -dev_err (devptr,"sc6000_setup_board: failed!\n" ); -return -ENODEV ; - } - err =sc6000_init_mss (devptr, vport, config, vmss_port, mss_config); -if (err <0 ) { -dev_err (devptr,"Cannot initialize Microsoft Sound System mode.\n" ); -return -ENODEV ; - } - -return 0 ; +return sc6000_program_board (devptr, sc6000); }static int snd_sc6000_mixer (struct snd_wss *chip)
@@ -538,10 +565,10 @@ static int snd_sc6000_match(struct device *devptr, unsigned int dev)static void snd_sc6000_free (struct snd_card *card) { -char __iomem *vport = (char __force __iomem *)card->private_data; +struct snd_sc6000 *sc6000 = card->private_data; -if (vport) -sc6000_setup_board (card->dev, vport,0 ); +if (sc6000->vport) +sc6000_setup_board (card->dev, sc6000->vport,0 ); }static int __snd_sc6000_probe (struct device *devptr,unsigned int dev)
@@ -552,15 +579,17 @@ static int __snd_sc6000_probe(struct device *devptr, unsigned int dev)int xirq = irq[dev];int xdma = dma[dev];struct snd_card *card; +struct snd_sc6000 *sc6000;struct snd_wss *chip;struct snd_opl3 *opl3;char __iomem *vport;char __iomem *vmss_port; err =snd_devm_card_new (devptr, index[dev], id[dev],THIS_MODULE , -0 , &card); +sizeof (*sc6000), &card);if (err <0 )return err; + sc6000 = card->private_data;if (xirq ==SNDRV_AUTO_IRQ ) { xirq =snd_legacy_find_free_irq (possible_irqs);
@@ -587,7 +616,7 @@ static int __snd_sc6000_probe(struct device *devptr, unsigned int dev)dev_err (devptr,"I/O port cannot be iomapped.\n" );return -EBUSY ; } - card->private_data = (void __force *)vport; + sc6000->vport = vport;/* to make it marked as used */ if (!devm_request_region (devptr, mss_port[dev],4 ,DRV_NAME )) {
@@ -600,12 +629,15 @@ static int __snd_sc6000_probe(struct device *devptr, unsigned int dev)dev_err (devptr,"MSS port I/O cannot be iomapped.\n" );return -EBUSY ; } + sc6000->vmss_port = vmss_port;dev_dbg (devptr,"Initializing BASE[0x%lx] IRQ[%d] DMA[%d] MIRQ[%d]\n" , port[dev], xirq, xdma, mpu_irq[dev] ==SNDRV_AUTO_IRQ ?0 : mpu_irq[dev]); - err =sc6000_init_board (devptr, vport, vmss_port, dev); +sc6000_prepare_board (devptr, sc6000, dev, xirq, xdma); + + err =sc6000_init_board (devptr, sc6000);if (err <0 )return err; card->private_free = snd_sc6000_free;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 170/508 dm cache: fix missing return in invalidate_committeds error path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming-Hung Tsai <[email protected]>
[ Upstream commit 8c0ee19db81f0fa1ff25fd75b22b17c0cc2acde3 ]
In passthrough mode, dm-cache defers write submission until after metadata commit completes via the invalidate_committed() continuation. On commit error, invalidate_committed() calls invalidate_complete() to end the bio and free the migration struct, after which it should return immediately.
The patch 4ca8b8bd952d ("dm cache: fix write hang in passthrough mode") omitted this early return, causing execution to fall through into the success path on error. This results in use-after-free on the migration struct in the subsequent calls.
Fix by adding the missing return after the invalidate_complete() call.
--- drivers/md/dm-cache-target.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/md/dm-cache-target.c +3 -1
@@ -1523,8 +1523,10 @@ static void invalidate_committed(struct work_struct *ws)struct bio *bio = mg->overwrite_bio;struct per_bio_data *pb =get_per_bio_data (bio); -if (mg->k.input) +if (mg->k.input) {invalidate_complete (mg, false); +return ; + }init_continuation (&mg->k, invalidate_completed);remap_to_origin_clear_discard (cache, bio, mg->invalidate_oblock);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 171/508 crypto: jitterentropy - replace long-held spinlock with mutex
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haixin Xu <[email protected]>
[ Upstream commit 01d798e9feb30212952d4e992801ba6bd6a82351 ]
jent_kcapi_random() serializes the shared jitterentropy state, but it currently holds a spinlock across the jent_read_entropy() call. That path performs expensive jitter collection and SHA3 conditioning, so parallel readers can trigger stalls as contending waiters spin for the same lock.
To prevent non-preemptible lock hold, replace rng->jent_lock with a mutex so contended readers sleep instead of spinning on a shared lock held across expensive entropy generation.
--- crypto/jitterentropy-kcapi.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
crypto/jitterentropy-kcapi.c +7 -7
@@ -42,6 +42,7 @@#include <linux/fips.h> #include <linux/kernel.h> #include <linux/module.h> +#include <linux/mutex.h> #include <linux/slab.h> #include <linux/time.h> #include <crypto/internal/rng.h>
@@ -182,7 +183,7 @@ int jent_read_random_block(void *hash_state, char *dst, unsigned int dst_len)***************************************************************************/ struct jitterentropy { -spinlock_t jent_lock; +struct mutex jent_lock;struct rand_data *entropy_collector;struct crypto_shash *tfm;struct shash_desc *sdesc;
@@ -192,7 +193,7 @@ static void jent_kcapi_cleanup(struct crypto_tfm *tfm) {struct jitterentropy *rng =crypto_tfm_ctx (tfm); -spin_lock (&rng->jent_lock); +mutex_lock (&rng->jent_lock);if (rng->sdesc) {shash_desc_zero (rng->sdesc);
@@ -207,7 +208,7 @@ static void jent_kcapi_cleanup(struct crypto_tfm *tfm)if (rng->entropy_collector)jent_entropy_collector_free (rng->entropy_collector); rng->entropy_collector =NULL ; -spin_unlock (&rng->jent_lock); +mutex_unlock (&rng->jent_lock); }static int jent_kcapi_init (struct crypto_tfm *tfm)
@@ -217,7 +218,7 @@ static int jent_kcapi_init(struct crypto_tfm *tfm)struct shash_desc *sdesc;int size, ret =0 ; -spin_lock_init (&rng->jent_lock); +mutex_init (&rng->jent_lock);/* * Use SHA3-256 as conditioner. We allocate only the generic
@@ -252,7 +253,6 @@ static int jent_kcapi_init(struct crypto_tfm *tfm) goto err; } -spin_lock_init (&rng->jent_lock);return 0 ; err:
@@ -267,7 +267,7 @@ static int jent_kcapi_random(struct crypto_rng *tfm,struct jitterentropy *rng =crypto_rng_ctx (tfm);int ret =0 ; -spin_lock (&rng->jent_lock); +mutex_lock (&rng->jent_lock); ret =jent_read_entropy (rng->entropy_collector, rdata, dlen);
@@ -293,7 +293,7 @@ static int jent_kcapi_random(struct crypto_rng *tfm, ret = -EINVAL ; } -spin_unlock (&rng->jent_lock); +mutex_unlock (&rng->jent_lock);return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 172/508 gfs2: Call unlock_new_inode before d_instantiate
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit 2ff7cf7e0640ff071ebc5c7e3dc2df024a7c91e6 ]
As Neil Brown describes in detail in the link referenced below, new inodes must be unlocked before they can be instantiated.
An even better fix is to use d_instantiate_new(), which combines d_instantiate() and unlock_new_inode().
--- fs/gfs2/inode.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/gfs2/inode.c +1 -2
@@ -805,7 +805,7 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry, goto fail_gunlock4;mark_inode_dirty (inode); -d_instantiate (dentry, inode); +d_instantiate_new (dentry, inode);/* After instantiate, errors should result in evict which will destroy * both inode and iopen glocks properly. */ if (file) {
@@ -817,7 +817,6 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,gfs2_glock_dq_uninit (&gh);gfs2_glock_put (io_gl);gfs2_qa_put (dip); -unlock_new_inode (inode);return error; fail_gunlock4:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 173/508 ktest: Avoid undef warning when WARNINGS_FILE is unset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <[email protected]>
[ Upstream commit 057854f8a595160656fe77ed7bf0d2403724b915 ]
check_buildlog() probes $warnings_file with -f even when WARNINGS_FILE is not configured. Perl warns about the uninitialized value and adds noise to the test log, which can hide the output we actually care about.
Check that WARNINGS_FILE is defined before testing whether the file exists.
--- tools/testing/ktest/ktest.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/ktest/ktest.pl +1 -1
@@ -2472,7 +2472,7 @@ sub check_buildlog { my $save_no_reboot = $no_reboot; $no_reboot = 1; - if (-f $warnings_file) { + if (defined($warnings_file) && -f $warnings_file) { open(IN, $warnings_file) or dodie "Error opening $warnings_file";
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 174/508 ktest: Honor empty per-test option overrides
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <[email protected]>
[ Upstream commit a2de57a3c8192dcd67cccaff6c341b93748d799b ]
A per-test override can clear an inherited default option by assigning an empty value, but __set_test_option() still used option_defined() to decide whether a per-test key existed. That turned an empty per-test assignment back into "fall back to the default", so tests still could not clear inherited settings.
For example:
DEFAULTS
(...)
LOG_FILE = /tmp/ktest-empty-override.log
CLEAR_LOG = 1
ADD_CONFIG = /tmp/.config
TEST_START
TEST_TYPE = build
BUILD_TYPE = nobuild
ADD_CONFIG =
This would run the test with ADD_CONFIG[1] = /tmp/.config
Fix by checking whether the per-test key exists before falling back. If it does exist but is empty, treat it as unset for that test and stop the fallback chain there.
--- tools/testing/ktest/ktest.pl | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
tools/testing/ktest/ktest.pl +4 -2
@@ -4113,7 +4113,8 @@ sub __set_test_option { my $option = "$name\[$i\]"; - if (option_defined($option)) { + if (exists($opt{$option})) { + return undef if (!option_defined($option)); return $opt{$option}; }
@@ -4121,7 +4122,8 @@ sub __set_test_option { if ($i >= $test && $i < $test + $repeat_tests{$test}) { $option = "$name\[$test\]"; - if (option_defined($option)) { + if (exists($opt{$option})) { + return undef if (!option_defined($option)); return $opt{$option}; } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 175/508 ktest: Run POST_KTEST hooks on failure and cancellation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <[email protected]>
[ Upstream commit bc6e165a452da909cef0efbc286e6695624db372 ]
PRE_KTEST can be useful for setting up the environment and POST_KTEST to tear it down, however POST_KTEST only runs on the normal end-of-run path. It is skipped when ktest exits through dodie() or cancel_test(). Final cleanup hooks are skipped.
Factor the final hook execution into run_post_ktest(), call it from the normal exit path and from the early exit paths, and guard it so the hook runs at most once.
--- tools/testing/ktest/ktest.pl | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-)
tools/testing/ktest/ktest.pl +22 -5
@@ -98,6 +98,7 @@ my $test_type; my $build_type; my $build_options; my $final_post_ktest; +my $post_ktest_done = 0; my $pre_ktest; my $post_ktest; my $pre_test;
@@ -1537,6 +1538,24 @@ sub get_test_name() { return $name; } +sub run_post_ktest { + my $cmd; + + return if ($post_ktest_done); + + if (defined($final_post_ktest)) { + $cmd = $final_post_ktest; + } elsif (defined($post_ktest)) { + $cmd = $post_ktest; + } else { + return; + } + + my $cp_post_ktest = eval_kernel_version($cmd); + run_command $cp_post_ktest; + $post_ktest_done = 1; +} + sub dodie { # avoid recursion return if ($in_die);
@@ -1596,6 +1615,7 @@ sub dodie { if (defined($post_test)) { run_command $post_test; } + run_post_ktest; die @_, "\n"; }
@@ -4230,6 +4250,7 @@ sub cancel_test { send_email("KTEST: Your [$name] test was cancelled", "Your test started at $script_start_time was cancelled: sig int"); } + run_post_ktest; die "\nCaught Sig Int, test interrupted: $!\n" }
@@ -4540,11 +4561,7 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) { success $i; } -if (defined($final_post_ktest)) { - - my $cp_final_post_ktest = eval_kernel_version $final_post_ktest; - run_command $cp_final_post_ktest; -} +run_post_ktest; if ($opt{"POWEROFF_ON_SUCCESS"}) { halt;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 176/508 quota: Fix race of dquot_scan_active() with quota deactivation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit e93ab401da4b2e2c1b8ef2424de2f238d51c8b2d ]
dquot_scan_active() can race with quota deactivation in quota_release_workfn() like:
CPU0 (quota_release_workfn) CPU1 (dquot_scan_active)
============================== ==============================
spin_lock(&dq_list_lock);
list_replace_init(
&releasing_dquots, &rls_head);
/* dquot X on rls_head,
dq_count == 0,
DQ_ACTIVE_B still set */
spin_unlock(&dq_list_lock);
synchronize_srcu(&dquot_srcu);
spin_lock(&dq_list_lock);
list_for_each_entry(dquot,
&inuse_list, dq_inuse) {
/* finds dquot X */
dquot_active(X) -> true
atomic_inc(&X->dq_count);
}
spin_unlock(&dq_list_lock);
spin_lock(&dq_list_lock);
dquot = list_first_entry(&rls_head);
WARN_ON_ONCE(atomic_read(&dquot->dq_count));The problem is not only a cosmetic one as under memory pressure the caller of dquot_scan_active() can end up working on freed dquot.
Fix the problem by making sure the dquot is removed from releasing list when we acquire a reference to it.
--- fs/quota/dquot.c | 38 ++++++++++++++++++++++++++++++-------- include/linux/quotaops.h | 9 +-------- 2 files changed, 31 insertions(+), 16 deletions(-)
fs/quota/dquot.c +30 -8
@@ -364,6 +364,31 @@ static inline int dquot_active(struct dquot *dquot)return test_bit (DQ_ACTIVE_B , &dquot->dq_flags); } +static struct dquot *__dqgrab (struct dquot *dquot) +{ +lockdep_assert_held (&dq_list_lock); +if (!atomic_read (&dquot->dq_count)) +remove_free_dquot (dquot); +atomic_inc (&dquot->dq_count); +return dquot; +} + +/* +* Get reference to dquot when we got pointer to it by some other means. The +* dquot has to be active and the caller has to make sure it cannot get +* deactivated under our hands. +*/ +struct dquot *dqgrab (struct dquot *dquot) +{ +spin_lock (&dq_list_lock); +WARN_ON_ONCE (!dquot_active (dquot)); + dquot =__dqgrab (dquot); +spin_unlock (&dq_list_lock); + +return dquot; +} +EXPORT_SYMBOL_GPL (dqgrab); +static inline int dquot_dirty (struct dquot *dquot) {return test_bit (DQ_MOD_B , &dquot->dq_flags);
@@ -642,15 +667,14 @@ int dquot_scan_active(struct super_block *sb,continue ;if (dquot->dq_sb != sb)continue ; -/* Now we have active dquot so we can just increase use count */ -atomic_inc (&dquot->dq_count); +__dqgrab (dquot);spin_unlock (&dq_list_lock);dqput (old_dquot); old_dquot = dquot;/* * ->release_dquot() can be racing with us. Our reference -* protects us from new calls to it so just wait for any -* outstanding call and recheck the DQ_ACTIVE_B after that. +* protects us from dquot_release() proceeding so just wait for +* any outstanding call and recheck the DQ_ACTIVE_B after that. */ wait_on_dquot (dquot);if (dquot_active (dquot)) {
@@ -718,7 +742,7 @@ int dquot_writeback_dquots(struct super_block *sb, int type)/* Now we have active dquot from which someone is * holding reference so we can safely just increase * use count */ -dqgrab (dquot); +__dqgrab (dquot);spin_unlock (&dq_list_lock); err =dquot_write_dquot (dquot);if (err && !ret)
@@ -973,9 +997,7 @@ struct dquot *dqget(struct super_block *sb, struct kqid qid)spin_unlock (&dq_list_lock);dqstats_inc (DQST_LOOKUPS ); }else { -if (!atomic_read (&dquot->dq_count)) -remove_free_dquot (dquot); -atomic_inc (&dquot->dq_count); +__dqgrab (dquot);spin_unlock (&dq_list_lock);dqstats_inc (DQST_CACHE_HITS );dqstats_inc (DQST_LOOKUPS );
include/linux/quotaops.h +1 -8
@@ -44,14 +44,7 @@ int dquot_initialize(struct inode *inode);bool dquot_initialize_needed (struct inode *inode);void dquot_drop (struct inode *inode);struct dquot *dqget (struct super_block *sb,struct kqid qid); -static inline struct dquot *dqgrab (struct dquot *dquot) -{ -/* Make sure someone else has active reference to dquot */ -WARN_ON_ONCE (!atomic_read (&dquot->dq_count)); -WARN_ON_ONCE (!test_bit (DQ_ACTIVE_B , &dquot->dq_flags)); -atomic_inc (&dquot->dq_count); -return dquot; -} +struct dquot *dqgrab (struct dquot *dquot);static inline bool dquot_is_busy (struct dquot *dquot) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 177/508 gfs2: add some missing log locking
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit fe2c8d051150b90b3ccb85f89e3b1d636cb88ec8 ]
Function gfs2_logd() calls the log flushing functions gfs2_ail1_start(), gfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp->sd_log_flush_lock, but these functions require exclusion against concurrent transactions.
To fix that, add a non-locking __gfs2_log_flush() function. Then, in gfs2_logd(), take sdp->sd_log_flush_lock before calling the above mentioned log flushing functions and __gfs2_log_flush().
--- fs/gfs2/log.c | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-)
fs/gfs2/log.c +20 -8
@@ -1024,14 +1024,15 @@ static void trans_drain(struct gfs2_trans *tr) }/** -* gfs2_log_flush - flush incore transaction(s) +* __gfs2_log_flush - flush incore transaction(s) * @sdp: The filesystem * @gl: The glock structure to flush. If NULL, flush the whole incore log * @flags: The log header flags: GFS2_LOG_HEAD_FLUSH_* and debug flags * */ -void gfs2_log_flush (struct gfs2_sbd *sdp,struct gfs2_glock *gl,u32 flags) +static void __gfs2_log_flush (struct gfs2_sbd *sdp,struct gfs2_glock *gl, +u32 flags) {struct gfs2_trans *tr =NULL ;unsigned int reserved_blocks =0 , used_blocks =0 ;
@@ -1039,7 +1040,6 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags)unsigned int first_log_head;unsigned int reserved_revokes =0 ; -down_write (&sdp->sd_log_flush_lock);trace_gfs2_log_flush (sdp,1 , flags); repeat:
@@ -1151,7 +1151,6 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags)gfs2_assert_withdraw_delayed (sdp, used_blocks < reserved_blocks);gfs2_log_release (sdp, reserved_blocks - used_blocks); } -up_write (&sdp->sd_log_flush_lock);gfs2_trans_free (sdp, tr);if (gfs2_withdrawing (sdp))gfs2_withdraw (sdp);
@@ -1174,6 +1173,13 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags) goto out_end; } +void gfs2_log_flush (struct gfs2_sbd *sdp,struct gfs2_glock *gl,u32 flags) +{ +down_write (&sdp->sd_log_flush_lock); +__gfs2_log_flush (sdp, gl, flags); +up_write (&sdp->sd_log_flush_lock); +} +/** * gfs2_merge_trans - Merge a new transaction into a cached transaction * @sdp: the filesystem
@@ -1315,19 +1321,25 @@ int gfs2_logd(void *data) }if (gfs2_jrnl_flush_reqd (sdp) || t ==0 ) { +down_write (&sdp->sd_log_flush_lock);gfs2_ail1_empty (sdp,0 ); -gfs2_log_flush (sdp,NULL ,GFS2_LOG_HEAD_FLUSH_NORMAL | -GFS2_LFC_LOGD_JFLUSH_REQD ); +__gfs2_log_flush (sdp,NULL , +GFS2_LOG_HEAD_FLUSH_NORMAL | +GFS2_LFC_LOGD_JFLUSH_REQD ); +up_write (&sdp->sd_log_flush_lock); }if (test_bit (SDF_FORCE_AIL_FLUSH , &sdp->sd_flags) ||gfs2_ail_flush_reqd (sdp)) {clear_bit (SDF_FORCE_AIL_FLUSH , &sdp->sd_flags); +down_write (&sdp->sd_log_flush_lock);gfs2_ail1_start (sdp);gfs2_ail1_wait (sdp);gfs2_ail1_empty (sdp,0 ); -gfs2_log_flush (sdp,NULL ,GFS2_LOG_HEAD_FLUSH_NORMAL | -GFS2_LFC_LOGD_AIL_FLUSH_REQD ); +__gfs2_log_flush (sdp,NULL , +GFS2_LOG_HEAD_FLUSH_NORMAL | +GFS2_LFC_LOGD_AIL_FLUSH_REQD ); +up_write (&sdp->sd_log_flush_lock); } t =gfs2_tune_get (sdp, gt_logd_secs) *HZ ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 178/508 gfs2: prevent NULL pointer dereference during unmount
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit 74b4dbb946060a3233604d91859a9abd3708141d ]
When flushing out outstanding glock work during an unmount, gfs2_log_flush() can be called when sdp->sd_jdesc has already been deallocated and sdp->sd_jdesc is NULL. Commit 35264909e9d1 ("gfs2: Fix NULL pointer dereference in gfs2_log_flush") added a check for that to gfs2_log_flush() itself, but it missed the sdp->sd_jdesc dereference in gfs2_log_release(). Fix that.
--- fs/gfs2/log.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/gfs2/log.c +3 -2
@@ -478,8 +478,9 @@ void gfs2_log_release(struct gfs2_sbd *sdp, unsigned int blks) {atomic_add (blks, &sdp->sd_log_blks_free);trace_gfs2_log_blocks (sdp, blks); -gfs2_assert_withdraw (sdp,atomic_read (&sdp->sd_log_blks_free) <= - sdp->sd_jdesc->jd_blocks); +gfs2_assert_withdraw (sdp, !sdp->sd_jdesc || +atomic_read (&sdp->sd_log_blks_free) <= + sdp->sd_jdesc->jd_blocks);if (atomic_read (&sdp->sd_log_blks_needed))wake_up (&sdp->sd_log_waitq); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 179/508 efi/capsule-loader: fix incorrect sizeof in phys array reallocation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Huth <[email protected]>
[ Upstream commit 48a428215782321b56956974f23593e40ce84b7a ]
The krealloc() call for cap_info->phys in __efi_capsule_setup_info() uses sizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be causing an undersized allocation.
The allocation is also inconsistent with the initial array allocation in efi_capsule_open() that allocates one entry with sizeof(phys_addr_t), and the efi_capsule_write() function that stores phys_addr_t values (not pointers) via page_to_phys().
On 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this goes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but pointers are 32-bit, this allocates half the required space, which might lead to a heap buffer overflow when storing physical addresses.
This is similar to the bug fixed in commit fccfa646ef36 ("efi/capsule-loader:
fix incorrect allocation size") which fixed the same issue at the initial allocation site.
--- drivers/firmware/efi/capsule-loader.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/efi/capsule-loader.c +1 -1
@@ -67,7 +67,7 @@ int __efi_capsule_setup_info(struct capsule_info *cap_info) cap_info->pages = temp_page; temp_page =krealloc (cap_info->phys, - pages_needed *sizeof (phys_addr_t *), + pages_needed *sizeof (phys_addr_t),GFP_KERNEL | __GFP_ZERO);if (!temp_page)return -ENOMEM ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 180/508 ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Klinesmith <[email protected]>
[ Upstream commit 3e298897f41c61450c2e7a4f457e8b2485eb35b3 ]
ksmbd_crypt_message() sets a NULL completion callback on AEAD requests and does not handle the -EINPROGRESS return code from async hardware crypto engines like the Qualcomm Crypto Engine (QCE). When QCE returns -EINPROGRESS, ksmbd treats it as an error and immediately frees the request while the hardware DMA operation is still in flight. The DMA completion callback then dereferences freed memory, causing a NULL pointer crash:
pc : qce_skcipher_done+0x24/0x174 lr : vchan_complete+0x230/0x27c ... el1h_64_irq+0x68/0x6c ksmbd_free_work_struct+0x20/0x118 [ksmbd] ksmbd_exit_file_cache+0x694/0xa4c [ksmbd]
Use the standard crypto_wait_req() pattern with crypto_req_done() as the completion callback, matching the approach used by the SMB client in fs/smb/client/smb2ops.c. This properly handles both synchronous engines (immediate return) and async engines (-EINPROGRESS followed by callback notification).
--- fs/smb/server/auth.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
fs/smb/server/auth.c +6 -5
@@ -1106,6 +1106,7 @@ int ksmbd_crypt_message(struct ksmbd_work *work, struct kvec *iov,struct smb2_transform_hdr *tr_hdr =smb2_get_msg (iov[0 ].iov_base);unsigned int assoc_data_len =sizeof (struct smb2_transform_hdr ) -20 ;int rc; +DECLARE_CRYPTO_WAIT (wait);struct scatterlist *sg;u8 sign[SMB2_SIGNATURE_SIZE ] = {};u8 key[SMB3_ENC_DEC_KEY_SIZE ];
@@ -1192,12 +1193,12 @@ int ksmbd_crypt_message(struct ksmbd_work *work, struct kvec *iov,aead_request_set_crypt (req, sg, sg, crypt_len, iv);aead_request_set_ad (req, assoc_data_len); -aead_request_set_callback (req,CRYPTO_TFM_REQ_MAY_SLEEP ,NULL ,NULL ); +aead_request_set_callback (req,CRYPTO_TFM_REQ_MAY_BACKLOG | +CRYPTO_TFM_REQ_MAY_SLEEP , + crypto_req_done, &wait); -if (enc) - rc =crypto_aead_encrypt (req); -else - rc =crypto_aead_decrypt (req); + rc =crypto_wait_req (enc ?crypto_aead_encrypt (req) : +crypto_aead_decrypt (req), &wait);if (rc) goto free_iv;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 181/508 ARM: dts: mediatek: mt7623: fix efuse fallback compatible
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit 5978ff33cc6f0988388a2830dc5cd2ea4e81f36a ]
Fix following validation error:arch/arm/boot/dts/mediatek/mt7623a-rfb-emmc.dtb: efuse@10206000: compatible: 'oneOf' conditional failed, one must be fixed:
['mediatek,mt7623-efuse', 'mediatek,mt8173-efuse'] is too long
'mediatek,mt8173-efuse' was expected
'mediatek,efuse' was expected
from schema $id: http://devicetree.org/schemas/nvmem/mediatek,efuse.yaml#arch/arm/boot/dts/mediatek/mt7623a-rfb-emmc.dtb: efuse@10206000: Unevaluated properties are not allowed ('compatible' was unexpected)
from schema $id: http://devicetree.org/schemas/nvmem/mediatek,efuse.yaml#
--- arch/arm/boot/dts/mediatek/mt7623.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/mediatek/mt7623.dtsi +1 -1
@@ -328,7 +328,7 @@ sysirq: interrupt-controller@10200100 { efuse: efuse@10206000 { compatible = "mediatek,mt7623-efuse", - "mediatek,mt8173-efuse"; + "mediatek,efuse"; reg = <0 0x10206000 0 0x1000>; #address-cells = <1>; #size-cells = <1>;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 182/508 memory: tegra124-emc: Fix dll_change check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Perttunen <[email protected]>
[ Upstream commit 9597ab9a8296ab337e6820f8a717ff621078b632 ]
The code checking whether the specified memory timing enables DLL in the EMRS register was reversed. DLL is enabled if bit A0 is low. Fix the check.
--- drivers/memory/tegra/tegra124-emc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/memory/tegra/tegra124-emc.c +1 -1
@@ -608,7 +608,7 @@ static int tegra_emc_prepare_timing_change(struct tegra_emc *emc,if ((last->emc_mode_1 &0x1 ) == (timing->emc_mode_1 &0x1 )) dll_change =DLL_CHANGE_NONE ; -else if (timing->emc_mode_1 &0x1 ) +else if (!(timing->emc_mode_1 &0x1 )) dll_change =DLL_CHANGE_ON ;else dll_change =DLL_CHANGE_OFF ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 183/508 memory: tegra30-emc: Fix dll_change check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Perttunen <[email protected]>
[ Upstream commit 0a93f2355cf4922ad2399dbef5ea1049fef116d4 ]
The code checking whether the specified memory timing enables DLL in the EMRS register was reversed. DLL is enabled if bit A0 is low. Fix the check.
--- drivers/memory/tegra/tegra30-emc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/memory/tegra/tegra30-emc.c +3 -3
@@ -554,14 +554,14 @@ static int emc_prepare_timing_change(struct tegra_emc *emc, unsigned long rate) emc->emc_cfg =readl_relaxed (emc->regs +EMC_CFG ); emc_dbg =readl_relaxed (emc->regs +EMC_DBG ); -if (emc->dll_on == !!(timing->emc_mode_1 &0x1 )) +if (emc->dll_on == !(timing->emc_mode_1 &0x1 )) dll_change =DLL_CHANGE_NONE ; -else if (timing->emc_mode_1 &0x1 ) +else if (!(timing->emc_mode_1 &0x1 )) dll_change =DLL_CHANGE_ON ;else dll_change =DLL_CHANGE_OFF ; - emc->dll_on = !!(timing->emc_mode_1 &0x1 ); + emc->dll_on = !(timing->emc_mode_1 &0x1 );if (timing->data[80 ] && !readl_relaxed (emc->regs +EMC_ZCAL_INTERVAL )) emc->zcal_long = true;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 184/508 arm64: dts: imx8-apalis: Fix LEDs name collision
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <[email protected]>
[ Upstream commit 92ab53b9bb2a72581c32073755077af916eb9aee ]
Ixora boards have multiple instances of status leds, to avoid a name collision add the function-enumerator property.
This fixes the following Linux kernel warnings:
leds-gpio leds: Led green:status renamed to green:status_1 due to name collision leds-gpio leds: Led red:status renamed to red:status_1 due to name collision
--- arch/arm64/boot/dts/freescale/imx8-apalis-ixora-v1.1.dtsi | 4 ++++ arch/arm64/boot/dts/freescale/imx8-apalis-ixora-v1.2.dtsi | 4 ++++ 2 files changed, 8 insertions(+)
arch/arm64/boot/dts/freescale/imx8-apalis-ixora-v1.1.dtsi +4 -0
@@ -21,6 +21,7 @@ led-1 { color = <LED_COLOR_ID_GREEN>; default-state = "off"; function = LED_FUNCTION_STATUS; + function-enumerator = <1>; gpios = <&lsio_gpio5 27 GPIO_ACTIVE_HIGH>; };
@@ -29,6 +30,7 @@ led-2 { color = <LED_COLOR_ID_RED>; default-state = "off"; function = LED_FUNCTION_STATUS; + function-enumerator = <1>; gpios = <&lsio_gpio5 29 GPIO_ACTIVE_HIGH>; };
@@ -37,6 +39,7 @@ led-3 { color = <LED_COLOR_ID_GREEN>; default-state = "off"; function = LED_FUNCTION_STATUS; + function-enumerator = <2>; gpios = <&lsio_gpio5 20 GPIO_ACTIVE_HIGH>; };
@@ -45,6 +48,7 @@ led-4 { color = <LED_COLOR_ID_RED>; default-state = "off"; function = LED_FUNCTION_STATUS; + function-enumerator = <2>; gpios = <&lsio_gpio5 21 GPIO_ACTIVE_HIGH>; }; };
arch/arm64/boot/dts/freescale/imx8-apalis-ixora-v1.2.dtsi +4 -0
@@ -21,6 +21,7 @@ led-1 { color = <LED_COLOR_ID_GREEN>; default-state = "off"; function = LED_FUNCTION_STATUS; + function-enumerator = <1>; gpios = <&lsio_gpio5 27 GPIO_ACTIVE_HIGH>; };
@@ -29,6 +30,7 @@ led-2 { color = <LED_COLOR_ID_RED>; default-state = "off"; function = LED_FUNCTION_STATUS; + function-enumerator = <1>; gpios = <&lsio_gpio5 29 GPIO_ACTIVE_HIGH>; };
@@ -37,6 +39,7 @@ led-3 { color = <LED_COLOR_ID_GREEN>; default-state = "off"; function = LED_FUNCTION_STATUS; + function-enumerator = <2>; gpios = <&lsio_gpio5 20 GPIO_ACTIVE_HIGH>; };
@@ -45,6 +48,7 @@ led-4 { color = <LED_COLOR_ID_RED>; default-state = "off"; function = LED_FUNCTION_STATUS; + function-enumerator = <2>; gpios = <&lsio_gpio5 21 GPIO_ACTIVE_HIGH>; }; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 185/508 arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sherry Sun <[email protected]>
[ Upstream commit d1e7eab6033f9885a02c4b4e8f09e34d8e9d21ab ]
The current pin configuration for MX8MP_IOMUXC_SD1_DATA4__GPIO2_IO06 sets the weak pull-up but does not enable the pull select field. Bit 8 in the IOMUX register must be set in order for the weak pull-up to actually take effect.
Update the pinctrl setting from 0x40 to 0x140 to enable both the pull select and the weak pull-up, ensuring the line behaves as expected.
--- arch/arm64/boot/dts/freescale/imx8mp-evk.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8mp-evk.dts +1 -1
@@ -764,7 +764,7 @@ MX8MP_IOMUXC_SD1_DATA5__GPIO2_IO07 0x40 pinctrl_pcie0_reg: pcie0reggrp { fsl,pins = < - MX8MP_IOMUXC_SD1_DATA4__GPIO2_IO06 0x40 + MX8MP_IOMUXC_SD1_DATA4__GPIO2_IO06 0x140 >; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 186/508 iommufd: vfio compatibility extension check for noiommu mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Pan <[email protected]>
[ Upstream commit 7147ec874ea08c322d779d8eba28946e294ed1f3 ]
VFIO_CHECK_EXTENSION should return false for TYPE1_IOMMU variants when in NO-IOMMU mode and IOMMUFD compat container is set. This change makes the behavior match VFIO_CONTAINER in noiommu mode. It also prevents userspace from incorrectly attempting to use TYPE1 IOMMU operations in a no-iommu context.
--- drivers/iommu/iommufd/vfio_compat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/iommufd/vfio_compat.c +1 -1
@@ -283,7 +283,7 @@ static int iommufd_vfio_check_extension(struct iommufd_ctx *ictx,case VFIO_TYPE1_IOMMU :case VFIO_TYPE1v2_IOMMU:case VFIO_UNMAP_ALL : -return 1 ; +return !ictx->no_iommu_mode;case VFIO_NOIOMMU_IOMMU :return IS_ENABLED (CONFIG_VFIO_NOIOMMU );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 187/508 arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akari Tsuyukusa <[email protected]>
[ Upstream commit c4c4823c8a5baa10b8100b01f49d7c3f4a871689 ]
The gpio-ranges in the MT6795 pinctrl node were incorrectly defined, therefore, GPIO196 cannot be used.
Correct the range count to match the driver.
--- arch/arm64/boot/dts/mediatek/mt6795.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt6795.dtsi +1 -1
@@ -353,7 +353,7 @@ pio: pinctrl@10005000 { <GIC_SPI 154 IRQ_TYPE_LEVEL_HIGH>; gpio-controller; #gpio-cells = <2>; - gpio-ranges = <&pio 0 0 196>; + gpio-ranges = <&pio 0 0 197>; interrupt-controller; #interrupt-cells = <2>; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 188/508 arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akari Tsuyukusa <[email protected]>
[ Upstream commit 820ed0c1a13c5fafb36232538d793f99a0986ef3 ]
The gpio-ranges in the MT7986A pinctrl node were incorrectly defined, therefore, pin 100 cannot be used.
Correct the range count to match the driver.
--- arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt7986a.dtsi +1 -1
@@ -187,7 +187,7 @@ pio: pinctrl@1001f000 { "iocfg_lb", "iocfg_tr", "iocfg_tl", "eint"; gpio-controller; #gpio-cells = <2>; - gpio-ranges = <&pio 0 0 100>; + gpio-ranges = <&pio 0 0 101>; interrupt-controller; interrupts = <GIC_SPI 225 IRQ_TYPE_LEVEL_HIGH>; interrupt-parent = <&gic>;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 189/508 arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Barnabás Czémán <[email protected]>
[ Upstream commit 9e87f0eaadccc3fecdf3c3c0334e05694804b5f5 ]
PMI8950 doesn't actually support setting an OVP threshold value of 29.6 V. The closest allowed value is 29.5 V. Set that instead.
--- arch/arm64/boot/dts/qcom/msm8953-xiaomi-vince.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/msm8953-xiaomi-vince.dts +1 -1
@@ -169,7 +169,7 @@ &pm8953_resin { &pmi8950_wled { qcom,current-limit-microamp = <20000>; - qcom,ovp-millivolt = <29600>; + qcom,ovp-millivolt = <29500>; qcom,num-strings = <2>; qcom,external-pfet; qcom,cabc;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 190/508 arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Barnabás Czémán <[email protected]>
[ Upstream commit 7131f6d909a6546329b71f2bacfdc60cb3e6020e ]
The backlight on this device is connected via 3 strings. Currently, the DT claims only two are present, which results in visible stripes on the display (since every third backlight string remains unconfigured).
Fix the number of strings to avoid that.
--- arch/arm64/boot/dts/qcom/msm8953-xiaomi-daisy.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/msm8953-xiaomi-daisy.dts +1 -1
@@ -157,7 +157,7 @@ &pm8953_resin { &pmi8950_wled { qcom,current-limit-microamp = <20000>; - qcom,num-strings = <2>; + qcom,num-strings = <3>; status = "okay"; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 191/508 soc: qcom: ocmem: make the core clock optional
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit e8a61c51417c679d1a599fb36695e9d3b8d95514 ]
OCMEM's core clock (aka RPM bus 2 clock) is being handled internally by the interconnect driver. Corresponding clock has been dropped from the SMD RPM clock driver. The users of the ocmem will vote on the ocmemnoc interconnect paths, making sure that ocmem is on. Make the clock optional, keeping it for compatibility with older DT.
--- drivers/soc/qcom/ocmem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/ocmem.c +1 -1
@@ -313,7 +313,7 @@ static int ocmem_dev_probe(struct platform_device *pdev) ocmem->dev = dev; ocmem->config =device_get_match_data (dev); - ocmem->core_clk =devm_clk_get (dev,"core" ); + ocmem->core_clk =devm_clk_get_optional (dev,"core" );if (IS_ERR (ocmem->core_clk))return dev_err_probe (dev,PTR_ERR (ocmem->core_clk),"Unable to get core clock\n" );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 192/508 soc: qcom: ocmem: use scoped device node handling to simplify error paths
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit f4c1c19f5c0e5cf2870df91dedc6b40400fd9c8a ]
Obtain the device node reference with scoped/cleanup.h to reduce error handling and make the code a bit simpler.
Stable-dep-of: 9dfd69cd89cd ("soc: qcom: ocmem: register reasons for probe deferrals")
--- drivers/soc/qcom/ocmem.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/soc/qcom/ocmem.c +2 -5
@@ -185,23 +185,20 @@ static void update_range(struct ocmem *ocmem, struct ocmem_buf *buf,struct ocmem *of_get_ocmem (struct device *dev) {struct platform_device *pdev; -struct device_node *devnode;struct ocmem *ocmem; - devnode =of_parse_phandle (dev->of_node,"sram" ,0 ); + struct device_node *devnode __free(device_node) = of_parse_phandle(dev->of_node, +"sram" ,0 );if (!devnode || !devnode->parent) {dev_err (dev,"Cannot look up sram phandle\n" ); -of_node_put (devnode);return ERR_PTR (-ENODEV ); } pdev =of_find_device_by_node (devnode->parent);if (!pdev) {dev_err (dev,"Cannot find device node %s\n" , devnode->name); -of_node_put (devnode);return ERR_PTR (-EPROBE_DEFER ); } -of_node_put (devnode); ocmem =platform_get_drvdata (pdev);put_device (&pdev->dev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 193/508 soc: qcom: ocmem: register reasons for probe deferrals
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 9dfd69cd89cd6afa4723be9098979abeef3bb8c6 ]
Instead of printing messages to the dmesg, let the message be recorded as a reason for the OCMEM client deferral.
[bjorn: s/ERR_PTR(dev_err_probe)/dev_err_ptr_probe/
--- drivers/soc/qcom/ocmem.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/soc/qcom/ocmem.c +4 -4
@@ -195,10 +195,10 @@ struct ocmem *of_get_ocmem(struct device *dev) } pdev =of_find_device_by_node (devnode->parent); -if (!pdev) { -dev_err (dev,"Cannot find device node %s\n" , devnode->name); -return ERR_PTR (-EPROBE_DEFER ); - } +if (!pdev) +return dev_err_ptr_probe (dev, -EPROBE_DEFER , +"Cannot find device node %s\n" , + devnode->name); ocmem =platform_get_drvdata (pdev);put_device (&pdev->dev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 194/508 soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 91b59009c7d48b58dbc50fecb27f2ad20749a05a ]
If OCMEM is declared in DT, it is expected that it is present and handled by the driver. The GPU driver will ignore -ENODEV error, which typically means that OCMEM isn't defined in DT. Let ocmem return -EPROBE_DEFER if it supposed to be used, but it is not probed (yet).
[bjorn: s/ERR_PTR(dev_err_probe)/dev_err_ptr_probe/
--- drivers/soc/qcom/ocmem.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/soc/qcom/ocmem.c +3 -4
@@ -202,10 +202,9 @@ struct ocmem *of_get_ocmem(struct device *dev) ocmem =platform_get_drvdata (pdev);put_device (&pdev->dev); -if (!ocmem) { -dev_err (dev,"Cannot get ocmem\n" ); -return ERR_PTR (-ENODEV ); - } +if (!ocmem) +return dev_err_ptr_probe (dev, -EPROBE_DEFER ,"Cannot get ocmem\n" ); +return ocmem; }EXPORT_SYMBOL (of_get_ocmem);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 195/508 arm64: dts: qcom: sm8450: Fix GIC_ITS range length
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 14044fa192c50265bc1f636108371044bbdcf7b7 ]
Currently, the GITS_SGIR register is cut off. Fix it up.
--- arch/arm64/boot/dts/qcom/sm8450.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sm8450.dtsi +1 -1
@@ -3947,7 +3947,7 @@ intc: interrupt-controller@17100000 { gic_its: msi-controller@17140000 { compatible = "arm,gic-v3-its"; - reg = <0x0 0x17140000 0x0 0x20000>; + reg = <0x0 0x17140000 0x0 0x40000>; msi-controller; #msi-cells = <1>; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 196/508 arm64: dts: qcom: sm8550: Fix GIC_ITS range length
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 357c559e386705609b6b9dc0544c420e3f91f3a0 ]
Currently, the GITS_SGIR register is cut off. Fix it up.
--- arch/arm64/boot/dts/qcom/sm8550.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sm8550.dtsi +1 -1
@@ -3830,7 +3830,7 @@ intc: interrupt-controller@17100000 { gic_its: msi-controller@17140000 { compatible = "arm,gic-v3-its"; - reg = <0 0x17140000 0 0x20000>; + reg = <0 0x17140000 0 0x40000>; msi-controller; #msi-cells = <1>; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 197/508 arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
[ Upstream commit 30ac651c69bddbc83cab6d52fc5d2e03bed83282 ]
The expected frequency of SD host controller core supply clock is 19.2MHz, while RPMH_CXO_CLK clock frequency on SM8650 platform is 38.4MHz.
Apparently the overclocked supply clock could be good enough on some boards and even with the most of SD cards, however some low-end UHS-I SD cards in SDR104 mode of the host controller produce I/O errors in runtime, fortunately this problem is gone, if the "xo" clock frequency matches the expected 19.2MHz clock rate.
--- arch/arm64/boot/dts/qcom/sm8550.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sm8550.dtsi +1 -1
@@ -2521,7 +2521,7 @@ sdhc_2: mmc@8804000 { clocks = <&gcc GCC_SDCC2_AHB_CLK>, <&gcc GCC_SDCC2_APPS_CLK>, - <&rpmhcc RPMH_CXO_CLK>; + <&bi_tcxo_div2>; clock-names = "iface", "core", "xo"; iommus = <&apps_smmu 0x540 0>; qcom,dll-config = <0x0007642c>;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 198/508 arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
[ Upstream commit db0c5ef1abda6effdc5c85d6688fb6af2b351ae5 ]
The reported problem of some non-working UHS-I speed modes on SM8450 originates in commit 0a631a36f724 ("arm64: dts: qcom: Add device tree for Sony Xperia 1 IV"), and then it was spread to all SM8450 powered platforms by commit 9d561dc4e5cc ("arm64: dts: qcom: sm8450: disable SDHCI SDR104/SDR50 on all boards").
The tests show that the rootcause of the problem was related to an overclocking of SD cards, and it's fixed later on by commit a27ac3806b0a ("clk: qcom: gcc-sm8450: Use floor ops for SDCC RCGs").
Since then both SDR50 and SDR104 speed modes are working fine on SM8450, tested on SM8450-HDK:
SDR50 speed mode:
mmc0: new UHS-I speed SDR50 SDHC card at address 0001
mmcblk0: mmc0:0001 00000 14.6 GiB
mmcblk0: p1
% dd if=/dev/mmcblk0p1 of=/dev/null bs=1M count=1024
1024+0 records in
1024+0 records out
1073741824 bytes (1.1 GB, 1.0 GiB) copied, 24.6254 s, 43.6 MB/sSDR104 speed mode:
mmc0: new UHS-I speed SDR104 SDHC card at address 59b4
mmcblk0: mmc0:59b4 USDU1 28.3 GiB
mmcblk0: p1
% dd if=/dev/mmcblk0p1 of=/dev/null bs=1M count=1024
1024+0 records in
1024+0 records out
1073741824 bytes (1.1 GB, 1.0 GiB) copied, 12.3266 s, 87.1 MB/sRemove the restrictions on SD card speed modes from the SM8450 platform dtsi file and enable UHS-I speed modes.
--- arch/arm64/boot/dts/qcom/sm8450.dtsi | 3 --- 1 file changed, 3 deletions(-)
arch/arm64/boot/dts/qcom/sm8450.dtsi +0 -3
@@ -4279,9 +4279,6 @@ sdhc_2: mmc@8804000 { bus-width = <4>; dma-coherent; - /* Forbid SDR104/SDR50 - broken hw! */ - sdhci-caps-mask = <0x3 0x0>; - status = "disabled"; sdhc2_opp_table: opp-table {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 199/508 arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
[ Upstream commit 66b0f024fba0728ddce6916dce173bb1bdd4eab0 ]
The restriction on UHS-I speed modes was added to all SM8550 platforms by copying it from SM8450 dtsi file, and due to the overclocking of SD cards it was an actually reproducible problem. Since the latter issue has been fixed, UHS-I speed modes are working fine on SM8550 boards, below is the test performed on SM8550-HDK:
SDR50 speed mode:
mmc0: new UHS-I speed SDR50 SDHC card at address 0001
mmcblk0: mmc0:0001 00000 14.6 GiB
mmcblk0: p1
% dd if=/dev/mmcblk0p1 of=/dev/null bs=1M count=1024
1024+0 records in
1024+0 records out
1073741824 bytes (1.1 GB, 1.0 GiB) copied, 23.5468 s, 45.6 MB/sSDR104 speed mode:
mmc0: new UHS-I speed SDR104 SDHC card at address 59b4
mmcblk0: mmc0:59b4 USDU1 28.3 GiB
mmcblk0: p1
% dd if=/dev/mmcblk0p1 of=/dev/null bs=1M count=1024
1024+0 records in
1024+0 records out
1073741824 bytes (1.1 GB, 1.0 GiB) copied, 11.9819 s, 89.6 MB/sUnset the UHS-I speed mode restrictions from the SM8550 platform dtsi file, there is no indication that the SDHC controller is broken.
--- arch/arm64/boot/dts/qcom/sm8550.dtsi | 3 --- 1 file changed, 3 deletions(-)
arch/arm64/boot/dts/qcom/sm8550.dtsi +0 -3
@@ -2535,9 +2535,6 @@ sdhc_2: mmc@8804000 { bus-width = <4>; dma-coherent; - /* Forbid SDR104/SDR50 - broken hw! */ - sdhci-caps-mask = <0x3 0>; - status = "disabled"; sdhc2_opp_table: opp-table {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 200/508 arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit be7c1badb0b934cfe88427b1d4ec3eb9f52ba587 ]
The pinctrl nodes from sm6350.dtsi already contain a bias-* property, so that needs to be deleted, otherwise the dtb will contain two conflicting bias-* properties.
--- arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts +4 -0
@@ -533,12 +533,14 @@ &qup_uart1_cts { * the Bluetooth module drives the pin in either * direction or leaves the pin fully unpowered. */ + /delete-property/ bias-disable; bias-bus-hold; }; &qup_uart1_rts { /* We'll drive RTS, so no pull */ drive-strength = <2>; + /delete-property/ bias-pull-down; bias-disable; };
@@ -549,12 +551,14 @@ &qup_uart1_rx { * in tri-state (module powered off or not driving the * signal yet). */ + /delete-property/ bias-disable; bias-pull-up; }; &qup_uart1_tx { /* We'll drive TX, so no pull */ drive-strength = <2>; + /delete-property/ bias-pull-up; bias-disable; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 201/508 arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Heidelberg <[email protected]>
[ Upstream commit 3b0dd81eea6b7a239fce456ce4545af76f1a9715 ]
The regulator must be on, since it provides the display subsystem and therefore the bootloader had turned it on before Linux booted.
--- arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi +1 -0
@@ -147,6 +147,7 @@ vreg_l1a_0p875: ldo1 { regulator-min-microvolt = <880000>; regulator-max-microvolt = <880000>; regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>; + regulator-boot-on; }; vreg_l5a_0p8: ldo5 {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 202/508 arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
[ Upstream commit 825b8c7e1d2918d89eb378b761530d1e51dba82e ]
When attach to PC Type-A port, the USB device controller does not function at all. Because it is configured as source-only and a Type-A port doesn't support PD capability, a data role swap is impossible.
Actually, PTN5110THQ is configured for Source role only at POR, but after POR it can operate as a DRP (Dual-Role Power). By switching the power-role to dual, the port can operate as a sink and enter device mode when attach to Type-A port.
Since the board design uses EN_SRC to control the 5V VBUS path and EN_SNK to control the 12V VBUS output, to avoid outputting a higher VBUS when in sink role, we set the operation current limit to 0mA so that SW will not control EN_SNK at all.
--- arch/arm64/boot/dts/freescale/imx8qxp-mek.dts | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8qxp-mek.dts +9 -1
@@ -161,9 +161,17 @@ typec_dr_sw: endpoint { usb_con1: connector { compatible = "usb-c-connector"; label = "USB-C"; - power-role = "source"; + power-role = "dual"; data-role = "dual"; + try-power-role = "sink"; source-pdos = <PDO_FIXED(5000, 3000, PDO_FIXED_USB_COMM)>; + /* + * Set operational current to 0mA as we don't want EN_SNK + * enable 12V VBUS switch when it work as a sink. + */ + sink-pdos = <PDO_FIXED(5000, 0, PDO_FIXED_USB_COMM)>; + op-sink-microwatt = <0>; + self-powered; ports { #address-cells = <1>;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 203/508 soc/tegra: cbb: Set ERD on resume for err interrupt
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumit Gupta <[email protected]>
[ Upstream commit b6ff71c5d1d4ad858ddf6f39394d169c96689596 ]
Set the Error Response Disable (ERD) bit to mask SError responses and use interrupt-based error reporting. When the ERD bit is set, inband error responses to the initiator via SError are suppressed, and fabric errors are reported via an interrupt instead.
The register is set during boot but the info is lost during system suspend and needs to be set again on resume.
--- drivers/soc/tegra/cbb/tegra234-cbb.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/soc/tegra/cbb/tegra234-cbb.c +4 -0
@@ -1176,6 +1176,10 @@ static int __maybe_unused tegra234_cbb_resume_noirq(struct device *dev) {struct tegra234_cbb *cbb =dev_get_drvdata (dev); +/* set ERD bit to mask SError and generate interrupt to report error */ +if (cbb->fabric->off_mask_erd) +tegra234_cbb_mask_serror (cbb); +tegra234_cbb_error_enable (&cbb->base);dev_dbg (dev,"%s resumed\n" , cbb->fabric->name);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 204/508 unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Grzedzicki <[email protected]>
[ Upstream commit a98621a0f187a934c115dcfe79a49520ae892111 ]
When set_cred_ucounts() fails in ksys_unshare() new_nsproxy is leaked.
Let's call put_nsproxy() if that happens.
--- kernel/fork.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
kernel/fork.c +7 -4
@@ -3443,11 +3443,10 @@ int ksys_unshare(unsigned long unshare_flags) new_cred, new_fs);if (err) goto bad_unshare_cleanup_cred; -if (new_cred) { err =set_cred_ucounts (new_cred);if (err) - goto bad_unshare_cleanup_cred; + goto bad_unshare_cleanup_nsproxy; }if (new_fs || new_fd || do_sysvsem || new_cred || new_nsproxy) {
@@ -3463,8 +3462,10 @@ int ksys_unshare(unsigned long unshare_flags)shm_init_task (current); } -if (new_nsproxy) +if (new_nsproxy) {switch_task_namespaces (current, new_nsproxy); + new_nsproxy =NULL ; + }task_lock (current);
@@ -3493,13 +3494,15 @@ int ksys_unshare(unsigned long unshare_flags)perf_event_namespaces (current); +bad_unshare_cleanup_nsproxy: +if (new_nsproxy) +put_nsproxy (new_nsproxy); bad_unshare_cleanup_cred:if (new_cred)put_cred (new_cred); bad_unshare_cleanup_fd:if (new_fd)put_files_struct (new_fd); - bad_unshare_cleanup_fs:if (new_fs)free_fs_struct (new_fs);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 205/508 ocfs2/dlm: validate qr_numregions in dlm_match_regions()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <[email protected]>
[ Upstream commit 7ab3fbb01bc6d79091bc375e5235d360cd9b78be ]
Patch series "ocfs2/dlm: fix two bugs in dlm_match_regions()".
In dlm_match_regions(), the qr_numregions field from a DLM_QUERY_REGION network message is used to drive loops over the qr_regions buffer without sufficient validation. This series fixes two issues:
- Patch 1 adds a bounds check to reject messages where qr_numregions exceeds O2NM_MAX_REGIONS. The o2net layer only validates message byte length; it does not constrain field values, so a crafted message can set qr_numregions up to 255 and trigger out-of-bounds reads past the 1024-byte qr_regions buffer.
- Patch 2 fixes an off-by-one in the local-vs-remote comparison loop, which uses '<=' instead of '<', reading one entry past the valid range even when qr_numregions is within bounds.
This patch (of 2):
The qr_numregions field from a DLM_QUERY_REGION network message is used directly as loop bounds in dlm_match_regions() without checking against O2NM_MAX_REGIONS. Since qr_regions is sized for at most O2NM_MAX_REGIONS
(32) entries, a crafted message with qr_numregions > 32 causes out-of-bounds reads past the qr_regions buffer.
Add a bounds check for qr_numregions before entering the loops.
--- fs/ocfs2/dlm/dlmdomain.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/ocfs2/dlm/dlmdomain.c +8 -0
@@ -980,6 +980,14 @@ static int dlm_match_regions(struct dlm_ctxt *dlm, goto bail; } +if (qr->qr_numregions >O2NM_MAX_REGIONS ) { +mlog (ML_ERROR ,"Domain %s: Joining node %d has invalid " +"number of heartbeat regions %u\n" , + qr->qr_domain, qr->qr_node, qr->qr_numregions); + status = -EINVAL ; + goto bail; + } + r = remote;for (i =0 ; i < qr->qr_numregions; ++i) {mlog (0 ,"Region %.*s\n" ,O2HB_MAX_REGION_NAME_LEN , r);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 206/508 ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <[email protected]>
[ Upstream commit 01b61e8dda9b0fdb0d4cda43de25f4e390554d7b ]
The local-vs-remote region comparison loop uses '<=' instead of '<', causing it to read one entry past the valid range of qr_regions. The other loops in the same function correctly use '<'.
Fix the loop condition to use '<' for consistency and correctness.
--- fs/ocfs2/dlm/dlmdomain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ocfs2/dlm/dlmdomain.c +1 -1
@@ -1002,7 +1002,7 @@ static int dlm_match_regions(struct dlm_ctxt *dlm,for (i =0 ; i < localnr; ++i) { foundit =0 ; r = remote; -for (j =0 ; j <= qr->qr_numregions; ++j) { +for (j =0 ; j < qr->qr_numregions; ++j) {if (!memcmp (l, r,O2HB_MAX_REGION_NAME_LEN )) { foundit =1 ;break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 207/508 soc: qcom: llcc: fix v1 SB syndrome register offset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 24e7625df5ce065393249b78930781be593bc381 ]
The llcc_v1_edac_reg_offset table uses 0x2304c for trp_ecc_sb_err_syn0, which is inconsistent with the surrounding TRP ECC registers (0x2034x) and with llcc_v2_1_edac_reg_offset, where trp_ecc_sb_err_syn0 is 0x2034c adjacent to trp_ecc_error_status0/1 at 0x20344/0x20348.
Use 0x2034c for llcc v1 so the SB syndrome register follows the expected +0x4 progression from trp_ecc_error_status1. This fixes EDAC reading the wrong register for SB syndrome reporting.
--- drivers/soc/qcom/llcc-qcom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/llcc-qcom.c +1 -1
@@ -359,7 +359,7 @@ static const struct llcc_slice_config sm8550_data[] = {static const struct llcc_edac_reg_offset llcc_v1_edac_reg_offset = { .trp_ecc_error_status0 =0x20344 , .trp_ecc_error_status1 =0x20348 , - .trp_ecc_sb_err_syn0 =0x2304c , + .trp_ecc_sb_err_syn0 =0x2034c , .trp_ecc_db_err_syn0 =0x20370 , .trp_ecc_error_cntr_clear =0x20440 , .trp_interrupt_0_status =0x20480 ,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 208/508 soc: qcom: aoss: compare against normalized cooling state
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit cd3c4670db3ffe997be9548c7a9db3952563cf14 ]
qmp_cdev_set_cur_state() normalizes the requested state to a boolean (cdev_state = !!state). The existing early-return check compares qmp_cdev->state == state, which can be wrong if state is non-boolean (any non-zero value). Compare qmp_cdev->state against cdev_state instead, so the check matches the effective state and avoids redundant updates.
--- drivers/soc/qcom/qcom_aoss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/qcom_aoss.c +1 -1
@@ -340,7 +340,7 @@ static int qmp_cdev_set_cur_state(struct thermal_cooling_device *cdev,/* Normalize state */ cdev_state = !!state; -if (qmp_cdev->state == state) +if (qmp_cdev->state == cdev_state)return 0 ; ret = qmp_send(qmp_cdev->qmp, "{class: volt_flr, event:zero_temp, res:%s, value:%s}",
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 209/508 arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Koskovich <[email protected]>
[ Upstream commit b683730e27ba4f91986c4c92f5cb7297f1e01a6d ]
This resolves the following error seen on the ASUS ROG Phone 3:
cpu cpu7: Voltage update failed freq=3091200
cpu cpu7: failed to update OPP for freq=3091200
--- arch/arm64/boot/dts/qcom/sm8250.dtsi | 5 +++++ 1 file changed, 5 insertions(+)
arch/arm64/boot/dts/qcom/sm8250.dtsi +5 -0
@@ -659,6 +659,11 @@ cpu7_opp20: opp-2841600000 { opp-hz = /bits/ 64 <2841600000>; opp-peak-kBps = <8368000 51609600>; }; + + cpu7_opp21: opp-3091200000 { + opp-hz = /bits/ 64 <3091200000>; + opp-peak-kBps = <8368000 51609600>; + }; }; firmware {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 210/508 ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaro Koskinen <[email protected]>
[ Upstream commit 7e74b606dd39c46d4378d6f6563f560a00ab8694 ]
On OMAP16XX, the UART enable bit shifts are written instead of the actual bits. This breaks the boot when DEBUG_LL and earlyprintk is enabled; the UART gets disabled and some random bits get enabled. Fix that.
--- arch/arm/mach-omap1/clock_data.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mach-omap1/clock_data.c +2 -2
@@ -700,8 +700,8 @@ int __init omap1_clk_init(void)/* Make sure UART clocks are enabled early */ if (cpu_is_omap16xx ())omap_writel (omap_readl (MOD_CONF_CTRL_0 ) | -CONF_MOD_UART1_CLK_MODE_R | -CONF_MOD_UART3_CLK_MODE_R ,MOD_CONF_CTRL_0 ); + (1 <<CONF_MOD_UART1_CLK_MODE_R ) | + (1 <<CONF_MOD_UART3_CLK_MODE_R ),MOD_CONF_CTRL_0 );#endif /* USB_REQ_EN will be disabled later if necessary (usb_dc_ck) */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 211/508 arm64/xor: fix conflicting attributes for xor_block_template
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 675a0dd596e712404557286d0a883b54ee28e4f4 ]
Commit 2c54b423cf85 ("arm64/xor: use EOR3 instructions when available") changes the definition to __ro_after_init instead of const, but failed to update the external declaration in xor.h. This was not found because xor-neon.c doesn't include <asm/xor.h>, and can't easily do that due to current architecture of the XOR code.
--- arch/arm64/include/asm/xor.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/include/asm/xor.h +1 -1
@@ -13,7 +13,7 @@#ifdef CONFIG_KERNEL_MODE_NEON -extern struct xor_block_template const xor_block_inner_neon; +extern struct xor_block_template xor_block_inner_neon__ro_after_init ; static void xor_neon_2(unsigned long bytes, unsigned long * __restrict p1,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 212/508 ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
[ Upstream commit 0477a6b31e2874e554e3bcfac9883684b8f8ca2d ]
The property interrupts use default interrupt controllers. But pass down gpio<n> as phandle. Correct it by use interrupts-extended.
--- arch/arm/boot/dts/nxp/imx/imx27-eukrea-cpuimx27.dtsi | 8 ++++---- .../boot/dts/nxp/imx/imx27-eukrea-mbimxsd27-baseboard.dts | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-)
arch/arm/boot/dts/nxp/imx/imx27-eukrea-cpuimx27.dtsi +4 -4
@@ -106,7 +106,7 @@ uart8250@3,200000 { compatible = "ns8250"; clocks = <&clk14745600>; fsl,weim-cs-timing = <0x0000d603 0x0d1d0d01 0x00d20000>; - interrupts = <&gpio2 23 IRQ_TYPE_LEVEL_LOW>; + interrupts-extended = <&gpio2 23 IRQ_TYPE_LEVEL_LOW>; reg = <3 0x200000 0x1000>; reg-shift = <1>; reg-io-width = <1>;
@@ -119,7 +119,7 @@ uart8250@3,400000 { compatible = "ns8250"; clocks = <&clk14745600>; fsl,weim-cs-timing = <0x0000d603 0x0d1d0d01 0x00d20000>; - interrupts = <&gpio2 22 IRQ_TYPE_LEVEL_LOW>; + interrupts-extended = <&gpio2 22 IRQ_TYPE_LEVEL_LOW>; reg = <3 0x400000 0x1000>; reg-shift = <1>; reg-io-width = <1>;
@@ -132,7 +132,7 @@ uart8250@3,800000 { compatible = "ns8250"; clocks = <&clk14745600>; fsl,weim-cs-timing = <0x0000d603 0x0d1d0d01 0x00d20000>; - interrupts = <&gpio2 27 IRQ_TYPE_LEVEL_LOW>; + interrupts-extended = <&gpio2 27 IRQ_TYPE_LEVEL_LOW>; reg = <3 0x800000 0x1000>; reg-shift = <1>; reg-io-width = <1>;
@@ -145,7 +145,7 @@ uart8250@3,1000000 { compatible = "ns8250"; clocks = <&clk14745600>; fsl,weim-cs-timing = <0x0000d603 0x0d1d0d01 0x00d20000>; - interrupts = <&gpio2 30 IRQ_TYPE_LEVEL_LOW>; + interrupts-extended = <&gpio2 30 IRQ_TYPE_LEVEL_LOW>; reg = <3 0x1000000 0x1000>; reg-shift = <1>; reg-io-width = <1>;
arch/arm/boot/dts/nxp/imx/imx27-eukrea-mbimxsd27-baseboard.dts +1 -1
@@ -76,7 +76,7 @@ ads7846@0 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_touch>; reg = <0>; - interrupts = <&gpio4 25 IRQ_TYPE_LEVEL_LOW>; + interrupts-extended = <&gpio4 25 IRQ_TYPE_LEVEL_LOW>; spi-cpol; spi-max-frequency = <1500000>; ti,keep-vref-on;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 213/508 ocfs2: fix listxattr handling when the buffer is full
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhengYuan Huang <[email protected]>
[ Upstream commit d12f558e6200b3f47dbef9331ed6d115d2410e59 ]
[BUG]
If an OCFS2 inode has both inline and block-based xattrs, listxattr() can return a size larger than the caller's buffer when the inline names consume that buffer exactly.
kernel BUG at mm/usercopy.c:102!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:usercopy_abort+0xb7/0xd0 mm/usercopy.c:102 Call Trace: __check_heap_object+0xe3/0x120 mm/slub.c:8243 check_heap_object mm/usercopy.c:196 [inline] __check_object_size mm/usercopy.c:250 [inline] __check_object_size+0x5c5/0x780 mm/usercopy.c:215 check_object_size include/linux/ucopysize.h:22 [inline] check_copy_size include/linux/ucopysize.h:59 [inline] copy_to_user include/linux/uaccess.h:219 [inline] listxattr+0xb0/0x170 fs/xattr.c:926 filename_listxattr fs/xattr.c:958 [inline] path_listxattrat+0x137/0x320 fs/xattr.c:988 __do_sys_listxattr fs/xattr.c:1001 [inline] __se_sys_listxattr fs/xattr.c:998 [inline] __x64_sys_listxattr+0x7f/0xd0 fs/xattr.c:998 ...
[CAUSE]
Commit 936b8834366e ("ocfs2: Refactor xattr list and remove ocfs2_xattr_handler().") replaced the old per-handler list accounting with ocfs2_xattr_list_entry(), but it kept using size == 0 to detect probe mode.
That assumption stops being true once ocfs2_listxattr() finishes the inline-xattr pass. If the inline names fill the caller buffer exactly, the block-xattr pass runs with a non-NULL buffer and a remaining size of zero. ocfs2_xattr_list_entry() then skips the bounds check, keeps counting block names, and returns a positive size larger than the supplied buffer.
[FIX]
Detect probe mode by testing whether the destination buffer pointer is NULL instead of whether the remaining size is zero.
That restores the pre-refactor behavior and matches the OCFS2 getxattr helpers. Once the remaining buffer reaches zero while more names are left, the block-xattr pass now returns -ERANGE instead of reporting a size larger than the allocated list buffer.
--- fs/ocfs2/xattr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ocfs2/xattr.c +2 -2
@@ -907,8 +907,8 @@ static int ocfs2_xattr_list_entry(struct super_block *sb, total_len = prefix_len + name_len +1 ; *result += total_len; -/* we are just looking for how big our buffer needs to be */ -if (!size) +/* No buffer means we are only looking for the required size. */ +if (!buffer)return 0 ;if (*result > size)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 214/508 ocfs2: validate bg_bits during freefrag scan
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhengYuan Huang <[email protected]>
[ Upstream commit 8f687eeed3da3012152b0f9473f578869de0cd7b ]
[BUG]
A crafted filesystem can trigger an out-of-bounds bitmap walk when OCFS2_IOC_INFO is issued with OCFS2_INFO_FL_NON_COHERENT.
BUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: use-after-free in test_bit_le include/asm-generic/bitops/le.h:21 [inline] BUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline] BUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline] BUG: KASAN: use-after-free in ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline] BUG: KASAN: use-after-free in ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754 Read of size 8 at addr ffff888031bce000 by task syz.0.636/1435 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xd1/0x650 mm/kasan/report.c:482 kasan_report+0xfb/0x140 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:186 [inline] kasan_check_range+0x11c/0x200 mm/kasan/generic.c:200 __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31 instrument_atomic_read include/linux/instrumented.h:68 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] test_bit_le include/asm-generic/bitops/le.h:21 [inline] ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline] ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline] ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline] ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754 ocfs2_info_handle+0x18d/0x2a0 fs/ocfs2/ioctl.c:828 ocfs2_ioctl+0x632/0x6e0 fs/ocfs2/ioctl.c:913 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583 ...
[CAUSE]ocfs2_info_freefrag_scan_chain() uses on-disk bg_bits directly as the bitmap scan limit. The coherent path reads group descriptors through ocfs2_read_group_descriptor(), which validates the descriptor before use. The non-coherent path uses ocfs2_read_blocks_sync() instead and skips that validation, so an impossible bg_bits value can drive the bitmap walk past the end of the block.
[FIX]
Compute the bitmap capacity from the filesystem format with ocfs2_group_bitmap_size(), report descriptors whose bg_bits exceeds that limit, and clamp the scan to the computed capacity. This keeps the freefrag report going while avoiding reads beyond the buffer.
--- fs/ocfs2/ioctl.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
fs/ocfs2/ioctl.c +17 -1
@@ -442,13 +442,16 @@ static int ocfs2_info_freefrag_scan_chain(struct ocfs2_super *osb,struct buffer_head *bh =NULL ;struct ocfs2_group_desc *bg =NULL ; -unsigned int max_bits, num_clusters; +unsigned int max_bits, max_bitmap_bits, num_clusters;unsigned int offset =0 , cluster, chunk;unsigned int chunk_free, last_chunksize =0 ;if (!le32_to_cpu (rec->c_free)) goto bail; + max_bitmap_bits =8 *ocfs2_group_bitmap_size (osb->sb,0 , + osb->s_feature_incompat); + do { if (!bg) blkno = le64_to_cpu(rec->c_blkno);
@@ -480,6 +483,19 @@ static int ocfs2_info_freefrag_scan_chain(struct ocfs2_super *osb,continue ; max_bits =le16_to_cpu (bg->bg_bits); + +/* +* Non-coherent scans read raw blocks and do not get the +* bg_bits validation from +* ocfs2_read_group_descriptor(). +*/ +if (max_bits > max_bitmap_bits) { +mlog (ML_ERROR , +"Group desc #%llu has %u bits, max bitmap bits %u\n" , + (unsigned long long )blkno, max_bits, max_bitmap_bits); + max_bits = max_bitmap_bits; + } + offset =0 ;for (chunk =0 ; chunk < chunks_in_group; chunk++) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 215/508 ocfs2: validate group add input before caching
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhengYuan Huang <[email protected]>
[ Upstream commit 70b672833f4025341c11b22c7f83778a5cd611bc ]
[BUG]OCFS2_IOC_GROUP_ADD can trigger a BUG_ON inocfs2_set_new_buffer_uptodate():
kernel BUG at fs/ocfs2/uptodate.c:509!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ocfs2_set_new_buffer_uptodate+0x194/0x1e0 fs/ocfs2/uptodate.c:509 Code: ffffe88f 42b9fe4c 89e64889 dfe8b4df Call Trace: ocfs2_group_add+0x3f1/0x1510 fs/ocfs2/resize.c:507 ocfs2_ioctl+0x309/0x6e0 fs/ocfs2/ioctl.c:887 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583 x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7bbfb55a966d
[CAUSE]ocfs2_group_add() calls ocfs2_set_new_buffer_uptodate() on a user-controlled group block before ocfs2_verify_group_and_input() validates that block number. That helper is only valid for newly allocated metadata and asserts that the block is not already present in the chosen metadata cache. The code also uses INODE_CACHE(inode) even though the group descriptor belongs to main_bm_inode and later journal accesses use that cache context instead.
[FIX]
Validate the on-disk group descriptor before caching it, then add it to the metadata cache tracked by INODE_CACHE(main_bm_inode). Keep the validation failure path separate from the later cleanup path so we only remove the buffer from that cache after it has actually been inserted. This keeps the group buffer lifetime consistent across validation, journaling, and cleanup.
--- fs/ocfs2/resize.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
fs/ocfs2/resize.c +7 -5
@@ -500,14 +500,14 @@ int ocfs2_group_add(struct inode *inode, struct ocfs2_new_group_input *input) goto out_unlock; } -ocfs2_set_new_buffer_uptodate (INODE_CACHE (inode), group_bh); - ret =ocfs2_verify_group_and_input (main_bm_inode, fe, input, group_bh);if (ret) {mlog_errno (ret); goto out_free_group_bh; } +ocfs2_set_new_buffer_uptodate (INODE_CACHE (main_bm_inode), group_bh); +trace_ocfs2_group_add ((unsigned long long )input->group, input->chain, input->clusters, input->frees);
@@ -515,7 +515,7 @@ int ocfs2_group_add(struct inode *inode, struct ocfs2_new_group_input *input)if (IS_ERR (handle)) {mlog_errno (PTR_ERR (handle)); ret = -EINVAL ; - goto out_free_group_bh; + goto out_remove_cache; } cl_bpc =le16_to_cpu (fe->id2.i_chain.cl_bpc);
@@ -569,9 +569,11 @@ int ocfs2_group_add(struct inode *inode, struct ocfs2_new_group_input *input) out_commit:ocfs2_commit_trans (osb, handle); -out_free_group_bh: +out_remove_cache:if (ret <0 ) -ocfs2_remove_from_cache (INODE_CACHE (inode), group_bh); +ocfs2_remove_from_cache (INODE_CACHE (main_bm_inode), group_bh); + +out_free_group_bh:brelse (group_bh); out_unlock:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 216/508 dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Khairul Anuar Romli <[email protected]>
[ Upstream commit 48278a72fce8a8d30efaedeb206c9c3f05c1eb3f ]
checkpatch.pl --strict reports a WARNING in dw-axi-dmac-platform.c:
WARNING: void function return statements are not generally useful
FILE: drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
According to Linux kernel coding style [Documentation/process/ coding-style.rst], explicit "return;" statements at the end of void functions are redundant and should be omitted. The function will automatically return upon reaching the closing brace, so the extra statement adds unnecessary clutter without functional benefit.
This patch removes the superfluous "return;" statement in dw_axi_dma_set_hw_channel() to comply with kernel coding standards and eliminate the checkpatch warning.
--- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 2 -- 1 file changed, 2 deletions(-)
drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +0 -2
@@ -546,8 +546,6 @@ static void dw_axi_dma_set_hw_channel(struct axi_dma_chan *chan, bool set) (chan->id * DMA_APB_HS_SEL_BIT_SIZE)); reg_value |= (val << (chan->id *DMA_APB_HS_SEL_BIT_SIZE ));lo_hi_writeq (reg_value, chip->apb_regs +DMAC_APB_HW_HS_SEL_0 ); - -return ; }/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 217/508 soundwire: bus: demote UNATTACHED state warnings to dev_dbg()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cole Leavitt <[email protected]>
[ Upstream commit 2c96956fe764f8224f9ec93b2a9160a578949a7a ]
The dev_warn() messages in sdw_handle_slave_status() for UNATTACHED transitions were added in commit d1b328557058 ("soundwire: bus: add dev_warn() messages to track UNATTACHED devices") to debug attachment failures with dynamic debug enabled.
These warnings fire during normal operation -- for example when a codec driver triggers a hardware reset after firmware download, causing the device to momentarily go UNATTACHED before re-attaching -- producing misleading noise on every boot.
Demote the messages to dev_dbg() so they remain available via dynamic debug for diagnosing real attachment failures without alarming users during expected initialization sequences.
--- drivers/soundwire/bus.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/soundwire/bus.c +4 -4
@@ -1864,8 +1864,8 @@ int sdw_handle_slave_status(struct sdw_bus *bus,if (status[i] ==SDW_SLAVE_UNATTACHED && slave->status !=SDW_SLAVE_UNATTACHED ) { -dev_warn (&slave->dev,"Slave %d state check1: UNATTACHED, status was %d\n" , - i, slave->status); +dev_dbg (&slave->dev,"Slave %d state check1: UNATTACHED, status was %d\n" , + i, slave->status);sdw_modify_slave_status (slave,SDW_SLAVE_UNATTACHED );/* Ensure driver knows that peripheral unattached */
@@ -1916,8 +1916,8 @@ int sdw_handle_slave_status(struct sdw_bus *bus,if (slave->status ==SDW_SLAVE_UNATTACHED )break ; -dev_warn (&slave->dev,"Slave %d state check2: UNATTACHED, status was %d\n" , - i, slave->status); +dev_dbg (&slave->dev,"Slave %d state check2: UNATTACHED, status was %d\n" , + i, slave->status);sdw_modify_slave_status (slave,SDW_SLAVE_UNATTACHED );break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 218/508 dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
[ Upstream commit ab2bf6d4c0a0152907b18d25c1b118ea5ea779df ]
Propagate the return value of of_dma_controller_register() in probe() instead of ignoring it.
--- drivers/dma/mxs-dma.c | 1 + 1 file changed, 1 insertion(+)
drivers/dma/mxs-dma.c +1 -0
@@ -824,6 +824,7 @@ static int mxs_dma_probe(struct platform_device *pdev)if (ret) {dev_err (mxs_dma->dma_device.dev,"failed to register controller\n" ); +return ret; }dev_info (mxs_dma->dma_device.dev,"initialized\n" );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 219/508 soundwire: cadence: Clear message complete before signaling waiting thread
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit cbfea84f820962c3c5394ff06e7e9344c96bf761 ]
Clear the CDNS_MCP_INT_RX_WL interrupt before signaling completion.
This is to prevent the potential race where:
- The main thread is scheduled immediately the completion is signaled, and starts a new message
- The RX_WL IRQ for this new message happens before sdw_cdns_irq() has been re-scheduled.
- When sdw_cdns_irq() is re-scheduled it clears the new RX_WL interrupt.
MAIN THREAD | IRQ THREAD
|
_cdns_xfer_msg() |
{ |
write data to FIFO |
wait_for_completion_timeout() |
<BLOCKED> | <---- RX_WL IRQ
| sdw_cdns_irq()
| {
| signal completion
<== RESCHEDULE <==
Handle message completion |
} |
|
Start new message |
_cdns_xfer_msg() |
{ |
write data to FIFO |
wait_for_completion_timeout() |
<BLOCKED> | <---- RX_WL IRQ ==> RESCHEDULE ==>
| // New RX_WL IRQ is cleared before
| // it has been handled.
| clear CDNS_MCP_INTSTAT
| return IRQ_HANDLED;
| }
Before this change, this error message was sometimes seen on kernels that have large amounts of debugging enabled:
SCP Msg trf timed out
This error indicates that the completion has not been signalled after 500ms.
--- drivers/soundwire/cadence_master.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/soundwire/cadence_master.c +8 -0
@@ -932,6 +932,14 @@ irqreturn_t sdw_cdns_irq(int irq, void *dev_id)cdns_read_response (cdns); +/* +* Clear interrupt before signalling the completion to avoid +* a race between this thread and the main thread starting +* another TX. +*/ +cdns_writel (cdns,CDNS_MCP_INTSTAT ,CDNS_MCP_INT_RX_WL ); + int_status &= ~CDNS_MCP_INT_RX_WL ; +if (defer && defer->msg) {cdns_fill_msg_resp (cdns, defer->msg, defer->length,0 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 220/508 tracing: Rebuild full_name on each hist_field_name() call
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 5ec1d1e97de134beed3a5b08235a60fc1c51af96 ]
hist_field_name() uses a static MAX_FILTER_STR_VAL buffer for fully qualified variable-reference names, but it currently appends into that buffer with strcat() without rebuilding it first. As a result, repeated calls append a new "system.event.field" name onto the previous one, which can eventually run past the end of full_name.
Build the name with snprintf() on each call and return NULL if the fully qualified name does not fit in MAX_FILTER_STR_VAL.
--- kernel/trace/trace_events_hist.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
kernel/trace/trace_events_hist.c +7 -5
@@ -1349,12 +1349,14 @@ static const char *hist_field_name(struct hist_field *field, field->flags & HIST_FIELD_FL_VAR_REF) {if (field->system) {static char full_name[MAX_FILTER_STR_VAL ]; +int len; + + len =snprintf (full_name,sizeof (full_name),"%s.%s.%s" , + field->system, field->event_name, + field->name); +if (len >=sizeof (full_name)) +return NULL ; -strcat (full_name, field->system); -strcat (full_name,"." ); -strcat (full_name, field->event_name); -strcat (full_name,"." ); -strcat (full_name, field->name); field_name = full_name; }else field_name = field->name;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 221/508 ima: check return value of crypto_shash_final() in boot aggregate
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Hodges <[email protected]>
[ Upstream commit 870819434c8dfcc3158033b66e7851b81bb17e21 ]
The return value of crypto_shash_final() is not checked in ima_calc_boot_aggregate_tfm(). If the hash finalization fails, the function returns success and a corrupted boot aggregate digest could be used for IMA measurements.
Capture the return value and propagate any error to the caller.
--- security/integrity/ima/ima_crypto.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/integrity/ima/ima_crypto.c +1 -1
@@ -837,7 +837,7 @@ static int ima_calc_boot_aggregate_tfm(char *digest, u16 alg_id, } }if (!rc) -crypto_shash_final (shash, digest); + rc =crypto_shash_final (shash, digest);return rc; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 222/508 HID: asus: make asus_resume adhere to linux kernel coding standards
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Benato <[email protected]>
[ Upstream commit 51d33b42b8ae23da92819d28439fdd5636c45186 ]
Linux kernel coding standars requires functions opening brackets to be in a newline: move the opening bracket of asus_resume in its own line.
--- drivers/hid/hid-asus.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/hid/hid-asus.c +2 -1
@@ -990,7 +990,8 @@ static int asus_start_multitouch(struct hid_device *hdev)return 0 ; } -static int __maybe_unused asus_resume (struct hid_device *hdev) { +static int __maybe_unused asus_resume (struct hid_device *hdev) +{struct asus_drvdata *drvdata =hid_get_drvdata (hdev);int ret =0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 223/508 HID: asus: do not abort probe when not necessary
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Benato <[email protected]>
[ Upstream commit 7253091766ded0fd81fe8d8be9b8b835495b06e8 ]
In order to avoid dereferencing a NULL pointer asus_probe is aborted early and control of some asus devices is transferred over hid-generic after erroring out even when such NULL dereference cannot happen: only early abort when the NULL dereference can happen.
Also make the code shorter and more adherent to coding standards removing square brackets enclosing single-line if-else statements.
--- drivers/hid/hid-asus.c | 25 ++++++++++--------------- 1 file changed, 10 insertions(+), 15 deletions(-)
drivers/hid/hid-asus.c +10 -15
@@ -1118,22 +1118,17 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id)* were freed during registration due to no usages being mapped, * leaving drvdata->input pointing to freed memory. */ -if (!drvdata->input || !(hdev->claimed &HID_CLAIMED_INPUT )) { -hid_err (hdev,"Asus input not registered\n" ); - ret = -ENOMEM ; - goto err_stop_hw; - } - -if (drvdata->tp) { - drvdata->input->name ="Asus TouchPad" ; - }else { - drvdata->input->name ="Asus Keyboard" ; - } +if (drvdata->input && (hdev->claimed &HID_CLAIMED_INPUT )) { +if (drvdata->tp) + drvdata->input->name ="Asus TouchPad" ; +else + drvdata->input->name ="Asus Keyboard" ; -if (drvdata->tp) { - ret =asus_start_multitouch (hdev); -if (ret) - goto err_stop_hw; +if (drvdata->tp) { + ret =asus_start_multitouch (hdev); +if (ret) + goto err_stop_hw; + } }return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 224/508 mtd: physmap_of_gemini: Fix disabled pinctrl state check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit b7c0982184b0661f5b1b805f3a56f1bd3757b63e ]
The condition for checking the disabled pinctrl state incorrectly checks gf->enabled_state instead of gf->disabled_state. This causes misleading error messages and could lead to incorrect behavior when only one of the pinctrl states is defined.
Fix the condition to properly check gf->disabled_state.
--- drivers/mtd/maps/physmap-gemini.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/maps/physmap-gemini.c +1 -1
@@ -181,7 +181,7 @@ int of_flash_probe_gemini(struct platform_device *pdev,dev_err (dev,"no enabled pin control state\n" ); gf->disabled_state =pinctrl_lookup_state (gf->p,"disabled" ); -if (IS_ERR (gf->enabled_state)) { +if (IS_ERR (gf->disabled_state)) {dev_err (dev,"no disabled pin control state\n" ); }else { ret =pinctrl_select_state (gf->p, gf->disabled_state);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 225/508 dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 15cfc8984defc17e5e4de1f58db7b993240fcbda ]
According to the "Arm Generic Interrupt Controller (GIC) Architecture Specification, v3 and v4", revision H.b[1], there can be only 64 Extended PPI interrupts.
[1] https://developer.arm.com/documentation/ihi0069/hb/
--- .../devicetree/bindings/interrupt-controller/arm,gic-v3.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/interrupt-controller/arm,gic-v3.yaml +1 -1
@@ -50,7 +50,7 @@ properties: The 2nd cell contains the interrupt number for the interrupt type. SPI interrupts are in the range [0-987]. PPI interrupts are in the range [0-15]. Extended SPI interrupts are in the range [0-1023]. - Extended PPI interrupts are in the range [0-127]. + Extended PPI interrupts are in the range [0-63]. The 3rd cell is the flags, encoded as follows: bits[3:0] trigger type and level flags.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 226/508 mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haibo Chen <[email protected]>
[ Upstream commit 756564a536ecd8c9d33edd89f0647a91a0b03587 ]
When check read operation, need to setting the op.dummy.nbytes based on current read operation rather than the nor->read_proto.
--- drivers/mtd/spi-nor/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/spi-nor/core.c +1 -1
@@ -2477,7 +2477,7 @@ static int spi_nor_spimem_check_readop(struct spi_nor *nor,/* convert the dummy cycles to the number of bytes */ op.dummy.nbytes = (read->num_mode_clocks + read->num_wait_states) * op.dummy.buswidth /8 ; -if (spi_nor_protocol_is_dtr (nor->read_proto)) +if (spi_nor_protocol_is_dtr (read->proto)) op.dummy.nbytes *=2 ;return spi_nor_spimem_check_op (nor, &op);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 227/508 mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takahiro Kuwano <[email protected]>
[ Upstream commit 653f6def567c81f37302f9591ffd54df3e2a11eb ]
SMPT contains config detection info that describes opcode, address, and dummy cycles to read sector map config. The dummy cycles parameter can be SMPT_CMD_READ_DUMMY_IS_VARIABLE and in that case nor->read_dummy (initialized as 0) is used. In Infineon flash chips, Read Any Register command with variable dummy cycle is defined in SMPT. S25Hx/S28Hx flash has 0 dummy cycle by default to read volatile regiters and nor->read_dummy can work. S25FS-S flash has 8 dummy cycles so we need a hook that can fix dummy cycles with actually used value.
Inroduce smpt_read_dummy() in struct spi_nor_fixups. It is called when the dummy cycle field in SMPT config detection is 'varialble'.
Stable-dep-of: 3620d67b4849 ("mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation")
--- drivers/mtd/spi-nor/core.h | 3 +++ drivers/mtd/spi-nor/sfdp.c | 18 ++++++++++++++++-- 2 files changed, 19 insertions(+), 2 deletions(-)
drivers/mtd/spi-nor/core.h +3 -0
@@ -416,6 +416,8 @@ struct spi_nor_flash_parameter {* flash parameters when information provided by the flash_info * table is incomplete or wrong. * @post_bfpt: called after the BFPT table has been parsed +* @smpt_read_dummy: called during SMPT table is being parsed. Used to fix the +* number of dummy cycles in read register ops. * @post_sfdp: called after SFDP has been parsed (is also called for SPI NORs * that do not support RDSFDP). Typically used to tweak various * parameters that could not be extracted by other means (i.e.
@@ -433,6 +435,7 @@ struct spi_nor_fixups {int (*post_bfpt)(struct spi_nor *nor,const struct sfdp_parameter_header *bfpt_header,const struct sfdp_bfpt *bfpt); +void (*smpt_read_dummy)(const struct spi_nor *nor,u8 *read_dummy);int (*post_sfdp)(struct spi_nor *nor);int (*late_init)(struct spi_nor *nor); };
drivers/mtd/spi-nor/sfdp.c +16 -2
@@ -674,6 +674,17 @@ static u8 spi_nor_smpt_addr_nbytes(const struct spi_nor *nor, const u32 settings } } +static void spi_nor_smpt_read_dummy_fixups (const struct spi_nor *nor, +u8 *read_dummy) +{ +if (nor->manufacturer && nor->manufacturer->fixups && + nor->manufacturer->fixups->smpt_read_dummy) + nor->manufacturer->fixups->smpt_read_dummy (nor, read_dummy); + +if (nor->info->fixups && nor->info->fixups->smpt_read_dummy) + nor->info->fixups->smpt_read_dummy (nor, read_dummy); +} +/** * spi_nor_smpt_read_dummy() - return the configuration detection command read * latency, in clock cycles.
@@ -686,8 +697,11 @@ static u8 spi_nor_smpt_read_dummy(const struct spi_nor *nor, const u32 settings) {u8 read_dummy =SMPT_CMD_READ_DUMMY (settings); -if (read_dummy ==SMPT_CMD_READ_DUMMY_IS_VARIABLE ) -return nor->read_dummy; +if (read_dummy ==SMPT_CMD_READ_DUMMY_IS_VARIABLE ) { + read_dummy = nor->read_dummy; +spi_nor_smpt_read_dummy_fixups (nor, &read_dummy); + } +return read_dummy; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 228/508 mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takahiro Kuwano <[email protected]>
[ Upstream commit f74de390557bf2bcc5dca4a357b41c0701d3f76e ]
Certain chips have inconsistent Sector Map Parameter Table (SMPT) data, which leads to the wrong map ID being identified, causing failures to detect the correct sector map.
To fix this, introduce smpt_map_id() into the struct spi_nor_fixups. This function will be called after the initial SMPT-based detection, allowing chip-specific logic to correct the map ID.
Infineon S25FS512S needs this fixup as it has inconsistency between map ID definition and configuration register value actually obtained.
Stable-dep-of: 3620d67b4849 ("mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation")
--- drivers/mtd/spi-nor/core.h | 3 +++ drivers/mtd/spi-nor/sfdp.c | 12 ++++++++++++ 2 files changed, 15 insertions(+)
drivers/mtd/spi-nor/core.h +3 -0
@@ -418,6 +418,8 @@ struct spi_nor_flash_parameter {* @post_bfpt: called after the BFPT table has been parsed * @smpt_read_dummy: called during SMPT table is being parsed. Used to fix the * number of dummy cycles in read register ops. +* @smpt_map_id: called after map ID in SMPT table has been determined for the +* case the map ID is wrong and needs to be fixed. * @post_sfdp: called after SFDP has been parsed (is also called for SPI NORs * that do not support RDSFDP). Typically used to tweak various * parameters that could not be extracted by other means (i.e.
@@ -436,6 +438,7 @@ struct spi_nor_fixups {const struct sfdp_parameter_header *bfpt_header, const struct sfdp_bfpt *bfpt);void (*smpt_read_dummy)(const struct spi_nor *nor,u8 *read_dummy); +void (*smpt_map_id)(const struct spi_nor *nor,u8 *map_id);int (*post_sfdp)(struct spi_nor *nor);int (*late_init)(struct spi_nor *nor); };
drivers/mtd/spi-nor/sfdp.c +12 -0
@@ -705,6 +705,16 @@ static u8 spi_nor_smpt_read_dummy(const struct spi_nor *nor, const u32 settings)return read_dummy; } +static void spi_nor_smpt_map_id_fixups (const struct spi_nor *nor,u8 *map_id) +{ +if (nor->manufacturer && nor->manufacturer->fixups && + nor->manufacturer->fixups->smpt_map_id) + nor->manufacturer->fixups->smpt_map_id (nor, map_id); + +if (nor->info->fixups && nor->info->fixups->smpt_map_id) + nor->info->fixups->smpt_map_id (nor, map_id); +} +/** * spi_nor_get_map_in_use() - get the configuration map in use * @nor: pointer to a 'struct spi_nor'
@@ -758,6 +768,8 @@ static const u32 *spi_nor_get_map_in_use(struct spi_nor *nor, const u32 *smpt, map_id = map_id <<1 | !!(*buf & read_data_mask); } +spi_nor_smpt_map_id_fixups (nor, &map_id); +/* * If command descriptors are provided, they always precede map * descriptors in the table. There is no need to start the iteration
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 229/508 mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit 3620d67b48493c6252bbc873dc88dde81641d56b ]
After commit 5273cc6df984 ("mtd: spi-nor: core: Call spi_nor_post_sfdp_fixups() only when SFDP is defined") spi_nor_post_sfdp_fixups() isn't called anymore if no SFDP is detected.
Update the documentation accordingly.
--- drivers/mtd/spi-nor/core.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/spi-nor/core.h +1 -1
@@ -420,7 +420,7 @@ struct spi_nor_flash_parameter {* number of dummy cycles in read register ops. * @smpt_map_id: called after map ID in SMPT table has been determined for the * case the map ID is wrong and needs to be fixed. -* @post_sfdp: called after SFDP has been parsed (is also called for SPI NORs +* @post_sfdp: called after SFDP has been parsed (is not called for SPI NORs * that do not support RDSFDP). Typically used to tweak various * parameters that could not be extracted by other means (i.e. * when information provided by the SFDP/flash_info tables are
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 230/508 mtd: spi-nor: swp: check SR_TB flag when getting tb_mask
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shiji Yang <[email protected]>
[ Upstream commit 94645aa41bf9ecb87c2ce78b1c3405bfb6074a37 ]
When the chip does not support top/bottom block protect, the tb_mask must be set to 0, otherwise SR1 bit5 will be unexpectedly modified.
--- drivers/mtd/spi-nor/swp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/mtd/spi-nor/swp.c +3 -1
@@ -27,8 +27,10 @@ static u8 spi_nor_get_sr_tb_mask(struct spi_nor *nor) {if (nor->flags &SNOR_F_HAS_SR_TB_BIT6 )return SR_TB_BIT6 ; -else +else if (nor->flags &SNOR_F_HAS_SR_TB )return SR_TB_BIT5 ; +else +return 0 ; }static u64 spi_nor_get_min_prot_length_sr (struct spi_nor *nor)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 231/508 mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Tanislav <[email protected]>
[ Upstream commit 0c87dea1aab86116211cb37387c404c9e9231c39 ]
ofpart_none can only be reached after the for_each_child_of_node() loop finishes. for_each_child_of_node() correctly calls of_node_put() for all device nodes it iterates over as long as we don't break or jump out of the loop.
Calling of_node_put() inside the ofpart_none path will wrongly decrement the ref count of the last node in the for_each_child_of_node() loop.
Move the call to of_node_put() under the ofpart_fail label to fix this.
--- drivers/mtd/parsers/ofpart_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/parsers/ofpart_core.c +1 -1
@@ -191,11 +191,11 @@ static int parse_fixed_partitions(struct mtd_info *master, ofpart_fail:pr_err ("%s: error parsing ofpart partition %pOF (%pOF)\n" , master->name, pp, mtd_node); +of_node_put (pp); ret = -EINVAL ; ofpart_none:if (dedicated)of_node_put (ofpart_node); -of_node_put (pp);kfree (parts);return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 232/508 mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Tanislav <[email protected]>
[ Upstream commit e882626c1747653f1f01ea9d12e278e613b11d0f ]
In order to parse sub-partitions, add_mtd_partitions() calls parse_mtd_partitions() for all previously found partitions.
Each partition will end up being passed to parse_fixed_partitions(), and its of_node will be treated as the ofpart_node.
Commit 7cce81df7d26 ("mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions()") added of_node_put() calls for ofpart_node on all exit paths.
In the case where the partition passed to parse_fixed_partitions() has a parent, it is treated as a dedicated partitions node, and of_node_put() is wrongly called for it, even if of_node_get() was not called explicitly.
On repeated bind / unbinds of the MTD, the extra of_node_put() ends up decrementing the refcount down to 0, which should never happen, resulting in the following error:
OF: ERROR: of_node_release() detected bad of_node_put() on /soc/spi@80007000/flash@0/partitions/partition@0
Call of_node_get() to balance the call to of_node_put() done for dedicated partitions nodes.
--- drivers/mtd/parsers/ofpart_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/parsers/ofpart_core.c +1 -1
@@ -71,7 +71,7 @@ static int parse_fixed_partitions(struct mtd_info *master, dedicated = false; } }else {/* Partition */ - ofpart_node = mtd_node; + ofpart_node =of_node_get (mtd_node); } of_id =of_match_node (parse_ofpart_match_table, ofpart_node);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 233/508 mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Genoud <[email protected]>
[ Upstream commit 848c13996c55fe4ea6bf5acc3ce6c8c5c944b5f6 ]
When dumping the OOB, the bytes at the end where actually copied from the beginning of the OOB instead of current_offset.
That leads to something like:
OOB: ff ff ff ff ff ff ff ff ea 19 00 3a 83 db aa 8d
OOB: 99 09 c8 9a 90 36 35 7d aa 15 13 07 3d 97 b2 a4
OOB: a8 bb 19 b3 07 e9 f6 25 52 d7 1a 23 e2 7e 0a e4
OOB: 52 8a 09 d2 1a 86 3d cf b4 99 43 13 d3 90 33 0b
OOB: ff ff ff ff ff ff ff ff ea 19 00 3a 83 db aa 8d
OOB: 99 09 c8 9a 90 36 35 7d aa 15 13 07 3d 97 b2 a4
OOB: a8 bb 19 b3 07 e9 f6 25 52 d7 1a 23 e2 7e 0a e4
OOB: 52 8a 09 d2 1a 86 3d cf b4 99 43 13 d3 90 33 0b instead of:
OOB: ff ff ff ff ff ff ff ff ea 19 00 3a 83 db aa 8d
OOB: 99 09 c8 9a 90 36 35 7d aa 15 13 07 3d 97 b2 a4
OOB: a8 bb 19 b3 07 e9 f6 25 52 d7 1a 23 e2 7e 0a e4
OOB: 52 8a 09 d2 1a 86 3d cf b4 99 43 13 d3 90 33 0b
OOB: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
OOB: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
OOB: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
OOB: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff (example with BCH16, user data [8,0], no scrambling)
*cur_off (offset from the beginning of the page) was compared to offset (offset from the beginning of the OOB), and then, the nand_change_read_column_op() sets the current position to the beginning of the OOB instead of OOB+offset
--- drivers/mtd/nand/raw/sunxi_nand.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/mtd/nand/raw/sunxi_nand.c +3 -3
@@ -886,9 +886,9 @@ static void sunxi_nfc_hw_ecc_read_extra_oob(struct nand_chip *nand,if (len <=0 )return ; -if (!cur_off || *cur_off != offset) -nand_change_read_column_op (nand, mtd->writesize,NULL ,0 , - false); +if (!cur_off || *cur_off != (offset + mtd->writesize)) +nand_change_read_column_op (nand, mtd->writesize + offset, +NULL ,0 , false);if (!randomize)sunxi_nfc_read_buf (nand, oob + offset, len);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 234/508 HID: usbhid: fix deadlock in hid_post_reset()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
[ Upstream commit 8df2c1b47ee3cd50fd454f75c7a7e2ae8a6adf72 ]
You can build a USB device that includes a HID component and a storage or UAS component. The components can be reset only together. That means that hid_pre_reset() and hid_post_reset() are in the block IO error handling. Hence no memory allocation used in them may do block IO because the IO can deadlock on the mutex held while resetting a device and calling the interface drivers.
Use GFP_NOIO for all allocations in them.
--- drivers/hid/usbhid/hid-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/usbhid/hid-core.c +1 -1
@@ -1549,7 +1549,7 @@ static int hid_post_reset(struct usb_interface *intf)* configuration descriptors passed, we already know that * the size of the HID report descriptor has not changed. */ - rdesc =kmalloc (hid->dev_rsize,GFP_KERNEL ); + rdesc =kmalloc (hid->dev_rsize,GFP_NOIO );if (!rdesc)return -ENOMEM ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 235/508 bpf, arm64: Fix off-by-one in check_imm signed range check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 1dd8be4ec722ce54e4cace59f3a4ba658111b3ec ]
check_imm(bits, imm) is used in the arm64 BPF JIT to verify that a branch displacement (in arm64 instruction units) fits into the signed N-bit immediate field of a B, B.cond or CBZ/CBNZ encoding before it is handed to the encoder. The macro currently tests for (imm > 0 && imm >> bits) || (imm < 0 && ~imm >> bits) which admits values in [-2^N, 2^N) — effectively a signed (N+1)-bit range. A signed N-bit field only holds [-2^(N-1), 2^(N-1)), so the check admits one extra bit of range on each side.
In particular, for check_imm19(), values in [2^18, 2^19) slip past the check but do not fit into the 19-bit signed imm19 field of B.cond. aarch64_insn_encode_immediate() then masks the raw value into the 19-bit field, setting bit 18 (the sign bit) and flipping a forward branch into a backward one. Same class of issue exists for check_imm26() and the B/BL encoding. Shift by (bits - 1) instead of bits so the actual signed N-bit range is enforced.
--- arch/arm64/net/bpf_jit_comp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/net/bpf_jit_comp.c +2 -2
@@ -33,8 +33,8 @@#define FP_BOTTOM (MAX_BPF_JIT_REG + 4)#define check_imm (bits, imm) do { \ - if ((((imm) > 0) && ((imm) >> (bits))) || \ - (((imm) < 0) && (~(imm) >> (bits)))) { \ + if ((((imm) > 0) && ((imm) >> ((bits) - 1))) || \ + (((imm) < 0) && (~(imm) >> ((bits) - 1)))) { \ pr_info("[%2d] imm=%d(0x%x) out of range\n", \ i, imm, imm); \ return -EINVAL; \
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 236/508 bpf, riscv: Remove redundant bpf_flush_icache() after pack allocator finalize
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Puranjay Mohan <[email protected]>
[ Upstream commit 46ee1342b887c9387a933397d846ff6c9584322c ]
bpf_flush_icache() calls flush_icache_range() to clean the data cache and invalidate the instruction cache for the JITed code region. However, since commit 48a8f78c50bd ("bpf, riscv: use prog pack allocator in the BPF JIT"), this flush is redundant.
bpf_jit_binary_pack_finalize() copies the JITed instructions to the ROX region via bpf_arch_text_copy() -> patch_text_nosync(), and patch_text_nosync() already calls flush_icache_range() on the written range. The subsequent bpf_flush_icache() repeats the same cache maintenance on an overlapping range.
Remove the redundant bpf_flush_icache() call and its now-unused definition.
--- arch/riscv/net/bpf_jit.h | 6 ------ arch/riscv/net/bpf_jit_core.c | 7 ------- 2 files changed, 13 deletions(-)
arch/riscv/net/bpf_jit.h +0 -6
@@ -11,7 +11,6 @@#include <linux/bpf.h> #include <linux/filter.h> -#include <asm/cacheflush.h> static inline bool rvc_enabled (void ) {
@@ -97,11 +96,6 @@ static inline void bpf_fill_ill_insns(void *area, unsigned int size)memset (area,0 , size); } -static inline void bpf_flush_icache (void *start,void *end) -{ -flush_icache_range ((unsigned long )start, (unsigned long )end); -} -/* Emit a 4-byte riscv instruction. */ static inline void emit (const u32 insn,struct rv_jit_context *ctx) {
arch/riscv/net/bpf_jit_core.c +0 -7
@@ -182,13 +182,6 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) prog = orig_prog; goto out_offset; } -/* -* The instructions have now been copied to the ROX region from -* where they will execute. -* Write any modified data cache blocks out to memory and -* invalidate the corresponding blocks in the instruction cache. -*/ -bpf_flush_icache (jit_data->ro_header, ctx->ro_insns + ctx->ninsns);for (i =0 ; i < prog->len; i++) ctx->offset[i] =ninsns_rvoff (ctx->offset[i]);bpf_prog_fill_jited_linfo (prog, ctx->offset);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 237/508 bpf, sockmap: Fix af_unix iter deadlock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit 4d328dd695383224aa750ddee6b4ad40c0f8d205 ]
bpf_iter_unix_seq_show() may deadlock when lock_sock_fast() takes the fast path and the iter prog attempts to update a sockmap. Which ends up spinning at sock_map_update_elem()'s bh_lock_sock():
WARNING: possible recursive locking detected
test_progs/1393 is trying to acquire lock:ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: sock_map_update_elem+0xdb/0x1f0
but task is already holding lock:ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: __lock_sock_fast+0x37/0xe0
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
---- lock(slock-AF_UNIX);
lock(slock-AF_UNIX);
*** DEADLOCK ***
May be due to missing lock nesting notation
4 locks held by test_progs/1393:
#0: ffff88814b59c790 (&p->lock){+.+.}-{4:4}, at: bpf_seq_read+0x59/0x10d0 #1: ffff88811ec25fd8 (sk_lock-AF_UNIX){+.+.}-{0:0}, at: bpf_seq_read+0x42c/0x10d0 #2: ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: __lock_sock_fast+0x37/0xe0 #3: ffffffff85a6a7c0 (rcu_read_lock){....}-{1:3}, at: bpf_iter_run_prog+0x51d/0xb00
Call Trace: dump_stack_lvl+0x5d/0x80 print_deadlock_bug.cold+0xc0/0xce __lock_acquire+0x130f/0x2590 lock_acquire+0x14e/0x2b0 _raw_spin_lock+0x30/0x40 sock_map_update_elem+0xdb/0x1f0 bpf_prog_2d0075e5d9b721cd_dump_unix+0x55/0x4f4 bpf_iter_run_prog+0x5b9/0xb00 bpf_iter_unix_seq_show+0x1f7/0x2e0 bpf_seq_read+0x42c/0x10d0 vfs_read+0x171/0xb20 ksys_read+0xff/0x200 do_syscall_64+0x6b/0x3a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
--- net/unix/af_unix.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
net/unix/af_unix.c +3 -4
@@ -3561,15 +3561,14 @@ static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v)struct bpf_prog *prog;struct sock *sk = v;uid_t uid; -bool slow;int ret;if (v ==SEQ_START_TOKEN )return 0 ; - slow =lock_sock_fast (sk); +lock_sock (sk); -if (unlikely (sk_unhashed (sk))) { +if (unlikely (sock_flag (sk,SOCK_DEAD ))) { ret =SEQ_SKIP ; goto unlock; }
@@ -3579,7 +3578,7 @@ static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v) prog =bpf_iter_get_info (&meta, false); ret =unix_prog_seq_show (prog, &meta, v, uid); unlock: -unlock_sock_fast (sk, slow); +release_sock (sk);return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 238/508 bpf, sockmap: Fix af_unix null-ptr-deref in proto update
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit dca38b7734d2ea00af4818ff3ae836fab33d5d5a ]
unix_stream_connect() sets sk_state (WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED)) _before_ it assigns a peer (unix_peer(sk) = newsk). sk_state == TCP_ESTABLISHED makes sock_map_sk_state_allowed() believe that socket is properly set up, which would include having a defined peer. IOW, there's a window when unix_stream_bpf_update_proto() can be called on socket which still has unix_peer(sk) == NULL.
CPU0 bpf CPU1 connect
-------- ------------
WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED)sock_map_sk_state_allowed(sk)
...sk_pair = unix_peer(sk)sock_hold(sk_pair)
sock_hold(newsk) smp_mb__after_atomic() unix_peer(sk) = newsk
BUG: kernel NULL pointer dereference, address: 0000000000000080 RIP: 0010:unix_stream_bpf_update_proto+0xa0/0x1b0 Call Trace: sock_map_link+0x564/0x8b0 sock_map_update_common+0x6e/0x340 sock_map_update_elem_sys+0x17d/0x240 __sys_bpf+0x26db/0x3250 __x64_sys_bpf+0x21/0x30 do_syscall_64+0x6b/0x3a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
Initial idea was to move peer assignment _before_ the sk_state update[1], but that involved an additional memory barrier, and changing the hot path was rejected.
Then a NULL check during proto update in unix_stream_bpf_update_proto() was considered[2], but the follow-up discussion[3] focused on the root cause, i.e. sockmap update taking a wrong lock. Or, more specifically, missing unix_state_lock()[4].
In the end it was concluded that teaching sockmap about the af_unix locking would be unnecessarily complex[5].
Complexity aside, since BPF_PROG_TYPE_SCHED_CLS and BPF_PROG_TYPE_SCHED_ACT are allowed to update sockmaps, sock_map_update_elem() taking the unix lock, as it is currently implemented in unix_state_lock():
spin_lock(&unix_sk(s)->lock), would be problematic. unix_state_lock() taken in a process context, followed by a softirq-context TC BPF program attempting to take the same spinlock -- deadlock[6].
This way we circled back to the peer check idea[2].
[1]: https://lore.kernel.org/netdev/[email protected]/
[2]: https://lore.kernel.org/netdev/[email protected]/
[3]: https://lore.kernel.org/netdev/[email protected]/
[4]: https://lore.kernel.org/netdev/CAAVpQUA+8GL_j63CaKb8hbxoL21izD58yr1NvhOhU=j+35+3og@mail.gmail.com/
[5]: https://lore.kernel.org/bpf/CAAVpQUAHijOMext28Gi10dSLuMzGYh+jK61Ujn+fZ-wvcODR2A@mail.gmail.com/
[6]: https://lore.kernel.org/bpf/[email protected]/
Summary of scenarios where af_unix/stream connect() may race a sockmap update:
1. connect() vs. bpf(BPF_MAP_UPDATE_ELEM), i.e. sock_map_update_elem_sys()
Implemented NULL check is sufficient. Once assigned, socket peer won't be released until socket fd is released. And that's not an issue because sock_map_update_elem_sys() bumps fd refcnf.
2. connect() vs BPF program doing update
Update restricted per verifier.c:may_update_sockmap() to
BPF_PROG_TYPE_TRACING/BPF_TRACE_ITER BPF_PROG_TYPE_SOCK_OPS (bpf_sock_map_update() only) BPF_PROG_TYPE_SOCKET_FILTER BPF_PROG_TYPE_SCHED_CLS BPF_PROG_TYPE_SCHED_ACT
BPF_PROG_TYPE_XDP BPF_PROG_TYPE_SK_REUSEPORT BPF_PROG_TYPE_FLOW_DISSECTOR BPF_PROG_TYPE_SK_LOOKUP
Plus one more race to consider:
CPU0 bpf CPU1 connect
-------- ------------
WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED)
sock_map_sk_state_allowed(sk)
sock_hold(newsk)
smp_mb__after_atomic()
unix_peer(sk) = newsk
sk_pair = unix_peer(sk)
if (unlikely(!sk_pair))
return -EINVAL;
CPU1 close
----------
skpair = unix_peer(sk);
unix_peer(sk) = NULL;
sock_put(skpair) // use after free?
sock_hold(sk_pair)
2.1 BPF program invoking helper function bpf_sock_map_update() ->
BPF_CALL_4(bpf_sock_map_update(), ...)
Helper limited to BPF_PROG_TYPE_SOCK_OPS. Nevertheless, a unix sock might be accessible via bpf_map_lookup_elem(). Which implies sk already having psock, which in turn implies sk already having sk_pair. Since sk_psock_destroy() is queued as RCU work, sk_pair won't go away while BPF executes the update.
2.2 BPF program invoking helper function bpf_map_update_elem() ->
sock_map_update_elem()
2.2.1 Unix sock accessible to BPF prog only via sockmap lookup in
BPF_PROG_TYPE_SOCKET_FILTER, BPF_PROG_TYPE_SCHED_CLS,
BPF_PROG_TYPE_SCHED_ACT, BPF_PROG_TYPE_XDP,
BPF_PROG_TYPE_SK_REUSEPORT, BPF_PROG_TYPE_FLOW_DISSECTOR,
BPF_PROG_TYPE_SK_LOOKUP.
Pretty much the same as case 2.1.
2.2.2 Unix sock accessible to BPF program directly:
BPF_PROG_TYPE_TRACING, narrowed down to BPF_TRACE_ITER.
Sockmap iterator (sock_map_seq_ops) is safe: unix sock
residing in a sockmap means that the sock already went through
the proto update step.
Unix sock iterator (bpf_iter_unix_seq_ops), on the other hand,
gives access to socks that may still be unconnected. Which
means iterator prog can race sockmap/proto update against
connect().
BUG: KASAN: null-ptr-deref in unix_stream_bpf_update_proto+0x253/0x4d0
Write of size 4 at addr 0000000000000080 by task test_progs/3140
Call Trace:
dump_stack_lvl+0x5d/0x80
kasan_report+0xe4/0x1c0
kasan_check_range+0x125/0x200
unix_stream_bpf_update_proto+0x253/0x4d0
sock_map_link+0x71c/0xec0
sock_map_update_common+0xbc/0x600
sock_map_update_elem+0x19a/0x1f0
bpf_prog_bbbf56096cdd4f01_selective_dump_unix+0x20c/0x217
bpf_iter_run_prog+0x21e/0xae0
bpf_iter_unix_seq_show+0x1e0/0x2a0
bpf_seq_read+0x42c/0x10d0
vfs_read+0x171/0xb20
ksys_read+0xff/0x200
do_syscall_64+0xf7/0x5e0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
While the introduced NULL check prevents null-ptr-deref in the
BPF program path as well, it is insufficient to guard against
a poorly timed close() leading to a use-after-free. This will
be addressed in a subsequent patch.--- net/unix/unix_bpf.c | 3 +++ 1 file changed, 3 insertions(+)
net/unix/unix_bpf.c +3 -0
@@ -184,6 +184,9 @@ int unix_stream_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool r*/ if (!psock->sk_pair) { sk_pair =unix_peer (sk); +if (unlikely (!sk_pair)) +return -EINVAL ; +sock_hold (sk_pair); psock->sk_pair = sk_pair; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 239/508 bpf, sockmap: Take state lock for af_unix iter
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit 64c2f93fc3254d3bf5de4445fb732ee5c451edb6 ]
When a BPF iterator program updates a sockmap, there is a race condition in unix_stream_bpf_update_proto() where the peer pointer can become stale[1] during a state transition TCP_ESTABLISHED -> TCP_CLOSE.
CPU0 bpf CPU1 close
-------- ----------
// unix_stream_bpf_update_proto()sk_pair = unix_peer(sk)
if (unlikely(!sk_pair))
return -EINVAL;
// unix_release_sock()
skpair = unix_peer(sk);
unix_peer(sk) = NULL;
sock_put(skpair)sock_hold(sk_pair) // UaF
More practically, this fix guarantees that the iterator program is consistently provided with a unix socket that remains stable during iterator execution.
[1]:
BUG: KASAN: slab-use-after-free in unix_stream_bpf_update_proto+0x155/0x490 Write of size 4 at addr ffff8881178c9a00 by task test_progs/2231 Call Trace: dump_stack_lvl+0x5d/0x80 print_report+0x170/0x4f3 kasan_report+0xe4/0x1c0 kasan_check_range+0x125/0x200 unix_stream_bpf_update_proto+0x155/0x490 sock_map_link+0x71c/0xec0 sock_map_update_common+0xbc/0x600 sock_map_update_elem+0x19a/0x1f0 bpf_prog_bbbf56096cdd4f01_selective_dump_unix+0x20c/0x217 bpf_iter_run_prog+0x21e/0xae0 bpf_iter_unix_seq_show+0x1e0/0x2a0 bpf_seq_read+0x42c/0x10d0 vfs_read+0x171/0xb20 ksys_read+0xff/0x200 do_syscall_64+0xf7/0x5e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Allocated by task 2236: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x63/0x80 kmem_cache_alloc_noprof+0x1d5/0x680 sk_prot_alloc+0x59/0x210 sk_alloc+0x34/0x470 unix_create1+0x86/0x8a0 unix_stream_connect+0x318/0x15b0 __sys_connect+0xfd/0x130 __x64_sys_connect+0x72/0xd0 do_syscall_64+0xf7/0x5e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 2236: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x70 __kasan_slab_free+0x47/0x70 kmem_cache_free+0x11c/0x590 __sk_destruct+0x432/0x6e0 unix_release_sock+0x9b3/0xf60 unix_release+0x8a/0xf0 __sock_release+0xb0/0x270 sock_close+0x18/0x20 __fput+0x36e/0xac0 fput_close_sync+0xe5/0x1a0 __x64_sys_close+0x7d/0xd0 do_syscall_64+0xf7/0x5e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
--- net/unix/af_unix.c | 2 ++ 1 file changed, 2 insertions(+)
net/unix/af_unix.c +2 -0
@@ -3567,6 +3567,7 @@ static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v)return 0 ;lock_sock (sk); +unix_state_lock (sk);if (unlikely (sock_flag (sk,SOCK_DEAD ))) { ret =SEQ_SKIP ;
@@ -3578,6 +3579,7 @@ static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v) prog =bpf_iter_get_info (&meta, false); ret =unix_prog_seq_show (prog, &meta, v, uid); unlock: +unix_state_unlock (sk);release_sock (sk);return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 240/508 bpf: Fix precedence bug in convert_bpf_ld_abs alignment check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit e5f635edd393aeaa7cad9e42831d397e6e2e1eed ]
Fix an operator precedence issue in convert_bpf_ld_abs() where the expression offset + ip_align % size evaluates as offset + (ip_align % size) due to % having higher precedence than +. That latter evaluation does not make any sense. The intended check is (offset + ip_align) % size == 0 to verify that the packet load offset is properly aligned for direct access.
With NET_IP_ALIGN == 2, the bug causes the inline fast-path for direct packet loads to almost never be taken on !CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS platforms. This forces nearly all cBPF BPF_LD_ABS packet loads through the bpf_skb_load_helper slow path on the affected archs.
--- net/core/filter.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/filter.c +1 -1
@@ -492,7 +492,7 @@ static bool convert_bpf_ld_abs(struct sock_filter *fp, struct bpf_insn **insnp) ((unaligned_ok && offset >= 0) || (!unaligned_ok && offset >= 0 && offset + ip_align >= 0 && - offset + ip_align % size == 0))) { + (offset + ip_align) % size == 0))) {bool ldx_off_ok = offset <=S16_MAX ; *insn++ =BPF_MOV64_REG (BPF_REG_TMP ,BPF_REG_H );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 241/508 bpf: Fix NULL deref in map_kptr_match_type for scalar regs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mykyta Yatsenko <[email protected]>
[ Upstream commit 4d0a375887ab4d49e4da1ff10f9606cab8f7c3ad ]
Commit ab6c637ad027 ("bpf: Fix a bpf_kptr_xchg() issue with local kptr") refactored map_kptr_match_type() to branch on btf_is_kernel() before checking base_type(). A scalar register stored into a kptr slot has no btf, so the btf_is_kernel(reg->btf) call dereferences NULL.
Move the base_type() != PTR_TO_BTF_ID guard before any reg->btf access.
--- kernel/bpf/verifier.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/bpf/verifier.c +4 -1
@@ -5336,6 +5336,9 @@ static int map_kptr_match_type(struct bpf_verifier_env *env,int perm_flags;const char *reg_name ="" ; +if (base_type (reg->type) !=PTR_TO_BTF_ID ) + goto bad_type; +if (btf_is_kernel (reg->btf)) { perm_flags =PTR_MAYBE_NULL |PTR_TRUSTED |MEM_RCU ;
@@ -5346,7 +5349,7 @@ static int map_kptr_match_type(struct bpf_verifier_env *env, perm_flags =PTR_MAYBE_NULL |MEM_ALLOC ; } -if (base_type (reg->type) !=PTR_TO_BTF_ID || (type_flag (reg->type) & ~perm_flags)) +if (type_flag (reg->type) & ~perm_flags) goto bad_type;/* We need to verify reg->type and reg->btf, before accessing reg->btf */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 242/508 bpf: allow UTF-8 literals in bpf_bprintf_prepare()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihan Ding <[email protected]>
[ Upstream commit b960430ea8862ef37ce53c8bf74a8dc79d3f2404 ]
bpf_bprintf_prepare() only needs ASCII parsing for conversion specifiers. Plain text can safely carry bytes >= 0x80, so allow UTF-8 literals outside '%' sequences while keeping ASCII control bytes rejected and format specifiers ASCII-only.
This keeps existing parsing rules for format directives unchanged, while allowing helpers such as bpf_trace_printk() to emit UTF-8 literal text.
Update test_snprintf_negative() in the same commit so selftests keep matching the new plain-text vs format-specifier split during bisection.
--- kernel/bpf/helpers.c | 17 ++++++++++++++++- .../testing/selftests/bpf/prog_tests/snprintf.c | 3 ++- 2 files changed, 18 insertions(+), 2 deletions(-)
kernel/bpf/helpers.c +16 -1
@@ -849,7 +849,13 @@ int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args, data->buf = buffers->buf;for (i =0 ; i < fmt_size; i++) { -if ((!isprint (fmt[i]) && !isspace (fmt[i])) || !isascii (fmt[i])) { +unsigned char c = fmt[i]; + +/* +* Permit bytes >= 0x80 in plain text so UTF-8 literals can pass +* through unchanged, while still rejecting ASCII control bytes. +*/ +if (isascii (c) && !isprint (c) && !isspace (c)) { err = -EINVAL ; goto out; }
@@ -871,6 +877,15 @@ int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args,* always access fmt[i + 1], in the worst case it will be a 0 */ i++; + c = fmt[i]; +/* +* The format parser below only understands ASCII conversion +* specifiers and modifiers, so reject non-ASCII after '%'. +*/ +if (!isascii (c)) { + err = -EINVAL ; + goto out; + }/* skip optional "[0 +-][num]" width formatting field */ while (fmt[i] == '0' || fmt[i] == '+' || fmt[i] == '-' ||
tools/testing/selftests/bpf/prog_tests/snprintf.c +2 -1
@@ -114,7 +114,8 @@ static void test_snprintf_negative(void)ASSERT_ERR (load_single_snprintf ("%--------" ),"invalid specifier 5" );ASSERT_ERR (load_single_snprintf ("%lc" ),"invalid specifier 6" );ASSERT_ERR (load_single_snprintf ("%llc" ),"invalid specifier 7" ); -ASSERT_ERR (load_single_snprintf ("\x80" ),"non ascii character" ); +ASSERT_OK (load_single_snprintf ("\x80" ),"non ascii plain text" ); +ASSERT_ERR (load_single_snprintf ("%\x80" ),"non ascii in specifier" );ASSERT_ERR (load_single_snprintf ("\x1" ),"non printable character" ); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 243/508 bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Puranjay Mohan <[email protected]>
[ Upstream commit e1d486445af3c392628532229f7ce5f5cf7891b6 ]
The ARM32 BPF JIT does not support BPF-to-BPF function calls (BPF_PSEUDO_CALL) or callbacks (BPF_PSEUDO_FUNC), but it does not reject them either.
When a program with subprograms is loaded (e.g. libxdp's XDP dispatcher uses __noinline__ subprograms, or any program using callbacks like bpf_loop or bpf_for_each_map_elem), the verifier invokes bpf_jit_subprogs() which calls bpf_int_jit_compile() for each subprogram.
For BPF_PSEUDO_CALL, since ARM32 does not reject it, the JIT silently emits code using the wrong address computation:
func = __bpf_call_base + imm
where imm is a pc-relative subprogram offset, producing a bogus function pointer.
For BPF_PSEUDO_FUNC, the ldimm64 handler ignores src_reg and loads the immediate as a normal 64-bit value without error.
In both cases, build_body() reports success and a JIT image is allocated. ARM32 lacks the jit_data/extra_pass mechanism needed for the second JIT pass in bpf_jit_subprogs(). On the second pass, bpf_int_jit_compile() performs a full fresh compilation, allocating a new JIT binary and overwriting prog->bpf_func. The first allocation is never freed. bpf_jit_subprogs() then detects the function pointer changed and aborts with -ENOTSUPP, but the original JIT binary has already been leaked. Each program load/unload cycle leaks one JIT binary allocation, as reported by kmemleak:
unreferenced object 0xbf0a1000 (size 4096):
backtrace:
bpf_jit_binary_alloc+0x64/0xfc
bpf_int_jit_compile+0x14c/0x348
bpf_jit_subprogs+0x4fc/0xa60Fix this by rejecting both BPF_PSEUDO_CALL in the BPF_CALL handler and BPF_PSEUDO_FUNC in the BPF_LD_IMM64 handler, falling through to the existing 'notyet' path. This causes build_body() to fail before any JIT binary is allocated, so bpf_int_jit_compile() returns the original program unjitted. bpf_jit_subprogs() then sees !prog->jited and cleanly falls back to the interpreter with no leak.
--- arch/arm/net/bpf_jit_32.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/arm/net/bpf_jit_32.c +6 -0
@@ -1594,6 +1594,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) {u64 val = (u32 )imm | (u64 )insn[1 ].imm <<32 ; +if (insn->src_reg ==BPF_PSEUDO_FUNC ) + goto notyet; +emit_a32_mov_i64 (dst, val, ctx);return 1 ;
@@ -1785,6 +1788,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)const s8 *r5 = bpf2a32[BPF_REG_5 ];const u32 func = (u32 )__bpf_call_base + (u32 )imm; +if (insn->src_reg ==BPF_PSEUDO_CALL ) + goto notyet; +emit_a32_mov_r64 (true, r0, r1, ctx);emit_a32_mov_r64 (true, r1, r2, ctx);emit_push_r64 (r5, ctx);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 244/508 pinctrl: pinctrl-pic32: Fix resource leak
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Tidmore <[email protected]>
[ Upstream commit fe5560688f3ba98364c7de7b4f8dc240ffd1ff75 ]
Fix three possible resource leaks by using the devres version of clk_prepare_enable(). Also, update error message accordingly.
Detected by Smatch:drivers/pinctrl/pinctrl-pic32.c:2211 pic32_pinctrl_probe() warn:
'pctl->clk' from clk_prepare_enable() not released on lines: 2208.
drivers/pinctrl/pinctrl-pic32.c:2274 pic32_gpio_probe() warn:
'bank->clk' from clk_prepare_enable() not released on lines: 2264,2272.
--- drivers/pinctrl/pinctrl-pic32.c | 20 ++++---------------- 1 file changed, 4 insertions(+), 16 deletions(-)
drivers/pinctrl/pinctrl-pic32.c +4 -16
@@ -2173,16 +2173,10 @@ static int pic32_pinctrl_probe(struct platform_device *pdev)if (IS_ERR (pctl->reg_base))return PTR_ERR (pctl->reg_base); - pctl->clk =devm_clk_get (&pdev->dev,NULL ); + pctl->clk =devm_clk_get_enabled (&pdev->dev,NULL );if (IS_ERR (pctl->clk)) { ret =PTR_ERR (pctl->clk); -dev_err (&pdev->dev,"clk get failed\n" ); -return ret; - } - - ret =clk_prepare_enable (pctl->clk); -if (ret) { -dev_err (&pdev->dev,"clk enable failed\n" ); +dev_err (&pdev->dev,"Failed to get and enable clock\n" );return ret; }
@@ -2238,16 +2232,10 @@ static int pic32_gpio_probe(struct platform_device *pdev)if (irq <0 )return irq; - bank->clk =devm_clk_get (&pdev->dev,NULL ); + bank->clk =devm_clk_get_enabled (&pdev->dev,NULL );if (IS_ERR (bank->clk)) { ret =PTR_ERR (bank->clk); -dev_err (&pdev->dev,"clk get failed\n" ); -return ret; - } - - ret =clk_prepare_enable (bank->clk); -if (ret) { -dev_err (&pdev->dev,"clk enable failed\n" ); +dev_err (&pdev->dev,"Failed to get and enable clock\n" );return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 245/508 pinctrl: cy8c95x0: remove duplicate error message
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 970dacb3b9f0fedbbbcfd7dbf1f4f22340b3f359 ]
The pin control core is covered to report any error via message. The devm_request_threaded_irq() already prints an error message. Remove the duplicates.
While at it, drop the info message as the same information about an IRQ in use can be retrieved differently.
Stable-dep-of: 5ad32c3607cf ("pinctrl: cy8c95x0: Avoid returning positive values to user space")
--- drivers/pinctrl/pinctrl-cy8c95x0.c | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-)
drivers/pinctrl/pinctrl-cy8c95x0.c +5 -16
@@ -1253,6 +1253,7 @@ static int cy8c95x0_irq_setup(struct cy8c95x0_pinctrl *chip, int irq) {struct gpio_irq_chip *girq = &chip->gpio_chip.irq;DECLARE_BITMAP (pending_irqs,MAX_LINE ); +struct device *dev = chip->dev;int ret;mutex_init (&chip->irq_lock);
@@ -1279,17 +1280,9 @@ static int cy8c95x0_irq_setup(struct cy8c95x0_pinctrl *chip, int irq) girq->handler = handle_simple_irq; girq->threaded = true; - ret =devm_request_threaded_irq (chip->dev, irq, -NULL , cy8c95x0_irq_handler, -IRQF_ONESHOT |IRQF_SHARED , -dev_name (chip->dev), chip); -if (ret) { -dev_err (chip->dev,"failed to request irq %d\n" , irq); -return ret; - } -dev_info (chip->dev,"Registered threaded IRQ\n" ); - -return 0 ; +return devm_request_threaded_irq (dev, irq,NULL , cy8c95x0_irq_handler, +IRQF_ONESHOT |IRQF_SHARED , +dev_name (chip->dev), chip); }static int cy8c95x0_setup_pinctrl (struct cy8c95x0_pinctrl *chip)
@@ -1305,11 +1298,7 @@ static int cy8c95x0_setup_pinctrl(struct cy8c95x0_pinctrl *chip) pd->owner =THIS_MODULE ; chip->pctldev =devm_pinctrl_register (chip->dev, pd, chip); -if (IS_ERR (chip->pctldev)) -return dev_err_probe (chip->dev,PTR_ERR (chip->pctldev), -"can't register controller\n" ); - -return 0 ; +return PTR_ERR_OR_ZERO (chip->pctldev); } static int cy8c95x0_detect(struct i2c_client *client,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 246/508 pinctrl: cy8c95x0: Unify messages with help of dev_err_probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 014884732095b982412d13d3220c3fe8483b9b3e ]
Unify error messages that might appear during probe phase by switching to use dev_err_probe().
Stable-dep-of: 5ad32c3607cf ("pinctrl: cy8c95x0: Avoid returning positive values to user space")
--- drivers/pinctrl/pinctrl-cy8c95x0.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/pinctrl/pinctrl-cy8c95x0.c +2 -4
@@ -1262,10 +1262,8 @@ static int cy8c95x0_irq_setup(struct cy8c95x0_pinctrl *chip, int irq)/* Read IRQ status register to clear all pending interrupts */ ret =cy8c95x0_irq_pending (chip, pending_irqs); -if (ret) { -dev_err (chip->dev,"failed to clear irq status register\n" ); -return ret; - } +if (ret) +return dev_err_probe (dev, ret,"failed to clear irq status register\n" );/* Mask all interrupts */ bitmap_fill (chip->irq_mask,MAX_LINE );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 247/508 pinctrl: cy8c95x0: Avoid returning positive values to user space
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 5ad32c3607cf241a1a2680cabd64cbcd757227aa ]
When probe fails due to unclear interrupt status register, it returns a positive number instead of the proper error code. Fix this accordingly.
--- drivers/pinctrl/pinctrl-cy8c95x0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/pinctrl-cy8c95x0.c +1 -1
@@ -1263,7 +1263,7 @@ static int cy8c95x0_irq_setup(struct cy8c95x0_pinctrl *chip, int irq)/* Read IRQ status register to clear all pending interrupts */ ret =cy8c95x0_irq_pending (chip, pending_irqs);if (ret) -return dev_err_probe (dev, ret,"failed to clear irq status register\n" ); +return dev_err_probe (dev, -EBUSY ,"failed to clear irq status register\n" );/* Mask all interrupts */ bitmap_fill (chip->irq_mask,MAX_LINE );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 248/508 perf branch: Avoid incrementing NULL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit c969a9d7bbf46f983c4a48566b3b2f7340b02296 ]
If the entry is NULL the value is meaningless so early return NULL to avoid an increment of NULL. This was happening in calls from has_stitched_lbr when running the "perf record LBR tests". The return value isn't used in that case, so returning NULL as no effect.
--- tools/perf/util/branch.h | 3 +++ 1 file changed, 3 insertions(+)
tools/perf/util/branch.h +3 -0
@@ -64,6 +64,9 @@ static inline struct branch_entry *perf_sample__branch_entries(struct perf_sampl {u64 *entry = (u64 *)sample->branch_stack; +if (entry ==NULL ) +return NULL ; + entry++;if (sample->no_hw_idx)return (struct branch_entry *)entry;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 249/508 perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Leach <[email protected]>
[ Upstream commit 6c478e7b3eba3f387a2d6c749e3e3ee0f8ad1c53 ]
Building perf with CORESIGHT=1 and the optional CSTRACE_RAW=1 enables additional debug printing of raw trace data when using command:- perf report --dump.
This raw trace prints the CoreSight formatted trace frames, which may be used to investigate suspected issues with trace quality / corruption / decode.
These frames are not present in ETE + TRBE trace. This fix removes the unnecessary call to print these frames.
This fix also rationalises implementation - original code had helper function that unnecessarily repeated initialisation calls that had already been made.
Due to an addtional fault with the OpenCSD library, this call when ETE/TRBE are being decoded will cause a segfault in perf. This fix also prevents that problem for perf using older (<= 1.8.0 version) OpenCSD libraries.
--- .../perf/util/cs-etm-decoder/cs-etm-decoder.c | 51 +++++-------------- 1 file changed, 13 insertions(+), 38 deletions(-)
tools/perf/util/cs-etm-decoder/cs-etm-decoder.c +13 -38
@@ -237,46 +237,24 @@ cs_etm_decoder__init_def_logger_printing(struct cs_etm_decoder_params *d_params, (void *)decoder, cs_etm_decoder__print_str_cb);if (ret !=0 ) - ret =-1 ; - -return 0 ; -} +return -1 ;#ifdef CS_LOG_RAW_FRAMES -static void -cs_etm_decoder__init_raw_frame_logging (struct cs_etm_decoder_params *d_params, -struct cs_etm_decoder *decoder) -{ -/* Only log these during a --dump operation */ -if (d_params->operation ==CS_ETM_OPERATION_PRINT ) { -/* set up a library default logger to process the -* raw frame printer we add later -*/ -ocsd_def_errlog_init (OCSD_ERR_SEV_ERROR ,1 ); - -/* no stdout / err / file output */ -ocsd_def_errlog_config_output (C_API_MSGLOGOUT_FLG_NONE ,NULL ); - -/* set the string CB for the default logger, -* passes strings to perf print logger. -*/ -ocsd_def_errlog_set_strprint_cb (decoder->dcd_tree, - (void *)decoder, - cs_etm_decoder__print_str_cb); - +/* +* Only log raw frames if --dump operation and hardware is actually +* generating formatted CoreSight trace frames +*/ +if ((d_params->operation ==CS_ETM_OPERATION_PRINT ) && + (d_params->formatted == true)) {/* use the built in library printer for the raw frames */ -ocsd_dt_set_raw_frame_printer (decoder->dcd_tree, -CS_RAW_DEBUG_FLAGS ); + ret =ocsd_dt_set_raw_frame_printer (decoder->dcd_tree, +CS_RAW_DEBUG_FLAGS ); +if (ret !=0 ) +return -1 ; } -} -#else -static void -cs_etm_decoder__init_raw_frame_logging ( -struct cs_etm_decoder_params *d_params__maybe_unused , -struct cs_etm_decoder *decoder__maybe_unused ) -{ -}#endif +return 0 ; +} static ocsd_datapath_resp_t cs_etm_decoder__do_soft_timestamp(struct cs_etm_queue *etmq,
@@ -755,9 +733,6 @@ cs_etm_decoder__new(int decoders, struct cs_etm_decoder_params *d_params,if (ret !=0 ) goto err_free_decoder; -/* init raw frame logging if required */ -cs_etm_decoder__init_raw_frame_logging (d_params, decoder); -for (i =0 ; i < decoders; i++) { ret = cs_etm_decoder__create_etm_decoder(d_params, &t_params[i],
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 250/508 pinctrl: abx500: Fix type of argument variable
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu-Chun Lin <[email protected]>
[ Upstream commit 34006f77890d050e6d80cbee365b5d703c1140b4 ]
The argument variable is assigned the return value of pinconf_to_config_argument(), which returns a u32. Change its type from enum pin_config_param to unsigned int to correctly store the configuration argument.
--- drivers/pinctrl/nomadik/pinctrl-abx500.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/nomadik/pinctrl-abx500.c +1 -1
@@ -853,7 +853,7 @@ static int abx500_pin_config_set(struct pinctrl_dev *pctldev,int ret = -EINVAL ;int i;enum pin_config_param param; -enum pin_config_param argument; +unsigned int argument;for (i =0 ; i < num_configs; i++) { param =pinconf_to_config_param (configs[i]);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 251/508 perf lock: Fix option value type in parse_max_stack
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit cfaade34b52aa1ec553044255702c4b31b57c005 ]
The value is a void* and the address of an int, max_stack_depth, is set up in the perf lock options. The parse_max_stack function treats the int* as a long*, make this more correct by declaring the value to be an int*.
--- tools/perf/builtin-lock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/builtin-lock.c +1 -1
@@ -2271,7 +2271,7 @@ static int parse_map_entry(const struct option *opt, const char *str,static int parse_max_stack (const struct option *opt,const char *str,int unset__maybe_unused ) { -unsigned long *len = (unsigned long *)opt->value; +int *len = opt->value;long val;char *endptr;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 252/508 perf tools: Fix module symbol resolution for non-zero .text sh_addr
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 9a82bfde4775b7a87cd1a7e791f46f83ae442848 ]
When perf resolves symbols from kernel module ELF files (ET_REL), it converts symbol addresses to file offsets so that sample IPs can be matched to the correct symbol. The conversion adjusts each symbol's st_value:
sym->st_value -= shdr->sh_addr - shdr->sh_offset;
For vmlinux (ET_EXEC), st_value is a virtual address and sh_addr is the section's virtual base, so subtracting sh_addr and adding sh_offset correctly yields a file offset.
For kernel modules (ET_REL), st_value is a section-relative offset. The module loader ignores sh_addr entirely and places symbols at module_base + st_value. Converting to file offset requires only adding sh_offset; subtracting sh_addr introduces an error equal to sh_addr bytes.
When .text has sh_addr == 0 -- the historical norm for simple modules -- both formulas produce the same result and the bug is latent. As modules gain more metadata sections before .text (.note, .static_call.text, etc.), the linker assigns .text a non-zero sh_addr, exposing the defect. For example, nfsd.ko on this kernel has sh_addr=0xa80, kvm-intel.ko has sh_addr=0x1e90.
The effect is that all .text symbols in affected modules shift by sh_addr bytes relative to sample IPs, causing perf report to attribute samples to incorrect, nearby symbols. This was observed as 13% of LLC-load-miss samples misattributed to nfsd_file_get_dio_attrs when the actual hot function was nfsd_cache_lookup, approximately 0xa80 bytes away in the symbol table.
Use the existing dso__rel() flag (already set for ET_REL modules) to select the correct adjustment: add sh_offset for ET_REL, subtract (sh_addr - sh_offset) for ET_EXEC/ET_DYN.
--- tools/perf/util/symbol-elf.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
tools/perf/util/symbol-elf.c +6 -2
@@ -1375,8 +1375,12 @@ static int dso__process_kernel_symbol(struct dso *dso, struct map *map,char dso_name[PATH_MAX ];/* Adjust symbol to map to file offset */ -if (adjust_kernel_syms) - sym->st_value -= shdr->sh_addr - shdr->sh_offset; +if (adjust_kernel_syms) { +if (dso__rel (dso)) + sym->st_value += shdr->sh_offset; +else + sym->st_value -= shdr->sh_addr - shdr->sh_offset; + }if (strcmp (section_name, (curr_dso->short_name + dso->short_name_len)) ==0 )return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 253/508 perf expr: Return -EINVAL for syntax error in expr__find_ids()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 3a61fd866ef9aaa1d3158b460f852b74a2df07f4 ]
expr__find_ids() propagates the parser return value directly. For syntax errors, the parser can return a positive value, but callers treat it as success, e.g., for below case on Arm64 platform:
metric expr 100 * (STALL_SLOT_BACKEND / (CPU_CYCLES * #slots) - BR_MIS_PRED * 3 / CPU_CYCLES) for backend_bound parsing metric: 100 * (STALL_SLOT_BACKEND / (CPU_CYCLES * #slots) - BR_MIS_PRED * 3 / CPU_CYCLES) Failure to read '#slots' literal: #slots = nan
syntax error
Convert positive parser returns in expr__find_ids() to -EINVAL, as a result, the error value will be respected by callers.
Before:
perf stat -C 5
Failure to read '#slots'Failure to read '#slots'Failure to read '#slots'Failure to read '#slots'Segmentation fault
After:
perf stat -C 5
Failure to read '#slots'Cannot find metric or group `Default'
--- tools/perf/util/expr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/perf/util/expr.c +2 -1
@@ -377,7 +377,8 @@ int expr__find_ids(const char *expr, const char *one,if (one)expr__del_id (ctx, one); -return ret; +/* A positive value means syntax error, convert to -EINVAL */ +return ret >0 ? -EINVAL : ret; }double expr_id_data__value (const struct expr_id_data *data)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 254/508 ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jian Zhang <[email protected]>
[ Upstream commit ea641be7a4faee4351f9c5ed6b188e1bbf5586a6 ]
copy_to_user() returns the number of bytes that could not be copied, with a non-zero value indicating a partial or complete failure. The current code only checks for negative return values and treats all non-negative results as success.
Treating any positive return value from copy_to_user() as an error and returning -EFAULT.
Message-ID: <[email protected]>
--- drivers/char/ipmi/ssif_bmc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/char/ipmi/ssif_bmc.c +2 -0
@@ -163,6 +163,8 @@ static ssize_t ssif_bmc_read(struct file *file, char __user *buf, size_t count,spin_unlock_irqrestore (&ssif_bmc->lock, flags); ret =copy_to_user (buf, &msg, count); +if (ret >0 ) + ret = -EFAULT ; }return (ret <0 ) ? ret : count;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 255/508 ipmi: ssif_bmc: fix message desynchronization after truncated response
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jian Zhang <[email protected]>
[ Upstream commit 1d38e849adb6851ee280aa1a1d687b2181549a66 ]
A truncated response, caused by host power-off, or other conditions, can lead to message desynchronization.
Raw trace data (STOP loss scenario, add state transition comment):
1. T-1: Read response phase (SSIF_RES_SENDING)
8271.955342 WR_RCV [03] <- Read polling cmd 8271.955348 RD_REQ [04] <== SSIF_RES_SENDING <- start sending response 8271.955436 RD_PRO [b4] 8271.955527 RD_PRO [00] 8271.955618 RD_PRO [c1] 8271.955707 RD_PRO [00] 8271.955814 RD_PRO [ad] <== SSIF_RES_SENDING <- last byte
<- !! STOP lost (truncated response)
2. T: New Write request arrives, BMC still in SSIF_RES_SENDING
8271.967973 WR_REQ [] <== SSIF_RES_SENDING >> SSIF_ABORTING <- log: unexpected WR_REQ in RES_SENDING 8271.968447 WR_RCV [02] <== SSIF_ABORTING <- do nothing 8271.968452 WR_RCV [02] <== SSIF_ABORTING <- do nothing 8271.968454 WR_RCV [18] <== SSIF_ABORTING <- do nothing 8271.968456 WR_RCV [01] <== SSIF_ABORTING <- do nothing 8271.968458 WR_RCV [66] <== SSIF_ABORTING <- do nothing 8271.978714 STOP [] <== SSIF_ABORTING >> SSIF_READY <- log: unexpected SLAVE STOP in state=SSIF_ABORTING
3. T+1: Next Read polling, treated as a fresh transaction
8271.979125 WR_REQ [] <== SSIF_READY >> SSIF_START 8271.979326 WR_RCV [03] <== SSIF_START >> SSIF_SMBUS_CMD <- smbus_cmd=0x03 8271.979331 RD_REQ [04] <== SSIF_RES_SENDING <- sending response 8271.979427 RD_PRO [b4] <- !! this is T's stale response -> desynchronization
When in SSIF_ABORTING state, a newly arrived command should still be handled to avoid dropping the request or causing message desynchronization.
Message-ID: <[email protected]>
--- drivers/char/ipmi/ssif_bmc.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/char/ipmi/ssif_bmc.c +14 -0
@@ -457,6 +457,15 @@ static bool supported_write_cmd(u8 cmd)return false; } +static bool supported_write_start_cmd (u8 cmd) +{ +if (cmd ==SSIF_IPMI_SINGLEPART_WRITE || + cmd ==SSIF_IPMI_MULTIPART_WRITE_START ) +return true; + +return false; +} +/* Process the IPMI response that will be read by master */ static void handle_read_processed (struct ssif_bmc_ctx *ssif_bmc,u8 *val) {
@@ -708,6 +717,11 @@ static void on_write_received_event(struct ssif_bmc_ctx *ssif_bmc, u8 *val) ssif_bmc->state =SSIF_ABORTING ; else ssif_bmc->state = SSIF_REQ_RECVING; + }else if (ssif_bmc->state ==SSIF_ABORTING ) { +if (supported_write_start_cmd (*val)) { + ssif_bmc->state =SSIF_SMBUS_CMD ; + ssif_bmc->aborting = false; + } }/* This is response sending state */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 256/508 ipmi: ssif_bmc: change log level to dbg in irq callback
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jian Zhang <[email protected]>
[ Upstream commit c9c99b7b7051eb7121b3224bfce181fb023b0269 ]
Long-running tests indicate that this logging can occasionally disrupt timing and lead to request/response corruption.
Irq handler need to be executed as fast as possible,
most I2C slave IRQ implementations are byte-level, logging here can significantly affect transfer behavior and timing. It is recommended to use dev_dbg() for these messages.
Message-ID: <[email protected]>
--- drivers/char/ipmi/ssif_bmc.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/char/ipmi/ssif_bmc.c +9 -9
@@ -568,7 +568,7 @@ static void process_request_part(struct ssif_bmc_ctx *ssif_bmc) len = ssif_bmc->request.len + part->length;/* Do the bound check here, not allow the request len exceed 254 bytes */ if (len >IPMI_SSIF_PAYLOAD_MAX ) { -dev_warn (&ssif_bmc->client->dev, +dev_dbg (&ssif_bmc->client->dev,"Warn: Request exceeded 254 bytes, aborting" );/* Request too long, aborting */ ssif_bmc->aborting = true;
@@ -614,7 +614,7 @@ static void on_read_requested_event(struct ssif_bmc_ctx *ssif_bmc, u8 *val) ssif_bmc->state == SSIF_START || ssif_bmc->state == SSIF_REQ_RECVING || ssif_bmc->state == SSIF_RES_SENDING) { -dev_warn (&ssif_bmc->client->dev, +dev_dbg (&ssif_bmc->client->dev,"Warn: %s unexpected READ REQUESTED in state=%s\n" , __func__,state_to_string (ssif_bmc->state)); ssif_bmc->state =SSIF_ABORTING ;
@@ -623,7 +623,7 @@ static void on_read_requested_event(struct ssif_bmc_ctx *ssif_bmc, u8 *val) }else if (ssif_bmc->state ==SSIF_SMBUS_CMD ) {if (!supported_read_cmd (ssif_bmc->part_buf.smbus_cmd)) { -dev_warn (&ssif_bmc->client->dev,"Warn: Unknown SMBus read command=0x%x" , +dev_dbg (&ssif_bmc->client->dev,"Warn: Unknown SMBus read command=0x%x" , ssif_bmc->part_buf.smbus_cmd); ssif_bmc->aborting = true; }
@@ -658,7 +658,7 @@ static void on_read_processed_event(struct ssif_bmc_ctx *ssif_bmc, u8 *val) ssif_bmc->state == SSIF_START || ssif_bmc->state == SSIF_REQ_RECVING || ssif_bmc->state == SSIF_SMBUS_CMD) { -dev_warn (&ssif_bmc->client->dev, +dev_dbg (&ssif_bmc->client->dev,"Warn: %s unexpected READ PROCESSED in state=%s\n" , __func__,state_to_string (ssif_bmc->state)); ssif_bmc->state =SSIF_ABORTING ;
@@ -683,7 +683,7 @@ static void on_write_requested_event(struct ssif_bmc_ctx *ssif_bmc, u8 *val) }else if (ssif_bmc->state ==SSIF_START || ssif_bmc->state ==SSIF_REQ_RECVING || ssif_bmc->state ==SSIF_RES_SENDING ) { -dev_warn (&ssif_bmc->client->dev, +dev_dbg (&ssif_bmc->client->dev,"Warn: %s unexpected WRITE REQUEST in state=%s\n" , __func__,state_to_string (ssif_bmc->state)); ssif_bmc->state =SSIF_ABORTING ;
@@ -698,7 +698,7 @@ static void on_write_received_event(struct ssif_bmc_ctx *ssif_bmc, u8 *val) {if (ssif_bmc->state ==SSIF_READY || ssif_bmc->state ==SSIF_RES_SENDING ) { -dev_warn (&ssif_bmc->client->dev, +dev_dbg (&ssif_bmc->client->dev,"Warn: %s unexpected WRITE RECEIVED in state=%s\n" , __func__,state_to_string (ssif_bmc->state)); ssif_bmc->state =SSIF_ABORTING ;
@@ -708,7 +708,7 @@ static void on_write_received_event(struct ssif_bmc_ctx *ssif_bmc, u8 *val) }else if (ssif_bmc->state ==SSIF_SMBUS_CMD ) {if (!supported_write_cmd (ssif_bmc->part_buf.smbus_cmd)) { -dev_warn (&ssif_bmc->client->dev,"Warn: Unknown SMBus write command=0x%x" , +dev_dbg (&ssif_bmc->client->dev,"Warn: Unknown SMBus write command=0x%x" , ssif_bmc->part_buf.smbus_cmd); ssif_bmc->aborting = true; }
@@ -737,7 +737,7 @@ static void on_stop_event(struct ssif_bmc_ctx *ssif_bmc, u8 *val) ssif_bmc->state == SSIF_START || ssif_bmc->state == SSIF_SMBUS_CMD || ssif_bmc->state == SSIF_ABORTING) { -dev_warn (&ssif_bmc->client->dev, +dev_dbg (&ssif_bmc->client->dev,"Warn: %s unexpected SLAVE STOP in state=%s\n" , __func__,state_to_string (ssif_bmc->state)); ssif_bmc->state =SSIF_READY ;
@@ -804,7 +804,7 @@ static int ssif_bmc_cb(struct i2c_client *client, enum i2c_slave_event event, u8break ;default : -dev_warn (&ssif_bmc->client->dev,"Warn: Unknown i2c slave event\n" ); +dev_dbg (&ssif_bmc->client->dev,"Warn: Unknown i2c slave event\n" );break ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 257/508 perf util: Kill die() prototype, dead for a long time
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit e5cce1b9c82fbd48e2f1f7a25a9fad8ee228176f ]
In fef2a735167a827a ("perf tools: Kill die()") the die() function was removed, but not the prototype in util.h, now when building with LIBPERL=1, during a 'make -C tools/perf build-test' routine test, it is failing as perl likes die() calls and then this clashes with this remnant, remove it.
--- tools/perf/util/util.h | 1 - 1 file changed, 1 deletion(-)
tools/perf/util/util.h +0 -1
@@ -25,7 +25,6 @@ extern bool perf_guest;/* General helper functions */ void usage (const char *err)__noreturn ; -void die(const char *err, ...) __noreturn __printf(1, 2);struct dirent ;struct strlist ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 258/508 i3c: master: Fix error codes at send_ccc_cmd
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jorge Marques <[email protected]>
[ Upstream commit ef8b5229348f0719aca557c4ca5530630ae4d134 ]
i3c_master_send_ccc_cmd_locked() would propagate cmd->err (positive, Mx codes) to the ret variable, cascading down multiple methods until reaching methods that explicitly stated they would return 0 on success or negative error code. For example, the call chain:
i3c_device_enable_ibi <- i3c_dev_enable_ibi_locked <- master->ops.enable_ibi <- i3c_master_enec_locked <- i3c_master_enec_disec_locked <- i3c_master_send_ccc_cmd_locked
Fix this by returning the ret value, callers can still read the cmd->err value if ret is negative.
All corner cases where the Mx codes do need to be handled individually, are resolved in previous commits. Those corner cases are all scenarios when I3C_ERROR_M2 is expected and acceptable.
The prerequisite patches for the fix are:
i3c: master: Move rstdaa error suppression
i3c: master: Move entdaa error suppression
i3c: master: Move bus_init error suppression
--- drivers/i3c/master.c | 32 +++++++++++++------------------- 1 file changed, 13 insertions(+), 19 deletions(-)
drivers/i3c/master.c +13 -19
@@ -792,11 +792,17 @@ static void i3c_ccc_cmd_init(struct i3c_ccc_cmd *cmd, bool rnw, u8 id, cmd->err =I3C_ERROR_UNKNOWN ; } +/** +* i3c_master_send_ccc_cmd_locked() - send a CCC (Common Command Codes) +* @master: master used to send frames on the bus +* @cmd: command to send +* +* Return: 0 in case of success, or a negative error code otherwise. +* I3C Mx error codes are stored in cmd->err. +*/ static int i3c_master_send_ccc_cmd_locked (struct i3c_master_controller *master,struct i3c_ccc_cmd *cmd) { -int ret; -if (!cmd || !master)return -EINVAL ;
@@ -814,15 +820,7 @@ static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master, !master->ops->supports_ccc_cmd(master, cmd)) return -ENOTSUPP; - ret = master->ops->send_ccc_cmd (master, cmd); -if (ret) { -if (cmd->err !=I3C_ERROR_UNKNOWN ) -return cmd->err; - -return ret; - } - -return 0 ; +return master->ops->send_ccc_cmd (master, cmd); } static struct i2c_dev_desc *
@@ -926,8 +924,7 @@ static int i3c_master_rstdaa_locked(struct i3c_master_controller *master,* * This function must be called with the bus lock held in write mode. * -* Return: 0 in case of success, a positive I3C error code if the error is -* one of the official Mx error codes, and a negative error code otherwise. +* Return: 0 in case of success, or a negative error code otherwise. */ int i3c_master_entdaa_locked (struct i3c_master_controller *master) {
@@ -979,8 +976,7 @@ static int i3c_master_enec_disec_locked(struct i3c_master_controller *master,* * This function must be called with the bus lock held in write mode. * -* Return: 0 in case of success, a positive I3C error code if the error is -* one of the official Mx error codes, and a negative error code otherwise. +* Return: 0 in case of success, or a negative error code otherwise. */ int i3c_master_disec_locked (struct i3c_master_controller *master,u8 addr,u8 evts)
@@ -1000,8 +996,7 @@ EXPORT_SYMBOL_GPL(i3c_master_disec_locked);* * This function must be called with the bus lock held in write mode. * -* Return: 0 in case of success, a positive I3C error code if the error is -* one of the official Mx error codes, and a negative error code otherwise. +* Return: 0 in case of success, or a negative error code otherwise. */ int i3c_master_enec_locked (struct i3c_master_controller *master,u8 addr,u8 evts)
@@ -1026,8 +1021,7 @@ EXPORT_SYMBOL_GPL(i3c_master_enec_locked);* * This function must be called with the bus lock held in write mode. * -* Return: 0 in case of success, a positive I3C error code if the error is -* one of the official Mx error codes, and a negative error code otherwise. +* Return: 0 in case of success, or a negative error code otherwise. */ int i3c_master_defslvs_locked (struct i3c_master_controller *master) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 259/508 i3c: mipi-i3c-hci: fix IBI payload length calculation for final status
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Billy Tsai <[email protected]>
[ Upstream commit d35a6db887eeae7c57b719521e39d64f929c6dc3 ]
In DMA mode, the IBI status descriptor encodes the payload using CHUNKS (number of chunks) and DATA_LENGTH (valid bytes in the last chunk). All preceding chunks are implicitly full-sized.
The current code accumulates full chunk sizes for non-final status descriptors, but for the final status descriptor it only adds DATA_LENGTH. This ignores the contribution of the preceding full chunks described by the same final status entry.
As a result, the computed IBI payload length is truncated whenever the final status spans multiple chunks. For example, with a chunk size of 4 bytes, CHUNKS=2 and DATA_LENGTH=1 should result in a total payload size of 5 bytes, but the current code reports only 1 byte.
Fix the calculation by adding the size of (CHUNKS - 1) full chunks plus DATA_LENGTH for the last chunk.
--- drivers/i3c/master/mipi-i3c-hci/dma.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/i3c/master/mipi-i3c-hci/dma.c +4 -1
@@ -636,7 +636,10 @@ static void hci_dma_process_ibi(struct i3c_hci *hci, struct hci_rh_data *rh)if (!(ibi_status &IBI_LAST_STATUS )) { ibi_size += chunks * rh->ibi_chunk_sz; }else { - ibi_size +=FIELD_GET (IBI_DATA_LENGTH , ibi_status); +if (chunks) { + ibi_size += (chunks -1 ) * rh->ibi_chunk_sz; + ibi_size +=FIELD_GET (IBI_DATA_LENGTH , ibi_status); + } last_ptr = ptr;break ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 260/508 dev_printk: add new dev_err_probe() helpers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Sa <[email protected]>
[ Upstream commit dbbe7eaf0e4795bf003ac06872aaf52b6b6b1310 ]
This is similar to dev_err_probe() but for cases where an ERR_PTR() or ERR_CAST() is to be returned simplifying patterns like:
dev_err_probe(dev, ret, ...); return ERR_PTR(ret) or dev_err_probe(dev, PTR_ERR(ptr), ...); return ERR_CAST(ptr)
Stable-dep-of: 797cc011ae02 ("backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt()")
--- include/linux/dev_printk.h | 8 ++++++++ 1 file changed, 8 insertions(+)
include/linux/dev_printk.h +8 -0
@@ -277,4 +277,12 @@ do { \ __printf(3, 4) int dev_err_probe(const struct device *dev, int err, const char *fmt, ...); +/* Simple helper for dev_err_probe() when ERR_PTR() is to be returned. */ +#define dev_err_ptr_probe (dev, ___err, fmt, ...) \ + ERR_PTR(dev_err_probe(dev, ___err, fmt, ##__VA_ARGS__)) + +/* Simple helper for dev_err_probe() when ERR_CAST() is to be returned. */ +#define dev_err_cast_probe (dev, ___err_ptr, fmt, ...) \ + ERR_PTR(dev_err_probe(dev, PTR_ERR(___err_ptr), fmt, ##__VA_ARGS__)) +#endif /* _DEVICE_PRINTK_H_ */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 261/508 backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit 797cc011ae02bda26f93d25a4442d7a1a77d84df ]
The devm_gpiod_get_optional() function may return an ERR_PTR in case of genuine GPIO acquisition errors, not just NULL which indicates the legitimate absence of an optional GPIO.
Add an IS_ERR() check after the call in sky81452_bl_parse_dt(). On error, return the error code to ensure proper failure handling rather than proceeding with invalid pointers.
--- drivers/video/backlight/sky81452-backlight.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/video/backlight/sky81452-backlight.c +3 -0
@@ -204,6 +204,9 @@ static struct sky81452_bl_platform_data *sky81452_bl_parse_dt( pdata->dpwm_mode =of_property_read_bool (np,"skyworks,dpwm-mode" ); pdata->phase_shift =of_property_read_bool (np,"skyworks,phase-shift" ); pdata->gpiod_enable =devm_gpiod_get_optional (dev,NULL ,GPIOD_OUT_HIGH ); +if (IS_ERR (pdata->gpiod_enable)) +return dev_err_cast_probe (dev, pdata->gpiod_enable, +"failed to get gpio\n" ); ret =of_property_count_u32_elems (np,"led-sources" );if (ret <0 ) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 262/508 platform/surface: surfacepro3_button: Drop wakeup source on remove
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 1410a228ab2d36fe2b383415a632ae12048d4f3a ]
The wakeup source added by device_init_wakeup() in surface_button_add() needs to be dropped during driver removal, so update the driver to do that.
--- drivers/platform/surface/surfacepro3_button.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/surface/surfacepro3_button.c +1 -0
@@ -243,6 +243,7 @@ static void surface_button_remove(struct acpi_device *device) {struct surface_button *button =acpi_driver_data (device); +device_init_wakeup (&device->dev, false);input_unregister_device (button->input);kfree (button); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 263/508 leds: lgm-sso: Remove duplicate assignments for priv->mmap
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit 7186d0330c3f3e86de577687a82f4ebd96dcb5ac ]
Remove duplicate assignment of priv->mmap in intel_sso_led_probe().
--- drivers/leds/blink/leds-lgm-sso.c | 2 -- 1 file changed, 2 deletions(-)
drivers/leds/blink/leds-lgm-sso.c +0 -2
@@ -806,8 +806,6 @@ static int intel_sso_led_probe(struct platform_device *pdev) priv->fpid_clkrate =clk_get_rate (priv->clocks[1 ].clk); - priv->mmap =syscon_node_to_regmap (dev->of_node); - priv->mmap =syscon_node_to_regmap (dev->of_node);if (IS_ERR (priv->mmap)) {dev_err (dev,"Failed to map iomem!\n" );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 264/508 tty: hvc_iucv: fix off-by-one in number of supported devices
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit f2a880e802ad12d1e38039d1334fb1475d0f5241 ]
MAX_HVC_IUCV_LINES == HVC_ALLOC_TTY_ADAPTERS == 8.
This is the number of entries in:
static struct hvc_iucv_private *hvc_iucv_table[MAX_HVC_IUCV_LINES];
Sometimes hvc_iucv_table[] is limited by:
(a) if (num > hvc_iucv_devices) // for error detection
or
(b) for (i = 0; i < hvc_iucv_devices; i++) // in 2 places
(so these 2 don't agree; second one appears to be correct to me.)
hvc_iucv_devices can be 0..8. This is a counter.
(c) if (hvc_iucv_devices > MAX_HVC_IUCV_LINES)
If hvc_iucv_devices == 8, (a) allows the code to access hvc_iucv_table[8]. Oops.
--- drivers/tty/hvc/hvc_iucv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/hvc/hvc_iucv.c +1 -1
@@ -130,7 +130,7 @@ static struct iucv_handler hvc_iucv_handler = {*/ static struct hvc_iucv_private *hvc_iucv_get_private (uint32_t num) { -if (num > hvc_iucv_devices) +if (num >= hvc_iucv_devices)return NULL ;return hvc_iucv_table[num]; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 265/508 platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 8baeff2c1d33dad8572216c6ad3a7425852507d4 ]
An ACPI notify handler is leaked if device_create_file() returns an error in acpi_pcc_hotkey_add().
Also, it is pointless to call pcc_unregister_optd_notifier() in acpi_pcc_hotkey_remove() if pcc->platform is NULL and it is better to arrange the cleanup code in that function in the same order as the rollback code in acpi_pcc_hotkey_add().
Address the above by placing the pcc_register_optd_notifier() call in acpi_pcc_hotkey_add() after the device_create_file() return value check and placing the pcc_unregister_optd_notifier() call in acpi_pcc_hotkey_remove() right before the device_remove_file() call.
--- drivers/platform/x86/panasonic-laptop.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/platform/x86/panasonic-laptop.c +3 -2
@@ -1081,9 +1081,10 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device) } result =device_create_file (&pcc->platform->dev, &dev_attr_cdpower); -pcc_register_optd_notifier (pcc,"\\_SB.PCI0.EHCI.ERHB.OPTD" );if (result) goto out_platform; + +pcc_register_optd_notifier (pcc,"\\_SB.PCI0.EHCI.ERHB.OPTD" ); }else { pcc->platform =NULL ; }
@@ -1117,10 +1118,10 @@ static void acpi_pcc_hotkey_remove(struct acpi_device *device)i8042_remove_filter (panasonic_i8042_filter);if (pcc->platform) { +pcc_unregister_optd_notifier (pcc,"\\_SB.PCI0.EHCI.ERHB.OPTD" );device_remove_file (&pcc->platform->dev, &dev_attr_cdpower);platform_device_unregister (pcc->platform); } -pcc_unregister_optd_notifier (pcc,"\\_SB.PCI0.EHCI.ERHB.OPTD" );sysfs_remove_group (&device->dev.kobj, &pcc_attr_group);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 266/508 mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit a5a65a7fb2f7796bbe492cd6be59c92cb64377d1 ]
The memory allocated for cell.name using kmemdup() is not freed when mfd_add_devices() fails. Fix that by using devm_kmemdup().
--- drivers/mfd/mc13xxx-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mfd/mc13xxx-core.c +1 -1
@@ -377,7 +377,7 @@ static int mc13xxx_add_subdevice_pdata(struct mc13xxx *mc13xxx,if (snprintf (buf,sizeof (buf), format, name) >sizeof (buf))return -E2BIG ; - cell.name =kmemdup (buf,strlen (buf) +1 ,GFP_KERNEL ); + cell.name =devm_kmemdup (mc13xxx->dev, buf,strlen (buf) +1 ,GFP_KERNEL );if (!cell.name)return -ENOMEM ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 267/508 nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit f83c8dda456ce4863f346aa26d88efa276eda35d ]
Clang compiler is not happy about set but unused variable (when dprintk() is no-op):
.../blocklayout/blocklayout.c:384:9: error: variable 'count' set but not used [-Werror,-Wunused-but-set-variable]
Remove a leftover from the previous cleanup.
--- fs/nfs/blocklayout/blocklayout.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
fs/nfs/blocklayout/blocklayout.c +1 -3
@@ -381,14 +381,13 @@ bl_write_pagelist(struct nfs_pgio_header *header, int sync)sector_t isect, extent_length =0 ;struct parallel_io *par =NULL ;loff_t offset = header->args.offset; -size_t count = header->args.count;struct page **pages = header->args.pages;int pg_index = header->args.pgbase >>PAGE_SHIFT ;unsigned int pg_len;struct blk_plug plug;int i; -dprintk ("%s enter, %zu@%lld\n" , __func__, count, offset); +dprintk ("%s enter, %u@%lld\n" , __func__, header->args.count, offset);/* At this point, header->page_aray is a (sequential) list of nfs_pages. * We want to write each, and if there is an error set pnfs_error
@@ -429,7 +428,6 @@ bl_write_pagelist(struct nfs_pgio_header *header, int sync) } offset += pg_len; - count -= pg_len; isect += (pg_len >>SECTOR_SHIFT ); extent_length -= (pg_len >>SECTOR_SHIFT ); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 268/508 fs/ntfs3: terminate the cached volume label after UTF-8 conversion
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit a6cd43fe9b083fa23fe1595666d5738856cb261a ]
ntfs_fill_super() loads the on-disk volume label with utf16s_to_utf8s() and stores the result in sbi->volume.label. The converted label is later exposed through ntfs3_label_show() using %s, but utf16s_to_utf8s() only returns the number of bytes written and does not add a trailing NUL.
If the converted label fills the entire fixed buffer, ntfs3_label_show() can read past the end of sbi->volume.label while looking for a terminator.
Terminate the cached label explicitly after a successful conversion and clamp the exact-full case to the last byte of the buffer.
--- fs/ntfs3/super.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/ntfs3/super.c +6 -1
@@ -1228,8 +1228,13 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)le32_to_cpu (attr->res.data_size) >>1 ,UTF16_LITTLE_ENDIAN , sbi->volume.label, sizeof(sbi->volume.label)); -if (err <0 ) +if (err <0 ) { sbi->volume.label[0 ] =0 ; + }else if (err >=sizeof (sbi->volume.label)) { + sbi->volume.label[sizeof (sbi->volume.label) -1 ] =0 ; + }else { + sbi->volume.label[err] =0 ; + } }else {/* Should we break mounting here? */ //err = -EINVAL;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 269/508 platform/x86: dell_rbu: avoid uninit value usage in packet_size_write()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
[ Upstream commit f8fd138c2363c0e2d3235c32bfb4fb5c6474e4ae ]
Ensure the temp value has been properly parsed from the user-provided buffer and initialized to be used in later operations. While at it, prefer a convenient kstrtoul() helper.
Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool.
--- drivers/platform/x86/dell/dell_rbu.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/platform/x86/dell/dell_rbu.c +5 -1
@@ -30,6 +30,7 @@#define pr_fmt (fmt) KBUILD_MODNAME ": " fmt#include <linux/init.h> +#include <linux/kstrtox.h> #include <linux/module.h> #include <linux/slab.h> #include <linux/string.h>
@@ -617,9 +618,12 @@ static ssize_t packet_size_write(struct file *filp, struct kobject *kobj, char *buffer, loff_t pos, size_t count) { unsigned long temp; + +if (kstrtoul (buffer,10 , &temp)) +return -EINVAL ; +spin_lock (&rbu_data.lock);packet_empty_list (); -sscanf (buffer,"%lu" , &temp);if (temp <0xffffffff ) rbu_data.packetsize = temp;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 270/508 platform/x86: dell-wmi-sysman: bound enumeration string aggregation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 3c34471c26abc52a37f5ad90949e2e4b8027eb14 ]
populate_enum_data() aggregates firmware-provided value-modifier and possible-value strings into fixed 512-byte struct members. The current code bounds each individual source string but then appends every string and separator with raw strcat() and no remaining-space check.
Switch the aggregation loops to a bounded append helper and reject enumeration packages whose combined strings do not fit in the destination buffers.
--- .../dell/dell-wmi-sysman/enum-attributes.c | 34 +++++++++++++++---- 1 file changed, 28 insertions(+), 6 deletions(-)
drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c +28 -6
@@ -6,10 +6,32 @@* Copyright (c) 2020 Dell Inc. */ +#include <linux/bug.h> +#include "dell-wmi-sysman.h" get_instance_id (enumeration); +static int append_enum_string (char *dest,const char *src) +{ +size_t dest_len =strlen (dest); +ssize_t copied; + +if (WARN_ON_ONCE (dest_len >=MAX_BUFF )) +return -EINVAL ; + + copied =strscpy (dest + dest_len, src,MAX_BUFF - dest_len); +if (copied <0 ) +return -EINVAL ; + + dest_len += copied; + copied =strscpy (dest + dest_len,";" ,MAX_BUFF - dest_len); +if (copied <0 ) +return -EINVAL ; + +return 0 ; +} +static ssize_t current_value_show (struct kobject *kobj,struct kobj_attribute *attr,char *buf) {int instance_id =get_enumeration_instance_id (kobj);
@@ -176,9 +198,9 @@ int populate_enum_data(union acpi_object *enumeration_obj, int instance_id,return -EINVAL ;if (check_property_type (enumeration, next_obj,ACPI_TYPE_STRING ))return -EINVAL ; -strcat (wmi_priv.enumeration_data[instance_id].dell_value_modifier, - enumeration_obj[next_obj++].string.pointer); -strcat (wmi_priv.enumeration_data[instance_id].dell_value_modifier,";" ); +if (append_enum_string (wmi_priv.enumeration_data[instance_id].dell_value_modifier, + enumeration_obj[next_obj++].string.pointer)) +return -EINVAL ; }if (next_obj >= enum_property_count)
@@ -193,9 +215,9 @@ int populate_enum_data(union acpi_object *enumeration_obj, int instance_id,return -EINVAL ;if (check_property_type (enumeration, next_obj,ACPI_TYPE_STRING ))return -EINVAL ; -strcat (wmi_priv.enumeration_data[instance_id].possible_values, - enumeration_obj[next_obj++].string.pointer); -strcat (wmi_priv.enumeration_data[instance_id].possible_values,";" ); +if (append_enum_string (wmi_priv.enumeration_data[instance_id].possible_values, + enumeration_obj[next_obj++].string.pointer)) +return -EINVAL ; }return sysfs_create_group (attr_name_kobj, &enumeration_attr_group);
Signature · 1 line
2.53.0