* [PATCH 5.16 0000/1039] 5.16.3-rc1 review
@ 2022-01-24 18:29 Greg Kroah-Hartman
2022-01-24 18:29 ` [PATCH 5.16 0001/1039] KVM: x86/mmu: Fix write-protection of PTs mapped by the TDP MMU Greg Kroah-Hartman
` (992 more replies)
0 siblings, 993 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:29 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable
This is the start of the stable review cycle for the 5.16.3 release.
There are 1039 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 26 Jan 2022 18:39:11 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.16.3-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.16.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 5.16.3-rc1
Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
ASoC: SOF: handle paused streams during system suspend
Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
ASoC: SOF: sof-audio: setup sched widgets during pipeline complete step
Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
ASoC: SOF: free widgets in sof_tear_down_pipelines() for static pipelines
Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
ASoC: SOF: topology: remove sof_load_pipeline_ipc()
Vitaly Kuznetsov <vkuznets@redhat.com>
KVM: selftests: Test KVM_SET_CPUID2 after KVM_RUN
Vitaly Kuznetsov <vkuznets@redhat.com>
KVM: selftests: Rename 'get_cpuid_test' to 'cpuid_test'
Vitaly Kuznetsov <vkuznets@redhat.com>
KVM: x86: Partially allow KVM_SET_CPUID{,2} after KVM_RUN
Vitaly Kuznetsov <vkuznets@redhat.com>
KVM: x86: Do runtime CPUID update before updating vcpu->arch.cpuid_entries
Andrey Konovalov <andreyknvl@gmail.com>
lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test
Moshe Tal <moshet@nvidia.com>
bonding: Fix extraction of ports from the packet headers
Alistair Popple <apopple@nvidia.com>
mm/hmm.c: allow VM_MIXEDMAP to work with hmm_range_fault
Miaoqian Lin <linmq006@gmail.com>
lib82596: Fix IRQ check in sni_82596_probe
Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
scripts/dtc: dtx_diff: remove broken example from help text
Laibin Qiu <qiulaibin@huawei.com>
blk-mq: fix tag_get wait task can't be awakened
Maxim Mikityanskiy <maximmi@nvidia.com>
sch_api: Don't skip qdisc attach on ingress
Sam Protsenko <semen.protsenko@linaro.org>
dt-bindings: watchdog: Require samsung,syscon-phandle for Exynos7
Alexander Stein <alexander.stein@mailbox.org>
dt-bindings: display: meson-vpu: Add missing amlogic,canvas property
Alexander Stein <alexander.stein@mailbox.org>
dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property
Tom Rix <trix@redhat.com>
net: mscc: ocelot: fix using match before it is set
Claudiu Beznea <claudiu.beznea@microchip.com>
net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices
Ard Biesheuvel <ardb@kernel.org>
net: cpsw: avoid alignment faults by taking NET_IP_ALIGN into account
Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
net: sfp: fix high power modules without diagnostic monitoring
Horatiu Vultur <horatiu.vultur@microchip.com>
net: ocelot: Fix the call to switchdev_bridge_port_offload
Tom Rix <trix@redhat.com>
net: ethernet: mtk_eth_soc: fix error checking in mtk_mac_config()
Slark Xiao <slark_xiao@163.com>
net: wwan: Fix MRU mismatch issue which may lead to data connection lost
Vladimir Oltean <vladimir.oltean@nxp.com>
net: mscc: ocelot: don't dereference NULL pointers with shared tc filters
Sergey Shtylyov <s.shtylyov@omp.ru>
bcmgenet: add WOL IRQ check
Vladimir Oltean <vladimir.oltean@nxp.com>
net: mscc: ocelot: don't let phylink re-enable TX PAUSE on the NPI port
Kevin Bracey <kevin@bracey.fi>
net_sched: restore "mpu xxx" handling
Alex Elder <elder@linaro.org>
net: ipa: fix atomic update in ipa_endpoint_replenish()
Jie Wang <wangjie125@huawei.com>
net: bonding: fix bond_xmit_broadcast return value error bug
Miroslav Lichvar <mlichvar@redhat.com>
net: fix sock_timestamping_bind_phc() to release device
David Heidelberg <david@ixit.cz>
arm64: dts: qcom: msm8996: drop not documented adreno properties
Leon Romanovsky <leon@kernel.org>
devlink: Remove misleading internal_flags from health reporter dump
Ian Rogers <irogers@google.com>
perf metric: Fix metric_leader
Zechuan Chen <chenzechuan1@huawei.com>
perf probe: Fix ppc64 'perf probe add events failed' case
Ian Rogers <irogers@google.com>
perf test: Enable system wide for metricgroups test
José Expósito <jose.exposito89@gmail.com>
perf metricgroup: Fix use after free in metric__new()
Uwe Kleine-König <uwe@kleine-koenig.org>
perf tools: Drop requirement for libstdc++.so for libopencsd check
Thomas Richter <tmricht@linux.ibm.com>
perf cputopo: Fix CPU topology reading on s/390
Tudor Ambarus <tudor.ambarus@microchip.com>
dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
Tudor Ambarus <tudor.ambarus@microchip.com>
dmaengine: at_xdmac: Fix lld view setting
Tudor Ambarus <tudor.ambarus@microchip.com>
dmaengine: at_xdmac: Fix concurrency over xfers_list
Tudor Ambarus <tudor.ambarus@microchip.com>
dmaengine: at_xdmac: Print debug message after realeasing the lock
Tudor Ambarus <tudor.ambarus@microchip.com>
dmaengine: at_xdmac: Start transfer for cyclic channels in issue_pending
Tudor Ambarus <tudor.ambarus@microchip.com>
dmaengine: at_xdmac: Don't start transactions at tx_submit level
Adrian Hunter <adrian.hunter@intel.com>
perf script: Fix hex dump character output
Guillaume Nault <gnault@redhat.com>
libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route()
Guillaume Nault <gnault@redhat.com>
gre: Don't accidentally set RTO_ONLINK in gre_fill_metadata_dst()
Eli Cohen <elic@nvidia.com>
vdpa/mlx5: Restore cur_num_vqs in case of failure in change_num_qps()
Eli Cohen <elic@nvidia.com>
vdpa/mlx5: Fix config_attr_mask assignment
Guillaume Nault <gnault@redhat.com>
xfrm: Don't accidentally set RTO_ONLINK in decode_session4()
Johannes Berg <johannes.berg@intel.com>
iwlwifi: fix Bz NMI behaviour
Eric Dumazet <edumazet@google.com>
netns: add schedule point in ops_exit_list()
Eric Dumazet <edumazet@google.com>
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
Eric W. Biederman <ebiederm@xmission.com>
taskstats: Cleanup the use of task->exit_code
Michael S. Tsirkin <mst@redhat.com>
virtio_ring: mark ring unused on error
Eli Cohen <elic@nvidia.com>
vdpa/mlx5: Fix wrong configuration of virtio_version_1_0
Laurence de Bruxelles <lfdebrux@gmail.com>
rtc: pxa: fix null pointer dereference
Kees Cook <keescook@chromium.org>
rtc: Move variable into switch case statement
Matt Johnston <matt@codeconstruct.com.au>
mctp: test: zero out sockaddr
Dmitry Torokhov <dmitry.torokhov@gmail.com>
HID: vivaldi: fix handling devices not using numbered reports
Johannes Berg <johannes.berg@intel.com>
um: gitignore: Add kernel/capflags.c
Yury Norov <yury.norov@gmail.com>
bitops: protect find_first_{,zero}_bit properly
Robert Hancock <robert.hancock@calian.com>
net: axienet: increase default TX ring size to 128
Robert Hancock <robert.hancock@calian.com>
net: axienet: fix for TX busy handling
Robert Hancock <robert.hancock@calian.com>
net: axienet: fix number of TX ring slots for available check
Robert Hancock <robert.hancock@calian.com>
net: axienet: Fix TX ring slot available check
Robert Hancock <robert.hancock@calian.com>
net: axienet: limit minimum TX ring size
Robert Hancock <robert.hancock@calian.com>
net: axienet: add missing memory barriers
Robert Hancock <robert.hancock@calian.com>
net: axienet: reset core on initialization prior to MDIO access
Robert Hancock <robert.hancock@calian.com>
net: axienet: Wait for PhyRstCmplt after core reset
Robert Hancock <robert.hancock@calian.com>
net: axienet: increase reset timeout
Wen Gu <guwen@linux.alibaba.com>
net/smc: Fix hung_task when removing SMC-R devices
Miaoqian Lin <linmq006@gmail.com>
gpio: idt3243x: Fix IRQ check in idt_gpio_probe
Miaoqian Lin <linmq006@gmail.com>
gpio: mpc8xxx: Fix IRQ check in mpc8xxx_probe
John Keeping <john@metanate.com>
pinctrl/rockchip: fix gpio device creation
Robert Hancock <robert.hancock@calian.com>
clk: si5341: Fix clock HW provider cleanup
Stephen Boyd <sboyd@kernel.org>
clk: Emit a stern warning with writable debugfs enabled
Eric Dumazet <edumazet@google.com>
af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress
Dan Carpenter <dan.carpenter@oracle.com>
crypto: octeontx2 - uninitialized variable in kvf_limits_store()
Chao Yu <chao@kernel.org>
f2fs: fix to check available space of CP area correctly in update_ckpt_flags()
Chao Yu <chao@kernel.org>
f2fs: fix to reserve space for IO align feature
Hyeong-Jun Kim <hj514.kim@samsung.com>
f2fs: compress: fix potential deadlock of compress file
Chao Yu <chao@kernel.org>
f2fs: fix to avoid panic in is_alive() if metadata is inconsistent
Fengnan Chang <changfengnan@vivo.com>
f2fs: fix remove page failed in invalidate compress pages
Zack Rusin <zackr@vmware.com>
drm/vmwgfx: Remove unused compile options
Zack Rusin <zackr@vmware.com>
drm/vmwgfx: Remove explicit transparent hugepages support
Geert Uytterhoeven <geert@linux-m68k.org>
riscv: dts: microchip: mpfs: Drop empty chosen node
Palmer Dabbelt <palmer@rivosinc.com>
RISC-V: defconfigs: Set CONFIG_FB=y, for FB console
Miaoqian Lin <linmq006@gmail.com>
parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries
Tobias Waldekranz <tobias@waldekranz.com>
net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module
Tobias Waldekranz <tobias@waldekranz.com>
net/fsl: xgmac_mdio: Add workaround for erratum A-009885
Guillaume Nault <gnault@redhat.com>
mlx5: Don't accidentally set RTO_ONLINK before mlx5e_route_lookup_ipv4_get()
Eric Dumazet <edumazet@google.com>
ipv4: avoid quadratic behavior in netns dismantle
Eric Dumazet <edumazet@google.com>
ipv4: update fib_info_cnt under spinlock protection
German Gomez <german.gomez@arm.com>
perf evsel: Override attr->sample_period for non-libpfm4 events
Daniel Borkmann <daniel@iogearbox.net>
bpf: Mark PTR_TO_FUNC register initially with zero offset
Yafang Shao <laoar.shao@gmail.com>
bpf: Fix mount source show for bpffs
Toke Høiland-Jørgensen <toke@redhat.com>
xdp: check prog type before updating BPF link
Quentin Monnet <quentin@isovalent.com>
bpftool: Fix indent in option lists in the documentation
Quentin Monnet <quentin@isovalent.com>
bpftool: Remove inclusion of utilities.mak from Makefiles
Russell King <russell.king@oracle.com>
arm64/bpf: Remove 128MB limit for BPF JIT programs
Andrii Nakryiko <andrii@kernel.org>
libbpf: Remove deprecation attribute from struct bpf_prog_prep_result
Maxime Ripard <maxime@cerno.tech>
drm/vc4: crtc: Copy assigned channel to the CRTC
Maxime Ripard <maxime@cerno.tech>
drm/vc4: Fix non-blocking commit getting stuck forever
Maxime Ripard <maxime@cerno.tech>
drm/vc4: crtc: Drop feed_txp from state
Ye Bin <yebin10@huawei.com>
block: Fix fsync always failed if once failed
Jens Axboe <axboe@kernel.dk>
block: fix async_depth sysfs interface for mq-deadline
Tobias Waldekranz <tobias@waldekranz.com>
powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses
Anders Roxell <anders.roxell@linaro.org>
powerpc/cell: Fix clang -Wimplicit-fallthrough warning
Moshe Shemesh <moshe@nvidia.com>
Revert "net/mlx5: Add retry mechanism to the command entry index allocation"
Amelie Delaunay <amelie.delaunay@foss.st.com>
dmaengine: stm32-mdma: fix STM32_MDMA_CTBR_TSEL_MASK
Chengguang Xu <cgxu519@mykernel.net>
RDMA/rxe: Fix a typo in opcode name
Yixing Liu <liuyixing1@huawei.com>
RDMA/hns: Modify the mapping attribute of doorbell to device
Dave Jiang <dave.jiang@intel.com>
dmaengine: idxd: fix wq settings post wq disable
Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
dmaengine: uniphier-xdmac: Fix type of address variables
Miaoqian Lin <linmq006@gmail.com>
scsi: ufs: ufs-mediatek: Fix error checking in ufs_mtk_init_va09_pwr_ctrl()
Baruch Siach <baruch@tkos.co.il>
of: base: Improve argument length mismatch error
Bart Van Assche <bvanassche@acm.org>
scsi: core: Show SCMD_LAST in text form
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: hci_sync: Fix not setting adv set duration
Markus Reichl <m.reichl@fivetechno.de>
net: usb: Correct reset handling of smsc95xx
Mark Chen <mark-yw.chen@mediatek.com>
Bluetooth: btusb: Return error code when getting patch status failed
Randy Dunlap <rdunlap@infradead.org>
Documentation: fix firewire.rst ABI file path error
Lukas Bulwahn <lukas.bulwahn@gmail.com>
Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization
Alexandre Ghiti <alexandre.ghiti@canonical.com>
Documentation, arch: Remove leftovers from CIFS_WEAK_PW_HASH
Alexandre Ghiti <alexandre.ghiti@canonical.com>
Documentation, arch: Remove leftovers from raw device
Sakari Ailus <sakari.ailus@linux.intel.com>
Documentation: ACPI: Fix data node reference documentation
Daniel Thompson <daniel.thompson@linaro.org>
Documentation: dmaengine: Correctly describe dmatest with channel unset
Mike Leach <mike.leach@linaro.org>
Documentation: coresight: Fix documentation issue
Randy Dunlap <rdunlap@infradead.org>
media: correct MEDIA_TEST_SUPPORT help text
Maxime Ripard <maxime@cerno.tech>
drm/vc4: hdmi: Make sure the device is powered with CEC
Suresh Udipi <sudipi@jp.adit-jv.com>
media: rcar-csi2: Optimize the selection PHTW register
Marc Kleine-Budde <mkl@pengutronix.de>
can: mcp251xfd: mcp251xfd_tef_obj_read(): fix typo in error message
Ben Hutchings <ben@decadent.org.uk>
firmware: Update Kconfig help text for Google firmware
Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
drm/amdgpu/display: Only set vblank_disable_immediate when PSR is not enabled
Christian König <christian.koenig@amd.com>
drm/radeon: fix error handling in radeon_driver_open_kms
Rajneesh Bhardwaj <rajneesh.bhardwaj@amd.com>
Revert "drm/amdgpu: Don't inherit GEM object VMAs in child process"
Theodore Ts'o <tytso@mit.edu>
ext4: don't use the orphan list when migrating an inode
Zhang Yi <yi.zhang@huawei.com>
ext4: fix an use-after-free issue about data=journal writeback mode
Ye Bin <yebin10@huawei.com>
ext4: fix null-ptr-deref in '__ext4_journal_ensure_credits'
Sebastian Andrzej Siewior <bigeasy@linutronix.de>
ext4: destroy ext4_fc_dentry_cachep kmemcache on module removal
Xin Yin <yinxin.x@bytedance.com>
ext4: fast commit may miss tracking unwritten range during ftruncate
Xin Yin <yinxin.x@bytedance.com>
ext4: use ext4_ext_remove_space() for fast commit replay delete range
Ye Bin <yebin10@huawei.com>
ext4: Fix BUG_ON in ext4_bread when write quota data
Luís Henriques <lhenriques@suse.de>
ext4: set csum seed in tmp inode while migrating to extents
Xin Yin <yinxin.x@bytedance.com>
ext4: fix fast commit may miss tracking range for FALLOC_FL_ZERO_RANGE
Harshad Shirwadkar <harshadshirwadkar@gmail.com>
ext4: initialize err_blk before calling __ext4_get_inode_loc
Chunguang Xu <brookxu@tencent.com>
ext4: fix a possible ABBA deadlock due to busy PA
Jan Kara <jack@suse.cz>
ext4: make sure quota gets properly shutdown on error
Jan Kara <jack@suse.cz>
ext4: make sure to reset inode lockdep class when quota enabling fails
Filipe Manana <fdmanana@suse.com>
btrfs: respect the max size in the header when activating swap file
Naohiro Aota <naohiro.aota@wdc.com>
btrfs: zoned: fix chunk allocation condition for zoned allocator
Naohiro Aota <naohiro.aota@wdc.com>
btrfs: zoned: unset dedicated block group on allocation failure
Naohiro Aota <naohiro.aota@wdc.com>
btrfs: add extent allocator hook to decide to allocate chunk or not
Josef Bacik <josef@toxicpanda.com>
btrfs: check the root node for uptodate before returning it
Naohiro Aota <naohiro.aota@wdc.com>
btrfs: zoned: cache reported zone during mount
Filipe Manana <fdmanana@suse.com>
btrfs: fix deadlock between quota enable and other quota operations
Nicolas Dichtel <nicolas.dichtel@6wind.com>
xfrm: fix dflt policy check when there is no policy configured
Ghalem Boudour <ghalem.boudour@6wind.com>
xfrm: fix policy lookup for ipv6 gre packets
Pali Rohár <pali@kernel.org>
PCI: pci-bridge-emul: Set PCI_STATUS_CAP_LIST for PCIe device
Pali Rohár <pali@kernel.org>
PCI: pci-bridge-emul: Correctly set PCIe capabilities
Pali Rohár <pali@kernel.org>
PCI: pci-bridge-emul: Fix definitions of reserved bits
Pali Rohár <pali@kernel.org>
PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI config space
Pali Rohár <pali@kernel.org>
PCI: pci-bridge-emul: Make expansion ROM Base Address register read-only
Lukas Wunner <lukas@wunner.de>
PCI: pciehp: Fix infinite loop in IRQ handler upon power fault
Hans de Goede <hdegoede@redhat.com>
PCI: pciehp: Use down_read/write_nested(reset_lock) to fix lockdep errors
Rob Herring <robh@kernel.org>
PCI: xgene: Fix IB window setup
José Roberto de Souza <jose.souza@intel.com>
drm/i915/display/ehl: Update voltage swing table
Mario Limonciello <mario.limonciello@amd.com>
drm/amd/display: Revert W/A for hard hangs on DCN20/DCN21
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu: don't do resets on APUs which don't support it
Lukas Fink <lukas.fink1@gmail.com>
drm/amdgpu: Fix rejecting Tahiti GPUs
Harry Wentland <harry.wentland@amd.com>
drm/amdgpu: Use correct VIEWPORT_DIMENSION for DCN2
James Smart <jsmart2021@gmail.com>
scsi: lpfc: Fix lpfc_force_rscn ndlp kref imbalance
Nicholas Piggin <npiggin@gmail.com>
powerpc/64s/radix: Fix huge vmap false positive
John David Anglin <dave.anglin@bell.net>
parisc: Fix lpa and lpa_user defines
Brian Norris <briannorris@chromium.org>
drm/bridge: analogix_dp: Make PSR-exit block less
Ilia Mirkin <imirkin@alum.mit.edu>
drm/nouveau/kms/nv04: use vzalloc for nv04_display
Yizhuo Zhai <yzhai003@ucr.edu>
drm/amd/display: Fix the uninitialized variable in enable_stream_features()
Lucas Stach <l.stach@pengutronix.de>
drm/etnaviv: limit submit sizes
Dmitry Osipenko <digetx@gmail.com>
drm/tegra: submit: Add missing pm_runtime_mark_last_busy()
Sakari Ailus <sakari.ailus@linux.intel.com>
device property: Fix fwnode_graph_devcon_match() fwnode leak
Alexander Gordeev <agordeev@linux.ibm.com>
s390/mm: fix 2KB pgtable release race
Ilan Peer <ilan.peer@intel.com>
iwlwifi: mvm: Increase the scan timeout guard to 30 seconds
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
remoteproc: imx_rproc: Fix a resource leak in the remove function
Steven Rostedt <rostedt@goodmis.org>
tracing: Have syscall trace events use trace_event_buffer_lock_reserve()
Xiangyang Zhang <xyz.sun.ok@gmail.com>
tracing/kprobes: 'nmissed' not showed correctly for kretprobe
Nikita Yushchenko <nikita.yushchenko@virtuozzo.com>
tracing/osnoise: Properly unhook events if start_per_cpu_kthreads() fails
Andrey Ryabinin <arbn@yandex-team.com>
sched/cpuacct: Fix user/system in shown cpuacct.usage*
Andrey Ryabinin <arbn@yandex-team.com>
cputime, cpuacct: Include guest time in user time in cpuacct.stat
Lukas Wunner <lukas@wunner.de>
serial: Fix incorrect rs485 polarity on uart open
Xie Yongji <xieyongji@bytedance.com>
fuse: Pass correct lend value to filemap_write_and_wait_range()
Borislav Petkov <bp@suse.de>
x86/mce: Check regs before accessing it
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
HID: magicmouse: Fix an error handling path in magicmouse_probe()
Xiao Ni <xni@redhat.com>
md: Move alloc/free acct bioset in to personality
Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
xen/gntdev: fix unmap notification order
Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
spi: uniphier: Fix a bug that doesn't point to private data correctly
Dmitry Osipenko <digetx@gmail.com>
mfd: tps65910: Set PWR_OFF bit during driver probe
Patrick Williams <patrick@stwcx.xyz>
tpm: fix NPE on probe for missing device
Lino Sanfilippo <LinoSanfilippo@gmx.de>
tpm: fix potential NULL pointer access in tpm_del_char_device
Petr Cvachoucek <cvachoucek@gmail.com>
ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers
Meng Li <Meng.Li@windriver.com>
crypto: caam - replace this_cpu_ptr with raw_cpu_ptr
Marek Vasut <marex@denx.de>
crypto: stm32/crc32 - Fix kernel BUG triggered in probe()
Heiner Kallweit <hkallweit1@gmail.com>
crypto: omap-aes - Fix broken pm_runtime_and_get() usage
Zhu Lingshan <lingshan.zhu@intel.com>
ifcvf/vDPA: fix misuse virtio-net device config size for blk dev
Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
rpmsg: core: Clean up resources on announce_create failure.
Sean Christopherson <seanjc@google.com>
hugetlbfs: fix off-by-one error in hugetlb_vmdelete_list()
Chen Wandun <chenwandun@huawei.com>
mm/page_isolation: unset migratetype directly for non Buddy page
Waiman Long <longman@redhat.com>
selftests/vm: make charge_reserved_hugetlb.sh work with existing cgroup setting
Andrey Konovalov <andreyknvl@gmail.com>
kasan: fix quarantine conflicting with init_on_free
Kefeng Wang <wangkefeng.wang@huawei.com>
mm: defer kmemleak object creation of module_alloc()
Xiaoke Wang <xkernel.wang@foxmail.com>
tracing/probes: check the return value of kstrndup() for pbuf
Xiaoke Wang <xkernel.wang@foxmail.com>
tracing/uprobes: Check the return value of kstrdup() for tu->filename
Weizhao Ouyang <o451686892@gmail.com>
dma-buf: cma_heap: Fix mutex locking section
Tom Rix <trix@redhat.com>
i3c: master: dw: check return of dw_i3c_master_get_free_pos()
Sergio Paracuellos <sergio.paracuellos@gmail.com>
PCI: mt7621: Add missing MODULE_LICENSE()
Guchun Chen <guchun.chen@amd.com>
drm/amdgpu: use spin_lock_irqsave to avoid deadlock by local interrupt
Jiasheng Jiang <jiasheng@iscas.ac.cn>
drm/amdkfd: Check for null pointer after calling kmemdup
José Expósito <jose.exposito89@gmail.com>
drm/amd/display: invalid parameter check in dmub_hpd_callback
Wesley Sheng <wesley.sheng@microchip.com>
ntb_hw_switchtec: Fix bug with more than 32 partitions
Jeremy Pallotta <jmpallotta@gmail.com>
ntb_hw_switchtec: Fix pff ioread to read into mmio_part_cfg_all
Liu Ying <victor.liu@nxp.com>
drm/atomic: Check new_crtc_state->active to determine if CRTC needs disable in self refresh mode
Miaoqian Lin <linmq006@gmail.com>
drm/sun4i: dw-hdmi: Fix missing put_device() call in sun8i_hdmi_phy_get
Chuck Lever <chuck.lever@oracle.com>
SUNRPC: Fix sockaddr handling in svcsock_accept_class trace points
Chuck Lever <chuck.lever@oracle.com>
SUNRPC: Fix sockaddr handling in the svc_xprt_create_error trace point
Matthew Auld <matthew.auld@intel.com>
drm/i915: don't call free_mmap_offset when purging
Juston Li <juston.li@intel.com>
drm/i915/pxp: Hold RPM wakelock during PXP unbind
Vitaly Kuznetsov <vkuznets@redhat.com>
x86/hyperv: Properly deal with empty cpumasks in hyperv_flush_tlb_multi()
J. Bruce Fields <bfields@redhat.com>
nfsd: fix crash on COPY_NOTIFY with special stateid
Chuck Lever <chuck.lever@oracle.com>
Revert "nfsd: skip some unnecessary stats in the v4 case"
Chuck Lever <chuck.lever@oracle.com>
NFSD: Fix verifier returned in stable WRITEs
Vincent Chen <vincent.chen@sifive.com>
KVM: RISC-V: Avoid spurious virtual interrupts after clearing hideleg CSR
Pali Rohár <pali@kernel.org>
PCI: mvebu: Fix support for DEVCAP2, DEVCTL2 and LNKCTL2 registers on emulated bridge
Pali Rohár <pali@kernel.org>
PCI: mvebu: Fix support for PCI_EXP_RTSTA on emulated bridge
Pali Rohár <pali@kernel.org>
PCI: mvebu: Fix support for PCI_EXP_DEVCTL on emulated bridge
Pali Rohár <pali@kernel.org>
PCI: mvebu: Fix support for PCI_BRIDGE_CTL_BUS_RESET on emulated bridge
Pali Rohár <pali@kernel.org>
PCI: mvebu: Setup PCIe controller to Root Complex mode
Pali Rohár <pali@kernel.org>
PCI: mvebu: Fix configuring secondary bus of PCIe Root Port via emulated bridge
Pali Rohár <pali@kernel.org>
PCI: mvebu: Fix support for bus mastering and PCI_COMMAND on emulated bridge
Pali Rohár <pali@kernel.org>
PCI: mvebu: Do not modify PCI IO type bits in conf_write
Pali Rohár <pali@kernel.org>
PCI: mvebu: Check for errors from pci_bridge_emul_init() call
Dario Binacchi <dariobin@libero.it>
Input: ti_am335x_tsc - fix STEPCONFIG setup for Z2
Dario Binacchi <dariobin@libero.it>
Input: ti_am335x_tsc - set ADCREFM for X configuration
Beau Belgrave <beaub@linux.microsoft.com>
tracing: Do not let synth_events block other dyn_event systems during create
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
i3c/master/mipi-i3c-hci: Fix a potentially infinite loop in 'hci_dat_v1_get_index()'
Jamie Iles <quic_jiles@quicinc.com>
i3c: fix incorrect address slot lookup on 64-bit
Hou Wenlong <houwenlong93@linux.alibaba.com>
KVM: x86: Exit to userspace if emulation prepared a completion callback
Sean Christopherson <seanjc@google.com>
KVM: x86: Handle 32-bit wrap of EIP for EMULTYPE_SKIP with flat code seg
Lai Jiangshan <laijs@linux.alibaba.com>
KVM: X86: Ensure that dirty PDPTRs are loaded
Sean Christopherson <seanjc@google.com>
KVM: VMX: Read Posted Interrupt "control" exactly once per loop iteration
Sean Christopherson <seanjc@google.com>
KVM: s390: Ensure kvm_arch_no_poll() is read once when blocking vCPU
Paolo Bonzini <pbonzini@redhat.com>
KVM: VMX: Don't unblock vCPU w/ Posted IRQ if IRQs are disabled in guest
Hector Martin <marcan@marcan.st>
PCI: apple: Fix REFCLK1 enable/poll logic
Pali Rohár <pali@kernel.org>
PCI: aardvark: Fix checking for MEM resource type
Tim Harvey <tharvey@gateworks.com>
PCI: dwc: Do not remap invalid res
Marek Vasut <marek.vasut+renesas@gmail.com>
PCI: rcar: Check if device is runtime suspended instead of __clk_is_enabled()
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
PCI: qcom: Fix an error handling path in 'qcom_pcie_probe()'
Jianjun Wang <jianjun.wang@mediatek.com>
PCI: mediatek-gen3: Disable DVFSRC voltage request
Eric W. Biederman <ebiederm@xmission.com>
signal: In get_signal test for signal_group_exit every time through the loop
Conor Dooley <conor.dooley@microchip.com>
mailbox: change mailbox-mpfs compatible string
Miaoqian Lin <linmq006@gmail.com>
phy: mediatek: Fix missing check in mtk_mipi_tx_probe
Ohad Sharabi <osharabi@habana.ai>
habanalabs: skip read fw errors if dynamic descriptor invalid
Dani Liberman <dliberman@habana.ai>
habanalabs: change wait for interrupt timeout to 64 bit
Tzung-Bi Shih <tzungbi@google.com>
ASoC: mediatek: mt8183: fix device_node leak
Tzung-Bi Shih <tzungbi@google.com>
ASoC: mediatek: mt8173: fix device_node leak
Chunfeng Yun <chunfeng.yun@mediatek.com>
phy: phy-mtk-tphy: add support efuse setting
Tzung-Bi Shih <tzungbi@google.com>
ASoC: mediatek: mt8192-mt6359: fix device_node leak
Sreekanth Reddy <sreekanth.reddy@broadcom.com>
scsi: mpi3mr: Fixes around reply request queues
Christoph Hellwig <hch@lst.de>
scsi: sr: Don't use GFP_DMA
Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
MIPS: Octeon: Fix build errors using clang
Michael Ellerman <mpe@ellerman.id.au>
selftests/powerpc: Add a test of sigreturning to the kernel
Ajit Kumar Pandey <AjitKumar.Pandey@amd.com>
ASoC: SOF: ipc: Add null pointer check for substream->runtime
Qi Liu <liuqi115@huawei.com>
scsi: hisi_sas: Prevent parallel FLR and controller reset
Lakshmi Sowjanya D <lakshmi.sowjanya.d@intel.com>
i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters
Marc Zyngier <maz@kernel.org>
irqchip/gic-v4: Disable redistributors' view of the VPE table at boot time
Ye Guojin <ye.guojin@zte.com.cn>
MIPS: OCTEON: add put_device() after of_find_device_by_node()
Jan Kara <jack@suse.cz>
udf: Fix error handling in udf_new_inode()
Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
ASoC: SOF: Intel: hda: add quirks for HDAudio DMA position information
Hari Bathini <hbathini@linux.ibm.com>
powerpc/fadump: Fix inaccurate CPU state info in vmcore generated with panic
Hari Bathini <hbathini@linux.ibm.com>
powerpc: handle kdump appropriately with crash_kexec_post_notifiers option
Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
selftests/powerpc/spectre_v2: Return skip code when miss_percent is high
Christophe Leroy <christophe.leroy@csgroup.eu>
powerpc/40x: Map 32Mbytes of memory at startup
Nathan Chancellor <nathan@kernel.org>
MIPS: Loongson64: Use three arguments for slti
Takashi Iwai <tiwai@suse.de>
ALSA: seq: Set upper limit of processed events
James Smart <jsmart2021@gmail.com>
scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup
James Smart <jsmart2021@gmail.com>
scsi: lpfc: Fix leaked lpfc_dmabuf mbox allocations with NPIV
Bart Van Assche <bvanassche@acm.org>
scsi: ufs: Fix a kernel crash during shutdown
Stephan Gerhold <stephan@gerhold.net>
interconnect: qcom: rpm: Prevent integer overflow in rate
Ameer Hamza <amhamza.mgc@gmail.com>
ASoC: test-component: fix null pointer dereference.
Christoph Hellwig <hch@lst.de>
dm: make the DAX support depend on CONFIG_FS_DAX
Christoph Hellwig <hch@lst.de>
dm: fix alloc_dax error handling in alloc_dev
Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
nvmem: core: set size for sysfs bin file
Christophe Leroy <christophe.leroy@csgroup.eu>
w1: Misuse of get_user()/put_user() reported by sparse
Alexey Kardashevskiy <aik@ozlabs.ru>
KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST
Alexey Kardashevskiy <aik@ozlabs.ru>
KVM: PPC: Book3S: Suppress warnings when allocating too big memory slots
Christophe Leroy <christophe.leroy@csgroup.eu>
powerpc/powermac: Add missing lockdep_register_key()
Martin Blumenstingl <martin.blumenstingl@googlemail.com>
clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB
Joakim Tjernlund <joakim.tjernlund@infinera.com>
i2c: mpc: Correct I2C reset procedure
Michael Ellerman <mpe@ellerman.id.au>
powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING
Heiner Kallweit <hkallweit1@gmail.com>
i2c: i801: Don't silently correct invalid transfer size
Ye Guojin <ye.guojin@zte.com.cn>
ASoC: imx-hdmi: add put_device() after of_find_device_by_node()
Nicholas Piggin <npiggin@gmail.com>
powerpc/watchdog: Fix missed watchdog reset due to memory ordering race
Julia Lawall <Julia.Lawall@lip6.fr>
powerpc/btext: add missing of_node_put
Julia Lawall <Julia.Lawall@lip6.fr>
powerpc/cell: add missing of_node_put
Julia Lawall <Julia.Lawall@lip6.fr>
powerpc/powernv: add missing of_node_put
Julia Lawall <Julia.Lawall@lip6.fr>
powerpc/6xx: add missing of_node_put
Sam Protsenko <semen.protsenko@linaro.org>
clk: samsung: exynos850: Register clocks early
Ingo Molnar <mingo@kernel.org>
x86/kbuild: Enable CONFIG_KALLSYMS_ALL=y in the defconfigs
Marc Kleine-Budde <mkl@pengutronix.de>
can: flexcan: add more quirks to describe RX path capabilities
Marc Kleine-Budde <mkl@pengutronix.de>
can: flexcan: rename RX modes
Dario Binacchi <dario.binacchi@amarulasolutions.com>
can: flexcan: allow to change quirks at runtime
Mauro Carvalho Chehab <mchehab@kernel.org>
scripts: sphinx-pre-install: Fix ctex support on Debian
John David Anglin <dave.anglin@bell.net>
parisc: Avoid calling faulthandler_disabled() twice
Maor Dickman <maord@nvidia.com>
net/mlx5e: Unblock setting vid 0 for VF in case PF isn't eswitch manager
Maher Sanalla <msanalla@nvidia.com>
net/mlx5: Update log_max_qp value to FW max capability
Jason A. Donenfeld <Jason@zx2c4.com>
random: do not throw away excess input to crng_fast_load
Lukas Wunner <lukas@wunner.de>
serial: core: Keep mctrl register state and cached copy in sync
Lukas Wunner <lukas@wunner.de>
serial: pl011: Drop CR register reset on set_termios
Lukas Wunner <lukas@wunner.de>
serial: pl010: Drop CR register reset on set_termios
Konrad Dybcio <konrad.dybcio@somainline.org>
regulator: qcom_smd: Align probe function with rpmh-regulator
Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
net: gemini: allow any RGMII interface mode
Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
net: phy: marvell: configure RGMII delays for 88E1118
Danielle Ratson <danieller@nvidia.com>
mlxsw: pci: Avoid flow control for EMAD packets
Jiri Olsa <jolsa@redhat.com>
bpf/selftests: Fix namespace mount setup in tc_redirect
Vincent Mailhol <mailhol.vincent@wanadoo.fr>
can: do not increase rx statistics when generating a CAN rx error message frame
Joe Thornber <ejt@redhat.com>
dm space map common: add bounds check to sm_ll_lookup_bitmap()
Joe Thornber <ejt@redhat.com>
dm btree: add a defensive bounds check to insert_at()
Ping-Ke Shih <pkshih@realtek.com>
mac80211: allow non-standard VHT MCS-10/11
Florian Fainelli <f.fainelli@gmail.com>
net: mdio: Demote probed message to debug print
Josef Bacik <josef@toxicpanda.com>
btrfs: remove BUG_ON(!eie) in find_parent_nodes
Josef Bacik <josef@toxicpanda.com>
btrfs: remove BUG_ON() in find_parent_nodes()
Yevgeny Kliteynik <kliteyn@nvidia.com>
net/mlx5: DR, Fix error flow in creating matcher
Mario Limonciello <mario.limonciello@amd.com>
ACPI: CPPC: Check present CPUs for determining _CPC is valid
Thomas Weißschuh <linux@weissschuh.net>
ACPI: battery: Add the ThinkPad "Not Charging" quirk
Marina Nikolic <Marina.Nikolic@amd.com>
amdgpu/pm: Make sysfs pm attributes as read-only for VFs
Hans de Goede <hdegoede@redhat.com>
mfd: intel_soc_pmic: Use CPU-id check instead of _HRV check to differentiate variants
Zongmin Zhou <zhouzongmin@kylinos.cn>
drm/amdgpu: fixup bad vram size on gmc v8
Rajneesh Bhardwaj <rajneesh.bhardwaj@amd.com>
drm/amdgpu: Don't inherit GEM object VMAs in child process
AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
mmc: mtk-sd: Use readl_poll_timeout instead of open-coded polling
Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5
Sudeep Holla <sudeep.holla@arm.com>
ACPICA: Fix wrong interpretation of PCC address
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R()
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPICA: Utilities: Avoid deleting the same object twice in a row
Mark Langsdorf <mlangsdo@redhat.com>
ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions
Kyeong Yoo <kyeong.yoo@alliedtelesis.co.nz>
jffs2: GC deadlock reading a page that is used in jffs2_write_begin()
Lucas Stach <l.stach@pengutronix.de>
drm/etnaviv: consider completed fence seqno in hang check
Antony Antony <antony.antony@secunet.com>
xfrm: rate limit SA mapping change message to user space
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: vhci: Set HCI_QUIRK_VALID_LE_STATES
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
cpufreq: intel_pstate: Update cpuinfo.max_freq on HWP_CAP changes
Tedd Ho-Jeong An <tedd.an@intel.com>
Bluetooth: btintel: Add missing quirks and msft ext for legacy bootloader
Ben Greear <greearb@candelatech.com>
ath11k: Fix napi related hang
Randy Dunlap <rdunlap@infradead.org>
um: registers: Rename function names to avoid conflicts and build problems
Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
block: check minor range in device_add_disk()
Hector Martin <marcan@marcan.st>
mmc: sdhci-pci-gli: GL9755: Support for CD/WP inversion on OF platforms
Luca Coelho <luciano.coelho@intel.com>
iwlwifi: pcie: make sure prph_info is set when treating wakeup IRQ
Avraham Stern <avraham.stern@intel.com>
iwlwifi: mvm: fix AUX ROC removal
Ilan Peer <ilan.peer@intel.com>
iwlwifi: mvm: Fix calculation of frame length
Johannes Berg <johannes.berg@intel.com>
iwlwifi: remove module loading failure message
Johannes Berg <johannes.berg@intel.com>
iwlwifi: fix leaks/bad data after failed firmware load
Luca Coelho <luciano.coelho@intel.com>
iwlwifi: recognize missing PNVM data and then log filename
Changcheng Deng <deng.changcheng@zte.com.cn>
PM: AVS: qcom-cpr: Use div64_ul instead of do_div
Po-Hao Huang <phhuang@realtek.com>
rtw88: 8822c: update rx settings to prevent potential hw deadlock
Zekun Shen <bruceshenzk@gmail.com>
ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()
Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
ath9k_htc: fix NULL pointer dereference at ath9k_htc_rxep()
Deren Wu <deren.wu@mediatek.com>
mt76: mt7921: fix network buffer leak by txs missing
Felix Fietkau <nbd@nbd.name>
mt76: mt7615: improve wmm index allocation
Xing Song <xing.song@mediatek.com>
mt76: do not pass the received frame with decryption error
Lorenzo Bianconi <lorenzo@kernel.org>
mt76: connac: fix a theoretical NULL pointer dereference in mt76_connac_get_phy_mode
Ryder Lee <ryder.lee@mediatek.com>
mt76: mt7915: fix SMPS operation fail
Peter Chiu <chui-hao.chiu@mediatek.com>
mt76: mt7615: fix possible deadlock while mt7615_register_ext_phy()
Kai-Heng Feng <kai.heng.feng@canonical.com>
usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
cpufreq: Fix initialization of min and max frequency QoS requests
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
PM: runtime: Add safety net to supplier device release
Yang Shen <shenyang39@huawei.com>
crypto: hisilicon/qm - fix deadlock for remove driver
Weili Qian <qianweili@huawei.com>
crypto: hisilicon/hpre - fix memory leak in hpre_curve25519_src_init()
Peter Gonda <pgonda@google.com>
crypto: ccp - Move SEV_INIT retry for corrupted data
Thierry Reding <treding@nvidia.com>
arm64: tegra: Adjust length of CCPLEX cluster MMIO region
Biwen Li <biwen.li@nxp.com>
arm64: dts: ls1028a-qds: move rtc node to the correct i2c bus
Paul Moore <paul@paul-moore.com>
audit: ensure userspace is penalized the same as the kernel when under pressure
Jingwen Chen <Jingwen.Chen2@amd.com>
drm/amd/amdgpu: fix gmc bo pin count leak in SRIOV
Jingwen Chen <Jingwen.Chen2@amd.com>
drm/amd/amdgpu: fix psp tmr bo pin count leak in SRIOV
H. Nikolaus Schaller <hns@goldelico.com>
mmc: omap_hsmmc: Revert special init for wl1251
Ulf Hansson <ulf.hansson@linaro.org>
mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO
Biju Das <biju.das.jz@bp.renesas.com>
mmc: tmio: reinit card irqs in reset routine
Zhou Qingyang <zhou1615@umn.edu>
media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach()
Mikhail Rudenko <mike.rudenko@gmail.com>
media: rockchip: rkisp1: use device name for debugfs subdir name
Sean Young <sean@mess.org>
media: igorplugusb: receiver overflow should be reported
Alistair Francis <alistair@alistair23.me>
HID: i2c-hid-of: Expose the touchscreen-inverted properties
Alistair Francis <alistair@alistair23.me>
HID: quirks: Allow inverting the absolute X/Y values
Isabella Basso <isabbasso@riseup.net>
drm/amdgpu: fix amdgpu_ras_mca_query_error_status scope
Felix Kuehling <Felix.Kuehling@amd.com>
drm/amdkfd: Fix error handling in svm_range_add
Paolo Abeni <pabeni@redhat.com>
bpf: Do not WARN in bpf_warn_invalid_xdp_action()
David Gow <davidgow@google.com>
kunit: Don't crash if no parameters are generated
Suresh Kumar <surkumar@redhat.com>
net: bonding: debug: avoid printing debug logs when bond is not notifying peers
Borislav Petkov <bp@suse.de>
x86/mce: Mark mce_read_aux() noinstr
Borislav Petkov <bp@suse.de>
x86/mce: Mark mce_end() noinstr
Borislav Petkov <bp@suse.de>
x86/mce: Mark mce_panic() noinstr
Borislav Petkov <bp@suse.de>
x86/mce: Prevent severity computation from being instrumented
Borislav Petkov <bp@suse.de>
x86/mce: Allow instrumentation during task work queueing
Alex Elder <elder@linaro.org>
ARM: dts: qcom: sdx55: fix IPA interconnect definitions
Baochen Qiang <quic_bqiang@quicinc.com>
ath11k: Avoid false DEADLOCK warning reported by lockdep
Jagan Teki <jagan@amarulasolutions.com>
arm64: dts: rockchip: Fix Bluetooth on ROCK Pi 4 boards
Heiko Carstens <hca@linux.ibm.com>
selftests/ftrace: make kprobe profile testcase description unique
Iwona Winiarska <iwona.winiarska@intel.com>
gpio: aspeed-sgpio: Convert aspeed_sgpio.lock to raw_spinlock
Iwona Winiarska <iwona.winiarska@intel.com>
gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock
Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
net: phy: prefer 1000baseT over 1000baseKX
Wen Gong <quic_wgong@quicinc.com>
ath10k: drop beacon and probe response which leak from other channel
Antoine Tenart <atenart@kernel.org>
net-sysfs: update the queue counts in the unregistration path
Ping-Ke Shih <pkshih@realtek.com>
rtw89: don't kick off TX DMA if failed to write skb
Sebastian Gottschall <s.gottschall@dd-wrt.com>
ath10k: Fix tx hanging
Wen Gong <quic_wgong@quicinc.com>
ath11k: avoid deadlock by change ieee80211_queue_work for regd_update_work
Wander Lairson Costa <wander@redhat.com>
rcutorture: Avoid soft lockup during cpu stall
Miri Korenblit <miriam.rachel.korenblit@intel.com>
iwlwifi: acpi: fix wgds rev 3 size
Shaul Triebitz <shaul.triebitz@intel.com>
iwlwifi: mvm: avoid clearing a just saved session protection id
Johannes Berg <johannes.berg@intel.com>
iwlwifi: mvm: synchronize with FW after multicast commands
Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
arm64: dts: renesas: Fix thermal bindings
Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Runtime PM activate both ends of the device link
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: m920x: don't use stack on USB reads
Tsuchiya Yuto <kitakar@gmail.com>
media: atomisp: fix "variable dereferenced before check 'asd'"
Zhou Qingyang <zhou1615@umn.edu>
media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach()
Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
media: rcar-vin: Update format alignment constraints
James Hilliard <james.hilliard1@gmail.com>
media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds.
Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
drm: rcar-du: Fix CRTC timings when CMM is used
Joerg Roedel <jroedel@suse.de>
x86/mm: Flush global TLB when switching to trampoline page-table
Xiongwei Song <sxwjean@gmail.com>
floppy: Add max size check for user space request
Neal Liu <neal_liu@aspeedtech.com>
usb: uhci: add aspeed ast2600 uhci support
Kishon Vijay Abraham I <kishon@ti.com>
arm64: dts: ti: j721e-main: Fix 'dtbs_check' in serdes_ln_ctrl node
Kishon Vijay Abraham I <kishon@ti.com>
arm64: dts: ti: j7200-main: Fix 'dtbs_check' serdes_ln_ctrl node
Vlad Zahorodnii <vlad.zahorodnii@kde.org>
drm/amd/display: Use oriented source size when checking cursor scaling
Thomas Zimmermann <tzimmermann@suse.de>
drm: Return error codes from struct drm_driver.gem_create_object
Hans de Goede <hdegoede@redhat.com>
ACPI / x86: Add not-present quirk for the PCI0.SDHB.BRC1 device on the GPD win
Hans de Goede <hdegoede@redhat.com>
ACPI / x86: Allow specifying acpi_device_override_status() quirks by path
Hans de Goede <hdegoede@redhat.com>
ACPI: Change acpi_device_always_present() into acpi_device_override_status()
Hans de Goede <hdegoede@redhat.com>
ACPI / x86: Drop PWM2 device on Lenovo Yoga Book from always present table
Zack Rusin <zackr@vmware.com>
drm/vmwgfx: Introduce a new placement for MOB page tables
Zack Rusin <zackr@vmware.com>
drm/vmwgfx: Release ttm memory if probe fails
Adam Ward <Adam.Ward.opensource@diasemi.com>
regulator: da9121: Prevent current limit change when enabled
Mansur Alisha Shaik <mansur@codeaurora.org>
media: venus: avoid calling core_clk_setrate() concurrently during concurrent video sessions
Sriram R <quic_srirrama@quicinc.com>
ath11k: Avoid NULL ptr access during mgmt tx cleanup
Zekun Shen <bruceshenzk@gmail.com>
rsi: Fix out-of-bounds read in rsi_read_pkt()
Zekun Shen <bruceshenzk@gmail.com>
rsi: Fix use-after-free in rsi_rx_done_handler()
Zekun Shen <bruceshenzk@gmail.com>
mwifiex: Fix skb_over_panic in mwifiex_usb_recv()
Ping-Ke Shih <pkshih@realtek.com>
rtw89: fix potentially access out of range of RF register array
Stephan Müller <smueller@chronox.de>
crypto: jitter - consider 32 LSB for APT
Chengfeng Ye <cyeaa@connect.ust.hk>
HSI: core: Fix return freed object in hsi_new_client
Hans de Goede <hdegoede@redhat.com>
gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use
Fugang Duan <fugang.duan@nxp.com>
tty: serial: imx: disable UCR4_OREN in .stop_rx() instead of .shutdown()
Emil Renner Berthing <kernel@esmil.dk>
serial: 8250_dw: Add StarFive JH7100 quirk
Jiri Slaby <jirislaby@kernel.org>
mxser: increase buf_overrun if tty_insert_flip_char() fails
Jiri Slaby <jirislaby@kernel.org>
mxser: don't throttle manually
Jiri Slaby <jirislaby@kernel.org>
mxser: keep only !tty test in ISR
Martyn Welch <martyn.welch@collabora.com>
drm/bridge: megachips: Ensure both bridges are probed before registration
Martin Leung <Martin.Leung@amd.com>
drm/amd/display: add else to avoid double destroy clk_mgr
Danielle Ratson <danieller@nvidia.com>
mlxsw: pci: Add shutdown method in PCI driver
Jan Kiszka <jan.kiszka@siemens.com>
soc: ti: pruss: fix referenced node in error message
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu/display: set vblank_disable_immediate for DC
Yang Li <yang.lee@linux.alibaba.com>
drm/amd/display: check top_pipe_to_program pointer
Anilkumar Kolli <akolli@codeaurora.org>
ath11k: Fix mon status ring rx tlv processing
Lukas Bulwahn <lukas.bulwahn@gmail.com>
ARM: imx: rename DEBUG_IMX21_IMX27_UART to DEBUG_IMX27_UART
Marek Vasut <marex@denx.de>
soc: imx: gpcv2: Synchronously suspend MIX domains
Konrad Dybcio <konrad.dybcio@somainline.org>
arm64: dts: qcom: sm8350: Shorten camera-thermal-bottom name
Konrad Dybcio <konrad.dybcio@somainline.org>
arm64: dts: qcom: sm[68]350: Use interrupts-extended with pdc interrupts
Dinh Nguyen <dinguyen@kernel.org>
EDAC/synopsys: Use the quirk for version instead of ddr version
Yang Li <yang.lee@linux.alibaba.com>
ethernet: renesas: Use div64_ul instead of do_div
Andrii Nakryiko <andrii@kernel.org>
libbpf: Accommodate DWARF/compiler bug with duplicated structs
Zheyu Ma <zheyuma97@gmail.com>
media: b2c2: Add missing check in flexcop_pci_isr:
José Expósito <jose.exposito89@gmail.com>
HID: apple: Do not reset quirks when the Fn key is not found
José Expósito <jose.exposito89@gmail.com>
HID: magicmouse: Report battery level over USB
Hans de Goede <hdegoede@redhat.com>
drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L
Brian Chen <brianchen118@gmail.com>
psi: Fix PSI_MEM_FULL state when tasks are in memstall and doing reclaim
Pavankumar Kondeti <quic_pkondeti@quicinc.com>
usb: gadget: f_fs: Use stream_open() for endpoint files
Haimin Zhang <tcs.kernel@gmail.com>
USB: ehci_brcm_hub_control: Improve port index sanitizing
Amjad Ouled-Ameur <aouledameur@baylibre.com>
usb: dwc3: meson-g12a: fix shared reset control use
Baochen Qiang <bqiang@codeaurora.org>
ath11k: Fix crash caused by uninitialized TX ring
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: atomisp: handle errors at sh_css_create_isp_params()
Tiezhu Yang <yangtiezhu@loongson.cn>
bpf: Change value of MAX_TAIL_CALL_CNT from 32 to 33
Linus Lüssing <linus.luessing@c0d3.blue>
batman-adv: allow netlink usage in unprivileged containers
Wen Gong <wgong@codeaurora.org>
ath11k: enable IEEE80211_VHT_EXT_NSS_BW_CAPABLE if NSS ratio enabled
Wan Jiabing <wanjiabing@vivo.com>
ARM: shmobile: rcar-gen2: Add missing of_node_put()
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: atomisp: check before deference asd variable
Hans de Goede <hdegoede@redhat.com>
media: atomisp-ov2680: Fix ov2680_set_fmt() clobbering the exposure
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: atomisp: set per-device's default mode
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: atomisp: fix try_fmt logic
Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR
Neil Armstrong <narmstrong@baylibre.com>
drm/bridge: dw-hdmi: handle ELD when DRM_BRIDGE_ATTACH_NO_CONNECTOR
Zekun Shen <bruceshenzk@gmail.com>
ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply
Andrii Nakryiko <andrii@kernel.org>
selftests/bpf: Fix bpf_object leak in skb_ctx selftest
Andrii Nakryiko <andrii@kernel.org>
selftests/bpf: Destroy XDP link correctly
Andrii Nakryiko <andrii@kernel.org>
selftests/bpf: Fix memory leaks in btf_type_c_dump() helper
Qiang Yu <yuq825@gmail.com>
drm/lima: fix warning when CONFIG_DEBUG_SG=y & CONFIG_DMA_API_DEBUG=y
Andrii Nakryiko <andrii@kernel.org>
libbpf: Validate that .BTF and .BTF.ext sections contain data
Andrii Nakryiko <andrii@kernel.org>
libbpf: Improve sanity checking during BTF fix up
Andrii Nakryiko <andrii@kernel.org>
libbpf: Detect corrupted ELF symbols section
Alexander Aring <aahringo@redhat.com>
fs: dlm: filter user dlm messages for kernel locks
Andrey Grodzovsky <andrey.grodzovsky@amd.com>
drm/sched: Avoid lockdep spalt on killing a processes
Archie Pusaka <apusaka@chromium.org>
Bluetooth: Fix removing adv when processing cmd complete
Brian Norris <briannorris@chromium.org>
drm/panel: Delete panel on mipi_dsi_attach() failure
Wei Yongjun <weiyongjun1@huawei.com>
Bluetooth: Fix memory leak of hci device
Wei Yongjun <weiyongjun1@huawei.com>
Bluetooth: Fix debugfs entry leak in hci_register_dev()
Nguyen Dinh Phi <phind.uet@gmail.com>
Bluetooth: hci_sock: purge socket queues in the destruct() callback
Merlijn Wajer <merlijn@wizzup.org>
leds: lp55xx: initialise output direction from dts
Sicelo A. Mhlongo <absicsz@gmail.com>
ARM: dts: omap3-n900: Fix lp5523 for multi color
Sudeep Holla <sudeep.holla@arm.com>
mailbox: pcc: Handle all PCC subtypes correctly in pcc_mbox_irq
Sudeep Holla <sudeep.holla@arm.com>
mailbox: pcc: Avoid using the uninitialized variable 'dev'
Dan Carpenter <dan.carpenter@oracle.com>
mailbox: imx: Fix an IS_ERR() vs NULL bug
jason-jh.lin <jason-jh.lin@mediatek.com>
mailbox: fix gce_num of mt8192 driver data
Paul Cercueil <paul@crapouillou.net>
MIPS: compressed: Fix build with ZSTD compression
Stephen Boyd <swboyd@chromium.org>
of/fdt: Don't worry about non-memory region overlap for no-map
Baruch Siach <baruch@tkos.co.il>
of: base: Fix phandle argument length mismatch error message
Conor Dooley <conor.dooley@microchip.com>
clk: bm1880: remove kfrees on static allocations
Shengjiu Wang <shengjiu.wang@nxp.com>
ASoC: fsl_asrc: refine the check of available clock divider
Shengjiu Wang <shengjiu.wang@nxp.com>
ASoC: imx-card: improve the sound quality for low rate
Shengjiu Wang <shengjiu.wang@nxp.com>
ASoC: imx-card: Fix mclk calculation issue for akcodec
Shengjiu Wang <shengjiu.wang@nxp.com>
ASoC: imx-card: Need special setting for ak4497 on i.MX8MQ
Taniya Das <tdas@codeaurora.org>
clk: qcom: gcc-sc7280: Mark gcc_cfg_noc_lpass_clk always enabled
Kamal Heib <kamalheib1@gmail.com>
RDMA/cxgb4: Set queue pair state when being queried
Huang Pei <huangpei@loongson.cn>
MIPS: fix local_{add,sub}_return on MIPS64
Nathan Chancellor <nathan@kernel.org>
cxl/core: Remove cxld_const_init in cxl_decoder_alloc()
Christian A. Ehrhardt <lk@c--e.de>
ALSA: hda/cs8409: Fix Jack detection after resume
Christian A. Ehrhardt <lk@c--e.de>
ALSA: hda/cs8409: Increase delay during jack detection
Alyssa Ross <hi@alyssa.is>
ASoC: fsl_mqs: fix MODULE_ALIAS
Ammar Faizi <ammarfaizi2@gmail.com>
powerpc/xive: Add missing null check after calling kmalloc
Randy Dunlap <rdunlap@infradead.org>
mips: bcm63xx: add support for clk_set_parent()
Randy Dunlap <rdunlap@infradead.org>
mips: lantiq: add support for clk_set_parent()
Sameer Pujar <spujar@nvidia.com>
arm64: tegra: Remove non existent Tegra194 reset
Trevor Wu <trevor.wu@mediatek.com>
ASoC: mediatek: mt8195: correct pcmif BE dai control flow
Wei Yongjun <weiyongjun1@huawei.com>
misc: lattice-ecp3-config: Fix task hung when firmware load failed
Jiasheng Jiang <jiasheng@iscas.ac.cn>
ASoC: samsung: idma: Check of ioremap return value
Tom Rix <trix@redhat.com>
iio: chemical: sunrise_co2: set val parameter only on success
Swapnil Jakhade <sjakhade@cadence.com>
phy: cadence: Sierra: Fix to get correct parent for mux clocks
Michael Ellerman <mpe@ellerman.id.au>
powerpc/64s: Use EMIT_WARN_ENTRY for SRR debug warnings
Michael Ellerman <mpe@ellerman.id.au>
powerpc/64s: Mask NIP before checking against SRR0
Jiasheng Jiang <jiasheng@iscas.ac.cn>
ASoC: mediatek: Check for error clk pointer
Ryuta NAKANISHI <nakanishi.ryuta@socionext.com>
phy: uniphier-usb3ss: fix unintended writing zeros to PHY register
Alan Stern <stern@rowland.harvard.edu>
scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume()
Pingfan Liu <kernelfans@gmail.com>
efi: apply memblock cap after memblock_add()
Zhen Lei <thunder.leizhen@huawei.com>
of: fdt: Aggregate the processing of "linux,usable-memory-range"
William Breathitt Gray <vilhelm.gray@gmail.com>
counter: 104-quad-8: Fix persistent enabled events bug
Trevor Wu <trevor.wu@mediatek.com>
ASoC: mediatek: mt8195: correct default value
Xiongfeng Wang <wangxiongfeng2@huawei.com>
iommu/iova: Fix race between FQ timeout and teardown
Cezary Rojewski <cezary.rojewski@intel.com>
ASoC: Intel: catpt: Test dmaengine_submit() result before moving on
Maxim Levitsky <mlevitsk@redhat.com>
iommu/amd: Remove useless irq affinity notifier
Maxim Levitsky <mlevitsk@redhat.com>
iommu/amd: X2apic mode: mask/unmask interrupts on suspend/resume
Maxim Levitsky <mlevitsk@redhat.com>
iommu/amd: X2apic mode: setup the INTX registers on mask/unmask
Maxim Levitsky <mlevitsk@redhat.com>
iommu/amd: X2apic mode: re-enable after resume
Maxim Levitsky <mlevitsk@redhat.com>
iommu/amd: Restore GA log/tail pointer on host resume
Arnd Bergmann <arnd@arndb.de>
dmaengine: pxa/mmp: stop referencing config->slave_id
Lukas Bulwahn <lukas.bulwahn@gmail.com>
mips: fix Kconfig reference to PHYS_ADDR_T_64BIT
Lukas Bulwahn <lukas.bulwahn@gmail.com>
mips: add SYS_HAS_CPU_MIPS64_R5 config for MIPS Release 5 support
Dillon Min <dillon.minfei@gmail.com>
clk: stm32: Fix ltdc's clock turn off by clk_disable_unused() after system enter shell
Frank Rowand <frank.rowand@sony.com>
of: unittest: 64 bit dma address test requires arch support
Jim Quinlan <jim2101024@gmail.com>
of: unittest: fix warning on PowerPC frame size warning
Jiasheng Jiang <jiasheng@iscas.ac.cn>
ASoC: rt5663: Handle device_property_read_u32_array error codes
Avihai Horon <avihaih@nvidia.com>
RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry
Avihai Horon <avihaih@nvidia.com>
RDMA/core: Let ib_find_gid() continue search even after empty entry
Rob Clark <robdclark@chromium.org>
iommu/arm-smmu-qcom: Fix TTBR0 read
Christophe Leroy <christophe.leroy@csgroup.eu>
powerpc/powermac: Add additional missing lockdep_register_key()
Thomas Gleixner <tglx@linutronix.de>
PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity()
Kamal Heib <kamalheib1@gmail.com>
RDMA/qedr: Fix reporting max_{send/recv}_wr attrs
Bart Van Assche <bvanassche@acm.org>
scsi: ufs: Fix race conditions related to driver data
Bart Van Assche <bvanassche@acm.org>
scsi: core: Fix scsi_device_max_queue_depth()
Kai Vehmanen <kai.vehmanen@linux.intel.com>
ASoC: SOF: Intel: fix build issue related to CODEC_PROBE_ENTRIES
Hector Martin <marcan@marcan.st>
iommu/io-pgtable-arm: Fix table descriptor paddr formatting
Lu Baolu <baolu.lu@linux.intel.com>
iommu: Extend mutex lock scope in iommu_probe_device()
Jiasheng Jiang <jiasheng@iscas.ac.cn>
uio: uio_dmem_genirq: Catch the Exception
Stafford Horne <shorne@gmail.com>
openrisc: Add clone3 ABI wrapper
Todd Kjos <tkjos@google.com>
binder: avoid potential data leakage when copying txn
Todd Kjos <tkjos@google.com>
binder: fix handling of error during copy
Kees Cook <keescook@chromium.org>
char/mwave: Adjust io port register size
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
misc: at25: Make driver OF independent again
Lucas Tanure <tanureal@opensource.cirrus.com>
ASoC: amd: Fix dependency for SPI master
Takashi Iwai <tiwai@suse.de>
ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID
Bixuan Cui <cuibixuan@linux.alibaba.com>
ALSA: oss: fix compile error when OSS_DEBUG is enabled
Waiman Long <longman@redhat.com>
clocksource: Avoid accidental unstable marking of clocksources
Christophe Leroy <christophe.leroy@csgroup.eu>
powerpc/32s: Fix shift-out-of-bounds in KASAN init
Christophe Leroy <christophe.leroy@csgroup.eu>
powerpc/modules: Don't WARN on first module allocation attempt
Athira Rajeev <atrajeev@linux.vnet.ibm.com>
powerpc/perf: Fix PMU callbacks to clear pending PMI before resetting an overflown PMC
Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
dt-bindings: thermal: Fix definition of cooling-maps contribution property
Thomas Gleixner <tglx@linutronix.de>
ALSA: hda: Make proper use of timecounter
Jack Wang <jinpu.wang@ionos.com>
RDMA/rtrs-clt: Fix the initial value of min_latency
Lukas Bulwahn <lukas.bulwahn@gmail.com>
ASoC: codecs: wcd938x: add SND_SOC_WCD938_SDW to codec list instead
Lukas Bulwahn <lukas.bulwahn@gmail.com>
ASoC: uniphier: drop selecting non-existing SND_SOC_UNIPHIER_AIO_DMA
Peiwei Hu <jlu.hpw@foxmail.com>
powerpc/prom_init: Fix improper check of prom_getprop()
Richard Fitzgerald <rf@opensource.cirrus.com>
ASoC: cs42l42: Report initial jack state
Adam Ford <aford173@gmail.com>
clk: imx8mn: Fix imx8mn_clko1_sels
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
clk: renesas: rzg2l: propagate return value of_genpd_add_provider_simple()
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
clk: renesas: rzg2l: Check return value of pm_genpd_init()
Igor Pylypiv <ipylypiv@google.com>
scsi: pm80xx: Update WARN_ON check in pm8001_mpi_build_cmd()
Kamal Heib <kamalheib1@gmail.com>
RDMA/hns: Validate the pkey index
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with pending cmd-bit"
Takashi Iwai <tiwai@suse.de>
ALSA: hda: Fix potential deadlock at codec unbinding
Takashi Iwai <tiwai@suse.de>
ALSA: hda: Add missing rwsem around snd_ctl_remove() calls
Takashi Iwai <tiwai@suse.de>
ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls
Takashi Iwai <tiwai@suse.de>
ALSA: jack: Add missing rwsem around snd_ctl_remove() calls
Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
ASoC: Intel: sof_sdw: fix jack detection on HP Spectre x360 convertible
Jan Kara <jack@suse.cz>
ext4: avoid trim error on fs with small groups
Taehee Yoo <ap420073@gmail.com>
amt: fix wrong return type of amt_send_membership_update()
Pavel Skripkin <paskripkin@gmail.com>
net: mcs7830: handle usb read errors properly
Edwin Peer <edwin.peer@broadcom.com>
bnxt_en: use firmware provided max timeout for messages
Nathan Chancellor <nathan@kernel.org>
iwlwifi: mvm: Use div_s64 instead of do_div in iwl_mvm_ftm_rtt_smoothing()
Paul Blakey <paulb@nvidia.com>
net: openvswitch: Fix ct_state nat flags for conns arriving from tc
Florian Westphal <fw@strlen.de>
netfilter: egress: avoid a lockdep splat
Dominik Brodowski <linux@dominikbrodowski.net>
pcmcia: fix setting of kthread task states
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
can: rcar_canfd: rcar_canfd_channel_probe(): make sure we free CAN network device
Jiasheng Jiang <jiasheng@iscas.ac.cn>
can: xilinx_can: xcan_probe(): check for error irq
Marc Kleine-Budde <mkl@pengutronix.de>
can: softing: softing_startstop(): fix set but not used variable warning
Christophe Jaillet <christophe.jaillet@wanadoo.fr>
tpm_tis: Fix an error handling path in 'tpm_tis_core_init()'
Chen Jun <chenjun102@huawei.com>
tpm: add request_locality before write TPM_INT_ENABLE
Marc Kleine-Budde <mkl@pengutronix.de>
can: mcp251xfd: add missing newline to printed strings
Sunil Goutham <sgoutham@marvell.com>
octeontx2-af: Fix interrupt name strings
Vladimir Oltean <vladimir.oltean@nxp.com>
net: mscc: ocelot: fix incorrect balancing with down LAG ports
Fabio Estevam <festevam@denx.de>
regmap: Call regmap_debugfs_exit() prior to _init()
Dan Carpenter <dan.carpenter@oracle.com>
netrom: fix api breakage in nr_setsockopt()
Dan Carpenter <dan.carpenter@oracle.com>
ax25: uninitialized variable in ax25_setsockopt()
Rakesh Babu Saladi <rsaladi2@marvell.com>
octeontx2-nicvf: Free VF PTP resources.
Subbaraya Sundeep <sbhatta@marvell.com>
octeontx2-af: Increment ptp refcount before use
Miaoqian Lin <linmq006@gmail.com>
spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe
Mat Martineau <mathew.j.martineau@linux.intel.com>
mptcp: Check reclaim amount before reducing allocation
Geliang Tang <geliang.tang@suse.com>
mptcp: fix a DSS option writing error
Matthieu Baerts <matthieu.baerts@tessares.net>
mptcp: fix opt size when sending DSS + MP_FAIL
Paolo Abeni <pabeni@redhat.com>
mptcp: fix per socket endpoint accounting
Dan Carpenter <dan.carpenter@oracle.com>
Bluetooth: hci_sock: fix endian bug in hci_sock_setsockopt()
Dan Carpenter <dan.carpenter@oracle.com>
Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt()
Zizhuang Deng <sunsetdzz@gmail.com>
lib/mpi: Add the return value check of kcalloc()
Moshe Shemesh <moshe@nvidia.com>
net/mlx5: Set command entry semaphore up once got index free
Maor Dickman <maord@nvidia.com>
net/mlx5e: Sync VXLAN udp ports during uplink representor profile change
Shay Drory <shayd@nvidia.com>
net/mlx5: Fix access to sf_dev_table on allocation failure
Paul Blakey <paulb@nvidia.com>
net/mlx5e: Fix matching on modified inner ip_ecn bits
Aya Levin <ayal@nvidia.com>
Revert "net/mlx5e: Block offload of outer header csum for GRE tunnel"
Aya Levin <ayal@nvidia.com>
Revert "net/mlx5e: Block offload of outer header csum for UDP tunnels"
Maor Dickman <maord@nvidia.com>
net/mlx5e: Don't block routes with nexthop objects in SW
Maor Dickman <maord@nvidia.com>
net/mlx5e: Fix wrong usage of fib_info_nh when routes with nexthop objects are used
Dima Chumak <dchumak@nvidia.com>
net/mlx5e: Fix nullptr on deleting mirroring rule
Aya Levin <ayal@nvidia.com>
net/mlx5e: Fix page DMA map/unmap attributes
Huang Rui <ray.huang@amd.com>
x86, sched: Fix undefined reference to init_freq_invariance_cppc() build error
Vinod Koul <vkoul@kernel.org>
spi: qcom: geni: handle timeout for gpi mode
Vinod Koul <vkoul@kernel.org>
spi: qcom: geni: set the error code for gpi transfer
Valentin Caron <valentin.caron@foss.st.com>
serial: stm32: move tx dma terminate DMA to shutdown
Alyssa Ross <hi@alyssa.is>
serial: liteuart: fix MODULE_ALIAS
Miaoqian Lin <linmq006@gmail.com>
drivers/firmware: Add missing platform_device_put() in sysfb_create_simplefb
Michal Suchanek <msuchanek@suse.de>
debugfs: lockdown: Allow reading debugfs files that are not world readable
José Expósito <jose.exposito89@gmail.com>
HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad
José Expósito <jose.exposito89@gmail.com>
HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init
José Expósito <jose.exposito89@gmail.com>
HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc
José Expósito <jose.exposito89@gmail.com>
HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init
Pavel Hofman <pavel.hofman@ivitera.com>
usb: gadget: u_audio: Subdevice 0 for capture ctls
John Keeping <john@metanate.com>
usb: gadget: u_audio: fix calculations for small bInterval
John Keeping <john@metanate.com>
usb: dwc2: gadget: initialize max_speed from params
Dinh Nguyen <dinguyen@kernel.org>
usb: dwc2: do not gate off the hardware if it does not support clock gating
Miaoqian Lin <linmq006@gmail.com>
usb: dwc3: qcom: Fix NULL vs IS_ERR checking in dwc3_qcom_probe
Wen Gu <guwen@linux.alibaba.com>
net/smc: Reset conn->lgr when link group registration fails
Miaoqian Lin <linmq006@gmail.com>
Bluetooth: hci_qca: Fix NULL vs IS_ERR_OR_NULL check in qca_serdev_probe
Jiasheng Jiang <jiasheng@iscas.ac.cn>
Bluetooth: hci_bcm: Check for error irq
Jiasheng Jiang <jiasheng@iscas.ac.cn>
fsl/fman: Check for null pointer after calling devm_ioremap
Jiasheng Jiang <jiasheng@iscas.ac.cn>
staging: greybus: audio: Check null pointer
Dan Carpenter <dan.carpenter@oracle.com>
rocker: fix a sleeping in atomic bug
Eric Dumazet <edumazet@google.com>
ppp: ensure minimum packet size in ppp_write()
Miroslav Lichvar <mlichvar@redhat.com>
net: fix SOF_TIMESTAMPING_BIND_PHC to work with multiple sockets
Florian Westphal <fw@strlen.de>
netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nft_payload: do not update layer 4 checksum when mangling fragments
Qiang Wang <wangqiang.wq.frank@bytedance.com>
libbpf: Use probe_name for legacy kprobe
Kuniyuki Iwashima <kuniyu@amazon.co.jp>
bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt().
Kris Van Hees <kris.van.hees@oracle.com>
bpf: Fix verifier support for validation of async callbacks
Daniel Borkmann <daniel@iogearbox.net>
bpf: Don't promote bogus looking registers after null check.
John Fastabend <john.fastabend@gmail.com>
bpf, sockmap: Fix double bpf_prog_put on error case in map_link
John Fastabend <john.fastabend@gmail.com>
bpf, sockmap: Fix return codes from tcp_bpf_recvmsg_parser()
Hou Tao <houtao1@huawei.com>
bpf, arm64: Use emit_addr_mov_i64() for BPF_PSEUDO_FUNC
Xin Xiong <xiongx18@fudan.edu.cn>
netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()
Vladimir Oltean <vladimir.oltean@nxp.com>
net: dsa: fix incorrect function pointer check for MRP ring roles
Daniel Golle <daniel@makrotopia.org>
net: ethernet: mtk_eth_soc: fix return values and refactor MDIO ops
Raed Salem <raeds@nvidia.com>
net/xfrm: IPsec tunnel mode fix inner_ipproto setting in sec_path
Jiasheng Jiang <jiasheng@iscas.ac.cn>
power: reset: mt6397: Check for null res pointer
Zhou Qingyang <zhou1615@umn.edu>
pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region()
Zhou Qingyang <zhou1615@umn.edu>
pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region()
Hans de Goede <hdegoede@redhat.com>
ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes
José Expósito <jose.exposito89@gmail.com>
drm/amd/display: fix dereference before NULL check
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
serial: 8250_bcm7271: Propagate error codes from brcmuart_probe()
Haimin Zhang <tcs_kernel@tencent.com>
bpf: Add missing map_get_next_key method to bloom filter map.
Pavel Begunkov <asml.silence@gmail.com>
io_uring: remove double poll on poll update
Zhang Zixun <zhang133010@icloud.com>
x86/mce/inject: Avoid out-of-bounds write when setting flags
Arseny Demidov <arsdemal@gmail.com>
hwmon: (mr75203) fix wrong power-up delay value
Marijn Suijten <marijn.suijten@somainline.org>
regulator: qcom-labibb: OCP interrupts are not a failure while disabled
Ming Lei <ming.lei@redhat.com>
block: null_blk: only set set->nr_maps as 3 if active poll_queues is > 0
Dan Carpenter <dan.carpenter@oracle.com>
crypto: octeontx2 - prevent underflow in get_cores_bmap()
Nathan Chancellor <nathan@kernel.org>
x86/boot/compressed: Move CLANG_FLAGS to beginning of KBUILD_CFLAGS
Panicker Harish <quic_pharish@quicinc.com>
Bluetooth: hci_qca: Stop IBS timer during BT OFF
Lorenzo Bianconi <lorenzo@kernel.org>
mt76: mt7921: fix a possible race enabling/disabling runtime-pm
Baochen Qiang <quic_bqiang@quicinc.com>
ath11k: Fix unexpected return buffer manager error for QCA6390
Clément Léger <clement.leger@bootlin.com>
software node: fix wrong node passed to find nargs_prop
Marijn Suijten <marijn.suijten@somainline.org>
backlight: qcom-wled: Respect enabled-strings in set_brightness
Marijn Suijten <marijn.suijten@somainline.org>
backlight: qcom-wled: Use cpu_to_le16 macro to perform conversion
Marijn Suijten <marijn.suijten@somainline.org>
backlight: qcom-wled: Override default length with qcom,enabled-strings
Marijn Suijten <marijn.suijten@somainline.org>
backlight: qcom-wled: Fix off-by-one maximum with default num_strings
Marijn Suijten <marijn.suijten@somainline.org>
backlight: qcom-wled: Pass number of elements to read to read_u32_array
Marijn Suijten <marijn.suijten@somainline.org>
backlight: qcom-wled: Validate enabled string indices in DT
Paul Chaignon <paul@isovalent.com>
bpftool: Enable line buffering for stdout
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: L2CAP: Fix using wrong mode
Johannes Berg <johannes.berg@intel.com>
um: virtio_uml: Fix time-travel external time propagation
Johannes Berg <johannes.berg@intel.com>
lib/logic_iomem: Fix operation on 32-bit
Johannes Berg <johannes.berg@intel.com>
lib/logic_iomem: Fix 32-bit build
Johannes Berg <johannes.berg@intel.com>
um: virt-pci: Fix 32-bit compile
Johannes Berg <johannes.berg@intel.com>
um: rename set_signals() to um_set_signals()
Johannes Berg <johannes.berg@intel.com>
um: fix ndelay/udelay defines
Bernard Zhao <bernard@vivo.com>
selinux: fix potential memleak in selinux_add_opt()
Christoph Hellwig <hch@lst.de>
block: fix error unwinding in device_add_disk
Sergey Shtylyov <s.shtylyov@omp.ru>
mmc: meson-mx-sdio: add IRQ check
Sergey Shtylyov <s.shtylyov@omp.ru>
mmc: meson-mx-sdhc: add IRQ check
Avraham Stern <avraham.stern@intel.com>
iwlwifi: mvm: set protected flag only for NDP ranging
Avraham Stern <avraham.stern@intel.com>
iwlwifi: mvm: perform 6GHz passive scan after suspend
Nathan Errera <nathan.errera@intel.com>
iwlwifi: mvm: test roc running status bits before removing the sta
Luca Coelho <luciano.coelho@intel.com>
iwlwifi: don't pass actual WGDS revision number in table_revision
Johannes Berg <johannes.berg@intel.com>
iwlwifi: mvm: fix 32-bit build in FTM
Kai-Heng Feng <kai.heng.feng@canonical.com>
rtw88: Disable PCIe ASPM while doing NAPI poll on 8821CE
Ping-Ke Shih <pkshih@realtek.com>
rtw88: add quirk to disable pci caps on HP 250 G7 Notebook PC
Dan Carpenter <dan.carpenter@oracle.com>
wilc1000: fix double free error in probe()
Sean Wang <sean.wang@mediatek.com>
mt76: mt7921s: fix suspend error with enlarging mcu timeout value
Lorenzo Bianconi <lorenzo@kernel.org>
mt76: connac: introduce MCU_UNI_CMD macro
Lorenzo Bianconi <lorenzo@kernel.org>
mt76: connac: remove MCU_FW_PREFIX bit
Lorenzo Bianconi <lorenzo@kernel.org>
mt76: connac: align MCU_EXT definitions with 7915 driver
Lorenzo Bianconi <lorenzo@kernel.org>
mt76: connac: introduce MCU_EXT macros
Sean Wang <sean.wang@mediatek.com>
mt76: mt7921: fix possible resume failure
Lorenzo Bianconi <lorenzo@kernel.org>
mt76: connac: fix last_chan configuration in mt76_connac_mcu_rate_txpower_band
Sean Wang <sean.wang@mediatek.com>
mt76: mt7921s: fix possible kernel crash due to invalid Rx count
Shayne Chen <shayne.chen@mediatek.com>
mt76: mt7921: use correct iftype data on 6GHz cap init
Sean Wang <sean.wang@mediatek.com>
mt76: mt7921s: fix the device cannot sleep deeply in suspend
Sean Wang <sean.wang@mediatek.com>
mt76: mt7921: move mt76_connac_mcu_set_hif_suspend to bus-related files
Lorenzo Bianconi <lorenzo@kernel.org>
mt76: mt7921: fix possible NULL pointer dereference in mt7921_mac_write_txwi
Lorenzo Bianconi <lorenzo@kernel.org>
mt76: fix possible OOB issue in mt76_calculate_default_rate
Lorenzo Bianconi <lorenzo@kernel.org>
mt76: debugfs: fix queue reporting for mt76-usb
Sean Wang <sean.wang@mediatek.com>
mt76: mt7921: fix MT7921E reset failure
Sean Wang <sean.wang@mediatek.com>
mt76: mt7921: drop offload_flags overwritten
Marek Behún <kabel@kernel.org>
ARM: dts: armada-38x: Add generic compatible to UART nodes
Robert Marko <robert.marko@sartura.hr>
arm64: dts: marvell: cn9130: enable CP0 GPIO controllers
Robert Marko <robert.marko@sartura.hr>
arm64: dts: marvell: cn9130: add GPIO and SPI aliases
Wei Yongjun <weiyongjun1@huawei.com>
usb: ftdi-elan: fix memory leak on device disconnect
Andre Przywara <andre.przywara@arm.com>
ARM: 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding
Antony Antony <antony.antony@secunet.com>
xfrm: state and policy should fail if XFRMA_IF_ID 0
Antony Antony <antony.antony@secunet.com>
xfrm: interface with if_id 0 should return error
Jernej Skrabec <jernej.skrabec@gmail.com>
media: hantro: Fix probe func error path
Robin Murphy <robin.murphy@arm.com>
drm/tegra: vic: Fix DMA API misuse
Thierry Reding <treding@nvidia.com>
drm/tegra: gr2d: Explicitly control module reset
Arnd Bergmann <arnd@arndb.de>
gpu: host1x: select CONFIG_DMA_SHARED_BUFFER
Stephen Boyd <swboyd@chromium.org>
drm/bridge: ti-sn65dsi86: Set max register for regmap
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
drm/msm/dpu: fix safe status debugfs file
Baruch Siach <baruch@tkos.co.il>
arm64: dts: qcom: ipq6018: Fix gpio-ranges property
Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
arm64: dts: qcom: c630: Fix soundcard setup
Kurt Kanzenbach <kurt@linutronix.de>
net: dsa: hellcreek: Add missing PTP via UDP rules
Kurt Kanzenbach <kurt@linutronix.de>
net: dsa: hellcreek: Allow PTP P2P measurements on blocked ports
Kurt Kanzenbach <kurt@linutronix.de>
net: dsa: hellcreek: Add STP forwarding rule
Kurt Kanzenbach <kurt@linutronix.de>
net: dsa: hellcreek: Fix insertion of static FDB entries
Zhou Qingyang <zhou1615@umn.edu>
ath11k: Fix a NULL pointer dereference in ath11k_mac_op_hw_scan()
Jiasheng Jiang <jiasheng@iscas.ac.cn>
media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes
Wang Hai <wanghai38@huawei.com>
media: msi001: fix possible null-ptr-deref in msi001_probe()
Anton Vasilyev <vasilyev@ispras.ru>
media: dw2102: Fix use after free
Robin Murphy <robin.murphy@arm.com>
perf/arm-cmn: Fix CPU hotplug unregistration
Christian Lamparter <chunkeey@gmail.com>
ARM: dts: gemini: NAS4220-B: fis-index-block with 128 KiB sectors
Daniel Latypov <dlatypov@google.com>
kunit: tool: fix --json output for skipped tests
Hector Martin <marcan@marcan.st>
spi: Fix incorrect cs_setup delay handling
Rameshkumar Sundaram <quic_ramess@quicinc.com>
ath11k: Fix deleting uninitialized kernel timer during fragment cache flush
Alexei Starovoitov <ast@kernel.org>
libbpf: Fix gen_loader assumption on number of programs.
Weili Qian <qianweili@huawei.com>
crypto: hisilicon/qm - fix incorrect return value of hisi_qm_resume()
Herbert Xu <herbert@gondor.apana.org.au>
crypto: stm32 - Revert broken pm_runtime_resume_and_get changes
Nicolas Toromanoff <nicolas.toromanoff@foss.st.com>
crypto: stm32/cryp - fix bugs and crash in tests
Nicolas Toromanoff <nicolas.toromanoff@foss.st.com>
crypto: stm32/cryp - fix lrw chaining mode
Nicolas Toromanoff <nicolas.toromanoff@foss.st.com>
crypto: stm32/cryp - fix double pm exit
Nicolas Toromanoff <nicolas.toromanoff@foss.st.com>
crypto: stm32/cryp - check early input data
Nicolas Toromanoff <nicolas.toromanoff@foss.st.com>
crypto: stm32/cryp - fix xts and race condition in crypto_engine requests
Nicolas Toromanoff <nicolas.toromanoff@foss.st.com>
crypto: stm32/cryp - fix CTR counter carry
Jakub Kicinski <kuba@kernel.org>
selftests: harness: avoid false negatives if test has no ASSERTs
Anders Roxell <anders.roxell@linaro.org>
selftests: clone3: clone3: add case CLONE3_ARGS_NO_TEST
Shuyi Cheng <chengshuyi@linux.alibaba.com>
libbpf: Add "bool skipped" to struct bpf_map
Kees Cook <keescook@chromium.org>
x86/uaccess: Move variable into switch case statement
Eric Dumazet <edumazet@google.com>
xfrm: fix a small bug in xfrm_sa_len()
Brian Norris <briannorris@chromium.org>
mwifiex: Fix possible ABBA deadlock
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
drm/msm/dsi: fix initialization in the bonded DSI case
Loic Poulain <loic.poulain@linaro.org>
wcn36xx: Fix max channels retrieval
Frederic Weisbecker <frederic@kernel.org>
rcu/exp: Mark current CPU as exp-QS in IPI loop second pass
Jackie Liu <liuyun01@kylinos.cn>
drm/msm/dp: displayPort driver need algorithm rational
Rob Clark <robdclark@chromium.org>
drm/msm/gpu: Don't allow zero fence_id
Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
drm/amd/display: Fix out of bounds access on DNC31 stream encoder regs
Wayne Lin <Wayne.Lin@amd.com>
drm/amd/display: Fix bug in debugfs crc_win_update entry
Mark Chen <mark-yw.chen@mediatek.com>
Bluetooth: btusb: Handle download_firmware failure cases
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: MGMT: Use hci_dev_test_and_{set,clear}_flag
Seevalamuthu Mariappan <quic_seevalam@quicinc.com>
ath11k: Fix QMI file type enum value
Fabio Estevam <festevam@denx.de>
ath10k: Fix the MTU size on QCA9377 SDIO
Tudor Ambarus <tudor.ambarus@microchip.com>
mtd: spi-nor: Fix mtd size for s3an flashes
Tudor Ambarus <tudor.ambarus@microchip.com>
mtd: spi-nor: Get rid of nor->page_size
Li Hua <hucool.lihua@huawei.com>
sched/rt: Try to restart rt period timer when rt runtime exceeded
Lv Yunlong <lyl2019@mail.ustc.edu.cn>
wireless: iwlwifi: Fix a double free in iwl_txq_dyn_alloc_dma
Robert Schlabbach <robert_s@gmx.net>
media: si2157: Fix "warm" tuner state detection
Zhou Qingyang <zhou1615@umn.edu>
media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach()
Zhou Qingyang <zhou1615@umn.edu>
media: dib8000: Fix a memleak in dib8000_init()
Ricardo Ribalda <ribalda@chromium.org>
media: uvcvideo: Avoid returning invalid controls
Ricardo Ribalda <ribalda@chromium.org>
media: uvcvideo: Avoid invalid memory access
Colin Ian King <colin.king@intel.com>
media: uvcvideo: Fix memory leak of object map on error exit path
Alexander Lobakin <alexandr.lobakin@intel.com>
samples: bpf: Fix 'unknown warning group' build warning on Clang
Alexander Lobakin <alexandr.lobakin@intel.com>
samples: bpf: Fix xdp_sample_user.o linking with Clang
Andrii Nakryiko <andrii@kernel.org>
samples/bpf: Clean up samples/bpf build failes
Hans de Goede <hdegoede@redhat.com>
platform/x86: wmi: Fix driver->notify() vs ->probe() race
Hans de Goede <hdegoede@redhat.com>
platform/x86: wmi: Replace read_takes_no_args with a flags field
Reiji Watanabe <reijiw@google.com>
arm64: mte: DC {GVA,GZVA} shouldn't be used when DCZID_EL0.DZP == 1
Reiji Watanabe <reijiw@google.com>
arm64: clear_page() shouldn't use DC ZVA when DCZID_EL0.DZP == 1
Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
drm: rcar-du: crtc: Support external DSI dot clock
Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
drm: rcar-du: Add DSI support to rcar_du_output_name
Kajol Jain <kjain@linux.ibm.com>
bpf: Remove config check to enable bpf support for branch records
Hou Tao <houtao1@huawei.com>
bpf: Disallow BPF_LOG_KERNEL log level for bpf(BPF_BTF_LOAD)
Alexei Starovoitov <ast@kernel.org>
bpf: Adjust BTF log size limit.
Vincent Donnefort <vincent.donnefort@arm.com>
sched/fair: Fix per-CPU kthread and wakee stacking for asym CPU capacity
Vincent Donnefort <vincent.donnefort@arm.com>
sched/fair: Fix detection of per-CPU kthreads waking a task
Maxim Mikityanskiy <maximmi@nvidia.com>
bpf: Fix the test_task_vma selftest to support output shorter than 1 kB
Sean Wang <sean.wang@mediatek.com>
Bluetooth: btmtksdio: fix resume failure
Yang Yingliang <yangyingliang@huawei.com>
staging: rtl8192e: rtllib_module: fix error handle case in alloc_rtllib()
Yang Yingliang <yangyingliang@huawei.com>
staging: rtl8192e: return error code from rtllib_softmac_init()
Tasos Sahanidis <tasos@tasossah.com>
floppy: Fix hang in watchdog when disk is ejected
Michael Walle <michael@walle.cc>
mtd: core: provide unique name for nvmem device
Lino Sanfilippo <LinoSanfilippo@gmx.de>
serial: amba-pl011: do not request memory region twice
Lizhi Hou <lizhi.hou@xilinx.com>
tty: serial: uartlite: allow 64 bit address
Nishanth Menon <nm@ti.com>
arm64: dts: ti: k3-j7200: Correct the d-cache-sets info
Nishanth Menon <nm@ti.com>
arm64: dts: ti: k3-j721e: Fix the L2 cache sets
Nishanth Menon <nm@ti.com>
arm64: dts: ti: k3-j7200: Fix the L2 cache sets
Nishanth Menon <nm@ti.com>
arm64: dts: ti: k3-am642: Fix the L2 cache sets
Gaurav Jain <gaurav.jain@nxp.com>
crypto: caam - save caam memory to support crypto engine retry mechanism.
Ming Lei <ming.lei@redhat.com>
null_blk: allow zero poll queues
Alexei Starovoitov <ast@kernel.org>
libbpf: Clean gen_loader's attach kind.
Zhou Qingyang <zhou1615@umn.edu>
drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms()
Zhou Qingyang <zhou1615@umn.edu>
drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode()
Paul Gerber <Paul.Gerber@tq-group.com>
thermal/drivers/imx8mm: Enable ADC when enabling monitor
Dan Carpenter <dan.carpenter@oracle.com>
pinctrl: mediatek: add a check for error in mtk_pinconf_bias_get_rsel()
Dan Carpenter <dan.carpenter@oracle.com>
pinctrl: mediatek: uninitialized variable in mtk_pctrl_show_one_pin()
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPI: EC: Rework flushing of EC work while suspended to idle
William Kucharski <william.kucharski@oracle.com>
cgroup: Trace event cgroup id fields should be u64
Zack Rusin <zackr@vmware.com>
drm/vmwgfx: Fail to initialize on broken configs
Zack Rusin <zackr@vmware.com>
drm/vmwgfx: Remove the deprecated lower mem limit
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
arm64: dts: qcom: msm8916: fix MMC controller aliases
Jun Miao <jun.miao@intel.com>
rcu: Avoid alloc_pages() when recording stack
Mark Rutland <mark.rutland@arm.com>
powerpc: Avoid discarding flags in system_call_exception()
Florian Westphal <fw@strlen.de>
netfilter: bridge: add support for pppoe filtering
Jesper Dangaard Brouer <brouer@redhat.com>
igc: AF_XDP zero-copy metadata adjust breaks SKBs on XDP_PASS
Oleksij Rempel <linux@rempel-privat.de>
thermal/drivers/imx: Implement runtime PM support
Yang Yingliang <yangyingliang@huawei.com>
net: lantiq: fix missing free_netdev() on error in ltq_etop_probe()
Bhupesh Sharma <bhupesh.sharma@linaro.org>
net: stmmac: Add platform level debug register dump feature
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
media: venus: core: Fix a resource leak in the error handling path of 'venus_probe()'
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
media: venus: core: Fix a potential NULL pointer dereference in an error handling path
Mansur Alisha Shaik <mansur@codeaurora.org>
media: venus: correct low power frequency calculation for encoder
Philipp Zabel <p.zabel@pengutronix.de>
media: coda: fix CODA960 JPEG encoder buffer overflow
Chen-Yu Tsai <wenst@chromium.org>
media: hantro: Hook up RK3399 JPEG encoder output
Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
media: mtk-vcodec: Fix an error handling path in 'mtk_vcodec_probe()'
Yang Yingliang <yangyingliang@huawei.com>
media: si470x-i2c: fix possible memory leak in si470x_i2c_probe()
Fabio Estevam <festevam@denx.de>
media: imx-pxp: Initialize the spinlock prior to using it
Suresh Udipi <sudipi@jp.adit-jv.com>
media: rcar-csi2: Correct the selection of hsfreqrange
Hans de Goede <hdegoede@redhat.com>
media: i2c: ov8865: Fix lockdep error
Daniel Scally <djrscally@gmail.com>
media: i2c: Re-order runtime pm initialisation
Eugen Hristev <eugen.hristev@microchip.com>
media: i2c: imx274: fix s_frame_interval runtime resume not requested
Alan Maguire <alan.maguire@oracle.com>
libbpf: Silence uninitialized warning/error in btf_dump_dump_type_data
Jan Kara <jack@suse.cz>
bfq: Do not let waker requests skip proper accounting
Claudiu Beznea <claudiu.beznea@microchip.com>
mfd: atmel-flexcom: Use .resume_noirq
Claudiu Beznea <claudiu.beznea@microchip.com>
mfd: atmel-flexcom: Remove #ifdef CONFIG_PM_SLEEP
Alvin Šipraga <alsi@bang-olufsen.dk>
net: dsa: rtl8365mb: set RGMII RX delay in steps of 0.3 ns
Joey Gouly <joey.gouly@arm.com>
pinctrl: apple: return an error if pinmux is missing in the DT
Tudor Ambarus <tudor.ambarus@microchip.com>
tty: serial: atmel: Call dma_async_issue_pending()
Tudor Ambarus <tudor.ambarus@microchip.com>
tty: serial: atmel: Check return code of dmaengine_submit()
Peng Fan <peng.fan@nxp.com>
arm64: dts: ti: k3-j721e: correct cache-sets info
Anilkumar Kolli <akolli@codeaurora.org>
ath11k: Use host CE parameters for CE interrupts configuration
Giovanni Cabiddu <giovanni.cabiddu@intel.com>
crypto: qat - fix undetected PFVF timeout in ACK loop
Andrii Nakryiko <andrii@kernel.org>
libbpf: Fix using invalidated memory in bpf_linker
Andrii Nakryiko <andrii@kernel.org>
libbpf: Fix glob_syms memory leak in bpf_linker
Andrii Nakryiko <andrii@kernel.org>
libbpf: Fix potential misaligned memory access in btf_ext__new()
Andrii Nakryiko <andrii@kernel.org>
tools/resolve_btf_ids: Close ELF file on error
Andrii Nakryiko <andrii@kernel.org>
libbpf: Load global data maps lazily on legacy kernels
Dillon Min <dillon.minfei@gmail.com>
ARM: dts: stm32: fix dtbs_check warning on ili9341 dts binding on stm32f429 disco
Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
cpufreq: qcom-hw: Fix probable nested interrupt handling
Adam Ford <aford173@gmail.com>
soc: imx: gpcv2: keep i.MX8MM VPU-H1 bus clock active
Lukasz Luba <lukasz.luba@arm.com>
cpufreq: qcom-cpufreq-hw: Update offline CPUs per-cpu thermal pressure
George G. Davis <davis.george@siemens.com>
mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove
Prasad Malisetty <pmaliset@codeaurora.org>
arm64: dts: qcom: sc7280: Fix 'interrupt-map' parent address cells
Prasad Malisetty <pmaliset@codeaurora.org>
arm64: dts: qcom: sc7280: Fix incorrect clock name
Chengfeng Ye <cyeaa@connect.ust.hk>
crypto: qce - fix uaf on qce_skcipher_register_one
Chengfeng Ye <cyeaa@connect.ust.hk>
crypto: qce - fix uaf on qce_ahash_register_one
Chengfeng Ye <cyeaa@connect.ust.hk>
crypto: qce - fix uaf on qce_aead_register_one
Wei Yongjun <weiyongjun1@huawei.com>
crypto: keembay-ocs-ecc - Fix error return code in kmb_ocs_ecc_probe()
Tudor Ambarus <tudor.ambarus@microchip.com>
crypto: atmel-aes - Reestablish the correct tfm context at dequeue
Wang Hai <wanghai38@huawei.com>
media: dmxdev: fix UAF when dvb_register_device() fails
Biju Das <biju.das.jz@bp.renesas.com>
arm64: dts: renesas: cat875: Add rx/tx delays
Seevalamuthu Mariappan <quic_seevalam@quicinc.com>
ath11k: add hw_param for wakeup_mhi
P Praneesh <ppranees@codeaurora.org>
ath11k: allocate dst ring descriptors from cacheable memory
Wen Gong <wgong@codeaurora.org>
ath11k: set correct NL80211_FEATURE_DYNAMIC_SMPS for WCN6855
Dan Carpenter <dan.carpenter@oracle.com>
drm/vboxvideo: fix a NULL vs IS_ERR() check
Jeremy Kerr <jk@codeconstruct.com.au>
mctp/test: Update refcount checking in route fragment tests
Tirthendu Sarkar <tirthendu.sarkar@intel.com>
selftests/bpf: Fix xdpxceiver failures for no hugepages
Lyude Paul <lyude@redhat.com>
drm/dp: Don't read back backlight mode in drm_edp_backlight_enable()
Alexander Aring <aahringo@redhat.com>
fs: dlm: fix build with CONFIG_IPV6 disabled
Sebastian Andrzej Siewior <bigeasy@linutronix.de>
kernel/locking: Use a pointer in ww_mutex_trylock().
Jens Wiklander <jens.wiklander@linaro.org>
tee: fix put order in teedev_close_context()
oujiefeng <oujiefeng@huawei.com>
spi: hisi-kunpeng: Fix the debugfs directory name incorrect
Karthikeyan Kathirvel <kathirve@codeaurora.org>
ath11k: reset RSN/WPA present state for open BSS
Karthikeyan Kathirvel <kathirve@codeaurora.org>
ath11k: clear the keys properly via DISABLE_KEY
Sven Eckelmann <sven@narfation.org>
ath11k: Fix ETSI regd with weather radar overlap
Jackie Liu <liuyun01@kylinos.cn>
Bluetooth: fix uninitialized variables notify_evt
Pavel Skripkin <paskripkin@gmail.com>
Bluetooth: stop proccessing malicious adv data
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails
Alexander Aring <aahringo@redhat.com>
fs: dlm: don't call kernel_getpeername() in error_report()
Christian Hewitt <christianshewitt@gmail.com>
arm64: dts: meson-gxbb-wetek: fix missing GPIO binding
Christian Hewitt <christianshewitt@gmail.com>
arm64: dts: meson-gxbb-wetek: fix HDMI in early boot
Alexander Stein <alexander.stein@mailbox.org>
arm64: dts: amlogic: Fix SPI NOR flash node name for ODROID N2/N2+
Alexander Stein <alexander.stein@mailbox.org>
arm64: dts: amlogic: meson-g12: Fix GPU operating point table node name
Jammy Huang <jammy_huang@aspeedtech.com>
media: aspeed: Update signal status immediately to ensure sane hw state
Dongliang Mu <mudongliangabcd@gmail.com>
media: em28xx: fix memory leak in em28xx_init_dev
Jammy Huang <jammy_huang@aspeedtech.com>
media: aspeed: fix mode-detect always time out at 2nd run
Dan Carpenter <dan.carpenter@oracle.com>
media: atomisp: fix uninitialized bug in gmin_get_pmic_id_and_addr()
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: atomisp: fix enum formats logic
Tsuchiya Yuto <kitakar@gmail.com>
media: atomisp: add NULL check for asd obtained from atomisp_video_pipe
Tsuchiya Yuto <kitakar@gmail.com>
media: atomisp: fix ifdefs in sh_css.c
Tsuchiya Yuto <kitakar@gmail.com>
media: atomisp: fix inverted error check for ia_css_mipi_is_source_port_valid()
Tsuchiya Yuto <kitakar@gmail.com>
media: atomisp: do not use err var when checking port validity for ISP2400
Tsuchiya Yuto <kitakar@gmail.com>
media: atomisp: fix inverted logic in buffers_needed()
Tsuchiya Yuto <kitakar@gmail.com>
media: atomisp: fix punit_ddr_dvfs_enable() argument for mrfld_power up case
Tsuchiya Yuto <kitakar@gmail.com>
media: atomisp: add missing media_device_cleanup() in atomisp_unregister_entities()
Dan Carpenter <dan.carpenter@oracle.com>
media: ipu3-cio2: fix error code in cio2_bridge_connect_sensor()
Dillon Min <dillon.minfei@gmail.com>
media: videobuf2: Fix the size printk format
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
mtd: hyperbus: rpc-if: Check return value of rpcif_sw_init()
Quentin Monnet <quentin@isovalent.com>
bpftool: Fix memory leak in prog_dump()
Rameshkumar Sundaram <ramess@codeaurora.org>
ath11k: Send PPDU_STATS_CFG with proper pdev mask to firmware
Benjamin Li <benl@squareup.com>
wcn36xx: fix RX BD rate mapping for 5GHz legacy rates
Benjamin Li <benl@squareup.com>
wcn36xx: populate band before determining rate on RX
Bryan O'Donoghue <bryan.odonoghue@linaro.org>
wcn36xx: Put DXE block into reset before freeing memory
Bryan O'Donoghue <bryan.odonoghue@linaro.org>
wcn36xx: Release DMA channel descriptor allocations
Bryan O'Donoghue <bryan.odonoghue@linaro.org>
wcn36xx: Fix DMA channel enable/disable cycle
Andrii Nakryiko <andrii@kernel.org>
libbpf: Free up resources used by inner map definition
Andrii Nakryiko <andrii@kernel.org>
libbpf: Fix non-C89 loop variable declaration in gen_loader.c
Maxime Ripard <maxime@cerno.tech>
drm/vc4: hdmi: Enable the scrambler on reconnection
Andrii Nakryiko <andrii@kernel.org>
libbpf: Fix section counting logic
Bryan O'Donoghue <bryan.odonoghue@linaro.org>
wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND
Benjamin Li <benl@squareup.com>
wcn36xx: ensure pairing of init_scan/finish_scan and start_scan/end_scan
Colin Ian King <colin.king@intel.com>
drm/virtio: fix another potential integer overflow on shift of a int
Colin Ian King <colin.king@intel.com>
drm/virtio: fix potential integer overflow on shift of a int
Maxime Ripard <maxime@cerno.tech>
drm/bridge: sn65dsi83: Fix bridge removal
Maxime Ripard <maxime@cerno.tech>
drm/vc4: crtc: Make sure the HDMI controller is powered when disabling
Maxime Ripard <maxime@cerno.tech>
drm/vc4: hdmi: Rework the pre_crtc_configure error handling
Maxime Ripard <maxime@cerno.tech>
drm/vc4: hdmi: Make sure the controller is powered up during bind
Maxime Ripard <maxime@cerno.tech>
drm/vc4: hdmi: Make sure the controller is powered in detect
Maxime Ripard <maxime@cerno.tech>
drm/vc4: hdmi: Move the HSM clock enable to runtime_pm
Maxime Ripard <maxime@cerno.tech>
drm/vc4: hdmi: Set a default HSM rate
Maxime Ripard <maxime@cerno.tech>
clk: bcm-2835: Remove rounding up the dividers
Maxime Ripard <maxime@cerno.tech>
clk: bcm-2835: Pick the closest clock rate
Wang Hai <wanghai38@huawei.com>
Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
Soenke Huster <soenke.huster@eknoes.de>
Bluetooth: virtio_bt: fix memory leak in virtbt_rx_handle()
Brian Norris <briannorris@chromium.org>
drm/rockchip: dsi: Disable PLL clock on bind error
Brian Norris <briannorris@chromium.org>
drm/rockchip: dsi: Fix unbalanced clock on probe error
Brian Norris <briannorris@chromium.org>
drm/panel: innolux-p079zca: Delete panel on attach() failure
Brian Norris <briannorris@chromium.org>
drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure
Wang Hai <wanghai38@huawei.com>
drm: fix null-ptr-deref in drm_dev_init_release()
Dan Carpenter <dan.carpenter@oracle.com>
drm/bridge: display-connector: fix an uninitialized pointer in probe()
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: L2CAP: Fix not initializing sk_peer_pid
Tedd Ho-Jeong An <tedd.an@intel.com>
Bluetooth: mgmt: Fix Experimental Feature Changed event
Tedd Ho-Jeong An <tedd.an@intel.com>
Bluetooth: hci_vhci: Fix to set the force_wakeup value
xinhui pan <xinhui.pan@amd.com>
drm/ttm: Put BO in its memory manager's lru list
Brian Norris <briannorris@chromium.org>
drm/rockchip: dsi: Reconfigure hardware on resume()
Brian Norris <briannorris@chromium.org>
drm/rockchip: dsi: Hold pm-runtime across bind/unbind
Gang Li <ligang.bdlg@bytedance.com>
shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode
Wen Gong <quic_wgong@quicinc.com>
ath11k: add string type to search board data in board-2.bin for WCN6855
Baoquan He <bhe@redhat.com>
mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed pages
Baoquan He <bhe@redhat.com>
dma/pool: create dma atomic pool only if dma zone has managed pages
Baoquan He <bhe@redhat.com>
mm_zone: add function to check if managed dma zone exists
Yifeng Li <tomli@tomli.me>
PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller
Thomas Hellström <thomas.hellstrom@linux.intel.com>
dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled()
Peng Hao <flyingpenghao@gmail.com>
virtio/virtio_mem: handle a possible NULL as a memcpy parameter
Hao Xu <haoxu@linux.alibaba.com>
io_uring: fix no lock protection for ctx->cq_extra
Dmitry Osipenko <digetx@gmail.com>
drm/tegra: Add back arm_iommu_detach_device()
Dmitry Osipenko <digetx@gmail.com>
gpu: host1x: Add back arm_iommu_detach_device()
Yunfei Wang <yf.wang@mediatek.com>
iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure
Hari Prasath <Hari.PrasathGE@microchip.com>
ARM: dts: at91: update alternate function of signal PD20
D Scott Phillips <scott@os.amperecomputing.com>
arm64: errata: Fix exec handling in erratum 1418040 workaround
Sumeet Pawnikar <sumeet.r.pawnikar@intel.com>
thermal/drivers/int340x: Fix RFIM mailbox write commands
Dan Williams <dan.j.williams@intel.com>
cxl/pmem: Fix module reload vs workqueue state
Dan Williams <dan.j.williams@intel.com>
cxl/pmem: Fix reference counting for delayed work
Manivannan Sadhasivam <mani@kernel.org>
bus: mhi: core: Fix race while handling SYS_ERR at power up
Bhaumik Bhatt <quic_bbhatt@quicinc.com>
bus: mhi: core: Fix reading wake_capable channel configuration
Loic Poulain <loic.poulain@linaro.org>
bus: mhi: pci_generic: Graceful shutdown on freeze
Christophe Leroy <christophe.leroy@csgroup.eu>
lkdtm: Fix content of section containing lkdtm_rodata_do_nothing()
Jonathan Cameron <Jonathan.Cameron@huawei.com>
iio: trigger: Fix a scheduling whilst atomic issue seen on tsc2046
Jonathan Cameron <Jonathan.Cameron@huawei.com>
iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs
Alexander Usyskin <alexander.usyskin@intel.com>
mei: hbm: fix client dma reply status
Johan Hovold <johan@kernel.org>
can: softing_cs: softingcs_probe(): fix memleak on registration failure
Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: cec-pin: fix interrupt en/disable handling
Johan Hovold <johan@kernel.org>
media: stk1160: fix control-message timeouts
Johan Hovold <johan@kernel.org>
media: pvrusb2: fix control-message timeouts
Johan Hovold <johan@kernel.org>
media: redrat3: fix control-message timeouts
Michael Kuron <michael.kuron@gmail.com>
media: dib0700: fix undefined behavior in tuner shutdown
Johan Hovold <johan@kernel.org>
media: s2255: fix control-message timeouts
Johan Hovold <johan@kernel.org>
media: cpia2: fix control-message timeouts
Johan Hovold <johan@kernel.org>
media: em28xx: fix control-message timeouts
Johan Hovold <johan@kernel.org>
media: mceusb: fix control-message timeouts
Johan Hovold <johan@kernel.org>
media: flexcop-usb: fix control-message timeouts
Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE
Sakari Ailus <sakari.ailus@linux.intel.com>
media: ov8865: Disable only enabled regulators on error path
Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: cec: fix a deadlock situation
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: add reserved room in ipc request/response
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: limits exceeding the maximum allowable outstanding requests
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: move credit charge deduction under processing request
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: add support for smb2 max credit parameter
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: fix guest connection failure with nautilus
Dan Carpenter <dan.carpenter@oracle.com>
ksmbd: uninitialized variable in create_socket()
Mohammad Athari Bin Ismail <mohammad.athari.ismail@intel.com>
net: phy: marvell: add Marvell specific PHY loopback
Mateusz Jończyk <mat.jonczyk@o2.pl>
rtc: cmos: take rtc_lock while reading from CMOS
Willy Tarreau <w@1wt.eu>
tools/nolibc: fix incorrect truncation of exit code
Willy Tarreau <w@1wt.eu>
tools/nolibc: i386: fix initial stack alignment
Jakub Kicinski <kuba@kernel.org>
crypto: x86/aesni - don't require alignment of data
Ammar Faizi <ammar.faizi@students.amikom.ac.id>
tools/nolibc: x86-64: Fix startup code bug
Lucas De Marchi <lucas.demarchi@intel.com>
x86/gpu: Reserve stolen memory for first integrated Intel GPU
Jisheng Zhang <jszhang@kernel.org>
riscv: mm: fix wrong phys_ram_base value for RV64
Nick Kossifidis <mick@ics.forth.gr>
riscv: use hart id instead of cpu id on machine_kexec
Nick Kossifidis <mick@ics.forth.gr>
riscv: Don't use va_pa_offset on kdump
Nick Kossifidis <mick@ics.forth.gr>
riscv: try to allocate crashkern region from 32bit addressible memory
Sean Christopherson <seanjc@google.com>
RISC-V: Use common riscv_cpuid_to_hartid_mask() for both SMP=y and SMP=n
Alexandre Ghiti <alexandre.ghiti@canonical.com>
riscv: Get rid of MAXPHYSMEM configs
Paul Cercueil <paul@crapouillou.net>
mtd: rawnand: ingenic: JZ4740 needs 'oob_first' read page function
Paul Cercueil <paul@crapouillou.net>
mtd: rawnand: Export nand_read_page_hwecc_oob_first()
Paul Cercueil <paul@crapouillou.net>
mtd: rawnand: davinci: Rewrite function description
Paul Cercueil <paul@crapouillou.net>
mtd: rawnand: davinci: Avoid duplicated page read
Paul Cercueil <paul@crapouillou.net>
mtd: rawnand: davinci: Don't calculate ECC when reading page
Andreas Oetken <ennoerlangen@gmail.com>
mtd: Fixed breaking list in __mtd_del_partition.
Stefan Riedmueller <s.riedmueller@phytec.de>
mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6
Christian Eggers <ceggers@arri.de>
mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings
Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()
Jaegeuk Kim <jaegeuk@kernel.org>
f2fs: avoid EINVAL by SBI_NEED_FSCK when pinning a file
Chao Yu <chao@kernel.org>
f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()
Chao Yu <chao@kernel.org>
f2fs: fix to do sanity check in is_alive()
Chao Yu <chao@kernel.org>
f2fs: fix to do sanity check on inode type during garbage collection
Shyam Prasad N <sprasad@microsoft.com>
cifs: free ntlmsspblob allocated in negotiate
Takashi Iwai <tiwai@suse.de>
ALSA: core: Fix SSID quirk lookup for subvendor=0
Jason Gerecke <killertofu@gmail.com>
HID: wacom: Avoid using stale array indicies to read contact count
Jason Gerecke <killertofu@gmail.com>
HID: wacom: Ignore the confidence flag when a touch is removed
Jason Gerecke <killertofu@gmail.com>
HID: wacom: Reset expected and received contact counts at the same time
Jann Horn <jannh@google.com>
HID: uhid: Fix worker destroying device without any protection
Karl Kurbjun <kkurbjun@gmail.com>
HID: Ignore battery for Elan touchscreen on HP Envy X360 15t-dr100
Marcelo Tosatti <mtosatti@redhat.com>
KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock
David Matlack <dmatlack@google.com>
KVM: x86/mmu: Fix write-protection of PTs mapped by the TDP MMU
-------------
Diffstat:
Documentation/admin-guide/cifs/usage.rst | 7 +-
Documentation/admin-guide/devices.txt | 8 +-
Documentation/admin-guide/hw-vuln/spectre.rst | 2 +-
.../bindings/display/amlogic,meson-dw-hdmi.yaml | 5 +
.../bindings/display/amlogic,meson-vpu.yaml | 6 +
.../devicetree/bindings/input/hid-over-i2c.txt | 2 +
.../devicetree/bindings/thermal/thermal-zones.yaml | 9 +-
.../devicetree/bindings/watchdog/samsung-wdt.yaml | 5 +-
Documentation/driver-api/dmaengine/dmatest.rst | 7 +-
Documentation/driver-api/firewire.rst | 4 +-
.../acpi/dsd/data-node-references.rst | 10 +-
Documentation/trace/coresight/coresight-config.rst | 16 +-
Makefile | 4 +-
arch/arm/Kconfig.debug | 14 +-
arch/arm/boot/compressed/efi-header.S | 22 +-
arch/arm/boot/compressed/head.S | 3 +-
arch/arm/boot/dts/armada-38x.dtsi | 4 +-
arch/arm/boot/dts/gemini-nas4220b.dts | 2 +-
arch/arm/boot/dts/omap3-n900.dts | 50 +-
arch/arm/boot/dts/qcom-sdx55.dtsi | 6 +-
arch/arm/boot/dts/sama7g5-pinfunc.h | 2 +-
arch/arm/boot/dts/stm32f429-disco.dts | 2 +-
arch/arm/configs/cm_x300_defconfig | 1 -
arch/arm/configs/ezx_defconfig | 1 -
arch/arm/configs/imote2_defconfig | 1 -
arch/arm/configs/nhk8815_defconfig | 1 -
arch/arm/configs/pxa_defconfig | 1 -
arch/arm/configs/spear13xx_defconfig | 1 -
arch/arm/configs/spear3xx_defconfig | 1 -
arch/arm/configs/spear6xx_defconfig | 1 -
arch/arm/include/debug/imx-uart.h | 18 +-
arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c | 5 +-
arch/arm/net/bpf_jit_32.c | 5 +-
arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 2 +-
.../boot/dts/amlogic/meson-g12b-odroid-n2.dtsi | 2 +-
arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi | 3 +
arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts | 14 +-
arch/arm64/boot/dts/marvell/cn9130.dtsi | 15 +
arch/arm64/boot/dts/nvidia/tegra186.dtsi | 2 +-
arch/arm64/boot/dts/nvidia/tegra194.dtsi | 5 +-
arch/arm64/boot/dts/qcom/ipq6018.dtsi | 2 +-
arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 +-
arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 -
arch/arm64/boot/dts/qcom/sc7280.dtsi | 10 +-
.../boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 27 +
arch/arm64/boot/dts/qcom/sm6350.dtsi | 4 +-
arch/arm64/boot/dts/qcom/sm8350.dtsi | 6 +-
arch/arm64/boot/dts/renesas/cat875.dtsi | 1 +
arch/arm64/boot/dts/renesas/r8a774a1.dtsi | 6 +-
arch/arm64/boot/dts/renesas/r8a774b1.dtsi | 6 +-
arch/arm64/boot/dts/renesas/r8a774e1.dtsi | 6 +-
arch/arm64/boot/dts/renesas/r8a77951.dtsi | 6 +-
arch/arm64/boot/dts/renesas/r8a77960.dtsi | 6 +-
arch/arm64/boot/dts/renesas/r8a77961.dtsi | 6 +-
arch/arm64/boot/dts/renesas/r8a77965.dtsi | 6 +-
arch/arm64/boot/dts/renesas/r8a77980.dtsi | 4 +-
arch/arm64/boot/dts/renesas/r8a779a0.dtsi | 10 +-
.../boot/dts/rockchip/rk3399-rock-pi-4b-plus.dts | 7 +-
arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4b.dts | 7 +-
arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4c.dts | 7 +-
arch/arm64/boot/dts/ti/k3-am642.dtsi | 2 +-
arch/arm64/boot/dts/ti/k3-j7200-main.dtsi | 2 +-
arch/arm64/boot/dts/ti/k3-j7200.dtsi | 6 +-
arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 2 +-
arch/arm64/boot/dts/ti/k3-j721e.dtsi | 6 +-
arch/arm64/include/asm/extable.h | 9 -
arch/arm64/include/asm/memory.h | 5 +-
arch/arm64/include/asm/mte-kasan.h | 8 +-
arch/arm64/kernel/module.c | 4 +-
arch/arm64/kernel/process.c | 39 +-
arch/arm64/kernel/traps.c | 2 +-
arch/arm64/lib/clear_page.S | 10 +
arch/arm64/lib/mte.S | 8 +-
arch/arm64/mm/ptdump.c | 2 -
arch/arm64/net/bpf_jit_comp.c | 17 +-
arch/mips/Kconfig | 6 +-
arch/mips/bcm63xx/clk.c | 6 +
arch/mips/boot/compressed/Makefile | 2 +-
arch/mips/boot/compressed/clz_ctz.c | 2 +
arch/mips/cavium-octeon/octeon-platform.c | 2 +
arch/mips/cavium-octeon/octeon-usb.c | 1 +
arch/mips/configs/fuloong2e_defconfig | 1 -
arch/mips/configs/malta_qemu_32r6_defconfig | 1 -
arch/mips/configs/maltaaprp_defconfig | 1 -
arch/mips/configs/maltasmvp_defconfig | 1 -
arch/mips/configs/maltasmvp_eva_defconfig | 1 -
arch/mips/configs/maltaup_defconfig | 1 -
arch/mips/include/asm/local.h | 9 +-
.../asm/mach-loongson64/kernel-entry-init.h | 4 +-
arch/mips/include/asm/octeon/cvmx-bootinfo.h | 4 +-
arch/mips/lantiq/clk.c | 6 +
arch/mips/net/bpf_jit_comp32.c | 3 +-
arch/mips/net/bpf_jit_comp64.c | 2 +-
arch/openrisc/include/asm/syscalls.h | 2 +
arch/openrisc/kernel/entry.S | 5 +
arch/parisc/include/asm/special_insns.h | 44 +-
arch/parisc/kernel/traps.c | 2 +-
arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi | 2 +
arch/powerpc/configs/ppc6xx_defconfig | 1 -
arch/powerpc/configs/pseries_defconfig | 1 -
arch/powerpc/include/asm/hw_irq.h | 40 +
arch/powerpc/kernel/btext.c | 4 +-
arch/powerpc/kernel/fadump.c | 8 +
arch/powerpc/kernel/head_40x.S | 9 +-
arch/powerpc/kernel/interrupt.c | 2 +-
arch/powerpc/kernel/interrupt_64.S | 10 +-
arch/powerpc/kernel/module.c | 11 +-
arch/powerpc/kernel/prom_init.c | 2 +-
arch/powerpc/kernel/smp.c | 42 +
arch/powerpc/kernel/watchdog.c | 41 +-
arch/powerpc/kvm/book3s_hv.c | 8 +-
arch/powerpc/kvm/book3s_hv_nested.c | 2 +-
arch/powerpc/mm/book3s64/radix_pgtable.c | 4 +-
arch/powerpc/mm/kasan/book3s_32.c | 3 +-
arch/powerpc/mm/pgtable_64.c | 14 +-
arch/powerpc/net/bpf_jit_comp32.c | 4 +-
arch/powerpc/net/bpf_jit_comp64.c | 4 +-
arch/powerpc/perf/core-book3s.c | 58 +-
arch/powerpc/platforms/cell/iommu.c | 1 +
arch/powerpc/platforms/cell/pervasive.c | 1 +
arch/powerpc/platforms/embedded6xx/hlwd-pic.c | 1 +
arch/powerpc/platforms/powermac/low_i2c.c | 3 +
arch/powerpc/platforms/powernv/opal-lpc.c | 1 +
arch/powerpc/sysdev/xive/spapr.c | 3 +
arch/riscv/Kconfig | 23 +-
arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi | 3 -
arch/riscv/configs/defconfig | 1 +
arch/riscv/configs/nommu_k210_defconfig | 2 -
arch/riscv/configs/nommu_k210_sdcard_defconfig | 2 -
arch/riscv/configs/nommu_virt_defconfig | 1 -
arch/riscv/configs/rv32_defconfig | 1 +
arch/riscv/include/asm/smp.h | 10 +-
arch/riscv/kernel/kexec_relocate.S | 20 +-
arch/riscv/kernel/machine_kexec.c | 3 +-
arch/riscv/kernel/setup.c | 10 +
arch/riscv/kernel/smp.c | 10 -
arch/riscv/kvm/main.c | 8 +
arch/riscv/mm/init.c | 19 +-
arch/riscv/net/bpf_jit_comp32.c | 6 +-
arch/riscv/net/bpf_jit_comp64.c | 7 +-
arch/s390/kernel/module.c | 5 +-
arch/s390/kvm/kvm-s390.c | 2 +-
arch/s390/mm/pgalloc.c | 4 +-
arch/s390/net/bpf_jit_comp.c | 6 +-
arch/sh/configs/titan_defconfig | 1 -
arch/sparc/net/bpf_jit_comp_64.c | 2 +-
arch/um/.gitignore | 1 +
arch/um/drivers/virt-pci.c | 8 +-
arch/um/drivers/virtio_uml.c | 4 +
arch/um/include/asm/delay.h | 4 +-
arch/um/include/asm/irqflags.h | 4 +-
arch/um/include/shared/longjmp.h | 2 +-
arch/um/include/shared/os.h | 4 +-
arch/um/include/shared/registers.h | 4 +-
arch/um/kernel/ksyms.c | 2 +-
arch/um/os-Linux/registers.c | 4 +-
arch/um/os-Linux/sigio.c | 6 +-
arch/um/os-Linux/signal.c | 8 +-
arch/um/os-Linux/start_up.c | 2 +-
arch/x86/boot/compressed/Makefile | 7 +-
arch/x86/configs/i386_defconfig | 1 +
arch/x86/configs/x86_64_defconfig | 1 +
arch/x86/crypto/aesni-intel_glue.c | 4 +-
arch/x86/hyperv/mmu.c | 19 +-
arch/x86/include/asm/realmode.h | 1 +
arch/x86/include/asm/topology.h | 2 +-
arch/x86/include/asm/uaccess.h | 5 +-
arch/x86/kernel/cpu/mce/core.c | 42 +-
arch/x86/kernel/cpu/mce/inject.c | 2 +-
arch/x86/kernel/cpu/mce/severity.c | 33 +-
arch/x86/kernel/early-quirks.c | 10 +-
arch/x86/kernel/module.c | 7 +-
arch/x86/kernel/reboot.c | 12 +-
arch/x86/kvm/cpuid.c | 90 +-
arch/x86/kvm/mmu/tdp_mmu.c | 6 +-
arch/x86/kvm/vmx/posted_intr.c | 25 +-
arch/x86/kvm/x86.c | 30 +-
arch/x86/net/bpf_jit_comp.c | 10 +-
arch/x86/net/bpf_jit_comp32.c | 4 +-
arch/x86/realmode/init.c | 26 +
arch/x86/um/syscalls_64.c | 3 +-
block/bfq-iosched.c | 44 +-
block/blk-flush.c | 4 +-
block/blk-mq-tag.c | 40 +-
block/blk-pm.c | 22 +-
block/genhd.c | 15 +-
block/mq-deadline.c | 4 +-
crypto/jitterentropy.c | 3 +-
drivers/acpi/acpica/exfield.c | 7 +-
drivers/acpi/acpica/exoparg1.c | 3 +-
drivers/acpi/acpica/hwesleep.c | 4 +-
drivers/acpi/acpica/hwsleep.c | 4 +-
drivers/acpi/acpica/hwxfsleep.c | 2 -
drivers/acpi/acpica/utdelete.c | 1 +
drivers/acpi/battery.c | 22 +
drivers/acpi/bus.c | 4 +-
drivers/acpi/cppc_acpi.c | 2 +-
drivers/acpi/ec.c | 57 +-
drivers/acpi/internal.h | 2 +
drivers/acpi/scan.c | 13 +-
drivers/acpi/x86/utils.c | 116 ++-
drivers/android/binder.c | 98 ++-
drivers/base/core.c | 3 +-
drivers/base/power/runtime.c | 41 +-
drivers/base/property.c | 4 +-
drivers/base/regmap/regmap.c | 1 +
drivers/base/swnode.c | 2 +-
drivers/block/floppy.c | 6 +-
drivers/block/null_blk/main.c | 8 +-
drivers/bluetooth/btintel.c | 26 +-
drivers/bluetooth/btmtksdio.c | 2 +
drivers/bluetooth/btusb.c | 5 +
drivers/bluetooth/hci_bcm.c | 7 +-
drivers/bluetooth/hci_qca.c | 9 +-
drivers/bluetooth/hci_vhci.c | 4 +
drivers/bluetooth/virtio_bt.c | 3 +
drivers/bus/mhi/core/init.c | 1 +
drivers/bus/mhi/core/pm.c | 35 +-
drivers/bus/mhi/pci_generic.c | 2 +-
drivers/char/mwave/3780i.h | 2 +-
drivers/char/random.c | 19 +-
drivers/char/tpm/tpm-chip.c | 18 +-
drivers/char/tpm/tpm_tis_core.c | 14 +-
drivers/clk/bcm/clk-bcm2835.c | 13 +-
drivers/clk/clk-bm1880.c | 20 +-
drivers/clk/clk-si5341.c | 2 +-
drivers/clk/clk-stm32f4.c | 4 -
drivers/clk/clk.c | 18 +
drivers/clk/imx/clk-imx8mn.c | 6 +-
drivers/clk/meson/gxbb.c | 44 +-
drivers/clk/qcom/gcc-sc7280.c | 2 +-
drivers/clk/renesas/rzg2l-cpg.c | 17 +-
drivers/clk/samsung/clk-exynos850.c | 70 +-
drivers/counter/104-quad-8.c | 82 +-
drivers/cpufreq/cpufreq.c | 4 +-
drivers/cpufreq/intel_pstate.c | 24 +-
drivers/cpufreq/qcom-cpufreq-hw.c | 7 +-
drivers/crypto/atmel-aes.c | 6 +-
drivers/crypto/caam/caamalg.c | 6 +
drivers/crypto/caam/caamalg_qi2.c | 2 +-
drivers/crypto/caam/caamhash.c | 3 +
drivers/crypto/caam/caampkc.c | 3 +
drivers/crypto/ccp/sev-dev.c | 30 +-
drivers/crypto/hisilicon/hpre/hpre_crypto.c | 2 +-
drivers/crypto/hisilicon/qm.c | 5 +-
drivers/crypto/keembay/keembay-ocs-ecc.c | 1 +
drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c | 9 +-
.../crypto/marvell/octeontx2/otx2_cptpf_ucode.c | 3 +-
drivers/crypto/omap-aes.c | 2 +-
drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 12 +-
drivers/crypto/qce/aead.c | 2 +-
drivers/crypto/qce/sha.c | 2 +-
drivers/crypto/qce/skcipher.c | 2 +-
drivers/crypto/stm32/stm32-crc32.c | 4 +-
drivers/crypto/stm32/stm32-cryp.c | 938 ++++++++-------------
drivers/crypto/stm32/stm32-hash.c | 6 +-
drivers/cxl/core/bus.c | 6 +-
drivers/cxl/core/pmem.c | 8 +-
drivers/cxl/cxl.h | 10 +-
drivers/cxl/pmem.c | 46 +-
drivers/dax/super.c | 6 +-
drivers/dma-buf/dma-fence-array.c | 6 +-
drivers/dma-buf/heaps/cma_heap.c | 6 +-
drivers/dma/at_xdmac.c | 57 +-
drivers/dma/idxd/device.c | 12 +-
drivers/dma/mmp_pdma.c | 6 -
drivers/dma/pxa_dma.c | 7 -
drivers/dma/stm32-mdma.c | 2 +-
drivers/dma/uniphier-xdmac.c | 5 +-
drivers/edac/synopsys_edac.c | 3 +-
drivers/firmware/efi/efi-init.c | 5 +
drivers/firmware/google/Kconfig | 6 +-
drivers/firmware/sysfb_simplefb.c | 8 +-
drivers/gpio/gpio-aspeed-sgpio.c | 32 +-
drivers/gpio/gpio-aspeed.c | 52 +-
drivers/gpio/gpio-idt3243x.c | 4 +-
drivers/gpio/gpio-mpc8xxx.c | 4 +-
drivers/gpio/gpiolib-acpi.c | 15 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 6 +
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 1 -
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 4 +
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 6 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c | 5 +-
drivers/gpu/drm/amd/amdgpu/cik.c | 4 +
drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c | 4 +
drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 13 +-
drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 18 +-
drivers/gpu/drm/amd/amdgpu/vi.c | 4 +
drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 3 +
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 138 ++-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 46 +-
.../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 +-
drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c | 3 +-
.../amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c | 11 +-
.../drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 11 +-
drivers/gpu/drm/amd/display/dc/core/dc.c | 3 +-
drivers/gpu/drm/amd/display/dc/core/dc_link.c | 2 +
.../gpu/drm/amd/display/dc/dcn201/dcn201_hwseq.c | 3 +-
.../gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 3 +-
.../amd/display/dc/irq/dcn20/irq_service_dcn20.c | 25 -
.../amd/display/dc/irq/dcn20/irq_service_dcn20.h | 2 -
.../amd/display/dc/irq/dcn21/irq_service_dcn21.c | 25 -
.../amd/display/dc/irq/dcn21/irq_service_dcn21.h | 2 -
drivers/gpu/drm/amd/display/dc/irq/irq_service.c | 2 +-
drivers/gpu/drm/amd/display/dc/irq/irq_service.h | 4 -
drivers/gpu/drm/amd/pm/amdgpu_pm.c | 6 +
drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c | 14 +-
drivers/gpu/drm/bridge/display-connector.c | 2 +-
.../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 40 +-
.../gpu/drm/bridge/synopsys/dw-hdmi-ahb-audio.c | 10 +-
drivers/gpu/drm/bridge/synopsys/dw-hdmi-audio.h | 4 +-
.../gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c | 9 +-
drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 12 +-
drivers/gpu/drm/bridge/ti-sn65dsi83.c | 2 +-
drivers/gpu/drm/bridge/ti-sn65dsi86.c | 1 +
drivers/gpu/drm/drm_atomic_helper.c | 2 +-
drivers/gpu/drm/drm_dp_helper.c | 40 +-
drivers/gpu/drm/drm_drv.c | 9 +-
drivers/gpu/drm/drm_gem_cma_helper.c | 17 +-
drivers/gpu/drm/drm_gem_shmem_helper.c | 17 +-
drivers/gpu/drm/drm_gem_vram_helper.c | 4 +-
drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 +
drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 6 +
drivers/gpu/drm/etnaviv/etnaviv_gpu.h | 1 +
drivers/gpu/drm/etnaviv/etnaviv_sched.c | 4 +-
drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c | 10 +-
drivers/gpu/drm/i915/gem/i915_gem_pages.c | 1 -
drivers/gpu/drm/i915/pxp/intel_pxp_tee.c | 5 +-
drivers/gpu/drm/lima/lima_device.c | 1 +
drivers/gpu/drm/lima/lima_gem.c | 2 +-
drivers/gpu/drm/msm/Kconfig | 1 +
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 4 +-
drivers/gpu/drm/msm/dsi/dsi.c | 10 +-
drivers/gpu/drm/msm/dsi/dsi.h | 1 -
drivers/gpu/drm/msm/dsi/dsi_manager.c | 17 -
drivers/gpu/drm/msm/msm_gem_submit.c | 2 +-
drivers/gpu/drm/nouveau/dispnv04/disp.c | 4 +-
drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c | 37 +-
.../gpu/drm/panel/panel-feiyang-fy07024di26a30d.c | 8 +-
drivers/gpu/drm/panel/panel-innolux-p079zca.c | 10 +-
drivers/gpu/drm/panel/panel-jdi-lt070me05000.c | 8 +-
drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c | 8 +-
drivers/gpu/drm/panel/panel-novatek-nt36672a.c | 8 +-
.../gpu/drm/panel/panel-panasonic-vvx10f034n00.c | 8 +-
drivers/gpu/drm/panel/panel-ronbo-rb070d30.c | 8 +-
.../drm/panel/panel-samsung-s6e88a0-ams452ef01.c | 1 +
drivers/gpu/drm/panel/panel-samsung-sofef00.c | 1 +
drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c | 8 +-
drivers/gpu/drm/panfrost/panfrost_gem.c | 2 +-
drivers/gpu/drm/radeon/radeon_kms.c | 42 +-
drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 31 +-
drivers/gpu/drm/rcar-du/rcar_du_drv.c | 6 +-
drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | 82 +-
drivers/gpu/drm/scheduler/sched_entity.c | 15 +-
drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c | 4 +-
drivers/gpu/drm/tegra/drm.c | 15 +
drivers/gpu/drm/tegra/gr2d.c | 33 +-
drivers/gpu/drm/tegra/submit.c | 4 +-
drivers/gpu/drm/tegra/vic.c | 7 +-
drivers/gpu/drm/ttm/ttm_bo.c | 2 +
drivers/gpu/drm/v3d/v3d_bo.c | 4 +-
drivers/gpu/drm/vboxvideo/vbox_main.c | 4 +-
drivers/gpu/drm/vc4/vc4_crtc.c | 31 +-
drivers/gpu/drm/vc4/vc4_drv.h | 29 +-
drivers/gpu/drm/vc4/vc4_hdmi.c | 136 ++-
drivers/gpu/drm/vc4/vc4_hvs.c | 26 +-
drivers/gpu/drm/vc4/vc4_kms.c | 3 +-
drivers/gpu/drm/vc4/vc4_txp.c | 4 +-
drivers/gpu/drm/vgem/vgem_drv.c | 2 +-
drivers/gpu/drm/virtio/virtgpu_ioctl.c | 4 +-
drivers/gpu/drm/virtio/virtgpu_object.c | 2 +-
drivers/gpu/drm/vmwgfx/Makefile | 3 +-
drivers/gpu/drm/vmwgfx/ttm_memory.c | 99 +--
drivers/gpu/drm/vmwgfx/ttm_memory.h | 6 +-
drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c | 7 +
drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 48 +-
drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 20 +-
drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 12 +-
drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 4 +-
drivers/gpu/drm/vmwgfx/vmwgfx_system_manager.c | 90 ++
drivers/gpu/drm/vmwgfx/vmwgfx_thp.c | 184 ----
drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c | 58 +-
drivers/gpu/host1x/Kconfig | 1 +
drivers/gpu/host1x/dev.c | 15 +
drivers/hid/hid-apple.c | 2 +-
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-input.c | 8 +
drivers/hid/hid-magicmouse.c | 95 ++-
drivers/hid/hid-uclogic-params.c | 31 +-
drivers/hid/hid-vivaldi.c | 34 +-
drivers/hid/i2c-hid/i2c-hid-acpi.c | 2 +-
drivers/hid/i2c-hid/i2c-hid-core.c | 4 +-
drivers/hid/i2c-hid/i2c-hid-of-goodix.c | 2 +-
drivers/hid/i2c-hid/i2c-hid-of.c | 10 +-
drivers/hid/i2c-hid/i2c-hid.h | 2 +-
drivers/hid/uhid.c | 29 +-
drivers/hid/wacom_wac.c | 39 +-
drivers/hsi/hsi_core.c | 1 +
drivers/hwmon/mr75203.c | 2 +-
drivers/i2c/busses/i2c-designware-pcidrv.c | 8 +-
drivers/i2c/busses/i2c-i801.c | 15 +-
drivers/i2c/busses/i2c-mpc.c | 23 +-
drivers/i3c/master.c | 3 +-
drivers/i3c/master/dw-i3c-master.c | 4 +
drivers/i3c/master/mipi-i3c-hci/dat_v1.c | 4 +-
drivers/iio/adc/ti-adc081c.c | 22 +-
drivers/iio/chemical/sunrise_co2.c | 4 +-
drivers/iio/industrialio-trigger.c | 36 +-
drivers/infiniband/core/cma.c | 12 +-
drivers/infiniband/core/device.c | 3 +-
drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 6 +-
drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 1 -
drivers/infiniband/hw/cxgb4/qp.c | 1 +
drivers/infiniband/hw/hns/hns_roce_main.c | 5 +-
drivers/infiniband/hw/qedr/verbs.c | 2 +
drivers/infiniband/sw/rxe/rxe_opcode.c | 2 +-
drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +-
drivers/input/touchscreen/ti_am335x_tsc.c | 8 +-
drivers/interconnect/qcom/icc-rpm.c | 1 +
drivers/iommu/amd/amd_iommu_types.h | 2 -
drivers/iommu/amd/init.c | 107 +--
drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 2 +-
drivers/iommu/io-pgtable-arm-v7s.c | 6 +-
drivers/iommu/io-pgtable-arm.c | 9 +-
drivers/iommu/iommu.c | 3 +-
drivers/iommu/iova.c | 3 +-
drivers/irqchip/irq-gic-v3.c | 16 +
drivers/leds/leds-lp55xx-common.c | 4 +-
drivers/mailbox/imx-mailbox.c | 4 +-
drivers/mailbox/mailbox-mpfs.c | 2 +-
drivers/mailbox/mtk-cmdq-mailbox.c | 2 +-
drivers/mailbox/pcc.c | 10 +-
drivers/md/dm-linear.c | 2 +-
drivers/md/dm-log-writes.c | 2 +-
drivers/md/dm-stripe.c | 2 +-
drivers/md/dm-writecache.c | 2 +-
drivers/md/dm.c | 6 +-
drivers/md/md.c | 27 +-
drivers/md/md.h | 2 +
drivers/md/persistent-data/dm-btree.c | 8 +-
drivers/md/persistent-data/dm-space-map-common.c | 5 +
drivers/md/raid0.c | 38 +-
drivers/md/raid5.c | 41 +-
drivers/media/Kconfig | 8 +-
drivers/media/cec/core/cec-adap.c | 38 +-
drivers/media/cec/core/cec-api.c | 6 +
drivers/media/cec/core/cec-core.c | 3 +
drivers/media/cec/core/cec-pin.c | 31 +-
drivers/media/common/saa7146/saa7146_fops.c | 2 +-
.../media/common/videobuf2/videobuf2-dma-contig.c | 8 +-
drivers/media/dvb-core/dmxdev.c | 18 +-
drivers/media/dvb-frontends/dib8000.c | 4 +-
drivers/media/i2c/imx274.c | 5 +
drivers/media/i2c/ov8865.c | 16 +-
drivers/media/pci/b2c2/flexcop-pci.c | 3 +
drivers/media/pci/intel/ipu3/cio2-bridge.c | 4 +-
drivers/media/pci/saa7146/hexium_gemini.c | 7 +-
drivers/media/pci/saa7146/hexium_orion.c | 8 +-
drivers/media/pci/saa7146/mxb.c | 8 +-
drivers/media/platform/aspeed-video.c | 14 +-
drivers/media/platform/coda/coda-common.c | 8 +-
drivers/media/platform/coda/coda-jpeg.c | 21 +-
drivers/media/platform/coda/imx-vdoa.c | 6 +-
drivers/media/platform/imx-pxp.c | 4 +-
.../media/platform/mtk-vcodec/mtk_vcodec_dec_drv.c | 2 +
.../media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c | 2 +-
drivers/media/platform/qcom/venus/core.c | 11 +-
drivers/media/platform/qcom/venus/pm_helpers.c | 32 +-
drivers/media/platform/rcar-vin/rcar-csi2.c | 18 +-
drivers/media/platform/rcar-vin/rcar-v4l2.c | 15 +-
.../media/platform/rockchip/rkisp1/rkisp1-dev.c | 2 +-
drivers/media/radio/si470x/radio-si470x-i2c.c | 3 +-
drivers/media/rc/igorplugusb.c | 4 +-
drivers/media/rc/mceusb.c | 8 +-
drivers/media/rc/redrat3.c | 22 +-
drivers/media/tuners/msi001.c | 7 +
drivers/media/tuners/si2157.c | 2 +-
drivers/media/usb/b2c2/flexcop-usb.c | 10 +-
drivers/media/usb/b2c2/flexcop-usb.h | 12 +-
drivers/media/usb/cpia2/cpia2_usb.c | 4 +-
drivers/media/usb/dvb-usb/dib0700_core.c | 2 -
drivers/media/usb/dvb-usb/dw2102.c | 338 +++++---
drivers/media/usb/dvb-usb/m920x.c | 12 +-
drivers/media/usb/em28xx/em28xx-cards.c | 18 +-
drivers/media/usb/em28xx/em28xx-core.c | 4 +-
drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 8 +-
drivers/media/usb/s2255/s2255drv.c | 4 +-
drivers/media/usb/stk1160/stk1160-core.c | 4 +-
drivers/media/usb/uvc/uvc_ctrl.c | 4 +-
drivers/media/usb/uvc/uvc_v4l2.c | 6 +-
drivers/media/usb/uvc/uvcvideo.h | 2 +-
drivers/media/v4l2-core/v4l2-ioctl.c | 4 +-
drivers/memory/renesas-rpc-if.c | 2 +-
drivers/mfd/atmel-flexcom.c | 11 +-
drivers/mfd/intel_soc_pmic_core.c | 28 +-
drivers/mfd/tps65910.c | 22 +-
drivers/misc/eeprom/at25.c | 13 +-
.../misc/habanalabs/common/command_submission.c | 22 +-
drivers/misc/habanalabs/common/firmware_if.c | 17 +-
drivers/misc/habanalabs/common/habanalabs.h | 2 +
drivers/misc/lattice-ecp3-config.c | 12 +-
drivers/misc/lkdtm/Makefile | 2 +-
drivers/misc/mei/hbm.c | 20 +-
drivers/mmc/core/sdio.c | 4 +-
drivers/mmc/host/meson-mx-sdhc-mmc.c | 5 +
drivers/mmc/host/meson-mx-sdio.c | 5 +
drivers/mmc/host/mtk-sd.c | 64 +-
drivers/mmc/host/omap_hsmmc.c | 36 -
drivers/mmc/host/sdhci-pci-gli.c | 11 +
drivers/mmc/host/tmio_mmc_core.c | 15 +-
drivers/mtd/hyperbus/rpc-if.c | 8 +-
drivers/mtd/mtdcore.c | 4 +-
drivers/mtd/mtdpart.c | 2 +-
drivers/mtd/nand/raw/davinci_nand.c | 73 +-
drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 37 +-
drivers/mtd/nand/raw/ingenic/ingenic_nand_drv.c | 5 +
drivers/mtd/nand/raw/nand_base.c | 67 ++
drivers/mtd/spi-nor/core.c | 19 +-
drivers/mtd/spi-nor/xilinx.c | 18 +-
drivers/net/amt.c | 2 +-
drivers/net/bonding/bond_main.c | 40 +-
drivers/net/can/at91_can.c | 6 -
drivers/net/can/c_can/c_can_main.c | 5 -
drivers/net/can/cc770/cc770.c | 3 -
drivers/net/can/dev/dev.c | 4 -
drivers/net/can/dev/rx-offload.c | 6 +-
drivers/net/can/flexcan.c | 150 ++--
drivers/net/can/ifi_canfd/ifi_canfd.c | 5 -
drivers/net/can/kvaser_pciefd.c | 5 -
drivers/net/can/m_can/m_can.c | 7 -
drivers/net/can/mscan/mscan.c | 9 +-
drivers/net/can/pch_can.c | 3 -
drivers/net/can/peak_canfd/peak_canfd.c | 4 -
drivers/net/can/rcar/rcar_can.c | 6 +-
drivers/net/can/rcar/rcar_canfd.c | 9 +-
drivers/net/can/sja1000/sja1000.c | 2 -
drivers/net/can/softing/softing_cs.c | 2 +-
drivers/net/can/softing/softing_fw.c | 11 +-
drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 6 +-
drivers/net/can/sun4i_can.c | 7 +-
drivers/net/can/usb/ems_usb.c | 2 -
drivers/net/can/usb/esd_usb2.c | 2 -
drivers/net/can/usb/etas_es58x/es58x_core.c | 7 -
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 2 -
drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 8 -
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 4 -
drivers/net/can/usb/peak_usb/pcan_usb.c | 2 -
drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 3 -
drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 2 -
drivers/net/can/usb/ucan.c | 6 +-
drivers/net/can/usb/usb_8dev.c | 2 -
drivers/net/can/xilinx_can.c | 16 +-
drivers/net/dsa/hirschmann/hellcreek.c | 87 +-
drivers/net/dsa/rtl8365mb.c | 15 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 +
drivers/net/ethernet/broadcom/bnxt/bnxt.h | 3 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c | 4 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 9 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c | 2 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.h | 3 +-
drivers/net/ethernet/broadcom/genet/bcmgenet.c | 10 +-
drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | 3 +-
drivers/net/ethernet/cortina/gemini.c | 9 +-
drivers/net/ethernet/freescale/fman/mac.c | 21 +-
drivers/net/ethernet/freescale/xgmac_mdio.c | 28 +-
drivers/net/ethernet/i825xx/sni_82596.c | 3 +-
drivers/net/ethernet/intel/igc/igc_main.c | 4 +-
drivers/net/ethernet/lantiq_etop.c | 4 +-
drivers/net/ethernet/marvell/octeontx2/af/ptp.c | 2 +
.../net/ethernet/marvell/octeontx2/af/rvu_cpt.c | 5 +-
.../ethernet/marvell/octeontx2/af/rvu_devlink.c | 2 +-
.../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 5 +-
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 55 +-
drivers/net/ethernet/mediatek/mtk_eth_soc.h | 16 +-
drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 36 +-
.../net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 5 +-
.../ethernet/mellanox/mlx5/core/en/tc_tun_encap.c | 2 +
.../net/ethernet/mellanox/mlx5/core/en/xsk/pool.c | 4 +-
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 19 +-
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 3 +
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 7 +-
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 120 ++-
.../net/ethernet/mellanox/mlx5/core/esw/legacy.c | 2 +-
.../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 28 +-
drivers/net/ethernet/mellanox/mlx5/core/lag/mp.c | 6 +-
drivers/net/ethernet/mellanox/mlx5/core/main.c | 8 +-
.../net/ethernet/mellanox/mlx5/core/sf/dev/dev.c | 5 +-
.../mellanox/mlx5/core/steering/dr_matcher.c | 53 +-
drivers/net/ethernet/mellanox/mlxsw/cmd.h | 12 +
drivers/net/ethernet/mellanox/mlxsw/pci.c | 7 +-
drivers/net/ethernet/mscc/ocelot.c | 31 +-
drivers/net/ethernet/mscc/ocelot_flower.c | 44 +-
drivers/net/ethernet/mscc/ocelot_net.c | 6 +-
drivers/net/ethernet/renesas/ravb_main.c | 6 +-
drivers/net/ethernet/rocker/rocker_ofdpa.c | 3 +-
.../ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c | 7 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +
drivers/net/ethernet/ti/cpsw.c | 6 +-
drivers/net/ethernet/ti/cpsw_new.c | 6 +-
drivers/net/ethernet/ti/cpsw_priv.c | 2 +-
drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 135 +--
drivers/net/ipa/ipa_endpoint.c | 7 +-
drivers/net/phy/marvell.c | 62 +-
drivers/net/phy/mdio_bus.c | 2 +-
drivers/net/phy/micrel.c | 36 +-
drivers/net/phy/phy-core.c | 2 +-
drivers/net/phy/sfp.c | 25 +-
drivers/net/ppp/ppp_generic.c | 7 +-
drivers/net/usb/mcs7830.c | 12 +-
drivers/net/usb/smsc95xx.c | 3 +-
drivers/net/wireless/ath/ar5523/ar5523.c | 4 +
drivers/net/wireless/ath/ath10k/core.c | 19 +-
drivers/net/wireless/ath/ath10k/htt_tx.c | 3 +
drivers/net/wireless/ath/ath10k/hw.h | 3 +
drivers/net/wireless/ath/ath10k/txrx.c | 2 -
drivers/net/wireless/ath/ath10k/wmi.c | 27 +-
drivers/net/wireless/ath/ath11k/ahb.c | 28 +-
drivers/net/wireless/ath/ath11k/core.c | 42 +-
drivers/net/wireless/ath/ath11k/core.h | 15 +-
drivers/net/wireless/ath/ath11k/dp.c | 38 +-
drivers/net/wireless/ath/ath11k/dp.h | 4 +-
drivers/net/wireless/ath/ath11k/dp_rx.c | 16 +-
drivers/net/wireless/ath/ath11k/dp_tx.c | 2 +-
drivers/net/wireless/ath/ath11k/hal.c | 50 +-
drivers/net/wireless/ath/ath11k/hal.h | 3 +
drivers/net/wireless/ath/ath11k/hal_rx.c | 2 +-
drivers/net/wireless/ath/ath11k/hw.c | 2 -
drivers/net/wireless/ath/ath11k/hw.h | 3 +
drivers/net/wireless/ath/ath11k/mac.c | 59 +-
drivers/net/wireless/ath/ath11k/pci.c | 34 +-
drivers/net/wireless/ath/ath11k/qmi.h | 2 +-
drivers/net/wireless/ath/ath11k/reg.c | 103 +--
drivers/net/wireless/ath/ath11k/wmi.c | 5 +-
drivers/net/wireless/ath/ath9k/hif_usb.c | 7 +
drivers/net/wireless/ath/ath9k/htc.h | 2 +
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 13 +
drivers/net/wireless/ath/ath9k/wmi.c | 4 +
drivers/net/wireless/ath/wcn36xx/dxe.c | 49 +-
drivers/net/wireless/ath/wcn36xx/main.c | 34 +-
drivers/net/wireless/ath/wcn36xx/smd.c | 10 +-
drivers/net/wireless/ath/wcn36xx/txrx.c | 41 +-
drivers/net/wireless/ath/wcn36xx/wcn36xx.h | 1 +
drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 2 +-
drivers/net/wireless/intel/iwlwifi/fw/api/power.h | 8 +-
drivers/net/wireless/intel/iwlwifi/fw/dump.c | 9 +
drivers/net/wireless/intel/iwlwifi/fw/img.c | 6 +-
drivers/net/wireless/intel/iwlwifi/fw/img.h | 4 +
drivers/net/wireless/intel/iwlwifi/iwl-csr.h | 5 +-
drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 17 +-
drivers/net/wireless/intel/iwlwifi/iwl-io.c | 2 +-
.../net/wireless/intel/iwlwifi/mvm/ftm-initiator.c | 4 +-
drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 18 +-
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 17 +
drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 27 +
drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 23 +-
.../net/wireless/intel/iwlwifi/mvm/time-event.c | 36 +-
drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 7 +-
drivers/net/wireless/intel/iwlwifi/queue/tx.c | 1 +
drivers/net/wireless/marvell/mwifiex/sta_event.c | 8 +-
drivers/net/wireless/marvell/mwifiex/usb.c | 3 +-
drivers/net/wireless/mediatek/mt76/debugfs.c | 2 +-
drivers/net/wireless/mediatek/mt76/mac80211.c | 7 +-
drivers/net/wireless/mediatek/mt76/mt7603/mac.c | 4 +
drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 9 +-
drivers/net/wireless/mediatek/mt76/mt7615/main.c | 12 +-
drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 174 ++--
.../net/wireless/mediatek/mt76/mt7615/pci_init.c | 8 +-
.../net/wireless/mediatek/mt76/mt7615/testmode.c | 4 +-
.../net/wireless/mediatek/mt76/mt76_connac_mac.c | 3 -
.../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 64 +-
.../net/wireless/mediatek/mt76/mt76_connac_mcu.h | 77 +-
drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 9 +-
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 81 +-
drivers/net/wireless/mediatek/mt76/mt7915/mcu.h | 8 +
.../net/wireless/mediatek/mt76/mt7921/debugfs.c | 12 +-
drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 13 +-
drivers/net/wireless/mediatek/mt76/mt7921/main.c | 30 +-
drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 116 ++-
drivers/net/wireless/mediatek/mt76/mt7921/mcu.h | 27 +
drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h | 2 +
drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 21 +-
.../net/wireless/mediatek/mt76/mt7921/pci_mac.c | 4 +
.../net/wireless/mediatek/mt76/mt7921/pci_mcu.c | 2 +-
drivers/net/wireless/mediatek/mt76/mt7921/sdio.c | 48 +-
drivers/net/wireless/mediatek/mt76/sdio.c | 3 +-
drivers/net/wireless/mediatek/mt76/sdio_txrx.c | 3 +-
drivers/net/wireless/microchip/wilc1000/netdev.c | 1 -
drivers/net/wireless/microchip/wilc1000/sdio.c | 2 +
drivers/net/wireless/microchip/wilc1000/spi.c | 2 +
drivers/net/wireless/realtek/rtw88/main.c | 2 +-
drivers/net/wireless/realtek/rtw88/pci.c | 61 +-
drivers/net/wireless/realtek/rtw88/pci.h | 2 +
drivers/net/wireless/realtek/rtw88/rtw8821c.h | 2 +-
drivers/net/wireless/realtek/rtw88/rtw8822b.c | 2 +-
drivers/net/wireless/realtek/rtw88/rtw8822c.c | 2 +-
drivers/net/wireless/realtek/rtw89/mac80211.c | 1 +
drivers/net/wireless/realtek/rtw89/phy.c | 33 +-
drivers/net/wireless/rsi/rsi_91x_main.c | 4 +
drivers/net/wireless/rsi/rsi_91x_usb.c | 9 +-
drivers/net/wireless/rsi/rsi_usb.h | 2 +
drivers/net/wwan/mhi_wwan_mbim.c | 4 +-
drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 16 +-
drivers/nvmem/core.c | 2 +
drivers/of/base.c | 11 +-
drivers/of/fdt.c | 25 +-
drivers/of/unittest.c | 21 +-
drivers/parisc/pdc_stable.c | 4 +-
drivers/pci/controller/dwc/pcie-designware.c | 7 +-
drivers/pci/controller/dwc/pcie-qcom.c | 12 +-
drivers/pci/controller/pci-aardvark.c | 10 +-
drivers/pci/controller/pci-mvebu.c | 260 +++++-
drivers/pci/controller/pci-xgene.c | 2 +-
drivers/pci/controller/pcie-apple.c | 7 +-
drivers/pci/controller/pcie-mediatek-gen3.c | 8 +
drivers/pci/controller/pcie-mt7621.c | 2 +
drivers/pci/controller/pcie-rcar-host.c | 10 +-
drivers/pci/hotplug/pciehp.h | 3 +
drivers/pci/hotplug/pciehp_core.c | 2 +-
drivers/pci/hotplug/pciehp_hpc.c | 28 +-
drivers/pci/msi.c | 26 +-
drivers/pci/pci-bridge-emul.c | 70 +-
drivers/pci/quirks.c | 3 +
drivers/pcmcia/cs.c | 8 +-
drivers/pcmcia/rsrc_nonstatic.c | 6 +
drivers/perf/arm-cmn.c | 5 +-
drivers/phy/cadence/phy-cadence-sierra.c | 31 +-
drivers/phy/mediatek/phy-mtk-mipi-dsi.c | 2 +
drivers/phy/mediatek/phy-mtk-tphy.c | 162 ++++
drivers/phy/socionext/phy-uniphier-usb3ss.c | 10 +-
drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 2 +
drivers/pinctrl/mediatek/pinctrl-paris.c | 2 +-
drivers/pinctrl/pinctrl-apple-gpio.c | 2 +-
drivers/pinctrl/pinctrl-rockchip.c | 2 +-
drivers/platform/x86/wmi.c | 17 +-
drivers/power/reset/mt6323-poweroff.c | 3 +
drivers/ptp/ptp_vclock.c | 10 +-
drivers/regulator/da9121-regulator.c | 5 +
drivers/regulator/qcom-labibb-regulator.c | 2 +-
drivers/regulator/qcom_smd-regulator.c | 100 ++-
drivers/remoteproc/imx_rproc.c | 1 +
drivers/rpmsg/rpmsg_core.c | 20 +-
drivers/rtc/dev.c | 6 +-
drivers/rtc/rtc-cmos.c | 3 +
drivers/rtc/rtc-pxa.c | 4 +
drivers/scsi/hisi_sas/hisi_sas_main.c | 8 +-
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 1 +
drivers/scsi/lpfc/lpfc.h | 2 +-
drivers/scsi/lpfc/lpfc_attr.c | 62 +-
drivers/scsi/lpfc/lpfc_els.c | 11 +-
drivers/scsi/lpfc/lpfc_hbadisc.c | 8 +-
drivers/scsi/lpfc/lpfc_init.c | 8 +-
drivers/scsi/lpfc/lpfc_nportdisc.c | 6 +
drivers/scsi/lpfc/lpfc_sli.c | 6 -
drivers/scsi/mpi3mr/mpi3mr.h | 3 +-
drivers/scsi/mpi3mr/mpi3mr_fw.c | 4 +-
drivers/scsi/pm8001/pm8001_hwi.c | 4 +-
drivers/scsi/scsi.c | 4 +-
drivers/scsi/scsi_debugfs.c | 1 +
drivers/scsi/scsi_pm.c | 2 +-
drivers/scsi/sr.c | 2 +-
drivers/scsi/sr_vendor.c | 4 +-
drivers/scsi/ufs/tc-dwc-g210-pci.c | 1 -
drivers/scsi/ufs/ufs-mediatek.c | 2 +-
drivers/scsi/ufs/ufshcd-pci.c | 2 -
drivers/scsi/ufs/ufshcd-pltfrm.c | 2 -
drivers/scsi/ufs/ufshcd.c | 22 +-
drivers/soc/imx/gpcv2.c | 3 +-
drivers/soc/mediatek/mtk-scpsys.c | 15 +-
drivers/soc/qcom/cpr.c | 2 +-
drivers/soc/ti/pruss.c | 2 +-
drivers/spi/spi-geni-qcom.c | 32 +-
drivers/spi/spi-hisi-kunpeng.c | 15 +-
drivers/spi/spi-meson-spifc.c | 1 +
drivers/spi/spi-uniphier.c | 11 +-
drivers/spi/spi.c | 13 +-
drivers/staging/greybus/audio_topology.c | 15 +
drivers/staging/media/atomisp/i2c/ov2680.h | 24 -
drivers/staging/media/atomisp/pci/atomisp_cmd.c | 82 +-
drivers/staging/media/atomisp/pci/atomisp_fops.c | 11 +
.../media/atomisp/pci/atomisp_gmin_platform.c | 2 +-
drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 188 ++++-
drivers/staging/media/atomisp/pci/atomisp_subdev.c | 15 +-
drivers/staging/media/atomisp/pci/atomisp_subdev.h | 3 +
drivers/staging/media/atomisp/pci/atomisp_v4l2.c | 13 +-
drivers/staging/media/atomisp/pci/atomisp_v4l2.h | 3 +-
drivers/staging/media/atomisp/pci/sh_css.c | 27 +-
drivers/staging/media/atomisp/pci/sh_css_mipi.c | 41 +-
drivers/staging/media/atomisp/pci/sh_css_params.c | 8 +-
drivers/staging/media/hantro/hantro_drv.c | 3 +-
drivers/staging/media/hantro/hantro_h1_jpeg_enc.c | 2 +-
drivers/staging/media/hantro/hantro_hw.h | 3 +-
.../media/hantro/rockchip_vpu2_hw_jpeg_enc.c | 17 +
drivers/staging/media/hantro/rockchip_vpu_hw.c | 5 +-
drivers/staging/rtl8192e/rtllib.h | 2 +-
drivers/staging/rtl8192e/rtllib_module.c | 16 +-
drivers/staging/rtl8192e/rtllib_softmac.c | 6 +-
drivers/tee/tee_core.c | 4 +-
drivers/thermal/imx8mm_thermal.c | 3 +
drivers/thermal/imx_thermal.c | 145 ++--
.../int340x_thermal/processor_thermal_device.h | 3 +-
.../intel/int340x_thermal/processor_thermal_mbox.c | 100 ++-
.../intel/int340x_thermal/processor_thermal_rfim.c | 23 +-
drivers/thunderbolt/acpi.c | 13 +
drivers/tty/mxser.c | 44 +-
drivers/tty/serial/8250/8250_bcm7271.c | 11 +-
drivers/tty/serial/8250/8250_dw.c | 3 +
drivers/tty/serial/amba-pl010.c | 3 -
drivers/tty/serial/amba-pl011.c | 29 +-
drivers/tty/serial/atmel_serial.c | 14 +
drivers/tty/serial/imx.c | 7 +-
drivers/tty/serial/liteuart.c | 2 +-
drivers/tty/serial/serial_core.c | 7 +-
drivers/tty/serial/stm32-usart.c | 6 +-
drivers/tty/serial/uartlite.c | 2 +-
drivers/uio/uio_dmem_genirq.c | 6 +-
drivers/usb/core/hub.c | 5 +-
drivers/usb/dwc2/gadget.c | 13 +-
drivers/usb/dwc2/hcd.c | 7 +-
drivers/usb/dwc3/dwc3-meson-g12a.c | 17 +-
drivers/usb/dwc3/dwc3-qcom.c | 7 +-
drivers/usb/gadget/function/f_fs.c | 4 +-
drivers/usb/gadget/function/u_audio.c | 28 +-
drivers/usb/host/ehci-brcm.c | 6 +-
drivers/usb/host/uhci-platform.c | 3 +-
drivers/usb/misc/ftdi-elan.c | 1 +
drivers/vdpa/ifcvf/ifcvf_base.c | 41 +-
drivers/vdpa/ifcvf/ifcvf_base.h | 9 +-
drivers/vdpa/ifcvf/ifcvf_main.c | 24 +-
drivers/vdpa/mlx5/net/mlx5_vnet.c | 8 +-
drivers/video/backlight/qcom-wled.c | 122 +--
drivers/virtio/virtio_mem.c | 2 +-
drivers/virtio/virtio_ring.c | 4 +-
drivers/w1/slaves/w1_ds28e04.c | 26 +-
drivers/xen/gntdev.c | 6 +-
fs/btrfs/backref.c | 21 +-
fs/btrfs/ctree.c | 19 +-
fs/btrfs/dev-replace.c | 2 +-
fs/btrfs/disk-io.c | 2 +
fs/btrfs/extent-tree.c | 58 +-
fs/btrfs/inode.c | 11 +
fs/btrfs/qgroup.c | 19 +
fs/btrfs/volumes.c | 2 +-
fs/btrfs/zoned.c | 91 +-
fs/btrfs/zoned.h | 13 +-
fs/cifs/sess.c | 13 +-
fs/debugfs/file.c | 2 +-
fs/dlm/lock.c | 9 +
fs/dlm/lowcomms.c | 44 +-
fs/ext4/ext4.h | 1 +
fs/ext4/ext4_jbd2.c | 2 +
fs/ext4/extents.c | 2 -
fs/ext4/fast_commit.c | 18 +-
fs/ext4/inode.c | 51 +-
fs/ext4/ioctl.c | 2 -
fs/ext4/mballoc.c | 48 +-
fs/ext4/migrate.c | 23 +-
fs/ext4/super.c | 27 +-
fs/f2fs/checkpoint.c | 4 +-
fs/f2fs/compress.c | 50 +-
fs/f2fs/data.c | 7 +-
fs/f2fs/f2fs.h | 11 +
fs/f2fs/file.c | 10 +-
fs/f2fs/gc.c | 8 +-
fs/f2fs/inode.c | 5 +
fs/f2fs/segment.h | 3 +-
fs/f2fs/super.c | 44 +
fs/f2fs/sysfs.c | 4 +-
fs/f2fs/xattr.c | 11 +-
fs/fuse/file.c | 2 +-
fs/hugetlbfs/inode.c | 7 +-
fs/io_uring.c | 4 +
fs/jffs2/file.c | 40 +-
fs/ksmbd/connection.c | 1 +
fs/ksmbd/connection.h | 4 +-
fs/ksmbd/ksmbd_netlink.h | 12 +-
fs/ksmbd/smb2misc.c | 18 +-
fs/ksmbd/smb2ops.c | 16 +-
fs/ksmbd/smb2pdu.c | 87 +-
fs/ksmbd/smb2pdu.h | 1 +
fs/ksmbd/smb_common.h | 1 +
fs/ksmbd/transport_ipc.c | 2 +
fs/ksmbd/transport_tcp.c | 3 +-
fs/nfsd/nfs3xdr.c | 44 +-
fs/nfsd/nfs4state.c | 6 +-
fs/nfsd/vfs.c | 4 +
fs/ubifs/super.c | 1 -
fs/udf/ialloc.c | 2 +
include/acpi/acpi_bus.h | 5 +-
include/acpi/actypes.h | 10 +-
include/asm-generic/bitops/find.h | 5 +
include/drm/drm_drv.h | 5 +-
include/drm/gpu_scheduler.h | 12 +-
include/linux/blk-pm.h | 2 +-
include/linux/bpf.h | 2 +-
include/linux/bpf_verifier.h | 7 +
include/linux/hid.h | 2 +
include/linux/iio/trigger.h | 2 +
include/linux/kasan.h | 4 +-
include/linux/mmzone.h | 9 +
include/linux/mtd/rawnand.h | 2 +
include/linux/mtd/spi-nor.h | 2 -
include/linux/netfilter_netdev.h | 2 +-
include/linux/of_fdt.h | 2 +
include/linux/pm_runtime.h | 3 +
include/linux/psi_types.h | 13 +-
include/linux/ptp_clock_kernel.h | 12 +-
include/linux/sbitmap.h | 11 +
include/linux/skbuff.h | 4 +-
include/linux/stmmac.h | 1 +
include/linux/vmalloc.h | 7 +
include/media/cec.h | 11 +-
include/net/inet_frag.h | 11 +-
include/net/ipv6_frag.h | 3 +-
include/net/pkt_sched.h | 4 +-
include/net/sch_generic.h | 5 +
include/net/xfrm.h | 7 +-
include/sound/hda_codec.h | 8 +-
include/trace/events/cgroup.h | 12 +-
include/trace/events/sunrpc.h | 13 +-
include/uapi/linux/bpf.h | 2 +-
include/uapi/linux/xfrm.h | 1 +
include/uapi/misc/habanalabs.h | 18 +-
kernel/audit.c | 18 +-
kernel/bpf/bloom_filter.c | 6 +
kernel/bpf/btf.c | 3 +-
kernel/bpf/core.c | 3 +-
kernel/bpf/inode.c | 14 +-
kernel/bpf/verifier.c | 28 +-
kernel/dma/pool.c | 4 +-
kernel/locking/ww_rt_mutex.c | 2 +-
kernel/rcu/rcutorture.c | 5 +
kernel/rcu/tree.c | 4 +-
kernel/rcu/tree_exp.h | 1 +
kernel/sched/cpuacct.c | 79 +-
kernel/sched/cputime.c | 4 +-
kernel/sched/fair.c | 4 +-
kernel/sched/psi.c | 45 +-
kernel/sched/rt.c | 23 +-
kernel/sched/stats.h | 5 +-
kernel/signal.c | 20 +-
kernel/time/clocksource.c | 50 +-
kernel/trace/bpf_trace.c | 6 +-
kernel/trace/trace_events_synth.c | 13 +-
kernel/trace/trace_kprobe.c | 5 +-
kernel/trace/trace_osnoise.c | 20 +-
kernel/trace/trace_probe.c | 2 +
kernel/trace/trace_syscalls.c | 6 +-
kernel/trace/trace_uprobe.c | 5 +
kernel/tsacct.c | 7 +-
lib/kunit/test.c | 18 +-
lib/logic_iomem.c | 19 +-
lib/mpi/mpi-mod.c | 2 +
lib/sbitmap.c | 25 +-
lib/test_bpf.c | 4 +-
lib/test_hmm.c | 24 +
lib/test_meminit.c | 1 +
mm/hmm.c | 5 +-
mm/kasan/quarantine.c | 11 +
mm/kasan/shadow.c | 9 +-
mm/page_alloc.c | 19 +-
mm/page_isolation.c | 2 +-
mm/shmem.c | 37 +-
mm/vmalloc.c | 3 +-
net/ax25/af_ax25.c | 10 +-
net/batman-adv/netlink.c | 30 +-
net/bluetooth/cmtp/core.c | 4 +-
net/bluetooth/hci_core.c | 1 +
net/bluetooth/hci_event.c | 37 +-
net/bluetooth/hci_request.c | 2 +-
net/bluetooth/hci_sock.c | 16 +-
net/bluetooth/hci_sysfs.c | 2 +
net/bluetooth/l2cap_sock.c | 45 +-
net/bluetooth/mgmt.c | 29 +-
net/bridge/br_netfilter_hooks.c | 7 +-
net/core/dev.c | 6 +
net/core/devlink.c | 2 -
net/core/filter.c | 8 +-
net/core/net-sysfs.c | 3 +
net/core/net_namespace.c | 4 +-
net/core/sock.c | 2 +
net/core/sock_map.c | 21 +-
net/dsa/switch.c | 4 +-
net/ipv4/fib_semantics.c | 47 +-
net/ipv4/inet_fragment.c | 8 +-
net/ipv4/ip_fragment.c | 3 +-
net/ipv4/ip_gre.c | 5 +-
net/ipv4/netfilter/ipt_CLUSTERIP.c | 5 +-
net/ipv4/tcp_bpf.c | 27 +
net/ipv6/ip6_gre.c | 5 +-
net/mac80211/rx.c | 2 +-
net/mctp/test/route-test.c | 7 +-
net/mptcp/options.c | 10 +-
net/mptcp/pm_netlink.c | 18 +-
net/mptcp/protocol.c | 4 +-
net/netfilter/nft_payload.c | 3 +
net/netfilter/nft_set_pipapo.c | 8 +
net/netrom/af_netrom.c | 12 +-
net/nfc/llcp_sock.c | 5 +
net/openvswitch/flow.c | 16 +-
net/sched/act_ct.c | 6 +
net/sched/cls_api.c | 2 +
net/sched/sch_api.c | 2 +-
net/sched/sch_generic.c | 1 +
net/smc/af_smc.c | 8 +-
net/smc/smc_core.c | 29 +-
net/smc/smc_core.h | 2 +-
net/socket.c | 9 +-
net/sunrpc/svc_xprt.c | 2 +-
net/unix/garbage.c | 14 +-
net/unix/scm.c | 6 +-
net/xfrm/xfrm_compat.c | 6 +-
net/xfrm/xfrm_interface.c | 14 +-
net/xfrm/xfrm_output.c | 30 +-
net/xfrm/xfrm_policy.c | 24 +-
net/xfrm/xfrm_state.c | 23 +-
net/xfrm/xfrm_user.c | 41 +-
samples/bpf/Makefile | 18 +-
samples/bpf/Makefile.target | 11 -
samples/bpf/lwt_len_hist_kern.c | 7 -
samples/bpf/xdp_sample_user.h | 2 +
scripts/dtc/dtx_diff | 8 +-
scripts/sphinx-pre-install | 3 +
security/selinux/hooks.c | 12 +-
sound/core/jack.c | 3 +
sound/core/misc.c | 2 +-
sound/core/oss/pcm_oss.c | 2 +-
sound/core/pcm.c | 6 +-
sound/core/seq/seq_queue.c | 14 +-
sound/hda/hdac_stream.c | 14 +-
sound/pci/hda/hda_bind.c | 5 +
sound/pci/hda/hda_codec.c | 45 +-
sound/pci/hda/hda_controller.c | 1 -
sound/pci/hda/hda_local.h | 1 +
sound/pci/hda/patch_cs8409-tables.c | 3 +
sound/pci/hda/patch_cs8409.c | 9 +-
sound/pci/hda/patch_cs8409.h | 1 +
sound/soc/amd/Kconfig | 2 +-
sound/soc/codecs/Kconfig | 3 +-
sound/soc/codecs/cs42l42.c | 22 +
sound/soc/codecs/cs42l42.h | 2 +
sound/soc/codecs/rt5663.c | 12 +-
sound/soc/fsl/fsl_asrc.c | 69 +-
sound/soc/fsl/fsl_mqs.c | 2 +-
sound/soc/fsl/imx-card.c | 32 +-
sound/soc/fsl/imx-hdmi.c | 2 +
sound/soc/generic/test-component.c | 5 +-
sound/soc/intel/boards/sof_sdw.c | 2 +-
sound/soc/intel/catpt/dsp.c | 14 +-
sound/soc/intel/skylake/skl-pcm.c | 1 -
sound/soc/mediatek/mt8173/mt8173-max98090.c | 3 +
sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c | 2 +
sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c | 2 +
sound/soc/mediatek/mt8173/mt8173-rt5650.c | 2 +
sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c | 6 +-
.../mt8183/mt8183-mt6358-ts3a227-max98357.c | 7 +-
.../mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c | 6 +-
sound/soc/mediatek/mt8195/mt8195-afe-pcm.c | 2 +-
sound/soc/mediatek/mt8195/mt8195-dai-pcm.c | 73 +-
sound/soc/mediatek/mt8195/mt8195-reg.h | 1 +
sound/soc/samsung/idma.c | 2 +
sound/soc/sof/intel/hda-codec.c | 3 +-
sound/soc/sof/intel/hda-pcm.c | 86 +-
sound/soc/sof/intel/hda.c | 9 +-
sound/soc/sof/intel/hda.h | 6 +
sound/soc/sof/ipc.c | 3 +-
sound/soc/sof/pcm.c | 5 +-
sound/soc/sof/sof-audio.c | 109 ++-
sound/soc/sof/sof-audio.h | 6 +-
sound/soc/sof/topology.c | 17 -
sound/soc/uniphier/Kconfig | 2 -
sound/usb/format.c | 2 +-
sound/usb/mixer_quirks.c | 2 +-
sound/usb/quirks.c | 2 +-
tools/bpf/bpftool/Documentation/Makefile | 1 -
tools/bpf/bpftool/Documentation/bpftool-btf.rst | 2 +-
tools/bpf/bpftool/Documentation/bpftool-cgroup.rst | 2 +-
tools/bpf/bpftool/Documentation/bpftool-gen.rst | 2 +-
tools/bpf/bpftool/Documentation/bpftool-link.rst | 2 +-
tools/bpf/bpftool/Documentation/bpftool-map.rst | 6 +-
tools/bpf/bpftool/Documentation/bpftool-prog.rst | 8 +-
tools/bpf/bpftool/Documentation/bpftool.rst | 6 +-
tools/bpf/bpftool/Makefile | 1 -
tools/bpf/bpftool/main.c | 2 +
tools/bpf/bpftool/prog.c | 15 +-
tools/bpf/resolve_btfids/main.c | 5 +-
tools/include/nolibc/nolibc.h | 33 +-
tools/include/uapi/linux/bpf.h | 2 +-
tools/lib/bpf/btf.c | 55 +-
tools/lib/bpf/btf.h | 2 +-
tools/lib/bpf/btf_dump.c | 2 +-
tools/lib/bpf/gen_loader.c | 12 +-
tools/lib/bpf/libbpf.c | 65 +-
tools/lib/bpf/libbpf.h | 1 -
tools/lib/bpf/linker.c | 6 +-
tools/perf/Makefile.config | 5 +-
tools/perf/tests/shell/stat_all_metricgroups.sh | 2 +-
tools/perf/util/cputopo.c | 3 +-
tools/perf/util/debug.c | 2 +-
tools/perf/util/evsel.c | 25 +-
tools/perf/util/metricgroup.c | 4 +-
tools/perf/util/probe-event.c | 3 +
tools/testing/kunit/kunit_json.py | 2 +
tools/testing/kunit/kunit_tool_test.py | 6 +
tools/testing/selftests/bpf/btf_helpers.c | 9 +-
tools/testing/selftests/bpf/prog_tests/bpf_iter.c | 5 +-
.../selftests/bpf/prog_tests/migrate_reuseport.c | 4 +-
tools/testing/selftests/bpf/prog_tests/skb_ctx.c | 2 +
.../testing/selftests/bpf/prog_tests/tc_redirect.c | 7 +
tools/testing/selftests/bpf/xdpxceiver.c | 6 +-
tools/testing/selftests/clone3/clone3.c | 6 +
.../selftests/ftrace/test.d/kprobe/profile.tc | 2 +-
tools/testing/selftests/kselftest_harness.h | 2 +-
tools/testing/selftests/kvm/.gitignore | 2 +-
tools/testing/selftests/kvm/Makefile | 4 +-
.../selftests/kvm/include/x86_64/processor.h | 7 +
tools/testing/selftests/kvm/lib/x86_64/processor.c | 33 +-
.../kvm/x86_64/{get_cpuid_test.c => cpuid_test.c} | 30 +
.../selftests/powerpc/security/spectre_v2.c | 2 +-
tools/testing/selftests/powerpc/signal/.gitignore | 1 +
tools/testing/selftests/powerpc/signal/Makefile | 1 +
.../selftests/powerpc/signal/sigreturn_kernel.c | 132 +++
.../selftests/vm/charge_reserved_hugetlb.sh | 34 +-
tools/testing/selftests/vm/hmm-tests.c | 42 +
.../selftests/vm/hugetlb_reparenting_test.sh | 21 +-
tools/testing/selftests/vm/write_hugetlb_memory.sh | 2 +-
virt/kvm/kvm_main.c | 5 +-
1127 files changed, 10720 insertions(+), 6000 deletions(-)
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0001/1039] KVM: x86/mmu: Fix write-protection of PTs mapped by the TDP MMU
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
@ 2022-01-24 18:29 ` Greg Kroah-Hartman
2022-01-24 18:29 ` [PATCH 5.16 0002/1039] KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock Greg Kroah-Hartman
` (991 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Matlack, Sean Christopherson,
Paolo Bonzini
From: David Matlack <dmatlack@google.com>
commit 7c8a4742c4abe205ec9daf416c9d42fd6b406e8e upstream.
When the TDP MMU is write-protection GFNs for page table protection (as
opposed to for dirty logging, or due to the HVA not being writable), it
checks if the SPTE is already write-protected and if so skips modifying
the SPTE and the TLB flush.
This behavior is incorrect because it fails to check if the SPTE
is write-protected for page table protection, i.e. fails to check
that MMU-writable is '0'. If the SPTE was write-protected for dirty
logging but not page table protection, the SPTE could locklessly be made
writable, and vCPUs could still be running with writable mappings cached
in their TLB.
Fix this by only skipping setting the SPTE if the SPTE is already
write-protected *and* MMU-writable is already clear. Technically,
checking only MMU-writable would suffice; a SPTE cannot be writable
without MMU-writable being set. But check both to be paranoid and
because it arguably yields more readable code.
Fixes: 46044f72c382 ("kvm: x86/mmu: Support write protection for nesting in tdp MMU")
Cc: stable@vger.kernel.org
Signed-off-by: David Matlack <dmatlack@google.com>
Message-Id: <20220113233020.3986005-2-dmatlack@google.com>
Reviewed-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/mmu/tdp_mmu.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/x86/kvm/mmu/tdp_mmu.c
+++ b/arch/x86/kvm/mmu/tdp_mmu.c
@@ -1442,12 +1442,12 @@ static bool write_protect_gfn(struct kvm
!is_last_spte(iter.old_spte, iter.level))
continue;
- if (!is_writable_pte(iter.old_spte))
- break;
-
new_spte = iter.old_spte &
~(PT_WRITABLE_MASK | shadow_mmu_writable_mask);
+ if (new_spte == iter.old_spte)
+ break;
+
tdp_mmu_set_spte(kvm, &iter, new_spte);
spte_set = true;
}
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0002/1039] KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
2022-01-24 18:29 ` [PATCH 5.16 0001/1039] KVM: x86/mmu: Fix write-protection of PTs mapped by the TDP MMU Greg Kroah-Hartman
@ 2022-01-24 18:29 ` Greg Kroah-Hartman
2022-01-24 18:29 ` [PATCH 5.16 0003/1039] HID: Ignore battery for Elan touchscreen on HP Envy X360 15t-dr100 Greg Kroah-Hartman
` (990 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:29 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Marcelo Tosatti, Paolo Bonzini
From: Marcelo Tosatti <mtosatti@redhat.com>
commit 5f02ef741a785678930f3ff0a8b6b2b0ef1bb402 upstream.
blocked_vcpu_on_cpu_lock is taken from hard interrupt context
(pi_wakeup_handler), therefore it cannot sleep.
Switch it to a raw spinlock.
Fixes:
[41297.066254] BUG: scheduling while atomic: CPU 0/KVM/635218/0x00010001
[41297.066323] Preemption disabled at:
[41297.066324] [<ffffffff902ee47f>] irq_enter_rcu+0xf/0x60
[41297.066339] Call Trace:
[41297.066342] <IRQ>
[41297.066346] dump_stack_lvl+0x34/0x44
[41297.066353] ? irq_enter_rcu+0xf/0x60
[41297.066356] __schedule_bug.cold+0x7d/0x8b
[41297.066361] __schedule+0x439/0x5b0
[41297.066365] ? task_blocks_on_rt_mutex.constprop.0.isra.0+0x1b0/0x440
[41297.066369] schedule_rtlock+0x1e/0x40
[41297.066371] rtlock_slowlock_locked+0xf1/0x260
[41297.066374] rt_spin_lock+0x3b/0x60
[41297.066378] pi_wakeup_handler+0x31/0x90 [kvm_intel]
[41297.066388] sysvec_kvm_posted_intr_wakeup_ipi+0x9d/0xd0
[41297.066392] </IRQ>
[41297.066392] asm_sysvec_kvm_posted_intr_wakeup_ipi+0x12/0x20
...
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx/posted_intr.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/arch/x86/kvm/vmx/posted_intr.c
+++ b/arch/x86/kvm/vmx/posted_intr.c
@@ -15,7 +15,7 @@
* can find which vCPU should be waken up.
*/
static DEFINE_PER_CPU(struct list_head, blocked_vcpu_on_cpu);
-static DEFINE_PER_CPU(spinlock_t, blocked_vcpu_on_cpu_lock);
+static DEFINE_PER_CPU(raw_spinlock_t, blocked_vcpu_on_cpu_lock);
static inline struct pi_desc *vcpu_to_pi_desc(struct kvm_vcpu *vcpu)
{
@@ -121,9 +121,9 @@ static void __pi_post_block(struct kvm_v
new.control) != old.control);
if (!WARN_ON_ONCE(vcpu->pre_pcpu == -1)) {
- spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+ raw_spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
list_del(&vcpu->blocked_vcpu_list);
- spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+ raw_spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
vcpu->pre_pcpu = -1;
}
}
@@ -154,11 +154,11 @@ int pi_pre_block(struct kvm_vcpu *vcpu)
local_irq_disable();
if (!WARN_ON_ONCE(vcpu->pre_pcpu != -1)) {
vcpu->pre_pcpu = vcpu->cpu;
- spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+ raw_spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
list_add_tail(&vcpu->blocked_vcpu_list,
&per_cpu(blocked_vcpu_on_cpu,
vcpu->pre_pcpu));
- spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+ raw_spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
}
do {
@@ -215,7 +215,7 @@ void pi_wakeup_handler(void)
struct kvm_vcpu *vcpu;
int cpu = smp_processor_id();
- spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
+ raw_spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
list_for_each_entry(vcpu, &per_cpu(blocked_vcpu_on_cpu, cpu),
blocked_vcpu_list) {
struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
@@ -223,13 +223,13 @@ void pi_wakeup_handler(void)
if (pi_test_on(pi_desc) == 1)
kvm_vcpu_kick(vcpu);
}
- spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
+ raw_spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
}
void __init pi_init_cpu(int cpu)
{
INIT_LIST_HEAD(&per_cpu(blocked_vcpu_on_cpu, cpu));
- spin_lock_init(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
+ raw_spin_lock_init(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
}
bool pi_has_pending_interrupt(struct kvm_vcpu *vcpu)
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0003/1039] HID: Ignore battery for Elan touchscreen on HP Envy X360 15t-dr100
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
2022-01-24 18:29 ` [PATCH 5.16 0001/1039] KVM: x86/mmu: Fix write-protection of PTs mapped by the TDP MMU Greg Kroah-Hartman
2022-01-24 18:29 ` [PATCH 5.16 0002/1039] KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock Greg Kroah-Hartman
@ 2022-01-24 18:29 ` Greg Kroah-Hartman
2022-01-24 18:29 ` [PATCH 5.16 0004/1039] HID: uhid: Fix worker destroying device without any protection Greg Kroah-Hartman
` (989 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:29 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Karl Kurbjun, Jiri Kosina
From: Karl Kurbjun <kkurbjun@gmail.com>
commit f3193ea1b6779023334faa72b214ece457e02656 upstream.
Battery status on Elan tablet driver is reported for the HP ENVY x360
15t-dr100. There is no separate battery for the Elan controller resulting in a
battery level report of 0% or 1% depending on whether a stylus has interacted
with the screen. These low battery level reports causes a variety of bad
behavior in desktop environments. This patch adds the appropriate quirk to
indicate that the batery status is unused for this target.
Cc: stable@vger.kernel.org
Signed-off-by: Karl Kurbjun <kkurbjun@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-input.c | 2 ++
2 files changed, 3 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -398,6 +398,7 @@
#define USB_DEVICE_ID_HP_X2 0x074d
#define USB_DEVICE_ID_HP_X2_10_COVER 0x0755
#define I2C_DEVICE_ID_HP_ENVY_X360_15 0x2d05
+#define I2C_DEVICE_ID_HP_ENVY_X360_15T_DR100 0x29CF
#define I2C_DEVICE_ID_HP_SPECTRE_X360_15 0x2817
#define USB_DEVICE_ID_ASUS_UX550VE_TOUCHSCREEN 0x2544
#define USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN 0x2706
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -329,6 +329,8 @@ static const struct hid_device_id hid_ba
HID_BATTERY_QUIRK_IGNORE },
{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15),
HID_BATTERY_QUIRK_IGNORE },
+ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15T_DR100),
+ HID_BATTERY_QUIRK_IGNORE },
{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_SPECTRE_X360_15),
HID_BATTERY_QUIRK_IGNORE },
{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_SURFACE_GO_TOUCHSCREEN),
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0004/1039] HID: uhid: Fix worker destroying device without any protection
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2022-01-24 18:29 ` [PATCH 5.16 0003/1039] HID: Ignore battery for Elan touchscreen on HP Envy X360 15t-dr100 Greg Kroah-Hartman
@ 2022-01-24 18:29 ` Greg Kroah-Hartman
2022-01-24 18:29 ` [PATCH 5.16 0005/1039] HID: wacom: Reset expected and received contact counts at the same time Greg Kroah-Hartman
` (988 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:29 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jann Horn, Jiri Kosina
From: Jann Horn <jannh@google.com>
commit 4ea5763fb79ed89b3bdad455ebf3f33416a81624 upstream.
uhid has to run hid_add_device() from workqueue context while allowing
parallel use of the userspace API (which is protected with ->devlock).
But hid_add_device() can fail. Currently, that is handled by immediately
destroying the associated HID device, without using ->devlock - but if
there are concurrent requests from userspace, that's wrong and leads to
NULL dereferences and/or memory corruption (via use-after-free).
Fix it by leaving the HID device as-is in the worker. We can clean it up
later, either in the UHID_DESTROY command handler or in the ->release()
handler.
Cc: stable@vger.kernel.org
Fixes: 67f8ecc550b5 ("HID: uhid: fix timeout when probe races with IO")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/uhid.c | 29 +++++++++++++++++++++++++----
1 file changed, 25 insertions(+), 4 deletions(-)
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -28,11 +28,22 @@
struct uhid_device {
struct mutex devlock;
+
+ /* This flag tracks whether the HID device is usable for commands from
+ * userspace. The flag is already set before hid_add_device(), which
+ * runs in workqueue context, to allow hid_add_device() to communicate
+ * with userspace.
+ * However, if hid_add_device() fails, the flag is cleared without
+ * holding devlock.
+ * We guarantee that if @running changes from true to false while you're
+ * holding @devlock, it's still fine to access @hid.
+ */
bool running;
__u8 *rd_data;
uint rd_size;
+ /* When this is NULL, userspace may use UHID_CREATE/UHID_CREATE2. */
struct hid_device *hid;
struct uhid_event input_buf;
@@ -63,9 +74,18 @@ static void uhid_device_add_worker(struc
if (ret) {
hid_err(uhid->hid, "Cannot register HID device: error %d\n", ret);
- hid_destroy_device(uhid->hid);
- uhid->hid = NULL;
+ /* We used to call hid_destroy_device() here, but that's really
+ * messy to get right because we have to coordinate with
+ * concurrent writes from userspace that might be in the middle
+ * of using uhid->hid.
+ * Just leave uhid->hid as-is for now, and clean it up when
+ * userspace tries to close or reinitialize the uhid instance.
+ *
+ * However, we do have to clear the ->running flag and do a
+ * wakeup to make sure userspace knows that the device is gone.
+ */
uhid->running = false;
+ wake_up_interruptible(&uhid->report_wait);
}
}
@@ -474,7 +494,7 @@ static int uhid_dev_create2(struct uhid_
void *rd_data;
int ret;
- if (uhid->running)
+ if (uhid->hid)
return -EALREADY;
rd_size = ev->u.create2.rd_size;
@@ -556,7 +576,7 @@ static int uhid_dev_create(struct uhid_d
static int uhid_dev_destroy(struct uhid_device *uhid)
{
- if (!uhid->running)
+ if (!uhid->hid)
return -EINVAL;
uhid->running = false;
@@ -565,6 +585,7 @@ static int uhid_dev_destroy(struct uhid_
cancel_work_sync(&uhid->worker);
hid_destroy_device(uhid->hid);
+ uhid->hid = NULL;
kfree(uhid->rd_data);
return 0;
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0005/1039] HID: wacom: Reset expected and received contact counts at the same time
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2022-01-24 18:29 ` [PATCH 5.16 0004/1039] HID: uhid: Fix worker destroying device without any protection Greg Kroah-Hartman
@ 2022-01-24 18:29 ` Greg Kroah-Hartman
2022-01-24 18:29 ` [PATCH 5.16 0006/1039] HID: wacom: Ignore the confidence flag when a touch is removed Greg Kroah-Hartman
` (987 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jason Gerecke, Ping Cheng, Jiri Kosina
From: Jason Gerecke <killertofu@gmail.com>
commit 546e41ac994cc185ef3de610ca849a294b5df3ba upstream.
These two values go hand-in-hand and must be valid for the driver to
behave correctly. We are currently lazy about updating the values and
rely on the "expected" code flow to take care of making sure they're
valid at the point they're needed. The "expected" flow changed somewhat
with commit f8b6a74719b5 ("HID: wacom: generic: Support multiple tools
per report"), however. This led to problems with the DTH-2452 due (in
part) to *all* contacts being fully processed -- even those past the
expected contact count. Specifically, the received count gets reset to
0 once all expected fingers are processed, but not the expected count.
The rest of the contacts in the report are then *also* processed since
now the driver thinks we've only processed 0 of N expected contacts.
Later commits such as 7fb0413baa7f (HID: wacom: Use "Confidence" flag to
prevent reporting invalid contacts) worked around the DTH-2452 issue by
skipping the invalid contacts at the end of the report, but this is not
a complete fix. The confidence flag cannot be relied on when a contact
is removed (see the following patch), and dealing with that condition
re-introduces the DTH-2452 issue unless we also address this contact
count laziness. By resetting expected and received counts at the same
time we ensure the driver understands that there are 0 more contacts
expected in the report. Similarly, we also make sure to reset the
received count if for some reason we're out of sync in the pre-report
phase.
Link: https://github.com/linuxwacom/input-wacom/issues/288
Fixes: f8b6a74719b5 ("HID: wacom: generic: Support multiple tools per report")
CC: stable@vger.kernel.org
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom_wac.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -2692,11 +2692,14 @@ static void wacom_wac_finger_pre_report(
hid_data->cc_index >= 0) {
struct hid_field *field = report->field[hid_data->cc_index];
int value = field->value[hid_data->cc_value_index];
- if (value)
+ if (value) {
hid_data->num_expected = value;
+ hid_data->num_received = 0;
+ }
}
else {
hid_data->num_expected = wacom_wac->features.touch_max;
+ hid_data->num_received = 0;
}
}
@@ -2724,6 +2727,7 @@ static void wacom_wac_finger_report(stru
input_sync(input);
wacom_wac->hid_data.num_received = 0;
+ wacom_wac->hid_data.num_expected = 0;
/* keep touch state for pen event */
wacom_wac->shared->touch_down = wacom_wac_finger_count_touches(wacom_wac);
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0006/1039] HID: wacom: Ignore the confidence flag when a touch is removed
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2022-01-24 18:29 ` [PATCH 5.16 0005/1039] HID: wacom: Reset expected and received contact counts at the same time Greg Kroah-Hartman
@ 2022-01-24 18:29 ` Greg Kroah-Hartman
2022-01-24 18:29 ` [PATCH 5.16 0007/1039] HID: wacom: Avoid using stale array indicies to read contact count Greg Kroah-Hartman
` (986 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jason Gerecke, Ping Cheng, Jiri Kosina
From: Jason Gerecke <killertofu@gmail.com>
commit df03e9bd6d4806619b4cdc91a3d7695818a8e2b7 upstream.
AES hardware may internally re-classify a contact that it thought was
intentional as a palm. Intentional contacts are reported as "down" with
the confidence bit set. When this re-classification occurs, however, the
state transitions to "up" with the confidence bit cleared. This kind of
transition appears to be legal according to Microsoft docs, but we do
not handle it correctly. Because the confidence bit is clear, we don't
call `wacom_wac_finger_slot` and update userspace. This causes hung
touches that confuse userspace and interfere with pen arbitration.
This commit adds a special case to ignore the confidence flag if a contact
is reported as removed. This ensures we do not leave a hung touch if one
of these re-classification events occured. Ideally we'd have some way to
also let userspace know that the touch has been re-classified as a palm
and needs to be canceled, but that's not possible right now :)
Link: https://github.com/linuxwacom/input-wacom/issues/288
Fixes: 7fb0413baa7f (HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts)
CC: stable@vger.kernel.org
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom_wac.c | 29 ++++++++++++++++++++++++++---
1 file changed, 26 insertions(+), 3 deletions(-)
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -2588,6 +2588,24 @@ static void wacom_wac_finger_slot(struct
}
}
+static bool wacom_wac_slot_is_active(struct input_dev *dev, int key)
+{
+ struct input_mt *mt = dev->mt;
+ struct input_mt_slot *s;
+
+ if (!mt)
+ return false;
+
+ for (s = mt->slots; s != mt->slots + mt->num_slots; s++) {
+ if (s->key == key &&
+ input_mt_get_value(s, ABS_MT_TRACKING_ID) >= 0) {
+ return true;
+ }
+ }
+
+ return false;
+}
+
static void wacom_wac_finger_event(struct hid_device *hdev,
struct hid_field *field, struct hid_usage *usage, __s32 value)
{
@@ -2638,9 +2656,14 @@ static void wacom_wac_finger_event(struc
}
if (usage->usage_index + 1 == field->report_count) {
- if (equivalent_usage == wacom_wac->hid_data.last_slot_field &&
- wacom_wac->hid_data.confidence)
- wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input);
+ if (equivalent_usage == wacom_wac->hid_data.last_slot_field) {
+ bool touch_removed = wacom_wac_slot_is_active(wacom_wac->touch_input,
+ wacom_wac->hid_data.id) && !wacom_wac->hid_data.tipswitch;
+
+ if (wacom_wac->hid_data.confidence || touch_removed) {
+ wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input);
+ }
+ }
}
}
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0007/1039] HID: wacom: Avoid using stale array indicies to read contact count
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2022-01-24 18:29 ` [PATCH 5.16 0006/1039] HID: wacom: Ignore the confidence flag when a touch is removed Greg Kroah-Hartman
@ 2022-01-24 18:29 ` Greg Kroah-Hartman
2022-01-24 18:29 ` [PATCH 5.16 0008/1039] ALSA: core: Fix SSID quirk lookup for subvendor=0 Greg Kroah-Hartman
` (985 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jason Gerecke, Ping Cheng, Jiri Kosina
From: Jason Gerecke <killertofu@gmail.com>
commit 20f3cf5f860f9f267a6a6e5642d3d0525edb1814 upstream.
If we ever see a touch report with contact count data we initialize
several variables used to read the contact count in the pre-report
phase. These variables are never reset if we process a report which
doesn't contain a contact count, however. This can cause the pre-
report function to trigger a read of arbitrary memory (e.g. NULL
if we're lucky) and potentially crash the driver.
This commit restores resetting of the variables back to default
"none" values that were used prior to the commit mentioned
below.
Link: https://github.com/linuxwacom/input-wacom/issues/276
Fixes: 003f50ab673c (HID: wacom: Update last_slot_field during pre_report phase)
CC: stable@vger.kernel.org
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom_wac.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -2682,6 +2682,10 @@ static void wacom_wac_finger_pre_report(
hid_data->confidence = true;
+ hid_data->cc_report = 0;
+ hid_data->cc_index = -1;
+ hid_data->cc_value_index = -1;
+
for (i = 0; i < report->maxfield; i++) {
struct hid_field *field = report->field[i];
int j;
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0008/1039] ALSA: core: Fix SSID quirk lookup for subvendor=0
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2022-01-24 18:29 ` [PATCH 5.16 0007/1039] HID: wacom: Avoid using stale array indicies to read contact count Greg Kroah-Hartman
@ 2022-01-24 18:29 ` Greg Kroah-Hartman
2022-01-24 18:29 ` [PATCH 5.16 0009/1039] cifs: free ntlmsspblob allocated in negotiate Greg Kroah-Hartman
` (984 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:29 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai
From: Takashi Iwai <tiwai@suse.de>
commit 5576c4f24c56722a2d9fb9c447d896e5b312078b upstream.
Some weird devices set the codec SSID vendor ID 0, and
snd_pci_quirk_lookup_id() loop aborts at the point although it should
still try matching with the SSID device ID. This resulted in a
missing quirk for some old Macs.
Fix the loop termination condition to check both subvendor and
subdevice.
Fixes: 73355ddd8775 ("ALSA: hda: Code refactoring snd_hda_pick_fixup()")
Cc: <stable@vger.kernel.org>
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=215495
Link: https://lore.kernel.org/r/20220116082838.19382-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/misc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/core/misc.c
+++ b/sound/core/misc.c
@@ -112,7 +112,7 @@ snd_pci_quirk_lookup_id(u16 vendor, u16
{
const struct snd_pci_quirk *q;
- for (q = list; q->subvendor; q++) {
+ for (q = list; q->subvendor || q->subdevice; q++) {
if (q->subvendor != vendor)
continue;
if (!q->subdevice ||
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0009/1039] cifs: free ntlmsspblob allocated in negotiate
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2022-01-24 18:29 ` [PATCH 5.16 0008/1039] ALSA: core: Fix SSID quirk lookup for subvendor=0 Greg Kroah-Hartman
@ 2022-01-24 18:29 ` Greg Kroah-Hartman
2022-01-24 18:29 ` [PATCH 5.16 0010/1039] f2fs: fix to do sanity check on inode type during garbage collection Greg Kroah-Hartman
` (983 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:29 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Shyam Prasad N, Steve French
From: Shyam Prasad N <sprasad@microsoft.com>
commit e3548aaf41a200c2af359462be23bcdd76efd795 upstream.
One of my previous fixes:
cifs: send workstation name during ntlmssp session setup
...changed the prototype of build_ntlmssp_negotiate_blob
from being allocated by the caller to being allocated within
the function. The caller needs to free this object too.
While SMB2 version of the caller did it, I forgot to free
for the SMB1 version. Fixing that here.
Fixes: 49bd49f983b5 ("cifs: send workstation name during ntlmssp session setup")
Cc: stable@vger.kernel.org # 5.16
Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/sess.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -1354,7 +1354,7 @@ sess_auth_rawntlmssp_negotiate(struct se
&blob_len, ses,
sess_data->nls_cp);
if (rc)
- goto out;
+ goto out_free_ntlmsspblob;
sess_data->iov[1].iov_len = blob_len;
sess_data->iov[1].iov_base = ntlmsspblob;
@@ -1362,7 +1362,7 @@ sess_auth_rawntlmssp_negotiate(struct se
rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
if (rc)
- goto out;
+ goto out_free_ntlmsspblob;
rc = sess_sendreceive(sess_data);
@@ -1376,14 +1376,14 @@ sess_auth_rawntlmssp_negotiate(struct se
rc = 0;
if (rc)
- goto out;
+ goto out_free_ntlmsspblob;
cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
if (smb_buf->WordCount != 4) {
rc = -EIO;
cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
- goto out;
+ goto out_free_ntlmsspblob;
}
ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
@@ -1397,10 +1397,13 @@ sess_auth_rawntlmssp_negotiate(struct se
cifs_dbg(VFS, "bad security blob length %d\n",
blob_len);
rc = -EINVAL;
- goto out;
+ goto out_free_ntlmsspblob;
}
rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
+
+out_free_ntlmsspblob:
+ kfree(ntlmsspblob);
out:
sess_free_buffer(sess_data);
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0010/1039] f2fs: fix to do sanity check on inode type during garbage collection
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2022-01-24 18:29 ` [PATCH 5.16 0009/1039] cifs: free ntlmsspblob allocated in negotiate Greg Kroah-Hartman
@ 2022-01-24 18:29 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0011/1039] f2fs: fix to do sanity check in is_alive() Greg Kroah-Hartman
` (982 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wenqing Liu, Chao Yu, Jaegeuk Kim
From: Chao Yu <chao@kernel.org>
commit 9056d6489f5a41cfbb67f719d2c0ce61ead72d9f upstream.
As report by Wenqing Liu in bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=215231
- Overview
kernel NULL pointer dereference triggered in folio_mark_dirty() when mount and operate on a crafted f2fs image
- Reproduce
tested on kernel 5.16-rc3, 5.15.X under root
1. mkdir mnt
2. mount -t f2fs tmp1.img mnt
3. touch tmp
4. cp tmp mnt
F2FS-fs (loop0): sanity_check_inode: inode (ino=49) extent info [5942, 4294180864, 4] is incorrect, run fsck to fix
F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=31340049, run fsck to fix.
BUG: kernel NULL pointer dereference, address: 0000000000000000
folio_mark_dirty+0x33/0x50
move_data_page+0x2dd/0x460 [f2fs]
do_garbage_collect+0xc18/0x16a0 [f2fs]
f2fs_gc+0x1d3/0xd90 [f2fs]
f2fs_balance_fs+0x13a/0x570 [f2fs]
f2fs_create+0x285/0x840 [f2fs]
path_openat+0xe6d/0x1040
do_filp_open+0xc5/0x140
do_sys_openat2+0x23a/0x310
do_sys_open+0x57/0x80
The root cause is for special file: e.g. character, block, fifo or socket file,
f2fs doesn't assign address space operations pointer array for mapping->a_ops field,
so, in a fuzzed image, SSA table indicates a data block belong to special file, when
f2fs tries to migrate that block, it causes NULL pointer access once move_data_page()
calls a_ops->set_dirty_page().
Cc: stable@vger.kernel.org
Reported-by: Wenqing Liu <wenqingliu0120@gmail.com>
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/gc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -1457,7 +1457,8 @@ next_step:
if (phase == 3) {
inode = f2fs_iget(sb, dni.ino);
- if (IS_ERR(inode) || is_bad_inode(inode))
+ if (IS_ERR(inode) || is_bad_inode(inode) ||
+ special_file(inode->i_mode))
continue;
if (!down_write_trylock(
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0011/1039] f2fs: fix to do sanity check in is_alive()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2022-01-24 18:29 ` [PATCH 5.16 0010/1039] f2fs: fix to do sanity check on inode type during garbage collection Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0012/1039] f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr() Greg Kroah-Hartman
` (981 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chao Yu, Jaegeuk Kim
From: Chao Yu <chao@kernel.org>
commit 77900c45ee5cd5da63bd4d818a41dbdf367e81cd upstream.
In fuzzed image, SSA table may indicate that a data block belongs to
invalid node, which node ID is out-of-range (0, 1, 2 or max_nid), in
order to avoid migrating inconsistent data in such corrupted image,
let's do sanity check anyway before data block migration.
Cc: stable@vger.kernel.org
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/gc.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -1026,6 +1026,9 @@ static bool is_alive(struct f2fs_sb_info
set_sbi_flag(sbi, SBI_NEED_FSCK);
}
+ if (f2fs_check_nid_range(sbi, dni->ino))
+ return false;
+
*nofs = ofs_of_node(node_page);
source_blkaddr = data_blkaddr(NULL, node_page, ofs_in_node);
f2fs_put_page(node_page, 1);
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0012/1039] f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0011/1039] f2fs: fix to do sanity check in is_alive() Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0013/1039] f2fs: avoid EINVAL by SBI_NEED_FSCK when pinning a file Greg Kroah-Hartman
` (980 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wenqing Liu, Chao Yu, Jaegeuk Kim
From: Chao Yu <chao@kernel.org>
commit 645a3c40ca3d40cc32b4b5972bf2620f2eb5dba6 upstream.
As Wenqing Liu reported in bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=215235
- Overview
page fault in f2fs_setxattr() when mount and operate on corrupted image
- Reproduce
tested on kernel 5.16-rc3, 5.15.X under root
1. unzip tmp7.zip
2. ./single.sh f2fs 7
Sometimes need to run the script several times
- Kernel dump
loop0: detected capacity change from 0 to 131072
F2FS-fs (loop0): Found nat_bits in checkpoint
F2FS-fs (loop0): Mounted with checkpoint version = 7548c2ee
BUG: unable to handle page fault for address: ffffe47bc7123f48
RIP: 0010:kfree+0x66/0x320
Call Trace:
__f2fs_setxattr+0x2aa/0xc00 [f2fs]
f2fs_setxattr+0xfa/0x480 [f2fs]
__f2fs_set_acl+0x19b/0x330 [f2fs]
__vfs_removexattr+0x52/0x70
__vfs_removexattr_locked+0xb1/0x140
vfs_removexattr+0x56/0x100
removexattr+0x57/0x80
path_removexattr+0xa3/0xc0
__x64_sys_removexattr+0x17/0x20
do_syscall_64+0x37/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
The root cause is in __f2fs_setxattr(), we missed to do sanity check on
last xattr entry, result in out-of-bound memory access during updating
inconsistent xattr data of target inode.
After the fix, it can detect such xattr inconsistency as below:
F2FS-fs (loop11): inode (7) has invalid last xattr entry, entry_size: 60676
F2FS-fs (loop11): inode (8) has corrupted xattr
F2FS-fs (loop11): inode (8) has corrupted xattr
F2FS-fs (loop11): inode (8) has invalid last xattr entry, entry_size: 47736
Cc: stable@vger.kernel.org
Reported-by: Wenqing Liu <wenqingliu0120@gmail.com>
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/xattr.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/fs/f2fs/xattr.c
+++ b/fs/f2fs/xattr.c
@@ -684,8 +684,17 @@ static int __f2fs_setxattr(struct inode
}
last = here;
- while (!IS_XATTR_LAST_ENTRY(last))
+ while (!IS_XATTR_LAST_ENTRY(last)) {
+ if ((void *)(last) + sizeof(__u32) > last_base_addr ||
+ (void *)XATTR_NEXT_ENTRY(last) > last_base_addr) {
+ f2fs_err(F2FS_I_SB(inode), "inode (%lu) has invalid last xattr entry, entry_size: %zu",
+ inode->i_ino, ENTRY_SIZE(last));
+ set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK);
+ error = -EFSCORRUPTED;
+ goto exit;
+ }
last = XATTR_NEXT_ENTRY(last);
+ }
newsize = XATTR_ALIGN(sizeof(struct f2fs_xattr_entry) + len + size);
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0013/1039] f2fs: avoid EINVAL by SBI_NEED_FSCK when pinning a file
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0012/1039] f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr() Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0014/1039] nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() Greg Kroah-Hartman
` (979 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jaegeuk Kim
From: Jaegeuk Kim <jaegeuk@kernel.org>
commit 19bdba5265624ba6b9d9dd936a0c6ccc167cfe80 upstream.
Android OTA failed due to SBI_NEED_FSCK flag when pinning the file. Let's avoid
it since we can do in-place-updates.
Cc: stable@vger.kernel.org
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/data.c | 7 +++++--
fs/f2fs/file.c | 10 +++++-----
2 files changed, 10 insertions(+), 7 deletions(-)
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -2617,6 +2617,11 @@ bool f2fs_should_update_outplace(struct
{
struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ /* The below cases were checked when setting it. */
+ if (f2fs_is_pinned_file(inode))
+ return false;
+ if (fio && is_sbi_flag_set(sbi, SBI_NEED_FSCK))
+ return true;
if (f2fs_lfs_mode(sbi))
return true;
if (S_ISDIR(inode->i_mode))
@@ -2625,8 +2630,6 @@ bool f2fs_should_update_outplace(struct
return true;
if (f2fs_is_atomic_file(inode))
return true;
- if (is_sbi_flag_set(sbi, SBI_NEED_FSCK))
- return true;
/* swap file is migrating in aligned write mode */
if (is_inode_flag_set(inode, FI_ALIGNED_WRITE))
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -3143,17 +3143,17 @@ static int f2fs_ioc_set_pin_file(struct
inode_lock(inode);
- if (f2fs_should_update_outplace(inode, NULL)) {
- ret = -EINVAL;
- goto out;
- }
-
if (!pin) {
clear_inode_flag(inode, FI_PIN_FILE);
f2fs_i_gc_failures_write(inode, 0);
goto done;
}
+ if (f2fs_should_update_outplace(inode, NULL)) {
+ ret = -EINVAL;
+ goto out;
+ }
+
if (f2fs_pin_file_control(inode, false)) {
ret = -EAGAIN;
goto out;
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0014/1039] nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0013/1039] f2fs: avoid EINVAL by SBI_NEED_FSCK when pinning a file Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0015/1039] mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings Greg Kroah-Hartman
` (978 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, David S. Miller,
syzbot+7f23bcddf626e0593a39
From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
commit dded08927ca3c31a5c37f8e7f95fe98770475dd4 upstream.
Syzbot detected a NULL pointer dereference of nfc_llcp_sock->dev pointer
(which is a 'struct nfc_dev *') with calls to llcp_sock_sendmsg() after
a failed llcp_sock_bind(). The message being sent is a SOCK_DGRAM.
KASAN report:
BUG: KASAN: null-ptr-deref in nfc_alloc_send_skb+0x2d/0xc0
Read of size 4 at addr 00000000000005c8 by task llcp_sock_nfc_a/899
CPU: 5 PID: 899 Comm: llcp_sock_nfc_a Not tainted 5.16.0-rc6-next-20211224-00001-gc6437fbf18b0 #125
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x45/0x59
? nfc_alloc_send_skb+0x2d/0xc0
__kasan_report.cold+0x117/0x11c
? mark_lock+0x480/0x4f0
? nfc_alloc_send_skb+0x2d/0xc0
kasan_report+0x38/0x50
nfc_alloc_send_skb+0x2d/0xc0
nfc_llcp_send_ui_frame+0x18c/0x2a0
? nfc_llcp_send_i_frame+0x230/0x230
? __local_bh_enable_ip+0x86/0xe0
? llcp_sock_connect+0x470/0x470
? llcp_sock_connect+0x470/0x470
sock_sendmsg+0x8e/0xa0
____sys_sendmsg+0x253/0x3f0
...
The issue was visible only with multiple simultaneous calls to bind() and
sendmsg(), which resulted in most of the bind() calls to fail. The
bind() was failing on checking if there is available WKS/SDP/SAP
(respective bit in 'struct nfc_llcp_local' fields). When there was no
available WKS/SDP/SAP, the bind returned error but the sendmsg() to such
socket was able to trigger mentioned NULL pointer dereference of
nfc_llcp_sock->dev.
The code looks simply racy and currently it protects several paths
against race with checks for (!nfc_llcp_sock->local) which is NULL-ified
in error paths of bind(). The llcp_sock_sendmsg() did not have such
check but called function nfc_llcp_send_ui_frame() had, although not
protected with lock_sock().
Therefore the race could look like (same socket is used all the time):
CPU0 CPU1
==== ====
llcp_sock_bind()
- lock_sock()
- success
- release_sock()
- return 0
llcp_sock_sendmsg()
- lock_sock()
- release_sock()
llcp_sock_bind(), same socket
- lock_sock()
- error
- nfc_llcp_send_ui_frame()
- if (!llcp_sock->local)
- llcp_sock->local = NULL
- nfc_put_device(dev)
- dereference llcp_sock->dev
- release_sock()
- return -ERRNO
The nfc_llcp_send_ui_frame() checked llcp_sock->local outside of the
lock, which is racy and ineffective check. Instead, its caller
llcp_sock_sendmsg(), should perform the check inside lock_sock().
Reported-and-tested-by: syzbot+7f23bcddf626e0593a39@syzkaller.appspotmail.com
Fixes: b874dec21d1c ("NFC: Implement LLCP connection less Tx path")
Cc: <stable@vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/nfc/llcp_sock.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -789,6 +789,11 @@ static int llcp_sock_sendmsg(struct sock
lock_sock(sk);
+ if (!llcp_sock->local) {
+ release_sock(sk);
+ return -ENODEV;
+ }
+
if (sk->sk_type == SOCK_DGRAM) {
DECLARE_SOCKADDR(struct sockaddr_nfc_llcp *, addr,
msg->msg_name);
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0015/1039] mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0014/1039] nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0016/1039] mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6 Greg Kroah-Hartman
` (977 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Riedmueller, Christian Eggers,
Han Xu, Miquel Raynal
From: Christian Eggers <ceggers@arri.de>
commit f53d4c109a666bf1a4883b45d546fba079258717 upstream.
gpmi_io clock needs to be gated off when changing the parent/dividers of
enfc_clk_root (i.MX6Q/i.MX6UL) respectively qspi2_clk_root (i.MX6SX).
Otherwise this rate change can lead to an unresponsive GPMI core which
results in DMA timeouts and failed driver probe:
[ 4.072318] gpmi-nand 112000.gpmi-nand: DMA timeout, last DMA
...
[ 4.370355] gpmi-nand 112000.gpmi-nand: Chip: 0, Error -110
...
[ 4.375988] gpmi-nand 112000.gpmi-nand: Chip: 0, Error -22
[ 4.381524] gpmi-nand 112000.gpmi-nand: Error in ECC-based read: -22
[ 4.387988] gpmi-nand 112000.gpmi-nand: Chip: 0, Error -22
[ 4.393535] gpmi-nand 112000.gpmi-nand: Chip: 0, Error -22
...
Other than stated in i.MX 6 erratum ERR007117, it should be sufficient
to gate only gpmi_io because all other bch/nand clocks are derived from
different clock roots.
The i.MX6 reference manuals state that changing clock muxers can cause
glitches but are silent about changing dividers. But tests showed that
these glitches can definitely happen on i.MX6ULL. For i.MX7D/8MM in turn,
the manual guarantees that no glitches can happen when changing
dividers.
Co-developed-by: Stefan Riedmueller <s.riedmueller@phytec.de>
Signed-off-by: Stefan Riedmueller <s.riedmueller@phytec.de>
Signed-off-by: Christian Eggers <ceggers@arri.de>
Cc: stable@vger.kernel.org
Acked-by: Han Xu <han.xu@nxp.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20211102202022.15551-2-ceggers@arri.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 28 +++++++++++++++++++++++++---
1 file changed, 25 insertions(+), 3 deletions(-)
--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
@@ -713,14 +713,32 @@ static void gpmi_nfc_compute_timings(str
(use_half_period ? BM_GPMI_CTRL1_HALF_PERIOD : 0);
}
-static void gpmi_nfc_apply_timings(struct gpmi_nand_data *this)
+static int gpmi_nfc_apply_timings(struct gpmi_nand_data *this)
{
struct gpmi_nfc_hardware_timing *hw = &this->hw;
struct resources *r = &this->resources;
void __iomem *gpmi_regs = r->gpmi_regs;
unsigned int dll_wait_time_us;
+ int ret;
+
+ /* Clock dividers do NOT guarantee a clean clock signal on its output
+ * during the change of the divide factor on i.MX6Q/UL/SX. On i.MX7/8,
+ * all clock dividers provide these guarantee.
+ */
+ if (GPMI_IS_MX6Q(this) || GPMI_IS_MX6SX(this))
+ clk_disable_unprepare(r->clock[0]);
+
+ ret = clk_set_rate(r->clock[0], hw->clk_rate);
+ if (ret) {
+ dev_err(this->dev, "cannot set clock rate to %lu Hz: %d\n", hw->clk_rate, ret);
+ return ret;
+ }
- clk_set_rate(r->clock[0], hw->clk_rate);
+ if (GPMI_IS_MX6Q(this) || GPMI_IS_MX6SX(this)) {
+ ret = clk_prepare_enable(r->clock[0]);
+ if (ret)
+ return ret;
+ }
writel(hw->timing0, gpmi_regs + HW_GPMI_TIMING0);
writel(hw->timing1, gpmi_regs + HW_GPMI_TIMING1);
@@ -739,6 +757,8 @@ static void gpmi_nfc_apply_timings(struc
/* Wait for the DLL to settle. */
udelay(dll_wait_time_us);
+
+ return 0;
}
static int gpmi_setup_interface(struct nand_chip *chip, int chipnr,
@@ -2278,7 +2298,9 @@ static int gpmi_nfc_exec_op(struct nand_
*/
if (this->hw.must_apply_timings) {
this->hw.must_apply_timings = false;
- gpmi_nfc_apply_timings(this);
+ ret = gpmi_nfc_apply_timings(this);
+ if (ret)
+ return ret;
}
dev_dbg(this->dev, "%s: %d instructions\n", __func__, op->ninstrs);
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0016/1039] mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0015/1039] mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0017/1039] mtd: Fixed breaking list in __mtd_del_partition Greg Kroah-Hartman
` (976 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Riedmueller, Han Xu, Miquel Raynal
From: Stefan Riedmueller <s.riedmueller@phytec.de>
commit aa1baa0e6c1aa4872e481dce4fc7fd6f3dd8496b upstream.
There is no need to explicitly set the default gpmi clock rate during
boot for the i.MX 6 since this is done during nand_detect anyway.
Signed-off-by: Stefan Riedmueller <s.riedmueller@phytec.de>
Cc: stable@vger.kernel.org
Acked-by: Han Xu <han.xu@nxp.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20211102202022.15551-1-ceggers@arri.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 9 ---------
1 file changed, 9 deletions(-)
--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
@@ -1052,15 +1052,6 @@ static int gpmi_get_clks(struct gpmi_nan
r->clock[i] = clk;
}
- if (GPMI_IS_MX6(this))
- /*
- * Set the default value for the gpmi clock.
- *
- * If you want to use the ONFI nand which is in the
- * Synchronous Mode, you should change the clock as you need.
- */
- clk_set_rate(r->clock[0], 22000000);
-
return 0;
err_clock:
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0017/1039] mtd: Fixed breaking list in __mtd_del_partition.
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0016/1039] mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6 Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0018/1039] mtd: rawnand: davinci: Dont calculate ECC when reading page Greg Kroah-Hartman
` (975 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Andreas Oetken, Miquel Raynal
From: Andreas Oetken <ennoerlangen@gmail.com>
commit 2966daf7d253d9904b337b040dd7a43472858b8a upstream.
Not the child partition should be removed from the partition list
but the partition itself. Otherwise the partition list gets broken
and any subsequent remove operations leads to a kernel panic.
Fixes: 46b5889cc2c5 ("mtd: implement proper partition handling")
Signed-off-by: Andreas Oetken <andreas.oetken@siemens-energy.com>
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20211102172604.2921065-1-andreas.oetken@siemens-energy.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/mtdpart.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -312,7 +312,7 @@ static int __mtd_del_partition(struct mt
if (err)
return err;
- list_del(&child->part.node);
+ list_del(&mtd->part.node);
free_partition(mtd);
return 0;
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0018/1039] mtd: rawnand: davinci: Dont calculate ECC when reading page
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0017/1039] mtd: Fixed breaking list in __mtd_del_partition Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0019/1039] mtd: rawnand: davinci: Avoid duplicated page read Greg Kroah-Hartman
` (974 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Miquel Raynal
From: Paul Cercueil <paul@crapouillou.net>
commit 71e89591502d737c10db2bd4d8fcfaa352552afb upstream.
The function nand_davinci_read_page_hwecc_oob_first() does read the ECC
data from the OOB area. Therefore it does not need to calculate the ECC
as it is already available.
Cc: <stable@vger.kernel.org> # v5.2
Fixes: a0ac778eb82c ("mtd: rawnand: ingenic: Add support for the JZ4740")
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20211016132228.40254-1-paul@crapouillou.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/davinci_nand.c | 3 ---
1 file changed, 3 deletions(-)
--- a/drivers/mtd/nand/raw/davinci_nand.c
+++ b/drivers/mtd/nand/raw/davinci_nand.c
@@ -394,7 +394,6 @@ static int nand_davinci_read_page_hwecc_
int eccsteps = chip->ecc.steps;
uint8_t *p = buf;
uint8_t *ecc_code = chip->ecc.code_buf;
- uint8_t *ecc_calc = chip->ecc.calc_buf;
unsigned int max_bitflips = 0;
/* Read the OOB area first */
@@ -420,8 +419,6 @@ static int nand_davinci_read_page_hwecc_
if (ret)
return ret;
- chip->ecc.calculate(chip, p, &ecc_calc[i]);
-
stat = chip->ecc.correct(chip, p, &ecc_code[i], NULL);
if (stat == -EBADMSG &&
(chip->ecc.options & NAND_ECC_GENERIC_ERASED_CHECK)) {
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0019/1039] mtd: rawnand: davinci: Avoid duplicated page read
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0018/1039] mtd: rawnand: davinci: Dont calculate ECC when reading page Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0020/1039] mtd: rawnand: davinci: Rewrite function description Greg Kroah-Hartman
` (973 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Miquel Raynal
From: Paul Cercueil <paul@crapouillou.net>
commit 9c9d709965385de5a99f84b14bd5860e1541729e upstream.
The function nand_davinci_read_page_hwecc_oob_first() first reads the
OOB data, extracts the ECC information, programs the ECC hardware before
reading the actual data in a loop.
Right after the OOB data was read, it called nand_read_page_op() to
reset the read cursor to the beginning of the page. This caused the
first page to be read twice: in that call, and later in the loop.
Address that issue by changing the call to nand_read_page_op() to
nand_change_read_column_op(), which will only reset the read cursor.
Cc: <stable@vger.kernel.org> # v5.2
Fixes: a0ac778eb82c ("mtd: rawnand: ingenic: Add support for the JZ4740")
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20211016132228.40254-2-paul@crapouillou.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/davinci_nand.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/mtd/nand/raw/davinci_nand.c
+++ b/drivers/mtd/nand/raw/davinci_nand.c
@@ -401,7 +401,8 @@ static int nand_davinci_read_page_hwecc_
if (ret)
return ret;
- ret = nand_read_page_op(chip, page, 0, NULL, 0);
+ /* Move read cursor to start of page */
+ ret = nand_change_read_column_op(chip, 0, NULL, 0, false);
if (ret)
return ret;
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0020/1039] mtd: rawnand: davinci: Rewrite function description
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0019/1039] mtd: rawnand: davinci: Avoid duplicated page read Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0021/1039] mtd: rawnand: Export nand_read_page_hwecc_oob_first() Greg Kroah-Hartman
` (972 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Miquel Raynal
From: Paul Cercueil <paul@crapouillou.net>
commit 0697f8441faad552fbeb02d74454b5e7bcc956a2 upstream.
The original comment that describes the function
nand_davinci_read_page_hwecc_oob_first() is very obscure and it is hard
to understand what it is for.
Cc: <stable@vger.kernel.org> # v5.2
Fixes: a0ac778eb82c ("mtd: rawnand: ingenic: Add support for the JZ4740")
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20211016132228.40254-3-paul@crapouillou.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/davinci_nand.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
--- a/drivers/mtd/nand/raw/davinci_nand.c
+++ b/drivers/mtd/nand/raw/davinci_nand.c
@@ -372,17 +372,15 @@ correct:
}
/**
- * nand_read_page_hwecc_oob_first - hw ecc, read oob first
+ * nand_davinci_read_page_hwecc_oob_first - Hardware ECC page read with ECC
+ * data read from OOB area
* @chip: nand chip info structure
* @buf: buffer to store read data
* @oob_required: caller requires OOB data read to chip->oob_poi
* @page: page number to read
*
- * Hardware ECC for large page chips, require OOB to be read first. For this
- * ECC mode, the write_page method is re-used from ECC_HW. These methods
- * read/write ECC from the OOB area, unlike the ECC_HW_SYNDROME support with
- * multiple ECC steps, follows the "infix ECC" scheme and reads/writes ECC from
- * the data area, by overwriting the NAND manufacturer bad block markings.
+ * Hardware ECC for large page chips, which requires the ECC data to be
+ * extracted from the OOB before the actual data is read.
*/
static int nand_davinci_read_page_hwecc_oob_first(struct nand_chip *chip,
uint8_t *buf,
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0021/1039] mtd: rawnand: Export nand_read_page_hwecc_oob_first()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0020/1039] mtd: rawnand: davinci: Rewrite function description Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0022/1039] mtd: rawnand: ingenic: JZ4740 needs oob_first read page function Greg Kroah-Hartman
` (971 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Miquel Raynal
From: Paul Cercueil <paul@crapouillou.net>
commit d8466f73010faf71effb21228ae1cbf577dab130 upstream.
Move the function nand_read_page_hwecc_oob_first() (previously
nand_davinci_read_page_hwecc_oob_first()) to nand_base.c, and export it
as a GPL symbol, so that it can be used by more modules.
Cc: <stable@vger.kernel.org> # v5.2
Fixes: a0ac778eb82c ("mtd: rawnand: ingenic: Add support for the JZ4740")
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20211016132228.40254-4-paul@crapouillou.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/davinci_nand.c | 69 ------------------------------------
drivers/mtd/nand/raw/nand_base.c | 67 ++++++++++++++++++++++++++++++++++
include/linux/mtd/rawnand.h | 2 +
3 files changed, 70 insertions(+), 68 deletions(-)
--- a/drivers/mtd/nand/raw/davinci_nand.c
+++ b/drivers/mtd/nand/raw/davinci_nand.c
@@ -371,73 +371,6 @@ correct:
return corrected;
}
-/**
- * nand_davinci_read_page_hwecc_oob_first - Hardware ECC page read with ECC
- * data read from OOB area
- * @chip: nand chip info structure
- * @buf: buffer to store read data
- * @oob_required: caller requires OOB data read to chip->oob_poi
- * @page: page number to read
- *
- * Hardware ECC for large page chips, which requires the ECC data to be
- * extracted from the OOB before the actual data is read.
- */
-static int nand_davinci_read_page_hwecc_oob_first(struct nand_chip *chip,
- uint8_t *buf,
- int oob_required, int page)
-{
- struct mtd_info *mtd = nand_to_mtd(chip);
- int i, eccsize = chip->ecc.size, ret;
- int eccbytes = chip->ecc.bytes;
- int eccsteps = chip->ecc.steps;
- uint8_t *p = buf;
- uint8_t *ecc_code = chip->ecc.code_buf;
- unsigned int max_bitflips = 0;
-
- /* Read the OOB area first */
- ret = nand_read_oob_op(chip, page, 0, chip->oob_poi, mtd->oobsize);
- if (ret)
- return ret;
-
- /* Move read cursor to start of page */
- ret = nand_change_read_column_op(chip, 0, NULL, 0, false);
- if (ret)
- return ret;
-
- ret = mtd_ooblayout_get_eccbytes(mtd, ecc_code, chip->oob_poi, 0,
- chip->ecc.total);
- if (ret)
- return ret;
-
- for (i = 0; eccsteps; eccsteps--, i += eccbytes, p += eccsize) {
- int stat;
-
- chip->ecc.hwctl(chip, NAND_ECC_READ);
-
- ret = nand_read_data_op(chip, p, eccsize, false, false);
- if (ret)
- return ret;
-
- stat = chip->ecc.correct(chip, p, &ecc_code[i], NULL);
- if (stat == -EBADMSG &&
- (chip->ecc.options & NAND_ECC_GENERIC_ERASED_CHECK)) {
- /* check for empty pages with bitflips */
- stat = nand_check_erased_ecc_chunk(p, eccsize,
- &ecc_code[i],
- eccbytes, NULL, 0,
- chip->ecc.strength);
- }
-
- if (stat < 0) {
- mtd->ecc_stats.failed++;
- } else {
- mtd->ecc_stats.corrected += stat;
- max_bitflips = max_t(unsigned int, max_bitflips, stat);
- }
- }
- return max_bitflips;
-}
-
/*----------------------------------------------------------------------*/
/* An ECC layout for using 4-bit ECC with small-page flash, storing
@@ -647,7 +580,7 @@ static int davinci_nand_attach_chip(stru
} else if (chunks == 4 || chunks == 8) {
mtd_set_ooblayout(mtd,
nand_get_large_page_ooblayout());
- chip->ecc.read_page = nand_davinci_read_page_hwecc_oob_first;
+ chip->ecc.read_page = nand_read_page_hwecc_oob_first;
} else {
return -EIO;
}
--- a/drivers/mtd/nand/raw/nand_base.c
+++ b/drivers/mtd/nand/raw/nand_base.c
@@ -3161,6 +3161,73 @@ static int nand_read_page_hwecc(struct n
}
/**
+ * nand_read_page_hwecc_oob_first - Hardware ECC page read with ECC
+ * data read from OOB area
+ * @chip: nand chip info structure
+ * @buf: buffer to store read data
+ * @oob_required: caller requires OOB data read to chip->oob_poi
+ * @page: page number to read
+ *
+ * Hardware ECC for large page chips, which requires the ECC data to be
+ * extracted from the OOB before the actual data is read.
+ */
+int nand_read_page_hwecc_oob_first(struct nand_chip *chip, uint8_t *buf,
+ int oob_required, int page)
+{
+ struct mtd_info *mtd = nand_to_mtd(chip);
+ int i, eccsize = chip->ecc.size, ret;
+ int eccbytes = chip->ecc.bytes;
+ int eccsteps = chip->ecc.steps;
+ uint8_t *p = buf;
+ uint8_t *ecc_code = chip->ecc.code_buf;
+ unsigned int max_bitflips = 0;
+
+ /* Read the OOB area first */
+ ret = nand_read_oob_op(chip, page, 0, chip->oob_poi, mtd->oobsize);
+ if (ret)
+ return ret;
+
+ /* Move read cursor to start of page */
+ ret = nand_change_read_column_op(chip, 0, NULL, 0, false);
+ if (ret)
+ return ret;
+
+ ret = mtd_ooblayout_get_eccbytes(mtd, ecc_code, chip->oob_poi, 0,
+ chip->ecc.total);
+ if (ret)
+ return ret;
+
+ for (i = 0; eccsteps; eccsteps--, i += eccbytes, p += eccsize) {
+ int stat;
+
+ chip->ecc.hwctl(chip, NAND_ECC_READ);
+
+ ret = nand_read_data_op(chip, p, eccsize, false, false);
+ if (ret)
+ return ret;
+
+ stat = chip->ecc.correct(chip, p, &ecc_code[i], NULL);
+ if (stat == -EBADMSG &&
+ (chip->ecc.options & NAND_ECC_GENERIC_ERASED_CHECK)) {
+ /* check for empty pages with bitflips */
+ stat = nand_check_erased_ecc_chunk(p, eccsize,
+ &ecc_code[i],
+ eccbytes, NULL, 0,
+ chip->ecc.strength);
+ }
+
+ if (stat < 0) {
+ mtd->ecc_stats.failed++;
+ } else {
+ mtd->ecc_stats.corrected += stat;
+ max_bitflips = max_t(unsigned int, max_bitflips, stat);
+ }
+ }
+ return max_bitflips;
+}
+EXPORT_SYMBOL_GPL(nand_read_page_hwecc_oob_first);
+
+/**
* nand_read_page_syndrome - [REPLACEABLE] hardware ECC syndrome based page read
* @chip: nand chip info structure
* @buf: buffer to store read data
--- a/include/linux/mtd/rawnand.h
+++ b/include/linux/mtd/rawnand.h
@@ -1539,6 +1539,8 @@ int nand_read_data_op(struct nand_chip *
bool force_8bit, bool check_only);
int nand_write_data_op(struct nand_chip *chip, const void *buf,
unsigned int len, bool force_8bit);
+int nand_read_page_hwecc_oob_first(struct nand_chip *chip, uint8_t *buf,
+ int oob_required, int page);
/* Scan and identify a NAND device */
int nand_scan_with_ids(struct nand_chip *chip, unsigned int max_chips,
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0022/1039] mtd: rawnand: ingenic: JZ4740 needs oob_first read page function
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0021/1039] mtd: rawnand: Export nand_read_page_hwecc_oob_first() Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0023/1039] riscv: Get rid of MAXPHYSMEM configs Greg Kroah-Hartman
` (970 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Miquel Raynal
From: Paul Cercueil <paul@crapouillou.net>
commit 0171480007d64f663aae9226303f1b1e4621229e upstream.
The ECC engine on the JZ4740 SoC requires the ECC data to be read before
the page; using the default page reading function does not work. Indeed,
the old JZ4740 NAND driver (removed in 5.4) did use the 'OOB first' flag
that existed back then.
Use the newly created nand_read_page_hwecc_oob_first() to address this
issue.
This issue was not found when the new ingenic-nand driver was developed,
most likely because the Device Tree used had the nand-ecc-mode set to
"hw_oob_first", which seems to not be supported anymore.
Cc: <stable@vger.kernel.org> # v5.2
Fixes: a0ac778eb82c ("mtd: rawnand: ingenic: Add support for the JZ4740")
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20211016132228.40254-5-paul@crapouillou.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/ingenic/ingenic_nand_drv.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/mtd/nand/raw/ingenic/ingenic_nand_drv.c
+++ b/drivers/mtd/nand/raw/ingenic/ingenic_nand_drv.c
@@ -32,6 +32,7 @@ struct jz_soc_info {
unsigned long addr_offset;
unsigned long cmd_offset;
const struct mtd_ooblayout_ops *oob_layout;
+ bool oob_first;
};
struct ingenic_nand_cs {
@@ -240,6 +241,9 @@ static int ingenic_nand_attach_chip(stru
if (chip->bbt_options & NAND_BBT_USE_FLASH)
chip->bbt_options |= NAND_BBT_NO_OOB;
+ if (nfc->soc_info->oob_first)
+ chip->ecc.read_page = nand_read_page_hwecc_oob_first;
+
/* For legacy reasons we use a different layout on the qi,lb60 board. */
if (of_machine_is_compatible("qi,lb60"))
mtd_set_ooblayout(mtd, &qi_lb60_ooblayout_ops);
@@ -534,6 +538,7 @@ static const struct jz_soc_info jz4740_s
.data_offset = 0x00000000,
.cmd_offset = 0x00008000,
.addr_offset = 0x00010000,
+ .oob_first = true,
};
static const struct jz_soc_info jz4725b_soc_info = {
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0023/1039] riscv: Get rid of MAXPHYSMEM configs
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0022/1039] mtd: rawnand: ingenic: JZ4740 needs oob_first read page function Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0024/1039] RISC-V: Use common riscv_cpuid_to_hartid_mask() for both SMP=y and SMP=n Greg Kroah-Hartman
` (969 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Alexandre Ghiti,
Conor Dooley, Palmer Dabbelt
From: Alexandre Ghiti <alexandre.ghiti@canonical.com>
commit db1503d355a79d1d4255a9996f20e72848b74a56 upstream.
CONFIG_MAXPHYSMEM_* are actually never used, even the nommu defconfigs
selecting the MAXPHYSMEM_2GB had no effects on PAGE_OFFSET since it was
preempted by !MMU case right before.
In addition, the move of the kernel mapping at the end of the address
space broke the use of MAXPHYSMEM_2G with MMU since it defines PAGE_OFFSET
at the same address as the kernel mapping.
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Fixes: 2bfc6cd81bd1 ("riscv: Move kernel mapping outside of linear mapping")
Signed-off-by: Alexandre Ghiti <alexandre.ghiti@canonical.com>
Tested-by: Geert Uytterhoeven <geert@linux-m68k.org>
Tested-by: Conor Dooley <Conor.Dooley@microchip.com>
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/Kconfig | 23 ++---------------------
arch/riscv/configs/nommu_k210_defconfig | 2 --
arch/riscv/configs/nommu_k210_sdcard_defconfig | 2 --
arch/riscv/configs/nommu_virt_defconfig | 1 -
4 files changed, 2 insertions(+), 26 deletions(-)
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -158,10 +158,9 @@ config PA_BITS
config PAGE_OFFSET
hex
- default 0xC0000000 if 32BIT && MAXPHYSMEM_1GB
+ default 0xC0000000 if 32BIT
default 0x80000000 if 64BIT && !MMU
- default 0xffffffff80000000 if 64BIT && MAXPHYSMEM_2GB
- default 0xffffffe000000000 if 64BIT && MAXPHYSMEM_128GB
+ default 0xffffffe000000000 if 64BIT
config KASAN_SHADOW_OFFSET
hex
@@ -270,24 +269,6 @@ config MODULE_SECTIONS
bool
select HAVE_MOD_ARCH_SPECIFIC
-choice
- prompt "Maximum Physical Memory"
- default MAXPHYSMEM_1GB if 32BIT
- default MAXPHYSMEM_2GB if 64BIT && CMODEL_MEDLOW
- default MAXPHYSMEM_128GB if 64BIT && CMODEL_MEDANY
-
- config MAXPHYSMEM_1GB
- depends on 32BIT
- bool "1GiB"
- config MAXPHYSMEM_2GB
- depends on 64BIT && CMODEL_MEDLOW
- bool "2GiB"
- config MAXPHYSMEM_128GB
- depends on 64BIT && CMODEL_MEDANY
- bool "128GiB"
-endchoice
-
-
config SMP
bool "Symmetric Multi-Processing"
help
--- a/arch/riscv/configs/nommu_k210_defconfig
+++ b/arch/riscv/configs/nommu_k210_defconfig
@@ -29,8 +29,6 @@ CONFIG_EMBEDDED=y
CONFIG_SLOB=y
# CONFIG_MMU is not set
CONFIG_SOC_CANAAN=y
-CONFIG_SOC_CANAAN_K210_DTB_SOURCE="k210_generic"
-CONFIG_MAXPHYSMEM_2GB=y
CONFIG_SMP=y
CONFIG_NR_CPUS=2
CONFIG_CMDLINE="earlycon console=ttySIF0"
--- a/arch/riscv/configs/nommu_k210_sdcard_defconfig
+++ b/arch/riscv/configs/nommu_k210_sdcard_defconfig
@@ -21,8 +21,6 @@ CONFIG_EMBEDDED=y
CONFIG_SLOB=y
# CONFIG_MMU is not set
CONFIG_SOC_CANAAN=y
-CONFIG_SOC_CANAAN_K210_DTB_SOURCE="k210_generic"
-CONFIG_MAXPHYSMEM_2GB=y
CONFIG_SMP=y
CONFIG_NR_CPUS=2
CONFIG_CMDLINE="earlycon console=ttySIF0 rootdelay=2 root=/dev/mmcblk0p1 ro"
--- a/arch/riscv/configs/nommu_virt_defconfig
+++ b/arch/riscv/configs/nommu_virt_defconfig
@@ -27,7 +27,6 @@ CONFIG_SLOB=y
# CONFIG_SLAB_MERGE_DEFAULT is not set
# CONFIG_MMU is not set
CONFIG_SOC_VIRT=y
-CONFIG_MAXPHYSMEM_2GB=y
CONFIG_SMP=y
CONFIG_CMDLINE="root=/dev/vda rw earlycon=uart8250,mmio,0x10000000,115200n8 console=ttyS0"
CONFIG_CMDLINE_FORCE=y
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0024/1039] RISC-V: Use common riscv_cpuid_to_hartid_mask() for both SMP=y and SMP=n
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0023/1039] riscv: Get rid of MAXPHYSMEM configs Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0025/1039] riscv: try to allocate crashkern region from 32bit addressible memory Greg Kroah-Hartman
` (968 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Adam Borowski, Anup Patel,
Sean Christopherson, Palmer Dabbelt
From: Sean Christopherson <seanjc@google.com>
commit 869c70609248102f3a2e95a39b6233ff6ea2c932 upstream.
Use what is currently the SMP=y version of riscv_cpuid_to_hartid_mask()
for both SMP=y and SMP=n to fix a build failure with KVM=m and SMP=n due
to boot_cpu_hartid not being exported. This also fixes a second bug
where the SMP=n version assumes the sole CPU in the system is in the
incoming mask, which may not hold true in kvm_riscv_vcpu_sbi_ecall() if
the KVM guest VM has multiple vCPUs (on a SMP=n system).
Fixes: 1ef46c231df4 ("RISC-V: Implement new SBI v0.2 extensions")
Reported-by: Adam Borowski <kilobyte@angband.pl>
Reviewed-by: Anup Patel <anup.patel@wdc.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/include/asm/smp.h | 10 ++--------
arch/riscv/kernel/setup.c | 10 ++++++++++
arch/riscv/kernel/smp.c | 10 ----------
3 files changed, 12 insertions(+), 18 deletions(-)
--- a/arch/riscv/include/asm/smp.h
+++ b/arch/riscv/include/asm/smp.h
@@ -43,7 +43,6 @@ void arch_send_call_function_ipi_mask(st
void arch_send_call_function_single_ipi(int cpu);
int riscv_hartid_to_cpuid(int hartid);
-void riscv_cpuid_to_hartid_mask(const struct cpumask *in, struct cpumask *out);
/* Set custom IPI operations */
void riscv_set_ipi_ops(const struct riscv_ipi_ops *ops);
@@ -85,13 +84,6 @@ static inline unsigned long cpuid_to_har
return boot_cpu_hartid;
}
-static inline void riscv_cpuid_to_hartid_mask(const struct cpumask *in,
- struct cpumask *out)
-{
- cpumask_clear(out);
- cpumask_set_cpu(boot_cpu_hartid, out);
-}
-
static inline void riscv_set_ipi_ops(const struct riscv_ipi_ops *ops)
{
}
@@ -102,6 +94,8 @@ static inline void riscv_clear_ipi(void)
#endif /* CONFIG_SMP */
+void riscv_cpuid_to_hartid_mask(const struct cpumask *in, struct cpumask *out);
+
#if defined(CONFIG_HOTPLUG_CPU) && (CONFIG_SMP)
bool cpu_has_hotplug(unsigned int cpu);
#else
--- a/arch/riscv/kernel/setup.c
+++ b/arch/riscv/kernel/setup.c
@@ -59,6 +59,16 @@ atomic_t hart_lottery __section(".sdata"
unsigned long boot_cpu_hartid;
static DEFINE_PER_CPU(struct cpu, cpu_devices);
+void riscv_cpuid_to_hartid_mask(const struct cpumask *in, struct cpumask *out)
+{
+ int cpu;
+
+ cpumask_clear(out);
+ for_each_cpu(cpu, in)
+ cpumask_set_cpu(cpuid_to_hartid_map(cpu), out);
+}
+EXPORT_SYMBOL_GPL(riscv_cpuid_to_hartid_mask);
+
/*
* Place kernel memory regions on the resource tree so that
* kexec-tools can retrieve them from /proc/iomem. While there
--- a/arch/riscv/kernel/smp.c
+++ b/arch/riscv/kernel/smp.c
@@ -59,16 +59,6 @@ int riscv_hartid_to_cpuid(int hartid)
return -ENOENT;
}
-void riscv_cpuid_to_hartid_mask(const struct cpumask *in, struct cpumask *out)
-{
- int cpu;
-
- cpumask_clear(out);
- for_each_cpu(cpu, in)
- cpumask_set_cpu(cpuid_to_hartid_map(cpu), out);
-}
-EXPORT_SYMBOL_GPL(riscv_cpuid_to_hartid_mask);
-
bool arch_match_cpu_phys_id(int cpu, u64 phys_id)
{
return phys_id == cpuid_to_hartid_map(cpu);
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0025/1039] riscv: try to allocate crashkern region from 32bit addressible memory
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0024/1039] RISC-V: Use common riscv_cpuid_to_hartid_mask() for both SMP=y and SMP=n Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0026/1039] riscv: Dont use va_pa_offset on kdump Greg Kroah-Hartman
` (967 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nick Kossifidis, Palmer Dabbelt
From: Nick Kossifidis <mick@ics.forth.gr>
commit decf89f86ecd3c3c3de81c562010d5797bea3de1 upstream.
When allocating crash kernel region without explicitly specifying its
base address/size, memblock_phys_alloc_range will attempt to allocate
memory top to bottom (memblock.bottom_up is false), so the crash
kernel region will end up in highmem on 64bit systems. This way
swiotlb can't work on the crash kernel, since there won't be any
32bit addressible memory available for the bounce buffers.
Try to allocate 32bit addressible memory if available, for the
crash kernel by restricting the top search address to be less
than SZ_4G. If that fails fallback to the previous behavior.
I tested this on HiFive Unmatched where the pci-e controller needs
swiotlb to work, with this patch it's possible to access the pci-e
controller on crash kernel and mount the rootfs from the nvme.
Signed-off-by: Nick Kossifidis <mick@ics.forth.gr>
Fixes: e53d28180d4d ("RISC-V: Add kdump support")
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/mm/init.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -812,13 +812,22 @@ static void __init reserve_crashkernel(v
/*
* Current riscv boot protocol requires 2MB alignment for
* RV64 and 4MB alignment for RV32 (hugepage size)
+ *
+ * Try to alloc from 32bit addressible physical memory so that
+ * swiotlb can work on the crash kernel.
*/
crash_base = memblock_phys_alloc_range(crash_size, PMD_SIZE,
- search_start, search_end);
+ search_start,
+ min(search_end, (unsigned long) SZ_4G));
if (crash_base == 0) {
- pr_warn("crashkernel: couldn't allocate %lldKB\n",
- crash_size >> 10);
- return;
+ /* Try again without restricting region to 32bit addressible memory */
+ crash_base = memblock_phys_alloc_range(crash_size, PMD_SIZE,
+ search_start, search_end);
+ if (crash_base == 0) {
+ pr_warn("crashkernel: couldn't allocate %lldKB\n",
+ crash_size >> 10);
+ return;
+ }
}
pr_info("crashkernel: reserved 0x%016llx - 0x%016llx (%lld MB)\n",
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0026/1039] riscv: Dont use va_pa_offset on kdump
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0025/1039] riscv: try to allocate crashkern region from 32bit addressible memory Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0027/1039] riscv: use hart id instead of cpu id on machine_kexec Greg Kroah-Hartman
` (966 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nick Kossifidis, Alexandre Ghiti,
Palmer Dabbelt
From: Nick Kossifidis <mick@ics.forth.gr>
commit a11c07f032a0e9a562a32ece73af96b0e754c4b3 upstream.
On kdump instead of using an intermediate step to relocate the kernel,
that lives in a "control buffer" outside the current kernel's mapping,
we jump to the crash kernel directly by calling riscv_kexec_norelocate().
The current implementation uses va_pa_offset while switching to physical
addressing, however since we moved the kernel outside the linear mapping
this won't work anymore since riscv_kexec_norelocate() is part of the
kernel mapping and we should use kernel_map.va_kernel_pa_offset, and also
take XIP kernel into account.
We don't really need to use va_pa_offset on riscv_kexec_norelocate, we
can just set STVEC to the physical address of the new kernel instead and
let the hart jump to the new kernel on the next instruction after setting
SATP to zero. This fixes kdump and is also simpler/cleaner.
I tested this on the latest qemu and HiFive Unmatched and works as
expected.
Fixes: 2bfc6cd81bd1 ("riscv: Move kernel mapping outside of linear mapping")
Signed-off-by: Nick Kossifidis <mick@ics.forth.gr>
Reviewed-by: Alexandre Ghiti <alex@ghiti.fr>
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/kernel/kexec_relocate.S | 20 +++++++++-----------
1 file changed, 9 insertions(+), 11 deletions(-)
--- a/arch/riscv/kernel/kexec_relocate.S
+++ b/arch/riscv/kernel/kexec_relocate.S
@@ -159,25 +159,15 @@ SYM_CODE_START(riscv_kexec_norelocate)
* s0: (const) Phys address to jump to
* s1: (const) Phys address of the FDT image
* s2: (const) The hartid of the current hart
- * s3: (const) kernel_map.va_pa_offset, used when switching MMU off
*/
mv s0, a1
mv s1, a2
mv s2, a3
- mv s3, a4
/* Disable / cleanup interrupts */
csrw CSR_SIE, zero
csrw CSR_SIP, zero
- /* Switch to physical addressing */
- la s4, 1f
- sub s4, s4, s3
- csrw CSR_STVEC, s4
- csrw CSR_SATP, zero
-
-.align 2
-1:
/* Pass the arguments to the next kernel / Cleanup*/
mv a0, s2
mv a1, s1
@@ -214,7 +204,15 @@ SYM_CODE_START(riscv_kexec_norelocate)
csrw CSR_SCAUSE, zero
csrw CSR_SSCRATCH, zero
- jalr zero, a2, 0
+ /*
+ * Switch to physical addressing
+ * This will also trigger a jump to CSR_STVEC
+ * which in this case is the address of the new
+ * kernel.
+ */
+ csrw CSR_STVEC, a2
+ csrw CSR_SATP, zero
+
SYM_CODE_END(riscv_kexec_norelocate)
.section ".rodata"
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0027/1039] riscv: use hart id instead of cpu id on machine_kexec
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0026/1039] riscv: Dont use va_pa_offset on kdump Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0028/1039] riscv: mm: fix wrong phys_ram_base value for RV64 Greg Kroah-Hartman
` (965 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nick Kossifidis, Palmer Dabbelt
From: Nick Kossifidis <mick@ics.forth.gr>
commit 0e105f1d0037d677dff3c697d22f9551e6c39af8 upstream.
raw_smp_processor_id() doesn't return the hart id as stated in
arch/riscv/include/asm/smp.h, use smp_processor_id() instead
to get the cpu id, and cpuid_to_hartid_map() to pass the hart id
to the next kernel. This fixes kexec on HiFive Unleashed/Unmatched
where cpu ids and hart ids don't match (on qemu-virt they match).
Fixes: fba8a8674f68 ("RISC-V: Add kexec support")
Signed-off-by: Nick Kossifidis <mick@ics.forth.gr>
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/kernel/machine_kexec.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/arch/riscv/kernel/machine_kexec.c
+++ b/arch/riscv/kernel/machine_kexec.c
@@ -169,7 +169,8 @@ machine_kexec(struct kimage *image)
struct kimage_arch *internal = &image->arch;
unsigned long jump_addr = (unsigned long) image->start;
unsigned long first_ind_entry = (unsigned long) &image->head;
- unsigned long this_hart_id = raw_smp_processor_id();
+ unsigned long this_cpu_id = smp_processor_id();
+ unsigned long this_hart_id = cpuid_to_hartid_map(this_cpu_id);
unsigned long fdt_addr = internal->fdt_addr;
void *control_code_buffer = page_address(image->control_code_page);
riscv_kexec_method kexec_method = NULL;
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0028/1039] riscv: mm: fix wrong phys_ram_base value for RV64
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0027/1039] riscv: use hart id instead of cpu id on machine_kexec Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0029/1039] x86/gpu: Reserve stolen memory for first integrated Intel GPU Greg Kroah-Hartman
` (964 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jisheng Zhang, Alexandre Ghiti,
Palmer Dabbelt
From: Jisheng Zhang <jszhang@kernel.org>
commit b0fd4b1bf995172b9efcee23600d4f69571c321c upstream.
Currently, if 64BIT and !XIP_KERNEL, the phys_ram_base is always 0,
no matter the real start of dram reported by memblock is.
Fixes: 6d7f91d914bc ("riscv: Get rid of CONFIG_PHYS_RAM_BASE in kernel physical address conversion")
Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
Reviewed-by: Alexandre Ghiti <alex@ghiti.fr>
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/mm/init.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -187,10 +187,10 @@ static void __init setup_bootmem(void)
phys_ram_end = memblock_end_of_DRAM();
-#ifndef CONFIG_64BIT
#ifndef CONFIG_XIP_KERNEL
phys_ram_base = memblock_start_of_DRAM();
#endif
+#ifndef CONFIG_64BIT
/*
* memblock allocator is not aware of the fact that last 4K bytes of
* the addressable memory can not be mapped because of IS_ERR_VALUE
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0029/1039] x86/gpu: Reserve stolen memory for first integrated Intel GPU
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0028/1039] riscv: mm: fix wrong phys_ram_base value for RV64 Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0030/1039] tools/nolibc: x86-64: Fix startup code bug Greg Kroah-Hartman
` (963 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lucas De Marchi, Bjorn Helgaas
From: Lucas De Marchi <lucas.demarchi@intel.com>
commit 9c494ca4d3a535f9ca11ad6af1813983c1c6cbdd upstream.
"Stolen memory" is memory set aside for use by an Intel integrated GPU.
The intel_graphics_quirks() early quirk reserves this memory when it is
called for a GPU that appears in the intel_early_ids[] table of integrated
GPUs.
Previously intel_graphics_quirks() was marked as QFLAG_APPLY_ONCE, so it
was called only for the first Intel GPU found. If a discrete GPU happened
to be enumerated first, intel_graphics_quirks() was called for it but not
for any integrated GPU found later. Therefore, stolen memory for such an
integrated GPU was never reserved.
For example, this problem occurs in this Alderlake-P (integrated) + DG2
(discrete) topology where the DG2 is found first, but stolen memory is
associated with the integrated GPU:
- 00:01.0 Bridge
`- 03:00.0 DG2 discrete GPU
- 00:02.0 Integrated GPU (with stolen memory)
Remove the QFLAG_APPLY_ONCE flag and call intel_graphics_quirks() for every
Intel GPU. Reserve stolen memory for the first GPU that appears in
intel_early_ids[].
[bhelgaas: commit log, add code comment, squash in
https://lore.kernel.org/r/20220118190558.2ququ4vdfjuahicm@ldmartin-desk2]
Link: https://lore.kernel.org/r/20220114002843.2083382-1-lucas.demarchi@intel.com
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/early-quirks.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/arch/x86/kernel/early-quirks.c
+++ b/arch/x86/kernel/early-quirks.c
@@ -515,6 +515,7 @@ static const struct intel_early_ops gen1
.stolen_size = gen9_stolen_size,
};
+/* Intel integrated GPUs for which we need to reserve "stolen memory" */
static const struct pci_device_id intel_early_ids[] __initconst = {
INTEL_I830_IDS(&i830_early_ops),
INTEL_I845G_IDS(&i845_early_ops),
@@ -591,6 +592,13 @@ static void __init intel_graphics_quirks
u16 device;
int i;
+ /*
+ * Reserve "stolen memory" for an integrated GPU. If we've already
+ * found one, there's nothing to do for other (discrete) GPUs.
+ */
+ if (resource_size(&intel_graphics_stolen_res))
+ return;
+
device = read_pci_config_16(num, slot, func, PCI_DEVICE_ID);
for (i = 0; i < ARRAY_SIZE(intel_early_ids); i++) {
@@ -703,7 +711,7 @@ static struct chipset early_qrk[] __init
{ PCI_VENDOR_ID_INTEL, 0x3406, PCI_CLASS_BRIDGE_HOST,
PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check },
{ PCI_VENDOR_ID_INTEL, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA, PCI_ANY_ID,
- QFLAG_APPLY_ONCE, intel_graphics_quirks },
+ 0, intel_graphics_quirks },
/*
* HPET on the current version of the Baytrail platform has accuracy
* problems: it will halt in deep idle state - so we disable it.
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0030/1039] tools/nolibc: x86-64: Fix startup code bug
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0029/1039] x86/gpu: Reserve stolen memory for first integrated Intel GPU Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0031/1039] crypto: x86/aesni - dont require alignment of data Greg Kroah-Hartman
` (962 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bedirhan KURT, Louvian Lyndal,
Peter Cordes, Ammar Faizi, Willy Tarreau, Paul E. McKenney
From: Ammar Faizi <ammar.faizi@students.amikom.ac.id>
commit 937ed91c712273131de6d2a02caafd3ee84e0c72 upstream.
Before this patch, the `_start` function looks like this:
```
0000000000001170 <_start>:
1170: pop %rdi
1171: mov %rsp,%rsi
1174: lea 0x8(%rsi,%rdi,8),%rdx
1179: and $0xfffffffffffffff0,%rsp
117d: sub $0x8,%rsp
1181: call 1000 <main>
1186: movzbq %al,%rdi
118a: mov $0x3c,%rax
1191: syscall
1193: hlt
1194: data16 cs nopw 0x0(%rax,%rax,1)
119f: nop
```
Note the "and" to %rsp with $-16, it makes the %rsp be 16-byte aligned,
but then there is a "sub" with $0x8 which makes the %rsp no longer
16-byte aligned, then it calls main. That's the bug!
What actually the x86-64 System V ABI mandates is that right before the
"call", the %rsp must be 16-byte aligned, not after the "call". So the
"sub" with $0x8 here breaks the alignment. Remove it.
An example where this rule matters is when the callee needs to align
its stack at 16-byte for aligned move instruction, like `movdqa` and
`movaps`. If the callee can't align its stack properly, it will result
in segmentation fault.
x86-64 System V ABI also mandates the deepest stack frame should be
zero. Just to be safe, let's zero the %rbp on startup as the content
of %rbp may be unspecified when the program starts. Now it looks like
this:
```
0000000000001170 <_start>:
1170: pop %rdi
1171: mov %rsp,%rsi
1174: lea 0x8(%rsi,%rdi,8),%rdx
1179: xor %ebp,%ebp # zero the %rbp
117b: and $0xfffffffffffffff0,%rsp # align the %rsp
117f: call 1000 <main>
1184: movzbq %al,%rdi
1188: mov $0x3c,%rax
118f: syscall
1191: hlt
1192: data16 cs nopw 0x0(%rax,%rax,1)
119d: nopl (%rax)
```
Cc: Bedirhan KURT <windowz414@gnuweeb.org>
Cc: Louvian Lyndal <louvianlyndal@gmail.com>
Reported-by: Peter Cordes <peter@cordes.ca>
Signed-off-by: Ammar Faizi <ammar.faizi@students.amikom.ac.id>
[wt: I did this on purpose due to a misunderstanding of the spec, other
archs will thus have to be rechecked, particularly i386]
Cc: stable@vger.kernel.org
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/include/nolibc/nolibc.h | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/tools/include/nolibc/nolibc.h
+++ b/tools/include/nolibc/nolibc.h
@@ -399,14 +399,20 @@ struct stat {
})
/* startup code */
+/*
+ * x86-64 System V ABI mandates:
+ * 1) %rsp must be 16-byte aligned right before the function call.
+ * 2) The deepest stack frame should be zero (the %rbp).
+ *
+ */
asm(".section .text\n"
".global _start\n"
"_start:\n"
"pop %rdi\n" // argc (first arg, %rdi)
"mov %rsp, %rsi\n" // argv[] (second arg, %rsi)
"lea 8(%rsi,%rdi,8),%rdx\n" // then a NULL then envp (third arg, %rdx)
- "and $-16, %rsp\n" // x86 ABI : esp must be 16-byte aligned when
- "sub $8, %rsp\n" // entering the callee
+ "xor %ebp, %ebp\n" // zero the stack frame
+ "and $-16, %rsp\n" // x86 ABI : esp must be 16-byte aligned before call
"call main\n" // main() returns the status code, we'll exit with it.
"movzb %al, %rdi\n" // retrieve exit code from 8 lower bits
"mov $60, %rax\n" // NR_exit == 60
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0031/1039] crypto: x86/aesni - dont require alignment of data
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0030/1039] tools/nolibc: x86-64: Fix startup code bug Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0032/1039] tools/nolibc: i386: fix initial stack alignment Greg Kroah-Hartman
` (961 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Ard Biesheuvel, Herbert Xu
From: Jakub Kicinski <kuba@kernel.org>
commit d480a26bdf872529919e7c30e17f79d0d7b8c4da upstream.
x86 AES-NI routines can deal with unaligned data. Crypto context
(key, iv etc.) have to be aligned but we take care of that separately
by copying it onto the stack. We were feeding unaligned data into
crypto routines up until commit 83c83e658863 ("crypto: aesni -
refactor scatterlist processing") switched to use the full
skcipher API which uses cra_alignmask to decide data alignment.
This fixes 21% performance regression in kTLS.
Tested by booting with CONFIG_CRYPTO_MANAGER_EXTRA_TESTS=y
(and running thru various kTLS packets).
CC: stable@vger.kernel.org # 5.15+
Fixes: 83c83e658863 ("crypto: aesni - refactor scatterlist processing")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/crypto/aesni-intel_glue.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/x86/crypto/aesni-intel_glue.c
+++ b/arch/x86/crypto/aesni-intel_glue.c
@@ -1107,7 +1107,7 @@ static struct aead_alg aesni_aeads[] = {
.cra_flags = CRYPTO_ALG_INTERNAL,
.cra_blocksize = 1,
.cra_ctxsize = sizeof(struct aesni_rfc4106_gcm_ctx),
- .cra_alignmask = AESNI_ALIGN - 1,
+ .cra_alignmask = 0,
.cra_module = THIS_MODULE,
},
}, {
@@ -1124,7 +1124,7 @@ static struct aead_alg aesni_aeads[] = {
.cra_flags = CRYPTO_ALG_INTERNAL,
.cra_blocksize = 1,
.cra_ctxsize = sizeof(struct generic_gcmaes_ctx),
- .cra_alignmask = AESNI_ALIGN - 1,
+ .cra_alignmask = 0,
.cra_module = THIS_MODULE,
},
} };
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0032/1039] tools/nolibc: i386: fix initial stack alignment
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0031/1039] crypto: x86/aesni - dont require alignment of data Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0033/1039] tools/nolibc: fix incorrect truncation of exit code Greg Kroah-Hartman
` (960 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ammar Faizi, Willy Tarreau, Paul E. McKenney
From: Willy Tarreau <w@1wt.eu>
commit ebbe0d8a449d183fa43b42d84fcb248e25303985 upstream.
After re-checking in the spec and comparing stack offsets with glibc,
The last pushed argument must be 16-byte aligned (i.e. aligned before the
call) so that in the callee esp+4 is multiple of 16, so the principle is
the 32-bit equivalent to what Ammar fixed for x86_64. It's possible that
32-bit code using SSE2 or MMX could have been affected. In addition the
frame pointer ought to be zero at the deepest level.
Link: https://gitlab.com/x86-psABIs/i386-ABI/-/wikis/Intel386-psABI
Cc: Ammar Faizi <ammar.faizi@students.amikom.ac.id>
Cc: stable@vger.kernel.org
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/include/nolibc/nolibc.h | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/tools/include/nolibc/nolibc.h
+++ b/tools/include/nolibc/nolibc.h
@@ -583,13 +583,21 @@ struct sys_stat_struct {
})
/* startup code */
+/*
+ * i386 System V ABI mandates:
+ * 1) last pushed argument must be 16-byte aligned.
+ * 2) The deepest stack frame should be set to zero
+ *
+ */
asm(".section .text\n"
".global _start\n"
"_start:\n"
"pop %eax\n" // argc (first arg, %eax)
"mov %esp, %ebx\n" // argv[] (second arg, %ebx)
"lea 4(%ebx,%eax,4),%ecx\n" // then a NULL then envp (third arg, %ecx)
- "and $-16, %esp\n" // x86 ABI : esp must be 16-byte aligned when
+ "xor %ebp, %ebp\n" // zero the stack frame
+ "and $-16, %esp\n" // x86 ABI : esp must be 16-byte aligned before
+ "sub $4, %esp\n" // the call instruction (args are aligned)
"push %ecx\n" // push all registers on the stack so that we
"push %ebx\n" // support both regparm and plain stack modes
"push %eax\n"
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0033/1039] tools/nolibc: fix incorrect truncation of exit code
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0032/1039] tools/nolibc: i386: fix initial stack alignment Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0034/1039] rtc: cmos: take rtc_lock while reading from CMOS Greg Kroah-Hartman
` (959 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ammar Faizi, Willy Tarreau, Paul E. McKenney
From: Willy Tarreau <w@1wt.eu>
commit de0244ae40ae91145faaf164a4252347607c3711 upstream.
Ammar Faizi reported that our exit code handling is wrong. We truncate
it to the lowest 8 bits but the syscall itself is expected to take a
regular 32-bit signed integer, not an unsigned char. It's the kernel
that later truncates it to the lowest 8 bits. The difference is visible
in strace, where the program below used to show exit(255) instead of
exit(-1):
int main(void)
{
return -1;
}
This patch applies the fix to all archs. x86_64, i386, arm64, armv7 and
mips were all tested and confirmed to work fine now. Risc-v was not
tested but the change is trivial and exactly the same as for other archs.
Reported-by: Ammar Faizi <ammar.faizi@students.amikom.ac.id>
Cc: stable@vger.kernel.org
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/include/nolibc/nolibc.h | 13 +++++--------
1 file changed, 5 insertions(+), 8 deletions(-)
--- a/tools/include/nolibc/nolibc.h
+++ b/tools/include/nolibc/nolibc.h
@@ -414,7 +414,7 @@ asm(".section .text\n"
"xor %ebp, %ebp\n" // zero the stack frame
"and $-16, %rsp\n" // x86 ABI : esp must be 16-byte aligned before call
"call main\n" // main() returns the status code, we'll exit with it.
- "movzb %al, %rdi\n" // retrieve exit code from 8 lower bits
+ "mov %eax, %edi\n" // retrieve exit code (32 bit)
"mov $60, %rax\n" // NR_exit == 60
"syscall\n" // really exit
"hlt\n" // ensure it does not return
@@ -602,9 +602,9 @@ asm(".section .text\n"
"push %ebx\n" // support both regparm and plain stack modes
"push %eax\n"
"call main\n" // main() returns the status code in %eax
- "movzbl %al, %ebx\n" // retrieve exit code from lower 8 bits
- "movl $1, %eax\n" // NR_exit == 1
- "int $0x80\n" // exit now
+ "mov %eax, %ebx\n" // retrieve exit code (32-bit int)
+ "movl $1, %eax\n" // NR_exit == 1
+ "int $0x80\n" // exit now
"hlt\n" // ensure it does not
"");
@@ -788,7 +788,6 @@ asm(".section .text\n"
"and %r3, %r1, $-8\n" // AAPCS : sp must be 8-byte aligned in the
"mov %sp, %r3\n" // callee, an bl doesn't push (lr=pc)
"bl main\n" // main() returns the status code, we'll exit with it.
- "and %r0, %r0, $0xff\n" // limit exit code to 8 bits
"movs r7, $1\n" // NR_exit == 1
"svc $0x00\n"
"");
@@ -985,7 +984,6 @@ asm(".section .text\n"
"add x2, x2, x1\n" // + argv
"and sp, x1, -16\n" // sp must be 16-byte aligned in the callee
"bl main\n" // main() returns the status code, we'll exit with it.
- "and x0, x0, 0xff\n" // limit exit code to 8 bits
"mov x8, 93\n" // NR_exit == 93
"svc #0\n"
"");
@@ -1190,7 +1188,7 @@ asm(".section .text\n"
"addiu $sp,$sp,-16\n" // the callee expects to save a0..a3 there!
"jal main\n" // main() returns the status code, we'll exit with it.
"nop\n" // delayed slot
- "and $a0, $v0, 0xff\n" // limit exit code to 8 bits
+ "move $a0, $v0\n" // retrieve 32-bit exit code from v0
"li $v0, 4001\n" // NR_exit == 4001
"syscall\n"
".end __start\n"
@@ -1388,7 +1386,6 @@ asm(".section .text\n"
"add a2,a2,a1\n" // + argv
"andi sp,a1,-16\n" // sp must be 16-byte aligned
"call main\n" // main() returns the status code, we'll exit with it.
- "andi a0, a0, 0xff\n" // limit exit code to 8 bits
"li a7, 93\n" // NR_exit == 93
"ecall\n"
"");
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0034/1039] rtc: cmos: take rtc_lock while reading from CMOS
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0033/1039] tools/nolibc: fix incorrect truncation of exit code Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0035/1039] net: phy: marvell: add Marvell specific PHY loopback Greg Kroah-Hartman
` (958 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mateusz Jończyk,
Nobuhiro Iwamatsu, Alessandro Zummo, Alexandre Belloni
From: Mateusz Jończyk <mat.jonczyk@o2.pl>
commit 454f47ff464325223129b9b5b8d0b61946ec704d upstream.
Reading from the CMOS involves writing to the index register and then
reading from the data register. Therefore access to the CMOS has to be
serialized with rtc_lock. This invocation of CMOS_READ was not
serialized, which could cause trouble when other code is accessing CMOS
at the same time.
Use spin_lock_irq() like the rest of the function.
Nothing in kernel modifies the RTC_DM_BINARY bit, so there could be a
separate pair of spin_lock_irq() / spin_unlock_irq() before doing the
math.
Signed-off-by: Mateusz Jończyk <mat.jonczyk@o2.pl>
Reviewed-by: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
Cc: stable@vger.kernel.org
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20211210200131.153887-2-mat.jonczyk@o2.pl
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rtc/rtc-cmos.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -457,7 +457,10 @@ static int cmos_set_alarm(struct device
min = t->time.tm_min;
sec = t->time.tm_sec;
+ spin_lock_irq(&rtc_lock);
rtc_control = CMOS_READ(RTC_CONTROL);
+ spin_unlock_irq(&rtc_lock);
+
if (!(rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD) {
/* Writing 0xff means "don't care" or "match all". */
mon = (mon <= 12) ? bin2bcd(mon) : 0xff;
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0035/1039] net: phy: marvell: add Marvell specific PHY loopback
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0034/1039] rtc: cmos: take rtc_lock while reading from CMOS Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0036/1039] ksmbd: uninitialized variable in create_socket() Greg Kroah-Hartman
` (957 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mohammad Athari Bin Ismail, David S. Miller
From: Mohammad Athari Bin Ismail <mohammad.athari.ismail@intel.com>
commit 020a45aff1190c32b1087cd75b57fbf6bff46ea6 upstream.
Existing genphy_loopback() is not applicable for Marvell PHY. Besides
configuring bit-6 and bit-13 in Page 0 Register 0 (Copper Control
Register), it is also required to configure same bits in Page 2
Register 21 (MAC Specific Control Register 2) according to speed of
the loopback is operating.
Tested working on Marvell88E1510 PHY for all speeds (1000/100/10Mbps).
FIXME: Based on trial and error test, it seem 1G need to have delay between
soft reset and loopback enablement.
Fixes: 014068dcb5b1 ("net: phy: genphy_loopback: add link speed configuration")
Cc: <stable@vger.kernel.org> # 5.15.x
Signed-off-by: Mohammad Athari Bin Ismail <mohammad.athari.ismail@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/phy/marvell.c | 56 +++++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 55 insertions(+), 1 deletion(-)
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -189,6 +189,8 @@
#define MII_88E1510_GEN_CTRL_REG_1_MODE_RGMII_SGMII 0x4
#define MII_88E1510_GEN_CTRL_REG_1_RESET 0x8000 /* Soft reset */
+#define MII_88E1510_MSCR_2 0x15
+
#define MII_VCT5_TX_RX_MDI0_COUPLING 0x10
#define MII_VCT5_TX_RX_MDI1_COUPLING 0x11
#define MII_VCT5_TX_RX_MDI2_COUPLING 0x12
@@ -1932,6 +1934,58 @@ static void marvell_get_stats(struct phy
data[i] = marvell_get_stat(phydev, i);
}
+static int m88e1510_loopback(struct phy_device *phydev, bool enable)
+{
+ int err;
+
+ if (enable) {
+ u16 bmcr_ctl = 0, mscr2_ctl = 0;
+
+ if (phydev->speed == SPEED_1000)
+ bmcr_ctl = BMCR_SPEED1000;
+ else if (phydev->speed == SPEED_100)
+ bmcr_ctl = BMCR_SPEED100;
+
+ if (phydev->duplex == DUPLEX_FULL)
+ bmcr_ctl |= BMCR_FULLDPLX;
+
+ err = phy_write(phydev, MII_BMCR, bmcr_ctl);
+ if (err < 0)
+ return err;
+
+ if (phydev->speed == SPEED_1000)
+ mscr2_ctl = BMCR_SPEED1000;
+ else if (phydev->speed == SPEED_100)
+ mscr2_ctl = BMCR_SPEED100;
+
+ err = phy_modify_paged(phydev, MII_MARVELL_MSCR_PAGE,
+ MII_88E1510_MSCR_2, BMCR_SPEED1000 |
+ BMCR_SPEED100, mscr2_ctl);
+ if (err < 0)
+ return err;
+
+ /* Need soft reset to have speed configuration takes effect */
+ err = genphy_soft_reset(phydev);
+ if (err < 0)
+ return err;
+
+ /* FIXME: Based on trial and error test, it seem 1G need to have
+ * delay between soft reset and loopback enablement.
+ */
+ if (phydev->speed == SPEED_1000)
+ msleep(1000);
+
+ return phy_modify(phydev, MII_BMCR, BMCR_LOOPBACK,
+ BMCR_LOOPBACK);
+ } else {
+ err = phy_modify(phydev, MII_BMCR, BMCR_LOOPBACK, 0);
+ if (err < 0)
+ return err;
+
+ return phy_config_aneg(phydev);
+ }
+}
+
static int marvell_vct5_wait_complete(struct phy_device *phydev)
{
int i;
@@ -3078,7 +3132,7 @@ static struct phy_driver marvell_drivers
.get_sset_count = marvell_get_sset_count,
.get_strings = marvell_get_strings,
.get_stats = marvell_get_stats,
- .set_loopback = genphy_loopback,
+ .set_loopback = m88e1510_loopback,
.get_tunable = m88e1011_get_tunable,
.set_tunable = m88e1011_set_tunable,
.cable_test_start = marvell_vct7_cable_test_start,
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0036/1039] ksmbd: uninitialized variable in create_socket()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0035/1039] net: phy: marvell: add Marvell specific PHY loopback Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0037/1039] ksmbd: fix guest connection failure with nautilus Greg Kroah-Hartman
` (956 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Namjae Jeon, Steve French
From: Dan Carpenter <dan.carpenter@oracle.com>
commit b207602fb04537cb21ac38fabd7577eca2fa05ae upstream.
The "ksmbd_socket" variable is not initialized on this error path.
Cc: stable@vger.kernel.org
Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ksmbd/transport_tcp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/ksmbd/transport_tcp.c
+++ b/fs/ksmbd/transport_tcp.c
@@ -404,7 +404,7 @@ static int create_socket(struct interfac
&ksmbd_socket);
if (ret) {
pr_err("Can't create socket for ipv4: %d\n", ret);
- goto out_error;
+ goto out_clear;
}
sin.sin_family = PF_INET;
@@ -462,6 +462,7 @@ static int create_socket(struct interfac
out_error:
tcp_destroy_socket(ksmbd_socket);
+out_clear:
iface->ksmbd_socket = NULL;
return ret;
}
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0037/1039] ksmbd: fix guest connection failure with nautilus
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0036/1039] ksmbd: uninitialized variable in create_socket() Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0038/1039] ksmbd: add support for smb2 max credit parameter Greg Kroah-Hartman
` (955 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Namjae Jeon, Steve French
From: Namjae Jeon <linkinjeon@kernel.org>
commit ac090d9c90b087d6fb714e54b2a6dd1e6c373ed6 upstream.
MS-SMB2 describe session sign like the following.
Session.SigningRequired MUST be set to TRUE under the following conditions:
- If the SMB2_NEGOTIATE_SIGNING_REQUIRED bit is set in the SecurityMode
field of the client request.
- If the SMB2_SESSION_FLAG_IS_GUEST bit is not set in the SessionFlags
field and Session.IsAnonymous is FALSE and either Connection.ShouldSign
or global RequireMessageSigning is TRUE.
When trying guest account connection using nautilus, The login failure
happened on session setup. ksmbd does not allow this connection
when the user is a guest and the connection sign is set. Just do not set
session sign instead of error response as described in the specification.
And this change improves the guest connection in Nautilus.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org # v5.15+
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ksmbd/smb2pdu.c | 64 ++++++++++++++++++++++++-----------------------------
1 file changed, 30 insertions(+), 34 deletions(-)
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -1455,11 +1455,6 @@ static int ntlm_authenticate(struct ksmb
sess->user = user;
if (user_guest(sess->user)) {
- if (conn->sign) {
- ksmbd_debug(SMB, "Guest login not allowed when signing enabled\n");
- return -EPERM;
- }
-
rsp->SessionFlags = SMB2_SESSION_FLAG_IS_GUEST_LE;
} else {
struct authenticate_message *authblob;
@@ -1472,38 +1467,39 @@ static int ntlm_authenticate(struct ksmb
ksmbd_debug(SMB, "authentication failed\n");
return -EPERM;
}
+ }
- /*
- * If session state is SMB2_SESSION_VALID, We can assume
- * that it is reauthentication. And the user/password
- * has been verified, so return it here.
- */
- if (sess->state == SMB2_SESSION_VALID) {
- if (conn->binding)
- goto binding_session;
- return 0;
- }
+ /*
+ * If session state is SMB2_SESSION_VALID, We can assume
+ * that it is reauthentication. And the user/password
+ * has been verified, so return it here.
+ */
+ if (sess->state == SMB2_SESSION_VALID) {
+ if (conn->binding)
+ goto binding_session;
+ return 0;
+ }
- if ((conn->sign || server_conf.enforced_signing) ||
- (req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED))
- sess->sign = true;
-
- if (smb3_encryption_negotiated(conn) &&
- !(req->Flags & SMB2_SESSION_REQ_FLAG_BINDING)) {
- rc = conn->ops->generate_encryptionkey(sess);
- if (rc) {
- ksmbd_debug(SMB,
- "SMB3 encryption key generation failed\n");
- return -EINVAL;
- }
- sess->enc = true;
- rsp->SessionFlags = SMB2_SESSION_FLAG_ENCRYPT_DATA_LE;
- /*
- * signing is disable if encryption is enable
- * on this session
- */
- sess->sign = false;
+ if ((rsp->SessionFlags != SMB2_SESSION_FLAG_IS_GUEST_LE &&
+ (conn->sign || server_conf.enforced_signing)) ||
+ (req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED))
+ sess->sign = true;
+
+ if (smb3_encryption_negotiated(conn) &&
+ !(req->Flags & SMB2_SESSION_REQ_FLAG_BINDING)) {
+ rc = conn->ops->generate_encryptionkey(sess);
+ if (rc) {
+ ksmbd_debug(SMB,
+ "SMB3 encryption key generation failed\n");
+ return -EINVAL;
}
+ sess->enc = true;
+ rsp->SessionFlags = SMB2_SESSION_FLAG_ENCRYPT_DATA_LE;
+ /*
+ * signing is disable if encryption is enable
+ * on this session
+ */
+ sess->sign = false;
}
binding_session:
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0038/1039] ksmbd: add support for smb2 max credit parameter
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0037/1039] ksmbd: fix guest connection failure with nautilus Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0039/1039] ksmbd: move credit charge deduction under processing request Greg Kroah-Hartman
` (954 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Namjae Jeon, Steve French
From: Namjae Jeon <linkinjeon@kernel.org>
commit 004443b3f6d722b455cf963ed7c3edd7f4772405 upstream.
Add smb2 max credits parameter to adjust maximum credits value to limit
number of outstanding requests.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ksmbd/connection.h | 1 -
fs/ksmbd/ksmbd_netlink.h | 1 +
fs/ksmbd/smb2misc.c | 2 +-
fs/ksmbd/smb2ops.c | 16 ++++++++++++----
fs/ksmbd/smb2pdu.c | 8 ++++----
fs/ksmbd/smb2pdu.h | 1 +
fs/ksmbd/smb_common.h | 1 +
fs/ksmbd/transport_ipc.c | 2 ++
8 files changed, 22 insertions(+), 10 deletions(-)
--- a/fs/ksmbd/connection.h
+++ b/fs/ksmbd/connection.h
@@ -62,7 +62,6 @@ struct ksmbd_conn {
/* References which are made for this Server object*/
atomic_t r_count;
unsigned short total_credits;
- unsigned short max_credits;
spinlock_t credits_lock;
wait_queue_head_t req_running_q;
/* Lock to protect requests list*/
--- a/fs/ksmbd/ksmbd_netlink.h
+++ b/fs/ksmbd/ksmbd_netlink.h
@@ -103,6 +103,7 @@ struct ksmbd_startup_request {
* we set the SPARSE_FILES bit (0x40).
*/
__u32 sub_auth[3]; /* Subauth value for Security ID */
+ __u32 smb2_max_credits; /* MAX credits */
__u32 ifc_list_sz; /* interfaces list size */
__s8 ____payload[];
};
--- a/fs/ksmbd/smb2misc.c
+++ b/fs/ksmbd/smb2misc.c
@@ -326,7 +326,7 @@ static int smb2_validate_credit_charge(s
ksmbd_debug(SMB, "Insufficient credit charge, given: %d, needed: %d\n",
credit_charge, calc_credit_num);
return 1;
- } else if (credit_charge > conn->max_credits) {
+ } else if (credit_charge > conn->vals->max_credits) {
ksmbd_debug(SMB, "Too large credit charge: %d\n", credit_charge);
return 1;
}
--- a/fs/ksmbd/smb2ops.c
+++ b/fs/ksmbd/smb2ops.c
@@ -19,6 +19,7 @@ static struct smb_version_values smb21_s
.max_read_size = SMB21_DEFAULT_IOSIZE,
.max_write_size = SMB21_DEFAULT_IOSIZE,
.max_trans_size = SMB21_DEFAULT_IOSIZE,
+ .max_credits = SMB2_MAX_CREDITS,
.large_lock_type = 0,
.exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE,
.shared_lock_type = SMB2_LOCKFLAG_SHARED,
@@ -44,6 +45,7 @@ static struct smb_version_values smb30_s
.max_read_size = SMB3_DEFAULT_IOSIZE,
.max_write_size = SMB3_DEFAULT_IOSIZE,
.max_trans_size = SMB3_DEFAULT_TRANS_SIZE,
+ .max_credits = SMB2_MAX_CREDITS,
.large_lock_type = 0,
.exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE,
.shared_lock_type = SMB2_LOCKFLAG_SHARED,
@@ -70,6 +72,7 @@ static struct smb_version_values smb302_
.max_read_size = SMB3_DEFAULT_IOSIZE,
.max_write_size = SMB3_DEFAULT_IOSIZE,
.max_trans_size = SMB3_DEFAULT_TRANS_SIZE,
+ .max_credits = SMB2_MAX_CREDITS,
.large_lock_type = 0,
.exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE,
.shared_lock_type = SMB2_LOCKFLAG_SHARED,
@@ -96,6 +99,7 @@ static struct smb_version_values smb311_
.max_read_size = SMB3_DEFAULT_IOSIZE,
.max_write_size = SMB3_DEFAULT_IOSIZE,
.max_trans_size = SMB3_DEFAULT_TRANS_SIZE,
+ .max_credits = SMB2_MAX_CREDITS,
.large_lock_type = 0,
.exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE,
.shared_lock_type = SMB2_LOCKFLAG_SHARED,
@@ -197,7 +201,6 @@ void init_smb2_1_server(struct ksmbd_con
conn->ops = &smb2_0_server_ops;
conn->cmds = smb2_0_server_cmds;
conn->max_cmds = ARRAY_SIZE(smb2_0_server_cmds);
- conn->max_credits = SMB2_MAX_CREDITS;
conn->signing_algorithm = SIGNING_ALG_HMAC_SHA256_LE;
if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_LEASES)
@@ -215,7 +218,6 @@ void init_smb3_0_server(struct ksmbd_con
conn->ops = &smb3_0_server_ops;
conn->cmds = smb2_0_server_cmds;
conn->max_cmds = ARRAY_SIZE(smb2_0_server_cmds);
- conn->max_credits = SMB2_MAX_CREDITS;
conn->signing_algorithm = SIGNING_ALG_AES_CMAC_LE;
if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_LEASES)
@@ -240,7 +242,6 @@ void init_smb3_02_server(struct ksmbd_co
conn->ops = &smb3_0_server_ops;
conn->cmds = smb2_0_server_cmds;
conn->max_cmds = ARRAY_SIZE(smb2_0_server_cmds);
- conn->max_credits = SMB2_MAX_CREDITS;
conn->signing_algorithm = SIGNING_ALG_AES_CMAC_LE;
if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_LEASES)
@@ -265,7 +266,6 @@ int init_smb3_11_server(struct ksmbd_con
conn->ops = &smb3_11_server_ops;
conn->cmds = smb2_0_server_cmds;
conn->max_cmds = ARRAY_SIZE(smb2_0_server_cmds);
- conn->max_credits = SMB2_MAX_CREDITS;
conn->signing_algorithm = SIGNING_ALG_AES_CMAC_LE;
if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_LEASES)
@@ -304,3 +304,11 @@ void init_smb2_max_trans_size(unsigned i
smb302_server_values.max_trans_size = sz;
smb311_server_values.max_trans_size = sz;
}
+
+void init_smb2_max_credits(unsigned int sz)
+{
+ smb21_server_values.max_credits = sz;
+ smb30_server_values.max_credits = sz;
+ smb302_server_values.max_credits = sz;
+ smb311_server_values.max_credits = sz;
+}
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -308,7 +308,7 @@ int smb2_set_rsp_credits(struct ksmbd_wo
hdr->CreditCharge = req_hdr->CreditCharge;
- if (conn->total_credits > conn->max_credits) {
+ if (conn->total_credits > conn->vals->max_credits) {
hdr->CreditRequest = 0;
pr_err("Total credits overflow: %d\n", conn->total_credits);
return -EINVAL;
@@ -329,12 +329,12 @@ int smb2_set_rsp_credits(struct ksmbd_wo
if (hdr->Command == SMB2_NEGOTIATE)
aux_max = 0;
else
- aux_max = conn->max_credits - credit_charge;
+ aux_max = conn->vals->max_credits - credit_charge;
aux_credits = min_t(unsigned short, aux_credits, aux_max);
credits_granted = credit_charge + aux_credits;
- if (conn->max_credits - conn->total_credits < credits_granted)
- credits_granted = conn->max_credits -
+ if (conn->vals->max_credits - conn->total_credits < credits_granted)
+ credits_granted = conn->vals->max_credits -
conn->total_credits;
conn->total_credits += credits_granted;
--- a/fs/ksmbd/smb2pdu.h
+++ b/fs/ksmbd/smb2pdu.h
@@ -980,6 +980,7 @@ int init_smb3_11_server(struct ksmbd_con
void init_smb2_max_read_size(unsigned int sz);
void init_smb2_max_write_size(unsigned int sz);
void init_smb2_max_trans_size(unsigned int sz);
+void init_smb2_max_credits(unsigned int sz);
bool is_smb2_neg_cmd(struct ksmbd_work *work);
bool is_smb2_rsp(struct ksmbd_work *work);
--- a/fs/ksmbd/smb_common.h
+++ b/fs/ksmbd/smb_common.h
@@ -365,6 +365,7 @@ struct smb_version_values {
__u32 max_read_size;
__u32 max_write_size;
__u32 max_trans_size;
+ __u32 max_credits;
__u32 large_lock_type;
__u32 exclusive_lock_type;
__u32 shared_lock_type;
--- a/fs/ksmbd/transport_ipc.c
+++ b/fs/ksmbd/transport_ipc.c
@@ -301,6 +301,8 @@ static int ipc_server_config_on_startup(
init_smb2_max_write_size(req->smb2_max_write);
if (req->smb2_max_trans)
init_smb2_max_trans_size(req->smb2_max_trans);
+ if (req->smb2_max_credits)
+ init_smb2_max_credits(req->smb2_max_credits);
ret = ksmbd_set_netbios_name(req->netbios_name);
ret |= ksmbd_set_server_string(req->server_string);
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0039/1039] ksmbd: move credit charge deduction under processing request
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0038/1039] ksmbd: add support for smb2 max credit parameter Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0040/1039] ksmbd: limits exceeding the maximum allowable outstanding requests Greg Kroah-Hartman
` (953 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Namjae Jeon, Steve French
From: Namjae Jeon <linkinjeon@kernel.org>
commit 914d7e5709ac59ded70bea7956d408fe2acd7c3c upstream.
Moves the credit charge deduction from total_credits under the processing
a request. When repeating smb2 lock request and other command request,
there will be a problem that ->total_credits does not decrease.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ksmbd/smb2misc.c | 7 ++-----
fs/ksmbd/smb2pdu.c | 16 ++++++++++------
2 files changed, 12 insertions(+), 11 deletions(-)
--- a/fs/ksmbd/smb2misc.c
+++ b/fs/ksmbd/smb2misc.c
@@ -289,7 +289,7 @@ static int smb2_validate_credit_charge(s
unsigned int req_len = 0, expect_resp_len = 0, calc_credit_num, max_len;
unsigned short credit_charge = le16_to_cpu(hdr->CreditCharge);
void *__hdr = hdr;
- int ret;
+ int ret = 0;
switch (hdr->Command) {
case SMB2_QUERY_INFO:
@@ -332,10 +332,7 @@ static int smb2_validate_credit_charge(s
}
spin_lock(&conn->credits_lock);
- if (credit_charge <= conn->total_credits) {
- conn->total_credits -= credit_charge;
- ret = 0;
- } else {
+ if (credit_charge > conn->total_credits) {
ksmbd_debug(SMB, "Insufficient credits granted, given: %u, granted: %u\n",
credit_charge, conn->total_credits);
ret = 1;
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -299,9 +299,8 @@ int smb2_set_rsp_credits(struct ksmbd_wo
struct smb2_hdr *req_hdr = ksmbd_req_buf_next(work);
struct smb2_hdr *hdr = ksmbd_resp_buf_next(work);
struct ksmbd_conn *conn = work->conn;
- unsigned short credits_requested;
+ unsigned short credits_requested, aux_max;
unsigned short credit_charge, credits_granted = 0;
- unsigned short aux_max, aux_credits;
if (work->send_no_response)
return 0;
@@ -316,6 +315,13 @@ int smb2_set_rsp_credits(struct ksmbd_wo
credit_charge = max_t(unsigned short,
le16_to_cpu(req_hdr->CreditCharge), 1);
+ if (credit_charge > conn->total_credits) {
+ ksmbd_debug(SMB, "Insufficient credits granted, given: %u, granted: %u\n",
+ credit_charge, conn->total_credits);
+ return -EINVAL;
+ }
+
+ conn->total_credits -= credit_charge;
credits_requested = max_t(unsigned short,
le16_to_cpu(req_hdr->CreditRequest), 1);
@@ -325,13 +331,11 @@ int smb2_set_rsp_credits(struct ksmbd_wo
* TODO: Need to adjuct CreditRequest value according to
* current cpu load
*/
- aux_credits = credits_requested - 1;
if (hdr->Command == SMB2_NEGOTIATE)
- aux_max = 0;
+ aux_max = 1;
else
aux_max = conn->vals->max_credits - credit_charge;
- aux_credits = min_t(unsigned short, aux_credits, aux_max);
- credits_granted = credit_charge + aux_credits;
+ credits_granted = min_t(unsigned short, credits_requested, aux_max);
if (conn->vals->max_credits - conn->total_credits < credits_granted)
credits_granted = conn->vals->max_credits -
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0040/1039] ksmbd: limits exceeding the maximum allowable outstanding requests
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0039/1039] ksmbd: move credit charge deduction under processing request Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0041/1039] ksmbd: add reserved room in ipc request/response Greg Kroah-Hartman
` (952 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Namjae Jeon, Steve French
From: Namjae Jeon <linkinjeon@kernel.org>
commit b589f5db6d4af8f14d70e31e1276b4c017668a26 upstream.
If the client ignores the CreditResponse received from the server and
continues to send the request, ksmbd limits the requests if it exceeds
smb2 max credits.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ksmbd/connection.c | 1 +
fs/ksmbd/connection.h | 3 ++-
fs/ksmbd/smb2misc.c | 9 +++++++++
fs/ksmbd/smb2pdu.c | 1 +
4 files changed, 13 insertions(+), 1 deletion(-)
--- a/fs/ksmbd/connection.c
+++ b/fs/ksmbd/connection.c
@@ -62,6 +62,7 @@ struct ksmbd_conn *ksmbd_conn_alloc(void
atomic_set(&conn->req_running, 0);
atomic_set(&conn->r_count, 0);
conn->total_credits = 1;
+ conn->outstanding_credits = 1;
init_waitqueue_head(&conn->req_running_q);
INIT_LIST_HEAD(&conn->conns_list);
--- a/fs/ksmbd/connection.h
+++ b/fs/ksmbd/connection.h
@@ -61,7 +61,8 @@ struct ksmbd_conn {
atomic_t req_running;
/* References which are made for this Server object*/
atomic_t r_count;
- unsigned short total_credits;
+ unsigned int total_credits;
+ unsigned int outstanding_credits;
spinlock_t credits_lock;
wait_queue_head_t req_running_q;
/* Lock to protect requests list*/
--- a/fs/ksmbd/smb2misc.c
+++ b/fs/ksmbd/smb2misc.c
@@ -337,7 +337,16 @@ static int smb2_validate_credit_charge(s
credit_charge, conn->total_credits);
ret = 1;
}
+
+ if ((u64)conn->outstanding_credits + credit_charge > conn->vals->max_credits) {
+ ksmbd_debug(SMB, "Limits exceeding the maximum allowable outstanding requests, given : %u, pending : %u\n",
+ credit_charge, conn->outstanding_credits);
+ ret = 1;
+ } else
+ conn->outstanding_credits += credit_charge;
+
spin_unlock(&conn->credits_lock);
+
return ret;
}
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -322,6 +322,7 @@ int smb2_set_rsp_credits(struct ksmbd_wo
}
conn->total_credits -= credit_charge;
+ conn->outstanding_credits -= credit_charge;
credits_requested = max_t(unsigned short,
le16_to_cpu(req_hdr->CreditRequest), 1);
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0041/1039] ksmbd: add reserved room in ipc request/response
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0040/1039] ksmbd: limits exceeding the maximum allowable outstanding requests Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0042/1039] media: cec: fix a deadlock situation Greg Kroah-Hartman
` (951 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Namjae Jeon, Steve French
From: Namjae Jeon <linkinjeon@kernel.org>
commit 41dbda16a0902798e732abc6599de256b9dc3b27 upstream.
Whenever new parameter is added to smb configuration, It is possible
to break the execution of the IPC daemon by mismatch size of
request/response. This patch tries to reserve space in ipc request/response
in advance to prevent that.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ksmbd/ksmbd_netlink.h | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/fs/ksmbd/ksmbd_netlink.h
+++ b/fs/ksmbd/ksmbd_netlink.h
@@ -104,6 +104,7 @@ struct ksmbd_startup_request {
*/
__u32 sub_auth[3]; /* Subauth value for Security ID */
__u32 smb2_max_credits; /* MAX credits */
+ __u32 reserved[128]; /* Reserved room */
__u32 ifc_list_sz; /* interfaces list size */
__s8 ____payload[];
};
@@ -114,7 +115,7 @@ struct ksmbd_startup_request {
* IPC request to shutdown ksmbd server.
*/
struct ksmbd_shutdown_request {
- __s32 reserved;
+ __s32 reserved[16];
};
/*
@@ -123,6 +124,7 @@ struct ksmbd_shutdown_request {
struct ksmbd_login_request {
__u32 handle;
__s8 account[KSMBD_REQ_MAX_ACCOUNT_NAME_SZ]; /* user account name */
+ __u32 reserved[16]; /* Reserved room */
};
/*
@@ -136,6 +138,7 @@ struct ksmbd_login_response {
__u16 status;
__u16 hash_sz; /* hash size */
__s8 hash[KSMBD_REQ_MAX_HASH_SZ]; /* password hash */
+ __u32 reserved[16]; /* Reserved room */
};
/*
@@ -144,6 +147,7 @@ struct ksmbd_login_response {
struct ksmbd_share_config_request {
__u32 handle;
__s8 share_name[KSMBD_REQ_MAX_SHARE_NAME]; /* share name */
+ __u32 reserved[16]; /* Reserved room */
};
/*
@@ -158,6 +162,7 @@ struct ksmbd_share_config_response {
__u16 force_directory_mode;
__u16 force_uid;
__u16 force_gid;
+ __u32 reserved[128]; /* Reserved room */
__u32 veto_list_sz;
__s8 ____payload[];
};
@@ -188,6 +193,7 @@ struct ksmbd_tree_connect_request {
__s8 account[KSMBD_REQ_MAX_ACCOUNT_NAME_SZ];
__s8 share[KSMBD_REQ_MAX_SHARE_NAME];
__s8 peer_addr[64];
+ __u32 reserved[16]; /* Reserved room */
};
/*
@@ -197,6 +203,7 @@ struct ksmbd_tree_connect_response {
__u32 handle;
__u16 status;
__u16 connection_flags;
+ __u32 reserved[16]; /* Reserved room */
};
/*
@@ -205,6 +212,7 @@ struct ksmbd_tree_connect_response {
struct ksmbd_tree_disconnect_request {
__u64 session_id; /* session id */
__u64 connect_id; /* tree connection id */
+ __u32 reserved[16]; /* Reserved room */
};
/*
@@ -213,6 +221,7 @@ struct ksmbd_tree_disconnect_request {
struct ksmbd_logout_request {
__s8 account[KSMBD_REQ_MAX_ACCOUNT_NAME_SZ]; /* user account name */
__u32 account_flags;
+ __u32 reserved[16]; /* Reserved room */
};
/*
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0042/1039] media: cec: fix a deadlock situation
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0041/1039] ksmbd: add reserved room in ipc request/response Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0043/1039] media: ov8865: Disable only enabled regulators on error path Greg Kroah-Hartman
` (950 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Mauro Carvalho Chehab
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
commit a9e6107616bb8108aa4fc22584a05e69761a91f7 upstream.
The cec_devnode struct has a lock meant to serialize access
to the fields of this struct. This lock is taken during
device node (un)registration and when opening or releasing a
filehandle to the device node. When the last open filehandle
is closed the cec adapter might be disabled by calling the
adap_enable driver callback with the devnode.lock held.
However, if during that callback a message or event arrives
then the driver will call one of the cec_queue_event()
variants in cec-adap.c, and those will take the same devnode.lock
to walk the open filehandle list.
This obviously causes a deadlock.
This is quite easy to reproduce with the cec-gpio driver since that
uses the cec-pin framework which generated lots of events and uses
a kernel thread for the processing, so when adap_enable is called
the thread is still running and can generate events.
But I suspect that it might also happen with other drivers if an
interrupt arrives signaling e.g. a received message before adap_enable
had a chance to disable the interrupts.
This patch adds a new mutex to serialize access to the fhs list.
When adap_enable() is called the devnode.lock mutex is held, but
not devnode.lock_fhs. The event functions in cec-adap.c will now
use devnode.lock_fhs instead of devnode.lock, ensuring that it is
safe to call those functions from the adap_enable callback.
This specific issue only happens if the last open filehandle is closed
and the physical address is invalid. This is not something that
happens during normal operation, but it does happen when monitoring
CEC traffic (e.g. cec-ctl --monitor) with an unconfigured CEC adapter.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Cc: <stable@vger.kernel.org> # for v5.13 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/cec/core/cec-adap.c | 38 +++++++++++++++++++++-----------------
drivers/media/cec/core/cec-api.c | 6 ++++++
drivers/media/cec/core/cec-core.c | 3 +++
include/media/cec.h | 11 +++++++++--
4 files changed, 39 insertions(+), 19 deletions(-)
--- a/drivers/media/cec/core/cec-adap.c
+++ b/drivers/media/cec/core/cec-adap.c
@@ -161,10 +161,10 @@ static void cec_queue_event(struct cec_a
u64 ts = ktime_get_ns();
struct cec_fh *fh;
- mutex_lock(&adap->devnode.lock);
+ mutex_lock(&adap->devnode.lock_fhs);
list_for_each_entry(fh, &adap->devnode.fhs, list)
cec_queue_event_fh(fh, ev, ts);
- mutex_unlock(&adap->devnode.lock);
+ mutex_unlock(&adap->devnode.lock_fhs);
}
/* Notify userspace that the CEC pin changed state at the given time. */
@@ -178,11 +178,12 @@ void cec_queue_pin_cec_event(struct cec_
};
struct cec_fh *fh;
- mutex_lock(&adap->devnode.lock);
- list_for_each_entry(fh, &adap->devnode.fhs, list)
+ mutex_lock(&adap->devnode.lock_fhs);
+ list_for_each_entry(fh, &adap->devnode.fhs, list) {
if (fh->mode_follower == CEC_MODE_MONITOR_PIN)
cec_queue_event_fh(fh, &ev, ktime_to_ns(ts));
- mutex_unlock(&adap->devnode.lock);
+ }
+ mutex_unlock(&adap->devnode.lock_fhs);
}
EXPORT_SYMBOL_GPL(cec_queue_pin_cec_event);
@@ -195,10 +196,10 @@ void cec_queue_pin_hpd_event(struct cec_
};
struct cec_fh *fh;
- mutex_lock(&adap->devnode.lock);
+ mutex_lock(&adap->devnode.lock_fhs);
list_for_each_entry(fh, &adap->devnode.fhs, list)
cec_queue_event_fh(fh, &ev, ktime_to_ns(ts));
- mutex_unlock(&adap->devnode.lock);
+ mutex_unlock(&adap->devnode.lock_fhs);
}
EXPORT_SYMBOL_GPL(cec_queue_pin_hpd_event);
@@ -211,10 +212,10 @@ void cec_queue_pin_5v_event(struct cec_a
};
struct cec_fh *fh;
- mutex_lock(&adap->devnode.lock);
+ mutex_lock(&adap->devnode.lock_fhs);
list_for_each_entry(fh, &adap->devnode.fhs, list)
cec_queue_event_fh(fh, &ev, ktime_to_ns(ts));
- mutex_unlock(&adap->devnode.lock);
+ mutex_unlock(&adap->devnode.lock_fhs);
}
EXPORT_SYMBOL_GPL(cec_queue_pin_5v_event);
@@ -286,12 +287,12 @@ static void cec_queue_msg_monitor(struct
u32 monitor_mode = valid_la ? CEC_MODE_MONITOR :
CEC_MODE_MONITOR_ALL;
- mutex_lock(&adap->devnode.lock);
+ mutex_lock(&adap->devnode.lock_fhs);
list_for_each_entry(fh, &adap->devnode.fhs, list) {
if (fh->mode_follower >= monitor_mode)
cec_queue_msg_fh(fh, msg);
}
- mutex_unlock(&adap->devnode.lock);
+ mutex_unlock(&adap->devnode.lock_fhs);
}
/*
@@ -302,12 +303,12 @@ static void cec_queue_msg_followers(stru
{
struct cec_fh *fh;
- mutex_lock(&adap->devnode.lock);
+ mutex_lock(&adap->devnode.lock_fhs);
list_for_each_entry(fh, &adap->devnode.fhs, list) {
if (fh->mode_follower == CEC_MODE_FOLLOWER)
cec_queue_msg_fh(fh, msg);
}
- mutex_unlock(&adap->devnode.lock);
+ mutex_unlock(&adap->devnode.lock_fhs);
}
/* Notify userspace of an adapter state change. */
@@ -1573,6 +1574,7 @@ void __cec_s_phys_addr(struct cec_adapte
/* Disabling monitor all mode should always succeed */
if (adap->monitor_all_cnt)
WARN_ON(call_op(adap, adap_monitor_all_enable, false));
+ /* serialize adap_enable */
mutex_lock(&adap->devnode.lock);
if (adap->needs_hpd || list_empty(&adap->devnode.fhs)) {
WARN_ON(adap->ops->adap_enable(adap, false));
@@ -1584,14 +1586,16 @@ void __cec_s_phys_addr(struct cec_adapte
return;
}
+ /* serialize adap_enable */
mutex_lock(&adap->devnode.lock);
adap->last_initiator = 0xff;
adap->transmit_in_progress = false;
- if ((adap->needs_hpd || list_empty(&adap->devnode.fhs)) &&
- adap->ops->adap_enable(adap, true)) {
- mutex_unlock(&adap->devnode.lock);
- return;
+ if (adap->needs_hpd || list_empty(&adap->devnode.fhs)) {
+ if (adap->ops->adap_enable(adap, true)) {
+ mutex_unlock(&adap->devnode.lock);
+ return;
+ }
}
if (adap->monitor_all_cnt &&
--- a/drivers/media/cec/core/cec-api.c
+++ b/drivers/media/cec/core/cec-api.c
@@ -586,6 +586,7 @@ static int cec_open(struct inode *inode,
return err;
}
+ /* serialize adap_enable */
mutex_lock(&devnode->lock);
if (list_empty(&devnode->fhs) &&
!adap->needs_hpd &&
@@ -624,7 +625,9 @@ static int cec_open(struct inode *inode,
}
#endif
+ mutex_lock(&devnode->lock_fhs);
list_add(&fh->list, &devnode->fhs);
+ mutex_unlock(&devnode->lock_fhs);
mutex_unlock(&devnode->lock);
return 0;
@@ -653,8 +656,11 @@ static int cec_release(struct inode *ino
cec_monitor_all_cnt_dec(adap);
mutex_unlock(&adap->lock);
+ /* serialize adap_enable */
mutex_lock(&devnode->lock);
+ mutex_lock(&devnode->lock_fhs);
list_del(&fh->list);
+ mutex_unlock(&devnode->lock_fhs);
if (cec_is_registered(adap) && list_empty(&devnode->fhs) &&
!adap->needs_hpd && adap->phys_addr == CEC_PHYS_ADDR_INVALID) {
WARN_ON(adap->ops->adap_enable(adap, false));
--- a/drivers/media/cec/core/cec-core.c
+++ b/drivers/media/cec/core/cec-core.c
@@ -169,8 +169,10 @@ static void cec_devnode_unregister(struc
devnode->registered = false;
devnode->unregistered = true;
+ mutex_lock(&devnode->lock_fhs);
list_for_each_entry(fh, &devnode->fhs, list)
wake_up_interruptible(&fh->wait);
+ mutex_unlock(&devnode->lock_fhs);
mutex_unlock(&devnode->lock);
@@ -272,6 +274,7 @@ struct cec_adapter *cec_allocate_adapter
/* adap->devnode initialization */
INIT_LIST_HEAD(&adap->devnode.fhs);
+ mutex_init(&adap->devnode.lock_fhs);
mutex_init(&adap->devnode.lock);
adap->kthread = kthread_run(cec_thread_func, adap, "cec-%s", name);
--- a/include/media/cec.h
+++ b/include/media/cec.h
@@ -26,13 +26,17 @@
* @dev: cec device
* @cdev: cec character device
* @minor: device node minor number
+ * @lock: lock to serialize open/release and registration
* @registered: the device was correctly registered
* @unregistered: the device was unregistered
+ * @lock_fhs: lock to control access to @fhs
* @fhs: the list of open filehandles (cec_fh)
- * @lock: lock to control access to this structure
*
* This structure represents a cec-related device node.
*
+ * To add or remove filehandles from @fhs the @lock must be taken first,
+ * followed by @lock_fhs. It is safe to access @fhs if either lock is held.
+ *
* The @parent is a physical device. It must be set by core or device drivers
* before registering the node.
*/
@@ -43,10 +47,13 @@ struct cec_devnode {
/* device info */
int minor;
+ /* serialize open/release and registration */
+ struct mutex lock;
bool registered;
bool unregistered;
+ /* protect access to fhs */
+ struct mutex lock_fhs;
struct list_head fhs;
- struct mutex lock;
};
struct cec_adapter;
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0043/1039] media: ov8865: Disable only enabled regulators on error path
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0042/1039] media: cec: fix a deadlock situation Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0044/1039] media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE Greg Kroah-Hartman
` (949 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sakari Ailus, Mauro Carvalho Chehab
From: Sakari Ailus <sakari.ailus@linux.intel.com>
commit cbe0b3af73bf72fad197756f026084404e2bcdc7 upstream.
If powering on the sensor failed, the entire power-off sequence was run
independently of how far the power-on sequence proceeded before the error.
This lead to disabling regulators and/or clock that was not enabled.
Fix this by disabling only clocks and regulators that were enabled
previously.
Fixes: 11c0d8fdccc5 ("media: i2c: Add support for the OV8865 image sensor")
Cc: stable@vger.kernel.org
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/ov8865.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/drivers/media/i2c/ov8865.c
+++ b/drivers/media/i2c/ov8865.c
@@ -2330,27 +2330,27 @@ static int ov8865_sensor_power(struct ov
if (ret) {
dev_err(sensor->dev,
"failed to enable DOVDD regulator\n");
- goto disable;
+ return ret;
}
ret = regulator_enable(sensor->avdd);
if (ret) {
dev_err(sensor->dev,
"failed to enable AVDD regulator\n");
- goto disable;
+ goto disable_dovdd;
}
ret = regulator_enable(sensor->dvdd);
if (ret) {
dev_err(sensor->dev,
"failed to enable DVDD regulator\n");
- goto disable;
+ goto disable_avdd;
}
ret = clk_prepare_enable(sensor->extclk);
if (ret) {
dev_err(sensor->dev, "failed to enable EXTCLK clock\n");
- goto disable;
+ goto disable_dvdd;
}
gpiod_set_value_cansleep(sensor->reset, 0);
@@ -2359,14 +2359,16 @@ static int ov8865_sensor_power(struct ov
/* Time to enter streaming mode according to power timings. */
usleep_range(10000, 12000);
} else {
-disable:
gpiod_set_value_cansleep(sensor->powerdown, 1);
gpiod_set_value_cansleep(sensor->reset, 1);
clk_disable_unprepare(sensor->extclk);
+disable_dvdd:
regulator_disable(sensor->dvdd);
+disable_avdd:
regulator_disable(sensor->avdd);
+disable_dovdd:
regulator_disable(sensor->dovdd);
}
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0044/1039] media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0043/1039] media: ov8865: Disable only enabled regulators on error path Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0045/1039] media: flexcop-usb: fix control-message timeouts Greg Kroah-Hartman
` (948 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Mauro Carvalho Chehab
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
commit cd9d9377ed235b294a492a094e1666178a5e78fd upstream.
If V4L2_CAP_READWRITE is not set, then readbuffers must be set to 0,
otherwise v4l2-compliance will complain.
A note on the Fixes tag below: this patch does not really fix that commit,
but it can be applied from that commit onwards. For older code there is no
guarantee that device_caps is set, so even though this patch would apply,
it will not work reliably.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Fixes: 049e684f2de9 (media: v4l2-dev: fix WARN_ON(!vdev->device_caps))
Cc: <stable@vger.kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/v4l2-core/v4l2-ioctl.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -2090,6 +2090,7 @@ static int v4l_prepare_buf(const struct
static int v4l_g_parm(const struct v4l2_ioctl_ops *ops,
struct file *file, void *fh, void *arg)
{
+ struct video_device *vfd = video_devdata(file);
struct v4l2_streamparm *p = arg;
v4l2_std_id std;
int ret = check_fmt(file, p->type);
@@ -2101,7 +2102,8 @@ static int v4l_g_parm(const struct v4l2_
if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE &&
p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE)
return -EINVAL;
- p->parm.capture.readbuffers = 2;
+ if (vfd->device_caps & V4L2_CAP_READWRITE)
+ p->parm.capture.readbuffers = 2;
ret = ops->vidioc_g_std(file, fh, &std);
if (ret == 0)
v4l2_video_std_frame_period(std, &p->parm.capture.timeperframe);
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0045/1039] media: flexcop-usb: fix control-message timeouts
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0044/1039] media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0046/1039] media: mceusb: " Greg Kroah-Hartman
` (947 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Hans Verkuil,
Mauro Carvalho Chehab
From: Johan Hovold <johan@kernel.org>
commit cd1798a387825cc4a51282f5a611ad05bb1ad75f upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Note that the driver was multiplying some of the timeout values with HZ
twice resulting in 3000-second timeouts with HZ=1000.
Also note that two of the timeout defines are currently unused.
Fixes: 2154be651b90 ("[media] redrat3: new rc-core IR transceiver device driver")
Cc: stable@vger.kernel.org # 3.0
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/b2c2/flexcop-usb.c | 10 +++++-----
drivers/media/usb/b2c2/flexcop-usb.h | 12 ++++++------
2 files changed, 11 insertions(+), 11 deletions(-)
--- a/drivers/media/usb/b2c2/flexcop-usb.c
+++ b/drivers/media/usb/b2c2/flexcop-usb.c
@@ -87,7 +87,7 @@ static int flexcop_usb_readwrite_dw(stru
0,
fc_usb->data,
sizeof(u32),
- B2C2_WAIT_FOR_OPERATION_RDW * HZ);
+ B2C2_WAIT_FOR_OPERATION_RDW);
if (ret != sizeof(u32)) {
err("error while %s dword from %d (%d).", read ? "reading" :
@@ -155,7 +155,7 @@ static int flexcop_usb_v8_memory_req(str
wIndex,
fc_usb->data,
buflen,
- nWaitTime * HZ);
+ nWaitTime);
if (ret != buflen)
ret = -EIO;
@@ -248,13 +248,13 @@ static int flexcop_usb_i2c_req(struct fl
/* DKT 020208 - add this to support special case of DiSEqC */
case USB_FUNC_I2C_CHECKWRITE:
pipe = B2C2_USB_CTRL_PIPE_OUT;
- nWaitTime = 2;
+ nWaitTime = 2000;
request_type |= USB_DIR_OUT;
break;
case USB_FUNC_I2C_READ:
case USB_FUNC_I2C_REPEATREAD:
pipe = B2C2_USB_CTRL_PIPE_IN;
- nWaitTime = 2;
+ nWaitTime = 2000;
request_type |= USB_DIR_IN;
break;
default:
@@ -281,7 +281,7 @@ static int flexcop_usb_i2c_req(struct fl
wIndex,
fc_usb->data,
buflen,
- nWaitTime * HZ);
+ nWaitTime);
if (ret != buflen)
ret = -EIO;
--- a/drivers/media/usb/b2c2/flexcop-usb.h
+++ b/drivers/media/usb/b2c2/flexcop-usb.h
@@ -91,13 +91,13 @@ typedef enum {
UTILITY_SRAM_TESTVERIFY = 0x16,
} flexcop_usb_utility_function_t;
-#define B2C2_WAIT_FOR_OPERATION_RW (1*HZ)
-#define B2C2_WAIT_FOR_OPERATION_RDW (3*HZ)
-#define B2C2_WAIT_FOR_OPERATION_WDW (1*HZ)
+#define B2C2_WAIT_FOR_OPERATION_RW 1000
+#define B2C2_WAIT_FOR_OPERATION_RDW 3000
+#define B2C2_WAIT_FOR_OPERATION_WDW 1000
-#define B2C2_WAIT_FOR_OPERATION_V8READ (3*HZ)
-#define B2C2_WAIT_FOR_OPERATION_V8WRITE (3*HZ)
-#define B2C2_WAIT_FOR_OPERATION_V8FLASH (3*HZ)
+#define B2C2_WAIT_FOR_OPERATION_V8READ 3000
+#define B2C2_WAIT_FOR_OPERATION_V8WRITE 3000
+#define B2C2_WAIT_FOR_OPERATION_V8FLASH 3000
typedef enum {
V8_MEMORY_PAGE_DVB_CI = 0x20,
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0046/1039] media: mceusb: fix control-message timeouts
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0045/1039] media: flexcop-usb: fix control-message timeouts Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0047/1039] media: em28xx: " Greg Kroah-Hartman
` (946 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Hans Verkuil,
Mauro Carvalho Chehab
From: Johan Hovold <johan@kernel.org>
commit 16394e998cbb050730536bdf7e89f5a70efbd974 upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Fixes: 66e89522aff7 ("V4L/DVB: IR: add mceusb IR receiver driver")
Cc: stable@vger.kernel.org # 2.6.36
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/mceusb.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/media/rc/mceusb.c
+++ b/drivers/media/rc/mceusb.c
@@ -1430,7 +1430,7 @@ static void mceusb_gen1_init(struct mceu
*/
ret = usb_control_msg(ir->usbdev, usb_rcvctrlpipe(ir->usbdev, 0),
USB_REQ_SET_ADDRESS, USB_TYPE_VENDOR, 0, 0,
- data, USB_CTRL_MSG_SZ, HZ * 3);
+ data, USB_CTRL_MSG_SZ, 3000);
dev_dbg(dev, "set address - ret = %d", ret);
dev_dbg(dev, "set address - data[0] = %d, data[1] = %d",
data[0], data[1]);
@@ -1438,20 +1438,20 @@ static void mceusb_gen1_init(struct mceu
/* set feature: bit rate 38400 bps */
ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0),
USB_REQ_SET_FEATURE, USB_TYPE_VENDOR,
- 0xc04e, 0x0000, NULL, 0, HZ * 3);
+ 0xc04e, 0x0000, NULL, 0, 3000);
dev_dbg(dev, "set feature - ret = %d", ret);
/* bRequest 4: set char length to 8 bits */
ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0),
4, USB_TYPE_VENDOR,
- 0x0808, 0x0000, NULL, 0, HZ * 3);
+ 0x0808, 0x0000, NULL, 0, 3000);
dev_dbg(dev, "set char length - retB = %d", ret);
/* bRequest 2: set handshaking to use DTR/DSR */
ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0),
2, USB_TYPE_VENDOR,
- 0x0000, 0x0100, NULL, 0, HZ * 3);
+ 0x0000, 0x0100, NULL, 0, 3000);
dev_dbg(dev, "set handshake - retC = %d", ret);
/* device resume */
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0047/1039] media: em28xx: fix control-message timeouts
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0046/1039] media: mceusb: " Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0048/1039] media: cpia2: " Greg Kroah-Hartman
` (945 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Hans Verkuil,
Mauro Carvalho Chehab
From: Johan Hovold <johan@kernel.org>
commit d9b7e8df3aa9b8c10708aab60e72e79ac08237e4 upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Fixes: a6c2ba283565 ("[PATCH] v4l: 716: support for em28xx board family")
Cc: stable@vger.kernel.org # 2.6.16
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/em28xx/em28xx-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/usb/em28xx/em28xx-core.c
+++ b/drivers/media/usb/em28xx/em28xx-core.c
@@ -89,7 +89,7 @@ int em28xx_read_reg_req_len(struct em28x
mutex_lock(&dev->ctrl_urb_lock);
ret = usb_control_msg(udev, pipe, req,
USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
- 0x0000, reg, dev->urb_buf, len, HZ);
+ 0x0000, reg, dev->urb_buf, len, 1000);
if (ret < 0) {
em28xx_regdbg("(pipe 0x%08x): IN: %02x %02x %02x %02x %02x %02x %02x %02x failed with error %i\n",
pipe,
@@ -158,7 +158,7 @@ int em28xx_write_regs_req(struct em28xx
memcpy(dev->urb_buf, buf, len);
ret = usb_control_msg(udev, pipe, req,
USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
- 0x0000, reg, dev->urb_buf, len, HZ);
+ 0x0000, reg, dev->urb_buf, len, 1000);
mutex_unlock(&dev->ctrl_urb_lock);
if (ret < 0) {
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0048/1039] media: cpia2: fix control-message timeouts
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0047/1039] media: em28xx: " Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0049/1039] media: s2255: " Greg Kroah-Hartman
` (944 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Hans Verkuil,
Mauro Carvalho Chehab
From: Johan Hovold <johan@kernel.org>
commit 10729be03327f53258cb196362015ad5c6eabe02 upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Fixes: ab33d5071de7 ("V4L/DVB (3376): Add cpia2 camera support")
Cc: stable@vger.kernel.org # 2.6.17
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/cpia2/cpia2_usb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/usb/cpia2/cpia2_usb.c
+++ b/drivers/media/usb/cpia2/cpia2_usb.c
@@ -550,7 +550,7 @@ static int write_packet(struct usb_devic
0, /* index */
buf, /* buffer */
size,
- HZ);
+ 1000);
kfree(buf);
return ret;
@@ -582,7 +582,7 @@ static int read_packet(struct usb_device
0, /* index */
buf, /* buffer */
size,
- HZ);
+ 1000);
if (ret >= 0)
memcpy(registers, buf, size);
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0049/1039] media: s2255: fix control-message timeouts
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0048/1039] media: cpia2: " Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0050/1039] media: dib0700: fix undefined behavior in tuner shutdown Greg Kroah-Hartman
` (943 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Hans Verkuil,
Mauro Carvalho Chehab
From: Johan Hovold <johan@kernel.org>
commit f71d272ad4e354097020a4e6b1dc6e4b59feb50f upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Use the common control-message timeout define for the five-second
timeouts.
Fixes: 38f993ad8b1f ("V4L/DVB (8125): This driver adds support for the Sensoray 2255 devices.")
Cc: stable@vger.kernel.org # 2.6.27
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/s2255/s2255drv.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/usb/s2255/s2255drv.c
+++ b/drivers/media/usb/s2255/s2255drv.c
@@ -1882,7 +1882,7 @@ static long s2255_vendor_req(struct s225
USB_TYPE_VENDOR | USB_RECIP_DEVICE |
USB_DIR_IN,
Value, Index, buf,
- TransferBufferLength, HZ * 5);
+ TransferBufferLength, USB_CTRL_SET_TIMEOUT);
if (r >= 0)
memcpy(TransferBuffer, buf, TransferBufferLength);
@@ -1891,7 +1891,7 @@ static long s2255_vendor_req(struct s225
r = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
Request, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
Value, Index, buf,
- TransferBufferLength, HZ * 5);
+ TransferBufferLength, USB_CTRL_SET_TIMEOUT);
}
kfree(buf);
return r;
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0050/1039] media: dib0700: fix undefined behavior in tuner shutdown
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0049/1039] media: s2255: " Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0051/1039] media: redrat3: fix control-message timeouts Greg Kroah-Hartman
` (942 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Kuron, Mauro Carvalho Chehab
From: Michael Kuron <michael.kuron@gmail.com>
commit f7b77ebe6d2f49c7747b2d619586d1aa33f9ea91 upstream.
This fixes a problem where closing the tuner would leave it in a state
where it would not tune to any channel when reopened. This problem was
discovered as part of https://github.com/hselasky/webcamd/issues/16.
Since adap->id is 0 or 1, this bit-shift overflows, which is undefined
behavior. The driver still worked in practice as the overflow would in
most environments result in 0, which rendered the line a no-op. When
running the driver as part of webcamd however, the overflow could lead
to 0xff due to optimizations by the compiler, which would, in the end,
improperly shut down the tuner.
The bug is a regression introduced in the commit referenced below. The
present patch causes identical behavior to before that commit for
adap->id equal to 0 or 1. The driver does not contain support for
dib0700 devices with more adapters, assuming such even exist.
Tests have been performed with the Xbox One Digital TV Tuner on amd64.
Not all dib0700 devices are expected to be affected by the regression;
this code path is only taken by those with incorrect endpoint numbers.
Link: https://lore.kernel.org/linux-media/1d2fc36d94ced6f67c7cc21dcc469d5e5bdd8201.1632689033.git.mchehab+huawei@kernel.org
Cc: stable@vger.kernel.org
Fixes: 7757ddda6f4f ("[media] DiB0700: add function to change I2C-speed")
Signed-off-by: Michael Kuron <michael.kuron@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/dvb-usb/dib0700_core.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/media/usb/dvb-usb/dib0700_core.c
+++ b/drivers/media/usb/dvb-usb/dib0700_core.c
@@ -618,8 +618,6 @@ int dib0700_streaming_ctrl(struct dvb_us
deb_info("the endpoint number (%i) is not correct, use the adapter id instead", adap->fe_adap[0].stream.props.endpoint);
if (onoff)
st->channel_state |= 1 << (adap->id);
- else
- st->channel_state |= 1 << ~(adap->id);
} else {
if (onoff)
st->channel_state |= 1 << (adap->fe_adap[0].stream.props.endpoint-2);
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0051/1039] media: redrat3: fix control-message timeouts
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0050/1039] media: dib0700: fix undefined behavior in tuner shutdown Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0052/1039] media: pvrusb2: " Greg Kroah-Hartman
` (941 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Hans Verkuil,
Mauro Carvalho Chehab
From: Johan Hovold <johan@kernel.org>
commit 2adc965c8bfa224e11ecccf9c92fd458c4236428 upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Fixes: 2154be651b90 ("[media] redrat3: new rc-core IR transceiver device driver")
Cc: stable@vger.kernel.org # 3.0
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/redrat3.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -404,7 +404,7 @@ static int redrat3_send_cmd(int cmd, str
udev = rr3->udev;
res = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), cmd,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
- 0x0000, 0x0000, data, sizeof(u8), HZ * 10);
+ 0x0000, 0x0000, data, sizeof(u8), 10000);
if (res < 0) {
dev_err(rr3->dev, "%s: Error sending rr3 cmd res %d, data %d",
@@ -480,7 +480,7 @@ static u32 redrat3_get_timeout(struct re
pipe = usb_rcvctrlpipe(rr3->udev, 0);
ret = usb_control_msg(rr3->udev, pipe, RR3_GET_IR_PARAM,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
- RR3_IR_IO_SIG_TIMEOUT, 0, tmp, len, HZ * 5);
+ RR3_IR_IO_SIG_TIMEOUT, 0, tmp, len, 5000);
if (ret != len)
dev_warn(rr3->dev, "Failed to read timeout from hardware\n");
else {
@@ -510,7 +510,7 @@ static int redrat3_set_timeout(struct rc
ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), RR3_SET_IR_PARAM,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
RR3_IR_IO_SIG_TIMEOUT, 0, timeout, sizeof(*timeout),
- HZ * 25);
+ 25000);
dev_dbg(dev, "set ir parm timeout %d ret 0x%02x\n",
be32_to_cpu(*timeout), ret);
@@ -542,32 +542,32 @@ static void redrat3_reset(struct redrat3
*val = 0x01;
rc = usb_control_msg(udev, rxpipe, RR3_RESET,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
- RR3_CPUCS_REG_ADDR, 0, val, len, HZ * 25);
+ RR3_CPUCS_REG_ADDR, 0, val, len, 25000);
dev_dbg(dev, "reset returned 0x%02x\n", rc);
*val = length_fuzz;
rc = usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
- RR3_IR_IO_LENGTH_FUZZ, 0, val, len, HZ * 25);
+ RR3_IR_IO_LENGTH_FUZZ, 0, val, len, 25000);
dev_dbg(dev, "set ir parm len fuzz %d rc 0x%02x\n", *val, rc);
*val = (65536 - (minimum_pause * 2000)) / 256;
rc = usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
- RR3_IR_IO_MIN_PAUSE, 0, val, len, HZ * 25);
+ RR3_IR_IO_MIN_PAUSE, 0, val, len, 25000);
dev_dbg(dev, "set ir parm min pause %d rc 0x%02x\n", *val, rc);
*val = periods_measure_carrier;
rc = usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
- RR3_IR_IO_PERIODS_MF, 0, val, len, HZ * 25);
+ RR3_IR_IO_PERIODS_MF, 0, val, len, 25000);
dev_dbg(dev, "set ir parm periods measure carrier %d rc 0x%02x", *val,
rc);
*val = RR3_DRIVER_MAXLENS;
rc = usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
- RR3_IR_IO_MAX_LENGTHS, 0, val, len, HZ * 25);
+ RR3_IR_IO_MAX_LENGTHS, 0, val, len, 25000);
dev_dbg(dev, "set ir parm max lens %d rc 0x%02x\n", *val, rc);
kfree(val);
@@ -585,7 +585,7 @@ static void redrat3_get_firmware_rev(str
rc = usb_control_msg(rr3->udev, usb_rcvctrlpipe(rr3->udev, 0),
RR3_FW_VERSION,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
- 0, 0, buffer, RR3_FW_VERSION_LEN, HZ * 5);
+ 0, 0, buffer, RR3_FW_VERSION_LEN, 5000);
if (rc >= 0)
dev_info(rr3->dev, "Firmware rev: %s", buffer);
@@ -825,14 +825,14 @@ static int redrat3_transmit_ir(struct rc
pipe = usb_sndbulkpipe(rr3->udev, rr3->ep_out->bEndpointAddress);
ret = usb_bulk_msg(rr3->udev, pipe, irdata,
- sendbuf_len, &ret_len, 10 * HZ);
+ sendbuf_len, &ret_len, 10000);
dev_dbg(dev, "sent %d bytes, (ret %d)\n", ret_len, ret);
/* now tell the hardware to transmit what we sent it */
pipe = usb_rcvctrlpipe(rr3->udev, 0);
ret = usb_control_msg(rr3->udev, pipe, RR3_TX_SEND_SIGNAL,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
- 0, 0, irdata, 2, HZ * 10);
+ 0, 0, irdata, 2, 10000);
if (ret < 0)
dev_err(dev, "Error: control msg send failed, rc %d\n", ret);
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0052/1039] media: pvrusb2: fix control-message timeouts
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0051/1039] media: redrat3: fix control-message timeouts Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0053/1039] media: stk1160: " Greg Kroah-Hartman
` (940 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Hans Verkuil,
Mauro Carvalho Chehab
From: Johan Hovold <johan@kernel.org>
commit b82bf9b9dc305d7d3d93eab106d70dbf2171b43e upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Fixes: d855497edbfb ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18")
Cc: stable@vger.kernel.org # 2.6.18
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
@@ -1467,7 +1467,7 @@ static int pvr2_upload_firmware1(struct
for (address = 0; address < fwsize; address += 0x800) {
memcpy(fw_ptr, fw_entry->data + address, 0x800);
ret += usb_control_msg(hdw->usb_dev, pipe, 0xa0, 0x40, address,
- 0, fw_ptr, 0x800, HZ);
+ 0, fw_ptr, 0x800, 1000);
}
trace_firmware("Upload done, releasing device's CPU");
@@ -1605,7 +1605,7 @@ int pvr2_upload_firmware2(struct pvr2_hd
((u32 *)fw_ptr)[icnt] = swab32(((u32 *)fw_ptr)[icnt]);
ret |= usb_bulk_msg(hdw->usb_dev, pipe, fw_ptr,bcnt,
- &actual_length, HZ);
+ &actual_length, 1000);
ret |= (actual_length != bcnt);
if (ret) break;
fw_done += bcnt;
@@ -3438,7 +3438,7 @@ void pvr2_hdw_cpufw_set_enabled(struct p
0xa0,0xc0,
address,0,
hdw->fw_buffer+address,
- 0x800,HZ);
+ 0x800,1000);
if (ret < 0) break;
}
@@ -3977,7 +3977,7 @@ void pvr2_hdw_cpureset_assert(struct pvr
/* Write the CPUCS register on the 8051. The lsb of the register
is the reset bit; a 1 asserts reset while a 0 clears it. */
pipe = usb_sndctrlpipe(hdw->usb_dev, 0);
- ret = usb_control_msg(hdw->usb_dev,pipe,0xa0,0x40,0xe600,0,da,1,HZ);
+ ret = usb_control_msg(hdw->usb_dev,pipe,0xa0,0x40,0xe600,0,da,1,1000);
if (ret < 0) {
pvr2_trace(PVR2_TRACE_ERROR_LEGS,
"cpureset_assert(%d) error=%d",val,ret);
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0053/1039] media: stk1160: fix control-message timeouts
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0052/1039] media: pvrusb2: " Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0054/1039] media: cec-pin: fix interrupt en/disable handling Greg Kroah-Hartman
` (939 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Hans Verkuil,
Mauro Carvalho Chehab
From: Johan Hovold <johan@kernel.org>
commit 6aa6e70cdb5b863a57bad61310bf89b6617a5d2d upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Fixes: 9cb2173e6ea8 ("[media] media: Add stk1160 new driver (easycap replacement)")
Cc: stable@vger.kernel.org # 3.7
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/stk1160/stk1160-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/usb/stk1160/stk1160-core.c
+++ b/drivers/media/usb/stk1160/stk1160-core.c
@@ -65,7 +65,7 @@ int stk1160_read_reg(struct stk1160 *dev
return -ENOMEM;
ret = usb_control_msg(dev->udev, pipe, 0x00,
USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
- 0x00, reg, buf, sizeof(u8), HZ);
+ 0x00, reg, buf, sizeof(u8), 1000);
if (ret < 0) {
stk1160_err("read failed on reg 0x%x (%d)\n",
reg, ret);
@@ -85,7 +85,7 @@ int stk1160_write_reg(struct stk1160 *de
ret = usb_control_msg(dev->udev, pipe, 0x01,
USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
- value, reg, NULL, 0, HZ);
+ value, reg, NULL, 0, 1000);
if (ret < 0) {
stk1160_err("write failed on reg 0x%x (%d)\n",
reg, ret);
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0054/1039] media: cec-pin: fix interrupt en/disable handling
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0053/1039] media: stk1160: " Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0055/1039] can: softing_cs: softingcs_probe(): fix memleak on registration failure Greg Kroah-Hartman
` (938 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Mauro Carvalho Chehab
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
commit 713bdfa10b5957053811470d298def9537d9ff13 upstream.
The en/disable_irq() functions keep track of the 'depth': i.e. if
interrupts are disabled twice, then it needs to enable_irq() calls to
enable them again. The cec-pin framework didn't take this into accound
and could disable irqs multiple times, and it expected that a single
enable_irq() would enable them again.
Move all calls to en/disable_irq() to the kthread where it is easy
to keep track of the current irq state and ensure that multiple
en/disable_irq calls never happen.
If interrupts where disabled twice, then they would never turn on
again, leaving the CEC adapter in a dead state.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Fixes: 865463fc03ed (media: cec-pin: add error injection support)
Cc: <stable@vger.kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/cec/core/cec-pin.c | 31 ++++++++++++++++++-------------
1 file changed, 18 insertions(+), 13 deletions(-)
--- a/drivers/media/cec/core/cec-pin.c
+++ b/drivers/media/cec/core/cec-pin.c
@@ -1033,6 +1033,7 @@ static int cec_pin_thread_func(void *_ad
{
struct cec_adapter *adap = _adap;
struct cec_pin *pin = adap->pin;
+ bool irq_enabled = false;
for (;;) {
wait_event_interruptible(pin->kthread_waitq,
@@ -1060,6 +1061,7 @@ static int cec_pin_thread_func(void *_ad
ns_to_ktime(pin->work_rx_msg.rx_ts));
msg->len = 0;
}
+
if (pin->work_tx_status) {
unsigned int tx_status = pin->work_tx_status;
@@ -1083,27 +1085,39 @@ static int cec_pin_thread_func(void *_ad
switch (atomic_xchg(&pin->work_irq_change,
CEC_PIN_IRQ_UNCHANGED)) {
case CEC_PIN_IRQ_DISABLE:
- pin->ops->disable_irq(adap);
+ if (irq_enabled) {
+ pin->ops->disable_irq(adap);
+ irq_enabled = false;
+ }
cec_pin_high(pin);
cec_pin_to_idle(pin);
hrtimer_start(&pin->timer, ns_to_ktime(0),
HRTIMER_MODE_REL);
break;
case CEC_PIN_IRQ_ENABLE:
+ if (irq_enabled)
+ break;
pin->enable_irq_failed = !pin->ops->enable_irq(adap);
if (pin->enable_irq_failed) {
cec_pin_to_idle(pin);
hrtimer_start(&pin->timer, ns_to_ktime(0),
HRTIMER_MODE_REL);
+ } else {
+ irq_enabled = true;
}
break;
default:
break;
}
-
if (kthread_should_stop())
break;
}
+ if (pin->ops->disable_irq && irq_enabled)
+ pin->ops->disable_irq(adap);
+ hrtimer_cancel(&pin->timer);
+ cec_pin_read(pin);
+ cec_pin_to_idle(pin);
+ pin->state = CEC_ST_OFF;
return 0;
}
@@ -1130,13 +1144,7 @@ static int cec_pin_adap_enable(struct ce
hrtimer_start(&pin->timer, ns_to_ktime(0),
HRTIMER_MODE_REL);
} else {
- if (pin->ops->disable_irq)
- pin->ops->disable_irq(adap);
- hrtimer_cancel(&pin->timer);
kthread_stop(pin->kthread);
- cec_pin_read(pin);
- cec_pin_to_idle(pin);
- pin->state = CEC_ST_OFF;
}
return 0;
}
@@ -1157,11 +1165,8 @@ void cec_pin_start_timer(struct cec_pin
if (pin->state != CEC_ST_RX_IRQ)
return;
- atomic_set(&pin->work_irq_change, CEC_PIN_IRQ_UNCHANGED);
- pin->ops->disable_irq(pin->adap);
- cec_pin_high(pin);
- cec_pin_to_idle(pin);
- hrtimer_start(&pin->timer, ns_to_ktime(0), HRTIMER_MODE_REL);
+ atomic_set(&pin->work_irq_change, CEC_PIN_IRQ_DISABLE);
+ wake_up_interruptible(&pin->kthread_waitq);
}
static int cec_pin_adap_transmit(struct cec_adapter *adap, u8 attempts,
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0055/1039] can: softing_cs: softingcs_probe(): fix memleak on registration failure
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0054/1039] media: cec-pin: fix interrupt en/disable handling Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0056/1039] mei: hbm: fix client dma reply status Greg Kroah-Hartman
` (937 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold, Marc Kleine-Budde
From: Johan Hovold <johan@kernel.org>
commit ced4913efb0acc844ed65cc01d091a85d83a2082 upstream.
In case device registration fails during probe, the driver state and
the embedded platform device structure needs to be freed using
platform_device_put() to properly free all resources (e.g. the device
name).
Fixes: 0a0b7a5f7a04 ("can: add driver for Softing card")
Link: https://lore.kernel.org/all/20211222104843.6105-1-johan@kernel.org
Cc: stable@vger.kernel.org # 2.6.38
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/softing/softing_cs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/can/softing/softing_cs.c
+++ b/drivers/net/can/softing/softing_cs.c
@@ -293,7 +293,7 @@ static int softingcs_probe(struct pcmcia
return 0;
platform_failed:
- kfree(dev);
+ platform_device_put(pdev);
mem_failed:
pcmcia_bad:
pcmcia_failed:
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0056/1039] mei: hbm: fix client dma reply status
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0055/1039] can: softing_cs: softingcs_probe(): fix memleak on registration failure Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0057/1039] iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs Greg Kroah-Hartman
` (936 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Emmanuel Grumbach, Tomas Winkler,
Alexander Usyskin
From: Alexander Usyskin <alexander.usyskin@intel.com>
commit 6b0b80ac103b2a40c72a47c301745fd1f4ef4697 upstream.
Don't blindly copy status value received from the firmware
into internal client status field,
It may be positive and ERR_PTR(ret) will translate it
into an invalid address and the caller will crash.
Put the error code into the client status on failure.
Fixes: 369aea845951 ("mei: implement client dma setup.")
Cc: <stable@vger.kernel.org> # v5.11+
Reported-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Tested-by: : Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Acked-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20211228082047.378115-1-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/mei/hbm.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -672,10 +672,14 @@ static void mei_hbm_cl_dma_map_res(struc
if (!cl)
return;
- dev_dbg(dev->dev, "cl dma map result = %d\n", res->status);
- cl->status = res->status;
- if (!cl->status)
+ if (res->status) {
+ dev_err(dev->dev, "cl dma map failed %d\n", res->status);
+ cl->status = -EFAULT;
+ } else {
+ dev_dbg(dev->dev, "cl dma map succeeded\n");
cl->dma_mapped = 1;
+ cl->status = 0;
+ }
wake_up(&cl->wait);
}
@@ -698,10 +702,14 @@ static void mei_hbm_cl_dma_unmap_res(str
if (!cl)
return;
- dev_dbg(dev->dev, "cl dma unmap result = %d\n", res->status);
- cl->status = res->status;
- if (!cl->status)
+ if (res->status) {
+ dev_err(dev->dev, "cl dma unmap failed %d\n", res->status);
+ cl->status = -EFAULT;
+ } else {
+ dev_dbg(dev->dev, "cl dma unmap succeeded\n");
cl->dma_mapped = 0;
+ cl->status = 0;
+ }
wake_up(&cl->wait);
}
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0057/1039] iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0056/1039] mei: hbm: fix client dma reply status Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0058/1039] iio: trigger: Fix a scheduling whilst atomic issue seen on tsc2046 Greg Kroah-Hartman
` (935 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kunyang Fan, Jonathan Cameron,
Andy Shevchenko, Stable
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
commit c9791a94384af07592d29504004d2255dbaf8663 upstream.
Unfortuanately a non standards compliant ACPI ID is known to be
in the wild on some AAEON boards.
Partly revert the removal of these IDs so that ADC081C will again
work + add a comment to that affect for future reference.
Whilst here use generic firmware properties rather than the ACPI
specific handling previously found in this driver.
Reported-by: Kunyang Fan <Kunyang_Fan@aaeon.com.tw>
Fixes: c458b7ca3fd0 ("iio:adc:ti-adc081c: Drop ACPI ids that seem very unlikely to be official.")
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
Tested-by: Kunyang Fan <Kunyang_Fan@aaeon.com.tw> #UP-extremei11
Link: https://lore.kernel.org/r/20211205172728.2826512-1-jic23@kernel.org
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/ti-adc081c.c | 22 +++++++++++++++++-----
1 file changed, 17 insertions(+), 5 deletions(-)
--- a/drivers/iio/adc/ti-adc081c.c
+++ b/drivers/iio/adc/ti-adc081c.c
@@ -19,6 +19,7 @@
#include <linux/i2c.h>
#include <linux/module.h>
#include <linux/mod_devicetable.h>
+#include <linux/property.h>
#include <linux/iio/iio.h>
#include <linux/iio/buffer.h>
@@ -156,13 +157,16 @@ static int adc081c_probe(struct i2c_clie
{
struct iio_dev *iio;
struct adc081c *adc;
- struct adcxx1c_model *model;
+ const struct adcxx1c_model *model;
int err;
if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_WORD_DATA))
return -EOPNOTSUPP;
- model = &adcxx1c_models[id->driver_data];
+ if (dev_fwnode(&client->dev))
+ model = device_get_match_data(&client->dev);
+ else
+ model = &adcxx1c_models[id->driver_data];
iio = devm_iio_device_alloc(&client->dev, sizeof(*adc));
if (!iio)
@@ -210,10 +214,17 @@ static const struct i2c_device_id adc081
};
MODULE_DEVICE_TABLE(i2c, adc081c_id);
+static const struct acpi_device_id adc081c_acpi_match[] = {
+ /* Used on some AAEON boards */
+ { "ADC081C", (kernel_ulong_t)&adcxx1c_models[ADC081C] },
+ { }
+};
+MODULE_DEVICE_TABLE(acpi, adc081c_acpi_match);
+
static const struct of_device_id adc081c_of_match[] = {
- { .compatible = "ti,adc081c" },
- { .compatible = "ti,adc101c" },
- { .compatible = "ti,adc121c" },
+ { .compatible = "ti,adc081c", .data = &adcxx1c_models[ADC081C] },
+ { .compatible = "ti,adc101c", .data = &adcxx1c_models[ADC101C] },
+ { .compatible = "ti,adc121c", .data = &adcxx1c_models[ADC121C] },
{ }
};
MODULE_DEVICE_TABLE(of, adc081c_of_match);
@@ -222,6 +233,7 @@ static struct i2c_driver adc081c_driver
.driver = {
.name = "adc081c",
.of_match_table = adc081c_of_match,
+ .acpi_match_table = adc081c_acpi_match,
},
.probe = adc081c_probe,
.id_table = adc081c_id,
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0058/1039] iio: trigger: Fix a scheduling whilst atomic issue seen on tsc2046
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0057/1039] iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0059/1039] lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() Greg Kroah-Hartman
` (934 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jonathan Cameron,
Pengutronix Kernel Team, Dmitry Torokhov, Oleksij Rempel, Stable
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
commit 9020ef659885f2622cfb386cc229b6d618362895 upstream.
IIO triggers are software IRQ chips that split an incoming IRQ into
separate IRQs routed to all devices using the trigger.
When all consumers are done then a trigger callback reenable() is
called. There are a few circumstances under which this can happen
in atomic context.
1) A single user of the trigger that calls the iio_trigger_done()
function from interrupt context.
2) A race between disconnecting the last device from a trigger and
the trigger itself sucessfully being disabled.
To avoid a resulting scheduling whilst atomic, close this second corner
by using schedule_work() to ensure the reenable is not done in atomic
context.
Note that drivers must be careful to manage the interaction of
set_state() and reenable() callbacks to ensure appropriate reference
counting if they are relying on the same hardware controls.
Deliberately taking this the slow path rather than via a fixes tree
because the error has hard to hit and I would like it to soak for a while
before hitting a release kernel.
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Tested-by: Oleksij Rempel <o.rempel@pengutronix.de>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211017172209.112387-1-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/industrialio-trigger.c | 36 +++++++++++++++++++++++++++++++++++-
include/linux/iio/trigger.h | 2 ++
2 files changed, 37 insertions(+), 1 deletion(-)
--- a/drivers/iio/industrialio-trigger.c
+++ b/drivers/iio/industrialio-trigger.c
@@ -162,6 +162,39 @@ static struct iio_trigger *iio_trigger_a
return trig;
}
+static void iio_reenable_work_fn(struct work_struct *work)
+{
+ struct iio_trigger *trig = container_of(work, struct iio_trigger,
+ reenable_work);
+
+ /*
+ * This 'might' occur after the trigger state is set to disabled -
+ * in that case the driver should skip reenabling.
+ */
+ trig->ops->reenable(trig);
+}
+
+/*
+ * In general, reenable callbacks may need to sleep and this path is
+ * not performance sensitive, so just queue up a work item
+ * to reneable the trigger for us.
+ *
+ * Races that can cause this.
+ * 1) A handler occurs entirely in interrupt context so the counter
+ * the final decrement is still in this interrupt.
+ * 2) The trigger has been removed, but one last interrupt gets through.
+ *
+ * For (1) we must call reenable, but not in atomic context.
+ * For (2) it should be safe to call reenanble, if drivers never blindly
+ * reenable after state is off.
+ */
+static void iio_trigger_notify_done_atomic(struct iio_trigger *trig)
+{
+ if (atomic_dec_and_test(&trig->use_count) && trig->ops &&
+ trig->ops->reenable)
+ schedule_work(&trig->reenable_work);
+}
+
void iio_trigger_poll(struct iio_trigger *trig)
{
int i;
@@ -173,7 +206,7 @@ void iio_trigger_poll(struct iio_trigger
if (trig->subirqs[i].enabled)
generic_handle_irq(trig->subirq_base + i);
else
- iio_trigger_notify_done(trig);
+ iio_trigger_notify_done_atomic(trig);
}
}
}
@@ -535,6 +568,7 @@ struct iio_trigger *viio_trigger_alloc(s
trig->dev.type = &iio_trig_type;
trig->dev.bus = &iio_bus_type;
device_initialize(&trig->dev);
+ INIT_WORK(&trig->reenable_work, iio_reenable_work_fn);
mutex_init(&trig->pool_lock);
trig->subirq_base = irq_alloc_descs(-1, 0,
--- a/include/linux/iio/trigger.h
+++ b/include/linux/iio/trigger.h
@@ -55,6 +55,7 @@ struct iio_trigger_ops {
* @attached_own_device:[INTERN] if we are using our own device as trigger,
* i.e. if we registered a poll function to the same
* device as the one providing the trigger.
+ * @reenable_work: [INTERN] work item used to ensure reenable can sleep.
**/
struct iio_trigger {
const struct iio_trigger_ops *ops;
@@ -74,6 +75,7 @@ struct iio_trigger {
unsigned long pool[BITS_TO_LONGS(CONFIG_IIO_CONSUMERS_PER_TRIGGER)];
struct mutex pool_lock;
bool attached_own_device;
+ struct work_struct reenable_work;
};
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0059/1039] lkdtm: Fix content of section containing lkdtm_rodata_do_nothing()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0058/1039] iio: trigger: Fix a scheduling whilst atomic issue seen on tsc2046 Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0060/1039] bus: mhi: pci_generic: Graceful shutdown on freeze Greg Kroah-Hartman
` (933 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kees Cook, Arnd Bergmann,
Nick Desaulniers, Nathan Chancellor, Christophe Leroy
From: Christophe Leroy <christophe.leroy@csgroup.eu>
commit bc93a22a19eb2b68a16ecf04cdf4b2ed65aaf398 upstream.
On a kernel without CONFIG_STRICT_KERNEL_RWX, running EXEC_RODATA
test leads to "Illegal instruction" failure.
Looking at the content of rodata_objcopy.o, we see that the
function content zeroes only:
Disassembly of section .rodata:
0000000000000000 <.lkdtm_rodata_do_nothing>:
0: 00 00 00 00 .long 0x0
Add the contents flag in order to keep the content of the section
while renaming it.
Disassembly of section .rodata:
0000000000000000 <.lkdtm_rodata_do_nothing>:
0: 4e 80 00 20 blr
Fixes: e9e08a07385e ("lkdtm: support llvm-objcopy")
Cc: stable@vger.kernel.org
Cc: Kees Cook <keescook@chromium.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/8900731fbc05fb8b0de18af7133a8fc07c3c53a1.1633712176.git.christophe.leroy@csgroup.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/lkdtm/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/misc/lkdtm/Makefile
+++ b/drivers/misc/lkdtm/Makefile
@@ -20,7 +20,7 @@ CFLAGS_REMOVE_rodata.o += $(CC_FLAGS_LT
OBJCOPYFLAGS :=
OBJCOPYFLAGS_rodata_objcopy.o := \
- --rename-section .noinstr.text=.rodata,alloc,readonly,load
+ --rename-section .noinstr.text=.rodata,alloc,readonly,load,contents
targets += rodata.o rodata_objcopy.o
$(obj)/rodata_objcopy.o: $(obj)/rodata.o FORCE
$(call if_changed,objcopy)
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0060/1039] bus: mhi: pci_generic: Graceful shutdown on freeze
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0059/1039] lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0061/1039] bus: mhi: core: Fix reading wake_capable channel configuration Greg Kroah-Hartman
` (932 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bhaumik Bhatt, Hemant Kumar,
Manivannan Sadhasivam, Loic Poulain, Manivannan Sadhasivam
From: Loic Poulain <loic.poulain@linaro.org>
commit f77097ec8c0141a4b5cf3722a246be0cb5677e29 upstream.
There is no reason for shutting down MHI ungracefully on freeze,
this causes the MHI host stack & device stack to not be aligned
anymore since the proper MHI reset sequence is not performed for
ungraceful shutdown.
Link: https://lore.kernel.org/r/1635268180-13699-1-git-send-email-loic.poulain@linaro.org
Fixes: 5f0c2ee1fe8d ("bus: mhi: pci-generic: Fix hibernation")
Cc: stable@vger.kernel.org
Suggested-by: Bhaumik Bhatt <bbhatt@codeaurora.org>
Reviewed-by: Bhaumik Bhatt <bbhatt@codeaurora.org>
Reviewed-by: Hemant Kumar <hemantk@codeaurora.org>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/20211216081227.237749-3-manivannan.sadhasivam@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bus/mhi/pci_generic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/bus/mhi/pci_generic.c
+++ b/drivers/bus/mhi/pci_generic.c
@@ -1018,7 +1018,7 @@ static int __maybe_unused mhi_pci_freeze
* context.
*/
if (test_and_clear_bit(MHI_PCI_DEV_STARTED, &mhi_pdev->status)) {
- mhi_power_down(mhi_cntrl, false);
+ mhi_power_down(mhi_cntrl, true);
mhi_unprepare_after_power_down(mhi_cntrl);
}
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0061/1039] bus: mhi: core: Fix reading wake_capable channel configuration
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0060/1039] bus: mhi: pci_generic: Graceful shutdown on freeze Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0062/1039] bus: mhi: core: Fix race while handling SYS_ERR at power up Greg Kroah-Hartman
` (931 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Manivannan Sadhasivam, Bhaumik Bhatt,
Manivannan Sadhasivam
From: Bhaumik Bhatt <quic_bbhatt@quicinc.com>
commit 42c4668f7efe1485dfc382517b412c0c6ab102b8 upstream.
The 'wake-capable' entry in channel configuration is not set when
parsing the configuration specified by the controller driver. Add
the missing entry to ensure channel is correctly specified as a
'wake-capable' channel.
Link: https://lore.kernel.org/r/1638320491-13382-1-git-send-email-quic_bbhatt@quicinc.com
Fixes: 0cbf260820fa ("bus: mhi: core: Add support for registering MHI controllers")
Cc: stable@vger.kernel.org
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bhaumik Bhatt <quic_bbhatt@quicinc.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/20211216081227.237749-7-manivannan.sadhasivam@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bus/mhi/core/init.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/bus/mhi/core/init.c
+++ b/drivers/bus/mhi/core/init.c
@@ -788,6 +788,7 @@ static int parse_ch_cfg(struct mhi_contr
mhi_chan->offload_ch = ch_cfg->offload_channel;
mhi_chan->db_cfg.reset_req = ch_cfg->doorbell_mode_switch;
mhi_chan->pre_alloc = ch_cfg->auto_queue;
+ mhi_chan->wake_capable = ch_cfg->wake_capable;
/*
* If MHI host allocates buffers, then the channel direction
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0062/1039] bus: mhi: core: Fix race while handling SYS_ERR at power up
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0061/1039] bus: mhi: core: Fix reading wake_capable channel configuration Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0063/1039] cxl/pmem: Fix reference counting for delayed work Greg Kroah-Hartman
` (930 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aleksander Morgado, Thomas Perrot,
Manivannan Sadhasivam
From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
commit d651ce8e917fa1bf6cfab8dca74c512edffc35d3 upstream.
During SYS_ERR condition, as a response to the MHI_RESET from host, some
devices tend to issue BHI interrupt without clearing the SYS_ERR state in
the device. This creates a race condition and causes a failure in booting
up the device.
The issue is seen on the Sierra Wireless EM9191 modem during SYS_ERR
handling in mhi_async_power_up(). Once the host detects that the device
is in SYS_ERR state, it issues MHI_RESET and waits for the device to
process the reset request. During this time, the device triggers the BHI
interrupt to the host without clearing SYS_ERR condition. So the host
starts handling the SYS_ERR condition again.
To fix this issue, let's register the IRQ handler only after handling the
SYS_ERR check to avoid getting spurious IRQs from the device.
Fixes: e18d4e9fa79b ("bus: mhi: core: Handle syserr during power_up")
Cc: stable@vger.kernel.org
Reported-by: Aleksander Morgado <aleksander@aleksander.es>
Tested-by: Aleksander Morgado <aleksander@aleksander.es>
Tested-by: Thomas Perrot <thomas.perrot@bootlin.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/20211216081227.237749-8-manivannan.sadhasivam@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bus/mhi/core/pm.c | 35 ++++++++++++-----------------------
1 file changed, 12 insertions(+), 23 deletions(-)
--- a/drivers/bus/mhi/core/pm.c
+++ b/drivers/bus/mhi/core/pm.c
@@ -1053,7 +1053,7 @@ int mhi_async_power_up(struct mhi_contro
enum mhi_ee_type current_ee;
enum dev_st_transition next_state;
struct device *dev = &mhi_cntrl->mhi_dev->dev;
- u32 val;
+ u32 interval_us = 25000; /* poll register field every 25 milliseconds */
int ret;
dev_info(dev, "Requested to power ON\n");
@@ -1070,10 +1070,6 @@ int mhi_async_power_up(struct mhi_contro
mutex_lock(&mhi_cntrl->pm_mutex);
mhi_cntrl->pm_state = MHI_PM_DISABLE;
- ret = mhi_init_irq_setup(mhi_cntrl);
- if (ret)
- goto error_setup_irq;
-
/* Setup BHI INTVEC */
write_lock_irq(&mhi_cntrl->pm_lock);
mhi_write_reg(mhi_cntrl, mhi_cntrl->bhi, BHI_INTVEC, 0);
@@ -1087,7 +1083,7 @@ int mhi_async_power_up(struct mhi_contro
dev_err(dev, "%s is not a valid EE for power on\n",
TO_MHI_EXEC_STR(current_ee));
ret = -EIO;
- goto error_async_power_up;
+ goto error_exit;
}
state = mhi_get_mhi_state(mhi_cntrl);
@@ -1096,20 +1092,12 @@ int mhi_async_power_up(struct mhi_contro
if (state == MHI_STATE_SYS_ERR) {
mhi_set_mhi_state(mhi_cntrl, MHI_STATE_RESET);
- ret = wait_event_timeout(mhi_cntrl->state_event,
- MHI_PM_IN_FATAL_STATE(mhi_cntrl->pm_state) ||
- mhi_read_reg_field(mhi_cntrl,
- mhi_cntrl->regs,
- MHICTRL,
- MHICTRL_RESET_MASK,
- MHICTRL_RESET_SHIFT,
- &val) ||
- !val,
- msecs_to_jiffies(mhi_cntrl->timeout_ms));
- if (!ret) {
- ret = -EIO;
+ ret = mhi_poll_reg_field(mhi_cntrl, mhi_cntrl->regs, MHICTRL,
+ MHICTRL_RESET_MASK, MHICTRL_RESET_SHIFT, 0,
+ interval_us);
+ if (ret) {
dev_info(dev, "Failed to reset MHI due to syserr state\n");
- goto error_async_power_up;
+ goto error_exit;
}
/*
@@ -1119,6 +1107,10 @@ int mhi_async_power_up(struct mhi_contro
mhi_write_reg(mhi_cntrl, mhi_cntrl->bhi, BHI_INTVEC, 0);
}
+ ret = mhi_init_irq_setup(mhi_cntrl);
+ if (ret)
+ goto error_exit;
+
/* Transition to next state */
next_state = MHI_IN_PBL(current_ee) ?
DEV_ST_TRANSITION_PBL : DEV_ST_TRANSITION_READY;
@@ -1131,10 +1123,7 @@ int mhi_async_power_up(struct mhi_contro
return 0;
-error_async_power_up:
- mhi_deinit_free_irq(mhi_cntrl);
-
-error_setup_irq:
+error_exit:
mhi_cntrl->pm_state = MHI_PM_DISABLE;
mutex_unlock(&mhi_cntrl->pm_mutex);
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0063/1039] cxl/pmem: Fix reference counting for delayed work
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0062/1039] bus: mhi: core: Fix race while handling SYS_ERR at power up Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0064/1039] cxl/pmem: Fix module reload vs workqueue state Greg Kroah-Hartman
` (929 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jonathan Cameron, Ben Widawsky, Dan Williams
From: Dan Williams <dan.j.williams@intel.com>
commit 08b9e0ab8af48895337192e683de44ab1e1b7427 upstream.
There is a potential race between queue_work() returning and the
queued-work running that could result in put_device() running before
get_device(). Introduce the cxl_nvdimm_bridge_state_work() helper that
takes the reference unconditionally, but drops it if no new work was
queued, to keep the references balanced.
Fixes: 8fdcb1704f61 ("cxl/pmem: Add initial infrastructure for pmem support")
Cc: <stable@vger.kernel.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Ben Widawsky <ben.widawsky@intel.com>
Link: https://lore.kernel.org/r/163553734757.2509761.3305231863616785470.stgit@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cxl/pmem.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
--- a/drivers/cxl/pmem.c
+++ b/drivers/cxl/pmem.c
@@ -266,14 +266,24 @@ static void cxl_nvb_update_state(struct
put_device(&cxl_nvb->dev);
}
+static void cxl_nvdimm_bridge_state_work(struct cxl_nvdimm_bridge *cxl_nvb)
+{
+ /*
+ * Take a reference that the workqueue will drop if new work
+ * gets queued.
+ */
+ get_device(&cxl_nvb->dev);
+ if (!queue_work(cxl_pmem_wq, &cxl_nvb->state_work))
+ put_device(&cxl_nvb->dev);
+}
+
static void cxl_nvdimm_bridge_remove(struct device *dev)
{
struct cxl_nvdimm_bridge *cxl_nvb = to_cxl_nvdimm_bridge(dev);
if (cxl_nvb->state == CXL_NVB_ONLINE)
cxl_nvb->state = CXL_NVB_OFFLINE;
- if (queue_work(cxl_pmem_wq, &cxl_nvb->state_work))
- get_device(&cxl_nvb->dev);
+ cxl_nvdimm_bridge_state_work(cxl_nvb);
}
static int cxl_nvdimm_bridge_probe(struct device *dev)
@@ -294,8 +304,7 @@ static int cxl_nvdimm_bridge_probe(struc
}
cxl_nvb->state = CXL_NVB_ONLINE;
- if (queue_work(cxl_pmem_wq, &cxl_nvb->state_work))
- get_device(&cxl_nvb->dev);
+ cxl_nvdimm_bridge_state_work(cxl_nvb);
return 0;
}
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0064/1039] cxl/pmem: Fix module reload vs workqueue state
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0063/1039] cxl/pmem: Fix reference counting for delayed work Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0065/1039] thermal/drivers/int340x: Fix RFIM mailbox write commands Greg Kroah-Hartman
` (928 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vishal Verma, Dan Williams
From: Dan Williams <dan.j.williams@intel.com>
commit 53989fad1286e652ea3655ae3367ba698da8d2ff upstream.
A test of the form:
while true; do modprobe -r cxl_pmem; modprobe cxl_pmem; done
May lead to a crash signature of the form:
BUG: unable to handle page fault for address: ffffffffc0660030
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
[..]
Workqueue: cxl_pmem 0xffffffffc0660030
RIP: 0010:0xffffffffc0660030
Code: Unable to access opcode bytes at RIP 0xffffffffc0660006.
[..]
Call Trace:
? process_one_work+0x4ec/0x9c0
? pwq_dec_nr_in_flight+0x100/0x100
? rwlock_bug.part.0+0x60/0x60
? worker_thread+0x2eb/0x700
In that report the 0xffffffffc0660030 address corresponds to the former
function address of cxl_nvb_update_state() from a previous load of the
module, not the current address. Fix that by arranging for ->state_work
in the 'struct cxl_nvdimm_bridge' object to be reinitialized on cxl_pmem
module reload.
Details:
Recall that CXL subsystem wants to link a CXL memory expander device to
an NVDIMM sub-hierarchy when both a persistent memory range has been
registered by the CXL platform driver (cxl_acpi) *and* when that CXL
memory expander has published persistent memory capacity (Get Partition
Info). To this end the cxl_nvdimm_bridge driver arranges to rescan the
CXL bus when either of those conditions change. The helper
bus_rescan_devices() can not be called underneath the device_lock() for
any device on that bus, so the cxl_nvdimm_bridge driver uses a workqueue
for the rescan.
Typically a driver allocates driver data to hold a 'struct work_struct'
for a driven device, but for a workqueue that may run after ->remove()
returns, driver data will have been freed. The 'struct
cxl_nvdimm_bridge' object holds the state and work_struct directly.
Unfortunately it was only arranging for that infrastructure to be
initialized once per device creation rather than the necessary once per
workqueue (cxl_pmem_wq) creation.
Introduce is_cxl_nvdimm_bridge() and cxl_nvdimm_bridge_reset() in
support of invalidating stale references to a recently destroyed
cxl_pmem_wq.
Cc: <stable@vger.kernel.org>
Fixes: 8fdcb1704f61 ("cxl/pmem: Add initial infrastructure for pmem support")
Reported-by: Vishal Verma <vishal.l.verma@intel.com>
Tested-by: Vishal Verma <vishal.l.verma@intel.com>
Link: https://lore.kernel.org/r/163665474585.3505991.8397182770066720755.stgit@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cxl/core/pmem.c | 8 +++++++-
drivers/cxl/cxl.h | 8 ++++++++
drivers/cxl/pmem.c | 29 +++++++++++++++++++++++++++--
3 files changed, 42 insertions(+), 3 deletions(-)
--- a/drivers/cxl/core/pmem.c
+++ b/drivers/cxl/core/pmem.c
@@ -51,10 +51,16 @@ struct cxl_nvdimm_bridge *to_cxl_nvdimm_
}
EXPORT_SYMBOL_GPL(to_cxl_nvdimm_bridge);
-__mock int match_nvdimm_bridge(struct device *dev, const void *data)
+bool is_cxl_nvdimm_bridge(struct device *dev)
{
return dev->type == &cxl_nvdimm_bridge_type;
}
+EXPORT_SYMBOL_NS_GPL(is_cxl_nvdimm_bridge, CXL);
+
+__mock int match_nvdimm_bridge(struct device *dev, const void *data)
+{
+ return is_cxl_nvdimm_bridge(dev);
+}
struct cxl_nvdimm_bridge *cxl_find_nvdimm_bridge(struct cxl_nvdimm *cxl_nvd)
{
--- a/drivers/cxl/cxl.h
+++ b/drivers/cxl/cxl.h
@@ -196,6 +196,13 @@ struct cxl_decoder {
};
+/**
+ * enum cxl_nvdimm_brige_state - state machine for managing bus rescans
+ * @CXL_NVB_NEW: Set at bridge create and after cxl_pmem_wq is destroyed
+ * @CXL_NVB_DEAD: Set at brige unregistration to preclude async probing
+ * @CXL_NVB_ONLINE: Target state after successful ->probe()
+ * @CXL_NVB_OFFLINE: Target state after ->remove() or failed ->probe()
+ */
enum cxl_nvdimm_brige_state {
CXL_NVB_NEW,
CXL_NVB_DEAD,
@@ -308,6 +315,7 @@ struct cxl_nvdimm_bridge *devm_cxl_add_n
struct cxl_port *port);
struct cxl_nvdimm *to_cxl_nvdimm(struct device *dev);
bool is_cxl_nvdimm(struct device *dev);
+bool is_cxl_nvdimm_bridge(struct device *dev);
int devm_cxl_add_nvdimm(struct device *host, struct cxl_memdev *cxlmd);
struct cxl_nvdimm_bridge *cxl_find_nvdimm_bridge(struct cxl_nvdimm *cxl_nvd);
--- a/drivers/cxl/pmem.c
+++ b/drivers/cxl/pmem.c
@@ -316,6 +316,31 @@ static struct cxl_driver cxl_nvdimm_brid
.id = CXL_DEVICE_NVDIMM_BRIDGE,
};
+/*
+ * Return all bridges to the CXL_NVB_NEW state to invalidate any
+ * ->state_work referring to the now destroyed cxl_pmem_wq.
+ */
+static int cxl_nvdimm_bridge_reset(struct device *dev, void *data)
+{
+ struct cxl_nvdimm_bridge *cxl_nvb;
+
+ if (!is_cxl_nvdimm_bridge(dev))
+ return 0;
+
+ cxl_nvb = to_cxl_nvdimm_bridge(dev);
+ device_lock(dev);
+ cxl_nvb->state = CXL_NVB_NEW;
+ device_unlock(dev);
+
+ return 0;
+}
+
+static void destroy_cxl_pmem_wq(void)
+{
+ destroy_workqueue(cxl_pmem_wq);
+ bus_for_each_dev(&cxl_bus_type, NULL, NULL, cxl_nvdimm_bridge_reset);
+}
+
static __init int cxl_pmem_init(void)
{
int rc;
@@ -341,7 +366,7 @@ static __init int cxl_pmem_init(void)
err_nvdimm:
cxl_driver_unregister(&cxl_nvdimm_bridge_driver);
err_bridge:
- destroy_workqueue(cxl_pmem_wq);
+ destroy_cxl_pmem_wq();
return rc;
}
@@ -349,7 +374,7 @@ static __exit void cxl_pmem_exit(void)
{
cxl_driver_unregister(&cxl_nvdimm_driver);
cxl_driver_unregister(&cxl_nvdimm_bridge_driver);
- destroy_workqueue(cxl_pmem_wq);
+ destroy_cxl_pmem_wq();
}
MODULE_LICENSE("GPL v2");
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0065/1039] thermal/drivers/int340x: Fix RFIM mailbox write commands
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0064/1039] cxl/pmem: Fix module reload vs workqueue state Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0066/1039] arm64: errata: Fix exec handling in erratum 1418040 workaround Greg Kroah-Hartman
` (927 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sumeet Pawnikar, Srinivas Pandruvada,
Rafael J. Wysocki
From: Sumeet Pawnikar <sumeet.r.pawnikar@intel.com>
commit 2685c77b80a80c57e2a25a726b82fb31e6e212ab upstream.
The existing mail mechanism only supports writing of workload types.
However, mailbox command for RFIM (cmd = 0x08) also requires write
operation which is ignored. This results in failing to store RFI
restriction.
Fixint this requires enhancing mailbox writes for non workload
commands too, so remove the check for MBOX_CMD_WORKLOAD_TYPE_WRITE
in mailbox write to allow this other write commands to be supoorted.
At the same time, however, we have to make sure that there is no
impact on read commands, by avoiding to write anything into the
mailbox data register.
To properly implement that, add two separate functions for mbox read
and write commands for the processor thermal workload command type.
This helps to distinguish the read and write workload command types
from each other while sending mbox commands.
Fixes: 5d6fbc96bd36 ("thermal/drivers/int340x: processor_thermal: Export additional attributes")
Signed-off-by: Sumeet Pawnikar <sumeet.r.pawnikar@intel.com>
Cc: 5.14+ <stable@vger.kernel.org> # 5.14+
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
[ rjw: Changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thermal/intel/int340x_thermal/processor_thermal_device.h | 3
drivers/thermal/intel/int340x_thermal/processor_thermal_mbox.c | 100 +++++-----
drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c | 23 +-
3 files changed, 73 insertions(+), 53 deletions(-)
--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.h
+++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.h
@@ -80,7 +80,8 @@ void proc_thermal_rfim_remove(struct pci
int proc_thermal_mbox_add(struct pci_dev *pdev, struct proc_thermal_device *proc_priv);
void proc_thermal_mbox_remove(struct pci_dev *pdev);
-int processor_thermal_send_mbox_cmd(struct pci_dev *pdev, u16 cmd_id, u32 cmd_data, u64 *cmd_resp);
+int processor_thermal_send_mbox_read_cmd(struct pci_dev *pdev, u16 id, u64 *resp);
+int processor_thermal_send_mbox_write_cmd(struct pci_dev *pdev, u16 id, u32 data);
int proc_thermal_add(struct device *dev, struct proc_thermal_device *priv);
void proc_thermal_remove(struct proc_thermal_device *proc_priv);
int proc_thermal_suspend(struct device *dev);
--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_mbox.c
+++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_mbox.c
@@ -24,19 +24,15 @@
static DEFINE_MUTEX(mbox_lock);
-static int send_mbox_cmd(struct pci_dev *pdev, u16 cmd_id, u32 cmd_data, u64 *cmd_resp)
+static int wait_for_mbox_ready(struct proc_thermal_device *proc_priv)
{
- struct proc_thermal_device *proc_priv;
u32 retries, data;
int ret;
- mutex_lock(&mbox_lock);
- proc_priv = pci_get_drvdata(pdev);
-
/* Poll for rb bit == 0 */
retries = MBOX_RETRY_COUNT;
do {
- data = readl((void __iomem *) (proc_priv->mmio_base + MBOX_OFFSET_INTERFACE));
+ data = readl(proc_priv->mmio_base + MBOX_OFFSET_INTERFACE);
if (data & BIT_ULL(MBOX_BUSY_BIT)) {
ret = -EBUSY;
continue;
@@ -45,53 +41,78 @@ static int send_mbox_cmd(struct pci_dev
break;
} while (--retries);
+ return ret;
+}
+
+static int send_mbox_write_cmd(struct pci_dev *pdev, u16 id, u32 data)
+{
+ struct proc_thermal_device *proc_priv;
+ u32 reg_data;
+ int ret;
+
+ proc_priv = pci_get_drvdata(pdev);
+
+ mutex_lock(&mbox_lock);
+
+ ret = wait_for_mbox_ready(proc_priv);
if (ret)
goto unlock_mbox;
- if (cmd_id == MBOX_CMD_WORKLOAD_TYPE_WRITE)
- writel(cmd_data, (void __iomem *) ((proc_priv->mmio_base + MBOX_OFFSET_DATA)));
-
+ writel(data, (proc_priv->mmio_base + MBOX_OFFSET_DATA));
/* Write command register */
- data = BIT_ULL(MBOX_BUSY_BIT) | cmd_id;
- writel(data, (void __iomem *) ((proc_priv->mmio_base + MBOX_OFFSET_INTERFACE)));
+ reg_data = BIT_ULL(MBOX_BUSY_BIT) | id;
+ writel(reg_data, (proc_priv->mmio_base + MBOX_OFFSET_INTERFACE));
- /* Poll for rb bit == 0 */
- retries = MBOX_RETRY_COUNT;
- do {
- data = readl((void __iomem *) (proc_priv->mmio_base + MBOX_OFFSET_INTERFACE));
- if (data & BIT_ULL(MBOX_BUSY_BIT)) {
- ret = -EBUSY;
- continue;
- }
+ ret = wait_for_mbox_ready(proc_priv);
- if (data) {
- ret = -ENXIO;
- goto unlock_mbox;
- }
+unlock_mbox:
+ mutex_unlock(&mbox_lock);
+ return ret;
+}
- ret = 0;
+static int send_mbox_read_cmd(struct pci_dev *pdev, u16 id, u64 *resp)
+{
+ struct proc_thermal_device *proc_priv;
+ u32 reg_data;
+ int ret;
- if (!cmd_resp)
- break;
+ proc_priv = pci_get_drvdata(pdev);
- if (cmd_id == MBOX_CMD_WORKLOAD_TYPE_READ)
- *cmd_resp = readl((void __iomem *) (proc_priv->mmio_base + MBOX_OFFSET_DATA));
- else
- *cmd_resp = readq((void __iomem *) (proc_priv->mmio_base + MBOX_OFFSET_DATA));
+ mutex_lock(&mbox_lock);
- break;
- } while (--retries);
+ ret = wait_for_mbox_ready(proc_priv);
+ if (ret)
+ goto unlock_mbox;
+
+ /* Write command register */
+ reg_data = BIT_ULL(MBOX_BUSY_BIT) | id;
+ writel(reg_data, (proc_priv->mmio_base + MBOX_OFFSET_INTERFACE));
+
+ ret = wait_for_mbox_ready(proc_priv);
+ if (ret)
+ goto unlock_mbox;
+
+ if (id == MBOX_CMD_WORKLOAD_TYPE_READ)
+ *resp = readl(proc_priv->mmio_base + MBOX_OFFSET_DATA);
+ else
+ *resp = readq(proc_priv->mmio_base + MBOX_OFFSET_DATA);
unlock_mbox:
mutex_unlock(&mbox_lock);
return ret;
}
-int processor_thermal_send_mbox_cmd(struct pci_dev *pdev, u16 cmd_id, u32 cmd_data, u64 *cmd_resp)
+int processor_thermal_send_mbox_read_cmd(struct pci_dev *pdev, u16 id, u64 *resp)
{
- return send_mbox_cmd(pdev, cmd_id, cmd_data, cmd_resp);
+ return send_mbox_read_cmd(pdev, id, resp);
}
-EXPORT_SYMBOL_GPL(processor_thermal_send_mbox_cmd);
+EXPORT_SYMBOL_NS_GPL(processor_thermal_send_mbox_read_cmd, INT340X_THERMAL);
+
+int processor_thermal_send_mbox_write_cmd(struct pci_dev *pdev, u16 id, u32 data)
+{
+ return send_mbox_write_cmd(pdev, id, data);
+}
+EXPORT_SYMBOL_NS_GPL(processor_thermal_send_mbox_write_cmd, INT340X_THERMAL);
/* List of workload types */
static const char * const workload_types[] = {
@@ -104,7 +125,6 @@ static const char * const workload_types
NULL
};
-
static ssize_t workload_available_types_show(struct device *dev,
struct device_attribute *attr,
char *buf)
@@ -146,7 +166,7 @@ static ssize_t workload_type_store(struc
data |= ret;
- ret = send_mbox_cmd(pdev, MBOX_CMD_WORKLOAD_TYPE_WRITE, data, NULL);
+ ret = send_mbox_write_cmd(pdev, MBOX_CMD_WORKLOAD_TYPE_WRITE, data);
if (ret)
return false;
@@ -161,7 +181,7 @@ static ssize_t workload_type_show(struct
u64 cmd_resp;
int ret;
- ret = send_mbox_cmd(pdev, MBOX_CMD_WORKLOAD_TYPE_READ, 0, &cmd_resp);
+ ret = send_mbox_read_cmd(pdev, MBOX_CMD_WORKLOAD_TYPE_READ, &cmd_resp);
if (ret)
return false;
@@ -186,8 +206,6 @@ static const struct attribute_group work
.name = "workload_request"
};
-
-
static bool workload_req_created;
int proc_thermal_mbox_add(struct pci_dev *pdev, struct proc_thermal_device *proc_priv)
@@ -196,7 +214,7 @@ int proc_thermal_mbox_add(struct pci_dev
int ret;
/* Check if there is a mailbox support, if fails return success */
- ret = send_mbox_cmd(pdev, MBOX_CMD_WORKLOAD_TYPE_READ, 0, &cmd_resp);
+ ret = send_mbox_read_cmd(pdev, MBOX_CMD_WORKLOAD_TYPE_READ, &cmd_resp);
if (ret)
return 0;
--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c
+++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c
@@ -9,6 +9,8 @@
#include <linux/pci.h>
#include "processor_thermal_device.h"
+MODULE_IMPORT_NS(INT340X_THERMAL);
+
struct mmio_reg {
int read_only;
u32 offset;
@@ -194,8 +196,7 @@ static ssize_t rfi_restriction_store(str
struct device_attribute *attr,
const char *buf, size_t count)
{
- u16 cmd_id = 0x0008;
- u64 cmd_resp;
+ u16 id = 0x0008;
u32 input;
int ret;
@@ -203,7 +204,7 @@ static ssize_t rfi_restriction_store(str
if (ret)
return ret;
- ret = processor_thermal_send_mbox_cmd(to_pci_dev(dev), cmd_id, input, &cmd_resp);
+ ret = processor_thermal_send_mbox_write_cmd(to_pci_dev(dev), id, input);
if (ret)
return ret;
@@ -214,30 +215,30 @@ static ssize_t rfi_restriction_show(stru
struct device_attribute *attr,
char *buf)
{
- u16 cmd_id = 0x0007;
- u64 cmd_resp;
+ u16 id = 0x0007;
+ u64 resp;
int ret;
- ret = processor_thermal_send_mbox_cmd(to_pci_dev(dev), cmd_id, 0, &cmd_resp);
+ ret = processor_thermal_send_mbox_read_cmd(to_pci_dev(dev), id, &resp);
if (ret)
return ret;
- return sprintf(buf, "%llu\n", cmd_resp);
+ return sprintf(buf, "%llu\n", resp);
}
static ssize_t ddr_data_rate_show(struct device *dev,
struct device_attribute *attr,
char *buf)
{
- u16 cmd_id = 0x0107;
- u64 cmd_resp;
+ u16 id = 0x0107;
+ u64 resp;
int ret;
- ret = processor_thermal_send_mbox_cmd(to_pci_dev(dev), cmd_id, 0, &cmd_resp);
+ ret = processor_thermal_send_mbox_read_cmd(to_pci_dev(dev), id, &resp);
if (ret)
return ret;
- return sprintf(buf, "%llu\n", cmd_resp);
+ return sprintf(buf, "%llu\n", resp);
}
static DEVICE_ATTR_RW(rfi_restriction);
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0066/1039] arm64: errata: Fix exec handling in erratum 1418040 workaround
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0065/1039] thermal/drivers/int340x: Fix RFIM mailbox write commands Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0067/1039] ARM: dts: at91: update alternate function of signal PD20 Greg Kroah-Hartman
` (926 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, D Scott Phillips, Marc Zyngier,
Catalin Marinas
From: D Scott Phillips <scott@os.amperecomputing.com>
commit 38e0257e0e6f4fef2aa2966b089b56a8b1cfb75c upstream.
The erratum 1418040 workaround enables CNTVCT_EL1 access trapping in EL0
when executing compat threads. The workaround is applied when switching
between tasks, but the need for the workaround could also change at an
exec(), when a non-compat task execs a compat binary or vice versa. Apply
the workaround in arch_setup_new_exec().
This leaves a small window of time between SET_PERSONALITY and
arch_setup_new_exec where preemption could occur and confuse the old
workaround logic that compares TIF_32BIT between prev and next. Instead, we
can just read cntkctl to make sure it's in the state that the next task
needs. I measured cntkctl read time to be about the same as a mov from a
general-purpose register on N1. Update the workaround logic to examine the
current value of cntkctl instead of the previous task's compat state.
Fixes: d49f7d7376d0 ("arm64: Move handling of erratum 1418040 into C code")
Cc: <stable@vger.kernel.org> # 5.9.x
Signed-off-by: D Scott Phillips <scott@os.amperecomputing.com>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211220234114.3926-1-scott@os.amperecomputing.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/process.c | 39 ++++++++++++++++-----------------------
1 file changed, 16 insertions(+), 23 deletions(-)
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -439,34 +439,26 @@ static void entry_task_switch(struct tas
/*
* ARM erratum 1418040 handling, affecting the 32bit view of CNTVCT.
- * Assuming the virtual counter is enabled at the beginning of times:
- *
- * - disable access when switching from a 64bit task to a 32bit task
- * - enable access when switching from a 32bit task to a 64bit task
+ * Ensure access is disabled when switching to a 32bit task, ensure
+ * access is enabled when switching to a 64bit task.
*/
-static void erratum_1418040_thread_switch(struct task_struct *prev,
- struct task_struct *next)
+static void erratum_1418040_thread_switch(struct task_struct *next)
{
- bool prev32, next32;
- u64 val;
-
- if (!IS_ENABLED(CONFIG_ARM64_ERRATUM_1418040))
- return;
-
- prev32 = is_compat_thread(task_thread_info(prev));
- next32 = is_compat_thread(task_thread_info(next));
-
- if (prev32 == next32 || !this_cpu_has_cap(ARM64_WORKAROUND_1418040))
+ if (!IS_ENABLED(CONFIG_ARM64_ERRATUM_1418040) ||
+ !this_cpu_has_cap(ARM64_WORKAROUND_1418040))
return;
- val = read_sysreg(cntkctl_el1);
-
- if (!next32)
- val |= ARCH_TIMER_USR_VCT_ACCESS_EN;
+ if (is_compat_thread(task_thread_info(next)))
+ sysreg_clear_set(cntkctl_el1, ARCH_TIMER_USR_VCT_ACCESS_EN, 0);
else
- val &= ~ARCH_TIMER_USR_VCT_ACCESS_EN;
+ sysreg_clear_set(cntkctl_el1, 0, ARCH_TIMER_USR_VCT_ACCESS_EN);
+}
- write_sysreg(val, cntkctl_el1);
+static void erratum_1418040_new_exec(void)
+{
+ preempt_disable();
+ erratum_1418040_thread_switch(current);
+ preempt_enable();
}
/*
@@ -501,7 +493,7 @@ __notrace_funcgraph struct task_struct *
contextidr_thread_switch(next);
entry_task_switch(next);
ssbs_thread_switch(next);
- erratum_1418040_thread_switch(prev, next);
+ erratum_1418040_thread_switch(next);
ptrauth_thread_switch_user(next);
/*
@@ -611,6 +603,7 @@ void arch_setup_new_exec(void)
current->mm->context.flags = mmflags;
ptrauth_thread_init_user();
mte_thread_init_user();
+ erratum_1418040_new_exec();
if (task_spec_ssb_noexec(current)) {
arch_prctl_spec_ctrl_set(current, PR_SPEC_STORE_BYPASS,
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0067/1039] ARM: dts: at91: update alternate function of signal PD20
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0066/1039] arm64: errata: Fix exec handling in erratum 1418040 workaround Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0068/1039] iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure Greg Kroah-Hartman
` (925 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hari Prasath, Nicolas Ferre
From: Hari Prasath <Hari.PrasathGE@microchip.com>
commit 12f332d2dd3187472f595b678246adb10d886bd0 upstream.
The alternate function of PD20 is 4 as per the datasheet of
sama7g5 and not 5 as defined earlier.
Signed-off-by: Hari Prasath <Hari.PrasathGE@microchip.com>
Fixes: 7540629e2fc7 ("ARM: dts: at91: add sama7g5 SoC DT and sama7g5-ek")
Cc: <stable@vger.kernel.org> # v5.15+
Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Link: https://lore.kernel.org/r/20211208063553.19807-1-Hari.PrasathGE@microchip.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/sama7g5-pinfunc.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/sama7g5-pinfunc.h
+++ b/arch/arm/boot/dts/sama7g5-pinfunc.h
@@ -765,7 +765,7 @@
#define PIN_PD20__PCK0 PINMUX_PIN(PIN_PD20, 1, 3)
#define PIN_PD20__FLEXCOM2_IO3 PINMUX_PIN(PIN_PD20, 2, 2)
#define PIN_PD20__PWMH3 PINMUX_PIN(PIN_PD20, 3, 4)
-#define PIN_PD20__CANTX4 PINMUX_PIN(PIN_PD20, 5, 2)
+#define PIN_PD20__CANTX4 PINMUX_PIN(PIN_PD20, 4, 2)
#define PIN_PD20__FLEXCOM5_IO0 PINMUX_PIN(PIN_PD20, 6, 5)
#define PIN_PD21 117
#define PIN_PD21__GPIO PINMUX_PIN(PIN_PD21, 0, 0)
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0068/1039] iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0067/1039] ARM: dts: at91: update alternate function of signal PD20 Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0069/1039] gpu: host1x: Add back arm_iommu_detach_device() Greg Kroah-Hartman
` (924 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yunfei Wang, Robin Murphy, Will Deacon
From: Yunfei Wang <yf.wang@mediatek.com>
commit a556cfe4cabc6d79cbb7733f118bbb420b376fe6 upstream.
In __arm_v7s_alloc_table function:
iommu call kmem_cache_alloc to allocate page table, this function
allocate memory may fail, when kmem_cache_alloc fails to allocate
table, call virt_to_phys will be abnomal and return unexpected phys
and goto out_free, then call kmem_cache_free to release table will
trigger KE, __get_free_pages and free_pages have similar problem,
so add error handle for page table allocation failure.
Fixes: 29859aeb8a6e ("iommu/io-pgtable-arm-v7s: Abort allocation when table address overflows the PTE")
Signed-off-by: Yunfei Wang <yf.wang@mediatek.com>
Cc: <stable@vger.kernel.org> # 5.10.*
Acked-by: Robin Murphy <robin.murphy@arm.com>
Link: https://lore.kernel.org/r/20211207113315.29109-1-yf.wang@mediatek.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/io-pgtable-arm-v7s.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/iommu/io-pgtable-arm-v7s.c
+++ b/drivers/iommu/io-pgtable-arm-v7s.c
@@ -246,13 +246,17 @@ static void *__arm_v7s_alloc_table(int l
__GFP_ZERO | ARM_V7S_TABLE_GFP_DMA, get_order(size));
else if (lvl == 2)
table = kmem_cache_zalloc(data->l2_tables, gfp);
+
+ if (!table)
+ return NULL;
+
phys = virt_to_phys(table);
if (phys != (arm_v7s_iopte)phys) {
/* Doesn't fit in PTE */
dev_err(dev, "Page table does not fit in PTE: %pa", &phys);
goto out_free;
}
- if (table && !cfg->coherent_walk) {
+ if (!cfg->coherent_walk) {
dma = dma_map_single(dev, table, size, DMA_TO_DEVICE);
if (dma_mapping_error(dev, dma))
goto out_free;
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0069/1039] gpu: host1x: Add back arm_iommu_detach_device()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0068/1039] iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:30 ` [PATCH 5.16 0070/1039] drm/tegra: " Greg Kroah-Hartman
` (923 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Osipenko, Thierry Reding
From: Dmitry Osipenko <digetx@gmail.com>
commit d5185965c3b59073c4520bad7dd2adf725b9abba upstream.
Host1x DMA buffer isn't mapped properly when CONFIG_ARM_DMA_USE_IOMMU=y.
The memory management code of Host1x driver has a longstanding overhaul
overdue and it's not obvious where the problem is in this case. Hence
let's add back the old workaround which we already had sometime before.
It explicitly detaches Host1x device from the offending implicit IOMMU
domain. This fixes a completely broken Host1x DMA in case of ARM32
multiplatform kernel config.
Cc: stable@vger.kernel.org
Fixes: af1cbfb9bf0f ("gpu: host1x: Support DMA mapping of buffers")
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/host1x/dev.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
--- a/drivers/gpu/host1x/dev.c
+++ b/drivers/gpu/host1x/dev.c
@@ -18,6 +18,10 @@
#include <trace/events/host1x.h>
#undef CREATE_TRACE_POINTS
+#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)
+#include <asm/dma-iommu.h>
+#endif
+
#include "bus.h"
#include "channel.h"
#include "debug.h"
@@ -238,6 +242,17 @@ static struct iommu_domain *host1x_iommu
struct iommu_domain *domain = iommu_get_domain_for_dev(host->dev);
int err;
+#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)
+ if (host->dev->archdata.mapping) {
+ struct dma_iommu_mapping *mapping =
+ to_dma_iommu_mapping(host->dev);
+ arm_iommu_detach_device(host->dev);
+ arm_iommu_release_mapping(mapping);
+
+ domain = iommu_get_domain_for_dev(host->dev);
+ }
+#endif
+
/*
* We may not always want to enable IOMMU support (for example if the
* host1x firewall is already enabled and we don't support addressing
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0070/1039] drm/tegra: Add back arm_iommu_detach_device()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0069/1039] gpu: host1x: Add back arm_iommu_detach_device() Greg Kroah-Hartman
@ 2022-01-24 18:30 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0071/1039] io_uring: fix no lock protection for ctx->cq_extra Greg Kroah-Hartman
` (922 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:30 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Osipenko, Thierry Reding
From: Dmitry Osipenko <digetx@gmail.com>
commit d210919dbdc8a82c676cc3e3c370b1802be63124 upstream.
DMA buffers of 2D/3D engines aren't mapped properly when
CONFIG_ARM_DMA_USE_IOMMU=y. The memory management code of Tegra DRM driver
has a longstanding overhaul overdue and it's not obvious where the problem
is in this case. Hence let's add back the old workaround which we already
had sometime before. It explicitly detaches DRM devices from the offending
implicit IOMMU domain. This fixes a completely broken 2d/3d drivers in
case of ARM32 multiplatform kernel config.
Cc: stable@vger.kernel.org
Fixes: fa6661b7aa0b ("drm/tegra: Optionally attach clients to the IOMMU")
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/tegra/drm.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -21,6 +21,10 @@
#include <drm/drm_prime.h>
#include <drm/drm_vblank.h>
+#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)
+#include <asm/dma-iommu.h>
+#endif
+
#include "dc.h"
#include "drm.h"
#include "gem.h"
@@ -936,6 +940,17 @@ int host1x_client_iommu_attach(struct ho
struct iommu_group *group = NULL;
int err;
+#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)
+ if (client->dev->archdata.mapping) {
+ struct dma_iommu_mapping *mapping =
+ to_dma_iommu_mapping(client->dev);
+ arm_iommu_detach_device(client->dev);
+ arm_iommu_release_mapping(mapping);
+
+ domain = iommu_get_domain_for_dev(client->dev);
+ }
+#endif
+
/*
* If the host1x client is already attached to an IOMMU domain that is
* not the shared IOMMU domain, don't try to attach it to a different
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0071/1039] io_uring: fix no lock protection for ctx->cq_extra
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2022-01-24 18:30 ` [PATCH 5.16 0070/1039] drm/tegra: " Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0072/1039] virtio/virtio_mem: handle a possible NULL as a memcpy parameter Greg Kroah-Hartman
` (921 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hao Xu, Jens Axboe
From: Hao Xu <haoxu@linux.alibaba.com>
commit e302f1046f4c209291b07ff7bc4d15ca26891f16 upstream.
ctx->cq_extra should be protected by completion lock so that the
req_need_defer() does the right check.
Cc: stable@vger.kernel.org
Signed-off-by: Hao Xu <haoxu@linux.alibaba.com>
Link: https://lore.kernel.org/r/20211125092103.224502-2-haoxu@linux.alibaba.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/io_uring.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -6544,12 +6544,15 @@ static __cold void io_drain_req(struct i
u32 seq = io_get_sequence(req);
/* Still need defer if there is pending req in defer list. */
+ spin_lock(&ctx->completion_lock);
if (!req_need_defer(req, seq) && list_empty_careful(&ctx->defer_list)) {
+ spin_unlock(&ctx->completion_lock);
queue:
ctx->drain_active = false;
io_req_task_queue(req);
return;
}
+ spin_unlock(&ctx->completion_lock);
ret = io_req_prep_async(req);
if (ret) {
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0072/1039] virtio/virtio_mem: handle a possible NULL as a memcpy parameter
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0071/1039] io_uring: fix no lock protection for ctx->cq_extra Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` Greg Kroah-Hartman
` (920 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Peng Hao, Michael S. Tsirkin
From: Peng Hao <flyingpenghao@gmail.com>
commit cf4a4493ff70874f8af26d75d4346c591c298e89 upstream.
There is a check for vm->sbm.sb_states before, and it should check
it here as well.
Signed-off-by: Peng Hao <flyingpeng@tencent.com>
Link: https://lore.kernel.org/r/20211222011225.40573-1-flyingpeng@tencent.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Fixes: 5f1f79bbc9e2 ("virtio-mem: Paravirtualized memory hotplug")
Cc: stable@vger.kernel.org # v5.8+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/virtio/virtio_mem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/virtio/virtio_mem.c
+++ b/drivers/virtio/virtio_mem.c
@@ -592,7 +592,7 @@ static int virtio_mem_sbm_sb_states_prep
return -ENOMEM;
mutex_lock(&vm->hotplug_mutex);
- if (new_bitmap)
+ if (vm->sbm.sb_states)
memcpy(new_bitmap, vm->sbm.sb_states, old_pages * PAGE_SIZE);
old_bitmap = vm->sbm.sb_states;
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0073/1039] dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:29 ` [PATCH 5.16 0002/1039] KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock Greg Kroah-Hartman
` (991 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Thomas Hellström, Gustavo Padovan, stable, linaro-mm-sig,
dri-devel, Greg Kroah-Hartman, Chris Wilson,
Christian König, linux-media
From: Thomas Hellström <thomas.hellstrom@linux.intel.com>
commit 95d35838880fb040ccb9fe4a48816bd0c8b62df5 upstream.
If a dma_fence_array is reported signaled by a call to
dma_fence_is_signaled(), it may leak the PENDING_ERROR status.
Fix this by clearing the PENDING_ERROR status if we return true in
dma_fence_array_signaled().
v2:
- Update Cc list, and add R-b.
Fixes: 1f70b8b812f3 ("dma-fence: Propagate errors to dma-fence-array container")
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Christian König <christian.koenig@amd.com>
Cc: "Christian König" <christian.koenig@amd.com>
Cc: linux-media@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: linaro-mm-sig@lists.linaro.org
Cc: <stable@vger.kernel.org> # v5.4+
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20211129152727.448908-1-thomas.hellstrom@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma-buf/dma-fence-array.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/dma-buf/dma-fence-array.c
+++ b/drivers/dma-buf/dma-fence-array.c
@@ -104,7 +104,11 @@ static bool dma_fence_array_signaled(str
{
struct dma_fence_array *array = to_dma_fence_array(fence);
- return atomic_read(&array->num_pending) <= 0;
+ if (atomic_read(&array->num_pending) > 0)
+ return false;
+
+ dma_fence_array_clear_pending_error(array);
+ return true;
}
static void dma_fence_array_release(struct dma_fence *fence)
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0073/1039] dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled()
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
0 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Wilson, Sumit Semwal,
Gustavo Padovan, Christian König, linux-media, dri-devel,
linaro-mm-sig, Thomas Hellström
From: Thomas Hellström <thomas.hellstrom@linux.intel.com>
commit 95d35838880fb040ccb9fe4a48816bd0c8b62df5 upstream.
If a dma_fence_array is reported signaled by a call to
dma_fence_is_signaled(), it may leak the PENDING_ERROR status.
Fix this by clearing the PENDING_ERROR status if we return true in
dma_fence_array_signaled().
v2:
- Update Cc list, and add R-b.
Fixes: 1f70b8b812f3 ("dma-fence: Propagate errors to dma-fence-array container")
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Christian König <christian.koenig@amd.com>
Cc: "Christian König" <christian.koenig@amd.com>
Cc: linux-media@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: linaro-mm-sig@lists.linaro.org
Cc: <stable@vger.kernel.org> # v5.4+
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20211129152727.448908-1-thomas.hellstrom@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma-buf/dma-fence-array.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/dma-buf/dma-fence-array.c
+++ b/drivers/dma-buf/dma-fence-array.c
@@ -104,7 +104,11 @@ static bool dma_fence_array_signaled(str
{
struct dma_fence_array *array = to_dma_fence_array(fence);
- return atomic_read(&array->num_pending) <= 0;
+ if (atomic_read(&array->num_pending) > 0)
+ return false;
+
+ dma_fence_array_clear_pending_error(array);
+ return true;
}
static void dma_fence_array_release(struct dma_fence *fence)
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0074/1039] PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2022-01-24 18:31 ` Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0075/1039] mm_zone: add function to check if managed dma zone exists Greg Kroah-Hartman
` (918 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sam Bingner, Yifeng Li,
Bjorn Helgaas, Krzysztof Wilczyński
From: Yifeng Li <tomli@tomli.me>
commit e445375882883f69018aa669b67cbb37ec873406 upstream.
Like other SATA controller chips in the Marvell 88SE91xx series, the
Marvell 88SE9125 has the same DMA requester ID hardware bug that prevents
it from working under IOMMU. Add it to the list of devices that need the
quirk.
Without this patch, device initialization fails with DMA errors:
ata8: softreset failed (1st FIS failed)
DMAR: DRHD: handling fault status reg 2
DMAR: [DMA Write NO_PASID] Request device [03:00.1] fault addr 0xfffc0000 [fault reason 0x02] Present bit in context entry is clear
DMAR: DRHD: handling fault status reg 2
DMAR: [DMA Read NO_PASID] Request device [03:00.1] fault addr 0xfffc0000 [fault reason 0x02] Present bit in context entry is clear
After applying the patch, the controller can be successfully initialized:
ata8: SATA link up 1.5 Gbps (SStatus 113 SControl 330)
ata8.00: ATAPI: PIONEER BD-RW BDR-207M, 1.21, max UDMA/100
ata8.00: configured for UDMA/100
scsi 7:0:0:0: CD-ROM PIONEER BD-RW BDR-207M 1.21 PQ: 0 ANSI: 5
Link: https://lore.kernel.org/r/YahpKVR+McJVDdkD@work
Reported-by: Sam Bingner <sam@bingner.com>
Tested-by: Sam Bingner <sam@bingner.com>
Tested-by: Yifeng Li <tomli@tomli.me>
Signed-off-by: Yifeng Li <tomli@tomli.me>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Krzysztof Wilczyński <kw@linux.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/quirks.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -4103,6 +4103,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_M
quirk_dma_func1_alias);
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9123,
quirk_dma_func1_alias);
+/* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c136 */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9125,
+ quirk_dma_func1_alias);
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9128,
quirk_dma_func1_alias);
/* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c14 */
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0075/1039] mm_zone: add function to check if managed dma zone exists
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0074/1039] PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0076/1039] dma/pool: create dma atomic pool only if dma zone has managed pages Greg Kroah-Hartman
` (917 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Baoquan He, David Hildenbrand,
John Donnelly, Christoph Hellwig, Christoph Lameter,
Hyeonggon Yoo, Pekka Enberg, David Rientjes, Joonsoo Kim,
Vlastimil Babka, David Laight, Borislav Petkov, Marek Szyprowski,
Robin Murphy, Andrew Morton, Linus Torvalds
From: Baoquan He <bhe@redhat.com>
commit 62b3107073646e0946bd97ff926832bafb846d17 upstream.
Patch series "Handle warning of allocation failure on DMA zone w/o
managed pages", v4.
**Problem observed:
On x86_64, when crash is triggered and entering into kdump kernel, page
allocation failure can always be seen.
---------------------------------
DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
swapper/0: page allocation failure: order:5, mode:0xcc1(GFP_KERNEL|GFP_DMA), nodemask=(null),cpuset=/,mems_allowed=0
CPU: 0 PID: 1 Comm: swapper/0
Call Trace:
dump_stack+0x7f/0xa1
warn_alloc.cold+0x72/0xd6
......
__alloc_pages+0x24d/0x2c0
......
dma_atomic_pool_init+0xdb/0x176
do_one_initcall+0x67/0x320
? rcu_read_lock_sched_held+0x3f/0x80
kernel_init_freeable+0x290/0x2dc
? rest_init+0x24f/0x24f
kernel_init+0xa/0x111
ret_from_fork+0x22/0x30
Mem-Info:
------------------------------------
***Root cause:
In the current kernel, it assumes that DMA zone must have managed pages
and try to request pages if CONFIG_ZONE_DMA is enabled. While this is not
always true. E.g in kdump kernel of x86_64, only low 1M is presented and
locked down at very early stage of boot, so that this low 1M won't be
added into buddy allocator to become managed pages of DMA zone. This
exception will always cause page allocation failure if page is requested
from DMA zone.
***Investigation:
This failure happens since below commit merged into linus's tree.
1a6a9044b967 x86/setup: Remove CONFIG_X86_RESERVE_LOW and reservelow= options
23721c8e92f7 x86/crash: Remove crash_reserve_low_1M()
f1d4d47c5851 x86/setup: Always reserve the first 1M of RAM
7c321eb2b843 x86/kdump: Remove the backup region handling
6f599d84231f x86/kdump: Always reserve the low 1M when the crashkernel option is specified
Before them, on x86_64, the low 640K area will be reused by kdump kernel.
So in kdump kernel, the content of low 640K area is copied into a backup
region for dumping before jumping into kdump. Then except of those firmware
reserved region in [0, 640K], the left area will be added into buddy
allocator to become available managed pages of DMA zone.
However, after above commits applied, in kdump kernel of x86_64, the low
1M is reserved by memblock, but not released to buddy allocator. So any
later page allocation requested from DMA zone will fail.
At the beginning, if crashkernel is reserved, the low 1M need be locked
down because AMD SME encrypts memory making the old backup region
mechanims impossible when switching into kdump kernel.
Later, it was also observed that there are BIOSes corrupting memory
under 1M. To solve this, in commit f1d4d47c5851, the entire region of
low 1M is always reserved after the real mode trampoline is allocated.
Besides, recently, Intel engineer mentioned their TDX (Trusted domain
extensions) which is under development in kernel also needs to lock down
the low 1M. So we can't simply revert above commits to fix the page allocation
failure from DMA zone as someone suggested.
***Solution:
Currently, only DMA atomic pool and dma-kmalloc will initialize and
request page allocation with GFP_DMA during bootup.
So only initializ DMA atomic pool when DMA zone has available managed
pages, otherwise just skip the initialization.
For dma-kmalloc(), for the time being, let's mute the warning of
allocation failure if requesting pages from DMA zone while no manged
pages. Meanwhile, change code to use dma_alloc_xx/dma_map_xx API to
replace kmalloc(GFP_DMA), or do not use GFP_DMA when calling kmalloc() if
not necessary. Christoph is posting patches to fix those under
drivers/scsi/. Finally, we can remove the need of dma-kmalloc() as people
suggested.
This patch (of 3):
In some places of the current kernel, it assumes that dma zone must have
managed pages if CONFIG_ZONE_DMA is enabled. While this is not always
true. E.g in kdump kernel of x86_64, only low 1M is presented and locked
down at very early stage of boot, so that there's no managed pages at all
in DMA zone. This exception will always cause page allocation failure if
page is requested from DMA zone.
Here add function has_managed_dma() and the relevant helper functions to
check if there's DMA zone with managed pages. It will be used in later
patches.
Link: https://lkml.kernel.org/r/20211223094435.248523-1-bhe@redhat.com
Link: https://lkml.kernel.org/r/20211223094435.248523-2-bhe@redhat.com
Fixes: 6f599d84231f ("x86/kdump: Always reserve the low 1M when the crashkernel option is specified")
Signed-off-by: Baoquan He <bhe@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Acked-by: John Donnelly <john.p.donnelly@oracle.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Christoph Lameter <cl@linux.com>
Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: David Laight <David.Laight@ACULAB.COM>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: Robin Murphy <robin.murphy@arm.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/mmzone.h | 9 +++++++++
mm/page_alloc.c | 15 +++++++++++++++
2 files changed, 24 insertions(+)
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -1047,6 +1047,15 @@ static inline int is_highmem_idx(enum zo
#endif
}
+#ifdef CONFIG_ZONE_DMA
+bool has_managed_dma(void);
+#else
+static inline bool has_managed_dma(void)
+{
+ return false;
+}
+#endif
+
/**
* is_highmem - helper function to quickly check if a struct zone is a
* highmem zone or not. This is an attempt to keep references
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -9460,3 +9460,18 @@ bool take_page_off_buddy(struct page *pa
return ret;
}
#endif
+
+#ifdef CONFIG_ZONE_DMA
+bool has_managed_dma(void)
+{
+ struct pglist_data *pgdat;
+
+ for_each_online_pgdat(pgdat) {
+ struct zone *zone = &pgdat->node_zones[ZONE_DMA];
+
+ if (managed_zone(zone))
+ return true;
+ }
+ return false;
+}
+#endif /* CONFIG_ZONE_DMA */
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0076/1039] dma/pool: create dma atomic pool only if dma zone has managed pages
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0075/1039] mm_zone: add function to check if managed dma zone exists Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0077/1039] mm/page_alloc.c: do not warn allocation failure on zone DMA if no " Greg Kroah-Hartman
` (916 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Baoquan He, Christoph Hellwig,
John Donnelly, David Hildenbrand, Marek Szyprowski, Robin Murphy,
Borislav Petkov, Christoph Lameter, David Laight, David Rientjes,
Hyeonggon Yoo, Joonsoo Kim, Pekka Enberg, Vlastimil Babka,
Andrew Morton, Linus Torvalds
From: Baoquan He <bhe@redhat.com>
commit a674e48c5443d12a8a43c3ac42367aa39505d506 upstream.
Currently three dma atomic pools are initialized as long as the relevant
kernel codes are built in. While in kdump kernel of x86_64, this is not
right when trying to create atomic_pool_dma, because there's no managed
pages in DMA zone. In the case, DMA zone only has low 1M memory
presented and locked down by memblock allocator. So no pages are added
into buddy of DMA zone. Please check commit f1d4d47c5851 ("x86/setup:
Always reserve the first 1M of RAM").
Then in kdump kernel of x86_64, it always prints below failure message:
DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
swapper/0: page allocation failure: order:5, mode:0xcc1(GFP_KERNEL|GFP_DMA), nodemask=(null),cpuset=/,mems_allowed=0
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.13.0-0.rc5.20210611git929d931f2b40.42.fc35.x86_64 #1
Hardware name: Dell Inc. PowerEdge R910/0P658H, BIOS 2.12.0 06/04/2018
Call Trace:
dump_stack+0x7f/0xa1
warn_alloc.cold+0x72/0xd6
__alloc_pages_slowpath.constprop.0+0xf29/0xf50
__alloc_pages+0x24d/0x2c0
alloc_page_interleave+0x13/0xb0
atomic_pool_expand+0x118/0x210
__dma_atomic_pool_init+0x45/0x93
dma_atomic_pool_init+0xdb/0x176
do_one_initcall+0x67/0x320
kernel_init_freeable+0x290/0x2dc
kernel_init+0xa/0x111
ret_from_fork+0x22/0x30
Mem-Info:
......
DMA: failed to allocate 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocation
DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
Here, let's check if DMA zone has managed pages, then create
atomic_pool_dma if yes. Otherwise just skip it.
Link: https://lkml.kernel.org/r/20211223094435.248523-3-bhe@redhat.com
Fixes: 6f599d84231f ("x86/kdump: Always reserve the low 1M when the crashkernel option is specified")
Signed-off-by: Baoquan He <bhe@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Acked-by: John Donnelly <john.p.donnelly@oracle.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: Robin Murphy <robin.murphy@arm.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Christoph Lameter <cl@linux.com>
Cc: David Laight <David.Laight@ACULAB.COM>
Cc: David Rientjes <rientjes@google.com>
Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/dma/pool.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/kernel/dma/pool.c
+++ b/kernel/dma/pool.c
@@ -203,7 +203,7 @@ static int __init dma_atomic_pool_init(v
GFP_KERNEL);
if (!atomic_pool_kernel)
ret = -ENOMEM;
- if (IS_ENABLED(CONFIG_ZONE_DMA)) {
+ if (has_managed_dma()) {
atomic_pool_dma = __dma_atomic_pool_init(atomic_pool_size,
GFP_KERNEL | GFP_DMA);
if (!atomic_pool_dma)
@@ -226,7 +226,7 @@ static inline struct gen_pool *dma_guess
if (prev == NULL) {
if (IS_ENABLED(CONFIG_ZONE_DMA32) && (gfp & GFP_DMA32))
return atomic_pool_dma32;
- if (IS_ENABLED(CONFIG_ZONE_DMA) && (gfp & GFP_DMA))
+ if (atomic_pool_dma && (gfp & GFP_DMA))
return atomic_pool_dma;
return atomic_pool_kernel;
}
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0077/1039] mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed pages
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0076/1039] dma/pool: create dma atomic pool only if dma zone has managed pages Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0078/1039] ath11k: add string type to search board data in board-2.bin for WCN6855 Greg Kroah-Hartman
` (915 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Baoquan He, John Donnelly,
Hyeonggon Yoo, Christoph Lameter, Pekka Enberg, David Rientjes,
Joonsoo Kim, Vlastimil Babka, Borislav Petkov, Christoph Hellwig,
David Hildenbrand, David Laight, Marek Szyprowski, Robin Murphy,
Andrew Morton, Linus Torvalds
From: Baoquan He <bhe@redhat.com>
commit c4dc63f0032c77464fbd4e7a6afc22fa6913c4a7 upstream.
In kdump kernel of x86_64, page allocation failure is observed:
kworker/u2:2: page allocation failure: order:0, mode:0xcc1(GFP_KERNEL|GFP_DMA), nodemask=(null),cpuset=/,mems_allowed=0
CPU: 0 PID: 55 Comm: kworker/u2:2 Not tainted 5.16.0-rc4+ #5
Hardware name: AMD Dinar/Dinar, BIOS RDN1505B 06/05/2013
Workqueue: events_unbound async_run_entry_fn
Call Trace:
<TASK>
dump_stack_lvl+0x48/0x5e
warn_alloc.cold+0x72/0xd6
__alloc_pages_slowpath.constprop.0+0xc69/0xcd0
__alloc_pages+0x1df/0x210
new_slab+0x389/0x4d0
___slab_alloc+0x58f/0x770
__slab_alloc.constprop.0+0x4a/0x80
kmem_cache_alloc_trace+0x24b/0x2c0
sr_probe+0x1db/0x620
......
device_add+0x405/0x920
......
__scsi_add_device+0xe5/0x100
ata_scsi_scan_host+0x97/0x1d0
async_run_entry_fn+0x30/0x130
process_one_work+0x1e8/0x3c0
worker_thread+0x50/0x3b0
? rescuer_thread+0x350/0x350
kthread+0x16b/0x190
? set_kthread_struct+0x40/0x40
ret_from_fork+0x22/0x30
</TASK>
Mem-Info:
......
The above failure happened when calling kmalloc() to allocate buffer with
GFP_DMA. It requests to allocate slab page from DMA zone while no managed
pages at all in there.
sr_probe()
--> get_capabilities()
--> buffer = kmalloc(512, GFP_KERNEL | GFP_DMA);
Because in the current kernel, dma-kmalloc will be created as long as
CONFIG_ZONE_DMA is enabled. However, kdump kernel of x86_64 doesn't have
managed pages on DMA zone since commit 6f599d84231f ("x86/kdump: Always
reserve the low 1M when the crashkernel option is specified"). The
failure can be always reproduced.
For now, let's mute the warning of allocation failure if requesting pages
from DMA zone while no managed pages.
[akpm@linux-foundation.org: fix warning]
Link: https://lkml.kernel.org/r/20211223094435.248523-4-bhe@redhat.com
Fixes: 6f599d84231f ("x86/kdump: Always reserve the low 1M when the crashkernel option is specified")
Signed-off-by: Baoquan He <bhe@redhat.com>
Acked-by: John Donnelly <john.p.donnelly@oracle.com>
Reviewed-by: Hyeonggon Yoo <42.hyeyoo@gmail.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Christoph Hellwig <hch@lst.de>
Cc: David Hildenbrand <david@redhat.com>
Cc: David Laight <David.Laight@ACULAB.COM>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: Robin Murphy <robin.murphy@arm.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/page_alloc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -4204,7 +4204,9 @@ void warn_alloc(gfp_t gfp_mask, nodemask
va_list args;
static DEFINE_RATELIMIT_STATE(nopage_rs, 10*HZ, 1);
- if ((gfp_mask & __GFP_NOWARN) || !__ratelimit(&nopage_rs))
+ if ((gfp_mask & __GFP_NOWARN) ||
+ !__ratelimit(&nopage_rs) ||
+ ((gfp_mask & __GFP_DMA) && !has_managed_dma()))
return;
va_start(args, fmt);
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0078/1039] ath11k: add string type to search board data in board-2.bin for WCN6855
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0077/1039] mm/page_alloc.c: do not warn allocation failure on zone DMA if no " Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0079/1039] shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode Greg Kroah-Hartman
` (914 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wen Gong, Jouni Malinen, Kalle Valo,
Limonciello, Mario
From: Wen Gong <quic_wgong@quicinc.com>
commit fc95d10ac41d75c14a81afcc8722333d8b2cf80f upstream.
Currently ath11k only support string type with bus, chip id and board id
such as "bus=ahb,qmi-chip-id=1,qmi-board-id=4" for ahb bus chip and
"bus=pci,qmi-chip-id=0,qmi-board-id=255" for PCIe bus chip in
board-2.bin. For WCN6855, it is not enough to distinguish all different
chips.
This is to add a new string type which include bus, chip id, board id,
vendor, device, subsystem-vendor and subsystem-device for WCN6855.
ath11k will first load board-2.bin and search in it for the board data
with the above parameters, if matched one board data, then download it
to firmware, if not matched any one, then ath11k will download the file
board.bin to firmware.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211111065340.20187-1-quic_wgong@quicinc.com
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath11k/core.c | 27 +++++++++++++++++++++------
drivers/net/wireless/ath/ath11k/core.h | 13 +++++++++++++
drivers/net/wireless/ath/ath11k/pci.c | 10 ++++++++++
3 files changed, 44 insertions(+), 6 deletions(-)
--- a/drivers/net/wireless/ath/ath11k/core.c
+++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -392,11 +392,26 @@ static int ath11k_core_create_board_name
scnprintf(variant, sizeof(variant), ",variant=%s",
ab->qmi.target.bdf_ext);
- scnprintf(name, name_len,
- "bus=%s,qmi-chip-id=%d,qmi-board-id=%d%s",
- ath11k_bus_str(ab->hif.bus),
- ab->qmi.target.chip_id,
- ab->qmi.target.board_id, variant);
+ switch (ab->id.bdf_search) {
+ case ATH11K_BDF_SEARCH_BUS_AND_BOARD:
+ scnprintf(name, name_len,
+ "bus=%s,vendor=%04x,device=%04x,subsystem-vendor=%04x,subsystem-device=%04x,qmi-chip-id=%d,qmi-board-id=%d%s",
+ ath11k_bus_str(ab->hif.bus),
+ ab->id.vendor, ab->id.device,
+ ab->id.subsystem_vendor,
+ ab->id.subsystem_device,
+ ab->qmi.target.chip_id,
+ ab->qmi.target.board_id,
+ variant);
+ break;
+ default:
+ scnprintf(name, name_len,
+ "bus=%s,qmi-chip-id=%d,qmi-board-id=%d%s",
+ ath11k_bus_str(ab->hif.bus),
+ ab->qmi.target.chip_id,
+ ab->qmi.target.board_id, variant);
+ break;
+ }
ath11k_dbg(ab, ATH11K_DBG_BOOT, "boot using board name '%s'\n", name);
@@ -633,7 +648,7 @@ static int ath11k_core_fetch_board_data_
return 0;
}
-#define BOARD_NAME_SIZE 100
+#define BOARD_NAME_SIZE 200
int ath11k_core_fetch_bdf(struct ath11k_base *ab, struct ath11k_board_data *bd)
{
char boardname[BOARD_NAME_SIZE];
--- a/drivers/net/wireless/ath/ath11k/core.h
+++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -47,6 +47,11 @@ enum ath11k_supported_bw {
ATH11K_BW_160 = 3,
};
+enum ath11k_bdf_search {
+ ATH11K_BDF_SEARCH_DEFAULT,
+ ATH11K_BDF_SEARCH_BUS_AND_BOARD,
+};
+
enum wme_ac {
WME_AC_BE,
WME_AC_BK,
@@ -759,6 +764,14 @@ struct ath11k_base {
struct completion htc_suspend;
+ struct {
+ enum ath11k_bdf_search bdf_search;
+ u32 vendor;
+ u32 device;
+ u32 subsystem_vendor;
+ u32 subsystem_device;
+ } id;
+
/* must be last */
u8 drv_priv[0] __aligned(sizeof(void *));
};
--- a/drivers/net/wireless/ath/ath11k/pci.c
+++ b/drivers/net/wireless/ath/ath11k/pci.c
@@ -1251,6 +1251,15 @@ static int ath11k_pci_probe(struct pci_d
goto err_free_core;
}
+ ath11k_dbg(ab, ATH11K_DBG_BOOT, "pci probe %04x:%04x %04x:%04x\n",
+ pdev->vendor, pdev->device,
+ pdev->subsystem_vendor, pdev->subsystem_device);
+
+ ab->id.vendor = pdev->vendor;
+ ab->id.device = pdev->device;
+ ab->id.subsystem_vendor = pdev->subsystem_vendor;
+ ab->id.subsystem_device = pdev->subsystem_device;
+
switch (pci_dev->device) {
case QCA6390_DEVICE_ID:
ath11k_pci_read_hw_version(ab, &soc_hw_version_major,
@@ -1273,6 +1282,7 @@ static int ath11k_pci_probe(struct pci_d
ab->hw_rev = ATH11K_HW_QCN9074_HW10;
break;
case WCN6855_DEVICE_ID:
+ ab->id.bdf_search = ATH11K_BDF_SEARCH_BUS_AND_BOARD;
ath11k_pci_read_hw_version(ab, &soc_hw_version_major,
&soc_hw_version_minor);
switch (soc_hw_version_major) {
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0079/1039] shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0078/1039] ath11k: add string type to search board data in board-2.bin for WCN6855 Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0080/1039] drm/rockchip: dsi: Hold pm-runtime across bind/unbind Greg Kroah-Hartman
` (913 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gang Li, Muchun Song,
Kirill A. Shutemov, Hugh Dickins, Andrew Morton, Linus Torvalds
From: Gang Li <ligang.bdlg@bytedance.com>
commit 62c9827cbb996c2c04f615ecd783ce28bcea894b upstream.
Fix a data race in commit 779750d20b93 ("shmem: split huge pages beyond
i_size under memory pressure").
Here are call traces causing race:
Call Trace 1:
shmem_unused_huge_shrink+0x3ae/0x410
? __list_lru_walk_one.isra.5+0x33/0x160
super_cache_scan+0x17c/0x190
shrink_slab.part.55+0x1ef/0x3f0
shrink_node+0x10e/0x330
kswapd+0x380/0x740
kthread+0xfc/0x130
? mem_cgroup_shrink_node+0x170/0x170
? kthread_create_on_node+0x70/0x70
ret_from_fork+0x1f/0x30
Call Trace 2:
shmem_evict_inode+0xd8/0x190
evict+0xbe/0x1c0
do_unlinkat+0x137/0x330
do_syscall_64+0x76/0x120
entry_SYSCALL_64_after_hwframe+0x3d/0xa2
A simple explanation:
Image there are 3 items in the local list (@list). In the first
traversal, A is not deleted from @list.
1) A->B->C
^
|
pos (leave)
In the second traversal, B is deleted from @list. Concurrently, A is
deleted from @list through shmem_evict_inode() since last reference
counter of inode is dropped by other thread. Then the @list is corrupted.
2) A->B->C
^ ^
| |
evict pos (drop)
We should make sure the inode is either on the global list or deleted from
any local list before iput().
Fixed by moving inodes back to global list before we put them.
[akpm@linux-foundation.org: coding style fixes]
Link: https://lkml.kernel.org/r/20211125064502.99983-1-ligang.bdlg@bytedance.com
Fixes: 779750d20b93 ("shmem: split huge pages beyond i_size under memory pressure")
Signed-off-by: Gang Li <ligang.bdlg@bytedance.com>
Reviewed-by: Muchun Song <songmuchun@bytedance.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/shmem.c | 37 +++++++++++++++++++++----------------
1 file changed, 21 insertions(+), 16 deletions(-)
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -554,7 +554,7 @@ static unsigned long shmem_unused_huge_s
struct shmem_inode_info *info;
struct page *page;
unsigned long batch = sc ? sc->nr_to_scan : 128;
- int removed = 0, split = 0;
+ int split = 0;
if (list_empty(&sbinfo->shrinklist))
return SHRINK_STOP;
@@ -569,7 +569,6 @@ static unsigned long shmem_unused_huge_s
/* inode is about to be evicted */
if (!inode) {
list_del_init(&info->shrinklist);
- removed++;
goto next;
}
@@ -577,12 +576,12 @@ static unsigned long shmem_unused_huge_s
if (round_up(inode->i_size, PAGE_SIZE) ==
round_up(inode->i_size, HPAGE_PMD_SIZE)) {
list_move(&info->shrinklist, &to_remove);
- removed++;
goto next;
}
list_move(&info->shrinklist, &list);
next:
+ sbinfo->shrinklist_len--;
if (!--batch)
break;
}
@@ -602,7 +601,7 @@ next:
inode = &info->vfs_inode;
if (nr_to_split && split >= nr_to_split)
- goto leave;
+ goto move_back;
page = find_get_page(inode->i_mapping,
(inode->i_size & HPAGE_PMD_MASK) >> PAGE_SHIFT);
@@ -616,38 +615,44 @@ next:
}
/*
- * Leave the inode on the list if we failed to lock
- * the page at this time.
+ * Move the inode on the list back to shrinklist if we failed
+ * to lock the page at this time.
*
* Waiting for the lock may lead to deadlock in the
* reclaim path.
*/
if (!trylock_page(page)) {
put_page(page);
- goto leave;
+ goto move_back;
}
ret = split_huge_page(page);
unlock_page(page);
put_page(page);
- /* If split failed leave the inode on the list */
+ /* If split failed move the inode on the list back to shrinklist */
if (ret)
- goto leave;
+ goto move_back;
split++;
drop:
list_del_init(&info->shrinklist);
- removed++;
-leave:
+ goto put;
+move_back:
+ /*
+ * Make sure the inode is either on the global list or deleted
+ * from any local list before iput() since it could be deleted
+ * in another thread once we put the inode (then the local list
+ * is corrupted).
+ */
+ spin_lock(&sbinfo->shrinklist_lock);
+ list_move(&info->shrinklist, &sbinfo->shrinklist);
+ sbinfo->shrinklist_len++;
+ spin_unlock(&sbinfo->shrinklist_lock);
+put:
iput(inode);
}
- spin_lock(&sbinfo->shrinklist_lock);
- list_splice_tail(&list, &sbinfo->shrinklist);
- sbinfo->shrinklist_len -= removed;
- spin_unlock(&sbinfo->shrinklist_lock);
-
return split;
}
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0080/1039] drm/rockchip: dsi: Hold pm-runtime across bind/unbind
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0079/1039] shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0081/1039] drm/rockchip: dsi: Reconfigure hardware on resume() Greg Kroah-Hartman
` (912 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, aleksandr.o.makarov, Brian Norris,
Nícolas F . R . A . Prado, Chen-Yu Tsai, Heiko Stuebner
From: Brian Norris <briannorris@chromium.org>
commit 514db871922f103886ad4d221cf406b4fcc5e74a upstream.
In commit 43c2de1002d2 ("drm/rockchip: dsi: move all lane config except
LCDC mux to bind()"), we moved most HW configuration to bind(), but we
didn't move the runtime PM management. Therefore, depending on initial
boot state, runtime-PM workqueue delays, and other timing factors, we
may disable our power domain in between the hardware configuration
(bind()) and when we enable the display. This can cause us to lose
hardware state and fail to configure our display. For example:
dw-mipi-dsi-rockchip ff968000.mipi: failed to write command FIFO
panel-innolux-p079zca ff960000.mipi.0: failed to write command 0
or:
dw-mipi-dsi-rockchip ff968000.mipi: failed to write command FIFO
panel-kingdisplay-kd097d04 ff960000.mipi.0: failed write init cmds: -110
We should match the runtime PM to the lifetime of the bind()/unbind()
cycle.
Tested on Acer Chrometab 10 (RK3399 Gru-Scarlet), with panel drivers
built either as modules or built-in.
Side notes: it seems one is more likely to see this problem when the
panel driver is built into the kernel. I've also seen this problem
bisect down to commits that simply changed Kconfig dependencies, because
it changed the order in which driver init functions were compiled into
the kernel, and therefore the ordering and timing of built-in device
probe.
Fixes: 43c2de1002d2 ("drm/rockchip: dsi: move all lane config except LCDC mux to bind()")
Link: https://lore.kernel.org/linux-rockchip/9aedfb528600ecf871885f7293ca4207c84d16c1.camel@gmail.com/
Reported-by: <aleksandr.o.makarov@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Brian Norris <briannorris@chromium.org>
Tested-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20210928143413.v3.1.Ic2904d37f30013a7f3d8476203ad3733c186827e@changeid
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | 37 ++++++++++++------------
1 file changed, 19 insertions(+), 18 deletions(-)
--- a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
+++ b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
@@ -772,10 +772,6 @@ static void dw_mipi_dsi_encoder_enable(s
if (mux < 0)
return;
- pm_runtime_get_sync(dsi->dev);
- if (dsi->slave)
- pm_runtime_get_sync(dsi->slave->dev);
-
/*
* For the RK3399, the clk of grf must be enabled before writing grf
* register. And for RK3288 or other soc, this grf_clk must be NULL,
@@ -794,20 +790,10 @@ static void dw_mipi_dsi_encoder_enable(s
clk_disable_unprepare(dsi->grf_clk);
}
-static void dw_mipi_dsi_encoder_disable(struct drm_encoder *encoder)
-{
- struct dw_mipi_dsi_rockchip *dsi = to_dsi(encoder);
-
- if (dsi->slave)
- pm_runtime_put(dsi->slave->dev);
- pm_runtime_put(dsi->dev);
-}
-
static const struct drm_encoder_helper_funcs
dw_mipi_dsi_encoder_helper_funcs = {
.atomic_check = dw_mipi_dsi_encoder_atomic_check,
.enable = dw_mipi_dsi_encoder_enable,
- .disable = dw_mipi_dsi_encoder_disable,
};
static int rockchip_dsi_drm_create_encoder(struct dw_mipi_dsi_rockchip *dsi,
@@ -937,10 +923,14 @@ static int dw_mipi_dsi_rockchip_bind(str
put_device(second);
}
+ pm_runtime_get_sync(dsi->dev);
+ if (dsi->slave)
+ pm_runtime_get_sync(dsi->slave->dev);
+
ret = clk_prepare_enable(dsi->pllref_clk);
if (ret) {
DRM_DEV_ERROR(dev, "Failed to enable pllref_clk: %d\n", ret);
- return ret;
+ goto out_pm_runtime;
}
/*
@@ -952,7 +942,7 @@ static int dw_mipi_dsi_rockchip_bind(str
ret = clk_prepare_enable(dsi->grf_clk);
if (ret) {
DRM_DEV_ERROR(dsi->dev, "Failed to enable grf_clk: %d\n", ret);
- return ret;
+ goto out_pm_runtime;
}
dw_mipi_dsi_rockchip_config(dsi);
@@ -964,16 +954,23 @@ static int dw_mipi_dsi_rockchip_bind(str
ret = rockchip_dsi_drm_create_encoder(dsi, drm_dev);
if (ret) {
DRM_DEV_ERROR(dev, "Failed to create drm encoder\n");
- return ret;
+ goto out_pm_runtime;
}
ret = dw_mipi_dsi_bind(dsi->dmd, &dsi->encoder);
if (ret) {
DRM_DEV_ERROR(dev, "Failed to bind: %d\n", ret);
- return ret;
+ goto out_pm_runtime;
}
return 0;
+
+out_pm_runtime:
+ pm_runtime_put(dsi->dev);
+ if (dsi->slave)
+ pm_runtime_put(dsi->slave->dev);
+
+ return ret;
}
static void dw_mipi_dsi_rockchip_unbind(struct device *dev,
@@ -988,6 +985,10 @@ static void dw_mipi_dsi_rockchip_unbind(
dw_mipi_dsi_unbind(dsi->dmd);
clk_disable_unprepare(dsi->pllref_clk);
+
+ pm_runtime_put(dsi->dev);
+ if (dsi->slave)
+ pm_runtime_put(dsi->slave->dev);
}
static const struct component_ops dw_mipi_dsi_rockchip_ops = {
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0081/1039] drm/rockchip: dsi: Reconfigure hardware on resume()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0080/1039] drm/rockchip: dsi: Hold pm-runtime across bind/unbind Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0082/1039] drm/ttm: Put BO in its memory managers lru list Greg Kroah-Hartman
` (911 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian Norris, Chen-Yu Tsai,
Nícolas F . R . A . Prado, Heiko Stuebner
From: Brian Norris <briannorris@chromium.org>
commit e584cdc1549932f87a2707b56bc588cfac5d89e0 upstream.
Since commit 43c2de1002d2 ("drm/rockchip: dsi: move all lane config except
LCDC mux to bind()"), we perform most HW configuration in the bind()
function. This configuration may be lost on suspend/resume, so we
need to call it again. That may lead to errors like this after system
suspend/resume:
dw-mipi-dsi-rockchip ff968000.mipi: failed to write command FIFO
panel-kingdisplay-kd097d04 ff960000.mipi.0: failed write init cmds: -110
Tested on Acer Chromebook Tab 10 (RK3399 Gru-Scarlet).
Note that early mailing list versions of this driver borrowed Rockchip's
downstream/BSP solution, to do HW configuration in mode_set() (which
*is* called at the appropriate pre-enable() times), but that was
discarded along the way. I've avoided that still, because mode_set()
documentation doesn't suggest this kind of purpose as far as I can tell.
Fixes: 43c2de1002d2 ("drm/rockchip: dsi: move all lane config except LCDC mux to bind()")
Cc: <stable@vger.kernel.org>
Signed-off-by: Brian Norris <briannorris@chromium.org>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Tested-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20210928143413.v3.2.I4e9d93aadb00b1ffc7d506e3186a25492bf0b732@changeid
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | 37 ++++++++++++++++++++++++
1 file changed, 37 insertions(+)
--- a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
+++ b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
@@ -267,6 +267,8 @@ struct dw_mipi_dsi_rockchip {
struct dw_mipi_dsi *dmd;
const struct rockchip_dw_dsi_chip_data *cdata;
struct dw_mipi_dsi_plat_data pdata;
+
+ bool dsi_bound;
};
struct dphy_pll_parameter_map {
@@ -963,6 +965,8 @@ static int dw_mipi_dsi_rockchip_bind(str
goto out_pm_runtime;
}
+ dsi->dsi_bound = true;
+
return 0;
out_pm_runtime:
@@ -982,6 +986,8 @@ static void dw_mipi_dsi_rockchip_unbind(
if (dsi->is_slave)
return;
+ dsi->dsi_bound = false;
+
dw_mipi_dsi_unbind(dsi->dmd);
clk_disable_unprepare(dsi->pllref_clk);
@@ -1276,6 +1282,36 @@ static const struct phy_ops dw_mipi_dsi_
.exit = dw_mipi_dsi_dphy_exit,
};
+static int __maybe_unused dw_mipi_dsi_rockchip_resume(struct device *dev)
+{
+ struct dw_mipi_dsi_rockchip *dsi = dev_get_drvdata(dev);
+ int ret;
+
+ /*
+ * Re-configure DSI state, if we were previously initialized. We need
+ * to do this before rockchip_drm_drv tries to re-enable() any panels.
+ */
+ if (dsi->dsi_bound) {
+ ret = clk_prepare_enable(dsi->grf_clk);
+ if (ret) {
+ DRM_DEV_ERROR(dsi->dev, "Failed to enable grf_clk: %d\n", ret);
+ return ret;
+ }
+
+ dw_mipi_dsi_rockchip_config(dsi);
+ if (dsi->slave)
+ dw_mipi_dsi_rockchip_config(dsi->slave);
+
+ clk_disable_unprepare(dsi->grf_clk);
+ }
+
+ return 0;
+}
+
+static const struct dev_pm_ops dw_mipi_dsi_rockchip_pm_ops = {
+ SET_LATE_SYSTEM_SLEEP_PM_OPS(NULL, dw_mipi_dsi_rockchip_resume)
+};
+
static int dw_mipi_dsi_rockchip_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
@@ -1593,6 +1629,7 @@ struct platform_driver dw_mipi_dsi_rockc
.remove = dw_mipi_dsi_rockchip_remove,
.driver = {
.of_match_table = dw_mipi_dsi_rockchip_dt_ids,
+ .pm = &dw_mipi_dsi_rockchip_pm_ops,
.name = "dw-mipi-dsi-rockchip",
},
};
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0082/1039] drm/ttm: Put BO in its memory managers lru list
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0081/1039] drm/rockchip: dsi: Reconfigure hardware on resume() Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0083/1039] Bluetooth: hci_vhci: Fix to set the force_wakeup value Greg Kroah-Hartman
` (910 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Christian König, xinhui pan
From: xinhui pan <xinhui.pan@amd.com>
commit 781050b0a3164934857c300bb0bc291e38c26b6f upstream.
After we move BO to a new memory region, we should put it to
the new memory manager's lru list regardless we unlock the resv or not.
Cc: stable@vger.kernel.org
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: xinhui pan <xinhui.pan@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20211110043149.57554-1-xinhui.pan@amd.com
Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/ttm/ttm_bo.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -727,6 +727,8 @@ int ttm_mem_evict_first(struct ttm_devic
ret = ttm_bo_evict(bo, ctx);
if (locked)
ttm_bo_unreserve(bo);
+ else
+ ttm_bo_move_to_lru_tail_unlocked(bo);
ttm_bo_put(bo);
return ret;
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0083/1039] Bluetooth: hci_vhci: Fix to set the force_wakeup value
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0082/1039] drm/ttm: Put BO in its memory managers lru list Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0084/1039] Bluetooth: mgmt: Fix Experimental Feature Changed event Greg Kroah-Hartman
` (909 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tedd Ho-Jeong An, Marcel Holtmann,
Sasha Levin
From: Tedd Ho-Jeong An <tedd.an@intel.com>
[ Upstream commit 8b89637dbac2d73d9f3dadf91b4a7dcdb1fc23af ]
This patch sets the wakeup state of the vhci driver when the
force_wakeup is updated.
Fixes: 60edfad4fd0b6 ("Bluetooth: hci_vhci: Add force_prevent_wake entry")
Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/hci_vhci.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
index b45db0db347c6..5fd91106e853d 100644
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -176,6 +176,8 @@ static ssize_t force_wakeup_write(struct file *file,
if (data->wakeup == enable)
return -EALREADY;
+ data->wakeup = enable;
+
return count;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0084/1039] Bluetooth: mgmt: Fix Experimental Feature Changed event
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0083/1039] Bluetooth: hci_vhci: Fix to set the force_wakeup value Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0085/1039] Bluetooth: L2CAP: Fix not initializing sk_peer_pid Greg Kroah-Hartman
` (908 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tedd Ho-Jeong An, Marcel Holtmann,
Sasha Levin
From: Tedd Ho-Jeong An <tedd.an@intel.com>
[ Upstream commit b15bfa4df63529150df9ff0585675f728436e0c1 ]
This patch fixes the controller index in the Experimental Features
Changed event for the offload_codec and the quality_report features to
use the actual hdev index instead of non-controller index(0xffff) so the
client can receive the event and know which controller the event is for.
Fixes: ad93315183285 ("Bluetooth: Add offload feature under experimental flag")
Fixes: ae7d925b5c043 ("Bluetooth: Support the quality report events")
Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/mgmt.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 3e5283607b97c..44683443300ce 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -3927,7 +3927,9 @@ static int exp_debug_feature_changed(bool enabled, struct sock *skip)
}
#endif
-static int exp_quality_report_feature_changed(bool enabled, struct sock *skip)
+static int exp_quality_report_feature_changed(bool enabled,
+ struct hci_dev *hdev,
+ struct sock *skip)
{
struct mgmt_ev_exp_feature_changed ev;
@@ -3935,7 +3937,7 @@ static int exp_quality_report_feature_changed(bool enabled, struct sock *skip)
memcpy(ev.uuid, quality_report_uuid, 16);
ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
- return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL,
+ return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
&ev, sizeof(ev),
HCI_MGMT_EXP_FEATURE_EVENTS, skip);
}
@@ -4156,14 +4158,15 @@ static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev,
&rp, sizeof(rp));
if (changed)
- exp_quality_report_feature_changed(val, sk);
+ exp_quality_report_feature_changed(val, hdev, sk);
unlock_quality_report:
hci_req_sync_unlock(hdev);
return err;
}
-static int exp_offload_codec_feature_changed(bool enabled, struct sock *skip)
+static int exp_offload_codec_feature_changed(bool enabled, struct hci_dev *hdev,
+ struct sock *skip)
{
struct mgmt_ev_exp_feature_changed ev;
@@ -4171,7 +4174,7 @@ static int exp_offload_codec_feature_changed(bool enabled, struct sock *skip)
memcpy(ev.uuid, offload_codecs_uuid, 16);
ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
- return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL,
+ return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
&ev, sizeof(ev),
HCI_MGMT_EXP_FEATURE_EVENTS, skip);
}
@@ -4229,7 +4232,7 @@ static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev,
&rp, sizeof(rp));
if (changed)
- exp_offload_codec_feature_changed(val, sk);
+ exp_offload_codec_feature_changed(val, hdev, sk);
return err;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0085/1039] Bluetooth: L2CAP: Fix not initializing sk_peer_pid
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0084/1039] Bluetooth: mgmt: Fix Experimental Feature Changed event Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0086/1039] drm/bridge: display-connector: fix an uninitialized pointer in probe() Greg Kroah-Hartman
` (907 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Luiz Augusto von Dentz,
Marcel Holtmann, Sasha Levin
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit f5ff291098f70a70b344df1e388596755c3c8315 ]
In order to group sockets being connected using L2CAP_MODE_EXT_FLOWCTL
the pid is used but sk_peer_pid was not being initialized as it is
currently only done for af_unix.
Fixes: b48596d1dc25 ("Bluetooth: L2CAP: Add get_peer_pid callback")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_sock.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 160c016a5dfb9..4574c5cb1b596 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -172,6 +172,21 @@ done:
return err;
}
+static void l2cap_sock_init_pid(struct sock *sk)
+{
+ struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+
+ /* Only L2CAP_MODE_EXT_FLOWCTL ever need to access the PID in order to
+ * group the channels being requested.
+ */
+ if (chan->mode != L2CAP_MODE_EXT_FLOWCTL)
+ return;
+
+ spin_lock(&sk->sk_peer_lock);
+ sk->sk_peer_pid = get_pid(task_tgid(current));
+ spin_unlock(&sk->sk_peer_lock);
+}
+
static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
int alen, int flags)
{
@@ -243,6 +258,8 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
if (chan->psm && bdaddr_type_is_le(chan->src_type) && !chan->mode)
chan->mode = L2CAP_MODE_LE_FLOWCTL;
+ l2cap_sock_init_pid(sk);
+
err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
&la.l2_bdaddr, la.l2_bdaddr_type);
if (err)
@@ -298,6 +315,8 @@ static int l2cap_sock_listen(struct socket *sock, int backlog)
goto done;
}
+ l2cap_sock_init_pid(sk);
+
sk->sk_max_ack_backlog = backlog;
sk->sk_ack_backlog = 0;
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0086/1039] drm/bridge: display-connector: fix an uninitialized pointer in probe()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0085/1039] Bluetooth: L2CAP: Fix not initializing sk_peer_pid Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0087/1039] drm: fix null-ptr-deref in drm_dev_init_release() Greg Kroah-Hartman
` (906 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Sam Ravnborg, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 189723fbe9aca18d6f7d638c59a40288030932b5 ]
The "label" pointer is used for debug output. The code assumes that it
is either NULL or valid, but it is never set to NULL. It is either
valid or uninitialized.
Fixes: 0c275c30176b ("drm/bridge: Add bridge driver for display connectors")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20211013080825.GE6010@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/display-connector.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/display-connector.c b/drivers/gpu/drm/bridge/display-connector.c
index 05eb759da6fc6..847a0dce7f1d3 100644
--- a/drivers/gpu/drm/bridge/display-connector.c
+++ b/drivers/gpu/drm/bridge/display-connector.c
@@ -107,7 +107,7 @@ static int display_connector_probe(struct platform_device *pdev)
{
struct display_connector *conn;
unsigned int type;
- const char *label;
+ const char *label = NULL;
int ret;
conn = devm_kzalloc(&pdev->dev, sizeof(*conn), GFP_KERNEL);
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0087/1039] drm: fix null-ptr-deref in drm_dev_init_release()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0086/1039] drm/bridge: display-connector: fix an uninitialized pointer in probe() Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0088/1039] drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure Greg Kroah-Hartman
` (905 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Hai, Sam Ravnborg,
Sasha Levin
From: Wang Hai <wanghai38@huawei.com>
[ Upstream commit acf20ed020ffa4d6cc8347e8d356509b95df3cbe ]
I got a null-ptr-deref report:
[drm:drm_dev_init [drm]] *ERROR* Cannot allocate anonymous inode: -12
==================================================================
BUG: KASAN: null-ptr-deref in iput+0x3c/0x4a0
...
Call Trace:
dump_stack_lvl+0x6c/0x8b
kasan_report.cold+0x64/0xdb
__asan_load8+0x69/0x90
iput+0x3c/0x4a0
drm_dev_init_release+0x39/0xb0 [drm]
drm_managed_release+0x158/0x2d0 [drm]
drm_dev_init+0x3a7/0x4c0 [drm]
__devm_drm_dev_alloc+0x55/0xd0 [drm]
mi0283qt_probe+0x8a/0x2b5 [mi0283qt]
spi_probe+0xeb/0x130
...
entry_SYSCALL_64_after_hwframe+0x44/0xae
If drm_fs_inode_new() fails in drm_dev_init(), dev->anon_inode will point
to PTR_ERR(...) instead of NULL. This will result in null-ptr-deref when
drm_fs_inode_free(dev->anon_inode) is called.
drm_dev_init()
drm_fs_inode_new() // fail, dev->anon_inode = PTR_ERR(...)
drm_managed_release()
drm_dev_init_release()
drm_fs_inode_free() // access non-existent anon_inode
Define a temp variable and assign it to dev->anon_inode if the temp
variable is not PTR_ERR.
Fixes: 2cbf7fc6718b ("drm: Use drmm_ for drm_dev_init cleanup")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20211013114139.4042207-1-wanghai38@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_drv.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 7a5097467ba5c..b3a1636d1b984 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -581,6 +581,7 @@ static int drm_dev_init(struct drm_device *dev,
const struct drm_driver *driver,
struct device *parent)
{
+ struct inode *inode;
int ret;
if (!drm_core_init_complete) {
@@ -617,13 +618,15 @@ static int drm_dev_init(struct drm_device *dev,
if (ret)
return ret;
- dev->anon_inode = drm_fs_inode_new();
- if (IS_ERR(dev->anon_inode)) {
- ret = PTR_ERR(dev->anon_inode);
+ inode = drm_fs_inode_new();
+ if (IS_ERR(inode)) {
+ ret = PTR_ERR(inode);
DRM_ERROR("Cannot allocate anonymous inode: %d\n", ret);
goto err;
}
+ dev->anon_inode = inode;
+
if (drm_core_check_feature(dev, DRIVER_RENDER)) {
ret = drm_minor_alloc(dev, DRM_MINOR_RENDER);
if (ret)
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0088/1039] drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0087/1039] drm: fix null-ptr-deref in drm_dev_init_release() Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0089/1039] drm/panel: innolux-p079zca: " Greg Kroah-Hartman
` (904 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian Norris, Sam Ravnborg, Sasha Levin
From: Brian Norris <briannorris@chromium.org>
[ Upstream commit 5f31dbeae8a88f31c3eb4eb526ab4807c40da241 ]
If we fail to attach (e.g., because 1 of 2 dual-DSI controllers aren't
ready), we leave a dangling drm_panel reference to freed memory. Clean
that up on failure.
Fixes: 2a994cbed6b2 ("drm/panel: Add Kingdisplay KD097D04 panel driver")
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210923173336.1.Icb4d9dbc1817f4e826361a4f1cea7461541668f0@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c b/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c
index 86e4213e8bb13..daccb1fd5fdad 100644
--- a/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c
+++ b/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c
@@ -406,7 +406,13 @@ static int kingdisplay_panel_probe(struct mipi_dsi_device *dsi)
if (err < 0)
return err;
- return mipi_dsi_attach(dsi);
+ err = mipi_dsi_attach(dsi);
+ if (err < 0) {
+ kingdisplay_panel_del(kingdisplay);
+ return err;
+ }
+
+ return 0;
}
static int kingdisplay_panel_remove(struct mipi_dsi_device *dsi)
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0089/1039] drm/panel: innolux-p079zca: Delete panel on attach() failure
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0088/1039] drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0090/1039] drm/rockchip: dsi: Fix unbalanced clock on probe error Greg Kroah-Hartman
` (903 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian Norris, Sam Ravnborg, Sasha Levin
From: Brian Norris <briannorris@chromium.org>
[ Upstream commit 32a267e9c057e1636e7afdd20599aa5741a73079 ]
If we fail to attach (e.g., because 1 of 2 dual-DSI controllers aren't
ready), we leave a dangling drm_panel reference to freed memory. Clean
that up on failure.
This problem exists since the driver's introduction, but is especially
relevant after refactored for dual-DSI variants.
Fixes: 14c8f2e9f8ea ("drm/panel: add Innolux P079ZCA panel driver")
Fixes: 7ad4e4636c54 ("drm/panel: p079zca: Refactor panel driver to support multiple panels")
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210923173336.2.I9023cf8811a3abf4964ed84eb681721d8bb489d6@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-innolux-p079zca.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/panel/panel-innolux-p079zca.c b/drivers/gpu/drm/panel/panel-innolux-p079zca.c
index aea3162253914..f194b62e290ca 100644
--- a/drivers/gpu/drm/panel/panel-innolux-p079zca.c
+++ b/drivers/gpu/drm/panel/panel-innolux-p079zca.c
@@ -484,6 +484,7 @@ static void innolux_panel_del(struct innolux_panel *innolux)
static int innolux_panel_probe(struct mipi_dsi_device *dsi)
{
const struct panel_desc *desc;
+ struct innolux_panel *innolux;
int err;
desc = of_device_get_match_data(&dsi->dev);
@@ -495,7 +496,14 @@ static int innolux_panel_probe(struct mipi_dsi_device *dsi)
if (err < 0)
return err;
- return mipi_dsi_attach(dsi);
+ err = mipi_dsi_attach(dsi);
+ if (err < 0) {
+ innolux = mipi_dsi_get_drvdata(dsi);
+ innolux_panel_del(innolux);
+ return err;
+ }
+
+ return 0;
}
static int innolux_panel_remove(struct mipi_dsi_device *dsi)
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0090/1039] drm/rockchip: dsi: Fix unbalanced clock on probe error
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0089/1039] drm/panel: innolux-p079zca: " Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0091/1039] drm/rockchip: dsi: Disable PLL clock on bind error Greg Kroah-Hartman
` (902 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian Norris, Chen-Yu Tsai,
Nícolas F . R . A . Prado, Heiko Stuebner, Sasha Levin
From: Brian Norris <briannorris@chromium.org>
[ Upstream commit 251888398753924059f3bb247a44153a2853137f ]
Our probe() function never enabled this clock, so we shouldn't disable
it if we fail to probe the bridge.
Noted by inspection.
Fixes: 2d4f7bdafd70 ("drm/rockchip: dsi: migrate to use dw-mipi-dsi bridge driver")
Signed-off-by: Brian Norris <briannorris@chromium.org>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Tested-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20210928143413.v3.3.Ie8ceefb51ab6065a1151869b6fcda41a467d4d2c@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
--- a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
+++ b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
@@ -1433,14 +1433,10 @@ static int dw_mipi_dsi_rockchip_probe(st
if (ret != -EPROBE_DEFER)
DRM_DEV_ERROR(dev,
"Failed to probe dw_mipi_dsi: %d\n", ret);
- goto err_clkdisable;
+ return ret;
}
return 0;
-
-err_clkdisable:
- clk_disable_unprepare(dsi->pllref_clk);
- return ret;
}
static int dw_mipi_dsi_rockchip_remove(struct platform_device *pdev)
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0091/1039] drm/rockchip: dsi: Disable PLL clock on bind error
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0090/1039] drm/rockchip: dsi: Fix unbalanced clock on probe error Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0092/1039] Bluetooth: virtio_bt: fix memory leak in virtbt_rx_handle() Greg Kroah-Hartman
` (901 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian Norris, Chen-Yu Tsai,
Nícolas F . R . A . Prado, Heiko Stuebner, Sasha Levin
From: Brian Norris <briannorris@chromium.org>
[ Upstream commit 5a614570172e1c9f59035d259dd735acd4f1c01b ]
Fix some error handling here noticed in review of other changes.
Fixes: 2d4f7bdafd70 ("drm/rockchip: dsi: migrate to use dw-mipi-dsi bridge driver")
Signed-off-by: Brian Norris <briannorris@chromium.org>
Reported-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Tested-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20210928143413.v3.4.I8bb7a91ecc411d56bc155763faa15f289d7fc074@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
+++ b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
@@ -944,7 +944,7 @@ static int dw_mipi_dsi_rockchip_bind(str
ret = clk_prepare_enable(dsi->grf_clk);
if (ret) {
DRM_DEV_ERROR(dsi->dev, "Failed to enable grf_clk: %d\n", ret);
- goto out_pm_runtime;
+ goto out_pll_clk;
}
dw_mipi_dsi_rockchip_config(dsi);
@@ -956,19 +956,21 @@ static int dw_mipi_dsi_rockchip_bind(str
ret = rockchip_dsi_drm_create_encoder(dsi, drm_dev);
if (ret) {
DRM_DEV_ERROR(dev, "Failed to create drm encoder\n");
- goto out_pm_runtime;
+ goto out_pll_clk;
}
ret = dw_mipi_dsi_bind(dsi->dmd, &dsi->encoder);
if (ret) {
DRM_DEV_ERROR(dev, "Failed to bind: %d\n", ret);
- goto out_pm_runtime;
+ goto out_pll_clk;
}
dsi->dsi_bound = true;
return 0;
+out_pll_clk:
+ clk_disable_unprepare(dsi->pllref_clk);
out_pm_runtime:
pm_runtime_put(dsi->dev);
if (dsi->slave)
^ permalink raw reply [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0092/1039] Bluetooth: virtio_bt: fix memory leak in virtbt_rx_handle()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0091/1039] drm/rockchip: dsi: Disable PLL clock on bind error Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0093/1039] Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails Greg Kroah-Hartman
` (900 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Soenke Huster, Marcel Holtmann, Sasha Levin
From: Soenke Huster <soenke.huster@eknoes.de>
[ Upstream commit 1d0688421449718c6c5f46e458a378c9b530ba18 ]
On the reception of packets with an invalid packet type, the memory of
the allocated socket buffers is never freed. Add a default case that frees
these to avoid a memory leak.
Fixes: afd2daa26c7a ("Bluetooth: Add support for virtio transport driver")
Signed-off-by: Soenke Huster <soenke.huster@eknoes.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/virtio_bt.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
index 57908ce4fae85..076e4942a3f0e 100644
--- a/drivers/bluetooth/virtio_bt.c
+++ b/drivers/bluetooth/virtio_bt.c
@@ -202,6 +202,9 @@ static void virtbt_rx_handle(struct virtio_bluetooth *vbt, struct sk_buff *skb)
hci_skb_pkt_type(skb) = pkt_type;
hci_recv_frame(vbt->hdev, skb);
break;
+ default:
+ kfree_skb(skb);
+ break;
}
}
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0093/1039] Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0092/1039] Bluetooth: virtio_bt: fix memory leak in virtbt_rx_handle() Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0094/1039] clk: bcm-2835: Pick the closest clock rate Greg Kroah-Hartman
` (899 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Hai,
Marcel Holtmann, Sasha Levin
From: Wang Hai <wanghai38@huawei.com>
[ Upstream commit 2a7ca7459d905febf519163bd9e3eed894de6bb7 ]
I got a kernel BUG report when doing fault injection test:
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:45!
...
RIP: 0010:__list_del_entry_valid.cold+0x12/0x4d
...
Call Trace:
proto_unregister+0x83/0x220
cmtp_cleanup_sockets+0x37/0x40 [cmtp]
cmtp_exit+0xe/0x1f [cmtp]
do_syscall_64+0x35/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
If cmtp_init_sockets() in cmtp_init() fails, cmtp_init() still returns
success. This will cause a kernel bug when accessing uncreated ctmp
related data when the module exits.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/cmtp/core.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index 0a2d78e811cf5..83eb84e8e688f 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -501,9 +501,7 @@ static int __init cmtp_init(void)
{
BT_INFO("CMTP (CAPI Emulation) ver %s", VERSION);
- cmtp_init_sockets();
-
- return 0;
+ return cmtp_init_sockets();
}
static void __exit cmtp_exit(void)
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0094/1039] clk: bcm-2835: Pick the closest clock rate
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0093/1039] Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0095/1039] clk: bcm-2835: Remove rounding up the dividers Greg Kroah-Hartman
` (898 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maxime Ripard, Stephen Boyd,
Nicolas Saenz Julienne, Michael Stapelberg, Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit 5517357a4733d7cf7c17fc79d0530cfa47add372 ]
The driver currently tries to pick the closest rate that is lower than
the rate being requested.
This causes an issue with clk_set_min_rate() since it actively checks
for the rounded rate to be above the minimum that was just set.
Let's change the logic a bit to pick the closest rate to the requested
rate, no matter if it's actually higher or lower.
Fixes: 6d18b8adbe67 ("clk: bcm2835: Support for clock parent selection")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Acked-by: Stephen Boyd <sboyd@kernel.org>
Reviewed-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Tested-by: Nicolas Saenz Julienne <nsaenz@kernel.org> # boot and basic functionality
Tested-by: Michael Stapelberg <michael@stapelberg.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210922125419.4125779-2-maxime@cerno.tech
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/bcm/clk-bcm2835.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index a254512965eb8..bf97b2b2a63f8 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -1216,7 +1216,7 @@ static int bcm2835_clock_determine_rate(struct clk_hw *hw,
rate = bcm2835_clock_choose_div_and_prate(hw, i, req->rate,
&div, &prate,
&avgrate);
- if (rate > best_rate && rate <= req->rate) {
+ if (abs(req->rate - rate) < abs(req->rate - best_rate)) {
best_parent = parent;
best_prate = prate;
best_rate = rate;
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0095/1039] clk: bcm-2835: Remove rounding up the dividers
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0094/1039] clk: bcm-2835: Pick the closest clock rate Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0096/1039] drm/vc4: hdmi: Set a default HSM rate Greg Kroah-Hartman
` (897 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maxime Ripard, Stephen Boyd,
Nicolas Saenz Julienne, Michael Stapelberg, Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit 8ca011ef4af48a7af7b15afd8a4a44039dd04cea ]
The driver, once it found a divider, tries to round it up by increasing
the least significant bit of the fractional part by one when the
round_up argument is set and there's a remainder.
However, since it increases the divider it will actually reduce the
clock rate below what we were asking for, leading to issues with
clk_set_min_rate() that will complain that our rounded clock rate is
below the minimum of the rate.
Since the dividers are fairly precise already, let's remove that part so
that we can have clk_set_min_rate() working.
This is effectively a revert of 9c95b32ca093 ("clk: bcm2835: add a round
up ability to the clock divisor").
Fixes: 9c95b32ca093 ("clk: bcm2835: add a round up ability to the clock divisor")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Acked-by: Stephen Boyd <sboyd@kernel.org>
Reviewed-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Tested-by: Nicolas Saenz Julienne <nsaenz@kernel.org> # boot and basic functionality
Tested-by: Michael Stapelberg <michael@stapelberg.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210922125419.4125779-3-maxime@cerno.tech
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/bcm/clk-bcm2835.c | 11 +++--------
1 file changed, 3 insertions(+), 8 deletions(-)
diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index bf97b2b2a63f8..3667b4d731e71 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -932,8 +932,7 @@ static int bcm2835_clock_is_on(struct clk_hw *hw)
static u32 bcm2835_clock_choose_div(struct clk_hw *hw,
unsigned long rate,
- unsigned long parent_rate,
- bool round_up)
+ unsigned long parent_rate)
{
struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw);
const struct bcm2835_clock_data *data = clock->data;
@@ -945,10 +944,6 @@ static u32 bcm2835_clock_choose_div(struct clk_hw *hw,
rem = do_div(temp, rate);
div = temp;
-
- /* Round up and mask off the unused bits */
- if (round_up && ((div & unused_frac_mask) != 0 || rem != 0))
- div += unused_frac_mask + 1;
div &= ~unused_frac_mask;
/* different clamping limits apply for a mash clock */
@@ -1079,7 +1074,7 @@ static int bcm2835_clock_set_rate(struct clk_hw *hw,
struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw);
struct bcm2835_cprman *cprman = clock->cprman;
const struct bcm2835_clock_data *data = clock->data;
- u32 div = bcm2835_clock_choose_div(hw, rate, parent_rate, false);
+ u32 div = bcm2835_clock_choose_div(hw, rate, parent_rate);
u32 ctl;
spin_lock(&cprman->regs_lock);
@@ -1130,7 +1125,7 @@ static unsigned long bcm2835_clock_choose_div_and_prate(struct clk_hw *hw,
if (!(BIT(parent_idx) & data->set_rate_parent)) {
*prate = clk_hw_get_rate(parent);
- *div = bcm2835_clock_choose_div(hw, rate, *prate, true);
+ *div = bcm2835_clock_choose_div(hw, rate, *prate);
*avgrate = bcm2835_clock_rate_from_divisor(clock, *prate, *div);
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0096/1039] drm/vc4: hdmi: Set a default HSM rate
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0095/1039] clk: bcm-2835: Remove rounding up the dividers Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0097/1039] drm/vc4: hdmi: Move the HSM clock enable to runtime_pm Greg Kroah-Hartman
` (896 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maxime Ripard,
Nicolas Saenz Julienne, Michael Stapelberg, Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit 3e85b81591609bb794bb00cd619b20965b5b38cd ]
When the firmware doesn't setup the HSM rate (such as when booting
without an HDMI cable plugged in), its rate is 0 and thus any register
access results in a CPU stall, even though HSM is enabled.
Let's enforce a minimum rate at boot to avoid this issue.
Fixes: 4f6e3d66ac52 ("drm/vc4: Add runtime PM support to the HDMI encoder driver")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Reviewed-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Tested-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Tested-by: Michael Stapelberg <michael@stapelberg.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210922125419.4125779-4-maxime@cerno.tech
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_hdmi.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index b284623e28634..33f61e2f7e6d1 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -94,6 +94,7 @@
# define VC4_HD_M_SW_RST BIT(2)
# define VC4_HD_M_ENABLE BIT(0)
+#define HSM_MIN_CLOCK_FREQ 120000000
#define CEC_CLOCK_FREQ 40000
#define HDMI_14_MAX_TMDS_CLK (340 * 1000 * 1000)
@@ -2162,6 +2163,19 @@ static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data)
vc4_hdmi->disable_4kp60 = true;
}
+ /*
+ * If we boot without any cable connected to the HDMI connector,
+ * the firmware will skip the HSM initialization and leave it
+ * with a rate of 0, resulting in a bus lockup when we're
+ * accessing the registers even if it's enabled.
+ *
+ * Let's put a sensible default at runtime_resume so that we
+ * don't end up in this situation.
+ */
+ ret = clk_set_min_rate(vc4_hdmi->hsm_clock, HSM_MIN_CLOCK_FREQ);
+ if (ret)
+ goto err_put_ddc;
+
if (vc4_hdmi->variant->reset)
vc4_hdmi->variant->reset(vc4_hdmi);
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0097/1039] drm/vc4: hdmi: Move the HSM clock enable to runtime_pm
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0096/1039] drm/vc4: hdmi: Set a default HSM rate Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0098/1039] drm/vc4: hdmi: Make sure the controller is powered in detect Greg Kroah-Hartman
` (895 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maxime Ripard, Dave Stevenson,
Nicolas Saenz Julienne, Michael Stapelberg, Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit c86b41214362e8e715e1343e16d5d6af0562db05 ]
In order to access the HDMI controller, we need to make sure the HSM
clock is enabled. If we were to access it with the clock disabled, the
CPU would completely hang, resulting in an hard crash.
Since we have different code path that would require it, let's move that
clock enable / disable to runtime_pm that will take care of the
reference counting for us.
Since we also want to change the HSM clock rate and it's only valid
while the clock is disabled, we need to move the clk_set_min_rate() call
on the HSM clock above pm_runtime_get_and_sync().
Fixes: 4f6e3d66ac52 ("drm/vc4: Add runtime PM support to the HDMI encoder driver")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Tested-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Tested-by: Michael Stapelberg <michael@stapelberg.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210922125419.4125779-5-maxime@cerno.tech
Link: https://lore.kernel.org/linux-arm-kernel/20210924152334.1342630-1-maxime@cerno.tech/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_hdmi.c | 70 +++++++++++++++++++++-------------
1 file changed, 44 insertions(+), 26 deletions(-)
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index 33f61e2f7e6d1..63b07087d37e8 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -628,7 +628,6 @@ static void vc4_hdmi_encoder_post_crtc_powerdown(struct drm_encoder *encoder,
vc4_hdmi->variant->phy_disable(vc4_hdmi);
clk_disable_unprepare(vc4_hdmi->pixel_bvb_clock);
- clk_disable_unprepare(vc4_hdmi->hsm_clock);
clk_disable_unprepare(vc4_hdmi->pixel_clock);
ret = pm_runtime_put(&vc4_hdmi->pdev->dev);
@@ -894,28 +893,10 @@ static void vc4_hdmi_encoder_pre_crtc_configure(struct drm_encoder *encoder,
conn_state_to_vc4_hdmi_conn_state(conn_state);
struct drm_display_mode *mode = &encoder->crtc->state->adjusted_mode;
struct vc4_hdmi *vc4_hdmi = encoder_to_vc4_hdmi(encoder);
- unsigned long bvb_rate, pixel_rate, hsm_rate;
+ unsigned long pixel_rate = vc4_conn_state->pixel_rate;
+ unsigned long bvb_rate, hsm_rate;
int ret;
- ret = pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev);
- if (ret < 0) {
- DRM_ERROR("Failed to retain power domain: %d\n", ret);
- return;
- }
-
- pixel_rate = vc4_conn_state->pixel_rate;
- ret = clk_set_rate(vc4_hdmi->pixel_clock, pixel_rate);
- if (ret) {
- DRM_ERROR("Failed to set pixel clock rate: %d\n", ret);
- return;
- }
-
- ret = clk_prepare_enable(vc4_hdmi->pixel_clock);
- if (ret) {
- DRM_ERROR("Failed to turn on pixel clock: %d\n", ret);
- return;
- }
-
/*
* As stated in RPi's vc4 firmware "HDMI state machine (HSM) clock must
* be faster than pixel clock, infinitesimally faster, tested in
@@ -939,10 +920,21 @@ static void vc4_hdmi_encoder_pre_crtc_configure(struct drm_encoder *encoder,
return;
}
- ret = clk_prepare_enable(vc4_hdmi->hsm_clock);
+ ret = pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev);
+ if (ret < 0) {
+ DRM_ERROR("Failed to retain power domain: %d\n", ret);
+ return;
+ }
+
+ ret = clk_set_rate(vc4_hdmi->pixel_clock, pixel_rate);
if (ret) {
- DRM_ERROR("Failed to turn on HSM clock: %d\n", ret);
- clk_disable_unprepare(vc4_hdmi->pixel_clock);
+ DRM_ERROR("Failed to set pixel clock rate: %d\n", ret);
+ return;
+ }
+
+ ret = clk_prepare_enable(vc4_hdmi->pixel_clock);
+ if (ret) {
+ DRM_ERROR("Failed to turn on pixel clock: %d\n", ret);
return;
}
@@ -958,7 +950,6 @@ static void vc4_hdmi_encoder_pre_crtc_configure(struct drm_encoder *encoder,
ret = clk_set_min_rate(vc4_hdmi->pixel_bvb_clock, bvb_rate);
if (ret) {
DRM_ERROR("Failed to set pixel bvb clock rate: %d\n", ret);
- clk_disable_unprepare(vc4_hdmi->hsm_clock);
clk_disable_unprepare(vc4_hdmi->pixel_clock);
return;
}
@@ -966,7 +957,6 @@ static void vc4_hdmi_encoder_pre_crtc_configure(struct drm_encoder *encoder,
ret = clk_prepare_enable(vc4_hdmi->pixel_bvb_clock);
if (ret) {
DRM_ERROR("Failed to turn on pixel bvb clock: %d\n", ret);
- clk_disable_unprepare(vc4_hdmi->hsm_clock);
clk_disable_unprepare(vc4_hdmi->pixel_clock);
return;
}
@@ -2100,6 +2090,27 @@ static int vc5_hdmi_init_resources(struct vc4_hdmi *vc4_hdmi)
return 0;
}
+static int __maybe_unused vc4_hdmi_runtime_suspend(struct device *dev)
+{
+ struct vc4_hdmi *vc4_hdmi = dev_get_drvdata(dev);
+
+ clk_disable_unprepare(vc4_hdmi->hsm_clock);
+
+ return 0;
+}
+
+static int vc4_hdmi_runtime_resume(struct device *dev)
+{
+ struct vc4_hdmi *vc4_hdmi = dev_get_drvdata(dev);
+ int ret;
+
+ ret = clk_prepare_enable(vc4_hdmi->hsm_clock);
+ if (ret)
+ return ret;
+
+ return 0;
+}
+
static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data)
{
const struct vc4_hdmi_variant *variant = of_device_get_match_data(dev);
@@ -2367,11 +2378,18 @@ static const struct of_device_id vc4_hdmi_dt_match[] = {
{}
};
+static const struct dev_pm_ops vc4_hdmi_pm_ops = {
+ SET_RUNTIME_PM_OPS(vc4_hdmi_runtime_suspend,
+ vc4_hdmi_runtime_resume,
+ NULL)
+};
+
struct platform_driver vc4_hdmi_driver = {
.probe = vc4_hdmi_dev_probe,
.remove = vc4_hdmi_dev_remove,
.driver = {
.name = "vc4_hdmi",
.of_match_table = vc4_hdmi_dt_match,
+ .pm = &vc4_hdmi_pm_ops,
},
};
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0098/1039] drm/vc4: hdmi: Make sure the controller is powered in detect
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0097/1039] drm/vc4: hdmi: Move the HSM clock enable to runtime_pm Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0099/1039] drm/vc4: hdmi: Make sure the controller is powered up during bind Greg Kroah-Hartman
` (894 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maxime Ripard, Dave Stevenson,
Nicolas Saenz Julienne, Michael Stapelberg, Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit 0f5251339eda7f7eb7bd4467607ae1d01b24e129 ]
If the HPD GPIO is not available and drm_probe_ddc fails, we end up
reading the HDMI_HOTPLUG register, but the controller might be powered
off resulting in a CPU hang. Make sure we have the power domain and the
HSM clock powered during the detect cycle to prevent the hang from
happening.
Fixes: 4f6e3d66ac52 ("drm/vc4: Add runtime PM support to the HDMI encoder driver")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Tested-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Tested-by: Michael Stapelberg <michael@stapelberg.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210922125419.4125779-6-maxime@cerno.tech
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_hdmi.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index 63b07087d37e8..f7e48bc6cb114 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -168,6 +168,8 @@ vc4_hdmi_connector_detect(struct drm_connector *connector, bool force)
struct vc4_hdmi *vc4_hdmi = connector_to_vc4_hdmi(connector);
bool connected = false;
+ WARN_ON(pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev));
+
if (vc4_hdmi->hpd_gpio &&
gpiod_get_value_cansleep(vc4_hdmi->hpd_gpio)) {
connected = true;
@@ -188,10 +190,12 @@ vc4_hdmi_connector_detect(struct drm_connector *connector, bool force)
}
}
+ pm_runtime_put(&vc4_hdmi->pdev->dev);
return connector_status_connected;
}
cec_phys_addr_invalidate(vc4_hdmi->cec_adap);
+ pm_runtime_put(&vc4_hdmi->pdev->dev);
return connector_status_disconnected;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0099/1039] drm/vc4: hdmi: Make sure the controller is powered up during bind
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0098/1039] drm/vc4: hdmi: Make sure the controller is powered in detect Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0100/1039] drm/vc4: hdmi: Rework the pre_crtc_configure error handling Greg Kroah-Hartman
` (893 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Stevenson, Maxime Ripard, Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit 9c6e4f6ed1d61d5f46946e5c151ceb279eedadb1 ]
In the bind hook, we actually need the device to have the HSM clock
running during the final part of the display initialisation where we
reset the controller and initialise the CEC component.
Failing to do so will result in a complete, silent, hang of the CPU.
Fixes: 411efa18e4b0 ("drm/vc4: hdmi: Move the HSM clock enable to runtime_pm")
Link: https://patchwork.freedesktop.org/patch/msgid/20210819135931.895976-3-maxime@cerno.tech
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_hdmi.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index f7e48bc6cb114..29ee9264b0870 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -2191,6 +2191,18 @@ static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data)
if (ret)
goto err_put_ddc;
+ /*
+ * We need to have the device powered up at this point to call
+ * our reset hook and for the CEC init.
+ */
+ ret = vc4_hdmi_runtime_resume(dev);
+ if (ret)
+ goto err_put_ddc;
+
+ pm_runtime_get_noresume(dev);
+ pm_runtime_set_active(dev);
+ pm_runtime_enable(dev);
+
if (vc4_hdmi->variant->reset)
vc4_hdmi->variant->reset(vc4_hdmi);
@@ -2202,8 +2214,6 @@ static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data)
clk_prepare_enable(vc4_hdmi->pixel_bvb_clock);
}
- pm_runtime_enable(dev);
-
drm_simple_encoder_init(drm, encoder, DRM_MODE_ENCODER_TMDS);
drm_encoder_helper_add(encoder, &vc4_hdmi_encoder_helper_funcs);
@@ -2227,6 +2237,8 @@ static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data)
vc4_hdmi_debugfs_regs,
vc4_hdmi);
+ pm_runtime_put_sync(dev);
+
return 0;
err_free_cec:
@@ -2237,6 +2249,7 @@ err_destroy_conn:
vc4_hdmi_connector_destroy(&vc4_hdmi->connector);
err_destroy_encoder:
drm_encoder_cleanup(encoder);
+ pm_runtime_put_sync(dev);
pm_runtime_disable(dev);
err_put_ddc:
put_device(&vc4_hdmi->ddc->dev);
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0100/1039] drm/vc4: hdmi: Rework the pre_crtc_configure error handling
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0099/1039] drm/vc4: hdmi: Make sure the controller is powered up during bind Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0101/1039] drm/vc4: crtc: Make sure the HDMI controller is powered when disabling Greg Kroah-Hartman
` (892 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Stevenson, Maxime Ripard, Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit caa51a4c11f1cadba9bcf61ed9e0105711952ce7 ]
Since our pre_crtc_configure hook returned void, we didn't implement a
goto-based error path handling, leading to errors like failing to put
back the device in pm_runtime in all the error paths, but also failing
to disable the pixel clock if clk_set_min_rate on the HSM clock fails.
Move to a goto-based implementation to have an easier consitency.
Fixes: 4f6e3d66ac52 ("drm/vc4: Add runtime PM support to the HDMI encoder driver")
Link: https://patchwork.freedesktop.org/patch/msgid/20210819135931.895976-4-maxime@cerno.tech
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_hdmi.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index 29ee9264b0870..05fd54fbb773e 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -933,15 +933,16 @@ static void vc4_hdmi_encoder_pre_crtc_configure(struct drm_encoder *encoder,
ret = clk_set_rate(vc4_hdmi->pixel_clock, pixel_rate);
if (ret) {
DRM_ERROR("Failed to set pixel clock rate: %d\n", ret);
- return;
+ goto err_put_runtime_pm;
}
ret = clk_prepare_enable(vc4_hdmi->pixel_clock);
if (ret) {
DRM_ERROR("Failed to turn on pixel clock: %d\n", ret);
- return;
+ goto err_put_runtime_pm;
}
+
vc4_hdmi_cec_update_clk_div(vc4_hdmi);
if (pixel_rate > 297000000)
@@ -954,15 +955,13 @@ static void vc4_hdmi_encoder_pre_crtc_configure(struct drm_encoder *encoder,
ret = clk_set_min_rate(vc4_hdmi->pixel_bvb_clock, bvb_rate);
if (ret) {
DRM_ERROR("Failed to set pixel bvb clock rate: %d\n", ret);
- clk_disable_unprepare(vc4_hdmi->pixel_clock);
- return;
+ goto err_disable_pixel_clock;
}
ret = clk_prepare_enable(vc4_hdmi->pixel_bvb_clock);
if (ret) {
DRM_ERROR("Failed to turn on pixel bvb clock: %d\n", ret);
- clk_disable_unprepare(vc4_hdmi->pixel_clock);
- return;
+ goto err_disable_pixel_clock;
}
if (vc4_hdmi->variant->phy_init)
@@ -975,6 +974,15 @@ static void vc4_hdmi_encoder_pre_crtc_configure(struct drm_encoder *encoder,
if (vc4_hdmi->variant->set_timings)
vc4_hdmi->variant->set_timings(vc4_hdmi, conn_state, mode);
+
+ return;
+
+err_disable_pixel_clock:
+ clk_disable_unprepare(vc4_hdmi->pixel_clock);
+err_put_runtime_pm:
+ pm_runtime_put(&vc4_hdmi->pdev->dev);
+
+ return;
}
static void vc4_hdmi_encoder_pre_crtc_enable(struct drm_encoder *encoder,
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0101/1039] drm/vc4: crtc: Make sure the HDMI controller is powered when disabling
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0100/1039] drm/vc4: hdmi: Rework the pre_crtc_configure error handling Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0102/1039] drm/bridge: sn65dsi83: Fix bridge removal Greg Kroah-Hartman
` (891 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maxime Ripard,
Nicolas Saenz Julienne, Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit bca10db67bdaf15997a5a2a276e7aa9b6eea1393 ]
Since commit 875a4d536842 ("drm/vc4: drv: Disable the CRTC at boot
time"), during the initial setup of the driver we call into the VC4 HDMI
controller hooks to make sure the controller is properly disabled.
However, we were never making sure that the device was properly powered
while doing so. This never resulted in any (reported) issue in practice,
but since the introduction of commit 4209f03fcb8e ("drm/vc4: hdmi: Warn
if we access the controller while disabled") we get a loud complaint
when we do that kind of access.
Let's make sure we have the HDMI controller properly powered while
disabling it.
Fixes: 875a4d536842 ("drm/vc4: drv: Disable the CRTC at boot time")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Reviewed-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Tested-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210923185013.826679-1-maxime@cerno.tech
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_crtc.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index 18f5009ce90e3..c0df11e5fcf2b 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -32,6 +32,7 @@
#include <linux/clk.h>
#include <linux/component.h>
#include <linux/of_device.h>
+#include <linux/pm_runtime.h>
#include <drm/drm_atomic.h>
#include <drm/drm_atomic_helper.h>
@@ -42,6 +43,7 @@
#include <drm/drm_vblank.h>
#include "vc4_drv.h"
+#include "vc4_hdmi.h"
#include "vc4_regs.h"
#define HVS_FIFO_LATENCY_PIX 6
@@ -496,8 +498,10 @@ int vc4_crtc_disable_at_boot(struct drm_crtc *crtc)
enum vc4_encoder_type encoder_type;
const struct vc4_pv_data *pv_data;
struct drm_encoder *encoder;
+ struct vc4_hdmi *vc4_hdmi;
unsigned encoder_sel;
int channel;
+ int ret;
if (!(of_device_is_compatible(vc4_crtc->pdev->dev.of_node,
"brcm,bcm2711-pixelvalve2") ||
@@ -525,7 +529,20 @@ int vc4_crtc_disable_at_boot(struct drm_crtc *crtc)
if (WARN_ON(!encoder))
return 0;
- return vc4_crtc_disable(crtc, encoder, NULL, channel);
+ vc4_hdmi = encoder_to_vc4_hdmi(encoder);
+ ret = pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev);
+ if (ret)
+ return ret;
+
+ ret = vc4_crtc_disable(crtc, encoder, NULL, channel);
+ if (ret)
+ return ret;
+
+ ret = pm_runtime_put(&vc4_hdmi->pdev->dev);
+ if (ret)
+ return ret;
+
+ return 0;
}
static void vc4_crtc_atomic_disable(struct drm_crtc *crtc,
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0102/1039] drm/bridge: sn65dsi83: Fix bridge removal
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0101/1039] drm/vc4: crtc: Make sure the HDMI controller is powered when disabling Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0103/1039] drm/virtio: fix potential integer overflow on shift of a int Greg Kroah-Hartman
` (890 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sam Ravnborg, Marek Vasut,
Maxime Ripard, Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit c05f1a4e2c4b8a217b448828c4e59fb47454dc75 ]
Commit 24417d5b0c00 ("drm/bridge: ti-sn65dsi83: Implement .detach
callback") moved the unregistration of the bridge DSI device and bridge
itself to the detach callback.
While this is correct for the DSI device detach and unregistration, the
bridge is added in the driver probe, and should thus be removed as part
of its remove callback.
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Reviewed-by: Marek Vasut <marex@denx.de>
Fixes: 24417d5b0c00 ("drm/bridge: ti-sn65dsi83: Implement .detach callback")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://patchwork.freedesktop.org/patch/msgid/20211025151536.1048186-14-maxime@cerno.tech
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/ti-sn65dsi83.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi83.c b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
index ba1160ec6d6e8..07917681782d2 100644
--- a/drivers/gpu/drm/bridge/ti-sn65dsi83.c
+++ b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
@@ -297,7 +297,6 @@ static void sn65dsi83_detach(struct drm_bridge *bridge)
mipi_dsi_detach(ctx->dsi);
mipi_dsi_device_unregister(ctx->dsi);
- drm_bridge_remove(&ctx->bridge);
ctx->dsi = NULL;
}
@@ -711,6 +710,7 @@ static int sn65dsi83_remove(struct i2c_client *client)
{
struct sn65dsi83 *ctx = i2c_get_clientdata(client);
+ drm_bridge_remove(&ctx->bridge);
of_node_put(ctx->host_node);
return 0;
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0103/1039] drm/virtio: fix potential integer overflow on shift of a int
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0102/1039] drm/bridge: sn65dsi83: Fix bridge removal Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0104/1039] drm/virtio: fix another " Greg Kroah-Hartman
` (889 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Colin Ian King, Gerd Hoffmann, Sasha Levin
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit 8f4502fa284478a5264afa8a5a95511276fa9b80 ]
The left shift of unsigned int 32 bit integer constant 1 is evaluated
using 32 bit arithmetic and then assigned to a signed 64 bit integer.
In the case where i is 32 or more this can lead to an overflow. Fix
this by shifting the value 1ULL instead.
Addresses-Coverity: ("Uninitentional integer overflow")
Fixes: 8d6b006e1f51 ("drm/virtio: implement context init: handle VIRTGPU_CONTEXT_PARAM_POLL_RINGS_MASK")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20210930101941.16546-1-colin.king@canonical.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/virtio/virtgpu_ioctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
index 3607646d32295..5e8103a197a96 100644
--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
@@ -819,7 +819,7 @@ static int virtio_gpu_context_init_ioctl(struct drm_device *dev,
if (vfpriv->ring_idx_mask) {
valid_ring_mask = 0;
for (i = 0; i < vfpriv->num_rings; i++)
- valid_ring_mask |= 1 << i;
+ valid_ring_mask |= 1ULL << i;
if (~valid_ring_mask & vfpriv->ring_idx_mask) {
ret = -EINVAL;
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0104/1039] drm/virtio: fix another potential integer overflow on shift of a int
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0103/1039] drm/virtio: fix potential integer overflow on shift of a int Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0105/1039] wcn36xx: ensure pairing of init_scan/finish_scan and start_scan/end_scan Greg Kroah-Hartman
` (888 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Colin Ian King, Gerd Hoffmann, Sasha Levin
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit 74c1bda2f3fa79a93e1c910008649b49b02dc09d ]
The left shift of unsigned int 32 bit integer constant 1 is evaluated
using 32 bit arithmetic and then assigned to a signed 64 bit integer.
In the case where value is 32 or more this can lead to an overflow
(value can be in range 0..MAX_CAPSET_ID (63). Fix this by shifting
the value 1ULL instead.
Addresses-Coverity: ("Uninitentional integer overflow")
Fixes: 4fb530e5caf7 ("drm/virtio: implement context init: support init ioctl")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20210930102748.16922-1-colin.king@canonical.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/virtio/virtgpu_ioctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
index 5e8103a197a96..c708bab555c6b 100644
--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
@@ -774,7 +774,7 @@ static int virtio_gpu_context_init_ioctl(struct drm_device *dev,
goto out_unlock;
}
- if ((vgdev->capset_id_mask & (1 << value)) == 0) {
+ if ((vgdev->capset_id_mask & (1ULL << value)) == 0) {
ret = -EINVAL;
goto out_unlock;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0105/1039] wcn36xx: ensure pairing of init_scan/finish_scan and start_scan/end_scan
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0104/1039] drm/virtio: fix another " Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0106/1039] wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND Greg Kroah-Hartman
` (887 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Benjamin Li, Bryan ODonoghue,
Kalle Valo, Sasha Levin
From: Benjamin Li <benl@squareup.com>
[ Upstream commit 8f1ba8b0ee2679f0b3d22d2a5c1bc70c436fd872 ]
An SMD capture from the downstream prima driver on WCN3680B shows the
following command sequence for connected scans:
- init_scan_req
- start_scan_req, channel 1
- end_scan_req, channel 1
- start_scan_req, channel 2
- ...
- end_scan_req, channel 3
- finish_scan_req
- init_scan_req
- start_scan_req, channel 4
- ...
- end_scan_req, channel 6
- finish_scan_req
- ...
- end_scan_req, channel 165
- finish_scan_req
Upstream currently never calls wcn36xx_smd_end_scan, and in some cases[1]
still sends finish_scan_req twice in a row or before init_scan_req. A
typical connected scan looks like this:
- init_scan_req
- start_scan_req, channel 1
- finish_scan_req
- init_scan_req
- start_scan_req, channel 2
- ...
- start_scan_req, channel 165
- finish_scan_req
- finish_scan_req
This patch cleans up scanning so that init/finish and start/end are always
paired together and correctly nested.
- init_scan_req
- start_scan_req, channel 1
- end_scan_req, channel 1
- finish_scan_req
- init_scan_req
- start_scan_req, channel 2
- end_scan_req, channel 2
- ...
- start_scan_req, channel 165
- end_scan_req, channel 165
- finish_scan_req
Note that upstream will not do batching of 3 active-probe scans before
returning to the operating channel, and this patch does not change that.
To match downstream in this aspect, adjust IEEE80211_PROBE_DELAY and/or
the 125ms max off-channel time in ieee80211_scan_state_decision.
[1]: commit d195d7aac09b ("wcn36xx: Ensure finish scan is not requested
before start scan") addressed one case of finish_scan_req being sent
without a preceding init_scan_req (the case of the operating channel
coinciding with the first scan channel); two other cases are:
1) if SW scan is started and aborted immediately, without scanning any
channels, we send a finish_scan_req without ever sending init_scan_req,
and
2) as SW scan logic always returns us to the operating channel before
calling wcn36xx_sw_scan_complete, finish_scan_req is always sent twice
at the end of a SW scan
Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Signed-off-by: Benjamin Li <benl@squareup.com>
Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211027170306.555535-4-benl@squareup.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/wcn36xx/main.c | 34 +++++++++++++++++-----
drivers/net/wireless/ath/wcn36xx/smd.c | 4 +++
drivers/net/wireless/ath/wcn36xx/wcn36xx.h | 1 +
3 files changed, 32 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index b04533bbc3a45..0747c27f3bd75 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -402,6 +402,7 @@ static void wcn36xx_change_opchannel(struct wcn36xx *wcn, int ch)
static int wcn36xx_config(struct ieee80211_hw *hw, u32 changed)
{
struct wcn36xx *wcn = hw->priv;
+ int ret;
wcn36xx_dbg(WCN36XX_DBG_MAC, "mac config changed 0x%08x\n", changed);
@@ -417,17 +418,31 @@ static int wcn36xx_config(struct ieee80211_hw *hw, u32 changed)
* want to receive/transmit regular data packets, then
* simply stop the scan session and exit PS mode.
*/
- wcn36xx_smd_finish_scan(wcn, HAL_SYS_MODE_SCAN,
- wcn->sw_scan_vif);
- wcn->sw_scan_channel = 0;
+ if (wcn->sw_scan_channel)
+ wcn36xx_smd_end_scan(wcn, wcn->sw_scan_channel);
+ if (wcn->sw_scan_init) {
+ wcn36xx_smd_finish_scan(wcn, HAL_SYS_MODE_SCAN,
+ wcn->sw_scan_vif);
+ }
} else if (wcn->sw_scan) {
/* A scan is ongoing, do not change the operating
* channel, but start a scan session on the channel.
*/
- wcn36xx_smd_init_scan(wcn, HAL_SYS_MODE_SCAN,
- wcn->sw_scan_vif);
+ if (wcn->sw_scan_channel)
+ wcn36xx_smd_end_scan(wcn, wcn->sw_scan_channel);
+ if (!wcn->sw_scan_init) {
+ /* This can fail if we are unable to notify the
+ * operating channel.
+ */
+ ret = wcn36xx_smd_init_scan(wcn,
+ HAL_SYS_MODE_SCAN,
+ wcn->sw_scan_vif);
+ if (ret) {
+ mutex_unlock(&wcn->conf_mutex);
+ return -EIO;
+ }
+ }
wcn36xx_smd_start_scan(wcn, ch);
- wcn->sw_scan_channel = ch;
} else {
wcn36xx_change_opchannel(wcn, ch);
}
@@ -722,7 +737,12 @@ static void wcn36xx_sw_scan_complete(struct ieee80211_hw *hw,
struct wcn36xx *wcn = hw->priv;
/* ensure that any scan session is finished */
- wcn36xx_smd_finish_scan(wcn, HAL_SYS_MODE_SCAN, wcn->sw_scan_vif);
+ if (wcn->sw_scan_channel)
+ wcn36xx_smd_end_scan(wcn, wcn->sw_scan_channel);
+ if (wcn->sw_scan_init) {
+ wcn36xx_smd_finish_scan(wcn, HAL_SYS_MODE_SCAN,
+ wcn->sw_scan_vif);
+ }
wcn->sw_scan = false;
wcn->sw_scan_opchannel = 0;
}
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index ed45e2cf039be..e44506e4f1d5f 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -722,6 +722,7 @@ int wcn36xx_smd_init_scan(struct wcn36xx *wcn, enum wcn36xx_hal_sys_mode mode,
wcn36xx_err("hal_init_scan response failed err=%d\n", ret);
goto out;
}
+ wcn->sw_scan_init = true;
out:
mutex_unlock(&wcn->hal_mutex);
return ret;
@@ -752,6 +753,7 @@ int wcn36xx_smd_start_scan(struct wcn36xx *wcn, u8 scan_channel)
wcn36xx_err("hal_start_scan response failed err=%d\n", ret);
goto out;
}
+ wcn->sw_scan_channel = scan_channel;
out:
mutex_unlock(&wcn->hal_mutex);
return ret;
@@ -782,6 +784,7 @@ int wcn36xx_smd_end_scan(struct wcn36xx *wcn, u8 scan_channel)
wcn36xx_err("hal_end_scan response failed err=%d\n", ret);
goto out;
}
+ wcn->sw_scan_channel = 0;
out:
mutex_unlock(&wcn->hal_mutex);
return ret;
@@ -823,6 +826,7 @@ int wcn36xx_smd_finish_scan(struct wcn36xx *wcn,
wcn36xx_err("hal_finish_scan response failed err=%d\n", ret);
goto out;
}
+ wcn->sw_scan_init = false;
out:
mutex_unlock(&wcn->hal_mutex);
return ret;
diff --git a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
index 1c8d918137da2..fbd0558c2c196 100644
--- a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
+++ b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
@@ -248,6 +248,7 @@ struct wcn36xx {
struct cfg80211_scan_request *scan_req;
bool sw_scan;
u8 sw_scan_opchannel;
+ bool sw_scan_init;
u8 sw_scan_channel;
struct ieee80211_vif *sw_scan_vif;
struct mutex scan_lock;
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0106/1039] wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0105/1039] wcn36xx: ensure pairing of init_scan/finish_scan and start_scan/end_scan Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0107/1039] libbpf: Fix section counting logic Greg Kroah-Hartman
` (886 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bryan ODonoghue, Kalle Valo, Sasha Levin
From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
[ Upstream commit 588b45c88ae130fe373a8c50edaf54735c3f4fe3 ]
Firmware can trigger a missed beacon indication, this is not the same as a
lost signal.
Flag to Linux the missed beacon and let the WiFi stack decide for itself if
the link is up or down by sending its own probe to determine this.
We should only be signalling the link is lost when the firmware indicates
Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211027232529.657764-1-bryan.odonoghue@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/wcn36xx/smd.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index e44506e4f1d5f..d3285a504429d 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -2736,7 +2736,7 @@ static int wcn36xx_smd_missed_beacon_ind(struct wcn36xx *wcn,
wcn36xx_dbg(WCN36XX_DBG_HAL, "beacon missed bss_index %d\n",
tmp->bss_index);
vif = wcn36xx_priv_to_vif(tmp);
- ieee80211_connection_loss(vif);
+ ieee80211_beacon_loss(vif);
}
return 0;
}
@@ -2751,7 +2751,7 @@ static int wcn36xx_smd_missed_beacon_ind(struct wcn36xx *wcn,
wcn36xx_dbg(WCN36XX_DBG_HAL, "beacon missed bss_index %d\n",
rsp->bss_index);
vif = wcn36xx_priv_to_vif(tmp);
- ieee80211_connection_loss(vif);
+ ieee80211_beacon_loss(vif);
return 0;
}
}
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0107/1039] libbpf: Fix section counting logic
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0106/1039] wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0108/1039] drm/vc4: hdmi: Enable the scrambler on reconnection Greg Kroah-Hartman
` (885 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrii Nakryiko, Alexei Starovoitov,
Yonghong Song, Sasha Levin
From: Andrii Nakryiko <andrii@kernel.org>
[ Upstream commit 0d6988e16a12ebd41d3e268992211b0ceba44ed7 ]
e_shnum does include section #0 and as such is exactly the number of ELF
sections that we need to allocate memory for to use section indices as
array indices. Fix the off-by-one error.
This is purely accounting fix, previously we were overallocating one
too many array items. But no correctness errors otherwise.
Fixes: 25bbbd7a444b ("libbpf: Remove assumptions about uniqueness of .rodata/.data/.bss maps")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20211103173213.1376990-5-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/libbpf.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 7c74342bb6680..5367bc8e52073 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -3191,11 +3191,11 @@ static int bpf_object__elf_collect(struct bpf_object *obj)
Elf_Scn *scn;
Elf64_Shdr *sh;
- /* ELF section indices are 1-based, so allocate +1 element to keep
- * indexing simple. Also include 0th invalid section into sec_cnt for
- * simpler and more traditional iteration logic.
+ /* ELF section indices are 0-based, but sec #0 is special "invalid"
+ * section. e_shnum does include sec #0, so e_shnum is the necessary
+ * size of an array to keep all the sections.
*/
- obj->efile.sec_cnt = 1 + obj->efile.ehdr->e_shnum;
+ obj->efile.sec_cnt = obj->efile.ehdr->e_shnum;
obj->efile.secs = calloc(obj->efile.sec_cnt, sizeof(*obj->efile.secs));
if (!obj->efile.secs)
return -ENOMEM;
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0108/1039] drm/vc4: hdmi: Enable the scrambler on reconnection
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0107/1039] libbpf: Fix section counting logic Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0109/1039] libbpf: Fix non-C89 loop variable declaration in gen_loader.c Greg Kroah-Hartman
` (884 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maxime Ripard, Dave Stevenson, Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit b7551457c5d0b3505b0be247d47919c1ee30506d ]
If we have a state already and disconnect/reconnect the display, the
SCDC messages won't be sent again since we didn't go through a disable /
enable cycle.
In order to fix this, let's call the vc4_hdmi_enable_scrambling function
in the detect callback if there is a mode and it needs the scrambler to
be enabled.
Fixes: c85695a2016e ("drm/vc4: hdmi: Enable the scrambler")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Link: https://lore.kernel.org/r/20211025152903.1088803-10-maxime@cerno.tech
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_hdmi.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index 05fd54fbb773e..c000946996edb 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -162,6 +162,8 @@ static void vc4_hdmi_cec_update_clk_div(struct vc4_hdmi *vc4_hdmi)
static void vc4_hdmi_cec_update_clk_div(struct vc4_hdmi *vc4_hdmi) {}
#endif
+static void vc4_hdmi_enable_scrambling(struct drm_encoder *encoder);
+
static enum drm_connector_status
vc4_hdmi_connector_detect(struct drm_connector *connector, bool force)
{
@@ -190,6 +192,7 @@ vc4_hdmi_connector_detect(struct drm_connector *connector, bool force)
}
}
+ vc4_hdmi_enable_scrambling(&vc4_hdmi->encoder.base.base);
pm_runtime_put(&vc4_hdmi->pdev->dev);
return connector_status_connected;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0109/1039] libbpf: Fix non-C89 loop variable declaration in gen_loader.c
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0108/1039] drm/vc4: hdmi: Enable the scrambler on reconnection Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0110/1039] libbpf: Free up resources used by inner map definition Greg Kroah-Hartman
` (883 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrii Nakryiko, Alexei Starovoitov,
Kumar Kartikeya Dwivedi, Sasha Levin
From: Andrii Nakryiko <andrii@kernel.org>
[ Upstream commit b8b5cb55f5d3f03cc1479a3768d68173a10359ad ]
Fix the `int i` declaration inside the for statement. This is non-C89
compliant. See [0] for user report breaking BCC build.
[0] https://github.com/libbpf/libbpf/issues/403
Fixes: 18f4fccbf314 ("libbpf: Update gen_loader to emit BTF_KIND_FUNC relocations")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/bpf/20211105191055.3324874-1-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/gen_loader.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/lib/bpf/gen_loader.c b/tools/lib/bpf/gen_loader.c
index 9934851ccde76..5aad39e92a7a5 100644
--- a/tools/lib/bpf/gen_loader.c
+++ b/tools/lib/bpf/gen_loader.c
@@ -597,8 +597,9 @@ void bpf_gen__record_extern(struct bpf_gen *gen, const char *name, bool is_weak,
static struct ksym_desc *get_ksym_desc(struct bpf_gen *gen, struct ksym_relo_desc *relo)
{
struct ksym_desc *kdesc;
+ int i;
- for (int i = 0; i < gen->nr_ksyms; i++) {
+ for (i = 0; i < gen->nr_ksyms; i++) {
if (!strcmp(gen->ksyms[i].name, relo->name)) {
gen->ksyms[i].ref++;
return &gen->ksyms[i];
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0110/1039] libbpf: Free up resources used by inner map definition
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0109/1039] libbpf: Fix non-C89 loop variable declaration in gen_loader.c Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0111/1039] wcn36xx: Fix DMA channel enable/disable cycle Greg Kroah-Hartman
` (882 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrii Nakryiko, Alexei Starovoitov,
Hengqi Chen, Sasha Levin
From: Andrii Nakryiko <andrii@kernel.org>
[ Upstream commit 8f7b239ea8cfdc8e64c875ee417fed41431a1f37 ]
It's not enough to just free(map->inner_map), as inner_map itself can
have extra memory allocated, like map name.
Fixes: 646f02ffdd49 ("libbpf: Add BTF-defined map-in-map support")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Hengqi Chen <hengqi.chen@gmail.com>
Link: https://lore.kernel.org/bpf/20211107165521.9240-3-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/libbpf.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 5367bc8e52073..509f3719409bb 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -9028,7 +9028,10 @@ int bpf_map__set_inner_map_fd(struct bpf_map *map, int fd)
pr_warn("error: inner_map_fd already specified\n");
return libbpf_err(-EINVAL);
}
- zfree(&map->inner_map);
+ if (map->inner_map) {
+ bpf_map__destroy(map->inner_map);
+ zfree(&map->inner_map);
+ }
map->inner_map_fd = fd;
return 0;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0111/1039] wcn36xx: Fix DMA channel enable/disable cycle
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0110/1039] libbpf: Free up resources used by inner map definition Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0112/1039] wcn36xx: Release DMA channel descriptor allocations Greg Kroah-Hartman
` (881 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bryan ODonoghue, Kalle Valo, Sasha Levin
From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
[ Upstream commit 89dcb1da611d9b3ff0728502d58372fdaae9ebff ]
Right now we have a broken sequence where we enable DMA channel interrupts
which can be left enabled and never disabled if we hit an error path.
Worse still when we unload the driver, the DMA channel interrupt bits are
left intact. About the only saving grace here is that we do remember to
disable the wcnss interrupt when unload the driver.
Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211105122152.1580542-2-bryan.odonoghue@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/wcn36xx/dxe.c | 38 ++++++++++++++++++--------
1 file changed, 27 insertions(+), 11 deletions(-)
diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c
index aff04ef662663..0c4f63f1312f8 100644
--- a/drivers/net/wireless/ath/wcn36xx/dxe.c
+++ b/drivers/net/wireless/ath/wcn36xx/dxe.c
@@ -272,6 +272,21 @@ static int wcn36xx_dxe_enable_ch_int(struct wcn36xx *wcn, u16 wcn_ch)
return 0;
}
+static void wcn36xx_dxe_disable_ch_int(struct wcn36xx *wcn, u16 wcn_ch)
+{
+ int reg_data = 0;
+
+ wcn36xx_dxe_read_register(wcn,
+ WCN36XX_DXE_INT_MASK_REG,
+ ®_data);
+
+ reg_data &= ~wcn_ch;
+
+ wcn36xx_dxe_write_register(wcn,
+ WCN36XX_DXE_INT_MASK_REG,
+ (int)reg_data);
+}
+
static int wcn36xx_dxe_fill_skb(struct device *dev,
struct wcn36xx_dxe_ctl *ctl,
gfp_t gfp)
@@ -869,7 +884,6 @@ int wcn36xx_dxe_init(struct wcn36xx *wcn)
WCN36XX_DXE_WQ_TX_L);
wcn36xx_dxe_read_register(wcn, WCN36XX_DXE_REG_CH_EN, ®_data);
- wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_TX_L);
/***************************************/
/* Init descriptors for TX HIGH channel */
@@ -893,9 +907,6 @@ int wcn36xx_dxe_init(struct wcn36xx *wcn)
wcn36xx_dxe_read_register(wcn, WCN36XX_DXE_REG_CH_EN, ®_data);
- /* Enable channel interrupts */
- wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_TX_H);
-
/***************************************/
/* Init descriptors for RX LOW channel */
/***************************************/
@@ -905,7 +916,6 @@ int wcn36xx_dxe_init(struct wcn36xx *wcn)
goto out_err_rxl_ch;
}
-
/* For RX we need to preallocated buffers */
wcn36xx_dxe_ch_alloc_skb(wcn, &wcn->dxe_rx_l_ch);
@@ -928,9 +938,6 @@ int wcn36xx_dxe_init(struct wcn36xx *wcn)
WCN36XX_DXE_REG_CTL_RX_L,
WCN36XX_DXE_CH_DEFAULT_CTL_RX_L);
- /* Enable channel interrupts */
- wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_L);
-
/***************************************/
/* Init descriptors for RX HIGH channel */
/***************************************/
@@ -962,15 +969,18 @@ int wcn36xx_dxe_init(struct wcn36xx *wcn)
WCN36XX_DXE_REG_CTL_RX_H,
WCN36XX_DXE_CH_DEFAULT_CTL_RX_H);
- /* Enable channel interrupts */
- wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_H);
-
ret = wcn36xx_dxe_request_irqs(wcn);
if (ret < 0)
goto out_err_irq;
timer_setup(&wcn->tx_ack_timer, wcn36xx_dxe_tx_timer, 0);
+ /* Enable channel interrupts */
+ wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_TX_L);
+ wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_TX_H);
+ wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_L);
+ wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_H);
+
return 0;
out_err_irq:
@@ -987,6 +997,12 @@ out_err_txh_ch:
void wcn36xx_dxe_deinit(struct wcn36xx *wcn)
{
+ /* Disable channel interrupts */
+ wcn36xx_dxe_disable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_H);
+ wcn36xx_dxe_disable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_L);
+ wcn36xx_dxe_disable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_TX_H);
+ wcn36xx_dxe_disable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_TX_L);
+
free_irq(wcn->tx_irq, wcn);
free_irq(wcn->rx_irq, wcn);
del_timer(&wcn->tx_ack_timer);
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0112/1039] wcn36xx: Release DMA channel descriptor allocations
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0111/1039] wcn36xx: Fix DMA channel enable/disable cycle Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0113/1039] wcn36xx: Put DXE block into reset before freeing memory Greg Kroah-Hartman
` (880 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bryan ODonoghue, Kalle Valo, Sasha Levin
From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
[ Upstream commit 3652096e5263ad67604b0323f71d133485f410e5 ]
When unloading the driver we are not releasing the DMA descriptors which we
previously allocated.
Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211105122152.1580542-3-bryan.odonoghue@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/wcn36xx/dxe.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c
index 0c4f63f1312f8..017c7d78072ba 100644
--- a/drivers/net/wireless/ath/wcn36xx/dxe.c
+++ b/drivers/net/wireless/ath/wcn36xx/dxe.c
@@ -1014,4 +1014,9 @@ void wcn36xx_dxe_deinit(struct wcn36xx *wcn)
wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_l_ch);
wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_h_ch);
+
+ wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_tx_l_ch);
+ wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_tx_h_ch);
+ wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_rx_l_ch);
+ wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_rx_h_ch);
}
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0113/1039] wcn36xx: Put DXE block into reset before freeing memory
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0112/1039] wcn36xx: Release DMA channel descriptor allocations Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0114/1039] wcn36xx: populate band before determining rate on RX Greg Kroah-Hartman
` (879 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bryan ODonoghue, Kalle Valo, Sasha Levin
From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
[ Upstream commit ed04ea76e69e7194f7489cebe23a32a68f39218d ]
When deiniting the DXE hardware we should reset the block to ensure there
is no spurious DMA write transaction from the downstream WCNSS to upstream
MSM at a skbuff address we will have released.
Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211105122152.1580542-4-bryan.odonoghue@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/wcn36xx/dxe.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c
index 017c7d78072ba..e1a35c2eadb6c 100644
--- a/drivers/net/wireless/ath/wcn36xx/dxe.c
+++ b/drivers/net/wireless/ath/wcn36xx/dxe.c
@@ -997,6 +997,8 @@ out_err_txh_ch:
void wcn36xx_dxe_deinit(struct wcn36xx *wcn)
{
+ int reg_data = 0;
+
/* Disable channel interrupts */
wcn36xx_dxe_disable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_H);
wcn36xx_dxe_disable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_L);
@@ -1012,6 +1014,10 @@ void wcn36xx_dxe_deinit(struct wcn36xx *wcn)
wcn->tx_ack_skb = NULL;
}
+ /* Put the DXE block into reset before freeing memory */
+ reg_data = WCN36XX_DXE_REG_RESET;
+ wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_REG_CSR_RESET, reg_data);
+
wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_l_ch);
wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_h_ch);
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0114/1039] wcn36xx: populate band before determining rate on RX
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0113/1039] wcn36xx: Put DXE block into reset before freeing memory Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0115/1039] wcn36xx: fix RX BD rate mapping for 5GHz legacy rates Greg Kroah-Hartman
` (878 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Benjamin Li, Loic Poulain,
Kalle Valo, Sasha Levin
From: Benjamin Li <benl@squareup.com>
[ Upstream commit c9c5608fafe4dae975c9644c7d14c51ad3b0ed73 ]
status.band is used in determination of status.rate -- for 5GHz on legacy
rates there is a linear shift between the BD descriptor's rate field and
the wcn36xx driver's rate table (wcn_5ghz_rates).
We have a special clause to populate status.band for hardware scan offload
frames. However, this block occurs after status.rate is already populated.
Correctly handle this dependency by moving the band block before the rate
block.
This patch addresses kernel warnings & missing scan results for 5GHz APs
that send their beacons/probe responses at the higher four legacy rates
(24-54 Mbps), when using hardware scan offload:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at net/mac80211/rx.c:4532 ieee80211_rx_napi+0x744/0x8d8
Modules linked in: wcn36xx [...]
CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 4.19.107-g73909fa #1
Hardware name: Square, Inc. T2 (all variants) (DT)
Call trace:
dump_backtrace+0x0/0x148
show_stack+0x14/0x1c
dump_stack+0xb8/0xf0
__warn+0x2ac/0x2d8
warn_slowpath_null+0x44/0x54
ieee80211_rx_napi+0x744/0x8d8
ieee80211_tasklet_handler+0xa4/0xe0
tasklet_action_common+0xe0/0x118
tasklet_action+0x20/0x28
__do_softirq+0x108/0x1ec
irq_exit+0xd4/0xd8
__handle_domain_irq+0x84/0xbc
gic_handle_irq+0x4c/0xb8
el1_irq+0xe8/0x190
lpm_cpuidle_enter+0x220/0x260
cpuidle_enter_state+0x114/0x1c0
cpuidle_enter+0x34/0x48
do_idle+0x150/0x268
cpu_startup_entry+0x20/0x24
rest_init+0xd4/0xe0
start_kernel+0x398/0x430
---[ end trace ae28cb759352b403 ]---
Fixes: 8a27ca394782 ("wcn36xx: Correct band/freq reporting on RX")
Signed-off-by: Benjamin Li <benl@squareup.com>
Tested-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211104010548.1107405-2-benl@squareup.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/wcn36xx/txrx.c | 37 +++++++++++++------------
1 file changed, 19 insertions(+), 18 deletions(-)
diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.c b/drivers/net/wireless/ath/wcn36xx/txrx.c
index 75951ccbc840e..f0a9f069a92a9 100644
--- a/drivers/net/wireless/ath/wcn36xx/txrx.c
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.c
@@ -314,8 +314,6 @@ int wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb)
fc = __le16_to_cpu(hdr->frame_control);
sn = IEEE80211_SEQ_TO_SN(__le16_to_cpu(hdr->seq_ctrl));
- status.freq = WCN36XX_CENTER_FREQ(wcn);
- status.band = WCN36XX_BAND(wcn);
status.mactime = 10;
status.signal = -get_rssi0(bd);
status.antenna = 1;
@@ -327,6 +325,25 @@ int wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb)
wcn36xx_dbg(WCN36XX_DBG_RX, "status.flags=%x\n", status.flag);
+ if (bd->scan_learn) {
+ /* If packet originate from hardware scanning, extract the
+ * band/channel from bd descriptor.
+ */
+ u8 hwch = (bd->reserved0 << 4) + bd->rx_ch;
+
+ if (bd->rf_band != 1 && hwch <= sizeof(ab_rx_ch_map) && hwch >= 1) {
+ status.band = NL80211_BAND_5GHZ;
+ status.freq = ieee80211_channel_to_frequency(ab_rx_ch_map[hwch - 1],
+ status.band);
+ } else {
+ status.band = NL80211_BAND_2GHZ;
+ status.freq = ieee80211_channel_to_frequency(hwch, status.band);
+ }
+ } else {
+ status.band = WCN36XX_BAND(wcn);
+ status.freq = WCN36XX_CENTER_FREQ(wcn);
+ }
+
if (bd->rate_id < ARRAY_SIZE(wcn36xx_rate_table)) {
rate = &wcn36xx_rate_table[bd->rate_id];
status.encoding = rate->encoding;
@@ -353,22 +370,6 @@ int wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb)
ieee80211_is_probe_resp(hdr->frame_control))
status.boottime_ns = ktime_get_boottime_ns();
- if (bd->scan_learn) {
- /* If packet originates from hardware scanning, extract the
- * band/channel from bd descriptor.
- */
- u8 hwch = (bd->reserved0 << 4) + bd->rx_ch;
-
- if (bd->rf_band != 1 && hwch <= sizeof(ab_rx_ch_map) && hwch >= 1) {
- status.band = NL80211_BAND_5GHZ;
- status.freq = ieee80211_channel_to_frequency(ab_rx_ch_map[hwch - 1],
- status.band);
- } else {
- status.band = NL80211_BAND_2GHZ;
- status.freq = ieee80211_channel_to_frequency(hwch, status.band);
- }
- }
-
memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
if (ieee80211_is_beacon(hdr->frame_control)) {
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0115/1039] wcn36xx: fix RX BD rate mapping for 5GHz legacy rates
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0114/1039] wcn36xx: populate band before determining rate on RX Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0116/1039] ath11k: Send PPDU_STATS_CFG with proper pdev mask to firmware Greg Kroah-Hartman
` (877 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Benjamin Li, Loic Poulain,
Kalle Valo, Sasha Levin
From: Benjamin Li <benl@squareup.com>
[ Upstream commit cfdf6b19e750f7de8ae71a26932f63b52e3bf74c ]
The linear mapping between the BD rate field and the driver's 5GHz
legacy rates table (wcn_5ghz_rates) does not only apply for the latter
four rates -- it applies to all eight rates.
Fixes: 6ea131acea98 ("wcn36xx: Fix warning due to bad rate_idx")
Signed-off-by: Benjamin Li <benl@squareup.com>
Tested-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211104010548.1107405-3-benl@squareup.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/wcn36xx/txrx.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.c b/drivers/net/wireless/ath/wcn36xx/txrx.c
index f0a9f069a92a9..dd58dde8c8363 100644
--- a/drivers/net/wireless/ath/wcn36xx/txrx.c
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.c
@@ -272,7 +272,6 @@ int wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb)
const struct wcn36xx_rate *rate;
struct ieee80211_hdr *hdr;
struct wcn36xx_rx_bd *bd;
- struct ieee80211_supported_band *sband;
u16 fc, sn;
/*
@@ -350,12 +349,11 @@ int wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb)
status.enc_flags = rate->encoding_flags;
status.bw = rate->bw;
status.rate_idx = rate->mcs_or_legacy_index;
- sband = wcn->hw->wiphy->bands[status.band];
status.nss = 1;
if (status.band == NL80211_BAND_5GHZ &&
status.encoding == RX_ENC_LEGACY &&
- status.rate_idx >= sband->n_bitrates) {
+ status.rate_idx >= 4) {
/* no dsss rates in 5Ghz rates table */
status.rate_idx -= 4;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0116/1039] ath11k: Send PPDU_STATS_CFG with proper pdev mask to firmware
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0115/1039] wcn36xx: fix RX BD rate mapping for 5GHz legacy rates Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0117/1039] bpftool: Fix memory leak in prog_dump() Greg Kroah-Hartman
` (876 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sathishkumar Muruganandam,
Rameshkumar Sundaram, Jouni Malinen, Kalle Valo, Sasha Levin
From: Rameshkumar Sundaram <ramess@codeaurora.org>
[ Upstream commit 16a2c3d5406f95ef6139de52669c60a39443f5f7 ]
HTT_PPDU_STATS_CFG_PDEV_ID bit mask for target FW PPDU stats request message
was set as bit 8 to 15. Bit 8 is reserved for soc stats and pdev id starts from
bit 9. Hence change the bitmask as bit 9 to 15 and fill the proper pdev id in
the request message.
In commit 701e48a43e15 ("ath11k: add packet log support for QCA6390"), both
HTT_PPDU_STATS_CFG_PDEV_ID and pdev_mask were changed, but this pdev_mask
calculation is not valid for platforms which has multiple pdevs with 1 rxdma
per pdev, as this is writing same value(i.e. 2) for all pdevs. Hence fixed it
to consider pdev_idx as well, to make it compatible for both single and multi
pd cases.
Tested on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01092-QCAHKSWPL_SILICONZ-1
Tested on: IPQ6018 hw1.0 WLAN.HK.2.5.0.1-01067-QCAHKSWPL_SILICONZ-1
Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390")
Co-developed-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210721212029.142388-10-jouni@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/dp.h | 3 ++-
drivers/net/wireless/ath/ath11k/dp_tx.c | 2 +-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/dp.h b/drivers/net/wireless/ath/ath11k/dp.h
index 4794ca04f2136..f524d19aca349 100644
--- a/drivers/net/wireless/ath/ath11k/dp.h
+++ b/drivers/net/wireless/ath/ath11k/dp.h
@@ -517,7 +517,8 @@ struct htt_ppdu_stats_cfg_cmd {
} __packed;
#define HTT_PPDU_STATS_CFG_MSG_TYPE GENMASK(7, 0)
-#define HTT_PPDU_STATS_CFG_PDEV_ID GENMASK(15, 8)
+#define HTT_PPDU_STATS_CFG_SOC_STATS BIT(8)
+#define HTT_PPDU_STATS_CFG_PDEV_ID GENMASK(15, 9)
#define HTT_PPDU_STATS_CFG_TLV_TYPE_BITMASK GENMASK(31, 16)
enum htt_ppdu_stats_tag_type {
diff --git a/drivers/net/wireless/ath/ath11k/dp_tx.c b/drivers/net/wireless/ath/ath11k/dp_tx.c
index 879fb2a9dc0c6..10b76f6f710b0 100644
--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
+++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
@@ -903,7 +903,7 @@ int ath11k_dp_tx_htt_h2t_ppdu_stats_req(struct ath11k *ar, u32 mask)
cmd->msg = FIELD_PREP(HTT_PPDU_STATS_CFG_MSG_TYPE,
HTT_H2T_MSG_TYPE_PPDU_STATS_CFG);
- pdev_mask = 1 << (i + 1);
+ pdev_mask = 1 << (ar->pdev_idx + i);
cmd->msg |= FIELD_PREP(HTT_PPDU_STATS_CFG_PDEV_ID, pdev_mask);
cmd->msg |= FIELD_PREP(HTT_PPDU_STATS_CFG_TLV_TYPE_BITMASK, mask);
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0117/1039] bpftool: Fix memory leak in prog_dump()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0116/1039] ath11k: Send PPDU_STATS_CFG with proper pdev mask to firmware Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0118/1039] mtd: hyperbus: rpc-if: Check return value of rpcif_sw_init() Greg Kroah-Hartman
` (875 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Quentin Monnet, Andrii Nakryiko, Sasha Levin
From: Quentin Monnet <quentin@isovalent.com>
[ Upstream commit ebbd7f64a3fbe9e0f235e39fc244ee9735e2a52a ]
Following the extraction of prog_dump() from do_dump(), the struct btf
allocated in prog_dump() is no longer freed on error; the struct
bpf_prog_linfo is not freed at all. Make sure we release them before
exiting the function.
Fixes: ec2025095cf6 ("bpftool: Match several programs with same tag")
Signed-off-by: Quentin Monnet <quentin@isovalent.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20211110114632.24537-2-quentin@isovalent.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/bpf/bpftool/prog.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index 515d229526026..6ccd17b8eb560 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -639,8 +639,8 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode,
char func_sig[1024];
unsigned char *buf;
__u32 member_len;
+ int fd, err = -1;
ssize_t n;
- int fd;
if (mode == DUMP_JITED) {
if (info->jited_prog_len == 0 || !info->jited_prog_insns) {
@@ -679,7 +679,7 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode,
if (fd < 0) {
p_err("can't open file %s: %s", filepath,
strerror(errno));
- return -1;
+ goto exit_free;
}
n = write(fd, buf, member_len);
@@ -687,7 +687,7 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode,
if (n != (ssize_t)member_len) {
p_err("error writing output file: %s",
n < 0 ? strerror(errno) : "short write");
- return -1;
+ goto exit_free;
}
if (json_output)
@@ -701,7 +701,7 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode,
info->netns_ino,
&disasm_opt);
if (!name)
- return -1;
+ goto exit_free;
}
if (info->nr_jited_func_lens && info->jited_func_lens) {
@@ -796,9 +796,12 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode,
kernel_syms_destroy(&dd);
}
- btf__free(btf);
+ err = 0;
- return 0;
+exit_free:
+ btf__free(btf);
+ bpf_prog_linfo__free(prog_linfo);
+ return err;
}
static int do_dump(int argc, char **argv)
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0118/1039] mtd: hyperbus: rpc-if: Check return value of rpcif_sw_init()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0117/1039] bpftool: Fix memory leak in prog_dump() Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0119/1039] media: videobuf2: Fix the size printk format Greg Kroah-Hartman
` (874 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lad Prabhakar, Vignesh Raghavendra,
Biju Das, Wolfram Sang, Geert Uytterhoeven, Sasha Levin
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
[ Upstream commit 981387ed06b96908223a607f5fba6efa42728fc2 ]
rpcif_sw_init() can fail so make sure we check the return value
of it and on error exit rpcif_hb_probe() callback with error code.
Fixes: 5de15b610f78 ("mtd: hyperbus: add Renesas RPC-IF driver")
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/20211025205631.21151-5-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/hyperbus/rpc-if.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/mtd/hyperbus/rpc-if.c b/drivers/mtd/hyperbus/rpc-if.c
index ecb050ba95cdf..367b0d72bf622 100644
--- a/drivers/mtd/hyperbus/rpc-if.c
+++ b/drivers/mtd/hyperbus/rpc-if.c
@@ -124,7 +124,9 @@ static int rpcif_hb_probe(struct platform_device *pdev)
if (!hyperbus)
return -ENOMEM;
- rpcif_sw_init(&hyperbus->rpc, pdev->dev.parent);
+ error = rpcif_sw_init(&hyperbus->rpc, pdev->dev.parent);
+ if (error)
+ return error;
platform_set_drvdata(pdev, hyperbus);
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0119/1039] media: videobuf2: Fix the size printk format
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0118/1039] mtd: hyperbus: rpc-if: Check return value of rpcif_sw_init() Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0120/1039] media: ipu3-cio2: fix error code in cio2_bridge_connect_sensor() Greg Kroah-Hartman
` (873 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dillon Min, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Dillon Min <dillon.minfei@gmail.com>
[ Upstream commit c9ee220d76775e42f35d634479c978d9350077d3 ]
Since the type of parameter size is unsigned long,
it should printk by %lu, instead of %ld, fix it.
Fixes: 7952be9b6ece ("media: drivers/media/common/videobuf2: rename from videobuf")
Signed-off-by: Dillon Min <dillon.minfei@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/common/videobuf2/videobuf2-dma-contig.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/media/common/videobuf2/videobuf2-dma-contig.c b/drivers/media/common/videobuf2/videobuf2-dma-contig.c
index 556e42ba66e55..7c4096e621738 100644
--- a/drivers/media/common/videobuf2/videobuf2-dma-contig.c
+++ b/drivers/media/common/videobuf2/videobuf2-dma-contig.c
@@ -257,7 +257,7 @@ static void *vb2_dc_alloc(struct vb2_buffer *vb,
ret = vb2_dc_alloc_coherent(buf);
if (ret) {
- dev_err(dev, "dma alloc of size %ld failed\n", size);
+ dev_err(dev, "dma alloc of size %lu failed\n", size);
kfree(buf);
return ERR_PTR(-ENOMEM);
}
@@ -298,9 +298,9 @@ static int vb2_dc_mmap(void *buf_priv, struct vm_area_struct *vma)
vma->vm_ops->open(vma);
- pr_debug("%s: mapped dma addr 0x%08lx at 0x%08lx, size %ld\n",
- __func__, (unsigned long)buf->dma_addr, vma->vm_start,
- buf->size);
+ pr_debug("%s: mapped dma addr 0x%08lx at 0x%08lx, size %lu\n",
+ __func__, (unsigned long)buf->dma_addr, vma->vm_start,
+ buf->size);
return 0;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0120/1039] media: ipu3-cio2: fix error code in cio2_bridge_connect_sensor()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0119/1039] media: videobuf2: Fix the size printk format Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0121/1039] media: atomisp: add missing media_device_cleanup() in atomisp_unregister_entities() Greg Kroah-Hartman
` (872 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Daniel Scally,
Kieran Bingham, Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 85db29d22cc521d9d06de2f5c7832981a55df157 ]
Return -ENODEV if acpi_get_physical_device_location() fails. Don't
return success.
Fixes: 485aa3df0dff ("media: ipu3-cio2: Parse sensor orientation and rotation")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Daniel Scally <djrscally@gmail.com>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/intel/ipu3/cio2-bridge.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/pci/intel/ipu3/cio2-bridge.c b/drivers/media/pci/intel/ipu3/cio2-bridge.c
index 67c467d3c81f9..0b586b4e537ef 100644
--- a/drivers/media/pci/intel/ipu3/cio2-bridge.c
+++ b/drivers/media/pci/intel/ipu3/cio2-bridge.c
@@ -238,8 +238,10 @@ static int cio2_bridge_connect_sensor(const struct cio2_sensor_config *cfg,
goto err_put_adev;
status = acpi_get_physical_device_location(adev->handle, &sensor->pld);
- if (ACPI_FAILURE(status))
+ if (ACPI_FAILURE(status)) {
+ ret = -ENODEV;
goto err_put_adev;
+ }
if (sensor->ssdb.lanes > CIO2_MAX_LANES) {
dev_err(&adev->dev,
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0121/1039] media: atomisp: add missing media_device_cleanup() in atomisp_unregister_entities()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0120/1039] media: ipu3-cio2: fix error code in cio2_bridge_connect_sensor() Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0122/1039] media: atomisp: fix punit_ddr_dvfs_enable() argument for mrfld_power up case Greg Kroah-Hartman
` (871 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Mauro Carvalho Chehab,
Sasha Levin
From: Tsuchiya Yuto <kitakar@gmail.com>
[ Upstream commit ce3015b7212e96db426d0c36f80fd159c91155d1 ]
After the commit 9832e155f1ed ("[media] media-device: split media
initialization and registration"), calling media_device_cleanup()
is needed it seems. However, currently it is missing for the module
unload path.
Note that for the probe failure path, it is already added in
atomisp_register_entities().
This patch adds the missing call of media_device_cleanup() in
atomisp_unregister_entities().
Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2")
Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/atomisp/pci/atomisp_v4l2.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_v4l2.c b/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
index 1e324f1f656e5..0511c454e769d 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
@@ -1182,6 +1182,7 @@ static void atomisp_unregister_entities(struct atomisp_device *isp)
v4l2_device_unregister(&isp->v4l2_dev);
media_device_unregister(&isp->media_dev);
+ media_device_cleanup(&isp->media_dev);
}
static int atomisp_register_entities(struct atomisp_device *isp)
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0122/1039] media: atomisp: fix punit_ddr_dvfs_enable() argument for mrfld_power up case
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0121/1039] media: atomisp: add missing media_device_cleanup() in atomisp_unregister_entities() Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0123/1039] media: atomisp: fix inverted logic in buffers_needed() Greg Kroah-Hartman
` (870 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Mauro Carvalho Chehab,
Sasha Levin
From: Tsuchiya Yuto <kitakar@gmail.com>
[ Upstream commit 5bfbf65fcca7325e4d89d289b3c286e11220e386 ]
When comparing with intel-aero atomisp [1], it looks like
punit_ddr_dvfs_enable() should take `false` as an argument on mrfld_power
up case.
Code from the intel-aero kernel [1]:
int atomisp_mrfld_power_down(struct atomisp_device *isp)
{
[...]
/*WA:Enable DVFS*/
if (IS_CHT)
punit_ddr_dvfs_enable(true);
int atomisp_mrfld_power_up(struct atomisp_device *isp)
{
[...]
/*WA for PUNIT, if DVFS enabled, ISP timeout observed*/
if (IS_CHT)
punit_ddr_dvfs_enable(false);
This patch fixes the inverted argument as per the intel-aero code, as
well as its comment. While here, fix space issues for comments in
atomisp_mrfld_power().
Note that it does not seem to be possible to unify the up/down cases for
punit_ddr_dvfs_enable(), i.e., we can't do something like the following:
if (IS_CHT)
punit_ddr_dvfs_enable(!enable);
because according to the intel-aero code [1], the DVFS is disabled
before "writing 0x0 to ISPSSPM0 bit[1:0]" and the DVFS is enabled after
"writing 0x3 to ISPSSPM0 bit[1:0]".
[1] https://github.com/intel-aero/linux-kernel/blob/a1b673258feb915268377275130c5c5df0eafc82/drivers/media/pci/atomisp/atomisp_driver/atomisp_v4l2.c#L431-L514
Fixes: 0f441fd70b1e ("media: atomisp: simplify the power down/up code")
Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/atomisp/pci/atomisp_v4l2.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_v4l2.c b/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
index 0511c454e769d..7982cc143374a 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
@@ -711,15 +711,15 @@ static int atomisp_mrfld_power(struct atomisp_device *isp, bool enable)
dev_dbg(isp->dev, "IUNIT power-%s.\n", enable ? "on" : "off");
- /*WA:Enable DVFS*/
+ /* WA for P-Unit, if DVFS enabled, ISP timeout observed */
if (IS_CHT && enable)
- punit_ddr_dvfs_enable(true);
+ punit_ddr_dvfs_enable(false);
/*
* FIXME:WA for ECS28A, with this sleep, CTS
* android.hardware.camera2.cts.CameraDeviceTest#testCameraDeviceAbort
* PASS, no impact on other platforms
- */
+ */
if (IS_BYT && enable)
msleep(10);
@@ -727,7 +727,7 @@ static int atomisp_mrfld_power(struct atomisp_device *isp, bool enable)
iosf_mbi_modify(BT_MBI_UNIT_PMC, MBI_REG_READ, MRFLD_ISPSSPM0,
val, MRFLD_ISPSSPM0_ISPSSC_MASK);
- /*WA:Enable DVFS*/
+ /* WA:Enable DVFS */
if (IS_CHT && !enable)
punit_ddr_dvfs_enable(true);
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0123/1039] media: atomisp: fix inverted logic in buffers_needed()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0122/1039] media: atomisp: fix punit_ddr_dvfs_enable() argument for mrfld_power up case Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0124/1039] media: atomisp: do not use err var when checking port validity for ISP2400 Greg Kroah-Hartman
` (869 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Mauro Carvalho Chehab,
Sasha Levin
From: Tsuchiya Yuto <kitakar@gmail.com>
[ Upstream commit e1921cd14640f0f4d1fad5eb8e448c58a536415d ]
When config.mode is IA_CSS_INPUT_MODE_BUFFERED_SENSOR, it rather needs
buffers. Fix it by inverting the return value.
Fixes: 3c0538fbad9f ("media: atomisp: get rid of most checks for ISP2401 version")
Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/atomisp/pci/sh_css_mipi.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/sh_css_mipi.c b/drivers/staging/media/atomisp/pci/sh_css_mipi.c
index 75489f7d75eec..483d40a467c74 100644
--- a/drivers/staging/media/atomisp/pci/sh_css_mipi.c
+++ b/drivers/staging/media/atomisp/pci/sh_css_mipi.c
@@ -374,17 +374,17 @@ static bool buffers_needed(struct ia_css_pipe *pipe)
{
if (!IS_ISP2401) {
if (pipe->stream->config.mode == IA_CSS_INPUT_MODE_BUFFERED_SENSOR)
- return false;
- else
return true;
+ else
+ return false;
}
if (pipe->stream->config.mode == IA_CSS_INPUT_MODE_BUFFERED_SENSOR ||
pipe->stream->config.mode == IA_CSS_INPUT_MODE_TPG ||
pipe->stream->config.mode == IA_CSS_INPUT_MODE_PRBS)
- return false;
+ return true;
- return true;
+ return false;
}
int
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0124/1039] media: atomisp: do not use err var when checking port validity for ISP2400
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0123/1039] media: atomisp: fix inverted logic in buffers_needed() Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0125/1039] media: atomisp: fix inverted error check for ia_css_mipi_is_source_port_valid() Greg Kroah-Hartman
` (868 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Mauro Carvalho Chehab,
Sasha Levin
From: Tsuchiya Yuto <kitakar@gmail.com>
[ Upstream commit 9f6b4fa2d2dfbff4b8a57eeb39b1128a6094ee20 ]
Currently, the `port >= N_CSI_PORTS || err` checks for ISP2400 are always
evaluated as true because the err variable is set to `-EINVAL` on
declaration but the variable is never used until the evaluation.
Looking at the diff of commit 3c0538fbad9f ("media: atomisp: get rid of
most checks for ISP2401 version"), the `port >= N_CSI_PORTS` check is
for ISP2400 and the err variable check is for ISP2401. Fix this issue
by adding ISP version test there accordingly.
Fixes: 3c0538fbad9f ("media: atomisp: get rid of most checks for ISP2401 version")
Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/atomisp/pci/sh_css_mipi.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/sh_css_mipi.c b/drivers/staging/media/atomisp/pci/sh_css_mipi.c
index 483d40a467c74..65fc93c5d56bc 100644
--- a/drivers/staging/media/atomisp/pci/sh_css_mipi.c
+++ b/drivers/staging/media/atomisp/pci/sh_css_mipi.c
@@ -430,7 +430,8 @@ allocate_mipi_frames(struct ia_css_pipe *pipe,
assert(port < N_CSI_PORTS);
- if (port >= N_CSI_PORTS || err) {
+ if ((!IS_ISP2401 && port >= N_CSI_PORTS) ||
+ (IS_ISP2401 && err)) {
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE_PRIVATE,
"allocate_mipi_frames(%p) exit: error: port is not correct (port=%d).\n",
pipe, port);
@@ -559,7 +560,8 @@ free_mipi_frames(struct ia_css_pipe *pipe)
assert(port < N_CSI_PORTS);
- if (port >= N_CSI_PORTS || err) {
+ if ((!IS_ISP2401 && port >= N_CSI_PORTS) ||
+ (IS_ISP2401 && err)) {
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE_PRIVATE,
"free_mipi_frames(%p, %d) exit: error: pipe port is not correct.\n",
pipe, port);
@@ -670,7 +672,8 @@ send_mipi_frames(struct ia_css_pipe *pipe)
assert(port < N_CSI_PORTS);
- if (port >= N_CSI_PORTS || err) {
+ if ((!IS_ISP2401 && port >= N_CSI_PORTS) ||
+ (IS_ISP2401 && err)) {
IA_CSS_ERROR("send_mipi_frames(%p) exit: invalid port specified (port=%d).\n",
pipe, port);
return err;
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0125/1039] media: atomisp: fix inverted error check for ia_css_mipi_is_source_port_valid()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0124/1039] media: atomisp: do not use err var when checking port validity for ISP2400 Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0126/1039] media: atomisp: fix ifdefs in sh_css.c Greg Kroah-Hartman
` (867 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Mauro Carvalho Chehab,
Sasha Levin
From: Tsuchiya Yuto <kitakar@gmail.com>
[ Upstream commit d21ce8c2f7bf6d737b60c09f86db141b9e8e47f0 ]
The function ia_css_mipi_is_source_port_valid() returns true if the port
is valid. So, we can't use the existing err variable as is.
To fix this issue while reusing that variable, invert the return value
when assigning it to the variable.
Fixes: 3c0538fbad9f ("media: atomisp: get rid of most checks for ISP2401 version")
Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../staging/media/atomisp/pci/sh_css_mipi.c | 24 ++++++++++++-------
1 file changed, 15 insertions(+), 9 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/sh_css_mipi.c b/drivers/staging/media/atomisp/pci/sh_css_mipi.c
index 65fc93c5d56bc..c1f2f6151c5f8 100644
--- a/drivers/staging/media/atomisp/pci/sh_css_mipi.c
+++ b/drivers/staging/media/atomisp/pci/sh_css_mipi.c
@@ -423,10 +423,12 @@ allocate_mipi_frames(struct ia_css_pipe *pipe,
return 0; /* AM TODO: Check */
}
- if (!IS_ISP2401)
+ if (!IS_ISP2401) {
port = (unsigned int)pipe->stream->config.source.port.port;
- else
- err = ia_css_mipi_is_source_port_valid(pipe, &port);
+ } else {
+ /* Returns true if port is valid. So, invert it */
+ err = !ia_css_mipi_is_source_port_valid(pipe, &port);
+ }
assert(port < N_CSI_PORTS);
@@ -553,10 +555,12 @@ free_mipi_frames(struct ia_css_pipe *pipe)
return err;
}
- if (!IS_ISP2401)
+ if (!IS_ISP2401) {
port = (unsigned int)pipe->stream->config.source.port.port;
- else
- err = ia_css_mipi_is_source_port_valid(pipe, &port);
+ } else {
+ /* Returns true if port is valid. So, invert it */
+ err = !ia_css_mipi_is_source_port_valid(pipe, &port);
+ }
assert(port < N_CSI_PORTS);
@@ -665,10 +669,12 @@ send_mipi_frames(struct ia_css_pipe *pipe)
/* TODO: AM: maybe this should be returning an error. */
}
- if (!IS_ISP2401)
+ if (!IS_ISP2401) {
port = (unsigned int)pipe->stream->config.source.port.port;
- else
- err = ia_css_mipi_is_source_port_valid(pipe, &port);
+ } else {
+ /* Returns true if port is valid. So, invert it */
+ err = !ia_css_mipi_is_source_port_valid(pipe, &port);
+ }
assert(port < N_CSI_PORTS);
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0126/1039] media: atomisp: fix ifdefs in sh_css.c
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0125/1039] media: atomisp: fix inverted error check for ia_css_mipi_is_source_port_valid() Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0127/1039] media: atomisp: add NULL check for asd obtained from atomisp_video_pipe Greg Kroah-Hartman
` (866 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Mauro Carvalho Chehab,
Sasha Levin
From: Tsuchiya Yuto <kitakar@gmail.com>
[ Upstream commit 5a1b2725558f8a3b4cbf0504f53cffae8e163034 ]
## `if (pipe->stream->config.mode == IA_CSS_INPUT_MODE_TPG) {` case
The intel-aero atomisp has `#if defined(IS_ISP_2400_SYSTEM)` [1]. It is
to be defined in the following two places [2]:
- css/hive_isp_css_common/system_global.h
- css/css_2401_csi2p_system/system_global.h
and the former file is to be included on ISP2400 devices, too. So, it
is to be defined for both ISP2400 and ISP2401 devices.
Because the upstreamed atomisp driver now supports only ISP2400 and
ISP2401, just remove the ISP version test again. This matches the other
upstream commits like 3c0538fbad9f ("media: atomisp: get rid of most
checks for ISP2401 version").
While here, moved the comment for define GP_ISEL_TPG_MODE to the
appropriate place.
[1] https://github.com/intel-aero/linux-kernel/blob/a1b673258feb915268377275130c5c5df0eafc82/drivers/media/pci/atomisp/css/sh_css.c#L552-L558
[2] https://github.com/intel-aero/linux-kernel/search?q=IS_ISP_2400_SYSTEM
## `isys_stream_descr->polling_mode` case
This does not exist on the intel-aero atomisp. This is because it is
based on css version irci_stable_candrpv_0415_20150521_0458.
On the other hand, the upstreamed atomisp is based on the following css
version depending on the ISP version using ifdefs:
- ISP2400: irci_stable_candrpv_0415_20150521_0458
- ISP2401: irci_master_20150911_0724
The `isys_stream_descr->polling_mode` usage was added on updating css
version to irci_master_20150701_0213 [3].
So, it is not a ISP version specific thing, but css version specific
thing. Because the upstreamed atomisp driver uses irci_master_20150911_0724
for ISP2401, re-add the ISP version check for now.
I say "for now" because ISP2401 should eventually use the same css
version with ISP2400 (i.e., irci_stable_candrpv_0415_20150521_0458)
[3] https://raw.githubusercontent.com/intel/ProductionKernelQuilts/cht-m1stable-2016_ww31/uefi/cht-m1stable/patches/cam-0439-atomisp2-css2401-and-2401_legacy-irci_master_2015070.patch
("atomisp2: css2401 and 2401_legacy-irci_master_20150701_0213")
Link to Intel's Android kernel patch.
## `coord = &me->config.internal_frame_origin_bqs_on_sctbl;` case
it was added on commit 4f744a573db3 ("media: atomisp: make
sh_css_sp_init_pipeline() ISP version independent") for ISP2401. Because
the upstreamed atomisp for the ISP2401 part is based on
irci_master_20150911_0724, hence the difference.
Because the upstreamed atomisp driver uses irci_master_20150911_0724
for ISP2401, revert the test back to `if (IS_ISP2401)`.
Fixes: 27333dadef57 ("media: atomisp: adjust some code at sh_css that could be broken")
Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/atomisp/pci/sh_css.c | 27 +++++++++-------------
1 file changed, 11 insertions(+), 16 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/sh_css.c b/drivers/staging/media/atomisp/pci/sh_css.c
index c4b35cbab3737..ba25d0da8b811 100644
--- a/drivers/staging/media/atomisp/pci/sh_css.c
+++ b/drivers/staging/media/atomisp/pci/sh_css.c
@@ -522,6 +522,7 @@ ia_css_stream_input_format_bits_per_pixel(struct ia_css_stream *stream)
return bpp;
}
+/* TODO: move define to proper file in tools */
#define GP_ISEL_TPG_MODE 0x90058
#if !defined(ISP2401)
@@ -573,12 +574,8 @@ sh_css_config_input_network(struct ia_css_stream *stream)
vblank_cycles = vblank_lines * (width + hblank_cycles);
sh_css_sp_configure_sync_gen(width, height, hblank_cycles,
vblank_cycles);
- if (!IS_ISP2401) {
- if (pipe->stream->config.mode == IA_CSS_INPUT_MODE_TPG) {
- /* TODO: move define to proper file in tools */
- ia_css_device_store_uint32(GP_ISEL_TPG_MODE, 0);
- }
- }
+ if (pipe->stream->config.mode == IA_CSS_INPUT_MODE_TPG)
+ ia_css_device_store_uint32(GP_ISEL_TPG_MODE, 0);
}
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE_PRIVATE,
"sh_css_config_input_network() leave:\n");
@@ -1009,16 +1006,14 @@ static bool sh_css_translate_stream_cfg_to_isys_stream_descr(
* ia_css_isys_stream_capture_indication() instead of
* ia_css_pipeline_sp_wait_for_isys_stream_N() as isp processing of
* capture takes longer than getting an ISYS frame
- *
- * Only 2401 relevant ??
*/
-#if 0 // FIXME: NOT USED on Yocto Aero
- isys_stream_descr->polling_mode
- = early_polling ? INPUT_SYSTEM_POLL_ON_CAPTURE_REQUEST
- : INPUT_SYSTEM_POLL_ON_WAIT_FOR_FRAME;
- ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE_PRIVATE,
- "sh_css_translate_stream_cfg_to_isys_stream_descr() leave:\n");
-#endif
+ if (IS_ISP2401) {
+ isys_stream_descr->polling_mode
+ = early_polling ? INPUT_SYSTEM_POLL_ON_CAPTURE_REQUEST
+ : INPUT_SYSTEM_POLL_ON_WAIT_FOR_FRAME;
+ ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE_PRIVATE,
+ "sh_css_translate_stream_cfg_to_isys_stream_descr() leave:\n");
+ }
return rc;
}
@@ -1433,7 +1428,7 @@ static void start_pipe(
assert(me); /* all callers are in this file and call with non null argument */
- if (!IS_ISP2401) {
+ if (IS_ISP2401) {
coord = &me->config.internal_frame_origin_bqs_on_sctbl;
params = me->stream->isp_params_configs;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0127/1039] media: atomisp: add NULL check for asd obtained from atomisp_video_pipe
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0126/1039] media: atomisp: fix ifdefs in sh_css.c Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0128/1039] media: atomisp: fix enum formats logic Greg Kroah-Hartman
` (865 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Mauro Carvalho Chehab,
Sasha Levin
From: Tsuchiya Yuto <kitakar@gmail.com>
[ Upstream commit c10bcb13462e9cf43111d17f1e08b4bb4d4401b0 ]
This is almost a BUG report with RFC patch that just avoids kernel
oopses. Thus, prefixed with [BUG][RFC].
Here is the kernel log after running `v4l2-compliance -d /dev/video4`
with this patch applied:
kern :err : [25507.580392] atomisp-isp2 0000:00:03.0: can't change power state from D3cold to D0 (config space inaccessible)
kern :warn : [25507.592343] isys dma store at addr(0xcd408) val(0)
kern :err : [25507.592995] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.593685] atomisp-isp2 0000:00:03.0: atomisp_g_input(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.593719] atomisp-isp2 0000:00:03.0: atomisp_g_parm(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.593727] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
[omitting 42 same messages]
kern :err : [25507.593976] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.594191] atomisp-isp2 0000:00:03.0: atomisp_g_input(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.594449] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
[omitting 43 same messages]
kern :err : [25507.594756] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.594779] atomisp-isp2 0000:00:03.0: atomisp_g_ctrl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.594787] atomisp-isp2 0000:00:03.0: atomisp_s_ctrl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.594803] atomisp-isp2 0000:00:03.0: atomisp_camera_g_ext_ctrls(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.594880] atomisp-isp2 0000:00:03.0: atomisp_enum_fmt_cap(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.594915] atomisp-isp2 0000:00:03.0: atomisp_g_parm(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.595058] atomisp-isp2 0000:00:03.0: atomisp_try_fmt(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.595089] atomisp-isp2 0000:00:03.0: atomisp_set_fmt(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.595124] atomisp-isp2 0000:00:03.0: atomisp_set_fmt(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.595221] atomisp-isp2 0000:00:03.0: atomisp_set_fmt(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.595241] atomisp-isp2 0000:00:03.0: atomisp_set_fmt(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.601571] atomisp-isp2 0000:00:03.0: can't change power state from D3cold to D0 (config space inaccessible)
kern :warn : [25507.607496] isys dma store at addr(0xcd408) val(0)
kern :err : [25507.608604] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.611988] atomisp-isp2 0000:00:03.0: can't change power state from D3cold to D0 (config space inaccessible)
kern :warn : [25507.617420] isys dma store at addr(0xcd408) val(0)
kern :err : [25507.618429] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.618811] atomisp-isp2 0000:00:03.0: atomisp_g_parm(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.622193] atomisp-isp2 0000:00:03.0: can't change power state from D3cold to D0 (config space inaccessible)
kern :warn : [25507.627355] isys dma store at addr(0xcd408) val(0)
kern :err : [25507.628391] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.631143] atomisp-isp2 0000:00:03.0: can't change power state from D3cold to D0 (config space inaccessible)
kern :warn : [25507.635813] isys dma store at addr(0xcd408) val(0)
kern :err : [25507.636489] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.636504] atomisp-isp2 0000:00:03.0: atomisp_s_input(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.636516] atomisp-isp2 0000:00:03.0: atomisp_set_fmt(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.639111] atomisp-isp2 0000:00:03.0: can't change power state from D3cold to D0 (config space inaccessible)
kern :warn : [25507.646152] isys dma store at addr(0xcd408) val(0)
kern :err : [25507.646831] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.646847] atomisp-isp2 0000:00:03.0: atomisp_s_input(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.650079] atomisp-isp2 0000:00:03.0: can't change power state from D3cold to D0 (config space inaccessible)
kern :warn : [25507.657476] isys dma store at addr(0xcd408) val(0)
kern :err : [25507.658741] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.658759] atomisp-isp2 0000:00:03.0: atomisp_s_input(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.658771] atomisp-isp2 0000:00:03.0: atomisp_set_fmt(): asd is NULL, device is ATOMISP ISP ACC
kern :err : [25507.660959] atomisp-isp2 0000:00:03.0: can't change power state from D3cold to D0 (config space inaccessible)
kern :warn : [25507.666665] isys dma store at addr(0xcd408) val(0)
kern :err : [25507.667397] atomisp-isp2 0000:00:03.0: atomisp_queryctl(): asd is NULL, device is ATOMISP ISP ACC
[mchehab: fix coding style]
Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../staging/media/atomisp/pci/atomisp_cmd.c | 73 +++++++++++++++
.../staging/media/atomisp/pci/atomisp_fops.c | 6 ++
.../staging/media/atomisp/pci/atomisp_ioctl.c | 90 +++++++++++++++++++
3 files changed, 169 insertions(+)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_cmd.c b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
index 366161cff5602..75a531667d743 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_cmd.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
@@ -1715,6 +1715,12 @@ void atomisp_wdt_refresh_pipe(struct atomisp_video_pipe *pipe,
{
unsigned long next;
+ if (!pipe->asd) {
+ dev_err(pipe->isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, pipe->vdev.name);
+ return;
+ }
+
if (delay != ATOMISP_WDT_KEEP_CURRENT_DELAY)
pipe->wdt_duration = delay;
@@ -1777,6 +1783,12 @@ void atomisp_wdt_refresh(struct atomisp_sub_device *asd, unsigned int delay)
/* ISP2401 */
void atomisp_wdt_stop_pipe(struct atomisp_video_pipe *pipe, bool sync)
{
+ if (!pipe->asd) {
+ dev_err(pipe->isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, pipe->vdev.name);
+ return;
+ }
+
if (!atomisp_is_wdt_running(pipe))
return;
@@ -4109,6 +4121,12 @@ void atomisp_handle_parameter_and_buffer(struct atomisp_video_pipe *pipe)
unsigned long irqflags;
bool need_to_enqueue_buffer = false;
+ if (!asd) {
+ dev_err(pipe->isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, pipe->vdev.name);
+ return;
+ }
+
if (atomisp_is_vf_pipe(pipe))
return;
@@ -4196,6 +4214,12 @@ int atomisp_set_parameters(struct video_device *vdev,
struct atomisp_css_params *css_param = &asd->params.css_param;
int ret;
+ if (!asd) {
+ dev_err(pipe->isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
if (!asd->stream_env[ATOMISP_INPUT_STREAM_GENERAL].stream) {
dev_err(asd->isp->dev, "%s: internal error!\n", __func__);
return -EINVAL;
@@ -4857,6 +4881,12 @@ int atomisp_try_fmt(struct video_device *vdev, struct v4l2_pix_format *f,
int source_pad = atomisp_subdev_source_pad(vdev);
int ret;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
if (!isp->inputs[asd->input_curr].camera)
return -EINVAL;
@@ -5198,6 +5228,12 @@ static int atomisp_set_fmt_to_isp(struct video_device *vdev,
const struct atomisp_in_fmt_conv *fc;
int ret, i;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
v4l2_fh_init(&fh.vfh, vdev);
isp_sink_crop = atomisp_subdev_get_rect(
@@ -5494,6 +5530,7 @@ static int atomisp_set_fmt_to_snr(struct video_device *vdev,
unsigned int dvs_env_w, unsigned int dvs_env_h)
{
struct atomisp_sub_device *asd = atomisp_to_video_pipe(vdev)->asd;
+ struct atomisp_video_pipe *pipe = atomisp_to_video_pipe(vdev);
const struct atomisp_format_bridge *format;
struct v4l2_subdev_pad_config pad_cfg;
struct v4l2_subdev_state pad_state = {
@@ -5512,6 +5549,12 @@ static int atomisp_set_fmt_to_snr(struct video_device *vdev,
struct v4l2_subdev_fh fh;
int ret;
+ if (!asd) {
+ dev_err(pipe->isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
v4l2_fh_init(&fh.vfh, vdev);
stream_index = atomisp_source_pad_to_stream_id(asd, source_pad);
@@ -5602,6 +5645,12 @@ int atomisp_set_fmt(struct video_device *vdev, struct v4l2_format *f)
struct v4l2_subdev_fh fh;
int ret;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
if (source_pad >= ATOMISP_SUBDEV_PADS_NUM)
return -EINVAL;
@@ -6034,6 +6083,12 @@ int atomisp_set_fmt_file(struct video_device *vdev, struct v4l2_format *f)
struct v4l2_subdev_fh fh;
int ret;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
v4l2_fh_init(&fh.vfh, vdev);
dev_dbg(isp->dev, "setting fmt %ux%u 0x%x for file inject\n",
@@ -6359,6 +6414,12 @@ bool atomisp_is_vf_pipe(struct atomisp_video_pipe *pipe)
{
struct atomisp_sub_device *asd = pipe->asd;
+ if (!asd) {
+ dev_err(pipe->isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, pipe->vdev.name);
+ return false;
+ }
+
if (pipe == &asd->video_out_vf)
return true;
@@ -6572,6 +6633,12 @@ static int atomisp_get_pipe_id(struct atomisp_video_pipe *pipe)
{
struct atomisp_sub_device *asd = pipe->asd;
+ if (!asd) {
+ dev_err(pipe->isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, pipe->vdev.name);
+ return -EINVAL;
+ }
+
if (ATOMISP_USE_YUVPP(asd)) {
return IA_CSS_PIPE_ID_YUVPP;
} else if (asd->vfpp->val == ATOMISP_VFPP_DISABLE_SCALER) {
@@ -6609,6 +6676,12 @@ int atomisp_get_invalid_frame_num(struct video_device *vdev,
struct ia_css_pipe_info p_info;
int ret;
+ if (!asd) {
+ dev_err(pipe->isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
if (asd->isp->inputs[asd->input_curr].camera_caps->
sensor[asd->sensor_curr].stream_num > 1) {
/* External ISP */
diff --git a/drivers/staging/media/atomisp/pci/atomisp_fops.c b/drivers/staging/media/atomisp/pci/atomisp_fops.c
index f82bf082aa796..02c19b92bdccb 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_fops.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_fops.c
@@ -1171,6 +1171,12 @@ static int atomisp_mmap(struct file *file, struct vm_area_struct *vma)
u32 origin_size, new_size;
int ret;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
if (!(vma->vm_flags & (VM_WRITE | VM_READ)))
return -EACCES;
diff --git a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
index c8a625667e81e..a57e640fbf791 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
@@ -646,6 +646,12 @@ static int atomisp_g_input(struct file *file, void *fh, unsigned int *input)
struct atomisp_device *isp = video_get_drvdata(vdev);
struct atomisp_sub_device *asd = atomisp_to_video_pipe(vdev)->asd;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
rt_mutex_lock(&isp->mutex);
*input = asd->input_curr;
rt_mutex_unlock(&isp->mutex);
@@ -665,6 +671,12 @@ static int atomisp_s_input(struct file *file, void *fh, unsigned int input)
struct v4l2_subdev *motor;
int ret;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
rt_mutex_lock(&isp->mutex);
if (input >= ATOM_ISP_MAX_INPUTS || input >= isp->input_cnt) {
dev_dbg(isp->dev, "input_cnt: %d\n", isp->input_cnt);
@@ -765,6 +777,12 @@ static int atomisp_enum_fmt_cap(struct file *file, void *fh,
unsigned int i, fi = 0;
int rval;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
rt_mutex_lock(&isp->mutex);
rval = v4l2_subdev_call(isp->inputs[asd->input_curr].camera, pad,
enum_mbus_code, NULL, &code);
@@ -1027,6 +1045,12 @@ int __atomisp_reqbufs(struct file *file, void *fh,
u16 stream_id = atomisp_source_pad_to_stream_id(asd, source_pad);
int ret = 0, i = 0;
+ if (!asd) {
+ dev_err(pipe->isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
if (req->count == 0) {
mutex_lock(&pipe->capq.vb_lock);
if (!list_empty(&pipe->capq.stream))
@@ -1154,6 +1178,12 @@ static int atomisp_qbuf(struct file *file, void *fh, struct v4l2_buffer *buf)
u32 pgnr;
int ret = 0;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
rt_mutex_lock(&isp->mutex);
if (isp->isp_fatal_error) {
ret = -EIO;
@@ -1389,6 +1419,12 @@ static int atomisp_dqbuf(struct file *file, void *fh, struct v4l2_buffer *buf)
struct atomisp_device *isp = video_get_drvdata(vdev);
int ret = 0;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
rt_mutex_lock(&isp->mutex);
if (isp->isp_fatal_error) {
@@ -1640,6 +1676,12 @@ static int atomisp_streamon(struct file *file, void *fh,
int ret = 0;
unsigned long irqflags;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
dev_dbg(isp->dev, "Start stream on pad %d for asd%d\n",
atomisp_subdev_source_pad(vdev), asd->index);
@@ -1901,6 +1943,12 @@ int __atomisp_streamoff(struct file *file, void *fh, enum v4l2_buf_type type)
unsigned long flags;
bool first_streamoff = false;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
dev_dbg(isp->dev, "Stop stream on pad %d for asd%d\n",
atomisp_subdev_source_pad(vdev), asd->index);
@@ -2150,6 +2198,12 @@ static int atomisp_g_ctrl(struct file *file, void *fh,
struct atomisp_device *isp = video_get_drvdata(vdev);
int i, ret = -EINVAL;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
for (i = 0; i < ctrls_num; i++) {
if (ci_v4l2_controls[i].id == control->id) {
ret = 0;
@@ -2229,6 +2283,12 @@ static int atomisp_s_ctrl(struct file *file, void *fh,
struct atomisp_device *isp = video_get_drvdata(vdev);
int i, ret = -EINVAL;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
for (i = 0; i < ctrls_num; i++) {
if (ci_v4l2_controls[i].id == control->id) {
ret = 0;
@@ -2310,6 +2370,12 @@ static int atomisp_queryctl(struct file *file, void *fh,
struct atomisp_sub_device *asd = atomisp_to_video_pipe(vdev)->asd;
struct atomisp_device *isp = video_get_drvdata(vdev);
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
switch (qc->id) {
case V4L2_CID_FOCUS_ABSOLUTE:
case V4L2_CID_FOCUS_RELATIVE:
@@ -2355,6 +2421,12 @@ static int atomisp_camera_g_ext_ctrls(struct file *file, void *fh,
int i;
int ret = 0;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
if (!IS_ISP2401)
motor = isp->inputs[asd->input_curr].motor;
else
@@ -2466,6 +2538,12 @@ static int atomisp_camera_s_ext_ctrls(struct file *file, void *fh,
int i;
int ret = 0;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
if (!IS_ISP2401)
motor = isp->inputs[asd->input_curr].motor;
else
@@ -2591,6 +2669,12 @@ static int atomisp_g_parm(struct file *file, void *fh,
struct atomisp_sub_device *asd = atomisp_to_video_pipe(vdev)->asd;
struct atomisp_device *isp = video_get_drvdata(vdev);
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
if (parm->type != V4L2_BUF_TYPE_VIDEO_CAPTURE) {
dev_err(isp->dev, "unsupported v4l2 buf type\n");
return -EINVAL;
@@ -2613,6 +2697,12 @@ static int atomisp_s_parm(struct file *file, void *fh,
int rval;
int fps;
+ if (!asd) {
+ dev_err(isp->dev, "%s(): asd is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
if (parm->type != V4L2_BUF_TYPE_VIDEO_CAPTURE) {
dev_err(isp->dev, "unsupported v4l2 buf type\n");
return -EINVAL;
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0128/1039] media: atomisp: fix enum formats logic
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0127/1039] media: atomisp: add NULL check for asd obtained from atomisp_video_pipe Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0129/1039] media: atomisp: fix uninitialized bug in gmin_get_pmic_id_and_addr() Greg Kroah-Hartman
` (864 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mauro Carvalho Chehab, Sasha Levin
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
[ Upstream commit fae46cb0531b45c789e39128f676f2bafa3a7b47 ]
Changeset 374d62e7aa50 ("media: v4l2-subdev: Verify v4l2_subdev_call() pad config argument")
added an extra verification for a pads parameter for enum mbus
format code.
Such change broke atomisp, because now the V4L2 core
refuses to enum MBUS formats if the state is empty.
So, add .which field in order to select the active formats,
in order to make it work again.
While here, improve error messages.
Fixes: 374d62e7aa50 ("media: v4l2-subdev: Verify v4l2_subdev_call() pad config argument")
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../staging/media/atomisp/pci/atomisp_ioctl.c | 23 ++++++++++++++-----
1 file changed, 17 insertions(+), 6 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
index a57e640fbf791..29826f8e4143d 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
@@ -773,7 +773,10 @@ static int atomisp_enum_fmt_cap(struct file *file, void *fh,
struct video_device *vdev = video_devdata(file);
struct atomisp_device *isp = video_get_drvdata(vdev);
struct atomisp_sub_device *asd = atomisp_to_video_pipe(vdev)->asd;
- struct v4l2_subdev_mbus_code_enum code = { 0 };
+ struct v4l2_subdev_mbus_code_enum code = {
+ .which = V4L2_SUBDEV_FORMAT_ACTIVE,
+ };
+ struct v4l2_subdev *camera;
unsigned int i, fi = 0;
int rval;
@@ -783,14 +786,20 @@ static int atomisp_enum_fmt_cap(struct file *file, void *fh,
return -EINVAL;
}
+ camera = isp->inputs[asd->input_curr].camera;
+ if(!camera) {
+ dev_err(isp->dev, "%s(): camera is NULL, device is %s\n",
+ __func__, vdev->name);
+ return -EINVAL;
+ }
+
rt_mutex_lock(&isp->mutex);
- rval = v4l2_subdev_call(isp->inputs[asd->input_curr].camera, pad,
- enum_mbus_code, NULL, &code);
+
+ rval = v4l2_subdev_call(camera, pad, enum_mbus_code, NULL, &code);
if (rval == -ENOIOCTLCMD) {
dev_warn(isp->dev,
- "enum_mbus_code pad op not supported. Please fix your sensor driver!\n");
- // rval = v4l2_subdev_call(isp->inputs[asd->input_curr].camera,
- // video, enum_mbus_fmt, 0, &code.code);
+ "enum_mbus_code pad op not supported by %s. Please fix your sensor driver!\n",
+ camera->name);
}
rt_mutex_unlock(&isp->mutex);
@@ -820,6 +829,8 @@ static int atomisp_enum_fmt_cap(struct file *file, void *fh,
f->pixelformat = format->pixelformat;
return 0;
}
+ dev_err(isp->dev, "%s(): format for code %x not found.\n",
+ __func__, code.code);
return -EINVAL;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0129/1039] media: atomisp: fix uninitialized bug in gmin_get_pmic_id_and_addr()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0128/1039] media: atomisp: fix enum formats logic Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:31 ` [PATCH 5.16 0130/1039] media: aspeed: fix mode-detect always time out at 2nd run Greg Kroah-Hartman
` (863 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Kieran Bingham,
Mauro Carvalho Chehab, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit cb4d67a998e97365afdf34965b069601da1dae60 ]
The "power" pointer is not initialized on the else path and that would
lead to an Oops.
Link: https://lore.kernel.org/linux-media/20211012082150.GA31086@kili
Fixes: c30f4cb2d4c7 ("media: atomisp: Refactor PMIC detection to a separate function")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
index d8c9e31314b2e..62dc06e224765 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
@@ -481,7 +481,7 @@ fail:
static u8 gmin_get_pmic_id_and_addr(struct device *dev)
{
- struct i2c_client *power;
+ struct i2c_client *power = NULL;
static u8 pmic_i2c_addr;
if (pmic_id)
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0130/1039] media: aspeed: fix mode-detect always time out at 2nd run
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0129/1039] media: atomisp: fix uninitialized bug in gmin_get_pmic_id_and_addr() Greg Kroah-Hartman
@ 2022-01-24 18:31 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0131/1039] media: em28xx: fix memory leak in em28xx_init_dev Greg Kroah-Hartman
` (862 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jammy Huang, Paul Menzel,
Joel Stanley, Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin
From: Jammy Huang <jammy_huang@aspeedtech.com>
[ Upstream commit 62cea52ad4bead0ae4be2cfe1142eb0aae0e9fbd ]
aspeed_video_get_resolution() will try to do res-detect again if the
timing got in last try is invalid. But it will always time out because
VE_SEQ_CTRL_TRIG_MODE_DET is only cleared after 1st mode-detect.
To fix the problem, just clear VE_SEQ_CTRL_TRIG_MODE_DET before setting
it in aspeed_video_enable_mode_detect().
Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver")
Signed-off-by: Jammy Huang <jammy_huang@aspeedtech.com>
Acked-by: Paul Menzel <pmenzel@molgen.mpg.de>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/aspeed-video.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c
index cad3f97515aef..136383ad0e97c 100644
--- a/drivers/media/platform/aspeed-video.c
+++ b/drivers/media/platform/aspeed-video.c
@@ -539,6 +539,10 @@ static void aspeed_video_enable_mode_detect(struct aspeed_video *video)
aspeed_video_update(video, VE_INTERRUPT_CTRL, 0,
VE_INTERRUPT_MODE_DETECT);
+ /* Disable mode detect in order to re-trigger */
+ aspeed_video_update(video, VE_SEQ_CTRL,
+ VE_SEQ_CTRL_TRIG_MODE_DET, 0);
+
/* Trigger mode detect */
aspeed_video_update(video, VE_SEQ_CTRL, 0, VE_SEQ_CTRL_TRIG_MODE_DET);
}
@@ -824,10 +828,6 @@ static void aspeed_video_get_resolution(struct aspeed_video *video)
return;
}
- /* Disable mode detect in order to re-trigger */
- aspeed_video_update(video, VE_SEQ_CTRL,
- VE_SEQ_CTRL_TRIG_MODE_DET, 0);
-
aspeed_video_check_and_set_polarity(video);
aspeed_video_enable_mode_detect(video);
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0131/1039] media: em28xx: fix memory leak in em28xx_init_dev
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2022-01-24 18:31 ` [PATCH 5.16 0130/1039] media: aspeed: fix mode-detect always time out at 2nd run Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0132/1039] media: aspeed: Update signal status immediately to ensure sane hw state Greg Kroah-Hartman
` (861 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pavel Skripkin, Dongliang Mu,
syzkaller, Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin
From: Dongliang Mu <mudongliangabcd@gmail.com>
[ Upstream commit 22be5a10d0b24eec9e45decd15d7e6112b25f080 ]
In the em28xx_init_rev, if em28xx_audio_setup fails, this function fails
to deallocate the media_dev allocated in the em28xx_media_device_init.
Fix this by adding em28xx_unregister_media_device to free media_dev.
BTW, this patch is tested in my local syzkaller instance, and it can
prevent the memory leak from occurring again.
CC: Pavel Skripkin <paskripkin@gmail.com>
Fixes: 37ecc7b1278f ("[media] em28xx: add media controller support")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/em28xx/em28xx-cards.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
index b207f34af5c6f..b451ce3cb169a 100644
--- a/drivers/media/usb/em28xx/em28xx-cards.c
+++ b/drivers/media/usb/em28xx/em28xx-cards.c
@@ -3630,8 +3630,10 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,
if (dev->is_audio_only) {
retval = em28xx_audio_setup(dev);
- if (retval)
- return -ENODEV;
+ if (retval) {
+ retval = -ENODEV;
+ goto err_deinit_media;
+ }
em28xx_init_extension(dev);
return 0;
@@ -3650,7 +3652,7 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,
dev_err(&dev->intf->dev,
"%s: em28xx_i2c_register bus 0 - error [%d]!\n",
__func__, retval);
- return retval;
+ goto err_deinit_media;
}
/* register i2c bus 1 */
@@ -3666,9 +3668,7 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,
"%s: em28xx_i2c_register bus 1 - error [%d]!\n",
__func__, retval);
- em28xx_i2c_unregister(dev, 0);
-
- return retval;
+ goto err_unreg_i2c;
}
}
@@ -3676,6 +3676,12 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,
em28xx_card_setup(dev);
return 0;
+
+err_unreg_i2c:
+ em28xx_i2c_unregister(dev, 0);
+err_deinit_media:
+ em28xx_unregister_media_device(dev);
+ return retval;
}
static int em28xx_duplicate_dev(struct em28xx *dev)
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0132/1039] media: aspeed: Update signal status immediately to ensure sane hw state
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0131/1039] media: em28xx: fix memory leak in em28xx_init_dev Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0133/1039] arm64: dts: amlogic: meson-g12: Fix GPU operating point table node name Greg Kroah-Hartman
` (860 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jammy Huang, Paul Menzel,
Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin
From: Jammy Huang <jammy_huang@aspeedtech.com>
[ Upstream commit af6d1bde395cac174ee71adcd3fa43f6435c7206 ]
If res-chg, VE_INTERRUPT_MODE_DETECT_WD irq will be raised. But
v4l2_input_status won't be updated to no-signal immediately until
aspeed_video_get_resolution() in aspeed_video_resolution_work().
During the period of time, aspeed_video_start_frame() could be called
because it doesn't know signal becomes unstable now. If it goes with
aspeed_video_init_regs() of aspeed_video_irq_res_change()
simultaneously, it will mess up hw state.
To fix this problem, v4l2_input_status is updated to no-signal
immediately for VE_INTERRUPT_MODE_DETECT_WD irq.
Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver")
Signed-off-by: Jammy Huang <jammy_huang@aspeedtech.com>
Acked-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/aspeed-video.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c
index 136383ad0e97c..7a24daf7165a4 100644
--- a/drivers/media/platform/aspeed-video.c
+++ b/drivers/media/platform/aspeed-video.c
@@ -595,6 +595,8 @@ static void aspeed_video_irq_res_change(struct aspeed_video *video, ulong delay)
set_bit(VIDEO_RES_CHANGE, &video->flags);
clear_bit(VIDEO_FRAME_INPRG, &video->flags);
+ video->v4l2_input_status = V4L2_IN_ST_NO_SIGNAL;
+
aspeed_video_off(video);
aspeed_video_bufs_done(video, VB2_BUF_STATE_ERROR);
@@ -1375,7 +1377,6 @@ static void aspeed_video_resolution_work(struct work_struct *work)
struct delayed_work *dwork = to_delayed_work(work);
struct aspeed_video *video = container_of(dwork, struct aspeed_video,
res_work);
- u32 input_status = video->v4l2_input_status;
aspeed_video_on(video);
@@ -1388,8 +1389,7 @@ static void aspeed_video_resolution_work(struct work_struct *work)
aspeed_video_get_resolution(video);
if (video->detected_timings.width != video->active_timings.width ||
- video->detected_timings.height != video->active_timings.height ||
- input_status != video->v4l2_input_status) {
+ video->detected_timings.height != video->active_timings.height) {
static const struct v4l2_event ev = {
.type = V4L2_EVENT_SOURCE_CHANGE,
.u.src_change.changes = V4L2_EVENT_SRC_CH_RESOLUTION,
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0133/1039] arm64: dts: amlogic: meson-g12: Fix GPU operating point table node name
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0132/1039] media: aspeed: Update signal status immediately to ensure sane hw state Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0134/1039] arm64: dts: amlogic: Fix SPI NOR flash node name for ODROID N2/N2+ Greg Kroah-Hartman
` (859 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Neil Armstrong, Alexander Stein, Sasha Levin
From: Alexander Stein <alexander.stein@mailbox.org>
[ Upstream commit bb98a6fd0b0e227cefb2ba91cea2b55455f203b7 ]
Starting with commit 94274f20f6bf ("dt-bindings: opp: Convert to DT
schema") the opp node name has a mandatory pattern. This change
fixes the dtbs_check warning:
gpu-opp-table: $nodename:0: 'gpu-opp-table' does not match
'^opp-table(-[a-z0-9]+)?$'
Put the 'gpu' part at the end to match the pattern.
Fixes: 916a0edc43f0 ("arm64: dts: amlogic: meson-g12: add the Mali OPP table and use DVFS")
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Alexander Stein <alexander.stein@mailbox.org>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://lore.kernel.org/r/20211026182813.900775-2-alexander.stein@mailbox.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
index 00c6f53290d43..428449d98c0ae 100644
--- a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
@@ -58,7 +58,7 @@
secure-monitor = <&sm>;
};
- gpu_opp_table: gpu-opp-table {
+ gpu_opp_table: opp-table-gpu {
compatible = "operating-points-v2";
opp-124999998 {
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0134/1039] arm64: dts: amlogic: Fix SPI NOR flash node name for ODROID N2/N2+
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0133/1039] arm64: dts: amlogic: meson-g12: Fix GPU operating point table node name Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0135/1039] arm64: dts: meson-gxbb-wetek: fix HDMI in early boot Greg Kroah-Hartman
` (858 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Neil Armstrong, Alexander Stein, Sasha Levin
From: Alexander Stein <alexander.stein@mailbox.org>
[ Upstream commit 95d35256b564aca33fb661eac77dc94bfcffc8df ]
Fix the schema warning: "spi-flash@0: $nodename:0: 'spi-flash@0' does
not match '^flash(@.*)?$'" from jedec,spi-nor.yaml
Fixes: a084eaf3096c ("arm64: dts: meson-g12b-odroid-n2: add SPIFC controller node")
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Alexander Stein <alexander.stein@mailbox.org>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://lore.kernel.org/r/20211026182813.900775-3-alexander.stein@mailbox.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi
index e8a00a2f88128..3e968b2441918 100644
--- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi
@@ -609,7 +609,7 @@
pinctrl-0 = <&nor_pins>;
pinctrl-names = "default";
- mx25u64: spi-flash@0 {
+ mx25u64: flash@0 {
#address-cells = <1>;
#size-cells = <1>;
compatible = "mxicy,mx25u6435f", "jedec,spi-nor";
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0135/1039] arm64: dts: meson-gxbb-wetek: fix HDMI in early boot
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0134/1039] arm64: dts: amlogic: Fix SPI NOR flash node name for ODROID N2/N2+ Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0136/1039] arm64: dts: meson-gxbb-wetek: fix missing GPIO binding Greg Kroah-Hartman
` (857 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian Hewitt, Neil Armstrong,
Sasha Levin
From: Christian Hewitt <christianshewitt@gmail.com>
[ Upstream commit 8182a35868db5f053111d5d9d4da8fcb3f99259d ]
Mark the VDDIO_AO18 regulator always-on and set hdmi-supply for the hdmi_tx
node to ensure HDMI is powered in the early stages of boot.
Fixes: fb72c03e0e32 ("ARM64: dts: meson-gxbb-wetek: add a wetek specific dtsi to cleanup hub and play2")
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://lore.kernel.org/r/20211012052522.30873-2-christianshewitt@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
index a350fee1264d7..8e2af986cebaf 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
@@ -64,6 +64,7 @@
regulator-name = "VDDIO_AO18";
regulator-min-microvolt = <1800000>;
regulator-max-microvolt = <1800000>;
+ regulator-always-on;
};
vcc_3v3: regulator-vcc_3v3 {
@@ -161,6 +162,7 @@
status = "okay";
pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>;
pinctrl-names = "default";
+ hdmi-supply = <&vddio_ao18>;
};
&hdmi_tx_tmds_port {
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0136/1039] arm64: dts: meson-gxbb-wetek: fix missing GPIO binding
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0135/1039] arm64: dts: meson-gxbb-wetek: fix HDMI in early boot Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0137/1039] fs: dlm: dont call kernel_getpeername() in error_report() Greg Kroah-Hartman
` (856 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian Hewitt, Neil Armstrong,
Sasha Levin
From: Christian Hewitt <christianshewitt@gmail.com>
[ Upstream commit c019abb2feba3cbbd7cf7178f8e6499c4fa6fced ]
The absence of this binding appears to be harmless in Linux but it breaks
Ethernet support in mainline u-boot. So add the binding (which is present
in all other u-boot supported GXBB device-trees).
Fixes: fb72c03e0e32 ("ARM64: dts: meson-gxbb-wetek: add a wetek specific dtsi to cleanup hub and play2")
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://lore.kernel.org/r/20211012052522.30873-3-christianshewitt@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
index 8e2af986cebaf..a4d34398da358 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
@@ -6,6 +6,7 @@
*/
#include "meson-gxbb.dtsi"
+#include <dt-bindings/gpio/gpio.h>
/ {
aliases {
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0137/1039] fs: dlm: dont call kernel_getpeername() in error_report()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0136/1039] arm64: dts: meson-gxbb-wetek: fix missing GPIO binding Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0138/1039] memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails Greg Kroah-Hartman
` (855 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bob Peterson, Alexander Aring,
David Teigland, Sasha Levin
From: Alexander Aring <aahringo@redhat.com>
[ Upstream commit 4c3d90570bcc2b338f70f61f01110268e281ca3c ]
In some cases kernel_getpeername() will held the socket lock which is
already held when the socket layer calls error_report() callback. Since
commit 9dfc685e0262 ("inet: remove races in inet{6}_getname()") this
problem becomes more likely because the socket lock will be held always.
You will see something like:
bob9-u5 login: [ 562.316860] BUG: spinlock recursion on CPU#7, swapper/7/0
[ 562.318562] lock: 0xffff8f2284720088, .magic: dead4ead, .owner: swapper/7/0, .owner_cpu: 7
[ 562.319522] CPU: 7 PID: 0 Comm: swapper/7 Not tainted 5.15.0+ #135
[ 562.320346] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.13.0-2.module+el8.3.0+7353+9de0a3cc 04/01/2014
[ 562.321277] Call Trace:
[ 562.321529] <IRQ>
[ 562.321734] dump_stack_lvl+0x33/0x42
[ 562.322282] do_raw_spin_lock+0x8b/0xc0
[ 562.322674] lock_sock_nested+0x1e/0x50
[ 562.323057] inet_getname+0x39/0x110
[ 562.323425] ? sock_def_readable+0x80/0x80
[ 562.323838] lowcomms_error_report+0x63/0x260 [dlm]
[ 562.324338] ? wait_for_completion_interruptible_timeout+0xd2/0x120
[ 562.324949] ? lock_timer_base+0x67/0x80
[ 562.325330] ? do_raw_spin_unlock+0x49/0xc0
[ 562.325735] ? _raw_spin_unlock_irqrestore+0x1e/0x40
[ 562.326218] ? del_timer+0x54/0x80
[ 562.326549] sk_error_report+0x12/0x70
[ 562.326919] tcp_validate_incoming+0x3c8/0x530
[ 562.327347] ? kvm_clock_read+0x14/0x30
[ 562.327718] ? ktime_get+0x3b/0xa0
[ 562.328055] tcp_rcv_established+0x121/0x660
[ 562.328466] tcp_v4_do_rcv+0x132/0x260
[ 562.328835] tcp_v4_rcv+0xcea/0xe20
[ 562.329173] ip_protocol_deliver_rcu+0x35/0x1f0
[ 562.329615] ip_local_deliver_finish+0x54/0x60
[ 562.330050] ip_local_deliver+0xf7/0x110
[ 562.330431] ? inet_rtm_getroute+0x211/0x840
[ 562.330848] ? ip_protocol_deliver_rcu+0x1f0/0x1f0
[ 562.331310] ip_rcv+0xe1/0xf0
[ 562.331603] ? ip_local_deliver+0x110/0x110
[ 562.332011] __netif_receive_skb_core+0x46a/0x1040
[ 562.332476] ? inet_gro_receive+0x263/0x2e0
[ 562.332885] __netif_receive_skb_list_core+0x13b/0x2c0
[ 562.333383] netif_receive_skb_list_internal+0x1c8/0x2f0
[ 562.333896] ? update_load_avg+0x7e/0x5e0
[ 562.334285] gro_normal_list.part.149+0x19/0x40
[ 562.334722] napi_complete_done+0x67/0x160
[ 562.335134] virtnet_poll+0x2ad/0x408 [virtio_net]
[ 562.335644] __napi_poll+0x28/0x140
[ 562.336012] net_rx_action+0x23d/0x300
[ 562.336414] __do_softirq+0xf2/0x2ea
[ 562.336803] irq_exit_rcu+0xc1/0xf0
[ 562.337173] common_interrupt+0xb9/0xd0
It is and was always forbidden to call kernel_getpeername() in context
of error_report(). To get rid of the problem we access the destination
address for the peer over the socket structure. While on it we fix to
print out the destination port of the inet socket.
Fixes: 1a31833d085a ("DLM: Replace nodeid_to_addr with kernel_getpeername")
Reported-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/dlm/lowcomms.c | 42 ++++++++++++++++++++----------------------
1 file changed, 20 insertions(+), 22 deletions(-)
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index 8f715c620e1f8..7b1c5f05a988b 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -592,8 +592,8 @@ int dlm_lowcomms_nodes_set_mark(int nodeid, unsigned int mark)
static void lowcomms_error_report(struct sock *sk)
{
struct connection *con;
- struct sockaddr_storage saddr;
void (*orig_report)(struct sock *) = NULL;
+ struct inet_sock *inet;
read_lock_bh(&sk->sk_callback_lock);
con = sock2con(sk);
@@ -601,33 +601,31 @@ static void lowcomms_error_report(struct sock *sk)
goto out;
orig_report = listen_sock.sk_error_report;
- if (kernel_getpeername(sk->sk_socket, (struct sockaddr *)&saddr) < 0) {
- printk_ratelimited(KERN_ERR "dlm: node %d: socket error "
- "sending to node %d, port %d, "
- "sk_err=%d/%d\n", dlm_our_nodeid(),
- con->nodeid, dlm_config.ci_tcp_port,
- sk->sk_err, sk->sk_err_soft);
- } else if (saddr.ss_family == AF_INET) {
- struct sockaddr_in *sin4 = (struct sockaddr_in *)&saddr;
+ inet = inet_sk(sk);
+ switch (sk->sk_family) {
+ case AF_INET:
printk_ratelimited(KERN_ERR "dlm: node %d: socket error "
- "sending to node %d at %pI4, port %d, "
+ "sending to node %d at %pI4, dport %d, "
"sk_err=%d/%d\n", dlm_our_nodeid(),
- con->nodeid, &sin4->sin_addr.s_addr,
- dlm_config.ci_tcp_port, sk->sk_err,
+ con->nodeid, &inet->inet_daddr,
+ ntohs(inet->inet_dport), sk->sk_err,
sk->sk_err_soft);
- } else {
- struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&saddr;
-
+ break;
+ case AF_INET6:
printk_ratelimited(KERN_ERR "dlm: node %d: socket error "
- "sending to node %d at %u.%u.%u.%u, "
- "port %d, sk_err=%d/%d\n", dlm_our_nodeid(),
- con->nodeid, sin6->sin6_addr.s6_addr32[0],
- sin6->sin6_addr.s6_addr32[1],
- sin6->sin6_addr.s6_addr32[2],
- sin6->sin6_addr.s6_addr32[3],
- dlm_config.ci_tcp_port, sk->sk_err,
+ "sending to node %d at %pI6c, "
+ "dport %d, sk_err=%d/%d\n", dlm_our_nodeid(),
+ con->nodeid, &sk->sk_v6_daddr,
+ ntohs(inet->inet_dport), sk->sk_err,
sk->sk_err_soft);
+ break;
+ default:
+ printk_ratelimited(KERN_ERR "dlm: node %d: socket error "
+ "invalid socket family %d set, "
+ "sk_err=%d/%d\n", dlm_our_nodeid(),
+ sk->sk_family, sk->sk_err, sk->sk_err_soft);
+ goto out;
}
/* below sendcon only handling */
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0138/1039] memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0137/1039] fs: dlm: dont call kernel_getpeername() in error_report() Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0139/1039] Bluetooth: stop proccessing malicious adv data Greg Kroah-Hartman
` (854 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lad Prabhakar, Biju Das,
Wolfram Sang, Geert Uytterhoeven, Krzysztof Kozlowski,
Sasha Levin
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
[ Upstream commit 818fdfa89baac77a8df5a2c30f4fb798cc937aa0 ]
Make sure we return error in case devm_ioremap_resource() fails for dirmap
resource.
Fixes: ca7d8b980b67 ("memory: add Renesas RPC-IF driver")
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/20211025205631.21151-6-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memory/renesas-rpc-if.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/memory/renesas-rpc-if.c b/drivers/memory/renesas-rpc-if.c
index 7435baad00075..ff8bcbccac637 100644
--- a/drivers/memory/renesas-rpc-if.c
+++ b/drivers/memory/renesas-rpc-if.c
@@ -243,7 +243,7 @@ int rpcif_sw_init(struct rpcif *rpc, struct device *dev)
res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dirmap");
rpc->dirmap = devm_ioremap_resource(&pdev->dev, res);
if (IS_ERR(rpc->dirmap))
- rpc->dirmap = NULL;
+ return PTR_ERR(rpc->dirmap);
rpc->size = resource_size(res);
rpc->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL);
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0139/1039] Bluetooth: stop proccessing malicious adv data
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0138/1039] memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0140/1039] Bluetooth: fix uninitialized variables notify_evt Greg Kroah-Hartman
` (853 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pavel Skripkin, Marcel Holtmann,
Sasha Levin, syzbot+e3fcb9c4f3c2a931dc40
From: Pavel Skripkin <paskripkin@gmail.com>
[ Upstream commit 3a56ef719f0b9682afb8a86d64b2399e36faa4e6 ]
Syzbot reported slab-out-of-bounds read in hci_le_adv_report_evt(). The
problem was in missing validaion check.
We should check if data is not malicious and we can read next data block.
If we won't check ptr validness, code can read a way beyond skb->end and
it can cause problems, of course.
Fixes: e95beb414168 ("Bluetooth: hci_le_adv_report_evt code refactoring")
Reported-and-tested-by: syzbot+e3fcb9c4f3c2a931dc40@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_event.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 7d0db1ca12482..59f0691d907f6 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -5825,7 +5825,8 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
struct hci_ev_le_advertising_info *ev = ptr;
s8 rssi;
- if (ev->length <= HCI_MAX_AD_LENGTH) {
+ if (ev->length <= HCI_MAX_AD_LENGTH &&
+ ev->data + ev->length <= skb_tail_pointer(skb)) {
rssi = ev->data[ev->length];
process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
ev->bdaddr_type, NULL, 0, rssi,
@@ -5835,6 +5836,11 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
}
ptr += sizeof(*ev) + ev->length + 1;
+
+ if (ptr > (void *) skb_tail_pointer(skb) - sizeof(*ev)) {
+ bt_dev_err(hdev, "Malicious advertising data. Stopping processing");
+ break;
+ }
}
hci_dev_unlock(hdev);
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0140/1039] Bluetooth: fix uninitialized variables notify_evt
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0139/1039] Bluetooth: stop proccessing malicious adv data Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0141/1039] ath11k: Fix ETSI regd with weather radar overlap Greg Kroah-Hartman
` (852 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marcel Holtmann, Jackie Liu, Sasha Levin
From: Jackie Liu <liuyun01@kylinos.cn>
[ Upstream commit a27c519a816437ec92f0ffa3adbc168c2c08725b ]
Coverity Scan report:
[...]
*** CID 1493985: Uninitialized variables (UNINIT)
/net/bluetooth/hci_event.c: 4535 in hci_sync_conn_complete_evt()
4529
4530 /* Notify only in case of SCO over HCI transport data path which
4531 * is zero and non-zero value shall be non-HCI transport data path
4532 */
4533 if (conn->codec.data_path == 0) {
4534 if (hdev->notify)
>>> CID 1493985: Uninitialized variables (UNINIT)
>>> Using uninitialized value "notify_evt" when calling "*hdev->notify".
4535 hdev->notify(hdev, notify_evt);
4536 }
4537
4538 hci_connect_cfm(conn, ev->status);
4539 if (ev->status)
4540 hci_conn_del(conn);
[...]
Although only btusb uses air_mode, and he only handles HCI_NOTIFY_ENABLE_SCO_CVSD
and HCI_NOTIFY_ENABLE_SCO_TRANSP, there is still a very small chance that
ev->air_mode is not equal to 0x2 and 0x3, but notify_evt is initialized to
HCI_NOTIFY_ENABLE_SCO_CVSD or HCI_NOTIFY_ENABLE_SCO_TRANSP. the context is
maybe not correct.
Let us directly use the required function instead of re-initializing it,
so as to restore the original logic and make the code more correct.
Addresses-Coverity: ("Uninitialized variables")
Fixes: f4f9fa0c07bb ("Bluetooth: Allow usb to auto-suspend when SCO use non-HCI transport")
Suggested-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_event.c | 23 +++++++++--------------
1 file changed, 9 insertions(+), 14 deletions(-)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 59f0691d907f6..6eba439487749 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4445,7 +4445,6 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
{
struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
struct hci_conn *conn;
- unsigned int notify_evt;
BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
@@ -4517,22 +4516,18 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
}
bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);
-
- switch (ev->air_mode) {
- case 0x02:
- notify_evt = HCI_NOTIFY_ENABLE_SCO_CVSD;
- break;
- case 0x03:
- notify_evt = HCI_NOTIFY_ENABLE_SCO_TRANSP;
- break;
- }
-
/* Notify only in case of SCO over HCI transport data path which
* is zero and non-zero value shall be non-HCI transport data path
*/
- if (conn->codec.data_path == 0) {
- if (hdev->notify)
- hdev->notify(hdev, notify_evt);
+ if (conn->codec.data_path == 0 && hdev->notify) {
+ switch (ev->air_mode) {
+ case 0x02:
+ hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
+ break;
+ case 0x03:
+ hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);
+ break;
+ }
}
hci_connect_cfm(conn, ev->status);
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0141/1039] ath11k: Fix ETSI regd with weather radar overlap
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0140/1039] Bluetooth: fix uninitialized variables notify_evt Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0142/1039] ath11k: clear the keys properly via DISABLE_KEY Greg Kroah-Hartman
` (851 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin
From: Sven Eckelmann <sven@narfation.org>
[ Upstream commit 086c921a354089f209318501038d43c98d3f409f ]
Some ETSI countries have a small overlap in the wireless-regdb with an ETSI
channel (5590-5650). A good example is Australia:
country AU: DFS-ETSI
(2400 - 2483.5 @ 40), (36)
(5150 - 5250 @ 80), (23), NO-OUTDOOR, AUTO-BW
(5250 - 5350 @ 80), (20), NO-OUTDOOR, AUTO-BW, DFS
(5470 - 5600 @ 80), (27), DFS
(5650 - 5730 @ 80), (27), DFS
(5730 - 5850 @ 80), (36)
(57000 - 66000 @ 2160), (43), NO-OUTDOOR
If the firmware (or the BDF) is shipped with these rules then there is only
a 10 MHz overlap with the weather radar:
* below: 5470 - 5590
* weather radar: 5590 - 5600
* above: (none for the rule "5470 - 5600 @ 80")
There are several wrong assumption in the ath11k code:
* there is always a valid range below the weather radar
(actually: there could be no range below the weather radar range OR range
could be smaller than 20 MHz)
* intersected range in the weather radar range is valid
(actually: the range could be smaller than 20 MHz)
* range above weather radar is either empty or valid
(actually: the range could be smaller than 20 MHz)
These wrong assumption will lead in this example to a rule
(5590 - 5600 @ 20), (N/A, 27), (600000 ms), DFS, AUTO-BW
which is invalid according to is_valid_reg_rule() because the freq_diff is
only 10 MHz but the max_bandwidth is set to 20 MHz. Which results in a
rejection like:
WARNING: at backports-20210222_001-4.4.60-b157d2276/net/wireless/reg.c:3984
[...]
Call trace:
[<ffffffbffc3d2e50>] reg_get_max_bandwidth+0x300/0x3a8 [cfg80211]
[<ffffffbffc3d3d0c>] regulatory_set_wiphy_regd_sync+0x3c/0x98 [cfg80211]
[<ffffffbffc651598>] ath11k_regd_update+0x1a8/0x210 [ath11k]
[<ffffffbffc652108>] ath11k_regd_update_work+0x18/0x20 [ath11k]
[<ffffffc0000a93e0>] process_one_work+0x1f8/0x340
[<ffffffc0000a9784>] worker_thread+0x25c/0x448
[<ffffffc0000aedc8>] kthread+0xd0/0xd8
[<ffffffc000085550>] ret_from_fork+0x10/0x40
ath11k c000000.wifi: failed to perform regd update : -22
Invalid regulatory domain detected
To avoid this, the algorithm has to be changed slightly. Instead of
splitting a rule which overlaps with the weather radar range into 3 pieces
and accepting the first two parts blindly, it must actually be checked for
each piece whether it is a valid range. And only if it is valid, add it to
the output array.
When these checks are in place, the processed rules for AU would end up as
country AU: DFS-ETSI
(2400 - 2483 @ 40), (N/A, 36), (N/A)
(5150 - 5250 @ 80), (6, 23), (N/A), NO-OUTDOOR, AUTO-BW
(5250 - 5350 @ 80), (6, 20), (0 ms), NO-OUTDOOR, DFS, AUTO-BW
(5470 - 5590 @ 80), (6, 27), (0 ms), DFS, AUTO-BW
(5650 - 5730 @ 80), (6, 27), (0 ms), DFS, AUTO-BW
(5730 - 5850 @ 80), (6, 36), (N/A), AUTO-BW
and will be accepted by the wireless regulatory code.
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211112153116.1214421-1-sven@narfation.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/reg.c | 103 ++++++++++++++------------
1 file changed, 56 insertions(+), 47 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c
index a66b5bdd21679..8606170ba80d5 100644
--- a/drivers/net/wireless/ath/ath11k/reg.c
+++ b/drivers/net/wireless/ath/ath11k/reg.c
@@ -456,6 +456,9 @@ ath11k_reg_adjust_bw(u16 start_freq, u16 end_freq, u16 max_bw)
{
u16 bw;
+ if (end_freq <= start_freq)
+ return 0;
+
bw = end_freq - start_freq;
bw = min_t(u16, bw, max_bw);
@@ -463,8 +466,10 @@ ath11k_reg_adjust_bw(u16 start_freq, u16 end_freq, u16 max_bw)
bw = 80;
else if (bw >= 40 && bw < 80)
bw = 40;
- else if (bw < 40)
+ else if (bw >= 20 && bw < 40)
bw = 20;
+ else
+ bw = 0;
return bw;
}
@@ -488,73 +493,77 @@ ath11k_reg_update_weather_radar_band(struct ath11k_base *ab,
struct cur_reg_rule *reg_rule,
u8 *rule_idx, u32 flags, u16 max_bw)
{
+ u32 start_freq;
u32 end_freq;
u16 bw;
u8 i;
i = *rule_idx;
+ /* there might be situations when even the input rule must be dropped */
+ i--;
+
+ /* frequencies below weather radar */
bw = ath11k_reg_adjust_bw(reg_rule->start_freq,
ETSI_WEATHER_RADAR_BAND_LOW, max_bw);
+ if (bw > 0) {
+ i++;
- ath11k_reg_update_rule(regd->reg_rules + i, reg_rule->start_freq,
- ETSI_WEATHER_RADAR_BAND_LOW, bw,
- reg_rule->ant_gain, reg_rule->reg_power,
- flags);
+ ath11k_reg_update_rule(regd->reg_rules + i,
+ reg_rule->start_freq,
+ ETSI_WEATHER_RADAR_BAND_LOW, bw,
+ reg_rule->ant_gain, reg_rule->reg_power,
+ flags);
- ath11k_dbg(ab, ATH11K_DBG_REG,
- "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
- i + 1, reg_rule->start_freq, ETSI_WEATHER_RADAR_BAND_LOW,
- bw, reg_rule->ant_gain, reg_rule->reg_power,
- regd->reg_rules[i].dfs_cac_ms,
- flags);
-
- if (reg_rule->end_freq > ETSI_WEATHER_RADAR_BAND_HIGH)
- end_freq = ETSI_WEATHER_RADAR_BAND_HIGH;
- else
- end_freq = reg_rule->end_freq;
+ ath11k_dbg(ab, ATH11K_DBG_REG,
+ "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
+ i + 1, reg_rule->start_freq,
+ ETSI_WEATHER_RADAR_BAND_LOW, bw, reg_rule->ant_gain,
+ reg_rule->reg_power, regd->reg_rules[i].dfs_cac_ms,
+ flags);
+ }
- bw = ath11k_reg_adjust_bw(ETSI_WEATHER_RADAR_BAND_LOW, end_freq,
- max_bw);
+ /* weather radar frequencies */
+ start_freq = max_t(u32, reg_rule->start_freq,
+ ETSI_WEATHER_RADAR_BAND_LOW);
+ end_freq = min_t(u32, reg_rule->end_freq, ETSI_WEATHER_RADAR_BAND_HIGH);
- i++;
+ bw = ath11k_reg_adjust_bw(start_freq, end_freq, max_bw);
+ if (bw > 0) {
+ i++;
- ath11k_reg_update_rule(regd->reg_rules + i,
- ETSI_WEATHER_RADAR_BAND_LOW, end_freq, bw,
- reg_rule->ant_gain, reg_rule->reg_power,
- flags);
+ ath11k_reg_update_rule(regd->reg_rules + i, start_freq,
+ end_freq, bw, reg_rule->ant_gain,
+ reg_rule->reg_power, flags);
- regd->reg_rules[i].dfs_cac_ms = ETSI_WEATHER_RADAR_BAND_CAC_TIMEOUT;
+ regd->reg_rules[i].dfs_cac_ms = ETSI_WEATHER_RADAR_BAND_CAC_TIMEOUT;
- ath11k_dbg(ab, ATH11K_DBG_REG,
- "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
- i + 1, ETSI_WEATHER_RADAR_BAND_LOW, end_freq,
- bw, reg_rule->ant_gain, reg_rule->reg_power,
- regd->reg_rules[i].dfs_cac_ms,
- flags);
-
- if (end_freq == reg_rule->end_freq) {
- regd->n_reg_rules--;
- *rule_idx = i;
- return;
+ ath11k_dbg(ab, ATH11K_DBG_REG,
+ "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
+ i + 1, start_freq, end_freq, bw,
+ reg_rule->ant_gain, reg_rule->reg_power,
+ regd->reg_rules[i].dfs_cac_ms, flags);
}
+ /* frequencies above weather radar */
bw = ath11k_reg_adjust_bw(ETSI_WEATHER_RADAR_BAND_HIGH,
reg_rule->end_freq, max_bw);
+ if (bw > 0) {
+ i++;
- i++;
-
- ath11k_reg_update_rule(regd->reg_rules + i, ETSI_WEATHER_RADAR_BAND_HIGH,
- reg_rule->end_freq, bw,
- reg_rule->ant_gain, reg_rule->reg_power,
- flags);
+ ath11k_reg_update_rule(regd->reg_rules + i,
+ ETSI_WEATHER_RADAR_BAND_HIGH,
+ reg_rule->end_freq, bw,
+ reg_rule->ant_gain, reg_rule->reg_power,
+ flags);
- ath11k_dbg(ab, ATH11K_DBG_REG,
- "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
- i + 1, ETSI_WEATHER_RADAR_BAND_HIGH, reg_rule->end_freq,
- bw, reg_rule->ant_gain, reg_rule->reg_power,
- regd->reg_rules[i].dfs_cac_ms,
- flags);
+ ath11k_dbg(ab, ATH11K_DBG_REG,
+ "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
+ i + 1, ETSI_WEATHER_RADAR_BAND_HIGH,
+ reg_rule->end_freq, bw, reg_rule->ant_gain,
+ reg_rule->reg_power, regd->reg_rules[i].dfs_cac_ms,
+ flags);
+ }
*rule_idx = i;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0142/1039] ath11k: clear the keys properly via DISABLE_KEY
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0141/1039] ath11k: Fix ETSI regd with weather radar overlap Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0143/1039] ath11k: reset RSN/WPA present state for open BSS Greg Kroah-Hartman
` (850 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Eckelmann,
Karthikeyan Kathirvel, Kalle Valo, Sasha Levin
From: Karthikeyan Kathirvel <kathirve@codeaurora.org>
[ Upstream commit 436a4e88659842a7cf634d7cc088c8f2cc94ebf5 ]
DISABLE_KEY sets the key_len to 0, firmware will not delete the keys if
key_len is 0. Changing from security mode to open mode will cause mcast
to be still encrypted without vdev restart.
Set the proper key_len for DISABLE_KEY cmd to clear the keys in
firmware.
Tested-on: IPQ6018 hw1.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Reported-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Karthikeyan Kathirvel <kathirve@codeaurora.org>
[sven@narfation.org: split into separate patches, clean up commit message]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211115100441.33771-1-sven@narfation.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/mac.c | 4 +---
drivers/net/wireless/ath/ath11k/wmi.c | 3 ++-
2 files changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 1cc55602787bb..cdee7545e876a 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -3316,9 +3316,7 @@ static int ath11k_install_key(struct ath11k_vif *arvif,
return 0;
if (cmd == DISABLE_KEY) {
- /* TODO: Check if FW expects value other than NONE for del */
- /* arg.key_cipher = WMI_CIPHER_NONE; */
- arg.key_len = 0;
+ arg.key_cipher = WMI_CIPHER_NONE;
arg.key_data = NULL;
goto install;
}
diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 04238c29419b5..621a63d6c8c6d 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -1689,7 +1689,8 @@ int ath11k_wmi_vdev_install_key(struct ath11k *ar,
tlv = (struct wmi_tlv *)(skb->data + sizeof(*cmd));
tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_BYTE) |
FIELD_PREP(WMI_TLV_LEN, key_len_aligned);
- memcpy(tlv->value, (u8 *)arg->key_data, key_len_aligned);
+ if (arg->key_data)
+ memcpy(tlv->value, (u8 *)arg->key_data, key_len_aligned);
ret = ath11k_wmi_cmd_send(wmi, skb, WMI_VDEV_INSTALL_KEY_CMDID);
if (ret) {
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0143/1039] ath11k: reset RSN/WPA present state for open BSS
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0142/1039] ath11k: clear the keys properly via DISABLE_KEY Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0144/1039] spi: hisi-kunpeng: Fix the debugfs directory name incorrect Greg Kroah-Hartman
` (849 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Venkateswara Naralasetty,
Sven Eckelmann, Karthikeyan Kathirvel, Kalle Valo, Sasha Levin
From: Karthikeyan Kathirvel <kathirve@codeaurora.org>
[ Upstream commit 64bc3aa02ae78b1fcb1b850e0eb1f0622002bfaa ]
The ath11k driver is caching the information about RSN/WPA IE in the
configured beacon template. The cached information is used during
associations to figure out whether 4-way PKT/2-way GTK peer flags need to
be set or not.
But the code never cleared the state when no such IE was found. This can
for example happen when moving from an WPA/RSN to an open setup. The
(seemingly connected) peer was then not able to communicate over the
link because the firmware assumed a different (encryption enabled) state
for the peer.
Tested-on: IPQ6018 hw1.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
Fixes: 01e34233c645 ("ath11k: fix wmi peer flags in peer assoc command")
Cc: Venkateswara Naralasetty <vnaralas@codeaurora.org>
Reported-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Karthikeyan Kathirvel <kathirve@codeaurora.org>
[sven@narfation.org: split into separate patches, clean up commit message]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211115100441.33771-2-sven@narfation.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/mac.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index cdee7545e876a..9ed7eb09bdb70 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -1137,11 +1137,15 @@ static int ath11k_mac_setup_bcn_tmpl(struct ath11k_vif *arvif)
if (cfg80211_find_ie(WLAN_EID_RSN, ies, (skb_tail_pointer(bcn) - ies)))
arvif->rsnie_present = true;
+ else
+ arvif->rsnie_present = false;
if (cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
WLAN_OUI_TYPE_MICROSOFT_WPA,
ies, (skb_tail_pointer(bcn) - ies)))
arvif->wpaie_present = true;
+ else
+ arvif->wpaie_present = false;
ret = ath11k_wmi_bcn_tmpl(ar, arvif->vdev_id, &offs, bcn);
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0144/1039] spi: hisi-kunpeng: Fix the debugfs directory name incorrect
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0143/1039] ath11k: reset RSN/WPA present state for open BSS Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0145/1039] tee: fix put order in teedev_close_context() Greg Kroah-Hartman
` (848 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, oujiefeng, Jay Fang, Mark Brown, Sasha Levin
From: oujiefeng <oujiefeng@huawei.com>
[ Upstream commit 40fafc8eca3f0d41b9dade5c10afb2dad723aad7 ]
Change the debugfs directory name from hisi_spi65535 to hisi_spi0.
Fixes: 2b2142f247eb ("spi: hisi-kunpeng: Add debugfs support")
Signed-off-by: oujiefeng <oujiefeng@huawei.com>
Signed-off-by: Jay Fang <f.fangjian@huawei.com>
Link: https://lore.kernel.org/r/20211117012119.55558-1-f.fangjian@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-hisi-kunpeng.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/spi/spi-hisi-kunpeng.c b/drivers/spi/spi-hisi-kunpeng.c
index 58b823a16fc4d..525cc0143a305 100644
--- a/drivers/spi/spi-hisi-kunpeng.c
+++ b/drivers/spi/spi-hisi-kunpeng.c
@@ -127,7 +127,6 @@ struct hisi_spi {
void __iomem *regs;
int irq;
u32 fifo_len; /* depth of the FIFO buffer */
- u16 bus_num;
/* Current message transfer state info */
const void *tx;
@@ -165,7 +164,10 @@ static int hisi_spi_debugfs_init(struct hisi_spi *hs)
{
char name[32];
- snprintf(name, 32, "hisi_spi%d", hs->bus_num);
+ struct spi_controller *master;
+
+ master = container_of(hs->dev, struct spi_controller, dev);
+ snprintf(name, 32, "hisi_spi%d", master->bus_num);
hs->debugfs = debugfs_create_dir(name, NULL);
if (!hs->debugfs)
return -ENOMEM;
@@ -467,7 +469,6 @@ static int hisi_spi_probe(struct platform_device *pdev)
hs = spi_controller_get_devdata(master);
hs->dev = dev;
hs->irq = irq;
- hs->bus_num = pdev->id;
hs->regs = devm_platform_ioremap_resource(pdev, 0);
if (IS_ERR(hs->regs))
@@ -490,7 +491,7 @@ static int hisi_spi_probe(struct platform_device *pdev)
master->use_gpio_descriptors = true;
master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH | SPI_LOOP;
master->bits_per_word_mask = SPI_BPW_RANGE_MASK(4, 32);
- master->bus_num = hs->bus_num;
+ master->bus_num = pdev->id;
master->setup = hisi_spi_setup;
master->cleanup = hisi_spi_cleanup;
master->transfer_one = hisi_spi_transfer_one;
@@ -506,15 +507,15 @@ static int hisi_spi_probe(struct platform_device *pdev)
return ret;
}
- if (hisi_spi_debugfs_init(hs))
- dev_info(dev, "failed to create debugfs dir\n");
-
ret = spi_register_controller(master);
if (ret) {
dev_err(dev, "failed to register spi master, ret=%d\n", ret);
return ret;
}
+ if (hisi_spi_debugfs_init(hs))
+ dev_info(dev, "failed to create debugfs dir\n");
+
dev_info(dev, "hw version:0x%x max-freq:%u kHz\n",
readl(hs->regs + HISI_SPI_VERSION),
master->max_speed_hz / 1000);
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0145/1039] tee: fix put order in teedev_close_context()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0144/1039] spi: hisi-kunpeng: Fix the debugfs directory name incorrect Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0146/1039] kernel/locking: Use a pointer in ww_mutex_trylock() Greg Kroah-Hartman
` (847 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sumit Garg, Jens Wiklander, Sasha Levin
From: Jens Wiklander <jens.wiklander@linaro.org>
[ Upstream commit f18397ab3ae23e8e43bba9986e66af6d4497f2ad ]
Prior to this patch was teedev_close_context() calling tee_device_put()
before teedev_ctx_put() leading to teedev_ctx_release() accessing
ctx->teedev just after the reference counter was decreased on the
teedev. Fix this by calling teedev_ctx_put() before tee_device_put().
Fixes: 217e0250cccb ("tee: use reference counting for tee_context")
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tee/tee_core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
index 2b37bc408fc3d..85102d12d7169 100644
--- a/drivers/tee/tee_core.c
+++ b/drivers/tee/tee_core.c
@@ -98,8 +98,10 @@ void teedev_ctx_put(struct tee_context *ctx)
static void teedev_close_context(struct tee_context *ctx)
{
- tee_device_put(ctx->teedev);
+ struct tee_device *teedev = ctx->teedev;
+
teedev_ctx_put(ctx);
+ tee_device_put(teedev);
}
static int tee_open(struct inode *inode, struct file *filp)
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0146/1039] kernel/locking: Use a pointer in ww_mutex_trylock().
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0145/1039] tee: fix put order in teedev_close_context() Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0147/1039] fs: dlm: fix build with CONFIG_IPV6 disabled Greg Kroah-Hartman
` (846 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior,
Peter Zijlstra (Intel),
Sasha Levin
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ Upstream commit 2202e15b2b1a946ce760d96748cd7477589701ab ]
mutex_acquire_nest() expects a pointer, pass the pointer.
Fixes: 12235da8c80a1 ("kernel/locking: Add context to ww_mutex_trylock()")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20211104122706.frk52zxbjorso2kv@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/locking/ww_rt_mutex.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/locking/ww_rt_mutex.c b/kernel/locking/ww_rt_mutex.c
index 0e00205cf467a..d1473c624105c 100644
--- a/kernel/locking/ww_rt_mutex.c
+++ b/kernel/locking/ww_rt_mutex.c
@@ -26,7 +26,7 @@ int ww_mutex_trylock(struct ww_mutex *lock, struct ww_acquire_ctx *ww_ctx)
if (__rt_mutex_trylock(&rtm->rtmutex)) {
ww_mutex_set_context_fastpath(lock, ww_ctx);
- mutex_acquire_nest(&rtm->dep_map, 0, 1, ww_ctx->dep_map, _RET_IP_);
+ mutex_acquire_nest(&rtm->dep_map, 0, 1, &ww_ctx->dep_map, _RET_IP_);
return 1;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0147/1039] fs: dlm: fix build with CONFIG_IPV6 disabled
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0146/1039] kernel/locking: Use a pointer in ww_mutex_trylock() Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0148/1039] drm/dp: Dont read back backlight mode in drm_edp_backlight_enable() Greg Kroah-Hartman
` (845 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kernel test robot, Alexander Aring,
David Teigland, Sasha Levin
From: Alexander Aring <aahringo@redhat.com>
[ Upstream commit 1b9beda83e27a0c2cd75d1cb743c297c7b36c844 ]
This patch will surround the AF_INET6 case in sk_error_report() of dlm
with a #if IS_ENABLED(CONFIG_IPV6). The field sk->sk_v6_daddr is not
defined when CONFIG_IPV6 is disabled. If CONFIG_IPV6 is disabled, the
socket creation with AF_INET6 should already fail because a runtime
check if AF_INET6 is registered. However if there is the possibility
that AF_INET6 is set as sk_family the sk_error_report() callback will
print then an invalid family type error.
Reported-by: kernel test robot <lkp@intel.com>
Fixes: 4c3d90570bcc ("fs: dlm: don't call kernel_getpeername() in error_report()")
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/dlm/lowcomms.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index 7b1c5f05a988b..7a8efce1c343e 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -612,6 +612,7 @@ static void lowcomms_error_report(struct sock *sk)
ntohs(inet->inet_dport), sk->sk_err,
sk->sk_err_soft);
break;
+#if IS_ENABLED(CONFIG_IPV6)
case AF_INET6:
printk_ratelimited(KERN_ERR "dlm: node %d: socket error "
"sending to node %d at %pI6c, "
@@ -620,6 +621,7 @@ static void lowcomms_error_report(struct sock *sk)
ntohs(inet->inet_dport), sk->sk_err,
sk->sk_err_soft);
break;
+#endif
default:
printk_ratelimited(KERN_ERR "dlm: node %d: socket error "
"invalid socket family %d set, "
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0148/1039] drm/dp: Dont read back backlight mode in drm_edp_backlight_enable()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0147/1039] fs: dlm: fix build with CONFIG_IPV6 disabled Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0149/1039] selftests/bpf: Fix xdpxceiver failures for no hugepages Greg Kroah-Hartman
` (844 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lyude Paul, Douglas Anderson, Sasha Levin
From: Lyude Paul <lyude@redhat.com>
[ Upstream commit 646596485e1ed2182adf293dfd5aec4a96c46330 ]
As it turns out, apparently some machines will actually leave additional
backlight functionality like dynamic backlight control on before the OS
loads. Currently we don't take care to disable unsupported features when
writing back the backlight mode, which can lead to some rather strange
looking behavior when adjusting the backlight.
So, let's fix this by just not reading back the current backlight mode on
initial enable. I don't think there should really be any downsides to this,
and this will ensure we don't leave any unsupported functionality enabled.
This should fix at least one (but not all) of the issues seen with DPCD
backlight support on fi-bdw-samus
v5:
* Just avoid reading back DPCD register - Doug Anderson
Signed-off-by: Lyude Paul <lyude@redhat.com>
Fixes: 867cf9cd73c3 ("drm/dp: Extract i915's eDP backlight code into DRM helpers")
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20211105183342.130810-4-lyude@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_dp_helper.c | 40 ++++++++++-----------------------
1 file changed, 12 insertions(+), 28 deletions(-)
diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c
index 4d0d1e8e51fa7..db7db839e42d1 100644
--- a/drivers/gpu/drm/drm_dp_helper.c
+++ b/drivers/gpu/drm/drm_dp_helper.c
@@ -3246,27 +3246,13 @@ int drm_edp_backlight_enable(struct drm_dp_aux *aux, const struct drm_edp_backli
const u16 level)
{
int ret;
- u8 dpcd_buf, new_dpcd_buf;
+ u8 dpcd_buf = DP_EDP_BACKLIGHT_CONTROL_MODE_DPCD;
- ret = drm_dp_dpcd_readb(aux, DP_EDP_BACKLIGHT_MODE_SET_REGISTER, &dpcd_buf);
- if (ret != 1) {
- drm_dbg_kms(aux->drm_dev,
- "%s: Failed to read backlight mode: %d\n", aux->name, ret);
- return ret < 0 ? ret : -EIO;
- }
-
- new_dpcd_buf = dpcd_buf;
-
- if ((dpcd_buf & DP_EDP_BACKLIGHT_CONTROL_MODE_MASK) != DP_EDP_BACKLIGHT_CONTROL_MODE_DPCD) {
- new_dpcd_buf &= ~DP_EDP_BACKLIGHT_CONTROL_MODE_MASK;
- new_dpcd_buf |= DP_EDP_BACKLIGHT_CONTROL_MODE_DPCD;
-
- if (bl->pwmgen_bit_count) {
- ret = drm_dp_dpcd_writeb(aux, DP_EDP_PWMGEN_BIT_COUNT, bl->pwmgen_bit_count);
- if (ret != 1)
- drm_dbg_kms(aux->drm_dev, "%s: Failed to write aux pwmgen bit count: %d\n",
- aux->name, ret);
- }
+ if (bl->pwmgen_bit_count) {
+ ret = drm_dp_dpcd_writeb(aux, DP_EDP_PWMGEN_BIT_COUNT, bl->pwmgen_bit_count);
+ if (ret != 1)
+ drm_dbg_kms(aux->drm_dev, "%s: Failed to write aux pwmgen bit count: %d\n",
+ aux->name, ret);
}
if (bl->pwm_freq_pre_divider) {
@@ -3276,16 +3262,14 @@ int drm_edp_backlight_enable(struct drm_dp_aux *aux, const struct drm_edp_backli
"%s: Failed to write aux backlight frequency: %d\n",
aux->name, ret);
else
- new_dpcd_buf |= DP_EDP_BACKLIGHT_FREQ_AUX_SET_ENABLE;
+ dpcd_buf |= DP_EDP_BACKLIGHT_FREQ_AUX_SET_ENABLE;
}
- if (new_dpcd_buf != dpcd_buf) {
- ret = drm_dp_dpcd_writeb(aux, DP_EDP_BACKLIGHT_MODE_SET_REGISTER, new_dpcd_buf);
- if (ret != 1) {
- drm_dbg_kms(aux->drm_dev, "%s: Failed to write aux backlight mode: %d\n",
- aux->name, ret);
- return ret < 0 ? ret : -EIO;
- }
+ ret = drm_dp_dpcd_writeb(aux, DP_EDP_BACKLIGHT_MODE_SET_REGISTER, dpcd_buf);
+ if (ret != 1) {
+ drm_dbg_kms(aux->drm_dev, "%s: Failed to write aux backlight mode: %d\n",
+ aux->name, ret);
+ return ret < 0 ? ret : -EIO;
}
ret = drm_edp_backlight_set_level(aux, bl, level);
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0149/1039] selftests/bpf: Fix xdpxceiver failures for no hugepages
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0148/1039] drm/dp: Dont read back backlight mode in drm_edp_backlight_enable() Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0150/1039] mctp/test: Update refcount checking in route fragment tests Greg Kroah-Hartman
` (843 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tirthendu Sarkar, Daniel Borkmann,
Sasha Levin
From: Tirthendu Sarkar <tirthendu.sarkar@intel.com>
[ Upstream commit dd7f091fd22b1dce6c20e8f7769aa068ed88ac6d ]
xsk_configure_umem() needs hugepages to work in unaligned mode. So when
hugepages are not configured, 'unaligned' tests should be skipped which
is determined by the helper function hugepages_present(). This function
erroneously returns true with MAP_NORESERVE flag even when no hugepages
are configured. The removal of this flag fixes the issue.
The test TEST_TYPE_UNALIGNED_INV_DESC also needs to be skipped when
there are no hugepages. However, this was not skipped as there was no
check for presence of hugepages and hence was failing. The check to skip
the test has now been added.
Fixes: a4ba98dd0c69 (selftests: xsk: Add test for unaligned mode)
Signed-off-by: Tirthendu Sarkar <tirthendu.sarkar@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20211117123613.22288-1-tirthendu.sarkar@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/xdpxceiver.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/xdpxceiver.c b/tools/testing/selftests/bpf/xdpxceiver.c
index 6c7cf8aadc792..621342ec30c48 100644
--- a/tools/testing/selftests/bpf/xdpxceiver.c
+++ b/tools/testing/selftests/bpf/xdpxceiver.c
@@ -1219,7 +1219,7 @@ static bool hugepages_present(struct ifobject *ifobject)
void *bufs;
bufs = mmap(NULL, mmap_sz, PROT_READ | PROT_WRITE,
- MAP_PRIVATE | MAP_ANONYMOUS | MAP_NORESERVE | MAP_HUGETLB, -1, 0);
+ MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB, -1, 0);
if (bufs == MAP_FAILED)
return false;
@@ -1366,6 +1366,10 @@ static void run_pkt_test(struct test_spec *test, enum test_mode mode, enum test_
testapp_invalid_desc(test);
break;
case TEST_TYPE_UNALIGNED_INV_DESC:
+ if (!hugepages_present(test->ifobj_tx)) {
+ ksft_test_result_skip("No 2M huge pages present.\n");
+ return;
+ }
test_spec_set_name(test, "UNALIGNED_INV_DESC");
test->ifobj_tx->umem->unaligned_mode = true;
test->ifobj_rx->umem->unaligned_mode = true;
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0150/1039] mctp/test: Update refcount checking in route fragment tests
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0149/1039] selftests/bpf: Fix xdpxceiver failures for no hugepages Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0151/1039] drm/vboxvideo: fix a NULL vs IS_ERR() check Greg Kroah-Hartman
` (842 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jeremy Kerr, David S. Miller, Sasha Levin
From: Jeremy Kerr <jk@codeconstruct.com.au>
[ Upstream commit f6ef47e5bdc6f652176e433b02317fc83049f8d7 ]
In 99ce45d5e, we moved a route refcount decrement from
mctp_do_fragment_route into the caller. This invalidates the assumption
that the route test makes about refcount behaviour, so the route tests
fail.
This change fixes the test case to suit the new refcount behaviour.
Fixes: 99ce45d5e7db ("mctp: Implement extended addressing")
Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mctp/test/route-test.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/net/mctp/test/route-test.c b/net/mctp/test/route-test.c
index 36fac3daf86a4..86ad15abf8978 100644
--- a/net/mctp/test/route-test.c
+++ b/net/mctp/test/route-test.c
@@ -150,11 +150,6 @@ static void mctp_test_fragment(struct kunit *test)
rt = mctp_test_create_route(&init_net, NULL, 10, mtu);
KUNIT_ASSERT_TRUE(test, rt);
- /* The refcount would usually be incremented as part of a route lookup,
- * but we're setting the route directly here.
- */
- refcount_inc(&rt->rt.refs);
-
rc = mctp_do_fragment_route(&rt->rt, skb, mtu, MCTP_TAG_OWNER);
KUNIT_EXPECT_FALSE(test, rc);
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0151/1039] drm/vboxvideo: fix a NULL vs IS_ERR() check
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0150/1039] mctp/test: Update refcount checking in route fragment tests Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0152/1039] ath11k: set correct NL80211_FEATURE_DYNAMIC_SMPS for WCN6855 Greg Kroah-Hartman
` (841 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Hans de Goede, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit cebbb5c46d0cb0615fd0c62dea9b44273d0a9780 ]
The devm_gen_pool_create() function never returns NULL, it returns
error pointers.
Fixes: 4cc9b565454b ("drm/vboxvideo: Use devm_gen_pool_create")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20211118111233.GA1147@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vboxvideo/vbox_main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/vboxvideo/vbox_main.c b/drivers/gpu/drm/vboxvideo/vbox_main.c
index f28779715ccda..c9e8b3a63c621 100644
--- a/drivers/gpu/drm/vboxvideo/vbox_main.c
+++ b/drivers/gpu/drm/vboxvideo/vbox_main.c
@@ -127,8 +127,8 @@ int vbox_hw_init(struct vbox_private *vbox)
/* Create guest-heap mem-pool use 2^4 = 16 byte chunks */
vbox->guest_pool = devm_gen_pool_create(vbox->ddev.dev, 4, -1,
"vboxvideo-accel");
- if (!vbox->guest_pool)
- return -ENOMEM;
+ if (IS_ERR(vbox->guest_pool))
+ return PTR_ERR(vbox->guest_pool);
ret = gen_pool_add_virt(vbox->guest_pool,
(unsigned long)vbox->guest_heap,
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0152/1039] ath11k: set correct NL80211_FEATURE_DYNAMIC_SMPS for WCN6855
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0151/1039] drm/vboxvideo: fix a NULL vs IS_ERR() check Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0153/1039] ath11k: allocate dst ring descriptors from cacheable memory Greg Kroah-Hartman
` (840 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wen Gong, Jouni Malinen, Kalle Valo,
Sasha Levin
From: Wen Gong <wgong@codeaurora.org>
[ Upstream commit 82c434c103408842a87404e873992b7698b6df2b ]
Commit 6f4d70308e5e ("ath11k: support SMPS configuration for 6 GHz") changed
"if (ht_cap & WMI_HT_CAP_DYNAMIC_SMPS)" to "if (ht_cap &
WMI_HT_CAP_DYNAMIC_SMPS || ar->supports_6ghz)" which means
NL80211_FEATURE_DYNAMIC_SMPS is enabled for all chips which support 6 GHz.
However, WCN6855 supports 6 GHz but it does not support feature
NL80211_FEATURE_DYNAMIC_SMPS, and this can lead to MU-MIMO test failures for
WCN6855.
Disable NL80211_FEATURE_DYNAMIC_SMPS for WCN6855 since its ht_cap does not
support WMI_HT_CAP_DYNAMIC_SMPS. Enable the feature only on QCN9074 as that's
the only other device supporting 6 GHz band.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
Signed-off-by: Wen Gong <wgong@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210914163726.38604-3-jouni@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/core.c | 5 +++++
drivers/net/wireless/ath/ath11k/hw.h | 1 +
drivers/net/wireless/ath/ath11k/mac.c | 3 ++-
3 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c
index b5a2af3ffc3e1..7ee2ccc49c747 100644
--- a/drivers/net/wireless/ath/ath11k/core.c
+++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -82,6 +82,7 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {
.fix_l1ss = true,
.max_tx_ring = DP_TCL_NUM_RING_MAX,
.hal_params = &ath11k_hw_hal_params_ipq8074,
+ .supports_dynamic_smps_6ghz = false,
},
{
.hw_rev = ATH11K_HW_IPQ6018_HW10,
@@ -131,6 +132,7 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {
.fix_l1ss = true,
.max_tx_ring = DP_TCL_NUM_RING_MAX,
.hal_params = &ath11k_hw_hal_params_ipq8074,
+ .supports_dynamic_smps_6ghz = false,
},
{
.name = "qca6390 hw2.0",
@@ -179,6 +181,7 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {
.fix_l1ss = true,
.max_tx_ring = DP_TCL_NUM_RING_MAX_QCA6390,
.hal_params = &ath11k_hw_hal_params_qca6390,
+ .supports_dynamic_smps_6ghz = false,
},
{
.name = "qcn9074 hw1.0",
@@ -227,6 +230,7 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {
.fix_l1ss = true,
.max_tx_ring = DP_TCL_NUM_RING_MAX,
.hal_params = &ath11k_hw_hal_params_ipq8074,
+ .supports_dynamic_smps_6ghz = true,
},
{
.name = "wcn6855 hw2.0",
@@ -275,6 +279,7 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {
.fix_l1ss = false,
.max_tx_ring = DP_TCL_NUM_RING_MAX_QCA6390,
.hal_params = &ath11k_hw_hal_params_qca6390,
+ .supports_dynamic_smps_6ghz = false,
},
};
diff --git a/drivers/net/wireless/ath/ath11k/hw.h b/drivers/net/wireless/ath/ath11k/hw.h
index 19223d36846e8..6dcac596e3fe5 100644
--- a/drivers/net/wireless/ath/ath11k/hw.h
+++ b/drivers/net/wireless/ath/ath11k/hw.h
@@ -176,6 +176,7 @@ struct ath11k_hw_params {
bool fix_l1ss;
u8 max_tx_ring;
const struct ath11k_hw_hal_params *hal_params;
+ bool supports_dynamic_smps_6ghz;
};
struct ath11k_hw_ops {
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 9ed7eb09bdb70..821332cbeb5de 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -7674,7 +7674,8 @@ static int __ath11k_mac_register(struct ath11k *ar)
* for each band for a dual band capable radio. It will be tricky to
* handle it when the ht capability different for each band.
*/
- if (ht_cap & WMI_HT_CAP_DYNAMIC_SMPS || ar->supports_6ghz)
+ if (ht_cap & WMI_HT_CAP_DYNAMIC_SMPS ||
+ (ar->supports_6ghz && ab->hw_params.supports_dynamic_smps_6ghz))
ar->hw->wiphy->features |= NL80211_FEATURE_DYNAMIC_SMPS;
ar->hw->wiphy->max_scan_ssids = WLAN_SCAN_PARAMS_MAX_SSID;
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0153/1039] ath11k: allocate dst ring descriptors from cacheable memory
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0152/1039] ath11k: set correct NL80211_FEATURE_DYNAMIC_SMPS for WCN6855 Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0154/1039] ath11k: add hw_param for wakeup_mhi Greg Kroah-Hartman
` (839 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pradeep Kumar Chitrapu, Sriram R,
Jouni Malinen, P Praneesh, Kalle Valo, Sasha Levin
From: P Praneesh <ppranees@codeaurora.org>
[ Upstream commit 6452f0a3d5651bb7edfd9c709e78973aaa4d3bfc ]
tcl_data and reo_dst rings are currently being allocated using
dma_allocate_coherent() which is non cacheable.
Allocating ring memory from cacheable memory area allows cached descriptor
access and prefetch next descriptors to optimize CPU usage during
descriptor processing on NAPI. Based on the hardware param we can enable
or disable this feature for the corresponding platform.
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1.r2-00012-QCAHKSWPL_SILICONZ-1
Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01695-QCAHKSWPL_SILICONZ-1
Co-developed-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
Co-developed-by: Sriram R <srirrama@codeaurora.org>
Signed-off-by: Sriram R <srirrama@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Signed-off-by: P Praneesh <ppranees@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1630560820-21905-3-git-send-email-ppranees@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/core.c | 5 ++++
drivers/net/wireless/ath/ath11k/dp.c | 38 ++++++++++++++++++++++----
drivers/net/wireless/ath/ath11k/dp.h | 1 +
drivers/net/wireless/ath/ath11k/hal.c | 28 +++++++++++++++++--
drivers/net/wireless/ath/ath11k/hal.h | 1 +
drivers/net/wireless/ath/ath11k/hw.h | 1 +
6 files changed, 67 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c
index 7ee2ccc49c747..280f1c6411aeb 100644
--- a/drivers/net/wireless/ath/ath11k/core.c
+++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -83,6 +83,7 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {
.max_tx_ring = DP_TCL_NUM_RING_MAX,
.hal_params = &ath11k_hw_hal_params_ipq8074,
.supports_dynamic_smps_6ghz = false,
+ .alloc_cacheable_memory = true,
},
{
.hw_rev = ATH11K_HW_IPQ6018_HW10,
@@ -133,6 +134,7 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {
.max_tx_ring = DP_TCL_NUM_RING_MAX,
.hal_params = &ath11k_hw_hal_params_ipq8074,
.supports_dynamic_smps_6ghz = false,
+ .alloc_cacheable_memory = true,
},
{
.name = "qca6390 hw2.0",
@@ -182,6 +184,7 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {
.max_tx_ring = DP_TCL_NUM_RING_MAX_QCA6390,
.hal_params = &ath11k_hw_hal_params_qca6390,
.supports_dynamic_smps_6ghz = false,
+ .alloc_cacheable_memory = false,
},
{
.name = "qcn9074 hw1.0",
@@ -231,6 +234,7 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {
.max_tx_ring = DP_TCL_NUM_RING_MAX,
.hal_params = &ath11k_hw_hal_params_ipq8074,
.supports_dynamic_smps_6ghz = true,
+ .alloc_cacheable_memory = true,
},
{
.name = "wcn6855 hw2.0",
@@ -280,6 +284,7 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {
.max_tx_ring = DP_TCL_NUM_RING_MAX_QCA6390,
.hal_params = &ath11k_hw_hal_params_qca6390,
.supports_dynamic_smps_6ghz = false,
+ .alloc_cacheable_memory = false,
},
};
diff --git a/drivers/net/wireless/ath/ath11k/dp.c b/drivers/net/wireless/ath/ath11k/dp.c
index 8baaeeb8cf821..8058b56028ded 100644
--- a/drivers/net/wireless/ath/ath11k/dp.c
+++ b/drivers/net/wireless/ath/ath11k/dp.c
@@ -101,8 +101,11 @@ void ath11k_dp_srng_cleanup(struct ath11k_base *ab, struct dp_srng *ring)
if (!ring->vaddr_unaligned)
return;
- dma_free_coherent(ab->dev, ring->size, ring->vaddr_unaligned,
- ring->paddr_unaligned);
+ if (ring->cached)
+ kfree(ring->vaddr_unaligned);
+ else
+ dma_free_coherent(ab->dev, ring->size, ring->vaddr_unaligned,
+ ring->paddr_unaligned);
ring->vaddr_unaligned = NULL;
}
@@ -222,6 +225,7 @@ int ath11k_dp_srng_setup(struct ath11k_base *ab, struct dp_srng *ring,
int entry_sz = ath11k_hal_srng_get_entrysize(ab, type);
int max_entries = ath11k_hal_srng_get_max_entries(ab, type);
int ret;
+ bool cached = false;
if (max_entries < 0 || entry_sz < 0)
return -EINVAL;
@@ -230,9 +234,28 @@ int ath11k_dp_srng_setup(struct ath11k_base *ab, struct dp_srng *ring,
num_entries = max_entries;
ring->size = (num_entries * entry_sz) + HAL_RING_BASE_ALIGN - 1;
- ring->vaddr_unaligned = dma_alloc_coherent(ab->dev, ring->size,
- &ring->paddr_unaligned,
- GFP_KERNEL);
+
+ if (ab->hw_params.alloc_cacheable_memory) {
+ /* Allocate the reo dst and tx completion rings from cacheable memory */
+ switch (type) {
+ case HAL_REO_DST:
+ cached = true;
+ break;
+ default:
+ cached = false;
+ }
+
+ if (cached) {
+ ring->vaddr_unaligned = kzalloc(ring->size, GFP_KERNEL);
+ ring->paddr_unaligned = virt_to_phys(ring->vaddr_unaligned);
+ }
+ }
+
+ if (!cached)
+ ring->vaddr_unaligned = dma_alloc_coherent(ab->dev, ring->size,
+ &ring->paddr_unaligned,
+ GFP_KERNEL);
+
if (!ring->vaddr_unaligned)
return -ENOMEM;
@@ -292,6 +315,11 @@ int ath11k_dp_srng_setup(struct ath11k_base *ab, struct dp_srng *ring,
return -EINVAL;
}
+ if (cached) {
+ params.flags |= HAL_SRNG_FLAGS_CACHED;
+ ring->cached = 1;
+ }
+
ret = ath11k_hal_srng_setup(ab, type, ring_num, mac_id, ¶ms);
if (ret < 0) {
ath11k_warn(ab, "failed to setup srng: %d ring_id %d\n",
diff --git a/drivers/net/wireless/ath/ath11k/dp.h b/drivers/net/wireless/ath/ath11k/dp.h
index f524d19aca349..a4c36a9be338a 100644
--- a/drivers/net/wireless/ath/ath11k/dp.h
+++ b/drivers/net/wireless/ath/ath11k/dp.h
@@ -64,6 +64,7 @@ struct dp_srng {
dma_addr_t paddr;
int size;
u32 ring_id;
+ u8 cached;
};
struct dp_rxdma_ring {
diff --git a/drivers/net/wireless/ath/ath11k/hal.c b/drivers/net/wireless/ath/ath11k/hal.c
index eaa0edca55761..f04edafbd0f15 100644
--- a/drivers/net/wireless/ath/ath11k/hal.c
+++ b/drivers/net/wireless/ath/ath11k/hal.c
@@ -627,6 +627,21 @@ u32 *ath11k_hal_srng_dst_peek(struct ath11k_base *ab, struct hal_srng *srng)
return NULL;
}
+static void ath11k_hal_srng_prefetch_desc(struct ath11k_base *ab,
+ struct hal_srng *srng)
+{
+ u32 *desc;
+
+ /* prefetch only if desc is available */
+ desc = ath11k_hal_srng_dst_peek(ab, srng);
+ if (likely(desc)) {
+ dma_sync_single_for_cpu(ab->dev, virt_to_phys(desc),
+ (srng->entry_size * sizeof(u32)),
+ DMA_FROM_DEVICE);
+ prefetch(desc);
+ }
+}
+
u32 *ath11k_hal_srng_dst_get_next_entry(struct ath11k_base *ab,
struct hal_srng *srng)
{
@@ -642,6 +657,10 @@ u32 *ath11k_hal_srng_dst_get_next_entry(struct ath11k_base *ab,
srng->u.dst_ring.tp = (srng->u.dst_ring.tp + srng->entry_size) %
srng->ring_size;
+ /* Try to prefetch the next descriptor in the ring */
+ if (srng->flags & HAL_SRNG_FLAGS_CACHED)
+ ath11k_hal_srng_prefetch_desc(ab, srng);
+
return desc;
}
@@ -775,11 +794,16 @@ void ath11k_hal_srng_access_begin(struct ath11k_base *ab, struct hal_srng *srng)
{
lockdep_assert_held(&srng->lock);
- if (srng->ring_dir == HAL_SRNG_DIR_SRC)
+ if (srng->ring_dir == HAL_SRNG_DIR_SRC) {
srng->u.src_ring.cached_tp =
*(volatile u32 *)srng->u.src_ring.tp_addr;
- else
+ } else {
srng->u.dst_ring.cached_hp = *srng->u.dst_ring.hp_addr;
+
+ /* Try to prefetch the next descriptor in the ring */
+ if (srng->flags & HAL_SRNG_FLAGS_CACHED)
+ ath11k_hal_srng_prefetch_desc(ab, srng);
+ }
}
/* Update cached ring head/tail pointers to HW. ath11k_hal_srng_access_begin()
diff --git a/drivers/net/wireless/ath/ath11k/hal.h b/drivers/net/wireless/ath/ath11k/hal.h
index 35ed3a14e200a..0f4f9ce74354b 100644
--- a/drivers/net/wireless/ath/ath11k/hal.h
+++ b/drivers/net/wireless/ath/ath11k/hal.h
@@ -513,6 +513,7 @@ enum hal_srng_dir {
#define HAL_SRNG_FLAGS_DATA_TLV_SWAP 0x00000020
#define HAL_SRNG_FLAGS_LOW_THRESH_INTR_EN 0x00010000
#define HAL_SRNG_FLAGS_MSI_INTR 0x00020000
+#define HAL_SRNG_FLAGS_CACHED 0x20000000
#define HAL_SRNG_FLAGS_LMAC_RING 0x80000000
#define HAL_SRNG_TLV_HDR_TAG GENMASK(9, 1)
diff --git a/drivers/net/wireless/ath/ath11k/hw.h b/drivers/net/wireless/ath/ath11k/hw.h
index 6dcac596e3fe5..de9e9546f2ec6 100644
--- a/drivers/net/wireless/ath/ath11k/hw.h
+++ b/drivers/net/wireless/ath/ath11k/hw.h
@@ -177,6 +177,7 @@ struct ath11k_hw_params {
u8 max_tx_ring;
const struct ath11k_hw_hal_params *hal_params;
bool supports_dynamic_smps_6ghz;
+ bool alloc_cacheable_memory;
};
struct ath11k_hw_ops {
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0154/1039] ath11k: add hw_param for wakeup_mhi
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0153/1039] ath11k: allocate dst ring descriptors from cacheable memory Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0155/1039] arm64: dts: renesas: cat875: Add rx/tx delays Greg Kroah-Hartman
` (838 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Seevalamuthu Mariappan, Kalle Valo,
Sasha Levin
From: Seevalamuthu Mariappan <quic_seevalam@quicinc.com>
[ Upstream commit 081e2d6476e30399433b509684d5da4d1844e430 ]
Wakeup mhi is needed before pci_read/write only for QCA6390 and WCN6855. Since
wakeup & release mhi is enabled for all hardwares, below mhi assert is seen in
QCN9074 when doing 'rmmod ath11k_pci':
Kernel panic - not syncing: dev_wake != 0
CPU: 2 PID: 13535 Comm: procd Not tainted 4.4.60 #1
Hardware name: Generic DT based system
[<80316dac>] (unwind_backtrace) from [<80313700>] (show_stack+0x10/0x14)
[<80313700>] (show_stack) from [<805135dc>] (dump_stack+0x7c/0x9c)
[<805135dc>] (dump_stack) from [<8032136c>] (panic+0x84/0x1f8)
[<8032136c>] (panic) from [<80549b24>] (mhi_pm_disable_transition+0x3b8/0x5b8)
[<80549b24>] (mhi_pm_disable_transition) from [<80549ddc>] (mhi_power_down+0xb8/0x100)
[<80549ddc>] (mhi_power_down) from [<7f5242b0>] (ath11k_mhi_op_status_cb+0x284/0x3ac [ath11k_pci])
[E][__mhi_device_get_sync] Did not enter M0 state, cur_state:RESET pm_state:SHUTDOWN Process
[E][__mhi_device_get_sync] Did not enter M0 state, cur_state:RESET pm_state:SHUTDOWN Process
[E][__mhi_device_get_sync] Did not enter M0 state, cur_state:RESET pm_state:SHUTDOWN Process
[<7f5242b0>] (ath11k_mhi_op_status_cb [ath11k_pci]) from [<7f524878>] (ath11k_mhi_stop+0x10/0x20 [ath11k_pci])
[<7f524878>] (ath11k_mhi_stop [ath11k_pci]) from [<7f525b94>] (ath11k_pci_power_down+0x54/0x90 [ath11k_pci])
[<7f525b94>] (ath11k_pci_power_down [ath11k_pci]) from [<8056b2a8>] (pci_device_shutdown+0x30/0x44)
[<8056b2a8>] (pci_device_shutdown) from [<805cfa0c>] (device_shutdown+0x124/0x174)
[<805cfa0c>] (device_shutdown) from [<8033aaa4>] (kernel_restart+0xc/0x50)
[<8033aaa4>] (kernel_restart) from [<8033ada8>] (SyS_reboot+0x178/0x1ec)
[<8033ada8>] (SyS_reboot) from [<80301b80>] (ret_fast_syscall+0x0/0x34)
Hence, disable wakeup/release mhi using hw_param for other hardwares.
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01060-QCAHKSWPL_SILICONZ-1
Fixes: a05bd8513335 ("ath11k: read and write registers below unwindowed address")
Signed-off-by: Seevalamuthu Mariappan <quic_seevalam@quicinc.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1636702019-26142-1-git-send-email-quic_seevalam@quicinc.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/core.c | 5 +++++
drivers/net/wireless/ath/ath11k/hw.h | 1 +
drivers/net/wireless/ath/ath11k/pci.c | 12 ++++++++----
3 files changed, 14 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c
index 280f1c6411aeb..638dc97669df2 100644
--- a/drivers/net/wireless/ath/ath11k/core.c
+++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -84,6 +84,7 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {
.hal_params = &ath11k_hw_hal_params_ipq8074,
.supports_dynamic_smps_6ghz = false,
.alloc_cacheable_memory = true,
+ .wakeup_mhi = false,
},
{
.hw_rev = ATH11K_HW_IPQ6018_HW10,
@@ -135,6 +136,7 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {
.hal_params = &ath11k_hw_hal_params_ipq8074,
.supports_dynamic_smps_6ghz = false,
.alloc_cacheable_memory = true,
+ .wakeup_mhi = false,
},
{
.name = "qca6390 hw2.0",
@@ -185,6 +187,7 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {
.hal_params = &ath11k_hw_hal_params_qca6390,
.supports_dynamic_smps_6ghz = false,
.alloc_cacheable_memory = false,
+ .wakeup_mhi = true,
},
{
.name = "qcn9074 hw1.0",
@@ -235,6 +238,7 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {
.hal_params = &ath11k_hw_hal_params_ipq8074,
.supports_dynamic_smps_6ghz = true,
.alloc_cacheable_memory = true,
+ .wakeup_mhi = false,
},
{
.name = "wcn6855 hw2.0",
@@ -285,6 +289,7 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {
.hal_params = &ath11k_hw_hal_params_qca6390,
.supports_dynamic_smps_6ghz = false,
.alloc_cacheable_memory = false,
+ .wakeup_mhi = true,
},
};
diff --git a/drivers/net/wireless/ath/ath11k/hw.h b/drivers/net/wireless/ath/ath11k/hw.h
index de9e9546f2ec6..aa93f0619f936 100644
--- a/drivers/net/wireless/ath/ath11k/hw.h
+++ b/drivers/net/wireless/ath/ath11k/hw.h
@@ -178,6 +178,7 @@ struct ath11k_hw_params {
const struct ath11k_hw_hal_params *hal_params;
bool supports_dynamic_smps_6ghz;
bool alloc_cacheable_memory;
+ bool wakeup_mhi;
};
struct ath11k_hw_ops {
diff --git a/drivers/net/wireless/ath/ath11k/pci.c b/drivers/net/wireless/ath/ath11k/pci.c
index 3d353e7c9d5c2..fadded5ef84b2 100644
--- a/drivers/net/wireless/ath/ath11k/pci.c
+++ b/drivers/net/wireless/ath/ath11k/pci.c
@@ -182,7 +182,8 @@ void ath11k_pci_write32(struct ath11k_base *ab, u32 offset, u32 value)
/* for offset beyond BAR + 4K - 32, may
* need to wakeup MHI to access.
*/
- if (test_bit(ATH11K_PCI_FLAG_INIT_DONE, &ab_pci->flags) &&
+ if (ab->hw_params.wakeup_mhi &&
+ test_bit(ATH11K_PCI_FLAG_INIT_DONE, &ab_pci->flags) &&
offset >= ACCESS_ALWAYS_OFF)
mhi_device_get_sync(ab_pci->mhi_ctrl->mhi_dev);
@@ -206,7 +207,8 @@ void ath11k_pci_write32(struct ath11k_base *ab, u32 offset, u32 value)
}
}
- if (test_bit(ATH11K_PCI_FLAG_INIT_DONE, &ab_pci->flags) &&
+ if (ab->hw_params.wakeup_mhi &&
+ test_bit(ATH11K_PCI_FLAG_INIT_DONE, &ab_pci->flags) &&
offset >= ACCESS_ALWAYS_OFF)
mhi_device_put(ab_pci->mhi_ctrl->mhi_dev);
}
@@ -219,7 +221,8 @@ u32 ath11k_pci_read32(struct ath11k_base *ab, u32 offset)
/* for offset beyond BAR + 4K - 32, may
* need to wakeup MHI to access.
*/
- if (test_bit(ATH11K_PCI_FLAG_INIT_DONE, &ab_pci->flags) &&
+ if (ab->hw_params.wakeup_mhi &&
+ test_bit(ATH11K_PCI_FLAG_INIT_DONE, &ab_pci->flags) &&
offset >= ACCESS_ALWAYS_OFF)
mhi_device_get_sync(ab_pci->mhi_ctrl->mhi_dev);
@@ -243,7 +246,8 @@ u32 ath11k_pci_read32(struct ath11k_base *ab, u32 offset)
}
}
- if (test_bit(ATH11K_PCI_FLAG_INIT_DONE, &ab_pci->flags) &&
+ if (ab->hw_params.wakeup_mhi &&
+ test_bit(ATH11K_PCI_FLAG_INIT_DONE, &ab_pci->flags) &&
offset >= ACCESS_ALWAYS_OFF)
mhi_device_put(ab_pci->mhi_ctrl->mhi_dev);
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0155/1039] arm64: dts: renesas: cat875: Add rx/tx delays
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0154/1039] ath11k: add hw_param for wakeup_mhi Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0156/1039] media: dmxdev: fix UAF when dvb_register_device() fails Greg Kroah-Hartman
` (837 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Biju Das, Geert Uytterhoeven, Sasha Levin
From: Biju Das <biju.das.jz@bp.renesas.com>
[ Upstream commit e1a9faddffe7e555304dc2e3284c84fbee0679ee ]
The CAT875 sub board from Silicon Linux uses a Realtek PHY.
The phy driver commit bbc4d71d63549bcd003 ("net: phy: realtek: fix
rtl8211e rx/tx delay config") introduced NFS mount failures. Now it
needs both rx/tx delays for the NFS mount to work.
This patch fixes the NFS mount failure issue by adding "rgmii-id" mode
to the avb device node.
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Fixes: bbc4d71d63549bcd ("net: phy: realtek: fix rtl8211e rx/tx delay config")
Link: https://lore.kernel.org/r/20211115142830.12651-1-biju.das.jz@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/renesas/cat875.dtsi | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/renesas/cat875.dtsi b/arch/arm64/boot/dts/renesas/cat875.dtsi
index a69d24e9c61db..8c9da8b4bd60b 100644
--- a/arch/arm64/boot/dts/renesas/cat875.dtsi
+++ b/arch/arm64/boot/dts/renesas/cat875.dtsi
@@ -18,6 +18,7 @@
pinctrl-names = "default";
renesas,no-ether-link;
phy-handle = <&phy0>;
+ phy-mode = "rgmii-id";
status = "okay";
phy0: ethernet-phy@0 {
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0156/1039] media: dmxdev: fix UAF when dvb_register_device() fails
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0155/1039] arm64: dts: renesas: cat875: Add rx/tx delays Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0157/1039] crypto: atmel-aes - Reestablish the correct tfm context at dequeue Greg Kroah-Hartman
` (836 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Hai,
Mauro Carvalho Chehab, Sasha Levin
From: Wang Hai <wanghai38@huawei.com>
[ Upstream commit ab599eb11882f834951c436cc080c3455ba32b9b ]
I got a use-after-free report:
dvbdev: dvb_register_device: failed to create device dvb1.dvr0 (-12)
...
==================================================================
BUG: KASAN: use-after-free in dvb_dmxdev_release+0xce/0x2f0
...
Call Trace:
dump_stack_lvl+0x6c/0x8b
print_address_description.constprop.0+0x48/0x70
kasan_report.cold+0x82/0xdb
__asan_load4+0x6b/0x90
dvb_dmxdev_release+0xce/0x2f0
...
Allocated by task 7666:
kasan_save_stack+0x23/0x50
__kasan_kmalloc+0x83/0xa0
kmem_cache_alloc_trace+0x22e/0x470
dvb_register_device+0x12f/0x980
dvb_dmxdev_init+0x1f3/0x230
...
Freed by task 7666:
kasan_save_stack+0x23/0x50
kasan_set_track+0x20/0x30
kasan_set_free_info+0x24/0x40
__kasan_slab_free+0xf2/0x130
kfree+0xd1/0x5c0
dvb_register_device.cold+0x1ac/0x1fa
dvb_dmxdev_init+0x1f3/0x230
...
When dvb_register_device() in dvb_dmxdev_init() fails, dvb_dmxdev_init()
does not return a failure, and the memory pointed to by dvbdev or
dvr_dvbdev is invalid at this point. If they are used subsequently, it
will result in UFA or null-ptr-deref.
If dvb_register_device() in dvb_dmxdev_init() fails, fix the bug by making
dvb_dmxdev_init() return an error as well.
Link: https://lore.kernel.org/linux-media/20211015085741.1203283-1-wanghai38@huawei.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-core/dmxdev.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
index 5d5a48475a54f..01f288fa37e0e 100644
--- a/drivers/media/dvb-core/dmxdev.c
+++ b/drivers/media/dvb-core/dmxdev.c
@@ -1413,7 +1413,7 @@ static const struct dvb_device dvbdev_dvr = {
};
int dvb_dmxdev_init(struct dmxdev *dmxdev, struct dvb_adapter *dvb_adapter)
{
- int i;
+ int i, ret;
if (dmxdev->demux->open(dmxdev->demux) < 0)
return -EUSERS;
@@ -1432,14 +1432,26 @@ int dvb_dmxdev_init(struct dmxdev *dmxdev, struct dvb_adapter *dvb_adapter)
DMXDEV_STATE_FREE);
}
- dvb_register_device(dvb_adapter, &dmxdev->dvbdev, &dvbdev_demux, dmxdev,
+ ret = dvb_register_device(dvb_adapter, &dmxdev->dvbdev, &dvbdev_demux, dmxdev,
DVB_DEVICE_DEMUX, dmxdev->filternum);
- dvb_register_device(dvb_adapter, &dmxdev->dvr_dvbdev, &dvbdev_dvr,
+ if (ret < 0)
+ goto err_register_dvbdev;
+
+ ret = dvb_register_device(dvb_adapter, &dmxdev->dvr_dvbdev, &dvbdev_dvr,
dmxdev, DVB_DEVICE_DVR, dmxdev->filternum);
+ if (ret < 0)
+ goto err_register_dvr_dvbdev;
dvb_ringbuffer_init(&dmxdev->dvr_buffer, NULL, 8192);
return 0;
+
+err_register_dvr_dvbdev:
+ dvb_unregister_device(dmxdev->dvbdev);
+err_register_dvbdev:
+ vfree(dmxdev->filter);
+ dmxdev->filter = NULL;
+ return ret;
}
EXPORT_SYMBOL(dvb_dmxdev_init);
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0157/1039] crypto: atmel-aes - Reestablish the correct tfm context at dequeue
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0156/1039] media: dmxdev: fix UAF when dvb_register_device() fails Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0158/1039] crypto: keembay-ocs-ecc - Fix error return code in kmb_ocs_ecc_probe() Greg Kroah-Hartman
` (835 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wolfgang Ocker, Tudor Ambarus,
Herbert Xu, Sasha Levin
From: Tudor Ambarus <tudor.ambarus@microchip.com>
[ Upstream commit 6d48de655917a9d782953eba65de4e3db593ddf0 ]
In case there were more requests from different tfms in the crypto
queue, only the context of the last initialized tfm was considered.
Fixes: ec2088b66f7a ("crypto: atmel-aes - Allocate aes dev at tfm init time")
Reported-by: Wolfgang Ocker <weo@reccoware.de>
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/atmel-aes.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/drivers/crypto/atmel-aes.c b/drivers/crypto/atmel-aes.c
index 9391ccc03382d..fe05584031914 100644
--- a/drivers/crypto/atmel-aes.c
+++ b/drivers/crypto/atmel-aes.c
@@ -960,6 +960,7 @@ static int atmel_aes_handle_queue(struct atmel_aes_dev *dd,
ctx = crypto_tfm_ctx(areq->tfm);
dd->areq = areq;
+ dd->ctx = ctx;
start_async = (areq != new_areq);
dd->is_async = start_async;
@@ -1274,7 +1275,6 @@ static int atmel_aes_init_tfm(struct crypto_skcipher *tfm)
crypto_skcipher_set_reqsize(tfm, sizeof(struct atmel_aes_reqctx));
ctx->base.dd = dd;
- ctx->base.dd->ctx = &ctx->base;
ctx->base.start = atmel_aes_start;
return 0;
@@ -1291,7 +1291,6 @@ static int atmel_aes_ctr_init_tfm(struct crypto_skcipher *tfm)
crypto_skcipher_set_reqsize(tfm, sizeof(struct atmel_aes_reqctx));
ctx->base.dd = dd;
- ctx->base.dd->ctx = &ctx->base;
ctx->base.start = atmel_aes_ctr_start;
return 0;
@@ -1783,7 +1782,6 @@ static int atmel_aes_gcm_init(struct crypto_aead *tfm)
crypto_aead_set_reqsize(tfm, sizeof(struct atmel_aes_reqctx));
ctx->base.dd = dd;
- ctx->base.dd->ctx = &ctx->base;
ctx->base.start = atmel_aes_gcm_start;
return 0;
@@ -1927,7 +1925,6 @@ static int atmel_aes_xts_init_tfm(struct crypto_skcipher *tfm)
crypto_skcipher_set_reqsize(tfm, sizeof(struct atmel_aes_reqctx) +
crypto_skcipher_reqsize(ctx->fallback_tfm));
ctx->base.dd = dd;
- ctx->base.dd->ctx = &ctx->base;
ctx->base.start = atmel_aes_xts_start;
return 0;
@@ -2154,7 +2151,6 @@ static int atmel_aes_authenc_init_tfm(struct crypto_aead *tfm,
crypto_aead_set_reqsize(tfm, (sizeof(struct atmel_aes_authenc_reqctx) +
auth_reqsize));
ctx->base.dd = dd;
- ctx->base.dd->ctx = &ctx->base;
ctx->base.start = atmel_aes_authenc_start;
return 0;
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0158/1039] crypto: keembay-ocs-ecc - Fix error return code in kmb_ocs_ecc_probe()
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0157/1039] crypto: atmel-aes - Reestablish the correct tfm context at dequeue Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0159/1039] crypto: qce - fix uaf on qce_aead_register_one Greg Kroah-Hartman
` (834 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wei Yongjun,
Daniele Alessandrelli, Herbert Xu, Sasha Levin
From: Wei Yongjun <weiyongjun1@huawei.com>
[ Upstream commit 94ad2d19a97efdb603a21fcad0625f466f1cdd0f ]
Fix to return negative error code -ENOMEM from the error handling
case instead of 0, as done elsewhere in this function.
Fixes: c9f608c38009 ("crypto: keembay-ocs-ecc - Add Keem Bay OCS ECC Driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Reviewed-by: Daniele Alessandrelli <daniele.alessandrelli@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/keembay/keembay-ocs-ecc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/crypto/keembay/keembay-ocs-ecc.c b/drivers/crypto/keembay/keembay-ocs-ecc.c
index 679e6ae295e0b..5d0785d3f1b55 100644
--- a/drivers/crypto/keembay/keembay-ocs-ecc.c
+++ b/drivers/crypto/keembay/keembay-ocs-ecc.c
@@ -930,6 +930,7 @@ static int kmb_ocs_ecc_probe(struct platform_device *pdev)
ecc_dev->engine = crypto_engine_alloc_init(dev, 1);
if (!ecc_dev->engine) {
dev_err(dev, "Could not allocate crypto engine\n");
+ rc = -ENOMEM;
goto list_del;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0159/1039] crypto: qce - fix uaf on qce_aead_register_one
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0158/1039] crypto: keembay-ocs-ecc - Fix error return code in kmb_ocs_ecc_probe() Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0160/1039] crypto: qce - fix uaf on qce_ahash_register_one Greg Kroah-Hartman
` (833 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chengfeng Ye, Thara Gopinath,
Herbert Xu, Sasha Levin
From: Chengfeng Ye <cyeaa@connect.ust.hk>
[ Upstream commit 4a9dbd021970ffe1b92521328377b699acba7c52 ]
Pointer alg points to sub field of tmpl, it
is dereferenced after tmpl is freed. Fix
this by accessing alg before free tmpl.
Fixes: 9363efb4 ("crypto: qce - Add support for AEAD algorithms")
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
Acked-by: Thara Gopinath <thara.gopinath@linaro.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qce/aead.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/qce/aead.c b/drivers/crypto/qce/aead.c
index 290e2446a2f35..97a530171f07a 100644
--- a/drivers/crypto/qce/aead.c
+++ b/drivers/crypto/qce/aead.c
@@ -802,8 +802,8 @@ static int qce_aead_register_one(const struct qce_aead_def *def, struct qce_devi
ret = crypto_register_aead(alg);
if (ret) {
- kfree(tmpl);
dev_err(qce->dev, "%s registration failed\n", alg->base.cra_name);
+ kfree(tmpl);
return ret;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0160/1039] crypto: qce - fix uaf on qce_ahash_register_one
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0159/1039] crypto: qce - fix uaf on qce_aead_register_one Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0161/1039] crypto: qce - fix uaf on qce_skcipher_register_one Greg Kroah-Hartman
` (832 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chengfeng Ye, Thara Gopinath,
Herbert Xu, Sasha Levin
From: Chengfeng Ye <cyeaa@connect.ust.hk>
[ Upstream commit b4cb4d31631912842eb7dce02b4350cbb7562d5e ]
Pointer base points to sub field of tmpl, it
is dereferenced after tmpl is freed. Fix
this by accessing base before free tmpl.
Fixes: ec8f5d8f ("crypto: qce - Qualcomm crypto engine driver")
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
Acked-by: Thara Gopinath <thara.gopinath@linaro.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qce/sha.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/qce/sha.c b/drivers/crypto/qce/sha.c
index 8e6fcf2c21cc0..59159f5e64e52 100644
--- a/drivers/crypto/qce/sha.c
+++ b/drivers/crypto/qce/sha.c
@@ -498,8 +498,8 @@ static int qce_ahash_register_one(const struct qce_ahash_def *def,
ret = crypto_register_ahash(alg);
if (ret) {
- kfree(tmpl);
dev_err(qce->dev, "%s registration failed\n", base->cra_name);
+ kfree(tmpl);
return ret;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0161/1039] crypto: qce - fix uaf on qce_skcipher_register_one
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0160/1039] crypto: qce - fix uaf on qce_ahash_register_one Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0162/1039] arm64: dts: qcom: sc7280: Fix incorrect clock name Greg Kroah-Hartman
` (831 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chengfeng Ye, Thara Gopinath,
Herbert Xu, Sasha Levin
From: Chengfeng Ye <cyeaa@connect.ust.hk>
[ Upstream commit e9c195aaeed1b45c9012adbe29dedb6031e85aa8 ]
Pointer alg points to sub field of tmpl, it
is dereferenced after tmpl is freed. Fix
this by accessing alg before free tmpl.
Fixes: ec8f5d8f ("crypto: qce - Qualcomm crypto engine driver")
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
Acked-by: Thara Gopinath <thara.gopinath@linaro.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qce/skcipher.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/qce/skcipher.c b/drivers/crypto/qce/skcipher.c
index 8ff10928f581d..3d27cd5210ef5 100644
--- a/drivers/crypto/qce/skcipher.c
+++ b/drivers/crypto/qce/skcipher.c
@@ -484,8 +484,8 @@ static int qce_skcipher_register_one(const struct qce_skcipher_def *def,
ret = crypto_register_skcipher(alg);
if (ret) {
- kfree(tmpl);
dev_err(qce->dev, "%s registration failed\n", alg->base.cra_name);
+ kfree(tmpl);
return ret;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0162/1039] arm64: dts: qcom: sc7280: Fix incorrect clock name
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0161/1039] crypto: qce - fix uaf on qce_skcipher_register_one Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0163/1039] arm64: dts: qcom: sc7280: Fix interrupt-map parent address cells Greg Kroah-Hartman
` (830 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Prasad Malisetty, Stephen Boyd,
Bjorn Andersson, Sasha Levin
From: Prasad Malisetty <pmaliset@codeaurora.org>
[ Upstream commit fa09b2248714c64644576d8064e9bd292a504a0e ]
Replace pcie_1_pipe-clk clock name with pcie_1_pipe_clk
To match with dt binding.
Fixes: ab7772de8612 ("arm64: dts: qcom: SC7280: Add rpmhcc clock controller node")
Signed-off-by: Prasad Malisetty <pmaliset@codeaurora.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/1637060508-30375-2-git-send-email-pmaliset@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
index 365a2e04e285b..cb94b877d6246 100644
--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
+++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
@@ -576,7 +576,7 @@
<&rpmhcc RPMH_CXO_CLK_A>, <&sleep_clk>,
<0>, <0>, <0>, <0>, <0>, <0>;
clock-names = "bi_tcxo", "bi_tcxo_ao", "sleep_clk",
- "pcie_0_pipe_clk", "pcie_1_pipe-clk",
+ "pcie_0_pipe_clk", "pcie_1_pipe_clk",
"ufs_phy_rx_symbol_0_clk", "ufs_phy_rx_symbol_1_clk",
"ufs_phy_tx_symbol_0_clk",
"usb3_phy_wrapper_gcc_usb30_pipe_clk";
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0163/1039] arm64: dts: qcom: sc7280: Fix interrupt-map parent address cells
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0162/1039] arm64: dts: qcom: sc7280: Fix incorrect clock name Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0164/1039] mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove Greg Kroah-Hartman
` (829 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Prasad Malisetty, Stephen Boyd,
Bjorn Andersson, Sasha Levin
From: Prasad Malisetty <pmaliset@codeaurora.org>
[ Upstream commit 66b788133030f0c69a0ecc7f72f7939b119c9a69 ]
Update interrupt-map parent address cells for sc7280
Similar to existing Qcom SoCs.
Fixes: 92e0ee9f8 ("arm64: dts: qcom: sc7280: Add PCIe and PHY related nodes")
Signed-off-by: Prasad Malisetty <pmaliset@codeaurora.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/1637060508-30375-4-git-send-email-pmaliset@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sc7280.dtsi | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
index cb94b877d6246..6e27a1beaa33a 100644
--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
+++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
@@ -1592,10 +1592,10 @@
interrupt-names = "msi";
#interrupt-cells = <1>;
interrupt-map-mask = <0 0 0 0x7>;
- interrupt-map = <0 0 0 1 &intc 0 434 IRQ_TYPE_LEVEL_HIGH>,
- <0 0 0 2 &intc 0 435 IRQ_TYPE_LEVEL_HIGH>,
- <0 0 0 3 &intc 0 438 IRQ_TYPE_LEVEL_HIGH>,
- <0 0 0 4 &intc 0 439 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-map = <0 0 0 1 &intc 0 0 0 434 IRQ_TYPE_LEVEL_HIGH>,
+ <0 0 0 2 &intc 0 0 0 435 IRQ_TYPE_LEVEL_HIGH>,
+ <0 0 0 3 &intc 0 0 0 438 IRQ_TYPE_LEVEL_HIGH>,
+ <0 0 0 4 &intc 0 0 0 439 IRQ_TYPE_LEVEL_HIGH>;
clocks = <&gcc GCC_PCIE_1_PIPE_CLK>,
<&gcc GCC_PCIE_1_PIPE_CLK_SRC>,
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0164/1039] mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0163/1039] arm64: dts: qcom: sc7280: Fix interrupt-map parent address cells Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0165/1039] cpufreq: qcom-cpufreq-hw: Update offline CPUs per-cpu thermal pressure Greg Kroah-Hartman
` (828 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, George G. Davis, Vignesh Raghavendra,
Sasha Levin
From: George G. Davis <davis.george@siemens.com>
[ Upstream commit baaf965f94308301d2dc554d72a87d7432cd5ce6 ]
The following KASAN BUG is observed when testing the rpc-if driver on
rcar-gen3:
root@rcar-gen3:~# modprobe -r rpc-if
[ 101.930146] ==================================================================
[ 101.937408] BUG: KASAN: slab-out-of-bounds in __lock_acquire+0x518/0x25d0
[ 101.944240] Read of size 8 at addr ffff0004c5be2750 by task modprobe/664
[ 101.950959]
[ 101.952466] CPU: 2 PID: 664 Comm: modprobe Not tainted 5.14.0-rc1-00342-g1a1464d7aa31 #1
[ 101.960578] Hardware name: Renesas H3ULCB board based on r8a77951 (DT)
[ 101.967120] Call trace:
[ 101.969580] dump_backtrace+0x0/0x2c0
[ 101.973275] show_stack+0x1c/0x30
[ 101.976616] dump_stack_lvl+0x9c/0xd8
[ 101.980301] print_address_description.constprop.0+0x74/0x2b8
[ 101.986071] kasan_report+0x1f4/0x26c
[ 101.989757] __asan_load8+0x98/0xd4
[ 101.993266] __lock_acquire+0x518/0x25d0
[ 101.997215] lock_acquire.part.0+0x18c/0x360
[ 102.001506] lock_acquire+0x74/0x90
[ 102.005013] _raw_spin_lock_irq+0x98/0x130
[ 102.009131] __pm_runtime_disable+0x30/0x210
[ 102.013427] rpcif_hb_remove+0x5c/0x70 [rpc_if]
[ 102.018001] platform_remove+0x40/0x80
[ 102.021771] __device_release_driver+0x234/0x350
[ 102.026412] driver_detach+0x158/0x20c
[ 102.030179] bus_remove_driver+0xa0/0x140
[ 102.034212] driver_unregister+0x48/0x80
[ 102.038153] platform_driver_unregister+0x18/0x24
[ 102.042879] rpcif_platform_driver_exit+0x1c/0x34 [rpc_if]
[ 102.048400] __arm64_sys_delete_module+0x210/0x310
[ 102.053212] invoke_syscall+0x60/0x190
[ 102.056986] el0_svc_common+0x12c/0x144
[ 102.060844] do_el0_svc+0x88/0xac
[ 102.064181] el0_svc+0x24/0x3c
[ 102.067257] el0t_64_sync_handler+0x1a8/0x1b0
[ 102.071634] el0t_64_sync+0x198/0x19c
[ 102.075315]
[ 102.076815] Allocated by task 628:
[ 102.080781]
[ 102.082280] Last potentially related work creation:
[ 102.087524]
[ 102.089022] The buggy address belongs to the object at ffff0004c5be2000
[ 102.089022] which belongs to the cache kmalloc-2k of size 2048
[ 102.101555] The buggy address is located 1872 bytes inside of
[ 102.101555] 2048-byte region [ffff0004c5be2000, ffff0004c5be2800)
[ 102.113486] The buggy address belongs to the page:
[ 102.118409]
[ 102.119908] Memory state around the buggy address:
[ 102.124711] ffff0004c5be2600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 102.131947] ffff0004c5be2680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 102.139181] >ffff0004c5be2700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 102.146412] ^
[ 102.152257] ffff0004c5be2780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 102.159491] ffff0004c5be2800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 102.166723] ==================================================================
The above bug is caused by use of the wrong pointer in the
rpcif_disable_rpm() call. Fix the bug by using the correct pointer.
Fixes: 5de15b610f78 ("mtd: hyperbus: add Renesas RPC-IF driver")
Signed-off-by: George G. Davis <davis.george@siemens.com>
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Link: https://lore.kernel.org/r/20210716204935.25859-1-george_davis@mentor.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/hyperbus/rpc-if.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/hyperbus/rpc-if.c b/drivers/mtd/hyperbus/rpc-if.c
index 367b0d72bf622..dc164c18f8429 100644
--- a/drivers/mtd/hyperbus/rpc-if.c
+++ b/drivers/mtd/hyperbus/rpc-if.c
@@ -152,9 +152,9 @@ static int rpcif_hb_remove(struct platform_device *pdev)
{
struct rpcif_hyperbus *hyperbus = platform_get_drvdata(pdev);
int error = hyperbus_unregister_device(&hyperbus->hbdev);
- struct rpcif *rpc = dev_get_drvdata(pdev->dev.parent);
- rpcif_disable_rpm(rpc);
+ rpcif_disable_rpm(&hyperbus->rpc);
+
return error;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0165/1039] cpufreq: qcom-cpufreq-hw: Update offline CPUs per-cpu thermal pressure
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0164/1039] mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0166/1039] soc: imx: gpcv2: keep i.MX8MM VPU-H1 bus clock active Greg Kroah-Hartman
` (827 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thara Gopinath, Lukasz Luba,
Viresh Kumar, Sasha Levin
From: Lukasz Luba <lukasz.luba@arm.com>
[ Upstream commit 93d9e6f93e1586fcc97498c764be2e8c8401f4bd ]
The thermal pressure signal gives information to the scheduler about
reduced CPU capacity due to thermal. It is based on a value stored in
a per-cpu 'thermal_pressure' variable. The online CPUs will get the
new value there, while the offline won't. Unfortunately, when the CPU
is back online, the value read from per-cpu variable might be wrong
(stale data). This might affect the scheduler decisions, since it
sees the CPU capacity differently than what is actually available.
Fix it by making sure that all online+offline CPUs would get the
proper value in their per-cpu variable when there is throttling
or throttling is removed.
Fixes: 275157b367f479 ("cpufreq: qcom-cpufreq-hw: Add dcvs interrupt support")
Reviewed-by: Thara Gopinath <thara.gopinath@linaro.org>
Signed-off-by: Lukasz Luba <lukasz.luba@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/qcom-cpufreq-hw.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c
index a2be0df7e1747..0138b2ec406dc 100644
--- a/drivers/cpufreq/qcom-cpufreq-hw.c
+++ b/drivers/cpufreq/qcom-cpufreq-hw.c
@@ -304,7 +304,8 @@ static void qcom_lmh_dcvs_notify(struct qcom_cpufreq_data *data)
if (capacity > max_capacity)
capacity = max_capacity;
- arch_set_thermal_pressure(policy->cpus, max_capacity - capacity);
+ arch_set_thermal_pressure(policy->related_cpus,
+ max_capacity - capacity);
/*
* In the unlikely case policy is unregistered do not enable
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0166/1039] soc: imx: gpcv2: keep i.MX8MM VPU-H1 bus clock active
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0165/1039] cpufreq: qcom-cpufreq-hw: Update offline CPUs per-cpu thermal pressure Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0167/1039] cpufreq: qcom-hw: Fix probable nested interrupt handling Greg Kroah-Hartman
` (826 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Adam Ford, Fabio Estevam, Shawn Guo,
Sasha Levin
From: Adam Ford <aford173@gmail.com>
[ Upstream commit 8361b8b29f9389084b679db854cf733375c64763 ]
Enable the vpu-h1 clock when the domain is active because reading
or writing to the VPU-H1 IP block cause the system to hang.
Fixes: 656ade7aa42a ("soc: imx: gpcv2: keep i.MX8M* bus clocks enabled")
Signed-off-by: Adam Ford <aford173@gmail.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/imx/gpcv2.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/soc/imx/gpcv2.c b/drivers/soc/imx/gpcv2.c
index b8d52d8d29dbb..7b6dfa33dcb9f 100644
--- a/drivers/soc/imx/gpcv2.c
+++ b/drivers/soc/imx/gpcv2.c
@@ -734,6 +734,7 @@ static const struct imx_pgc_domain imx8mm_pgc_domains[] = {
.map = IMX8MM_VPUH1_A53_DOMAIN,
},
.pgc = BIT(IMX8MM_PGC_VPUH1),
+ .keep_clocks = true,
},
[IMX8MM_POWER_DOMAIN_DISPMIX] = {
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0167/1039] cpufreq: qcom-hw: Fix probable nested interrupt handling
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0166/1039] soc: imx: gpcv2: keep i.MX8MM VPU-H1 bus clock active Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0168/1039] ARM: dts: stm32: fix dtbs_check warning on ili9341 dts binding on stm32f429 disco Greg Kroah-Hartman
` (825 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy,
Matthias Kaehlcke, Bjorn Andersson, Viresh Kumar, Sasha Levin
From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
[ Upstream commit e0e27c3d4e20dab861566f1c348ae44e4b498630 ]
Re-enabling an interrupt from its own interrupt handler may cause
an interrupt storm, if there is a pending interrupt and because its
handling is disabled due to already done entrance into the handler
above in the stack.
Also, apparently it is improper to lock a mutex in an interrupt contex.
Fixes: 275157b367f4 ("cpufreq: qcom-cpufreq-hw: Add dcvs interrupt support")
Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/qcom-cpufreq-hw.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c
index 0138b2ec406dc..35d93361fda1a 100644
--- a/drivers/cpufreq/qcom-cpufreq-hw.c
+++ b/drivers/cpufreq/qcom-cpufreq-hw.c
@@ -343,9 +343,9 @@ static irqreturn_t qcom_lmh_dcvs_handle_irq(int irq, void *data)
/* Disable interrupt and enable polling */
disable_irq_nosync(c_data->throttle_irq);
- qcom_lmh_dcvs_notify(c_data);
+ schedule_delayed_work(&c_data->throttle_work, 0);
- return 0;
+ return IRQ_HANDLED;
}
static const struct qcom_cpufreq_soc_data qcom_soc_data = {
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0168/1039] ARM: dts: stm32: fix dtbs_check warning on ili9341 dts binding on stm32f429 disco
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0167/1039] cpufreq: qcom-hw: Fix probable nested interrupt handling Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0169/1039] libbpf: Load global data maps lazily on legacy kernels Greg Kroah-Hartman
` (824 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dillon Min, kernel test robot,
Linus Walleij, Alexandre Torgue, Sasha Levin
From: Dillon Min <dillon.minfei@gmail.com>
[ Upstream commit b046049e59dca5e5830dc75ed16acf7657a95161 ]
Since the compatible string defined from ilitek,ili9341.yaml is
"st,sf-tc240t-9370-t", "ilitek,ili9341"
so, append "ilitek,ili9341" to avoid the below dtbs_check warning.
arch/arm/boot/dts/stm32f429-disco.dt.yaml: display@1: compatible:
['st,sf-tc240t-9370-t'] is too short
Fixes: a726e2f000ec ("ARM: dts: stm32: enable ltdc binding with ili9341, gyro l3gd20 on stm32429-disco board")
Signed-off-by: Dillon Min <dillon.minfei@gmail.com>
Reported-by: kernel test robot <lkp@intel.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/stm32f429-disco.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/stm32f429-disco.dts b/arch/arm/boot/dts/stm32f429-disco.dts
index 075ac57d0bf4a..6435e099c6326 100644
--- a/arch/arm/boot/dts/stm32f429-disco.dts
+++ b/arch/arm/boot/dts/stm32f429-disco.dts
@@ -192,7 +192,7 @@
display: display@1{
/* Connect panel-ilitek-9341 to ltdc */
- compatible = "st,sf-tc240t-9370-t";
+ compatible = "st,sf-tc240t-9370-t", "ilitek,ili9341";
reg = <1>;
spi-3wire;
spi-max-frequency = <10000000>;
--
2.34.1
^ permalink raw reply related [flat|nested] 1065+ messages in thread
* [PATCH 5.16 0169/1039] libbpf: Load global data maps lazily on legacy kernels
2022-01-24 18:29 [PATCH 5.16 0000/1039] 5.16.3-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2022-01-24 18:32 ` [PATCH 5.16 0168/1039] ARM: dts: stm32: fix dtbs_check warning on ili9341 dts binding on stm32f429 disco Greg Kroah-Hartman
@ 2022-01-24 18:32 ` Greg Kroah-Hartman
2022-01-24 18:32 ` [PATCH 5.16 0170/1039] tools/resolve_btf_ids: Close ELF file on error Greg Kroah-Hartman
` (823 subsequent siblings)
992 siblings, 0 replies; 1065+ messages in thread
From: Greg Kroah-Hartman @ 2022-01-24 18:32 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrii Nakryiko, Daniel Borkmann,
Song Liu, Sasha Levin
From: Andrii Nakryiko <andrii@kernel.org>
[ Upstream commit 16e0c35c6f7a2e90d52f3035ecf942af21417b7b ]
Load global data maps lazily, if kernel is too old to support global
data. Make sure that programs are still correct by detecting if any of
the to-be-loaded programs have relocation against any of such maps.
This allows to solve the issue ([0]) with bpf_printk() and Clang
generating unnecessary and unreferenced .rodata.strX.Y sections, but it
also goes further along the CO-RE lines, allowing to have a BPF object
in which some code can work on very old kernels and relies only on BPF
maps explicitly, while other BPF programs might enjoy global variable
support. If such programs are correctly set to not load at runtime on
old kernels, bpf_object will load and function correctly now.
[0] https://lore.kernel.org/bpf/CAK-59YFPU3qO+_pXWOH+c1LSA=8WA1yabJZfREjOEXNHAqgXNg@mail.gmail.com/
Fixes: aed659170a31 ("libbpf: Support multiple .rodata.* and .data.* BPF maps")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Song Liu <songliubraving@fb.com>
Link: https://lore.kernel.org/bpf/20211123200105.387855-1-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/libbpf.c | 34 ++++++++++++++++++++++++++++++----
1 file changed, 30 insertions(+), 4 deletions(-)
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 509f3719409bb..4050a0f8dad66 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -4988,6 +4988,24 @@ bpf_object__create_maps(struct bpf_object *obj)
for (i = 0; i < obj->nr_maps; i++) {
map = &obj->maps[i];
+ /* To support old kernels, we skip creating global data maps
+ * (.rodata, .data, .kconfig, etc); later on, during program
+ * loading, if we detect that at least one of the to-be-loaded
+ * programs is referencing any global data map, we'll error
+ * out with program name and relocation index logged.
+ * This approach allows to accommodate Clang emitting
+ * unnecessary .rodata.str1.1 sections for string literals,
+ * but also it allows to have CO-RE applications that use
+ * global variables in some of BPF programs, but not others.
+ * If those global variable-using programs are not loaded at
+ * runtime due to bpf_program__set_autoload(prog, false),
+ * bpf_object loading will succeed just fine even on old
+ * kernels.
+ */
+ if (bpf_map__is_internal(map) &&
+ !kernel_supports(obj, FEAT_GLOBAL_DATA))
+ continue;
+
retried = false;
retry:
if (map->pin_path) {
@@ -5587,6 +5605,14 @@ bpf_object__relocate_data(struct bpf_object *obj, struct bpf_program *prog)
insn[0].src_reg = BPF_PSEUDO_MAP_IDX_VALUE;
insn[0].imm = relo->map_idx;
} else {
+ const struct bpf_map *map = &obj->maps[relo->map_idx];
+
+ if (bpf_map__is_internal(map) &&
+ !kernel_supports(obj, FEAT_GLOBAL_DATA)) {
+ pr_warn("prog '%s': relo #%d: kernel doesn't support global data\n",
+ prog->name, i);
+ return -ENOTSUP;
+ }
insn[0].src_reg = BPF_PSEUDO_MAP_VALUE;
insn[0].imm = obj->maps[relo->map_idx].fd;
}
@@ -6121,6 +6147,8 @@ bpf_object__relocate(struct bpf_object *obj, const char *targ_btf_path)
*/
if (prog_is_subprog(obj, prog))
continue;
+ if (!prog->load)
+ continue;
err = bpf_object__relocate_calls(obj, prog);
if (err) {
@@ -6134,6 +6162,8 @@ bpf_object__relocate(struct bpf_object *obj, const char *targ_btf_path)
prog = &obj->programs[i];
if (prog_is_subprog(obj, prog))
continue;
+ if (!prog->load)
+ continue;
err = bpf_object__relocate_data(obj, prog);
if (err) {
pr_warn("prog '%s': failed to relocate data references: %d\n",
@@ -6915,10 +6945,6 @@ static int bpf_object__sanitize_maps(struct bpf_object *obj)
bpf_object__for_each_map(m, obj) {
if (!bpf_map__is_internal(m))
continue;
- if (!kernel_supports(obj, FEAT_GLOBAL_DATA)) {
- pr_warn("kernel doesn't support global data\n");
- return -ENOTSUP;
- }
if (!kernel_supports(obj, FEAT_ARRAY_MMAP))
m->def.map_flags ^= BPF_F_MMAPABLE;
}
--
2.34.1