6.12.91-rc1 review
Subsystems (7)
Greg Kroah-Hartman
maintainerPATCH 218/666 crypto: qat - introduce fuse array
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suman Kumar Chakraborty <[email protected]>
[ Upstream commit f3bda3b9b69cb193968ba781446ff18c734f0276 ]
Change the representation of fuses in the accelerator device structure from a single value to an array.
This allows the structure to accommodate additional fuses that are required for future generations of QAT hardware.
This does not introduce any functional changes.
Stable-dep-of: b260d53561dd ("crypto: qat - disable 4xxx AE cluster when lead engine is fused off")
--- .../crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c | 2 +- drivers/crypto/intel/qat/qat_420xx/adf_drv.c | 2 +- drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 2 +- drivers/crypto/intel/qat/qat_4xxx/adf_drv.c | 2 +- .../crypto/intel/qat/qat_c3xxx/adf_c3xxx_hw_data.c | 4 ++-- drivers/crypto/intel/qat/qat_c3xxx/adf_drv.c | 2 +- drivers/crypto/intel/qat/qat_c62x/adf_c62x_hw_data.c | 4 ++-- drivers/crypto/intel/qat/qat_c62x/adf_drv.c | 4 ++-- .../crypto/intel/qat/qat_common/adf_accel_devices.h | 12 +++++++++++- .../crypto/intel/qat/qat_common/adf_gen2_hw_data.c | 2 +- .../intel/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c | 6 +++--- drivers/crypto/intel/qat/qat_dh895xcc/adf_drv.c | 2 +- 12 files changed, 27 insertions(+), 17 deletions(-)
drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c +1 -1
@@ -98,7 +98,7 @@ static struct adf_hw_device_class adf_420xx_class = {static u32 get_ae_mask (struct adf_hw_device_data *self) { -u32 me_disable = self->fuses; +u32 me_disable = self->fuses[ADF_FUSECTL4 ];return ~me_disable &ADF_420XX_ACCELENGINES_MASK ; }
drivers/crypto/intel/qat/qat_420xx/adf_drv.c +1 -1
@@ -79,7 +79,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)adf_init_hw_data_420xx (accel_dev->hw_device, ent->device);pci_read_config_byte (pdev,PCI_REVISION_ID , &accel_pci_dev->revid); -pci_read_config_dword (pdev,ADF_GEN4_FUSECTL4_OFFSET , &hw_data->fuses); +pci_read_config_dword (pdev,ADF_GEN4_FUSECTL4_OFFSET , &hw_data->fuses[ADF_FUSECTL4 ]);/* Get Accelerators and Accelerators Engines masks */ hw_data->accel_mask = hw_data->get_accel_mask (hw_data);
drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c +1 -1
@@ -101,7 +101,7 @@ static struct adf_hw_device_class adf_4xxx_class = {static u32 get_ae_mask (struct adf_hw_device_data *self) { -u32 me_disable = self->fuses; +u32 me_disable = self->fuses[ADF_FUSECTL4 ];return ~me_disable &ADF_4XXX_ACCELENGINES_MASK ; }
drivers/crypto/intel/qat/qat_4xxx/adf_drv.c +1 -1
@@ -81,7 +81,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)adf_init_hw_data_4xxx (accel_dev->hw_device, ent->device);pci_read_config_byte (pdev,PCI_REVISION_ID , &accel_pci_dev->revid); -pci_read_config_dword (pdev,ADF_GEN4_FUSECTL4_OFFSET , &hw_data->fuses); +pci_read_config_dword (pdev,ADF_GEN4_FUSECTL4_OFFSET , &hw_data->fuses[ADF_FUSECTL4 ]);/* Get Accelerators and Accelerators Engines masks */ hw_data->accel_mask = hw_data->get_accel_mask (hw_data);
drivers/crypto/intel/qat/qat_c3xxx/adf_c3xxx_hw_data.c +2 -2
@@ -27,8 +27,8 @@ static struct adf_hw_device_class c3xxx_class = {static u32 get_accel_mask (struct adf_hw_device_data *self) { +u32 fuses = self->fuses[ADF_FUSECTL0 ];u32 straps = self->straps; -u32 fuses = self->fuses;u32 accel; accel = ~(fuses | straps) >>ADF_C3XXX_ACCELERATORS_REG_OFFSET ;
@@ -39,8 +39,8 @@ static u32 get_accel_mask(struct adf_hw_device_data *self)static u32 get_ae_mask (struct adf_hw_device_data *self) { +u32 fuses = self->fuses[ADF_FUSECTL0 ];u32 straps = self->straps; -u32 fuses = self->fuses;unsigned long disabled;u32 ae_disable;int accel;
drivers/crypto/intel/qat/qat_c3xxx/adf_drv.c +1 -1
@@ -134,7 +134,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)adf_init_hw_data_c3xxx (accel_dev->hw_device);pci_read_config_byte (pdev,PCI_REVISION_ID , &accel_pci_dev->revid);pci_read_config_dword (pdev,ADF_DEVICE_FUSECTL_OFFSET , - &hw_data->fuses); + &hw_data->fuses[ADF_FUSECTL0 ]);pci_read_config_dword (pdev,ADF_C3XXX_SOFTSTRAP_CSR_OFFSET , &hw_data->straps);
drivers/crypto/intel/qat/qat_c62x/adf_c62x_hw_data.c +2 -2
@@ -27,8 +27,8 @@ static struct adf_hw_device_class c62x_class = {static u32 get_accel_mask (struct adf_hw_device_data *self) { +u32 fuses = self->fuses[ADF_FUSECTL0 ];u32 straps = self->straps; -u32 fuses = self->fuses;u32 accel; accel = ~(fuses | straps) >>ADF_C62X_ACCELERATORS_REG_OFFSET ;
@@ -39,8 +39,8 @@ static u32 get_accel_mask(struct adf_hw_device_data *self)static u32 get_ae_mask (struct adf_hw_device_data *self) { +u32 fuses = self->fuses[ADF_FUSECTL0 ];u32 straps = self->straps; -u32 fuses = self->fuses;unsigned long disabled;u32 ae_disable;int accel;
drivers/crypto/intel/qat/qat_c62x/adf_drv.c +2 -2
@@ -134,7 +134,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)adf_init_hw_data_c62x (accel_dev->hw_device);pci_read_config_byte (pdev,PCI_REVISION_ID , &accel_pci_dev->revid);pci_read_config_dword (pdev,ADF_DEVICE_FUSECTL_OFFSET , - &hw_data->fuses); + &hw_data->fuses[ADF_FUSECTL0 ]);pci_read_config_dword (pdev,ADF_C62X_SOFTSTRAP_CSR_OFFSET , &hw_data->straps);
@@ -177,7 +177,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) hw_data->accel_capabilities_mask = hw_data->get_accel_cap (accel_dev);/* Find and map all the device's BARS */ - i = (hw_data->fuses &ADF_DEVICE_FUSECTL_MASK ) ?1 :0 ; + i = (hw_data->fuses[ADF_FUSECTL0 ] &ADF_DEVICE_FUSECTL_MASK ) ?1 :0 ; bar_mask =pci_select_bars (pdev,IORESOURCE_MEM );for_each_set_bit (bar_nr, &bar_mask,ADF_PCI_MAX_BARS *2 ) {struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
drivers/crypto/intel/qat/qat_common/adf_accel_devices.h +11 -1
@@ -52,6 +52,16 @@ enum adf_accel_capabilities {ADF_ACCEL_CAPABILITIES_RANDOM_NUMBER =128 }; +enum adf_fuses { +ADF_FUSECTL0 , +ADF_FUSECTL1 , +ADF_FUSECTL2 , +ADF_FUSECTL3 , +ADF_FUSECTL4 , +ADF_FUSECTL5 , +ADF_MAX_FUSES +}; +struct adf_bar {resource_size_t base_addr;void __iomem *virt_addr;
@@ -343,7 +353,7 @@ struct adf_hw_device_data {struct qat_migdev_ops vfmig_ops;const char *fw_name;const char *fw_mmp_name; -u32 fuses; +u32 fuses[ADF_MAX_FUSES ];u32 straps;u32 accel_capabilities_mask;u32 extended_dc_capabilities;
drivers/crypto/intel/qat/qat_common/adf_gen2_hw_data.c +1 -1
@@ -115,8 +115,8 @@ u32 adf_gen2_get_accel_cap(struct adf_accel_dev *accel_dev) {struct adf_hw_device_data *hw_data = accel_dev->hw_device;struct pci_dev *pdev = accel_dev->accel_pci_dev.pci_dev; +u32 fuses = hw_data->fuses[ADF_FUSECTL0 ];u32 straps = hw_data->straps; -u32 fuses = hw_data->fuses;u32 legfuses;u32 capabilities =ICP_ACCEL_CAPABILITIES_CRYPTO_SYMMETRIC | ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC |
drivers/crypto/intel/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c +3 -3
@@ -29,7 +29,7 @@ static struct adf_hw_device_class dh895xcc_class = {static u32 get_accel_mask (struct adf_hw_device_data *self) { -u32 fuses = self->fuses; +u32 fuses = self->fuses[ADF_FUSECTL0 ];return ~fuses >>ADF_DH895XCC_ACCELERATORS_REG_OFFSET &ADF_DH895XCC_ACCELERATORS_MASK ;
@@ -37,7 +37,7 @@ static u32 get_accel_mask(struct adf_hw_device_data *self)static u32 get_ae_mask (struct adf_hw_device_data *self) { -u32 fuses = self->fuses; +u32 fuses = self->fuses[ADF_FUSECTL0 ];return ~fuses &ADF_DH895XCC_ACCELENGINES_MASK ; }
@@ -99,7 +99,7 @@ static u32 get_accel_cap(struct adf_accel_dev *accel_dev)static enum dev_sku_info get_sku (struct adf_hw_device_data *self) { -int sku = (self->fuses &ADF_DH895XCC_FUSECTL_SKU_MASK ) +int sku = (self->fuses[ADF_FUSECTL0 ] &ADF_DH895XCC_FUSECTL_SKU_MASK ) >>ADF_DH895XCC_FUSECTL_SKU_SHIFT ;switch (sku) {
drivers/crypto/intel/qat/qat_dh895xcc/adf_drv.c +1 -1
@@ -134,7 +134,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)adf_init_hw_data_dh895xcc (accel_dev->hw_device);pci_read_config_byte (pdev,PCI_REVISION_ID , &accel_pci_dev->revid);pci_read_config_dword (pdev,ADF_DEVICE_FUSECTL_OFFSET , - &hw_data->fuses); + &hw_data->fuses[ADF_FUSECTL0 ]);/* Get Accelerators and Accelerators Engines masks */ hw_data->accel_mask = hw_data->get_accel_mask (hw_data);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 219/666 crypto: qat - disable 4xxx AE cluster when lead engine is fused off
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahsan Atta <[email protected]>
[ Upstream commit b260d53561dd69b29505222ec44cf386ac2c2ca6 ]
The get_ae_mask() function only disables individual engines based on the fuse register, but engines are organized in clusters of 4. If the lead engine of a cluster is fused off, the entire cluster must be disabled.
Replace the single bitmask inversion with explicit test_bit() checks on the lead engine of each group, disabling the full ADF_AE_GROUP when the lead bit is set.
--- .../crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c +12 -2
@@ -101,9 +101,19 @@ static struct adf_hw_device_class adf_4xxx_class = {static u32 get_ae_mask (struct adf_hw_device_data *self) { -u32 me_disable = self->fuses[ADF_FUSECTL4 ]; +unsigned long fuses = self->fuses[ADF_FUSECTL4 ]; +u32 mask =ADF_4XXX_ACCELENGINES_MASK ; -return ~me_disable &ADF_4XXX_ACCELENGINES_MASK ; +if (test_bit (0 , &fuses)) + mask &= ~ADF_AE_GROUP_0 ; + +if (test_bit (4 , &fuses)) + mask &= ~ADF_AE_GROUP_1 ; + +if (test_bit (8 , &fuses)) + mask &= ~ADF_AE_GROUP_2 ; + +return mask; }static u32 get_accel_cap (struct adf_accel_dev *accel_dev)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 220/666 crypto: qat - disable 420xx AE cluster when lead engine is fused off
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahsan Atta <[email protected]>
[ Upstream commit f216e0f2d1787e662bb6662c9c522185aa3b855a ]
The get_ae_mask() function only disables individual engines based on the fuse register, but engines are organized in clusters of 4. If the lead engine of a cluster is fused off, the entire cluster must be disabled.
Replace the single bitmask inversion with explicit test_bit() checks on the lead engine of each group, disabling the full ADF_AE_GROUP when the lead bit is set.
--- .../intel/qat/qat_420xx/adf_420xx_hw_data.c | 20 +++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-)
drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c +18 -2
@@ -98,9 +98,25 @@ static struct adf_hw_device_class adf_420xx_class = {static u32 get_ae_mask (struct adf_hw_device_data *self) { -u32 me_disable = self->fuses[ADF_FUSECTL4 ]; +unsigned long fuses = self->fuses[ADF_FUSECTL4 ]; +u32 mask =ADF_420XX_ACCELENGINES_MASK ; -return ~me_disable &ADF_420XX_ACCELENGINES_MASK ; +if (test_bit (0 , &fuses)) + mask &= ~ADF_AE_GROUP_0 ; + +if (test_bit (4 , &fuses)) + mask &= ~ADF_AE_GROUP_1 ; + +if (test_bit (8 , &fuses)) + mask &= ~ADF_AE_GROUP_2 ; + +if (test_bit (12 , &fuses)) + mask &= ~ADF_AE_GROUP_3 ; + +if (test_bit (16 , &fuses)) + mask &= ~ADF_AE_GROUP_4 ; + +return mask; }static u32 uof_get_num_objs (struct adf_accel_dev *accel_dev)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 221/666 crypto: qat - fix type mismatch in RAS sysfs show functions
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giovanni Cabiddu <[email protected]>
[ Upstream commit ec23d75c4b77ae42af0777ea59599b1d4f611371 ]
ADF_RAS_ERR_CTR_READ() expands to atomic_read(), which returns int. The local variable 'counter' was declared as 'unsigned long', causing a type mismatch on the assignment. The format specifier '%ld' was consequently wrong in two ways: wrong length modifier and wrong signedness.
Use int to match the return type of atomic_read() and update the format specifier to '%d' accordingly.
--- .../intel/qat/qat_common/adf_sysfs_ras_counters.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/crypto/intel/qat/qat_common/adf_sysfs_ras_counters.c +6 -6
@@ -13,14 +13,14 @@ static ssize_t errors_correctable_show(struct device *dev, char *buf) {struct adf_accel_dev *accel_dev; -unsigned long counter; +int counter; accel_dev =adf_devmgr_pci_to_accel_dev (to_pci_dev (dev));if (!accel_dev)return -EINVAL ; counter =ADF_RAS_ERR_CTR_READ (accel_dev->ras_errors,ADF_RAS_CORR ); -return scnprintf (buf,PAGE_SIZE ,"%ld\n" , counter); +return scnprintf (buf,PAGE_SIZE ,"%d\n" , counter); } static ssize_t errors_nonfatal_show(struct device *dev,
@@ -28,14 +28,14 @@ static ssize_t errors_nonfatal_show(struct device *dev, char *buf) {struct adf_accel_dev *accel_dev; -unsigned long counter; +int counter; accel_dev =adf_devmgr_pci_to_accel_dev (to_pci_dev (dev));if (!accel_dev)return -EINVAL ; counter =ADF_RAS_ERR_CTR_READ (accel_dev->ras_errors,ADF_RAS_UNCORR ); -return scnprintf (buf,PAGE_SIZE ,"%ld\n" , counter); +return scnprintf (buf,PAGE_SIZE ,"%d\n" , counter); } static ssize_t errors_fatal_show(struct device *dev,
@@ -43,14 +43,14 @@ static ssize_t errors_fatal_show(struct device *dev, char *buf) {struct adf_accel_dev *accel_dev; -unsigned long counter; +int counter; accel_dev =adf_devmgr_pci_to_accel_dev (to_pci_dev (dev));if (!accel_dev)return -EINVAL ; counter =ADF_RAS_ERR_CTR_READ (accel_dev->ras_errors,ADF_RAS_FATAL ); -return scnprintf (buf,PAGE_SIZE ,"%ld\n" , counter); +return scnprintf (buf,PAGE_SIZE ,"%d\n" , counter); } static ssize_t reset_error_counters_store(struct device *dev,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 222/666 crypto: qat - use swab32 macro
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giovanni Cabiddu <[email protected]>
[ Upstream commit 35ecb77ae0749a2f1b04872c9978d9d7ddbbeb79 ]
Replace __builtin_bswap32() with swab32 in icp_qat_hw_20_comp.h to fix the following build errors on architectures without native byte-swap support:
alpha-linux-ld: drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.o: in function `adf_gen4_build_decomp_block':
drivers/crypto/intel/qat/qat_common/icp_qat_hw_20_comp.h:141:(.text+0xeec): undefined reference to `__bswapsi2'
alpha-linux-ld: drivers/crypto/intel/qat/qat_common/icp_qat_hw_20_comp.h:141:(.text+0xef8): undefined reference to `__bswapsi2'
alpha-linux-ld: drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.o: in function `adf_gen4_build_comp_block':
drivers/crypto/intel/qat/qat_common/icp_qat_hw_20_comp.h:57:(.text+0xf64): undefined reference to `__bswapsi2'
alpha-linux-ld: drivers/crypto/intel/qat/qat_common/icp_qat_hw_20_comp.h:57:(.text+0xf7c): undefined reference to `__bswapsi2'
--- .../crypto/intel/qat/qat_common/icp_qat_hw_20_comp.h | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/crypto/intel/qat/qat_common/icp_qat_hw_20_comp.h +6 -4
@@ -3,6 +3,8 @@#ifndef _ICP_QAT_HW_20_COMP_H_#define _ICP_QAT_HW_20_COMP_H_ +#include <linux/swab.h> +#include "icp_qat_hw_20_comp_defs.h" #include "icp_qat_fw.h"
@@ -54,7 +56,7 @@ ICP_QAT_FW_COMP_20_BUILD_CONFIG_LOWER(struct icp_qat_hw_comp_20_config_csr_lowerQAT_FIELD_SET (val32, csr.abd,ICP_QAT_HW_COMP_20_CONFIG_CSR_ABD_BITPOS ,ICP_QAT_HW_COMP_20_CONFIG_CSR_ABD_MASK ); -return __builtin_bswap32 (val32); +return swab32 (val32); }struct icp_qat_hw_comp_20_config_csr_upper {
@@ -106,7 +108,7 @@ ICP_QAT_FW_COMP_20_BUILD_CONFIG_UPPER(struct icp_qat_hw_comp_20_config_csr_upperICP_QAT_HW_COMP_20_CONFIG_CSR_NICE_PARAM_BITPOS , ICP_QAT_HW_COMP_20_CONFIG_CSR_NICE_PARAM_MASK); -return __builtin_bswap32 (val32); +return swab32 (val32); }struct icp_qat_hw_decomp_20_config_csr_lower {
@@ -138,7 +140,7 @@ ICP_QAT_FW_DECOMP_20_BUILD_CONFIG_LOWER(struct icp_qat_hw_decomp_20_config_csr_lICP_QAT_HW_DECOMP_20_CONFIG_CSR_LZ4_BLOCK_CHECKSUM_PRESENT_BITPOS , ICP_QAT_HW_DECOMP_20_CONFIG_CSR_LZ4_BLOCK_CHECKSUM_PRESENT_MASK); -return __builtin_bswap32 (val32); +return swab32 (val32); }struct icp_qat_hw_decomp_20_config_csr_upper {
@@ -158,7 +160,7 @@ ICP_QAT_FW_DECOMP_20_BUILD_CONFIG_UPPER(struct icp_qat_hw_decomp_20_config_csr_uICP_QAT_HW_DECOMP_20_CONFIG_CSR_MINI_CAM_CONTROL_BITPOS , ICP_QAT_HW_DECOMP_20_CONFIG_CSR_MINI_CAM_CONTROL_MASK); - return __builtin_bswap32(val32); + return swab32(val32); }#endif
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 223/666 ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Rastyogin <[email protected]>
[ Upstream commit f9e437cddf6cf9e603bdaefe148c1f4792aaf39c ]
component_dais[RSND_MAX_COMPONENT] is initially zero-initialized and later populated in rsnd_dai_of_node(). However, the existing boundary check:
if (i >= RSND_MAX_COMPONENT)
does not guarantee that the last valid element remains zero. As a result, the loop can rely on component_dais[RSND_MAX_COMPONENT] being zero, which may lead to an out-of-bounds access.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- sound/soc/sh/rcar/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/sh/rcar/core.c +1 -1
@@ -1978,7 +1978,7 @@ static int rsnd_probe(struct platform_device *pdev)* asoc register */ ci =0 ; -for (i =0 ; priv->component_dais[i] >0 ; i++) { +for (i =0 ; i <RSND_MAX_COMPONENT && priv->component_dais[i] >0 ; i++) {int nr = priv->component_dais[i]; ret = devm_snd_soc_register_component(dev, &rsnd_soc_component,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 224/666 PCI: Enable AtomicOps only if Root Port supports them
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerd Bayer <[email protected]>
[ Upstream commit 1ae8c4ce157037e266184064a182af9ef9af278b ]
When inspecting the config space of a Connect-X physical function in an s390 system after it was initialized by the mlx5_core device driver, we found the function to be enabled to request AtomicOps despite the Root Port lacking support for completing them:
00:00.1 Ethernet controller: Mellanox Technologies MT2894 Family [ConnectX-6 Lx]
Subsystem: Mellanox Technologies Device 0002
DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis-
AtomicOpsCtl: ReqEn+
On s390 and many virtualized guests, the Endpoint is visible but the Root Port is not. In this case, pci_enable_atomic_ops_to_root() previously enabled AtomicOps in the Endpoint even though it can't tell whether the Root Port supports them as a completer.
Change pci_enable_atomic_ops_to_root() to fail if there's no Root Port or the Root Port doesn't support AtomicOps.
--- drivers/pci/pci.c | 41 ++++++++++++++++++++--------------------- 1 file changed, 20 insertions(+), 21 deletions(-)
drivers/pci/pci.c +20 -21
@@ -3850,8 +3850,7 @@ int pci_rebar_set_size(struct pci_dev *pdev, int bar, int size)*/ int pci_enable_atomic_ops_to_root (struct pci_dev *dev,u32 cap_mask) { -struct pci_bus *bus = dev->bus; -struct pci_dev *bridge; +struct pci_dev *root, *bridge;u32 cap, ctl2;/*
@@ -3881,35 +3880,35 @@ int pci_enable_atomic_ops_to_root(struct pci_dev *dev, u32 cap_mask)return -EINVAL ; } -while (bus->parent) { - bridge = bus->self; + root =pcie_find_root_port (dev); +if (!root) +return -EINVAL ; -pcie_capability_read_dword (bridge,PCI_EXP_DEVCAP2 , &cap); +pcie_capability_read_dword (root,PCI_EXP_DEVCAP2 , &cap); +if ((cap & cap_mask) != cap_mask) +return -EINVAL ; + bridge =pci_upstream_bridge (dev); +while (bridge != root) {switch (pci_pcie_type (bridge)) { -/* Ensure switch ports support AtomicOp routing */ case PCI_EXP_TYPE_UPSTREAM : -case PCI_EXP_TYPE_DOWNSTREAM : -if (!(cap &PCI_EXP_DEVCAP2_ATOMIC_ROUTE )) -return -EINVAL ; -break ; - -/* Ensure root port supports all the sizes we care about */ -case PCI_EXP_TYPE_ROOT_PORT : -if ((cap & cap_mask) != cap_mask) -return -EINVAL ; -break ; - } - -/* Ensure upstream ports don't block AtomicOps on egress */ -if (pci_pcie_type (bridge) ==PCI_EXP_TYPE_UPSTREAM ) { +/* Upstream ports must not block AtomicOps on egress */ pcie_capability_read_dword (bridge,PCI_EXP_DEVCTL2 , &ctl2);if (ctl2 &PCI_EXP_DEVCTL2_ATOMIC_EGRESS_BLOCK )return -EINVAL ; + fallthrough; + +/* All switch ports need to route AtomicOps */ +case PCI_EXP_TYPE_DOWNSTREAM : +pcie_capability_read_dword (bridge,PCI_EXP_DEVCAP2 , + &cap); +if (!(cap &PCI_EXP_DEVCAP2_ATOMIC_ROUTE )) +return -EINVAL ; +break ; } - bus = bus->parent; + bridge =pci_upstream_bridge (bridge); } pcie_capability_set_word(dev, PCI_EXP_DEVCTL2,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 225/666 PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 5573c44cb3fd01a9f62d569ae9ac870ef5f0e0ba ]
In mtk_pcie_setup_irq(), the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the function directly returns an error, without cleaning up the allocated domains.
Hence, reverse the order so that the IRQ domains are allocated after the controller's IRQ is found.
This was flagged by Sashiko during a review of "[PATCH v6 0/7] PCI:
mediatek-gen3: add power control support".
--- drivers/pci/controller/pcie-mediatek-gen3.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/pci/controller/pcie-mediatek-gen3.c +4 -4
@@ -794,14 +794,14 @@ static int mtk_pcie_setup_irq(struct mtk_gen3_pcie *pcie)struct platform_device *pdev =to_platform_device (dev);int err; - err =mtk_pcie_init_irq_domains (pcie); -if (err) -return err; - pcie->irq =platform_get_irq (pdev,0 );if (pcie->irq <0 )return pcie->irq; + err =mtk_pcie_init_irq_domains (pcie); +if (err) +return err; +irq_set_chained_handler_and_data (pcie->irq, mtk_pcie_irq_handler, pcie);return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 226/666 selftests/mm: skip migration tests if NUMA is unavailable
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: AnishMulay <[email protected]>
[ Upstream commit 54218f10dfbe88c8e41c744fd45a756cde60b8c4 ]
Currently, the migration test asserts that numa_available() returns 0. On systems where NUMA is not available (returning -1), such as certain ARM64 configurations or single-node systems, this assertion fails and crashes the test.
Update the test to check the return value of numa_available(). If it is less than 0, skip the test gracefully instead of failing.
This aligns the behavior with other MM selftests (like rmap) that skip when NUMA support is missing.
--- tools/testing/selftests/mm/migration.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/mm/migration.c +2 -1
@@ -33,7 +33,8 @@ FIXTURE_SETUP(migration) {int n; -ASSERT_EQ (numa_available (),0 ); +if (numa_available () <0 ) +SKIP (return,"NUMA not available" ); self->nthreads =numa_num_task_cpus () -1 ; self->n1 =-1 ; self->n2 =-1 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 227/666 Documentation: fix a hugetlbfs reservation statement
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jane Chu <[email protected]>
[ Upstream commit 7a197d346a44384a1a858a98ef03766840e561d4 ]
Documentation/mm/hugetlbfs_reserv.rst has
if (resv_needed <= (resv_huge_pages - free_huge_pages))
resv_huge_pages += resv_needed;
which describes this code in gather_surplus_pages()
needed = (h->resv_huge_pages + delta) - h->free_huge_pages;
if (needed <= 0) {
h->resv_huge_pages += delta;
return 0;
}which means if there are enough free hugepages to account for the new reservation, simply update the global reservation count without further action.
But the description is backwards, it should be
if (resv_needed <= (free_huge_pages - resv_huge_pages))
instead.
--- Documentation/mm/hugetlbfs_reserv.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/mm/hugetlbfs_reserv.rst +1 -1
@@ -155,7 +155,7 @@ are enough free huge pages to accommodate the reservation. If there are, the global reservation count resv_huge_pages is adjusted something like the following:: - if (resv_needed <= (resv_huge_pages - free_huge_pages)) + if (resv_needed <= (free_huge_pages - resv_huge_pages) resv_huge_pages += resv_needed; Note that the global lock hugetlb_lock is held when checking and adjusting
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 228/666 selftest: memcg: skip memcg_sock test if address family not supported
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Waiman Long <[email protected]>
[ Upstream commit 2d028f3e4bbbfd448928a8d3d2814b0b04c214f4 ]
The test_memcg_sock test in memcontrol.c sets up an IPv6 socket and send data over it to consume memory and verify that memory.stat.sock and memory.current values are close.
On systems where IPv6 isn't enabled or not configured to support SOCK_STREAM, the test_memcg_sock test always fails. When the socket() call fails, there is no way we can test the memory consumption and verify the above claim. I believe it is better to just skip the test in this case instead of reporting a test failure hinting that there may be something wrong with the memcg code.
--- tools/testing/selftests/cgroup/test_memcontrol.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
tools/testing/selftests/cgroup/test_memcontrol.c +10 -1
@@ -1190,8 +1190,11 @@ static int tcp_server(const char *cgroup, void *arg) saddr.sin6_port =htons (srv_args->port); sk =socket (AF_INET6 ,SOCK_STREAM ,0 ); -if (sk <0 ) +if (sk <0 ) { +/* Pass back errno to the ctl_fd */ +write (ctl_fd, &errno,sizeof (errno));return ret; + }if (setsockopt (sk,SOL_SOCKET ,SO_REUSEADDR , &yes,sizeof (yes)) <0 ) goto cleanup;
@@ -1321,6 +1324,12 @@ static int test_memcg_sock(const char *root) goto cleanup;close (args.ctl[0 ]); +/* Skip if address family not supported by protocol */ +if (err ==EAFNOSUPPORT ) { + ret =KSFT_SKIP ; + goto cleanup; + } +if (!err)break ;if (err !=EADDRINUSE )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 229/666 ALSA: scarlett2: Add missing sentinel initializer field
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Panagiotis Petrakopoulos <[email protected]>
[ Upstream commit 2428cd6e8b6fa80c36db4652702ca0acd2ce3f08 ]
A "-Wmissing-field-initializers" warning was emitted when compiling the module using the W=2 option. There is a sentinel initializer field missing in the end of scarlett2_devices[]. Tested using a Scarlett Solo 4th gen.
--- sound/usb/mixer_scarlett2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/mixer_scarlett2.c +1 -1
@@ -2221,7 +2221,7 @@ static const struct scarlett2_device_entry scarlett2_devices[] = { { USB_ID(0x1235, 0x820c), &clarett_8pre_info, "Clarett+" },/* End of list */ - { 0, NULL }, + { 0, NULL, NULL }, };/* get the starting port index number for a given port type/direction */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 230/666 ASoC: SOF: compress: return the configured codec from get_params
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
[ Upstream commit 2c4fdd055f92a2fc8602dcd88bcea08c374b7e8b ]
The SOF compressed offload path accepts codec parameters in sof_compr_set_params() and forwards them to firmware as extended data in the SOF IPC stream params message.
However, sof_compr_get_params() still returns success without filling the snd_codec structure. Since the compress core allocates that structure zeroed and copies it back to userspace on success, SNDRV_COMPRESS_GET_PARAMS returns an all-zero codec description even after the stream has been configured successfully.
The stale TODO in this callback conflates get_params() with capability discovery. Supported codec enumeration belongs in get_caps() and get_codec_caps(). get_params() should report the current codec settings.
Cache the codec accepted by sof_compr_set_params() in the per-stream SOF compress state and return it from sof_compr_get_params().
--- sound/soc/sof/compress.c | 8 +++++--- sound/soc/sof/sof-priv.h | 2 ++ 2 files changed, 7 insertions(+), 3 deletions(-)
sound/soc/sof/compress.c +5 -3
@@ -247,6 +247,7 @@ static int sof_compr_set_params(struct snd_soc_component *component, sstream->sampling_rate = params->codec.sample_rate; sstream->channels = params->codec.ch_out; sstream->sample_container_bytes = pcm->params.sample_container_bytes; + sstream->codec_params = params->codec; spcm->prepared[cstream->direction] = true;
@@ -259,9 +260,10 @@ static int sof_compr_set_params(struct snd_soc_component *component,static int sof_compr_get_params (struct snd_soc_component *component,struct snd_compr_stream *cstream,struct snd_codec *params) { -/* TODO: we don't query the supported codecs for now, if the -* application asks for an unsupported codec the set_params() will fail. -*/ +struct sof_compr_stream *sstream = cstream->runtime->private_data; + + *params = sstream->codec_params; +return 0 ; }
sound/soc/sof/sof-priv.h +2 -0
@@ -17,6 +17,7 @@#include <sound/sof/info.h> #include <sound/sof/pm.h> #include <sound/sof/trace.h> +#include <sound/compress_params.h> #include <uapi/sound/sof/fw.h> #include <sound/sof/ext_manifest.h>
@@ -119,6 +120,7 @@ struct sof_compr_stream {u32 sampling_rate;u16 channels;u16 sample_container_bytes; +struct snd_codec codec_params;size_t posn_offset; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 231/666 PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Cheng <[email protected]>
[ Upstream commit 16d021c878dca22532c984668c9e8cf4722d6a49 ]
NPEM registers LED classdevs on PCI endpoint that may be behind hotplug-capable ports. During hot-removal, led_classdev_unregister() calls led_set_brightness(LED_OFF) which leads to a PCI config read to a disconnected device, which fails and returns -ENODEV (topology details in msgid.link below):
leds 0003:01:00.0:enclosure:ok: Setting an LED's brightness failed (-19)
The LED core already suppresses this for devices with LED_HW_PLUGGABLE set, but NPEM never sets it. Add the flag since NPEM LEDs are on hot-pluggable hardware by nature.
--- drivers/pci/npem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/npem.c +1 -1
@@ -504,7 +504,7 @@ static int pci_npem_set_led_classdev(struct npem *npem, struct npem_led *nled) led->brightness_get = brightness_get; led->max_brightness =1 ; led->default_trigger ="none" ; - led->flags =0 ; + led->flags =LED_HW_PLUGGABLE ; ret =led_classdev_register (&npem->dev->dev, led);if (ret)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 232/666 PCI: tegra194: Fix polling delay for L2 state
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidya Sagar <[email protected]>
[ Upstream commit adaffed907f14f954096555665ad6af2ae724d83 ]
As per PCIe r7.0, sec 5.3.3.2.1, after sending PME_Turn_Off message, Root Port should wait for 1-10 msec for PME_TO_Ack message. Currently, driver is polling for 10 msec with 1 usec delay which is aggressive. Use existing macro PCIE_PME_TO_L2_TIMEOUT_US to poll for 10 msec with 1 msec delay. Since this function is used in non-atomic context only, use non-atomic poll function.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +4 -5
@@ -198,8 +198,6 @@#define CAP_SPCIE_CAP_OFF_USP_TX_PRESET0_MASK GENMASK(11, 8)#define CAP_SPCIE_CAP_OFF_USP_TX_PRESET0_SHIFT 8 -#define PME_ACK_TIMEOUT 10000 -#define LTSSM_TIMEOUT 50000/* 50ms */ #define GEN3_GEN4_EQ_PRESET_INIT 5
@@ -1570,9 +1568,10 @@ static int tegra_pcie_try_link_l2(struct tegra_pcie_dw *pcie) val |=APPL_PM_XMT_TURNOFF_STATE ;appl_writel (pcie, val,APPL_RADM_STATUS ); -return readl_poll_timeout_atomic (pcie->appl_base +APPL_DEBUG , val, - val &APPL_DEBUG_PM_LINKST_IN_L2_LAT , -1 ,PME_ACK_TIMEOUT ); +return readl_poll_timeout (pcie->appl_base +APPL_DEBUG , val, + val &APPL_DEBUG_PM_LINKST_IN_L2_LAT , +PCIE_PME_TO_L2_TIMEOUT_US /10 , +PCIE_PME_TO_L2_TIMEOUT_US ); }static void tegra_pcie_dw_pme_turnoff (struct tegra_pcie_dw *pcie)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 233/666 PCI: tegra194: Increase LTSSM poll time on surprise link down
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manikanta Maddireddy <[email protected]>
[ Upstream commit 74dd8efe4d6cead433162147333af989a568aac7 ]
On surprise link down, LTSSM state transits from L0 -> Recovery.RcvrLock -> Recovery.RcvrSpeed -> Gen1 Recovery.RcvrLock -> Detect. Recovery.RcvrLock and Recovery.RcvrSpeed transit times are 24 ms and 48 ms respectively, so the total time from L0 to Detect is ~96 ms. Increase the poll timeout to 120 ms to account for this.
While at it, add LTSSM state defines for Detect-related states and use them in the poll condition. Use readl_poll_timeout() instead of readl_poll_timeout_atomic() in tegra_pcie_dw_pme_turnoff() since that path runs in non-atomic context.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 36 +++++++++++++--------- 1 file changed, 21 insertions(+), 15 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +21 -15
@@ -137,7 +137,11 @@#define APPL_DEBUG_PM_LINKST_IN_L0 0x11#define APPL_DEBUG_LTSSM_STATE_MASK GENMASK(8, 3)#define APPL_DEBUG_LTSSM_STATE_SHIFT 3 -#define LTSSM_STATE_PRE_DETECT 5 +#define LTSSM_STATE_DETECT_QUIET 0x00 +#define LTSSM_STATE_DETECT_ACT 0x08 +#define LTSSM_STATE_PRE_DETECT_QUIET 0x28 +#define LTSSM_STATE_DETECT_WAIT 0x30 +#define LTSSM_STATE_L2_IDLE 0xa8#define APPL_RADM_STATUS 0xE4#define APPL_PM_XMT_TURNOFF_STATE BIT(0)
@@ -198,7 +202,8 @@#define CAP_SPCIE_CAP_OFF_USP_TX_PRESET0_MASK GENMASK(11, 8)#define CAP_SPCIE_CAP_OFF_USP_TX_PRESET0_SHIFT 8 -#define LTSSM_TIMEOUT 50000/* 50ms */ +#define LTSSM_DELAY_US 10000/* 10 ms */ +#define LTSSM_TIMEOUT_US 120000/* 120 ms */ #define GEN3_GEN4_EQ_PRESET_INIT 5
@@ -1614,15 +1619,14 @@ static void tegra_pcie_dw_pme_turnoff(struct tegra_pcie_dw *pcie) data &= ~APPL_CTRL_LTSSM_EN ;writel (data, pcie->appl_base +APPL_CTRL ); - err =readl_poll_timeout_atomic (pcie->appl_base +APPL_DEBUG , - data, - ((data & -APPL_DEBUG_LTSSM_STATE_MASK ) >> -APPL_DEBUG_LTSSM_STATE_SHIFT ) == -LTSSM_STATE_PRE_DETECT , -1 ,LTSSM_TIMEOUT ); + err =readl_poll_timeout (pcie->appl_base +APPL_DEBUG , data, + ((data &APPL_DEBUG_LTSSM_STATE_MASK ) ==LTSSM_STATE_DETECT_QUIET ) || + ((data &APPL_DEBUG_LTSSM_STATE_MASK ) ==LTSSM_STATE_DETECT_ACT ) || + ((data &APPL_DEBUG_LTSSM_STATE_MASK ) ==LTSSM_STATE_PRE_DETECT_QUIET ) || + ((data &APPL_DEBUG_LTSSM_STATE_MASK ) ==LTSSM_STATE_DETECT_WAIT ), +LTSSM_DELAY_US ,LTSSM_TIMEOUT_US );if (err) -dev_info (pcie->dev,"Link didn't go to detect state\n" ); +dev_info (pcie->dev,"LTSSM state: 0x%x detect timeout: %d\n" , data, err); }/* * DBI registers may not be accessible after this as PLL-E would be
@@ -1710,12 +1714,14 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie)appl_writel (pcie, val,APPL_CTRL ); ret =readl_poll_timeout (pcie->appl_base +APPL_DEBUG , val, - ((val &APPL_DEBUG_LTSSM_STATE_MASK ) >> -APPL_DEBUG_LTSSM_STATE_SHIFT ) == -LTSSM_STATE_PRE_DETECT , -1 ,LTSSM_TIMEOUT ); + ((val &APPL_DEBUG_LTSSM_STATE_MASK ) ==LTSSM_STATE_DETECT_QUIET ) || + ((val &APPL_DEBUG_LTSSM_STATE_MASK ) ==LTSSM_STATE_DETECT_ACT ) || + ((val &APPL_DEBUG_LTSSM_STATE_MASK ) ==LTSSM_STATE_PRE_DETECT_QUIET ) || + ((val &APPL_DEBUG_LTSSM_STATE_MASK ) ==LTSSM_STATE_DETECT_WAIT ) || + ((val &APPL_DEBUG_LTSSM_STATE_MASK ) ==LTSSM_STATE_L2_IDLE ), +LTSSM_DELAY_US ,LTSSM_TIMEOUT_US );if (ret) -dev_err (pcie->dev,"Failed to go Detect state: %d\n" , ret); +dev_info (pcie->dev,"LTSSM state: 0x%x detect timeout: %d\n" , val, ret);reset_control_assert (pcie->core_rst);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 234/666 PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manikanta Maddireddy <[email protected]>
[ Upstream commit 9fa0c242f8d7acf1b124d4462d18f4023573ac1c ]
After the link reaches a Detect-related LTSSM state, disable LTSSM so it does not keep toggling between Polling and Detect. Do this by polling for the Detect state first, then clearing APPL_CTRL_LTSSM_EN in both tegra_pcie_dw_pme_turnoff() and pex_ep_event_pex_rst_assert().
--- drivers/pci/controller/dwc/pcie-tegra194.c | 29 ++++++++++++---------- 1 file changed, 16 insertions(+), 13 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +16 -13
@@ -1611,14 +1611,6 @@ static void tegra_pcie_dw_pme_turnoff(struct tegra_pcie_dw *pcie) data &= ~APPL_PINMUX_PEX_RST ;appl_writel (pcie, data,APPL_PINMUX ); -/* -* Some cards do not go to detect state even after de-asserting -* PERST#. So, de-assert LTSSM to bring link to detect state. -*/ - data =readl (pcie->appl_base +APPL_CTRL ); - data &= ~APPL_CTRL_LTSSM_EN ; -writel (data, pcie->appl_base +APPL_CTRL ); - err = readl_poll_timeout(pcie->appl_base + APPL_DEBUG, data, ((data & APPL_DEBUG_LTSSM_STATE_MASK) == LTSSM_STATE_DETECT_QUIET) || ((data & APPL_DEBUG_LTSSM_STATE_MASK) == LTSSM_STATE_DETECT_ACT) ||
@@ -1627,6 +1619,14 @@ static void tegra_pcie_dw_pme_turnoff(struct tegra_pcie_dw *pcie) LTSSM_DELAY_US, LTSSM_TIMEOUT_US);if (err)dev_info (pcie->dev,"LTSSM state: 0x%x detect timeout: %d\n" , data, err); + +/* +* Deassert LTSSM state to stop the state toggling between +* Polling and Detect. +*/ + data =readl (pcie->appl_base +APPL_CTRL ); + data &= ~APPL_CTRL_LTSSM_EN ; +writel (data, pcie->appl_base +APPL_CTRL ); }/* * DBI registers may not be accessible after this as PLL-E would be
@@ -1708,11 +1708,6 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie)if (pcie->ep_state ==EP_STATE_DISABLED )return ; -/* Disable LTSSM */ - val =appl_readl (pcie,APPL_CTRL ); - val &= ~APPL_CTRL_LTSSM_EN ; -appl_writel (pcie, val,APPL_CTRL ); - ret = readl_poll_timeout(pcie->appl_base + APPL_DEBUG, val, ((val & APPL_DEBUG_LTSSM_STATE_MASK) == LTSSM_STATE_DETECT_QUIET) || ((val & APPL_DEBUG_LTSSM_STATE_MASK) == LTSSM_STATE_DETECT_ACT) ||
@@ -1723,6 +1718,14 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie)if (ret)dev_info (pcie->dev,"LTSSM state: 0x%x detect timeout: %d\n" , val, ret); +/* +* Deassert LTSSM state to stop the state toggling between +* Polling and Detect. +*/ + val =appl_readl (pcie,APPL_CTRL ); + val &= ~APPL_CTRL_LTSSM_EN ; +appl_writel (pcie, val,APPL_CTRL ); +reset_control_assert (pcie->core_rst);tegra_pcie_disable_phy (pcie);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 235/666 PCI: tegra194: Rename root_bus to root_port_bus in tegra_pcie_downstream_dev_to_D0()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
[ Upstream commit e1bd928479fb1fa60e9034b0fdb1ab9f3fa92f33 ]
In tegra_pcie_downstream_dev_to_D0(), PCI devices are transitioned to D0 state. For iterating over the devices, first the downstream bus of the Root Port is searched from the root bus. But the name of the variable that holds the Root Port downstream bus is named as 'root_bus', which is wrong.
Rename the variable to 'root_port_bus'. Also, move the comment on 'bringing the devices to D0' to where the state is set exactly.
Stable-dep-of: 71d9f67701e1 ("PCI: tegra194: Don't force the device into the D0 state before L2")
--- drivers/pci/controller/dwc/pcie-tegra194.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +6 -6
@@ -1278,7 +1278,7 @@ static int tegra_pcie_bpmp_set_pll_state(struct tegra_pcie_dw *pcie,static void tegra_pcie_downstream_dev_to_D0 (struct tegra_pcie_dw *pcie) {struct dw_pcie_rp *pp = &pcie->pci.pp; -struct pci_bus *child, *root_bus =NULL ; +struct pci_bus *child, *root_port_bus =NULL ;struct pci_dev *pdev;/*
@@ -1291,19 +1291,19 @@ static void tegra_pcie_downstream_dev_to_D0(struct tegra_pcie_dw *pcie)*/ list_for_each_entry (child, &pp->bridge->bus->children, node) { -/* Bring downstream devices to D0 if they are not already in */ if (child->parent == pp->bridge->bus) { - root_bus = child; + root_port_bus = child;break ; } } -if (!root_bus) { -dev_err (pcie->dev,"Failed to find downstream devices\n" ); +if (!root_port_bus) { +dev_err (pcie->dev,"Failed to find downstream bus of Root Port\n" );return ; } -list_for_each_entry (pdev, &root_bus->devices, bus_list) { +/* Bring downstream devices to D0 if they are not already in */ +list_for_each_entry (pdev, &root_port_bus->devices, bus_list) {if (PCI_SLOT (pdev->devfn) ==0 ) {if (pci_set_power_state (pdev,PCI_D0 )) dev_err(pcie->dev,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 236/666 PCI: tegra194: Dont force the device into the D0 state before L2
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidya Sagar <[email protected]>
[ Upstream commit 71d9f67701e1affc82d18ca88ae798c5361beddf ]
As per PCIe CEM r6.0, sec 2.3, the PCIe Endpoint device should be in D3cold to assert WAKE# pin. The previous workaround that forced downstream devices to D0 before taking the link to L2 cited PCIe r4.0, sec 5.2, "Link State Power Management"; however, that spec does not explicitly require putting the device into D0 and only indicates that power removal may be initiated without transitioning to D3hot.
Remove the D0 workaround so that Endpoint devices can use wake functionality (WAKE# from D3). With some Endpoints the link may not enter L2 when they remain in D3, but the Root Port continues with the usual flow after PME timeout, so there is no functional issue.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 41 ---------------------- 1 file changed, 41 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +0 -41
@@ -1275,44 +1275,6 @@ static int tegra_pcie_bpmp_set_pll_state(struct tegra_pcie_dw *pcie,return 0 ; } -static void tegra_pcie_downstream_dev_to_D0 (struct tegra_pcie_dw *pcie) -{ -struct dw_pcie_rp *pp = &pcie->pci.pp; -struct pci_bus *child, *root_port_bus =NULL ; -struct pci_dev *pdev; - -/* -* link doesn't go into L2 state with some of the endpoints with Tegra -* if they are not in D0 state. So, need to make sure that immediate -* downstream devices are in D0 state before sending PME_TurnOff to put -* link into L2 state. -* This is as per PCI Express Base r4.0 v1.0 September 27-2017, -* 5.2 Link State Power Management (Page #428). -*/ - -list_for_each_entry (child, &pp->bridge->bus->children, node) { -if (child->parent == pp->bridge->bus) { - root_port_bus = child; -break ; - } - } - -if (!root_port_bus) { -dev_err (pcie->dev,"Failed to find downstream bus of Root Port\n" ); -return ; - } - -/* Bring downstream devices to D0 if they are not already in */ -list_for_each_entry (pdev, &root_port_bus->devices, bus_list) { -if (PCI_SLOT (pdev->devfn) ==0 ) { -if (pci_set_power_state (pdev,PCI_D0 )) -dev_err (pcie->dev, -"Failed to transition %s to D0 state\n" , -dev_name (&pdev->dev)); - } - } -} -static int tegra_pcie_get_slot_regulators (struct tegra_pcie_dw *pcie) { pcie->slot_ctl_3v3 =devm_regulator_get_optional (pcie->dev,"vpcie3v3" );
@@ -1642,7 +1604,6 @@ static void tegra_pcie_dw_pme_turnoff(struct tegra_pcie_dw *pcie)static void tegra_pcie_deinit_controller (struct tegra_pcie_dw *pcie) { -tegra_pcie_downstream_dev_to_D0 (pcie);dw_pcie_host_deinit (&pcie->pci.pp);tegra_pcie_dw_pme_turnoff (pcie);tegra_pcie_unconfig_controller (pcie);
@@ -2367,7 +2328,6 @@ static int tegra_pcie_dw_suspend_noirq(struct device *dev)if (!pcie->link_state)return 0 ; -tegra_pcie_downstream_dev_to_D0 (pcie);tegra_pcie_dw_pme_turnoff (pcie);tegra_pcie_unconfig_controller (pcie);
@@ -2441,7 +2401,6 @@ static void tegra_pcie_dw_shutdown(struct platform_device *pdev)return ;debugfs_remove_recursive (pcie->debugfs); -tegra_pcie_downstream_dev_to_D0 (pcie);disable_irq (pcie->pci.pp.irq);if (IS_ENABLED (CONFIG_PCI_MSI ))
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 237/666 PCI: tegra194: Disable PERST# IRQ only in Endpoint mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manikanta Maddireddy <[email protected]>
[ Upstream commit 40658a31b6e134169c648041efc84944c4c71dcd ]
The PERST# GPIO interrupt is only registered when the controller is operating in Endpoint mode. In Root Port mode, the PERST# GPIO is configured as an output to control downstream devices, and no interrupt is registered for it.
Currently, tegra_pcie_dw_stop_link() unconditionally calls disable_irq() on pex_rst_irq, which causes issues in Root Port mode where this IRQ is not registered.
Fix this by only disabling the PERST# IRQ when operating in Endpoint mode, where the interrupt is actually registered and used to detect PERST# assertion/deassertion from the host.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pci/controller/dwc/pcie-tegra194.c +2 -1
@@ -1042,7 +1042,8 @@ static void tegra_pcie_dw_stop_link(struct dw_pcie *pci) {struct tegra_pcie_dw *pcie =to_tegra_pcie (pci); -disable_irq (pcie->pex_rst_irq); +if (pcie->of_data->mode ==DW_PCIE_EP_TYPE ) +disable_irq (pcie->pex_rst_irq); }static const struct dw_pcie_ops tegra_dw_pcie_ops = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 238/666 PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidya Sagar <[email protected]>
[ Upstream commit f62bc7917de1374dce86a852ffba8baf9cb7a56a ]
The GPIO DT property "nvidia,refclk-select", to select the PCIe reference clock is optional. Use devm_gpiod_get_optional() to get it.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +3 -3
@@ -1184,9 +1184,9 @@ static int tegra_pcie_dw_parse_dt(struct tegra_pcie_dw *pcie)return err; } - pcie->pex_refclk_sel_gpiod =devm_gpiod_get (pcie->dev, -"nvidia,refclk-select" , -GPIOD_OUT_HIGH ); + pcie->pex_refclk_sel_gpiod =devm_gpiod_get_optional (pcie->dev, +"nvidia,refclk-select" , +GPIOD_OUT_HIGH );if (IS_ERR (pcie->pex_refclk_sel_gpiod)) {int err =PTR_ERR (pcie->pex_refclk_sel_gpiod);const char *level =KERN_ERR ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 239/666 PCI: tegra194: Disable direct speed change for Endpoint mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidya Sagar <[email protected]>
[ Upstream commit 976f6763f57970388bcd7118931f33f447916927 ]
Pre-silicon simulation showed the controller operating in Endpoint mode initiating link speed change after completing Secondary Bus Reset. Ideally, the Root Port or the Switch Downstream Port should initiate the link speed change post SBR, not the Endpoint.
So, as per the hardware team recommendation, disable direct speed change for the Endpoint mode to prevent it from initiating speed change after the physical layer link is up at Gen1, leaving speed change ownership with the host.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/pci/controller/dwc/pcie-tegra194.c +4 -0
@@ -1830,6 +1830,10 @@ static void pex_ep_event_pex_rst_deassert(struct tegra_pcie_dw *pcie)reset_control_deassert (pcie->core_rst); + val =dw_pcie_readl_dbi (pci,PCIE_LINK_WIDTH_SPEED_CONTROL ); + val &= ~PORT_LOGIC_SPEED_CHANGE ; +dw_pcie_writel_dbi (pci,PCIE_LINK_WIDTH_SPEED_CONTROL , val); +if (pcie->update_fc_fixup) { val =dw_pcie_readl_dbi (pci,CFG_TIMER_CTRL_MAX_FUNC_NUM_OFF ); val |=0x1 <<CFG_TIMER_CTRL_ACK_NAK_SHIFT ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 240/666 PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidya Sagar <[email protected]>
[ Upstream commit b256493bf8cacf0e524bf4c10b5c4901d0c6cefe ]
LTR message should be sent as soon as the Root Port enables LTR in the Endpoint mode. So set snoop and no-snoop LTR timing and LTR message request before the PCIe link comes up, so that the LTR message is sent upstream as soon as LTR is enabled.
Without programming these values, the Endpoint would send latencies of 0 to the host, which will be inaccurate.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +9 -9
@@ -487,15 +487,6 @@ static irqreturn_t tegra_pcie_ep_irq_thread(int irq, void *arg)if (val &PCI_COMMAND_MASTER ) {ktime_t timeout; -/* 110us for both snoop and no-snoop */ - val =FIELD_PREP (PCI_LTR_VALUE_MASK ,110 ) | -FIELD_PREP (PCI_LTR_SCALE_MASK ,2 ) | -LTR_MSG_REQ | -FIELD_PREP (PCI_LTR_NOSNOOP_VALUE ,110 ) | -FIELD_PREP (PCI_LTR_NOSNOOP_SCALE ,2 ) | -LTR_NOSNOOP_MSG_REQ ; -appl_writel (pcie, val,APPL_LTR_MSG_1 ); -/* Send LTR upstream */ val =appl_readl (pcie,APPL_LTR_MSG_2 ); val |=APPL_LTR_MSG_2_LTR_MSG_REQ_STATE ;
@@ -1828,6 +1819,15 @@ static void pex_ep_event_pex_rst_deassert(struct tegra_pcie_dw *pcie) val |=APPL_INTR_EN_L1_0_0_RDLH_LINK_UP_INT_EN ;appl_writel (pcie, val,APPL_INTR_EN_L1_0_0 ); +/* 110us for both snoop and no-snoop */ + val =FIELD_PREP (PCI_LTR_VALUE_MASK ,110 ) | +FIELD_PREP (PCI_LTR_SCALE_MASK ,2 ) | +LTR_MSG_REQ | +FIELD_PREP (PCI_LTR_NOSNOOP_VALUE ,110 ) | +FIELD_PREP (PCI_LTR_NOSNOOP_SCALE ,2 ) | +LTR_NOSNOOP_MSG_REQ ; +appl_writel (pcie, val,APPL_LTR_MSG_1 ); +reset_control_deassert (pcie->core_rst); val =dw_pcie_readl_dbi (pci,PCIE_LINK_WIDTH_SPEED_CONTROL );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 241/666 PCI: tegra194: Allow system suspend when the Endpoint link is not up
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidya Sagar <[email protected]>
[ Upstream commit c76f8eae7d4695b1176c4ea5eb93c17e16a20272 ]
Host software initiates the L2 sequence. PCIe link is kept in L2 state during suspend. If Endpoint mode is enabled and the link is up, the software cannot proceed with suspend. However, when the PCIe Endpoint driver is probed, but the PCIe link is not up, Tegra can go into suspend state. So, allow system to suspend in this case.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 31 +++++++++++++++++----- 1 file changed, 25 insertions(+), 6 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +25 -6
@@ -2301,16 +2301,28 @@ static void tegra_pcie_dw_remove(struct platform_device *pdev)gpiod_set_value (pcie->pex_refclk_sel_gpiod,0 ); } -static int tegra_pcie_dw_suspend_late (struct device *dev) +static int tegra_pcie_dw_suspend (struct device *dev) {struct tegra_pcie_dw *pcie =dev_get_drvdata (dev); -u32 val;if (pcie->of_data->mode ==DW_PCIE_EP_TYPE ) { -dev_err (dev,"Failed to Suspend as Tegra PCIe is in EP mode\n" ); -return -EPERM ; +if (pcie->ep_state ==EP_STATE_ENABLED ) { +dev_err (dev,"Tegra PCIe is in EP mode, suspend not allowed\n" ); +return -EPERM ; + } + +disable_irq (pcie->pex_rst_irq); +return 0 ; } +return 0 ; +} + +static int tegra_pcie_dw_suspend_late (struct device *dev) +{ +struct tegra_pcie_dw *pcie =dev_get_drvdata (dev); +u32 val; +if (!pcie->link_state)return 0 ;
@@ -2330,6 +2342,9 @@ static int tegra_pcie_dw_suspend_noirq(struct device *dev) {struct tegra_pcie_dw *pcie =dev_get_drvdata (dev); +if (pcie->of_data->mode ==DW_PCIE_EP_TYPE ) +return 0 ; +if (!pcie->link_state)return 0 ;
@@ -2344,6 +2359,9 @@ static int tegra_pcie_dw_resume_noirq(struct device *dev)struct tegra_pcie_dw *pcie =dev_get_drvdata (dev);int ret; +if (pcie->of_data->mode ==DW_PCIE_EP_TYPE ) +return 0 ; +if (!pcie->link_state)return 0 ;
@@ -2376,8 +2394,8 @@ static int tegra_pcie_dw_resume_early(struct device *dev)u32 val;if (pcie->of_data->mode ==DW_PCIE_EP_TYPE ) { -dev_err (dev,"Suspend is not supported in EP mode" ); -return -ENOTSUPP ; +enable_irq (pcie->pex_rst_irq); +return 0 ; }if (!pcie->link_state)
@@ -2482,6 +2500,7 @@ static const struct of_device_id tegra_pcie_dw_of_match[] = { };static const struct dev_pm_ops tegra_pcie_dw_pm_ops = { + .suspend = tegra_pcie_dw_suspend, .suspend_late = tegra_pcie_dw_suspend_late, .suspend_noirq = tegra_pcie_dw_suspend_noirq, .resume_noirq = tegra_pcie_dw_resume_noirq,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 242/666 PCI: tegra194: Free up Endpoint resources during remove()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidya Sagar <[email protected]>
[ Upstream commit 8870f02f7868209eb9bdc5dc53540a6262cf9227 ]
Free up the resources during remove() that were acquired by the DesignWare driver for the Endpoint mode during probe().
--- drivers/pci/controller/dwc/pcie-tegra194.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/controller/dwc/pcie-tegra194.c +2 -0
@@ -2282,6 +2282,7 @@ static int tegra_pcie_dw_probe(struct platform_device *pdev)static void tegra_pcie_dw_remove (struct platform_device *pdev) {struct tegra_pcie_dw *pcie =platform_get_drvdata (pdev); +struct dw_pcie_ep *ep = &pcie->pci.ep;if (pcie->of_data->mode ==DW_PCIE_RC_TYPE ) {if (!pcie->link_state)
@@ -2293,6 +2294,7 @@ static void tegra_pcie_dw_remove(struct platform_device *pdev) }else {disable_irq (pcie->pex_rst_irq);pex_ep_event_pex_rst_assert (pcie); +dw_pcie_ep_deinit (ep); }pm_runtime_disable (pcie->dev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 243/666 PCI: tegra194: Use DWC IP core version
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manikanta Maddireddy <[email protected]>
[ Upstream commit ea60ca067f0f098043610c96a915d162113c1aac ]
Tegra194 PCIe driver used custom version numbers to detect Tegra194 and Tegra234 IPs. With version detect logic added, version check results in mismatch warnings:
tegra194-pcie 14100000.pcie: Versions don't match (0000562a != 3536322a)
Use HW version numbers which match to PORT_LOGIC.PCIE_VERSION_OFF in Tegra194 driver to avoid these kernel warnings.
--- drivers/pci/controller/dwc/pcie-designware.h | 2 ++ drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-)
drivers/pci/controller/dwc/pcie-designware.h +2 -0
@@ -31,8 +31,10 @@#define DW_PCIE_VER_470A 0x3437302a#define DW_PCIE_VER_480A 0x3438302a#define DW_PCIE_VER_490A 0x3439302a +#define DW_PCIE_VER_500A 0x3530302a#define DW_PCIE_VER_520A 0x3532302a#define DW_PCIE_VER_540A 0x3534302a +#define DW_PCIE_VER_562A 0x3536322a#define __dw_pcie_ver_cmp (_pci, _ver, _op) \ ((_pci)->version _op DW_PCIE_VER_ ## _ver)
drivers/pci/controller/dwc/pcie-tegra194.c +2 -2
@@ -35,8 +35,8 @@#include <soc/tegra/bpmp-abi.h> #include "../../pci.h" -#define TEGRA194_DWC_IP_VER 0x490A -#define TEGRA234_DWC_IP_VER 0x562A +#define TEGRA194_DWC_IP_VER DW_PCIE_VER_500A +#define TEGRA234_DWC_IP_VER DW_PCIE_VER_562A#define APPL_PINMUX 0x0#define APPL_PINMUX_PEX_RST BIT(0)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 244/666 PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manikanta Maddireddy <[email protected]>
[ Upstream commit 40805f32dceadebb7381d911003100bec7b8cd51 ]
The ECRC (TLP digest) workaround was originally added for DesignWare version 4.90a. Tegra234 SoC has 5.00a DWC HW version, which has the same ATU TD override behaviour, so apply the workaround for 5.00a too.
--- drivers/pci/controller/dwc/pcie-designware.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/pci/controller/dwc/pcie-designware.c +8 -8
@@ -429,13 +429,13 @@ static inline void dw_pcie_writel_atu_ob(struct dw_pcie *pci, u32 index, u32 regstatic inline u32 dw_pcie_enable_ecrc (u32 val) {/* -* DesignWare core version 4.90A has a design issue where the 'TD' -* bit in the Control register-1 of the ATU outbound region acts -* like an override for the ECRC setting, i.e., the presence of TLP -* Digest (ECRC) in the outgoing TLPs is solely determined by this -* bit. This is contrary to the PCIe spec which says that the -* enablement of the ECRC is solely determined by the AER -* registers. +* DWC versions 0x3530302a and 0x3536322a have a design issue where +* the 'TD' bit in the Control register-1 of the ATU outbound +* region acts like an override for the ECRC setting, i.e., the +* presence of TLP Digest (ECRC) in the outgoing TLPs is solely +* determined by this bit. This is contrary to the PCIe spec which +* says that the enablement of the ECRC is solely determined by the +* AER registers. * * Because of this, even when the ECRC is enabled through AER * registers, the transactions going through ATU won't have TLP
@@ -505,7 +505,7 @@ int dw_pcie_prog_outbound_atu(struct dw_pcie *pci,if (upper_32_bits (limit_addr) >upper_32_bits (cpu_addr) && dw_pcie_ver_is_ge(pci, 460A)) val |=PCIE_ATU_INCREASE_REGION_SIZE ; - if (dw_pcie_ver_is(pci, 490A)) + if (dw_pcie_ver_is(pci, 490A) || dw_pcie_ver_is(pci, 500A)) val =dw_pcie_enable_ecrc (val);dw_pcie_writel_atu_ob (pci, atu->index,PCIE_ATU_REGION_CTRL1 , val);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 245/666 PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manikanta Maddireddy <[email protected]>
[ Upstream commit 34b3eef48d980cd37b876e128bbf314f69fb5d70 ]
When PERST# is deasserted twice (assert -> deassert -> assert -> deassert), a CBB (Control Backbone) timeout occurs at DBI register offset 0x8bc (PCIE_MISC_CONTROL_1_OFF). This happens because pci_epc_deinit_notify() and dw_pcie_ep_cleanup() are called before reset_control_deassert() powers on the controller core.
The call chain that causes the timeout:
pex_ep_event_pex_rst_deassert()
pci_epc_deinit_notify()
pci_epf_test_epc_deinit()
pci_epf_test_clear_bar()
pci_epc_clear_bar()
dw_pcie_ep_clear_bar()
__dw_pcie_ep_reset_bar()
dw_pcie_dbi_ro_wr_en() <- Accesses 0x8bc DBI register
reset_control_deassert(pcie->core_rst) <- Core powered on HEREThe DBI registers, including PCIE_MISC_CONTROL_1_OFF (0x8bc), are only accessible after the controller core is powered on via reset_control_deassert(pcie->core_rst). Accessing them before this point results in a CBB timeout because the hardware is not yet operational.
Fix this by moving pci_epc_deinit_notify() and dw_pcie_ep_cleanup() to after reset_control_deassert(pcie->core_rst), ensuring the controller is fully powered on before any DBI register accesses occur.
--- drivers/pci/controller/dwc/pcie-tegra194.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +4 -4
@@ -1757,10 +1757,6 @@ static void pex_ep_event_pex_rst_deassert(struct tegra_pcie_dw *pcie) goto fail_phy; } -/* Perform cleanup that requires refclk */ -pci_epc_deinit_notify (pcie->pci.ep.epc); -dw_pcie_ep_cleanup (&pcie->pci.ep); -/* Clear any stale interrupt statuses */ appl_writel (pcie,0xFFFFFFFF ,APPL_INTR_STATUS_L0 );appl_writel (pcie,0xFFFFFFFF ,APPL_INTR_STATUS_L1_0_0 );
@@ -1830,6 +1826,10 @@ static void pex_ep_event_pex_rst_deassert(struct tegra_pcie_dw *pcie)reset_control_deassert (pcie->core_rst); +/* Perform cleanup that requires refclk and core reset deasserted */ +pci_epc_deinit_notify (pcie->pci.ep.epc); +dw_pcie_ep_cleanup (&pcie->pci.ep); + val =dw_pcie_readl_dbi (pci,PCIE_LINK_WIDTH_SPEED_CONTROL ); val &= ~PORT_LOGIC_SPEED_CHANGE ;dw_pcie_writel_dbi (pci,PCIE_LINK_WIDTH_SPEED_CONTROL , val);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 246/666 spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <[email protected]>
[ Upstream commit ab00febad191d7a4400aa1c3468279fb508258d4 ]
mtk_snand_probe() registers the on-host NAND ECC engine, but teardown was missing from both probe unwind and remove-time cleanup. Add a devm cleanup action after successful registration so nand_ecc_unregister_on_host_hw_engine() runs automatically on probe failures and during device removal.
--- drivers/spi/spi-mtk-snfi.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/spi/spi-mtk-snfi.c +14 -0
@@ -1307,6 +1307,13 @@ static const struct spi_controller_mem_caps mtk_snand_mem_caps = { .ecc = true, }; +static void mtk_unregister_ecc_engine (void *data) +{ +struct nand_ecc_engine *eng = data; + +nand_ecc_unregister_on_host_hw_engine (eng); +} +static irqreturn_t mtk_snand_irq (int irq,void *id) {struct mtk_snand *snf = id;
@@ -1447,6 +1454,13 @@ static int mtk_snand_probe(struct platform_device *pdev) goto release_ecc; } + ret =devm_add_action_or_reset (&pdev->dev, mtk_unregister_ecc_engine, + &ms->ecc_eng); +if (ret) { +dev_err_probe (&pdev->dev, ret,"failed to add ECC unregister action\n" ); + goto release_ecc; + } + ctlr->num_chipselect =1 ; ctlr->mem_ops = &mtk_snand_mem_ops; ctlr->mem_caps = &mtk_snand_mem_caps;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 247/666 ALSA: sc6000: Keep the programmed board state in card-private data
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
[ Upstream commit fb79bf127ac2577b4876132da6dba768018aad4c ]
The driver may auto-select IRQ and DMA resources at probe time, but sc6000_init_board() still derives the SC-6000 soft configuration from the module parameter arrays. When irq=auto or dma=auto is used, the codec is created with the selected resources while the board is programmed with the unresolved values.
Store the mapped ports and generated SC-6000 board configuration in card-private data, build that configuration from the live probe results instead of the raw module parameters, and keep the probe-time board programming in a shared helper.
This fixes the resource-programming mismatch and leaves the driver with a stable board-state block that can be reused by suspend/resume.
--- sound/isa/sc6000.c | 152 +++++++++++++++++++++++++++------------------ 1 file changed, 92 insertions(+), 60 deletions(-)
sound/isa/sc6000.c +92 -60
@@ -100,6 +100,15 @@ MODULE_PARM_DESC(joystick, "Enable gameport.");#define PFX "sc6000: "#define DRV_NAME "SC-6000" +struct snd_sc6000 { +char __iomem *vport; +char __iomem *vmss_port; +u8 mss_config; +u8 config; +u8 hw_cfg[2 ]; +bool old_dsp; +}; +/* hardware dependent functions */ /*
@@ -267,7 +276,7 @@ static int sc6000_dsp_reset(char __iomem *vport)/* detection and initialization */ static int sc6000_hw_cfg_write (struct device *devptr, -char __iomem *vport,const int *cfg) +char __iomem *vport,const u8 *cfg) {if (sc6000_write (devptr, vport,COMMAND_6C ) <0 ) {dev_warn (devptr,"CMD 0x%x: failed!\n" ,COMMAND_6C );
@@ -353,8 +362,7 @@ static int sc6000_init_mss(struct device *devptr,return 0 ; } -static void sc6000_hw_cfg_encode (struct device *devptr, -char __iomem *vport,int *cfg, +static void sc6000_hw_cfg_encode (struct device *devptr,u8 *cfg,long xport,long xmpu,long xmss_port,int joystick) {
@@ -376,27 +384,83 @@ static void sc6000_hw_cfg_encode(struct device *devptr,dev_dbg (devptr,"hw cfg %x, %x\n" , cfg[0 ], cfg[1 ]); } -static int sc6000_init_board (struct device *devptr, -char __iomem *vport, -char __iomem *vmss_port,int dev) +static void sc6000_prepare_board (struct device *devptr, +struct snd_sc6000 *sc6000, +unsigned int dev,int xirq,int xdma) +{ + sc6000->mss_config =sc6000_irq_to_softcfg (xirq) | +sc6000_dma_to_softcfg (xdma); + sc6000->config = sc6000->mss_config | +sc6000_mpu_irq_to_softcfg (mpu_irq[dev]); +sc6000_hw_cfg_encode (devptr, sc6000->hw_cfg, port[dev], mpu_port[dev], + mss_port[dev], joystick[dev]); +} + +static void sc6000_detect_old_dsp (struct device *devptr, +struct snd_sc6000 *sc6000) +{ +sc6000_write (devptr, sc6000->vport,COMMAND_5C ); + sc6000->old_dsp =sc6000_read (sc6000->vport) <0 ; +} + +static int sc6000_program_board (struct device *devptr, +struct snd_sc6000 *sc6000) +{ +int err; + +if (!sc6000->old_dsp) { +if (sc6000_hw_cfg_write (devptr, sc6000->vport, + sc6000->hw_cfg) <0 ) { +dev_err (devptr,"sc6000_hw_cfg_write: failed!\n" ); +return -EIO ; + } + } + + err =sc6000_setup_board (devptr, sc6000->vport, sc6000->config); +if (err <0 ) { +dev_err (devptr,"sc6000_setup_board: failed!\n" ); +return -ENODEV ; + } + +sc6000_dsp_reset (sc6000->vport); + +if (!sc6000->old_dsp) { +sc6000_write (devptr, sc6000->vport,COMMAND_60 ); +sc6000_write (devptr, sc6000->vport,0x02 ); +sc6000_dsp_reset (sc6000->vport); + } + + err =sc6000_setup_board (devptr, sc6000->vport, sc6000->config); +if (err <0 ) { +dev_err (devptr,"sc6000_setup_board: failed!\n" ); +return -ENODEV ; + } + + err =sc6000_init_mss (devptr, sc6000->vport, sc6000->config, + sc6000->vmss_port, sc6000->mss_config); +if (err <0 ) { +dev_err (devptr,"Cannot initialize Microsoft Sound System mode.\n" ); +return -ENODEV ; + } + +return 0 ; +} + +static int sc6000_init_board (struct device *devptr,struct snd_sc6000 *sc6000) {char answer[15 ];char version[2 ]; -int mss_config =sc6000_irq_to_softcfg (irq[dev]) | -sc6000_dma_to_softcfg (dma[dev]); -int config = mss_config | -sc6000_mpu_irq_to_softcfg (mpu_irq[dev]);int err; -int old =0 ; - err =sc6000_dsp_reset (vport); + err =sc6000_dsp_reset (sc6000->vport);if (err <0 ) {dev_err (devptr,"sc6000_dsp_reset: failed!\n" );return err; }memset (answer,0 ,sizeof (answer)); - err =sc6000_dsp_get_answer (devptr, vport,GET_DSP_COPYRIGHT , answer,15 ); + err =sc6000_dsp_get_answer (devptr, sc6000->vport,GET_DSP_COPYRIGHT , + answer,15 );if (err <=0 ) {dev_err (devptr,"sc6000_dsp_copyright: failed!\n" );return -ENODEV ;
@@ -408,54 +472,17 @@ static int sc6000_init_board(struct device *devptr,if (strncmp ("SC-6000" , answer,7 ))dev_warn (devptr,"Warning: non SC-6000 audio card!\n" ); -if (sc6000_dsp_get_answer (devptr, vport,GET_DSP_VERSION , version,2 ) <2 ) { +if (sc6000_dsp_get_answer (devptr, sc6000->vport, +GET_DSP_VERSION , version,2 ) <2 ) {dev_err (devptr,"sc6000_dsp_version: failed!\n" );return -ENODEV ; }dev_info (devptr,"Detected model: %s, DSP version %d.%d\n" , answer, version[0 ], version[1 ]); -/* set configuration */ -sc6000_write (devptr, vport,COMMAND_5C ); -if (sc6000_read (vport) <0 ) - old =1 ; - -if (!old) { -int cfg[2 ]; -sc6000_hw_cfg_encode (devptr, - vport, &cfg[0 ], port[dev], mpu_port[dev], - mss_port[dev], joystick[dev]); -if (sc6000_hw_cfg_write (devptr, vport, cfg) <0 ) { -dev_err (devptr,"sc6000_hw_cfg_write: failed!\n" ); -return -EIO ; - } - } - err =sc6000_setup_board (devptr, vport, config); -if (err <0 ) { -dev_err (devptr,"sc6000_setup_board: failed!\n" ); -return -ENODEV ; - } - -sc6000_dsp_reset (vport); - -if (!old) { -sc6000_write (devptr, vport,COMMAND_60 ); -sc6000_write (devptr, vport,0x02 ); -sc6000_dsp_reset (vport); - } +sc6000_detect_old_dsp (devptr, sc6000); - err =sc6000_setup_board (devptr, vport, config); -if (err <0 ) { -dev_err (devptr,"sc6000_setup_board: failed!\n" ); -return -ENODEV ; - } - err =sc6000_init_mss (devptr, vport, config, vmss_port, mss_config); -if (err <0 ) { -dev_err (devptr,"Cannot initialize Microsoft Sound System mode.\n" ); -return -ENODEV ; - } - -return 0 ; +return sc6000_program_board (devptr, sc6000); }static int snd_sc6000_mixer (struct snd_wss *chip)
@@ -538,10 +565,10 @@ static int snd_sc6000_match(struct device *devptr, unsigned int dev)static void snd_sc6000_free (struct snd_card *card) { -char __iomem *vport = (char __force __iomem *)card->private_data; +struct snd_sc6000 *sc6000 = card->private_data; -if (vport) -sc6000_setup_board (card->dev, vport,0 ); +if (sc6000->vport) +sc6000_setup_board (card->dev, sc6000->vport,0 ); }static int __snd_sc6000_probe (struct device *devptr,unsigned int dev)
@@ -552,15 +579,17 @@ static int __snd_sc6000_probe(struct device *devptr, unsigned int dev)int xirq = irq[dev];int xdma = dma[dev];struct snd_card *card; +struct snd_sc6000 *sc6000;struct snd_wss *chip;struct snd_opl3 *opl3;char __iomem *vport;char __iomem *vmss_port; err =snd_devm_card_new (devptr, index[dev], id[dev],THIS_MODULE , -0 , &card); +sizeof (*sc6000), &card);if (err <0 )return err; + sc6000 = card->private_data;if (xirq ==SNDRV_AUTO_IRQ ) { xirq =snd_legacy_find_free_irq (possible_irqs);
@@ -587,7 +616,7 @@ static int __snd_sc6000_probe(struct device *devptr, unsigned int dev)dev_err (devptr,"I/O port cannot be iomapped.\n" );return -EBUSY ; } - card->private_data = (void __force *)vport; + sc6000->vport = vport;/* to make it marked as used */ if (!devm_request_region (devptr, mss_port[dev],4 ,DRV_NAME )) {
@@ -600,12 +629,15 @@ static int __snd_sc6000_probe(struct device *devptr, unsigned int dev)dev_err (devptr,"MSS port I/O cannot be iomapped.\n" );return -EBUSY ; } + sc6000->vmss_port = vmss_port;dev_dbg (devptr,"Initializing BASE[0x%lx] IRQ[%d] DMA[%d] MIRQ[%d]\n" , port[dev], xirq, xdma, mpu_irq[dev] ==SNDRV_AUTO_IRQ ?0 : mpu_irq[dev]); - err =sc6000_init_board (devptr, vport, vmss_port, dev); +sc6000_prepare_board (devptr, sc6000, dev, xirq, xdma); + + err =sc6000_init_board (devptr, sc6000);if (err <0 )return err; card->private_free = snd_sc6000_free;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 248/666 dm cache: fix missing return in invalidate_committeds error path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming-Hung Tsai <[email protected]>
[ Upstream commit 8c0ee19db81f0fa1ff25fd75b22b17c0cc2acde3 ]
In passthrough mode, dm-cache defers write submission until after metadata commit completes via the invalidate_committed() continuation. On commit error, invalidate_committed() calls invalidate_complete() to end the bio and free the migration struct, after which it should return immediately.
The patch 4ca8b8bd952d ("dm cache: fix write hang in passthrough mode") omitted this early return, causing execution to fall through into the success path on error. This results in use-after-free on the migration struct in the subsequent calls.
Fix by adding the missing return after the invalidate_complete() call.
--- drivers/md/dm-cache-target.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/md/dm-cache-target.c +3 -1
@@ -1521,8 +1521,10 @@ static void invalidate_committed(struct work_struct *ws)struct bio *bio = mg->overwrite_bio;struct per_bio_data *pb =get_per_bio_data (bio); -if (mg->k.input) +if (mg->k.input) {invalidate_complete (mg, false); +return ; + }init_continuation (&mg->k, invalidate_completed);remap_to_origin_clear_discard (cache, bio, mg->invalidate_oblock);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 249/666 crypto: jitterentropy - replace long-held spinlock with mutex
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haixin Xu <[email protected]>
[ Upstream commit 01d798e9feb30212952d4e992801ba6bd6a82351 ]
jent_kcapi_random() serializes the shared jitterentropy state, but it currently holds a spinlock across the jent_read_entropy() call. That path performs expensive jitter collection and SHA3 conditioning, so parallel readers can trigger stalls as contending waiters spin for the same lock.
To prevent non-preemptible lock hold, replace rng->jent_lock with a mutex so contended readers sleep instead of spinning on a shared lock held across expensive entropy generation.
--- crypto/jitterentropy-kcapi.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
crypto/jitterentropy-kcapi.c +7 -7
@@ -42,6 +42,7 @@#include <linux/fips.h> #include <linux/kernel.h> #include <linux/module.h> +#include <linux/mutex.h> #include <linux/slab.h> #include <linux/time.h> #include <crypto/internal/rng.h>
@@ -192,7 +193,7 @@ int jent_read_random_block(void *hash_state, char *dst, unsigned int dst_len)***************************************************************************/ struct jitterentropy { -spinlock_t jent_lock; +struct mutex jent_lock;struct rand_data *entropy_collector;struct crypto_shash *tfm;struct shash_desc *sdesc;
@@ -202,7 +203,7 @@ static void jent_kcapi_cleanup(struct crypto_tfm *tfm) {struct jitterentropy *rng =crypto_tfm_ctx (tfm); -spin_lock (&rng->jent_lock); +mutex_lock (&rng->jent_lock);if (rng->sdesc) {shash_desc_zero (rng->sdesc);
@@ -217,7 +218,7 @@ static void jent_kcapi_cleanup(struct crypto_tfm *tfm)if (rng->entropy_collector)jent_entropy_collector_free (rng->entropy_collector); rng->entropy_collector =NULL ; -spin_unlock (&rng->jent_lock); +mutex_unlock (&rng->jent_lock); }static int jent_kcapi_init (struct crypto_tfm *tfm)
@@ -227,7 +228,7 @@ static int jent_kcapi_init(struct crypto_tfm *tfm)struct shash_desc *sdesc;int size, ret =0 ; -spin_lock_init (&rng->jent_lock); +mutex_init (&rng->jent_lock);/* * Use SHA3-256 as conditioner. We allocate only the generic
@@ -264,7 +265,6 @@ static int jent_kcapi_init(struct crypto_tfm *tfm) goto err; } -spin_lock_init (&rng->jent_lock);return 0 ; err:
@@ -279,7 +279,7 @@ static int jent_kcapi_random(struct crypto_rng *tfm,struct jitterentropy *rng =crypto_rng_ctx (tfm);int ret =0 ; -spin_lock (&rng->jent_lock); +mutex_lock (&rng->jent_lock); ret =jent_read_entropy (rng->entropy_collector, rdata, dlen);
@@ -305,7 +305,7 @@ static int jent_kcapi_random(struct crypto_rng *tfm, ret = -EINVAL ; } -spin_unlock (&rng->jent_lock); +mutex_unlock (&rng->jent_lock);return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 250/666 ALSA: hda/realtek - fixed speaker no sound update
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
[ Upstream commit 46c862f5419e0a86b60b9f9558d247f6084c99f9 ]
Fixed speaker has pop noise on Lenovo Thinkpad X11 Carbon Gen 12.
--- sound/pci/hda/patch_realtek.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-)
sound/pci/hda/patch_realtek.c +5 -11
@@ -7881,22 +7881,11 @@ static void alc287_alc1318_playback_pcm_hook(struct hda_pcm_stream *hinfo, struct snd_pcm_substream *substream, int action) { -static const struct coef_fw dis_coefs[] = { -WRITE_COEF (0x24 ,0x0013 ),WRITE_COEF (0x25 ,0x0000 ),WRITE_COEF (0x26 ,0xC203 ), -WRITE_COEF (0x28 ,0x0004 ),WRITE_COEF (0x29 ,0xb023 ), - };/* Disable AMP silence detection */ -static const struct coef_fw en_coefs[] = { -WRITE_COEF (0x24 ,0x0013 ),WRITE_COEF (0x25 ,0x0000 ),WRITE_COEF (0x26 ,0xC203 ), -WRITE_COEF (0x28 ,0x0084 ),WRITE_COEF (0x29 ,0xb023 ), - };/* Enable AMP silence detection */ - switch (action) {case HDA_GEN_PCM_ACT_OPEN : -alc_process_coef_fw (codec, dis_coefs);alc_write_coefex_idx (codec,0x5a ,0x00 ,0x954f );/* write gpio3 to high */ break ;case HDA_GEN_PCM_ACT_CLOSE : -alc_process_coef_fw (codec, en_coefs);alc_write_coefex_idx (codec,0x5a ,0x00 ,0x554f );/* write gpio3 as default value */ break ; }
@@ -7919,10 +7908,15 @@ static void alc287_fixup_lenovo_thinkpad_with_alc1318(struct hda_codec *codec,WRITE_COEF (0x24 ,0x0013 ),WRITE_COEF (0x25 ,0x0000 ),WRITE_COEF (0x26 ,0xC301 ), WRITE_COEF(0x28, 0x0001), WRITE_COEF(0x29, 0xb023), }; +static const struct coef_fw dis_coefs[] = { +WRITE_COEF (0x24 ,0x0013 ),WRITE_COEF (0x25 ,0x0000 ),WRITE_COEF (0x26 ,0xC203 ), +WRITE_COEF (0x28 ,0x0004 ),WRITE_COEF (0x29 ,0xb023 ), + };/* Disable AMP silence detection */ if (action !=HDA_FIXUP_ACT_PRE_PROBE )return ;alc_update_coef_idx (codec,0x10 ,1 <<11 ,1 <<11 ); +alc_process_coef_fw (codec, dis_coefs);alc_process_coef_fw (codec, coefs); spec->power_hook = alc287_s4_power_gpio3_default; spec->gen.pcm_playback_hook = alc287_alc1318_playback_pcm_hook;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 251/666 gfs2: Call unlock_new_inode before d_instantiate
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit 2ff7cf7e0640ff071ebc5c7e3dc2df024a7c91e6 ]
As Neil Brown describes in detail in the link referenced below, new inodes must be unlocked before they can be instantiated.
An even better fix is to use d_instantiate_new(), which combines d_instantiate() and unlock_new_inode().
--- fs/gfs2/inode.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/gfs2/inode.c +1 -2
@@ -893,7 +893,7 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry, goto fail_gunlock4;mark_inode_dirty (inode); -d_instantiate (dentry, inode); +d_instantiate_new (dentry, inode);/* After instantiate, errors should result in evict which will destroy * both inode and iopen glocks properly. */ if (file) {
@@ -905,7 +905,6 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,gfs2_glock_dq_uninit (&gh);gfs2_glock_put (io_gl);gfs2_qa_put (dip); -unlock_new_inode (inode);return error; fail_gunlock4:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 252/666 net/socket.c: switch to CLASS(fd)
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 53c0a58beb60b76e105a61aae518fd780eec03d9 ]
The important part in sockfd_lookup_light() is avoiding needless
file refcount operations, not the marginal reduction of the register pressure from not keeping a struct file pointer in the caller.
Switch to use fdget()/fdpu(); with sane use of CLASS(fd) we can
get a better code generation...
Would be nice if somebody tested it on networking test suites
(including benchmarks)...
sockfd_lookup_light() does fdget(), uses sock_from_file() to
get the associated socket and returns the struct socket reference to the caller, along with "do we need to fput()" flag. No matching fdput(), the caller does its equivalent manually, using the fact that sock->file points to the struct file the socket has come from.
Get rid of that - have the callers do fdget()/fdput() and
use sock_from_file() directly. That kills sockfd_lookup_light() and fput_light() (no users left).
What's more, we can get rid of explicit fdget()/fdput() by
switching to CLASS(fd, ...) - code generation does not suffer, since now fdput() inserted on "descriptor is not opened" failure exit is recognized to be a no-op by compiler.
[folded a fix for braino in do_recvmmsg() caught by Simon Horman]
Stable-dep-of: 66052a768d47 ("fanotify: call fanotify_events_supported() before path_permission() and security_path_notify()")
--- include/linux/file.h | 6 - net/socket.c | 303 +++++++++++++++++++------------------------ 2 files changed, 137 insertions(+), 172 deletions(-)
include/linux/file.h +0 -6
@@ -30,12 +30,6 @@ extern struct file *alloc_file_pseudo_noaccount(struct inode *, struct vfsmountextern struct file *alloc_file_clone (struct file *,int flags,const struct file_operations *); -static inline void fput_light (struct file *file,int fput_needed) -{ -if (fput_needed) -fput (file); -} -/* either a reference to struct file + flags * (cloned vs. borrowed, pos locked), with * flags stored in lower bits of value,
net/socket.c +137 -166
508 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 253/666 fdget(), trivial conversions
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 6348be02eead77bdd1562154ed6b3296ad3b3750 ]
fdget() is the first thing done in scope, all matching fdput() are immediately followed by leaving the scope.
Stable-dep-of: 66052a768d47 ("fanotify: call fanotify_events_supported() before path_permission() and security_path_notify()")
--- arch/powerpc/kvm/book3s_64_vio.c | 21 +++--------- arch/powerpc/kvm/powerpc.c | 24 ++++--------- arch/powerpc/platforms/cell/spu_syscalls.c | 6 ++-- arch/x86/kernel/cpu/sgx/main.c | 10 ++---- arch/x86/kvm/svm/sev.c | 39 ++++++++-------------- drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c | 23 ++++--------- drivers/gpu/drm/drm_syncobj.c | 9 ++--- drivers/media/rc/lirc_dev.c | 13 +++----- fs/btrfs/ioctl.c | 5 ++- fs/eventfd.c | 9 ++--- fs/eventpoll.c | 23 ++++--------- fs/fhandle.c | 5 ++- fs/ioctl.c | 23 +++++-------- fs/kernel_read_file.c | 12 +++---- fs/notify/fanotify/fanotify_user.c | 15 +++------ fs/notify/inotify/inotify_user.c | 17 +++------- fs/open.c | 36 +++++++++----------- fs/read_write.c | 28 +++++----------- fs/signalfd.c | 9 ++--- fs/sync.c | 29 ++++++---------- io_uring/sqpoll.c | 29 +++++----------- kernel/events/core.c | 14 +++----- kernel/nsproxy.c | 5 ++- kernel/pid.c | 7 ++-- kernel/sys.c | 15 +++------ kernel/watch_queue.c | 6 ++-- mm/fadvise.c | 10 ++---- mm/readahead.c | 17 +++------- net/core/net_namespace.c | 10 +++--- security/landlock/syscalls.c | 26 +++++---------- virt/kvm/vfio.c | 8 ++--- 31 files changed, 164 insertions(+), 339 deletions(-)
arch/powerpc/kvm/book3s_64_vio.c +5 -16
@@ -115,10 +115,9 @@ long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd,struct iommu_table_group *table_group;long i;struct kvmppc_spapr_tce_iommu_table *stit; -struct fd f; +CLASS (fd, f)(tablefd); - f =fdget (tablefd); -if (!fd_file (f)) +if (fd_empty (f))return -EBADF ;rcu_read_lock ();
@@ -130,16 +129,12 @@ long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, }rcu_read_unlock (); -if (!found) { -fdput (f); +if (!found)return -EINVAL ; - } table_group =iommu_group_get_iommudata (grp); -if (WARN_ON (!table_group)) { -fdput (f); +if (WARN_ON (!table_group))return -EFAULT ; - }for (i =0 ; i <IOMMU_TABLE_GROUP_MAX_TABLES ; ++i) {struct iommu_table *tbltmp = table_group->tables[i];
@@ -160,10 +155,8 @@ long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd,break ; } } -if (!tbl) { -fdput (f); +if (!tbl)return -EINVAL ; - }rcu_read_lock ();list_for_each_entry_rcu (stit, &stt->iommu_tables, next) {
@@ -174,7 +167,6 @@ long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd,/* stit is being destroyed */ iommu_tce_table_put (tbl);rcu_read_unlock (); -fdput (f);return -ENOTTY ; }/*
@@ -182,7 +174,6 @@ long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd,* its KVM reference counter and can return. */ rcu_read_unlock (); -fdput (f);return 0 ; }rcu_read_unlock ();
@@ -190,7 +181,6 @@ long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, stit =kzalloc (sizeof (*stit),GFP_KERNEL );if (!stit) {iommu_tce_table_put (tbl); -fdput (f);return -ENOMEM ; }
@@ -199,7 +189,6 @@ long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd,list_add_rcu (&stit->next, &stt->iommu_tables); -fdput (f);return 0 ; }
arch/powerpc/kvm/powerpc.c +7 -17
@@ -1930,12 +1930,11 @@ static int kvm_vcpu_ioctl_enable_cap(struct kvm_vcpu *vcpu,#endif #ifdef CONFIG_KVM_MPIC case KVM_CAP_IRQ_MPIC : { -struct fd f; +CLASS (fd, f)(cap->args[0 ]);struct kvm_device *dev; r = -EBADF ; - f =fdget (cap->args[0 ]); -if (!fd_file (f)) +if (fd_empty (f))break ; r = -EPERM ;
@@ -1943,18 +1942,16 @@ static int kvm_vcpu_ioctl_enable_cap(struct kvm_vcpu *vcpu,if (dev) r =kvmppc_mpic_connect_vcpu (dev, vcpu, cap->args[1 ]); -fdput (f);break ; }#endif #ifdef CONFIG_KVM_XICS case KVM_CAP_IRQ_XICS : { -struct fd f; +CLASS (fd, f)(cap->args[0 ]);struct kvm_device *dev; r = -EBADF ; - f =fdget (cap->args[0 ]); -if (!fd_file (f)) +if (fd_empty (f))break ; r = -EPERM ;
@@ -1965,34 +1962,27 @@ static int kvm_vcpu_ioctl_enable_cap(struct kvm_vcpu *vcpu, else r = kvmppc_xics_connect_vcpu(dev, vcpu, cap->args[1]); } - -fdput (f);break ; }#endif /* CONFIG_KVM_XICS */ #ifdef CONFIG_KVM_XIVE case KVM_CAP_PPC_IRQ_XIVE : { -struct fd f; +CLASS (fd, f)(cap->args[0 ]);struct kvm_device *dev; r = -EBADF ; - f =fdget (cap->args[0 ]); -if (!fd_file (f)) +if (fd_empty (f))break ; r = -ENXIO ; -if (!xive_enabled ()) { -fdput (f); +if (!xive_enabled ())break ; - } r = -EPERM ; dev =kvm_device_from_filp (fd_file (f));if (dev) r =kvmppc_xive_native_connect_vcpu (dev, vcpu, cap->args[1 ]); - -fdput (f);break ; }#endif /* CONFIG_KVM_XIVE */
arch/powerpc/platforms/cell/spu_syscalls.c +2 -4
@@ -64,12 +64,10 @@ SYSCALL_DEFINE4(spu_create, const char __user *, name, unsigned int, flags,return -ENOSYS ;if (flags &SPU_CREATE_AFFINITY_SPU ) { -struct fd neighbor =fdget (neighbor_fd); +CLASS (fd, neighbor)(neighbor_fd); ret = -EBADF ; -if (fd_file (neighbor)) { +if (!fd_empty (neighbor)) ret = calls->create_thread (name, flags, mode,fd_file (neighbor)); -fdput (neighbor); - } }else ret = calls->create_thread (name, flags, mode,NULL );
arch/x86/kernel/cpu/sgx/main.c +3 -7
@@ -903,19 +903,15 @@ static struct miscdevice sgx_dev_provision = {int sgx_set_attribute (unsigned long *allowed_attributes,unsigned int attribute_fd) { -struct fd f =fdget (attribute_fd); +CLASS (fd, f)(attribute_fd); -if (!fd_file (f)) +if (fd_empty (f))return -EINVAL ; -if (fd_file (f)->f_op != &sgx_provision_fops) { -fdput (f); +if (fd_file (f)->f_op != &sgx_provision_fops)return -EINVAL ; - } *allowed_attributes |=SGX_ATTR_PROVISIONKEY ; - -fdput (f);return 0 ; }EXPORT_SYMBOL_GPL (sgx_set_attribute);
arch/x86/kvm/svm/sev.c +13 -26
@@ -533,17 +533,12 @@ static int sev_bind_asid(struct kvm *kvm, unsigned int handle, int *error)static int __sev_issue_cmd (int fd,int id,void *data,int *error) { -struct fd f; -int ret; +CLASS (fd, f)(fd); - f =fdget (fd); -if (!fd_file (f)) +if (fd_empty (f))return -EBADF ; - ret =sev_issue_cmd_external_user (fd_file (f), id, data, error); - -fdput (f); -return ret; +return sev_issue_cmd_external_user (fd_file (f), id, data, error); }static int sev_issue_cmd (struct kvm *kvm,int id,void *data,int *error)
@@ -2089,23 +2084,21 @@ int sev_vm_move_enc_context_from(struct kvm *kvm, unsigned int source_fd) {struct kvm_sev_info *dst_sev = &to_kvm_svm (kvm)->sev_info;struct kvm_sev_info *src_sev, *cg_cleanup_sev; -struct fd f =fdget (source_fd); +CLASS (fd, f)(source_fd);struct kvm *source_kvm;bool charged = false;int ret; -if (!fd_file (f)) +if (fd_empty (f))return -EBADF ; -if (!file_is_kvm (fd_file (f))) { - ret = -EBADF ; - goto out_fput; - } +if (!file_is_kvm (fd_file (f))) +return -EBADF ; source_kvm =fd_file (f)->private_data; ret =sev_lock_two_vms (kvm, source_kvm);if (ret) - goto out_fput; +return ret;if (kvm->arch.vm_type != source_kvm->arch.vm_type ||sev_guest (kvm) || !sev_guest (source_kvm)) {
@@ -2152,8 +2145,6 @@ int sev_vm_move_enc_context_from(struct kvm *kvm, unsigned int source_fd) cg_cleanup_sev->misc_cg =NULL ; out_unlock:sev_unlock_two_vms (kvm, source_kvm); -out_fput: -fdput (f);return ret; }
@@ -2817,23 +2808,21 @@ int sev_mem_enc_unregister_region(struct kvm *kvm,int sev_vm_copy_enc_context_from (struct kvm *kvm,unsigned int source_fd) { -struct fd f =fdget (source_fd); +CLASS (fd, f)(source_fd);struct kvm *source_kvm;struct kvm_sev_info *source_sev, *mirror_sev;int ret; -if (!fd_file (f)) +if (fd_empty (f))return -EBADF ; -if (!file_is_kvm (fd_file (f))) { - ret = -EBADF ; - goto e_source_fput; - } +if (!file_is_kvm (fd_file (f))) +return -EBADF ; source_kvm =fd_file (f)->private_data; ret =sev_lock_two_vms (kvm, source_kvm);if (ret) - goto e_source_fput; +return ret;/* * Mirrors of mirrors should work, but let's not get silly. Also
@@ -2876,8 +2865,6 @@ int sev_vm_copy_enc_context_from(struct kvm *kvm, unsigned int source_fd) e_unlock:sev_unlock_two_vms (kvm, source_kvm); -e_source_fput: -fdput (f);return ret; }
drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c +7 -16
@@ -35,21 +35,19 @@ static int amdgpu_sched_process_priority_override(struct amdgpu_device *adev,int fd, int32_t priority) { -struct fd f =fdget (fd); +CLASS (fd ,f )(fd );struct amdgpu_fpriv *fpriv;struct amdgpu_ctx_mgr *mgr;struct amdgpu_ctx *ctx;uint32_t id;int r; -if (!fd_file (f)) +if (fd_empty (f))return -EINVAL ; r =amdgpu_file_to_fpriv (fd_file (f), &fpriv); -if (r) { -fdput (f); +if (r)return r; - } mgr = &fpriv->ctx_mgr;mutex_lock (&mgr->lock);
@@ -57,7 +55,6 @@ static int amdgpu_sched_process_priority_override(struct amdgpu_device *adev,amdgpu_ctx_priority_override (ctx, priority);mutex_unlock (&mgr->lock); -fdput (f);return 0 ; }
@@ -66,31 +63,25 @@ static int amdgpu_sched_context_priority_override(struct amdgpu_device *adev,unsigned ctx_id, int32_t priority) { -struct fd f =fdget (fd); +CLASS (fd ,f )(fd );struct amdgpu_fpriv *fpriv;struct amdgpu_ctx *ctx;int r; -if (!fd_file (f)) +if (fd_empty (f))return -EINVAL ; r =amdgpu_file_to_fpriv (fd_file (f), &fpriv); -if (r) { -fdput (f); +if (r)return r; - } ctx =amdgpu_ctx_get (fpriv, ctx_id); -if (!ctx) { -fdput (f); +if (!ctx)return -EINVAL ; - }amdgpu_ctx_priority_override (ctx, priority);amdgpu_ctx_put (ctx); -fdput (f); -return 0 ; }
drivers/gpu/drm/drm_syncobj.c +3 -6
@@ -712,16 +712,14 @@ static int drm_syncobj_fd_to_handle(struct drm_file *file_private, int fd, u32 *handle) { struct drm_syncobj *syncobj; -struct fd f =fdget (fd); +CLASS (fd, f)(fd);int ret; -if (!fd_file (f)) +if (fd_empty (f))return -EINVAL ; -if (fd_file (f)->f_op != &drm_syncobj_file_fops) { -fdput (f); +if (fd_file (f)->f_op != &drm_syncobj_file_fops)return -EINVAL ; - }/* take a reference to put in the idr */ syncobj =fd_file (f)->private_data;
@@ -739,7 +737,6 @@ static int drm_syncobj_fd_to_handle(struct drm_file *file_private, }else drm_syncobj_put (syncobj); -fdput (f);return ret; }
drivers/media/rc/lirc_dev.c +4 -9
@@ -816,28 +816,23 @@ void __exit lirc_dev_exit(void)struct rc_dev *rc_dev_get_from_fd (int fd,bool write) { -struct fd f =fdget (fd); +CLASS (fd, f)(fd);struct lirc_fh *fh;struct rc_dev *dev; -if (!fd_file (f)) +if (fd_empty (f))return ERR_PTR (-EBADF ); -if (fd_file (f)->f_op != &lirc_fops) { -fdput (f); +if (fd_file (f)->f_op != &lirc_fops)return ERR_PTR (-EINVAL ); - } -if (write && !(fd_file (f)->f_mode &FMODE_WRITE )) { -fdput (f); +if (write && !(fd_file (f)->f_mode &FMODE_WRITE ))return ERR_PTR (-EPERM ); - } fh =fd_file (f)->private_data; dev = fh->rc;get_device (&dev->dev); -fdput (f);return dev; }
fs/btrfs/ioctl.c +2 -3
@@ -1315,9 +1315,9 @@ static noinline int __btrfs_ioctl_snap_create(struct file *file, ret =btrfs_mksubvol (&file->f_path, idmap, name, namelen,NULL , readonly, inherit); }else { -struct fd src =fdget (fd); +CLASS (fd, src)(fd);struct inode *src_inode; -if (!fd_file (src)) { +if (fd_empty (src)) { ret = -EINVAL ; goto out_drop_write; }
@@ -1348,7 +1348,6 @@ static noinline int __btrfs_ioctl_snap_create(struct file *file,BTRFS_I (src_inode)->root, readonly, inherit); } -fdput (src); } out_drop_write:mnt_drop_write_file (file);
fs/eventfd.c +3 -6
@@ -347,13 +347,10 @@ EXPORT_SYMBOL_GPL(eventfd_fget);*/ struct eventfd_ctx *eventfd_ctx_fdget (int fd) { -struct eventfd_ctx *ctx; -struct fd f =fdget (fd); -if (!fd_file (f)) +CLASS (fd, f)(fd); +if (fd_empty (f))return ERR_PTR (-EBADF ); - ctx =eventfd_ctx_fileget (fd_file (f)); -fdput (f); -return ctx; +return eventfd_ctx_fileget (fd_file (f)); }EXPORT_SYMBOL_GPL (eventfd_ctx_fdget);
fs/eventpoll.c +7 -16
@@ -2207,25 +2207,22 @@ int do_epoll_ctl(int epfd, int op, int fd, struct epoll_event *epds, {int error;int full_check =0 ; -struct fd f, tf;struct eventpoll *ep;struct epitem *epi;struct eventpoll *tep =NULL ; - error = -EBADF ; - f =fdget (epfd); -if (!fd_file (f)) - goto error_return; +CLASS (fd, f)(epfd); +if (fd_empty (f)) +return -EBADF ;/* Get the "struct file *" for the target file */ - tf =fdget (fd); -if (!fd_file (tf)) - goto error_fput; +CLASS (fd, tf)(fd); +if (fd_empty (tf)) +return -EBADF ;/* The target file descriptor must support poll */ - error = -EPERM ;if (!file_can_poll (fd_file (tf))) - goto error_tgt_fput; +return -EPERM ;/* Check if EPOLLWAKEUP is allowed */ if (ep_op_has_event (op))
@@ -2344,12 +2341,6 @@ int do_epoll_ctl(int epfd, int op, int fd, struct epoll_event *epds, loop_check_gen++;mutex_unlock (&epnested_mutex); } - -fdput (tf); -error_fput: -fdput (f); -error_return: -return error; }
fs/fhandle.c +2 -3
@@ -139,12 +139,11 @@ static int get_path_from_fd(int fd, struct path *root)path_get (root);spin_unlock (&fs->lock); }else { -struct fd f =fdget (fd); -if (!fd_file (f)) +CLASS (fd, f)(fd); +if (fd_empty (f))return -EBADF ; *root =fd_file (f)->f_path;path_get (root); -fdput (f); }return 0 ;
fs/ioctl.c +8 -15
@@ -231,11 +231,11 @@ static int ioctl_fiemap(struct file *filp, struct fiemap __user *ufiemap)static long ioctl_file_clone (struct file *dst_file,unsigned long srcfd,u64 off,u64 olen,u64 destoff) { -struct fd src_file =fdget (srcfd); +CLASS (fd, src_file)(srcfd);loff_t cloned;int ret; -if (!fd_file (src_file)) +if (fd_empty (src_file))return -EBADF ; cloned =vfs_clone_file_range (fd_file (src_file), off, dst_file, destoff, olen,0 );
@@ -245,7 +245,6 @@ static long ioctl_file_clone(struct file *dst_file, unsigned long srcfd, ret = -EINVAL ; else ret =0 ; -fdput (src_file);return ret; }
@@ -892,22 +891,20 @@ static int do_vfs_ioctl(struct file *filp, unsigned int fd, SYSCALL_DEFINE3(ioctl, unsigned int, fd, unsigned int, cmd, unsigned long, arg) { -struct fd f =fdget (fd); +CLASS (fd, f)(fd);int error; -if (!fd_file (f)) +if (fd_empty (f))return -EBADF ; error =security_file_ioctl (fd_file (f), cmd, arg);if (error) - goto out; +return error; error =do_vfs_ioctl (fd_file (f), fd, cmd, arg);if (error == -ENOIOCTLCMD ) error =vfs_ioctl (fd_file (f), cmd, arg); -out: -fdput (f);return error; }
@@ -950,15 +947,15 @@ EXPORT_SYMBOL(compat_ptr_ioctl); COMPAT_SYSCALL_DEFINE3(ioctl, unsigned int, fd, unsigned int, cmd, compat_ulong_t, arg) { -struct fd f =fdget (fd); +CLASS (fd, f)(fd);int error; -if (!fd_file (f)) +if (fd_empty (f))return -EBADF ; error =security_file_ioctl_compat (fd_file (f), cmd, arg);if (error) - goto out; +return error;switch (cmd) {/* FICLONE takes an int argument, so don't use compat_ptr() */
@@ -1009,10 +1006,6 @@ COMPAT_SYSCALL_DEFINE3(ioctl, unsigned int, fd, unsigned int, cmd, error = -ENOTTY ; break; } - - out: -fdput (f); -return error; }#endif
fs/kernel_read_file.c +4 -8
@@ -175,15 +175,11 @@ ssize_t kernel_read_file_from_fd(int fd, loff_t offset, void **buf, size_t buf_size, size_t *file_size, enum kernel_read_file_id id) { - struct fd f = fdget(fd); -ssize_t ret = -EBADF ; +CLASS (fd ,f )(fd ); -if (!fd_file (f) || !(fd_file (f)->f_mode &FMODE_READ )) - goto out; +if (fd_empty (f) || !(fd_file (f)->f_mode &FMODE_READ )) +return -EBADF ; - ret =kernel_read_file (fd_file (f), offset, buf, buf_size, file_size, id); -out: -fdput (f); -return ret; +return kernel_read_file (fd_file (f), offset, buf, buf_size, file_size, id); }EXPORT_SYMBOL_GPL (kernel_read_file_from_fd);
fs/notify/fanotify/fanotify_user.c +5 -10
@@ -1014,22 +1014,17 @@ static int fanotify_find_path(int dfd, const char __user *filename, dfd, filename, flags);if (filename ==NULL ) { -struct fd f =fdget (dfd); +CLASS (fd, f)(dfd); - ret = -EBADF ; -if (!fd_file (f)) - goto out; +if (fd_empty (f)) +return -EBADF ; - ret = -ENOTDIR ;if ((flags &FAN_MARK_ONLYDIR ) && - !(S_ISDIR (file_inode (fd_file (f))->i_mode))) { -fdput (f); - goto out; - } + !(S_ISDIR (file_inode (fd_file (f))->i_mode))) +return -ENOTDIR ; *path =fd_file (f)->f_path;path_get (path); -fdput (f); }else {unsigned int lookup_flags =0 ;
fs/notify/inotify/inotify_user.c +5 -12
@@ -795,33 +795,26 @@ SYSCALL_DEFINE2(inotify_rm_watch, int, fd, __s32, wd) {struct fsnotify_group *group;struct inotify_inode_mark *i_mark; -struct fd f; -int ret = -EINVAL ; +CLASS (fd, f)(fd); - f =fdget (fd); -if (unlikely (!fd_file (f))) +if (fd_empty (f))return -EBADF ;/* verify that this is indeed an inotify instance */ if (unlikely (fd_file (f)->f_op != &inotify_fops)) - goto out; +return -EINVAL ; group =fd_file (f)->private_data; i_mark =inotify_idr_find (group, wd);if (unlikely (!i_mark)) - goto out; - - ret =0 ; +return -EINVAL ;fsnotify_destroy_mark (&i_mark->fsn_mark, group);/* match ref taken by inotify_idr_find */ fsnotify_put_mark (&i_mark->fsn_mark); - -out: -fdput (f); -return ret; +return 0 ; }/*
fs/open.c +15 -21
@@ -349,14 +349,12 @@ EXPORT_SYMBOL_GPL(vfs_fallocate);int ksys_fallocate (int fd,int mode,loff_t offset,loff_t len) { -struct fd f =fdget (fd); -int error = -EBADF ; +CLASS (fd, f)(fd); -if (fd_file (f)) { - error =vfs_fallocate (fd_file (f), mode, offset, len); -fdput (f); - } -return error; +if (fd_empty (f)) +return -EBADF ; + +return vfs_fallocate (fd_file (f), mode, offset, len); }SYSCALL_DEFINE4 (fallocate, int, fd, int, mode, loff_t, offset, loff_t, len)
@@ -671,14 +669,12 @@ int vfs_fchmod(struct file *file, umode_t mode) SYSCALL_DEFINE2(fchmod, unsigned int, fd, umode_t, mode) { -struct fd f =fdget (fd); -int err = -EBADF ; +CLASS (fd, f)(fd); -if (fd_file (f)) { - err =vfs_fchmod (fd_file (f), mode); -fdput (f); - } -return err; +if (fd_empty (f)) +return -EBADF ; + +return vfs_fchmod (fd_file (f), mode); } static int do_fchmodat(int dfd, const char __user *filename, umode_t mode,
@@ -865,14 +861,12 @@ int vfs_fchown(struct file *file, uid_t user, gid_t group)int ksys_fchown (unsigned int fd,uid_t user,gid_t group) { -struct fd f =fdget (fd); -int error = -EBADF ; +CLASS (fd, f)(fd); -if (fd_file (f)) { - error =vfs_fchown (fd_file (f), user, group); -fdput (f); - } -return error; +if (fd_empty (f)) +return -EBADF ; + +return vfs_fchown (fd_file (f), user, group); } SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group)
fs/read_write.c +9 -19
@@ -1675,36 +1675,32 @@ SYSCALL_DEFINE6(copy_file_range, int, fd_in, loff_t __user *, off_in, {loff_t pos_in;loff_t pos_out; -struct fd f_in; -struct fd f_out;ssize_t ret = -EBADF ; - f_in =fdget (fd_in); -if (!fd_file (f_in)) - goto out2; +CLASS (fd, f_in)(fd_in); +if (fd_empty (f_in)) +return -EBADF ; - f_out =fdget (fd_out); -if (!fd_file (f_out)) - goto out1; +CLASS (fd, f_out)(fd_out); +if (fd_empty (f_out)) +return -EBADF ; - ret = -EFAULT ;if (off_in) {if (copy_from_user (&pos_in, off_in,sizeof (loff_t))) - goto out; +return -EFAULT ; }else { pos_in =fd_file (f_in)->f_pos; }if (off_out) {if (copy_from_user (&pos_out, off_out,sizeof (loff_t))) - goto out; +return -EFAULT ; }else { pos_out =fd_file (f_out)->f_pos; } - ret = -EINVAL ;if (flags !=0 ) - goto out; +return -EINVAL ; ret =vfs_copy_file_range (fd_file (f_in), pos_in,fd_file (f_out), pos_out, len, flags);
@@ -1726,12 +1722,6 @@ SYSCALL_DEFINE6(copy_file_range, int, fd_in, loff_t __user *, off_in,fd_file (f_out)->f_pos = pos_out; } } - -out: -fdput (f_out); -out1: -fdput (f_in); -out2:return ret; }
fs/signalfd.c +3 -6
@@ -288,20 +288,17 @@ static int do_signalfd4(int ufd, sigset_t *mask, int flags)fd_install (ufd, file); }else { -struct fd f =fdget (ufd); -if (!fd_file (f)) +CLASS (fd, f)(ufd); +if (fd_empty (f))return -EBADF ; ctx =fd_file (f)->private_data; -if (fd_file (f)->f_op != &signalfd_fops) { -fdput (f); +if (fd_file (f)->f_op != &signalfd_fops)return -EINVAL ; - }spin_lock_irq (¤t->sighand->siglock); ctx->sigmask = *mask;spin_unlock_irq (¤t->sighand->siglock);wake_up (¤t->sighand->signalfd_wqh); -fdput (f); }return ufd;
fs/sync.c +11 -18
@@ -148,11 +148,11 @@ void emergency_sync(void)*/ SYSCALL_DEFINE1(syncfs, int, fd) { -struct fd f =fdget (fd); +CLASS (fd, f)(fd);struct super_block *sb;int ret, ret2; -if (!fd_file (f)) +if (fd_empty (f))return -EBADF ; sb =fd_file (f)->f_path.dentry->d_sb;
@@ -162,7 +162,6 @@ SYSCALL_DEFINE1(syncfs, int, fd) ret2 =errseq_check_and_advance (&sb->s_wb_err, &fd_file (f)->f_sb_err); -fdput (f);return ret ? ret : ret2; }
@@ -205,14 +204,12 @@ EXPORT_SYMBOL(vfs_fsync);static int do_fsync (unsigned int fd,int datasync) { -struct fd f =fdget (fd); -int ret = -EBADF ; +CLASS (fd, f)(fd); -if (fd_file (f)) { - ret =vfs_fsync (fd_file (f), datasync); -fdput (f); - } -return ret; +if (fd_empty (f)) +return -EBADF ; + +return vfs_fsync (fd_file (f), datasync); } SYSCALL_DEFINE1(fsync, unsigned int, fd)
@@ -355,16 +352,12 @@ int sync_file_range(struct file *file, loff_t offset, loff_t nbytes,int ksys_sync_file_range (int fd,loff_t offset,loff_t nbytes,unsigned int flags) { -int ret; -struct fd f; +CLASS (fd, f)(fd); - ret = -EBADF ; - f =fdget (fd); -if (fd_file (f)) - ret =sync_file_range (fd_file (f), offset, nbytes, flags); +if (fd_empty (f)) +return -EBADF ; -fdput (f); -return ret; +return sync_file_range (fd_file (f), offset, nbytes, flags); } SYSCALL_DEFINE4(sync_file_range, int, fd, loff_t, offset, loff_t, nbytes,
io_uring/sqpoll.c +8 -21
@@ -115,29 +115,21 @@ static struct io_sq_data *io_attach_sq_data(struct io_uring_params *p) {struct io_ring_ctx *ctx_attach;struct io_sq_data *sqd; -struct fd f; +CLASS (fd, f)(p->wq_fd); - f =fdget (p->wq_fd); -if (!fd_file (f)) +if (fd_empty (f))return ERR_PTR (-ENXIO ); -if (!io_is_uring_fops (fd_file (f))) { -fdput (f); +if (!io_is_uring_fops (fd_file (f)))return ERR_PTR (-EINVAL ); - } ctx_attach =fd_file (f)->private_data; sqd = ctx_attach->sq_data; -if (!sqd) { -fdput (f); +if (!sqd)return ERR_PTR (-EINVAL ); - } -if (sqd->task_tgid != current->tgid) { -fdput (f); +if (sqd->task_tgid != current->tgid)return ERR_PTR (-EPERM ); - }refcount_inc (&sqd->refs); -fdput (f);return sqd; }
@@ -456,16 +448,11 @@ __cold int io_sq_offload_create(struct io_ring_ctx *ctx,/* Retain compatibility with failing for an invalid attach attempt */ if ((ctx->flags & (IORING_SETUP_ATTACH_WQ |IORING_SETUP_SQPOLL )) ==IORING_SETUP_ATTACH_WQ ) { -struct fd f; - - f =fdget (p->wq_fd); -if (!fd_file (f)) +CLASS (fd, f)(p->wq_fd); +if (fd_empty (f))return -ENXIO ; -if (!io_is_uring_fops (fd_file (f))) { -fdput (f); +if (!io_is_uring_fops (fd_file (f)))return -EINVAL ; - } -fdput (f); }if (ctx->flags &IORING_SETUP_SQPOLL ) {struct task_struct *tsk;
kernel/events/core.c +5 -9
@@ -984,22 +984,20 @@ static inline int perf_cgroup_connect(int fd, struct perf_event *event, {struct perf_cgroup *cgrp;struct cgroup_subsys_state *css; -struct fd f =fdget (fd); +CLASS (fd, f)(fd);int ret =0 ; -if (!fd_file (f)) +if (fd_empty (f))return -EBADF ; css =css_tryget_online_from_dir (fd_file (f)->f_path.dentry, &perf_event_cgrp_subsys); -if (IS_ERR (css)) { - ret =PTR_ERR (css); - goto out; - } +if (IS_ERR (css)) +return PTR_ERR (css); ret =perf_cgroup_ensure_storage (event, css);if (ret) - goto out; +return ret; cgrp = container_of(css, struct perf_cgroup, css); event->cgrp = cgrp;
@@ -1013,8 +1011,6 @@ static inline int perf_cgroup_connect(int fd, struct perf_event *event,perf_detach_cgroup (event); ret = -EINVAL ; } -out: -fdput (f);return ret; }
kernel/nsproxy.c +2 -3
@@ -545,12 +545,12 @@ static void commit_nsset(struct nsset *nsset) SYSCALL_DEFINE2(setns, int, fd, int, flags) { -struct fd f =fdget (fd); +CLASS (fd, f)(fd);struct ns_common *ns =NULL ;struct nsset nsset = {};int err =0 ; -if (!fd_file (f)) +if (fd_empty (f))return -EBADF ;if (proc_ns_file (fd_file (f))) {
@@ -580,7 +580,6 @@ SYSCALL_DEFINE2(setns, int, fd, int, flags) }put_nsset (&nsset); out: -fdput (f);return err; }
kernel/pid.c +2 -5
@@ -536,11 +536,10 @@ EXPORT_SYMBOL_GPL(find_ge_pid);struct pid *pidfd_get_pid (unsigned int fd,unsigned int *flags) { -struct fd f; +CLASS (fd, f)(fd);struct pid *pid; - f =fdget (fd); -if (!fd_file (f)) +if (fd_empty (f))return ERR_PTR (-EBADF ); pid =pidfd_pid (fd_file (f));
@@ -548,8 +547,6 @@ struct pid *pidfd_get_pid(unsigned int fd, unsigned int *flags)get_pid (pid); *flags =fd_file (f)->f_flags; } - -fdput (f);return pid; }
kernel/sys.c +5 -10
@@ -1929,12 +1929,11 @@ SYSCALL_DEFINE1(umask, int, mask)static int prctl_set_mm_exe_file (struct mm_struct *mm,unsigned int fd) { -struct fd exe; +CLASS (fd, exe)(fd);struct inode *inode;int err; - exe =fdget (fd); -if (!fd_file (exe)) +if (fd_empty (exe))return -EBADF ; inode =file_inode (fd_file (exe));
@@ -1944,18 +1943,14 @@ static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)* sure that this one is executable as well, to avoid breaking an * overall picture. */ - err = -EACCES ;if (!S_ISREG (inode->i_mode) ||path_noexec (&fd_file (exe)->f_path)) - goto exit; +return -EACCES ; err =file_permission (fd_file (exe),MAY_EXEC );if (err) - goto exit; +return err; - err =replace_mm_exe_file (mm,fd_file (exe)); -exit: -fdput (exe); -return err; +return replace_mm_exe_file (mm,fd_file (exe)); }/*
kernel/watch_queue.c +2 -4
@@ -672,16 +672,14 @@ struct watch_queue *get_watch_queue(int fd) {struct pipe_inode_info *pipe;struct watch_queue *wqueue =ERR_PTR (-EINVAL ); -struct fd f; +CLASS (fd, f)(fd); - f =fdget (fd); -if (fd_file (f)) { +if (!fd_empty (f)) { pipe =get_pipe_info (fd_file (f), false);if (pipe && pipe->watch_queue) { wqueue = pipe->watch_queue;kref_get (&wqueue->usage); } -fdput (f); }return wqueue;
mm/fadvise.c +3 -7
@@ -190,16 +190,12 @@ EXPORT_SYMBOL(vfs_fadvise);int ksys_fadvise64_64 (int fd,loff_t offset,loff_t len,int advice) { -struct fd f =fdget (fd); -int ret; +CLASS (fd, f)(fd); -if (!fd_file (f)) +if (fd_empty (f))return -EBADF ; - ret =vfs_fadvise (fd_file (f), offset, len, advice); - -fdput (f); -return ret; +return vfs_fadvise (fd_file (f), offset, len, advice); }SYSCALL_DEFINE4 (fadvise64_64, int, fd, loff_t, offset, loff_t, len, int, advice)
mm/readahead.c +5 -12
@@ -676,29 +676,22 @@ EXPORT_SYMBOL_GPL(page_cache_async_ra);ssize_t ksys_readahead (int fd,loff_t offset,size_t count) { -ssize_t ret; -struct fd f; +CLASS (fd, f)(fd); - ret = -EBADF ; - f =fdget (fd); -if (!fd_file (f) || !(fd_file (f)->f_mode &FMODE_READ )) - goto out; +if (fd_empty (f) || !(fd_file (f)->f_mode &FMODE_READ )) +return -EBADF ;/* * The readahead() syscall is intended to run only on files * that can execute readahead. If readahead is not possible * on this file, then we must return -EINVAL. */ - ret = -EINVAL ;if (!fd_file (f)->f_mapping || !fd_file (f)->f_mapping->a_ops || (!S_ISREG (file_inode (fd_file (f))->i_mode) && !S_ISBLK (file_inode (fd_file (f))->i_mode))) - goto out; +return -EINVAL ; - ret =vfs_fadvise (fd_file (f), offset, count,POSIX_FADV_WILLNEED ); -out: -fdput (f); -return ret; +return vfs_fadvise (fd_file (f), offset, count,POSIX_FADV_WILLNEED ); }SYSCALL_DEFINE3 (readahead, int, fd, loff_t, offset, size_t, count)
net/core/net_namespace.c +4 -6
@@ -712,20 +712,18 @@ EXPORT_SYMBOL_GPL(get_net_ns);struct net *get_net_ns_by_fd (int fd) { -struct fd f =fdget (fd); -struct net *net =ERR_PTR (-EINVAL ); +CLASS (fd, f)(fd); -if (!fd_file (f)) +if (fd_empty (f))return ERR_PTR (-EBADF );if (proc_ns_file (fd_file (f))) {struct ns_common *ns =get_proc_ns (file_inode (fd_file (f)));if (ns->ops == &netns_operations) - net = get_net(container_of(ns, struct net, ns)); + return get_net(container_of(ns, struct net, ns)); } -fdput (f); -return net; +return ERR_PTR (-EINVAL ); }EXPORT_SYMBOL_GPL (get_net_ns_by_fd);#endif
security/landlock/syscalls.c +8 -18
@@ -255,31 +255,21 @@ const int landlock_abi_version = LANDLOCK_ABI_VERSION;static struct landlock_ruleset *get_ruleset_from_fd (const int fd,const fmode_t mode) { -struct fd ruleset_f; +CLASS (fd, ruleset_f)(fd);struct landlock_ruleset *ruleset; - ruleset_f =fdget (fd); -if (!fd_file (ruleset_f)) +if (fd_empty (ruleset_f))return ERR_PTR (-EBADF );/* Checks FD type and access right. */ -if (fd_file (ruleset_f)->f_op != &ruleset_fops) { - ruleset =ERR_PTR (-EBADFD ); - goto out_fdput; - } -if (!(fd_file (ruleset_f)->f_mode & mode)) { - ruleset =ERR_PTR (-EPERM ); - goto out_fdput; - } +if (fd_file (ruleset_f)->f_op != &ruleset_fops) +return ERR_PTR (-EBADFD ); +if (!(fd_file (ruleset_f)->f_mode & mode)) +return ERR_PTR (-EPERM ); ruleset =fd_file (ruleset_f)->private_data; -if (WARN_ON_ONCE (ruleset->num_layers !=1 )) { - ruleset =ERR_PTR (-EINVAL ); - goto out_fdput; - } +if (WARN_ON_ONCE (ruleset->num_layers !=1 )) +return ERR_PTR (-EINVAL );landlock_get_ruleset (ruleset); - -out_fdput: -fdput (ruleset_f);return ruleset; }
virt/kvm/vfio.c +2 -6
@@ -190,11 +190,10 @@ static int kvm_vfio_file_del(struct kvm_device *dev, unsigned int fd) {struct kvm_vfio *kv = dev->private;struct kvm_vfio_file *kvf; -struct fd f; +CLASS (fd, f)(fd);int ret; - f =fdget (fd); -if (!fd_file (f)) +if (fd_empty (f))return -EBADF ; ret = -ENOENT ;
@@ -220,9 +219,6 @@ static int kvm_vfio_file_del(struct kvm_device *dev, unsigned int fd)kvm_vfio_update_coherency (dev);mutex_unlock (&kv->lock); - -fdput (f); -return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 254/666 fanotify: call fanotify_events_supported() before path_permission() and security_path_notify()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Mosnacek <[email protected]>
[ Upstream commit 66052a768d4726a31e939b5ac902f2b0b452c8d5 ]
The latter trigger LSM (e.g. SELinux) checks, which will log a denial when permission is denied, so it's better to do them after validity checks to avoid logging a denial when the operation would fail anyway.
--- fs/notify/fanotify/fanotify_user.c | 25 ++++++++++--------------- 1 file changed, 10 insertions(+), 15 deletions(-)
fs/notify/fanotify/fanotify_user.c +10 -15
@@ -1025,6 +1025,7 @@ static int fanotify_find_path(int dfd, const char __user *filename, *path =fd_file (f)->f_path;path_get (path); + ret =0 ; }else {unsigned int lookup_flags =0 ;
@@ -1034,22 +1035,7 @@ static int fanotify_find_path(int dfd, const char __user *filename, lookup_flags |=LOOKUP_DIRECTORY ; ret =user_path_at (dfd, filename, lookup_flags, path); -if (ret) - goto out; - } - -/* you can only watch an inode if you have read permissions on it */ - ret =path_permission (path,MAY_READ ); -if (ret) { -path_put (path); - goto out; } - - ret =security_path_notify (path, mask, obj_type); -if (ret) -path_put (path); - -out:return ret; }
@@ -1841,6 +1827,15 @@ static int do_fanotify_mark(int fanotify_fd, unsigned int flags, __u64 mask, goto path_put_and_out; } +/* you can only watch an inode if you have read permissions on it */ + ret =path_permission (&path,MAY_READ ); +if (ret) + goto path_put_and_out; + + ret =security_path_notify (&path, mask, obj_type); +if (ret) + goto path_put_and_out; +if (fid_mode) { ret =fanotify_test_fsid (path.dentry, flags, &__fsid);if (ret)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 255/666 ktest: Avoid undef warning when WARNINGS_FILE is unset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <[email protected]>
[ Upstream commit 057854f8a595160656fe77ed7bf0d2403724b915 ]
check_buildlog() probes $warnings_file with -f even when WARNINGS_FILE is not configured. Perl warns about the uninitialized value and adds noise to the test log, which can hide the output we actually care about.
Check that WARNINGS_FILE is defined before testing whether the file exists.
--- tools/testing/ktest/ktest.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/ktest/ktest.pl +1 -1
@@ -2483,7 +2483,7 @@ sub check_buildlog { my $save_no_reboot = $no_reboot; $no_reboot = 1; - if (-f $warnings_file) { + if (defined($warnings_file) && -f $warnings_file) { open(IN, $warnings_file) or dodie "Error opening $warnings_file";
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 256/666 ktest: Honor empty per-test option overrides
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <[email protected]>
[ Upstream commit a2de57a3c8192dcd67cccaff6c341b93748d799b ]
A per-test override can clear an inherited default option by assigning an empty value, but __set_test_option() still used option_defined() to decide whether a per-test key existed. That turned an empty per-test assignment back into "fall back to the default", so tests still could not clear inherited settings.
For example:
DEFAULTS
(...)
LOG_FILE = /tmp/ktest-empty-override.log
CLEAR_LOG = 1
ADD_CONFIG = /tmp/.config
TEST_START
TEST_TYPE = build
BUILD_TYPE = nobuild
ADD_CONFIG =
This would run the test with ADD_CONFIG[1] = /tmp/.config
Fix by checking whether the per-test key exists before falling back. If it does exist but is empty, treat it as unset for that test and stop the fallback chain there.
--- tools/testing/ktest/ktest.pl | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
tools/testing/ktest/ktest.pl +4 -2
@@ -4127,7 +4127,8 @@ sub __set_test_option { my $option = "$name\[$i\]"; - if (option_defined($option)) { + if (exists($opt{$option})) { + return undef if (!option_defined($option)); return $opt{$option}; }
@@ -4135,7 +4136,8 @@ sub __set_test_option { if ($i >= $test && $i < $test + $repeat_tests{$test}) { $option = "$name\[$test\]"; - if (option_defined($option)) { + if (exists($opt{$option})) { + return undef if (!option_defined($option)); return $opt{$option}; } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 257/666 ktest: Run POST_KTEST hooks on failure and cancellation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <[email protected]>
[ Upstream commit bc6e165a452da909cef0efbc286e6695624db372 ]
PRE_KTEST can be useful for setting up the environment and POST_KTEST to tear it down, however POST_KTEST only runs on the normal end-of-run path. It is skipped when ktest exits through dodie() or cancel_test(). Final cleanup hooks are skipped.
Factor the final hook execution into run_post_ktest(), call it from the normal exit path and from the early exit paths, and guard it so the hook runs at most once.
--- tools/testing/ktest/ktest.pl | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-)
tools/testing/ktest/ktest.pl +22 -5
@@ -98,6 +98,7 @@ my $test_type; my $build_type; my $build_options; my $final_post_ktest; +my $post_ktest_done = 0; my $pre_ktest; my $post_ktest; my $pre_test;
@@ -1550,6 +1551,24 @@ sub get_test_name() { return $name; } +sub run_post_ktest { + my $cmd; + + return if ($post_ktest_done); + + if (defined($final_post_ktest)) { + $cmd = $final_post_ktest; + } elsif (defined($post_ktest)) { + $cmd = $post_ktest; + } else { + return; + } + + my $cp_post_ktest = eval_kernel_version($cmd); + run_command $cp_post_ktest; + $post_ktest_done = 1; +} + sub dodie { # avoid recursion return if ($in_die);
@@ -1609,6 +1628,7 @@ sub dodie { if (defined($post_test)) { run_command $post_test; } + run_post_ktest; die @_, "\n"; }
@@ -4244,6 +4264,7 @@ sub cancel_test { send_email("KTEST: Your [$name] test was cancelled", "Your test started at $script_start_time was cancelled: sig int"); } + run_post_ktest; die "\nCaught Sig Int, test interrupted: $!\n" }
@@ -4554,11 +4575,7 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) { success $i; } -if (defined($final_post_ktest)) { - - my $cp_final_post_ktest = eval_kernel_version $final_post_ktest; - run_command $cp_final_post_ktest; -} +run_post_ktest; if ($opt{"POWEROFF_ON_SUCCESS"}) { halt;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 258/666 quota: Fix race of dquot_scan_active() with quota deactivation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit e93ab401da4b2e2c1b8ef2424de2f238d51c8b2d ]
dquot_scan_active() can race with quota deactivation in quota_release_workfn() like:
CPU0 (quota_release_workfn) CPU1 (dquot_scan_active)
============================== ==============================
spin_lock(&dq_list_lock);
list_replace_init(
&releasing_dquots, &rls_head);
/* dquot X on rls_head,
dq_count == 0,
DQ_ACTIVE_B still set */
spin_unlock(&dq_list_lock);
synchronize_srcu(&dquot_srcu);
spin_lock(&dq_list_lock);
list_for_each_entry(dquot,
&inuse_list, dq_inuse) {
/* finds dquot X */
dquot_active(X) -> true
atomic_inc(&X->dq_count);
}
spin_unlock(&dq_list_lock);
spin_lock(&dq_list_lock);
dquot = list_first_entry(&rls_head);
WARN_ON_ONCE(atomic_read(&dquot->dq_count));The problem is not only a cosmetic one as under memory pressure the caller of dquot_scan_active() can end up working on freed dquot.
Fix the problem by making sure the dquot is removed from releasing list when we acquire a reference to it.
--- fs/quota/dquot.c | 38 ++++++++++++++++++++++++++++++-------- include/linux/quotaops.h | 9 +-------- 2 files changed, 31 insertions(+), 16 deletions(-)
fs/quota/dquot.c +30 -8
@@ -364,6 +364,31 @@ static inline int dquot_active(struct dquot *dquot)return test_bit (DQ_ACTIVE_B , &dquot->dq_flags); } +static struct dquot *__dqgrab (struct dquot *dquot) +{ +lockdep_assert_held (&dq_list_lock); +if (!atomic_read (&dquot->dq_count)) +remove_free_dquot (dquot); +atomic_inc (&dquot->dq_count); +return dquot; +} + +/* +* Get reference to dquot when we got pointer to it by some other means. The +* dquot has to be active and the caller has to make sure it cannot get +* deactivated under our hands. +*/ +struct dquot *dqgrab (struct dquot *dquot) +{ +spin_lock (&dq_list_lock); +WARN_ON_ONCE (!dquot_active (dquot)); + dquot =__dqgrab (dquot); +spin_unlock (&dq_list_lock); + +return dquot; +} +EXPORT_SYMBOL_GPL (dqgrab); +static inline int dquot_dirty (struct dquot *dquot) {return test_bit (DQ_MOD_B , &dquot->dq_flags);
@@ -642,15 +667,14 @@ int dquot_scan_active(struct super_block *sb,continue ;if (dquot->dq_sb != sb)continue ; -/* Now we have active dquot so we can just increase use count */ -atomic_inc (&dquot->dq_count); +__dqgrab (dquot);spin_unlock (&dq_list_lock);dqput (old_dquot); old_dquot = dquot;/* * ->release_dquot() can be racing with us. Our reference -* protects us from new calls to it so just wait for any -* outstanding call and recheck the DQ_ACTIVE_B after that. +* protects us from dquot_release() proceeding so just wait for +* any outstanding call and recheck the DQ_ACTIVE_B after that. */ wait_on_dquot (dquot);if (dquot_active (dquot)) {
@@ -718,7 +742,7 @@ int dquot_writeback_dquots(struct super_block *sb, int type)/* Now we have active dquot from which someone is * holding reference so we can safely just increase * use count */ -dqgrab (dquot); +__dqgrab (dquot);spin_unlock (&dq_list_lock); err =dquot_write_dquot (dquot);if (err && !ret)
@@ -964,9 +988,7 @@ struct dquot *dqget(struct super_block *sb, struct kqid qid)spin_unlock (&dq_list_lock);dqstats_inc (DQST_LOOKUPS ); }else { -if (!atomic_read (&dquot->dq_count)) -remove_free_dquot (dquot); -atomic_inc (&dquot->dq_count); +__dqgrab (dquot);spin_unlock (&dq_list_lock);dqstats_inc (DQST_CACHE_HITS );dqstats_inc (DQST_LOOKUPS );
include/linux/quotaops.h +1 -8
@@ -44,14 +44,7 @@ int dquot_initialize(struct inode *inode);bool dquot_initialize_needed (struct inode *inode);void dquot_drop (struct inode *inode);struct dquot *dqget (struct super_block *sb,struct kqid qid); -static inline struct dquot *dqgrab (struct dquot *dquot) -{ -/* Make sure someone else has active reference to dquot */ -WARN_ON_ONCE (!atomic_read (&dquot->dq_count)); -WARN_ON_ONCE (!test_bit (DQ_ACTIVE_B , &dquot->dq_flags)); -atomic_inc (&dquot->dq_count); -return dquot; -} +struct dquot *dqgrab (struct dquot *dquot);static inline bool dquot_is_busy (struct dquot *dquot) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 259/666 gfs2: add some missing log locking
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit fe2c8d051150b90b3ccb85f89e3b1d636cb88ec8 ]
Function gfs2_logd() calls the log flushing functions gfs2_ail1_start(), gfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp->sd_log_flush_lock, but these functions require exclusion against concurrent transactions.
To fix that, add a non-locking __gfs2_log_flush() function. Then, in gfs2_logd(), take sdp->sd_log_flush_lock before calling the above mentioned log flushing functions and __gfs2_log_flush().
--- fs/gfs2/log.c | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-)
fs/gfs2/log.c +20 -8
@@ -1027,14 +1027,15 @@ static void trans_drain(struct gfs2_trans *tr) }/** -* gfs2_log_flush - flush incore transaction(s) +* __gfs2_log_flush - flush incore transaction(s) * @sdp: The filesystem * @gl: The glock structure to flush. If NULL, flush the whole incore log * @flags: The log header flags: GFS2_LOG_HEAD_FLUSH_* and debug flags * */ -void gfs2_log_flush (struct gfs2_sbd *sdp,struct gfs2_glock *gl,u32 flags) +static void __gfs2_log_flush (struct gfs2_sbd *sdp,struct gfs2_glock *gl, +u32 flags) {struct gfs2_trans *tr =NULL ;unsigned int reserved_blocks =0 , used_blocks =0 ;
@@ -1042,7 +1043,6 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags)unsigned int first_log_head;unsigned int reserved_revokes =0 ; -down_write (&sdp->sd_log_flush_lock);trace_gfs2_log_flush (sdp,1 , flags); repeat:
@@ -1154,7 +1154,6 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags)gfs2_assert_withdraw_delayed (sdp, used_blocks < reserved_blocks);gfs2_log_release (sdp, reserved_blocks - used_blocks); } -up_write (&sdp->sd_log_flush_lock);gfs2_trans_free (sdp, tr);if (gfs2_withdrawing (sdp))gfs2_withdraw (sdp);
@@ -1177,6 +1176,13 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags) goto out_end; } +void gfs2_log_flush (struct gfs2_sbd *sdp,struct gfs2_glock *gl,u32 flags) +{ +down_write (&sdp->sd_log_flush_lock); +__gfs2_log_flush (sdp, gl, flags); +up_write (&sdp->sd_log_flush_lock); +} +/** * gfs2_merge_trans - Merge a new transaction into a cached transaction * @sdp: the filesystem
@@ -1319,19 +1325,25 @@ int gfs2_logd(void *data) }if (gfs2_jrnl_flush_reqd (sdp) || t ==0 ) { +down_write (&sdp->sd_log_flush_lock);gfs2_ail1_empty (sdp,0 ); -gfs2_log_flush (sdp,NULL ,GFS2_LOG_HEAD_FLUSH_NORMAL | -GFS2_LFC_LOGD_JFLUSH_REQD ); +__gfs2_log_flush (sdp,NULL , +GFS2_LOG_HEAD_FLUSH_NORMAL | +GFS2_LFC_LOGD_JFLUSH_REQD ); +up_write (&sdp->sd_log_flush_lock); }if (test_bit (SDF_FORCE_AIL_FLUSH , &sdp->sd_flags) ||gfs2_ail_flush_reqd (sdp)) {clear_bit (SDF_FORCE_AIL_FLUSH , &sdp->sd_flags); +down_write (&sdp->sd_log_flush_lock);gfs2_ail1_start (sdp);gfs2_ail1_wait (sdp);gfs2_ail1_empty (sdp,0 ); -gfs2_log_flush (sdp,NULL ,GFS2_LOG_HEAD_FLUSH_NORMAL | -GFS2_LFC_LOGD_AIL_FLUSH_REQD ); +__gfs2_log_flush (sdp,NULL , +GFS2_LOG_HEAD_FLUSH_NORMAL | +GFS2_LFC_LOGD_AIL_FLUSH_REQD ); +up_write (&sdp->sd_log_flush_lock); } t =gfs2_tune_get (sdp, gt_logd_secs) *HZ ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 260/666 gfs2: prevent NULL pointer dereference during unmount
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit 74b4dbb946060a3233604d91859a9abd3708141d ]
When flushing out outstanding glock work during an unmount, gfs2_log_flush() can be called when sdp->sd_jdesc has already been deallocated and sdp->sd_jdesc is NULL. Commit 35264909e9d1 ("gfs2: Fix NULL pointer dereference in gfs2_log_flush") added a check for that to gfs2_log_flush() itself, but it missed the sdp->sd_jdesc dereference in gfs2_log_release(). Fix that.
--- fs/gfs2/log.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/gfs2/log.c +3 -2
@@ -471,8 +471,9 @@ void gfs2_log_release(struct gfs2_sbd *sdp, unsigned int blks) {atomic_add (blks, &sdp->sd_log_blks_free);trace_gfs2_log_blocks (sdp, blks); -gfs2_assert_withdraw (sdp,atomic_read (&sdp->sd_log_blks_free) <= - sdp->sd_jdesc->jd_blocks); +gfs2_assert_withdraw (sdp, !sdp->sd_jdesc || +atomic_read (&sdp->sd_log_blks_free) <= + sdp->sd_jdesc->jd_blocks);if (atomic_read (&sdp->sd_log_blks_needed))wake_up (&sdp->sd_log_waitq); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 261/666 efi/capsule-loader: fix incorrect sizeof in phys array reallocation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Huth <[email protected]>
[ Upstream commit 48a428215782321b56956974f23593e40ce84b7a ]
The krealloc() call for cap_info->phys in __efi_capsule_setup_info() uses sizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be causing an undersized allocation.
The allocation is also inconsistent with the initial array allocation in efi_capsule_open() that allocates one entry with sizeof(phys_addr_t), and the efi_capsule_write() function that stores phys_addr_t values (not pointers) via page_to_phys().
On 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this goes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but pointers are 32-bit, this allocates half the required space, which might lead to a heap buffer overflow when storing physical addresses.
This is similar to the bug fixed in commit fccfa646ef36 ("efi/capsule-loader:
fix incorrect allocation size") which fixed the same issue at the initial allocation site.
--- drivers/firmware/efi/capsule-loader.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/efi/capsule-loader.c +1 -1
@@ -67,7 +67,7 @@ int __efi_capsule_setup_info(struct capsule_info *cap_info) cap_info->pages = temp_page; temp_page =krealloc (cap_info->phys, - pages_needed *sizeof (phys_addr_t *), + pages_needed *sizeof (phys_addr_t),GFP_KERNEL | __GFP_ZERO);if (!temp_page)return -ENOMEM ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 262/666 ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Klinesmith <[email protected]>
[ Upstream commit 3e298897f41c61450c2e7a4f457e8b2485eb35b3 ]
ksmbd_crypt_message() sets a NULL completion callback on AEAD requests and does not handle the -EINPROGRESS return code from async hardware crypto engines like the Qualcomm Crypto Engine (QCE). When QCE returns -EINPROGRESS, ksmbd treats it as an error and immediately frees the request while the hardware DMA operation is still in flight. The DMA completion callback then dereferences freed memory, causing a NULL pointer crash:
pc : qce_skcipher_done+0x24/0x174 lr : vchan_complete+0x230/0x27c ... el1h_64_irq+0x68/0x6c ksmbd_free_work_struct+0x20/0x118 [ksmbd] ksmbd_exit_file_cache+0x694/0xa4c [ksmbd]
Use the standard crypto_wait_req() pattern with crypto_req_done() as the completion callback, matching the approach used by the SMB client in fs/smb/client/smb2ops.c. This properly handles both synchronous engines (immediate return) and async engines (-EINPROGRESS followed by callback notification).
--- fs/smb/server/auth.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
fs/smb/server/auth.c +6 -5
@@ -1111,6 +1111,7 @@ int ksmbd_crypt_message(struct ksmbd_work *work, struct kvec *iov,struct smb2_transform_hdr *tr_hdr =smb2_get_msg (iov[0 ].iov_base);unsigned int assoc_data_len =sizeof (struct smb2_transform_hdr ) -20 ;int rc; +DECLARE_CRYPTO_WAIT (wait);struct scatterlist *sg;u8 sign[SMB2_SIGNATURE_SIZE ] = {};u8 key[SMB3_ENC_DEC_KEY_SIZE ];
@@ -1197,12 +1198,12 @@ int ksmbd_crypt_message(struct ksmbd_work *work, struct kvec *iov,aead_request_set_crypt (req, sg, sg, crypt_len, iv);aead_request_set_ad (req, assoc_data_len); -aead_request_set_callback (req,CRYPTO_TFM_REQ_MAY_SLEEP ,NULL ,NULL ); +aead_request_set_callback (req,CRYPTO_TFM_REQ_MAY_BACKLOG | +CRYPTO_TFM_REQ_MAY_SLEEP , + crypto_req_done, &wait); -if (enc) - rc =crypto_aead_encrypt (req); -else - rc =crypto_aead_decrypt (req); + rc =crypto_wait_req (enc ?crypto_aead_encrypt (req) : +crypto_aead_decrypt (req), &wait);if (rc) goto free_iv;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 263/666 arm64: dts: mediatek: mt8365: Describe infracfg-nao as a pure syscon
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nícolas F. R. A. Prado <[email protected]>
[ Upstream commit 0651c24658360706c30588cec0a12c05edb03e9a ]
The infracfg-nao register space at 0x1020e000 has different registers than the infracfg space at 0x10001000, and most importantly, doesn't contain any clock controls. Therefore it shouldn't use the same compatible used for the mt8365 infracfg clocks driver:
mediatek,mt8365-infracfg. Since it currently does, probe errors are reported in the kernel logs:
[ 0.245959] Failed to register clk ifr_pmic_tmr: -EEXIST [ 0.245998] clk-mt8365 1020e000.infracfg: probe with driver clk-mt8365 failed with error -17
This register space is used only as a syscon for bus control by the power domain controller, so in order to properly describe it and fix the errors, set its compatible to a distinct compatible used exclusively as a syscon, drop the clock-cells, and while at it rename the node to 'syscon' following the naming convention.
--- arch/arm64/boot/dts/mediatek/mt8365.dtsi | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
arch/arm64/boot/dts/mediatek/mt8365.dtsi +2 -3
@@ -481,10 +481,9 @@ iommu: iommu@10205000 { #iommu-cells = <1>; }; - infracfg_nao: infracfg@1020e000 { - compatible = "mediatek,mt8365-infracfg", "syscon"; + infracfg_nao: syscon@1020e000 { + compatible = "mediatek,mt8365-infracfg-nao", "syscon"; reg = <0 0x1020e000 0 0x1000>; - #clock-cells = <1>; }; rng: rng@1020f000 {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 264/666 ARM: dts: mediatek: mt7623: fix efuse fallback compatible
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit 5978ff33cc6f0988388a2830dc5cd2ea4e81f36a ]
Fix following validation error:arch/arm/boot/dts/mediatek/mt7623a-rfb-emmc.dtb: efuse@10206000: compatible: 'oneOf' conditional failed, one must be fixed:
['mediatek,mt7623-efuse', 'mediatek,mt8173-efuse'] is too long
'mediatek,mt8173-efuse' was expected
'mediatek,efuse' was expected
from schema $id: http://devicetree.org/schemas/nvmem/mediatek,efuse.yaml#arch/arm/boot/dts/mediatek/mt7623a-rfb-emmc.dtb: efuse@10206000: Unevaluated properties are not allowed ('compatible' was unexpected)
from schema $id: http://devicetree.org/schemas/nvmem/mediatek,efuse.yaml#
--- arch/arm/boot/dts/mediatek/mt7623.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/mediatek/mt7623.dtsi +1 -1
@@ -328,7 +328,7 @@ sysirq: interrupt-controller@10200100 { efuse: efuse@10206000 { compatible = "mediatek,mt7623-efuse", - "mediatek,mt8173-efuse"; + "mediatek,efuse"; reg = <0 0x10206000 0 0x1000>; #address-cells = <1>; #size-cells = <1>;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 265/666 memory: tegra124-emc: Fix dll_change check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Perttunen <[email protected]>
[ Upstream commit 9597ab9a8296ab337e6820f8a717ff621078b632 ]
The code checking whether the specified memory timing enables DLL in the EMRS register was reversed. DLL is enabled if bit A0 is low. Fix the check.
--- drivers/memory/tegra/tegra124-emc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/memory/tegra/tegra124-emc.c +1 -1
@@ -608,7 +608,7 @@ static int tegra_emc_prepare_timing_change(struct tegra_emc *emc,if ((last->emc_mode_1 &0x1 ) == (timing->emc_mode_1 &0x1 )) dll_change =DLL_CHANGE_NONE ; -else if (timing->emc_mode_1 &0x1 ) +else if (!(timing->emc_mode_1 &0x1 )) dll_change =DLL_CHANGE_ON ;else dll_change =DLL_CHANGE_OFF ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 266/666 memory: tegra30-emc: Fix dll_change check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Perttunen <[email protected]>
[ Upstream commit 0a93f2355cf4922ad2399dbef5ea1049fef116d4 ]
The code checking whether the specified memory timing enables DLL in the EMRS register was reversed. DLL is enabled if bit A0 is low. Fix the check.
--- drivers/memory/tegra/tegra30-emc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/memory/tegra/tegra30-emc.c +3 -3
@@ -554,14 +554,14 @@ static int emc_prepare_timing_change(struct tegra_emc *emc, unsigned long rate) emc->emc_cfg =readl_relaxed (emc->regs +EMC_CFG ); emc_dbg =readl_relaxed (emc->regs +EMC_DBG ); -if (emc->dll_on == !!(timing->emc_mode_1 &0x1 )) +if (emc->dll_on == !(timing->emc_mode_1 &0x1 )) dll_change =DLL_CHANGE_NONE ; -else if (timing->emc_mode_1 &0x1 ) +else if (!(timing->emc_mode_1 &0x1 )) dll_change =DLL_CHANGE_ON ;else dll_change =DLL_CHANGE_OFF ; - emc->dll_on = !!(timing->emc_mode_1 &0x1 ); + emc->dll_on = !(timing->emc_mode_1 &0x1 );if (timing->data[80 ] && !readl_relaxed (emc->regs +EMC_ZCAL_INTERVAL )) emc->zcal_long = true;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 267/666 arm64: dts: imx8-apalis: Fix LEDs name collision
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <[email protected]>
[ Upstream commit 92ab53b9bb2a72581c32073755077af916eb9aee ]
Ixora boards have multiple instances of status leds, to avoid a name collision add the function-enumerator property.
This fixes the following Linux kernel warnings:
leds-gpio leds: Led green:status renamed to green:status_1 due to name collision leds-gpio leds: Led red:status renamed to red:status_1 due to name collision
--- arch/arm64/boot/dts/freescale/imx8-apalis-ixora-v1.1.dtsi | 4 ++++ arch/arm64/boot/dts/freescale/imx8-apalis-ixora-v1.2.dtsi | 4 ++++ 2 files changed, 8 insertions(+)
arch/arm64/boot/dts/freescale/imx8-apalis-ixora-v1.1.dtsi +4 -0
@@ -21,6 +21,7 @@ led-1 { color = <LED_COLOR_ID_GREEN>; default-state = "off"; function = LED_FUNCTION_STATUS; + function-enumerator = <1>; gpios = <&lsio_gpio5 27 GPIO_ACTIVE_HIGH>; };
@@ -29,6 +30,7 @@ led-2 { color = <LED_COLOR_ID_RED>; default-state = "off"; function = LED_FUNCTION_STATUS; + function-enumerator = <1>; gpios = <&lsio_gpio5 29 GPIO_ACTIVE_HIGH>; };
@@ -37,6 +39,7 @@ led-3 { color = <LED_COLOR_ID_GREEN>; default-state = "off"; function = LED_FUNCTION_STATUS; + function-enumerator = <2>; gpios = <&lsio_gpio5 20 GPIO_ACTIVE_HIGH>; };
@@ -45,6 +48,7 @@ led-4 { color = <LED_COLOR_ID_RED>; default-state = "off"; function = LED_FUNCTION_STATUS; + function-enumerator = <2>; gpios = <&lsio_gpio5 21 GPIO_ACTIVE_HIGH>; }; };
arch/arm64/boot/dts/freescale/imx8-apalis-ixora-v1.2.dtsi +4 -0
@@ -21,6 +21,7 @@ led-1 { color = <LED_COLOR_ID_GREEN>; default-state = "off"; function = LED_FUNCTION_STATUS; + function-enumerator = <1>; gpios = <&lsio_gpio5 27 GPIO_ACTIVE_HIGH>; };
@@ -29,6 +30,7 @@ led-2 { color = <LED_COLOR_ID_RED>; default-state = "off"; function = LED_FUNCTION_STATUS; + function-enumerator = <1>; gpios = <&lsio_gpio5 29 GPIO_ACTIVE_HIGH>; };
@@ -37,6 +39,7 @@ led-3 { color = <LED_COLOR_ID_GREEN>; default-state = "off"; function = LED_FUNCTION_STATUS; + function-enumerator = <2>; gpios = <&lsio_gpio5 20 GPIO_ACTIVE_HIGH>; };
@@ -45,6 +48,7 @@ led-4 { color = <LED_COLOR_ID_RED>; default-state = "off"; function = LED_FUNCTION_STATUS; + function-enumerator = <2>; gpios = <&lsio_gpio5 21 GPIO_ACTIVE_HIGH>; }; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 268/666 arm64: dts: rockchip: Make Jaguar PCIe-refclk pin use pull-up config
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Stuebner <[email protected]>
[ Upstream commit f45d4356feeba1c8dac3414b688f59292ddfc9f9 ]
The hardware PU/PD config of the pin after reset is to pull-up and on Jaguar this will also keep the device in reset until the driver actually enables the pin. So restore this boot pull-up config of the pin on Jaguar instead of setting it to pull-none.
--- arch/arm64/boot/dts/rockchip/rk3588-jaguar.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3588-jaguar.dts +1 -1
@@ -424,7 +424,7 @@ led1_pin: led1-pin { pcie30x4 { pcie30x4_clkreqn_m0: pcie30x4-clkreqn-m0 { - rockchip,pins = <0 RK_PC6 RK_FUNC_GPIO &pcfg_pull_none>; + rockchip,pins = <0 RK_PC6 RK_FUNC_GPIO &pcfg_pull_up>; }; pcie30x4_perstn_m0: pcie30x4-perstn-m0 {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 269/666 arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1)
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sherry Sun <[email protected]>
[ Upstream commit d1e7eab6033f9885a02c4b4e8f09e34d8e9d21ab ]
The current pin configuration for MX8MP_IOMUXC_SD1_DATA4__GPIO2_IO06 sets the weak pull-up but does not enable the pull select field. Bit 8 in the IOMUX register must be set in order for the weak pull-up to actually take effect.
Update the pinctrl setting from 0x40 to 0x140 to enable both the pull select and the weak pull-up, ensuring the line behaves as expected.
--- arch/arm64/boot/dts/freescale/imx8mp-evk.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8mp-evk.dts +1 -1
@@ -947,7 +947,7 @@ MX8MP_IOMUXC_SD1_DATA5__GPIO2_IO07 0x40 pinctrl_pcie0_reg: pcie0reggrp { fsl,pins = < - MX8MP_IOMUXC_SD1_DATA4__GPIO2_IO06 0x40 + MX8MP_IOMUXC_SD1_DATA4__GPIO2_IO06 0x140 >; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 270/666 iommufd: vfio compatibility extension check for noiommu mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Pan <[email protected]>
[ Upstream commit 7147ec874ea08c322d779d8eba28946e294ed1f3 ]
VFIO_CHECK_EXTENSION should return false for TYPE1_IOMMU variants when in NO-IOMMU mode and IOMMUFD compat container is set. This change makes the behavior match VFIO_CONTAINER in noiommu mode. It also prevents userspace from incorrectly attempting to use TYPE1 IOMMU operations in a no-iommu context.
--- drivers/iommu/iommufd/vfio_compat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/iommufd/vfio_compat.c +1 -1
@@ -283,7 +283,7 @@ static int iommufd_vfio_check_extension(struct iommufd_ctx *ictx,case VFIO_TYPE1_IOMMU :case VFIO_TYPE1v2_IOMMU:case VFIO_UNMAP_ALL : -return 1 ; +return !ictx->no_iommu_mode;case VFIO_NOIOMMU_IOMMU :return IS_ENABLED (CONFIG_VFIO_NOIOMMU );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 271/666 arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akari Tsuyukusa <[email protected]>
[ Upstream commit c4c4823c8a5baa10b8100b01f49d7c3f4a871689 ]
The gpio-ranges in the MT6795 pinctrl node were incorrectly defined, therefore, GPIO196 cannot be used.
Correct the range count to match the driver.
--- arch/arm64/boot/dts/mediatek/mt6795.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt6795.dtsi +1 -1
@@ -372,7 +372,7 @@ pio: pinctrl@10005000 { <GIC_SPI 154 IRQ_TYPE_LEVEL_HIGH>; gpio-controller; #gpio-cells = <2>; - gpio-ranges = <&pio 0 0 196>; + gpio-ranges = <&pio 0 0 197>; interrupt-controller; #interrupt-cells = <2>; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 272/666 arm64: dts: mediatek: mt7981b: Fix gpio-ranges pin count
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akari Tsuyukusa <[email protected]>
[ Upstream commit b62a927f4a46a7f58d88ba3d5fb6e88e1a4b4603 ]
The gpio-ranges in the MT7981B pinctrl node were incorrectly defined, therefore, pin 56 cannot be used.
Correct the range count to match the driver.
--- arch/arm64/boot/dts/mediatek/mt7981b.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt7981b.dtsi +1 -1
@@ -200,7 +200,7 @@ pio: pinctrl@11d00000 { interrupt-controller; interrupts = <GIC_SPI 225 IRQ_TYPE_LEVEL_HIGH>; interrupt-parent = <&gic>; - gpio-ranges = <&pio 0 0 56>; + gpio-ranges = <&pio 0 0 57>; gpio-controller; #gpio-cells = <2>; #interrupt-cells = <2>;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 273/666 arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akari Tsuyukusa <[email protected]>
[ Upstream commit 820ed0c1a13c5fafb36232538d793f99a0986ef3 ]
The gpio-ranges in the MT7986A pinctrl node were incorrectly defined, therefore, pin 100 cannot be used.
Correct the range count to match the driver.
--- arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt7986a.dtsi +1 -1
@@ -187,7 +187,7 @@ pio: pinctrl@1001f000 { "iocfg_lb", "iocfg_tr", "iocfg_tl", "eint"; gpio-controller; #gpio-cells = <2>; - gpio-ranges = <&pio 0 0 100>; + gpio-ranges = <&pio 0 0 101>; interrupt-controller; interrupts = <GIC_SPI 225 IRQ_TYPE_LEVEL_HIGH>; interrupt-parent = <&gic>;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 274/666 arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Barnabás Czémán <[email protected]>
[ Upstream commit 9e87f0eaadccc3fecdf3c3c0334e05694804b5f5 ]
PMI8950 doesn't actually support setting an OVP threshold value of 29.6 V. The closest allowed value is 29.5 V. Set that instead.
--- arch/arm64/boot/dts/qcom/msm8953-xiaomi-vince.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/msm8953-xiaomi-vince.dts +1 -1
@@ -169,7 +169,7 @@ &pm8953_resin { &pmi8950_wled { qcom,current-limit-microamp = <20000>; - qcom,ovp-millivolt = <29600>; + qcom,ovp-millivolt = <29500>; qcom,num-strings = <2>; qcom,external-pfet; qcom,cabc;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 275/666 arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Barnabás Czémán <[email protected]>
[ Upstream commit 7131f6d909a6546329b71f2bacfdc60cb3e6020e ]
The backlight on this device is connected via 3 strings. Currently, the DT claims only two are present, which results in visible stripes on the display (since every third backlight string remains unconfigured).
Fix the number of strings to avoid that.
--- arch/arm64/boot/dts/qcom/msm8953-xiaomi-daisy.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/msm8953-xiaomi-daisy.dts +1 -1
@@ -157,7 +157,7 @@ &pm8953_resin { &pmi8950_wled { qcom,current-limit-microamp = <20000>; - qcom,num-strings = <2>; + qcom,num-strings = <3>; status = "okay"; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 276/666 arm64: dts: rockchip: Fix Bluetooth stability on LCKFB TaiShan Pi
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Wang <[email protected]>
[ Upstream commit 861a9593e10bb6ab2a492b315c8a2a3aad70ac00 ]
The AP6212 WiFi/BT module on the LCKFB TaiShan Pi (RK3566) is prone to communication timeouts and reset failures (error -110) when operating at 3 Mbps.
This patch stabilizes the Bluetooth interface by:
1. Updating the compatible string to 'brcm,bcm43430a1-bt' to better reflect the actual chip revision used in the AP6212 module.
2. Lowering the maximum UART baud rate from 3,000,000 to 1,500,000 bps. Tests show that 1.5 Mbps is the reliable upper limit for this board's UART configuration, eliminating the initialization timeouts.
--- arch/arm64/boot/dts/rockchip/rk3566-lckfb-tspi.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/rockchip/rk3566-lckfb-tspi.dts +2 -2
@@ -635,10 +635,10 @@ &uart1 { status = "okay"; bluetooth: bluetooth { - compatible = "brcm,bcm43438-bt"; + compatible = "brcm,bcm43430a1-bt"; clocks = <&rk809 1>; clock-names = "lpo"; - max-speed = <3000000>; + max-speed = <1500000>; pinctrl-names = "default"; pinctrl-0 = <&bt_host_wake_l &bt_wake_l &bt_enable_h>; shutdown-gpios = <&gpio2 RK_PB7 GPIO_ACTIVE_HIGH>;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 277/666 arm64: dts: rockchip: Correct Fan Supply for Gameforce Ace
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Morgan <[email protected]>
[ Upstream commit c7079215b7dbf88b84a95ff13982bf3dab3cfbe1 ]
Correct the regulator providing power to the PWM controlled fan. Without this fix the fan only runs when the audio path is playing audio (because the speaker amplifier and PWM fan share the same regulator).
--- arch/arm64/boot/dts/rockchip/rk3588s-gameforce-ace.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3588s-gameforce-ace.dts +1 -1
@@ -303,7 +303,7 @@ pwm_fan: pwm-fan { compatible = "pwm-fan"; #cooling-cells = <2>; cooling-levels = <0 120 150 180 210 240 255>; - fan-supply = <&vcc5v0_sys>; + fan-supply = <&vcc5v0_spk>; interrupt-parent = <&gpio4>; interrupts = <RK_PB2 IRQ_TYPE_EDGE_RISING>; pulses-per-revolution = <4>;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 278/666 arm64: dts: rockchip: Correct Joystick Axes on Gameforce Ace
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Morgan <[email protected]>
[ Upstream commit c337c1b561c1c3016d30776d7dc2032ea4979334 ]
The Gameforce Ace's joystick axes were set incorrectly initially, getting the X/Y and RX/RY axes backwards. Additionally, correct the RY axis so that it is inverted.
All axes tested with evtest and outputting correct values.
--- arch/arm64/boot/dts/rockchip/rk3588s-gameforce-ace.dts | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/arm64/boot/dts/rockchip/rk3588s-gameforce-ace.dts +5 -5
@@ -59,8 +59,8 @@ axis@0 { reg = <0>; abs-flat = <40>; abs-fuzz = <30>; - abs-range = <0 4095>; - linux,code = <ABS_RX>; + abs-range = <4095 0>; + linux,code = <ABS_RY>; }; axis@1 {
@@ -68,7 +68,7 @@ axis@1 { abs-flat = <40>; abs-fuzz = <30>; abs-range = <0 4095>; - linux,code = <ABS_RY>; + linux,code = <ABS_RX>; }; axis@2 {
@@ -76,7 +76,7 @@ axis@2 { abs-flat = <40>; abs-fuzz = <30>; abs-range = <0 4095>; - linux,code = <ABS_Y>; + linux,code = <ABS_X>; }; axis@3 {
@@ -84,7 +84,7 @@ axis@3 { abs-flat = <40>; abs-fuzz = <30>; abs-range = <0 4095>; - linux,code = <ABS_X>; + linux,code = <ABS_Y>; }; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 279/666 soc: qcom: ocmem: make the core clock optional
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit e8a61c51417c679d1a599fb36695e9d3b8d95514 ]
OCMEM's core clock (aka RPM bus 2 clock) is being handled internally by the interconnect driver. Corresponding clock has been dropped from the SMD RPM clock driver. The users of the ocmem will vote on the ocmemnoc interconnect paths, making sure that ocmem is on. Make the clock optional, keeping it for compatibility with older DT.
--- drivers/soc/qcom/ocmem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/ocmem.c +1 -1
@@ -308,7 +308,7 @@ static int ocmem_dev_probe(struct platform_device *pdev) ocmem->dev = dev; ocmem->config =device_get_match_data (dev); - ocmem->core_clk =devm_clk_get (dev,"core" ); + ocmem->core_clk =devm_clk_get_optional (dev,"core" );if (IS_ERR (ocmem->core_clk))return dev_err_probe (dev,PTR_ERR (ocmem->core_clk),"Unable to get core clock\n" );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 280/666 soc: qcom: ocmem: register reasons for probe deferrals
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 9dfd69cd89cd6afa4723be9098979abeef3bb8c6 ]
Instead of printing messages to the dmesg, let the message be recorded as a reason for the OCMEM client deferral.
[bjorn: s/ERR_PTR(dev_err_probe)/dev_err_ptr_probe/
--- drivers/soc/qcom/ocmem.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/soc/qcom/ocmem.c +4 -4
@@ -196,10 +196,10 @@ struct ocmem *of_get_ocmem(struct device *dev) } pdev =of_find_device_by_node (devnode->parent); -if (!pdev) { -dev_err (dev,"Cannot find device node %s\n" , devnode->name); -return ERR_PTR (-EPROBE_DEFER ); - } +if (!pdev) +return dev_err_ptr_probe (dev, -EPROBE_DEFER , +"Cannot find device node %s\n" , + devnode->name); ocmem =platform_get_drvdata (pdev);put_device (&pdev->dev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 281/666 soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 91b59009c7d48b58dbc50fecb27f2ad20749a05a ]
If OCMEM is declared in DT, it is expected that it is present and handled by the driver. The GPU driver will ignore -ENODEV error, which typically means that OCMEM isn't defined in DT. Let ocmem return -EPROBE_DEFER if it supposed to be used, but it is not probed (yet).
[bjorn: s/ERR_PTR(dev_err_probe)/dev_err_ptr_probe/
--- drivers/soc/qcom/ocmem.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/soc/qcom/ocmem.c +3 -4
@@ -203,10 +203,9 @@ struct ocmem *of_get_ocmem(struct device *dev) ocmem =platform_get_drvdata (pdev);put_device (&pdev->dev); -if (!ocmem) { -dev_err (dev,"Cannot get ocmem\n" ); -return ERR_PTR (-ENODEV ); - } +if (!ocmem) +return dev_err_ptr_probe (dev, -EPROBE_DEFER ,"Cannot get ocmem\n" ); +return ocmem; }EXPORT_SYMBOL_GPL (of_get_ocmem);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 282/666 bus: rifsc: fix RIF configuration check for peripherals
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gatien Chevallier <[email protected]>
[ Upstream commit d5ce3b4e951bc41a6ce877c8500bb4fe42146669 ]
Peripheral holding CID0 cannot be accessed, remove this completely incorrect check. While there, fix and simplify the semaphore checking that should be performed when the CID filtering is enabled.
--- drivers/bus/stm32_rifsc.c | 52 ++++++++++++++------------------------- 1 file changed, 18 insertions(+), 34 deletions(-)
drivers/bus/stm32_rifsc.c +18 -34
@@ -126,34 +126,6 @@ static int stm32_rifsc_grant_access(struct stm32_firewall_controller *ctrl, u32 sec_reg_value =readl (rifsc_controller->mmio +RIFSC_RISC_SECCFGR0 +0x4 * reg_id); cid_reg_value =readl (rifsc_controller->mmio +RIFSC_RISC_PER0_CIDCFGR +0x8 * firewall_id); -/* First check conditions for semaphore mode, which doesn't take into account static CID. */ -if ((cid_reg_value &CIDCFGR_SEMEN ) && (cid_reg_value &CIDCFGR_CFEN )) { -if (cid_reg_value &BIT (RIF_CID1 +SEMWL_SHIFT )) { -/* Static CID is irrelevant if semaphore mode */ - goto skip_cid_check; - }else { -dev_dbg (rifsc_controller->dev, -"Invalid bus semaphore configuration: index %d\n" , firewall_id); -return -EACCES ; - } - } - -/* -* Skip CID check if CID filtering isn't enabled or filtering is enabled on CID0, which -* corresponds to whatever CID. -*/ -if (!(cid_reg_value &CIDCFGR_CFEN ) || -FIELD_GET (RIFSC_RISC_SCID_MASK , cid_reg_value) ==RIF_CID0 ) - goto skip_cid_check; - -/* Coherency check with the CID configuration */ -if (FIELD_GET (RIFSC_RISC_SCID_MASK , cid_reg_value) !=RIF_CID1 ) { -dev_dbg (rifsc_controller->dev,"Invalid CID configuration for peripheral: %d\n" , - firewall_id); -return -EACCES ; - } - -skip_cid_check:/* Check security configuration */ if (sec_reg_value &BIT (reg_offset)) { dev_dbg(rifsc_controller->dev,
@@ -161,19 +133,31 @@ static int stm32_rifsc_grant_access(struct stm32_firewall_controller *ctrl, u32return -EACCES ; } -/* -* If the peripheral is in semaphore mode, take the semaphore so that -* the CID1 has the ownership. -*/ -if ((cid_reg_value &CIDCFGR_SEMEN ) && (cid_reg_value &CIDCFGR_CFEN )) { +/* Skip CID check if CID filtering isn't enabled */ +if (!(cid_reg_value &CIDCFGR_CFEN )) + goto skip_cid_check; + +/* First check conditions for semaphore mode, which doesn't take into account static CID. */ +if (cid_reg_value &CIDCFGR_SEMEN ) { +if (!(cid_reg_value &BIT (RIF_CID1 +SEMWL_SHIFT ))) { +dev_dbg (rifsc_controller->dev, +"Invalid bus semaphore configuration: index %d\n" , firewall_id); +return -EACCES ; + } + rc =stm32_rif_acquire_semaphore (rifsc_controller, firewall_id);if (rc) { -dev_err (rifsc_controller->dev, +dev_dbg (rifsc_controller->dev,"Couldn't acquire semaphore for peripheral: %d\n" , firewall_id);return rc; } + }else if (FIELD_GET (RIFSC_RISC_SCID_MASK , cid_reg_value) !=RIF_CID1 ) { +dev_dbg (rifsc_controller->dev,"Invalid CID configuration for peripheral: %d\n" , + firewall_id); +return -EACCES ; } +skip_cid_check:return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 283/666 arm64: dts: qcom: sm8450: Fix GIC_ITS range length
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 14044fa192c50265bc1f636108371044bbdcf7b7 ]
Currently, the GITS_SGIR register is cut off. Fix it up.
--- arch/arm64/boot/dts/qcom/sm8450.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sm8450.dtsi +1 -1
@@ -4274,7 +4274,7 @@ intc: interrupt-controller@17100000 { gic_its: msi-controller@17140000 { compatible = "arm,gic-v3-its"; - reg = <0x0 0x17140000 0x0 0x20000>; + reg = <0x0 0x17140000 0x0 0x40000>; msi-controller; #msi-cells = <1>; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 284/666 arm64: dts: qcom: sm8550: Fix GIC_ITS range length
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 357c559e386705609b6b9dc0544c420e3f91f3a0 ]
Currently, the GITS_SGIR register is cut off. Fix it up.
--- arch/arm64/boot/dts/qcom/sm8550.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sm8550.dtsi +1 -1
@@ -4418,7 +4418,7 @@ intc: interrupt-controller@17100000 { gic_its: msi-controller@17140000 { compatible = "arm,gic-v3-its"; - reg = <0 0x17140000 0 0x20000>; + reg = <0 0x17140000 0 0x40000>; msi-controller; #msi-cells = <1>; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 285/666 arm64: dts: qcom: sm8650: Fix GIC_ITS range length
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 6c8e2ca1263d0da5976418ed285eaec430e8d87f ]
Currently, the GITS_SGIR register is cut off. Fix it up.
--- arch/arm64/boot/dts/qcom/sm8650.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sm8650.dtsi +1 -1
@@ -5142,7 +5142,7 @@ intc: interrupt-controller@17100000 { gic_its: msi-controller@17140000 { compatible = "arm,gic-v3-its"; - reg = <0 0x17140000 0 0x20000>; + reg = <0 0x17140000 0 0x40000>; msi-controller; #msi-cells = <1>;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 286/666 arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
[ Upstream commit 30ac651c69bddbc83cab6d52fc5d2e03bed83282 ]
The expected frequency of SD host controller core supply clock is 19.2MHz, while RPMH_CXO_CLK clock frequency on SM8650 platform is 38.4MHz.
Apparently the overclocked supply clock could be good enough on some boards and even with the most of SD cards, however some low-end UHS-I SD cards in SDR104 mode of the host controller produce I/O errors in runtime, fortunately this problem is gone, if the "xo" clock frequency matches the expected 19.2MHz clock rate.
--- arch/arm64/boot/dts/qcom/sm8550.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sm8550.dtsi +1 -1
@@ -2824,7 +2824,7 @@ sdhc_2: mmc@8804000 { clocks = <&gcc GCC_SDCC2_AHB_CLK>, <&gcc GCC_SDCC2_APPS_CLK>, - <&rpmhcc RPMH_CXO_CLK>; + <&bi_tcxo_div2>; clock-names = "iface", "core", "xo"; iommus = <&apps_smmu 0x540 0>; qcom,dll-config = <0x0007642c>;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 287/666 arm64: dts: qcom: sm8650: Fix xo clock supply of SD host controller
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
[ Upstream commit 390903efaa057c44fd80e7d9839419c50092018e ]
The expected frequency of SD host controller core supply clock is 19.2MHz, while RPMH_CXO_CLK clock frequency on SM8650 platform is 38.4MHz.
Apparently the overclocked supply clock could be good enough on some boards and even with the most of SD cards, however some low-end UHS-I SD cards in SDR104 mode of the host controller produce I/O errors in runtime, fortunately this problem is gone, if the "xo" clock frequency matches the expected 19.2MHz clock rate.
--- arch/arm64/boot/dts/qcom/sm8650.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sm8650.dtsi +1 -1
@@ -3423,7 +3423,7 @@ sdhc_2: mmc@8804000 { clocks = <&gcc GCC_SDCC2_AHB_CLK>, <&gcc GCC_SDCC2_APPS_CLK>, - <&rpmhcc RPMH_CXO_CLK>; + <&bi_tcxo_div2>; clock-names = "iface", "core", "xo";
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 288/666 arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
[ Upstream commit db0c5ef1abda6effdc5c85d6688fb6af2b351ae5 ]
The reported problem of some non-working UHS-I speed modes on SM8450 originates in commit 0a631a36f724 ("arm64: dts: qcom: Add device tree for Sony Xperia 1 IV"), and then it was spread to all SM8450 powered platforms by commit 9d561dc4e5cc ("arm64: dts: qcom: sm8450: disable SDHCI SDR104/SDR50 on all boards").
The tests show that the rootcause of the problem was related to an overclocking of SD cards, and it's fixed later on by commit a27ac3806b0a ("clk: qcom: gcc-sm8450: Use floor ops for SDCC RCGs").
Since then both SDR50 and SDR104 speed modes are working fine on SM8450, tested on SM8450-HDK:
SDR50 speed mode:
mmc0: new UHS-I speed SDR50 SDHC card at address 0001
mmcblk0: mmc0:0001 00000 14.6 GiB
mmcblk0: p1
% dd if=/dev/mmcblk0p1 of=/dev/null bs=1M count=1024
1024+0 records in
1024+0 records out
1073741824 bytes (1.1 GB, 1.0 GiB) copied, 24.6254 s, 43.6 MB/sSDR104 speed mode:
mmc0: new UHS-I speed SDR104 SDHC card at address 59b4
mmcblk0: mmc0:59b4 USDU1 28.3 GiB
mmcblk0: p1
% dd if=/dev/mmcblk0p1 of=/dev/null bs=1M count=1024
1024+0 records in
1024+0 records out
1073741824 bytes (1.1 GB, 1.0 GiB) copied, 12.3266 s, 87.1 MB/sRemove the restrictions on SD card speed modes from the SM8450 platform dtsi file and enable UHS-I speed modes.
--- arch/arm64/boot/dts/qcom/sm8450.dtsi | 3 --- 1 file changed, 3 deletions(-)
arch/arm64/boot/dts/qcom/sm8450.dtsi +0 -3
@@ -4599,9 +4599,6 @@ sdhc_2: mmc@8804000 { bus-width = <4>; dma-coherent; - /* Forbid SDR104/SDR50 - broken hw! */ - sdhci-caps-mask = <0x3 0x0>; - status = "disabled"; sdhc2_opp_table: opp-table {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 289/666 arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
[ Upstream commit 66b0f024fba0728ddce6916dce173bb1bdd4eab0 ]
The restriction on UHS-I speed modes was added to all SM8550 platforms by copying it from SM8450 dtsi file, and due to the overclocking of SD cards it was an actually reproducible problem. Since the latter issue has been fixed, UHS-I speed modes are working fine on SM8550 boards, below is the test performed on SM8550-HDK:
SDR50 speed mode:
mmc0: new UHS-I speed SDR50 SDHC card at address 0001
mmcblk0: mmc0:0001 00000 14.6 GiB
mmcblk0: p1
% dd if=/dev/mmcblk0p1 of=/dev/null bs=1M count=1024
1024+0 records in
1024+0 records out
1073741824 bytes (1.1 GB, 1.0 GiB) copied, 23.5468 s, 45.6 MB/sSDR104 speed mode:
mmc0: new UHS-I speed SDR104 SDHC card at address 59b4
mmcblk0: mmc0:59b4 USDU1 28.3 GiB
mmcblk0: p1
% dd if=/dev/mmcblk0p1 of=/dev/null bs=1M count=1024
1024+0 records in
1024+0 records out
1073741824 bytes (1.1 GB, 1.0 GiB) copied, 11.9819 s, 89.6 MB/sUnset the UHS-I speed mode restrictions from the SM8550 platform dtsi file, there is no indication that the SDHC controller is broken.
--- arch/arm64/boot/dts/qcom/sm8550.dtsi | 3 --- 1 file changed, 3 deletions(-)
arch/arm64/boot/dts/qcom/sm8550.dtsi +0 -3
@@ -2838,9 +2838,6 @@ sdhc_2: mmc@8804000 { bus-width = <4>; dma-coherent; - /* Forbid SDR104/SDR50 - broken hw! */ - sdhci-caps-mask = <0x3 0>; - status = "disabled"; sdhc2_opp_table: opp-table {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 290/666 arm64: dts: qcom: sm8650: Enable UHS-I SDR50 and SDR104 SD card modes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
[ Upstream commit 93f823e7d48232e62fb8fb74481696609c90244a ]
The restriction on UHS-I speed modes was added to all SM8650 platforms by copying it from SM8450 and SM8550 dtsi files, and it was an actually reproducible problem due to the overclocking of SD cards. Since the latter issue has been fixed in the SM8650 GCC driver, UHS-I speed modes are working fine on SM8650 boards, below is the test performed on SM8650-HDK:
SDR50 speed mode:
mmc0: new UHS-I speed SDR50 SDHC card at address 0001
mmcblk0: mmc0:0001 00000 14.6 GiB
mmcblk0: p1
% dd if=/dev/mmcblk0p1 of=/dev/null bs=1M count=1024
1024+0 records in
1024+0 records out
1073741824 bytes (1.1 GB, 1.0 GiB) copied, 24.8086 s, 43.3 MB/sSDR104 speed mode:
mmc0: new UHS-I speed SDR104 SDHC card at address 59b4
mmcblk0: mmc0:59b4 USDU1 28.3 GiB
mmcblk0: p1
% dd if=/dev/mmcblk0p1 of=/dev/null bs=1M count=1024
1024+0 records in
1024+0 records out
1073741824 bytes (1.1 GB, 1.0 GiB) copied, 12.9448 s, 82.9 MB/sUnset the UHS-I speed mode restrictions from the SM8550 platform dtsi file, there is no indication that the SDHC controller is broken.
--- arch/arm64/boot/dts/qcom/sm8650.dtsi | 3 --- 1 file changed, 3 deletions(-)
arch/arm64/boot/dts/qcom/sm8650.dtsi +0 -3
@@ -3442,9 +3442,6 @@ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>, bus-width = <4>; - /* Forbid SDR104/SDR50 - broken hw! */ - sdhci-caps-mask = <0x3 0>; - qcom,dll-config = <0x0007642c>; qcom,ddr-config = <0x80040868>;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 291/666 arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit be7c1badb0b934cfe88427b1d4ec3eb9f52ba587 ]
The pinctrl nodes from sm6350.dtsi already contain a bias-* property, so that needs to be deleted, otherwise the dtb will contain two conflicting bias-* properties.
--- arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts +4 -0
@@ -946,12 +946,14 @@ &qup_uart1_cts { * the Bluetooth module drives the pin in either * direction or leaves the pin fully unpowered. */ + /delete-property/ bias-disable; bias-bus-hold; }; &qup_uart1_rts { /* We'll drive RTS, so no pull */ drive-strength = <2>; + /delete-property/ bias-pull-down; bias-disable; };
@@ -962,12 +964,14 @@ &qup_uart1_rx { * in tri-state (module powered off or not driving the * signal yet). */ + /delete-property/ bias-disable; bias-pull-up; }; &qup_uart1_tx { /* We'll drive TX, so no pull */ drive-strength = <2>; + /delete-property/ bias-pull-up; bias-disable; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 292/666 arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Heidelberg <[email protected]>
[ Upstream commit 3b0dd81eea6b7a239fce456ce4545af76f1a9715 ]
The regulator must be on, since it provides the display subsystem and therefore the bootloader had turned it on before Linux booted.
--- arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi +1 -0
@@ -147,6 +147,7 @@ vreg_l1a_0p875: ldo1 { regulator-min-microvolt = <880000>; regulator-max-microvolt = <880000>; regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>; + regulator-boot-on; }; vreg_l5a_0p8: ldo5 {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 293/666 arm64: dts: ti: k3-am62p5-sk: Disable MMC1 internal pulls on data pins
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <[email protected]>
[ Upstream commit 6d4441be969bea89bb9702781f5dfb3a8f2a02a4 ]
AM62P SK has external 10K pullups on MMC1 DAT1-DAT3 pins [0]. Disable internal pullups on DAT1-DAT3 so that each line has a single pullup source:
- with both pullups enabled, the effective parallel resistance on DAT1-3 (~8.33K) drops below the 10K minimum pullup requirement for data lines (per SD Physical Layer Specification)
- removing internal pullups makes DAT1-3 match DAT0 10K external pullup so its consistent and within spec
- both internal and external pullups enabled equals unnecessary power consumption
[0] https://www.ti.com/lit/zip/SPRR487
--- arch/arm64/boot/dts/ti/k3-am62p5-sk.dts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/boot/dts/ti/k3-am62p5-sk.dts +3 -3
@@ -224,9 +224,9 @@ main_mmc1_pins_default: main-mmc1-default-pins { AM62PX_IOPAD(0x023c, PIN_INPUT, 0) /* (H20) MMC1_CMD */ AM62PX_IOPAD(0x0234, PIN_OUTPUT, 0) /* (J24) MMC1_CLK */ AM62PX_IOPAD(0x0230, PIN_INPUT, 0) /* (H21) MMC1_DAT0 */ - AM62PX_IOPAD(0x022c, PIN_INPUT_PULLUP, 0) /* (H23) MMC1_DAT1 */ - AM62PX_IOPAD(0x0228, PIN_INPUT_PULLUP, 0) /* (H22) MMC1_DAT2 */ - AM62PX_IOPAD(0x0224, PIN_INPUT_PULLUP, 0) /* (H25) MMC1_DAT3 */ + AM62PX_IOPAD(0x022c, PIN_INPUT, 0) /* (H23) MMC1_DAT1 */ + AM62PX_IOPAD(0x0228, PIN_INPUT, 0) /* (H22) MMC1_DAT2 */ + AM62PX_IOPAD(0x0224, PIN_INPUT, 0) /* (H25) MMC1_DAT3 */ AM62PX_IOPAD(0x0240, PIN_INPUT, 0) /* (D23) MMC1_SDCD */ >; bootph-all;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 294/666 arm64: dts: ti: k3-am62-lp-sk: Enable internal pulls for MMC0 data pins
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <[email protected]>
[ Upstream commit ee2a9d9c9e6c9643fb7e45febcaedfbc038e483a ]
AM62 LP SK board does not have external pullups on MMC0 DAT1-DAT7 pins [0]. Enable internal pullups on DAT1-DAT7 considering:
- without a host-side pullup, these lines rely solely on the eMMC device's internal pullup (R_int, 10-150K per JEDEC), which may exceed the recommended 50K max for 1.8V VCCQ
- JEDEC JESD84-B51 Table 200 requires host-side pullups (R_DAT, 10K-100K) on all data lines to prevent bus floating
[0] https://www.ti.com/lit/zip/SPRR471
--- arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts +7 -7
@@ -80,13 +80,13 @@ main_mmc0_pins_default: main-mmc0-default-pins { AM62X_IOPAD(0x220, PIN_INPUT, 0) /* (V3) MMC0_CMD */ AM62X_IOPAD(0x218, PIN_INPUT, 0) /* (Y1) MMC0_CLK */ AM62X_IOPAD(0x214, PIN_INPUT, 0) /* (V2) MMC0_DAT0 */ - AM62X_IOPAD(0x210, PIN_INPUT, 0) /* (V1) MMC0_DAT1 */ - AM62X_IOPAD(0x20c, PIN_INPUT, 0) /* (W2) MMC0_DAT2 */ - AM62X_IOPAD(0x208, PIN_INPUT, 0) /* (W1) MMC0_DAT3 */ - AM62X_IOPAD(0x204, PIN_INPUT, 0) /* (Y2) MMC0_DAT4 */ - AM62X_IOPAD(0x200, PIN_INPUT, 0) /* (W3) MMC0_DAT5 */ - AM62X_IOPAD(0x1fc, PIN_INPUT, 0) /* (W4) MMC0_DAT6 */ - AM62X_IOPAD(0x1f8, PIN_INPUT, 0) /* (V4) MMC0_DAT7 */ + AM62X_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (V1) MMC0_DAT1 */ + AM62X_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (W2) MMC0_DAT2 */ + AM62X_IOPAD(0x208, PIN_INPUT_PULLUP, 0) /* (W1) MMC0_DAT3 */ + AM62X_IOPAD(0x204, PIN_INPUT_PULLUP, 0) /* (Y2) MMC0_DAT4 */ + AM62X_IOPAD(0x200, PIN_INPUT_PULLUP, 0) /* (W3) MMC0_DAT5 */ + AM62X_IOPAD(0x1fc, PIN_INPUT_PULLUP, 0) /* (W4) MMC0_DAT6 */ + AM62X_IOPAD(0x1f8, PIN_INPUT_PULLUP, 0) /* (V4) MMC0_DAT7 */ >; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 295/666 arm64: dts: ti: k3-am62-verdin: Fix SPI_1 GPIO CS pinctrl label
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <[email protected]>
[ Upstream commit 944dffaec1ef0f21c203728de77b5618ed70df6e ]
Fix SPI_1_CS GPIO pinmux label, this is spi1_cs, not qspi1_io4.
There are no user of this label yet, therefore this change does not create any compatibility issue.
--- arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi +1 -1
@@ -272,7 +272,7 @@ AM62X_IOPAD(0x0018, PIN_INPUT, 7) /* (F24) OSPI0_D3.GPIO0_6 */ /* SODIMM 62 */ }; /* Verdin SPI_1 CS as GPIO */ - pinctrl_qspi1_io4_gpio: main-gpio0-7-default-pins { + pinctrl_spi1_cs_gpio: main-gpio0-7-default-pins { pinctrl-single,pins = < AM62X_IOPAD(0x001c, PIN_INPUT, 7) /* (J23) OSPI0_D4.GPIO0_7 */ /* SODIMM 202 */ >;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 296/666 arm64: dts: freescale: imx8mp-tqma8mpql-mba8mp-ras314: fix UART1 RTS/CTS muxing
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nora Schiffer <[email protected]>
[ Upstream commit b8d785a9f360abcd6a6f8f10a2adf222f8494d66 ]
UART1 operates in DCE mode, but the RTS/CTS pins were incorrectly configured using the DTE pinmux setting.
Correct the pinmux to match DCE mode. Switching the RTS and CTS signals is fine for this board, as UART1 is routed to a pin header. Existing functionality is unaffected, as RTS/CTS could never have worked with the incorrect pinmux.
--- .../boot/dts/freescale/imx8mp-tqma8mpql-mba8mp-ras314.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mp-ras314.dts +2 -2
@@ -833,8 +833,8 @@ pinctrl_tlv320aic3x04: tlv320aic3x04grp { pinctrl_uart1: uart1grp { fsl,pins = <MX8MP_IOMUXC_SAI2_RXFS__UART1_DCE_TX 0x14>, <MX8MP_IOMUXC_SAI2_RXC__UART1_DCE_RX 0x14>, - <MX8MP_IOMUXC_SAI2_RXD0__UART1_DTE_CTS 0x14>, - <MX8MP_IOMUXC_SAI2_TXFS__UART1_DTE_RTS 0x14>; + <MX8MP_IOMUXC_SAI2_RXD0__UART1_DCE_RTS 0x14>, + <MX8MP_IOMUXC_SAI2_TXFS__UART1_DCE_CTS 0x14>; }; pinctrl_uart1_gpio: uart1gpiogrp {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 297/666 arm64: dts: lx2160a: change i2c0 (iic1) pinmux mask to one bit
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josua Mayer <[email protected]>
[ Upstream commit 7a3cc49ad1fc8d063abb7f5de8f1b981b99d2978 ]
LX2160A pinmux is done in groups by various length bitfields within configuration registers.
The first i2c bus (called IIC1 in reference manual) is configured through field IIC1_PMUX in register RCWSR14 bit 10 which is described in the reference manual as a single bit, unlike the other i2c buses.
Change the bitmask for the pinmux nodes from 0x7 to 0x1 to ensure only single bit is modified.
Further change the zero in the same line to hexadecimal format for consistency.
Align with documentation by avoiding writes to reserved bits. No functional change, as writing the extra two reserved bits is not known to cause issues.
--- arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi +2 -2
@@ -1790,11 +1790,11 @@ i2c7_scl_gpio: i2c7-scl-gpio-pins { }; i2c0_scl: i2c0-scl-pins { - pinctrl-single,bits = <0x8 0 (0x7 << 10)>; + pinctrl-single,bits = <0x8 0x0 (0x1 << 10)>; }; i2c0_scl_gpio: i2c0-scl-gpio-pins { - pinctrl-single,bits = <0x8 (0x1 << 10) (0x7 << 10)>; + pinctrl-single,bits = <0x8 (0x1 << 10) (0x1 << 10)>; }; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 298/666 arm64: dts: lx2160a: remove duplicate pinmux nodes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josua Mayer <[email protected]>
[ Upstream commit 325ca511ca3dda936207ce737e0afe837d45a674 ]
LX2160A pinmux is done in groups by various length bitfields within configuration registers.
The pinmux nodes i2c7-scl-pins and i2c7-scl-gpio-pins are duplicates of i2c6-scl-gpio and i2c6-scl-gpio-pins, writing to the same register and bits.
These two i2c buses i2c6/i2c7 (IIC7/IIC8) are configured together in register RCWSR13 bits 3-0.
Drop the duplicate node name and change references to the i2c6 node.
--- arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-)
arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi +2 -10
@@ -862,8 +862,8 @@ i2c7: i2c@2070000 { clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL QORIQ_CLK_PLL_DIV(16)>; pinctrl-names = "default", "gpio"; - pinctrl-0 = <&i2c7_scl>; - pinctrl-1 = <&i2c7_scl_gpio>; + pinctrl-0 = <&i2c6_scl>; + pinctrl-1 = <&i2c6_scl_gpio>; scl-gpios = <&gpio1 18 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; status = "disabled"; };
@@ -1781,14 +1781,6 @@ i2c6_scl_gpio: i2c6-scl-gpio-pins { pinctrl-single,bits = <0x4 0x1 0x7>; }; - i2c7_scl: i2c7-scl-pins { - pinctrl-single,bits = <0x4 0x2 0x7>; - }; - - i2c7_scl_gpio: i2c7-scl-gpio-pins { - pinctrl-single,bits = <0x4 0x1 0x7>; - }; - i2c0_scl: i2c0-scl-pins { pinctrl-single,bits = <0x8 0x0 (0x1 << 10)>; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 299/666 arm64: dts: lx2160a: rename pinmux nodes for readability
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josua Mayer <[email protected]>
[ Upstream commit 456eb494746afd56d3a9dc30271300136e55b96e ]
LX2160A pinmux is done in groups by various length bitfields within configuration registers.
Each group of pins is named in the reference manual after a primary function using soc-specific naming, e.g. IIC1 (for i2c0).
Hardware block numbering starts from zero in device-tree but one in the reference manual.
Rename the already defined pinmux nodes originally added for changing i2c pins between i2c and gpio functions reflecting the reference manual name (IIC) in the node name, and the device-tree name (i2c, gpio) in the label.
Specifically, drop the "_scl" suffix from the I2C labels because the nodes actually configure both SDA and SCL pins together. Instead add "_pins" suffix to avoid conflicts with I2C controller labels.
For GPIO functions, include the specific controller and pin numbers in the label to clarify they are generic GPIOs and help spot mistakes.
No functional change intended.
--- .../arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 64 +++++++++---------- 1 file changed, 32 insertions(+), 32 deletions(-)
arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi +32 -32
@@ -750,8 +750,8 @@ i2c0: i2c@2000000 { clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL QORIQ_CLK_PLL_DIV(16)>; pinctrl-names = "default", "gpio"; - pinctrl-0 = <&i2c0_scl>; - pinctrl-1 = <&i2c0_scl_gpio>; + pinctrl-0 = <&i2c0_pins>; + pinctrl-1 = <&gpio0_3_2_pins>; scl-gpios = <&gpio0 3 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; status = "disabled"; };
@@ -766,8 +766,8 @@ i2c1: i2c@2010000 { clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL QORIQ_CLK_PLL_DIV(16)>; pinctrl-names = "default", "gpio"; - pinctrl-0 = <&i2c1_scl>; - pinctrl-1 = <&i2c1_scl_gpio>; + pinctrl-0 = <&i2c1_pins>; + pinctrl-1 = <&gpio0_31_30_pins>; scl-gpios = <&gpio0 31 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; status = "disabled"; };
@@ -782,8 +782,8 @@ i2c2: i2c@2020000 { clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL QORIQ_CLK_PLL_DIV(16)>; pinctrl-names = "default", "gpio"; - pinctrl-0 = <&i2c2_scl>; - pinctrl-1 = <&i2c2_scl_gpio>; + pinctrl-0 = <&i2c2_pins>; + pinctrl-1 = <&gpio0_29_28_pins>; scl-gpios = <&gpio0 29 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; status = "disabled"; };
@@ -798,8 +798,8 @@ i2c3: i2c@2030000 { clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL QORIQ_CLK_PLL_DIV(16)>; pinctrl-names = "default", "gpio"; - pinctrl-0 = <&i2c3_scl>; - pinctrl-1 = <&i2c3_scl_gpio>; + pinctrl-0 = <&i2c3_pins>; + pinctrl-1 = <&gpio0_27_26_pins>; scl-gpios = <&gpio0 27 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; status = "disabled"; };
@@ -814,8 +814,8 @@ i2c4: i2c@2040000 { clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL QORIQ_CLK_PLL_DIV(16)>; pinctrl-names = "default", "gpio"; - pinctrl-0 = <&i2c4_scl>; - pinctrl-1 = <&i2c4_scl_gpio>; + pinctrl-0 = <&i2c4_pins>; + pinctrl-1 = <&gpio0_25_24_pins>; scl-gpios = <&gpio0 25 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; status = "disabled"; };
@@ -830,8 +830,8 @@ i2c5: i2c@2050000 { clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL QORIQ_CLK_PLL_DIV(16)>; pinctrl-names = "default", "gpio"; - pinctrl-0 = <&i2c5_scl>; - pinctrl-1 = <&i2c5_scl_gpio>; + pinctrl-0 = <&i2c5_pins>; + pinctrl-1 = <&gpio0_23_22_pins>; scl-gpios = <&gpio0 23 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; status = "disabled"; };
@@ -846,8 +846,8 @@ i2c6: i2c@2060000 { clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL QORIQ_CLK_PLL_DIV(16)>; pinctrl-names = "default", "gpio"; - pinctrl-0 = <&i2c6_scl>; - pinctrl-1 = <&i2c6_scl_gpio>; + pinctrl-0 = <&i2c6_i2c7_pins>; + pinctrl-1 = <&gpio1_18_15_pins>; scl-gpios = <&gpio1 16 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; status = "disabled"; };
@@ -862,8 +862,8 @@ i2c7: i2c@2070000 { clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL QORIQ_CLK_PLL_DIV(16)>; pinctrl-names = "default", "gpio"; - pinctrl-0 = <&i2c6_scl>; - pinctrl-1 = <&i2c6_scl_gpio>; + pinctrl-0 = <&i2c6_i2c7_pins>; + pinctrl-1 = <&gpio1_18_15_pins>; scl-gpios = <&gpio1 18 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; status = "disabled"; };
@@ -1709,11 +1709,11 @@ pinmux_i2crv: pinmux@70010012c { pinctrl-single,register-width = <32>; pinctrl-single,function-mask = <0x7>; - i2c1_scl: i2c1-scl-pins { + i2c1_pins: iic2-i2c-pins { pinctrl-single,bits = <0x0 0 0x7>; }; - i2c1_scl_gpio: i2c1-scl-gpio-pins { + gpio0_31_30_pins: iic2-gpio-pins { pinctrl-single,bits = <0x0 0x1 0x7>; };
@@ -1721,35 +1721,35 @@ esdhc0_cd_wp_pins: iic2-sdhc-pins { pinctrl-single,bits = <0x0 0x6 0x7>; }; - i2c2_scl: i2c2-scl-pins { + i2c2_pins: iic3-i2c-pins { pinctrl-single,bits = <0x0 0 (0x7 << 3)>; }; - i2c2_scl_gpio: i2c2-scl-gpio-pins { + gpio0_29_28_pins: iic3-gpio-pins { pinctrl-single,bits = <0x0 (0x1 << 3) (0x7 << 3)>; }; - i2c3_scl: i2c3-scl-pins { + i2c3_pins: iic4-i2c-pins { pinctrl-single,bits = <0x0 0 (0x7 << 6)>; }; - i2c3_scl_gpio: i2c3-scl-gpio-pins { + gpio0_27_26_pins: iic4-gpio-pins { pinctrl-single,bits = <0x0 (0x1 << 6) (0x7 << 6)>; }; - i2c4_scl: i2c4-scl-pins { + i2c4_pins: iic5-i2c-pins { pinctrl-single,bits = <0x0 0 (0x7 << 9)>; }; - i2c4_scl_gpio: i2c4-scl-gpio-pins { + gpio0_25_24_pins: iic5-gpio-pins { pinctrl-single,bits = <0x0 (0x1 << 9) (0x7 << 9)>; }; - i2c5_scl: i2c5-scl-pins { + i2c5_pins: iic6-i2c-pins { pinctrl-single,bits = <0x0 0 (0x7 << 12)>; }; - i2c5_scl_gpio: i2c5-scl-gpio-pins { + gpio0_23_22_pins: iic6-gpio-pins { pinctrl-single,bits = <0x0 (0x1 << 12) (0x7 << 12)>; };
@@ -1773,19 +1773,19 @@ gpio0_14_12_pins: sdhc1-dir-gpio-pins { pinctrl-single,bits = <0x0 (0x1 << 27) (0x7 << 27)>; }; - i2c6_scl: i2c6-scl-pins { - pinctrl-single,bits = <0x4 0x2 0x7>; + gpio1_18_15_pins: iic8-iic7-gpio-pins { + pinctrl-single,bits = <0x4 0x1 0x7>; }; - i2c6_scl_gpio: i2c6-scl-gpio-pins { - pinctrl-single,bits = <0x4 0x1 0x7>; + i2c6_i2c7_pins: iic8-iic7-i2c-pins { + pinctrl-single,bits = <0x4 0x2 0x7>; }; - i2c0_scl: i2c0-scl-pins { + i2c0_pins: iic1-i2c-pins { pinctrl-single,bits = <0x8 0x0 (0x1 << 10)>; }; - i2c0_scl_gpio: i2c0-scl-gpio-pins { + gpio0_3_2_pins: iic1-gpio-pins { pinctrl-single,bits = <0x8 (0x1 << 10) (0x1 << 10)>; }; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 300/666 arm64: dts: lx2160a: add sda gpio references for i2c bus recovery
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josua Mayer <[email protected]>
[ Upstream commit 89ea0dbd701f89805499d26bd90657468c789545 ]
LX2160A pinmux is done in groups by various length bitfields within configuration registers.
In particular i2c sda/scl pins are always configured together. Therefore bus recovery may control both sda and scl.
When pinmux nodes and bus recovery was enabled originally for LX2160, only the scl-gpios were added to the i2c controller nodes.
Add references to sda-gpios for each i2c controller.
--- arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi +8 -0
@@ -753,6 +753,7 @@ i2c0: i2c@2000000 { pinctrl-0 = <&i2c0_pins>; pinctrl-1 = <&gpio0_3_2_pins>; scl-gpios = <&gpio0 3 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + sda-gpios = <&gpio0 2 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; status = "disabled"; };
@@ -769,6 +770,7 @@ i2c1: i2c@2010000 { pinctrl-0 = <&i2c1_pins>; pinctrl-1 = <&gpio0_31_30_pins>; scl-gpios = <&gpio0 31 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + sda-gpios = <&gpio0 30 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; status = "disabled"; };
@@ -785,6 +787,7 @@ i2c2: i2c@2020000 { pinctrl-0 = <&i2c2_pins>; pinctrl-1 = <&gpio0_29_28_pins>; scl-gpios = <&gpio0 29 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + sda-gpios = <&gpio0 28 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; status = "disabled"; };
@@ -801,6 +804,7 @@ i2c3: i2c@2030000 { pinctrl-0 = <&i2c3_pins>; pinctrl-1 = <&gpio0_27_26_pins>; scl-gpios = <&gpio0 27 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + sda-gpios = <&gpio0 26 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; status = "disabled"; };
@@ -817,6 +821,7 @@ i2c4: i2c@2040000 { pinctrl-0 = <&i2c4_pins>; pinctrl-1 = <&gpio0_25_24_pins>; scl-gpios = <&gpio0 25 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + sda-gpios = <&gpio0 24 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; status = "disabled"; };
@@ -833,6 +838,7 @@ i2c5: i2c@2050000 { pinctrl-0 = <&i2c5_pins>; pinctrl-1 = <&gpio0_23_22_pins>; scl-gpios = <&gpio0 23 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + sda-gpios = <&gpio0 22 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; status = "disabled"; };
@@ -849,6 +855,7 @@ i2c6: i2c@2060000 { pinctrl-0 = <&i2c6_i2c7_pins>; pinctrl-1 = <&gpio1_18_15_pins>; scl-gpios = <&gpio1 16 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + sda-gpios = <&gpio1 15 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; status = "disabled"; };
@@ -865,6 +872,7 @@ i2c7: i2c@2070000 { pinctrl-0 = <&i2c6_i2c7_pins>; pinctrl-1 = <&gpio1_18_15_pins>; scl-gpios = <&gpio1 18 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + sda-gpios = <&gpio1 17 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; status = "disabled"; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 301/666 arm64: dts: lx2160a: change zeros to hexadecimal in pinmux nodes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josua Mayer <[email protected]>
[ Upstream commit 03241620d2b9915c9e3463dbc56e9eb95ad43c08 ]
Replace some stray zeros from decimal to hexadecimal format within pinmux nodes.
No functional change intended.
--- arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi +5 -5
@@ -1718,7 +1718,7 @@ pinmux_i2crv: pinmux@70010012c { pinctrl-single,function-mask = <0x7>; i2c1_pins: iic2-i2c-pins { - pinctrl-single,bits = <0x0 0 0x7>; + pinctrl-single,bits = <0x0 0x0 0x7>; }; gpio0_31_30_pins: iic2-gpio-pins {
@@ -1730,7 +1730,7 @@ esdhc0_cd_wp_pins: iic2-sdhc-pins { }; i2c2_pins: iic3-i2c-pins { - pinctrl-single,bits = <0x0 0 (0x7 << 3)>; + pinctrl-single,bits = <0x0 0x0 (0x7 << 3)>; }; gpio0_29_28_pins: iic3-gpio-pins {
@@ -1738,7 +1738,7 @@ gpio0_29_28_pins: iic3-gpio-pins { }; i2c3_pins: iic4-i2c-pins { - pinctrl-single,bits = <0x0 0 (0x7 << 6)>; + pinctrl-single,bits = <0x0 0x0 (0x7 << 6)>; }; gpio0_27_26_pins: iic4-gpio-pins {
@@ -1746,7 +1746,7 @@ gpio0_27_26_pins: iic4-gpio-pins { }; i2c4_pins: iic5-i2c-pins { - pinctrl-single,bits = <0x0 0 (0x7 << 9)>; + pinctrl-single,bits = <0x0 0x0 (0x7 << 9)>; }; gpio0_25_24_pins: iic5-gpio-pins {
@@ -1754,7 +1754,7 @@ gpio0_25_24_pins: iic5-gpio-pins { }; i2c5_pins: iic6-i2c-pins { - pinctrl-single,bits = <0x0 0 (0x7 << 12)>; + pinctrl-single,bits = <0x0 0x0 (0x7 << 12)>; }; gpio0_23_22_pins: iic6-gpio-pins {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 302/666 arm64: dts: lx2160a: complete pinmux for rcwsr12 configuration word
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josua Mayer <[email protected]>
[ Upstream commit 284ad7064aaa1badde022785cd925af29c696b21 ]
Commit 8a1365c7bbc1 ("arm64: dts: lx2160a: add pinmux and i2c gpio to support bus recovery") introduced pinmux nodes for lx2160 i2c interfaces, allowing runtime change between i2c and gpio functions implementing bus recovery.
However, the dynamic configuration area (overwrite MUX) used by the pinctrl-single driver initially reads as zero and does not reflect the actual hardware state set by the Reset Configuration Word (RCW) at power-on.
Because multiple groups of pins are configured from a single 32-bit register, the first write from the pinctrl driver unintentionally clears all other bits to zero.
Add description for all bits of RCWSR12 register, allowing boards to explicitly define and restore their intended hardware state.
This includes i2c, gpio, flextimer, spi, can and sdhc functions.
Other configuration words, i.e. RCWSR13 & RCWSR14 may be added in the future for boards setting non-zero values there.
--- .../arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 75 +++++++++++++++++++ 1 file changed, 75 insertions(+)
arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi +75 -0
@@ -1717,6 +1717,7 @@ pinmux_i2crv: pinmux@70010012c { pinctrl-single,register-width = <32>; pinctrl-single,function-mask = <0x7>; + /* RCWSR12 */ i2c1_pins: iic2-i2c-pins { pinctrl-single,bits = <0x0 0x0 0x7>; };
@@ -1725,6 +1726,10 @@ gpio0_31_30_pins: iic2-gpio-pins { pinctrl-single,bits = <0x0 0x1 0x7>; }; + ftm0_ch10_pins: iic2-ftm-pins { + pinctrl-single,bits = <0x0 0x2 0x7>; + }; + esdhc0_cd_wp_pins: iic2-sdhc-pins { pinctrl-single,bits = <0x0 0x6 0x7>; };
@@ -1737,6 +1742,14 @@ gpio0_29_28_pins: iic3-gpio-pins { pinctrl-single,bits = <0x0 (0x1 << 3) (0x7 << 3)>; }; + can0_pins: iic3-can-pins { + pinctrl-single,bits = <0x0 (0x2 << 3) (0x7 << 3)>; + }; + + event65_pins: iic3-event-pins { + pinctrl-single,bits = <0x0 (0x6 << 3) (0x7 << 3)>; + }; + i2c3_pins: iic4-i2c-pins { pinctrl-single,bits = <0x0 0x0 (0x7 << 6)>; };
@@ -1745,6 +1758,14 @@ gpio0_27_26_pins: iic4-gpio-pins { pinctrl-single,bits = <0x0 (0x1 << 6) (0x7 << 6)>; }; + can1_pins: iic4-can-pins { + pinctrl-single,bits = <0x0 (0x2 << 6) (0x7 << 6)>; + }; + + event87_pins: iic4-event-pins { + pinctrl-single,bits = <0x0 (0x6 << 6) (0x7 << 6)>; + }; + i2c4_pins: iic5-i2c-pins { pinctrl-single,bits = <0x0 0x0 (0x7 << 9)>; };
@@ -1753,6 +1774,14 @@ gpio0_25_24_pins: iic5-gpio-pins { pinctrl-single,bits = <0x0 (0x1 << 9) (0x7 << 9)>; }; + esdhc0_clksync_pins: iic5-sdhc-clk-pins { + pinctrl-single,bits = <0x0 (0x2 << 9) (0x7 << 9)>; + }; + + dspi2_miso_mosi_pins: iic5-spi3-pins { + pinctrl-single,bits = <0x3 (0x2 << 9) (0x7 << 9)>; + }; + i2c5_pins: iic6-i2c-pins { pinctrl-single,bits = <0x0 0x0 (0x7 << 12)>; };
@@ -1761,26 +1790,71 @@ gpio0_23_22_pins: iic6-gpio-pins { pinctrl-single,bits = <0x0 (0x1 << 12) (0x7 << 12)>; }; + esdhc1_clksync_pins: iic6-sdhc-clk-pins { + pinctrl-single,bits = <0x0 (0x2 << 12) (0x7 << 12)>; + }; + fspi_data74_pins: xspi1-data74-pins { pinctrl-single,bits = <0x0 0x0 (0x7 << 15)>; }; + gpio1_31_28_pins: xspi1-data74-gpio-pins { + pinctrl-single,bits = <0x0 0x1 (0x7 << 15)>; + }; + fspi_data30_pins: xspi1-data30-pins { pinctrl-single,bits = <0x0 0x0 (0x7 << 18)>; }; + gpio1_27_24_pins: xspi1-data30-gpio-pins { + pinctrl-single,bits = <0x0 0x1 (0x7 << 18)>; + }; + fspi_dqs_sck_cs10_pins: xspi1-base-pins { pinctrl-single,bits = <0x0 0x0 (0x7 << 21)>; }; + gpio1_23_20_pins: xspi1-base-gpio-pins { + pinctrl-single,bits = <0x0 0x1 (0x7 << 21)>; + }; + esdhc0_cmd_data30_clk_vsel_pins: sdhc1-base-sdhc-vsel-pins { pinctrl-single,bits = <0x0 0x0 (0x7 << 24)>; }; + gpio0_21_15_pins: sdhc1-base-gpio-pins { + pinctrl-single,bits = <0x0 (0x1 << 24) (0x7 << 24)>; + }; + + dspi0_pins: sdhc1-base-spi1-pins { + pinctrl-single,bits = <0x0 (0x2 << 24) (0x7 << 24)>; + }; + + esdhc0_cmd_data30_clk_dspi2_cs0_pins: sdhc1-base-sdhc-spi3-pins { + pinctrl-single,bits = <0x0 (0x3 << 24) (0x7 << 24)>; + }; + + esdhc0_cmd_data30_clk_data4_pins: sdhc1-base-sdhc-data4-pins { + pinctrl-single,bits = <0x0 (0x4 << 24) (0x7 << 24)>; + }; + + esdhc0_dir_pins: sdhc1-dir-pins { + pinctrl-single,bits = <0x0 0x0 (0x7 << 27)>; + }; + gpio0_14_12_pins: sdhc1-dir-gpio-pins { pinctrl-single,bits = <0x0 (0x1 << 27) (0x7 << 27)>; }; + dspi2_cs31_pins: sdhc1-dir-spi3-pins { + pinctrl-single,bits = <0x0 (0x3 << 27) (0x7 << 27)>; + }; + + esdhc0_data75_pins: sdhc1-dir-sdhc-pins { + pinctrl-single,bits = <0x0 (0x4 << 27) (0x7 << 27)>; + }; + + /* RCWSR13 */ gpio1_18_15_pins: iic8-iic7-gpio-pins { pinctrl-single,bits = <0x4 0x1 0x7>; };
@@ -1789,6 +1863,7 @@ i2c6_i2c7_pins: iic8-iic7-i2c-pins { pinctrl-single,bits = <0x4 0x2 0x7>; }; + /* RCWSR14 */ i2c0_pins: iic1-i2c-pins { pinctrl-single,bits = <0x8 0x0 (0x1 << 10)>; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 303/666 arm64: dts: imx8qm-mek: switch Type-C connector power-role to dual
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
[ Upstream commit e3d3d19d1c0050789a4813ce836a641a3387d916 ]
When attach to PC Type-A port, the USB device controller does not function at all. Because it is configured as source-only and a Type-A port doesn't support PD capability, a data role swap is impossible.
Actually, PTN5110THQ is configured for Source role only at POR, but after POR it can operate as a DRP (Dual-Role Power). By switching the power-role to dual, the port can operate as a sink and enter device mode when attach to Type-A port.
Since the board design uses EN_SRC to control the 5V VBUS path and EN_SNK to control the 12V VBUS output, to avoid outputting a higher VBUS when in sink role, we set the operation current limit to 0mA so that SW will not control EN_SNK at all.
--- arch/arm64/boot/dts/freescale/imx8qm-mek.dts | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8qm-mek.dts +9 -1
@@ -351,9 +351,17 @@ ptn5110: tcpc@51 { usb_con1: connector { compatible = "usb-c-connector"; label = "USB-C"; - power-role = "source"; + power-role = "dual"; data-role = "dual"; + try-power-role = "sink"; source-pdos = <PDO_FIXED(5000, 3000, PDO_FIXED_USB_COMM)>; + /* + * Set operational current to 0mA as we don't want EN_SNK + * enable 12V VBUS switch when it work as a sink. + */ + sink-pdos = <PDO_FIXED(5000, 0, PDO_FIXED_USB_COMM)>; + op-sink-microwatt = <0>; + self-powered; ports { #address-cells = <1>;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 304/666 arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
[ Upstream commit 825b8c7e1d2918d89eb378b761530d1e51dba82e ]
When attach to PC Type-A port, the USB device controller does not function at all. Because it is configured as source-only and a Type-A port doesn't support PD capability, a data role swap is impossible.
Actually, PTN5110THQ is configured for Source role only at POR, but after POR it can operate as a DRP (Dual-Role Power). By switching the power-role to dual, the port can operate as a sink and enter device mode when attach to Type-A port.
Since the board design uses EN_SRC to control the 5V VBUS path and EN_SNK to control the 12V VBUS output, to avoid outputting a higher VBUS when in sink role, we set the operation current limit to 0mA so that SW will not control EN_SNK at all.
--- arch/arm64/boot/dts/freescale/imx8qxp-mek.dts | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8qxp-mek.dts +9 -1
@@ -176,9 +176,17 @@ ptn5110: tcpc@50 { usb_con1: connector { compatible = "usb-c-connector"; label = "USB-C"; - power-role = "source"; + power-role = "dual"; data-role = "dual"; + try-power-role = "sink"; source-pdos = <PDO_FIXED(5000, 3000, PDO_FIXED_USB_COMM)>; + /* + * Set operational current to 0mA as we don't want EN_SNK + * enable 12V VBUS switch when it work as a sink. + */ + sink-pdos = <PDO_FIXED(5000, 0, PDO_FIXED_USB_COMM)>; + op-sink-microwatt = <0>; + self-powered; ports { #address-cells = <1>;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 305/666 soc/tegra: cbb: Set ERD on resume for err interrupt
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumit Gupta <[email protected]>
[ Upstream commit b6ff71c5d1d4ad858ddf6f39394d169c96689596 ]
Set the Error Response Disable (ERD) bit to mask SError responses and use interrupt-based error reporting. When the ERD bit is set, inband error responses to the initiator via SError are suppressed, and fabric errors are reported via an interrupt instead.
The register is set during boot but the info is lost during system suspend and needs to be set again on resume.
--- drivers/soc/tegra/cbb/tegra234-cbb.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/soc/tegra/cbb/tegra234-cbb.c +4 -0
@@ -1176,6 +1176,10 @@ static int __maybe_unused tegra234_cbb_resume_noirq(struct device *dev) {struct tegra234_cbb *cbb =dev_get_drvdata (dev); +/* set ERD bit to mask SError and generate interrupt to report error */ +if (cbb->fabric->off_mask_erd) +tegra234_cbb_mask_serror (cbb); +tegra234_cbb_error_enable (&cbb->base);dev_dbg (dev,"%s resumed\n" , cbb->fabric->name);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 306/666 unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Grzedzicki <[email protected]>
[ Upstream commit a98621a0f187a934c115dcfe79a49520ae892111 ]
When set_cred_ucounts() fails in ksys_unshare() new_nsproxy is leaked.
Let's call put_nsproxy() if that happens.
--- kernel/fork.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
kernel/fork.c +7 -4
@@ -3348,11 +3348,10 @@ int ksys_unshare(unsigned long unshare_flags) new_cred, new_fs);if (err) goto bad_unshare_cleanup_cred; -if (new_cred) { err =set_cred_ucounts (new_cred);if (err) - goto bad_unshare_cleanup_cred; + goto bad_unshare_cleanup_nsproxy; }if (new_fs || new_fd || do_sysvsem || new_cred || new_nsproxy) {
@@ -3368,8 +3367,10 @@ int ksys_unshare(unsigned long unshare_flags)shm_init_task (current); } -if (new_nsproxy) +if (new_nsproxy) {switch_task_namespaces (current, new_nsproxy); + new_nsproxy =NULL ; + }task_lock (current);
@@ -3398,13 +3399,15 @@ int ksys_unshare(unsigned long unshare_flags)perf_event_namespaces (current); +bad_unshare_cleanup_nsproxy: +if (new_nsproxy) +put_nsproxy (new_nsproxy); bad_unshare_cleanup_cred:if (new_cred)put_cred (new_cred); bad_unshare_cleanup_fd:if (new_fd)put_files_struct (new_fd); - bad_unshare_cleanup_fs:if (new_fs)free_fs_struct (new_fs);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 307/666 ocfs2/dlm: validate qr_numregions in dlm_match_regions()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <[email protected]>
[ Upstream commit 7ab3fbb01bc6d79091bc375e5235d360cd9b78be ]
Patch series "ocfs2/dlm: fix two bugs in dlm_match_regions()".
In dlm_match_regions(), the qr_numregions field from a DLM_QUERY_REGION network message is used to drive loops over the qr_regions buffer without sufficient validation. This series fixes two issues:
- Patch 1 adds a bounds check to reject messages where qr_numregions exceeds O2NM_MAX_REGIONS. The o2net layer only validates message byte length; it does not constrain field values, so a crafted message can set qr_numregions up to 255 and trigger out-of-bounds reads past the 1024-byte qr_regions buffer.
- Patch 2 fixes an off-by-one in the local-vs-remote comparison loop, which uses '<=' instead of '<', reading one entry past the valid range even when qr_numregions is within bounds.
This patch (of 2):
The qr_numregions field from a DLM_QUERY_REGION network message is used directly as loop bounds in dlm_match_regions() without checking against O2NM_MAX_REGIONS. Since qr_regions is sized for at most O2NM_MAX_REGIONS
(32) entries, a crafted message with qr_numregions > 32 causes out-of-bounds reads past the qr_regions buffer.
Add a bounds check for qr_numregions before entering the loops.
--- fs/ocfs2/dlm/dlmdomain.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/ocfs2/dlm/dlmdomain.c +8 -0
@@ -980,6 +980,14 @@ static int dlm_match_regions(struct dlm_ctxt *dlm, goto bail; } +if (qr->qr_numregions >O2NM_MAX_REGIONS ) { +mlog (ML_ERROR ,"Domain %s: Joining node %d has invalid " +"number of heartbeat regions %u\n" , + qr->qr_domain, qr->qr_node, qr->qr_numregions); + status = -EINVAL ; + goto bail; + } + r = remote;for (i =0 ; i < qr->qr_numregions; ++i) {mlog (0 ,"Region %.*s\n" ,O2HB_MAX_REGION_NAME_LEN , r);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 308/666 ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <[email protected]>
[ Upstream commit 01b61e8dda9b0fdb0d4cda43de25f4e390554d7b ]
The local-vs-remote region comparison loop uses '<=' instead of '<', causing it to read one entry past the valid range of qr_regions. The other loops in the same function correctly use '<'.
Fix the loop condition to use '<' for consistency and correctness.
--- fs/ocfs2/dlm/dlmdomain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ocfs2/dlm/dlmdomain.c +1 -1
@@ -1002,7 +1002,7 @@ static int dlm_match_regions(struct dlm_ctxt *dlm,for (i =0 ; i < localnr; ++i) { foundit =0 ; r = remote; -for (j =0 ; j <= qr->qr_numregions; ++j) { +for (j =0 ; j < qr->qr_numregions; ++j) {if (!memcmp (l, r,O2HB_MAX_REGION_NAME_LEN )) { foundit =1 ;break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 309/666 soc: qcom: llcc: fix v1 SB syndrome register offset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 24e7625df5ce065393249b78930781be593bc381 ]
The llcc_v1_edac_reg_offset table uses 0x2304c for trp_ecc_sb_err_syn0, which is inconsistent with the surrounding TRP ECC registers (0x2034x) and with llcc_v2_1_edac_reg_offset, where trp_ecc_sb_err_syn0 is 0x2034c adjacent to trp_ecc_error_status0/1 at 0x20344/0x20348.
Use 0x2034c for llcc v1 so the SB syndrome register follows the expected +0x4 progression from trp_ecc_error_status1. This fixes EDAC reading the wrong register for SB syndrome reporting.
--- drivers/soc/qcom/llcc-qcom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/llcc-qcom.c +1 -1
@@ -2584,7 +2584,7 @@ static const struct llcc_slice_config x1e80100_data[] = {static const struct llcc_edac_reg_offset llcc_v1_edac_reg_offset = { .trp_ecc_error_status0 =0x20344 , .trp_ecc_error_status1 =0x20348 , - .trp_ecc_sb_err_syn0 =0x2304c , + .trp_ecc_sb_err_syn0 =0x2034c , .trp_ecc_db_err_syn0 =0x20370 , .trp_ecc_error_cntr_clear =0x20440 , .trp_interrupt_0_status =0x20480 ,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 310/666 soc: qcom: aoss: compare against normalized cooling state
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit cd3c4670db3ffe997be9548c7a9db3952563cf14 ]
qmp_cdev_set_cur_state() normalizes the requested state to a boolean (cdev_state = !!state). The existing early-return check compares qmp_cdev->state == state, which can be wrong if state is non-boolean (any non-zero value). Compare qmp_cdev->state against cdev_state instead, so the check matches the effective state and avoids redundant updates.
--- drivers/soc/qcom/qcom_aoss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/qcom_aoss.c +1 -1
@@ -354,7 +354,7 @@ static int qmp_cdev_set_cur_state(struct thermal_cooling_device *cdev,/* Normalize state */ cdev_state = !!state; -if (qmp_cdev->state == state) +if (qmp_cdev->state == cdev_state)return 0 ; ret = qmp_send(qmp_cdev->qmp, "{class: volt_flr, event:zero_temp, res:%s, value:%s}",
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 311/666 arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Koskovich <[email protected]>
[ Upstream commit b683730e27ba4f91986c4c92f5cb7297f1e01a6d ]
This resolves the following error seen on the ASUS ROG Phone 3:
cpu cpu7: Voltage update failed freq=3091200
cpu cpu7: failed to update OPP for freq=3091200
--- arch/arm64/boot/dts/qcom/sm8250.dtsi | 5 +++++ 1 file changed, 5 insertions(+)
arch/arm64/boot/dts/qcom/sm8250.dtsi +5 -0
@@ -664,6 +664,11 @@ cpu7_opp20: opp-2841600000 { opp-hz = /bits/ 64 <2841600000>; opp-peak-kBps = <8368000 51609600>; }; + + cpu7_opp21: opp-3091200000 { + opp-hz = /bits/ 64 <3091200000>; + opp-peak-kBps = <8368000 51609600>; + }; }; firmware {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 312/666 ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaro Koskinen <[email protected]>
[ Upstream commit 7e74b606dd39c46d4378d6f6563f560a00ab8694 ]
On OMAP16XX, the UART enable bit shifts are written instead of the actual bits. This breaks the boot when DEBUG_LL and earlyprintk is enabled; the UART gets disabled and some random bits get enabled. Fix that.
--- arch/arm/mach-omap1/clock_data.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mach-omap1/clock_data.c +2 -2
@@ -700,8 +700,8 @@ int __init omap1_clk_init(void)/* Make sure UART clocks are enabled early */ if (cpu_is_omap16xx ())omap_writel (omap_readl (MOD_CONF_CTRL_0 ) | -CONF_MOD_UART1_CLK_MODE_R | -CONF_MOD_UART3_CLK_MODE_R ,MOD_CONF_CTRL_0 ); + (1 <<CONF_MOD_UART1_CLK_MODE_R ) | + (1 <<CONF_MOD_UART3_CLK_MODE_R ),MOD_CONF_CTRL_0 );#endif /* USB_REQ_EN will be disabled later if necessary (usb_dc_ck) */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 313/666 arm64/xor: fix conflicting attributes for xor_block_template
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 675a0dd596e712404557286d0a883b54ee28e4f4 ]
Commit 2c54b423cf85 ("arm64/xor: use EOR3 instructions when available") changes the definition to __ro_after_init instead of const, but failed to update the external declaration in xor.h. This was not found because xor-neon.c doesn't include <asm/xor.h>, and can't easily do that due to current architecture of the XOR code.
--- arch/arm64/include/asm/xor.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/include/asm/xor.h +1 -1
@@ -13,7 +13,7 @@#ifdef CONFIG_KERNEL_MODE_NEON -extern struct xor_block_template const xor_block_inner_neon; +extern struct xor_block_template xor_block_inner_neon__ro_after_init ; static void xor_neon_2(unsigned long bytes, unsigned long * __restrict p1,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 314/666 ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
[ Upstream commit 0477a6b31e2874e554e3bcfac9883684b8f8ca2d ]
The property interrupts use default interrupt controllers. But pass down gpio<n> as phandle. Correct it by use interrupts-extended.
--- arch/arm/boot/dts/nxp/imx/imx27-eukrea-cpuimx27.dtsi | 8 ++++---- .../boot/dts/nxp/imx/imx27-eukrea-mbimxsd27-baseboard.dts | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-)
arch/arm/boot/dts/nxp/imx/imx27-eukrea-cpuimx27.dtsi +4 -4
@@ -106,7 +106,7 @@ uart8250@3,200000 { compatible = "ns8250"; clocks = <&clk14745600>; fsl,weim-cs-timing = <0x0000d603 0x0d1d0d01 0x00d20000>; - interrupts = <&gpio2 23 IRQ_TYPE_LEVEL_LOW>; + interrupts-extended = <&gpio2 23 IRQ_TYPE_LEVEL_LOW>; reg = <3 0x200000 0x1000>; reg-shift = <1>; reg-io-width = <1>;
@@ -119,7 +119,7 @@ uart8250@3,400000 { compatible = "ns8250"; clocks = <&clk14745600>; fsl,weim-cs-timing = <0x0000d603 0x0d1d0d01 0x00d20000>; - interrupts = <&gpio2 22 IRQ_TYPE_LEVEL_LOW>; + interrupts-extended = <&gpio2 22 IRQ_TYPE_LEVEL_LOW>; reg = <3 0x400000 0x1000>; reg-shift = <1>; reg-io-width = <1>;
@@ -132,7 +132,7 @@ uart8250@3,800000 { compatible = "ns8250"; clocks = <&clk14745600>; fsl,weim-cs-timing = <0x0000d603 0x0d1d0d01 0x00d20000>; - interrupts = <&gpio2 27 IRQ_TYPE_LEVEL_LOW>; + interrupts-extended = <&gpio2 27 IRQ_TYPE_LEVEL_LOW>; reg = <3 0x800000 0x1000>; reg-shift = <1>; reg-io-width = <1>;
@@ -145,7 +145,7 @@ uart8250@3,1000000 { compatible = "ns8250"; clocks = <&clk14745600>; fsl,weim-cs-timing = <0x0000d603 0x0d1d0d01 0x00d20000>; - interrupts = <&gpio2 30 IRQ_TYPE_LEVEL_LOW>; + interrupts-extended = <&gpio2 30 IRQ_TYPE_LEVEL_LOW>; reg = <3 0x1000000 0x1000>; reg-shift = <1>; reg-io-width = <1>;
arch/arm/boot/dts/nxp/imx/imx27-eukrea-mbimxsd27-baseboard.dts +1 -1
@@ -76,7 +76,7 @@ ads7846@0 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_touch>; reg = <0>; - interrupts = <&gpio4 25 IRQ_TYPE_LEVEL_LOW>; + interrupts-extended = <&gpio4 25 IRQ_TYPE_LEVEL_LOW>; spi-cpol; spi-max-frequency = <1500000>; ti,keep-vref-on;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 315/666 firmware: arm_ffa: Use the correct buffer size during RXTX_MAP
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Ene <[email protected]>
[ Upstream commit 83210251fd70d5f96bcdc8911e15f7411a6b2463 ]
Don't use the discovered buffer size from an FFA_FEATURES call directly since we can run on a system that has the PAGE_SIZE larger than the returned size which makes the alloc_pages_exact for the buffer to be rounded up.
--- drivers/firmware/arm_ffa/driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/arm_ffa/driver.c +1 -1
@@ -1804,7 +1804,7 @@ static int __init ffa_init(void) ret =ffa_rxtx_map (virt_to_phys (drv_info->tx_buffer),virt_to_phys (drv_info->rx_buffer), - rxtx_bufsz /FFA_PAGE_SIZE ); +PAGE_ALIGN (rxtx_bufsz) /FFA_PAGE_SIZE );if (ret) {pr_err ("failed to register FFA RxTx buffers\n" ); goto free_pages;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 316/666 ocfs2: fix listxattr handling when the buffer is full
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhengYuan Huang <[email protected]>
[ Upstream commit d12f558e6200b3f47dbef9331ed6d115d2410e59 ]
[BUG]
If an OCFS2 inode has both inline and block-based xattrs, listxattr() can return a size larger than the caller's buffer when the inline names consume that buffer exactly.
kernel BUG at mm/usercopy.c:102!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:usercopy_abort+0xb7/0xd0 mm/usercopy.c:102 Call Trace: __check_heap_object+0xe3/0x120 mm/slub.c:8243 check_heap_object mm/usercopy.c:196 [inline] __check_object_size mm/usercopy.c:250 [inline] __check_object_size+0x5c5/0x780 mm/usercopy.c:215 check_object_size include/linux/ucopysize.h:22 [inline] check_copy_size include/linux/ucopysize.h:59 [inline] copy_to_user include/linux/uaccess.h:219 [inline] listxattr+0xb0/0x170 fs/xattr.c:926 filename_listxattr fs/xattr.c:958 [inline] path_listxattrat+0x137/0x320 fs/xattr.c:988 __do_sys_listxattr fs/xattr.c:1001 [inline] __se_sys_listxattr fs/xattr.c:998 [inline] __x64_sys_listxattr+0x7f/0xd0 fs/xattr.c:998 ...
[CAUSE]
Commit 936b8834366e ("ocfs2: Refactor xattr list and remove ocfs2_xattr_handler().") replaced the old per-handler list accounting with ocfs2_xattr_list_entry(), but it kept using size == 0 to detect probe mode.
That assumption stops being true once ocfs2_listxattr() finishes the inline-xattr pass. If the inline names fill the caller buffer exactly, the block-xattr pass runs with a non-NULL buffer and a remaining size of zero. ocfs2_xattr_list_entry() then skips the bounds check, keeps counting block names, and returns a positive size larger than the supplied buffer.
[FIX]
Detect probe mode by testing whether the destination buffer pointer is NULL instead of whether the remaining size is zero.
That restores the pre-refactor behavior and matches the OCFS2 getxattr helpers. Once the remaining buffer reaches zero while more names are left, the block-xattr pass now returns -ERANGE instead of reporting a size larger than the allocated list buffer.
--- fs/ocfs2/xattr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ocfs2/xattr.c +2 -2
@@ -907,8 +907,8 @@ static int ocfs2_xattr_list_entry(struct super_block *sb, total_len = prefix_len + name_len +1 ; *result += total_len; -/* we are just looking for how big our buffer needs to be */ -if (!size) +/* No buffer means we are only looking for the required size. */ +if (!buffer)return 0 ;if (*result > size)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 317/666 ocfs2: validate bg_bits during freefrag scan
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhengYuan Huang <[email protected]>
[ Upstream commit 8f687eeed3da3012152b0f9473f578869de0cd7b ]
[BUG]
A crafted filesystem can trigger an out-of-bounds bitmap walk when OCFS2_IOC_INFO is issued with OCFS2_INFO_FL_NON_COHERENT.
BUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: use-after-free in test_bit_le include/asm-generic/bitops/le.h:21 [inline] BUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline] BUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline] BUG: KASAN: use-after-free in ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline] BUG: KASAN: use-after-free in ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754 Read of size 8 at addr ffff888031bce000 by task syz.0.636/1435 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xd1/0x650 mm/kasan/report.c:482 kasan_report+0xfb/0x140 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:186 [inline] kasan_check_range+0x11c/0x200 mm/kasan/generic.c:200 __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31 instrument_atomic_read include/linux/instrumented.h:68 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] test_bit_le include/asm-generic/bitops/le.h:21 [inline] ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline] ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline] ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline] ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754 ocfs2_info_handle+0x18d/0x2a0 fs/ocfs2/ioctl.c:828 ocfs2_ioctl+0x632/0x6e0 fs/ocfs2/ioctl.c:913 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583 ...
[CAUSE]ocfs2_info_freefrag_scan_chain() uses on-disk bg_bits directly as the bitmap scan limit. The coherent path reads group descriptors through ocfs2_read_group_descriptor(), which validates the descriptor before use. The non-coherent path uses ocfs2_read_blocks_sync() instead and skips that validation, so an impossible bg_bits value can drive the bitmap walk past the end of the block.
[FIX]
Compute the bitmap capacity from the filesystem format with ocfs2_group_bitmap_size(), report descriptors whose bg_bits exceeds that limit, and clamp the scan to the computed capacity. This keeps the freefrag report going while avoiding reads beyond the buffer.
--- fs/ocfs2/ioctl.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
fs/ocfs2/ioctl.c +17 -1
@@ -443,13 +443,16 @@ static int ocfs2_info_freefrag_scan_chain(struct ocfs2_super *osb,struct buffer_head *bh =NULL ;struct ocfs2_group_desc *bg =NULL ; -unsigned int max_bits, num_clusters; +unsigned int max_bits, max_bitmap_bits, num_clusters;unsigned int offset =0 , cluster, chunk;unsigned int chunk_free, last_chunksize =0 ;if (!le32_to_cpu (rec->c_free)) goto bail; + max_bitmap_bits =8 *ocfs2_group_bitmap_size (osb->sb,0 , + osb->s_feature_incompat); + do { if (!bg) blkno = le64_to_cpu(rec->c_blkno);
@@ -481,6 +484,19 @@ static int ocfs2_info_freefrag_scan_chain(struct ocfs2_super *osb,continue ; max_bits =le16_to_cpu (bg->bg_bits); + +/* +* Non-coherent scans read raw blocks and do not get the +* bg_bits validation from +* ocfs2_read_group_descriptor(). +*/ +if (max_bits > max_bitmap_bits) { +mlog (ML_ERROR , +"Group desc #%llu has %u bits, max bitmap bits %u\n" , + (unsigned long long )blkno, max_bits, max_bitmap_bits); + max_bits = max_bitmap_bits; + } + offset =0 ;for (chunk =0 ; chunk < chunks_in_group; chunk++) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 318/666 ocfs2: validate group add input before caching
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhengYuan Huang <[email protected]>
[ Upstream commit 70b672833f4025341c11b22c7f83778a5cd611bc ]
[BUG]OCFS2_IOC_GROUP_ADD can trigger a BUG_ON inocfs2_set_new_buffer_uptodate():
kernel BUG at fs/ocfs2/uptodate.c:509!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ocfs2_set_new_buffer_uptodate+0x194/0x1e0 fs/ocfs2/uptodate.c:509 Code: ffffe88f 42b9fe4c 89e64889 dfe8b4df Call Trace: ocfs2_group_add+0x3f1/0x1510 fs/ocfs2/resize.c:507 ocfs2_ioctl+0x309/0x6e0 fs/ocfs2/ioctl.c:887 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583 x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7bbfb55a966d
[CAUSE]ocfs2_group_add() calls ocfs2_set_new_buffer_uptodate() on a user-controlled group block before ocfs2_verify_group_and_input() validates that block number. That helper is only valid for newly allocated metadata and asserts that the block is not already present in the chosen metadata cache. The code also uses INODE_CACHE(inode) even though the group descriptor belongs to main_bm_inode and later journal accesses use that cache context instead.
[FIX]
Validate the on-disk group descriptor before caching it, then add it to the metadata cache tracked by INODE_CACHE(main_bm_inode). Keep the validation failure path separate from the later cleanup path so we only remove the buffer from that cache after it has actually been inserted. This keeps the group buffer lifetime consistent across validation, journaling, and cleanup.
--- fs/ocfs2/resize.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
fs/ocfs2/resize.c +7 -5
@@ -508,14 +508,14 @@ int ocfs2_group_add(struct inode *inode, struct ocfs2_new_group_input *input) goto out_unlock; } -ocfs2_set_new_buffer_uptodate (INODE_CACHE (inode), group_bh); - ret =ocfs2_verify_group_and_input (main_bm_inode, fe, input, group_bh);if (ret) {mlog_errno (ret); goto out_free_group_bh; } +ocfs2_set_new_buffer_uptodate (INODE_CACHE (main_bm_inode), group_bh); +trace_ocfs2_group_add ((unsigned long long )input->group, input->chain, input->clusters, input->frees);
@@ -523,7 +523,7 @@ int ocfs2_group_add(struct inode *inode, struct ocfs2_new_group_input *input)if (IS_ERR (handle)) {mlog_errno (PTR_ERR (handle)); ret = -EINVAL ; - goto out_free_group_bh; + goto out_remove_cache; } cl_bpc =le16_to_cpu (fe->id2.i_chain.cl_bpc);
@@ -577,9 +577,11 @@ int ocfs2_group_add(struct inode *inode, struct ocfs2_new_group_input *input) out_commit:ocfs2_commit_trans (osb, handle); -out_free_group_bh: +out_remove_cache:if (ret <0 ) -ocfs2_remove_from_cache (INODE_CACHE (inode), group_bh); +ocfs2_remove_from_cache (INODE_CACHE (main_bm_inode), group_bh); + +out_free_group_bh:brelse (group_bh); out_unlock:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 319/666 dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Khairul Anuar Romli <[email protected]>
[ Upstream commit 48278a72fce8a8d30efaedeb206c9c3f05c1eb3f ]
checkpatch.pl --strict reports a WARNING in dw-axi-dmac-platform.c:
WARNING: void function return statements are not generally useful
FILE: drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
According to Linux kernel coding style [Documentation/process/ coding-style.rst], explicit "return;" statements at the end of void functions are redundant and should be omitted. The function will automatically return upon reaching the closing brace, so the extra statement adds unnecessary clutter without functional benefit.
This patch removes the superfluous "return;" statement in dw_axi_dma_set_hw_channel() to comply with kernel coding standards and eliminate the checkpatch warning.
--- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 2 -- 1 file changed, 2 deletions(-)
drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +0 -2
@@ -592,8 +592,6 @@ static void dw_axi_dma_set_hw_channel(struct axi_dma_chan *chan, bool set) (chan->id * DMA_APB_HS_SEL_BIT_SIZE)); reg_value |= (val << (chan->id *DMA_APB_HS_SEL_BIT_SIZE ));lo_hi_writeq (reg_value, chip->apb_regs +DMAC_APB_HW_HS_SEL_0 ); - -return ; }/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 320/666 soundwire: bus: demote UNATTACHED state warnings to dev_dbg()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cole Leavitt <[email protected]>
[ Upstream commit 2c96956fe764f8224f9ec93b2a9160a578949a7a ]
The dev_warn() messages in sdw_handle_slave_status() for UNATTACHED transitions were added in commit d1b328557058 ("soundwire: bus: add dev_warn() messages to track UNATTACHED devices") to debug attachment failures with dynamic debug enabled.
These warnings fire during normal operation -- for example when a codec driver triggers a hardware reset after firmware download, causing the device to momentarily go UNATTACHED before re-attaching -- producing misleading noise on every boot.
Demote the messages to dev_dbg() so they remain available via dynamic debug for diagnosing real attachment failures without alarming users during expected initialization sequences.
--- drivers/soundwire/bus.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/soundwire/bus.c +4 -4
@@ -1866,8 +1866,8 @@ int sdw_handle_slave_status(struct sdw_bus *bus,if (status[i] ==SDW_SLAVE_UNATTACHED && slave->status !=SDW_SLAVE_UNATTACHED ) { -dev_warn (&slave->dev,"Slave %d state check1: UNATTACHED, status was %d\n" , - i, slave->status); +dev_dbg (&slave->dev,"Slave %d state check1: UNATTACHED, status was %d\n" , + i, slave->status);sdw_modify_slave_status (slave,SDW_SLAVE_UNATTACHED );/* Ensure driver knows that peripheral unattached */
@@ -1918,8 +1918,8 @@ int sdw_handle_slave_status(struct sdw_bus *bus,if (slave->status ==SDW_SLAVE_UNATTACHED )break ; -dev_warn (&slave->dev,"Slave %d state check2: UNATTACHED, status was %d\n" , - i, slave->status); +dev_dbg (&slave->dev,"Slave %d state check2: UNATTACHED, status was %d\n" , + i, slave->status);sdw_modify_slave_status (slave,SDW_SLAVE_UNATTACHED );break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 321/666 dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
[ Upstream commit ab2bf6d4c0a0152907b18d25c1b118ea5ea779df ]
Propagate the return value of of_dma_controller_register() in probe() instead of ignoring it.
--- drivers/dma/mxs-dma.c | 1 + 1 file changed, 1 insertion(+)
drivers/dma/mxs-dma.c +1 -0
@@ -824,6 +824,7 @@ static int mxs_dma_probe(struct platform_device *pdev)if (ret) {dev_err (mxs_dma->dma_device.dev,"failed to register controller\n" ); +return ret; }dev_info (mxs_dma->dma_device.dev,"initialized\n" );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 322/666 soundwire: cadence: Clear message complete before signaling waiting thread
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit cbfea84f820962c3c5394ff06e7e9344c96bf761 ]
Clear the CDNS_MCP_INT_RX_WL interrupt before signaling completion.
This is to prevent the potential race where:
- The main thread is scheduled immediately the completion is signaled, and starts a new message
- The RX_WL IRQ for this new message happens before sdw_cdns_irq() has been re-scheduled.
- When sdw_cdns_irq() is re-scheduled it clears the new RX_WL interrupt.
MAIN THREAD | IRQ THREAD
|
_cdns_xfer_msg() |
{ |
write data to FIFO |
wait_for_completion_timeout() |
<BLOCKED> | <---- RX_WL IRQ
| sdw_cdns_irq()
| {
| signal completion
<== RESCHEDULE <==
Handle message completion |
} |
|
Start new message |
_cdns_xfer_msg() |
{ |
write data to FIFO |
wait_for_completion_timeout() |
<BLOCKED> | <---- RX_WL IRQ ==> RESCHEDULE ==>
| // New RX_WL IRQ is cleared before
| // it has been handled.
| clear CDNS_MCP_INTSTAT
| return IRQ_HANDLED;
| }
Before this change, this error message was sometimes seen on kernels that have large amounts of debugging enabled:
SCP Msg trf timed out
This error indicates that the completion has not been signalled after 500ms.
--- drivers/soundwire/cadence_master.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/soundwire/cadence_master.c +8 -0
@@ -931,6 +931,14 @@ irqreturn_t sdw_cdns_irq(int irq, void *dev_id)cdns_read_response (cdns); +/* +* Clear interrupt before signalling the completion to avoid +* a race between this thread and the main thread starting +* another TX. +*/ +cdns_writel (cdns,CDNS_MCP_INTSTAT ,CDNS_MCP_INT_RX_WL ); + int_status &= ~CDNS_MCP_INT_RX_WL ; +if (defer && defer->msg) {cdns_fill_msg_resp (cdns, defer->msg, defer->length,0 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 323/666 tracing: Rebuild full_name on each hist_field_name() call
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 5ec1d1e97de134beed3a5b08235a60fc1c51af96 ]
hist_field_name() uses a static MAX_FILTER_STR_VAL buffer for fully qualified variable-reference names, but it currently appends into that buffer with strcat() without rebuilding it first. As a result, repeated calls append a new "system.event.field" name onto the previous one, which can eventually run past the end of full_name.
Build the name with snprintf() on each call and return NULL if the fully qualified name does not fit in MAX_FILTER_STR_VAL.
--- kernel/trace/trace_events_hist.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
kernel/trace/trace_events_hist.c +7 -5
@@ -1342,12 +1342,14 @@ static const char *hist_field_name(struct hist_field *field, field->flags & HIST_FIELD_FL_VAR_REF) {if (field->system) {static char full_name[MAX_FILTER_STR_VAL ]; +int len; + + len =snprintf (full_name,sizeof (full_name),"%s.%s.%s" , + field->system, field->event_name, + field->name); +if (len >=sizeof (full_name)) +return NULL ; -strcat (full_name, field->system); -strcat (full_name,"." ); -strcat (full_name, field->event_name); -strcat (full_name,"." ); -strcat (full_name, field->name); field_name = full_name; }else field_name = field->name;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 324/666 hte: tegra194: remove Kconfig dependency on Tegra194 SoC
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Lavra <[email protected]>
[ Upstream commit 92dfd92f747698352b256cd9ddd7497bb7ebe9c8 ]
This driver runs also on other Tegra SoCs (e.g. Tegra234). Replace Kconfig dependency on Tegra194 with more generic dependency on Tegra, and amend the Kconfig help text to reflect the fact that this driver works on SoCs other than Tegra194.
--- drivers/hte/Kconfig | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/hte/Kconfig +3 -3
@@ -16,13 +16,13 @@ if HTE config HTE_TEGRA194 tristate "NVIDIA Tegra194 HTE Support" - depends on (ARCH_TEGRA_194_SOC || COMPILE_TEST) + depends on (ARCH_TEGRA || COMPILE_TEST) depends on GPIOLIB help Enable this option for integrated hardware timestamping engine also known as generic timestamping engine (GTE) support on NVIDIA Tegra194 - systems-on-chip. The driver supports 352 LIC IRQs and 39 AON GPIOs - lines for timestamping in realtime. + and later systems-on-chip. The driver supports 352 LIC IRQs and 39 + AON GPIOs lines for timestamping in realtime. config HTE_TEGRA194_TEST tristate "NVIDIA Tegra194 HTE Test"
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 325/666 remoteproc: xlnx: Fix sram property parsing
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Michals <[email protected]>
[ Upstream commit d116bccf6f1c199b27c9ebdf07cc3cfe868f919c ]
As per sram bindings, "sram" property can be list of phandles. When more than one sram phandles are listed, driver can't parse second phandle's address correctly. Because, phandle index is passed to the API instead of offset of address from reg property which is always 0 as per sram.yaml bindings. Fix it by passing 0 to the API instead of sram phandle index.
--- drivers/remoteproc/xlnx_r5_remoteproc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/remoteproc/xlnx_r5_remoteproc.c +1 -1
@@ -990,7 +990,7 @@ static int zynqmp_r5_get_sram_banks(struct zynqmp_r5_core *r5_core) }/* Get SRAM device address */ - ret =of_property_read_reg (sram_np, i, &abs_addr, &size); + ret =of_property_read_reg (sram_np,0 , &abs_addr, &size);if (ret) {dev_err (dev,"failed to get reg property\n" ); goto fail_sram_get;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 326/666 ima: check return value of crypto_shash_final() in boot aggregate
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Hodges <[email protected]>
[ Upstream commit 870819434c8dfcc3158033b66e7851b81bb17e21 ]
The return value of crypto_shash_final() is not checked in ima_calc_boot_aggregate_tfm(). If the hash finalization fails, the function returns success and a corrupted boot aggregate digest could be used for IMA measurements.
Capture the return value and propagate any error to the caller.
--- security/integrity/ima/ima_crypto.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/integrity/ima/ima_crypto.c +1 -1
@@ -832,7 +832,7 @@ static int ima_calc_boot_aggregate_tfm(char *digest, u16 alg_id, } }if (!rc) -crypto_shash_final (shash, digest); + rc =crypto_shash_final (shash, digest);return rc; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 327/666 HID: asus: make asus_resume adhere to linux kernel coding standards
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Benato <[email protected]>
[ Upstream commit 51d33b42b8ae23da92819d28439fdd5636c45186 ]
Linux kernel coding standars requires functions opening brackets to be in a newline: move the opening bracket of asus_resume in its own line.
--- drivers/hid/hid-asus.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/hid/hid-asus.c +2 -1
@@ -1092,7 +1092,8 @@ static int asus_start_multitouch(struct hid_device *hdev)return 0 ; } -static int __maybe_unused asus_resume (struct hid_device *hdev) { +static int __maybe_unused asus_resume (struct hid_device *hdev) +{struct asus_drvdata *drvdata =hid_get_drvdata (hdev);int ret =0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 328/666 HID: asus: do not abort probe when not necessary
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Benato <[email protected]>
[ Upstream commit 7253091766ded0fd81fe8d8be9b8b835495b06e8 ]
In order to avoid dereferencing a NULL pointer asus_probe is aborted early and control of some asus devices is transferred over hid-generic after erroring out even when such NULL dereference cannot happen: only early abort when the NULL dereference can happen.
Also make the code shorter and more adherent to coding standards removing square brackets enclosing single-line if-else statements.
--- drivers/hid/hid-asus.c | 25 ++++++++++--------------- 1 file changed, 10 insertions(+), 15 deletions(-)
drivers/hid/hid-asus.c +10 -15
@@ -1220,22 +1220,17 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id)* were freed during registration due to no usages being mapped, * leaving drvdata->input pointing to freed memory. */ -if (!drvdata->input || !(hdev->claimed &HID_CLAIMED_INPUT )) { -hid_err (hdev,"Asus input not registered\n" ); - ret = -ENOMEM ; - goto err_stop_hw; - } - -if (drvdata->tp) { - drvdata->input->name ="Asus TouchPad" ; - }else { - drvdata->input->name ="Asus Keyboard" ; - } +if (drvdata->input && (hdev->claimed &HID_CLAIMED_INPUT )) { +if (drvdata->tp) + drvdata->input->name ="Asus TouchPad" ; +else + drvdata->input->name ="Asus Keyboard" ; -if (drvdata->tp) { - ret =asus_start_multitouch (hdev); -if (ret) - goto err_stop_hw; +if (drvdata->tp) { + ret =asus_start_multitouch (hdev); +if (ret) + goto err_stop_hw; + } }return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 329/666 mtd: physmap_of_gemini: Fix disabled pinctrl state check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit b7c0982184b0661f5b1b805f3a56f1bd3757b63e ]
The condition for checking the disabled pinctrl state incorrectly checks gf->enabled_state instead of gf->disabled_state. This causes misleading error messages and could lead to incorrect behavior when only one of the pinctrl states is defined.
Fix the condition to properly check gf->disabled_state.
--- drivers/mtd/maps/physmap-gemini.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/maps/physmap-gemini.c +1 -1
@@ -181,7 +181,7 @@ int of_flash_probe_gemini(struct platform_device *pdev,dev_err (dev,"no enabled pin control state\n" ); gf->disabled_state =pinctrl_lookup_state (gf->p,"disabled" ); -if (IS_ERR (gf->enabled_state)) { +if (IS_ERR (gf->disabled_state)) {dev_err (dev,"no disabled pin control state\n" ); }else { ret =pinctrl_select_state (gf->p, gf->disabled_state);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 330/666 ima_fs: dont bother with removal of files in directory well be removing
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 22260a99d791163f7697a240dfc48e4e5a91ecfe ]
removal of parent takes all children out
Stable-dep-of: d7bd8cf0b348 ("ima_fs: Correctly create securityfs files for unsupported hash algos")
--- security/integrity/ima/ima_fs.c | 57 +++++++++++---------------------- 1 file changed, 18 insertions(+), 39 deletions(-)
security/integrity/ima/ima_fs.c +18 -39
@@ -396,11 +396,6 @@ static ssize_t ima_write_policy(struct file *file, const char __user *buf,static struct dentry *ima_dir;static struct dentry *ima_symlink; -static struct dentry *binary_runtime_measurements; -static struct dentry *ascii_runtime_measurements; -static struct dentry *runtime_measurements_count; -static struct dentry *violations; -static struct dentry *ima_policy;enum ima_fs_flags {IMA_FS_BUSY ,
@@ -419,14 +414,7 @@ static const struct seq_operations ima_policy_seqops = {static void __init remove_securityfs_measurement_lists (struct dentry **lists) { -int i; - -if (lists) { -for (i =0 ; i < securityfs_measurement_list_count; i++) -securityfs_remove (lists[i]); - -kfree (lists); - } +kfree (lists); }static int __init create_securityfs_measurement_lists (void )
@@ -533,8 +521,7 @@ static int ima_release_policy(struct inode *inode, struct file *file)ima_update_policy ();#if !defined(CONFIG_IMA_WRITE_POLICY ) && !defined(CONFIG_IMA_READ_POLICY ) -securityfs_remove (ima_policy); - ima_policy =NULL ; +securityfs_remove (file->f_path.dentry);#elif defined(CONFIG_IMA_WRITE_POLICY )clear_bit (IMA_FS_BUSY , &ima_fs_flags);#elif defined(CONFIG_IMA_READ_POLICY )
@@ -553,6 +540,7 @@ static const struct file_operations ima_measure_policy_ops = {int __init ima_fs_init (void ) { +struct dentry *dentry;int ret; ascii_securityfs_measurement_lists =NULL ;
@@ -573,54 +561,45 @@ int __init ima_fs_init(void)if (ret !=0 ) goto out; - binary_runtime_measurements = -securityfs_create_symlink ("binary_runtime_measurements" , ima_dir, + dentry =securityfs_create_symlink ("binary_runtime_measurements" , ima_dir,"binary_runtime_measurements_sha1" ,NULL ); -if (IS_ERR (binary_runtime_measurements)) { - ret =PTR_ERR (binary_runtime_measurements); +if (IS_ERR (dentry)) { + ret =PTR_ERR (dentry); goto out; } - ascii_runtime_measurements = -securityfs_create_symlink ("ascii_runtime_measurements" , ima_dir, + dentry =securityfs_create_symlink ("ascii_runtime_measurements" , ima_dir,"ascii_runtime_measurements_sha1" ,NULL ); -if (IS_ERR (ascii_runtime_measurements)) { - ret =PTR_ERR (ascii_runtime_measurements); +if (IS_ERR (dentry)) { + ret =PTR_ERR (dentry); goto out; } - runtime_measurements_count = -securityfs_create_file ("runtime_measurements_count" , + dentry =securityfs_create_file ("runtime_measurements_count" ,S_IRUSR |S_IRGRP , ima_dir,NULL , &ima_measurements_count_ops); -if (IS_ERR (runtime_measurements_count)) { - ret =PTR_ERR (runtime_measurements_count); +if (IS_ERR (dentry)) { + ret =PTR_ERR (dentry); goto out; } - violations = -securityfs_create_file ("violations" ,S_IRUSR |S_IRGRP , + dentry =securityfs_create_file ("violations" ,S_IRUSR |S_IRGRP , ima_dir,NULL , &ima_htable_violations_ops); -if (IS_ERR (violations)) { - ret =PTR_ERR (violations); +if (IS_ERR (dentry)) { + ret =PTR_ERR (dentry); goto out; } - ima_policy =securityfs_create_file ("policy" ,POLICY_FILE_FLAGS , + dentry =securityfs_create_file ("policy" ,POLICY_FILE_FLAGS , ima_dir,NULL , &ima_measure_policy_ops); -if (IS_ERR (ima_policy)) { - ret =PTR_ERR (ima_policy); +if (IS_ERR (dentry)) { + ret =PTR_ERR (dentry); goto out; }return 0 ; out: -securityfs_remove (ima_policy); -securityfs_remove (violations); -securityfs_remove (runtime_measurements_count); -securityfs_remove (ascii_runtime_measurements); -securityfs_remove (binary_runtime_measurements);remove_securityfs_measurement_lists (ascii_securityfs_measurement_lists);remove_securityfs_measurement_lists (binary_securityfs_measurement_lists); securityfs_measurement_list_count =0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 331/666 ima_fs: get rid of lookup-by-dentry stuff
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit d15ffbbf4d32a9007c4a339a9fecac90ce30432a ]
lookup_template_data_hash_algo() machinery is used to locate the matching ima_algo_array[] element at read time; securityfs allows to stash that into inode->i_private at object creation time, so there's no need to bother
Stable-dep-of: d7bd8cf0b348 ("ima_fs: Correctly create securityfs files for unsupported hash algos")
--- security/integrity/ima/ima_fs.c | 82 +++++++-------------------------- 1 file changed, 16 insertions(+), 66 deletions(-)
security/integrity/ima/ima_fs.c +16 -66
@@ -116,28 +116,6 @@ void ima_putc(struct seq_file *m, void *data, int datalen)seq_putc (m, *(char *)data++); } -static struct dentry **ascii_securityfs_measurement_lists__ro_after_init ; -static struct dentry **binary_securityfs_measurement_lists__ro_after_init ; -static int securityfs_measurement_list_count__ro_after_init ; - -static void lookup_template_data_hash_algo (int *algo_idx,enum hash_algo *algo, -struct seq_file *m, -struct dentry **lists) -{ -struct dentry *dentry; -int i; - - dentry =file_dentry (m->file); - -for (i =0 ; i < securityfs_measurement_list_count; i++) { -if (dentry == lists[i]) { - *algo_idx = i; - *algo = ima_algo_array[i].algo; -break ; - } - } -} -/* print format: * 32bit-le=pcr# * char[n]=template digest
@@ -160,9 +138,10 @@ int ima_measurements_show(struct seq_file *m, void *v) algo_idx = ima_sha1_idx; algo =HASH_ALGO_SHA1 ; -if (m->file !=NULL ) -lookup_template_data_hash_algo (&algo_idx, &algo, m, - binary_securityfs_measurement_lists); +if (m->file !=NULL ) { + algo_idx = (unsigned long )file_inode (m->file)->i_private; + algo = ima_algo_array[algo_idx].algo; + }/* get entry */ e = qe->entry;
@@ -256,9 +235,10 @@ static int ima_ascii_measurements_show(struct seq_file *m, void *v) algo_idx = ima_sha1_idx; algo =HASH_ALGO_SHA1 ; -if (m->file !=NULL ) -lookup_template_data_hash_algo (&algo_idx, &algo, m, - ascii_securityfs_measurement_lists); +if (m->file !=NULL ) { + algo_idx = (unsigned long )file_inode (m->file)->i_private; + algo = ima_algo_array[algo_idx].algo; + }/* get entry */ e = qe->entry;
@@ -412,57 +392,33 @@ static const struct seq_operations ima_policy_seqops = { };#endif -static void __init remove_securityfs_measurement_lists (struct dentry **lists) -{ -kfree (lists); -} -static int __init create_securityfs_measurement_lists (void ) { -char file_name[NAME_MAX +1 ]; -struct dentry *dentry; -u16 algo; -int i; - - securityfs_measurement_list_count =NR_BANKS (ima_tpm_chip); +int count =NR_BANKS (ima_tpm_chip);if (ima_sha1_idx >=NR_BANKS (ima_tpm_chip)) - securityfs_measurement_list_count++; + count++; - ascii_securityfs_measurement_lists = -kcalloc (securityfs_measurement_list_count,sizeof (struct dentry *), -GFP_KERNEL ); -if (!ascii_securityfs_measurement_lists) -return -ENOMEM ; - - binary_securityfs_measurement_lists = -kcalloc (securityfs_measurement_list_count,sizeof (struct dentry *), -GFP_KERNEL ); -if (!binary_securityfs_measurement_lists) -return -ENOMEM ; - -for (i =0 ; i < securityfs_measurement_list_count; i++) { - algo = ima_algo_array[i].algo; +for (int i =0 ; i < count; i++) { +u16 algo = ima_algo_array[i].algo; +char file_name[NAME_MAX +1 ]; +struct dentry *dentry;sprintf (file_name,"ascii_runtime_measurements_%s" , hash_algo_name[algo]); dentry =securityfs_create_file (file_name,S_IRUSR |S_IRGRP , - ima_dir,NULL , + ima_dir, (void *)(uintptr_t )i, &ima_ascii_measurements_ops);if (IS_ERR (dentry))return PTR_ERR (dentry); - ascii_securityfs_measurement_lists[i] = dentry; -sprintf (file_name,"binary_runtime_measurements_%s" , hash_algo_name[algo]); dentry =securityfs_create_file (file_name,S_IRUSR |S_IRGRP , - ima_dir,NULL , + ima_dir, (void *)(uintptr_t )i, &ima_measurements_ops);if (IS_ERR (dentry))return PTR_ERR (dentry); - - binary_securityfs_measurement_lists[i] = dentry; }return 0 ;
@@ -543,9 +499,6 @@ int __init ima_fs_init(void)struct dentry *dentry;int ret; - ascii_securityfs_measurement_lists =NULL ; - binary_securityfs_measurement_lists =NULL ; - ima_dir =securityfs_create_dir ("ima" , integrity_dir);if (IS_ERR (ima_dir))return PTR_ERR (ima_dir);
@@ -600,9 +553,6 @@ int __init ima_fs_init(void)return 0 ; out: -remove_securityfs_measurement_lists (ascii_securityfs_measurement_lists); -remove_securityfs_measurement_lists (binary_securityfs_measurement_lists); - securityfs_measurement_list_count =0 ;securityfs_remove (ima_symlink);securityfs_remove (ima_dir);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 332/666 ima_fs: Correctly create securityfs files for unsupported hash algos
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Safonov <[email protected]>
[ Upstream commit d7bd8cf0b348d3edae7bee33e74a32b21668b181 ]
ima_tpm_chip->allocated_banks[i].crypto_id is initialized to HASH_ALGO__LAST if the TPM algorithm is not supported. However there are places relying on the algorithm to be valid because it is accessed by hash_algo_name[].
On 6.12.40 I observe the following read out-of-bounds in hash_algo_name:
==================================================================
BUG: KASAN: global-out-of-bounds in create_securityfs_measurement_lists+0x396/0x440
Read of size 8 at addr ffffffff83e18138 by task swapper/0/1
CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.40 #3
Call Trace:
<TASK>
dump_stack_lvl+0x61/0x90
print_report+0xc4/0x580
? kasan_addr_to_slab+0x26/0x80
? create_securityfs_measurement_lists+0x396/0x440
kasan_report+0xc2/0x100
? create_securityfs_measurement_lists+0x396/0x440
create_securityfs_measurement_lists+0x396/0x440
ima_fs_init+0xa3/0x300
ima_init+0x7d/0xd0
init_ima+0x28/0x100
do_one_initcall+0xa6/0x3e0
kernel_init_freeable+0x455/0x740
kernel_init+0x24/0x1d0
ret_from_fork+0x38/0x80
ret_from_fork_asm+0x11/0x20
</TASK>
The buggy address belongs to the variable:
hash_algo_name+0xb8/0x420
Memory state around the buggy address:
ffffffff83e18000: 00 01 f9 f9 f9 f9 f9 f9 00 01 f9 f9 f9 f9 f9 f9
ffffffff83e18080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffffff83e18100: 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 00 05 f9 f9
^
ffffffff83e18180: f9 f9 f9 f9 00 00 00 00 00 00 00 04 f9 f9 f9 f9
ffffffff83e18200: 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9 f9 f9
==================================================================Seems like the TPM chip supports sha3_256, which isn't yet in tpm_algorithms:
tpm tpm0: TPM with unsupported bank algorithm 0x0027
That's TPM_ALG_SHA3_256 == 0x0027 from "Trusted Platform Module 2.0 Library Part 2: Structures", page 51 [1].
See also the related U-Boot algorithms update [2].
Thus solve the problem by creating a file name with "_tpm_alg_<ID>" postfix if the crypto algorithm isn't initialized.
This is how it looks on the test machine (patch ported to v6.12 release):
# ls -1 /sys/kernel/security/ima/ ascii_runtime_measurements ascii_runtime_measurements_tpm_alg_27 ascii_runtime_measurements_sha1 ascii_runtime_measurements_sha256 binary_runtime_measurements binary_runtime_measurements_tpm_alg_27 binary_runtime_measurements_sha1 binary_runtime_measurements_sha256 policy runtime_measurements_count violations
[1]: https://trustedcomputinggroup.org/wp-content/uploads/Trusted-Platform-Module-2.0-Library-Part-2-Version-184_pub.pdf
[2]: https://lists.denx.de/pipermail/u-boot/2024-July/558835.html
--- security/integrity/ima/ima_fs.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
security/integrity/ima/ima_fs.c +12 -4
@@ -404,16 +404,24 @@ static int __init create_securityfs_measurement_lists(void)char file_name[NAME_MAX +1 ];struct dentry *dentry; -sprintf (file_name,"ascii_runtime_measurements_%s" , - hash_algo_name[algo]); +if (algo ==HASH_ALGO__LAST ) +sprintf (file_name,"ascii_runtime_measurements_tpm_alg_%x" , + ima_tpm_chip->allocated_banks[i].alg_id); +else +sprintf (file_name,"ascii_runtime_measurements_%s" , + hash_algo_name[algo]); dentry =securityfs_create_file (file_name,S_IRUSR |S_IRGRP , ima_dir, (void *)(uintptr_t )i, &ima_ascii_measurements_ops);if (IS_ERR (dentry))return PTR_ERR (dentry); -sprintf (file_name,"binary_runtime_measurements_%s" , - hash_algo_name[algo]); +if (algo ==HASH_ALGO__LAST ) +sprintf (file_name,"binary_runtime_measurements_tpm_alg_%x" , + ima_tpm_chip->allocated_banks[i].alg_id); +else +sprintf (file_name,"binary_runtime_measurements_%s" , + hash_algo_name[algo]); dentry =securityfs_create_file (file_name,S_IRUSR |S_IRGRP , ima_dir, (void *)(uintptr_t )i, &ima_measurements_ops);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 333/666 dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 15cfc8984defc17e5e4de1f58db7b993240fcbda ]
According to the "Arm Generic Interrupt Controller (GIC) Architecture Specification, v3 and v4", revision H.b[1], there can be only 64 Extended PPI interrupts.
[1] https://developer.arm.com/documentation/ihi0069/hb/
--- .../devicetree/bindings/interrupt-controller/arm,gic-v3.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/interrupt-controller/arm,gic-v3.yaml +1 -1
@@ -50,7 +50,7 @@ properties: The 2nd cell contains the interrupt number for the interrupt type. SPI interrupts are in the range [0-987]. PPI interrupts are in the range [0-15]. Extended SPI interrupts are in the range [0-1023]. - Extended PPI interrupts are in the range [0-127]. + Extended PPI interrupts are in the range [0-63]. The 3rd cell is the flags, encoded as follows: bits[3:0] trigger type and level flags.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 334/666 mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haibo Chen <[email protected]>
[ Upstream commit 756564a536ecd8c9d33edd89f0647a91a0b03587 ]
When check read operation, need to setting the op.dummy.nbytes based on current read operation rather than the nor->read_proto.
--- drivers/mtd/spi-nor/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/spi-nor/core.c +1 -1
@@ -2416,7 +2416,7 @@ static int spi_nor_spimem_check_readop(struct spi_nor *nor,/* convert the dummy cycles to the number of bytes */ op.dummy.nbytes = (read->num_mode_clocks + read->num_wait_states) * op.dummy.buswidth /8 ; -if (spi_nor_protocol_is_dtr (nor->read_proto)) +if (spi_nor_protocol_is_dtr (read->proto)) op.dummy.nbytes *=2 ;return spi_nor_spimem_check_op (nor, &op);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 335/666 mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takahiro Kuwano <[email protected]>
[ Upstream commit 653f6def567c81f37302f9591ffd54df3e2a11eb ]
SMPT contains config detection info that describes opcode, address, and dummy cycles to read sector map config. The dummy cycles parameter can be SMPT_CMD_READ_DUMMY_IS_VARIABLE and in that case nor->read_dummy (initialized as 0) is used. In Infineon flash chips, Read Any Register command with variable dummy cycle is defined in SMPT. S25Hx/S28Hx flash has 0 dummy cycle by default to read volatile regiters and nor->read_dummy can work. S25FS-S flash has 8 dummy cycles so we need a hook that can fix dummy cycles with actually used value.
Inroduce smpt_read_dummy() in struct spi_nor_fixups. It is called when the dummy cycle field in SMPT config detection is 'varialble'.
Stable-dep-of: 3620d67b4849 ("mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation")
--- drivers/mtd/spi-nor/core.h | 3 +++ drivers/mtd/spi-nor/sfdp.c | 18 ++++++++++++++++-- 2 files changed, 19 insertions(+), 2 deletions(-)
drivers/mtd/spi-nor/core.h +3 -0
@@ -408,6 +408,8 @@ struct spi_nor_flash_parameter {* flash parameters when information provided by the flash_info * table is incomplete or wrong. * @post_bfpt: called after the BFPT table has been parsed +* @smpt_read_dummy: called during SMPT table is being parsed. Used to fix the +* number of dummy cycles in read register ops. * @post_sfdp: called after SFDP has been parsed (is also called for SPI NORs * that do not support RDSFDP). Typically used to tweak various * parameters that could not be extracted by other means (i.e.
@@ -425,6 +427,7 @@ struct spi_nor_fixups {int (*post_bfpt)(struct spi_nor *nor,const struct sfdp_parameter_header *bfpt_header,const struct sfdp_bfpt *bfpt); +void (*smpt_read_dummy)(const struct spi_nor *nor,u8 *read_dummy);int (*post_sfdp)(struct spi_nor *nor);int (*late_init)(struct spi_nor *nor); };
drivers/mtd/spi-nor/sfdp.c +16 -2
@@ -695,6 +695,17 @@ static u8 spi_nor_smpt_addr_nbytes(const struct spi_nor *nor, const u32 settings } } +static void spi_nor_smpt_read_dummy_fixups (const struct spi_nor *nor, +u8 *read_dummy) +{ +if (nor->manufacturer && nor->manufacturer->fixups && + nor->manufacturer->fixups->smpt_read_dummy) + nor->manufacturer->fixups->smpt_read_dummy (nor, read_dummy); + +if (nor->info->fixups && nor->info->fixups->smpt_read_dummy) + nor->info->fixups->smpt_read_dummy (nor, read_dummy); +} +/** * spi_nor_smpt_read_dummy() - return the configuration detection command read * latency, in clock cycles.
@@ -707,8 +718,11 @@ static u8 spi_nor_smpt_read_dummy(const struct spi_nor *nor, const u32 settings) {u8 read_dummy =SMPT_CMD_READ_DUMMY (settings); -if (read_dummy ==SMPT_CMD_READ_DUMMY_IS_VARIABLE ) -return nor->read_dummy; +if (read_dummy ==SMPT_CMD_READ_DUMMY_IS_VARIABLE ) { + read_dummy = nor->read_dummy; +spi_nor_smpt_read_dummy_fixups (nor, &read_dummy); + } +return read_dummy; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 336/666 mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takahiro Kuwano <[email protected]>
[ Upstream commit f74de390557bf2bcc5dca4a357b41c0701d3f76e ]
Certain chips have inconsistent Sector Map Parameter Table (SMPT) data, which leads to the wrong map ID being identified, causing failures to detect the correct sector map.
To fix this, introduce smpt_map_id() into the struct spi_nor_fixups. This function will be called after the initial SMPT-based detection, allowing chip-specific logic to correct the map ID.
Infineon S25FS512S needs this fixup as it has inconsistency between map ID definition and configuration register value actually obtained.
Stable-dep-of: 3620d67b4849 ("mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation")
--- drivers/mtd/spi-nor/core.h | 3 +++ drivers/mtd/spi-nor/sfdp.c | 12 ++++++++++++ 2 files changed, 15 insertions(+)
drivers/mtd/spi-nor/core.h +3 -0
@@ -410,6 +410,8 @@ struct spi_nor_flash_parameter {* @post_bfpt: called after the BFPT table has been parsed * @smpt_read_dummy: called during SMPT table is being parsed. Used to fix the * number of dummy cycles in read register ops. +* @smpt_map_id: called after map ID in SMPT table has been determined for the +* case the map ID is wrong and needs to be fixed. * @post_sfdp: called after SFDP has been parsed (is also called for SPI NORs * that do not support RDSFDP). Typically used to tweak various * parameters that could not be extracted by other means (i.e.
@@ -428,6 +430,7 @@ struct spi_nor_fixups {const struct sfdp_parameter_header *bfpt_header, const struct sfdp_bfpt *bfpt);void (*smpt_read_dummy)(const struct spi_nor *nor,u8 *read_dummy); +void (*smpt_map_id)(const struct spi_nor *nor,u8 *map_id);int (*post_sfdp)(struct spi_nor *nor);int (*late_init)(struct spi_nor *nor); };
drivers/mtd/spi-nor/sfdp.c +12 -0
@@ -726,6 +726,16 @@ static u8 spi_nor_smpt_read_dummy(const struct spi_nor *nor, const u32 settings)return read_dummy; } +static void spi_nor_smpt_map_id_fixups (const struct spi_nor *nor,u8 *map_id) +{ +if (nor->manufacturer && nor->manufacturer->fixups && + nor->manufacturer->fixups->smpt_map_id) + nor->manufacturer->fixups->smpt_map_id (nor, map_id); + +if (nor->info->fixups && nor->info->fixups->smpt_map_id) + nor->info->fixups->smpt_map_id (nor, map_id); +} +/** * spi_nor_get_map_in_use() - get the configuration map in use * @nor: pointer to a 'struct spi_nor'
@@ -779,6 +789,8 @@ static const u32 *spi_nor_get_map_in_use(struct spi_nor *nor, const u32 *smpt, map_id = map_id <<1 | !!(*buf & read_data_mask); } +spi_nor_smpt_map_id_fixups (nor, &map_id); +/* * If command descriptors are provided, they always precede map * descriptors in the table. There is no need to start the iteration
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 337/666 mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit 3620d67b48493c6252bbc873dc88dde81641d56b ]
After commit 5273cc6df984 ("mtd: spi-nor: core: Call spi_nor_post_sfdp_fixups() only when SFDP is defined") spi_nor_post_sfdp_fixups() isn't called anymore if no SFDP is detected.
Update the documentation accordingly.
--- drivers/mtd/spi-nor/core.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/spi-nor/core.h +1 -1
@@ -412,7 +412,7 @@ struct spi_nor_flash_parameter {* number of dummy cycles in read register ops. * @smpt_map_id: called after map ID in SMPT table has been determined for the * case the map ID is wrong and needs to be fixed. -* @post_sfdp: called after SFDP has been parsed (is also called for SPI NORs +* @post_sfdp: called after SFDP has been parsed (is not called for SPI NORs * that do not support RDSFDP). Typically used to tweak various * parameters that could not be extracted by other means (i.e. * when information provided by the SFDP/flash_info tables are
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 338/666 mtd: spi-nor: swp: check SR_TB flag when getting tb_mask
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shiji Yang <[email protected]>
[ Upstream commit 94645aa41bf9ecb87c2ce78b1c3405bfb6074a37 ]
When the chip does not support top/bottom block protect, the tb_mask must be set to 0, otherwise SR1 bit5 will be unexpectedly modified.
--- drivers/mtd/spi-nor/swp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/mtd/spi-nor/swp.c +3 -1
@@ -27,8 +27,10 @@ static u8 spi_nor_get_sr_tb_mask(struct spi_nor *nor) {if (nor->flags &SNOR_F_HAS_SR_TB_BIT6 )return SR_TB_BIT6 ; -else +else if (nor->flags &SNOR_F_HAS_SR_TB )return SR_TB_BIT5 ; +else +return 0 ; }static u64 spi_nor_get_min_prot_length_sr (struct spi_nor *nor)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 339/666 mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Tanislav <[email protected]>
[ Upstream commit 0c87dea1aab86116211cb37387c404c9e9231c39 ]
ofpart_none can only be reached after the for_each_child_of_node() loop finishes. for_each_child_of_node() correctly calls of_node_put() for all device nodes it iterates over as long as we don't break or jump out of the loop.
Calling of_node_put() inside the ofpart_none path will wrongly decrement the ref count of the last node in the for_each_child_of_node() loop.
Move the call to of_node_put() under the ofpart_fail label to fix this.
--- drivers/mtd/parsers/ofpart_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/parsers/ofpart_core.c +1 -1
@@ -191,11 +191,11 @@ static int parse_fixed_partitions(struct mtd_info *master, ofpart_fail:pr_err ("%s: error parsing ofpart partition %pOF (%pOF)\n" , master->name, pp, mtd_node); +of_node_put (pp); ret = -EINVAL ; ofpart_none:if (dedicated)of_node_put (ofpart_node); -of_node_put (pp);kfree (parts);return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 340/666 mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Tanislav <[email protected]>
[ Upstream commit e882626c1747653f1f01ea9d12e278e613b11d0f ]
In order to parse sub-partitions, add_mtd_partitions() calls parse_mtd_partitions() for all previously found partitions.
Each partition will end up being passed to parse_fixed_partitions(), and its of_node will be treated as the ofpart_node.
Commit 7cce81df7d26 ("mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions()") added of_node_put() calls for ofpart_node on all exit paths.
In the case where the partition passed to parse_fixed_partitions() has a parent, it is treated as a dedicated partitions node, and of_node_put() is wrongly called for it, even if of_node_get() was not called explicitly.
On repeated bind / unbinds of the MTD, the extra of_node_put() ends up decrementing the refcount down to 0, which should never happen, resulting in the following error:
OF: ERROR: of_node_release() detected bad of_node_put() on /soc/spi@80007000/flash@0/partitions/partition@0
Call of_node_get() to balance the call to of_node_put() done for dedicated partitions nodes.
--- drivers/mtd/parsers/ofpart_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/parsers/ofpart_core.c +1 -1
@@ -71,7 +71,7 @@ static int parse_fixed_partitions(struct mtd_info *master, dedicated = false; } }else {/* Partition */ - ofpart_node = mtd_node; + ofpart_node =of_node_get (mtd_node); } of_id =of_match_node (parse_ofpart_match_table, ofpart_node);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 341/666 cxl/pci: Check memdev driver binding status in cxl_reset_done()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Ming <[email protected]>
[ Upstream commit e8069c66d09309579e53567be8ddfa6ccb2f452a ]
cxl_reset_done() accesses the endpoint of the corresponding CXL memdev without endpoint validity checking. By default, cxlmd->endpoint is initialized to -ENXIO, if cxl_reset_done() is triggered after the corresponding CXL memdev probing failed, this results in access to an invalid endpoint.
CXL subsystem can always check CXL memdev driver binding status to confirm its endpoint validity. So adding the CXL memdev driver checking inside cxl_reset_done() to avoid accessing an invalid endpoint.
--- drivers/cxl/pci.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/cxl/pci.c +3 -0
@@ -994,6 +994,9 @@ static void cxl_reset_done(struct pci_dev *pdev)* that no longer exists. */ guard (device)(&cxlmd->dev); +if (!cxlmd->dev.driver) +return ; +if (cxlmd->endpoint &&cxl_endpoint_decoder_reset_detected (cxlmd->endpoint)) {dev_crit (dev,"SBR happened without memory regions removal.\n" );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 342/666 mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Genoud <[email protected]>
[ Upstream commit 848c13996c55fe4ea6bf5acc3ce6c8c5c944b5f6 ]
When dumping the OOB, the bytes at the end where actually copied from the beginning of the OOB instead of current_offset.
That leads to something like:
OOB: ff ff ff ff ff ff ff ff ea 19 00 3a 83 db aa 8d
OOB: 99 09 c8 9a 90 36 35 7d aa 15 13 07 3d 97 b2 a4
OOB: a8 bb 19 b3 07 e9 f6 25 52 d7 1a 23 e2 7e 0a e4
OOB: 52 8a 09 d2 1a 86 3d cf b4 99 43 13 d3 90 33 0b
OOB: ff ff ff ff ff ff ff ff ea 19 00 3a 83 db aa 8d
OOB: 99 09 c8 9a 90 36 35 7d aa 15 13 07 3d 97 b2 a4
OOB: a8 bb 19 b3 07 e9 f6 25 52 d7 1a 23 e2 7e 0a e4
OOB: 52 8a 09 d2 1a 86 3d cf b4 99 43 13 d3 90 33 0b instead of:
OOB: ff ff ff ff ff ff ff ff ea 19 00 3a 83 db aa 8d
OOB: 99 09 c8 9a 90 36 35 7d aa 15 13 07 3d 97 b2 a4
OOB: a8 bb 19 b3 07 e9 f6 25 52 d7 1a 23 e2 7e 0a e4
OOB: 52 8a 09 d2 1a 86 3d cf b4 99 43 13 d3 90 33 0b
OOB: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
OOB: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
OOB: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
OOB: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff (example with BCH16, user data [8,0], no scrambling)
*cur_off (offset from the beginning of the page) was compared to offset (offset from the beginning of the OOB), and then, the nand_change_read_column_op() sets the current position to the beginning of the OOB instead of OOB+offset
--- drivers/mtd/nand/raw/sunxi_nand.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/mtd/nand/raw/sunxi_nand.c +3 -3
@@ -886,9 +886,9 @@ static void sunxi_nfc_hw_ecc_read_extra_oob(struct nand_chip *nand,if (len <=0 )return ; -if (!cur_off || *cur_off != offset) -nand_change_read_column_op (nand, mtd->writesize,NULL ,0 , - false); +if (!cur_off || *cur_off != (offset + mtd->writesize)) +nand_change_read_column_op (nand, mtd->writesize + offset, +NULL ,0 , false);if (!randomize)sunxi_nfc_read_buf (nand, oob + offset, len);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 343/666 HID: usbhid: fix deadlock in hid_post_reset()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
[ Upstream commit 8df2c1b47ee3cd50fd454f75c7a7e2ae8a6adf72 ]
You can build a USB device that includes a HID component and a storage or UAS component. The components can be reset only together. That means that hid_pre_reset() and hid_post_reset() are in the block IO error handling. Hence no memory allocation used in them may do block IO because the IO can deadlock on the mutex held while resetting a device and calling the interface drivers.
Use GFP_NOIO for all allocations in them.
--- drivers/hid/usbhid/hid-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/usbhid/hid-core.c +1 -1
@@ -1552,7 +1552,7 @@ static int hid_post_reset(struct usb_interface *intf)* configuration descriptors passed, we already know that * the size of the HID report descriptor has not changed. */ - rdesc =kmalloc (hid->dev_rsize,GFP_KERNEL ); + rdesc =kmalloc (hid->dev_rsize,GFP_NOIO );if (!rdesc)return -ENOMEM ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 344/666 ext4: fix possible null-ptr-deref in mbt_kunit_exit()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
[ Upstream commit 22f53f08d9eb837ce69b1a07641d414aac8d045f ]
There's issue as follows:
# test_new_blocks_simple: failed to initialize: -12
KASAN: null-ptr-deref in range [0x0000000000000638-0x000000000000063f] Tainted: [E]=UNSIGNED_MODULE, [N]=TEST RIP: 0010:mbt_kunit_exit+0x5e/0x3e0 [ext4_test] Call Trace: <TASK> kunit_try_run_case_cleanup+0xbc/0x100 [kunit] kunit_generic_run_threadfn_adapter+0x89/0x100 [kunit] kthread+0x408/0x540 ret_from_fork+0xa76/0xdf0 ret_from_fork_asm+0x1a/0x30
If mbt_kunit_init() init testcase failed will lead to null-ptr-deref. So add test if 'sb' is inited success in mbt_kunit_exit().
--- fs/ext4/mballoc-test.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/ext4/mballoc-test.c +5 -1
@@ -362,7 +362,6 @@ static int mbt_kunit_init(struct kunit *test)return ret; } - test->priv = sb;kunit_activate_static_stub (test, ext4_read_block_bitmap_nowait, ext4_read_block_bitmap_nowait_stub);
@@ -383,6 +382,8 @@ static int mbt_kunit_init(struct kunit *test)return -ENOMEM ; } + test->priv = sb; +return 0 ; }
@@ -390,6 +391,9 @@ static void mbt_kunit_exit(struct kunit *test) {struct super_block *sb = (struct super_block *)test->priv; +if (!sb) +return ; +mbt_mb_release (sb);mbt_ctx_release (sb);mbt_ext4_free_super_block (sb);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 345/666 bpf, arm64: Fix off-by-one in check_imm signed range check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 1dd8be4ec722ce54e4cace59f3a4ba658111b3ec ]
check_imm(bits, imm) is used in the arm64 BPF JIT to verify that a branch displacement (in arm64 instruction units) fits into the signed N-bit immediate field of a B, B.cond or CBZ/CBNZ encoding before it is handed to the encoder. The macro currently tests for (imm > 0 && imm >> bits) || (imm < 0 && ~imm >> bits) which admits values in [-2^N, 2^N) — effectively a signed (N+1)-bit range. A signed N-bit field only holds [-2^(N-1), 2^(N-1)), so the check admits one extra bit of range on each side.
In particular, for check_imm19(), values in [2^18, 2^19) slip past the check but do not fit into the 19-bit signed imm19 field of B.cond. aarch64_insn_encode_immediate() then masks the raw value into the 19-bit field, setting bit 18 (the sign bit) and flipping a forward branch into a backward one. Same class of issue exists for check_imm26() and the B/BL encoding. Shift by (bits - 1) instead of bits so the actual signed N-bit range is enforced.
--- arch/arm64/net/bpf_jit_comp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/net/bpf_jit_comp.c +2 -2
@@ -33,8 +33,8 @@#define ARENA_VM_START (MAX_BPF_JIT_REG + 5)#define check_imm (bits, imm) do { \ - if ((((imm) > 0) && ((imm) >> (bits))) || \ - (((imm) < 0) && (~(imm) >> (bits)))) { \ + if ((((imm) > 0) && ((imm) >> ((bits) - 1))) || \ + (((imm) < 0) && (~(imm) >> ((bits) - 1)))) { \ pr_info("[%2d] imm=%d(0x%x) out of range\n", \ i, imm, imm); \ return -EINVAL; \
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 346/666 bpf, riscv: Remove redundant bpf_flush_icache() after pack allocator finalize
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Puranjay Mohan <[email protected]>
[ Upstream commit 46ee1342b887c9387a933397d846ff6c9584322c ]
bpf_flush_icache() calls flush_icache_range() to clean the data cache and invalidate the instruction cache for the JITed code region. However, since commit 48a8f78c50bd ("bpf, riscv: use prog pack allocator in the BPF JIT"), this flush is redundant.
bpf_jit_binary_pack_finalize() copies the JITed instructions to the ROX region via bpf_arch_text_copy() -> patch_text_nosync(), and patch_text_nosync() already calls flush_icache_range() on the written range. The subsequent bpf_flush_icache() repeats the same cache maintenance on an overlapping range.
Remove the redundant bpf_flush_icache() call and its now-unused definition.
--- arch/riscv/net/bpf_jit.h | 6 ------ arch/riscv/net/bpf_jit_core.c | 7 ------- 2 files changed, 13 deletions(-)
arch/riscv/net/bpf_jit.h +0 -6
@@ -11,7 +11,6 @@#include <linux/bpf.h> #include <linux/filter.h> -#include <asm/cacheflush.h> static inline bool rvc_enabled (void ) {
@@ -109,11 +108,6 @@ static inline void bpf_fill_ill_insns(void *area, unsigned int size)memset (area,0 , size); } -static inline void bpf_flush_icache (void *start,void *end) -{ -flush_icache_range ((unsigned long )start, (unsigned long )end); -} -/* Emit a 4-byte riscv instruction. */ static inline void emit (const u32 insn,struct rv_jit_context *ctx) {
arch/riscv/net/bpf_jit_core.c +0 -7
@@ -184,13 +184,6 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) prog = orig_prog; goto out_offset; } -/* -* The instructions have now been copied to the ROX region from -* where they will execute. -* Write any modified data cache blocks out to memory and -* invalidate the corresponding blocks in the instruction cache. -*/ -bpf_flush_icache (jit_data->ro_header, ctx->ro_insns + ctx->ninsns);for (i =0 ; i < prog->len; i++) ctx->offset[i] =ninsns_rvoff (ctx->offset[i]);bpf_prog_fill_jited_linfo (prog, ctx->offset);
Signature · 1 line
2.53.0
Re: [PATCH 6.12 346/666] bpf, riscv: Remove redundant bpf_flush_icache() after pack allocator finalize
Hi Greg,
Quoted 48 lines · Greg Kroah-Hartman
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Puranjay Mohan <[email protected]>
[ Upstream commit
46ee1342b887c9387a933397d846ff6c9584322c]
bpf_flush_icache()callsflush_icache_range()to clean the data cache and invalidate the instruction cache for the JITed code region. However, since commit48a8f78c50bd("bpf, riscv: use prog pack allocator in the BPF JIT"), this flush is redundant.
bpf_jit_binary_pack_finalize()copies the JITed instructions to the ROX region viabpf_arch_text_copy()->patch_text_nosync(), andpatch_text_nosync()already callsflush_icache_range()on the written range. The subsequentbpf_flush_icache()repeats the same cache maintenance on an overlapping range.Remove the redundant
bpf_flush_icache()call and its now-unused definition.Fixes 48a8f78c50bd ("bpf, riscv: use prog pack allocator in the BPF JIT")Acked-by Song Liu <[email protected]>Signed-off-by Puranjay Mohan <[email protected]>Reviewed-by Pu Lehui <[email protected]>Tested-by Paul Chaignon <[email protected]>Signed-off-by Alexei Starovoitov <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- arch/riscv/net/bpf_jit.h | 6 ------ arch/riscv/net/bpf_jit_core.c | 7 ------- 2 files changed, 13 deletions(-)arch/riscv/net/bpf_jit.h +0
-1@@ -11,7 +11,6 @@#include <linux/bpf.h> #include <linux/filter.h> -#include <asm/cacheflush.h> static inline bool rvc_enabled (void ) {
arch/riscv/net/bpf_jit.h static inline void bpf_fill_ill_insns(void *area, unsigned int size) · line 116
Quoted 8 lines
arch/riscv/net/bpf_jit.h +0
-5@@ -109,11 +108,6 @@ static inline void bpf_fill_ill_insns(void *area, unsigned int size)memset (area,0 , size); } -static inline void bpf_flush_icache (void *start,void *end) -{ -flush_icache_range ((unsigned long )start, (unsigned long )end); -} -
I have run an AI assisted backport review and it spotted an issue: I have taken a look and the issues goes like:
on 6.12.
$ git grep bpf_flush_icache arch/riscv/ arch/riscv/net/bpf_jit_comp64.c: bpf_flush_icache(ro_image, ro_image_end);
Upstream doesn't have this problem because this call is removed in commit: 6798668ab195 ("riscv, bpf: Remove duplicated bpf_flush_icache()") but this is not present in 6.12.91 so I think it is incorrect to backport this, should we drop this ?
I didn't try compiling this on risv.
thanks,
Harshit
Quoted 21 lines
arch/riscv/net/bpf_jit.h +0
-0/* Emit a 4-byte riscv instruction. */ static inline void emit (const u32 insn,struct rv_jit_context *ctx) {arch/riscv/net/bpf_jit_core.c +0
-7@@ -184,13 +184,6 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) prog = orig_prog; goto out_offset; } -/* -* The instructions have now been copied to the ROX region from -* where they will execute. -* Write any modified data cache blocks out to memory and -* invalidate the corresponding blocks in the instruction cache. -*/ -bpf_flush_icache (jit_data->ro_header, ctx->ro_insns + ctx->ninsns);for (i =0 ; i < prog->len; i++) ctx->offset[i] =ninsns_rvoff (ctx->offset[i]);bpf_prog_fill_jited_linfo (prog, ctx->offset);
Sasha Levin
maintainerRe: [PATCH 6.12 346/666] bpf, riscv: Remove redundant bpf_flush_icache() after pack allocator finalize
Quoted 4 lines · Harshit Mogalapalli
Upstream doesn't have this problem because this call is removed in
commit:6798668ab195("riscv, bpf: Remove duplicatedbpf_flush_icache()") but this is not present in 6.12.91 so I think it is incorrect to backport this, should we drop this ?
Dropped from the 6.12 and 6.6 queues — 6.6 has the same missing prerequisite. Thanks for the report.
--
Thanks,
Sasha
Greg Kroah-Hartman
maintainerPATCH 347/666 bpf, sockmap: Fix af_unix iter deadlock
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit 4d328dd695383224aa750ddee6b4ad40c0f8d205 ]
bpf_iter_unix_seq_show() may deadlock when lock_sock_fast() takes the fast path and the iter prog attempts to update a sockmap. Which ends up spinning at sock_map_update_elem()'s bh_lock_sock():
WARNING: possible recursive locking detected
test_progs/1393 is trying to acquire lock:ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: sock_map_update_elem+0xdb/0x1f0
but task is already holding lock:ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: __lock_sock_fast+0x37/0xe0
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
---- lock(slock-AF_UNIX);
lock(slock-AF_UNIX);
*** DEADLOCK ***
May be due to missing lock nesting notation
4 locks held by test_progs/1393:
#0: ffff88814b59c790 (&p->lock){+.+.}-{4:4}, at: bpf_seq_read+0x59/0x10d0 #1: ffff88811ec25fd8 (sk_lock-AF_UNIX){+.+.}-{0:0}, at: bpf_seq_read+0x42c/0x10d0 #2: ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: __lock_sock_fast+0x37/0xe0 #3: ffffffff85a6a7c0 (rcu_read_lock){....}-{1:3}, at: bpf_iter_run_prog+0x51d/0xb00
Call Trace: dump_stack_lvl+0x5d/0x80 print_deadlock_bug.cold+0xc0/0xce __lock_acquire+0x130f/0x2590 lock_acquire+0x14e/0x2b0 _raw_spin_lock+0x30/0x40 sock_map_update_elem+0xdb/0x1f0 bpf_prog_2d0075e5d9b721cd_dump_unix+0x55/0x4f4 bpf_iter_run_prog+0x5b9/0xb00 bpf_iter_unix_seq_show+0x1f7/0x2e0 bpf_seq_read+0x42c/0x10d0 vfs_read+0x171/0xb20 ksys_read+0xff/0x200 do_syscall_64+0x6b/0x3a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
--- net/unix/af_unix.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
net/unix/af_unix.c +3 -4
@@ -3621,15 +3621,14 @@ static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v)struct bpf_prog *prog;struct sock *sk = v;uid_t uid; -bool slow;int ret;if (v ==SEQ_START_TOKEN )return 0 ; - slow =lock_sock_fast (sk); +lock_sock (sk); -if (unlikely (sk_unhashed (sk))) { +if (unlikely (sock_flag (sk,SOCK_DEAD ))) { ret =SEQ_SKIP ; goto unlock; }
@@ -3639,7 +3638,7 @@ static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v) prog =bpf_iter_get_info (&meta, false); ret =unix_prog_seq_show (prog, &meta, v, uid); unlock: -unlock_sock_fast (sk, slow); +release_sock (sk);return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 348/666 bpf, sockmap: Fix af_unix null-ptr-deref in proto update
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit dca38b7734d2ea00af4818ff3ae836fab33d5d5a ]
unix_stream_connect() sets sk_state (WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED)) _before_ it assigns a peer (unix_peer(sk) = newsk). sk_state == TCP_ESTABLISHED makes sock_map_sk_state_allowed() believe that socket is properly set up, which would include having a defined peer. IOW, there's a window when unix_stream_bpf_update_proto() can be called on socket which still has unix_peer(sk) == NULL.
CPU0 bpf CPU1 connect
-------- ------------
WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED)sock_map_sk_state_allowed(sk)
...sk_pair = unix_peer(sk)sock_hold(sk_pair)
sock_hold(newsk) smp_mb__after_atomic() unix_peer(sk) = newsk
BUG: kernel NULL pointer dereference, address: 0000000000000080 RIP: 0010:unix_stream_bpf_update_proto+0xa0/0x1b0 Call Trace: sock_map_link+0x564/0x8b0 sock_map_update_common+0x6e/0x340 sock_map_update_elem_sys+0x17d/0x240 __sys_bpf+0x26db/0x3250 __x64_sys_bpf+0x21/0x30 do_syscall_64+0x6b/0x3a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
Initial idea was to move peer assignment _before_ the sk_state update[1], but that involved an additional memory barrier, and changing the hot path was rejected.
Then a NULL check during proto update in unix_stream_bpf_update_proto() was considered[2], but the follow-up discussion[3] focused on the root cause, i.e. sockmap update taking a wrong lock. Or, more specifically, missing unix_state_lock()[4].
In the end it was concluded that teaching sockmap about the af_unix locking would be unnecessarily complex[5].
Complexity aside, since BPF_PROG_TYPE_SCHED_CLS and BPF_PROG_TYPE_SCHED_ACT are allowed to update sockmaps, sock_map_update_elem() taking the unix lock, as it is currently implemented in unix_state_lock():
spin_lock(&unix_sk(s)->lock), would be problematic. unix_state_lock() taken in a process context, followed by a softirq-context TC BPF program attempting to take the same spinlock -- deadlock[6].
This way we circled back to the peer check idea[2].
[1]: https://lore.kernel.org/netdev/[email protected]/
[2]: https://lore.kernel.org/netdev/[email protected]/
[3]: https://lore.kernel.org/netdev/[email protected]/
[4]: https://lore.kernel.org/netdev/CAAVpQUA+8GL_j63CaKb8hbxoL21izD58yr1NvhOhU=j+35+3og@mail.gmail.com/
[5]: https://lore.kernel.org/bpf/CAAVpQUAHijOMext28Gi10dSLuMzGYh+jK61Ujn+fZ-wvcODR2A@mail.gmail.com/
[6]: https://lore.kernel.org/bpf/[email protected]/
Summary of scenarios where af_unix/stream connect() may race a sockmap update:
1. connect() vs. bpf(BPF_MAP_UPDATE_ELEM), i.e. sock_map_update_elem_sys()
Implemented NULL check is sufficient. Once assigned, socket peer won't be released until socket fd is released. And that's not an issue because sock_map_update_elem_sys() bumps fd refcnf.
2. connect() vs BPF program doing update
Update restricted per verifier.c:may_update_sockmap() to
BPF_PROG_TYPE_TRACING/BPF_TRACE_ITER BPF_PROG_TYPE_SOCK_OPS (bpf_sock_map_update() only) BPF_PROG_TYPE_SOCKET_FILTER BPF_PROG_TYPE_SCHED_CLS BPF_PROG_TYPE_SCHED_ACT
BPF_PROG_TYPE_XDP BPF_PROG_TYPE_SK_REUSEPORT BPF_PROG_TYPE_FLOW_DISSECTOR BPF_PROG_TYPE_SK_LOOKUP
Plus one more race to consider:
CPU0 bpf CPU1 connect
-------- ------------
WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED)
sock_map_sk_state_allowed(sk)
sock_hold(newsk)
smp_mb__after_atomic()
unix_peer(sk) = newsk
sk_pair = unix_peer(sk)
if (unlikely(!sk_pair))
return -EINVAL;
CPU1 close
----------
skpair = unix_peer(sk);
unix_peer(sk) = NULL;
sock_put(skpair) // use after free?
sock_hold(sk_pair)
2.1 BPF program invoking helper function bpf_sock_map_update() ->
BPF_CALL_4(bpf_sock_map_update(), ...)
Helper limited to BPF_PROG_TYPE_SOCK_OPS. Nevertheless, a unix sock might be accessible via bpf_map_lookup_elem(). Which implies sk already having psock, which in turn implies sk already having sk_pair. Since sk_psock_destroy() is queued as RCU work, sk_pair won't go away while BPF executes the update.
2.2 BPF program invoking helper function bpf_map_update_elem() ->
sock_map_update_elem()
2.2.1 Unix sock accessible to BPF prog only via sockmap lookup in
BPF_PROG_TYPE_SOCKET_FILTER, BPF_PROG_TYPE_SCHED_CLS,
BPF_PROG_TYPE_SCHED_ACT, BPF_PROG_TYPE_XDP,
BPF_PROG_TYPE_SK_REUSEPORT, BPF_PROG_TYPE_FLOW_DISSECTOR,
BPF_PROG_TYPE_SK_LOOKUP.
Pretty much the same as case 2.1.
2.2.2 Unix sock accessible to BPF program directly:
BPF_PROG_TYPE_TRACING, narrowed down to BPF_TRACE_ITER.
Sockmap iterator (sock_map_seq_ops) is safe: unix sock
residing in a sockmap means that the sock already went through
the proto update step.
Unix sock iterator (bpf_iter_unix_seq_ops), on the other hand,
gives access to socks that may still be unconnected. Which
means iterator prog can race sockmap/proto update against
connect().
BUG: KASAN: null-ptr-deref in unix_stream_bpf_update_proto+0x253/0x4d0
Write of size 4 at addr 0000000000000080 by task test_progs/3140
Call Trace:
dump_stack_lvl+0x5d/0x80
kasan_report+0xe4/0x1c0
kasan_check_range+0x125/0x200
unix_stream_bpf_update_proto+0x253/0x4d0
sock_map_link+0x71c/0xec0
sock_map_update_common+0xbc/0x600
sock_map_update_elem+0x19a/0x1f0
bpf_prog_bbbf56096cdd4f01_selective_dump_unix+0x20c/0x217
bpf_iter_run_prog+0x21e/0xae0
bpf_iter_unix_seq_show+0x1e0/0x2a0
bpf_seq_read+0x42c/0x10d0
vfs_read+0x171/0xb20
ksys_read+0xff/0x200
do_syscall_64+0xf7/0x5e0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
While the introduced NULL check prevents null-ptr-deref in the
BPF program path as well, it is insufficient to guard against
a poorly timed close() leading to a use-after-free. This will
be addressed in a subsequent patch.--- net/unix/unix_bpf.c | 3 +++ 1 file changed, 3 insertions(+)
net/unix/unix_bpf.c +3 -0
@@ -184,6 +184,9 @@ int unix_stream_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool r*/ if (!psock->sk_pair) { sk_pair =unix_peer (sk); +if (unlikely (!sk_pair)) +return -EINVAL ; +sock_hold (sk_pair); psock->sk_pair = sk_pair; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 349/666 bpf, sockmap: Take state lock for af_unix iter
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit 64c2f93fc3254d3bf5de4445fb732ee5c451edb6 ]
When a BPF iterator program updates a sockmap, there is a race condition in unix_stream_bpf_update_proto() where the peer pointer can become stale[1] during a state transition TCP_ESTABLISHED -> TCP_CLOSE.
CPU0 bpf CPU1 close
-------- ----------
// unix_stream_bpf_update_proto()sk_pair = unix_peer(sk)
if (unlikely(!sk_pair))
return -EINVAL;
// unix_release_sock()
skpair = unix_peer(sk);
unix_peer(sk) = NULL;
sock_put(skpair)sock_hold(sk_pair) // UaF
More practically, this fix guarantees that the iterator program is consistently provided with a unix socket that remains stable during iterator execution.
[1]:
BUG: KASAN: slab-use-after-free in unix_stream_bpf_update_proto+0x155/0x490 Write of size 4 at addr ffff8881178c9a00 by task test_progs/2231 Call Trace: dump_stack_lvl+0x5d/0x80 print_report+0x170/0x4f3 kasan_report+0xe4/0x1c0 kasan_check_range+0x125/0x200 unix_stream_bpf_update_proto+0x155/0x490 sock_map_link+0x71c/0xec0 sock_map_update_common+0xbc/0x600 sock_map_update_elem+0x19a/0x1f0 bpf_prog_bbbf56096cdd4f01_selective_dump_unix+0x20c/0x217 bpf_iter_run_prog+0x21e/0xae0 bpf_iter_unix_seq_show+0x1e0/0x2a0 bpf_seq_read+0x42c/0x10d0 vfs_read+0x171/0xb20 ksys_read+0xff/0x200 do_syscall_64+0xf7/0x5e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Allocated by task 2236: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x63/0x80 kmem_cache_alloc_noprof+0x1d5/0x680 sk_prot_alloc+0x59/0x210 sk_alloc+0x34/0x470 unix_create1+0x86/0x8a0 unix_stream_connect+0x318/0x15b0 __sys_connect+0xfd/0x130 __x64_sys_connect+0x72/0xd0 do_syscall_64+0xf7/0x5e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 2236: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x70 __kasan_slab_free+0x47/0x70 kmem_cache_free+0x11c/0x590 __sk_destruct+0x432/0x6e0 unix_release_sock+0x9b3/0xf60 unix_release+0x8a/0xf0 __sock_release+0xb0/0x270 sock_close+0x18/0x20 __fput+0x36e/0xac0 fput_close_sync+0xe5/0x1a0 __x64_sys_close+0x7d/0xd0 do_syscall_64+0xf7/0x5e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
--- net/unix/af_unix.c | 2 ++ 1 file changed, 2 insertions(+)
net/unix/af_unix.c +2 -0
@@ -3627,6 +3627,7 @@ static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v)return 0 ;lock_sock (sk); +unix_state_lock (sk);if (unlikely (sock_flag (sk,SOCK_DEAD ))) { ret =SEQ_SKIP ;
@@ -3638,6 +3639,7 @@ static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v) prog =bpf_iter_get_info (&meta, false); ret =unix_prog_seq_show (prog, &meta, v, uid); unlock: +unix_state_unlock (sk);release_sock (sk);return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 350/666 bpf: Fix precedence bug in convert_bpf_ld_abs alignment check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit e5f635edd393aeaa7cad9e42831d397e6e2e1eed ]
Fix an operator precedence issue in convert_bpf_ld_abs() where the expression offset + ip_align % size evaluates as offset + (ip_align % size) due to % having higher precedence than +. That latter evaluation does not make any sense. The intended check is (offset + ip_align) % size == 0 to verify that the packet load offset is properly aligned for direct access.
With NET_IP_ALIGN == 2, the bug causes the inline fast-path for direct packet loads to almost never be taken on !CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS platforms. This forces nearly all cBPF BPF_LD_ABS packet loads through the bpf_skb_load_helper slow path on the affected archs.
--- net/core/filter.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/filter.c +1 -1
@@ -499,7 +499,7 @@ static bool convert_bpf_ld_abs(struct sock_filter *fp, struct bpf_insn **insnp) ((unaligned_ok && offset >= 0) || (!unaligned_ok && offset >= 0 && offset + ip_align >= 0 && - offset + ip_align % size == 0))) { + (offset + ip_align) % size == 0))) {bool ldx_off_ok = offset <=S16_MAX ; *insn++ =BPF_MOV64_REG (BPF_REG_TMP ,BPF_REG_H );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 351/666 bpf: Fix NULL deref in map_kptr_match_type for scalar regs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mykyta Yatsenko <[email protected]>
[ Upstream commit 4d0a375887ab4d49e4da1ff10f9606cab8f7c3ad ]
Commit ab6c637ad027 ("bpf: Fix a bpf_kptr_xchg() issue with local kptr") refactored map_kptr_match_type() to branch on btf_is_kernel() before checking base_type(). A scalar register stored into a kptr slot has no btf, so the btf_is_kernel(reg->btf) call dereferences NULL.
Move the base_type() != PTR_TO_BTF_ID guard before any reg->btf access.
--- kernel/bpf/verifier.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/bpf/verifier.c +4 -1
@@ -5473,6 +5473,9 @@ static int map_kptr_match_type(struct bpf_verifier_env *env,int perm_flags;const char *reg_name ="" ; +if (base_type (reg->type) !=PTR_TO_BTF_ID ) + goto bad_type; +if (btf_is_kernel (reg->btf)) { perm_flags =PTR_MAYBE_NULL |PTR_TRUSTED |MEM_RCU ;
@@ -5485,7 +5488,7 @@ static int map_kptr_match_type(struct bpf_verifier_env *env, perm_flags |=MEM_PERCPU ; } -if (base_type (reg->type) !=PTR_TO_BTF_ID || (type_flag (reg->type) & ~perm_flags)) +if (type_flag (reg->type) & ~perm_flags) goto bad_type;/* We need to verify reg->type and reg->btf, before accessing reg->btf */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 352/666 bpf: allow UTF-8 literals in bpf_bprintf_prepare()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihan Ding <[email protected]>
[ Upstream commit b960430ea8862ef37ce53c8bf74a8dc79d3f2404 ]
bpf_bprintf_prepare() only needs ASCII parsing for conversion specifiers. Plain text can safely carry bytes >= 0x80, so allow UTF-8 literals outside '%' sequences while keeping ASCII control bytes rejected and format specifiers ASCII-only.
This keeps existing parsing rules for format directives unchanged, while allowing helpers such as bpf_trace_printk() to emit UTF-8 literal text.
Update test_snprintf_negative() in the same commit so selftests keep matching the new plain-text vs format-specifier split during bisection.
--- kernel/bpf/helpers.c | 17 ++++++++++++++++- .../testing/selftests/bpf/prog_tests/snprintf.c | 3 ++- 2 files changed, 18 insertions(+), 2 deletions(-)
kernel/bpf/helpers.c +16 -1
@@ -847,7 +847,13 @@ int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args, data->buf = buffers->buf;for (i =0 ; i < fmt_size; i++) { -if ((!isprint (fmt[i]) && !isspace (fmt[i])) || !isascii (fmt[i])) { +unsigned char c = fmt[i]; + +/* +* Permit bytes >= 0x80 in plain text so UTF-8 literals can pass +* through unchanged, while still rejecting ASCII control bytes. +*/ +if (isascii (c) && !isprint (c) && !isspace (c)) { err = -EINVAL ; goto out; }
@@ -869,6 +875,15 @@ int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args,* always access fmt[i + 1], in the worst case it will be a 0 */ i++; + c = fmt[i]; +/* +* The format parser below only understands ASCII conversion +* specifiers and modifiers, so reject non-ASCII after '%'. +*/ +if (!isascii (c)) { + err = -EINVAL ; + goto out; + }/* skip optional "[0 +-][num]" width formatting field */ while (fmt[i] == '0' || fmt[i] == '+' || fmt[i] == '-' ||
tools/testing/selftests/bpf/prog_tests/snprintf.c +2 -1
@@ -114,7 +114,8 @@ static void test_snprintf_negative(void)ASSERT_ERR (load_single_snprintf ("%--------" ),"invalid specifier 5" );ASSERT_ERR (load_single_snprintf ("%lc" ),"invalid specifier 6" );ASSERT_ERR (load_single_snprintf ("%llc" ),"invalid specifier 7" ); -ASSERT_ERR (load_single_snprintf ("\x80" ),"non ascii character" ); +ASSERT_OK (load_single_snprintf ("\x80" ),"non ascii plain text" ); +ASSERT_ERR (load_single_snprintf ("%\x80" ),"non ascii in specifier" );ASSERT_ERR (load_single_snprintf ("\x1" ),"non printable character" ); }
Signature · 1 line
2.53.0