5.11.20-rc1 review
Subsystems (7)
Greg Kroah-Hartman
maintainercover 5.11.20-rc1 review
This is the start of the stable review cycle for the 5.11.20 release. There are 342 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 May 2021 10:19:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.11.20-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.11.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.11.20-rc1
Lukasz Luba <[email protected]>
thermal/core/fair share: Lock the thermal zone while looping over instances
brian-sy yang <[email protected]>
thermal/drivers/cpufreq_cooling: Fix slab OOB issue
Rasmus Villemoes <[email protected]>
lib/vsprintf.c: remove leftover 'f' and 'F' cases from bstr_printf()
周琰杰 (Zhou Yanjie) <[email protected]>
pinctrl: Ingenic: Add support for read the pin configuration of X1830.
Benjamin Block <[email protected]>
dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails
Tian Tao <[email protected]>
dm integrity: fix missing goto in bitmap_flush_interval error handling
Joe Thornber <[email protected]>
dm space map common: fix division bug in sm_ll_find_free_block()
Joe Thornber <[email protected]>
dm persistent data: packed struct should have an aligned() attribute too
Steven Rostedt (VMware) <[email protected]>
tracing: Restructure trace_clock_global() to never block
Steven Rostedt (VMware) <[email protected]>
tracing: Map all PIDs to command lines
Calvin Walton <[email protected]>
tools/power turbostat: Fix offset overflow issue in index converting
Marek Vasut <[email protected]>
rsi: Use resume_noirq for SDIO
Pavel Skripkin <[email protected]>
tty: fix memory leak in vc_deallocate
Hou Zhiqiang <[email protected]>
PCI: dwc: Move iATU detection earlier
Artur Petrosyan <[email protected]>
usb: dwc2: Fix session request interrupt handler
Yu Chen <[email protected]>
usb: dwc3: core: Do core softreset when switch mode
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Fix START_TRANSFER link state check
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Remove FS bInterval_m1 limitation
Dean Anderson <[email protected]>
usb: gadget/function/f_fs string table fix for multiple languages
Hemant Kumar <[email protected]>
usb: gadget: Fix double free of device descriptor pointers
Anirudh Rayabharam <[email protected]>
usb: gadget: dummy_hcd: fix gpf in gadget_setup
Stanimir Varbanov <[email protected]>
media: venus: hfi_parser: Don't initialize parser on v1
Marco Felsch <[email protected]>
media: coda: fix macroblocks count control usage
Hans Verkuil <[email protected]>
media: v4l2-ctrls: fix reference to freed memory
Ricardo Ribalda <[email protected]>
media: staging/intel-ipu3: Fix race condition during set_fmt
Ricardo Ribalda <[email protected]>
media: staging/intel-ipu3: Fix set_fmt error handling
Ricardo Ribalda <[email protected]>
media: staging/intel-ipu3: Fix memory leak in imu_fmt
Takashi Iwai <[email protected]>
media: dvb-usb: Fix memory leak at error in dvb_usb_device_init()
Takashi Iwai <[email protected]>
media: dvb-usb: Fix use-after-free access
Peilin Ye <[email protected]>
media: dvbdev: Fix memory leak in dvb_media_device_free()
Jan Kara <[email protected]>
ext4: Fix occasional generic/418 failure
Theodore Ts'o <[email protected]>
ext4: allow the dax flag to be set and cleared on inline directories
Xu Yihang <[email protected]>
ext4: fix error return code in ext4_fc_perform_commit()
Ye Bin <[email protected]>
ext4: fix ext4_error_err save negative errno into superblock
Fengnan Chang <[email protected]>
ext4: fix error code in ext4_commit_super
Ye Bin <[email protected]>
ext4: always panic when errors=panic is specified
Zhang Yi <[email protected]>
ext4: do not set SB_ACTIVE in ext4_orphan_cleanup()
Zhang Yi <[email protected]>
ext4: fix check to prevent false positive report of incorrect used inodes
Jan Kara <[email protected]>
ext4: annotate data race in jbd2_journal_dirty_metadata()
Jan Kara <[email protected]>
ext4: annotate data race in start_this_handle()
Masahiro Yamada <[email protected]>
kbuild: update config_data.gz only when the content of .config is changed
Sean Christopherson <[email protected]>
x86/cpu: Initialize MSR_TSC_AUX if RDTSCP *or* RDPID is supported
Thomas Gleixner <[email protected]>
futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
Thomas Gleixner <[email protected]>
Revert 337f13046ff0 ("futex: Allow FUTEX_CLOCK_REALTIME with FUTEX_WAIT op")
Steve French <[email protected]>
smb3: do not attempt multichannel to server which does not support it
Steve French <[email protected]>
smb3: if max_channels set to more than one channel request multichannel
Steve French <[email protected]>
smb3: when mounting with multichannel include it in requested capabilities
Yang Yang <[email protected]>
jffs2: check the validity of dstlen in jffs2_zlib_compress()
Linus Torvalds <[email protected]>
Fix misc new gcc warnings
Arnd Bergmann <[email protected]>
security: commoncap: fix -Wstringop-overread warning
Frederic Weisbecker <[email protected]>
rcu/nocb: Fix missed nocb_timer requeue
Edward Cree <[email protected]>
sfc: farch: fix TX queue lookup in TX event handling
Edward Cree <[email protected]>
sfc: farch: fix TX queue lookup in TX flush done handling
Hyeongseok Kim <[email protected]>
exfat: fix erroneous discard when clear cluster bit
Sergei Trofimovich <[email protected]>
mm: page_alloc: ignore init_on_free=1 for debug_pagealloc=1
Vivek Goyal <[email protected]>
fuse: fix write deadlock
Heinz Mauelshagen <[email protected]>
dm raid: fix inconclusive reshape layout on fast raid4/5/6 table reload sequences
Paul Clements <[email protected]>
md/raid1: properly indicate failure when ending a failed write request
Eric Biggers <[email protected]>
crypto: rng - fix crypto_rng_reset() refcounting when !CRYPTO_STATS
Nathan Chancellor <[email protected]>
crypto: arm/curve25519 - Move '.fpu' after '.arch'
Stefan Berger <[email protected]>
tpm: vtpm_proxy: Avoid reading host log when using a virtual device
Stefan Berger <[email protected]>
tpm: efi: Use local variable for calculating final log size
Alexander Shishkin <[email protected]>
intel_th: pci: Add Alder Lake-M support
Michael Ellerman <[email protected]>
powerpc/kvm: Fix build error when PPC_MEM_KEYS/PPC_PSERIES=n
Michael Ellerman <[email protected]>
powerpc/kvm: Fix PR KVM with KUAP/MEM_KEYS enabled
Tony Ambardar <[email protected]>
powerpc: fix EDEADLOCK redefinition error in uapi/asm/errno.h
Christophe Leroy <[email protected]>
powerpc/32: Fix boot failure with CONFIG_STACKPROTECTOR
Sourabh Jain <[email protected]>
powerpc/kexec_file: Use current CPU info while setting up FDT
Mahesh Salgaonkar <[email protected]>
powerpc/eeh: Fix EEH handling for hugepages in ioremap space.
Nicholas Piggin <[email protected]>
powerpc/powernv: Enable HAIL (HV AIL) for ISA v3.1 processors
Dmitry Safonov <[email protected]>
powerpc/vdso: Separate vvar vma from vdso
Longpeng(Mike) <[email protected]>
iommu/vt-d: Force to flush iotlb before creating superpage
Joel Stanley <[email protected]>
jffs2: Hook up splice_write callback
lizhe <[email protected]>
jffs2: Fix kasan slab-out-of-bounds problem
Hansem Ro <[email protected]>
Input: ili210x - add missing negation for touch indication on ili210x
Trond Myklebust <[email protected]>
NFSv4: Don't discard segments marked for return in _pnfs_return_layout()
Trond Myklebust <[email protected]>
NFS: Don't discard pNFS layout segments that are marked for return
Randy Dunlap <[email protected]>
NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
Marc Zyngier <[email protected]>
ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure
Davide Caratti <[email protected]>
net/sched: sch_frag: fix stack OOB read while fragmenting IPv4 packets
Davide Caratti <[email protected]>
openvswitch: fix stack OOB read while fragmenting IPv4 packets
Ido Schimmel <[email protected]>
mlxsw: spectrum_mr: Update egress RIF list before route's action
Chao Yu <[email protected]>
f2fs: fix to avoid out-of-bounds memory access
Eric Biggers <[email protected]>
f2fs: fix error handling in f2fs_end_enable_verity()
Guochun Mao <[email protected]>
ubifs: Only check replay with inode type to judge if inode linked
Marco Elver <[email protected]>
kcsan, debugfs: Move debugfs file creation out of early init
Luis Henriques <[email protected]>
virtiofs: fix memory leak in virtio_fs_probe()
Theodore Ts'o <[email protected]>
fs: fix reporting supported extra file attributes for statx()
Nathan Chancellor <[email protected]>
Makefile: Move -Wno-unused-but-set-variable out of GCC only block
Bill Wendling <[email protected]>
arm64/vdso: Discard .note.gnu.property sections in vDSO
Filipe Manana <[email protected]>
btrfs: fix race when picking most recent mod log operation for an old root
Bas Nieuwenhuizen <[email protected]>
tools/power/turbostat: Fix turbostat for AMD Zen CPUs
Eckhart Mohr <[email protected]>
ALSA: hda/realtek: Add quirk for Intel Clevo PCx0Dx
Sami Loone <[email protected]>
ALSA: hda/realtek: fix static noise on ALC285 Lenovo laptops
Kailang Yang <[email protected]>
ALSA: hda/realtek - Headset Mic issue on HP platform
Phil Calvin <[email protected]>
ALSA: hda/realtek: fix mic boost on Intel NUC 8
Luke D Jones <[email protected]>
ALSA: hda/realtek: GA503 use same quirks as GA401
Jonas Witschel <[email protected]>
ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G7
Timo Gurr <[email protected]>
ALSA: usb-audio: Add dB range mapping for Sennheiser Communications Headset PC 8
Takashi Iwai <[email protected]>
ALSA: usb-audio: Explicitly set up the clock selector
Lv Yunlong <[email protected]>
ALSA: sb: Fix two use after free in snd_sb_qsound_build
Takashi Iwai <[email protected]>
ALSA: hda/conexant: Re-order CX5066 quirk table entries
Lv Yunlong <[email protected]>
ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer
Guangqing Zhu <[email protected]>
power: supply: cpcap-battery: fix invalid usage of list cursor
Charan Teja Reddy <[email protected]>
sched,psi: Handle potential task count underflow bugs more gracefully
Harald Freudenberger <[email protected]>
s390/archrandom: add parameter check for s390_arch_random_generate
Gioh Kim <[email protected]>
block/rnbd-clt: Fix missing a memory free when unloading the module
Gioh Kim <[email protected]>
block/rnbd-srv: Prevent a deadlock generated by accessing sysfs in parallel
Peter Zijlstra <[email protected]>
sched,fair: Alternative sched_slice()
Peter Zijlstra <[email protected]>
perf: Rework perf_event_exit_event()
Bart Van Assche <[email protected]>
scsi: libfc: Fix a format specifier
Dinghao Liu <[email protected]>
mfd: arizona: Fix rumtime PM imbalance on error
Hubert Streidl <[email protected]>
mfd: da9063: Support SMBus and I2C mode
Xu Yilun <[email protected]>
mfd: intel-m10-bmc: Fix the register access range
James Smart <[email protected]>
scsi: lpfc: Remove unsupported mbox PORT_CAPABILITIES logic
James Smart <[email protected]>
scsi: lpfc: Fix error handling for mailboxes completed in MBX_POLL mode
James Smart <[email protected]>
scsi: lpfc: Fix reference counting errors in lpfc_cmpl_els_rsp()
James Smart <[email protected]>
scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO response
Guchun Chen <[email protected]>
drm/amdgpu: fix NULL pointer dereference
Werner Sembach <[email protected]>
drm/amd/display: Try YCbCr420 color when YCbCr444 fails
Alex Deucher <[email protected]>
drm/amdgpu/display: fix memory leak for dimgrey cavefish
Arnd Bergmann <[email protected]>
amdgpu: avoid incorrect %hu format string
Qu Huang <[email protected]>
drm/amdkfd: Fix cat debugfs hang_hws file causes system crash bug
Tong Zhang <[email protected]>
drm/radeon: don't evict if not initialized
Anson Jacob <[email protected]>
drm/amd/display: Fix UBSAN: shift-out-of-bounds warning
Fangzhi Zuo <[email protected]>
drm/amd/display: Fix debugfs link_settings entry
Daniel Gomez <[email protected]>
drm/radeon/ttm: Fix memory leak userptr pages
Daniel Gomez <[email protected]>
drm/amdgpu/ttm: Fix memory leak userptr pages
Marijn Suijten <[email protected]>
drm/msm/mdp5: Do not multiply vclk line count by 100
Marijn Suijten <[email protected]>
drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal
Lingutla Chandrasekhar <[email protected]>
sched/fair: Ignore percpu threads for imbalance pulls
Hans Verkuil <[email protected]>
media: gscpa/stv06xx: fix memory leak
Pavel Skripkin <[email protected]>
media: dvb-usb: fix memory leak in dvb_usb_adapter_init
Dinghao Liu <[email protected]>
media: sun8i-di: Fix runtime PM imbalance in deinterlace_start_streaming
Dinghao Liu <[email protected]>
media: platform: sti: Fix runtime PM imbalance in regs_show
Yang Yingliang <[email protected]>
media: i2c: adv7842: fix possible use-after-free in adv7842_remove()
Yang Yingliang <[email protected]>
media: i2c: tda1997: Fix possible use-after-free in tda1997x_remove()
Yang Yingliang <[email protected]>
media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove()
Yang Yingliang <[email protected]>
media: adv7604: fix possible use-after-free in adv76xx_remove()
Yang Yingliang <[email protected]>
media: tc358743: fix possible use-after-free in tc358743_remove()
Yang Yingliang <[email protected]>
power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove()
Yang Yingliang <[email protected]>
power: supply: generic-adc-battery: fix possible use-after-free in gab_remove()
Colin Ian King <[email protected]>
clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return
Abhinav Kumar <[email protected]>
drm/msm/dp: Fix incorrect NULL check kbot warnings in DP driver
Hans Verkuil <[email protected]>
media: vivid: update EDID
Muhammad Usama Anjum <[email protected]>
media: em28xx: fix memory leak
Ewan D. Milne <[email protected]>
scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg()
Kevin Barnett <[email protected]>
scsi: smartpqi: Add new PCI IDs
Murthy Bhat <[email protected]>
scsi: smartpqi: Correct request leakage during reset operations
Don Brace <[email protected]>
scsi: smartpqi: Use host-wide tag space
Carl Philipp Klemm <[email protected]>
power: supply: cpcap-charger: Add usleep to cpcap charger to avoid usb plug bounce
Fenghua Yu <[email protected]>
selftests/resctrl: Fix checking for < 0 for unsigned values
Fenghua Yu <[email protected]>
selftests/resctrl: Fix incorrect parsing of iMC counters
Fenghua Yu <[email protected]>
selftests/resctrl: Use resctrl/info for feature detection
Fenghua Yu <[email protected]>
selftests/resctrl: Fix missing options "-n" and "-p"
Fenghua Yu <[email protected]>
selftests/resctrl: Clean up resctrl features check
Fenghua Yu <[email protected]>
selftests/resctrl: Fix compilation issues for other global variables
Fenghua Yu <[email protected]>
selftests/resctrl: Fix compilation issues for global variables
Fenghua Yu <[email protected]>
selftests/resctrl: Enable gcc checks to detect buffer overflows
Hou Pu <[email protected]>
nvmet: return proper error code from discovery ctrl
Carsten Haitzler <[email protected]>
drm/komeda: Fix bit check to import to value of proper type
Xingui Yang <[email protected]>
ata: ahci: Disable SXS for Hisilicon Kunpeng920
Al Cooper <[email protected]>
mmc: sdhci-brcmstb: Remove CQE quirk
Adrian Hunter <[email protected]>
mmc: sdhci-pci: Add PCI IDs for Intel LKF
Peng Fan <[email protected]>
mmc: sdhci-esdhc-imx: validate pinctrl before use it
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix use after free in bsg
Dmitry Vyukov <[email protected]>
drm/vkms: fix misuse of WARN_ON
Bart Van Assche <[email protected]>
scsi: qla2xxx: Always check the return value of qla24xx_get_isp_stats()
xinhui pan <[email protected]>
drm/amdgpu: Fix memory leak
Dmytro Laktyushkin <[email protected]>
drm/amd/display: fix dml prefetch validation
Aric Cyr <[email protected]>
drm/amd/display: DCHUB underflow counter increasing in some scenarios
Anson Jacob <[email protected]>
drm/amd/display: Fix UBSAN warning for not a valid value for type '_Bool'
Kenneth Feng <[email protected]>
drm/amd/pm: fix workload mismatch on vega10
shaoyunl <[email protected]>
drm/amdgpu : Fix asic reset regression issue introduce by 8f211fe8ac7c4f
Anson Jacob <[email protected]>
drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
Jonathan Kim <[email protected]>
drm/amdgpu: mask the xgmi number of hops reported from psp to kfd
Kiran Gunda <[email protected]>
backlight: qcom-wled: Fix FSC update issue for WLED5
Obeida Shamoun <[email protected]>
backlight: qcom-wled: Use sink_addr for sync toggle
dongjian <[email protected]>
power: supply: Use IRQF_ONESHOT
Hans Verkuil <[email protected]>
media: v4l2-ctrls.c: initialize flags field of p_fwht_params
Hans Verkuil <[email protected]>
media: gspca/sq905.c: fix uninitialized variable
Daniel Niv <[email protected]>
media: media/saa7164: fix saa7164_encoder_register() memory leak bugs
Hans de Goede <[email protected]>
extcon: arizona: Fix various races on driver unbind
Hans de Goede <[email protected]>
extcon: arizona: Fix some issues when HPDET IRQ fires after the jack has been unplugged
Matthias Schiffer <[email protected]>
power: supply: bq27xxx: fix power_avg for newer ICs
Mauro Carvalho Chehab <[email protected]>
atomisp: don't let it go past pipes array
Laurent Pinchart <[email protected]>
media: imx: capture: Return -EPIPE from __capture_legacy_try_fmt()
Brad Love <[email protected]>
media: cx23885: add more quirks for reset DMA on some AMD IOMMU
Pavel Skripkin <[email protected]>
media: drivers/media/usb: fix memory leak in zr364xx_probe
Julian Braha <[email protected]>
media: drivers: media: pci: sta2x11: fix Kconfig dependency on GPIOLIB
Sean Young <[email protected]>
media: ite-cir: check for receive overflow
Chaitanya Kulkarni <[email protected]>
scsi: target: pscsi: Fix warning in pscsi_complete_cmd()
xndcn <[email protected]>
drm/virtio: fix possible leak/unlock virtio_gpu_object_array
Uladzislau Rezki (Sony) <[email protected]>
kvfree_rcu: Use same set of GFP flags as does single-argument
Barry Song <[email protected]>
sched/topology: fix the issue groups don't span domain->span for NUMA diameter > 2
Vincent Donnefort <[email protected]>
sched/pelt: Fix task util_est update filtering
Emily Deng <[email protected]>
drm/amdgpu: Fix some unload driver issues
James Smart <[email protected]>
scsi: lpfc: Fix ADISC handling that never frees nodes
James Smart <[email protected]>
scsi: lpfc: Fix PLOGI ACC to be transmit after REG_LOGIN
James Smart <[email protected]>
scsi: lpfc: Fix status returned in lpfc_els_retry() error exit path
James Smart <[email protected]>
scsi: lpfc: Fix pt2pt connection does not recover after LOGO
James Smart <[email protected]>
scsi: lpfc: Fix incorrect dbde assignment when building target abts wqe
Lee Jones <[email protected]>
drm/amd/display/dc/dce/dce_aux: Remove duplicate line causing 'field overwritten' issue
Xiaogang Chen <[email protected]>
drm/amdgpu/display: buffer INTERRUPT_LOW_IRQ_CONTEXT interrupt work
Wyatt Wood <[email protected]>
drm/amd/display: Return invalid state if GPINT times out
Aric Cyr <[email protected]>
drm/amd/display: Don't optimize bandwidth before disabling planes
Eryk Brol <[email protected]>
drm/amd/display: Check for DSC support instead of ASIC revision
Tong Zhang <[email protected]>
drm/ast: fix memory leak when unload the driver
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Fix MPC OGAM power on/off sequence
Martin Leung <[email protected]>
drm/amd/display: changing sr exit latency
Thomas Zimmermann <[email protected]>
drm/ast: Fix invalid usage of AST_MAX_HWC_WIDTH in cursor atomic_check
Gerd Hoffmann <[email protected]>
drm/qxl: release shadow on shutdown
Tong Zhang <[email protected]>
drm/qxl: do not run release if qxl failed to init
Jared Baldridge <[email protected]>
drm: Added orientation quirk for OneGX1 Pro
Adam Ward <[email protected]>
regulator: da9121: automotive variants identity fix
Josef Bacik <[email protected]>
btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s
Josef Bacik <[email protected]>
btrfs: do proper error handling in btrfs_update_reloc_root
Josef Bacik <[email protected]>
btrfs: do proper error handling in create_reloc_root
David Bauer <[email protected]>
spi: sync up initial chipselect state
David E. Box <[email protected]>
platform/x86: intel_pmc_core: Don't use global pmcdev in quirks
Shixin Liu <[email protected]>
crypto: omap-aes - Fix PM reference leak on omap-aes.c
Shixin Liu <[email protected]>
crypto: sa2ul - Fix PM reference leak in sa_ul_probe()
Shixin Liu <[email protected]>
crypto: stm32/cryp - Fix PM reference leak on stm32-cryp.c
Shixin Liu <[email protected]>
crypto: stm32/hash - Fix PM reference leak on stm32-hash.c
Shixin Liu <[email protected]>
crypto: sun8i-ce - Fix PM reference leak in sun8i_ce_probe()
Shixin Liu <[email protected]>
crypto: sun8i-ss - Fix PM reference leak when pm_runtime_get_sync() fails
Yang Yingliang <[email protected]>
phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove()
Pavel Machek <[email protected]>
intel_th: Consistency and off-by-one fix
Hillf Danton <[email protected]>
tty: n_gsm: check error while registering tty devices
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Check for disabled LPM quirk
Bixuan Cui <[email protected]>
usb: core: hub: Fix PM reference leak in usb_port_resume()
Bixuan Cui <[email protected]>
usb: musb: fix PM reference leak in musb_irq_work()
Yang Yingliang <[email protected]>
usb: gadget: tegra-xudc: Fix possible use-after-free in tegra_xudc_remove()
Wang Li <[email protected]>
spi: qup: fix PM reference leak in spi_qup_remove()
Wei Yongjun <[email protected]>
spi: omap-100k: Fix reference leak to master
Wei Yongjun <[email protected]>
spi: dln2: Fix reference leak to master
Angela Czubak <[email protected]>
resource: Prevent irqresource_disabled() from erasing flags
Dinh Nguyen <[email protected]>
clocksource/drivers/dw_apb_timer_of: Add handling for potential memory leak
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Account for increased timeout in some cases
Srinivas Pandruvada <[email protected]>
tools/power/x86/intel-speed-select: Increase string size
Ludovic Desroches <[email protected]>
ARM: dts: at91: change the key code of the gpio key
Bhaumik Bhatt <[email protected]>
bus: mhi: core: Clear context for stopped channels from remove()
Mathias Nyman <[email protected]>
xhci: fix potential array out of bounds with several interrupters
Mathias Nyman <[email protected]>
xhci: check control context is valid before dereferencing it.
Mathias Nyman <[email protected]>
xhci: check port array allocation was successful before dereferencing it
Russ Weight <[email protected]>
fpga: dfl: pci: add DID for D5005 PAC cards
Chunfeng Yun <[email protected]>
usb: xhci-mtk: support quirk to disable usb2 lpm
Eric Biggers <[email protected]>
random: initialize ChaCha20 constants with correct endianness
Robin Murphy <[email protected]>
perf/arm_pmu_platform: Fix error handling
Robin Murphy <[email protected]>
perf/arm_pmu_platform: Use dev_err_probe() for IRQ errors
Pierre-Louis Bossart <[email protected]>
soundwire: cadence: only prepare attached devices on clock stop
Jerome Forissier <[email protected]>
tee: optee: do not check memref size on return from Secure World
Sebastian Krzyszkowiak <[email protected]>
arm64: dts: imx8mq-librem5-r3: Mark buck3 as always on
Dmitry Osipenko <[email protected]>
soc/tegra: pmc: Fix completion of power-gate toggling
Nathan Chancellor <[email protected]>
efi/libstub: Add $(CLANG_FLAGS) to x86 flags
Nathan Chancellor <[email protected]>
x86/boot: Add $(CLANG_FLAGS) to compressed KBUILD_CFLAGS
John Millikin <[email protected]>
x86/build: Propagate $(CLANG_FLAGS) to $(REALMODE_FLAGS)
Linus Walleij <[email protected]>
ARM: dts: ux500: Fix up TVK R3 sensors
Rafał Miłecki <[email protected]>
ARM: dts: BCM5301X: fix "reg" formatting in /memory node
Andre Przywara <[email protected]>
kselftest/arm64: mte: Fix MTE feature detection
Rafael J. Wysocki <[email protected]>
PCI: PM: Do not read power state in pci_enable_device_flags()
Dmitry Osipenko <[email protected]>
ARM: tegra: acer-a500: Rename avdd to vdda of touchscreen node
Andre Przywara <[email protected]>
kselftest/arm64: mte: Fix compilation with native compiler
Thinh Nguyen <[email protected]>
usb: xhci: Fix port minor revision
Wesley Cheng <[email protected]>
usb: dwc3: gadget: Ignore EP queue requests during bus reset
Ruslan Bilovol <[email protected]>
usb: gadget: f_uac1: validate input parameters
Ruslan Bilovol <[email protected]>
usb: gadget: f_uac2: validate input parameters
Vitaly Kuznetsov <[email protected]>
genirq/matrix: Prevent allocation counter corruption
Longfang Liu <[email protected]>
crypto: hisilicon/sec - fixes a printing error
Joerg Roedel <[email protected]>
x86/sev: Do not require Hypervisor CPUID bit for SEV guests
Pawel Laszczak <[email protected]>
usb: webcam: Invalid size of Processing Unit Descriptor
Pawel Laszczak <[email protected]>
usb: gadget: uvc: add bInterval checking for HS mode
Hui Tang <[email protected]>
crypto: qat - fix unmap invalid dma address
Ard Biesheuvel <[email protected]>
crypto: api - check for ERR pointers in crypto_destroy_tfm()
Bhaumik Bhatt <[email protected]>
bus: mhi: core: Process execution environment changes serially
Bhaumik Bhatt <[email protected]>
bus: mhi: core: Destroy SBL devices when moving to mission mode
David Bauer <[email protected]>
spi: ath79: remove spi-master setup and cleanup assignment
David Bauer <[email protected]>
spi: ath79: always call chipselect function
karthik alapati <[email protected]>
staging: wimax/i2400m: fix byte-order issue
Tony Lindgren <[email protected]>
bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first
Dmitry Osipenko <[email protected]>
cpuidle: tegra: Fix C7 idling state on Tegra114
Phillip Potter <[email protected]>
fbdev: zero-fill colormap in fbcmap.c
Chen Jun <[email protected]>
posix-timers: Preserve return value in clock_adjtime32()
Filipe Manana <[email protected]>
btrfs: fix race between transaction aborts and fsyncs leading to use-after-free
Alexander Shishkin <[email protected]>
intel_th: pci: Add Rocket Lake CPU support
Filipe Manana <[email protected]>
btrfs: fix metadata extent leak after failure to create subvolume
Maciej W. Rozycki <[email protected]>
x86/build: Disable HIGHMEM64G selection for M486SX
Qu Wenruo <[email protected]>
btrfs: handle remount to no compress during compression
Aurelien Aptel <[email protected]>
smb2: fix use-after-free in smb2_ioctl_query_info()
Paulo Alcantara <[email protected]>
cifs: fix regression when mounting shares with prefix paths
Shyam Prasad N <[email protected]>
cifs: detect dead connections only when echoes are enabled.
David Disseldorp <[email protected]>
cifs: fix leak in cifs_smb3_do_mount() ctx
Eugene Korenevsky <[email protected]>
cifs: fix out-of-bound memory access when calling smb3_notify() at mount point
Paul Aurich <[email protected]>
cifs: Return correct error code from smb2_get_enc_key
He Ying <[email protected]>
irqchip/gic-v3: Do not enable irqs when handling spurious interrups
Ulf Hansson <[email protected]>
mmc: core: Fix hanging on I/O during system suspend for removable cards
Seunghui Lee <[email protected]>
mmc: core: Set read only for SD cards with permanent write protect bit
DooHyun Hwang <[email protected]>
mmc: core: Do a power cycle when the CMD11 fails
Avri Altman <[email protected]>
mmc: block: Issue a cache flush only when it's enabled
Avri Altman <[email protected]>
mmc: block: Update ext_csd.cache_ctrl if it was written
Aniruddha Tvs Rao <[email protected]>
mmc: sdhci-tegra: Add required callbacks to set/clear CQE_EN bit
Adrian Hunter <[email protected]>
mmc: sdhci-pci: Fix initialization of some SD cards for Intel BYT-based controllers
Pradeep P V K <[email protected]>
mmc: sdhci: Check for reset prior to DMA address unmap
Christophe JAILLET <[email protected]>
mmc: uniphier-sd: Fix a resource leak in the remove function
Christophe JAILLET <[email protected]>
mmc: uniphier-sd: Fix an error handling path in uniphier_sd_probe()
Sreekanth Reddy <[email protected]>
scsi: mpt3sas: Block PCI config access from userspace during reset
Sreekanth Reddy <[email protected]>
scsi: mpt3sas: Only one vSES is present even when IOC has multi vSES
Arun Easi <[email protected]>
scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()
James Smart <[email protected]>
scsi: lpfc: Fix rmmod crash due to bad ring pointers to abort_iotag
Roman Bolshakov <[email protected]>
scsi: qla2xxx: Reserve extra IRQ vectors
Ilya Dryomov <[email protected]>
libceph: allow addrvecs with a single NONE/blank address
Ilya Dryomov <[email protected]>
libceph: bump CephXAuthenticate encoding version
Tudor Ambarus <[email protected]>
spi: spi-ti-qspi: Free DMA resources
Christophe Kerello <[email protected]>
spi: stm32-qspi: fix pm_runtime usage_count counter
Gao Xiang <[email protected]>
erofs: add unsupported inode i_format check
Gustavo A. R. Silva <[email protected]>
mtd: physmap: physmap-bt1-rom: Fix unintentional stack access
Kai Stuhlemmer (ebee Engineering) <[email protected]>
mtd: rawnand: atmel: Update ecc_stats.corrected counter
Alexander Lobakin <[email protected]>
mtd: spinand: core: add missing MODULE_DEVICE_TABLE()
Tudor Ambarus <[email protected]>
Revert "mtd: spi-nor: macronix: Add support for mx25l51245g"
Xiang Chen <[email protected]>
mtd: spi-nor: core: Fix an issue of releasing resources during read/write
Jim Quinlan <[email protected]>
reset: add missing empty function reset_control_rearm()
Davidlohr Bueso <[email protected]>
fs/epoll: restore waking from ep_done_scan()
Jeffrey Mitchell <[email protected]>
ecryptfs: fix kernel panic with null dev_name
Chunfeng Yun <[email protected]>
arm64: dts: mt8173: fix property typo of 'phys' in dsi node
Marek Behún <[email protected]>
arm64: dts: marvell: armada-37xx: add syscon compatible to NB clk node
Ard Biesheuvel <[email protected]>
ARM: 9056/1: decompressor: fix BSS size calculation for LLVM ld.lld
Steven Rostedt (VMware) <[email protected]>
ftrace: Handle commands when closing set_ftrace_filter file
Mark Langsdorf <[email protected]>
ACPI: custom_method: fix a possible memory leak
Mark Langsdorf <[email protected]>
ACPI: custom_method: fix potential use-after-free issue
Stefan Berger <[email protected]>
tpm: acpi: Check eventlog signature before using it
Jason Wang <[email protected]>
vhost-vdpa: fix vm_flags for virtqueue doorbell mapping
Vineeth Vijayan <[email protected]>
s390/cio: remove invalid condition on IO_SCH_UNREG
Tony Krowiak <[email protected]>
s390/vfio-ap: fix circular lockdep when setting/clearing crypto masks
Harald Freudenberger <[email protected]>
s390/zcrypt: fix zcard and zqueue hot-unplug memleak
Vasily Gorbik <[email protected]>
s390/disassembler: increase ebpf disasm buffer size
Shuo Chen <[email protected]>
dyndbg: fix parsing file query without a line-range suffix
Mathias Krause <[email protected]>
nitro_enclaves: Fix stale file descriptors on failed usercopy
Loic Poulain <[email protected]>
bus: mhi: pci_generic: Remove WQ_MEM_RECLAIM flag from state workqueue
Bhaumik Bhatt <[email protected]>
bus: mhi: core: Add missing checks for MMIO register entries
Jeffrey Hugo <[email protected]>
bus: mhi: core: Sanity check values from remote device before use
Bhaumik Bhatt <[email protected]>
bus: mhi: core: Clear configuration from channel context during reset
Jeffrey Hugo <[email protected]>
bus: mhi: core: Fix check for syserr at power_up
-------------
Diffstat:
Makefile | 12 +- arch/arm/boot/compressed/Makefile | 4 +- arch/arm/boot/dts/at91-sam9x60ek.dts | 3 +- arch/arm/boot/dts/at91-sama5d27_som1_ek.dts | 3 +- arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts | 3 +- arch/arm/boot/dts/at91-sama5d2_icp.dts | 3 +- arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts | 3 +- arch/arm/boot/dts/at91-sama5d2_xplained.dts | 3 +- arch/arm/boot/dts/at91-sama5d3_xplained.dts | 3 +- arch/arm/boot/dts/at91sam9260ek.dts | 3 +- arch/arm/boot/dts/at91sam9g20ek_common.dtsi | 3 +- arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts | 4 +- arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts | 4 +- arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts | 4 +- arch/arm/boot/dts/bcm4708-netgear-r6250.dts | 4 +- arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts | 4 +- arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts | 4 +- arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts | 4 +- arch/arm/boot/dts/bcm47081-buffalo-wzr-600dhp2.dts | 4 +- arch/arm/boot/dts/bcm47081-buffalo-wzr-900dhp.dts | 4 +- arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts | 4 +- arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts | 4 +- arch/arm/boot/dts/bcm4709-linksys-ea9200.dts | 4 +- arch/arm/boot/dts/bcm4709-netgear-r7000.dts | 4 +- arch/arm/boot/dts/bcm4709-netgear-r8000.dts | 4 +- arch/arm/boot/dts/bcm47094-dlink-dir-885l.dts | 4 +- arch/arm/boot/dts/bcm47094-linksys-panamera.dts | 4 +- arch/arm/boot/dts/bcm47094-luxul-abr-4500.dts | 4 +- arch/arm/boot/dts/bcm47094-luxul-xbr-4500.dts | 4 +- arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts | 4 +- arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts | 4 +- arch/arm/boot/dts/bcm47094-luxul-xwr-3150-v1.dts | 4 +- arch/arm/boot/dts/bcm47094-netgear-r8500.dts | 4 +- arch/arm/boot/dts/bcm47094-phicomm-k3.dts | 4 +- arch/arm/boot/dts/ste-href-tvk1281618-r3.dtsi | 73 +++-- arch/arm/boot/dts/tegra20-acer-a500-picasso.dts | 2 +- arch/arm/crypto/curve25519-core.S | 2 +- .../arm64/boot/dts/freescale/imx8mq-librem5-r3.dts | 4 + arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 3 +- arch/arm64/boot/dts/mediatek/mt8173.dtsi | 2 +- arch/arm64/kernel/vdso/vdso.lds.S | 8 +- arch/powerpc/include/asm/mmu_context.h | 2 +- arch/powerpc/include/asm/reg.h | 1 + arch/powerpc/include/uapi/asm/errno.h | 1 + arch/powerpc/kernel/eeh.c | 11 +- arch/powerpc/kernel/setup_64.c | 19 +- arch/powerpc/kernel/vdso.c | 54 +++- arch/powerpc/kexec/file_load_64.c | 92 ++++++ arch/powerpc/kvm/book3s_64_mmu_host.c | 2 + arch/powerpc/lib/Makefile | 3 + arch/s390/crypto/arch_random.c | 4 + arch/s390/kernel/dis.c | 2 +- arch/x86/Kconfig | 2 +- arch/x86/Makefile | 1 + arch/x86/boot/compressed/Makefile | 1 + arch/x86/boot/compressed/mem_encrypt.S | 6 - arch/x86/kernel/cpu/common.c | 2 +- arch/x86/kernel/sev-es-shared.c | 6 +- arch/x86/mm/mem_encrypt_identity.c | 35 +-- crypto/api.c | 2 +- crypto/rng.c | 10 +- drivers/acpi/arm64/gtdt.c | 10 +- drivers/acpi/custom_method.c | 4 +- drivers/ata/ahci.c | 5 + drivers/ata/ahci.h | 1 + drivers/ata/libahci.c | 5 + drivers/block/rnbd/rnbd-clt-sysfs.c | 10 +- drivers/block/rnbd/rnbd-srv.c | 4 +- drivers/bus/mhi/core/init.c | 27 +- drivers/bus/mhi/core/main.c | 150 ++++++++-- drivers/bus/mhi/core/pm.c | 10 +- drivers/bus/ti-sysc.c | 49 ++++ drivers/char/random.c | 4 +- drivers/char/tpm/eventlog/acpi.c | 33 ++- drivers/char/tpm/eventlog/common.c | 3 + drivers/char/tpm/eventlog/efi.c | 29 +- drivers/clk/socfpga/clk-gate-a10.c | 1 + drivers/clocksource/dw_apb_timer_of.c | 26 +- drivers/cpuidle/cpuidle-tegra.c | 12 +- drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 2 +- .../crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c | 2 +- drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 2 +- drivers/crypto/hisilicon/sec2/sec_crypto.c | 2 +- drivers/crypto/omap-aes.c | 7 +- drivers/crypto/qat/qat_common/qat_algs.c | 11 +- drivers/crypto/sa2ul.c | 2 +- drivers/crypto/stm32/stm32-cryp.c | 4 +- drivers/crypto/stm32/stm32-hash.c | 8 +- drivers/extcon/extcon-arizona.c | 57 ++-- drivers/firmware/efi/libstub/Makefile | 3 +- drivers/fpga/dfl-pci.c | 18 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c | 9 +- drivers/gpu/drm/amd/amdkfd/kfd_debugfs.c | 7 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 17 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 17 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 14 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 15 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c | 115 +++++--- drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c | 3 + .../amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c | 4 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 3 +- drivers/gpu/drm/amd/display/dc/dce/dce_aux.h | 1 - drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c | 15 +- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_mpc.c | 24 +- .../gpu/drm/amd/display/dc/dcn30/dcn30_resource.c | 2 +- .../amd/display/dc/dml/dcn20/display_mode_vba_20.c | 1 + .../display/dc/dml/dcn20/display_mode_vba_20v2.c | 1 + .../display/dc/dml/dcn20/display_rq_dlg_calc_20.c | 28 +- .../dc/dml/dcn20/display_rq_dlg_calc_20v2.c | 28 +- .../display/dc/dml/dcn21/display_rq_dlg_calc_21.c | 28 +- .../display/dc/dml/dcn30/display_rq_dlg_calc_30.c | 28 +- .../amd/display/dc/dml/dml1_display_rq_dlg_calc.c | 28 +- .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 2 +- drivers/gpu/drm/arm/display/include/malidp_utils.h | 3 - .../gpu/drm/arm/display/komeda/komeda_pipeline.c | 16 +- .../drm/arm/display/komeda/komeda_pipeline_state.c | 19 +- drivers/gpu/drm/ast/ast_drv.c | 2 + drivers/gpu/drm/ast/ast_mode.c | 2 +- drivers/gpu/drm/drm_panel_orientation_quirks.c | 14 + drivers/gpu/drm/i915/intel_pm.c | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c | 18 +- drivers/gpu/drm/msm/dp/dp_hpd.c | 4 +- drivers/gpu/drm/qxl/qxl_display.c | 4 + drivers/gpu/drm/qxl/qxl_drv.c | 2 + drivers/gpu/drm/radeon/radeon_object.c | 2 + drivers/gpu/drm/radeon/radeon_ttm.c | 5 +- drivers/gpu/drm/virtio/virtgpu_ioctl.c | 2 +- drivers/gpu/drm/virtio/virtgpu_object.c | 1 + drivers/gpu/drm/vkms/vkms_crtc.c | 3 +- drivers/hwtracing/intel_th/gth.c | 4 +- drivers/hwtracing/intel_th/pci.c | 10 + drivers/input/touchscreen/ili210x.c | 2 +- drivers/iommu/intel/iommu.c | 52 +++- drivers/irqchip/irq-gic-v3.c | 8 +- drivers/md/dm-integrity.c | 1 + drivers/md/dm-raid.c | 34 ++- drivers/md/dm-rq.c | 2 + drivers/md/persistent-data/dm-btree-internal.h | 4 +- drivers/md/persistent-data/dm-space-map-common.c | 2 + drivers/md/persistent-data/dm-space-map-common.h | 8 +- drivers/md/raid1.c | 2 + drivers/media/dvb-core/dvbdev.c | 1 + drivers/media/i2c/adv7511-v4l2.c | 2 +- drivers/media/i2c/adv7604.c | 2 +- drivers/media/i2c/adv7842.c | 2 +- drivers/media/i2c/tc358743.c | 2 +- drivers/media/i2c/tda1997x.c | 2 +- drivers/media/pci/cx23885/cx23885-core.c | 9 + drivers/media/pci/saa7164/saa7164-encoder.c | 20 +- drivers/media/pci/sta2x11/Kconfig | 1 + drivers/media/platform/coda/coda-common.c | 4 +- drivers/media/platform/qcom/venus/hfi_parser.c | 6 +- drivers/media/platform/sti/bdisp/bdisp-debug.c | 2 +- drivers/media/platform/sunxi/sun8i-di/sun8i-di.c | 2 +- drivers/media/rc/ite-cir.c | 8 +- drivers/media/test-drivers/vivid/vivid-core.c | 6 +- drivers/media/usb/dvb-usb/dvb-usb-init.c | 90 ++++-- drivers/media/usb/dvb-usb/dvb-usb.h | 2 +- drivers/media/usb/em28xx/em28xx-dvb.c | 1 + drivers/media/usb/gspca/gspca.c | 2 + drivers/media/usb/gspca/gspca.h | 1 + drivers/media/usb/gspca/sq905.c | 2 +- drivers/media/usb/gspca/stv06xx/stv06xx.c | 9 + drivers/media/usb/zr364xx/zr364xx.c | 13 +- drivers/media/v4l2-core/v4l2-ctrls.c | 139 +++++----- drivers/mfd/arizona-irq.c | 2 +- drivers/mfd/da9063-i2c.c | 10 + drivers/mmc/core/block.c | 16 ++ drivers/mmc/core/core.c | 76 +---- drivers/mmc/core/core.h | 17 +- drivers/mmc/core/host.c | 40 ++- drivers/mmc/core/mmc.c | 7 + drivers/mmc/core/mmc_ops.c | 4 +- drivers/mmc/core/sd.c | 6 + drivers/mmc/core/sdio.c | 28 +- drivers/mmc/host/sdhci-brcmstb.c | 1 - drivers/mmc/host/sdhci-esdhc-imx.c | 2 +- drivers/mmc/host/sdhci-pci-core.c | 29 ++ drivers/mmc/host/sdhci-pci.h | 2 + drivers/mmc/host/sdhci-tegra.c | 32 +++ drivers/mmc/host/sdhci.c | 60 ++-- drivers/mmc/host/uniphier-sd.c | 5 +- drivers/mtd/maps/physmap-bt1-rom.c | 2 +- drivers/mtd/nand/raw/atmel/nand-controller.c | 6 +- drivers/mtd/nand/spi/core.c | 2 + drivers/mtd/spi-nor/core.c | 33 +++ drivers/mtd/spi-nor/macronix.c | 3 - drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c | 30 +- drivers/net/ethernet/sfc/farch.c | 16 +- drivers/net/wireless/rsi/rsi_91x_sdio.c | 2 +- drivers/nvme/target/discovery.c | 6 +- drivers/pci/controller/dwc/pcie-designware-ep.c | 2 + drivers/pci/controller/dwc/pcie-designware-host.c | 1 + drivers/pci/controller/dwc/pcie-designware.c | 11 +- drivers/pci/controller/dwc/pcie-designware.h | 1 + drivers/pci/pci.c | 16 +- drivers/perf/arm_pmu_platform.c | 9 +- drivers/phy/ti/phy-twl4030-usb.c | 2 +- drivers/pinctrl/pinctrl-ingenic.c | 40 ++- drivers/platform/x86/intel_pmc_core.c | 19 +- .../x86/intel_speed_select_if/isst_if_mbox_pci.c | 33 ++- drivers/power/supply/bq27xxx_battery.c | 51 ++-- drivers/power/supply/cpcap-battery.c | 2 +- drivers/power/supply/cpcap-charger.c | 3 + drivers/power/supply/generic-adc-battery.c | 2 +- drivers/power/supply/lp8788-charger.c | 2 +- drivers/power/supply/pm2301_charger.c | 2 +- drivers/power/supply/s3c_adc_battery.c | 2 +- drivers/power/supply/tps65090-charger.c | 2 +- drivers/power/supply/tps65217_charger.c | 2 +- drivers/regulator/da9121-regulator.c | 80 ++++-- drivers/regulator/da9121-regulator.h | 13 + drivers/s390/cio/device.c | 3 +- drivers/s390/crypto/vfio_ap_ops.c | 308 ++++++++++++++------- drivers/s390/crypto/vfio_ap_private.h | 2 + drivers/s390/crypto/zcrypt_card.c | 1 + drivers/s390/crypto/zcrypt_queue.c | 1 + drivers/scsi/device_handler/scsi_dh_alua.c | 5 +- drivers/scsi/libfc/fc_lport.c | 2 +- drivers/scsi/lpfc/lpfc_attr.c | 75 +++-- drivers/scsi/lpfc/lpfc_crtn.h | 7 +- drivers/scsi/lpfc/lpfc_els.c | 99 +------ drivers/scsi/lpfc/lpfc_hbadisc.c | 10 +- drivers/scsi/lpfc/lpfc_hw4.h | 174 +----------- drivers/scsi/lpfc/lpfc_init.c | 112 +------- drivers/scsi/lpfc/lpfc_mbox.c | 36 --- drivers/scsi/lpfc/lpfc_nportdisc.c | 254 ++++++----------- drivers/scsi/lpfc/lpfc_nvmet.c | 1 - drivers/scsi/lpfc/lpfc_sli.c | 63 +++-- drivers/scsi/mpt3sas/mpt3sas_base.c | 4 + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 +- drivers/scsi/qla2xxx/qla_attr.c | 8 +- drivers/scsi/qla2xxx/qla_bsg.c | 3 +- drivers/scsi/qla2xxx/qla_isr.c | 4 +- drivers/scsi/qla2xxx/qla_os.c | 7 - drivers/scsi/smartpqi/smartpqi_init.c | 161 +++++++++++ drivers/soc/tegra/pmc.c | 70 ++++- drivers/soundwire/cadence_master.c | 10 +- drivers/spi/spi-ath79.c | 3 +- drivers/spi/spi-dln2.c | 2 +- drivers/spi/spi-omap-100k.c | 6 +- drivers/spi/spi-qup.c | 2 +- drivers/spi/spi-stm32-qspi.c | 18 +- drivers/spi/spi-ti-qspi.c | 20 +- drivers/spi/spi.c | 16 +- drivers/staging/media/atomisp/pci/atomisp_fops.c | 3 + drivers/staging/media/imx/imx-media-capture.c | 2 +- drivers/staging/media/ipu3/ipu3-v4l2.c | 36 ++- drivers/staging/wimax/i2400m/op-rfkill.c | 2 +- drivers/target/target_core_pscsi.c | 3 +- drivers/tee/optee/core.c | 10 - drivers/thermal/cpufreq_cooling.c | 2 +- drivers/thermal/gov_fair_share.c | 4 + drivers/tty/n_gsm.c | 14 +- drivers/tty/vt/vt.c | 1 + drivers/usb/core/hub.c | 2 +- drivers/usb/dwc2/core_intr.c | 8 + drivers/usb/dwc3/core.c | 29 ++ drivers/usb/dwc3/core.h | 9 +- drivers/usb/dwc3/gadget.c | 41 ++- drivers/usb/gadget/config.c | 4 + drivers/usb/gadget/function/f_fs.c | 3 +- drivers/usb/gadget/function/f_uac1.c | 43 +++ drivers/usb/gadget/function/f_uac2.c | 39 ++- drivers/usb/gadget/function/f_uvc.c | 8 +- drivers/usb/gadget/legacy/webcam.c | 1 + drivers/usb/gadget/udc/dummy_hcd.c | 23 +- drivers/usb/gadget/udc/tegra-xudc.c | 2 +- drivers/usb/host/xhci-mem.c | 12 + drivers/usb/host/xhci-mtk.c | 3 + drivers/usb/host/xhci-mtk.h | 1 + drivers/usb/host/xhci.c | 14 +- drivers/usb/musb/musb_core.c | 2 +- drivers/vhost/vdpa.c | 1 + drivers/video/backlight/qcom-wled.c | 29 +- drivers/video/fbdev/core/fbcmap.c | 8 +- drivers/virt/nitro_enclaves/ne_misc_dev.c | 43 ++- fs/btrfs/compression.c | 11 +- fs/btrfs/ctree.c | 20 ++ fs/btrfs/ioctl.c | 18 +- fs/btrfs/relocation.c | 46 ++- fs/btrfs/transaction.c | 12 +- fs/cifs/cifsfs.c | 2 +- fs/cifs/connect.c | 25 +- fs/cifs/fs_context.c | 7 + fs/cifs/sess.c | 6 + fs/cifs/smb2ops.c | 18 +- fs/cifs/smb2pdu.c | 5 + fs/ecryptfs/main.c | 6 + fs/erofs/erofs_fs.h | 3 + fs/erofs/inode.c | 7 + fs/eventpoll.c | 6 + fs/exfat/balloc.c | 11 +- fs/ext4/fast_commit.c | 4 +- fs/ext4/file.c | 25 +- fs/ext4/ialloc.c | 51 ++-- fs/ext4/ioctl.c | 6 + fs/ext4/mmp.c | 2 +- fs/ext4/super.c | 16 +- fs/f2fs/node.c | 3 + fs/f2fs/verity.c | 75 +++-- fs/fuse/file.c | 41 ++- fs/fuse/fuse_i.h | 1 + fs/fuse/virtio_fs.c | 1 + fs/jbd2/transaction.c | 15 +- fs/jffs2/compr_rtime.c | 3 + fs/jffs2/file.c | 1 + fs/jffs2/scan.c | 2 +- fs/nfs/fs_context.c | 12 + fs/nfs/pnfs.c | 7 +- fs/stat.c | 8 + fs/ubifs/replay.c | 3 +- include/crypto/acompress.h | 2 + include/crypto/aead.h | 2 + include/crypto/akcipher.h | 2 + include/crypto/chacha.h | 9 +- include/crypto/hash.h | 4 + include/crypto/kpp.h | 2 + include/crypto/rng.h | 2 + include/crypto/skcipher.h | 2 + include/linux/ioport.h | 2 +- include/linux/mfd/da9063/registers.h | 3 + include/linux/mfd/intel-m10-bmc.h | 2 +- include/linux/mmc/host.h | 3 - include/linux/perf_event.h | 1 + include/linux/power/bq27xxx_battery.h | 1 - include/linux/reset.h | 5 + include/media/v4l2-ctrls.h | 12 +- include/scsi/libfcoe.h | 2 +- include/uapi/linux/usb/video.h | 3 +- kernel/.gitignore | 1 + kernel/Makefile | 9 +- kernel/events/core.c | 142 +++++----- kernel/futex.c | 7 +- kernel/irq/matrix.c | 4 +- kernel/kcsan/core.c | 2 - kernel/kcsan/debugfs.c | 4 +- kernel/kcsan/kcsan.h | 5 - kernel/rcu/tree.c | 2 +- kernel/rcu/tree_plugin.h | 7 +- kernel/sched/fair.c | 31 ++- kernel/sched/features.h | 3 + kernel/sched/psi.c | 5 +- kernel/sched/topology.c | 91 ++++-- kernel/time/posix-timers.c | 4 +- kernel/trace/ftrace.c | 5 +- kernel/trace/trace.c | 41 +-- kernel/trace/trace_clock.c | 44 ++- lib/dynamic_debug.c | 2 +- lib/vsprintf.c | 2 - mm/page_alloc.c | 30 +- net/bluetooth/ecdh_helper.h | 2 +- net/ceph/auth_x.c | 2 +- net/ceph/decode.c | 20 +- net/openvswitch/actions.c | 8 +- net/sched/sch_frag.c | 8 +- security/commoncap.c | 2 +- sound/isa/sb/emu8000.c | 4 +- sound/isa/sb/sb16_csp.c | 8 +- sound/pci/hda/patch_conexant.c | 14 +- sound/pci/hda/patch_realtek.c | 52 +++- sound/usb/clock.c | 18 +- sound/usb/mixer_maps.c | 12 + tools/power/x86/intel-speed-select/isst-display.c | 12 +- tools/power/x86/turbostat/turbostat.c | 19 +- tools/testing/selftests/arm64/mte/Makefile | 2 - .../testing/selftests/arm64/mte/mte_common_util.c | 13 +- tools/testing/selftests/resctrl/Makefile | 2 +- tools/testing/selftests/resctrl/cache.c | 8 +- tools/testing/selftests/resctrl/cat_test.c | 12 +- tools/testing/selftests/resctrl/cqm_test.c | 14 +- tools/testing/selftests/resctrl/fill_buf.c | 4 +- tools/testing/selftests/resctrl/mba_test.c | 2 +- tools/testing/selftests/resctrl/mbm_test.c | 2 +- tools/testing/selftests/resctrl/resctrl.h | 21 +- tools/testing/selftests/resctrl/resctrl_tests.c | 14 +- tools/testing/selftests/resctrl/resctrl_val.c | 85 +++--- tools/testing/selftests/resctrl/resctrlfs.c | 79 ++++-- 384 files changed, 3783 insertions(+), 2214 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/342 bus: mhi: core: Fix check for syserr at power_up
From: Jeffrey Hugo <[email protected]>
commit 6403298c58d4858d93648f553abf0bcbd2dfaca2 upstream.
The check to see if we have reset the device after detecting syserr at power_up is inverted. wait_for_event_timeout() returns 0 on failure, and a positive value on success. The check is looking for non-zero as a failure, which is likely to incorrectly cause a device init failure if syserr was detected at power_up. Fix this.
--- drivers/bus/mhi/core/pm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/bus/mhi/core/pm.c +1 -1
@@ -1092,7 +1092,7 @@ int mhi_async_power_up(struct mhi_contro &val) || !val, msecs_to_jiffies(mhi_cntrl->timeout_ms)); -if (ret) { +if (!ret) { ret = -EIO ;dev_info (dev,"Failed to reset MHI due to syserr state\n" ); goto error_bhi_offset;
Greg Kroah-Hartman
maintainerPATCH 2/342 bus: mhi: core: Clear configuration from channel context during reset
In reply to Greg Kroah-HartmanFrom: Bhaumik Bhatt <[email protected]>
commit 47705c08465931923e2f2b506986ca0bdf80380d upstream.
When clearing up the channel context after client drivers are done using channels, the configuration is currently not being reset entirely. Ensure this is done to appropriately handle issues where clients unaware of the context state end up calling functions which expect a context.
--- drivers/bus/mhi/core/init.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/bus/mhi/core/init.c +13 -0
@@ -547,6 +547,7 @@ void mhi_deinit_chan_ctxt(struct mhi_construct mhi_ring *buf_ring;struct mhi_ring *tre_ring;struct mhi_chan_ctxt *chan_ctxt; +u32 tmp; buf_ring = &mhi_chan->buf_ring; tre_ring = &mhi_chan->tre_ring;
@@ -560,7 +561,19 @@ void mhi_deinit_chan_ctxt(struct mhi_convfree (buf_ring->base); buf_ring->base = tre_ring->base =NULL ; + tre_ring->ctxt_wp =NULL ; chan_ctxt->rbase =0 ; + chan_ctxt->rlen =0 ; + chan_ctxt->rp =0 ; + chan_ctxt->wp =0 ; + + tmp = chan_ctxt->chcfg; + tmp &= ~CHAN_CTX_CHSTATE_MASK ; + tmp |= (MHI_CH_STATE_DISABLED <<CHAN_CTX_CHSTATE_SHIFT ); + chan_ctxt->chcfg = tmp; + +/* Update to all cores */ +smp_wmb (); } int mhi_init_chan_ctxt(struct mhi_controller *mhi_cntrl,
Greg Kroah-Hartman
maintainerPATCH 3/342 bus: mhi: core: Sanity check values from remote device before use
In reply to Greg Kroah-HartmanFrom: Jeffrey Hugo <[email protected]>
commit ec32332df7645e0ba463a08d483fe97665167071 upstream.
When parsing the structures in the shared memory, there are values which come from the remote device. For example, a transfer completion event will have a pointer to the tre in the relevant channel's transfer ring. As another example, event ring elements may specify a channel in which the event occurred, however the specified channel value may not be valid as no channel is defined at that index even though the index may be less than the maximum allowed index. Such values should be considered to be untrusted, and validated before use. If we blindly use such values, we may access invalid data or crash if the values are corrupted.
If validation fails, drop the relevant event.
--- drivers/bus/mhi/core/main.c | 81 ++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 74 insertions(+), 7 deletions(-)
drivers/bus/mhi/core/main.c +74 -7
@@ -222,6 +222,11 @@ static void mhi_del_ring_element(structsmp_wmb (); } +static bool is_valid_ring_ptr (struct mhi_ring *ring,dma_addr_t addr) +{ +return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len; +} +int mhi_destroy_device (struct device *dev,void *data) {struct mhi_device *mhi_dev;
@@ -351,7 +356,16 @@ irqreturn_t mhi_irq_handler(int irq_numbstruct mhi_event_ctxt *er_ctxt = &mhi_cntrl->mhi_ctxt->er_ctxt[mhi_event->er_index];struct mhi_ring *ev_ring = &mhi_event->ring; -void *dev_rp =mhi_to_virtual (ev_ring, er_ctxt->rp); +dma_addr_t ptr = er_ctxt->rp; +void *dev_rp; + +if (!is_valid_ring_ptr (ev_ring, ptr)) { +dev_err (&mhi_cntrl->mhi_dev->dev, +"Event ring rp points outside of the event ring\n" ); +return IRQ_HANDLED ; + } + + dev_rp =mhi_to_virtual (ev_ring, ptr);/* Only proceed if event ring has pending events */ if (ev_ring->rp == dev_rp)
@@ -504,6 +518,11 @@ static int parse_xfer_event(struct mhi_cstruct mhi_buf_info *buf_info;u16 xfer_len; +if (!is_valid_ring_ptr (tre_ring, ptr)) { +dev_err (&mhi_cntrl->mhi_dev->dev, +"Event element points outside of the tre ring\n" ); +break ; + }/* Get the TRB this event points to */ ev_tre =mhi_to_virtual (tre_ring, ptr);
@@ -663,6 +682,12 @@ static void mhi_process_cmd_completion(sstruct mhi_chan *mhi_chan;u32 chan; +if (!is_valid_ring_ptr (mhi_ring, ptr)) { +dev_err (&mhi_cntrl->mhi_dev->dev, +"Event element points outside of the cmd ring\n" ); +return ; + } + cmd_pkt =mhi_to_virtual (mhi_ring, ptr); chan =MHI_TRE_GET_CMD_CHID (cmd_pkt);
@@ -687,6 +712,7 @@ int mhi_process_ctrl_ev_ring(struct mhi_struct device *dev = &mhi_cntrl->mhi_dev->dev;u32 chan;int count =0 ; +dma_addr_t ptr = er_ctxt->rp;/* * This is a quick check to avoid unnecessary event processing
@@ -696,7 +722,13 @@ int mhi_process_ctrl_ev_ring(struct mhi_if (unlikely (MHI_EVENT_ACCESS_INVALID (mhi_cntrl->pm_state)))return -EIO ; - dev_rp =mhi_to_virtual (ev_ring, er_ctxt->rp); +if (!is_valid_ring_ptr (ev_ring, ptr)) { +dev_err (&mhi_cntrl->mhi_dev->dev, +"Event ring rp points outside of the event ring\n" ); +return -EIO ; + } + + dev_rp =mhi_to_virtual (ev_ring, ptr); local_rp = ev_ring->rp;while (dev_rp != local_rp) {
@@ -802,6 +834,8 @@ int mhi_process_ctrl_ev_ring(struct mhi_*/ if (chan < mhi_cntrl->max_chan) { mhi_chan = &mhi_cntrl->mhi_chan[chan]; +if (!mhi_chan->configured) +break ;parse_xfer_event (mhi_cntrl, local_rp, mhi_chan); event_quota--; }
@@ -813,7 +847,15 @@ int mhi_process_ctrl_ev_ring(struct mhi_mhi_recycle_ev_ring_element (mhi_cntrl, ev_ring); local_rp = ev_ring->rp; - dev_rp =mhi_to_virtual (ev_ring, er_ctxt->rp); + + ptr = er_ctxt->rp; +if (!is_valid_ring_ptr (ev_ring, ptr)) { +dev_err (&mhi_cntrl->mhi_dev->dev, +"Event ring rp points outside of the event ring\n" ); +return -EIO ; + } + + dev_rp =mhi_to_virtual (ev_ring, ptr); count++; }
@@ -836,11 +878,18 @@ int mhi_process_data_event_ring(struct mint count =0 ;u32 chan;struct mhi_chan *mhi_chan; +dma_addr_t ptr = er_ctxt->rp;if (unlikely (MHI_EVENT_ACCESS_INVALID (mhi_cntrl->pm_state)))return -EIO ; - dev_rp =mhi_to_virtual (ev_ring, er_ctxt->rp); +if (!is_valid_ring_ptr (ev_ring, ptr)) { +dev_err (&mhi_cntrl->mhi_dev->dev, +"Event ring rp points outside of the event ring\n" ); +return -EIO ; + } + + dev_rp =mhi_to_virtual (ev_ring, ptr); local_rp = ev_ring->rp;while (dev_rp != local_rp && event_quota >0 ) {
@@ -854,7 +903,8 @@ int mhi_process_data_event_ring(struct m* Only process the event ring elements whose channel * ID is within the maximum supported range. */ -if (chan < mhi_cntrl->max_chan) { +if (chan < mhi_cntrl->max_chan && + mhi_cntrl->mhi_chan[chan].configured) { mhi_chan = &mhi_cntrl->mhi_chan[chan];if (likely (type ==MHI_PKT_TYPE_TX_EVENT )) {
@@ -868,7 +918,15 @@ int mhi_process_data_event_ring(struct mmhi_recycle_ev_ring_element (mhi_cntrl, ev_ring); local_rp = ev_ring->rp; - dev_rp =mhi_to_virtual (ev_ring, er_ctxt->rp); + + ptr = er_ctxt->rp; +if (!is_valid_ring_ptr (ev_ring, ptr)) { +dev_err (&mhi_cntrl->mhi_dev->dev, +"Event ring rp points outside of the event ring\n" ); +return -EIO ; + } + + dev_rp =mhi_to_virtual (ev_ring, ptr); count++; }read_lock_bh (&mhi_cntrl->pm_lock);
@@ -1407,6 +1465,7 @@ static void mhi_mark_stale_events(structstruct mhi_ring *ev_ring;struct device *dev = &mhi_cntrl->mhi_dev->dev;unsigned long flags; +dma_addr_t ptr;dev_dbg (dev,"Marking all events for chan: %d as stale\n" , chan);
@@ -1414,7 +1473,15 @@ static void mhi_mark_stale_events(struct/* mark all stale events related to channel as STALE event */ spin_lock_irqsave (&mhi_event->lock, flags); - dev_rp =mhi_to_virtual (ev_ring, er_ctxt->rp); + + ptr = er_ctxt->rp; +if (!is_valid_ring_ptr (ev_ring, ptr)) { +dev_err (&mhi_cntrl->mhi_dev->dev, +"Event ring rp points outside of the event ring\n" ); + dev_rp = ev_ring->rp; + }else { + dev_rp =mhi_to_virtual (ev_ring, ptr); + } local_rp = ev_ring->rp;while (dev_rp != local_rp) {
Greg Kroah-Hartman
maintainerPATCH 4/342 bus: mhi: core: Add missing checks for MMIO register entries
In reply to Greg Kroah-HartmanFrom: Bhaumik Bhatt <[email protected]>
commit 8de5ad99414347ad08e6ebc2260be1d2e009cb9a upstream.
As per documentation, fields marked as (required) in an MHI controller structure need to be populated by the controller driver before calling mhi_register_controller(). Ensure all required pointers and non-zero fields are present in the controller before proceeding with the registration.
--- drivers/bus/mhi/core/init.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/bus/mhi/core/init.c +3 -5
@@ -871,12 +871,10 @@ int mhi_register_controller(struct mhi_cu32 soc_info;int ret, i; -if (!mhi_cntrl) -return -EINVAL ; - -if (!mhi_cntrl->runtime_get || !mhi_cntrl->runtime_put || +if (!mhi_cntrl || !mhi_cntrl->cntrl_dev || !mhi_cntrl->regs || + !mhi_cntrl->runtime_get || !mhi_cntrl->runtime_put || !mhi_cntrl->status_cb || !mhi_cntrl->read_reg || - !mhi_cntrl->write_reg || !mhi_cntrl->nr_irqs) + !mhi_cntrl->write_reg || !mhi_cntrl->nr_irqs || !mhi_cntrl->irq)return -EINVAL ; ret =parse_config (mhi_cntrl, config);
Greg Kroah-Hartman
maintainerPATCH 5/342 bus: mhi: pci_generic: Remove WQ_MEM_RECLAIM flag from state workqueue
In reply to Greg Kroah-HartmanFrom: Loic Poulain <[email protected]>
commit 0fccbf0a3b690b162f53b13ed8bc442ea33437dc upstream.
A recent change created a dedicated workqueue for the state-change work with WQ_HIGHPRI (no strong reason for that) and WQ_MEM_RECLAIM flags, but the state-change work (mhi_pm_st_worker) does not guarantee forward progress under memory pressure, and will even wait on various memory allocations when e.g. creating devices, loading firmware, etc... The work is then not part of a memory reclaim path...
Moreover, this causes a warning in check_flush_dependency() since we end up in code that flushes a non-reclaim workqueue:
[ 40.969601] workqueue: WQ_MEM_RECLAIM mhi_hiprio_wq:mhi_pm_st_worker [mhi] is flushing !WQ_MEM_RECLAIM events_highpri:flush_backlog [ 40.969612] WARNING: CPU: 4 PID: 158 at kernel/workqueue.c:2607 check_flush_dependency+0x11c/0x140 [ 40.969733] Call Trace: [ 40.969740] __flush_work+0x97/0x1d0 [ 40.969745] ? wake_up_process+0x15/0x20 [ 40.969749] ? insert_work+0x70/0x80 [ 40.969750] ? __queue_work+0x14a/0x3e0 [ 40.969753] flush_work+0x10/0x20 [ 40.969756] rollback_registered_many+0x1c9/0x510 [ 40.969759] unregister_netdevice_queue+0x94/0x120 [ 40.969761] unregister_netdev+0x1d/0x30 [ 40.969765] mhi_net_remove+0x1a/0x40 [mhi_net] [ 40.969770] mhi_driver_remove+0x124/0x250 [mhi] [ 40.969776] device_release_driver_internal+0xf0/0x1d0 [ 40.969778] device_release_driver+0x12/0x20 [ 40.969782] bus_remove_device+0xe1/0x150 [ 40.969786] device_del+0x17b/0x3e0 [ 40.969791] mhi_destroy_device+0x9a/0x100 [mhi] [ 40.969796] ? mhi_unmap_single_use_bb+0x50/0x50 [mhi] [ 40.969799] device_for_each_child+0x5e/0xa0 [ 40.969804] mhi_pm_st_worker+0x921/0xf50 [mhi]
--- drivers/bus/mhi/core/init.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/bus/mhi/core/init.c +1 -2
@@ -896,8 +896,7 @@ int mhi_register_controller(struct mhi_cINIT_WORK (&mhi_cntrl->st_worker, mhi_pm_st_worker);init_waitqueue_head (&mhi_cntrl->state_event); - mhi_cntrl->hiprio_wq =alloc_ordered_workqueue - ("mhi_hiprio_wq" ,WQ_MEM_RECLAIM |WQ_HIGHPRI ); + mhi_cntrl->hiprio_wq =alloc_ordered_workqueue ("mhi_hiprio_wq" ,WQ_HIGHPRI );if (!mhi_cntrl->hiprio_wq) {dev_err (mhi_cntrl->cntrl_dev,"Failed to allocate workqueue\n" ); ret = -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 6/342 nitro_enclaves: Fix stale file descriptors on failed usercopy
In reply to Greg Kroah-HartmanFrom: Mathias Krause <[email protected]>
commit f1ce3986baa62cffc3c5be156994de87524bab99 upstream.
A failing usercopy of the slot uid will lead to a stale entry in the file descriptor table as put_unused_fd() won't release it. This enables userland to refer to a dangling 'file' object through that still valid file descriptor, leading to all kinds of use-after-free exploitation scenarios.
Exchanging put_unused_fd() for close_fd(), ksys_close() or alike won't solve the underlying issue, as the file descriptor might have been replaced in the meantime, e.g. via userland calling close() on it (leading to a NULL pointer dereference in the error handling code as 'fget(enclave_fd)' will return a NULL pointer) or by dup2()'ing a completely different file object to that very file descriptor, leading to the same situation: a dangling file descriptor pointing to a freed object -- just in this case to a file object of user's choosing.
Generally speaking, after the call to fd_install() the file descriptor is live and userland is free to do whatever with it. We cannot rely on it to still refer to our enclave object afterwards. In fact, by abusing userfaultfd() userland can hit the condition without any racing and abuse the error handling in the nitro code as it pleases.
To fix the above issues, defer the call to fd_install() until all possible errors are handled. In this case it's just the usercopy, so do it directly in ne_create_vm_ioctl() itself.
--- drivers/virt/nitro_enclaves/ne_misc_dev.c | 43 +++++++++++------------------- 1 file changed, 17 insertions(+), 26 deletions(-)
drivers/virt/nitro_enclaves/ne_misc_dev.c +17 -26
@@ -1524,7 +1524,8 @@ static const struct file_operations ne_e* enclave file descriptor to be further used for enclave * resources handling e.g. memory regions and CPUs. * @ne_pci_dev : Private data associated with the PCI device. -* @slot_uid: Generated unique slot id associated with an enclave. +* @slot_uid: User pointer to store the generated unique slot id +* associated with an enclave to. * * Context: Process context. This function is called with the ne_pci_dev enclave * mutex held.
@@ -1532,7 +1533,7 @@ static const struct file_operations ne_e* * Enclave fd on success. * * Negative return value on failure. */ -static int ne_create_vm_ioctl (struct ne_pci_dev *ne_pci_dev,u64 *slot_uid) +static int ne_create_vm_ioctl (struct ne_pci_dev *ne_pci_dev,u64 __user *slot_uid) {struct ne_pci_dev_cmd_reply cmd_reply = {};int enclave_fd =-1 ;
@@ -1634,7 +1635,18 @@ static int ne_create_vm_ioctl(struct ne_list_add (&ne_enclave->enclave_list_entry, &ne_pci_dev->enclaves_list); - *slot_uid = ne_enclave->slot_uid; +if (copy_to_user (slot_uid, &ne_enclave->slot_uid,sizeof (ne_enclave->slot_uid))) { +/* +* As we're holding the only reference to 'enclave_file', fput() +* will call ne_enclave_release() which will do a proper cleanup +* of all so far allocated resources, leaving only the unused fd +* for us to free. +*/ +fput (enclave_file); +put_unused_fd (enclave_fd); + +return -EFAULT ; + }fd_install (enclave_fd, enclave_file);
@@ -1671,34 +1683,13 @@ static long ne_ioctl(struct file *file,switch (cmd) {case NE_CREATE_VM : {int enclave_fd =-1 ; -struct file *enclave_file =NULL ;struct ne_pci_dev *ne_pci_dev = ne_devs.ne_pci_dev; -int rc = -EINVAL ; -u64 slot_uid =0 ; +u64 __user *slot_uid = (void __user *)arg;mutex_lock (&ne_pci_dev->enclaves_list_mutex); - - enclave_fd =ne_create_vm_ioctl (ne_pci_dev, &slot_uid); -if (enclave_fd <0 ) { - rc = enclave_fd; - -mutex_unlock (&ne_pci_dev->enclaves_list_mutex); - -return rc; - } - + enclave_fd =ne_create_vm_ioctl (ne_pci_dev, slot_uid);mutex_unlock (&ne_pci_dev->enclaves_list_mutex); -if (copy_to_user ((void __user *)arg, &slot_uid,sizeof (slot_uid))) { - enclave_file =fget (enclave_fd); -/* Decrement file refs to have release() called. */ -fput (enclave_file); -fput (enclave_file); -put_unused_fd (enclave_fd); - -return -EFAULT ; - } -return enclave_fd; }
Greg Kroah-Hartman
maintainerPATCH 7/342 dyndbg: fix parsing file query without a line-range suffix
In reply to Greg Kroah-HartmanFrom: Shuo Chen <[email protected]>
commit 7b1ae248279bea33af9e797a93c35f49601cb8a0 upstream.
Query like 'file tcp_input.c line 1234 +p' was broken by
commit aaebe329bff0 ("dyndbg: accept 'file foo.c:func1' and 'file foo.c:10-100'") because a file name without a ':' now makes the loop in ddebug_parse_query() exits early before parsing the 'line 1234' part. As a result, all pr_debug() in tcp_input.c will be enabled, instead of only the one on line 1234. Changing 'break' to 'continue' fixes this.
--- lib/dynamic_debug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/dynamic_debug.c +1 -1
@@ -396,7 +396,7 @@ static int ddebug_parse_query(char *word/* tail :$info is function or line-range */ fline =strchr (query->filename,':' );if (!fline) -break ; +continue ; *fline++ ='\0' ;if (isalpha (*fline) || *fline =='*' || *fline =='?' ) {/* take as function name */
Greg Kroah-Hartman
maintainerPATCH 8/342 s390/disassembler: increase ebpf disasm buffer size
In reply to Greg Kroah-HartmanFrom: Vasily Gorbik <[email protected]>
commit 6f3353c2d2b3eb4de52e9704cb962712033db181 upstream.
Current ebpf disassembly buffer size of 64 is too small. E.g. this line takes 65 bytes:01fffff8005822e: ec8100ed8065\tclgrj\t%r8,%r1,8,001fffff80058408\n\0
Double the buffer size like it is done for the kernel disassembly buffer.
Fixes the following KASAN finding:
UG: KASAN: stack-out-of-bounds in print_fn_code+0x34c/0x380
Write of size 1 at addr 001fff800ad5f970 by task test_progs/853
CPU: 53 PID: 853 Comm: test_progs Not tainted
5.12.0-rc7-23786-g23457d86b1f0-dirty #19
Hardware name: IBM 3906 M04 704 (LPAR)
Call Trace:
[<0000000cd8e0538a>] show_stack+0x17a/0x1668
[<0000000cd8e2a5d8>] dump_stack+0x140/0x1b8
[<0000000cd8e16e74>] print_address_description.constprop.0+0x54/0x260
[<0000000cd75a8698>] kasan_report+0xc8/0x130
[<0000000cd6e26da4>] print_fn_code+0x34c/0x380
[<0000000cd6ea0f4e>] bpf_int_jit_compile+0xe3e/0xe58
[<0000000cd72c4c88>] bpf_prog_select_runtime+0x5b8/0x9c0
[<0000000cd72d1bf8>] bpf_prog_load+0xa78/0x19c0
[<0000000cd72d7ad6>] __do_sys_bpf.part.0+0x18e/0x768
[<0000000cd6e0f392>] do_syscall+0x12a/0x220
[<0000000cd8e333f8>] __do_syscall+0x98/0xc8
[<0000000cd8e54834>] system_call+0x6c/0x94
1 lock held by test_progs/853:
#0: 0000000cd9bf7460 (report_lock){....}-{2:2}, at:
kasan_report+0x96/0x130addr 001fff800ad5f970 is located in stack of task test_progs/853 at offset 96 in frame:
print_fn_code+0x0/0x380
this frame has 1 object:
[32, 96) 'buffer'
Memory state around the buggy address:
001fff800ad5f800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001fff800ad5f880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>001fff800ad5f900: 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 f3 f3
^
001fff800ad5f980: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001fff800ad5fa00: 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00--- arch/s390/kernel/dis.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/kernel/dis.c +1 -1
@@ -563,7 +563,7 @@ void show_code(struct pt_regs *regs)void print_fn_code (unsigned char *code,unsigned long len) { -char buffer[64 ], *ptr; +char buffer[128 ], *ptr;int opsize, i;while (len) {
Greg Kroah-Hartman
maintainerPATCH 9/342 s390/zcrypt: fix zcard and zqueue hot-unplug memleak
In reply to Greg Kroah-HartmanFrom: Harald Freudenberger <[email protected]>
commit 70fac8088cfad9f3b379c9082832b4d7532c16c2 upstream.
Tests with kvm and a kmemdebug kernel showed, that on hot unplug the zcard and zqueue structs for the unplugged card or queue are not properly freed because of a mismatch with get/put for the embedded kref counter.
This fix now adjusts the handling of the kref counters. With init the kref counter starts with 1. This initial value needs to drop to zero with the unregister of the card or queue to trigger the release and free the object.
--- drivers/s390/crypto/zcrypt_card.c | 1 + drivers/s390/crypto/zcrypt_queue.c | 1 + 2 files changed, 2 insertions(+)
drivers/s390/crypto/zcrypt_card.c +1 -0
@@ -192,5 +192,6 @@ void zcrypt_card_unregister(struct zcrypspin_unlock (&zcrypt_list_lock);sysfs_remove_group (&zc->card->ap_dev.device.kobj, &zcrypt_card_attr_group); +zcrypt_card_put (zc); }EXPORT_SYMBOL (zcrypt_card_unregister);
drivers/s390/crypto/zcrypt_queue.c +1 -0
@@ -223,5 +223,6 @@ void zcrypt_queue_unregister(struct zcrysysfs_remove_group (&zq->queue->ap_dev.device.kobj, &zcrypt_queue_attr_group);zcrypt_card_put (zc); +zcrypt_queue_put (zq); }EXPORT_SYMBOL (zcrypt_queue_unregister);
Greg Kroah-Hartman
maintainerPATCH 10/342 s390/vfio-ap: fix circular lockdep when setting/clearing crypto masks
In reply to Greg Kroah-HartmanFrom: Tony Krowiak <[email protected]>
commit 0cc00c8d40500c4c8fe058dc014bdaf44a82f4f7 upstream.
This patch fixes a lockdep splat introduced by commit f21916ec4826 ("s390/vfio-ap: clean up vfio_ap resources when KVM pointer invalidated"). The lockdep splat only occurs when starting a Secure Execution guest. Crypto virtualization (vfio_ap) is not yet supported for SE guests; however, in order to avoid this problem when support becomes available, this fix is being provided.
The circular locking dependency was introduced when the setting of the masks in the guest's APCB was executed while holding the matrix_dev->lock. While the lock is definitely needed to protect the setting/unsetting of the matrix_mdev->kvm pointer, it is not necessarily critical for setting the masks; so, the matrix_dev->lock will be released while the masks are being set or cleared.
Keep in mind, however, that another process that takes the matrix_dev->lock can get control while the masks in the guest's APCB are being set or cleared as a result of the driver being notified that the KVM pointer has been set or unset. This could result in invalid access to the matrix_mdev->kvm pointer by the intervening process. To avoid this scenario, two new fields are being added to the ap_matrix_mdev struct:
struct ap_matrix_mdev {
...
bool kvm_busy;
wait_queue_head_t wait_for_kvm; ...
};
The functions that handle notification that the KVM pointer value has been set or cleared will set the kvm_busy flag to true until they are done processing at which time they will set it to false and wake up the tasks on the matrix_mdev->wait_for_kvm wait queue. Functions that require access to matrix_mdev->kvm will sleep on the wait queue until they are awakened at which time they can safely access the matrix_mdev->kvm field.
--- drivers/s390/crypto/vfio_ap_ops.c | 308 +++++++++++++++++++++++----------- drivers/s390/crypto/vfio_ap_private.h | 2 2 files changed, 215 insertions(+), 95 deletions(-)
drivers/s390/crypto/vfio_ap_ops.c +213 -95
@@ -294,6 +294,19 @@ static int handle_pqap(struct kvm_vcpu * matrix_mdev =container_of (vcpu->kvm->arch.crypto.pqap_hook, struct ap_matrix_mdev, pqap_hook); +/* +* If the KVM pointer is in the process of being set, wait until the +* process has completed. +*/ +wait_event_cmd (matrix_mdev->wait_for_kvm, + !matrix_mdev->kvm_busy, +mutex_unlock (&matrix_dev->lock), +mutex_lock (&matrix_dev->lock)); + +/* If the there is no guest using the mdev, there is nothing to do */ +if (!matrix_mdev->kvm) + goto out_unlock; + q =vfio_ap_get_queue (matrix_mdev, apqn);if (!q) goto out_unlock;
@@ -337,6 +350,7 @@ static int vfio_ap_mdev_create(struct ko matrix_mdev->mdev = mdev;vfio_ap_matrix_init (&matrix_dev->info, &matrix_mdev->matrix); +init_waitqueue_head (&matrix_mdev->wait_for_kvm);mdev_set_drvdata (mdev, matrix_mdev); matrix_mdev->pqap_hook.hook = handle_pqap; matrix_mdev->pqap_hook.owner =THIS_MODULE ;
@@ -351,17 +365,23 @@ static int vfio_ap_mdev_remove(struct md {struct ap_matrix_mdev *matrix_mdev =mdev_get_drvdata (mdev); -if (matrix_mdev->kvm) +mutex_lock (&matrix_dev->lock); + +/* +* If the KVM pointer is in flux or the guest is running, disallow +* un-assignment of control domain. +*/ +if (matrix_mdev->kvm_busy || matrix_mdev->kvm) { +mutex_unlock (&matrix_dev->lock);return -EBUSY ; + } -mutex_lock (&matrix_dev->lock);vfio_ap_mdev_reset_queues (mdev);list_del (&matrix_mdev->node); -mutex_unlock (&matrix_dev->lock); -kfree (matrix_mdev);mdev_set_drvdata (mdev,NULL );atomic_inc (&matrix_dev->available_instances); +mutex_unlock (&matrix_dev->lock);return 0 ; }
@@ -606,24 +626,31 @@ static ssize_t assign_adapter_store(strustruct mdev_device *mdev =mdev_from_dev (dev);struct ap_matrix_mdev *matrix_mdev =mdev_get_drvdata (mdev); -/* If the guest is running, disallow assignment of adapter */ -if (matrix_mdev->kvm) -return -EBUSY ; +mutex_lock (&matrix_dev->lock); + +/* +* If the KVM pointer is in flux or the guest is running, disallow +* un-assignment of adapter +*/ +if (matrix_mdev->kvm_busy || matrix_mdev->kvm) { + ret = -EBUSY ; + goto done; + } ret =kstrtoul (buf,0 , &apid);if (ret) -return ret; + goto done; -if (apid > matrix_mdev->matrix.apm_max) -return -ENODEV ; +if (apid > matrix_mdev->matrix.apm_max) { + ret = -ENODEV ; + goto done; + }/* * Set the bit in the AP mask (APM) corresponding to the AP adapter * number (APID). The bits in the mask, from most significant to least * significant bit, correspond to APIDs 0-255. */ -mutex_lock (&matrix_dev->lock); - ret =vfio_ap_mdev_verify_queues_reserved_for_apid (matrix_mdev, apid);if (ret) goto done;
@@ -672,22 +699,31 @@ static ssize_t unassign_adapter_store(ststruct mdev_device *mdev =mdev_from_dev (dev);struct ap_matrix_mdev *matrix_mdev =mdev_get_drvdata (mdev); -/* If the guest is running, disallow un-assignment of adapter */ -if (matrix_mdev->kvm) -return -EBUSY ; +mutex_lock (&matrix_dev->lock); + +/* +* If the KVM pointer is in flux or the guest is running, disallow +* un-assignment of adapter +*/ +if (matrix_mdev->kvm_busy || matrix_mdev->kvm) { + ret = -EBUSY ; + goto done; + } ret =kstrtoul (buf,0 , &apid);if (ret) -return ret; + goto done; -if (apid > matrix_mdev->matrix.apm_max) -return -ENODEV ; +if (apid > matrix_mdev->matrix.apm_max) { + ret = -ENODEV ; + goto done; + } -mutex_lock (&matrix_dev->lock);clear_bit_inv ((unsigned long )apid, matrix_mdev->matrix.apm); + ret = count; +done:mutex_unlock (&matrix_dev->lock); - -return count; +return ret; }static DEVICE_ATTR_WO (unassign_adapter);
@@ -753,17 +789,24 @@ static ssize_t assign_domain_store(strucstruct ap_matrix_mdev *matrix_mdev =mdev_get_drvdata (mdev);unsigned long max_apqi = matrix_mdev->matrix.aqm_max; -/* If the guest is running, disallow assignment of domain */ -if (matrix_mdev->kvm) -return -EBUSY ; +mutex_lock (&matrix_dev->lock); + +/* +* If the KVM pointer is in flux or the guest is running, disallow +* assignment of domain +*/ +if (matrix_mdev->kvm_busy || matrix_mdev->kvm) { + ret = -EBUSY ; + goto done; + } ret =kstrtoul (buf,0 , &apqi);if (ret) -return ret; -if (apqi > max_apqi) -return -ENODEV ; - -mutex_lock (&matrix_dev->lock); + goto done; +if (apqi > max_apqi) { + ret = -ENODEV ; + goto done; + } ret =vfio_ap_mdev_verify_queues_reserved_for_apqi (matrix_mdev, apqi);if (ret)
@@ -814,22 +857,32 @@ static ssize_t unassign_domain_store(strstruct mdev_device *mdev =mdev_from_dev (dev);struct ap_matrix_mdev *matrix_mdev =mdev_get_drvdata (mdev); -/* If the guest is running, disallow un-assignment of domain */ -if (matrix_mdev->kvm) -return -EBUSY ; +mutex_lock (&matrix_dev->lock); + +/* +* If the KVM pointer is in flux or the guest is running, disallow +* un-assignment of domain +*/ +if (matrix_mdev->kvm_busy || matrix_mdev->kvm) { + ret = -EBUSY ; + goto done; + } ret =kstrtoul (buf,0 , &apqi);if (ret) -return ret; + goto done; -if (apqi > matrix_mdev->matrix.aqm_max) -return -ENODEV ; +if (apqi > matrix_mdev->matrix.aqm_max) { + ret = -ENODEV ; + goto done; + } -mutex_lock (&matrix_dev->lock);clear_bit_inv ((unsigned long )apqi, matrix_mdev->matrix.aqm); -mutex_unlock (&matrix_dev->lock); + ret = count; -return count; +done: +mutex_unlock (&matrix_dev->lock); +return ret; }static DEVICE_ATTR_WO (unassign_domain);
@@ -858,27 +911,36 @@ static ssize_t assign_control_domain_stostruct mdev_device *mdev =mdev_from_dev (dev);struct ap_matrix_mdev *matrix_mdev =mdev_get_drvdata (mdev); -/* If the guest is running, disallow assignment of control domain */ -if (matrix_mdev->kvm) -return -EBUSY ; +mutex_lock (&matrix_dev->lock); + +/* +* If the KVM pointer is in flux or the guest is running, disallow +* assignment of control domain. +*/ +if (matrix_mdev->kvm_busy || matrix_mdev->kvm) { + ret = -EBUSY ; + goto done; + } ret =kstrtoul (buf,0 , &id);if (ret) -return ret; + goto done; -if (id > matrix_mdev->matrix.adm_max) -return -ENODEV ; +if (id > matrix_mdev->matrix.adm_max) { + ret = -ENODEV ; + goto done; + }/* Set the bit in the ADM (bitmask) corresponding to the AP control * domain number (id). The bits in the mask, from most significant to * least significant, correspond to IDs 0 up to the one less than the * number of control domains that can be assigned. */ -mutex_lock (&matrix_dev->lock);set_bit_inv (id, matrix_mdev->matrix.adm); + ret = count; +done:mutex_unlock (&matrix_dev->lock); - -return count; +return ret; }static DEVICE_ATTR_WO (assign_control_domain);
@@ -908,21 +970,30 @@ static ssize_t unassign_control_domain_sstruct ap_matrix_mdev *matrix_mdev =mdev_get_drvdata (mdev);unsigned long max_domid = matrix_mdev->matrix.adm_max; -/* If the guest is running, disallow un-assignment of control domain */ -if (matrix_mdev->kvm) -return -EBUSY ; +mutex_lock (&matrix_dev->lock); + +/* +* If the KVM pointer is in flux or the guest is running, disallow +* un-assignment of control domain. +*/ +if (matrix_mdev->kvm_busy || matrix_mdev->kvm) { + ret = -EBUSY ; + goto done; + } ret =kstrtoul (buf,0 , &domid);if (ret) -return ret; -if (domid > max_domid) -return -ENODEV ; + goto done; +if (domid > max_domid) { + ret = -ENODEV ; + goto done; + } -mutex_lock (&matrix_dev->lock);clear_bit_inv (domid, matrix_mdev->matrix.adm); + ret = count; +done:mutex_unlock (&matrix_dev->lock); - -return count; +return ret; }static DEVICE_ATTR_WO (unassign_control_domain);
@@ -1027,8 +1098,15 @@ static const struct attribute_group *vfi* @matrix_mdev: a mediated matrix device * @kvm: reference to KVM instance * -* Verifies no other mediated matrix device has @kvm and sets a reference to -* it in @matrix_mdev->kvm. +* Sets all data for @matrix_mdev that are needed to manage AP resources +* for the guest whose state is represented by @kvm. +* +* Note: The matrix_dev->lock must be taken prior to calling +* this function; however, the lock will be temporarily released while the +* guest's AP configuration is set to avoid a potential lockdep splat. +* The kvm->lock is taken to set the guest's AP configuration which, under +* certain circumstances, will result in a circular lock dependency if this is +* done under the @matrix_mdev->lock. * * Return 0 if no other mediated matrix device has a reference to @kvm; * otherwise, returns an -EPERM.
@@ -1038,14 +1116,25 @@ static int vfio_ap_mdev_set_kvm(struct a {struct ap_matrix_mdev *m; -list_for_each_entry (m, &matrix_dev->mdev_list, node) { -if ((m != matrix_mdev) && (m->kvm == kvm)) -return -EPERM ; - } +if (kvm->arch.crypto.crycbd) { +list_for_each_entry (m, &matrix_dev->mdev_list, node) { +if (m != matrix_mdev && m->kvm == kvm) +return -EPERM ; + } - matrix_mdev->kvm = kvm; -kvm_get_kvm (kvm); - kvm->arch.crypto.pqap_hook = &matrix_mdev->pqap_hook; +kvm_get_kvm (kvm); + matrix_mdev->kvm_busy = true; +mutex_unlock (&matrix_dev->lock); +kvm_arch_crypto_set_masks (kvm, + matrix_mdev->matrix.apm, + matrix_mdev->matrix.aqm, + matrix_mdev->matrix.adm); +mutex_lock (&matrix_dev->lock); + kvm->arch.crypto.pqap_hook = &matrix_mdev->pqap_hook; + matrix_mdev->kvm = kvm; + matrix_mdev->kvm_busy = false; +wake_up_all (&matrix_mdev->wait_for_kvm); + }return 0 ; }
@@ -1079,51 +1168,65 @@ static int vfio_ap_mdev_iommu_notifier(sreturn NOTIFY_DONE ; } +/** +* vfio_ap_mdev_unset_kvm +* +* @matrix_mdev: a matrix mediated device +* +* Performs clean-up of resources no longer needed by @matrix_mdev. +* +* Note: The matrix_dev->lock must be taken prior to calling +* this function; however, the lock will be temporarily released while the +* guest's AP configuration is cleared to avoid a potential lockdep splat. +* The kvm->lock is taken to clear the guest's AP configuration which, under +* certain circumstances, will result in a circular lock dependency if this is +* done under the @matrix_mdev->lock. +* +*/ static void vfio_ap_mdev_unset_kvm (struct ap_matrix_mdev *matrix_mdev) { -kvm_arch_crypto_clear_masks (matrix_mdev->kvm); - matrix_mdev->kvm->arch.crypto.pqap_hook =NULL ; -vfio_ap_mdev_reset_queues (matrix_mdev->mdev); -kvm_put_kvm (matrix_mdev->kvm); - matrix_mdev->kvm =NULL ; +/* +* If the KVM pointer is in the process of being set, wait until the +* process has completed. +*/ +wait_event_cmd (matrix_mdev->wait_for_kvm, + !matrix_mdev->kvm_busy, +mutex_unlock (&matrix_dev->lock), +mutex_lock (&matrix_dev->lock)); + +if (matrix_mdev->kvm) { + matrix_mdev->kvm_busy = true; +mutex_unlock (&matrix_dev->lock); +kvm_arch_crypto_clear_masks (matrix_mdev->kvm); +mutex_lock (&matrix_dev->lock); +vfio_ap_mdev_reset_queues (matrix_mdev->mdev); + matrix_mdev->kvm->arch.crypto.pqap_hook =NULL ; +kvm_put_kvm (matrix_mdev->kvm); + matrix_mdev->kvm =NULL ; + matrix_mdev->kvm_busy = false; +wake_up_all (&matrix_mdev->wait_for_kvm); + } }static int vfio_ap_mdev_group_notifier (struct notifier_block *nb,unsigned long action,void *data) { -int ret, notify_rc =NOTIFY_OK ; +int notify_rc =NOTIFY_OK ;struct ap_matrix_mdev *matrix_mdev;if (action !=VFIO_GROUP_NOTIFY_SET_KVM )return NOTIFY_OK ; - matrix_mdev = container_of(nb, struct ap_matrix_mdev, group_notifier);mutex_lock (&matrix_dev->lock); + matrix_mdev = container_of(nb, struct ap_matrix_mdev, group_notifier); -if (!data) { -if (matrix_mdev->kvm) -vfio_ap_mdev_unset_kvm (matrix_mdev); - goto notify_done; - } - - ret =vfio_ap_mdev_set_kvm (matrix_mdev, data); -if (ret) { - notify_rc =NOTIFY_DONE ; - goto notify_done; - } - -/* If there is no CRYCB pointer, then we can't copy the masks */ -if (!matrix_mdev->kvm->arch.crypto.crycbd) { +if (!data) +vfio_ap_mdev_unset_kvm (matrix_mdev); +else if (vfio_ap_mdev_set_kvm (matrix_mdev, data)) notify_rc =NOTIFY_DONE ; - goto notify_done; - } - -kvm_arch_crypto_set_masks (matrix_mdev->kvm, matrix_mdev->matrix.apm, - matrix_mdev->matrix.aqm, - matrix_mdev->matrix.adm); -notify_done:mutex_unlock (&matrix_dev->lock); +return notify_rc; }
@@ -1258,8 +1361,7 @@ static void vfio_ap_mdev_release(structstruct ap_matrix_mdev *matrix_mdev =mdev_get_drvdata (mdev);mutex_lock (&matrix_dev->lock); -if (matrix_mdev->kvm) -vfio_ap_mdev_unset_kvm (matrix_mdev); +vfio_ap_mdev_unset_kvm (matrix_mdev);mutex_unlock (&matrix_dev->lock); vfio_unregister_notifier(mdev_dev(mdev), VFIO_IOMMU_NOTIFY,
@@ -1293,6 +1395,7 @@ static ssize_t vfio_ap_mdev_ioctl(struct unsigned int cmd, unsigned long arg) { int ret; +struct ap_matrix_mdev *matrix_mdev;mutex_lock (&matrix_dev->lock);switch (cmd) {
@@ -1300,6 +1403,21 @@ static ssize_t vfio_ap_mdev_ioctl(struct ret =vfio_ap_mdev_get_device_info (arg);break ;case VFIO_DEVICE_RESET : + matrix_mdev =mdev_get_drvdata (mdev); +if (WARN (!matrix_mdev,"Driver data missing from mdev!!" )) { + ret = -EINVAL ; +break ; + } + +/* +* If the KVM pointer is in the process of being set, wait until +* the process has completed. +*/ +wait_event_cmd (matrix_mdev->wait_for_kvm, + !matrix_mdev->kvm_busy, +mutex_unlock (&matrix_dev->lock), +mutex_lock (&matrix_dev->lock)); + ret =vfio_ap_mdev_reset_queues (mdev);break ;default :
drivers/s390/crypto/vfio_ap_private.h +2 -0
@@ -83,6 +83,8 @@ struct ap_matrix_mdev {struct ap_matrix matrix;struct notifier_block group_notifier;struct notifier_block iommu_notifier; +bool kvm_busy; +wait_queue_head_t wait_for_kvm;struct kvm *kvm;struct kvm_s390_module_hook pqap_hook;struct mdev_device *mdev;
Greg Kroah-Hartman
maintainerPATCH 11/342 s390/cio: remove invalid condition on IO_SCH_UNREG
In reply to Greg Kroah-HartmanFrom: Vineeth Vijayan <[email protected]>
commit 2f7484fd73729f89085fe08d683f5a8d9e17fe99 upstream.
The condition to check the cdev pointer validity on css_sch_device_unregister() is a leftover from the 'commit 8cc0dcfdc1c0 ("s390/cio: remove pm support from ccw bus driver")'. This could lead to a situation, where detaching the device is not happening completely. Remove this invalid condition in the IO_SCH_UNREG case.
--- drivers/s390/cio/device.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/s390/cio/device.c +1 -2
@@ -1525,8 +1525,7 @@ static int io_subchannel_sch_event(strucswitch (action) {case IO_SCH_ORPH_UNREG :case IO_SCH_UNREG : -if (!cdev) -css_sch_device_unregister (sch); +css_sch_device_unregister (sch);break ;case IO_SCH_ORPH_ATTACH :case IO_SCH_UNREG_ATTACH :
Greg Kroah-Hartman
maintainerPATCH 12/342 vhost-vdpa: fix vm_flags for virtqueue doorbell mapping
In reply to Greg Kroah-HartmanFrom: Jason Wang <[email protected]>
commit 3a3e0fad16d40a2aa68ddf7eea4acdf48b22dd44 upstream.
The virtqueue doorbell is usually implemented via registeres but we don't provide the necessary vma->flags like VM_PFNMAP. This may cause several issues e.g when userspace tries to map the doorbell via vhost IOTLB, kernel may panic due to the page is not backed by page structure. This patch fixes this by setting the necessary vm_flags. With this patch, try to map doorbell via IOTLB will fail with bad address.
--- drivers/vhost/vdpa.c | 1 + 1 file changed, 1 insertion(+)
drivers/vhost/vdpa.c +1 -0
@@ -993,6 +993,7 @@ static int vhost_vdpa_mmap(struct file *if (vma->vm_end - vma->vm_start != notify.size)return -ENOTSUPP ; + vma->vm_flags |=VM_IO |VM_PFNMAP |VM_DONTEXPAND |VM_DONTDUMP ; vma->vm_ops = &vhost_vdpa_vm_ops;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 13/342 tpm: acpi: Check eventlog signature before using it
In reply to Greg Kroah-HartmanFrom: Stefan Berger <[email protected]>
commit 3dcd15665aca80197333500a4be3900948afccc1 upstream.
Check the eventlog signature before using it. This avoids using an empty log, as may be the case when QEMU created the ACPI tables, rather than probing the EFI log next. This resolves an issue where the EFI log was empty since an empty ACPI log was used.
--- drivers/char/tpm/eventlog/acpi.c | 33 ++++++++++++++++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-)
drivers/char/tpm/eventlog/acpi.c +32 -1
@@ -41,6 +41,27 @@ struct acpi_tcpa { }; }; +/* Check that the given log is indeed a TPM2 log. */ +static bool tpm_is_tpm2_log (void *bios_event_log,u64 len) +{ +struct tcg_efi_specid_event_head *efispecid; +struct tcg_pcr_event *event_header; +int n; + +if (len <sizeof (*event_header)) +return false; + len -=sizeof (*event_header); + event_header = bios_event_log; + +if (len <sizeof (*efispecid)) +return false; + efispecid = (struct tcg_efi_specid_event_head *)event_header->event; + + n =memcmp (efispecid->signature,TCG_SPECID_SIG , +sizeof (TCG_SPECID_SIG )); +return n ==0 ; +} +/* read binary bios log */ int tpm_read_log_acpi (struct tpm_chip *chip) {
@@ -52,6 +73,7 @@ int tpm_read_log_acpi(struct tpm_chip *cstruct acpi_table_tpm2 *tbl;struct acpi_tpm2_phy *tpm2_phy;int format; +int ret; log = &chip->log;
@@ -112,6 +134,7 @@ int tpm_read_log_acpi(struct tpm_chip *c log->bios_event_log_end = log->bios_event_log + len; + ret = -EIO ; virt =acpi_os_map_iomem (start, len);if (!virt) goto err;
@@ -119,11 +142,19 @@ int tpm_read_log_acpi(struct tpm_chip *cmemcpy_fromio (log->bios_event_log, virt, len);acpi_os_unmap_iomem (virt, len); + +if (chip->flags &TPM_CHIP_FLAG_TPM2 && + !tpm_is_tpm2_log (log->bios_event_log, len)) { +/* try EFI log next */ + ret = -ENODEV ; + goto err; + } +return format; err:kfree (log->bios_event_log); log->bios_event_log =NULL ; -return -EIO ; +return ret; }
Greg Kroah-Hartman
maintainerPATCH 14/342 ACPI: custom_method: fix potential use-after-free issue
In reply to Greg Kroah-HartmanFrom: Mark Langsdorf <[email protected]>
commit e483bb9a991bdae29a0caa4b3a6d002c968f94aa upstream.
In cm_write(), buf is always freed when reaching the end of the function. If the requested count is less than table.length, the allocated buffer will be freed but subsequent calls to cm_write() will still try to access it.
Remove the unconditional kfree(buf) at the end of the function and set the buf to NULL in the -EINVAL error path to match the rest of function.
--- drivers/acpi/custom_method.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/custom_method.c +1 -1
@@ -55,6 +55,7 @@ static ssize_t cm_write(struct file *fil (*ppos + count < count) || (count > uncopied_bytes)) {kfree (buf); + buf =NULL ;return -EINVAL ; }
@@ -76,7 +77,6 @@ static ssize_t cm_write(struct file *filadd_taint (TAINT_OVERRIDDEN_ACPI_TABLE ,LOCKDEP_NOW_UNRELIABLE ); } -kfree (buf);return count; }
Greg Kroah-Hartman
maintainerPATCH 15/342 ACPI: custom_method: fix a possible memory leak
In reply to Greg Kroah-HartmanFrom: Mark Langsdorf <[email protected]>
commit 1cfd8956437f842836e8a066b40d1ec2fc01f13e upstream.
In cm_write(), if the 'buf' is allocated memory but not fully consumed, it is possible to reallocate the buffer without freeing it by passing '*ppos' as 0 on a subsequent call.
Add an explicit kfree() before kzalloc() to prevent the possible memory leak.
--- drivers/acpi/custom_method.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/acpi/custom_method.c +2 -0
@@ -42,6 +42,8 @@ static ssize_t cm_write(struct file *fil sizeof(struct acpi_table_header)))return -EFAULT ; uncopied_bytes = max_size = table.length; +/* make sure the buf is not allocated */ +kfree (buf); buf =kzalloc (max_size,GFP_KERNEL );if (!buf)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 16/342 ftrace: Handle commands when closing set_ftrace_filter file
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
commit 8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 upstream.
# echo switch_mm:traceoff > /sys/kernel/tracing/set_ftrace_filter
will cause switch_mm to stop tracing by the traceoff command.
# echo -n switch_mm:traceoff > /sys/kernel/tracing/set_ftrace_filter
does nothing.
The reason is that the parsing in the write function only processes commands if it finished parsing (there is white space written after the command). That's to handle:
write(fd, "switch_mm:", 10);
write(fd, "traceoff", 8);
cases, where the command is broken over multiple writes.
The problem is if the file descriptor is closed, then the write call is not processed, and the command needs to be processed in the release code. The release code can handle matching of functions, but does not handle commands.
--- kernel/trace/ftrace.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/trace/ftrace.c +4 -1
@@ -5631,7 +5631,10 @@ int ftrace_regex_release(struct inode *i parser = &iter->parser;if (trace_parser_loaded (parser)) { -ftrace_match_records (iter->hash, parser->buffer, parser->idx); +int enable = !(iter->flags &FTRACE_ITER_NOTRACE ); + +ftrace_process_regex (iter, parser->buffer, + parser->idx, enable); }trace_parser_put (parser);
Greg Kroah-Hartman
maintainerPATCH 17/342 ARM: 9056/1: decompressor: fix BSS size calculation for LLVM ld.lld
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
commit c4e792d1acce31c2eb7b9193ab06ab94de05bf42 upstream.
The LLVM ld.lld linker uses a different symbol type for __bss_start, resulting in the calculation of KBSS_SZ to be thrown off. Up until now, this has gone unnoticed as it only affects the appended DTB case, but pending changes for ARM in the way the decompressed kernel is cleaned from the caches has uncovered this problem.
On a ld.lld build:
$ nm vmlinux |grep bss_ c1c22034 D __bss_start c1c86e98 B __bss_stop
resulting in
$ readelf -s arch/arm/boot/compressed/vmlinux | grep bss_size 433: c1c86e98 0 NOTYPE GLOBAL DEFAULT ABS _kernel_bss_size
which is obviously incorrect, and may cause the cache clean to access unmapped memory, or cause the size calculation to wrap, resulting in no cache clean to be performed at all.
Fix this by updating the sed regex to take D type symbols into account.
--- arch/arm/boot/compressed/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/compressed/Makefile +2 -2
@@ -115,8 +115,8 @@ asflags-y := -DZIMAGE # Supply kernel BSS size to the decompressor via a linker symbol. KBSS_SZ = $(shell echo $$(($$($(NM) $(obj)/../../../../vmlinux | \ - sed -n -e 's/^\([^ ]*\) [AB] __bss_start$$/-0x\1/p' \ - -e 's/^\([^ ]*\) [AB] __bss_stop$$/+0x\1/p') )) ) + sed -n -e 's/^\([^ ]*\) [ABD] __bss_start$$/-0x\1/p' \ + -e 's/^\([^ ]*\) [ABD] __bss_stop$$/+0x\1/p') )) ) LDFLAGS_vmlinux = --defsym _kernel_bss_size=$(KBSS_SZ) # Supply ZRELADDR to the decompressor via a linker symbol. ifneq ($(CONFIG_AUTO_ZRELADDR),y)
Greg Kroah-Hartman
maintainerPATCH 18/342 arm64: dts: marvell: armada-37xx: add syscon compatible to NB clk node
In reply to Greg Kroah-HartmanFrom: Marek Behún <[email protected]>
commit 1d88358a89dbac9c7d4559548b9a44840456e6fb upstream.
Add "syscon" compatible to the North Bridge clocks node to allow the cpufreq driver to access these registers via syscon API.
This is needed for a fix of cpufreq driver.
--- arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm64/boot/dts/marvell/armada-37xx.dtsi +2 -1
@@ -156,7 +156,8 @@ }; nb_periph_clk: nb-periph-clk@13000 { - compatible = "marvell,armada-3700-periph-clock-nb"; + compatible = "marvell,armada-3700-periph-clock-nb", + "syscon"; reg = <0x13000 0x100>; clocks = <&tbg 0>, <&tbg 1>, <&tbg 2>, <&tbg 3>, <&xtalclk>;
Greg Kroah-Hartman
maintainerPATCH 19/342 arm64: dts: mt8173: fix property typo of phys in dsi node
In reply to Greg Kroah-HartmanFrom: Chunfeng Yun <[email protected]>
commit e4e5d030bd779fb8321d3b8bd65406fbe0827037 upstream.
Use 'phys' instead of 'phy'.
--- arch/arm64/boot/dts/mediatek/mt8173.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt8173.dtsi +1 -1
@@ -1235,7 +1235,7 @@ <&mmsys CLK_MM_DSI1_DIGITAL>, <&mipi_tx1>; clock-names = "engine", "digital", "hs"; - phy = <&mipi_tx1>; + phys = <&mipi_tx1>; phy-names = "dphy"; status = "disabled"; };
Greg Kroah-Hartman
maintainerPATCH 20/342 ecryptfs: fix kernel panic with null dev_name
In reply to Greg Kroah-HartmanFrom: Jeffrey Mitchell <[email protected]>
commit 9046625511ad8dfbc8c6c2de16b3532c43d68d48 upstream.
When mounting eCryptfs, a null "dev_name" argument to ecryptfs_mount() causes a kernel panic if the parsed options are valid. The easiest way to reproduce this is to call mount() from userspace with an existing eCryptfs mount's options and a "source" argument of 0.
Error out if "dev_name" is null in ecryptfs_mount()
--- fs/ecryptfs/main.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ecryptfs/main.c +6 -0
@@ -492,6 +492,12 @@ static struct dentry *ecryptfs_mount(str goto out; } +if (!dev_name) { + rc = -EINVAL ; + err ="Device name cannot be null" ; + goto out; + } + rc =ecryptfs_parse_options (sbi, raw_data, &check_ruid);if (rc) { err ="Error parsing options" ;
Greg Kroah-Hartman
maintainerPATCH 21/342 fs/epoll: restore waking from ep_done_scan()
In reply to Greg Kroah-HartmanFrom: Davidlohr Bueso <[email protected]>
commit 7fab29e356309ff93a4b30ecc466129682ec190b upstream.
Commit 339ddb53d373 ("fs/epoll: remove unnecessary wakeups of nested epoll") changed the userspace visible behavior of exclusive waiters blocked on a common epoll descriptor upon a single event becoming ready.
Previously, all tasks doing epoll_wait would awake, and now only one is awoken, potentially causing missed wakeups on applications that rely on this behavior, such as Apache Qpid.
While the aforementioned commit aims at having only a wakeup single path in ep_poll_callback (with the exceptions of epoll_ctl cases), we need to restore the wakeup in what was the old ep_scan_ready_list() such that the next thread can be awoken, in a cascading style, after the waker's corresponding ep_send_events().
--- fs/eventpoll.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/eventpoll.c +6 -0
@@ -657,6 +657,12 @@ static void ep_done_scan(struct eventpol*/ list_splice (txlist, &ep->rdllist);__pm_relax (ep->ws); + +if (!list_empty (&ep->rdllist)) { +if (waitqueue_active (&ep->wq)) +wake_up (&ep->wq); + } +write_unlock_irq (&ep->lock); }
Greg Kroah-Hartman
maintainerPATCH 22/342 reset: add missing empty function reset_control_rearm()
In reply to Greg Kroah-HartmanFrom: Jim Quinlan <[email protected]>
commit 48582b2e3b87b794a9845d488af2c76ce055502b upstream.
All other functions are defined for when CONFIG_RESET_CONTROLLER is not set.
--- include/linux/reset.h | 5 +++++ 1 file changed, 5 insertions(+)
include/linux/reset.h +5 -0
@@ -47,6 +47,11 @@ static inline int reset_control_reset(streturn 0 ; } +static inline int reset_control_rearm (struct reset_control *rstc) +{ +return 0 ; +} +static inline int reset_control_assert (struct reset_control *rstc) {return 0 ;
Greg Kroah-Hartman
maintainerPATCH 23/342 mtd: spi-nor: core: Fix an issue of releasing resources during read/write
In reply to Greg Kroah-HartmanFrom: Xiang Chen <[email protected]>
commit be94215be1ab19e5d38f50962f611c88d4bfc83a upstream.
If rmmod the driver during read or write, the driver will release the resources which are used during read or write, so it is possible to refer to NULL pointer.
Use the testcase "mtd_debug read /dev/mtd0 0xc00000 0x400000 dest_file & sleep 0.5;rmmod spi_hisi_sfc_v3xx.ko", the issue can be reproduced in hisi_sfc_v3xx driver.
To avoid the issue, fill the interface _get_device and _put_device of mtd_info to grab the reference to the spi controller driver module, so the request of rmmod the driver is rejected before read/write is finished.
--- drivers/mtd/spi-nor/core.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+)
drivers/mtd/spi-nor/core.c +33 -0
@@ -3264,6 +3264,37 @@ static void spi_nor_resume(struct mtd_indev_err (dev,"resume() failed\n" ); } +static int spi_nor_get_device (struct mtd_info *mtd) +{ +struct mtd_info *master =mtd_get_master (mtd); +struct spi_nor *nor =mtd_to_spi_nor (master); +struct device *dev; + +if (nor->spimem) + dev = nor->spimem->spi->controller->dev.parent; +else + dev = nor->dev; + +if (!try_module_get (dev->driver->owner)) +return -ENODEV ; + +return 0 ; +} + +static void spi_nor_put_device (struct mtd_info *mtd) +{ +struct mtd_info *master =mtd_get_master (mtd); +struct spi_nor *nor =mtd_to_spi_nor (master); +struct device *dev; + +if (nor->spimem) + dev = nor->spimem->spi->controller->dev.parent; +else + dev = nor->dev; + +module_put (dev->driver->owner); +} +void spi_nor_restore (struct spi_nor *nor) {/* restore the addressing mode */
@@ -3458,6 +3489,8 @@ int spi_nor_scan(struct spi_nor *nor, co mtd->_read = spi_nor_read; mtd->_suspend = spi_nor_suspend; mtd->_resume = spi_nor_resume; + mtd->_get_device = spi_nor_get_device; + mtd->_put_device = spi_nor_put_device;if (nor->params->locking_ops) { mtd->_lock = spi_nor_lock;
Greg Kroah-Hartman
maintainerPATCH 24/342 Revert "mtd: spi-nor: macronix: Add support for mx25l51245g"
In reply to Greg Kroah-HartmanFrom: Tudor Ambarus <[email protected]>
commit 46094049a49be777f12a9589798f7c70b90cd03f upstream.
This reverts commit 04b8edad262eec0d153005973dfbdd83423c0dcb.
mx25l51245g and mx66l51235l have the same flash ID. The flash detection returns the first entry in the flash_info array that matches the flash ID that was read, thus for the 0xc2201a ID, mx25l51245g was always hit, introducing a regression for mx66l51235l.
If one wants to differentiate the flash names, a better fix would be to differentiate between the two at run-time, depending on SFDP, and choose the correct name from a list of flash names, depending on the SFDP differentiator.
--- drivers/mtd/spi-nor/macronix.c | 3 --- 1 file changed, 3 deletions(-)
drivers/mtd/spi-nor/macronix.c +0 -3
@@ -73,9 +73,6 @@ static const struct flash_info macronix_SECT_4K |SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) }, { "mx25l25655e", INFO(0xc22619, 0, 64 * 1024, 512, 0) }, - { "mx25l51245g", INFO(0xc2201a, 0, 64 * 1024, 1024, -SECT_4K |SPI_NOR_DUAL_READ |SPI_NOR_QUAD_READ | - SPI_NOR_4B_OPCODES) }, { "mx66l51235l", INFO(0xc2201a, 0, 64 * 1024, 1024,SPI_NOR_DUAL_READ |SPI_NOR_QUAD_READ | SPI_NOR_4B_OPCODES) },
Greg Kroah-Hartman
maintainerPATCH 25/342 mtd: spinand: core: add missing MODULE_DEVICE_TABLE()
In reply to Greg Kroah-HartmanFrom: Alexander Lobakin <[email protected]>
commit 25fefc88c71f47db0466570335e3f75f10952e7a upstream.
The module misses MODULE_DEVICE_TABLE() for both SPI and OF ID tables and thus never autoloads on ID matches.
Add the missing declarations.
Present since day-0 of spinand framework introduction.
--- drivers/mtd/nand/spi/core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mtd/nand/spi/core.c +2 -0
@@ -1263,12 +1263,14 @@ static const struct spi_device_id spinan { .name = "spi-nand" }, { /* sentinel */ }, }; +MODULE_DEVICE_TABLE (spi, spinand_ids);#ifdef CONFIG_OF static const struct of_device_id spinand_of_ids[] = { { .compatible ="spi-nand" }, {/* sentinel */ }, }; +MODULE_DEVICE_TABLE (of, spinand_of_ids);#endif static struct spi_mem_driver spinand_drv = {
Greg Kroah-Hartman
maintainerPATCH 26/342 mtd: rawnand: atmel: Update ecc_stats.corrected counter
In reply to Greg Kroah-HartmanFrom: Kai Stuhlemmer (ebee Engineering) <[email protected]>
commit 33cebf701e98dd12b01d39d1c644387b27c1a627 upstream.
Update MTD ECC statistics with the number of corrected bits.
--- drivers/mtd/nand/raw/atmel/nand-controller.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/mtd/nand/raw/atmel/nand-controller.c +4 -2
@@ -883,10 +883,12 @@ static int atmel_nand_pmecc_correct_dataNULL ,0 , chip->ecc.strength); -if (ret >=0 ) +if (ret >=0 ) { + mtd->ecc_stats.corrected += ret; max_bitflips =max (ret, max_bitflips); -else + }else { mtd->ecc_stats.failed++; + } databuf += chip->ecc.size; eccbuf += chip->ecc.bytes;
Greg Kroah-Hartman
maintainerPATCH 27/342 mtd: physmap: physmap-bt1-rom: Fix unintentional stack access
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
commit 683313993dbe1651c7aa00bb42a041d70e914925 upstream.
Cast &data to (char *) in order to avoid unintentionally accessing the stack.
Notice that data is of type u32, so any increment to &data will be in the order of 4-byte chunks, and this piece of code is actually intended to be a byte offset.
Addresses-Coverity-ID: 1497765 ("Out-of-bounds access")
--- drivers/mtd/maps/physmap-bt1-rom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/maps/physmap-bt1-rom.c +1 -1
@@ -79,7 +79,7 @@ static void __xipram bt1_rom_map_copy_frif (shift) { chunk =min_t (ssize_t,4 - shift, len); data =readl_relaxed (src - shift); -memcpy (to, &data + shift, chunk); +memcpy (to, (char *)&data + shift, chunk); src += chunk; to += chunk; len -= chunk;
Greg Kroah-Hartman
maintainerPATCH 28/342 erofs: add unsupported inode i_format check
In reply to Greg Kroah-HartmanFrom: Gao Xiang <[email protected]>
commit 24a806d849c0b0c1d0cd6a6b93ba4ae4c0ec9f08 upstream.
If any unknown i_format fields are set (may be of some new incompat inode features), mark such inode as unsupported.
Just in case of any new incompat i_format fields added in the future.
--- fs/erofs/erofs_fs.h | 3 +++ fs/erofs/inode.c | 7 +++++++ 2 files changed, 10 insertions(+)
fs/erofs/erofs_fs.h +3 -0
@@ -75,6 +75,9 @@ static inline bool erofs_inode_is_data_c#define EROFS_I_VERSION_BIT 0#define EROFS_I_DATALAYOUT_BIT 1 +#define EROFS_I_ALL \ + ((1 << (EROFS_I_DATALAYOUT_BIT + EROFS_I_DATALAYOUT_BITS)) - 1) +/* 32-byte reduced form of an ondisk inode */ struct erofs_inode_compact {__le16 i_format;/* inode format hints */
fs/erofs/inode.c +7 -0
@@ -44,6 +44,13 @@ static struct page *erofs_read_inode(str dic =page_address (page) + *ofs; ifmt =le16_to_cpu (dic->i_format); +if (ifmt & ~EROFS_I_ALL ) { +erofs_err (inode->i_sb,"unsupported i_format %u of nid %llu" , + ifmt, vi->nid); + err = -EOPNOTSUPP ; + goto err_out; + } + vi->datalayout =erofs_inode_datalayout (ifmt);if (vi->datalayout >=EROFS_INODE_DATALAYOUT_MAX ) { erofs_err(inode->i_sb, "unsupported datalayout %u of nid %llu",
Greg Kroah-Hartman
maintainerPATCH 29/342 spi: stm32-qspi: fix pm_runtime usage_count counter
In reply to Greg Kroah-HartmanFrom: Christophe Kerello <[email protected]>
commit 102e9d1936569d43f55dd1ea89be355ad207143c upstream.
pm_runtime usage_count counter is not well managed. pm_runtime_put_autosuspend callback drops the usage_counter but this one has never been increased. Add pm_runtime_get_sync callback to bump up the usage counter. It is also needed to use pm_runtime_force_suspend and pm_runtime_force_resume APIs to handle properly the clock.
--- drivers/spi/spi-stm32-qspi.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
drivers/spi/spi-stm32-qspi.c +14 -4
@@ -727,21 +727,31 @@ static int __maybe_unused stm32_qspi_sus {pinctrl_pm_select_sleep_state (dev); -return 0 ; +return pm_runtime_force_suspend (dev); }static int __maybe_unused stm32_qspi_resume (struct device *dev) {struct stm32_qspi *qspi =dev_get_drvdata (dev); +int ret; + + ret =pm_runtime_force_resume (dev); +if (ret <0 ) +return ret;pinctrl_pm_select_default_state (dev); -clk_prepare_enable (qspi->clk); + + ret =pm_runtime_get_sync (dev); +if (ret <0 ) { +pm_runtime_put_noidle (dev); +return ret; + }writel_relaxed (qspi->cr_reg, qspi->io_base +QSPI_CR );writel_relaxed (qspi->dcr_reg, qspi->io_base +QSPI_DCR ); -pm_runtime_mark_last_busy (qspi->dev); -pm_runtime_put_autosuspend (qspi->dev); +pm_runtime_mark_last_busy (dev); +pm_runtime_put_autosuspend (dev);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 30/342 spi: spi-ti-qspi: Free DMA resources
In reply to Greg Kroah-HartmanFrom: Tudor Ambarus <[email protected]>
commit 1d309cd688a76fb733f0089d36dc630327b32d59 upstream.
Release the RX channel and free the dma coherent memory when devm_spi_register_master() fails.
--- drivers/spi/spi-ti-qspi.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
drivers/spi/spi-ti-qspi.c +14 -6
@@ -733,6 +733,17 @@ static int ti_qspi_runtime_resume(structreturn 0 ; } +static void ti_qspi_dma_cleanup (struct ti_qspi *qspi) +{ +if (qspi->rx_bb_addr) +dma_free_coherent (qspi->dev,QSPI_DMA_BUFFER_SIZE , + qspi->rx_bb_addr, + qspi->rx_bb_dma_addr); + +if (qspi->rx_chan) +dma_release_channel (qspi->rx_chan); +} +static const struct of_device_id ti_qspi_match[] = { {.compatible ="ti,dra7xxx-qspi" }, {.compatible ="ti,am4372-qspi" },
@@ -886,6 +897,8 @@ no_dma:if (!ret)return 0 ; +ti_qspi_dma_cleanup (qspi); +pm_runtime_disable (&pdev->dev); free_master:spi_master_put (master);
@@ -904,12 +917,7 @@ static int ti_qspi_remove(struct platforpm_runtime_put_sync (&pdev->dev);pm_runtime_disable (&pdev->dev); -if (qspi->rx_bb_addr) -dma_free_coherent (qspi->dev,QSPI_DMA_BUFFER_SIZE , - qspi->rx_bb_addr, - qspi->rx_bb_dma_addr); -if (qspi->rx_chan) -dma_release_channel (qspi->rx_chan); +ti_qspi_dma_cleanup (qspi);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 31/342 libceph: bump CephXAuthenticate encoding version
In reply to Greg Kroah-HartmanFrom: Ilya Dryomov <[email protected]>
commit 7807dafda21a549403d922da98dde0ddfeb70d08 upstream.
A dummy v3 encoding (exactly the same as v2) was introduced so that the monitors can distinguish broken clients that may not include their auth ticket in CEPHX_GET_AUTH_SESSION_KEY request on reconnects, thus failing to prove previous possession of their global_id (one part of CVE-2021-20288).
The kernel client has always included its auth ticket, so it is compatible with enforcing mode as is. However we want to bump the encoding version to avoid having to authenticate twice on the initial connect -- all legacy (CephXAuthenticate < v3) are now forced do so in order to expose insecure global_id reclaim.
Marking for stable since at least for 5.11 and 5.12 it is trivial (v2 -> v3).
Cc: [email protected] # 5.11+
URL: https://tracker.ceph.com/issues/50452
--- net/ceph/auth_x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ceph/auth_x.c +1 -1
@@ -526,7 +526,7 @@ static int ceph_x_build_request(struct cif (ret <0 )return ret; - auth->struct_v =2 ;/* nautilus+ */ + auth->struct_v =3 ;/* nautilus+ */ auth->key =0 ;for (u = (u64 *)enc_buf; u +1 <= (u64 *)(enc_buf + ret); u++) auth->key ^= *(__le64 *)u;
Greg Kroah-Hartman
maintainerPATCH 32/342 libceph: allow addrvecs with a single NONE/blank address
In reply to Greg Kroah-HartmanFrom: Ilya Dryomov <[email protected]>
commit 3f1c6f2122fc780560f09735b6d1dbf39b44eb0f upstream.
Normally, an unused OSD id/slot is represented by an empty addrvec. However, it also appears to be possible to generate an osdmap where an unused OSD id/slot has an addrvec with a single blank address of type NONE. Allow such addrvecs and make the end result be exactly the same as for the empty addrvec case -- leave addr intact.
--- net/ceph/decode.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
net/ceph/decode.c +14 -6
@@ -4,6 +4,7 @@#include <linux/inet.h> #include <linux/ceph/decode.h> +#include <linux/ceph/messenger.h> /* for ceph_pr_addr() */ static int ceph_decode_entity_addr_versioned(void **p, void *end,
@@ -110,6 +111,7 @@ int ceph_decode_entity_addrvec(void **p, }ceph_decode_32_safe (p, end, addr_cnt, e_inval); +dout ("%s addr_cnt %d\n" , __func__, addr_cnt); found = false;for (i =0 ; i < addr_cnt; i++) {
@@ -117,6 +119,7 @@ int ceph_decode_entity_addrvec(void **p,if (ret)return ret; +dout ("%s i %d addr %s\n" , __func__, i,ceph_pr_addr (&tmp_addr));if (tmp_addr.type == my_type) {if (found) { pr_err("another match of type %d in addrvec\n",
@@ -128,13 +131,18 @@ int ceph_decode_entity_addrvec(void **p, found = true; } } -if (!found && addr_cnt !=0 ) { -pr_err ("no match of type %d in addrvec\n" , -le32_to_cpu (my_type)); -return -ENOENT ; - } -return 0 ; +if (found) +return 0 ; + +if (!addr_cnt) +return 0 ;/* normal -- e.g. unused OSD id/slot */ + +if (addr_cnt ==1 && !memchr_inv (&tmp_addr,0 ,sizeof (tmp_addr))) +return 0 ;/* weird but effectively the same as !addr_cnt */ + +pr_err ("no match of type %d in addrvec\n" ,le32_to_cpu (my_type)); +return -ENOENT ; e_inval:return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 33/342 scsi: qla2xxx: Reserve extra IRQ vectors
In reply to Greg Kroah-HartmanFrom: Roman Bolshakov <[email protected]>
commit f02d4086a8f36a0e1aaebf559b54cf24a177a486 upstream.
Commit a6dcfe08487e ("scsi: qla2xxx: Limit interrupt vectors to number of CPUs") lowers the number of allocated MSI-X vectors to the number of CPUs.
That breaks vector allocation assumptions in qla83xx_iospace_config(), qla24xx_enable_msix() and qla2x00_iospace_config(). Either of the functions computes maximum number of qpairs as:
ha->max_qpairs = ha->msix_count - 1 (MB interrupt) - 1 (default
response queue) - 1 (ATIO, in dual or pure target mode)
max_qpairs is set to zero in case of two CPUs and initiator mode. The number is then used to allocate ha->queue_pair_map inside qla2x00_alloc_queues(). No allocation happens and ha->queue_pair_map is left NULL but the driver thinks there are queue pairs available.
qla2xxx_queuecommand() tries to find a qpair in the map and crashes:
if (ha->mqenable) {
uint32_t tag;
uint16_t hwq;
struct qla_qpair *qpair = NULL; tag = blk_mq_unique_tag(cmd->request);
hwq = blk_mq_unique_tag_to_hwq(tag);
qpair = ha->queue_pair_map[hwq]; # <- HERE
if (qpair)
return qla2xxx_mqueuecommand(host, cmd, qpair);}
BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 0 PID: 72 Comm: kworker/u4:3 Tainted: G W 5.10.0-rc1+ #25 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014 Workqueue: scsi_wq_7 fc_scsi_scan_rport [scsi_transport_fc] RIP: 0010:qla2xxx_queuecommand+0x16b/0x3f0 [qla2xxx] Call Trace: scsi_queue_rq+0x58c/0xa60 blk_mq_dispatch_rq_list+0x2b7/0x6f0 ? __sbitmap_get_word+0x2a/0x80 __blk_mq_sched_dispatch_requests+0xb8/0x170 blk_mq_sched_dispatch_requests+0x2b/0x50 __blk_mq_run_hw_queue+0x49/0xb0 __blk_mq_delay_run_hw_queue+0xfb/0x150 blk_mq_sched_insert_request+0xbe/0x110 blk_execute_rq+0x45/0x70 __scsi_execute+0x10e/0x250 scsi_probe_and_add_lun+0x228/0xda0 __scsi_scan_target+0xf4/0x620 ? __pm_runtime_resume+0x4f/0x70 scsi_scan_target+0x100/0x110 fc_scsi_scan_rport+0xa1/0xb0 [scsi_transport_fc] process_one_work+0x1ea/0x3b0 worker_thread+0x28/0x3b0 ? process_one_work+0x3b0/0x3b0 kthread+0x112/0x130 ? kthread_park+0x80/0x80 ret_from_fork+0x22/0x30
The driver should allocate enough vectors to provide every CPU it's own HW queue and still handle reserved (MB, RSP, ATIO) interrupts.
The change fixes the crash on dual core VM and prevents unbalanced QP allocation where nr_hw_queues is two less than the number of CPUs.
--- drivers/scsi/qla2xxx/qla_isr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/qla2xxx/qla_isr.c +2 -2
@@ -3978,11 +3978,11 @@ qla24xx_enable_msix(struct qla_hw_data *if (USER_CTRL_IRQ (ha) || !ha->mqiobase) {/* user wants to control IRQ setting for target mode */ ret =pci_alloc_irq_vectors (ha->pdev, min_vecs, -min ((u16 )ha->msix_count, (u16 )num_online_cpus ()), +min ((u16 )ha->msix_count, (u16)(num_online_cpus () + min_vecs)),PCI_IRQ_MSIX ); }else ret =pci_alloc_irq_vectors_affinity (ha->pdev, min_vecs, -min ((u16 )ha->msix_count, (u16 )num_online_cpus ()), +min ((u16 )ha->msix_count, (u16)(num_online_cpus () + min_vecs)),PCI_IRQ_MSIX |PCI_IRQ_AFFINITY , &desc);
Greg Kroah-Hartman
maintainerPATCH 34/342 scsi: lpfc: Fix rmmod crash due to bad ring pointers to abort_iotag
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
commit 078c68b87a717b9fcd8e0f2109f73456fbc55490 upstream.
Rmmod on SLI-4 adapters is sometimes hitting a bad ptr dereference in lpfc_els_free_iocb().
A prior patch refactored the lpfc_sli_abort_iocb() routine. One of the changes was to convert from building/sending an abort within the routine to using a common routine. The reworked routine passes, without modification, the pring ptr to the new common routine. The older routine had logic to check SLI-3 vs SLI-4 and adapt the pring ptr if necessary as callers were passing SLI-3 pointers even when not on an SLI-4 adapter. The new routine is missing this check and adapt, so the SLI-3 ring pointers are being used in SLI-4 paths.
Fix by cleaning up the calling routines. In review, there is no need to pass the ring ptr argument to abort_iocb at all. The routine can look at the adapter type itself and reference the proper ring.
--- drivers/scsi/lpfc/lpfc_crtn.h | 4 ++-- drivers/scsi/lpfc/lpfc_hbadisc.c | 10 +++------- drivers/scsi/lpfc/lpfc_nportdisc.c | 4 +--- drivers/scsi/lpfc/lpfc_sli.c | 20 +++++++++++++++----- 4 files changed, 21 insertions(+), 17 deletions(-)
drivers/scsi/lpfc/lpfc_crtn.h +2 -2
@@ -352,8 +352,8 @@ int lpfc_sli_hbq_size(void);int lpfc_sli_issue_abort_iotag (struct lpfc_hba *,struct lpfc_sli_ring *,struct lpfc_iocbq *,void *);int lpfc_sli_sum_iocb (struct lpfc_vport *,uint16_t ,uint64_t ,lpfc_ctx_cmd ); -int lpfc_sli_abort_iocb (struct lpfc_vport *,struct lpfc_sli_ring *,uint16_t , -uint64_t ,lpfc_ctx_cmd ); +int lpfc_sli_abort_iocb (struct lpfc_vport *vport,u16 tgt_id,u64 lun_id, +lpfc_ctx_cmd abort_cmd);int lpfc_sli_abort_taskmgmt (struct lpfc_vport *,struct lpfc_sli_ring *,uint16_t ,uint64_t ,lpfc_ctx_cmd );
drivers/scsi/lpfc/lpfc_hbadisc.c +3 -7
@@ -130,11 +130,8 @@ lpfc_terminate_rport_io(struct fc_rport"rport terminate: sid:x%x did:x%x flg:x%x" , ndlp->nlp_sid, ndlp->nlp_DID, ndlp->nlp_flag); -if (ndlp->nlp_sid !=NLP_NO_SID ) { -lpfc_sli_abort_iocb (vport, - &vport->phba->sli.sli3_ring[LPFC_FCP_RING ], - ndlp->nlp_sid,0 ,LPFC_CTX_TGT ); - } +if (ndlp->nlp_sid !=NLP_NO_SID ) +lpfc_sli_abort_iocb (vport, ndlp->nlp_sid,0 ,LPFC_CTX_TGT ); }/*
@@ -289,8 +286,7 @@ lpfc_dev_loss_tmo_handler(struct lpfc_noif (ndlp->nlp_sid !=NLP_NO_SID ) { warn_on =1 ; -lpfc_sli_abort_iocb (vport, &phba->sli.sli3_ring[LPFC_FCP_RING ], - ndlp->nlp_sid,0 ,LPFC_CTX_TGT ); +lpfc_sli_abort_iocb (vport, ndlp->nlp_sid,0 ,LPFC_CTX_TGT ); }if (warn_on) {
drivers/scsi/lpfc/lpfc_nportdisc.c +1 -3
@@ -2614,12 +2614,10 @@ static uint32_t lpfc_rcv_prlo_mapped_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, void *arg, uint32_t evt) { - struct lpfc_hba *phba = vport->phba; struct lpfc_iocbq *cmdiocb = (struct lpfc_iocbq *) arg;/* flush the target */ -lpfc_sli_abort_iocb (vport, &phba->sli.sli3_ring[LPFC_FCP_RING ], - ndlp->nlp_sid,0 ,LPFC_CTX_TGT ); +lpfc_sli_abort_iocb (vport, ndlp->nlp_sid,0 ,LPFC_CTX_TGT );/* Treat like rcv logo */ lpfc_rcv_logo (vport, ndlp, cmdiocb,ELS_CMD_PRLO );
drivers/scsi/lpfc/lpfc_sli.c +15 -5
@@ -11639,7 +11639,7 @@ lpfc_sli_issue_abort_iotag(struct lpfc_h icmd = &cmdiocb->iocb;if (icmd->ulpCommand ==CMD_ABORT_XRI_CN || icmd->ulpCommand ==CMD_CLOSE_XRI_CN || - (cmdiocb->iocb_flag &LPFC_DRIVER_ABORTED ) !=0 ) + cmdiocb->iocb_flag &LPFC_DRIVER_ABORTED )return IOCB_ABORTING ;if (!pring) {
@@ -11937,7 +11937,6 @@ lpfc_sli_abort_fcp_cmpl(struct lpfc_hba/** * lpfc_sli_abort_iocb - issue abort for all commands on a host/target/LUN * @vport: Pointer to virtual port. -* @pring: Pointer to driver SLI ring object. * @tgt_id: SCSI ID of the target. * @lun_id: LUN ID of the scsi device. * @abort_cmd: LPFC_CTX_LUN/LPFC_CTX_TGT/LPFC_CTX_HOST.
@@ -11952,18 +11951,22 @@ lpfc_sli_abort_fcp_cmpl(struct lpfc_hba* FCP iocbs associated with SCSI target specified by tgt_id parameter. * When abort_cmd == LPFC_CTX_HOST, the function sends abort to all * FCP iocbs associated with virtual port. +* The pring used for SLI3 is sli3_ring[LPFC_FCP_RING], for SLI4 +* lpfc_sli4_calc_ring is used. * This function returns number of iocbs it failed to abort. * This function is called with no locks held. **/ int -lpfc_sli_abort_iocb (struct lpfc_vport *vport,struct lpfc_sli_ring *pring, -uint16_t tgt_id,uint64_t lun_id,lpfc_ctx_cmd abort_cmd) +lpfc_sli_abort_iocb (struct lpfc_vport *vport,u16 tgt_id,u64 lun_id, +lpfc_ctx_cmd abort_cmd) {struct lpfc_hba *phba = vport->phba; +struct lpfc_sli_ring *pring =NULL ;struct lpfc_iocbq *iocbq;int errcnt =0 , ret_val =0 ;unsigned long iflags;int i; +void *fcp_cmpl =NULL ;/* all I/Os are in process of being flushed */ if (phba->hba_flag &HBA_IOQ_FLUSH )
@@ -11977,8 +11980,15 @@ lpfc_sli_abort_iocb(struct lpfc_vport *vcontinue ;spin_lock_irqsave (&phba->hbalock, iflags); +if (phba->sli_rev ==LPFC_SLI_REV3 ) { + pring = &phba->sli.sli3_ring[LPFC_FCP_RING ]; + fcp_cmpl = lpfc_sli_abort_fcp_cmpl; + }else if (phba->sli_rev ==LPFC_SLI_REV4 ) { + pring =lpfc_sli4_calc_ring (phba, iocbq); + fcp_cmpl = lpfc_sli4_abort_fcp_cmpl; + } ret_val =lpfc_sli_issue_abort_iotag (phba, pring, iocbq, - lpfc_sli_abort_fcp_cmpl); + fcp_cmpl);spin_unlock_irqrestore (&phba->hbalock, iflags);if (ret_val !=IOCB_SUCCESS ) errcnt++;
Greg Kroah-Hartman
maintainerPATCH 35/342 scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()
In reply to Greg Kroah-HartmanFrom: Arun Easi <[email protected]>
commit 6641df81ab799f28a5d564f860233dd26cca0d93 upstream.
RIP: 0010:kmem_cache_free+0xfa/0x1b0
Call Trace:
qla2xxx_mqueuecommand+0x2b5/0x2c0 [qla2xxx]
scsi_queue_rq+0x5e2/0xa40
__blk_mq_try_issue_directly+0x128/0x1d0
blk_mq_request_issue_directly+0x4e/0xb0Fix incorrect call to free srb in qla2xxx_mqueuecommand(), as srb is now allocated by upper layers. This fixes smatch warning of srb unintended free.
--- drivers/scsi/qla2xxx/qla_os.c | 7 ------- 1 file changed, 7 deletions(-)
drivers/scsi/qla2xxx/qla_os.c +0 -7
@@ -1008,8 +1008,6 @@ qla2xxx_mqueuecommand(struct Scsi_Host *if (rval !=QLA_SUCCESS ) {ql_dbg (ql_dbg_io + ql_dbg_verbose, vha,0x3078 ,"Start scsi failed rval=%d for cmd=%p.\n" , rval, cmd); -if (rval ==QLA_INTERFACE_ERROR ) - goto qc24_free_sp_fail_command; goto qc24_host_busy_free_sp; }
@@ -1021,11 +1019,6 @@ qc24_host_busy_free_sp: qc24_target_busy:return SCSI_MLQUEUE_TARGET_BUSY ; -qc24_free_sp_fail_command: - sp->free (sp); -CMD_SP (cmd) =NULL ; -qla2xxx_rel_qpair_sp (sp->qpair, sp); - qc24_fail_command: cmd->scsi_done (cmd);
Greg Kroah-Hartman
maintainerPATCH 36/342 scsi: mpt3sas: Only one vSES is present even when IOC has multi vSES
In reply to Greg Kroah-HartmanFrom: Sreekanth Reddy <[email protected]>
commit 4c51f956965120b3441cdd39c358b87daba13e19 upstream.
Whenever the driver is adding a vSES to virtual-phys list it is reinitializing the list head. Hence those vSES devices which were added previously are lost.
Stop reinitializing the list every time a new vSES device is added.
--- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/mpt3sas/mpt3sas_scsih.c +3 -1
@@ -6475,6 +6475,9 @@ _scsih_alloc_vphy(struct MPT3SAS_ADAPTERif (!vphy)return NULL ; +if (!port->vphys_mask) +INIT_LIST_HEAD (&port->vphys_list); +/* * Enable bit corresponding to HBA phy number on its * parent hba_port object's vphys_mask field.
@@ -6482,7 +6485,6 @@ _scsih_alloc_vphy(struct MPT3SAS_ADAPTER port->vphys_mask |= (1 << phy_num); vphy->phy_mask |= (1 << phy_num); -INIT_LIST_HEAD (&port->vphys_list);list_add_tail (&vphy->list, &port->vphys_list); ioc_info(ioc,
Greg Kroah-Hartman
maintainerPATCH 37/342 scsi: mpt3sas: Block PCI config access from userspace during reset
In reply to Greg Kroah-HartmanFrom: Sreekanth Reddy <[email protected]>
commit 3c8604691d2acc7b7d4795d9695070de9eaa5828 upstream.
While diag reset is in progress there is short duration where all access to controller's PCI config space from the host needs to be blocked. This is due to a hardware limitation of the IOC controllers.
Block all access to controller's config space from userland applications by calling pci_cfg_access_lock() while diag reset is in progress and unlocking it again after the controller comes back to ready state.
--- drivers/scsi/mpt3sas/mpt3sas_base.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/scsi/mpt3sas/mpt3sas_base.c +4 -0
@@ -7235,6 +7235,8 @@ _base_diag_reset(struct MPT3SAS_ADAPTERioc_info (ioc,"sending diag reset !!\n" ); +pci_cfg_access_lock (ioc->pdev); +drsprintk (ioc,ioc_info (ioc,"clear interrupts\n" )); count =0 ;
@@ -7325,10 +7327,12 @@ _base_diag_reset(struct MPT3SAS_ADAPTER goto out; } +pci_cfg_access_unlock (ioc->pdev);ioc_info (ioc,"diag reset: SUCCESS\n" );return 0 ; out: +pci_cfg_access_unlock (ioc->pdev);ioc_err (ioc,"diag reset: FAILED\n" );return -EFAULT ; }
Greg Kroah-Hartman
maintainerPATCH 38/342 mmc: uniphier-sd: Fix an error handling path in uniphier_sd_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
commit b03aec1c1f337dfdae44cdb0645ecac34208ae0a upstream.
A 'uniphier_sd_clk_enable()' call should be balanced by a corresponding 'uniphier_sd_clk_disable()' call.
This is done in the remove function, but not in the error handling path of the probe.
Add the missing call.
--- drivers/mmc/host/uniphier-sd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/mmc/host/uniphier-sd.c +3 -1
@@ -637,7 +637,7 @@ static int uniphier_sd_probe(struct plat ret =tmio_mmc_host_probe (host);if (ret) - goto free_host; + goto disable_clk; ret =devm_request_irq (dev, irq, tmio_mmc_irq,IRQF_SHARED ,dev_name (dev), host);
@@ -648,6 +648,8 @@ static int uniphier_sd_probe(struct plat remove_host:tmio_mmc_host_remove (host); +disable_clk: +uniphier_sd_clk_disable (host); free_host:tmio_mmc_host_free (host);
Greg Kroah-Hartman
maintainerPATCH 39/342 mmc: uniphier-sd: Fix a resource leak in the remove function
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
commit e29c84857e2d51aa017ce04284b962742fb97d9e upstream.
A 'tmio_mmc_host_free()' call is missing in the remove function, in order to balance a 'tmio_mmc_host_alloc()' call in the probe.
This is done in the error handling path of the probe, but not in the remove function.
Add the missing call.
--- drivers/mmc/host/uniphier-sd.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/host/uniphier-sd.c +1 -0
@@ -662,6 +662,7 @@ static int uniphier_sd_remove(struct platmio_mmc_host_remove (host);uniphier_sd_clk_disable (host); +tmio_mmc_host_free (host);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 40/342 mmc: sdhci: Check for reset prior to DMA address unmap
In reply to Greg Kroah-HartmanFrom: Pradeep P V K <[email protected]>
commit 21e35e898aa9ef7781632959db8613a5380f2eae upstream.
For data read commands, SDHC may initiate data transfers even before it completely process the command response. In case command itself fails, driver un-maps the memory associated with data transfer but this memory can still be accessed by SDHC for the already initiated data transfer. This scenario can lead to un-mapped memory access error.
To avoid this scenario, reset SDHC (when command fails) prior to un-mapping memory. Resetting SDHC ensures that all in-flight data transfers are either aborted or completed. So we don't run into this scenario.
Swap the reset, un-map steps sequence in sdhci_request_done().
--- drivers/mmc/host/sdhci.c | 60 ++++++++++++++++++++++++----------------------- 1 file changed, 31 insertions(+), 29 deletions(-)
drivers/mmc/host/sdhci.c +31 -29
@@ -2998,6 +2998,37 @@ static bool sdhci_request_done(struct sd }/* +* The controller needs a reset of internal state machines +* upon error conditions. +*/ +if (sdhci_needs_reset (host, mrq)) { +/* +* Do not finish until command and data lines are available for +* reset. Note there can only be one other mrq, so it cannot +* also be in mrqs_done, otherwise host->cmd and host->data_cmd +* would both be null. +*/ +if (host->cmd || host->data_cmd) { +spin_unlock_irqrestore (&host->lock, flags); +return true; + } + +/* Some controllers need this kick or reset won't work here */ +if (host->quirks &SDHCI_QUIRK_CLOCK_BEFORE_RESET ) +/* This is to force an update */ + host->ops->set_clock (host, host->clock); + +/* +* Spec says we should do both at the same time, but Ricoh +* controllers do not like that. +*/ +sdhci_do_reset (host,SDHCI_RESET_CMD ); +sdhci_do_reset (host,SDHCI_RESET_DATA ); + + host->pending_reset = false; + } + +/* * Always unmap the data buffers if they were mapped by * sdhci_prepare_data() whenever we finish with a request. * This avoids leaking DMA mappings on error.
@@ -3060,35 +3091,6 @@ static bool sdhci_request_done(struct sd } } -/* -* The controller needs a reset of internal state machines -* upon error conditions. -*/ -if (sdhci_needs_reset (host, mrq)) { -/* -* Do not finish until command and data lines are available for -* reset. Note there can only be one other mrq, so it cannot -* also be in mrqs_done, otherwise host->cmd and host->data_cmd -* would both be null. -*/ -if (host->cmd || host->data_cmd) { -spin_unlock_irqrestore (&host->lock, flags); -return true; - } - -/* Some controllers need this kick or reset won't work here */ -if (host->quirks &SDHCI_QUIRK_CLOCK_BEFORE_RESET ) -/* This is to force an update */ - host->ops->set_clock (host, host->clock); - -/* Spec says we should do both at the same time, but Ricoh -controllers do not like that. */ -sdhci_do_reset (host,SDHCI_RESET_CMD ); -sdhci_do_reset (host,SDHCI_RESET_DATA ); - - host->pending_reset = false; - } - host->mrqs_done[i] =NULL ;spin_unlock_irqrestore (&host->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 41/342 mmc: sdhci-pci: Fix initialization of some SD cards for Intel BYT-based controllers
In reply to Greg Kroah-HartmanFrom: Adrian Hunter <[email protected]>
commit 2970134b927834e9249659a70aac48e62dff804a upstream.
Bus power may control card power, but the full reset done by SDHCI at initialization still may not reset the power, whereas a direct write to SDHCI_POWER_CONTROL can. That might be needed to initialize correctly, if the card was left powered on previously.
--- drivers/mmc/host/sdhci-pci-core.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)
drivers/mmc/host/sdhci-pci-core.c +27 -0
@@ -516,6 +516,7 @@ struct intel_host {int drv_strength;bool d3_retune;bool rpm_retune_ok; +bool needs_pwr_off;u32 glk_rx_ctrl1;u32 glk_tun_val;u32 active_ltr;
@@ -643,9 +644,25 @@ out:static void sdhci_intel_set_power (struct sdhci_host *host,unsigned char mode,unsigned short vdd) { +struct sdhci_pci_slot *slot =sdhci_priv (host); +struct intel_host *intel_host =sdhci_pci_priv (slot);int cntr;u8 reg; +/* +* Bus power may control card power, but a full reset still may not +* reset the power, whereas a direct write to SDHCI_POWER_CONTROL can. +* That might be needed to initialize correctly, if the card was left +* powered on previously. +*/ +if (intel_host->needs_pwr_off) { + intel_host->needs_pwr_off = false; +if (mode !=MMC_POWER_OFF ) { +sdhci_writeb (host,0 ,SDHCI_POWER_CONTROL ); +usleep_range (10000 ,12500 ); + } + } +sdhci_set_power (host, mode, vdd);if (mode ==MMC_POWER_OFF )
@@ -1135,6 +1152,14 @@ static int byt_sdio_probe_slot(struct sdreturn 0 ; } +static void byt_needs_pwr_off (struct sdhci_pci_slot *slot) +{ +struct intel_host *intel_host =sdhci_pci_priv (slot); +u8 reg =sdhci_readb (slot->host,SDHCI_POWER_CONTROL ); + + intel_host->needs_pwr_off = reg &SDHCI_POWER_ON ; +} +static int byt_sd_probe_slot (struct sdhci_pci_slot *slot) {byt_probe_slot (slot);
@@ -1152,6 +1177,8 @@ static int byt_sd_probe_slot(struct sdhc slot->chip->pdev->subsystem_device == PCI_SUBDEVICE_ID_NI_78E3) slot->host->mmc->caps2 |= MMC_CAP2_AVOID_3_3V; +byt_needs_pwr_off (slot); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 42/342 mmc: sdhci-tegra: Add required callbacks to set/clear CQE_EN bit
In reply to Greg Kroah-HartmanFrom: Aniruddha Tvs Rao <[email protected]>
commit 5ec6fa5a6dc5e42a4aa782f3a81d5f08b0fac1e6 upstream.
CMD8 is not supported with Command Queue Enabled. Add required callback to clear CQE_EN and CQE_INTR fields in the host controller register before sending CMD8. Add corresponding callback in the CQHCI resume path to re-enable CQE_EN and CQE_INTR fields.
--- drivers/mmc/host/sdhci-tegra.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+)
drivers/mmc/host/sdhci-tegra.c +32 -0
@@ -119,6 +119,10 @@/* SDMMC CQE Base Address for Tegra Host Ver 4.1 and Higher */ #define SDHCI_TEGRA_CQE_BASE_ADDR 0xF000 +#define SDHCI_TEGRA_CQE_TRNS_MODE (SDHCI_TRNS_MULTI | \ + SDHCI_TRNS_BLK_CNT_EN | \ + SDHCI_TRNS_DMA) +struct sdhci_tegra_soc_data {const struct sdhci_pltfm_data *pdata;u64 dma_mask;
@@ -1156,6 +1160,7 @@ static void tegra_sdhci_voltage_switch(sstatic void tegra_cqhci_writel (struct cqhci_host *cq_host,u32 val,int reg) {struct mmc_host *mmc = cq_host->mmc; +struct sdhci_host *host =mmc_priv (mmc);u8 ctrl;ktime_t timeout;bool timed_out;
@@ -1170,6 +1175,7 @@ static void tegra_cqhci_writel(struct cq*/ if (reg ==CQHCI_CTL && !(val &CQHCI_HALT ) &&cqhci_readl (cq_host,CQHCI_CTL ) &CQHCI_HALT ) { +sdhci_writew (host,SDHCI_TEGRA_CQE_TRNS_MODE ,SDHCI_TRANSFER_MODE );sdhci_cqe_enable (mmc);writel (val, cq_host->mmio + reg); timeout =ktime_add_us (ktime_get (),50 );
@@ -1205,6 +1211,7 @@ static void sdhci_tegra_update_dcmd_descstatic void sdhci_tegra_cqe_enable (struct mmc_host *mmc) {struct cqhci_host *cq_host = mmc->cqe_private; +struct sdhci_host *host =mmc_priv (mmc);u32 val;/*
@@ -1218,6 +1225,7 @@ static void sdhci_tegra_cqe_enable(strucif (val &CQHCI_ENABLE )cqhci_writel (cq_host, (val & ~CQHCI_ENABLE ),CQHCI_CFG ); +sdhci_writew (host,SDHCI_TEGRA_CQE_TRNS_MODE ,SDHCI_TRANSFER_MODE );sdhci_cqe_enable (mmc);if (val &CQHCI_ENABLE )cqhci_writel (cq_host, val,CQHCI_CFG );
@@ -1281,12 +1289,36 @@ static void tegra_sdhci_set_timeout(stru__sdhci_set_timeout (host, cmd); } +static void sdhci_tegra_cqe_pre_enable (struct mmc_host *mmc) +{ +struct cqhci_host *cq_host = mmc->cqe_private; +u32 reg; + + reg =cqhci_readl (cq_host,CQHCI_CFG ); + reg |=CQHCI_ENABLE ; +cqhci_writel (cq_host, reg,CQHCI_CFG ); +} + +static void sdhci_tegra_cqe_post_disable (struct mmc_host *mmc) +{ +struct cqhci_host *cq_host = mmc->cqe_private; +struct sdhci_host *host =mmc_priv (mmc); +u32 reg; + + reg =cqhci_readl (cq_host,CQHCI_CFG ); + reg &= ~CQHCI_ENABLE ; +cqhci_writel (cq_host, reg,CQHCI_CFG ); +sdhci_writew (host,0x0 ,SDHCI_TRANSFER_MODE ); +} +static const struct cqhci_host_ops sdhci_tegra_cqhci_ops = { .write_l = tegra_cqhci_writel, .enable = sdhci_tegra_cqe_enable, .disable = sdhci_cqe_disable, .dumpregs = sdhci_tegra_dumpregs, .update_dcmd_desc = sdhci_tegra_update_dcmd_desc, + .pre_enable = sdhci_tegra_cqe_pre_enable, + .post_disable = sdhci_tegra_cqe_post_disable, };static int tegra_sdhci_set_dma_mask (struct sdhci_host *host)
Greg Kroah-Hartman
maintainerPATCH 43/342 mmc: block: Update ext_csd.cache_ctrl if it was written
In reply to Greg Kroah-HartmanFrom: Avri Altman <[email protected]>
commit aea0440ad023ab0662299326f941214b0d7480bd upstream.
The cache function can be turned ON and OFF by writing to the CACHE_CTRL byte (EXT_CSD byte [33]). However, card->ext_csd.cache_ctrl is only set on init if cache size > 0.
Fix that by explicitly setting ext_csd.cache_ctrl on ext-csd write.
--- drivers/mmc/core/block.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/mmc/core/block.c +12 -0
@@ -572,6 +572,18 @@ static int __mmc_blk_ioctl_cmd(struct mm }/* +* Make sure to update CACHE_CTRL in case it was changed. The cache +* will get turned back on if the card is re-initialized, e.g. +* suspend/resume or hw reset in recovery. +*/ +if ((MMC_EXTRACT_INDEX_FROM_ARG (cmd.arg) ==EXT_CSD_CACHE_CTRL ) && + (cmd.opcode ==MMC_SWITCH )) { +u8 value =MMC_EXTRACT_VALUE_FROM_ARG (cmd.arg) &1 ; + + card->ext_csd.cache_ctrl = value; + } + +/* * According to the SD specs, some commands require a delay after * issuing the command. */
Greg Kroah-Hartman
maintainerPATCH 44/342 mmc: block: Issue a cache flush only when its enabled
In reply to Greg Kroah-HartmanFrom: Avri Altman <[email protected]>
commit 97fce126e279690105ee15be652b465fd96f9997 upstream.
In command queueing mode, the cache isn't flushed via the mmc_flush_cache() function, but instead by issuing a CMDQ_TASK_MGMT (CMD48) with a FLUSH_CACHE opcode. In this path, we need to check if cache has been enabled, before deciding to flush the cache, along the lines of what's being done in mmc_flush_cache().
To fix this problem, let's add a new bus ops callback ->cache_enabled() and implement it for the mmc bus type. In this way, the mmc block device driver can call it to know whether cache flushing should be done.
--- drivers/mmc/core/block.c | 4 ++++ drivers/mmc/core/core.h | 9 +++++++++ drivers/mmc/core/mmc.c | 7 +++++++ drivers/mmc/core/mmc_ops.c | 4 +--- 4 files changed, 21 insertions(+), 3 deletions(-)
drivers/mmc/core/block.c +4 -0
@@ -2233,6 +2233,10 @@ enum mmc_issued mmc_blk_mq_issue_rq(strucase MMC_ISSUE_ASYNC :switch (req_op (req)) {case REQ_OP_FLUSH : +if (!mmc_cache_enabled (host)) { +blk_mq_end_request (req,BLK_STS_OK ); +return MMC_REQ_FINISHED ; + } ret =mmc_blk_cqe_issue_flush (mq, req);break ;case REQ_OP_READ :
drivers/mmc/core/core.h +9 -0
@@ -29,6 +29,7 @@ struct mmc_bus_ops {int (*shutdown)(struct mmc_host *);int (*hw_reset)(struct mmc_host *);int (*sw_reset)(struct mmc_host *); +bool (*cache_enabled)(struct mmc_host *); };void mmc_attach_bus (struct mmc_host *host,const struct mmc_bus_ops *ops);
@@ -171,4 +172,12 @@ static inline void mmc_post_req(struct m host->ops->post_req(host, mrq, err); } +static inline bool mmc_cache_enabled (struct mmc_host *host) +{ +if (host->bus_ops->cache_enabled) +return host->bus_ops->cache_enabled (host); + +return false; +} +#endif
drivers/mmc/core/mmc.c +7 -0
@@ -2033,6 +2033,12 @@ static void mmc_detect(struct mmc_host * } } +static bool _mmc_cache_enabled (struct mmc_host *host) +{ +return host->card->ext_csd.cache_size >0 && + host->card->ext_csd.cache_ctrl &1 ; +} +static int _mmc_suspend (struct mmc_host *host,bool is_suspend) {int err =0 ;
@@ -2212,6 +2218,7 @@ static const struct mmc_bus_ops mmc_ops .alive = mmc_alive, .shutdown = mmc_shutdown, .hw_reset = _mmc_hw_reset, + .cache_enabled = _mmc_cache_enabled, };/*
drivers/mmc/core/mmc_ops.c +1 -3
@@ -988,9 +988,7 @@ int mmc_flush_cache(struct mmc_card *car {int err =0 ; -if (mmc_card_mmc (card) && - (card->ext_csd.cache_size >0 ) && - (card->ext_csd.cache_ctrl &1 )) { +if (mmc_cache_enabled (card->host)) { err =mmc_switch (card,EXT_CSD_CMD_SET_NORMAL ,EXT_CSD_FLUSH_CACHE ,1 ,MMC_CACHE_FLUSH_TIMEOUT_MS );
Greg Kroah-Hartman
maintainerPATCH 45/342 mmc: core: Do a power cycle when the CMD11 fails
In reply to Greg Kroah-HartmanFrom: DooHyun Hwang <[email protected]>
commit 147186f531ae49c18b7a9091a2c40e83b3d95649 upstream.
A CMD11 is sent to the SD/SDIO card to start the voltage switch procedure into 1.8V I/O. According to the SD spec a power cycle is needed of the card, if it turns out that the CMD11 fails. Let's fix this, to allow a retry of the initialization without the voltage switch, to succeed.
Note that, whether it makes sense to also retry with the voltage switch after the power cycle is a bit more difficult to know. At this point, we treat it like the CMD11 isn't supported and therefore we skip it when retrying.
--- drivers/mmc/core/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/core/core.c +1 -1
@@ -1204,7 +1204,7 @@ int mmc_set_uhs_voltage(struct mmc_host err =mmc_wait_for_cmd (host, &cmd,0 );if (err) -return err; + goto power_cycle;if (!mmc_host_is_spi (host) && (cmd.resp[0 ] &R1_ERROR ))return -EIO ;
Greg Kroah-Hartman
maintainerPATCH 46/342 mmc: core: Set read only for SD cards with permanent write protect bit
In reply to Greg Kroah-HartmanFrom: Seunghui Lee <[email protected]>
commit 917a5336f2c27928be270226ab374ed0cbf3805d upstream.
Some of SD cards sets permanent write protection bit in their CSD register, due to lifespan or internal problem. To avoid unnecessary I/O write operations, let's parse the bits in the CSD during initialization and mark the card as read only for this case.
--- drivers/mmc/core/sd.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/mmc/core/sd.c +6 -0
@@ -135,6 +135,9 @@ static int mmc_decode_csd(struct mmc_car csd->erase_size =UNSTUFF_BITS (resp,39 ,7 ) +1 ; csd->erase_size <<= csd->write_blkbits -9 ; } + +if (UNSTUFF_BITS (resp,13 ,1 )) +mmc_card_set_readonly (card);break ;case 1 :/*
@@ -169,6 +172,9 @@ static int mmc_decode_csd(struct mmc_car csd->write_blkbits =9 ; csd->write_partial =0 ; csd->erase_size =1 ; + +if (UNSTUFF_BITS (resp,13 ,1 )) +mmc_card_set_readonly (card);break ;default : pr_err("%s: unrecognised CSD structure version %d\n",
Greg Kroah-Hartman
maintainerPATCH 47/342 mmc: core: Fix hanging on I/O during system suspend for removable cards
In reply to Greg Kroah-HartmanFrom: Ulf Hansson <[email protected]>
commit 17a17bf50612e6048a9975450cf1bd30f93815b5 upstream.
The mmc core uses a PM notifier to temporarily during system suspend, turn off the card detection mechanism for removal/insertion of (e)MMC/SD/SDIO cards. Additionally, the notifier may be used to remove an SDIO card entirely, if a corresponding SDIO functional driver don't have the system suspend/resume callbacks assigned. This behaviour has been around for a very long time.
However, a recent bug report tells us there are problems with this approach. More precisely, when receiving the PM_SUSPEND_PREPARE notification, we may end up hanging on I/O to be completed, thus also preventing the system from getting suspended.
In the end what happens, is that the cancel_delayed_work_sync() in mmc_pm_notify() ends up waiting for mmc_rescan() to complete - and since mmc_rescan() wants to claim the host, it needs to wait for the I/O to be completed first.
Typically, this problem is triggered in Android, if there is ongoing I/O while the user decides to suspend, resume and then suspend the system again. This due to that after the resume, an mmc_rescan() work gets punted to the workqueue, which job is to verify that the card remains inserted after the system has resumed.
To fix this problem, userspace needs to become frozen to suspend the I/O, prior to turning off the card detection mechanism. Therefore, let's drop the PM notifiers for mmc subsystem altogether and rely on the card detection to be turned off/on as a part of the system_freezable_wq, that we are already using.
Moreover, to allow and SDIO card to be removed during system suspend, let's manage this from a ->prepare() callback, assigned at the mmc_host_class level. In this way, we can use the parent device (the mmc_host_class device), to remove the card device that is the child, in the device_prepare() phase.
--- drivers/mmc/core/core.c | 74 ----------------------------------------------- drivers/mmc/core/core.h | 8 ----- drivers/mmc/core/host.c | 40 +++++++++++++++++++++++-- drivers/mmc/core/sdio.c | 28 +++++++++++++---- include/linux/mmc/host.h | 3 - 5 files changed, 59 insertions(+), 94 deletions(-)
drivers/mmc/core/core.c +0 -74
@@ -2366,80 +2366,6 @@ void mmc_stop_host(struct mmc_host *hostmmc_release_host (host); } -#ifdef CONFIG_PM_SLEEP -/* Do the card removal on suspend if card is assumed removeable -* Do that in pm notifier while userspace isn't yet frozen, so we will be able -to sync the card. -*/ -static int mmc_pm_notify (struct notifier_block *notify_block, -unsigned long mode,void *unused) -{ -struct mmc_host *host =container_of ( - notify_block, struct mmc_host, pm_notify); -unsigned long flags; -int err =0 ; - -switch (mode) { -case PM_HIBERNATION_PREPARE : -case PM_SUSPEND_PREPARE : -case PM_RESTORE_PREPARE : -spin_lock_irqsave (&host->lock, flags); - host->rescan_disable =1 ; -spin_unlock_irqrestore (&host->lock, flags); -cancel_delayed_work_sync (&host->detect); - -if (!host->bus_ops) -break ; - -/* Validate prerequisites for suspend */ -if (host->bus_ops->pre_suspend) - err = host->bus_ops->pre_suspend (host); -if (!err) -break ; - -if (!mmc_card_is_removable (host)) { -dev_warn (mmc_dev (host), -"pre_suspend failed for non-removable host: " -"%d\n" , err); -/* Avoid removing non-removable hosts */ -break ; - } - -/* Calling bus_ops->remove() with a claimed host can deadlock */ - host->bus_ops->remove (host); -mmc_claim_host (host); -mmc_detach_bus (host); -mmc_power_off (host); -mmc_release_host (host); - host->pm_flags =0 ; -break ; - -case PM_POST_SUSPEND : -case PM_POST_HIBERNATION : -case PM_POST_RESTORE : - -spin_lock_irqsave (&host->lock, flags); - host->rescan_disable =0 ; -spin_unlock_irqrestore (&host->lock, flags); -_mmc_detect_change (host,0 , false); - - } - -return 0 ; -} - -void mmc_register_pm_notifier (struct mmc_host *host) -{ - host->pm_notify.notifier_call = mmc_pm_notify; -register_pm_notifier (&host->pm_notify); -} - -void mmc_unregister_pm_notifier (struct mmc_host *host) -{ -unregister_pm_notifier (&host->pm_notify); -} -#endif -static int __init mmc_init (void ) {int ret;
drivers/mmc/core/core.h +0 -8
@@ -94,14 +94,6 @@ int mmc_execute_tuning(struct mmc_card *int mmc_hs200_to_hs400 (struct mmc_card *card);int mmc_hs400_to_hs200 (struct mmc_card *card); -#ifdef CONFIG_PM_SLEEP -void mmc_register_pm_notifier (struct mmc_host *host); -void mmc_unregister_pm_notifier (struct mmc_host *host); -#else -static inline void mmc_register_pm_notifier (struct mmc_host *host) { } -static inline void mmc_unregister_pm_notifier (struct mmc_host *host) { } -#endif -void mmc_wait_for_req_done (struct mmc_host *host,struct mmc_request *mrq);bool mmc_is_req_done (struct mmc_host *host,struct mmc_request *mrq);
drivers/mmc/core/host.c +37 -3
@@ -34,6 +34,42 @@static DEFINE_IDA (mmc_host_ida); +#ifdef CONFIG_PM_SLEEP +static int mmc_host_class_prepare (struct device *dev) +{ +struct mmc_host *host =cls_dev_to_mmc_host (dev); + +/* +* It's safe to access the bus_ops pointer, as both userspace and the +* workqueue for detecting cards are frozen at this point. +*/ +if (!host->bus_ops) +return 0 ; + +/* Validate conditions for system suspend. */ +if (host->bus_ops->pre_suspend) +return host->bus_ops->pre_suspend (host); + +return 0 ; +} + +static void mmc_host_class_complete (struct device *dev) +{ +struct mmc_host *host =cls_dev_to_mmc_host (dev); + +_mmc_detect_change (host,0 , false); +} + +static const struct dev_pm_ops mmc_host_class_dev_pm_ops = { + .prepare = mmc_host_class_prepare, + .complete = mmc_host_class_complete, +}; + +#define MMC_HOST_CLASS_DEV_PM_OPS (&mmc_host_class_dev_pm_ops) +#else +#define MMC_HOST_CLASS_DEV_PM_OPS NULL +#endif +static void mmc_host_classdev_release (struct device *dev) {struct mmc_host *host =cls_dev_to_mmc_host (dev);
@@ -45,6 +81,7 @@ static void mmc_host_classdev_release(ststatic struct class mmc_host_class = { .name ="mmc_host" , .dev_release = mmc_host_classdev_release, + .pm =MMC_HOST_CLASS_DEV_PM_OPS , };int mmc_register_host_class (void )
@@ -493,8 +530,6 @@ int mmc_add_host(struct mmc_host *host)#endif mmc_start_host (host); -mmc_register_pm_notifier (host); -return 0 ; }
@@ -510,7 +545,6 @@ EXPORT_SYMBOL(mmc_add_host);*/ void mmc_remove_host (struct mmc_host *host) { -mmc_unregister_pm_notifier (host);mmc_stop_host (host);#ifdef CONFIG_DEBUG_FS
drivers/mmc/core/sdio.c +22 -6
@@ -985,21 +985,37 @@ out:*/ static int mmc_sdio_pre_suspend (struct mmc_host *host) { -int i, err =0 ; +int i;for (i =0 ; i < host->card->sdio_funcs; i++) {struct sdio_func *func = host->card->sdio_func[i];if (func &&sdio_func_present (func) && func->dev.driver) {const struct dev_pm_ops *pmops = func->dev.driver->pm; -if (!pmops || !pmops->suspend || !pmops->resume) { +if (!pmops || !pmops->suspend || !pmops->resume)/* force removal of entire card in that case */ - err = -ENOSYS ; -break ; - } + goto remove; } } -return err; +return 0 ; + +remove: +if (!mmc_card_is_removable (host)) { +dev_warn (mmc_dev (host), +"missing suspend/resume ops for non-removable SDIO card\n" ); +/* Don't remove a non-removable card - we can't re-detect it. */ +return 0 ; + } + +/* Remove the SDIO card and let it be re-detected later on. */ +mmc_sdio_remove (host); +mmc_claim_host (host); +mmc_detach_bus (host); +mmc_power_off (host); +mmc_release_host (host); + host->pm_flags =0 ; + +return 0 ; }/*
include/linux/mmc/host.h +0 -3
@@ -290,9 +290,6 @@ struct mmc_host {u32 ocr_avail_sdio;/* SDIO-specific OCR */ u32 ocr_avail_sd;/* SD-specific OCR */ u32 ocr_avail_mmc;/* MMC-specific OCR */ -#ifdef CONFIG_PM_SLEEP -struct notifier_block pm_notify; -#endif struct wakeup_source *ws;/* Enable consume of uevents */ u32 max_current_330;u32 max_current_300;
Greg Kroah-Hartman
maintainerPATCH 48/342 irqchip/gic-v3: Do not enable irqs when handling spurious interrups
In reply to Greg Kroah-HartmanFrom: He Ying <[email protected]>
commit a97709f563a078e259bf0861cd259aa60332890a upstream.
We triggered the following error while running our 4.19 kernel with the pseudo-NMI patches backported to it:
[ 14.816231] ------------[ cut here ]------------ [ 14.816231] kernel BUG at irq.c:99! [ 14.816232] Internal error: Oops - BUG: 0 [#1] SMP [ 14.816232] Process swapper/0 (pid: 0, stack limit = 0x(____ptrval____)) [ 14.816233] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G O 4.19.95.aarch64 #14 [ 14.816233] Hardware name: evb (DT) [ 14.816234] pstate: 80400085 (Nzcv daIf +PAN -UAO) [ 14.816234] pc : asm_nmi_enter+0x94/0x98 [ 14.816235] lr : asm_nmi_enter+0x18/0x98 [ 14.816235] sp : ffff000008003c50 [ 14.816235] pmr_save: 00000070 [ 14.816237] x29: ffff000008003c50 x28: ffff0000095f56c0 [ 14.816238] x27: 0000000000000000 x26: ffff000008004000 [ 14.816239] x25: 00000000015e0000 x24: ffff8008fb916000 [ 14.816240] x23: 0000000020400005 x22: ffff0000080817cc [ 14.816241] x21: ffff000008003da0 x20: 0000000000000060 [ 14.816242] x19: 00000000000003ff x18: ffffffffffffffff [ 14.816243] x17: 0000000000000008 x16: 003d090000000000 [ 14.816244] x15: ffff0000095ea6c8 x14: ffff8008fff5ab40 [ 14.816244] x13: ffff8008fff58b9d x12: 0000000000000000 [ 14.816245] x11: ffff000008c8a200 x10: 000000008e31fca5 [ 14.816246] x9 : ffff000008c8a208 x8 : 000000000000000f [ 14.816247] x7 : 0000000000000004 x6 : ffff8008fff58b9e [ 14.816248] x5 : 0000000000000000 x4 : 0000000080000000 [ 14.816249] x3 : 0000000000000000 x2 : 0000000080000000 [ 14.816250] x1 : 0000000000120000 x0 : ffff0000095f56c0 [ 14.816251] Call trace: [ 14.816251] asm_nmi_enter+0x94/0x98 [ 14.816251] el1_irq+0x8c/0x180 (IRQ C) [ 14.816252] gic_handle_irq+0xbc/0x2e4 [ 14.816252] el1_irq+0xcc/0x180 (IRQ B) [ 14.816253] arch_timer_handler_virt+0x38/0x58 [ 14.816253] handle_percpu_devid_irq+0x90/0x240 [ 14.816253] generic_handle_irq+0x34/0x50 [ 14.816254] __handle_domain_irq+0x68/0xc0 [ 14.816254] gic_handle_irq+0xf8/0x2e4 [ 14.816255] el1_irq+0xcc/0x180 (IRQ A) [ 14.816255] arch_cpu_idle+0x34/0x1c8 [ 14.816255] default_idle_call+0x24/0x44 [ 14.816256] do_idle+0x1d0/0x2c8 [ 14.816256] cpu_startup_entry+0x28/0x30 [ 14.816256] rest_init+0xb8/0xc8 [ 14.816257] start_kernel+0x4c8/0x4f4 [ 14.816257] Code: 940587f1 d5384100 b9401001 36a7fd01 (d4210000) [ 14.816258] Modules linked in: start_dp(O) smeth(O) [ 15.103092] ---[ end trace 701753956cb14aa8 ]--- [ 15.103093] Kernel panic - not syncing: Fatal exception in interrupt [ 15.103099] SMP: stopping secondary CPUs [ 15.103100] Kernel Offset: disabled [ 15.103100] CPU features: 0x36,a2400218 [ 15.103100] Memory Limit: none
which is cause by a 'BUG_ON(in_nmi())' in nmi_enter().
Quoted 1 line
From the call trace, we can find three interrupts (noted A, B, C above):
interrupt (A) is preempted by (B), which is further interrupted by (C).
Subsequent investigations show that (B) results in nmi_enter() being called, but that it actually is a spurious interrupt. Furthermore, interrupts are reenabled in the context of (B), and (C) fires with NMI priority. We end-up with a nested NMI situation, something we definitely do not want to (and cannot) handle.
The bug here is that spurious interrupts should never result in any state change, and we should just return to the interrupted context. Moving the handling of spurious interrupts as early as possible in the GICv3 handler fixes this issue.
--- drivers/irqchip/irq-gic-v3.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/irqchip/irq-gic-v3.c +4 -4
@@ -648,6 +648,10 @@ static asmlinkage void __exception_irq_e irqnr =gic_read_iar (); +/* Check for special IDs first */ +if ((irqnr >=1020 && irqnr <=1023 )) +return ; +if (gic_supports_nmi () &&unlikely (gic_read_rpr () ==GICD_INT_NMI_PRI )) {gic_handle_nmi (irqnr, regs);
@@ -659,10 +663,6 @@ static asmlinkage void __exception_irq_egic_arch_enable_irqs (); } -/* Check for special IDs first */ -if ((irqnr >=1020 && irqnr <=1023 )) -return ; -if (static_branch_likely (&supports_deactivate_key))gic_write_eoir (irqnr);else
Greg Kroah-Hartman
maintainerPATCH 49/342 cifs: Return correct error code from smb2_get_enc_key
In reply to Greg Kroah-HartmanFrom: Paul Aurich <[email protected]>
commit 83728cbf366e334301091d5b808add468ab46b27 upstream.
Avoid a warning if the error percolates back up:
[440700.376476] CIFS VFS: \\otters.example.com crypt_message: Could not get encryption key [440700.386947] ------------[ cut here ]------------ [440700.386948] err = 1 [440700.386977] WARNING: CPU: 11 PID: 2733 at /build/linux-hwe-5.4-p6lk6L/linux-hwe-5.4-5.4.0/lib/errseq.c:74 errseq_set+0x5c/0x70 ... [440700.397304] CPU: 11 PID: 2733 Comm: tar Tainted: G OE 5.4.0-70-generic #78~18.04.1-Ubuntu ... [440700.397334] Call Trace: [440700.397346] __filemap_set_wb_err+0x1a/0x70 [440700.397419] cifs_writepages+0x9c7/0xb30 [cifs] [440700.397426] do_writepages+0x4b/0xe0 [440700.397444] __filemap_fdatawrite_range+0xcb/0x100 [440700.397455] filemap_write_and_wait+0x42/0xa0 [440700.397486] cifs_setattr+0x68b/0xf30 [cifs] [440700.397493] notify_change+0x358/0x4a0 [440700.397500] utimes_common+0xe9/0x1c0 [440700.397510] do_utimes+0xc5/0x150 [440700.397520] __x64_sys_utimensat+0x88/0xd0
--- fs/cifs/smb2ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/smb2ops.c +1 -1
@@ -4117,7 +4117,7 @@ smb2_get_enc_key(struct TCP_Server_Info }spin_unlock (&cifs_tcp_ses_lock); -return 1 ; +return -EAGAIN ; }/* * Encrypt or decrypt @rqst message. @rqst[0] has the following format:
Greg Kroah-Hartman
maintainerPATCH 50/342 cifs: fix out-of-bound memory access when calling smb3_notify() at mount point
In reply to Greg Kroah-HartmanFrom: Eugene Korenevsky <[email protected]>
commit a637f4ae037e1e0604ac008564934d63261a8fd1 upstream.
If smb3_notify() is called at mount point of CIFS, build_path_from_dentry() returns the pointer to kmalloc-ed memory with terminating zero (this is empty FileName to be passed to SMB2 CREATE request). This pointer is assigned to the path variable.
Then path + 1 (to skip first backslash symbol) is passed to cifs_convert_path_to_utf16(). This is incorrect for empty path and causes out-of-bound memory access.
Get rid of this "increase by one". cifs_convert_path_to_utf16() already contains the check for leading backslash in the path.
--- fs/cifs/smb2ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/smb2ops.c +1 -1
@@ -2201,7 +2201,7 @@ smb3_notify(const unsigned int xid, stru cifs_sb =CIFS_SB (inode->i_sb); - utf16_path =cifs_convert_path_to_utf16 (path +1 , cifs_sb); + utf16_path =cifs_convert_path_to_utf16 (path, cifs_sb);if (utf16_path ==NULL ) { rc = -ENOMEM ; goto notify_exit;
Greg Kroah-Hartman
maintainerPATCH 51/342 cifs: fix leak in cifs_smb3_do_mount() ctx
In reply to Greg Kroah-HartmanFrom: David Disseldorp <[email protected]>
commit 315db9a05b7a56810728589baa930864107e4634 upstream.
cifs_smb3_do_mount() calls smb3_fs_context_dup() and then cifs_setup_volume_info(). The latter's subsequent smb3_parse_devname() call overwrites the cifs_sb->ctx->UNC string already dup'ed by smb3_fs_context_dup(), resulting in a leak. E.g.
unreferenced object 0xffff888002980420 (size 32):
comm "mount", pid 160, jiffies 4294892541 (age 30.416s) hex dump (first 32 bytes):
5c 5c 31 39 32 2e 31 36 38 2e 31 37 34 2e 31 30 \\192.168.174.10
34 5c 72 61 70 69 64 6f 2d 73 68 61 72 65 00 00 4\rapido-share..
backtrace:
[<00000000069e12f6>] kstrdup+0x28/0x50
[<00000000b61f4032>] smb3_fs_context_dup+0x127/0x1d0 [cifs]
[<00000000c6e3e3bf>] cifs_smb3_do_mount+0x77/0x660 [cifs]
[<0000000063467a6b>] smb3_get_tree+0xdf/0x220 [cifs]
[<00000000716f731e>] vfs_get_tree+0x1b/0x90
[<00000000491d3892>] path_mount+0x62a/0x910
[<0000000046b2e774>] do_mount+0x50/0x70
[<00000000ca7b64dd>] __x64_sys_mount+0x81/0xd0
[<00000000b5122496>] do_syscall_64+0x33/0x40
[<000000002dd397af>] entry_SYSCALL_64_after_hwframe+0x44/0xaeThis change is a bandaid until the cifs_setup_volume_info() TODO and error handling issues are resolved.
--- fs/cifs/cifsfs.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/cifs/cifsfs.c +6 -0
@@ -823,6 +823,12 @@ cifs_smb3_do_mount(struct file_system_ty goto out; } +/* cifs_setup_volume_info->smb3_parse_devname() redups UNC & prepath */ +kfree (cifs_sb->ctx->UNC); + cifs_sb->ctx->UNC =NULL ; +kfree (cifs_sb->ctx->prepath); + cifs_sb->ctx->prepath =NULL ; + rc =cifs_setup_volume_info (cifs_sb->ctx,NULL , old_ctx->UNC);if (rc) { root =ERR_PTR (rc);
Greg Kroah-Hartman
maintainerPATCH 52/342 cifs: detect dead connections only when echoes are enabled.
In reply to Greg Kroah-HartmanFrom: Shyam Prasad N <[email protected]>
commit f4916649f98e2c7bdba38c6597a98c456c17317d upstream.
We can detect server unresponsiveness only if echoes are enabled. Echoes can be disabled under two scenarios:
1. The connection is low on credits, so we've disabled echoes/oplocks.
2. The connection has not seen any request till now (other than negotiate/sess-setup), which is when we enable these two, based on the credits available.
So this fix will check for dead connection, only when echo is enabled.
--- fs/cifs/connect.c | 1 + 1 file changed, 1 insertion(+)
fs/cifs/connect.c +1 -0
@@ -488,6 +488,7 @@ server_unresponsive(struct TCP_Server_In*/ if ((server->tcpStatus == CifsGood || server->tcpStatus == CifsNeedNegotiate) && + (!server->ops->can_echo || server->ops->can_echo (server)) &&time_after (jiffies, server->lstrp +3 * server->echo_interval)) {cifs_server_dbg (VFS ,"has not responded in %lu seconds. Reconnecting...\n" , (3 * server->echo_interval) /HZ );
Greg Kroah-Hartman
maintainerPATCH 53/342 cifs: fix regression when mounting shares with prefix paths
In reply to Greg Kroah-HartmanFrom: Paulo Alcantara <[email protected]>
commit 5c1acf3fe05ce443edba5e2110c9e581765f66a8 upstream.
The commit 315db9a05b7a ("cifs: fix leak in cifs_smb3_do_mount() ctx") revealed an existing bug when mounting shares that contain a prefix path or DFS links.
cifs_setup_volume_info() requires the @devname to contain the full path (UNC + prefix) to update the fs context with the new UNC and prepath values, however we were passing only the UNC path (old_ctx->UNC) in @device thus discarding any prefix paths.
Instead of concatenating both old_ctx->{UNC,prepath} and pass it in @devname, just keep the dup'ed values of UNC and prepath in cifs_sb->ctx after calling smb3_fs_context_dup(), and fix smb3_parse_devname() to correctly parse and not leak the new UNC and prefix paths.
--- fs/cifs/cifsfs.c | 8 +------- fs/cifs/connect.c | 24 ++++++++++++++++++------ fs/cifs/fs_context.c | 4 ++++ 3 files changed, 23 insertions(+), 13 deletions(-)
fs/cifs/cifsfs.c +1 -7
@@ -823,13 +823,7 @@ cifs_smb3_do_mount(struct file_system_ty goto out; } -/* cifs_setup_volume_info->smb3_parse_devname() redups UNC & prepath */ -kfree (cifs_sb->ctx->UNC); - cifs_sb->ctx->UNC =NULL ; -kfree (cifs_sb->ctx->prepath); - cifs_sb->ctx->prepath =NULL ; - - rc =cifs_setup_volume_info (cifs_sb->ctx,NULL , old_ctx->UNC); + rc =cifs_setup_volume_info (cifs_sb->ctx,NULL ,NULL );if (rc) { root =ERR_PTR (rc); goto out;
fs/cifs/connect.c +18 -6
@@ -3150,17 +3150,29 @@ out:int cifs_setup_volume_info (struct smb3_fs_context *ctx,const char *mntopts,const char *devname) { -int rc =0 ; +int rc; -smb3_parse_devname (devname, ctx); +if (devname) { +cifs_dbg (FYI ,"%s: devname=%s\n" , __func__, devname); + rc =smb3_parse_devname (devname, ctx); +if (rc) { +cifs_dbg (VFS ,"%s: failed to parse %s: %d\n" , __func__, devname, rc); +return rc; + } + }if (mntopts) {char *ip; -cifs_dbg (FYI ,"%s: mntopts=%s\n" , __func__, mntopts); rc =smb3_parse_opt (mntopts,"ip" , &ip); -if (!rc && !cifs_convert_address ((struct sockaddr *)&ctx->dstaddr, ip, -strlen (ip))) { +if (rc) { +cifs_dbg (VFS ,"%s: failed to parse ip options: %d\n" , __func__, rc); +return rc; + } + + rc =cifs_convert_address ((struct sockaddr *)&ctx->dstaddr, ip,strlen (ip)); +kfree (ip); +if (!rc) {cifs_dbg (VFS ,"%s: failed to convert ip address\n" , __func__);return -EINVAL ; }
@@ -3180,7 +3192,7 @@ cifs_setup_volume_info(struct smb3_fs_coreturn -EINVAL ; } -return rc; +return 0 ; } static int
fs/cifs/fs_context.c +4 -0
@@ -473,6 +473,7 @@ smb3_parse_devname(const char *devname,/* move "pos" up to delimiter or NULL */ pos += len; +kfree (ctx->UNC); ctx->UNC =kstrndup (devname, pos - devname,GFP_KERNEL );if (!ctx->UNC)return -ENOMEM ;
@@ -483,6 +484,9 @@ smb3_parse_devname(const char *devname,if (*pos =='/' || *pos =='\\' ) pos++; +kfree (ctx->prepath); + ctx->prepath =NULL ; +/* If pos is NULL then no prepath */ if (!*pos)return 0 ;
Greg Kroah-Hartman
maintainerPATCH 54/342 smb2: fix use-after-free in smb2_ioctl_query_info()
In reply to Greg Kroah-HartmanFrom: Aurelien Aptel <[email protected]>
commit ccd48ec3d4a6cc595b2d9c5146e63b6c23546701 upstream.
* rqst[1,2,3] is allocated in vars
* each rqst->rq_iov is also allocated in vars or using pooled memory
SMB2_open_free, SMB2_ioctl_free, SMB2_query_info_free are iterating on each rqst after vars has been freed (use-after-free), and they are freeing the kvec a second time (double-free).
How to trigger:
* compile with KASAN
* mount a share
$ smbinfo quota /mnt/foo Segmentation fault $ dmesg
==================================================================
BUG: KASAN: use-after-free in SMB2_open_free+0x1c/0xa0
Read of size 8 at addr ffff888007b10c00 by task python3/1200
CPU: 2 PID: 1200 Comm: python3 Not tainted 5.12.0-rc6+ #107
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.14.0-0-g155821a-rebuilt.opensuse.org 04/01/2014
Call Trace:
dump_stack+0x93/0xc2
print_address_description.constprop.0+0x18/0x130
? SMB2_open_free+0x1c/0xa0
? SMB2_open_free+0x1c/0xa0
kasan_report.cold+0x7f/0x111
? smb2_ioctl_query_info+0x240/0x990
? SMB2_open_free+0x1c/0xa0
SMB2_open_free+0x1c/0xa0
smb2_ioctl_query_info+0x2bf/0x990
? smb2_query_reparse_tag+0x600/0x600
? cifs_mapchar+0x250/0x250
? rcu_read_lock_sched_held+0x3f/0x70
? cifs_strndup_to_utf16+0x12c/0x1c0
? rwlock_bug.part.0+0x60/0x60
? rcu_read_lock_sched_held+0x3f/0x70
? cifs_convert_path_to_utf16+0xf8/0x140
? smb2_check_message+0x6f0/0x6f0
cifs_ioctl+0xf18/0x16b0
? smb2_query_reparse_tag+0x600/0x600
? cifs_readdir+0x1800/0x1800
? selinux_bprm_creds_for_exec+0x4d0/0x4d0
? do_user_addr_fault+0x30b/0x950
? __x64_sys_openat+0xce/0x140
__x64_sys_ioctl+0xb9/0xf0
do_syscall_64+0x33/0x40
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fdcf1f4ba87
Code: b3 66 90 48 8b 05 11 14 2c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e1 13 2c 00 f7 d8 64 89 01 48
RSP: 002b:00007ffef1ce7748 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000c018cf07 RCX: 00007fdcf1f4ba87
RDX: 0000564c467c5590 RSI: 00000000c018cf07 RDI: 0000000000000003
RBP: 00007ffef1ce7770 R08: 00007ffef1ce7420 R09: 00007fdcf0e0562b
R10: 0000000000000100 R11: 0000000000000246 R12: 0000000000004018
R13: 0000000000000001 R14: 0000000000000003 R15: 0000564c467c5590
Allocated by task 1200:
kasan_save_stack+0x1b/0x40
__kasan_kmalloc+0x7a/0x90
smb2_ioctl_query_info+0x10e/0x990
cifs_ioctl+0xf18/0x16b0
__x64_sys_ioctl+0xb9/0xf0
do_syscall_64+0x33/0x40
entry_SYSCALL_64_after_hwframe+0x44/0xae
Freed by task 1200:
kasan_save_stack+0x1b/0x40
kasan_set_track+0x1c/0x30
kasan_set_free_info+0x20/0x30
__kasan_slab_free+0xe5/0x110
slab_free_freelist_hook+0x53/0x130
kfree+0xcc/0x320
smb2_ioctl_query_info+0x2ad/0x990
cifs_ioctl+0xf18/0x16b0
__x64_sys_ioctl+0xb9/0xf0
do_syscall_64+0x33/0x40
entry_SYSCALL_64_after_hwframe+0x44/0xae
The buggy address belongs to the object at ffff888007b10c00
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 0 bytes inside of
512-byte region [ffff888007b10c00, ffff888007b10e00)
The buggy address belongs to the page:
page:0000000044e14b75 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7b10
head:0000000044e14b75 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x100000000010200(slab|head)
raw: 0100000000010200 ffffea000015f500 0000000400000004 ffff888001042c80
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888007b10b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888007b10b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888007b10c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888007b10c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888007b10d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================--- fs/cifs/smb2ops.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-)
fs/cifs/smb2ops.c +5 -9
@@ -1732,18 +1732,14 @@ smb2_ioctl_query_info(const unsigned int } iqinf_exit: -kfree (vars); -kfree (buffer); -SMB2_open_free (&rqst[0 ]); -if (qi.flags &PASSTHRU_FSCTL ) -SMB2_ioctl_free (&rqst[1 ]); -else -SMB2_query_info_free (&rqst[1 ]); - -SMB2_close_free (&rqst[2 ]); +cifs_small_buf_release (rqst[0 ].rq_iov[0 ].iov_base); +cifs_small_buf_release (rqst[1 ].rq_iov[0 ].iov_base); +cifs_small_buf_release (rqst[2 ].rq_iov[0 ].iov_base);free_rsp_buf (resp_buftype[0 ], rsp_iov[0 ].iov_base);free_rsp_buf (resp_buftype[1 ], rsp_iov[1 ].iov_base);free_rsp_buf (resp_buftype[2 ], rsp_iov[2 ].iov_base); +kfree (vars); +kfree (buffer);return rc; e_fault:
Greg Kroah-Hartman
maintainerPATCH 55/342 btrfs: handle remount to no compress during compression
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit 1d8ba9e7e785b6625f4d8e978e8a284b144a7077 upstream.
[BUG]
When running btrfs/071 with inode_need_compress() removed from compress_file_range(), we got the following crash:
BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Workqueue: btrfs-delalloc btrfs_work_helper [btrfs] RIP: 0010:compress_file_range+0x476/0x7b0 [btrfs] Call Trace: ? submit_compressed_extents+0x450/0x450 [btrfs] async_cow_start+0x16/0x40 [btrfs] btrfs_work_helper+0xf2/0x3e0 [btrfs] process_one_work+0x278/0x5e0 worker_thread+0x55/0x400 ? process_one_work+0x5e0/0x5e0 kthread+0x168/0x190 ? kthread_create_worker_on_cpu+0x70/0x70 ret_from_fork+0x22/0x30 ---[ end trace 65faf4eae941fa7d ]---
This is already after the patch "btrfs: inode: fix NULL pointer dereference if inode doesn't need compression."
[CAUSE]
@pages is firstly created by kcalloc() in compress_file_extent():
pages = kcalloc(nr_pages, sizeof(struct page *), GFP_NOFS);
Then passed to btrfs_compress_pages() to be utilized there:
ret = btrfs_compress_pages(...
pages,
&nr_pages,
...);btrfs_compress_pages() will initialize each page as output, in zlib_compress_pages() we have:
pages[nr_pages] = out_page;
nr_pages++;Normally this is completely fine, but there is a special case which is in btrfs_compress_pages() itself:
switch (type) {
default:
return -E2BIG;
}In this case, we didn't modify @pages nor @out_pages, leaving them untouched, then when we cleanup pages, the we can hit NULL pointer dereference again:
if (pages) {
for (i = 0; i < nr_pages; i++) {
WARN_ON(pages[i]->mapping);
put_page(pages[i]);
}
...
}Since pages[i] are all initialized to zero, and btrfs_compress_pages() doesn't change them at all, accessing pages[i]->mapping would lead to NULL pointer dereference.
This is not possible for current kernel, as we check inode_need_compress() before doing pages allocation. But if we're going to remove that inode_need_compress() in compress_file_extent(), then it's going to be a problem.
[FIX]
When btrfs_compress_pages() hits its default case, modify @out_pages to 0 to prevent such problem from happening.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=212331
--- fs/btrfs/compression.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
fs/btrfs/compression.c +8 -3
@@ -80,10 +80,15 @@ static int compression_compress_pages(incase BTRFS_COMPRESS_NONE :default :/* -* This can't happen, the type is validated several times -* before we get here. As a sane fallback, return what the -* callers will understand as 'no compression happened'. +* This can happen when compression races with remount setting +* it to 'no compress', while caller doesn't call +* inode_need_compress() to check if we really need to +* compress. +* +* Not a big deal, just need to inform caller that we +* haven't allocated any pages yet. */ + *out_pages =0 ;return -E2BIG ; } }
Greg Kroah-Hartman
maintainerPATCH 56/342 x86/build: Disable HIGHMEM64G selection for M486SX
In reply to Greg Kroah-HartmanFrom: Maciej W. Rozycki <[email protected]>
commit 0ef3439cd80ba7770723edb0470d15815914bb62 upstream.
Fix a regression caused by making the 486SX separately selectable in Kconfig, for which the HIGHMEM64G setting has not been updated and therefore has become exposed as a user-selectable option for the M486SX configuration setting unlike with original M486 and all the other settings that choose non-PAE-enabled processors:
High Memory Support
Quoted 1 line
1. off (NOHIGHMEM)
2. 4GB (HIGHMEM4G)
3. 64GB (HIGHMEM64G)
choice[1-3?]:
With the fix in place the setting is now correctly removed:
High Memory Support
Quoted 1 line
1. off (NOHIGHMEM)
2. 4GB (HIGHMEM4G)
choice[1-2?]:
[ bp: Massage commit message. ]
--- arch/x86/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/Kconfig +1 -1
@@ -1416,7 +1416,7 @@ config HIGHMEM4G config HIGHMEM64G bool "64GB" - depends on !M486 && !M586 && !M586TSC && !M586MMX && !MGEODE_LX && !MGEODEGX1 && !MCYRIXIII && !MELAN && !MWINCHIPC6 && !WINCHIP3D && !MK6 + depends on !M486SX && !M486 && !M586 && !M586TSC && !M586MMX && !MGEODE_LX && !MGEODEGX1 && !MCYRIXIII && !MELAN && !MWINCHIPC6 && !WINCHIP3D && !MK6 select X86_PAE help Select this if you have a 32-bit processor and more than 4
Greg Kroah-Hartman
maintainerPATCH 57/342 btrfs: fix metadata extent leak after failure to create subvolume
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 67addf29004c5be9fa0383c82a364bb59afc7f84 upstream.
When creating a subvolume we allocate an extent buffer for its root node after starting a transaction. We setup a root item for the subvolume that points to that extent buffer and then attempt to insert the root item into the root tree - however if that fails, due to ENOMEM for example, we do not free the extent buffer previously allocated and we do not abort the transaction (as at that point we did nothing that can not be undone).
This means that we effectively do not return the metadata extent back to the free space cache/tree and we leave a delayed reference for it which causes a metadata extent item to be added to the extent tree, in the next transaction commit, without having backreferences. When this happens 'btrfs check' reports the following:
$ btrfs check /dev/sdi Opening filesystem to check... Checking filesystem on /dev/sdi UUID: dce2cb9d-025f-4b05-a4bf-cee0ad3785eb [1/7] checking root items [2/7] checking extents ref mismatch on [30425088 16384] extent item 1, found 0 backref 30425088 root 256 not referenced back 0x564a91c23d70 incorrect global backref count on 30425088 found 1 wanted 0 backpointer mismatch on [30425088 16384] owner ref check failed [30425088 16384] ERROR: errors found in extent allocation tree or chunk allocation [3/7] checking free space cache [4/7] checking fs roots [5/7] checking only csums items (without verifying data) [6/7] checking root refs [7/7] checking quota groups skipped (not enabled on this FS) found 212992 bytes used, error(s) found total csum bytes: 0 total tree bytes: 131072 total fs tree bytes: 32768 total extent tree bytes: 16384 btree space waste bytes: 124669 file data blocks allocated: 65536 referenced 65536
So fix this by freeing the metadata extent if btrfs_insert_root() returns an error.
--- fs/btrfs/ioctl.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
fs/btrfs/ioctl.c +15 -3
@@ -690,8 +690,6 @@ static noinline int create_subvol(structbtrfs_set_root_otransid (root_item, trans->transid);btrfs_tree_unlock (leaf); -free_extent_buffer (leaf); - leaf =NULL ;btrfs_set_root_dirid (root_item, new_dirid);
@@ -700,8 +698,22 @@ static noinline int create_subvol(struct key.type =BTRFS_ROOT_ITEM_KEY ; ret =btrfs_insert_root (trans, fs_info->tree_root, &key, root_item); -if (ret) +if (ret) { +/* +* Since we don't abort the transaction in this case, free the +* tree block so that we don't leak space and leave the +* filesystem in an inconsistent state (an extent item in the +* extent tree without backreferences). Also no need to have +* the tree block locked since it is not in any tree at this +* point, so no other task can find it and use it. +*/ +btrfs_free_tree_block (trans, root, leaf,0 ,1 ); +free_extent_buffer (leaf); goto fail; + } + +free_extent_buffer (leaf); + leaf =NULL ; key.offset = (u64)-1 ; new_root =btrfs_get_new_fs_root (fs_info, objectid, anon_dev);
Greg Kroah-Hartman
maintainerPATCH 58/342 intel_th: pci: Add Rocket Lake CPU support
In reply to Greg Kroah-HartmanFrom: Alexander Shishkin <[email protected]>
commit 9f7f2a5e01ab4ee56b6d9c0572536fe5fd56e376 upstream.
This adds support for the Trace Hub in Rocket Lake CPUs.
--- drivers/hwtracing/intel_th/pci.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/hwtracing/intel_th/pci.c +5 -0
@@ -278,6 +278,11 @@ static const struct pci_device_id intel_ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x466f), .driver_data = (kernel_ulong_t)&intel_th_2x, }, + { +/* Rocket Lake CPU */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4c19), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, { 0 }, };
Greg Kroah-Hartman
maintainerPATCH 59/342 btrfs: fix race between transaction aborts and fsyncs leading to use-after-free
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 061dde8245356d8864d29e25207aa4daa0be4d3c upstream.
There is a race between a task aborting a transaction during a commit, a task doing an fsync and the transaction kthread, which leads to an use-after-free of the log root tree. When this happens, it results in a stack trace like the following:
BTRFS info (device dm-0): forced readonly
BTRFS warning (device dm-0): Skipping commit of aborted transaction.
BTRFS: error (device dm-0) in cleanup_transaction:1958: errno=-5 IO failure
BTRFS warning (device dm-0): lost page write due to IO error on /dev/mapper/error-test (-5) BTRFS warning (device dm-0): Skipping commit of aborted transaction.
BTRFS warning (device dm-0): direct IO failed ino 261 rw 0,0 sector 0xa4e8 len 4096 err no 10 BTRFS error (device dm-0): error writing primary super block to device 1
BTRFS warning (device dm-0): direct IO failed ino 261 rw 0,0 sector 0x12e000 len 4096 err no 10 BTRFS warning (device dm-0): direct IO failed ino 261 rw 0,0 sector 0x12e008 len 4096 err no 10 BTRFS warning (device dm-0): direct IO failed ino 261 rw 0,0 sector 0x12e010 len 4096 err no 10
BTRFS: error (device dm-0) in write_all_supers:4110: errno=-5 IO failure (1 errors while writing supers)
BTRFS: error (device dm-0) in btrfs_sync_log:3308: errno=-5 IO failure
general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b68: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI CPU: 2 PID: 2458471 Comm: fsstress Not tainted 5.12.0-rc5-btrfs-next-84 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:__mutex_lock+0x139/0xa40 Code: c0 74 19 (...) RSP: 0018:ffff9f18830d7b00 EFLAGS: 00010202 RAX: 6b6b6b6b6b6b6b68 RBX: 0000000000000001 RCX: 0000000000000002 RDX: ffffffffb9c54d13 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff9f18830d7bc0 R08: 0000000000000000 R09: 0000000000000000 R10: ffff9f18830d7be0 R11: 0000000000000001 R12: ffff8c6cd199c040 R13: ffff8c6c95821358 R14: 00000000fffffffb R15: ffff8c6cbcf01358 FS: 00007fa9140c2b80(0000) GS:ffff8c6fac600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa913d52000 CR3: 000000013d2b4003 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? __btrfs_handle_fs_error+0xde/0x146 [btrfs] ? btrfs_sync_log+0x7c1/0xf20 [btrfs] ? btrfs_sync_log+0x7c1/0xf20 [btrfs] btrfs_sync_log+0x7c1/0xf20 [btrfs] btrfs_sync_file+0x40c/0x580 [btrfs] do_fsync+0x38/0x70 __x64_sys_fsync+0x10/0x20 do_syscall_64+0x33/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fa9142a55c3 Code: 8b 15 09 (...) RSP: 002b:00007fff26278d48 EFLAGS: 00000246 ORIG_RAX: 000000000000004a RAX: ffffffffffffffda RBX: 0000563c83cb4560 RCX: 00007fa9142a55c3 RDX: 00007fff26278cb0 RSI: 00007fff26278cb0 RDI: 0000000000000005 RBP: 0000000000000005 R08: 0000000000000001 R09: 00007fff26278d5c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000340 R13: 00007fff26278de0 R14: 00007fff26278d96 R15: 0000563c83ca57c0 Modules linked in: btrfs dm_zero dm_snapshot dm_thin_pool (...) ---[ end trace ee2f1b19327d791d ]---
The steps that lead to this crash are the following:
1) We are at transaction N;
2) We have two tasks with a transaction handle attached to transaction N. Task A and Task B. Task B is doing an fsync;
3) Task B is at btrfs_sync_log(), and has saved fs_info->log_root_tree into a local variable named 'log_root_tree' at the top of btrfs_sync_log(). Task B is about to call write_all_supers(), but before that...
4) Task A calls btrfs_commit_transaction(), and after it sets the transaction state to TRANS_STATE_COMMIT_START, an error happens before it waits for the transaction's 'num_writers' counter to reach a value of 1 (no one else attached to the transaction), so it jumps to the label "cleanup_transaction";
5) Task A then calls cleanup_transaction(), where it aborts the transaction, setting BTRFS_FS_STATE_TRANS_ABORTED on fs_info->fs_state, setting the ->aborted field of the transaction and the handle to an errno value and also setting BTRFS_FS_STATE_ERROR on fs_info->fs_state.
After that, at cleanup_transaction(), it deletes the transaction from the list of transactions (fs_info->trans_list), sets the transaction to the state TRANS_STATE_COMMIT_DOING and then waits for the number of writers to go down to 1, as it's currently 2 (1 for task A and 1 for task B);
6) The transaction kthread is running and sees that BTRFS_FS_STATE_ERROR is set in fs_info->fs_state, so it calls btrfs_cleanup_transaction().
There it sees the list fs_info->trans_list is empty, and then proceeds into calling btrfs_drop_all_logs(), which frees the log root tree with a call to btrfs_free_log_root_tree();
7) Task B calls write_all_supers() and, shortly after, under the label 'out_wake_log_root', it deferences the pointer stored in 'log_root_tree', which was already freed in the previous step by the transaction kthread. This results in a use-after-free leading to a crash.
Fix this by deleting the transaction from the list of transactions at cleanup_transaction() only after setting the transaction state to TRANS_STATE_COMMIT_DOING and waiting for all existing tasks that are attached to the transaction to release their transaction handles. This makes the transaction kthread wait for all the tasks attached to the transaction to be done with the transaction before dropping the log roots and doing other cleanups.
--- fs/btrfs/transaction.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
fs/btrfs/transaction.c +11 -1
@@ -1947,7 +1947,6 @@ static void cleanup_transaction(struct b*/ BUG_ON (list_empty (&cur_trans->list)); -list_del_init (&cur_trans->list);if (cur_trans == fs_info->running_transaction) { cur_trans->state =TRANS_STATE_COMMIT_DOING ;spin_unlock (&fs_info->trans_lock);
@@ -1956,6 +1955,17 @@ static void cleanup_transaction(struct bspin_lock (&fs_info->trans_lock); } + +/* +* Now that we know no one else is still using the transaction we can +* remove the transaction from the list of transactions. This avoids +* the transaction kthread from cleaning up the transaction while some +* other task is still using it, which could result in a use-after-free +* on things like log trees, as it forces the transaction kthread to +* wait for this transaction to be cleaned up by us. +*/ +list_del_init (&cur_trans->list); +spin_unlock (&fs_info->trans_lock);btrfs_cleanup_one_transaction (trans->transaction, fs_info);
Greg Kroah-Hartman
maintainerPATCH 60/342 posix-timers: Preserve return value in clock_adjtime32()
In reply to Greg Kroah-HartmanFrom: Chen Jun <[email protected]>
commit 2d036dfa5f10df9782f5278fc591d79d283c1fad upstream.
The return value on success (>= 0) is overwritten by the return value of put_old_timex32(). That works correct in the fault case, but is wrong for the success case where put_old_timex32() returns 0.
Just check the return value of put_old_timex32() and return -EFAULT in case it is not zero.
[ tglx: Massage changelog ]
--- kernel/time/posix-timers.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/time/posix-timers.c +2 -2
@@ -1191,8 +1191,8 @@ SYSCALL_DEFINE2(clock_adjtime32, clockid err =do_clock_adjtime (which_clock, &ktx); -if (err >=0 ) - err =put_old_timex32 (utp, &ktx); +if (err >=0 &&put_old_timex32 (utp, &ktx)) +return -EFAULT ;return err; }
Greg Kroah-Hartman
maintainerPATCH 61/342 fbdev: zero-fill colormap in fbcmap.c
In reply to Greg Kroah-HartmanFrom: Phillip Potter <[email protected]>
commit 19ab233989d0f7ab1de19a036e247afa4a0a1e9c upstream.
Use kzalloc() rather than kmalloc() for the dynamically allocated parts of the colormap in fb_alloc_cmap_gfp, to prevent a leak of random kernel data to userspace under certain circumstances.
Fixes a KMSAN-found infoleak bug reported by syzbot at:
https://syzkaller.appspot.com/bug?id=741578659feabd108ad9e06696f0c1f2e69c4b6e
--- drivers/video/fbdev/core/fbcmap.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/video/fbdev/core/fbcmap.c +4 -4
@@ -101,17 +101,17 @@ int fb_alloc_cmap_gfp(struct fb_cmap *cmif (!len)return 0 ; - cmap->red =kmalloc (size, flags); + cmap->red =kzalloc (size, flags);if (!cmap->red) goto fail; - cmap->green =kmalloc (size, flags); + cmap->green =kzalloc (size, flags);if (!cmap->green) goto fail; - cmap->blue =kmalloc (size, flags); + cmap->blue =kzalloc (size, flags);if (!cmap->blue) goto fail;if (transp) { - cmap->transp =kmalloc (size, flags); + cmap->transp =kzalloc (size, flags);if (!cmap->transp) goto fail; }else {
Greg Kroah-Hartman
maintainerPATCH 62/342 cpuidle: tegra: Fix C7 idling state on Tegra114
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
commit 32c8c34d8132b5fe8497c2538597445a0d65c29d upstream.
Trusted Foundation firmware doesn't implement the do_idle call and in this case suspending should fall back to the common suspend path. In order to fix this issue we will unconditionally set the NOFLUSH_L2 mode via firmware call, which is a NO-OP on Tegra30/124, and then proceed to the C7 idling, like it was done by the older Tegra114 cpuidle driver.
--- drivers/cpuidle/cpuidle-tegra.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/cpuidle/cpuidle-tegra.c +6 -6
@@ -135,13 +135,13 @@ static int tegra_cpuidle_c7_enter(void) {int err; -if (tegra_cpuidle_using_firmware ()) { - err =call_firmware_op (prepare_idle,TF_PM_MODE_LP2_NOFLUSH_L2 ); -if (err) -return err; + err =call_firmware_op (prepare_idle,TF_PM_MODE_LP2_NOFLUSH_L2 ); +if (err && err != -ENOSYS ) +return err; -return call_firmware_op (do_idle,0 ); - } + err =call_firmware_op (do_idle,0 ); +if (err != -ENOSYS ) +return err;return cpu_suspend (0 , tegra30_pm_secondary_cpu_suspend); }
Greg Kroah-Hartman
maintainerPATCH 63/342 bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit 4700a00755fb5a4bb5109128297d6fd2d1272ee6 ]
We want to probe l4_wkup and l4_cfg interconnect devices first to avoid issues with missing resources. Otherwise we attempt to probe l4_per devices first causing pointless deferred probe and also annoyingh renumbering of the MMC devices for example.
--- drivers/bus/ti-sysc.c | 49 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+)
drivers/bus/ti-sysc.c +49 -0
@@ -635,6 +635,51 @@ static int sysc_parse_and_check_child_range(struct sysc *ddata)return 0 ; } +/* Interconnect instances to probe before l4_per instances */ +static struct resource early_bus_ranges[] = { +/* am3/4 l4_wkup */ + { .start =0x44c00000 , .end =0x44c00000 +0x300000 , }, +/* omap4/5 and dra7 l4_cfg */ + { .start =0x4a000000 , .end =0x4a000000 +0x300000 , }, +/* omap4 l4_wkup */ + { .start =0x4a300000 , .end =0x4a300000 +0x30000 , }, +/* omap5 and dra7 l4_wkup without dra7 dcan segment */ + { .start =0x4ae00000 , .end =0x4ae00000 +0x30000 , }, +}; + +static atomic_t sysc_defer =ATOMIC_INIT (10 ); + +/** +* sysc_defer_non_critical - defer non_critical interconnect probing +* @ddata: device driver data +* +* We want to probe l4_cfg and l4_wkup interconnect instances before any +* l4_per instances as l4_per instances depend on resources on l4_cfg and +* l4_wkup interconnects. +*/ +static int sysc_defer_non_critical (struct sysc *ddata) +{ +struct resource *res; +int i; + +if (!atomic_read (&sysc_defer)) +return 0 ; + +for (i =0 ; i <ARRAY_SIZE (early_bus_ranges); i++) { + res = &early_bus_ranges[i]; +if (ddata->module_pa >= res->start && + ddata->module_pa <= res->end) { +atomic_set (&sysc_defer,0 ); + +return 0 ; + } + } + +atomic_dec_if_positive (&sysc_defer); + +return -EPROBE_DEFER ; +} +static struct device_node *stdout_path;static void sysc_init_stdout_path (struct sysc *ddata)
@@ -863,6 +908,10 @@ static int sysc_map_and_check_registers(struct sysc *ddata)if (error)return error; + error =sysc_defer_non_critical (ddata); +if (error) +return error; +sysc_check_children (ddata); error =sysc_parse_registers (ddata);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 64/342 staging: wimax/i2400m: fix byte-order issue
In reply to Greg Kroah-HartmanFrom: karthik alapati <[email protected]>
[ Upstream commit 0c37baae130df39b19979bba88bde2ee70a33355 ]
fix sparse byte-order warnings by converting host byte-order type to __le16 byte-order types before assigning to hdr.length
--- drivers/staging/wimax/i2400m/op-rfkill.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/wimax/i2400m/op-rfkill.c +1 -1
@@ -86,7 +86,7 @@ int i2400m_op_rfkill_sw_toggle(struct wimax_dev *wimax_dev,if (cmd ==NULL ) goto error_alloc; cmd->hdr.type =cpu_to_le16 (I2400M_MT_CMD_RF_CONTROL ); - cmd->hdr.length =sizeof (cmd->sw_rf); + cmd->hdr.length =cpu_to_le16 (sizeof (cmd->sw_rf)); cmd->hdr.version =cpu_to_le16 (I2400M_L3L4_VERSION ); cmd->sw_rf.hdr.type =cpu_to_le16 (I2400M_TLV_RF_OPERATION ); cmd->sw_rf.hdr.length =cpu_to_le16 (sizeof (cmd->sw_rf.status));
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 65/342 spi: ath79: always call chipselect function
In reply to Greg Kroah-HartmanFrom: David Bauer <[email protected]>
[ Upstream commit 19e2132174583beb90c1bd3e9c842bc6d5c944d1 ]
spi-bitbang has to call the chipselect function on the ath79 SPI driver in order to communicate with the SPI slave device, as the ath79 SPI driver has three dedicated chipselect lines but can also be used with GPIOs for the CS lines.
Fixes commit 4a07b8bcd503 ("spi: bitbang: Make chipselect callback optional")
--- drivers/spi/spi-ath79.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-ath79.c +1 -0
@@ -158,6 +158,7 @@ static int ath79_spi_probe(struct platform_device *pdev) master->bits_per_word_mask =SPI_BPW_RANGE_MASK (1 ,32 ); master->setup = spi_bitbang_setup; master->cleanup = spi_bitbang_cleanup; + master->flags =SPI_MASTER_GPIO_SS ;if (pdata) { master->bus_num = pdata->bus_num; master->num_chipselect = pdata->num_chipselect;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 66/342 spi: ath79: remove spi-master setup and cleanup assignment
In reply to Greg Kroah-HartmanFrom: David Bauer <[email protected]>
[ Upstream commit ffb597b2bd3cd78b9bfb68f536743cd46dbb2cc4 ]
This removes the assignment of setup and cleanup functions for the ath79 target. Assigning the setup-method will lead to 'setup_transfer' not being assigned in spi_bitbang_init. Because of this, performing any TX/RX operation will lead to a kernel oops.
Also drop the redundant cleanup assignment, as it's also assigned in spi_bitbang_init.
--- drivers/spi/spi-ath79.c | 2 -- 1 file changed, 2 deletions(-)
drivers/spi/spi-ath79.c +0 -2
@@ -156,8 +156,6 @@ static int ath79_spi_probe(struct platform_device *pdev) master->use_gpio_descriptors = true; master->bits_per_word_mask =SPI_BPW_RANGE_MASK (1 ,32 ); - master->setup = spi_bitbang_setup; - master->cleanup = spi_bitbang_cleanup; master->flags =SPI_MASTER_GPIO_SS ;if (pdata) { master->bus_num = pdata->bus_num;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 67/342 bus: mhi: core: Destroy SBL devices when moving to mission mode
In reply to Greg Kroah-HartmanFrom: Bhaumik Bhatt <[email protected]>
[ Upstream commit 925089c1900f588615db5bf4e1d9064a5f2c18c7 ]
Currently, client devices are created in SBL or AMSS (mission mode) and only destroyed after power down or SYS ERROR. When moving between certain execution environments, such as from SBL to AMSS, no clean-up is required. This presents an issue where SBL-specific channels are left open and client drivers now run in an execution environment where they cannot operate. Fix this by expanding the mhi_destroy_device() to do an execution environment specific clean-up if one is requested. Close the gap and destroy devices in such scenarios that allow SBL client drivers to clean up once device enters mission mode.
--- drivers/bus/mhi/core/main.c | 29 +++++++++++++++++++++++++---- drivers/bus/mhi/core/pm.c | 3 +++ 2 files changed, 28 insertions(+), 4 deletions(-)
drivers/bus/mhi/core/main.c +25 -4
@@ -229,8 +229,10 @@ static bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr)int mhi_destroy_device (struct device *dev,void *data) { +struct mhi_chan *ul_chan, *dl_chan;struct mhi_device *mhi_dev;struct mhi_controller *mhi_cntrl; +enum mhi_ee_type ee =MHI_EE_MAX ;if (dev->bus != &mhi_bus_type)return 0 ;
@@ -242,6 +244,17 @@ int mhi_destroy_device(struct device *dev, void *data)if (mhi_dev->dev_type ==MHI_DEVICE_CONTROLLER )return 0 ; + ul_chan = mhi_dev->ul_chan; + dl_chan = mhi_dev->dl_chan; + +/* +* If execution environment is specified, remove only those devices that +* started in them based on ee_mask for the channels as we move on to a +* different execution environment +*/ +if (data) + ee = *(enum mhi_ee_type *)data; +/* * For the suspend and resume case, this function will get called * without mhi_unregister_controller(). Hence, we need to drop the
@@ -249,11 +262,19 @@ int mhi_destroy_device(struct device *dev, void *data)* be sure that there will be no instances of mhi_dev left after * this. */ -if (mhi_dev->ul_chan) -put_device (&mhi_dev->ul_chan->mhi_dev->dev); +if (ul_chan) { +if (ee !=MHI_EE_MAX && !(ul_chan->ee_mask &BIT (ee))) +return 0 ; -if (mhi_dev->dl_chan) -put_device (&mhi_dev->dl_chan->mhi_dev->dev); +put_device (&ul_chan->mhi_dev->dev); + } + +if (dl_chan) { +if (ee !=MHI_EE_MAX && !(dl_chan->ee_mask &BIT (ee))) +return 0 ; + +put_device (&dl_chan->mhi_dev->dev); + }dev_dbg (&mhi_cntrl->mhi_dev->dev,"destroy device for chan:%s\n" , mhi_dev->name);
drivers/bus/mhi/core/pm.c +3 -0
@@ -377,6 +377,7 @@ static int mhi_pm_mission_mode_transition(struct mhi_controller *mhi_cntrl) {struct mhi_event *mhi_event;struct device *dev = &mhi_cntrl->mhi_dev->dev; +enum mhi_ee_type current_ee = mhi_cntrl->ee;int i, ret;dev_dbg (dev,"Processing Mission Mode transition\n" );
@@ -395,6 +396,8 @@ static int mhi_pm_mission_mode_transition(struct mhi_controller *mhi_cntrl)wake_up_all (&mhi_cntrl->state_event); +device_for_each_child (&mhi_cntrl->mhi_dev->dev, ¤t_ee, + mhi_destroy_device); mhi_cntrl->status_cb (mhi_cntrl,MHI_CB_EE_MISSION_MODE );/* Force MHI to be in M0 state before continuing */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 68/342 bus: mhi: core: Process execution environment changes serially
In reply to Greg Kroah-HartmanFrom: Bhaumik Bhatt <[email protected]>
[ Upstream commit ef2126c4e2ea2b92f543fae00a2a0332e4573c48 ]
In current design, whenever the BHI interrupt is fired, the execution environment is updated. This can cause race conditions and impede ongoing power up/down processing. For example, if a power down is in progress, MHI host updates to a local "disabled" execution environment. If a BHI interrupt fires later, that value gets replaced with one from the BHI EE register. This impacts the controller as it does not expect multiple RDDM execution environment change status callbacks as an example. Another issue would be that the device can enter mission mode and the execution environment is updated, while device creation for SBL channels is still going on due to slower PM state worker thread run, leading to multiple attempts at opening the same channel.
Ensure that EE changes are handled only from appropriate places and occur one after another and handle only PBL modes or RDDM EE changes as critical events directly from the interrupt handler. Simplify handling by waiting for SYS ERROR before handling RDDM. This also makes sure that we use the correct execution environment to notify the controller driver when the device resets to one of the PBL execution environments.
--- drivers/bus/mhi/core/main.c | 40 +++++++++++++++++++------------------ drivers/bus/mhi/core/pm.c | 7 ++++--- 2 files changed, 25 insertions(+), 22 deletions(-)
drivers/bus/mhi/core/main.c +21 -19
@@ -412,7 +412,7 @@ irqreturn_t mhi_intvec_threaded_handler(int irq_number, void *priv)struct device *dev = &mhi_cntrl->mhi_dev->dev;enum mhi_state state =MHI_STATE_MAX ;enum mhi_pm_state pm_state =0 ; -enum mhi_ee_type ee =0 ; +enum mhi_ee_type ee =MHI_EE_MAX ;write_lock_irq (&mhi_cntrl->pm_lock);if (!MHI_REG_ACCESS_VALID (mhi_cntrl->pm_state)) {
@@ -421,8 +421,7 @@ irqreturn_t mhi_intvec_threaded_handler(int irq_number, void *priv) } state =mhi_get_mhi_state (mhi_cntrl); - ee = mhi_cntrl->ee; - mhi_cntrl->ee =mhi_get_exec_env (mhi_cntrl); + ee =mhi_get_exec_env (mhi_cntrl);dev_dbg (dev,"local ee:%s device ee:%s dev_state:%s\n" ,TO_MHI_EXEC_STR (mhi_cntrl->ee),TO_MHI_EXEC_STR (ee),TO_MHI_STATE_STR (state));
@@ -434,27 +433,30 @@ irqreturn_t mhi_intvec_threaded_handler(int irq_number, void *priv) }write_unlock_irq (&mhi_cntrl->pm_lock); -/* If device supports RDDM don't bother processing SYS error */ -if (mhi_cntrl->rddm_image) { -/* host may be performing a device power down already */ -if (!mhi_is_active (mhi_cntrl)) - goto exit_intvec; +if (pm_state !=MHI_PM_SYS_ERR_DETECT || ee == mhi_cntrl->ee) + goto exit_intvec; -if (mhi_cntrl->ee ==MHI_EE_RDDM && mhi_cntrl->ee != ee) { +switch (ee) { +case MHI_EE_RDDM : +/* proceed if power down is not already in progress */ +if (mhi_cntrl->rddm_image &&mhi_is_active (mhi_cntrl)) { mhi_cntrl->status_cb (mhi_cntrl,MHI_CB_EE_RDDM ); + mhi_cntrl->ee = ee;wake_up_all (&mhi_cntrl->state_event); } - goto exit_intvec; - } - -if (pm_state ==MHI_PM_SYS_ERR_DETECT ) { +break ; +case MHI_EE_PBL : +case MHI_EE_EDL : +case MHI_EE_PTHRU : + mhi_cntrl->status_cb (mhi_cntrl,MHI_CB_FATAL_ERROR ); + mhi_cntrl->ee = ee;wake_up_all (&mhi_cntrl->state_event); - -/* For fatal errors, we let controller decide next step */ -if (MHI_IN_PBL (ee)) - mhi_cntrl->status_cb (mhi_cntrl,MHI_CB_FATAL_ERROR ); -else -mhi_pm_sys_err_handler (mhi_cntrl); +mhi_pm_sys_err_handler (mhi_cntrl); +break ; +default : +wake_up_all (&mhi_cntrl->state_event); +mhi_pm_sys_err_handler (mhi_cntrl); +break ; } exit_intvec:
drivers/bus/mhi/core/pm.c +4 -3
@@ -377,21 +377,22 @@ static int mhi_pm_mission_mode_transition(struct mhi_controller *mhi_cntrl) {struct mhi_event *mhi_event;struct device *dev = &mhi_cntrl->mhi_dev->dev; -enum mhi_ee_type current_ee = mhi_cntrl->ee; +enum mhi_ee_type ee =MHI_EE_MAX , current_ee = mhi_cntrl->ee;int i, ret;dev_dbg (dev,"Processing Mission Mode transition\n" );write_lock_irq (&mhi_cntrl->pm_lock);if (MHI_REG_ACCESS_VALID (mhi_cntrl->pm_state)) - mhi_cntrl->ee =mhi_get_exec_env (mhi_cntrl); + ee =mhi_get_exec_env (mhi_cntrl); -if (!MHI_IN_MISSION_MODE (mhi_cntrl->ee)) { +if (!MHI_IN_MISSION_MODE (ee)) { mhi_cntrl->pm_state =MHI_PM_LD_ERR_FATAL_DETECT ;write_unlock_irq (&mhi_cntrl->pm_lock);wake_up_all (&mhi_cntrl->state_event);return -EIO ; } + mhi_cntrl->ee = ee;write_unlock_irq (&mhi_cntrl->pm_lock);wake_up_all (&mhi_cntrl->state_event);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 69/342 crypto: api - check for ERR pointers in crypto_destroy_tfm()
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
[ Upstream commit 83681f2bebb34dbb3f03fecd8f570308ab8b7c2c ]
Given that crypto_alloc_tfm() may return ERR pointers, and to avoid crashes on obscure error paths where such pointers are presented to crypto_destroy_tfm() (such as [0]), add an ERR_PTR check there before dereferencing the second argument as a struct crypto_tfm pointer.
[0] https://lore.kernel.org/linux-crypto/[email protected]/
--- crypto/api.c | 2 +- include/crypto/acompress.h | 2 ++ include/crypto/aead.h | 2 ++ include/crypto/akcipher.h | 2 ++ include/crypto/hash.h | 4 ++++ include/crypto/kpp.h | 2 ++ include/crypto/rng.h | 2 ++ include/crypto/skcipher.h | 2 ++ 8 files changed, 17 insertions(+), 1 deletion(-)
crypto/api.c +1 -1
@@ -562,7 +562,7 @@ void crypto_destroy_tfm(void *mem, struct crypto_tfm *tfm) {struct crypto_alg *alg; -if (unlikely (!mem)) +if (IS_ERR_OR_NULL (mem))return ; alg = tfm->__crt_alg;
include/crypto/acompress.h +2 -0
@@ -165,6 +165,8 @@ static inline struct crypto_acomp *crypto_acomp_reqtfm(struct acomp_req *req)* crypto_free_acomp() -- free ACOMPRESS tfm handle * * @tfm: ACOMPRESS tfm handle allocated with crypto_alloc_acomp() +* +* If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_acomp (struct crypto_acomp *tfm) {
include/crypto/aead.h +2 -0
@@ -185,6 +185,8 @@ static inline struct crypto_tfm *crypto_aead_tfm(struct crypto_aead *tfm)/** * crypto_free_aead() - zeroize and free aead handle * @tfm: cipher handle to be freed +* +* If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_aead (struct crypto_aead *tfm) {
include/crypto/akcipher.h +2 -0
@@ -174,6 +174,8 @@ static inline struct crypto_akcipher *crypto_akcipher_reqtfm(* crypto_free_akcipher() - free AKCIPHER tfm handle * * @tfm: AKCIPHER tfm handle allocated with crypto_alloc_akcipher() +* +* If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_akcipher (struct crypto_akcipher *tfm) {
include/crypto/hash.h +4 -0
@@ -281,6 +281,8 @@ static inline struct crypto_tfm *crypto_ahash_tfm(struct crypto_ahash *tfm)/** * crypto_free_ahash() - zeroize and free the ahash handle * @tfm: cipher handle to be freed +* +* If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_ahash (struct crypto_ahash *tfm) {
@@ -724,6 +726,8 @@ static inline struct crypto_tfm *crypto_shash_tfm(struct crypto_shash *tfm)/** * crypto_free_shash() - zeroize and free the message digest handle * @tfm: cipher handle to be freed +* +* If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_shash (struct crypto_shash *tfm) {
include/crypto/kpp.h +2 -0
@@ -154,6 +154,8 @@ static inline void crypto_kpp_set_flags(struct crypto_kpp *tfm, u32 flags)* crypto_free_kpp() - free KPP tfm handle * * @tfm: KPP tfm handle allocated with crypto_alloc_kpp() +* +* If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_kpp (struct crypto_kpp *tfm) {
include/crypto/rng.h +2 -0
@@ -111,6 +111,8 @@ static inline struct rng_alg *crypto_rng_alg(struct crypto_rng *tfm)/** * crypto_free_rng() - zeroize and free RNG handle * @tfm: cipher handle to be freed +* +* If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_rng (struct crypto_rng *tfm) {
include/crypto/skcipher.h +2 -0
@@ -196,6 +196,8 @@ static inline struct crypto_tfm *crypto_skcipher_tfm(/** * crypto_free_skcipher() - zeroize and free cipher handle * @tfm: cipher handle to be freed +* +* If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_skcipher (struct crypto_skcipher *tfm) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 70/342 crypto: qat - fix unmap invalid dma address
In reply to Greg Kroah-HartmanFrom: Hui Tang <[email protected]>
[ Upstream commit 792b32fad548281e1b7fe14df9063a96c54b32a2 ]
'dma_mapping_error' return a negative value if 'dma_addr' is equal to 'DMA_MAPPING_ERROR' not zero, so fix initialization of 'dma_addr'.
--- drivers/crypto/qat/qat_common/qat_algs.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/crypto/qat/qat_common/qat_algs.c +9 -2
@@ -718,7 +718,7 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,struct qat_alg_buf_list *bufl;struct qat_alg_buf_list *buflout =NULL ;dma_addr_t blp; -dma_addr_t bloutp =0 ; +dma_addr_t bloutp;struct scatterlist *sg;size_t sz_out, sz =struct_size (bufl, bufers, n +1 );
@@ -730,6 +730,9 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,if (unlikely (!bufl))return -ENOMEM ; +for_each_sg (sgl, sg, n, i) + bufl->bufers[i].addr =DMA_MAPPING_ERROR ; + blp =dma_map_single (dev, bufl, sz,DMA_TO_DEVICE );if (unlikely (dma_mapping_error (dev, blp))) goto err_in;
@@ -763,10 +766,14 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst, dev_to_node(&GET_DEV(inst->accel_dev)));if (unlikely (!buflout)) goto err_in; + + bufers = buflout->bufers; +for_each_sg (sglout, sg, n, i) + bufers[i].addr =DMA_MAPPING_ERROR ; + bloutp =dma_map_single (dev, buflout, sz_out,DMA_TO_DEVICE );if (unlikely (dma_mapping_error (dev, bloutp))) goto err_out; - bufers = buflout->bufers;for_each_sg (sglout, sg, n, i) {int y = sg_nctr;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 71/342 usb: gadget: uvc: add bInterval checking for HS mode
In reply to Greg Kroah-HartmanFrom: Pawel Laszczak <[email protected]>
[ Upstream commit 26adde04acdff14a1f28d4a5dce46a8513a3038b ]
Patch adds extra checking for bInterval passed by configfs. The 5.6.4 chapter of USB Specification (rev. 2.0) say:
"A high-bandwidth endpoint must specify a period of 1x125 µs (i.e., a bInterval value of 1)."
The issue was observed during testing UVC class on CV. I treat this change as improvement because we can control bInterval by configfs.
--- drivers/usb/gadget/function/f_uvc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/f_uvc.c +6 -1
@@ -633,7 +633,12 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f) uvc_hs_streaming_ep.wMaxPacketSize =cpu_to_le16 (max_packet_size | ((max_packet_mult -1 ) <<11 )); - uvc_hs_streaming_ep.bInterval = opts->streaming_interval; + +/* A high-bandwidth endpoint must specify a bInterval value of 1 */ +if (max_packet_mult >1 ) + uvc_hs_streaming_ep.bInterval =1 ; +else + uvc_hs_streaming_ep.bInterval = opts->streaming_interval; uvc_ss_streaming_ep.wMaxPacketSize =cpu_to_le16 (max_packet_size); uvc_ss_streaming_ep.bInterval = opts->streaming_interval;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 72/342 usb: webcam: Invalid size of Processing Unit Descriptor
In reply to Greg Kroah-HartmanFrom: Pawel Laszczak <[email protected]>
[ Upstream commit 6a154ec9ef6762c774cd2b50215c7a8f0f08a862 ]
According with USB Device Class Definition for Video Device the Processing Unit Descriptor bLength should be 12 (10 + bmControlSize), but it has 11.
Invalid length caused that Processing Unit Descriptor Test Video form CV tool failed. To fix this issue patch adds bmVideoStandards into uvc_processing_unit_descriptor structure.
The bmVideoStandards field was added in UVC 1.1 and it wasn't part of UVC 1.0a.
--- drivers/usb/gadget/function/f_uvc.c | 1 + drivers/usb/gadget/legacy/webcam.c | 1 + include/uapi/linux/usb/video.h | 3 ++- 3 files changed, 4 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/f_uvc.c +1 -0
@@ -822,6 +822,7 @@ static struct usb_function_instance *uvc_alloc_inst(void) pd->bmControls[0 ] =1 ; pd->bmControls[1 ] =0 ; pd->iProcessing =0 ; + pd->bmVideoStandards =0 ; od = &opts->uvc_output_terminal; od->bLength =UVC_DT_OUTPUT_TERMINAL_SIZE ;
drivers/usb/gadget/legacy/webcam.c +1 -0
@@ -125,6 +125,7 @@ static const struct uvc_processing_unit_descriptor uvc_processing = { .bmControls[0] = 1, .bmControls[1] = 0, .iProcessing = 0, + .bmVideoStandards = 0, };static const struct uvc_output_terminal_descriptor uvc_output_terminal = {
include/uapi/linux/usb/video.h +2 -1
@@ -302,9 +302,10 @@ struct uvc_processing_unit_descriptor {__u8 bControlSize;__u8 bmControls[2 ];__u8 iProcessing; +__u8 bmVideoStandards; } __attribute__((__packed__)); -#define UVC_DT_PROCESSING_UNIT_SIZE (n) (9+(n)) +#define UVC_DT_PROCESSING_UNIT_SIZE (n) (10+(n))/* 3.7.2.6. Extension Unit Descriptor */ struct uvc_extension_unit_descriptor {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 73/342 x86/sev: Do not require Hypervisor CPUID bit for SEV guests
In reply to Greg Kroah-HartmanFrom: Joerg Roedel <[email protected]>
[ Upstream commit eab696d8e8b9c9d600be6fad8dd8dfdfaca6ca7c ]
A malicious hypervisor could disable the CPUID intercept for an SEV or SEV-ES guest and trick it into the no-SEV boot path, where it could potentially reveal secrets. This is not an issue for SEV-SNP guests, as the CPUID intercept can't be disabled for those.
Remove the Hypervisor CPUID bit check from the SEV detection code to protect against this kind of attack and add a Hypervisor bit equals zero check to the SME detection path to prevent non-encrypted guests from trying to enable SME.
This handles the following cases:
1) SEV(-ES) guest where CPUID intercept is disabled. The guest will still see leaf 0x8000001f and the SEV bit. It can retrieve the C-bit and boot normally.
2) Non-encrypted guests with intercepted CPUID will check the SEV_STATUS MSR and find it 0 and will try to enable SME. This will fail when the guest finds MSR_K8_SYSCFG to be zero, as it is emulated by KVM. But we can't rely on that, as there might be other hypervisors which return this MSR with bit 23 set. The Hypervisor bit check will prevent that the guest tries to enable SME in this case.
3) Non-encrypted guests on SEV capable hosts with CPUID intercept disabled (by a malicious hypervisor) will try to boot into the SME path. This will fail, but it is also not considered a problem because non-encrypted guests have no protection against the hypervisor anyway.
[ bp: s/non-SEV/non-encrypted/g ]
--- arch/x86/boot/compressed/mem_encrypt.S | 6 ----- arch/x86/kernel/sev-es-shared.c | 6 +---- arch/x86/mm/mem_encrypt_identity.c | 35 ++++++++++++++------------ 3 files changed, 20 insertions(+), 27 deletions(-)
arch/x86/boot/compressed/mem_encrypt.S +0 -6
@@ -23,12 +23,6 @@ SYM_FUNC_START(get_sev_encryption_bit) push %ecx push %edx - /* Check if running under a hypervisor */ - movl $1, %eax - cpuid - bt $31, %ecx /* Check the hypervisor bit */ - jnc .Lno_sev - movl $0x80000000, %eax /* CPUID to check the highest leaf */ cpuid cmpl $0x8000001f, %eax /* See if 0x8000001f is available */
arch/x86/kernel/sev-es-shared.c +1 -5
@@ -186,7 +186,6 @@ void __init do_vc_no_ghcb(struct pt_regs *regs, unsigned long exit_code)* make it accessible to the hypervisor. * * In particular, check for: -* - Hypervisor CPUID bit * - Availability of CPUID leaf 0x8000001f * - SEV CPUID bit. *
@@ -194,10 +193,7 @@ void __init do_vc_no_ghcb(struct pt_regs *regs, unsigned long exit_code)* can't be checked here. */ -if ((fn ==1 && !(regs->cx &BIT (31 )))) -/* Hypervisor bit */ - goto fail; -else if (fn ==0x80000000 && (regs->ax <0x8000001f )) +if (fn ==0x80000000 && (regs->ax <0x8000001f ))/* SEV leaf check */ goto fail;else if ((fn ==0x8000001f && !(regs->ax &BIT (1 ))))
arch/x86/mm/mem_encrypt_identity.c +19 -16
@@ -503,14 +503,10 @@ void __init sme_enable(struct boot_params *bp)#define AMD_SME_BIT BIT(0)#define AMD_SEV_BIT BIT(1) -/* -* Set the feature mask (SME or SEV) based on whether we are -* running under a hypervisor. -*/ - eax =1 ; - ecx =0 ; -native_cpuid (&eax, &ebx, &ecx, &edx); - feature_mask = (ecx &BIT (31 )) ?AMD_SEV_BIT :AMD_SME_BIT ; + +/* Check the SEV MSR whether SEV or SME is enabled */ + sev_status =__rdmsr (MSR_AMD64_SEV ); + feature_mask = (sev_status &MSR_AMD64_SEV_ENABLED ) ?AMD_SEV_BIT :AMD_SME_BIT ;/* * Check for the SME/SEV feature:
@@ -530,19 +526,26 @@ void __init sme_enable(struct boot_params *bp)/* Check if memory encryption is enabled */ if (feature_mask ==AMD_SME_BIT ) { +/* +* No SME if Hypervisor bit is set. This check is here to +* prevent a guest from trying to enable SME. For running as a +* KVM guest the MSR_K8_SYSCFG will be sufficient, but there +* might be other hypervisors which emulate that MSR as non-zero +* or even pass it through to the guest. +* A malicious hypervisor can still trick a guest into this +* path, but there is no way to protect against that. +*/ + eax =1 ; + ecx =0 ; +native_cpuid (&eax, &ebx, &ecx, &edx); +if (ecx &BIT (31 )) +return ; +/* For SME, check the SYSCFG MSR */ msr =__rdmsr (MSR_K8_SYSCFG );if (!(msr &MSR_K8_SYSCFG_MEM_ENCRYPT ))return ; }else { -/* For SEV, check the SEV MSR */ - msr =__rdmsr (MSR_AMD64_SEV ); -if (!(msr &MSR_AMD64_SEV_ENABLED )) -return ; - -/* Save SEV_STATUS to avoid reading MSR again */ - sev_status = msr; -/* SEV state cannot be controlled by a command line option */ sme_me_mask = me_mask; sev_enabled = true;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 74/342 crypto: hisilicon/sec - fixes a printing error
In reply to Greg Kroah-HartmanFrom: Longfang Liu <[email protected]>
[ Upstream commit 4b7aef0230418345be1fb77abbb1592801869901 ]
When the log is output here, the device has not
been initialized yet.
--- drivers/crypto/hisilicon/sec2/sec_crypto.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/hisilicon/sec2/sec_crypto.c +1 -1
@@ -546,7 +546,7 @@ static int sec_skcipher_init(struct crypto_skcipher *tfm)crypto_skcipher_set_reqsize (tfm,sizeof (struct sec_req )); ctx->c_ctx.ivsize =crypto_skcipher_ivsize (tfm);if (ctx->c_ctx.ivsize >SEC_IV_SIZE ) { -dev_err (SEC_CTX_DEV (ctx),"get error skcipher iv size!\n" ); +pr_err ("get error skcipher iv size!\n" );return -EINVAL ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 75/342 genirq/matrix: Prevent allocation counter corruption
In reply to Greg Kroah-HartmanFrom: Vitaly Kuznetsov <[email protected]>
[ Upstream commit c93a5e20c3c2dabef8ea360a3d3f18c6f68233ab ]
When irq_matrix_free() is called for an unallocated vector the managed_allocated and total_allocated counters get out of sync with the real state of the matrix. Later, when the last interrupt is freed, these counters will underflow resulting in UINTMAX because the counters are unsigned.
While this is certainly a problem of the calling code, this can be catched in the allocator by checking the allocation bit for the to be freed vector which simplifies debugging.
An example of the problem described above:
https://lore.kernel.org/lkml/[email protected]/
Add the missing sanity check and emit a warning when it triggers.
--- kernel/irq/matrix.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/irq/matrix.c +3 -1
@@ -423,7 +423,9 @@ void irq_matrix_free(struct irq_matrix *m, unsigned int cpu,if (WARN_ON_ONCE (bit < m->alloc_start || bit >= m->alloc_end))return ; -clear_bit (bit, cm->alloc_map); +if (WARN_ON_ONCE (!test_and_clear_bit (bit, cm->alloc_map))) +return ; + cm->allocated--;if (managed) cm->managed_allocated--;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 76/342 usb: gadget: f_uac2: validate input parameters
In reply to Greg Kroah-HartmanFrom: Ruslan Bilovol <[email protected]>
[ Upstream commit 3713d5ceb04d5ab6a5e2b86dfca49170053f3a5e ]
Currently user can configure UAC2 function with parameters that violate UAC2 spec or are not supported by UAC2 gadget implementation.
This can lead to incorrect behavior if such gadget is connected to the host - like enumeration failure or other issues depending on host's UAC2 driver implementation, bringing user to a long hours of debugging the issue.
Instead of silently accept these parameters, throw an error if they are not valid.
--- drivers/usb/gadget/function/f_uac2.c | 39 ++++++++++++++++++++++++++-- 1 file changed, 37 insertions(+), 2 deletions(-)
drivers/usb/gadget/function/f_uac2.c +37 -2
@@ -14,6 +14,9 @@#include "u_audio.h" #include "u_uac2.h" +/* UAC2 spec: 4.1 Audio Channel Cluster Descriptor */ +#define UAC2_CHANNEL_MASK 0x07FFFFFF +/* * The driver implements a simple UAC_2 topology. * USB-OUT -> IT_1 -> OT_3 -> ALSA_Capture
@@ -604,6 +607,36 @@ static void setup_descriptor(struct f_uac2_opts *opts) hs_audio_desc[i] =NULL ; } +static int afunc_validate_opts (struct g_audio *agdev,struct device *dev) +{ +struct f_uac2_opts *opts =g_audio_to_uac2_opts (agdev); + +if (!opts->p_chmask && !opts->c_chmask) { +dev_err (dev,"Error: no playback and capture channels\n" ); +return -EINVAL ; + }else if (opts->p_chmask & ~UAC2_CHANNEL_MASK ) { +dev_err (dev,"Error: unsupported playback channels mask\n" ); +return -EINVAL ; + }else if (opts->c_chmask & ~UAC2_CHANNEL_MASK ) { +dev_err (dev,"Error: unsupported capture channels mask\n" ); +return -EINVAL ; + }else if ((opts->p_ssize <1 ) || (opts->p_ssize >4 )) { +dev_err (dev,"Error: incorrect playback sample size\n" ); +return -EINVAL ; + }else if ((opts->c_ssize <1 ) || (opts->c_ssize >4 )) { +dev_err (dev,"Error: incorrect capture sample size\n" ); +return -EINVAL ; + }else if (!opts->p_srate) { +dev_err (dev,"Error: incorrect playback sampling rate\n" ); +return -EINVAL ; + }else if (!opts->c_srate) { +dev_err (dev,"Error: incorrect capture sampling rate\n" ); +return -EINVAL ; + } + +return 0 ; +} +static int afunc_bind (struct usb_configuration *cfg,struct usb_function *fn) {
@@ -612,11 +645,13 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)struct usb_composite_dev *cdev = cfg->cdev;struct usb_gadget *gadget = cdev->gadget;struct device *dev = &gadget->dev; -struct f_uac2_opts *uac2_opts; +struct f_uac2_opts *uac2_opts =g_audio_to_uac2_opts (agdev);struct usb_string *us;int ret; - uac2_opts = container_of(fn->fi, struct f_uac2_opts, func_inst); + ret =afunc_validate_opts (agdev, dev); +if (ret) +return ret; us =usb_gstrings_attach (cdev, fn_strings,ARRAY_SIZE (strings_fn));if (IS_ERR (us))
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 77/342 usb: gadget: f_uac1: validate input parameters
In reply to Greg Kroah-HartmanFrom: Ruslan Bilovol <[email protected]>
[ Upstream commit a59c68a6a3d1b18e2494f526eb19893a34fa6ec6 ]
Currently user can configure UAC1 function with parameters that violate UAC1 spec or are not supported by UAC1 gadget implementation.
This can lead to incorrect behavior if such gadget is connected to the host - like enumeration failure or other issues depending on host's UAC1 driver implementation, bringing user to a long hours of debugging the issue.
Instead of silently accept these parameters, throw an error if they are not valid.
--- drivers/usb/gadget/function/f_uac1.c | 43 ++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+)
drivers/usb/gadget/function/f_uac1.c +43 -0
@@ -19,6 +19,9 @@#include "u_audio.h" #include "u_uac1.h" +/* UAC1 spec: 3.7.2.3 Audio Channel Cluster Format */ +#define UAC1_CHANNEL_MASK 0x0FFF +struct f_uac1 {struct g_audio g_audio;u8 ac_intf, as_in_intf, as_out_intf;
@@ -30,6 +33,11 @@ static inline struct f_uac1 *func_to_uac1(struct usb_function *f) return container_of(f, struct f_uac1, g_audio.func); } +static inline struct f_uac1_opts *g_audio_to_uac1_opts (struct g_audio *audio) +{ + return container_of(audio->func.fi, struct f_uac1_opts, func_inst); +} +/* * DESCRIPTORS ... most are static, but strings and full * configuration descriptors are built on demand.
@@ -505,11 +513,42 @@ static void f_audio_disable(struct usb_function *f)/*-------------------------------------------------------------------------*/ +static int f_audio_validate_opts (struct g_audio *audio,struct device *dev) +{ +struct f_uac1_opts *opts =g_audio_to_uac1_opts (audio); + +if (!opts->p_chmask && !opts->c_chmask) { +dev_err (dev,"Error: no playback and capture channels\n" ); +return -EINVAL ; + }else if (opts->p_chmask & ~UAC1_CHANNEL_MASK ) { +dev_err (dev,"Error: unsupported playback channels mask\n" ); +return -EINVAL ; + }else if (opts->c_chmask & ~UAC1_CHANNEL_MASK ) { +dev_err (dev,"Error: unsupported capture channels mask\n" ); +return -EINVAL ; + }else if ((opts->p_ssize <1 ) || (opts->p_ssize >4 )) { +dev_err (dev,"Error: incorrect playback sample size\n" ); +return -EINVAL ; + }else if ((opts->c_ssize <1 ) || (opts->c_ssize >4 )) { +dev_err (dev,"Error: incorrect capture sample size\n" ); +return -EINVAL ; + }else if (!opts->p_srate) { +dev_err (dev,"Error: incorrect playback sampling rate\n" ); +return -EINVAL ; + }else if (!opts->c_srate) { +dev_err (dev,"Error: incorrect capture sampling rate\n" ); +return -EINVAL ; + } + +return 0 ; +} +/* audio function driver setup/binding */ static int f_audio_bind (struct usb_configuration *c,struct usb_function *f) {struct usb_composite_dev *cdev = c->cdev;struct usb_gadget *gadget = cdev->gadget; +struct device *dev = &gadget->dev;struct f_uac1 *uac1 =func_to_uac1 (f);struct g_audio *audio =func_to_g_audio (f);struct f_uac1_opts *audio_opts;
@@ -519,6 +558,10 @@ static int f_audio_bind(struct usb_configuration *c, struct usb_function *f)int rate;int status; + status =f_audio_validate_opts (audio, dev); +if (status) +return status; + audio_opts = container_of(f->fi, struct f_uac1_opts, func_inst); us =usb_gstrings_attach (cdev, uac1_strings,ARRAY_SIZE (strings_uac1));
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 78/342 usb: dwc3: gadget: Ignore EP queue requests during bus reset
In reply to Greg Kroah-HartmanFrom: Wesley Cheng <[email protected]>
[ Upstream commit 71ca43f30df9c642970f9dc9b2d6f463f4967e7b ]
The current dwc3_gadget_reset_interrupt() will stop any active transfers, but only addresses blocking of EP queuing for while we are coming from a disconnected scenario, i.e. after receiving the disconnect event. If the host decides to issue a bus reset on the device, the connected parameter will still be set to true, allowing for EP queuing to continue while we are disabling the functions. To avoid this, set the connected flag to false until the stop active transfers is complete.
--- drivers/usb/dwc3/gadget.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/dwc3/gadget.c +9 -0
@@ -3267,6 +3267,15 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc) {u32 reg; +/* +* Ideally, dwc3_reset_gadget() would trigger the function +* drivers to stop any active transfers through ep disable. +* However, for functions which defer ep disable, such as mass +* storage, we will need to rely on the call to stop active +* transfers here, and avoid allowing of request queuing. +*/ + dwc->connected = false; +/* * WORKAROUND: DWC3 revisions <1.88a have an issue which * would cause a missing Disconnect Event if there's a
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 79/342 usb: xhci: Fix port minor revision
In reply to Greg Kroah-HartmanFrom: Thinh Nguyen <[email protected]>
[ Upstream commit 64364bc912c01b33bba6c22e3ccb849bfca96398 ]
Some hosts incorrectly use sub-minor version for minor version (i.e. 0x02 instead of 0x20 for bcdUSB 0x320 and 0x01 for bcdUSB 0x310). Currently the xHCI driver works around this by just checking for minor revision > 0x01 for USB 3.1 everywhere. With the addition of USB 3.2, checking this gets a bit cumbersome. Since there is no USB release with bcdUSB 0x301 to 0x309, we can assume that sub-minor version 01 to 09 is incorrect. Let's try to fix this and use the minor revision that matches with the USB/xHCI spec to help with the version checking within the driver.
--- drivers/usb/host/xhci-mem.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/host/xhci-mem.c +9 -0
@@ -2142,6 +2142,15 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports,if (major_revision ==0x03 ) { rhub = &xhci->usb3_rhub; +/* +* Some hosts incorrectly use sub-minor version for minor +* version (i.e. 0x02 instead of 0x20 for bcdUSB 0x320 and 0x01 +* for bcdUSB 0x310). Since there is no USB release with sub +* minor version 0x301 to 0x309, we can assume that they are +* incorrect and fix it here. +*/ +if (minor_revision >0x00 && minor_revision <0x10 ) + minor_revision <<=4 ; }else if (major_revision <=0x02 ) { rhub = &xhci->usb2_rhub; }else {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 80/342 kselftest/arm64: mte: Fix compilation with native compiler
In reply to Greg Kroah-HartmanFrom: Andre Przywara <[email protected]>
[ Upstream commit 4a423645bc2690376a7a94b4bb7b2f74bc6206ff ]
The mte selftest Makefile contains a check for GCC, to add the memtag -march flag to the compiler options. This check fails if the compiler is not explicitly specified, so reverts to the standard "cc", in which case --version doesn't mention the "gcc" string we match against:
$ cc --version | head -n 1 cc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0
This will not add the -march switch to the command line, so compilation fails:mte_helper.S: Assembler messages:
mte_helper.S:25: Error: selected processor does not support irg x0,x0,xzr' mte_helper.S:38: Error: selected processor does not support gmi x1,x0,xzr'
...
Actually clang accepts the same -march option as well, so we can just drop this check and add this unconditionally to the command line, to avoid any future issues with this check altogether (gcc actually prints basename(argv[0]) when called with --version).
--- tools/testing/selftests/arm64/mte/Makefile | 2 -- 1 file changed, 2 deletions(-)
tools/testing/selftests/arm64/mte/Makefile +0 -2
@@ -6,9 +6,7 @@ SRCS := $(filter-out mte_common_util.c,$(wildcard *.c)) PROGS := $(patsubst %.c,%,$(SRCS)) #Add mte compiler option -ifneq ($(shell $(CC) --version 2>&1 | head -n 1 | grep gcc),) CFLAGS += -march=armv8.5-a+memtag -endif #check if the compiler works well mte_cc_support := $(shell if ($(CC) $(CFLAGS) -E -x c /dev/null -o /dev/null 2>&1) then echo "1"; fi)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 81/342 ARM: tegra: acer-a500: Rename avdd to vdda of touchscreen node
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
[ Upstream commit b27b9689e1f3278919c6183c565d837d0aef6fc1 ]
Rename avdd supply to vdda of the touchscreen node. The old supply name was incorrect.
--- arch/arm/boot/dts/tegra20-acer-a500-picasso.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/tegra20-acer-a500-picasso.dts +1 -1
@@ -448,7 +448,7 @@ reset-gpios = <&gpio TEGRA_GPIO(Q, 7) GPIO_ACTIVE_LOW>; - avdd-supply = <&vdd_3v3_sys>; + vdda-supply = <&vdd_3v3_sys>; vdd-supply = <&vdd_3v3_sys>; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 82/342 PCI: PM: Do not read power state in pci_enable_device_flags()
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
[ Upstream commit 4514d991d99211f225d83b7e640285f29f0755d0 ]
It should not be necessary to update the current_state field of struct pci_dev in pci_enable_device_flags() before calling do_pci_enable_device() for the device, because none of the code between that point and the pci_set_power_state() call in do_pci_enable_device() invoked later depends on it.
Moreover, doing that is actively harmful in some cases. For example, if the given PCI device depends on an ACPI power resource whose _STA method initially returns 0 ("off"), but the config space of the PCI device is accessible and the power state retrieved from the PCI_PM_CTRL register is D0, the current_state field in the struct pci_dev representing that device will get out of sync with the power.state of its ACPI companion object and that will lead to power management issues going forward.
To avoid such issues it is better to leave the current_state value as is until it is changed to PCI_D0 by do_pci_enable_device() as appropriate. However, the power state of the device is not changed to PCI_D0 if it is already enabled when pci_enable_device_flags() gets called for it, so update its current_state in that case, but use pci_update_current_state() covering platform PM too for that.
--- drivers/pci/pci.c | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-)
drivers/pci/pci.c +3 -13
@@ -1870,20 +1870,10 @@ static int pci_enable_device_flags(struct pci_dev *dev, unsigned long flags)int err;int i, bars =0 ; -/* -* Power state could be unknown at this point, either due to a fresh -* boot or a device removal call. So get the current power state -* so that things like MSI message writing will behave as expected -* (e.g. if the device really is in D0 at enable time). -*/ -if (dev->pm_cap) { -u16 pmcsr; -pci_read_config_word (dev, dev->pm_cap +PCI_PM_CTRL , &pmcsr); - dev->current_state = (pmcsr &PCI_PM_CTRL_STATE_MASK ); - } - -if (atomic_inc_return (&dev->enable_cnt) >1 ) +if (atomic_inc_return (&dev->enable_cnt) >1 ) { +pci_update_current_state (dev, dev->current_state);return 0 ;/* already enabled */ + } bridge =pci_upstream_bridge (dev);if (bridge)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 83/342 kselftest/arm64: mte: Fix MTE feature detection
In reply to Greg Kroah-HartmanFrom: Andre Przywara <[email protected]>
[ Upstream commit 592432862cc4019075a7196d9961562c49507d6f ]
To check whether the CPU and kernel support the MTE features we want to test, we use an (emulated) CPU ID register read. However we only check against a very particular feature version (0b0010), even though the ARM ARM promises ID register features to be backwards compatible.
While this could be fixed by using ">=" instead of "==", we should actually use the explicit HWCAP2_MTE hardware capability, exposed by the kernel via the ELF auxiliary vectors.
That moves this responsibility to the kernel, and fixes running the tests on machines with FEAT_MTE3 capability.
--- tools/testing/selftests/arm64/mte/mte_common_util.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-)
tools/testing/selftests/arm64/mte/mte_common_util.c +2 -11
@@ -278,22 +278,13 @@ int mte_switch_mode(int mte_option, unsigned long incl_mask)return 0 ; } -#define ID_AA64PFR1_MTE_SHIFT 8 -#define ID_AA64PFR1_MTE 2 -int mte_default_setup (void ) { -unsigned long hwcaps =getauxval (AT_HWCAP ); +unsigned long hwcaps2 =getauxval (AT_HWCAP2 );unsigned long en =0 ;int ret; -if (!(hwcaps &HWCAP_CPUID )) { -ksft_print_msg ("FAIL: CPUID registers unavailable\n" ); -return KSFT_FAIL ; - } -/* Read ID_AA64PFR1_EL1 register */ - asmvolatile ("mrs %0, id_aa64pfr1_el1" :"=r" (hwcaps) : :"memory" ); -if (((hwcaps >>ID_AA64PFR1_MTE_SHIFT ) &MT_TAG_MASK ) !=ID_AA64PFR1_MTE ) { +if (!(hwcaps2 &HWCAP2_MTE )) {ksft_print_msg ("FAIL: MTE features unavailable\n" );return KSFT_SKIP ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 84/342 ARM: dts: BCM5301X: fix "reg" formatting in /memory node
In reply to Greg Kroah-HartmanFrom: Rafał Miłecki <[email protected]>
[ Upstream commit 43986f38818278bb71a7fef6de689637bb734afe ]
This fixes warnings/errors like:arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dt.yaml: /: memory@0:reg:0: [0, 134217728, 2281701376, 402653184] is too long
From schema: /lib/python3.6/site-packages/dtschema/schemas/reg.yaml
--- arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts | 4 ++-- arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts | 4 ++-- arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts | 4 ++-- arch/arm/boot/dts/bcm4708-netgear-r6250.dts | 4 ++-- arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts | 4 ++-- arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts | 4 ++-- arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts | 4 ++-- arch/arm/boot/dts/bcm47081-buffalo-wzr-600dhp2.dts | 4 ++-- arch/arm/boot/dts/bcm47081-buffalo-wzr-900dhp.dts | 4 ++-- arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts | 4 ++-- arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts | 4 ++-- arch/arm/boot/dts/bcm4709-linksys-ea9200.dts | 4 ++-- arch/arm/boot/dts/bcm4709-netgear-r7000.dts | 4 ++-- arch/arm/boot/dts/bcm4709-netgear-r8000.dts | 4 ++-- arch/arm/boot/dts/bcm47094-dlink-dir-885l.dts | 4 ++-- arch/arm/boot/dts/bcm47094-linksys-panamera.dts | 4 ++-- arch/arm/boot/dts/bcm47094-luxul-abr-4500.dts | 4 ++-- arch/arm/boot/dts/bcm47094-luxul-xbr-4500.dts | 4 ++-- arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts | 4 ++-- arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts | 4 ++-- arch/arm/boot/dts/bcm47094-luxul-xwr-3150-v1.dts | 4 ++-- arch/arm/boot/dts/bcm47094-netgear-r8500.dts | 4 ++-- arch/arm/boot/dts/bcm47094-phicomm-k3.dts | 4 ++-- 23 files changed, 46 insertions(+), 46 deletions(-)
arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts +2 -2
@@ -21,8 +21,8 @@ memory@0 { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x08000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x08000000>; }; leds {
arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts +2 -2
@@ -21,8 +21,8 @@ memory@0 { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x08000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x08000000>; }; leds {
arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts +2 -2
@@ -21,8 +21,8 @@ memory@0 { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x18000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x18000000>; }; spi {
arch/arm/boot/dts/bcm4708-netgear-r6250.dts +2 -2
@@ -22,8 +22,8 @@ memory { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x08000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x08000000>; }; leds {
arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts +2 -2
@@ -21,8 +21,8 @@ memory@0 { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x08000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x08000000>; }; leds {
arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts +2 -2
@@ -21,8 +21,8 @@ memory@0 { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x08000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x08000000>; }; leds {
arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts +2 -2
@@ -21,8 +21,8 @@ memory@0 { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x08000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x08000000>; }; leds {
arch/arm/boot/dts/bcm47081-buffalo-wzr-600dhp2.dts +2 -2
@@ -21,8 +21,8 @@ memory@0 { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x08000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x08000000>; }; spi {
arch/arm/boot/dts/bcm47081-buffalo-wzr-900dhp.dts +2 -2
@@ -21,8 +21,8 @@ memory@0 { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x08000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x08000000>; }; spi {
arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts +2 -2
@@ -21,8 +21,8 @@ memory { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x08000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x08000000>; }; leds {
arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts +2 -2
@@ -21,8 +21,8 @@ memory { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x18000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x18000000>; }; leds {
arch/arm/boot/dts/bcm4709-linksys-ea9200.dts +2 -2
@@ -18,8 +18,8 @@ memory { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x08000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x08000000>; }; gpio-keys {
arch/arm/boot/dts/bcm4709-netgear-r7000.dts +2 -2
@@ -21,8 +21,8 @@ memory { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x08000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x08000000>; }; leds {
arch/arm/boot/dts/bcm4709-netgear-r8000.dts +2 -2
@@ -32,8 +32,8 @@ memory { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x08000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x08000000>; }; leds {
arch/arm/boot/dts/bcm47094-dlink-dir-885l.dts +2 -2
@@ -21,8 +21,8 @@ memory@0 { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x08000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x08000000>; }; nand: nand@18028000 {
arch/arm/boot/dts/bcm47094-linksys-panamera.dts +2 -2
@@ -18,8 +18,8 @@ memory@0 { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x08000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x08000000>; }; gpio-keys {
arch/arm/boot/dts/bcm47094-luxul-abr-4500.dts +2 -2
@@ -18,8 +18,8 @@ memory@0 { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x18000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x18000000>; }; leds {
arch/arm/boot/dts/bcm47094-luxul-xbr-4500.dts +2 -2
@@ -18,8 +18,8 @@ memory@0 { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x18000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x18000000>; }; leds {
arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts +2 -2
@@ -18,8 +18,8 @@ memory { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x18000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x18000000>; }; leds {
arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts +2 -2
@@ -18,8 +18,8 @@ memory@0 { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x08000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x08000000>; }; leds {
arch/arm/boot/dts/bcm47094-luxul-xwr-3150-v1.dts +2 -2
@@ -18,8 +18,8 @@ memory@0 { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x18000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x18000000>; }; leds {
arch/arm/boot/dts/bcm47094-netgear-r8500.dts +2 -2
@@ -18,8 +18,8 @@ memory@0 { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x18000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x18000000>; }; leds {
arch/arm/boot/dts/bcm47094-phicomm-k3.dts +2 -2
@@ -15,8 +15,8 @@ memory@0 { device_type = "memory"; - reg = <0x00000000 0x08000000 - 0x88000000 0x18000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x18000000>; }; gpio-keys {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 85/342 ARM: dts: ux500: Fix up TVK R3 sensors
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
[ Upstream commit aeceecd40d94ed3c00bfe1cfe59dd1bfac2fc6fe ]
The TVK1281618 R3 sensors are different from the R2 board, some incorrectness is fixed and some new sensors added, we also rename the nodes appropriately with accelerometer@ etc.
--- arch/arm/boot/dts/ste-href-tvk1281618-r3.dtsi | 73 +++++++++++++------ 1 file changed, 50 insertions(+), 23 deletions(-)
arch/arm/boot/dts/ste-href-tvk1281618-r3.dtsi +50 -23
@@ -8,37 +8,43 @@ / { soc { i2c@80128000 { - /* Marked: - * 129 - * M35 - * L3GD20 - */ - l3gd20@6a { - /* Gyroscope */ - compatible = "st,l3gd20"; - status = "disabled"; + accelerometer@19 { + compatible = "st,lsm303dlhc-accel"; st,drdy-int-pin = <1>; - drive-open-drain; - reg = <0x6a>; // 0x6a or 0x6b + reg = <0x19>; vdd-supply = <&ab8500_ldo_aux1_reg>; vddio-supply = <&db8500_vsmps2_reg>; + interrupt-parent = <&gpio2>; + interrupts = <18 IRQ_TYPE_EDGE_RISING>, + <19 IRQ_TYPE_EDGE_RISING>; + pinctrl-names = "default"; + pinctrl-0 = <&accel_tvk_mode>; }; - /* - * Marked: - * 2122 - * C3H - * DQEEE - * LIS3DH? - */ - lis3dh@18 { - /* Accelerometer */ - compatible = "st,lis3dh-accel"; + magnetometer@1e { + compatible = "st,lsm303dlm-magn"; st,drdy-int-pin = <1>; - reg = <0x18>; + reg = <0x1e>; vdd-supply = <&ab8500_ldo_aux1_reg>; vddio-supply = <&db8500_vsmps2_reg>; + // This interrupt is not properly working with the driver + // interrupt-parent = <&gpio1>; + // interrupts = <0 IRQ_TYPE_EDGE_RISING>; pinctrl-names = "default"; - pinctrl-0 = <&accel_tvk_mode>; + pinctrl-0 = <&magn_tvk_mode>; + }; + gyroscope@68 { + /* Gyroscope */ + compatible = "st,l3g4200d-gyro"; + reg = <0x68>; + vdd-supply = <&ab8500_ldo_aux1_reg>; + vddio-supply = <&db8500_vsmps2_reg>; + }; + pressure@5c { + /* Barometer/pressure sensor */ + compatible = "st,lps001wp-press"; + reg = <0x5c>; + vdd-supply = <&ab8500_ldo_aux1_reg>; + vddio-supply = <&db8500_vsmps2_reg>; }; };
@@ -54,5 +60,26 @@ }; }; }; + + pinctrl { + accelerometer { + accel_tvk_mode: accel_tvk { + /* Accelerometer interrupt lines 1 & 2 */ + tvk_cfg { + pins = "GPIO82_C1", "GPIO83_D3"; + ste,config = <&gpio_in_pd>; + }; + }; + }; + magnetometer { + magn_tvk_mode: magn_tvk { + /* GPIO 32 used for DRDY, pull this down */ + tvk_cfg { + pins = "GPIO32_V2"; + ste,config = <&gpio_in_pd>; + }; + }; + }; + }; }; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 86/342 x86/build: Propagate $(CLANG_FLAGS) to $(REALMODE_FLAGS)
In reply to Greg Kroah-HartmanFrom: John Millikin <[email protected]>
[ Upstream commit 8abe7fc26ad8f28bfdf78adbed56acd1fa93f82d ]
When cross-compiling with Clang, the $(CLANG_FLAGS)' variable contains additional flags needed to build C and assembly sources for the target platform. Normally this variable is automatically included in $(KBUILD_CFLAGS)' via the top-level Makefile.
The x86 real-mode makefile builds `$(REALMODE_CFLAGS)' from a plain assignment and therefore drops the Clang flags. This causes Clang to not recognize x86-specific assembler directives:
arch/x86/realmode/rm/header.S:36:1: error: unknown directive .type real_mode_header STT_OBJECT ; .size real_mode_header, .-real_mode_header ^
Explicit propagation of $(CLANG_FLAGS)' to $(REALMODE_CFLAGS)', which is inherited by real-mode make rules, fixes cross-compilation with Clang for x86 targets.
Relevant flags:
* --target' sets the target architecture when cross-compiling. This flag must be set for both compilation and assembly (KBUILD_AFLAGS') to support architecture-specific assembler directives.
* -no-integrated-as' tells clang to assemble with GNU Assembler instead of its built-in LLVM assembler. This flag is set by default unless LLVM_IAS=1' is set, because the LLVM assembler can't yet parse certain GNU extensions.
--- arch/x86/Makefile | 1 + 1 file changed, 1 insertion(+)
arch/x86/Makefile +1 -0
@@ -33,6 +33,7 @@ REALMODE_CFLAGS += -ffreestanding REALMODE_CFLAGS += -fno-stack-protector REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -Wno-address-of-packed-member) REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), $(cc_stack_align4)) +REALMODE_CFLAGS += $(CLANG_FLAGS) export REALMODE_CFLAGS # BITS is used as extension for files which are available in a 32 bit
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 87/342 x86/boot: Add $(CLANG_FLAGS) to compressed KBUILD_CFLAGS
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit d5cbd80e302dfea59726c44c56ab7957f822409f ]
When cross compiling x86 on an ARM machine with clang, there are several errors along the lines of:
arch/x86/include/asm/string_64.h:27:10: error: invalid output constraint '=&c' in asm
This happens because the compressed boot Makefile reassigns KBUILD_CFLAGS and drops the clang flags that set the target architecture ('--target=') and the path to the GNU cross tools ('--prefix='), meaning that the host architecture is targeted.
These flags are available as $(CLANG_FLAGS) from the main Makefile so add them to the compressed boot folder's KBUILD_CFLAGS so that cross compiling works as expected.
--- arch/x86/boot/compressed/Makefile | 1 + 1 file changed, 1 insertion(+)
arch/x86/boot/compressed/Makefile +1 -0
@@ -46,6 +46,7 @@ KBUILD_CFLAGS += -D__DISABLE_EXPORTS # Disable relocation relaxation in case the link is not PIE. KBUILD_CFLAGS += $(call as-option,-Wa$(comma)-mrelax-relocations=no) KBUILD_CFLAGS += -include $(srctree)/include/linux/hidden.h +KBUILD_CFLAGS += $(CLANG_FLAGS) # sev-es.c indirectly inludes inat-table.h which is generated during # compilation and stored in $(objtree). Add the directory to the includes so
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 88/342 efi/libstub: Add $(CLANG_FLAGS) to x86 flags
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit 58d746c119dfa28e72fc35aacaf3d2a3ac625cd0 ]
When cross compiling x86 on an ARM machine with clang, there are several errors along the lines of:
arch/x86/include/asm/page_64.h:52:7: error: invalid output constraint '=D' in asm
This happens because the x86 flags in the EFI stub are not derived from KBUILD_CFLAGS like the other architectures are and the clang flags that set the target architecture ('--target=') and the path to the GNU cross tools ('--prefix=') are not present, meaning that the host architecture is targeted.
These flags are available as $(CLANG_FLAGS) from the main Makefile so add them to the cflags for x86 so that cross compiling works as expected.
--- drivers/firmware/efi/libstub/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/firmware/efi/libstub/Makefile +2 -1
@@ -13,7 +13,8 @@ cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ \ -Wno-pointer-sign \ $(call cc-disable-warning, address-of-packed-member) \ $(call cc-disable-warning, gnu) \ - -fno-asynchronous-unwind-tables + -fno-asynchronous-unwind-tables \ + $(CLANG_FLAGS) # arm64 uses the full KBUILD_CFLAGS so it's necessary to explicitly # disable the stackleak plugin
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 89/342 soc/tegra: pmc: Fix completion of power-gate toggling
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
[ Upstream commit c45e66a6b9f40f2e95bc6d97fbf3daa1ebe88c6b ]
The SW-initiated power gate toggling is dropped by PMC if there is contention with a HW-initiated toggling, i.e. when one of CPU cores is gated by cpuidle driver. Software should retry the toggling after 10 microseconds on Tegra20/30 SoCs, hence add the retrying. On Tegra114+ the toggling method was changed in hardware, the TOGGLE_START bit indicates whether PMC is busy or could accept the command to toggle, hence handle that bit properly.
The problem pops up after enabling dynamic power gating of 3D hardware, where 3D power domain fails to turn on/off "randomly".
The programming sequence and quirks are documented in TRMs, but PMC driver obliviously re-used the Tegra20 logic for Tegra30+, which strikes back now. The 10 microseconds and other timeouts aren't documented in TRM, they are taken from downstream kernel.
--- drivers/soc/tegra/pmc.c | 70 ++++++++++++++++++++++++++++++++++++++--- 1 file changed, 65 insertions(+), 5 deletions(-)
drivers/soc/tegra/pmc.c +65 -5
@@ -317,6 +317,8 @@ struct tegra_pmc_soc { bool invert);int (*irq_set_wake)(struct irq_data *data,unsigned int on);int (*irq_set_type)(struct irq_data *data,unsigned int type); +int (*powergate_set)(struct tegra_pmc *pmc,unsigned int id, +bool new_state);const char *const *reset_sources;unsigned int num_reset_sources;
@@ -517,6 +519,63 @@ static int tegra_powergate_lookup(struct tegra_pmc *pmc, const char *name)return -ENODEV ; } +static int tegra20_powergate_set (struct tegra_pmc *pmc,unsigned int id, +bool new_state) +{ +unsigned int retries =100 ; +bool status; +int ret; + +/* +* As per TRM documentation, the toggle command will be dropped by PMC +* if there is contention with a HW-initiated toggling (i.e. CPU core +* power-gated), the command should be retried in that case. +*/ +do { +tegra_pmc_writel (pmc,PWRGATE_TOGGLE_START | id,PWRGATE_TOGGLE ); + +/* wait for PMC to execute the command */ + ret =readx_poll_timeout (tegra_powergate_state, id, status, + status == new_state,1 ,10 ); + }while (ret == -ETIMEDOUT && retries--); + +return ret; +} + +static inline bool tegra_powergate_toggle_ready (struct tegra_pmc *pmc) +{ +return !(tegra_pmc_readl (pmc,PWRGATE_TOGGLE ) &PWRGATE_TOGGLE_START ); +} + +static int tegra114_powergate_set (struct tegra_pmc *pmc,unsigned int id, +bool new_state) +{ +bool status; +int err; + +/* wait while PMC power gating is contended */ + err =readx_poll_timeout (tegra_powergate_toggle_ready, pmc, status, + status == true,1 ,100 ); +if (err) +return err; + +tegra_pmc_writel (pmc,PWRGATE_TOGGLE_START | id,PWRGATE_TOGGLE ); + +/* wait for PMC to accept the command */ + err =readx_poll_timeout (tegra_powergate_toggle_ready, pmc, status, + status == true,1 ,100 ); +if (err) +return err; + +/* wait for PMC to execute the command */ + err =readx_poll_timeout (tegra_powergate_state, id, status, + status == new_state,10 ,100000 ); +if (err) +return err; + +return 0 ; +} +/** * tegra_powergate_set() - set the state of a partition * @pmc: power management controller
@@ -526,7 +585,6 @@ static int tegra_powergate_lookup(struct tegra_pmc *pmc, const char *name)static int tegra_powergate_set (struct tegra_pmc *pmc,unsigned int id,bool new_state) { -bool status;int err;if (id ==TEGRA_POWERGATE_3D && pmc->soc->has_gpu_clamps)
@@ -539,10 +597,7 @@ static int tegra_powergate_set(struct tegra_pmc *pmc, unsigned int id,return 0 ; } -tegra_pmc_writel (pmc,PWRGATE_TOGGLE_START | id,PWRGATE_TOGGLE ); - - err =readx_poll_timeout (tegra_powergate_state, id, status, - status == new_state,10 ,100000 ); + err = pmc->soc->powergate_set (pmc, id, new_state);mutex_unlock (&pmc->powergates_lock);
@@ -2699,6 +2754,7 @@ static const struct tegra_pmc_soc tegra20_pmc_soc = { .regs = &tegra20_pmc_regs, .init = tegra20_pmc_init, .setup_irq_polarity = tegra20_pmc_setup_irq_polarity, + .powergate_set = tegra20_powergate_set, .reset_sources = NULL, .num_reset_sources = 0, .reset_levels = NULL,
@@ -2757,6 +2813,7 @@ static const struct tegra_pmc_soc tegra30_pmc_soc = { .regs = &tegra20_pmc_regs, .init = tegra20_pmc_init, .setup_irq_polarity = tegra20_pmc_setup_irq_polarity, + .powergate_set = tegra20_powergate_set, .reset_sources = tegra30_reset_sources, .num_reset_sources = ARRAY_SIZE(tegra30_reset_sources), .reset_levels = NULL,
@@ -2811,6 +2868,7 @@ static const struct tegra_pmc_soc tegra114_pmc_soc = { .regs = &tegra20_pmc_regs, .init = tegra20_pmc_init, .setup_irq_polarity = tegra20_pmc_setup_irq_polarity, + .powergate_set = tegra114_powergate_set, .reset_sources = tegra30_reset_sources, .num_reset_sources = ARRAY_SIZE(tegra30_reset_sources), .reset_levels = NULL,
@@ -2925,6 +2983,7 @@ static const struct tegra_pmc_soc tegra124_pmc_soc = { .regs = &tegra20_pmc_regs, .init = tegra20_pmc_init, .setup_irq_polarity = tegra20_pmc_setup_irq_polarity, + .powergate_set = tegra114_powergate_set, .reset_sources = tegra30_reset_sources, .num_reset_sources = ARRAY_SIZE(tegra30_reset_sources), .reset_levels = NULL,
@@ -3048,6 +3107,7 @@ static const struct tegra_pmc_soc tegra210_pmc_soc = { .regs = &tegra20_pmc_regs, .init = tegra20_pmc_init, .setup_irq_polarity = tegra20_pmc_setup_irq_polarity, + .powergate_set = tegra114_powergate_set, .irq_set_wake = tegra210_pmc_irq_set_wake, .irq_set_type = tegra210_pmc_irq_set_type, .reset_sources = tegra210_reset_sources,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 90/342 arm64: dts: imx8mq-librem5-r3: Mark buck3 as always on
In reply to Greg Kroah-HartmanFrom: Sebastian Krzyszkowiak <[email protected]>
[ Upstream commit a362b0cc94d476b097ba0ff466958c1d4e27e219 ]
Commit 99e71c029213 ("arm64: dts: imx8mq-librem5: Don't mark buck3 as always on") removed always-on marking from GPU regulator, which is great for power saving - however it introduces additional i2c0 traffic which can be deadly for devices from the Dogwood batch.
To workaround the i2c0 shutdown issue on Dogwood, this commit marks buck3 as always-on again - but only for Dogwood (r3).
--- arch/arm64/boot/dts/freescale/imx8mq-librem5-r3.dts | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm64/boot/dts/freescale/imx8mq-librem5-r3.dts +4 -0
@@ -22,6 +22,10 @@ ti,termination-current = <144000>; /* uA */ }; +&buck3_reg { + regulator-always-on; +}; + &proximity { proximity-near-level = <25>; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 91/342 tee: optee: do not check memref size on return from Secure World
In reply to Greg Kroah-HartmanFrom: Jerome Forissier <[email protected]>
[ Upstream commit c650b8dc7a7910eb25af0aac1720f778b29e679d ]
When Secure World returns, it may have changed the size attribute of the memory references passed as [in/out] parameters. The GlobalPlatform TEE Internal Core API specification does not restrict the values that this size can take. In particular, Secure World may increase the value to be larger than the size of the input buffer to indicate that it needs more.
Therefore, the size check in optee_from_msg_param() is incorrect and needs to be removed. This fixes a number of failed test cases in the GlobalPlatform TEE Initial Configuratiom Test Suite v2_0_0_0-2017_06_09 when OP-TEE is compiled without dynamic shared memory support (CFG_CORE_DYN_SHM=n).
--- drivers/tee/optee/core.c | 10 ---------- 1 file changed, 10 deletions(-)
drivers/tee/optee/core.c +0 -10
@@ -79,16 +79,6 @@ int optee_from_msg_param(struct tee_param *params, size_t num_params,return rc; p->u.memref.shm_offs = mp->u.tmem.buf_ptr - pa; p->u.memref.shm = shm; - -/* Check that the memref is covered by the shm object */ -if (p->u.memref.size) { -size_t o = p->u.memref.shm_offs + - p->u.memref.size -1 ; - - rc =tee_shm_get_pa (shm, o,NULL ); -if (rc) -return rc; - }break ;case OPTEE_MSG_ATTR_TYPE_RMEM_INPUT :case OPTEE_MSG_ATTR_TYPE_RMEM_OUTPUT :
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 92/342 soundwire: cadence: only prepare attached devices on clock stop
In reply to Greg Kroah-HartmanFrom: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 58ef9356260c291a4321e07ff507f31a1d8212af ]
We sometimes see COMMAND_IGNORED responses during the clock stop sequence. It turns out we already have information if devices are present on a link, so we should only prepare those when they are attached.
In addition, even when COMMAND_IGNORED are received, we should still proceed with the clock stop. The device will not be prepared but that's not a problem.
The only case where the clock stop will fail is if the Cadence IP reports an error (including a timeout), or if the devices throw a COMMAND_FAILED response.
--- drivers/soundwire/cadence_master.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/soundwire/cadence_master.c +6 -4
@@ -1449,10 +1449,12 @@ int sdw_cdns_clock_stop(struct sdw_cdns *cdns, bool block_wake) }/* Prepare slaves for clock stop */ - ret =sdw_bus_prep_clk_stop (&cdns->bus); -if (ret <0 ) { -dev_err (cdns->dev,"prepare clock stop failed %d" , ret); -return ret; +if (slave_present) { + ret =sdw_bus_prep_clk_stop (&cdns->bus); +if (ret <0 && ret != -ENODATA ) { +dev_err (cdns->dev,"prepare clock stop failed %d\n" , ret); +return ret; + } }/*
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 93/342 perf/arm_pmu_platform: Use dev_err_probe() for IRQ errors
In reply to Greg Kroah-HartmanFrom: Robin Murphy <[email protected]>
[ Upstream commit 11fa1dc8020a2a9e0c59998920092d4df3fb7308 ]
By virtue of using platform_irq_get_optional() under the covers, platform_irq_count() needs the target interrupt controller to be available and may return -EPROBE_DEFER if it isn't. Let's use dev_err_probe() to avoid a spurious error log (and help debug any deferral issues) in that case.
--- drivers/perf/arm_pmu_platform.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/perf/arm_pmu_platform.c +3 -4
@@ -6,6 +6,7 @@* Copyright (C) 2010 ARM Ltd., Will Deacon <[email protected]> */ #define pr_fmt (fmt) "hw perfevents: " fmt +#define dev_fmt pr_fmt#include <linux/bug.h> #include <linux/cpumask.h>
@@ -100,10 +101,8 @@ static int pmu_parse_irqs(struct arm_pmu *pmu)struct pmu_hw_events __percpu *hw_events = pmu->hw_events; num_irqs =platform_irq_count (pdev); -if (num_irqs <0 ) { -pr_err ("unable to count PMU IRQs\n" ); -return num_irqs; - } +if (num_irqs <0 ) +return dev_err_probe (&pdev->dev, num_irqs,"unable to count PMU IRQs\n" );/* * In this case we have no idea which CPUs are covered by the PMU.
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 94/342 perf/arm_pmu_platform: Fix error handling
In reply to Greg Kroah-HartmanFrom: Robin Murphy <[email protected]>
[ Upstream commit e338cb6bef254821a8c095018fd27254d74bfd6a ]
If we're aborting after failing to register the PMU device, we probably don't want to leak the IRQs that we've claimed.
--- drivers/perf/arm_pmu_platform.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/perf/arm_pmu_platform.c +1 -1
@@ -235,7 +235,7 @@ int arm_pmu_device_probe(struct platform_device *pdev, ret =armpmu_register (pmu);if (ret) - goto out_free; + goto out_free_irqs;return 0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 95/342 random: initialize ChaCha20 constants with correct endianness
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
[ Upstream commit a181e0fdb2164268274453b5b291589edbb9b22d ]
On big endian CPUs, the ChaCha20-based CRNG is using the wrong endianness for the ChaCha20 constants.
This doesn't matter cryptographically, but technically it means it's not ChaCha20 anymore. Fix it to always use the standard constants.
--- drivers/char/random.c | 4 ++-- include/crypto/chacha.h | 9 +++++++-- 2 files changed, 9 insertions(+), 4 deletions(-)
drivers/char/random.c +2 -2
@@ -819,7 +819,7 @@ static bool __init crng_init_try_arch_early(struct crng_state *crng)static void __maybe_unused crng_initialize_secondary (struct crng_state *crng) { -memcpy (&crng->state[0 ],"expand 32-byte k" ,16 ); +chacha_init_consts (crng->state);_get_random_bytes (&crng->state[4 ],sizeof (__u32) *12 );crng_init_try_arch (crng); crng->init_time = jiffies -CRNG_RESEED_INTERVAL -1 ;
@@ -827,7 +827,7 @@ static void __maybe_unused crng_initialize_secondary(struct crng_state *crng)static void __init crng_initialize_primary (struct crng_state *crng) { -memcpy (&crng->state[0 ],"expand 32-byte k" ,16 ); +chacha_init_consts (crng->state);_extract_entropy (&input_pool, &crng->state[4 ],sizeof (__u32) *12 ,0 );if (crng_init_try_arch_early (crng) && trust_cpu) {invalidate_batched_entropy ();
include/crypto/chacha.h +7 -2
@@ -47,13 +47,18 @@ static inline void hchacha_block(const u32 *state, u32 *out, int nrounds)hchacha_block_generic (state, out, nrounds); } -void chacha_init_arch (u32 *state,const u32 *key,const u8 *iv); -static inline void chacha_init_generic (u32 *state,const u32 *key,const u8 *iv) +static inline void chacha_init_consts (u32 *state) { state[0 ] =0x61707865 ;/* "expa" */ state[1 ] =0x3320646e ;/* "nd 3" */ state[2 ] =0x79622d32 ;/* "2-by" */ state[3 ] =0x6b206574 ;/* "te k" */ +} + +void chacha_init_arch (u32 *state,const u32 *key,const u8 *iv); +static inline void chacha_init_generic (u32 *state,const u32 *key,const u8 *iv) +{ +chacha_init_consts (state); state[4 ] = key[0 ]; state[5 ] = key[1 ]; state[6 ] = key[2 ];
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 96/342 usb: xhci-mtk: support quirk to disable usb2 lpm
In reply to Greg Kroah-HartmanFrom: Chunfeng Yun <[email protected]>
[ Upstream commit bee1f89aad2a51cd3339571bc8eadbb0dc88a683 ]
The xHCI driver support usb2 HW LPM by default, here add support XHCI_HW_LPM_DISABLE quirk, then we can disable usb2 lpm when need it.
--- drivers/usb/host/xhci-mtk.c | 3 +++ drivers/usb/host/xhci-mtk.h | 1 + 2 files changed, 4 insertions(+)
drivers/usb/host/xhci-mtk.c +3 -0
@@ -397,6 +397,8 @@ static void xhci_mtk_quirks(struct device *dev, struct xhci_hcd *xhci) xhci->quirks |=XHCI_SPURIOUS_SUCCESS ;if (mtk->lpm_support) xhci->quirks |=XHCI_LPM_SUPPORT ; +if (mtk->u2_lpm_disable) + xhci->quirks |=XHCI_HW_LPM_DISABLE ;/* * MTK xHCI 0.96: PSA is 1 by default even if doesn't support stream,
@@ -469,6 +471,7 @@ static int xhci_mtk_probe(struct platform_device *pdev)return ret; mtk->lpm_support =of_property_read_bool (node,"usb3-lpm-capable" ); + mtk->u2_lpm_disable =of_property_read_bool (node,"usb2-lpm-disable" );/* optional property, ignore the error if it does not exist */ of_property_read_u32 (node,"mediatek,u3p-dis-msk" , &mtk->u3p_dis_msk);
drivers/usb/host/xhci-mtk.h +1 -0
@@ -150,6 +150,7 @@ struct xhci_hcd_mtk {struct phy **phys;int num_phys;bool lpm_support; +bool u2_lpm_disable;/* usb remote wakeup */ bool uwk_en;struct regmap *uwk;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 97/342 fpga: dfl: pci: add DID for D5005 PAC cards
In reply to Greg Kroah-HartmanFrom: Russ Weight <[email protected]>
[ Upstream commit a78a51a851ed3edc83264a67e2ba77a34f27965f ]
This patch adds the approved PCI Express Device IDs for the PF and VF for the card for D5005 PAC cards.
--- drivers/fpga/dfl-pci.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
drivers/fpga/dfl-pci.c +11 -7
@@ -61,14 +61,16 @@ static void cci_pci_free_irq(struct pci_dev *pcidev) }/* PCI Device ID */ -#define PCIE_DEVICE_ID_PF_INT_5_X 0xBCBD -#define PCIE_DEVICE_ID_PF_INT_6_X 0xBCC0 -#define PCIE_DEVICE_ID_PF_DSC_1_X 0x09C4 -#define PCIE_DEVICE_ID_INTEL_PAC_N3000 0x0B30 +#define PCIE_DEVICE_ID_PF_INT_5_X 0xBCBD +#define PCIE_DEVICE_ID_PF_INT_6_X 0xBCC0 +#define PCIE_DEVICE_ID_PF_DSC_1_X 0x09C4 +#define PCIE_DEVICE_ID_INTEL_PAC_N3000 0x0B30 +#define PCIE_DEVICE_ID_INTEL_PAC_D5005 0x0B2B/* VF Device */ -#define PCIE_DEVICE_ID_VF_INT_5_X 0xBCBF -#define PCIE_DEVICE_ID_VF_INT_6_X 0xBCC1 -#define PCIE_DEVICE_ID_VF_DSC_1_X 0x09C5 +#define PCIE_DEVICE_ID_VF_INT_5_X 0xBCBF +#define PCIE_DEVICE_ID_VF_INT_6_X 0xBCC1 +#define PCIE_DEVICE_ID_VF_DSC_1_X 0x09C5 +#define PCIE_DEVICE_ID_INTEL_PAC_D5005_VF 0x0B2Cstatic struct pci_device_id cci_pcie_id_tbl[] = { {PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCIE_DEVICE_ID_PF_INT_5_X ),},
@@ -78,6 +80,8 @@ static struct pci_device_id cci_pcie_id_tbl[] = { {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCIE_DEVICE_ID_PF_DSC_1_X),}, {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCIE_DEVICE_ID_VF_DSC_1_X),}, {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCIE_DEVICE_ID_INTEL_PAC_N3000),}, + {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCIE_DEVICE_ID_INTEL_PAC_D5005),}, + {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCIE_DEVICE_ID_INTEL_PAC_D5005_VF),}, {0,} };MODULE_DEVICE_TABLE (pci, cci_pcie_id_tbl);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 98/342 xhci: check port array allocation was successful before dereferencing it
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
[ Upstream commit 8a157d2ff104d2849c58226a1fd02365d7d60150 ]
return if rhub->ports is null after rhub->ports = kcalloc_node() Klockwork reported issue
--- drivers/usb/host/xhci-mem.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/host/xhci-mem.c +3 -0
@@ -2262,6 +2262,9 @@ static void xhci_create_rhub_port_array(struct xhci_hcd *xhci,return ; rhub->ports =kcalloc_node (rhub->num_ports,sizeof (*rhub->ports), flags,dev_to_node (dev)); +if (!rhub->ports) +return ; +for (i =0 ; i <HCS_MAX_PORTS (xhci->hcs_params1); i++) {if (xhci->hw_ports[i].rhub != rhub || xhci->hw_ports[i].hcd_portnum ==DUPLICATE_ENTRY )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 99/342 xhci: check control context is valid before dereferencing it.
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
[ Upstream commit 597899d2f7c5619c87185ee7953d004bd37fd0eb ]
Don't dereference ctrl_ctx before checking it's valid. Issue reported by Klockwork
--- drivers/usb/host/xhci.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/usb/host/xhci.c +8 -0
@@ -3351,6 +3351,14 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd,/* config ep command clears toggle if add and drop ep flags are set */ ctrl_ctx =xhci_get_input_control_ctx (cfg_cmd->in_ctx); +if (!ctrl_ctx) { +spin_unlock_irqrestore (&xhci->lock, flags); +xhci_free_command (xhci, cfg_cmd); +xhci_warn (xhci,"%s: Could not get input context, bad type.\n" , + __func__); + goto cleanup; + } +xhci_setup_input_ctx_for_config_ep (xhci, cfg_cmd->in_ctx, vdev->out_ctx, ctrl_ctx, ep_flag, ep_flag);xhci_endpoint_copy (xhci, cfg_cmd->in_ctx, vdev->out_ctx, ep_index);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 100/342 xhci: fix potential array out of bounds with several interrupters
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
[ Upstream commit 286fd02fd54b6acab65809549cf5fb3f2a886696 ]
The Max Interrupters supported by the controller is given in a 10bit wide bitfield, but the driver uses a fixed 128 size array to index these interrupters.
Klockwork reports a possible array out of bounds case which in theory is possible. In practice this hasn't been hit as a common number of Max Interrupters for new controllers is 8, not even close to 128.
This needs to be fixed anyway
--- drivers/usb/host/xhci.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/usb/host/xhci.c +5 -1
@@ -228,6 +228,7 @@ static void xhci_zero_64b_regs(struct xhci_hcd *xhci)struct device *dev =xhci_to_hcd (xhci)->self.sysdev;int err, i;u64 val; +u32 intrs;/* * Some Renesas controllers get into a weird state if they are
@@ -266,7 +267,10 @@ static void xhci_zero_64b_regs(struct xhci_hcd *xhci)if (upper_32_bits (val))xhci_write_64 (xhci,0 , &xhci->op_regs->cmd_ring); -for (i =0 ; i <HCS_MAX_INTRS (xhci->hcs_params1); i++) { + intrs =min_t (u32,HCS_MAX_INTRS (xhci->hcs_params1), +ARRAY_SIZE (xhci->run_regs->ir_set)); + +for (i =0 ; i < intrs; i++) {struct xhci_intr_reg __iomem *ir; ir = &xhci->run_regs->ir_set[i];
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 101/342 bus: mhi: core: Clear context for stopped channels from remove()
In reply to Greg Kroah-HartmanFrom: Bhaumik Bhatt <[email protected]>
[ Upstream commit 4e44ae3d6d9c2c2a6d9356dd279c925532d5cd8c ]
If a channel was explicitly stopped but not reset and a driver remove is issued, clean up the channel context such that it is reflected on the device. This move is useful if a client driver module is unloaded or a device crash occurs with the host having placed the channel in a stopped state.
--- drivers/bus/mhi/core/init.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/bus/mhi/core/init.c +2 -1
@@ -1301,7 +1301,8 @@ static int mhi_driver_remove(struct device *dev)mutex_lock (&mhi_chan->mutex); -if (ch_state[dir] ==MHI_CH_STATE_ENABLED && +if ((ch_state[dir] ==MHI_CH_STATE_ENABLED || + ch_state[dir] ==MHI_CH_STATE_STOP ) && !mhi_chan->offload_ch)mhi_deinit_chan_ctxt (mhi_cntrl, mhi_chan);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 102/342 ARM: dts: at91: change the key code of the gpio key
In reply to Greg Kroah-HartmanFrom: Ludovic Desroches <[email protected]>
[ Upstream commit ca7a049ad1a72ec5f03d1330b53575237fcb727c ]
Having a button code and not a key code causes issues with libinput. udev won't set ID_INPUT_KEY. If it is forced, then it causes a bug within libinput.
--- arch/arm/boot/dts/at91-sam9x60ek.dts | 3 ++- arch/arm/boot/dts/at91-sama5d27_som1_ek.dts | 3 ++- arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts | 3 ++- arch/arm/boot/dts/at91-sama5d2_icp.dts | 3 ++- arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts | 3 ++- arch/arm/boot/dts/at91-sama5d2_xplained.dts | 3 ++- arch/arm/boot/dts/at91-sama5d3_xplained.dts | 3 ++- arch/arm/boot/dts/at91sam9260ek.dts | 3 ++- arch/arm/boot/dts/at91sam9g20ek_common.dtsi | 3 ++- 9 files changed, 18 insertions(+), 9 deletions(-)
arch/arm/boot/dts/at91-sam9x60ek.dts +2 -1
@@ -8,6 +8,7 @@ */ /dts-v1/; #include "sam9x60.dtsi" +#include <dt-bindings/input/input.h> / { model = "Microchip SAM9X60-EK";
@@ -84,7 +85,7 @@ sw1 { label = "SW1"; gpios = <&pioD 18 GPIO_ACTIVE_LOW>; - linux,code=<0x104>; + linux,code=<KEY_PROG1>; wakeup-source; }; };
arch/arm/boot/dts/at91-sama5d27_som1_ek.dts +2 -1
@@ -11,6 +11,7 @@ #include "at91-sama5d27_som1.dtsi" #include <dt-bindings/mfd/atmel-flexcom.h> #include <dt-bindings/gpio/gpio.h> +#include <dt-bindings/input/input.h> / { model = "Atmel SAMA5D27 SOM1 EK";
@@ -467,7 +468,7 @@ pb4 { label = "USER"; gpios = <&pioA PIN_PA29 GPIO_ACTIVE_LOW>; - linux,code = <0x104>; + linux,code = <KEY_PROG1>; wakeup-source; }; };
arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts +2 -1
@@ -8,6 +8,7 @@ */ /dts-v1/; #include "at91-sama5d27_wlsom1.dtsi" +#include <dt-bindings/input/input.h> / { model = "Microchip SAMA5D27 WLSOM1 EK";
@@ -35,7 +36,7 @@ sw4 { label = "USER BUTTON"; gpios = <&pioA PIN_PB2 GPIO_ACTIVE_LOW>; - linux,code = <0x104>; + linux,code = <KEY_PROG1>; wakeup-source; }; };
arch/arm/boot/dts/at91-sama5d2_icp.dts +2 -1
@@ -12,6 +12,7 @@ #include "sama5d2.dtsi" #include "sama5d2-pinfunc.h" #include <dt-bindings/gpio/gpio.h> +#include <dt-bindings/input/input.h> #include <dt-bindings/mfd/atmel-flexcom.h> / {
@@ -51,7 +52,7 @@ sw4 { label = "USER_PB1"; gpios = <&pioA PIN_PD0 GPIO_ACTIVE_LOW>; - linux,code = <0x104>; + linux,code = <KEY_PROG1>; wakeup-source; }; };
arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts +2 -1
@@ -11,6 +11,7 @@ #include "sama5d2-pinfunc.h" #include <dt-bindings/mfd/atmel-flexcom.h> #include <dt-bindings/gpio/gpio.h> +#include <dt-bindings/input/input.h> #include <dt-bindings/pinctrl/at91.h> / {
@@ -403,7 +404,7 @@ bp1 { label = "PB_USER"; gpios = <&pioA PIN_PA10 GPIO_ACTIVE_LOW>; - linux,code = <0x104>; + linux,code = <KEY_PROG1>; wakeup-source; }; };
arch/arm/boot/dts/at91-sama5d2_xplained.dts +2 -1
@@ -10,6 +10,7 @@ #include "sama5d2-pinfunc.h" #include <dt-bindings/mfd/atmel-flexcom.h> #include <dt-bindings/gpio/gpio.h> +#include <dt-bindings/input/input.h> #include <dt-bindings/regulator/active-semi,8945a-regulator.h> / {
@@ -713,7 +714,7 @@ bp1 { label = "PB_USER"; gpios = <&pioA PIN_PB9 GPIO_ACTIVE_LOW>; - linux,code = <0x104>; + linux,code = <KEY_PROG1>; wakeup-source; }; };
arch/arm/boot/dts/at91-sama5d3_xplained.dts +2 -1
@@ -7,6 +7,7 @@ */ /dts-v1/; #include "sama5d36.dtsi" +#include <dt-bindings/input/input.h> / { model = "SAMA5D3 Xplained";
@@ -354,7 +355,7 @@ bp3 { label = "PB_USER"; gpios = <&pioE 29 GPIO_ACTIVE_LOW>; - linux,code = <0x104>; + linux,code = <KEY_PROG1>; wakeup-source; }; };
arch/arm/boot/dts/at91sam9260ek.dts +2 -1
@@ -7,6 +7,7 @@ */ /dts-v1/; #include "at91sam9260.dtsi" +#include <dt-bindings/input/input.h> / { model = "Atmel at91sam9260ek";
@@ -156,7 +157,7 @@ btn4 { label = "Button 4"; gpios = <&pioA 31 GPIO_ACTIVE_LOW>; - linux,code = <0x104>; + linux,code = <KEY_PROG1>; wakeup-source; }; };
arch/arm/boot/dts/at91sam9g20ek_common.dtsi +2 -1
@@ -5,6 +5,7 @@ * Copyright (C) 2012 Jean-Christophe PLAGNIOL-VILLARD <[email protected]> */ #include "at91sam9g20.dtsi" +#include <dt-bindings/input/input.h> / {
@@ -234,7 +235,7 @@ btn4 { label = "Button 4"; gpios = <&pioA 31 GPIO_ACTIVE_LOW>; - linux,code = <0x104>; + linux,code = <KEY_PROG1>; wakeup-source; }; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 103/342 tools/power/x86/intel-speed-select: Increase string size
In reply to Greg Kroah-HartmanFrom: Srinivas Pandruvada <[email protected]>
[ Upstream commit 2e70b710f36c80b6e78cf32a5c30b46dbb72213c ]
The current string size to print cpulist can accommodate upto 80 logical CPUs per package. But this limit is not enough. So increase the string size. Also prevent buffer overflow, if the string size reaches limit.
--- tools/power/x86/intel-speed-select/isst-display.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
tools/power/x86/intel-speed-select/isst-display.c +10 -2
@@ -25,10 +25,14 @@ static void printcpulist(int str_len, char *str, int mask_size, index =snprintf (&str[curr_index], str_len - curr_index,"," ); curr_index += index; +if (curr_index >= str_len) +break ; } index =snprintf (&str[curr_index], str_len - curr_index,"%d" , i); curr_index += index; +if (curr_index >= str_len) +break ; first =0 ; } }
@@ -64,10 +68,14 @@ static void printcpumask(int str_len, char *str, int mask_size, index =snprintf (&str[curr_index], str_len - curr_index,"%08x" , mask[i]); curr_index += index; +if (curr_index >= str_len) +break ;if (i) {strncat (&str[curr_index],"," , str_len - curr_index); curr_index++; } +if (curr_index >= str_len) +break ; }free (mask);
@@ -185,7 +193,7 @@ static void _isst_pbf_display_information(int cpu, FILE *outf, int level, int disp_level) {char header[256 ]; -char value[256 ]; +char value[512 ];snprintf (header,sizeof (header),"speed-select-base-freq-properties" );format_and_print (outf, disp_level, header,NULL );
@@ -349,7 +357,7 @@ void isst_ctdp_display_information(int cpu, FILE *outf, int tdp_level, struct isst_pkg_ctdp *pkg_dev) {char header[256 ]; -char value[256 ]; +char value[512 ];static int level;int i;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 104/342 platform/x86: ISST: Account for increased timeout in some cases
In reply to Greg Kroah-HartmanFrom: Srinivas Pandruvada <[email protected]>
[ Upstream commit 5c782817a981981917ec3c647cf521022ee07143 ]
In some cases when firmware is busy or updating, some mailbox commands still timeout on some newer CPUs. To fix this issue, change how we process timeout.
With this change, replaced timeout from using simple count with real timeout in micro-seconds using ktime. When the command response takes more than average processing time, yield to other tasks. The worst case timeout is extended upto 1 milli-second.
--- .../intel_speed_select_if/isst_if_mbox_pci.c | 33 +++++++++++++------ 1 file changed, 23 insertions(+), 10 deletions(-)
drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c +23 -10
@@ -21,12 +21,16 @@#define PUNIT_MAILBOX_BUSY_BIT 31/* -* The average time to complete some commands is about 40us. The current -* count is enough to satisfy 40us. But when the firmware is very busy, this -* causes timeout occasionally. So increase to deal with some worst case -* scenarios. Most of the command still complete in few us. +* The average time to complete mailbox commands is less than 40us. Most of +* the commands complete in few micro seconds. But the same firmware handles +* requests from all power management features. +* We can create a scenario where we flood the firmware with requests then +* the mailbox response can be delayed for 100s of micro seconds. So define +* two timeouts. One for average case and one for long. +* If the firmware is taking more than average, just call cond_resched(). */ -#define OS_MAILBOX_RETRY_COUNT 100 +#define OS_MAILBOX_TIMEOUT_AVG_US 40 +#define OS_MAILBOX_TIMEOUT_MAX_US 1000struct isst_if_device {struct mutex mutex;
@@ -35,11 +39,13 @@ struct isst_if_device {static int isst_if_mbox_cmd (struct pci_dev *pdev,struct isst_if_mbox_cmd *mbox_cmd) { -u32 retries, data; +s64 tm_delta =0 ; +ktime_t tm; +u32 data;int ret;/* Poll for rb bit == 0 */ - retries =OS_MAILBOX_RETRY_COUNT ; + tm =ktime_get (); do { ret = pci_read_config_dword(pdev, PUNIT_MAILBOX_INTERFACE, &data);
@@ -48,11 +54,14 @@ static int isst_if_mbox_cmd(struct pci_dev *pdev,if (data &BIT_ULL (PUNIT_MAILBOX_BUSY_BIT )) { ret = -EBUSY ; + tm_delta =ktime_us_delta (ktime_get (), tm); +if (tm_delta >OS_MAILBOX_TIMEOUT_AVG_US ) +cond_resched ();continue ; } ret =0 ;break ; - }while (--retries); + }while (tm_delta <OS_MAILBOX_TIMEOUT_MAX_US );if (ret)return ret;
@@ -74,7 +83,8 @@ static int isst_if_mbox_cmd(struct pci_dev *pdev,return ret;/* Poll for rb bit == 0 */ - retries =OS_MAILBOX_RETRY_COUNT ; + tm_delta =0 ; + tm =ktime_get (); do { ret = pci_read_config_dword(pdev, PUNIT_MAILBOX_INTERFACE, &data);
@@ -83,6 +93,9 @@ static int isst_if_mbox_cmd(struct pci_dev *pdev,if (data &BIT_ULL (PUNIT_MAILBOX_BUSY_BIT )) { ret = -EBUSY ; + tm_delta =ktime_us_delta (ktime_get (), tm); +if (tm_delta >OS_MAILBOX_TIMEOUT_AVG_US ) +cond_resched ();continue ; }
@@ -96,7 +109,7 @@ static int isst_if_mbox_cmd(struct pci_dev *pdev, mbox_cmd->resp_data = data; ret =0 ;break ; - }while (--retries); + }while (tm_delta <OS_MAILBOX_TIMEOUT_MAX_US );return ret; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 105/342 clocksource/drivers/dw_apb_timer_of: Add handling for potential memory leak
In reply to Greg Kroah-HartmanFrom: Dinh Nguyen <[email protected]>
[ Upstream commit 397dc6f7ca3c858dc95800f299357311ccf679e6 ]
Add calls to disable the clock and unmap the timer base address in case of any failures.
--- drivers/clocksource/dw_apb_timer_of.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-)
drivers/clocksource/dw_apb_timer_of.c +21 -5
@@ -52,18 +52,34 @@ static int __init timer_get_base_and_rate(struct device_node *np,return 0 ; timer_clk =of_clk_get_by_name (np,"timer" ); -if (IS_ERR (timer_clk)) -return PTR_ERR (timer_clk); +if (IS_ERR (timer_clk)) { + ret =PTR_ERR (timer_clk); + goto out_pclk_disable; + } ret =clk_prepare_enable (timer_clk);if (ret) -return ret; + goto out_timer_clk_put; *rate =clk_get_rate (timer_clk); -if (!(*rate)) -return -EINVAL ; +if (!(*rate)) { + ret = -EINVAL ; + goto out_timer_clk_disable; + }return 0 ; + +out_timer_clk_disable: +clk_disable_unprepare (timer_clk); +out_timer_clk_put: +clk_put (timer_clk); +out_pclk_disable: +if (!IS_ERR (pclk)) { +clk_disable_unprepare (pclk); +clk_put (pclk); + } +iounmap (*base); +return ret; }static int __init add_clockevent (struct device_node *event_timer)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 106/342 resource: Prevent irqresource_disabled() from erasing flags
In reply to Greg Kroah-HartmanFrom: Angela Czubak <[email protected]>
[ Upstream commit d08a745729646f407277e904b02991458f20d261 ]
Some Chromebooks use hard-coded interrupts in their ACPI tables. This is an excerpt as dumped on Relm:
...
Name (_HID, "ELAN0001") // _HID: Hardware ID
Name (_DDN, "Elan Touchscreen ") // _DDN: DOS Device Name
Name (_UID, 0x05) // _UID: Unique ID
Name (ISTP, Zero)
Method (_CRS, 0, NotSerialized) // _CRS: Current Resource Settings
{
Name (BUF0, ResourceTemplate ()
{
I2cSerialBusV2 (0x0010, ControllerInitiated, 0x00061A80,
AddressingMode7Bit, "\\_SB.I2C1",
0x00, ResourceConsumer, , Exclusive,
)
Interrupt (ResourceConsumer, Edge, ActiveLow, Exclusive, ,, )
{
0x000000B8,
}
})
Return (BUF0) /* \_SB_.I2C1.ETSA._CRS.BUF0 */
}...
This interrupt is hard-coded to 0xB8 = 184 which is too high to be mapped to IO-APIC, so no triggering information is propagated as acpi_register_gsi() fails and irqresource_disabled() is issued, which leads to erasing triggering and polarity information.
Do not overwrite flags as it leads to erasing triggering and polarity information which might be useful in case of hard-coded interrupts. This way the information can be read later on even though mapping to APIC domain failed.
--- include/linux/ioport.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/ioport.h +1 -1
@@ -331,7 +331,7 @@ static inline void irqresource_disabled(struct resource *res, u32 irq) { res->start = irq; res->end = irq; - res->flags =IORESOURCE_IRQ |IORESOURCE_DISABLED |IORESOURCE_UNSET ; + res->flags |=IORESOURCE_IRQ |IORESOURCE_DISABLED |IORESOURCE_UNSET ; }#ifdef CONFIG_IO_STRICT_DEVMEM
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 107/342 spi: dln2: Fix reference leak to master
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit 9b844b087124c1538d05f40fda8a4fec75af55be ]
Call spi_master_get() holds the reference count to master device, thus we need an additional spi_master_put() call to reduce the reference count, otherwise we will leak a reference to master.
This commit fix it by removing the unnecessary spi_master_get().
--- drivers/spi/spi-dln2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-dln2.c +1 -1
@@ -780,7 +780,7 @@ exit_free_master:static int dln2_spi_remove (struct platform_device *pdev) { -struct spi_master *master =spi_master_get (platform_get_drvdata (pdev)); +struct spi_master *master =platform_get_drvdata (pdev);struct dln2_spi *dln2 =spi_master_get_devdata (master);pm_runtime_disable (&pdev->dev);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 108/342 spi: omap-100k: Fix reference leak to master
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit a23faea76d4cf5f75decb574491e66f9ecd707e7 ]
Call spi_master_get() holds the reference count to master device, thus we need an additional spi_master_put() call to reduce the reference count, otherwise we will leak a reference to master.
This commit fix it by removing the unnecessary spi_master_get().
--- drivers/spi/spi-omap-100k.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/spi/spi-omap-100k.c +3 -3
@@ -424,7 +424,7 @@ err:static int omap1_spi100k_remove (struct platform_device *pdev) { -struct spi_master *master =spi_master_get (platform_get_drvdata (pdev)); +struct spi_master *master =platform_get_drvdata (pdev);struct omap1_spi100k *spi100k =spi_master_get_devdata (master);pm_runtime_disable (&pdev->dev);
@@ -438,7 +438,7 @@ static int omap1_spi100k_remove(struct platform_device *pdev)#ifdef CONFIG_PM static int omap1_spi100k_runtime_suspend (struct device *dev) { -struct spi_master *master =spi_master_get (dev_get_drvdata (dev)); +struct spi_master *master =dev_get_drvdata (dev);struct omap1_spi100k *spi100k =spi_master_get_devdata (master);clk_disable_unprepare (spi100k->ick);
@@ -449,7 +449,7 @@ static int omap1_spi100k_runtime_suspend(struct device *dev)static int omap1_spi100k_runtime_resume (struct device *dev) { -struct spi_master *master =spi_master_get (dev_get_drvdata (dev)); +struct spi_master *master =dev_get_drvdata (dev);struct omap1_spi100k *spi100k =spi_master_get_devdata (master);int ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 109/342 spi: qup: fix PM reference leak in spi_qup_remove()
In reply to Greg Kroah-HartmanFrom: Wang Li <[email protected]>
[ Upstream commit cec77e0a249892ceb10061bf17b63f9fb111d870 ]
pm_runtime_get_sync will increment pm usage counter even it failed. Forgetting to putting operation will result in reference leak here. Fix it by replacing it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/spi/spi-qup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-qup.c +1 -1
@@ -1263,7 +1263,7 @@ static int spi_qup_remove(struct platform_device *pdev)struct spi_qup *controller =spi_master_get_devdata (master);int ret; - ret =pm_runtime_get_sync (&pdev->dev); + ret =pm_runtime_resume_and_get (&pdev->dev);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 110/342 usb: gadget: tegra-xudc: Fix possible use-after-free in tegra_xudc_remove()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit a932ee40c276767cd55fadec9e38829bf441db41 ]
This driver's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free.
Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself.
--- drivers/usb/gadget/udc/tegra-xudc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/udc/tegra-xudc.c +1 -1
@@ -3883,7 +3883,7 @@ static int tegra_xudc_remove(struct platform_device *pdev)pm_runtime_get_sync (xudc->dev); -cancel_delayed_work (&xudc->plc_reset_work); +cancel_delayed_work_sync (&xudc->plc_reset_work);cancel_work_sync (&xudc->usb_role_sw_work);usb_del_gadget_udc (&xudc->gadget);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 111/342 usb: musb: fix PM reference leak in musb_irq_work()
In reply to Greg Kroah-HartmanFrom: Bixuan Cui <[email protected]>
[ Upstream commit 9535b99533904e9bc1607575aa8e9539a55435d7 ]
pm_runtime_get_sync will increment pm usage counter even it failed. thus a pairing decrement is needed.
Fix it by replacing it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/usb/musb/musb_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/musb/musb_core.c +1 -1
@@ -2070,7 +2070,7 @@ static void musb_irq_work(struct work_struct *data) struct musb *musb = container_of(data, struct musb, irq_work.work);int error; - error =pm_runtime_get_sync (musb->controller); + error =pm_runtime_resume_and_get (musb->controller);if (error <0 ) {dev_err (musb->controller,"Could not enable: %i\n" , error);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 112/342 usb: core: hub: Fix PM reference leak in usb_port_resume()
In reply to Greg Kroah-HartmanFrom: Bixuan Cui <[email protected]>
[ Upstream commit 025f97d188006eeee4417bb475a6878d1e0eed3f ]
pm_runtime_get_sync will increment pm usage counter even it failed. thus a pairing decrement is needed.
Fix it by replacing it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/usb/core/hub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/core/hub.c +1 -1
@@ -3556,7 +3556,7 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg)u16 portchange, portstatus;if (!test_and_set_bit (port1, hub->child_usage_bits)) { - status =pm_runtime_get_sync (&port_dev->dev); + status =pm_runtime_resume_and_get (&port_dev->dev);if (status <0 ) {dev_dbg (&udev->dev,"can't resume usb port, status %d\n" , status);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 113/342 usb: dwc3: gadget: Check for disabled LPM quirk
In reply to Greg Kroah-HartmanFrom: Thinh Nguyen <[email protected]>
[ Upstream commit 475e8be53d0496f9bc6159f4abb3ff5f9b90e8de ]
If the device doesn't support LPM, make sure to disable the LPM capability and don't advertise to the host that it supports it.
--- drivers/usb/dwc3/core.c | 2 ++ drivers/usb/dwc3/core.h | 4 +++- drivers/usb/dwc3/gadget.c | 9 ++++++++- 3 files changed, 13 insertions(+), 2 deletions(-)
drivers/usb/dwc3/core.c +2 -0
@@ -1297,6 +1297,8 @@ static void dwc3_get_properties(struct dwc3 *dwc) "snps,usb3_lpm_capable"); dwc->usb2_lpm_disable =device_property_read_bool (dev,"snps,usb2-lpm-disable" ); + dwc->usb2_gadget_lpm_disable =device_property_read_bool (dev, +"snps,usb2-gadget-lpm-disable" );device_property_read_u8 (dev,"snps,rx-thr-num-pkt-prd" , &rx_thr_num_pkt_prd); device_property_read_u8(dev, "snps,rx-max-burst-prd",
drivers/usb/dwc3/core.h +3 -1
@@ -1026,7 +1026,8 @@ struct dwc3_scratchpad_array {* @dis_start_transfer_quirk: set if start_transfer failure SW workaround is * not needed for DWC_usb31 version 1.70a-ea06 and below * @usb3_lpm_capable: set if hadrware supports Link Power Management -* @usb2_lpm_disable: set to disable usb2 lpm +* @usb2_lpm_disable: set to disable usb2 lpm for host +* @usb2_gadget_lpm_disable: set to disable usb2 lpm for gadget * @disable_scramble_quirk: set if we enable the disable scramble quirk * @u2exit_lfps_quirk: set if we enable u2exit lfps quirk * @u2ss_inp3_quirk: set if we enable P3 OK for U2/SS Inactive quirk
@@ -1227,6 +1228,7 @@ struct dwc3 { unsigned dis_start_transfer_quirk:1; unsigned usb3_lpm_capable:1; unsigned usb2_lpm_disable:1; + unsigned usb2_gadget_lpm_disable:1; unsigned disable_scramble_quirk:1; unsigned u2exit_lfps_quirk:1;
drivers/usb/dwc3/gadget.c +8 -1
@@ -3398,6 +3398,7 @@ static void dwc3_gadget_conndone_interrupt(struct dwc3 *dwc)/* Enable USB2 LPM Capability */ if (!DWC3_VER_IS_WITHIN(DWC3, ANY, 194A) && + !dwc->usb2_gadget_lpm_disable && (speed !=DWC3_DSTS_SUPERSPEED ) && (speed !=DWC3_DSTS_SUPERSPEED_PLUS )) { reg =dwc3_readl (dwc->regs,DWC3_DCFG );
@@ -3424,6 +3425,12 @@ static void dwc3_gadget_conndone_interrupt(struct dwc3 *dwc)dwc3_gadget_dctl_write_safe (dwc, reg); }else { +if (dwc->usb2_gadget_lpm_disable) { + reg =dwc3_readl (dwc->regs,DWC3_DCFG ); + reg &= ~DWC3_DCFG_LPM_CAP ; +dwc3_writel (dwc->regs,DWC3_DCFG , reg); + } + reg =dwc3_readl (dwc->regs,DWC3_DCTL ); reg &= ~DWC3_DCTL_HIRD_THRES_MASK ;dwc3_gadget_dctl_write_safe (dwc, reg);
@@ -3871,7 +3878,7 @@ int dwc3_gadget_init(struct dwc3 *dwc) dwc->gadget->speed =USB_SPEED_UNKNOWN ; dwc->gadget->sg_supported = true; dwc->gadget->name ="dwc3-gadget" ; - dwc->gadget->lpm_capable = true; + dwc->gadget->lpm_capable = !dwc->usb2_gadget_lpm_disable;/* * FIXME We might be setting max_speed to <SUPER, however versions
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 114/342 tty: n_gsm: check error while registering tty devices
In reply to Greg Kroah-HartmanFrom: Hillf Danton <[email protected]>
[ Upstream commit 0a360e8b65d62fe1a994f0a8da4f8d20877b2100 ]
Add the error path for registering tty devices and roll back in case of error in bid to avoid the UAF like the below one reported.
Plus syzbot reported general protection fault in cdev_del() on Sep 24, 2020 and both cases are down to the kobject_put() in tty_cdev_add().
------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 8923 at lib/refcount.c:28 refcount_warn_saturate+0x1cf/0x210 -origin/lib/refcount.c:28 Modules linked in: CPU: 1 PID: 8923 Comm: executor Not tainted 5.12.0-rc5+ #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:refcount_warn_saturate+0x1cf/0x210 -origin/lib/refcount.c:28 Code: 4f ff ff ff e8 32 fa b5 fe 48 c7 c7 3d f8 f6 86 e8 d6 ab c6 fe c6 05 7c 34 67 04 01 48 c7 c7 68 f8 6d 86 31 c0 e8 81 2e 9d fe <0f> 0b e9 22 ff ff ff e8 05 fa b5 fe 48 c7 c7 3e f8 f6 86 e8 a9 ab RSP: 0018:ffffc90001633c60 EFLAGS: 00010246 RAX: 15d08b2e34b77800 RBX: 0000000000000003 RCX: ffff88804c056c80 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000003 R08: ffffffff813767aa R09: 0001ffffffffffff R10: 0001ffffffffffff R11: ffff88804c056c80 R12: ffff888040b7d000 R13: ffff88804c206938 R14: ffff88804c206900 R15: ffff888041b18488 FS: 00000000022c9940(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9f9b122008 CR3: 0000000044b4b000 CR4: 0000000000750ee0 PKRU: 55555554 Call Trace: __refcount_sub_and_test -origin/./include/linux/refcount.h:283 [inline] __refcount_dec_and_test -origin/./include/linux/refcount.h:315 [inline] refcount_dec_and_test -origin/./include/linux/refcount.h:333 [inline] kref_put -origin/./include/linux/kref.h:64 [inline] kobject_put+0x17b/0x180 -origin/lib/kobject.c:753 cdev_del+0x4b/0x50 -origin/fs/char_dev.c:597 tty_unregister_device+0x99/0xd0 -origin/drivers/tty/tty_io.c:3343 gsmld_detach_gsm -origin/drivers/tty/n_gsm.c:2409 [inline] gsmld_close+0x6c/0x140 -origin/drivers/tty/n_gsm.c:2478 tty_ldisc_close -origin/drivers/tty/tty_ldisc.c:488 [inline] tty_ldisc_kill -origin/drivers/tty/tty_ldisc.c:636 [inline] tty_ldisc_release+0x1b6/0x400 -origin/drivers/tty/tty_ldisc.c:809 tty_release_struct+0x19/0xb0 -origin/drivers/tty/tty_io.c:1714 tty_release+0x9ad/0xa00 -origin/drivers/tty/tty_io.c:1885 __fput+0x260/0x4e0 -origin/fs/file_table.c:280 ____fput+0x11/0x20 -origin/fs/file_table.c:313 task_work_run+0x8e/0x110 -origin/kernel/task_work.c:140 tracehook_notify_resume -origin/./include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop -origin/kernel/entry/common.c:174 [inline] exit_to_user_mode_prepare+0x16b/0x1a0 -origin/kernel/entry/common.c:208 __syscall_exit_to_user_mode_work -origin/kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x20/0x40 -origin/kernel/entry/common.c:301 do_syscall_64+0x45/0x80 -origin/arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x44/0xae
--- drivers/tty/n_gsm.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/tty/n_gsm.c +12 -2
@@ -2384,8 +2384,18 @@ static int gsmld_attach_gsm(struct tty_struct *tty, struct gsm_mux *gsm)/* Don't register device 0 - this is the control channel and not a usable tty interface */ base =mux_num_to_base (gsm);/* Base for this MUX */ -for (i =1 ; i <NUM_DLCI ; i++) -tty_register_device (gsm_tty_driver, base + i,NULL ); +for (i =1 ; i <NUM_DLCI ; i++) { +struct device *dev; + + dev =tty_register_device (gsm_tty_driver, + base + i,NULL ); +if (IS_ERR (dev)) { +for (i--; i >=1 ; i--) +tty_unregister_device (gsm_tty_driver, + base + i); +return PTR_ERR (dev); + } + } }return ret; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 115/342 intel_th: Consistency and off-by-one fix
In reply to Greg Kroah-HartmanFrom: Pavel Machek <[email protected]>
[ Upstream commit 18ffbc47d45a1489b664dd68fb3a7610a6e1dea3 ]
Consistently use "< ... +1" in for loops.
Fix of-by-one in for_each_set_bit().
--- drivers/hwtracing/intel_th/gth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwtracing/intel_th/gth.c +2 -2
@@ -543,7 +543,7 @@ static void intel_th_gth_disable(struct intel_th_device *thdev, output->active = false;for_each_set_bit (master, gth->output[output->port].master, -TH_CONFIGURABLE_MASTERS ) { +TH_CONFIGURABLE_MASTERS +1 ) {gth_master_set (gth, master,-1 ); }spin_unlock (>h->gth_lock);
@@ -697,7 +697,7 @@ static void intel_th_gth_unassign(struct intel_th_device *thdev, othdev->output.port =-1 ; othdev->output.active = false; gth->output[port].output =NULL ; -for (master =0 ; master <=TH_CONFIGURABLE_MASTERS ; master++) +for (master =0 ; master <TH_CONFIGURABLE_MASTERS +1 ; master++)if (gth->master[master] == port) gth->master[master] =-1 ;spin_unlock (>h->gth_lock);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 116/342 phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit e1723d8b87b73ab363256e7ca3af3ddb75855680 ]
This driver's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free.
Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself.
--- drivers/phy/ti/phy-twl4030-usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/phy/ti/phy-twl4030-usb.c +1 -1
@@ -779,7 +779,7 @@ static int twl4030_usb_remove(struct platform_device *pdev)usb_remove_phy (&twl->phy);pm_runtime_get_sync (twl->dev); -cancel_delayed_work (&twl->id_workaround_work); +cancel_delayed_work_sync (&twl->id_workaround_work);device_remove_file (twl->dev, &dev_attr_vbus);/* set transceiver mode to power on defaults */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 117/342 crypto: sun8i-ss - Fix PM reference leak when pm_runtime_get_sync() fails
In reply to Greg Kroah-HartmanFrom: Shixin Liu <[email protected]>
[ Upstream commit 06cd7423cf451d68bfab289278d7890c9ae01a14 ]
pm_runtime_get_sync will increment pm usage counter even it failed. Forgetting to putting operation will result in reference leak here. Fix it by replacing it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c | 2 +- drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c +1 -1
@@ -351,7 +351,7 @@ int sun8i_ss_cipher_init(struct crypto_tfm *tfm) op->enginectx.op.prepare_request =NULL ; op->enginectx.op.unprepare_request =NULL ; - err =pm_runtime_get_sync (op->ss->dev); + err =pm_runtime_resume_and_get (op->ss->dev);if (err <0 ) {dev_err (op->ss->dev,"pm error %d\n" , err); goto error_pm;
drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c +1 -1
@@ -753,7 +753,7 @@ static int sun8i_ss_probe(struct platform_device *pdev)if (err) goto error_alg; - err =pm_runtime_get_sync (ss->dev); + err =pm_runtime_resume_and_get (ss->dev);if (err <0 ) goto error_alg;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 118/342 crypto: sun8i-ce - Fix PM reference leak in sun8i_ce_probe()
In reply to Greg Kroah-HartmanFrom: Shixin Liu <[email protected]>
[ Upstream commit cc987ae9150c255352660d235ab27c834aa527be ]
pm_runtime_get_sync will increment pm usage counter even it failed. Forgetting to putting operation will result in reference leak here. Fix it by replacing it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c +1 -1
@@ -932,7 +932,7 @@ static int sun8i_ce_probe(struct platform_device *pdev)if (err) goto error_alg; - err =pm_runtime_get_sync (ce->dev); + err =pm_runtime_resume_and_get (ce->dev);if (err <0 ) goto error_alg;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 119/342 crypto: stm32/hash - Fix PM reference leak on stm32-hash.c
In reply to Greg Kroah-HartmanFrom: Shixin Liu <[email protected]>
[ Upstream commit 1cb3ad701970e68f18a9e5d090baf2b1b703d729 ]
pm_runtime_get_sync will increment pm usage counter even it failed. Forgetting to putting operation will result in reference leak here. Fix it by replacing it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/crypto/stm32/stm32-hash.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/crypto/stm32/stm32-hash.c +4 -4
@@ -813,7 +813,7 @@ static void stm32_hash_finish_req(struct ahash_request *req, int err)static int stm32_hash_hw_init (struct stm32_hash_dev *hdev,struct stm32_hash_request_ctx *rctx) { -pm_runtime_get_sync (hdev->dev); +pm_runtime_resume_and_get (hdev->dev);if (!(HASH_FLAGS_INIT & hdev->flags)) {stm32_hash_write (hdev,HASH_CR ,HASH_CR_INIT );
@@ -962,7 +962,7 @@ static int stm32_hash_export(struct ahash_request *req, void *out)u32 *preg;unsigned int i; -pm_runtime_get_sync (hdev->dev); +pm_runtime_resume_and_get (hdev->dev);while ((stm32_hash_read (hdev,HASH_SR ) &HASH_SR_BUSY ))cpu_relax ();
@@ -1000,7 +1000,7 @@ static int stm32_hash_import(struct ahash_request *req, const void *in) preg = rctx->hw_context; -pm_runtime_get_sync (hdev->dev); +pm_runtime_resume_and_get (hdev->dev);stm32_hash_write (hdev,HASH_IMR , *preg++);stm32_hash_write (hdev,HASH_STR , *preg++);
@@ -1566,7 +1566,7 @@ static int stm32_hash_remove(struct platform_device *pdev)if (!hdev)return -ENODEV ; - ret =pm_runtime_get_sync (hdev->dev); + ret =pm_runtime_resume_and_get (hdev->dev);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 120/342 crypto: stm32/cryp - Fix PM reference leak on stm32-cryp.c
In reply to Greg Kroah-HartmanFrom: Shixin Liu <[email protected]>
[ Upstream commit 747bf30fd944f02f341b5f3bc7d97a13f2ae2fbe ]
pm_runtime_get_sync will increment pm usage counter even it failed. Forgetting to putting operation will result in reference leak here. Fix it by replacing it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/crypto/stm32/stm32-cryp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/crypto/stm32/stm32-cryp.c +2 -2
@@ -542,7 +542,7 @@ static int stm32_cryp_hw_init(struct stm32_cryp *cryp)int ret;u32 cfg, hw_mode; -pm_runtime_get_sync (cryp->dev); +pm_runtime_resume_and_get (cryp->dev);/* Disable interrupt */ stm32_cryp_write (cryp,CRYP_IMSCR ,0 );
@@ -2043,7 +2043,7 @@ static int stm32_cryp_remove(struct platform_device *pdev)if (!cryp)return -ENODEV ; - ret =pm_runtime_get_sync (cryp->dev); + ret =pm_runtime_resume_and_get (cryp->dev);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 121/342 crypto: sa2ul - Fix PM reference leak in sa_ul_probe()
In reply to Greg Kroah-HartmanFrom: Shixin Liu <[email protected]>
[ Upstream commit 13343badae093977295341d5a050f51ef128821c ]
pm_runtime_get_sync will increment pm usage counter even it failed. Forgetting to putting operation will result in reference leak here. Fix it by replacing it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/crypto/sa2ul.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/sa2ul.c +1 -1
@@ -2350,7 +2350,7 @@ static int sa_ul_probe(struct platform_device *pdev)dev_set_drvdata (sa_k3_dev, dev_data);pm_runtime_enable (dev); - ret =pm_runtime_get_sync (dev); + ret =pm_runtime_resume_and_get (dev);if (ret <0 ) {dev_err (&pdev->dev,"%s: failed to get sync: %d\n" , __func__, ret);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 122/342 crypto: omap-aes - Fix PM reference leak on omap-aes.c
In reply to Greg Kroah-HartmanFrom: Shixin Liu <[email protected]>
[ Upstream commit 1f34cc4a8da34fbb250efb928f9b8c6fe7ee0642 ]
pm_runtime_get_sync will increment pm usage counter even it failed. Forgetting to putting operation will result in reference leak here. Fix it by replacing it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/crypto/omap-aes.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/crypto/omap-aes.c +3 -4
@@ -103,9 +103,8 @@ static int omap_aes_hw_init(struct omap_aes_dev *dd) dd->err =0 ; } - err =pm_runtime_get_sync (dd->dev); + err =pm_runtime_resume_and_get (dd->dev);if (err <0 ) { -pm_runtime_put_noidle (dd->dev);dev_err (dd->dev,"failed to get sync: %d\n" , err);return err; }
@@ -1134,7 +1133,7 @@ static int omap_aes_probe(struct platform_device *pdev)pm_runtime_set_autosuspend_delay (dev,DEFAULT_AUTOSUSPEND_DELAY );pm_runtime_enable (dev); - err =pm_runtime_get_sync (dev); + err =pm_runtime_resume_and_get (dev);if (err <0 ) {dev_err (dev,"%s: failed to get_sync(%d)\n" , __func__, err);
@@ -1303,7 +1302,7 @@ static int omap_aes_suspend(struct device *dev)static int omap_aes_resume (struct device *dev) { -pm_runtime_get_sync (dev); +pm_runtime_resume_and_get (dev);return 0 ; }#endif
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 123/342 platform/x86: intel_pmc_core: Dont use global pmcdev in quirks
In reply to Greg Kroah-HartmanFrom: David E. Box <[email protected]>
[ Upstream commit c9f86d6ca6b5e23d30d16ade4b9fff5b922a610a ]
The DMI callbacks, used for quirks, currently access the PMC by getting the address a global pmc_dev struct. Instead, have the callbacks set a global quirk specific variable. In probe, after calling dmi_check_system(), pass pmc_dev to a function that will handle each quirk if its variable condition is met. This allows removing the global pmc_dev later.
--- drivers/platform/x86/intel_pmc_core.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
drivers/platform/x86/intel_pmc_core.c +16 -3
@@ -1186,9 +1186,15 @@ static const struct pci_device_id pmc_pci_ids[] = {* the platform BIOS enforces 24Mhz crystal to shutdown * before PMC can assert SLP_S0#. */ +static bool xtal_ignore;static int quirk_xtal_ignore (const struct dmi_system_id *id) { -struct pmc_dev *pmcdev = &pmc; + xtal_ignore = true; +return 0 ; +} + +static void pmc_core_xtal_ignore (struct pmc_dev *pmcdev) +{u32 value; value =pmc_core_reg_read (pmcdev, pmcdev->map->pm_vric1_offset);
@@ -1197,7 +1203,6 @@ static int quirk_xtal_ignore(const struct dmi_system_id *id)/* Low Voltage Mode Enable */ value &= ~SPT_PMC_VRIC1_SLPS0LVEN ;pmc_core_reg_write (pmcdev, pmcdev->map->pm_vric1_offset, value); -return 0 ; }static const struct dmi_system_id pmc_core_dmi_table[] = {
@@ -1212,6 +1217,14 @@ static const struct dmi_system_id pmc_core_dmi_table[] = { {} }; +static void pmc_core_do_dmi_quirks (struct pmc_dev *pmcdev) +{ +dmi_check_system (pmc_core_dmi_table); + +if (xtal_ignore) +pmc_core_xtal_ignore (pmcdev); +} +static int pmc_core_probe (struct platform_device *pdev) {static bool device_initialized;
@@ -1253,7 +1266,7 @@ static int pmc_core_probe(struct platform_device *pdev)mutex_init (&pmcdev->lock);platform_set_drvdata (pdev, pmcdev); pmcdev->pmc_xram_read_bit =pmc_core_check_read_lock_bit (); -dmi_check_system (pmc_core_dmi_table); +pmc_core_do_dmi_quirks (pmcdev);/* * On TGL, due to a hardware limitation, the GBE LTR blocks PC10 when
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 124/342 spi: sync up initial chipselect state
In reply to Greg Kroah-HartmanFrom: David Bauer <[email protected]>
[ Upstream commit d347b4aaa1a042ea528e385d9070b74c77a14321 ]
When initially probing the SPI slave device, the call for disabling an SPI device without the SPI_CS_HIGH flag is not applied, as the condition for checking whether or not the state to be applied equals the one currently set evaluates to true.
This however might not necessarily be the case, as the chipselect might be active.
Add a force flag to spi_set_cs which allows to override this early exit condition. Set it to false everywhere except when called from spi_setup to sync up the initial CS state.
Fixes commit d40f0b6f2e21 ("spi: Avoid setting the chip select if we don't need to")
--- drivers/spi/spi.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/spi/spi.c +8 -8
@@ -795,7 +795,7 @@ int spi_register_board_info(struct spi_board_info const *info, unsigned n)/*-------------------------------------------------------------------------*/ -static void spi_set_cs (struct spi_device *spi,bool enable) +static void spi_set_cs (struct spi_device *spi,bool enable,bool force) {bool enable1 = enable;
@@ -803,7 +803,7 @@ static void spi_set_cs(struct spi_device *spi, bool enable)* Avoid calling into the driver (or doing delays) if the chip select * isn't actually changing from the last time this was called. */ -if ((spi->controller->last_cs_enable == enable) && +if (!force && (spi->controller->last_cs_enable == enable) && (spi->controller->last_cs_mode_high == (spi->mode &SPI_CS_HIGH )))return ;
@@ -1251,7 +1251,7 @@ static int spi_transfer_one_message(struct spi_controller *ctlr,struct spi_statistics *statm = &ctlr->statistics;struct spi_statistics *stats = &msg->spi->statistics; -spi_set_cs (msg->spi, true); +spi_set_cs (msg->spi, true, false);SPI_STATISTICS_INCREMENT_FIELD (statm, messages);SPI_STATISTICS_INCREMENT_FIELD (stats, messages);
@@ -1319,9 +1319,9 @@ fallback_pio: &msg->transfers)) { keep_cs = true; }else { -spi_set_cs (msg->spi, false); +spi_set_cs (msg->spi, false, false);_spi_transfer_cs_change_delay (msg, xfer); -spi_set_cs (msg->spi, true); +spi_set_cs (msg->spi, true, false); } }
@@ -1330,7 +1330,7 @@ fallback_pio: out:if (ret !=0 || !keep_cs) -spi_set_cs (msg->spi, false); +spi_set_cs (msg->spi, false, false);if (msg->status == -EINPROGRESS ) msg->status = ret;
@@ -3410,11 +3410,11 @@ int spi_setup(struct spi_device *spi)*/ status =0 ; -spi_set_cs (spi, false); +spi_set_cs (spi, false, true);pm_runtime_mark_last_busy (spi->controller->dev.parent);pm_runtime_put_autosuspend (spi->controller->dev.parent); }else { -spi_set_cs (spi, false); +spi_set_cs (spi, false, true); }mutex_unlock (&spi->controller->io_mutex);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 125/342 btrfs: do proper error handling in create_reloc_root
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
[ Upstream commit 84c50ba5214c2f3c1be4a931d521ec19f55dfdc8 ]
We do memory allocations here, read blocks from disk, all sorts of operations that could easily fail at any given point. Instead of panicing the box, simply return the error back up the chain, all callers at this point have proper error handling.
--- fs/btrfs/relocation.c | 34 ++++++++++++++++++++++++++++------ 1 file changed, 28 insertions(+), 6 deletions(-)
fs/btrfs/relocation.c +28 -6
@@ -732,10 +732,12 @@ static struct btrfs_root *create_reloc_root(struct btrfs_trans_handle *trans,struct extent_buffer *eb;struct btrfs_root_item *root_item;struct btrfs_key root_key; -int ret; +int ret =0 ; +bool must_abort = false; root_item =kmalloc (sizeof (*root_item),GFP_NOFS ); -BUG_ON (!root_item); +if (!root_item) +return ERR_PTR (-ENOMEM ); root_key.objectid =BTRFS_TREE_RELOC_OBJECTID ; root_key.type =BTRFS_ROOT_ITEM_KEY ;
@@ -747,7 +749,9 @@ static struct btrfs_root *create_reloc_root(struct btrfs_trans_handle *trans,/* called by btrfs_init_reloc_root */ ret =btrfs_copy_root (trans, root, root->commit_root, &eb,BTRFS_TREE_RELOC_OBJECTID ); -BUG_ON (ret); +if (ret) + goto fail; +/* * Set the last_snapshot field to the generation of the commit * root - like this ctree.c:btrfs_block_can_be_shared() behaves
@@ -768,9 +772,16 @@ static struct btrfs_root *create_reloc_root(struct btrfs_trans_handle *trans,*/ ret =btrfs_copy_root (trans, root, root->node, &eb,BTRFS_TREE_RELOC_OBJECTID ); -BUG_ON (ret); +if (ret) + goto fail; } +/* +* We have changed references at this point, we must abort the +* transaction if anything fails. +*/ + must_abort = true; +memcpy (root_item, &root->root_item,sizeof (*root_item));btrfs_set_root_bytenr (root_item, eb->start);btrfs_set_root_level (root_item,btrfs_header_level (eb));
@@ -788,14 +799,25 @@ static struct btrfs_root *create_reloc_root(struct btrfs_trans_handle *trans, ret =btrfs_insert_root (trans, fs_info->tree_root, &root_key, root_item); -BUG_ON (ret); +if (ret) + goto fail; +kfree (root_item); reloc_root =btrfs_read_tree_root (fs_info->tree_root, &root_key); -BUG_ON (IS_ERR (reloc_root)); +if (IS_ERR (reloc_root)) { + ret =PTR_ERR (reloc_root); + goto abort; + }set_bit (BTRFS_ROOT_SHAREABLE , &reloc_root->state); reloc_root->last_trans = trans->transid;return reloc_root; +fail: +kfree (root_item); +abort: +if (must_abort) +btrfs_abort_transaction (trans, ret); +return ERR_PTR (ret); }/*
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 126/342 btrfs: do proper error handling in btrfs_update_reloc_root
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
[ Upstream commit 592fbcd50c99b8adf999a2a54f9245caff333139 ]
We call btrfs_update_root in btrfs_update_reloc_root, which can fail for all sorts of reasons, including IO errors. Instead of panicing the box lets return the error, now that all callers properly handle those errors.
--- fs/btrfs/relocation.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
fs/btrfs/relocation.c +2 -4
@@ -896,7 +896,7 @@ int btrfs_update_reloc_root(struct btrfs_trans_handle *trans,int ret;if (!have_reloc_root (root)) - goto out; +return 0 ; reloc_root = root->reloc_root; root_item = &reloc_root->root_item;
@@ -929,10 +929,8 @@ int btrfs_update_reloc_root(struct btrfs_trans_handle *trans, ret =btrfs_update_root (trans, fs_info->tree_root, &reloc_root->root_key, root_item); -BUG_ON (ret);btrfs_put_root (reloc_root); -out: -return 0 ; +return ret; }/*
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 127/342 btrfs: convert logic BUG_ON()s in replace_path to ASSERT()s
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
[ Upstream commit 7a9213a93546e7eaef90e6e153af6b8fc7553f10 ]
A few BUG_ON()'s in replace_path are purely to keep us from making logical mistakes, so replace them with ASSERT()'s.
--- fs/btrfs/relocation.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/btrfs/relocation.c +3 -3
@@ -1204,8 +1204,8 @@ int replace_path(struct btrfs_trans_handle *trans, struct reloc_control *rc,int ret;int slot; -BUG_ON (src->root_key.objectid !=BTRFS_TREE_RELOC_OBJECTID ); -BUG_ON (dest->root_key.objectid ==BTRFS_TREE_RELOC_OBJECTID ); +ASSERT (src->root_key.objectid ==BTRFS_TREE_RELOC_OBJECTID ); +ASSERT (dest->root_key.objectid !=BTRFS_TREE_RELOC_OBJECTID ); last_snapshot =btrfs_root_last_snapshot (&src->root_item); again:
@@ -1236,7 +1236,7 @@ again: parent = eb;while (1 ) { level =btrfs_header_level (parent); -BUG_ON (level < lowest_level); +ASSERT (level >= lowest_level); ret =btrfs_bin_search (parent, &key, &slot);if (ret <0 )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 128/342 regulator: da9121: automotive variants identity fix
In reply to Greg Kroah-HartmanFrom: Adam Ward <[email protected]>
[ Upstream commit 013592be146a10d3567c0062cd1416faab060704 ]
This patch fixes identification of DA913x parts by the DA9121 driver, where a lack of clarity lead to implementation on the basis that variant IDs were to be identical to the equivalent rated non-automotive parts.
There is a new emphasis on the DT identity to cope with overlap in these ID's - this is not considered to be problematic, because projects would be exclusively using automotive or consumer grade parts.
--- drivers/regulator/da9121-regulator.c | 80 ++++++++++++++++++---------- drivers/regulator/da9121-regulator.h | 13 +++++ 2 files changed, 65 insertions(+), 28 deletions(-)
drivers/regulator/da9121-regulator.c +52 -28
@@ -40,6 +40,7 @@ struct da9121 {unsigned int passive_delay;int chip_irq;int variant_id; +int subvariant_id; };/* Define ranges for different variants, enabling translation to/from
@@ -812,7 +813,6 @@ static struct regmap_config da9121_2ch_regmap_config = {static int da9121_check_device_type (struct i2c_client *i2c,struct da9121 *chip) {u32 device_id; -u8 chip_id = chip->variant_id;u32 variant_id;u8 variant_mrc, variant_vrc;char *type;
@@ -839,22 +839,34 @@ static int da9121_check_device_type(struct i2c_client *i2c, struct da9121 *chip) variant_vrc = variant_id &DA9121_MASK_OTP_VARIANT_ID_VRC ; -switch (variant_vrc) { -case DA9121_VARIANT_VRC : - type ="DA9121/DA9130" ; - config_match = (chip_id ==DA9121_TYPE_DA9121_DA9130 ); +switch (chip->subvariant_id) { +case DA9121_SUBTYPE_DA9121 : + type ="DA9121" ; + config_match = (variant_vrc ==DA9121_VARIANT_VRC );break ; -case DA9220_VARIANT_VRC : - type ="DA9220/DA9132" ; - config_match = (chip_id ==DA9121_TYPE_DA9220_DA9132 ); +case DA9121_SUBTYPE_DA9130 : + type ="DA9130" ; + config_match = (variant_vrc ==DA9130_VARIANT_VRC );break ; -case DA9122_VARIANT_VRC : - type ="DA9122/DA9131" ; - config_match = (chip_id ==DA9121_TYPE_DA9122_DA9131 ); +case DA9121_SUBTYPE_DA9220 : + type ="DA9220" ; + config_match = (variant_vrc ==DA9220_VARIANT_VRC );break ; -case DA9217_VARIANT_VRC : +case DA9121_SUBTYPE_DA9132 : + type ="DA9132" ; + config_match = (variant_vrc ==DA9132_VARIANT_VRC ); +break ; +case DA9121_SUBTYPE_DA9122 : + type ="DA9122" ; + config_match = (variant_vrc ==DA9122_VARIANT_VRC ); +break ; +case DA9121_SUBTYPE_DA9131 : + type ="DA9131" ; + config_match = (variant_vrc ==DA9131_VARIANT_VRC ); +break ; +case DA9121_SUBTYPE_DA9217 : type ="DA9217" ; - config_match = (chip_id ==DA9121_TYPE_DA9217 ); + config_match = (variant_vrc ==DA9217_VARIANT_VRC );break ;default : type ="Unknown" ;
@@ -892,15 +904,27 @@ static int da9121_assign_chip_model(struct i2c_client *i2c, chip->dev = &i2c->dev; -switch (chip->variant_id) { -case DA9121_TYPE_DA9121_DA9130 : - fallthrough; -case DA9121_TYPE_DA9217 : +/* Use configured subtype to select the regulator descriptor index and +* register map, common to both consumer and automotive grade variants +*/ +switch (chip->subvariant_id) { +case DA9121_SUBTYPE_DA9121 : +case DA9121_SUBTYPE_DA9130 : + chip->variant_id =DA9121_TYPE_DA9121_DA9130 ; regmap = &da9121_1ch_regmap_config;break ; -case DA9121_TYPE_DA9122_DA9131 : - fallthrough; -case DA9121_TYPE_DA9220_DA9132 : +case DA9121_SUBTYPE_DA9217 : + chip->variant_id =DA9121_TYPE_DA9217 ; + regmap = &da9121_1ch_regmap_config; +break ; +case DA9121_SUBTYPE_DA9122 : +case DA9121_SUBTYPE_DA9131 : + chip->variant_id =DA9121_TYPE_DA9122_DA9131 ; + regmap = &da9121_2ch_regmap_config; +break ; +case DA9121_SUBTYPE_DA9220 : +case DA9121_SUBTYPE_DA9132 : + chip->variant_id =DA9121_TYPE_DA9220_DA9132 ; regmap = &da9121_2ch_regmap_config;break ; }
@@ -975,13 +999,13 @@ regmap_error: }static const struct of_device_id da9121_dt_ids[] = { - { .compatible ="dlg,da9121" , .data = (void *)DA9121_TYPE_DA9121_DA9130 }, - { .compatible ="dlg,da9130" , .data = (void *)DA9121_TYPE_DA9121_DA9130 }, - { .compatible ="dlg,da9217" , .data = (void *)DA9121_TYPE_DA9217 }, - { .compatible ="dlg,da9122" , .data = (void *)DA9121_TYPE_DA9122_DA9131 }, - { .compatible ="dlg,da9131" , .data = (void *)DA9121_TYPE_DA9122_DA9131 }, - { .compatible ="dlg,da9220" , .data = (void *)DA9121_TYPE_DA9220_DA9132 }, - { .compatible ="dlg,da9132" , .data = (void *)DA9121_TYPE_DA9220_DA9132 }, + { .compatible ="dlg,da9121" , .data = (void *)DA9121_SUBTYPE_DA9121 }, + { .compatible ="dlg,da9130" , .data = (void *)DA9121_SUBTYPE_DA9130 }, + { .compatible ="dlg,da9217" , .data = (void *)DA9121_SUBTYPE_DA9217 }, + { .compatible ="dlg,da9122" , .data = (void *)DA9121_SUBTYPE_DA9122 }, + { .compatible ="dlg,da9131" , .data = (void *)DA9121_SUBTYPE_DA9131 }, + { .compatible ="dlg,da9220" , .data = (void *)DA9121_SUBTYPE_DA9220 }, + { .compatible ="dlg,da9132" , .data = (void *)DA9121_SUBTYPE_DA9132 }, { } };MODULE_DEVICE_TABLE (of, da9121_dt_ids);
@@ -1011,7 +1035,7 @@ static int da9121_i2c_probe(struct i2c_client *i2c, } chip->pdata = i2c->dev.platform_data; - chip->variant_id =da9121_of_get_id (&i2c->dev); + chip->subvariant_id =da9121_of_get_id (&i2c->dev); ret =da9121_assign_chip_model (i2c, chip);if (ret <0 )
drivers/regulator/da9121-regulator.h +13 -0
@@ -29,6 +29,16 @@ enum da9121_variant { DA9121_TYPE_DA9217 }; +enum da9121_subvariant { +DA9121_SUBTYPE_DA9121 , +DA9121_SUBTYPE_DA9130 , +DA9121_SUBTYPE_DA9220 , +DA9121_SUBTYPE_DA9132 , +DA9121_SUBTYPE_DA9122 , +DA9121_SUBTYPE_DA9131 , +DA9121_SUBTYPE_DA9217 +}; +/* Minimum, maximum and default polling millisecond periods are provided * here as an example. It is expected that any final implementation will * include a modification of these settings to match the required
@@ -279,6 +289,9 @@ enum da9121_variant {#define DA9220_VARIANT_VRC 0x0#define DA9122_VARIANT_VRC 0x2#define DA9217_VARIANT_VRC 0x7 +#define DA9130_VARIANT_VRC 0x0 +#define DA9131_VARIANT_VRC 0x1 +#define DA9132_VARIANT_VRC 0x2/* DA9121_REG_OTP_CUSTOMER_ID */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 129/342 drm: Added orientation quirk for OneGX1 Pro
In reply to Greg Kroah-HartmanFrom: Jared Baldridge <[email protected]>
[ Upstream commit 81ad7f9f78e4ff80e95be8282423f511b84f1166 ]
The OneGX1 Pro has a fairly unique combination of generic strings, but we additionally match on the BIOS date just to be safe.
--- drivers/gpu/drm/drm_panel_orientation_quirks.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/gpu/drm/drm_panel_orientation_quirks.c +14 -0
@@ -84,6 +84,13 @@ static const struct drm_dmi_panel_orientation_data itworks_tw891 = { .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, }; +static const struct drm_dmi_panel_orientation_data onegx1_pro = { + .width =1200 , + .height =1920 , + .bios_dates = (const char *const []){"12/17/2020" ,NULL }, + .orientation =DRM_MODE_PANEL_ORIENTATION_RIGHT_UP , +}; +static const struct drm_dmi_panel_orientation_data lcd720x1280_rightside_up = { .width =720 , .height =1280 ,
@@ -211,6 +218,13 @@ static const struct dmi_system_id orientation_data[] = { DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad D330-10IGM"), }, .driver_data = (void *)&lcd1200x1920_rightside_up, + }, { /* OneGX1 Pro */ + .matches = { +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"SYSTEM_MANUFACTURER" ), +DMI_EXACT_MATCH (DMI_PRODUCT_NAME ,"SYSTEM_PRODUCT_NAME" ), + DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Default string"), + }, + .driver_data = (void *)&onegx1_pro, }, { /* VIOS LTH17 */ .matches = { DMI_EXACT_MATCH(DMI_SYS_VENDOR, "VIOS"),
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 130/342 drm/qxl: do not run release if qxl failed to init
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit b91907a6241193465ca92e357adf16822242296d ]
if qxl_device_init() fail, drm device will not be registered, in this case, do not run qxl_drm_release()
[ 5.258534] ================================================================== [ 5.258931] BUG: KASAN: user-memory-access in qxl_destroy_monitors_object+0x42/0xa0 [qxl] [ 5.259388] Write of size 8 at addr 00000000000014dc by task modprobe/95 [ 5.259754] [ 5.259842] CPU: 0 PID: 95 Comm: modprobe Not tainted 5.11.0-rc6-00007-g88bb507a74ea #62 [ 5.260309] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd9c812dda54 [ 5.260917] Call Trace: [ 5.261056] dump_stack+0x7d/0xa3 [ 5.261245] kasan_report.cold+0x10c/0x10e [ 5.261475] ? qxl_destroy_monitors_object+0x42/0xa0 [qxl] [ 5.261789] check_memory_region+0x17c/0x1e0 [ 5.262029] qxl_destroy_monitors_object+0x42/0xa0 [qxl] [ 5.262332] qxl_modeset_fini+0x9/0x20 [qxl] [ 5.262595] qxl_drm_release+0x22/0x30 [qxl] [ 5.262841] drm_dev_release+0x32/0x50 [ 5.263047] release_nodes+0x39e/0x410 [ 5.263253] ? devres_release+0x40/0x40 [ 5.263462] really_probe+0x2ea/0x420 [ 5.263664] driver_probe_device+0x6d/0xd0 [ 5.263888] device_driver_attach+0x82/0x90 [ 5.264116] ? device_driver_attach+0x90/0x90 [ 5.264353] __driver_attach+0x60/0x100 [ 5.264563] ? device_driver_attach+0x90/0x90 [ 5.264801] bus_for_each_dev+0xe1/0x140 [ 5.265014] ? subsys_dev_iter_exit+0x10/0x10 [ 5.265251] ? klist_node_init+0x61/0x80 [ 5.265464] bus_add_driver+0x254/0x2a0 [ 5.265673] driver_register+0xd3/0x150 [ 5.265882] ? 0xffffffffc0048000 [ 5.266064] do_one_initcall+0x84/0x250 [ 5.266274] ? trace_event_raw_event_initcall_finish+0x150/0x150 [ 5.266596] ? unpoison_range+0xf/0x30 [ 5.266801] ? ____kasan_kmalloc.constprop.0+0x84/0xa0 [ 5.267082] ? unpoison_range+0xf/0x30 [ 5.267287] ? unpoison_range+0xf/0x30 [ 5.267491] do_init_module+0xf8/0x350 [ 5.267697] load_module+0x3fe6/0x4340 [ 5.267902] ? vm_unmap_ram+0x1d0/0x1d0 [ 5.268115] ? module_frob_arch_sections+0x20/0x20 [ 5.268375] ? __do_sys_finit_module+0x108/0x170 [ 5.268624] __do_sys_finit_module+0x108/0x170 [ 5.268865] ? __ia32_sys_init_module+0x40/0x40 [ 5.269111] ? file_open_root+0x200/0x200 [ 5.269330] ? do_sys_open+0x85/0xe0 [ 5.269527] ? filp_open+0x50/0x50 [ 5.269714] ? exit_to_user_mode_prepare+0xfc/0x130 [ 5.269978] do_syscall_64+0x33/0x40 [ 5.270176] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 5.270450] RIP: 0033:0x7fa3f685bcf7 [ 5.270646] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f7 48 89 d1 [ 5.271634] RSP: 002b:00007ffca83048d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 5.272037] RAX: ffffffffffffffda RBX: 0000000001e94a70 RCX: 00007fa3f685bcf7 [ 5.272416] RDX: 0000000000000000 RSI: 0000000001e939e0 RDI: 0000000000000003 [ 5.272794] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001 [ 5.273171] R10: 00007fa3f68bf300 R11: 0000000000000246 R12: 0000000001e939e0 [ 5.273550] R13: 0000000000000000 R14: 0000000001e93bd0 R15: 0000000000000001 [ 5.273928] ==================================================================
--- drivers/gpu/drm/qxl/qxl_drv.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/qxl/qxl_drv.c +2 -0
@@ -144,6 +144,8 @@ static void qxl_drm_release(struct drm_device *dev)* reodering qxl_modeset_fini() + qxl_device_fini() calls is * non-trivial though. */ +if (!dev->registered) +return ;qxl_modeset_fini (qdev);qxl_device_fini (qdev); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 131/342 drm/qxl: release shadow on shutdown
In reply to Greg Kroah-HartmanFrom: Gerd Hoffmann <[email protected]>
[ Upstream commit 4ca77c513537700d3fae69030879f781dde1904c ]
In case we have a shadow surface on shutdown release it so it doesn't leak.
--- drivers/gpu/drm/qxl/qxl_display.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/qxl/qxl_display.c +4 -0
@@ -1228,6 +1228,10 @@ int qxl_modeset_init(struct qxl_device *qdev)void qxl_modeset_fini (struct qxl_device *qdev) { +if (qdev->dumb_shadow_bo) { +drm_gem_object_put (&qdev->dumb_shadow_bo->tbo.base); + qdev->dumb_shadow_bo =NULL ; + }qxl_destroy_monitors_object (qdev);drm_mode_config_cleanup (&qdev->ddev); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 132/342 drm/ast: Fix invalid usage of AST_MAX_HWC_WIDTH in cursor atomic_check
In reply to Greg Kroah-HartmanFrom: Thomas Zimmermann <[email protected]>
[ Upstream commit ee4a92d690f30f3793df942939726bec0338e65b ]
Use AST_MAX_HWC_HEIGHT for setting offset_y in the cursor plane's atomic_check. The code used AST_MAX_HWC_WIDTH instead. This worked because both constants has the same value.
--- drivers/gpu/drm/ast/ast_mode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/ast/ast_mode.c +1 -1
@@ -688,7 +688,7 @@ ast_cursor_plane_helper_atomic_update(struct drm_plane *plane,unsigned int offset_x, offset_y; offset_x =AST_MAX_HWC_WIDTH - fb->width; - offset_y =AST_MAX_HWC_WIDTH - fb->height; + offset_y =AST_MAX_HWC_HEIGHT - fb->height;if (state->fb != old_state->fb) {/* A new cursor image was installed. */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 133/342 drm/amd/display: changing sr exit latency
In reply to Greg Kroah-HartmanFrom: Martin Leung <[email protected]>
[ Upstream commit efe213e5a57e0cd92fa4f328dc1963d330549982 ]
[Why]
Hardware team remeasured, need to update timings to increase latency slightly and avoid intermittent underflows.
[How]
sr exit latency update.
--- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c +1 -1
@@ -181,7 +181,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn3_0_soc = { }, .min_dcfclk = 500.0, /* TODO: set this to actual min DCFCLK */ .num_states = 1, - .sr_exit_time_us = 12, + .sr_exit_time_us = 15.5, .sr_enter_plus_exit_time_us = 20, .urgent_latency_us = 4.0, .urgent_latency_pixel_data_only_us = 4.0,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 134/342 drm/amd/display: Fix MPC OGAM power on/off sequence
In reply to Greg Kroah-HartmanFrom: Nicholas Kazlauskas <[email protected]>
[ Upstream commit 737b2b536a30a467c405d75f2287e17828838a13 ]
[Why]
Color corruption can occur on bootup into a login manager that applies a non-linear gamma LUT because the LUT may not actually be powered on before writing.
It's cleared on the next full pipe reprogramming as we switch to LUTB from LUTA and the pipe accessing the LUT has taken it out of light sleep mode.
[How]
The MPCC_OGAM_MEM_PWR_FORCE register does not force the current power mode when set to 0. It only forces when set light sleep, deep sleep or shutdown.
The register to actually force power on and ignore sleep modes is MPCC_OGAM_MEM_PWR_DIS - a value of 0 will enable power requests and a value of 1 will disable them.
When PWR_FORCE!=0 is combined with PWR_DIS=0 then MPCC OGAM memory is forced into the state specified by the force bits.
If PWR_FORCE is 0 then it respects the mode specified by MPCC_OGAM_MEM_LOW_PWR_MODE if the RAM LUT is not in use.
We set that bit to shutdown on low power, but otherwise it inherits from bootup defaults.
So for the fix:
1. Update the sequence to "force" power on when needed
We can use MPCC_OGAM_MEM_PWR_DIS for this to turn on the memory even when the block is in bypass and pending to be enabled for the next frame.
We need this for both low power enabled or disabled.
If we don't set this then we can run into issues when we first program the LUT from bootup.
2. Don't apply FORCE_SEL
Once we enable power requests with DIS=0 we run into the issue of the RAM being forced into light sleep and being unusable for display output. Leave this 0 like we used to for DCN20.
3. Rely on MPCC OGAM init to determine light sleep/deep sleep
MPC low power debug mode isn't enabled on any ASIC currently but we'll respect the setting determined during init if it is.
Lightly tested as working with IGT tests and desktop color adjustment.
4. Change the MPC resource default for DCN30
It was interleaving the dcn20 and dcn30 versions before depending on the sequence.
5. REG_WAIT for it to be on whenever we're powering up the memory
Otherwise we can write register values too early and we'll get corruption.
--- .../gpu/drm/amd/display/dc/dcn30/dcn30_mpc.c | 24 ++++++++++--------- 1 file changed, 13 insertions(+), 11 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_mpc.c +13 -11
@@ -143,16 +143,18 @@ static void mpc3_power_on_ogam_lut( {struct dcn30_mpc *mpc30 =TO_DCN30_MPC (mpc); -if (mpc->ctx->dc->debug.enable_mem_low_power.bits.mpc) { -// Force power on -REG_UPDATE (MPCC_MEM_PWR_CTRL [mpcc_id],MPCC_OGAM_MEM_PWR_DIS , power_on == true ?1 :0 ); -// Wait for confirmation when powering on -if (power_on) -REG_WAIT (MPCC_MEM_PWR_CTRL [mpcc_id],MPCC_OGAM_MEM_PWR_STATE ,0 ,10 ,10 ); - }else { -REG_SET (MPCC_MEM_PWR_CTRL [mpcc_id],0 , -MPCC_OGAM_MEM_PWR_FORCE , power_on == true ?0 :1 ); - } +/* +* Powering on: force memory active so the LUT can be updated. +* Powering off: allow entering memory low power mode +* +* Memory low power mode is controlled during MPC OGAM LUT init. +*/ +REG_UPDATE (MPCC_MEM_PWR_CTRL [mpcc_id], +MPCC_OGAM_MEM_PWR_DIS , power_on !=0 ); + +/* Wait for memory to be powered on - we won't be able to write to it otherwise. */ +if (power_on) +REG_WAIT (MPCC_MEM_PWR_CTRL [mpcc_id],MPCC_OGAM_MEM_PWR_STATE ,0 ,10 ,10 ); } static void mpc3_configure_ogam_lut(
@@ -1427,7 +1429,7 @@ const struct mpc_funcs dcn30_mpc_funcs = { .acquire_rmu = mpcc3_acquire_rmu, .program_3dlut = mpc3_program_3dlut, .release_rmu = mpcc3_release_rmu, - .power_on_mpc_mem_pwr = mpc20_power_on_ogam_lut, + .power_on_mpc_mem_pwr = mpc3_power_on_ogam_lut, .get_mpc_out_mux = mpc1_get_mpc_out_mux, };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 135/342 drm/ast: fix memory leak when unload the driver
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit dc739820ff90acccd013f6bb420222978a982791 ]
a connector is leaked upon module unload, it seems that we should do similar to sample driver as suggested in drm_drv.c.
Adding drm_atomic_helper_shutdown() in ast_pci_remove to prevent leaking.
[ 153.822134] WARNING: CPU: 0 PID: 173 at drivers/gpu/drm/drm_mode_config.c:504 drm_mode_config_cle0 [ 153.822698] Modules linked in: ast(-) drm_vram_helper drm_ttm_helper ttm [last unloaded: ttm] [ 153.823197] CPU: 0 PID: 173 Comm: modprobe Tainted: G W 5.11.0-03615-g55f62bc873474 [ 153.823708] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd9c812dda519-4 [ 153.824333] RIP: 0010:drm_mode_config_cleanup+0x418/0x470 [ 153.824637] Code: 0c 00 00 00 00 48 8b 84 24 a8 00 00 00 65 48 33 04 25 28 00 00 00 75 65 48 81 c0 [ 153.825668] RSP: 0018:ffff888103c9fb70 EFLAGS: 00010212 [ 153.825962] RAX: ffff888102b0d100 RBX: ffff888102b0c298 RCX: ffffffff818d8b2b [ 153.826356] RDX: dffffc0000000000 RSI: 000000007fffffff RDI: ffff888102b0c298 [ 153.826748] RBP: ffff888103c9fba0 R08: 0000000000000001 R09: ffffed1020561857 [ 153.827146] R10: ffff888102b0c2b7 R11: ffffed1020561856 R12: ffff888102b0c000 [ 153.827538] R13: ffff888102b0c2d8 R14: ffff888102b0c2d8 R15: 1ffff11020793f70 [ 153.827935] FS: 00007f24bff456a0(0000) GS:ffff88815b400000(0000) knlGS:0000000000000000 [ 153.828380] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 153.828697] CR2: 0000000001c39018 CR3: 0000000103c90000 CR4: 00000000000006f0 [ 153.829096] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 153.829486] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 153.829883] Call Trace: [ 153.830024] ? drmm_mode_config_init+0x930/0x930 [ 153.830281] ? cpumask_next+0x16/0x20 [ 153.830488] ? mnt_get_count+0x66/0x80 [ 153.830699] ? drm_mode_config_cleanup+0x470/0x470 [ 153.830972] drm_managed_release+0xed/0x1c0 [ 153.831208] drm_dev_release+0x3a/0x50 [ 153.831420] release_nodes+0x39e/0x410 [ 153.831631] ? devres_release+0x40/0x40 [ 153.831852] device_release_driver_internal+0x158/0x270 [ 153.832143] driver_detach+0x76/0xe0 [ 153.832344] bus_remove_driver+0x7e/0x100 [ 153.832568] pci_unregister_driver+0x28/0xf0 [ 153.832821] __x64_sys_delete_module+0x268/0x300 [ 153.833086] ? __ia32_sys_delete_module+0x300/0x300 [ 153.833357] ? call_rcu+0x372/0x4f0 [ 153.833553] ? fpregs_assert_state_consistent+0x4d/0x60 [ 153.833840] ? exit_to_user_mode_prepare+0x2f/0x130 [ 153.834118] do_syscall_64+0x33/0x40 [ 153.834317] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 153.834597] RIP: 0033:0x7f24bfec7cf7 [ 153.834797] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f7 48 89 d6 41 [ 153.835812] RSP: 002b:00007fff72e6cb58 EFLAGS: 00000202 ORIG_RAX: 00000000000000b0 [ 153.836234] RAX: ffffffffffffffda RBX: 00007f24bff45690 RCX: 00007f24bfec7cf7 [ 153.836623] RDX: 00000000ffffffff RSI: 0000000000000080 RDI: 0000000001c2fb10 [ 153.837018] RBP: 0000000001c2fac0 R08: 2f2f2f2f2f2f2f2f R09: 0000000001c2fac0 [ 153.837408] R10: fefefefefefefeff R11: 0000000000000202 R12: 0000000001c2fac0 [ 153.837798] R13: 0000000001c2f9d0 R14: 0000000000000000 R15: 0000000000000001 [ 153.838194] ---[ end trace b92031513bbe596c ]--- [ 153.838441] [drm:drm_mode_config_cleanup] *ERROR* connector VGA-1 leaked!
--- drivers/gpu/drm/ast/ast_drv.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/ast/ast_drv.c +2 -0
@@ -30,6 +30,7 @@#include <linux/module.h> #include <linux/pci.h> +#include <drm/drm_atomic_helper.h> #include <drm/drm_crtc_helper.h> #include <drm/drm_drv.h> #include <drm/drm_fb_helper.h>
@@ -138,6 +139,7 @@ static void ast_pci_remove(struct pci_dev *pdev)struct drm_device *dev =pci_get_drvdata (pdev);drm_dev_unregister (dev); +drm_atomic_helper_shutdown (dev); }static int ast_drm_freeze (struct drm_device *dev)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 136/342 drm/amd/display: Check for DSC support instead of ASIC revision
In reply to Greg Kroah-HartmanFrom: Eryk Brol <[email protected]>
[ Upstream commit 349a19b2f1b01e713268c7de9944ad669ccdf369 ]
[why]
This check for ASIC revision is no longer useful and causes lightup issues after a topology change in MST DSC scenario. In this case, DSC configs should be recalculated for the new topology. This check prevented that from happening on certain ASICs that do, in fact, support DSC.
[how]
Change the ASIC revision to instead check if DSC is supported.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +1 -1
@@ -9216,7 +9216,7 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev, }#if defined(CONFIG_DRM_AMD_DC_DCN ) -if (adev->asic_type >=CHIP_NAVI10 ) { +if (dc_resource_is_dsc_encoding_supported (dc)) {for_each_oldnew_crtc_in_state (state, crtc, old_crtc_state, new_crtc_state, i) {if (drm_atomic_crtc_needs_modeset (new_crtc_state)) { ret =add_affected_mst_dsc_crtcs (state, crtc);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 137/342 drm/amd/display: Dont optimize bandwidth before disabling planes
In reply to Greg Kroah-HartmanFrom: Aric Cyr <[email protected]>
[ Upstream commit 6ad98e8aeb0106f453bb154933e8355849244990 ]
[Why]
There is a window of time where we optimize bandwidth due to no streams enabled will enable PSTATE changing but HUBPs are not disabled yet. This results in underflow counter increasing in some hotplug scenarios.
[How]
Set the optimize-bandwidth flag for later processing once all the HUBPs are properly disabled.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc.c +2 -1
@@ -2380,7 +2380,8 @@ static void commit_planes_do_stream_update(struct dc *dc,if (pipe_ctx->stream_res.audio && !dc->debug.az_endpoint_mute_only) pipe_ctx->stream_res.audio->funcs->az_disable (pipe_ctx->stream_res.audio); - dc->hwss.optimize_bandwidth (dc, dc->current_state); + dc->optimized_required = true; + }else {if (dc->optimize_seamless_boot_streams ==0 ) dc->hwss.prepare_bandwidth (dc, dc->current_state);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 138/342 drm/amd/display: Return invalid state if GPINT times out
In reply to Greg Kroah-HartmanFrom: Wyatt Wood <[email protected]>
[ Upstream commit 8039bc7130ef4206a58e4dc288621bc97eba08eb ]
[Why]
GPINT timeout is causing PSR_STATE_0 to be returned when it shouldn't. We must guarantee that PSR is fully disabled before doing hw programming on driver-side.
[How]
Return invalid state if GPINT command times out. Let existing retry logic send the GPINT until successful.
--- drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c +10 -5
@@ -81,13 +81,18 @@ static void dmub_psr_get_state(struct dmub_psr *dmub, enum dc_psr_state *state) {struct dmub_srv *srv = dmub->ctx->dmub_srv->dmub;uint32_t raw_state; +enum dmub_status status =DMUB_STATUS_INVALID ;// Send gpint command and wait for ack -dmub_srv_send_gpint_command (srv,DMUB_GPINT__GET_PSR_STATE ,0 ,30 ); - -dmub_srv_get_gpint_response (srv, &raw_state); - - *state =convert_psr_state (raw_state); + status =dmub_srv_send_gpint_command (srv,DMUB_GPINT__GET_PSR_STATE ,0 ,30 ); + +if (status ==DMUB_STATUS_OK ) { +// GPINT was executed, get response +dmub_srv_get_gpint_response (srv, &raw_state); + *state =convert_psr_state (raw_state); + }else +// Return invalid state when GPINT times out + *state =0xFF ; }/**
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 139/342 drm/amdgpu/display: buffer INTERRUPT_LOW_IRQ_CONTEXT interrupt work
In reply to Greg Kroah-HartmanFrom: Xiaogang Chen <[email protected]>
[ Upstream commit b6f91fc183f758461b9462cc93e673adbbf95c2d ]
amdgpu DM handles INTERRUPT_LOW_IRQ_CONTEXT interrupt(hpd, hpd_rx) by using work queue and uses single work_struct. If new interrupt is recevied before the previous handler finished, new interrupts(same type) will be discarded and driver just sends "amdgpu_dm_irq_schedule_work FAILED" message out. If some important hpd, hpd_rx related interrupts are missed by driver the hot (un)plug devices may cause system hang or instability, such as issues with system resume from S3 sleep with mst device connected.
This patch dynamically allocates new amdgpu_dm_irq_handler_data for new interrupts if previous INTERRUPT_LOW_IRQ_CONTEXT interrupt work has not been handled. So the new interrupt works can be queued to the same workqueue_struct, instead of discard the new interrupts. All allocated amdgpu_dm_irq_handler_data are put into a single linked list and will be reused after.
--- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 14 +-- .../drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c | 115 ++++++++++++------ 2 files changed, 80 insertions(+), 49 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +1 -13
@@ -68,18 +68,6 @@ struct common_irq_params {enum dc_irq_source irq_src; }; -/** -* struct irq_list_head - Linked-list for low context IRQ handlers. -* -* @head: The list_head within &struct handler_data -* @work: A work_struct containing the deferred handler work -*/ -struct irq_list_head { -struct list_head head; -/* In case this interrupt needs post-processing, 'work' will be queued*/ -struct work_struct work; -}; -/** * struct dm_compressor_info - Buffer info used by frame buffer compression * @cpu_addr: MMIO cpu addr
@@ -270,7 +258,7 @@ struct amdgpu_display_manager {* Note that handlers are called in the same order as they were * registered (FIFO). */ -struct irq_list_head irq_handler_list_low_tab[DAL_IRQ_SOURCES_NUMBER ]; +struct list_head irq_handler_list_low_tab[DAL_IRQ_SOURCES_NUMBER ];/** * @irq_handler_list_high_tab:
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c +79 -36
206 lines not on this page · raw message
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 140/342 drm/amd/display/dc/dce/dce_aux: Remove duplicate line causing field overwritten issue
In reply to Greg Kroah-HartmanFrom: Lee Jones <[email protected]>
[ Upstream commit 89adc10178fd6cb68c8ef1905d269070a4d3bd64 ]
Fixes the following W=1 kernel build warning(s):
In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dce112/dce112_resource.c:59:
drivers/gpu/drm/amd/amdgpu/../include/asic_reg/dce/dce_11_2_sh_mask.h:10014:58: warning: initialized field overwritten [-Woverride-init] drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_aux.h:214:16: note: in expansion of macro ‘AUX_SW_DATA__AUX_SW_AUTOINCREMENT_DISABLE__SHIFT’ drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_aux.h:127:2: note: in expansion of macro ‘AUX_SF’ drivers/gpu/drm/amd/amdgpu/../display/dc/dce112/dce112_resource.c:177:2: note: in expansion of macro ‘DCE_AUX_MASK_SH_LIST’ drivers/gpu/drm/amd/amdgpu/../include/asic_reg/dce/dce_11_2_sh_mask.h:10014:58: note: (near initialization for ‘aux_shift.AUX_SW_AUTOINCREMENT_DISABLE’) drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_aux.h:214:16: note: in expansion of macro ‘AUX_SW_DATA__AUX_SW_AUTOINCREMENT_DISABLE__SHIFT’ drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_aux.h:127:2: note: in expansion of macro ‘AUX_SF’ drivers/gpu/drm/amd/amdgpu/../display/dc/dce112/dce112_resource.c:177:2: note: in expansion of macro ‘DCE_AUX_MASK_SH_LIST’ drivers/gpu/drm/amd/amdgpu/../include/asic_reg/dce/dce_11_2_sh_mask.h:10013:56: warning: initialized field overwritten [-Woverride-init] drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_aux.h:214:16: note: in expansion of macro ‘AUX_SW_DATA__AUX_SW_AUTOINCREMENT_DISABLE_MASK’ drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_aux.h:127:2: note: in expansion of macro ‘AUX_SF’ drivers/gpu/drm/amd/amdgpu/../display/dc/dce112/dce112_resource.c:181:2: note: in expansion of macro ‘DCE_AUX_MASK_SH_LIST’ drivers/gpu/drm/amd/amdgpu/../include/asic_reg/dce/dce_11_2_sh_mask.h:10013:56: note: (near initialization for ‘aux_mask.AUX_SW_AUTOINCREMENT_DISABLE’) drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_aux.h:214:16: note: in expansion of macro ‘AUX_SW_DATA__AUX_SW_AUTOINCREMENT_DISABLE_MASK’ drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_aux.h:127:2: note: in expansion of macro ‘AUX_SF’
--- drivers/gpu/drm/amd/display/dc/dce/dce_aux.h | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dce/dce_aux.h +0 -1
@@ -99,7 +99,6 @@ struct dce110_aux_registers {AUX_SF (AUX_SW_CONTROL ,AUX_SW_GO , mask_sh),\AUX_SF (AUX_SW_DATA ,AUX_SW_AUTOINCREMENT_DISABLE , mask_sh),\AUX_SF (AUX_SW_DATA ,AUX_SW_DATA_RW , mask_sh),\ -AUX_SF (AUX_SW_DATA ,AUX_SW_AUTOINCREMENT_DISABLE , mask_sh),\AUX_SF (AUX_SW_DATA ,AUX_SW_INDEX , mask_sh),\AUX_SF (AUX_SW_DATA ,AUX_SW_DATA , mask_sh),\ AUX_SF(AUX_SW_STATUS, AUX_SW_REPLY_BYTE_COUNT, mask_sh),\
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 141/342 scsi: lpfc: Fix incorrect dbde assignment when building target abts wqe
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 9302154c07bff4e7f7f43c506a1ac84540303d06 ]
The wqe_dbde field indicates whether a Data BDE is present in Words 0:2 and should therefore should be clear in the abts request wqe. By setting the bit we can be misleading fw into error cases.
Clear the wqe_dbde field.
--- drivers/scsi/lpfc/lpfc_nvmet.c | 1 - 1 file changed, 1 deletion(-)
drivers/scsi/lpfc/lpfc_nvmet.c +0 -1
@@ -3299,7 +3299,6 @@ lpfc_nvmet_unsol_issue_abort(struct lpfc_hba *phba,bf_set (wqe_rcvoxid, &wqe_abts->xmit_sequence.wqe_com, xri);/* Word 10 */ -bf_set (wqe_dbde, &wqe_abts->xmit_sequence.wqe_com,1 );bf_set (wqe_iod, &wqe_abts->xmit_sequence.wqe_com,LPFC_WQE_IOD_WRITE );bf_set (wqe_lenloc, &wqe_abts->xmit_sequence.wqe_com,LPFC_WQE_LENLOC_WORD12 );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 142/342 scsi: lpfc: Fix pt2pt connection does not recover after LOGO
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit bd4f5100424d17d4e560d6653902ef8e49b2fc1f ]
On a pt2pt setup, between 2 initiators, if one side issues a a LOGO, there is no relogin attempt. The FC specs are grey in this area on which port (higher wwn or not) is to re-login.
As there is no spec guidance, unconditionally re-PLOGI after the logout to ensure a login is re-established.
--- drivers/scsi/lpfc/lpfc_nportdisc.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/scsi/lpfc/lpfc_nportdisc.c +7 -2
@@ -901,9 +901,14 @@ lpfc_rcv_logo(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, } }else if ((!(ndlp->nlp_type &NLP_FABRIC ) && ((ndlp->nlp_type &NLP_FCP_TARGET ) || - !(ndlp->nlp_type &NLP_FCP_INITIATOR ))) || + (ndlp->nlp_type &NLP_NVME_TARGET ) || + (vport->fc_flag &FC_PT2PT ))) || (ndlp->nlp_state ==NLP_STE_ADISC_ISSUE )) { -/* Only try to re-login if this is NOT a Fabric Node */ +/* Only try to re-login if this is NOT a Fabric Node +* AND the remote NPORT is a FCP/NVME Target or we +* are in pt2pt mode. NLP_STE_ADISC_ISSUE is a special +* case for LOGO as a response to ADISC behavior. +*/ mod_timer (&ndlp->nlp_delayfunc, jiffies +msecs_to_jiffies (1000 *1 ));spin_lock_irq (&ndlp->lock);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 143/342 scsi: lpfc: Fix status returned in lpfc_els_retry() error exit path
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 148bc64d38fe314475a074c4f757ec9d84537d1c ]
An unlikely error exit path from lpfc_els_retry() returns incorrect status to a caller, erroneously indicating that a retry has been successfully issued or scheduled.
Change error exit path to indicate no retry.
--- drivers/scsi/lpfc/lpfc_els.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/lpfc/lpfc_els.c +1 -1
@@ -3840,7 +3840,7 @@ lpfc_els_retry(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, did = irsp->un.elsreq64.remoteID; ndlp =lpfc_findnode_did (vport, did);if (!ndlp && (cmd !=ELS_CMD_PLOGI )) -return 1 ; +return 0 ; } lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD,
Signature · 1 line
2.30.2