diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-02-20 08:00:45 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-02-20 08:00:45 +0100 |
| commit | b789119ea7cd1b62d129bd61b342135c67b27fdb (patch) | |
| tree | affdda0835757e042cd0aa0b092e79520c5fa5a6 | |
| parent | 506059bff9e19599c641c0a6926b726cf088e73a (diff) | |
| download | vulns-b789119ea7cd1b62d129bd61b342135c67b27fdb.tar.gz | |
add 6.7.1 review and proposed commits
| -rw-r--r-- | cve/review/mbox.6.7 | 109281 | ||||
| -rw-r--r-- | cve/review/mbox.6.7.1 | 2396 | ||||
| -rw-r--r-- | cve/review/mbox.6.7.1.cve | 393 |
3 files changed, 2789 insertions, 109281 deletions
diff --git a/cve/review/mbox.6.7 b/cve/review/mbox.6.7 deleted file mode 100644 index 86beafca..00000000 --- a/cve/review/mbox.6.7 +++ /dev/null @@ -1,109281 +0,0 @@ -From f6c30bfe5a49bc38cae985083a11016800708fea Mon Sep 17 00:00:00 2001 -From: Eric Biggers <ebiggers@google.com> -Date: Mon, 6 Nov 2023 20:44:34 -0800 -Subject: [PATCH 0001/1501] f2fs: explicitly null-terminate the xattr list -Status: RO -Content-Length: 1091 -Lines: 33 - -commit e26b6d39270f5eab0087453d9b544189a38c8564 upstream. - -When setting an xattr, explicitly null-terminate the xattr list. This -eliminates the fragile assumption that the unused xattr space is always -zeroed. - -Signed-off-by: Eric Biggers <ebiggers@google.com> -Reviewed-by: Chao Yu <chao@kernel.org> -Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/f2fs/xattr.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c -index 47e88b4d4e7d..a8fc2cac6879 100644 ---- a/fs/f2fs/xattr.c -+++ b/fs/f2fs/xattr.c -@@ -754,6 +754,12 @@ static int __f2fs_setxattr(struct inode *inode, int index, - memcpy(pval, value, size); - last->e_value_size = cpu_to_le16(size); - new_hsize += newsize; -+ /* -+ * Explicitly add the null terminator. The unused xattr space -+ * is supposed to always be zeroed, which would make this -+ * unnecessary, but don't depend on that. -+ */ -+ *(u32 *)((u8 *)last + newsize) = 0; - } - - error = write_all_xattrs(inode, new_hsize, base_addr, ipage); --- -2.43.2 - -From e848c4bb56d9b0bf0d222bf311f5eea72d06b1e7 Mon Sep 17 00:00:00 2001 -From: Hans de Goede <hdegoede@redhat.com> -Date: Sat, 23 Dec 2023 15:57:06 +0100 -Subject: [PATCH 0009/1501] ACPI: resource: Add another DMI match for the - TongFang GMxXGxx -Content-Length: 1268 -Lines: 38 - -commit df0cced74159c79e36ce7971f0bf250673296d93 upstream. - -The TongFang GMxXGxx, which needs IRQ overriding for the keyboard to work, -is also sold as the Eluktronics RP-15 which does not use the standard -TongFang GMxXGxx DMI board_name. - -Add an entry for this laptop to the irq1_edge_low_force_override[] DMI -table to make the internal keyboard functional. - -Reported-by: Luis Acuna <ldacuna@gmail.com> -Signed-off-by: Hans de Goede <hdegoede@redhat.com> -Cc: All applicable <stable@vger.kernel.org> -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/acpi/resource.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c -index 9bd9f79cd409..c3536c236be9 100644 ---- a/drivers/acpi/resource.c -+++ b/drivers/acpi/resource.c -@@ -510,6 +510,13 @@ static const struct dmi_system_id irq1_edge_low_force_override[] = { - DMI_MATCH(DMI_BOARD_NAME, "GMxXGxx"), - }, - }, -+ { -+ /* TongFang GMxXGxx sold as Eluktronics Inc. RP-15 */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Eluktronics Inc."), -+ DMI_MATCH(DMI_BOARD_NAME, "RP-15"), -+ }, -+ }, - { - /* TongFang GM6XGxX/TUXEDO Stellaris 16 Gen5 AMD */ - .matches = { --- -2.43.2 - -From ba0bc8bf90c9d84807024cfe6b008138ea970981 Mon Sep 17 00:00:00 2001 -From: Sjoerd Simons <sjoerd@collabora.com> -Date: Tue, 28 Nov 2023 22:35:04 +0100 -Subject: [PATCH 0010/1501] bus: moxtet: Mark the irq as shared -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1112 -Lines: 32 - -commit e7830f5a83e96d8cb8efc0412902a03008f8fbe3 upstream. - -The Turris Mox shares the moxtet IRQ with various devices on the board, -so mark the IRQ as shared in the driver as well. - -Without this loading the module will fail with: - genirq: Flags mismatch irq 40. 00002002 (moxtet) vs. 00002080 (mcp7940x) - -Signed-off-by: Sjoerd Simons <sjoerd@collabora.com> -Cc: <stable@vger.kernel.org> # v6.2+ -Reviewed-by: Marek Behún <kabel@kernel.org> -Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/bus/moxtet.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/bus/moxtet.c b/drivers/bus/moxtet.c -index 5eb0fe73ddc4..48c18f95660a 100644 ---- a/drivers/bus/moxtet.c -+++ b/drivers/bus/moxtet.c -@@ -755,7 +755,7 @@ static int moxtet_irq_setup(struct moxtet *moxtet) - moxtet->irq.masked = ~0; - - ret = request_threaded_irq(moxtet->dev_irq, NULL, moxtet_irq_thread_fn, -- IRQF_ONESHOT, "moxtet", moxtet); -+ IRQF_SHARED | IRQF_ONESHOT, "moxtet", moxtet); - if (ret < 0) - goto err_free; - --- -2.43.2 - -From dc272a4d63025dba31fbdec2ec2043c591942d66 Mon Sep 17 00:00:00 2001 -From: Sjoerd Simons <sjoerd@collabora.com> -Date: Tue, 28 Nov 2023 22:35:05 +0100 -Subject: [PATCH 0011/1501] bus: moxtet: Add spi device table -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1177 -Lines: 41 - -commit aaafe88d5500ba18b33be72458439367ef878788 upstream. - -The moxtet module fails to auto-load on. Add a SPI id table to -allow it to do so. - -Signed-off-by: Sjoerd Simons <sjoerd@collabora.com> -Cc: <stable@vger.kernel.org> -Reviewed-by: Marek Behún <kabel@kernel.org> -Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/bus/moxtet.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/drivers/bus/moxtet.c b/drivers/bus/moxtet.c -index 48c18f95660a..e384fbc6c1d9 100644 ---- a/drivers/bus/moxtet.c -+++ b/drivers/bus/moxtet.c -@@ -830,6 +830,12 @@ static void moxtet_remove(struct spi_device *spi) - mutex_destroy(&moxtet->lock); - } - -+static const struct spi_device_id moxtet_spi_ids[] = { -+ { "moxtet" }, -+ { }, -+}; -+MODULE_DEVICE_TABLE(spi, moxtet_spi_ids); -+ - static const struct of_device_id moxtet_dt_ids[] = { - { .compatible = "cznic,moxtet" }, - {}, -@@ -841,6 +847,7 @@ static struct spi_driver moxtet_spi_driver = { - .name = "moxtet", - .of_match_table = moxtet_dt_ids, - }, -+ .id_table = moxtet_spi_ids, - .probe = moxtet_probe, - .remove = moxtet_remove, - }; --- -2.43.2 - -From f90fb3a482d1d4705603ab6c320de0ccd611055c Mon Sep 17 00:00:00 2001 -From: Lewis Huang <lewis.huang@amd.com> -Date: Fri, 1 Dec 2023 06:25:02 -0700 -Subject: [PATCH 0012/1501] drm/amd/display: Pass pwrseq inst for backlight and - ABM -Content-Length: 21219 -Lines: 535 - -commit b17ef04bf3a4346d66404454d6a646343ddc9749 upstream. - -[Why] -OTG inst and pwrseq inst mapping is not align therefore we cannot use -otg_inst as pwrseq inst to get DCIO register. - -[How] -1. Pass the correct pwrseq instance to dmub when set abm pipe. -2. LVTMA control index change from panel_inst to pwrseq_inst. - -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Reviewed-by: Phil Hsieh <phil.hsieh@amd.com> -Acked-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com> -Signed-off-by: Lewis Huang <lewis.huang@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - .../drm/amd/display/dc/bios/bios_parser2.c | 4 +- - .../drm/amd/display/dc/bios/command_table2.c | 12 ++-- - .../drm/amd/display/dc/bios/command_table2.h | 2 +- - .../gpu/drm/amd/display/dc/dc_bios_types.h | 2 +- - drivers/gpu/drm/amd/display/dc/dce/dmub_abm.c | 8 ++- - .../gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c | 7 ++- - .../gpu/drm/amd/display/dc/dce/dmub_abm_lcd.h | 2 +- - .../amd/display/dc/dcn31/dcn31_panel_cntl.c | 5 +- - .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 16 ++--- - .../amd/display/dc/hwss/dcn21/dcn21_hwseq.c | 36 ++++++++--- - drivers/gpu/drm/amd/display/dc/inc/hw/abm.h | 3 +- - .../drm/amd/display/dc/inc/hw/panel_cntl.h | 2 + - .../drm/amd/display/dc/link/link_factory.c | 59 +++++++++++++------ - .../gpu/drm/amd/display/dmub/inc/dmub_cmd.h | 14 ++++- - 14 files changed, 119 insertions(+), 53 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c -index 2d1f5efa9091..b5b29451d2db 100644 ---- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c -+++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c -@@ -1698,7 +1698,7 @@ static enum bp_result bios_parser_enable_disp_power_gating( - static enum bp_result bios_parser_enable_lvtma_control( - struct dc_bios *dcb, - uint8_t uc_pwr_on, -- uint8_t panel_instance, -+ uint8_t pwrseq_instance, - uint8_t bypass_panel_control_wait) - { - struct bios_parser *bp = BP_FROM_DCB(dcb); -@@ -1706,7 +1706,7 @@ static enum bp_result bios_parser_enable_lvtma_control( - if (!bp->cmd_tbl.enable_lvtma_control) - return BP_RESULT_FAILURE; - -- return bp->cmd_tbl.enable_lvtma_control(bp, uc_pwr_on, panel_instance, bypass_panel_control_wait); -+ return bp->cmd_tbl.enable_lvtma_control(bp, uc_pwr_on, pwrseq_instance, bypass_panel_control_wait); - } - - static bool bios_parser_is_accelerated_mode( -diff --git a/drivers/gpu/drm/amd/display/dc/bios/command_table2.c b/drivers/gpu/drm/amd/display/dc/bios/command_table2.c -index 90a02d7bd3da..ab0adabf9dd4 100644 ---- a/drivers/gpu/drm/amd/display/dc/bios/command_table2.c -+++ b/drivers/gpu/drm/amd/display/dc/bios/command_table2.c -@@ -976,7 +976,7 @@ static unsigned int get_smu_clock_info_v3_1(struct bios_parser *bp, uint8_t id) - static enum bp_result enable_lvtma_control( - struct bios_parser *bp, - uint8_t uc_pwr_on, -- uint8_t panel_instance, -+ uint8_t pwrseq_instance, - uint8_t bypass_panel_control_wait); - - static void init_enable_lvtma_control(struct bios_parser *bp) -@@ -989,7 +989,7 @@ static void init_enable_lvtma_control(struct bios_parser *bp) - static void enable_lvtma_control_dmcub( - struct dc_dmub_srv *dmcub, - uint8_t uc_pwr_on, -- uint8_t panel_instance, -+ uint8_t pwrseq_instance, - uint8_t bypass_panel_control_wait) - { - -@@ -1002,8 +1002,8 @@ static void enable_lvtma_control_dmcub( - DMUB_CMD__VBIOS_LVTMA_CONTROL; - cmd.lvtma_control.data.uc_pwr_action = - uc_pwr_on; -- cmd.lvtma_control.data.panel_inst = -- panel_instance; -+ cmd.lvtma_control.data.pwrseq_inst = -+ pwrseq_instance; - cmd.lvtma_control.data.bypass_panel_control_wait = - bypass_panel_control_wait; - dm_execute_dmub_cmd(dmcub->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -@@ -1012,7 +1012,7 @@ static void enable_lvtma_control_dmcub( - static enum bp_result enable_lvtma_control( - struct bios_parser *bp, - uint8_t uc_pwr_on, -- uint8_t panel_instance, -+ uint8_t pwrseq_instance, - uint8_t bypass_panel_control_wait) - { - enum bp_result result = BP_RESULT_FAILURE; -@@ -1021,7 +1021,7 @@ static enum bp_result enable_lvtma_control( - bp->base.ctx->dc->debug.dmub_command_table) { - enable_lvtma_control_dmcub(bp->base.ctx->dmub_srv, - uc_pwr_on, -- panel_instance, -+ pwrseq_instance, - bypass_panel_control_wait); - return BP_RESULT_OK; - } -diff --git a/drivers/gpu/drm/amd/display/dc/bios/command_table2.h b/drivers/gpu/drm/amd/display/dc/bios/command_table2.h -index b6d09bf6cf72..41c8c014397f 100644 ---- a/drivers/gpu/drm/amd/display/dc/bios/command_table2.h -+++ b/drivers/gpu/drm/amd/display/dc/bios/command_table2.h -@@ -96,7 +96,7 @@ struct cmd_tbl { - struct bios_parser *bp, uint8_t id); - enum bp_result (*enable_lvtma_control)(struct bios_parser *bp, - uint8_t uc_pwr_on, -- uint8_t panel_instance, -+ uint8_t pwrseq_instance, - uint8_t bypass_panel_control_wait); - }; - -diff --git a/drivers/gpu/drm/amd/display/dc/dc_bios_types.h b/drivers/gpu/drm/amd/display/dc/dc_bios_types.h -index be9aa1a71847..26940d94d8fb 100644 ---- a/drivers/gpu/drm/amd/display/dc/dc_bios_types.h -+++ b/drivers/gpu/drm/amd/display/dc/dc_bios_types.h -@@ -140,7 +140,7 @@ struct dc_vbios_funcs { - enum bp_result (*enable_lvtma_control)( - struct dc_bios *bios, - uint8_t uc_pwr_on, -- uint8_t panel_instance, -+ uint8_t pwrseq_instance, - uint8_t bypass_panel_control_wait); - - enum bp_result (*get_soc_bb_info)( -diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_abm.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_abm.c -index d3e6544022b7..930fd929e93a 100644 ---- a/drivers/gpu/drm/amd/display/dc/dce/dmub_abm.c -+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_abm.c -@@ -145,7 +145,11 @@ static bool dmub_abm_save_restore_ex( - return ret; - } - --static bool dmub_abm_set_pipe_ex(struct abm *abm, uint32_t otg_inst, uint32_t option, uint32_t panel_inst) -+static bool dmub_abm_set_pipe_ex(struct abm *abm, -+ uint32_t otg_inst, -+ uint32_t option, -+ uint32_t panel_inst, -+ uint32_t pwrseq_inst) - { - bool ret = false; - unsigned int feature_support; -@@ -153,7 +157,7 @@ static bool dmub_abm_set_pipe_ex(struct abm *abm, uint32_t otg_inst, uint32_t op - feature_support = abm_feature_support(abm, panel_inst); - - if (feature_support == ABM_LCD_SUPPORT) -- ret = dmub_abm_set_pipe(abm, otg_inst, option, panel_inst); -+ ret = dmub_abm_set_pipe(abm, otg_inst, option, panel_inst, pwrseq_inst); - - return ret; - } -diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c -index 592a8f7a1c6d..42c802afc468 100644 ---- a/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c -+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c -@@ -254,7 +254,11 @@ bool dmub_abm_save_restore( - return true; - } - --bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, uint32_t option, uint32_t panel_inst) -+bool dmub_abm_set_pipe(struct abm *abm, -+ uint32_t otg_inst, -+ uint32_t option, -+ uint32_t panel_inst, -+ uint32_t pwrseq_inst) - { - union dmub_rb_cmd cmd; - struct dc_context *dc = abm->ctx; -@@ -264,6 +268,7 @@ bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, uint32_t option, uint - cmd.abm_set_pipe.header.type = DMUB_CMD__ABM; - cmd.abm_set_pipe.header.sub_type = DMUB_CMD__ABM_SET_PIPE; - cmd.abm_set_pipe.abm_set_pipe_data.otg_inst = otg_inst; -+ cmd.abm_set_pipe.abm_set_pipe_data.pwrseq_inst = pwrseq_inst; - cmd.abm_set_pipe.abm_set_pipe_data.set_pipe_option = option; - cmd.abm_set_pipe.abm_set_pipe_data.panel_inst = panel_inst; - cmd.abm_set_pipe.abm_set_pipe_data.ramping_boundary = ramping_boundary; -diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.h b/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.h -index 853564d7f471..07ea6c8d414f 100644 ---- a/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.h -+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.h -@@ -44,7 +44,7 @@ bool dmub_abm_save_restore( - struct dc_context *dc, - unsigned int panel_inst, - struct abm_save_restore *pData); --bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, uint32_t option, uint32_t panel_inst); -+bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, uint32_t option, uint32_t panel_inst, uint32_t pwrseq_inst); - bool dmub_abm_set_backlight_level(struct abm *abm, - unsigned int backlight_pwm_u16_16, - unsigned int frame_ramp, -diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_panel_cntl.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_panel_cntl.c -index 217acd4e292a..d849b1eaa4a5 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_panel_cntl.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_panel_cntl.c -@@ -50,7 +50,7 @@ static bool dcn31_query_backlight_info(struct panel_cntl *panel_cntl, union dmub - cmd->panel_cntl.header.type = DMUB_CMD__PANEL_CNTL; - cmd->panel_cntl.header.sub_type = DMUB_CMD__PANEL_CNTL_QUERY_BACKLIGHT_INFO; - cmd->panel_cntl.header.payload_bytes = sizeof(cmd->panel_cntl.data); -- cmd->panel_cntl.data.inst = dcn31_panel_cntl->base.inst; -+ cmd->panel_cntl.data.pwrseq_inst = dcn31_panel_cntl->base.pwrseq_inst; - - return dm_execute_dmub_cmd(dc_dmub_srv->ctx, cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY); - } -@@ -78,7 +78,7 @@ static uint32_t dcn31_panel_cntl_hw_init(struct panel_cntl *panel_cntl) - cmd.panel_cntl.header.type = DMUB_CMD__PANEL_CNTL; - cmd.panel_cntl.header.sub_type = DMUB_CMD__PANEL_CNTL_HW_INIT; - cmd.panel_cntl.header.payload_bytes = sizeof(cmd.panel_cntl.data); -- cmd.panel_cntl.data.inst = dcn31_panel_cntl->base.inst; -+ cmd.panel_cntl.data.pwrseq_inst = dcn31_panel_cntl->base.pwrseq_inst; - cmd.panel_cntl.data.bl_pwm_cntl = panel_cntl->stored_backlight_registers.BL_PWM_CNTL; - cmd.panel_cntl.data.bl_pwm_period_cntl = panel_cntl->stored_backlight_registers.BL_PWM_PERIOD_CNTL; - cmd.panel_cntl.data.bl_pwm_ref_div1 = -@@ -157,4 +157,5 @@ void dcn31_panel_cntl_construct( - dcn31_panel_cntl->base.funcs = &dcn31_link_panel_cntl_funcs; - dcn31_panel_cntl->base.ctx = init_data->ctx; - dcn31_panel_cntl->base.inst = init_data->inst; -+ dcn31_panel_cntl->base.pwrseq_inst = init_data->pwrseq_inst; - } -diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c -index 960a55e06375..9b8299d97e40 100644 ---- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c -@@ -790,7 +790,7 @@ void dce110_edp_power_control( - struct dc_context *ctx = link->ctx; - struct bp_transmitter_control cntl = { 0 }; - enum bp_result bp_result; -- uint8_t panel_instance; -+ uint8_t pwrseq_instance; - - - if (dal_graphics_object_id_get_connector_id(link->link_enc->connector) -@@ -873,7 +873,7 @@ void dce110_edp_power_control( - cntl.coherent = false; - cntl.lanes_number = LANE_COUNT_FOUR; - cntl.hpd_sel = link->link_enc->hpd_source; -- panel_instance = link->panel_cntl->inst; -+ pwrseq_instance = link->panel_cntl->pwrseq_inst; - - if (ctx->dc->ctx->dmub_srv && - ctx->dc->debug.dmub_command_table) { -@@ -881,11 +881,11 @@ void dce110_edp_power_control( - if (cntl.action == TRANSMITTER_CONTROL_POWER_ON) { - bp_result = ctx->dc_bios->funcs->enable_lvtma_control(ctx->dc_bios, - LVTMA_CONTROL_POWER_ON, -- panel_instance, link->link_powered_externally); -+ pwrseq_instance, link->link_powered_externally); - } else { - bp_result = ctx->dc_bios->funcs->enable_lvtma_control(ctx->dc_bios, - LVTMA_CONTROL_POWER_OFF, -- panel_instance, link->link_powered_externally); -+ pwrseq_instance, link->link_powered_externally); - } - } - -@@ -956,7 +956,7 @@ void dce110_edp_backlight_control( - { - struct dc_context *ctx = link->ctx; - struct bp_transmitter_control cntl = { 0 }; -- uint8_t panel_instance; -+ uint8_t pwrseq_instance; - unsigned int pre_T11_delay = OLED_PRE_T11_DELAY; - unsigned int post_T7_delay = OLED_POST_T7_DELAY; - -@@ -1009,7 +1009,7 @@ void dce110_edp_backlight_control( - */ - /* dc_service_sleep_in_milliseconds(50); */ - /*edp 1.2*/ -- panel_instance = link->panel_cntl->inst; -+ pwrseq_instance = link->panel_cntl->pwrseq_inst; - - if (cntl.action == TRANSMITTER_CONTROL_BACKLIGHT_ON) { - if (!link->dc->config.edp_no_power_sequencing) -@@ -1034,11 +1034,11 @@ void dce110_edp_backlight_control( - if (cntl.action == TRANSMITTER_CONTROL_BACKLIGHT_ON) - ctx->dc_bios->funcs->enable_lvtma_control(ctx->dc_bios, - LVTMA_CONTROL_LCD_BLON, -- panel_instance, link->link_powered_externally); -+ pwrseq_instance, link->link_powered_externally); - else - ctx->dc_bios->funcs->enable_lvtma_control(ctx->dc_bios, - LVTMA_CONTROL_LCD_BLOFF, -- panel_instance, link->link_powered_externally); -+ pwrseq_instance, link->link_powered_externally); - } - - link_transmitter_control(ctx->dc_bios, &cntl); -diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c -index 467812cf3368..08783ad097d2 100644 ---- a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c -@@ -137,7 +137,8 @@ void dcn21_PLAT_58856_wa(struct dc_state *context, struct pipe_ctx *pipe_ctx) - pipe_ctx->stream->dpms_off = true; - } - --static bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, uint32_t option, uint32_t panel_inst) -+static bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, -+ uint32_t option, uint32_t panel_inst, uint32_t pwrseq_inst) - { - union dmub_rb_cmd cmd; - struct dc_context *dc = abm->ctx; -@@ -147,6 +148,7 @@ static bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, uint32_t optio - cmd.abm_set_pipe.header.type = DMUB_CMD__ABM; - cmd.abm_set_pipe.header.sub_type = DMUB_CMD__ABM_SET_PIPE; - cmd.abm_set_pipe.abm_set_pipe_data.otg_inst = otg_inst; -+ cmd.abm_set_pipe.abm_set_pipe_data.pwrseq_inst = pwrseq_inst; - cmd.abm_set_pipe.abm_set_pipe_data.set_pipe_option = option; - cmd.abm_set_pipe.abm_set_pipe_data.panel_inst = panel_inst; - cmd.abm_set_pipe.abm_set_pipe_data.ramping_boundary = ramping_boundary; -@@ -179,7 +181,6 @@ void dcn21_set_abm_immediate_disable(struct pipe_ctx *pipe_ctx) - struct abm *abm = pipe_ctx->stream_res.abm; - uint32_t otg_inst = pipe_ctx->stream_res.tg->inst; - struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl; -- - struct dmcu *dmcu = pipe_ctx->stream->ctx->dc->res_pool->dmcu; - - if (dmcu) { -@@ -190,9 +191,13 @@ void dcn21_set_abm_immediate_disable(struct pipe_ctx *pipe_ctx) - if (abm && panel_cntl) { - if (abm->funcs && abm->funcs->set_pipe_ex) { - abm->funcs->set_pipe_ex(abm, otg_inst, SET_ABM_PIPE_IMMEDIATELY_DISABLE, -- panel_cntl->inst); -+ panel_cntl->inst, panel_cntl->pwrseq_inst); - } else { -- dmub_abm_set_pipe(abm, otg_inst, SET_ABM_PIPE_IMMEDIATELY_DISABLE, panel_cntl->inst); -+ dmub_abm_set_pipe(abm, -+ otg_inst, -+ SET_ABM_PIPE_IMMEDIATELY_DISABLE, -+ panel_cntl->inst, -+ panel_cntl->pwrseq_inst); - } - panel_cntl->funcs->store_backlight_level(panel_cntl); - } -@@ -212,9 +217,16 @@ void dcn21_set_pipe(struct pipe_ctx *pipe_ctx) - - if (abm && panel_cntl) { - if (abm->funcs && abm->funcs->set_pipe_ex) { -- abm->funcs->set_pipe_ex(abm, otg_inst, SET_ABM_PIPE_NORMAL, panel_cntl->inst); -+ abm->funcs->set_pipe_ex(abm, -+ otg_inst, -+ SET_ABM_PIPE_NORMAL, -+ panel_cntl->inst, -+ panel_cntl->pwrseq_inst); - } else { -- dmub_abm_set_pipe(abm, otg_inst, SET_ABM_PIPE_NORMAL, panel_cntl->inst); -+ dmub_abm_set_pipe(abm, otg_inst, -+ SET_ABM_PIPE_NORMAL, -+ panel_cntl->inst, -+ panel_cntl->pwrseq_inst); - } - } - } -@@ -237,9 +249,17 @@ bool dcn21_set_backlight_level(struct pipe_ctx *pipe_ctx, - - if (abm && panel_cntl) { - if (abm->funcs && abm->funcs->set_pipe_ex) { -- abm->funcs->set_pipe_ex(abm, otg_inst, SET_ABM_PIPE_NORMAL, panel_cntl->inst); -+ abm->funcs->set_pipe_ex(abm, -+ otg_inst, -+ SET_ABM_PIPE_NORMAL, -+ panel_cntl->inst, -+ panel_cntl->pwrseq_inst); - } else { -- dmub_abm_set_pipe(abm, otg_inst, SET_ABM_PIPE_NORMAL, panel_cntl->inst); -+ dmub_abm_set_pipe(abm, -+ otg_inst, -+ SET_ABM_PIPE_NORMAL, -+ panel_cntl->inst, -+ panel_cntl->pwrseq_inst); - } - } - } -diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/abm.h b/drivers/gpu/drm/amd/display/dc/inc/hw/abm.h -index 33db15d69f23..9f521cf0fc5a 100644 ---- a/drivers/gpu/drm/amd/display/dc/inc/hw/abm.h -+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/abm.h -@@ -64,7 +64,8 @@ struct abm_funcs { - bool (*set_pipe_ex)(struct abm *abm, - unsigned int otg_inst, - unsigned int option, -- unsigned int panel_inst); -+ unsigned int panel_inst, -+ unsigned int pwrseq_inst); - }; - - #endif -diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/panel_cntl.h b/drivers/gpu/drm/amd/display/dc/inc/hw/panel_cntl.h -index 24af9d80b937..248adc1705e3 100644 ---- a/drivers/gpu/drm/amd/display/dc/inc/hw/panel_cntl.h -+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/panel_cntl.h -@@ -56,12 +56,14 @@ struct panel_cntl_funcs { - struct panel_cntl_init_data { - struct dc_context *ctx; - uint32_t inst; -+ uint32_t pwrseq_inst; - }; - - struct panel_cntl { - const struct panel_cntl_funcs *funcs; - struct dc_context *ctx; - uint32_t inst; -+ uint32_t pwrseq_inst; - /* registers setting needs to be saved and restored at InitBacklight */ - struct panel_cntl_backlight_registers stored_backlight_registers; - }; -diff --git a/drivers/gpu/drm/amd/display/dc/link/link_factory.c b/drivers/gpu/drm/amd/display/dc/link/link_factory.c -index 7abfc67d10a6..ff7801aa552a 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/link_factory.c -+++ b/drivers/gpu/drm/amd/display/dc/link/link_factory.c -@@ -368,6 +368,30 @@ static enum transmitter translate_encoder_to_transmitter( - } - } - -+static uint8_t translate_dig_inst_to_pwrseq_inst(struct dc_link *link) -+{ -+ uint8_t pwrseq_inst = 0xF; -+ struct dc_context *dc_ctx = link->dc->ctx; -+ -+ DC_LOGGER_INIT(dc_ctx->logger); -+ -+ switch (link->eng_id) { -+ case ENGINE_ID_DIGA: -+ pwrseq_inst = 0; -+ break; -+ case ENGINE_ID_DIGB: -+ pwrseq_inst = 1; -+ break; -+ default: -+ DC_LOG_WARNING("Unsupported pwrseq engine id: %d!\n", link->eng_id); -+ ASSERT(false); -+ break; -+ } -+ -+ return pwrseq_inst; -+} -+ -+ - static void link_destruct(struct dc_link *link) - { - int i; -@@ -595,24 +619,6 @@ static bool construct_phy(struct dc_link *link, - link->ddc_hw_inst = - dal_ddc_get_line(get_ddc_pin(link->ddc)); - -- -- if (link->dc->res_pool->funcs->panel_cntl_create && -- (link->link_id.id == CONNECTOR_ID_EDP || -- link->link_id.id == CONNECTOR_ID_LVDS)) { -- panel_cntl_init_data.ctx = dc_ctx; -- panel_cntl_init_data.inst = -- panel_cntl_init_data.ctx->dc_edp_id_count; -- link->panel_cntl = -- link->dc->res_pool->funcs->panel_cntl_create( -- &panel_cntl_init_data); -- panel_cntl_init_data.ctx->dc_edp_id_count++; -- -- if (link->panel_cntl == NULL) { -- DC_ERROR("Failed to create link panel_cntl!\n"); -- goto panel_cntl_create_fail; -- } -- } -- - enc_init_data.ctx = dc_ctx; - bp_funcs->get_src_obj(dc_ctx->dc_bios, link->link_id, 0, - &enc_init_data.encoder); -@@ -643,6 +649,23 @@ static bool construct_phy(struct dc_link *link, - link->dc->res_pool->dig_link_enc_count++; - - link->link_enc_hw_inst = link->link_enc->transmitter; -+ -+ if (link->dc->res_pool->funcs->panel_cntl_create && -+ (link->link_id.id == CONNECTOR_ID_EDP || -+ link->link_id.id == CONNECTOR_ID_LVDS)) { -+ panel_cntl_init_data.ctx = dc_ctx; -+ panel_cntl_init_data.inst = panel_cntl_init_data.ctx->dc_edp_id_count; -+ panel_cntl_init_data.pwrseq_inst = translate_dig_inst_to_pwrseq_inst(link); -+ link->panel_cntl = -+ link->dc->res_pool->funcs->panel_cntl_create( -+ &panel_cntl_init_data); -+ panel_cntl_init_data.ctx->dc_edp_id_count++; -+ -+ if (link->panel_cntl == NULL) { -+ DC_ERROR("Failed to create link panel_cntl!\n"); -+ goto panel_cntl_create_fail; -+ } -+ } - for (i = 0; i < 4; i++) { - if (bp_funcs->get_device_tag(dc_ctx->dc_bios, - link->link_id, i, -diff --git a/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h b/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h -index ed4379c04715..3cea96a36432 100644 ---- a/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h -+++ b/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h -@@ -3357,6 +3357,16 @@ struct dmub_cmd_abm_set_pipe_data { - * TODO: Remove. - */ - uint8_t ramping_boundary; -+ -+ /** -+ * PwrSeq HW Instance. -+ */ -+ uint8_t pwrseq_inst; -+ -+ /** -+ * Explicit padding to 4 byte boundary. -+ */ -+ uint8_t pad[3]; - }; - - /** -@@ -3737,7 +3747,7 @@ enum dmub_cmd_panel_cntl_type { - * struct dmub_cmd_panel_cntl_data - Panel control data. - */ - struct dmub_cmd_panel_cntl_data { -- uint32_t inst; /**< panel instance */ -+ uint32_t pwrseq_inst; /**< pwrseq instance */ - uint32_t current_backlight; /* in/out */ - uint32_t bl_pwm_cntl; /* in/out */ - uint32_t bl_pwm_period_cntl; /* in/out */ -@@ -3796,7 +3806,7 @@ struct dmub_cmd_lvtma_control_data { - uint8_t uc_pwr_action; /**< LVTMA_ACTION */ - uint8_t bypass_panel_control_wait; - uint8_t reserved_0[2]; /**< For future use */ -- uint8_t panel_inst; /**< LVTMA control instance */ -+ uint8_t pwrseq_inst; /**< LVTMA control instance */ - uint8_t reserved_1[3]; /**< For future use */ - }; - --- -2.43.2 - -From 4f6638562db5f9568dbfbe3a2a6ac80c4832f19e Mon Sep 17 00:00:00 2001 -From: Namjae Jeon <linkinjeon@kernel.org> -Date: Sun, 7 Jan 2024 21:24:07 +0900 -Subject: [PATCH 0013/1501] ksmbd: don't allow O_TRUNC open on read-only share -Content-Length: 2688 -Lines: 80 - -commit d592a9158a112d419f341f035d18d02f8d232def upstream. - -When file is changed using notepad on read-only share(read_only = yes in -ksmbd.conf), There is a problem where existing data is truncated. -notepad in windows try to O_TRUNC open(FILE_OVERWRITE_IF) and all data -in file is truncated. This patch don't allow O_TRUNC open on read-only -share and add KSMBD_TREE_CONN_FLAG_WRITABLE check in smb2_set_info(). - -Cc: stable@vger.kernel.org -Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> -Signed-off-by: Steve French <stfrench@microsoft.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/smb/server/smb2pdu.c | 23 +++++++++-------------- - 1 file changed, 9 insertions(+), 14 deletions(-) - -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index 652ab429bf2e..ca2c528c9de3 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -2971,7 +2971,7 @@ int smb2_open(struct ksmbd_work *work) - &may_flags); - - if (!test_tree_conn_flag(tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { -- if (open_flags & O_CREAT) { -+ if (open_flags & (O_CREAT | O_TRUNC)) { - ksmbd_debug(SMB, - "User does not have write permission\n"); - rc = -EACCES; -@@ -5943,12 +5943,6 @@ static int smb2_set_info_file(struct ksmbd_work *work, struct ksmbd_file *fp, - } - case FILE_RENAME_INFORMATION: - { -- if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { -- ksmbd_debug(SMB, -- "User does not have write permission\n"); -- return -EACCES; -- } -- - if (buf_len < sizeof(struct smb2_file_rename_info)) - return -EINVAL; - -@@ -5968,12 +5962,6 @@ static int smb2_set_info_file(struct ksmbd_work *work, struct ksmbd_file *fp, - } - case FILE_DISPOSITION_INFORMATION: - { -- if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { -- ksmbd_debug(SMB, -- "User does not have write permission\n"); -- return -EACCES; -- } -- - if (buf_len < sizeof(struct smb2_file_disposition_info)) - return -EINVAL; - -@@ -6035,7 +6023,7 @@ int smb2_set_info(struct ksmbd_work *work) - { - struct smb2_set_info_req *req; - struct smb2_set_info_rsp *rsp; -- struct ksmbd_file *fp; -+ struct ksmbd_file *fp = NULL; - int rc = 0; - unsigned int id = KSMBD_NO_FID, pid = KSMBD_NO_FID; - -@@ -6055,6 +6043,13 @@ int smb2_set_info(struct ksmbd_work *work) - rsp = smb2_get_msg(work->response_buf); - } - -+ if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { -+ ksmbd_debug(SMB, "User does not have write permission\n"); -+ pr_err("User does not have write permission\n"); -+ rc = -EACCES; -+ goto err_out; -+ } -+ - if (!has_file_id(id)) { - id = req->VolatileFileId; - pid = req->PersistentFileId; --- -2.43.2 - -From 68f9b0945b19e8140239c6043f7a9b01f1d1a529 Mon Sep 17 00:00:00 2001 -From: Fedor Pchelkin <pchelkin@ispras.ru> -Date: Tue, 9 Jan 2024 17:14:44 +0300 -Subject: [PATCH 0014/1501] ksmbd: free ppace array on error in parse_dacl -Content-Length: 1685 -Lines: 53 - -commit 8cf9bedfc3c47d24bb0de386f808f925dc52863e upstream. - -The ppace array is not freed if one of the init_acl_state() calls inside -parse_dacl() fails. At the moment the function may fail only due to the -memory allocation errors so it's highly unlikely in this case but -nevertheless a fix is needed. - -Move ppace allocation after the init_acl_state() calls with proper error -handling. - -Found by Linux Verification Center (linuxtesting.org). - -Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") -Cc: stable@vger.kernel.org -Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> -Acked-by: Namjae Jeon <linkinjeon@kernel.org> -Signed-off-by: Steve French <stfrench@microsoft.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/smb/server/smbacl.c | 11 +++++++---- - 1 file changed, 7 insertions(+), 4 deletions(-) - -diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c -index 1164365533f0..1c9775f1efa5 100644 ---- a/fs/smb/server/smbacl.c -+++ b/fs/smb/server/smbacl.c -@@ -401,10 +401,6 @@ static void parse_dacl(struct mnt_idmap *idmap, - if (num_aces > ULONG_MAX / sizeof(struct smb_ace *)) - return; - -- ppace = kmalloc_array(num_aces, sizeof(struct smb_ace *), GFP_KERNEL); -- if (!ppace) -- return; -- - ret = init_acl_state(&acl_state, num_aces); - if (ret) - return; -@@ -414,6 +410,13 @@ static void parse_dacl(struct mnt_idmap *idmap, - return; - } - -+ ppace = kmalloc_array(num_aces, sizeof(struct smb_ace *), GFP_KERNEL); -+ if (!ppace) { -+ free_acl_state(&default_acl_state); -+ free_acl_state(&acl_state); -+ return; -+ } -+ - /* - * reset rwx permissions for user/group/other. - * Also, if num_aces is 0 i.e. DACL has no ACEs, --- -2.43.2 - -From 0de40f76d567133b871cd6ad46bb87afbce46983 Mon Sep 17 00:00:00 2001 -From: Junxiao Bi <junxiao.bi@oracle.com> -Date: Wed, 8 Nov 2023 10:22:16 -0800 -Subject: [PATCH 0015/1501] Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in - raid5d" -Content-Length: 1980 -Lines: 64 - -commit bed9e27baf52a09b7ba2a3714f1e24e17ced386d upstream. - -This reverts commit 5e2cf333b7bd5d3e62595a44d598a254c697cd74. - -That commit introduced the following race and can cause system hung. - - md_write_start: raid5d: - // mddev->in_sync == 1 - set "MD_SB_CHANGE_PENDING" - // running before md_write_start wakeup it - waiting "MD_SB_CHANGE_PENDING" cleared - >>>>>>>>> hung - wakeup mddev->thread - ... - waiting "MD_SB_CHANGE_PENDING" cleared - >>>> hung, raid5d should clear this flag - but get hung by same flag. - -The issue reverted commit fixing is fixed by last patch in a new way. - -Fixes: 5e2cf333b7bd ("md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d") -Cc: stable@vger.kernel.org # v5.19+ -Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com> -Reviewed-by: Yu Kuai <yukuai3@huawei.com> -Signed-off-by: Song Liu <song@kernel.org> -Link: https://lore.kernel.org/r/20231108182216.73611-2-junxiao.bi@oracle.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/md/raid5.c | 12 ------------ - 1 file changed, 12 deletions(-) - -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index 26e1e8a5e941..b02b1a3010f7 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -36,7 +36,6 @@ - */ - - #include <linux/blkdev.h> --#include <linux/delay.h> - #include <linux/kthread.h> - #include <linux/raid/pq.h> - #include <linux/async_tx.h> -@@ -6820,18 +6819,7 @@ static void raid5d(struct md_thread *thread) - spin_unlock_irq(&conf->device_lock); - md_check_recovery(mddev); - spin_lock_irq(&conf->device_lock); -- -- /* -- * Waiting on MD_SB_CHANGE_PENDING below may deadlock -- * seeing md_check_recovery() is needed to clear -- * the flag when using mdmon. -- */ -- continue; - } -- -- wait_event_lock_irq(mddev->sb_wait, -- !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags), -- conf->device_lock); - } - pr_debug("%d stripes handled\n", handled); - --- -2.43.2 - -From 913205930da6213305616ac539447702eaa85e41 Mon Sep 17 00:00:00 2001 -From: Guanghui Feng <guanghuifeng@linux.alibaba.com> -Date: Thu, 21 Dec 2023 17:57:43 +0800 -Subject: [PATCH 0020/1501] uio: Fix use-after-free in uio_open -Content-Length: 2160 -Lines: 71 - -commit 0c9ae0b8605078eafc3bea053cc78791e97ba2e2 upstream. - -core-1 core-2 -------------------------------------------------------- -uio_unregister_device uio_open - idev = idr_find() -device_unregister(&idev->dev) -put_device(&idev->dev) -uio_device_release - get_device(&idev->dev) -kfree(idev) -uio_free_minor(minor) - uio_release - put_device(&idev->dev) - kfree(idev) -------------------------------------------------------- - -In the core-1 uio_unregister_device(), the device_unregister will kfree -idev when the idev->dev kobject ref is 1. But after core-1 -device_unregister, put_device and before doing kfree, the core-2 may -get_device. Then: -1. After core-1 kfree idev, the core-2 will do use-after-free for idev. -2. When core-2 do uio_release and put_device, the idev will be double - freed. - -To address this issue, we can get idev atomic & inc idev reference with -minor_lock. - -Fixes: 57c5f4df0a5a ("uio: fix crash after the device is unregistered") -Cc: stable <stable@kernel.org> -Signed-off-by: Guanghui Feng <guanghuifeng@linux.alibaba.com> -Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com> -Link: https://lore.kernel.org/r/1703152663-59949-1-git-send-email-guanghuifeng@linux.alibaba.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/uio/uio.c | 7 +++---- - 1 file changed, 3 insertions(+), 4 deletions(-) - -diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c -index 62082d64ece0..2d572f6c8ec8 100644 ---- a/drivers/uio/uio.c -+++ b/drivers/uio/uio.c -@@ -466,13 +466,13 @@ static int uio_open(struct inode *inode, struct file *filep) - - mutex_lock(&minor_lock); - idev = idr_find(&uio_idr, iminor(inode)); -- mutex_unlock(&minor_lock); - if (!idev) { - ret = -ENODEV; -+ mutex_unlock(&minor_lock); - goto out; - } -- - get_device(&idev->dev); -+ mutex_unlock(&minor_lock); - - if (!try_module_get(idev->owner)) { - ret = -ENODEV; -@@ -1064,9 +1064,8 @@ void uio_unregister_device(struct uio_info *info) - wake_up_interruptible(&idev->wait); - kill_fasync(&idev->async_queue, SIGIO, POLL_HUP); - -- device_unregister(&idev->dev); -- - uio_free_minor(minor); -+ device_unregister(&idev->dev); - - return; - } --- -2.43.2 - -From 2498b0bbb736ac26aae799bf3d9582abab644d2b Mon Sep 17 00:00:00 2001 -From: LeoLiuoc <LeoLiu-oc@zhaoxin.com> -Date: Mon, 11 Dec 2023 17:15:43 +0800 -Subject: [PATCH 0024/1501] PCI: Add ACS quirk for more Zhaoxin Root Ports -Content-Length: 1769 -Lines: 47 - -commit e367e3c765f5477b2e79da0f1399aed49e2d1e37 upstream. - -Add more Root Port Device IDs to pci_quirk_zhaoxin_pcie_ports_acs() for -some new Zhaoxin platforms. - -Fixes: 299bd044a6f3 ("PCI: Add ACS quirk for Zhaoxin Root/Downstream Ports") -Link: https://lore.kernel.org/r/20231211091543.735903-1-LeoLiu-oc@zhaoxin.com -Signed-off-by: LeoLiuoc <LeoLiu-oc@zhaoxin.com> -[bhelgaas: update subject, drop changelog, add Fixes, add stable tag, fix -whitespace, wrap code comment] -Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> -Cc: <stable@vger.kernel.org> # 5.7 -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/pci/quirks.c | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index ea476252280a..d55a3ffae4b8 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -4699,17 +4699,21 @@ static int pci_quirk_xgene_acs(struct pci_dev *dev, u16 acs_flags) - * But the implementation could block peer-to-peer transactions between them - * and provide ACS-like functionality. - */ --static int pci_quirk_zhaoxin_pcie_ports_acs(struct pci_dev *dev, u16 acs_flags) -+static int pci_quirk_zhaoxin_pcie_ports_acs(struct pci_dev *dev, u16 acs_flags) - { - if (!pci_is_pcie(dev) || - ((pci_pcie_type(dev) != PCI_EXP_TYPE_ROOT_PORT) && - (pci_pcie_type(dev) != PCI_EXP_TYPE_DOWNSTREAM))) - return -ENOTTY; - -+ /* -+ * Future Zhaoxin Root Ports and Switch Downstream Ports will -+ * implement ACS capability in accordance with the PCIe Spec. -+ */ - switch (dev->device) { - case 0x0710 ... 0x071e: - case 0x0721: -- case 0x0723 ... 0x0732: -+ case 0x0723 ... 0x0752: - return pci_acs_ctrl_enabled(acs_flags, - PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF); - } --- -2.43.2 - -From a6d3eb9d4ed5e561cfe7a7e3ce7c71357bd196b7 Mon Sep 17 00:00:00 2001 -From: James Clark <james.clark@arm.com> -Date: Wed, 1 Nov 2023 11:52:06 +0000 -Subject: [PATCH 0025/1501] coresight: etm4x: Fix width of CCITMIN field -Content-Length: 1737 -Lines: 44 - -commit cc0271a339cc70cae914c3ec20edc2a8058407da upstream. - -CCITMIN is a 12 bit field and doesn't fit in a u8, so extend it to u16. -This probably wasn't an issue previously because values higher than 255 -never occurred. - -But since commit 4aff040bcc8d ("coresight: etm: Override TRCIDR3.CCITMIN -on errata affected cpus"), a comparison with 256 was done to enable the -errata, generating the following W=1 build error: - - coresight-etm4x-core.c:1188:24: error: result of comparison of - constant 256 with expression of type 'u8' (aka 'unsigned char') is - always false [-Werror,-Wtautological-constant-out-of-range-compare] - - if (drvdata->ccitmin == 256) - -Cc: stable@vger.kernel.org -Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver") -Reported-by: kernel test robot <lkp@intel.com> -Closes: https://lore.kernel.org/oe-kbuild-all/202310302043.as36UFED-lkp@intel.com/ -Reviewed-by: Mike Leach <mike.leach@linaro.org> -Signed-off-by: James Clark <james.clark@arm.com> -Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> -Link: https://lore.kernel.org/r/20231101115206.70810-1-james.clark@arm.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/hwtracing/coresight/coresight-etm4x.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h -index 20e2e4cb7614..da17b6c49b0f 100644 ---- a/drivers/hwtracing/coresight/coresight-etm4x.h -+++ b/drivers/hwtracing/coresight/coresight-etm4x.h -@@ -1036,7 +1036,7 @@ struct etmv4_drvdata { - u8 ctxid_size; - u8 vmid_size; - u8 ccsize; -- u8 ccitmin; -+ u16 ccitmin; - u8 s_ex_level; - u8 ns_ex_level; - u8 q_support; --- -2.43.2 - -From 2f2eb48bbe34f5b70d8da7d2e26b9222399d367f Mon Sep 17 00:00:00 2001 -From: Carlos Llamas <cmllamas@google.com> -Date: Fri, 29 Sep 2023 03:48:17 +0000 -Subject: [PATCH 0026/1501] scripts/decode_stacktrace.sh: optionally use LLVM - utilities -Content-Length: 3322 -Lines: 94 - -commit efbd6398353315b7018e6943e41fee9ec35e875f upstream. - -GNU's addr2line can have problems parsing a vmlinux built with LLVM, -particularly when LTO was used. In order to decode the traces correctly -this patch adds the ability to switch to LLVM's utilities readelf and -addr2line. The same approach is followed by Will in [1]. - -Before: - $ scripts/decode_stacktrace.sh vmlinux < kernel.log - [17716.240635] Call trace: - [17716.240646] skb_cow_data (??:?) - [17716.240654] esp6_input (ld-temp.o:?) - [17716.240666] xfrm_input (ld-temp.o:?) - [17716.240674] xfrm6_rcv (??:?) - [...] - -After: - $ LLVM=1 scripts/decode_stacktrace.sh vmlinux < kernel.log - [17716.240635] Call trace: - [17716.240646] skb_cow_data (include/linux/skbuff.h:2172 net/core/skbuff.c:4503) - [17716.240654] esp6_input (net/ipv6/esp6.c:977) - [17716.240666] xfrm_input (net/xfrm/xfrm_input.c:659) - [17716.240674] xfrm6_rcv (net/ipv6/xfrm6_input.c:172) - [...] - -Note that one could set CROSS_COMPILE=llvm- instead to hack around this -issue. However, doing so can break the decodecode routine as it will -force the selection of other LLVM utilities down the line e.g. llvm-as. - -[1] https://lore.kernel.org/all/20230914131225.13415-3-will@kernel.org/ - -Link: https://lkml.kernel.org/r/20230929034836.403735-1-cmllamas@google.com -Signed-off-by: Carlos Llamas <cmllamas@google.com> -Reviewed-by: Nick Desaulniers <ndesaulniers@google.com> -Reviewed-by: Elliot Berman <quic_eberman@quicinc.com> -Tested-by: Justin Stitt <justinstitt@google.com> -Cc: Will Deacon <will@kernel.org> -Cc: John Stultz <jstultz@google.com> -Cc: Masahiro Yamada <masahiroy@kernel.org> -Cc: Nathan Chancellor <nathan@kernel.org> -Cc: Tom Rix <trix@redhat.com> -Cc: <stable@vger.kernel.org> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - scripts/decode_stacktrace.sh | 19 +++++++++++++++++-- - 1 file changed, 17 insertions(+), 2 deletions(-) - -diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh -index 564c5632e1a2..bfe5a4082d8e 100755 ---- a/scripts/decode_stacktrace.sh -+++ b/scripts/decode_stacktrace.sh -@@ -16,6 +16,21 @@ elif type c++filt >/dev/null 2>&1 ; then - cppfilt_opts=-i - fi - -+UTIL_SUFFIX= -+if [[ -z ${LLVM:-} ]]; then -+ UTIL_PREFIX=${CROSS_COMPILE:-} -+else -+ UTIL_PREFIX=llvm- -+ if [[ ${LLVM} == */ ]]; then -+ UTIL_PREFIX=${LLVM}${UTIL_PREFIX} -+ elif [[ ${LLVM} == -* ]]; then -+ UTIL_SUFFIX=${LLVM} -+ fi -+fi -+ -+READELF=${UTIL_PREFIX}readelf${UTIL_SUFFIX} -+ADDR2LINE=${UTIL_PREFIX}addr2line${UTIL_SUFFIX} -+ - if [[ $1 == "-r" ]] ; then - vmlinux="" - basepath="auto" -@@ -75,7 +90,7 @@ find_module() { - - if [[ "$modpath" != "" ]] ; then - for fn in $(find "$modpath" -name "${module//_/[-_]}.ko*") ; do -- if readelf -WS "$fn" | grep -qwF .debug_line ; then -+ if ${READELF} -WS "$fn" | grep -qwF .debug_line ; then - echo $fn - return - fi -@@ -169,7 +184,7 @@ parse_symbol() { - if [[ $aarray_support == true && "${cache[$module,$address]+isset}" == "isset" ]]; then - local code=${cache[$module,$address]} - else -- local code=$(${CROSS_COMPILE}addr2line -i -e "$objfile" "$address" 2>/dev/null) -+ local code=$(${ADDR2LINE} -i -e "$objfile" "$address" 2>/dev/null) - if [[ $aarray_support == true ]]; then - cache[$module,$address]=$code - fi --- -2.43.2 - -From f7f4ff54c440c5324229e5ee204698f95487ae73 Mon Sep 17 00:00:00 2001 -From: Vegard Nossum <vegard.nossum@oracle.com> -Date: Wed, 10 Jan 2024 18:47:58 +0100 -Subject: [PATCH 0027/1501] docs: kernel_feat.py: fix potential command - injection -Content-Length: 13280 -Lines: 333 - -commit c48a7c44a1d02516309015b6134c9bb982e17008 upstream. - -The kernel-feat directive passes its argument straight to the shell. -This is unfortunate and unnecessary. - -Let's always use paths relative to $srctree/Documentation/ and use -subprocess.check_call() instead of subprocess.Popen(shell=True). - -This also makes the code shorter. - -This is analogous to commit 3231dd586277 ("docs: kernel_abi.py: fix -command injection") where we did exactly the same thing for -kernel_abi.py, somehow I completely missed this one. - -Link: https://fosstodon.org/@jani/111676532203641247 -Reported-by: Jani Nikula <jani.nikula@intel.com> -Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com> -Cc: stable@vger.kernel.org -Signed-off-by: Jonathan Corbet <corbet@lwn.net> -Link: https://lore.kernel.org/r/20240110174758.3680506-1-vegard.nossum@oracle.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - Documentation/admin-guide/features.rst | 2 +- - Documentation/arch/arc/features.rst | 2 +- - Documentation/arch/arm/features.rst | 2 +- - Documentation/arch/arm64/features.rst | 2 +- - Documentation/arch/loongarch/features.rst | 2 +- - Documentation/arch/m68k/features.rst | 2 +- - Documentation/arch/mips/features.rst | 2 +- - Documentation/arch/nios2/features.rst | 2 +- - Documentation/arch/openrisc/features.rst | 2 +- - Documentation/arch/parisc/features.rst | 2 +- - Documentation/arch/powerpc/features.rst | 2 +- - Documentation/arch/riscv/features.rst | 2 +- - Documentation/arch/s390/features.rst | 2 +- - Documentation/arch/sh/features.rst | 2 +- - Documentation/arch/sparc/features.rst | 2 +- - Documentation/arch/x86/features.rst | 2 +- - Documentation/arch/xtensa/features.rst | 2 +- - Documentation/sphinx/kernel_feat.py | 57 ++++--------------- - .../zh_CN/arch/loongarch/features.rst | 2 +- - .../translations/zh_CN/arch/mips/features.rst | 2 +- - .../zh_TW/arch/loongarch/features.rst | 2 +- - .../translations/zh_TW/arch/mips/features.rst | 2 +- - 22 files changed, 33 insertions(+), 66 deletions(-) - -diff --git a/Documentation/admin-guide/features.rst b/Documentation/admin-guide/features.rst -index 8c167082a84f..7651eca38227 100644 ---- a/Documentation/admin-guide/features.rst -+++ b/Documentation/admin-guide/features.rst -@@ -1,3 +1,3 @@ - .. SPDX-License-Identifier: GPL-2.0 - --.. kernel-feat:: $srctree/Documentation/features -+.. kernel-feat:: features -diff --git a/Documentation/arch/arc/features.rst b/Documentation/arch/arc/features.rst -index b793583d688a..49ff446ff744 100644 ---- a/Documentation/arch/arc/features.rst -+++ b/Documentation/arch/arc/features.rst -@@ -1,3 +1,3 @@ - .. SPDX-License-Identifier: GPL-2.0 - --.. kernel-feat:: $srctree/Documentation/features arc -+.. kernel-feat:: features arc -diff --git a/Documentation/arch/arm/features.rst b/Documentation/arch/arm/features.rst -index 7414ec03dd15..0e76aaf68eca 100644 ---- a/Documentation/arch/arm/features.rst -+++ b/Documentation/arch/arm/features.rst -@@ -1,3 +1,3 @@ - .. SPDX-License-Identifier: GPL-2.0 - --.. kernel-feat:: $srctree/Documentation/features arm -+.. kernel-feat:: features arm -diff --git a/Documentation/arch/arm64/features.rst b/Documentation/arch/arm64/features.rst -index dfa4cb3cd3ef..03321f4309d0 100644 ---- a/Documentation/arch/arm64/features.rst -+++ b/Documentation/arch/arm64/features.rst -@@ -1,3 +1,3 @@ - .. SPDX-License-Identifier: GPL-2.0 - --.. kernel-feat:: $srctree/Documentation/features arm64 -+.. kernel-feat:: features arm64 -diff --git a/Documentation/arch/loongarch/features.rst b/Documentation/arch/loongarch/features.rst -index ebacade3ea45..009f44c7951f 100644 ---- a/Documentation/arch/loongarch/features.rst -+++ b/Documentation/arch/loongarch/features.rst -@@ -1,3 +1,3 @@ - .. SPDX-License-Identifier: GPL-2.0 - --.. kernel-feat:: $srctree/Documentation/features loongarch -+.. kernel-feat:: features loongarch -diff --git a/Documentation/arch/m68k/features.rst b/Documentation/arch/m68k/features.rst -index 5107a2119472..de7f0ccf7fc8 100644 ---- a/Documentation/arch/m68k/features.rst -+++ b/Documentation/arch/m68k/features.rst -@@ -1,3 +1,3 @@ - .. SPDX-License-Identifier: GPL-2.0 - --.. kernel-feat:: $srctree/Documentation/features m68k -+.. kernel-feat:: features m68k -diff --git a/Documentation/arch/mips/features.rst b/Documentation/arch/mips/features.rst -index 1973d729b29a..6e0ffe3e7354 100644 ---- a/Documentation/arch/mips/features.rst -+++ b/Documentation/arch/mips/features.rst -@@ -1,3 +1,3 @@ - .. SPDX-License-Identifier: GPL-2.0 - --.. kernel-feat:: $srctree/Documentation/features mips -+.. kernel-feat:: features mips -diff --git a/Documentation/arch/nios2/features.rst b/Documentation/arch/nios2/features.rst -index 8449e63f69b2..89913810ccb5 100644 ---- a/Documentation/arch/nios2/features.rst -+++ b/Documentation/arch/nios2/features.rst -@@ -1,3 +1,3 @@ - .. SPDX-License-Identifier: GPL-2.0 - --.. kernel-feat:: $srctree/Documentation/features nios2 -+.. kernel-feat:: features nios2 -diff --git a/Documentation/arch/openrisc/features.rst b/Documentation/arch/openrisc/features.rst -index 3f7c40d219f2..bae2e25adfd6 100644 ---- a/Documentation/arch/openrisc/features.rst -+++ b/Documentation/arch/openrisc/features.rst -@@ -1,3 +1,3 @@ - .. SPDX-License-Identifier: GPL-2.0 - --.. kernel-feat:: $srctree/Documentation/features openrisc -+.. kernel-feat:: features openrisc -diff --git a/Documentation/arch/parisc/features.rst b/Documentation/arch/parisc/features.rst -index 501d7c450037..b3aa4d243b93 100644 ---- a/Documentation/arch/parisc/features.rst -+++ b/Documentation/arch/parisc/features.rst -@@ -1,3 +1,3 @@ - .. SPDX-License-Identifier: GPL-2.0 - --.. kernel-feat:: $srctree/Documentation/features parisc -+.. kernel-feat:: features parisc -diff --git a/Documentation/arch/powerpc/features.rst b/Documentation/arch/powerpc/features.rst -index aeae73df86b0..ee4b95e04202 100644 ---- a/Documentation/arch/powerpc/features.rst -+++ b/Documentation/arch/powerpc/features.rst -@@ -1,3 +1,3 @@ - .. SPDX-License-Identifier: GPL-2.0 - --.. kernel-feat:: $srctree/Documentation/features powerpc -+.. kernel-feat:: features powerpc -diff --git a/Documentation/arch/riscv/features.rst b/Documentation/arch/riscv/features.rst -index c70ef6ac2368..36e90144adab 100644 ---- a/Documentation/arch/riscv/features.rst -+++ b/Documentation/arch/riscv/features.rst -@@ -1,3 +1,3 @@ - .. SPDX-License-Identifier: GPL-2.0 - --.. kernel-feat:: $srctree/Documentation/features riscv -+.. kernel-feat:: features riscv -diff --git a/Documentation/arch/s390/features.rst b/Documentation/arch/s390/features.rst -index 57c296a9d8f3..2883dc950681 100644 ---- a/Documentation/arch/s390/features.rst -+++ b/Documentation/arch/s390/features.rst -@@ -1,3 +1,3 @@ - .. SPDX-License-Identifier: GPL-2.0 - --.. kernel-feat:: $srctree/Documentation/features s390 -+.. kernel-feat:: features s390 -diff --git a/Documentation/arch/sh/features.rst b/Documentation/arch/sh/features.rst -index f722af3b6c99..fae48fe81e9b 100644 ---- a/Documentation/arch/sh/features.rst -+++ b/Documentation/arch/sh/features.rst -@@ -1,3 +1,3 @@ - .. SPDX-License-Identifier: GPL-2.0 - --.. kernel-feat:: $srctree/Documentation/features sh -+.. kernel-feat:: features sh -diff --git a/Documentation/arch/sparc/features.rst b/Documentation/arch/sparc/features.rst -index c0c92468b0fe..96835b6d598a 100644 ---- a/Documentation/arch/sparc/features.rst -+++ b/Documentation/arch/sparc/features.rst -@@ -1,3 +1,3 @@ - .. SPDX-License-Identifier: GPL-2.0 - --.. kernel-feat:: $srctree/Documentation/features sparc -+.. kernel-feat:: features sparc -diff --git a/Documentation/arch/x86/features.rst b/Documentation/arch/x86/features.rst -index b663f15053ce..a33616346a38 100644 ---- a/Documentation/arch/x86/features.rst -+++ b/Documentation/arch/x86/features.rst -@@ -1,3 +1,3 @@ - .. SPDX-License-Identifier: GPL-2.0 - --.. kernel-feat:: $srctree/Documentation/features x86 -+.. kernel-feat:: features x86 -diff --git a/Documentation/arch/xtensa/features.rst b/Documentation/arch/xtensa/features.rst -index 6b92c7bfa19d..28dcce1759be 100644 ---- a/Documentation/arch/xtensa/features.rst -+++ b/Documentation/arch/xtensa/features.rst -@@ -1,3 +1,3 @@ - .. SPDX-License-Identifier: GPL-2.0 - --.. kernel-feat:: $srctree/Documentation/features xtensa -+.. kernel-feat:: features xtensa -diff --git a/Documentation/sphinx/kernel_feat.py b/Documentation/sphinx/kernel_feat.py -index b5fa2f0542a5..b9df61eb4501 100644 ---- a/Documentation/sphinx/kernel_feat.py -+++ b/Documentation/sphinx/kernel_feat.py -@@ -37,8 +37,6 @@ import re - import subprocess - import sys - --from os import path -- - from docutils import nodes, statemachine - from docutils.statemachine import ViewList - from docutils.parsers.rst import directives, Directive -@@ -76,33 +74,26 @@ class KernelFeat(Directive): - self.state.document.settings.env.app.warn(message, prefix="") - - def run(self): -- - doc = self.state.document - if not doc.settings.file_insertion_enabled: - raise self.warning("docutils: file insertion disabled") - - env = doc.settings.env -- cwd = path.dirname(doc.current_source) -- cmd = "get_feat.pl rest --enable-fname --dir " -- cmd += self.arguments[0] -+ -+ srctree = os.path.abspath(os.environ["srctree"]) -+ -+ args = [ -+ os.path.join(srctree, 'scripts/get_feat.pl'), -+ 'rest', -+ '--enable-fname', -+ '--dir', -+ os.path.join(srctree, 'Documentation', self.arguments[0]), -+ ] - - if len(self.arguments) > 1: -- cmd += " --arch " + self.arguments[1] -+ args.extend(['--arch', self.arguments[1]]) - -- srctree = path.abspath(os.environ["srctree"]) -- -- fname = cmd -- -- # extend PATH with $(srctree)/scripts -- path_env = os.pathsep.join([ -- srctree + os.sep + "scripts", -- os.environ["PATH"] -- ]) -- shell_env = os.environ.copy() -- shell_env["PATH"] = path_env -- shell_env["srctree"] = srctree -- -- lines = self.runCmd(cmd, shell=True, cwd=cwd, env=shell_env) -+ lines = subprocess.check_output(args, cwd=os.path.dirname(doc.current_source)).decode('utf-8') - - line_regex = re.compile(r"^\.\. FILE (\S+)$") - -@@ -121,30 +112,6 @@ class KernelFeat(Directive): - nodeList = self.nestedParse(out_lines, fname) - return nodeList - -- def runCmd(self, cmd, **kwargs): -- u"""Run command ``cmd`` and return its stdout as unicode.""" -- -- try: -- proc = subprocess.Popen( -- cmd -- , stdout = subprocess.PIPE -- , stderr = subprocess.PIPE -- , **kwargs -- ) -- out, err = proc.communicate() -- -- out, err = codecs.decode(out, 'utf-8'), codecs.decode(err, 'utf-8') -- -- if proc.returncode != 0: -- raise self.severe( -- u"command '%s' failed with return code %d" -- % (cmd, proc.returncode) -- ) -- except OSError as exc: -- raise self.severe(u"problems with '%s' directive: %s." -- % (self.name, ErrorString(exc))) -- return out -- - def nestedParse(self, lines, fname): - content = ViewList() - node = nodes.section() -diff --git a/Documentation/translations/zh_CN/arch/loongarch/features.rst b/Documentation/translations/zh_CN/arch/loongarch/features.rst -index 82bfac180bdc..cec38dda8298 100644 ---- a/Documentation/translations/zh_CN/arch/loongarch/features.rst -+++ b/Documentation/translations/zh_CN/arch/loongarch/features.rst -@@ -5,4 +5,4 @@ - :Original: Documentation/arch/loongarch/features.rst - :Translator: Huacai Chen <chenhuacai@loongson.cn> - --.. kernel-feat:: $srctree/Documentation/features loongarch -+.. kernel-feat:: features loongarch -diff --git a/Documentation/translations/zh_CN/arch/mips/features.rst b/Documentation/translations/zh_CN/arch/mips/features.rst -index da1b956e4a40..0d6df97db069 100644 ---- a/Documentation/translations/zh_CN/arch/mips/features.rst -+++ b/Documentation/translations/zh_CN/arch/mips/features.rst -@@ -10,4 +10,4 @@ - - .. _cn_features: - --.. kernel-feat:: $srctree/Documentation/features mips -+.. kernel-feat:: features mips -diff --git a/Documentation/translations/zh_TW/arch/loongarch/features.rst b/Documentation/translations/zh_TW/arch/loongarch/features.rst -index b64e430f55ae..c2175fd32b54 100644 ---- a/Documentation/translations/zh_TW/arch/loongarch/features.rst -+++ b/Documentation/translations/zh_TW/arch/loongarch/features.rst -@@ -5,5 +5,5 @@ - :Original: Documentation/arch/loongarch/features.rst - :Translator: Huacai Chen <chenhuacai@loongson.cn> - --.. kernel-feat:: $srctree/Documentation/features loongarch -+.. kernel-feat:: features loongarch - -diff --git a/Documentation/translations/zh_TW/arch/mips/features.rst b/Documentation/translations/zh_TW/arch/mips/features.rst -index f69410420035..3d3906c4d08e 100644 ---- a/Documentation/translations/zh_TW/arch/mips/features.rst -+++ b/Documentation/translations/zh_TW/arch/mips/features.rst -@@ -10,5 +10,5 @@ - - .. _tw_features: - --.. kernel-feat:: $srctree/Documentation/features mips -+.. kernel-feat:: features mips - --- -2.43.2 - -From 0f91df0c0fae1a88f11be3eabb1f20f73a88c90a Mon Sep 17 00:00:00 2001 -From: Sumanth Korikkar <sumanthk@linux.ibm.com> -Date: Wed, 10 Jan 2024 15:01:27 +0100 -Subject: [PATCH 0028/1501] mm/memory_hotplug: fix memmap_on_memory sysfs value - retrieval -Content-Length: 2153 -Lines: 52 - -commit 11684134140bb708b6e6de969a060535630b1b53 upstream. - -set_memmap_mode() stores the kernel parameter memmap mode as an integer. -However, the get_memmap_mode() function utilizes param_get_bool() to fetch -the value as a boolean, leading to potential endianness issue. On -Big-endian architectures, the memmap_on_memory is consistently displayed -as 'N' regardless of its actual status. - -To address this endianness problem, the solution involves obtaining the -mode as an integer. This adjustment ensures the proper display of the -memmap_on_memory parameter, presenting it as one of the following options: -Force, Y, or N. - -Link: https://lkml.kernel.org/r/20240110140127.241451-1-sumanthk@linux.ibm.com -Fixes: 2d1f649c7c08 ("mm/memory_hotplug: support memmap_on_memory when memmap is not aligned to pageblocks") -Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com> -Suggested-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com> -Acked-by: David Hildenbrand <david@redhat.com> -Cc: Alexander Gordeev <agordeev@linux.ibm.com> -Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com> -Cc: Heiko Carstens <hca@linux.ibm.com> -Cc: Michal Hocko <mhocko@suse.com> -Cc: Oscar Salvador <osalvador@suse.de> -Cc: Vasily Gorbik <gor@linux.ibm.com> -Cc: <stable@vger.kernel.org> [6.6+] -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - mm/memory_hotplug.c | 8 +++++--- - 1 file changed, 5 insertions(+), 3 deletions(-) - -diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c -index 7a5fc89a8652..c9c2ad5e2681 100644 ---- a/mm/memory_hotplug.c -+++ b/mm/memory_hotplug.c -@@ -101,9 +101,11 @@ static int set_memmap_mode(const char *val, const struct kernel_param *kp) - - static int get_memmap_mode(char *buffer, const struct kernel_param *kp) - { -- if (*((int *)kp->arg) == MEMMAP_ON_MEMORY_FORCE) -- return sprintf(buffer, "force\n"); -- return param_get_bool(buffer, kp); -+ int mode = *((int *)kp->arg); -+ -+ if (mode == MEMMAP_ON_MEMORY_FORCE) -+ return sprintf(buffer, "force\n"); -+ return sprintf(buffer, "%c\n", mode ? 'Y' : 'N'); - } - - static const struct kernel_param_ops memmap_mode_ops = { --- -2.43.2 - -From a91fdae50a6d65ee57378d31284ddec7e9a7ba1b Mon Sep 17 00:00:00 2001 -From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Date: Sat, 20 Jan 2024 11:53:02 +0100 -Subject: [PATCH 0029/1501] Linux 6.7.1 -Content-Length: 1018 -Lines: 32 - -Link: https://lore.kernel.org/r/20240118104301.249503558@linuxfoundation.org -Tested-by: Ronald Warsow <rwarsow@gmx.de> -Tested-by: Allen Pais <apais@linux.microsoft.com> -Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> -Tested-by: SeongJae Park <sj@kernel.org> -Tested-by: Shuah Khan <skhan@linuxfoundation.org> -Tested-by: Ron Economos <re@w6rz.net> -Tested-by: Bagas Sanjaya <bagasdotme@gmail.com> -Tested-by: Ricardo B. Marliere <ricardo@marliere.net> -Tested-by: Jon Hunter <jonathanh@nvidia.com> -Tested-by: Luna Jernberg <droidbittin@gmail.com> -Tested-by: Justin M. Forbes <jforbes@fedoraproject.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - Makefile | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Makefile b/Makefile -index c6f549f6a4ae..186da2386a06 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 7 --SUBLEVEL = 0 -+SUBLEVEL = 1 - EXTRAVERSION = - NAME = Hurr durr I'ma ninja sloth - --- -2.43.2 - -From 426fae93c01dffa379225eb2bd4d3cdc42c6eec5 Mon Sep 17 00:00:00 2001 -From: Arnd Bergmann <arnd@arndb.de> -Date: Wed, 22 Nov 2023 23:19:53 +0100 -Subject: [PATCH 0032/1501] EDAC/thunderx: Fix possible out-of-bounds string - access -Content-Length: 3257 -Lines: 83 - -[ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ] - -Enabling -Wstringop-overflow globally exposes a warning for a common bug -in the usage of strncat(): - - drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': - drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] - 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - ... - 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); - ... - 1150 | strncat(msg, other, OCX_MESSAGE_SIZE); - - ... - -Apparently the author of this driver expected strncat() to behave the -way that strlcat() does, which uses the size of the destination buffer -as its third argument rather than the length of the source buffer. The -result is that there is no check on the size of the allocated buffer. - -Change it to strlcat(). - - [ bp: Trim compiler output, fixup commit message. ] - -Fixes: 41003396f932 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver") -Signed-off-by: Arnd Bergmann <arnd@arndb.de> -Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> -Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> -Link: https://lore.kernel.org/r/20231122222007.3199885-1-arnd@kernel.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/edac/thunderx_edac.c | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c -index b9c5772da959..90d46e5c4ff0 100644 ---- a/drivers/edac/thunderx_edac.c -+++ b/drivers/edac/thunderx_edac.c -@@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) - decode_register(other, OCX_OTHER_SIZE, - ocx_com_errors, ctx->reg_com_int); - -- strncat(msg, other, OCX_MESSAGE_SIZE); -+ strlcat(msg, other, OCX_MESSAGE_SIZE); - - for (lane = 0; lane < OCX_RX_LANES; lane++) - if (ctx->reg_com_int & BIT(lane)) { -@@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) - lane, ctx->reg_lane_int[lane], - lane, ctx->reg_lane_stat11[lane]); - -- strncat(msg, other, OCX_MESSAGE_SIZE); -+ strlcat(msg, other, OCX_MESSAGE_SIZE); - - decode_register(other, OCX_OTHER_SIZE, - ocx_lane_errors, - ctx->reg_lane_int[lane]); -- strncat(msg, other, OCX_MESSAGE_SIZE); -+ strlcat(msg, other, OCX_MESSAGE_SIZE); - } - - if (ctx->reg_com_int & OCX_COM_INT_CE) -@@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id) - decode_register(other, OCX_OTHER_SIZE, - ocx_com_link_errors, ctx->reg_com_link_int); - -- strncat(msg, other, OCX_MESSAGE_SIZE); -+ strlcat(msg, other, OCX_MESSAGE_SIZE); - - if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE) - edac_device_handle_ue(ocx->edac_dev, 0, 0, msg); -@@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id) - - decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int); - -- strncat(msg, other, L2C_MESSAGE_SIZE); -+ strlcat(msg, other, L2C_MESSAGE_SIZE); - - if (ctx->reg_int & mask_ue) - edac_device_handle_ue(l2c->edac_dev, 0, 0, msg); --- -2.43.2 - -From 92d79ca28df4b3d8223a7c12bae537d144b45506 Mon Sep 17 00:00:00 2001 -From: Masahiro Yamada <masahiroy@kernel.org> -Date: Tue, 21 Nov 2023 08:23:32 +0900 -Subject: [PATCH 0033/1501] powerpc: add crtsavres.o to always-y instead of - extra-y -Content-Length: 1795 -Lines: 42 - -[ Upstream commit 1b1e38002648819c04773647d5242990e2824264 ] - -crtsavres.o is linked to modules. However, as explained in commit -d0e628cd817f ("kbuild: doc: clarify the difference between extra-y -and always-y"), 'make modules' does not build extra-y. - -For example, the following command fails: - - $ make ARCH=powerpc LLVM=1 KBUILD_MODPOST_WARN=1 mrproper ps3_defconfig modules - [snip] - LD [M] arch/powerpc/platforms/cell/spufs/spufs.ko - ld.lld: error: cannot open arch/powerpc/lib/crtsavres.o: No such file or directory - make[3]: *** [scripts/Makefile.modfinal:56: arch/powerpc/platforms/cell/spufs/spufs.ko] Error 1 - make[2]: *** [Makefile:1844: modules] Error 2 - make[1]: *** [/home/masahiro/workspace/linux-kbuild/Makefile:350: __build_one_by_one] Error 2 - make: *** [Makefile:234: __sub-make] Error 2 - -Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> -Fixes: baa25b571a16 ("powerpc/64: Do not link crtsavres.o in vmlinux") -Reviewed-by: Nicholas Piggin <npiggin@gmail.com> -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Link: https://msgid.link/20231120232332.4100288-1-masahiroy@kernel.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/powerpc/lib/Makefile | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile -index 51ad0397c17a..6eac63e79a89 100644 ---- a/arch/powerpc/lib/Makefile -+++ b/arch/powerpc/lib/Makefile -@@ -45,7 +45,7 @@ obj-$(CONFIG_FUNCTION_ERROR_INJECTION) += error-inject.o - # so it is only needed for modules, and only for older linkers which - # do not support --save-restore-funcs - ifndef CONFIG_LD_IS_BFD --extra-$(CONFIG_PPC64) += crtsavres.o -+always-$(CONFIG_PPC64) += crtsavres.o - endif - - obj-$(CONFIG_PPC_BOOK3S_64) += copyuser_power7.o copypage_power7.o \ --- -2.43.2 - -From cdd8fc7dc4176ed04662b77d132f89d4835e6df0 Mon Sep 17 00:00:00 2001 -From: Jann Horn <jannh@google.com> -Date: Fri, 24 Nov 2023 16:08:22 +0100 -Subject: [PATCH 0034/1501] fs/pipe: Fix lockdep false-positive in watchqueue - pipe_write() -Content-Length: 2336 -Lines: 66 - -[ Upstream commit 055ca83559912f2cfd91c9441427bac4caf3c74e ] - -When you try to splice between a normal pipe and a notification pipe, -get_pipe_info(..., true) fails, so splice() falls back to treating the -notification pipe like a normal pipe - so we end up in -iter_file_splice_write(), which first locks the input pipe, then calls -vfs_iter_write(), which locks the output pipe. - -Lockdep complains about that, because we're taking a pipe lock while -already holding another pipe lock. - -I think this probably (?) can't actually lead to deadlocks, since you'd -need another way to nest locking a normal pipe into locking a -watch_queue pipe, but the lockdep annotations don't make that clear. - -Bail out earlier in pipe_write() for notification pipes, before taking -the pipe lock. - -Reported-and-tested-by: <syzbot+011e4ea1da6692cf881c@syzkaller.appspotmail.com> -Closes: https://syzkaller.appspot.com/bug?extid=011e4ea1da6692cf881c -Fixes: c73be61cede5 ("pipe: Add general notification queue support") -Signed-off-by: Jann Horn <jannh@google.com> -Link: https://lore.kernel.org/r/20231124150822.2121798-1-jannh@google.com -Signed-off-by: Christian Brauner <brauner@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/pipe.c | 17 ++++++++++++----- - 1 file changed, 12 insertions(+), 5 deletions(-) - -diff --git a/fs/pipe.c b/fs/pipe.c -index 804a7d789452..226e7f66b590 100644 ---- a/fs/pipe.c -+++ b/fs/pipe.c -@@ -446,6 +446,18 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from) - bool was_empty = false; - bool wake_next_writer = false; - -+ /* -+ * Reject writing to watch queue pipes before the point where we lock -+ * the pipe. -+ * Otherwise, lockdep would be unhappy if the caller already has another -+ * pipe locked. -+ * If we had to support locking a normal pipe and a notification pipe at -+ * the same time, we could set up lockdep annotations for that, but -+ * since we don't actually need that, it's simpler to just bail here. -+ */ -+ if (pipe_has_watch_queue(pipe)) -+ return -EXDEV; -+ - /* Null write succeeds. */ - if (unlikely(total_len == 0)) - return 0; -@@ -458,11 +470,6 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from) - goto out; - } - -- if (pipe_has_watch_queue(pipe)) { -- ret = -EXDEV; -- goto out; -- } -- - /* - * If it wasn't empty we try to merge new data into - * the last buffer. --- -2.43.2 - -From a85aeb83f3423ea38cbecbdf0a09de4b57d49360 Mon Sep 17 00:00:00 2001 -From: Peter Zijlstra <peterz@infradead.org> -Date: Wed, 15 Nov 2023 10:13:23 -0500 -Subject: [PATCH 0035/1501] x86: Fix CPUIDLE_FLAG_IRQ_ENABLE leaking timer - reprogram -Status: RO -Content-Length: 3964 -Lines: 113 - -[ Upstream commit edc8fc01f608108b0b7580cb2c29dfb5135e5f0e ] - -intel_idle_irq() re-enables IRQs very early. As a result, an interrupt -may fire before mwait() is eventually called. If such an interrupt queues -a timer, it may go unnoticed until mwait returns and the idle loop -handles the tick re-evaluation. And monitoring TIF_NEED_RESCHED doesn't -help because a local timer enqueue doesn't set that flag. - -The issue is mitigated by the fact that this idle handler is only invoked -for shallow C-states when, presumably, the next tick is supposed to be -close enough. There may still be rare cases though when the next tick -is far away and the selected C-state is shallow, resulting in a timer -getting ignored for a while. - -Fix this with using sti_mwait() whose IRQ-reenablement only triggers -upon calling mwait(), dealing with the race while keeping the interrupt -latency within acceptable bounds. - -Fixes: c227233ad64c (intel_idle: enable interrupts before C1 on Xeons) -Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> -Signed-off-by: Frederic Weisbecker <frederic@kernel.org> -Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> -Acked-by: Rafael J. Wysocki <rafael@kernel.org> -Link: https://lkml.kernel.org/r/20231115151325.6262-3-frederic@kernel.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/x86/include/asm/mwait.h | 11 +++++++++-- - drivers/idle/intel_idle.c | 19 +++++++------------ - 2 files changed, 16 insertions(+), 14 deletions(-) - -diff --git a/arch/x86/include/asm/mwait.h b/arch/x86/include/asm/mwait.h -index 778df05f8539..bae83810505b 100644 ---- a/arch/x86/include/asm/mwait.h -+++ b/arch/x86/include/asm/mwait.h -@@ -115,8 +115,15 @@ static __always_inline void mwait_idle_with_hints(unsigned long eax, unsigned lo - } - - __monitor((void *)¤t_thread_info()->flags, 0, 0); -- if (!need_resched()) -- __mwait(eax, ecx); -+ -+ if (!need_resched()) { -+ if (ecx & 1) { -+ __mwait(eax, ecx); -+ } else { -+ __sti_mwait(eax, ecx); -+ raw_local_irq_disable(); -+ } -+ } - } - current_clr_polling(); - } -diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c -index dcda0afecfc5..3e01a6b23e75 100644 ---- a/drivers/idle/intel_idle.c -+++ b/drivers/idle/intel_idle.c -@@ -131,11 +131,12 @@ static unsigned int mwait_substates __initdata; - #define MWAIT2flg(eax) ((eax & 0xFF) << 24) - - static __always_inline int __intel_idle(struct cpuidle_device *dev, -- struct cpuidle_driver *drv, int index) -+ struct cpuidle_driver *drv, -+ int index, bool irqoff) - { - struct cpuidle_state *state = &drv->states[index]; - unsigned long eax = flg2MWAIT(state->flags); -- unsigned long ecx = 1; /* break on interrupt flag */ -+ unsigned long ecx = 1*irqoff; /* break on interrupt flag */ - - mwait_idle_with_hints(eax, ecx); - -@@ -159,19 +160,13 @@ static __always_inline int __intel_idle(struct cpuidle_device *dev, - static __cpuidle int intel_idle(struct cpuidle_device *dev, - struct cpuidle_driver *drv, int index) - { -- return __intel_idle(dev, drv, index); -+ return __intel_idle(dev, drv, index, true); - } - - static __cpuidle int intel_idle_irq(struct cpuidle_device *dev, - struct cpuidle_driver *drv, int index) - { -- int ret; -- -- raw_local_irq_enable(); -- ret = __intel_idle(dev, drv, index); -- raw_local_irq_disable(); -- -- return ret; -+ return __intel_idle(dev, drv, index, false); - } - - static __cpuidle int intel_idle_ibrs(struct cpuidle_device *dev, -@@ -184,7 +179,7 @@ static __cpuidle int intel_idle_ibrs(struct cpuidle_device *dev, - if (smt_active) - __update_spec_ctrl(0); - -- ret = __intel_idle(dev, drv, index); -+ ret = __intel_idle(dev, drv, index, true); - - if (smt_active) - __update_spec_ctrl(spec_ctrl); -@@ -196,7 +191,7 @@ static __cpuidle int intel_idle_xstate(struct cpuidle_device *dev, - struct cpuidle_driver *drv, int index) - { - fpu_idle_fpregs(); -- return __intel_idle(dev, drv, index); -+ return __intel_idle(dev, drv, index, true); - } - - /** --- -2.43.2 - -From 9bca92a9b66bd780910c928eba14adfa1d8e1f31 Mon Sep 17 00:00:00 2001 -From: Randy Dunlap <rdunlap@infradead.org> -Date: Thu, 30 Nov 2023 21:51:59 -0800 -Subject: [PATCH 0036/1501] powerpc/44x: select I2C for CURRITUCK -Content-Length: 1357 -Lines: 35 - -[ Upstream commit 4a74197b65e69c46fe6e53f7df2f4d6ce9ffe012 ] - -Fix build errors when CURRITUCK=y and I2C is not builtin (=m or is -not set). Fixes these build errors: - -powerpc-linux-ld: arch/powerpc/platforms/44x/ppc476.o: in function `avr_halt_system': -ppc476.c:(.text+0x58): undefined reference to `i2c_smbus_write_byte_data' -powerpc-linux-ld: arch/powerpc/platforms/44x/ppc476.o: in function `ppc47x_device_probe': -ppc476.c:(.init.text+0x18): undefined reference to `i2c_register_driver' - -Fixes: 2a2c74b2efcb ("IBM Akebono: Add the Akebono platform") -Signed-off-by: Randy Dunlap <rdunlap@infradead.org> -Reported-by: kernel test robot <lkp@intel.com> -Closes: lore.kernel.org/r/202312010820.cmdwF5X9-lkp@intel.com -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Link: https://msgid.link/20231201055159.8371-1-rdunlap@infradead.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/powerpc/platforms/44x/Kconfig | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/arch/powerpc/platforms/44x/Kconfig b/arch/powerpc/platforms/44x/Kconfig -index 1624ebf95497..35a1f4b9f827 100644 ---- a/arch/powerpc/platforms/44x/Kconfig -+++ b/arch/powerpc/platforms/44x/Kconfig -@@ -173,6 +173,7 @@ config ISS4xx - config CURRITUCK - bool "IBM Currituck (476fpe) Support" - depends on PPC_47x -+ select I2C - select SWIOTLB - select 476FPE - select FORCE_PCI --- -2.43.2 - -From 708a4b59baad96c4718dc0bd3a3427d3ab22fedc Mon Sep 17 00:00:00 2001 -From: Nathan Lynch <nathanl@linux.ibm.com> -Date: Tue, 14 Nov 2023 11:01:53 -0600 -Subject: [PATCH 0037/1501] powerpc/pseries/memhp: Fix access beyond end of - drmem array -Content-Length: 3266 -Lines: 93 - -[ Upstream commit bd68ffce69f6cf8ddd3a3c32549d1d2275e49fc5 ] - -dlpar_memory_remove_by_index() may access beyond the bounds of the -drmem lmb array when the LMB lookup fails to match an entry with the -given DRC index. When the search fails, the cursor is left pointing to -&drmem_info->lmbs[drmem_info->n_lmbs], which is one element past the -last valid entry in the array. The debug message at the end of the -function then dereferences this pointer: - - pr_debug("Failed to hot-remove memory at %llx\n", - lmb->base_addr); - -This was found by inspection and confirmed with KASAN: - - pseries-hotplug-mem: Attempting to hot-remove LMB, drc index 1234 - ================================================================== - BUG: KASAN: slab-out-of-bounds in dlpar_memory+0x298/0x1658 - Read of size 8 at addr c000000364e97fd0 by task bash/949 - - dump_stack_lvl+0xa4/0xfc (unreliable) - print_report+0x214/0x63c - kasan_report+0x140/0x2e0 - __asan_load8+0xa8/0xe0 - dlpar_memory+0x298/0x1658 - handle_dlpar_errorlog+0x130/0x1d0 - dlpar_store+0x18c/0x3e0 - kobj_attr_store+0x68/0xa0 - sysfs_kf_write+0xc4/0x110 - kernfs_fop_write_iter+0x26c/0x390 - vfs_write+0x2d4/0x4e0 - ksys_write+0xac/0x1a0 - system_call_exception+0x268/0x530 - system_call_vectored_common+0x15c/0x2ec - - Allocated by task 1: - kasan_save_stack+0x48/0x80 - kasan_set_track+0x34/0x50 - kasan_save_alloc_info+0x34/0x50 - __kasan_kmalloc+0xd0/0x120 - __kmalloc+0x8c/0x320 - kmalloc_array.constprop.0+0x48/0x5c - drmem_init+0x2a0/0x41c - do_one_initcall+0xe0/0x5c0 - kernel_init_freeable+0x4ec/0x5a0 - kernel_init+0x30/0x1e0 - ret_from_kernel_user_thread+0x14/0x1c - - The buggy address belongs to the object at c000000364e80000 - which belongs to the cache kmalloc-128k of size 131072 - The buggy address is located 0 bytes to the right of - allocated 98256-byte region [c000000364e80000, c000000364e97fd0) - - ================================================================== - pseries-hotplug-mem: Failed to hot-remove memory at 0 - -Log failed lookups with a separate message and dereference the -cursor only when it points to a valid entry. - -Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com> -Fixes: 51925fb3c5c9 ("powerpc/pseries: Implement memory hotplug remove in the kernel") -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Link: https://msgid.link/20231114-pseries-memhp-fixes-v1-1-fb8f2bb7c557@linux.ibm.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/powerpc/platforms/pseries/hotplug-memory.c | 9 +++++---- - 1 file changed, 5 insertions(+), 4 deletions(-) - -diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c -index a43bfb01720a..6f2eebae7bee 100644 ---- a/arch/powerpc/platforms/pseries/hotplug-memory.c -+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c -@@ -436,14 +436,15 @@ static int dlpar_memory_remove_by_index(u32 drc_index) - } - } - -- if (!lmb_found) -+ if (!lmb_found) { -+ pr_debug("Failed to look up LMB for drc index %x\n", drc_index); - rc = -EINVAL; -- -- if (rc) -+ } else if (rc) { - pr_debug("Failed to hot-remove memory at %llx\n", - lmb->base_addr); -- else -+ } else { - pr_debug("Memory at %llx was hot-removed\n", lmb->base_addr); -+ } - - return rc; - } --- -2.43.2 - -From 8a9837401dde6169108ebc6450b4c5e38a398828 Mon Sep 17 00:00:00 2001 -From: "Borislav Petkov (AMD)" <bp@alien8.de> -Date: Fri, 1 Dec 2023 14:35:06 +0100 -Subject: [PATCH 0038/1501] x86/microcode/intel: Set new revision only after a - successful update -Content-Length: 1892 -Lines: 60 - -[ Upstream commit 9c21ea53e6bd1104c637b80a0688040f184cc761 ] - -This was meant to be done only when early microcode got updated -successfully. Move it into the if-branch. - -Also, make sure the current revision is read unconditionally and only -once. - -Fixes: 080990aa3344 ("x86/microcode: Rework early revisions reporting") -Reported-by: Ashok Raj <ashok.raj@intel.com> -Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> -Tested-by: Ashok Raj <ashok.raj@intel.com> -Link: https://lore.kernel.org/r/ZWjVt5dNRjbcvlzR@a4bf019067fa.jf.intel.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/x86/kernel/cpu/microcode/intel.c | 14 +++++++------- - 1 file changed, 7 insertions(+), 7 deletions(-) - -diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c -index 070426b9895f..334972c097d9 100644 ---- a/arch/x86/kernel/cpu/microcode/intel.c -+++ b/arch/x86/kernel/cpu/microcode/intel.c -@@ -370,14 +370,14 @@ static __init struct microcode_intel *get_microcode_blob(struct ucode_cpu_info * - { - struct cpio_data cp; - -+ intel_collect_cpu_info(&uci->cpu_sig); -+ - if (!load_builtin_intel_microcode(&cp)) - cp = find_microcode_in_initrd(ucode_path); - - if (!(cp.data && cp.size)) - return NULL; - -- intel_collect_cpu_info(&uci->cpu_sig); -- - return scan_microcode(cp.data, cp.size, uci, save); - } - -@@ -410,13 +410,13 @@ void __init load_ucode_intel_bsp(struct early_load_data *ed) - { - struct ucode_cpu_info uci; - -- ed->old_rev = intel_get_microcode_revision(); -- - uci.mc = get_microcode_blob(&uci, false); -- if (uci.mc && apply_microcode_early(&uci) == UCODE_UPDATED) -- ucode_patch_va = UCODE_BSP_LOADED; -+ ed->old_rev = uci.cpu_sig.rev; - -- ed->new_rev = uci.cpu_sig.rev; -+ if (uci.mc && apply_microcode_early(&uci) == UCODE_UPDATED) { -+ ucode_patch_va = UCODE_BSP_LOADED; -+ ed->new_rev = uci.cpu_sig.rev; -+ } - } - - void load_ucode_intel_ap(void) --- -2.43.2 - -From 045dd9f81f80b283a46f5c6af6a0ddd651de8182 Mon Sep 17 00:00:00 2001 -From: Robin Murphy <robin.murphy@arm.com> -Date: Thu, 23 Nov 2023 11:58:13 +0000 -Subject: [PATCH 0039/1501] perf/arm-cmn: Fix HN-F class_occup_id events -Content-Length: 1469 -Lines: 32 - -[ Upstream commit 590f23b092401f29e410fd4ca67128fcc45192fc ] - -A subtle copy-paste error managed to slip through the reorganisation -of these patches in development, and not only give some HN-F events -the wrong type, but use that wrong type before the subsequent patch -defined it. Too late to fix history, but we can at least fix the bug. - -Fixes: b1b7dc38e482 ("perf/arm-cmn: Refactor HN-F event selector macros") -Reported-by: Jing Zhang <renyu.zj@linux.alibaba.com> -Signed-off-by: Robin Murphy <robin.murphy@arm.com> -Link: https://lore.kernel.org/r/5a22439de84ff188ef76674798052448eb03a3e1.1700740693.git.robin.murphy@arm.com -Signed-off-by: Will Deacon <will@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/perf/arm-cmn.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c -index 847b0dc41293..c584165b13ba 100644 ---- a/drivers/perf/arm-cmn.c -+++ b/drivers/perf/arm-cmn.c -@@ -811,7 +811,7 @@ static umode_t arm_cmn_event_attr_is_visible(struct kobject *kobj, - #define CMN_EVENT_HNF_OCC(_model, _name, _event) \ - CMN_EVENT_HN_OCC(_model, hnf_##_name, CMN_TYPE_HNF, _event) - #define CMN_EVENT_HNF_CLS(_model, _name, _event) \ -- CMN_EVENT_HN_CLS(_model, hnf_##_name, CMN_TYPE_HNS, _event) -+ CMN_EVENT_HN_CLS(_model, hnf_##_name, CMN_TYPE_HNF, _event) - #define CMN_EVENT_HNF_SNT(_model, _name, _event) \ - CMN_EVENT_HN_SNT(_model, hnf_##_name, CMN_TYPE_HNF, _event) - --- -2.43.2 - -From cd36bd5ff1f6d4c9ed7677fb4f40d4e018b3dee0 Mon Sep 17 00:00:00 2001 -From: Junhao He <hejunhao3@huawei.com> -Date: Mon, 4 Dec 2023 19:04:25 +0800 -Subject: [PATCH 0040/1501] drivers/perf: hisi: Fix some event id for HiSilicon - UC pmu -Content-Length: 1324 -Lines: 31 - -[ Upstream commit 38bbef7240b8c5f2dc4493eec356e2efbf2da5f4 ] - -Some event id of HiSilicon uncore UC PMU driver is incorrect, fix them. - -Fixes: 312eca95e28d ("drivers/perf: hisi: Add support for HiSilicon UC PMU driver") -Signed-off-by: Junhao He <hejunhao3@huawei.com> -Reviewed-by: Yicong Yang <yangyicong@hisilicon.com> -Link: https://lore.kernel.org/r/20231204110425.20354-1-hejunhao3@huawei.com -Signed-off-by: Will Deacon <will@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/perf/hisilicon/hisi_uncore_uc_pmu.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c b/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c -index 63da05e5831c..636fb79647c8 100644 ---- a/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c -+++ b/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c -@@ -383,8 +383,8 @@ static struct attribute *hisi_uc_pmu_events_attr[] = { - HISI_PMU_EVENT_ATTR(cpu_rd, 0x10), - HISI_PMU_EVENT_ATTR(cpu_rd64, 0x17), - HISI_PMU_EVENT_ATTR(cpu_rs64, 0x19), -- HISI_PMU_EVENT_ATTR(cpu_mru, 0x1a), -- HISI_PMU_EVENT_ATTR(cycles, 0x9c), -+ HISI_PMU_EVENT_ATTR(cpu_mru, 0x1c), -+ HISI_PMU_EVENT_ATTR(cycles, 0x95), - HISI_PMU_EVENT_ATTR(spipe_hit, 0xb3), - HISI_PMU_EVENT_ATTR(hpipe_hit, 0xdb), - HISI_PMU_EVENT_ATTR(cring_rxdat_cnt, 0xfa), --- -2.43.2 - -From e74686601ca2e90821cf149a5b68b8cb89d9b2d3 Mon Sep 17 00:00:00 2001 -From: Nicholas Piggin <npiggin@gmail.com> -Date: Fri, 1 Dec 2023 18:56:11 +0530 -Subject: [PATCH 0041/1501] KVM: PPC: Book3S HV: Handle pending exceptions on - guest entry with MSR_EE -Content-Length: 2091 -Lines: 53 - -[ Upstream commit ecd10702baae5c16a91d139bde7eff84ce55daee ] - -Commit 026728dc5d41 ("KVM: PPC: Book3S HV P9: Inject pending xive -interrupts at guest entry") changed guest entry so that if external -interrupts are enabled, BOOK3S_IRQPRIO_EXTERNAL is not tested for. Test -for this regardless of MSR_EE. - -For an L1 host, do not inject an interrupt, but always -use LPCR_MER. If the L0 desires it can inject an interrupt. - -Fixes: 026728dc5d41 ("KVM: PPC: Book3S HV P9: Inject pending xive interrupts at guest entry") -Signed-off-by: Nicholas Piggin <npiggin@gmail.com> -[jpn: use kvmpcc_get_msr(), write commit message] -Signed-off-by: Jordan Niethe <jniethe5@gmail.com> -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Link: https://msgid.link/20231201132618.555031-7-vaibhav@linux.ibm.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/powerpc/kvm/book3s_hv.c | 18 ++++++++++++------ - 1 file changed, 12 insertions(+), 6 deletions(-) - -diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c -index 1ed6ec140701..002a7573a5d4 100644 ---- a/arch/powerpc/kvm/book3s_hv.c -+++ b/arch/powerpc/kvm/book3s_hv.c -@@ -4736,13 +4736,19 @@ int kvmhv_run_single_vcpu(struct kvm_vcpu *vcpu, u64 time_limit, - - if (!nested) { - kvmppc_core_prepare_to_enter(vcpu); -- if (__kvmppc_get_msr_hv(vcpu) & MSR_EE) { -- if (xive_interrupt_pending(vcpu)) -+ if (test_bit(BOOK3S_IRQPRIO_EXTERNAL, -+ &vcpu->arch.pending_exceptions) || -+ xive_interrupt_pending(vcpu)) { -+ /* -+ * For nested HV, don't synthesize but always pass MER, -+ * the L0 will be able to optimise that more -+ * effectively than manipulating registers directly. -+ */ -+ if (!kvmhv_on_pseries() && (__kvmppc_get_msr_hv(vcpu) & MSR_EE)) - kvmppc_inject_interrupt_hv(vcpu, -- BOOK3S_INTERRUPT_EXTERNAL, 0); -- } else if (test_bit(BOOK3S_IRQPRIO_EXTERNAL, -- &vcpu->arch.pending_exceptions)) { -- lpcr |= LPCR_MER; -+ BOOK3S_INTERRUPT_EXTERNAL, 0); -+ else -+ lpcr |= LPCR_MER; - } - } else if (vcpu->arch.pending_exceptions || - vcpu->arch.doorbell_request || --- -2.43.2 - -From eb765f5a804ff5969ce08687e1dc36233ae44921 Mon Sep 17 00:00:00 2001 -From: Kajol Jain <kjain@linux.ibm.com> -Date: Thu, 16 Nov 2023 17:50:32 +0530 -Subject: [PATCH 0043/1501] powerpc/hv-gpci: Add return value check in - affinity_domain_via_partition_show function -Content-Length: 2143 -Lines: 58 - -[ Upstream commit 070b71f428facd9130319707db854ed8bd24637a ] - -To access hv-gpci kernel interface files data, the -"Enable Performance Information Collection" option has to be set -in hmc. Incase that option is not set and user try to read -the interface files, it should give error message as -operation not permitted. - -Result of accessing added interface files with disabled -performance collection option: - -[command]# cat processor_bus_topology -cat: processor_bus_topology: Operation not permitted - -[command]# cat processor_config -cat: processor_config: Operation not permitted - -[command]# cat affinity_domain_via_domain -cat: affinity_domain_via_domain: Operation not permitted - -[command]# cat affinity_domain_via_virtual_processor -cat: affinity_domain_via_virtual_processor: Operation not permitted - -[command]# cat affinity_domain_via_partition - -Based on above result there is no error message when reading -affinity_domain_via_partition file because of missing -check for failed hcall. Fix this issue by adding -a check in the start of affinity_domain_via_partition_show -function, to return error incase hcall fails, with error type -other then H_PARAMETER. - -Fixes: a15e0d6a6929 ("powerpc/hv_gpci: Add sysfs file inside hv_gpci device to show affinity domain via partition information") -Reported-by: Disha Goel <disgoel@linux.vnet.ibm.com> -Signed-off-by: Kajol Jain <kjain@linux.ibm.com> -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Link: https://msgid.link/20231116122033.160964-1-kjain@linux.ibm.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/powerpc/perf/hv-gpci.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/arch/powerpc/perf/hv-gpci.c b/arch/powerpc/perf/hv-gpci.c -index 39dbe6b348df..27f18119fda1 100644 ---- a/arch/powerpc/perf/hv-gpci.c -+++ b/arch/powerpc/perf/hv-gpci.c -@@ -534,6 +534,9 @@ static ssize_t affinity_domain_via_partition_show(struct device *dev, struct dev - if (!ret) - goto parse_result; - -+ if (ret && (ret != H_PARAMETER)) -+ goto out; -+ - /* - * ret value as 'H_PARAMETER' implies that the current buffer size - * can't accommodate all the information, and a partial buffer --- -2.43.2 - -From 3bbe74e896e345894bc671dce26f349c85ca5c2c Mon Sep 17 00:00:00 2001 -From: Nathan Lynch <nathanl@linux.ibm.com> -Date: Tue, 12 Dec 2023 11:01:48 -0600 -Subject: [PATCH 0044/1501] powerpc/rtas: Avoid warning on invalid token - argument to sys_rtas() -Content-Length: 3403 -Lines: 86 - -[ Upstream commit 01e346ffefda3a7088afebf02b940614179688e7 ] - -rtas_token_to_function() WARNs when passed an invalid token; it's -meant to catch bugs in kernel-based users of RTAS functions. However, -user space controls the token value passed to rtas_token_to_function() -by block_rtas_call(), so user space with sufficient privilege to use -sys_rtas() can trigger the warnings at will: - - unexpected failed lookup for token 2048 - WARNING: CPU: 20 PID: 2247 at arch/powerpc/kernel/rtas.c:556 - rtas_token_to_function+0xfc/0x110 - ... - NIP rtas_token_to_function+0xfc/0x110 - LR rtas_token_to_function+0xf8/0x110 - Call Trace: - rtas_token_to_function+0xf8/0x110 (unreliable) - sys_rtas+0x188/0x880 - system_call_exception+0x268/0x530 - system_call_common+0x160/0x2c4 - -It's desirable to continue warning on bogus tokens in -rtas_token_to_function(). Currently it is used to look up RTAS -function descriptors when tracing, where we know there has to have -been a successful descriptor lookup by different means already, and it -would be a serious inconsistency for the reverse lookup to fail. - -So instead of weakening rtas_token_to_function()'s contract by -removing the warnings, introduce rtas_token_to_function_untrusted(), -which has no opinion on failed lookups. Convert block_rtas_call() and -rtas_token_to_function() to use it. - -Fixes: 8252b88294d2 ("powerpc/rtas: improve function information lookups") -Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com> -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Link: https://msgid.link/20231212-papr-sys_rtas-vs-lockdown-v6-1-e9eafd0c8c6c@linux.ibm.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/powerpc/kernel/rtas.c | 19 +++++++++++++++++-- - 1 file changed, 17 insertions(+), 2 deletions(-) - -diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c -index eddc031c4b95..87d65bdd3eca 100644 ---- a/arch/powerpc/kernel/rtas.c -+++ b/arch/powerpc/kernel/rtas.c -@@ -544,6 +544,21 @@ static int __init rtas_token_to_function_xarray_init(void) - } - arch_initcall(rtas_token_to_function_xarray_init); - -+/* -+ * For use by sys_rtas(), where the token value is provided by user -+ * space and we don't want to warn on failed lookups. -+ */ -+static const struct rtas_function *rtas_token_to_function_untrusted(s32 token) -+{ -+ return xa_load(&rtas_token_to_function_xarray, token); -+} -+ -+/* -+ * Reverse lookup for deriving the function descriptor from a -+ * known-good token value in contexts where the former is not already -+ * available. @token must be valid, e.g. derived from the result of a -+ * prior lookup against the function table. -+ */ - static const struct rtas_function *rtas_token_to_function(s32 token) - { - const struct rtas_function *func; -@@ -551,7 +566,7 @@ static const struct rtas_function *rtas_token_to_function(s32 token) - if (WARN_ONCE(token < 0, "invalid token %d", token)) - return NULL; - -- func = xa_load(&rtas_token_to_function_xarray, token); -+ func = rtas_token_to_function_untrusted(token); - - if (WARN_ONCE(!func, "unexpected failed lookup for token %d", token)) - return NULL; -@@ -1726,7 +1741,7 @@ static bool block_rtas_call(int token, int nargs, - * If this token doesn't correspond to a function the kernel - * understands, you're not allowed to call it. - */ -- func = rtas_token_to_function(token); -+ func = rtas_token_to_function_untrusted(token); - if (!func) - goto err; - /* --- -2.43.2 - -From a9c05cbb6644a2103c75b6906e9dafb9981ebd13 Mon Sep 17 00:00:00 2001 -From: Kunwu Chan <chentao@kylinos.cn> -Date: Fri, 8 Dec 2023 16:59:37 +0800 -Subject: [PATCH 0045/1501] powerpc/powernv: Add a null pointer check to - scom_debug_init_one() -Content-Length: 1253 -Lines: 33 - -[ Upstream commit 9a260f2dd827bbc82cc60eb4f4d8c22707d80742 ] - -kasprintf() returns a pointer to dynamically allocated memory -which can be NULL upon failure. -Add a null pointer check, and release 'ent' to avoid memory leaks. - -Fixes: bfd2f0d49aef ("powerpc/powernv: Get rid of old scom_controller abstraction") -Signed-off-by: Kunwu Chan <chentao@kylinos.cn> -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Link: https://msgid.link/20231208085937.107210-1-chentao@kylinos.cn -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/powerpc/platforms/powernv/opal-xscom.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/arch/powerpc/platforms/powernv/opal-xscom.c b/arch/powerpc/platforms/powernv/opal-xscom.c -index 262cd6fac907..748c2b97fa53 100644 ---- a/arch/powerpc/platforms/powernv/opal-xscom.c -+++ b/arch/powerpc/platforms/powernv/opal-xscom.c -@@ -165,6 +165,11 @@ static int scom_debug_init_one(struct dentry *root, struct device_node *dn, - ent->chip = chip; - snprintf(ent->name, 16, "%08x", chip); - ent->path.data = (void *)kasprintf(GFP_KERNEL, "%pOF", dn); -+ if (!ent->path.data) { -+ kfree(ent); -+ return -ENOMEM; -+ } -+ - ent->path.size = strlen((char *)ent->path.data); - - dir = debugfs_create_dir(ent->name, root); --- -2.43.2 - -From e08c2e275fa1874de945b87093f925997722ee42 Mon Sep 17 00:00:00 2001 -From: Kunwu Chan <chentao@kylinos.cn> -Date: Mon, 27 Nov 2023 11:07:55 +0800 -Subject: [PATCH 0046/1501] powerpc/powernv: Add a null pointer check in - opal_event_init() -Content-Length: 1067 -Lines: 29 - -[ Upstream commit 8649829a1dd25199bbf557b2621cedb4bf9b3050 ] - -kasprintf() returns a pointer to dynamically allocated memory -which can be NULL upon failure. - -Fixes: 2717a33d6074 ("powerpc/opal-irqchip: Use interrupt names if present") -Signed-off-by: Kunwu Chan <chentao@kylinos.cn> -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Link: https://msgid.link/20231127030755.1546750-1-chentao@kylinos.cn -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/powerpc/platforms/powernv/opal-irqchip.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/arch/powerpc/platforms/powernv/opal-irqchip.c b/arch/powerpc/platforms/powernv/opal-irqchip.c -index f9a7001dacb7..56a1f7ce78d2 100644 ---- a/arch/powerpc/platforms/powernv/opal-irqchip.c -+++ b/arch/powerpc/platforms/powernv/opal-irqchip.c -@@ -275,6 +275,8 @@ int __init opal_event_init(void) - else - name = kasprintf(GFP_KERNEL, "opal"); - -+ if (!name) -+ continue; - /* Install interrupt handler */ - rc = request_irq(r->start, opal_interrupt, r->flags & IRQD_TRIGGER_MASK, - name, NULL); --- -2.43.2 - -From b02ecc35d01a76b4235e008d2dd292895b28ecab Mon Sep 17 00:00:00 2001 -From: Kunwu Chan <chentao@kylinos.cn> -Date: Sun, 26 Nov 2023 17:57:39 +0800 -Subject: [PATCH 0047/1501] powerpc/powernv: Add a null pointer check in - opal_powercap_init() -Content-Length: 1161 -Lines: 33 - -[ Upstream commit e123015c0ba859cf48aa7f89c5016cc6e98e018d ] - -kasprintf() returns a pointer to dynamically allocated memory -which can be NULL upon failure. - -Fixes: b9ef7b4b867f ("powerpc: Convert to using %pOFn instead of device_node.name") -Signed-off-by: Kunwu Chan <chentao@kylinos.cn> -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Link: https://msgid.link/20231126095739.1501990-1-chentao@kylinos.cn -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/powerpc/platforms/powernv/opal-powercap.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/arch/powerpc/platforms/powernv/opal-powercap.c b/arch/powerpc/platforms/powernv/opal-powercap.c -index 7bfe4cbeb35a..ea917266aa17 100644 ---- a/arch/powerpc/platforms/powernv/opal-powercap.c -+++ b/arch/powerpc/platforms/powernv/opal-powercap.c -@@ -196,6 +196,12 @@ void __init opal_powercap_init(void) - - j = 0; - pcaps[i].pg.name = kasprintf(GFP_KERNEL, "%pOFn", node); -+ if (!pcaps[i].pg.name) { -+ kfree(pcaps[i].pattrs); -+ kfree(pcaps[i].pg.attrs); -+ goto out_pcaps_pattrs; -+ } -+ - if (has_min) { - powercap_add_attr(min, "powercap-min", - &pcaps[i].pattrs[j]); --- -2.43.2 - -From c7d828e12b326ea50fb80c369d7aa87519ed14c6 Mon Sep 17 00:00:00 2001 -From: Kunwu Chan <chentao@kylinos.cn> -Date: Sun, 26 Nov 2023 17:37:19 +0800 -Subject: [PATCH 0048/1501] powerpc/imc-pmu: Add a null pointer check in - update_events_in_group() -Content-Length: 1776 -Lines: 47 - -[ Upstream commit 0a233867a39078ebb0f575e2948593bbff5826b3 ] - -kasprintf() returns a pointer to dynamically allocated memory -which can be NULL upon failure. - -Fixes: 885dcd709ba9 ("powerpc/perf: Add nest IMC PMU support") -Signed-off-by: Kunwu Chan <chentao@kylinos.cn> -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Link: https://msgid.link/20231126093719.1440305-1-chentao@kylinos.cn -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/powerpc/perf/imc-pmu.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c -index 5d12ca386c1f..8664a7d297ad 100644 ---- a/arch/powerpc/perf/imc-pmu.c -+++ b/arch/powerpc/perf/imc-pmu.c -@@ -299,6 +299,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) - attr_group->attrs = attrs; - do { - ev_val_str = kasprintf(GFP_KERNEL, "event=0x%x", pmu->events[i].value); -+ if (!ev_val_str) -+ continue; - dev_str = device_str_attr_create(pmu->events[i].name, ev_val_str); - if (!dev_str) - continue; -@@ -306,6 +308,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) - attrs[j++] = dev_str; - if (pmu->events[i].scale) { - ev_scale_str = kasprintf(GFP_KERNEL, "%s.scale", pmu->events[i].name); -+ if (!ev_scale_str) -+ continue; - dev_str = device_str_attr_create(ev_scale_str, pmu->events[i].scale); - if (!dev_str) - continue; -@@ -315,6 +319,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) - - if (pmu->events[i].unit) { - ev_unit_str = kasprintf(GFP_KERNEL, "%s.unit", pmu->events[i].name); -+ if (!ev_unit_str) -+ continue; - dev_str = device_str_attr_create(ev_unit_str, pmu->events[i].unit); - if (!dev_str) - continue; --- -2.43.2 - -From e3e9ced780d694dca58ba97b41b949db57bbdbbc Mon Sep 17 00:00:00 2001 -From: Yiwei Lin <s921975628@gmail.com> -Date: Fri, 17 Nov 2023 16:01:06 +0800 -Subject: [PATCH 0049/1501] sched/fair: Update min_vruntime for - reweight_entity() correctly -Content-Length: 1752 -Lines: 50 - -[ Upstream commit 5068d84054b766efe7c6202fc71b2350d1c326f1 ] - -Since reweight_entity() may have chance to change the weight of -cfs_rq->curr entity, we should also update_min_vruntime() if -this is the case - -Fixes: eab03c23c2a1 ("sched/eevdf: Fix vruntime adjustment on reweight") -Signed-off-by: Yiwei Lin <s921975628@gmail.com> -Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> -Reviewed-by: Abel Wu <wuyun.abel@bytedance.com> -Link: https://lore.kernel.org/r/20231117080106.12890-1-s921975628@gmail.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - kernel/sched/fair.c | 20 ++++++++++---------- - 1 file changed, 10 insertions(+), 10 deletions(-) - -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index d7a3c63a2171..4182fb118ce9 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -3811,17 +3811,17 @@ static void reweight_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, - enqueue_load_avg(cfs_rq, se); - if (se->on_rq) { - update_load_add(&cfs_rq->load, se->load.weight); -- if (!curr) { -- /* -- * The entity's vruntime has been adjusted, so let's check -- * whether the rq-wide min_vruntime needs updated too. Since -- * the calculations above require stable min_vruntime rather -- * than up-to-date one, we do the update at the end of the -- * reweight process. -- */ -+ if (!curr) - __enqueue_entity(cfs_rq, se); -- update_min_vruntime(cfs_rq); -- } -+ -+ /* -+ * The entity's vruntime has been adjusted, so let's check -+ * whether the rq-wide min_vruntime needs updated too. Since -+ * the calculations above require stable min_vruntime rather -+ * than up-to-date one, we do the update at the end of the -+ * reweight process. -+ */ -+ update_min_vruntime(cfs_rq); - } - } - --- -2.43.2 - -From 3d6f4a78b104c65e4256c3776c9949f49a1b459e Mon Sep 17 00:00:00 2001 -From: Alexander Antonov <alexander.antonov@linux.intel.com> -Date: Mon, 27 Nov 2023 10:52:45 -0800 -Subject: [PATCH 0050/1501] perf/x86/intel/uncore: Fix NULL pointer dereference - issue in upi_fill_topology() -Content-Length: 2157 -Lines: 56 - -[ Upstream commit 1692cf434ba13ee212495b5af795b6a07e986ce4 ] - -Get logical socket id instead of physical id in discover_upi_topology() -to avoid out-of-bound access on 'upi = &type->topology[nid][idx];' line -that leads to NULL pointer dereference in upi_fill_topology() - -Fixes: f680b6e6062e ("perf/x86/intel/uncore: Enable UPI topology discovery for Icelake Server") -Reported-by: Kyle Meyer <kyle.meyer@hpe.com> -Signed-off-by: Alexander Antonov <alexander.antonov@linux.intel.com> -Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> -Reviewed-by: Kan Liang <kan.liang@linux.intel.com> -Tested-by: Kyle Meyer <kyle.meyer@hpe.com> -Link: https://lore.kernel.org/r/20231127185246.2371939-2-alexander.antonov@linux.intel.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/x86/events/intel/uncore_snbep.c | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - -diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c -index 8250f0f59c2b..49bc27ab26ad 100644 ---- a/arch/x86/events/intel/uncore_snbep.c -+++ b/arch/x86/events/intel/uncore_snbep.c -@@ -5596,7 +5596,7 @@ static int discover_upi_topology(struct intel_uncore_type *type, int ubox_did, i - struct pci_dev *ubox = NULL; - struct pci_dev *dev = NULL; - u32 nid, gid; -- int i, idx, ret = -EPERM; -+ int i, idx, lgc_pkg, ret = -EPERM; - struct intel_uncore_topology *upi; - unsigned int devfn; - -@@ -5614,8 +5614,13 @@ static int discover_upi_topology(struct intel_uncore_type *type, int ubox_did, i - for (i = 0; i < 8; i++) { - if (nid != GIDNIDMAP(gid, i)) - continue; -+ lgc_pkg = topology_phys_to_logical_pkg(i); -+ if (lgc_pkg < 0) { -+ ret = -EPERM; -+ goto err; -+ } - for (idx = 0; idx < type->num_boxes; idx++) { -- upi = &type->topology[nid][idx]; -+ upi = &type->topology[lgc_pkg][idx]; - devfn = PCI_DEVFN(dev_link0 + idx, ICX_UPI_REGS_ADDR_FUNCTION); - dev = pci_get_domain_bus_and_slot(pci_domain_nr(ubox->bus), - ubox->bus->number, -@@ -5626,6 +5631,7 @@ static int discover_upi_topology(struct intel_uncore_type *type, int ubox_did, i - goto err; - } - } -+ break; - } - } - err: --- -2.43.2 - -From 8a75d3963fba41f47596c5ac5c71a16ec56031d9 Mon Sep 17 00:00:00 2001 -From: Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com> -Date: Mon, 6 Nov 2023 20:23:55 +0530 -Subject: [PATCH 0051/1501] spi: spi-zynqmp-gqspi: fix driver kconfig - dependencies -Content-Length: 1290 -Lines: 34 - -[ Upstream commit 424a8166764e462258fdccaaefbdeb07517c8b21 ] - -ZynqMP GQSPI driver no longer uses spi-master framework. It had been -converted to use spi-mem framework. So remove driver dependency from -spi-master and replace it with spi-mem. - -Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework") -Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com> -Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> -Link: https://lore.kernel.org/r/1699282435-884917-1-git-send-email-radhey.shyam.pandey@amd.com -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/spi/Kconfig | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig -index 70c9dd6b6a31..ddae0fde798e 100644 ---- a/drivers/spi/Kconfig -+++ b/drivers/spi/Kconfig -@@ -1177,9 +1177,10 @@ config SPI_ZYNQ_QSPI - - config SPI_ZYNQMP_GQSPI - tristate "Xilinx ZynqMP GQSPI controller" -- depends on (SPI_MASTER && HAS_DMA) || COMPILE_TEST -+ depends on (SPI_MEM && HAS_DMA) || COMPILE_TEST - help - Enables Xilinx GQSPI controller driver for Zynq UltraScale+ MPSoC. -+ This controller only supports SPI memory interface. - - config SPI_AMD - tristate "AMD SPI controller" --- -2.43.2 - -From dfdcc0502f371c53ce4ff04db88e3cd3ab33ff18 Mon Sep 17 00:00:00 2001 -From: Ronald Monthero <debug.penguin32@gmail.com> -Date: Sat, 18 Nov 2023 18:31:51 +1000 -Subject: [PATCH 0052/1501] mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand - controller response -Content-Length: 1701 -Lines: 40 - -[ Upstream commit 923fb6238cb3ac529aa2bf13b3b1e53762186a8b ] - -Under heavy load it is likely that the controller is done -with its own task but the thread unlocking the wait is not -scheduled in time. Increasing IFC_TIMEOUT_MSECS allows the -controller to respond within allowable timeslice of 1 sec. - -fsl,ifc-nand 7e800000.nand: Controller is not responding - -[<804b2047>] (nand_get_device) from [<804b5335>] (nand_write_oob+0x1b/0x4a) -[<804b5335>] (nand_write_oob) from [<804a3585>] (mtd_write+0x41/0x5c) -[<804a3585>] (mtd_write) from [<804c1d47>] (ubi_io_write+0x17f/0x22c) -[<804c1d47>] (ubi_io_write) from [<804c047b>] (ubi_eba_write_leb+0x5b/0x1d0) - -Fixes: 82771882d960 ("NAND Machine support for Integrated Flash Controller") -Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com> -Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Signed-off-by: Ronald Monthero <debug.penguin32@gmail.com> -Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> -Link: https://lore.kernel.org/linux-mtd/20231118083156.776887-1-debug.penguin32@gmail.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/mtd/nand/raw/fsl_ifc_nand.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/mtd/nand/raw/fsl_ifc_nand.c b/drivers/mtd/nand/raw/fsl_ifc_nand.c -index 20bb1e0cb5eb..f0e2318ce088 100644 ---- a/drivers/mtd/nand/raw/fsl_ifc_nand.c -+++ b/drivers/mtd/nand/raw/fsl_ifc_nand.c -@@ -21,7 +21,7 @@ - - #define ERR_BYTE 0xFF /* Value returned for read - bytes when read failed */ --#define IFC_TIMEOUT_MSECS 500 /* Maximum number of mSecs to wait -+#define IFC_TIMEOUT_MSECS 1000 /* Maximum timeout to wait - for IFC NAND Machine */ - - struct fsl_ifc_ctrl; --- -2.43.2 - -From 72884ce4e10417b1233b614bf134da852df0f15f Mon Sep 17 00:00:00 2001 -From: Nikita Kiryushin <kiryushin@ancud.ru> -Date: Thu, 9 Nov 2023 16:49:25 +0300 -Subject: [PATCH 0053/1501] ACPI: video: check for error while searching for - backlight device parent -Content-Length: 1551 -Lines: 45 - -[ Upstream commit ccd45faf4973746c4f30ea41eec864e5cf191099 ] - -If acpi_get_parent() called in acpi_video_dev_register_backlight() -fails, for example, because acpi_ut_acquire_mutex() fails inside -acpi_get_parent), this can lead to incorrect (uninitialized) -acpi_parent handle being passed to acpi_get_pci_dev() for detecting -the parent pci device. - -Check acpi_get_parent() result and set parent device only in case of success. - -Found by Linux Verification Center (linuxtesting.org) with SVACE. - -Fixes: 9661e92c10a9 ("acpi: tie ACPI backlight devices to PCI devices if possible") -Signed-off-by: Nikita Kiryushin <kiryushin@ancud.ru> -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/acpi/acpi_video.c | 12 ++++++------ - 1 file changed, 6 insertions(+), 6 deletions(-) - -diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c -index 6cee536c229a..375010e575d0 100644 ---- a/drivers/acpi/acpi_video.c -+++ b/drivers/acpi/acpi_video.c -@@ -1713,12 +1713,12 @@ static void acpi_video_dev_register_backlight(struct acpi_video_device *device) - return; - count++; - -- acpi_get_parent(device->dev->handle, &acpi_parent); -- -- pdev = acpi_get_pci_dev(acpi_parent); -- if (pdev) { -- parent = &pdev->dev; -- pci_dev_put(pdev); -+ if (ACPI_SUCCESS(acpi_get_parent(device->dev->handle, &acpi_parent))) { -+ pdev = acpi_get_pci_dev(acpi_parent); -+ if (pdev) { -+ parent = &pdev->dev; -+ pci_dev_put(pdev); -+ } - } - - memset(&props, 0, sizeof(struct backlight_properties)); --- -2.43.2 - -From b7aab9d906e2e252a7783f872406033ec49b6dae Mon Sep 17 00:00:00 2001 -From: Nikita Kiryushin <kiryushin@ancud.ru> -Date: Thu, 9 Nov 2023 21:08:59 +0300 -Subject: [PATCH 0054/1501] ACPI: LPIT: Avoid u32 multiplication overflow -Content-Length: 1125 -Lines: 32 - -[ Upstream commit 56d2eeda87995245300836ee4dbd13b002311782 ] - -In lpit_update_residency() there is a possibility of overflow -in multiplication, if tsc_khz is large enough (> UINT_MAX/1000). - -Change multiplication to mul_u32_u32(). - -Found by Linux Verification Center (linuxtesting.org) with SVACE. - -Fixes: eeb2d80d502a ("ACPI / LPIT: Add Low Power Idle Table (LPIT) support") -Signed-off-by: Nikita Kiryushin <kiryushin@ancud.ru> -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/acpi/acpi_lpit.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/acpi/acpi_lpit.c b/drivers/acpi/acpi_lpit.c -index c5598b6d5db8..794962c5c88e 100644 ---- a/drivers/acpi/acpi_lpit.c -+++ b/drivers/acpi/acpi_lpit.c -@@ -105,7 +105,7 @@ static void lpit_update_residency(struct lpit_residency_info *info, - return; - - info->frequency = lpit_native->counter_frequency ? -- lpit_native->counter_frequency : tsc_khz * 1000; -+ lpit_native->counter_frequency : mul_u32_u32(tsc_khz, 1000U); - if (!info->frequency) - info->frequency = 1; - --- -2.43.2 - -From cd06de9800b3a7742fe7f6d772ff72b966085850 Mon Sep 17 00:00:00 2001 -From: Chen Ni <nichen@iscas.ac.cn> -Date: Wed, 8 Nov 2023 07:36:27 +0000 -Subject: [PATCH 0055/1501] KEYS: encrypted: Add check for strsep -Content-Length: 967 -Lines: 29 - -[ Upstream commit b4af096b5df5dd131ab796c79cedc7069d8f4882 ] - -Add check for strsep() in order to transfer the error. - -Fixes: cd3bc044af48 ("KEYS: encrypted: Instantiate key with user-provided decrypted data") -Signed-off-by: Chen Ni <nichen@iscas.ac.cn> -Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - security/keys/encrypted-keys/encrypted.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c -index 8af2136069d2..76f55dd13cb8 100644 ---- a/security/keys/encrypted-keys/encrypted.c -+++ b/security/keys/encrypted-keys/encrypted.c -@@ -237,6 +237,10 @@ static int datablob_parse(char *datablob, const char **format, - break; - } - *decrypted_data = strsep(&datablob, " \t"); -+ if (!*decrypted_data) { -+ pr_info("encrypted_key: decrypted_data is missing\n"); -+ break; -+ } - ret = 0; - break; - case Opt_load: --- -2.43.2 - -From a1146b16ac9402522735451c883cf1766133f257 Mon Sep 17 00:00:00 2001 -From: Yang Yingliang <yangyingliang@huawei.com> -Date: Wed, 29 Nov 2023 16:11:47 +0800 -Subject: [PATCH 0056/1501] spi: cadence-quadspi: add missing - clk_disable_unprepare() in cqspi_probe() -Content-Length: 1524 -Lines: 42 - -[ Upstream commit 5cb475174cce1bfedf1025b6e235e2c43d81144f ] - -cqspi_jh7110_clk_init() is called after clk_prepare_enable(cqspi->clk), -if it fails, it should goto label 'probe_reset_failed' to disable -cqspi->clk. - -In the error path after calling cqspi_jh7110_clk_init(), -cqspi_jh7110_disable_clk() need be called. - -Fixes: 33f1ef6d4eb6 ("spi: cadence-quadspi: Add clock configuration for StarFive JH7110 QSPI") -Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> -Link: https://lore.kernel.org/r/20231129081147.628004-1-yangyingliang@huawei.com -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/spi/spi-cadence-quadspi.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c -index 3d7bf62da11c..f94e0d370d46 100644 ---- a/drivers/spi/spi-cadence-quadspi.c -+++ b/drivers/spi/spi-cadence-quadspi.c -@@ -1840,7 +1840,7 @@ static int cqspi_probe(struct platform_device *pdev) - if (ddata->jh7110_clk_init) { - ret = cqspi_jh7110_clk_init(pdev, cqspi); - if (ret) -- goto probe_clk_failed; -+ goto probe_reset_failed; - } - - if (of_device_is_compatible(pdev->dev.of_node, -@@ -1901,6 +1901,8 @@ static int cqspi_probe(struct platform_device *pdev) - probe_setup_failed: - cqspi_controller_enable(cqspi, 0); - probe_reset_failed: -+ if (cqspi->is_jh7110) -+ cqspi_jh7110_disable_clk(pdev, cqspi); - clk_disable_unprepare(cqspi->clk); - probe_clk_failed: - return ret; --- -2.43.2 - -From 2a2664d1408c9ad4bd0286ab99bac99cbd207a69 Mon Sep 17 00:00:00 2001 -From: "David E. Box" <david.e.box@linux.intel.com> -Date: Wed, 29 Nov 2023 14:21:13 -0800 -Subject: [PATCH 0057/1501] platform/x86/intel/vsec: Fix xa_alloc memory leak -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 3272 -Lines: 94 - -[ Upstream commit 8cbcc1dbf8a62c730fadd60de761e0658547a589 ] - -Commit 936874b77dd0 ("platform/x86/intel/vsec: Add PCI error recovery -support to Intel PMT") added an xarray to track the list of vsec devices to -be recovered after a PCI error. But it did not provide cleanup for the list -leading to a memory leak that was caught by kmemleak. Do xa_alloc() before -devm_add_action_or_reset() so that the list may be cleaned up with -xa_erase() in the release function. - -Fixes: 936874b77dd0 ("platform/x86/intel/vsec: Add PCI error recovery support to Intel PMT") -Signed-off-by: David E. Box <david.e.box@linux.intel.com> -Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> -Link: https://lore.kernel.org/r/20231129222132.2331261-2-david.e.box@linux.intel.com -[hdegoede@redhat.com: Add missing xa_erase() on error-exit -Signed-off-by: Hans de Goede <hdegoede@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/platform/x86/intel/vsec.c | 25 +++++++++++++++---------- - drivers/platform/x86/intel/vsec.h | 1 + - 2 files changed, 16 insertions(+), 10 deletions(-) - -diff --git a/drivers/platform/x86/intel/vsec.c b/drivers/platform/x86/intel/vsec.c -index c1f9e4471b28..343ab6a82c01 100644 ---- a/drivers/platform/x86/intel/vsec.c -+++ b/drivers/platform/x86/intel/vsec.c -@@ -120,6 +120,8 @@ static void intel_vsec_dev_release(struct device *dev) - { - struct intel_vsec_device *intel_vsec_dev = dev_to_ivdev(dev); - -+ xa_erase(&auxdev_array, intel_vsec_dev->id); -+ - mutex_lock(&vsec_ida_lock); - ida_free(intel_vsec_dev->ida, intel_vsec_dev->auxdev.id); - mutex_unlock(&vsec_ida_lock); -@@ -135,19 +137,28 @@ int intel_vsec_add_aux(struct pci_dev *pdev, struct device *parent, - struct auxiliary_device *auxdev = &intel_vsec_dev->auxdev; - int ret, id; - -- mutex_lock(&vsec_ida_lock); -- ret = ida_alloc(intel_vsec_dev->ida, GFP_KERNEL); -- mutex_unlock(&vsec_ida_lock); -+ ret = xa_alloc(&auxdev_array, &intel_vsec_dev->id, intel_vsec_dev, -+ PMT_XA_LIMIT, GFP_KERNEL); - if (ret < 0) { - kfree(intel_vsec_dev->resource); - kfree(intel_vsec_dev); - return ret; - } - -+ mutex_lock(&vsec_ida_lock); -+ id = ida_alloc(intel_vsec_dev->ida, GFP_KERNEL); -+ mutex_unlock(&vsec_ida_lock); -+ if (id < 0) { -+ xa_erase(&auxdev_array, intel_vsec_dev->id); -+ kfree(intel_vsec_dev->resource); -+ kfree(intel_vsec_dev); -+ return id; -+ } -+ - if (!parent) - parent = &pdev->dev; - -- auxdev->id = ret; -+ auxdev->id = id; - auxdev->name = name; - auxdev->dev.parent = parent; - auxdev->dev.release = intel_vsec_dev_release; -@@ -169,12 +180,6 @@ int intel_vsec_add_aux(struct pci_dev *pdev, struct device *parent, - if (ret < 0) - return ret; - -- /* Add auxdev to list */ -- ret = xa_alloc(&auxdev_array, &id, intel_vsec_dev, PMT_XA_LIMIT, -- GFP_KERNEL); -- if (ret) -- return ret; -- - return 0; - } - EXPORT_SYMBOL_NS_GPL(intel_vsec_add_aux, INTEL_VSEC); -diff --git a/drivers/platform/x86/intel/vsec.h b/drivers/platform/x86/intel/vsec.h -index 0fd042c171ba..0a6201b4a0e9 100644 ---- a/drivers/platform/x86/intel/vsec.h -+++ b/drivers/platform/x86/intel/vsec.h -@@ -45,6 +45,7 @@ struct intel_vsec_device { - struct ida *ida; - struct intel_vsec_platform_info *info; - int num_resources; -+ int id; /* xa */ - void *priv_data; - size_t priv_data_size; - }; --- -2.43.2 - -From 5b003be1ae17da1110c97720fde7397769a2c7a6 Mon Sep 17 00:00:00 2001 -From: Alexandra Diupina <adiupina@astralinux.ru> -Date: Tue, 5 Dec 2023 18:12:20 +0300 -Subject: [PATCH 0058/1501] cpufreq: scmi: process the result of - devm_of_clk_add_hw_provider() -Content-Length: 1360 -Lines: 35 - -[ Upstream commit c4a5118a3ae1eadc687d84eef9431f9e13eb015c ] - -devm_of_clk_add_hw_provider() may return an errno, so -add a return value check - -Found by Linux Verification Center (linuxtesting.org) with SVACE. - -Fixes: 8410e7f3b31e ("cpufreq: scmi: Fix OPP addition failure with a dummy clock provider") -Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru> -Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/cpufreq/scmi-cpufreq.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c -index c8a7ccc42c16..4ee23f4ebf4a 100644 ---- a/drivers/cpufreq/scmi-cpufreq.c -+++ b/drivers/cpufreq/scmi-cpufreq.c -@@ -334,8 +334,11 @@ static int scmi_cpufreq_probe(struct scmi_device *sdev) - - #ifdef CONFIG_COMMON_CLK - /* dummy clock provider as needed by OPP if clocks property is used */ -- if (of_property_present(dev->of_node, "#clock-cells")) -- devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, NULL); -+ if (of_property_present(dev->of_node, "#clock-cells")) { -+ ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, NULL); -+ if (ret) -+ return dev_err_probe(dev, ret, "%s: registering clock provider failed\n", __func__); -+ } - #endif - - ret = cpufreq_register_driver(&scmi_cpufreq_driver); --- -2.43.2 - -From f14d36e6e97fe935a20e0ceb159c100f90b6627c Mon Sep 17 00:00:00 2001 -From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru> -Date: Thu, 23 Nov 2023 09:25:54 +0000 -Subject: [PATCH 0059/1501] calipso: fix memory leak in - netlbl_calipso_add_pass() -Content-Length: 4656 -Lines: 130 - -[ Upstream commit ec4e9d630a64df500641892f4e259e8149594a99 ] - -If IPv6 support is disabled at boot (ipv6.disable=1), -the calipso_init() -> netlbl_calipso_ops_register() function isn't called, -and the netlbl_calipso_ops_get() function always returns NULL. -In this case, the netlbl_calipso_add_pass() function allocates memory -for the doi_def variable but doesn't free it with the calipso_doi_free(). - -BUG: memory leak -unreferenced object 0xffff888011d68180 (size 64): - comm "syz-executor.1", pid 10746, jiffies 4295410986 (age 17.928s) - hex dump (first 32 bytes): - 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 ................ - 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ - backtrace: - [<...>] kmalloc include/linux/slab.h:552 [inline] - [<...>] netlbl_calipso_add_pass net/netlabel/netlabel_calipso.c:76 [inline] - [<...>] netlbl_calipso_add+0x22e/0x4f0 net/netlabel/netlabel_calipso.c:111 - [<...>] genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739 - [<...>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline] - [<...>] genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800 - [<...>] netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2515 - [<...>] genl_rcv+0x29/0x40 net/netlink/genetlink.c:811 - [<...>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] - [<...>] netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1339 - [<...>] netlink_sendmsg+0x90a/0xdf0 net/netlink/af_netlink.c:1934 - [<...>] sock_sendmsg_nosec net/socket.c:651 [inline] - [<...>] sock_sendmsg+0x157/0x190 net/socket.c:671 - [<...>] ____sys_sendmsg+0x712/0x870 net/socket.c:2342 - [<...>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2396 - [<...>] __sys_sendmsg+0xea/0x1b0 net/socket.c:2429 - [<...>] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46 - [<...>] entry_SYSCALL_64_after_hwframe+0x61/0xc6 - -Found by InfoTeCS on behalf of Linux Verification Center -(linuxtesting.org) with Syzkaller - -Fixes: cb72d38211ea ("netlabel: Initial support for the CALIPSO netlink protocol.") -Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru> -[PM: merged via the LSM tree at Jakub Kicinski request] -Signed-off-by: Paul Moore <paul@paul-moore.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netlabel/netlabel_calipso.c | 49 +++++++++++++++++---------------- - 1 file changed, 26 insertions(+), 23 deletions(-) - -diff --git a/net/netlabel/netlabel_calipso.c b/net/netlabel/netlabel_calipso.c -index f1d5b8465217..a07c2216d28b 100644 ---- a/net/netlabel/netlabel_calipso.c -+++ b/net/netlabel/netlabel_calipso.c -@@ -54,6 +54,28 @@ static const struct nla_policy calipso_genl_policy[NLBL_CALIPSO_A_MAX + 1] = { - [NLBL_CALIPSO_A_MTYPE] = { .type = NLA_U32 }, - }; - -+static const struct netlbl_calipso_ops *calipso_ops; -+ -+/** -+ * netlbl_calipso_ops_register - Register the CALIPSO operations -+ * @ops: ops to register -+ * -+ * Description: -+ * Register the CALIPSO packet engine operations. -+ * -+ */ -+const struct netlbl_calipso_ops * -+netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops) -+{ -+ return xchg(&calipso_ops, ops); -+} -+EXPORT_SYMBOL(netlbl_calipso_ops_register); -+ -+static const struct netlbl_calipso_ops *netlbl_calipso_ops_get(void) -+{ -+ return READ_ONCE(calipso_ops); -+} -+ - /* NetLabel Command Handlers - */ - /** -@@ -96,15 +118,18 @@ static int netlbl_calipso_add_pass(struct genl_info *info, - * - */ - static int netlbl_calipso_add(struct sk_buff *skb, struct genl_info *info) -- - { - int ret_val = -EINVAL; - struct netlbl_audit audit_info; -+ const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); - - if (!info->attrs[NLBL_CALIPSO_A_DOI] || - !info->attrs[NLBL_CALIPSO_A_MTYPE]) - return -EINVAL; - -+ if (!ops) -+ return -EOPNOTSUPP; -+ - netlbl_netlink_auditinfo(&audit_info); - switch (nla_get_u32(info->attrs[NLBL_CALIPSO_A_MTYPE])) { - case CALIPSO_MAP_PASS: -@@ -363,28 +388,6 @@ int __init netlbl_calipso_genl_init(void) - return genl_register_family(&netlbl_calipso_gnl_family); - } - --static const struct netlbl_calipso_ops *calipso_ops; -- --/** -- * netlbl_calipso_ops_register - Register the CALIPSO operations -- * @ops: ops to register -- * -- * Description: -- * Register the CALIPSO packet engine operations. -- * -- */ --const struct netlbl_calipso_ops * --netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops) --{ -- return xchg(&calipso_ops, ops); --} --EXPORT_SYMBOL(netlbl_calipso_ops_register); -- --static const struct netlbl_calipso_ops *netlbl_calipso_ops_get(void) --{ -- return READ_ONCE(calipso_ops); --} -- - /** - * calipso_doi_add - Add a new DOI to the CALIPSO protocol engine - * @doi_def: the DOI structure --- -2.43.2 - -From d4a714873db0866cc471521114eeac4a5072d548 Mon Sep 17 00:00:00 2001 -From: Ilias Apalodimas <ilias.apalodimas@linaro.org> -Date: Tue, 7 Nov 2023 14:40:56 +0900 -Subject: [PATCH 0060/1501] efivarfs: force RO when remounting if SetVariable - is not supported -Content-Length: 4485 -Lines: 101 - -[ Upstream commit 0e8d2444168dd519fea501599d150e62718ed2fe ] - -If SetVariable at runtime is not supported by the firmware we never assign -a callback for that function. At the same time mount the efivarfs as -RO so no one can call that. However, we never check the permission flags -when someone remounts the filesystem as RW. As a result this leads to a -crash looking like this: - -$ mount -o remount,rw /sys/firmware/efi/efivars -$ efi-updatevar -f PK.auth PK - -[ 303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 -[ 303.280482] Mem abort info: -[ 303.280854] ESR = 0x0000000086000004 -[ 303.281338] EC = 0x21: IABT (current EL), IL = 32 bits -[ 303.282016] SET = 0, FnV = 0 -[ 303.282414] EA = 0, S1PTW = 0 -[ 303.282821] FSC = 0x04: level 0 translation fault -[ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 -[ 303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 -[ 303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP -[ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 -[ 303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 -[ 303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 -[ 303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) -[ 303.292123] pc : 0x0 -[ 303.292443] lr : efivar_set_variable_locked+0x74/0xec -[ 303.293156] sp : ffff800008673c10 -[ 303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 -[ 303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027 -[ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000 -[ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 -[ 303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 -[ 303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 -[ 303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002 -[ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201 -[ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc -[ 303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 -[ 303.303341] Call trace: -[ 303.303679] 0x0 -[ 303.303938] efivar_entry_set_get_size+0x98/0x16c -[ 303.304585] efivarfs_file_write+0xd0/0x1a4 -[ 303.305148] vfs_write+0xc4/0x2e4 -[ 303.305601] ksys_write+0x70/0x104 -[ 303.306073] __arm64_sys_write+0x1c/0x28 -[ 303.306622] invoke_syscall+0x48/0x114 -[ 303.307156] el0_svc_common.constprop.0+0x44/0xec -[ 303.307803] do_el0_svc+0x38/0x98 -[ 303.308268] el0_svc+0x2c/0x84 -[ 303.308702] el0t_64_sync_handler+0xf4/0x120 -[ 303.309293] el0t_64_sync+0x190/0x194 -[ 303.309794] Code: ???????? ???????? ???????? ???????? (????????) -[ 303.310612] ---[ end trace 0000000000000000 ]--- - -Fix this by adding a .reconfigure() function to the fs operations which -we can use to check the requested flags and deny anything that's not RO -if the firmware doesn't implement SetVariable at runtime. - -Fixes: f88814cc2578 ("efi/efivars: Expose RT service availability via efivars abstraction") -Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> -Signed-off-by: Ard Biesheuvel <ardb@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/efivarfs/super.c | 12 ++++++++++++ - 1 file changed, 12 insertions(+) - -diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c -index 77240953a92e..869537f1a550 100644 ---- a/fs/efivarfs/super.c -+++ b/fs/efivarfs/super.c -@@ -15,6 +15,7 @@ - #include <linux/slab.h> - #include <linux/magic.h> - #include <linux/statfs.h> -+#include <linux/printk.h> - - #include "internal.h" - -@@ -333,9 +334,20 @@ static int efivarfs_get_tree(struct fs_context *fc) - return get_tree_single(fc, efivarfs_fill_super); - } - -+static int efivarfs_reconfigure(struct fs_context *fc) -+{ -+ if (!efivar_supports_writes() && !(fc->sb_flags & SB_RDONLY)) { -+ pr_err("Firmware does not support SetVariableRT. Can not remount with rw\n"); -+ return -EINVAL; -+ } -+ -+ return 0; -+} -+ - static const struct fs_context_operations efivarfs_context_ops = { - .get_tree = efivarfs_get_tree, - .parse_param = efivarfs_parse_param, -+ .reconfigure = efivarfs_reconfigure, - }; - - static int efivarfs_init_fs_context(struct fs_context *fc) --- -2.43.2 - -From 92be3095c6ca1cdc46237839c6087555be9160e3 Mon Sep 17 00:00:00 2001 -From: Ard Biesheuvel <ardb@kernel.org> -Date: Fri, 8 Dec 2023 17:39:28 +0100 -Subject: [PATCH 0061/1501] efivarfs: Free s_fs_info on unmount -Content-Length: 1066 -Lines: 35 - -[ Upstream commit 547713d502f7b4b8efccd409cff84d731a23853b ] - -Now that we allocate a s_fs_info struct on fs context creation, we -should ensure that we free it again when the superblock goes away. - -Fixes: 5329aa5101f7 ("efivarfs: Add uid/gid mount options") -Signed-off-by: Ard Biesheuvel <ardb@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/efivarfs/super.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c -index 869537f1a550..edf29c15db77 100644 ---- a/fs/efivarfs/super.c -+++ b/fs/efivarfs/super.c -@@ -368,6 +368,8 @@ static int efivarfs_init_fs_context(struct fs_context *fc) - - static void efivarfs_kill_sb(struct super_block *sb) - { -+ struct efivarfs_fs_info *sfi = sb->s_fs_info; -+ - kill_litter_super(sb); - - if (!efivar_is_available()) -@@ -375,6 +377,7 @@ static void efivarfs_kill_sb(struct super_block *sb) - - /* Remove all entries and destroy */ - efivar_entry_iter(efivarfs_destroy, &efivarfs_list, NULL); -+ kfree(sfi); - } - - static struct file_system_type efivarfs_type = { --- -2.43.2 - -From 47b6bca555750e81b800ad2000bf179cb1820899 Mon Sep 17 00:00:00 2001 -From: Wolfram Sang <wsa+renesas@sang-engineering.com> -Date: Tue, 12 Dec 2023 09:12:38 +0100 -Subject: [PATCH 0062/1501] spi: sh-msiof: Enforce fixed DTDL for R-Car H3 -Content-Length: 2659 -Lines: 72 - -[ Upstream commit e5c7bcb499840551cfbe85c6df177ebc50432bf0 ] - -Documentation says only DTDL of 200 is allowed for this SoC. - -Fixes: 4286db8456f4 ("spi: sh-msiof: Add R-Car Gen 2 and 3 fallback bindings") -Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> -Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> -Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> -Link: https://msgid.link/r/20231212081239.14254-1-wsa+renesas@sang-engineering.com -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/spi/spi-sh-msiof.c | 17 +++++++++++++++++ - 1 file changed, 17 insertions(+) - -diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c -index fb452bc78372..cfc3b1ddbd22 100644 ---- a/drivers/spi/spi-sh-msiof.c -+++ b/drivers/spi/spi-sh-msiof.c -@@ -29,12 +29,15 @@ - - #include <asm/unaligned.h> - -+#define SH_MSIOF_FLAG_FIXED_DTDL_200 BIT(0) -+ - struct sh_msiof_chipdata { - u32 bits_per_word_mask; - u16 tx_fifo_size; - u16 rx_fifo_size; - u16 ctlr_flags; - u16 min_div_pow; -+ u32 flags; - }; - - struct sh_msiof_spi_priv { -@@ -1072,6 +1075,16 @@ static const struct sh_msiof_chipdata rcar_gen3_data = { - .min_div_pow = 1, - }; - -+static const struct sh_msiof_chipdata rcar_r8a7795_data = { -+ .bits_per_word_mask = SPI_BPW_MASK(8) | SPI_BPW_MASK(16) | -+ SPI_BPW_MASK(24) | SPI_BPW_MASK(32), -+ .tx_fifo_size = 64, -+ .rx_fifo_size = 64, -+ .ctlr_flags = SPI_CONTROLLER_MUST_TX, -+ .min_div_pow = 1, -+ .flags = SH_MSIOF_FLAG_FIXED_DTDL_200, -+}; -+ - static const struct of_device_id sh_msiof_match[] __maybe_unused = { - { .compatible = "renesas,sh-mobile-msiof", .data = &sh_data }, - { .compatible = "renesas,msiof-r8a7743", .data = &rcar_gen2_data }, -@@ -1082,6 +1095,7 @@ static const struct of_device_id sh_msiof_match[] __maybe_unused = { - { .compatible = "renesas,msiof-r8a7793", .data = &rcar_gen2_data }, - { .compatible = "renesas,msiof-r8a7794", .data = &rcar_gen2_data }, - { .compatible = "renesas,rcar-gen2-msiof", .data = &rcar_gen2_data }, -+ { .compatible = "renesas,msiof-r8a7795", .data = &rcar_r8a7795_data }, - { .compatible = "renesas,msiof-r8a7796", .data = &rcar_gen3_data }, - { .compatible = "renesas,rcar-gen3-msiof", .data = &rcar_gen3_data }, - { .compatible = "renesas,rcar-gen4-msiof", .data = &rcar_gen3_data }, -@@ -1279,6 +1293,9 @@ static int sh_msiof_spi_probe(struct platform_device *pdev) - return -ENXIO; - } - -+ if (chipdata->flags & SH_MSIOF_FLAG_FIXED_DTDL_200) -+ info->dtdl = 200; -+ - if (info->mode == MSIOF_SPI_TARGET) - ctlr = spi_alloc_target(&pdev->dev, - sizeof(struct sh_msiof_spi_priv)); --- -2.43.2 - -From 4d08e6c01cf2d853971d68700785646045a5afd6 Mon Sep 17 00:00:00 2001 -From: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Date: Mon, 11 Dec 2023 13:14:29 +0200 -Subject: [PATCH 0063/1501] ACPI: LPSS: Fix the fractional clock divider flags -Content-Length: 1258 -Lines: 32 - -[ Upstream commit 3ebccf1d1ca74bbb78e6f8c38d1d172e468d91f8 ] - -The conversion to CLK_FRAC_DIVIDER_POWER_OF_TWO_PS uses wrong flags -in the parameters and hence miscalculates the values in the clock -divider. Fix this by applying the flag to the proper parameter. - -Fixes: 82f53f9ee577 ("clk: fractional-divider: Introduce POWER_OF_TWO_PS flag") -Reported-by: Alex Vinarskis <alex.vinarskis@gmail.com> -Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/acpi/acpi_lpss.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c -index 875de44961bf..d48407472dfb 100644 ---- a/drivers/acpi/acpi_lpss.c -+++ b/drivers/acpi/acpi_lpss.c -@@ -461,8 +461,9 @@ static int register_device_clock(struct acpi_device *adev, - if (!clk_name) - return -ENOMEM; - clk = clk_register_fractional_divider(NULL, clk_name, parent, -+ 0, prv_base, 1, 15, 16, 15, - CLK_FRAC_DIVIDER_POWER_OF_TWO_PS, -- prv_base, 1, 15, 16, 15, 0, NULL); -+ NULL); - parent = clk_name; - - clk_name = kasprintf(GFP_KERNEL, "%s-update", devname); --- -2.43.2 - -From f3bd89340eab3ff2740a499384977f6562b9a53f Mon Sep 17 00:00:00 2001 -From: Tony Luck <tony.luck@intel.com> -Date: Tue, 12 Dec 2023 13:22:39 -0800 -Subject: [PATCH 0064/1501] ACPI: extlog: Clear Extended Error Log status when - RAS_CEC handled the error -Content-Length: 1382 -Lines: 39 - -[ Upstream commit 38c872a9e96f72f2947affc0526cc05659367d3d ] - -When both CONFIG_RAS_CEC and CONFIG_ACPI_EXTLOG are enabled, Linux does -not clear the status word of the BIOS supplied error record for corrected -errors. This may prevent logging of subsequent uncorrected errors. - -Fix by clearing the status. - -Fixes: 23ba710a0864 ("x86/mce: Fix all mce notifiers to update the mce->kflags bitmask") -Reported-by: Erwin Tsaur <erwin.tsaur@intel.com> -Signed-off-by: Tony Luck <tony.luck@intel.com> -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/acpi/acpi_extlog.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c -index e120a96e1eae..71e8d4e7a36c 100644 ---- a/drivers/acpi/acpi_extlog.c -+++ b/drivers/acpi/acpi_extlog.c -@@ -145,9 +145,14 @@ static int extlog_print(struct notifier_block *nb, unsigned long val, - static u32 err_seq; - - estatus = extlog_elog_entry_check(cpu, bank); -- if (estatus == NULL || (mce->kflags & MCE_HANDLED_CEC)) -+ if (!estatus) - return NOTIFY_DONE; - -+ if (mce->kflags & MCE_HANDLED_CEC) { -+ estatus->block_status = 0; -+ return NOTIFY_DONE; -+ } -+ - memcpy(elog_buf, (void *)estatus, ELOG_ENTRY_LEN); - /* clear record status to enable BIOS to update it again */ - estatus->block_status = 0; --- -2.43.2 - -From 02871710b93058eb1249d5847c0b2d1c2c3c98ae Mon Sep 17 00:00:00 2001 -From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com> -Date: Thu, 14 Dec 2023 11:52:25 +0100 -Subject: [PATCH 0065/1501] thermal: core: Fix NULL pointer dereference in zone - registration error path -Content-Length: 1524 -Lines: 38 - -[ Upstream commit 04e6ccfc93c5a1aa1d75a537cf27e418895e20ea ] - -If device_register() in thermal_zone_device_register_with_trips() -returns an error, the tz variable is set to NULL and subsequently -dereferenced in kfree(tz->tzp). - -Commit adc8749b150c ("thermal/drivers/core: Use put_device() if -device_register() fails") added the tz = NULL assignment in question to -avoid a possible double-free after dropping the reference to the zone -device. However, after commit 4649620d9404 ("thermal: core: Make -thermal_zone_device_unregister() return after freeing the zone"), that -assignment has become redundant, because dropping the reference to the -zone device does not cause the zone object to be freed any more. - -Drop it to address the NULL pointer dereference. - -Fixes: 3d439b1a2ad3 ("thermal/core: Alloc-copy-free the thermal zone parameters structure") -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Reviewed-by: Lukasz Luba <lukasz.luba@arm.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/thermal/thermal_core.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c -index 9c17d35ccbbd..1bc7ba459406 100644 ---- a/drivers/thermal/thermal_core.c -+++ b/drivers/thermal/thermal_core.c -@@ -1369,7 +1369,6 @@ thermal_zone_device_register_with_trips(const char *type, struct thermal_trip *t - device_del(&tz->device); - release_device: - put_device(&tz->device); -- tz = NULL; - remove_id: - ida_free(&thermal_tz_ida, id); - free_tzp: --- -2.43.2 - -From 7d72528b6c46ca173084064334e562c8c6bd3005 Mon Sep 17 00:00:00 2001 -From: Richard Fitzgerald <rf@opensource.cirrus.com> -Date: Mon, 30 Oct 2023 10:47:58 +0000 -Subject: [PATCH 0066/1501] kunit: debugfs: Fix unchecked dereference in - debugfs_print_results() -Content-Length: 1461 -Lines: 42 - -[ Upstream commit 34dfd5bb2e5507e69d9b6d6c90f546600c7a4977 ] - -Move the call to kunit_suite_has_succeeded() after the check that -the kunit_suite pointer is valid. - -This was found by smatch: - - lib/kunit/debugfs.c:66 debugfs_print_results() warn: variable - dereferenced before check 'suite' (see line 63) - -Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com> -Reported-by: Dan Carpenter <dan.carpenter@linaro.org> -Fixes: 38289a26e1b8 ("kunit: fix debugfs code to use enum kunit_status, not bool") -Reviewed-by: Rae Moar <rmoar@google.com> -Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - lib/kunit/debugfs.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/lib/kunit/debugfs.c b/lib/kunit/debugfs.c -index 270d185737e6..5bfc18ad5fff 100644 ---- a/lib/kunit/debugfs.c -+++ b/lib/kunit/debugfs.c -@@ -60,12 +60,14 @@ static void debugfs_print_result(struct seq_file *seq, struct string_stream *log - static int debugfs_print_results(struct seq_file *seq, void *v) - { - struct kunit_suite *suite = (struct kunit_suite *)seq->private; -- enum kunit_status success = kunit_suite_has_succeeded(suite); -+ enum kunit_status success; - struct kunit_case *test_case; - - if (!suite) - return 0; - -+ success = kunit_suite_has_succeeded(suite); -+ - /* Print KTAP header so the debugfs log can be parsed as valid KTAP. */ - seq_puts(seq, "KTAP version 1\n"); - seq_puts(seq, "1..1\n"); --- -2.43.2 - -From 568a410e89f0ae73f2663bd1a48f981d3377aac9 Mon Sep 17 00:00:00 2001 -From: Richard Fitzgerald <rf@opensource.cirrus.com> -Date: Mon, 30 Oct 2023 10:47:32 +0000 -Subject: [PATCH 0067/1501] kunit: debugfs: Handle errors from - alloc_string_stream() -Content-Length: 2833 -Lines: 78 - -[ Upstream commit 1557e89d3af51a4f1bd6870b3117bed651de5dbf ] - -In kunit_debugfs_create_suite() give up and skip creating the debugfs -file if any of the alloc_string_stream() calls return an error or NULL. -Only put a value in the log pointer of kunit_suite and kunit_test if it -is a valid pointer to a log. - -This prevents the potential invalid dereference reported by smatch: - - lib/kunit/debugfs.c:115 kunit_debugfs_create_suite() error: 'suite->log' - dereferencing possible ERR_PTR() - lib/kunit/debugfs.c:119 kunit_debugfs_create_suite() error: 'test_case->log' - dereferencing possible ERR_PTR() - -Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com> -Reported-by: Dan Carpenter <dan.carpenter@linaro.org> -Fixes: 05e2006ce493 ("kunit: Use string_stream for test log") -Reviewed-by: Rae Moar <rmoar@google.com> -Reviewed-by: David Gow <davidgow@google.com> -Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - lib/kunit/debugfs.c | 30 +++++++++++++++++++++++++----- - 1 file changed, 25 insertions(+), 5 deletions(-) - -diff --git a/lib/kunit/debugfs.c b/lib/kunit/debugfs.c -index 5bfc18ad5fff..382706dfb47d 100644 ---- a/lib/kunit/debugfs.c -+++ b/lib/kunit/debugfs.c -@@ -111,14 +111,28 @@ static const struct file_operations debugfs_results_fops = { - void kunit_debugfs_create_suite(struct kunit_suite *suite) - { - struct kunit_case *test_case; -+ struct string_stream *stream; - -- /* Allocate logs before creating debugfs representation. */ -- suite->log = alloc_string_stream(GFP_KERNEL); -- string_stream_set_append_newlines(suite->log, true); -+ /* -+ * Allocate logs before creating debugfs representation. -+ * The suite->log and test_case->log pointer are expected to be NULL -+ * if there isn't a log, so only set it if the log stream was created -+ * successfully. -+ */ -+ stream = alloc_string_stream(GFP_KERNEL); -+ if (IS_ERR_OR_NULL(stream)) -+ return; -+ -+ string_stream_set_append_newlines(stream, true); -+ suite->log = stream; - - kunit_suite_for_each_test_case(suite, test_case) { -- test_case->log = alloc_string_stream(GFP_KERNEL); -- string_stream_set_append_newlines(test_case->log, true); -+ stream = alloc_string_stream(GFP_KERNEL); -+ if (IS_ERR_OR_NULL(stream)) -+ goto err; -+ -+ string_stream_set_append_newlines(stream, true); -+ test_case->log = stream; - } - - suite->debugfs = debugfs_create_dir(suite->name, debugfs_rootdir); -@@ -126,6 +140,12 @@ void kunit_debugfs_create_suite(struct kunit_suite *suite) - debugfs_create_file(KUNIT_DEBUGFS_RESULTS, S_IFREG | 0444, - suite->debugfs, - suite, &debugfs_results_fops); -+ return; -+ -+err: -+ string_stream_destroy(suite->log); -+ kunit_suite_for_each_test_case(suite, test_case) -+ string_stream_destroy(test_case->log); - } - - void kunit_debugfs_destroy_suite(struct kunit_suite *suite) --- -2.43.2 - -From b36aaa64d58aaa2f2cbc8275e89bae76a2b6c3dc Mon Sep 17 00:00:00 2001 -From: ZhaoLong Wang <wangzhaolong1@huawei.com> -Date: Wed, 20 Dec 2023 10:46:19 +0800 -Subject: [PATCH 0068/1501] mtd: Fix gluebi NULL pointer dereference caused by - ftl notifier -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2865 -Lines: 74 - -[ Upstream commit a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6 ] - -If both ftl.ko and gluebi.ko are loaded, the notifier of ftl -triggers NULL pointer dereference when trying to access -‘gluebi->desc’ in gluebi_read(). - -ubi_gluebi_init - ubi_register_volume_notifier - ubi_enumerate_volumes - ubi_notify_all - gluebi_notify nb->notifier_call() - gluebi_create - mtd_device_register - mtd_device_parse_register - add_mtd_device - blktrans_notify_add not->add() - ftl_add_mtd tr->add_mtd() - scan_header - mtd_read - mtd_read_oob - mtd_read_oob_std - gluebi_read mtd->read() - gluebi->desc - NULL - -Detailed reproduction information available at the Link [1], - -In the normal case, obtain gluebi->desc in the gluebi_get_device(), -and access gluebi->desc in the gluebi_read(). However, -gluebi_get_device() is not executed in advance in the -ftl_add_mtd() process, which leads to NULL pointer dereference. - -The solution for the gluebi module is to run jffs2 on the UBI -volume without considering working with ftl or mtdblock [2]. -Therefore, this problem can be avoided by preventing gluebi from -creating the mtdblock device after creating mtd partition of the -type MTD_UBIVOLUME. - -Fixes: 2ba3d76a1e29 ("UBI: make gluebi a separate module") -Link: https://bugzilla.kernel.org/show_bug.cgi?id=217992 [1] -Link: https://lore.kernel.org/lkml/441107100.23734.1697904580252.JavaMail.zimbra@nod.at/ [2] -Signed-off-by: ZhaoLong Wang <wangzhaolong1@huawei.com> -Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com> -Acked-by: Richard Weinberger <richard@nod.at> -Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> -Link: https://lore.kernel.org/linux-mtd/20231220024619.2138625-1-wangzhaolong1@huawei.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/mtd/mtd_blkdevs.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c -index ff18636e0889..5bc32108ca03 100644 ---- a/drivers/mtd/mtd_blkdevs.c -+++ b/drivers/mtd/mtd_blkdevs.c -@@ -463,7 +463,7 @@ static void blktrans_notify_add(struct mtd_info *mtd) - { - struct mtd_blktrans_ops *tr; - -- if (mtd->type == MTD_ABSENT) -+ if (mtd->type == MTD_ABSENT || mtd->type == MTD_UBIVOLUME) - return; - - list_for_each_entry(tr, &blktrans_majors, list) -@@ -503,7 +503,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr) - mutex_lock(&mtd_table_mutex); - list_add(&tr->list, &blktrans_majors); - mtd_for_each_device(mtd) -- if (mtd->type != MTD_ABSENT) -+ if (mtd->type != MTD_ABSENT && mtd->type != MTD_UBIVOLUME) - tr->add_mtd(tr, mtd); - mutex_unlock(&mtd_table_mutex); - return 0; --- -2.43.2 - -From f1f92ff6f50261e2b006aaad23a6f41835d492e7 Mon Sep 17 00:00:00 2001 -From: "Borislav Petkov (AMD)" <bp@alien8.de> -Date: Fri, 29 Dec 2023 18:08:18 +0100 -Subject: [PATCH 0069/1501] cpuidle: haltpoll: Do not enable interrupts when - entering idle -Content-Length: 1622 -Lines: 45 - -[ Upstream commit c8f5caec3df84a02b937d6d9cda1f7ffa8dc443f ] - -The cpuidle drivers' ->enter() methods are supposed to be IRQ invariant: - - 5e26aa933911 ("cpuidle/poll: Ensure IRQs stay disabled after cpuidle_state::enter() calls") - bb7b11258561 ("cpuidle: Move IRQ state validation") - -Do that in the haltpoll driver too. - -Fixes: 5e26aa933911 ("cpuidle/poll: Ensure IRQs stay disabled after cpuidle_state::enter() calls") -Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218245 -Reported-by: <forza@tnonline.net> -Tested-by: <forza@tnonline.net> -Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> -[ rjw: Changelog edits ] -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/cpuidle/cpuidle-haltpoll.c | 9 ++++----- - 1 file changed, 4 insertions(+), 5 deletions(-) - -diff --git a/drivers/cpuidle/cpuidle-haltpoll.c b/drivers/cpuidle/cpuidle-haltpoll.c -index e66df22f9695..d8515d5c0853 100644 ---- a/drivers/cpuidle/cpuidle-haltpoll.c -+++ b/drivers/cpuidle/cpuidle-haltpoll.c -@@ -25,13 +25,12 @@ MODULE_PARM_DESC(force, "Load unconditionally"); - static struct cpuidle_device __percpu *haltpoll_cpuidle_devices; - static enum cpuhp_state haltpoll_hp_state; - --static int default_enter_idle(struct cpuidle_device *dev, -- struct cpuidle_driver *drv, int index) -+static __cpuidle int default_enter_idle(struct cpuidle_device *dev, -+ struct cpuidle_driver *drv, int index) - { -- if (current_clr_polling_and_test()) { -- local_irq_enable(); -+ if (current_clr_polling_and_test()) - return index; -- } -+ - arch_cpu_idle(); - return index; - } --- -2.43.2 - -From 6010a9fc14eb1feab5cafd84422001134fe8ec58 Mon Sep 17 00:00:00 2001 -From: Binbin Zhou <zhoubinbin@loongson.cn> -Date: Fri, 24 Nov 2023 17:57:45 +0800 -Subject: [PATCH 0070/1501] drivers/thermal/loongson2_thermal: Fix incorrect - PTR_ERR() judgment -Content-Length: 5129 -Lines: 86 - -[ Upstream commit 15ef92e9c41124ee9d88b01208364f3fe1f45f84 ] - -PTR_ERR() returns -ENODEV when thermal-zones are undefined, and we need --ENODEV as the right value for comparison. - -Otherwise, tz->type is NULL when thermal-zones is undefined, resulting -in the following error: - -[ 12.290030] CPU 1 Unable to handle kernel paging request at virtual address fffffffffffffff1, era == 900000000355f410, ra == 90000000031579b8 -[ 12.302877] Oops[#1]: -[ 12.305190] CPU: 1 PID: 181 Comm: systemd-udevd Not tainted 6.6.0-rc7+ #5385 -[ 12.312304] pc 900000000355f410 ra 90000000031579b8 tp 90000001069e8000 sp 90000001069eba10 -[ 12.320739] a0 0000000000000000 a1 fffffffffffffff1 a2 0000000000000014 a3 0000000000000001 -[ 12.329173] a4 90000001069eb990 a5 0000000000000001 a6 0000000000001001 a7 900000010003431c -[ 12.337606] t0 fffffffffffffff1 t1 54567fd5da9b4fd4 t2 900000010614ec40 t3 00000000000dc901 -[ 12.346041] t4 0000000000000000 t5 0000000000000004 t6 900000010614ee20 t7 900000000d00b790 -[ 12.354472] t8 00000000000dc901 u0 54567fd5da9b4fd4 s9 900000000402ae10 s0 900000010614ec40 -[ 12.362916] s1 90000000039fced0 s2 ffffffffffffffed s3 ffffffffffffffed s4 9000000003acc000 -[ 12.362931] s5 0000000000000004 s6 fffffffffffff000 s7 0000000000000490 s8 90000001028b2ec8 -[ 12.362938] ra: 90000000031579b8 thermal_add_hwmon_sysfs+0x258/0x300 -[ 12.386411] ERA: 900000000355f410 strscpy+0xf0/0x160 -[ 12.391626] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) -[ 12.397898] PRMD: 00000004 (PPLV0 +PIE -PWE) -[ 12.403678] EUEN: 00000000 (-FPE -SXE -ASXE -BTE) -[ 12.409859] ECFG: 00071c1c (LIE=2-4,10-12 VS=7) -[ 12.415882] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) -[ 12.415907] BADV: fffffffffffffff1 -[ 12.415911] PRID: 0014a000 (Loongson-64bit, Loongson-2K1000) -[ 12.415917] Modules linked in: loongson2_thermal(+) vfat fat uio_pdrv_genirq uio fuse zram zsmalloc -[ 12.415950] Process systemd-udevd (pid: 181, threadinfo=00000000358b9718, task=00000000ace72fe3) -[ 12.415961] Stack : 0000000000000dc0 54567fd5da9b4fd4 900000000402ae10 9000000002df9358 -[ 12.415982] ffffffffffffffed 0000000000000004 9000000107a10aa8 90000001002a3410 -[ 12.415999] ffffffffffffffed ffffffffffffffed 9000000107a11268 9000000003157ab0 -[ 12.416016] 9000000107a10aa8 ffffff80020fc0c8 90000001002a3410 ffffffffffffffed -[ 12.416032] 0000000000000024 ffffff80020cc1e8 900000000402b2a0 9000000003acc000 -[ 12.416048] 90000001002a3410 0000000000000000 ffffff80020f4030 90000001002a3410 -[ 12.416065] 0000000000000000 9000000002df6808 90000001002a3410 0000000000000000 -[ 12.416081] ffffff80020f4030 0000000000000000 90000001002a3410 9000000002df2ba8 -[ 12.416097] 00000000000000b4 90000001002a34f4 90000001002a3410 0000000000000002 -[ 12.416114] ffffff80020f4030 fffffffffffffff0 90000001002a3410 9000000002df2f30 -[ 12.416131] ... -[ 12.416138] Call Trace: -[ 12.416142] [<900000000355f410>] strscpy+0xf0/0x160 -[ 12.416167] [<90000000031579b8>] thermal_add_hwmon_sysfs+0x258/0x300 -[ 12.416183] [<9000000003157ab0>] devm_thermal_add_hwmon_sysfs+0x50/0xe0 -[ 12.416200] [<ffffff80020cc1e8>] loongson2_thermal_probe+0x128/0x200 [loongson2_thermal] -[ 12.416232] [<9000000002df6808>] platform_probe+0x68/0x140 -[ 12.416249] [<9000000002df2ba8>] really_probe+0xc8/0x3c0 -[ 12.416269] [<9000000002df2f30>] __driver_probe_device+0x90/0x180 -[ 12.416286] [<9000000002df3058>] driver_probe_device+0x38/0x160 -[ 12.416302] [<9000000002df33a8>] __driver_attach+0xa8/0x200 -[ 12.416314] [<9000000002deffec>] bus_for_each_dev+0x8c/0x120 -[ 12.416330] [<9000000002df198c>] bus_add_driver+0x10c/0x2a0 -[ 12.416346] [<9000000002df46b4>] driver_register+0x74/0x160 -[ 12.416358] [<90000000022201a4>] do_one_initcall+0x84/0x220 -[ 12.416372] [<90000000022f3ab8>] do_init_module+0x58/0x2c0 -[ 12.416386] [<90000000022f6538>] init_module_from_file+0x98/0x100 -[ 12.416399] [<90000000022f67f0>] sys_finit_module+0x230/0x3c0 -[ 12.416412] [<900000000358f7c8>] do_syscall+0x88/0xc0 -[ 12.416431] [<900000000222137c>] handle_syscall+0xbc/0x158 - -Fixes: e7e3a7c35791 ("thermal/drivers/loongson-2: Add thermal management support") -Cc: Yinbo Zhu <zhuyinbo@loongson.cn> -Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> -Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> -Link: https://lore.kernel.org/r/343c14de98216636a47b43e8bfd47b70d0a8e068.1700817227.git.zhoubinbin@loongson.cn -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/thermal/loongson2_thermal.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/thermal/loongson2_thermal.c b/drivers/thermal/loongson2_thermal.c -index 133098dc0854..99ca0c7bc41c 100644 ---- a/drivers/thermal/loongson2_thermal.c -+++ b/drivers/thermal/loongson2_thermal.c -@@ -127,7 +127,7 @@ static int loongson2_thermal_probe(struct platform_device *pdev) - if (!IS_ERR(tzd)) - break; - -- if (PTR_ERR(tzd) != ENODEV) -+ if (PTR_ERR(tzd) != -ENODEV) - continue; - - return dev_err_probe(dev, PTR_ERR(tzd), "failed to register"); --- -2.43.2 - -From 7f25cd51aa71711438a6c11fa638ba5aba61ed95 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= <mic@digikod.net> -Date: Wed, 3 Jan 2024 17:34:15 +0100 -Subject: [PATCH 0071/1501] selinux: Fix error priority for bind with AF_UNSPEC - on PF_INET6 socket -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1683 -Lines: 43 - -[ Upstream commit bbf5a1d0e5d0fb3bdf90205aa872636122692a50 ] - -The IPv6 network stack first checks the sockaddr length (-EINVAL error) -before checking the family (-EAFNOSUPPORT error). - -This was discovered thanks to commit a549d055a22e ("selftests/landlock: -Add network tests"). - -Cc: Eric Paris <eparis@parisplace.org> -Cc: Konstantin Meskhidze <konstantin.meskhidze@huawei.com> -Cc: Paul Moore <paul@paul-moore.com> -Cc: Stephen Smalley <stephen.smalley.work@gmail.com> -Reported-by: Muhammad Usama Anjum <usama.anjum@collabora.com> -Closes: https://lore.kernel.org/r/0584f91c-537c-4188-9e4f-04f192565667@collabora.com -Fixes: 0f8db8cc73df ("selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind()") -Signed-off-by: Mickaël Salaün <mic@digikod.net> -Tested-by: Muhammad Usama Anjum <usama.anjum@collabora.com> -Signed-off-by: Paul Moore <paul@paul-moore.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - security/selinux/hooks.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index 340b2bbbb2dd..0fb890bd72cb 100644 ---- a/security/selinux/hooks.c -+++ b/security/selinux/hooks.c -@@ -4661,6 +4661,13 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in - return -EINVAL; - addr4 = (struct sockaddr_in *)address; - if (family_sa == AF_UNSPEC) { -+ if (family == PF_INET6) { -+ /* Length check from inet6_bind_sk() */ -+ if (addrlen < SIN6_LEN_RFC2133) -+ return -EINVAL; -+ /* Family check from __inet6_bind() */ -+ goto err_af; -+ } - /* see __inet_bind(), we only want to allow - * AF_UNSPEC if the address is INADDR_ANY - */ --- -2.43.2 - -From 95ad8b6879e2e49d02e3bfc0e1fb46421633fe2a Mon Sep 17 00:00:00 2001 -From: Dan Carpenter <dan.carpenter@linaro.org> -Date: Mon, 30 Oct 2023 12:02:59 +0300 -Subject: [PATCH 0072/1501] crypto: rsa - add a check for allocation failure -Content-Length: 934 -Lines: 30 - -[ Upstream commit d872ca165cb67112f2841ef9c37d51ef7e63d1e4 ] - -Static checkers insist that the mpi_alloc() allocation can fail so add -a check to prevent a NULL dereference. Small allocations like this -can't actually fail in current kernels, but adding a check is very -simple and makes the static checkers happy. - -Fixes: 6637e11e4ad2 ("crypto: rsa - allow only odd e and restrict value in FIPS mode") -Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - crypto/rsa.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/crypto/rsa.c b/crypto/rsa.c -index c79613cdce6e..b9cd11fb7d36 100644 ---- a/crypto/rsa.c -+++ b/crypto/rsa.c -@@ -220,6 +220,8 @@ static int rsa_check_exponent_fips(MPI e) - } - - e_max = mpi_alloc(0); -+ if (!e_max) -+ return -ENOMEM; - mpi_set_bit(e_max, 256); - - if (mpi_cmp(e, e_max) >= 0) { --- -2.43.2 - -From c71d330e1d6096f99c2db7364d710892c2337e08 Mon Sep 17 00:00:00 2001 -From: Dan Carpenter <dan.carpenter@linaro.org> -Date: Tue, 31 Oct 2023 11:58:32 +0300 -Subject: [PATCH 0073/1501] crypto: qat - prevent underflow in rp2srv_store() -Content-Length: 1242 -Lines: 31 - -[ Upstream commit e53c741303a59ee1682e11f61b7772863e02526d ] - -The "ring" variable has an upper bounds check but nothing checks for -negatives. This code uses kstrtouint() already and it was obviously -intended to be declared as unsigned int. Make it so. - -Fixes: dbc8876dd873 ("crypto: qat - add rp2svc sysfs attribute") -Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> -Acked-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/intel/qat/qat_common/adf_sysfs.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/crypto/intel/qat/qat_common/adf_sysfs.c b/drivers/crypto/intel/qat/qat_common/adf_sysfs.c -index ddffc98119c6..6f0b3629da13 100644 ---- a/drivers/crypto/intel/qat/qat_common/adf_sysfs.c -+++ b/drivers/crypto/intel/qat/qat_common/adf_sysfs.c -@@ -242,7 +242,8 @@ static ssize_t rp2srv_store(struct device *dev, struct device_attribute *attr, - const char *buf, size_t count) - { - struct adf_accel_dev *accel_dev; -- int ring, num_rings, ret; -+ int num_rings, ret; -+ unsigned int ring; - - accel_dev = adf_devmgr_pci_to_accel_dev(to_pci_dev(dev)); - if (!accel_dev) --- -2.43.2 - -From 8e6ec051e0bfd5de52cfc40fedd0f1ce79f3ad40 Mon Sep 17 00:00:00 2001 -From: Chanho Park <chanho61.park@samsung.com> -Date: Thu, 9 Nov 2023 15:32:59 +0900 -Subject: [PATCH 0074/1501] crypto: jh7110 - Correct deferred probe return -Content-Length: 1503 -Lines: 46 - -[ Upstream commit d57343022b71b9f41e731282dbe0baf0cff6ada8 ] - -This fixes list_add corruption error when the driver is returned -with -EPROBE_DEFER. It is also required to roll back the previous -probe sequences in case of deferred_probe. So, this removes -'err_probe_defer" goto label and just use err_dma_init instead. - -Fixes: 42ef0e944b01 ("crypto: starfive - Add crypto engine support") -Signed-off-by: Chanho Park <chanho61.park@samsung.com> -Reviewed-by: Jia Jie Ho <jiajie.ho@starfivetech.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/starfive/jh7110-cryp.c | 10 +++------- - 1 file changed, 3 insertions(+), 7 deletions(-) - -diff --git a/drivers/crypto/starfive/jh7110-cryp.c b/drivers/crypto/starfive/jh7110-cryp.c -index 08e974e0dd12..3a67ddc4d936 100644 ---- a/drivers/crypto/starfive/jh7110-cryp.c -+++ b/drivers/crypto/starfive/jh7110-cryp.c -@@ -180,12 +180,8 @@ static int starfive_cryp_probe(struct platform_device *pdev) - spin_unlock(&dev_list.lock); - - ret = starfive_dma_init(cryp); -- if (ret) { -- if (ret == -EPROBE_DEFER) -- goto err_probe_defer; -- else -- goto err_dma_init; -- } -+ if (ret) -+ goto err_dma_init; - - /* Initialize crypto engine */ - cryp->engine = crypto_engine_alloc_init(&pdev->dev, 1); -@@ -233,7 +229,7 @@ static int starfive_cryp_probe(struct platform_device *pdev) - - tasklet_kill(&cryp->aes_done); - tasklet_kill(&cryp->hash_done); --err_probe_defer: -+ - return ret; - } - --- -2.43.2 - -From 8862c0d2e47ba1733d9687fe0ff4e02d6e391255 Mon Sep 17 00:00:00 2001 -From: "Gonglei (Arei)" <arei.gonglei@huawei.com> -Date: Mon, 20 Nov 2023 11:49:45 +0000 -Subject: [PATCH 0075/1501] crypto: virtio - Handle dataq logic with tasklet -Content-Length: 3085 -Lines: 91 - -[ Upstream commit fed93fb62e05c38152b0fc1dc9609639e63eed76 ] - -Doing ipsec produces a spinlock recursion warning. -This is due to crypto_finalize_request() being called in the upper half. -Move virtual data queue processing of virtio-crypto driver to tasklet. - -Fixes: dbaf0624ffa57 ("crypto: add virtio-crypto driver") -Reported-by: Halil Pasic <pasic@linux.ibm.com> -Signed-off-by: wangyangxin <wangyangxin1@huawei.com> -Signed-off-by: Gonglei <arei.gonglei@huawei.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/virtio/virtio_crypto_common.h | 2 ++ - drivers/crypto/virtio/virtio_crypto_core.c | 23 +++++++++++--------- - 2 files changed, 15 insertions(+), 10 deletions(-) - -diff --git a/drivers/crypto/virtio/virtio_crypto_common.h b/drivers/crypto/virtio/virtio_crypto_common.h -index 154590e1f764..7059bbe5a2eb 100644 ---- a/drivers/crypto/virtio/virtio_crypto_common.h -+++ b/drivers/crypto/virtio/virtio_crypto_common.h -@@ -10,6 +10,7 @@ - #include <linux/virtio.h> - #include <linux/crypto.h> - #include <linux/spinlock.h> -+#include <linux/interrupt.h> - #include <crypto/aead.h> - #include <crypto/aes.h> - #include <crypto/engine.h> -@@ -28,6 +29,7 @@ struct data_queue { - char name[32]; - - struct crypto_engine *engine; -+ struct tasklet_struct done_task; - }; - - struct virtio_crypto { -diff --git a/drivers/crypto/virtio/virtio_crypto_core.c b/drivers/crypto/virtio/virtio_crypto_core.c -index 43a0838d31ff..428d76562447 100644 ---- a/drivers/crypto/virtio/virtio_crypto_core.c -+++ b/drivers/crypto/virtio/virtio_crypto_core.c -@@ -72,27 +72,28 @@ int virtio_crypto_ctrl_vq_request(struct virtio_crypto *vcrypto, struct scatterl - return 0; - } - --static void virtcrypto_dataq_callback(struct virtqueue *vq) -+static void virtcrypto_done_task(unsigned long data) - { -- struct virtio_crypto *vcrypto = vq->vdev->priv; -+ struct data_queue *data_vq = (struct data_queue *)data; -+ struct virtqueue *vq = data_vq->vq; - struct virtio_crypto_request *vc_req; -- unsigned long flags; - unsigned int len; -- unsigned int qid = vq->index; - -- spin_lock_irqsave(&vcrypto->data_vq[qid].lock, flags); - do { - virtqueue_disable_cb(vq); - while ((vc_req = virtqueue_get_buf(vq, &len)) != NULL) { -- spin_unlock_irqrestore( -- &vcrypto->data_vq[qid].lock, flags); - if (vc_req->alg_cb) - vc_req->alg_cb(vc_req, len); -- spin_lock_irqsave( -- &vcrypto->data_vq[qid].lock, flags); - } - } while (!virtqueue_enable_cb(vq)); -- spin_unlock_irqrestore(&vcrypto->data_vq[qid].lock, flags); -+} -+ -+static void virtcrypto_dataq_callback(struct virtqueue *vq) -+{ -+ struct virtio_crypto *vcrypto = vq->vdev->priv; -+ struct data_queue *dq = &vcrypto->data_vq[vq->index]; -+ -+ tasklet_schedule(&dq->done_task); - } - - static int virtcrypto_find_vqs(struct virtio_crypto *vi) -@@ -150,6 +151,8 @@ static int virtcrypto_find_vqs(struct virtio_crypto *vi) - ret = -ENOMEM; - goto err_engine; - } -+ tasklet_init(&vi->data_vq[i].done_task, virtcrypto_done_task, -+ (unsigned long)&vi->data_vq[i]); - } - - kfree(names); --- -2.43.2 - -From c3c9f8e17d4598a37652b7645a34f47e78c779de Mon Sep 17 00:00:00 2001 -From: Damian Muszynski <damian.muszynski@intel.com> -Date: Tue, 21 Nov 2023 17:59:45 +0100 -Subject: [PATCH 0076/1501] crypto: qat - add sysfs_added flag for ras -Content-Length: 3389 -Lines: 81 - -[ Upstream commit 65089000ba8c2ae713ccac6603319143f3e1c08b ] - -The qat_ras sysfs attribute group is registered within the -adf_dev_start() function, alongside other driver components. -If any of the functions preceding the group registration fails, -the adf_dev_start() function returns, and the caller, to undo the -operation, invokes adf_dev_stop() followed by adf_dev_shutdown(). -However, the current flow lacks information about whether the -registration of the qat_ras attribute group was successful or not. - -In cases where this condition is encountered, an error similar to -the following might be reported: - - 4xxx 0000:6b:00.0: Starting device qat_dev0 - 4xxx 0000:6b:00.0: qat_dev0 started 9 acceleration engines - 4xxx 0000:6b:00.0: Failed to send init message - 4xxx 0000:6b:00.0: Failed to start device qat_dev0 - sysfs group 'qat_ras' not found for kobject '0000:6b:00.0' - ... - sysfs_remove_groups+0x29/0x50 - adf_sysfs_stop_ras+0x4b/0x80 [intel_qat] - adf_dev_stop+0x43/0x1d0 [intel_qat] - adf_dev_down+0x4b/0x150 [intel_qat] - ... - 4xxx 0000:6b:00.0: qat_dev0 stopped 9 acceleration engines - 4xxx 0000:6b:00.0: Resetting device qat_dev0 - -To prevent attempting to remove attributes from a group that has not -been added yet, a flag named 'sysfs_added' is introduced. This flag -is set to true upon the successful registration of the attribute group. - -Fixes: 532d7f6bc458 ("crypto: qat - add error counters") -Signed-off-by: Damian Muszynski <damian.muszynski@intel.com> -Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> -Reviewed-by: Ahsan Atta <ahsan.atta@intel.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/intel/qat/qat_common/adf_accel_devices.h | 1 + - .../crypto/intel/qat/qat_common/adf_sysfs_ras_counters.c | 7 ++++++- - 2 files changed, 7 insertions(+), 1 deletion(-) - -diff --git a/drivers/crypto/intel/qat/qat_common/adf_accel_devices.h b/drivers/crypto/intel/qat/qat_common/adf_accel_devices.h -index 4ff5729a3496..9d5fdd529a2e 100644 ---- a/drivers/crypto/intel/qat/qat_common/adf_accel_devices.h -+++ b/drivers/crypto/intel/qat/qat_common/adf_accel_devices.h -@@ -92,6 +92,7 @@ enum ras_errors { - - struct adf_error_counters { - atomic_t counter[ADF_RAS_ERRORS]; -+ bool sysfs_added; - bool enabled; - }; - -diff --git a/drivers/crypto/intel/qat/qat_common/adf_sysfs_ras_counters.c b/drivers/crypto/intel/qat/qat_common/adf_sysfs_ras_counters.c -index cffe2d722995..e97c67c87b3c 100644 ---- a/drivers/crypto/intel/qat/qat_common/adf_sysfs_ras_counters.c -+++ b/drivers/crypto/intel/qat/qat_common/adf_sysfs_ras_counters.c -@@ -99,6 +99,8 @@ void adf_sysfs_start_ras(struct adf_accel_dev *accel_dev) - if (device_add_group(&GET_DEV(accel_dev), &qat_ras_group)) - dev_err(&GET_DEV(accel_dev), - "Failed to create qat_ras attribute group.\n"); -+ -+ accel_dev->ras_errors.sysfs_added = true; - } - - void adf_sysfs_stop_ras(struct adf_accel_dev *accel_dev) -@@ -106,7 +108,10 @@ void adf_sysfs_stop_ras(struct adf_accel_dev *accel_dev) - if (!accel_dev->ras_errors.enabled) - return; - -- device_remove_group(&GET_DEV(accel_dev), &qat_ras_group); -+ if (accel_dev->ras_errors.sysfs_added) { -+ device_remove_group(&GET_DEV(accel_dev), &qat_ras_group); -+ accel_dev->ras_errors.sysfs_added = false; -+ } - - ADF_RAS_ERR_CTR_CLEAR(accel_dev->ras_errors); - } --- -2.43.2 - -From 902caff5a728a392e2c8a8546590866d2df17ba7 Mon Sep 17 00:00:00 2001 -From: Damian Muszynski <damian.muszynski@intel.com> -Date: Tue, 21 Nov 2023 18:02:23 +0100 -Subject: [PATCH 0077/1501] crypto: qat - add sysfs_added flag for rate - limiting -Content-Length: 3120 -Lines: 81 - -[ Upstream commit d71fdd0f3c278c7f132c3a522645ebf9157edd6d ] - -The qat_rl sysfs attribute group is registered within the adf_dev_start() -function, alongside other driver components. -If any of the functions preceding the group registration fails, -the adf_dev_start() function returns, and the caller, to undo the -operation, invokes adf_dev_stop() followed by adf_dev_shutdown(). -However, the current flow lacks information about whether the -registration of the qat_rl attribute group was successful or not. - -In cases where this condition is encountered, an error similar to -the following might be reported: - - 4xxx 0000:6b:00.0: Starting device qat_dev0 - 4xxx 0000:6b:00.0: qat_dev0 started 9 acceleration engines - 4xxx 0000:6b:00.0: Failed to send init message - 4xxx 0000:6b:00.0: Failed to start device qat_dev0 - sysfs group 'qat_rl' not found for kobject '0000:6b:00.0' - ... - sysfs_remove_groups+0x2d/0x50 - adf_sysfs_rl_rm+0x44/0x70 [intel_qat] - adf_rl_stop+0x2d/0xb0 [intel_qat] - adf_dev_stop+0x33/0x1d0 [intel_qat] - adf_dev_down+0xf1/0x150 [intel_qat] - ... - 4xxx 0000:6b:00.0: qat_dev0 stopped 9 acceleration engines - 4xxx 0000:6b:00.0: Resetting device qat_dev0 - -To prevent attempting to remove attributes from a group that has not -been added yet, a flag named 'sysfs_added' is introduced. This flag -is set to true upon the successful registration of the attribute group. - -Fixes: d9fb8408376e ("crypto: qat - add rate limiting feature to qat_4xxx") -Signed-off-by: Damian Muszynski <damian.muszynski@intel.com> -Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> -Reviewed-by: Ahsan Atta <ahsan.atta@intel.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/intel/qat/qat_common/adf_rl.h | 1 + - drivers/crypto/intel/qat/qat_common/adf_sysfs_rl.c | 8 ++++++++ - 2 files changed, 9 insertions(+) - -diff --git a/drivers/crypto/intel/qat/qat_common/adf_rl.h b/drivers/crypto/intel/qat/qat_common/adf_rl.h -index eb5a330f8543..269c6656fb90 100644 ---- a/drivers/crypto/intel/qat/qat_common/adf_rl.h -+++ b/drivers/crypto/intel/qat/qat_common/adf_rl.h -@@ -79,6 +79,7 @@ struct adf_rl_interface_data { - struct adf_rl_sla_input_data input; - enum adf_base_services cap_rem_srv; - struct rw_semaphore lock; -+ bool sysfs_added; - }; - - struct adf_rl_hw_data { -diff --git a/drivers/crypto/intel/qat/qat_common/adf_sysfs_rl.c b/drivers/crypto/intel/qat/qat_common/adf_sysfs_rl.c -index abf9c52474ec..bedb514d4e30 100644 ---- a/drivers/crypto/intel/qat/qat_common/adf_sysfs_rl.c -+++ b/drivers/crypto/intel/qat/qat_common/adf_sysfs_rl.c -@@ -441,11 +441,19 @@ int adf_sysfs_rl_add(struct adf_accel_dev *accel_dev) - - data->cap_rem_srv = ADF_SVC_NONE; - data->input.srv = ADF_SVC_NONE; -+ data->sysfs_added = true; - - return ret; - } - - void adf_sysfs_rl_rm(struct adf_accel_dev *accel_dev) - { -+ struct adf_rl_interface_data *data; -+ -+ data = &GET_RL_STRUCT(accel_dev); -+ if (!data->sysfs_added) -+ return; -+ - device_remove_group(&GET_DEV(accel_dev), &qat_rl_group); -+ data->sysfs_added = false; - } --- -2.43.2 - -From a9975dc25dbe24d10569f5f575414f377b8869a7 Mon Sep 17 00:00:00 2001 -From: Chen Ni <nichen@iscas.ac.cn> -Date: Mon, 27 Nov 2023 02:03:01 +0000 -Subject: [PATCH 0078/1501] crypto: sa2ul - Return crypto_aead_setkey to - transfer the error -Content-Length: 1016 -Lines: 30 - -[ Upstream commit ce852f1308ac738e61c5b2502517deea593a1554 ] - -Return crypto_aead_setkey() in order to transfer the error if -it fails. - -Fixes: d2c8ac187fc9 ("crypto: sa2ul - Add AEAD algorithm support") -Signed-off-by: Chen Ni <nichen@iscas.ac.cn> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/sa2ul.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/drivers/crypto/sa2ul.c b/drivers/crypto/sa2ul.c -index 6846a8429574..78a4930c6480 100644 ---- a/drivers/crypto/sa2ul.c -+++ b/drivers/crypto/sa2ul.c -@@ -1869,9 +1869,8 @@ static int sa_aead_setkey(struct crypto_aead *authenc, - crypto_aead_set_flags(ctx->fallback.aead, - crypto_aead_get_flags(authenc) & - CRYPTO_TFM_REQ_MASK); -- crypto_aead_setkey(ctx->fallback.aead, key, keylen); - -- return 0; -+ return crypto_aead_setkey(ctx->fallback.aead, key, keylen); - } - - static int sa_aead_setauthsize(struct crypto_aead *tfm, unsigned int authsize) --- -2.43.2 - -From 0055ff3ee060002c97cbbaf77ceead8c11d0b984 Mon Sep 17 00:00:00 2001 -From: Dinghao Liu <dinghao.liu@zju.edu.cn> -Date: Mon, 27 Nov 2023 11:47:10 +0800 -Subject: [PATCH 0079/1501] crypto: ccp - fix memleak in ccp_init_dm_workarea -Content-Length: 1351 -Lines: 37 - -[ Upstream commit a1c95dd5bc1d6a5d7a75a376c2107421b7d6240d ] - -When dma_map_single() fails, wa->address is supposed to be freed -by the callers of ccp_init_dm_workarea() through ccp_dm_free(). -However, many of the call spots don't expect to have to call -ccp_dm_free() on failure of ccp_init_dm_workarea(), which may -lead to a memleak. Let's free wa->address in ccp_init_dm_workarea() -when dma_map_single() fails. - -Fixes: 63b945091a07 ("crypto: ccp - CCP device driver and interface support") -Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> -Acked-by: Tom Lendacky <thomas.lendacky@amd.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/ccp/ccp-ops.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c -index aa4e1a500691..cb8e99936abb 100644 ---- a/drivers/crypto/ccp/ccp-ops.c -+++ b/drivers/crypto/ccp/ccp-ops.c -@@ -179,8 +179,11 @@ static int ccp_init_dm_workarea(struct ccp_dm_workarea *wa, - - wa->dma.address = dma_map_single(wa->dev, wa->address, len, - dir); -- if (dma_mapping_error(wa->dev, wa->dma.address)) -+ if (dma_mapping_error(wa->dev, wa->dma.address)) { -+ kfree(wa->address); -+ wa->address = NULL; - return -ENOMEM; -+ } - - wa->dma.length = len; - } --- -2.43.2 - -From 4767e8239e15f891d819ef3ba2b286d87ea327e1 Mon Sep 17 00:00:00 2001 -From: Herbert Xu <herbert@gondor.apana.org.au> -Date: Tue, 28 Nov 2023 16:25:49 +0800 -Subject: [PATCH 0080/1501] crypto: af_alg - Disallow multiple in-flight AIO - requests -Content-Length: 2364 -Lines: 77 - -[ Upstream commit 67b164a871af1d736f131fd6fe78a610909f06f3 ] - -Having multiple in-flight AIO requests results in unpredictable -output because they all share the same IV. Fix this by only allowing -one request at a time. - -Fixes: 83094e5e9e49 ("crypto: af_alg - add async support to algif_aead") -Fixes: a596999b7ddf ("crypto: algif - change algif_skcipher to be asynchronous") -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - crypto/af_alg.c | 14 +++++++++++++- - include/crypto/if_alg.h | 3 +++ - 2 files changed, 16 insertions(+), 1 deletion(-) - -diff --git a/crypto/af_alg.c b/crypto/af_alg.c -index ea6fb8e89d06..68cc9290cabe 100644 ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -1116,9 +1116,13 @@ EXPORT_SYMBOL_GPL(af_alg_sendmsg); - void af_alg_free_resources(struct af_alg_async_req *areq) - { - struct sock *sk = areq->sk; -+ struct af_alg_ctx *ctx; - - af_alg_free_areq_sgls(areq); - sock_kfree_s(sk, areq, areq->areqlen); -+ -+ ctx = alg_sk(sk)->private; -+ ctx->inflight = false; - } - EXPORT_SYMBOL_GPL(af_alg_free_resources); - -@@ -1188,11 +1192,19 @@ EXPORT_SYMBOL_GPL(af_alg_poll); - struct af_alg_async_req *af_alg_alloc_areq(struct sock *sk, - unsigned int areqlen) - { -- struct af_alg_async_req *areq = sock_kmalloc(sk, areqlen, GFP_KERNEL); -+ struct af_alg_ctx *ctx = alg_sk(sk)->private; -+ struct af_alg_async_req *areq; - -+ /* Only one AIO request can be in flight. */ -+ if (ctx->inflight) -+ return ERR_PTR(-EBUSY); -+ -+ areq = sock_kmalloc(sk, areqlen, GFP_KERNEL); - if (unlikely(!areq)) - return ERR_PTR(-ENOMEM); - -+ ctx->inflight = true; -+ - areq->areqlen = areqlen; - areq->sk = sk; - areq->first_rsgl.sgl.sgt.sgl = areq->first_rsgl.sgl.sgl; -diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h -index ef8ce86b1f78..08b803a4fcde 100644 ---- a/include/crypto/if_alg.h -+++ b/include/crypto/if_alg.h -@@ -136,6 +136,7 @@ struct af_alg_async_req { - * recvmsg is invoked. - * @init: True if metadata has been sent. - * @len: Length of memory allocated for this data structure. -+ * @inflight: Non-zero when AIO requests are in flight. - */ - struct af_alg_ctx { - struct list_head tsgl_list; -@@ -154,6 +155,8 @@ struct af_alg_ctx { - bool init; - - unsigned int len; -+ -+ unsigned int inflight; - }; - - int af_alg_register_type(const struct af_alg_type *type); --- -2.43.2 - -From 8e70af2465a16cee580009ac1f7b761c613411a3 Mon Sep 17 00:00:00 2001 -From: Damian Muszynski <damian.muszynski@intel.com> -Date: Tue, 28 Nov 2023 18:37:32 +0100 -Subject: [PATCH 0081/1501] crypto: qat - fix error path in add_update_sla() -Content-Length: 2037 -Lines: 50 - -[ Upstream commit 6627f03c21cb7001ae4dbbfb7a8514516d02331c ] - -The input argument `sla_in` is a pointer to a structure that contains -the parameters of the SLA which is being added or updated. -If this pointer is NULL, the function should return an error as -the data required for the algorithm is not available. -By mistake, the logic jumps to the error path which dereferences -the pointer. - -This results in a warnings reported by the static analyzer Smatch when -executed without a database: - - drivers/crypto/intel/qat/qat_common/adf_rl.c:871 add_update_sla() - error: we previously assumed 'sla_in' could be null (see line 812) - -This issue was not found in internal testing as the pointer cannot be -NULL. The function add_update_sla() is only called (indirectly) by -the rate limiting sysfs interface implementation in adf_sysfs_rl.c -which ensures that the data structure is allocated and valid. This is -also proven by the fact that Smatch executed with a database does not -report such error. - -Fix it by returning with error if the pointer `sla_in` is NULL. - -Fixes: d9fb8408376e ("crypto: qat - add rate limiting feature to qat_4xxx") -Reported-by: Dan Carpenter <dan.carpenter@linaro.org> -Signed-off-by: Damian Muszynski <damian.muszynski@intel.com> -Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/intel/qat/qat_common/adf_rl.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/drivers/crypto/intel/qat/qat_common/adf_rl.c b/drivers/crypto/intel/qat/qat_common/adf_rl.c -index 86e3e2152b1b..f2de3cd7d05d 100644 ---- a/drivers/crypto/intel/qat/qat_common/adf_rl.c -+++ b/drivers/crypto/intel/qat/qat_common/adf_rl.c -@@ -812,8 +812,7 @@ static int add_update_sla(struct adf_accel_dev *accel_dev, - if (!sla_in) { - dev_warn(&GET_DEV(accel_dev), - "SLA input data pointer is missing\n"); -- ret = -EFAULT; -- goto ret_err; -+ return -EFAULT; - } - - /* Input validation */ --- -2.43.2 - -From c25825e9a29c0f09cf6b23965cedfc24826ea75e Mon Sep 17 00:00:00 2001 -From: Damian Muszynski <damian.muszynski@intel.com> -Date: Tue, 28 Nov 2023 18:39:30 +0100 -Subject: [PATCH 0082/1501] crypto: qat - fix mutex ordering in adf_rl -Content-Length: 1326 -Lines: 38 - -[ Upstream commit 487caa8d5ef9a9a27b092c5790d529a7a0c24f8b ] - -If the function validate_user_input() returns an error, the error path -attempts to unlock an unacquired mutex. -Acquire the mutex before calling validate_user_input(). This is not -strictly necessary but simplifies the code. - -Fixes: d9fb8408376e ("crypto: qat - add rate limiting feature to qat_4xxx") -Signed-off-by: Damian Muszynski <damian.muszynski@intel.com> -Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/intel/qat/qat_common/adf_rl.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/crypto/intel/qat/qat_common/adf_rl.c b/drivers/crypto/intel/qat/qat_common/adf_rl.c -index f2de3cd7d05d..de1b214dba1f 100644 ---- a/drivers/crypto/intel/qat/qat_common/adf_rl.c -+++ b/drivers/crypto/intel/qat/qat_common/adf_rl.c -@@ -815,13 +815,13 @@ static int add_update_sla(struct adf_accel_dev *accel_dev, - return -EFAULT; - } - -+ mutex_lock(&rl_data->rl_lock); -+ - /* Input validation */ - ret = validate_user_input(accel_dev, sla_in, is_update); - if (ret) - goto ret_err; - -- mutex_lock(&rl_data->rl_lock); -- - if (is_update) { - ret = validate_sla_id(accel_dev, sla_in->sla_id); - if (ret) --- -2.43.2 - -From 5f7c93ad2dcb40542b2ca4d5768d2591fc71bf89 Mon Sep 17 00:00:00 2001 -From: Giovanni Cabiddu <giovanni.cabiddu@intel.com> -Date: Tue, 28 Nov 2023 19:17:25 +0000 -Subject: [PATCH 0083/1501] crypto: qat - add NULL pointer check -Content-Length: 1234 -Lines: 32 - -[ Upstream commit a643212c9f28d09225c3792c316bc4aaf6be4a68 ] - -There is a possibility that the function adf_devmgr_pci_to_accel_dev() -might return a NULL pointer. -Add a NULL pointer check in the function rp2srv_show(). - -Fixes: dbc8876dd873 ("crypto: qat - add rp2svc sysfs attribute") -Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> -Reviewed-by: Ahsan Atta <ahsan.atta@intel.com> -Reviewed-by: David Guckian <david.guckian@intel.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/intel/qat/qat_common/adf_sysfs.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/crypto/intel/qat/qat_common/adf_sysfs.c b/drivers/crypto/intel/qat/qat_common/adf_sysfs.c -index 6f0b3629da13..d450dad32c9e 100644 ---- a/drivers/crypto/intel/qat/qat_common/adf_sysfs.c -+++ b/drivers/crypto/intel/qat/qat_common/adf_sysfs.c -@@ -215,6 +215,9 @@ static ssize_t rp2srv_show(struct device *dev, struct device_attribute *attr, - enum adf_cfg_service_type svc; - - accel_dev = adf_devmgr_pci_to_accel_dev(to_pci_dev(dev)); -+ if (!accel_dev) -+ return -EINVAL; -+ - hw_data = GET_HW_DATA(accel_dev); - - if (accel_dev->sysfs.ring_num == UNSET_RING_NUM) --- -2.43.2 - -From 5a251bc44e3789bd5cef5f5cd3007fec27de6164 Mon Sep 17 00:00:00 2001 -From: Yang Yingliang <yangyingliang@huawei.com> -Date: Fri, 1 Dec 2023 16:20:48 +0800 -Subject: [PATCH 0084/1501] hwrng: stm32 - add missing clk_disable_unprepare() - in stm32_rng_init() -Content-Length: 997 -Lines: 27 - -[ Upstream commit 429fec81d12266e6402868672de8c68bf4d8db13 ] - -Add clk_disable_unprepare() in the error path in stm32_rng_init(). - -Fixes: 6b85a7e141cb ("hwrng: stm32 - implement STM32MP13x support") -Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> -Reviewed-by: Gatien Chevallier <gatien.chevallier@foss.st.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/char/hw_random/stm32-rng.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/char/hw_random/stm32-rng.c b/drivers/char/hw_random/stm32-rng.c -index 41e1dbea5d2e..efd6edcd7066 100644 ---- a/drivers/char/hw_random/stm32-rng.c -+++ b/drivers/char/hw_random/stm32-rng.c -@@ -325,6 +325,7 @@ static int stm32_rng_init(struct hwrng *rng) - (!(reg & RNG_CR_CONDRST)), - 10, 50000); - if (err) { -+ clk_disable_unprepare(priv->clk); - dev_err((struct device *)priv->rng.priv, - "%s: timeout %x!\n", __func__, reg); - return -EINVAL; --- -2.43.2 - -From fc0b785802b856566df3ac943e38a072557001c4 Mon Sep 17 00:00:00 2001 -From: Nikita Zhandarovich <n.zhandarovich@fintech.ru> -Date: Fri, 1 Dec 2023 04:49:29 -0800 -Subject: [PATCH 0085/1501] crypto: safexcel - Add error handling for - dma_map_sg() calls -Content-Length: 2363 -Lines: 64 - -[ Upstream commit 87e02063d07708cac5bfe9fd3a6a242898758ac8 ] - -Macro dma_map_sg() may return 0 on error. This patch enables -checks in case of the macro failure and ensures unmapping of -previously mapped buffers with dma_unmap_sg(). - -Found by Linux Verification Center (linuxtesting.org) with static -analysis tool SVACE. - -Fixes: 49186a7d9e46 ("crypto: inside_secure - Avoid dma map if size is zero") -Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru> -Reviewed-by: Antoine Tenart <atenart@kernel.org> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../crypto/inside-secure/safexcel_cipher.c | 19 +++++++++++-------- - 1 file changed, 11 insertions(+), 8 deletions(-) - -diff --git a/drivers/crypto/inside-secure/safexcel_cipher.c b/drivers/crypto/inside-secure/safexcel_cipher.c -index 272c28b5a088..b83818634ae4 100644 ---- a/drivers/crypto/inside-secure/safexcel_cipher.c -+++ b/drivers/crypto/inside-secure/safexcel_cipher.c -@@ -742,9 +742,9 @@ static int safexcel_send_req(struct crypto_async_request *base, int ring, - max(totlen_src, totlen_dst)); - return -EINVAL; - } -- if (sreq->nr_src > 0) -- dma_map_sg(priv->dev, src, sreq->nr_src, -- DMA_BIDIRECTIONAL); -+ if (sreq->nr_src > 0 && -+ !dma_map_sg(priv->dev, src, sreq->nr_src, DMA_BIDIRECTIONAL)) -+ return -EIO; - } else { - if (unlikely(totlen_src && (sreq->nr_src <= 0))) { - dev_err(priv->dev, "Source buffer not large enough (need %d bytes)!", -@@ -752,8 +752,9 @@ static int safexcel_send_req(struct crypto_async_request *base, int ring, - return -EINVAL; - } - -- if (sreq->nr_src > 0) -- dma_map_sg(priv->dev, src, sreq->nr_src, DMA_TO_DEVICE); -+ if (sreq->nr_src > 0 && -+ !dma_map_sg(priv->dev, src, sreq->nr_src, DMA_TO_DEVICE)) -+ return -EIO; - - if (unlikely(totlen_dst && (sreq->nr_dst <= 0))) { - dev_err(priv->dev, "Dest buffer not large enough (need %d bytes)!", -@@ -762,9 +763,11 @@ static int safexcel_send_req(struct crypto_async_request *base, int ring, - goto unmap; - } - -- if (sreq->nr_dst > 0) -- dma_map_sg(priv->dev, dst, sreq->nr_dst, -- DMA_FROM_DEVICE); -+ if (sreq->nr_dst > 0 && -+ !dma_map_sg(priv->dev, dst, sreq->nr_dst, DMA_FROM_DEVICE)) { -+ ret = -EIO; -+ goto unmap; -+ } - } - - memcpy(ctx->base.ctxr->data, ctx->key, ctx->key_len); --- -2.43.2 - -From ef6a7a3797ebc18e495bb3ae851e0ac10af21674 Mon Sep 17 00:00:00 2001 -From: Ovidiu Panait <ovidiu.panait@windriver.com> -Date: Fri, 1 Dec 2023 19:06:19 +0200 -Subject: [PATCH 0086/1501] crypto: sahara - remove FLAGS_NEW_KEY logic -Content-Length: 3011 -Lines: 98 - -[ Upstream commit 8fd183435728b139248a77978ea3732039341779 ] - -Remove the FLAGS_NEW_KEY logic as it has the following issues: -- the wrong key may end up being used when there are multiple data streams: - t1 t2 - setkey() - encrypt() - setkey() - encrypt() - - encrypt() <--- key from t2 is used -- switching between encryption and decryption with the same key is not - possible, as the hdr flags are only updated when a new setkey() is - performed - -With this change, the key is always sent along with the cryptdata when -performing encryption/decryption operations. - -Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.") -Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/sahara.c | 36 ++++++++++++++---------------------- - 1 file changed, 14 insertions(+), 22 deletions(-) - -diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c -index 02065131c300..5cc1cd59a384 100644 ---- a/drivers/crypto/sahara.c -+++ b/drivers/crypto/sahara.c -@@ -43,7 +43,6 @@ - #define FLAGS_MODE_MASK 0x000f - #define FLAGS_ENCRYPT BIT(0) - #define FLAGS_CBC BIT(1) --#define FLAGS_NEW_KEY BIT(3) - - #define SAHARA_HDR_BASE 0x00800000 - #define SAHARA_HDR_SKHA_ALG_AES 0 -@@ -141,8 +140,6 @@ struct sahara_hw_link { - }; - - struct sahara_ctx { -- unsigned long flags; -- - /* AES-specific context */ - int keylen; - u8 key[AES_KEYSIZE_128]; -@@ -447,26 +444,22 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev) - int i, j; - int idx = 0; - -- /* Copy new key if necessary */ -- if (ctx->flags & FLAGS_NEW_KEY) { -- memcpy(dev->key_base, ctx->key, ctx->keylen); -- ctx->flags &= ~FLAGS_NEW_KEY; -+ memcpy(dev->key_base, ctx->key, ctx->keylen); - -- if (dev->flags & FLAGS_CBC) { -- dev->hw_desc[idx]->len1 = AES_BLOCK_SIZE; -- dev->hw_desc[idx]->p1 = dev->iv_phys_base; -- } else { -- dev->hw_desc[idx]->len1 = 0; -- dev->hw_desc[idx]->p1 = 0; -- } -- dev->hw_desc[idx]->len2 = ctx->keylen; -- dev->hw_desc[idx]->p2 = dev->key_phys_base; -- dev->hw_desc[idx]->next = dev->hw_phys_desc[1]; -- -- dev->hw_desc[idx]->hdr = sahara_aes_key_hdr(dev); -- -- idx++; -+ if (dev->flags & FLAGS_CBC) { -+ dev->hw_desc[idx]->len1 = AES_BLOCK_SIZE; -+ dev->hw_desc[idx]->p1 = dev->iv_phys_base; -+ } else { -+ dev->hw_desc[idx]->len1 = 0; -+ dev->hw_desc[idx]->p1 = 0; - } -+ dev->hw_desc[idx]->len2 = ctx->keylen; -+ dev->hw_desc[idx]->p2 = dev->key_phys_base; -+ dev->hw_desc[idx]->next = dev->hw_phys_desc[1]; -+ dev->hw_desc[idx]->hdr = sahara_aes_key_hdr(dev); -+ -+ idx++; -+ - - dev->nb_in_sg = sg_nents_for_len(dev->in_sg, dev->total); - if (dev->nb_in_sg < 0) { -@@ -608,7 +601,6 @@ static int sahara_aes_setkey(struct crypto_skcipher *tfm, const u8 *key, - /* SAHARA only supports 128bit keys */ - if (keylen == AES_KEYSIZE_128) { - memcpy(ctx->key, key, keylen); -- ctx->flags |= FLAGS_NEW_KEY; - return 0; - } - --- -2.43.2 - -From c38666981ec67b9cca22c6a1fe4c932e5ba2da7a Mon Sep 17 00:00:00 2001 -From: Ovidiu Panait <ovidiu.panait@windriver.com> -Date: Fri, 1 Dec 2023 19:06:20 +0200 -Subject: [PATCH 0087/1501] crypto: sahara - fix cbc selftest failure -Content-Length: 2814 -Lines: 86 - -[ Upstream commit 9f10bc28c0fb676ae58aa3bfa358db8f5de124bb ] - -The kernel crypto API requires that all CBC implementations update the IV -buffer to contain the last ciphertext block. - -This fixes the following cbc selftest error: -alg: skcipher: sahara-cbc-aes encryption test failed (wrong output IV) on -test vector 0, cfg="in-place (one sglist)" - -Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.") -Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/sahara.c | 33 +++++++++++++++++++++++++++++++-- - 1 file changed, 31 insertions(+), 2 deletions(-) - -diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c -index 5cc1cd59a384..888e5e5157bb 100644 ---- a/drivers/crypto/sahara.c -+++ b/drivers/crypto/sahara.c -@@ -148,6 +148,7 @@ struct sahara_ctx { - - struct sahara_aes_reqctx { - unsigned long mode; -+ u8 iv_out[AES_BLOCK_SIZE]; - struct skcipher_request fallback_req; // keep at the end - }; - -@@ -541,8 +542,24 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev) - return -EINVAL; - } - -+static void sahara_aes_cbc_update_iv(struct skcipher_request *req) -+{ -+ struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req); -+ struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); -+ unsigned int ivsize = crypto_skcipher_ivsize(skcipher); -+ -+ /* Update IV buffer to contain the last ciphertext block */ -+ if (rctx->mode & FLAGS_ENCRYPT) { -+ sg_pcopy_to_buffer(req->dst, sg_nents(req->dst), req->iv, -+ ivsize, req->cryptlen - ivsize); -+ } else { -+ memcpy(req->iv, rctx->iv_out, ivsize); -+ } -+} -+ - static int sahara_aes_process(struct skcipher_request *req) - { -+ struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req); - struct sahara_dev *dev = dev_ptr; - struct sahara_ctx *ctx; - struct sahara_aes_reqctx *rctx; -@@ -564,8 +581,17 @@ static int sahara_aes_process(struct skcipher_request *req) - rctx->mode &= FLAGS_MODE_MASK; - dev->flags = (dev->flags & ~FLAGS_MODE_MASK) | rctx->mode; - -- if ((dev->flags & FLAGS_CBC) && req->iv) -- memcpy(dev->iv_base, req->iv, AES_KEYSIZE_128); -+ if ((dev->flags & FLAGS_CBC) && req->iv) { -+ unsigned int ivsize = crypto_skcipher_ivsize(skcipher); -+ -+ memcpy(dev->iv_base, req->iv, ivsize); -+ -+ if (!(dev->flags & FLAGS_ENCRYPT)) { -+ sg_pcopy_to_buffer(req->src, sg_nents(req->src), -+ rctx->iv_out, ivsize, -+ req->cryptlen - ivsize); -+ } -+ } - - /* assign new context to device */ - dev->ctx = ctx; -@@ -588,6 +614,9 @@ static int sahara_aes_process(struct skcipher_request *req) - dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg, - DMA_TO_DEVICE); - -+ if ((dev->flags & FLAGS_CBC) && req->iv) -+ sahara_aes_cbc_update_iv(req); -+ - return 0; - } - --- -2.43.2 - -From 09bcb95ea82d96422892e37561bfce3b72d53b1d Mon Sep 17 00:00:00 2001 -From: Ovidiu Panait <ovidiu.panait@windriver.com> -Date: Fri, 1 Dec 2023 19:06:21 +0200 -Subject: [PATCH 0088/1501] crypto: sahara - fix ahash selftest failure -Content-Length: 1137 -Lines: 33 - -[ Upstream commit afffcf3db98b9495114b79d5381f8cc3f69476fb ] - -update() calls should not modify the result buffer, so add an additional -check for "rctx->last" to make sure that only the final hash value is -copied into the buffer. - -Fixes the following selftest failure: -alg: ahash: sahara-sha256 update() used result buffer on test vector 3, -cfg="init+update+final aligned buffer" - -Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256") -Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/sahara.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c -index 888e5e5157bb..863171b44cda 100644 ---- a/drivers/crypto/sahara.c -+++ b/drivers/crypto/sahara.c -@@ -1047,7 +1047,7 @@ static int sahara_sha_process(struct ahash_request *req) - - memcpy(rctx->context, dev->context_base, rctx->context_size); - -- if (req->result) -+ if (req->result && rctx->last) - memcpy(req->result, rctx->context, rctx->digest_size); - - return 0; --- -2.43.2 - -From a0813feca172a6ca74e35826709c47f09188014a Mon Sep 17 00:00:00 2001 -From: Ovidiu Panait <ovidiu.panait@windriver.com> -Date: Fri, 1 Dec 2023 19:06:22 +0200 -Subject: [PATCH 0089/1501] crypto: sahara - fix processing requests with - cryptlen < sg->length -Content-Length: 2221 -Lines: 64 - -[ Upstream commit 5b8668ce3452827d27f8c34ff6ba080a8f983ed0 ] - -It's not always the case that the entire sg entry needs to be processed. -Currently, when cryptlen is less than sg->legth, "Descriptor length" errors -are encountered. - -The error was noticed when testing xts(sahara-ecb-aes) with arbitrary sized -input data. To fix this, take the actual request size into account when -populating the hw links. - -Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.") -Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/sahara.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - -diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c -index 863171b44cda..cbb7153e4162 100644 ---- a/drivers/crypto/sahara.c -+++ b/drivers/crypto/sahara.c -@@ -444,6 +444,7 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev) - int ret; - int i, j; - int idx = 0; -+ u32 len; - - memcpy(dev->key_base, ctx->key, ctx->keylen); - -@@ -494,12 +495,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev) - /* Create input links */ - dev->hw_desc[idx]->p1 = dev->hw_phys_link[0]; - sg = dev->in_sg; -+ len = dev->total; - for (i = 0; i < dev->nb_in_sg; i++) { -- dev->hw_link[i]->len = sg->length; -+ dev->hw_link[i]->len = min(len, sg->length); - dev->hw_link[i]->p = sg->dma_address; - if (i == (dev->nb_in_sg - 1)) { - dev->hw_link[i]->next = 0; - } else { -+ len -= min(len, sg->length); - dev->hw_link[i]->next = dev->hw_phys_link[i + 1]; - sg = sg_next(sg); - } -@@ -508,12 +511,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev) - /* Create output links */ - dev->hw_desc[idx]->p2 = dev->hw_phys_link[i]; - sg = dev->out_sg; -+ len = dev->total; - for (j = i; j < dev->nb_out_sg + i; j++) { -- dev->hw_link[j]->len = sg->length; -+ dev->hw_link[j]->len = min(len, sg->length); - dev->hw_link[j]->p = sg->dma_address; - if (j == (dev->nb_out_sg + i - 1)) { - dev->hw_link[j]->next = 0; - } else { -+ len -= min(len, sg->length); - dev->hw_link[j]->next = dev->hw_phys_link[j + 1]; - sg = sg_next(sg); - } --- -2.43.2 - -From 5d50a76d463aa5a2b2c357ebdc61b77c14a9429d Mon Sep 17 00:00:00 2001 -From: Ovidiu Panait <ovidiu.panait@windriver.com> -Date: Fri, 1 Dec 2023 19:06:23 +0200 -Subject: [PATCH 0090/1501] crypto: sahara - fix error handling in - sahara_hw_descriptor_create() -Content-Length: 1351 -Lines: 46 - -[ Upstream commit ee6e6f0a7f5b39d50a5ef5fcc006f4f693db18a7 ] - -Do not call dma_unmap_sg() for scatterlists that were not mapped -successfully. - -Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.") -Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/sahara.c | 8 +++----- - 1 file changed, 3 insertions(+), 5 deletions(-) - -diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c -index cbb7153e4162..c4eb66d2e08d 100644 ---- a/drivers/crypto/sahara.c -+++ b/drivers/crypto/sahara.c -@@ -483,13 +483,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev) - DMA_TO_DEVICE); - if (!ret) { - dev_err(dev->device, "couldn't map in sg\n"); -- goto unmap_in; -+ return -EINVAL; - } -+ - ret = dma_map_sg(dev->device, dev->out_sg, dev->nb_out_sg, - DMA_FROM_DEVICE); - if (!ret) { - dev_err(dev->device, "couldn't map out sg\n"); -- goto unmap_out; -+ goto unmap_in; - } - - /* Create input links */ -@@ -537,9 +538,6 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev) - - return 0; - --unmap_out: -- dma_unmap_sg(dev->device, dev->out_sg, dev->nb_out_sg, -- DMA_FROM_DEVICE); - unmap_in: - dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg, - DMA_TO_DEVICE); --- -2.43.2 - -From 2736b0641f930d91d50aba3faee2d5cd0bd9ba24 Mon Sep 17 00:00:00 2001 -From: Zhiqi Song <songzhiqi1@huawei.com> -Date: Sat, 2 Dec 2023 17:17:19 +0800 -Subject: [PATCH 0091/1501] crypto: hisilicon/qm - save capability registers in - qm init process -Content-Length: 8529 -Lines: 249 - -[ Upstream commit cabe13d0bd2efb8dd50ed2310f57b33e1a69a0d4 ] - -In previous capability register implementation, qm irq related values -were read from capability registers dynamically when needed. But in -abnormal scenario, e.g. the core is timeout and the device needs to -soft reset and reset failed after disabling the MSE, the device can -not be removed normally, causing the following call trace: - - | Call trace: - | pci_irq_vector+0xfc/0x140 - | hisi_qm_uninit+0x278/0x3b0 [hisi_qm] - | hpre_remove+0x16c/0x1c0 [hisi_hpre] - | pci_device_remove+0x6c/0x264 - | device_release_driver_internal+0x1ec/0x3e0 - | device_release_driver+0x3c/0x60 - | pci_stop_bus_device+0xfc/0x22c - | pci_stop_and_remove_bus_device+0x38/0x70 - | pci_iov_remove_virtfn+0x108/0x1c0 - | sriov_disable+0x7c/0x1e4 - | pci_disable_sriov+0x4c/0x6c - | hisi_qm_sriov_disable+0x90/0x160 [hisi_qm] - | hpre_remove+0x1a8/0x1c0 [hisi_hpre] - | pci_device_remove+0x6c/0x264 - | device_release_driver_internal+0x1ec/0x3e0 - | driver_detach+0x168/0x2d0 - | bus_remove_driver+0xc0/0x230 - | driver_unregister+0x58/0xdc - | pci_unregister_driver+0x40/0x220 - | hpre_exit+0x34/0x64 [hisi_hpre] - | __arm64_sys_delete_module+0x374/0x620 - [...] - - | Call trace: - | free_msi_irqs+0x25c/0x300 - | pci_disable_msi+0x19c/0x264 - | pci_free_irq_vectors+0x4c/0x70 - | hisi_qm_pci_uninit+0x44/0x90 [hisi_qm] - | hisi_qm_uninit+0x28c/0x3b0 [hisi_qm] - | hpre_remove+0x16c/0x1c0 [hisi_hpre] - | pci_device_remove+0x6c/0x264 - [...] - -The reason for this call trace is that when the MSE is disabled, the value -of capability registers in the BAR space become invalid. This will make the -subsequent unregister process get the wrong irq vector through capability -registers and get the wrong irq number by pci_irq_vector(). - -So add a capability table structure to pre-store the valid value of the irq -information capability register in qm init process, avoid obtaining invalid -capability register value after the MSE is disabled. - -Fixes: 3536cc55cada ("crypto: hisilicon/qm - support get device irq information from hardware registers") -Signed-off-by: Zhiqi Song <songzhiqi1@huawei.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/hisilicon/qm.c | 62 +++++++++++++++++++++++++++++------ - include/linux/hisi_acc_qm.h | 12 +++++++ - 2 files changed, 64 insertions(+), 10 deletions(-) - -diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c -index 18599f3634c3..30b43006d1db 100644 ---- a/drivers/crypto/hisilicon/qm.c -+++ b/drivers/crypto/hisilicon/qm.c -@@ -294,6 +294,13 @@ enum qm_basic_type { - QM_VF_IRQ_NUM_CAP, - }; - -+enum qm_pre_store_cap_idx { -+ QM_EQ_IRQ_TYPE_CAP_IDX = 0x0, -+ QM_AEQ_IRQ_TYPE_CAP_IDX, -+ QM_ABN_IRQ_TYPE_CAP_IDX, -+ QM_PF2VF_IRQ_TYPE_CAP_IDX, -+}; -+ - static const struct hisi_qm_cap_info qm_cap_info_comm[] = { - {QM_SUPPORT_DB_ISOLATION, 0x30, 0, BIT(0), 0x0, 0x0, 0x0}, - {QM_SUPPORT_FUNC_QOS, 0x3100, 0, BIT(8), 0x0, 0x0, 0x1}, -@@ -323,6 +330,13 @@ static const struct hisi_qm_cap_info qm_basic_info[] = { - {QM_VF_IRQ_NUM_CAP, 0x311c, 0, GENMASK(15, 0), 0x1, 0x2, 0x3}, - }; - -+static const u32 qm_pre_store_caps[] = { -+ QM_EQ_IRQ_TYPE_CAP, -+ QM_AEQ_IRQ_TYPE_CAP, -+ QM_ABN_IRQ_TYPE_CAP, -+ QM_PF2VF_IRQ_TYPE_CAP, -+}; -+ - struct qm_mailbox { - __le16 w0; - __le16 queue_num; -@@ -4816,7 +4830,7 @@ static void qm_unregister_abnormal_irq(struct hisi_qm *qm) - if (qm->fun_type == QM_HW_VF) - return; - -- val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_ABN_IRQ_TYPE_CAP, qm->cap_ver); -+ val = qm->cap_tables.qm_cap_table[QM_ABN_IRQ_TYPE_CAP_IDX].cap_val; - if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_ABN_IRQ_TYPE_MASK)) - return; - -@@ -4833,7 +4847,7 @@ static int qm_register_abnormal_irq(struct hisi_qm *qm) - if (qm->fun_type == QM_HW_VF) - return 0; - -- val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_ABN_IRQ_TYPE_CAP, qm->cap_ver); -+ val = qm->cap_tables.qm_cap_table[QM_ABN_IRQ_TYPE_CAP_IDX].cap_val; - if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_ABN_IRQ_TYPE_MASK)) - return 0; - -@@ -4850,7 +4864,7 @@ static void qm_unregister_mb_cmd_irq(struct hisi_qm *qm) - struct pci_dev *pdev = qm->pdev; - u32 irq_vector, val; - -- val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_PF2VF_IRQ_TYPE_CAP, qm->cap_ver); -+ val = qm->cap_tables.qm_cap_table[QM_PF2VF_IRQ_TYPE_CAP_IDX].cap_val; - if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK)) - return; - -@@ -4864,7 +4878,7 @@ static int qm_register_mb_cmd_irq(struct hisi_qm *qm) - u32 irq_vector, val; - int ret; - -- val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_PF2VF_IRQ_TYPE_CAP, qm->cap_ver); -+ val = qm->cap_tables.qm_cap_table[QM_PF2VF_IRQ_TYPE_CAP_IDX].cap_val; - if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK)) - return 0; - -@@ -4881,7 +4895,7 @@ static void qm_unregister_aeq_irq(struct hisi_qm *qm) - struct pci_dev *pdev = qm->pdev; - u32 irq_vector, val; - -- val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_AEQ_IRQ_TYPE_CAP, qm->cap_ver); -+ val = qm->cap_tables.qm_cap_table[QM_AEQ_IRQ_TYPE_CAP_IDX].cap_val; - if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK)) - return; - -@@ -4895,7 +4909,7 @@ static int qm_register_aeq_irq(struct hisi_qm *qm) - u32 irq_vector, val; - int ret; - -- val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_AEQ_IRQ_TYPE_CAP, qm->cap_ver); -+ val = qm->cap_tables.qm_cap_table[QM_AEQ_IRQ_TYPE_CAP_IDX].cap_val; - if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK)) - return 0; - -@@ -4913,7 +4927,7 @@ static void qm_unregister_eq_irq(struct hisi_qm *qm) - struct pci_dev *pdev = qm->pdev; - u32 irq_vector, val; - -- val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_EQ_IRQ_TYPE_CAP, qm->cap_ver); -+ val = qm->cap_tables.qm_cap_table[QM_EQ_IRQ_TYPE_CAP_IDX].cap_val; - if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK)) - return; - -@@ -4927,7 +4941,7 @@ static int qm_register_eq_irq(struct hisi_qm *qm) - u32 irq_vector, val; - int ret; - -- val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_EQ_IRQ_TYPE_CAP, qm->cap_ver); -+ val = qm->cap_tables.qm_cap_table[QM_EQ_IRQ_TYPE_CAP_IDX].cap_val; - if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK)) - return 0; - -@@ -5015,7 +5029,29 @@ static int qm_get_qp_num(struct hisi_qm *qm) - return 0; - } - --static void qm_get_hw_caps(struct hisi_qm *qm) -+static int qm_pre_store_irq_type_caps(struct hisi_qm *qm) -+{ -+ struct hisi_qm_cap_record *qm_cap; -+ struct pci_dev *pdev = qm->pdev; -+ size_t i, size; -+ -+ size = ARRAY_SIZE(qm_pre_store_caps); -+ qm_cap = devm_kzalloc(&pdev->dev, sizeof(*qm_cap) * size, GFP_KERNEL); -+ if (!qm_cap) -+ return -ENOMEM; -+ -+ for (i = 0; i < size; i++) { -+ qm_cap[i].type = qm_pre_store_caps[i]; -+ qm_cap[i].cap_val = hisi_qm_get_hw_info(qm, qm_basic_info, -+ qm_pre_store_caps[i], qm->cap_ver); -+ } -+ -+ qm->cap_tables.qm_cap_table = qm_cap; -+ -+ return 0; -+} -+ -+static int qm_get_hw_caps(struct hisi_qm *qm) - { - const struct hisi_qm_cap_info *cap_info = qm->fun_type == QM_HW_PF ? - qm_cap_info_pf : qm_cap_info_vf; -@@ -5046,6 +5082,9 @@ static void qm_get_hw_caps(struct hisi_qm *qm) - if (val) - set_bit(cap_info[i].type, &qm->caps); - } -+ -+ /* Fetch and save the value of irq type related capability registers */ -+ return qm_pre_store_irq_type_caps(qm); - } - - static int qm_get_pci_res(struct hisi_qm *qm) -@@ -5067,7 +5106,10 @@ static int qm_get_pci_res(struct hisi_qm *qm) - goto err_request_mem_regions; - } - -- qm_get_hw_caps(qm); -+ ret = qm_get_hw_caps(qm); -+ if (ret) -+ goto err_ioremap; -+ - if (test_bit(QM_SUPPORT_DB_ISOLATION, &qm->caps)) { - qm->db_interval = QM_QP_DB_INTERVAL; - qm->db_phys_base = pci_resource_start(pdev, PCI_BAR_4); -diff --git a/include/linux/hisi_acc_qm.h b/include/linux/hisi_acc_qm.h -index ddc7ebb70523..b8da977711a7 100644 ---- a/include/linux/hisi_acc_qm.h -+++ b/include/linux/hisi_acc_qm.h -@@ -265,6 +265,16 @@ struct hisi_qm_cap_info { - u32 v3_val; - }; - -+struct hisi_qm_cap_record { -+ u32 type; -+ u32 cap_val; -+}; -+ -+struct hisi_qm_cap_tables { -+ struct hisi_qm_cap_record *qm_cap_table; -+ struct hisi_qm_cap_record *dev_cap_table; -+}; -+ - struct hisi_qm_list { - struct mutex lock; - struct list_head list; -@@ -376,6 +386,8 @@ struct hisi_qm { - u32 mb_qos; - u32 type_rate; - struct qm_err_isolate isolate_data; -+ -+ struct hisi_qm_cap_tables cap_tables; - }; - - struct hisi_qp_status { --- -2.43.2 - -From 615245a08f04c8d3c7a8bcf22aff55166b8bca4d Mon Sep 17 00:00:00 2001 -From: Chenghai Huang <huangchenghai2@huawei.com> -Date: Fri, 24 Nov 2023 13:49:24 +0800 -Subject: [PATCH 0092/1501] crypto: hisilicon/zip - add zip comp high perf mode - configuration -Content-Length: 3479 -Lines: 117 - -[ Upstream commit a9864bae1806499ebf3757a9e71dddde5b9c48c6 ] - -To meet specific application scenarios, the function of switching between -the high performance mode and the high compression mode is added. - -Use the perf_mode=0/1 configuration to set the compression high perf mode, -0(default, high compression mode), 1(high performance mode). These two -modes only apply to the compression direction and are compatible with -software algorithm in both directions. - -Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Stable-dep-of: cf8b5156bbc8 ("crypto: hisilicon/hpre - save capability registers in probe process") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/hisilicon/zip/zip_main.c | 65 +++++++++++++++++++++++++ - 1 file changed, 65 insertions(+) - -diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c -index db4c964cd649..85576f818278 100644 ---- a/drivers/crypto/hisilicon/zip/zip_main.c -+++ b/drivers/crypto/hisilicon/zip/zip_main.c -@@ -107,6 +107,14 @@ - #define HZIP_CLOCK_GATED_EN (HZIP_CORE_GATED_EN | \ - HZIP_CORE_GATED_OOO_EN) - -+/* zip comp high performance */ -+#define HZIP_HIGH_PERF_OFFSET 0x301208 -+ -+enum { -+ HZIP_HIGH_COMP_RATE, -+ HZIP_HIGH_COMP_PERF, -+}; -+ - static const char hisi_zip_name[] = "hisi_zip"; - static struct dentry *hzip_debugfs_root; - -@@ -352,6 +360,37 @@ static int hzip_diff_regs_show(struct seq_file *s, void *unused) - return 0; - } - DEFINE_SHOW_ATTRIBUTE(hzip_diff_regs); -+ -+static int perf_mode_set(const char *val, const struct kernel_param *kp) -+{ -+ int ret; -+ u32 n; -+ -+ if (!val) -+ return -EINVAL; -+ -+ ret = kstrtou32(val, 10, &n); -+ if (ret != 0 || (n != HZIP_HIGH_COMP_PERF && -+ n != HZIP_HIGH_COMP_RATE)) -+ return -EINVAL; -+ -+ return param_set_int(val, kp); -+} -+ -+static const struct kernel_param_ops zip_com_perf_ops = { -+ .set = perf_mode_set, -+ .get = param_get_int, -+}; -+ -+/* -+ * perf_mode = 0 means enable high compression rate mode, -+ * perf_mode = 1 means enable high compression performance mode. -+ * These two modes only apply to the compression direction. -+ */ -+static u32 perf_mode = HZIP_HIGH_COMP_RATE; -+module_param_cb(perf_mode, &zip_com_perf_ops, &perf_mode, 0444); -+MODULE_PARM_DESC(perf_mode, "ZIP high perf mode 0(default), 1(enable)"); -+ - static const struct kernel_param_ops zip_uacce_mode_ops = { - .set = uacce_mode_set, - .get = param_get_int, -@@ -417,6 +456,28 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg) - return false; - } - -+static int hisi_zip_set_high_perf(struct hisi_qm *qm) -+{ -+ u32 val; -+ int ret; -+ -+ val = readl_relaxed(qm->io_base + HZIP_HIGH_PERF_OFFSET); -+ if (perf_mode == HZIP_HIGH_COMP_PERF) -+ val |= HZIP_HIGH_COMP_PERF; -+ else -+ val &= ~HZIP_HIGH_COMP_PERF; -+ -+ /* Set perf mode */ -+ writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET); -+ ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_HIGH_PERF_OFFSET, -+ val, val == perf_mode, HZIP_DELAY_1_US, -+ HZIP_POLL_TIMEOUT_US); -+ if (ret) -+ pci_err(qm->pdev, "failed to set perf mode\n"); -+ -+ return ret; -+} -+ - static int hisi_zip_set_qm_algs(struct hisi_qm *qm) - { - struct device *dev = &qm->pdev->dev; -@@ -1115,6 +1176,10 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip) - if (ret) - return ret; - -+ ret = hisi_zip_set_high_perf(qm); -+ if (ret) -+ return ret; -+ - hisi_zip_open_sva_prefetch(qm); - hisi_qm_dev_err_init(qm); - hisi_zip_debug_regs_clear(qm); --- -2.43.2 - -From b83aae9e22a32d9095149919ccdbbb01c99bc34d Mon Sep 17 00:00:00 2001 -From: Wenkai Lin <linwenkai6@hisilicon.com> -Date: Sat, 2 Dec 2023 17:17:18 +0800 -Subject: [PATCH 0093/1501] crypto: hisilicon/qm - add a function to set qm - algs -Content-Length: 10405 -Lines: 377 - -[ Upstream commit f76f0d7f20672611974d3cc705996751fc403734 ] - -Extract a public function to set qm algs and remove -the similar code for setting qm algs in each module. - -Signed-off-by: Wenkai Lin <linwenkai6@hisilicon.com> -Signed-off-by: Hao Fang <fanghao11@huawei.com> -Signed-off-by: Zhiqi Song <songzhiqi1@huawei.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Stable-dep-of: cf8b5156bbc8 ("crypto: hisilicon/hpre - save capability registers in probe process") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/hisilicon/hpre/hpre_main.c | 42 ++----------------- - drivers/crypto/hisilicon/qm.c | 36 +++++++++++++++++ - drivers/crypto/hisilicon/sec2/sec_main.c | 47 ++++------------------ - drivers/crypto/hisilicon/zip/zip_main.c | 49 ++++------------------- - include/linux/hisi_acc_qm.h | 8 +++- - 5 files changed, 62 insertions(+), 120 deletions(-) - -diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c -index 56777099ef69..84c92d85d23d 100644 ---- a/drivers/crypto/hisilicon/hpre/hpre_main.c -+++ b/drivers/crypto/hisilicon/hpre/hpre_main.c -@@ -118,8 +118,6 @@ - #define HPRE_DFX_COMMON2_LEN 0xE - #define HPRE_DFX_CORE_LEN 0x43 - --#define HPRE_DEV_ALG_MAX_LEN 256 -- - static const char hpre_name[] = "hisi_hpre"; - static struct dentry *hpre_debugfs_root; - static const struct pci_device_id hpre_dev_ids[] = { -@@ -135,12 +133,7 @@ struct hpre_hw_error { - const char *msg; - }; - --struct hpre_dev_alg { -- u32 alg_msk; -- const char *alg; --}; -- --static const struct hpre_dev_alg hpre_dev_algs[] = { -+static const struct qm_dev_alg hpre_dev_algs[] = { - { - .alg_msk = BIT(0), - .alg = "rsa\n" -@@ -362,35 +355,6 @@ bool hpre_check_alg_support(struct hisi_qm *qm, u32 alg) - return false; - } - --static int hpre_set_qm_algs(struct hisi_qm *qm) --{ -- struct device *dev = &qm->pdev->dev; -- char *algs, *ptr; -- u32 alg_msk; -- int i; -- -- if (!qm->use_sva) -- return 0; -- -- algs = devm_kzalloc(dev, HPRE_DEV_ALG_MAX_LEN * sizeof(char), GFP_KERNEL); -- if (!algs) -- return -ENOMEM; -- -- alg_msk = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_DEV_ALG_BITMAP_CAP, qm->cap_ver); -- -- for (i = 0; i < ARRAY_SIZE(hpre_dev_algs); i++) -- if (alg_msk & hpre_dev_algs[i].alg_msk) -- strcat(algs, hpre_dev_algs[i].alg); -- -- ptr = strrchr(algs, '\n'); -- if (ptr) -- *ptr = '\0'; -- -- qm->uacce->algs = algs; -- -- return 0; --} -- - static int hpre_diff_regs_show(struct seq_file *s, void *unused) - { - struct hisi_qm *qm = s->private; -@@ -1141,6 +1105,7 @@ static void hpre_debugfs_exit(struct hisi_qm *qm) - - static int hpre_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) - { -+ u64 alg_msk; - int ret; - - if (pdev->revision == QM_HW_V1) { -@@ -1171,7 +1136,8 @@ static int hpre_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) - return ret; - } - -- ret = hpre_set_qm_algs(qm); -+ alg_msk = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_DEV_ALG_BITMAP_CAP, qm->cap_ver); -+ ret = hisi_qm_set_algs(qm, alg_msk, hpre_dev_algs, ARRAY_SIZE(hpre_dev_algs)); - if (ret) { - pci_err(pdev, "Failed to set hpre algs!\n"); - hisi_qm_uninit(qm); -diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c -index 30b43006d1db..40da95dbab25 100644 ---- a/drivers/crypto/hisilicon/qm.c -+++ b/drivers/crypto/hisilicon/qm.c -@@ -229,6 +229,8 @@ - #define QM_QOS_MAX_CIR_U 6 - #define QM_AUTOSUSPEND_DELAY 3000 - -+#define QM_DEV_ALG_MAX_LEN 256 -+ - #define QM_MK_CQC_DW3_V1(hop_num, pg_sz, buf_sz, cqe_sz) \ - (((hop_num) << QM_CQ_HOP_NUM_SHIFT) | \ - ((pg_sz) << QM_CQ_PAGE_SIZE_SHIFT) | \ -@@ -842,6 +844,40 @@ static void qm_get_xqc_depth(struct hisi_qm *qm, u16 *low_bits, - *high_bits = (depth >> QM_XQ_DEPTH_SHIFT) & QM_XQ_DEPTH_MASK; - } - -+int hisi_qm_set_algs(struct hisi_qm *qm, u64 alg_msk, const struct qm_dev_alg *dev_algs, -+ u32 dev_algs_size) -+{ -+ struct device *dev = &qm->pdev->dev; -+ char *algs, *ptr; -+ int i; -+ -+ if (!qm->uacce) -+ return 0; -+ -+ if (dev_algs_size >= QM_DEV_ALG_MAX_LEN) { -+ dev_err(dev, "algs size %u is equal or larger than %d.\n", -+ dev_algs_size, QM_DEV_ALG_MAX_LEN); -+ return -EINVAL; -+ } -+ -+ algs = devm_kzalloc(dev, QM_DEV_ALG_MAX_LEN * sizeof(char), GFP_KERNEL); -+ if (!algs) -+ return -ENOMEM; -+ -+ for (i = 0; i < dev_algs_size; i++) -+ if (alg_msk & dev_algs[i].alg_msk) -+ strcat(algs, dev_algs[i].alg); -+ -+ ptr = strrchr(algs, '\n'); -+ if (ptr) { -+ *ptr = '\0'; -+ qm->uacce->algs = algs; -+ } -+ -+ return 0; -+} -+EXPORT_SYMBOL_GPL(hisi_qm_set_algs); -+ - static u32 qm_get_irq_num(struct hisi_qm *qm) - { - if (qm->fun_type == QM_HW_PF) -diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c -index 0e56a47eb862..2eceab7600ca 100644 ---- a/drivers/crypto/hisilicon/sec2/sec_main.c -+++ b/drivers/crypto/hisilicon/sec2/sec_main.c -@@ -120,7 +120,6 @@ - GENMASK_ULL(42, 25)) - #define SEC_AEAD_BITMAP (GENMASK_ULL(7, 6) | GENMASK_ULL(18, 17) | \ - GENMASK_ULL(45, 43)) --#define SEC_DEV_ALG_MAX_LEN 256 - - struct sec_hw_error { - u32 int_msk; -@@ -132,11 +131,6 @@ struct sec_dfx_item { - u32 offset; - }; - --struct sec_dev_alg { -- u64 alg_msk; -- const char *algs; --}; -- - static const char sec_name[] = "hisi_sec2"; - static struct dentry *sec_debugfs_root; - -@@ -173,15 +167,15 @@ static const struct hisi_qm_cap_info sec_basic_info[] = { - {SEC_CORE4_ALG_BITMAP_HIGH, 0x3170, 0, GENMASK(31, 0), 0x3FFF, 0x3FFF, 0x3FFF}, - }; - --static const struct sec_dev_alg sec_dev_algs[] = { { -+static const struct qm_dev_alg sec_dev_algs[] = { { - .alg_msk = SEC_CIPHER_BITMAP, -- .algs = "cipher\n", -+ .alg = "cipher\n", - }, { - .alg_msk = SEC_DIGEST_BITMAP, -- .algs = "digest\n", -+ .alg = "digest\n", - }, { - .alg_msk = SEC_AEAD_BITMAP, -- .algs = "aead\n", -+ .alg = "aead\n", - }, - }; - -@@ -1077,37 +1071,9 @@ static int sec_pf_probe_init(struct sec_dev *sec) - return ret; - } - --static int sec_set_qm_algs(struct hisi_qm *qm) --{ -- struct device *dev = &qm->pdev->dev; -- char *algs, *ptr; -- u64 alg_mask; -- int i; -- -- if (!qm->use_sva) -- return 0; -- -- algs = devm_kzalloc(dev, SEC_DEV_ALG_MAX_LEN * sizeof(char), GFP_KERNEL); -- if (!algs) -- return -ENOMEM; -- -- alg_mask = sec_get_alg_bitmap(qm, SEC_DEV_ALG_BITMAP_HIGH, SEC_DEV_ALG_BITMAP_LOW); -- -- for (i = 0; i < ARRAY_SIZE(sec_dev_algs); i++) -- if (alg_mask & sec_dev_algs[i].alg_msk) -- strcat(algs, sec_dev_algs[i].algs); -- -- ptr = strrchr(algs, '\n'); -- if (ptr) -- *ptr = '\0'; -- -- qm->uacce->algs = algs; -- -- return 0; --} -- - static int sec_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) - { -+ u64 alg_msk; - int ret; - - qm->pdev = pdev; -@@ -1142,7 +1108,8 @@ static int sec_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) - return ret; - } - -- ret = sec_set_qm_algs(qm); -+ alg_msk = sec_get_alg_bitmap(qm, SEC_DEV_ALG_BITMAP_HIGH, SEC_DEV_ALG_BITMAP_LOW); -+ ret = hisi_qm_set_algs(qm, alg_msk, sec_dev_algs, ARRAY_SIZE(sec_dev_algs)); - if (ret) { - pci_err(qm->pdev, "Failed to set sec algs!\n"); - hisi_qm_uninit(qm); -diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c -index 85576f818278..f7cf54f02dd7 100644 ---- a/drivers/crypto/hisilicon/zip/zip_main.c -+++ b/drivers/crypto/hisilicon/zip/zip_main.c -@@ -74,7 +74,6 @@ - #define HZIP_AXI_SHUTDOWN_ENABLE BIT(14) - #define HZIP_WR_PORT BIT(11) - --#define HZIP_DEV_ALG_MAX_LEN 256 - #define HZIP_ALG_ZLIB_BIT GENMASK(1, 0) - #define HZIP_ALG_GZIP_BIT GENMASK(3, 2) - #define HZIP_ALG_DEFLATE_BIT GENMASK(5, 4) -@@ -128,23 +127,18 @@ struct zip_dfx_item { - u32 offset; - }; - --struct zip_dev_alg { -- u32 alg_msk; -- const char *algs; --}; -- --static const struct zip_dev_alg zip_dev_algs[] = { { -+static const struct qm_dev_alg zip_dev_algs[] = { { - .alg_msk = HZIP_ALG_ZLIB_BIT, -- .algs = "zlib\n", -+ .alg = "zlib\n", - }, { - .alg_msk = HZIP_ALG_GZIP_BIT, -- .algs = "gzip\n", -+ .alg = "gzip\n", - }, { - .alg_msk = HZIP_ALG_DEFLATE_BIT, -- .algs = "deflate\n", -+ .alg = "deflate\n", - }, { - .alg_msk = HZIP_ALG_LZ77_BIT, -- .algs = "lz77_zstd\n", -+ .alg = "lz77_zstd\n", - }, - }; - -@@ -478,35 +472,6 @@ static int hisi_zip_set_high_perf(struct hisi_qm *qm) - return ret; - } - --static int hisi_zip_set_qm_algs(struct hisi_qm *qm) --{ -- struct device *dev = &qm->pdev->dev; -- char *algs, *ptr; -- u32 alg_mask; -- int i; -- -- if (!qm->use_sva) -- return 0; -- -- algs = devm_kzalloc(dev, HZIP_DEV_ALG_MAX_LEN * sizeof(char), GFP_KERNEL); -- if (!algs) -- return -ENOMEM; -- -- alg_mask = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_DEV_ALG_BITMAP, qm->cap_ver); -- -- for (i = 0; i < ARRAY_SIZE(zip_dev_algs); i++) -- if (alg_mask & zip_dev_algs[i].alg_msk) -- strcat(algs, zip_dev_algs[i].algs); -- -- ptr = strrchr(algs, '\n'); -- if (ptr) -- *ptr = '\0'; -- -- qm->uacce->algs = algs; -- -- return 0; --} -- - static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm) - { - u32 val; -@@ -1193,6 +1158,7 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip) - - static int hisi_zip_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) - { -+ u64 alg_msk; - int ret; - - qm->pdev = pdev; -@@ -1228,7 +1194,8 @@ static int hisi_zip_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) - return ret; - } - -- ret = hisi_zip_set_qm_algs(qm); -+ alg_msk = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_DEV_ALG_BITMAP, qm->cap_ver); -+ ret = hisi_qm_set_algs(qm, alg_msk, zip_dev_algs, ARRAY_SIZE(zip_dev_algs)); - if (ret) { - pci_err(qm->pdev, "Failed to set zip algs!\n"); - hisi_qm_uninit(qm); -diff --git a/include/linux/hisi_acc_qm.h b/include/linux/hisi_acc_qm.h -index b8da977711a7..4c5611d99c42 100644 ---- a/include/linux/hisi_acc_qm.h -+++ b/include/linux/hisi_acc_qm.h -@@ -160,6 +160,11 @@ enum qm_cap_bits { - QM_SUPPORT_RPM, - }; - -+struct qm_dev_alg { -+ u64 alg_msk; -+ const char *alg; -+}; -+ - struct dfx_diff_registers { - u32 *regs; - u32 reg_offset; -@@ -375,7 +380,6 @@ struct hisi_qm { - struct work_struct rst_work; - struct work_struct cmd_process; - -- const char *algs; - bool use_sva; - - resource_size_t phys_base; -@@ -575,6 +579,8 @@ void hisi_qm_regs_dump(struct seq_file *s, struct debugfs_regset32 *regset); - u32 hisi_qm_get_hw_info(struct hisi_qm *qm, - const struct hisi_qm_cap_info *info_table, - u32 index, bool is_read); -+int hisi_qm_set_algs(struct hisi_qm *qm, u64 alg_msk, const struct qm_dev_alg *dev_algs, -+ u32 dev_algs_size); - - /* Used by VFIO ACC live migration driver */ - struct pci_driver *hisi_sec_get_pf_driver(void); --- -2.43.2 - -From ce2b3ce5cae73889ca697f0d6344b85d3cb94ad9 Mon Sep 17 00:00:00 2001 -From: Zhiqi Song <songzhiqi1@huawei.com> -Date: Sat, 2 Dec 2023 17:17:20 +0800 -Subject: [PATCH 0094/1501] crypto: hisilicon/hpre - save capability registers - in probe process -Content-Length: 7132 -Lines: 203 - -[ Upstream commit cf8b5156bbc8c9376f699e8d35e9464b739e33ff ] - -Pre-store the valid value of hpre alg support related capability -register in hpre_qm_init(), which will be called by hpre_probe(). -It can reduce the number of capability register queries and avoid -obtaining incorrect values in abnormal scenarios, such as reset -failed and the memory space disabled. - -Fixes: f214d59a0603 ("crypto: hisilicon/hpre - support hpre capability") -Signed-off-by: Zhiqi Song <songzhiqi1@huawei.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/hisilicon/hpre/hpre_main.c | 82 ++++++++++++++++++----- - 1 file changed, 64 insertions(+), 18 deletions(-) - -diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c -index 84c92d85d23d..3255b2a070c7 100644 ---- a/drivers/crypto/hisilicon/hpre/hpre_main.c -+++ b/drivers/crypto/hisilicon/hpre/hpre_main.c -@@ -226,6 +226,20 @@ static const struct hisi_qm_cap_info hpre_basic_info[] = { - {HPRE_CORE10_ALG_BITMAP_CAP, 0x3170, 0, GENMASK(31, 0), 0x0, 0x10, 0x10} - }; - -+enum hpre_pre_store_cap_idx { -+ HPRE_CLUSTER_NUM_CAP_IDX = 0x0, -+ HPRE_CORE_ENABLE_BITMAP_CAP_IDX, -+ HPRE_DRV_ALG_BITMAP_CAP_IDX, -+ HPRE_DEV_ALG_BITMAP_CAP_IDX, -+}; -+ -+static const u32 hpre_pre_store_caps[] = { -+ HPRE_CLUSTER_NUM_CAP, -+ HPRE_CORE_ENABLE_BITMAP_CAP, -+ HPRE_DRV_ALG_BITMAP_CAP, -+ HPRE_DEV_ALG_BITMAP_CAP, -+}; -+ - static const struct hpre_hw_error hpre_hw_errors[] = { - { - .int_msk = BIT(0), -@@ -348,7 +362,7 @@ bool hpre_check_alg_support(struct hisi_qm *qm, u32 alg) - { - u32 cap_val; - -- cap_val = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_DRV_ALG_BITMAP_CAP, qm->cap_ver); -+ cap_val = qm->cap_tables.dev_cap_table[HPRE_DRV_ALG_BITMAP_CAP_IDX].cap_val; - if (alg & cap_val) - return true; - -@@ -424,16 +438,6 @@ static u32 vfs_num; - module_param_cb(vfs_num, &vfs_num_ops, &vfs_num, 0444); - MODULE_PARM_DESC(vfs_num, "Number of VFs to enable(1-63), 0(default)"); - --static inline int hpre_cluster_num(struct hisi_qm *qm) --{ -- return hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_CLUSTER_NUM_CAP, qm->cap_ver); --} -- --static inline int hpre_cluster_core_mask(struct hisi_qm *qm) --{ -- return hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_CORE_ENABLE_BITMAP_CAP, qm->cap_ver); --} -- - struct hisi_qp *hpre_create_qp(u8 type) - { - int node = cpu_to_node(smp_processor_id()); -@@ -500,13 +504,15 @@ static int hpre_cfg_by_dsm(struct hisi_qm *qm) - - static int hpre_set_cluster(struct hisi_qm *qm) - { -- u32 cluster_core_mask = hpre_cluster_core_mask(qm); -- u8 clusters_num = hpre_cluster_num(qm); - struct device *dev = &qm->pdev->dev; - unsigned long offset; -+ u32 cluster_core_mask; -+ u8 clusters_num; - u32 val = 0; - int ret, i; - -+ cluster_core_mask = qm->cap_tables.dev_cap_table[HPRE_CORE_ENABLE_BITMAP_CAP_IDX].cap_val; -+ clusters_num = qm->cap_tables.dev_cap_table[HPRE_CLUSTER_NUM_CAP_IDX].cap_val; - for (i = 0; i < clusters_num; i++) { - offset = i * HPRE_CLSTR_ADDR_INTRVL; - -@@ -701,11 +707,12 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm) - - static void hpre_cnt_regs_clear(struct hisi_qm *qm) - { -- u8 clusters_num = hpre_cluster_num(qm); - unsigned long offset; -+ u8 clusters_num; - int i; - - /* clear clusterX/cluster_ctrl */ -+ clusters_num = qm->cap_tables.dev_cap_table[HPRE_CLUSTER_NUM_CAP_IDX].cap_val; - for (i = 0; i < clusters_num; i++) { - offset = HPRE_CLSTR_BASE + i * HPRE_CLSTR_ADDR_INTRVL; - writel(0x0, qm->io_base + offset + HPRE_CLUSTER_INQURY); -@@ -992,13 +999,14 @@ static int hpre_pf_comm_regs_debugfs_init(struct hisi_qm *qm) - - static int hpre_cluster_debugfs_init(struct hisi_qm *qm) - { -- u8 clusters_num = hpre_cluster_num(qm); - struct device *dev = &qm->pdev->dev; - char buf[HPRE_DBGFS_VAL_MAX_LEN]; - struct debugfs_regset32 *regset; - struct dentry *tmp_d; -+ u8 clusters_num; - int i, ret; - -+ clusters_num = qm->cap_tables.dev_cap_table[HPRE_CLUSTER_NUM_CAP_IDX].cap_val; - for (i = 0; i < clusters_num; i++) { - ret = snprintf(buf, HPRE_DBGFS_VAL_MAX_LEN, "cluster%d", i); - if (ret >= HPRE_DBGFS_VAL_MAX_LEN) -@@ -1103,6 +1111,34 @@ static void hpre_debugfs_exit(struct hisi_qm *qm) - debugfs_remove_recursive(qm->debug.debug_root); - } - -+static int hpre_pre_store_cap_reg(struct hisi_qm *qm) -+{ -+ struct hisi_qm_cap_record *hpre_cap; -+ struct device *dev = &qm->pdev->dev; -+ size_t i, size; -+ -+ size = ARRAY_SIZE(hpre_pre_store_caps); -+ hpre_cap = devm_kzalloc(dev, sizeof(*hpre_cap) * size, GFP_KERNEL); -+ if (!hpre_cap) -+ return -ENOMEM; -+ -+ for (i = 0; i < size; i++) { -+ hpre_cap[i].type = hpre_pre_store_caps[i]; -+ hpre_cap[i].cap_val = hisi_qm_get_hw_info(qm, hpre_basic_info, -+ hpre_pre_store_caps[i], qm->cap_ver); -+ } -+ -+ if (hpre_cap[HPRE_CLUSTER_NUM_CAP_IDX].cap_val > HPRE_CLUSTERS_NUM_MAX) { -+ dev_err(dev, "Device cluster num %u is out of range for driver supports %d!\n", -+ hpre_cap[HPRE_CLUSTER_NUM_CAP_IDX].cap_val, HPRE_CLUSTERS_NUM_MAX); -+ return -EINVAL; -+ } -+ -+ qm->cap_tables.dev_cap_table = hpre_cap; -+ -+ return 0; -+} -+ - static int hpre_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) - { - u64 alg_msk; -@@ -1136,7 +1172,15 @@ static int hpre_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) - return ret; - } - -- alg_msk = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_DEV_ALG_BITMAP_CAP, qm->cap_ver); -+ /* Fetch and save the value of capability registers */ -+ ret = hpre_pre_store_cap_reg(qm); -+ if (ret) { -+ pci_err(pdev, "Failed to pre-store capability registers!\n"); -+ hisi_qm_uninit(qm); -+ return ret; -+ } -+ -+ alg_msk = qm->cap_tables.dev_cap_table[HPRE_DEV_ALG_BITMAP_CAP_IDX].cap_val; - ret = hisi_qm_set_algs(qm, alg_msk, hpre_dev_algs, ARRAY_SIZE(hpre_dev_algs)); - if (ret) { - pci_err(pdev, "Failed to set hpre algs!\n"); -@@ -1150,11 +1194,12 @@ static int hpre_show_last_regs_init(struct hisi_qm *qm) - { - int cluster_dfx_regs_num = ARRAY_SIZE(hpre_cluster_dfx_regs); - int com_dfx_regs_num = ARRAY_SIZE(hpre_com_dfx_regs); -- u8 clusters_num = hpre_cluster_num(qm); - struct qm_debug *debug = &qm->debug; - void __iomem *io_base; -+ u8 clusters_num; - int i, j, idx; - -+ clusters_num = qm->cap_tables.dev_cap_table[HPRE_CLUSTER_NUM_CAP_IDX].cap_val; - debug->last_words = kcalloc(cluster_dfx_regs_num * clusters_num + - com_dfx_regs_num, sizeof(unsigned int), GFP_KERNEL); - if (!debug->last_words) -@@ -1191,10 +1236,10 @@ static void hpre_show_last_dfx_regs(struct hisi_qm *qm) - { - int cluster_dfx_regs_num = ARRAY_SIZE(hpre_cluster_dfx_regs); - int com_dfx_regs_num = ARRAY_SIZE(hpre_com_dfx_regs); -- u8 clusters_num = hpre_cluster_num(qm); - struct qm_debug *debug = &qm->debug; - struct pci_dev *pdev = qm->pdev; - void __iomem *io_base; -+ u8 clusters_num; - int i, j, idx; - u32 val; - -@@ -1209,6 +1254,7 @@ static void hpre_show_last_dfx_regs(struct hisi_qm *qm) - hpre_com_dfx_regs[i].name, debug->last_words[i], val); - } - -+ clusters_num = qm->cap_tables.dev_cap_table[HPRE_CLUSTER_NUM_CAP_IDX].cap_val; - for (i = 0; i < clusters_num; i++) { - io_base = qm->io_base + hpre_cluster_offsets[i]; - for (j = 0; j < cluster_dfx_regs_num; j++) { --- -2.43.2 - -From 7fea58e8e647ffcc70dfa1ea53c325d7e52c893b Mon Sep 17 00:00:00 2001 -From: Zhiqi Song <songzhiqi1@huawei.com> -Date: Sat, 2 Dec 2023 17:17:21 +0800 -Subject: [PATCH 0095/1501] crypto: hisilicon/sec2 - save capability registers - in probe process -Content-Length: 5011 -Lines: 143 - -[ Upstream commit f1115b0096c3163592e04e74f5a7548c25bda957 ] - -Pre-store the valid value of the sec alg support related capability -register in sec_qm_init(), which will be called by probe process. -It can reduce the number of capability register queries and avoid -obtaining incorrect values in abnormal scenarios, such as reset -failed and the memory space disabled. - -Fixes: 921715b6b782 ("crypto: hisilicon/sec - get algorithm bitmap from registers") -Signed-off-by: Zhiqi Song <songzhiqi1@huawei.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/hisilicon/sec2/sec.h | 7 ++++ - drivers/crypto/hisilicon/sec2/sec_crypto.c | 10 ++++- - drivers/crypto/hisilicon/sec2/sec_main.c | 43 ++++++++++++++++++++-- - 3 files changed, 55 insertions(+), 5 deletions(-) - -diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h -index 3e57fc04b377..410c83712e28 100644 ---- a/drivers/crypto/hisilicon/sec2/sec.h -+++ b/drivers/crypto/hisilicon/sec2/sec.h -@@ -220,6 +220,13 @@ enum sec_cap_type { - SEC_CORE4_ALG_BITMAP_HIGH, - }; - -+enum sec_cap_reg_record_idx { -+ SEC_DRV_ALG_BITMAP_LOW_IDX = 0x0, -+ SEC_DRV_ALG_BITMAP_HIGH_IDX, -+ SEC_DEV_ALG_BITMAP_LOW_IDX, -+ SEC_DEV_ALG_BITMAP_HIGH_IDX, -+}; -+ - void sec_destroy_qps(struct hisi_qp **qps, int qp_num); - struct hisi_qp **sec_create_qps(void); - int sec_register_to_crypto(struct hisi_qm *qm); -diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c -index 6fcabbc87860..ba7f305d43c1 100644 ---- a/drivers/crypto/hisilicon/sec2/sec_crypto.c -+++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c -@@ -2547,9 +2547,12 @@ static int sec_register_aead(u64 alg_mask) - - int sec_register_to_crypto(struct hisi_qm *qm) - { -- u64 alg_mask = sec_get_alg_bitmap(qm, SEC_DRV_ALG_BITMAP_HIGH, SEC_DRV_ALG_BITMAP_LOW); -+ u64 alg_mask; - int ret = 0; - -+ alg_mask = sec_get_alg_bitmap(qm, SEC_DRV_ALG_BITMAP_HIGH_IDX, -+ SEC_DRV_ALG_BITMAP_LOW_IDX); -+ - mutex_lock(&sec_algs_lock); - if (sec_available_devs) { - sec_available_devs++; -@@ -2578,7 +2581,10 @@ int sec_register_to_crypto(struct hisi_qm *qm) - - void sec_unregister_from_crypto(struct hisi_qm *qm) - { -- u64 alg_mask = sec_get_alg_bitmap(qm, SEC_DRV_ALG_BITMAP_HIGH, SEC_DRV_ALG_BITMAP_LOW); -+ u64 alg_mask; -+ -+ alg_mask = sec_get_alg_bitmap(qm, SEC_DRV_ALG_BITMAP_HIGH_IDX, -+ SEC_DRV_ALG_BITMAP_LOW_IDX); - - mutex_lock(&sec_algs_lock); - if (--sec_available_devs) -diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c -index 2eceab7600ca..878d94ab5d6d 100644 ---- a/drivers/crypto/hisilicon/sec2/sec_main.c -+++ b/drivers/crypto/hisilicon/sec2/sec_main.c -@@ -167,6 +167,13 @@ static const struct hisi_qm_cap_info sec_basic_info[] = { - {SEC_CORE4_ALG_BITMAP_HIGH, 0x3170, 0, GENMASK(31, 0), 0x3FFF, 0x3FFF, 0x3FFF}, - }; - -+static const u32 sec_pre_store_caps[] = { -+ SEC_DRV_ALG_BITMAP_LOW, -+ SEC_DRV_ALG_BITMAP_HIGH, -+ SEC_DEV_ALG_BITMAP_LOW, -+ SEC_DEV_ALG_BITMAP_HIGH, -+}; -+ - static const struct qm_dev_alg sec_dev_algs[] = { { - .alg_msk = SEC_CIPHER_BITMAP, - .alg = "cipher\n", -@@ -388,8 +395,8 @@ u64 sec_get_alg_bitmap(struct hisi_qm *qm, u32 high, u32 low) - { - u32 cap_val_h, cap_val_l; - -- cap_val_h = hisi_qm_get_hw_info(qm, sec_basic_info, high, qm->cap_ver); -- cap_val_l = hisi_qm_get_hw_info(qm, sec_basic_info, low, qm->cap_ver); -+ cap_val_h = qm->cap_tables.dev_cap_table[high].cap_val; -+ cap_val_l = qm->cap_tables.dev_cap_table[low].cap_val; - - return ((u64)cap_val_h << SEC_ALG_BITMAP_SHIFT) | (u64)cap_val_l; - } -@@ -1071,6 +1078,28 @@ static int sec_pf_probe_init(struct sec_dev *sec) - return ret; - } - -+static int sec_pre_store_cap_reg(struct hisi_qm *qm) -+{ -+ struct hisi_qm_cap_record *sec_cap; -+ struct pci_dev *pdev = qm->pdev; -+ size_t i, size; -+ -+ size = ARRAY_SIZE(sec_pre_store_caps); -+ sec_cap = devm_kzalloc(&pdev->dev, sizeof(*sec_cap) * size, GFP_KERNEL); -+ if (!sec_cap) -+ return -ENOMEM; -+ -+ for (i = 0; i < size; i++) { -+ sec_cap[i].type = sec_pre_store_caps[i]; -+ sec_cap[i].cap_val = hisi_qm_get_hw_info(qm, sec_basic_info, -+ sec_pre_store_caps[i], qm->cap_ver); -+ } -+ -+ qm->cap_tables.dev_cap_table = sec_cap; -+ -+ return 0; -+} -+ - static int sec_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) - { - u64 alg_msk; -@@ -1108,7 +1137,15 @@ static int sec_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) - return ret; - } - -- alg_msk = sec_get_alg_bitmap(qm, SEC_DEV_ALG_BITMAP_HIGH, SEC_DEV_ALG_BITMAP_LOW); -+ /* Fetch and save the value of capability registers */ -+ ret = sec_pre_store_cap_reg(qm); -+ if (ret) { -+ pci_err(qm->pdev, "Failed to pre-store capability registers!\n"); -+ hisi_qm_uninit(qm); -+ return ret; -+ } -+ -+ alg_msk = sec_get_alg_bitmap(qm, SEC_DEV_ALG_BITMAP_HIGH_IDX, SEC_DEV_ALG_BITMAP_LOW_IDX); - ret = hisi_qm_set_algs(qm, alg_msk, sec_dev_algs, ARRAY_SIZE(sec_dev_algs)); - if (ret) { - pci_err(qm->pdev, "Failed to set sec algs!\n"); --- -2.43.2 - -From f7bf58957718d38670610500ffb44fecd08f371b Mon Sep 17 00:00:00 2001 -From: Zhiqi Song <songzhiqi1@huawei.com> -Date: Sat, 2 Dec 2023 17:17:22 +0800 -Subject: [PATCH 0096/1501] crypto: hisilicon/zip - save capability registers - in probe process -Content-Length: 5580 -Lines: 151 - -[ Upstream commit 2ff0ad847951d61c2d8b309e1ccefb26c57dcc7b ] - -Pre-store the valid value of the zip alg support related capability -register in hisi_zip_qm_init(), which will be called by hisi_zip_probe(). -It can reduce the number of capability register queries and avoid -obtaining incorrect values in abnormal scenarios, such as reset failed -and the memory space disabled. - -Fixes: db700974b69d ("crypto: hisilicon/zip - support zip capability") -Signed-off-by: Zhiqi Song <songzhiqi1@huawei.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/hisilicon/zip/zip_main.c | 73 ++++++++++++++++++++----- - 1 file changed, 60 insertions(+), 13 deletions(-) - -diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c -index f7cf54f02dd7..403b07468841 100644 ---- a/drivers/crypto/hisilicon/zip/zip_main.c -+++ b/drivers/crypto/hisilicon/zip/zip_main.c -@@ -249,6 +249,26 @@ static struct hisi_qm_cap_info zip_basic_cap_info[] = { - {ZIP_CAP_MAX, 0x317c, 0, GENMASK(0, 0), 0x0, 0x0, 0x0} - }; - -+enum zip_pre_store_cap_idx { -+ ZIP_CORE_NUM_CAP_IDX = 0x0, -+ ZIP_CLUSTER_COMP_NUM_CAP_IDX, -+ ZIP_CLUSTER_DECOMP_NUM_CAP_IDX, -+ ZIP_DECOMP_ENABLE_BITMAP_IDX, -+ ZIP_COMP_ENABLE_BITMAP_IDX, -+ ZIP_DRV_ALG_BITMAP_IDX, -+ ZIP_DEV_ALG_BITMAP_IDX, -+}; -+ -+static const u32 zip_pre_store_caps[] = { -+ ZIP_CORE_NUM_CAP, -+ ZIP_CLUSTER_COMP_NUM_CAP, -+ ZIP_CLUSTER_DECOMP_NUM_CAP, -+ ZIP_DECOMP_ENABLE_BITMAP, -+ ZIP_COMP_ENABLE_BITMAP, -+ ZIP_DRV_ALG_BITMAP, -+ ZIP_DEV_ALG_BITMAP, -+}; -+ - enum { - HZIP_COMP_CORE0, - HZIP_COMP_CORE1, -@@ -443,7 +463,7 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg) - { - u32 cap_val; - -- cap_val = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_DRV_ALG_BITMAP, qm->cap_ver); -+ cap_val = qm->cap_tables.dev_cap_table[ZIP_DRV_ALG_BITMAP_IDX].cap_val; - if ((alg & cap_val) == alg) - return true; - -@@ -568,10 +588,8 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm) - } - - /* let's open all compression/decompression cores */ -- dcomp_bm = hisi_qm_get_hw_info(qm, zip_basic_cap_info, -- ZIP_DECOMP_ENABLE_BITMAP, qm->cap_ver); -- comp_bm = hisi_qm_get_hw_info(qm, zip_basic_cap_info, -- ZIP_COMP_ENABLE_BITMAP, qm->cap_ver); -+ dcomp_bm = qm->cap_tables.dev_cap_table[ZIP_DECOMP_ENABLE_BITMAP_IDX].cap_val; -+ comp_bm = qm->cap_tables.dev_cap_table[ZIP_COMP_ENABLE_BITMAP_IDX].cap_val; - writel(HZIP_DECOMP_CHECK_ENABLE | dcomp_bm | comp_bm, base + HZIP_CLOCK_GATE_CTRL); - - /* enable sqc,cqc writeback */ -@@ -798,9 +816,8 @@ static int hisi_zip_core_debug_init(struct hisi_qm *qm) - char buf[HZIP_BUF_SIZE]; - int i; - -- zip_core_num = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_CORE_NUM_CAP, qm->cap_ver); -- zip_comp_core_num = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_CLUSTER_COMP_NUM_CAP, -- qm->cap_ver); -+ zip_core_num = qm->cap_tables.dev_cap_table[ZIP_CORE_NUM_CAP_IDX].cap_val; -+ zip_comp_core_num = qm->cap_tables.dev_cap_table[ZIP_CLUSTER_COMP_NUM_CAP_IDX].cap_val; - - for (i = 0; i < zip_core_num; i++) { - if (i < zip_comp_core_num) -@@ -942,7 +959,7 @@ static int hisi_zip_show_last_regs_init(struct hisi_qm *qm) - u32 zip_core_num; - int i, j, idx; - -- zip_core_num = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_CORE_NUM_CAP, qm->cap_ver); -+ zip_core_num = qm->cap_tables.dev_cap_table[ZIP_CORE_NUM_CAP_IDX].cap_val; - - debug->last_words = kcalloc(core_dfx_regs_num * zip_core_num + com_dfx_regs_num, - sizeof(unsigned int), GFP_KERNEL); -@@ -998,9 +1015,9 @@ static void hisi_zip_show_last_dfx_regs(struct hisi_qm *qm) - hzip_com_dfx_regs[i].name, debug->last_words[i], val); - } - -- zip_core_num = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_CORE_NUM_CAP, qm->cap_ver); -- zip_comp_core_num = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_CLUSTER_COMP_NUM_CAP, -- qm->cap_ver); -+ zip_core_num = qm->cap_tables.dev_cap_table[ZIP_CORE_NUM_CAP_IDX].cap_val; -+ zip_comp_core_num = qm->cap_tables.dev_cap_table[ZIP_CLUSTER_COMP_NUM_CAP_IDX].cap_val; -+ - for (i = 0; i < zip_core_num; i++) { - if (i < zip_comp_core_num) - scnprintf(buf, sizeof(buf), "Comp_core-%d", i); -@@ -1156,6 +1173,28 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip) - return ret; - } - -+static int zip_pre_store_cap_reg(struct hisi_qm *qm) -+{ -+ struct hisi_qm_cap_record *zip_cap; -+ struct pci_dev *pdev = qm->pdev; -+ size_t i, size; -+ -+ size = ARRAY_SIZE(zip_pre_store_caps); -+ zip_cap = devm_kzalloc(&pdev->dev, sizeof(*zip_cap) * size, GFP_KERNEL); -+ if (!zip_cap) -+ return -ENOMEM; -+ -+ for (i = 0; i < size; i++) { -+ zip_cap[i].type = zip_pre_store_caps[i]; -+ zip_cap[i].cap_val = hisi_qm_get_hw_info(qm, zip_basic_cap_info, -+ zip_pre_store_caps[i], qm->cap_ver); -+ } -+ -+ qm->cap_tables.dev_cap_table = zip_cap; -+ -+ return 0; -+} -+ - static int hisi_zip_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) - { - u64 alg_msk; -@@ -1194,7 +1233,15 @@ static int hisi_zip_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) - return ret; - } - -- alg_msk = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_DEV_ALG_BITMAP, qm->cap_ver); -+ /* Fetch and save the value of capability registers */ -+ ret = zip_pre_store_cap_reg(qm); -+ if (ret) { -+ pci_err(qm->pdev, "Failed to pre-store capability registers!\n"); -+ hisi_qm_uninit(qm); -+ return ret; -+ } -+ -+ alg_msk = qm->cap_tables.dev_cap_table[ZIP_DEV_ALG_BITMAP_IDX].cap_val; - ret = hisi_qm_set_algs(qm, alg_msk, zip_dev_algs, ARRAY_SIZE(zip_dev_algs)); - if (ret) { - pci_err(qm->pdev, "Failed to set zip algs!\n"); --- -2.43.2 - -From f9b891a7e8fcf83901f8507241e23e7420103b61 Mon Sep 17 00:00:00 2001 -From: Sergey Shtylyov <s.shtylyov@omp.ru> -Date: Sun, 5 Nov 2023 23:29:36 +0300 -Subject: [PATCH 0097/1501] pstore: ram_core: fix possible overflow in - persistent_ram_init_ecc() -Content-Length: 1513 -Lines: 38 - -[ Upstream commit 86222a8fc16ec517de8da2604d904c9df3a08e5d ] - -In persistent_ram_init_ecc(), on 64-bit arches DIV_ROUND_UP() will return -64-bit value since persistent_ram_zone::buffer_size has type size_t which -is derived from the 64-bit *unsigned long*, while the ecc_blocks variable -this value gets assigned to has (always 32-bit) *int* type. Even if that -value fits into *int* type, an overflow is still possible when calculating -the size_t typed ecc_total variable further below since there's no cast to -any 64-bit type before multiplication. Declaring the ecc_blocks variable -as *size_t* should fix this mess... - -Found by Linux Verification Center (linuxtesting.org) with the SVACE static -analysis tool. - -Fixes: 9cc05ad97c57 ("staging: android: persistent_ram: refactor ecc support") -Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru> -Link: https://lore.kernel.org/r/20231105202936.25694-1-s.shtylyov@omp.ru -Signed-off-by: Kees Cook <keescook@chromium.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/pstore/ram_core.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c -index 650e437b55e6..f1848cdd6d34 100644 ---- a/fs/pstore/ram_core.c -+++ b/fs/pstore/ram_core.c -@@ -190,7 +190,7 @@ static int persistent_ram_init_ecc(struct persistent_ram_zone *prz, - { - int numerr; - struct persistent_ram_buffer *buffer = prz->buffer; -- int ecc_blocks; -+ size_t ecc_blocks; - size_t ecc_total; - - if (!ecc_info || !ecc_info->ecc_size) --- -2.43.2 - -From 2458d56a5876b7c5f4ff9d41827448aafa219f3c Mon Sep 17 00:00:00 2001 -From: Gao Xiang <hsiangkao@linux.alibaba.com> -Date: Wed, 29 Nov 2023 02:04:31 +0800 -Subject: [PATCH 0098/1501] erofs: fix memory leak on short-lived bounced pages -Content-Length: 1496 -Lines: 42 - -[ Upstream commit 93d6fda7f926451a0fa1121b9558d75ca47e861e ] - -Both MicroLZMA and DEFLATE algorithms can use short-lived pages on -demand for the overlapped inplace I/O decompression. - -However, those short-lived pages are actually added to -`be->compressed_pages`. Thus, it should be checked instead of -`pcl->compressed_bvecs`. - -The LZ4 algorithm doesn't work like this, so it won't be impacted. - -Fixes: 67139e36d970 ("erofs: introduce `z_erofs_parse_in_bvecs'") -Reviewed-by: Yue Hu <huyue2@coolpad.com> -Reviewed-by: Chao Yu <chao@kernel.org> -Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com> -Link: https://lore.kernel.org/r/20231128180431.4116991-1-hsiangkao@linux.alibaba.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/erofs/zdata.c | 5 ++--- - 1 file changed, 2 insertions(+), 3 deletions(-) - -diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c -index a7e6847f6f8f..a33cd6757f98 100644 ---- a/fs/erofs/zdata.c -+++ b/fs/erofs/zdata.c -@@ -1309,12 +1309,11 @@ static int z_erofs_decompress_pcluster(struct z_erofs_decompress_backend *be, - put_page(page); - } else { - for (i = 0; i < pclusterpages; ++i) { -- page = pcl->compressed_bvecs[i].page; -+ /* consider shortlived pages added when decompressing */ -+ page = be->compressed_pages[i]; - - if (erofs_page_is_managed(sbi, page)) - continue; -- -- /* recycle all individual short-lived pages */ - (void)z_erofs_put_shortlivedpage(be->pagepool, page); - WRITE_ONCE(pcl->compressed_bvecs[i].page, NULL); - } --- -2.43.2 - -From 3c5adf160e64ba468c4769548514410fb949c268 Mon Sep 17 00:00:00 2001 -From: Christian Brauner <brauner@kernel.org> -Date: Wed, 22 Nov 2023 12:17:37 -0500 -Subject: [PATCH 0099/1501] fs: indicate request originates from old mount API -Content-Length: 1778 -Lines: 53 - -[ Upstream commit f67d922edb4e95a4a56d07d5d40a76dd4f23a85b ] - -We already communicate to filesystems when a remount request comes from -the old mount API as some filesystems choose to implement different -behavior in the new mount API than the old mount API to e.g., take the -chance to fix significant API bugs. Allow the same for regular mount -requests. - -Fixes: b330966f79fb ("fuse: reject options on reconfigure via fsconfig(2)") -Reviewed-by: Christoph Hellwig <hch@lst.de> -Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com> -Reviewed-by: Anand Jain <anand.jain@oracle.com> -Signed-off-by: Christian Brauner <brauner@kernel.org> -Signed-off-by: Josef Bacik <josef@toxicpanda.com> -Reviewed-by: David Sterba <dsterba@suse.com> -Signed-off-by: David Sterba <dsterba@suse.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/namespace.c | 11 +++++++++++ - 1 file changed, 11 insertions(+) - -diff --git a/fs/namespace.c b/fs/namespace.c -index fbf0e596fcd3..6c39ec020a5f 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -2875,7 +2875,12 @@ static int do_remount(struct path *path, int ms_flags, int sb_flags, - if (IS_ERR(fc)) - return PTR_ERR(fc); - -+ /* -+ * Indicate to the filesystem that the remount request is coming -+ * from the legacy mount system call. -+ */ - fc->oldapi = true; -+ - err = parse_monolithic_mount_data(fc, data); - if (!err) { - down_write(&sb->s_umount); -@@ -3324,6 +3329,12 @@ static int do_new_mount(struct path *path, const char *fstype, int sb_flags, - if (IS_ERR(fc)) - return PTR_ERR(fc); - -+ /* -+ * Indicate to the filesystem that the mount request is coming -+ * from the legacy mount system call. -+ */ -+ fc->oldapi = true; -+ - if (subtype) - err = vfs_parse_fs_string(fc, "subtype", - subtype, strlen(subtype)); --- -2.43.2 - -From c323efd620c741168c8e0cc6fc0be04ab57e331a Mon Sep 17 00:00:00 2001 -From: Osama Muhammad <osmtendev@gmail.com> -Date: Mon, 6 Nov 2023 21:21:29 +0500 -Subject: [PATCH 0100/1501] gfs2: Fix kernel NULL pointer dereference in - gfs2_rgrp_dump -Content-Length: 1378 -Lines: 32 - -[ Upstream commit 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa ] - -Syzkaller has reported a NULL pointer dereference when accessing -rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating -rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in -gfs2_rgrp_dump() to prevent that. - -Reported-and-tested-by: syzbot+da0fc229cc1ff4bb2e6d@syzkaller.appspotmail.com -Link: https://syzkaller.appspot.com/bug?extid=da0fc229cc1ff4bb2e6d -Fixes: 72244b6bc752 ("gfs2: improve debug information when lvb mismatches are found") -Signed-off-by: Osama Muhammad <osmtendev@gmail.com> -Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/gfs2/rgrp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c -index c2060203b98a..396d0f4a259d 100644 ---- a/fs/gfs2/rgrp.c -+++ b/fs/gfs2/rgrp.c -@@ -2306,7 +2306,7 @@ void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd, - (unsigned long long)rgd->rd_addr, rgd->rd_flags, - rgd->rd_free, rgd->rd_free_clone, rgd->rd_dinodes, - rgd->rd_requested, rgd->rd_reserved, rgd->rd_extfail_pt); -- if (rgd->rd_sbd->sd_args.ar_rgrplvb) { -+ if (rgd->rd_sbd->sd_args.ar_rgrplvb && rgd->rd_rgl) { - struct gfs2_rgrp_lvb *rgl = rgd->rd_rgl; - - gfs2_print_dbg(seq, "%s L: f:%02x b:%u i:%u\n", fs_id_buf, --- -2.43.2 - -From 7c24831356e187de1a04d83c1c73568895d9469f Mon Sep 17 00:00:00 2001 -From: Edward Adam Davis <eadavis@qq.com> -Date: Sat, 2 Dec 2023 17:25:49 +0800 -Subject: [PATCH 0101/1501] gfs2: fix kernel BUG in gfs2_quota_cleanup -Content-Length: 3680 -Lines: 87 - -[ Upstream commit 71733b4922007500ae259af9e96017080f5d36d9 ] - -[Syz report] -kernel BUG at fs/gfs2/quota.c:1508! -invalid opcode: 0000 [#1] PREEMPT SMP KASAN -CPU: 0 PID: 5060 Comm: syz-executor505 Not tainted 6.7.0-rc3-syzkaller-00134-g994d5c58e50e #0 -Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 -RIP: 0010:gfs2_quota_cleanup+0x6b5/0x6c0 fs/gfs2/quota.c:1508 -Code: fe e9 cf fd ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 2d fe ff ff 4c 89 ef e8 b6 19 23 fe e9 20 fe ff ff e8 ec 11 c7 fd 90 <0f> 0b e8 84 9c 4f 07 0f 1f 40 00 66 0f 1f 00 55 41 57 41 56 41 54 -RSP: 0018:ffffc9000409f9e0 EFLAGS: 00010293 -RAX: ffffffff83c76854 RBX: 0000000000000002 RCX: ffff888026001dc0 -RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000 -RBP: ffffc9000409fb00 R08: ffffffff83c762b0 R09: 1ffff1100fd38015 -R10: dffffc0000000000 R11: ffffed100fd38016 R12: dffffc0000000000 -R13: ffff88807e9c0828 R14: ffff888014693580 R15: ffff88807e9c0000 -FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 -CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -CR2: 00007f16d1bd70f8 CR3: 0000000027199000 CR4: 00000000003506f0 -DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 -DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 -Call Trace: - <TASK> - gfs2_put_super+0x2e1/0x940 fs/gfs2/super.c:611 - generic_shutdown_super+0x13a/0x2c0 fs/super.c:696 - kill_block_super+0x44/0x90 fs/super.c:1667 - deactivate_locked_super+0xc1/0x130 fs/super.c:484 - cleanup_mnt+0x426/0x4c0 fs/namespace.c:1256 - task_work_run+0x24a/0x300 kernel/task_work.c:180 - exit_task_work include/linux/task_work.h:38 [inline] - do_exit+0xa34/0x2750 kernel/exit.c:871 - do_group_exit+0x206/0x2c0 kernel/exit.c:1021 - __do_sys_exit_group kernel/exit.c:1032 [inline] - __se_sys_exit_group kernel/exit.c:1030 [inline] - __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1030 - do_syscall_x64 arch/x86/entry/common.c:51 [inline] - do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82 - entry_SYSCALL_64_after_hwframe+0x63/0x6b -... - -[pid 5060] fsconfig(4, FSCONFIG_CMD_RECONFIGURE, NULL, NULL, 0) = 0 -[pid 5060] exit_group(1) = ? -... - -[Analysis] -When the task exits, it will execute cleanup_mnt() to recycle the mounted gfs2 -file system, but it performs a system call fsconfig(4, FSCONFIG_CMD_RECONFIGURE, -NULL, NULL, 0) before executing the task exit operation. - -This will execute the following kernel path to complete the setting of -SDF_JOURNAL_LIVE for sd_flags: - -SYSCALL_DEFINE5(fsconfig, ..)-> - vfs_fsconfig_locked()-> - vfs_cmd_reconfigure()-> - gfs2_reconfigure()-> - gfs2_make_fs_rw()-> - set_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags); - -[Fix] -Add SDF_NORECOVERY check in gfs2_quota_cleanup() to avoid checking -SDF_JOURNAL_LIVE on the path where gfs2 is being unmounted. - -Reported-and-tested-by: syzbot+3b6e67ac2b646da57862@syzkaller.appspotmail.com -Fixes: f66af88e3321 ("gfs2: Stop using gfs2_make_fs_ro for withdraw") -Signed-off-by: Edward Adam Davis <eadavis@qq.com> -Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/gfs2/quota.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c -index 95dae7838b4e..f139ce8cf5ce 100644 ---- a/fs/gfs2/quota.c -+++ b/fs/gfs2/quota.c -@@ -1505,7 +1505,8 @@ void gfs2_quota_cleanup(struct gfs2_sbd *sdp) - LIST_HEAD(dispose); - int count; - -- BUG_ON(test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags)); -+ BUG_ON(!test_bit(SDF_NORECOVERY, &sdp->sd_flags) && -+ test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags)); - - spin_lock(&qd_lock); - list_for_each_entry(qd, &sdp->sd_quota_list, qd_list) { --- -2.43.2 - -From 45fb63af57edd0688885f97d340ff3c5274a327f Mon Sep 17 00:00:00 2001 -From: Alexander Aring <aahringo@redhat.com> -Date: Wed, 20 Dec 2023 14:38:58 -0500 -Subject: [PATCH 0102/1501] dlm: fix format seq ops type 4 -Content-Length: 1007 -Lines: 30 - -[ Upstream commit 367e753d5c54a414d82610eb709fe71fda6cf1c3 ] - -This patch fixes to set the type 4 format ops in case of table_open4(). -It got accidentially changed by commit 541adb0d4d10 ("fs: dlm: debugfs -for queued callbacks") and since them toss debug dumps the same format -as format 5 that are the queued ast callbacks for lkbs. - -Fixes: 541adb0d4d10 ("fs: dlm: debugfs for queued callbacks") -Signed-off-by: Alexander Aring <aahringo@redhat.com> -Signed-off-by: David Teigland <teigland@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/dlm/debug_fs.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/fs/dlm/debug_fs.c b/fs/dlm/debug_fs.c -index 42f332f46359..c587bfadeff4 100644 ---- a/fs/dlm/debug_fs.c -+++ b/fs/dlm/debug_fs.c -@@ -748,7 +748,7 @@ static int table_open4(struct inode *inode, struct file *file) - struct seq_file *seq; - int ret; - -- ret = seq_open(file, &format5_seq_ops); -+ ret = seq_open(file, &format4_seq_ops); - if (ret) - return ret; - --- -2.43.2 - -From 4d57e44db1a41fc1b435244e793be7fa1501a7c8 Mon Sep 17 00:00:00 2001 -From: wangyangxin <wangyangxin1@huawei.com> -Date: Mon, 11 Dec 2023 19:42:15 +0800 -Subject: [PATCH 0103/1501] crypto: virtio - Wait for tasklet to complete on - device remove -Content-Length: 1330 -Lines: 35 - -[ Upstream commit 67cc511e8d436456cc98033e6d4ba83ebfc8e672 ] - -The scheduled tasklet needs to be executed on device remove. - -Fixes: fed93fb62e05 ("crypto: virtio - Handle dataq logic with tasklet") -Signed-off-by: wangyangxin <wangyangxin1@huawei.com> -Signed-off-by: Gonglei <arei.gonglei@huawei.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/virtio/virtio_crypto_core.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/crypto/virtio/virtio_crypto_core.c b/drivers/crypto/virtio/virtio_crypto_core.c -index 428d76562447..b909c6a2bf1c 100644 ---- a/drivers/crypto/virtio/virtio_crypto_core.c -+++ b/drivers/crypto/virtio/virtio_crypto_core.c -@@ -500,12 +500,15 @@ static void virtcrypto_free_unused_reqs(struct virtio_crypto *vcrypto) - static void virtcrypto_remove(struct virtio_device *vdev) - { - struct virtio_crypto *vcrypto = vdev->priv; -+ int i; - - dev_info(&vdev->dev, "Start virtcrypto_remove.\n"); - - flush_work(&vcrypto->config_work); - if (virtcrypto_dev_started(vcrypto)) - virtcrypto_dev_stop(vcrypto); -+ for (i = 0; i < vcrypto->max_data_queues; i++) -+ tasklet_kill(&vcrypto->data_vq[i].done_task); - virtio_reset_device(vdev); - virtcrypto_free_unused_reqs(vcrypto); - virtcrypto_clear_crypto_engines(vcrypto); --- -2.43.2 - -From 1b1430bd3a20a535f84df3b528b9ef40cdc3891f Mon Sep 17 00:00:00 2001 -From: Ovidiu Panait <ovidiu.panait@windriver.com> -Date: Fri, 1 Dec 2023 19:06:25 +0200 -Subject: [PATCH 0104/1501] crypto: sahara - avoid skcipher fallback code - duplication -Content-Length: 4983 -Lines: 140 - -[ Upstream commit 01d70a4bbff20ea05cadb4c208841985a7cc6596 ] - -Factor out duplicated skcipher fallback handling code to a helper function -sahara_aes_fallback(). Also, keep a single check if fallback is required in -sahara_aes_crypt(). - -Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Stable-dep-of: d1d6351e37aa ("crypto: sahara - handle zero-length aes requests") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/sahara.c | 85 ++++++++++++----------------------------- - 1 file changed, 25 insertions(+), 60 deletions(-) - -diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c -index c4eb66d2e08d..0771c7160c47 100644 ---- a/drivers/crypto/sahara.c -+++ b/drivers/crypto/sahara.c -@@ -648,12 +648,37 @@ static int sahara_aes_setkey(struct crypto_skcipher *tfm, const u8 *key, - return crypto_skcipher_setkey(ctx->fallback, key, keylen); - } - -+static int sahara_aes_fallback(struct skcipher_request *req, unsigned long mode) -+{ -+ struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); -+ struct sahara_ctx *ctx = crypto_skcipher_ctx( -+ crypto_skcipher_reqtfm(req)); -+ -+ skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback); -+ skcipher_request_set_callback(&rctx->fallback_req, -+ req->base.flags, -+ req->base.complete, -+ req->base.data); -+ skcipher_request_set_crypt(&rctx->fallback_req, req->src, -+ req->dst, req->cryptlen, req->iv); -+ -+ if (mode & FLAGS_ENCRYPT) -+ return crypto_skcipher_encrypt(&rctx->fallback_req); -+ -+ return crypto_skcipher_decrypt(&rctx->fallback_req); -+} -+ - static int sahara_aes_crypt(struct skcipher_request *req, unsigned long mode) - { - struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); -+ struct sahara_ctx *ctx = crypto_skcipher_ctx( -+ crypto_skcipher_reqtfm(req)); - struct sahara_dev *dev = dev_ptr; - int err = 0; - -+ if (unlikely(ctx->keylen != AES_KEYSIZE_128)) -+ return sahara_aes_fallback(req, mode); -+ - dev_dbg(dev->device, "nbytes: %d, enc: %d, cbc: %d\n", - req->cryptlen, !!(mode & FLAGS_ENCRYPT), !!(mode & FLAGS_CBC)); - -@@ -676,81 +701,21 @@ static int sahara_aes_crypt(struct skcipher_request *req, unsigned long mode) - - static int sahara_aes_ecb_encrypt(struct skcipher_request *req) - { -- struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); -- struct sahara_ctx *ctx = crypto_skcipher_ctx( -- crypto_skcipher_reqtfm(req)); -- -- if (unlikely(ctx->keylen != AES_KEYSIZE_128)) { -- skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback); -- skcipher_request_set_callback(&rctx->fallback_req, -- req->base.flags, -- req->base.complete, -- req->base.data); -- skcipher_request_set_crypt(&rctx->fallback_req, req->src, -- req->dst, req->cryptlen, req->iv); -- return crypto_skcipher_encrypt(&rctx->fallback_req); -- } -- - return sahara_aes_crypt(req, FLAGS_ENCRYPT); - } - - static int sahara_aes_ecb_decrypt(struct skcipher_request *req) - { -- struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); -- struct sahara_ctx *ctx = crypto_skcipher_ctx( -- crypto_skcipher_reqtfm(req)); -- -- if (unlikely(ctx->keylen != AES_KEYSIZE_128)) { -- skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback); -- skcipher_request_set_callback(&rctx->fallback_req, -- req->base.flags, -- req->base.complete, -- req->base.data); -- skcipher_request_set_crypt(&rctx->fallback_req, req->src, -- req->dst, req->cryptlen, req->iv); -- return crypto_skcipher_decrypt(&rctx->fallback_req); -- } -- - return sahara_aes_crypt(req, 0); - } - - static int sahara_aes_cbc_encrypt(struct skcipher_request *req) - { -- struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); -- struct sahara_ctx *ctx = crypto_skcipher_ctx( -- crypto_skcipher_reqtfm(req)); -- -- if (unlikely(ctx->keylen != AES_KEYSIZE_128)) { -- skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback); -- skcipher_request_set_callback(&rctx->fallback_req, -- req->base.flags, -- req->base.complete, -- req->base.data); -- skcipher_request_set_crypt(&rctx->fallback_req, req->src, -- req->dst, req->cryptlen, req->iv); -- return crypto_skcipher_encrypt(&rctx->fallback_req); -- } -- - return sahara_aes_crypt(req, FLAGS_ENCRYPT | FLAGS_CBC); - } - - static int sahara_aes_cbc_decrypt(struct skcipher_request *req) - { -- struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); -- struct sahara_ctx *ctx = crypto_skcipher_ctx( -- crypto_skcipher_reqtfm(req)); -- -- if (unlikely(ctx->keylen != AES_KEYSIZE_128)) { -- skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback); -- skcipher_request_set_callback(&rctx->fallback_req, -- req->base.flags, -- req->base.complete, -- req->base.data); -- skcipher_request_set_crypt(&rctx->fallback_req, req->src, -- req->dst, req->cryptlen, req->iv); -- return crypto_skcipher_decrypt(&rctx->fallback_req); -- } -- - return sahara_aes_crypt(req, FLAGS_CBC); - } - --- -2.43.2 - -From 73c999bf9e18f2294246053fd8e879a748e5584f Mon Sep 17 00:00:00 2001 -From: Ovidiu Panait <ovidiu.panait@windriver.com> -Date: Sun, 24 Dec 2023 10:21:31 +0200 -Subject: [PATCH 0105/1501] crypto: sahara - handle zero-length aes requests -Content-Length: 900 -Lines: 28 - -[ Upstream commit d1d6351e37aac14b32a291731d0855996c459d11 ] - -In case of a zero-length input, exit gracefully from sahara_aes_crypt(). - -Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.") -Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/sahara.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c -index 0771c7160c47..78666b82ac80 100644 ---- a/drivers/crypto/sahara.c -+++ b/drivers/crypto/sahara.c -@@ -676,6 +676,9 @@ static int sahara_aes_crypt(struct skcipher_request *req, unsigned long mode) - struct sahara_dev *dev = dev_ptr; - int err = 0; - -+ if (!req->cryptlen) -+ return 0; -+ - if (unlikely(ctx->keylen != AES_KEYSIZE_128)) - return sahara_aes_fallback(req, mode); - --- -2.43.2 - -From 350dd5a9cc19a24da266e19b7a51a978e6304edf Mon Sep 17 00:00:00 2001 -From: Ovidiu Panait <ovidiu.panait@windriver.com> -Date: Sun, 24 Dec 2023 10:21:32 +0200 -Subject: [PATCH 0106/1501] crypto: sahara - fix ahash reqsize -Content-Length: 1002 -Lines: 29 - -[ Upstream commit efcb50f41740ac55e6ccc4986c1a7740e21c62b4 ] - -Set the reqsize for sha algorithms to sizeof(struct sahara_sha_reqctx), the -extra space is not needed. - -Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256") -Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/sahara.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c -index 78666b82ac80..31973e6ce520 100644 ---- a/drivers/crypto/sahara.c -+++ b/drivers/crypto/sahara.c -@@ -1162,8 +1162,7 @@ static int sahara_sha_import(struct ahash_request *req, const void *in) - static int sahara_sha_cra_init(struct crypto_tfm *tfm) - { - crypto_ahash_set_reqsize(__crypto_ahash_cast(tfm), -- sizeof(struct sahara_sha_reqctx) + -- SHA_BUFFER_LEN + SHA256_BLOCK_SIZE); -+ sizeof(struct sahara_sha_reqctx)); - - return 0; - } --- -2.43.2 - -From 2193b2467e3987fcb77531149afb94152ce27a22 Mon Sep 17 00:00:00 2001 -From: Ovidiu Panait <ovidiu.panait@windriver.com> -Date: Sun, 24 Dec 2023 10:21:33 +0200 -Subject: [PATCH 0107/1501] crypto: sahara - fix wait_for_completion_timeout() - error handling -Content-Length: 1880 -Lines: 62 - -[ Upstream commit 2dba8e1d1a7957dcbe7888846268538847b471d1 ] - -The sg lists are not unmapped in case of timeout errors. Fix this. - -Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256") -Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.") -Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/sahara.c | 18 ++++++++++-------- - 1 file changed, 10 insertions(+), 8 deletions(-) - -diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c -index 31973e6ce520..3661f02d131a 100644 ---- a/drivers/crypto/sahara.c -+++ b/drivers/crypto/sahara.c -@@ -607,16 +607,17 @@ static int sahara_aes_process(struct skcipher_request *req) - - timeout = wait_for_completion_timeout(&dev->dma_completion, - msecs_to_jiffies(SAHARA_TIMEOUT_MS)); -- if (!timeout) { -- dev_err(dev->device, "AES timeout\n"); -- return -ETIMEDOUT; -- } - - dma_unmap_sg(dev->device, dev->out_sg, dev->nb_out_sg, - DMA_FROM_DEVICE); - dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg, - DMA_TO_DEVICE); - -+ if (!timeout) { -+ dev_err(dev->device, "AES timeout\n"); -+ return -ETIMEDOUT; -+ } -+ - if ((dev->flags & FLAGS_CBC) && req->iv) - sahara_aes_cbc_update_iv(req); - -@@ -1007,15 +1008,16 @@ static int sahara_sha_process(struct ahash_request *req) - - timeout = wait_for_completion_timeout(&dev->dma_completion, - msecs_to_jiffies(SAHARA_TIMEOUT_MS)); -- if (!timeout) { -- dev_err(dev->device, "SHA timeout\n"); -- return -ETIMEDOUT; -- } - - if (rctx->sg_in_idx) - dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg, - DMA_TO_DEVICE); - -+ if (!timeout) { -+ dev_err(dev->device, "SHA timeout\n"); -+ return -ETIMEDOUT; -+ } -+ - memcpy(rctx->context, dev->context_base, rctx->context_size); - - if (req->result && rctx->last) --- -2.43.2 - -From cc9b6af87d21173baf5de95c850e5c86c476d5df Mon Sep 17 00:00:00 2001 -From: Ovidiu Panait <ovidiu.panait@windriver.com> -Date: Sun, 24 Dec 2023 10:21:34 +0200 -Subject: [PATCH 0108/1501] crypto: sahara - improve error handling in - sahara_sha_process() -Content-Length: 1417 -Lines: 43 - -[ Upstream commit 5deff027fca49a1eb3b20359333cf2ae562a2343 ] - -sahara_sha_hw_data_descriptor_create() returns negative error codes on -failure, so make sure the errors are correctly handled / propagated. - -Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256") -Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/sahara.c | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - -diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c -index 3661f02d131a..cfb02905c1ab 100644 ---- a/drivers/crypto/sahara.c -+++ b/drivers/crypto/sahara.c -@@ -987,7 +987,10 @@ static int sahara_sha_process(struct ahash_request *req) - return ret; - - if (rctx->first) { -- sahara_sha_hw_data_descriptor_create(dev, rctx, req, 0); -+ ret = sahara_sha_hw_data_descriptor_create(dev, rctx, req, 0); -+ if (ret) -+ return ret; -+ - dev->hw_desc[0]->next = 0; - rctx->first = 0; - } else { -@@ -995,7 +998,10 @@ static int sahara_sha_process(struct ahash_request *req) - - sahara_sha_hw_context_descriptor_create(dev, rctx, req, 0); - dev->hw_desc[0]->next = dev->hw_phys_desc[1]; -- sahara_sha_hw_data_descriptor_create(dev, rctx, req, 1); -+ ret = sahara_sha_hw_data_descriptor_create(dev, rctx, req, 1); -+ if (ret) -+ return ret; -+ - dev->hw_desc[1]->next = 0; - } - --- -2.43.2 - -From 12c7bc0d9f15d130b133830f8c93bd503fcfa115 Mon Sep 17 00:00:00 2001 -From: Ovidiu Panait <ovidiu.panait@windriver.com> -Date: Sun, 24 Dec 2023 10:21:35 +0200 -Subject: [PATCH 0109/1501] crypto: sahara - fix processing hash requests with - req->nbytes < sg->length -Content-Length: 1506 -Lines: 47 - -[ Upstream commit 7bafa74d1ba35dcc173e1ce915e983d65905f77e ] - -It's not always the case that the entire sg entry needs to be processed. -Currently, when nbytes is less than sg->length, "Descriptor length" errors -are encountered. - -To fix this, take the actual request size into account when populating the -hw links. - -Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256") -Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/sahara.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c -index cfb02905c1ab..dd8291a4442c 100644 ---- a/drivers/crypto/sahara.c -+++ b/drivers/crypto/sahara.c -@@ -776,6 +776,7 @@ static int sahara_sha_hw_links_create(struct sahara_dev *dev, - int start) - { - struct scatterlist *sg; -+ unsigned int len; - unsigned int i; - int ret; - -@@ -797,12 +798,14 @@ static int sahara_sha_hw_links_create(struct sahara_dev *dev, - if (!ret) - return -EFAULT; - -+ len = rctx->total; - for (i = start; i < dev->nb_in_sg + start; i++) { -- dev->hw_link[i]->len = sg->length; -+ dev->hw_link[i]->len = min(len, sg->length); - dev->hw_link[i]->p = sg->dma_address; - if (i == (dev->nb_in_sg + start - 1)) { - dev->hw_link[i]->next = 0; - } else { -+ len -= min(len, sg->length); - dev->hw_link[i]->next = dev->hw_phys_link[i + 1]; - sg = sg_next(sg); - } --- -2.43.2 - -From b1eb1f817f7139461820643c5e2d84297fbdf1df Mon Sep 17 00:00:00 2001 -From: Ovidiu Panait <ovidiu.panait@windriver.com> -Date: Sun, 24 Dec 2023 10:21:36 +0200 -Subject: [PATCH 0110/1501] crypto: sahara - do not resize req->src when doing - hash operations -Content-Length: 2879 -Lines: 91 - -[ Upstream commit a3c6f4f4d249cecaf2f34471aadbfb4f4ef57298 ] - -When testing sahara sha256 speed performance with tcrypt (mode=404) on -imx53-qsrb board, multiple "Invalid numbers of src SG." errors are -reported. This was traced to sahara_walk_and_recalc() resizing req->src -and causing the subsequent dma_map_sg() call to fail. - -Now that the previous commit fixed sahara_sha_hw_links_create() to take -into account the actual request size, rather than relying on sg->length -values, the resize operation is no longer necessary. - -Therefore, remove sahara_walk_and_recalc() and simplify associated logic. - -Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256") -Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/sahara.c | 38 ++------------------------------------ - 1 file changed, 2 insertions(+), 36 deletions(-) - -diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c -index dd8291a4442c..fabe4f381fb6 100644 ---- a/drivers/crypto/sahara.c -+++ b/drivers/crypto/sahara.c -@@ -886,24 +886,6 @@ static int sahara_sha_hw_context_descriptor_create(struct sahara_dev *dev, - return 0; - } - --static int sahara_walk_and_recalc(struct scatterlist *sg, unsigned int nbytes) --{ -- if (!sg || !sg->length) -- return nbytes; -- -- while (nbytes && sg) { -- if (nbytes <= sg->length) { -- sg->length = nbytes; -- sg_mark_end(sg); -- break; -- } -- nbytes -= sg->length; -- sg = sg_next(sg); -- } -- -- return nbytes; --} -- - static int sahara_sha_prepare_request(struct ahash_request *req) - { - struct crypto_ahash *tfm = crypto_ahash_reqtfm(req); -@@ -940,36 +922,20 @@ static int sahara_sha_prepare_request(struct ahash_request *req) - hash_later, 0); - } - -- /* nbytes should now be multiple of blocksize */ -- req->nbytes = req->nbytes - hash_later; -- -- sahara_walk_and_recalc(req->src, req->nbytes); -- -+ rctx->total = len - hash_later; - /* have data from previous operation and current */ - if (rctx->buf_cnt && req->nbytes) { - sg_init_table(rctx->in_sg_chain, 2); - sg_set_buf(rctx->in_sg_chain, rctx->rembuf, rctx->buf_cnt); -- - sg_chain(rctx->in_sg_chain, 2, req->src); -- -- rctx->total = req->nbytes + rctx->buf_cnt; - rctx->in_sg = rctx->in_sg_chain; -- -- req->src = rctx->in_sg_chain; - /* only data from previous operation */ - } else if (rctx->buf_cnt) { -- if (req->src) -- rctx->in_sg = req->src; -- else -- rctx->in_sg = rctx->in_sg_chain; -- /* buf was copied into rembuf above */ -+ rctx->in_sg = rctx->in_sg_chain; - sg_init_one(rctx->in_sg, rctx->rembuf, rctx->buf_cnt); -- rctx->total = rctx->buf_cnt; - /* no data from previous operation */ - } else { - rctx->in_sg = req->src; -- rctx->total = req->nbytes; -- req->src = rctx->in_sg; - } - - /* on next call, we only have the remaining data in the buffer */ --- -2.43.2 - -From d76718ca20b40c587997087cff547bf160f93399 Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Wed, 10 Jan 2024 21:11:40 +0000 -Subject: [PATCH 0112/1501] keys, dns: Fix size check of V1 server-list header -Content-Length: 1359 -Lines: 37 - -[ Upstream commit acc657692aed438e9931438f8c923b2b107aebf9 ] - -Fix the size check added to dns_resolver_preparse() for the V1 server-list -header so that it doesn't give EINVAL if the size supplied is the same as -the size of the header struct (which should be valid). - -This can be tested with: - - echo -n -e '\0\0\01\xff\0\0' | keyctl padd dns_resolver desc @p - -which will give "add_key: Invalid argument" without this fix. - -Fixes: 1997b3cb4217 ("keys, dns: Fix missing size check of V1 server-list header") -Reported-by: Pengfei Xu <pengfei.xu@intel.com> -Link: https://lore.kernel.org/r/ZZ4fyY4r3rqgZL+4@xpf.sh.intel.com/ -Signed-off-by: David Howells <dhowells@redhat.com> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/dns_resolver/dns_key.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c -index f18ca02aa95a..c42ddd85ff1f 100644 ---- a/net/dns_resolver/dns_key.c -+++ b/net/dns_resolver/dns_key.c -@@ -104,7 +104,7 @@ dns_resolver_preparse(struct key_preparsed_payload *prep) - const struct dns_server_list_v1_header *v1; - - /* It may be a server list. */ -- if (datalen <= sizeof(*v1)) -+ if (datalen < sizeof(*v1)) - return -EINVAL; - - v1 = (const struct dns_server_list_v1_header *)data; --- -2.43.2 - -From 59b3715bc78bbbffc85686ab3e46082b1440d1ba Mon Sep 17 00:00:00 2001 -From: Arnd Bergmann <arnd@arndb.de> -Date: Mon, 6 Nov 2023 22:02:59 +0100 -Subject: [PATCH 0113/1501] csky: fix arch_jump_label_transform_static override -Content-Length: 1465 -Lines: 37 - -[ Upstream commit ca8e45c8048a2c9503c74751d25414601f730580 ] - -The arch_jump_label_transform_static() function in csky was originally meant to -override the generic __weak function, but that got changed to an #ifndef check. - -This showed up as a missing-prototype warning: -arch/csky/kernel/jump_label.c:43:6: error: no previous prototype for 'arch_jump_label_transform_static' [-Werror=missing-prototypes] - -Change the method to use the new method of having a #define and a prototype -for the global function. - -Fixes: 7e6b9db27de9 ("jump_label: make initial NOP patching the special case") -Fixes: 4e8bb4ba5a55 ("csky: Add jump-label implementation") -Reviewed-by: Guo Ren <guoren@kernel.org> -Signed-off-by: Arnd Bergmann <arnd@arndb.de> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/csky/include/asm/jump_label.h | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/arch/csky/include/asm/jump_label.h b/arch/csky/include/asm/jump_label.h -index d488ba6084bc..98a3f4b168bd 100644 ---- a/arch/csky/include/asm/jump_label.h -+++ b/arch/csky/include/asm/jump_label.h -@@ -43,5 +43,10 @@ static __always_inline bool arch_static_branch_jump(struct static_key *key, - return true; - } - -+enum jump_label_type; -+void arch_jump_label_transform_static(struct jump_entry *entry, -+ enum jump_label_type type); -+#define arch_jump_label_transform_static arch_jump_label_transform_static -+ - #endif /* __ASSEMBLY__ */ - #endif /* __ASM_CSKY_JUMP_LABEL_H */ --- -2.43.2 - -From 17e6fc0688e0e7c9972b166fd0ab0a0ab04c08e8 Mon Sep 17 00:00:00 2001 -From: Benjamin Coddington <bcodding@redhat.com> -Date: Tue, 5 Dec 2023 10:05:01 -0500 -Subject: [PATCH 0114/1501] blocklayoutdriver: Fix reference leak of - pnfs_device_node -Content-Length: 968 -Lines: 29 - -[ Upstream commit 1530827b90025cdf80c9b0d07a166d045a0a7b81 ] - -The error path for blocklayout's device lookup is missing a reference drop -for the case where a lookup finds the device, but the device is marked with -NFS_DEVICEID_UNAVAILABLE. - -Fixes: b3dce6a2f060 ("pnfs/blocklayout: handle transient devices") -Signed-off-by: Benjamin Coddington <bcodding@redhat.com> -Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/nfs/blocklayout/blocklayout.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c -index 943aeea1eb16..1d1d7abc3205 100644 ---- a/fs/nfs/blocklayout/blocklayout.c -+++ b/fs/nfs/blocklayout/blocklayout.c -@@ -580,6 +580,8 @@ bl_find_get_deviceid(struct nfs_server *server, - nfs4_delete_deviceid(node->ld, node->nfs_client, id); - goto retry; - } -+ -+ nfs4_put_deviceid_node(node); - return ERR_PTR(-ENODEV); - } - --- -2.43.2 - -From 16b859e6ec7f8730edc2173316f217595636269c Mon Sep 17 00:00:00 2001 -From: Scott Mayhew <smayhew@redhat.com> -Date: Tue, 5 Dec 2023 09:10:54 -0500 -Subject: [PATCH 0115/1501] NFS: Use parent's objective cred in - nfs_access_login_time() -Content-Length: 1117 -Lines: 32 - -[ Upstream commit a10a9233073d984b239e22358ba21825e27e2e88 ] - -The subjective cred (task->cred) can potentially be overridden and -subsquently freed in non-RCU context, which could lead to a panic if we -try to use it in cred_fscmp(). Use __task_cred(), which returns the -objective cred (task->real_cred) instead. - -Fixes: 0eb43812c027 ("NFS: Clear the file access cache upon login") -Fixes: 5e9a7b9c2ea1 ("NFS: Fix up a sparse warning") - -Signed-off-by: Scott Mayhew <smayhew@redhat.com> -Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/nfs/dir.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c -index 13dffe4201e6..273c0b68abf4 100644 ---- a/fs/nfs/dir.c -+++ b/fs/nfs/dir.c -@@ -2963,7 +2963,7 @@ static u64 nfs_access_login_time(const struct task_struct *task, - rcu_read_lock(); - for (;;) { - parent = rcu_dereference(task->real_parent); -- pcred = rcu_dereference(parent->cred); -+ pcred = __task_cred(parent); - if (parent == task || cred_fscmp(pcred, cred) != 0) - break; - task = parent; --- -2.43.2 - -From b1a3d07b150abd8426ba0b854a4173cf0acbb3fa Mon Sep 17 00:00:00 2001 -From: Trond Myklebust <trond.myklebust@hammerspace.com> -Date: Wed, 15 Nov 2023 13:55:29 -0500 -Subject: [PATCH 0116/1501] NFSv4.1/pnfs: Ensure we handle the error - NFS4ERR_RETURNCONFLICT -Content-Length: 1488 -Lines: 45 - -[ Upstream commit 037e56a22ff37f9a9c2330b66cff55d3d1ff9b90 ] - -Once the client has processed the CB_LAYOUTRECALL, but has not yet -successfully returned the layout, the server is supposed to switch to -returning NFS4ERR_RETURNCONFLICT. This patch ensures that we handle -that return value correctly. - -Fixes: 183d9e7b112a ("pnfs: rework LAYOUTGET retry handling") -Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com> -Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/nfs/nfs4proc.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 8a943fffaad5..23819a756508 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -170,6 +170,7 @@ static int nfs4_map_errors(int err) - case -NFS4ERR_RESOURCE: - case -NFS4ERR_LAYOUTTRYLATER: - case -NFS4ERR_RECALLCONFLICT: -+ case -NFS4ERR_RETURNCONFLICT: - return -EREMOTEIO; - case -NFS4ERR_WRONGSEC: - case -NFS4ERR_WRONG_CRED: -@@ -558,6 +559,7 @@ static int nfs4_do_handle_exception(struct nfs_server *server, - case -NFS4ERR_GRACE: - case -NFS4ERR_LAYOUTTRYLATER: - case -NFS4ERR_RECALLCONFLICT: -+ case -NFS4ERR_RETURNCONFLICT: - exception->delay = 1; - return 0; - -@@ -9691,6 +9693,7 @@ nfs4_layoutget_handle_exception(struct rpc_task *task, - status = -EBUSY; - break; - case -NFS4ERR_RECALLCONFLICT: -+ case -NFS4ERR_RETURNCONFLICT: - status = -ERECALLCONFLICT; - break; - case -NFS4ERR_DELEG_REVOKED: --- -2.43.2 - -From 242f80e20b9e8b36dd69f8dab40632d30b2ccd54 Mon Sep 17 00:00:00 2001 -From: Olga Kornievskaia <kolga@netapp.com> -Date: Fri, 1 Dec 2023 14:42:03 -0500 -Subject: [PATCH 0117/1501] SUNRPC: fix _xprt_switch_find_current_entry logic -Content-Length: 944 -Lines: 27 - -[ Upstream commit 98b4e5137504a5bd9346562b1310cdc13486603b ] - -Fix the logic for picking current transport entry. - -Fixes: 95d0d30c66b8 ("SUNRPC create an iterator to list only OFFLINE xprts") -Signed-off-by: Olga Kornievskaia <kolga@netapp.com> -Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/sunrpc/xprtmultipath.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/sunrpc/xprtmultipath.c b/net/sunrpc/xprtmultipath.c -index 701250b305db..74ee2271251e 100644 ---- a/net/sunrpc/xprtmultipath.c -+++ b/net/sunrpc/xprtmultipath.c -@@ -284,7 +284,7 @@ struct rpc_xprt *_xprt_switch_find_current_entry(struct list_head *head, - if (cur == pos) - found = true; - if (found && ((find_active && xprt_is_active(pos)) || -- (!find_active && xprt_is_active(pos)))) -+ (!find_active && !xprt_is_active(pos)))) - return pos; - } - return NULL; --- -2.43.2 - -From a075613766994c8673c1f2d3cd05d86baa5dd233 Mon Sep 17 00:00:00 2001 -From: Trond Myklebust <trond.myklebust@hammerspace.com> -Date: Fri, 17 Nov 2023 06:25:13 -0500 -Subject: [PATCH 0118/1501] pNFS: Fix the pnfs block driver's calculation of - layoutget size -Content-Length: 3229 -Lines: 84 - -[ Upstream commit 8a6291bf3b0eae1bf26621e6419a91682f2d6227 ] - -Instead of relying on the value of the 'bytes_left' field, we should -calculate the layout size based on the offset of the request that is -being written out. - -Reported-by: Benjamin Coddington <bcodding@redhat.com> -Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com> -Fixes: 954998b60caa ("NFS: Fix error handling for O_DIRECT write scheduling") -Reviewed-by: Benjamin Coddington <bcodding@redhat.com> -Tested-by: Benjamin Coddington <bcodding@redhat.com> -Reviewed-by: Christoph Hellwig <hch@lst.de> -Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/nfs/blocklayout/blocklayout.c | 5 ++--- - fs/nfs/direct.c | 5 +++-- - fs/nfs/internal.h | 2 +- - fs/nfs/pnfs.c | 3 ++- - 4 files changed, 8 insertions(+), 7 deletions(-) - -diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c -index 1d1d7abc3205..6be13e0ec170 100644 ---- a/fs/nfs/blocklayout/blocklayout.c -+++ b/fs/nfs/blocklayout/blocklayout.c -@@ -895,10 +895,9 @@ bl_pg_init_write(struct nfs_pageio_descriptor *pgio, struct nfs_page *req) - } - - if (pgio->pg_dreq == NULL) -- wb_size = pnfs_num_cont_bytes(pgio->pg_inode, -- req->wb_index); -+ wb_size = pnfs_num_cont_bytes(pgio->pg_inode, req->wb_index); - else -- wb_size = nfs_dreq_bytes_left(pgio->pg_dreq); -+ wb_size = nfs_dreq_bytes_left(pgio->pg_dreq, req_offset(req)); - - pnfs_generic_pg_init_write(pgio, req, wb_size); - -diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c -index f6c74f424691..5918c67dae0d 100644 ---- a/fs/nfs/direct.c -+++ b/fs/nfs/direct.c -@@ -205,9 +205,10 @@ static void nfs_direct_req_release(struct nfs_direct_req *dreq) - kref_put(&dreq->kref, nfs_direct_req_free); - } - --ssize_t nfs_dreq_bytes_left(struct nfs_direct_req *dreq) -+ssize_t nfs_dreq_bytes_left(struct nfs_direct_req *dreq, loff_t offset) - { -- return dreq->bytes_left; -+ loff_t start = offset - dreq->io_start; -+ return dreq->max_count - start; - } - EXPORT_SYMBOL_GPL(nfs_dreq_bytes_left); - -diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h -index 9c9cf764f600..b1fa81c9dff6 100644 ---- a/fs/nfs/internal.h -+++ b/fs/nfs/internal.h -@@ -655,7 +655,7 @@ extern int nfs_sillyrename(struct inode *dir, struct dentry *dentry); - /* direct.c */ - void nfs_init_cinfo_from_dreq(struct nfs_commit_info *cinfo, - struct nfs_direct_req *dreq); --extern ssize_t nfs_dreq_bytes_left(struct nfs_direct_req *dreq); -+extern ssize_t nfs_dreq_bytes_left(struct nfs_direct_req *dreq, loff_t offset); - - /* nfs4proc.c */ - extern struct nfs_client *nfs4_init_client(struct nfs_client *clp, -diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c -index 21a365357629..0c0fed1ecd0b 100644 ---- a/fs/nfs/pnfs.c -+++ b/fs/nfs/pnfs.c -@@ -2733,7 +2733,8 @@ pnfs_generic_pg_init_read(struct nfs_pageio_descriptor *pgio, struct nfs_page *r - if (pgio->pg_dreq == NULL) - rd_size = i_size_read(pgio->pg_inode) - req_offset(req); - else -- rd_size = nfs_dreq_bytes_left(pgio->pg_dreq); -+ rd_size = nfs_dreq_bytes_left(pgio->pg_dreq, -+ req_offset(req)); - - pgio->pg_lseg = - pnfs_update_layout(pgio->pg_inode, nfs_req_openctx(req), --- -2.43.2 - -From 2eb1d9ae8cd093c4d351b5aef4ef85bccf004014 Mon Sep 17 00:00:00 2001 -From: Benjamin Coddington <bcodding@redhat.com> -Date: Thu, 4 Jan 2024 09:58:45 -0500 -Subject: [PATCH 0119/1501] SUNRPC: Fixup v4.1 backchannel request timeouts -Content-Length: 3599 -Lines: 99 - -[ Upstream commit e6f533b615971afcaa1141573a1a1714d9d4f31a ] - -After commit 59464b262ff5 ("SUNRPC: SOFTCONN tasks should time out when on -the sending list"), any 4.1 backchannel tasks placed on the sending queue -would immediately return with -ETIMEDOUT since their req timers are zero. - -Initialize the backchannel's rpc_rqst timeout parameters from the xprt's -default timeout settings. - -Fixes: 59464b262ff5 ("SUNRPC: SOFTCONN tasks should time out when on the sending list") -Signed-off-by: Benjamin Coddington <bcodding@redhat.com> -Tested-by: Chuck Lever <chuck.lever@oracle.com> -Tested-by: Jeff Layton <jlayton@kernel.org> -Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/sunrpc/xprt.c | 23 ++++++++++++++--------- - 1 file changed, 14 insertions(+), 9 deletions(-) - -diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c -index 2364c485540c..6cc9ffac962d 100644 ---- a/net/sunrpc/xprt.c -+++ b/net/sunrpc/xprt.c -@@ -651,9 +651,9 @@ static unsigned long xprt_abs_ktime_to_jiffies(ktime_t abstime) - jiffies + nsecs_to_jiffies(-delta); - } - --static unsigned long xprt_calc_majortimeo(struct rpc_rqst *req) -+static unsigned long xprt_calc_majortimeo(struct rpc_rqst *req, -+ const struct rpc_timeout *to) - { -- const struct rpc_timeout *to = req->rq_task->tk_client->cl_timeout; - unsigned long majortimeo = req->rq_timeout; - - if (to->to_exponential) -@@ -665,9 +665,10 @@ static unsigned long xprt_calc_majortimeo(struct rpc_rqst *req) - return majortimeo; - } - --static void xprt_reset_majortimeo(struct rpc_rqst *req) -+static void xprt_reset_majortimeo(struct rpc_rqst *req, -+ const struct rpc_timeout *to) - { -- req->rq_majortimeo += xprt_calc_majortimeo(req); -+ req->rq_majortimeo += xprt_calc_majortimeo(req, to); - } - - static void xprt_reset_minortimeo(struct rpc_rqst *req) -@@ -675,7 +676,8 @@ static void xprt_reset_minortimeo(struct rpc_rqst *req) - req->rq_minortimeo += req->rq_timeout; - } - --static void xprt_init_majortimeo(struct rpc_task *task, struct rpc_rqst *req) -+static void xprt_init_majortimeo(struct rpc_task *task, struct rpc_rqst *req, -+ const struct rpc_timeout *to) - { - unsigned long time_init; - struct rpc_xprt *xprt = req->rq_xprt; -@@ -684,8 +686,9 @@ static void xprt_init_majortimeo(struct rpc_task *task, struct rpc_rqst *req) - time_init = jiffies; - else - time_init = xprt_abs_ktime_to_jiffies(task->tk_start); -- req->rq_timeout = task->tk_client->cl_timeout->to_initval; -- req->rq_majortimeo = time_init + xprt_calc_majortimeo(req); -+ -+ req->rq_timeout = to->to_initval; -+ req->rq_majortimeo = time_init + xprt_calc_majortimeo(req, to); - req->rq_minortimeo = time_init + req->rq_timeout; - } - -@@ -713,7 +716,7 @@ int xprt_adjust_timeout(struct rpc_rqst *req) - } else { - req->rq_timeout = to->to_initval; - req->rq_retries = 0; -- xprt_reset_majortimeo(req); -+ xprt_reset_majortimeo(req, to); - /* Reset the RTT counters == "slow start" */ - spin_lock(&xprt->transport_lock); - rpc_init_rtt(req->rq_task->tk_client->cl_rtt, to->to_initval); -@@ -1886,7 +1889,7 @@ xprt_request_init(struct rpc_task *task) - req->rq_snd_buf.bvec = NULL; - req->rq_rcv_buf.bvec = NULL; - req->rq_release_snd_buf = NULL; -- xprt_init_majortimeo(task, req); -+ xprt_init_majortimeo(task, req, task->tk_client->cl_timeout); - - trace_xprt_reserve(req); - } -@@ -1996,6 +1999,8 @@ xprt_init_bc_request(struct rpc_rqst *req, struct rpc_task *task) - */ - xbufp->len = xbufp->head[0].iov_len + xbufp->page_len + - xbufp->tail[0].iov_len; -+ -+ xprt_init_majortimeo(task, req, req->rq_xprt->timeout); - } - #endif - --- -2.43.2 - -From de8181191989301801c31ec73281e3b69a6f7880 Mon Sep 17 00:00:00 2001 -From: David McKay <david.mckay@codasip.com> -Date: Thu, 4 Jan 2024 09:40:10 +0000 -Subject: [PATCH 0120/1501] asm-generic: Fix 32 bit __generic_cmpxchg_local -Content-Length: 1233 -Lines: 31 - -[ Upstream commit d93cca2f3109f88c94a32d3322ec8b2854a9c339 ] - -Commit 656e9007ef58 ("asm-generic: avoid __generic_cmpxchg_local -warnings") introduced a typo that means the code is incorrect for 32 bit -values. It will work fine for postive numbers, but will fail for -negative numbers on a system where longs are 64 bit. - -Fixes: 656e9007ef58 ("asm-generic: avoid __generic_cmpxchg_local warnings") -Signed-off-by: David McKay <david.mckay@codasip.com> -Signed-off-by: Stuart Menefy <stuart.menefy@codasip.com> -Signed-off-by: Arnd Bergmann <arnd@arndb.de> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/asm-generic/cmpxchg-local.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/include/asm-generic/cmpxchg-local.h b/include/asm-generic/cmpxchg-local.h -index 3df9f59a544e..f27d66fdc00a 100644 ---- a/include/asm-generic/cmpxchg-local.h -+++ b/include/asm-generic/cmpxchg-local.h -@@ -34,7 +34,7 @@ static inline unsigned long __generic_cmpxchg_local(volatile void *ptr, - *(u16 *)ptr = (new & 0xffffu); - break; - case 4: prev = *(u32 *)ptr; -- if (prev == (old & 0xffffffffffu)) -+ if (prev == (old & 0xffffffffu)) - *(u32 *)ptr = (new & 0xffffffffu); - break; - case 8: prev = *(u64 *)ptr; --- -2.43.2 - -From 34adcb506e5864d23375184e563e2c2fbebf46b8 Mon Sep 17 00:00:00 2001 -From: Chih-Kang Chang <gary.chang@realtek.com> -Date: Fri, 3 Nov 2023 10:08:51 +0800 -Subject: [PATCH 0126/1501] wifi: rtw88: fix RX filter in FIF_ALLMULTI flag -Content-Length: 1326 -Lines: 34 - -[ Upstream commit 53ee0b3b99edc6a47096bffef15695f5a895386f ] - -The broadcast packets will be filtered in the FIF_ALLMULTI flag in -the original code, which causes beacon packets to be filtered out -and disconnection. Therefore, we fix it. - -Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver") -Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com> -Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://lore.kernel.org/r/20231103020851.102238-1-pkshih@realtek.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/realtek/rtw88/mac80211.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/wireless/realtek/rtw88/mac80211.c b/drivers/net/wireless/realtek/rtw88/mac80211.c -index a99b53d44267..d8d68f16014e 100644 ---- a/drivers/net/wireless/realtek/rtw88/mac80211.c -+++ b/drivers/net/wireless/realtek/rtw88/mac80211.c -@@ -280,9 +280,9 @@ static void rtw_ops_configure_filter(struct ieee80211_hw *hw, - - if (changed_flags & FIF_ALLMULTI) { - if (*new_flags & FIF_ALLMULTI) -- rtwdev->hal.rcr |= BIT_AM | BIT_AB; -+ rtwdev->hal.rcr |= BIT_AM; - else -- rtwdev->hal.rcr &= ~(BIT_AM | BIT_AB); -+ rtwdev->hal.rcr &= ~(BIT_AM); - } - if (changed_flags & FIF_FCSFAIL) { - if (*new_flags & FIF_FCSFAIL) --- -2.43.2 - -From 06a7919489f2e310f6ba1ccd8c62e5b19189b6e0 Mon Sep 17 00:00:00 2001 -From: Florian Lehner <dev@der-flo.net> -Date: Sun, 5 Nov 2023 09:58:01 +0100 -Subject: [PATCH 0127/1501] bpf, lpm: Fix check prefixlen before walking trie -Status: RO -Content-Length: 1345 -Lines: 35 - -[ Upstream commit 9b75dbeb36fcd9fc7ed51d370310d0518a387769 ] - -When looking up an element in LPM trie, the condition 'matchlen == -trie->max_prefixlen' will never return true, if key->prefixlen is larger -than trie->max_prefixlen. Consequently all elements in the LPM trie will -be visited and no element is returned in the end. - -To resolve this, check key->prefixlen first before walking the LPM trie. - -Fixes: b95a5c4db09b ("bpf: add a longest prefix match trie map implementation") -Signed-off-by: Florian Lehner <dev@der-flo.net> -Signed-off-by: Andrii Nakryiko <andrii@kernel.org> -Link: https://lore.kernel.org/bpf/20231105085801.3742-1-dev@der-flo.net -Signed-off-by: Alexei Starovoitov <ast@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - kernel/bpf/lpm_trie.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c -index 17c7e7782a1f..b32be680da6c 100644 ---- a/kernel/bpf/lpm_trie.c -+++ b/kernel/bpf/lpm_trie.c -@@ -231,6 +231,9 @@ static void *trie_lookup_elem(struct bpf_map *map, void *_key) - struct lpm_trie_node *node, *found = NULL; - struct bpf_lpm_trie_key *key = _key; - -+ if (key->prefixlen > trie->max_prefixlen) -+ return NULL; -+ - /* Start walking the trie from the root node ... */ - - for (node = rcu_dereference_check(trie->root, rcu_read_lock_bh_held()); --- -2.43.2 - -From eb214e4b7776e84abc8ac9aaf840585726a61329 Mon Sep 17 00:00:00 2001 -From: Dave Marchevsky <davemarchevsky@fb.com> -Date: Tue, 7 Nov 2023 00:56:34 -0800 -Subject: [PATCH 0128/1501] bpf: Add KF_RCU flag to bpf_refcount_acquire_impl -Content-Length: 2283 -Lines: 48 - -[ Upstream commit 1500a5d9f49cb66906d3ea1c9158df25cc41dd40 ] - -Refcounted local kptrs are kptrs to user-defined types with a -bpf_refcount field. Recent commits ([0], [1]) modified the lifetime of -refcounted local kptrs such that the underlying memory is not reused -until RCU grace period has elapsed. - -Separately, verification of bpf_refcount_acquire calls currently -succeeds for MAYBE_NULL non-owning reference input, which is a problem -as bpf_refcount_acquire_impl has no handling for this case. - -This patch takes advantage of aforementioned lifetime changes to tag -bpf_refcount_acquire_impl kfunc KF_RCU, thereby preventing MAYBE_NULL -input to the kfunc. The KF_RCU flag applies to all kfunc params; it's -fine for it to apply to the void *meta__ign param as that's populated by -the verifier and is tagged __ign regardless. - - [0]: commit 7e26cd12ad1c ("bpf: Use bpf_mem_free_rcu when - bpf_obj_dropping refcounted nodes") is the actual change to - allocation behaivor - [1]: commit 0816b8c6bf7f ("bpf: Consider non-owning refs to refcounted - nodes RCU protected") modified verifier understanding of - refcounted local kptrs to match [0]'s changes - -Signed-off-by: Dave Marchevsky <davemarchevsky@fb.com> -Fixes: 7c50b1cb76ac ("bpf: Add bpf_refcount_acquire kfunc") -Link: https://lore.kernel.org/r/20231107085639.3016113-2-davemarchevsky@fb.com -Signed-off-by: Alexei Starovoitov <ast@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - kernel/bpf/helpers.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c -index 56b0c1f678ee..6950f0461634 100644 ---- a/kernel/bpf/helpers.c -+++ b/kernel/bpf/helpers.c -@@ -2520,7 +2520,7 @@ BTF_ID_FLAGS(func, bpf_obj_new_impl, KF_ACQUIRE | KF_RET_NULL) - BTF_ID_FLAGS(func, bpf_percpu_obj_new_impl, KF_ACQUIRE | KF_RET_NULL) - BTF_ID_FLAGS(func, bpf_obj_drop_impl, KF_RELEASE) - BTF_ID_FLAGS(func, bpf_percpu_obj_drop_impl, KF_RELEASE) --BTF_ID_FLAGS(func, bpf_refcount_acquire_impl, KF_ACQUIRE | KF_RET_NULL) -+BTF_ID_FLAGS(func, bpf_refcount_acquire_impl, KF_ACQUIRE | KF_RET_NULL | KF_RCU) - BTF_ID_FLAGS(func, bpf_list_push_front_impl) - BTF_ID_FLAGS(func, bpf_list_push_back_impl) - BTF_ID_FLAGS(func, bpf_list_pop_front, KF_ACQUIRE | KF_RET_NULL) --- -2.43.2 - -From 49c4d6fe853749e5e1be539b9f5834be1d0e34c4 Mon Sep 17 00:00:00 2001 -From: Jordan Rome <jordalgo@meta.com> -Date: Wed, 8 Nov 2023 03:23:34 -0800 -Subject: [PATCH 0129/1501] bpf: Add crosstask check to __bpf_get_stack -Content-Length: 4882 -Lines: 113 - -[ Upstream commit b8e3a87a627b575896e448021e5c2f8a3bc19931 ] - -Currently get_perf_callchain only supports user stack walking for -the current task. Passing the correct *crosstask* param will return -0 frames if the task passed to __bpf_get_stack isn't the current -one instead of a single incorrect frame/address. This change -passes the correct *crosstask* param but also does a preemptive -check in __bpf_get_stack if the task is current and returns --EOPNOTSUPP if it is not. - -This issue was found using bpf_get_task_stack inside a BPF -iterator ("iter/task"), which iterates over all tasks. -bpf_get_task_stack works fine for fetching kernel stacks -but because get_perf_callchain relies on the caller to know -if the requested *task* is the current one (via *crosstask*) -it was failing in a confusing way. - -It might be possible to get user stacks for all tasks utilizing -something like access_process_vm but that requires the bpf -program calling bpf_get_task_stack to be sleepable and would -therefore be a breaking change. - -Fixes: fa28dcb82a38 ("bpf: Introduce helper bpf_get_task_stack()") -Signed-off-by: Jordan Rome <jordalgo@meta.com> -Signed-off-by: Andrii Nakryiko <andrii@kernel.org> -Link: https://lore.kernel.org/bpf/20231108112334.3433136-1-jordalgo@meta.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/uapi/linux/bpf.h | 3 +++ - kernel/bpf/stackmap.c | 11 ++++++++++- - tools/include/uapi/linux/bpf.h | 3 +++ - 3 files changed, 16 insertions(+), 1 deletion(-) - -diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h -index 0f6cdf52b1da..bda948a685e5 100644 ---- a/include/uapi/linux/bpf.h -+++ b/include/uapi/linux/bpf.h -@@ -4517,6 +4517,8 @@ union bpf_attr { - * long bpf_get_task_stack(struct task_struct *task, void *buf, u32 size, u64 flags) - * Description - * Return a user or a kernel stack in bpf program provided buffer. -+ * Note: the user stack will only be populated if the *task* is -+ * the current task; all other tasks will return -EOPNOTSUPP. - * To achieve this, the helper needs *task*, which is a valid - * pointer to **struct task_struct**. To store the stacktrace, the - * bpf program provides *buf* with a nonnegative *size*. -@@ -4528,6 +4530,7 @@ union bpf_attr { - * - * **BPF_F_USER_STACK** - * Collect a user space stack instead of a kernel stack. -+ * The *task* must be the current task. - * **BPF_F_USER_BUILD_ID** - * Collect buildid+offset instead of ips for user stack, - * only valid if **BPF_F_USER_STACK** is also specified. -diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c -index d6b277482085..dff7ba539701 100644 ---- a/kernel/bpf/stackmap.c -+++ b/kernel/bpf/stackmap.c -@@ -388,6 +388,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, - { - u32 trace_nr, copy_len, elem_size, num_elem, max_depth; - bool user_build_id = flags & BPF_F_USER_BUILD_ID; -+ bool crosstask = task && task != current; - u32 skip = flags & BPF_F_SKIP_FIELD_MASK; - bool user = flags & BPF_F_USER_STACK; - struct perf_callchain_entry *trace; -@@ -410,6 +411,14 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, - if (task && user && !user_mode(regs)) - goto err_fault; - -+ /* get_perf_callchain does not support crosstask user stack walking -+ * but returns an empty stack instead of NULL. -+ */ -+ if (crosstask && user) { -+ err = -EOPNOTSUPP; -+ goto clear; -+ } -+ - num_elem = size / elem_size; - max_depth = num_elem + skip; - if (sysctl_perf_event_max_stack < max_depth) -@@ -421,7 +430,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, - trace = get_callchain_entry_for_task(task, max_depth); - else - trace = get_perf_callchain(regs, 0, kernel, user, max_depth, -- false, false); -+ crosstask, false); - if (unlikely(!trace)) - goto err_fault; - -diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h -index 0f6cdf52b1da..bda948a685e5 100644 ---- a/tools/include/uapi/linux/bpf.h -+++ b/tools/include/uapi/linux/bpf.h -@@ -4517,6 +4517,8 @@ union bpf_attr { - * long bpf_get_task_stack(struct task_struct *task, void *buf, u32 size, u64 flags) - * Description - * Return a user or a kernel stack in bpf program provided buffer. -+ * Note: the user stack will only be populated if the *task* is -+ * the current task; all other tasks will return -EOPNOTSUPP. - * To achieve this, the helper needs *task*, which is a valid - * pointer to **struct task_struct**. To store the stacktrace, the - * bpf program provides *buf* with a nonnegative *size*. -@@ -4528,6 +4530,7 @@ union bpf_attr { - * - * **BPF_F_USER_STACK** - * Collect a user space stack instead of a kernel stack. -+ * The *task* must be the current task. - * **BPF_F_USER_BUILD_ID** - * Collect buildid+offset instead of ips for user stack, - * only valid if **BPF_F_USER_STACK** is also specified. --- -2.43.2 - -From 9308431c71883680192a05aa06a21a3d828d16d7 Mon Sep 17 00:00:00 2001 -From: Luca Weiss <luca.weiss@fairphone.com> -Date: Fri, 27 Oct 2023 08:57:18 +0200 -Subject: [PATCH 0130/1501] wifi: ath11k: Defer on rproc_get failure -Content-Length: 2045 -Lines: 49 - -[ Upstream commit 2a3ec40b98b46c339adb57313d3b933ee5e7a8e8 ] - -If we already have gotten the rproc_handle (meaning the "qcom,rproc" -property is defined in the devicetree), it's a valid state that the -remoteproc module hasn't probed yet so we should defer probing instead -of just failing to probe. - -This resolves a race condition when the ath11k driver probes and fails -before the wpss remoteproc driver has probed, like the following: - - [ 6.232360] ath11k 17a10040.wifi: failed to get rproc - [ 6.232366] ath11k 17a10040.wifi: failed to get rproc: -22 - [ 6.232478] ath11k: probe of 17a10040.wifi failed with error -22 - ... - [ 6.252415] remoteproc remoteproc2: 8a00000.remoteproc is available - [ 6.252776] remoteproc remoteproc2: powering up 8a00000.remoteproc - [ 6.252781] remoteproc remoteproc2: Booting fw image qcom/qcm6490/fairphone5/wpss.mdt, size 7188 - -So, defer the probe if we hit that so we can retry later once the wpss -remoteproc is available. - -Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-01264-QCAMSLSWPLZ-1.37886.3 - -Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") -Signed-off-by: Luca Weiss <luca.weiss@fairphone.com> -Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> -Link: https://lore.kernel.org/r/20231027-ath11k-rproc-defer-v1-1-f6b6a812cd18@fairphone.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/ath/ath11k/ahb.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/wireless/ath/ath11k/ahb.c b/drivers/net/wireless/ath/ath11k/ahb.c -index 235336ef2a7a..f8f5e653cd03 100644 ---- a/drivers/net/wireless/ath/ath11k/ahb.c -+++ b/drivers/net/wireless/ath/ath11k/ahb.c -@@ -803,8 +803,8 @@ static int ath11k_core_get_rproc(struct ath11k_base *ab) - - prproc = rproc_get_by_phandle(rproc_phandle); - if (!prproc) { -- ath11k_err(ab, "failed to get rproc\n"); -- return -EINVAL; -+ ath11k_dbg(ab, ATH11K_DBG_AHB, "failed to get rproc, deferring\n"); -+ return -EPROBE_DEFER; - } - ab_ahb->tgt_rproc = prproc; - --- -2.43.2 - -From c07f2b3fc54c1da9072fa0ae0f26347fd0dc7066 Mon Sep 17 00:00:00 2001 -From: Arnd Bergmann <arnd@arndb.de> -Date: Wed, 8 Nov 2023 16:34:03 +0100 -Subject: [PATCH 0131/1501] wifi: libertas: stop selecting wext -Content-Length: 1001 -Lines: 29 - -[ Upstream commit 8170b04c2c92eee52ea50b96db4c54662197e512 ] - -Libertas no longer references the iw_handler infrastructure or wext_spy, -so neither of the 'select' statements are used any more. - -Fixes: e86dc1ca4676 ("Libertas: cfg80211 support") -Signed-off-by: Arnd Bergmann <arnd@arndb.de> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://lore.kernel.org/r/20231108153409.1065286-1-arnd@kernel.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/marvell/libertas/Kconfig | 2 -- - 1 file changed, 2 deletions(-) - -diff --git a/drivers/net/wireless/marvell/libertas/Kconfig b/drivers/net/wireless/marvell/libertas/Kconfig -index 6d62ab49aa8d..c7d02adb3eea 100644 ---- a/drivers/net/wireless/marvell/libertas/Kconfig -+++ b/drivers/net/wireless/marvell/libertas/Kconfig -@@ -2,8 +2,6 @@ - config LIBERTAS - tristate "Marvell 8xxx Libertas WLAN driver support" - depends on CFG80211 -- select WIRELESS_EXT -- select WEXT_SPY - select LIB80211 - select FW_LOADER - help --- -2.43.2 - -From 69fa32b4db1ca25ee7d84ac43076a0cf4f2f6e88 Mon Sep 17 00:00:00 2001 -From: Justin Tee <justin.tee@broadcom.com> -Date: Tue, 31 Oct 2023 12:12:18 -0700 -Subject: [PATCH 0133/1501] scsi: lpfc: Fix list_entry null check warning in - lpfc_cmpl_els_plogi() -Content-Length: 1731 -Lines: 41 - -[ Upstream commit 1dec1311b9b6cc9c5fd26a77b936f542f03c51d1 ] - -Smatch called out a warning for null checking a ptr that is assigned by -list_entry(). list_entry() does not return null and, if the list is empty, -can return an invalid ptr. Thus, the !psrp check does not execute properly. - - drivers/scsi/lpfc/lpfc_els.c:2133 lpfc_cmpl_els_plogi() - warn: list_entry() does not return NULL 'prsp' - -Replace list_entry() with list_get_first(), which does a list_empty() check -before returning the first entry. - -Fixes: a3c3c0a806f1 ("scsi: lpfc: Validate ELS LS_ACC completion payload") -Reported-by: Dan Carpenter <dan.carpenter@linaro.org> -Closes: https://lore.kernel.org/linux-scsi/01b7568f-4ab4-4d56-bfa6-9ecc5fc261fe@moroto.mountain/ -Signed-off-by: Justin Tee <justin.tee@broadcom.com> -Link: https://lore.kernel.org/r/20231031191224.150862-4-justintee8345@gmail.com -Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com> -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/scsi/lpfc/lpfc_els.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index f9627eddab08..0829fe6ddff8 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -2128,8 +2128,8 @@ lpfc_cmpl_els_plogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - NLP_EVT_DEVICE_RM); - } else { - /* Good status, call state machine */ -- prsp = list_entry(cmdiocb->cmd_dmabuf->list.next, -- struct lpfc_dmabuf, list); -+ prsp = list_get_first(&cmdiocb->cmd_dmabuf->list, -+ struct lpfc_dmabuf, list); - if (!prsp) - goto out; - if (!lpfc_is_els_acc_rsp(prsp)) --- -2.43.2 - -From 87ac26716a3050824a8f58c7f71ba9455e91303f Mon Sep 17 00:00:00 2001 -From: Peter Delevoryas <peter@pjd.dev> -Date: Tue, 14 Nov 2023 10:07:34 -0600 -Subject: [PATCH 0134/1501] net/ncsi: Fix netlink major/minor version numbers -Content-Length: 7584 -Lines: 194 - -[ Upstream commit 3084b58bfd0b9e4b5e034f31f31b42977db35f12 ] - -The netlink interface for major and minor version numbers doesn't actually -return the major and minor version numbers. - -It reports a u32 that contains the (major, minor, update, alpha1) -components as the major version number, and then alpha2 as the minor -version number. - -For whatever reason, the u32 byte order was reversed (ntohl): maybe it was -assumed that the encoded value was a single big-endian u32, and alpha2 was -the minor version. - -The correct way to get the supported NC-SI version from the network -controller is to parse the Get Version ID response as described in 8.4.44 -of the NC-SI spec[1]. - - Get Version ID Response Packet Format - - Bits - +--------+--------+--------+--------+ - Bytes | 31..24 | 23..16 | 15..8 | 7..0 | - +-------+--------+--------+--------+--------+ - | 0..15 | NC-SI Header | - +-------+--------+--------+--------+--------+ - | 16..19| Response code | Reason code | - +-------+--------+--------+--------+--------+ - |20..23 | Major | Minor | Update | Alpha1 | - +-------+--------+--------+--------+--------+ - |24..27 | reserved | Alpha2 | - +-------+--------+--------+--------+--------+ - | .... other stuff .... | - -The major, minor, and update fields are all binary-coded decimal (BCD) -encoded [2]. The spec provides examples below the Get Version ID response -format in section 8.4.44.1, but for practical purposes, this is an example -from a live network card: - - root@bmc:~# ncsi-util 0x15 - NC-SI Command Response: - cmd: GET_VERSION_ID(0x15) - Response: COMMAND_COMPLETED(0x0000) Reason: NO_ERROR(0x0000) - Payload length = 40 - - 20: 0xf1 0xf1 0xf0 0x00 <<<<<<<<< (major, minor, update, alpha1) - 24: 0x00 0x00 0x00 0x00 <<<<<<<<< (_, _, _, alpha2) - - 28: 0x6d 0x6c 0x78 0x30 - 32: 0x2e 0x31 0x00 0x00 - 36: 0x00 0x00 0x00 0x00 - 40: 0x16 0x1d 0x07 0xd2 - 44: 0x10 0x1d 0x15 0xb3 - 48: 0x00 0x17 0x15 0xb3 - 52: 0x00 0x00 0x81 0x19 - -This should be parsed as "1.1.0". - -"f" in the upper-nibble means to ignore it, contributing zero. - -If both nibbles are "f", I think the whole field is supposed to be ignored. -Major and minor are "required", meaning they're not supposed to be "ff", -but the update field is "optional" so I think it can be ff. I think the -simplest thing to do is just set the major and minor to zero instead of -juggling some conditional logic or something. - -bcd2bin() from "include/linux/bcd.h" seems to assume both nibbles are 0-9, -so I've provided a custom BCD decoding function. - -Alpha1 and alpha2 are ISO/IEC 8859-1 encoded, which just means ASCII -characters as far as I can tell, although the full encoding table for -non-alphabetic characters is slightly different (I think). - -I imagine the alpha fields are just supposed to be alphabetic characters, -but I haven't seen any network cards actually report a non-zero value for -either. - -If people wrote software against this netlink behavior, and were parsing -the major and minor versions themselves from the u32, then this would -definitely break their code. - -[1] https://www.dmtf.org/sites/default/files/standards/documents/DSP0222_1.0.0.pdf -[2] https://en.wikipedia.org/wiki/Binary-coded_decimal -[2] https://en.wikipedia.org/wiki/ISO/IEC_8859-1 - -Signed-off-by: Peter Delevoryas <peter@pjd.dev> -Fixes: 138635cc27c9 ("net/ncsi: NCSI response packet handler") -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/ncsi/internal.h | 7 +++++-- - net/ncsi/ncsi-netlink.c | 4 ++-- - net/ncsi/ncsi-pkt.h | 7 +++++-- - net/ncsi/ncsi-rsp.c | 26 ++++++++++++++++++++++++-- - 4 files changed, 36 insertions(+), 8 deletions(-) - -diff --git a/net/ncsi/internal.h b/net/ncsi/internal.h -index 03757e76bb6b..374412ed780b 100644 ---- a/net/ncsi/internal.h -+++ b/net/ncsi/internal.h -@@ -105,8 +105,11 @@ enum { - - - struct ncsi_channel_version { -- u32 version; /* Supported BCD encoded NCSI version */ -- u32 alpha2; /* Supported BCD encoded NCSI version */ -+ u8 major; /* NCSI version major */ -+ u8 minor; /* NCSI version minor */ -+ u8 update; /* NCSI version update */ -+ char alpha1; /* NCSI version alpha1 */ -+ char alpha2; /* NCSI version alpha2 */ - u8 fw_name[12]; /* Firmware name string */ - u32 fw_version; /* Firmware version */ - u16 pci_ids[4]; /* PCI identification */ -diff --git a/net/ncsi/ncsi-netlink.c b/net/ncsi/ncsi-netlink.c -index a3a6753a1db7..2f872d064396 100644 ---- a/net/ncsi/ncsi-netlink.c -+++ b/net/ncsi/ncsi-netlink.c -@@ -71,8 +71,8 @@ static int ncsi_write_channel_info(struct sk_buff *skb, - if (nc == nc->package->preferred_channel) - nla_put_flag(skb, NCSI_CHANNEL_ATTR_FORCED); - -- nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MAJOR, nc->version.version); -- nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MINOR, nc->version.alpha2); -+ nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MAJOR, nc->version.major); -+ nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MINOR, nc->version.minor); - nla_put_string(skb, NCSI_CHANNEL_ATTR_VERSION_STR, nc->version.fw_name); - - vid_nest = nla_nest_start_noflag(skb, NCSI_CHANNEL_ATTR_VLAN_LIST); -diff --git a/net/ncsi/ncsi-pkt.h b/net/ncsi/ncsi-pkt.h -index ba66c7dc3a21..c9d1da34dc4d 100644 ---- a/net/ncsi/ncsi-pkt.h -+++ b/net/ncsi/ncsi-pkt.h -@@ -197,9 +197,12 @@ struct ncsi_rsp_gls_pkt { - /* Get Version ID */ - struct ncsi_rsp_gvi_pkt { - struct ncsi_rsp_pkt_hdr rsp; /* Response header */ -- __be32 ncsi_version; /* NCSI version */ -+ unsigned char major; /* NCSI version major */ -+ unsigned char minor; /* NCSI version minor */ -+ unsigned char update; /* NCSI version update */ -+ unsigned char alpha1; /* NCSI version alpha1 */ - unsigned char reserved[3]; /* Reserved */ -- unsigned char alpha2; /* NCSI version */ -+ unsigned char alpha2; /* NCSI version alpha2 */ - unsigned char fw_name[12]; /* f/w name string */ - __be32 fw_version; /* f/w version */ - __be16 pci_ids[4]; /* PCI IDs */ -diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c -index 069c2659074b..480e80e3c283 100644 ---- a/net/ncsi/ncsi-rsp.c -+++ b/net/ncsi/ncsi-rsp.c -@@ -19,6 +19,19 @@ - #include "ncsi-pkt.h" - #include "ncsi-netlink.h" - -+/* Nibbles within [0xA, 0xF] add zero "0" to the returned value. -+ * Optional fields (encoded as 0xFF) will default to zero. -+ */ -+static u8 decode_bcd_u8(u8 x) -+{ -+ int lo = x & 0xF; -+ int hi = x >> 4; -+ -+ lo = lo < 0xA ? lo : 0; -+ hi = hi < 0xA ? hi : 0; -+ return lo + hi * 10; -+} -+ - static int ncsi_validate_rsp_pkt(struct ncsi_request *nr, - unsigned short payload) - { -@@ -755,9 +768,18 @@ static int ncsi_rsp_handler_gvi(struct ncsi_request *nr) - if (!nc) - return -ENODEV; - -- /* Update to channel's version info */ -+ /* Update channel's version info -+ * -+ * Major, minor, and update fields are supposed to be -+ * unsigned integers encoded as packed BCD. -+ * -+ * Alpha1 and alpha2 are ISO/IEC 8859-1 characters. -+ */ - ncv = &nc->version; -- ncv->version = ntohl(rsp->ncsi_version); -+ ncv->major = decode_bcd_u8(rsp->major); -+ ncv->minor = decode_bcd_u8(rsp->minor); -+ ncv->update = decode_bcd_u8(rsp->update); -+ ncv->alpha1 = rsp->alpha1; - ncv->alpha2 = rsp->alpha2; - memcpy(ncv->fw_name, rsp->fw_name, 12); - ncv->fw_version = ntohl(rsp->fw_version); --- -2.43.2 - -From d7768dd38cb01d8f93492f73618a3bd36dd1ffc0 Mon Sep 17 00:00:00 2001 -From: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Date: Mon, 30 Oct 2023 11:12:26 +0100 -Subject: [PATCH 0135/1501] firmware: ti_sci: Fix an off-by-one in - ti_sci_debugfs_create() -Content-Length: 1826 -Lines: 47 - -[ Upstream commit 964946b88887089f447a9b6a28c39ee97dc76360 ] - -The ending NULL is not taken into account by strncat(), so switch to -snprintf() to correctly build 'debug_name'. - -Using snprintf() also makes the code more readable. - -Fixes: aa276781a64a ("firmware: Add basic support for TI System Control Interface (TI-SCI) protocol") -Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> -Link: https://lore.kernel.org/r/7158db0a4d7b19855ddd542ec61b666973aad8dc.1698660720.git.christophe.jaillet@wanadoo.fr -Signed-off-by: Nishanth Menon <nm@ti.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/firmware/ti_sci.c | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c -index 7041befc756a..8b9a2556de16 100644 ---- a/drivers/firmware/ti_sci.c -+++ b/drivers/firmware/ti_sci.c -@@ -164,7 +164,7 @@ static int ti_sci_debugfs_create(struct platform_device *pdev, - { - struct device *dev = &pdev->dev; - struct resource *res; -- char debug_name[50] = "ti_sci_debug@"; -+ char debug_name[50]; - - /* Debug region is optional */ - res = platform_get_resource_byname(pdev, IORESOURCE_MEM, -@@ -181,10 +181,10 @@ static int ti_sci_debugfs_create(struct platform_device *pdev, - /* Setup NULL termination */ - info->debug_buffer[info->debug_region_size] = 0; - -- info->d = debugfs_create_file(strncat(debug_name, dev_name(dev), -- sizeof(debug_name) - -- sizeof("ti_sci_debug@")), -- 0444, NULL, info, &ti_sci_debug_fops); -+ snprintf(debug_name, sizeof(debug_name), "ti_sci_debug@%s", -+ dev_name(dev)); -+ info->d = debugfs_create_file(debug_name, 0444, NULL, info, -+ &ti_sci_debug_fops); - if (IS_ERR(info->d)) - return PTR_ERR(info->d); - --- -2.43.2 - -From 4370209098a249fa51f44f445323fe5a5c03a27c Mon Sep 17 00:00:00 2001 -From: Bart Van Assche <bvanassche@acm.org> -Date: Wed, 15 Nov 2023 11:33:38 -0800 -Subject: [PATCH 0136/1501] scsi: bfa: Use the proper data type for BLIST flags -Content-Length: 1336 -Lines: 32 - -[ Upstream commit 0349be31e4ffc79723e46e2e373569567b06347b ] - -Fix the following sparse warning: - -drivers/scsi/bfa/bfad_bsg.c:2553:50: sparse: sparse: incorrect type in initializer (different base types) - -Fixes: 2e5a6c3baccd ("scsi: bfa: Convert bfad_reset_sdev_bflags() from a macro into a function") -Reported-by: kernel test robot <lkp@intel.com> -Closes: https://lore.kernel.org/oe-kbuild-all/202311031255.lmSPisIk-lkp@intel.com/ -Signed-off-by: Bart Van Assche <bvanassche@acm.org> -Link: https://lore.kernel.org/r/20231115193338.2261972-1-bvanassche@acm.org -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/scsi/bfa/bfad_bsg.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/scsi/bfa/bfad_bsg.c b/drivers/scsi/bfa/bfad_bsg.c -index 520f9152f3bf..d4ceca2d435e 100644 ---- a/drivers/scsi/bfa/bfad_bsg.c -+++ b/drivers/scsi/bfa/bfad_bsg.c -@@ -2550,7 +2550,7 @@ bfad_iocmd_vf_clr_stats(struct bfad_s *bfad, void *cmd) - static void bfad_reset_sdev_bflags(struct bfad_im_port_s *im_port, - int lunmask_cfg) - { -- const u32 scan_flags = BLIST_NOREPORTLUN | BLIST_SPARSELUN; -+ const blist_flags_t scan_flags = BLIST_NOREPORTLUN | BLIST_SPARSELUN; - struct bfad_itnim_s *itnim; - struct scsi_device *sdev; - unsigned long flags; --- -2.43.2 - -From b4e593a7a22fa3c7d0550ef51c90b5c21f790aa8 Mon Sep 17 00:00:00 2001 -From: Karthikeyan Periyasamy <quic_periyasa@quicinc.com> -Date: Wed, 22 Nov 2023 20:31:02 +0200 -Subject: [PATCH 0137/1501] wifi: ath12k: fix the error handler of rfkill - config -Content-Length: 1863 -Lines: 51 - -[ Upstream commit 898d8b3e1414cd900492ee6a0b582f8095ba4a1a ] - -When the core rfkill config throws error, it should free the -allocated resources. Currently it is not freeing the core pdev -create resources. Avoid this issue by calling the core pdev -destroy in the error handler of core rfkill config. - -Found this issue in the code review and it is compile tested only. - -Fixes: 004ccbc0dd49 ("wifi: ath12k: add support for hardware rfkill for WCN7850") -Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com> -Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com> -Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> -Link: https://lore.kernel.org/r/20231111040107.18708-1-quic_periyasa@quicinc.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/ath/ath12k/core.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/wireless/ath/ath12k/core.c b/drivers/net/wireless/ath/ath12k/core.c -index b936760b5140..6c01b282fcd3 100644 ---- a/drivers/net/wireless/ath/ath12k/core.c -+++ b/drivers/net/wireless/ath/ath12k/core.c -@@ -1,7 +1,7 @@ - // SPDX-License-Identifier: BSD-3-Clause-Clear - /* - * Copyright (c) 2018-2021 The Linux Foundation. All rights reserved. -- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include <linux/module.h> -@@ -698,13 +698,15 @@ int ath12k_core_qmi_firmware_ready(struct ath12k_base *ab) - ret = ath12k_core_rfkill_config(ab); - if (ret && ret != -EOPNOTSUPP) { - ath12k_err(ab, "failed to config rfkill: %d\n", ret); -- goto err_core_stop; -+ goto err_core_pdev_destroy; - } - - mutex_unlock(&ab->core_lock); - - return 0; - -+err_core_pdev_destroy: -+ ath12k_core_pdev_destroy(ab); - err_core_stop: - ath12k_core_stop(ab); - ath12k_mac_destroy(ab); --- -2.43.2 - -From d47acee77c65c2c9653b03628d0ac990756e8148 Mon Sep 17 00:00:00 2001 -From: Su Hui <suhui@nfschina.com> -Date: Mon, 27 Nov 2023 09:35:13 +0800 -Subject: [PATCH 0138/1501] wifi: rtlwifi: rtl8821ae: phy: fix an undefined - bitwise shift behavior -Content-Length: 2150 -Lines: 50 - -[ Upstream commit bc8263083af60e7e57c6120edbc1f75d6c909a35 ] - -Clang static checker warns: - -drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c:184:49: - The result of the left shift is undefined due to shifting by '32', - which is greater or equal to the width of type 'u32'. - [core.UndefinedBinaryOperatorResult] - -If the value of the right operand is negative or is greater than or -equal to the width of the promoted left operand, the behavior is -undefined.[1][2] - -For example, when using different gcc's compilation optimization options -(-O0 or -O2), the result of '(u32)data << 32' is different. One is 0, the -other is old value of data. Let _rtl8821ae_phy_calculate_bit_shift()'s -return value less than 32 to fix this problem. Warn if bitmask is zero. - -[1] https://stackoverflow.com/questions/11270492/what-does-the-c-standard-say-about-bitshifting-more-bits-than-the-width-of-type -[2] https://www.open-std.org/jtc1/sc22/wg14/www/docs/n1256.pdf - -Fixes: 21e4b0726dc6 ("rtlwifi: rtl8821ae: Move driver from staging to regular tree") -Signed-off-by: Su Hui <suhui@nfschina.com> -Acked-by: Ping-Ke Shih <pkshih@realtek.com> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://lore.kernel.org/r/20231127013511.26694-2-suhui@nfschina.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c -index 5323ead30db0..fa1839d8ee55 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c -@@ -29,9 +29,10 @@ static void _rtl8821ae_phy_rf_serial_write(struct ieee80211_hw *hw, - u32 data); - static u32 _rtl8821ae_phy_calculate_bit_shift(u32 bitmask) - { -- u32 i = ffs(bitmask); -+ if (WARN_ON_ONCE(!bitmask)) -+ return 0; - -- return i ? i - 1 : 32; -+ return __ffs(bitmask); - } - static bool _rtl8821ae_phy_bb8821a_config_parafile(struct ieee80211_hw *hw); - /*static bool _rtl8812ae_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);*/ --- -2.43.2 - -From 0e9ffff72a0674cd6656314dbd99cdd2123a3030 Mon Sep 17 00:00:00 2001 -From: Martin Blumenstingl <martin.blumenstingl@googlemail.com> -Date: Mon, 20 Nov 2023 12:57:26 +0100 -Subject: [PATCH 0142/1501] wifi: rtw88: sdio: Honor the host max_req_size in - the RX path -Content-Length: 4922 -Lines: 111 - -[ Upstream commit 00384f565a91c08c4bedae167f749b093d10e3fe ] - -Lukas reports skb_over_panic errors on his Banana Pi BPI-CM4 which comes -with an Amlogic A311D (G12B) SoC and a RTL8822CS SDIO wifi/Bluetooth -combo card. The error he observed is identical to what has been fixed -in commit e967229ead0e ("wifi: rtw88: sdio: Check the HISR RX_REQUEST -bit in rtw_sdio_rx_isr()") but that commit didn't fix Lukas' problem. - -Lukas found that disabling or limiting RX aggregation works around the -problem for some time (but does not fully fix it). In the following -discussion a few key topics have been discussed which have an impact on -this problem: -- The Amlogic A311D (G12B) SoC has a hardware bug in the SDIO controller - which prevents DMA transfers. Instead all transfers need to go through - the controller SRAM which limits transfers to 1536 bytes -- rtw88 chips don't split incoming (RX) packets, so if a big packet is - received this is forwarded to the host in it's original form -- rtw88 chips can do RX aggregation, meaning more multiple incoming - packets can be pulled by the host from the card with one MMC/SDIO - transfer. This Depends on settings in the REG_RXDMA_AGG_PG_TH - register (BIT_RXDMA_AGG_PG_TH limits the number of packets that will - be aggregated, BIT_DMA_AGG_TO_V1 configures a timeout for aggregation - and BIT_EN_PRE_CALC makes the chip honor the limits more effectively) - -Use multiple consecutive reads in rtw_sdio_read_port() and limit the -number of bytes which are copied by the host from the card in one -MMC/SDIO transfer. This allows receiving a buffer that's larger than -the hosts max_req_size (number of bytes which can be transferred in -one MMC/SDIO transfer). As a result of this the skb_over_panic error -is gone as the rtw88 driver is now able to receive more than 1536 bytes -from the card (either because the incoming packet is larger than that -or because multiple packets have been aggregated). - -In case of an receive errors (-EILSEQ has been observed by Lukas) we -need to drain the remaining data from the card's buffer, otherwise the -card will return corrupt data for the next rtw_sdio_read_port() call. - -Fixes: 65371a3f14e7 ("wifi: rtw88: sdio: Add HCI implementation for SDIO based chipsets") -Reported-by: Lukas F. Hartmann <lukas@mntre.com> -Closes: https://lore.kernel.org/linux-wireless/CAFBinCBaXtebixKbjkWKW_WXc5k=NdGNaGUjVE8NCPNxOhsb2g@mail.gmail.com/ -Suggested-by: Ping-Ke Shih <pkshih@realtek.com> -Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> -Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org> -Acked-by: Ping-Ke Shih <pkshih@realtek.com> -Tested-by: Lukas F. Hartmann <lukas@mntre.com> -Reported-by: Lukas F. Hartmann <lukas@mntre.com> -Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> -Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org> -Acked-by: Ping-Ke Shih <pkshih@realtek.com> -Tested-by: Lukas F. Hartmann <lukas@mntre.com> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://lore.kernel.org/r/20231120115726.1569323-1-martin.blumenstingl@googlemail.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/realtek/rtw88/sdio.c | 35 ++++++++++++++++++----- - 1 file changed, 28 insertions(+), 7 deletions(-) - -diff --git a/drivers/net/wireless/realtek/rtw88/sdio.c b/drivers/net/wireless/realtek/rtw88/sdio.c -index 2c1fb2dabd40..0cae5746f540 100644 ---- a/drivers/net/wireless/realtek/rtw88/sdio.c -+++ b/drivers/net/wireless/realtek/rtw88/sdio.c -@@ -500,19 +500,40 @@ static u32 rtw_sdio_get_tx_addr(struct rtw_dev *rtwdev, size_t size, - static int rtw_sdio_read_port(struct rtw_dev *rtwdev, u8 *buf, size_t count) - { - struct rtw_sdio *rtwsdio = (struct rtw_sdio *)rtwdev->priv; -+ struct mmc_host *host = rtwsdio->sdio_func->card->host; - bool bus_claim = rtw_sdio_bus_claim_needed(rtwsdio); - u32 rxaddr = rtwsdio->rx_addr++; -- int ret; -+ int ret = 0, err; -+ size_t bytes; - - if (bus_claim) - sdio_claim_host(rtwsdio->sdio_func); - -- ret = sdio_memcpy_fromio(rtwsdio->sdio_func, buf, -- RTW_SDIO_ADDR_RX_RX0FF_GEN(rxaddr), count); -- if (ret) -- rtw_warn(rtwdev, -- "Failed to read %zu byte(s) from SDIO port 0x%08x", -- count, rxaddr); -+ while (count > 0) { -+ bytes = min_t(size_t, host->max_req_size, count); -+ -+ err = sdio_memcpy_fromio(rtwsdio->sdio_func, buf, -+ RTW_SDIO_ADDR_RX_RX0FF_GEN(rxaddr), -+ bytes); -+ if (err) { -+ rtw_warn(rtwdev, -+ "Failed to read %zu byte(s) from SDIO port 0x%08x: %d", -+ bytes, rxaddr, err); -+ -+ /* Signal to the caller that reading did not work and -+ * that the data in the buffer is short/corrupted. -+ */ -+ ret = err; -+ -+ /* Don't stop here - instead drain the remaining data -+ * from the card's buffer, else the card will return -+ * corrupt data for the next rtw_sdio_read_port() call. -+ */ -+ } -+ -+ count -= bytes; -+ buf += bytes; -+ } - - if (bus_claim) - sdio_release_host(rtwsdio->sdio_func); --- -2.43.2 - -From c4c2345214b66e2505a26fd2ea58839dd7a1d48d Mon Sep 17 00:00:00 2001 -From: Yu Kuai <yukuai3@huawei.com> -Date: Wed, 29 Nov 2023 10:02:34 +0800 -Subject: [PATCH 0144/1501] md: synchronize flush io with array reconfiguration -Content-Length: 2970 -Lines: 88 - -[ Upstream commit fa2bbff7b0b4e211fec5e5686ef96350690597b5 ] - -Currently rcu is used to protect iterating rdev from submit_flushes(): - -submit_flushes remove_and_add_spares - synchronize_rcu - pers->hot_remove_disk() - rcu_read_lock() - rdev_for_each_rcu - if (rdev->raid_disk >= 0) - rdev->radi_disk = -1; - atomic_inc(&rdev->nr_pending) - rcu_read_unlock() - bi = bio_alloc_bioset() - bi->bi_end_io = md_end_flush - bi->private = rdev - submit_bio - // issue io for removed rdev - -Fix this problem by grabbing 'acive_io' before iterating rdev, make sure -that remove_and_add_spares() won't concurrent with submit_flushes(). - -Fixes: a2826aa92e2e ("md: support barrier requests on all personalities.") -Signed-off-by: Yu Kuai <yukuai3@huawei.com> -Signed-off-by: Song Liu <song@kernel.org> -Link: https://lore.kernel.org/r/20231129020234.1586910-1-yukuai1@huaweicloud.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/md/md.c | 22 ++++++++++++++++------ - 1 file changed, 16 insertions(+), 6 deletions(-) - -diff --git a/drivers/md/md.c b/drivers/md/md.c -index 9bdd57324c37..f246bb0932b0 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -543,6 +543,9 @@ static void md_end_flush(struct bio *bio) - rdev_dec_pending(rdev, mddev); - - if (atomic_dec_and_test(&mddev->flush_pending)) { -+ /* The pair is percpu_ref_get() from md_flush_request() */ -+ percpu_ref_put(&mddev->active_io); -+ - /* The pre-request flush has finished */ - queue_work(md_wq, &mddev->flush_work); - } -@@ -562,12 +565,8 @@ static void submit_flushes(struct work_struct *ws) - rdev_for_each_rcu(rdev, mddev) - if (rdev->raid_disk >= 0 && - !test_bit(Faulty, &rdev->flags)) { -- /* Take two references, one is dropped -- * when request finishes, one after -- * we reclaim rcu_read_lock -- */ - struct bio *bi; -- atomic_inc(&rdev->nr_pending); -+ - atomic_inc(&rdev->nr_pending); - rcu_read_unlock(); - bi = bio_alloc_bioset(rdev->bdev, 0, -@@ -578,7 +577,6 @@ static void submit_flushes(struct work_struct *ws) - atomic_inc(&mddev->flush_pending); - submit_bio(bi); - rcu_read_lock(); -- rdev_dec_pending(rdev, mddev); - } - rcu_read_unlock(); - if (atomic_dec_and_test(&mddev->flush_pending)) -@@ -631,6 +629,18 @@ bool md_flush_request(struct mddev *mddev, struct bio *bio) - /* new request after previous flush is completed */ - if (ktime_after(req_start, mddev->prev_flush_start)) { - WARN_ON(mddev->flush_bio); -+ /* -+ * Grab a reference to make sure mddev_suspend() will wait for -+ * this flush to be done. -+ * -+ * md_flush_reqeust() is called under md_handle_request() and -+ * 'active_io' is already grabbed, hence percpu_ref_is_zero() -+ * won't pass, percpu_ref_tryget_live() can't be used because -+ * percpu_ref_kill() can be called by mddev_suspend() -+ * concurrently. -+ */ -+ WARN_ON(percpu_ref_is_zero(&mddev->active_io)); -+ percpu_ref_get(&mddev->active_io); - mddev->flush_bio = bio; - bio = NULL; - } --- -2.43.2 - -From d8a88dcdee7f7d8259f5c2e1ce924205382868fd Mon Sep 17 00:00:00 2001 -From: Andrii Nakryiko <andrii@kernel.org> -Date: Sat, 2 Dec 2023 09:56:57 -0800 -Subject: [PATCH 0145/1501] bpf: enforce precision of R0 on callback return -Content-Length: 1439 -Lines: 38 - -[ Upstream commit 0acd03a5bd188b0c501d285d938439618bd855c4 ] - -Given verifier checks actual value, r0 has to be precise, so we need to -propagate precision properly. r0 also has to be marked as read, -otherwise subsequent state comparisons will ignore such register as -unimportant and precision won't really help here. - -Fixes: 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper") -Acked-by: Eduard Zingerman <eddyz87@gmail.com> -Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com> -Signed-off-by: Andrii Nakryiko <andrii@kernel.org> -Link: https://lore.kernel.org/r/20231202175705.885270-4-andrii@kernel.org -Signed-off-by: Alexei Starovoitov <ast@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - kernel/bpf/verifier.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index af2819d5c8ee..4d59b200e898 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -9829,6 +9829,13 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx) - verbose(env, "R0 not a scalar value\n"); - return -EACCES; - } -+ -+ /* we are going to rely on register's precise value */ -+ err = mark_reg_read(env, r0, r0->parent, REG_LIVE_READ64); -+ err = err ?: mark_chain_precision(env, BPF_REG_0); -+ if (err) -+ return err; -+ - if (!tnum_in(range, r0->var_off)) { - verbose_invalid_scalar(env, r0, &range, "callback return", "R0"); - return -EINVAL; --- -2.43.2 - -From 71b64db92a450ecfad9c0913b7cecb24b3096e8f Mon Sep 17 00:00:00 2001 -From: Stephen Boyd <swboyd@chromium.org> -Date: Tue, 28 Nov 2023 19:04:41 -0800 -Subject: [PATCH 0148/1501] dt-bindings: arm: qcom: Fix html link -Content-Length: 1625 -Lines: 35 - -[ Upstream commit 3c3fcac8d3b1b0f242845c3b3c3263bd38b3b92f ] - -This link got broken by commit e790a4ce5290 ("arm: docs: Move Arm -documentation to Documentation/arch/") when the doc moved from arm/ to -arch/arm/. Fix the link so that it can continue to be followed. - -Fixes: e790a4ce5290 ("arm: docs: Move Arm documentation to Documentation/arch/") -Cc: Alexandre TORGUE <alexandre.torgue@foss.st.com> -Cc: Yanteng Si <siyanteng@loongson.cn> -Cc: Jonathan Corbet <corbet@lwn.net> -Reviewed-by: Douglas Anderson <dianders@chromium.org> -Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> -Signed-off-by: Stephen Boyd <swboyd@chromium.org> -Link: https://lore.kernel.org/r/20231129030443.2753833-1-swboyd@chromium.org -Signed-off-by: Bjorn Andersson <andersson@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - Documentation/devicetree/bindings/arm/qcom.yaml | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Documentation/devicetree/bindings/arm/qcom.yaml b/Documentation/devicetree/bindings/arm/qcom.yaml -index 7f80f48a0954..8a6466d1fc4e 100644 ---- a/Documentation/devicetree/bindings/arm/qcom.yaml -+++ b/Documentation/devicetree/bindings/arm/qcom.yaml -@@ -138,7 +138,7 @@ description: | - There are many devices in the list below that run the standard ChromeOS - bootloader setup and use the open source depthcharge bootloader to boot the - OS. These devices do not use the scheme described above. For details, see: -- https://docs.kernel.org/arm/google/chromebook-boot-flow.html -+ https://docs.kernel.org/arch/arm/google/chromebook-boot-flow.html - - properties: - $nodename: --- -2.43.2 - -From 03afa27a784a61fdd048f883bf1381d5d8023f94 Mon Sep 17 00:00:00 2001 -From: Hou Tao <houtao1@huawei.com> -Date: Mon, 4 Dec 2023 22:04:20 +0800 -Subject: [PATCH 0160/1501] bpf: Add map and need_defer parameters to - .map_fd_put_ptr() -Content-Length: 6079 -Lines: 166 - -[ Upstream commit 20c20bd11a0702ce4dc9300c3da58acf551d9725 ] - -map is the pointer of outer map, and need_defer needs some explanation. -need_defer tells the implementation to defer the reference release of -the passed element and ensure that the element is still alive before -the bpf program, which may manipulate it, exits. - -The following three cases will invoke map_fd_put_ptr() and different -need_defer values will be passed to these callers: - -1) release the reference of the old element in the map during map update - or map deletion. The release must be deferred, otherwise the bpf - program may incur use-after-free problem, so need_defer needs to be - true. -2) release the reference of the to-be-added element in the error path of - map update. The to-be-added element is not visible to any bpf - program, so it is OK to pass false for need_defer parameter. -3) release the references of all elements in the map during map release. - Any bpf program which has access to the map must have been exited and - released, so need_defer=false will be OK. - -These two parameters will be used by the following patches to fix the -potential use-after-free problem for map-in-map. - -Signed-off-by: Hou Tao <houtao1@huawei.com> -Link: https://lore.kernel.org/r/20231204140425.1480317-3-houtao@huaweicloud.com -Signed-off-by: Alexei Starovoitov <ast@kernel.org> -Stable-dep-of: 876673364161 ("bpf: Defer the free of inner map when necessary") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/linux/bpf.h | 6 +++++- - kernel/bpf/arraymap.c | 12 +++++++----- - kernel/bpf/hashtab.c | 6 +++--- - kernel/bpf/map_in_map.c | 2 +- - kernel/bpf/map_in_map.h | 2 +- - 5 files changed, 17 insertions(+), 11 deletions(-) - -diff --git a/include/linux/bpf.h b/include/linux/bpf.h -index cff5bb08820e..741af9e5cb9d 100644 ---- a/include/linux/bpf.h -+++ b/include/linux/bpf.h -@@ -106,7 +106,11 @@ struct bpf_map_ops { - /* funcs called by prog_array and perf_event_array map */ - void *(*map_fd_get_ptr)(struct bpf_map *map, struct file *map_file, - int fd); -- void (*map_fd_put_ptr)(void *ptr); -+ /* If need_defer is true, the implementation should guarantee that -+ * the to-be-put element is still alive before the bpf program, which -+ * may manipulate it, exists. -+ */ -+ void (*map_fd_put_ptr)(struct bpf_map *map, void *ptr, bool need_defer); - int (*map_gen_lookup)(struct bpf_map *map, struct bpf_insn *insn_buf); - u32 (*map_fd_sys_lookup_elem)(void *ptr); - void (*map_seq_show_elem)(struct bpf_map *map, void *key, -diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c -index c85ff9162a5c..9bfad7e96913 100644 ---- a/kernel/bpf/arraymap.c -+++ b/kernel/bpf/arraymap.c -@@ -867,7 +867,7 @@ int bpf_fd_array_map_update_elem(struct bpf_map *map, struct file *map_file, - } - - if (old_ptr) -- map->ops->map_fd_put_ptr(old_ptr); -+ map->ops->map_fd_put_ptr(map, old_ptr, true); - return 0; - } - -@@ -890,7 +890,7 @@ static long fd_array_map_delete_elem(struct bpf_map *map, void *key) - } - - if (old_ptr) { -- map->ops->map_fd_put_ptr(old_ptr); -+ map->ops->map_fd_put_ptr(map, old_ptr, true); - return 0; - } else { - return -ENOENT; -@@ -913,8 +913,9 @@ static void *prog_fd_array_get_ptr(struct bpf_map *map, - return prog; - } - --static void prog_fd_array_put_ptr(void *ptr) -+static void prog_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer) - { -+ /* bpf_prog is freed after one RCU or tasks trace grace period */ - bpf_prog_put(ptr); - } - -@@ -1201,8 +1202,9 @@ static void *perf_event_fd_array_get_ptr(struct bpf_map *map, - return ee; - } - --static void perf_event_fd_array_put_ptr(void *ptr) -+static void perf_event_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer) - { -+ /* bpf_perf_event is freed after one RCU grace period */ - bpf_event_entry_free_rcu(ptr); - } - -@@ -1256,7 +1258,7 @@ static void *cgroup_fd_array_get_ptr(struct bpf_map *map, - return cgroup_get_from_fd(fd); - } - --static void cgroup_fd_array_put_ptr(void *ptr) -+static void cgroup_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer) - { - /* cgroup_put free cgrp after a rcu grace period */ - cgroup_put(ptr); -diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c -index fd8d4b0addfc..5b9146fa825f 100644 ---- a/kernel/bpf/hashtab.c -+++ b/kernel/bpf/hashtab.c -@@ -897,7 +897,7 @@ static void htab_put_fd_value(struct bpf_htab *htab, struct htab_elem *l) - - if (map->ops->map_fd_put_ptr) { - ptr = fd_htab_map_get_ptr(map, l); -- map->ops->map_fd_put_ptr(ptr); -+ map->ops->map_fd_put_ptr(map, ptr, true); - } - } - -@@ -2484,7 +2484,7 @@ static void fd_htab_map_free(struct bpf_map *map) - hlist_nulls_for_each_entry_safe(l, n, head, hash_node) { - void *ptr = fd_htab_map_get_ptr(map, l); - -- map->ops->map_fd_put_ptr(ptr); -+ map->ops->map_fd_put_ptr(map, ptr, false); - } - } - -@@ -2525,7 +2525,7 @@ int bpf_fd_htab_map_update_elem(struct bpf_map *map, struct file *map_file, - - ret = htab_map_update_elem(map, key, &ptr, map_flags); - if (ret) -- map->ops->map_fd_put_ptr(ptr); -+ map->ops->map_fd_put_ptr(map, ptr, false); - - return ret; - } -diff --git a/kernel/bpf/map_in_map.c b/kernel/bpf/map_in_map.c -index cd5eafaba97e..2dfeb5835e16 100644 ---- a/kernel/bpf/map_in_map.c -+++ b/kernel/bpf/map_in_map.c -@@ -127,7 +127,7 @@ void *bpf_map_fd_get_ptr(struct bpf_map *map, - return inner_map; - } - --void bpf_map_fd_put_ptr(void *ptr) -+void bpf_map_fd_put_ptr(struct bpf_map *map, void *ptr, bool need_defer) - { - /* ptr->ops->map_free() has to go through one - * rcu grace period by itself. -diff --git a/kernel/bpf/map_in_map.h b/kernel/bpf/map_in_map.h -index bcb7534afb3c..7d61602354de 100644 ---- a/kernel/bpf/map_in_map.h -+++ b/kernel/bpf/map_in_map.h -@@ -13,7 +13,7 @@ struct bpf_map *bpf_map_meta_alloc(int inner_map_ufd); - void bpf_map_meta_free(struct bpf_map *map_meta); - void *bpf_map_fd_get_ptr(struct bpf_map *map, struct file *map_file, - int ufd); --void bpf_map_fd_put_ptr(void *ptr); -+void bpf_map_fd_put_ptr(struct bpf_map *map, void *ptr, bool need_defer); - u32 bpf_map_fd_sys_lookup_elem(void *ptr); - - #endif --- -2.43.2 - -From bfd9b20c4862f41d4590fde11d70a5eeae53dcc5 Mon Sep 17 00:00:00 2001 -From: Hou Tao <houtao1@huawei.com> -Date: Mon, 4 Dec 2023 22:04:22 +0800 -Subject: [PATCH 0161/1501] bpf: Defer the free of inner map when necessary -Status: RO -Content-Length: 4726 -Lines: 133 - -[ Upstream commit 876673364161da50eed6b472d746ef88242b2368 ] - -When updating or deleting an inner map in map array or map htab, the map -may still be accessed by non-sleepable program or sleepable program. -However bpf_map_fd_put_ptr() decreases the ref-counter of the inner map -directly through bpf_map_put(), if the ref-counter is the last one -(which is true for most cases), the inner map will be freed by -ops->map_free() in a kworker. But for now, most .map_free() callbacks -don't use synchronize_rcu() or its variants to wait for the elapse of a -RCU grace period, so after the invocation of ops->map_free completes, -the bpf program which is accessing the inner map may incur -use-after-free problem. - -Fix the free of inner map by invoking bpf_map_free_deferred() after both -one RCU grace period and one tasks trace RCU grace period if the inner -map has been removed from the outer map before. The deferment is -accomplished by using call_rcu() or call_rcu_tasks_trace() when -releasing the last ref-counter of bpf map. The newly-added rcu_head -field in bpf_map shares the same storage space with work field to -reduce the size of bpf_map. - -Fixes: bba1dc0b55ac ("bpf: Remove redundant synchronize_rcu.") -Fixes: 638e4b825d52 ("bpf: Allows per-cpu maps and map-in-map in sleepable programs") -Signed-off-by: Hou Tao <houtao1@huawei.com> -Link: https://lore.kernel.org/r/20231204140425.1480317-5-houtao@huaweicloud.com -Signed-off-by: Alexei Starovoitov <ast@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/linux/bpf.h | 7 ++++++- - kernel/bpf/map_in_map.c | 11 ++++++++--- - kernel/bpf/syscall.c | 32 +++++++++++++++++++++++++++----- - 3 files changed, 41 insertions(+), 9 deletions(-) - -diff --git a/include/linux/bpf.h b/include/linux/bpf.h -index 741af9e5cb9d..7a7859a5cce4 100644 ---- a/include/linux/bpf.h -+++ b/include/linux/bpf.h -@@ -276,7 +276,11 @@ struct bpf_map { - */ - atomic64_t refcnt ____cacheline_aligned; - atomic64_t usercnt; -- struct work_struct work; -+ /* rcu is used before freeing and work is only used during freeing */ -+ union { -+ struct work_struct work; -+ struct rcu_head rcu; -+ }; - struct mutex freeze_mutex; - atomic64_t writecnt; - /* 'Ownership' of program-containing map is claimed by the first program -@@ -292,6 +296,7 @@ struct bpf_map { - } owner; - bool bypass_spec_v1; - bool frozen; /* write-once; write-protected by freeze_mutex */ -+ bool free_after_mult_rcu_gp; - s64 __percpu *elem_count; - }; - -diff --git a/kernel/bpf/map_in_map.c b/kernel/bpf/map_in_map.c -index 2dfeb5835e16..3248ff5d8161 100644 ---- a/kernel/bpf/map_in_map.c -+++ b/kernel/bpf/map_in_map.c -@@ -129,10 +129,15 @@ void *bpf_map_fd_get_ptr(struct bpf_map *map, - - void bpf_map_fd_put_ptr(struct bpf_map *map, void *ptr, bool need_defer) - { -- /* ptr->ops->map_free() has to go through one -- * rcu grace period by itself. -+ struct bpf_map *inner_map = ptr; -+ -+ /* The inner map may still be used by both non-sleepable and sleepable -+ * bpf program, so free it after one RCU grace period and one tasks -+ * trace RCU grace period. - */ -- bpf_map_put(ptr); -+ if (need_defer) -+ WRITE_ONCE(inner_map->free_after_mult_rcu_gp, true); -+ bpf_map_put(inner_map); - } - - u32 bpf_map_fd_sys_lookup_elem(void *ptr) -diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c -index 0ed286b8a0f0..c6579067eeea 100644 ---- a/kernel/bpf/syscall.c -+++ b/kernel/bpf/syscall.c -@@ -719,6 +719,28 @@ static void bpf_map_put_uref(struct bpf_map *map) - } - } - -+static void bpf_map_free_in_work(struct bpf_map *map) -+{ -+ INIT_WORK(&map->work, bpf_map_free_deferred); -+ /* Avoid spawning kworkers, since they all might contend -+ * for the same mutex like slab_mutex. -+ */ -+ queue_work(system_unbound_wq, &map->work); -+} -+ -+static void bpf_map_free_rcu_gp(struct rcu_head *rcu) -+{ -+ bpf_map_free_in_work(container_of(rcu, struct bpf_map, rcu)); -+} -+ -+static void bpf_map_free_mult_rcu_gp(struct rcu_head *rcu) -+{ -+ if (rcu_trace_implies_rcu_gp()) -+ bpf_map_free_rcu_gp(rcu); -+ else -+ call_rcu(rcu, bpf_map_free_rcu_gp); -+} -+ - /* decrement map refcnt and schedule it for freeing via workqueue - * (underlying map implementation ops->map_free() might sleep) - */ -@@ -728,11 +750,11 @@ void bpf_map_put(struct bpf_map *map) - /* bpf_map_free_id() must be called first */ - bpf_map_free_id(map); - btf_put(map->btf); -- INIT_WORK(&map->work, bpf_map_free_deferred); -- /* Avoid spawning kworkers, since they all might contend -- * for the same mutex like slab_mutex. -- */ -- queue_work(system_unbound_wq, &map->work); -+ -+ if (READ_ONCE(map->free_after_mult_rcu_gp)) -+ call_rcu_tasks_trace(&map->rcu, bpf_map_free_mult_rcu_gp); -+ else -+ bpf_map_free_in_work(map); - } - } - EXPORT_SYMBOL_GPL(bpf_map_put); --- -2.43.2 - -From 1db951f27736d43bc4bb3807ed4bd96e255494e8 Mon Sep 17 00:00:00 2001 -From: Artem Chernyshev <artem.chernyshev@red-soft.ru> -Date: Tue, 28 Nov 2023 14:10:08 +0300 -Subject: [PATCH 0164/1501] scsi: fnic: Return error if vmalloc() failed -Content-Length: 1209 -Lines: 36 - -[ Upstream commit f5f27a332a14f43463aa0075efa3a0c662c0f4a8 ] - -In fnic_init_module() exists redundant check for return value from -fnic_debugfs_init(), because at moment it only can return zero. It make -sense to process theoretical vmalloc() failure. - -Found by Linux Verification Center (linuxtesting.org) with SVACE. - -Fixes: 9730ddfb123d ("scsi: fnic: remove redundant assignment of variable rc") -Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru> -Link: https://lore.kernel.org/r/20231128111008.2280507-1-artem.chernyshev@red-soft.ru -Reviewed-by: Karan Tilak Kumar <kartilak@cisco.com> -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/scsi/fnic/fnic_debugfs.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/scsi/fnic/fnic_debugfs.c b/drivers/scsi/fnic/fnic_debugfs.c -index c4d9ed0d7d75..2619a2d4f5f1 100644 ---- a/drivers/scsi/fnic/fnic_debugfs.c -+++ b/drivers/scsi/fnic/fnic_debugfs.c -@@ -52,9 +52,10 @@ int fnic_debugfs_init(void) - fc_trc_flag->fnic_trace = 2; - fc_trc_flag->fc_trace = 3; - fc_trc_flag->fc_clear = 4; -+ return 0; - } - -- return 0; -+ return -ENOMEM; - } - - /* --- -2.43.2 - -From dd58bb4a43708057eaa981036c9c05650e24598b Mon Sep 17 00:00:00 2001 -From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com> -Date: Thu, 12 Oct 2023 15:00:26 -0700 -Subject: [PATCH 0175/1501] wifi: mt76: mt7996: fix uninitialized variable in - parsing txfree -Content-Length: 1077 -Lines: 27 - -[ Upstream commit 706e83b33103fc5dc945765ddbf6a3e879d21275 ] - -Fix the uninitialized variable warning in mt7996_mac_tx_free. - -Fixes: 2461599f835e ("wifi: mt76: mt7996: get tx_retries and tx_failed from txfree") -Signed-off-by: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com> -Signed-off-by: Felix Fietkau <nbd@nbd.name> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c -index 04540833485f..59ab07b89087 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c -@@ -1074,7 +1074,7 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len) - struct mt76_phy *phy3 = mdev->phys[MT_BAND2]; - struct mt76_txwi_cache *txwi; - struct ieee80211_sta *sta = NULL; -- struct mt76_wcid *wcid; -+ struct mt76_wcid *wcid = NULL; - LIST_HEAD(free_list); - struct sk_buff *skb, *tmp; - void *end = data + len; --- -2.43.2 - -From 72246f7178038ca1b0030b4c1426a93e0c561375 Mon Sep 17 00:00:00 2001 -From: Christian Marangi <ansuelsmth@gmail.com> -Date: Wed, 18 Oct 2023 15:09:38 +0200 -Subject: [PATCH 0176/1501] wifi: mt76: fix typo in - mt76_get_of_eeprom_from_nvmem function -Content-Length: 1374 -Lines: 37 - -[ Upstream commit c33e5f4cbb9f961e66473a9ace077c4d1f29a5bb ] - -Fix typo in mt76_get_of_eeprom_from_nvmem where eeprom was misspelled as -epprom. - -Fixes: 5bef3a406c6e ("wifi: mt76: add support for providing eeprom in nvmem cells") -Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> -Signed-off-by: Felix Fietkau <nbd@nbd.name> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/mediatek/mt76/eeprom.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/wireless/mediatek/mt76/eeprom.c b/drivers/net/wireless/mediatek/mt76/eeprom.c -index 7725dd6763ef..be55c7e0aff1 100644 ---- a/drivers/net/wireless/mediatek/mt76/eeprom.c -+++ b/drivers/net/wireless/mediatek/mt76/eeprom.c -@@ -106,7 +106,7 @@ static int mt76_get_of_epprom_from_mtd(struct mt76_dev *dev, void *eep, int offs - #endif - } - --static int mt76_get_of_epprom_from_nvmem(struct mt76_dev *dev, void *eep, int len) -+static int mt76_get_of_eeprom_from_nvmem(struct mt76_dev *dev, void *eep, int len) - { - struct device_node *np = dev->dev->of_node; - struct nvmem_cell *cell; -@@ -153,7 +153,7 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len) - if (!ret) - return 0; - -- return mt76_get_of_epprom_from_nvmem(dev, eep, len); -+ return mt76_get_of_eeprom_from_nvmem(dev, eep, len); - } - EXPORT_SYMBOL_GPL(mt76_get_of_eeprom); - --- -2.43.2 - -From 9bc3550f86a13dd03f8503ffccaec12d98c69e16 Mon Sep 17 00:00:00 2001 -From: Lorenzo Bianconi <lorenzo@kernel.org> -Date: Fri, 20 Oct 2023 12:45:19 +0200 -Subject: [PATCH 0177/1501] wifi: mt76: mt7915: fallback to non-wed mode if - platform_get_resource fails in mt7915_mmio_wed_init() -Content-Length: 1152 -Lines: 30 - -[ Upstream commit 5f9d5d4fc561e7bd3a18742f1fdb96cab98f1870 ] - -mt76 assumes mt7915_mmio_wed_init can fail just after wed driver has -been attached running mtk_wed_device_attach(). -Fall back to non-wed mode if platform_get_resource fails in -mt7915_mmio_wed_init routines. - -Fixes: eebb70976be5 ("wifi: mt76: mt7915: enable wed for mt7986-wmac chipset") -Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> -Signed-off-by: Felix Fietkau <nbd@nbd.name> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/mediatek/mt76/mt7915/mmio.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c -index e7d8e03f826f..04a49ef67560 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c -@@ -742,7 +742,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr, - - res = platform_get_resource(plat_dev, IORESOURCE_MEM, 0); - if (!res) -- return -ENOMEM; -+ return 0; - - wed->wlan.platform_dev = plat_dev; - wed->wlan.bus_type = MTK_WED_BUS_AXI; --- -2.43.2 - -From 3ecec630ef58df2b6aa168b1089b395671cbf3d7 Mon Sep 17 00:00:00 2001 -From: Sujuan Chen <sujuan.chen@mediatek.com> -Date: Mon, 23 Oct 2023 23:38:49 +0800 -Subject: [PATCH 0178/1501] wifi: mt76: mt7996: fix the size of struct - bss_rate_tlv -Content-Length: 963 -Lines: 28 - -[ Upstream commit 4aa9992674e70074fce450f65ebc95c2ba2b79ae ] - -Align the format of struct bss_rate_tlv to the firmware. - -Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") -Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com> -Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> -Signed-off-by: Felix Fietkau <nbd@nbd.name> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/mediatek/mt76/mt7996/mcu.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h -index a88f6af323da..ebe96a85ca9e 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h -+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h -@@ -247,7 +247,7 @@ struct bss_rate_tlv { - u8 short_preamble; - u8 bc_fixed_rate; - u8 mc_fixed_rate; -- u8 __rsv2[1]; -+ u8 __rsv2[9]; - } __packed; - - struct bss_ra_tlv { --- -2.43.2 - -From a50023ced3b1ca1f424841df662a67678d2c104d Mon Sep 17 00:00:00 2001 -From: MeiChia Chiu <meichia.chiu@mediatek.com> -Date: Mon, 23 Oct 2023 23:38:54 +0800 -Subject: [PATCH 0179/1501] wifi: mt76: mt7996: fix rate usage of inband - discovery frames -Content-Length: 1444 -Lines: 34 - -[ Upstream commit 1e3f387736c744e73b5398a147b90412f82f54da ] - -For UBPR and FILS frames, the BSS_CHANGED_BEACON flag will also be set, -which causes those frames to use the beacon rate in TX descriptors. -Adjust the statement to fix this issue. - -Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") -Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com> -Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> -Signed-off-by: Felix Fietkau <nbd@nbd.name> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c -index 59ab07b89087..fa3001e59a36 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c -@@ -840,10 +840,10 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi, - struct mt76_vif *mvif; - u16 tx_count = 15; - u32 val; -- bool beacon = !!(changed & (BSS_CHANGED_BEACON | -- BSS_CHANGED_BEACON_ENABLED)); - bool inband_disc = !!(changed & (BSS_CHANGED_UNSOL_BCAST_PROBE_RESP | - BSS_CHANGED_FILS_DISCOVERY)); -+ bool beacon = !!(changed & (BSS_CHANGED_BEACON | -+ BSS_CHANGED_BEACON_ENABLED)) && (!inband_disc); - - mvif = vif ? (struct mt76_vif *)vif->drv_priv : NULL; - if (mvif) { --- -2.43.2 - -From 1c69fade102d2bcb37da4892eacc4b06bf7237d6 Mon Sep 17 00:00:00 2001 -From: StanleyYP Wang <StanleyYP.Wang@mediatek.com> -Date: Thu, 2 Nov 2023 18:02:59 +0800 -Subject: [PATCH 0180/1501] wifi: mt76: mt7996: fix alignment of sta info event -Content-Length: 946 -Lines: 28 - -[ Upstream commit d58a9778f7ca0634622d2fc2e9f76163467bdf5b ] - -Fix the alignment of struct mt7996_mcu_all_sta_info_event. - -Fixes: adde3eed4a75 ("wifi: mt76: mt7996: Add mcu commands for getting sta tx statistic") -Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> -Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> -Signed-off-by: Felix Fietkau <nbd@nbd.name> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/mediatek/mt76/mt7996/mcu.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h -index ebe96a85ca9e..14c0dd31387a 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h -+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h -@@ -160,7 +160,7 @@ struct mt7996_mcu_all_sta_info_event { - u8 more; - u8 rsv2; - __le16 sta_num; -- u8 rsv3[2]; -+ u8 rsv3[4]; - - union { - struct { --- -2.43.2 - -From 90f1b2ff2b7b1e78c5a87ca010a66291a1652321 Mon Sep 17 00:00:00 2001 -From: StanleyYP Wang <StanleyYP.Wang@mediatek.com> -Date: Mon, 6 Nov 2023 22:38:53 +0000 -Subject: [PATCH 0181/1501] wifi: mt76: mt7915: fix EEPROM offset of TSSI flag - on MT7981 -Content-Length: 1175 -Lines: 30 - -[ Upstream commit 3531c72aedb95261f4d78c47efa4b5ba7cdcddd9 ] - -The offset of the TSSI flag on the EEPROM of MT7981 devices was wrong. -Set the correct offset instead. - -Fixes: 6bad146d162e ("wifi: mt76: mt7915: add support for MT7981") -Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> -Signed-off-by: Daniel Golle <daniel@makrotopia.org> -Signed-off-by: Felix Fietkau <nbd@nbd.name> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h -index f3e56817d36e..adc26a222823 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h -+++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h -@@ -144,7 +144,8 @@ static inline bool - mt7915_tssi_enabled(struct mt7915_dev *dev, enum nl80211_band band) - { - u8 *eep = dev->mt76.eeprom.data; -- u8 val = eep[MT_EE_WIFI_CONF + 7]; -+ u8 offs = is_mt7981(&dev->mt76) ? 8 : 7; -+ u8 val = eep[MT_EE_WIFI_CONF + offs]; - - if (band == NL80211_BAND_2GHZ) - return val & MT_EE_WIFI_CONF7_TSSI0_2G; --- -2.43.2 - -From 33fd9701237c5cd047b0cfa4531f15c0ab80ff8d Mon Sep 17 00:00:00 2001 -From: StanleyYP Wang <StanleyYP.Wang@mediatek.com> -Date: Mon, 6 Nov 2023 22:39:31 +0000 -Subject: [PATCH 0182/1501] wifi: mt76: mt7915: also MT7981 is 3T3R but nss2 on - 5 GHz band -Content-Length: 1464 -Lines: 33 - -[ Upstream commit ff434cc129d6907e6dbc89dd0ebc59fd3646d4c2 ] - -Just like MT7916 also MT7981 can handle 3T3R DBDC frontend and should -hence be included in the corresponding conditional expression in the -driver. Add it. - -Fixes: 6bad146d162e ("wifi: mt76: mt7915: add support for MT7981") -Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> -Signed-off-by: Daniel Golle <daniel@makrotopia.org> -Signed-off-by: Felix Fietkau <nbd@nbd.name> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/mediatek/mt76/mt7915/main.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c -index a3fd54cc1911..9d747eb8ab82 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c -@@ -1059,8 +1059,9 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant) - - phy->mt76->antenna_mask = tx_ant; - -- /* handle a variant of mt7916 which has 3T3R but nss2 on 5 GHz band */ -- if (is_mt7916(&dev->mt76) && band && hweight8(tx_ant) == max_nss) -+ /* handle a variant of mt7916/mt7981 which has 3T3R but nss2 on 5 GHz band */ -+ if ((is_mt7916(&dev->mt76) || is_mt7981(&dev->mt76)) && -+ band && hweight8(tx_ant) == max_nss) - phy->mt76->chainmask = (dev->chainmask >> chainshift) << chainshift; - else - phy->mt76->chainmask = tx_ant << (chainshift * band); --- -2.43.2 - -From 573af2747a94d99f4a529b6f34938aa4aec5aaa0 Mon Sep 17 00:00:00 2001 -From: Arnd Bergmann <arnd@arndb.de> -Date: Fri, 10 Nov 2023 15:29:30 +0100 -Subject: [PATCH 0183/1501] wifi: mt76: mt7996: fix - mt7996_mcu_all_sta_info_event struct packing -Content-Length: 1712 -Lines: 44 - -[ Upstream commit 2ee1c40daeb9a33e25c460bf87feca58e91af879 ] - -The internal struct and union inside mt7996_mcu_all_sta_info_event is -marked as being aligned, which conflicts with it being unaligned -within that structure: - -drivers/net/wireless/mediatek/mt76/mt7996/mcu.h:165:2: error: field within 'struct mt7996_mcu_all_sta_info_event' is less aligned than 'union mt7996_mcu_all_sta_info_event::(anonymous at ../drivers/net/wireless/mediatek/mt76/mt7996/mcu.h:165:2)' and is usually due to 'struct mt7996_mcu_all_sta_info_event' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] - -Mark all three as being packed as well to ensure byte packing for -the entire thing. - -Fixes: adde3eed4a75 ("wifi: mt76: mt7996: Add mcu commands for getting sta tx statistic") -Signed-off-by: Arnd Bergmann <arnd@arndb.de> -Signed-off-by: Felix Fietkau <nbd@nbd.name> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/mediatek/mt76/mt7996/mcu.h | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h -index 14c0dd31387a..9300cd8eeb76 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h -+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h -@@ -168,15 +168,15 @@ struct mt7996_mcu_all_sta_info_event { - u8 rsv[2]; - __le32 tx_bytes[IEEE80211_NUM_ACS]; - __le32 rx_bytes[IEEE80211_NUM_ACS]; -- } adm_stat[0]; -+ } adm_stat[0] __packed; - - struct { - __le16 wlan_idx; - u8 rsv[2]; - __le32 tx_msdu_cnt; - __le32 rx_msdu_cnt; -- } msdu_cnt[0]; -- }; -+ } msdu_cnt[0] __packed; -+ } __packed; - } __packed; - - enum mt7996_chan_mib_offs { --- -2.43.2 - -From ee86f6d9740a5cdedf2f8e246b2f75b4b0480978 Mon Sep 17 00:00:00 2001 -From: Wang Zhao <wang.zhao@mediatek.com> -Date: Fri, 17 Nov 2023 20:54:49 +0800 -Subject: [PATCH 0184/1501] wifi: mt76: mt7921s: fix workqueue problem causes - STA association fail -Content-Length: 6938 -Lines: 171 - -[ Upstream commit 92184eae1d5ad804884e2c6e289d885b9e3194d1 ] - -The ieee80211_queue_work function queues work into the mac80211 -local->workqueue, which is widely used for mac80211 internal -work processes. In the mt76 driver, both the mt76-sido-status and -mt76-sdio-net threads enqueue workers to the workqueue with this -function. However, in some cases, when two workers are enqueued -to the workqueue almost simultaneously, the second worker may not -be scheduled immediately and may get stuck for a while. -This can cause timing issues. To avoid these timing -conflicts caused by worker scheduling, replace the worker -with an independent thread. - -Fixes: 48fab5bbef40 ("mt76: mt7921: introduce mt7921s support") -Signed-off-by: Wang Zhao <wang.zhao@mediatek.com> -Signed-off-by: Deren Wu <deren.wu@mediatek.com> -Signed-off-by: Felix Fietkau <nbd@nbd.name> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/mediatek/mt76/mt76.h | 3 +-- - .../net/wireless/mediatek/mt76/mt7615/sdio.c | 2 +- - .../net/wireless/mediatek/mt76/mt7921/sdio.c | 4 +++- - .../wireless/mediatek/mt76/mt7921/sdio_mac.c | 3 ++- - drivers/net/wireless/mediatek/mt76/sdio.c | 18 +++++++++++------- - 5 files changed, 18 insertions(+), 12 deletions(-) - -diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h -index ea828ba0b83a..a17b2fbd693b 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt76.h -+++ b/drivers/net/wireless/mediatek/mt76/mt76.h -@@ -575,8 +575,7 @@ struct mt76_sdio { - struct mt76_worker txrx_worker; - struct mt76_worker status_worker; - struct mt76_worker net_worker; -- -- struct work_struct stat_work; -+ struct mt76_worker stat_worker; - - u8 *xmit_buf; - u32 xmit_buf_sz; -diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/sdio.c b/drivers/net/wireless/mediatek/mt76/mt7615/sdio.c -index fc547a0031ea..67cedd2555f9 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7615/sdio.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7615/sdio.c -@@ -204,8 +204,8 @@ static int mt7663s_suspend(struct device *dev) - mt76_worker_disable(&mdev->mt76.sdio.txrx_worker); - mt76_worker_disable(&mdev->mt76.sdio.status_worker); - mt76_worker_disable(&mdev->mt76.sdio.net_worker); -+ mt76_worker_disable(&mdev->mt76.sdio.stat_worker); - -- cancel_work_sync(&mdev->mt76.sdio.stat_work); - clear_bit(MT76_READING_STATS, &mdev->mphy.state); - - mt76_tx_status_check(&mdev->mt76, true); -diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c b/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c -index dc1beb76df3e..7591e54d2897 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c -@@ -228,7 +228,7 @@ static int mt7921s_suspend(struct device *__dev) - mt76_txq_schedule_all(&dev->mphy); - mt76_worker_disable(&mdev->tx_worker); - mt76_worker_disable(&mdev->sdio.status_worker); -- cancel_work_sync(&mdev->sdio.stat_work); -+ mt76_worker_disable(&mdev->sdio.stat_worker); - clear_bit(MT76_READING_STATS, &dev->mphy.state); - mt76_tx_status_check(mdev, true); - -@@ -260,6 +260,7 @@ static int mt7921s_suspend(struct device *__dev) - restore_worker: - mt76_worker_enable(&mdev->tx_worker); - mt76_worker_enable(&mdev->sdio.status_worker); -+ mt76_worker_enable(&mdev->sdio.stat_worker); - - if (!pm->ds_enable) - mt76_connac_mcu_set_deep_sleep(mdev, false); -@@ -292,6 +293,7 @@ static int mt7921s_resume(struct device *__dev) - mt76_worker_enable(&mdev->sdio.txrx_worker); - mt76_worker_enable(&mdev->sdio.status_worker); - mt76_worker_enable(&mdev->sdio.net_worker); -+ mt76_worker_enable(&mdev->sdio.stat_worker); - - /* restore previous ds setting */ - if (!pm->ds_enable) -diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c -index 8edd0291c128..389eb0903807 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c -@@ -107,7 +107,7 @@ int mt7921s_mac_reset(struct mt792x_dev *dev) - mt76_worker_disable(&dev->mt76.sdio.txrx_worker); - mt76_worker_disable(&dev->mt76.sdio.status_worker); - mt76_worker_disable(&dev->mt76.sdio.net_worker); -- cancel_work_sync(&dev->mt76.sdio.stat_work); -+ mt76_worker_disable(&dev->mt76.sdio.stat_worker); - - mt7921s_disable_irq(&dev->mt76); - mt7921s_wfsys_reset(dev); -@@ -115,6 +115,7 @@ int mt7921s_mac_reset(struct mt792x_dev *dev) - mt76_worker_enable(&dev->mt76.sdio.txrx_worker); - mt76_worker_enable(&dev->mt76.sdio.status_worker); - mt76_worker_enable(&dev->mt76.sdio.net_worker); -+ mt76_worker_enable(&dev->mt76.sdio.stat_worker); - - dev->fw_assert = false; - clear_bit(MT76_MCU_RESET, &dev->mphy.state); -diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c -index 419723118ded..c52d550f0c32 100644 ---- a/drivers/net/wireless/mediatek/mt76/sdio.c -+++ b/drivers/net/wireless/mediatek/mt76/sdio.c -@@ -481,21 +481,21 @@ static void mt76s_status_worker(struct mt76_worker *w) - if (dev->drv->tx_status_data && ndata_frames > 0 && - !test_and_set_bit(MT76_READING_STATS, &dev->phy.state) && - !test_bit(MT76_STATE_SUSPEND, &dev->phy.state)) -- ieee80211_queue_work(dev->hw, &dev->sdio.stat_work); -+ mt76_worker_schedule(&sdio->stat_worker); - } while (nframes > 0); - - if (resched) - mt76_worker_schedule(&dev->tx_worker); - } - --static void mt76s_tx_status_data(struct work_struct *work) -+static void mt76s_tx_status_data(struct mt76_worker *worker) - { - struct mt76_sdio *sdio; - struct mt76_dev *dev; - u8 update = 1; - u16 count = 0; - -- sdio = container_of(work, struct mt76_sdio, stat_work); -+ sdio = container_of(worker, struct mt76_sdio, stat_worker); - dev = container_of(sdio, struct mt76_dev, sdio); - - while (true) { -@@ -508,7 +508,7 @@ static void mt76s_tx_status_data(struct work_struct *work) - } - - if (count && test_bit(MT76_STATE_RUNNING, &dev->phy.state)) -- ieee80211_queue_work(dev->hw, &sdio->stat_work); -+ mt76_worker_schedule(&sdio->status_worker); - else - clear_bit(MT76_READING_STATS, &dev->phy.state); - } -@@ -600,8 +600,8 @@ void mt76s_deinit(struct mt76_dev *dev) - mt76_worker_teardown(&sdio->txrx_worker); - mt76_worker_teardown(&sdio->status_worker); - mt76_worker_teardown(&sdio->net_worker); -+ mt76_worker_teardown(&sdio->stat_worker); - -- cancel_work_sync(&sdio->stat_work); - clear_bit(MT76_READING_STATS, &dev->phy.state); - - mt76_tx_status_check(dev, true); -@@ -644,10 +644,14 @@ int mt76s_init(struct mt76_dev *dev, struct sdio_func *func, - if (err) - return err; - -+ err = mt76_worker_setup(dev->hw, &sdio->stat_worker, mt76s_tx_status_data, -+ "sdio-sta"); -+ if (err) -+ return err; -+ - sched_set_fifo_low(sdio->status_worker.task); - sched_set_fifo_low(sdio->net_worker.task); -- -- INIT_WORK(&sdio->stat_work, mt76s_tx_status_data); -+ sched_set_fifo_low(sdio->stat_worker.task); - - dev->queue_ops = &sdio_queue_ops; - dev->bus = bus_ops; --- -2.43.2 - -From af5c4997d329918327e831584bdc67a24f7d9139 Mon Sep 17 00:00:00 2001 -From: Moudy Ho <moudy.ho@mediatek.com> -Date: Tue, 31 Oct 2023 16:33:42 +0800 -Subject: [PATCH 0190/1501] dt-bindings: media: mediatek: mdp3: correct RDMA - and WROT node with generic names -Content-Length: 4383 -Lines: 116 - -[ Upstream commit f5f185bf7c42f6ca885202fefc40fc871d08a722 ] - -The DMA-related nodes RDMA/WROT in MDP3 should be changed to generic names. -In addition, fix improper space indent in example. - -Fixes: 4ad7b39623ab ("media: dt-binding: mediatek: add bindings for MediaTek MDP3 components") -Signed-off-by: Moudy Ho <moudy.ho@mediatek.com> -Acked-by: Rob Herring <robh@kernel.org> -Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> -Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../bindings/media/mediatek,mdp3-rdma.yaml | 29 +++++++++++-------- - .../bindings/media/mediatek,mdp3-wrot.yaml | 23 +++++++++------ - 2 files changed, 31 insertions(+), 21 deletions(-) - -diff --git a/Documentation/devicetree/bindings/media/mediatek,mdp3-rdma.yaml b/Documentation/devicetree/bindings/media/mediatek,mdp3-rdma.yaml -index 7032c7e15039..3e128733ef53 100644 ---- a/Documentation/devicetree/bindings/media/mediatek,mdp3-rdma.yaml -+++ b/Documentation/devicetree/bindings/media/mediatek,mdp3-rdma.yaml -@@ -61,6 +61,9 @@ properties: - - description: used for 1st data pipe from RDMA - - description: used for 2nd data pipe from RDMA - -+ '#dma-cells': -+ const: 1 -+ - required: - - compatible - - reg -@@ -70,6 +73,7 @@ required: - - clocks - - iommus - - mboxes -+ - '#dma-cells' - - additionalProperties: false - -@@ -80,16 +84,17 @@ examples: - #include <dt-bindings/power/mt8183-power.h> - #include <dt-bindings/memory/mt8183-larb-port.h> - -- mdp3_rdma0: mdp3-rdma0@14001000 { -- compatible = "mediatek,mt8183-mdp3-rdma"; -- reg = <0x14001000 0x1000>; -- mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x1000 0x1000>; -- mediatek,gce-events = <CMDQ_EVENT_MDP_RDMA0_SOF>, -- <CMDQ_EVENT_MDP_RDMA0_EOF>; -- power-domains = <&spm MT8183_POWER_DOMAIN_DISP>; -- clocks = <&mmsys CLK_MM_MDP_RDMA0>, -- <&mmsys CLK_MM_MDP_RSZ1>; -- iommus = <&iommu>; -- mboxes = <&gce 20 CMDQ_THR_PRIO_LOWEST>, -- <&gce 21 CMDQ_THR_PRIO_LOWEST>; -+ dma-controller@14001000 { -+ compatible = "mediatek,mt8183-mdp3-rdma"; -+ reg = <0x14001000 0x1000>; -+ mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x1000 0x1000>; -+ mediatek,gce-events = <CMDQ_EVENT_MDP_RDMA0_SOF>, -+ <CMDQ_EVENT_MDP_RDMA0_EOF>; -+ power-domains = <&spm MT8183_POWER_DOMAIN_DISP>; -+ clocks = <&mmsys CLK_MM_MDP_RDMA0>, -+ <&mmsys CLK_MM_MDP_RSZ1>; -+ iommus = <&iommu>; -+ mboxes = <&gce 20 CMDQ_THR_PRIO_LOWEST>, -+ <&gce 21 CMDQ_THR_PRIO_LOWEST>; -+ #dma-cells = <1>; - }; -diff --git a/Documentation/devicetree/bindings/media/mediatek,mdp3-wrot.yaml b/Documentation/devicetree/bindings/media/mediatek,mdp3-wrot.yaml -index 0baa77198fa2..64ea98aa0592 100644 ---- a/Documentation/devicetree/bindings/media/mediatek,mdp3-wrot.yaml -+++ b/Documentation/devicetree/bindings/media/mediatek,mdp3-wrot.yaml -@@ -50,6 +50,9 @@ properties: - iommus: - maxItems: 1 - -+ '#dma-cells': -+ const: 1 -+ - required: - - compatible - - reg -@@ -58,6 +61,7 @@ required: - - power-domains - - clocks - - iommus -+ - '#dma-cells' - - additionalProperties: false - -@@ -68,13 +72,14 @@ examples: - #include <dt-bindings/power/mt8183-power.h> - #include <dt-bindings/memory/mt8183-larb-port.h> - -- mdp3_wrot0: mdp3-wrot0@14005000 { -- compatible = "mediatek,mt8183-mdp3-wrot"; -- reg = <0x14005000 0x1000>; -- mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x5000 0x1000>; -- mediatek,gce-events = <CMDQ_EVENT_MDP_WROT0_SOF>, -- <CMDQ_EVENT_MDP_WROT0_EOF>; -- power-domains = <&spm MT8183_POWER_DOMAIN_DISP>; -- clocks = <&mmsys CLK_MM_MDP_WROT0>; -- iommus = <&iommu>; -+ dma-controller@14005000 { -+ compatible = "mediatek,mt8183-mdp3-wrot"; -+ reg = <0x14005000 0x1000>; -+ mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x5000 0x1000>; -+ mediatek,gce-events = <CMDQ_EVENT_MDP_WROT0_SOF>, -+ <CMDQ_EVENT_MDP_WROT0_EOF>; -+ power-domains = <&spm MT8183_POWER_DOMAIN_DISP>; -+ clocks = <&mmsys CLK_MM_MDP_WROT0>; -+ iommus = <&iommu>; -+ #dma-cells = <1>; - }; --- -2.43.2 - -From 5c8cac512844ad593d31258e215908014381bee2 Mon Sep 17 00:00:00 2001 -From: Ming Yen Hsieh <mingyen.hsieh@mediatek.com> -Date: Wed, 22 Nov 2023 11:06:44 +0800 -Subject: [PATCH 0195/1501] wifi: mt76: mt7921: fix country count limitation - for CLC -Content-Length: 1969 -Lines: 57 - -[ Upstream commit fa6ad88e023ddfa6c5dcdb466d159e89f451e305 ] - -Due to the increase in the number of power tables for 6Ghz on CLC, -the variable nr_country is no longer sufficient to represent the -total quantity. Therefore, we have switched to calculating the -length of clc buf to obtain the correct power table. Additionally, -the version number has been incremented to 1. - -Fixes: 23bdc5d8cadf ("wifi: mt76: mt7921: introduce Country Location Control support") -Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com> -Signed-off-by: Felix Fietkau <nbd@nbd.name> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 11 ++++++++--- - 1 file changed, 8 insertions(+), 3 deletions(-) - -diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c -index 2cc2d2788f83..399d7ca6bebc 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c -@@ -1263,13 +1263,15 @@ int __mt7921_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2, - u8 env_6g; - u8 rsvd[63]; - } __packed req = { -+ .ver = 1, - .idx = idx, - .env = env_cap, - .env_6g = dev->phy.power_type, - .acpi_conf = mt792x_acpi_get_flags(&dev->phy), - }; - int ret, valid_cnt = 0; -- u8 i, *pos; -+ u16 buf_len = 0; -+ u8 *pos; - - if (!clc) - return 0; -@@ -1279,12 +1281,15 @@ int __mt7921_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2, - if (mt76_find_power_limits_node(&dev->mt76)) - req.cap |= CLC_CAP_DTS_EN; - -+ buf_len = le16_to_cpu(clc->len) - sizeof(*clc); - pos = clc->data; -- for (i = 0; i < clc->nr_country; i++) { -+ while (buf_len > 16) { - struct mt7921_clc_rule *rule = (struct mt7921_clc_rule *)pos; - u16 len = le16_to_cpu(rule->len); -+ u16 offset = len + sizeof(*rule); - -- pos += len + sizeof(*rule); -+ pos += offset; -+ buf_len -= offset; - if (rule->alpha2[0] != alpha2[0] || - rule->alpha2[1] != alpha2[1]) - continue; --- -2.43.2 - -From 33af3fb9fc896d4aa9166f8a8b397d0ac8e08ef3 Mon Sep 17 00:00:00 2001 -From: Ming Yen Hsieh <mingyen.hsieh@mediatek.com> -Date: Wed, 22 Nov 2023 11:06:45 +0800 -Subject: [PATCH 0196/1501] wifi: mt76: mt7921: fix CLC command timeout when - suspend/resume -Content-Length: 3816 -Lines: 96 - -[ Upstream commit d0a2bc5fe712217d2c73822ae75fd4e69a15cb2c ] - -When enter suspend/resume while in a connected state, the upper layer -will trigger disconnection before entering suspend, and at the same time, -it will trigger regd_notifier() and update CLC, causing the CLC event to -not be received due to suspend, resulting in a command timeout. - -Therefore, the update of CLC is postponed until resume, to ensure data -consistency and avoid the occurrence of command timeout. - -Fixes: 4fc8df50fd41 ("wifi: mt76: mt7921: get regulatory information from the clc event") -Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com> -Signed-off-by: Felix Fietkau <nbd@nbd.name> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../net/wireless/mediatek/mt76/mt7921/init.c | 25 ++++++++++++++----- - .../wireless/mediatek/mt76/mt7921/mt7921.h | 1 + - .../net/wireless/mediatek/mt76/mt7921/pci.c | 3 +++ - 3 files changed, 23 insertions(+), 6 deletions(-) - -diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/init.c b/drivers/net/wireless/mediatek/mt76/mt7921/init.c -index 7d6a9d746011..48433c6d5e7d 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7921/init.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7921/init.c -@@ -110,24 +110,37 @@ mt7921_regd_channel_update(struct wiphy *wiphy, struct mt792x_dev *dev) - } - } - -+void mt7921_regd_update(struct mt792x_dev *dev) -+{ -+ struct mt76_dev *mdev = &dev->mt76; -+ struct ieee80211_hw *hw = mdev->hw; -+ struct wiphy *wiphy = hw->wiphy; -+ -+ mt7921_mcu_set_clc(dev, mdev->alpha2, dev->country_ie_env); -+ mt7921_regd_channel_update(wiphy, dev); -+ mt76_connac_mcu_set_channel_domain(hw->priv); -+ mt7921_set_tx_sar_pwr(hw, NULL); -+} -+EXPORT_SYMBOL_GPL(mt7921_regd_update); -+ - static void - mt7921_regd_notifier(struct wiphy *wiphy, - struct regulatory_request *request) - { - struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy); - struct mt792x_dev *dev = mt792x_hw_dev(hw); -+ struct mt76_connac_pm *pm = &dev->pm; - - memcpy(dev->mt76.alpha2, request->alpha2, sizeof(dev->mt76.alpha2)); - dev->mt76.region = request->dfs_region; - dev->country_ie_env = request->country_ie_env; - -- mt792x_mutex_acquire(dev); -- mt7921_mcu_set_clc(dev, request->alpha2, request->country_ie_env); -- mt76_connac_mcu_set_channel_domain(hw->priv); -- mt7921_set_tx_sar_pwr(hw, NULL); -- mt792x_mutex_release(dev); -+ if (pm->suspended) -+ return; - -- mt7921_regd_channel_update(wiphy, dev); -+ mt792x_mutex_acquire(dev); -+ mt7921_regd_update(dev); -+ mt792x_mutex_release(dev); - } - - int mt7921_mac_init(struct mt792x_dev *dev) -diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h -index f28621121927..5c4cc370e6ce 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h -+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h -@@ -233,6 +233,7 @@ mt7921_l1_rmw(struct mt792x_dev *dev, u32 addr, u32 mask, u32 val) - #define mt7921_l1_set(dev, addr, val) mt7921_l1_rmw(dev, addr, 0, val) - #define mt7921_l1_clear(dev, addr, val) mt7921_l1_rmw(dev, addr, val, 0) - -+void mt7921_regd_update(struct mt792x_dev *dev); - int mt7921_mac_init(struct mt792x_dev *dev); - bool mt7921_mac_wtbl_update(struct mt792x_dev *dev, int idx, u32 mask); - int mt7921_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif, -diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c -index f04e7095e181..42fd456eb6fa 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c -@@ -507,6 +507,9 @@ static int mt7921_pci_resume(struct device *device) - mt76_connac_mcu_set_deep_sleep(&dev->mt76, false); - - err = mt76_connac_mcu_set_hif_suspend(mdev, false); -+ -+ mt7921_regd_update(dev); -+ - failed: - pm->suspended = false; - --- -2.43.2 - -From 05534fc3de5461dec973fcdfbd0002f9ce346056 Mon Sep 17 00:00:00 2001 -From: Ming Yen Hsieh <mingyen.hsieh@mediatek.com> -Date: Wed, 22 Nov 2023 11:06:46 +0800 -Subject: [PATCH 0197/1501] wifi: mt76: mt7921: fix wrong 6Ghz power type -Content-Length: 2845 -Lines: 94 - -[ Upstream commit 10f2903147ed04784522ab841c20bb469bdd8681 ] - -To avoid using incorrect 6g power settings after disconnection, -it should to update back to the default state when disconnected. - -Fixes: 51ba0e3a15eb ("wifi: mt76: mt7921: add 6GHz power type support for clc") -Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com> -Signed-off-by: Felix Fietkau <nbd@nbd.name> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../net/wireless/mediatek/mt76/mt7921/main.c | 38 +++++++++++++++++-- - 1 file changed, 35 insertions(+), 3 deletions(-) - -diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c -index 510a575a973b..0645417e0582 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c -@@ -683,17 +683,45 @@ static void mt7921_bss_info_changed(struct ieee80211_hw *hw, - } - - static void --mt7921_regd_set_6ghz_power_type(struct ieee80211_vif *vif) -+mt7921_calc_vif_num(void *priv, u8 *mac, struct ieee80211_vif *vif) -+{ -+ u32 *num = priv; -+ -+ if (!priv) -+ return; -+ -+ switch (vif->type) { -+ case NL80211_IFTYPE_STATION: -+ case NL80211_IFTYPE_P2P_CLIENT: -+ case NL80211_IFTYPE_AP: -+ case NL80211_IFTYPE_P2P_GO: -+ *num += 1; -+ break; -+ default: -+ break; -+ } -+} -+ -+static void -+mt7921_regd_set_6ghz_power_type(struct ieee80211_vif *vif, bool is_add) - { - struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv; - struct mt792x_phy *phy = mvif->phy; - struct mt792x_dev *dev = phy->dev; -+ u32 valid_vif_num = 0; - -- if (hweight64(dev->mt76.vif_mask) > 1) { -+ ieee80211_iterate_active_interfaces(mt76_hw(dev), -+ IEEE80211_IFACE_ITER_RESUME_ALL, -+ mt7921_calc_vif_num, &valid_vif_num); -+ -+ if (valid_vif_num > 1) { - phy->power_type = MT_AP_DEFAULT; - goto out; - } - -+ if (!is_add) -+ vif->bss_conf.power_type = IEEE80211_REG_UNSET_AP; -+ - switch (vif->bss_conf.power_type) { - case IEEE80211_REG_SP_AP: - phy->power_type = MT_AP_SP; -@@ -705,6 +733,8 @@ mt7921_regd_set_6ghz_power_type(struct ieee80211_vif *vif) - phy->power_type = MT_AP_LPI; - break; - case IEEE80211_REG_UNSET_AP: -+ phy->power_type = MT_AP_UNSET; -+ break; - default: - phy->power_type = MT_AP_DEFAULT; - break; -@@ -749,7 +779,7 @@ int mt7921_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif, - if (ret) - return ret; - -- mt7921_regd_set_6ghz_power_type(vif); -+ mt7921_regd_set_6ghz_power_type(vif, true); - - mt76_connac_power_save_sched(&dev->mphy, &dev->pm); - -@@ -811,6 +841,8 @@ void mt7921_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif, - list_del_init(&msta->wcid.poll_list); - spin_unlock_bh(&dev->mt76.sta_poll_lock); - -+ mt7921_regd_set_6ghz_power_type(vif, false); -+ - mt76_connac_power_save_sched(&dev->mphy, &dev->pm); - } - EXPORT_SYMBOL_GPL(mt7921_mac_sta_remove); --- -2.43.2 - -From dab5e71fe7e234e9ebe8cb2b9e3932ce7c0e0ec4 Mon Sep 17 00:00:00 2001 -From: Miri Korenblit <miriam.rachel.korenblit@intel.com> -Date: Thu, 7 Dec 2023 04:50:08 +0200 -Subject: [PATCH 0198/1501] wifi: iwlwifi: don't support triggered EHT CQI - feedback -Content-Length: 1540 -Lines: 31 - -[ Upstream commit 637bbd5b3cbd0fc6945ebd2e311315b6cca1f9c5 ] - -EHT CQI is one of the EHT PHY capabilities. We don't support EHT CQI. -The non-triggered CQI feedback bit was unset in a previous patch, -but the triggered CQI feedback bit wasn't. Unset it. - -Fixes: 0e21ec6edbb5 ("wifi: iwlwifi: nvm: Update EHT capabilities for GL device") -Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> -Link: https://msgid.link/20231207044813.092528daf59e.I5715769490835819beddb00c91bbc9e806e170cb@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c -index 6015e1255d2a..480f8edbfd35 100644 ---- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c -+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c -@@ -1029,7 +1029,8 @@ iwl_nvm_fixup_sband_iftd(struct iwl_trans *trans, - IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK | - IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK | - IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK | -- IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK); -+ IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK | -+ IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK); - iftype_data->eht_cap.eht_cap_elem.phy_cap_info[4] &= - ~(IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO | - IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP); --- -2.43.2 - -From d6bb0fc39623fd6a670bf6e1b6ab86f027a6c6c6 Mon Sep 17 00:00:00 2001 -From: Li Nan <linan122@huawei.com> -Date: Mon, 11 Dec 2023 15:53:56 +0800 -Subject: [PATCH 0200/1501] block: Set memalloc_noio to false on - device_add_disk() error path -Content-Length: 1176 -Lines: 31 - -[ Upstream commit 5fa3d1a00c2d4ba14f1300371ad39d5456e890d7 ] - -On the error path of device_add_disk(), device's memalloc_noio flag was -set but not cleared. As the comment of pm_runtime_set_memalloc_noio(), -"The function should be called between device_add() and device_del()". -Clear this flag before device_del() now. - -Fixes: 25e823c8c37d ("block/genhd.c: apply pm_runtime_set_memalloc_noio on block devices") -Signed-off-by: Li Nan <linan122@huawei.com> -Reviewed-by: Christoph Hellwig <hch@lst.de> -Link: https://lore.kernel.org/r/20231211075356.1839282-1-linan666@huaweicloud.com -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - block/genhd.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/block/genhd.c b/block/genhd.c -index c9d06f72c587..13db3a7943d8 100644 ---- a/block/genhd.c -+++ b/block/genhd.c -@@ -542,6 +542,7 @@ int __must_check device_add_disk(struct device *parent, struct gendisk *disk, - kobject_put(disk->part0->bd_holder_dir); - out_del_block_link: - sysfs_remove_link(block_depr, dev_name(ddev)); -+ pm_runtime_set_memalloc_noio(ddev, false); - out_device_del: - device_del(ddev); - out_free_ext_minor: --- -2.43.2 - -From 524c27ad167e05c51d31ff41b17eeb1de15bf956 Mon Sep 17 00:00:00 2001 -From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> -Date: Fri, 8 Dec 2023 12:28:47 +0530 -Subject: [PATCH 0204/1501] scsi: ufs: qcom: Fix the return value of - ufs_qcom_ice_program_key() -Content-Length: 1304 -Lines: 32 - -[ Upstream commit 3bf7ab4ac30c03beecf57c052e87d5a38fb8aed6 ] - -Currently, the function returns -EINVAL if algorithm other than AES-256-XTS -is requested. But the correct error code is -EOPNOTSUPP. Fix it! - -Cc: Abel Vesa <abel.vesa@linaro.org> -Fixes: 56541c7c4468 ("scsi: ufs: ufs-qcom: Switch to the new ICE API") -Reviewed-by: Abel Vesa <abel.vesa@linaro.org> -Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> -Link: https://lore.kernel.org/r/20231208065902.11006-3-manivannan.sadhasivam@linaro.org -Tested-by: Andrew Halaney <ahalaney@redhat.com> # sa8775p-ride -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/ufs/host/ufs-qcom.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c -index 17e24270477d..c92cdca21fe1 100644 ---- a/drivers/ufs/host/ufs-qcom.c -+++ b/drivers/ufs/host/ufs-qcom.c -@@ -158,7 +158,7 @@ static int ufs_qcom_ice_program_key(struct ufs_hba *hba, - cap = hba->crypto_cap_array[cfg->crypto_cap_idx]; - if (cap.algorithm_id != UFS_CRYPTO_ALG_AES_XTS || - cap.key_size != UFS_CRYPTO_KEY_SIZE_256) -- return -EINVAL; -+ return -EOPNOTSUPP; - - if (config_enable) - return qcom_ice_program_key(host->ice, --- -2.43.2 - -From 407f893d748df2ee3f597941456f89dc5ca1f87c Mon Sep 17 00:00:00 2001 -From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> -Date: Fri, 8 Dec 2023 12:28:48 +0530 -Subject: [PATCH 0205/1501] scsi: ufs: qcom: Fix the return value when - platform_get_resource_byname() fails -Content-Length: 1215 -Lines: 31 - -[ Upstream commit 3a747c5cf9b6c36649783b28d2ef8f9c92b16a0f ] - -The return value should be -ENODEV indicating that the resource is not -provided in DT, not -ENOMEM. Fix it! - -Fixes: c263b4ef737e ("scsi: ufs: core: mcq: Configure resource regions") -Reviewed-by: Andrew Halaney <ahalaney@redhat.com> -Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> -Link: https://lore.kernel.org/r/20231208065902.11006-4-manivannan.sadhasivam@linaro.org -Tested-by: Andrew Halaney <ahalaney@redhat.com> # sa8775p-ride -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/ufs/host/ufs-qcom.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c -index c92cdca21fe1..0f4b3f16d3d7 100644 ---- a/drivers/ufs/host/ufs-qcom.c -+++ b/drivers/ufs/host/ufs-qcom.c -@@ -1787,7 +1787,7 @@ static int ufs_qcom_mcq_config_resource(struct ufs_hba *hba) - if (!res->resource) { - dev_info(hba->dev, "Resource %s not provided\n", res->name); - if (i == RES_UFS) -- return -ENOMEM; -+ return -ENODEV; - continue; - } else if (i == RES_UFS) { - res_mem = res->resource; --- -2.43.2 - -From a63e95450c75d3cced5fb2c8f536090cb7686444 Mon Sep 17 00:00:00 2001 -From: Yihang Li <liyihang9@huawei.com> -Date: Thu, 14 Dec 2023 11:45:13 +0800 -Subject: [PATCH 0206/1501] scsi: hisi_sas: Replace with standard error code - return value -Content-Length: 2054 -Lines: 55 - -[ Upstream commit d34ee535705eb43885bc0f561c63046f697355ad ] - -In function hisi_sas_controller_prereset(), -ENOSYS (Function not -implemented) should be returned if the driver does not support .soft_reset. -Returns -EPERM (Operation not permitted) if HISI_SAS_RESETTING_BIT is -already be set. - -In function _suspend_v3_hw(), returns -EPERM (Operation not permitted) if -HISI_SAS_RESETTING_BIT is already be set. - -Fixes: 4522204ab218 ("scsi: hisi_sas: tidy host controller reset function a bit") -Signed-off-by: Yihang Li <liyihang9@huawei.com> -Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com> -Link: https://lore.kernel.org/r/1702525516-51258-3-git-send-email-chenxiang66@hisilicon.com -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/scsi/hisi_sas/hisi_sas_main.c | 4 ++-- - drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- - 2 files changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c -index d50058b41409..16017064e96a 100644 ---- a/drivers/scsi/hisi_sas/hisi_sas_main.c -+++ b/drivers/scsi/hisi_sas/hisi_sas_main.c -@@ -1565,12 +1565,12 @@ EXPORT_SYMBOL_GPL(hisi_sas_controller_reset_done); - static int hisi_sas_controller_prereset(struct hisi_hba *hisi_hba) - { - if (!hisi_hba->hw->soft_reset) -- return -1; -+ return -ENOENT; - - down(&hisi_hba->sem); - if (test_and_set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) { - up(&hisi_hba->sem); -- return -1; -+ return -EPERM; - } - - if (hisi_sas_debugfs_enable && hisi_hba->debugfs_itct[0].itct) -diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -index d8437a98037b..b8ee374fe6ca 100644 ---- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -@@ -5018,7 +5018,7 @@ static int _suspend_v3_hw(struct device *device) - } - - if (test_and_set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) -- return -1; -+ return -EPERM; - - dev_warn(dev, "entering suspend state\n"); - --- -2.43.2 - -From 0cae77c61752c2ddb83f7baf4e0b886b71d50bec Mon Sep 17 00:00:00 2001 -From: Yihang Li <liyihang9@huawei.com> -Date: Thu, 14 Dec 2023 11:45:14 +0800 -Subject: [PATCH 0207/1501] scsi: hisi_sas: Check before using pointer - variables -Content-Length: 1717 -Lines: 43 - -[ Upstream commit 8dd10296be8562a45c6c6794dd492a2b7dccede8 ] - -In commit 4b329abc9180 ("scsi: hisi_sas: Move slot variable definition in -hisi_sas_abort_task()"), we move the variables slot to the function head. -However, the variable slot may be NULL, we should check it in each branch. - -Fixes: 4b329abc9180 ("scsi: hisi_sas: Move slot variable definition in hisi_sas_abort_task()") -Signed-off-by: Yihang Li <liyihang9@huawei.com> -Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com> -Link: https://lore.kernel.org/r/1702525516-51258-4-git-send-email-chenxiang66@hisilicon.com -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/scsi/hisi_sas/hisi_sas_main.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c -index 16017064e96a..bbb7b2d9ffcf 100644 ---- a/drivers/scsi/hisi_sas/hisi_sas_main.c -+++ b/drivers/scsi/hisi_sas/hisi_sas_main.c -@@ -1641,7 +1641,10 @@ static int hisi_sas_abort_task(struct sas_task *task) - task->task_state_flags |= SAS_TASK_STATE_ABORTED; - spin_unlock_irqrestore(&task->task_state_lock, flags); - -- if (slot && task->task_proto & SAS_PROTOCOL_SSP) { -+ if (!slot) -+ goto out; -+ -+ if (task->task_proto & SAS_PROTOCOL_SSP) { - u16 tag = slot->idx; - int rc2; - -@@ -1688,7 +1691,7 @@ static int hisi_sas_abort_task(struct sas_task *task) - rc = hisi_sas_softreset_ata_disk(device); - } - } -- } else if (slot && task->task_proto & SAS_PROTOCOL_SMP) { -+ } else if (task->task_proto & SAS_PROTOCOL_SMP) { - /* SMP */ - u32 tag = slot->idx; - struct hisi_sas_cq *cq = &hisi_hba->cq[slot->dlvry_queue]; --- -2.43.2 - -From d42f4ee56abf9075c2d4fcbf4a820362bffaddd3 Mon Sep 17 00:00:00 2001 -From: Yihang Li <liyihang9@huawei.com> -Date: Thu, 14 Dec 2023 11:45:15 +0800 -Subject: [PATCH 0208/1501] scsi: hisi_sas: Rollback some operations if FLR - failed -Content-Length: 1852 -Lines: 47 - -[ Upstream commit 7ea3e7763c50b20a8bd25cf524ea0c6463de69be ] - -We obtain the semaphore and set HISI_SAS_RESETTING_BIT in -hisi_sas_reset_prepare_v3_hw(), block the scsi host and set -HISI_SAS_REJECT_CMD_BIT in hisi_sas_controller_reset_prepare(), released -them in hisi_sas_controller_reset_done(). However, if the HW reset failure -in FLR results in early return, the semaphore and flag bits will not be -release. - -Rollback some operations including clearing flags / releasing semaphore -when FLR is failed. - -Fixes: e5ea48014adc ("scsi: hisi_sas: Implement handlers of PCIe FLR for v3 hw") -Signed-off-by: Yihang Li <liyihang9@huawei.com> -Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com> -Link: https://lore.kernel.org/r/1702525516-51258-5-git-send-email-chenxiang66@hisilicon.com -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -index b8ee374fe6ca..704bd65f373d 100644 ---- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -@@ -4968,6 +4968,7 @@ static void hisi_sas_reset_done_v3_hw(struct pci_dev *pdev) - { - struct sas_ha_struct *sha = pci_get_drvdata(pdev); - struct hisi_hba *hisi_hba = sha->lldd_ha; -+ struct Scsi_Host *shost = hisi_hba->shost; - struct device *dev = hisi_hba->dev; - int rc; - -@@ -4976,6 +4977,10 @@ static void hisi_sas_reset_done_v3_hw(struct pci_dev *pdev) - rc = hw_init_v3_hw(hisi_hba); - if (rc) { - dev_err(dev, "FLR: hw init failed rc=%d\n", rc); -+ clear_bit(HISI_SAS_REJECT_CMD_BIT, &hisi_hba->flags); -+ scsi_unblock_requests(shost); -+ clear_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags); -+ up(&hisi_hba->sem); - return; - } - --- -2.43.2 - -From 5b1fa17ee7b4c64aa27e3dc7b05289247857c859 Mon Sep 17 00:00:00 2001 -From: Yihang Li <liyihang9@huawei.com> -Date: Thu, 14 Dec 2023 11:45:16 +0800 -Subject: [PATCH 0209/1501] scsi: hisi_sas: Correct the number of global - debugfs registers -Content-Length: 1397 -Lines: 34 - -[ Upstream commit 73e33f969ef05328766b23a99b2c07bfff765009 ] - -In function debugfs_debugfs_snapshot_global_reg_v3_hw() it uses -debugfs_axi_reg.count (which is the number of axi debugfs registers) to -acquire the number of global debugfs registers. - -Use debugfs_global_reg.count to acquire the number of global debugfs -registers instead. - -Fixes: 623a4b6d5c2a ("scsi: hisi_sas: Move debugfs code to v3 hw driver") -Signed-off-by: Yihang Li <liyihang9@huawei.com> -Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com> -Link: https://lore.kernel.org/r/1702525516-51258-6-git-send-email-chenxiang66@hisilicon.com -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -index 704bd65f373d..6d8577423d32 100644 ---- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -@@ -3476,7 +3476,7 @@ static void debugfs_snapshot_global_reg_v3_hw(struct hisi_hba *hisi_hba) - u32 *databuf = hisi_hba->debugfs_regs[dump_index][DEBUGFS_GLOBAL].data; - int i; - -- for (i = 0; i < debugfs_axi_reg.count; i++, databuf++) -+ for (i = 0; i < debugfs_global_reg.count; i++, databuf++) - *databuf = hisi_sas_read32(hisi_hba, 4 * i); - } - --- -2.43.2 - -From f9ff6ef1c73cd9e1a6bb1ab3e57c5d141a536306 Mon Sep 17 00:00:00 2001 -From: Yonghong Song <yonghong.song@linux.dev> -Date: Thu, 14 Dec 2023 12:38:15 -0800 -Subject: [PATCH 0212/1501] bpf: Fix a race condition between btf_put() and - map_free() -Content-Length: 8776 -Lines: 203 - -[ Upstream commit 59e5791f59dd83e8aa72a4e74217eabb6e8cfd90 ] - -When running `./test_progs -j` in my local vm with latest kernel, -I once hit a kasan error like below: - - [ 1887.184724] BUG: KASAN: slab-use-after-free in bpf_rb_root_free+0x1f8/0x2b0 - [ 1887.185599] Read of size 4 at addr ffff888106806910 by task kworker/u12:2/2830 - [ 1887.186498] - [ 1887.186712] CPU: 3 PID: 2830 Comm: kworker/u12:2 Tainted: G OEL 6.7.0-rc3-00699-g90679706d486-dirty #494 - [ 1887.188034] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 - [ 1887.189618] Workqueue: events_unbound bpf_map_free_deferred - [ 1887.190341] Call Trace: - [ 1887.190666] <TASK> - [ 1887.190949] dump_stack_lvl+0xac/0xe0 - [ 1887.191423] ? nf_tcp_handle_invalid+0x1b0/0x1b0 - [ 1887.192019] ? panic+0x3c0/0x3c0 - [ 1887.192449] print_report+0x14f/0x720 - [ 1887.192930] ? preempt_count_sub+0x1c/0xd0 - [ 1887.193459] ? __virt_addr_valid+0xac/0x120 - [ 1887.194004] ? bpf_rb_root_free+0x1f8/0x2b0 - [ 1887.194572] kasan_report+0xc3/0x100 - [ 1887.195085] ? bpf_rb_root_free+0x1f8/0x2b0 - [ 1887.195668] bpf_rb_root_free+0x1f8/0x2b0 - [ 1887.196183] ? __bpf_obj_drop_impl+0xb0/0xb0 - [ 1887.196736] ? preempt_count_sub+0x1c/0xd0 - [ 1887.197270] ? preempt_count_sub+0x1c/0xd0 - [ 1887.197802] ? _raw_spin_unlock+0x1f/0x40 - [ 1887.198319] bpf_obj_free_fields+0x1d4/0x260 - [ 1887.198883] array_map_free+0x1a3/0x260 - [ 1887.199380] bpf_map_free_deferred+0x7b/0xe0 - [ 1887.199943] process_scheduled_works+0x3a2/0x6c0 - [ 1887.200549] worker_thread+0x633/0x890 - [ 1887.201047] ? __kthread_parkme+0xd7/0xf0 - [ 1887.201574] ? kthread+0x102/0x1d0 - [ 1887.202020] kthread+0x1ab/0x1d0 - [ 1887.202447] ? pr_cont_work+0x270/0x270 - [ 1887.202954] ? kthread_blkcg+0x50/0x50 - [ 1887.203444] ret_from_fork+0x34/0x50 - [ 1887.203914] ? kthread_blkcg+0x50/0x50 - [ 1887.204397] ret_from_fork_asm+0x11/0x20 - [ 1887.204913] </TASK> - [ 1887.204913] </TASK> - [ 1887.205209] - [ 1887.205416] Allocated by task 2197: - [ 1887.205881] kasan_set_track+0x3f/0x60 - [ 1887.206366] __kasan_kmalloc+0x6e/0x80 - [ 1887.206856] __kmalloc+0xac/0x1a0 - [ 1887.207293] btf_parse_fields+0xa15/0x1480 - [ 1887.207836] btf_parse_struct_metas+0x566/0x670 - [ 1887.208387] btf_new_fd+0x294/0x4d0 - [ 1887.208851] __sys_bpf+0x4ba/0x600 - [ 1887.209292] __x64_sys_bpf+0x41/0x50 - [ 1887.209762] do_syscall_64+0x4c/0xf0 - [ 1887.210222] entry_SYSCALL_64_after_hwframe+0x63/0x6b - [ 1887.210868] - [ 1887.211074] Freed by task 36: - [ 1887.211460] kasan_set_track+0x3f/0x60 - [ 1887.211951] kasan_save_free_info+0x28/0x40 - [ 1887.212485] ____kasan_slab_free+0x101/0x180 - [ 1887.213027] __kmem_cache_free+0xe4/0x210 - [ 1887.213514] btf_free+0x5b/0x130 - [ 1887.213918] rcu_core+0x638/0xcc0 - [ 1887.214347] __do_softirq+0x114/0x37e - -The error happens at bpf_rb_root_free+0x1f8/0x2b0: - - 00000000000034c0 <bpf_rb_root_free>: - ; { - 34c0: f3 0f 1e fa endbr64 - 34c4: e8 00 00 00 00 callq 0x34c9 <bpf_rb_root_free+0x9> - 34c9: 55 pushq %rbp - 34ca: 48 89 e5 movq %rsp, %rbp - ... - ; if (rec && rec->refcount_off >= 0 && - 36aa: 4d 85 ed testq %r13, %r13 - 36ad: 74 a9 je 0x3658 <bpf_rb_root_free+0x198> - 36af: 49 8d 7d 10 leaq 0x10(%r13), %rdi - 36b3: e8 00 00 00 00 callq 0x36b8 <bpf_rb_root_free+0x1f8> - <==== kasan function - 36b8: 45 8b 7d 10 movl 0x10(%r13), %r15d - <==== use-after-free load - 36bc: 45 85 ff testl %r15d, %r15d - 36bf: 78 8c js 0x364d <bpf_rb_root_free+0x18d> - -So the problem is at rec->refcount_off in the above. - -I did some source code analysis and find the reason. - CPU A CPU B - bpf_map_put: - ... - btf_put with rcu callback - ... - bpf_map_free_deferred - with system_unbound_wq - ... ... ... - ... btf_free_rcu: ... - ... ... bpf_map_free_deferred: - ... ... - ... ---------> btf_struct_metas_free() - ... | race condition ... - ... ---------> map->ops->map_free() - ... - ... btf->struct_meta_tab = NULL - -In the above, map_free() corresponds to array_map_free() and eventually -calling bpf_rb_root_free() which calls: - ... - __bpf_obj_drop_impl(obj, field->graph_root.value_rec, false); - ... - -Here, 'value_rec' is assigned in btf_check_and_fixup_fields() with following code: - - meta = btf_find_struct_meta(btf, btf_id); - if (!meta) - return -EFAULT; - rec->fields[i].graph_root.value_rec = meta->record; - -So basically, 'value_rec' is a pointer to the record in struct_metas_tab. -And it is possible that that particular record has been freed by -btf_struct_metas_free() and hence we have a kasan error here. - -Actually it is very hard to reproduce the failure with current bpf/bpf-next -code, I only got the above error once. To increase reproducibility, I added -a delay in bpf_map_free_deferred() to delay map->ops->map_free(), which -significantly increased reproducibility. - -# diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c -# index 5e43ddd1b83f..aae5b5213e93 100644 -# --- a/kernel/bpf/syscall.c -# +++ b/kernel/bpf/syscall.c -# @@ -695,6 +695,7 @@ static void bpf_map_free_deferred(struct work_struct *work) -# struct bpf_map *map = container_of(work, struct bpf_map, work); -# struct btf_record *rec = map->record; -# -# + mdelay(100); -# security_bpf_map_free(map); -# bpf_map_release_memcg(map); -# /* implementation dependent freeing */ - -Hao also provided test cases ([1]) for easily reproducing the above issue. - -There are two ways to fix the issue, the v1 of the patch ([2]) moving -btf_put() after map_free callback, and the v5 of the patch ([3]) using -a kptr style fix which tries to get a btf reference during -map_check_btf(). Each approach has its pro and cons. The first approach -delays freeing btf while the second approach needs to acquire reference -depending on context which makes logic not very elegant and may -complicate things with future new data structures. Alexei -suggested in [4] going back to v1 which is what this patch -tries to do. - -Rerun './test_progs -j' with the above mdelay() hack for a couple -of times and didn't observe the error for the above rb_root test cases. -Running Hou's test ([1]) is also successful. - - [1] https://lore.kernel.org/bpf/20231207141500.917136-1-houtao@huaweicloud.com/ - [2] v1: https://lore.kernel.org/bpf/20231204173946.3066377-1-yonghong.song@linux.dev/ - [3] v5: https://lore.kernel.org/bpf/20231208041621.2968241-1-yonghong.song@linux.dev/ - [4] v4: https://lore.kernel.org/bpf/CAADnVQJ3FiXUhZJwX_81sjZvSYYKCFB3BT6P8D59RS2Gu+0Z7g@mail.gmail.com/ - -Cc: Hou Tao <houtao@huaweicloud.com> -Fixes: 958cf2e273f0 ("bpf: Introduce bpf_obj_new") -Signed-off-by: Yonghong Song <yonghong.song@linux.dev> -Link: https://lore.kernel.org/r/20231214203815.1469107-1-yonghong.song@linux.dev -Signed-off-by: Alexei Starovoitov <ast@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - kernel/bpf/syscall.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c -index c6579067eeea..6e7e57360b81 100644 ---- a/kernel/bpf/syscall.c -+++ b/kernel/bpf/syscall.c -@@ -694,6 +694,7 @@ static void bpf_map_free_deferred(struct work_struct *work) - { - struct bpf_map *map = container_of(work, struct bpf_map, work); - struct btf_record *rec = map->record; -+ struct btf *btf = map->btf; - - security_bpf_map_free(map); - bpf_map_release_memcg(map); -@@ -709,6 +710,10 @@ static void bpf_map_free_deferred(struct work_struct *work) - * template bpf_map struct used during verification. - */ - btf_record_free(rec); -+ /* Delay freeing of btf for maps, as map_free callback may need -+ * struct_meta info which will be freed with btf_put(). -+ */ -+ btf_put(btf); - } - - static void bpf_map_put_uref(struct bpf_map *map) -@@ -749,7 +754,6 @@ void bpf_map_put(struct bpf_map *map) - if (atomic64_dec_and_test(&map->refcnt)) { - /* bpf_map_free_id() must be called first */ - bpf_map_free_id(map); -- btf_put(map->btf); - - if (READ_ONCE(map->free_after_mult_rcu_gp)) - call_rcu_tasks_trace(&map->rcu, bpf_map_free_mult_rcu_gp); --- -2.43.2 - -From 7d97858e21fbc472acda7d908357c5fe54a8e439 Mon Sep 17 00:00:00 2001 -From: Leone Fernando <leone4fernando@gmail.com> -Date: Wed, 13 Dec 2023 17:19:35 +0100 -Subject: [PATCH 0214/1501] ipmr: support IP_PKTINFO on cache report IGMP msg -Content-Length: 2108 -Lines: 64 - -[ Upstream commit bb7403655b3c3eb245d0ee330047cd3e20b3c4af ] - -In order to support IP_PKTINFO on those packets, we need to call -ipv4_pktinfo_prepare. - -When sending mrouted/pimd daemons a cache report IGMP msg, it is -unnecessary to set dst on the newly created skb. -It used to be necessary on older versions until -commit d826eb14ecef ("ipv4: PKTINFO doesnt need dst reference") which -changed the way IP_PKTINFO struct is been retrieved. - -Changes from v1: -1. Undo changes in ipv4_pktinfo_prepare function. use it directly - and copy the control block. - -Fixes: d826eb14ecef ("ipv4: PKTINFO doesnt need dst reference") -Signed-off-by: Leone Fernando <leone4fernando@gmail.com> -Reviewed-by: Eric Dumazet <edumazet@google.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/ipv4/ipmr.c | 13 ++++++------- - 1 file changed, 6 insertions(+), 7 deletions(-) - -diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c -index 9e222a57bc2b..0063a237253b 100644 ---- a/net/ipv4/ipmr.c -+++ b/net/ipv4/ipmr.c -@@ -1025,6 +1025,10 @@ static int ipmr_cache_report(const struct mr_table *mrt, - struct sk_buff *skb; - int ret; - -+ mroute_sk = rcu_dereference(mrt->mroute_sk); -+ if (!mroute_sk) -+ return -EINVAL; -+ - if (assert == IGMPMSG_WHOLEPKT || assert == IGMPMSG_WRVIFWHOLE) - skb = skb_realloc_headroom(pkt, sizeof(struct iphdr)); - else -@@ -1069,7 +1073,8 @@ static int ipmr_cache_report(const struct mr_table *mrt, - msg = (struct igmpmsg *)skb_network_header(skb); - msg->im_vif = vifi; - msg->im_vif_hi = vifi >> 8; -- skb_dst_set(skb, dst_clone(skb_dst(pkt))); -+ ipv4_pktinfo_prepare(mroute_sk, pkt); -+ memcpy(skb->cb, pkt->cb, sizeof(skb->cb)); - /* Add our header */ - igmp = skb_put(skb, sizeof(struct igmphdr)); - igmp->type = assert; -@@ -1079,12 +1084,6 @@ static int ipmr_cache_report(const struct mr_table *mrt, - skb->transport_header = skb->network_header; - } - -- mroute_sk = rcu_dereference(mrt->mroute_sk); -- if (!mroute_sk) { -- kfree_skb(skb); -- return -EINVAL; -- } -- - igmpmsg_netlink_event(mrt, skb); - - /* Deliver to mrouted */ --- -2.43.2 - -From 7907d6b1bc4cb2ec870deeb7cbf47882d47d447e Mon Sep 17 00:00:00 2001 -From: Arseniy Krasnov <avkrasnov@salutedevices.com> -Date: Thu, 14 Dec 2023 15:52:28 +0300 -Subject: [PATCH 0215/1501] virtio/vsock: fix logic which reduces credit update - messages -Content-Length: 2501 -Lines: 61 - -[ Upstream commit 93b80887668226180ea5f5349cc728ca6dc700ab ] - -Add one more condition for sending credit update during dequeue from -stream socket: when number of bytes in the rx queue is smaller than -SO_RCVLOWAT value of the socket. This is actual for non-default value -of SO_RCVLOWAT (e.g. not 1) - idea is to "kick" peer to continue data -transmission, because we need at least SO_RCVLOWAT bytes in our rx -queue to wake up user for reading data (in corner case it is also -possible to stuck both tx and rx sides, this is why 'Fixes' is used). - -Fixes: b89d882dc9fc ("vsock/virtio: reduce credit update messages") -Signed-off-by: Arseniy Krasnov <avkrasnov@salutedevices.com> -Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> -Acked-by: Michael S. Tsirkin <mst@redhat.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/vmw_vsock/virtio_transport_common.c | 13 ++++++++++--- - 1 file changed, 10 insertions(+), 3 deletions(-) - -diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c -index 6df246b53260..b35306dfcebe 100644 ---- a/net/vmw_vsock/virtio_transport_common.c -+++ b/net/vmw_vsock/virtio_transport_common.c -@@ -557,6 +557,8 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk, - struct virtio_vsock_sock *vvs = vsk->trans; - size_t bytes, total = 0; - struct sk_buff *skb; -+ u32 fwd_cnt_delta; -+ bool low_rx_bytes; - int err = -EFAULT; - u32 free_space; - -@@ -600,7 +602,10 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk, - } - } - -- free_space = vvs->buf_alloc - (vvs->fwd_cnt - vvs->last_fwd_cnt); -+ fwd_cnt_delta = vvs->fwd_cnt - vvs->last_fwd_cnt; -+ free_space = vvs->buf_alloc - fwd_cnt_delta; -+ low_rx_bytes = (vvs->rx_bytes < -+ sock_rcvlowat(sk_vsock(vsk), 0, INT_MAX)); - - spin_unlock_bh(&vvs->rx_lock); - -@@ -610,9 +615,11 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk, - * too high causes extra messages. Too low causes transmitter - * stalls. As stalls are in theory more expensive than extra - * messages, we set the limit to a high value. TODO: experiment -- * with different values. -+ * with different values. Also send credit update message when -+ * number of bytes in rx queue is not enough to wake up reader. - */ -- if (free_space < VIRTIO_VSOCK_MAX_PKT_BUF_SIZE) -+ if (fwd_cnt_delta && -+ (free_space < VIRTIO_VSOCK_MAX_PKT_BUF_SIZE || low_rx_bytes)) - virtio_transport_send_credit_update(vsk); - - return total; --- -2.43.2 - -From 85a9670fe182b49191b265153d2af5c81f43213a Mon Sep 17 00:00:00 2001 -From: Arseniy Krasnov <avkrasnov@salutedevices.com> -Date: Thu, 14 Dec 2023 15:52:29 +0300 -Subject: [PATCH 0216/1501] virtio/vsock: send credit update during setting - SO_RCVLOWAT -Content-Length: 7285 -Lines: 181 - -[ Upstream commit 0fe1798968115488c0c02f4633032a015b1faf97 ] - -Send credit update message when SO_RCVLOWAT is updated and it is bigger -than number of bytes in rx queue. It is needed, because 'poll()' will -wait until number of bytes in rx queue will be not smaller than -O_RCVLOWAT, so kick sender to send more data. Otherwise mutual hungup -for tx/rx is possible: sender waits for free space and receiver is -waiting data in 'poll()'. - -Rename 'set_rcvlowat' callback to 'notify_set_rcvlowat' and set -'sk->sk_rcvlowat' only in one place (i.e. 'vsock_set_rcvlowat'), so the -transport doesn't need to do it. - -Fixes: b89d882dc9fc ("vsock/virtio: reduce credit update messages") -Signed-off-by: Arseniy Krasnov <avkrasnov@salutedevices.com> -Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> -Acked-by: Michael S. Tsirkin <mst@redhat.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/vhost/vsock.c | 1 + - include/linux/virtio_vsock.h | 1 + - include/net/af_vsock.h | 2 +- - net/vmw_vsock/af_vsock.c | 9 ++++++-- - net/vmw_vsock/hyperv_transport.c | 4 ++-- - net/vmw_vsock/virtio_transport.c | 1 + - net/vmw_vsock/virtio_transport_common.c | 30 +++++++++++++++++++++++++ - net/vmw_vsock/vsock_loopback.c | 1 + - 8 files changed, 44 insertions(+), 5 deletions(-) - -diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c -index f75731396b7e..ec20ecff85c7 100644 ---- a/drivers/vhost/vsock.c -+++ b/drivers/vhost/vsock.c -@@ -449,6 +449,7 @@ static struct virtio_transport vhost_transport = { - .notify_send_pre_enqueue = virtio_transport_notify_send_pre_enqueue, - .notify_send_post_enqueue = virtio_transport_notify_send_post_enqueue, - .notify_buffer_size = virtio_transport_notify_buffer_size, -+ .notify_set_rcvlowat = virtio_transport_notify_set_rcvlowat, - - .read_skb = virtio_transport_read_skb, - }, -diff --git a/include/linux/virtio_vsock.h b/include/linux/virtio_vsock.h -index ebb3ce63d64d..c82089dee0c8 100644 ---- a/include/linux/virtio_vsock.h -+++ b/include/linux/virtio_vsock.h -@@ -256,4 +256,5 @@ void virtio_transport_put_credit(struct virtio_vsock_sock *vvs, u32 credit); - void virtio_transport_deliver_tap_pkt(struct sk_buff *skb); - int virtio_transport_purge_skbs(void *vsk, struct sk_buff_head *list); - int virtio_transport_read_skb(struct vsock_sock *vsk, skb_read_actor_t read_actor); -+int virtio_transport_notify_set_rcvlowat(struct vsock_sock *vsk, int val); - #endif /* _LINUX_VIRTIO_VSOCK_H */ -diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h -index e302c0e804d0..535701efc1e5 100644 ---- a/include/net/af_vsock.h -+++ b/include/net/af_vsock.h -@@ -137,7 +137,6 @@ struct vsock_transport { - u64 (*stream_rcvhiwat)(struct vsock_sock *); - bool (*stream_is_active)(struct vsock_sock *); - bool (*stream_allow)(u32 cid, u32 port); -- int (*set_rcvlowat)(struct vsock_sock *vsk, int val); - - /* SEQ_PACKET. */ - ssize_t (*seqpacket_dequeue)(struct vsock_sock *vsk, struct msghdr *msg, -@@ -168,6 +167,7 @@ struct vsock_transport { - struct vsock_transport_send_notify_data *); - /* sk_lock held by the caller */ - void (*notify_buffer_size)(struct vsock_sock *, u64 *); -+ int (*notify_set_rcvlowat)(struct vsock_sock *vsk, int val); - - /* Shutdown. */ - int (*shutdown)(struct vsock_sock *, int); -diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c -index 816725af281f..54ba7316f808 100644 ---- a/net/vmw_vsock/af_vsock.c -+++ b/net/vmw_vsock/af_vsock.c -@@ -2264,8 +2264,13 @@ static int vsock_set_rcvlowat(struct sock *sk, int val) - - transport = vsk->transport; - -- if (transport && transport->set_rcvlowat) -- return transport->set_rcvlowat(vsk, val); -+ if (transport && transport->notify_set_rcvlowat) { -+ int err; -+ -+ err = transport->notify_set_rcvlowat(vsk, val); -+ if (err) -+ return err; -+ } - - WRITE_ONCE(sk->sk_rcvlowat, val ? : 1); - return 0; -diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c -index 7cb1a9d2cdb4..e2157e387217 100644 ---- a/net/vmw_vsock/hyperv_transport.c -+++ b/net/vmw_vsock/hyperv_transport.c -@@ -816,7 +816,7 @@ int hvs_notify_send_post_enqueue(struct vsock_sock *vsk, ssize_t written, - } - - static --int hvs_set_rcvlowat(struct vsock_sock *vsk, int val) -+int hvs_notify_set_rcvlowat(struct vsock_sock *vsk, int val) - { - return -EOPNOTSUPP; - } -@@ -856,7 +856,7 @@ static struct vsock_transport hvs_transport = { - .notify_send_pre_enqueue = hvs_notify_send_pre_enqueue, - .notify_send_post_enqueue = hvs_notify_send_post_enqueue, - -- .set_rcvlowat = hvs_set_rcvlowat -+ .notify_set_rcvlowat = hvs_notify_set_rcvlowat - }; - - static bool hvs_check_transport(struct vsock_sock *vsk) -diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c -index af5bab1acee1..f495b9e5186b 100644 ---- a/net/vmw_vsock/virtio_transport.c -+++ b/net/vmw_vsock/virtio_transport.c -@@ -537,6 +537,7 @@ static struct virtio_transport virtio_transport = { - .notify_send_pre_enqueue = virtio_transport_notify_send_pre_enqueue, - .notify_send_post_enqueue = virtio_transport_notify_send_post_enqueue, - .notify_buffer_size = virtio_transport_notify_buffer_size, -+ .notify_set_rcvlowat = virtio_transport_notify_set_rcvlowat, - - .read_skb = virtio_transport_read_skb, - }, -diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c -index b35306dfcebe..16ff976a86e3 100644 ---- a/net/vmw_vsock/virtio_transport_common.c -+++ b/net/vmw_vsock/virtio_transport_common.c -@@ -1690,6 +1690,36 @@ int virtio_transport_read_skb(struct vsock_sock *vsk, skb_read_actor_t recv_acto - } - EXPORT_SYMBOL_GPL(virtio_transport_read_skb); - -+int virtio_transport_notify_set_rcvlowat(struct vsock_sock *vsk, int val) -+{ -+ struct virtio_vsock_sock *vvs = vsk->trans; -+ bool send_update; -+ -+ spin_lock_bh(&vvs->rx_lock); -+ -+ /* If number of available bytes is less than new SO_RCVLOWAT value, -+ * kick sender to send more data, because sender may sleep in its -+ * 'send()' syscall waiting for enough space at our side. Also -+ * don't send credit update when peer already knows actual value - -+ * such transmission will be useless. -+ */ -+ send_update = (vvs->rx_bytes < val) && -+ (vvs->fwd_cnt != vvs->last_fwd_cnt); -+ -+ spin_unlock_bh(&vvs->rx_lock); -+ -+ if (send_update) { -+ int err; -+ -+ err = virtio_transport_send_credit_update(vsk); -+ if (err < 0) -+ return err; -+ } -+ -+ return 0; -+} -+EXPORT_SYMBOL_GPL(virtio_transport_notify_set_rcvlowat); -+ - MODULE_LICENSE("GPL v2"); - MODULE_AUTHOR("Asias He"); - MODULE_DESCRIPTION("common code for virtio vsock"); -diff --git a/net/vmw_vsock/vsock_loopback.c b/net/vmw_vsock/vsock_loopback.c -index 048640167411..6dea6119f5b2 100644 ---- a/net/vmw_vsock/vsock_loopback.c -+++ b/net/vmw_vsock/vsock_loopback.c -@@ -96,6 +96,7 @@ static struct virtio_transport loopback_transport = { - .notify_send_pre_enqueue = virtio_transport_notify_send_pre_enqueue, - .notify_send_post_enqueue = virtio_transport_notify_send_post_enqueue, - .notify_buffer_size = virtio_transport_notify_buffer_size, -+ .notify_set_rcvlowat = virtio_transport_notify_set_rcvlowat, - - .read_skb = virtio_transport_read_skb, - }, --- -2.43.2 - -From 2fd1335445f94e74af5b487a29c609392ffffc4b Mon Sep 17 00:00:00 2001 -From: Joakim Zhang <joakim.zhang@cixtech.com> -Date: Thu, 14 Dec 2023 16:25:26 +0800 -Subject: [PATCH 0217/1501] dma-mapping: clear dev->dma_mem to NULL after - freeing it -Content-Length: 1184 -Lines: 36 - -[ Upstream commit b07bc2347672cc8c7293c64499f1488278c5ca3d ] - -Reproduced with below sequence: -dma_declare_coherent_memory()->dma_release_coherent_memory() -->dma_declare_coherent_memory()->"return -EBUSY" error - -It will return -EBUSY from the dma_assign_coherent_memory() -in dma_declare_coherent_memory(), the reason is that dev->dma_mem -pointer has not been set to NULL after it's freed. - -Fixes: cf65a0f6f6ff ("dma-mapping: move all DMA mapping code to kernel/dma") -Signed-off-by: Joakim Zhang <joakim.zhang@cixtech.com> -Signed-off-by: Christoph Hellwig <hch@lst.de> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - kernel/dma/coherent.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/kernel/dma/coherent.c b/kernel/dma/coherent.c -index c21abc77c53e..ff5683a57f77 100644 ---- a/kernel/dma/coherent.c -+++ b/kernel/dma/coherent.c -@@ -132,8 +132,10 @@ int dma_declare_coherent_memory(struct device *dev, phys_addr_t phys_addr, - - void dma_release_coherent_memory(struct device *dev) - { -- if (dev) -+ if (dev) { - _dma_release_coherent_memory(dev->dma_mem); -+ dev->dma_mem = NULL; -+ } - } - - static void *__dma_alloc_from_coherent(struct device *dev, --- -2.43.2 - -From b58c6d0d1874dcae1e73e37f69c6836ab42d3b19 Mon Sep 17 00:00:00 2001 -From: Hou Tao <houtao1@huawei.com> -Date: Fri, 15 Dec 2023 18:07:04 +0800 -Subject: [PATCH 0218/1501] bpf: Limit the number of uprobes when attaching - program to multiple uprobes -Content-Length: 1862 -Lines: 51 - -[ Upstream commit 8b2efe51ba85ca83460941672afac6fca4199df6 ] - -An abnormally big cnt may be passed to link_create.uprobe_multi.cnt, -and it will trigger the following warning in kvmalloc_node(): - - if (unlikely(size > INT_MAX)) { - WARN_ON_ONCE(!(flags & __GFP_NOWARN)); - return NULL; - } - -Fix the warning by limiting the maximal number of uprobes in -bpf_uprobe_multi_link_attach(). If the number of uprobes is greater than -MAX_UPROBE_MULTI_CNT, the attachment will return -E2BIG. - -Fixes: 89ae89f53d20 ("bpf: Add multi uprobe link") -Reported-by: Xingwei Lee <xrivendell7@gmail.com> -Signed-off-by: Hou Tao <houtao1@huawei.com> -Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> -Acked-by: Jiri Olsa <jolsa@kernel.org> -Acked-by: Andrii Nakryiko <andrii@kernel.org> -Closes: https://lore.kernel.org/bpf/CABOYnLwwJY=yFAGie59LFsUsBAgHfroVqbzZ5edAXbFE3YiNVA@mail.gmail.com -Link: https://lore.kernel.org/bpf/20231215100708.2265609-2-houtao@huaweicloud.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - kernel/trace/bpf_trace.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c -index 84e8a0f6e4e0..640b08818afa 100644 ---- a/kernel/trace/bpf_trace.c -+++ b/kernel/trace/bpf_trace.c -@@ -41,6 +41,8 @@ - #define bpf_event_rcu_dereference(p) \ - rcu_dereference_protected(p, lockdep_is_held(&bpf_event_mutex)) - -+#define MAX_UPROBE_MULTI_CNT (1U << 20) -+ - #ifdef CONFIG_MODULES - struct bpf_trace_module { - struct module *module; -@@ -3202,6 +3204,8 @@ int bpf_uprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr - - if (!upath || !uoffsets || !cnt) - return -EINVAL; -+ if (cnt > MAX_UPROBE_MULTI_CNT) -+ return -E2BIG; - - uref_ctr_offsets = u64_to_user_ptr(attr->link_create.uprobe_multi.ref_ctr_offsets); - ucookies = u64_to_user_ptr(attr->link_create.uprobe_multi.cookies); --- -2.43.2 - -From 3818a1e3b2032c6d8e723cc9c6a639e0c00d7e73 Mon Sep 17 00:00:00 2001 -From: Hou Tao <houtao1@huawei.com> -Date: Fri, 15 Dec 2023 18:07:05 +0800 -Subject: [PATCH 0219/1501] bpf: Limit the number of kprobes when attaching - program to multiple kprobes -Content-Length: 1672 -Lines: 49 - -[ Upstream commit d6d1e6c17cab2dcb7b8530c599f00e7de906d380 ] - -An abnormally big cnt may also be assigned to kprobe_multi.cnt when -attaching multiple kprobes. It will trigger the following warning in -kvmalloc_node(): - - if (unlikely(size > INT_MAX)) { - WARN_ON_ONCE(!(flags & __GFP_NOWARN)); - return NULL; - } - -Fix the warning by limiting the maximal number of kprobes in -bpf_kprobe_multi_link_attach(). If the number of kprobes is greater than -MAX_KPROBE_MULTI_CNT, the attachment will fail and return -E2BIG. - -Fixes: 0dcac2725406 ("bpf: Add multi kprobe link") -Signed-off-by: Hou Tao <houtao1@huawei.com> -Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> -Acked-by: Jiri Olsa <jolsa@kernel.org> -Acked-by: Andrii Nakryiko <andrii@kernel.org> -Link: https://lore.kernel.org/bpf/20231215100708.2265609-3-houtao@huaweicloud.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - kernel/trace/bpf_trace.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c -index 640b08818afa..652c40a14d0d 100644 ---- a/kernel/trace/bpf_trace.c -+++ b/kernel/trace/bpf_trace.c -@@ -42,6 +42,7 @@ - rcu_dereference_protected(p, lockdep_is_held(&bpf_event_mutex)) - - #define MAX_UPROBE_MULTI_CNT (1U << 20) -+#define MAX_KPROBE_MULTI_CNT (1U << 20) - - #ifdef CONFIG_MODULES - struct bpf_trace_module { -@@ -2901,6 +2902,8 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr - cnt = attr->link_create.kprobe_multi.cnt; - if (!cnt) - return -EINVAL; -+ if (cnt > MAX_KPROBE_MULTI_CNT) -+ return -E2BIG; - - size = cnt * sizeof(*addrs); - addrs = kvmalloc_array(cnt, sizeof(*addrs), GFP_KERNEL); --- -2.43.2 - -From df0c69122affa3c166ef795d6a1d80471d4f936f Mon Sep 17 00:00:00 2001 -From: Atul Dhudase <quic_adhudase@quicinc.com> -Date: Wed, 6 Dec 2023 21:02:51 +0530 -Subject: [PATCH 0221/1501] soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc - configuration -Content-Length: 2810 -Lines: 62 - -[ Upstream commit eed6e57e9f3e2beac37563eb6a0129549daa330e ] - -Commit c14e64b46944 ("soc: qcom: llcc: Support chipsets that can - write to llcc") add the support for chipset where capacity based -allocation and retention through power collapse can be programmed -based on content of SCT table mentioned in the llcc driver where -the target like sdm845 where the entire programming related to it -is controlled in firmware. However, the commit introduces a bug -where capacity/retention register get overwritten each time it -gets programmed for each slice and that results in misconfiguration -of the register based on SCT table and that is not expected -behaviour instead it should be read modify write to retain the -configuration of other slices. - -This issue is totally caught from code review and programming test -and not through any power/perf numbers so, it is not known what -impact this could make if we don't have this change however, -this feature are for these targets and they should have been -programmed accordingly as per their configuration mentioned in -SCT table like others bits information. - -This change brings one difference where it keeps capacity/retention -bits of the slices that are not mentioned in SCT table in unknown -state where as earlier it was initialized to zero. - -Fixes: c14e64b46944 ("soc: qcom: llcc: Support chipsets that can write to llcc") -Signed-off-by: Atul Dhudase <quic_adhudase@quicinc.com> -Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com> -Reviewed-by: Douglas Anderson <dianders@chromium.org> -Link: https://lore.kernel.org/r/1701876771-10695-1-git-send-email-quic_mojha@quicinc.com -Signed-off-by: Bjorn Andersson <andersson@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/soc/qcom/llcc-qcom.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/drivers/soc/qcom/llcc-qcom.c b/drivers/soc/qcom/llcc-qcom.c -index 674abd0d6700..2e32a0e521d5 100644 ---- a/drivers/soc/qcom/llcc-qcom.c -+++ b/drivers/soc/qcom/llcc-qcom.c -@@ -941,15 +941,15 @@ static int _qcom_llcc_cfg_program(const struct llcc_slice_config *config, - u32 disable_cap_alloc, retain_pc; - - disable_cap_alloc = config->dis_cap_alloc << config->slice_id; -- ret = regmap_write(drv_data->bcast_regmap, -- LLCC_TRP_SCID_DIS_CAP_ALLOC, disable_cap_alloc); -+ ret = regmap_update_bits(drv_data->bcast_regmap, LLCC_TRP_SCID_DIS_CAP_ALLOC, -+ BIT(config->slice_id), disable_cap_alloc); - if (ret) - return ret; - - if (drv_data->version < LLCC_VERSION_4_1_0_0) { - retain_pc = config->retain_on_pc << config->slice_id; -- ret = regmap_write(drv_data->bcast_regmap, -- LLCC_TRP_PCB_ACT, retain_pc); -+ ret = regmap_update_bits(drv_data->bcast_regmap, LLCC_TRP_PCB_ACT, -+ BIT(config->slice_id), retain_pc); - if (ret) - return ret; - } --- -2.43.2 - -From 85fdbf6840455be64eac16bdfe0df3368ee3d0f0 Mon Sep 17 00:00:00 2001 -From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> -Date: Mon, 27 Nov 2023 15:15:48 +0100 -Subject: [PATCH 0226/1501] firmware: qcom: qseecom: fix memory leaks in error - paths -Content-Length: 2912 -Lines: 74 - -[ Upstream commit 6c57d7b593c4a4e60db65d5ce0fe1d9f79ccbe9b ] - -Fix instances of returning error codes directly instead of jumping to -the relevant labels where memory allocated for the SCM calls would be -freed. - -Fixes: 759e7a2b62eb ("firmware: Add support for Qualcomm UEFI Secure Application") -Reported-by: kernel test robot <lkp@intel.com> -Reported-by: Dan Carpenter <error27@gmail.com> -Closes: https://lore.kernel.org/r/202311270828.k4HGcjiL-lkp@intel.com/ -Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> -Reviewed-by: Maximilian Luz <luzmaximilian@gmail.com> -Tested-by: Deepti Jaggi <quic_djaggi@quicinc.com> #sa8775p-ride -Link: https://lore.kernel.org/r/20231127141600.20929-2-brgl@bgdev.pl -Signed-off-by: Bjorn Andersson <andersson@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../firmware/qcom/qcom_qseecom_uefisecapp.c | 20 ++++++++++++------- - 1 file changed, 13 insertions(+), 7 deletions(-) - -diff --git a/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c b/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c -index a33acdaf7b78..32188f098ef3 100644 ---- a/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c -+++ b/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c -@@ -325,8 +325,10 @@ static efi_status_t qsee_uefi_get_variable(struct qcuefi_client *qcuefi, const e - req_data->length = req_size; - - status = ucs2_strscpy(((void *)req_data) + req_data->name_offset, name, name_length); -- if (status < 0) -- return EFI_INVALID_PARAMETER; -+ if (status < 0) { -+ efi_status = EFI_INVALID_PARAMETER; -+ goto out_free; -+ } - - memcpy(((void *)req_data) + req_data->guid_offset, guid, req_data->guid_size); - -@@ -471,8 +473,10 @@ static efi_status_t qsee_uefi_set_variable(struct qcuefi_client *qcuefi, const e - req_data->length = req_size; - - status = ucs2_strscpy(((void *)req_data) + req_data->name_offset, name, name_length); -- if (status < 0) -- return EFI_INVALID_PARAMETER; -+ if (status < 0) { -+ efi_status = EFI_INVALID_PARAMETER; -+ goto out_free; -+ } - - memcpy(((void *)req_data) + req_data->guid_offset, guid, req_data->guid_size); - -@@ -563,8 +567,10 @@ static efi_status_t qsee_uefi_get_next_variable(struct qcuefi_client *qcuefi, - memcpy(((void *)req_data) + req_data->guid_offset, guid, req_data->guid_size); - status = ucs2_strscpy(((void *)req_data) + req_data->name_offset, name, - *name_size / sizeof(*name)); -- if (status < 0) -- return EFI_INVALID_PARAMETER; -+ if (status < 0) { -+ efi_status = EFI_INVALID_PARAMETER; -+ goto out_free; -+ } - - status = qcom_qseecom_app_send(qcuefi->client, req_data, req_size, rsp_data, rsp_size); - if (status) { -@@ -635,7 +641,7 @@ static efi_status_t qsee_uefi_get_next_variable(struct qcuefi_client *qcuefi, - * have already been validated above, causing this function to - * bail with EFI_BUFFER_TOO_SMALL. - */ -- return EFI_DEVICE_ERROR; -+ efi_status = EFI_DEVICE_ERROR; - } - - out_free: --- -2.43.2 - -From 62d546526c4a07aff8bcc27157f5e84a33a60ab1 Mon Sep 17 00:00:00 2001 -From: Abel Vesa <abel.vesa@linaro.org> -Date: Thu, 12 Oct 2023 19:05:09 +0300 -Subject: [PATCH 0227/1501] soc: qcom: llcc: Fix LLCC_TRP_ATTR2_CFGn offset -Content-Length: 1296 -Lines: 31 - -[ Upstream commit 110cb8d861cc1a040cdab495b22ac436c49d1454 ] - -According to documentation, it has increments of 4, not 8. - -Fixes: c72ca343f911 ("soc: qcom: llcc: Add v4.1 HW version support") -Reported-by: Unnathi Chalicheemala <quic_uchalich@quicinc.com> -Reviewed-by: Satya Durga Srinivasu Prabhala <quic_satyap@quicinc.com> -Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org> -Signed-off-by: Abel Vesa <abel.vesa@linaro.org> -Link: https://lore.kernel.org/r/20231012160509.184891-1-abel.vesa@linaro.org -Signed-off-by: Bjorn Andersson <andersson@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/soc/qcom/llcc-qcom.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/soc/qcom/llcc-qcom.c b/drivers/soc/qcom/llcc-qcom.c -index 2e32a0e521d5..57d47dcf11b9 100644 ---- a/drivers/soc/qcom/llcc-qcom.c -+++ b/drivers/soc/qcom/llcc-qcom.c -@@ -47,7 +47,7 @@ - #define LLCC_TRP_STATUSn(n) (4 + n * SZ_4K) - #define LLCC_TRP_ATTR0_CFGn(n) (0x21000 + SZ_8 * n) - #define LLCC_TRP_ATTR1_CFGn(n) (0x21004 + SZ_8 * n) --#define LLCC_TRP_ATTR2_CFGn(n) (0x21100 + SZ_8 * n) -+#define LLCC_TRP_ATTR2_CFGn(n) (0x21100 + SZ_4 * n) - - #define LLCC_TRP_SCID_DIS_CAP_ALLOC 0x21f00 - #define LLCC_TRP_PCB_ACT 0x21f04 --- -2.43.2 - -From 822f3d3b18249628658b56573dbad85bb1923cda Mon Sep 17 00:00:00 2001 -From: Li Nan <linan122@huawei.com> -Date: Tue, 19 Dec 2023 15:59:42 +0800 -Subject: [PATCH 0228/1501] block: add check of 'minors' and 'first_minor' in - device_add_disk() -Content-Length: 1422 -Lines: 37 - -[ Upstream commit 4c434392c4777881d01beada6701eff8c76b43fe ] - -'first_minor' represents the starting minor number of disks, and -'minors' represents the number of partitions in the device. Neither -of them can be greater than MINORMASK + 1. - -Commit e338924bd05d ("block: check minor range in device_add_disk()") -only added the check of 'first_minor + minors'. However, their sum might -be less than MINORMASK but their values are wrong. Complete the checks now. - -Fixes: e338924bd05d ("block: check minor range in device_add_disk()") -Signed-off-by: Li Nan <linan122@huawei.com> -Reviewed-by: Christoph Hellwig <hch@lst.de> -Link: https://lore.kernel.org/r/20231219075942.840255-1-linan666@huaweicloud.com -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - block/genhd.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/block/genhd.c b/block/genhd.c -index 13db3a7943d8..d74fb5b4ae68 100644 ---- a/block/genhd.c -+++ b/block/genhd.c -@@ -432,7 +432,9 @@ int __must_check device_add_disk(struct device *parent, struct gendisk *disk, - DISK_MAX_PARTS); - disk->minors = DISK_MAX_PARTS; - } -- if (disk->first_minor + disk->minors > MINORMASK + 1) -+ if (disk->first_minor > MINORMASK || -+ disk->minors > MINORMASK + 1 || -+ disk->first_minor + disk->minors > MINORMASK + 1) - goto out_exit_elevator; - } else { - if (WARN_ON(disk->minors)) --- -2.43.2 - -From 1c842bfde74cbff32df76e3059699fe2ac970bf0 Mon Sep 17 00:00:00 2001 -From: Hou Tao <houtao1@huawei.com> -Date: Sat, 16 Dec 2023 21:10:51 +0800 -Subject: [PATCH 0235/1501] bpf: Use c->unit_size to select target cache during - free -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 9434 -Lines: 260 - -[ Upstream commit 7ac5c53e00735d183a0f5e2cfce5eeb6c16319f2 ] - -At present, bpf memory allocator uses check_obj_size() to ensure that -ksize() of allocated pointer is equal with the unit_size of used -bpf_mem_cache. Its purpose is to prevent bpf_mem_free() from selecting -a bpf_mem_cache which has different unit_size compared with the -bpf_mem_cache used for allocation. But as reported by lkp, the return -value of ksize() or kmalloc_size_roundup() may change due to slab merge -and it will lead to the warning report in check_obj_size(). - -The reported warning happened as follows: -(1) in bpf_mem_cache_adjust_size(), kmalloc_size_roundup(96) returns the -object_size of kmalloc-96 instead of kmalloc-cg-96. The object_size of -kmalloc-96 is 96, so size_index for 96 is not adjusted accordingly. -(2) the object_size of kmalloc-cg-96 is adjust from 96 to 128 due to -slab merge in __kmem_cache_alias(). For SLAB, SLAB_HWCACHE_ALIGN is -enabled by default for kmalloc slab, so align is 64 and size is 128 for -kmalloc-cg-96. SLUB has a similar merge logic, but its object_size will -not be changed, because its align is 8 under x86-64. -(3) when unit_alloc() does kmalloc_node(96, __GFP_ACCOUNT, node), -ksize() returns 128 instead of 96 for the returned pointer. -(4) the warning in check_obj_size() is triggered. - -Considering the slab merge can happen in anytime (e.g, a slab created in -a new module), the following case is also possible: during the -initialization of bpf_global_ma, there is no slab merge and ksize() for -a 96-bytes object returns 96. But after that a new slab created by a -kernel module is merged to kmalloc-cg-96 and the object_size of -kmalloc-cg-96 is adjust from 96 to 128 (which is possible for x86-64 + -CONFIG_SLAB, because its alignment requirement is 64 for 96-bytes slab). -So soon or later, when bpf_global_ma frees a 96-byte-sized pointer -which is allocated from bpf_mem_cache with unit_size=96, bpf_mem_free() -will free the pointer through a bpf_mem_cache in which unit_size is 128, -because the return value of ksize() changes. The warning for the -mismatch will be triggered again. - -A feasible fix is introducing similar APIs compared with ksize() and -kmalloc_size_roundup() to return the actually-allocated size instead of -size which may change due to slab merge, but it will introduce -unnecessary dependency on the implementation details of mm subsystem. - -As for now the pointer of bpf_mem_cache is saved in the 8-bytes area -(or 4-bytes under 32-bit host) above the returned pointer, using -unit_size in the saved bpf_mem_cache to select the target cache instead -of inferring the size from the pointer itself. Beside no extra -dependency on mm subsystem, the performance for bpf_mem_free_rcu() is -also improved as shown below. - -Before applying the patch, the performances of bpf_mem_alloc() and -bpf_mem_free_rcu() on 8-CPUs VM with one producer are as follows: - -kmalloc : alloc 11.69 ± 0.28M/s free 29.58 ± 0.93M/s -percpu : alloc 14.11 ± 0.52M/s free 14.29 ± 0.99M/s - -After apply the patch, the performance for bpf_mem_free_rcu() increases -9% and 146% for kmalloc memory and per-cpu memory respectively: - -kmalloc: alloc 11.01 ± 0.03M/s free 32.42 ± 0.48M/s -percpu: alloc 12.84 ± 0.12M/s free 35.24 ± 0.23M/s - -After the fixes, there is no need to adjust size_index to fix the -mismatch between allocation and free, so remove it as well. Also return -NULL instead of ZERO_SIZE_PTR for zero-sized alloc in bpf_mem_alloc(), -because there is no bpf_mem_cache pointer saved above ZERO_SIZE_PTR. - -Fixes: 9077fc228f09 ("bpf: Use kmalloc_size_roundup() to adjust size_index") -Reported-by: kernel test robot <oliver.sang@intel.com> -Closes: https://lore.kernel.org/bpf/202310302113.9f8fe705-oliver.sang@intel.com -Signed-off-by: Hou Tao <houtao1@huawei.com> -Link: https://lore.kernel.org/r/20231216131052.27621-2-houtao@huaweicloud.com -Signed-off-by: Alexei Starovoitov <ast@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - kernel/bpf/memalloc.c | 105 +++++------------------------------------- - 1 file changed, 11 insertions(+), 94 deletions(-) - -diff --git a/kernel/bpf/memalloc.c b/kernel/bpf/memalloc.c -index 6a51cfe4c2d6..aa0fbf000a12 100644 ---- a/kernel/bpf/memalloc.c -+++ b/kernel/bpf/memalloc.c -@@ -490,27 +490,6 @@ static void prefill_mem_cache(struct bpf_mem_cache *c, int cpu) - alloc_bulk(c, c->unit_size <= 256 ? 4 : 1, cpu_to_node(cpu), false); - } - --static int check_obj_size(struct bpf_mem_cache *c, unsigned int idx) --{ -- struct llist_node *first; -- unsigned int obj_size; -- -- first = c->free_llist.first; -- if (!first) -- return 0; -- -- if (c->percpu_size) -- obj_size = pcpu_alloc_size(((void **)first)[1]); -- else -- obj_size = ksize(first); -- if (obj_size != c->unit_size) { -- WARN_ONCE(1, "bpf_mem_cache[%u]: percpu %d, unexpected object size %u, expect %u\n", -- idx, c->percpu_size, obj_size, c->unit_size); -- return -EINVAL; -- } -- return 0; --} -- - /* When size != 0 bpf_mem_cache for each cpu. - * This is typical bpf hash map use case when all elements have equal size. - * -@@ -521,10 +500,10 @@ static int check_obj_size(struct bpf_mem_cache *c, unsigned int idx) - int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu) - { - static u16 sizes[NUM_CACHES] = {96, 192, 16, 32, 64, 128, 256, 512, 1024, 2048, 4096}; -- int cpu, i, err, unit_size, percpu_size = 0; - struct bpf_mem_caches *cc, __percpu *pcc; - struct bpf_mem_cache *c, __percpu *pc; - struct obj_cgroup *objcg = NULL; -+ int cpu, i, unit_size, percpu_size = 0; - - /* room for llist_node and per-cpu pointer */ - if (percpu) -@@ -560,7 +539,6 @@ int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu) - pcc = __alloc_percpu_gfp(sizeof(*cc), 8, GFP_KERNEL); - if (!pcc) - return -ENOMEM; -- err = 0; - #ifdef CONFIG_MEMCG_KMEM - objcg = get_obj_cgroup_from_current(); - #endif -@@ -574,28 +552,12 @@ int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu) - c->tgt = c; - - init_refill_work(c); -- /* Another bpf_mem_cache will be used when allocating -- * c->unit_size in bpf_mem_alloc(), so doesn't prefill -- * for the bpf_mem_cache because these free objects will -- * never be used. -- */ -- if (i != bpf_mem_cache_idx(c->unit_size)) -- continue; - prefill_mem_cache(c, cpu); -- err = check_obj_size(c, i); -- if (err) -- goto out; - } - } - --out: - ma->caches = pcc; -- /* refill_work is either zeroed or initialized, so it is safe to -- * call irq_work_sync(). -- */ -- if (err) -- bpf_mem_alloc_destroy(ma); -- return err; -+ return 0; - } - - static void drain_mem_cache(struct bpf_mem_cache *c) -@@ -869,7 +831,7 @@ void notrace *bpf_mem_alloc(struct bpf_mem_alloc *ma, size_t size) - void *ret; - - if (!size) -- return ZERO_SIZE_PTR; -+ return NULL; - - idx = bpf_mem_cache_idx(size + LLIST_NODE_SZ); - if (idx < 0) -@@ -879,26 +841,17 @@ void notrace *bpf_mem_alloc(struct bpf_mem_alloc *ma, size_t size) - return !ret ? NULL : ret + LLIST_NODE_SZ; - } - --static notrace int bpf_mem_free_idx(void *ptr, bool percpu) --{ -- size_t size; -- -- if (percpu) -- size = pcpu_alloc_size(*((void **)ptr)); -- else -- size = ksize(ptr - LLIST_NODE_SZ); -- return bpf_mem_cache_idx(size); --} -- - void notrace bpf_mem_free(struct bpf_mem_alloc *ma, void *ptr) - { -+ struct bpf_mem_cache *c; - int idx; - - if (!ptr) - return; - -- idx = bpf_mem_free_idx(ptr, ma->percpu); -- if (idx < 0) -+ c = *(void **)(ptr - LLIST_NODE_SZ); -+ idx = bpf_mem_cache_idx(c->unit_size); -+ if (WARN_ON_ONCE(idx < 0)) - return; - - unit_free(this_cpu_ptr(ma->caches)->cache + idx, ptr); -@@ -906,13 +859,15 @@ void notrace bpf_mem_free(struct bpf_mem_alloc *ma, void *ptr) - - void notrace bpf_mem_free_rcu(struct bpf_mem_alloc *ma, void *ptr) - { -+ struct bpf_mem_cache *c; - int idx; - - if (!ptr) - return; - -- idx = bpf_mem_free_idx(ptr, ma->percpu); -- if (idx < 0) -+ c = *(void **)(ptr - LLIST_NODE_SZ); -+ idx = bpf_mem_cache_idx(c->unit_size); -+ if (WARN_ON_ONCE(idx < 0)) - return; - - unit_free_rcu(this_cpu_ptr(ma->caches)->cache + idx, ptr); -@@ -986,41 +941,3 @@ void notrace *bpf_mem_cache_alloc_flags(struct bpf_mem_alloc *ma, gfp_t flags) - - return !ret ? NULL : ret + LLIST_NODE_SZ; - } -- --/* The alignment of dynamic per-cpu area is 8, so c->unit_size and the -- * actual size of dynamic per-cpu area will always be matched and there is -- * no need to adjust size_index for per-cpu allocation. However for the -- * simplicity of the implementation, use an unified size_index for both -- * kmalloc and per-cpu allocation. -- */ --static __init int bpf_mem_cache_adjust_size(void) --{ -- unsigned int size; -- -- /* Adjusting the indexes in size_index() according to the object_size -- * of underlying slab cache, so bpf_mem_alloc() will select a -- * bpf_mem_cache with unit_size equal to the object_size of -- * the underlying slab cache. -- * -- * The maximal value of KMALLOC_MIN_SIZE and __kmalloc_minalign() is -- * 256-bytes, so only do adjustment for [8-bytes, 192-bytes]. -- */ -- for (size = 192; size >= 8; size -= 8) { -- unsigned int kmalloc_size, index; -- -- kmalloc_size = kmalloc_size_roundup(size); -- if (kmalloc_size == size) -- continue; -- -- if (kmalloc_size <= 192) -- index = size_index[(kmalloc_size - 1) / 8]; -- else -- index = fls(kmalloc_size - 1) - 1; -- /* Only overwrite if necessary */ -- if (size_index[(size - 1) / 8] != index) -- size_index[(size - 1) / 8] = index; -- } -- -- return 0; --} --subsys_initcall(bpf_mem_cache_adjust_size); --- -2.43.2 - -From 8a8226bc19dd046c45326e783ec48147b35df9a0 Mon Sep 17 00:00:00 2001 -From: Su Hui <suhui@nfschina.com> -Date: Tue, 19 Dec 2023 14:57:29 +0800 -Subject: [PATCH 0236/1501] wifi: rtlwifi: add calculate_bit_shift() -Content-Length: 1309 -Lines: 35 - -[ Upstream commit 52221dfddbbfb5b4e029bb2efe9bb7da33ec1e46 ] - -There are many same functions like _rtl88e_phy_calculate_bit_shift(), -_rtl92c_phy_calculate_bit_shift() and so on. And these functions can -cause undefined bitwise shift behavior. Add calculate_bit_shift() to -replace them and fix undefined behavior in subsequent patches. - -Signed-off-by: Su Hui <suhui@nfschina.com> -Acked-by: Ping-Ke Shih <pkshih@realtek.com> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://msgid.link/20231219065739.1895666-2-suhui@nfschina.com -Stable-dep-of: 969bc926f04b ("wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/realtek/rtlwifi/wifi.h | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h -index 31a481f43a07..5d842cc394aa 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/wifi.h -+++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h -@@ -3069,4 +3069,11 @@ static inline struct ieee80211_sta *rtl_find_sta(struct ieee80211_hw *hw, - return ieee80211_find_sta(mac->vif, mac_addr); - } - -+static inline u32 calculate_bit_shift(u32 bitmask) -+{ -+ if (WARN_ON_ONCE(!bitmask)) -+ return 0; -+ -+ return __ffs(bitmask); -+} - #endif --- -2.43.2 - -From 62067608da2dedab6cfd124805d526c718207fce Mon Sep 17 00:00:00 2001 -From: Su Hui <suhui@nfschina.com> -Date: Tue, 19 Dec 2023 14:57:31 +0800 -Subject: [PATCH 0237/1501] wifi: rtlwifi: rtl8188ee: phy: using - calculate_bit_shift() -Content-Length: 2867 -Lines: 69 - -[ Upstream commit 969bc926f04b438676768aeffffffb050e480b62 ] - -Using calculate_bit_shift() to replace _rtl88e_phy_calculate_bit_shift(). -And fix the undefined bitwise shift behavior problem. - -Fixes: f0eb856e0b6c ("rtlwifi: rtl8188ee: Add new driver") -Signed-off-by: Su Hui <suhui@nfschina.com> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://msgid.link/20231219065739.1895666-4-suhui@nfschina.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../net/wireless/realtek/rtlwifi/rtl8188ee/phy.c | 14 ++++---------- - 1 file changed, 4 insertions(+), 10 deletions(-) - -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c -index 12d0b3a87af7..0fab3a0c7d49 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c -@@ -16,12 +16,6 @@ static u32 _rtl88e_phy_rf_serial_read(struct ieee80211_hw *hw, - static void _rtl88e_phy_rf_serial_write(struct ieee80211_hw *hw, - enum radio_path rfpath, u32 offset, - u32 data); --static u32 _rtl88e_phy_calculate_bit_shift(u32 bitmask) --{ -- u32 i = ffs(bitmask); -- -- return i ? i - 1 : 32; --} - static bool _rtl88e_phy_bb8188e_config_parafile(struct ieee80211_hw *hw); - static bool _rtl88e_phy_config_mac_with_headerfile(struct ieee80211_hw *hw); - static bool phy_config_bb_with_headerfile(struct ieee80211_hw *hw, -@@ -51,7 +45,7 @@ u32 rtl88e_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) - rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, - "regaddr(%#x), bitmask(%#x)\n", regaddr, bitmask); - originalvalue = rtl_read_dword(rtlpriv, regaddr); -- bitshift = _rtl88e_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - returnvalue = (originalvalue & bitmask) >> bitshift; - - rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, -@@ -74,7 +68,7 @@ void rtl88e_phy_set_bb_reg(struct ieee80211_hw *hw, - - if (bitmask != MASKDWORD) { - originalvalue = rtl_read_dword(rtlpriv, regaddr); -- bitshift = _rtl88e_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = ((originalvalue & (~bitmask)) | (data << bitshift)); - } - -@@ -99,7 +93,7 @@ u32 rtl88e_phy_query_rf_reg(struct ieee80211_hw *hw, - - - original_value = _rtl88e_phy_rf_serial_read(hw, rfpath, regaddr); -- bitshift = _rtl88e_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - readback_value = (original_value & bitmask) >> bitshift; - - spin_unlock(&rtlpriv->locks.rf_lock); -@@ -127,7 +121,7 @@ void rtl88e_phy_set_rf_reg(struct ieee80211_hw *hw, - original_value = _rtl88e_phy_rf_serial_read(hw, - rfpath, - regaddr); -- bitshift = _rtl88e_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = - ((original_value & (~bitmask)) | - (data << bitshift)); --- -2.43.2 - -From af618f0fd9479cdd95806bfce533cd01e4e68dec Mon Sep 17 00:00:00 2001 -From: Su Hui <suhui@nfschina.com> -Date: Tue, 19 Dec 2023 14:57:32 +0800 -Subject: [PATCH 0238/1501] wifi: rtlwifi: rtl8192c: using - calculate_bit_shift() -Content-Length: 2837 -Lines: 66 - -[ Upstream commit 1dedc3a6699d827d345019e921b8d8f37f694333 ] - -Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift(). -And fix the undefined bitwise shift behavior problem. - -Fixes: 4295cd254af3 ("rtlwifi: Move common parts of rtl8192ce/phy.c") -Signed-off-by: Su Hui <suhui@nfschina.com> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://msgid.link/20231219065739.1895666-5-suhui@nfschina.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../wireless/realtek/rtlwifi/rtl8192c/phy_common.c | 12 ++---------- - .../wireless/realtek/rtlwifi/rtl8192c/phy_common.h | 1 - - 2 files changed, 2 insertions(+), 11 deletions(-) - -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c -index 3d29c8dbb255..144ee780e1b6 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c -@@ -17,7 +17,7 @@ u32 rtl92c_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) - rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "regaddr(%#x), bitmask(%#x)\n", - regaddr, bitmask); - originalvalue = rtl_read_dword(rtlpriv, regaddr); -- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - returnvalue = (originalvalue & bitmask) >> bitshift; - - rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, -@@ -40,7 +40,7 @@ void rtl92c_phy_set_bb_reg(struct ieee80211_hw *hw, - - if (bitmask != MASKDWORD) { - originalvalue = rtl_read_dword(rtlpriv, regaddr); -- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = ((originalvalue & (~bitmask)) | (data << bitshift)); - } - -@@ -143,14 +143,6 @@ void _rtl92c_phy_rf_serial_write(struct ieee80211_hw *hw, - } - EXPORT_SYMBOL(_rtl92c_phy_rf_serial_write); - --u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask) --{ -- u32 i = ffs(bitmask); -- -- return i ? i - 1 : 32; --} --EXPORT_SYMBOL(_rtl92c_phy_calculate_bit_shift); -- - static void _rtl92c_phy_bb_config_1t(struct ieee80211_hw *hw) - { - rtl_set_bbreg(hw, RFPGA0_TXINFO, 0x3, 0x2); -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h -index 75afa6253ad0..e64d377dfe9e 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h -@@ -196,7 +196,6 @@ bool rtl92c_phy_set_rf_power_state(struct ieee80211_hw *hw, - void rtl92ce_phy_set_rf_on(struct ieee80211_hw *hw); - void rtl92c_phy_set_io(struct ieee80211_hw *hw); - void rtl92c_bb_block_on(struct ieee80211_hw *hw); --u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask); - long _rtl92c_phy_txpwr_idx_to_dbm(struct ieee80211_hw *hw, - enum wireless_mode wirelessmode, - u8 txpwridx); --- -2.43.2 - -From eb9d1534fd9c4f572c5f958c3d38c59ede9938b4 Mon Sep 17 00:00:00 2001 -From: Su Hui <suhui@nfschina.com> -Date: Tue, 19 Dec 2023 14:57:33 +0800 -Subject: [PATCH 0239/1501] wifi: rtlwifi: rtl8192cu: using - calculate_bit_shift() -Content-Length: 2002 -Lines: 47 - -[ Upstream commit f4088c8fcbabadad9dd17d17ae9ba24e9e3221ec ] - -Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift(). -And fix an undefined bitwise shift behavior problem. - -Fixes: f0a39ae738d6 ("rtlwifi: rtl8192cu: Add routine phy") -Signed-off-by: Su Hui <suhui@nfschina.com> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://msgid.link/20231219065739.1895666-6-suhui@nfschina.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c -index a8d9fe269f31..0b8cb7e61fd8 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c -@@ -32,7 +32,7 @@ u32 rtl92cu_phy_query_rf_reg(struct ieee80211_hw *hw, - original_value = _rtl92c_phy_fw_rf_serial_read(hw, - rfpath, regaddr); - } -- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - readback_value = (original_value & bitmask) >> bitshift; - rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, - "regaddr(%#x), rfpath(%#x), bitmask(%#x), original_value(%#x)\n", -@@ -56,7 +56,7 @@ void rtl92cu_phy_set_rf_reg(struct ieee80211_hw *hw, - original_value = _rtl92c_phy_rf_serial_read(hw, - rfpath, - regaddr); -- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = - ((original_value & (~bitmask)) | - (data << bitshift)); -@@ -67,7 +67,7 @@ void rtl92cu_phy_set_rf_reg(struct ieee80211_hw *hw, - original_value = _rtl92c_phy_fw_rf_serial_read(hw, - rfpath, - regaddr); -- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = - ((original_value & (~bitmask)) | - (data << bitshift)); --- -2.43.2 - -From 5656d496889748cbd3a02f608be97453304755d9 Mon Sep 17 00:00:00 2001 -From: Su Hui <suhui@nfschina.com> -Date: Tue, 19 Dec 2023 14:57:34 +0800 -Subject: [PATCH 0240/1501] wifi: rtlwifi: rtl8192ce: using - calculate_bit_shift() -Content-Length: 2669 -Lines: 60 - -[ Upstream commit 3d03e8231031bcc65a48cd88ef9c71b6524ce70b ] - -Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift(). -And fix the undefined bitwise shift behavior problem. - -Fixes: 0c8173385e54 ("rtl8192ce: Add new driver") -Signed-off-by: Su Hui <suhui@nfschina.com> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://msgid.link/20231219065739.1895666-7-suhui@nfschina.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c | 6 +++--- - drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h | 1 - - 2 files changed, 3 insertions(+), 4 deletions(-) - -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c -index da54e51badd3..fa70a7d5539f 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c -@@ -39,7 +39,7 @@ u32 rtl92c_phy_query_rf_reg(struct ieee80211_hw *hw, - rfpath, regaddr); - } - -- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - readback_value = (original_value & bitmask) >> bitshift; - - spin_unlock(&rtlpriv->locks.rf_lock); -@@ -110,7 +110,7 @@ void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw, - original_value = _rtl92c_phy_rf_serial_read(hw, - rfpath, - regaddr); -- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = - ((original_value & (~bitmask)) | - (data << bitshift)); -@@ -122,7 +122,7 @@ void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw, - original_value = _rtl92c_phy_fw_rf_serial_read(hw, - rfpath, - regaddr); -- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = - ((original_value & (~bitmask)) | - (data << bitshift)); -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h -index 7582a162bd11..c7a0d4c776f0 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h -@@ -94,7 +94,6 @@ u32 _rtl92c_phy_rf_serial_read(struct ieee80211_hw *hw, enum radio_path rfpath, - u32 offset); - u32 _rtl92c_phy_fw_rf_serial_read(struct ieee80211_hw *hw, - enum radio_path rfpath, u32 offset); --u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask); - void _rtl92c_phy_rf_serial_write(struct ieee80211_hw *hw, - enum radio_path rfpath, u32 offset, u32 data); - void _rtl92c_phy_fw_rf_serial_write(struct ieee80211_hw *hw, --- -2.43.2 - -From 13d813fb79a5bee898c4df1cf61f11c625ac253e Mon Sep 17 00:00:00 2001 -From: Su Hui <suhui@nfschina.com> -Date: Tue, 19 Dec 2023 14:57:35 +0800 -Subject: [PATCH 0241/1501] wifi: rtlwifi: rtl8192de: using - calculate_bit_shift() -Content-Length: 2827 -Lines: 70 - -[ Upstream commit b8b2baad2e652042cf8b6339939ac2f4e6f53de4 ] - -Using calculate_bit_shift() to replace _rtl92d_phy_calculate_bit_shift(). -And fix the undefined bitwise shift behavior problem. - -Fixes: 7274a8c22980 ("rtlwifi: rtl8192de: Merge phy routines") -Signed-off-by: Su Hui <suhui@nfschina.com> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://msgid.link/20231219065739.1895666-8-suhui@nfschina.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../net/wireless/realtek/rtlwifi/rtl8192de/phy.c | 15 ++++----------- - 1 file changed, 4 insertions(+), 11 deletions(-) - -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c -index d18c092b6142..d835a27429f0 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c -@@ -169,13 +169,6 @@ static const u8 channel_all[59] = { - 157, 159, 161, 163, 165 - }; - --static u32 _rtl92d_phy_calculate_bit_shift(u32 bitmask) --{ -- u32 i = ffs(bitmask); -- -- return i ? i - 1 : 32; --} -- - u32 rtl92d_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) - { - struct rtl_priv *rtlpriv = rtl_priv(hw); -@@ -198,7 +191,7 @@ u32 rtl92d_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) - } else { - originalvalue = rtl_read_dword(rtlpriv, regaddr); - } -- bitshift = _rtl92d_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - returnvalue = (originalvalue & bitmask) >> bitshift; - rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, - "BBR MASK=0x%x Addr[0x%x]=0x%x\n", -@@ -230,7 +223,7 @@ void rtl92d_phy_set_bb_reg(struct ieee80211_hw *hw, - dbi_direct); - else - originalvalue = rtl_read_dword(rtlpriv, regaddr); -- bitshift = _rtl92d_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = ((originalvalue & (~bitmask)) | (data << bitshift)); - } - if (rtlhal->during_mac1init_radioa || rtlhal->during_mac0init_radiob) -@@ -317,7 +310,7 @@ u32 rtl92d_phy_query_rf_reg(struct ieee80211_hw *hw, - regaddr, rfpath, bitmask); - spin_lock(&rtlpriv->locks.rf_lock); - original_value = _rtl92d_phy_rf_serial_read(hw, rfpath, regaddr); -- bitshift = _rtl92d_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - readback_value = (original_value & bitmask) >> bitshift; - spin_unlock(&rtlpriv->locks.rf_lock); - rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, -@@ -343,7 +336,7 @@ void rtl92d_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath, - if (bitmask != RFREG_OFFSET_MASK) { - original_value = _rtl92d_phy_rf_serial_read(hw, - rfpath, regaddr); -- bitshift = _rtl92d_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = ((original_value & (~bitmask)) | - (data << bitshift)); - } --- -2.43.2 - -From 335fd6ea8bce0e888536b4c4fce26a6ed5d77d32 Mon Sep 17 00:00:00 2001 -From: Su Hui <suhui@nfschina.com> -Date: Tue, 19 Dec 2023 14:57:36 +0800 -Subject: [PATCH 0242/1501] wifi: rtlwifi: rtl8192ee: using - calculate_bit_shift() -Content-Length: 3265 -Lines: 78 - -[ Upstream commit 63526897fc0d086069bcab67c3a112caaec751cb ] - -Using calculate_bit_shift() to replace _rtl92ee_phy_calculate_bit_shift(). -And fix the undefined bitwise shift behavior problem. - -Fixes: b1a3bfc97cd9 ("rtlwifi: rtl8192ee: Move driver from staging to the regular tree") -Signed-off-by: Su Hui <suhui@nfschina.com> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://msgid.link/20231219065739.1895666-9-suhui@nfschina.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../net/wireless/realtek/rtlwifi/rtl8192ee/phy.c | 16 ++++------------ - 1 file changed, 4 insertions(+), 12 deletions(-) - -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c -index cc0bcaf13e96..73ef602bfb01 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c -@@ -16,7 +16,6 @@ static u32 _rtl92ee_phy_rf_serial_read(struct ieee80211_hw *hw, - static void _rtl92ee_phy_rf_serial_write(struct ieee80211_hw *hw, - enum radio_path rfpath, u32 offset, - u32 data); --static u32 _rtl92ee_phy_calculate_bit_shift(u32 bitmask); - static bool _rtl92ee_phy_bb8192ee_config_parafile(struct ieee80211_hw *hw); - static bool _rtl92ee_phy_config_mac_with_headerfile(struct ieee80211_hw *hw); - static bool phy_config_bb_with_hdr_file(struct ieee80211_hw *hw, -@@ -46,7 +45,7 @@ u32 rtl92ee_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) - rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, - "regaddr(%#x), bitmask(%#x)\n", regaddr, bitmask); - originalvalue = rtl_read_dword(rtlpriv, regaddr); -- bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - returnvalue = (originalvalue & bitmask) >> bitshift; - - rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, -@@ -68,7 +67,7 @@ void rtl92ee_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr, - - if (bitmask != MASKDWORD) { - originalvalue = rtl_read_dword(rtlpriv, regaddr); -- bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = ((originalvalue & (~bitmask)) | (data << bitshift)); - } - -@@ -92,7 +91,7 @@ u32 rtl92ee_phy_query_rf_reg(struct ieee80211_hw *hw, - spin_lock(&rtlpriv->locks.rf_lock); - - original_value = _rtl92ee_phy_rf_serial_read(hw , rfpath, regaddr); -- bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - readback_value = (original_value & bitmask) >> bitshift; - - spin_unlock(&rtlpriv->locks.rf_lock); -@@ -119,7 +118,7 @@ void rtl92ee_phy_set_rf_reg(struct ieee80211_hw *hw, - - if (bitmask != RFREG_OFFSET_MASK) { - original_value = _rtl92ee_phy_rf_serial_read(hw, rfpath, addr); -- bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = (original_value & (~bitmask)) | (data << bitshift); - } - -@@ -201,13 +200,6 @@ static void _rtl92ee_phy_rf_serial_write(struct ieee80211_hw *hw, - pphyreg->rf3wire_offset, data_and_addr); - } - --static u32 _rtl92ee_phy_calculate_bit_shift(u32 bitmask) --{ -- u32 i = ffs(bitmask); -- -- return i ? i - 1 : 32; --} -- - bool rtl92ee_phy_mac_config(struct ieee80211_hw *hw) - { - return _rtl92ee_phy_config_mac_with_headerfile(hw); --- -2.43.2 - -From 7dd199aa70ec2b4ce665a524f9ee1e33e3b9bfa5 Mon Sep 17 00:00:00 2001 -From: Su Hui <suhui@nfschina.com> -Date: Tue, 19 Dec 2023 14:57:37 +0800 -Subject: [PATCH 0243/1501] wifi: rtlwifi: rtl8192se: using - calculate_bit_shift() -Content-Length: 2681 -Lines: 70 - -[ Upstream commit ac32b9317063b101a8ff3d3e885f76f87a280419 ] - -Using calculate_bit_shift() to replace _rtl92s_phy_calculate_bit_shift(). -And fix the undefined bitwise shift behavior problem. - -Fixes: d15853163bea ("rtlwifi: rtl8192se: Merge phy routines") -Signed-off-by: Su Hui <suhui@nfschina.com> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://msgid.link/20231219065739.1895666-10-suhui@nfschina.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../net/wireless/realtek/rtlwifi/rtl8192se/phy.c | 15 ++++----------- - 1 file changed, 4 insertions(+), 11 deletions(-) - -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c -index 09591a0b5a81..d9ef7e1da1db 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c -@@ -14,13 +14,6 @@ - #include "hw.h" - #include "table.h" - --static u32 _rtl92s_phy_calculate_bit_shift(u32 bitmask) --{ -- u32 i = ffs(bitmask); -- -- return i ? i - 1 : 32; --} -- - u32 rtl92s_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) - { - struct rtl_priv *rtlpriv = rtl_priv(hw); -@@ -30,7 +23,7 @@ u32 rtl92s_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) - regaddr, bitmask); - - originalvalue = rtl_read_dword(rtlpriv, regaddr); -- bitshift = _rtl92s_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - returnvalue = (originalvalue & bitmask) >> bitshift; - - rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "BBR MASK=0x%x Addr[0x%x]=0x%x\n", -@@ -52,7 +45,7 @@ void rtl92s_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask, - - if (bitmask != MASKDWORD) { - originalvalue = rtl_read_dword(rtlpriv, regaddr); -- bitshift = _rtl92s_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = ((originalvalue & (~bitmask)) | (data << bitshift)); - } - -@@ -157,7 +150,7 @@ u32 rtl92s_phy_query_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath, - - original_value = _rtl92s_phy_rf_serial_read(hw, rfpath, regaddr); - -- bitshift = _rtl92s_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - readback_value = (original_value & bitmask) >> bitshift; - - spin_unlock(&rtlpriv->locks.rf_lock); -@@ -188,7 +181,7 @@ void rtl92s_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath, - if (bitmask != RFREG_OFFSET_MASK) { - original_value = _rtl92s_phy_rf_serial_read(hw, rfpath, - regaddr); -- bitshift = _rtl92s_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = ((original_value & (~bitmask)) | (data << bitshift)); - } - --- -2.43.2 - -From 00bde87cfccdfbc1a596b95d24bcf629b567a2f9 Mon Sep 17 00:00:00 2001 -From: Ayala Beker <ayala.beker@intel.com> -Date: Wed, 20 Dec 2023 13:41:44 +0200 -Subject: [PATCH 0244/1501] wifi: mac80211: fix advertised TTLM scheduling -Content-Length: 3485 -Lines: 104 - -[ Upstream commit b1a23f8ae0d76ad32fe36682730c050251275b0b ] - -Handle a case of time overflow, where the switch time might -be smaller than the partial TSF in the beacon. -Additionally, apply advertised TTLM earlier in order to be -ready on time on the newly activated links. - -Fixes: 702e80470a33 ("wifi: mac80211: support handling of advertised TID-to-link mapping") -Signed-off-by: Ayala Beker <ayala.beker@intel.com> -Reviewed-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> -Link: https://msgid.link/20231220133549.15079c34e5c8.I0dd50bcceff5953080cdd7aee5118b72c78c6507@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/mac80211/mlme.c | 49 ++++++++++++++++++++++++++++++++++++--------- - 1 file changed, 40 insertions(+), 9 deletions(-) - -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index c8998cf01b7a..dcdaab19efbd 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -43,6 +43,9 @@ - #define IEEE80211_ASSOC_TIMEOUT_SHORT (HZ / 10) - #define IEEE80211_ASSOC_MAX_TRIES 3 - -+#define IEEE80211_ADV_TTLM_SAFETY_BUFFER_MS msecs_to_jiffies(100) -+#define IEEE80211_ADV_TTLM_ST_UNDERFLOW 0xff00 -+ - static int max_nullfunc_tries = 2; - module_param(max_nullfunc_tries, int, 0644); - MODULE_PARM_DESC(max_nullfunc_tries, -@@ -5946,6 +5949,13 @@ ieee80211_parse_adv_t2l(struct ieee80211_sub_if_data *sdata, - pos++; - - ttlm_info->switch_time = get_unaligned_le16(pos); -+ -+ /* Since ttlm_info->switch_time == 0 means no switch time, bump it -+ * by 1. -+ */ -+ if (!ttlm_info->switch_time) -+ ttlm_info->switch_time = 1; -+ - pos += 2; - - if (control & IEEE80211_TTLM_CONTROL_EXPECTED_DUR_PRESENT) { -@@ -6040,25 +6050,46 @@ static void ieee80211_process_adv_ttlm(struct ieee80211_sub_if_data *sdata, - } - - if (ttlm_info.switch_time) { -- u32 st_us, delay = 0; -- u32 ts_l26 = beacon_ts & GENMASK(25, 0); -+ u16 beacon_ts_tu, st_tu, delay; -+ u32 delay_jiffies; -+ u64 mask; - - /* The t2l map switch time is indicated with a partial -- * TSF value, convert it to TSF and calc the delay -- * to the start time. -+ * TSF value (bits 10 to 25), get the partial beacon TS -+ * as well, and calc the delay to the start time. - */ -- st_us = ieee80211_tu_to_usec(ttlm_info.switch_time); -- if (st_us > ts_l26) -- delay = st_us - ts_l26; -+ mask = GENMASK_ULL(25, 10); -+ beacon_ts_tu = (beacon_ts & mask) >> 10; -+ st_tu = ttlm_info.switch_time; -+ delay = st_tu - beacon_ts_tu; -+ -+ /* -+ * If the switch time is far in the future, then it -+ * could also be the previous switch still being -+ * announced. -+ * We can simply ignore it for now, if it is a future -+ * switch the AP will continue to announce it anyway. -+ */ -+ if (delay > IEEE80211_ADV_TTLM_ST_UNDERFLOW) -+ return; -+ -+ delay_jiffies = TU_TO_JIFFIES(delay); -+ -+ /* Link switching can take time, so schedule it -+ * 100ms before to be ready on time -+ */ -+ if (delay_jiffies > IEEE80211_ADV_TTLM_SAFETY_BUFFER_MS) -+ delay_jiffies -= -+ IEEE80211_ADV_TTLM_SAFETY_BUFFER_MS; - else -- continue; -+ delay_jiffies = 0; - - sdata->u.mgd.ttlm_info = ttlm_info; - wiphy_delayed_work_cancel(sdata->local->hw.wiphy, - &sdata->u.mgd.ttlm_work); - wiphy_delayed_work_queue(sdata->local->hw.wiphy, - &sdata->u.mgd.ttlm_work, -- usecs_to_jiffies(delay)); -+ delay_jiffies); - return; - } - } --- -2.43.2 - -From d620def81acf2c0dcc0ed88df8fa67139df14984 Mon Sep 17 00:00:00 2001 -From: Johannes Berg <johannes.berg@intel.com> -Date: Tue, 19 Dec 2023 21:58:49 +0200 -Subject: [PATCH 0245/1501] wifi: iwlwifi: mvm: set siso/mimo chains to 1 in FW - SMPS request -Content-Length: 1666 -Lines: 41 - -[ Upstream commit b1a2e5c310e063560760806d2cc5d2233c596067 ] - -The firmware changed their mind, don't set the chains to zero, -instead set them to 1 as we normally would for connections to -APs that don't use MIMO. - -Fixes: 2a7ce54ccc23 ("iwlwifi: mvm: honour firmware SMPS requests") -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Reviewed-by: Luciano Coelho <luciano.coelho@intel.com> -Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> -Link: https://msgid.link/20231219215605.7f031f1a127f.Idc816e0f604b07d22a9d5352bc23c445512fad14@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c | 11 ----------- - 1 file changed, 11 deletions(-) - -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c -index 4e1fccff3987..334d1f59f6e4 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c -@@ -99,17 +99,6 @@ static void iwl_mvm_phy_ctxt_set_rxchain(struct iwl_mvm *mvm, - active_cnt = 2; - } - -- /* -- * If the firmware requested it, then we know that it supports -- * getting zero for the values to indicate "use one, but pick -- * which one yourself", which means it can dynamically pick one -- * that e.g. has better RSSI. -- */ -- if (mvm->fw_static_smps_request && active_cnt == 1 && idle_cnt == 1) { -- idle_cnt = 0; -- active_cnt = 0; -- } -- - *rxchain_info = cpu_to_le32(iwl_mvm_get_valid_rx_ant(mvm) << - PHY_RX_CHAIN_VALID_POS); - *rxchain_info |= cpu_to_le32(idle_cnt << PHY_RX_CHAIN_CNT_POS); --- -2.43.2 - -From 03dfa2a47dc854924cfe197c626f34fa77b0c498 Mon Sep 17 00:00:00 2001 -From: Johannes Berg <johannes.berg@intel.com> -Date: Tue, 19 Dec 2023 21:58:52 +0200 -Subject: [PATCH 0246/1501] wifi: iwlwifi: mvm: send TX path flush in rfkill -Content-Length: 1559 -Lines: 34 - -[ Upstream commit 2afc3dad39ea84a072d04ff40a417234326adc47 ] - -If we want to drop packets, that's surely a good thing to -do when we want to enter rfkill. Send this command despite -rfkill so we can successfully clean up everything, we need -to handle it separately since it has CMD_WANT_SKB, so it's -not going to automatically return success when in rfkill. - -Fixes: d4e3a341b87b ("iwlwifi: mvm: add support for new flush queue response") -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Reviewed-by: Gregory Greenman <gregory.greenman@intel.com> -Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> -Link: https://msgid.link/20231219215605.c528a6fa6cec.Ibe5e9560359ccc0fba60c35e01de285c376748a2@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c -index ae5cd13cd6dd..db986bfc4dc3 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c -@@ -2256,7 +2256,7 @@ int iwl_mvm_flush_sta_tids(struct iwl_mvm *mvm, u32 sta_id, u16 tids) - WARN_ON(!iwl_mvm_has_new_tx_api(mvm)); - - if (iwl_fw_lookup_notif_ver(mvm->fw, LONG_GROUP, TXPATH_FLUSH, 0) > 0) -- cmd.flags |= CMD_WANT_SKB; -+ cmd.flags |= CMD_WANT_SKB | CMD_SEND_IN_RFKILL; - - IWL_DEBUG_TX_QUEUES(mvm, "flush for sta id %d tid mask 0x%x\n", - sta_id, tids); --- -2.43.2 - -From 3ec42e03b9146a29d084e0964ba28f5336e04f0b Mon Sep 17 00:00:00 2001 -From: Ilan Peer <ilan.peer@intel.com> -Date: Tue, 19 Dec 2023 21:58:54 +0200 -Subject: [PATCH 0247/1501] wifi: iwlwifi: mvm: Do not warn if valid link pair - was not found -Content-Length: 1363 -Lines: 32 - -[ Upstream commit c5bfdb46636a2ea7f0678243c6d3e9f8d26b027a ] - -It is possible that though multiple links are enabled we cannot enabled -EMLSR enable more than a single link, e.g., all valid links are on the -same band etc. Thus, do not warn in case no valid link pair is found. - -Fixes: b9be67fb4207 ("wifi: iwlwifi: mvm: Add basic link selection logic") -Signed-off-by: Ilan Peer <ilan.peer@intel.com> -Reviewed-by: Gregory Greenman <gregory.greenman@intel.com> -Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> -Link: https://msgid.link/20231219215605.142e57a05230.I7cfe78c94c3d15c4c744bccadd8f187e43594932@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c -index ff6cb064051b..8e263acbc763 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c -@@ -716,7 +716,7 @@ void iwl_mvm_mld_select_links(struct iwl_mvm *mvm, struct ieee80211_vif *vif, - } - } - -- if (WARN_ON(!new_active_links)) -+ if (!new_active_links) - return; - - if (vif->active_links != new_active_links) --- -2.43.2 - -From 8e4bb647d7f72a6e505bfa4664bd9ffd946edadc Mon Sep 17 00:00:00 2001 -From: Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com> -Date: Tue, 19 Dec 2023 21:58:55 +0200 -Subject: [PATCH 0248/1501] wifi: iwlwifi: fix out of bound copy_from_user -Content-Length: 1631 -Lines: 36 - -[ Upstream commit cb2dfacb197bed0241fbb4f84bd0995a47f4465e ] - -The driver copies the userspace buffer into an internal NUL -byte terminated buffer. While doing so, it was reading beyond -the end of the userspace buffer, overwriting its own NUL -termination in the process. - -Fix this by only copying the correct number of bytes. - -Fixes: 3f244876ef73 ("wifi: iwlwifi: make debugfs entries link specific") -Signed-off-by: Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com> -Reviewed-by: Gregory Greenman <gregory.greenman@intel.com> -Reviewed-by: Benjamin Berg <benjamin.berg@intel.com> -Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> -Link: https://msgid.link/20231219215605.e4913deb2ad4.Idcf6a7e909ff4b7801cd49c2f691f84a2f68eff9@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c -index 329c545f65fd..7737650e56cb 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c -@@ -1815,7 +1815,7 @@ static ssize_t _iwl_dbgfs_link_sta_##name##_write(struct file *file, \ - char buf[buflen] = {}; \ - size_t buf_size = min(count, sizeof(buf) - 1); \ - \ -- if (copy_from_user(buf, user_buf, sizeof(buf))) \ -+ if (copy_from_user(buf, user_buf, buf_size)) \ - return -EFAULT; \ - \ - return _iwl_dbgfs_link_sta_wrap_write(iwl_dbgfs_##name##_write, \ --- -2.43.2 - -From c337cbcf381959d34379d529a689ae7e42bccadb Mon Sep 17 00:00:00 2001 -From: Miri Korenblit <miriam.rachel.korenblit@intel.com> -Date: Tue, 19 Dec 2023 21:58:56 +0200 -Subject: [PATCH 0249/1501] wifi: iwlwifi: assign phy_ctxt before eSR - activation -Content-Length: 1883 -Lines: 47 - -[ Upstream commit 9b6614e5ead5d19a71893bcca3f1a6569ca0c456 ] - -eSR is activated when a chanctx is assigned to more than one link. -During eSR activation we should disable RLC for both phys, and configure -the FW with a special phy command for both phys. -Currently we assign the phy_ctxt to the link only after eSR activation, -so RLC is not disabled for the new phy_ctxt, and a cmd is not sent to FW. -Fix this by first assigning the new phy_ctxt to the link and then -doing the eSR activation. - -Fixes: 12bacfc2c065 ("wifi: iwlwifi: handle eSR transitions") -Reviewed-by: Gregory Greenman <gregory.greenman@intel.com> -Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> -Link: https://msgid.link/20231219215605.3d94507f5d9a.I537fcd73aedf94c7348c03157e486f24301fef14@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c -index 8e263acbc763..61170173f917 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c -@@ -271,17 +271,17 @@ __iwl_mvm_mld_assign_vif_chanctx(struct iwl_mvm *mvm, - } - } - -+ mvmvif->link[link_id]->phy_ctxt = phy_ctxt; -+ - if (iwl_mvm_is_esr_supported(mvm->fwrt.trans) && n_active > 1) { - mvmvif->link[link_id]->listen_lmac = true; - ret = iwl_mvm_esr_mode_active(mvm, vif); - if (ret) { - IWL_ERR(mvm, "failed to activate ESR mode (%d)\n", ret); -- return ret; -+ goto out; - } - } - -- mvmvif->link[link_id]->phy_ctxt = phy_ctxt; -- - if (switching_chanctx) { - /* reactivate if we turned this off during channel switch */ - if (vif->type == NL80211_IFTYPE_AP) --- -2.43.2 - -From 66f0f06ffb664b24c26d881a0bd09b37986a47a7 Mon Sep 17 00:00:00 2001 -From: Florian Westphal <fw@strlen.de> -Date: Mon, 27 Nov 2023 11:00:37 +0100 -Subject: [PATCH 0250/1501] netfilter: nf_tables: mark newset as dead on - transaction abort -Content-Length: 1510 -Lines: 42 - -[ Upstream commit 08e4c8c5919fd405a4d709b4ba43d836894a26eb ] - -If a transaction is aborted, we should mark the to-be-released NEWSET dead, -just like commit path does for DEL and DESTROYSET commands. - -In both cases all remaining elements will be released via -set->ops->destroy(). - -The existing abort code does NOT post the actual release to the work queue. -Also the entire __nf_tables_abort() function is wrapped in gc_seq -begin/end pair. - -Therefore, async gc worker will never try to release the pending set -elements, as gc sequence is always stale. - -It might be possible to speed up transaction aborts via work queue too, -this would result in a race and a possible use-after-free. - -So fix this before it becomes an issue. - -Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane") -Signed-off-by: Florian Westphal <fw@strlen.de> -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nf_tables_api.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index be04af433988..bbb8d8533f77 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -10383,6 +10383,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) - nft_trans_destroy(trans); - break; - } -+ nft_trans_set(trans)->dead = 1; - list_del_rcu(&nft_trans_set(trans)->list); - break; - case NFT_MSG_DELSET: --- -2.43.2 - -From ca3cbb24601f439a7216a4adeea4a599697ba159 Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso <pablo@netfilter.org> -Date: Thu, 14 Dec 2023 22:43:22 +0100 -Subject: [PATCH 0251/1501] netfilter: nf_tables: validate chain type update if - available -Content-Length: 1198 -Lines: 39 - -[ Upstream commit aaba7ddc8507f4ad5bbd07988573967632bc2385 ] - -Parse netlink attribute containing the chain type in this update, to -bail out if this is different from the existing type. - -Otherwise, it is possible to define a chain with the same name, hook and -priority but different type, which is silently ignored. - -Fixes: 96518518cc41 ("netfilter: add nftables") -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nf_tables_api.c | 11 ++++++++++- - 1 file changed, 10 insertions(+), 1 deletion(-) - -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index bbb8d8533f77..d5f76e26ae03 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -2261,7 +2261,16 @@ static int nft_chain_parse_hook(struct net *net, - return -EOPNOTSUPP; - } - -- type = basechain->type; -+ if (nla[NFTA_CHAIN_TYPE]) { -+ type = __nf_tables_chain_type_lookup(nla[NFTA_CHAIN_TYPE], -+ family); -+ if (!type) { -+ NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TYPE]); -+ return -ENOENT; -+ } -+ } else { -+ type = basechain->type; -+ } - } - - if (!try_module_get(type->owner)) { --- -2.43.2 - -From f5f01c542c03e2034bd1597d2ee84b233417d81e Mon Sep 17 00:00:00 2001 -From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> -Date: Thu, 30 Nov 2023 14:58:03 +0100 -Subject: [PATCH 0252/1501] Bluetooth: Fix bogus check for re-auth no supported - with non-ssp -Content-Length: 3029 -Lines: 80 - -[ Upstream commit d03376c185926098cb4d668d6458801eb785c0a5 ] - -This reverts 19f8def031bfa50c579149b200bfeeb919727b27 -"Bluetooth: Fix auth_complete_evt for legacy units" which seems to be -working around a bug on a broken controller rather then any limitation -imposed by the Bluetooth spec, in fact if there ws not possible to -re-auth the command shall fail not succeed. - -Fixes: 19f8def031bf ("Bluetooth: Fix auth_complete_evt for legacy units") -Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/net/bluetooth/hci_core.h | 1 - - net/bluetooth/hci_conn.c | 8 +++----- - net/bluetooth/hci_event.c | 11 ++--------- - 3 files changed, 5 insertions(+), 15 deletions(-) - -diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h -index a3a1ea2696a8..65dd28669352 100644 ---- a/include/net/bluetooth/hci_core.h -+++ b/include/net/bluetooth/hci_core.h -@@ -957,7 +957,6 @@ void hci_inquiry_cache_flush(struct hci_dev *hdev); - /* ----- HCI Connections ----- */ - enum { - HCI_CONN_AUTH_PEND, -- HCI_CONN_REAUTH_PEND, - HCI_CONN_ENCRYPT_PEND, - HCI_CONN_RSWITCH_PEND, - HCI_CONN_MODE_CHANGE_PEND, -diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c -index 2cee330188ce..d01db89fcb46 100644 ---- a/net/bluetooth/hci_conn.c -+++ b/net/bluetooth/hci_conn.c -@@ -2421,12 +2421,10 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) - hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, - sizeof(cp), &cp); - -- /* If we're already encrypted set the REAUTH_PEND flag, -- * otherwise set the ENCRYPT_PEND. -+ /* Set the ENCRYPT_PEND to trigger encryption after -+ * authentication. - */ -- if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) -- set_bit(HCI_CONN_REAUTH_PEND, &conn->flags); -- else -+ if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags)) - set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); - } - -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index ebf17b51072f..ef8c3bed7361 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -3500,14 +3500,8 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, void *data, - - if (!ev->status) { - clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags); -- -- if (!hci_conn_ssp_enabled(conn) && -- test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) { -- bt_dev_info(hdev, "re-auth of legacy device is not possible."); -- } else { -- set_bit(HCI_CONN_AUTH, &conn->flags); -- conn->sec_level = conn->pending_sec_level; -- } -+ set_bit(HCI_CONN_AUTH, &conn->flags); -+ conn->sec_level = conn->pending_sec_level; - } else { - if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING) - set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags); -@@ -3516,7 +3510,6 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, void *data, - } - - clear_bit(HCI_CONN_AUTH_PEND, &conn->flags); -- clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags); - - if (conn->state == BT_CONFIG) { - if (!ev->status && hci_conn_ssp_enabled(conn)) { --- -2.43.2 - -From 9efc70cf2554e7a8d5a996a44252f39e5bc4e510 Mon Sep 17 00:00:00 2001 -From: Francesco Dolcini <francesco.dolcini@toradex.com> -Date: Mon, 11 Dec 2023 17:40:18 +0100 -Subject: [PATCH 0253/1501] Bluetooth: btnxpuart: fix recv_buf() return value -Content-Length: 2609 -Lines: 61 - -[ Upstream commit 94d05394254401e503867c16aff561d3e687dfdc ] - -Serdev recv_buf() callback is supposed to return the amount of bytes -consumed, therefore an int in between 0 and count. - -Do not return a negative number in case of issue, just print an error -and return count. Before this change, in case of error, the returned -negative number was internally converted to 0 in ttyport_receive_buf, -now when the receive buffer is corrupted we return the size of the whole -received data (`count`). This should allow for better recovery in case -receiver/transmitter get out of sync if some data is lost. - -This fixes a WARN in ttyport_receive_buf(). - - Bluetooth: hci0: Frame reassembly failed (-84) - ------------[ cut here ]------------ - serial serial0: receive_buf returns -84 (count = 6) - WARNING: CPU: 0 PID: 37 at drivers/tty/serdev/serdev-ttyport.c:37 ttyport_receive_buf+0xd8/0xf8 - Modules linked in: mwifiex_sdio(+) ... - CPU: 0 PID: 37 Comm: kworker/u4:2 Not tainted 6.7.0-rc2-00147-gf1a09972a45a #1 - Hardware name: Toradex Verdin AM62 WB on Verdin Development Board (DT) - Workqueue: events_unbound flush_to_ldisc - pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) - pc : ttyport_receive_buf+0xd8/0xf8 - lr : ttyport_receive_buf+0xd8/0xf8 -... - Call trace: - ttyport_receive_buf+0xd8/0xf8 - flush_to_ldisc+0xbc/0x1a4 - process_scheduled_works+0x16c/0x28c - -Closes: https://lore.kernel.org/all/ZWEIhcUXfutb5SY6@francesco-nb.int.toradex.com/ -Fixes: 689ca16e5232 ("Bluetooth: NXP: Add protocol support for NXP Bluetooth chipsets") -Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com> -Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/bluetooth/btnxpuart.c | 7 +++---- - 1 file changed, 3 insertions(+), 4 deletions(-) - -diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c -index b7e66b7ac570..951fe3014a3f 100644 ---- a/drivers/bluetooth/btnxpuart.c -+++ b/drivers/bluetooth/btnxpuart.c -@@ -1276,11 +1276,10 @@ static int btnxpuart_receive_buf(struct serdev_device *serdev, const u8 *data, - if (IS_ERR(nxpdev->rx_skb)) { - int err = PTR_ERR(nxpdev->rx_skb); - /* Safe to ignore out-of-sync bootloader signatures */ -- if (is_fw_downloading(nxpdev)) -- return count; -- bt_dev_err(nxpdev->hdev, "Frame reassembly failed (%d)", err); -+ if (!is_fw_downloading(nxpdev)) -+ bt_dev_err(nxpdev->hdev, "Frame reassembly failed (%d)", err); - nxpdev->rx_skb = NULL; -- return err; -+ return count; - } - if (!is_fw_downloading(nxpdev)) - nxpdev->hdev->stat.byte_rx += count; --- -2.43.2 - -From 3e2680bd68fab7ba145393e4eb069d6c4d8a30fa Mon Sep 17 00:00:00 2001 -From: Francesco Dolcini <francesco.dolcini@toradex.com> -Date: Mon, 11 Dec 2023 17:40:19 +0100 -Subject: [PATCH 0254/1501] Bluetooth: btmtkuart: fix recv_buf() return value -Content-Length: 1991 -Lines: 60 - -[ Upstream commit 64057f051f20c2a2184b9db7f8037d928d68a4f4 ] - -Serdev recv_buf() callback is supposed to return the amount of bytes -consumed, therefore an int in between 0 and count. - -Do not return negative number in case of issue, just print an error and -return count. This fixes a WARN in ttyport_receive_buf(). - -Link: https://lore.kernel.org/all/087be419-ec6b-47ad-851a-5e1e3ea5cfcc@kernel.org/ -Fixes: 7237c4c9ec92 ("Bluetooth: mediatek: Add protocol support for MediaTek serial devices") -Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com> -Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/bluetooth/btmtkuart.c | 11 +++-------- - 1 file changed, 3 insertions(+), 8 deletions(-) - -diff --git a/drivers/bluetooth/btmtkuart.c b/drivers/bluetooth/btmtkuart.c -index 935feab815d9..203a000a84e3 100644 ---- a/drivers/bluetooth/btmtkuart.c -+++ b/drivers/bluetooth/btmtkuart.c -@@ -336,7 +336,7 @@ mtk_stp_split(struct btmtkuart_dev *bdev, const unsigned char *data, int count, - return data; - } - --static int btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count) -+static void btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count) - { - struct btmtkuart_dev *bdev = hci_get_drvdata(hdev); - const unsigned char *p_left = data, *p_h4; -@@ -375,25 +375,20 @@ static int btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count) - bt_dev_err(bdev->hdev, - "Frame reassembly failed (%d)", err); - bdev->rx_skb = NULL; -- return err; -+ return; - } - - sz_left -= sz_h4; - p_left += sz_h4; - } -- -- return 0; - } - - static int btmtkuart_receive_buf(struct serdev_device *serdev, const u8 *data, - size_t count) - { - struct btmtkuart_dev *bdev = serdev_device_get_drvdata(serdev); -- int err; - -- err = btmtkuart_recv(bdev->hdev, data, count); -- if (err < 0) -- return err; -+ btmtkuart_recv(bdev->hdev, data, count); - - bdev->hdev->stat.byte_rx += count; - --- -2.43.2 - -From 2600dfaac57813ab7813ea571417bcbd503c65fc Mon Sep 17 00:00:00 2001 -From: Christoph Hellwig <hch@lst.de> -Date: Wed, 27 Dec 2023 09:23:02 +0000 -Subject: [PATCH 0255/1501] null_blk: don't cap max_hw_sectors to - BLK_DEF_MAX_SECTORS -Content-Length: 2020 -Lines: 51 - -[ Upstream commit 9a9525de865410047fa962867b4fcd33943b206f ] - -null_blk has some rather odd capping of the max_hw_sectors value to -BLK_DEF_MAX_SECTORS, which doesn't make sense - max_hw_sector is the -hardware limit, and BLK_DEF_MAX_SECTORS despite the confusing name is the -default cap for the max_sectors field used for normal file system I/O. - -Remove all the capping, and simply leave it to the block layer or -user to take up or not all of that for file system I/O. - -Fixes: ea17fd354ca8 ("null_blk: Allow controlling max_hw_sectors limit") -Signed-off-by: Christoph Hellwig <hch@lst.de> -Link: https://lore.kernel.org/r/20231227092305.279567-2-hch@lst.de -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/block/null_blk/main.c | 12 ++---------- - 1 file changed, 2 insertions(+), 10 deletions(-) - -diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c -index 3021d58ca51c..13ed446b5e19 100644 ---- a/drivers/block/null_blk/main.c -+++ b/drivers/block/null_blk/main.c -@@ -2186,10 +2186,8 @@ static int null_add_dev(struct nullb_device *dev) - - blk_queue_logical_block_size(nullb->q, dev->blocksize); - blk_queue_physical_block_size(nullb->q, dev->blocksize); -- if (!dev->max_sectors) -- dev->max_sectors = queue_max_hw_sectors(nullb->q); -- dev->max_sectors = min(dev->max_sectors, BLK_DEF_MAX_SECTORS); -- blk_queue_max_hw_sectors(nullb->q, dev->max_sectors); -+ if (dev->max_sectors) -+ blk_queue_max_hw_sectors(nullb->q, dev->max_sectors); - - if (dev->virt_boundary) - blk_queue_virt_boundary(nullb->q, PAGE_SIZE - 1); -@@ -2289,12 +2287,6 @@ static int __init null_init(void) - g_bs = PAGE_SIZE; - } - -- if (g_max_sectors > BLK_DEF_MAX_SECTORS) { -- pr_warn("invalid max sectors\n"); -- pr_warn("defaults max sectors to %u\n", BLK_DEF_MAX_SECTORS); -- g_max_sectors = BLK_DEF_MAX_SECTORS; -- } -- - if (g_home_node != NUMA_NO_NODE && g_home_node >= nr_online_nodes) { - pr_err("invalid home_node value\n"); - g_home_node = NUMA_NO_NODE; --- -2.43.2 - -From 3cd9b9bee33f39f6c6d52360fe381b89a7b12695 Mon Sep 17 00:00:00 2001 -From: Kunwu Chan <chentao@kylinos.cn> -Date: Tue, 12 Dec 2023 10:40:15 +0800 -Subject: [PATCH 0257/1501] ice: Fix some null pointer dereference issues in - ice_ptp.c -Content-Length: 1722 -Lines: 42 - -[ Upstream commit 3027e7b15b02d2d37e3f82d6b8404f6d37e3b8cf ] - -devm_kasprintf() returns a pointer to dynamically allocated memory -which can be NULL upon failure. - -Fixes: d938a8cca88a ("ice: Auxbus devices & driver for E822 TS") -Cc: Kunwu Chan <kunwu.chan@hotmail.com> -Suggested-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> -Signed-off-by: Kunwu Chan <chentao@kylinos.cn> -Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> -Reviewed-by: Simon Horman <horms@kernel.org> -Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel) -Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/intel/ice/ice_ptp.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c -index 71f405f8a6fe..e6b1ce76ca8a 100644 ---- a/drivers/net/ethernet/intel/ice/ice_ptp.c -+++ b/drivers/net/ethernet/intel/ice/ice_ptp.c -@@ -2692,6 +2692,8 @@ static int ice_ptp_register_auxbus_driver(struct ice_pf *pf) - name = devm_kasprintf(dev, GFP_KERNEL, "ptp_aux_dev_%u_%u_clk%u", - pf->pdev->bus->number, PCI_SLOT(pf->pdev->devfn), - ice_get_ptp_src_clock_index(&pf->hw)); -+ if (!name) -+ return -ENOMEM; - - aux_driver->name = name; - aux_driver->shutdown = ice_ptp_auxbus_shutdown; -@@ -2938,6 +2940,8 @@ static int ice_ptp_create_auxbus_device(struct ice_pf *pf) - name = devm_kasprintf(dev, GFP_KERNEL, "ptp_aux_dev_%u_%u_clk%u", - pf->pdev->bus->number, PCI_SLOT(pf->pdev->devfn), - ice_get_ptp_src_clock_index(&pf->hw)); -+ if (!name) -+ return -ENOMEM; - - aux_dev->name = name; - aux_dev->id = id; --- -2.43.2 - -From 38344519bee6b5d3c21b57683bc2c01f8802c358 Mon Sep 17 00:00:00 2001 -From: Benjamin Berg <benjamin.berg@intel.com> -Date: Tue, 2 Jan 2024 21:35:30 +0200 -Subject: [PATCH 0258/1501] wifi: cfg80211: correct comment about MLD ID -Content-Length: 1626 -Lines: 38 - -[ Upstream commit 2a0698f86d4dfc43cc0c1703efb7ba6b1506a4e2 ] - -The comment was referencing the wrong section of the documentation and -was also subtly wrong as it assumed the rules that apply when sending -probe requests directly to a nontransmitted AP. However, in that case -the response comes from the transmitting AP and the AP MLD ID will be -included. - -Fixes: 2481b5da9c6b ("wifi: cfg80211: handle BSS data contained in ML probe responses") -Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> -Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> -Link: https://msgid.link/20240102213313.0917ab4b5d7f.I76aff0e261a5de44ffb467e591a46597a30d7c0a@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/wireless/scan.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/net/wireless/scan.c b/net/wireless/scan.c -index 9e5ccffd6868..8cd3eef76f2b 100644 ---- a/net/wireless/scan.c -+++ b/net/wireless/scan.c -@@ -2647,8 +2647,11 @@ static void cfg80211_parse_ml_sta_data(struct wiphy *wiphy, - /* MLD capabilities and operations */ - pos += 2; - -- /* Not included when the (nontransmitted) AP is responding itself, -- * but defined to zero then (Draft P802.11be_D3.0, 9.4.2.170.2) -+ /* -+ * The MLD ID of the reporting AP is always zero. It is set if the AP -+ * is part of an MBSSID set and will be non-zero for ML Elements -+ * relating to a nontransmitted BSS (matching the Multi-BSSID Index, -+ * Draft P802.11be_D3.2, 35.3.4.2) - */ - if (u16_get_bits(control, IEEE80211_MLC_BASIC_PRES_MLD_ID)) { - mld_id = *pos; --- -2.43.2 - -From d4924d21f6bc4f50ad1b8ffee9b73886244eb981 Mon Sep 17 00:00:00 2001 -From: Benjamin Berg <benjamin.berg@intel.com> -Date: Tue, 2 Jan 2024 21:35:31 +0200 -Subject: [PATCH 0259/1501] wifi: cfg80211: parse all ML elements in an ML - probe response -Content-Length: 3021 -Lines: 90 - -[ Upstream commit d18125b640309e925441ce49559be33867ae6b29 ] - -A probe response from a transmitting AP in an Multi-BSSID setup will -contain more than one Multi-Link element. Most likely, only one of these -elements contains per-STA profiles. - -Fixes: 2481b5da9c6b ("wifi: cfg80211: handle BSS data contained in ML probe responses") -Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> -Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> -Link: https://msgid.link/20240102213313.6635eb152735.I94289002d4a2f7b6b44dfa428344854e37b0b29c@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/wireless/scan.c | 40 ++++++++++++++++++++++++++-------------- - 1 file changed, 26 insertions(+), 14 deletions(-) - -diff --git a/net/wireless/scan.c b/net/wireless/scan.c -index 8cd3eef76f2b..0d6c3fc1238a 100644 ---- a/net/wireless/scan.c -+++ b/net/wireless/scan.c -@@ -2591,10 +2591,12 @@ cfg80211_tbtt_info_for_mld_ap(const u8 *ie, size_t ielen, u8 mld_id, u8 link_id, - return false; - } - --static void cfg80211_parse_ml_sta_data(struct wiphy *wiphy, -- struct cfg80211_inform_single_bss_data *tx_data, -- struct cfg80211_bss *source_bss, -- gfp_t gfp) -+static void -+cfg80211_parse_ml_elem_sta_data(struct wiphy *wiphy, -+ struct cfg80211_inform_single_bss_data *tx_data, -+ struct cfg80211_bss *source_bss, -+ const struct element *elem, -+ gfp_t gfp) - { - struct cfg80211_inform_single_bss_data data = { - .drv_data = tx_data->drv_data, -@@ -2603,7 +2605,6 @@ static void cfg80211_parse_ml_sta_data(struct wiphy *wiphy, - .bss_source = BSS_SOURCE_STA_PROFILE, - }; - struct ieee80211_multi_link_elem *ml_elem; -- const struct element *elem; - struct cfg80211_mle *mle; - u16 control; - u8 *new_ie; -@@ -2613,15 +2614,7 @@ static void cfg80211_parse_ml_sta_data(struct wiphy *wiphy, - const u8 *pos; - u8 i; - -- if (!source_bss) -- return; -- -- if (tx_data->ftype != CFG80211_BSS_FTYPE_PRESP) -- return; -- -- elem = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_MULTI_LINK, -- tx_data->ie, tx_data->ielen); -- if (!elem || !ieee80211_mle_size_ok(elem->data + 1, elem->datalen - 1)) -+ if (!ieee80211_mle_size_ok(elem->data + 1, elem->datalen - 1)) - return; - - ml_elem = (void *)elem->data + 1; -@@ -2756,6 +2749,25 @@ static void cfg80211_parse_ml_sta_data(struct wiphy *wiphy, - kfree(mle); - } - -+static void cfg80211_parse_ml_sta_data(struct wiphy *wiphy, -+ struct cfg80211_inform_single_bss_data *tx_data, -+ struct cfg80211_bss *source_bss, -+ gfp_t gfp) -+{ -+ const struct element *elem; -+ -+ if (!source_bss) -+ return; -+ -+ if (tx_data->ftype != CFG80211_BSS_FTYPE_PRESP) -+ return; -+ -+ for_each_element_extid(elem, WLAN_EID_EXT_EHT_MULTI_LINK, -+ tx_data->ie, tx_data->ielen) -+ cfg80211_parse_ml_elem_sta_data(wiphy, tx_data, source_bss, -+ elem, gfp); -+} -+ - struct cfg80211_bss * - cfg80211_inform_bss_data(struct wiphy *wiphy, - struct cfg80211_inform_bss *data, --- -2.43.2 - -From 0c199d135888d27575ab523bb8384c364d116464 Mon Sep 17 00:00:00 2001 -From: John Fastabend <john.fastabend@gmail.com> -Date: Thu, 21 Dec 2023 15:23:23 -0800 -Subject: [PATCH 0260/1501] bpf: sockmap, fix proto update hook to avoid dup - calls -Content-Length: 3014 -Lines: 73 - -[ Upstream commit 16b2f264983dc264c1560cc0170e760dec1bf54f ] - -When sockets are added to a sockmap or sockhash we allocate and init a -psock. Then update the proto ops with sock_map_init_proto the flow is - - sock_hash_update_common - sock_map_link - psock = sock_map_psock_get_checked() <-returns existing psock - sock_map_init_proto(sk, psock) <- updates sk_proto - -If the socket is already in a map this results in the sock_map_init_proto -being called multiple times on the same socket. We do this because when -a socket is added to multiple maps this might result in a new set of BPF -programs being attached to the socket requiring an updated ops struct. - -This creates a rule where it must be safe to call psock_update_sk_prot -multiple times. When we added a fix for UAF through unix sockets in patch -4dd9a38a753fc we broke this rule by adding a sock_hold in that path -to ensure the sock is not released. The result is if a af_unix stream sock -is placed in multiple maps it results in a memory leak because we call -sock_hold multiple times with only a single sock_put on it. - -Fixes: 8866730aed51 ("bpf, sockmap: af_unix stream sockets need to hold ref for pair sock") -Reported-by: Xingwei Lee <xrivendell7@gmail.com> -Signed-off-by: John Fastabend <john.fastabend@gmail.com> -Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org> -Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> -Link: https://lore.kernel.org/r/20231221232327.43678-2-john.fastabend@gmail.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/unix/unix_bpf.c | 21 ++++++++++++++++++--- - 1 file changed, 18 insertions(+), 3 deletions(-) - -diff --git a/net/unix/unix_bpf.c b/net/unix/unix_bpf.c -index 7ea7c3a0d0d0..bd84785bf8d6 100644 ---- a/net/unix/unix_bpf.c -+++ b/net/unix/unix_bpf.c -@@ -161,15 +161,30 @@ int unix_stream_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool r - { - struct sock *sk_pair; - -+ /* Restore does not decrement the sk_pair reference yet because we must -+ * keep the a reference to the socket until after an RCU grace period -+ * and any pending sends have completed. -+ */ - if (restore) { - sk->sk_write_space = psock->saved_write_space; - sock_replace_proto(sk, psock->sk_proto); - return 0; - } - -- sk_pair = unix_peer(sk); -- sock_hold(sk_pair); -- psock->sk_pair = sk_pair; -+ /* psock_update_sk_prot can be called multiple times if psock is -+ * added to multiple maps and/or slots in the same map. There is -+ * also an edge case where replacing a psock with itself can trigger -+ * an extra psock_update_sk_prot during the insert process. So it -+ * must be safe to do multiple calls. Here we need to ensure we don't -+ * increment the refcnt through sock_hold many times. There will only -+ * be a single matching destroy operation. -+ */ -+ if (!psock->sk_pair) { -+ sk_pair = unix_peer(sk); -+ sock_hold(sk_pair); -+ psock->sk_pair = sk_pair; -+ } -+ - unix_stream_bpf_check_needs_rebuild(psock->sk_proto); - sock_replace_proto(sk, &unix_stream_bpf_prot); - return 0; --- -2.43.2 - -From 596e695a3041e6028918bf7ca848c5be1eeb33fc Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Tue, 12 Dec 2023 14:55:50 +0000 -Subject: [PATCH 0261/1501] sctp: support MSG_ERRQUEUE flag in recvmsg() -Content-Length: 1733 -Lines: 51 - -[ Upstream commit 4746b36b1abe11ca32987b2d21e1e770deab17cc ] - -For some reason sctp_poll() generates EPOLLERR if sk->sk_error_queue -is not empty but recvmsg() can not drain the error queue yet. - -This is needed to better support timestamping. - -I had to export inet_recv_error(), since sctp -can be compiled as a module. - -Signed-off-by: Eric Dumazet <edumazet@google.com> -Cc: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> -Cc: Willem de Bruijn <willemb@google.com> -Acked-by: Xin Long <lucien.xin@gmail.com> -Link: https://lore.kernel.org/r/20231212145550.3872051-1-edumazet@google.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Stable-dep-of: a562c0a2d651 ("sctp: fix busy polling") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/ipv4/af_inet.c | 1 + - net/sctp/socket.c | 3 +++ - 2 files changed, 4 insertions(+) - -diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c -index fb81de10d332..ea0b0334a0fb 100644 ---- a/net/ipv4/af_inet.c -+++ b/net/ipv4/af_inet.c -@@ -1633,6 +1633,7 @@ int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) - #endif - return -EINVAL; - } -+EXPORT_SYMBOL(inet_recv_error); - - int inet_gro_complete(struct sk_buff *skb, int nhoff) - { -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 7f89e43154c0..5fb02bbb4b34 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -2099,6 +2099,9 @@ static int sctp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, - pr_debug("%s: sk:%p, msghdr:%p, len:%zd, flags:0x%x, addr_len:%p)\n", - __func__, sk, msg, len, flags, addr_len); - -+ if (unlikely(flags & MSG_ERRQUEUE)) -+ return inet_recv_error(sk, msg, len, addr_len); -+ - lock_sock(sk); - - if (sctp_style(sk, TCP) && !sctp_sstate(sk, ESTABLISHED) && --- -2.43.2 - -From 63b48d3554fc4bbb915decabd9ec10190cd26525 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Tue, 19 Dec 2023 17:00:17 +0000 -Subject: [PATCH 0262/1501] sctp: fix busy polling -Content-Length: 1548 -Lines: 46 - -[ Upstream commit a562c0a2d651e040681b0bfce9b4d229ac3b0b8c ] - -Busy polling while holding the socket lock makes litle sense, -because incoming packets wont reach our receive queue. - -Fixes: 8465a5fcd1ce ("sctp: add support for busy polling to sctp protocol") -Reported-by: Jacob Moroni <jmoroni@google.com> -Signed-off-by: Eric Dumazet <edumazet@google.com> -Cc: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> -Cc: Xin Long <lucien.xin@gmail.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/sctp/socket.c | 10 ++++------ - 1 file changed, 4 insertions(+), 6 deletions(-) - -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 5fb02bbb4b34..6b9fcdb0952a 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -2102,6 +2102,10 @@ static int sctp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, - if (unlikely(flags & MSG_ERRQUEUE)) - return inet_recv_error(sk, msg, len, addr_len); - -+ if (sk_can_busy_loop(sk) && -+ skb_queue_empty_lockless(&sk->sk_receive_queue)) -+ sk_busy_loop(sk, flags & MSG_DONTWAIT); -+ - lock_sock(sk); - - if (sctp_style(sk, TCP) && !sctp_sstate(sk, ESTABLISHED) && -@@ -9046,12 +9050,6 @@ struct sk_buff *sctp_skb_recv_datagram(struct sock *sk, int flags, int *err) - if (sk->sk_shutdown & RCV_SHUTDOWN) - break; - -- if (sk_can_busy_loop(sk)) { -- sk_busy_loop(sk, flags & MSG_DONTWAIT); -- -- if (!skb_queue_empty_lockless(&sk->sk_receive_queue)) -- continue; -- } - - /* User doesn't want to wait. */ - error = -EAGAIN; --- -2.43.2 - -From ad0b398069132ca9583ea3f315d78e9f50569e97 Mon Sep 17 00:00:00 2001 -From: Ilya Leoshkevich <iii@linux.ibm.com> -Date: Tue, 2 Jan 2024 20:30:35 +0100 -Subject: [PATCH 0263/1501] s390/bpf: Fix gotol with large offsets -Content-Length: 1189 -Lines: 31 - -[ Upstream commit ecba66cb36e3428e9f0c2362b45e213ad43ba8d0 ] - -The gotol implementation uses a wrong data type for the offset: it -should be s32, not s16. - -Fixes: c690191e23d8 ("s390/bpf: Implement unconditional jump with 32-bit offset") -Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> -Acked-by: Yonghong Song <yonghong.song@linux.dev> -Acked-by: John Fastabend <john.fastabend@gmail.com> -Link: https://lore.kernel.org/r/20240102193531.3169422-2-iii@linux.ibm.com -Signed-off-by: Alexei Starovoitov <ast@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/s390/net/bpf_jit_comp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c -index bf06b7283f0c..c7fbeedeb0a4 100644 ---- a/arch/s390/net/bpf_jit_comp.c -+++ b/arch/s390/net/bpf_jit_comp.c -@@ -779,7 +779,7 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, - int i, bool extra_pass, u32 stack_depth) - { - struct bpf_insn *insn = &fp->insnsi[i]; -- s16 branch_oc_off = insn->off; -+ s32 branch_oc_off = insn->off; - u32 dst_reg = insn->dst_reg; - u32 src_reg = insn->src_reg; - int last, insn_count = 1; --- -2.43.2 - -From 77fcddb6be7ca0c8d2e36b78442e993cdbbf6608 Mon Sep 17 00:00:00 2001 -From: Ming Lei <ming.lei@redhat.com> -Date: Tue, 19 Dec 2023 09:28:33 +0800 -Subject: [PATCH 0264/1501] blk-cgroup: fix rcu lockdep warning in - blkg_lookup() -Content-Length: 1385 -Lines: 38 - -[ Upstream commit 393cd8ffd832f23eec3a105553eff622e8198918 ] - -blkg_lookup() is called with either queue_lock or rcu read lock, so -use rcu_dereference_check(lockdep_is_held(&q->queue_lock)) for -retrieving 'blkg', which way models the check exactly for covering -queue lock or rcu read lock. - -Fix lockdep warning of "block/blk-cgroup.h:254 suspicious rcu_dereference_check() usage!" -from blkg_lookup(). - -Tested-by: Changhui Zhong <czhong@redhat.com> -Signed-off-by: Ming Lei <ming.lei@redhat.com> -Reviewed-by: Yu Kuai <yukuai3@huawei.com> -Fixes: 83462a6c971c ("blkcg: Drop unnecessary RCU read [un]locks from blkg_conf_prep/finish()") -Acked-by: Tejun Heo <tj@kernel.org> -Link: https://lore.kernel.org/r/20231219012833.2129540-1-ming.lei@redhat.com -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - block/blk-cgroup.h | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h -index fd482439afbc..b927a4a0ad03 100644 ---- a/block/blk-cgroup.h -+++ b/block/blk-cgroup.h -@@ -252,7 +252,8 @@ static inline struct blkcg_gq *blkg_lookup(struct blkcg *blkcg, - if (blkcg == &blkcg_root) - return q->root_blkg; - -- blkg = rcu_dereference(blkcg->blkg_hint); -+ blkg = rcu_dereference_check(blkcg->blkg_hint, -+ lockdep_is_held(&q->queue_lock)); - if (blkg && blkg->q == q) - return blkg; - --- -2.43.2 - -From f5346df0591d10bc948761ca854b1fae6d2ef441 Mon Sep 17 00:00:00 2001 -From: Tao Liu <taoliu828@163.com> -Date: Thu, 28 Dec 2023 16:14:57 +0800 -Subject: [PATCH 0265/1501] net/sched: act_ct: fix skb leak and crash on ooo - frags -Content-Length: 6310 -Lines: 141 - -[ Upstream commit 3f14b377d01d8357eba032b4cabc8c1149b458b6 ] - -act_ct adds skb->users before defragmentation. If frags arrive in order, -the last frag's reference is reset in: - - inet_frag_reasm_prepare - skb_morph - -which is not straightforward. - -However when frags arrive out of order, nobody unref the last frag, and -all frags are leaked. The situation is even worse, as initiating packet -capture can lead to a crash[0] when skb has been cloned and shared at the -same time. - -Fix the issue by removing skb_get() before defragmentation. act_ct -returns TC_ACT_CONSUMED when defrag failed or in progress. - -[0]: -[ 843.804823] ------------[ cut here ]------------ -[ 843.809659] kernel BUG at net/core/skbuff.c:2091! -[ 843.814516] invalid opcode: 0000 [#1] PREEMPT SMP -[ 843.819296] CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G S 6.7.0-rc3 #2 -[ 843.824107] Hardware name: XFUSION 1288H V6/BC13MBSBD, BIOS 1.29 11/25/2022 -[ 843.828953] RIP: 0010:pskb_expand_head+0x2ac/0x300 -[ 843.833805] Code: 8b 70 28 48 85 f6 74 82 48 83 c6 08 bf 01 00 00 00 e8 38 bd ff ff 8b 83 c0 00 00 00 48 03 83 c8 00 00 00 e9 62 ff ff ff 0f 0b <0f> 0b e8 8d d0 ff ff e9 b3 fd ff ff 81 7c 24 14 40 01 00 00 4c 89 -[ 843.843698] RSP: 0018:ffffc9000cce07c0 EFLAGS: 00010202 -[ 843.848524] RAX: 0000000000000002 RBX: ffff88811a211d00 RCX: 0000000000000820 -[ 843.853299] RDX: 0000000000000640 RSI: 0000000000000000 RDI: ffff88811a211d00 -[ 843.857974] RBP: ffff888127d39518 R08: 00000000bee97314 R09: 0000000000000000 -[ 843.862584] R10: 0000000000000000 R11: ffff8881109f0000 R12: 0000000000000880 -[ 843.867147] R13: ffff888127d39580 R14: 0000000000000640 R15: ffff888170f7b900 -[ 843.871680] FS: 0000000000000000(0000) GS:ffff889ffffc0000(0000) knlGS:0000000000000000 -[ 843.876242] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -[ 843.880778] CR2: 00007fa42affcfb8 CR3: 000000011433a002 CR4: 0000000000770ef0 -[ 843.885336] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 -[ 843.889809] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 -[ 843.894229] PKRU: 55555554 -[ 843.898539] Call Trace: -[ 843.902772] <IRQ> -[ 843.906922] ? __die_body+0x1e/0x60 -[ 843.911032] ? die+0x3c/0x60 -[ 843.915037] ? do_trap+0xe2/0x110 -[ 843.918911] ? pskb_expand_head+0x2ac/0x300 -[ 843.922687] ? do_error_trap+0x65/0x80 -[ 843.926342] ? pskb_expand_head+0x2ac/0x300 -[ 843.929905] ? exc_invalid_op+0x50/0x60 -[ 843.933398] ? pskb_expand_head+0x2ac/0x300 -[ 843.936835] ? asm_exc_invalid_op+0x1a/0x20 -[ 843.940226] ? pskb_expand_head+0x2ac/0x300 -[ 843.943580] inet_frag_reasm_prepare+0xd1/0x240 -[ 843.946904] ip_defrag+0x5d4/0x870 -[ 843.950132] nf_ct_handle_fragments+0xec/0x130 [nf_conntrack] -[ 843.953334] tcf_ct_act+0x252/0xd90 [act_ct] -[ 843.956473] ? tcf_mirred_act+0x516/0x5a0 [act_mirred] -[ 843.959657] tcf_action_exec+0xa1/0x160 -[ 843.962823] fl_classify+0x1db/0x1f0 [cls_flower] -[ 843.966010] ? skb_clone+0x53/0xc0 -[ 843.969173] tcf_classify+0x24d/0x420 -[ 843.972333] tc_run+0x8f/0xf0 -[ 843.975465] __netif_receive_skb_core+0x67a/0x1080 -[ 843.978634] ? dev_gro_receive+0x249/0x730 -[ 843.981759] __netif_receive_skb_list_core+0x12d/0x260 -[ 843.984869] netif_receive_skb_list_internal+0x1cb/0x2f0 -[ 843.987957] ? mlx5e_handle_rx_cqe_mpwrq_rep+0xfa/0x1a0 [mlx5_core] -[ 843.991170] napi_complete_done+0x72/0x1a0 -[ 843.994305] mlx5e_napi_poll+0x28c/0x6d0 [mlx5_core] -[ 843.997501] __napi_poll+0x25/0x1b0 -[ 844.000627] net_rx_action+0x256/0x330 -[ 844.003705] __do_softirq+0xb3/0x29b -[ 844.006718] irq_exit_rcu+0x9e/0xc0 -[ 844.009672] common_interrupt+0x86/0xa0 -[ 844.012537] </IRQ> -[ 844.015285] <TASK> -[ 844.017937] asm_common_interrupt+0x26/0x40 -[ 844.020591] RIP: 0010:acpi_safe_halt+0x1b/0x20 -[ 844.023247] Code: ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 65 48 8b 04 25 00 18 03 00 48 8b 00 a8 08 75 0c 66 90 0f 00 2d 81 d0 44 00 fb f4 <fa> c3 0f 1f 00 89 fa ec 48 8b 05 ee 88 ed 00 a9 00 00 00 80 75 11 -[ 844.028900] RSP: 0018:ffffc90000533e70 EFLAGS: 00000246 -[ 844.031725] RAX: 0000000000004000 RBX: 0000000000000001 RCX: 0000000000000000 -[ 844.034553] RDX: ffff889ffffc0000 RSI: ffffffff828b7f20 RDI: ffff88a090f45c64 -[ 844.037368] RBP: ffff88a0901a2800 R08: ffff88a090f45c00 R09: 00000000000317c0 -[ 844.040155] R10: 00ec812281150475 R11: ffff889fffff0e04 R12: ffffffff828b7fa0 -[ 844.042962] R13: ffffffff828b7f20 R14: 0000000000000001 R15: 0000000000000000 -[ 844.045819] acpi_idle_enter+0x7b/0xc0 -[ 844.048621] cpuidle_enter_state+0x7f/0x430 -[ 844.051451] cpuidle_enter+0x2d/0x40 -[ 844.054279] do_idle+0x1d4/0x240 -[ 844.057096] cpu_startup_entry+0x2a/0x30 -[ 844.059934] start_secondary+0x104/0x130 -[ 844.062787] secondary_startup_64_no_verify+0x16b/0x16b -[ 844.065674] </TASK> - -Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct") -Signed-off-by: Tao Liu <taoliu828@163.com> -Link: https://lore.kernel.org/r/20231228081457.936732-1-taoliu828@163.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/sched/act_ct.c | 12 ++++++------ - 1 file changed, 6 insertions(+), 6 deletions(-) - -diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c -index f69c47945175..3d50215985d5 100644 ---- a/net/sched/act_ct.c -+++ b/net/sched/act_ct.c -@@ -850,7 +850,6 @@ static int tcf_ct_handle_fragments(struct net *net, struct sk_buff *skb, - if (err || !frag) - return err; - -- skb_get(skb); - err = nf_ct_handle_fragments(net, skb, zone, family, &proto, &mru); - if (err) - return err; -@@ -999,12 +998,8 @@ TC_INDIRECT_SCOPE int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a, - nh_ofs = skb_network_offset(skb); - skb_pull_rcsum(skb, nh_ofs); - err = tcf_ct_handle_fragments(net, skb, family, p->zone, &defrag); -- if (err == -EINPROGRESS) { -- retval = TC_ACT_STOLEN; -- goto out_clear; -- } - if (err) -- goto drop; -+ goto out_frag; - - err = nf_ct_skb_network_trim(skb, family); - if (err) -@@ -1091,6 +1086,11 @@ TC_INDIRECT_SCOPE int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a, - qdisc_skb_cb(skb)->pkt_len = skb->len; - return retval; - -+out_frag: -+ if (err != -EINPROGRESS) -+ tcf_action_inc_drop_qstats(&c->common); -+ return TC_ACT_CONSUMED; -+ - drop: - tcf_action_inc_drop_qstats(&c->common); - return TC_ACT_SHOT; --- -2.43.2 - -From eb774a523b3bff499261572aa47451c19afabd96 Mon Sep 17 00:00:00 2001 -From: Asmaa Mnebhi <asmaa@nvidia.com> -Date: Fri, 5 Jan 2024 10:59:46 -0500 -Subject: [PATCH 0266/1501] mlxbf_gige: Fix intermittent no ip issue -Content-Length: 3009 -Lines: 85 - -[ Upstream commit ef210ef85d5cb543ce34a57803ed856d0c8c08c2 ] - -Although the link is up, there is no ip assigned on setups with high background -traffic. Nothing is transmitted nor received. The RX error count keeps on -increasing. After several minutes, the RX error count stagnates and the -GigE interface finally gets an ip. - -The issue is that mlxbf_gige_rx_init() is called before phy_start(). -As soon as the RX DMA is enabled in mlxbf_gige_rx_init(), the RX CI reaches the max -of 128, and becomes equal to RX PI. RX CI doesn't decrease since the code hasn't -ran phy_start yet. -Bring the PHY up before starting the RX. - -Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver") -Reviewed-by: David Thompson <davthompson@nvidia.com> -Signed-off-by: Asmaa Mnebhi <asmaa@nvidia.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../mellanox/mlxbf_gige/mlxbf_gige_main.c | 16 ++++++++-------- - .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c | 6 +++--- - 2 files changed, 11 insertions(+), 11 deletions(-) - -diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c -index 954ba0826c61..ac7f0128619c 100644 ---- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c -+++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c -@@ -147,14 +147,14 @@ static int mlxbf_gige_open(struct net_device *netdev) - */ - priv->valid_polarity = 0; - -- err = mlxbf_gige_rx_init(priv); -- if (err) -- goto free_irqs; -+ phy_start(phydev); -+ - err = mlxbf_gige_tx_init(priv); - if (err) -- goto rx_deinit; -- -- phy_start(phydev); -+ goto free_irqs; -+ err = mlxbf_gige_rx_init(priv); -+ if (err) -+ goto tx_deinit; - - netif_napi_add(netdev, &priv->napi, mlxbf_gige_poll); - napi_enable(&priv->napi); -@@ -176,8 +176,8 @@ static int mlxbf_gige_open(struct net_device *netdev) - - return 0; - --rx_deinit: -- mlxbf_gige_rx_deinit(priv); -+tx_deinit: -+ mlxbf_gige_tx_deinit(priv); - - free_irqs: - mlxbf_gige_free_irqs(priv); -diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c -index 227d01cace3f..699984358493 100644 ---- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c -+++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c -@@ -142,6 +142,9 @@ int mlxbf_gige_rx_init(struct mlxbf_gige *priv) - writeq(MLXBF_GIGE_RX_MAC_FILTER_COUNT_PASS_EN, - priv->base + MLXBF_GIGE_RX_MAC_FILTER_COUNT_PASS); - -+ writeq(ilog2(priv->rx_q_entries), -+ priv->base + MLXBF_GIGE_RX_WQE_SIZE_LOG2); -+ - /* Clear MLXBF_GIGE_INT_MASK 'receive pkt' bit to - * indicate readiness to receive interrupts - */ -@@ -154,9 +157,6 @@ int mlxbf_gige_rx_init(struct mlxbf_gige *priv) - data |= MLXBF_GIGE_RX_DMA_EN; - writeq(data, priv->base + MLXBF_GIGE_RX_DMA); - -- writeq(ilog2(priv->rx_q_entries), -- priv->base + MLXBF_GIGE_RX_WQE_SIZE_LOG2); -- - return 0; - - free_wqe_and_skb: --- -2.43.2 - -From 8f8d1d97a1c924cce9d83e0a7eb04af41e957b6e Mon Sep 17 00:00:00 2001 -From: Asmaa Mnebhi <asmaa@nvidia.com> -Date: Fri, 5 Jan 2024 11:00:14 -0500 -Subject: [PATCH 0267/1501] mlxbf_gige: Enable the GigE port in mlxbf_gige_open -Content-Length: 2245 -Lines: 60 - -[ Upstream commit a460f4a684511e007bbf1700758a41f05d9981e6 ] - -At the moment, the GigE port is enabled in the mlxbf_gige_probe -function. If the mlxbf_gige_open is not executed, this could cause -pause frames to increase in the case where there is high backgroud -traffic. This results in clogging the port. -So move enabling the OOB port to mlxbf_gige_open. - -Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver") -Reviewed-by: David Thompson <davthompson@nvidia.com> -Signed-off-by: Asmaa Mnebhi <asmaa@nvidia.com> -Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 12 ++++++------ - 1 file changed, 6 insertions(+), 6 deletions(-) - -diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c -index ac7f0128619c..3d09fa54598f 100644 ---- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c -+++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c -@@ -130,9 +130,15 @@ static int mlxbf_gige_open(struct net_device *netdev) - { - struct mlxbf_gige *priv = netdev_priv(netdev); - struct phy_device *phydev = netdev->phydev; -+ u64 control; - u64 int_en; - int err; - -+ /* Perform general init of GigE block */ -+ control = readq(priv->base + MLXBF_GIGE_CONTROL); -+ control |= MLXBF_GIGE_CONTROL_PORT_EN; -+ writeq(control, priv->base + MLXBF_GIGE_CONTROL); -+ - err = mlxbf_gige_request_irqs(priv); - if (err) - return err; -@@ -365,7 +371,6 @@ static int mlxbf_gige_probe(struct platform_device *pdev) - void __iomem *plu_base; - void __iomem *base; - int addr, phy_irq; -- u64 control; - int err; - - base = devm_platform_ioremap_resource(pdev, MLXBF_GIGE_RES_MAC); -@@ -380,11 +385,6 @@ static int mlxbf_gige_probe(struct platform_device *pdev) - if (IS_ERR(plu_base)) - return PTR_ERR(plu_base); - -- /* Perform general init of GigE block */ -- control = readq(base + MLXBF_GIGE_CONTROL); -- control |= MLXBF_GIGE_CONTROL_PORT_EN; -- writeq(control, base + MLXBF_GIGE_CONTROL); -- - netdev = devm_alloc_etherdev(&pdev->dev, sizeof(*priv)); - if (!netdev) - return -ENOMEM; --- -2.43.2 - -From b76ab198ed03803e687981ed07a1a2e6f5107620 Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Fri, 5 Jan 2024 17:05:41 +0000 -Subject: [PATCH 0268/1501] rxrpc: Fix skbuff cleanup of call's recvmsg_queue - and rx_oos_queue -Content-Length: 1382 -Lines: 40 - -[ Upstream commit 4fc68c4c1a114ba597b4f3b082f04622dfa0e0f6 ] - -Fix rxrpc_cleanup_ring() to use rxrpc_purge_queue() rather than -skb_queue_purge() so that the count of outstanding skbuffs is correctly -updated when a failed call is cleaned up. - -Without this rmmod may hang waiting for rxrpc_n_rx_skbs to become zero. - -Fixes: 5d7edbc9231e ("rxrpc: Get rid of the Rx ring") -Reported-by: Marc Dionne <marc.dionne@auristor.com> -Signed-off-by: David Howells <dhowells@redhat.com> -cc: "David S. Miller" <davem@davemloft.net> -cc: Eric Dumazet <edumazet@google.com> -cc: Jakub Kicinski <kuba@kernel.org> -cc: Paolo Abeni <pabeni@redhat.com> -cc: linux-afs@lists.infradead.org -cc: netdev@vger.kernel.org -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/rxrpc/call_object.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c -index 773eecd1e979..f10b37c14772 100644 ---- a/net/rxrpc/call_object.c -+++ b/net/rxrpc/call_object.c -@@ -545,8 +545,8 @@ void rxrpc_get_call(struct rxrpc_call *call, enum rxrpc_call_trace why) - */ - static void rxrpc_cleanup_ring(struct rxrpc_call *call) - { -- skb_queue_purge(&call->recvmsg_queue); -- skb_queue_purge(&call->rx_oos_queue); -+ rxrpc_purge_queue(&call->recvmsg_queue); -+ rxrpc_purge_queue(&call->rx_oos_queue); - } - - /* --- -2.43.2 - -From ba8d904c274268b18ef3dc11d3ca7b24a96cb087 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Fri, 5 Jan 2024 17:03:13 +0000 -Subject: [PATCH 0269/1501] ip6_tunnel: fix NEXTHDR_FRAGMENT handling in - ip6_tnl_parse_tlv_enc_lim() -Content-Length: 6594 -Lines: 165 - -[ Upstream commit d375b98e0248980681e5e56b712026174d617198 ] - -syzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken. - -Reading frag_off can only be done if we pulled enough bytes -to skb->head. Currently we might access garbage. - -[1] -BUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 -ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 -ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline] -ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432 -__netdev_start_xmit include/linux/netdevice.h:4940 [inline] -netdev_start_xmit include/linux/netdevice.h:4954 [inline] -xmit_one net/core/dev.c:3548 [inline] -dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 -__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 -dev_queue_xmit include/linux/netdevice.h:3134 [inline] -neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592 -neigh_output include/net/neighbour.h:542 [inline] -ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137 -ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222 -NF_HOOK_COND include/linux/netfilter.h:303 [inline] -ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243 -dst_output include/net/dst.h:451 [inline] -ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155 -ip6_send_skb net/ipv6/ip6_output.c:1952 [inline] -ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972 -rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582 -rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 -inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847 -sock_sendmsg_nosec net/socket.c:730 [inline] -__sock_sendmsg net/socket.c:745 [inline] -____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 -___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 -__sys_sendmsg net/socket.c:2667 [inline] -__do_sys_sendmsg net/socket.c:2676 [inline] -__se_sys_sendmsg net/socket.c:2674 [inline] -__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 -do_syscall_x64 arch/x86/entry/common.c:52 [inline] -do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 -entry_SYSCALL_64_after_hwframe+0x63/0x6b - -Uninit was created at: -slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 -slab_alloc_node mm/slub.c:3478 [inline] -__kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517 -__do_kmalloc_node mm/slab_common.c:1006 [inline] -__kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1027 -kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582 -pskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098 -__pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655 -pskb_may_pull_reason include/linux/skbuff.h:2673 [inline] -pskb_may_pull include/linux/skbuff.h:2681 [inline] -ip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408 -ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline] -ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432 -__netdev_start_xmit include/linux/netdevice.h:4940 [inline] -netdev_start_xmit include/linux/netdevice.h:4954 [inline] -xmit_one net/core/dev.c:3548 [inline] -dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 -__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 -dev_queue_xmit include/linux/netdevice.h:3134 [inline] -neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592 -neigh_output include/net/neighbour.h:542 [inline] -ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137 -ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222 -NF_HOOK_COND include/linux/netfilter.h:303 [inline] -ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243 -dst_output include/net/dst.h:451 [inline] -ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155 -ip6_send_skb net/ipv6/ip6_output.c:1952 [inline] -ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972 -rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582 -rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 -inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847 -sock_sendmsg_nosec net/socket.c:730 [inline] -__sock_sendmsg net/socket.c:745 [inline] -____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 -___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 -__sys_sendmsg net/socket.c:2667 [inline] -__do_sys_sendmsg net/socket.c:2676 [inline] -__se_sys_sendmsg net/socket.c:2674 [inline] -__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 -do_syscall_x64 arch/x86/entry/common.c:52 [inline] -do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 -entry_SYSCALL_64_after_hwframe+0x63/0x6b - -CPU: 0 PID: 7345 Comm: syz-executor.3 Not tainted 6.7.0-rc8-syzkaller-00024-gac865f00af29 #0 -Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 - -Fixes: fbfa743a9d2a ("ipv6: fix ip6_tnl_parse_tlv_enc_lim()") -Reported-by: syzbot <syzkaller@googlegroups.com> -Signed-off-by: Eric Dumazet <edumazet@google.com> -Cc: Willem de Bruijn <willemb@google.com> -Reviewed-by: Willem de Bruijn <willemb@google.com> -Reviewed-by: David Ahern <dsahern@kernel.org> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/ipv6/ip6_tunnel.c | 26 +++++++++++++------------- - 1 file changed, 13 insertions(+), 13 deletions(-) - -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index 5e80e517f071..46c19bd48990 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -399,7 +399,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) - const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw; - unsigned int nhoff = raw - skb->data; - unsigned int off = nhoff + sizeof(*ipv6h); -- u8 next, nexthdr = ipv6h->nexthdr; -+ u8 nexthdr = ipv6h->nexthdr; - - while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) { - struct ipv6_opt_hdr *hdr; -@@ -410,26 +410,26 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) - - hdr = (struct ipv6_opt_hdr *)(skb->data + off); - if (nexthdr == NEXTHDR_FRAGMENT) { -- struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr; -- if (frag_hdr->frag_off) -- break; - optlen = 8; - } else if (nexthdr == NEXTHDR_AUTH) { - optlen = ipv6_authlen(hdr); - } else { - optlen = ipv6_optlen(hdr); - } -- /* cache hdr->nexthdr, since pskb_may_pull() might -- * invalidate hdr -- */ -- next = hdr->nexthdr; -+ -+ if (!pskb_may_pull(skb, off + optlen)) -+ break; -+ -+ hdr = (struct ipv6_opt_hdr *)(skb->data + off); -+ if (nexthdr == NEXTHDR_FRAGMENT) { -+ struct frag_hdr *frag_hdr = (struct frag_hdr *)hdr; -+ -+ if (frag_hdr->frag_off) -+ break; -+ } - if (nexthdr == NEXTHDR_DEST) { - u16 i = 2; - -- /* Remember : hdr is no longer valid at this point. */ -- if (!pskb_may_pull(skb, off + optlen)) -- break; -- - while (1) { - struct ipv6_tlv_tnl_enc_lim *tel; - -@@ -449,7 +449,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) - i++; - } - } -- nexthdr = next; -+ nexthdr = hdr->nexthdr; - off += optlen; - } - return 0; --- -2.43.2 - -From 7854a85a9bf5d6195fae23f33a2e791c43f7ddc5 Mon Sep 17 00:00:00 2001 -From: Arnd Bergmann <arnd@arndb.de> -Date: Mon, 8 Jan 2024 12:00:36 +0100 -Subject: [PATCH 0270/1501] ARM: davinci: always select CONFIG_CPU_ARM926T -Content-Length: 1089 -Lines: 31 - -[ Upstream commit 40974ee421b4d1fc74ac733d86899ce1b83d8f65 ] - -The select was lost by accident during the multiplatform conversion. -Any davinci-only - -arm-linux-gnueabi-ld: arch/arm/mach-davinci/sleep.o: in function `CACHE_FLUSH': -(.text+0x168): undefined reference to `arm926_flush_kern_cache_all' - -Fixes: f962396ce292 ("ARM: davinci: support multiplatform build for ARM v5") -Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> -Link: https://lore.kernel.org/r/20240108110055.1531153-1-arnd@kernel.org -Signed-off-by: Arnd Bergmann <arnd@arndb.de> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/arm/mach-davinci/Kconfig | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/arch/arm/mach-davinci/Kconfig b/arch/arm/mach-davinci/Kconfig -index 4316e1370627..59de137c6f53 100644 ---- a/arch/arm/mach-davinci/Kconfig -+++ b/arch/arm/mach-davinci/Kconfig -@@ -4,6 +4,7 @@ menuconfig ARCH_DAVINCI - bool "TI DaVinci" - depends on ARCH_MULTI_V5 - depends on CPU_LITTLE_ENDIAN -+ select CPU_ARM926T - select DAVINCI_TIMER - select ZONE_DMA - select PM_GENERIC_DOMAINS if PM --- -2.43.2 - -From f30bed074544f13a038fdaf51274899c0ac8d9ae Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Wed, 20 Sep 2023 15:57:16 +0300 -Subject: [PATCH 0271/1501] Revert "drm/tidss: Annotate dma-fence critical - section in commit path" -Content-Length: 6159 -Lines: 167 - -[ Upstream commit ca34d816558c3e4c3f8fe037b5a6b16c944693de ] - -This reverts commit 4d56a4f08391857ba93465de489707b66adad114. - -The DMA-fence annotations cause a lockdep warning (see below). As per -https://patchwork.freedesktop.org/patch/462170/ it sounds like the -annotations don't work correctly. - -====================================================== -WARNING: possible circular locking dependency detected -6.6.0-rc2+ #1 Not tainted ------------------------------------------------------- -kmstest/733 is trying to acquire lock: -ffff8000819377f0 (fs_reclaim){+.+.}-{0:0}, at: __kmem_cache_alloc_node+0x58/0x2d4 - -but task is already holding lock: -ffff800081a06aa0 (dma_fence_map){++++}-{0:0}, at: tidss_atomic_commit_tail+0x20/0xc0 [tidss] - -which lock already depends on the new lock. - -the existing dependency chain (in reverse order) is: - --> #2 (dma_fence_map){++++}-{0:0}: - __dma_fence_might_wait+0x5c/0xd0 - dma_resv_lockdep+0x1a4/0x32c - do_one_initcall+0x84/0x2fc - kernel_init_freeable+0x28c/0x4c4 - kernel_init+0x24/0x1dc - ret_from_fork+0x10/0x20 - --> #1 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}: - fs_reclaim_acquire+0x70/0xe4 - __kmem_cache_alloc_node+0x58/0x2d4 - kmalloc_trace+0x38/0x78 - __kthread_create_worker+0x3c/0x150 - kthread_create_worker+0x64/0x8c - workqueue_init+0x1e8/0x2f0 - kernel_init_freeable+0x11c/0x4c4 - kernel_init+0x24/0x1dc - ret_from_fork+0x10/0x20 - --> #0 (fs_reclaim){+.+.}-{0:0}: - __lock_acquire+0x1370/0x20d8 - lock_acquire+0x1e8/0x308 - fs_reclaim_acquire+0xd0/0xe4 - __kmem_cache_alloc_node+0x58/0x2d4 - __kmalloc_node_track_caller+0x58/0xf0 - kmemdup+0x34/0x60 - regmap_bulk_write+0x64/0x2c0 - tc358768_bridge_pre_enable+0x8c/0x12d0 [tc358768] - drm_atomic_bridge_call_pre_enable+0x68/0x80 [drm] - drm_atomic_bridge_chain_pre_enable+0x50/0x158 [drm] - drm_atomic_helper_commit_modeset_enables+0x164/0x264 [drm_kms_helper] - tidss_atomic_commit_tail+0x58/0xc0 [tidss] - commit_tail+0xa0/0x188 [drm_kms_helper] - drm_atomic_helper_commit+0x1a8/0x1c0 [drm_kms_helper] - drm_atomic_commit+0xa8/0xe0 [drm] - drm_mode_atomic_ioctl+0x9ec/0xc80 [drm] - drm_ioctl_kernel+0xc4/0x170 [drm] - drm_ioctl+0x234/0x4b0 [drm] - drm_compat_ioctl+0x110/0x12c [drm] - __arm64_compat_sys_ioctl+0x128/0x150 - invoke_syscall+0x48/0x110 - el0_svc_common.constprop.0+0x40/0xe0 - do_el0_svc_compat+0x1c/0x38 - el0_svc_compat+0x48/0xb4 - el0t_32_sync_handler+0xb0/0x138 - el0t_32_sync+0x194/0x198 - -other info that might help us debug this: - -Chain exists of: - fs_reclaim --> mmu_notifier_invalidate_range_start --> dma_fence_map - - Possible unsafe locking scenario: - - CPU0 CPU1 - ---- ---- - rlock(dma_fence_map); - lock(mmu_notifier_invalidate_range_start); - lock(dma_fence_map); - lock(fs_reclaim); - - *** DEADLOCK *** - -3 locks held by kmstest/733: - #0: ffff800082e5bba0 (crtc_ww_class_acquire){+.+.}-{0:0}, at: drm_mode_atomic_ioctl+0x118/0xc80 [drm] - #1: ffff000004224c88 (crtc_ww_class_mutex){+.+.}-{3:3}, at: modeset_lock+0xdc/0x1a0 [drm] - #2: ffff800081a06aa0 (dma_fence_map){++++}-{0:0}, at: tidss_atomic_commit_tail+0x20/0xc0 [tidss] - -stack backtrace: -CPU: 0 PID: 733 Comm: kmstest Not tainted 6.6.0-rc2+ #1 -Hardware name: Toradex Verdin AM62 on Verdin Development Board (DT) -Call trace: - dump_backtrace+0x98/0x118 - show_stack+0x18/0x24 - dump_stack_lvl+0x60/0xac - dump_stack+0x18/0x24 - print_circular_bug+0x288/0x368 - check_noncircular+0x168/0x17c - __lock_acquire+0x1370/0x20d8 - lock_acquire+0x1e8/0x308 - fs_reclaim_acquire+0xd0/0xe4 - __kmem_cache_alloc_node+0x58/0x2d4 - __kmalloc_node_track_caller+0x58/0xf0 - kmemdup+0x34/0x60 - regmap_bulk_write+0x64/0x2c0 - tc358768_bridge_pre_enable+0x8c/0x12d0 [tc358768] - drm_atomic_bridge_call_pre_enable+0x68/0x80 [drm] - drm_atomic_bridge_chain_pre_enable+0x50/0x158 [drm] - drm_atomic_helper_commit_modeset_enables+0x164/0x264 [drm_kms_helper] - tidss_atomic_commit_tail+0x58/0xc0 [tidss] - commit_tail+0xa0/0x188 [drm_kms_helper] - drm_atomic_helper_commit+0x1a8/0x1c0 [drm_kms_helper] - drm_atomic_commit+0xa8/0xe0 [drm] - drm_mode_atomic_ioctl+0x9ec/0xc80 [drm] - drm_ioctl_kernel+0xc4/0x170 [drm] - drm_ioctl+0x234/0x4b0 [drm] - drm_compat_ioctl+0x110/0x12c [drm] - __arm64_compat_sys_ioctl+0x128/0x150 - invoke_syscall+0x48/0x110 - el0_svc_common.constprop.0+0x40/0xe0 - do_el0_svc_compat+0x1c/0x38 - el0_svc_compat+0x48/0xb4 - el0t_32_sync_handler+0xb0/0x138 - el0t_32_sync+0x194/0x198 - -Fixes: 4d56a4f08391 ("drm/tidss: Annotate dma-fence critical section in commit path") -Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com> -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20230920-dma-fence-annotation-revert-v1-1-7ebf6f7f5bf6@ideasonboard.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/tidss/tidss_kms.c | 4 ---- - 1 file changed, 4 deletions(-) - -diff --git a/drivers/gpu/drm/tidss/tidss_kms.c b/drivers/gpu/drm/tidss/tidss_kms.c -index c979ad1af236..d096d8d2bc8f 100644 ---- a/drivers/gpu/drm/tidss/tidss_kms.c -+++ b/drivers/gpu/drm/tidss/tidss_kms.c -@@ -4,8 +4,6 @@ - * Author: Tomi Valkeinen <tomi.valkeinen@ti.com> - */ - --#include <linux/dma-fence.h> -- - #include <drm/drm_atomic.h> - #include <drm/drm_atomic_helper.h> - #include <drm/drm_bridge.h> -@@ -25,7 +23,6 @@ static void tidss_atomic_commit_tail(struct drm_atomic_state *old_state) - { - struct drm_device *ddev = old_state->dev; - struct tidss_device *tidss = to_tidss(ddev); -- bool fence_cookie = dma_fence_begin_signalling(); - - dev_dbg(ddev->dev, "%s\n", __func__); - -@@ -36,7 +33,6 @@ static void tidss_atomic_commit_tail(struct drm_atomic_state *old_state) - drm_atomic_helper_commit_modeset_enables(ddev, old_state); - - drm_atomic_helper_commit_hw_done(old_state); -- dma_fence_end_signalling(fence_cookie); - drm_atomic_helper_wait_for_flip_done(ddev, old_state); - - drm_atomic_helper_cleanup_planes(ddev, old_state); --- -2.43.2 - -From a7751389c9c75227a6a0b2ff90c38bfbf626dcd1 Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Wed, 20 Sep 2023 15:57:17 +0300 -Subject: [PATCH 0272/1501] Revert "drm/omapdrm: Annotate dma-fence critical - section in commit path" -Content-Length: 6924 -Lines: 183 - -[ Upstream commit 9d7c8c066916f231ca0ed4e4fce6c4b58ca3e451 ] - -This reverts commit 250aa22920cd5d956a5d3e9c6a43d671c2bae217. - -The DMA-fence annotations cause a lockdep warning (see below). As per -https://patchwork.freedesktop.org/patch/462170/ it sounds like the -annotations don't work correctly. - -====================================================== -WARNING: possible circular locking dependency detected -6.5.0-rc2+ #2 Not tainted ------------------------------------------------------- -kmstest/219 is trying to acquire lock: -c4705838 (&hdmi->lock){+.+.}-{3:3}, at: hdmi5_bridge_mode_set+0x1c/0x50 - -but task is already holding lock: -c11e1128 (dma_fence_map){++++}-{0:0}, at: omap_atomic_commit_tail+0x14/0xbc - -which lock already depends on the new lock. - -the existing dependency chain (in reverse order) is: - --> #2 (dma_fence_map){++++}-{0:0}: - __dma_fence_might_wait+0x48/0xb4 - dma_resv_lockdep+0x1b8/0x2bc - do_one_initcall+0x68/0x3b0 - kernel_init_freeable+0x260/0x34c - kernel_init+0x14/0x140 - ret_from_fork+0x14/0x28 - --> #1 (fs_reclaim){+.+.}-{0:0}: - fs_reclaim_acquire+0x70/0xa8 - __kmem_cache_alloc_node+0x3c/0x368 - kmalloc_trace+0x28/0x58 - _drm_do_get_edid+0x7c/0x35c - hdmi5_bridge_get_edid+0xc8/0x1ac - drm_bridge_connector_get_modes+0x64/0xc0 - drm_helper_probe_single_connector_modes+0x170/0x528 - drm_client_modeset_probe+0x208/0x1334 - __drm_fb_helper_initial_config_and_unlock+0x30/0x548 - omap_fbdev_client_hotplug+0x3c/0x6c - drm_client_register+0x58/0x94 - pdev_probe+0x544/0x6b0 - platform_probe+0x58/0xbc - really_probe+0xd8/0x3fc - __driver_probe_device+0x94/0x1f4 - driver_probe_device+0x2c/0xc4 - __device_attach_driver+0xa4/0x11c - bus_for_each_drv+0x84/0xdc - __device_attach+0xac/0x20c - bus_probe_device+0x8c/0x90 - device_add+0x588/0x7e0 - platform_device_add+0x110/0x24c - platform_device_register_full+0x108/0x15c - dss_bind+0x90/0xc0 - try_to_bring_up_aggregate_device+0x1e0/0x2c8 - __component_add+0xa4/0x174 - hdmi5_probe+0x1c8/0x270 - platform_probe+0x58/0xbc - really_probe+0xd8/0x3fc - __driver_probe_device+0x94/0x1f4 - driver_probe_device+0x2c/0xc4 - __device_attach_driver+0xa4/0x11c - bus_for_each_drv+0x84/0xdc - __device_attach+0xac/0x20c - bus_probe_device+0x8c/0x90 - deferred_probe_work_func+0x8c/0xd8 - process_one_work+0x2ac/0x6e4 - worker_thread+0x30/0x4ec - kthread+0x100/0x124 - ret_from_fork+0x14/0x28 - --> #0 (&hdmi->lock){+.+.}-{3:3}: - __lock_acquire+0x145c/0x29cc - lock_acquire.part.0+0xb4/0x258 - __mutex_lock+0x90/0x950 - mutex_lock_nested+0x1c/0x24 - hdmi5_bridge_mode_set+0x1c/0x50 - drm_bridge_chain_mode_set+0x48/0x5c - crtc_set_mode+0x188/0x1d0 - omap_atomic_commit_tail+0x2c/0xbc - commit_tail+0x9c/0x188 - drm_atomic_helper_commit+0x158/0x18c - drm_atomic_commit+0xa4/0xe8 - drm_mode_atomic_ioctl+0x9a4/0xc38 - drm_ioctl+0x210/0x4a8 - sys_ioctl+0x138/0xf00 - ret_fast_syscall+0x0/0x1c - -other info that might help us debug this: - -Chain exists of: - &hdmi->lock --> fs_reclaim --> dma_fence_map - - Possible unsafe locking scenario: - - CPU0 CPU1 - ---- ---- - rlock(dma_fence_map); - lock(fs_reclaim); - lock(dma_fence_map); - lock(&hdmi->lock); - - *** DEADLOCK *** - -3 locks held by kmstest/219: - #0: f1011de4 (crtc_ww_class_acquire){+.+.}-{0:0}, at: drm_mode_atomic_ioctl+0xf0/0xc38 - #1: c47059c8 (crtc_ww_class_mutex){+.+.}-{3:3}, at: modeset_lock+0xf8/0x230 - #2: c11e1128 (dma_fence_map){++++}-{0:0}, at: omap_atomic_commit_tail+0x14/0xbc - -stack backtrace: -CPU: 1 PID: 219 Comm: kmstest Not tainted 6.5.0-rc2+ #2 -Hardware name: Generic DRA74X (Flattened Device Tree) - unwind_backtrace from show_stack+0x10/0x14 - show_stack from dump_stack_lvl+0x58/0x70 - dump_stack_lvl from check_noncircular+0x164/0x198 - check_noncircular from __lock_acquire+0x145c/0x29cc - __lock_acquire from lock_acquire.part.0+0xb4/0x258 - lock_acquire.part.0 from __mutex_lock+0x90/0x950 - __mutex_lock from mutex_lock_nested+0x1c/0x24 - mutex_lock_nested from hdmi5_bridge_mode_set+0x1c/0x50 - hdmi5_bridge_mode_set from drm_bridge_chain_mode_set+0x48/0x5c - drm_bridge_chain_mode_set from crtc_set_mode+0x188/0x1d0 - crtc_set_mode from omap_atomic_commit_tail+0x2c/0xbc - omap_atomic_commit_tail from commit_tail+0x9c/0x188 - commit_tail from drm_atomic_helper_commit+0x158/0x18c - drm_atomic_helper_commit from drm_atomic_commit+0xa4/0xe8 - drm_atomic_commit from drm_mode_atomic_ioctl+0x9a4/0xc38 - drm_mode_atomic_ioctl from drm_ioctl+0x210/0x4a8 - drm_ioctl from sys_ioctl+0x138/0xf00 - sys_ioctl from ret_fast_syscall+0x0/0x1c -Exception stack(0xf1011fa8 to 0xf1011ff0) -1fa0: 00466d58 be9ab510 00000003 c03864bc be9ab510 be9ab4e0 -1fc0: 00466d58 be9ab510 c03864bc 00000036 00466ef0 00466fc0 00467020 00466f20 -1fe0: b6bc7ef4 be9ab4d0 b6bbbb00 b6cb2cc0 - -Fixes: 250aa22920cd ("drm/omapdrm: Annotate dma-fence critical section in commit path") -Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com> -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20230920-dma-fence-annotation-revert-v1-2-7ebf6f7f5bf6@ideasonboard.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/omapdrm/omap_drv.c | 9 ++++----- - 1 file changed, 4 insertions(+), 5 deletions(-) - -diff --git a/drivers/gpu/drm/omapdrm/omap_drv.c b/drivers/gpu/drm/omapdrm/omap_drv.c -index b2835b3ea6f5..6598c9c08ba1 100644 ---- a/drivers/gpu/drm/omapdrm/omap_drv.c -+++ b/drivers/gpu/drm/omapdrm/omap_drv.c -@@ -69,7 +69,6 @@ static void omap_atomic_commit_tail(struct drm_atomic_state *old_state) - { - struct drm_device *dev = old_state->dev; - struct omap_drm_private *priv = dev->dev_private; -- bool fence_cookie = dma_fence_begin_signalling(); - - dispc_runtime_get(priv->dispc); - -@@ -92,6 +91,8 @@ static void omap_atomic_commit_tail(struct drm_atomic_state *old_state) - omap_atomic_wait_for_completion(dev, old_state); - - drm_atomic_helper_commit_planes(dev, old_state, 0); -+ -+ drm_atomic_helper_commit_hw_done(old_state); - } else { - /* - * OMAP3 DSS seems to have issues with the work-around above, -@@ -101,12 +102,10 @@ static void omap_atomic_commit_tail(struct drm_atomic_state *old_state) - drm_atomic_helper_commit_planes(dev, old_state, 0); - - drm_atomic_helper_commit_modeset_enables(dev, old_state); -+ -+ drm_atomic_helper_commit_hw_done(old_state); - } - -- drm_atomic_helper_commit_hw_done(old_state); -- -- dma_fence_end_signalling(fence_cookie); -- - /* - * Wait for completion of the page flips to ensure that old buffers - * can't be touched by the hardware anymore before cleaning up planes. --- -2.43.2 - -From d49d90007a01d3b3dcea71e730eaab0aebb6f6a8 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jouni=20H=C3=B6gander?= <jouni.hogander@intel.com> -Date: Thu, 12 Oct 2023 10:21:57 +0300 -Subject: [PATCH 0273/1501] drm/i915/display: Move releasing gem object away - from fb tracking -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1926 -Lines: 43 - -[ Upstream commit 501069dad5214fafe1b8ba38fa26a5d07df784c3 ] - -As a preparation for Xe we want to remove all i915_gem_object details away -from frontbuffer tacking code. Due to this move releasing gem object -reference to i915_gem_object_set_frontbuffer. - -Signed-off-by: Jouni Högander <jouni.hogander@intel.com> -Reviewed-by: Juha-Pekka Heikkila <juhapekka.heikkila@gmail.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20231012072158.4115795-2-jouni.hogander@intel.com -Stable-dep-of: 560ea72c76eb ("drm/i915/dp_mst: Fix race between connector registration and setup") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/i915/display/intel_frontbuffer.c | 2 -- - drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h | 1 + - 2 files changed, 1 insertion(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/i915/display/intel_frontbuffer.c b/drivers/gpu/drm/i915/display/intel_frontbuffer.c -index ec46716b2f49..2ea37c0414a9 100644 ---- a/drivers/gpu/drm/i915/display/intel_frontbuffer.c -+++ b/drivers/gpu/drm/i915/display/intel_frontbuffer.c -@@ -265,8 +265,6 @@ static void frontbuffer_release(struct kref *ref) - spin_unlock(&intel_bo_to_i915(obj)->display.fb_tracking.lock); - - i915_active_fini(&front->write); -- -- i915_gem_object_put(obj); - kfree_rcu(front, rcu); - } - -diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h b/drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h -index e5e870b6f186..9fbf14867a2a 100644 ---- a/drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h -+++ b/drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h -@@ -89,6 +89,7 @@ i915_gem_object_set_frontbuffer(struct drm_i915_gem_object *obj, - - if (!front) { - RCU_INIT_POINTER(obj->frontbuffer, NULL); -+ drm_gem_object_put(intel_bo_to_drm_bo(obj)); - } else if (rcu_access_pointer(obj->frontbuffer)) { - cur = rcu_dereference_protected(obj->frontbuffer, true); - kref_get(&cur->ref); --- -2.43.2 - -From 4a14c2893dced8ed13e83839e53fd873b1ae465d Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com> -Date: Tue, 24 Oct 2023 04:08:57 +0300 -Subject: [PATCH 0274/1501] drm/dp_mst: Fix fractional DSC bpp handling -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 8002 -Lines: 192 - -[ Upstream commit 7707dd6022593f3edd8e182e7935870cf326f874 ] - -The current code does '(bpp << 4) / 16' in the MST PBN -calculation, but that is just the same as 'bpp' so the -DSC codepath achieves absolutely nothing. Fix it up so that -the fractional part of the bpp value is actually used instead -of truncated away. 64*1006 has enough zero lsbs that we can -just shift that down in the dividend and thus still manage -to stick to a 32bit divisor. - -And while touching this, let's just make the whole thing more -straightforward by making the passed in bpp value .4 binary -fixed point always, instead of having to pass in different -things based on whether DSC is enabled or not. - -v2: -- Fix DSC kunit test cases. - -Cc: Manasi Navare <manasi.d.navare@intel.com> -Cc: Lyude Paul <lyude@redhat.com> -Cc: Harry Wentland <harry.wentland@amd.com> -Cc: David Francis <David.Francis@amd.com> -Cc: Mikita Lipski <mikita.lipski@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Fixes: dc48529fb14e ("drm/dp_mst: Add PBN calculation for DSC modes") -Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> -[Imre: Fix kunit test cases] -Acked-by: Maxime Ripard <mripard@kernel.org> -Reviewed-by: Lyude Paul <lyude@redhat.com> -Acked-by: Harry Wentland <harry.wentland@amd.com> -Signed-off-by: Imre Deak <imre.deak@intel.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20231030155843.2251023-3-imre.deak@intel.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- - .../display/amdgpu_dm/amdgpu_dm_mst_types.c | 2 +- - drivers/gpu/drm/display/drm_dp_mst_topology.c | 20 +++++-------------- - drivers/gpu/drm/i915/display/intel_dp_mst.c | 5 ++--- - drivers/gpu/drm/nouveau/dispnv50/disp.c | 3 +-- - .../gpu/drm/tests/drm_dp_mst_helper_test.c | 6 +++--- - include/drm/display/drm_dp_mst_helper.h | 2 +- - 7 files changed, 14 insertions(+), 26 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 4e82ee4d74ac..d8c967cee498 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -6928,7 +6928,7 @@ static int dm_encoder_helper_atomic_check(struct drm_encoder *encoder, - max_bpc); - bpp = convert_dc_color_depth_into_bpc(color_depth) * 3; - clock = adjusted_mode->clock; -- dm_new_connector_state->pbn = drm_dp_calc_pbn_mode(clock, bpp, false); -+ dm_new_connector_state->pbn = drm_dp_calc_pbn_mode(clock, bpp << 4); - } - - dm_new_connector_state->vcpi_slots = -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -index 11da0eebee6c..9b71643d8a89 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -@@ -1642,7 +1642,7 @@ enum dc_status dm_dp_mst_is_port_support_mode( - } else { - /* check if mode could be supported within full_pbn */ - bpp = convert_dc_color_depth_into_bpc(stream->timing.display_color_depth) * 3; -- pbn = drm_dp_calc_pbn_mode(stream->timing.pix_clk_100hz / 10, bpp, false); -+ pbn = drm_dp_calc_pbn_mode(stream->timing.pix_clk_100hz / 10, bpp << 4); - if (pbn > full_pbn) - return DC_FAIL_BANDWIDTH_VALIDATE; - } -diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c -index 0e0d0e76de06..772b00ebd57b 100644 ---- a/drivers/gpu/drm/display/drm_dp_mst_topology.c -+++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c -@@ -4718,13 +4718,12 @@ EXPORT_SYMBOL(drm_dp_check_act_status); - - /** - * drm_dp_calc_pbn_mode() - Calculate the PBN for a mode. -- * @clock: dot clock for the mode -- * @bpp: bpp for the mode. -- * @dsc: DSC mode. If true, bpp has units of 1/16 of a bit per pixel -+ * @clock: dot clock -+ * @bpp: bpp as .4 binary fixed point - * - * This uses the formula in the spec to calculate the PBN value for a mode. - */ --int drm_dp_calc_pbn_mode(int clock, int bpp, bool dsc) -+int drm_dp_calc_pbn_mode(int clock, int bpp) - { - /* - * margin 5300ppm + 300ppm ~ 0.6% as per spec, factor is 1.006 -@@ -4735,18 +4734,9 @@ int drm_dp_calc_pbn_mode(int clock, int bpp, bool dsc) - * peak_kbps *= (1006/1000) - * peak_kbps *= (64/54) - * peak_kbps *= 8 convert to bytes -- * -- * If the bpp is in units of 1/16, further divide by 16. Put this -- * factor in the numerator rather than the denominator to avoid -- * integer overflow - */ -- -- if (dsc) -- return DIV_ROUND_UP_ULL(mul_u32_u32(clock * (bpp / 16), 64 * 1006), -- 8 * 54 * 1000 * 1000); -- -- return DIV_ROUND_UP_ULL(mul_u32_u32(clock * bpp, 64 * 1006), -- 8 * 54 * 1000 * 1000); -+ return DIV_ROUND_UP_ULL(mul_u32_u32(clock * bpp, 64 * 1006 >> 4), -+ 1000 * 8 * 54 * 1000); - } - EXPORT_SYMBOL(drm_dp_calc_pbn_mode); - -diff --git a/drivers/gpu/drm/i915/display/intel_dp_mst.c b/drivers/gpu/drm/i915/display/intel_dp_mst.c -index aa1061262613..03ac2817664e 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp_mst.c -+++ b/drivers/gpu/drm/i915/display/intel_dp_mst.c -@@ -106,8 +106,7 @@ static int intel_dp_mst_find_vcpi_slots_for_bpp(struct intel_encoder *encoder, - continue; - - crtc_state->pbn = drm_dp_calc_pbn_mode(adjusted_mode->crtc_clock, -- dsc ? bpp << 4 : bpp, -- dsc); -+ bpp << 4); - - slots = drm_dp_atomic_find_time_slots(state, &intel_dp->mst_mgr, - connector->port, -@@ -979,7 +978,7 @@ intel_dp_mst_mode_valid_ctx(struct drm_connector *connector, - return ret; - - if (mode_rate > max_rate || mode->clock > max_dotclk || -- drm_dp_calc_pbn_mode(mode->clock, min_bpp, false) > port->full_pbn) { -+ drm_dp_calc_pbn_mode(mode->clock, min_bpp << 4) > port->full_pbn) { - *status = MODE_CLOCK_HIGH; - return 0; - } -diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c -index 118807e38422..d093549f6eb7 100644 ---- a/drivers/gpu/drm/nouveau/dispnv50/disp.c -+++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c -@@ -982,8 +982,7 @@ nv50_msto_atomic_check(struct drm_encoder *encoder, - const int clock = crtc_state->adjusted_mode.clock; - - asyh->or.bpc = connector->display_info.bpc; -- asyh->dp.pbn = drm_dp_calc_pbn_mode(clock, asyh->or.bpc * 3, -- false); -+ asyh->dp.pbn = drm_dp_calc_pbn_mode(clock, asyh->or.bpc * 3 << 4); - } - - mst_state = drm_atomic_get_mst_topology_state(state, &mstm->mgr); -diff --git a/drivers/gpu/drm/tests/drm_dp_mst_helper_test.c b/drivers/gpu/drm/tests/drm_dp_mst_helper_test.c -index 545beea33e8c..e3c818dfc0e6 100644 ---- a/drivers/gpu/drm/tests/drm_dp_mst_helper_test.c -+++ b/drivers/gpu/drm/tests/drm_dp_mst_helper_test.c -@@ -42,13 +42,13 @@ static const struct drm_dp_mst_calc_pbn_mode_test drm_dp_mst_calc_pbn_mode_cases - .clock = 332880, - .bpp = 24, - .dsc = true, -- .expected = 50 -+ .expected = 1191 - }, - { - .clock = 324540, - .bpp = 24, - .dsc = true, -- .expected = 49 -+ .expected = 1161 - }, - }; - -@@ -56,7 +56,7 @@ static void drm_test_dp_mst_calc_pbn_mode(struct kunit *test) - { - const struct drm_dp_mst_calc_pbn_mode_test *params = test->param_value; - -- KUNIT_EXPECT_EQ(test, drm_dp_calc_pbn_mode(params->clock, params->bpp, params->dsc), -+ KUNIT_EXPECT_EQ(test, drm_dp_calc_pbn_mode(params->clock, params->bpp << 4), - params->expected); - } - -diff --git a/include/drm/display/drm_dp_mst_helper.h b/include/drm/display/drm_dp_mst_helper.h -index 4429d3b1745b..655862b3d2a4 100644 ---- a/include/drm/display/drm_dp_mst_helper.h -+++ b/include/drm/display/drm_dp_mst_helper.h -@@ -842,7 +842,7 @@ struct edid *drm_dp_mst_get_edid(struct drm_connector *connector, - int drm_dp_get_vc_payload_bw(const struct drm_dp_mst_topology_mgr *mgr, - int link_rate, int link_lane_count); - --int drm_dp_calc_pbn_mode(int clock, int bpp, bool dsc); -+int drm_dp_calc_pbn_mode(int clock, int bpp); - - void drm_dp_mst_update_slots(struct drm_dp_mst_topology_state *mst_state, uint8_t link_encoding_cap); - --- -2.43.2 - -From 50ad3ec3e3c026eeb43c2940739b59ad3d13fe66 Mon Sep 17 00:00:00 2001 -From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> -Date: Thu, 2 Nov 2023 15:15:07 +0100 -Subject: [PATCH 0275/1501] drm/panfrost: Really power off GPU cores in - panfrost_gpu_power_off() -Content-Length: 4541 -Lines: 119 - -[ Upstream commit 22aa1a209018dc2eca78745f7666db63637cd5dc ] - -The layout of the registers {TILER,SHADER,L2}_PWROFF_LO, used to request -powering off cores, is the same as the {TILER,SHADER,L2}_PWRON_LO ones: -this means that in order to request poweroff of cores, we are supposed -to write a bitmask of cores that should be powered off! -This means that the panfrost_gpu_power_off() function has always been -doing nothing. - -Fix powering off the GPU by writing a bitmask of the cores to poweroff -to the relevant PWROFF_LO registers and then check that the transition -(from ON to OFF) has finished by polling the relevant PWRTRANS_LO -registers. - -While at it, in order to avoid code duplication, move the core mask -logic from panfrost_gpu_power_on() to a new panfrost_get_core_mask() -function, used in both poweron and poweroff. - -Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver") -Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> -Reviewed-by: Steven Price <steven.price@arm.com> -Signed-off-by: Steven Price <steven.price@arm.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20231102141507.73481-1-angelogioacchino.delregno@collabora.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/panfrost/panfrost_gpu.c | 64 ++++++++++++++++++------- - 1 file changed, 46 insertions(+), 18 deletions(-) - -diff --git a/drivers/gpu/drm/panfrost/panfrost_gpu.c b/drivers/gpu/drm/panfrost/panfrost_gpu.c -index f0be7e19b13e..97f097ee5c1d 100644 ---- a/drivers/gpu/drm/panfrost/panfrost_gpu.c -+++ b/drivers/gpu/drm/panfrost/panfrost_gpu.c -@@ -362,28 +362,38 @@ unsigned long long panfrost_cycle_counter_read(struct panfrost_device *pfdev) - return ((u64)hi << 32) | lo; - } - -+static u64 panfrost_get_core_mask(struct panfrost_device *pfdev) -+{ -+ u64 core_mask; -+ -+ if (pfdev->features.l2_present == 1) -+ return U64_MAX; -+ -+ /* -+ * Only support one core group now. -+ * ~(l2_present - 1) unsets all bits in l2_present except -+ * the bottom bit. (l2_present - 2) has all the bits in -+ * the first core group set. AND them together to generate -+ * a mask of cores in the first core group. -+ */ -+ core_mask = ~(pfdev->features.l2_present - 1) & -+ (pfdev->features.l2_present - 2); -+ dev_info_once(pfdev->dev, "using only 1st core group (%lu cores from %lu)\n", -+ hweight64(core_mask), -+ hweight64(pfdev->features.shader_present)); -+ -+ return core_mask; -+} -+ - void panfrost_gpu_power_on(struct panfrost_device *pfdev) - { - int ret; - u32 val; -- u64 core_mask = U64_MAX; -+ u64 core_mask; - - panfrost_gpu_init_quirks(pfdev); -+ core_mask = panfrost_get_core_mask(pfdev); - -- if (pfdev->features.l2_present != 1) { -- /* -- * Only support one core group now. -- * ~(l2_present - 1) unsets all bits in l2_present except -- * the bottom bit. (l2_present - 2) has all the bits in -- * the first core group set. AND them together to generate -- * a mask of cores in the first core group. -- */ -- core_mask = ~(pfdev->features.l2_present - 1) & -- (pfdev->features.l2_present - 2); -- dev_info_once(pfdev->dev, "using only 1st core group (%lu cores from %lu)\n", -- hweight64(core_mask), -- hweight64(pfdev->features.shader_present)); -- } - gpu_write(pfdev, L2_PWRON_LO, pfdev->features.l2_present & core_mask); - ret = readl_relaxed_poll_timeout(pfdev->iomem + L2_READY_LO, - val, val == (pfdev->features.l2_present & core_mask), -@@ -408,9 +418,27 @@ void panfrost_gpu_power_on(struct panfrost_device *pfdev) - - void panfrost_gpu_power_off(struct panfrost_device *pfdev) - { -- gpu_write(pfdev, TILER_PWROFF_LO, 0); -- gpu_write(pfdev, SHADER_PWROFF_LO, 0); -- gpu_write(pfdev, L2_PWROFF_LO, 0); -+ u64 core_mask = panfrost_get_core_mask(pfdev); -+ int ret; -+ u32 val; -+ -+ gpu_write(pfdev, SHADER_PWROFF_LO, pfdev->features.shader_present & core_mask); -+ ret = readl_relaxed_poll_timeout(pfdev->iomem + SHADER_PWRTRANS_LO, -+ val, !val, 1, 1000); -+ if (ret) -+ dev_err(pfdev->dev, "shader power transition timeout"); -+ -+ gpu_write(pfdev, TILER_PWROFF_LO, pfdev->features.tiler_present); -+ ret = readl_relaxed_poll_timeout(pfdev->iomem + TILER_PWRTRANS_LO, -+ val, !val, 1, 1000); -+ if (ret) -+ dev_err(pfdev->dev, "tiler power transition timeout"); -+ -+ gpu_write(pfdev, L2_PWROFF_LO, pfdev->features.l2_present & core_mask); -+ ret = readl_poll_timeout(pfdev->iomem + L2_PWRTRANS_LO, -+ val, !val, 0, 1000); -+ if (ret) -+ dev_err(pfdev->dev, "l2 power transition timeout"); - } - - int panfrost_gpu_init(struct panfrost_device *pfdev) --- -2.43.2 - -From a3b88926863353a32b5a2e655e35ed05983c56f7 Mon Sep 17 00:00:00 2001 -From: Leon Romanovsky <leonro@nvidia.com> -Date: Mon, 13 Nov 2023 11:28:02 +0200 -Subject: [PATCH 0276/1501] RDMA/usnic: Silence uninitialized symbol smatch - warnings -Content-Length: 2718 -Lines: 74 - -[ Upstream commit b9a85e5eec126d6ae6c362f94b447c223e8fe6e4 ] - -The patch 1da177e4c3f4: "Linux-2.6.12-rc2" from Apr 16, 2005 -(linux-next), leads to the following Smatch static checker warning: - - drivers/infiniband/hw/mthca/mthca_cmd.c:644 mthca_SYS_EN() - error: uninitialized symbol 'out'. - -drivers/infiniband/hw/mthca/mthca_cmd.c - 636 int mthca_SYS_EN(struct mthca_dev *dev) - 637 { - 638 u64 out; - 639 int ret; - 640 - 641 ret = mthca_cmd_imm(dev, 0, &out, 0, 0, CMD_SYS_EN, CMD_TIME_CLASS_D); - -We pass out here and it gets used without being initialized. - - err = mthca_cmd_post(dev, in_param, - out_param ? *out_param : 0, - ^^^^^^^^^^ - in_modifier, op_modifier, - op, context->token, 1); - -It's the same in mthca_cmd_wait() and mthca_cmd_poll(). - -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Reported-by: Dan Carpenter <dan.carpenter@linaro.org> -Closes: https://lore.kernel.org/all/533bc3df-8078-4397-b93d-d1f6cec9b636@moroto.mountain -Link: https://lore.kernel.org/r/c559cb7113158c02d75401ac162652072ef1b5f0.1699867650.git.leon@kernel.org -Signed-off-by: Leon Romanovsky <leonro@nvidia.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/infiniband/hw/mthca/mthca_cmd.c | 4 ++-- - drivers/infiniband/hw/mthca/mthca_main.c | 2 +- - 2 files changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c -index f330ce895d88..8fe0cef7e2be 100644 ---- a/drivers/infiniband/hw/mthca/mthca_cmd.c -+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c -@@ -635,7 +635,7 @@ void mthca_free_mailbox(struct mthca_dev *dev, struct mthca_mailbox *mailbox) - - int mthca_SYS_EN(struct mthca_dev *dev) - { -- u64 out; -+ u64 out = 0; - int ret; - - ret = mthca_cmd_imm(dev, 0, &out, 0, 0, CMD_SYS_EN, CMD_TIME_CLASS_D); -@@ -1955,7 +1955,7 @@ int mthca_WRITE_MGM(struct mthca_dev *dev, int index, - int mthca_MGID_HASH(struct mthca_dev *dev, struct mthca_mailbox *mailbox, - u16 *hash) - { -- u64 imm; -+ u64 imm = 0; - int err; - - err = mthca_cmd_imm(dev, mailbox->dma, &imm, 0, 0, CMD_MGID_HASH, -diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c -index b54bc8865dae..1ab268b77096 100644 ---- a/drivers/infiniband/hw/mthca/mthca_main.c -+++ b/drivers/infiniband/hw/mthca/mthca_main.c -@@ -382,7 +382,7 @@ static int mthca_init_icm(struct mthca_dev *mdev, - struct mthca_init_hca_param *init_hca, - u64 icm_size) - { -- u64 aux_pages; -+ u64 aux_pages = 0; - int err; - - err = mthca_SET_ICM_SIZE(mdev, icm_size, &aux_pages); --- -2.43.2 - -From 3a130131afa02d414c94a5d694763a6e8e7c1434 Mon Sep 17 00:00:00 2001 -From: Junxian Huang <huangjunxian6@hisilicon.com> -Date: Tue, 14 Nov 2023 20:34:47 +0800 -Subject: [PATCH 0277/1501] RDMA/hns: Fix inappropriate err code for - unsupported operations -Content-Length: 1736 -Lines: 44 - -[ Upstream commit f45b83ad39f8033e717b1eee57e81811113d5a84 ] - -EOPNOTSUPP is more situable than EINVAL for allocating XRCD while XRC -is not supported and unsupported resizing SRQ. - -Fixes: 32548870d438 ("RDMA/hns: Add support for XRC on HIP09") -Fixes: 221109e64316 ("RDMA/hns: Add interception for resizing SRQs") -Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com> -Link: https://lore.kernel.org/r/20231114123449.1106162-2-huangjunxian6@hisilicon.com -Signed-off-by: Leon Romanovsky <leon@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +- - drivers/infiniband/hw/hns/hns_roce_pd.c | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -index 2bca9560f32d..e4753c802942 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -@@ -5671,7 +5671,7 @@ static int hns_roce_v2_modify_srq(struct ib_srq *ibsrq, - - /* Resizing SRQs is not supported yet */ - if (srq_attr_mask & IB_SRQ_MAX_WR) -- return -EINVAL; -+ return -EOPNOTSUPP; - - if (srq_attr_mask & IB_SRQ_LIMIT) { - if (srq_attr->srq_limit > srq->wqe_cnt) -diff --git a/drivers/infiniband/hw/hns/hns_roce_pd.c b/drivers/infiniband/hw/hns/hns_roce_pd.c -index 783e71852c50..bd1fe89ca205 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_pd.c -+++ b/drivers/infiniband/hw/hns/hns_roce_pd.c -@@ -150,7 +150,7 @@ int hns_roce_alloc_xrcd(struct ib_xrcd *ib_xrcd, struct ib_udata *udata) - int ret; - - if (!(hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_XRC)) -- return -EINVAL; -+ return -EOPNOTSUPP; - - ret = hns_roce_xrcd_alloc(hr_dev, &xrcd->xrcdn); - if (ret) --- -2.43.2 - -From edeea58ab0eb60b6cf7dc2d43cb74fc8cc685cb2 Mon Sep 17 00:00:00 2001 -From: Chris Morgan <macromorgan@hotmail.com> -Date: Fri, 17 Nov 2023 14:25:32 -0600 -Subject: [PATCH 0278/1501] drm/panel: nv3051d: Hold panel in reset for - unprepare -Content-Length: 1207 -Lines: 31 - -[ Upstream commit 697ebc319b942403a6fee894607fd2cd47cca069 ] - -Improve the panel's ability to restore from suspend by holding the -panel in suspend after unprepare. - -Fixes: b1d39f0f4264 ("drm/panel: Add NewVision NV3051D MIPI-DSI LCD panel") -Signed-off-by: Chris Morgan <macromorgan@hotmail.com> -Reviewed-by: Jessica Zhang <quic_jesszhan@quicinc.com> -Link: https://lore.kernel.org/r/20231117202536.1387815-3-macroalpha82@gmail.com -Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20231117202536.1387815-3-macroalpha82@gmail.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/panel/panel-newvision-nv3051d.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/gpu/drm/panel/panel-newvision-nv3051d.c b/drivers/gpu/drm/panel/panel-newvision-nv3051d.c -index 79de6c886292..c44c6945662f 100644 ---- a/drivers/gpu/drm/panel/panel-newvision-nv3051d.c -+++ b/drivers/gpu/drm/panel/panel-newvision-nv3051d.c -@@ -261,6 +261,8 @@ static int panel_nv3051d_unprepare(struct drm_panel *panel) - - usleep_range(10000, 15000); - -+ gpiod_set_value_cansleep(ctx->reset_gpio, 1); -+ - regulator_disable(ctx->vdd); - - return 0; --- -2.43.2 - -From a446cc7eb175b96497987dee7a51f4d4e0c34b33 Mon Sep 17 00:00:00 2001 -From: Chris Morgan <macromorgan@hotmail.com> -Date: Fri, 17 Nov 2023 13:44:02 -0600 -Subject: [PATCH 0279/1501] drm/panel-elida-kd35t133: hold panel in reset for - unprepare -Content-Length: 1390 -Lines: 34 - -[ Upstream commit 03c5b2a5f6c39fe4e090346536cf1c14ee18b61e ] - -For devices like the Anbernic RG351M and RG351P the panel is wired to -an always on regulator. When the device suspends and wakes up, there -are some slight artifacts on the screen that go away over time. If -instead we hold the panel in reset status after it is unprepared, -this does not happen. - -Fixes: 5b6603360c12 ("drm/panel: add panel driver for Elida KD35T133 panels") -Signed-off-by: Chris Morgan <macromorgan@hotmail.com> -Reviewed-by: Jessica Zhang <quic_jesszhan@quicinc.com> -Link: https://lore.kernel.org/r/20231117194405.1386265-3-macroalpha82@gmail.com -Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20231117194405.1386265-3-macroalpha82@gmail.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/panel/panel-elida-kd35t133.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/gpu/drm/panel/panel-elida-kd35t133.c b/drivers/gpu/drm/panel/panel-elida-kd35t133.c -index e7be15b68102..6de117232346 100644 ---- a/drivers/gpu/drm/panel/panel-elida-kd35t133.c -+++ b/drivers/gpu/drm/panel/panel-elida-kd35t133.c -@@ -104,6 +104,8 @@ static int kd35t133_unprepare(struct drm_panel *panel) - return ret; - } - -+ gpiod_set_value_cansleep(ctx->reset_gpio, 1); -+ - regulator_disable(ctx->iovcc); - regulator_disable(ctx->vdd); - --- -2.43.2 - -From a417515e57e747bca7bb84812d996e81c1cf4fb3 Mon Sep 17 00:00:00 2001 -From: Abhinav Singh <singhabhinav9051571833@gmail.com> -Date: Tue, 14 Nov 2023 00:43:03 +0530 -Subject: [PATCH 0280/1501] drm/nouveau/fence:: fix warning directly - dereferencing a rcu pointer -Content-Length: 1886 -Lines: 50 - -[ Upstream commit 5f35a624c1e30b5bae5023b3c256e94e0ad4f806 ] - -Fix a sparse warning with this message -"warning:dereference of noderef expression". In this context it means we -are dereferencing a __rcu tagged pointer directly. - -We should not be directly dereferencing a rcu pointer. To get a normal -(non __rcu tagged pointer) from a __rcu tagged pointer we are using the -function unrcu_pointer(...). The non __rcu tagged pointer then can be -dereferenced just like a normal pointer. - -I tested with qemu with this command -qemu-system-x86_64 \ - -m 2G \ - -smp 2 \ - -kernel bzImage \ - -append "console=ttyS0 root=/dev/sda earlyprintk=serial net.ifnames=0" \ - -drive file=bullseye.img,format=raw \ - -net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10021-:22 \ - -net nic,model=e1000 \ - -enable-kvm \ - -nographic \ - -pidfile vm.pid \ - 2>&1 | tee vm.log -with lockdep enabled. - -Fixes: 0ec5f02f0e2c ("drm/nouveau: prevent stale fence->channel pointers, and protect with rcu") -Signed-off-by: Abhinav Singh <singhabhinav9051571833@gmail.com> -Signed-off-by: Danilo Krummrich <dakr@redhat.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20231113191303.3277733-1-singhabhinav9051571833@gmail.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/nouveau/nv04_fence.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/nouveau/nv04_fence.c b/drivers/gpu/drm/nouveau/nv04_fence.c -index 5b71a5a5cd85..cdbc75e3d1f6 100644 ---- a/drivers/gpu/drm/nouveau/nv04_fence.c -+++ b/drivers/gpu/drm/nouveau/nv04_fence.c -@@ -39,7 +39,7 @@ struct nv04_fence_priv { - static int - nv04_fence_emit(struct nouveau_fence *fence) - { -- struct nvif_push *push = fence->channel->chan.push; -+ struct nvif_push *push = unrcu_pointer(fence->channel)->chan.push; - int ret = PUSH_WAIT(push, 2); - if (ret == 0) { - PUSH_NVSQ(push, NV_SW, 0x0150, fence->base.seqno); --- -2.43.2 - -From e00ec5901954d85b39b5f10f94e60ab9af463eb1 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de> -Date: Thu, 2 Nov 2023 17:56:42 +0100 -Subject: [PATCH 0281/1501] drm/bridge: tpd12s015: Drop buggy __exit annotation - for remove function -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1565 -Lines: 40 - -[ Upstream commit ce3e112e7ae854249d8755906acc5f27e1542114 ] - -With tpd12s015_remove() marked with __exit this function is discarded -when the driver is compiled as a built-in. The result is that when the -driver unbinds there is no cleanup done which results in resource -leakage or worse. - -Fixes: cff5e6f7e83f ("drm/bridge: Add driver for the TI TPD12S015 HDMI level shifter") -Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> -Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> -Link: https://patchwork.freedesktop.org/patch/msgid/20231102165640.3307820-19-u.kleine-koenig@pengutronix.de -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/bridge/ti-tpd12s015.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/bridge/ti-tpd12s015.c b/drivers/gpu/drm/bridge/ti-tpd12s015.c -index e0e015243a60..b588fea12502 100644 ---- a/drivers/gpu/drm/bridge/ti-tpd12s015.c -+++ b/drivers/gpu/drm/bridge/ti-tpd12s015.c -@@ -179,7 +179,7 @@ static int tpd12s015_probe(struct platform_device *pdev) - return 0; - } - --static int __exit tpd12s015_remove(struct platform_device *pdev) -+static int tpd12s015_remove(struct platform_device *pdev) - { - struct tpd12s015_device *tpd = platform_get_drvdata(pdev); - -@@ -197,7 +197,7 @@ MODULE_DEVICE_TABLE(of, tpd12s015_of_match); - - static struct platform_driver tpd12s015_driver = { - .probe = tpd12s015_probe, -- .remove = __exit_p(tpd12s015_remove), -+ .remove = tpd12s015_remove, - .driver = { - .name = "tpd12s015", - .of_match_table = tpd12s015_of_match, --- -2.43.2 - -From a5918cdc0f390b10b4436faae854ec23c766f79b Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Tue, 19 Sep 2023 10:12:50 +0300 -Subject: [PATCH 0282/1501] drm/tilcdc: Fix irq free on unload -Content-Length: 1221 -Lines: 32 - -[ Upstream commit 38360bf96d816e175bc602c4ee76953cd303b71d ] - -The driver only frees the reserved irq if priv->irq_enabled is set to -true. However, the driver mistakenly sets priv->irq_enabled to false, -instead of true, in tilcdc_irq_install(), and thus the driver never -frees the irq, causing issues on loading the driver a second time. - -Fixes: b6366814fa77 ("drm/tilcdc: Convert to Linux IRQ interfaces") -Cc: Thomas Zimmermann <tzimmermann@suse.de> -Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com> -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20230919-lcdc-v1-1-ba60da7421e1@ideasonboard.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/tilcdc/tilcdc_drv.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c -index 8ebd7134ee21..2f6eaac7f659 100644 ---- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c -+++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c -@@ -138,7 +138,7 @@ static int tilcdc_irq_install(struct drm_device *dev, unsigned int irq) - if (ret) - return ret; - -- priv->irq_enabled = false; -+ priv->irq_enabled = true; - - return 0; - } --- -2.43.2 - -From 5cb6738ac7ade67a94335c98614febc388a7d8ce Mon Sep 17 00:00:00 2001 -From: Zheng Wang <zyytlz.wz@163.com> -Date: Mon, 6 Nov 2023 15:48:09 +0100 -Subject: [PATCH 0284/1501] media: mtk-jpeg: Remove cancel worker in - mtk_jpeg_remove to avoid the crash of multi-core JPEG devices -Content-Length: 1404 -Lines: 34 - -[ Upstream commit d8212c5c87c143ca01b78f6bf61244af07e0058e ] - -This patch reverts commit c677d7ae8314 -("media: mtk-jpeg: Fix use after free bug due to uncanceled work"). -The job_timeout_work is initialized only for -the single-core JPEG device so it will cause the crash for multi-core -JPEG devices. - -Fix it by removing the cancel_delayed_work_sync function. - -Fixes: c677d7ae8314 ("media: mtk-jpeg: Fix use after free bug due to uncanceled work") -Signed-off-by: Zheng Wang <zyytlz.wz@163.com> -Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c -index 7194f88edc0f..60425c99a2b8 100644 ---- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c -+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c -@@ -1403,7 +1403,6 @@ static void mtk_jpeg_remove(struct platform_device *pdev) - { - struct mtk_jpeg_dev *jpeg = platform_get_drvdata(pdev); - -- cancel_delayed_work_sync(&jpeg->job_timeout_work); - pm_runtime_disable(&pdev->dev); - video_unregister_device(jpeg->vdev); - v4l2_m2m_release(jpeg->m2m_dev); --- -2.43.2 - -From 7d9f301db6f1c5c369af10b47cb250251a10f397 Mon Sep 17 00:00:00 2001 -From: Paul Kocialkowski <paul.kocialkowski@bootlin.com> -Date: Thu, 9 Nov 2023 21:16:38 +0100 -Subject: [PATCH 0285/1501] media: visl: Hook the (TRY_)DECODER_CMD stateless - ioctls -Content-Length: 1411 -Lines: 34 - -[ Upstream commit 3907f6ef8e0d55a88cdb0f7238363d24e26790ca ] - -The (TRY_)DECODER_CMD ioctls are used to support flushing when holding -capture buffers is supported. This is the case of this driver but the -ioctls were never hooked to the ioctl ops. - -Add them to correctly support flushing. - -Fixes: 0c078e310b6d ("media: visl: add virtual stateless decoder driver") -Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> -Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/test-drivers/visl/visl-video.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/media/test-drivers/visl/visl-video.c b/drivers/media/test-drivers/visl/visl-video.c -index 7cac6a6456eb..9303a3e118d7 100644 ---- a/drivers/media/test-drivers/visl/visl-video.c -+++ b/drivers/media/test-drivers/visl/visl-video.c -@@ -525,6 +525,9 @@ const struct v4l2_ioctl_ops visl_ioctl_ops = { - .vidioc_streamon = v4l2_m2m_ioctl_streamon, - .vidioc_streamoff = v4l2_m2m_ioctl_streamoff, - -+ .vidioc_decoder_cmd = v4l2_m2m_ioctl_stateless_decoder_cmd, -+ .vidioc_try_decoder_cmd = v4l2_m2m_ioctl_stateless_try_decoder_cmd, -+ - .vidioc_subscribe_event = v4l2_ctrl_subscribe_event, - .vidioc_unsubscribe_event = v4l2_event_unsubscribe, - }; --- -2.43.2 - -From 642e2b75ccf634076e94863b570c07117726a078 Mon Sep 17 00:00:00 2001 -From: Paul Kocialkowski <paul.kocialkowski@bootlin.com> -Date: Thu, 9 Nov 2023 21:16:39 +0100 -Subject: [PATCH 0286/1501] media: verisilicon: Hook the (TRY_)DECODER_CMD - stateless ioctls -Content-Length: 2088 -Lines: 48 - -[ Upstream commit 6c0d9e12b1d12bbd95484e4b99f63feeb423765f ] - -The (TRY_)DECODER_CMD ioctls are used to support flushing when holding -capture buffers is supported. This is the case of this driver but the -ioctls were never hooked to the ioctl ops. - -Add them to correctly support flushing. - -Fixes: 340ce50f75a6 ("media: hantro: Enable HOLD_CAPTURE_BUF for H.264") -Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> -Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/platform/verisilicon/hantro_drv.c | 2 ++ - drivers/media/platform/verisilicon/hantro_v4l2.c | 3 +++ - 2 files changed, 5 insertions(+) - -diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c -index a9fa05ac56a9..3a2a0f28cbfe 100644 ---- a/drivers/media/platform/verisilicon/hantro_drv.c -+++ b/drivers/media/platform/verisilicon/hantro_drv.c -@@ -905,6 +905,8 @@ static int hantro_add_func(struct hantro_dev *vpu, unsigned int funcid) - - if (funcid == MEDIA_ENT_F_PROC_VIDEO_ENCODER) { - vpu->encoder = func; -+ v4l2_disable_ioctl(vfd, VIDIOC_TRY_DECODER_CMD); -+ v4l2_disable_ioctl(vfd, VIDIOC_DECODER_CMD); - } else { - vpu->decoder = func; - v4l2_disable_ioctl(vfd, VIDIOC_TRY_ENCODER_CMD); -diff --git a/drivers/media/platform/verisilicon/hantro_v4l2.c b/drivers/media/platform/verisilicon/hantro_v4l2.c -index b3ae037a50f6..db145519fc5d 100644 ---- a/drivers/media/platform/verisilicon/hantro_v4l2.c -+++ b/drivers/media/platform/verisilicon/hantro_v4l2.c -@@ -785,6 +785,9 @@ const struct v4l2_ioctl_ops hantro_ioctl_ops = { - .vidioc_g_selection = vidioc_g_selection, - .vidioc_s_selection = vidioc_s_selection, - -+ .vidioc_decoder_cmd = v4l2_m2m_ioctl_stateless_decoder_cmd, -+ .vidioc_try_decoder_cmd = v4l2_m2m_ioctl_stateless_try_decoder_cmd, -+ - .vidioc_try_encoder_cmd = v4l2_m2m_ioctl_try_encoder_cmd, - .vidioc_encoder_cmd = vidioc_encoder_cmd, - }; --- -2.43.2 - -From 30187e2fa4a3574b9bba6e745f0a8b63e101ba2e Mon Sep 17 00:00:00 2001 -From: Paul Kocialkowski <paul.kocialkowski@bootlin.com> -Date: Thu, 9 Nov 2023 21:16:40 +0100 -Subject: [PATCH 0287/1501] media: rkvdec: Hook the (TRY_)DECODER_CMD stateless - ioctls -Content-Length: 1357 -Lines: 34 - -[ Upstream commit 1fb7b5ab62113b29ce331464048d8c39e58fd08a ] - -The (TRY_)DECODER_CMD ioctls are used to support flushing when holding -capture buffers is supported. This is the case of this driver but the -ioctls were never hooked to the ioctl ops. - -Add them to correctly support flushing. - -Fixes: ed7bb87d3d03 ("media: rkvdec: Enable capture buffer holding for H264") -Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> -Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/staging/media/rkvdec/rkvdec.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c -index 84a41792cb4b..ac398b5a9736 100644 ---- a/drivers/staging/media/rkvdec/rkvdec.c -+++ b/drivers/staging/media/rkvdec/rkvdec.c -@@ -461,6 +461,9 @@ static const struct v4l2_ioctl_ops rkvdec_ioctl_ops = { - - .vidioc_streamon = v4l2_m2m_ioctl_streamon, - .vidioc_streamoff = v4l2_m2m_ioctl_streamoff, -+ -+ .vidioc_decoder_cmd = v4l2_m2m_ioctl_stateless_decoder_cmd, -+ .vidioc_try_decoder_cmd = v4l2_m2m_ioctl_stateless_try_decoder_cmd, - }; - - static int rkvdec_queue_setup(struct vb2_queue *vq, unsigned int *num_buffers, --- -2.43.2 - -From 06c70285056a4ef40dfdd35c6d376bfa4570a479 Mon Sep 17 00:00:00 2001 -From: Alexander Stein <alexander.stein@ew.tq-group.com> -Date: Tue, 7 Nov 2023 08:15:21 +0100 -Subject: [PATCH 0288/1501] media: amphion: Fix VPU core alias name -Content-Length: 1385 -Lines: 33 - -[ Upstream commit f033c87fda47e272bb4f75dc7b03677261d91158 ] - -Starting with commit f6038de293f2 ("arm64: dts: imx8qm: Fix VPU core -alias name") the alias for VPU cores uses dashes instead of underscores. -Adjust the alias stem accordingly. Fixes the errors: -amphion-vpu-core 2d040000.vpu-core: can't get vpu core id -amphion-vpu-core 2d050000.vpu-core: can't get vpu core id - -Fixes: f6038de293f2 ("arm64: dts: imx8qm: Fix VPU core alias name") -Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> -Reviewed-by: Ming Qian <ming.qian@nxp.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/platform/amphion/vpu_core.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c -index 1af6fc9460d4..3a2030d02e45 100644 ---- a/drivers/media/platform/amphion/vpu_core.c -+++ b/drivers/media/platform/amphion/vpu_core.c -@@ -642,7 +642,7 @@ static int vpu_core_probe(struct platform_device *pdev) - return -ENODEV; - - core->type = core->res->type; -- core->id = of_alias_get_id(dev->of_node, "vpu_core"); -+ core->id = of_alias_get_id(dev->of_node, "vpu-core"); - if (core->id < 0) { - dev_err(dev, "can't get vpu core id\n"); - return core->id; --- -2.43.2 - -From 1470d173925d697b497656b93f7c5bddae2e64b2 Mon Sep 17 00:00:00 2001 -From: Luben Tuikov <ltuikov89@gmail.com> -Date: Wed, 22 Nov 2023 23:58:53 -0500 -Subject: [PATCH 0289/1501] drm/sched: Fix bounds limiting when given a - malformed entity -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1986 -Lines: 43 - -[ Upstream commit 2bbe6ab2be53858507f11f99f856846d04765ae3 ] - -If we're given a malformed entity in drm_sched_entity_init()--shouldn't -happen, but we verify--with out-of-bounds priority value, we set it to an -allowed value. Fix the expression which sets this limit. - -Signed-off-by: Luben Tuikov <ltuikov89@gmail.com> -Fixes: 56e449603f0ac5 ("drm/sched: Convert the GPU scheduler to variable number of run-queues") -Link: https://patchwork.freedesktop.org/patch/msgid/20231123122422.167832-2-ltuikov89@gmail.com -Reviewed-by: Christian König <christian.koenig@amd.com> -Link: https://lore.kernel.org/r/dbb91dbe-ef77-4d79-aaf9-2adb171c1d7a@amd.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/scheduler/sched_entity.c | 13 ++++++++----- - 1 file changed, 8 insertions(+), 5 deletions(-) - -diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c -index 409e4256f6e7..0a7a7e4ad8d1 100644 ---- a/drivers/gpu/drm/scheduler/sched_entity.c -+++ b/drivers/gpu/drm/scheduler/sched_entity.c -@@ -81,12 +81,15 @@ int drm_sched_entity_init(struct drm_sched_entity *entity, - */ - pr_warn("%s: called with uninitialized scheduler\n", __func__); - } else if (num_sched_list) { -- /* The "priority" of an entity cannot exceed the number -- * of run-queues of a scheduler. -+ /* The "priority" of an entity cannot exceed the number of run-queues of a -+ * scheduler. Protect against num_rqs being 0, by converting to signed. - */ -- if (entity->priority >= sched_list[0]->num_rqs) -- entity->priority = max_t(u32, sched_list[0]->num_rqs, -- DRM_SCHED_PRIORITY_MIN); -+ if (entity->priority >= sched_list[0]->num_rqs) { -+ drm_err(sched_list[0], "entity with out-of-bounds priority:%u num_rqs:%u\n", -+ entity->priority, sched_list[0]->num_rqs); -+ entity->priority = max_t(s32, (s32) sched_list[0]->num_rqs - 1, -+ (s32) DRM_SCHED_PRIORITY_MIN); -+ } - entity->rq = sched_list[0]->sched_rq[entity->priority]; - } - --- -2.43.2 - -From af1baa7e5fe2705bc45e566b90bc584b8f2766ed Mon Sep 17 00:00:00 2001 -From: Dario Binacchi <dario.binacchi@amarulasolutions.com> -Date: Fri, 24 Nov 2023 10:42:30 +0100 -Subject: [PATCH 0290/1501] drm/bridge: Fix typo in post_disable() description -Content-Length: 1037 -Lines: 28 - -[ Upstream commit 288b039db225676e0c520c981a1b5a2562d893a3 ] - -s/singals/signals/ - -Fixes: 199e4e967af4 ("drm: Extract drm_bridge.h") -Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com> -Signed-off-by: Robert Foss <rfoss@kernel.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20231124094253.658064-1-dario.binacchi@amarulasolutions.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/drm/drm_bridge.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/include/drm/drm_bridge.h b/include/drm/drm_bridge.h -index cfb7dcdb66c4..9ef461aa9b9e 100644 ---- a/include/drm/drm_bridge.h -+++ b/include/drm/drm_bridge.h -@@ -194,7 +194,7 @@ struct drm_bridge_funcs { - * or &drm_encoder_helper_funcs.dpms hook. - * - * The bridge must assume that the display pipe (i.e. clocks and timing -- * singals) feeding it is no longer running when this callback is -+ * signals) feeding it is no longer running when this callback is - * called. - * - * The @post_disable callback is optional. --- -2.43.2 - -From 363885ef9e3a4586f039d9e1ac5b2de8b807e26e Mon Sep 17 00:00:00 2001 -From: Liu Ying <victor.liu@nxp.com> -Date: Thu, 23 Nov 2023 13:18:07 +0800 -Subject: [PATCH 0291/1501] drm/bridge: imx93-mipi-dsi: Fix a couple of - building warnings -Content-Length: 1487 -Lines: 35 - -[ Upstream commit 325b71e820b67569048c621227266783442b75ed ] - -Fix a couple of building warnings on used uninitialized 'best_m' and -'best_n' local variables by initializing 'best_m' to zero and 'best_n' -to UINT_MAX. This makes compiler happy only. No functional change. - -Fixes: ce62f8ea7e3f ("drm/bridge: imx: Add i.MX93 MIPI DSI support") -Reported-by: kernel test robot <lkp@intel.com> -Closes: https://lore.kernel.org/oe-kbuild-all/202311151746.f7u7dzbZ-lkp@intel.com/ -Signed-off-by: Liu Ying <victor.liu@nxp.com> -Reviewed-by: Robert Foss <rfoss@kernel.org> -Signed-off-by: Robert Foss <rfoss@kernel.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20231123051807.3818342-1-victor.liu@nxp.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/bridge/imx/imx93-mipi-dsi.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/bridge/imx/imx93-mipi-dsi.c b/drivers/gpu/drm/bridge/imx/imx93-mipi-dsi.c -index 3ff30ce80c5b..2347f8dd632f 100644 ---- a/drivers/gpu/drm/bridge/imx/imx93-mipi-dsi.c -+++ b/drivers/gpu/drm/bridge/imx/imx93-mipi-dsi.c -@@ -226,8 +226,8 @@ dphy_pll_get_configure_from_opts(struct imx93_dsi *dsi, - unsigned long fout; - unsigned long best_fout = 0; - unsigned int fvco_div; -- unsigned int min_n, max_n, n, best_n; -- unsigned long m, best_m; -+ unsigned int min_n, max_n, n, best_n = UINT_MAX; -+ unsigned long m, best_m = 0; - unsigned long min_delta = ULONG_MAX; - unsigned long delta; - u64 tmp; --- -2.43.2 - -From 2fb4867f4405aea8c0519d7d188207f232a57862 Mon Sep 17 00:00:00 2001 -From: Chao Yu <chao@kernel.org> -Date: Tue, 28 Nov 2023 17:25:16 +0800 -Subject: [PATCH 0292/1501] f2fs: fix to avoid dirent corruption -Content-Length: 1626 -Lines: 52 - -[ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ] - -As Al reported in link[1]: - -f2fs_rename() -... - if (old_dir != new_dir && !whiteout) - f2fs_set_link(old_inode, old_dir_entry, - old_dir_page, new_dir); - else - f2fs_put_page(old_dir_page, 0); - -You want correct inumber in the ".." link. And cross-directory -rename does move the source to new parent, even if you'd been asked -to leave a whiteout in the old place. - -[1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ - -With below testcase, it may cause dirent corruption, due to it missed -to call f2fs_set_link() to update ".." link to new directory. -- mkdir -p dir/foo -- renameat2 -w dir/foo bar - -[ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] -[FSCK] other corrupted bugs [Fail] - -Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT") -Cc: Jan Kara <jack@suse.cz> -Reported-by: Al Viro <viro@zeniv.linux.org.uk> -Signed-off-by: Chao Yu <chao@kernel.org> -Reviewed-by: Jan Kara <jack@suse.cz> -Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/f2fs/namei.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c -index d0053b0284d8..7f71bae2c83b 100644 ---- a/fs/f2fs/namei.c -+++ b/fs/f2fs/namei.c -@@ -1106,7 +1106,7 @@ static int f2fs_rename(struct mnt_idmap *idmap, struct inode *old_dir, - } - - if (old_dir_entry) { -- if (old_dir != new_dir && !whiteout) -+ if (old_dir != new_dir) - f2fs_set_link(old_inode, old_dir_entry, - old_dir_page, new_dir); - else --- -2.43.2 - -From 2c788486180a380b5a64fd08a8ffe690ab81b948 Mon Sep 17 00:00:00 2001 -From: Xin Ji <xji@analogixsemi.com> -Date: Mon, 20 Nov 2023 17:10:36 +0800 -Subject: [PATCH 0293/1501] Revert "drm/bridge: Add 200ms delay to wait FW HPD - status stable" -Content-Length: 1205 -Lines: 33 - -[ Upstream commit af3145aa142c92409d3b123ff87ff0b5fd0bf849 ] - -This reverts commit 330140d7319fcc4ec68bd924ea212e476bf12275 - -200ms delay will cause panel display image later than backlight -turn on, revert this patch. - -Fixes: 330140d7319fcc ("drm/bridge: Add 200ms delay to wait FW HPD status stable") -Signed-off-by: Xin Ji <xji@analogixsemi.com> -Reviewed-by: Robert Foss <rfoss@kernel.org> -Signed-off-by: Robert Foss <rfoss@kernel.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20231120091038.284825-1-xji@analogixsemi.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/bridge/analogix/anx7625.c | 3 --- - 1 file changed, 3 deletions(-) - -diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c -index 8f740154707d..51abe42c639e 100644 ---- a/drivers/gpu/drm/bridge/analogix/anx7625.c -+++ b/drivers/gpu/drm/bridge/analogix/anx7625.c -@@ -1464,9 +1464,6 @@ static int _anx7625_hpd_polling(struct anx7625_data *ctx, - if (ctx->pdata.intp_irq) - return 0; - -- /* Delay 200ms for FW HPD de-bounce */ -- msleep(200); -- - ret = readx_poll_timeout(anx7625_read_hpd_status_p0, - ctx, val, - ((val & HPD_STATUS) || (val < 0)), --- -2.43.2 - -From dcb3532bf53e3dffef7d1541b9ce222bcdf8f94d Mon Sep 17 00:00:00 2001 -From: Thomas Zimmermann <tzimmermann@suse.de> -Date: Mon, 27 Nov 2023 14:15:31 +0100 -Subject: [PATCH 0294/1501] fbdev/sm712fb: Use correct initializer macros for - struct fb_ops -Content-Length: 2968 -Lines: 69 - -[ Upstream commit 12d55c013a09a2d490f004a324c20800e4ff35ec ] - -Only initialize mmap and draw helpers with macros; leave read/write -callbacks to driver implementations. Fixes the following warnings: - - CC [M] drivers/video/fbdev/sm712fb.o - sm712fb.c:1355:25: warning: initialized field overwritten [-Woverride-init] - 1355 | .fb_fillrect = cfb_fillrect, - | ^~~~~~~~~~~~ - sm712fb.c:1355:25: note: (near initialization for 'smtcfb_ops.fb_fillrect') - sm712fb.c:1356:25: warning: initialized field overwritten [-Woverride-init] - 1356 | .fb_imageblit = cfb_imageblit, - | ^~~~~~~~~~~~~ - sm712fb.c:1356:25: note: (near initialization for 'smtcfb_ops.fb_imageblit') - sm712fb.c:1357:25: warning: initialized field overwritten [-Woverride-init] - 1357 | .fb_copyarea = cfb_copyarea, - | ^~~~~~~~~~~~ - sm712fb.c:1357:25: note: (near initialization for 'smtcfb_ops.fb_copyarea') - sm712fb.c:1358:25: warning: initialized field overwritten [-Woverride-init] - 1358 | .fb_read = smtcfb_read, - | ^~~~~~~~~~~ - sm712fb.c:1358:25: note: (near initialization for 'smtcfb_ops.fb_read') - sm712fb.c:1359:25: warning: initialized field overwritten [-Woverride-init] - 1359 | .fb_write = smtcfb_write, - | ^~~~~~~~~~~~ - sm712fb.c:1359:25: note: (near initialization for 'smtcfb_ops.fb_write') - -Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> -Fixes: 586132cf1d38 ("fbdev/sm712fb: Initialize fb_ops to fbdev I/O-memory helpers") -Cc: Thomas Zimmermann <tzimmermann@suse.de> -Cc: Javier Martinez Canillas <javierm@redhat.com> -Cc: Sudip Mukherjee <sudipm.mukherjee@gmail.com> -Cc: Teddy Wang <teddy.wang@siliconmotion.com> -Cc: Sam Ravnborg <sam@ravnborg.org> -Cc: Helge Deller <deller@gmx.de> -Cc: Arnd Bergmann <arnd@arndb.de> -Cc: linux-fbdev@vger.kernel.org -Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20231127131655.4020-3-tzimmermann@suse.de -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/video/fbdev/sm712fb.c | 6 ++---- - 1 file changed, 2 insertions(+), 4 deletions(-) - -diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c -index 3f8ef50e3209..104f122e0f27 100644 ---- a/drivers/video/fbdev/sm712fb.c -+++ b/drivers/video/fbdev/sm712fb.c -@@ -1347,16 +1347,14 @@ static int smtc_set_par(struct fb_info *info) - - static const struct fb_ops smtcfb_ops = { - .owner = THIS_MODULE, -- FB_DEFAULT_IOMEM_OPS, - .fb_check_var = smtc_check_var, - .fb_set_par = smtc_set_par, - .fb_setcolreg = smtc_setcolreg, - .fb_blank = smtc_blank, -- .fb_fillrect = cfb_fillrect, -- .fb_imageblit = cfb_imageblit, -- .fb_copyarea = cfb_copyarea, -+ __FB_DEFAULT_IOMEM_OPS_DRAW, - .fb_read = smtcfb_read, - .fb_write = smtcfb_write, -+ __FB_DEFAULT_IOMEM_OPS_MMAP, - }; - - /* --- -2.43.2 - -From c4135343ec7c09577839481abc0165b4d984b075 Mon Sep 17 00:00:00 2001 -From: Arnd Bergmann <arnd@arndb.de> -Date: Wed, 29 Nov 2023 12:31:17 +0100 -Subject: [PATCH 0295/1501] ASoC: fsl_rpmsg: update Kconfig dependencies -Content-Length: 1571 -Lines: 36 - -[ Upstream commit 9cce9c4806a89439ea34aad2e382150d68c7ea95 ] - -SND_SOC_IMX_RPMSG gained a new dependency and gets selected by SND_SOC_FSL_RPMSG, -which as a result needs to have the same dependency, or produce a build failure -based on that: - -WARNING: unmet direct dependencies detected for SND_SOC_IMX_RPMSG - Depends on [n]: SOUND [=y] && SND [=y] && SND_SOC [=y] && SND_IMX_SOC [=y] && RPMSG [=y] && OF [=y] && I2C [=n] - Selected by [y]: - - SND_SOC_FSL_RPMSG [=y] && SOUND [=y] && SND [=y] && SND_SOC [=y] && COMMON_CLK [=y] && RPMSG [=y] && (SND_IMX_SOC [=y] || SND_IMX_SOC [=y]=n) && SND_IMX_SOC [=y]!=n -x86_64-linux-ld: sound/soc/fsl/imx-rpmsg.o: in function `imx_rpmsg_late_probe': -imx-rpmsg.c:(.text+0x11e): undefined reference to `i2c_find_device_by_fwnode' - -Fixes: f83d38def6b1 ("ASoC: imx-rpmsg: SND_SOC_IMX_RPMSG should depend on OF and I2C") -Signed-off-by: Arnd Bergmann <arnd@arndb.de> -Link: https://lore.kernel.org/r/20231129113204.2869356-1-arnd@kernel.org -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - sound/soc/fsl/Kconfig | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/sound/soc/fsl/Kconfig b/sound/soc/fsl/Kconfig -index be342ee03fb9..d14061e88e58 100644 ---- a/sound/soc/fsl/Kconfig -+++ b/sound/soc/fsl/Kconfig -@@ -121,6 +121,7 @@ config SND_SOC_FSL_UTILS - config SND_SOC_FSL_RPMSG - tristate "NXP Audio Base On RPMSG support" - depends on COMMON_CLK -+ depends on OF && I2C - depends on RPMSG - depends on SND_IMX_SOC || SND_IMX_SOC = n - select SND_SOC_IMX_RPMSG if SND_IMX_SOC != n --- -2.43.2 - -From 0ba91c3e1039950c9b36aae6b93a6827ef33d7ae Mon Sep 17 00:00:00 2001 -From: Nikita Zhandarovich <n.zhandarovich@fintech.ru> -Date: Wed, 29 Nov 2023 07:22:30 -0800 -Subject: [PATCH 0296/1501] drm/radeon/r600_cs: Fix possible int overflows in - r600_cs_check_reg() -Content-Length: 1722 -Lines: 43 - -[ Upstream commit 39c960bbf9d9ea862398759e75736cfb68c3446f ] - -While improbable, there may be a chance of hitting integer -overflow when the result of radeon_get_ib_value() gets shifted -left. - -Avoid it by casting one of the operands to larger data type (u64). - -Found by Linux Verification Center (linuxtesting.org) with static -analysis tool SVACE. - -Fixes: 1729dd33d20b ("drm/radeon/kms: r600 CS parser fixes") -Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/radeon/r600_cs.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c -index 638f861af80f..6cf54a747749 100644 ---- a/drivers/gpu/drm/radeon/r600_cs.c -+++ b/drivers/gpu/drm/radeon/r600_cs.c -@@ -1275,7 +1275,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx) - return -EINVAL; - } - tmp = (reg - CB_COLOR0_BASE) / 4; -- track->cb_color_bo_offset[tmp] = radeon_get_ib_value(p, idx) << 8; -+ track->cb_color_bo_offset[tmp] = (u64)radeon_get_ib_value(p, idx) << 8; - ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff); - track->cb_color_base_last[tmp] = ib[idx]; - track->cb_color_bo[tmp] = reloc->robj; -@@ -1302,7 +1302,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx) - "0x%04X\n", reg); - return -EINVAL; - } -- track->htile_offset = radeon_get_ib_value(p, idx) << 8; -+ track->htile_offset = (u64)radeon_get_ib_value(p, idx) << 8; - ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff); - track->htile_bo = reloc->robj; - track->db_dirty = true; --- -2.43.2 - -From cadb98cc3dba58557c40dcb8b59353c83595820a Mon Sep 17 00:00:00 2001 -From: Nikita Zhandarovich <n.zhandarovich@fintech.ru> -Date: Wed, 29 Nov 2023 07:22:12 -0800 -Subject: [PATCH 0297/1501] drm/radeon/r100: Fix integer overflow issues in - r100_cs_track_check() -Content-Length: 1783 -Lines: 44 - -[ Upstream commit b5c5baa458faa5430c445acd9a17481274d77ccf ] - -It may be possible, albeit unlikely, to encounter integer overflow -during the multiplication of several unsigned int variables, the -result being assigned to a variable 'size' of wider type. - -Prevent this potential behaviour by converting one of the multiples -to unsigned long. - -Found by Linux Verification Center (linuxtesting.org) with static -analysis tool SVACE. - -Fixes: 0242f74d29df ("drm/radeon: clean up CS functions in r100.c") -Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/radeon/r100.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c -index affa9e0309b2..cfeca2694d5f 100644 ---- a/drivers/gpu/drm/radeon/r100.c -+++ b/drivers/gpu/drm/radeon/r100.c -@@ -2321,7 +2321,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track) - switch (prim_walk) { - case 1: - for (i = 0; i < track->num_arrays; i++) { -- size = track->arrays[i].esize * track->max_indx * 4; -+ size = track->arrays[i].esize * track->max_indx * 4UL; - if (track->arrays[i].robj == NULL) { - DRM_ERROR("(PW %u) Vertex array %u no buffer " - "bound\n", prim_walk, i); -@@ -2340,7 +2340,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track) - break; - case 2: - for (i = 0; i < track->num_arrays; i++) { -- size = track->arrays[i].esize * (nverts - 1) * 4; -+ size = track->arrays[i].esize * (nverts - 1) * 4UL; - if (track->arrays[i].robj == NULL) { - DRM_ERROR("(PW %u) Vertex array %u no buffer " - "bound\n", prim_walk, i); --- -2.43.2 - -From 7d76889a458973cf40938fa2b0d3b8bd2f9d38c3 Mon Sep 17 00:00:00 2001 -From: Nikita Zhandarovich <n.zhandarovich@fintech.ru> -Date: Tue, 8 Aug 2023 11:04:16 -0700 -Subject: [PATCH 0298/1501] drm/radeon: check return value of - radeon_ring_lock() -Content-Length: 1257 -Lines: 34 - -[ Upstream commit 71225e1c930942cb1e042fc08c5cc0c4ef30e95e ] - -In the unlikely event of radeon_ring_lock() failing, its errno return -value should be processed. This patch checks said return value and -prints a debug message in case of an error. - -Found by Linux Verification Center (linuxtesting.org) with static -analysis tool SVACE. - -Fixes: 48c0c902e2e6 ("drm/radeon/kms: add support for CP setup on SI") -Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/radeon/si.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c -index a91012447b56..85e9cba49cec 100644 ---- a/drivers/gpu/drm/radeon/si.c -+++ b/drivers/gpu/drm/radeon/si.c -@@ -3611,6 +3611,10 @@ static int si_cp_start(struct radeon_device *rdev) - for (i = RADEON_RING_TYPE_GFX_INDEX; i <= CAYMAN_RING_TYPE_CP2_INDEX; ++i) { - ring = &rdev->ring[i]; - r = radeon_ring_lock(rdev, ring, 2); -+ if (r) { -+ DRM_ERROR("radeon: cp failed to lock ring (%d).\n", r); -+ return r; -+ } - - /* clear the compute context state */ - radeon_ring_write(ring, PACKET3_COMPUTE(PACKET3_CLEAR_STATE, 0)); --- -2.43.2 - -From 6b80326efff093d037e0971831dca6ebddba9b45 Mon Sep 17 00:00:00 2001 -From: Mario Limonciello <mario.limonciello@amd.com> -Date: Tue, 28 Nov 2023 18:35:09 -0600 -Subject: [PATCH 0299/1501] drm/amd/display: Fix NULL pointer dereference at - hibernate -Content-Length: 1501 -Lines: 39 - -[ Upstream commit b719a9c15d52d4f56bdea8241a5d90fd9197ce99 ] - -During hibernate sequence the source context might not have a clk_mgr. -So don't use it to look for DML2 support. - -Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2980 -Fixes: 7966f319c66d ("drm/amd/display: Introduce DML2") -Reviewed-by: Harry Wentland <harry.wentland@amd.com> -Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -index a1f1d1003992..e4bb1e25ee3b 100644 ---- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -@@ -4512,7 +4512,7 @@ void dc_resource_state_copy_construct( - struct dml2_context *dml2 = NULL; - - // Need to preserve allocated dml2 context -- if (src_ctx->clk_mgr->ctx->dc->debug.using_dml2) -+ if (src_ctx->clk_mgr && src_ctx->clk_mgr->ctx->dc->debug.using_dml2) - dml2 = dst_ctx->bw_ctx.dml2; - #endif - -@@ -4520,7 +4520,7 @@ void dc_resource_state_copy_construct( - - #ifdef CONFIG_DRM_AMD_DC_FP - // Preserve allocated dml2 context -- if (src_ctx->clk_mgr->ctx->dc->debug.using_dml2) -+ if (src_ctx->clk_mgr && src_ctx->clk_mgr->ctx->dc->debug.using_dml2) - dst_ctx->bw_ctx.dml2 = dml2; - #endif - --- -2.43.2 - -From 32604d9f0618f91d95b24a2f5f4636910745daea Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Thu, 9 Nov 2023 09:37:57 +0200 -Subject: [PATCH 0300/1501] drm/tidss: Move reset to the end of dispc_init() -Content-Length: 1797 -Lines: 47 - -[ Upstream commit 36d1e0852680aa038e2428d450673390111b165c ] - -We do a DSS reset in the middle of the dispc_init(). While that happens -to work now, we should really make sure that e..g the fclk, which is -acquired only later in the function, is enabled when doing a reset. This -will be handled in a later patch, but for now, let's move the -dispc_softreset() call to the end of dispc_init(), which is a sensible -place for it anyway. - -Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> -Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com> -Link: https://lore.kernel.org/r/20231109-tidss-probe-v2-4-ac91b5ea35c0@ideasonboard.com -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Stable-dep-of: bc288a927815 ("drm/tidss: Fix dss reset") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/tidss/tidss_dispc.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c -index 9d9dee7abaef..8d822372bf94 100644 ---- a/drivers/gpu/drm/tidss/tidss_dispc.c -+++ b/drivers/gpu/drm/tidss/tidss_dispc.c -@@ -2777,10 +2777,6 @@ int dispc_init(struct tidss_device *tidss) - return r; - } - -- /* K2G display controller does not support soft reset */ -- if (feat->subrev != DISPC_K2G) -- dispc_softreset(dispc); -- - for (i = 0; i < dispc->feat->num_vps; i++) { - u32 gamma_size = dispc->feat->vp_feat.color.gamma_size; - u32 *gamma_table; -@@ -2829,6 +2825,10 @@ int dispc_init(struct tidss_device *tidss) - of_property_read_u32(dispc->dev->of_node, "max-memory-bandwidth", - &dispc->memory_bandwidth_limit); - -+ /* K2G display controller does not support soft reset */ -+ if (feat->subrev != DISPC_K2G) -+ dispc_softreset(dispc); -+ - tidss->dispc = dispc; - - return 0; --- -2.43.2 - -From c59a9821408eb687521e81b90443107a6a420b5d Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Thu, 9 Nov 2023 09:37:58 +0200 -Subject: [PATCH 0301/1501] drm/tidss: Return error value from from softreset -Content-Length: 1790 -Lines: 58 - -[ Upstream commit aceafbb5035c4bfc75a321863ed1e393d644d2d2 ] - -Return an error value from dispc_softreset() so that the caller can -handle the errors. - -Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com> -Link: https://lore.kernel.org/r/20231109-tidss-probe-v2-5-ac91b5ea35c0@ideasonboard.com -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Stable-dep-of: bc288a927815 ("drm/tidss: Fix dss reset") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/tidss/tidss_dispc.c | 17 ++++++++++++----- - 1 file changed, 12 insertions(+), 5 deletions(-) - -diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c -index 8d822372bf94..9a29f5fa8453 100644 ---- a/drivers/gpu/drm/tidss/tidss_dispc.c -+++ b/drivers/gpu/drm/tidss/tidss_dispc.c -@@ -2702,7 +2702,7 @@ static void dispc_init_errata(struct dispc_device *dispc) - } - } - --static void dispc_softreset(struct dispc_device *dispc) -+static int dispc_softreset(struct dispc_device *dispc) - { - u32 val; - int ret = 0; -@@ -2712,8 +2712,12 @@ static void dispc_softreset(struct dispc_device *dispc) - /* Wait for reset to complete */ - ret = readl_poll_timeout(dispc->base_common + DSS_SYSSTATUS, - val, val & 1, 100, 5000); -- if (ret) -- dev_warn(dispc->dev, "failed to reset dispc\n"); -+ if (ret) { -+ dev_err(dispc->dev, "failed to reset dispc\n"); -+ return ret; -+ } -+ -+ return 0; - } - - int dispc_init(struct tidss_device *tidss) -@@ -2826,8 +2830,11 @@ int dispc_init(struct tidss_device *tidss) - &dispc->memory_bandwidth_limit); - - /* K2G display controller does not support soft reset */ -- if (feat->subrev != DISPC_K2G) -- dispc_softreset(dispc); -+ if (feat->subrev != DISPC_K2G) { -+ r = dispc_softreset(dispc); -+ if (r) -+ return r; -+ } - - tidss->dispc = dispc; - --- -2.43.2 - -From d8603443ca36051694c9456d168a9167a4bacc29 Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Thu, 9 Nov 2023 09:37:59 +0200 -Subject: [PATCH 0302/1501] drm/tidss: Check for K2G in in dispc_softreset() -Content-Length: 1689 -Lines: 49 - -[ Upstream commit 151825150cf9c2e9fb90763d35b9dff3783628ac ] - -K2G doesn't have softreset feature. Instead of having every caller of -dispc_softreset() check for K2G, move the check into dispc_softreset(), -and make dispc_softreset() return 0 in case of K2G. - -Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> -Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com> -Link: https://lore.kernel.org/r/20231109-tidss-probe-v2-6-ac91b5ea35c0@ideasonboard.com -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Stable-dep-of: bc288a927815 ("drm/tidss: Fix dss reset") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/tidss/tidss_dispc.c | 13 +++++++------ - 1 file changed, 7 insertions(+), 6 deletions(-) - -diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c -index 9a29f5fa8453..2af623842cfb 100644 ---- a/drivers/gpu/drm/tidss/tidss_dispc.c -+++ b/drivers/gpu/drm/tidss/tidss_dispc.c -@@ -2707,6 +2707,10 @@ static int dispc_softreset(struct dispc_device *dispc) - u32 val; - int ret = 0; - -+ /* K2G display controller does not support soft reset */ -+ if (dispc->feat->subrev == DISPC_K2G) -+ return 0; -+ - /* Soft reset */ - REG_FLD_MOD(dispc, DSS_SYSCONFIG, 1, 1, 1); - /* Wait for reset to complete */ -@@ -2829,12 +2833,9 @@ int dispc_init(struct tidss_device *tidss) - of_property_read_u32(dispc->dev->of_node, "max-memory-bandwidth", - &dispc->memory_bandwidth_limit); - -- /* K2G display controller does not support soft reset */ -- if (feat->subrev != DISPC_K2G) { -- r = dispc_softreset(dispc); -- if (r) -- return r; -- } -+ r = dispc_softreset(dispc); -+ if (r) -+ return r; - - tidss->dispc = dispc; - --- -2.43.2 - -From efeefba966d86847862f11c9c7f00c83e81d870e Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Thu, 9 Nov 2023 09:38:01 +0200 -Subject: [PATCH 0303/1501] drm/tidss: Fix dss reset -Content-Length: 2943 -Lines: 98 - -[ Upstream commit bc288a927815efcf9d7f4a54d4d89c5df478c635 ] - -The probe function calls dispc_softreset() before runtime PM is enabled -and without enabling any of the DSS clocks. This happens to work by -luck, and we need to make sure the DSS HW is active and the fclk is -enabled. - -To fix the above, add a new function, dispc_init_hw(), which does: - -- pm_runtime_set_active() -- clk_prepare_enable(fclk) -- dispc_softreset(). - -This ensures that the reset can be successfully accomplished. - -Note that we use pm_runtime_set_active(), not the normal -pm_runtime_get(). The reason for this is that at this point we haven't -enabled the runtime PM yet and also we don't want the normal resume -callback to be called: the dispc resume callback does some initial HW -setup, and it expects that the HW was off (no video ports are -streaming). If the bootloader has enabled the DSS and has set up a -boot time splash-screen, the DSS would be enabled and streaming which -might lead to issues with the normal resume callback. - -Fixes: c9b2d923befd ("drm/tidss: Soft Reset DISPC on startup") -Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com> -Link: https://lore.kernel.org/r/20231109-tidss-probe-v2-8-ac91b5ea35c0@ideasonboard.com -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/tidss/tidss_dispc.c | 45 ++++++++++++++++++++++++++++- - 1 file changed, 44 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c -index 2af623842cfb..98efbaf3b0c2 100644 ---- a/drivers/gpu/drm/tidss/tidss_dispc.c -+++ b/drivers/gpu/drm/tidss/tidss_dispc.c -@@ -2724,6 +2724,49 @@ static int dispc_softreset(struct dispc_device *dispc) - return 0; - } - -+static int dispc_init_hw(struct dispc_device *dispc) -+{ -+ struct device *dev = dispc->dev; -+ int ret; -+ -+ ret = pm_runtime_set_active(dev); -+ if (ret) { -+ dev_err(dev, "Failed to set DSS PM to active\n"); -+ return ret; -+ } -+ -+ ret = clk_prepare_enable(dispc->fclk); -+ if (ret) { -+ dev_err(dev, "Failed to enable DSS fclk\n"); -+ goto err_runtime_suspend; -+ } -+ -+ ret = dispc_softreset(dispc); -+ if (ret) -+ goto err_clk_disable; -+ -+ clk_disable_unprepare(dispc->fclk); -+ ret = pm_runtime_set_suspended(dev); -+ if (ret) { -+ dev_err(dev, "Failed to set DSS PM to suspended\n"); -+ return ret; -+ } -+ -+ return 0; -+ -+err_clk_disable: -+ clk_disable_unprepare(dispc->fclk); -+ -+err_runtime_suspend: -+ ret = pm_runtime_set_suspended(dev); -+ if (ret) { -+ dev_err(dev, "Failed to set DSS PM to suspended\n"); -+ return ret; -+ } -+ -+ return ret; -+} -+ - int dispc_init(struct tidss_device *tidss) - { - struct device *dev = tidss->dev; -@@ -2833,7 +2876,7 @@ int dispc_init(struct tidss_device *tidss) - of_property_read_u32(dispc->dev->of_node, "max-memory-bandwidth", - &dispc->memory_bandwidth_limit); - -- r = dispc_softreset(dispc); -+ r = dispc_init_hw(dispc); - if (r) - return r; - --- -2.43.2 - -From 97409fe234fb77168ac95a3411c28c42f44c1ced Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de> -Date: Thu, 6 Jul 2023 11:27:31 +0200 -Subject: [PATCH 0304/1501] drm/imx/lcdc: Fix double-free of driver data -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1689 -Lines: 47 - -[ Upstream commit ff3670877e7c73d06c2a835d9abb62efcae0145c ] - -The struct imx_lcdc driver data is allocated using devm_drm_dev_alloc() -so it must not be explicitly kfree()d. - -Also drm_kms_helper_poll_fini() should not be called as there is no -matching drm_kms_helper_poll_init(). So drop the release function -completely. - -Fixes: c87e859cdeb5 ("drm/imx/lcdc: Implement DRM driver for imx25") -Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> -Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> -Signed-off-by: Philipp Zabel <philipp.zabel@gmail.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20230706092731.2630232-1-u.kleine-koenig@pengutronix.de -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/imx/lcdc/imx-lcdc.c | 9 --------- - 1 file changed, 9 deletions(-) - -diff --git a/drivers/gpu/drm/imx/lcdc/imx-lcdc.c b/drivers/gpu/drm/imx/lcdc/imx-lcdc.c -index 22b65f4a0e30..4beb3b4bd694 100644 ---- a/drivers/gpu/drm/imx/lcdc/imx-lcdc.c -+++ b/drivers/gpu/drm/imx/lcdc/imx-lcdc.c -@@ -342,21 +342,12 @@ static const struct drm_mode_config_helper_funcs imx_lcdc_mode_config_helpers = - .atomic_commit_tail = drm_atomic_helper_commit_tail_rpm, - }; - --static void imx_lcdc_release(struct drm_device *drm) --{ -- struct imx_lcdc *lcdc = imx_lcdc_from_drmdev(drm); -- -- drm_kms_helper_poll_fini(drm); -- kfree(lcdc); --} -- - DEFINE_DRM_GEM_DMA_FOPS(imx_lcdc_drm_fops); - - static struct drm_driver imx_lcdc_drm_driver = { - .driver_features = DRIVER_GEM | DRIVER_MODESET | DRIVER_ATOMIC, - .fops = &imx_lcdc_drm_fops, - DRM_GEM_DMA_DRIVER_OPS_VMAP, -- .release = imx_lcdc_release, - .name = "imx-lcdc", - .desc = "i.MX LCDC driver", - .date = "20200716", --- -2.43.2 - -From 6ece404708f0d29b157321f7db77afd188e102e8 Mon Sep 17 00:00:00 2001 -From: Linus Walleij <linus.walleij@linaro.org> -Date: Fri, 1 Dec 2023 14:20:31 +0100 -Subject: [PATCH 0305/1501] ASoC: cs35l33: Fix GPIO name and drop legacy - include -Content-Length: 1996 -Lines: 56 - -[ Upstream commit 50678d339d670a92658e5538ebee30447c88ccb3 ] - -This driver includes the legacy GPIO APIs <linux/gpio.h> and -<linux/of_gpio.h> but does not use any symbols from any of -them. - -Drop the includes. - -Further the driver is requesting "reset-gpios" rather than -just "reset" from the GPIO framework. This is wrong because -the gpiolib core will add "-gpios" before processing the -request from e.g. device tree. Drop the suffix. - -The last problem means that the optional RESET GPIO has -never been properly retrieved and used even if it existed, -but nobody noticed. - -Fixes: 3333cb7187b9 ("ASoC: cs35l33: Initial commit of the cs35l33 CODEC driver.") -Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com> -Signed-off-by: Linus Walleij <linus.walleij@linaro.org> -Link: https://lore.kernel.org/r/20231201-descriptors-sound-cirrus-v2-2-ee9f9d4655eb@linaro.org -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - sound/soc/codecs/cs35l33.c | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - -diff --git a/sound/soc/codecs/cs35l33.c b/sound/soc/codecs/cs35l33.c -index 4010a2d33a33..a19a2bafb37c 100644 ---- a/sound/soc/codecs/cs35l33.c -+++ b/sound/soc/codecs/cs35l33.c -@@ -22,13 +22,11 @@ - #include <sound/soc-dapm.h> - #include <sound/initval.h> - #include <sound/tlv.h> --#include <linux/gpio.h> - #include <linux/gpio/consumer.h> - #include <sound/cs35l33.h> - #include <linux/pm_runtime.h> - #include <linux/regulator/consumer.h> - #include <linux/regulator/machine.h> --#include <linux/of_gpio.h> - #include <linux/of.h> - - #include "cs35l33.h" -@@ -1165,7 +1163,7 @@ static int cs35l33_i2c_probe(struct i2c_client *i2c_client) - - /* We could issue !RST or skip it based on AMP topology */ - cs35l33->reset_gpio = devm_gpiod_get_optional(&i2c_client->dev, -- "reset-gpios", GPIOD_OUT_HIGH); -+ "reset", GPIOD_OUT_HIGH); - if (IS_ERR(cs35l33->reset_gpio)) { - dev_err(&i2c_client->dev, "%s ERROR: Can't get reset GPIO\n", - __func__); --- -2.43.2 - -From 3b06c9b5bc0ee6c79aacbd689666e42ef42fea97 Mon Sep 17 00:00:00 2001 -From: Linus Walleij <linus.walleij@linaro.org> -Date: Fri, 1 Dec 2023 14:20:32 +0100 -Subject: [PATCH 0306/1501] ASoC: cs35l34: Fix GPIO name and drop legacy - include -Content-Length: 2023 -Lines: 57 - -[ Upstream commit a6122b0b4211d132934ef99e7b737910e6d54d2f ] - -This driver includes the legacy GPIO APIs <linux/gpio.h> and -<linux/of_gpio.h> but does not use any symbols from any of -them. - -Drop the includes. - -Further the driver is requesting "reset-gpios" rather than -just "reset" from the GPIO framework. This is wrong because -the gpiolib core will add "-gpios" before processing the -request from e.g. device tree. Drop the suffix. - -The last problem means that the optional RESET GPIO has -never been properly retrieved and used even if it existed, -but nobody noticed. - -Fixes: c1124c09e103 ("ASoC: cs35l34: Initial commit of the cs35l34 CODEC driver.") -Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com> -Signed-off-by: Linus Walleij <linus.walleij@linaro.org> -Link: https://lore.kernel.org/r/20231201-descriptors-sound-cirrus-v2-3-ee9f9d4655eb@linaro.org -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - sound/soc/codecs/cs35l34.c | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - -diff --git a/sound/soc/codecs/cs35l34.c b/sound/soc/codecs/cs35l34.c -index e5871736fa29..cca59de66b73 100644 ---- a/sound/soc/codecs/cs35l34.c -+++ b/sound/soc/codecs/cs35l34.c -@@ -20,14 +20,12 @@ - #include <linux/regulator/machine.h> - #include <linux/pm_runtime.h> - #include <linux/of.h> --#include <linux/of_gpio.h> - #include <linux/of_irq.h> - #include <sound/core.h> - #include <sound/pcm.h> - #include <sound/pcm_params.h> - #include <sound/soc.h> - #include <sound/soc-dapm.h> --#include <linux/gpio.h> - #include <linux/gpio/consumer.h> - #include <sound/initval.h> - #include <sound/tlv.h> -@@ -1061,7 +1059,7 @@ static int cs35l34_i2c_probe(struct i2c_client *i2c_client) - dev_err(&i2c_client->dev, "Failed to request IRQ: %d\n", ret); - - cs35l34->reset_gpio = devm_gpiod_get_optional(&i2c_client->dev, -- "reset-gpios", GPIOD_OUT_LOW); -+ "reset", GPIOD_OUT_LOW); - if (IS_ERR(cs35l34->reset_gpio)) { - ret = PTR_ERR(cs35l34->reset_gpio); - goto err_regulator; --- -2.43.2 - -From be49a5d7f9fa09a7d1d1bb32ed9f28ff3f851d35 Mon Sep 17 00:00:00 2001 -From: Arnd Bergmann <arnd@arndb.de> -Date: Mon, 16 Oct 2023 22:04:03 +0200 -Subject: [PATCH 0307/1501] drm/msm/a6xx: add QMP dependency -Content-Length: 1457 -Lines: 37 - -[ Upstream commit 96ab215b2d5edc39310c00f50b33d8ab72ac3fe3 ] - -When QMP is in a loadable module, the A6xx GPU driver fails to link -as built-in: - -x86_64-linux-ld: drivers/gpu/drm/msm/adreno/a6xx_gmu.o: in function `a6xx_gmu_resume': -a6xx_gmu.c:(.text+0xd62): undefined reference to `qmp_send' - -Add the usual dependency that still allows compiling without QMP but -otherwise avoids the broken combination of options. - -Fixes: 88a0997f2f949 ("drm/msm/a6xx: Send ACD state to QMP at GMU resume") -Signed-off-by: Arnd Bergmann <arnd@arndb.de> -Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org> -Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Patchwork: https://patchwork.freedesktop.org/patch/562945/ -Link: https://lore.kernel.org/r/20231016200415.791090-1-arnd@kernel.org -Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/msm/Kconfig | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/gpu/drm/msm/Kconfig b/drivers/gpu/drm/msm/Kconfig -index 6309a857ca31..ad70b611b44f 100644 ---- a/drivers/gpu/drm/msm/Kconfig -+++ b/drivers/gpu/drm/msm/Kconfig -@@ -6,6 +6,7 @@ config DRM_MSM - depends on ARCH_QCOM || SOC_IMX5 || COMPILE_TEST - depends on COMMON_CLK - depends on IOMMU_SUPPORT -+ depends on QCOM_AOSS_QMP || QCOM_AOSS_QMP=n - depends on QCOM_OCMEM || QCOM_OCMEM=n - depends on QCOM_LLCC || QCOM_LLCC=n - depends on QCOM_COMMAND_DB || QCOM_COMMAND_DB=n --- -2.43.2 - -From c9dff99d485915718875a95caaf69f0b755ed6a6 Mon Sep 17 00:00:00 2001 -From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Date: Tue, 28 Nov 2023 00:54:01 +0300 -Subject: [PATCH 0308/1501] drm/msm/mdp4: flush vblank event on disable -Content-Length: 1657 -Lines: 45 - -[ Upstream commit c6721b3c6423d8a348ae885a0f4c85e14f9bf85c ] - -Flush queued events when disabling the crtc. This avoids timeouts when -we come back and wait for dependencies (like the previous frame's -flip_done). - -Fixes: c8afe684c95c ("drm/msm: basic KMS driver for snapdragon") -Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com> -Patchwork: https://patchwork.freedesktop.org/patch/569127/ -Link: https://lore.kernel.org/r/20231127215401.4064128-1-dmitry.baryshkov@linaro.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c -index 169f9de4a12a..3100957225a7 100644 ---- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c -+++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c -@@ -269,6 +269,7 @@ static void mdp4_crtc_atomic_disable(struct drm_crtc *crtc, - { - struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc); - struct mdp4_kms *mdp4_kms = get_kms(crtc); -+ unsigned long flags; - - DBG("%s", mdp4_crtc->name); - -@@ -281,6 +282,14 @@ static void mdp4_crtc_atomic_disable(struct drm_crtc *crtc, - mdp_irq_unregister(&mdp4_kms->base, &mdp4_crtc->err); - mdp4_disable(mdp4_kms); - -+ if (crtc->state->event && !crtc->state->active) { -+ WARN_ON(mdp4_crtc->event); -+ spin_lock_irqsave(&mdp4_kms->dev->event_lock, flags); -+ drm_crtc_send_vblank_event(crtc, crtc->state->event); -+ crtc->state->event = NULL; -+ spin_unlock_irqrestore(&mdp4_kms->dev->event_lock, flags); -+ } -+ - mdp4_crtc->enabled = false; - } - --- -2.43.2 - -From d1f7e58a269c1d86aa6b8ebded66c81e269748b1 Mon Sep 17 00:00:00 2001 -From: Bjorn Andersson <quic_bjorande@quicinc.com> -Date: Thu, 30 Nov 2023 16:35:01 -0800 -Subject: [PATCH 0309/1501] drm/msm/dpu: Add missing safe_lut_tbl in sc8180x - catalog -Content-Length: 1494 -Lines: 34 - -[ Upstream commit 7cc2621f16b644bb7af37987cb471311641a9e56 ] - -Similar to SC8280XP, the misconfigured SAFE logic causes rather -significant delays in __arm_smmu_tlb_sync(), resulting in poor -performance for things such as USB. - -Introduce appropriate SAFE values for SC8180X to correct this. - -Fixes: f3af2d6ee9ab ("drm/msm/dpu: Add SC8180x to hw catalog") -Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com> -Reported-by: Anton Bambura <jenneron@postmarketos.org> -Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Patchwork: https://patchwork.freedesktop.org/patch/569840/ -Link: https://lore.kernel.org/r/20231130-sc8180x-dpu-safe-lut-v1-1-a8a6bbac36b8@quicinc.com -Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h -index e07f4c8c25b9..9ffc8804a6fc 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h -@@ -367,6 +367,7 @@ static const struct dpu_perf_cfg sc8180x_perf_data = { - .min_llcc_ib = 800000, - .min_dram_ib = 800000, - .danger_lut_tbl = {0xf, 0xffff, 0x0}, -+ .safe_lut_tbl = {0xfff0, 0xf000, 0xffff}, - .qos_lut_tbl = { - {.nentry = ARRAY_SIZE(sc7180_qos_linear), - .entries = sc7180_qos_linear --- -2.43.2 - -From 938772d4c2a2ce13ff6709474e35252cc9df7d71 Mon Sep 17 00:00:00 2001 -From: Konrad Dybcio <konrad.dybcio@linaro.org> -Date: Tue, 20 Jun 2023 13:43:20 +0200 -Subject: [PATCH 0310/1501] drm/msm/dsi: Use pm_runtime_resume_and_get to - prevent refcnt leaks -Content-Length: 1311 -Lines: 35 - -[ Upstream commit 3d07a411b4faaf2b498760ccf12888f8de529de0 ] - -This helper has been introduced to avoid programmer errors (missing -_put calls leading to dangling refcnt) when using pm_runtime_get, use it. - -While at it, start checking the return value. - -Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> -Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Fixes: 5c8290284402 ("drm/msm/dsi: Split PHY drivers to separate files") -Patchwork: https://patchwork.freedesktop.org/patch/543350/ -Link: https://lore.kernel.org/r/20230620-topic-dsiphy_rpm-v2-1-a11a751f34f0@linaro.org -Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c -index 05621e5e7d63..b6314bb66d2f 100644 ---- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c -+++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c -@@ -516,7 +516,9 @@ static int dsi_phy_enable_resource(struct msm_dsi_phy *phy) - struct device *dev = &phy->pdev->dev; - int ret; - -- pm_runtime_get_sync(dev); -+ ret = pm_runtime_resume_and_get(dev); -+ if (ret) -+ return ret; - - ret = clk_prepare_enable(phy->ahb_clk); - if (ret) { --- -2.43.2 - -From f5d46c2dd1377f2c18da353d36eff01f134e63de Mon Sep 17 00:00:00 2001 -From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Date: Sun, 3 Dec 2023 01:55:52 +0300 -Subject: [PATCH 0311/1501] drm/drv: propagate errors from - drm_modeset_register_all() -Content-Length: 1597 -Lines: 46 - -[ Upstream commit 5f8dec200923a76dc57187965fd59c1136f5d085 ] - -In case the drm_modeset_register_all() function fails, its error code -will be ignored. Instead make the drm_dev_register() bail out in case of -such an error. - -Fixes: 79190ea2658a ("drm: Add callbacks for late registering") -Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> -Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Signed-off-by: Maxime Ripard <mripard@kernel.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20231202225552.1283638-1-dmitry.baryshkov@linaro.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/drm_drv.c | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c -index 535f16e7882e..3c835c99daad 100644 ---- a/drivers/gpu/drm/drm_drv.c -+++ b/drivers/gpu/drm/drm_drv.c -@@ -949,8 +949,11 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags) - goto err_minors; - } - -- if (drm_core_check_feature(dev, DRIVER_MODESET)) -- drm_modeset_register_all(dev); -+ if (drm_core_check_feature(dev, DRIVER_MODESET)) { -+ ret = drm_modeset_register_all(dev); -+ if (ret) -+ goto err_unload; -+ } - - DRM_INFO("Initialized %s %d.%d.%d %s for %s on minor %d\n", - driver->name, driver->major, driver->minor, -@@ -960,6 +963,9 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags) - - goto out_unlock; - -+err_unload: -+ if (dev->driver->unload) -+ dev->driver->unload(dev); - err_minors: - remove_compat_control_link(dev); - drm_minor_unregister(dev, DRM_MINOR_ACCEL); --- -2.43.2 - -From 49d82811428469566667f22749610b8c132cdb3e Mon Sep 17 00:00:00 2001 -From: Sebastian Reichel <sre@kernel.org> -Date: Mon, 13 Nov 2023 23:57:23 +0100 -Subject: [PATCH 0312/1501] media: v4l: async: Fix duplicated list deletion -Content-Length: 1246 -Lines: 34 - -[ Upstream commit 3de6ee94aae701fa949cd3b5df6b6a440ddfb8f2 ] - -The list deletion call dropped here is already called from the -helper function in the line before. Having a second list_del() -call results in either a warning (with CONFIG_DEBUG_LIST=y): - -list_del corruption, c46c8198->next is LIST_POISON1 (00000100) - -If CONFIG_DEBUG_LIST is disabled the operation results in a -kernel error due to NULL pointer dereference. - -Fixes: 28a1295795d8 ("media: v4l: async: Allow multiple connections between entities") -Signed-off-by: Sebastian Reichel <sre@kernel.org> -Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/v4l2-core/v4l2-async.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c -index 091e8cf4114b..8cfd593d293d 100644 ---- a/drivers/media/v4l2-core/v4l2-async.c -+++ b/drivers/media/v4l2-core/v4l2-async.c -@@ -880,7 +880,6 @@ void v4l2_async_unregister_subdev(struct v4l2_subdev *sd) - &asc->notifier->waiting_list); - - v4l2_async_unbind_subdev_one(asc->notifier, asc); -- list_del(&asc->asc_subdev_entry); - } - } - --- -2.43.2 - -From 09268d90c7ff600ed70731c7176ca423502e62b2 Mon Sep 17 00:00:00 2001 -From: Brent Lu <brent.lu@intel.com> -Date: Mon, 4 Dec 2023 15:41:58 -0600 -Subject: [PATCH 0313/1501] ASoC: Intel: glk_rt5682_max98357a: fix board id - mismatch -Content-Length: 2208 -Lines: 59 - -[ Upstream commit 486ede0df82dd74472c6f5651e38ff48f7f766c1 ] - -The drv_name in enumeration table for ALC5682I-VS codec does not match -the board id string in machine driver. Modify the entry of "10EC5682" -to enumerate "RTL5682" as well and remove invalid entry. - -Fixes: 88b4d77d6035 ("ASoC: Intel: glk_rt5682_max98357a: support ALC5682I-VS codec") -Reported-by: Curtis Malainey <cujomalainey@chromium.org> -Reviewed-by: Curtis Malainey <cujomalainey@chromium.org> -Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> -Signed-off-by: Brent Lu <brent.lu@intel.com> -Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> -Link: https://lore.kernel.org/r/20231204214200.203100-4-pierre-louis.bossart@linux.intel.com -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - sound/soc/intel/common/soc-acpi-intel-glk-match.c | 14 ++++++-------- - 1 file changed, 6 insertions(+), 8 deletions(-) - -diff --git a/sound/soc/intel/common/soc-acpi-intel-glk-match.c b/sound/soc/intel/common/soc-acpi-intel-glk-match.c -index 387e73100884..8911c90bbaf6 100644 ---- a/sound/soc/intel/common/soc-acpi-intel-glk-match.c -+++ b/sound/soc/intel/common/soc-acpi-intel-glk-match.c -@@ -19,6 +19,11 @@ static const struct snd_soc_acpi_codecs glk_codecs = { - .codecs = {"MX98357A"} - }; - -+static const struct snd_soc_acpi_codecs glk_rt5682_rt5682s_hp = { -+ .num_codecs = 2, -+ .codecs = {"10EC5682", "RTL5682"}, -+}; -+ - struct snd_soc_acpi_mach snd_soc_acpi_intel_glk_machines[] = { - { - .id = "INT343A", -@@ -35,20 +40,13 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_glk_machines[] = { - .sof_tplg_filename = "sof-glk-da7219.tplg", - }, - { -- .id = "10EC5682", -+ .comp_ids = &glk_rt5682_rt5682s_hp, - .drv_name = "glk_rt5682_mx98357a", - .fw_filename = "intel/dsp_fw_glk.bin", - .machine_quirk = snd_soc_acpi_codec_list, - .quirk_data = &glk_codecs, - .sof_tplg_filename = "sof-glk-rt5682.tplg", - }, -- { -- .id = "RTL5682", -- .drv_name = "glk_rt5682_max98357a", -- .machine_quirk = snd_soc_acpi_codec_list, -- .quirk_data = &glk_codecs, -- .sof_tplg_filename = "sof-glk-rt5682.tplg", -- }, - { - .id = "10134242", - .drv_name = "glk_cs4242_mx98357a", --- -2.43.2 - -From 582231a8c4f73ac153493687ecc1bed853e9c9ef Mon Sep 17 00:00:00 2001 -From: Bard Liao <yung-chuan.liao@linux.intel.com> -Date: Mon, 4 Dec 2023 15:41:59 -0600 -Subject: [PATCH 0314/1501] ASoC: Intel: sof_sdw_rt_sdca_jack_common: - ctx->headset_codec_dev = NULL -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1545 -Lines: 36 - -[ Upstream commit e38e252dbceeef7d2f848017132efd68e9ae1416 ] - -sof_sdw_rt_sdca_jack_exit() are used by different codecs, and some of -them use the same dai name. -For example, rt712 and rt713 both use "rt712-sdca-aif1" and -sof_sdw_rt_sdca_jack_exit(). -As a result, sof_sdw_rt_sdca_jack_exit() will be called twice by -mc_dailink_exit_loop(). Set ctx->headset_codec_dev = NULL; after -put_device(ctx->headset_codec_dev); to avoid ctx->headset_codec_dev -being put twice. - -Fixes: 5360c6704638 ("ASoC: Intel: sof_sdw: add rt712 support") -Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com> -Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com> -Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> -Link: https://lore.kernel.org/r/20231204214200.203100-5-pierre-louis.bossart@linux.intel.com -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - sound/soc/intel/boards/sof_sdw_rt_sdca_jack_common.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/sound/soc/intel/boards/sof_sdw_rt_sdca_jack_common.c b/sound/soc/intel/boards/sof_sdw_rt_sdca_jack_common.c -index 65bbcee88d6d..49a513399dc4 100644 ---- a/sound/soc/intel/boards/sof_sdw_rt_sdca_jack_common.c -+++ b/sound/soc/intel/boards/sof_sdw_rt_sdca_jack_common.c -@@ -168,6 +168,7 @@ int sof_sdw_rt_sdca_jack_exit(struct snd_soc_card *card, struct snd_soc_dai_link - - device_remove_software_node(ctx->headset_codec_dev); - put_device(ctx->headset_codec_dev); -+ ctx->headset_codec_dev = NULL; - - return 0; - } --- -2.43.2 - -From 1a66ae303d3dad60eee8d19d76a7511db944ef7e Mon Sep 17 00:00:00 2001 -From: Bard Liao <yung-chuan.liao@linux.intel.com> -Date: Mon, 4 Dec 2023 15:47:10 -0600 -Subject: [PATCH 0315/1501] ASoC: SOF: topology: Use partial match for - disconnecting DAI link and DAI widget -Content-Length: 1310 -Lines: 31 - -[ Upstream commit 2f03970198d6438d95b96f69041254bd39aafed0 ] - -We use partial match for connecting DAI link and DAI widget. We need to -use partial match for disconnecting, too. - -Fixes: fe88788779fc ("ASoC: SOF: topology: Use partial match for connecting DAI link and DAI widget") -Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com> -Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com> -Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> -Link: https://lore.kernel.org/r/20231204214713.208951-2-pierre-louis.bossart@linux.intel.com -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - sound/soc/sof/topology.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c -index 37ec671a2d76..7133ec13322b 100644 ---- a/sound/soc/sof/topology.c -+++ b/sound/soc/sof/topology.c -@@ -1134,7 +1134,7 @@ static void sof_disconnect_dai_widget(struct snd_soc_component *scomp, - list_for_each_entry(rtd, &card->rtd_list, list) { - /* does stream match DAI link ? */ - if (!rtd->dai_link->stream_name || -- strcmp(sname, rtd->dai_link->stream_name)) -+ !strstr(rtd->dai_link->stream_name, sname)) - continue; - - for_each_rtd_cpu_dais(rtd, i, cpu_dai) --- -2.43.2 - -From 3b7f7776a9c0afc7690b5066123246ce60d1db2b Mon Sep 17 00:00:00 2001 -From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Date: Mon, 9 Oct 2023 19:56:27 +0300 -Subject: [PATCH 0316/1501] drm/msm/dpu: enable SmartDMA on SM8450 -Content-Length: 3326 -Lines: 93 - -[ Upstream commit a9bd555de5e9042fdf8ab8d6080b86f45c68ddf6 ] - -Enable the SmartDMA / multirect support on the SM8450 platform to -support higher resoltion modes. - -Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com> -Patchwork: https://patchwork.freedesktop.org/patch/561590/ -Link: https://lore.kernel.org/r/20231009165627.2691015-1-dmitry.baryshkov@linaro.org -Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Stable-dep-of: 46b1f1b839ca ("drm/msm/dpu: populate SSPP scaler block version") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h | 16 ++++++++-------- - 1 file changed, 8 insertions(+), 8 deletions(-) - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h -index 7742f52be859..d18145c226da 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h -@@ -75,7 +75,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = { - { - .name = "sspp_0", .id = SSPP_VIG0, - .base = 0x4000, .len = 0x32c, -- .features = VIG_SC7180_MASK, -+ .features = VIG_SC7180_MASK_SDMA, - .sblk = &sm8250_vig_sblk_0, - .xin_id = 0, - .type = SSPP_TYPE_VIG, -@@ -83,7 +83,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = { - }, { - .name = "sspp_1", .id = SSPP_VIG1, - .base = 0x6000, .len = 0x32c, -- .features = VIG_SC7180_MASK, -+ .features = VIG_SC7180_MASK_SDMA, - .sblk = &sm8250_vig_sblk_1, - .xin_id = 4, - .type = SSPP_TYPE_VIG, -@@ -91,7 +91,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = { - }, { - .name = "sspp_2", .id = SSPP_VIG2, - .base = 0x8000, .len = 0x32c, -- .features = VIG_SC7180_MASK, -+ .features = VIG_SC7180_MASK_SDMA, - .sblk = &sm8250_vig_sblk_2, - .xin_id = 8, - .type = SSPP_TYPE_VIG, -@@ -99,7 +99,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = { - }, { - .name = "sspp_3", .id = SSPP_VIG3, - .base = 0xa000, .len = 0x32c, -- .features = VIG_SC7180_MASK, -+ .features = VIG_SC7180_MASK_SDMA, - .sblk = &sm8250_vig_sblk_3, - .xin_id = 12, - .type = SSPP_TYPE_VIG, -@@ -107,7 +107,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = { - }, { - .name = "sspp_8", .id = SSPP_DMA0, - .base = 0x24000, .len = 0x32c, -- .features = DMA_SDM845_MASK, -+ .features = DMA_SDM845_MASK_SDMA, - .sblk = &sdm845_dma_sblk_0, - .xin_id = 1, - .type = SSPP_TYPE_DMA, -@@ -115,7 +115,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = { - }, { - .name = "sspp_9", .id = SSPP_DMA1, - .base = 0x26000, .len = 0x32c, -- .features = DMA_SDM845_MASK, -+ .features = DMA_SDM845_MASK_SDMA, - .sblk = &sdm845_dma_sblk_1, - .xin_id = 5, - .type = SSPP_TYPE_DMA, -@@ -123,7 +123,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = { - }, { - .name = "sspp_10", .id = SSPP_DMA2, - .base = 0x28000, .len = 0x32c, -- .features = DMA_CURSOR_SDM845_MASK, -+ .features = DMA_CURSOR_SDM845_MASK_SDMA, - .sblk = &sdm845_dma_sblk_2, - .xin_id = 9, - .type = SSPP_TYPE_DMA, -@@ -131,7 +131,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = { - }, { - .name = "sspp_11", .id = SSPP_DMA3, - .base = 0x2a000, .len = 0x32c, -- .features = DMA_CURSOR_SDM845_MASK, -+ .features = DMA_CURSOR_SDM845_MASK_SDMA, - .sblk = &sdm845_dma_sblk_3, - .xin_id = 13, - .type = SSPP_TYPE_DMA, --- -2.43.2 - -From 41a871b26ddb2f835b4ac311d6e082b9eb12ecad Mon Sep 17 00:00:00 2001 -From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Date: Sat, 2 Dec 2023 01:40:25 +0200 -Subject: [PATCH 0317/1501] drm/msm/dpu: populate SSPP scaler block version -Content-Length: 14043 -Lines: 341 - -[ Upstream commit 46b1f1b839cad600de3ad7ed999bd0155c528746 ] - -The function _dpu_hw_sspp_setup_scaler3() passes and -dpu_hw_setup_scaler3() uses scaler_blk.version to determine in which way -the scaler (QSEED3) block should be programmed. However up to now we -were not setting this field. Set it now, splitting the vig_sblk data -which has different version fields. - -Reported-by: Marijn Suijten <marijn.suijten@somainline.org> -Fixes: 9b6f4fedaac2 ("drm/msm/dpu: Add SM6125 support") -Fixes: 27f0df03f3ff ("drm/msm/dpu: Add SM6375 support") -Fixes: 3186acba5cdc ("drm/msm/dpu: Add SM6350 support") -Fixes: efcd0107727c ("drm/msm/dpu: add support for SM8550") -Fixes: 4a352c2fc15a ("drm/msm/dpu: Introduce SC8280XP") -Fixes: 0e91bcbb0016 ("drm/msm/dpu: Add SM8350 to hw catalog") -Fixes: 100d7ef6995d ("drm/msm/dpu: add support for SM8450") -Fixes: 3581b7062cec ("drm/msm/disp/dpu1: add support for display on SM6115") -Fixes: dabfdd89eaa9 ("drm/msm/disp/dpu1: add inline rotation support for sc7280") -Fixes: f3af2d6ee9ab ("drm/msm/dpu: Add SC8180x to hw catalog") -Fixes: 94391a14fc27 ("drm/msm/dpu1: Add MSM8998 to hw catalog") -Fixes: af776a3e1c30 ("drm/msm/dpu: add SM8250 to hw catalog") -Fixes: 386fced3f76f ("drm/msm/dpu: add SM8150 to hw catalog") -Fixes: b75ab05a3479 ("msm:disp:dpu1: add scaler support on SC7180 display") -Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") -Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Patchwork: https://patchwork.freedesktop.org/patch/570098/ -Link: https://lore.kernel.org/r/20231201234234.2065610-2-dmitry.baryshkov@linaro.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../msm/disp/dpu1/catalog/dpu_5_0_sm8150.h | 8 +- - .../msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h | 8 +- - .../msm/disp/dpu1/catalog/dpu_8_1_sm8450.h | 8 +- - .../gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 95 ++++++++++++++----- - .../gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h | 3 +- - 5 files changed, 87 insertions(+), 35 deletions(-) - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h -index 9392ad2b4d3f..c022e57864a4 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h -@@ -77,7 +77,7 @@ static const struct dpu_sspp_cfg sm8150_sspp[] = { - .name = "sspp_0", .id = SSPP_VIG0, - .base = 0x4000, .len = 0x1f0, - .features = VIG_SDM845_MASK, -- .sblk = &sdm845_vig_sblk_0, -+ .sblk = &sm8150_vig_sblk_0, - .xin_id = 0, - .type = SSPP_TYPE_VIG, - .clk_ctrl = DPU_CLK_CTRL_VIG0, -@@ -85,7 +85,7 @@ static const struct dpu_sspp_cfg sm8150_sspp[] = { - .name = "sspp_1", .id = SSPP_VIG1, - .base = 0x6000, .len = 0x1f0, - .features = VIG_SDM845_MASK, -- .sblk = &sdm845_vig_sblk_1, -+ .sblk = &sm8150_vig_sblk_1, - .xin_id = 4, - .type = SSPP_TYPE_VIG, - .clk_ctrl = DPU_CLK_CTRL_VIG1, -@@ -93,7 +93,7 @@ static const struct dpu_sspp_cfg sm8150_sspp[] = { - .name = "sspp_2", .id = SSPP_VIG2, - .base = 0x8000, .len = 0x1f0, - .features = VIG_SDM845_MASK, -- .sblk = &sdm845_vig_sblk_2, -+ .sblk = &sm8150_vig_sblk_2, - .xin_id = 8, - .type = SSPP_TYPE_VIG, - .clk_ctrl = DPU_CLK_CTRL_VIG2, -@@ -101,7 +101,7 @@ static const struct dpu_sspp_cfg sm8150_sspp[] = { - .name = "sspp_3", .id = SSPP_VIG3, - .base = 0xa000, .len = 0x1f0, - .features = VIG_SDM845_MASK, -- .sblk = &sdm845_vig_sblk_3, -+ .sblk = &sm8150_vig_sblk_3, - .xin_id = 12, - .type = SSPP_TYPE_VIG, - .clk_ctrl = DPU_CLK_CTRL_VIG3, -diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h -index 9ffc8804a6fc..cb0758f0829d 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h -@@ -76,7 +76,7 @@ static const struct dpu_sspp_cfg sc8180x_sspp[] = { - .name = "sspp_0", .id = SSPP_VIG0, - .base = 0x4000, .len = 0x1f0, - .features = VIG_SDM845_MASK, -- .sblk = &sdm845_vig_sblk_0, -+ .sblk = &sm8150_vig_sblk_0, - .xin_id = 0, - .type = SSPP_TYPE_VIG, - .clk_ctrl = DPU_CLK_CTRL_VIG0, -@@ -84,7 +84,7 @@ static const struct dpu_sspp_cfg sc8180x_sspp[] = { - .name = "sspp_1", .id = SSPP_VIG1, - .base = 0x6000, .len = 0x1f0, - .features = VIG_SDM845_MASK, -- .sblk = &sdm845_vig_sblk_1, -+ .sblk = &sm8150_vig_sblk_1, - .xin_id = 4, - .type = SSPP_TYPE_VIG, - .clk_ctrl = DPU_CLK_CTRL_VIG1, -@@ -92,7 +92,7 @@ static const struct dpu_sspp_cfg sc8180x_sspp[] = { - .name = "sspp_2", .id = SSPP_VIG2, - .base = 0x8000, .len = 0x1f0, - .features = VIG_SDM845_MASK, -- .sblk = &sdm845_vig_sblk_2, -+ .sblk = &sm8150_vig_sblk_2, - .xin_id = 8, - .type = SSPP_TYPE_VIG, - .clk_ctrl = DPU_CLK_CTRL_VIG2, -@@ -100,7 +100,7 @@ static const struct dpu_sspp_cfg sc8180x_sspp[] = { - .name = "sspp_3", .id = SSPP_VIG3, - .base = 0xa000, .len = 0x1f0, - .features = VIG_SDM845_MASK, -- .sblk = &sdm845_vig_sblk_3, -+ .sblk = &sm8150_vig_sblk_3, - .xin_id = 12, - .type = SSPP_TYPE_VIG, - .clk_ctrl = DPU_CLK_CTRL_VIG3, -diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h -index d18145c226da..72b0f547242f 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h -@@ -76,7 +76,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = { - .name = "sspp_0", .id = SSPP_VIG0, - .base = 0x4000, .len = 0x32c, - .features = VIG_SC7180_MASK_SDMA, -- .sblk = &sm8250_vig_sblk_0, -+ .sblk = &sm8450_vig_sblk_0, - .xin_id = 0, - .type = SSPP_TYPE_VIG, - .clk_ctrl = DPU_CLK_CTRL_VIG0, -@@ -84,7 +84,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = { - .name = "sspp_1", .id = SSPP_VIG1, - .base = 0x6000, .len = 0x32c, - .features = VIG_SC7180_MASK_SDMA, -- .sblk = &sm8250_vig_sblk_1, -+ .sblk = &sm8450_vig_sblk_1, - .xin_id = 4, - .type = SSPP_TYPE_VIG, - .clk_ctrl = DPU_CLK_CTRL_VIG1, -@@ -92,7 +92,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = { - .name = "sspp_2", .id = SSPP_VIG2, - .base = 0x8000, .len = 0x32c, - .features = VIG_SC7180_MASK_SDMA, -- .sblk = &sm8250_vig_sblk_2, -+ .sblk = &sm8450_vig_sblk_2, - .xin_id = 8, - .type = SSPP_TYPE_VIG, - .clk_ctrl = DPU_CLK_CTRL_VIG2, -@@ -100,7 +100,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = { - .name = "sspp_3", .id = SSPP_VIG3, - .base = 0xa000, .len = 0x32c, - .features = VIG_SC7180_MASK_SDMA, -- .sblk = &sm8250_vig_sblk_3, -+ .sblk = &sm8450_vig_sblk_3, - .xin_id = 12, - .type = SSPP_TYPE_VIG, - .clk_ctrl = DPU_CLK_CTRL_VIG3, -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c -index a1aada630780..7056c08b9957 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c -@@ -249,14 +249,17 @@ static const uint32_t wb2_formats[] = { - * SSPP sub blocks config - *************************************************************/ - -+#define SSPP_SCALER_VER(maj, min) (((maj) << 16) | (min)) -+ - /* SSPP common configuration */ --#define _VIG_SBLK(sdma_pri, qseed_ver) \ -+#define _VIG_SBLK(sdma_pri, qseed_ver, scaler_ver) \ - { \ - .maxdwnscale = MAX_DOWNSCALE_RATIO, \ - .maxupscale = MAX_UPSCALE_RATIO, \ - .smart_dma_priority = sdma_pri, \ - .scaler_blk = {.name = "scaler", \ - .id = qseed_ver, \ -+ .version = scaler_ver, \ - .base = 0xa00, .len = 0xa0,}, \ - .csc_blk = {.name = "csc", \ - .id = DPU_SSPP_CSC_10BIT, \ -@@ -268,13 +271,14 @@ static const uint32_t wb2_formats[] = { - .rotation_cfg = NULL, \ - } - --#define _VIG_SBLK_ROT(sdma_pri, qseed_ver, rot_cfg) \ -+#define _VIG_SBLK_ROT(sdma_pri, qseed_ver, scaler_ver, rot_cfg) \ - { \ - .maxdwnscale = MAX_DOWNSCALE_RATIO, \ - .maxupscale = MAX_UPSCALE_RATIO, \ - .smart_dma_priority = sdma_pri, \ - .scaler_blk = {.name = "scaler", \ - .id = qseed_ver, \ -+ .version = scaler_ver, \ - .base = 0xa00, .len = 0xa0,}, \ - .csc_blk = {.name = "csc", \ - .id = DPU_SSPP_CSC_10BIT, \ -@@ -298,13 +302,17 @@ static const uint32_t wb2_formats[] = { - } - - static const struct dpu_sspp_sub_blks msm8998_vig_sblk_0 = -- _VIG_SBLK(0, DPU_SSPP_SCALER_QSEED3); -+ _VIG_SBLK(0, DPU_SSPP_SCALER_QSEED3, -+ SSPP_SCALER_VER(1, 2)); - static const struct dpu_sspp_sub_blks msm8998_vig_sblk_1 = -- _VIG_SBLK(0, DPU_SSPP_SCALER_QSEED3); -+ _VIG_SBLK(0, DPU_SSPP_SCALER_QSEED3, -+ SSPP_SCALER_VER(1, 2)); - static const struct dpu_sspp_sub_blks msm8998_vig_sblk_2 = -- _VIG_SBLK(0, DPU_SSPP_SCALER_QSEED3); -+ _VIG_SBLK(0, DPU_SSPP_SCALER_QSEED3, -+ SSPP_SCALER_VER(1, 2)); - static const struct dpu_sspp_sub_blks msm8998_vig_sblk_3 = -- _VIG_SBLK(0, DPU_SSPP_SCALER_QSEED3); -+ _VIG_SBLK(0, DPU_SSPP_SCALER_QSEED3, -+ SSPP_SCALER_VER(1, 2)); - - static const struct dpu_rotation_cfg dpu_rot_sc7280_cfg_v2 = { - .rot_maxheight = 1088, -@@ -313,13 +321,30 @@ static const struct dpu_rotation_cfg dpu_rot_sc7280_cfg_v2 = { - }; - - static const struct dpu_sspp_sub_blks sdm845_vig_sblk_0 = -- _VIG_SBLK(5, DPU_SSPP_SCALER_QSEED3); -+ _VIG_SBLK(5, DPU_SSPP_SCALER_QSEED3, -+ SSPP_SCALER_VER(1, 3)); - static const struct dpu_sspp_sub_blks sdm845_vig_sblk_1 = -- _VIG_SBLK(6, DPU_SSPP_SCALER_QSEED3); -+ _VIG_SBLK(6, DPU_SSPP_SCALER_QSEED3, -+ SSPP_SCALER_VER(1, 3)); - static const struct dpu_sspp_sub_blks sdm845_vig_sblk_2 = -- _VIG_SBLK(7, DPU_SSPP_SCALER_QSEED3); -+ _VIG_SBLK(7, DPU_SSPP_SCALER_QSEED3, -+ SSPP_SCALER_VER(1, 3)); - static const struct dpu_sspp_sub_blks sdm845_vig_sblk_3 = -- _VIG_SBLK(8, DPU_SSPP_SCALER_QSEED3); -+ _VIG_SBLK(8, DPU_SSPP_SCALER_QSEED3, -+ SSPP_SCALER_VER(1, 3)); -+ -+static const struct dpu_sspp_sub_blks sm8150_vig_sblk_0 = -+ _VIG_SBLK(5, DPU_SSPP_SCALER_QSEED3, -+ SSPP_SCALER_VER(1, 4)); -+static const struct dpu_sspp_sub_blks sm8150_vig_sblk_1 = -+ _VIG_SBLK(6, DPU_SSPP_SCALER_QSEED3, -+ SSPP_SCALER_VER(1, 4)); -+static const struct dpu_sspp_sub_blks sm8150_vig_sblk_2 = -+ _VIG_SBLK(7, DPU_SSPP_SCALER_QSEED3, -+ SSPP_SCALER_VER(1, 4)); -+static const struct dpu_sspp_sub_blks sm8150_vig_sblk_3 = -+ _VIG_SBLK(8, DPU_SSPP_SCALER_QSEED3, -+ SSPP_SCALER_VER(1, 4)); - - static const struct dpu_sspp_sub_blks sdm845_dma_sblk_0 = _DMA_SBLK(1); - static const struct dpu_sspp_sub_blks sdm845_dma_sblk_1 = _DMA_SBLK(2); -@@ -327,34 +352,60 @@ static const struct dpu_sspp_sub_blks sdm845_dma_sblk_2 = _DMA_SBLK(3); - static const struct dpu_sspp_sub_blks sdm845_dma_sblk_3 = _DMA_SBLK(4); - - static const struct dpu_sspp_sub_blks sc7180_vig_sblk_0 = -- _VIG_SBLK(4, DPU_SSPP_SCALER_QSEED4); -+ _VIG_SBLK(4, DPU_SSPP_SCALER_QSEED4, -+ SSPP_SCALER_VER(3, 0)); - - static const struct dpu_sspp_sub_blks sc7280_vig_sblk_0 = -- _VIG_SBLK_ROT(4, DPU_SSPP_SCALER_QSEED4, &dpu_rot_sc7280_cfg_v2); -+ _VIG_SBLK_ROT(4, DPU_SSPP_SCALER_QSEED4, -+ SSPP_SCALER_VER(3, 0), -+ &dpu_rot_sc7280_cfg_v2); - - static const struct dpu_sspp_sub_blks sm6115_vig_sblk_0 = -- _VIG_SBLK(2, DPU_SSPP_SCALER_QSEED4); -+ _VIG_SBLK(2, DPU_SSPP_SCALER_QSEED4, -+ SSPP_SCALER_VER(3, 0)); - - static const struct dpu_sspp_sub_blks sm6125_vig_sblk_0 = -- _VIG_SBLK(3, DPU_SSPP_SCALER_QSEED3LITE); -+ _VIG_SBLK(3, DPU_SSPP_SCALER_QSEED3LITE, -+ SSPP_SCALER_VER(2, 4)); - - static const struct dpu_sspp_sub_blks sm8250_vig_sblk_0 = -- _VIG_SBLK(5, DPU_SSPP_SCALER_QSEED4); -+ _VIG_SBLK(5, DPU_SSPP_SCALER_QSEED4, -+ SSPP_SCALER_VER(3, 0)); - static const struct dpu_sspp_sub_blks sm8250_vig_sblk_1 = -- _VIG_SBLK(6, DPU_SSPP_SCALER_QSEED4); -+ _VIG_SBLK(6, DPU_SSPP_SCALER_QSEED4, -+ SSPP_SCALER_VER(3, 0)); - static const struct dpu_sspp_sub_blks sm8250_vig_sblk_2 = -- _VIG_SBLK(7, DPU_SSPP_SCALER_QSEED4); -+ _VIG_SBLK(7, DPU_SSPP_SCALER_QSEED4, -+ SSPP_SCALER_VER(3, 0)); - static const struct dpu_sspp_sub_blks sm8250_vig_sblk_3 = -- _VIG_SBLK(8, DPU_SSPP_SCALER_QSEED4); -+ _VIG_SBLK(8, DPU_SSPP_SCALER_QSEED4, -+ SSPP_SCALER_VER(3, 0)); -+ -+static const struct dpu_sspp_sub_blks sm8450_vig_sblk_0 = -+ _VIG_SBLK(5, DPU_SSPP_SCALER_QSEED4, -+ SSPP_SCALER_VER(3, 1)); -+static const struct dpu_sspp_sub_blks sm8450_vig_sblk_1 = -+ _VIG_SBLK(6, DPU_SSPP_SCALER_QSEED4, -+ SSPP_SCALER_VER(3, 1)); -+static const struct dpu_sspp_sub_blks sm8450_vig_sblk_2 = -+ _VIG_SBLK(7, DPU_SSPP_SCALER_QSEED4, -+ SSPP_SCALER_VER(3, 1)); -+static const struct dpu_sspp_sub_blks sm8450_vig_sblk_3 = -+ _VIG_SBLK(8, DPU_SSPP_SCALER_QSEED4, -+ SSPP_SCALER_VER(3, 1)); - - static const struct dpu_sspp_sub_blks sm8550_vig_sblk_0 = -- _VIG_SBLK(7, DPU_SSPP_SCALER_QSEED4); -+ _VIG_SBLK(7, DPU_SSPP_SCALER_QSEED4, -+ SSPP_SCALER_VER(3, 2)); - static const struct dpu_sspp_sub_blks sm8550_vig_sblk_1 = -- _VIG_SBLK(8, DPU_SSPP_SCALER_QSEED4); -+ _VIG_SBLK(8, DPU_SSPP_SCALER_QSEED4, -+ SSPP_SCALER_VER(3, 2)); - static const struct dpu_sspp_sub_blks sm8550_vig_sblk_2 = -- _VIG_SBLK(9, DPU_SSPP_SCALER_QSEED4); -+ _VIG_SBLK(9, DPU_SSPP_SCALER_QSEED4, -+ SSPP_SCALER_VER(3, 2)); - static const struct dpu_sspp_sub_blks sm8550_vig_sblk_3 = -- _VIG_SBLK(10, DPU_SSPP_SCALER_QSEED4); -+ _VIG_SBLK(10, DPU_SSPP_SCALER_QSEED4, -+ SSPP_SCALER_VER(3, 2)); - static const struct dpu_sspp_sub_blks sm8550_dma_sblk_4 = _DMA_SBLK(5); - static const struct dpu_sspp_sub_blks sm8550_dma_sblk_5 = _DMA_SBLK(6); - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h -index df024e10d3a3..62445075306a 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h -@@ -265,7 +265,8 @@ enum { - /** - * struct dpu_scaler_blk: Scaler information - * @info: HW register and features supported by this sub-blk -- * @version: qseed block revision -+ * @version: qseed block revision, on QSEED3+ platforms this is the value of -+ * scaler_blk.base + QSEED3_HW_VERSION registers. - */ - struct dpu_scaler_blk { - DPU_HW_SUBBLK_INFO; --- -2.43.2 - -From bca0a5845ddc883310dcd1175bd533d8e90dd52f Mon Sep 17 00:00:00 2001 -From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> -Date: Mon, 4 Dec 2023 12:42:13 +0100 -Subject: [PATCH 0318/1501] drm/panfrost: Ignore core_mask for poweroff and - disable PWRTRANS irq -Content-Length: 3318 -Lines: 76 - -[ Upstream commit a4f5892914ca7709ea6d191f0edace93a5935966 ] - -Some SoCs may be equipped with a GPU containing two core groups -and this is exactly the case of Samsung's Exynos 5422 featuring -an ARM Mali-T628 MP6 GPU: the support for this GPU in Panfrost -is partial, as this driver currently supports using only one -core group and that's reflected on all parts of it, including -the power on (and power off, previously to this patch) function. - -The issue with this is that even though executing the soft reset -operation should power off all cores unconditionally, on at least -one platform we're seeing a crash that seems to be happening due -to an interrupt firing which may be because we are calling power -transition only on the first core group, leaving the second one -unchanged, or because ISR execution was pending before entering -the panfrost_gpu_power_off() function and executed after powering -off the GPU cores, or all of the above. - -Finally, solve this by: - - Avoid to enable the power transition interrupt on reset; and - - Ignoring the core_mask and ask the GPU to poweroff both core groups - -Fixes: 22aa1a209018 ("drm/panfrost: Really power off GPU cores in panfrost_gpu_power_off()") -Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> -Reviewed-by: Steven Price <steven.price@arm.com> -Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> -Tested-by: Marek Szyprowski <m.szyprowski@samsung.com> -Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20231204114215.54575-2-angelogioacchino.delregno@collabora.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/panfrost/panfrost_gpu.c | 12 ++++++++---- - 1 file changed, 8 insertions(+), 4 deletions(-) - -diff --git a/drivers/gpu/drm/panfrost/panfrost_gpu.c b/drivers/gpu/drm/panfrost/panfrost_gpu.c -index 97f097ee5c1d..311cf4525e1e 100644 ---- a/drivers/gpu/drm/panfrost/panfrost_gpu.c -+++ b/drivers/gpu/drm/panfrost/panfrost_gpu.c -@@ -71,7 +71,12 @@ int panfrost_gpu_soft_reset(struct panfrost_device *pfdev) - } - - gpu_write(pfdev, GPU_INT_CLEAR, GPU_IRQ_MASK_ALL); -- gpu_write(pfdev, GPU_INT_MASK, GPU_IRQ_MASK_ALL); -+ -+ /* Only enable the interrupts we care about */ -+ gpu_write(pfdev, GPU_INT_MASK, -+ GPU_IRQ_MASK_ERROR | -+ GPU_IRQ_PERFCNT_SAMPLE_COMPLETED | -+ GPU_IRQ_CLEAN_CACHES_COMPLETED); - - /* - * All in-flight jobs should have released their cycle -@@ -418,11 +423,10 @@ void panfrost_gpu_power_on(struct panfrost_device *pfdev) - - void panfrost_gpu_power_off(struct panfrost_device *pfdev) - { -- u64 core_mask = panfrost_get_core_mask(pfdev); - int ret; - u32 val; - -- gpu_write(pfdev, SHADER_PWROFF_LO, pfdev->features.shader_present & core_mask); -+ gpu_write(pfdev, SHADER_PWROFF_LO, pfdev->features.shader_present); - ret = readl_relaxed_poll_timeout(pfdev->iomem + SHADER_PWRTRANS_LO, - val, !val, 1, 1000); - if (ret) -@@ -434,7 +438,7 @@ void panfrost_gpu_power_off(struct panfrost_device *pfdev) - if (ret) - dev_err(pfdev->dev, "tiler power transition timeout"); - -- gpu_write(pfdev, L2_PWROFF_LO, pfdev->features.l2_present & core_mask); -+ gpu_write(pfdev, L2_PWROFF_LO, pfdev->features.l2_present); - ret = readl_poll_timeout(pfdev->iomem + L2_PWRTRANS_LO, - val, !val, 0, 1000); - if (ret) --- -2.43.2 - -From 34a6f2c905e31775fd7ebb56804d27d03203ea57 Mon Sep 17 00:00:00 2001 -From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Date: Sun, 3 Dec 2023 03:24:37 +0300 -Subject: [PATCH 0319/1501] drm/msm/dpu: correct clk bit for WB2 block -Content-Length: 3227 -Lines: 66 - -[ Upstream commit e843ca2f30e630675e2d2a75c96f4844f2854430 ] - -On sc7280 there are two clk bits for WB2: vbif_cli and clk_ctrl. While -programming the VBIF params of WB, the driver should be toggling the -former bit, while the sc7180_mdp, sc7280_mdp and sm8250_mdp structs -list the latter one. - -Correct that to ensure proper programming sequence for WB2 on these -platforms. - -Fixes: 255f056181ac ("drm/msm/dpu: sc7180: add missing WB2 clock control") -Fixes: 3ce166380567 ("drm/msm/dpu: add writeback support for sc7280") -Fixes: 53324b99bd7b ("drm/msm/dpu: add writeback blocks to the sm8250 DPU catalog") -Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com> -Tested-by: Paloma Arellano <quic_parellan@quicinc.com> -Patchwork: https://patchwork.freedesktop.org/patch/570185/ -Link: https://lore.kernel.org/r/20231203002437.1291595-1-dmitry.baryshkov@linaro.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_0_sm8250.h | 2 +- - drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_2_sc7180.h | 2 +- - drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_2_sc7280.h | 2 +- - 3 files changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_0_sm8250.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_0_sm8250.h -index 94278a3e3483..9f8068fa0175 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_0_sm8250.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_0_sm8250.h -@@ -32,7 +32,7 @@ static const struct dpu_mdp_cfg sm8250_mdp = { - [DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2bc, .bit_off = 8 }, - [DPU_CLK_CTRL_DMA3] = { .reg_off = 0x2c4, .bit_off = 8 }, - [DPU_CLK_CTRL_REG_DMA] = { .reg_off = 0x2bc, .bit_off = 20 }, -- [DPU_CLK_CTRL_WB2] = { .reg_off = 0x3b8, .bit_off = 24 }, -+ [DPU_CLK_CTRL_WB2] = { .reg_off = 0x2bc, .bit_off = 16 }, - }, - }; - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_2_sc7180.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_2_sc7180.h -index c0d88ddccb28..9bfa15e4e645 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_2_sc7180.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_2_sc7180.h -@@ -25,7 +25,7 @@ static const struct dpu_mdp_cfg sc7180_mdp = { - [DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 }, - [DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 }, - [DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2c4, .bit_off = 8 }, -- [DPU_CLK_CTRL_WB2] = { .reg_off = 0x3b8, .bit_off = 24 }, -+ [DPU_CLK_CTRL_WB2] = { .reg_off = 0x2bc, .bit_off = 16 }, - }, - }; - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_2_sc7280.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_2_sc7280.h -index 15942fa5a8e0..b9c296e51e36 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_2_sc7280.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_2_sc7280.h -@@ -25,7 +25,7 @@ static const struct dpu_mdp_cfg sc7280_mdp = { - [DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 }, - [DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 }, - [DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2c4, .bit_off = 8 }, -- [DPU_CLK_CTRL_WB2] = { .reg_off = 0x3b8, .bit_off = 24 }, -+ [DPU_CLK_CTRL_WB2] = { .reg_off = 0x2bc, .bit_off = 16 }, - }, - }; - --- -2.43.2 - -From 87b2b27e4d7f4022a677a174ab7bc8e978c461cf Mon Sep 17 00:00:00 2001 -From: Harry Wentland <harry.wentland@amd.com> -Date: Fri, 1 Dec 2023 06:25:26 -0700 -Subject: [PATCH 0320/1501] drm/amd/display: Return drm_connector from - find_first_crtc_matching_connector -Content-Length: 4179 -Lines: 99 - -[ Upstream commit 748b091d641638e68330b1b24195eaba9aadf997 ] - -[WHY] -We will be dealing with two types of connector: amdgpu_dm_connector -and drm_writeback_connector. - -[HOW] -We want to find both and then cast to the appriopriate type afterwards. - -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Reviewed-by: Alex Hung <alex.hung@amd.com> -Signed-off-by: Harry Wentland <harry.wentland@amd.com> -Signed-off-by: Alex Hung <alex.hung@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Stable-dep-of: dbf5d3d02987 ("drm/amd/display: Check writeback connectors in create_validate_stream_for_sink") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 +++++--- - drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 2 +- - .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 4 +++- - 3 files changed, 9 insertions(+), 5 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index d8c967cee498..5cf919a489a1 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -2660,7 +2660,7 @@ static int dm_suspend(void *handle) - return 0; - } - --struct amdgpu_dm_connector * -+struct drm_connector * - amdgpu_dm_find_first_crtc_matching_connector(struct drm_atomic_state *state, - struct drm_crtc *crtc) - { -@@ -2673,7 +2673,7 @@ amdgpu_dm_find_first_crtc_matching_connector(struct drm_atomic_state *state, - crtc_from_state = new_con_state->crtc; - - if (crtc_from_state == crtc) -- return to_amdgpu_dm_connector(connector); -+ return connector; - } - - return NULL; -@@ -9354,6 +9354,7 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm, - * update changed items - */ - struct amdgpu_crtc *acrtc = NULL; -+ struct drm_connector *connector = NULL; - struct amdgpu_dm_connector *aconnector = NULL; - struct drm_connector_state *drm_new_conn_state = NULL, *drm_old_conn_state = NULL; - struct dm_connector_state *dm_new_conn_state = NULL, *dm_old_conn_state = NULL; -@@ -9363,7 +9364,8 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm, - dm_old_crtc_state = to_dm_crtc_state(old_crtc_state); - dm_new_crtc_state = to_dm_crtc_state(new_crtc_state); - acrtc = to_amdgpu_crtc(crtc); -- aconnector = amdgpu_dm_find_first_crtc_matching_connector(state, crtc); -+ connector = amdgpu_dm_find_first_crtc_matching_connector(state, crtc); -+ aconnector = to_amdgpu_dm_connector(connector); - - /* TODO This hack should go away */ - if (aconnector && enable) { -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h -index 3d480be802cb..3710f4d0f2cb 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h -@@ -834,7 +834,7 @@ struct dc_stream_state * - int dm_atomic_get_state(struct drm_atomic_state *state, - struct dm_atomic_state **dm_state); - --struct amdgpu_dm_connector * -+struct drm_connector * - amdgpu_dm_find_first_crtc_matching_connector(struct drm_atomic_state *state, - struct drm_crtc *crtc); - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -index 9b71643d8a89..602a2ab98abf 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -@@ -1500,14 +1500,16 @@ int pre_validate_dsc(struct drm_atomic_state *state, - int ind = find_crtc_index_in_state_by_stream(state, stream); - - if (ind >= 0) { -+ struct drm_connector *connector; - struct amdgpu_dm_connector *aconnector; - struct drm_connector_state *drm_new_conn_state; - struct dm_connector_state *dm_new_conn_state; - struct dm_crtc_state *dm_old_crtc_state; - -- aconnector = -+ connector = - amdgpu_dm_find_first_crtc_matching_connector(state, - state->crtcs[ind].ptr); -+ aconnector = to_amdgpu_dm_connector(connector); - drm_new_conn_state = - drm_atomic_get_new_connector_state(state, - &aconnector->base); --- -2.43.2 - -From b1d5fd560cfad6ce5ea0fa549383220961845807 Mon Sep 17 00:00:00 2001 -From: Harry Wentland <harry.wentland@amd.com> -Date: Fri, 1 Dec 2023 06:25:27 -0700 -Subject: [PATCH 0321/1501] drm/amd/display: Use drm_connector in - create_stream_for_sink -Content-Length: 7696 -Lines: 203 - -[ Upstream commit 3e094a2875260543ca74838decc0c995d3765096 ] - -[WHAT] -We need to use this function for both amdgpu_dm_connectors -and drm_writeback_connectors. Modify it to operate on -a drm_connector as a common base. - -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Reviewed-by: Alex Hung <alex.hung@amd.com> -Signed-off-by: Harry Wentland <harry.wentland@amd.com> -Signed-off-by: Alex Hung <alex.hung@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Stable-dep-of: dbf5d3d02987 ("drm/amd/display: Check writeback connectors in create_validate_stream_for_sink") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 65 +++++++++++-------- - 1 file changed, 37 insertions(+), 28 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 5cf919a489a1..beacda24b4ef 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -5527,6 +5527,7 @@ static void fill_stream_properties_from_drm_display_mode( - && stream->signal == SIGNAL_TYPE_HDMI_TYPE_A) - timing_out->pixel_encoding = PIXEL_ENCODING_YCBCR420; - else if (drm_mode_is_420_also(info, mode_in) -+ && aconnector - && aconnector->force_yuv420_output) - timing_out->pixel_encoding = PIXEL_ENCODING_YCBCR420; - else if ((connector->display_info.color_formats & DRM_COLOR_FORMAT_YCBCR444) -@@ -5562,7 +5563,7 @@ static void fill_stream_properties_from_drm_display_mode( - timing_out->hdmi_vic = hv_frame.vic; - } - -- if (is_freesync_video_mode(mode_in, aconnector)) { -+ if (aconnector && is_freesync_video_mode(mode_in, aconnector)) { - timing_out->h_addressable = mode_in->hdisplay; - timing_out->h_total = mode_in->htotal; - timing_out->h_sync_width = mode_in->hsync_end - mode_in->hsync_start; -@@ -6039,14 +6040,14 @@ static void apply_dsc_policy_for_stream(struct amdgpu_dm_connector *aconnector, - } - - static struct dc_stream_state * --create_stream_for_sink(struct amdgpu_dm_connector *aconnector, -+create_stream_for_sink(struct drm_connector *connector, - const struct drm_display_mode *drm_mode, - const struct dm_connector_state *dm_state, - const struct dc_stream_state *old_stream, - int requested_bpc) - { -+ struct amdgpu_dm_connector *aconnector = NULL; - struct drm_display_mode *preferred_mode = NULL; -- struct drm_connector *drm_connector; - const struct drm_connector_state *con_state = &dm_state->base; - struct dc_stream_state *stream = NULL; - struct drm_display_mode mode; -@@ -6065,20 +6066,22 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector, - drm_mode_init(&mode, drm_mode); - memset(&saved_mode, 0, sizeof(saved_mode)); - -- if (aconnector == NULL) { -- DRM_ERROR("aconnector is NULL!\n"); -+ if (connector == NULL) { -+ DRM_ERROR("connector is NULL!\n"); - return stream; - } - -- drm_connector = &aconnector->base; -- -- if (!aconnector->dc_sink) { -- sink = create_fake_sink(aconnector); -- if (!sink) -- return stream; -- } else { -- sink = aconnector->dc_sink; -- dc_sink_retain(sink); -+ if (connector->connector_type != DRM_MODE_CONNECTOR_WRITEBACK) { -+ aconnector = NULL; -+ aconnector = to_amdgpu_dm_connector(connector); -+ if (!aconnector->dc_sink) { -+ sink = create_fake_sink(aconnector); -+ if (!sink) -+ return stream; -+ } else { -+ sink = aconnector->dc_sink; -+ dc_sink_retain(sink); -+ } - } - - stream = dc_create_stream_for_sink(sink); -@@ -6088,12 +6091,13 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector, - goto finish; - } - -+ /* We leave this NULL for writeback connectors */ - stream->dm_stream_context = aconnector; - - stream->timing.flags.LTE_340MCSC_SCRAMBLE = -- drm_connector->display_info.hdmi.scdc.scrambling.low_rates; -+ connector->display_info.hdmi.scdc.scrambling.low_rates; - -- list_for_each_entry(preferred_mode, &aconnector->base.modes, head) { -+ list_for_each_entry(preferred_mode, &connector->modes, head) { - /* Search for preferred mode */ - if (preferred_mode->type & DRM_MODE_TYPE_PREFERRED) { - native_mode_found = true; -@@ -6102,7 +6106,7 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector, - } - if (!native_mode_found) - preferred_mode = list_first_entry_or_null( -- &aconnector->base.modes, -+ &connector->modes, - struct drm_display_mode, - head); - -@@ -6116,7 +6120,7 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector, - * and the modelist may not be filled in time. - */ - DRM_DEBUG_DRIVER("No preferred mode found\n"); -- } else { -+ } else if (aconnector) { - recalculate_timing = is_freesync_video_mode(&mode, aconnector); - if (recalculate_timing) { - freesync_mode = get_highest_refresh_rate_mode(aconnector, false); -@@ -6139,13 +6143,17 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector, - */ - if (!scale || mode_refresh != preferred_refresh) - fill_stream_properties_from_drm_display_mode( -- stream, &mode, &aconnector->base, con_state, NULL, -+ stream, &mode, connector, con_state, NULL, - requested_bpc); - else - fill_stream_properties_from_drm_display_mode( -- stream, &mode, &aconnector->base, con_state, old_stream, -+ stream, &mode, connector, con_state, old_stream, - requested_bpc); - -+ /* The rest isn't needed for writeback connectors */ -+ if (!aconnector) -+ goto finish; -+ - if (aconnector->timing_changed) { - drm_dbg(aconnector->base.dev, - "overriding timing for automated test, bpc %d, changing to %d\n", -@@ -6163,7 +6171,7 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector, - - fill_audio_info( - &stream->audio_info, -- drm_connector, -+ connector, - sink); - - update_stream_signal(stream, sink); -@@ -6633,7 +6641,7 @@ create_validate_stream_for_sink(struct amdgpu_dm_connector *aconnector, - enum dc_status dc_result = DC_OK; - - do { -- stream = create_stream_for_sink(aconnector, drm_mode, -+ stream = create_stream_for_sink(connector, drm_mode, - dm_state, old_stream, - requested_bpc); - if (stream == NULL) { -@@ -9365,15 +9373,16 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm, - dm_new_crtc_state = to_dm_crtc_state(new_crtc_state); - acrtc = to_amdgpu_crtc(crtc); - connector = amdgpu_dm_find_first_crtc_matching_connector(state, crtc); -- aconnector = to_amdgpu_dm_connector(connector); -+ if (connector && connector->connector_type != DRM_MODE_CONNECTOR_WRITEBACK) -+ aconnector = to_amdgpu_dm_connector(connector); - - /* TODO This hack should go away */ -- if (aconnector && enable) { -+ if (connector && enable) { - /* Make sure fake sink is created in plug-in scenario */ - drm_new_conn_state = drm_atomic_get_new_connector_state(state, -- &aconnector->base); -+ connector); - drm_old_conn_state = drm_atomic_get_old_connector_state(state, -- &aconnector->base); -+ connector); - - if (IS_ERR(drm_new_conn_state)) { - ret = PTR_ERR_OR_ZERO(drm_new_conn_state); -@@ -9520,7 +9529,7 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm, - * added MST connectors not found in existing crtc_state in the chained mode - * TODO: need to dig out the root cause of that - */ -- if (!aconnector) -+ if (!connector) - goto skip_modeset; - - if (modereset_required(new_crtc_state)) -@@ -9563,7 +9572,7 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm, - * We want to do dc stream updates that do not require a - * full modeset below. - */ -- if (!(enable && aconnector && new_crtc_state->active)) -+ if (!(enable && connector && new_crtc_state->active)) - return 0; - /* - * Given above conditions, the dc state cannot be NULL because: --- -2.43.2 - -From 0fe85301b95077ac4fa4a91909d38b7341e81187 Mon Sep 17 00:00:00 2001 -From: Alex Hung <alex.hung@amd.com> -Date: Fri, 1 Dec 2023 06:25:28 -0700 -Subject: [PATCH 0322/1501] drm/amd/display: Check writeback connectors in - create_validate_stream_for_sink -Content-Length: 1771 -Lines: 41 - -[ Upstream commit dbf5d3d02987faa0eec3710dd687cd912362d7b5 ] - -[WHY & HOW] -This is to check connector type to avoid -unhandled null pointer for writeback connectors. - -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Fixes: 60e034f28600 ("drm/amd/display: Revert "drm/amd/display: Use drm_connector in create_validate_stream_for_sink"") -Signed-off-by: Alex Hung <alex.hung@amd.com> -Reviewed-by: Harry Wentland <harry.wentland@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index beacda24b4ef..a9bd020b165a 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -6649,6 +6649,9 @@ create_validate_stream_for_sink(struct amdgpu_dm_connector *aconnector, - break; - } - -+ if (aconnector->base.connector_type == DRM_MODE_CONNECTOR_WRITEBACK) -+ return stream; -+ - dc_result = dc_validate_stream(adev->dm.dc, stream); - if (dc_result == DC_OK && stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST) - dc_result = dm_dp_mst_is_port_support_mode(aconnector, stream); -@@ -9373,7 +9376,7 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm, - dm_new_crtc_state = to_dm_crtc_state(new_crtc_state); - acrtc = to_amdgpu_crtc(crtc); - connector = amdgpu_dm_find_first_crtc_matching_connector(state, crtc); -- if (connector && connector->connector_type != DRM_MODE_CONNECTOR_WRITEBACK) -+ if (connector) - aconnector = to_amdgpu_dm_connector(connector); - - /* TODO This hack should go away */ --- -2.43.2 - -From fb2d8bc9b5e55848b8a7c3c028e2ee8d49f28f97 Mon Sep 17 00:00:00 2001 -From: Yang Yingliang <yangyingliang@huawei.com> -Date: Thu, 30 Nov 2023 15:50:16 +0800 -Subject: [PATCH 0323/1501] drm/radeon: check the alloc_workqueue return value - in radeon_crtc_init() -Content-Length: 1307 -Lines: 37 - -[ Upstream commit 7a2464fac80d42f6f8819fed97a553e9c2f43310 ] - -check the alloc_workqueue return value in radeon_crtc_init() -to avoid null-ptr-deref. - -Fixes: fa7f517cb26e ("drm/radeon: rework page flip handling v4") -Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/radeon/radeon_display.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c -index 901e75ec70ff..efd18c8d84c8 100644 ---- a/drivers/gpu/drm/radeon/radeon_display.c -+++ b/drivers/gpu/drm/radeon/radeon_display.c -@@ -687,11 +687,16 @@ static void radeon_crtc_init(struct drm_device *dev, int index) - if (radeon_crtc == NULL) - return; - -+ radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0); -+ if (!radeon_crtc->flip_queue) { -+ kfree(radeon_crtc); -+ return; -+ } -+ - drm_crtc_init(dev, &radeon_crtc->base, &radeon_crtc_funcs); - - drm_mode_crtc_set_gamma_size(&radeon_crtc->base, 256); - radeon_crtc->crtc_id = index; -- radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0); - rdev->mode_info.crtcs[index] = radeon_crtc; - - if (rdev->family >= CHIP_BONAIRE) { --- -2.43.2 - -From a0a5f90bed2d69553c8fa7009c2ca1380962b90d Mon Sep 17 00:00:00 2001 -From: Zhipeng Lu <alexious@zju.edu.cn> -Date: Mon, 4 Dec 2023 16:57:56 +0800 -Subject: [PATCH 0324/1501] drm/radeon/dpm: fix a memleak in - sumo_parse_power_table -Content-Length: 1355 -Lines: 33 - -[ Upstream commit 0737df9ed0997f5b8addd6e2b9699a8c6edba2e4 ] - -The rdev->pm.dpm.ps allocated by kcalloc should be freed in every -following error-handling path. However, in the error-handling of -rdev->pm.power_state[i].clock_info the rdev->pm.dpm.ps is not freed, -resulting in a memleak in this function. - -Fixes: 80ea2c129c76 ("drm/radeon/kms: add dpm support for sumo asics (v2)") -Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/radeon/sumo_dpm.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c -index f74f381af05f..d49c145db437 100644 ---- a/drivers/gpu/drm/radeon/sumo_dpm.c -+++ b/drivers/gpu/drm/radeon/sumo_dpm.c -@@ -1493,8 +1493,10 @@ static int sumo_parse_power_table(struct radeon_device *rdev) - non_clock_array_index = power_state->v2.nonClockInfoIndex; - non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) - &non_clock_info_array->nonClockInfo[non_clock_array_index]; -- if (!rdev->pm.power_state[i].clock_info) -+ if (!rdev->pm.power_state[i].clock_info) { -+ kfree(rdev->pm.dpm.ps); - return -EINVAL; -+ } - ps = kzalloc(sizeof(struct sumo_ps), GFP_KERNEL); - if (ps == NULL) { - kfree(rdev->pm.dpm.ps); --- -2.43.2 - -From bb47d0f411fa0005024a843bf287d734c4cf92e9 Mon Sep 17 00:00:00 2001 -From: Zhipeng Lu <alexious@zju.edu.cn> -Date: Mon, 4 Dec 2023 18:21:54 +0800 -Subject: [PATCH 0325/1501] drm/radeon/trinity_dpm: fix a memleak in - trinity_parse_power_table -Content-Length: 1371 -Lines: 33 - -[ Upstream commit 28c28d7f77c06ac2c0b8f9c82bc04eba22912b3b ] - -The rdev->pm.dpm.ps allocated by kcalloc should be freed in every -following error-handling path. However, in the error-handling of -rdev->pm.power_state[i].clock_info the rdev->pm.dpm.ps is not freed, -resulting in a memleak in this function. - -Fixes: d70229f70447 ("drm/radeon/kms: add dpm support for trinity asics") -Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/radeon/trinity_dpm.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c -index 08ea1c864cb2..ef1cc7bad20a 100644 ---- a/drivers/gpu/drm/radeon/trinity_dpm.c -+++ b/drivers/gpu/drm/radeon/trinity_dpm.c -@@ -1726,8 +1726,10 @@ static int trinity_parse_power_table(struct radeon_device *rdev) - non_clock_array_index = power_state->v2.nonClockInfoIndex; - non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) - &non_clock_info_array->nonClockInfo[non_clock_array_index]; -- if (!rdev->pm.power_state[i].clock_info) -+ if (!rdev->pm.power_state[i].clock_info) { -+ kfree(rdev->pm.dpm.ps); - return -EINVAL; -+ } - ps = kzalloc(sizeof(struct sumo_ps), GFP_KERNEL); - if (ps == NULL) { - kfree(rdev->pm.dpm.ps); --- -2.43.2 - -From ab2630da0be54c11eb2453f6638491d88510d2d7 Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Fri, 3 Nov 2023 15:14:05 +0200 -Subject: [PATCH 0326/1501] drm/bridge: cdns-mhdp8546: Fix use of uninitialized - variable -Content-Length: 1182 -Lines: 30 - -[ Upstream commit 155d6fb61270dd297f128731cd155080deee8f3a ] - -'ret' could be uninitialized at the end of the function, although it's -not clear if that can happen in practice. - -Fixes: 6a3608eae6d3 ("drm: bridge: cdns-mhdp8546: Enable HDCP") -Acked-by: Maxime Ripard <mripard@kernel.org> -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20231103-uninit-fixes-v2-3-c22b2444f5f5@ideasonboard.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c -index 946212a95598..5e3b8edcf794 100644 ---- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c -+++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c -@@ -403,7 +403,8 @@ static int _cdns_mhdp_hdcp_disable(struct cdns_mhdp_device *mhdp) - - static int _cdns_mhdp_hdcp_enable(struct cdns_mhdp_device *mhdp, u8 content_type) - { -- int ret, tries = 3; -+ int ret = -EINVAL; -+ int tries = 3; - u32 i; - - for (i = 0; i < tries; i++) { --- -2.43.2 - -From 80a7e72a98491003a8c6e0ab427876eff1043119 Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Fri, 3 Nov 2023 15:14:06 +0200 -Subject: [PATCH 0327/1501] drm/bridge: tc358767: Fix return value on error - case -Content-Length: 1055 -Lines: 31 - -[ Upstream commit 32bd29b619638256c5b75fb021d6d9f12fc4a984 ] - -If the hpd_pin is invalid, the driver returns 'ret'. But 'ret' contains -0, instead of an error value. - -Return -EINVAL instead. - -Fixes: f25ee5017e4f ("drm/bridge: tc358767: add IRQ and HPD support") -Acked-by: Maxime Ripard <mripard@kernel.org> -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20231103-uninit-fixes-v2-4-c22b2444f5f5@ideasonboard.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/bridge/tc358767.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c -index ef2e373606ba..615cc8f950d7 100644 ---- a/drivers/gpu/drm/bridge/tc358767.c -+++ b/drivers/gpu/drm/bridge/tc358767.c -@@ -2273,7 +2273,7 @@ static int tc_probe(struct i2c_client *client) - } else { - if (tc->hpd_pin < 0 || tc->hpd_pin > 1) { - dev_err(dev, "failed to parse HPD number\n"); -- return ret; -+ return -EINVAL; - } - } - --- -2.43.2 - -From 2ab6c2d41511f2996e8d738866abb25bf9d53184 Mon Sep 17 00:00:00 2001 -From: Zhipeng Lu <alexious@zju.edu.cn> -Date: Fri, 1 Dec 2023 21:22:55 +0800 -Subject: [PATCH 0328/1501] media: cx231xx: fix a memleak in cx231xx_init_isoc -Content-Length: 1676 -Lines: 43 - -[ Upstream commit 5d3c8990e2bbf929cb211563dadd70708f42e4e6 ] - -The dma_q->p_left_data alloced by kzalloc should be freed in all the -following error handling paths. However, it hasn't been freed in the -allocation error paths of dev->video_mode.isoc_ctl.urb and -dev->video_mode.isoc_ctl.transfer_buffer. - -On the other hand, the dma_q->p_left_data did be freed in the -error-handling paths after that of dev->video_mode.isoc_ctl.urb and -dev->video_mode.isoc_ctl.transfer_buffer, by calling -cx231xx_uninit_isoc(dev). So the same free operation should be done in -error-handling paths of those two allocation. - -Fixes: 64fbf4445526 ("[media] cx231xx: Added support for Carraera, Shelby, RDx_253S and VIDEO_GRABBER") -Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/usb/cx231xx/cx231xx-core.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/media/usb/cx231xx/cx231xx-core.c b/drivers/media/usb/cx231xx/cx231xx-core.c -index 7b7e2a26ef93..d8312201694f 100644 ---- a/drivers/media/usb/cx231xx/cx231xx-core.c -+++ b/drivers/media/usb/cx231xx/cx231xx-core.c -@@ -1023,6 +1023,7 @@ int cx231xx_init_isoc(struct cx231xx *dev, int max_packets, - if (!dev->video_mode.isoc_ctl.urb) { - dev_err(dev->dev, - "cannot alloc memory for usb buffers\n"); -+ kfree(dma_q->p_left_data); - return -ENOMEM; - } - -@@ -1032,6 +1033,7 @@ int cx231xx_init_isoc(struct cx231xx *dev, int max_packets, - dev_err(dev->dev, - "cannot allocate memory for usbtransfer\n"); - kfree(dev->video_mode.isoc_ctl.urb); -+ kfree(dma_q->p_left_data); - return -ENOMEM; - } - --- -2.43.2 - -From 1344e4c43bf66be7e2467a9a4484ee0dae82e9cc Mon Sep 17 00:00:00 2001 -From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> -Date: Mon, 4 Dec 2023 15:27:09 -0600 -Subject: [PATCH 0329/1501] ASoC: SOF: Intel: pci-mtl: fix ARL-S definitions -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 4656 -Lines: 118 - -[ Upstream commit a00be6dc9bb80796244196033aa5eb258b6af47a ] - -The initial copy/paste from MTL was incorrect, the hardware is -different and requires different descriptors along with a dedicated -firmware binary. - -Fixes: 3851831f529e ("ASoC: SOF: Intel: pci-mtl: use ARL specific firmware definitions") -Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> -Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com> -Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com> -Acked-by: Mark Brown <broonie@kernel.org> -Link: https://lore.kernel.org/r/20231204212710.185976-5-pierre-louis.bossart@linux.intel.com -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - sound/soc/sof/intel/hda.h | 1 + - sound/soc/sof/intel/mtl.c | 28 ++++++++++++++++++++++++++++ - sound/soc/sof/intel/pci-mtl.c | 12 ++++++------ - 3 files changed, 35 insertions(+), 6 deletions(-) - -diff --git a/sound/soc/sof/intel/hda.h b/sound/soc/sof/intel/hda.h -index d628d6a3a7e5..1592e27bc14d 100644 ---- a/sound/soc/sof/intel/hda.h -+++ b/sound/soc/sof/intel/hda.h -@@ -882,6 +882,7 @@ extern const struct sof_intel_dsp_desc ehl_chip_info; - extern const struct sof_intel_dsp_desc jsl_chip_info; - extern const struct sof_intel_dsp_desc adls_chip_info; - extern const struct sof_intel_dsp_desc mtl_chip_info; -+extern const struct sof_intel_dsp_desc arl_s_chip_info; - extern const struct sof_intel_dsp_desc lnl_chip_info; - - /* Probes support */ -diff --git a/sound/soc/sof/intel/mtl.c b/sound/soc/sof/intel/mtl.c -index 254dbbeac1d0..7946110e7adf 100644 ---- a/sound/soc/sof/intel/mtl.c -+++ b/sound/soc/sof/intel/mtl.c -@@ -746,3 +746,31 @@ const struct sof_intel_dsp_desc mtl_chip_info = { - .hw_ip_version = SOF_INTEL_ACE_1_0, - }; - EXPORT_SYMBOL_NS(mtl_chip_info, SND_SOC_SOF_INTEL_HDA_COMMON); -+ -+const struct sof_intel_dsp_desc arl_s_chip_info = { -+ .cores_num = 2, -+ .init_core_mask = BIT(0), -+ .host_managed_cores_mask = BIT(0), -+ .ipc_req = MTL_DSP_REG_HFIPCXIDR, -+ .ipc_req_mask = MTL_DSP_REG_HFIPCXIDR_BUSY, -+ .ipc_ack = MTL_DSP_REG_HFIPCXIDA, -+ .ipc_ack_mask = MTL_DSP_REG_HFIPCXIDA_DONE, -+ .ipc_ctl = MTL_DSP_REG_HFIPCXCTL, -+ .rom_status_reg = MTL_DSP_ROM_STS, -+ .rom_init_timeout = 300, -+ .ssp_count = MTL_SSP_COUNT, -+ .ssp_base_offset = CNL_SSP_BASE_OFFSET, -+ .sdw_shim_base = SDW_SHIM_BASE_ACE, -+ .sdw_alh_base = SDW_ALH_BASE_ACE, -+ .d0i3_offset = MTL_HDA_VS_D0I3C, -+ .read_sdw_lcount = hda_sdw_check_lcount_common, -+ .enable_sdw_irq = mtl_enable_sdw_irq, -+ .check_sdw_irq = mtl_dsp_check_sdw_irq, -+ .check_sdw_wakeen_irq = hda_sdw_check_wakeen_irq_common, -+ .check_ipc_irq = mtl_dsp_check_ipc_irq, -+ .cl_init = mtl_dsp_cl_init, -+ .power_down_dsp = mtl_power_down_dsp, -+ .disable_interrupts = mtl_dsp_disable_interrupts, -+ .hw_ip_version = SOF_INTEL_ACE_1_0, -+}; -+EXPORT_SYMBOL_NS(arl_s_chip_info, SND_SOC_SOF_INTEL_HDA_COMMON); -diff --git a/sound/soc/sof/intel/pci-mtl.c b/sound/soc/sof/intel/pci-mtl.c -index 0f378f45486d..60d5e73cdad2 100644 ---- a/sound/soc/sof/intel/pci-mtl.c -+++ b/sound/soc/sof/intel/pci-mtl.c -@@ -50,7 +50,7 @@ static const struct sof_dev_desc mtl_desc = { - .ops_free = hda_ops_free, - }; - --static const struct sof_dev_desc arl_desc = { -+static const struct sof_dev_desc arl_s_desc = { - .use_acpi_target_states = true, - .machines = snd_soc_acpi_intel_arl_machines, - .alt_machines = snd_soc_acpi_intel_arl_sdw_machines, -@@ -58,21 +58,21 @@ static const struct sof_dev_desc arl_desc = { - .resindex_pcicfg_base = -1, - .resindex_imr_base = -1, - .irqindex_host_ipc = -1, -- .chip_info = &mtl_chip_info, -+ .chip_info = &arl_s_chip_info, - .ipc_supported_mask = BIT(SOF_IPC_TYPE_4), - .ipc_default = SOF_IPC_TYPE_4, - .dspless_mode_supported = true, /* Only supported for HDaudio */ - .default_fw_path = { -- [SOF_IPC_TYPE_4] = "intel/sof-ipc4/arl", -+ [SOF_IPC_TYPE_4] = "intel/sof-ipc4/arl-s", - }, - .default_lib_path = { -- [SOF_IPC_TYPE_4] = "intel/sof-ipc4-lib/arl", -+ [SOF_IPC_TYPE_4] = "intel/sof-ipc4-lib/arl-s", - }, - .default_tplg_path = { - [SOF_IPC_TYPE_4] = "intel/sof-ace-tplg", - }, - .default_fw_filename = { -- [SOF_IPC_TYPE_4] = "sof-arl.ri", -+ [SOF_IPC_TYPE_4] = "sof-arl-s.ri", - }, - .nocodec_tplg_filename = "sof-arl-nocodec.tplg", - .ops = &sof_mtl_ops, -@@ -83,7 +83,7 @@ static const struct sof_dev_desc arl_desc = { - /* PCI IDs */ - static const struct pci_device_id sof_pci_ids[] = { - { PCI_DEVICE_DATA(INTEL, HDA_MTL, &mtl_desc) }, -- { PCI_DEVICE_DATA(INTEL, HDA_ARL_S, &arl_desc) }, -+ { PCI_DEVICE_DATA(INTEL, HDA_ARL_S, &arl_s_desc) }, - { 0, } - }; - MODULE_DEVICE_TABLE(pci, sof_pci_ids); --- -2.43.2 - -From 7e20b1dc5aa65af250cbb5b273c9e733f14712f4 Mon Sep 17 00:00:00 2001 -From: Chengchang Tang <tangchengchang@huawei.com> -Date: Thu, 7 Dec 2023 19:42:31 +0800 -Subject: [PATCH 0330/1501] RDMA/hns: Fix memory leak in free_mr_init() -Content-Length: 1183 -Lines: 32 - -[ Upstream commit 288f535951aa81ed674f5e5477ab11b9d9351b8c ] - -When a reserved QP fails to be created, the memory of the remaining -created reserved QPs is leaked. - -Fixes: 70f92521584f ("RDMA/hns: Use the reserved loopback QPs to free MR before destroying MPT") -Signed-off-by: Chengchang Tang <tangchengchang@huawei.com> -Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com> -Link: https://lore.kernel.org/r/20231207114231.2872104-6-huangjunxian6@hisilicon.com -Signed-off-by: Leon Romanovsky <leon@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -index e4753c802942..aa9527ac2fe0 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -@@ -2698,6 +2698,10 @@ static int free_mr_alloc_res(struct hns_roce_dev *hr_dev) - return 0; - - create_failed_qp: -+ for (i--; i >= 0; i--) { -+ hns_roce_v2_destroy_qp(&free_mr->rsv_qp[i]->ibqp, NULL); -+ kfree(free_mr->rsv_qp[i]); -+ } - hns_roce_destroy_cq(cq, NULL); - kfree(cq); - --- -2.43.2 - -From 18b951e84226ac5e9c3fb6ccff4b24445afde87a Mon Sep 17 00:00:00 2001 -From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com> -Date: Wed, 22 Nov 2023 09:58:14 +0530 -Subject: [PATCH 0331/1501] clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 - config -Content-Length: 1253 -Lines: 32 - -[ Upstream commit 6ebd9a4f8b8d2b35cf965a04849c4ba763722f13 ] - -Update the test_ctl_hi_val and test_ctl_hi1_val of gpu_cc_pll1 -as per latest HW recommendation. - -Fixes: 0cef71f2ccc8 ("clk: qcom: Add graphics clock controller driver for SM8150") -Signed-off-by: Satya Priya Kakitapalli <quic_skakitap@quicinc.com> -Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org> -Link: https://lore.kernel.org/r/20231122042814.4158076-1-quic_skakitap@quicinc.com -Signed-off-by: Bjorn Andersson <andersson@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/clk/qcom/gpucc-sm8150.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/clk/qcom/gpucc-sm8150.c b/drivers/clk/qcom/gpucc-sm8150.c -index 8422fd047493..c89a5b59ddb7 100644 ---- a/drivers/clk/qcom/gpucc-sm8150.c -+++ b/drivers/clk/qcom/gpucc-sm8150.c -@@ -37,8 +37,8 @@ static struct alpha_pll_config gpu_cc_pll1_config = { - .config_ctl_hi_val = 0x00002267, - .config_ctl_hi1_val = 0x00000024, - .test_ctl_val = 0x00000000, -- .test_ctl_hi_val = 0x00000002, -- .test_ctl_hi1_val = 0x00000000, -+ .test_ctl_hi_val = 0x00000000, -+ .test_ctl_hi1_val = 0x00000020, - .user_ctl_val = 0x00000000, - .user_ctl_hi_val = 0x00000805, - .user_ctl_hi1_val = 0x000000d0, --- -2.43.2 - -From cc16c8600013b2a50a932026d216fe1adda24000 Mon Sep 17 00:00:00 2001 -From: Daniel Rosenberg <drosen@google.com> -Date: Mon, 4 Dec 2023 18:38:01 -0800 -Subject: [PATCH 0332/1501] f2fs: Restrict max filesize for 16K f2fs -Content-Length: 1256 -Lines: 38 - -[ Upstream commit a6a010f5def544af3efcfe21683905a712b60536 ] - -Blocks are tracked by u32, so the max permitted filesize is -(U32_MAX + 1) * BLOCK_SIZE. Additionally, in order to support crypto -data unit sizes of 4K with a 16K block with IV_INO_LBLK_{32,64}, we must -further restrict max filesize to (U32_MAX + 1) * 4096. This does not -affect 4K blocksize f2fs as the natural limit for files are well below -that. - -Fixes: d7e9a9037de2 ("f2fs: Support Block Size == Page Size") -Signed-off-by: Daniel Rosenberg <drosen@google.com> -Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/f2fs/super.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c -index 033af907c3b1..5dfbc6b4c0ac 100644 ---- a/fs/f2fs/super.c -+++ b/fs/f2fs/super.c -@@ -3364,6 +3364,14 @@ loff_t max_file_blocks(struct inode *inode) - leaf_count *= NIDS_PER_BLOCK; - result += leaf_count; - -+ /* -+ * For compatibility with FSCRYPT_POLICY_FLAG_IV_INO_LBLK_{64,32} with -+ * a 4K crypto data unit, we must restrict the max filesize to what can -+ * fit within U32_MAX + 1 data units. -+ */ -+ -+ result = min(result, (((loff_t)U32_MAX + 1) * 4096) >> F2FS_BLKSIZE_BITS); -+ - return result; - } - --- -2.43.2 - -From c092634e7b35e35e19774584e0553f8334975eee Mon Sep 17 00:00:00 2001 -From: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Date: Thu, 30 Nov 2023 13:58:10 +0100 -Subject: [PATCH 0333/1501] media: bttv: start_streaming should return a proper - error code -Content-Length: 2535 -Lines: 80 - -[ Upstream commit 0d75bb6ae127f5e3fd0e2239714908fd2038193d ] - -The start_streaming callback returned 0 or 1 instead of a -proper error code. Fix that. - -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Fixes: b7ec3212a73a ("media: bttv: convert to vb2") -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/pci/bt8xx/bttv-driver.c | 6 ++---- - drivers/media/pci/bt8xx/bttv-vbi.c | 8 +++----- - 2 files changed, 5 insertions(+), 9 deletions(-) - -diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c -index 09a193bb87df..8e8c9dada67a 100644 ---- a/drivers/media/pci/bt8xx/bttv-driver.c -+++ b/drivers/media/pci/bt8xx/bttv-driver.c -@@ -1536,13 +1536,11 @@ static void buf_cleanup(struct vb2_buffer *vb) - - static int start_streaming(struct vb2_queue *q, unsigned int count) - { -- int ret = 1; - int seqnr = 0; - struct bttv_buffer *buf; - struct bttv *btv = vb2_get_drv_priv(q); - -- ret = check_alloc_btres_lock(btv, RESOURCE_VIDEO_STREAM); -- if (ret == 0) { -+ if (!check_alloc_btres_lock(btv, RESOURCE_VIDEO_STREAM)) { - if (btv->field_count) - seqnr++; - while (!list_empty(&btv->capture)) { -@@ -1553,7 +1551,7 @@ static int start_streaming(struct vb2_queue *q, unsigned int count) - vb2_buffer_done(&buf->vbuf.vb2_buf, - VB2_BUF_STATE_QUEUED); - } -- return !ret; -+ return -EBUSY; - } - if (!vb2_is_streaming(&btv->vbiq)) { - init_irqreg(btv); -diff --git a/drivers/media/pci/bt8xx/bttv-vbi.c b/drivers/media/pci/bt8xx/bttv-vbi.c -index ab213e51ec95..e489a3acb4b9 100644 ---- a/drivers/media/pci/bt8xx/bttv-vbi.c -+++ b/drivers/media/pci/bt8xx/bttv-vbi.c -@@ -123,14 +123,12 @@ static void buf_cleanup_vbi(struct vb2_buffer *vb) - - static int start_streaming_vbi(struct vb2_queue *q, unsigned int count) - { -- int ret; - int seqnr = 0; - struct bttv_buffer *buf; - struct bttv *btv = vb2_get_drv_priv(q); - - btv->framedrop = 0; -- ret = check_alloc_btres_lock(btv, RESOURCE_VBI); -- if (ret == 0) { -+ if (!check_alloc_btres_lock(btv, RESOURCE_VBI)) { - if (btv->field_count) - seqnr++; - while (!list_empty(&btv->vcapture)) { -@@ -141,13 +139,13 @@ static int start_streaming_vbi(struct vb2_queue *q, unsigned int count) - vb2_buffer_done(&buf->vbuf.vb2_buf, - VB2_BUF_STATE_QUEUED); - } -- return !ret; -+ return -EBUSY; - } - if (!vb2_is_streaming(&btv->capq)) { - init_irqreg(btv); - btv->field_count = 0; - } -- return !ret; -+ return 0; - } - - static void stop_streaming_vbi(struct vb2_queue *q) --- -2.43.2 - -From 22858e6243d6b124d2c8c5a331a86eb96ecbd50d Mon Sep 17 00:00:00 2001 -From: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Date: Thu, 30 Nov 2023 13:58:11 +0100 -Subject: [PATCH 0334/1501] media: bttv: add back vbi hack -Content-Length: 2127 -Lines: 58 - -[ Upstream commit 3f1faa154a4316b1b585a25394697504b3c24e98 ] - -The old (now removed) videobuf framework had an optional vbi hack where -the sequence number of the frame counter was copied in the last 4 bytes -of the buffer. This hack was active only for the read() interface -(so not for streaming I/O), and it was enabled by bttv. This allowed -applications that used read() for the VBI data to match it with the -corresponding video frame. - -When bttv was converted to vb2 this hack was forgotten, but some old -applications rely on this. - -So add this back, but this time in the bttv driver rather than in the -vb2 framework. - -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Fixes: b7ec3212a73a ("media: bttv: convert to vb2") -Tested-by: Dr. David Alan Gilbert <dave@treblig.org> -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/pci/bt8xx/bttv-driver.c | 21 +++++++++++++++++++++ - 1 file changed, 21 insertions(+) - -diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c -index 8e8c9dada67a..49a3dd70ec0f 100644 ---- a/drivers/media/pci/bt8xx/bttv-driver.c -+++ b/drivers/media/pci/bt8xx/bttv-driver.c -@@ -2772,6 +2772,27 @@ bttv_irq_wakeup_vbi(struct bttv *btv, struct bttv_buffer *wakeup, - return; - wakeup->vbuf.vb2_buf.timestamp = ktime_get_ns(); - wakeup->vbuf.sequence = btv->field_count >> 1; -+ -+ /* -+ * Ugly hack for backwards compatibility. -+ * Some applications expect that the last 4 bytes of -+ * the VBI data contains the sequence number. -+ * -+ * This makes it possible to associate the VBI data -+ * with the video frame if you use read() to get the -+ * VBI data. -+ */ -+ if (vb2_fileio_is_active(wakeup->vbuf.vb2_buf.vb2_queue)) { -+ u32 *vaddr = vb2_plane_vaddr(&wakeup->vbuf.vb2_buf, 0); -+ unsigned long size = -+ vb2_get_plane_payload(&wakeup->vbuf.vb2_buf, 0) / 4; -+ -+ if (vaddr && size) { -+ vaddr += size - 1; -+ *vaddr = wakeup->vbuf.sequence; -+ } -+ } -+ - vb2_buffer_done(&wakeup->vbuf.vb2_buf, state); - if (btv->field_count == 0) - btor(BT848_INT_VSYNC, BT848_INT_MASK); --- -2.43.2 - -From bf17f9ae554fae67cefdfad48bf282d9c36b2d7a Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Wed, 22 Nov 2023 16:21:34 +0100 -Subject: [PATCH 0336/1501] media: imx-mipi-csis: Fix clock handling in - remove() -Content-Length: 1572 -Lines: 38 - -[ Upstream commit 5705b0e0eb550ff834125a46a4ef99b62093d83d ] - -The driver always calls mipi_csis_runtime_suspend() and -mipi_csis_clk_disable() in remove(). This causes multiple WARNs from the -kernel, as the clocks get disabled too many times. - -Fix the remove() to call mipi_csis_runtime_suspend() and -mipi_csis_clk_disable() in a way that reverses what is done in probe(). - -Link: https://lore.kernel.org/r/20231122-imx-csis-v2-1-e44b8dc4cb66@ideasonboard.com - -Fixes: 7807063b862b ("media: staging/imx7: add MIPI CSI-2 receiver subdev for i.MX7") -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/platform/nxp/imx-mipi-csis.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/media/platform/nxp/imx-mipi-csis.c b/drivers/media/platform/nxp/imx-mipi-csis.c -index 6cb20b45e0a1..b39d7aeba750 100644 ---- a/drivers/media/platform/nxp/imx-mipi-csis.c -+++ b/drivers/media/platform/nxp/imx-mipi-csis.c -@@ -1502,8 +1502,10 @@ static void mipi_csis_remove(struct platform_device *pdev) - v4l2_async_nf_cleanup(&csis->notifier); - v4l2_async_unregister_subdev(&csis->sd); - -+ if (!pm_runtime_enabled(&pdev->dev)) -+ mipi_csis_runtime_suspend(&pdev->dev); -+ - pm_runtime_disable(&pdev->dev); -- mipi_csis_runtime_suspend(&pdev->dev); - mipi_csis_clk_disable(csis); - v4l2_subdev_cleanup(&csis->sd); - media_entity_cleanup(&csis->sd.entity); --- -2.43.2 - -From e66168205ac7a8e400a83ecb5d709fa2e21eff10 Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Wed, 22 Nov 2023 16:21:35 +0100 -Subject: [PATCH 0337/1501] media: imx-mipi-csis: Drop extra clock enable at - probe() -Content-Length: 2622 -Lines: 73 - -[ Upstream commit fb387fcb5cdd0384ba04a5d15a3605e2dccdab2a ] - -The driver always enables the clocks at probe() and disables them only -at remove(). It is not clear why the driver does this, as it supports -runtime PM, and enables and disables the clocks in the runtime resume -and suspend callbacks. Also, in the case runtime PM is not available, -the driver calls the resume and suspend callbacks manually from probe() -and remove(). - -Drop the unnecessary clock enable, thus enabling the clocks only when -actually needed. - -Link: https://lore.kernel.org/r/20231122-imx-csis-v2-2-e44b8dc4cb66@ideasonboard.com - -Fixes: 7807063b862b ("media: staging/imx7: add MIPI CSI-2 receiver subdev for i.MX7") -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/platform/nxp/imx-mipi-csis.c | 13 ++----------- - 1 file changed, 2 insertions(+), 11 deletions(-) - -diff --git a/drivers/media/platform/nxp/imx-mipi-csis.c b/drivers/media/platform/nxp/imx-mipi-csis.c -index b39d7aeba750..b08f6d2e7516 100644 ---- a/drivers/media/platform/nxp/imx-mipi-csis.c -+++ b/drivers/media/platform/nxp/imx-mipi-csis.c -@@ -1435,24 +1435,18 @@ static int mipi_csis_probe(struct platform_device *pdev) - /* Reset PHY and enable the clocks. */ - mipi_csis_phy_reset(csis); - -- ret = mipi_csis_clk_enable(csis); -- if (ret < 0) { -- dev_err(csis->dev, "failed to enable clocks: %d\n", ret); -- return ret; -- } -- - /* Now that the hardware is initialized, request the interrupt. */ - ret = devm_request_irq(dev, irq, mipi_csis_irq_handler, 0, - dev_name(dev), csis); - if (ret) { - dev_err(dev, "Interrupt request failed\n"); -- goto err_disable_clock; -+ return ret; - } - - /* Initialize and register the subdev. */ - ret = mipi_csis_subdev_init(csis); - if (ret < 0) -- goto err_disable_clock; -+ return ret; - - platform_set_drvdata(pdev, &csis->sd); - -@@ -1486,8 +1480,6 @@ static int mipi_csis_probe(struct platform_device *pdev) - v4l2_async_nf_unregister(&csis->notifier); - v4l2_async_nf_cleanup(&csis->notifier); - v4l2_async_unregister_subdev(&csis->sd); --err_disable_clock: -- mipi_csis_clk_disable(csis); - - return ret; - } -@@ -1506,7 +1498,6 @@ static void mipi_csis_remove(struct platform_device *pdev) - mipi_csis_runtime_suspend(&pdev->dev); - - pm_runtime_disable(&pdev->dev); -- mipi_csis_clk_disable(csis); - v4l2_subdev_cleanup(&csis->sd); - media_entity_cleanup(&csis->sd.entity); - pm_runtime_set_suspended(&pdev->dev); --- -2.43.2 - -From d6a1bc2ab2072e3bfea91512ef43826cf4a2c992 Mon Sep 17 00:00:00 2001 -From: Mehdi Djait <mehdi.djait@bootlin.com> -Date: Wed, 15 Nov 2023 17:44:07 +0100 -Subject: [PATCH 0338/1501] media: dt-bindings: media: rkisp1: Fix the port - description for the parallel interface -Content-Length: 1524 -Lines: 45 - -[ Upstream commit 25bf28b25a2afa1864b7143259443160d9163ea0 ] - -The bus-type belongs to the endpoint's properties and should therefore -be moved. - -Link: https://lore.kernel.org/r/20231115164407.99876-1-mehdi.djait@bootlin.com - -Fixes: 6a0eaa25bf36 ("media: dt-bindings: media: rkisp1: Add port for parallel interface") -Signed-off-by: Mehdi Djait <mehdi.djait@bootlin.com> -Acked-by: Conor Dooley <conor.dooley@microchip.com> -Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../devicetree/bindings/media/rockchip-isp1.yaml | 11 ++++++----- - 1 file changed, 6 insertions(+), 5 deletions(-) - -diff --git a/Documentation/devicetree/bindings/media/rockchip-isp1.yaml b/Documentation/devicetree/bindings/media/rockchip-isp1.yaml -index e466dff8286d..afcaa427d48b 100644 ---- a/Documentation/devicetree/bindings/media/rockchip-isp1.yaml -+++ b/Documentation/devicetree/bindings/media/rockchip-isp1.yaml -@@ -90,15 +90,16 @@ properties: - description: connection point for input on the parallel interface - - properties: -- bus-type: -- enum: [5, 6] -- - endpoint: - $ref: video-interfaces.yaml# - unevaluatedProperties: false - -- required: -- - bus-type -+ properties: -+ bus-type: -+ enum: [5, 6] -+ -+ required: -+ - bus-type - - anyOf: - - required: --- -2.43.2 - -From 32d015914bd2acfcb47d5b46dbf59214041c3776 Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Wed, 22 Nov 2023 16:50:07 +0100 -Subject: [PATCH 0339/1501] media: rkisp1: Fix media device memory leak -Content-Length: 1849 -Lines: 49 - -[ Upstream commit 452f604a4683654f4d9472b3126d8da61d748443 ] - -Add missing calls to media_device_cleanup() to fix memory leak. - -Link: https://lore.kernel.org/r/20231122-rkisp-fixes-v2-1-78bfb63cdcf8@ideasonboard.com - -Fixes: d65dd85281fb ("media: staging: rkisp1: add Rockchip ISP1 base driver") -Reviewed-by: Tommaso Merciai <tomm.merciai@gmail.com> -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c -index c41abd2833f1..894d5afaff4e 100644 ---- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c -+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c -@@ -582,7 +582,7 @@ static int rkisp1_probe(struct platform_device *pdev) - - ret = v4l2_device_register(rkisp1->dev, &rkisp1->v4l2_dev); - if (ret) -- goto err_pm_runtime_disable; -+ goto err_media_dev_cleanup; - - ret = media_device_register(&rkisp1->media_dev); - if (ret) { -@@ -617,6 +617,8 @@ static int rkisp1_probe(struct platform_device *pdev) - media_device_unregister(&rkisp1->media_dev); - err_unreg_v4l2_dev: - v4l2_device_unregister(&rkisp1->v4l2_dev); -+err_media_dev_cleanup: -+ media_device_cleanup(&rkisp1->media_dev); - err_pm_runtime_disable: - pm_runtime_disable(&pdev->dev); - return ret; -@@ -637,6 +639,8 @@ static void rkisp1_remove(struct platform_device *pdev) - media_device_unregister(&rkisp1->media_dev); - v4l2_device_unregister(&rkisp1->v4l2_dev); - -+ media_device_cleanup(&rkisp1->media_dev); -+ - pm_runtime_disable(&pdev->dev); - } - --- -2.43.2 - -From d5da367551c5849227fa1e1cc8a895605c94e776 Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Wed, 22 Nov 2023 16:50:08 +0100 -Subject: [PATCH 0340/1501] media: rkisp1: Fix memory leaks in - rkisp1_isp_unregister() -Content-Length: 1172 -Lines: 30 - -[ Upstream commit 688f3af3c354adc19b78d352c8c7b2006f993f2d ] - -Add missing call to v4l2_subdev_cleanup() to fix memory leak. - -Link: https://lore.kernel.org/r/20231122-rkisp-fixes-v2-2-78bfb63cdcf8@ideasonboard.com - -Fixes: 2cce0a369dbd ("media: rkisp1: isp: Use V4L2 subdev active state") -Reviewed-by: Tommaso Merciai <tomm.merciai@gmail.com> -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c -index 88ca8b2283b7..45d1ab96fc6e 100644 ---- a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c -+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c -@@ -933,6 +933,7 @@ void rkisp1_isp_unregister(struct rkisp1_device *rkisp1) - return; - - v4l2_device_unregister_subdev(&isp->sd); -+ v4l2_subdev_cleanup(&isp->sd); - media_entity_cleanup(&isp->sd.entity); - } - --- -2.43.2 - -From 606ae60e7d652c8291af4a40085c074faf198ce7 Mon Sep 17 00:00:00 2001 -From: Bjorn Andersson <quic_bjorande@quicinc.com> -Date: Thu, 30 Nov 2023 16:26:41 -0800 -Subject: [PATCH 0341/1501] drm/msm/adreno: Fix A680 chip id -Content-Length: 1186 -Lines: 32 - -[ Upstream commit 3e6688fd96966b6c275e95c39aa367bc0a490ccd ] - -The only A680 referenced from DeviceTree is patch level 1, which since -commit '90b593ce1c9e ("drm/msm/adreno: Switch to chip-id for identifying -GPU")' isn't a known chip id. - -Correct the chip id to allow the A680 to be recognized again. - -Fixes: 90b593ce1c9e ("drm/msm/adreno: Switch to chip-id for identifying GPU") -Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com> -Patchwork: https://patchwork.freedesktop.org/patch/569839/ -Signed-off-by: Rob Clark <robdclark@chromium.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/msm/adreno/adreno_device.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/msm/adreno/adreno_device.c b/drivers/gpu/drm/msm/adreno/adreno_device.c -index 41b13dec9bef..3ee14646ab6b 100644 ---- a/drivers/gpu/drm/msm/adreno/adreno_device.c -+++ b/drivers/gpu/drm/msm/adreno/adreno_device.c -@@ -464,7 +464,7 @@ static const struct adreno_info gpulist[] = { - { 190, 1 }, - ), - }, { -- .chip_ids = ADRENO_CHIP_IDS(0x06080000), -+ .chip_ids = ADRENO_CHIP_IDS(0x06080001), - .family = ADRENO_6XX_GEN2, - .revn = 680, - .fw = { --- -2.43.2 - -From 77183635cd56e93e15c3d0e366cdb55feefc7c23 Mon Sep 17 00:00:00 2001 -From: Chris Morgan <macromorgan@hotmail.com> -Date: Fri, 8 Dec 2023 09:48:45 -0600 -Subject: [PATCH 0342/1501] drm/panel: st7701: Fix AVCL calculation -Content-Length: 1846 -Lines: 38 - -[ Upstream commit 799825aa87200ade1ba21db853d1c2ff720dcfe0 ] - -The AVCL register, according to the datasheet, comes in increments -of -0.2v between -4.4v (represented by 0x0) to -5.0v (represented -by 0x3). The current calculation is done by adding the defined -AVCL value in mV to -4400 and then dividing by 200 to get the register -value. Unfortunately if I subtract -4400 from -4400 I get -8800, which -divided by 200 gives me -44. If I instead subtract -4400 from -4400 -I get 0, which divided by 200 gives me 0. Based on the datasheet this -is the expected register value. - -Fixes: 83b7a8e7e88e ("drm/panel/panel-sitronix-st7701: Parametrize voltage and timing") - -Signed-off-by: Chris Morgan <macromorgan@hotmail.com> -Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> -Link: https://lore.kernel.org/r/20231208154847.130615-2-macroalpha82@gmail.com -Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20231208154847.130615-2-macroalpha82@gmail.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/panel/panel-sitronix-st7701.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/panel/panel-sitronix-st7701.c b/drivers/gpu/drm/panel/panel-sitronix-st7701.c -index 0459965e1b4f..036ac403ed21 100644 ---- a/drivers/gpu/drm/panel/panel-sitronix-st7701.c -+++ b/drivers/gpu/drm/panel/panel-sitronix-st7701.c -@@ -288,7 +288,7 @@ static void st7701_init_sequence(struct st7701 *st7701) - FIELD_PREP(DSI_CMD2_BK1_PWRCTRL2_AVDD_MASK, - DIV_ROUND_CLOSEST(desc->avdd_mv - 6200, 200)) | - FIELD_PREP(DSI_CMD2_BK1_PWRCTRL2_AVCL_MASK, -- DIV_ROUND_CLOSEST(-4400 + desc->avcl_mv, 200))); -+ DIV_ROUND_CLOSEST(-4400 - desc->avcl_mv, 200))); - - /* T2D = 0.2us * T2D[3:0] */ - ST7701_DSI(st7701, DSI_CMD2_BK1_SPD1, --- -2.43.2 - -From f904c156d8011d8291ffd5b6b398f3747e294986 Mon Sep 17 00:00:00 2001 -From: Chao Yu <chao@kernel.org> -Date: Sun, 10 Dec 2023 19:35:43 +0800 -Subject: [PATCH 0343/1501] f2fs: fix to wait on block writeback for post_read - case -Content-Length: 1747 -Lines: 61 - -[ Upstream commit 55fdc1c24a1d6229fe0ecf31335fb9a2eceaaa00 ] - -If inode is compressed, but not encrypted, it missed to call -f2fs_wait_on_block_writeback() to wait for GCed page writeback -in IPU write path. - -Thread A GC-Thread - - f2fs_gc - - do_garbage_collect - - gc_data_segment - - move_data_block - - f2fs_submit_page_write - migrate normal cluster's block via - meta_inode's page cache -- f2fs_write_single_data_page - - f2fs_do_write_data_page - - f2fs_inplace_write_data - - f2fs_submit_page_bio - -IRQ -- f2fs_read_end_io - IRQ - old data overrides new data due to - out-of-order GC and common IO. - - f2fs_read_end_io - -Fixes: 4c8ff7095bef ("f2fs: support data compression") -Signed-off-by: Chao Yu <chao@kernel.org> -Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/f2fs/data.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c -index 4e42b5f24deb..bc3f05d43b62 100644 ---- a/fs/f2fs/data.c -+++ b/fs/f2fs/data.c -@@ -2566,9 +2566,6 @@ int f2fs_encrypt_one_page(struct f2fs_io_info *fio) - - page = fio->compressed_page ? fio->compressed_page : fio->page; - -- /* wait for GCed page writeback via META_MAPPING */ -- f2fs_wait_on_block_writeback(inode, fio->old_blkaddr); -- - if (fscrypt_inode_uses_inline_crypto(inode)) - return 0; - -@@ -2755,6 +2752,10 @@ int f2fs_do_write_data_page(struct f2fs_io_info *fio) - goto out_writepage; - } - -+ /* wait for GCed page writeback via META_MAPPING */ -+ if (fio->post_read) -+ f2fs_wait_on_block_writeback(inode, fio->old_blkaddr); -+ - /* - * If current allocation needs SSR, - * it had better in-place writes for updated data. --- -2.43.2 - -From 321bb4b1af5a9d5ab58f200a545d9d2917886cec Mon Sep 17 00:00:00 2001 -From: Chao Yu <chao@kernel.org> -Date: Sun, 10 Dec 2023 19:35:44 +0800 -Subject: [PATCH 0344/1501] f2fs: fix to check compress file in - f2fs_move_file_range() -Content-Length: 945 -Lines: 32 - -[ Upstream commit fb9b65340c818875ea86464faf3c744bdce0055c ] - -f2fs_move_file_range() doesn't support migrating compressed cluster -data, let's add the missing check condition and return -EOPNOTSUPP -for the case until we support it. - -Fixes: 4c8ff7095bef ("f2fs: support data compression") -Signed-off-by: Chao Yu <chao@kernel.org> -Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/f2fs/file.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c -index e50363583f01..37917c634e22 100644 ---- a/fs/f2fs/file.c -+++ b/fs/f2fs/file.c -@@ -2818,6 +2818,11 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in, - goto out; - } - -+ if (f2fs_compressed_file(src) || f2fs_compressed_file(dst)) { -+ ret = -EOPNOTSUPP; -+ goto out_unlock; -+ } -+ - ret = -EINVAL; - if (pos_in + len > src->i_size || pos_in + len < pos_in) - goto out_unlock; --- -2.43.2 - -From cea07e12ea78aef4e0271272663341b5561a990d Mon Sep 17 00:00:00 2001 -From: Chao Yu <chao@kernel.org> -Date: Sun, 10 Dec 2023 19:35:47 +0800 -Subject: [PATCH 0345/1501] f2fs: fix to update iostat correctly in - f2fs_filemap_fault() -Content-Length: 844 -Lines: 28 - -[ Upstream commit bb34cc6ca87ff78f9fb5913d7619dc1389554da6 ] - -In f2fs_filemap_fault(), it fixes to update iostat info only if -VM_FAULT_LOCKED is tagged in return value of filemap_fault(). - -Fixes: 8b83ac81f428 ("f2fs: support read iostat") -Signed-off-by: Chao Yu <chao@kernel.org> -Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/f2fs/file.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c -index 37917c634e22..8912511980ae 100644 ---- a/fs/f2fs/file.c -+++ b/fs/f2fs/file.c -@@ -42,7 +42,7 @@ static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf) - vm_fault_t ret; - - ret = filemap_fault(vmf); -- if (!ret) -+ if (ret & VM_FAULT_LOCKED) - f2fs_update_iostat(F2FS_I_SB(inode), inode, - APP_MAPPED_READ_IO, F2FS_BLKSIZE); - --- -2.43.2 - -From a1a57a7ff30e00d84af84aa786d45ab32f9d9df9 Mon Sep 17 00:00:00 2001 -From: Dan Carpenter <dan.carpenter@linaro.org> -Date: Tue, 31 Oct 2023 12:53:33 +0300 -Subject: [PATCH 0346/1501] media: dvbdev: drop refcount on error path in - dvb_device_open() -Content-Length: 894 -Lines: 27 - -[ Upstream commit a2dd235df435a05d389240be748909ada91201d2 ] - -If call to file->f_op->open() fails, then call dvb_device_put(dvbdev). - -Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF") -Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/dvb-core/dvbdev.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c -index 305bb21d843c..49f0eb7d0b9d 100644 ---- a/drivers/media/dvb-core/dvbdev.c -+++ b/drivers/media/dvb-core/dvbdev.c -@@ -104,6 +104,8 @@ static int dvb_device_open(struct inode *inode, struct file *file) - err = file->f_op->open(inode, file); - up_read(&minor_rwsem); - mutex_unlock(&dvbdev_mutex); -+ if (err) -+ dvb_device_put(dvbdev); - return err; - } - fail: --- -2.43.2 - -From f6b6e5dec5d3f1b35cb84dea10c472615980d4f7 Mon Sep 17 00:00:00 2001 -From: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Date: Mon, 30 Oct 2023 08:20:26 +0100 -Subject: [PATCH 0347/1501] media: dvb-frontends: m88ds3103: Fix a memory leak - in an error handling path of m88ds3103_probe() -Content-Length: 1492 -Lines: 45 - -[ Upstream commit 5b2f885e2f6f482d05c23f04c8240f7b4fc5bdb5 ] - -If an error occurs after a successful i2c_mux_add_adapter(), then -i2c_mux_del_adapters() should be called to free some resources, as -already done in the remove function. - -Fixes: e6089feca460 ("media: m88ds3103: Add support for ds3103b demod") -Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/dvb-frontends/m88ds3103.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/drivers/media/dvb-frontends/m88ds3103.c b/drivers/media/dvb-frontends/m88ds3103.c -index 26c67ef05d13..e0272054fca5 100644 ---- a/drivers/media/dvb-frontends/m88ds3103.c -+++ b/drivers/media/dvb-frontends/m88ds3103.c -@@ -1894,7 +1894,7 @@ static int m88ds3103_probe(struct i2c_client *client) - /* get frontend address */ - ret = regmap_read(dev->regmap, 0x29, &utmp); - if (ret) -- goto err_kfree; -+ goto err_del_adapters; - dev->dt_addr = ((utmp & 0x80) == 0) ? 0x42 >> 1 : 0x40 >> 1; - dev_dbg(&client->dev, "dt addr is 0x%02x\n", dev->dt_addr); - -@@ -1902,11 +1902,14 @@ static int m88ds3103_probe(struct i2c_client *client) - dev->dt_addr); - if (IS_ERR(dev->dt_client)) { - ret = PTR_ERR(dev->dt_client); -- goto err_kfree; -+ goto err_del_adapters; - } - } - - return 0; -+ -+err_del_adapters: -+ i2c_mux_del_adapters(dev->muxc); - err_kfree: - kfree(dev); - err: --- -2.43.2 - -From 92f4d3825931c1fca11f389a7721855f7005d671 Mon Sep 17 00:00:00 2001 -From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> -Date: Mon, 20 Nov 2023 09:00:11 +0200 -Subject: [PATCH 0348/1501] clk: renesas: rzg2l-cpg: Reuse code in - rzg2l_cpg_reset() -Content-Length: 2401 -Lines: 74 - -[ Upstream commit 5f9e29b9159a41fcf6733c3b59fa46a90ce3ae20 ] - -Code in rzg2l_cpg_reset() is equivalent with the combined code of -rzg2l_cpg_assert() and rzg2l_cpg_deassert(). There is no need to have -different versions thus re-use rzg2l_cpg_assert() and rzg2l_cpg_deassert(). - -Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> -Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> -Link: https://lore.kernel.org/r/20231120070024.4079344-2-claudiu.beznea.uj@bp.renesas.com -Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> -Stable-dep-of: da235d2fac21 ("clk: renesas: rzg2l: Check reset monitor registers") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/clk/renesas/rzg2l-cpg.c | 38 +++++++++++++-------------------- - 1 file changed, 15 insertions(+), 23 deletions(-) - -diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c -index 764bd72cf059..3189c3167ba8 100644 ---- a/drivers/clk/renesas/rzg2l-cpg.c -+++ b/drivers/clk/renesas/rzg2l-cpg.c -@@ -1410,29 +1410,6 @@ rzg2l_cpg_register_mod_clk(const struct rzg2l_mod_clk *mod, - - #define rcdev_to_priv(x) container_of(x, struct rzg2l_cpg_priv, rcdev) - --static int rzg2l_cpg_reset(struct reset_controller_dev *rcdev, -- unsigned long id) --{ -- struct rzg2l_cpg_priv *priv = rcdev_to_priv(rcdev); -- const struct rzg2l_cpg_info *info = priv->info; -- unsigned int reg = info->resets[id].off; -- u32 dis = BIT(info->resets[id].bit); -- u32 we = dis << 16; -- -- dev_dbg(rcdev->dev, "reset id:%ld offset:0x%x\n", id, CLK_RST_R(reg)); -- -- /* Reset module */ -- writel(we, priv->base + CLK_RST_R(reg)); -- -- /* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */ -- udelay(35); -- -- /* Release module from reset state */ -- writel(we | dis, priv->base + CLK_RST_R(reg)); -- -- return 0; --} -- - static int rzg2l_cpg_assert(struct reset_controller_dev *rcdev, - unsigned long id) - { -@@ -1463,6 +1440,21 @@ static int rzg2l_cpg_deassert(struct reset_controller_dev *rcdev, - return 0; - } - -+static int rzg2l_cpg_reset(struct reset_controller_dev *rcdev, -+ unsigned long id) -+{ -+ int ret; -+ -+ ret = rzg2l_cpg_assert(rcdev, id); -+ if (ret) -+ return ret; -+ -+ /* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */ -+ udelay(35); -+ -+ return rzg2l_cpg_deassert(rcdev, id); -+} -+ - static int rzg2l_cpg_status(struct reset_controller_dev *rcdev, - unsigned long id) - { --- -2.43.2 - -From 4126980d2c8207c09ef4917fa327634dad0a64da Mon Sep 17 00:00:00 2001 -From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> -Date: Thu, 7 Dec 2023 09:06:50 +0200 -Subject: [PATCH 0349/1501] clk: renesas: rzg2l: Check reset monitor registers -Content-Length: 4422 -Lines: 130 - -[ Upstream commit da235d2fac212d0add570e755feb1167a830bc99 ] - -The hardware manual of both RZ/G2L and RZ/G3S specifies that the reset -monitor registers need to be interrogated when the reset signals are -toggled (chapters "Procedures for Supplying and Stopping Reset Signals" -and "Procedure for Activating Modules"). Without this, there is a -chance that different modules (e.g. Ethernet) are not ready after their -reset signal is toggled, leading to failures (on probe or resume from -deep sleep states). - -The same indications are available for RZ/V2M for TYPE-B reset controls. - -Fixes: ef3c613ccd68 ("clk: renesas: Add CPG core wrapper for RZ/G2L SoC") -Fixes: 8090bea32484 ("clk: renesas: rzg2l: Add support for RZ/V2M reset monitor reg") -Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> -Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> -Link: https://lore.kernel.org/r/20231207070700.4156557-2-claudiu.beznea.uj@bp.renesas.com -Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/clk/renesas/rzg2l-cpg.c | 59 ++++++++++++++++++++++++--------- - 1 file changed, 44 insertions(+), 15 deletions(-) - -diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c -index 3189c3167ba8..3d2daa4ba2a4 100644 ---- a/drivers/clk/renesas/rzg2l-cpg.c -+++ b/drivers/clk/renesas/rzg2l-cpg.c -@@ -1416,12 +1416,27 @@ static int rzg2l_cpg_assert(struct reset_controller_dev *rcdev, - struct rzg2l_cpg_priv *priv = rcdev_to_priv(rcdev); - const struct rzg2l_cpg_info *info = priv->info; - unsigned int reg = info->resets[id].off; -- u32 value = BIT(info->resets[id].bit) << 16; -+ u32 mask = BIT(info->resets[id].bit); -+ s8 monbit = info->resets[id].monbit; -+ u32 value = mask << 16; - - dev_dbg(rcdev->dev, "assert id:%ld offset:0x%x\n", id, CLK_RST_R(reg)); - - writel(value, priv->base + CLK_RST_R(reg)); -- return 0; -+ -+ if (info->has_clk_mon_regs) { -+ reg = CLK_MRST_R(reg); -+ } else if (monbit >= 0) { -+ reg = CPG_RST_MON; -+ mask = BIT(monbit); -+ } else { -+ /* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */ -+ udelay(35); -+ return 0; -+ } -+ -+ return readl_poll_timeout_atomic(priv->base + reg, value, -+ value & mask, 10, 200); - } - - static int rzg2l_cpg_deassert(struct reset_controller_dev *rcdev, -@@ -1430,14 +1445,28 @@ static int rzg2l_cpg_deassert(struct reset_controller_dev *rcdev, - struct rzg2l_cpg_priv *priv = rcdev_to_priv(rcdev); - const struct rzg2l_cpg_info *info = priv->info; - unsigned int reg = info->resets[id].off; -- u32 dis = BIT(info->resets[id].bit); -- u32 value = (dis << 16) | dis; -+ u32 mask = BIT(info->resets[id].bit); -+ s8 monbit = info->resets[id].monbit; -+ u32 value = (mask << 16) | mask; - - dev_dbg(rcdev->dev, "deassert id:%ld offset:0x%x\n", id, - CLK_RST_R(reg)); - - writel(value, priv->base + CLK_RST_R(reg)); -- return 0; -+ -+ if (info->has_clk_mon_regs) { -+ reg = CLK_MRST_R(reg); -+ } else if (monbit >= 0) { -+ reg = CPG_RST_MON; -+ mask = BIT(monbit); -+ } else { -+ /* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */ -+ udelay(35); -+ return 0; -+ } -+ -+ return readl_poll_timeout_atomic(priv->base + reg, value, -+ !(value & mask), 10, 200); - } - - static int rzg2l_cpg_reset(struct reset_controller_dev *rcdev, -@@ -1449,9 +1478,6 @@ static int rzg2l_cpg_reset(struct reset_controller_dev *rcdev, - if (ret) - return ret; - -- /* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */ -- udelay(35); -- - return rzg2l_cpg_deassert(rcdev, id); - } - -@@ -1460,18 +1486,21 @@ static int rzg2l_cpg_status(struct reset_controller_dev *rcdev, - { - struct rzg2l_cpg_priv *priv = rcdev_to_priv(rcdev); - const struct rzg2l_cpg_info *info = priv->info; -- unsigned int reg = info->resets[id].off; -- u32 bitmask = BIT(info->resets[id].bit); - s8 monbit = info->resets[id].monbit; -+ unsigned int reg; -+ u32 bitmask; - - if (info->has_clk_mon_regs) { -- return !!(readl(priv->base + CLK_MRST_R(reg)) & bitmask); -+ reg = CLK_MRST_R(info->resets[id].off); -+ bitmask = BIT(info->resets[id].bit); - } else if (monbit >= 0) { -- u32 monbitmask = BIT(monbit); -- -- return !!(readl(priv->base + CPG_RST_MON) & monbitmask); -+ reg = CPG_RST_MON; -+ bitmask = BIT(monbit); -+ } else { -+ return -ENOTSUPP; - } -- return -ENOTSUPP; -+ -+ return !!(readl(priv->base + reg) & bitmask); - } - - static const struct reset_control_ops rzg2l_cpg_reset_ops = { --- -2.43.2 - -From 653398657bf9394eb6acb8628092915ea4993c2c Mon Sep 17 00:00:00 2001 -From: Jessica Zhang <quic_jesszhan@quicinc.com> -Date: Wed, 13 Dec 2023 13:30:17 -0800 -Subject: [PATCH 0350/1501] drm/msm/dpu: Set input_sel bit for INTF -Content-Length: 3831 -Lines: 92 - -[ Upstream commit 980fffd0c69e5df0f67ee089d405899d532aeeab ] - -Set the input_sel bit for encoders as it was missed in the initial -implementation. - -Reported-by: Rob Clark <robdclark@gmail.com> -Closes: https://gitlab.freedesktop.org/drm/msm/-/issues/39 -Fixes: 91143873a05d ("drm/msm/dpu: Add MISR register support for interface") -Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com> -Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com> -Patchwork: https://patchwork.freedesktop.org/patch/572007/ -Link: https://lore.kernel.org/r/20231213-encoder-fixup-v4-1-6da6cd1bf118@quicinc.com -Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c | 2 +- - drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c | 2 +- - drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c | 9 +++++++-- - drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h | 3 ++- - 4 files changed, 11 insertions(+), 5 deletions(-) - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c -index e8b8908d3e12..813bfde6832a 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c -@@ -320,7 +320,7 @@ static u32 dpu_hw_intf_get_line_count(struct dpu_hw_intf *intf) - - static void dpu_hw_intf_setup_misr(struct dpu_hw_intf *intf, bool enable, u32 frame_count) - { -- dpu_hw_setup_misr(&intf->hw, INTF_MISR_CTRL, enable, frame_count); -+ dpu_hw_setup_misr(&intf->hw, INTF_MISR_CTRL, enable, frame_count, 0x1); - } - - static int dpu_hw_intf_collect_misr(struct dpu_hw_intf *intf, u32 *misr_value) -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c -index d1c3bd8379ea..a34cf8c979cb 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c -@@ -83,7 +83,7 @@ static void dpu_hw_lm_setup_border_color(struct dpu_hw_mixer *ctx, - - static void dpu_hw_lm_setup_misr(struct dpu_hw_mixer *ctx, bool enable, u32 frame_count) - { -- dpu_hw_setup_misr(&ctx->hw, LM_MISR_CTRL, enable, frame_count); -+ dpu_hw_setup_misr(&ctx->hw, LM_MISR_CTRL, enable, frame_count, 0x0); - } - - static int dpu_hw_lm_collect_misr(struct dpu_hw_mixer *ctx, u32 *misr_value) -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c -index 18b16b2d2bf5..b328fe22abde 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c -@@ -481,9 +481,13 @@ void _dpu_hw_setup_qos_lut(struct dpu_hw_blk_reg_map *c, u32 offset, - cfg->danger_safe_en ? QOS_QOS_CTRL_DANGER_SAFE_EN : 0); - } - -+/* -+ * note: Aside from encoders, input_sel should be set to 0x0 by default -+ */ - void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c, - u32 misr_ctrl_offset, -- bool enable, u32 frame_count) -+ bool enable, u32 frame_count, -+ u8 input_sel) - { - u32 config = 0; - -@@ -494,7 +498,8 @@ void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c, - - if (enable) { - config = (frame_count & MISR_FRAME_COUNT_MASK) | -- MISR_CTRL_ENABLE | MISR_CTRL_FREE_RUN_MASK; -+ MISR_CTRL_ENABLE | MISR_CTRL_FREE_RUN_MASK | -+ ((input_sel & 0xF) << 24); - - DPU_REG_WRITE(c, misr_ctrl_offset, config); - } else { -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h -index 4bea139081bc..3feb6043e251 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h -@@ -360,7 +360,8 @@ void _dpu_hw_setup_qos_lut(struct dpu_hw_blk_reg_map *c, u32 offset, - void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c, - u32 misr_ctrl_offset, - bool enable, -- u32 frame_count); -+ u32 frame_count, -+ u8 input_sel); - - int dpu_hw_collect_misr(struct dpu_hw_blk_reg_map *c, - u32 misr_ctrl_offset, --- -2.43.2 - -From 404596e79fb7170cca98987c9bb44437ffc4cbec Mon Sep 17 00:00:00 2001 -From: Jessica Zhang <quic_jesszhan@quicinc.com> -Date: Wed, 13 Dec 2023 13:30:18 -0800 -Subject: [PATCH 0351/1501] drm/msm/dpu: Drop enable and frame_count parameters - from dpu_hw_setup_misr() -Content-Length: 9544 -Lines: 237 - -[ Upstream commit 3313c23f3eab698bc6b904520ee608fc0f7b03d0 ] - -Drop the enable and frame_count parameters from dpu_hw_setup_misr() as they -are always set to the same values. - -In addition, replace MISR_FRAME_COUNT_MASK with MISR_FRAME_COUNT as -frame_count is always set to the same value. - -Fixes: 7b37523fb1d1 ("drm/msm/dpu: Move MISR methods to dpu_hw_util") -Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com> -Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com> -Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Patchwork: https://patchwork.freedesktop.org/patch/572009/ -Link: https://lore.kernel.org/r/20231213-encoder-fixup-v4-2-6da6cd1bf118@quicinc.com -Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 4 ++-- - drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 4 ++-- - drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c | 6 +++--- - drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h | 4 ++-- - drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c | 6 +++--- - drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h | 3 ++- - drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c | 19 +++++-------------- - drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h | 9 +++------ - 8 files changed, 22 insertions(+), 33 deletions(-) - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c -index 3c475f8042b0..db501ce1d855 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c -@@ -1,6 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0-only - /* -- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. - * Copyright (c) 2014-2021 The Linux Foundation. All rights reserved. - * Copyright (C) 2013 Red Hat - * Author: Rob Clark <robdclark@gmail.com> -@@ -125,7 +125,7 @@ static void dpu_crtc_setup_lm_misr(struct dpu_crtc_state *crtc_state) - continue; - - /* Calculate MISR over 1 frame */ -- m->hw_lm->ops.setup_misr(m->hw_lm, true, 1); -+ m->hw_lm->ops.setup_misr(m->hw_lm); - } - } - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -index 1cf7ff6caff4..5dbb5d27bbea 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -@@ -2,7 +2,7 @@ - /* - * Copyright (C) 2013 Red Hat - * Copyright (c) 2014-2018, 2020-2021 The Linux Foundation. All rights reserved. -- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. - * - * Author: Rob Clark <robdclark@gmail.com> - */ -@@ -255,7 +255,7 @@ void dpu_encoder_setup_misr(const struct drm_encoder *drm_enc) - if (!phys->hw_intf || !phys->hw_intf->ops.setup_misr) - continue; - -- phys->hw_intf->ops.setup_misr(phys->hw_intf, true, 1); -+ phys->hw_intf->ops.setup_misr(phys->hw_intf); - } - } - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c -index 813bfde6832a..27b9373cd784 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c -@@ -1,6 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0-only - /* -- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. - * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved. - */ - -@@ -318,9 +318,9 @@ static u32 dpu_hw_intf_get_line_count(struct dpu_hw_intf *intf) - return DPU_REG_READ(c, INTF_LINE_COUNT); - } - --static void dpu_hw_intf_setup_misr(struct dpu_hw_intf *intf, bool enable, u32 frame_count) -+static void dpu_hw_intf_setup_misr(struct dpu_hw_intf *intf) - { -- dpu_hw_setup_misr(&intf->hw, INTF_MISR_CTRL, enable, frame_count, 0x1); -+ dpu_hw_setup_misr(&intf->hw, INTF_MISR_CTRL, 0x1); - } - - static int dpu_hw_intf_collect_misr(struct dpu_hw_intf *intf, u32 *misr_value) -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h -index c539025c418b..66a5603dc7ed 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h -@@ -1,6 +1,6 @@ - /* SPDX-License-Identifier: GPL-2.0-only */ - /* -- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. - * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved. - */ - -@@ -95,7 +95,7 @@ struct dpu_hw_intf_ops { - - void (*bind_pingpong_blk)(struct dpu_hw_intf *intf, - const enum dpu_pingpong pp); -- void (*setup_misr)(struct dpu_hw_intf *intf, bool enable, u32 frame_count); -+ void (*setup_misr)(struct dpu_hw_intf *intf); - int (*collect_misr)(struct dpu_hw_intf *intf, u32 *misr_value); - - // Tearcheck on INTF since DPU 5.0.0 -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c -index a34cf8c979cb..a590c1f7465f 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c -@@ -1,6 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0-only - /* -- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. - * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved. - */ - -@@ -81,9 +81,9 @@ static void dpu_hw_lm_setup_border_color(struct dpu_hw_mixer *ctx, - } - } - --static void dpu_hw_lm_setup_misr(struct dpu_hw_mixer *ctx, bool enable, u32 frame_count) -+static void dpu_hw_lm_setup_misr(struct dpu_hw_mixer *ctx) - { -- dpu_hw_setup_misr(&ctx->hw, LM_MISR_CTRL, enable, frame_count, 0x0); -+ dpu_hw_setup_misr(&ctx->hw, LM_MISR_CTRL, 0x0); - } - - static int dpu_hw_lm_collect_misr(struct dpu_hw_mixer *ctx, u32 *misr_value) -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h -index 36992d046a53..98b77cda6547 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h -@@ -1,5 +1,6 @@ - /* SPDX-License-Identifier: GPL-2.0-only */ - /* -+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. - * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved. - */ - -@@ -57,7 +58,7 @@ struct dpu_hw_lm_ops { - /** - * setup_misr: Enable/disable MISR - */ -- void (*setup_misr)(struct dpu_hw_mixer *ctx, bool enable, u32 frame_count); -+ void (*setup_misr)(struct dpu_hw_mixer *ctx); - - /** - * collect_misr: Read MISR signature -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c -index b328fe22abde..1d4f0b97c3c1 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c -@@ -1,6 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0-only - /* -- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. - * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved. - */ - #define pr_fmt(fmt) "[drm:%s:%d] " fmt, __func__, __LINE__ -@@ -485,9 +485,7 @@ void _dpu_hw_setup_qos_lut(struct dpu_hw_blk_reg_map *c, u32 offset, - * note: Aside from encoders, input_sel should be set to 0x0 by default - */ - void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c, -- u32 misr_ctrl_offset, -- bool enable, u32 frame_count, -- u8 input_sel) -+ u32 misr_ctrl_offset, u8 input_sel) - { - u32 config = 0; - -@@ -496,16 +494,9 @@ void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c, - /* Clear old MISR value (in case it's read before a new value is calculated)*/ - wmb(); - -- if (enable) { -- config = (frame_count & MISR_FRAME_COUNT_MASK) | -- MISR_CTRL_ENABLE | MISR_CTRL_FREE_RUN_MASK | -- ((input_sel & 0xF) << 24); -- -- DPU_REG_WRITE(c, misr_ctrl_offset, config); -- } else { -- DPU_REG_WRITE(c, misr_ctrl_offset, 0); -- } -- -+ config = MISR_FRAME_COUNT | MISR_CTRL_ENABLE | MISR_CTRL_FREE_RUN_MASK | -+ ((input_sel & 0xF) << 24); -+ DPU_REG_WRITE(c, misr_ctrl_offset, config); - } - - int dpu_hw_collect_misr(struct dpu_hw_blk_reg_map *c, -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h -index 3feb6043e251..ec09fc3865ab 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h -@@ -1,6 +1,6 @@ - /* SPDX-License-Identifier: GPL-2.0-only */ - /* -- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. - * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved. - */ - -@@ -13,7 +13,7 @@ - #include "dpu_hw_catalog.h" - - #define REG_MASK(n) ((BIT(n)) - 1) --#define MISR_FRAME_COUNT_MASK 0xFF -+#define MISR_FRAME_COUNT 0x1 - #define MISR_CTRL_ENABLE BIT(8) - #define MISR_CTRL_STATUS BIT(9) - #define MISR_CTRL_STATUS_CLEAR BIT(10) -@@ -358,10 +358,7 @@ void _dpu_hw_setup_qos_lut(struct dpu_hw_blk_reg_map *c, u32 offset, - const struct dpu_hw_qos_cfg *cfg); - - void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c, -- u32 misr_ctrl_offset, -- bool enable, -- u32 frame_count, -- u8 input_sel); -+ u32 misr_ctrl_offset, u8 input_sel); - - int dpu_hw_collect_misr(struct dpu_hw_blk_reg_map *c, - u32 misr_ctrl_offset, --- -2.43.2 - -From 71f8a684249881949e3aa7c871957bd481171898 Mon Sep 17 00:00:00 2001 -From: Arnd Bergmann <arnd@arndb.de> -Date: Wed, 13 Dec 2023 12:23:07 +0100 -Subject: [PATCH 0352/1501] media: i2c: mt9m114: use fsleep() in place of - udelay() -Content-Length: 1695 -Lines: 45 - -[ Upstream commit 02d4e62ae2452c83e4a3e279b8e4cb4dcbad4b31 ] - -With clang-16, building without COMMON_CLK triggers a range check on -udelay() because of a constant division-by-zero calculation: - -ld.lld: error: undefined symbol: __bad_udelay ->>> referenced by mt9m114.c ->>> drivers/media/i2c/mt9m114.o:(mt9m114_power_on) in archive vmlinux.a - -In this configuration, the driver already fails to probe, before -this function gets called, so it's enough to suppress the assertion. - -Do this by using fsleep(), which turns long delays into sleep() calls -in place of the link failure. - -This is probably a good idea regardless to avoid overly long dynamic -udelay() calls on a slow clock. - -Cc: Sakari Ailus <sakari.ailus@linux.intel.com> -Fixes: 24d756e914fc ("media: i2c: Add driver for onsemi MT9M114 camera sensor") -Signed-off-by: Arnd Bergmann <arnd@arndb.de> -Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> -Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/i2c/mt9m114.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/media/i2c/mt9m114.c b/drivers/media/i2c/mt9m114.c -index ac19078ceda3..1a535c098ded 100644 ---- a/drivers/media/i2c/mt9m114.c -+++ b/drivers/media/i2c/mt9m114.c -@@ -2112,7 +2112,7 @@ static int mt9m114_power_on(struct mt9m114 *sensor) - duration = DIV_ROUND_UP(2 * 50 * 1000000, freq); - - gpiod_set_value(sensor->reset, 1); -- udelay(duration); -+ fsleep(duration); - gpiod_set_value(sensor->reset, 0); - } else { - /* --- -2.43.2 - -From f14419f20f969e0555ca4809c337ffa65f6f9553 Mon Sep 17 00:00:00 2001 -From: Hsiao Chien Sung <shawn.sung@mediatek.com> -Date: Thu, 14 Dec 2023 13:58:44 +0800 -Subject: [PATCH 0353/1501] drm/mediatek: Return error if MDP RDMA failed to - enable the clock -Content-Length: 1208 -Lines: 33 - -[ Upstream commit 21b287146adf39304193e4c49198021e06a28ded ] - -Return the result of clk_prepare_enable() instead of -always returns 0. - -Fixes: f8946e2b6bb2 ("drm/mediatek: Add display MDP RDMA support for MT8195") - -Reviewed-by: CK Hu <ck.hu@mediatek.com> -Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> -Signed-off-by: Hsiao Chien Sung <shawn.sung@mediatek.com> -Link: https://patchwork.kernel.org/project/dri-devel/patch/20231214055847.4936-21-shawn.sung@mediatek.com/ -Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/mediatek/mtk_mdp_rdma.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/mediatek/mtk_mdp_rdma.c b/drivers/gpu/drm/mediatek/mtk_mdp_rdma.c -index c3adaeefd551..c7233d0ac210 100644 ---- a/drivers/gpu/drm/mediatek/mtk_mdp_rdma.c -+++ b/drivers/gpu/drm/mediatek/mtk_mdp_rdma.c -@@ -246,8 +246,7 @@ int mtk_mdp_rdma_clk_enable(struct device *dev) - { - struct mtk_mdp_rdma *rdma = dev_get_drvdata(dev); - -- clk_prepare_enable(rdma->clk); -- return 0; -+ return clk_prepare_enable(rdma->clk); - } - - void mtk_mdp_rdma_clk_disable(struct device *dev) --- -2.43.2 - -From 993f8d7c6c33f40d541e829de5ef8ee64a518ac1 Mon Sep 17 00:00:00 2001 -From: Hsiao Chien Sung <shawn.sung@mediatek.com> -Date: Thu, 14 Dec 2023 13:58:45 +0800 -Subject: [PATCH 0354/1501] drm/mediatek: Remove the redundant driver data for - DPI -Content-Length: 2278 -Lines: 54 - -[ Upstream commit 8ac6935e5689a491f0bec78fec732722b3dad094 ] - -DPI input is in 1T2P mode on both MT8195 and MT8188. -Remove the redundant driver data to align the settings, or -the screen will glitch. - -Fixes: 2847cd7e6403 ("drm/mediatek: Add mt8188 dpi compatibles and platform data") - -Reviewed-by: CK Hu <ck.hu@mediatek.com> -Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> -Signed-off-by: Hsiao Chien Sung <shawn.sung@mediatek.com> -Link: https://patchwork.kernel.org/project/dri-devel/patch/20231214055847.4936-22-shawn.sung@mediatek.com/ -Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/mediatek/mtk_dpi.c | 16 +--------------- - 1 file changed, 1 insertion(+), 15 deletions(-) - -diff --git a/drivers/gpu/drm/mediatek/mtk_dpi.c b/drivers/gpu/drm/mediatek/mtk_dpi.c -index 4e3d9f7b4d8c..beb7d9d08e97 100644 ---- a/drivers/gpu/drm/mediatek/mtk_dpi.c -+++ b/drivers/gpu/drm/mediatek/mtk_dpi.c -@@ -966,20 +966,6 @@ static const struct mtk_dpi_conf mt8186_conf = { - .csc_enable_bit = CSC_ENABLE, - }; - --static const struct mtk_dpi_conf mt8188_dpintf_conf = { -- .cal_factor = mt8195_dpintf_calculate_factor, -- .max_clock_khz = 600000, -- .output_fmts = mt8195_output_fmts, -- .num_output_fmts = ARRAY_SIZE(mt8195_output_fmts), -- .pixels_per_iter = 4, -- .input_2pixel = false, -- .dimension_mask = DPINTF_HPW_MASK, -- .hvsize_mask = DPINTF_HSIZE_MASK, -- .channel_swap_shift = DPINTF_CH_SWAP, -- .yuv422_en_bit = DPINTF_YUV422_EN, -- .csc_enable_bit = DPINTF_CSC_ENABLE, --}; -- - static const struct mtk_dpi_conf mt8192_conf = { - .cal_factor = mt8183_calculate_factor, - .reg_h_fre_con = 0xe0, -@@ -1103,7 +1089,7 @@ static const struct of_device_id mtk_dpi_of_ids[] = { - { .compatible = "mediatek,mt8173-dpi", .data = &mt8173_conf }, - { .compatible = "mediatek,mt8183-dpi", .data = &mt8183_conf }, - { .compatible = "mediatek,mt8186-dpi", .data = &mt8186_conf }, -- { .compatible = "mediatek,mt8188-dp-intf", .data = &mt8188_dpintf_conf }, -+ { .compatible = "mediatek,mt8188-dp-intf", .data = &mt8195_dpintf_conf }, - { .compatible = "mediatek,mt8192-dpi", .data = &mt8192_conf }, - { .compatible = "mediatek,mt8195-dp-intf", .data = &mt8195_dpintf_conf }, - { /* sentinel */ }, --- -2.43.2 - -From 37050fc054520f0e4eb9ce4d64fb49b089218a7d Mon Sep 17 00:00:00 2001 -From: Hsiao Chien Sung <shawn.sung@mediatek.com> -Date: Thu, 14 Dec 2023 13:58:46 +0800 -Subject: [PATCH 0355/1501] drm/mediatek: Fix underrun in VDO1 when switches - off the layer -Content-Length: 1326 -Lines: 33 - -[ Upstream commit 73b5ab27ab2ee616f2709dc212c2b0007894a12e ] - -Do not reset Merge while using CMDQ because reset API doesn't -wait for frame done event as CMDQ does and could lead to -underrun when the layer is switching off. - -Fixes: aaf94f7c3ae6 ("drm/mediatek: Add display merge async reset control") - -Reviewed-by: CK Hu <ck.hu@mediatek.com> -Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> -Signed-off-by: Hsiao Chien Sung <shawn.sung@mediatek.com> -Link: https://patchwork.kernel.org/project/dri-devel/patch/20231214055847.4936-23-shawn.sung@mediatek.com/ -Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/mediatek/mtk_disp_merge.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/mediatek/mtk_disp_merge.c b/drivers/gpu/drm/mediatek/mtk_disp_merge.c -index e525a6b9e5b0..22f768d923d5 100644 ---- a/drivers/gpu/drm/mediatek/mtk_disp_merge.c -+++ b/drivers/gpu/drm/mediatek/mtk_disp_merge.c -@@ -103,7 +103,7 @@ void mtk_merge_stop_cmdq(struct device *dev, struct cmdq_pkt *cmdq_pkt) - mtk_ddp_write(cmdq_pkt, 0, &priv->cmdq_reg, priv->regs, - DISP_REG_MERGE_CTRL); - -- if (priv->async_clk) -+ if (!cmdq_pkt && priv->async_clk) - reset_control_reset(priv->reset_ctl); - } - --- -2.43.2 - -From 9e8fa2afaf9a219f3af61864573058e2f7b2e81f Mon Sep 17 00:00:00 2001 -From: Alex Deucher <alexander.deucher@amd.com> -Date: Mon, 27 Nov 2023 17:26:29 -0500 -Subject: [PATCH 0356/1501] drm/amdgpu/debugfs: fix error code when smc - register accessors are NULL -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1159 -Lines: 36 - -[ Upstream commit afe58346d5d3887b3e49ff623d2f2e471f232a8d ] - -Should be -EOPNOTSUPP. - -Fixes: 5104fdf50d32 ("drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL") -Reviewed-by: Christian König <christian.koenig@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c -index 0e61ebdb3f3e..8d4a3ff65c18 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c -@@ -755,7 +755,7 @@ static ssize_t amdgpu_debugfs_regs_smc_read(struct file *f, char __user *buf, - int r; - - if (!adev->smc_rreg) -- return -EPERM; -+ return -EOPNOTSUPP; - - if (size & 0x3 || *pos & 0x3) - return -EINVAL; -@@ -814,7 +814,7 @@ static ssize_t amdgpu_debugfs_regs_smc_write(struct file *f, const char __user * - int r; - - if (!adev->smc_wreg) -- return -EPERM; -+ return -EOPNOTSUPP; - - if (size & 0x3 || *pos & 0x3) - return -EINVAL; --- -2.43.2 - -From ca8e2e251c65e5a712f6025e27bd9b26d16e6f4a Mon Sep 17 00:00:00 2001 -From: Zhipeng Lu <alexious@zju.edu.cn> -Date: Thu, 14 Dec 2023 23:24:11 +0800 -Subject: [PATCH 0357/1501] drm/amd/pm: fix a double-free in si_dpm_init -Content-Length: 1584 -Lines: 37 - -[ Upstream commit ac16667237a82e2597e329eb9bc520d1cf9dff30 ] - -When the allocation of -adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails, -amdgpu_free_extended_power_table is called to free some fields of adev. -However, when the control flow returns to si_dpm_sw_init, it goes to -label dpm_failed and calls si_dpm_fini, which calls -amdgpu_free_extended_power_table again and free those fields again. Thus -a double-free is triggered. - -Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") -Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 ++--- - 1 file changed, 2 insertions(+), 3 deletions(-) - -diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c -index fc8e4ac6c8e7..df4f20293c16 100644 ---- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c -+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c -@@ -7379,10 +7379,9 @@ static int si_dpm_init(struct amdgpu_device *adev) - kcalloc(4, - sizeof(struct amdgpu_clock_voltage_dependency_entry), - GFP_KERNEL); -- if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) { -- amdgpu_free_extended_power_table(adev); -+ if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) - return -ENOMEM; -- } -+ - adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.count = 4; - adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].clk = 0; - adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].v = 0; --- -2.43.2 - -From 3426f059eacc33ecc676b0d66539297e1cfafd02 Mon Sep 17 00:00:00 2001 -From: Zhipeng Lu <alexious@zju.edu.cn> -Date: Fri, 15 Dec 2023 00:24:58 +0800 -Subject: [PATCH 0358/1501] drivers/amd/pm: fix a use-after-free in - kv_parse_power_table -Content-Length: 1488 -Lines: 40 - -[ Upstream commit 28dd788382c43b330480f57cd34cde0840896743 ] - -When ps allocated by kzalloc equals to NULL, kv_parse_power_table -frees adev->pm.dpm.ps that allocated before. However, after the control -flow goes through the following call chains: - -kv_parse_power_table - |-> kv_dpm_init - |-> kv_dpm_sw_init - |-> kv_dpm_fini - -The adev->pm.dpm.ps is used in the for loop of kv_dpm_fini after its -first free in kv_parse_power_table and causes a use-after-free bug. - -Fixes: a2e73f56fa62 ("drm/amdgpu: Add support for CIK parts") -Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - -diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c -index 5d28c951a319..5cb4725c773f 100644 ---- a/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c -+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c -@@ -2735,10 +2735,8 @@ static int kv_parse_power_table(struct amdgpu_device *adev) - non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) - &non_clock_info_array->nonClockInfo[non_clock_array_index]; - ps = kzalloc(sizeof(struct kv_ps), GFP_KERNEL); -- if (ps == NULL) { -- kfree(adev->pm.dpm.ps); -+ if (ps == NULL) - return -ENOMEM; -- } - adev->pm.dpm.ps[i].ps_priv = ps; - k = 0; - idx = (u8 *)&power_state->v2.clockInfoIndex[0]; --- -2.43.2 - -From b7b7ff0b28a8e1d0e17dc0286c48e8e1bdc1c699 Mon Sep 17 00:00:00 2001 -From: Zhipeng Lu <alexious@zju.edu.cn> -Date: Fri, 15 Dec 2023 00:58:42 +0800 -Subject: [PATCH 0359/1501] gpu/drm/radeon: fix two memleaks in radeon_vm_init -Content-Length: 1321 -Lines: 40 - -[ Upstream commit c2709b2d6a537ca0fa0f1da36fdaf07e48ef447d ] - -When radeon_bo_create and radeon_vm_clear_bo fail, the vm->page_tables -allocated before need to be freed. However, neither radeon_vm_init -itself nor its caller have done such deallocation. - -Fixes: 6d2f2944e95e ("drm/radeon: use normal BOs for the page tables v4") -Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/radeon/radeon_vm.c | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c -index 987cabbf1318..c38b4d5d6a14 100644 ---- a/drivers/gpu/drm/radeon/radeon_vm.c -+++ b/drivers/gpu/drm/radeon/radeon_vm.c -@@ -1204,13 +1204,17 @@ int radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm) - r = radeon_bo_create(rdev, pd_size, align, true, - RADEON_GEM_DOMAIN_VRAM, 0, NULL, - NULL, &vm->page_directory); -- if (r) -+ if (r) { -+ kfree(vm->page_tables); -+ vm->page_tables = NULL; - return r; -- -+ } - r = radeon_vm_clear_bo(rdev, vm->page_directory); - if (r) { - radeon_bo_unref(&vm->page_directory); - vm->page_directory = NULL; -+ kfree(vm->page_tables); -+ vm->page_tables = NULL; - return r; - } - --- -2.43.2 - -From 638942ccda557c565108d41283dd12c7a163088b Mon Sep 17 00:00:00 2001 -From: Zhipeng Lu <alexious@zju.edu.cn> -Date: Fri, 15 Dec 2023 00:59:38 +0800 -Subject: [PATCH 0360/1501] drm/amd/pm: fix a double-free in - amdgpu_parse_extended_power_table -Content-Length: 8502 -Lines: 190 - -[ Upstream commit a6582701178a47c4d0cb2188c965c59c0c0647c8 ] - -The amdgpu_free_extended_power_table is called in every error-handling -paths of amdgpu_parse_extended_power_table. However, after the following -call chain of returning: - -amdgpu_parse_extended_power_table - |-> kv_dpm_init / si_dpm_init - (the only two caller of amdgpu_parse_extended_power_table) - |-> kv_dpm_sw_init / si_dpm_sw_init - (the only caller of kv_dpm_init / si_dpm_init, accordingly) - |-> kv_dpm_fini / si_dpm_fini - (goto dpm_failed in xx_dpm_sw_init) - |-> amdgpu_free_extended_power_table - -As above, the amdgpu_free_extended_power_table is called twice in this -returning chain and thus a double-free is triggered. Similarily, the -last kfree in amdgpu_parse_extended_power_table also cause a double free -with amdgpu_free_extended_power_table in kv_dpm_fini. - -Fixes: 84176663e70d ("drm/amd/pm: create a new holder for those APIs used only by legacy ASICs(si/kv)") -Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | 52 +++++-------------- - 1 file changed, 13 insertions(+), 39 deletions(-) - -diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c -index 81fb4e5dd804..60377747bab4 100644 ---- a/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c -+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c -@@ -272,10 +272,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - le16_to_cpu(power_info->pplib4.usVddcDependencyOnSCLKOffset)); - ret = amdgpu_parse_clk_voltage_dep_table(&adev->pm.dpm.dyn_state.vddc_dependency_on_sclk, - dep_table); -- if (ret) { -- amdgpu_free_extended_power_table(adev); -+ if (ret) - return ret; -- } - } - if (power_info->pplib4.usVddciDependencyOnMCLKOffset) { - dep_table = (ATOM_PPLIB_Clock_Voltage_Dependency_Table *) -@@ -283,10 +281,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - le16_to_cpu(power_info->pplib4.usVddciDependencyOnMCLKOffset)); - ret = amdgpu_parse_clk_voltage_dep_table(&adev->pm.dpm.dyn_state.vddci_dependency_on_mclk, - dep_table); -- if (ret) { -- amdgpu_free_extended_power_table(adev); -+ if (ret) - return ret; -- } - } - if (power_info->pplib4.usVddcDependencyOnMCLKOffset) { - dep_table = (ATOM_PPLIB_Clock_Voltage_Dependency_Table *) -@@ -294,10 +290,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - le16_to_cpu(power_info->pplib4.usVddcDependencyOnMCLKOffset)); - ret = amdgpu_parse_clk_voltage_dep_table(&adev->pm.dpm.dyn_state.vddc_dependency_on_mclk, - dep_table); -- if (ret) { -- amdgpu_free_extended_power_table(adev); -+ if (ret) - return ret; -- } - } - if (power_info->pplib4.usMvddDependencyOnMCLKOffset) { - dep_table = (ATOM_PPLIB_Clock_Voltage_Dependency_Table *) -@@ -305,10 +299,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - le16_to_cpu(power_info->pplib4.usMvddDependencyOnMCLKOffset)); - ret = amdgpu_parse_clk_voltage_dep_table(&adev->pm.dpm.dyn_state.mvdd_dependency_on_mclk, - dep_table); -- if (ret) { -- amdgpu_free_extended_power_table(adev); -+ if (ret) - return ret; -- } - } - if (power_info->pplib4.usMaxClockVoltageOnDCOffset) { - ATOM_PPLIB_Clock_Voltage_Limit_Table *clk_v = -@@ -339,10 +331,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - kcalloc(psl->ucNumEntries, - sizeof(struct amdgpu_phase_shedding_limits_entry), - GFP_KERNEL); -- if (!adev->pm.dpm.dyn_state.phase_shedding_limits_table.entries) { -- amdgpu_free_extended_power_table(adev); -+ if (!adev->pm.dpm.dyn_state.phase_shedding_limits_table.entries) - return -ENOMEM; -- } - - entry = &psl->entries[0]; - for (i = 0; i < psl->ucNumEntries; i++) { -@@ -383,10 +373,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - ATOM_PPLIB_CAC_Leakage_Record *entry; - u32 size = cac_table->ucNumEntries * sizeof(struct amdgpu_cac_leakage_table); - adev->pm.dpm.dyn_state.cac_leakage_table.entries = kzalloc(size, GFP_KERNEL); -- if (!adev->pm.dpm.dyn_state.cac_leakage_table.entries) { -- amdgpu_free_extended_power_table(adev); -+ if (!adev->pm.dpm.dyn_state.cac_leakage_table.entries) - return -ENOMEM; -- } - entry = &cac_table->entries[0]; - for (i = 0; i < cac_table->ucNumEntries; i++) { - if (adev->pm.dpm.platform_caps & ATOM_PP_PLATFORM_CAP_EVV) { -@@ -438,10 +426,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - sizeof(struct amdgpu_vce_clock_voltage_dependency_entry); - adev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.entries = - kzalloc(size, GFP_KERNEL); -- if (!adev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.entries) { -- amdgpu_free_extended_power_table(adev); -+ if (!adev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.entries) - return -ENOMEM; -- } - adev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.count = - limits->numEntries; - entry = &limits->entries[0]; -@@ -493,10 +479,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - sizeof(struct amdgpu_uvd_clock_voltage_dependency_entry); - adev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries = - kzalloc(size, GFP_KERNEL); -- if (!adev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries) { -- amdgpu_free_extended_power_table(adev); -+ if (!adev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries) - return -ENOMEM; -- } - adev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.count = - limits->numEntries; - entry = &limits->entries[0]; -@@ -525,10 +509,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - sizeof(struct amdgpu_clock_voltage_dependency_entry); - adev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table.entries = - kzalloc(size, GFP_KERNEL); -- if (!adev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table.entries) { -- amdgpu_free_extended_power_table(adev); -+ if (!adev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table.entries) - return -ENOMEM; -- } - adev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table.count = - limits->numEntries; - entry = &limits->entries[0]; -@@ -548,10 +530,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - le16_to_cpu(ext_hdr->usPPMTableOffset)); - adev->pm.dpm.dyn_state.ppm_table = - kzalloc(sizeof(struct amdgpu_ppm_table), GFP_KERNEL); -- if (!adev->pm.dpm.dyn_state.ppm_table) { -- amdgpu_free_extended_power_table(adev); -+ if (!adev->pm.dpm.dyn_state.ppm_table) - return -ENOMEM; -- } - adev->pm.dpm.dyn_state.ppm_table->ppm_design = ppm->ucPpmDesign; - adev->pm.dpm.dyn_state.ppm_table->cpu_core_number = - le16_to_cpu(ppm->usCpuCoreNumber); -@@ -583,10 +563,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - sizeof(struct amdgpu_clock_voltage_dependency_entry); - adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table.entries = - kzalloc(size, GFP_KERNEL); -- if (!adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table.entries) { -- amdgpu_free_extended_power_table(adev); -+ if (!adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table.entries) - return -ENOMEM; -- } - adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table.count = - limits->numEntries; - entry = &limits->entries[0]; -@@ -606,10 +584,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - ATOM_PowerTune_Table *pt; - adev->pm.dpm.dyn_state.cac_tdp_table = - kzalloc(sizeof(struct amdgpu_cac_tdp_table), GFP_KERNEL); -- if (!adev->pm.dpm.dyn_state.cac_tdp_table) { -- amdgpu_free_extended_power_table(adev); -+ if (!adev->pm.dpm.dyn_state.cac_tdp_table) - return -ENOMEM; -- } - if (rev > 0) { - ATOM_PPLIB_POWERTUNE_Table_V1 *ppt = (ATOM_PPLIB_POWERTUNE_Table_V1 *) - (mode_info->atom_context->bios + data_offset + -@@ -645,10 +621,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - ret = amdgpu_parse_clk_voltage_dep_table( - &adev->pm.dpm.dyn_state.vddgfx_dependency_on_sclk, - dep_table); -- if (ret) { -- kfree(adev->pm.dpm.dyn_state.vddgfx_dependency_on_sclk.entries); -+ if (ret) - return ret; -- } - } - } - --- -2.43.2 - -From 7348495bac0765751f9accb6c35d35007e679bc9 Mon Sep 17 00:00:00 2001 -From: Zhiguo Niu <zhiguo.niu@unisoc.com> -Date: Tue, 12 Dec 2023 10:15:27 +0800 -Subject: [PATCH 0361/1501] f2fs: fix to check return value of - f2fs_recover_xattr_data -Content-Length: 1964 -Lines: 62 - -[ Upstream commit 86d7d57a3f096c8349b32a0cd5f6f314e4416a6d ] - -Should check return value of f2fs_recover_xattr_data in -__f2fs_setxattr rather than doing invalid retry if error happen. - -Also just do set_page_dirty in f2fs_recover_xattr_data when -page is changed really. - -Fixes: 50a472bbc79f ("f2fs: do not return EFSCORRUPTED, but try to run online repair") -Signed-off-by: Zhiguo Niu <zhiguo.niu@unisoc.com> -Reviewed-by: Chao Yu <chao@kernel.org> -Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/f2fs/node.c | 6 +++--- - fs/f2fs/xattr.c | 11 +++++++---- - 2 files changed, 10 insertions(+), 7 deletions(-) - -diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c -index 6c7f6a649d27..9b546fd21010 100644 ---- a/fs/f2fs/node.c -+++ b/fs/f2fs/node.c -@@ -2751,11 +2751,11 @@ int f2fs_recover_xattr_data(struct inode *inode, struct page *page) - f2fs_update_inode_page(inode); - - /* 3: update and set xattr node page dirty */ -- if (page) -+ if (page) { - memcpy(F2FS_NODE(xpage), F2FS_NODE(page), - VALID_XATTR_BLOCK_SIZE); -- -- set_page_dirty(xpage); -+ set_page_dirty(xpage); -+ } - f2fs_put_page(xpage, 1); - - return 0; -diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c -index a8fc2cac6879..f290fe9327c4 100644 ---- a/fs/f2fs/xattr.c -+++ b/fs/f2fs/xattr.c -@@ -660,11 +660,14 @@ static int __f2fs_setxattr(struct inode *inode, int index, - here = __find_xattr(base_addr, last_base_addr, NULL, index, len, name); - if (!here) { - if (!F2FS_I(inode)->i_xattr_nid) { -+ error = f2fs_recover_xattr_data(inode, NULL); - f2fs_notice(F2FS_I_SB(inode), -- "recover xattr in inode (%lu)", inode->i_ino); -- f2fs_recover_xattr_data(inode, NULL); -- kfree(base_addr); -- goto retry; -+ "recover xattr in inode (%lu), error(%d)", -+ inode->i_ino, error); -+ if (!error) { -+ kfree(base_addr); -+ goto retry; -+ } - } - f2fs_err(F2FS_I_SB(inode), "set inode (%lu) has corrupted xattr", - inode->i_ino); --- -2.43.2 - -From 36e2a8355f4c3716e7ebda3b5682010078777d48 Mon Sep 17 00:00:00 2001 -From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com> -Date: Fri, 1 Dec 2023 15:20:26 +0530 -Subject: [PATCH 0362/1501] clk: qcom: videocc-sm8150: Add missing PLL config - property -Content-Length: 1176 -Lines: 29 - -[ Upstream commit 71f130c9193f613d497f7245365ed05ffdb0a401 ] - -When the driver was ported upstream, PLL test_ctl_hi1 register value -was omitted. Add it to ensure the PLLs are fully configured. - -Fixes: 5658e8cf1a8a ("clk: qcom: add video clock controller driver for SM8150") -Signed-off-by: Satya Priya Kakitapalli <quic_skakitap@quicinc.com> -Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org> -Link: https://lore.kernel.org/r/20231201-videocc-8150-v3-3-56bec3a5e443@quicinc.com -Signed-off-by: Bjorn Andersson <andersson@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/clk/qcom/videocc-sm8150.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/clk/qcom/videocc-sm8150.c b/drivers/clk/qcom/videocc-sm8150.c -index 1afdbe4a249d..5579463f7e46 100644 ---- a/drivers/clk/qcom/videocc-sm8150.c -+++ b/drivers/clk/qcom/videocc-sm8150.c -@@ -33,6 +33,7 @@ static struct alpha_pll_config video_pll0_config = { - .config_ctl_val = 0x20485699, - .config_ctl_hi_val = 0x00002267, - .config_ctl_hi1_val = 0x00000024, -+ .test_ctl_hi1_val = 0x00000020, - .user_ctl_val = 0x00000000, - .user_ctl_hi_val = 0x00000805, - .user_ctl_hi1_val = 0x000000D0, --- -2.43.2 - -From e4ad7f8859bb9cede6d3ced7c9e42224c4383250 Mon Sep 17 00:00:00 2001 -From: Yang Yingliang <yangyingliang@huawei.com> -Date: Tue, 28 Nov 2023 21:30:16 +0800 -Subject: [PATCH 0363/1501] clk: sp7021: fix return value check in - sp7021_clk_probe() -Content-Length: 1362 -Lines: 42 - -[ Upstream commit 1004c346a2b7393fce37dd1f320555e0a0d71e3f ] - -devm_platform_ioremap_resource() never returns NULL pointer, -it will return ERR_PTR() when it fails, so replace the check -with IS_ERR(). - -Fixes: d54c1fd4a51e ("clk: Add Sunplus SP7021 clock driver") -Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> -Link: https://lore.kernel.org/r/20231128133016.2494699-1-yangyingliang@huawei.com -Signed-off-by: Stephen Boyd <sboyd@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/clk/clk-sp7021.c | 12 ++++++------ - 1 file changed, 6 insertions(+), 6 deletions(-) - -diff --git a/drivers/clk/clk-sp7021.c b/drivers/clk/clk-sp7021.c -index 01d3c4c7b0b2..7cb7d501d7a6 100644 ---- a/drivers/clk/clk-sp7021.c -+++ b/drivers/clk/clk-sp7021.c -@@ -604,14 +604,14 @@ static int sp7021_clk_probe(struct platform_device *pdev) - int i; - - clk_base = devm_platform_ioremap_resource(pdev, 0); -- if (!clk_base) -- return -ENXIO; -+ if (IS_ERR(clk_base)) -+ return PTR_ERR(clk_base); - pll_base = devm_platform_ioremap_resource(pdev, 1); -- if (!pll_base) -- return -ENXIO; -+ if (IS_ERR(pll_base)) -+ return PTR_ERR(pll_base); - sys_base = devm_platform_ioremap_resource(pdev, 2); -- if (!sys_base) -- return -ENXIO; -+ if (IS_ERR(sys_base)) -+ return PTR_ERR(sys_base); - - /* enable default clks */ - for (i = 0; i < ARRAY_SIZE(sp_clken); i++) --- -2.43.2 - -From d8626fc25273ff7946b774fd0b65d394d40a87f7 Mon Sep 17 00:00:00 2001 -From: Jay Buddhabhatti <jay.buddhabhatti@amd.com> -Date: Wed, 29 Nov 2023 03:29:15 -0800 -Subject: [PATCH 0364/1501] drivers: clk: zynqmp: calculate closest mux rate -Content-Length: 2561 -Lines: 53 - -[ Upstream commit b782921ddd7f84f524723090377903f399fdbbcb ] - -Currently zynqmp clock driver is not calculating closest mux rate and -because of that Linux is not setting proper frequency for CPU and -not able to set given frequency for dynamic frequency scaling. - -E.g., In current logic initial acpu clock parent and frequency as below -apll1 0 0 0 2199999978 0 0 50000 Y - acpu0_mux 0 0 0 2199999978 0 0 50000 Y - acpu0_idiv1 0 0 0 2199999978 0 0 50000 Y - acpu0 0 0 0 2199999978 0 0 50000 Y - -After changing acpu frequency to 549999994 Hz using CPU freq scaling its -selecting incorrect parent which is not closest frequency. -rpll_to_xpd 0 0 0 1599999984 0 0 50000 Y - acpu0_mux 0 0 0 1599999984 0 0 50000 Y - acpu0_div1 0 0 0 533333328 0 0 50000 Y - acpu0 0 0 0 533333328 0 0 50000 Y - -Parent should remain same since 549999994 = 2199999978 / 4. - -So use __clk_mux_determine_rate_closest() generic function to calculate -closest rate for mux clock. After this change its selecting correct -parent and correct clock rate. -apll1 0 0 0 2199999978 0 0 50000 Y - acpu0_mux 0 0 0 2199999978 0 0 50000 Y - acpu0_div1 0 0 0 549999995 0 0 50000 Y - acpu0 0 0 0 549999995 0 0 50000 Y - -Fixes: 3fde0e16d016 ("drivers: clk: Add ZynqMP clock driver") -Signed-off-by: Jay Buddhabhatti <jay.buddhabhatti@amd.com> -Link: https://lore.kernel.org/r/20231129112916.23125-2-jay.buddhabhatti@amd.com -Signed-off-by: Stephen Boyd <sboyd@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/clk/zynqmp/clk-mux-zynqmp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/clk/zynqmp/clk-mux-zynqmp.c b/drivers/clk/zynqmp/clk-mux-zynqmp.c -index 60359333f26d..9b5d3050b742 100644 ---- a/drivers/clk/zynqmp/clk-mux-zynqmp.c -+++ b/drivers/clk/zynqmp/clk-mux-zynqmp.c -@@ -89,7 +89,7 @@ static int zynqmp_clk_mux_set_parent(struct clk_hw *hw, u8 index) - static const struct clk_ops zynqmp_clk_mux_ops = { - .get_parent = zynqmp_clk_mux_get_parent, - .set_parent = zynqmp_clk_mux_set_parent, -- .determine_rate = __clk_mux_determine_rate, -+ .determine_rate = __clk_mux_determine_rate_closest, - }; - - static const struct clk_ops zynqmp_clk_mux_ro_ops = { --- -2.43.2 - -From 8167710f8658b9c56676e721ae0396dec3185686 Mon Sep 17 00:00:00 2001 -From: Jay Buddhabhatti <jay.buddhabhatti@amd.com> -Date: Wed, 29 Nov 2023 03:29:16 -0800 -Subject: [PATCH 0365/1501] drivers: clk: zynqmp: update divider round rate - logic -Content-Length: 3693 -Lines: 113 - -[ Upstream commit 1fe15be1fb613534ecbac5f8c3f8744f757d237d ] - -Currently zynqmp divider round rate is considering single parent and -calculating rate and parent rate accordingly. But if divider clock flag -is set to SET_RATE_PARENT then its not trying to traverse through all -parent rate and not selecting best parent rate from that. So use common -divider_round_rate() which is traversing through all clock parents and -its rate and calculating proper parent rate. - -Fixes: 3fde0e16d016 ("drivers: clk: Add ZynqMP clock driver") -Signed-off-by: Jay Buddhabhatti <jay.buddhabhatti@amd.com> -Link: https://lore.kernel.org/r/20231129112916.23125-3-jay.buddhabhatti@amd.com -Signed-off-by: Stephen Boyd <sboyd@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/clk/zynqmp/divider.c | 66 +++--------------------------------- - 1 file changed, 5 insertions(+), 61 deletions(-) - -diff --git a/drivers/clk/zynqmp/divider.c b/drivers/clk/zynqmp/divider.c -index 33a3b2a22659..5a00487ae408 100644 ---- a/drivers/clk/zynqmp/divider.c -+++ b/drivers/clk/zynqmp/divider.c -@@ -110,52 +110,6 @@ static unsigned long zynqmp_clk_divider_recalc_rate(struct clk_hw *hw, - return DIV_ROUND_UP_ULL(parent_rate, value); - } - --static void zynqmp_get_divider2_val(struct clk_hw *hw, -- unsigned long rate, -- struct zynqmp_clk_divider *divider, -- u32 *bestdiv) --{ -- int div1; -- int div2; -- long error = LONG_MAX; -- unsigned long div1_prate; -- struct clk_hw *div1_parent_hw; -- struct zynqmp_clk_divider *pdivider; -- struct clk_hw *div2_parent_hw = clk_hw_get_parent(hw); -- -- if (!div2_parent_hw) -- return; -- -- pdivider = to_zynqmp_clk_divider(div2_parent_hw); -- if (!pdivider) -- return; -- -- div1_parent_hw = clk_hw_get_parent(div2_parent_hw); -- if (!div1_parent_hw) -- return; -- -- div1_prate = clk_hw_get_rate(div1_parent_hw); -- *bestdiv = 1; -- for (div1 = 1; div1 <= pdivider->max_div;) { -- for (div2 = 1; div2 <= divider->max_div;) { -- long new_error = ((div1_prate / div1) / div2) - rate; -- -- if (abs(new_error) < abs(error)) { -- *bestdiv = div2; -- error = new_error; -- } -- if (divider->flags & CLK_DIVIDER_POWER_OF_TWO) -- div2 = div2 << 1; -- else -- div2++; -- } -- if (pdivider->flags & CLK_DIVIDER_POWER_OF_TWO) -- div1 = div1 << 1; -- else -- div1++; -- } --} -- - /** - * zynqmp_clk_divider_round_rate() - Round rate of divider clock - * @hw: handle between common and hardware-specific interfaces -@@ -174,6 +128,7 @@ static long zynqmp_clk_divider_round_rate(struct clk_hw *hw, - u32 div_type = divider->div_type; - u32 bestdiv; - int ret; -+ u8 width; - - /* if read only, just return current value */ - if (divider->flags & CLK_DIVIDER_READ_ONLY) { -@@ -193,23 +148,12 @@ static long zynqmp_clk_divider_round_rate(struct clk_hw *hw, - return DIV_ROUND_UP_ULL((u64)*prate, bestdiv); - } - -- bestdiv = zynqmp_divider_get_val(*prate, rate, divider->flags); -+ width = fls(divider->max_div); - -- /* -- * In case of two divisors, compute best divider values and return -- * divider2 value based on compute value. div1 will be automatically -- * set to optimum based on required total divider value. -- */ -- if (div_type == TYPE_DIV2 && -- (clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT)) { -- zynqmp_get_divider2_val(hw, rate, divider, &bestdiv); -- } -+ rate = divider_round_rate(hw, rate, prate, NULL, width, divider->flags); - -- if ((clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT) && divider->is_frac) -- bestdiv = rate % *prate ? 1 : bestdiv; -- -- bestdiv = min_t(u32, bestdiv, divider->max_div); -- *prate = rate * bestdiv; -+ if (divider->is_frac && (clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT) && (rate % *prate)) -+ *prate = rate; - - return rate; - } --- -2.43.2 - -From 90c6cada5006f0945631e598277766ab37d2b51b Mon Sep 17 00:00:00 2001 -From: Curtis Klein <curtis.klein@hpe.com> -Date: Tue, 5 Dec 2023 11:05:22 -0800 -Subject: [PATCH 0366/1501] watchdog: set cdev owner before adding -Content-Length: 2266 -Lines: 53 - -[ Upstream commit 38d75297745f04206db9c29bdd75557f0344c7cc ] - -When the new watchdog character device is registered, it becomes -available for opening. This creates a race where userspace may open the -device before the character device's owner is set. This results in an -imbalance in module_get calls as the cdev_get in cdev_open will not -increment the reference count on the watchdog driver module. - -This causes problems when the watchdog character device is released as -the module loader's reference will also be released. This makes it -impossible to open the watchdog device later on as it now appears that -the module is being unloaded. The open will fail with -ENXIO from -chrdev_open. - -The legacy watchdog device will fail with -EBUSY from the try_module_get -in watchdog_open because it's module owner is the watchdog core module -so it can still be opened but it will fail to get a refcount on the -underlying watchdog device driver. - -Fixes: 72139dfa2464 ("watchdog: Fix the race between the release of watchdog_core_data and cdev") -Signed-off-by: Curtis Klein <curtis.klein@hpe.com> -Reviewed-by: Guenter Roeck <linux@roeck-us.net> -Link: https://lore.kernel.org/r/20231205190522.55153-1-curtis.klein@hpe.com -Signed-off-by: Guenter Roeck <linux@roeck-us.net> -Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/watchdog/watchdog_dev.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c -index 15df74e11a59..e2bd266b1b5b 100644 ---- a/drivers/watchdog/watchdog_dev.c -+++ b/drivers/watchdog/watchdog_dev.c -@@ -1073,6 +1073,7 @@ static int watchdog_cdev_register(struct watchdog_device *wdd) - - /* Fill in the data structures */ - cdev_init(&wd_data->cdev, &watchdog_fops); -+ wd_data->cdev.owner = wdd->ops->owner; - - /* Add the device */ - err = cdev_device_add(&wd_data->cdev, &wd_data->dev); -@@ -1087,8 +1088,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd) - return err; - } - -- wd_data->cdev.owner = wdd->ops->owner; -- - /* Record time of most recent heartbeat as 'just before now'. */ - wd_data->last_hw_keepalive = ktime_sub(ktime_get(), 1); - watchdog_set_open_deadline(wd_data); --- -2.43.2 - -From a6ce482b1bee20a6d5b7d957cff5e254501c84a1 Mon Sep 17 00:00:00 2001 -From: Jerry Hoemann <jerry.hoemann@hpe.com> -Date: Wed, 13 Dec 2023 14:53:38 -0700 -Subject: [PATCH 0367/1501] watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO -Content-Length: 1641 -Lines: 43 - -[ Upstream commit dced0b3e51dd2af3730efe14dd86b5e3173f0a65 ] - -Avoid unnecessary crashes by claiming only NMIs that are due to -ERROR signalling or generated by the hpwdt hardware device. - -The code does this, but only for iLO5. - -The intent was to preserve legacy, Gen9 and earlier, semantics of -using hpwdt for error containtment as hardware/firmware would signal -fatal IO errors as an NMI with the expectation of hpwdt crashing -the system. Howerver, these IO errors should be received by hpwdt -as an NMI_IO_CHECK. So the test is overly permissive and should -not be limited to only ilo5. - -We need to enable this protection for future iLOs not matching the -current PCI IDs. - -Fixes: 62290a5c194b ("watchdog: hpwdt: Claim NMIs generated by iLO5") -Signed-off-by: Jerry Hoemann <jerry.hoemann@hpe.com> -Reviewed-by: Guenter Roeck <linux@roeck-us.net> -Link: https://lore.kernel.org/r/20231213215340.495734-2-jerry.hoemann@hpe.com -Signed-off-by: Guenter Roeck <linux@roeck-us.net> -Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/watchdog/hpwdt.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c -index f79f932bca14..79ed1626d8ea 100644 ---- a/drivers/watchdog/hpwdt.c -+++ b/drivers/watchdog/hpwdt.c -@@ -178,7 +178,7 @@ static int hpwdt_pretimeout(unsigned int ulReason, struct pt_regs *regs) - "3. OA Forward Progress Log\n" - "4. iLO Event Log"; - -- if (ilo5 && ulReason == NMI_UNKNOWN && !mynmi) -+ if (ulReason == NMI_UNKNOWN && !mynmi) - return NMI_DONE; - - if (ilo5 && !pretimeout && !mynmi) --- -2.43.2 - -From 375c9af5b852723233d1048dc4f92eb4d978bc4c Mon Sep 17 00:00:00 2001 -From: Stefan Wahren <wahrenst@gmx.net> -Date: Sun, 12 Nov 2023 18:32:51 +0100 -Subject: [PATCH 0368/1501] watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT - handling -Content-Length: 1927 -Lines: 49 - -[ Upstream commit f33f5b1fd1be5f5106d16f831309648cb0f1c31d ] - -Users report about the unexpected behavior for setting timeouts above -15 sec on Raspberry Pi. According to watchdog-api.rst the ioctl -WDIOC_SETTIMEOUT shouldn't fail because of hardware limitations. -But looking at the code shows that max_timeout based on the -register value PM_WDOG_TIME_SET, which is the maximum. - -Since 664a39236e71 ("watchdog: Introduce hardware maximum heartbeat -in watchdog core") the watchdog core is able to handle this problem. - -This fix has been tested with watchdog-test from selftests. - -Link: https://bugzilla.kernel.org/show_bug.cgi?id=217374 -Fixes: 664a39236e71 ("watchdog: Introduce hardware maximum heartbeat in watchdog core") -Signed-off-by: Stefan Wahren <wahrenst@gmx.net> -Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> -Reviewed-by: Guenter Roeck <linux@roeck-us.net> -Link: https://lore.kernel.org/r/20231112173251.4827-1-wahrenst@gmx.net -Signed-off-by: Guenter Roeck <linux@roeck-us.net> -Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/watchdog/bcm2835_wdt.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c -index 7a855289ff5e..bb001c5d7f17 100644 ---- a/drivers/watchdog/bcm2835_wdt.c -+++ b/drivers/watchdog/bcm2835_wdt.c -@@ -42,6 +42,7 @@ - - #define SECS_TO_WDOG_TICKS(x) ((x) << 16) - #define WDOG_TICKS_TO_SECS(x) ((x) >> 16) -+#define WDOG_TICKS_TO_MSECS(x) ((x) * 1000 >> 16) - - struct bcm2835_wdt { - void __iomem *base; -@@ -140,7 +141,7 @@ static struct watchdog_device bcm2835_wdt_wdd = { - .info = &bcm2835_wdt_info, - .ops = &bcm2835_wdt_ops, - .min_timeout = 1, -- .max_timeout = WDOG_TICKS_TO_SECS(PM_WDOG_TIME_SET), -+ .max_hw_heartbeat_ms = WDOG_TICKS_TO_MSECS(PM_WDOG_TIME_SET), - .timeout = WDOG_TICKS_TO_SECS(PM_WDOG_TIME_SET), - }; - --- -2.43.2 - -From 9ca5edf11ea5187a536d4d3957370d76f7a8a46e Mon Sep 17 00:00:00 2001 -From: Vignesh Raghavendra <vigneshr@ti.com> -Date: Wed, 13 Dec 2023 19:31:10 +0530 -Subject: [PATCH 0369/1501] watchdog: rti_wdt: Drop runtime pm reference count - when watchdog is unused -Content-Length: 2075 -Lines: 63 - -[ Upstream commit c1a6edf3b541e44e78f10bc6024df779715723f1 ] - -Call runtime_pm_put*() if watchdog is not already started during probe and re -enable it in watchdog start as required. - -On K3 SoCs, watchdogs and their corresponding CPUs are under same -power-domain, so if the reference count of unused watchdogs aren't -dropped, it will lead to CPU hotplug failures as Device Management -firmware won't allow to turn off the power-domain due to dangling -reference count. - -Fixes: 2d63908bdbfb ("watchdog: Add K3 RTI watchdog support") -Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com> -Tested-by: Manorit Chawdhry <m-chawdhry@ti.com> -Reviewed-by: Guenter Roeck <linux@roeck-us.net> -Link: https://lore.kernel.org/r/20231213140110.938129-1-vigneshr@ti.com -Signed-off-by: Guenter Roeck <linux@roeck-us.net> -Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/watchdog/rti_wdt.c | 13 ++++++++++++- - 1 file changed, 12 insertions(+), 1 deletion(-) - -diff --git a/drivers/watchdog/rti_wdt.c b/drivers/watchdog/rti_wdt.c -index 8e1be7ba0103..9215793a1c81 100644 ---- a/drivers/watchdog/rti_wdt.c -+++ b/drivers/watchdog/rti_wdt.c -@@ -77,6 +77,11 @@ static int rti_wdt_start(struct watchdog_device *wdd) - { - u32 timer_margin; - struct rti_wdt_device *wdt = watchdog_get_drvdata(wdd); -+ int ret; -+ -+ ret = pm_runtime_resume_and_get(wdd->parent); -+ if (ret) -+ return ret; - - /* set timeout period */ - timer_margin = (u64)wdd->timeout * wdt->freq; -@@ -343,6 +348,9 @@ static int rti_wdt_probe(struct platform_device *pdev) - if (last_ping) - watchdog_set_last_hw_keepalive(wdd, last_ping); - -+ if (!watchdog_hw_running(wdd)) -+ pm_runtime_put_sync(&pdev->dev); -+ - return 0; - - err_iomap: -@@ -357,7 +365,10 @@ static void rti_wdt_remove(struct platform_device *pdev) - struct rti_wdt_device *wdt = platform_get_drvdata(pdev); - - watchdog_unregister_device(&wdt->wdd); -- pm_runtime_put(&pdev->dev); -+ -+ if (!pm_runtime_suspended(&pdev->dev)) -+ pm_runtime_put(&pdev->dev); -+ - pm_runtime_disable(&pdev->dev); - } - --- -2.43.2 - -From 1bbcb2ebc8be85593a6444faa6ca1f020d2d72ee Mon Sep 17 00:00:00 2001 -From: Marek Vasut <marek.vasut+renesas@mailbox.org> -Date: Sun, 5 Nov 2023 21:06:15 +0100 -Subject: [PATCH 0370/1501] clk: rs9: Fix DIF OEn bit placement on 9FGV0241 -Content-Length: 1262 -Lines: 32 - -[ Upstream commit 29d861b5d29b6c80a887e93ad982cbbf4af2a06b ] - -On 9FGV0241, the DIF OE0 is BIT(1) and DIF OE1 is BIT(2), on the other -chips like 9FGV0441 and 9FGV0841 DIF OE0 is BIT(0) and so on. Increment -the index in BIT() macro instead of the result of BIT() macro to shift -the bit correctly on 9FGV0241. - -Fixes: 603df193ec51 ("clk: rs9: Support device specific dif bit calculation") -Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> -Link: https://lore.kernel.org/r/20231105200642.62792-1-marek.vasut+renesas@mailbox.org -Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com> -Signed-off-by: Stephen Boyd <sboyd@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/clk/clk-renesas-pcie.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/clk/clk-renesas-pcie.c b/drivers/clk/clk-renesas-pcie.c -index 380245f635d6..6606aba253c5 100644 ---- a/drivers/clk/clk-renesas-pcie.c -+++ b/drivers/clk/clk-renesas-pcie.c -@@ -163,7 +163,7 @@ static u8 rs9_calc_dif(const struct rs9_driver_data *rs9, int idx) - enum rs9_model model = rs9->chip_info->model; - - if (model == RENESAS_9FGV0241) -- return BIT(idx) + 1; -+ return BIT(idx + 1); - else if (model == RENESAS_9FGV0441) - return BIT(idx); - --- -2.43.2 - -From 28740ee6cd81b7b1cc6a077ee46edf423ea9de72 Mon Sep 17 00:00:00 2001 -From: Su Hui <suhui@nfschina.com> -Date: Wed, 1 Nov 2023 11:16:36 +0800 -Subject: [PATCH 0371/1501] clk: si5341: fix an error code problem in - si5341_output_clk_set_rate -Content-Length: 1187 -Lines: 33 - -[ Upstream commit 5607068ae5ab02c3ac9cabc6859d36e98004c341 ] - -regmap_bulk_write() return zero or negative error code, return the value -of regmap_bulk_write() rather than '0'. - -Fixes: 3044a860fd09 ("clk: Add Si5341/Si5340 driver") -Acked-by: Mike Looijmans <mike.looijmans@topic.nl> -Signed-off-by: Su Hui <suhui@nfschina.com> -Link: https://lore.kernel.org/r/20231101031633.996124-1-suhui@nfschina.com -Signed-off-by: Stephen Boyd <sboyd@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/clk/clk-si5341.c | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - -diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c -index 845b451511d2..6e8dd7387cfd 100644 ---- a/drivers/clk/clk-si5341.c -+++ b/drivers/clk/clk-si5341.c -@@ -895,10 +895,8 @@ static int si5341_output_clk_set_rate(struct clk_hw *hw, unsigned long rate, - r[0] = r_div ? (r_div & 0xff) : 1; - r[1] = (r_div >> 8) & 0xff; - r[2] = (r_div >> 16) & 0xff; -- err = regmap_bulk_write(output->data->regmap, -+ return regmap_bulk_write(output->data->regmap, - SI5341_OUT_R_REG(output), r, 3); -- -- return 0; - } - - static int si5341_output_reparent(struct clk_si5341_output *output, u8 index) --- -2.43.2 - -From a12d8891ffa3d97b4b6d38ebcadfd48b6eb019b0 Mon Sep 17 00:00:00 2001 -From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> -Date: Sat, 9 Dec 2023 22:32:19 +0200 -Subject: [PATCH 0372/1501] ASoC: amd: vangogh: Drop conflicting ACPI-based - probing -Content-Length: 3584 -Lines: 104 - -[ Upstream commit ddd1ee12a8fb6e4d6f86eddeba64c135eee56623 ] - -The Vangogh machine driver variant based on the MAX98388 amplifier, as -found on Valve's Steam Deck OLED, relies on probing via an ACPI match -table. This worked fine until commit 197b1f7f0df1 ("ASoC: amd: Add new -dmi entries to config entry") enabled SOF support for the target machine -(i.e. Galileo product), causing the sound card to enter the deferred -probe state indefinitely: - -$ cat /sys/kernel/debug/devices_deferred -AMDI8821:00 acp5x_mach: Register card (acp5x-max98388) failed - -The issue is related to commit e89f45edb747 ("ASoC: amd: vangogh: Add -check for acp config flags in vangogh platform"), which tries to -mitigate potential conflicts between SOF and generic ACP Vangogh -drivers, due to sharing the PCI device IDs. - -However, the solution is effective only if the machine driver is -directly probed by pci-acp5x through platform_device_register_full(). - -Hence, remove the conflicting ACPI based probing and rely exclusively on -DMI quirks for sound card setup. - -Fixes: dba22efd0d17 ("ASoC: amd: vangogh: Add support for NAU8821/MAX98388 variant") -Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> -Reviewed-by: Emil Velikov <emil.velikov@collabora.com> -Link: https://msgid.link/r/20231209203229.878730-2-cristian.ciocaltea@collabora.com -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - sound/soc/amd/vangogh/acp5x-mach.c | 35 +++++++++++------------------- - 1 file changed, 13 insertions(+), 22 deletions(-) - -diff --git a/sound/soc/amd/vangogh/acp5x-mach.c b/sound/soc/amd/vangogh/acp5x-mach.c -index de4b478a983d..7878e061ecb9 100644 ---- a/sound/soc/amd/vangogh/acp5x-mach.c -+++ b/sound/soc/amd/vangogh/acp5x-mach.c -@@ -439,7 +439,15 @@ static const struct dmi_system_id acp5x_vg_quirk_table[] = { - .matches = { - DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Valve"), - DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Jupiter"), -- } -+ }, -+ .driver_data = (void *)&acp5x_8821_35l41_card, -+ }, -+ { -+ .matches = { -+ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Valve"), -+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Galileo"), -+ }, -+ .driver_data = (void *)&acp5x_8821_98388_card, - }, - {} - }; -@@ -452,25 +460,15 @@ static int acp5x_probe(struct platform_device *pdev) - struct snd_soc_card *card; - int ret; - -- card = (struct snd_soc_card *)device_get_match_data(dev); -- if (!card) { -- /* -- * This is normally the result of directly probing the driver -- * in pci-acp5x through platform_device_register_full(), which -- * is necessary for the CS35L41 variant, as it doesn't support -- * ACPI probing and relies on DMI quirks. -- */ -- dmi_id = dmi_first_match(acp5x_vg_quirk_table); -- if (!dmi_id) -- return -ENODEV; -- -- card = &acp5x_8821_35l41_card; -- } -+ dmi_id = dmi_first_match(acp5x_vg_quirk_table); -+ if (!dmi_id || !dmi_id->driver_data) -+ return -ENODEV; - - machine = devm_kzalloc(dev, sizeof(*machine), GFP_KERNEL); - if (!machine) - return -ENOMEM; - -+ card = dmi_id->driver_data; - card->dev = dev; - platform_set_drvdata(pdev, card); - snd_soc_card_set_drvdata(card, machine); -@@ -482,17 +480,10 @@ static int acp5x_probe(struct platform_device *pdev) - return 0; - } - --static const struct acpi_device_id acp5x_acpi_match[] = { -- { "AMDI8821", (kernel_ulong_t)&acp5x_8821_98388_card }, -- {}, --}; --MODULE_DEVICE_TABLE(acpi, acp5x_acpi_match); -- - static struct platform_driver acp5x_mach_driver = { - .driver = { - .name = DRV_NAME, - .pm = &snd_soc_pm_ops, -- .acpi_match_table = acp5x_acpi_match, - }, - .probe = acp5x_probe, - }; --- -2.43.2 - -From ff0ac4b903b7c60be00b3ccf0bed66eb199da4ec Mon Sep 17 00:00:00 2001 -From: Gergo Koteles <soyer@irl.hu> -Date: Thu, 14 Dec 2023 01:25:39 +0100 -Subject: [PATCH 0373/1501] ASoC: tas2781: add support for FW version 0x0503 -Content-Length: 1070 -Lines: 29 - -[ Upstream commit ee00330a5b78e2acf4b3aac32913da43e2c12a26 ] - -Layout of FW version 0x0503 is compatible with 0x0502. -Already supported by TI's tas2781-linux-driver tree. -https://git.ti.com/cgit/tas2781-linux-drivers/tas2781-linux-driver/ - -Fixes: 915f5eadebd2 ("ASoC: tas2781: firmware lib") -Signed-off-by: Gergo Koteles <soyer@irl.hu> -Link: https://msgid.link/r/98d4ee4e01e834af72a1a0bea6736facf43582e0.1702513517.git.soyer@irl.hu -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - sound/soc/codecs/tas2781-fmwlib.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/sound/soc/codecs/tas2781-fmwlib.c b/sound/soc/codecs/tas2781-fmwlib.c -index 5c09e441a936..85e14ff61769 100644 ---- a/sound/soc/codecs/tas2781-fmwlib.c -+++ b/sound/soc/codecs/tas2781-fmwlib.c -@@ -1982,6 +1982,7 @@ static int tasdevice_dspfw_ready(const struct firmware *fmw, - case 0x301: - case 0x302: - case 0x502: -+ case 0x503: - tas_priv->fw_parse_variable_header = - fw_parse_variable_header_kernel; - tas_priv->fw_parse_program_data = --- -2.43.2 - -From 646df7c634222f9852c787ee7d114778050cc17a Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?N=C3=ADcolas=20F=2E=20R=2E=20A=2E=20Prado?= - <nfraprado@collabora.com> -Date: Tue, 21 Nov 2023 09:29:27 -0500 -Subject: [PATCH 0374/1501] drm/mediatek: dp: Add phy_mtk_dp module as - pre-dependency -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1788 -Lines: 37 - -[ Upstream commit c8048dd0b07df68724805254b9e994d99e9a7af4 ] - -The mtk_dp driver registers a phy device which is handled by the -phy_mtk_dp driver and assumes that the phy probe will complete -synchronously, proceeding to make use of functionality exposed by that -driver right away. This assumption however is false when the phy driver -is built as a module, causing the mtk_dp driver to fail probe in this -case. - -Add the phy_mtk_dp module as a pre-dependency to the mtk_dp module to -ensure the phy module has been loaded before the dp, so that the phy -probe happens synchrounously and the mtk_dp driver can probe -successfully even with the phy driver built as a module. - -Suggested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> -Fixes: f70ac097a2cf ("drm/mediatek: Add MT8195 Embedded DisplayPort driver") -Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com> -Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> -Reviewed-by: Guillaume Ranquet <granquet@baylibre.com> -Link: https://patchwork.kernel.org/project/dri-devel/patch/20231121142938.460846-1-nfraprado@collabora.com/ -Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/mediatek/mtk_dp.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c -index e4c16ba9902d..2136a596efa1 100644 ---- a/drivers/gpu/drm/mediatek/mtk_dp.c -+++ b/drivers/gpu/drm/mediatek/mtk_dp.c -@@ -2818,3 +2818,4 @@ MODULE_AUTHOR("Markus Schneider-Pargmann <msp@baylibre.com>"); - MODULE_AUTHOR("Bo-Chen Chen <rex-bc.chen@mediatek.com>"); - MODULE_DESCRIPTION("MediaTek DisplayPort Driver"); - MODULE_LICENSE("GPL"); -+MODULE_SOFTDEP("pre: phy_mtk_dp"); --- -2.43.2 - -From db43f2eabdceedc41b8c3e0621ac42ca19b13b7d Mon Sep 17 00:00:00 2001 -From: Xingyuan Mo <hdthky0@gmail.com> -Date: Fri, 8 Dec 2023 21:00:59 +0800 -Subject: [PATCH 0375/1501] accel/habanalabs: fix information leak in - sec_attest_info() -Content-Length: 1311 -Lines: 31 - -[ Upstream commit a9f07790a4b2250f0140e9a61c7f842fd9b618c7 ] - -This function may copy the pad0 field of struct hl_info_sec_attest to user -mode which has not been initialized, resulting in leakage of kernel heap -data to user mode. To prevent this, use kzalloc() to allocate and zero out -the buffer, which can also eliminate other uninitialized holes, if any. - -Fixes: 0c88760f8f5e ("habanalabs/gaudi2: add secured attestation info uapi") -Signed-off-by: Xingyuan Mo <hdthky0@gmail.com> -Reviewed-by: Oded Gabbay <ogabbay@kernel.org> -Signed-off-by: Oded Gabbay <ogabbay@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/accel/habanalabs/common/habanalabs_ioctl.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/accel/habanalabs/common/habanalabs_ioctl.c b/drivers/accel/habanalabs/common/habanalabs_ioctl.c -index 8ef36effb95b..a7cd625d82c0 100644 ---- a/drivers/accel/habanalabs/common/habanalabs_ioctl.c -+++ b/drivers/accel/habanalabs/common/habanalabs_ioctl.c -@@ -685,7 +685,7 @@ static int sec_attest_info(struct hl_fpriv *hpriv, struct hl_info_args *args) - if (!sec_attest_info) - return -ENOMEM; - -- info = kmalloc(sizeof(*info), GFP_KERNEL); -+ info = kzalloc(sizeof(*info), GFP_KERNEL); - if (!info) { - rc = -ENOMEM; - goto free_sec_attest_info; --- -2.43.2 - -From 95417cc6a16c54c12975fe24e35dc23641d65fc8 Mon Sep 17 00:00:00 2001 -From: Konrad Dybcio <konrad.dybcio@linaro.org> -Date: Mon, 18 Dec 2023 17:02:04 +0100 -Subject: [PATCH 0376/1501] clk: qcom: gcc-sm8550: Add the missing - RETAIN_FF_ENABLE GDSC flag -Content-Length: 2719 -Lines: 92 - -[ Upstream commit 1fe8273c8d4088dd68faaab8640ec95f381cbf1e ] - -All of the 8550's GCC GDSCs can and should use the retain registers so -as not to lose their state when entering lower power modes. - -Fixes: 955f2ea3b9e9 ("clk: qcom: Add GCC driver for SM8550") -Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> -Link: https://lore.kernel.org/r/20231218-topic-8550_fixes-v1-3-ce1272d77540@linaro.org -Signed-off-by: Bjorn Andersson <andersson@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/clk/qcom/gcc-sm8550.c | 16 ++++++++-------- - 1 file changed, 8 insertions(+), 8 deletions(-) - -diff --git a/drivers/clk/qcom/gcc-sm8550.c b/drivers/clk/qcom/gcc-sm8550.c -index 586126c4dd90..1c3d78500392 100644 ---- a/drivers/clk/qcom/gcc-sm8550.c -+++ b/drivers/clk/qcom/gcc-sm8550.c -@@ -3002,7 +3002,7 @@ static struct gdsc pcie_0_gdsc = { - .name = "pcie_0_gdsc", - }, - .pwrsts = PWRSTS_OFF_ON, -- .flags = POLL_CFG_GDSCR, -+ .flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE, - }; - - static struct gdsc pcie_0_phy_gdsc = { -@@ -3011,7 +3011,7 @@ static struct gdsc pcie_0_phy_gdsc = { - .name = "pcie_0_phy_gdsc", - }, - .pwrsts = PWRSTS_OFF_ON, -- .flags = POLL_CFG_GDSCR, -+ .flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE, - }; - - static struct gdsc pcie_1_gdsc = { -@@ -3020,7 +3020,7 @@ static struct gdsc pcie_1_gdsc = { - .name = "pcie_1_gdsc", - }, - .pwrsts = PWRSTS_OFF_ON, -- .flags = POLL_CFG_GDSCR, -+ .flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE, - }; - - static struct gdsc pcie_1_phy_gdsc = { -@@ -3029,7 +3029,7 @@ static struct gdsc pcie_1_phy_gdsc = { - .name = "pcie_1_phy_gdsc", - }, - .pwrsts = PWRSTS_OFF_ON, -- .flags = POLL_CFG_GDSCR, -+ .flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE, - }; - - static struct gdsc ufs_phy_gdsc = { -@@ -3038,7 +3038,7 @@ static struct gdsc ufs_phy_gdsc = { - .name = "ufs_phy_gdsc", - }, - .pwrsts = PWRSTS_OFF_ON, -- .flags = POLL_CFG_GDSCR, -+ .flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE, - }; - - static struct gdsc ufs_mem_phy_gdsc = { -@@ -3047,7 +3047,7 @@ static struct gdsc ufs_mem_phy_gdsc = { - .name = "ufs_mem_phy_gdsc", - }, - .pwrsts = PWRSTS_OFF_ON, -- .flags = POLL_CFG_GDSCR, -+ .flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE, - }; - - static struct gdsc usb30_prim_gdsc = { -@@ -3056,7 +3056,7 @@ static struct gdsc usb30_prim_gdsc = { - .name = "usb30_prim_gdsc", - }, - .pwrsts = PWRSTS_OFF_ON, -- .flags = POLL_CFG_GDSCR, -+ .flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE, - }; - - static struct gdsc usb3_phy_gdsc = { -@@ -3065,7 +3065,7 @@ static struct gdsc usb3_phy_gdsc = { - .name = "usb3_phy_gdsc", - }, - .pwrsts = PWRSTS_OFF_ON, -- .flags = POLL_CFG_GDSCR, -+ .flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE, - }; - - static struct clk_regmap *gcc_sm8550_clocks[] = { --- -2.43.2 - -From af73be8a06d28dd691061c8bc5b7d9db11052cfb Mon Sep 17 00:00:00 2001 -From: Konrad Dybcio <konrad.dybcio@linaro.org> -Date: Mon, 18 Dec 2023 17:02:05 +0100 -Subject: [PATCH 0377/1501] clk: qcom: gcc-sm8550: Mark the PCIe GDSCs votable -Content-Length: 1942 -Lines: 59 - -[ Upstream commit e7fe73fc6b68ee97b1e8f124a66a5ee50d8d5e5b ] - -The PCIe GDSCs on most Qualcomm platforms expect the OS to always -consider collapse requests as successful. This also concerns SM8550. - -Add the VOTABLE flag to the GDSCs in question to comply with these -expectations. - -Fixes: 955f2ea3b9e9 ("clk: qcom: Add GCC driver for SM8550") -Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> -Link: https://lore.kernel.org/r/20231218-topic-8550_fixes-v1-4-ce1272d77540@linaro.org -Signed-off-by: Bjorn Andersson <andersson@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/clk/qcom/gcc-sm8550.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/drivers/clk/qcom/gcc-sm8550.c b/drivers/clk/qcom/gcc-sm8550.c -index 1c3d78500392..a16d07426b71 100644 ---- a/drivers/clk/qcom/gcc-sm8550.c -+++ b/drivers/clk/qcom/gcc-sm8550.c -@@ -3002,7 +3002,7 @@ static struct gdsc pcie_0_gdsc = { - .name = "pcie_0_gdsc", - }, - .pwrsts = PWRSTS_OFF_ON, -- .flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE, -+ .flags = VOTABLE | POLL_CFG_GDSCR | RETAIN_FF_ENABLE, - }; - - static struct gdsc pcie_0_phy_gdsc = { -@@ -3011,7 +3011,7 @@ static struct gdsc pcie_0_phy_gdsc = { - .name = "pcie_0_phy_gdsc", - }, - .pwrsts = PWRSTS_OFF_ON, -- .flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE, -+ .flags = VOTABLE | POLL_CFG_GDSCR | RETAIN_FF_ENABLE, - }; - - static struct gdsc pcie_1_gdsc = { -@@ -3020,7 +3020,7 @@ static struct gdsc pcie_1_gdsc = { - .name = "pcie_1_gdsc", - }, - .pwrsts = PWRSTS_OFF_ON, -- .flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE, -+ .flags = VOTABLE | POLL_CFG_GDSCR | RETAIN_FF_ENABLE, - }; - - static struct gdsc pcie_1_phy_gdsc = { -@@ -3029,7 +3029,7 @@ static struct gdsc pcie_1_phy_gdsc = { - .name = "pcie_1_phy_gdsc", - }, - .pwrsts = PWRSTS_OFF_ON, -- .flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE, -+ .flags = VOTABLE | POLL_CFG_GDSCR | RETAIN_FF_ENABLE, - }; - - static struct gdsc ufs_phy_gdsc = { --- -2.43.2 - -From 98fd99cc9faa610360e6fad7593977ecfc947b11 Mon Sep 17 00:00:00 2001 -From: Konrad Dybcio <konrad.dybcio@linaro.org> -Date: Mon, 18 Dec 2023 17:02:06 +0100 -Subject: [PATCH 0378/1501] clk: qcom: gcc-sm8550: use collapse-voting for PCIe - GDSCs -Content-Length: 1911 -Lines: 62 - -[ Upstream commit 7e77a39265293ea4f05e20fff180755503c49918 ] - -The PCIe GDSCs can be shared with other masters and should use the APCS -collapse-vote register when updating the power state. - -This is specifically also needed to be able to disable power domains -that have been enabled by boot firmware using the vote register. - -Following other recent Qualcomm platforms, describe this register and -the corresponding mask for the PCIe (and _phy) GDSCs. - -Fixes: 955f2ea3b9e9 ("clk: qcom: Add GCC driver for SM8550") -Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> -Link: https://lore.kernel.org/r/20231218-topic-8550_fixes-v1-5-ce1272d77540@linaro.org -Signed-off-by: Bjorn Andersson <andersson@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/clk/qcom/gcc-sm8550.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/drivers/clk/qcom/gcc-sm8550.c b/drivers/clk/qcom/gcc-sm8550.c -index a16d07426b71..73bda0d03aa7 100644 ---- a/drivers/clk/qcom/gcc-sm8550.c -+++ b/drivers/clk/qcom/gcc-sm8550.c -@@ -2998,6 +2998,8 @@ static struct clk_branch gcc_video_axi1_clk = { - - static struct gdsc pcie_0_gdsc = { - .gdscr = 0x6b004, -+ .collapse_ctrl = 0x52020, -+ .collapse_mask = BIT(0), - .pd = { - .name = "pcie_0_gdsc", - }, -@@ -3007,6 +3009,8 @@ static struct gdsc pcie_0_gdsc = { - - static struct gdsc pcie_0_phy_gdsc = { - .gdscr = 0x6c000, -+ .collapse_ctrl = 0x52020, -+ .collapse_mask = BIT(3), - .pd = { - .name = "pcie_0_phy_gdsc", - }, -@@ -3016,6 +3020,8 @@ static struct gdsc pcie_0_phy_gdsc = { - - static struct gdsc pcie_1_gdsc = { - .gdscr = 0x8d004, -+ .collapse_ctrl = 0x52020, -+ .collapse_mask = BIT(1), - .pd = { - .name = "pcie_1_gdsc", - }, -@@ -3025,6 +3031,8 @@ static struct gdsc pcie_1_gdsc = { - - static struct gdsc pcie_1_phy_gdsc = { - .gdscr = 0x8e000, -+ .collapse_ctrl = 0x52020, -+ .collapse_mask = BIT(4), - .pd = { - .name = "pcie_1_phy_gdsc", - }, --- -2.43.2 - -From 984fbb9ee8855549df47fe32eea2638110082e77 Mon Sep 17 00:00:00 2001 -From: Konrad Dybcio <konrad.dybcio@linaro.org> -Date: Mon, 18 Dec 2023 17:02:07 +0100 -Subject: [PATCH 0379/1501] clk: qcom: gcc-sm8550: Mark RCGs shared where - applicable -Content-Length: 12823 -Lines: 406 - -[ Upstream commit 929c75d575667af389c8a9e03cebc93d43bb7f31 ] - -The vast majority of shared RCGs were not marked as such. Fix it. - -Fixes: 955f2ea3b9e9 ("clk: qcom: Add GCC driver for SM8550") -Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> -Link: https://lore.kernel.org/r/20231218-topic-8550_fixes-v1-6-ce1272d77540@linaro.org -Signed-off-by: Bjorn Andersson <andersson@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/clk/qcom/gcc-sm8550.c | 86 +++++++++++++++++------------------ - 1 file changed, 43 insertions(+), 43 deletions(-) - -diff --git a/drivers/clk/qcom/gcc-sm8550.c b/drivers/clk/qcom/gcc-sm8550.c -index 73bda0d03aa7..b883dffe5f7a 100644 ---- a/drivers/clk/qcom/gcc-sm8550.c -+++ b/drivers/clk/qcom/gcc-sm8550.c -@@ -401,7 +401,7 @@ static struct clk_rcg2 gcc_gp1_clk_src = { - .parent_data = gcc_parent_data_1, - .num_parents = ARRAY_SIZE(gcc_parent_data_1), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -416,7 +416,7 @@ static struct clk_rcg2 gcc_gp2_clk_src = { - .parent_data = gcc_parent_data_1, - .num_parents = ARRAY_SIZE(gcc_parent_data_1), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -431,7 +431,7 @@ static struct clk_rcg2 gcc_gp3_clk_src = { - .parent_data = gcc_parent_data_1, - .num_parents = ARRAY_SIZE(gcc_parent_data_1), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -451,7 +451,7 @@ static struct clk_rcg2 gcc_pcie_0_aux_clk_src = { - .parent_data = gcc_parent_data_2, - .num_parents = ARRAY_SIZE(gcc_parent_data_2), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -471,7 +471,7 @@ static struct clk_rcg2 gcc_pcie_0_phy_rchng_clk_src = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -486,7 +486,7 @@ static struct clk_rcg2 gcc_pcie_1_aux_clk_src = { - .parent_data = gcc_parent_data_2, - .num_parents = ARRAY_SIZE(gcc_parent_data_2), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -501,7 +501,7 @@ static struct clk_rcg2 gcc_pcie_1_phy_rchng_clk_src = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -521,7 +521,7 @@ static struct clk_rcg2 gcc_pdm2_clk_src = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -536,7 +536,7 @@ static struct clk_rcg2 gcc_qupv3_i2c_s0_clk_src = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -551,7 +551,7 @@ static struct clk_rcg2 gcc_qupv3_i2c_s1_clk_src = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -566,7 +566,7 @@ static struct clk_rcg2 gcc_qupv3_i2c_s2_clk_src = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -581,7 +581,7 @@ static struct clk_rcg2 gcc_qupv3_i2c_s3_clk_src = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -596,7 +596,7 @@ static struct clk_rcg2 gcc_qupv3_i2c_s4_clk_src = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -611,7 +611,7 @@ static struct clk_rcg2 gcc_qupv3_i2c_s5_clk_src = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -626,7 +626,7 @@ static struct clk_rcg2 gcc_qupv3_i2c_s6_clk_src = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -641,7 +641,7 @@ static struct clk_rcg2 gcc_qupv3_i2c_s7_clk_src = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -656,7 +656,7 @@ static struct clk_rcg2 gcc_qupv3_i2c_s8_clk_src = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -671,7 +671,7 @@ static struct clk_rcg2 gcc_qupv3_i2c_s9_clk_src = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -700,7 +700,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s0_clk_src_init = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap1_s0_clk_src = { -@@ -717,7 +717,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s1_clk_src_init = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap1_s1_clk_src = { -@@ -750,7 +750,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s2_clk_src_init = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap1_s2_clk_src = { -@@ -767,7 +767,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s3_clk_src_init = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap1_s3_clk_src = { -@@ -784,7 +784,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s4_clk_src_init = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap1_s4_clk_src = { -@@ -801,7 +801,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s5_clk_src_init = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap1_s5_clk_src = { -@@ -818,7 +818,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s6_clk_src_init = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap1_s6_clk_src = { -@@ -835,7 +835,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s7_clk_src_init = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap1_s7_clk_src = { -@@ -852,7 +852,7 @@ static struct clk_init_data gcc_qupv3_wrap2_s0_clk_src_init = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap2_s0_clk_src = { -@@ -869,7 +869,7 @@ static struct clk_init_data gcc_qupv3_wrap2_s1_clk_src_init = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap2_s1_clk_src = { -@@ -886,7 +886,7 @@ static struct clk_init_data gcc_qupv3_wrap2_s2_clk_src_init = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap2_s2_clk_src = { -@@ -903,7 +903,7 @@ static struct clk_init_data gcc_qupv3_wrap2_s3_clk_src_init = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap2_s3_clk_src = { -@@ -920,7 +920,7 @@ static struct clk_init_data gcc_qupv3_wrap2_s4_clk_src_init = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap2_s4_clk_src = { -@@ -937,7 +937,7 @@ static struct clk_init_data gcc_qupv3_wrap2_s5_clk_src_init = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap2_s5_clk_src = { -@@ -975,7 +975,7 @@ static struct clk_init_data gcc_qupv3_wrap2_s6_clk_src_init = { - .parent_data = gcc_parent_data_8, - .num_parents = ARRAY_SIZE(gcc_parent_data_8), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap2_s6_clk_src = { -@@ -992,7 +992,7 @@ static struct clk_init_data gcc_qupv3_wrap2_s7_clk_src_init = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap2_s7_clk_src = { -@@ -1025,7 +1025,7 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = { - .parent_data = gcc_parent_data_9, - .num_parents = ARRAY_SIZE(gcc_parent_data_9), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -1048,7 +1048,7 @@ static struct clk_rcg2 gcc_sdcc4_apps_clk_src = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -1071,7 +1071,7 @@ static struct clk_rcg2 gcc_ufs_phy_axi_clk_src = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -1093,7 +1093,7 @@ static struct clk_rcg2 gcc_ufs_phy_ice_core_clk_src = { - .parent_data = gcc_parent_data_3, - .num_parents = ARRAY_SIZE(gcc_parent_data_3), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -1114,7 +1114,7 @@ static struct clk_rcg2 gcc_ufs_phy_phy_aux_clk_src = { - .parent_data = gcc_parent_data_4, - .num_parents = ARRAY_SIZE(gcc_parent_data_4), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -1136,7 +1136,7 @@ static struct clk_rcg2 gcc_ufs_phy_unipro_core_clk_src = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -1159,7 +1159,7 @@ static struct clk_rcg2 gcc_usb30_prim_master_clk_src = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -1174,7 +1174,7 @@ static struct clk_rcg2 gcc_usb30_prim_mock_utmi_clk_src = { - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -1189,7 +1189,7 @@ static struct clk_rcg2 gcc_usb3_prim_phy_aux_clk_src = { - .parent_data = gcc_parent_data_2, - .num_parents = ARRAY_SIZE(gcc_parent_data_2), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - --- -2.43.2 - -From 318aa1593fce7098b146ff6476553cf110eb6f9e Mon Sep 17 00:00:00 2001 -From: Konrad Dybcio <konrad.dybcio@linaro.org> -Date: Mon, 18 Dec 2023 17:02:08 +0100 -Subject: [PATCH 0380/1501] clk: qcom: gpucc-sm8550: Update GPU PLL settings -Content-Length: 1193 -Lines: 36 - -[ Upstream commit 1d595972da12b5a78748eeb3ba1ff58bb0283b91 ] - -The settings in the driver seem to have been taken from an older -release. Update them to match the latest values. - -Fixes: bfae40744b33 ("clk: qcom: gpucc-sm8550: Add support for graphics clock controller") -Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> -Link: https://lore.kernel.org/r/20231218-topic-8550_fixes-v1-7-ce1272d77540@linaro.org -Signed-off-by: Bjorn Andersson <andersson@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/clk/qcom/gpucc-sm8550.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/clk/qcom/gpucc-sm8550.c b/drivers/clk/qcom/gpucc-sm8550.c -index 420dcb27b47d..2fa8673424d7 100644 ---- a/drivers/clk/qcom/gpucc-sm8550.c -+++ b/drivers/clk/qcom/gpucc-sm8550.c -@@ -35,12 +35,12 @@ enum { - }; - - static const struct pll_vco lucid_ole_vco[] = { -- { 249600000, 2300000000, 0 }, -+ { 249600000, 2000000000, 0 }, - }; - - static const struct alpha_pll_config gpu_cc_pll0_config = { -- .l = 0x0d, -- .alpha = 0x0, -+ .l = 0x1e, -+ .alpha = 0xbaaa, - .config_ctl_val = 0x20485699, - .config_ctl_hi_val = 0x00182261, - .config_ctl_hi1_val = 0x82aa299c, --- -2.43.2 - -From 4d848df2afcfbb14d909d5b57c5563c2e878c4ae Mon Sep 17 00:00:00 2001 -From: Konrad Dybcio <konrad.dybcio@linaro.org> -Date: Mon, 18 Dec 2023 17:02:09 +0100 -Subject: [PATCH 0381/1501] clk: qcom: dispcc-sm8550: Update disp PLL settings -Content-Length: 1540 -Lines: 42 - -[ Upstream commit febd251d8775c4fb6e4acd6b5d7b0ed707f4611f ] - -The settings in the driver seem to have been taken from an older -release. Update them to match the latest values. - -Fixes: 90114ca11476 ("clk: qcom: add SM8550 DISPCC driver") -Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> -Link: https://lore.kernel.org/r/20231218-topic-8550_fixes-v1-8-ce1272d77540@linaro.org -Signed-off-by: Bjorn Andersson <andersson@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/clk/qcom/dispcc-sm8550.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/drivers/clk/qcom/dispcc-sm8550.c b/drivers/clk/qcom/dispcc-sm8550.c -index aefa19f3c2c5..0b8f0904b339 100644 ---- a/drivers/clk/qcom/dispcc-sm8550.c -+++ b/drivers/clk/qcom/dispcc-sm8550.c -@@ -81,6 +81,10 @@ static const struct alpha_pll_config disp_cc_pll0_config = { - .config_ctl_val = 0x20485699, - .config_ctl_hi_val = 0x00182261, - .config_ctl_hi1_val = 0x82aa299c, -+ .test_ctl_val = 0x00000000, -+ .test_ctl_hi_val = 0x00000003, -+ .test_ctl_hi1_val = 0x00009000, -+ .test_ctl_hi2_val = 0x00000034, - .user_ctl_val = 0x00000000, - .user_ctl_hi_val = 0x00000005, - }; -@@ -108,6 +112,10 @@ static const struct alpha_pll_config disp_cc_pll1_config = { - .config_ctl_val = 0x20485699, - .config_ctl_hi_val = 0x00182261, - .config_ctl_hi1_val = 0x82aa299c, -+ .test_ctl_val = 0x00000000, -+ .test_ctl_hi_val = 0x00000003, -+ .test_ctl_hi1_val = 0x00009000, -+ .test_ctl_hi2_val = 0x00000034, - .user_ctl_val = 0x00000000, - .user_ctl_hi_val = 0x00000005, - }; --- -2.43.2 - -From aa33dcb4952ed4bc6eef5a1b375eb9485dc28d76 Mon Sep 17 00:00:00 2001 -From: Konrad Dybcio <konrad.dybcio@linaro.org> -Date: Mon, 18 Dec 2023 17:02:10 +0100 -Subject: [PATCH 0382/1501] clk: qcom: dispcc-sm8550: Use the correct PLL - configuration function -Content-Length: 1327 -Lines: 31 - -[ Upstream commit c559bcb92564cbaedd43c749cf9b6fbb3d53ad5e ] - -To ensure that all fields (particularly CAL_L and CAL_L_RINGOSC) are -filled properly, use the correct prepare function for OLE PLLs. - -Fixes: 90114ca11476 ("clk: qcom: add SM8550 DISPCC driver") -Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> -Link: https://lore.kernel.org/r/20231218-topic-8550_fixes-v1-9-ce1272d77540@linaro.org -Signed-off-by: Bjorn Andersson <andersson@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/clk/qcom/dispcc-sm8550.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/clk/qcom/dispcc-sm8550.c b/drivers/clk/qcom/dispcc-sm8550.c -index 0b8f0904b339..f96d8b81fd9a 100644 ---- a/drivers/clk/qcom/dispcc-sm8550.c -+++ b/drivers/clk/qcom/dispcc-sm8550.c -@@ -1774,8 +1774,8 @@ static int disp_cc_sm8550_probe(struct platform_device *pdev) - goto err_put_rpm; - } - -- clk_lucid_evo_pll_configure(&disp_cc_pll0, regmap, &disp_cc_pll0_config); -- clk_lucid_evo_pll_configure(&disp_cc_pll1, regmap, &disp_cc_pll1_config); -+ clk_lucid_ole_pll_configure(&disp_cc_pll0, regmap, &disp_cc_pll0_config); -+ clk_lucid_ole_pll_configure(&disp_cc_pll1, regmap, &disp_cc_pll1_config); - - /* Enable clock gating for MDP clocks */ - regmap_update_bits(regmap, DISP_CC_MISC_CMD, 0x10, 0x10); --- -2.43.2 - -From a1224b95e16332bc766f958e3d80e246c7a796ec Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Th=C3=A9o=20Lebrun?= <theo.lebrun@bootlin.com> -Date: Mon, 18 Dec 2023 18:14:16 +0100 -Subject: [PATCH 0383/1501] clk: fixed-rate: fix - clk_hw_register_fixed_rate_with_accuracy_parent_hw -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1409 -Lines: 31 - -[ Upstream commit ee0cf5e07f44a10fce8f1bfa9db226c0b5ecf880 ] - -Add missing comma and remove extraneous NULL argument. The macro is -currently used by no one which explains why the typo slipped by. - -Fixes: 2d34f09e79c9 ("clk: fixed-rate: Add support for specifying parents via DT/pointers") -Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com> -Link: https://lore.kernel.org/r/20231218-mbly-clk-v1-1-44ce54108f06@bootlin.com -Signed-off-by: Stephen Boyd <sboyd@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/linux/clk-provider.h | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h -index ace3a4ce2fc9..1293c38ddb7f 100644 ---- a/include/linux/clk-provider.h -+++ b/include/linux/clk-provider.h -@@ -448,8 +448,8 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name, - */ - #define clk_hw_register_fixed_rate_with_accuracy_parent_hw(dev, name, \ - parent_hw, flags, fixed_rate, fixed_accuracy) \ -- __clk_hw_register_fixed_rate((dev), NULL, (name), NULL, (parent_hw) \ -- NULL, NULL, (flags), (fixed_rate), \ -+ __clk_hw_register_fixed_rate((dev), NULL, (name), NULL, (parent_hw), \ -+ NULL, (flags), (fixed_rate), \ - (fixed_accuracy), 0, false) - /** - * clk_hw_register_fixed_rate_with_accuracy_parent_data - register fixed-rate --- -2.43.2 - -From 888a98a4ee0510ea968d2c8ffc2cab1bdba66ac6 Mon Sep 17 00:00:00 2001 -From: Philipp Zabel <p.zabel@pengutronix.de> -Date: Thu, 19 Oct 2023 22:07:02 +0200 -Subject: [PATCH 0384/1501] pwm: stm32: Use hweight32 in - stm32_pwm_detect_channels -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1710 -Lines: 55 - -[ Upstream commit 41fa8f57c0d269243fe3bde2bce71e82c884b9ad ] - -Use hweight32() to count the CCxE bits in stm32_pwm_detect_channels(). -Since the return value is assigned to chip.npwm, change it to unsigned -int as well. - -Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> -Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> -Reviewed-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com> -Signed-off-by: Thierry Reding <thierry.reding@gmail.com> -Stable-dep-of: 19f1016ea960 ("pwm: stm32: Fix enable count for clk in .probe()") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/pwm/pwm-stm32.c | 17 ++--------------- - 1 file changed, 2 insertions(+), 15 deletions(-) - -diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c -index 3303a754ea02..ffdfd81c0613 100644 ---- a/drivers/pwm/pwm-stm32.c -+++ b/drivers/pwm/pwm-stm32.c -@@ -578,10 +578,9 @@ static void stm32_pwm_detect_complementary(struct stm32_pwm *priv) - priv->have_complementary_output = (ccer != 0); - } - --static int stm32_pwm_detect_channels(struct stm32_pwm *priv) -+static unsigned int stm32_pwm_detect_channels(struct stm32_pwm *priv) - { - u32 ccer; -- int npwm = 0; - - /* - * If channels enable bits don't exist writing 1 will have no -@@ -591,19 +590,7 @@ static int stm32_pwm_detect_channels(struct stm32_pwm *priv) - regmap_read(priv->regmap, TIM_CCER, &ccer); - regmap_clear_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE); - -- if (ccer & TIM_CCER_CC1E) -- npwm++; -- -- if (ccer & TIM_CCER_CC2E) -- npwm++; -- -- if (ccer & TIM_CCER_CC3E) -- npwm++; -- -- if (ccer & TIM_CCER_CC4E) -- npwm++; -- -- return npwm; -+ return hweight32(ccer & TIM_CCER_CCXE); - } - - static int stm32_pwm_probe(struct platform_device *pdev) --- -2.43.2 - -From 1bf92921641f108c1b173f496edb8be80d13d8e4 Mon Sep 17 00:00:00 2001 -From: Philipp Zabel <p.zabel@pengutronix.de> -Date: Thu, 19 Oct 2023 22:07:04 +0200 -Subject: [PATCH 0385/1501] pwm: stm32: Fix enable count for clk in .probe() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2509 -Lines: 69 - -[ Upstream commit 19f1016ea9600ed89bc24247c36ff5934ad94fbb ] - -Make the driver take over hardware state without disabling in .probe() -and enable the clock for each enabled channel. - -Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> -[ukleinek: split off from a patch that also implemented .get_state()] -Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> -Fixes: 7edf7369205b ("pwm: Add driver for STM32 plaftorm") -Reviewed-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com> -Signed-off-by: Thierry Reding <thierry.reding@gmail.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/pwm/pwm-stm32.c | 18 ++++++++++++++---- - 1 file changed, 14 insertions(+), 4 deletions(-) - -diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c -index ffdfd81c0613..58ece15ef6c3 100644 ---- a/drivers/pwm/pwm-stm32.c -+++ b/drivers/pwm/pwm-stm32.c -@@ -578,17 +578,21 @@ static void stm32_pwm_detect_complementary(struct stm32_pwm *priv) - priv->have_complementary_output = (ccer != 0); - } - --static unsigned int stm32_pwm_detect_channels(struct stm32_pwm *priv) -+static unsigned int stm32_pwm_detect_channels(struct stm32_pwm *priv, -+ unsigned int *num_enabled) - { -- u32 ccer; -+ u32 ccer, ccer_backup; - - /* - * If channels enable bits don't exist writing 1 will have no - * effect so we can detect and count them. - */ -+ regmap_read(priv->regmap, TIM_CCER, &ccer_backup); - regmap_set_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE); - regmap_read(priv->regmap, TIM_CCER, &ccer); -- regmap_clear_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE); -+ regmap_write(priv->regmap, TIM_CCER, ccer_backup); -+ -+ *num_enabled = hweight32(ccer_backup & TIM_CCER_CCXE); - - return hweight32(ccer & TIM_CCER_CCXE); - } -@@ -599,6 +603,8 @@ static int stm32_pwm_probe(struct platform_device *pdev) - struct device_node *np = dev->of_node; - struct stm32_timers *ddata = dev_get_drvdata(pdev->dev.parent); - struct stm32_pwm *priv; -+ unsigned int num_enabled; -+ unsigned int i; - int ret; - - priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL); -@@ -621,7 +627,11 @@ static int stm32_pwm_probe(struct platform_device *pdev) - - priv->chip.dev = dev; - priv->chip.ops = &stm32pwm_ops; -- priv->chip.npwm = stm32_pwm_detect_channels(priv); -+ priv->chip.npwm = stm32_pwm_detect_channels(priv, &num_enabled); -+ -+ /* Initialize clock refcount to number of enabled PWM channels. */ -+ for (i = 0; i < num_enabled; i++) -+ clk_enable(priv->clk); - - ret = devm_pwmchip_add(dev, &priv->chip); - if (ret < 0) --- -2.43.2 - -From 909f2b5920bb982ec7e1c8cc8f462192dfc73e01 Mon Sep 17 00:00:00 2001 -From: Hans de Goede <hdegoede@redhat.com> -Date: Sun, 26 Nov 2023 22:40:18 +0100 -Subject: [PATCH 0386/1501] ASoC: rt5645: Drop double EF20 entry from - dmi_platform_data[] -Content-Length: 1371 -Lines: 45 - -[ Upstream commit 51add1687f39292af626ac3c2046f49241713273 ] - -dmi_platform_data[] first contains a DMI entry matching: - - DMI_MATCH(DMI_PRODUCT_NAME, "EF20"), - -and then contains an identical entry except for the match being: - - DMI_MATCH(DMI_PRODUCT_NAME, "EF20EA"), - -Since these are partial (non exact) DMI matches the first match -will also match any board with "EF20EA" in their DMI product-name, -drop the second, redundant, entry. - -Fixes: a4dae468cfdd ("ASoC: rt5645: Add ACPI-defined GPIO for ECS EF20 series") -Cc: Chris Chiu <chiu@endlessos.org> -Signed-off-by: Hans de Goede <hdegoede@redhat.com> -Link: https://msgid.link/r/20231126214024.300505-2-hdegoede@redhat.com -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - sound/soc/codecs/rt5645.c | 8 -------- - 1 file changed, 8 deletions(-) - -diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c -index a0d01d71d8b5..edcb85bd8ea7 100644 ---- a/sound/soc/codecs/rt5645.c -+++ b/sound/soc/codecs/rt5645.c -@@ -3854,14 +3854,6 @@ static const struct dmi_system_id dmi_platform_data[] = { - }, - .driver_data = (void *)&ecs_ef20_platform_data, - }, -- { -- .ident = "EF20EA", -- .callback = cht_rt5645_ef20_quirk_cb, -- .matches = { -- DMI_MATCH(DMI_PRODUCT_NAME, "EF20EA"), -- }, -- .driver_data = (void *)&ecs_ef20_platform_data, -- }, - { } - }; - --- -2.43.2 - -From a606be902f66cbe4b876d2e5be80602308e9414f Mon Sep 17 00:00:00 2001 -From: Peter Robinson <pbrobinson@gmail.com> -Date: Wed, 20 Dec 2023 13:59:46 +0000 -Subject: [PATCH 0392/1501] mmc: sdhci_am654: Fix TI SoC dependencies -Content-Length: 1484 -Lines: 40 - -[ Upstream commit cb052da7f031b0d2309a4895ca236afb3b4bbf50 ] - -The sdhci_am654 is specific to recent TI SoCs, update the -dependencies for those SoCs and compile testing. While we're -at it update the text to reflect the wider range of -supported TI SoCS the driver now supports. - -Fixes: 41fd4caeb00b ("mmc: sdhci_am654: Add Initial Support for AM654 SDHCI driver") -Signed-off-by: Peter Robinson <pbrobinson@gmail.com> -Link: https://lore.kernel.org/r/20231220135950.433588-1-pbrobinson@gmail.com -Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/mmc/host/Kconfig | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig -index 58bd5fe4cd25..24ce5576b61a 100644 ---- a/drivers/mmc/host/Kconfig -+++ b/drivers/mmc/host/Kconfig -@@ -1041,14 +1041,15 @@ config MMC_SDHCI_OMAP - - config MMC_SDHCI_AM654 - tristate "Support for the SDHCI Controller in TI's AM654 SOCs" -+ depends on ARCH_K3 || COMPILE_TEST - depends on MMC_SDHCI_PLTFM && OF - select MMC_SDHCI_IO_ACCESSORS - select MMC_CQHCI - select REGMAP_MMIO - help - This selects the Secure Digital Host Controller Interface (SDHCI) -- support present in TI's AM654 SOCs. The controller supports -- SD/MMC/SDIO devices. -+ support present in TI's AM65x/AM64x/AM62x/J721E SOCs. The controller -+ supports SD/MMC/SDIO devices. - - If you have a controller with this interface, say Y or M here. - --- -2.43.2 - -From e2ab99c1f1a42da7eabe44cc913a6af8b39cf656 Mon Sep 17 00:00:00 2001 -From: Peter Robinson <pbrobinson@gmail.com> -Date: Wed, 20 Dec 2023 13:59:47 +0000 -Subject: [PATCH 0393/1501] mmc: sdhci_omap: Fix TI SoC dependencies -Content-Length: 1471 -Lines: 40 - -[ Upstream commit 09f164d393a6671e5ff8342ba6b3cb7fe3f20208 ] - -The sdhci_omap is specific to older TI SoCs, update the -dependencies for those SoCs and compile testing. While we're -at it update the text to reflect the wider range of -supported TI SoCS the driver now supports. - -Fixes: 7d326930d352 ("mmc: sdhci-omap: Add OMAP SDHCI driver") -Signed-off-by: Peter Robinson <pbrobinson@gmail.com> -Link: https://lore.kernel.org/r/20231220135950.433588-2-pbrobinson@gmail.com -Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/mmc/host/Kconfig | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig -index 24ce5576b61a..81f2c4e05287 100644 ---- a/drivers/mmc/host/Kconfig -+++ b/drivers/mmc/host/Kconfig -@@ -1026,14 +1026,15 @@ config MMC_SDHCI_XENON - - config MMC_SDHCI_OMAP - tristate "TI SDHCI Controller Support" -+ depends on ARCH_OMAP2PLUS || ARCH_KEYSTONE || COMPILE_TEST - depends on MMC_SDHCI_PLTFM && OF - select THERMAL - imply TI_SOC_THERMAL - select MMC_SDHCI_EXTERNAL_DMA if DMA_ENGINE - help - This selects the Secure Digital Host Controller Interface (SDHCI) -- support present in TI's DRA7 SOCs. The controller supports -- SD/MMC/SDIO devices. -+ support present in TI's Keystone/OMAP2+/DRA7 SOCs. The controller -+ supports SD/MMC/SDIO devices. - - If you have a controller with this interface, say Y or M here. - --- -2.43.2 - -From 9dcd273718a479707a58f5ba05bca28035f40036 Mon Sep 17 00:00:00 2001 -From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Date: Thu, 21 Dec 2023 08:10:42 +0530 -Subject: [PATCH 0394/1501] drm/amdkfd: Fix type of 'dbg_flags' in 'struct - kfd_process' -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1449 -Lines: 37 - -[ Upstream commit 217e85f97031791fb48a2d374c7bdcf439365b21 ] - -dbg_flags looks to be defined with incorrect data type; to process -multiple debug flag options, and hence defined dbg_flags as u32. - -Fixes the below: - -drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_packet_manager_v9.c:117 pm_map_process_aldebaran() warn: maybe use && instead of & - -Fixes: 0de4ec9a0353 ("drm/amdgpu: prepare map process for multi-process debug devices") -Suggested-by: Lijo Lazar <lijo.lazar@amd.com> -Cc: Felix Kuehling <Felix.Kuehling@amd.com> -Cc: Christian König <christian.koenig@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h -index 4c8e278a0d0c..28162bfbe1b3 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h -@@ -971,7 +971,7 @@ struct kfd_process { - struct work_struct debug_event_workarea; - - /* Tracks debug per-vmid request for debug flags */ -- bool dbg_flags; -+ u32 dbg_flags; - - atomic_t poison; - /* Queues are in paused stated because we are in the process of doing a CRIU checkpoint */ --- -2.43.2 - -From dc23b1ba2f158d4d401f03b072d4869c7068bdc3 Mon Sep 17 00:00:00 2001 -From: Sergey Gorenko <sergeygo@nvidia.com> -Date: Tue, 19 Dec 2023 09:23:11 +0200 -Subject: [PATCH 0395/1501] IB/iser: Prevent invalidating wrong MR -Content-Length: 4750 -Lines: 125 - -[ Upstream commit 2f1888281e67205bd80d3e8f54dbd519a9653f26 ] - -The iser_reg_resources structure has two pointers to MR but only one -mr_valid field. The implementation assumes that we use only *sig_mr when -pi_enable is true. Otherwise, we use only *mr. However, it is only -sometimes correct. Read commands without protection information occur even -when pi_enble is true. For example, the following SCSI commands have a -Data-In buffer but never have protection information: READ CAPACITY (16), -INQUIRY, MODE SENSE(6), MAINTENANCE IN. So, we use -*sig_mr for some SCSI commands and *mr for the other SCSI commands. - -In most cases, it works fine because the remote invalidation is applied. -However, there are two cases when the remote invalidation is not -applicable. - 1. Small write commands when all data is sent as an immediate. - 2. The target does not support the remote invalidation feature. - -The lazy invalidation is used if the remote invalidation is impossible. -Since, at the lazy invalidation, we always invalidate the MR we want to -use, the wrong MR may be invalidated. - -To fix the issue, we need a field per MR that indicates the MR needs -invalidation. Since the ib_mr structure already has such a field, let's -use ib_mr.need_inval instead of iser_reg_resources.mr_valid. - -Fixes: b76a439982f8 ("IB/iser: Use IB_WR_REG_MR_INTEGRITY for PI handover") -Link: https://lore.kernel.org/r/20231219072311.40989-1-sergeygo@nvidia.com -Acked-by: Max Gurtovoy <mgurtovoy@nvidia.com> -Signed-off-by: Sergey Gorenko <sergeygo@nvidia.com> -Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/infiniband/ulp/iser/iscsi_iser.h | 2 -- - drivers/infiniband/ulp/iser/iser_initiator.c | 5 ++++- - drivers/infiniband/ulp/iser/iser_memory.c | 8 ++++---- - drivers/infiniband/ulp/iser/iser_verbs.c | 1 - - 4 files changed, 8 insertions(+), 8 deletions(-) - -diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h -index dee8c97ff056..d967d5532459 100644 ---- a/drivers/infiniband/ulp/iser/iscsi_iser.h -+++ b/drivers/infiniband/ulp/iser/iscsi_iser.h -@@ -317,12 +317,10 @@ struct iser_device { - * - * @mr: memory region - * @sig_mr: signature memory region -- * @mr_valid: is mr valid indicator - */ - struct iser_reg_resources { - struct ib_mr *mr; - struct ib_mr *sig_mr; -- u8 mr_valid:1; - }; - - /** -diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c -index 39ea73f69016..f5f090dc4f1e 100644 ---- a/drivers/infiniband/ulp/iser/iser_initiator.c -+++ b/drivers/infiniband/ulp/iser/iser_initiator.c -@@ -581,7 +581,10 @@ static inline int iser_inv_desc(struct iser_fr_desc *desc, u32 rkey) - return -EINVAL; - } - -- desc->rsc.mr_valid = 0; -+ if (desc->sig_protected) -+ desc->rsc.sig_mr->need_inval = false; -+ else -+ desc->rsc.mr->need_inval = false; - - return 0; - } -diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c -index 29ae2c6a250a..6efcb79c8efe 100644 ---- a/drivers/infiniband/ulp/iser/iser_memory.c -+++ b/drivers/infiniband/ulp/iser/iser_memory.c -@@ -264,7 +264,7 @@ static int iser_reg_sig_mr(struct iscsi_iser_task *iser_task, - - iser_set_prot_checks(iser_task->sc, &sig_attrs->check_mask); - -- if (rsc->mr_valid) -+ if (rsc->sig_mr->need_inval) - iser_inv_rkey(&tx_desc->inv_wr, mr, cqe, &wr->wr); - - ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey)); -@@ -288,7 +288,7 @@ static int iser_reg_sig_mr(struct iscsi_iser_task *iser_task, - wr->access = IB_ACCESS_LOCAL_WRITE | - IB_ACCESS_REMOTE_READ | - IB_ACCESS_REMOTE_WRITE; -- rsc->mr_valid = 1; -+ rsc->sig_mr->need_inval = true; - - sig_reg->sge.lkey = mr->lkey; - sig_reg->rkey = mr->rkey; -@@ -313,7 +313,7 @@ static int iser_fast_reg_mr(struct iscsi_iser_task *iser_task, - struct ib_reg_wr *wr = &tx_desc->reg_wr; - int n; - -- if (rsc->mr_valid) -+ if (rsc->mr->need_inval) - iser_inv_rkey(&tx_desc->inv_wr, mr, cqe, &wr->wr); - - ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey)); -@@ -336,7 +336,7 @@ static int iser_fast_reg_mr(struct iscsi_iser_task *iser_task, - IB_ACCESS_REMOTE_WRITE | - IB_ACCESS_REMOTE_READ; - -- rsc->mr_valid = 1; -+ rsc->mr->need_inval = true; - - reg->sge.lkey = mr->lkey; - reg->rkey = mr->rkey; -diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c -index 95b8eebf7e04..6801b70dc9e0 100644 ---- a/drivers/infiniband/ulp/iser/iser_verbs.c -+++ b/drivers/infiniband/ulp/iser/iser_verbs.c -@@ -129,7 +129,6 @@ iser_create_fastreg_desc(struct iser_device *device, - goto err_alloc_mr_integrity; - } - } -- desc->rsc.mr_valid = 0; - - return desc; - --- -2.43.2 - -From 4ac4e023ed7ab1c7c67d2d12b7b6198fcd099e5c Mon Sep 17 00:00:00 2001 -From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Date: Thu, 21 Dec 2023 07:16:23 +0530 -Subject: [PATCH 0396/1501] drm/amdkfd: Confirm list is non-empty before - utilizing list_first_entry in kfd_topology.c -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2537 -Lines: 69 - -[ Upstream commit 499839eca34ad62d43025ec0b46b80e77065f6d8 ] - -Before using list_first_entry, make sure to check that list is not -empty, if list is empty return -ENODATA. - -Fixes the below: -drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1347 kfd_create_indirect_link_prop() warn: can 'gpu_link' even be NULL? -drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1428 kfd_add_peer_prop() warn: can 'iolink1' even be NULL? -drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1433 kfd_add_peer_prop() warn: can 'iolink2' even be NULL? - -Fixes: 0f28cca87e9a ("drm/amdkfd: Extend KFD device topology to surface peer-to-peer links") -Cc: Felix Kuehling <Felix.Kuehling@amd.com> -Cc: Christian König <christian.koenig@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Suggested-by: Felix Kuehling <Felix.Kuehling@amd.com> -Suggested-by: Lijo Lazar <lijo.lazar@amd.com> -Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 21 ++++++++++++--------- - 1 file changed, 12 insertions(+), 9 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c -index 057284bf50bb..58d775a0668d 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c -@@ -1342,10 +1342,11 @@ static int kfd_create_indirect_link_prop(struct kfd_topology_device *kdev, int g - num_cpu++; - } - -+ if (list_empty(&kdev->io_link_props)) -+ return -ENODATA; -+ - gpu_link = list_first_entry(&kdev->io_link_props, -- struct kfd_iolink_properties, list); -- if (!gpu_link) -- return -ENOMEM; -+ struct kfd_iolink_properties, list); - - for (i = 0; i < num_cpu; i++) { - /* CPU <--> GPU */ -@@ -1423,15 +1424,17 @@ static int kfd_add_peer_prop(struct kfd_topology_device *kdev, - peer->gpu->adev)) - return ret; - -+ if (list_empty(&kdev->io_link_props)) -+ return -ENODATA; -+ - iolink1 = list_first_entry(&kdev->io_link_props, -- struct kfd_iolink_properties, list); -- if (!iolink1) -- return -ENOMEM; -+ struct kfd_iolink_properties, list); -+ -+ if (list_empty(&peer->io_link_props)) -+ return -ENODATA; - - iolink2 = list_first_entry(&peer->io_link_props, -- struct kfd_iolink_properties, list); -- if (!iolink2) -- return -ENOMEM; -+ struct kfd_iolink_properties, list); - - props = kfd_alloc_struct(props); - if (!props) --- -2.43.2 - -From e0fc60a44d22ce06797239bc602478de3cfcbeaa Mon Sep 17 00:00:00 2001 -From: Zhipeng Lu <alexious@zju.edu.cn> -Date: Sun, 24 Dec 2023 16:22:47 +0800 -Subject: [PATCH 0397/1501] drm/amd/pm/smu7: fix a memleak in - smu7_hwmgr_backend_init -Content-Length: 1733 -Lines: 45 - -[ Upstream commit 2f3be3ca779b11c332441b10e00443a2510f4d7b ] - -The hwmgr->backend, (i.e. data) allocated by kzalloc is not freed in -the error-handling paths of smu7_get_evv_voltages and -smu7_update_edc_leakage_table. However, it did be freed in the -error-handling of phm_initializa_dynamic_state_adjustment_rule_settings, -by smu7_hwmgr_backend_fini. So the lack of free in smu7_get_evv_voltages -and smu7_update_edc_leakage_table is considered a memleak in this patch. - -Fixes: 599a7e9fe1b6 ("drm/amd/powerplay: implement smu7 hwmgr to manager asics with smu ip version 7.") -Fixes: 8f0804c6b7d0 ("drm/amd/pm: add edc leakage controller setting") -Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c -index 11372fcc59c8..b1a8799e2dee 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c -@@ -2974,6 +2974,8 @@ static int smu7_hwmgr_backend_init(struct pp_hwmgr *hwmgr) - result = smu7_get_evv_voltages(hwmgr); - if (result) { - pr_info("Get EVV Voltage Failed. Abort Driver loading!\n"); -+ kfree(hwmgr->backend); -+ hwmgr->backend = NULL; - return -EINVAL; - } - } else { -@@ -3019,8 +3021,10 @@ static int smu7_hwmgr_backend_init(struct pp_hwmgr *hwmgr) - } - - result = smu7_update_edc_leakage_table(hwmgr); -- if (result) -+ if (result) { -+ smu7_hwmgr_backend_fini(hwmgr); - return result; -+ } - - return 0; - } --- -2.43.2 - -From 7f9fee9748227e9f9dea0c0b08878e94c11546b3 Mon Sep 17 00:00:00 2001 -From: Arnd Bergmann <arnd@arndb.de> -Date: Wed, 22 Nov 2023 23:13:36 +0100 -Subject: [PATCH 0398/1501] drm/amd/display: avoid stringop-overflow warnings - for dp_decide_lane_settings() -Content-Length: 3338 -Lines: 56 - -[ Upstream commit c966dc0e9d96dc44423c404a2628236f1200c24e ] - -gcc prints a warning about a possible array overflow for a couple of -callers of dp_decide_lane_settings() after commit 1b56c90018f0 ("Makefile: -Enable -Wstringop-overflow globally"): - -drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c: In function 'dp_perform_fixed_vs_pe_training_sequence_legacy': -drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c:426:25: error: 'dp_decide_lane_settings' accessing 4 bytes in a region of size 1 [-Werror=stringop-overflow=] - 426 | dp_decide_lane_settings(lt_settings, dpcd_lane_adjust, - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - 427 | lt_settings->hw_lane_settings, lt_settings->dpcd_lane_settings); - | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c:426:25: note: referencing argument 4 of type 'union dpcd_training_lane[4]' - -I'm not entirely sure what caused this, but changing the prototype to expect -a pointer instead of an array avoids the warnings. - -Fixes: 7727e7b60f82 ("drm/amd/display: Improve robustness of FIXED_VS link training at DP1 rates") -Acked-by: Randy Dunlap <rdunlap@infradead.org> -Tested-by: Randy Dunlap <rdunlap@infradead.org> # build-tested -Signed-off-by: Arnd Bergmann <arnd@arndb.de> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../gpu/drm/amd/display/dc/link/protocols/link_dp_training.c | 2 +- - .../gpu/drm/amd/display/dc/link/protocols/link_dp_training.h | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c -index 90339c2dfd84..5a0b04518956 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c -+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c -@@ -807,7 +807,7 @@ void dp_decide_lane_settings( - const struct link_training_settings *lt_settings, - const union lane_adjust ln_adjust[LANE_COUNT_DP_MAX], - struct dc_lane_settings hw_lane_settings[LANE_COUNT_DP_MAX], -- union dpcd_training_lane dpcd_lane_settings[LANE_COUNT_DP_MAX]) -+ union dpcd_training_lane *dpcd_lane_settings) - { - uint32_t lane; - -diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.h b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.h -index 7d027bac8255..851bd17317a0 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.h -+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.h -@@ -111,7 +111,7 @@ void dp_decide_lane_settings( - const struct link_training_settings *lt_settings, - const union lane_adjust ln_adjust[LANE_COUNT_DP_MAX], - struct dc_lane_settings hw_lane_settings[LANE_COUNT_DP_MAX], -- union dpcd_training_lane dpcd_lane_settings[LANE_COUNT_DP_MAX]); -+ union dpcd_training_lane *dpcd_lane_settings); - - enum dc_dp_training_pattern decide_cr_training_pattern( - const struct dc_link_settings *link_settings); --- -2.43.2 - -From 36fdccf8455fc0efa3ba8cc50b80c71636d54ead Mon Sep 17 00:00:00 2001 -From: Li Nan <linan122@huawei.com> -Date: Fri, 8 Dec 2023 14:56:47 +0800 -Subject: [PATCH 0402/1501] ksmbd: validate the zero field of packet header -Content-Length: 1469 -Lines: 40 - -[ Upstream commit 516b3eb8c8065f7465f87608d37a7ed08298c7a5 ] - -The SMB2 Protocol requires that "The first byte of the Direct TCP -transport packet header MUST be zero (0x00)"[1]. Commit 1c1bcf2d3ea0 -("ksmbd: validate smb request protocol id") removed the validation of -this 1-byte zero. Add the validation back now. - -[1]: [MS-SMB2] - v20230227, page 30. -https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SMB2/%5bMS-SMB2%5d-230227.pdf - -Fixes: 1c1bcf2d3ea0 ("ksmbd: validate smb request protocol id") -Signed-off-by: Li Nan <linan122@huawei.com> -Acked-by: Tom Talpey <tom@talpey.com> -Acked-by: Namjae Jeon <linkinjeon@kernel.org> -Signed-off-by: Steve French <stfrench@microsoft.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/smb/server/smb_common.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c -index 6691ae68af0c..7c98bf699772 100644 ---- a/fs/smb/server/smb_common.c -+++ b/fs/smb/server/smb_common.c -@@ -158,8 +158,12 @@ int ksmbd_verify_smb_message(struct ksmbd_work *work) - */ - bool ksmbd_smb_request(struct ksmbd_conn *conn) - { -- __le32 *proto = (__le32 *)smb2_get_msg(conn->request_buf); -+ __le32 *proto; - -+ if (conn->request_buf[0] != 0) -+ return false; -+ -+ proto = (__le32 *)smb2_get_msg(conn->request_buf); - if (*proto == SMB2_COMPRESSION_TRANSFORM_ID) { - pr_err_ratelimited("smb2 compression not support yet"); - return false; --- -2.43.2 - -From cafa992134124e785609a406da4ff2b54052aff7 Mon Sep 17 00:00:00 2001 -From: "Christian A. Ehrhardt" <lk@c--e.de> -Date: Fri, 29 Dec 2023 11:54:11 +0100 -Subject: [PATCH 0403/1501] of: Fix double free in - of_parse_phandle_with_args_map -Content-Length: 7126 -Lines: 223 - -[ Upstream commit 4dde83569832f9377362e50f7748463340c5db6b ] - -In of_parse_phandle_with_args_map() the inner loop that -iterates through the map entries calls of_node_put(new) -to free the reference acquired by the previous iteration -of the inner loop. This assumes that the value of "new" is -NULL on the first iteration of the inner loop. - -Make sure that this is true in all iterations of the outer -loop by setting "new" to NULL after its value is assigned to "cur". - -Extend the unittest to detect the double free and add an additional -test case that actually triggers this path. - -Fixes: bd6f2fd5a1 ("of: Support parsing phandle argument lists through a nexus node") -Cc: Stephen Boyd <stephen.boyd@linaro.org> -Signed-off-by: "Christian A. Ehrhardt" <lk@c--e.de> -Link: https://lore.kernel.org/r/20231229105411.1603434-1-lk@c--e.de -Signed-off-by: Rob Herring <robh@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/of/base.c | 1 + - drivers/of/unittest-data/tests-phandle.dtsi | 10 ++- - drivers/of/unittest.c | 74 ++++++++++++--------- - 3 files changed, 53 insertions(+), 32 deletions(-) - -diff --git a/drivers/of/base.c b/drivers/of/base.c -index 8d93cb6ea9cd..b0ad8fc06e80 100644 ---- a/drivers/of/base.c -+++ b/drivers/of/base.c -@@ -1464,6 +1464,7 @@ int of_parse_phandle_with_args_map(const struct device_node *np, - out_args->np = new; - of_node_put(cur); - cur = new; -+ new = NULL; - } - put: - of_node_put(cur); -diff --git a/drivers/of/unittest-data/tests-phandle.dtsi b/drivers/of/unittest-data/tests-phandle.dtsi -index d01f92f0f0db..554a996b2ef1 100644 ---- a/drivers/of/unittest-data/tests-phandle.dtsi -+++ b/drivers/of/unittest-data/tests-phandle.dtsi -@@ -40,6 +40,13 @@ provider4: provider4 { - phandle-map-pass-thru = <0x0 0xf0>; - }; - -+ provider5: provider5 { -+ #phandle-cells = <2>; -+ phandle-map = <2 7 &provider4 2 3>; -+ phandle-map-mask = <0xff 0xf>; -+ phandle-map-pass-thru = <0x0 0xf0>; -+ }; -+ - consumer-a { - phandle-list = <&provider1 1>, - <&provider2 2 0>, -@@ -66,7 +73,8 @@ consumer-b { - <&provider4 4 0x100>, - <&provider4 0 0x61>, - <&provider0>, -- <&provider4 19 0x20>; -+ <&provider4 19 0x20>, -+ <&provider5 2 7>; - phandle-list-bad-phandle = <12345678 0 0>; - phandle-list-bad-args = <&provider2 1 0>, - <&provider4 0>; -diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c -index e9e90e96600e..45bd0d28c717 100644 ---- a/drivers/of/unittest.c -+++ b/drivers/of/unittest.c -@@ -456,6 +456,9 @@ static void __init of_unittest_parse_phandle_with_args(void) - - unittest(passed, "index %i - data error on node %pOF rc=%i\n", - i, args.np, rc); -+ -+ if (rc == 0) -+ of_node_put(args.np); - } - - /* Check for missing list property */ -@@ -545,8 +548,9 @@ static void __init of_unittest_parse_phandle_with_args(void) - - static void __init of_unittest_parse_phandle_with_args_map(void) - { -- struct device_node *np, *p0, *p1, *p2, *p3; -+ struct device_node *np, *p[6] = {}; - struct of_phandle_args args; -+ unsigned int prefs[6]; - int i, rc; - - np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-b"); -@@ -555,34 +559,24 @@ static void __init of_unittest_parse_phandle_with_args_map(void) - return; - } - -- p0 = of_find_node_by_path("/testcase-data/phandle-tests/provider0"); -- if (!p0) { -- pr_err("missing testcase data\n"); -- return; -- } -- -- p1 = of_find_node_by_path("/testcase-data/phandle-tests/provider1"); -- if (!p1) { -- pr_err("missing testcase data\n"); -- return; -- } -- -- p2 = of_find_node_by_path("/testcase-data/phandle-tests/provider2"); -- if (!p2) { -- pr_err("missing testcase data\n"); -- return; -- } -- -- p3 = of_find_node_by_path("/testcase-data/phandle-tests/provider3"); -- if (!p3) { -- pr_err("missing testcase data\n"); -- return; -+ p[0] = of_find_node_by_path("/testcase-data/phandle-tests/provider0"); -+ p[1] = of_find_node_by_path("/testcase-data/phandle-tests/provider1"); -+ p[2] = of_find_node_by_path("/testcase-data/phandle-tests/provider2"); -+ p[3] = of_find_node_by_path("/testcase-data/phandle-tests/provider3"); -+ p[4] = of_find_node_by_path("/testcase-data/phandle-tests/provider4"); -+ p[5] = of_find_node_by_path("/testcase-data/phandle-tests/provider5"); -+ for (i = 0; i < ARRAY_SIZE(p); ++i) { -+ if (!p[i]) { -+ pr_err("missing testcase data\n"); -+ return; -+ } -+ prefs[i] = kref_read(&p[i]->kobj.kref); - } - - rc = of_count_phandle_with_args(np, "phandle-list", "#phandle-cells"); -- unittest(rc == 7, "of_count_phandle_with_args() returned %i, expected 7\n", rc); -+ unittest(rc == 8, "of_count_phandle_with_args() returned %i, expected 7\n", rc); - -- for (i = 0; i < 8; i++) { -+ for (i = 0; i < 9; i++) { - bool passed = true; - - memset(&args, 0, sizeof(args)); -@@ -593,13 +587,13 @@ static void __init of_unittest_parse_phandle_with_args_map(void) - switch (i) { - case 0: - passed &= !rc; -- passed &= (args.np == p1); -+ passed &= (args.np == p[1]); - passed &= (args.args_count == 1); - passed &= (args.args[0] == 1); - break; - case 1: - passed &= !rc; -- passed &= (args.np == p3); -+ passed &= (args.np == p[3]); - passed &= (args.args_count == 3); - passed &= (args.args[0] == 2); - passed &= (args.args[1] == 5); -@@ -610,28 +604,36 @@ static void __init of_unittest_parse_phandle_with_args_map(void) - break; - case 3: - passed &= !rc; -- passed &= (args.np == p0); -+ passed &= (args.np == p[0]); - passed &= (args.args_count == 0); - break; - case 4: - passed &= !rc; -- passed &= (args.np == p1); -+ passed &= (args.np == p[1]); - passed &= (args.args_count == 1); - passed &= (args.args[0] == 3); - break; - case 5: - passed &= !rc; -- passed &= (args.np == p0); -+ passed &= (args.np == p[0]); - passed &= (args.args_count == 0); - break; - case 6: - passed &= !rc; -- passed &= (args.np == p2); -+ passed &= (args.np == p[2]); - passed &= (args.args_count == 2); - passed &= (args.args[0] == 15); - passed &= (args.args[1] == 0x20); - break; - case 7: -+ passed &= !rc; -+ passed &= (args.np == p[3]); -+ passed &= (args.args_count == 3); -+ passed &= (args.args[0] == 2); -+ passed &= (args.args[1] == 5); -+ passed &= (args.args[2] == 3); -+ break; -+ case 8: - passed &= (rc == -ENOENT); - break; - default: -@@ -640,6 +642,9 @@ static void __init of_unittest_parse_phandle_with_args_map(void) - - unittest(passed, "index %i - data error on node %s rc=%i\n", - i, args.np->full_name, rc); -+ -+ if (rc == 0) -+ of_node_put(args.np); - } - - /* Check for missing list property */ -@@ -686,6 +691,13 @@ static void __init of_unittest_parse_phandle_with_args_map(void) - "OF: /testcase-data/phandle-tests/consumer-b: #phandle-cells = 2 found 1"); - - unittest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc); -+ -+ for (i = 0; i < ARRAY_SIZE(p); ++i) { -+ unittest(prefs[i] == kref_read(&p[i]->kobj.kref), -+ "provider%d: expected:%d got:%d\n", -+ i, prefs[i], kref_read(&p[i]->kobj.kref)); -+ of_node_put(p[i]); -+ } - } - - static void __init of_unittest_property_string(void) --- -2.43.2 - -From 2a6a91242300790a8051d595689042529633eb67 Mon Sep 17 00:00:00 2001 -From: Dario Binacchi <dario.binacchi@amarulasolutions.com> -Date: Sat, 11 Nov 2023 11:41:50 +0100 -Subject: [PATCH 0404/1501] fbdev: imxfb: fix left margin setting -Content-Length: 3934 -Lines: 113 - -[ Upstream commit 5758844105f7dd9a0a04990cd92499a1a593dd36 ] - -The previous setting did not take into account the CSTN mode. -For the H_WAIT_2 bitfield (bits 0-7) of the LCDC Horizontal Configuration -Register (LCDCR), the IMX25RM manual states that: - -In TFT mode, it specifies the number of SCLK periods between the end of -HSYNC and the beginning of OE signal, and the total delay time equals -(H_WAIT_2 + 3) of SCLK periods. -In CSTN mode, it specifies the number of SCLK periods between the end of -HSYNC and the first display data in each line, and the total delay time -equals (H_WAIT_2 + 2) of SCLK periods. - -The patch handles both cases. - -Fixes: 4e47382fbca9 ("fbdev: imxfb: warn about invalid left/right margin") -Fixes: 7e8549bcee00 ("imxfb: Fix margin settings") -Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com> -Signed-off-by: Helge Deller <deller@gmx.de> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/video/fbdev/imxfb.c | 27 +++++++++++++++++++++++++-- - 1 file changed, 25 insertions(+), 2 deletions(-) - -diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c -index 84201c9608d3..7042a43b81d8 100644 ---- a/drivers/video/fbdev/imxfb.c -+++ b/drivers/video/fbdev/imxfb.c -@@ -42,6 +42,7 @@ - #include <video/videomode.h> - - #define PCR_TFT (1 << 31) -+#define PCR_COLOR (1 << 30) - #define PCR_BPIX_8 (3 << 25) - #define PCR_BPIX_12 (4 << 25) - #define PCR_BPIX_16 (5 << 25) -@@ -150,6 +151,12 @@ enum imxfb_type { - IMX21_FB, - }; - -+enum imxfb_panel_type { -+ PANEL_TYPE_MONOCHROME, -+ PANEL_TYPE_CSTN, -+ PANEL_TYPE_TFT, -+}; -+ - struct imxfb_info { - struct platform_device *pdev; - void __iomem *regs; -@@ -157,6 +164,7 @@ struct imxfb_info { - struct clk *clk_ahb; - struct clk *clk_per; - enum imxfb_type devtype; -+ enum imxfb_panel_type panel_type; - bool enabled; - - /* -@@ -444,6 +452,13 @@ static int imxfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) - if (!is_imx1_fb(fbi) && imxfb_mode->aus_mode) - fbi->lauscr = LAUSCR_AUS_MODE; - -+ if (imxfb_mode->pcr & PCR_TFT) -+ fbi->panel_type = PANEL_TYPE_TFT; -+ else if (imxfb_mode->pcr & PCR_COLOR) -+ fbi->panel_type = PANEL_TYPE_CSTN; -+ else -+ fbi->panel_type = PANEL_TYPE_MONOCHROME; -+ - /* - * Copy the RGB parameters for this display - * from the machine specific parameters. -@@ -596,6 +611,7 @@ static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *inf - { - struct imxfb_info *fbi = info->par; - u32 ymax_mask = is_imx1_fb(fbi) ? YMAX_MASK_IMX1 : YMAX_MASK_IMX21; -+ u8 left_margin_low; - - pr_debug("var: xres=%d hslen=%d lm=%d rm=%d\n", - var->xres, var->hsync_len, -@@ -604,6 +620,13 @@ static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *inf - var->yres, var->vsync_len, - var->upper_margin, var->lower_margin); - -+ if (fbi->panel_type == PANEL_TYPE_TFT) -+ left_margin_low = 3; -+ else if (fbi->panel_type == PANEL_TYPE_CSTN) -+ left_margin_low = 2; -+ else -+ left_margin_low = 0; -+ - #if DEBUG_VAR - if (var->xres < 16 || var->xres > 1024) - printk(KERN_ERR "%s: invalid xres %d\n", -@@ -611,7 +634,7 @@ static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *inf - if (var->hsync_len < 1 || var->hsync_len > 64) - printk(KERN_ERR "%s: invalid hsync_len %d\n", - info->fix.id, var->hsync_len); -- if (var->left_margin < 3 || var->left_margin > 255) -+ if (var->left_margin < left_margin_low || var->left_margin > 255) - printk(KERN_ERR "%s: invalid left_margin %d\n", - info->fix.id, var->left_margin); - if (var->right_margin < 1 || var->right_margin > 255) -@@ -637,7 +660,7 @@ static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *inf - - writel(HCR_H_WIDTH(var->hsync_len - 1) | - HCR_H_WAIT_1(var->right_margin - 1) | -- HCR_H_WAIT_2(var->left_margin - 3), -+ HCR_H_WAIT_2(var->left_margin - left_margin_low), - fbi->regs + LCDC_HCR); - - writel(VCR_V_WIDTH(var->vsync_len) | --- -2.43.2 - -From 439d3c783c58d77e686d3f21e39c185a327fe371 Mon Sep 17 00:00:00 2001 -From: Geert Uytterhoeven <geert+renesas@glider.be> -Date: Thu, 11 Jan 2024 09:50:25 +0100 -Subject: [PATCH 0405/1501] of: unittest: Fix of_count_phandle_with_args() - expected value message -Content-Length: 1155 -Lines: 30 - -[ Upstream commit 716089b417cf98d01f0dc1b39f9c47e1d7b4c965 ] - -The expected result value for the call to of_count_phandle_with_args() -was updated from 7 to 8, but the accompanying error message was -forgotten. - -Fixes: 4dde83569832f937 ("of: Fix double free in of_parse_phandle_with_args_map") -Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> -Link: https://lore.kernel.org/r/20240111085025.2073894-1-geert+renesas@glider.be -Signed-off-by: Rob Herring <robh@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/of/unittest.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c -index 45bd0d28c717..cfd60e35a899 100644 ---- a/drivers/of/unittest.c -+++ b/drivers/of/unittest.c -@@ -574,7 +574,7 @@ static void __init of_unittest_parse_phandle_with_args_map(void) - } - - rc = of_count_phandle_with_args(np, "phandle-list", "#phandle-cells"); -- unittest(rc == 8, "of_count_phandle_with_args() returned %i, expected 7\n", rc); -+ unittest(rc == 8, "of_count_phandle_with_args() returned %i, expected 8\n", rc); - - for (i = 0; i < 9; i++) { - bool passed = true; --- -2.43.2 - -From 0f1486dafca3398c4c46b9f6e6452fa27e73b559 Mon Sep 17 00:00:00 2001 -From: Jing Xia <jing.xia@unisoc.com> -Date: Wed, 20 Dec 2023 10:46:03 +0800 -Subject: [PATCH 0406/1501] class: fix use-after-free in class_register() -Content-Length: 2483 -Lines: 73 - -commit 93ec4a3b76404bce01bd5c9032bef5df6feb1d62 upstream. - -The lock_class_key is still registered and can be found in -lock_keys_hash hlist after subsys_private is freed in error -handler path.A task who iterate over the lock_keys_hash -later may cause use-after-free.So fix that up and unregister -the lock_class_key before kfree(cp). - -On our platform, a driver fails to kset_register because of -creating duplicate filename '/class/xxx'.With Kasan enabled, -it prints a invalid-access bug report. - -KASAN bug report: - -BUG: KASAN: invalid-access in lockdep_register_key+0x19c/0x1bc -Write of size 8 at addr 15ffff808b8c0368 by task modprobe/252 -Pointer tag: [15], memory tag: [fe] - -CPU: 7 PID: 252 Comm: modprobe Tainted: G W - 6.6.0-mainline-maybe-dirty #1 - -Call trace: -dump_backtrace+0x1b0/0x1e4 -show_stack+0x2c/0x40 -dump_stack_lvl+0xac/0xe0 -print_report+0x18c/0x4d8 -kasan_report+0xe8/0x148 -__hwasan_store8_noabort+0x88/0x98 -lockdep_register_key+0x19c/0x1bc -class_register+0x94/0x1ec -init_module+0xbc/0xf48 [rfkill] -do_one_initcall+0x17c/0x72c -do_init_module+0x19c/0x3f8 -... -Memory state around the buggy address: -ffffff808b8c0100: 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a -ffffff808b8c0200: 8a 8a 8a 8a 8a 8a 8a 8a fe fe fe fe fe fe fe fe ->ffffff808b8c0300: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe - ^ -ffffff808b8c0400: 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 - -As CONFIG_KASAN_GENERIC is not set, Kasan reports invalid-access -not use-after-free here.In this case, modprobe is manipulating -the corrupted lock_keys_hash hlish where lock_class_key is already -freed before. - -It's worth noting that this only can happen if lockdep is enabled, -which is not true for normal system. - -Fixes: dcfbb67e48a2 ("driver core: class: use lock_class_key already present in struct subsys_private") -Cc: stable <stable@kernel.org> -Signed-off-by: Jing Xia <jing.xia@unisoc.com> -Signed-off-by: Xuewen Yan <xuewen.yan@unisoc.com> -Link: https://lore.kernel.org/r/20231220024603.186078-1-jing.xia@unisoc.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/base/class.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/base/class.c b/drivers/base/class.c -index 7e78aee0fd6c..7b38fdf8e1d7 100644 ---- a/drivers/base/class.c -+++ b/drivers/base/class.c -@@ -213,6 +213,7 @@ int class_register(const struct class *cls) - return 0; - - err_out: -+ lockdep_unregister_key(key); - kfree(cp); - return error; - } --- -2.43.2 - -From 22269c75abf9469953704aafa1c2803295fe4a85 Mon Sep 17 00:00:00 2001 -From: Andrea Righi <andrea.righi@canonical.com> -Date: Fri, 29 Dec 2023 08:49:16 +0100 -Subject: [PATCH 0407/1501] kernfs: convert kernfs_idr_lock to an irq safe raw - spinlock -Content-Length: 6738 -Lines: 196 - -commit c312828c37a72fe2d033a961c47c227b0767e9f8 upstream. - -bpf_cgroup_from_id() is basically a wrapper to cgroup_get_from_id(), -that is relying on kernfs to determine the right cgroup associated to -the target id. - -As a kfunc, it has the potential to be attached to any function through -BPF, particularly in contexts where certain locks are held. - -However, kernfs is not using an irq safe spinlock for kernfs_idr_lock, -that means any kernfs function that is acquiring this lock can be -interrupted and potentially hit bpf_cgroup_from_id() in the process, -triggering a deadlock. - -For example, it is really easy to trigger a lockdep splat between -kernfs_idr_lock and rq->_lock, attaching a small BPF program to -__set_cpus_allowed_ptr_locked() that just calls bpf_cgroup_from_id(): - - ===================================================== - WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected - 6.7.0-rc7-virtme #5 Not tainted - ----------------------------------------------------- - repro/131 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: - ffffffffb2dc4578 (kernfs_idr_lock){+.+.}-{2:2}, at: kernfs_find_and_get_node_by_id+0x1d/0x80 - - and this task is already holding: - ffff911cbecaf218 (&rq->__lock){-.-.}-{2:2}, at: task_rq_lock+0x50/0xc0 - which would create a new lock dependency: - (&rq->__lock){-.-.}-{2:2} -> (kernfs_idr_lock){+.+.}-{2:2} - - but this new dependency connects a HARDIRQ-irq-safe lock: - (&rq->__lock){-.-.}-{2:2} - - ... which became HARDIRQ-irq-safe at: - lock_acquire+0xbf/0x2b0 - _raw_spin_lock_nested+0x2e/0x40 - scheduler_tick+0x5d/0x170 - update_process_times+0x9c/0xb0 - tick_periodic+0x27/0xe0 - tick_handle_periodic+0x24/0x70 - __sysvec_apic_timer_interrupt+0x64/0x1a0 - sysvec_apic_timer_interrupt+0x6f/0x80 - asm_sysvec_apic_timer_interrupt+0x1a/0x20 - memcpy+0xc/0x20 - arch_dup_task_struct+0x15/0x30 - copy_process+0x1ce/0x1eb0 - kernel_clone+0xac/0x390 - kernel_thread+0x6f/0xa0 - kthreadd+0x199/0x230 - ret_from_fork+0x31/0x50 - ret_from_fork_asm+0x1b/0x30 - - to a HARDIRQ-irq-unsafe lock: - (kernfs_idr_lock){+.+.}-{2:2} - - ... which became HARDIRQ-irq-unsafe at: - ... - lock_acquire+0xbf/0x2b0 - _raw_spin_lock+0x30/0x40 - __kernfs_new_node.isra.0+0x83/0x280 - kernfs_create_root+0xf6/0x1d0 - sysfs_init+0x1b/0x70 - mnt_init+0xd9/0x2a0 - vfs_caches_init+0xcf/0xe0 - start_kernel+0x58a/0x6a0 - x86_64_start_reservations+0x18/0x30 - x86_64_start_kernel+0xc5/0xe0 - secondary_startup_64_no_verify+0x178/0x17b - - other info that might help us debug this: - - Possible interrupt unsafe locking scenario: - - CPU0 CPU1 - ---- ---- - lock(kernfs_idr_lock); - local_irq_disable(); - lock(&rq->__lock); - lock(kernfs_idr_lock); - <Interrupt> - lock(&rq->__lock); - - *** DEADLOCK *** - -Prevent this deadlock condition converting kernfs_idr_lock to a raw irq -safe spinlock. - -The performance impact of this change should be negligible and it also -helps to prevent similar deadlock conditions with any other subsystems -that may depend on kernfs. - -Fixes: 332ea1f697be ("bpf: Add bpf_cgroup_from_id() kfunc") -Cc: stable <stable@kernel.org> -Signed-off-by: Andrea Righi <andrea.righi@canonical.com> -Acked-by: Tejun Heo <tj@kernel.org> -Link: https://lore.kernel.org/r/20231229074916.53547-1-andrea.righi@canonical.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/kernfs/dir.c | 23 +++++++++++++---------- - 1 file changed, 13 insertions(+), 10 deletions(-) - -diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c -index 8b2bd65d70e7..9ce7d2872b55 100644 ---- a/fs/kernfs/dir.c -+++ b/fs/kernfs/dir.c -@@ -27,7 +27,7 @@ static DEFINE_RWLOCK(kernfs_rename_lock); /* kn->parent and ->name */ - */ - static DEFINE_SPINLOCK(kernfs_pr_cont_lock); - static char kernfs_pr_cont_buf[PATH_MAX]; /* protected by pr_cont_lock */ --static DEFINE_SPINLOCK(kernfs_idr_lock); /* root->ino_idr */ -+static DEFINE_RAW_SPINLOCK(kernfs_idr_lock); /* root->ino_idr */ - - #define rb_to_kn(X) rb_entry((X), struct kernfs_node, rb) - -@@ -539,6 +539,7 @@ void kernfs_put(struct kernfs_node *kn) - { - struct kernfs_node *parent; - struct kernfs_root *root; -+ unsigned long flags; - - if (!kn || !atomic_dec_and_test(&kn->count)) - return; -@@ -563,9 +564,9 @@ void kernfs_put(struct kernfs_node *kn) - simple_xattrs_free(&kn->iattr->xattrs, NULL); - kmem_cache_free(kernfs_iattrs_cache, kn->iattr); - } -- spin_lock(&kernfs_idr_lock); -+ raw_spin_lock_irqsave(&kernfs_idr_lock, flags); - idr_remove(&root->ino_idr, (u32)kernfs_ino(kn)); -- spin_unlock(&kernfs_idr_lock); -+ raw_spin_unlock_irqrestore(&kernfs_idr_lock, flags); - kmem_cache_free(kernfs_node_cache, kn); - - kn = parent; -@@ -607,6 +608,7 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root, - struct kernfs_node *kn; - u32 id_highbits; - int ret; -+ unsigned long irqflags; - - name = kstrdup_const(name, GFP_KERNEL); - if (!name) -@@ -617,13 +619,13 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root, - goto err_out1; - - idr_preload(GFP_KERNEL); -- spin_lock(&kernfs_idr_lock); -+ raw_spin_lock_irqsave(&kernfs_idr_lock, irqflags); - ret = idr_alloc_cyclic(&root->ino_idr, kn, 1, 0, GFP_ATOMIC); - if (ret >= 0 && ret < root->last_id_lowbits) - root->id_highbits++; - id_highbits = root->id_highbits; - root->last_id_lowbits = ret; -- spin_unlock(&kernfs_idr_lock); -+ raw_spin_unlock_irqrestore(&kernfs_idr_lock, irqflags); - idr_preload_end(); - if (ret < 0) - goto err_out2; -@@ -659,9 +661,9 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root, - return kn; - - err_out3: -- spin_lock(&kernfs_idr_lock); -+ raw_spin_lock_irqsave(&kernfs_idr_lock, irqflags); - idr_remove(&root->ino_idr, (u32)kernfs_ino(kn)); -- spin_unlock(&kernfs_idr_lock); -+ raw_spin_unlock_irqrestore(&kernfs_idr_lock, irqflags); - err_out2: - kmem_cache_free(kernfs_node_cache, kn); - err_out1: -@@ -702,8 +704,9 @@ struct kernfs_node *kernfs_find_and_get_node_by_id(struct kernfs_root *root, - struct kernfs_node *kn; - ino_t ino = kernfs_id_ino(id); - u32 gen = kernfs_id_gen(id); -+ unsigned long flags; - -- spin_lock(&kernfs_idr_lock); -+ raw_spin_lock_irqsave(&kernfs_idr_lock, flags); - - kn = idr_find(&root->ino_idr, (u32)ino); - if (!kn) -@@ -727,10 +730,10 @@ struct kernfs_node *kernfs_find_and_get_node_by_id(struct kernfs_root *root, - if (unlikely(!__kernfs_active(kn) || !atomic_inc_not_zero(&kn->count))) - goto err_unlock; - -- spin_unlock(&kernfs_idr_lock); -+ raw_spin_unlock_irqrestore(&kernfs_idr_lock, flags); - return kn; - err_unlock: -- spin_unlock(&kernfs_idr_lock); -+ raw_spin_unlock_irqrestore(&kernfs_idr_lock, flags); - return NULL; - } - --- -2.43.2 - -From 3e8b4ade111d5d40701816c38971823dbc08bfba Mon Sep 17 00:00:00 2001 -From: Tejun Heo <tj@kernel.org> -Date: Tue, 9 Jan 2024 11:48:02 -1000 -Subject: [PATCH 0408/1501] Revert "kernfs: convert kernfs_idr_lock to an irq - safe raw spinlock" -Content-Length: 5941 -Lines: 154 - -commit e3977e0609a07d86406029fceea0fd40d7849368 upstream. - -This reverts commit dad3fb67ca1cbef87ce700e83a55835e5921ce8a. - -The commit converted kernfs_idr_lock to an IRQ-safe raw_spinlock because it -could be acquired while holding an rq lock through bpf_cgroup_from_id(). -However, kernfs_idr_lock is held while doing GPF_NOWAIT allocations which -involves acquiring an non-IRQ-safe and non-raw lock leading to the following -lockdep warning: - - ============================= - [ BUG: Invalid wait context ] - 6.7.0-rc5-kzm9g-00251-g655022a45b1c #578 Not tainted - ----------------------------- - swapper/0/0 is trying to lock: - dfbcd488 (&c->lock){....}-{3:3}, at: local_lock_acquire+0x0/0xa4 - other info that might help us debug this: - context-{5:5} - 2 locks held by swapper/0/0: - #0: dfbc9c60 (lock){+.+.}-{3:3}, at: local_lock_acquire+0x0/0xa4 - #1: c0c012a8 (kernfs_idr_lock){....}-{2:2}, at: __kernfs_new_node.constprop.0+0x68/0x258 - stack backtrace: - CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.7.0-rc5-kzm9g-00251-g655022a45b1c #578 - Hardware name: Generic SH73A0 (Flattened Device Tree) - unwind_backtrace from show_stack+0x10/0x14 - show_stack from dump_stack_lvl+0x68/0x90 - dump_stack_lvl from __lock_acquire+0x3cc/0x168c - __lock_acquire from lock_acquire+0x274/0x30c - lock_acquire from local_lock_acquire+0x28/0xa4 - local_lock_acquire from ___slab_alloc+0x234/0x8a8 - ___slab_alloc from __slab_alloc.constprop.0+0x30/0x44 - __slab_alloc.constprop.0 from kmem_cache_alloc+0x7c/0x148 - kmem_cache_alloc from radix_tree_node_alloc.constprop.0+0x44/0xdc - radix_tree_node_alloc.constprop.0 from idr_get_free+0x110/0x2b8 - idr_get_free from idr_alloc_u32+0x9c/0x108 - idr_alloc_u32 from idr_alloc_cyclic+0x50/0xb8 - idr_alloc_cyclic from __kernfs_new_node.constprop.0+0x88/0x258 - __kernfs_new_node.constprop.0 from kernfs_create_root+0xbc/0x154 - kernfs_create_root from sysfs_init+0x18/0x5c - sysfs_init from mnt_init+0xc4/0x220 - mnt_init from vfs_caches_init+0x6c/0x88 - vfs_caches_init from start_kernel+0x474/0x528 - start_kernel from 0x0 - -Let's rever the commit. It's undesirable to spread out raw spinlock usage -anyway and the problem can be solved by protecting the lookup path with RCU -instead. - -Signed-off-by: Tejun Heo <tj@kernel.org> -Cc: Andrea Righi <andrea.righi@canonical.com> -Reported-by: Geert Uytterhoeven <geert@linux-m68k.org> -Link: http://lkml.kernel.org/r/CAMuHMdV=AKt+mwY7svEq5gFPx41LoSQZ_USME5_MEdWQze13ww@mail.gmail.com -Link: https://lore.kernel.org/r/20240109214828.252092-2-tj@kernel.org -Tested-by: Andrea Righi <andrea.righi@canonical.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/kernfs/dir.c | 23 ++++++++++------------- - 1 file changed, 10 insertions(+), 13 deletions(-) - -diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c -index 9ce7d2872b55..8b2bd65d70e7 100644 ---- a/fs/kernfs/dir.c -+++ b/fs/kernfs/dir.c -@@ -27,7 +27,7 @@ static DEFINE_RWLOCK(kernfs_rename_lock); /* kn->parent and ->name */ - */ - static DEFINE_SPINLOCK(kernfs_pr_cont_lock); - static char kernfs_pr_cont_buf[PATH_MAX]; /* protected by pr_cont_lock */ --static DEFINE_RAW_SPINLOCK(kernfs_idr_lock); /* root->ino_idr */ -+static DEFINE_SPINLOCK(kernfs_idr_lock); /* root->ino_idr */ - - #define rb_to_kn(X) rb_entry((X), struct kernfs_node, rb) - -@@ -539,7 +539,6 @@ void kernfs_put(struct kernfs_node *kn) - { - struct kernfs_node *parent; - struct kernfs_root *root; -- unsigned long flags; - - if (!kn || !atomic_dec_and_test(&kn->count)) - return; -@@ -564,9 +563,9 @@ void kernfs_put(struct kernfs_node *kn) - simple_xattrs_free(&kn->iattr->xattrs, NULL); - kmem_cache_free(kernfs_iattrs_cache, kn->iattr); - } -- raw_spin_lock_irqsave(&kernfs_idr_lock, flags); -+ spin_lock(&kernfs_idr_lock); - idr_remove(&root->ino_idr, (u32)kernfs_ino(kn)); -- raw_spin_unlock_irqrestore(&kernfs_idr_lock, flags); -+ spin_unlock(&kernfs_idr_lock); - kmem_cache_free(kernfs_node_cache, kn); - - kn = parent; -@@ -608,7 +607,6 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root, - struct kernfs_node *kn; - u32 id_highbits; - int ret; -- unsigned long irqflags; - - name = kstrdup_const(name, GFP_KERNEL); - if (!name) -@@ -619,13 +617,13 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root, - goto err_out1; - - idr_preload(GFP_KERNEL); -- raw_spin_lock_irqsave(&kernfs_idr_lock, irqflags); -+ spin_lock(&kernfs_idr_lock); - ret = idr_alloc_cyclic(&root->ino_idr, kn, 1, 0, GFP_ATOMIC); - if (ret >= 0 && ret < root->last_id_lowbits) - root->id_highbits++; - id_highbits = root->id_highbits; - root->last_id_lowbits = ret; -- raw_spin_unlock_irqrestore(&kernfs_idr_lock, irqflags); -+ spin_unlock(&kernfs_idr_lock); - idr_preload_end(); - if (ret < 0) - goto err_out2; -@@ -661,9 +659,9 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root, - return kn; - - err_out3: -- raw_spin_lock_irqsave(&kernfs_idr_lock, irqflags); -+ spin_lock(&kernfs_idr_lock); - idr_remove(&root->ino_idr, (u32)kernfs_ino(kn)); -- raw_spin_unlock_irqrestore(&kernfs_idr_lock, irqflags); -+ spin_unlock(&kernfs_idr_lock); - err_out2: - kmem_cache_free(kernfs_node_cache, kn); - err_out1: -@@ -704,9 +702,8 @@ struct kernfs_node *kernfs_find_and_get_node_by_id(struct kernfs_root *root, - struct kernfs_node *kn; - ino_t ino = kernfs_id_ino(id); - u32 gen = kernfs_id_gen(id); -- unsigned long flags; - -- raw_spin_lock_irqsave(&kernfs_idr_lock, flags); -+ spin_lock(&kernfs_idr_lock); - - kn = idr_find(&root->ino_idr, (u32)ino); - if (!kn) -@@ -730,10 +727,10 @@ struct kernfs_node *kernfs_find_and_get_node_by_id(struct kernfs_root *root, - if (unlikely(!__kernfs_active(kn) || !atomic_inc_not_zero(&kn->count))) - goto err_unlock; - -- raw_spin_unlock_irqrestore(&kernfs_idr_lock, flags); -+ spin_unlock(&kernfs_idr_lock); - return kn; - err_unlock: -- raw_spin_unlock_irqrestore(&kernfs_idr_lock, flags); -+ spin_unlock(&kernfs_idr_lock); - return NULL; - } - --- -2.43.2 - -From e519f39f296334390885dafdd67f44d299ca0a84 Mon Sep 17 00:00:00 2001 -From: Hans de Goede <hdegoede@redhat.com> -Date: Tue, 16 Jan 2024 21:43:25 +0100 -Subject: [PATCH 0412/1501] Input: atkbd - use ab83 as id when skipping the - getid command -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2883 -Lines: 69 - -commit 58f65f9db7e0de366a5a115c2e2c0703858bba69 upstream. - -Barnabás reported that the change to skip the getid command -when the controller is in translated mode on laptops caused -the Version field of his "AT Translated Set 2 keyboard" -input device to change from ab83 to abba, breaking a custom -hwdb entry for this keyboard. - -Use the standard ab83 id for keyboards when getid is skipped -(rather then that getid fails) to avoid reporting a different -Version to userspace then before skipping the getid. - -Fixes: 936e4d49ecbc ("Input: atkbd - skip ATKBD_CMD_GETID in translated mode") -Reported-by: Barnabás Pőcze <pobrn@protonmail.com> -Closes: https://lore.kernel.org/linux-input/W1ydwoG2fYv85Z3C3yfDOJcVpilEvGge6UGa9kZh8zI2-qkHXp7WLnl2hSkFz63j-c7WupUWI5TLL6n7Lt8DjRuU-yJBwLYWrreb1hbnd6A=@protonmail.com/ -Signed-off-by: Hans de Goede <hdegoede@redhat.com> -Link: https://lore.kernel.org/r/20240116204325.7719-1-hdegoede@redhat.com -Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/input/keyboard/atkbd.c | 12 +++++++----- - 1 file changed, 7 insertions(+), 5 deletions(-) - -diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c -index 786f00f6b7fd..13ef6284223d 100644 ---- a/drivers/input/keyboard/atkbd.c -+++ b/drivers/input/keyboard/atkbd.c -@@ -791,9 +791,9 @@ static bool atkbd_is_portable_device(void) - * not work. So in this case simply assume a keyboard is connected to avoid - * confusing some laptop keyboards. - * -- * Skipping ATKBD_CMD_GETID ends up using a fake keyboard id. Using a fake id is -- * ok in translated mode, only atkbd_select_set() checks atkbd->id and in -- * translated mode that is a no-op. -+ * Skipping ATKBD_CMD_GETID ends up using a fake keyboard id. Using the standard -+ * 0xab83 id is ok in translated mode, only atkbd_select_set() checks atkbd->id -+ * and in translated mode that is a no-op. - */ - static bool atkbd_skip_getid(struct atkbd *atkbd) - { -@@ -811,6 +811,7 @@ static int atkbd_probe(struct atkbd *atkbd) - { - struct ps2dev *ps2dev = &atkbd->ps2dev; - unsigned char param[2]; -+ bool skip_getid; - - /* - * Some systems, where the bit-twiddling when testing the io-lines of the -@@ -832,7 +833,8 @@ static int atkbd_probe(struct atkbd *atkbd) - */ - - param[0] = param[1] = 0xa5; /* initialize with invalid values */ -- if (atkbd_skip_getid(atkbd) || ps2_command(ps2dev, param, ATKBD_CMD_GETID)) { -+ skip_getid = atkbd_skip_getid(atkbd); -+ if (skip_getid || ps2_command(ps2dev, param, ATKBD_CMD_GETID)) { - - /* - * If the get ID command was skipped or failed, we check if we can at least set -@@ -842,7 +844,7 @@ static int atkbd_probe(struct atkbd *atkbd) - param[0] = 0; - if (ps2_command(ps2dev, param, ATKBD_CMD_SETLEDS)) - return -1; -- atkbd->id = 0xabba; -+ atkbd->id = skip_getid ? 0xab83 : 0xabba; - return 0; - } - --- -2.43.2 - -From 087b50f60d80a4e0eb9fe2249303ab63a9ebb6df Mon Sep 17 00:00:00 2001 -From: Matthew Maurer <mmaurer@google.com> -Date: Tue, 31 Oct 2023 20:19:44 +0000 -Subject: [PATCH 0413/1501] rust: Ignore preserve-most functions -Content-Length: 1351 -Lines: 34 - -commit bad098d76835c1379e1cf6afc935f8a7e050f83c upstream. - -Neither bindgen nor Rust know about the preserve-most calling -convention, and Clang describes it as unstable. Since we aren't using -functions with this calling convention from Rust, blocklist them. - -These functions are only added to the build when list hardening is -enabled, which is likely why others didn't notice this yet. - -Signed-off-by: Matthew Maurer <mmaurer@google.com> -Reviewed-by: Martin Rodriguez Reboredo <yakoyoku@gmail.com> -Reviewed-by: Alice Ryhl <aliceryhl@google.com> -Link: https://lore.kernel.org/r/20231031201945.1412345-1-mmaurer@google.com -[ Used Markdown for consistency with the other comments in the file. ] -Signed-off-by: Miguel Ojeda <ojeda@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - rust/bindgen_parameters | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters -index 552d9a85925b..a721d466bee4 100644 ---- a/rust/bindgen_parameters -+++ b/rust/bindgen_parameters -@@ -20,3 +20,7 @@ - - # `seccomp`'s comment gets understood as a doctest - --no-doc-comments -+ -+# These functions use the `__preserve_most` calling convention, which neither bindgen -+# nor Rust currently understand, and which Clang currently declares to be unstable. -+--blocklist-function __list_.*_report --- -2.43.2 - -From 9e59dd458a6e616c12312fc2d80b4de2b904bd9f Mon Sep 17 00:00:00 2001 -From: Kaibo Ma <ent3rm4n@gmail.com> -Date: Wed, 3 Jan 2024 12:29:56 +0800 -Subject: [PATCH 0414/1501] Revert "drm/amdkfd: Relocate TBA/TMA to opposite - side of VM hole" -Content-Length: 2876 -Lines: 76 - -commit 0f35b0a7b8fa402adbffa2565047cdcc4c480153 upstream. - -That commit causes NULL pointer dereferences in dmesgs when -running applications using ROCm, including clinfo, blender, -and PyTorch, since v6.6.1. Revert it to fix blender again. - -This reverts commit 96c211f1f9ef82183493f4ceed4e347b52849149. - -Closes: https://github.com/ROCm/ROCm/issues/2596 -Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2991 -Reviewed-by: Jay Cornwall <jay.cornwall@amd.com> -Signed-off-by: Kaibo Ma <ent3rm4n@gmail.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c | 26 ++++++++++---------- - 1 file changed, 13 insertions(+), 13 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c b/drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c -index 62b205dac63a..6604a3f99c5e 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c -@@ -330,12 +330,6 @@ static void kfd_init_apertures_vi(struct kfd_process_device *pdd, uint8_t id) - pdd->gpuvm_limit = - pdd->dev->kfd->shared_resources.gpuvm_size - 1; - -- /* dGPUs: the reserved space for kernel -- * before SVM -- */ -- pdd->qpd.cwsr_base = SVM_CWSR_BASE; -- pdd->qpd.ib_base = SVM_IB_BASE; -- - pdd->scratch_base = MAKE_SCRATCH_APP_BASE_VI(); - pdd->scratch_limit = MAKE_SCRATCH_APP_LIMIT(pdd->scratch_base); - } -@@ -345,18 +339,18 @@ static void kfd_init_apertures_v9(struct kfd_process_device *pdd, uint8_t id) - pdd->lds_base = MAKE_LDS_APP_BASE_V9(); - pdd->lds_limit = MAKE_LDS_APP_LIMIT(pdd->lds_base); - -- pdd->gpuvm_base = PAGE_SIZE; -+ /* Raven needs SVM to support graphic handle, etc. Leave the small -+ * reserved space before SVM on Raven as well, even though we don't -+ * have to. -+ * Set gpuvm_base and gpuvm_limit to CANONICAL addresses so that they -+ * are used in Thunk to reserve SVM. -+ */ -+ pdd->gpuvm_base = SVM_USER_BASE; - pdd->gpuvm_limit = - pdd->dev->kfd->shared_resources.gpuvm_size - 1; - - pdd->scratch_base = MAKE_SCRATCH_APP_BASE_V9(); - pdd->scratch_limit = MAKE_SCRATCH_APP_LIMIT(pdd->scratch_base); -- -- /* -- * Place TBA/TMA on opposite side of VM hole to prevent -- * stray faults from triggering SVM on these pages. -- */ -- pdd->qpd.cwsr_base = pdd->dev->kfd->shared_resources.gpuvm_size; - } - - int kfd_init_apertures(struct kfd_process *process) -@@ -413,6 +407,12 @@ int kfd_init_apertures(struct kfd_process *process) - return -EINVAL; - } - } -+ -+ /* dGPUs: the reserved space for kernel -+ * before SVM -+ */ -+ pdd->qpd.cwsr_base = SVM_CWSR_BASE; -+ pdd->qpd.ib_base = SVM_IB_BASE; - } - - dev_dbg(kfd_device, "node id %u\n", id); --- -2.43.2 - -From 0179c6b07f7ed2f3ea7309596169e15a59e7ee0e Mon Sep 17 00:00:00 2001 -From: Jan Beulich <jbeulich@suse.com> -Date: Mon, 8 Jan 2024 09:55:56 +0100 -Subject: [PATCH 0415/1501] xen-netback: don't produce zero-size SKB frags -Content-Length: 3500 -Lines: 103 - -commit c7ec4f2d684e17d69bbdd7c4324db0ef5daac26a upstream. - -While frontends may submit zero-size requests (wasting a precious slot), -core networking code as of at least 3ece782693c4b ("sock: skb_copy_ubufs -support for compound pages") can't deal with SKBs when they have all -zero-size fragments. Respond to empty requests right when populating -fragments; all further processing is fragment based and hence won't -encounter these empty requests anymore. - -In a way this should have been that way from the beginning: When no data -is to be transferred for a particular request, there's not even a point -in validating the respective grant ref. That's no different from e.g. -passing NULL into memcpy() when at the same time the size is 0. - -This is XSA-448 / CVE-2023-46838. - -Cc: stable@vger.kernel.org -Signed-off-by: Jan Beulich <jbeulich@suse.com> -Reviewed-by: Juergen Gross <jgross@suse.com> -Reviewed-by: Paul Durrant <paul@xen.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/net/xen-netback/netback.c | 44 ++++++++++++++++++++++++++----- - 1 file changed, 38 insertions(+), 6 deletions(-) - -diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c -index 88f760a7cbc3..d7503aef599f 100644 ---- a/drivers/net/xen-netback/netback.c -+++ b/drivers/net/xen-netback/netback.c -@@ -463,12 +463,25 @@ static void xenvif_get_requests(struct xenvif_queue *queue, - } - - for (shinfo->nr_frags = 0; nr_slots > 0 && shinfo->nr_frags < MAX_SKB_FRAGS; -- shinfo->nr_frags++, gop++, nr_slots--) { -+ nr_slots--) { -+ if (unlikely(!txp->size)) { -+ unsigned long flags; -+ -+ spin_lock_irqsave(&queue->response_lock, flags); -+ make_tx_response(queue, txp, 0, XEN_NETIF_RSP_OKAY); -+ push_tx_responses(queue); -+ spin_unlock_irqrestore(&queue->response_lock, flags); -+ ++txp; -+ continue; -+ } -+ - index = pending_index(queue->pending_cons++); - pending_idx = queue->pending_ring[index]; - xenvif_tx_create_map_op(queue, pending_idx, txp, - txp == first ? extra_count : 0, gop); - frag_set_pending_idx(&frags[shinfo->nr_frags], pending_idx); -+ ++shinfo->nr_frags; -+ ++gop; - - if (txp == first) - txp = txfrags; -@@ -481,20 +494,39 @@ static void xenvif_get_requests(struct xenvif_queue *queue, - shinfo = skb_shinfo(nskb); - frags = shinfo->frags; - -- for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots; -- shinfo->nr_frags++, txp++, gop++) { -+ for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots; ++txp) { -+ if (unlikely(!txp->size)) { -+ unsigned long flags; -+ -+ spin_lock_irqsave(&queue->response_lock, flags); -+ make_tx_response(queue, txp, 0, -+ XEN_NETIF_RSP_OKAY); -+ push_tx_responses(queue); -+ spin_unlock_irqrestore(&queue->response_lock, -+ flags); -+ continue; -+ } -+ - index = pending_index(queue->pending_cons++); - pending_idx = queue->pending_ring[index]; - xenvif_tx_create_map_op(queue, pending_idx, txp, 0, - gop); - frag_set_pending_idx(&frags[shinfo->nr_frags], - pending_idx); -+ ++shinfo->nr_frags; -+ ++gop; - } - -- skb_shinfo(skb)->frag_list = nskb; -- } else if (nskb) { -+ if (shinfo->nr_frags) { -+ skb_shinfo(skb)->frag_list = nskb; -+ nskb = NULL; -+ } -+ } -+ -+ if (nskb) { - /* A frag_list skb was allocated but it is no longer needed -- * because enough slots were converted to copy ops above. -+ * because enough slots were converted to copy ops above or some -+ * were empty. - */ - kfree_skb(nskb); - } --- -2.43.2 - -From b4f76c2a393ec265795a8c31cf11b15158d8b842 Mon Sep 17 00:00:00 2001 -From: Tony Lindgren <tony@atomide.com> -Date: Tue, 14 Nov 2023 09:29:30 +0200 -Subject: [PATCH 0417/1501] clocksource/drivers/timer-ti-dm: Fix make W=n - kerneldoc warnings -Content-Length: 2254 -Lines: 47 - -commit b99a212a7697c542b460adaa15d4a98abf8223f0 upstream. - -Kernel test robot reports of kerneldoc related warnings that happen with -make W=n for "parameter or member not described". - -These were caused by changes to function parameter names with -earlier commits where the kerneldoc parts were not updated. - -Fixes: 49cd16bb573e ("clocksource/drivers/timer-ti-dm: Simplify register writes with dmtimer_write()") -Fixes: a6e543f61531 ("clocksource/drivers/timer-ti-dm: Move struct omap_dm_timer fields to driver") -Reported-by: kernel test robot <lkp@intel.com> -Closes: https://lore.kernel.org/oe-kbuild-all/202311040403.DzIiBuwU-lkp@intel.com/ -Closes: https://lore.kernel.org/oe-kbuild-all/202311040606.XL5OcR9O-lkp@intel.com/ -Signed-off-by: Tony Lindgren <tony@atomide.com> -Reviewed-by: Randy Dunlap <rdunlap@infradead.org> -Tested-by: Randy Dunlap <rdunlap@infradead.org> -Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> -Link: https://lore.kernel.org/r/20231114072930.40615-1-tony@atomide.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/clocksource/timer-ti-dm.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/clocksource/timer-ti-dm.c b/drivers/clocksource/timer-ti-dm.c -index 5f60f6bd3386..56acf2617262 100644 ---- a/drivers/clocksource/timer-ti-dm.c -+++ b/drivers/clocksource/timer-ti-dm.c -@@ -183,7 +183,7 @@ static inline u32 dmtimer_read(struct dmtimer *timer, u32 reg) - * dmtimer_write - write timer registers in posted and non-posted mode - * @timer: timer pointer over which write operation is to perform - * @reg: lowest byte holds the register offset -- * @value: data to write into the register -+ * @val: data to write into the register - * - * The posted mode bit is encoded in reg. Note that in posted mode, the write - * pending bit must be checked. Otherwise a write on a register which has a -@@ -949,7 +949,7 @@ static int omap_dm_timer_set_int_enable(struct omap_dm_timer *cookie, - - /** - * omap_dm_timer_set_int_disable - disable timer interrupts -- * @timer: pointer to timer handle -+ * @cookie: pointer to timer cookie - * @mask: bit mask of interrupts to be disabled - * - * Disables the specified timer interrupts for a timer. --- -2.43.2 - -From 23eead90c8397ee65587c60fc2e54c8b5e3e0e57 Mon Sep 17 00:00:00 2001 -From: Inochi Amaoto <inochiama@outlook.com> -Date: Mon, 4 Dec 2023 17:51:08 +0800 -Subject: [PATCH 0418/1501] dt-bindings: timer: thead,c900-aclint-mtimer: - separate mtime and mtimecmp regs -Content-Length: 2754 -Lines: 70 - -commit b91cf01cf3e63a627b3b65f4284dcf9a4deb80f9 upstream. - -The timer registers of aclint don't follow the clint layout and can -be mapped on any different offset. As sg2042 uses separated timer -and mswi for its clint, it should follow the aclint spec and have -separated registers. - -The previous patch introduced a new type of T-HEAD aclint timer which -has clint timer layout. Although it has the clint timer layout, it -should follow the aclint spec and uses the separated mtime and mtimecmp -regs. So a ABI change is needed to make the timer fit the aclint spec. - -To make T-HEAD aclint timer more closer to the aclint spec, use -regs-names to represent the mtimecmp register, which can avoid hack -for unsupport mtime register of T-HEAD aclint timer. - -Also, as T-HEAD aclint only supports mtimecmp, it is unnecessary to -implement the whole aclint spec. To make this binding T-HEAD specific, -only add reg-name for existed register. For details, see the discussion -in the last link. - -Signed-off-by: Inochi Amaoto <inochiama@outlook.com> -Fixes: 4734449f7311 ("dt-bindings: timer: Add Sophgo sg2042 CLINT timer") -Link: https://lists.infradead.org/pipermail/opensbi/2023-October/005693.html -Link: https://github.com/riscv/riscv-aclint/blob/main/riscv-aclint.adoc -Link: https://lore.kernel.org/all/IA1PR20MB4953F9D77FFC76A9D236922DBBB6A@IA1PR20MB4953.namprd20.prod.outlook.com/ -Acked-by: Guo Ren <guoren@kernel.org> -Acked-by: Conor Dooley <conor.dooley@microchip.com> -Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> -Link: https://lore.kernel.org/r/IA1PR20MB49531ED1BCC00D6B265C2D10BB86A@IA1PR20MB4953.namprd20.prod.outlook.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - .../bindings/timer/thead,c900-aclint-mtimer.yaml | 9 ++++++++- - 1 file changed, 8 insertions(+), 1 deletion(-) - -diff --git a/Documentation/devicetree/bindings/timer/thead,c900-aclint-mtimer.yaml b/Documentation/devicetree/bindings/timer/thead,c900-aclint-mtimer.yaml -index fbd235650e52..2e92bcdeb423 100644 ---- a/Documentation/devicetree/bindings/timer/thead,c900-aclint-mtimer.yaml -+++ b/Documentation/devicetree/bindings/timer/thead,c900-aclint-mtimer.yaml -@@ -17,7 +17,12 @@ properties: - - const: thead,c900-aclint-mtimer - - reg: -- maxItems: 1 -+ items: -+ - description: MTIMECMP Registers -+ -+ reg-names: -+ items: -+ - const: mtimecmp - - interrupts-extended: - minItems: 1 -@@ -28,6 +33,7 @@ additionalProperties: false - required: - - compatible - - reg -+ - reg-names - - interrupts-extended - - examples: -@@ -39,5 +45,6 @@ examples: - <&cpu3intc 7>, - <&cpu4intc 7>; - reg = <0xac000000 0x00010000>; -+ reg-names = "mtimecmp"; - }; - ... --- -2.43.2 - -From c4eb97db08f9a7657b3235dba463534cba0f8c7b Mon Sep 17 00:00:00 2001 -From: Arnd Bergmann <arnd@arndb.de> -Date: Tue, 12 Dec 2023 22:46:07 +0100 -Subject: [PATCH 0419/1501] clocksource/drivers/ep93xx: Fix error handling - during probe -Content-Length: 1774 -Lines: 46 - -commit c0c4579d79d0df841e825c68df450909a0032faf upstream. - -When the interrupt property fails to be parsed, ep93xx_timer_of_init() -return code ends up uninitialized: - -drivers/clocksource/timer-ep93xx.c:160:6: error: variable 'ret' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized] - if (irq < 0) { - ^~~~~~~ -drivers/clocksource/timer-ep93xx.c:188:9: note: uninitialized use occurs here - return ret; - ^~~ -drivers/clocksource/timer-ep93xx.c:160:2: note: remove the 'if' if its condition is always false - if (irq < 0) { - ^~~~~~~~~~~~~~ - -Simplify this portion to use the normal construct of just checking -whether a valid interrupt was returned. Note that irq_of_parse_and_map() -never returns a negative value and no other callers check for that either. - -Fixes: c28ca80ba3b5 ("clocksource: ep93xx: Add driver for Cirrus Logic EP93xx") -Signed-off-by: Arnd Bergmann <arnd@arndb.de> -Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> -Link: https://lore.kernel.org/r/20231212214616.193098-1-arnd@kernel.org -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/clocksource/timer-ep93xx.c | 5 ++--- - 1 file changed, 2 insertions(+), 3 deletions(-) - -diff --git a/drivers/clocksource/timer-ep93xx.c b/drivers/clocksource/timer-ep93xx.c -index bc0ca6e12334..6981ff3ac8a9 100644 ---- a/drivers/clocksource/timer-ep93xx.c -+++ b/drivers/clocksource/timer-ep93xx.c -@@ -155,9 +155,8 @@ static int __init ep93xx_timer_of_init(struct device_node *np) - ep93xx_tcu = tcu; - - irq = irq_of_parse_and_map(np, 0); -- if (irq == 0) -- irq = -EINVAL; -- if (irq < 0) { -+ if (!irq) { -+ ret = -EINVAL; - pr_err("EP93XX Timer Can't parse IRQ %d", irq); - goto out_free; - } --- -2.43.2 - -From 58f396513cb1fa4ef91838c78698d458100cc27c Mon Sep 17 00:00:00 2001 -From: Michael Ellerman <mpe@ellerman.id.au> -Date: Fri, 15 Dec 2023 23:44:49 +1100 -Subject: [PATCH 0420/1501] powerpc/64s: Increase default stack size to 32KB -Content-Length: 1760 -Lines: 44 - -commit 18f14afe281648e31ed35c9ad2fcb724c4838ad9 upstream. - -There are reports of kernels crashing due to stack overflow while -running OpenShift (Kubernetes). The primary contributor to the stack -usage seems to be openvswitch, which is used by OVN-Kubernetes (based on -OVN (Open Virtual Network)), but NFS also contributes in some stack -traces. - -There may be some opportunities to reduce stack usage in the openvswitch -code, but doing so potentially require tradeoffs vs performance, and -also requires testing across architectures. - -Looking at stack usage across the kernel (using -fstack-usage), shows -that ppc64le stack frames are on average 50-100% larger than the -equivalent function built for x86-64. Which is not surprising given the -minimum stack frame size is 32 bytes on ppc64le vs 16 bytes on x86-64. - -So increase the default stack size to 32KB for the modern 64-bit Book3S -platforms, ie. pseries (virtualised) and powernv (bare metal). That -leaves the older systems like G5s, and the AmigaOne (pasemi) with a 16KB -stack which should be sufficient on those machines. - -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Signed-off-by: Aneesh Kumar K.V (IBM) <aneesh.kumar@kernel.org> -Link: https://msgid.link/20231215124449.317597-1-mpe@ellerman.id.au -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/powerpc/Kconfig | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig -index 1f11a62809f2..dbb6c44d5938 100644 ---- a/arch/powerpc/Kconfig -+++ b/arch/powerpc/Kconfig -@@ -858,6 +858,7 @@ config THREAD_SHIFT - int "Thread shift" if EXPERT - range 13 15 - default "15" if PPC_256K_PAGES -+ default "15" if PPC_PSERIES || PPC_POWERNV - default "14" if PPC64 - default "13" - help --- -2.43.2 - -From 8c3e4ca931664dbcc0cde810d9c5c58f666c05e4 Mon Sep 17 00:00:00 2001 -From: Heiko Carstens <hca@linux.ibm.com> -Date: Mon, 15 Jan 2024 17:35:55 +0100 -Subject: [PATCH 0421/1501] tick-sched: Fix idle and iowait sleeptime - accounting vs CPU hotplug -Content-Length: 2992 -Lines: 82 - -commit 71fee48fb772ac4f6cfa63dbebc5629de8b4cc09 upstream. - -When offlining and onlining CPUs the overall reported idle and iowait -times as reported by /proc/stat jump backward and forward: - -cpu 132 0 176 225249 47 6 6 21 0 0 -cpu0 80 0 115 112575 33 3 4 18 0 0 -cpu1 52 0 60 112673 13 3 1 2 0 0 - -cpu 133 0 177 226681 47 6 6 21 0 0 -cpu0 80 0 116 113387 33 3 4 18 0 0 - -cpu 133 0 178 114431 33 6 6 21 0 0 <---- jump backward -cpu0 80 0 116 114247 33 3 4 18 0 0 -cpu1 52 0 61 183 0 3 1 2 0 0 <---- idle + iowait start with 0 - -cpu 133 0 178 228956 47 6 6 21 0 0 <---- jump forward -cpu0 81 0 117 114929 33 3 4 18 0 0 - -Reason for this is that get_idle_time() in fs/proc/stat.c has different -sources for both values depending on if a CPU is online or offline: - -- if a CPU is online the values may be taken from its per cpu - tick_cpu_sched structure - -- if a CPU is offline the values are taken from its per cpu cpustat - structure - -The problem is that the per cpu tick_cpu_sched structure is set to zero on -CPU offline. See tick_cancel_sched_timer() in kernel/time/tick-sched.c. - -Therefore when a CPU is brought offline and online afterwards both its idle -and iowait sleeptime will be zero, causing a jump backward in total system -idle and iowait sleeptime. In a similar way if a CPU is then brought -offline again the total idle and iowait sleeptimes will jump forward. - -It looks like this behavior was introduced with commit 4b0c0f294f60 -("tick: Cleanup NOHZ per cpu data on cpu down"). - -This was only noticed now on s390, since we switched to generic idle time -reporting with commit be76ea614460 ("s390/idle: remove arch_cpu_idle_time() -and corresponding code"). - -Fix this by preserving the values of idle_sleeptime and iowait_sleeptime -members of the per-cpu tick_sched structure on CPU hotplug. - -Fixes: 4b0c0f294f60 ("tick: Cleanup NOHZ per cpu data on cpu down") -Reported-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com> -Signed-off-by: Heiko Carstens <hca@linux.ibm.com> -Signed-off-by: Thomas Gleixner <tglx@linutronix.de> -Reviewed-by: Frederic Weisbecker <frederic@kernel.org> -Link: https://lore.kernel.org/r/20240115163555.1004144-1-hca@linux.ibm.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - kernel/time/tick-sched.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c -index be77b021e5d6..2305366a818a 100644 ---- a/kernel/time/tick-sched.c -+++ b/kernel/time/tick-sched.c -@@ -1573,13 +1573,18 @@ void tick_setup_sched_timer(void) - void tick_cancel_sched_timer(int cpu) - { - struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu); -+ ktime_t idle_sleeptime, iowait_sleeptime; - - # ifdef CONFIG_HIGH_RES_TIMERS - if (ts->sched_timer.base) - hrtimer_cancel(&ts->sched_timer); - # endif - -+ idle_sleeptime = ts->idle_sleeptime; -+ iowait_sleeptime = ts->iowait_sleeptime; - memset(ts, 0, sizeof(*ts)); -+ ts->idle_sleeptime = idle_sleeptime; -+ ts->iowait_sleeptime = iowait_sleeptime; - } - #endif - --- -2.43.2 - -From 16d32c6ef4f84975ad4078f98c5e682c425ca1d3 Mon Sep 17 00:00:00 2001 -From: Lino Sanfilippo <l.sanfilippo@kunbus.com> -Date: Wed, 3 Jan 2024 07:18:12 +0100 -Subject: [PATCH 0438/1501] serial: Do not hold the port lock when setting - rx-during-tx GPIO -Content-Length: 5267 -Lines: 138 - -commit 07c30ea5861fb26a77dade8cdc787252f6122fb1 upstream. - -Both the imx and stm32 driver set the rx-during-tx GPIO in rs485_config(). -Since this function is called with the port lock held, this can be a -problem in case that setting the GPIO line can sleep (e.g. if a GPIO -expander is used which is connected via SPI or I2C). - -Avoid this issue by moving the GPIO setting outside of the port lock into -the serial core and thus making it a generic feature. - -Also with commit c54d48543689 ("serial: stm32: Add support for rs485 -RX_DURING_TX output GPIO") the SER_RS485_RX_DURING_TX flag is only set if a -rx-during-tx GPIO is _not_ available, which is wrong. Fix this, too. - -Furthermore reset old GPIO settings in case that changing the RS485 -configuration failed. - -Fixes: c54d48543689 ("serial: stm32: Add support for rs485 RX_DURING_TX output GPIO") -Fixes: ca530cfa968c ("serial: imx: Add support for RS485 RX_DURING_TX output GPIO") -Cc: Shawn Guo <shawnguo@kernel.org> -Cc: Sascha Hauer <s.hauer@pengutronix.de> -Cc: <stable@vger.kernel.org> -Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com> -Link: https://lore.kernel.org/r/20240103061818.564-2-l.sanfilippo@kunbus.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/tty/serial/imx.c | 4 ---- - drivers/tty/serial/serial_core.c | 26 ++++++++++++++++++++++++-- - drivers/tty/serial/stm32-usart.c | 8 ++------ - 3 files changed, 26 insertions(+), 12 deletions(-) - -diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c -index 708b9852a575..9cffeb23112b 100644 ---- a/drivers/tty/serial/imx.c -+++ b/drivers/tty/serial/imx.c -@@ -1943,10 +1943,6 @@ static int imx_uart_rs485_config(struct uart_port *port, struct ktermios *termio - rs485conf->flags & SER_RS485_RX_DURING_TX) - imx_uart_start_rx(port); - -- if (port->rs485_rx_during_tx_gpio) -- gpiod_set_value_cansleep(port->rs485_rx_during_tx_gpio, -- !!(rs485conf->flags & SER_RS485_RX_DURING_TX)); -- - return 0; - } - -diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c -index f1348a509552..d155131f221d 100644 ---- a/drivers/tty/serial/serial_core.c -+++ b/drivers/tty/serial/serial_core.c -@@ -1402,6 +1402,16 @@ static void uart_set_rs485_termination(struct uart_port *port, - !!(rs485->flags & SER_RS485_TERMINATE_BUS)); - } - -+static void uart_set_rs485_rx_during_tx(struct uart_port *port, -+ const struct serial_rs485 *rs485) -+{ -+ if (!(rs485->flags & SER_RS485_ENABLED)) -+ return; -+ -+ gpiod_set_value_cansleep(port->rs485_rx_during_tx_gpio, -+ !!(rs485->flags & SER_RS485_RX_DURING_TX)); -+} -+ - static int uart_rs485_config(struct uart_port *port) - { - struct serial_rs485 *rs485 = &port->rs485; -@@ -1413,12 +1423,17 @@ static int uart_rs485_config(struct uart_port *port) - - uart_sanitize_serial_rs485(port, rs485); - uart_set_rs485_termination(port, rs485); -+ uart_set_rs485_rx_during_tx(port, rs485); - - uart_port_lock_irqsave(port, &flags); - ret = port->rs485_config(port, NULL, rs485); - uart_port_unlock_irqrestore(port, flags); -- if (ret) -+ if (ret) { - memset(rs485, 0, sizeof(*rs485)); -+ /* unset GPIOs */ -+ gpiod_set_value_cansleep(port->rs485_term_gpio, 0); -+ gpiod_set_value_cansleep(port->rs485_rx_during_tx_gpio, 0); -+ } - - return ret; - } -@@ -1457,6 +1472,7 @@ static int uart_set_rs485_config(struct tty_struct *tty, struct uart_port *port, - return ret; - uart_sanitize_serial_rs485(port, &rs485); - uart_set_rs485_termination(port, &rs485); -+ uart_set_rs485_rx_during_tx(port, &rs485); - - uart_port_lock_irqsave(port, &flags); - ret = port->rs485_config(port, &tty->termios, &rs485); -@@ -1468,8 +1484,14 @@ static int uart_set_rs485_config(struct tty_struct *tty, struct uart_port *port, - port->ops->set_mctrl(port, port->mctrl); - } - uart_port_unlock_irqrestore(port, flags); -- if (ret) -+ if (ret) { -+ /* restore old GPIO settings */ -+ gpiod_set_value_cansleep(port->rs485_term_gpio, -+ !!(port->rs485.flags & SER_RS485_TERMINATE_BUS)); -+ gpiod_set_value_cansleep(port->rs485_rx_during_tx_gpio, -+ !!(port->rs485.flags & SER_RS485_RX_DURING_TX)); - return ret; -+ } - - if (copy_to_user(rs485_user, &port->rs485, sizeof(port->rs485))) - return -EFAULT; -diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c -index 3048620315d6..fc7fd40bca98 100644 ---- a/drivers/tty/serial/stm32-usart.c -+++ b/drivers/tty/serial/stm32-usart.c -@@ -226,12 +226,6 @@ static int stm32_usart_config_rs485(struct uart_port *port, struct ktermios *ter - - stm32_usart_clr_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit)); - -- if (port->rs485_rx_during_tx_gpio) -- gpiod_set_value_cansleep(port->rs485_rx_during_tx_gpio, -- !!(rs485conf->flags & SER_RS485_RX_DURING_TX)); -- else -- rs485conf->flags |= SER_RS485_RX_DURING_TX; -- - if (rs485conf->flags & SER_RS485_ENABLED) { - cr1 = readl_relaxed(port->membase + ofs->cr1); - cr3 = readl_relaxed(port->membase + ofs->cr3); -@@ -256,6 +250,8 @@ static int stm32_usart_config_rs485(struct uart_port *port, struct ktermios *ter - - writel_relaxed(cr3, port->membase + ofs->cr3); - writel_relaxed(cr1, port->membase + ofs->cr1); -+ -+ rs485conf->flags |= SER_RS485_RX_DURING_TX; - } else { - stm32_usart_clr_bits(port, ofs->cr3, - USART_CR3_DEM | USART_CR3_DEP); --- -2.43.2 - -From 0cd92a55946eed56444e5acd54e01a55d3b6b359 Mon Sep 17 00:00:00 2001 -From: Lino Sanfilippo <l.sanfilippo@kunbus.com> -Date: Wed, 3 Jan 2024 07:18:14 +0100 -Subject: [PATCH 0439/1501] serial: core: fix sanitizing check for RTS settings -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 3027 -Lines: 76 - -commit 4afeced55baa391490b61ed9164867e2927353ed upstream. - -Among other things uart_sanitize_serial_rs485() tests the sanity of the RTS -settings in a RS485 configuration that has been passed by userspace. -If RTS-on-send and RTS-after-send are both set or unset the configuration -is adjusted and RTS-after-send is disabled and RTS-on-send enabled. - -This however makes only sense if both RTS modes are actually supported by -the driver. - -With commit be2e2cb1d281 ("serial: Sanitize rs485_struct") the code does -take the driver support into account but only checks if one of both RTS -modes are supported. This may lead to the errorneous result of RTS-on-send -being set even if only RTS-after-send is supported. - -Fix this by changing the implemented logic: First clear all unsupported -flags in the RS485 configuration, then adjust an invalid RTS setting by -taking into account which RTS mode is supported. - -Cc: <stable@vger.kernel.org> -Fixes: be2e2cb1d281 ("serial: Sanitize rs485_struct") -Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> -Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com> -Link: https://lore.kernel.org/r/20240103061818.564-4-l.sanfilippo@kunbus.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/tty/serial/serial_core.c | 32 ++++++++++++++++++++------------ - 1 file changed, 20 insertions(+), 12 deletions(-) - -diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c -index d155131f221d..33ce1813b997 100644 ---- a/drivers/tty/serial/serial_core.c -+++ b/drivers/tty/serial/serial_core.c -@@ -1371,20 +1371,28 @@ static void uart_sanitize_serial_rs485(struct uart_port *port, struct serial_rs4 - return; - } - -- /* Pick sane settings if the user hasn't */ -- if ((supported_flags & (SER_RS485_RTS_ON_SEND|SER_RS485_RTS_AFTER_SEND)) && -- !(rs485->flags & SER_RS485_RTS_ON_SEND) == -- !(rs485->flags & SER_RS485_RTS_AFTER_SEND)) { -- dev_warn_ratelimited(port->dev, -- "%s (%d): invalid RTS setting, using RTS_ON_SEND instead\n", -- port->name, port->line); -- rs485->flags |= SER_RS485_RTS_ON_SEND; -- rs485->flags &= ~SER_RS485_RTS_AFTER_SEND; -- supported_flags |= SER_RS485_RTS_ON_SEND|SER_RS485_RTS_AFTER_SEND; -- } -- - rs485->flags &= supported_flags; - -+ /* Pick sane settings if the user hasn't */ -+ if (!(rs485->flags & SER_RS485_RTS_ON_SEND) == -+ !(rs485->flags & SER_RS485_RTS_AFTER_SEND)) { -+ if (supported_flags & SER_RS485_RTS_ON_SEND) { -+ rs485->flags |= SER_RS485_RTS_ON_SEND; -+ rs485->flags &= ~SER_RS485_RTS_AFTER_SEND; -+ -+ dev_warn_ratelimited(port->dev, -+ "%s (%d): invalid RTS setting, using RTS_ON_SEND instead\n", -+ port->name, port->line); -+ } else { -+ rs485->flags |= SER_RS485_RTS_AFTER_SEND; -+ rs485->flags &= ~SER_RS485_RTS_ON_SEND; -+ -+ dev_warn_ratelimited(port->dev, -+ "%s (%d): invalid RTS setting, using RTS_AFTER_SEND instead\n", -+ port->name, port->line); -+ } -+ } -+ - uart_sanitize_serial_rs485_delays(port, rs485); - - /* Return clean padding area to userspace */ --- -2.43.2 - -From c294a899dcc8c63daf7c28ed99b66e385b6433bd Mon Sep 17 00:00:00 2001 -From: Lino Sanfilippo <l.sanfilippo@kunbus.com> -Date: Wed, 3 Jan 2024 07:18:15 +0100 -Subject: [PATCH 0440/1501] serial: core: make sure RS485 cannot be enabled - when it is not supported -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1900 -Lines: 46 - -commit c73986913fa47e71e0b1ad7f039f6444915e8810 upstream. - -Some uart drivers specify a rs485_config() function and then decide later -to disable RS485 support for some reason (e.g. imx and ar933). - -In these cases userspace may be able to activate RS485 via TIOCSRS485 -nevertheless, since in uart_set_rs485_config() an existing rs485_config() -function indicates that RS485 is supported. - -Make sure that this is not longer possible by checking the uarts -rs485_supported.flags instead and bailing out if SER_RS485_ENABLED is not -set. - -Furthermore instead of returning an empty structure return -ENOTTY if the -RS485 configuration is requested via TIOCGRS485 but RS485 is not supported. -This has a small impact on userspace visibility but it is consistent with -the -ENOTTY error for TIOCGRS485. - -Fixes: e849145e1fdd ("serial: ar933x: Fill in rs485_supported") -Fixes: 55e18c6b6d42 ("serial: imx: Remove serial_rs485 sanitization") -Cc: Shawn Guo <shawnguo@kernel.org> -Cc: Sascha Hauer <s.hauer@pengutronix.de> -Cc: <stable@vger.kernel.org> -Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> -Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com> -Link: https://lore.kernel.org/r/20240103061818.564-5-l.sanfilippo@kunbus.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/tty/serial/serial_core.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c -index 33ce1813b997..a6371f269648 100644 ---- a/drivers/tty/serial/serial_core.c -+++ b/drivers/tty/serial/serial_core.c -@@ -1469,7 +1469,7 @@ static int uart_set_rs485_config(struct tty_struct *tty, struct uart_port *port, - int ret; - unsigned long flags; - -- if (!port->rs485_config) -+ if (!(port->rs485_supported.flags & SER_RS485_ENABLED)) - return -ENOTTY; - - if (copy_from_user(&rs485, rs485_user, sizeof(*rs485_user))) --- -2.43.2 - -From cecfbbde2bacbaa8307893859f36a59b0f6eecfa Mon Sep 17 00:00:00 2001 -From: Lino Sanfilippo <l.sanfilippo@kunbus.com> -Date: Wed, 3 Jan 2024 07:18:13 +0100 -Subject: [PATCH 0441/1501] serial: core: set missing supported flag for RX - during TX GPIO -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1405 -Lines: 33 - -commit 1a33e33ca0e80d485458410f149265cdc0178cfa upstream. - -If the RS485 feature RX-during-TX is supported by means of a GPIO set the -according supported flag. Otherwise setting this feature from userspace may -not be possible, since in uart_sanitize_serial_rs485() the passed RS485 -configuration is matched against the supported features and unsupported -settings are thereby removed and thus take no effect. - -Cc: <stable@vger.kernel.org> -Fixes: 163f080eb717 ("serial: core: Add option to output RS485 RX_DURING_TX state via GPIO") -Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> -Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com> -Link: https://lore.kernel.org/r/20240103061818.564-3-l.sanfilippo@kunbus.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/tty/serial/serial_core.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c -index a6371f269648..28bcbc686c67 100644 ---- a/drivers/tty/serial/serial_core.c -+++ b/drivers/tty/serial/serial_core.c -@@ -3650,6 +3650,8 @@ int uart_get_rs485_mode(struct uart_port *port) - if (IS_ERR(desc)) - return dev_err_probe(dev, PTR_ERR(desc), "Cannot get rs485-rx-during-tx-gpios\n"); - port->rs485_rx_during_tx_gpio = desc; -+ if (port->rs485_rx_during_tx_gpio) -+ port->rs485_supported.flags |= SER_RS485_RX_DURING_TX; - - return 0; - } --- -2.43.2 - -From a51ff5ed81284b7a3705a57e188ca33e8b830575 Mon Sep 17 00:00:00 2001 -From: Stefan Wahren <wahrenst@gmx.net> -Date: Wed, 20 Dec 2023 12:43:34 +0100 -Subject: [PATCH 0442/1501] serial: 8250_bcm2835aux: Restore clock error - handling -Content-Length: 1251 -Lines: 31 - -commit 83e571f054cd742eb9a46d46ef05193904adf53f upstream. - -The commit fcc446c8aa63 ("serial: 8250_bcm2835aux: Add ACPI support") -dropped the error handling for clock acquiring. But even an optional -clock needs this. - -Fixes: fcc446c8aa63 ("serial: 8250_bcm2835aux: Add ACPI support") -Cc: stable <stable@kernel.org> -Signed-off-by: Stefan Wahren <wahrenst@gmx.net> -Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> -Link: https://lore.kernel.org/r/20231220114334.4712-1-wahrenst@gmx.net -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/tty/serial/8250/8250_bcm2835aux.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/tty/serial/8250/8250_bcm2835aux.c b/drivers/tty/serial/8250/8250_bcm2835aux.c -index 15a2387a5b25..4f4502fb5454 100644 ---- a/drivers/tty/serial/8250/8250_bcm2835aux.c -+++ b/drivers/tty/serial/8250/8250_bcm2835aux.c -@@ -119,6 +119,8 @@ static int bcm2835aux_serial_probe(struct platform_device *pdev) - - /* get the clock - this also enables the HW */ - data->clk = devm_clk_get_optional(&pdev->dev, NULL); -+ if (IS_ERR(data->clk)) -+ return dev_err_probe(&pdev->dev, PTR_ERR(data->clk), "could not get clk\n"); - - /* get the interrupt */ - ret = platform_get_irq(pdev, 0); --- -2.43.2 - -From e3521c4856e70593f5a7c4190ad30eab54a99c80 Mon Sep 17 00:00:00 2001 -From: Lino Sanfilippo <l.sanfilippo@kunbus.com> -Date: Wed, 3 Jan 2024 07:18:16 +0100 -Subject: [PATCH 0443/1501] serial: core, imx: do not set RS485 enabled if it - is not supported -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 3246 -Lines: 81 - -commit 74eab89b26ac433ad857292f4707b43c1a8f0209 upstream. - -If the imx driver cannot support RS485 it nullifies the ports -rs485_supported structure. But it still calls uart_get_rs485_mode() which -may set the RS485_ENABLED flag nevertheless. - -This may lead to an attempt to configure RS485 even if it is not supported -when the flag is evaluated in uart_configure_port() at port startup. - -Avoid this by bailing out of uart_get_rs485_mode() if the RS485_ENABLED -flag is not supported by the caller. - -With this fix a check for RTS availability is now obsolete in the imx -driver, since it can not evaluate to true any more. So remove this check. - -Furthermore the explicit nullifcation of rs485_supported is not needed, -since the memory has already been set to zeros at allocation. So remove -this, too. - -Fixes: 00d7a00e2a6f ("serial: imx: Fill in rs485_supported") -Cc: Shawn Guo <shawnguo@kernel.org> -Cc: Sascha Hauer <s.hauer@pengutronix.de> -Cc: <stable@vger.kernel.org> -Suggested-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> -Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com> -Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> -Link: https://lore.kernel.org/r/20240103061818.564-6-l.sanfilippo@kunbus.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/tty/serial/imx.c | 7 ------- - drivers/tty/serial/serial_core.c | 3 +++ - 2 files changed, 3 insertions(+), 7 deletions(-) - -diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c -index 9cffeb23112b..198ce7e7bc8b 100644 ---- a/drivers/tty/serial/imx.c -+++ b/drivers/tty/serial/imx.c -@@ -2206,7 +2206,6 @@ static enum hrtimer_restart imx_trigger_stop_tx(struct hrtimer *t) - return HRTIMER_NORESTART; - } - --static const struct serial_rs485 imx_no_rs485 = {}; /* No RS485 if no RTS */ - static const struct serial_rs485 imx_rs485_supported = { - .flags = SER_RS485_ENABLED | SER_RS485_RTS_ON_SEND | SER_RS485_RTS_AFTER_SEND | - SER_RS485_RX_DURING_TX, -@@ -2290,8 +2289,6 @@ static int imx_uart_probe(struct platform_device *pdev) - /* RTS is required to control the RS485 transmitter */ - if (sport->have_rtscts || sport->have_rtsgpio) - sport->port.rs485_supported = imx_rs485_supported; -- else -- sport->port.rs485_supported = imx_no_rs485; - sport->port.flags = UPF_BOOT_AUTOCONF; - timer_setup(&sport->timer, imx_uart_timeout, 0); - -@@ -2328,10 +2325,6 @@ static int imx_uart_probe(struct platform_device *pdev) - return ret; - } - -- if (sport->port.rs485.flags & SER_RS485_ENABLED && -- (!sport->have_rtscts && !sport->have_rtsgpio)) -- dev_err(&pdev->dev, "no RTS control, disabling rs485\n"); -- - /* - * If using the i.MX UART RTS/CTS control then the RTS (CTS_B) - * signal cannot be set low during transmission in case the -diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c -index 28bcbc686c67..93e4e1693601 100644 ---- a/drivers/tty/serial/serial_core.c -+++ b/drivers/tty/serial/serial_core.c -@@ -3600,6 +3600,9 @@ int uart_get_rs485_mode(struct uart_port *port) - u32 rs485_delay[2]; - int ret; - -+ if (!(port->rs485_supported.flags & SER_RS485_ENABLED)) -+ return 0; -+ - ret = device_property_read_u32_array(dev, "rs485-rts-delay", - rs485_delay, 2); - if (!ret) { --- -2.43.2 - -From dfe8d18d0417aa42d7301f216b962d155b6d4bc2 Mon Sep 17 00:00:00 2001 -From: Christoph Niedermaier <cniedermaier@dh-electronics.com> -Date: Tue, 26 Dec 2023 12:36:47 +0100 -Subject: [PATCH 0444/1501] serial: imx: Ensure that imx_uart_rs485_config() is - called with enabled clock -Content-Length: 3562 -Lines: 101 - -commit 7c45eaa813476bd195ac1227a64b52f9cf2e2030 upstream. - -There are register accesses in the function imx_uart_rs485_config(). The -clock must be enabled for these accesses. This was ensured by calling it -via the function uart_rs485_config() in the probe() function within the -range where the clock is enabled. With the commit 7c7f9bc986e6 ("serial: -Deassert Transmit Enable on probe in driver-specific way") it was removed -from the probe() function and is now only called through the function -uart_add_one_port() which is located at the end of the probe() function. -But the clock is already switched off in this area. To ensure that the -clock is enabled during register access, move the disabling of the clock -to the very end of the probe() function. To avoid leaking enabled clocks -on error also add an error path for exiting with disabling the clock. - -Fixes: 7c7f9bc986e6 ("serial: Deassert Transmit Enable on probe in driver-specific way") -Cc: stable <stable@kernel.org> -Signed-off-by: Christoph Niedermaier <cniedermaier@dh-electronics.com> -Reviewed-by: Lukas Wunner <lukas@wunner.de> -Link: https://lore.kernel.org/r/20231226113647.39376-1-cniedermaier@dh-electronics.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/tty/serial/imx.c | 23 ++++++++++++----------- - 1 file changed, 12 insertions(+), 11 deletions(-) - -diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c -index 198ce7e7bc8b..4cecc097408e 100644 ---- a/drivers/tty/serial/imx.c -+++ b/drivers/tty/serial/imx.c -@@ -2320,10 +2320,8 @@ static int imx_uart_probe(struct platform_device *pdev) - } - - ret = uart_get_rs485_mode(&sport->port); -- if (ret) { -- clk_disable_unprepare(sport->clk_ipg); -- return ret; -- } -+ if (ret) -+ goto err_clk; - - /* - * If using the i.MX UART RTS/CTS control then the RTS (CTS_B) -@@ -2403,8 +2401,6 @@ static int imx_uart_probe(struct platform_device *pdev) - imx_uart_writel(sport, ucr3, UCR3); - } - -- clk_disable_unprepare(sport->clk_ipg); -- - hrtimer_init(&sport->trigger_start_tx, CLOCK_MONOTONIC, HRTIMER_MODE_REL); - hrtimer_init(&sport->trigger_stop_tx, CLOCK_MONOTONIC, HRTIMER_MODE_REL); - sport->trigger_start_tx.function = imx_trigger_start_tx; -@@ -2420,7 +2416,7 @@ static int imx_uart_probe(struct platform_device *pdev) - if (ret) { - dev_err(&pdev->dev, "failed to request rx irq: %d\n", - ret); -- return ret; -+ goto err_clk; - } - - ret = devm_request_irq(&pdev->dev, txirq, imx_uart_txint, 0, -@@ -2428,7 +2424,7 @@ static int imx_uart_probe(struct platform_device *pdev) - if (ret) { - dev_err(&pdev->dev, "failed to request tx irq: %d\n", - ret); -- return ret; -+ goto err_clk; - } - - ret = devm_request_irq(&pdev->dev, rtsirq, imx_uart_rtsint, 0, -@@ -2436,14 +2432,14 @@ static int imx_uart_probe(struct platform_device *pdev) - if (ret) { - dev_err(&pdev->dev, "failed to request rts irq: %d\n", - ret); -- return ret; -+ goto err_clk; - } - } else { - ret = devm_request_irq(&pdev->dev, rxirq, imx_uart_int, 0, - dev_name(&pdev->dev), sport); - if (ret) { - dev_err(&pdev->dev, "failed to request irq: %d\n", ret); -- return ret; -+ goto err_clk; - } - } - -@@ -2451,7 +2447,12 @@ static int imx_uart_probe(struct platform_device *pdev) - - platform_set_drvdata(pdev, sport); - -- return uart_add_one_port(&imx_uart_uart_driver, &sport->port); -+ ret = uart_add_one_port(&imx_uart_uart_driver, &sport->port); -+ -+err_clk: -+ clk_disable_unprepare(sport->clk_ipg); -+ -+ return ret; - } - - static int imx_uart_remove(struct platform_device *pdev) --- -2.43.2 - -From 31010f9076fef529a1da89a525345ff0349f5160 Mon Sep 17 00:00:00 2001 -From: Lino Sanfilippo <l.sanfilippo@kunbus.com> -Date: Wed, 3 Jan 2024 07:18:18 +0100 -Subject: [PATCH 0445/1501] serial: 8250_exar: Set missing rs485_supported flag -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2013 -Lines: 47 - -commit 0c2a5f471ce58bca8f8ab5fcb911aff91eaaa5eb upstream. - -The UART supports an auto-RTS mode in which the RTS pin is automatically -activated during transmission. So mark this mode as being supported even -if RTS is not controlled by the driver but the UART. - -Also the serial core expects now at least one of both modes rts-on-send or -rts-after-send to be supported. This is since during sanitization -unsupported flags are deleted from a RS485 configuration set by userspace. -However if the configuration ends up with both flags unset, the core prints -a warning since it considers such a configuration invalid (see -uart_sanitize_serial_rs485()). - -Cc: <stable@vger.kernel.org> -Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> -Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com> -Link: https://lore.kernel.org/r/20240103061818.564-8-l.sanfilippo@kunbus.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/tty/serial/8250/8250_exar.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c -index 6085d356ad86..23366f868ae3 100644 ---- a/drivers/tty/serial/8250/8250_exar.c -+++ b/drivers/tty/serial/8250/8250_exar.c -@@ -480,7 +480,7 @@ static int sealevel_rs485_config(struct uart_port *port, struct ktermios *termio - } - - static const struct serial_rs485 generic_rs485_supported = { -- .flags = SER_RS485_ENABLED, -+ .flags = SER_RS485_ENABLED | SER_RS485_RTS_ON_SEND, - }; - - static const struct exar8250_platform exar8250_default_platform = { -@@ -524,7 +524,8 @@ static int iot2040_rs485_config(struct uart_port *port, struct ktermios *termios - } - - static const struct serial_rs485 iot2040_rs485_supported = { -- .flags = SER_RS485_ENABLED | SER_RS485_RX_DURING_TX | SER_RS485_TERMINATE_BUS, -+ .flags = SER_RS485_ENABLED | SER_RS485_RTS_ON_SEND | -+ SER_RS485_RX_DURING_TX | SER_RS485_TERMINATE_BUS, - }; - - static const struct property_entry iot2040_gpio_properties[] = { --- -2.43.2 - -From 2528362529721c622c2a6c327051942fcf35accf Mon Sep 17 00:00:00 2001 -From: Lino Sanfilippo <l.sanfilippo@kunbus.com> -Date: Wed, 3 Jan 2024 07:18:17 +0100 -Subject: [PATCH 0446/1501] serial: omap: do not override settings for RS485 - support -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 3547 -Lines: 98 - -commit 51f93776b84dee23e44a7be880736669a01cec2b upstream. - -The drivers RS485 support is deactivated if there is no RTS GPIO available. -This is done by nullifying the ports rs485_supported struct. After that -however the settings in serial_omap_rs485_supported are assigned to the -same structure unconditionally, which results in an unintended reactivation -of RS485 support. - -Fix this by moving the assignment to the beginning of -serial_omap_probe_rs485() and thus before uart_get_rs485_mode() gets -called. - -Also replace the assignment of rs485_config() to have the complete RS485 -setup in one function. - -Fixes: e2752ae3cfc9 ("serial: omap: Disallow RS-485 if rts-gpio is not specified") -Cc: <stable@vger.kernel.org> -Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com> -Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> -Link: https://lore.kernel.org/r/20240103061818.564-7-l.sanfilippo@kunbus.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/tty/serial/omap-serial.c | 27 ++++++++++++++------------- - 1 file changed, 14 insertions(+), 13 deletions(-) - -diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c -index ad4c1c5d0a7f..f4c6ff806465 100644 ---- a/drivers/tty/serial/omap-serial.c -+++ b/drivers/tty/serial/omap-serial.c -@@ -1483,6 +1483,13 @@ static struct omap_uart_port_info *of_get_uart_port_info(struct device *dev) - return omap_up_info; - } - -+static const struct serial_rs485 serial_omap_rs485_supported = { -+ .flags = SER_RS485_ENABLED | SER_RS485_RTS_ON_SEND | SER_RS485_RTS_AFTER_SEND | -+ SER_RS485_RX_DURING_TX, -+ .delay_rts_before_send = 1, -+ .delay_rts_after_send = 1, -+}; -+ - static int serial_omap_probe_rs485(struct uart_omap_port *up, - struct device *dev) - { -@@ -1497,6 +1504,9 @@ static int serial_omap_probe_rs485(struct uart_omap_port *up, - if (!np) - return 0; - -+ up->port.rs485_config = serial_omap_config_rs485; -+ up->port.rs485_supported = serial_omap_rs485_supported; -+ - ret = uart_get_rs485_mode(&up->port); - if (ret) - return ret; -@@ -1531,13 +1541,6 @@ static int serial_omap_probe_rs485(struct uart_omap_port *up, - return 0; - } - --static const struct serial_rs485 serial_omap_rs485_supported = { -- .flags = SER_RS485_ENABLED | SER_RS485_RTS_ON_SEND | SER_RS485_RTS_AFTER_SEND | -- SER_RS485_RX_DURING_TX, -- .delay_rts_before_send = 1, -- .delay_rts_after_send = 1, --}; -- - static int serial_omap_probe(struct platform_device *pdev) - { - struct omap_uart_port_info *omap_up_info = dev_get_platdata(&pdev->dev); -@@ -1604,17 +1607,11 @@ static int serial_omap_probe(struct platform_device *pdev) - dev_info(up->port.dev, "no wakeirq for uart%d\n", - up->port.line); - -- ret = serial_omap_probe_rs485(up, &pdev->dev); -- if (ret < 0) -- goto err_rs485; -- - sprintf(up->name, "OMAP UART%d", up->port.line); - up->port.mapbase = mem->start; - up->port.membase = base; - up->port.flags = omap_up_info->flags; - up->port.uartclk = omap_up_info->uartclk; -- up->port.rs485_config = serial_omap_config_rs485; -- up->port.rs485_supported = serial_omap_rs485_supported; - if (!up->port.uartclk) { - up->port.uartclk = DEFAULT_CLK_SPEED; - dev_warn(&pdev->dev, -@@ -1622,6 +1619,10 @@ static int serial_omap_probe(struct platform_device *pdev) - DEFAULT_CLK_SPEED); - } - -+ ret = serial_omap_probe_rs485(up, &pdev->dev); -+ if (ret < 0) -+ goto err_rs485; -+ - up->latency = PM_QOS_CPU_LATENCY_DEFAULT_VALUE; - up->calc_latency = PM_QOS_CPU_LATENCY_DEFAULT_VALUE; - cpu_latency_qos_add_request(&up->pm_qos_request, up->latency); --- -2.43.2 - -From 5e6dfec95833edc54c48605a98365a7325e5541e Mon Sep 17 00:00:00 2001 -From: Namjae Jeon <linkinjeon@kernel.org> -Date: Sat, 13 Jan 2024 15:11:41 +0900 -Subject: [PATCH 0451/1501] ksmbd: validate mech token in session setup -Content-Length: 3457 -Lines: 105 - -commit 92e470163d96df8db6c4fa0f484e4a229edb903d upstream. - -If client send invalid mech token in session setup request, ksmbd -validate and make the error if it is invalid. - -Cc: stable@vger.kernel.org -Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-22890 -Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> -Signed-off-by: Steve French <stfrench@microsoft.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/smb/server/asn1.c | 5 +++++ - fs/smb/server/connection.h | 1 + - fs/smb/server/smb2pdu.c | 22 +++++++++++++++++----- - 3 files changed, 23 insertions(+), 5 deletions(-) - -diff --git a/fs/smb/server/asn1.c b/fs/smb/server/asn1.c -index 4a4b2b03ff33..b931a99ab9c8 100644 ---- a/fs/smb/server/asn1.c -+++ b/fs/smb/server/asn1.c -@@ -214,10 +214,15 @@ static int ksmbd_neg_token_alloc(void *context, size_t hdrlen, - { - struct ksmbd_conn *conn = context; - -+ if (!vlen) -+ return -EINVAL; -+ - conn->mechToken = kmemdup_nul(value, vlen, GFP_KERNEL); - if (!conn->mechToken) - return -ENOMEM; - -+ conn->mechTokenLen = (unsigned int)vlen; -+ - return 0; - } - -diff --git a/fs/smb/server/connection.h b/fs/smb/server/connection.h -index 3c005246a32e..342f935f5770 100644 ---- a/fs/smb/server/connection.h -+++ b/fs/smb/server/connection.h -@@ -88,6 +88,7 @@ struct ksmbd_conn { - __u16 dialect; - - char *mechToken; -+ unsigned int mechTokenLen; - - struct ksmbd_conn_ops *conn_ops; - -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index ca2c528c9de3..948665f8370f 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -1414,7 +1414,10 @@ static struct ksmbd_user *session_user(struct ksmbd_conn *conn, - char *name; - unsigned int name_off, name_len, secbuf_len; - -- secbuf_len = le16_to_cpu(req->SecurityBufferLength); -+ if (conn->use_spnego && conn->mechToken) -+ secbuf_len = conn->mechTokenLen; -+ else -+ secbuf_len = le16_to_cpu(req->SecurityBufferLength); - if (secbuf_len < sizeof(struct authenticate_message)) { - ksmbd_debug(SMB, "blob len %d too small\n", secbuf_len); - return NULL; -@@ -1505,7 +1508,10 @@ static int ntlm_authenticate(struct ksmbd_work *work, - struct authenticate_message *authblob; - - authblob = user_authblob(conn, req); -- sz = le16_to_cpu(req->SecurityBufferLength); -+ if (conn->use_spnego && conn->mechToken) -+ sz = conn->mechTokenLen; -+ else -+ sz = le16_to_cpu(req->SecurityBufferLength); - rc = ksmbd_decode_ntlmssp_auth_blob(authblob, sz, conn, sess); - if (rc) { - set_user_flag(sess->user, KSMBD_USER_FLAG_BAD_PASSWORD); -@@ -1778,8 +1784,7 @@ int smb2_sess_setup(struct ksmbd_work *work) - - negblob_off = le16_to_cpu(req->SecurityBufferOffset); - negblob_len = le16_to_cpu(req->SecurityBufferLength); -- if (negblob_off < offsetof(struct smb2_sess_setup_req, Buffer) || -- negblob_len < offsetof(struct negotiate_message, NegotiateFlags)) { -+ if (negblob_off < offsetof(struct smb2_sess_setup_req, Buffer)) { - rc = -EINVAL; - goto out_err; - } -@@ -1788,8 +1793,15 @@ int smb2_sess_setup(struct ksmbd_work *work) - negblob_off); - - if (decode_negotiation_token(conn, negblob, negblob_len) == 0) { -- if (conn->mechToken) -+ if (conn->mechToken) { - negblob = (struct negotiate_message *)conn->mechToken; -+ negblob_len = conn->mechTokenLen; -+ } -+ } -+ -+ if (negblob_len < offsetof(struct negotiate_message, NegotiateFlags)) { -+ rc = -EINVAL; -+ goto out_err; - } - - if (server_conf.auth_mechs & conn->auth_mechs) { --- -2.43.2 - -From 69d54650b751532d1e1613a4fb433e591aeef126 Mon Sep 17 00:00:00 2001 -From: Namjae Jeon <linkinjeon@kernel.org> -Date: Sat, 13 Jan 2024 15:30:07 +0900 -Subject: [PATCH 0452/1501] ksmbd: fix UAF issue in ksmbd_tcp_new_connection() -Content-Length: 3833 -Lines: 111 - -commit 38d20c62903d669693a1869aa68c4dd5674e2544 upstream. - -The race is between the handling of a new TCP connection and -its disconnection. It leads to UAF on `struct tcp_transport` in -ksmbd_tcp_new_connection() function. - -Cc: stable@vger.kernel.org -Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-22991 -Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> -Signed-off-by: Steve French <stfrench@microsoft.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/smb/server/connection.c | 6 ------ - fs/smb/server/connection.h | 1 - - fs/smb/server/transport_rdma.c | 11 ++++++----- - fs/smb/server/transport_tcp.c | 13 +++++++------ - 4 files changed, 13 insertions(+), 18 deletions(-) - -diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c -index b6fa1e285c40..7977827c6541 100644 ---- a/fs/smb/server/connection.c -+++ b/fs/smb/server/connection.c -@@ -415,13 +415,7 @@ static void stop_sessions(void) - again: - down_read(&conn_list_lock); - list_for_each_entry(conn, &conn_list, conns_list) { -- struct task_struct *task; -- - t = conn->transport; -- task = t->handler; -- if (task) -- ksmbd_debug(CONN, "Stop session handler %s/%d\n", -- task->comm, task_pid_nr(task)); - ksmbd_conn_set_exiting(conn); - if (t->ops->shutdown) { - up_read(&conn_list_lock); -diff --git a/fs/smb/server/connection.h b/fs/smb/server/connection.h -index 342f935f5770..0e04cf8b1d89 100644 ---- a/fs/smb/server/connection.h -+++ b/fs/smb/server/connection.h -@@ -135,7 +135,6 @@ struct ksmbd_transport_ops { - struct ksmbd_transport { - struct ksmbd_conn *conn; - struct ksmbd_transport_ops *ops; -- struct task_struct *handler; - }; - - #define KSMBD_TCP_RECV_TIMEOUT (7 * HZ) -diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c -index c5629a68c8b7..8faa25c6e129 100644 ---- a/fs/smb/server/transport_rdma.c -+++ b/fs/smb/server/transport_rdma.c -@@ -2039,6 +2039,7 @@ static bool rdma_frwr_is_supported(struct ib_device_attr *attrs) - static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id) - { - struct smb_direct_transport *t; -+ struct task_struct *handler; - int ret; - - if (!rdma_frwr_is_supported(&new_cm_id->device->attrs)) { -@@ -2056,11 +2057,11 @@ static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id) - if (ret) - goto out_err; - -- KSMBD_TRANS(t)->handler = kthread_run(ksmbd_conn_handler_loop, -- KSMBD_TRANS(t)->conn, "ksmbd:r%u", -- smb_direct_port); -- if (IS_ERR(KSMBD_TRANS(t)->handler)) { -- ret = PTR_ERR(KSMBD_TRANS(t)->handler); -+ handler = kthread_run(ksmbd_conn_handler_loop, -+ KSMBD_TRANS(t)->conn, "ksmbd:r%u", -+ smb_direct_port); -+ if (IS_ERR(handler)) { -+ ret = PTR_ERR(handler); - pr_err("Can't start thread\n"); - goto out_err; - } -diff --git a/fs/smb/server/transport_tcp.c b/fs/smb/server/transport_tcp.c -index eff7a1d793f0..9d4222154dcc 100644 ---- a/fs/smb/server/transport_tcp.c -+++ b/fs/smb/server/transport_tcp.c -@@ -185,6 +185,7 @@ static int ksmbd_tcp_new_connection(struct socket *client_sk) - struct sockaddr *csin; - int rc = 0; - struct tcp_transport *t; -+ struct task_struct *handler; - - t = alloc_transport(client_sk); - if (!t) { -@@ -199,13 +200,13 @@ static int ksmbd_tcp_new_connection(struct socket *client_sk) - goto out_error; - } - -- KSMBD_TRANS(t)->handler = kthread_run(ksmbd_conn_handler_loop, -- KSMBD_TRANS(t)->conn, -- "ksmbd:%u", -- ksmbd_tcp_get_port(csin)); -- if (IS_ERR(KSMBD_TRANS(t)->handler)) { -+ handler = kthread_run(ksmbd_conn_handler_loop, -+ KSMBD_TRANS(t)->conn, -+ "ksmbd:%u", -+ ksmbd_tcp_get_port(csin)); -+ if (IS_ERR(handler)) { - pr_err("cannot start conn thread\n"); -- rc = PTR_ERR(KSMBD_TRANS(t)->handler); -+ rc = PTR_ERR(handler); - free_transport(t); - } - return rc; --- -2.43.2 - -From b40d66a4d6bafaa7823b48c44749cae47ac765d9 Mon Sep 17 00:00:00 2001 -From: Namjae Jeon <linkinjeon@kernel.org> -Date: Mon, 15 Jan 2024 10:24:54 +0900 -Subject: [PATCH 0453/1501] ksmbd: only v2 leases handle the directory -Content-Length: 1087 -Lines: 34 - -commit 77bebd186442a7d703b796784db7495129cc3e70 upstream. - -When smb2 leases is disable, ksmbd can send oplock break notification -and cause wait oplock break ack timeout. It may appear like hang when -accessing a directory. This patch make only v2 leases handle the -directory. - -Cc: stable@vger.kernel.org -Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> -Signed-off-by: Steve French <stfrench@microsoft.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/smb/server/oplock.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c -index 562b180459a1..e0eb7cb2a525 100644 ---- a/fs/smb/server/oplock.c -+++ b/fs/smb/server/oplock.c -@@ -1191,6 +1191,12 @@ int smb_grant_oplock(struct ksmbd_work *work, int req_op_level, u64 pid, - bool prev_op_has_lease; - __le32 prev_op_state = 0; - -+ /* Only v2 leases handle the directory */ -+ if (S_ISDIR(file_inode(fp->filp)->i_mode)) { -+ if (!lctx || lctx->version != 2) -+ return 0; -+ } -+ - opinfo = alloc_opinfo(work, pid, tid); - if (!opinfo) - return -ENOMEM; --- -2.43.2 - -From a13bca9f6aa99bcfd9a4e9502891cfe5ae4b7400 Mon Sep 17 00:00:00 2001 -From: Eric Biggers <ebiggers@google.com> -Date: Wed, 22 Nov 2023 19:08:38 -0800 -Subject: [PATCH 0454/1501] ceph: select FS_ENCRYPTION_ALGS if FS_ENCRYPTION -Content-Length: 1204 -Lines: 33 - -commit 9c896d6bc3dfef86659a6a1fb25ccdea5dbef6a3 upstream. - -The kconfig options for filesystems that support FS_ENCRYPTION are -supposed to select FS_ENCRYPTION_ALGS. This is needed to ensure that -required crypto algorithms get enabled as loadable modules or builtin as -is appropriate for the set of enabled filesystems. Do this for CEPH_FS -so that there aren't any missing algorithms if someone happens to have -CEPH_FS as their only enabled filesystem that supports encryption. - -Cc: stable@vger.kernel.org -Fixes: f061feda6c54 ("ceph: add fscrypt ioctls and ceph.fscrypt.auth vxattr") -Signed-off-by: Eric Biggers <ebiggers@google.com> -Reviewed-by: Xiubo Li <xiubli@redhat.com> -Signed-off-by: Ilya Dryomov <idryomov@gmail.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/ceph/Kconfig | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/fs/ceph/Kconfig b/fs/ceph/Kconfig -index 94df854147d3..7249d70e1a43 100644 ---- a/fs/ceph/Kconfig -+++ b/fs/ceph/Kconfig -@@ -7,6 +7,7 @@ config CEPH_FS - select CRYPTO_AES - select CRYPTO - select NETFS_SUPPORT -+ select FS_ENCRYPTION_ALGS if FS_ENCRYPTION - default n - help - Choose Y or M here to include support for mounting the --- -2.43.2 - -From 146b8010753de49a0fea8a76dc7beb869bc95824 Mon Sep 17 00:00:00 2001 -From: Xi Ruoyao <xry111@xry111.site> -Date: Wed, 17 Jan 2024 12:43:08 +0800 -Subject: [PATCH 0455/1501] LoongArch: Fix and simplify fcsr initialization on - execve() -Content-Length: 4685 -Lines: 118 - -commit c2396651309eba291c15e32db8fbe44c738b5921 upstream. - -There has been a lingering bug in LoongArch Linux systems causing some -GCC tests to intermittently fail (see Closes link). I've made a minimal -reproducer: - - zsh% cat measure.s - .align 4 - .globl _start - _start: - movfcsr2gr $a0, $fcsr0 - bstrpick.w $a0, $a0, 16, 16 - beqz $a0, .ok - break 0 - .ok: - li.w $a7, 93 - syscall 0 - zsh% cc mesaure.s -o measure -nostdlib - zsh% echo $((1.0/3)) - 0.33333333333333331 - zsh% while ./measure; do ; done - -This while loop should not stop as POSIX is clear that execve must set -fenv to the default, where FCSR should be zero. But in fact it will -just stop after running for a while (normally less than 30 seconds). -Note that "$((1.0/3))" is needed to reproduce this issue because it -raises FE_INVALID and makes fcsr0 non-zero. - -The problem is we are currently relying on SET_PERSONALITY2() to reset -current->thread.fpu.fcsr. But SET_PERSONALITY2() is executed before -start_thread which calls lose_fpu(0). We can see if kernel preempt is -enabled, we may switch to another thread after SET_PERSONALITY2() but -before lose_fpu(0). Then bad thing happens: during the thread switch -the value of the fcsr0 register is stored into current->thread.fpu.fcsr, -making it dirty again. - -The issue can be fixed by setting current->thread.fpu.fcsr after -lose_fpu(0) because lose_fpu() clears TIF_USEDFPU, then the thread -switch won't touch current->thread.fpu.fcsr. - -The only other architecture setting FCSR in SET_PERSONALITY2() is MIPS. -I've ran a similar test on MIPS with mainline kernel and it turns out -MIPS is buggy, too. Anyway MIPS do this for supporting different FP -flavors (NaN encodings, etc.) which do not exist on LoongArch. So for -LoongArch, we can simply remove the current->thread.fpu.fcsr setting -from SET_PERSONALITY2() and do it in start_thread(), after lose_fpu(0). - -The while loop failing with the mainline kernel has survived one hour -after this change on LoongArch. - -Fixes: 803b0fc5c3f2baa ("LoongArch: Add process management") -Closes: https://github.com/loongson-community/discussions/issues/7 -Link: https://lore.kernel.org/linux-mips/7a6aa1bbdbbe2e63ae96ff163fab0349f58f1b9e.camel@xry111.site/ -Cc: stable@vger.kernel.org -Signed-off-by: Xi Ruoyao <xry111@xry111.site> -Signed-off-by: Huacai Chen <chenhuacai@loongson.cn> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/loongarch/include/asm/elf.h | 5 ----- - arch/loongarch/kernel/elf.c | 5 ----- - arch/loongarch/kernel/process.c | 1 + - 3 files changed, 1 insertion(+), 10 deletions(-) - -diff --git a/arch/loongarch/include/asm/elf.h b/arch/loongarch/include/asm/elf.h -index 9b16a3b8e706..f16bd42456e4 100644 ---- a/arch/loongarch/include/asm/elf.h -+++ b/arch/loongarch/include/asm/elf.h -@@ -241,8 +241,6 @@ void loongarch_dump_regs64(u64 *uregs, const struct pt_regs *regs); - do { \ - current->thread.vdso = &vdso_info; \ - \ -- loongarch_set_personality_fcsr(state); \ -- \ - if (personality(current->personality) != PER_LINUX) \ - set_personality(PER_LINUX); \ - } while (0) -@@ -259,7 +257,6 @@ do { \ - clear_thread_flag(TIF_32BIT_ADDR); \ - \ - current->thread.vdso = &vdso_info; \ -- loongarch_set_personality_fcsr(state); \ - \ - p = personality(current->personality); \ - if (p != PER_LINUX32 && p != PER_LINUX) \ -@@ -340,6 +337,4 @@ extern int arch_elf_pt_proc(void *ehdr, void *phdr, struct file *elf, - extern int arch_check_elf(void *ehdr, bool has_interpreter, void *interp_ehdr, - struct arch_elf_state *state); - --extern void loongarch_set_personality_fcsr(struct arch_elf_state *state); -- - #endif /* _ASM_ELF_H */ -diff --git a/arch/loongarch/kernel/elf.c b/arch/loongarch/kernel/elf.c -index 183e94fc9c69..0fa81ced28dc 100644 ---- a/arch/loongarch/kernel/elf.c -+++ b/arch/loongarch/kernel/elf.c -@@ -23,8 +23,3 @@ int arch_check_elf(void *_ehdr, bool has_interpreter, void *_interp_ehdr, - { - return 0; - } -- --void loongarch_set_personality_fcsr(struct arch_elf_state *state) --{ -- current->thread.fpu.fcsr = boot_cpu_data.fpu_csr0; --} -diff --git a/arch/loongarch/kernel/process.c b/arch/loongarch/kernel/process.c -index 767d94cce0de..f2ff8b5d591e 100644 ---- a/arch/loongarch/kernel/process.c -+++ b/arch/loongarch/kernel/process.c -@@ -85,6 +85,7 @@ void start_thread(struct pt_regs *regs, unsigned long pc, unsigned long sp) - regs->csr_euen = euen; - lose_fpu(0); - lose_lbt(0); -+ current->thread.fpu.fcsr = boot_cpu_data.fpu_csr0; - - clear_thread_flag(TIF_LSX_CTX_LIVE); - clear_thread_flag(TIF_LASX_CTX_LIVE); --- -2.43.2 - -From d413a342275d0d81ca04563ebc897858a7a5f159 Mon Sep 17 00:00:00 2001 -From: Pavel Begunkov <asml.silence@gmail.com> -Date: Fri, 1 Dec 2023 00:38:52 +0000 -Subject: [PATCH 0456/1501] io_uring: don't check iopoll if request completes -Content-Length: 1278 -Lines: 36 - -commit 9b43ef3d52532a0175ed6654618f7db61d390d2e upstream. - -IOPOLL request should never return IOU_OK, so the following iopoll -queueing check in io_issue_sqe() after getting IOU_OK doesn't make any -sense as would never turn true. Let's optimise on that and return a bit -earlier. It's also much more resilient to potential bugs from -mischieving iopoll implementations. - -Cc: <stable@vger.kernel.org> -Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> -Link: https://lore.kernel.org/r/2f8690e2fa5213a2ff292fac29a7143c036cdd60.1701390926.git.asml.silence@gmail.com -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - io_uring/io_uring.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c -index 9626a363f121..828d0975c270 100644 ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -1898,7 +1898,11 @@ static int io_issue_sqe(struct io_kiocb *req, unsigned int issue_flags) - io_req_complete_defer(req); - else - io_req_complete_post(req, issue_flags); -- } else if (ret != IOU_ISSUE_SKIP_COMPLETE) -+ -+ return 0; -+ } -+ -+ if (ret != IOU_ISSUE_SKIP_COMPLETE) - return ret; - - /* If the op doesn't have a file, we're not polling for it */ --- -2.43.2 - -From ba8d8a8a36b2649c250e31d15f8d4e5b9539343d Mon Sep 17 00:00:00 2001 -From: Jens Axboe <axboe@kernel.dk> -Date: Thu, 21 Dec 2023 08:49:18 -0700 -Subject: [PATCH 0457/1501] io_uring/rw: ensure io->bytes_done is always - initialized -Content-Length: 1303 -Lines: 47 - -commit 0a535eddbe0dc1de4386046ab849f08aeb2f8faf upstream. - -If IOSQE_ASYNC is set and we fail importing an iovec for a readv or -writev request, then we leave ->bytes_done uninitialized and hence the -eventual failure CQE posted can potentially have a random res value -rather than the expected -EINVAL. - -Setup ->bytes_done before potentially failing, so we have a consistent -value if we fail the request early. - -Cc: stable@vger.kernel.org -Reported-by: xingwei lee <xrivendell7@gmail.com> -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - io_uring/rw.c | 10 +++++++--- - 1 file changed, 7 insertions(+), 3 deletions(-) - -diff --git a/io_uring/rw.c b/io_uring/rw.c -index 64390d4e20c1..743732fba7a4 100644 ---- a/io_uring/rw.c -+++ b/io_uring/rw.c -@@ -589,15 +589,19 @@ static inline int io_rw_prep_async(struct io_kiocb *req, int rw) - struct iovec *iov; - int ret; - -+ iorw->bytes_done = 0; -+ iorw->free_iovec = NULL; -+ - /* submission path, ->uring_lock should already be taken */ - ret = io_import_iovec(rw, req, &iov, &iorw->s, 0); - if (unlikely(ret < 0)) - return ret; - -- iorw->bytes_done = 0; -- iorw->free_iovec = iov; -- if (iov) -+ if (iov) { -+ iorw->free_iovec = iov; - req->flags |= REQ_F_NEED_CLEANUP; -+ } -+ - return 0; - } - --- -2.43.2 - -From 22eed91345095bd96839453b3c55beff1579de40 Mon Sep 17 00:00:00 2001 -From: Jens Axboe <axboe@kernel.dk> -Date: Thu, 4 Jan 2024 12:21:08 -0700 -Subject: [PATCH 0458/1501] io_uring: ensure local task_work is run on wait - timeout -Content-Length: 1960 -Lines: 52 - -commit 6ff1407e24e6fdfa4a16ba9ba551e3d253a26391 upstream. - -A previous commit added an earlier break condition here, which is fine if -we're using non-local task_work as it'll be run on return to userspace. -However, if DEFER_TASKRUN is used, then we could be leaving local -task_work that is ready to process in the ctx list until next time that -we enter the kernel to wait for events. - -Move the break condition to _after_ we have run task_work. - -Cc: stable@vger.kernel.org -Fixes: 846072f16eed ("io_uring: mimimise io_cqring_wait_schedule") -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - io_uring/io_uring.c | 14 ++++++++++++-- - 1 file changed, 12 insertions(+), 2 deletions(-) - -diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c -index 828d0975c270..7f62f5990152 100644 ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -2637,8 +2637,6 @@ static int io_cqring_wait(struct io_ring_ctx *ctx, int min_events, - __set_current_state(TASK_RUNNING); - atomic_set(&ctx->cq_wait_nr, 0); - -- if (ret < 0) -- break; - /* - * Run task_work after scheduling and before io_should_wake(). - * If we got woken because of task_work being processed, run it -@@ -2648,6 +2646,18 @@ static int io_cqring_wait(struct io_ring_ctx *ctx, int min_events, - if (!llist_empty(&ctx->work_llist)) - io_run_local_work(ctx); - -+ /* -+ * Non-local task_work will be run on exit to userspace, but -+ * if we're using DEFER_TASKRUN, then we could have waited -+ * with a timeout for a number of requests. If the timeout -+ * hits, we could have some requests ready to process. Ensure -+ * this break is _after_ we have run task_work, to avoid -+ * deferring running potentially pending requests until the -+ * next time we wait for events. -+ */ -+ if (ret < 0) -+ break; -+ - check_cq = READ_ONCE(ctx->check_cq); - if (unlikely(check_cq)) { - /* let the caller flush overflows, retry */ --- -2.43.2 - -From d4a48f53d92918430b572d633f2260be22871fbe Mon Sep 17 00:00:00 2001 -From: Thomas Zimmermann <tzimmermann@suse.de> -Date: Mon, 27 Nov 2023 14:15:30 +0100 -Subject: [PATCH 0459/1501] fbdev/acornfb: Fix name of fb_ops initializer macro -Content-Length: 1314 -Lines: 35 - -commit b48807788e7a2bd93044fe84cfe8ff64b85ec15e upstream. - -Fix build by using the correct name for the initializer macro -for struct fb_ops. - -Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> -Fixes: 9037afde8b9d ("fbdev/acornfb: Use fbdev I/O helpers") -Cc: Thomas Zimmermann <tzimmermann@suse.de> -Cc: Sam Ravnborg <sam@ravnborg.org> -Cc: Helge Deller <deller@gmx.de> -Cc: Javier Martinez Canillas <javierm@redhat.com> -Cc: Arnd Bergmann <arnd@arndb.de> -Cc: <stable@vger.kernel.org> # v6.6+ -Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20231127131655.4020-2-tzimmermann@suse.de -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/video/fbdev/acornfb.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/video/fbdev/acornfb.c b/drivers/video/fbdev/acornfb.c -index 163d2c9f951c..f0600f6ca254 100644 ---- a/drivers/video/fbdev/acornfb.c -+++ b/drivers/video/fbdev/acornfb.c -@@ -605,7 +605,7 @@ acornfb_pan_display(struct fb_var_screeninfo *var, struct fb_info *info) - - static const struct fb_ops acornfb_ops = { - .owner = THIS_MODULE, -- FB_IOMEM_DEFAULT_OPS, -+ FB_DEFAULT_IOMEM_OPS, - .fb_check_var = acornfb_check_var, - .fb_set_par = acornfb_set_par, - .fb_setcolreg = acornfb_setcolreg, --- -2.43.2 - -From 96136cf03ac6eef971d907dac6ec4b2c462529b7 Mon Sep 17 00:00:00 2001 -From: Nam Cao <namcao@linutronix.de> -Date: Mon, 18 Dec 2023 10:57:30 +0100 -Subject: [PATCH 0460/1501] fbdev: flush deferred work in - fb_deferred_io_fsync() -Content-Length: 2016 -Lines: 48 - -commit 15e4c1f462279b4e128f27de48133e0debe9e0df upstream. - -The driver's fsync() is supposed to flush any pending operation to -hardware. It is implemented in this driver by cancelling the queued -deferred IO first, then schedule it for "immediate execution" by calling -schedule_delayed_work() again with delay=0. However, setting delay=0 -only means the work is scheduled immediately, it does not mean the work -is executed immediately. There is no guarantee that the work is finished -after schedule_delayed_work() returns. After this driver's fsync() -returns, there can still be pending work. Furthermore, if close() is -called by users immediately after fsync(), the pending work gets -cancelled and fsync() may do nothing. - -To ensure that the deferred IO completes, use flush_delayed_work() -instead. Write operations to this driver either write to the device -directly, or invoke schedule_delayed_work(); so by flushing the -workqueue, it can be guaranteed that all previous writes make it to the -device. - -Fixes: 5e841b88d23d ("fb: fsync() method for deferred I/O flush.") -Cc: stable@vger.kernel.org -Signed-off-by: Nam Cao <namcao@linutronix.de> -Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> -Signed-off-by: Helge Deller <deller@gmx.de> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/video/fbdev/core/fb_defio.c | 6 +----- - 1 file changed, 1 insertion(+), 5 deletions(-) - -diff --git a/drivers/video/fbdev/core/fb_defio.c b/drivers/video/fbdev/core/fb_defio.c -index 274f5d0fa247..6c8b81c452f0 100644 ---- a/drivers/video/fbdev/core/fb_defio.c -+++ b/drivers/video/fbdev/core/fb_defio.c -@@ -132,11 +132,7 @@ int fb_deferred_io_fsync(struct file *file, loff_t start, loff_t end, int datasy - return 0; - - inode_lock(inode); -- /* Kill off the delayed work */ -- cancel_delayed_work_sync(&info->deferred_work); -- -- /* Run it immediately */ -- schedule_delayed_work(&info->deferred_work, 0); -+ flush_delayed_work(&info->deferred_work); - inode_unlock(inode); - - return 0; --- -2.43.2 - -From 21ba4f2543bdd30dac4b95b3a168ee0aa57092f0 Mon Sep 17 00:00:00 2001 -From: Nam Cao <namcao@linutronix.de> -Date: Mon, 18 Dec 2023 10:57:31 +0100 -Subject: [PATCH 0461/1501] fbdev: flush deferred IO before closing -Content-Length: 1756 -Lines: 43 - -commit 33cd6ea9c0673517cdb06ad5c915c6f22e9615fc upstream. - -When framebuffer gets closed, the queued deferred IO gets cancelled. This -can cause some last display data to vanish. This is problematic for users -who send a still image to the framebuffer, then close the file: the image -may never appear. - -To ensure none of display data get lost, flush the queued deferred IO -first before closing. - -Another possible solution is to delete the cancel_delayed_work_sync() -instead. The difference is that the display may appear some time after -closing. However, the clearing of page mapping after this needs to be -removed too, because the page mapping is used by the deferred work. It is -not completely obvious whether it is okay to not clear the page mapping. -For a patch intended for stable trees, go with the simple and obvious -solution. - -Fixes: 60b59beafba8 ("fbdev: mm: Deferred IO support") -Cc: stable@vger.kernel.org -Signed-off-by: Nam Cao <namcao@linutronix.de> -Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> -Signed-off-by: Helge Deller <deller@gmx.de> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/video/fbdev/core/fb_defio.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/video/fbdev/core/fb_defio.c b/drivers/video/fbdev/core/fb_defio.c -index 6c8b81c452f0..1ae1d35a5942 100644 ---- a/drivers/video/fbdev/core/fb_defio.c -+++ b/drivers/video/fbdev/core/fb_defio.c -@@ -313,7 +313,7 @@ static void fb_deferred_io_lastclose(struct fb_info *info) - struct page *page; - int i; - -- cancel_delayed_work_sync(&info->deferred_work); -+ flush_delayed_work(&info->deferred_work); - - /* clear out the mapping that we setup */ - for (i = 0 ; i < info->fix.smem_len; i += PAGE_SIZE) { --- -2.43.2 - -From ed92091e67ba63a8a81a89357ef9f7d92c9b68df Mon Sep 17 00:00:00 2001 -From: Bart Van Assche <bvanassche@acm.org> -Date: Mon, 18 Dec 2023 14:52:14 -0800 -Subject: [PATCH 0462/1501] scsi: ufs: core: Simplify power management during - async scan -Content-Length: 1666 -Lines: 51 - -commit daf7795406bf307997366f694888bd317ae5b5fa upstream. - -ufshcd_init() calls pm_runtime_get_sync() before it calls -async_schedule(). ufshcd_async_scan() calls pm_runtime_put_sync() directly -or indirectly from ufshcd_add_lus(). Simplify ufshcd_async_scan() by always -calling pm_runtime_put_sync() from ufshcd_async_scan(). - -Cc: <stable@vger.kernel.org> -Signed-off-by: Bart Van Assche <bvanassche@acm.org> -Link: https://lore.kernel.org/r/20231218225229.2542156-2-bvanassche@acm.org -Reviewed-by: Can Guo <quic_cang@quicinc.com> -Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/ufs/core/ufshcd.c | 7 +++---- - 1 file changed, 3 insertions(+), 4 deletions(-) - -diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c -index 16d76325039a..ce2f76769fb0 100644 ---- a/drivers/ufs/core/ufshcd.c -+++ b/drivers/ufs/core/ufshcd.c -@@ -8646,7 +8646,6 @@ static int ufshcd_add_lus(struct ufs_hba *hba) - - ufs_bsg_probe(hba); - scsi_scan_host(hba->host); -- pm_runtime_put_sync(hba->dev); - - out: - return ret; -@@ -8914,15 +8913,15 @@ static void ufshcd_async_scan(void *data, async_cookie_t cookie) - - /* Probe and add UFS logical units */ - ret = ufshcd_add_lus(hba); -+ - out: -+ pm_runtime_put_sync(hba->dev); - /* - * If we failed to initialize the device or the device is not - * present, turn off the power/clocks etc. - */ -- if (ret) { -- pm_runtime_put_sync(hba->dev); -+ if (ret) - ufshcd_hba_exit(hba); -- } - } - - static enum scsi_timeout_action ufshcd_eh_timed_out(struct scsi_cmnd *scmd) --- -2.43.2 - -From 9d188ec5c3393c094497dad680a161647815f730 Mon Sep 17 00:00:00 2001 -From: Amir Goldstein <amir73il@gmail.com> -Date: Thu, 23 Nov 2023 11:20:00 +0200 -Subject: [PATCH 0463/1501] scsi: target: core: add missing - file_{start,end}_write() -Content-Length: 2002 -Lines: 57 - -commit 0db1d53937fafa8bb96e077375691e16902f4899 upstream. - -The callers of vfs_iter_write() are required to hold file_start_write(). -file_start_write() is a no-op for the S_ISBLK() case, but it is really -needed when the backing file is a regular file. - -We are going to move file_{start,end}_write() into vfs_iter_write(), but -we need to fix this first, so that the fix could be backported to stable -kernels. - -Suggested-by: Christoph Hellwig <hch@lst.de> -Link: https://lore.kernel.org/r/ZV8ETIpM+wZa33B5@infradead.org/ -Cc: <stable@vger.kernel.org> -Signed-off-by: Amir Goldstein <amir73il@gmail.com> -Link: https://lore.kernel.org/r/20231123092000.2665902-1-amir73il@gmail.com -Acked-by: Martin K. Petersen <martin.petersen@oracle.com> -Reviewed-by: Christoph Hellwig <hch@lst.de> -Reviewed-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Christian Brauner <brauner@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/target/target_core_file.c | 10 +++++++--- - 1 file changed, 7 insertions(+), 3 deletions(-) - -diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c -index 4d447520bab8..4e4cf6c34a77 100644 ---- a/drivers/target/target_core_file.c -+++ b/drivers/target/target_core_file.c -@@ -332,11 +332,13 @@ static int fd_do_rw(struct se_cmd *cmd, struct file *fd, - } - - iov_iter_bvec(&iter, is_write, bvec, sgl_nents, len); -- if (is_write) -+ if (is_write) { -+ file_start_write(fd); - ret = vfs_iter_write(fd, &iter, &pos, 0); -- else -+ file_end_write(fd); -+ } else { - ret = vfs_iter_read(fd, &iter, &pos, 0); -- -+ } - if (is_write) { - if (ret < 0 || ret != data_length) { - pr_err("%s() write returned %d\n", __func__, ret); -@@ -467,7 +469,9 @@ fd_execute_write_same(struct se_cmd *cmd) - } - - iov_iter_bvec(&iter, ITER_SOURCE, bvec, nolb, len); -+ file_start_write(fd_dev->fd_file); - ret = vfs_iter_write(fd_dev->fd_file, &iter, &pos, 0); -+ file_end_write(fd_dev->fd_file); - - kfree(bvec); - if (ret < 0 || ret != len) { --- -2.43.2 - -From 5fe459fbca75ef94aac01c10a682182b34a0d02e Mon Sep 17 00:00:00 2001 -From: Chandrakanth patil <chandrakanth.patil@broadcom.com> -Date: Sun, 26 Nov 2023 11:01:31 +0530 -Subject: [PATCH 0464/1501] scsi: mpi3mr: Refresh sdev queue depth after - controller reset -Content-Length: 1528 -Lines: 39 - -commit e5aab848dfdf7996d20ece4d28d2733c732c5e5a upstream. - -After a controller reset, the firmware may modify the device queue depth. -Therefore, update the device queue depth accordingly. - -Cc: <stable@vger.kernel.org> # v5.15+ -Co-developed-by: Sathya Prakash <sathya.prakash@broadcom.com> -Signed-off-by: Sathya Prakash <sathya.prakash@broadcom.com> -Signed-off-by: Chandrakanth patil <chandrakanth.patil@broadcom.com> -Link: https://lore.kernel.org/r/20231126053134.10133-2-chandrakanth.patil@broadcom.com -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/scsi/mpi3mr/mpi3mr_os.c | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - -diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c -index 040031eb0c12..bdc29567f292 100644 ---- a/drivers/scsi/mpi3mr/mpi3mr_os.c -+++ b/drivers/scsi/mpi3mr/mpi3mr_os.c -@@ -1070,8 +1070,14 @@ void mpi3mr_rfresh_tgtdevs(struct mpi3mr_ioc *mrioc) - tgtdev = NULL; - list_for_each_entry(tgtdev, &mrioc->tgtdev_list, list) { - if ((tgtdev->dev_handle != MPI3MR_INVALID_DEV_HANDLE) && -- !tgtdev->is_hidden && !tgtdev->host_exposed) -- mpi3mr_report_tgtdev_to_host(mrioc, tgtdev->perst_id); -+ !tgtdev->is_hidden) { -+ if (!tgtdev->host_exposed) -+ mpi3mr_report_tgtdev_to_host(mrioc, -+ tgtdev->perst_id); -+ else if (tgtdev->starget) -+ starget_for_each_device(tgtdev->starget, -+ (void *)tgtdev, mpi3mr_update_sdev); -+ } - } - } - --- -2.43.2 - -From 28804a6ec6f0863ddea9fb0b471982763d1161c1 Mon Sep 17 00:00:00 2001 -From: Chandrakanth patil <chandrakanth.patil@broadcom.com> -Date: Sun, 26 Nov 2023 11:01:32 +0530 -Subject: [PATCH 0465/1501] scsi: mpi3mr: Clean up block devices post - controller reset -Content-Length: 1892 -Lines: 45 - -commit c01d515687e358b22aa8414d6dac60d7defa6eb9 upstream. - -After a controller reset, if the firmware changes the state of devices to -"hide", then remove those devices from the OS. - -Cc: <stable@vger.kernel.org> # v6.6+ -Co-developed-by: Sathya Prakash <sathya.prakash@broadcom.com> -Signed-off-by: Sathya Prakash <sathya.prakash@broadcom.com> -Signed-off-by: Chandrakanth patil <chandrakanth.patil@broadcom.com> -Link: https://lore.kernel.org/r/20231126053134.10133-3-chandrakanth.patil@broadcom.com -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/scsi/mpi3mr/mpi3mr_os.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - -diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c -index bdc29567f292..e2f2c205df71 100644 ---- a/drivers/scsi/mpi3mr/mpi3mr_os.c -+++ b/drivers/scsi/mpi3mr/mpi3mr_os.c -@@ -1047,8 +1047,9 @@ void mpi3mr_rfresh_tgtdevs(struct mpi3mr_ioc *mrioc) - list_for_each_entry_safe(tgtdev, tgtdev_next, &mrioc->tgtdev_list, - list) { - if ((tgtdev->dev_handle == MPI3MR_INVALID_DEV_HANDLE) && -- tgtdev->host_exposed && tgtdev->starget && -- tgtdev->starget->hostdata) { -+ tgtdev->is_hidden && -+ tgtdev->host_exposed && tgtdev->starget && -+ tgtdev->starget->hostdata) { - tgt_priv = tgtdev->starget->hostdata; - tgt_priv->dev_removed = 1; - atomic_set(&tgt_priv->block_io, 0); -@@ -1064,6 +1065,10 @@ void mpi3mr_rfresh_tgtdevs(struct mpi3mr_ioc *mrioc) - mpi3mr_remove_tgtdev_from_host(mrioc, tgtdev); - mpi3mr_tgtdev_del_from_list(mrioc, tgtdev, true); - mpi3mr_tgtdev_put(tgtdev); -+ } else if (tgtdev->is_hidden & tgtdev->host_exposed) { -+ dprint_reset(mrioc, "hiding target device with perst_id(%d)\n", -+ tgtdev->perst_id); -+ mpi3mr_remove_tgtdev_from_host(mrioc, tgtdev); - } - } - --- -2.43.2 - -From 997348517edb0c3b431a06293d88f2bc50434c24 Mon Sep 17 00:00:00 2001 -From: Chandrakanth patil <chandrakanth.patil@broadcom.com> -Date: Sun, 26 Nov 2023 11:01:33 +0530 -Subject: [PATCH 0466/1501] scsi: mpi3mr: Block PEL Enable Command on - Controller Reset and Unrecoverable State -Content-Length: 1558 -Lines: 46 - -commit f8fb3f39148e8010479e4b2003ba4728818ec661 upstream. - -If a controller reset is underway or the controller is in an unrecoverable -state, the PEL enable management command will be returned as EAGAIN or -EFAULT. - -Cc: <stable@vger.kernel.org> # v6.1+ -Co-developed-by: Sathya Prakash <sathya.prakash@broadcom.com> -Signed-off-by: Sathya Prakash <sathya.prakash@broadcom.com> -Signed-off-by: Chandrakanth patil <chandrakanth.patil@broadcom.com> -Link: https://lore.kernel.org/r/20231126053134.10133-4-chandrakanth.patil@broadcom.com -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/scsi/mpi3mr/mpi3mr_app.c | 16 ++++++++++++++++ - 1 file changed, 16 insertions(+) - -diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c -index 08645a99ad6b..9dacbb8570c9 100644 ---- a/drivers/scsi/mpi3mr/mpi3mr_app.c -+++ b/drivers/scsi/mpi3mr/mpi3mr_app.c -@@ -223,6 +223,22 @@ static long mpi3mr_bsg_pel_enable(struct mpi3mr_ioc *mrioc, - return rval; - } - -+ if (mrioc->unrecoverable) { -+ dprint_bsg_err(mrioc, "%s: unrecoverable controller\n", -+ __func__); -+ return -EFAULT; -+ } -+ -+ if (mrioc->reset_in_progress) { -+ dprint_bsg_err(mrioc, "%s: reset in progress\n", __func__); -+ return -EAGAIN; -+ } -+ -+ if (mrioc->stop_bsgs) { -+ dprint_bsg_err(mrioc, "%s: bsgs are blocked\n", __func__); -+ return -EAGAIN; -+ } -+ - sg_copy_to_buffer(job->request_payload.sg_list, - job->request_payload.sg_cnt, - &pel_enable, sizeof(pel_enable)); --- -2.43.2 - -From 11a74717dc50730fdc752e325b301cd2baa60030 Mon Sep 17 00:00:00 2001 -From: Yu Kuai <yukuai3@huawei.com> -Date: Tue, 9 Jan 2024 21:39:57 +0800 -Subject: [PATCH 0467/1501] md: Fix md_seq_ops() regressions -Content-Length: 3338 -Lines: 111 - -commit f9cfe7e7f96a9414a17d596e288693c4f2325d49 upstream. - -Commit cf1b6d4441ff ("md: simplify md_seq_ops") introduce following -regressions: - -1) If list all_mddevs is emptly, personalities and unused devices won't - be showed to user anymore. -2) If seq_file buffer overflowed from md_seq_show(), then md_seq_start() - will be called again, hence personalities will be showed to user - again. -3) If seq_file buffer overflowed from md_seq_stop(), seq_read_iter() - doesn't handle this, hence unused devices won't be showed to user. - -Fix above problems by printing personalities and unused devices in -md_seq_show(). - -Fixes: cf1b6d4441ff ("md: simplify md_seq_ops") -Cc: stable@vger.kernel.org # v6.7+ -Signed-off-by: Yu Kuai <yukuai3@huawei.com> -Signed-off-by: Song Liu <song@kernel.org> -Link: https://lore.kernel.org/r/20240109133957.2975272-1-yukuai1@huaweicloud.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/md/md.c | 40 +++++++++++++++++++++++++++------------- - 1 file changed, 27 insertions(+), 13 deletions(-) - -diff --git a/drivers/md/md.c b/drivers/md/md.c -index f246bb0932b0..22b54788bcea 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -8122,6 +8122,19 @@ static void status_unused(struct seq_file *seq) - seq_printf(seq, "\n"); - } - -+static void status_personalities(struct seq_file *seq) -+{ -+ struct md_personality *pers; -+ -+ seq_puts(seq, "Personalities : "); -+ spin_lock(&pers_lock); -+ list_for_each_entry(pers, &pers_list, list) -+ seq_printf(seq, "[%s] ", pers->name); -+ -+ spin_unlock(&pers_lock); -+ seq_puts(seq, "\n"); -+} -+ - static int status_resync(struct seq_file *seq, struct mddev *mddev) - { - sector_t max_sectors, resync, res; -@@ -8263,20 +8276,10 @@ static int status_resync(struct seq_file *seq, struct mddev *mddev) - static void *md_seq_start(struct seq_file *seq, loff_t *pos) - __acquires(&all_mddevs_lock) - { -- struct md_personality *pers; -- -- seq_puts(seq, "Personalities : "); -- spin_lock(&pers_lock); -- list_for_each_entry(pers, &pers_list, list) -- seq_printf(seq, "[%s] ", pers->name); -- -- spin_unlock(&pers_lock); -- seq_puts(seq, "\n"); - seq->poll_event = atomic_read(&md_event_count); -- - spin_lock(&all_mddevs_lock); - -- return seq_list_start(&all_mddevs, *pos); -+ return seq_list_start_head(&all_mddevs, *pos); - } - - static void *md_seq_next(struct seq_file *seq, void *v, loff_t *pos) -@@ -8287,16 +8290,23 @@ static void *md_seq_next(struct seq_file *seq, void *v, loff_t *pos) - static void md_seq_stop(struct seq_file *seq, void *v) - __releases(&all_mddevs_lock) - { -- status_unused(seq); - spin_unlock(&all_mddevs_lock); - } - - static int md_seq_show(struct seq_file *seq, void *v) - { -- struct mddev *mddev = list_entry(v, struct mddev, all_mddevs); -+ struct mddev *mddev; - sector_t sectors; - struct md_rdev *rdev; - -+ if (v == &all_mddevs) { -+ status_personalities(seq); -+ if (list_empty(&all_mddevs)) -+ status_unused(seq); -+ return 0; -+ } -+ -+ mddev = list_entry(v, struct mddev, all_mddevs); - if (!mddev_get(mddev)) - return 0; - -@@ -8372,6 +8382,10 @@ static int md_seq_show(struct seq_file *seq, void *v) - } - spin_unlock(&mddev->lock); - spin_lock(&all_mddevs_lock); -+ -+ if (mddev == list_last_entry(&all_mddevs, struct mddev, all_mddevs)) -+ status_unused(seq); -+ - if (atomic_dec_and_test(&mddev->active)) - __mddev_put(mddev); - --- -2.43.2 - -From 05f7a3475af0faa8bf77f8637c4a40349db4f78f Mon Sep 17 00:00:00 2001 -From: Mario Limonciello <mario.limonciello@amd.com> -Date: Fri, 24 Nov 2023 09:56:32 -0600 -Subject: [PATCH 0468/1501] drm/amd: Enable PCIe PME from D3 -Content-Length: 1133 -Lines: 33 - -commit bd1f6a31e7762ebc99b97f3eda5e5ea3708fa792 upstream. - -When dGPU is put into BOCO it may be in D3cold but still able send -PME on display hotplug event. For this to work it must be enabled -as wake source from D3. - -When runpm is enabled use pci_wake_from_d3() to mark wakeup as -enabled by default. - -Cc: stable@vger.kernel.org # 6.1+ -Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> -Acked-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -index 8b33b130ea36..76084802426e 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -@@ -2265,6 +2265,8 @@ static int amdgpu_pci_probe(struct pci_dev *pdev, - - pci_wake_from_d3(pdev, TRUE); - -+ pci_wake_from_d3(pdev, TRUE); -+ - /* - * For runpm implemented via BACO, PMFW will handle the - * timing for BACO in and out: --- -2.43.2 - -From bcdc288e7bc008daf38ef0401b53e4a8bb61bbe5 Mon Sep 17 00:00:00 2001 -From: Min Li <min15.li@samsung.com> -Date: Thu, 29 Jun 2023 14:25:17 +0000 -Subject: [PATCH 0469/1501] block: add check that partition length needs to be - aligned with block size -Content-Length: 2270 -Lines: 59 - -commit 6f64f866aa1ae6975c95d805ed51d7e9433a0016 upstream. - -Before calling add partition or resize partition, there is no check -on whether the length is aligned with the logical block size. -If the logical block size of the disk is larger than 512 bytes, -then the partition size maybe not the multiple of the logical block size, -and when the last sector is read, bio_truncate() will adjust the bio size, -resulting in an IO error if the size of the read command is smaller than -the logical block size.If integrity data is supported, this will also -result in a null pointer dereference when calling bio_integrity_free. - -Cc: <stable@vger.kernel.org> -Signed-off-by: Min Li <min15.li@samsung.com> -Reviewed-by: Damien Le Moal <dlemoal@kernel.org> -Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> -Reviewed-by: Christoph Hellwig <hch@lst.de> -Link: https://lore.kernel.org/r/20230629142517.121241-1-min15.li@samsung.com -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - block/ioctl.c | 11 +++++++---- - 1 file changed, 7 insertions(+), 4 deletions(-) - -diff --git a/block/ioctl.c b/block/ioctl.c -index 4160f4e6bd5b..9c73a763ef88 100644 ---- a/block/ioctl.c -+++ b/block/ioctl.c -@@ -18,7 +18,7 @@ static int blkpg_do_ioctl(struct block_device *bdev, - { - struct gendisk *disk = bdev->bd_disk; - struct blkpg_partition p; -- long long start, length; -+ sector_t start, length; - - if (disk->flags & GENHD_FL_NO_PART) - return -EINVAL; -@@ -35,14 +35,17 @@ static int blkpg_do_ioctl(struct block_device *bdev, - if (op == BLKPG_DEL_PARTITION) - return bdev_del_partition(disk, p.pno); - -+ if (p.start < 0 || p.length <= 0 || p.start + p.length < 0) -+ return -EINVAL; -+ /* Check that the partition is aligned to the block size */ -+ if (!IS_ALIGNED(p.start | p.length, bdev_logical_block_size(bdev))) -+ return -EINVAL; -+ - start = p.start >> SECTOR_SHIFT; - length = p.length >> SECTOR_SHIFT; - - switch (op) { - case BLKPG_ADD_PARTITION: -- /* check if partition is aligned to blocksize */ -- if (p.start & (bdev_logical_block_size(bdev) - 1)) -- return -EINVAL; - return bdev_add_partition(disk, p.pno, start, length); - case BLKPG_RESIZE_PARTITION: - return bdev_resize_partition(disk, p.pno, start, length); --- -2.43.2 - -From d198c15d181cc9d580f0f2c25150b077d1d49c1a Mon Sep 17 00:00:00 2001 -From: "Matthew Wilcox (Oracle)" <willy@infradead.org> -Date: Mon, 14 Aug 2023 15:41:00 +0100 -Subject: [PATCH 0470/1501] block: Remove special-casing of compound pages -Content-Length: 4808 -Lines: 131 - -commit 1b151e2435fc3a9b10c8946c6aebe9f3e1938c55 upstream. - -The special casing was originally added in pre-git history; reproducing -the commit log here: - -> commit a318a92567d77 -> Author: Andrew Morton <akpm@osdl.org> -> Date: Sun Sep 21 01:42:22 2003 -0700 -> -> [PATCH] Speed up direct-io hugetlbpage handling -> -> This patch short-circuits all the direct-io page dirtying logic for -> higher-order pages. Without this, we pointlessly bounce BIOs up to -> keventd all the time. - -In the last twenty years, compound pages have become used for more than -just hugetlb. Rewrite these functions to operate on folios instead -of pages and remove the special case for hugetlbfs; I don't think -it's needed any more (and if it is, we can put it back in as a call -to folio_test_hugetlb()). - -This was found by inspection; as far as I can tell, this bug can lead -to pages used as the destination of a direct I/O read not being marked -as dirty. If those pages are then reclaimed by the MM without being -dirtied for some other reason, they won't be written out. Then when -they're faulted back in, they will not contain the data they should. -It'll take a pretty unusual setup to produce this problem with several -races all going the wrong way. - -This problem predates the folio work; it could for example have been -triggered by mmaping a THP in tmpfs and using that as the target of an -O_DIRECT read. - -Fixes: 800d8c63b2e98 ("shmem: add huge pages support") -Cc: <stable@vger.kernel.org> -Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - block/bio.c | 46 ++++++++++++++++++++++++---------------------- - 1 file changed, 24 insertions(+), 22 deletions(-) - -diff --git a/block/bio.c b/block/bio.c -index 816d412c06e9..5eba53ca953b 100644 ---- a/block/bio.c -+++ b/block/bio.c -@@ -1145,13 +1145,22 @@ EXPORT_SYMBOL(bio_add_folio); - - void __bio_release_pages(struct bio *bio, bool mark_dirty) - { -- struct bvec_iter_all iter_all; -- struct bio_vec *bvec; -+ struct folio_iter fi; - -- bio_for_each_segment_all(bvec, bio, iter_all) { -- if (mark_dirty && !PageCompound(bvec->bv_page)) -- set_page_dirty_lock(bvec->bv_page); -- bio_release_page(bio, bvec->bv_page); -+ bio_for_each_folio_all(fi, bio) { -+ struct page *page; -+ size_t done = 0; -+ -+ if (mark_dirty) { -+ folio_lock(fi.folio); -+ folio_mark_dirty(fi.folio); -+ folio_unlock(fi.folio); -+ } -+ page = folio_page(fi.folio, fi.offset / PAGE_SIZE); -+ do { -+ bio_release_page(bio, page++); -+ done += PAGE_SIZE; -+ } while (done < fi.length); - } - } - EXPORT_SYMBOL_GPL(__bio_release_pages); -@@ -1439,18 +1448,12 @@ EXPORT_SYMBOL(bio_free_pages); - * bio_set_pages_dirty() and bio_check_pages_dirty() are support functions - * for performing direct-IO in BIOs. - * -- * The problem is that we cannot run set_page_dirty() from interrupt context -+ * The problem is that we cannot run folio_mark_dirty() from interrupt context - * because the required locks are not interrupt-safe. So what we can do is to - * mark the pages dirty _before_ performing IO. And in interrupt context, - * check that the pages are still dirty. If so, fine. If not, redirty them - * in process context. - * -- * We special-case compound pages here: normally this means reads into hugetlb -- * pages. The logic in here doesn't really work right for compound pages -- * because the VM does not uniformly chase down the head page in all cases. -- * But dirtiness of compound pages is pretty meaningless anyway: the VM doesn't -- * handle them at all. So we skip compound pages here at an early stage. -- * - * Note that this code is very hard to test under normal circumstances because - * direct-io pins the pages with get_user_pages(). This makes - * is_page_cache_freeable return false, and the VM will not clean the pages. -@@ -1466,12 +1469,12 @@ EXPORT_SYMBOL(bio_free_pages); - */ - void bio_set_pages_dirty(struct bio *bio) - { -- struct bio_vec *bvec; -- struct bvec_iter_all iter_all; -+ struct folio_iter fi; - -- bio_for_each_segment_all(bvec, bio, iter_all) { -- if (!PageCompound(bvec->bv_page)) -- set_page_dirty_lock(bvec->bv_page); -+ bio_for_each_folio_all(fi, bio) { -+ folio_lock(fi.folio); -+ folio_mark_dirty(fi.folio); -+ folio_unlock(fi.folio); - } - } - EXPORT_SYMBOL_GPL(bio_set_pages_dirty); -@@ -1515,12 +1518,11 @@ static void bio_dirty_fn(struct work_struct *work) - - void bio_check_pages_dirty(struct bio *bio) - { -- struct bio_vec *bvec; -+ struct folio_iter fi; - unsigned long flags; -- struct bvec_iter_all iter_all; - -- bio_for_each_segment_all(bvec, bio, iter_all) { -- if (!PageDirty(bvec->bv_page) && !PageCompound(bvec->bv_page)) -+ bio_for_each_folio_all(fi, bio) { -+ if (!folio_test_dirty(fi.folio)) - goto defer; - } - --- -2.43.2 - -From ca3ede3f5893e2d26d4dbdef1eec28a8487fafde Mon Sep 17 00:00:00 2001 -From: "Matthew Wilcox (Oracle)" <willy@infradead.org> -Date: Tue, 16 Jan 2024 21:29:59 +0000 -Subject: [PATCH 0471/1501] block: Fix iterating over an empty bio with - bio_for_each_folio_all -Content-Length: 1737 -Lines: 49 - -commit 7bed6f3d08b7af27b7015da8dc3acf2b9c1f21d7 upstream. - -If the bio contains no data, bio_first_folio() calls page_folio() on a -NULL pointer and oopses. Move the test that we've reached the end of -the bio from bio_next_folio() to bio_first_folio(). - -Reported-by: syzbot+8b23309d5788a79d3eea@syzkaller.appspotmail.com -Reported-by: syzbot+004c1e0fced2b4bc3dcc@syzkaller.appspotmail.com -Fixes: 640d1930bef4 ("block: Add bio_for_each_folio_all()") -Cc: stable@vger.kernel.org -Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> -Link: https://lore.kernel.org/r/20240116212959.3413014-1-willy@infradead.org -[axboe: add unlikely() to error case] -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - include/linux/bio.h | 9 ++++++--- - 1 file changed, 6 insertions(+), 3 deletions(-) - -diff --git a/include/linux/bio.h b/include/linux/bio.h -index 41d417ee1349..0286bada25ce 100644 ---- a/include/linux/bio.h -+++ b/include/linux/bio.h -@@ -286,6 +286,11 @@ static inline void bio_first_folio(struct folio_iter *fi, struct bio *bio, - { - struct bio_vec *bvec = bio_first_bvec_all(bio) + i; - -+ if (unlikely(i >= bio->bi_vcnt)) { -+ fi->folio = NULL; -+ return; -+ } -+ - fi->folio = page_folio(bvec->bv_page); - fi->offset = bvec->bv_offset + - PAGE_SIZE * (bvec->bv_page - &fi->folio->page); -@@ -303,10 +308,8 @@ static inline void bio_next_folio(struct folio_iter *fi, struct bio *bio) - fi->offset = 0; - fi->length = min(folio_size(fi->folio), fi->_seg_count); - fi->_next = folio_next(fi->folio); -- } else if (fi->_i + 1 < bio->bi_vcnt) { -- bio_first_folio(fi, bio, fi->_i + 1); - } else { -- fi->folio = NULL; -+ bio_first_folio(fi, bio, fi->_i + 1); - } - } - --- -2.43.2 - -From 7e0f5f8ae3e5f17e367f7040ade7a467f1f0e3b9 Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso <pablo@netfilter.org> -Date: Fri, 12 Jan 2024 23:28:45 +0100 -Subject: [PATCH 0472/1501] netfilter: nf_tables: check if catch-all set - element is active in next generation -Content-Length: 1189 -Lines: 32 - -commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7 upstream. - -When deactivating the catch-all set element, check the state in the next -generation that represents this transaction. - -This bug uncovered after the recent removal of the element busy mark -a2dd0233cbc4 ("netfilter: nf_tables: remove busy mark and gc batch API"). - -Fixes: aaa31047a6d2 ("netfilter: nftables: add catch-all set element support") -Cc: stable@vger.kernel.org -Reported-by: lonial con <kongln9170@gmail.com> -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - net/netfilter/nf_tables_api.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index d5f76e26ae03..5e7994898c76 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -6487,7 +6487,7 @@ static int nft_setelem_catchall_deactivate(const struct net *net, - - list_for_each_entry(catchall, &set->catchall_list, list) { - ext = nft_set_elem_ext(set, catchall->elem); -- if (!nft_is_active(net, ext)) -+ if (!nft_is_active_next(net, ext)) - continue; - - kfree(elem->priv); --- -2.43.2 - -From 1ba16fa9a6f8a50a9b20f9d66c1c503600c37ec2 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de> -Date: Sat, 6 Jan 2024 15:13:03 +0100 -Subject: [PATCH 0473/1501] pwm: jz4740: Don't use dev_err_probe() in - .request() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1545 -Lines: 41 - -commit 9320fc509b87b4d795fb37112931e2f4f8b5c55f upstream. - -dev_err_probe() is only supposed to be used in probe functions. While it -probably doesn't hurt, both the EPROBE_DEFER handling and calling -device_set_deferred_probe_reason() are conceptually wrong in the request -callback. So replace the call by dev_err() and a separate return -statement. - -This effectively reverts commit c0bfe9606e03 ("pwm: jz4740: Simplify -with dev_err_probe()"). - -Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> -Link: https://lore.kernel.org/r/20240106141302.1253365-2-u.kleine-koenig@pengutronix.de -Fixes: c0bfe9606e03 ("pwm: jz4740: Simplify with dev_err_probe()") -Cc: stable@vger.kernel.org -Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/pwm/pwm-jz4740.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/drivers/pwm/pwm-jz4740.c b/drivers/pwm/pwm-jz4740.c -index e9375de60ad6..d0a0406b24f4 100644 ---- a/drivers/pwm/pwm-jz4740.c -+++ b/drivers/pwm/pwm-jz4740.c -@@ -61,9 +61,10 @@ static int jz4740_pwm_request(struct pwm_chip *chip, struct pwm_device *pwm) - snprintf(name, sizeof(name), "timer%u", pwm->hwpwm); - - clk = clk_get(chip->dev, name); -- if (IS_ERR(clk)) -- return dev_err_probe(chip->dev, PTR_ERR(clk), -- "Failed to get clock\n"); -+ if (IS_ERR(clk)) { -+ dev_err(chip->dev, "error %pe: Failed to get clock\n", clk); -+ return PTR_ERR(clk); -+ } - - err = clk_prepare_enable(clk); - if (err < 0) { --- -2.43.2 - -From bae45b7ebb31984b63b13c3519fd724b3ce92123 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de> -Date: Tue, 9 Jan 2024 22:34:31 +0100 -Subject: [PATCH 0474/1501] pwm: Fix out-of-bounds access in - of_pwm_single_xlate() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1128 -Lines: 29 - -commit a297d07b9a1e4fb8cda25a4a2363a507d294b7c9 upstream. - -With args->args_count == 2 args->args[2] is not defined. Actually the -flags are contained in args->args[1]. - -Fixes: 3ab7b6ac5d82 ("pwm: Introduce single-PWM of_xlate function") -Cc: stable@vger.kernel.org -Link: https://lore.kernel.org/r/243908750d306e018a3d4bf2eb745d53ab50f663.1704835845.git.u.kleine-koenig@pengutronix.de -Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/pwm/core.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c -index 29078486534d..59c44a5584e6 100644 ---- a/drivers/pwm/core.c -+++ b/drivers/pwm/core.c -@@ -176,7 +176,7 @@ of_pwm_single_xlate(struct pwm_chip *chip, const struct of_phandle_args *args) - pwm->args.period = args->args[0]; - pwm->args.polarity = PWM_POLARITY_NORMAL; - -- if (args->args_count == 2 && args->args[2] & PWM_POLARITY_INVERTED) -+ if (args->args_count == 2 && args->args[1] & PWM_POLARITY_INVERTED) - pwm->args.polarity = PWM_POLARITY_INVERSED; - - return pwm; --- -2.43.2 - -From 70ed3daa2f06170452380fa99f16d2747ad5938f Mon Sep 17 00:00:00 2001 -From: Bart Van Assche <bvanassche@acm.org> -Date: Sun, 7 Jan 2024 16:12:23 -0800 -Subject: [PATCH 0475/1501] md/raid1: Use blk_opf_t for read and write - operations -Content-Length: 2968 -Lines: 81 - -commit 7dab24554dedd4e6f408af8eb2d25c89997a6a1f upstream. - -Use the type blk_opf_t for read and write operations instead of int. This -patch does not affect the generated code but fixes the following sparse -warning: - -drivers/md/raid1.c:1993:60: sparse: sparse: incorrect type in argument 5 (different base types) - expected restricted blk_opf_t [usertype] opf - got int rw - -Cc: Song Liu <song@kernel.org> -Cc: Jens Axboe <axboe@kernel.dk> -Fixes: 3c5e514db58f ("md/raid1: Use the new blk_opf_t type") -Cc: stable@vger.kernel.org # v6.0+ -Reported-by: kernel test robot <lkp@intel.com> -Closes: https://lore.kernel.org/oe-kbuild-all/202401080657.UjFnvQgX-lkp@intel.com/ -Signed-off-by: Bart Van Assche <bvanassche@acm.org> -Signed-off-by: Song Liu <song@kernel.org> -Link: https://lore.kernel.org/r/20240108001223.23835-1-bvanassche@acm.org -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/md/raid1.c | 12 ++++++------ - 1 file changed, 6 insertions(+), 6 deletions(-) - -diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index 35d12948e0a9..e138922d5129 100644 ---- a/drivers/md/raid1.c -+++ b/drivers/md/raid1.c -@@ -1984,12 +1984,12 @@ static void end_sync_write(struct bio *bio) - } - - static int r1_sync_page_io(struct md_rdev *rdev, sector_t sector, -- int sectors, struct page *page, int rw) -+ int sectors, struct page *page, blk_opf_t rw) - { - if (sync_page_io(rdev, sector, sectors << 9, page, rw, false)) - /* success */ - return 1; -- if (rw == WRITE) { -+ if (rw == REQ_OP_WRITE) { - set_bit(WriteErrorSeen, &rdev->flags); - if (!test_and_set_bit(WantReplacement, - &rdev->flags)) -@@ -2106,7 +2106,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio) - rdev = conf->mirrors[d].rdev; - if (r1_sync_page_io(rdev, sect, s, - pages[idx], -- WRITE) == 0) { -+ REQ_OP_WRITE) == 0) { - r1_bio->bios[d]->bi_end_io = NULL; - rdev_dec_pending(rdev, mddev); - } -@@ -2121,7 +2121,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio) - rdev = conf->mirrors[d].rdev; - if (r1_sync_page_io(rdev, sect, s, - pages[idx], -- READ) != 0) -+ REQ_OP_READ) != 0) - atomic_add(s, &rdev->corrected_errors); - } - sectors -= s; -@@ -2333,7 +2333,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk, - atomic_inc(&rdev->nr_pending); - rcu_read_unlock(); - r1_sync_page_io(rdev, sect, s, -- conf->tmppage, WRITE); -+ conf->tmppage, REQ_OP_WRITE); - rdev_dec_pending(rdev, mddev); - } else - rcu_read_unlock(); -@@ -2350,7 +2350,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk, - atomic_inc(&rdev->nr_pending); - rcu_read_unlock(); - if (r1_sync_page_io(rdev, sect, s, -- conf->tmppage, READ)) { -+ conf->tmppage, REQ_OP_READ)) { - atomic_add(s, &rdev->corrected_errors); - pr_info("md/raid1:%s: read error corrected (%d sectors at %llu on %pg)\n", - mdname(mddev), s, --- -2.43.2 - -From 0401e47e039b6d98f9efe23780fca920fdf8f53e Mon Sep 17 00:00:00 2001 -From: Stefan Berger <stefanb@linux.ibm.com> -Date: Sun, 19 Nov 2023 20:12:48 -0500 -Subject: [PATCH 0476/1501] rootfs: Fix support for rootfstype= when root= is - given -Content-Length: 2472 -Lines: 67 - -commit 21528c69a0d8483f7c6345b1a0bc8d8975e9a172 upstream. - -Documentation/filesystems/ramfs-rootfs-initramfs.rst states: - - If CONFIG_TMPFS is enabled, rootfs will use tmpfs instead of ramfs by - default. To force ramfs, add "rootfstype=ramfs" to the kernel command - line. - -This currently does not work when root= is provided since then -saved_root_name contains a string and rootfstype= is ignored. Therefore, -ramfs is currently always chosen when root= is provided. - -The current behavior for rootfs's filesystem is: - - root= | rootfstype= | chosen rootfs filesystem - ------------+-------------+-------------------------- - unspecified | unspecified | tmpfs - unspecified | tmpfs | tmpfs - unspecified | ramfs | ramfs - provided | ignored | ramfs - -rootfstype= should be respected regardless whether root= is given, -as shown below: - - root= | rootfstype= | chosen rootfs filesystem - ------------+-------------+-------------------------- - unspecified | unspecified | tmpfs (as before) - unspecified | tmpfs | tmpfs (as before) - unspecified | ramfs | ramfs (as before) - provided | unspecified | ramfs (compatibility with before) - provided | tmpfs | tmpfs (new) - provided | ramfs | ramfs (new) - -This table represents the new behavior. - -Fixes: 6e19eded3684 ("initmpfs: use initramfs if rootfstype= or root= specified") -Cc: <stable@vger.kernel.org> -Signed-off-by: Rob Landley <rob@landley.net> -Link: https://lore.kernel.org/lkml/8244c75f-445e-b15b-9dbf-266e7ca666e2@landley.net/ -Reviewed-and-Tested-by: Mimi Zohar <zohar@linux.ibm.com> -Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> -Link: https://lore.kernel.org/r/20231120011248.396012-1-stefanb@linux.ibm.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - init/do_mounts.c | 9 ++++++--- - 1 file changed, 6 insertions(+), 3 deletions(-) - -diff --git a/init/do_mounts.c b/init/do_mounts.c -index 5fdef94f0864..279ad28bf4fb 100644 ---- a/init/do_mounts.c -+++ b/init/do_mounts.c -@@ -510,7 +510,10 @@ struct file_system_type rootfs_fs_type = { - - void __init init_rootfs(void) - { -- if (IS_ENABLED(CONFIG_TMPFS) && !saved_root_name[0] && -- (!root_fs_names || strstr(root_fs_names, "tmpfs"))) -- is_tmpfs = true; -+ if (IS_ENABLED(CONFIG_TMPFS)) { -+ if (!saved_root_name[0] && !root_fs_names) -+ is_tmpfs = true; -+ else if (root_fs_names && !!strstr(root_fs_names, "tmpfs")) -+ is_tmpfs = true; -+ } - } --- -2.43.2 - -From d1c6a77d6d48215ba723f910eaabdb6e60d21a37 Mon Sep 17 00:00:00 2001 -From: Gui-Dong Han <2045gemini@gmail.com> -Date: Fri, 22 Dec 2023 23:12:41 +0800 -Subject: [PATCH 0477/1501] Bluetooth: Fix atomicity violation in - {min,max}_key_size_set -Content-Length: 3357 -Lines: 91 - -commit da9065caa594d19b26e1a030fd0cc27bd365d685 upstream. - -In min_key_size_set(): - if (val > hdev->le_max_key_size || val < SMP_MIN_ENC_KEY_SIZE) - return -EINVAL; - hci_dev_lock(hdev); - hdev->le_min_key_size = val; - hci_dev_unlock(hdev); - -In max_key_size_set(): - if (val > SMP_MAX_ENC_KEY_SIZE || val < hdev->le_min_key_size) - return -EINVAL; - hci_dev_lock(hdev); - hdev->le_max_key_size = val; - hci_dev_unlock(hdev); - -The atomicity violation occurs due to concurrent execution of set_min and -set_max funcs.Consider a scenario where setmin writes a new, valid 'min' -value, and concurrently, setmax writes a value that is greater than the -old 'min' but smaller than the new 'min'. In this case, setmax might check -against the old 'min' value (before acquiring the lock) but write its -value after the 'min' has been updated by setmin. This leads to a -situation where the 'max' value ends up being smaller than the 'min' -value, which is an inconsistency. - -This possible bug is found by an experimental static analysis tool -developed by our team, BassCheck[1]. This tool analyzes the locking APIs -to extract function pairs that can be concurrently executed, and then -analyzes the instructions in the paired functions to identify possible -concurrency bugs including data races and atomicity violations. The above -possible bug is reported when our tool analyzes the source code of -Linux 5.17. - -To resolve this issue, it is suggested to encompass the validity checks -within the locked sections in both set_min and set_max funcs. The -modification ensures that the validation of 'val' against the -current min/max values is atomic, thus maintaining the integrity of the -settings. With this patch applied, our tool no longer reports the bug, -with the kernel configuration allyesconfig for x86_64. Due to the lack of -associated hardware, we cannot test the patch in runtime testing, and just -verify it according to the code logic. - -[1] https://sites.google.com/view/basscheck/ - -Fixes: 18f81241b74f ("Bluetooth: Move {min,max}_key_size debugfs ...") -Cc: stable@vger.kernel.org -Signed-off-by: Gui-Dong Han <2045gemini@gmail.com> -Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - net/bluetooth/hci_debugfs.c | 16 ++++++++++------ - 1 file changed, 10 insertions(+), 6 deletions(-) - -diff --git a/net/bluetooth/hci_debugfs.c b/net/bluetooth/hci_debugfs.c -index 6b7741f6e95b..233453807b50 100644 ---- a/net/bluetooth/hci_debugfs.c -+++ b/net/bluetooth/hci_debugfs.c -@@ -1046,10 +1046,12 @@ static int min_key_size_set(void *data, u64 val) - { - struct hci_dev *hdev = data; - -- if (val > hdev->le_max_key_size || val < SMP_MIN_ENC_KEY_SIZE) -- return -EINVAL; -- - hci_dev_lock(hdev); -+ if (val > hdev->le_max_key_size || val < SMP_MIN_ENC_KEY_SIZE) { -+ hci_dev_unlock(hdev); -+ return -EINVAL; -+ } -+ - hdev->le_min_key_size = val; - hci_dev_unlock(hdev); - -@@ -1074,10 +1076,12 @@ static int max_key_size_set(void *data, u64 val) - { - struct hci_dev *hdev = data; - -- if (val > SMP_MAX_ENC_KEY_SIZE || val < hdev->le_min_key_size) -- return -EINVAL; -- - hci_dev_lock(hdev); -+ if (val > SMP_MAX_ENC_KEY_SIZE || val < hdev->le_min_key_size) { -+ hci_dev_unlock(hdev); -+ return -EINVAL; -+ } -+ - hdev->le_max_key_size = val; - hci_dev_unlock(hdev); - --- -2.43.2 - -From 50ae82f080cf87e84828f066c31723b781d68f5b Mon Sep 17 00:00:00 2001 -From: Jiri Olsa <olsajiri@gmail.com> -Date: Wed, 3 Jan 2024 20:05:46 +0100 -Subject: [PATCH 0478/1501] bpf: Fix re-attachment branch in - bpf_tracing_prog_attach -Content-Length: 2700 -Lines: 76 - -commit 715d82ba636cb3629a6e18a33bb9dbe53f9936ee upstream. - -The following case can cause a crash due to missing attach_btf: - -1) load rawtp program -2) load fentry program with rawtp as target_fd -3) create tracing link for fentry program with target_fd = 0 -4) repeat 3 - -In the end we have: - -- prog->aux->dst_trampoline == NULL -- tgt_prog == NULL (because we did not provide target_fd to link_create) -- prog->aux->attach_btf == NULL (the program was loaded with attach_prog_fd=X) -- the program was loaded for tgt_prog but we have no way to find out which one - - BUG: kernel NULL pointer dereference, address: 0000000000000058 - Call Trace: - <TASK> - ? __die+0x20/0x70 - ? page_fault_oops+0x15b/0x430 - ? fixup_exception+0x22/0x330 - ? exc_page_fault+0x6f/0x170 - ? asm_exc_page_fault+0x22/0x30 - ? bpf_tracing_prog_attach+0x279/0x560 - ? btf_obj_id+0x5/0x10 - bpf_tracing_prog_attach+0x439/0x560 - __sys_bpf+0x1cf4/0x2de0 - __x64_sys_bpf+0x1c/0x30 - do_syscall_64+0x41/0xf0 - entry_SYSCALL_64_after_hwframe+0x6e/0x76 - -Return -EINVAL in this situation. - -Fixes: f3a95075549e0 ("bpf: Allow trampoline re-attach for tracing and lsm programs") -Cc: stable@vger.kernel.org -Signed-off-by: Jiri Olsa <olsajiri@gmail.com> -Acked-by: Jiri Olsa <olsajiri@gmail.com> -Acked-by: Song Liu <song@kernel.org> -Signed-off-by: Dmitrii Dolgov <9erthalion6@gmail.com> -Link: https://lore.kernel.org/r/20240103190559.14750-4-9erthalion6@gmail.com -Signed-off-by: Alexei Starovoitov <ast@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - kernel/bpf/syscall.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c -index 6e7e57360b81..58e34ff81197 100644 ---- a/kernel/bpf/syscall.c -+++ b/kernel/bpf/syscall.c -@@ -3205,6 +3205,10 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog, - * - * - if prog->aux->dst_trampoline and tgt_prog is NULL, the program - * was detached and is going for re-attachment. -+ * -+ * - if prog->aux->dst_trampoline is NULL and tgt_prog and prog->aux->attach_btf -+ * are NULL, then program was already attached and user did not provide -+ * tgt_prog_fd so we have no way to find out or create trampoline - */ - if (!prog->aux->dst_trampoline && !tgt_prog) { - /* -@@ -3218,6 +3222,11 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog, - err = -EINVAL; - goto out_unlock; - } -+ /* We can allow re-attach only if we have valid attach_btf. */ -+ if (!prog->aux->attach_btf) { -+ err = -EINVAL; -+ goto out_unlock; -+ } - btf_id = prog->aux->attach_btf_id; - key = bpf_trampoline_compute_key(NULL, prog->aux->attach_btf, btf_id); - } --- -2.43.2 - -From a16206d0d78c43f3ae4f3ea67ecfc9416da3f53a Mon Sep 17 00:00:00 2001 -From: Aurelien Jarno <aurelien@aurel32.net> -Date: Sat, 13 Jan 2024 19:33:31 +0100 -Subject: [PATCH 0479/1501] media: solo6x10: replace max(a, min(b, c)) by - clamp(b, a, c) -Content-Length: 2371 -Lines: 56 - -commit 31e97d7c9ae3de072d7b424b2cf706a03ec10720 upstream. - -This patch replaces max(a, min(b, c)) by clamp(b, a, c) in the solo6x10 -driver. This improves the readability and more importantly, for the -solo6x10-p2m.c file, this reduces on my system (x86-64, gcc 13): - - - the preprocessed size from 121 MiB to 4.5 MiB; - - - the build CPU time from 46.8 s to 1.6 s; - - - the build memory from 2786 MiB to 98MiB. - -In fine, this allows this relatively simple C file to be built on a -32-bit system. - -Reported-by: Jiri Slaby <jirislaby@gmail.com> -Closes: https://lore.kernel.org/lkml/18c6df0d-45ed-450c-9eda-95160a2bbb8e@gmail.com/ -Cc: <stable@vger.kernel.org> # v6.7+ -Suggested-by: David Laight <David.Laight@ACULAB.COM> -Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> -Reviewed-by: David Laight <David.Laight@ACULAB.COM> -Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/media/pci/solo6x10/solo6x10-offsets.h | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/drivers/media/pci/solo6x10/solo6x10-offsets.h b/drivers/media/pci/solo6x10/solo6x10-offsets.h -index f414ee1316f2..fdbb817e6360 100644 ---- a/drivers/media/pci/solo6x10/solo6x10-offsets.h -+++ b/drivers/media/pci/solo6x10/solo6x10-offsets.h -@@ -57,16 +57,16 @@ - #define SOLO_MP4E_EXT_ADDR(__solo) \ - (SOLO_EREF_EXT_ADDR(__solo) + SOLO_EREF_EXT_AREA(__solo)) - #define SOLO_MP4E_EXT_SIZE(__solo) \ -- max((__solo->nr_chans * 0x00080000), \ -- min(((__solo->sdram_size - SOLO_MP4E_EXT_ADDR(__solo)) - \ -- __SOLO_JPEG_MIN_SIZE(__solo)), 0x00ff0000)) -+ clamp(__solo->sdram_size - SOLO_MP4E_EXT_ADDR(__solo) - \ -+ __SOLO_JPEG_MIN_SIZE(__solo), \ -+ __solo->nr_chans * 0x00080000, 0x00ff0000) - - #define __SOLO_JPEG_MIN_SIZE(__solo) (__solo->nr_chans * 0x00080000) - #define SOLO_JPEG_EXT_ADDR(__solo) \ - (SOLO_MP4E_EXT_ADDR(__solo) + SOLO_MP4E_EXT_SIZE(__solo)) - #define SOLO_JPEG_EXT_SIZE(__solo) \ -- max(__SOLO_JPEG_MIN_SIZE(__solo), \ -- min((__solo->sdram_size - SOLO_JPEG_EXT_ADDR(__solo)), 0x00ff0000)) -+ clamp(__solo->sdram_size - SOLO_JPEG_EXT_ADDR(__solo), \ -+ __SOLO_JPEG_MIN_SIZE(__solo), 0x00ff0000) - - #define SOLO_SDRAM_END(__solo) \ - (SOLO_JPEG_EXT_ADDR(__solo) + SOLO_JPEG_EXT_SIZE(__solo)) --- -2.43.2 - -From 7e382bfc8fabc16346caf47d1971b69c0f13d711 Mon Sep 17 00:00:00 2001 -From: Rob Clark <robdclark@chromium.org> -Date: Sun, 10 Dec 2023 10:06:53 -0800 -Subject: [PATCH 0480/1501] iommu/arm-smmu-qcom: Add missing GMU entry to match - table -Content-Length: 1727 -Lines: 37 - -commit afc95681c3068956fed1241a1ff1612c066c75ac upstream. - -In some cases the firmware expects cbndx 1 to be assigned to the GMU, -so we also want the default domain for the GMU to be an identy domain. -This way it does not get a context bank assigned. Without this, both -of_dma_configure() and drm/msm's iommu_domain_attach() will trigger -allocating and configuring a context bank. So GMU ends up attached to -both cbndx 1 and later cbndx 2. This arrangement seemingly confounds -and surprises the firmware if the GPU later triggers a translation -fault, resulting (on sc8280xp / lenovo x13s, at least) in the SMMU -getting wedged and the GPU stuck without memory access. - -Cc: stable@vger.kernel.org -Signed-off-by: Rob Clark <robdclark@chromium.org> -Tested-by: Johan Hovold <johan+linaro@kernel.org> -Reviewed-by: Robin Murphy <robin.murphy@arm.com> -Link: https://lore.kernel.org/r/20231210180655.75542-1-robdclark@gmail.com -Signed-off-by: Will Deacon <will@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c -index 549ae4dba3a6..d326fa230b96 100644 ---- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c -+++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c -@@ -243,6 +243,7 @@ static int qcom_adreno_smmu_init_context(struct arm_smmu_domain *smmu_domain, - - static const struct of_device_id qcom_smmu_client_of_match[] __maybe_unused = { - { .compatible = "qcom,adreno" }, -+ { .compatible = "qcom,adreno-gmu" }, - { .compatible = "qcom,mdp4" }, - { .compatible = "qcom,mdss" }, - { .compatible = "qcom,sc7180-mdss" }, --- -2.43.2 - -From 2cabcffe017bb82f0f56d38821262f25f7a48845 Mon Sep 17 00:00:00 2001 -From: Christian Marangi <ansuelsmth@gmail.com> -Date: Wed, 18 Oct 2023 15:09:37 +0200 -Subject: [PATCH 0482/1501] wifi: mt76: fix broken precal loading from MTD for - mt7915 -Content-Length: 1836 -Lines: 47 - -commit e874a79250b39447765ac13272b67ac36ccf2a75 upstream. - -Commit 495184ac91bb ("mt76: mt7915: add support for applying -pre-calibration data") was fundamentally broken and never worked. - -The idea (before NVMEM support) was to expand the MTD function and pass -an additional offset. For normal EEPROM load the offset would always be -0. For the purpose of precal loading, an offset was passed that was -internally the size of EEPROM, since precal data is right after the -EEPROM. - -Problem is that the offset value passed is never handled and is actually -overwrite by - - offset = be32_to_cpup(list); - ret = mtd_read(mtd, offset, len, &retlen, eep); - -resulting in the passed offset value always ingnored. (and even passing -garbage data as precal as the start of the EEPROM is getting read) - -Fix this by adding to the current offset value, the offset from DT to -correctly read the piece of data at the requested location. - -Cc: stable@vger.kernel.org -Fixes: 495184ac91bb ("mt76: mt7915: add support for applying pre-calibration data") -Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> -Signed-off-by: Felix Fietkau <nbd@nbd.name> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/net/wireless/mediatek/mt76/eeprom.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/mediatek/mt76/eeprom.c b/drivers/net/wireless/mediatek/mt76/eeprom.c -index be55c7e0aff1..50820fe00b8b 100644 ---- a/drivers/net/wireless/mediatek/mt76/eeprom.c -+++ b/drivers/net/wireless/mediatek/mt76/eeprom.c -@@ -67,7 +67,7 @@ static int mt76_get_of_epprom_from_mtd(struct mt76_dev *dev, void *eep, int offs - goto out_put_node; - } - -- offset = be32_to_cpup(list); -+ offset += be32_to_cpup(list); - ret = mtd_read(mtd, offset, len, &retlen, eep); - put_mtd_device(mtd); - if (mtd_is_bitflip(ret)) --- -2.43.2 - -From d24a4df619254e8fc965226411f123baa61075f1 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@linux.intel.com> -Date: Fri, 24 Nov 2023 10:47:16 +0200 -Subject: [PATCH 0483/1501] wifi: rtlwifi: Remove bogus and dangerous ASPM - disable/enable code -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 6890 -Lines: 179 - -commit b3943b3c2971444364e03224cfc828c5789deada upstream. - -Ever since introduction in the commit 0c8173385e54 ("rtl8192ce: Add new -driver") the rtlwifi code has, according to comments, attempted to -disable/enable ASPM of the upstream bridge by writing into its LNKCTL -register. However, the code has never been correct because it performs -the writes to the device instead of the upstream bridge. - -Worse yet, the offset where the PCIe capabilities reside is derived -from the offset of the upstream bridge. As a result, the write will use -an offset on the device that does not relate to the LNKCTL register -making the ASPM disable/enable code outright dangerous. - -Because of those problems, there is no indication that the driver needs -disable/enable ASPM on the upstream bridge. As the Capabilities offset -is not correctly calculated for the write to target device's LNKCTL -register, the code is not disabling/enabling device's ASPM either. -Therefore, just remove the upstream bridge related ASPM disable/enable -code entirely. - -The upstream bridge related ASPM code was the only user of the struct -mp_adapter members num4bytes, pcibridge_pciehdr_offset, and -pcibridge_linkctrlreg so those are removed as well. - -Note: This change does not remove the code related to changing the -device's ASPM on purpose (which is independent of this flawed code -related to upstream bridge's ASPM). - -Suggested-by: Bjorn Helgaas <bhelgaas@kernel.org> -Fixes: 0c8173385e54 ("rtl8192ce: Add new driver") -Fixes: 886e14b65a8f ("rtlwifi: Eliminate raw reads and writes from PCIe portion") -Cc: stable@vger.kernel.org -Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://lore.kernel.org/r/20231124084725.12738-2-ilpo.jarvinen@linux.intel.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/net/wireless/realtek/rtlwifi/pci.c | 58 +--------------------- - drivers/net/wireless/realtek/rtlwifi/pci.h | 5 -- - 2 files changed, 1 insertion(+), 62 deletions(-) - -diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c -index 9886e719739b..206eca310cd7 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/pci.c -+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c -@@ -192,11 +192,8 @@ static void rtl_pci_disable_aspm(struct ieee80211_hw *hw) - struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw)); - struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); - u8 pcibridge_vendor = pcipriv->ndis_adapter.pcibridge_vendor; -- u8 num4bytes = pcipriv->ndis_adapter.num4bytes; - /*Retrieve original configuration settings. */ - u8 linkctrl_reg = pcipriv->ndis_adapter.linkctrl_reg; -- u16 pcibridge_linkctrlreg = pcipriv->ndis_adapter. -- pcibridge_linkctrlreg; - u16 aspmlevel = 0; - u8 tmp_u1b = 0; - -@@ -221,16 +218,8 @@ static void rtl_pci_disable_aspm(struct ieee80211_hw *hw) - /*Set corresponding value. */ - aspmlevel |= BIT(0) | BIT(1); - linkctrl_reg &= ~aspmlevel; -- pcibridge_linkctrlreg &= ~(BIT(0) | BIT(1)); - - _rtl_pci_platform_switch_device_pci_aspm(hw, linkctrl_reg); -- udelay(50); -- -- /*4 Disable Pci Bridge ASPM */ -- pci_write_config_byte(rtlpci->pdev, (num4bytes << 2), -- pcibridge_linkctrlreg); -- -- udelay(50); - } - - /*Enable RTL8192SE ASPM & Enable Pci Bridge ASPM for -@@ -245,9 +234,7 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw) - struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw)); - struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); - u8 pcibridge_vendor = pcipriv->ndis_adapter.pcibridge_vendor; -- u8 num4bytes = pcipriv->ndis_adapter.num4bytes; - u16 aspmlevel; -- u8 u_pcibridge_aspmsetting; - u8 u_device_aspmsetting; - - if (!ppsc->support_aspm) -@@ -259,25 +246,6 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw) - return; - } - -- /*4 Enable Pci Bridge ASPM */ -- -- u_pcibridge_aspmsetting = -- pcipriv->ndis_adapter.pcibridge_linkctrlreg | -- rtlpci->const_hostpci_aspm_setting; -- -- if (pcibridge_vendor == PCI_BRIDGE_VENDOR_INTEL) -- u_pcibridge_aspmsetting &= ~BIT(0); -- -- pci_write_config_byte(rtlpci->pdev, (num4bytes << 2), -- u_pcibridge_aspmsetting); -- -- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, -- "PlatformEnableASPM(): Write reg[%x] = %x\n", -- (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10), -- u_pcibridge_aspmsetting); -- -- udelay(50); -- - /*Get ASPM level (with/without Clock Req) */ - aspmlevel = rtlpci->const_devicepci_aspm_setting; - u_device_aspmsetting = pcipriv->ndis_adapter.linkctrl_reg; -@@ -358,22 +326,6 @@ static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw, - return tpriv != NULL; - } - --static void rtl_pci_get_linkcontrol_field(struct ieee80211_hw *hw) --{ -- struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw); -- struct rtl_pci *rtlpci = rtl_pcidev(pcipriv); -- u8 capabilityoffset = pcipriv->ndis_adapter.pcibridge_pciehdr_offset; -- u8 linkctrl_reg; -- u8 num4bbytes; -- -- num4bbytes = (capabilityoffset + 0x10) / 4; -- -- /*Read Link Control Register */ -- pci_read_config_byte(rtlpci->pdev, (num4bbytes << 2), &linkctrl_reg); -- -- pcipriv->ndis_adapter.pcibridge_linkctrlreg = linkctrl_reg; --} -- - static void rtl_pci_parse_configuration(struct pci_dev *pdev, - struct ieee80211_hw *hw) - { -@@ -2028,12 +1980,6 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev, - PCI_SLOT(bridge_pdev->devfn); - pcipriv->ndis_adapter.pcibridge_funcnum = - PCI_FUNC(bridge_pdev->devfn); -- pcipriv->ndis_adapter.pcibridge_pciehdr_offset = -- pci_pcie_cap(bridge_pdev); -- pcipriv->ndis_adapter.num4bytes = -- (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10) / 4; -- -- rtl_pci_get_linkcontrol_field(hw); - - if (pcipriv->ndis_adapter.pcibridge_vendor == - PCI_BRIDGE_VENDOR_AMD) { -@@ -2050,13 +1996,11 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev, - pdev->vendor, pcipriv->ndis_adapter.linkctrl_reg); - - rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, -- "pci_bridge busnumber:devnumber:funcnumber:vendor:pcie_cap:link_ctl_reg:amd %d:%d:%d:%x:%x:%x:%x\n", -+ "pci_bridge busnumber:devnumber:funcnumber:vendor:amd %d:%d:%d:%x:%x\n", - pcipriv->ndis_adapter.pcibridge_busnum, - pcipriv->ndis_adapter.pcibridge_devnum, - pcipriv->ndis_adapter.pcibridge_funcnum, - pcibridge_vendors[pcipriv->ndis_adapter.pcibridge_vendor], -- pcipriv->ndis_adapter.pcibridge_pciehdr_offset, -- pcipriv->ndis_adapter.pcibridge_linkctrlreg, - pcipriv->ndis_adapter.amd_l1_patch); - - rtl_pci_parse_configuration(pdev, hw); -diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.h b/drivers/net/wireless/realtek/rtlwifi/pci.h -index 866861626a0a..d6307197dfea 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/pci.h -+++ b/drivers/net/wireless/realtek/rtlwifi/pci.h -@@ -236,11 +236,6 @@ struct mp_adapter { - u16 pcibridge_vendorid; - u16 pcibridge_deviceid; - -- u8 num4bytes; -- -- u8 pcibridge_pciehdr_offset; -- u8 pcibridge_linkctrlreg; -- - bool amd_l1_patch; - }; - --- -2.43.2 - -From 5d4a90b43ee5967799169368182dd16aa70b9fa9 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@linux.intel.com> -Date: Fri, 24 Nov 2023 10:47:17 +0200 -Subject: [PATCH 0484/1501] wifi: rtlwifi: Convert LNKCTL change to PCIe cap - RMW accessors -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2826 -Lines: 73 - -commit 5894d0089cbc146063dcc0239a78ede0a8142efb upstream. - -The rtlwifi driver comes with custom code to write into PCIe Link -Control register. RMW access for the Link Control register requires -locking that is already provided by the standard PCIe capability -accessors. - -Convert the custom RMW code writing into LNKCTL register to standard -RMW capability accessors. The accesses are changed to cover the full -LNKCTL register instead of touching just a single byte of the register. - -Fixes: 0c8173385e54 ("rtl8192ce: Add new driver") -Cc: stable@vger.kernel.org -Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://lore.kernel.org/r/20231124084725.12738-3-ilpo.jarvinen@linux.intel.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/net/wireless/realtek/rtlwifi/pci.c | 23 +++++++++++++++------- - 1 file changed, 16 insertions(+), 7 deletions(-) - -diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c -index 206eca310cd7..b118df035243 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/pci.c -+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c -@@ -164,21 +164,29 @@ static bool _rtl_pci_platform_switch_device_pci_aspm( - struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); - struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw)); - -- if (rtlhal->hw_type != HARDWARE_TYPE_RTL8192SE) -- value |= 0x40; -+ value &= PCI_EXP_LNKCTL_ASPMC; - -- pci_write_config_byte(rtlpci->pdev, 0x80, value); -+ if (rtlhal->hw_type != HARDWARE_TYPE_RTL8192SE) -+ value |= PCI_EXP_LNKCTL_CCC; -+ -+ pcie_capability_clear_and_set_word(rtlpci->pdev, PCI_EXP_LNKCTL, -+ PCI_EXP_LNKCTL_ASPMC | value, -+ value); - - return false; - } - --/*When we set 0x01 to enable clk request. Set 0x0 to disable clk req.*/ --static void _rtl_pci_switch_clk_req(struct ieee80211_hw *hw, u8 value) -+/* @value is PCI_EXP_LNKCTL_CLKREQ_EN or 0 to enable/disable clk request. */ -+static void _rtl_pci_switch_clk_req(struct ieee80211_hw *hw, u16 value) - { - struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); - struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw)); - -- pci_write_config_byte(rtlpci->pdev, 0x81, value); -+ value &= PCI_EXP_LNKCTL_CLKREQ_EN; -+ -+ pcie_capability_clear_and_set_word(rtlpci->pdev, PCI_EXP_LNKCTL, -+ PCI_EXP_LNKCTL_CLKREQ_EN, -+ value); - - if (rtlhal->hw_type == HARDWARE_TYPE_RTL8192SE) - udelay(100); -@@ -259,7 +267,8 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw) - - if (ppsc->reg_rfps_level & RT_RF_OFF_LEVL_CLK_REQ) { - _rtl_pci_switch_clk_req(hw, (ppsc->reg_rfps_level & -- RT_RF_OFF_LEVL_CLK_REQ) ? 1 : 0); -+ RT_RF_OFF_LEVL_CLK_REQ) ? -+ PCI_EXP_LNKCTL_CLKREQ_EN : 0); - RT_SET_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_CLK_REQ); - } - udelay(100); --- -2.43.2 - -From a3c603ef9c2af7f07562c152640af5d974cf7cd6 Mon Sep 17 00:00:00 2001 -From: David Lin <yu-hao.lin@nxp.com> -Date: Sat, 9 Dec 2023 07:40:29 +0800 -Subject: [PATCH 0485/1501] wifi: mwifiex: add extra delay for firmware ready -Content-Length: 5284 -Lines: 155 - -commit 1c5d463c0770c6fa2037511a24fb17966fd07d97 upstream. - -For SDIO IW416, due to a bug, FW may return ready before complete full -initialization. Command timeout may occur at driver load after reboot. -Workaround by adding 100ms delay at checking FW status. - -Signed-off-by: David Lin <yu-hao.lin@nxp.com> -Cc: stable@vger.kernel.org -Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com> -Acked-by: Brian Norris <briannorris@chromium.org> -Tested-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> # Verdin AM62 (IW416) -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://msgid.link/20231208234029.2197-1-yu-hao.lin@nxp.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/net/wireless/marvell/mwifiex/sdio.c | 19 +++++++++++++++++++ - drivers/net/wireless/marvell/mwifiex/sdio.h | 2 ++ - 2 files changed, 21 insertions(+) - -diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c -index 6462a0ffe698..ef3e68d1059c 100644 ---- a/drivers/net/wireless/marvell/mwifiex/sdio.c -+++ b/drivers/net/wireless/marvell/mwifiex/sdio.c -@@ -331,6 +331,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8786 = { - .can_dump_fw = false, - .can_auto_tdls = false, - .can_ext_scan = false, -+ .fw_ready_extra_delay = false, - }; - - static const struct mwifiex_sdio_device mwifiex_sdio_sd8787 = { -@@ -346,6 +347,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8787 = { - .can_dump_fw = false, - .can_auto_tdls = false, - .can_ext_scan = true, -+ .fw_ready_extra_delay = false, - }; - - static const struct mwifiex_sdio_device mwifiex_sdio_sd8797 = { -@@ -361,6 +363,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8797 = { - .can_dump_fw = false, - .can_auto_tdls = false, - .can_ext_scan = true, -+ .fw_ready_extra_delay = false, - }; - - static const struct mwifiex_sdio_device mwifiex_sdio_sd8897 = { -@@ -376,6 +379,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8897 = { - .can_dump_fw = true, - .can_auto_tdls = false, - .can_ext_scan = true, -+ .fw_ready_extra_delay = false, - }; - - static const struct mwifiex_sdio_device mwifiex_sdio_sd8977 = { -@@ -392,6 +396,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8977 = { - .fw_dump_enh = true, - .can_auto_tdls = false, - .can_ext_scan = true, -+ .fw_ready_extra_delay = false, - }; - - static const struct mwifiex_sdio_device mwifiex_sdio_sd8978 = { -@@ -408,6 +413,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8978 = { - .fw_dump_enh = true, - .can_auto_tdls = false, - .can_ext_scan = true, -+ .fw_ready_extra_delay = true, - }; - - static const struct mwifiex_sdio_device mwifiex_sdio_sd8997 = { -@@ -425,6 +431,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8997 = { - .fw_dump_enh = true, - .can_auto_tdls = false, - .can_ext_scan = true, -+ .fw_ready_extra_delay = false, - }; - - static const struct mwifiex_sdio_device mwifiex_sdio_sd8887 = { -@@ -440,6 +447,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8887 = { - .can_dump_fw = false, - .can_auto_tdls = true, - .can_ext_scan = true, -+ .fw_ready_extra_delay = false, - }; - - static const struct mwifiex_sdio_device mwifiex_sdio_sd8987 = { -@@ -456,6 +464,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8987 = { - .fw_dump_enh = true, - .can_auto_tdls = true, - .can_ext_scan = true, -+ .fw_ready_extra_delay = false, - }; - - static const struct mwifiex_sdio_device mwifiex_sdio_sd8801 = { -@@ -471,6 +480,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8801 = { - .can_dump_fw = false, - .can_auto_tdls = false, - .can_ext_scan = true, -+ .fw_ready_extra_delay = false, - }; - - static struct memory_type_mapping generic_mem_type_map[] = { -@@ -563,6 +573,7 @@ mwifiex_sdio_probe(struct sdio_func *func, const struct sdio_device_id *id) - card->fw_dump_enh = data->fw_dump_enh; - card->can_auto_tdls = data->can_auto_tdls; - card->can_ext_scan = data->can_ext_scan; -+ card->fw_ready_extra_delay = data->fw_ready_extra_delay; - INIT_WORK(&card->work, mwifiex_sdio_work); - } - -@@ -766,6 +777,7 @@ mwifiex_sdio_read_fw_status(struct mwifiex_adapter *adapter, u16 *dat) - static int mwifiex_check_fw_status(struct mwifiex_adapter *adapter, - u32 poll_num) - { -+ struct sdio_mmc_card *card = adapter->card; - int ret = 0; - u16 firmware_stat; - u32 tries; -@@ -783,6 +795,13 @@ static int mwifiex_check_fw_status(struct mwifiex_adapter *adapter, - ret = -1; - } - -+ if (card->fw_ready_extra_delay && -+ firmware_stat == FIRMWARE_READY_SDIO) -+ /* firmware might pretend to be ready, when it's not. -+ * Wait a little bit more as a workaround. -+ */ -+ msleep(100); -+ - return ret; - } - -diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.h b/drivers/net/wireless/marvell/mwifiex/sdio.h -index b86a9263a6a8..cb63ad55d675 100644 ---- a/drivers/net/wireless/marvell/mwifiex/sdio.h -+++ b/drivers/net/wireless/marvell/mwifiex/sdio.h -@@ -255,6 +255,7 @@ struct sdio_mmc_card { - bool fw_dump_enh; - bool can_auto_tdls; - bool can_ext_scan; -+ bool fw_ready_extra_delay; - - struct mwifiex_sdio_mpa_tx mpa_tx; - struct mwifiex_sdio_mpa_rx mpa_rx; -@@ -278,6 +279,7 @@ struct mwifiex_sdio_device { - bool fw_dump_enh; - bool can_auto_tdls; - bool can_ext_scan; -+ bool fw_ready_extra_delay; - }; - - /* --- -2.43.2 - -From 73f81cc8503a710e1f8042256d9fd72bb898bd69 Mon Sep 17 00:00:00 2001 -From: David Lin <yu-hao.lin@nxp.com> -Date: Fri, 15 Dec 2023 08:51:18 +0800 -Subject: [PATCH 0486/1501] wifi: mwifiex: configure BSSID consistently when - starting AP -Content-Length: 4293 -Lines: 93 - -commit f0dd488e11e71ac095df7638d892209c629d9af2 upstream. - -AP BSSID configuration is missing at AP start. Without this fix, FW returns -STA interface MAC address after first init. When hostapd restarts, it gets MAC -address from netdev before driver sets STA MAC to netdev again. Now MAC address -between hostapd and net interface are different causes STA cannot connect to -AP. After that MAC address of uap0 mlan0 become the same. And issue disappears -after following hostapd restart (another issue is AP/STA MAC address become the -same). - -This patch fixes the issue cleanly. - -Signed-off-by: David Lin <yu-hao.lin@nxp.com> -Fixes: 12190c5d80bd ("mwifiex: add cfg80211 start_ap and stop_ap handlers") -Cc: stable@vger.kernel.org -Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com> -Tested-by: Rafael Beims <rafael.beims@toradex.com> # Verdin iMX8MP/SD8997 SD -Acked-by: Brian Norris <briannorris@chromium.org> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://msgid.link/20231215005118.17031-1-yu-hao.lin@nxp.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/net/wireless/marvell/mwifiex/cfg80211.c | 2 ++ - drivers/net/wireless/marvell/mwifiex/fw.h | 1 + - drivers/net/wireless/marvell/mwifiex/ioctl.h | 1 + - drivers/net/wireless/marvell/mwifiex/uap_cmd.c | 8 ++++++++ - 4 files changed, 12 insertions(+) - -diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c -index 7a15ea8072e6..3604abcbcff9 100644 ---- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c -+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c -@@ -2047,6 +2047,8 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy, - - mwifiex_set_sys_config_invalid_data(bss_cfg); - -+ memcpy(bss_cfg->mac_addr, priv->curr_addr, ETH_ALEN); -+ - if (params->beacon_interval) - bss_cfg->beacon_period = params->beacon_interval; - if (params->dtim_period) -diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h -index 8e6db904e5b2..62f3c9a52a1d 100644 ---- a/drivers/net/wireless/marvell/mwifiex/fw.h -+++ b/drivers/net/wireless/marvell/mwifiex/fw.h -@@ -165,6 +165,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER { - #define TLV_TYPE_STA_MAC_ADDR (PROPRIETARY_TLV_BASE_ID + 32) - #define TLV_TYPE_BSSID (PROPRIETARY_TLV_BASE_ID + 35) - #define TLV_TYPE_CHANNELBANDLIST (PROPRIETARY_TLV_BASE_ID + 42) -+#define TLV_TYPE_UAP_MAC_ADDRESS (PROPRIETARY_TLV_BASE_ID + 43) - #define TLV_TYPE_UAP_BEACON_PERIOD (PROPRIETARY_TLV_BASE_ID + 44) - #define TLV_TYPE_UAP_DTIM_PERIOD (PROPRIETARY_TLV_BASE_ID + 45) - #define TLV_TYPE_UAP_BCAST_SSID (PROPRIETARY_TLV_BASE_ID + 48) -diff --git a/drivers/net/wireless/marvell/mwifiex/ioctl.h b/drivers/net/wireless/marvell/mwifiex/ioctl.h -index 091e7ca79376..e8825f302de8 100644 ---- a/drivers/net/wireless/marvell/mwifiex/ioctl.h -+++ b/drivers/net/wireless/marvell/mwifiex/ioctl.h -@@ -107,6 +107,7 @@ struct mwifiex_uap_bss_param { - u8 qos_info; - u8 power_constraint; - struct mwifiex_types_wmm_info wmm_info; -+ u8 mac_addr[ETH_ALEN]; - }; - - enum { -diff --git a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c -index e78a201cd150..491e36611909 100644 ---- a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c -+++ b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c -@@ -468,6 +468,7 @@ void mwifiex_config_uap_11d(struct mwifiex_private *priv, - static int - mwifiex_uap_bss_param_prepare(u8 *tlv, void *cmd_buf, u16 *param_size) - { -+ struct host_cmd_tlv_mac_addr *mac_tlv; - struct host_cmd_tlv_dtim_period *dtim_period; - struct host_cmd_tlv_beacon_period *beacon_period; - struct host_cmd_tlv_ssid *ssid; -@@ -487,6 +488,13 @@ mwifiex_uap_bss_param_prepare(u8 *tlv, void *cmd_buf, u16 *param_size) - int i; - u16 cmd_size = *param_size; - -+ mac_tlv = (struct host_cmd_tlv_mac_addr *)tlv; -+ mac_tlv->header.type = cpu_to_le16(TLV_TYPE_UAP_MAC_ADDRESS); -+ mac_tlv->header.len = cpu_to_le16(ETH_ALEN); -+ memcpy(mac_tlv->mac_addr, bss_cfg->mac_addr, ETH_ALEN); -+ cmd_size += sizeof(struct host_cmd_tlv_mac_addr); -+ tlv += sizeof(struct host_cmd_tlv_mac_addr); -+ - if (bss_cfg->ssid.ssid_len) { - ssid = (struct host_cmd_tlv_ssid *)tlv; - ssid->header.type = cpu_to_le16(TLV_TYPE_UAP_SSID); --- -2.43.2 - -From cf7bbf90f7aa493da685091a346520fc33edd427 Mon Sep 17 00:00:00 2001 -From: David Lin <yu-hao.lin@nxp.com> -Date: Thu, 21 Dec 2023 09:55:11 +0800 -Subject: [PATCH 0487/1501] wifi: mwifiex: fix uninitialized firmware_stat -Content-Length: 1287 -Lines: 33 - -commit 3df95e265924ac898c1a38a0c01846dd0bd3b354 upstream. - -Variable firmware_stat is possible to be used without initialization. - -Signed-off-by: David Lin <yu-hao.lin@nxp.com> -Fixes: 1c5d463c0770 ("wifi: mwifiex: add extra delay for firmware ready") -Cc: stable@vger.kernel.org -Reported-by: kernel test robot <lkp@intel.com> -Reported-by: Dan Carpenter <error27@gmail.com> -Closes: https://lore.kernel.org/r/202312192236.ZflaWYCw-lkp@intel.com/ -Acked-by: Brian Norris <briannorris@chromium.org> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://msgid.link/20231221015511.1032128-1-yu-hao.lin@nxp.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/net/wireless/marvell/mwifiex/sdio.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c -index ef3e68d1059c..75f53c2f1e1f 100644 ---- a/drivers/net/wireless/marvell/mwifiex/sdio.c -+++ b/drivers/net/wireless/marvell/mwifiex/sdio.c -@@ -779,7 +779,7 @@ static int mwifiex_check_fw_status(struct mwifiex_adapter *adapter, - { - struct sdio_mmc_card *card = adapter->card; - int ret = 0; -- u16 firmware_stat; -+ u16 firmware_stat = 0; - u32 tries; - - for (tries = 0; tries < poll_num; tries++) { --- -2.43.2 - -From 388018df38b69fff60294472d2b7d00a9c868c4c Mon Sep 17 00:00:00 2001 -From: Petr Tesarik <petr@tesarici.cz> -Date: Fri, 5 Jan 2024 21:16:42 +0100 -Subject: [PATCH 0488/1501] net: stmmac: fix ethtool per-queue statistics -Content-Length: 2804 -Lines: 80 - -commit 61921bdaa132b580b6db6858e6d7dcdb870df5fe upstream. - -Fix per-queue statistics for devices with more than one queue. - -The output data pointer is currently reset in each loop iteration, -effectively summing all queue statistics in the first four u64 values. - -The summary values are not even labeled correctly. For example, if eth0 has -2 queues, ethtool -S eth0 shows: - - q0_tx_pkt_n: 374 (actually tx_pkt_n over all queues) - q0_tx_irq_n: 23 (actually tx_normal_irq_n over all queues) - q1_tx_pkt_n: 462 (actually rx_pkt_n over all queues) - q1_tx_irq_n: 446 (actually rx_normal_irq_n over all queues) - q0_rx_pkt_n: 0 - q0_rx_irq_n: 0 - q1_rx_pkt_n: 0 - q1_rx_irq_n: 0 - -Fixes: 133466c3bbe1 ("net: stmmac: use per-queue 64 bit statistics where necessary") -Cc: stable@vger.kernel.org -Signed-off-by: Petr Tesarik <petr@tesarici.cz> -Reviewed-by: Jisheng Zhang <jszhang@kernel.org> -Reviewed-by: Andrew Lunn <andrew@lunn.ch> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 9 ++------- - 1 file changed, 2 insertions(+), 7 deletions(-) - -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -index f628411ae4ae..112a36a698f1 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -@@ -543,15 +543,12 @@ static void stmmac_get_per_qstats(struct stmmac_priv *priv, u64 *data) - u32 rx_cnt = priv->plat->rx_queues_to_use; - unsigned int start; - int q, stat; -- u64 *pos; - char *p; - -- pos = data; - for (q = 0; q < tx_cnt; q++) { - struct stmmac_txq_stats *txq_stats = &priv->xstats.txq_stats[q]; - struct stmmac_txq_stats snapshot; - -- data = pos; - do { - start = u64_stats_fetch_begin(&txq_stats->syncp); - snapshot = *txq_stats; -@@ -559,17 +556,15 @@ static void stmmac_get_per_qstats(struct stmmac_priv *priv, u64 *data) - - p = (char *)&snapshot + offsetof(struct stmmac_txq_stats, tx_pkt_n); - for (stat = 0; stat < STMMAC_TXQ_STATS; stat++) { -- *data++ += (*(u64 *)p); -+ *data++ = (*(u64 *)p); - p += sizeof(u64); - } - } - -- pos = data; - for (q = 0; q < rx_cnt; q++) { - struct stmmac_rxq_stats *rxq_stats = &priv->xstats.rxq_stats[q]; - struct stmmac_rxq_stats snapshot; - -- data = pos; - do { - start = u64_stats_fetch_begin(&rxq_stats->syncp); - snapshot = *rxq_stats; -@@ -577,7 +572,7 @@ static void stmmac_get_per_qstats(struct stmmac_priv *priv, u64 *data) - - p = (char *)&snapshot + offsetof(struct stmmac_rxq_stats, rx_pkt_n); - for (stat = 0; stat < STMMAC_RXQ_STATS; stat++) { -- *data++ += (*(u64 *)p); -+ *data++ = (*(u64 *)p); - p += sizeof(u64); - } - } --- -2.43.2 - -From 2640eb29610cb85e3270124a5327987124a748ef Mon Sep 17 00:00:00 2001 -From: Romain Gantois <romain.gantois@bootlin.com> -Date: Tue, 16 Jan 2024 13:19:17 +0100 -Subject: [PATCH 0489/1501] net: stmmac: Prevent DSA tags from breaking COE -Content-Length: 3987 -Lines: 98 - -commit c2945c435c999c63e47f337bc7c13c98c21d0bcc upstream. - -Some DSA tagging protocols change the EtherType field in the MAC header -e.g. DSA_TAG_PROTO_(DSA/EDSA/BRCM/MTK/RTL4C_A/SJA1105). On TX these tagged -frames are ignored by the checksum offload engine and IP header checker of -some stmmac cores. - -On RX, the stmmac driver wrongly assumes that checksums have been computed -for these tagged packets, and sets CHECKSUM_UNNECESSARY. - -Add an additional check in the stmmac TX and RX hotpaths so that COE is -deactivated for packets with ethertypes that will not trigger the COE and -IP header checks. - -Fixes: 6b2c6e4a938f ("net: stmmac: propagate feature flags to vlan") -Cc: <stable@vger.kernel.org> -Reported-by: Richard Tresidder <rtresidd@electromag.com.au> -Link: https://lore.kernel.org/netdev/e5c6c75f-2dfa-4e50-a1fb-6bf4cdb617c2@electromag.com.au/ -Reported-by: Romain Gantois <romain.gantois@bootlin.com> -Link: https://lore.kernel.org/netdev/c57283ed-6b9b-b0e6-ee12-5655c1c54495@bootlin.com/ -Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com> -Reviewed-by: Linus Walleij <linus.walleij@linaro.org> -Signed-off-by: Romain Gantois <romain.gantois@bootlin.com> -Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - .../net/ethernet/stmicro/stmmac/stmmac_main.c | 32 +++++++++++++++++-- - 1 file changed, 29 insertions(+), 3 deletions(-) - -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index 37e64283f910..5b9da19743b9 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -4371,6 +4371,28 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev) - return NETDEV_TX_OK; - } - -+/** -+ * stmmac_has_ip_ethertype() - Check if packet has IP ethertype -+ * @skb: socket buffer to check -+ * -+ * Check if a packet has an ethertype that will trigger the IP header checks -+ * and IP/TCP checksum engine of the stmmac core. -+ * -+ * Return: true if the ethertype can trigger the checksum engine, false -+ * otherwise -+ */ -+static bool stmmac_has_ip_ethertype(struct sk_buff *skb) -+{ -+ int depth = 0; -+ __be16 proto; -+ -+ proto = __vlan_get_protocol(skb, eth_header_parse_protocol(skb), -+ &depth); -+ -+ return (depth <= ETH_HLEN) && -+ (proto == htons(ETH_P_IP) || proto == htons(ETH_P_IPV6)); -+} -+ - /** - * stmmac_xmit - Tx entry point of the driver - * @skb : the socket buffer -@@ -4435,9 +4457,13 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev) - /* DWMAC IPs can be synthesized to support tx coe only for a few tx - * queues. In that case, checksum offloading for those queues that don't - * support tx coe needs to fallback to software checksum calculation. -+ * -+ * Packets that won't trigger the COE e.g. most DSA-tagged packets will -+ * also have to be checksummed in software. - */ - if (csum_insertion && -- priv->plat->tx_queues_cfg[queue].coe_unsupported) { -+ (priv->plat->tx_queues_cfg[queue].coe_unsupported || -+ !stmmac_has_ip_ethertype(skb))) { - if (unlikely(skb_checksum_help(skb))) - goto dma_map_err; - csum_insertion = !csum_insertion; -@@ -4997,7 +5023,7 @@ static void stmmac_dispatch_skb_zc(struct stmmac_priv *priv, u32 queue, - stmmac_rx_vlan(priv->dev, skb); - skb->protocol = eth_type_trans(skb, priv->dev); - -- if (unlikely(!coe)) -+ if (unlikely(!coe) || !stmmac_has_ip_ethertype(skb)) - skb_checksum_none_assert(skb); - else - skb->ip_summed = CHECKSUM_UNNECESSARY; -@@ -5513,7 +5539,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) - stmmac_rx_vlan(priv->dev, skb); - skb->protocol = eth_type_trans(skb, priv->dev); - -- if (unlikely(!coe)) -+ if (unlikely(!coe) || !stmmac_has_ip_ethertype(skb)) - skb_checksum_none_assert(skb); - else - skb->ip_summed = CHECKSUM_UNNECESSARY; --- -2.43.2 - -From 5692e9d51cb6082189a08898f523471dac8d0a09 Mon Sep 17 00:00:00 2001 -From: Nicolas Dichtel <nicolas.dichtel@6wind.com> -Date: Mon, 8 Jan 2024 10:41:02 +0100 -Subject: [PATCH 0490/1501] Revert "net: rtnetlink: Enslave device before - bringing it up" -Content-Length: 1967 -Lines: 62 - -commit ec4ffd100ffb396eca13ebe7d18938ea80f399c3 upstream. - -This reverts commit a4abfa627c3865c37e036bccb681619a50d3d93c. - -The patch broke: -> ip link set dummy0 up -> ip link set dummy0 master bond0 down - -This last command is useful to be able to enslave an interface with only -one netlink message. - -After discussion, there is no good reason to support: -> ip link set dummy0 down -> ip link set dummy0 master bond0 up -because the bond interface already set the slave up when it is up. - -Cc: stable@vger.kernel.org -Fixes: a4abfa627c38 ("net: rtnetlink: Enslave device before bringing it up") -Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> -Reviewed-by: Jiri Pirko <jiri@nvidia.com> -Reviewed-by: Hangbin Liu <liuhangbin@gmail.com> -Link: https://lore.kernel.org/r/20240108094103.2001224-2-nicolas.dichtel@6wind.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - net/core/rtnetlink.c | 14 +++++++------- - 1 file changed, 7 insertions(+), 7 deletions(-) - -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index e8431c6c8490..bf4c3f65ad99 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -2905,13 +2905,6 @@ static int do_setlink(const struct sk_buff *skb, - call_netdevice_notifiers(NETDEV_CHANGEADDR, dev); - } - -- if (tb[IFLA_MASTER]) { -- err = do_set_master(dev, nla_get_u32(tb[IFLA_MASTER]), extack); -- if (err) -- goto errout; -- status |= DO_SETLINK_MODIFIED; -- } -- - if (ifm->ifi_flags || ifm->ifi_change) { - err = dev_change_flags(dev, rtnl_dev_combine_flags(dev, ifm), - extack); -@@ -2919,6 +2912,13 @@ static int do_setlink(const struct sk_buff *skb, - goto errout; - } - -+ if (tb[IFLA_MASTER]) { -+ err = do_set_master(dev, nla_get_u32(tb[IFLA_MASTER]), extack); -+ if (err) -+ goto errout; -+ status |= DO_SETLINK_MODIFIED; -+ } -+ - if (tb[IFLA_CARRIER]) { - err = dev_change_carrier(dev, nla_get_u8(tb[IFLA_CARRIER])); - if (err) --- -2.43.2 - -From a48895e9f5ab0a4d47877b5638078d14b16911f1 Mon Sep 17 00:00:00 2001 -From: Sean Christopherson <seanjc@google.com> -Date: Wed, 18 Oct 2023 12:41:03 -0700 -Subject: [PATCH 0491/1501] Revert "nSVM: Check for reserved encodings of - TLB_CONTROL in nested VMCB" -Content-Length: 2120 -Lines: 57 - -commit a484755ab2526ebdbe042397cdd6e427eb4b1a68 upstream. - -Revert KVM's made-up consistency check on SVM's TLB control. The APM says -that unsupported encodings are reserved, but the APM doesn't state that -VMRUN checks for a supported encoding. Unless something is called out -in "Canonicalization and Consistency Checks" or listed as MBZ (Must Be -Zero), AMD behavior is typically to let software shoot itself in the foot. - -This reverts commit 174a921b6975ef959dd82ee9e8844067a62e3ec1. - -Fixes: 174a921b6975 ("nSVM: Check for reserved encodings of TLB_CONTROL in nested VMCB") -Reported-by: Stefan Sterz <s.sterz@proxmox.com> -Closes: https://lkml.kernel.org/r/b9915c9c-4cf6-051a-2d91-44cc6380f455%40proxmox.com -Cc: stable@vger.kernel.org -Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> -Link: https://lore.kernel.org/r/20231018194104.1896415-2-seanjc@google.com -Signed-off-by: Sean Christopherson <seanjc@google.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/x86/kvm/svm/nested.c | 15 --------------- - 1 file changed, 15 deletions(-) - -diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c -index 3fea8c47679e..60891b9ce25f 100644 ---- a/arch/x86/kvm/svm/nested.c -+++ b/arch/x86/kvm/svm/nested.c -@@ -247,18 +247,6 @@ static bool nested_svm_check_bitmap_pa(struct kvm_vcpu *vcpu, u64 pa, u32 size) - kvm_vcpu_is_legal_gpa(vcpu, addr + size - 1); - } - --static bool nested_svm_check_tlb_ctl(struct kvm_vcpu *vcpu, u8 tlb_ctl) --{ -- /* Nested FLUSHBYASID is not supported yet. */ -- switch(tlb_ctl) { -- case TLB_CONTROL_DO_NOTHING: -- case TLB_CONTROL_FLUSH_ALL_ASID: -- return true; -- default: -- return false; -- } --} -- - static bool __nested_vmcb_check_controls(struct kvm_vcpu *vcpu, - struct vmcb_ctrl_area_cached *control) - { -@@ -278,9 +266,6 @@ static bool __nested_vmcb_check_controls(struct kvm_vcpu *vcpu, - IOPM_SIZE))) - return false; - -- if (CC(!nested_svm_check_tlb_ctl(vcpu, control->tlb_ctl))) -- return false; -- - if (CC((control->int_ctl & V_NMI_ENABLE_MASK) && - !vmcb12_is_intercept(control, INTERCEPT_NMI))) { - return false; --- -2.43.2 - -From c884129fdce358e1baef0d063641fb3fc0868ab6 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com> -Date: Wed, 10 Jan 2024 15:19:29 +0100 -Subject: [PATCH 0492/1501] drm/amdgpu: revert "Adjust removal control flow for - smu v13_0_2" -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 6937 -Lines: 189 - -commit fb1c93c2e9604a884467a773790016199f78ca08 upstream. - -Calling amdgpu_device_ip_resume_phase1() during shutdown leaves the -HW in an active state and is an unbalanced use of the IP callbacks. - -Using the IP callbacks like this can lead to memory leaks, double -free and imbalanced reference counters. - -Leaving the HW in an active state can lead to DMA accesses to memory now -freed by the driver. - -Both is a complete no-go for driver unload so completely revert the -workaround for now. - -This reverts commit f5c7e7797060255dbc8160734ccc5ad6183c5e04. - -Signed-off-by: Christian König <christian.koenig@amd.com> -Acked-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 32 +--------------------- - drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 32 ---------------------- - drivers/gpu/drm/amd/amdgpu/amdgpu_reset.h | 1 - - drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.h | 1 - - 4 files changed, 1 insertion(+), 65 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -index 93cf73d6fa11..3677d644183b 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -@@ -5172,7 +5172,6 @@ int amdgpu_do_asic_reset(struct list_head *device_list_handle, - struct amdgpu_device *tmp_adev = NULL; - bool need_full_reset, skip_hw_reset, vram_lost = false; - int r = 0; -- bool gpu_reset_for_dev_remove = 0; - - /* Try reset handler method first */ - tmp_adev = list_first_entry(device_list_handle, struct amdgpu_device, -@@ -5192,10 +5191,6 @@ int amdgpu_do_asic_reset(struct list_head *device_list_handle, - test_bit(AMDGPU_NEED_FULL_RESET, &reset_context->flags); - skip_hw_reset = test_bit(AMDGPU_SKIP_HW_RESET, &reset_context->flags); - -- gpu_reset_for_dev_remove = -- test_bit(AMDGPU_RESET_FOR_DEVICE_REMOVE, &reset_context->flags) && -- test_bit(AMDGPU_NEED_FULL_RESET, &reset_context->flags); -- - /* - * ASIC reset has to be done on all XGMI hive nodes ASAP - * to allow proper links negotiation in FW (within 1 sec) -@@ -5238,18 +5233,6 @@ int amdgpu_do_asic_reset(struct list_head *device_list_handle, - amdgpu_ras_intr_cleared(); - } - -- /* Since the mode1 reset affects base ip blocks, the -- * phase1 ip blocks need to be resumed. Otherwise there -- * will be a BIOS signature error and the psp bootloader -- * can't load kdb on the next amdgpu install. -- */ -- if (gpu_reset_for_dev_remove) { -- list_for_each_entry(tmp_adev, device_list_handle, reset_list) -- amdgpu_device_ip_resume_phase1(tmp_adev); -- -- goto end; -- } -- - list_for_each_entry(tmp_adev, device_list_handle, reset_list) { - if (need_full_reset) { - /* post card */ -@@ -5486,11 +5469,6 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev, - int i, r = 0; - bool need_emergency_restart = false; - bool audio_suspended = false; -- bool gpu_reset_for_dev_remove = false; -- -- gpu_reset_for_dev_remove = -- test_bit(AMDGPU_RESET_FOR_DEVICE_REMOVE, &reset_context->flags) && -- test_bit(AMDGPU_NEED_FULL_RESET, &reset_context->flags); - - /* - * Special case: RAS triggered and full reset isn't supported -@@ -5528,7 +5506,7 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev, - if (!amdgpu_sriov_vf(adev) && (adev->gmc.xgmi.num_physical_nodes > 1)) { - list_for_each_entry(tmp_adev, &hive->device_list, gmc.xgmi.head) { - list_add_tail(&tmp_adev->reset_list, &device_list); -- if (gpu_reset_for_dev_remove && adev->shutdown) -+ if (adev->shutdown) - tmp_adev->shutdown = true; - } - if (!list_is_first(&adev->reset_list, &device_list)) -@@ -5613,10 +5591,6 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev, - - retry: /* Rest of adevs pre asic reset from XGMI hive. */ - list_for_each_entry(tmp_adev, device_list_handle, reset_list) { -- if (gpu_reset_for_dev_remove) { -- /* Workaroud for ASICs need to disable SMC first */ -- amdgpu_device_smu_fini_early(tmp_adev); -- } - r = amdgpu_device_pre_asic_reset(tmp_adev, reset_context); - /*TODO Should we stop ?*/ - if (r) { -@@ -5648,9 +5622,6 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev, - r = amdgpu_do_asic_reset(device_list_handle, reset_context); - if (r && r == -EAGAIN) - goto retry; -- -- if (!r && gpu_reset_for_dev_remove) -- goto recover_end; - } - - skip_hw_reset: -@@ -5706,7 +5677,6 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev, - amdgpu_ras_set_error_query_ready(tmp_adev, true); - } - --recover_end: - tmp_adev = list_first_entry(device_list_handle, struct amdgpu_device, - reset_list); - amdgpu_device_unlock_reset_domain(tmp_adev->reset_domain); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -index 76084802426e..f4174eebe993 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -@@ -2315,38 +2315,6 @@ amdgpu_pci_remove(struct pci_dev *pdev) - pm_runtime_forbid(dev->dev); - } - -- if (amdgpu_ip_version(adev, MP1_HWIP, 0) == IP_VERSION(13, 0, 2) && -- !amdgpu_sriov_vf(adev)) { -- bool need_to_reset_gpu = false; -- -- if (adev->gmc.xgmi.num_physical_nodes > 1) { -- struct amdgpu_hive_info *hive; -- -- hive = amdgpu_get_xgmi_hive(adev); -- if (hive->device_remove_count == 0) -- need_to_reset_gpu = true; -- hive->device_remove_count++; -- amdgpu_put_xgmi_hive(hive); -- } else { -- need_to_reset_gpu = true; -- } -- -- /* Workaround for ASICs need to reset SMU. -- * Called only when the first device is removed. -- */ -- if (need_to_reset_gpu) { -- struct amdgpu_reset_context reset_context; -- -- adev->shutdown = true; -- memset(&reset_context, 0, sizeof(reset_context)); -- reset_context.method = AMD_RESET_METHOD_NONE; -- reset_context.reset_req_dev = adev; -- set_bit(AMDGPU_NEED_FULL_RESET, &reset_context.flags); -- set_bit(AMDGPU_RESET_FOR_DEVICE_REMOVE, &reset_context.flags); -- amdgpu_device_gpu_recover(adev, NULL, &reset_context); -- } -- } -- - amdgpu_driver_unload_kms(dev); - - /* -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_reset.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_reset.h -index b0335a1c5e90..19899f6b9b2b 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_reset.h -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_reset.h -@@ -32,7 +32,6 @@ enum AMDGPU_RESET_FLAGS { - - AMDGPU_NEED_FULL_RESET = 0, - AMDGPU_SKIP_HW_RESET = 1, -- AMDGPU_RESET_FOR_DEVICE_REMOVE = 2, - }; - - struct amdgpu_reset_context { -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.h -index 6cab882e8061..1592c63b3099 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.h -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.h -@@ -43,7 +43,6 @@ struct amdgpu_hive_info { - } pstate; - - struct amdgpu_reset_domain *reset_domain; -- uint32_t device_remove_count; - atomic_t ras_recovery; - }; - --- -2.43.2 - -From b91a1fad85e30ff2acb35ff6072fbf0c6eef60ab Mon Sep 17 00:00:00 2001 -From: Huang Ying <ying.huang@intel.com> -Date: Fri, 8 Dec 2023 11:06:36 +0800 -Subject: [PATCH 0493/1501] cxl/port: Fix decoder initialization when - nr_targets > interleave_ways -Content-Length: 2187 -Lines: 52 - -commit d6488fee66472b468ed88d265b14aa3f04dc3bdf upstream. - -The decoder_populate_targets() helper walks all of the targets in a port -and makes sure they can be looked up in @target_map. Where @target_map -is a lookup table from target position to target id (corresponding to a -cxl_dport instance). However @target_map is only responsible for -conveying the active dport instances as indicated by interleave_ways. - -When nr_targets > interleave_ways it results in -decoder_populate_targets() walking off the end of the valid entries in -@target_map. Given target_map is initialized to 0 it results in the -dport lookup failing if position 0 is not mapped to a dport with an id -of 0: - - cxl_port port3: Failed to populate active decoder targets - cxl_port port3: Failed to add decoder - cxl_port port3: Failed to add decoder3.0 - cxl_bus_probe: cxl_port port3: probe: -6 - -This bug also highlights that when the decoder's ->targets[] array is -written in cxl_port_setup_targets() it is missing a hold of the -targets_lock to synchronize against sysfs readers of the target list. A -fix for that is saved for a later patch. - -Fixes: a5c258021689 ("cxl/bus: Populate the target list at decoder create") -Cc: <stable@vger.kernel.org> -Signed-off-by: Huang, Ying <ying.huang@intel.com> -[djbw: rewrite the changelog, find the Fixes: tag] -Co-developed-by: Dan Williams <dan.j.williams@intel.com> -Reviewed-by: Alison Schofield <alison.schofield@intel.com> -Reviewed-by: Dave Jiang <dave.jiang@intel.com> -Signed-off-by: Dan Williams <dan.j.williams@intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/cxl/core/port.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/cxl/core/port.c b/drivers/cxl/core/port.c -index b7c93bb18f6e..57495cdc181f 100644 ---- a/drivers/cxl/core/port.c -+++ b/drivers/cxl/core/port.c -@@ -1644,7 +1644,7 @@ static int decoder_populate_targets(struct cxl_switch_decoder *cxlsd, - return -EINVAL; - - write_seqlock(&cxlsd->target_lock); -- for (i = 0; i < cxlsd->nr_targets; i++) { -+ for (i = 0; i < cxlsd->cxld.interleave_ways; i++) { - struct cxl_dport *dport = find_dport(port, target_map[i]); - - if (!dport) { --- -2.43.2 - -From 7035255bb722593441a9d81535741bd817518ddc Mon Sep 17 00:00:00 2001 -From: Tadeusz Struk <tstruk@gigaio.com> -Date: Mon, 13 Nov 2023 19:03:25 +0100 -Subject: [PATCH 0494/1501] PCI/P2PDMA: Remove reference to pci_p2pdma_map_sg() -Content-Length: 1998 -Lines: 45 - -commit 9a000a72af75886e5de13f4edef7f0d788622e7d upstream. - -Update Documentation/driver-api/pci/p2pdma.rst doc and remove references to -obsolete p2pdma mapping functions. - -Fixes: 0d06132fc84b ("PCI/P2PDMA: Remove pci_p2pdma_[un]map_sg()") -Link: https://lore.kernel.org/r/20231113180325.444692-1-tstruk@gmail.com -Signed-off-by: Tadeusz Struk <tstruk@gigaio.com> -Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> -Reviewed-by: Logan Gunthorpe <logang@deltatee.com> -Cc: stable@kernel.org -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - Documentation/driver-api/pci/p2pdma.rst | 16 +++------------- - 1 file changed, 3 insertions(+), 13 deletions(-) - -diff --git a/Documentation/driver-api/pci/p2pdma.rst b/Documentation/driver-api/pci/p2pdma.rst -index 44deb52beeb4..d0b241628cf1 100644 ---- a/Documentation/driver-api/pci/p2pdma.rst -+++ b/Documentation/driver-api/pci/p2pdma.rst -@@ -83,19 +83,9 @@ this to include other types of resources like doorbells. - Client Drivers - -------------- - --A client driver typically only has to conditionally change its DMA map --routine to use the mapping function :c:func:`pci_p2pdma_map_sg()` instead --of the usual :c:func:`dma_map_sg()` function. Memory mapped in this --way does not need to be unmapped. -- --The client may also, optionally, make use of --:c:func:`is_pci_p2pdma_page()` to determine when to use the P2P mapping --functions and when to use the regular mapping functions. In some --situations, it may be more appropriate to use a flag to indicate a --given request is P2P memory and map appropriately. It is important to --ensure that struct pages that back P2P memory stay out of code that --does not have support for them as other code may treat the pages as --regular memory which may not be appropriate. -+A client driver only has to use the mapping API :c:func:`dma_map_sg()` -+and :c:func:`dma_unmap_sg()` functions as usual, and the implementation -+will do the right thing for the P2P capable memory. - - - Orchestrator Drivers --- -2.43.2 - -From ecd75791fd0212231c9289785081aa946c5d75f7 Mon Sep 17 00:00:00 2001 -From: Bjorn Helgaas <bhelgaas@google.com> -Date: Tue, 21 Nov 2023 12:36:35 -0600 -Subject: [PATCH 0495/1501] x86/pci: Reserve ECAM if BIOS didn't include it in - PNP0C02 _CRS -Content-Length: 3828 -Lines: 85 - -commit 070909e56a7d65fd0b4aad6e808966b7c634befe upstream. - -Tomasz, Sebastian, and some Proxmox users reported problems initializing -ixgbe NICs. - -I think the problem is that ECAM space described in the ACPI MCFG table is -not reserved via a PNP0C02 _CRS method as required by the PCI Firmware spec -(r3.3, sec 4.1.2), but it *is* included in the PNP0A03 host bridge _CRS as -part of the MMIO aperture. - -If we allocate space for a PCI BAR, we're likely to allocate it from that -ECAM space, which obviously cannot work. - -This could happen for any device, but in the ixgbe case it happens because -it's an SR-IOV device and the BIOS didn't allocate space for the VF BARs, -so Linux reallocated the bridge window leading to ixgbe and put it on top -of the ECAM space. From Tomasz' system: - - PCI: MMCONFIG for domain 0000 [bus 00-ff] at [mem 0x80000000-0x8fffffff] (base 0x80000000) - PCI: MMCONFIG at [mem 0x80000000-0x8fffffff] not reserved in ACPI motherboard resources - pci_bus 0000:00: root bus resource [mem 0x80000000-0xfbffffff window] - - pci 0000:00:01.1: PCI bridge to [bus 02-03] - pci 0000:00:01.1: bridge window [mem 0xfb900000-0xfbbfffff] - pci 0000:02:00.0: [8086:10fb] type 00 class 0x020000 # ixgbe - pci 0000:02:00.0: reg 0x10: [mem 0xfba80000-0xfbafffff 64bit] - pci 0000:02:00.0: VF(n) BAR0 space: [mem 0x00000000-0x000fffff 64bit] (contains BAR0 for 64 VFs) - pci 0000:02:00.0: BAR 7: no space for [mem size 0x00100000 64bit] # VF BAR 0 - - pci_bus 0000:00: No. 2 try to assign unassigned res - pci 0000:00:01.1: resource 14 [mem 0xfb900000-0xfbbfffff] released - pci 0000:00:01.1: BAR 14: assigned [mem 0x80000000-0x806fffff] - pci 0000:02:00.0: BAR 0: assigned [mem 0x80000000-0x8007ffff 64bit] - pci 0000:02:00.0: BAR 7: assigned [mem 0x80204000-0x80303fff 64bit] # VF BAR 0 - -Fixes: 07eab0901ede ("efi/x86: Remove EfiMemoryMappedIO from E820 map") -Fixes: fd3a8cff4d4a ("x86/pci: Treat EfiMemoryMappedIO as reservation of ECAM space") -Reported-by: Tomasz Pala <gotar@polanet.pl> -Link: https://bugzilla.kernel.org/show_bug.cgi?id=218050 -Reported-by: Sebastian Manciulea <manciuleas@protonmail.com> -Link: https://bugzilla.kernel.org/show_bug.cgi?id=218107 -Link: https://forum.proxmox.com/threads/proxmox-8-kernel-6-2-16-4-pve-ixgbe-driver-fails-to-load-due-to-pci-device-probing-failure.131203/ -Link: https://lore.kernel.org/r/20231121183643.249006-2-helgaas@kernel.org -Tested-by: Tomasz Pala <gotar@polanet.pl> -Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> -Cc: stable@vger.kernel.org # v6.2+ -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/x86/pci/mmconfig-shared.c | 13 ++++++++++++- - 1 file changed, 12 insertions(+), 1 deletion(-) - -diff --git a/arch/x86/pci/mmconfig-shared.c b/arch/x86/pci/mmconfig-shared.c -index 4b3efaa82ab7..e9497ee0f854 100644 ---- a/arch/x86/pci/mmconfig-shared.c -+++ b/arch/x86/pci/mmconfig-shared.c -@@ -525,6 +525,8 @@ static bool __ref is_mmconf_reserved(check_reserved_t is_reserved, - static bool __ref - pci_mmcfg_check_reserved(struct device *dev, struct pci_mmcfg_region *cfg, int early) - { -+ struct resource *conflict; -+ - if (!early && !acpi_disabled) { - if (is_mmconf_reserved(is_acpi_reserved, cfg, dev, - "ACPI motherboard resource")) -@@ -542,8 +544,17 @@ pci_mmcfg_check_reserved(struct device *dev, struct pci_mmcfg_region *cfg, int e - &cfg->res); - - if (is_mmconf_reserved(is_efi_mmio, cfg, dev, -- "EfiMemoryMappedIO")) -+ "EfiMemoryMappedIO")) { -+ conflict = insert_resource_conflict(&iomem_resource, -+ &cfg->res); -+ if (conflict) -+ pr_warn("MMCONFIG %pR conflicts with %s %pR\n", -+ &cfg->res, conflict->name, conflict); -+ else -+ pr_info("MMCONFIG %pR reserved to work around lack of ACPI motherboard _CRS\n", -+ &cfg->res); - return true; -+ } - } - - /* --- -2.43.2 - -From 9be44b06cad12cc3aef3cf59442715574b70bbee Mon Sep 17 00:00:00 2001 -From: Niklas Cassel <niklas.cassel@wdc.com> -Date: Tue, 28 Nov 2023 14:22:30 +0100 -Subject: [PATCH 0496/1501] PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() - alignment support -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1809 -Lines: 42 - -commit 2217fffcd63f86776c985d42e76daa43a56abdf1 upstream. - -Commit 6f5e193bfb55 ("PCI: dwc: Fix dw_pcie_ep_raise_msix_irq() to get -correct MSI-X table address") modified dw_pcie_ep_raise_msix_irq() to -support iATUs which require a specific alignment. - -However, this support cannot have been properly tested. - -The whole point is for the iATU to map an address that is aligned, -using dw_pcie_ep_map_addr(), and then let the writel() write to -ep->msi_mem + aligned_offset. - -Thus, modify the address that is mapped such that it is aligned. -With this change, dw_pcie_ep_raise_msix_irq() matches the logic in -dw_pcie_ep_raise_msi_irq(). - -Link: https://lore.kernel.org/linux-pci/20231128132231.2221614-1-nks@flawful.org -Fixes: 6f5e193bfb55 ("PCI: dwc: Fix dw_pcie_ep_raise_msix_irq() to get correct MSI-X table address") -Signed-off-by: Niklas Cassel <niklas.cassel@wdc.com> -Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org> -Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> -Cc: stable@vger.kernel.org # 5.7 -Cc: Kishon Vijay Abraham I <kishon@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/pci/controller/dwc/pcie-designware-ep.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c -index f6207989fc6a..bc94d7f39535 100644 ---- a/drivers/pci/controller/dwc/pcie-designware-ep.c -+++ b/drivers/pci/controller/dwc/pcie-designware-ep.c -@@ -615,6 +615,7 @@ int dw_pcie_ep_raise_msix_irq(struct dw_pcie_ep *ep, u8 func_no, - } - - aligned_offset = msg_addr & (epc->mem->window.page_size - 1); -+ msg_addr &= ~aligned_offset; - ret = dw_pcie_ep_map_addr(epc, func_no, 0, ep->msi_mem_phys, msg_addr, - epc->mem->window.page_size); - if (ret) --- -2.43.2 - -From aba43504dd0a07ae3c7d9093aa6e1d8da1ab2f3d Mon Sep 17 00:00:00 2001 -From: qizhong cheng <qizhong.cheng@mediatek.com> -Date: Mon, 11 Dec 2023 17:49:23 +0800 -Subject: [PATCH 0497/1501] PCI: mediatek: Clear interrupt status before - dispatching handler -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2204 -Lines: 52 - -commit 4e11c29873a8a296a20f99b3e03095e65ebf897d upstream. - -We found a failure when using the iperf tool during WiFi performance -testing, where some MSIs were received while clearing the interrupt -status, and these MSIs cannot be serviced. - -The interrupt status can be cleared even if the MSI status remains pending. -As such, given the edge-triggered interrupt type, its status should be -cleared before being dispatched to the handler of the underling device. - -[kwilczynski: commit log, code comment wording] -Link: https://lore.kernel.org/linux-pci/20231211094923.31967-1-jianjun.wang@mediatek.com -Fixes: 43e6409db64d ("PCI: mediatek: Add MSI support for MT2712 and MT7622") -Signed-off-by: qizhong cheng <qizhong.cheng@mediatek.com> -Signed-off-by: Jianjun Wang <jianjun.wang@mediatek.com> -Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org> -[bhelgaas: rewrap comment] -Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> -Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> -Cc: <stable@vger.kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/pci/controller/pcie-mediatek.c | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - -diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c -index 66a8f73296fc..48372013f26d 100644 ---- a/drivers/pci/controller/pcie-mediatek.c -+++ b/drivers/pci/controller/pcie-mediatek.c -@@ -617,12 +617,18 @@ static void mtk_pcie_intr_handler(struct irq_desc *desc) - if (status & MSI_STATUS){ - unsigned long imsi_status; - -+ /* -+ * The interrupt status can be cleared even if the -+ * MSI status remains pending. As such, given the -+ * edge-triggered interrupt type, its status should -+ * be cleared before being dispatched to the -+ * handler of the underlying device. -+ */ -+ writel(MSI_STATUS, port->base + PCIE_INT_STATUS); - while ((imsi_status = readl(port->base + PCIE_IMSI_STATUS))) { - for_each_set_bit(bit, &imsi_status, MTK_MSI_IRQS_NUM) - generic_handle_domain_irq(port->inner_domain, bit); - } -- /* Clear MSI interrupt status */ -- writel(MSI_STATUS, port->base + PCIE_INT_STATUS); - } - } - --- -2.43.2 - -From 6ae0335be2b9d5741719b04073bbd4cff544b56a Mon Sep 17 00:00:00 2001 -From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> -Date: Tue, 5 Dec 2023 03:45:01 +0300 -Subject: [PATCH 0499/1501] x86/kvm: Do not try to disable kvmclock if it was - not enabled -Content-Length: 2491 -Lines: 67 - -commit 1c6d984f523f67ecfad1083bb04c55d91977bb15 upstream. - -kvm_guest_cpu_offline() tries to disable kvmclock regardless if it is -present in the VM. It leads to write to a MSR that doesn't exist on some -configurations, namely in TDX guest: - - unchecked MSR access error: WRMSR to 0x12 (tried to write 0x0000000000000000) - at rIP: 0xffffffff8110687c (kvmclock_disable+0x1c/0x30) - -kvmclock enabling is gated by CLOCKSOURCE and CLOCKSOURCE2 KVM paravirt -features. - -Do not disable kvmclock if it was not enabled. - -Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> -Fixes: c02027b5742b ("x86/kvm: Disable kvmclock on all CPUs on shutdown") -Reviewed-by: Sean Christopherson <seanjc@google.com> -Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com> -Cc: Paolo Bonzini <pbonzini@redhat.com> -Cc: Wanpeng Li <wanpengli@tencent.com> -Cc: stable@vger.kernel.org -Message-Id: <20231205004510.27164-6-kirill.shutemov@linux.intel.com> -Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/x86/kernel/kvmclock.c | 12 ++++++++---- - 1 file changed, 8 insertions(+), 4 deletions(-) - -diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c -index fb8f52149be9..f2fff625576d 100644 ---- a/arch/x86/kernel/kvmclock.c -+++ b/arch/x86/kernel/kvmclock.c -@@ -24,8 +24,8 @@ - - static int kvmclock __initdata = 1; - static int kvmclock_vsyscall __initdata = 1; --static int msr_kvm_system_time __ro_after_init = MSR_KVM_SYSTEM_TIME; --static int msr_kvm_wall_clock __ro_after_init = MSR_KVM_WALL_CLOCK; -+static int msr_kvm_system_time __ro_after_init; -+static int msr_kvm_wall_clock __ro_after_init; - static u64 kvm_sched_clock_offset __ro_after_init; - - static int __init parse_no_kvmclock(char *arg) -@@ -195,7 +195,8 @@ static void kvm_setup_secondary_clock(void) - - void kvmclock_disable(void) - { -- native_write_msr(msr_kvm_system_time, 0, 0); -+ if (msr_kvm_system_time) -+ native_write_msr(msr_kvm_system_time, 0, 0); - } - - static void __init kvmclock_init_mem(void) -@@ -294,7 +295,10 @@ void __init kvmclock_init(void) - if (kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE2)) { - msr_kvm_system_time = MSR_KVM_SYSTEM_TIME_NEW; - msr_kvm_wall_clock = MSR_KVM_WALL_CLOCK_NEW; -- } else if (!kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE)) { -+ } else if (kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE)) { -+ msr_kvm_system_time = MSR_KVM_SYSTEM_TIME; -+ msr_kvm_wall_clock = MSR_KVM_WALL_CLOCK; -+ } else { - return; - } - --- -2.43.2 - -From 85e99dffcfbd9ee9ef75d1b75a271c9d92259525 Mon Sep 17 00:00:00 2001 -From: Marc Zyngier <maz@kernel.org> -Date: Sun, 17 Dec 2023 11:15:09 +0000 -Subject: [PATCH 0500/1501] KVM: arm64: vgic-v4: Restore pending state on host - userspace write -Content-Length: 2304 -Lines: 66 - -commit 7b95382f965133ef61ce44aaabc518c16eb46909 upstream. - -When the VMM writes to ISPENDR0 to set the state pending state of -an SGI, we fail to convey this to the HW if this SGI is already -backed by a GICv4.1 vSGI. - -This is a bit of a corner case, as this would only occur if the -vgic state is changed on an already running VM, but this can -apparently happen across a guest reset driven by the VMM. - -Fix this by always writing out the pending_latch value to the -HW, and reseting it to false. - -Reported-by: Kunkun Jiang <jiangkunkun@huawei.com> -Signed-off-by: Marc Zyngier <maz@kernel.org> -Reviewed-by: Zenghui Yu <yuzenghui@huawei.com> -Cc: stable@vger.kernel.org # 5.10+ -Link: https://lore.kernel.org/r/7e7f2c0c-448b-10a9-8929-4b8f4f6e2a32@huawei.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/arm64/kvm/vgic/vgic-mmio-v3.c | 27 +++++++++++++++++---------- - 1 file changed, 17 insertions(+), 10 deletions(-) - -diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c -index a764b0ab8bf9..2533f264b954 100644 ---- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c -+++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c -@@ -365,19 +365,26 @@ static int vgic_v3_uaccess_write_pending(struct kvm_vcpu *vcpu, - struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i); - - raw_spin_lock_irqsave(&irq->irq_lock, flags); -- if (test_bit(i, &val)) { -- /* -- * pending_latch is set irrespective of irq type -- * (level or edge) to avoid dependency that VM should -- * restore irq config before pending info. -- */ -- irq->pending_latch = true; -- vgic_queue_irq_unlock(vcpu->kvm, irq, flags); -- } else { -+ -+ /* -+ * pending_latch is set irrespective of irq type -+ * (level or edge) to avoid dependency that VM should -+ * restore irq config before pending info. -+ */ -+ irq->pending_latch = test_bit(i, &val); -+ -+ if (irq->hw && vgic_irq_is_sgi(irq->intid)) { -+ irq_set_irqchip_state(irq->host_irq, -+ IRQCHIP_STATE_PENDING, -+ irq->pending_latch); - irq->pending_latch = false; -- raw_spin_unlock_irqrestore(&irq->irq_lock, flags); - } - -+ if (irq->pending_latch) -+ vgic_queue_irq_unlock(vcpu->kvm, irq, flags); -+ else -+ raw_spin_unlock_irqrestore(&irq->irq_lock, flags); -+ - vgic_put_irq(vcpu->kvm, irq); - } - --- -2.43.2 - -From dd3956a1b3dd11f46488c928cb890d6937d1ca80 Mon Sep 17 00:00:00 2001 -From: Oliver Upton <oliver.upton@linux.dev> -Date: Thu, 4 Jan 2024 18:32:32 +0000 -Subject: [PATCH 0501/1501] KVM: arm64: vgic-its: Avoid potential UAF in LPI - translation cache -Content-Length: 1683 -Lines: 46 - -commit ad362fe07fecf0aba839ff2cc59a3617bd42c33f upstream. - -There is a potential UAF scenario in the case of an LPI translation -cache hit racing with an operation that invalidates the cache, such -as a DISCARD ITS command. The root of the problem is that -vgic_its_check_cache() does not elevate the refcount on the vgic_irq -before dropping the lock that serializes refcount changes. - -Have vgic_its_check_cache() raise the refcount on the returned vgic_irq -and add the corresponding decrement after queueing the interrupt. - -Cc: stable@vger.kernel.org -Signed-off-by: Oliver Upton <oliver.upton@linux.dev> -Signed-off-by: Marc Zyngier <maz@kernel.org> -Link: https://lore.kernel.org/r/20240104183233.3560639-1-oliver.upton@linux.dev -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/arm64/kvm/vgic/vgic-its.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c -index 2dad2d095160..e2764d0ffa9f 100644 ---- a/arch/arm64/kvm/vgic/vgic-its.c -+++ b/arch/arm64/kvm/vgic/vgic-its.c -@@ -590,7 +590,11 @@ static struct vgic_irq *vgic_its_check_cache(struct kvm *kvm, phys_addr_t db, - unsigned long flags; - - raw_spin_lock_irqsave(&dist->lpi_list_lock, flags); -+ - irq = __vgic_its_check_cache(dist, db, devid, eventid); -+ if (irq) -+ vgic_get_irq_kref(irq); -+ - raw_spin_unlock_irqrestore(&dist->lpi_list_lock, flags); - - return irq; -@@ -769,6 +773,7 @@ int vgic_its_inject_cached_translation(struct kvm *kvm, struct kvm_msi *msi) - raw_spin_lock_irqsave(&irq->irq_lock, flags); - irq->pending_latch = true; - vgic_queue_irq_unlock(kvm, irq, flags); -+ vgic_put_irq(kvm, irq); - - return 0; - } --- -2.43.2 - -From 9da7b20451d2a742ecdbc0fc2ebb5f675d4c2084 Mon Sep 17 00:00:00 2001 -From: Sean Christopherson <seanjc@google.com> -Date: Fri, 3 Nov 2023 16:05:36 -0700 -Subject: [PATCH 0502/1501] KVM: x86/pmu: Move PMU reset logic to common x86 - code -Content-Length: 5951 -Lines: 199 - -commit cbb359d81a2695bb5e63ec9de06fcbef28518891 upstream. - -Move the common (or at least "ignored") aspects of resetting the vPMU to -common x86 code, along with the stop/release helpers that are no used only -by the common pmu.c. - -There is no need to manually handle fixed counters as all_valid_pmc_idx -tracks both fixed and general purpose counters, and resetting the vPMU is -far from a hot path, i.e. the extra bit of overhead to the PMC from the -index is a non-issue. - -Zero fixed_ctr_ctrl in common code even though it's Intel specific. -Ensuring it's zero doesn't harm AMD/SVM in any way, and stopping the fixed -counters via all_valid_pmc_idx, but not clearing the associated control -bits, would be odd/confusing. - -Make the .reset() hook optional as SVM no longer needs vendor specific -handling. - -Cc: stable@vger.kernel.org -Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> -Link: https://lore.kernel.org/r/20231103230541.352265-2-seanjc@google.com -Signed-off-by: Sean Christopherson <seanjc@google.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/x86/include/asm/kvm-x86-pmu-ops.h | 2 +- - arch/x86/kvm/pmu.c | 40 +++++++++++++++++++++++++- - arch/x86/kvm/pmu.h | 18 ------------ - arch/x86/kvm/svm/pmu.c | 16 ----------- - arch/x86/kvm/vmx/pmu_intel.c | 20 ------------- - 5 files changed, 40 insertions(+), 56 deletions(-) - -diff --git a/arch/x86/include/asm/kvm-x86-pmu-ops.h b/arch/x86/include/asm/kvm-x86-pmu-ops.h -index 6c98f4bb4228..058bc636356a 100644 ---- a/arch/x86/include/asm/kvm-x86-pmu-ops.h -+++ b/arch/x86/include/asm/kvm-x86-pmu-ops.h -@@ -22,7 +22,7 @@ KVM_X86_PMU_OP(get_msr) - KVM_X86_PMU_OP(set_msr) - KVM_X86_PMU_OP(refresh) - KVM_X86_PMU_OP(init) --KVM_X86_PMU_OP(reset) -+KVM_X86_PMU_OP_OPTIONAL(reset) - KVM_X86_PMU_OP_OPTIONAL(deliver_pmi) - KVM_X86_PMU_OP_OPTIONAL(cleanup) - -diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c -index 9ae07db6f0f6..027e9c3c2b93 100644 ---- a/arch/x86/kvm/pmu.c -+++ b/arch/x86/kvm/pmu.c -@@ -250,6 +250,24 @@ static bool pmc_resume_counter(struct kvm_pmc *pmc) - return true; - } - -+static void pmc_release_perf_event(struct kvm_pmc *pmc) -+{ -+ if (pmc->perf_event) { -+ perf_event_release_kernel(pmc->perf_event); -+ pmc->perf_event = NULL; -+ pmc->current_config = 0; -+ pmc_to_pmu(pmc)->event_count--; -+ } -+} -+ -+static void pmc_stop_counter(struct kvm_pmc *pmc) -+{ -+ if (pmc->perf_event) { -+ pmc->counter = pmc_read_counter(pmc); -+ pmc_release_perf_event(pmc); -+ } -+} -+ - static int filter_cmp(const void *pa, const void *pb, u64 mask) - { - u64 a = *(u64 *)pa & mask; -@@ -654,7 +672,27 @@ void kvm_pmu_refresh(struct kvm_vcpu *vcpu) - - void kvm_pmu_reset(struct kvm_vcpu *vcpu) - { -- static_call(kvm_x86_pmu_reset)(vcpu); -+ struct kvm_pmu *pmu = vcpu_to_pmu(vcpu); -+ struct kvm_pmc *pmc; -+ int i; -+ -+ bitmap_zero(pmu->reprogram_pmi, X86_PMC_IDX_MAX); -+ -+ for_each_set_bit(i, pmu->all_valid_pmc_idx, X86_PMC_IDX_MAX) { -+ pmc = static_call(kvm_x86_pmu_pmc_idx_to_pmc)(pmu, i); -+ if (!pmc) -+ continue; -+ -+ pmc_stop_counter(pmc); -+ pmc->counter = 0; -+ -+ if (pmc_is_gp(pmc)) -+ pmc->eventsel = 0; -+ } -+ -+ pmu->fixed_ctr_ctrl = pmu->global_ctrl = pmu->global_status = 0; -+ -+ static_call_cond(kvm_x86_pmu_reset)(vcpu); - } - - void kvm_pmu_init(struct kvm_vcpu *vcpu) -diff --git a/arch/x86/kvm/pmu.h b/arch/x86/kvm/pmu.h -index 1d64113de488..a46aa9b25150 100644 ---- a/arch/x86/kvm/pmu.h -+++ b/arch/x86/kvm/pmu.h -@@ -80,24 +80,6 @@ static inline void pmc_write_counter(struct kvm_pmc *pmc, u64 val) - pmc->counter &= pmc_bitmask(pmc); - } - --static inline void pmc_release_perf_event(struct kvm_pmc *pmc) --{ -- if (pmc->perf_event) { -- perf_event_release_kernel(pmc->perf_event); -- pmc->perf_event = NULL; -- pmc->current_config = 0; -- pmc_to_pmu(pmc)->event_count--; -- } --} -- --static inline void pmc_stop_counter(struct kvm_pmc *pmc) --{ -- if (pmc->perf_event) { -- pmc->counter = pmc_read_counter(pmc); -- pmc_release_perf_event(pmc); -- } --} -- - static inline bool pmc_is_gp(struct kvm_pmc *pmc) - { - return pmc->type == KVM_PMC_GP; -diff --git a/arch/x86/kvm/svm/pmu.c b/arch/x86/kvm/svm/pmu.c -index 373ff6a6687b..3fd47de14b38 100644 ---- a/arch/x86/kvm/svm/pmu.c -+++ b/arch/x86/kvm/svm/pmu.c -@@ -233,21 +233,6 @@ static void amd_pmu_init(struct kvm_vcpu *vcpu) - } - } - --static void amd_pmu_reset(struct kvm_vcpu *vcpu) --{ -- struct kvm_pmu *pmu = vcpu_to_pmu(vcpu); -- int i; -- -- for (i = 0; i < KVM_AMD_PMC_MAX_GENERIC; i++) { -- struct kvm_pmc *pmc = &pmu->gp_counters[i]; -- -- pmc_stop_counter(pmc); -- pmc->counter = pmc->prev_counter = pmc->eventsel = 0; -- } -- -- pmu->global_ctrl = pmu->global_status = 0; --} -- - struct kvm_pmu_ops amd_pmu_ops __initdata = { - .hw_event_available = amd_hw_event_available, - .pmc_idx_to_pmc = amd_pmc_idx_to_pmc, -@@ -259,7 +244,6 @@ struct kvm_pmu_ops amd_pmu_ops __initdata = { - .set_msr = amd_pmu_set_msr, - .refresh = amd_pmu_refresh, - .init = amd_pmu_init, -- .reset = amd_pmu_reset, - .EVENTSEL_EVENT = AMD64_EVENTSEL_EVENT, - .MAX_NR_GP_COUNTERS = KVM_AMD_PMC_MAX_GENERIC, - .MIN_NR_GP_COUNTERS = AMD64_NUM_COUNTERS, -diff --git a/arch/x86/kvm/vmx/pmu_intel.c b/arch/x86/kvm/vmx/pmu_intel.c -index 820d3e1f6b4f..90c1f7f07e53 100644 ---- a/arch/x86/kvm/vmx/pmu_intel.c -+++ b/arch/x86/kvm/vmx/pmu_intel.c -@@ -632,26 +632,6 @@ static void intel_pmu_init(struct kvm_vcpu *vcpu) - - static void intel_pmu_reset(struct kvm_vcpu *vcpu) - { -- struct kvm_pmu *pmu = vcpu_to_pmu(vcpu); -- struct kvm_pmc *pmc = NULL; -- int i; -- -- for (i = 0; i < KVM_INTEL_PMC_MAX_GENERIC; i++) { -- pmc = &pmu->gp_counters[i]; -- -- pmc_stop_counter(pmc); -- pmc->counter = pmc->prev_counter = pmc->eventsel = 0; -- } -- -- for (i = 0; i < KVM_PMC_MAX_FIXED; i++) { -- pmc = &pmu->fixed_counters[i]; -- -- pmc_stop_counter(pmc); -- pmc->counter = pmc->prev_counter = 0; -- } -- -- pmu->fixed_ctr_ctrl = pmu->global_ctrl = pmu->global_status = 0; -- - intel_pmu_release_guest_lbr_event(vcpu); - } - --- -2.43.2 - -From 535326c4817a5a8e68cd9141420b6bffefdd2e34 Mon Sep 17 00:00:00 2001 -From: Sean Christopherson <seanjc@google.com> -Date: Fri, 3 Nov 2023 16:05:37 -0700 -Subject: [PATCH 0503/1501] KVM: x86/pmu: Reset the PMU, i.e. stop counters, - before refreshing -Content-Length: 2404 -Lines: 80 - -commit 1647b52757d59131fe30cf73fa36fac834d4367f upstream. - -Stop all counters and release all perf events before refreshing the vPMU, -i.e. before reconfiguring the vPMU to respond to changes in the vCPU -model. - -Clear need_cleanup in kvm_pmu_reset() as well so that KVM doesn't -prematurely stop counters, e.g. if KVM enters the guest and enables -counters before the vCPU is scheduled out. - -Cc: stable@vger.kernel.org -Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> -Link: https://lore.kernel.org/r/20231103230541.352265-3-seanjc@google.com -Signed-off-by: Sean Christopherson <seanjc@google.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/x86/kvm/pmu.c | 35 ++++++++++++++++++++++------------- - 1 file changed, 22 insertions(+), 13 deletions(-) - -diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c -index 027e9c3c2b93..dc8e8e907cfb 100644 ---- a/arch/x86/kvm/pmu.c -+++ b/arch/x86/kvm/pmu.c -@@ -657,25 +657,14 @@ int kvm_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - return 0; - } - --/* refresh PMU settings. This function generally is called when underlying -- * settings are changed (such as changes of PMU CPUID by guest VMs), which -- * should rarely happen. -- */ --void kvm_pmu_refresh(struct kvm_vcpu *vcpu) --{ -- if (KVM_BUG_ON(kvm_vcpu_has_run(vcpu), vcpu->kvm)) -- return; -- -- bitmap_zero(vcpu_to_pmu(vcpu)->all_valid_pmc_idx, X86_PMC_IDX_MAX); -- static_call(kvm_x86_pmu_refresh)(vcpu); --} -- - void kvm_pmu_reset(struct kvm_vcpu *vcpu) - { - struct kvm_pmu *pmu = vcpu_to_pmu(vcpu); - struct kvm_pmc *pmc; - int i; - -+ pmu->need_cleanup = false; -+ - bitmap_zero(pmu->reprogram_pmi, X86_PMC_IDX_MAX); - - for_each_set_bit(i, pmu->all_valid_pmc_idx, X86_PMC_IDX_MAX) { -@@ -695,6 +684,26 @@ void kvm_pmu_reset(struct kvm_vcpu *vcpu) - static_call_cond(kvm_x86_pmu_reset)(vcpu); - } - -+ -+/* -+ * Refresh the PMU configuration for the vCPU, e.g. if userspace changes CPUID -+ * and/or PERF_CAPABILITIES. -+ */ -+void kvm_pmu_refresh(struct kvm_vcpu *vcpu) -+{ -+ if (KVM_BUG_ON(kvm_vcpu_has_run(vcpu), vcpu->kvm)) -+ return; -+ -+ /* -+ * Stop/release all existing counters/events before realizing the new -+ * vPMU model. -+ */ -+ kvm_pmu_reset(vcpu); -+ -+ bitmap_zero(vcpu_to_pmu(vcpu)->all_valid_pmc_idx, X86_PMC_IDX_MAX); -+ static_call(kvm_x86_pmu_refresh)(vcpu); -+} -+ - void kvm_pmu_init(struct kvm_vcpu *vcpu) - { - struct kvm_pmu *pmu = vcpu_to_pmu(vcpu); --- -2.43.2 - -From 3ab655125a76d24260903fcdc5408c24d4ac6756 Mon Sep 17 00:00:00 2001 -From: Marcelo Schmitt <marcelo.schmitt@analog.com> -Date: Sat, 16 Dec 2023 14:46:11 -0300 -Subject: [PATCH 0504/1501] iio: adc: ad7091r: Pass iio_dev to event handler -Content-Length: 1928 -Lines: 47 - -commit a25a7df518fc71b1ba981d691e9322e645d2689c upstream. - -Previous version of ad7091r event handler received the ADC state pointer -and retrieved the iio device from driver data field with dev_get_drvdata(). -However, no driver data have ever been set, which led to null pointer -dereference when running the event handler. - -Pass the iio device to the event handler and retrieve the ADC state struct -from it so we avoid the null pointer dereference and save the driver from -filling the driver data field. - -Fixes: ca69300173b6 ("iio: adc: Add support for AD7091R5 ADC") -Signed-off-by: Marcelo Schmitt <marcelo.schmitt@analog.com> -Link: https://lore.kernel.org/r/5024b764107463de9578d5b3b0a3d5678e307b1a.1702746240.git.marcelo.schmitt1@gmail.com -Cc: <Stable@vger.kernel.org> -Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/iio/adc/ad7091r-base.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/iio/adc/ad7091r-base.c b/drivers/iio/adc/ad7091r-base.c -index 8e252cde735b..0e5d3d2e9c98 100644 ---- a/drivers/iio/adc/ad7091r-base.c -+++ b/drivers/iio/adc/ad7091r-base.c -@@ -174,8 +174,8 @@ static const struct iio_info ad7091r_info = { - - static irqreturn_t ad7091r_event_handler(int irq, void *private) - { -- struct ad7091r_state *st = (struct ad7091r_state *) private; -- struct iio_dev *iio_dev = dev_get_drvdata(st->dev); -+ struct iio_dev *iio_dev = private; -+ struct ad7091r_state *st = iio_priv(iio_dev); - unsigned int i, read_val; - int ret; - s64 timestamp = iio_get_time_ns(iio_dev); -@@ -234,7 +234,7 @@ int ad7091r_probe(struct device *dev, const char *name, - if (irq) { - ret = devm_request_threaded_irq(dev, irq, NULL, - ad7091r_event_handler, -- IRQF_TRIGGER_FALLING | IRQF_ONESHOT, name, st); -+ IRQF_TRIGGER_FALLING | IRQF_ONESHOT, name, iio_dev); - if (ret) - return ret; - } --- -2.43.2 - -From 388cd2685ec9d7d56ff7c005b5c056d3df53ff28 Mon Sep 17 00:00:00 2001 -From: Yauhen Kharuzhy <jekhor@gmail.com> -Date: Wed, 20 Dec 2023 01:15:03 +0200 -Subject: [PATCH 0505/1501] HID: sensor-hub: Enable hid core report processing - for all devices -Content-Length: 1735 -Lines: 45 - -commit 8e2f79f41a5d1b1a4a53ec524eb7609ca89f3c65 upstream. - -After the commit 666cf30a589a ("HID: sensor-hub: Allow multi-function -sensor devices") hub devices are claimed by hidraw driver in hid_connect(). -This causes stoppping of processing HID reports by hid core due to -optimization. - -In such case, the hid-sensor-custom driver cannot match a known custom -sensor in hid_sensor_custom_get_known() because it try to check custom -properties which weren't filled from the report because hid core didn't -parsed it. - -As result, custom sensors like hinge angle sensor and LISS sensors -don't work. - -Mark the sensor hub devices claimed by some driver to avoid hidraw-related -optimizations. - -Fixes: 666cf30a589a ("HID: sensor-hub: Allow multi-function sensor devices") -Cc: stable@vger.kernel.org -Signed-off-by: Yauhen Kharuzhy <jekhor@gmail.com> -Tested-by: Daniel Thompson <daniel.thompson@linaro.org> -Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> -Link: https://lore.kernel.org/r/20231219231503.1506801-1-jekhor@gmail.com -Signed-off-by: Benjamin Tissoires <bentiss@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/hid/hid-sensor-hub.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c -index 2eba152e8b90..26e93a331a51 100644 ---- a/drivers/hid/hid-sensor-hub.c -+++ b/drivers/hid/hid-sensor-hub.c -@@ -632,7 +632,7 @@ static int sensor_hub_probe(struct hid_device *hdev, - } - INIT_LIST_HEAD(&hdev->inputs); - -- ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT); -+ ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT | HID_CONNECT_DRIVER); - if (ret) { - hid_err(hdev, "hw start failed\n"); - return ret; --- -2.43.2 - -From c1f8575a099b2477fc0d2264ff483d8ae9c79461 Mon Sep 17 00:00:00 2001 -From: Jason Gerecke <jason.gerecke@wacom.com> -Date: Tue, 19 Dec 2023 13:33:43 -0800 -Subject: [PATCH 0506/1501] HID: wacom: Correct behavior when processing some - confidence == false touches -Content-Length: 3815 -Lines: 100 - -commit 502296030ec6b0329e00f9fb15018e170cc63037 upstream. - -There appear to be a few different ways that Wacom devices can deal with -confidence: - - 1. If the device looses confidence in a touch, it will first clear - the tipswitch flag in one report, and then clear the confidence - flag in a second report. This behavior is used by e.g. DTH-2452. - - 2. If the device looses confidence in a touch, it will clear both - the tipswitch and confidence flags within the same report. This - behavior is used by some AES devices. - - 3. If the device looses confidence in a touch, it will clear *only* - the confidence bit. The tipswitch bit will remain set so long as - the touch is tracked. This behavior may be used in future devices. - -The driver does not currently handle situation 3 properly. Touches that -loose confidence will remain "in prox" and essentially frozen in place -until the tipswitch bit is finally cleared. Not only does this result -in userspace seeing a stuck touch, but it also prevents pen arbitration -from working properly (the pen won't send events until all touches are -up, but we don't currently process events from non-confident touches). - -This commit centralizes the checking of the confidence bit in the -wacom_wac_finger_slot() function and has 'prox' depend on it. In the -case where situation 3 is encountered, the treat the touch as though -it was removed, allowing both userspace and the pen arbitration to -act normally. - -Signed-off-by: Tatsunosuke Tobita <tatsunosuke.tobita@wacom.com> -Signed-off-by: Ping Cheng <ping.cheng@wacom.com> -Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> -Fixes: 7fb0413baa7f ("HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts") -Cc: stable@vger.kernel.org -Signed-off-by: Jiri Kosina <jkosina@suse.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/hid/wacom_wac.c | 32 ++++---------------------------- - 1 file changed, 4 insertions(+), 28 deletions(-) - -diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c -index 471db78dbbf0..8289ce763704 100644 ---- a/drivers/hid/wacom_wac.c -+++ b/drivers/hid/wacom_wac.c -@@ -2649,8 +2649,8 @@ static void wacom_wac_finger_slot(struct wacom_wac *wacom_wac, - { - struct hid_data *hid_data = &wacom_wac->hid_data; - bool mt = wacom_wac->features.touch_max > 1; -- bool prox = hid_data->tipswitch && -- report_touch_events(wacom_wac); -+ bool touch_down = hid_data->tipswitch && hid_data->confidence; -+ bool prox = touch_down && report_touch_events(wacom_wac); - - if (touch_is_muted(wacom_wac)) { - if (!wacom_wac->shared->touch_down) -@@ -2700,24 +2700,6 @@ static void wacom_wac_finger_slot(struct wacom_wac *wacom_wac, - } - } - --static bool wacom_wac_slot_is_active(struct input_dev *dev, int key) --{ -- struct input_mt *mt = dev->mt; -- struct input_mt_slot *s; -- -- if (!mt) -- return false; -- -- for (s = mt->slots; s != mt->slots + mt->num_slots; s++) { -- if (s->key == key && -- input_mt_get_value(s, ABS_MT_TRACKING_ID) >= 0) { -- return true; -- } -- } -- -- return false; --} -- - static void wacom_wac_finger_event(struct hid_device *hdev, - struct hid_field *field, struct hid_usage *usage, __s32 value) - { -@@ -2768,14 +2750,8 @@ static void wacom_wac_finger_event(struct hid_device *hdev, - } - - if (usage->usage_index + 1 == field->report_count) { -- if (equivalent_usage == wacom_wac->hid_data.last_slot_field) { -- bool touch_removed = wacom_wac_slot_is_active(wacom_wac->touch_input, -- wacom_wac->hid_data.id) && !wacom_wac->hid_data.tipswitch; -- -- if (wacom_wac->hid_data.confidence || touch_removed) { -- wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input); -- } -- } -+ if (equivalent_usage == wacom_wac->hid_data.last_slot_field) -+ wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input); - } - } - --- -2.43.2 - -From 86f905b386a06419af648b8de8d81a644454b1e3 Mon Sep 17 00:00:00 2001 -From: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Date: Thu, 21 Dec 2023 18:18:09 -0500 -Subject: [PATCH 0507/1501] serial: sc16is7xx: add check for unsupported SPI - modes during probe -Content-Length: 1746 -Lines: 46 - -commit 6d710b769c1f5f0d55c9ad9bb49b7dce009ec103 upstream. - -The original comment is confusing because it implies that variants other -than the SC16IS762 supports other SPI modes beside SPI_MODE_0. - -Extract from datasheet: - The SC16IS762 differs from the SC16IS752 in that it supports SPI clock - speeds up to 15 Mbit/s instead of the 4 Mbit/s supported by the - SC16IS752... In all other aspects, the SC16IS762 is functionally and - electrically the same as the SC16IS752. - -The same is also true of the SC16IS760 variant versus the SC16IS740 and -SC16IS750 variants. - -For all variants, only SPI mode 0 is supported. - -Change comment and abort probing if the specified SPI mode is not -SPI_MODE_0. - -Fixes: 2c837a8a8f9f ("sc16is7xx: spi interface is added") -Cc: <stable@vger.kernel.org> -Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Link: https://lore.kernel.org/r/20231221231823.2327894-3-hugo@hugovil.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/tty/serial/sc16is7xx.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c -index cf0c6120d30e..00ddc34653f9 100644 ---- a/drivers/tty/serial/sc16is7xx.c -+++ b/drivers/tty/serial/sc16is7xx.c -@@ -1727,7 +1727,10 @@ static int sc16is7xx_spi_probe(struct spi_device *spi) - - /* Setup SPI bus */ - spi->bits_per_word = 8; -- /* only supports mode 0 on SC16IS762 */ -+ /* For all variants, only mode 0 is supported */ -+ if ((spi->mode & SPI_MODE_X_MASK) != SPI_MODE_0) -+ return dev_err_probe(&spi->dev, -EINVAL, "Unsupported SPI mode\n"); -+ - spi->mode = spi->mode ? : SPI_MODE_0; - spi->max_speed_hz = spi->max_speed_hz ? : 15000000; - ret = spi_setup(spi); --- -2.43.2 - -From 3437e35fe8a6a937b96da90716c0c538e15be0f7 Mon Sep 17 00:00:00 2001 -From: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Date: Thu, 21 Dec 2023 18:18:10 -0500 -Subject: [PATCH 0508/1501] serial: sc16is7xx: set safe default SPI clock - frequency -Content-Length: 1413 -Lines: 41 - -commit 3ef79cd1412236d884ab0c46b4d1921380807b48 upstream. - -15 MHz is supported only by 76x variants. - -If the SPI clock frequency is not specified, use a safe default clock value -of 4 MHz that is supported by all variants. - -Also use HZ_PER_MHZ macro to improve readability. - -Fixes: 2c837a8a8f9f ("sc16is7xx: spi interface is added") -Cc: <stable@vger.kernel.org> -Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Link: https://lore.kernel.org/r/20231221231823.2327894-4-hugo@hugovil.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/tty/serial/sc16is7xx.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c -index 00ddc34653f9..d5bb0da95376 100644 ---- a/drivers/tty/serial/sc16is7xx.c -+++ b/drivers/tty/serial/sc16is7xx.c -@@ -24,6 +24,7 @@ - #include <linux/tty_flip.h> - #include <linux/spi/spi.h> - #include <linux/uaccess.h> -+#include <linux/units.h> - #include <uapi/linux/sched/types.h> - - #define SC16IS7XX_NAME "sc16is7xx" -@@ -1732,7 +1733,7 @@ static int sc16is7xx_spi_probe(struct spi_device *spi) - return dev_err_probe(&spi->dev, -EINVAL, "Unsupported SPI mode\n"); - - spi->mode = spi->mode ? : SPI_MODE_0; -- spi->max_speed_hz = spi->max_speed_hz ? : 15000000; -+ spi->max_speed_hz = spi->max_speed_hz ? : 4 * HZ_PER_MHZ; - ret = spi_setup(spi); - if (ret) - return ret; --- -2.43.2 - -From eec049b123bbfdfbb3562c883929bf776b3a8e99 Mon Sep 17 00:00:00 2001 -From: Randy Dunlap <rdunlap@infradead.org> -Date: Tue, 7 Nov 2023 01:36:03 +0100 -Subject: [PATCH 0509/1501] ARM: 9330/1: davinci: also select PINCTRL -Content-Length: 1368 -Lines: 40 - -[ Upstream commit f54e8634d1366926c807e2af6125b33cff555fa7 ] - -kconfig warns when PINCTRL_SINGLE is selected but PINCTRL is not -set, so also set PINCTRL for ARCH_DAVINCI. This prevents a -kconfig/build warning: - - WARNING: unmet direct dependencies detected for PINCTRL_SINGLE - Depends on [n]: PINCTRL [=n] && OF [=y] && HAS_IOMEM [=y] - Selected by [y]: - - ARCH_DAVINCI [=y] && ARCH_MULTI_V5 [=y] - -Closes: lore.kernel.org/r/202311070548.0f6XfBrh-lkp@intel.com - -Fixes: f962396ce292 ("ARM: davinci: support multiplatform build for ARM v5") -Signed-off-by: Randy Dunlap <rdunlap@infradead.org> -Reported-by: kernel test robot <lkp@intel.com> -Cc: Bartosz Golaszewski <brgl@bgdev.pl> -Cc: Arnd Bergmann <arnd@arndb.de> -Cc: linux-arm-kernel@lists.infradead.org -Cc: patches@armlinux.org.uk -Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/arm/mach-davinci/Kconfig | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/arch/arm/mach-davinci/Kconfig b/arch/arm/mach-davinci/Kconfig -index 59de137c6f53..2a8a9fe46586 100644 ---- a/arch/arm/mach-davinci/Kconfig -+++ b/arch/arm/mach-davinci/Kconfig -@@ -11,6 +11,7 @@ menuconfig ARCH_DAVINCI - select PM_GENERIC_DOMAINS_OF if PM && OF - select REGMAP_MMIO - select RESET_CONTROLLER -+ select PINCTRL - select PINCTRL_SINGLE - - if ARCH_DAVINCI --- -2.43.2 - -From d81d4e695f58e854acd721c778dcd9aa92c7ce18 Mon Sep 17 00:00:00 2001 -From: Neil Armstrong <neil.armstrong@linaro.org> -Date: Thu, 16 Nov 2023 15:05:13 +0100 -Subject: [PATCH 0510/1501] mfd: rk8xx: fixup devices registration with - PLATFORM_DEVID_AUTO -Content-Length: 5557 -Lines: 165 - -[ Upstream commit 4aedcd4aa61d536ca17e67ecd5bc5d42529164f4 ] - -Since commit 210f418f8ace ("mfd: rk8xx: Add rk806 support"), devices are -registered with "0" as id, causing devices to not have an automatic device id -and prevents having multiple RK8xx PMICs on the same system. - -Properly pass PLATFORM_DEVID_AUTO to devm_mfd_add_devices() and since -it will ignore the cells .id with this special value, also cleanup -by removing all now ignored cells .id values. - -Now we have the same behaviour as before rk806 introduction and rk806 -retains the intended behavior. - -This fixes a regression while booting the Odroid Go Ultra on v6.6.1: -sysfs: cannot create duplicate filename '/bus/platform/devices/rk808-clkout' -CPU: 3 PID: 97 Comm: kworker/u12:2 Not tainted 6.6.1 #1 -Hardware name: Hardkernel ODROID-GO-Ultra (DT) -Workqueue: events_unbound deferred_probe_work_func -Call trace: -dump_backtrace+0x9c/0x11c -show_stack+0x18/0x24 -dump_stack_lvl+0x78/0xc4 -dump_stack+0x18/0x24 -sysfs_warn_dup+0x64/0x80 -sysfs_do_create_link_sd+0xf0/0xf8 -sysfs_create_link+0x20/0x40 -bus_add_device+0x114/0x160 -device_add+0x3f0/0x7cc -platform_device_add+0x180/0x270 -mfd_add_device+0x390/0x4a8 -devm_mfd_add_devices+0xb0/0x150 -rk8xx_probe+0x26c/0x410 -rk8xx_i2c_probe+0x64/0x98 -i2c_device_probe+0x104/0x2e8 -really_probe+0x184/0x3c8 -__driver_probe_device+0x7c/0x16c -driver_probe_device+0x3c/0x10c -__device_attach_driver+0xbc/0x158 -bus_for_each_drv+0x80/0xdc -__device_attach+0x9c/0x1ac -device_initial_probe+0x14/0x20 -bus_probe_device+0xac/0xb0 -deferred_probe_work_func+0xa0/0xf4 -process_one_work+0x1bc/0x378 -worker_thread+0x1dc/0x3d4 -kthread+0x104/0x118 -ret_from_fork+0x10/0x20 -rk8xx-i2c 0-001c: error -EEXIST: failed to add MFD devices -rk8xx-i2c: probe of 0-001c failed with error -17 - -Fixes: 210f418f8ace ("mfd: rk8xx: Add rk806 support") -Reported-by: Adam Green <greena88@gmail.com> -Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> -Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com> -Link: https://lore.kernel.org/r/20231116-topic-amlogic-upstream-fix-rk8xx-devid-auto-v2-1-3f1bad68ab9d@linaro.org -Signed-off-by: Lee Jones <lee@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/mfd/rk8xx-core.c | 34 +++++++++++++--------------------- - 1 file changed, 13 insertions(+), 21 deletions(-) - -diff --git a/drivers/mfd/rk8xx-core.c b/drivers/mfd/rk8xx-core.c -index c47164a3ec1d..b1ffc3b9e2be 100644 ---- a/drivers/mfd/rk8xx-core.c -+++ b/drivers/mfd/rk8xx-core.c -@@ -53,76 +53,68 @@ static const struct resource rk817_charger_resources[] = { - }; - - static const struct mfd_cell rk805s[] = { -- { .name = "rk808-clkout", .id = PLATFORM_DEVID_NONE, }, -- { .name = "rk808-regulator", .id = PLATFORM_DEVID_NONE, }, -- { .name = "rk805-pinctrl", .id = PLATFORM_DEVID_NONE, }, -+ { .name = "rk808-clkout", }, -+ { .name = "rk808-regulator", }, -+ { .name = "rk805-pinctrl", }, - { - .name = "rk808-rtc", - .num_resources = ARRAY_SIZE(rtc_resources), - .resources = &rtc_resources[0], -- .id = PLATFORM_DEVID_NONE, - }, - { .name = "rk805-pwrkey", - .num_resources = ARRAY_SIZE(rk805_key_resources), - .resources = &rk805_key_resources[0], -- .id = PLATFORM_DEVID_NONE, - }, - }; - - static const struct mfd_cell rk806s[] = { -- { .name = "rk805-pinctrl", .id = PLATFORM_DEVID_AUTO, }, -- { .name = "rk808-regulator", .id = PLATFORM_DEVID_AUTO, }, -+ { .name = "rk805-pinctrl", }, -+ { .name = "rk808-regulator", }, - { - .name = "rk805-pwrkey", - .resources = rk806_pwrkey_resources, - .num_resources = ARRAY_SIZE(rk806_pwrkey_resources), -- .id = PLATFORM_DEVID_AUTO, - }, - }; - - static const struct mfd_cell rk808s[] = { -- { .name = "rk808-clkout", .id = PLATFORM_DEVID_NONE, }, -- { .name = "rk808-regulator", .id = PLATFORM_DEVID_NONE, }, -+ { .name = "rk808-clkout", }, -+ { .name = "rk808-regulator", }, - { - .name = "rk808-rtc", - .num_resources = ARRAY_SIZE(rtc_resources), - .resources = rtc_resources, -- .id = PLATFORM_DEVID_NONE, - }, - }; - - static const struct mfd_cell rk817s[] = { -- { .name = "rk808-clkout", .id = PLATFORM_DEVID_NONE, }, -- { .name = "rk808-regulator", .id = PLATFORM_DEVID_NONE, }, -+ { .name = "rk808-clkout", }, -+ { .name = "rk808-regulator", }, - { - .name = "rk805-pwrkey", - .num_resources = ARRAY_SIZE(rk817_pwrkey_resources), - .resources = &rk817_pwrkey_resources[0], -- .id = PLATFORM_DEVID_NONE, - }, - { - .name = "rk808-rtc", - .num_resources = ARRAY_SIZE(rk817_rtc_resources), - .resources = &rk817_rtc_resources[0], -- .id = PLATFORM_DEVID_NONE, - }, -- { .name = "rk817-codec", .id = PLATFORM_DEVID_NONE, }, -+ { .name = "rk817-codec", }, - { - .name = "rk817-charger", - .num_resources = ARRAY_SIZE(rk817_charger_resources), - .resources = &rk817_charger_resources[0], -- .id = PLATFORM_DEVID_NONE, - }, - }; - - static const struct mfd_cell rk818s[] = { -- { .name = "rk808-clkout", .id = PLATFORM_DEVID_NONE, }, -- { .name = "rk808-regulator", .id = PLATFORM_DEVID_NONE, }, -+ { .name = "rk808-clkout", }, -+ { .name = "rk808-regulator", }, - { - .name = "rk808-rtc", - .num_resources = ARRAY_SIZE(rtc_resources), - .resources = rtc_resources, -- .id = PLATFORM_DEVID_NONE, - }, - }; - -@@ -684,7 +676,7 @@ int rk8xx_probe(struct device *dev, int variant, unsigned int irq, struct regmap - pre_init_reg[i].addr); - } - -- ret = devm_mfd_add_devices(dev, 0, cells, nr_cells, NULL, 0, -+ ret = devm_mfd_add_devices(dev, PLATFORM_DEVID_AUTO, cells, nr_cells, NULL, 0, - regmap_irq_get_domain(rk808->irq_data)); - if (ret) - return dev_err_probe(dev, ret, "failed to add MFD devices\n"); --- -2.43.2 - -From e7e0c2328c17bb1b96acaa48c21ff0ffe4571d96 Mon Sep 17 00:00:00 2001 -From: Charles Keepax <ckeepax@opensource.cirrus.com> -Date: Thu, 30 Nov 2023 11:57:11 +0000 -Subject: [PATCH 0511/1501] mfd: cs42l43: Correct SoundWire port list -Content-Length: 4006 -Lines: 132 - -[ Upstream commit 47b1b03dc56ebc302620ce43e967aa8f33516f6f ] - -Two ports are missing from the port list, and the wrong port is set -to 4 channels. Also the attempt to list them by function is rather -misguided, there is nothing in the hardware that fixes a particular -port to one function. Factor out the port properties to an actual -struct, fixing the missing ports and correcting the port set to 4 -channels. - -Fixes: ace6d1448138 ("mfd: cs42l43: Add support for cs42l43 core driver") -Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> -Link: https://lore.kernel.org/r/20231130115712.669180-1-ckeepax@opensource.cirrus.com -Signed-off-by: Lee Jones <lee@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/mfd/cs42l43-sdw.c | 74 +++++++++++++++------------------------ - 1 file changed, 28 insertions(+), 46 deletions(-) - -diff --git a/drivers/mfd/cs42l43-sdw.c b/drivers/mfd/cs42l43-sdw.c -index 7392b3d2e6b9..4be4df9dd8cf 100644 ---- a/drivers/mfd/cs42l43-sdw.c -+++ b/drivers/mfd/cs42l43-sdw.c -@@ -17,13 +17,12 @@ - - #include "cs42l43.h" - --enum cs42l43_sdw_ports { -- CS42L43_DMIC_DEC_ASP_PORT = 1, -- CS42L43_SPK_TX_PORT, -- CS42L43_SPDIF_HP_PORT, -- CS42L43_SPK_RX_PORT, -- CS42L43_ASP_PORT, --}; -+#define CS42L43_SDW_PORT(port, chans) { \ -+ .num = port, \ -+ .max_ch = chans, \ -+ .type = SDW_DPN_FULL, \ -+ .max_word = 24, \ -+} - - static const struct regmap_config cs42l43_sdw_regmap = { - .reg_bits = 32, -@@ -42,65 +41,48 @@ static const struct regmap_config cs42l43_sdw_regmap = { - .num_reg_defaults = ARRAY_SIZE(cs42l43_reg_default), - }; - -+static const struct sdw_dpn_prop cs42l43_src_port_props[] = { -+ CS42L43_SDW_PORT(1, 4), -+ CS42L43_SDW_PORT(2, 2), -+ CS42L43_SDW_PORT(3, 2), -+ CS42L43_SDW_PORT(4, 2), -+}; -+ -+static const struct sdw_dpn_prop cs42l43_sink_port_props[] = { -+ CS42L43_SDW_PORT(5, 2), -+ CS42L43_SDW_PORT(6, 2), -+ CS42L43_SDW_PORT(7, 2), -+}; -+ - static int cs42l43_read_prop(struct sdw_slave *sdw) - { - struct sdw_slave_prop *prop = &sdw->prop; - struct device *dev = &sdw->dev; -- struct sdw_dpn_prop *dpn; -- unsigned long addr; -- int nval; - int i; -- u32 bit; - - prop->use_domain_irq = true; - prop->paging_support = true; - prop->wake_capable = true; -- prop->source_ports = BIT(CS42L43_DMIC_DEC_ASP_PORT) | BIT(CS42L43_SPK_TX_PORT); -- prop->sink_ports = BIT(CS42L43_SPDIF_HP_PORT) | -- BIT(CS42L43_SPK_RX_PORT) | BIT(CS42L43_ASP_PORT); - prop->quirks = SDW_SLAVE_QUIRKS_INVALID_INITIAL_PARITY; - prop->scp_int1_mask = SDW_SCP_INT1_BUS_CLASH | SDW_SCP_INT1_PARITY | - SDW_SCP_INT1_IMPL_DEF; - -- nval = hweight32(prop->source_ports); -- prop->src_dpn_prop = devm_kcalloc(dev, nval, sizeof(*prop->src_dpn_prop), -- GFP_KERNEL); -+ for (i = 0; i < ARRAY_SIZE(cs42l43_src_port_props); i++) -+ prop->source_ports |= BIT(cs42l43_src_port_props[i].num); -+ -+ prop->src_dpn_prop = devm_kmemdup(dev, cs42l43_src_port_props, -+ sizeof(cs42l43_src_port_props), GFP_KERNEL); - if (!prop->src_dpn_prop) - return -ENOMEM; - -- i = 0; -- dpn = prop->src_dpn_prop; -- addr = prop->source_ports; -- for_each_set_bit(bit, &addr, 32) { -- dpn[i].num = bit; -- dpn[i].max_ch = 2; -- dpn[i].type = SDW_DPN_FULL; -- dpn[i].max_word = 24; -- i++; -- } -- /* -- * All ports are 2 channels max, except the first one, -- * CS42L43_DMIC_DEC_ASP_PORT. -- */ -- dpn[CS42L43_DMIC_DEC_ASP_PORT].max_ch = 4; -+ for (i = 0; i < ARRAY_SIZE(cs42l43_sink_port_props); i++) -+ prop->sink_ports |= BIT(cs42l43_sink_port_props[i].num); - -- nval = hweight32(prop->sink_ports); -- prop->sink_dpn_prop = devm_kcalloc(dev, nval, sizeof(*prop->sink_dpn_prop), -- GFP_KERNEL); -+ prop->sink_dpn_prop = devm_kmemdup(dev, cs42l43_sink_port_props, -+ sizeof(cs42l43_sink_port_props), GFP_KERNEL); - if (!prop->sink_dpn_prop) - return -ENOMEM; - -- i = 0; -- dpn = prop->sink_dpn_prop; -- addr = prop->sink_ports; -- for_each_set_bit(bit, &addr, 32) { -- dpn[i].num = bit; -- dpn[i].max_ch = 2; -- dpn[i].type = SDW_DPN_FULL; -- dpn[i].max_word = 24; -- i++; -- } -- - return 0; - } - --- -2.43.2 - -From 7f2c410ac470959b88e03dadd94b7a0b71df7973 Mon Sep 17 00:00:00 2001 -From: Kunwu Chan <chentao@kylinos.cn> -Date: Mon, 4 Dec 2023 17:24:43 +0800 -Subject: [PATCH 0512/1501] mfd: syscon: Fix null pointer dereference in - of_syscon_register() -Content-Length: 1126 -Lines: 32 - -[ Upstream commit 41673c66b3d0c09915698fec5c13b24336f18dd1 ] - -kasprintf() returns a pointer to dynamically allocated memory -which can be NULL upon failure. - -Fixes: e15d7f2b81d2 ("mfd: syscon: Use a unique name with regmap_config") -Signed-off-by: Kunwu Chan <chentao@kylinos.cn> -Reviewed-by: Arnd Bergmann <arnd@arndb.de> -Link: https://lore.kernel.org/r/20231204092443.2462115-1-chentao@kylinos.cn -Signed-off-by: Lee Jones <lee@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/mfd/syscon.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/mfd/syscon.c b/drivers/mfd/syscon.c -index 57b29c325131..c9550368d9ea 100644 ---- a/drivers/mfd/syscon.c -+++ b/drivers/mfd/syscon.c -@@ -105,6 +105,10 @@ static struct syscon *of_syscon_register(struct device_node *np, bool check_res) - } - - syscon_config.name = kasprintf(GFP_KERNEL, "%pOFn@%pa", np, &res.start); -+ if (!syscon_config.name) { -+ ret = -ENOMEM; -+ goto err_regmap; -+ } - syscon_config.reg_stride = reg_io_width; - syscon_config.val_bits = reg_io_width * 8; - syscon_config.max_register = resource_size(&res) - reg_io_width; --- -2.43.2 - -From 8194c4bd2946b52f2258ac426099ced99f3d945e Mon Sep 17 00:00:00 2001 -From: "Paul E. McKenney" <paulmck@kernel.org> -Date: Wed, 1 Nov 2023 18:28:38 -0700 -Subject: [PATCH 0513/1501] rcu: Restrict access to RCU CPU stall notifiers -Content-Length: 10455 -Lines: 242 - -[ Upstream commit 4e58aaeebb3c27993c734c99eae6881b196b1ddb ] - -Although the RCU CPU stall notifiers can be useful for dumping state when -tracking down delicate forward-progress bugs where NUMA effects cause -cache lines to be delivered to a given CPU regularly, but always in a -state that prevents that CPU from making forward progress. These bugs can -be detected by the RCU CPU stall-warning mechanism, but in some cases, -the stall-warnings printk()s disrupt the forward-progress bug before -any useful state can be obtained. - -Unfortunately, the notifier mechanism added by commit 5b404fdabacf ("rcu: -Add RCU CPU stall notifier") can make matters worse if used at all -carelessly. For example, if the stall warning was caused by a lock not -being released, then any attempt to acquire that lock in the notifier -will hang. This will prevent not only the notifier from producing any -useful output, but it will also prevent the stall-warning message from -ever appearing. - -This commit therefore hides this new RCU CPU stall notifier -mechanism under a new RCU_CPU_STALL_NOTIFIER Kconfig option that -depends on both DEBUG_KERNEL and RCU_EXPERT. In addition, the -rcupdate.rcu_cpu_stall_notifiers=1 kernel boot parameter must also -be specified. The RCU_CPU_STALL_NOTIFIER Kconfig option's help text -contains a warning and explains the dangers of careless use, recommending -lockless notifier code. In addition, a WARN() is triggered each time -that an attempt is made to register a stall-warning notifier in kernels -built with CONFIG_RCU_CPU_STALL_NOTIFIER=y. - -This combination of measures will keep use of this mechanism confined to -debug kernels and away from routine deployments. - -[ paulmck: Apply Dan Carpenter feedback. ] - -Fixes: 5b404fdabacf ("rcu: Add RCU CPU stall notifier") -Reported-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Paul E. McKenney <paulmck@kernel.org> -Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org> -Signed-off-by: Neeraj Upadhyay (AMD) <neeraj.iitr10@gmail.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../admin-guide/kernel-parameters.txt | 6 +++++ - include/linux/rcu_notifier.h | 6 ++--- - kernel/rcu/Kconfig.debug | 25 +++++++++++++++++++ - kernel/rcu/rcu.h | 8 +++--- - kernel/rcu/rcutorture.c | 12 +++++---- - kernel/rcu/tree_stall.h | 11 +++++++- - kernel/rcu/update.c | 6 +++++ - 7 files changed, 62 insertions(+), 12 deletions(-) - -diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt -index 65731b060e3f..b72e2049c487 100644 ---- a/Documentation/admin-guide/kernel-parameters.txt -+++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -5302,6 +5302,12 @@ - Dump ftrace buffer after reporting RCU CPU - stall warning. - -+ rcupdate.rcu_cpu_stall_notifiers= [KNL] -+ Provide RCU CPU stall notifiers, but see the -+ warnings in the RCU_CPU_STALL_NOTIFIER Kconfig -+ option's help text. TL;DR: You almost certainly -+ do not want rcupdate.rcu_cpu_stall_notifiers. -+ - rcupdate.rcu_cpu_stall_suppress= [KNL] - Suppress RCU CPU stall warning messages. - -diff --git a/include/linux/rcu_notifier.h b/include/linux/rcu_notifier.h -index ebf371364581..5640f024773b 100644 ---- a/include/linux/rcu_notifier.h -+++ b/include/linux/rcu_notifier.h -@@ -13,7 +13,7 @@ - #define RCU_STALL_NOTIFY_NORM 1 - #define RCU_STALL_NOTIFY_EXP 2 - --#ifdef CONFIG_RCU_STALL_COMMON -+#if defined(CONFIG_RCU_STALL_COMMON) && defined(CONFIG_RCU_CPU_STALL_NOTIFIER) - - #include <linux/notifier.h> - #include <linux/types.h> -@@ -21,12 +21,12 @@ - int rcu_stall_chain_notifier_register(struct notifier_block *n); - int rcu_stall_chain_notifier_unregister(struct notifier_block *n); - --#else // #ifdef CONFIG_RCU_STALL_COMMON -+#else // #if defined(CONFIG_RCU_STALL_COMMON) && defined(CONFIG_RCU_CPU_STALL_NOTIFIER) - - // No RCU CPU stall warnings in Tiny RCU. - static inline int rcu_stall_chain_notifier_register(struct notifier_block *n) { return -EEXIST; } - static inline int rcu_stall_chain_notifier_unregister(struct notifier_block *n) { return -ENOENT; } - --#endif // #else // #ifdef CONFIG_RCU_STALL_COMMON -+#endif // #else // #if defined(CONFIG_RCU_STALL_COMMON) && defined(CONFIG_RCU_CPU_STALL_NOTIFIER) - - #endif /* __LINUX_RCU_NOTIFIER_H */ -diff --git a/kernel/rcu/Kconfig.debug b/kernel/rcu/Kconfig.debug -index 2984de629f74..9b0b52e1836f 100644 ---- a/kernel/rcu/Kconfig.debug -+++ b/kernel/rcu/Kconfig.debug -@@ -105,6 +105,31 @@ config RCU_CPU_STALL_CPUTIME - The boot option rcupdate.rcu_cpu_stall_cputime has the same function - as this one, but will override this if it exists. - -+config RCU_CPU_STALL_NOTIFIER -+ bool "Provide RCU CPU-stall notifiers" -+ depends on RCU_STALL_COMMON -+ depends on DEBUG_KERNEL -+ depends on RCU_EXPERT -+ default n -+ help -+ WARNING: You almost certainly do not want this!!! -+ -+ Enable RCU CPU-stall notifiers, which are invoked just before -+ printing the RCU CPU stall warning. As such, bugs in notifier -+ callbacks can prevent stall warnings from being printed. -+ And the whole reason that a stall warning is being printed is -+ that something is hung up somewhere. Therefore, the notifier -+ callbacks must be written extremely carefully, preferably -+ containing only lockless code. After all, it is quite possible -+ that the whole reason that the RCU CPU stall is happening in -+ the first place is that someone forgot to release whatever lock -+ that you are thinking of acquiring. In which case, having your -+ notifier callback acquire that lock will hang, preventing the -+ RCU CPU stall warning from appearing. -+ -+ Say Y here if you want RCU CPU stall notifiers (you don't want them) -+ Say N if you are unsure. -+ - config RCU_TRACE - bool "Enable tracing for RCU" - depends on DEBUG_KERNEL -diff --git a/kernel/rcu/rcu.h b/kernel/rcu/rcu.h -index b531c33e9545..f94f65877f2b 100644 ---- a/kernel/rcu/rcu.h -+++ b/kernel/rcu/rcu.h -@@ -262,6 +262,8 @@ static inline bool rcu_stall_is_suppressed_at_boot(void) - return rcu_cpu_stall_suppress_at_boot && !rcu_inkernel_boot_has_ended(); - } - -+extern int rcu_cpu_stall_notifiers; -+ - #ifdef CONFIG_RCU_STALL_COMMON - - extern int rcu_cpu_stall_ftrace_dump; -@@ -659,10 +661,10 @@ static inline bool rcu_cpu_beenfullyonline(int cpu) { return true; } - bool rcu_cpu_beenfullyonline(int cpu); - #endif - --#ifdef CONFIG_RCU_STALL_COMMON -+#if defined(CONFIG_RCU_STALL_COMMON) && defined(CONFIG_RCU_CPU_STALL_NOTIFIER) - int rcu_stall_notifier_call_chain(unsigned long val, void *v); --#else // #ifdef CONFIG_RCU_STALL_COMMON -+#else // #if defined(CONFIG_RCU_STALL_COMMON) && defined(CONFIG_RCU_CPU_STALL_NOTIFIER) - static inline int rcu_stall_notifier_call_chain(unsigned long val, void *v) { return NOTIFY_DONE; } --#endif // #else // #ifdef CONFIG_RCU_STALL_COMMON -+#endif // #else // #if defined(CONFIG_RCU_STALL_COMMON) && defined(CONFIG_RCU_CPU_STALL_NOTIFIER) - - #endif /* __LINUX_RCU_H */ -diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c -index 30fc9d34e329..07a6a183c555 100644 ---- a/kernel/rcu/rcutorture.c -+++ b/kernel/rcu/rcutorture.c -@@ -2450,10 +2450,12 @@ static int rcu_torture_stall(void *args) - unsigned long stop_at; - - VERBOSE_TOROUT_STRING("rcu_torture_stall task started"); -- ret = rcu_stall_chain_notifier_register(&rcu_torture_stall_block); -- if (ret) -- pr_info("%s: rcu_stall_chain_notifier_register() returned %d, %sexpected.\n", -- __func__, ret, !IS_ENABLED(CONFIG_RCU_STALL_COMMON) ? "un" : ""); -+ if (rcu_cpu_stall_notifiers) { -+ ret = rcu_stall_chain_notifier_register(&rcu_torture_stall_block); -+ if (ret) -+ pr_info("%s: rcu_stall_chain_notifier_register() returned %d, %sexpected.\n", -+ __func__, ret, !IS_ENABLED(CONFIG_RCU_STALL_COMMON) ? "un" : ""); -+ } - if (stall_cpu_holdoff > 0) { - VERBOSE_TOROUT_STRING("rcu_torture_stall begin holdoff"); - schedule_timeout_interruptible(stall_cpu_holdoff * HZ); -@@ -2497,7 +2499,7 @@ static int rcu_torture_stall(void *args) - cur_ops->readunlock(idx); - } - pr_alert("%s end.\n", __func__); -- if (!ret) { -+ if (rcu_cpu_stall_notifiers && !ret) { - ret = rcu_stall_chain_notifier_unregister(&rcu_torture_stall_block); - if (ret) - pr_info("%s: rcu_stall_chain_notifier_unregister() returned %d.\n", __func__, ret); -diff --git a/kernel/rcu/tree_stall.h b/kernel/rcu/tree_stall.h -index ac8e86babe44..5d666428546b 100644 ---- a/kernel/rcu/tree_stall.h -+++ b/kernel/rcu/tree_stall.h -@@ -1061,6 +1061,7 @@ static int __init rcu_sysrq_init(void) - } - early_initcall(rcu_sysrq_init); - -+#ifdef CONFIG_RCU_CPU_STALL_NOTIFIER - - ////////////////////////////////////////////////////////////////////////////// - // -@@ -1081,7 +1082,13 @@ static ATOMIC_NOTIFIER_HEAD(rcu_cpu_stall_notifier_list); - */ - int rcu_stall_chain_notifier_register(struct notifier_block *n) - { -- return atomic_notifier_chain_register(&rcu_cpu_stall_notifier_list, n); -+ int rcsn = rcu_cpu_stall_notifiers; -+ -+ WARN(1, "Adding %pS() to RCU stall notifier list (%s).\n", n->notifier_call, -+ rcsn ? "possibly suppressing RCU CPU stall warnings" : "failed, so all is well"); -+ if (rcsn) -+ return atomic_notifier_chain_register(&rcu_cpu_stall_notifier_list, n); -+ return -EEXIST; - } - EXPORT_SYMBOL_GPL(rcu_stall_chain_notifier_register); - -@@ -1115,3 +1122,5 @@ int rcu_stall_notifier_call_chain(unsigned long val, void *v) - { - return atomic_notifier_call_chain(&rcu_cpu_stall_notifier_list, val, v); - } -+ -+#endif // #ifdef CONFIG_RCU_CPU_STALL_NOTIFIER -diff --git a/kernel/rcu/update.c b/kernel/rcu/update.c -index c534d6806d3d..46aaaa9fe339 100644 ---- a/kernel/rcu/update.c -+++ b/kernel/rcu/update.c -@@ -538,9 +538,15 @@ long torture_sched_setaffinity(pid_t pid, const struct cpumask *in_mask) - EXPORT_SYMBOL_GPL(torture_sched_setaffinity); - #endif - -+int rcu_cpu_stall_notifiers __read_mostly; // !0 = provide stall notifiers (rarely useful) -+EXPORT_SYMBOL_GPL(rcu_cpu_stall_notifiers); -+ - #ifdef CONFIG_RCU_STALL_COMMON - int rcu_cpu_stall_ftrace_dump __read_mostly; - module_param(rcu_cpu_stall_ftrace_dump, int, 0644); -+#ifdef CONFIG_RCU_CPU_STALL_NOTIFIER -+module_param(rcu_cpu_stall_notifiers, int, 0444); -+#endif // #ifdef CONFIG_RCU_CPU_STALL_NOTIFIER - int rcu_cpu_stall_suppress __read_mostly; // !0 = suppress stall warnings. - EXPORT_SYMBOL_GPL(rcu_cpu_stall_suppress); - module_param(rcu_cpu_stall_suppress, int, 0644); --- -2.43.2 - -From fd8af4edef36103c317b3fa89ffde670a9b3e814 Mon Sep 17 00:00:00 2001 -From: Dang Huynh <danct12@riseup.net> -Date: Fri, 3 Nov 2023 18:42:03 +0700 -Subject: [PATCH 0514/1501] leds: aw2013: Select missing dependency REGMAP_I2C -Content-Length: 1086 -Lines: 33 - -[ Upstream commit 75469bb0537ad2ab0fc1fb6e534a79cfc03f3b3f ] - -The AW2013 driver uses devm_regmap_init_i2c, so REGMAP_I2C needs to -be selected. - -Otherwise build process may fail with: - ld: drivers/leds/leds-aw2013.o: in function `aw2013_probe': - leds-aw2013.c:345: undefined reference to `__devm_regmap_init_i2c' - -Signed-off-by: Dang Huynh <danct12@riseup.net> -Acked-by: Nikita Travkin <nikita@trvn.ru> -Fixes: 59ea3c9faf32 ("leds: add aw2013 driver") -Link: https://lore.kernel.org/r/20231103114203.1108922-1-danct12@riseup.net -Signed-off-by: Lee Jones <lee@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/leds/Kconfig | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig -index 6292fddcc55c..a3a9ac5b5338 100644 ---- a/drivers/leds/Kconfig -+++ b/drivers/leds/Kconfig -@@ -110,6 +110,7 @@ config LEDS_AW200XX - config LEDS_AW2013 - tristate "LED support for Awinic AW2013" - depends on LEDS_CLASS && I2C && OF -+ select REGMAP_I2C - help - This option enables support for the AW2013 3-channel - LED driver. --- -2.43.2 - -From 8fed64f143c7300ce04222a12c9b5a8c36322651 Mon Sep 17 00:00:00 2001 -From: Martin Kurbanov <mmkurbanov@salutedevices.com> -Date: Sat, 25 Nov 2023 23:05:09 +0300 -Subject: [PATCH 0515/1501] leds: aw200xx: Fix write to DIM parameter -Content-Length: 1611 -Lines: 44 - -[ Upstream commit adfd4621b78d0c02da91335da2b9ad847cb7b39e ] - -If write only DIM value to the page 4, LED brightness will not be -updated, as both DIM and FADE need to be written to the page 4. -Therefore, write DIM to the page 1. - -Fixes: 36a87f371b7a ("leds: Add AW20xx driver") -Signed-off-by: Martin Kurbanov <mmkurbanov@salutedevices.com> -Signed-off-by: Dmitry Rokosov <ddrokosov@salutedevices.com> -Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> -Link: https://lore.kernel.org/r/20231125200519.1750-2-ddrokosov@salutedevices.com -Signed-off-by: Lee Jones <lee@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/leds/leds-aw200xx.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/drivers/leds/leds-aw200xx.c b/drivers/leds/leds-aw200xx.c -index 14ca236ce29e..f3bed4f05b34 100644 ---- a/drivers/leds/leds-aw200xx.c -+++ b/drivers/leds/leds-aw200xx.c -@@ -74,6 +74,10 @@ - #define AW200XX_LED2REG(x, columns) \ - ((x) + (((x) / (columns)) * (AW200XX_DSIZE_COLUMNS_MAX - (columns)))) - -+/* DIM current configuration register on page 1 */ -+#define AW200XX_REG_DIM_PAGE1(x, columns) \ -+ AW200XX_REG(AW200XX_PAGE1, AW200XX_LED2REG(x, columns)) -+ - /* - * DIM current configuration register (page 4). - * The even address for current DIM configuration. -@@ -153,7 +157,8 @@ static ssize_t dim_store(struct device *dev, struct device_attribute *devattr, - - if (dim >= 0) { - ret = regmap_write(chip->regmap, -- AW200XX_REG_DIM(led->num, columns), dim); -+ AW200XX_REG_DIM_PAGE1(led->num, columns), -+ dim); - if (ret) - goto out_unlock; - } --- -2.43.2 - -From c18949d7d18cd7deed70c733f2dbbd948c8171da Mon Sep 17 00:00:00 2001 -From: Kunwu Chan <chentao@kylinos.cn> -Date: Fri, 8 Dec 2023 11:33:20 +0800 -Subject: [PATCH 0516/1501] mfd: tps6594: Add null pointer check to - tps6594_device_init() -Content-Length: 1160 -Lines: 31 - -[ Upstream commit 825906f2ebe83977d747d8bce61675dddd72485d ] - -devm_kasprintf() returns a pointer to dynamically allocated memory -which can be NULL upon failure. - -Fixes: 325bec7157b3 ("mfd: tps6594: Add driver for TI TPS6594 PMIC") -Suggested-by: Lee Jones <lee@kernel.org> -Signed-off-by: Kunwu Chan <chentao@kylinos.cn> -Link: https://lore.kernel.org/r/20231208033320.49345-1-chentao@kylinos.cn -Signed-off-by: Lee Jones <lee@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/mfd/tps6594-core.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/mfd/tps6594-core.c b/drivers/mfd/tps6594-core.c -index 0fb9c5cf213a..783ee59901e8 100644 ---- a/drivers/mfd/tps6594-core.c -+++ b/drivers/mfd/tps6594-core.c -@@ -433,6 +433,9 @@ int tps6594_device_init(struct tps6594 *tps, bool enable_crc) - tps6594_irq_chip.name = devm_kasprintf(dev, GFP_KERNEL, "%s-%ld-0x%02x", - dev->driver->name, tps->chip_id, tps->reg); - -+ if (!tps6594_irq_chip.name) -+ return -ENOMEM; -+ - ret = devm_regmap_add_irq_chip(dev, tps->regmap, tps->irq, IRQF_SHARED | IRQF_ONESHOT, - 0, &tps6594_irq_chip, &tps->irq_data); - if (ret) --- -2.43.2 - -From 7fd5dbcaac4a61bf6b15a8121c3bbefa4baa9550 Mon Sep 17 00:00:00 2001 -From: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Date: Mon, 11 Dec 2023 13:14:41 +0200 -Subject: [PATCH 0517/1501] mfd: intel-lpss: Fix the fractional clock divider - flags -Content-Length: 1314 -Lines: 32 - -[ Upstream commit 03d790f04fb2507173913cad9c213272ac983a60 ] - -The conversion to CLK_FRAC_DIVIDER_POWER_OF_TWO_PS uses wrong flags -in the parameters and hence miscalculates the values in the clock -divider. Fix this by applying the flag to the proper parameter. - -Fixes: 82f53f9ee577 ("clk: fractional-divider: Introduce POWER_OF_TWO_PS flag") -Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Reported-by: Alex Vinarskis <alex.vinarskis@gmail.com> -Link: https://lore.kernel.org/r/20231211111441.3910083-1-andriy.shevchenko@linux.intel.com -Signed-off-by: Lee Jones <lee@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/mfd/intel-lpss.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c -index 9591b354072a..00e7b578bb3e 100644 ---- a/drivers/mfd/intel-lpss.c -+++ b/drivers/mfd/intel-lpss.c -@@ -301,8 +301,8 @@ static int intel_lpss_register_clock_divider(struct intel_lpss *lpss, - - snprintf(name, sizeof(name), "%s-div", devname); - tmp = clk_register_fractional_divider(NULL, name, __clk_get_name(tmp), -+ 0, lpss->priv, 1, 15, 16, 15, - CLK_FRAC_DIVIDER_POWER_OF_TWO_PS, -- lpss->priv, 1, 15, 16, 15, 0, - NULL); - if (IS_ERR(tmp)) - return PTR_ERR(tmp); --- -2.43.2 - -From cf5e01a112c08e25303708d8e26e173429ec80b0 Mon Sep 17 00:00:00 2001 -From: Sebastian Andrzej Siewior <bigeasy@linutronix.de> -Date: Thu, 30 Nov 2023 14:27:29 +0100 -Subject: [PATCH 0518/1501] srcu: Use try-lock lockdep annotation for NMI-safe - access. -Content-Length: 2701 -Lines: 72 - -[ Upstream commit 3c6b0c1c28184038d90dffe8eb542bedcb8ccf98 ] - -It is claimed that srcu_read_lock_nmisafe() NMI-safe. However it -triggers a lockdep if used from NMI because lockdep expects a deadlock -since nothing disables NMIs while the lock is acquired. - -This is because commit f0f44752f5f61 ("rcu: Annotate SRCU's update-side -lockdep dependencies") annotates synchronize_srcu() as a write lock -usage. This helps to detect a deadlocks such as - srcu_read_lock(); - synchronize_srcu(); - srcu_read_unlock(); - -The side effect is that the lock srcu_struct now has a USED usage in normal -contexts, so it conflicts with a USED_READ usage in NMI. But this shouldn't -cause a real deadlock because the write lock usage from synchronize_srcu() -is a fake one and only used for read/write deadlock detection. - -Use a try-lock annotation for srcu_read_lock_nmisafe() to avoid lockdep -complains if used from NMI. - -Fixes: f0f44752f5f6 ("rcu: Annotate SRCU's update-side lockdep dependencies") -Link: https://lore.kernel.org/r/20230927160231.XRCDDSK4@linutronix.de -Reviewed-by: Boqun Feng <boqun.feng@gmail.com> -Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> -Signed-off-by: Paul E. McKenney <paulmck@kernel.org> -Signed-off-by: Neeraj Upadhyay (AMD) <neeraj.iitr10@gmail.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/linux/rcupdate.h | 6 ++++++ - include/linux/srcu.h | 2 +- - 2 files changed, 7 insertions(+), 1 deletion(-) - -diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h -index f7206b2623c9..31d523c4e089 100644 ---- a/include/linux/rcupdate.h -+++ b/include/linux/rcupdate.h -@@ -301,6 +301,11 @@ static inline void rcu_lock_acquire(struct lockdep_map *map) - lock_acquire(map, 0, 0, 2, 0, NULL, _THIS_IP_); - } - -+static inline void rcu_try_lock_acquire(struct lockdep_map *map) -+{ -+ lock_acquire(map, 0, 1, 2, 0, NULL, _THIS_IP_); -+} -+ - static inline void rcu_lock_release(struct lockdep_map *map) - { - lock_release(map, _THIS_IP_); -@@ -315,6 +320,7 @@ int rcu_read_lock_any_held(void); - #else /* #ifdef CONFIG_DEBUG_LOCK_ALLOC */ - - # define rcu_lock_acquire(a) do { } while (0) -+# define rcu_try_lock_acquire(a) do { } while (0) - # define rcu_lock_release(a) do { } while (0) - - static inline int rcu_read_lock_held(void) -diff --git a/include/linux/srcu.h b/include/linux/srcu.h -index 127ef3b2e607..236610e4a8fa 100644 ---- a/include/linux/srcu.h -+++ b/include/linux/srcu.h -@@ -229,7 +229,7 @@ static inline int srcu_read_lock_nmisafe(struct srcu_struct *ssp) __acquires(ssp - - srcu_check_nmi_safety(ssp, true); - retval = __srcu_read_lock_nmisafe(ssp); -- rcu_lock_acquire(&ssp->dep_map); -+ rcu_try_lock_acquire(&ssp->dep_map); - return retval; - } - --- -2.43.2 - -From 12e6ba21af24022ff7917ae1718c0a1f8a44ee2c Mon Sep 17 00:00:00 2001 -From: Serge Semin <fancer.lancer@gmail.com> -Date: Sat, 2 Dec 2023 14:14:18 +0300 -Subject: [PATCH 0519/1501] mips: dmi: Fix early remap on MIPS32 -Content-Length: 1499 -Lines: 36 - -[ Upstream commit 0d0a3748a2cb38f9da1f08d357688ebd982eb788 ] - -dmi_early_remap() has been defined as ioremap_cache() which on MIPS32 gets -to be converted to the VM-based mapping. DMI early remapping is performed -at the setup_arch() stage with no VM available. So calling the -dmi_early_remap() for MIPS32 causes the system to crash at the early boot -time. Fix that by converting dmi_early_remap() to the uncached remapping -which is always available on both 32 and 64-bits MIPS systems. - -Note this change shall not cause any regressions on the current DMI -support implementation because on the early boot-up stage neither MIPS32 -nor MIPS64 has the cacheable ioremapping support anyway. - -Fixes: be8fa1cb444c ("MIPS: Add support for Desktop Management Interface (DMI)") -Signed-off-by: Serge Semin <fancer.lancer@gmail.com> -Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/mips/include/asm/dmi.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/mips/include/asm/dmi.h b/arch/mips/include/asm/dmi.h -index 27415a288adf..dc397f630c66 100644 ---- a/arch/mips/include/asm/dmi.h -+++ b/arch/mips/include/asm/dmi.h -@@ -5,7 +5,7 @@ - #include <linux/io.h> - #include <linux/memblock.h> - --#define dmi_early_remap(x, l) ioremap_cache(x, l) -+#define dmi_early_remap(x, l) ioremap(x, l) - #define dmi_early_unmap(x, l) iounmap(x) - #define dmi_remap(x, l) ioremap_cache(x, l) - #define dmi_unmap(x) iounmap(x) --- -2.43.2 - -From 0cc5981ea8d810adb19236e14f162bc444c2a35c Mon Sep 17 00:00:00 2001 -From: Serge Semin <fancer.lancer@gmail.com> -Date: Sat, 2 Dec 2023 14:14:19 +0300 -Subject: [PATCH 0520/1501] mips: Fix incorrect max_low_pfn adjustment -Content-Length: 3147 -Lines: 72 - -[ Upstream commit 0f5cc249ff73552d3bd864e62f85841dafaa107d ] - -max_low_pfn variable is incorrectly adjusted if the kernel is built with -high memory support and the later is detected in a running system, so the -memory which actually can be directly mapped is getting into the highmem -zone. See the ZONE_NORMAL range on my MIPS32r5 system: - -> Zone ranges: -> DMA [mem 0x0000000000000000-0x0000000000ffffff] -> Normal [mem 0x0000000001000000-0x0000000007ffffff] -> HighMem [mem 0x0000000008000000-0x000000020fffffff] - -while the zones are supposed to look as follows: - -> Zone ranges: -> DMA [mem 0x0000000000000000-0x0000000000ffffff] -> Normal [mem 0x0000000001000000-0x000000001fffffff] -> HighMem [mem 0x0000000020000000-0x000000020fffffff] - -Even though the physical memory within the range [0x08000000;0x20000000] -belongs to MMIO on our system, we don't really want it to be considered as -high memory since on MIPS32 that range still can be directly mapped. - -Note there might be other problems caused by the max_low_pfn variable -misconfiguration. For instance high_memory variable is initialize with -virtual address corresponding to the max_low_pfn PFN, and by design it -must define the upper bound on direct map memory, then end of the normal -zone. That in its turn potentially may cause problems in accessing the -memory by means of the /dev/mem and /dev/kmem devices. - -Let's fix the discovered misconfiguration then. It turns out the commit -a94e4f24ec83 ("MIPS: init: Drop boot_mem_map") didn't introduce the -max_low_pfn adjustment quite correct. If the kernel is built with high -memory support and the system is equipped with high memory, the -max_low_pfn variable will need to be initialized with PFN of the most -upper directly reachable memory address so the zone normal would be -correctly setup. On MIPS that PFN corresponds to PFN_DOWN(HIGHMEM_START). -If the system is built with no high memory support and one is detected in -the running system, we'll just need to adjust the max_pfn variable to -discard the found high memory from the system and leave the max_low_pfn as -is, since the later will be less than PFN_DOWN(HIGHMEM_START) anyway by -design of the for_each_memblock() loop performed a bit early in the -bootmem_init() method. - -Fixes: a94e4f24ec83 ("MIPS: init: Drop boot_mem_map") -Signed-off-by: Serge Semin <fancer.lancer@gmail.com> -Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/mips/kernel/setup.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c -index 2d2ca024bd47..0461ab49e8f1 100644 ---- a/arch/mips/kernel/setup.c -+++ b/arch/mips/kernel/setup.c -@@ -321,11 +321,11 @@ static void __init bootmem_init(void) - panic("Incorrect memory mapping !!!"); - - if (max_pfn > PFN_DOWN(HIGHMEM_START)) { -+ max_low_pfn = PFN_DOWN(HIGHMEM_START); - #ifdef CONFIG_HIGHMEM -- highstart_pfn = PFN_DOWN(HIGHMEM_START); -+ highstart_pfn = max_low_pfn; - highend_pfn = max_pfn; - #else -- max_low_pfn = PFN_DOWN(HIGHMEM_START); - max_pfn = max_low_pfn; - #endif - } --- -2.43.2 - -From 5072b4c519397a77ac45715455385957d568f54e Mon Sep 17 00:00:00 2001 -From: Vincent Whitchurch <vincent.whitchurch@axis.com> -Date: Fri, 1 Sep 2023 15:35:43 +0200 -Subject: [PATCH 0521/1501] um: virt-pci: fix platform map offset -Content-Length: 944 -Lines: 28 - -[ Upstream commit 32253f00ac8a8073bf6db4bfe9d6511cc93c4aef ] - -The offset is currently always zero so the backend can't distinguish -between accesses to different ioremapped areas. - -Fixes: 522c532c4fe7 ("virt-pci: add platform bus support") -Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com> -Signed-off-by: Richard Weinberger <richard@nod.at> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/um/drivers/virt-pci.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/um/drivers/virt-pci.c b/arch/um/drivers/virt-pci.c -index ffe2ee8a0246..97a37c062997 100644 ---- a/arch/um/drivers/virt-pci.c -+++ b/arch/um/drivers/virt-pci.c -@@ -971,7 +971,7 @@ static long um_pci_map_platform(unsigned long offset, size_t size, - *ops = &um_pci_device_bar_ops; - *priv = &um_pci_platform_device->resptr[0]; - -- return 0; -+ return offset; - } - - static const struct logic_iomem_region_ops um_pci_platform_ops = { --- -2.43.2 - -From 1d7a03052846f34d624d0ab41a879adf5e85c85f Mon Sep 17 00:00:00 2001 -From: Alexandre Ghiti <alexghiti@rivosinc.com> -Date: Thu, 14 Dec 2023 10:19:26 +0100 -Subject: [PATCH 0522/1501] riscv: Check if the code to patch lies in the exit - section -Content-Length: 3392 -Lines: 102 - -[ Upstream commit 420370f3ae3d3b883813fd3051a38805160b2b9f ] - -Otherwise we fall through to vmalloc_to_page() which panics since the -address does not lie in the vmalloc region. - -Fixes: 043cb41a85de ("riscv: introduce interfaces to patch kernel code") -Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com> -Reviewed-by: Charlie Jenkins <charlie@rivosinc.com> -Link: https://lore.kernel.org/r/20231214091926.203439-1-alexghiti@rivosinc.com -Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/riscv/include/asm/sections.h | 1 + - arch/riscv/kernel/patch.c | 11 ++++++++++- - arch/riscv/kernel/vmlinux-xip.lds.S | 2 ++ - arch/riscv/kernel/vmlinux.lds.S | 2 ++ - 4 files changed, 15 insertions(+), 1 deletion(-) - -diff --git a/arch/riscv/include/asm/sections.h b/arch/riscv/include/asm/sections.h -index 32336e8a17cb..a393d5035c54 100644 ---- a/arch/riscv/include/asm/sections.h -+++ b/arch/riscv/include/asm/sections.h -@@ -13,6 +13,7 @@ extern char _start_kernel[]; - extern char __init_data_begin[], __init_data_end[]; - extern char __init_text_begin[], __init_text_end[]; - extern char __alt_start[], __alt_end[]; -+extern char __exittext_begin[], __exittext_end[]; - - static inline bool is_va_kernel_text(uintptr_t va) - { -diff --git a/arch/riscv/kernel/patch.c b/arch/riscv/kernel/patch.c -index 13ee7bf589a1..37e87fdcf6a0 100644 ---- a/arch/riscv/kernel/patch.c -+++ b/arch/riscv/kernel/patch.c -@@ -14,6 +14,7 @@ - #include <asm/fixmap.h> - #include <asm/ftrace.h> - #include <asm/patch.h> -+#include <asm/sections.h> - - struct patch_insn { - void *addr; -@@ -25,6 +26,14 @@ struct patch_insn { - int riscv_patch_in_stop_machine = false; - - #ifdef CONFIG_MMU -+ -+static inline bool is_kernel_exittext(uintptr_t addr) -+{ -+ return system_state < SYSTEM_RUNNING && -+ addr >= (uintptr_t)__exittext_begin && -+ addr < (uintptr_t)__exittext_end; -+} -+ - /* - * The fix_to_virt(, idx) needs a const value (not a dynamic variable of - * reg-a0) or BUILD_BUG_ON failed with "idx >= __end_of_fixed_addresses". -@@ -35,7 +44,7 @@ static __always_inline void *patch_map(void *addr, const unsigned int fixmap) - uintptr_t uintaddr = (uintptr_t) addr; - struct page *page; - -- if (core_kernel_text(uintaddr)) -+ if (core_kernel_text(uintaddr) || is_kernel_exittext(uintaddr)) - page = phys_to_page(__pa_symbol(addr)); - else if (IS_ENABLED(CONFIG_STRICT_MODULE_RWX)) - page = vmalloc_to_page(addr); -diff --git a/arch/riscv/kernel/vmlinux-xip.lds.S b/arch/riscv/kernel/vmlinux-xip.lds.S -index 50767647fbc6..8c3daa1b0531 100644 ---- a/arch/riscv/kernel/vmlinux-xip.lds.S -+++ b/arch/riscv/kernel/vmlinux-xip.lds.S -@@ -29,10 +29,12 @@ SECTIONS - HEAD_TEXT_SECTION - INIT_TEXT_SECTION(PAGE_SIZE) - /* we have to discard exit text and such at runtime, not link time */ -+ __exittext_begin = .; - .exit.text : - { - EXIT_TEXT - } -+ __exittext_end = .; - - .text : { - _text = .; -diff --git a/arch/riscv/kernel/vmlinux.lds.S b/arch/riscv/kernel/vmlinux.lds.S -index 492dd4b8f3d6..002ca58dd998 100644 ---- a/arch/riscv/kernel/vmlinux.lds.S -+++ b/arch/riscv/kernel/vmlinux.lds.S -@@ -69,10 +69,12 @@ SECTIONS - __soc_builtin_dtb_table_end = .; - } - /* we have to discard exit text and such at runtime, not link time */ -+ __exittext_begin = .; - .exit.text : - { - EXIT_TEXT - } -+ __exittext_end = .; - - __init_text_end = .; - . = ALIGN(SECTION_ALIGN); --- -2.43.2 - -From 82c34f2fe1f0b0f8134e3248d59efda4a6dc43d9 Mon Sep 17 00:00:00 2001 -From: Alexandre Ghiti <alexghiti@rivosinc.com> -Date: Tue, 12 Dec 2023 20:54:00 +0100 -Subject: [PATCH 0523/1501] riscv: Fix wrong usage of lm_alias() when splitting - a huge linear mapping -Content-Length: 1560 -Lines: 40 - -[ Upstream commit c29fc621e1a49949a14c7fa031dd4760087bfb29 ] - -lm_alias() can only be used on kernel mappings since it explicitly uses -__pa_symbol(), so simply fix this by checking where the address belongs -to before. - -Fixes: 311cd2f6e253 ("riscv: Fix set_memory_XX() and set_direct_map_XX() by splitting huge linear mappings") -Reported-by: syzbot+afb726d49f84c8d95ee1@syzkaller.appspotmail.com -Closes: https://lore.kernel.org/linux-riscv/000000000000620dd0060c02c5e1@google.com/ -Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com> -Reviewed-by: Charlie Jenkins <charlie@rivosinc.com> -Link: https://lore.kernel.org/r/20231212195400.128457-1-alexghiti@rivosinc.com -Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/riscv/mm/pageattr.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - -diff --git a/arch/riscv/mm/pageattr.c b/arch/riscv/mm/pageattr.c -index fc5fc4f785c4..96cbda683936 100644 ---- a/arch/riscv/mm/pageattr.c -+++ b/arch/riscv/mm/pageattr.c -@@ -305,8 +305,13 @@ static int __set_memory(unsigned long addr, int numpages, pgprot_t set_mask, - goto unlock; - } - } else if (is_kernel_mapping(start) || is_linear_mapping(start)) { -- lm_start = (unsigned long)lm_alias(start); -- lm_end = (unsigned long)lm_alias(end); -+ if (is_kernel_mapping(start)) { -+ lm_start = (unsigned long)lm_alias(start); -+ lm_end = (unsigned long)lm_alias(end); -+ } else { -+ lm_start = start; -+ lm_end = end; -+ } - - ret = split_linear_mapping(lm_start, lm_end); - if (ret) --- -2.43.2 - -From c757f93ffcc9213979118b7001bc72905744922e Mon Sep 17 00:00:00 2001 -From: Alexandre Ghiti <alexghiti@rivosinc.com> -Date: Wed, 13 Dec 2023 14:40:26 +0100 -Subject: [PATCH 0524/1501] riscv: Fix module_alloc() that did not reset the - linear mapping permissions -Content-Length: 1921 -Lines: 47 - -[ Upstream commit 749b94b08005929bbc636df21a23322733166e35 ] - -After unloading a module, we must reset the linear mapping permissions, -see the example below: - -Before unloading a module: - -0xffffaf809d65d000-0xffffaf809d6dc000 0x000000011d65d000 508K PTE . .. .. D A G . . W R V -0xffffaf809d6dc000-0xffffaf809d6dd000 0x000000011d6dc000 4K PTE . .. .. D A G . . . R V -0xffffaf809d6dd000-0xffffaf809d6e1000 0x000000011d6dd000 16K PTE . .. .. D A G . . W R V -0xffffaf809d6e1000-0xffffaf809d6e7000 0x000000011d6e1000 24K PTE . .. .. D A G . X . R V - -After unloading a module: - -0xffffaf809d65d000-0xffffaf809d6e1000 0x000000011d65d000 528K PTE . .. .. D A G . . W R V -0xffffaf809d6e1000-0xffffaf809d6e7000 0x000000011d6e1000 24K PTE . .. .. D A G . X W R V - -The last mapping is not reset and we end up with WX mappings in the linear -mapping. - -So add VM_FLUSH_RESET_PERMS to our module_alloc() definition. - -Fixes: 0cff8bff7af8 ("riscv: avoid the PIC offset of static percpu data in module beyond 2G limits") -Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com> -Link: https://lore.kernel.org/r/20231213134027.155327-2-alexghiti@rivosinc.com -Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/riscv/kernel/module.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c -index aac019ed63b1..862834bb1d64 100644 ---- a/arch/riscv/kernel/module.c -+++ b/arch/riscv/kernel/module.c -@@ -894,7 +894,8 @@ void *module_alloc(unsigned long size) - { - return __vmalloc_node_range(size, 1, MODULES_VADDR, - MODULES_END, GFP_KERNEL, -- PAGE_KERNEL, 0, NUMA_NO_NODE, -+ PAGE_KERNEL, VM_FLUSH_RESET_PERMS, -+ NUMA_NO_NODE, - __builtin_return_address(0)); - } - #endif --- -2.43.2 - -From 42736f24474b8a412cf6b02636eac0c93496cfe6 Mon Sep 17 00:00:00 2001 -From: Alexandre Ghiti <alexghiti@rivosinc.com> -Date: Wed, 13 Dec 2023 14:40:27 +0100 -Subject: [PATCH 0525/1501] riscv: Fix set_direct_map_default_noflush() to - reset _PAGE_EXEC -Content-Length: 1090 -Lines: 30 - -[ Upstream commit b8b2711336f03ece539de61479d6ffc44fb603d3 ] - -When resetting the linear mapping permissions, we must make sure that we -clear the X bit so that do not end up with WX mappings (since we set -PAGE_KERNEL). - -Fixes: 395a21ff859c ("riscv: add ARCH_HAS_SET_DIRECT_MAP support") -Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com> -Link: https://lore.kernel.org/r/20231213134027.155327-3-alexghiti@rivosinc.com -Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/riscv/mm/pageattr.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/riscv/mm/pageattr.c b/arch/riscv/mm/pageattr.c -index 96cbda683936..01398fee5cf8 100644 ---- a/arch/riscv/mm/pageattr.c -+++ b/arch/riscv/mm/pageattr.c -@@ -383,7 +383,7 @@ int set_direct_map_invalid_noflush(struct page *page) - int set_direct_map_default_noflush(struct page *page) - { - return __set_memory((unsigned long)page_address(page), 1, -- PAGE_KERNEL, __pgprot(0)); -+ PAGE_KERNEL, __pgprot(_PAGE_EXEC)); - } - - #ifdef CONFIG_DEBUG_PAGEALLOC --- -2.43.2 - -From 0fbd510985ef8464f47fd756ee6a0de0394fa94d Mon Sep 17 00:00:00 2001 -From: Frederik Haxel <haxel@fzi.de> -Date: Tue, 12 Dec 2023 14:01:13 +0100 -Subject: [PATCH 0526/1501] riscv: Fixed wrong register in - XIP_FIXUP_FLASH_OFFSET macro -Content-Length: 1007 -Lines: 31 - -[ Upstream commit 5daa3726410288075ba73c336bb2e80d6b06aa4d ] - -During the refactoring, a bug was introduced in the rarly used -XIP_FIXUP_FLASH_OFFSET macro. - -Fixes: bee7fbc38579 ("RISC-V CPU Idle Support") -Fixes: e7681beba992 ("RISC-V: Split out the XIP fixups into their own file") - -Signed-off-by: Frederik Haxel <haxel@fzi.de> -Link: https://lore.kernel.org/r/20231212130116.848530-3-haxel@fzi.de -Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/riscv/include/asm/xip_fixup.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/riscv/include/asm/xip_fixup.h b/arch/riscv/include/asm/xip_fixup.h -index d4ffc3c37649..b65bf6306f69 100644 ---- a/arch/riscv/include/asm/xip_fixup.h -+++ b/arch/riscv/include/asm/xip_fixup.h -@@ -13,7 +13,7 @@ - add \reg, \reg, t0 - .endm - .macro XIP_FIXUP_FLASH_OFFSET reg -- la t1, __data_loc -+ la t0, __data_loc - REG_L t1, _xip_phys_offset - sub \reg, \reg, t1 - add \reg, \reg, t0 --- -2.43.2 - -From f75b9c0707ec775b8d7b594972ac7a2c4cfb2b0e Mon Sep 17 00:00:00 2001 -From: Ankit Nautiyal <ankit.k.nautiyal@intel.com> -Date: Wed, 13 Dec 2023 14:46:29 +0530 -Subject: [PATCH 0527/1501] drm/i915/dp: Fix the max DSC bpc supported by - source -Content-Length: 1348 -Lines: 34 - -[ Upstream commit 584ebbefd12296c6bad009c8a0c9e610eb8283c8 ] - -Use correct helper for getting max DSC bpc supported by the source. - -Fixes: 1c56e9a39833 ("drm/i915/dp: Get optimal link config to have best compressed bpp") -Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com> -Cc: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com> -Cc: Jani Nikula <jani.nikula@intel.com> - -Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> -Reviewed-by: Swati Sharma <swati2.sharma@intel.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20231213091632.431557-3-ankit.k.nautiyal@intel.com -(cherry picked from commit cd7b0b2dd3d9fecc6057c07b40e8087db2f9f71a) -Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/i915/display/intel_dp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c -index 62ce92772367..1710ef24c511 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp.c -+++ b/drivers/gpu/drm/i915/display/intel_dp.c -@@ -2025,7 +2025,7 @@ static int intel_dp_dsc_compute_pipe_bpp(struct intel_dp *intel_dp, - } - } - -- dsc_max_bpc = intel_dp_dsc_min_src_input_bpc(i915); -+ dsc_max_bpc = intel_dp_dsc_max_src_input_bpc(i915); - if (!dsc_max_bpc) - return -EINVAL; - --- -2.43.2 - -From 2b18cfb58117571c295f0bcbe2b843369de38031 Mon Sep 17 00:00:00 2001 -From: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Date: Wed, 10 Jan 2024 19:07:36 +0100 -Subject: [PATCH 0528/1501] MIPS: Alchemy: Fix an out-of-bound access in - db1200_dev_setup() -Content-Length: 1108 -Lines: 28 - -[ Upstream commit 89c4b588d11e9acf01d604de4b0c715884f59213 ] - -When calling spi_register_board_info(), we should pass the number of -elements in 'db1200_spi_devs', not 'db1200_i2c_devs'. - -Fixes: 63323ec54a7e ("MIPS: Alchemy: Extended DB1200 board support.") -Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/mips/alchemy/devboards/db1200.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/mips/alchemy/devboards/db1200.c b/arch/mips/alchemy/devboards/db1200.c -index f521874ebb07..67f067706af2 100644 ---- a/arch/mips/alchemy/devboards/db1200.c -+++ b/arch/mips/alchemy/devboards/db1200.c -@@ -847,7 +847,7 @@ int __init db1200_dev_setup(void) - i2c_register_board_info(0, db1200_i2c_devs, - ARRAY_SIZE(db1200_i2c_devs)); - spi_register_board_info(db1200_spi_devs, -- ARRAY_SIZE(db1200_i2c_devs)); -+ ARRAY_SIZE(db1200_spi_devs)); - - /* SWITCHES: S6.8 I2C/SPI selector (OFF=I2C ON=SPI) - * S6.7 AC97/I2S selector (OFF=AC97 ON=I2S) --- -2.43.2 - -From dfb88135858a90a6f6a6f2520106d8be99aa3f2a Mon Sep 17 00:00:00 2001 -From: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Date: Wed, 10 Jan 2024 19:09:46 +0100 -Subject: [PATCH 0529/1501] MIPS: Alchemy: Fix an out-of-bound access in - db1550_dev_setup() -Content-Length: 1002 -Lines: 27 - -[ Upstream commit 3c1e5abcda64bed0c7bffa65af2316995f269a61 ] - -When calling spi_register_board_info(), - -Fixes: f869d42e580f ("MIPS: Alchemy: Improved DB1550 support, with audio and serial busses.") -Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/mips/alchemy/devboards/db1550.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/mips/alchemy/devboards/db1550.c b/arch/mips/alchemy/devboards/db1550.c -index fd91d9c9a252..6c6837181f55 100644 ---- a/arch/mips/alchemy/devboards/db1550.c -+++ b/arch/mips/alchemy/devboards/db1550.c -@@ -589,7 +589,7 @@ int __init db1550_dev_setup(void) - i2c_register_board_info(0, db1550_i2c_devs, - ARRAY_SIZE(db1550_i2c_devs)); - spi_register_board_info(db1550_spi_devs, -- ARRAY_SIZE(db1550_i2c_devs)); -+ ARRAY_SIZE(db1550_spi_devs)); - - c = clk_get(NULL, "psc0_intclk"); - if (!IS_ERR(c)) { --- -2.43.2 - -From 8fe09cf1c43e7320c5e1b354b2ff00f8541c41b1 Mon Sep 17 00:00:00 2001 -From: Jan Palus <jpalus@fastmail.com> -Date: Sat, 11 Nov 2023 23:17:04 +0100 -Subject: [PATCH 0530/1501] power: supply: cw2015: correct time_to_empty units - in sysfs -Content-Length: 1164 -Lines: 30 - -[ Upstream commit f37669119423ca852ca855b24732f25c0737aa57 ] - -RRT_ALRT register holds remaining battery time in minutes therefore it -needs to be scaled accordingly when exposing TIME_TO_EMPTY via sysfs -expressed in seconds - -Fixes: b4c7715c10c1 ("power: supply: add CellWise cw2015 fuel gauge driver") -Signed-off-by: Jan Palus <jpalus@fastmail.com> -Link: https://lore.kernel.org/r/20231111221704.5579-1-jpalus@fastmail.com -Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/power/supply/cw2015_battery.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c -index bb29e9ebd24a..99f3ccdc30a6 100644 ---- a/drivers/power/supply/cw2015_battery.c -+++ b/drivers/power/supply/cw2015_battery.c -@@ -491,7 +491,7 @@ static int cw_battery_get_property(struct power_supply *psy, - - case POWER_SUPPLY_PROP_TIME_TO_EMPTY_NOW: - if (cw_battery_valid_time_to_empty(cw_bat)) -- val->intval = cw_bat->time_to_empty; -+ val->intval = cw_bat->time_to_empty * 60; - else - val->intval = 0; - break; --- -2.43.2 - -From 9b5fde200fcbb46f6c8672de5c1209c6434dcbe0 Mon Sep 17 00:00:00 2001 -From: Su Hui <suhui@nfschina.com> -Date: Thu, 16 Nov 2023 12:18:23 +0800 -Subject: [PATCH 0531/1501] power: supply: bq256xx: fix some problem in - bq256xx_hw_init -Content-Length: 1670 -Lines: 47 - -[ Upstream commit b55d073e6501dc6077edaa945a6dad8ac5c8bbab ] - -smatch complains that there is a buffer overflow and clang complains -'ret' is never read. - -Smatch error: -drivers/power/supply/bq256xx_charger.c:1578 bq256xx_hw_init() error: -buffer overflow 'bq256xx_watchdog_time' 4 <= 4 - -Clang static checker: -Value stored to 'ret' is never read. - -Add check for buffer overflow and error code from regmap_update_bits(). - -Fixes: 32e4978bb920 ("power: supply: bq256xx: Introduce the BQ256XX charger driver") -Signed-off-by: Su Hui <suhui@nfschina.com> -Link: https://lore.kernel.org/r/20231116041822.1378758-1-suhui@nfschina.com -Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/power/supply/bq256xx_charger.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/drivers/power/supply/bq256xx_charger.c b/drivers/power/supply/bq256xx_charger.c -index 789a31bd70c3..1a935bc88510 100644 ---- a/drivers/power/supply/bq256xx_charger.c -+++ b/drivers/power/supply/bq256xx_charger.c -@@ -1574,13 +1574,16 @@ static int bq256xx_hw_init(struct bq256xx_device *bq) - wd_reg_val = i; - break; - } -- if (bq->watchdog_timer > bq256xx_watchdog_time[i] && -+ if (i + 1 < BQ256XX_NUM_WD_VAL && -+ bq->watchdog_timer > bq256xx_watchdog_time[i] && - bq->watchdog_timer < bq256xx_watchdog_time[i + 1]) - wd_reg_val = i; - } - ret = regmap_update_bits(bq->regmap, BQ256XX_CHARGER_CONTROL_1, - BQ256XX_WATCHDOG_MASK, wd_reg_val << - BQ256XX_WDT_BIT_SHIFT); -+ if (ret) -+ return ret; - - ret = power_supply_get_battery_info(bq->charger, &bat_info); - if (ret == -ENOMEM) --- -2.43.2 - -From bd26159dcaaa3e9a927070efd348e7ce7e5ee933 Mon Sep 17 00:00:00 2001 -From: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Date: Mon, 30 Oct 2023 13:42:18 +0200 -Subject: [PATCH 0532/1501] PCI: Avoid potential out-of-bounds read in - pci_dev_for_each_resource() -Content-Length: 2239 -Lines: 52 - -[ Upstream commit 3171e46d677a668eed3086da78671f1e4f5b8405 ] - -Coverity complains that pointer in the pci_dev_for_each_resource() may be -wrong, i.e., might be used for the out-of-bounds read. - -There is no actual issue right now because we have another check afterwards -and the out-of-bounds read is not being performed. In any case it's better -code with this fixed, hence the proposed change. - -As Jonas pointed out "It probably makes the code slightly less performant -as res will now be checked for being not NULL (which will always be true), -but I doubt it will be significant (or in any hot paths)." - -Fixes: 09cc90063240 ("PCI: Introduce pci_dev_for_each_resource()") -Reported-by: Bjorn Helgaas <bhelgaas@google.com> -Closes: https://lore.kernel.org/r/20230509182122.GA1259567@bhelgaas -Suggested-by: Jonas Gorski <jonas.gorski@gmail.com> -Link: https://lore.kernel.org/r/20231030114218.2752236-1-andriy.shevchenko@linux.intel.com -Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/linux/pci.h | 12 ++++++------ - 1 file changed, 6 insertions(+), 6 deletions(-) - -diff --git a/include/linux/pci.h b/include/linux/pci.h -index dea043bc1e38..bc80960fad7c 100644 ---- a/include/linux/pci.h -+++ b/include/linux/pci.h -@@ -2130,14 +2130,14 @@ int pci_iobar_pfn(struct pci_dev *pdev, int bar, struct vm_area_struct *vma); - (pci_resource_end((dev), (bar)) ? \ - resource_size(pci_resource_n((dev), (bar))) : 0) - --#define __pci_dev_for_each_res0(dev, res, ...) \ -- for (unsigned int __b = 0; \ -- res = pci_resource_n(dev, __b), __b < PCI_NUM_RESOURCES; \ -+#define __pci_dev_for_each_res0(dev, res, ...) \ -+ for (unsigned int __b = 0; \ -+ __b < PCI_NUM_RESOURCES && (res = pci_resource_n(dev, __b)); \ - __b++) - --#define __pci_dev_for_each_res1(dev, res, __b) \ -- for (__b = 0; \ -- res = pci_resource_n(dev, __b), __b < PCI_NUM_RESOURCES; \ -+#define __pci_dev_for_each_res1(dev, res, __b) \ -+ for (__b = 0; \ -+ __b < PCI_NUM_RESOURCES && (res = pci_resource_n(dev, __b)); \ - __b++) - - #define pci_dev_for_each_resource(dev, res, ...) \ --- -2.43.2 - -From 95e4e0031effad9837af557ecbfd4294a4d8aeee Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de> -Date: Fri, 10 Nov 2023 16:29:29 +0100 -Subject: [PATCH 0533/1501] serial: 8250: omap: Don't skip resource freeing if - pm_runtime_resume_and_get() failed -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1589 -Lines: 39 - -[ Upstream commit ad90d0358bd3b4554f243a425168fc7cebe7d04e ] - -Returning an error code from .remove() makes the driver core emit the -little helpful error message: - - remove callback returned a non-zero value. This will be ignored. - -and then remove the device anyhow. So all resources that were not freed -are leaked in this case. Skipping serial8250_unregister_port() has the -potential to keep enough of the UART around to trigger a use-after-free. - -So replace the error return (and with it the little helpful error -message) by a more useful error message and continue to cleanup. - -Fixes: e3f0c638f428 ("serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in omap8250_remove()") -Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> -Reviewed-by: Tony Lindgren <tony@atomide.com> -Link: https://lore.kernel.org/r/20231110152927.70601-2-u.kleine-koenig@pengutronix.de -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/tty/serial/8250/8250_omap.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c -index 578f35895b27..dd2be7a813c3 100644 ---- a/drivers/tty/serial/8250/8250_omap.c -+++ b/drivers/tty/serial/8250/8250_omap.c -@@ -1594,7 +1594,7 @@ static int omap8250_remove(struct platform_device *pdev) - - err = pm_runtime_resume_and_get(&pdev->dev); - if (err) -- return err; -+ dev_err(&pdev->dev, "Failed to resume hardware\n"); - - up = serial8250_get_port(priv->line); - omap_8250_shutdown(&up->port); --- -2.43.2 - -From 1cf24d70d7a21121bf39525c5a8cb3979551abb9 Mon Sep 17 00:00:00 2001 -From: Laurentiu Tudor <laurentiu.tudor@nxp.com> -Date: Tue, 26 Sep 2023 18:26:00 +0300 -Subject: [PATCH 0534/1501] iommu: Map reserved memory as cacheable if device - is coherent -Content-Length: 1304 -Lines: 35 - -[ Upstream commit f1aad9df93f39267e890836a28d22511f23474e1 ] - -Check if the device is marked as DMA coherent in the DT and if so, -map its reserved memory as cacheable in the IOMMU. -This fixes the recently added IOMMU reserved memory support which -uses IOMMU_RESV_DIRECT without properly building the PROT for the -mapping. - -Fixes: a5bf3cfce8cb ("iommu: Implement of_iommu_get_resv_regions()") -Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com> -Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> -Acked-by: Thierry Reding <treding@nvidia.com> -Link: https://lore.kernel.org/r/20230926152600.8749-1-laurentiu.tudor@nxp.com -Signed-off-by: Joerg Roedel <jroedel@suse.de> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/iommu/of_iommu.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/iommu/of_iommu.c b/drivers/iommu/of_iommu.c -index 35ba090f3b5e..47302b637cc0 100644 ---- a/drivers/iommu/of_iommu.c -+++ b/drivers/iommu/of_iommu.c -@@ -260,6 +260,9 @@ void of_iommu_get_resv_regions(struct device *dev, struct list_head *list) - phys_addr_t iova; - size_t length; - -+ if (of_dma_is_coherent(dev->of_node)) -+ prot |= IOMMU_CACHE; -+ - maps = of_translate_dma_region(np, maps, &iova, &length); - type = iommu_resv_region_get_type(dev, &phys, iova, length); - --- -2.43.2 - -From 59fcfb7617d3af37422d9e925922df7afa4a88bc Mon Sep 17 00:00:00 2001 -From: Nick Forrington <nick.forrington@arm.com> -Date: Thu, 2 Nov 2023 16:22:24 +0000 -Subject: [PATCH 0535/1501] perf test: Remove atomics from test_loop to avoid - test failures -Content-Length: 1778 -Lines: 50 - -[ Upstream commit 72b4ca7e993e94f09bcf6d19fc385a2e8060c71f ] - -The current use of atomics can lead to test failures, as tests (such as -tests/shell/record.sh) search for samples with "test_loop" as the -top-most stack frame, but find frames related to the atomic operation -(e.g. __aarch64_ldadd4_relax). - -This change simply removes the "count" variable, as it is not necessary. - -Fixes: 1962ab6f6e0b39e4 ("perf test workload thloop: Make count increments atomic") -Reviewed-by: James Clark <james.clark@arm.com> -Signed-off-by: Nick Forrington <nick.forrington@arm.com> -Acked-by: Leo Yan <leo.yan@linaro.org> -Cc: Adrian Hunter <adrian.hunter@intel.com> -Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> -Cc: Ian Rogers <irogers@google.com> -Cc: Jiri Olsa <jolsa@kernel.org> -Cc: Mark Rutland <mark.rutland@arm.com> -Cc: Namhyung Kim <namhyung@kernel.org> -Link: https://lore.kernel.org/r/20231102162225.50028-1-nick.forrington@arm.com -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/perf/tests/workloads/thloop.c | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - -diff --git a/tools/perf/tests/workloads/thloop.c b/tools/perf/tests/workloads/thloop.c -index af05269c2eb8..457b29f91c3e 100644 ---- a/tools/perf/tests/workloads/thloop.c -+++ b/tools/perf/tests/workloads/thloop.c -@@ -7,7 +7,6 @@ - #include "../tests.h" - - static volatile sig_atomic_t done; --static volatile unsigned count; - - /* We want to check this symbol in perf report */ - noinline void test_loop(void); -@@ -19,8 +18,7 @@ static void sighandler(int sig __maybe_unused) - - noinline void test_loop(void) - { -- while (!done) -- __atomic_fetch_add(&count, 1, __ATOMIC_RELAXED); -+ while (!done); - } - - static void *thfunc(void *arg) --- -2.43.2 - -From 15d38635ad8c6f621a40deaa0bdb76d6f6e62f17 Mon Sep 17 00:00:00 2001 -From: Adrian Hunter <adrian.hunter@intel.com> -Date: Thu, 23 Nov 2023 09:58:41 +0200 -Subject: [PATCH 0536/1501] perf header: Fix segfault on build_mem_topology() - error path -Content-Length: 2591 -Lines: 76 - -[ Upstream commit 70df07838fc1c0acfab3325ae79014e241a88bdf ] - -Do not increase the node count unless a node has been successfully read, -because it can lead to a segfault if an error occurs. - -For example, if perf exceeds the open file limit in memory_node__read(), -which, on a test system, could be made to happen by setting the file limit -to exactly 32: - - Before: - - $ ulimit -n 32 - $ perf mem record --all-user -- sleep 1 - [ perf record: Woken up 1 times to write data ] - failed: can't open memory sysfs data - perf: Segmentation fault - Obtained 14 stack frames. - perf(sighandler_dump_stack+0x48) [0x55f4b1f59558] - /lib/x86_64-linux-gnu/libc.so.6(+0x42520) [0x7f4ba1c42520] - /lib/x86_64-linux-gnu/libc.so.6(free+0x1e) [0x7f4ba1ca53fe] - perf(+0x178ff4) [0x55f4b1f48ff4] - perf(+0x179a70) [0x55f4b1f49a70] - perf(+0x17ef5d) [0x55f4b1f4ef5d] - perf(+0x85c0b) [0x55f4b1e55c0b] - perf(cmd_record+0xe1d) [0x55f4b1e5920d] - perf(cmd_mem+0xc96) [0x55f4b1e80e56] - perf(+0x130460) [0x55f4b1f00460] - perf(main+0x689) [0x55f4b1e427d9] - /lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x7f4ba1c29d90] - /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x7f4ba1c29e40] - perf(_start+0x25) [0x55f4b1e42a25] - Segmentation fault (core dumped) - $ - -After: - - $ ulimit -n 32 - $ perf mem record --all-user -- sleep 1 - [ perf record: Woken up 1 times to write data ] - failed: can't open memory sysfs data - [ perf record: Captured and wrote 0.005 MB perf.data (11 samples) ] - $ - -Fixes: f8e502b9d1b3b197 ("perf header: Ensure bitmaps are freed") -Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> -Acked-by: Ian Rogers <irogers@google.com> -Cc: German Gomez <german.gomez@arm.com> -Cc: Ian Rogers <irogers@google.com> -Cc: James Clark <james.clark@arm.com> -Cc: Jiri Olsa <jolsa@kernel.org> -Cc: Leo Yan <leo.yan@linaro.org> -Cc: Namhyung Kim <namhyung@kernel.org> -Link: https://lore.kernel.org/r/20231123075848.9652-2-adrian.hunter@intel.com -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/perf/util/header.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c -index e86b9439ffee..7609b4d468dc 100644 ---- a/tools/perf/util/header.c -+++ b/tools/perf/util/header.c -@@ -1444,7 +1444,9 @@ static int build_mem_topology(struct memory_node **nodesp, u64 *cntp) - nodes = new_nodes; - size += 4; - } -- ret = memory_node__read(&nodes[cnt++], idx); -+ ret = memory_node__read(&nodes[cnt], idx); -+ if (!ret) -+ cnt += 1; - } - out: - closedir(dir); --- -2.43.2 - -From a66b6f84213827ee2738c43b01f94e722eff3416 Mon Sep 17 00:00:00 2001 -From: Arnaldo Carvalho de Melo <acme@redhat.com> -Date: Thu, 30 Nov 2023 14:11:45 -0300 -Subject: [PATCH 0537/1501] libapi: Add missing linux/types.h header to get the - __u64 type on io.h -Content-Length: 983 -Lines: 31 - -[ Upstream commit af76b2dec0984a079d8497bfa37d29a9b55932e1 ] - -There are functions using __u64, so we need to have the linux/types.h -header otherwise we'll break when its not included before api/io.h. - -Fixes: e95770af4c4a280f ("tools api: Add a lightweight buffered reading api") -Reviewed-by: Ian Rogers <irogers@google.com> -Cc: Adrian Hunter <adrian.hunter@intel.com> -Cc: Jiri Olsa <jolsa@kernel.org> -Cc: Namhyung Kim <namhyung@kernel.org> -Link: https://lore.kernel.org/lkml/ZWjDPL+IzPPsuC3X@kernel.org -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/lib/api/io.h | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/tools/lib/api/io.h b/tools/lib/api/io.h -index a77b74c5fb65..2a7fe9758813 100644 ---- a/tools/lib/api/io.h -+++ b/tools/lib/api/io.h -@@ -12,6 +12,7 @@ - #include <stdlib.h> - #include <string.h> - #include <unistd.h> -+#include <linux/types.h> - - struct io { - /* File descriptor being read/ */ --- -2.43.2 - -From 7dc22c33e6c8a2f61b497443d35ff6719063e2ba Mon Sep 17 00:00:00 2001 -From: Umang Jain <umang.jain@ideasonboard.com> -Date: Wed, 29 Nov 2023 01:48:45 +0530 -Subject: [PATCH 0538/1501] staging: vc04_services: vchiq_core: Log through - struct vchiq_instance -Content-Length: 2105 -Lines: 50 - -[ Upstream commit f9c42898830383aff4fdc723828fa93a6abec02d ] - -The handle_to_service() helper can return NULL, so `service` pointer -can indeed be set to NULL. So, do not log through service pointer -(which can cause NULL-deference), instead, use the vchiq_instance -function argument to get access to the struct device. - -Fixes: f67af5940d6d ("staging: vc04: Convert(and rename) vchiq_log_info() to use dynamic debug") -Reviewed-by: Ricardo B. Marliere <ricardo@marliere.net> -Signed-off-by: Umang Jain <umang.jain@ideasonboard.com> -Link: https://lore.kernel.org/r/20231128201845.489237-1-umang.jain@ideasonboard.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../staging/vc04_services/interface/vchiq_arm/vchiq_core.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c -index 39b857da2d42..8a9eb0101c2e 100644 ---- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c -+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c -@@ -245,7 +245,7 @@ find_service_by_handle(struct vchiq_instance *instance, unsigned int handle) - return service; - } - rcu_read_unlock(); -- vchiq_log_debug(service->state->dev, VCHIQ_CORE, -+ vchiq_log_debug(instance->state->dev, VCHIQ_CORE, - "Invalid service handle 0x%x", handle); - return NULL; - } -@@ -287,7 +287,7 @@ find_service_for_instance(struct vchiq_instance *instance, unsigned int handle) - return service; - } - rcu_read_unlock(); -- vchiq_log_debug(service->state->dev, VCHIQ_CORE, -+ vchiq_log_debug(instance->state->dev, VCHIQ_CORE, - "Invalid service handle 0x%x", handle); - return NULL; - } -@@ -310,7 +310,7 @@ find_closed_service_for_instance(struct vchiq_instance *instance, unsigned int h - return service; - } - rcu_read_unlock(); -- vchiq_log_debug(service->state->dev, VCHIQ_CORE, -+ vchiq_log_debug(instance->state->dev, VCHIQ_CORE, - "Invalid service handle 0x%x", handle); - return service; - } --- -2.43.2 - -From 896735ce99fc4449039dd1f5fd79e05dd7fde3e5 Mon Sep 17 00:00:00 2001 -From: Umang Jain <umang.jain@ideasonboard.com> -Date: Wed, 29 Nov 2023 01:49:22 +0530 -Subject: [PATCH 0539/1501] staging: vc04_services: Do not pass NULL to - vchiq_log_error() -Content-Length: 2749 -Lines: 61 - -[ Upstream commit 149261d378d0ca441b16de6c1a250a350df66598 ] - -vchiq_add_connected_callback() logs using vchiq_log_error() macro, -but passes NULL instead of a struct device pointer. Fix it. - -vchiq_add_connected_callback() is not used anywhere in the vc04_services -as of now. It will be used when we add new drivers(VC shared memory and -bcm2835-isp), hence it kept as it is for now. - -Fixes: 1d8915cf8899 ("staging: vc04: Convert vchiq_log_error() to use dynamic debug") -Signed-off-by: Umang Jain <umang.jain@ideasonboard.com> -Link: https://lore.kernel.org/r/20231128201926.489269-2-umang.jain@ideasonboard.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../vc04_services/interface/vchiq_arm/vchiq_connected.c | 4 ++-- - .../vc04_services/interface/vchiq_arm/vchiq_connected.h | 4 +++- - 2 files changed, 5 insertions(+), 3 deletions(-) - -diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_connected.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_connected.c -index b3928bd8c9c6..21f9fa1a1713 100644 ---- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_connected.c -+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_connected.c -@@ -27,7 +27,7 @@ static void connected_init(void) - * be made immediately, otherwise it will be deferred until - * vchiq_call_connected_callbacks is called. - */ --void vchiq_add_connected_callback(void (*callback)(void)) -+void vchiq_add_connected_callback(struct vchiq_device *device, void (*callback)(void)) - { - connected_init(); - -@@ -39,7 +39,7 @@ void vchiq_add_connected_callback(void (*callback)(void)) - callback(); - } else { - if (g_num_deferred_callbacks >= MAX_CALLBACKS) { -- vchiq_log_error(NULL, VCHIQ_CORE, -+ vchiq_log_error(&device->dev, VCHIQ_CORE, - "There already %d callback registered - please increase MAX_CALLBACKS", - g_num_deferred_callbacks); - } else { -diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_connected.h b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_connected.h -index 4caf5e30099d..e4ed56446f8a 100644 ---- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_connected.h -+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_connected.h -@@ -1,10 +1,12 @@ - /* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */ - /* Copyright (c) 2010-2012 Broadcom. All rights reserved. */ - -+#include "vchiq_bus.h" -+ - #ifndef VCHIQ_CONNECTED_H - #define VCHIQ_CONNECTED_H - --void vchiq_add_connected_callback(void (*callback)(void)); -+void vchiq_add_connected_callback(struct vchiq_device *device, void (*callback)(void)); - void vchiq_call_connected_callbacks(void); - - #endif /* VCHIQ_CONNECTED_H */ --- -2.43.2 - -From 1b886bd484b631033a373df47f418f2148bb6ce2 Mon Sep 17 00:00:00 2001 -From: Veronika Molnarova <vmolnaro@redhat.com> -Date: Fri, 1 Dec 2023 20:46:17 +0100 -Subject: [PATCH 0540/1501] perf test record user-regs: Fix mask for vg - register -Content-Length: 2616 -Lines: 60 - -[ Upstream commit 28b01743ca752cea5ab182297d8b912b22f2a2d1 ] - -The 'vg' register for arm64 shows up in --user_regs as available when -masking the variable AT_HWCAP with 1 << 22 returns '1' as done in -perf_regs.c. - -However, in subtests for support of SVE, the check for the 'vg' register -is done by masking the variable AT_HWCAP with the value 0x200000 which -is equals to 1 << 21 instead of 1 << 22. - -This results in inconsistencies on certain systems where the test -expects that the 'vg' register is not operational when it is, and -vice-versa. - -During the testing on a machine that the test expected not to have the -'vg' register available, 'perf record' with the option --user-regs -showed records for the 'vg' register together with all of the others, -which means that the mask for the subtest of perf_event_attr is off by -one. - -Change the value of the mask from 0x200000 to 0x400000 to correct it. - -Fixes: 9440ebdc333dd12e ("perf test arm64: Add attr tests for new VG register") -Reviewed-by: Leo Yan <leo.yan@linaro.org> -Signed-off-by: Veronika Molnarova <vmolnaro@redhat.com> -Cc: James Clark <james.clark@arm.com> -Cc: Michael Petlan <mpetlan@redhat.com> -Link: https://lore.kernel.org/r/20231201194617.13012-1-vmolnaro@redhat.com -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/perf/tests/attr/test-record-user-regs-no-sve-aarch64 | 2 +- - tools/perf/tests/attr/test-record-user-regs-sve-aarch64 | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/tools/perf/tests/attr/test-record-user-regs-no-sve-aarch64 b/tools/perf/tests/attr/test-record-user-regs-no-sve-aarch64 -index fbb065842880..bed765450ca9 100644 ---- a/tools/perf/tests/attr/test-record-user-regs-no-sve-aarch64 -+++ b/tools/perf/tests/attr/test-record-user-regs-no-sve-aarch64 -@@ -6,4 +6,4 @@ args = --no-bpf-event --user-regs=vg kill >/dev/null 2>&1 - ret = 129 - test_ret = true - arch = aarch64 --auxv = auxv["AT_HWCAP"] & 0x200000 == 0 -+auxv = auxv["AT_HWCAP"] & 0x400000 == 0 -diff --git a/tools/perf/tests/attr/test-record-user-regs-sve-aarch64 b/tools/perf/tests/attr/test-record-user-regs-sve-aarch64 -index c598c803221d..a65113cd7311 100644 ---- a/tools/perf/tests/attr/test-record-user-regs-sve-aarch64 -+++ b/tools/perf/tests/attr/test-record-user-regs-sve-aarch64 -@@ -6,7 +6,7 @@ args = --no-bpf-event --user-regs=vg kill >/dev/null 2>&1 - ret = 1 - test_ret = true - arch = aarch64 --auxv = auxv["AT_HWCAP"] & 0x200000 == 0x200000 -+auxv = auxv["AT_HWCAP"] & 0x400000 == 0x400000 - kernel_since = 6.1 - - [event:base-record] --- -2.43.2 - -From f3f61693a2410f8492ea547f1f3136c4516f595f Mon Sep 17 00:00:00 2001 -From: Brett Creeley <brett.creeley@amd.com> -Date: Thu, 16 Nov 2023 16:12:02 -0800 -Subject: [PATCH 0541/1501] vfio/pds: Fix calculations in pds_vfio_dirty_sync -Content-Length: 2115 -Lines: 51 - -[ Upstream commit 4004497cec3093d7b0087bc70709b45969fa07b6 ] - -The incorrect check is being done for comparing the -iova/length being requested to sync. This can cause -the dirty sync operation to fail. Fix this by making -sure the iova offset added to the requested sync -length doesn't exceed the region_size. - -Also, the region_start is assumed to always be at 0. -This can cause dirty tracking to fail because the -device/driver bitmap offset always starts at 0, -however, the region_start/iova may not. Fix this by -determining the iova offset from region_start to -determine the bitmap offset. - -Fixes: f232836a9152 ("vfio/pds: Add support for dirty page tracking") -Signed-off-by: Brett Creeley <brett.creeley@amd.com> -Signed-off-by: Shannon Nelson <shannon.nelson@amd.com> -Link: https://lore.kernel.org/r/20231117001207.2793-2-brett.creeley@amd.com -Signed-off-by: Alex Williamson <alex.williamson@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/vfio/pci/pds/dirty.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/vfio/pci/pds/dirty.c b/drivers/vfio/pci/pds/dirty.c -index c937aa6f3954..27607d7b9030 100644 ---- a/drivers/vfio/pci/pds/dirty.c -+++ b/drivers/vfio/pci/pds/dirty.c -@@ -478,8 +478,7 @@ static int pds_vfio_dirty_sync(struct pds_vfio_pci_device *pds_vfio, - pds_vfio->vf_id, iova, length, pds_vfio->dirty.region_page_size, - pages, bitmap_size); - -- if (!length || ((dirty->region_start + iova + length) > -- (dirty->region_start + dirty->region_size))) { -+ if (!length || ((iova - dirty->region_start + length) > dirty->region_size)) { - dev_err(dev, "Invalid iova 0x%lx and/or length 0x%lx to sync\n", - iova, length); - return -EINVAL; -@@ -496,7 +495,8 @@ static int pds_vfio_dirty_sync(struct pds_vfio_pci_device *pds_vfio, - return -EINVAL; - } - -- bmp_offset = DIV_ROUND_UP(iova / dirty->region_page_size, sizeof(u64)); -+ bmp_offset = DIV_ROUND_UP((iova - dirty->region_start) / -+ dirty->region_page_size, sizeof(u64)); - - dev_dbg(dev, - "Syncing dirty bitmap, iova 0x%lx length 0x%lx, bmp_offset %llu bmp_bytes %llu\n", --- -2.43.2 - -From b3675dfa4501c8ace1c9f7950dee644244407756 Mon Sep 17 00:00:00 2001 -From: Ilkka Koskinen <ilkka@os.amperecomputing.com> -Date: Thu, 30 Nov 2023 18:15:49 -0800 -Subject: [PATCH 0542/1501] perf vendor events arm64 AmpereOne: Rename - BPU_FLUSH_MEM_FAULT to GPC_FLUSH_MEM_FAULT -Content-Length: 1907 -Lines: 44 - -[ Upstream commit 10a149e4b4a9187940adbfff0f216ccb5a15aa41 ] - -The documentation wrongly called the event as BPU_FLUSH_MEM_FAULT and now -has been fixed. Correct the name in the perf tool as well. - -Fixes: a9650b7f6fc09d16 ("perf vendor events arm64: Add AmpereOne core PMU events") -Reviewed-by: Ian Rogers <irogers@google.com> -Signed-off-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> -Cc: Adrian Hunter <adrian.hunter@intel.com> -Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> -Cc: Ilkka Koskinen <ilkka@os.amperecomputing.com> -Cc: Ingo Molnar <mingo@redhat.com> -Cc: James Clark <james.clark@arm.com> -Cc: Jiri Olsa <jolsa@kernel.org> -Cc: John Garry <john.g.garry@oracle.com> -Cc: Leo Yan <leo.yan@linaro.org> -Cc: linux-arm-kernel@lists.infradead.org -Cc: Mark Rutland <mark.rutland@arm.com> -Cc: Mike Leach <mike.leach@linaro.org> -Cc: Namhyung Kim <namhyung@kernel.org> -Cc: Peter Zijlstra <peterz@infradead.org> -Cc: Will Deacon <will@kernel.org> -Link: https://lore.kernel.org/r/20231201021550.1109196-3-ilkka@os.amperecomputing.com -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../pmu-events/arch/arm64/ampere/ampereone/core-imp-def.json | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/tools/perf/pmu-events/arch/arm64/ampere/ampereone/core-imp-def.json b/tools/perf/pmu-events/arch/arm64/ampere/ampereone/core-imp-def.json -index 88b23b85e33c..879ff21e0b17 100644 ---- a/tools/perf/pmu-events/arch/arm64/ampere/ampereone/core-imp-def.json -+++ b/tools/perf/pmu-events/arch/arm64/ampere/ampereone/core-imp-def.json -@@ -110,7 +110,7 @@ - { - "PublicDescription": "Flushes due to memory hazards", - "EventCode": "0x121", -- "EventName": "BPU_FLUSH_MEM_FAULT", -+ "EventName": "GPC_FLUSH_MEM_FAULT", - "BriefDescription": "Flushes due to memory hazards" - }, - { --- -2.43.2 - -From 5d793f1482687562781505857bba68c0968894e2 Mon Sep 17 00:00:00 2001 -From: Athira Rajeev <atrajeev@linux.vnet.ibm.com> -Date: Thu, 23 Nov 2023 21:31:10 +0530 -Subject: [PATCH 0543/1501] perf vendor events powerpc: Update datasource event - name to fix duplicate events -Content-Length: 4284 -Lines: 105 - -[ Upstream commit 9eef41014fe01287dae79fe208b9b433b13040bb ] - -Running "perf list" on powerpc fails with segfault as below: - - $ ./perf list - Segmentation fault (core dumped) - $ - -This happens because of duplicate events in the JSON list. The powerpc -JSON event list contains some event with same event name, but different -event code. They are: - -- PM_INST_FROM_L3MISS (Present in datasource and frontend) -- PM_MRK_DATA_FROM_L2MISS (Present in datasource and marked) -- PM_MRK_INST_FROM_L3MISS (Present in datasource and marked) -- PM_MRK_DATA_FROM_L3MISS (Present in datasource and marked) - -pmu_events_table__num_events() uses the value from table_pmu->num_entries -which includes duplicate events as well. This causes issue during "perf -list" and results in a segmentation fault. - -Since both event codes are valid, append _DSRC to the Data Source events -(datasource.json), so that they would have a unique name. - -Also add PM_DATA_FROM_L2MISS_DSRC and PM_DATA_FROM_L3MISS_DSRC events. - -With the fix, 'perf list' works as expected. - -Fixes: fc143580753348c6 ("perf vendor events power10: Update JSON/events") -Signed-off-by: Athira Jajeev <atrajeev@linux.vnet.ibm.com> -Tested-by: Disha Goel <disgoel@linux.ibm.com> -Cc: Adrian Hunter <adrian.hunter@intel.com> -Cc: Disha Goel <disgoel@linux.vnet.ibm.com> -Cc: Ian Rogers <irogers@google.com> -Cc: James Clark <james.clark@arm.com> -Cc: Jiri Olsa <jolsa@kernel.org> -Cc: Kajol Jain <kjain@linux.ibm.com> -Cc: linuxppc-dev@lists.ozlabs.org -Cc: Madhavan Srinivasan <maddy@linux.ibm.com> -Cc: Namhyung Kim <namhyung@kernel.org> -Link: https://lore.kernel.org/r/20231123160110.94090-1-atrajeev@linux.vnet.ibm.com -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../arch/powerpc/power10/datasource.json | 18 ++++++++++++++---- - 1 file changed, 14 insertions(+), 4 deletions(-) - -diff --git a/tools/perf/pmu-events/arch/powerpc/power10/datasource.json b/tools/perf/pmu-events/arch/powerpc/power10/datasource.json -index 6b0356f2d301..0eeaaf1a95b8 100644 ---- a/tools/perf/pmu-events/arch/powerpc/power10/datasource.json -+++ b/tools/perf/pmu-events/arch/powerpc/power10/datasource.json -@@ -99,6 +99,11 @@ - "EventName": "PM_INST_FROM_L2MISS", - "BriefDescription": "The processor's instruction cache was reloaded from a source beyond the local core's L2 due to a demand miss." - }, -+ { -+ "EventCode": "0x0003C0000000C040", -+ "EventName": "PM_DATA_FROM_L2MISS_DSRC", -+ "BriefDescription": "The processor's L1 data cache was reloaded from a source beyond the local core's L2 due to a demand miss." -+ }, - { - "EventCode": "0x000380000010C040", - "EventName": "PM_INST_FROM_L2MISS_ALL", -@@ -161,9 +166,14 @@ - }, - { - "EventCode": "0x000780000000C040", -- "EventName": "PM_INST_FROM_L3MISS", -+ "EventName": "PM_INST_FROM_L3MISS_DSRC", - "BriefDescription": "The processor's instruction cache was reloaded from beyond the local core's L3 due to a demand miss." - }, -+ { -+ "EventCode": "0x0007C0000000C040", -+ "EventName": "PM_DATA_FROM_L3MISS_DSRC", -+ "BriefDescription": "The processor's L1 data cache was reloaded from beyond the local core's L3 due to a demand miss." -+ }, - { - "EventCode": "0x000780000010C040", - "EventName": "PM_INST_FROM_L3MISS_ALL", -@@ -981,7 +991,7 @@ - }, - { - "EventCode": "0x0003C0000000C142", -- "EventName": "PM_MRK_DATA_FROM_L2MISS", -+ "EventName": "PM_MRK_DATA_FROM_L2MISS_DSRC", - "BriefDescription": "The processor's L1 data cache was reloaded from a source beyond the local core's L2 due to a demand miss for a marked instruction." - }, - { -@@ -1046,12 +1056,12 @@ - }, - { - "EventCode": "0x000780000000C142", -- "EventName": "PM_MRK_INST_FROM_L3MISS", -+ "EventName": "PM_MRK_INST_FROM_L3MISS_DSRC", - "BriefDescription": "The processor's instruction cache was reloaded from beyond the local core's L3 due to a demand miss for a marked instruction." - }, - { - "EventCode": "0x0007C0000000C142", -- "EventName": "PM_MRK_DATA_FROM_L3MISS", -+ "EventName": "PM_MRK_DATA_FROM_L3MISS_DSRC", - "BriefDescription": "The processor's L1 data cache was reloaded from beyond the local core's L3 due to a demand miss for a marked instruction." - }, - { --- -2.43.2 - -From 783510ea243f7988edbc5f8812a54c6cc14ef175 Mon Sep 17 00:00:00 2001 -From: Kan Liang <kan.liang@linux.intel.com> -Date: Tue, 28 Nov 2023 12:39:40 -0800 -Subject: [PATCH 0544/1501] perf mem: Fix error on hybrid related to - availability of mem event in a PMU -Content-Length: 4311 -Lines: 122 - -[ Upstream commit a4320085a6c694326dd8db46f563d52d1a826f07 ] - -The below error can be triggered on a hybrid machine. - - $ perf mem record -t load sleep 1 - event syntax error: 'breakpoint/mem-loads,ldlat=30/P' - \___ Bad event or PMU - - Unable to find PMU or event on a PMU of 'breakpoint' - -In the perf_mem_events__record_args(), the current perf never checks the -availability of a mem event on a given PMU. All the PMUs will be added -to the perf mem event list. Perf errors out for the unsupported PMU. - -Extend perf_mem_event__supported() and take a PMU into account. Check -the mem event for each PMU before adding it to the perf mem event list. - -Optimize the perf_mem_events__init() a little bit. The function is to -check whether the mem events are supported in the system. It doesn't -need to scan all PMUs. Just return with the first supported PMU is good -enough. - -Fixes: 5752c20f3787c9bc ("perf mem: Scan all PMUs instead of just core ones") -Reported-by: Ammy Yi <ammy.yi@intel.com> -Signed-off-by: Kan Liang <kan.liang@linux.intel.com> -Tested-by: Ammy Yi <ammy.yi@intel.com> -Acked-by: Ian Rogers <irogers@google.com> -Cc: Adrian Hunter <adrian.hunter@intel.com> -Cc: Ingo Molnar <mingo@redhat.com> -Cc: Jiri Olsa <jolsa@kernel.org> -Cc: Mark Rutland <mark.rutland@arm.com> -Cc: Namhyung Kim <namhyung@kernel.org> -Cc: Peter Zijlstra <peterz@infradead.org> -Cc: Ravi Bangoria <ravi.bangoria@amd.com> -Link: https://lore.kernel.org/r/20231128203940.3964287-1-kan.liang@linux.intel.com -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/perf/util/mem-events.c | 25 ++++++++++++++----------- - 1 file changed, 14 insertions(+), 11 deletions(-) - -diff --git a/tools/perf/util/mem-events.c b/tools/perf/util/mem-events.c -index 954b235e12e5..3a2e3687878c 100644 ---- a/tools/perf/util/mem-events.c -+++ b/tools/perf/util/mem-events.c -@@ -100,11 +100,14 @@ int perf_mem_events__parse(const char *str) - return -1; - } - --static bool perf_mem_event__supported(const char *mnt, char *sysfs_name) -+static bool perf_mem_event__supported(const char *mnt, struct perf_pmu *pmu, -+ struct perf_mem_event *e) - { -+ char sysfs_name[100]; - char path[PATH_MAX]; - struct stat st; - -+ scnprintf(sysfs_name, sizeof(sysfs_name), e->sysfs_name, pmu->name); - scnprintf(path, PATH_MAX, "%s/devices/%s", mnt, sysfs_name); - return !stat(path, &st); - } -@@ -120,7 +123,6 @@ int perf_mem_events__init(void) - - for (j = 0; j < PERF_MEM_EVENTS__MAX; j++) { - struct perf_mem_event *e = perf_mem_events__ptr(j); -- char sysfs_name[100]; - struct perf_pmu *pmu = NULL; - - /* -@@ -136,12 +138,12 @@ int perf_mem_events__init(void) - * of core PMU. - */ - while ((pmu = perf_pmus__scan(pmu)) != NULL) { -- scnprintf(sysfs_name, sizeof(sysfs_name), e->sysfs_name, pmu->name); -- e->supported |= perf_mem_event__supported(mnt, sysfs_name); -+ e->supported |= perf_mem_event__supported(mnt, pmu, e); -+ if (e->supported) { -+ found = true; -+ break; -+ } - } -- -- if (e->supported) -- found = true; - } - - return found ? 0 : -ENOENT; -@@ -167,13 +169,10 @@ static void perf_mem_events__print_unsupport_hybrid(struct perf_mem_event *e, - int idx) - { - const char *mnt = sysfs__mount(); -- char sysfs_name[100]; - struct perf_pmu *pmu = NULL; - - while ((pmu = perf_pmus__scan(pmu)) != NULL) { -- scnprintf(sysfs_name, sizeof(sysfs_name), e->sysfs_name, -- pmu->name); -- if (!perf_mem_event__supported(mnt, sysfs_name)) { -+ if (!perf_mem_event__supported(mnt, pmu, e)) { - pr_err("failed: event '%s' not supported\n", - perf_mem_events__name(idx, pmu->name)); - } -@@ -183,6 +182,7 @@ static void perf_mem_events__print_unsupport_hybrid(struct perf_mem_event *e, - int perf_mem_events__record_args(const char **rec_argv, int *argv_nr, - char **rec_tmp, int *tmp_nr) - { -+ const char *mnt = sysfs__mount(); - int i = *argv_nr, k = 0; - struct perf_mem_event *e; - -@@ -211,6 +211,9 @@ int perf_mem_events__record_args(const char **rec_argv, int *argv_nr, - while ((pmu = perf_pmus__scan(pmu)) != NULL) { - const char *s = perf_mem_events__name(j, pmu->name); - -+ if (!perf_mem_event__supported(mnt, pmu, e)) -+ continue; -+ - rec_argv[i++] = "-e"; - if (s) { - char *copy = strdup(s); --- -2.43.2 - -From a669520c894b10938520b52c7c811d5224ef5231 Mon Sep 17 00:00:00 2001 -From: Ian Rogers <irogers@google.com> -Date: Wed, 6 Dec 2023 10:35:33 -0800 -Subject: [PATCH 0545/1501] perf stat: Exit perf stat if parse groups fails -Content-Length: 2290 -Lines: 64 - -[ Upstream commit 0713ab3bd169da82c35eefd012b07b715e4ebcf7 ] - -Metrics were added by a callback but commit a4b8cfcabb1d90ec ("perf -stat: Delay metric parsing") postponed this to allow optimizations based -on the CPU configuration. - -In doing so it stopped errors in metric parsing from causing 'perf stat' -termination. - -This change adds the termination for bad metric names back in. - -Fixes: a4b8cfcabb1d90ec ("perf stat: Delay metric parsing") -Reported-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Ian Rogers <irogers@google.com> -Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Cc: Adrian Hunter <adrian.hunter@intel.com> -Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> -Cc: Ian Rogers <irogers@google.com> -Cc: Ingo Molnar <mingo@redhat.com> -Cc: Jiri Olsa <jolsa@kernel.org> -Cc: Mark Rutland <mark.rutland@arm.com> -Cc: Namhyung Kim <namhyung@kernel.org> -Cc: Peter Zijlstra <peterz@infradead.org> -Closes: https://lore.kernel.org/lkml/ZXByT1K6enTh2EHT@kernel.org/ -Link: https://lore.kernel.org/r/20231206183533.972028-1-irogers@google.com -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/perf/builtin-stat.c | 18 +++++++++++------- - 1 file changed, 11 insertions(+), 7 deletions(-) - -diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c -index a3af805a1d57..78c104922181 100644 ---- a/tools/perf/builtin-stat.c -+++ b/tools/perf/builtin-stat.c -@@ -2695,15 +2695,19 @@ int cmd_stat(int argc, const char **argv) - */ - if (metrics) { - const char *pmu = parse_events_option_args.pmu_filter ?: "all"; -+ int ret = metricgroup__parse_groups(evsel_list, pmu, metrics, -+ stat_config.metric_no_group, -+ stat_config.metric_no_merge, -+ stat_config.metric_no_threshold, -+ stat_config.user_requested_cpu_list, -+ stat_config.system_wide, -+ &stat_config.metric_events); - -- metricgroup__parse_groups(evsel_list, pmu, metrics, -- stat_config.metric_no_group, -- stat_config.metric_no_merge, -- stat_config.metric_no_threshold, -- stat_config.user_requested_cpu_list, -- stat_config.system_wide, -- &stat_config.metric_events); - zfree(&metrics); -+ if (ret) { -+ status = ret; -+ goto out; -+ } - } - - if (add_default_attributes()) --- -2.43.2 - -From 065ed56ce40b9f92de3043d03e45c085913e1fa2 Mon Sep 17 00:00:00 2001 -From: Gregory Price <gourry.memverge@gmail.com> -Date: Mon, 30 Oct 2023 00:42:39 -0400 -Subject: [PATCH 0546/1501] base/node.c: initialize the accessor list before - registering -Content-Length: 1806 -Lines: 56 - -[ Upstream commit 48b5928e18dc27e05cab3dc4c78cd8a15baaf1e5 ] - -The current code registers the node as available in the node array -before initializing the accessor list. This makes it so that -anything which might access the accessor list as a result of -allocations will cause an undefined memory access. - -In one example, an extension to access hmat data during interleave -caused this undefined access as a result of a bulk allocation -that occurs during node initialization but before the accessor -list is initialized. - -Initialize the accessor list before making the node generally -available to the global system. - -Fixes: 08d9dbe72b1f ("node: Link memory nodes to their compute nodes") -Signed-off-by: Gregory Price <gregory.price@memverge.com> -Link: https://lore.kernel.org/r/20231030044239.971756-1-gregory.price@memverge.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/base/node.c | 9 ++++++--- - 1 file changed, 6 insertions(+), 3 deletions(-) - -diff --git a/drivers/base/node.c b/drivers/base/node.c -index 493d533f8375..4d588f4658c8 100644 ---- a/drivers/base/node.c -+++ b/drivers/base/node.c -@@ -868,11 +868,15 @@ int __register_one_node(int nid) - { - int error; - int cpu; -+ struct node *node; - -- node_devices[nid] = kzalloc(sizeof(struct node), GFP_KERNEL); -- if (!node_devices[nid]) -+ node = kzalloc(sizeof(struct node), GFP_KERNEL); -+ if (!node) - return -ENOMEM; - -+ INIT_LIST_HEAD(&node->access_list); -+ node_devices[nid] = node; -+ - error = register_node(node_devices[nid], nid); - - /* link cpu under this node */ -@@ -881,7 +885,6 @@ int __register_one_node(int nid) - register_cpu_under_node(cpu, nid); - } - -- INIT_LIST_HEAD(&node_devices[nid]->access_list); - node_init_caches(nid); - - return error; --- -2.43.2 - -From fc051a66ba0dcba320f12a0e9256dcf8835f4aa6 Mon Sep 17 00:00:00 2001 -From: Sakari Ailus <sakari.ailus@linux.intel.com> -Date: Thu, 9 Nov 2023 12:10:08 +0200 -Subject: [PATCH 0547/1501] acpi: property: Let args be NULL in - __acpi_node_get_property_reference -Content-Length: 1692 -Lines: 43 - -[ Upstream commit bef52aa0f3de1b7d8c258c13b16e577361dabf3a ] - -fwnode_get_property_reference_args() may not be called with args argument -NULL on ACPI, OF already supports this. Add the missing NULL checks and -document this. - -The purpose is to be able to count the references. - -Fixes: 977d5ad39f3e ("ACPI: Convert ACPI reference args to generic fwnode reference args") -Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> -Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> -Link: https://lore.kernel.org/r/20231109101010.1329587-2-sakari.ailus@linux.intel.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/acpi/property.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c -index 6979a3f9f90a..4d042673d57b 100644 ---- a/drivers/acpi/property.c -+++ b/drivers/acpi/property.c -@@ -852,6 +852,7 @@ static int acpi_get_ref_args(struct fwnode_reference_args *args, - * @index: Index of the reference to return - * @num_args: Maximum number of arguments after each reference - * @args: Location to store the returned reference with optional arguments -+ * (may be NULL) - * - * Find property with @name, verifify that it is a package containing at least - * one object reference and if so, store the ACPI device object pointer to the -@@ -908,6 +909,9 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode, - if (!device) - return -EINVAL; - -+ if (!args) -+ return 0; -+ - args->fwnode = acpi_fwnode_handle(device); - args->nargs = 0; - return 0; --- -2.43.2 - -From ca48380cd6af00aa047dc09b358ed8aa782ff994 Mon Sep 17 00:00:00 2001 -From: Sakari Ailus <sakari.ailus@linux.intel.com> -Date: Thu, 9 Nov 2023 12:10:09 +0200 -Subject: [PATCH 0548/1501] software node: Let args be NULL in - software_node_get_reference_args -Content-Length: 1202 -Lines: 34 - -[ Upstream commit 1eaea4b3604eb9ca7d9a1e73d88fc121bb4061f5 ] - -fwnode_get_property_reference_args() may not be called with args argument -NULL and while OF already supports this. Add the missing NULL check. - -The purpose is to be able to count the references. - -Fixes: b06184acf751 ("software node: Add software_node_get_reference_args()") -Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> -Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> -Link: https://lore.kernel.org/r/20231109101010.1329587-3-sakari.ailus@linux.intel.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/base/swnode.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c -index 1886995a0b3a..079bd14bdedc 100644 ---- a/drivers/base/swnode.c -+++ b/drivers/base/swnode.c -@@ -541,6 +541,9 @@ software_node_get_reference_args(const struct fwnode_handle *fwnode, - if (nargs > NR_FWNODE_REFERENCE_ARGS) - return -EINVAL; - -+ if (!args) -+ return 0; -+ - args->fwnode = software_node_get(refnode); - args->nargs = nargs; - --- -2.43.2 - -From 9a662d06c22ddfa371958c2071dc350436be802b Mon Sep 17 00:00:00 2001 -From: Paul Geurts <paul_geurts@live.nl> -Date: Fri, 24 Nov 2023 14:11:10 +0100 -Subject: [PATCH 0549/1501] serial: imx: fix tx statemachine deadlock -Content-Length: 2132 -Lines: 50 - -[ Upstream commit 78d60dae9a0c9f09aa3d6477c94047df2fe6f7b0 ] - -When using the serial port as RS485 port, the tx statemachine is used to -control the RTS pin to drive the RS485 transceiver TX_EN pin. When the -TTY port is closed in the middle of a transmission (for instance during -userland application crash), imx_uart_shutdown disables the interface -and disables the Transmission Complete interrupt. afer that, -imx_uart_stop_tx bails on an incomplete transmission, to be retriggered -by the TC interrupt. This interrupt is disabled and therefore the tx -statemachine never transitions out of SEND. The statemachine is in -deadlock now, and the TX_EN remains low, making the interface useless. - -imx_uart_stop_tx now checks for incomplete transmission AND whether TC -interrupts are enabled before bailing to be retriggered. This makes sure -the state machine handling is reached, and is properly set to -WAIT_AFTER_SEND. - -Fixes: cb1a60923609 ("serial: imx: implement rts delaying for rs485") -Signed-off-by: Paul Geurts <paul_geurts@live.nl> -Tested-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk> -Tested-by: Eberhard Stoll <eberhard.stoll@gmx.de> -Link: https://lore.kernel.org/r/AM0PR09MB26758F651BC1B742EB45775995B8A@AM0PR09MB2675.eurprd09.prod.outlook.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/tty/serial/imx.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c -index 4cecc097408e..16207b9a8c81 100644 ---- a/drivers/tty/serial/imx.c -+++ b/drivers/tty/serial/imx.c -@@ -415,13 +415,13 @@ static void imx_uart_stop_tx(struct uart_port *port) - ucr1 = imx_uart_readl(sport, UCR1); - imx_uart_writel(sport, ucr1 & ~UCR1_TRDYEN, UCR1); - -+ ucr4 = imx_uart_readl(sport, UCR4); - usr2 = imx_uart_readl(sport, USR2); -- if (!(usr2 & USR2_TXDC)) { -+ if ((!(usr2 & USR2_TXDC)) && (ucr4 & UCR4_TCEN)) { - /* The shifter is still busy, so retry once TC triggers */ - return; - } - -- ucr4 = imx_uart_readl(sport, UCR4); - ucr4 &= ~UCR4_TCEN; - imx_uart_writel(sport, ucr4, UCR4); - --- -2.43.2 - -From 80c8795db5d4b3280cf89493e45e31dd103c6504 Mon Sep 17 00:00:00 2001 -From: Nuno Sa <nuno.sa@analog.com> -Date: Thu, 7 Dec 2023 13:39:24 +0100 -Subject: [PATCH 0554/1501] iio: adc: ad9467: fix reset gpio handling -Content-Length: 2716 -Lines: 83 - -[ Upstream commit 76f028539cf360f750efd8cde560edda298e4c6b ] - -The reset gpio was being handled with inverted polarity. This means that -as far as gpiolib is concerned we were actually leaving the pin asserted -(in theory, this would mean reset). However, inverting the polarity in -devicetree made things work. Fix it by doing it the proper way and how -gpiolib expects it to be done. - -While at it, moved the handling to it's own function and dropped -'reset_gpio' from the 'struct ad9467_state' as we only need it during -probe. On top of that, refactored things so that we now request the gpio -asserted (i.e in reset) and then de-assert it. Also note that we now use -gpiod_set_value_cansleep() instead of gpiod_direction_output() as we -already request the pin as output. - -Fixes: ad6797120238 ("iio: adc: ad9467: add support AD9467 ADC") -Reviewed-by: David Lechner <dlechner@baylibre.com> -Signed-off-by: Nuno Sa <nuno.sa@analog.com> -Link: https://lore.kernel.org/r/20231207-iio-backend-prep-v2-1-a4a33bc4d70e@analog.com -Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/iio/adc/ad9467.c | 31 ++++++++++++++++++------------- - 1 file changed, 18 insertions(+), 13 deletions(-) - -diff --git a/drivers/iio/adc/ad9467.c b/drivers/iio/adc/ad9467.c -index 39eccc28debe..4fb9e48dc782 100644 ---- a/drivers/iio/adc/ad9467.c -+++ b/drivers/iio/adc/ad9467.c -@@ -121,7 +121,6 @@ struct ad9467_state { - unsigned int output_mode; - - struct gpio_desc *pwrdown_gpio; -- struct gpio_desc *reset_gpio; - }; - - static int ad9467_spi_read(struct spi_device *spi, unsigned int reg) -@@ -378,6 +377,21 @@ static int ad9467_preenable_setup(struct adi_axi_adc_conv *conv) - return ad9467_outputmode_set(st->spi, st->output_mode); - } - -+static int ad9467_reset(struct device *dev) -+{ -+ struct gpio_desc *gpio; -+ -+ gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH); -+ if (IS_ERR_OR_NULL(gpio)) -+ return PTR_ERR_OR_ZERO(gpio); -+ -+ fsleep(1); -+ gpiod_set_value_cansleep(gpio, 0); -+ fsleep(10 * USEC_PER_MSEC); -+ -+ return 0; -+} -+ - static int ad9467_probe(struct spi_device *spi) - { - const struct ad9467_chip_info *info; -@@ -408,18 +422,9 @@ static int ad9467_probe(struct spi_device *spi) - if (IS_ERR(st->pwrdown_gpio)) - return PTR_ERR(st->pwrdown_gpio); - -- st->reset_gpio = devm_gpiod_get_optional(&spi->dev, "reset", -- GPIOD_OUT_LOW); -- if (IS_ERR(st->reset_gpio)) -- return PTR_ERR(st->reset_gpio); -- -- if (st->reset_gpio) { -- udelay(1); -- ret = gpiod_direction_output(st->reset_gpio, 1); -- if (ret) -- return ret; -- mdelay(10); -- } -+ ret = ad9467_reset(&spi->dev); -+ if (ret) -+ return ret; - - conv->chip_info = &info->axi_adc_info; - --- -2.43.2 - -From 5ee72bc4203e4e6d60aad43673e5f22602ee5889 Mon Sep 17 00:00:00 2001 -From: Nuno Sa <nuno.sa@analog.com> -Date: Thu, 7 Dec 2023 13:39:25 +0100 -Subject: [PATCH 0555/1501] iio: adc: ad9467: don't ignore error codes -Content-Length: 2605 -Lines: 77 - -[ Upstream commit e072e149cfb827e0ab4cafb0547e9658e35393cd ] - -Make sure functions that return errors are not ignored. - -Fixes: ad6797120238 ("iio: adc: ad9467: add support AD9467 ADC") -Reviewed-by: David Lechner <dlechner@baylibre.com> -Signed-off-by: Nuno Sa <nuno.sa@analog.com> -Link: https://lore.kernel.org/r/20231207-iio-backend-prep-v2-2-a4a33bc4d70e@analog.com -Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/iio/adc/ad9467.c | 27 +++++++++++++++++---------- - 1 file changed, 17 insertions(+), 10 deletions(-) - -diff --git a/drivers/iio/adc/ad9467.c b/drivers/iio/adc/ad9467.c -index 4fb9e48dc782..d3c98c4eccd3 100644 ---- a/drivers/iio/adc/ad9467.c -+++ b/drivers/iio/adc/ad9467.c -@@ -162,9 +162,10 @@ static int ad9467_reg_access(struct adi_axi_adc_conv *conv, unsigned int reg, - - if (readval == NULL) { - ret = ad9467_spi_write(spi, reg, writeval); -- ad9467_spi_write(spi, AN877_ADC_REG_TRANSFER, -- AN877_ADC_TRANSFER_SYNC); -- return ret; -+ if (ret) -+ return ret; -+ return ad9467_spi_write(spi, AN877_ADC_REG_TRANSFER, -+ AN877_ADC_TRANSFER_SYNC); - } - - ret = ad9467_spi_read(spi, reg); -@@ -272,10 +273,13 @@ static int ad9467_get_scale(struct adi_axi_adc_conv *conv, int *val, int *val2) - const struct ad9467_chip_info *info1 = to_ad9467_chip_info(info); - struct ad9467_state *st = adi_axi_adc_conv_priv(conv); - unsigned int i, vref_val; -+ int ret; - -- vref_val = ad9467_spi_read(st->spi, AN877_ADC_REG_VREF); -+ ret = ad9467_spi_read(st->spi, AN877_ADC_REG_VREF); -+ if (ret < 0) -+ return ret; - -- vref_val &= info1->vref_mask; -+ vref_val = ret & info1->vref_mask; - - for (i = 0; i < info->num_scales; i++) { - if (vref_val == info->scale_table[i][1]) -@@ -296,6 +300,7 @@ static int ad9467_set_scale(struct adi_axi_adc_conv *conv, int val, int val2) - struct ad9467_state *st = adi_axi_adc_conv_priv(conv); - unsigned int scale_val[2]; - unsigned int i; -+ int ret; - - if (val != 0) - return -EINVAL; -@@ -305,11 +310,13 @@ static int ad9467_set_scale(struct adi_axi_adc_conv *conv, int val, int val2) - if (scale_val[0] != val || scale_val[1] != val2) - continue; - -- ad9467_spi_write(st->spi, AN877_ADC_REG_VREF, -- info->scale_table[i][1]); -- ad9467_spi_write(st->spi, AN877_ADC_REG_TRANSFER, -- AN877_ADC_TRANSFER_SYNC); -- return 0; -+ ret = ad9467_spi_write(st->spi, AN877_ADC_REG_VREF, -+ info->scale_table[i][1]); -+ if (ret < 0) -+ return ret; -+ -+ return ad9467_spi_write(st->spi, AN877_ADC_REG_TRANSFER, -+ AN877_ADC_TRANSFER_SYNC); - } - - return -EINVAL; --- -2.43.2 - -From 37996444a0060f22b3d25ada67d95160d73c94af Mon Sep 17 00:00:00 2001 -From: Nuno Sa <nuno.sa@analog.com> -Date: Thu, 7 Dec 2023 13:39:26 +0100 -Subject: [PATCH 0556/1501] iio: adc: ad9467: add mutex to struct ad9467_state -Content-Length: 1951 -Lines: 58 - -[ Upstream commit 737720197be445bb9eec2986101e4a386e019337 ] - -When calling ad9467_set_scale(), multiple calls to ad9467_spi_write() -are done which means we need to properly protect the whole operation so -we are sure we will be in a sane state if two concurrent calls occur. - -Fixes: ad6797120238 ("iio: adc: ad9467: add support AD9467 ADC") -Signed-off-by: Nuno Sa <nuno.sa@analog.com> -Reviewed-by: David Lechner <dlechner@baylibre.com> -Link: https://lore.kernel.org/r/20231207-iio-backend-prep-v2-3-a4a33bc4d70e@analog.com -Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/iio/adc/ad9467.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/drivers/iio/adc/ad9467.c b/drivers/iio/adc/ad9467.c -index d3c98c4eccd3..104c6d394a3e 100644 ---- a/drivers/iio/adc/ad9467.c -+++ b/drivers/iio/adc/ad9467.c -@@ -4,8 +4,9 @@ - * - * Copyright 2012-2020 Analog Devices Inc. - */ -- -+#include <linux/cleanup.h> - #include <linux/module.h> -+#include <linux/mutex.h> - #include <linux/device.h> - #include <linux/kernel.h> - #include <linux/slab.h> -@@ -121,6 +122,8 @@ struct ad9467_state { - unsigned int output_mode; - - struct gpio_desc *pwrdown_gpio; -+ /* ensure consistent state obtained on multiple related accesses */ -+ struct mutex lock; - }; - - static int ad9467_spi_read(struct spi_device *spi, unsigned int reg) -@@ -161,6 +164,7 @@ static int ad9467_reg_access(struct adi_axi_adc_conv *conv, unsigned int reg, - int ret; - - if (readval == NULL) { -+ guard(mutex)(&st->lock); - ret = ad9467_spi_write(spi, reg, writeval); - if (ret) - return ret; -@@ -310,6 +314,7 @@ static int ad9467_set_scale(struct adi_axi_adc_conv *conv, int val, int val2) - if (scale_val[0] != val || scale_val[1] != val2) - continue; - -+ guard(mutex)(&st->lock); - ret = ad9467_spi_write(st->spi, AN877_ADC_REG_VREF, - info->scale_table[i][1]); - if (ret < 0) --- -2.43.2 - -From 713062c24414d54b0e342b00241d15a331731043 Mon Sep 17 00:00:00 2001 -From: Nuno Sa <nuno.sa@analog.com> -Date: Thu, 7 Dec 2023 13:39:27 +0100 -Subject: [PATCH 0557/1501] iio: adc: ad9467: fix scale setting -Content-Length: 8275 -Lines: 247 - -[ Upstream commit b73f08bb7fe5a0901646ca5ceaa1e7a2d5ee6293 ] - -When reading in_voltage_scale we can get something like: - -root@analog:/sys/bus/iio/devices/iio:device2# cat in_voltage_scale -0.038146 - -However, when reading the available options: - -root@analog:/sys/bus/iio/devices/iio:device2# cat -in_voltage_scale_available -2000.000000 2100.000006 2200.000007 2300.000008 2400.000009 2500.000010 - -which does not make sense. Moreover, when trying to set a new scale we -get an error because there's no call to __ad9467_get_scale() to give us -values as given when reading in_voltage_scale. Fix it by computing the -available scales during probe and properly pass the list when -.read_available() is called. - -While at it, change to use .read_available() from iio_info. Also note -that to properly fix this, adi-axi-adc.c has to be changed accordingly. - -Fixes: ad6797120238 ("iio: adc: ad9467: add support AD9467 ADC") -Signed-off-by: Nuno Sa <nuno.sa@analog.com> -Reviewed-by: David Lechner <dlechner@baylibre.com> -Link: https://lore.kernel.org/r/20231207-iio-backend-prep-v2-4-a4a33bc4d70e@analog.com -Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/iio/adc/ad9467.c | 47 ++++++++++++++++++ - drivers/iio/adc/adi-axi-adc.c | 74 ++++++----------------------- - include/linux/iio/adc/adi-axi-adc.h | 4 ++ - 3 files changed, 66 insertions(+), 59 deletions(-) - -diff --git a/drivers/iio/adc/ad9467.c b/drivers/iio/adc/ad9467.c -index 104c6d394a3e..f668313730cb 100644 ---- a/drivers/iio/adc/ad9467.c -+++ b/drivers/iio/adc/ad9467.c -@@ -120,6 +120,7 @@ struct ad9467_state { - struct spi_device *spi; - struct clk *clk; - unsigned int output_mode; -+ unsigned int (*scales)[2]; - - struct gpio_desc *pwrdown_gpio; - /* ensure consistent state obtained on multiple related accesses */ -@@ -216,6 +217,7 @@ static void __ad9467_get_scale(struct adi_axi_adc_conv *conv, int index, - .channel = _chan, \ - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE) | \ - BIT(IIO_CHAN_INFO_SAMP_FREQ), \ -+ .info_mask_shared_by_type_available = BIT(IIO_CHAN_INFO_SCALE), \ - .scan_index = _si, \ - .scan_type = { \ - .sign = _sign, \ -@@ -370,6 +372,26 @@ static int ad9467_write_raw(struct adi_axi_adc_conv *conv, - } - } - -+static int ad9467_read_avail(struct adi_axi_adc_conv *conv, -+ struct iio_chan_spec const *chan, -+ const int **vals, int *type, int *length, -+ long mask) -+{ -+ const struct adi_axi_adc_chip_info *info = conv->chip_info; -+ struct ad9467_state *st = adi_axi_adc_conv_priv(conv); -+ -+ switch (mask) { -+ case IIO_CHAN_INFO_SCALE: -+ *vals = (const int *)st->scales; -+ *type = IIO_VAL_INT_PLUS_MICRO; -+ /* Values are stored in a 2D matrix */ -+ *length = info->num_scales * 2; -+ return IIO_AVAIL_LIST; -+ default: -+ return -EINVAL; -+ } -+} -+ - static int ad9467_outputmode_set(struct spi_device *spi, unsigned int mode) - { - int ret; -@@ -382,6 +404,26 @@ static int ad9467_outputmode_set(struct spi_device *spi, unsigned int mode) - AN877_ADC_TRANSFER_SYNC); - } - -+static int ad9467_scale_fill(struct adi_axi_adc_conv *conv) -+{ -+ const struct adi_axi_adc_chip_info *info = conv->chip_info; -+ struct ad9467_state *st = adi_axi_adc_conv_priv(conv); -+ unsigned int i, val1, val2; -+ -+ st->scales = devm_kmalloc_array(&st->spi->dev, info->num_scales, -+ sizeof(*st->scales), GFP_KERNEL); -+ if (!st->scales) -+ return -ENOMEM; -+ -+ for (i = 0; i < info->num_scales; i++) { -+ __ad9467_get_scale(conv, i, &val1, &val2); -+ st->scales[i][0] = val1; -+ st->scales[i][1] = val2; -+ } -+ -+ return 0; -+} -+ - static int ad9467_preenable_setup(struct adi_axi_adc_conv *conv) - { - struct ad9467_state *st = adi_axi_adc_conv_priv(conv); -@@ -440,6 +482,10 @@ static int ad9467_probe(struct spi_device *spi) - - conv->chip_info = &info->axi_adc_info; - -+ ret = ad9467_scale_fill(conv); -+ if (ret) -+ return ret; -+ - id = ad9467_spi_read(spi, AN877_ADC_REG_CHIP_ID); - if (id != conv->chip_info->id) { - dev_err(&spi->dev, "Mismatch CHIP_ID, got 0x%X, expected 0x%X\n", -@@ -450,6 +496,7 @@ static int ad9467_probe(struct spi_device *spi) - conv->reg_access = ad9467_reg_access; - conv->write_raw = ad9467_write_raw; - conv->read_raw = ad9467_read_raw; -+ conv->read_avail = ad9467_read_avail; - conv->preenable_setup = ad9467_preenable_setup; - - st->output_mode = info->default_output_mode | -diff --git a/drivers/iio/adc/adi-axi-adc.c b/drivers/iio/adc/adi-axi-adc.c -index aff0532a974a..ae83ada7f9f2 100644 ---- a/drivers/iio/adc/adi-axi-adc.c -+++ b/drivers/iio/adc/adi-axi-adc.c -@@ -144,6 +144,20 @@ static int adi_axi_adc_write_raw(struct iio_dev *indio_dev, - return conv->write_raw(conv, chan, val, val2, mask); - } - -+static int adi_axi_adc_read_avail(struct iio_dev *indio_dev, -+ struct iio_chan_spec const *chan, -+ const int **vals, int *type, int *length, -+ long mask) -+{ -+ struct adi_axi_adc_state *st = iio_priv(indio_dev); -+ struct adi_axi_adc_conv *conv = &st->client->conv; -+ -+ if (!conv->read_avail) -+ return -EOPNOTSUPP; -+ -+ return conv->read_avail(conv, chan, vals, type, length, mask); -+} -+ - static int adi_axi_adc_update_scan_mode(struct iio_dev *indio_dev, - const unsigned long *scan_mask) - { -@@ -228,69 +242,11 @@ struct adi_axi_adc_conv *devm_adi_axi_adc_conv_register(struct device *dev, - } - EXPORT_SYMBOL_NS_GPL(devm_adi_axi_adc_conv_register, IIO_ADI_AXI); - --static ssize_t in_voltage_scale_available_show(struct device *dev, -- struct device_attribute *attr, -- char *buf) --{ -- struct iio_dev *indio_dev = dev_to_iio_dev(dev); -- struct adi_axi_adc_state *st = iio_priv(indio_dev); -- struct adi_axi_adc_conv *conv = &st->client->conv; -- size_t len = 0; -- int i; -- -- for (i = 0; i < conv->chip_info->num_scales; i++) { -- const unsigned int *s = conv->chip_info->scale_table[i]; -- -- len += scnprintf(buf + len, PAGE_SIZE - len, -- "%u.%06u ", s[0], s[1]); -- } -- buf[len - 1] = '\n'; -- -- return len; --} -- --static IIO_DEVICE_ATTR_RO(in_voltage_scale_available, 0); -- --enum { -- ADI_AXI_ATTR_SCALE_AVAIL, --}; -- --#define ADI_AXI_ATTR(_en_, _file_) \ -- [ADI_AXI_ATTR_##_en_] = &iio_dev_attr_##_file_.dev_attr.attr -- --static struct attribute *adi_axi_adc_attributes[] = { -- ADI_AXI_ATTR(SCALE_AVAIL, in_voltage_scale_available), -- NULL --}; -- --static umode_t axi_adc_attr_is_visible(struct kobject *kobj, -- struct attribute *attr, int n) --{ -- struct device *dev = kobj_to_dev(kobj); -- struct iio_dev *indio_dev = dev_to_iio_dev(dev); -- struct adi_axi_adc_state *st = iio_priv(indio_dev); -- struct adi_axi_adc_conv *conv = &st->client->conv; -- -- switch (n) { -- case ADI_AXI_ATTR_SCALE_AVAIL: -- if (!conv->chip_info->num_scales) -- return 0; -- return attr->mode; -- default: -- return attr->mode; -- } --} -- --static const struct attribute_group adi_axi_adc_attribute_group = { -- .attrs = adi_axi_adc_attributes, -- .is_visible = axi_adc_attr_is_visible, --}; -- - static const struct iio_info adi_axi_adc_info = { - .read_raw = &adi_axi_adc_read_raw, - .write_raw = &adi_axi_adc_write_raw, -- .attrs = &adi_axi_adc_attribute_group, - .update_scan_mode = &adi_axi_adc_update_scan_mode, -+ .read_avail = &adi_axi_adc_read_avail, - }; - - static const struct adi_axi_adc_core_info adi_axi_adc_10_0_a_info = { -diff --git a/include/linux/iio/adc/adi-axi-adc.h b/include/linux/iio/adc/adi-axi-adc.h -index 52620e5b8052..b7904992d561 100644 ---- a/include/linux/iio/adc/adi-axi-adc.h -+++ b/include/linux/iio/adc/adi-axi-adc.h -@@ -41,6 +41,7 @@ struct adi_axi_adc_chip_info { - * @reg_access IIO debugfs_reg_access hook for the client ADC - * @read_raw IIO read_raw hook for the client ADC - * @write_raw IIO write_raw hook for the client ADC -+ * @read_avail IIO read_avail hook for the client ADC - */ - struct adi_axi_adc_conv { - const struct adi_axi_adc_chip_info *chip_info; -@@ -54,6 +55,9 @@ struct adi_axi_adc_conv { - int (*write_raw)(struct adi_axi_adc_conv *conv, - struct iio_chan_spec const *chan, - int val, int val2, long mask); -+ int (*read_avail)(struct adi_axi_adc_conv *conv, -+ struct iio_chan_spec const *chan, -+ const int **val, int *type, int *length, long mask); - }; - - struct adi_axi_adc_conv *devm_adi_axi_adc_conv_register(struct device *dev, --- -2.43.2 - -From a643a74bb06af615a4b6658daaf21173cd820871 Mon Sep 17 00:00:00 2001 -From: Yicong Yang <yangyicong@hisilicon.com> -Date: Thu, 7 Dec 2023 16:16:34 +0800 -Subject: [PATCH 0558/1501] perf header: Fix one memory leakage in - perf_event__fprintf_event_update() -Content-Length: 1742 -Lines: 48 - -[ Upstream commit 813900d19b923fc1b241c1ce292472f68066092b ] - -When dump the raw trace by `perf report -D` ASan reports a memory -leakage in perf_event__fprintf_event_update(). - -It shows that we allocated a temporary cpumap for dumping the CPUs but -doesn't release it and it's not used elsewhere. Fix this by free the -cpumap after the dumping. - -Fixes: c853f9394b7bc189 ("perf tools: Add perf_event__fprintf_event_update function") -Reviewed-by: Ian Rogers <irogers@google.com> -Signed-off-by: Yicong Yang <yangyicong@hisilicon.com> -Acked-by: Namhyung Kim <namhyung@kernel.org> -Cc: Adrian Hunter <adrian.hunter@intel.com> -Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> -Cc: Ingo Molnar <mingo@redhat.com> -Cc: Jiri Olsa <jolsa@kernel.org> -Cc: Jonathan Cameron <jonathan.cameron@huawei.com> -Cc: Junhao He <hejunhao3@huawei.com> -Cc: Mark Rutland <mark.rutland@arm.com> -Cc: Peter Zijlstra <peterz@infradead.org> -Cc: linuxarm@huawei.com -Link: https://lore.kernel.org/r/20231207081635.8427-2-yangyicong@huawei.com -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/perf/util/header.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c -index 7609b4d468dc..b39b3e4cec8a 100644 ---- a/tools/perf/util/header.c -+++ b/tools/perf/util/header.c -@@ -4371,9 +4371,10 @@ size_t perf_event__fprintf_event_update(union perf_event *event, FILE *fp) - ret += fprintf(fp, "... "); - - map = cpu_map__new_data(&ev->cpus.cpus); -- if (map) -+ if (map) { - ret += cpu_map__fprintf(map, fp); -- else -+ perf_cpu_map__put(map); -+ } else - ret += fprintf(fp, "failed to get cpus\n"); - break; - default: --- -2.43.2 - -From b277e142532b400b6d89493b66c54ca74c59bc41 Mon Sep 17 00:00:00 2001 -From: Yicong Yang <yangyicong@hisilicon.com> -Date: Thu, 7 Dec 2023 16:16:35 +0800 -Subject: [PATCH 0559/1501] perf hisi-ptt: Fix one memory leakage in - hisi_ptt_process_auxtrace_event() -Content-Length: 1575 -Lines: 41 - -[ Upstream commit 1bc479d665bc25a9a4e8168d5b400a47491511f9 ] - -ASan complains a memory leakage in hisi_ptt_process_auxtrace_event() -that the data buffer is not freed. Since currently we only support the -raw dump trace mode, the data buffer is used only within this function. -So fix this by freeing the data buffer before going out. - -Fixes: 5e91e57e68090c0e ("perf auxtrace arm64: Add support for parsing HiSilicon PCIe Trace packet") -Reviewed-by: Ian Rogers <irogers@google.com> -Signed-off-by: Yicong Yang <yangyicong@hisilicon.com> -Acked-by: Namhyung Kim <Namhyung@kernel.org> -Cc: Adrian Hunter <adrian.hunter@intel.com> -Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> -Cc: Ingo Molnar <mingo@redhat.com> -Cc: Jiri Olsa <jolsa@kernel.org> -Cc: Jonathan Cameron <jonathan.cameron@huawei.com> -Cc: Junhao He <hejunhao3@huawei.com> -Cc: Mark Rutland <mark.rutland@arm.com> -Cc: Peter Zijlstra <peterz@infradead.org> -Cc: Qi Liu <liuqi115@huawei.com> -Link: https://lore.kernel.org/r/20231207081635.8427-3-yangyicong@huawei.com -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/perf/util/hisi-ptt.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/tools/perf/util/hisi-ptt.c b/tools/perf/util/hisi-ptt.c -index 43bd1ca62d58..52d0ce302ca0 100644 ---- a/tools/perf/util/hisi-ptt.c -+++ b/tools/perf/util/hisi-ptt.c -@@ -123,6 +123,7 @@ static int hisi_ptt_process_auxtrace_event(struct perf_session *session, - if (dump_trace) - hisi_ptt_dump_event(ptt, data, size); - -+ free(data); - return 0; - } - --- -2.43.2 - -From 6a4bd42b0657c87762c81db4a4c61b109b299e41 Mon Sep 17 00:00:00 2001 -From: Namhyung Kim <namhyung@kernel.org> -Date: Mon, 11 Dec 2023 23:05:44 -0800 -Subject: [PATCH 0560/1501] perf genelf: Set ELF program header addresses - properly -Content-Length: 1523 -Lines: 42 - -[ Upstream commit 1af478903fc48c1409a8dd6b698383b62387adf1 ] - -The text section starts after the ELF headers so PHDR.p_vaddr and -others should have the correct addresses. - -Fixes: babd04386b1df8c3 ("perf jit: Include program header in ELF files") -Reviewed-by: Ian Rogers <irogers@google.com> -Signed-off-by: Namhyung Kim <namhyung@kernel.org> -Cc: Adrian Hunter <adrian.hunter@intel.com> -Cc: Fangrui Song <maskray@google.com> -Cc: Ingo Molnar <mingo@kernel.org> -Cc: Jiri Olsa <jolsa@kernel.org> -Cc: Lieven Hey <lieven.hey@kdab.com> -Cc: Milian Wolff <milian.wolff@kdab.com> -Cc: Pablo Galindo <pablogsal@gmail.com> -Cc: Peter Zijlstra <peterz@infradead.org> -Link: https://lore.kernel.org/r/20231212070547.612536-2-namhyung@kernel.org -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/perf/util/genelf.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/tools/perf/util/genelf.c b/tools/perf/util/genelf.c -index fefc72066c4e..ac17a3cb59dc 100644 ---- a/tools/perf/util/genelf.c -+++ b/tools/perf/util/genelf.c -@@ -293,9 +293,9 @@ jit_write_elf(int fd, uint64_t load_addr, const char *sym, - */ - phdr = elf_newphdr(e, 1); - phdr[0].p_type = PT_LOAD; -- phdr[0].p_offset = 0; -- phdr[0].p_vaddr = 0; -- phdr[0].p_paddr = 0; -+ phdr[0].p_offset = GEN_ELF_TEXT_OFFSET; -+ phdr[0].p_vaddr = GEN_ELF_TEXT_OFFSET; -+ phdr[0].p_paddr = GEN_ELF_TEXT_OFFSET; - phdr[0].p_filesz = csize; - phdr[0].p_memsz = csize; - phdr[0].p_flags = PF_X | PF_R; --- -2.43.2 - -From b23546c8bcc757d0ca85b163957afd52dad6e150 Mon Sep 17 00:00:00 2001 -From: Namhyung Kim <namhyung@kernel.org> -Date: Mon, 11 Dec 2023 23:05:45 -0800 -Subject: [PATCH 0561/1501] perf unwind-libdw: Handle JIT-generated DSOs - properly -Content-Length: 3081 -Lines: 86 - -[ Upstream commit c966d23a351a33f8a977fd7efbb6f467132f7383 ] - -Usually DSOs are mapped from the beginning of the file, so the base -address of the DSO can be calculated by map->start - map->pgoff. - -However, JIT DSOs which are generated by `perf inject -j`, are mapped -only the code segment. This makes unwind-libdw code confusing and -rejects processing unwinds in the JIT DSOs. It should use the map -start address as base for them to fix the confusion. - -Fixes: 1fe627da30331024 ("perf unwind: Take pgoff into account when reporting elf to libdwfl") -Signed-off-by: Namhyung Kim <namhyung@kernel.org> -Cc: Adrian Hunter <adrian.hunter@intel.com> -Cc: Fangrui Song <maskray@google.com> -Cc: Ian Rogers <irogers@google.com> -Cc: Ingo Molnar <mingo@kernel.org> -Cc: Jiri Olsa <jolsa@kernel.org> -Cc: Milian Wolff <milian.wolff@kdab.com> -Cc: Pablo Galindo <pablogsal@gmail.com> -Cc: Peter Zijlstra <peterz@infradead.org> -Link: https://lore.kernel.org/r/20231212070547.612536-3-namhyung@kernel.org -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/perf/util/unwind-libdw.c | 21 +++++++++++++++++---- - 1 file changed, 17 insertions(+), 4 deletions(-) - -diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c -index 8554db3fc0d7..6013335a8dae 100644 ---- a/tools/perf/util/unwind-libdw.c -+++ b/tools/perf/util/unwind-libdw.c -@@ -46,6 +46,7 @@ static int __report_module(struct addr_location *al, u64 ip, - { - Dwfl_Module *mod; - struct dso *dso = NULL; -+ Dwarf_Addr base; - /* - * Some callers will use al->sym, so we can't just use the - * cheaper thread__find_map() here. -@@ -58,13 +59,25 @@ static int __report_module(struct addr_location *al, u64 ip, - if (!dso) - return 0; - -+ /* -+ * The generated JIT DSO files only map the code segment without -+ * ELF headers. Since JIT codes used to be packed in a memory -+ * segment, calculating the base address using pgoff falls into -+ * a different code in another DSO. So just use the map->start -+ * directly to pick the correct one. -+ */ -+ if (!strncmp(dso->long_name, "/tmp/jitted-", 12)) -+ base = map__start(al->map); -+ else -+ base = map__start(al->map) - map__pgoff(al->map); -+ - mod = dwfl_addrmodule(ui->dwfl, ip); - if (mod) { - Dwarf_Addr s; - - dwfl_module_info(mod, NULL, &s, NULL, NULL, NULL, NULL, NULL); -- if (s != map__start(al->map) - map__pgoff(al->map)) -- mod = 0; -+ if (s != base) -+ mod = NULL; - } - - if (!mod) { -@@ -72,14 +85,14 @@ static int __report_module(struct addr_location *al, u64 ip, - - __symbol__join_symfs(filename, sizeof(filename), dso->long_name); - mod = dwfl_report_elf(ui->dwfl, dso->short_name, filename, -1, -- map__start(al->map) - map__pgoff(al->map), false); -+ base, false); - } - if (!mod) { - char filename[PATH_MAX]; - - if (dso__build_id_filename(dso, filename, sizeof(filename), false)) - mod = dwfl_report_elf(ui->dwfl, dso->short_name, filename, -1, -- map__start(al->map) - map__pgoff(al->map), false); -+ base, false); - } - - if (mod) { --- -2.43.2 - -From 8232f7a310ed835034d760e92d0d4583c6d1b716 Mon Sep 17 00:00:00 2001 -From: Namhyung Kim <namhyung@kernel.org> -Date: Mon, 11 Dec 2023 23:05:46 -0800 -Subject: [PATCH 0562/1501] perf unwind-libunwind: Fix base address for - .eh_frame -Content-Length: 1710 -Lines: 41 - -[ Upstream commit 4fb54994b2360ab5029ee3a959161f6fe6bbb349 ] - -The base address of a DSO mapping should start at the start of the file. -Usually DSOs are mapped from the pgoff 0 so it doesn't matter when it -uses the start of the map address. - -But generated DSOs for JIT codes doesn't start from the 0 so it should -subtract the offset to calculate the .eh_frame table offsets correctly. - -Fixes: dc2cf4ca866f5715 ("perf unwind: Fix segbase for ld.lld linked objects") -Reviewed-by: Ian Rogers <irogers@google.com> -Signed-off-by: Namhyung Kim <namhyung@kernel.org> -Cc: Adrian Hunter <adrian.hunter@intel.com> -Cc: Fangrui Song <maskray@google.com> -Cc: Ingo Molnar <mingo@kernel.org> -Cc: Jiri Olsa <jolsa@kernel.org> -Cc: Milian Wolff <milian.wolff@kdab.com> -Cc: Pablo Galindo <pablogsal@gmail.com> -Cc: Peter Zijlstra <peterz@infradead.org> -Link: https://lore.kernel.org/r/20231212070547.612536-4-namhyung@kernel.org -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/perf/util/unwind-libunwind-local.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/tools/perf/util/unwind-libunwind-local.c b/tools/perf/util/unwind-libunwind-local.c -index c0641882fd2f..5e5c3395a499 100644 ---- a/tools/perf/util/unwind-libunwind-local.c -+++ b/tools/perf/util/unwind-libunwind-local.c -@@ -327,7 +327,7 @@ static int read_unwind_spec_eh_frame(struct dso *dso, struct unwind_info *ui, - - maps__for_each_entry(thread__maps(ui->thread), map_node) { - struct map *map = map_node->map; -- u64 start = map__start(map); -+ u64 start = map__start(map) - map__pgoff(map); - - if (map__dso(map) == dso && start < base_addr) - base_addr = start; --- -2.43.2 - -From 83042081cdf21f36487211e86a7dd47874f0f6e2 Mon Sep 17 00:00:00 2001 -From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> -Date: Fri, 1 Sep 2023 13:05:02 +0530 -Subject: [PATCH 0563/1501] bus: mhi: ep: Do not allocate event ring element on - stack -Content-Length: 4305 -Lines: 118 - -[ Upstream commit 987fdb5a43a66764808371b54e6047834170d565 ] - -It is possible that the host controller driver would use DMA framework to -write the event ring element. So avoid allocating event ring element on the -stack as DMA cannot work on vmalloc memory. - -Cc: stable@vger.kernel.org -Fixes: 961aeb689224 ("bus: mhi: ep: Add support for sending events to the host") -Link: https://lore.kernel.org/r/20230901073502.69385-1-manivannan.sadhasivam@linaro.org -Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> -Stable-dep-of: 327ec5f70609 ("PCI: epf-mhi: Fix the DMA data direction of dma_unmap_single()") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/bus/mhi/ep/main.c | 68 ++++++++++++++++++++++++++++----------- - 1 file changed, 50 insertions(+), 18 deletions(-) - -diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c -index 600881808982..e2513f5f47a6 100644 ---- a/drivers/bus/mhi/ep/main.c -+++ b/drivers/bus/mhi/ep/main.c -@@ -71,45 +71,77 @@ static int mhi_ep_send_event(struct mhi_ep_cntrl *mhi_cntrl, u32 ring_idx, - static int mhi_ep_send_completion_event(struct mhi_ep_cntrl *mhi_cntrl, struct mhi_ep_ring *ring, - struct mhi_ring_element *tre, u32 len, enum mhi_ev_ccs code) - { -- struct mhi_ring_element event = {}; -+ struct mhi_ring_element *event; -+ int ret; - -- event.ptr = cpu_to_le64(ring->rbase + ring->rd_offset * sizeof(*tre)); -- event.dword[0] = MHI_TRE_EV_DWORD0(code, len); -- event.dword[1] = MHI_TRE_EV_DWORD1(ring->ch_id, MHI_PKT_TYPE_TX_EVENT); -+ event = kzalloc(sizeof(struct mhi_ring_element), GFP_KERNEL); -+ if (!event) -+ return -ENOMEM; - -- return mhi_ep_send_event(mhi_cntrl, ring->er_index, &event, MHI_TRE_DATA_GET_BEI(tre)); -+ event->ptr = cpu_to_le64(ring->rbase + ring->rd_offset * sizeof(*tre)); -+ event->dword[0] = MHI_TRE_EV_DWORD0(code, len); -+ event->dword[1] = MHI_TRE_EV_DWORD1(ring->ch_id, MHI_PKT_TYPE_TX_EVENT); -+ -+ ret = mhi_ep_send_event(mhi_cntrl, ring->er_index, event, MHI_TRE_DATA_GET_BEI(tre)); -+ kfree(event); -+ -+ return ret; - } - - int mhi_ep_send_state_change_event(struct mhi_ep_cntrl *mhi_cntrl, enum mhi_state state) - { -- struct mhi_ring_element event = {}; -+ struct mhi_ring_element *event; -+ int ret; - -- event.dword[0] = MHI_SC_EV_DWORD0(state); -- event.dword[1] = MHI_SC_EV_DWORD1(MHI_PKT_TYPE_STATE_CHANGE_EVENT); -+ event = kzalloc(sizeof(struct mhi_ring_element), GFP_KERNEL); -+ if (!event) -+ return -ENOMEM; - -- return mhi_ep_send_event(mhi_cntrl, 0, &event, 0); -+ event->dword[0] = MHI_SC_EV_DWORD0(state); -+ event->dword[1] = MHI_SC_EV_DWORD1(MHI_PKT_TYPE_STATE_CHANGE_EVENT); -+ -+ ret = mhi_ep_send_event(mhi_cntrl, 0, event, 0); -+ kfree(event); -+ -+ return ret; - } - - int mhi_ep_send_ee_event(struct mhi_ep_cntrl *mhi_cntrl, enum mhi_ee_type exec_env) - { -- struct mhi_ring_element event = {}; -+ struct mhi_ring_element *event; -+ int ret; - -- event.dword[0] = MHI_EE_EV_DWORD0(exec_env); -- event.dword[1] = MHI_SC_EV_DWORD1(MHI_PKT_TYPE_EE_EVENT); -+ event = kzalloc(sizeof(struct mhi_ring_element), GFP_KERNEL); -+ if (!event) -+ return -ENOMEM; - -- return mhi_ep_send_event(mhi_cntrl, 0, &event, 0); -+ event->dword[0] = MHI_EE_EV_DWORD0(exec_env); -+ event->dword[1] = MHI_SC_EV_DWORD1(MHI_PKT_TYPE_EE_EVENT); -+ -+ ret = mhi_ep_send_event(mhi_cntrl, 0, event, 0); -+ kfree(event); -+ -+ return ret; - } - - static int mhi_ep_send_cmd_comp_event(struct mhi_ep_cntrl *mhi_cntrl, enum mhi_ev_ccs code) - { - struct mhi_ep_ring *ring = &mhi_cntrl->mhi_cmd->ring; -- struct mhi_ring_element event = {}; -+ struct mhi_ring_element *event; -+ int ret; - -- event.ptr = cpu_to_le64(ring->rbase + ring->rd_offset * sizeof(struct mhi_ring_element)); -- event.dword[0] = MHI_CC_EV_DWORD0(code); -- event.dword[1] = MHI_CC_EV_DWORD1(MHI_PKT_TYPE_CMD_COMPLETION_EVENT); -+ event = kzalloc(sizeof(struct mhi_ring_element), GFP_KERNEL); -+ if (!event) -+ return -ENOMEM; - -- return mhi_ep_send_event(mhi_cntrl, 0, &event, 0); -+ event->ptr = cpu_to_le64(ring->rbase + ring->rd_offset * sizeof(struct mhi_ring_element)); -+ event->dword[0] = MHI_CC_EV_DWORD0(code); -+ event->dword[1] = MHI_CC_EV_DWORD1(MHI_PKT_TYPE_CMD_COMPLETION_EVENT); -+ -+ ret = mhi_ep_send_event(mhi_cntrl, 0, event, 0); -+ kfree(event); -+ -+ return ret; - } - - static int mhi_ep_process_cmd_ring(struct mhi_ep_ring *ring, struct mhi_ring_element *el) --- -2.43.2 - -From 66aea64413c99628121c2d86cd587264a2588828 Mon Sep 17 00:00:00 2001 -From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> -Date: Wed, 18 Oct 2023 17:58:12 +0530 -Subject: [PATCH 0564/1501] bus: mhi: ep: Use slab allocator where applicable -Content-Length: 8455 -Lines: 238 - -[ Upstream commit 62210a26cd4f8ad52683a71c0226dfe85de1144d ] - -Use slab allocator for allocating the memory for objects used frequently -and are of fixed size. This reduces the overheard associated with -kmalloc(). - -Suggested-by: Alex Elder <elder@linaro.org> -Link: https://lore.kernel.org/r/20231018122812.47261-1-manivannan.sadhasivam@linaro.org -Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> -Stable-dep-of: 327ec5f70609 ("PCI: epf-mhi: Fix the DMA data direction of dma_unmap_single()") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/bus/mhi/ep/main.c | 66 +++++++++++++++++++++++++++++---------- - include/linux/mhi_ep.h | 3 ++ - 2 files changed, 52 insertions(+), 17 deletions(-) - -diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c -index e2513f5f47a6..517279600645 100644 ---- a/drivers/bus/mhi/ep/main.c -+++ b/drivers/bus/mhi/ep/main.c -@@ -74,7 +74,7 @@ static int mhi_ep_send_completion_event(struct mhi_ep_cntrl *mhi_cntrl, struct m - struct mhi_ring_element *event; - int ret; - -- event = kzalloc(sizeof(struct mhi_ring_element), GFP_KERNEL); -+ event = kmem_cache_zalloc(mhi_cntrl->ev_ring_el_cache, GFP_KERNEL | GFP_DMA); - if (!event) - return -ENOMEM; - -@@ -83,7 +83,7 @@ static int mhi_ep_send_completion_event(struct mhi_ep_cntrl *mhi_cntrl, struct m - event->dword[1] = MHI_TRE_EV_DWORD1(ring->ch_id, MHI_PKT_TYPE_TX_EVENT); - - ret = mhi_ep_send_event(mhi_cntrl, ring->er_index, event, MHI_TRE_DATA_GET_BEI(tre)); -- kfree(event); -+ kmem_cache_free(mhi_cntrl->ev_ring_el_cache, event); - - return ret; - } -@@ -93,7 +93,7 @@ int mhi_ep_send_state_change_event(struct mhi_ep_cntrl *mhi_cntrl, enum mhi_stat - struct mhi_ring_element *event; - int ret; - -- event = kzalloc(sizeof(struct mhi_ring_element), GFP_KERNEL); -+ event = kmem_cache_zalloc(mhi_cntrl->ev_ring_el_cache, GFP_KERNEL | GFP_DMA); - if (!event) - return -ENOMEM; - -@@ -101,7 +101,7 @@ int mhi_ep_send_state_change_event(struct mhi_ep_cntrl *mhi_cntrl, enum mhi_stat - event->dword[1] = MHI_SC_EV_DWORD1(MHI_PKT_TYPE_STATE_CHANGE_EVENT); - - ret = mhi_ep_send_event(mhi_cntrl, 0, event, 0); -- kfree(event); -+ kmem_cache_free(mhi_cntrl->ev_ring_el_cache, event); - - return ret; - } -@@ -111,7 +111,7 @@ int mhi_ep_send_ee_event(struct mhi_ep_cntrl *mhi_cntrl, enum mhi_ee_type exec_e - struct mhi_ring_element *event; - int ret; - -- event = kzalloc(sizeof(struct mhi_ring_element), GFP_KERNEL); -+ event = kmem_cache_zalloc(mhi_cntrl->ev_ring_el_cache, GFP_KERNEL | GFP_DMA); - if (!event) - return -ENOMEM; - -@@ -119,7 +119,7 @@ int mhi_ep_send_ee_event(struct mhi_ep_cntrl *mhi_cntrl, enum mhi_ee_type exec_e - event->dword[1] = MHI_SC_EV_DWORD1(MHI_PKT_TYPE_EE_EVENT); - - ret = mhi_ep_send_event(mhi_cntrl, 0, event, 0); -- kfree(event); -+ kmem_cache_free(mhi_cntrl->ev_ring_el_cache, event); - - return ret; - } -@@ -130,7 +130,7 @@ static int mhi_ep_send_cmd_comp_event(struct mhi_ep_cntrl *mhi_cntrl, enum mhi_e - struct mhi_ring_element *event; - int ret; - -- event = kzalloc(sizeof(struct mhi_ring_element), GFP_KERNEL); -+ event = kmem_cache_zalloc(mhi_cntrl->ev_ring_el_cache, GFP_KERNEL | GFP_DMA); - if (!event) - return -ENOMEM; - -@@ -139,7 +139,7 @@ static int mhi_ep_send_cmd_comp_event(struct mhi_ep_cntrl *mhi_cntrl, enum mhi_e - event->dword[1] = MHI_CC_EV_DWORD1(MHI_PKT_TYPE_CMD_COMPLETION_EVENT); - - ret = mhi_ep_send_event(mhi_cntrl, 0, event, 0); -- kfree(event); -+ kmem_cache_free(mhi_cntrl->ev_ring_el_cache, event); - - return ret; - } -@@ -451,7 +451,7 @@ static int mhi_ep_process_ch_ring(struct mhi_ep_ring *ring, struct mhi_ring_elem - mhi_chan->xfer_cb(mhi_chan->mhi_dev, &result); - } else { - /* UL channel */ -- result.buf_addr = kzalloc(len, GFP_KERNEL); -+ result.buf_addr = kmem_cache_zalloc(mhi_cntrl->tre_buf_cache, GFP_KERNEL | GFP_DMA); - if (!result.buf_addr) - return -ENOMEM; - -@@ -459,7 +459,7 @@ static int mhi_ep_process_ch_ring(struct mhi_ep_ring *ring, struct mhi_ring_elem - ret = mhi_ep_read_channel(mhi_cntrl, ring, &result, len); - if (ret < 0) { - dev_err(&mhi_chan->mhi_dev->dev, "Failed to read channel\n"); -- kfree(result.buf_addr); -+ kmem_cache_free(mhi_cntrl->tre_buf_cache, result.buf_addr); - return ret; - } - -@@ -471,7 +471,7 @@ static int mhi_ep_process_ch_ring(struct mhi_ep_ring *ring, struct mhi_ring_elem - /* Read until the ring becomes empty */ - } while (!mhi_ep_queue_is_empty(mhi_chan->mhi_dev, DMA_TO_DEVICE)); - -- kfree(result.buf_addr); -+ kmem_cache_free(mhi_cntrl->tre_buf_cache, result.buf_addr); - } - - return 0; -@@ -780,14 +780,14 @@ static void mhi_ep_ch_ring_worker(struct work_struct *work) - if (ret) { - dev_err(dev, "Error updating write offset for ring\n"); - mutex_unlock(&chan->lock); -- kfree(itr); -+ kmem_cache_free(mhi_cntrl->ring_item_cache, itr); - continue; - } - - /* Sanity check to make sure there are elements in the ring */ - if (ring->rd_offset == ring->wr_offset) { - mutex_unlock(&chan->lock); -- kfree(itr); -+ kmem_cache_free(mhi_cntrl->ring_item_cache, itr); - continue; - } - -@@ -799,12 +799,12 @@ static void mhi_ep_ch_ring_worker(struct work_struct *work) - dev_err(dev, "Error processing ring for channel (%u): %d\n", - ring->ch_id, ret); - mutex_unlock(&chan->lock); -- kfree(itr); -+ kmem_cache_free(mhi_cntrl->ring_item_cache, itr); - continue; - } - - mutex_unlock(&chan->lock); -- kfree(itr); -+ kmem_cache_free(mhi_cntrl->ring_item_cache, itr); - } - } - -@@ -860,7 +860,7 @@ static void mhi_ep_queue_channel_db(struct mhi_ep_cntrl *mhi_cntrl, unsigned lon - u32 ch_id = ch_idx + i; - - ring = &mhi_cntrl->mhi_chan[ch_id].ring; -- item = kzalloc(sizeof(*item), GFP_ATOMIC); -+ item = kmem_cache_zalloc(mhi_cntrl->ring_item_cache, GFP_ATOMIC); - if (!item) - return; - -@@ -1407,6 +1407,29 @@ int mhi_ep_register_controller(struct mhi_ep_cntrl *mhi_cntrl, - goto err_free_ch; - } - -+ mhi_cntrl->ev_ring_el_cache = kmem_cache_create("mhi_ep_event_ring_el", -+ sizeof(struct mhi_ring_element), 0, -+ SLAB_CACHE_DMA, NULL); -+ if (!mhi_cntrl->ev_ring_el_cache) { -+ ret = -ENOMEM; -+ goto err_free_cmd; -+ } -+ -+ mhi_cntrl->tre_buf_cache = kmem_cache_create("mhi_ep_tre_buf", MHI_EP_DEFAULT_MTU, 0, -+ SLAB_CACHE_DMA, NULL); -+ if (!mhi_cntrl->tre_buf_cache) { -+ ret = -ENOMEM; -+ goto err_destroy_ev_ring_el_cache; -+ } -+ -+ mhi_cntrl->ring_item_cache = kmem_cache_create("mhi_ep_ring_item", -+ sizeof(struct mhi_ep_ring_item), 0, -+ 0, NULL); -+ if (!mhi_cntrl->ev_ring_el_cache) { -+ ret = -ENOMEM; -+ goto err_destroy_tre_buf_cache; -+ } -+ - INIT_WORK(&mhi_cntrl->state_work, mhi_ep_state_worker); - INIT_WORK(&mhi_cntrl->reset_work, mhi_ep_reset_worker); - INIT_WORK(&mhi_cntrl->cmd_ring_work, mhi_ep_cmd_ring_worker); -@@ -1415,7 +1438,7 @@ int mhi_ep_register_controller(struct mhi_ep_cntrl *mhi_cntrl, - mhi_cntrl->wq = alloc_workqueue("mhi_ep_wq", 0, 0); - if (!mhi_cntrl->wq) { - ret = -ENOMEM; -- goto err_free_cmd; -+ goto err_destroy_ring_item_cache; - } - - INIT_LIST_HEAD(&mhi_cntrl->st_transition_list); -@@ -1474,6 +1497,12 @@ int mhi_ep_register_controller(struct mhi_ep_cntrl *mhi_cntrl, - ida_free(&mhi_ep_cntrl_ida, mhi_cntrl->index); - err_destroy_wq: - destroy_workqueue(mhi_cntrl->wq); -+err_destroy_ring_item_cache: -+ kmem_cache_destroy(mhi_cntrl->ring_item_cache); -+err_destroy_ev_ring_el_cache: -+ kmem_cache_destroy(mhi_cntrl->ev_ring_el_cache); -+err_destroy_tre_buf_cache: -+ kmem_cache_destroy(mhi_cntrl->tre_buf_cache); - err_free_cmd: - kfree(mhi_cntrl->mhi_cmd); - err_free_ch: -@@ -1495,6 +1524,9 @@ void mhi_ep_unregister_controller(struct mhi_ep_cntrl *mhi_cntrl) - - free_irq(mhi_cntrl->irq, mhi_cntrl); - -+ kmem_cache_destroy(mhi_cntrl->tre_buf_cache); -+ kmem_cache_destroy(mhi_cntrl->ev_ring_el_cache); -+ kmem_cache_destroy(mhi_cntrl->ring_item_cache); - kfree(mhi_cntrl->mhi_cmd); - kfree(mhi_cntrl->mhi_chan); - -diff --git a/include/linux/mhi_ep.h b/include/linux/mhi_ep.h -index f198a8ac7ee7..ce85d42b685d 100644 ---- a/include/linux/mhi_ep.h -+++ b/include/linux/mhi_ep.h -@@ -128,6 +128,9 @@ struct mhi_ep_cntrl { - struct work_struct reset_work; - struct work_struct cmd_ring_work; - struct work_struct ch_ring_work; -+ struct kmem_cache *ring_item_cache; -+ struct kmem_cache *ev_ring_el_cache; -+ struct kmem_cache *tre_buf_cache; - - void (*raise_irq)(struct mhi_ep_cntrl *mhi_cntrl, u32 vector); - int (*alloc_map)(struct mhi_ep_cntrl *mhi_cntrl, u64 pci_addr, phys_addr_t *phys_ptr, --- -2.43.2 - -From 0ed2a7429a420a078dc4deb0ca5608b4bd0ca33a Mon Sep 17 00:00:00 2001 -From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> -Date: Thu, 17 Aug 2023 23:24:52 +0530 -Subject: [PATCH 0565/1501] bus: mhi: ep: Pass mhi_ep_buf_info struct to - read/write APIs -Content-Length: 14473 -Lines: 398 - -[ Upstream commit b08ded2ef2e98768d5ee5f71da8fe768b1f7774b ] - -In the preparation of DMA async support, let's pass the parameters to -read_from_host() and write_to_host() APIs using mhi_ep_buf_info structure. - -No functional change. - -Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> -Stable-dep-of: 327ec5f70609 ("PCI: epf-mhi: Fix the DMA data direction of dma_unmap_single()") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/bus/mhi/ep/main.c | 23 +++---- - drivers/bus/mhi/ep/ring.c | 41 ++++++------ - drivers/pci/endpoint/functions/pci-epf-mhi.c | 66 +++++++++++--------- - include/linux/mhi_ep.h | 16 ++++- - 4 files changed, 84 insertions(+), 62 deletions(-) - -diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c -index 517279600645..582d5c166a75 100644 ---- a/drivers/bus/mhi/ep/main.c -+++ b/drivers/bus/mhi/ep/main.c -@@ -324,10 +324,9 @@ static int mhi_ep_read_channel(struct mhi_ep_cntrl *mhi_cntrl, - struct mhi_ep_chan *mhi_chan = &mhi_cntrl->mhi_chan[ring->ch_id]; - struct device *dev = &mhi_cntrl->mhi_dev->dev; - size_t tr_len, read_offset, write_offset; -+ struct mhi_ep_buf_info buf_info = {}; - struct mhi_ring_element *el; - bool tr_done = false; -- void *write_addr; -- u64 read_addr; - u32 buf_left; - int ret; - -@@ -356,11 +355,13 @@ static int mhi_ep_read_channel(struct mhi_ep_cntrl *mhi_cntrl, - - read_offset = mhi_chan->tre_size - mhi_chan->tre_bytes_left; - write_offset = len - buf_left; -- read_addr = mhi_chan->tre_loc + read_offset; -- write_addr = result->buf_addr + write_offset; -+ -+ buf_info.host_addr = mhi_chan->tre_loc + read_offset; -+ buf_info.dev_addr = result->buf_addr + write_offset; -+ buf_info.size = tr_len; - - dev_dbg(dev, "Reading %zd bytes from channel (%u)\n", tr_len, ring->ch_id); -- ret = mhi_cntrl->read_from_host(mhi_cntrl, read_addr, write_addr, tr_len); -+ ret = mhi_cntrl->read_from_host(mhi_cntrl, &buf_info); - if (ret < 0) { - dev_err(&mhi_chan->mhi_dev->dev, "Error reading from channel\n"); - return ret; -@@ -483,12 +484,11 @@ int mhi_ep_queue_skb(struct mhi_ep_device *mhi_dev, struct sk_buff *skb) - struct mhi_ep_cntrl *mhi_cntrl = mhi_dev->mhi_cntrl; - struct mhi_ep_chan *mhi_chan = mhi_dev->dl_chan; - struct device *dev = &mhi_chan->mhi_dev->dev; -+ struct mhi_ep_buf_info buf_info = {}; - struct mhi_ring_element *el; - u32 buf_left, read_offset; - struct mhi_ep_ring *ring; - enum mhi_ev_ccs code; -- void *read_addr; -- u64 write_addr; - size_t tr_len; - u32 tre_len; - int ret; -@@ -517,11 +517,13 @@ int mhi_ep_queue_skb(struct mhi_ep_device *mhi_dev, struct sk_buff *skb) - - tr_len = min(buf_left, tre_len); - read_offset = skb->len - buf_left; -- read_addr = skb->data + read_offset; -- write_addr = MHI_TRE_DATA_GET_PTR(el); -+ -+ buf_info.dev_addr = skb->data + read_offset; -+ buf_info.host_addr = MHI_TRE_DATA_GET_PTR(el); -+ buf_info.size = tr_len; - - dev_dbg(dev, "Writing %zd bytes to channel (%u)\n", tr_len, ring->ch_id); -- ret = mhi_cntrl->write_to_host(mhi_cntrl, read_addr, write_addr, tr_len); -+ ret = mhi_cntrl->write_to_host(mhi_cntrl, &buf_info); - if (ret < 0) { - dev_err(dev, "Error writing to the channel\n"); - goto err_exit; -@@ -1429,7 +1431,6 @@ int mhi_ep_register_controller(struct mhi_ep_cntrl *mhi_cntrl, - ret = -ENOMEM; - goto err_destroy_tre_buf_cache; - } -- - INIT_WORK(&mhi_cntrl->state_work, mhi_ep_state_worker); - INIT_WORK(&mhi_cntrl->reset_work, mhi_ep_reset_worker); - INIT_WORK(&mhi_cntrl->cmd_ring_work, mhi_ep_cmd_ring_worker); -diff --git a/drivers/bus/mhi/ep/ring.c b/drivers/bus/mhi/ep/ring.c -index 115518ec76a4..c673d7200b3e 100644 ---- a/drivers/bus/mhi/ep/ring.c -+++ b/drivers/bus/mhi/ep/ring.c -@@ -30,7 +30,8 @@ static int __mhi_ep_cache_ring(struct mhi_ep_ring *ring, size_t end) - { - struct mhi_ep_cntrl *mhi_cntrl = ring->mhi_cntrl; - struct device *dev = &mhi_cntrl->mhi_dev->dev; -- size_t start, copy_size; -+ struct mhi_ep_buf_info buf_info = {}; -+ size_t start; - int ret; - - /* Don't proceed in the case of event ring. This happens during mhi_ep_ring_start(). */ -@@ -43,30 +44,34 @@ static int __mhi_ep_cache_ring(struct mhi_ep_ring *ring, size_t end) - - start = ring->wr_offset; - if (start < end) { -- copy_size = (end - start) * sizeof(struct mhi_ring_element); -- ret = mhi_cntrl->read_from_host(mhi_cntrl, ring->rbase + -- (start * sizeof(struct mhi_ring_element)), -- &ring->ring_cache[start], copy_size); -+ buf_info.size = (end - start) * sizeof(struct mhi_ring_element); -+ buf_info.host_addr = ring->rbase + (start * sizeof(struct mhi_ring_element)); -+ buf_info.dev_addr = &ring->ring_cache[start]; -+ -+ ret = mhi_cntrl->read_from_host(mhi_cntrl, &buf_info); - if (ret < 0) - return ret; - } else { -- copy_size = (ring->ring_size - start) * sizeof(struct mhi_ring_element); -- ret = mhi_cntrl->read_from_host(mhi_cntrl, ring->rbase + -- (start * sizeof(struct mhi_ring_element)), -- &ring->ring_cache[start], copy_size); -+ buf_info.size = (ring->ring_size - start) * sizeof(struct mhi_ring_element); -+ buf_info.host_addr = ring->rbase + (start * sizeof(struct mhi_ring_element)); -+ buf_info.dev_addr = &ring->ring_cache[start]; -+ -+ ret = mhi_cntrl->read_from_host(mhi_cntrl, &buf_info); - if (ret < 0) - return ret; - - if (end) { -- ret = mhi_cntrl->read_from_host(mhi_cntrl, ring->rbase, -- &ring->ring_cache[0], -- end * sizeof(struct mhi_ring_element)); -+ buf_info.host_addr = ring->rbase; -+ buf_info.dev_addr = &ring->ring_cache[0]; -+ buf_info.size = end * sizeof(struct mhi_ring_element); -+ -+ ret = mhi_cntrl->read_from_host(mhi_cntrl, &buf_info); - if (ret < 0) - return ret; - } - } - -- dev_dbg(dev, "Cached ring: start %zu end %zu size %zu\n", start, end, copy_size); -+ dev_dbg(dev, "Cached ring: start %zu end %zu size %zu\n", start, end, buf_info.size); - - return 0; - } -@@ -102,6 +107,7 @@ int mhi_ep_ring_add_element(struct mhi_ep_ring *ring, struct mhi_ring_element *e - { - struct mhi_ep_cntrl *mhi_cntrl = ring->mhi_cntrl; - struct device *dev = &mhi_cntrl->mhi_dev->dev; -+ struct mhi_ep_buf_info buf_info = {}; - size_t old_offset = 0; - u32 num_free_elem; - __le64 rp; -@@ -133,12 +139,11 @@ int mhi_ep_ring_add_element(struct mhi_ep_ring *ring, struct mhi_ring_element *e - rp = cpu_to_le64(ring->rd_offset * sizeof(*el) + ring->rbase); - memcpy_toio((void __iomem *) &ring->ring_ctx->generic.rp, &rp, sizeof(u64)); - -- ret = mhi_cntrl->write_to_host(mhi_cntrl, el, ring->rbase + (old_offset * sizeof(*el)), -- sizeof(*el)); -- if (ret < 0) -- return ret; -+ buf_info.host_addr = ring->rbase + (old_offset * sizeof(*el)); -+ buf_info.dev_addr = el; -+ buf_info.size = sizeof(*el); - -- return 0; -+ return mhi_cntrl->write_to_host(mhi_cntrl, &buf_info); - } - - void mhi_ep_ring_init(struct mhi_ep_ring *ring, enum mhi_ep_ring_type type, u32 id) -diff --git a/drivers/pci/endpoint/functions/pci-epf-mhi.c b/drivers/pci/endpoint/functions/pci-epf-mhi.c -index b7b9d3e21f97..ec5f4a38178b 100644 ---- a/drivers/pci/endpoint/functions/pci-epf-mhi.c -+++ b/drivers/pci/endpoint/functions/pci-epf-mhi.c -@@ -209,28 +209,28 @@ static void pci_epf_mhi_raise_irq(struct mhi_ep_cntrl *mhi_cntrl, u32 vector) - vector + 1); - } - --static int pci_epf_mhi_iatu_read(struct mhi_ep_cntrl *mhi_cntrl, u64 from, -- void *to, size_t size) -+static int pci_epf_mhi_iatu_read(struct mhi_ep_cntrl *mhi_cntrl, -+ struct mhi_ep_buf_info *buf_info) - { - struct pci_epf_mhi *epf_mhi = to_epf_mhi(mhi_cntrl); -- size_t offset = get_align_offset(epf_mhi, from); -+ size_t offset = get_align_offset(epf_mhi, buf_info->host_addr); - void __iomem *tre_buf; - phys_addr_t tre_phys; - int ret; - - mutex_lock(&epf_mhi->lock); - -- ret = __pci_epf_mhi_alloc_map(mhi_cntrl, from, &tre_phys, &tre_buf, -- offset, size); -+ ret = __pci_epf_mhi_alloc_map(mhi_cntrl, buf_info->host_addr, &tre_phys, -+ &tre_buf, offset, buf_info->size); - if (ret) { - mutex_unlock(&epf_mhi->lock); - return ret; - } - -- memcpy_fromio(to, tre_buf, size); -+ memcpy_fromio(buf_info->dev_addr, tre_buf, buf_info->size); - -- __pci_epf_mhi_unmap_free(mhi_cntrl, from, tre_phys, tre_buf, offset, -- size); -+ __pci_epf_mhi_unmap_free(mhi_cntrl, buf_info->host_addr, tre_phys, -+ tre_buf, offset, buf_info->size); - - mutex_unlock(&epf_mhi->lock); - -@@ -238,27 +238,27 @@ static int pci_epf_mhi_iatu_read(struct mhi_ep_cntrl *mhi_cntrl, u64 from, - } - - static int pci_epf_mhi_iatu_write(struct mhi_ep_cntrl *mhi_cntrl, -- void *from, u64 to, size_t size) -+ struct mhi_ep_buf_info *buf_info) - { - struct pci_epf_mhi *epf_mhi = to_epf_mhi(mhi_cntrl); -- size_t offset = get_align_offset(epf_mhi, to); -+ size_t offset = get_align_offset(epf_mhi, buf_info->host_addr); - void __iomem *tre_buf; - phys_addr_t tre_phys; - int ret; - - mutex_lock(&epf_mhi->lock); - -- ret = __pci_epf_mhi_alloc_map(mhi_cntrl, to, &tre_phys, &tre_buf, -- offset, size); -+ ret = __pci_epf_mhi_alloc_map(mhi_cntrl, buf_info->host_addr, &tre_phys, -+ &tre_buf, offset, buf_info->size); - if (ret) { - mutex_unlock(&epf_mhi->lock); - return ret; - } - -- memcpy_toio(tre_buf, from, size); -+ memcpy_toio(tre_buf, buf_info->dev_addr, buf_info->size); - -- __pci_epf_mhi_unmap_free(mhi_cntrl, to, tre_phys, tre_buf, offset, -- size); -+ __pci_epf_mhi_unmap_free(mhi_cntrl, buf_info->host_addr, tre_phys, -+ tre_buf, offset, buf_info->size); - - mutex_unlock(&epf_mhi->lock); - -@@ -270,8 +270,8 @@ static void pci_epf_mhi_dma_callback(void *param) - complete(param); - } - --static int pci_epf_mhi_edma_read(struct mhi_ep_cntrl *mhi_cntrl, u64 from, -- void *to, size_t size) -+static int pci_epf_mhi_edma_read(struct mhi_ep_cntrl *mhi_cntrl, -+ struct mhi_ep_buf_info *buf_info) - { - struct pci_epf_mhi *epf_mhi = to_epf_mhi(mhi_cntrl); - struct device *dma_dev = epf_mhi->epf->epc->dev.parent; -@@ -284,13 +284,13 @@ static int pci_epf_mhi_edma_read(struct mhi_ep_cntrl *mhi_cntrl, u64 from, - dma_addr_t dst_addr; - int ret; - -- if (size < SZ_4K) -- return pci_epf_mhi_iatu_read(mhi_cntrl, from, to, size); -+ if (buf_info->size < SZ_4K) -+ return pci_epf_mhi_iatu_read(mhi_cntrl, buf_info); - - mutex_lock(&epf_mhi->lock); - - config.direction = DMA_DEV_TO_MEM; -- config.src_addr = from; -+ config.src_addr = buf_info->host_addr; - - ret = dmaengine_slave_config(chan, &config); - if (ret) { -@@ -298,14 +298,16 @@ static int pci_epf_mhi_edma_read(struct mhi_ep_cntrl *mhi_cntrl, u64 from, - goto err_unlock; - } - -- dst_addr = dma_map_single(dma_dev, to, size, DMA_FROM_DEVICE); -+ dst_addr = dma_map_single(dma_dev, buf_info->dev_addr, buf_info->size, -+ DMA_FROM_DEVICE); - ret = dma_mapping_error(dma_dev, dst_addr); - if (ret) { - dev_err(dev, "Failed to map remote memory\n"); - goto err_unlock; - } - -- desc = dmaengine_prep_slave_single(chan, dst_addr, size, DMA_DEV_TO_MEM, -+ desc = dmaengine_prep_slave_single(chan, dst_addr, buf_info->size, -+ DMA_DEV_TO_MEM, - DMA_CTRL_ACK | DMA_PREP_INTERRUPT); - if (!desc) { - dev_err(dev, "Failed to prepare DMA\n"); -@@ -332,15 +334,15 @@ static int pci_epf_mhi_edma_read(struct mhi_ep_cntrl *mhi_cntrl, u64 from, - } - - err_unmap: -- dma_unmap_single(dma_dev, dst_addr, size, DMA_FROM_DEVICE); -+ dma_unmap_single(dma_dev, dst_addr, buf_info->size, DMA_FROM_DEVICE); - err_unlock: - mutex_unlock(&epf_mhi->lock); - - return ret; - } - --static int pci_epf_mhi_edma_write(struct mhi_ep_cntrl *mhi_cntrl, void *from, -- u64 to, size_t size) -+static int pci_epf_mhi_edma_write(struct mhi_ep_cntrl *mhi_cntrl, -+ struct mhi_ep_buf_info *buf_info) - { - struct pci_epf_mhi *epf_mhi = to_epf_mhi(mhi_cntrl); - struct device *dma_dev = epf_mhi->epf->epc->dev.parent; -@@ -353,13 +355,13 @@ static int pci_epf_mhi_edma_write(struct mhi_ep_cntrl *mhi_cntrl, void *from, - dma_addr_t src_addr; - int ret; - -- if (size < SZ_4K) -- return pci_epf_mhi_iatu_write(mhi_cntrl, from, to, size); -+ if (buf_info->size < SZ_4K) -+ return pci_epf_mhi_iatu_write(mhi_cntrl, buf_info); - - mutex_lock(&epf_mhi->lock); - - config.direction = DMA_MEM_TO_DEV; -- config.dst_addr = to; -+ config.dst_addr = buf_info->host_addr; - - ret = dmaengine_slave_config(chan, &config); - if (ret) { -@@ -367,14 +369,16 @@ static int pci_epf_mhi_edma_write(struct mhi_ep_cntrl *mhi_cntrl, void *from, - goto err_unlock; - } - -- src_addr = dma_map_single(dma_dev, from, size, DMA_TO_DEVICE); -+ src_addr = dma_map_single(dma_dev, buf_info->dev_addr, buf_info->size, -+ DMA_TO_DEVICE); - ret = dma_mapping_error(dma_dev, src_addr); - if (ret) { - dev_err(dev, "Failed to map remote memory\n"); - goto err_unlock; - } - -- desc = dmaengine_prep_slave_single(chan, src_addr, size, DMA_MEM_TO_DEV, -+ desc = dmaengine_prep_slave_single(chan, src_addr, buf_info->size, -+ DMA_MEM_TO_DEV, - DMA_CTRL_ACK | DMA_PREP_INTERRUPT); - if (!desc) { - dev_err(dev, "Failed to prepare DMA\n"); -@@ -401,7 +405,7 @@ static int pci_epf_mhi_edma_write(struct mhi_ep_cntrl *mhi_cntrl, void *from, - } - - err_unmap: -- dma_unmap_single(dma_dev, src_addr, size, DMA_FROM_DEVICE); -+ dma_unmap_single(dma_dev, src_addr, buf_info->size, DMA_FROM_DEVICE); - err_unlock: - mutex_unlock(&epf_mhi->lock); - -diff --git a/include/linux/mhi_ep.h b/include/linux/mhi_ep.h -index ce85d42b685d..96f3a133540d 100644 ---- a/include/linux/mhi_ep.h -+++ b/include/linux/mhi_ep.h -@@ -49,6 +49,18 @@ struct mhi_ep_db_info { - u32 status; - }; - -+/** -+ * struct mhi_ep_buf_info - MHI Endpoint transfer buffer info -+ * @dev_addr: Address of the buffer in endpoint -+ * @host_addr: Address of the bufffer in host -+ * @size: Size of the buffer -+ */ -+struct mhi_ep_buf_info { -+ void *dev_addr; -+ u64 host_addr; -+ size_t size; -+}; -+ - /** - * struct mhi_ep_cntrl - MHI Endpoint controller structure - * @cntrl_dev: Pointer to the struct device of physical bus acting as the MHI -@@ -137,8 +149,8 @@ struct mhi_ep_cntrl { - void __iomem **virt, size_t size); - void (*unmap_free)(struct mhi_ep_cntrl *mhi_cntrl, u64 pci_addr, phys_addr_t phys, - void __iomem *virt, size_t size); -- int (*read_from_host)(struct mhi_ep_cntrl *mhi_cntrl, u64 from, void *to, size_t size); -- int (*write_to_host)(struct mhi_ep_cntrl *mhi_cntrl, void *from, u64 to, size_t size); -+ int (*read_from_host)(struct mhi_ep_cntrl *mhi_cntrl, struct mhi_ep_buf_info *buf_info); -+ int (*write_to_host)(struct mhi_ep_cntrl *mhi_cntrl, struct mhi_ep_buf_info *buf_info); - - enum mhi_state mhi_state; - --- -2.43.2 - -From 6f4ab8c02427da39f88a7140ac41811a5d746a46 Mon Sep 17 00:00:00 2001 -From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> -Date: Thu, 14 Dec 2023 12:03:28 +0530 -Subject: [PATCH 0566/1501] PCI: epf-mhi: Fix the DMA data direction of - dma_unmap_single() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1249 -Lines: 30 - -[ Upstream commit 327ec5f70609cf00c6f961073c01857555c6a8eb ] - -In the error path of pci_epf_mhi_edma_write() function, the DMA data -direction passed (DMA_FROM_DEVICE) doesn't match the actual direction used -for the data transfer. Fix it by passing the correct one (DMA_TO_DEVICE). - -Fixes: 7b99aaaddabb ("PCI: epf-mhi: Add eDMA support") -Reviewed-by: Krzysztof Wilczyński <kw@linux.com> -Link: https://lore.kernel.org/r/20231214063328.40657-1-manivannan.sadhasivam@linaro.org -Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/pci/endpoint/functions/pci-epf-mhi.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/pci/endpoint/functions/pci-epf-mhi.c b/drivers/pci/endpoint/functions/pci-epf-mhi.c -index ec5f4a38178b..6dc918a8a023 100644 ---- a/drivers/pci/endpoint/functions/pci-epf-mhi.c -+++ b/drivers/pci/endpoint/functions/pci-epf-mhi.c -@@ -405,7 +405,7 @@ static int pci_epf_mhi_edma_write(struct mhi_ep_cntrl *mhi_cntrl, - } - - err_unmap: -- dma_unmap_single(dma_dev, src_addr, buf_info->size, DMA_FROM_DEVICE); -+ dma_unmap_single(dma_dev, src_addr, buf_info->size, DMA_TO_DEVICE); - err_unlock: - mutex_unlock(&epf_mhi->lock); - --- -2.43.2 - -From 0142ecc28326c8a9a98c636cc83401037c97e614 Mon Sep 17 00:00:00 2001 -From: Rob Herring <robh@kernel.org> -Date: Thu, 7 Dec 2023 10:31:27 -0600 -Subject: [PATCH 0569/1501] cdx: Explicitly include correct DT includes, again -Content-Length: 1538 -Lines: 41 - -[ Upstream commit aaee477e3e2c7305a95ffc528bf831a13da3dacb ] - -The DT of_device.h and of_platform.h date back to the separate -of_platform_bus_type before it was merged into the regular platform bus. -As part of that merge prepping Arm DT support 13 years ago, they -"temporarily" include each other. They also include platform_device.h -and of.h. As a result, there's a pretty much random mix of those include -files used throughout the tree. In order to detangle these headers and -replace the implicit includes with struct declarations, users need to -explicitly include the correct includes. - -CDX was fixed once, but commit ("cdx: Remove cdx controller list from cdx -bus system") added another occurrence. - -Fixes: 54b406e10f03 ("cdx: Remove cdx controller list from cdx bus system") -Signed-off-by: Rob Herring <robh@kernel.org> -Acked-by: Nikhil Agarwal <Nikhil.agarwal@amd.com> -Link: https://lore.kernel.org/r/20231207163128.2707993-2-robh@kernel.org -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/cdx/cdx.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/cdx/cdx.c b/drivers/cdx/cdx.c -index 4461c6c9313f..d84d153078d7 100644 ---- a/drivers/cdx/cdx.c -+++ b/drivers/cdx/cdx.c -@@ -57,7 +57,10 @@ - - #include <linux/init.h> - #include <linux/kernel.h> -+#include <linux/of.h> - #include <linux/of_device.h> -+#include <linux/of_platform.h> -+#include <linux/platform_device.h> - #include <linux/slab.h> - #include <linux/mm.h> - #include <linux/idr.h> --- -2.43.2 - -From 6d07126f0ff9842c1c3fcde5eec9d28336d5f2a8 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?N=C3=ADcolas=20F=2E=20R=2E=20A=2E=20Prado?= - <nfraprado@collabora.com> -Date: Wed, 6 Dec 2023 15:17:24 -0800 -Subject: [PATCH 0570/1501] spmi: mtk-pmif: Serialize PMIF status check and - command submission -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 5541 -Lines: 136 - -[ Upstream commit f200fff8d019f2754f91f5d715652e3e3fdf3604 ] - -Before writing the read or write command to the SPMI arbiter through the -PMIF interface, the current status of the channel is checked to ensure -it is idle. However, since the status only changes from idle when the -command is written, it is possible for two concurrent calls to determine -that the channel is idle and simultaneously send their commands. At this -point the PMIF interface hangs, with the status register no longer being -updated, and thus causing all subsequent operations to time out. - -This was observed on the mt8195-cherry-tomato-r2 machine, particularly -after commit 46600ab142f8 ("regulator: Set PROBE_PREFER_ASYNCHRONOUS for -drivers between 5.10 and 5.15") was applied, since then the two MT6315 -devices present on the SPMI bus would probe assynchronously and -sometimes (during probe or at a later point) read the bus -simultaneously, breaking the PMIF interface and consequently slowing -down the whole system. - -To fix the issue at its root cause, introduce locking around the channel -status check and the command write, so that both become an atomic -operation, preventing race conditions between two (or more) SPMI bus -read/write operations. A spinlock is used since this is a fast bus, as -indicated by the usage of the atomic variant of readl_poll, and -'.fast_io = true' being used in the mt6315 driver, so spinlocks are -already used for the regmap access. - -Fixes: b45b3ccef8c0 ("spmi: mediatek: Add support for MT6873/8192") -Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com> -Link: https://lore.kernel.org/r/20230724154739.493724-1-nfraprado@collabora.com -Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> -Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com> -Signed-off-by: Stephen Boyd <sboyd@kernel.org> -Link: https://lore.kernel.org/r/20231206231733.4031901-2-sboyd@kernel.org -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/spmi/spmi-mtk-pmif.c | 20 ++++++++++++++++---- - 1 file changed, 16 insertions(+), 4 deletions(-) - -diff --git a/drivers/spmi/spmi-mtk-pmif.c b/drivers/spmi/spmi-mtk-pmif.c -index b3c991e1ea40..54c35f5535cb 100644 ---- a/drivers/spmi/spmi-mtk-pmif.c -+++ b/drivers/spmi/spmi-mtk-pmif.c -@@ -50,6 +50,7 @@ struct pmif { - struct clk_bulk_data clks[PMIF_MAX_CLKS]; - size_t nclks; - const struct pmif_data *data; -+ raw_spinlock_t lock; - }; - - static const char * const pmif_clock_names[] = { -@@ -314,6 +315,7 @@ static int pmif_spmi_read_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid, - struct ch_reg *inf_reg; - int ret; - u32 data, cmd; -+ unsigned long flags; - - /* Check for argument validation. */ - if (sid & ~0xf) { -@@ -334,6 +336,7 @@ static int pmif_spmi_read_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid, - else - return -EINVAL; - -+ raw_spin_lock_irqsave(&arb->lock, flags); - /* Wait for Software Interface FSM state to be IDLE. */ - inf_reg = &arb->chan; - ret = readl_poll_timeout_atomic(arb->base + arb->data->regs[inf_reg->ch_sta], -@@ -343,6 +346,7 @@ static int pmif_spmi_read_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid, - /* set channel ready if the data has transferred */ - if (pmif_is_fsm_vldclr(arb)) - pmif_writel(arb, 1, inf_reg->ch_rdy); -+ raw_spin_unlock_irqrestore(&arb->lock, flags); - dev_err(&ctrl->dev, "failed to wait for SWINF_IDLE\n"); - return ret; - } -@@ -350,6 +354,7 @@ static int pmif_spmi_read_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid, - /* Send the command. */ - cmd = (opc << 30) | (sid << 24) | ((len - 1) << 16) | addr; - pmif_writel(arb, cmd, inf_reg->ch_send); -+ raw_spin_unlock_irqrestore(&arb->lock, flags); - - /* - * Wait for Software Interface FSM state to be WFVLDCLR, -@@ -376,7 +381,8 @@ static int pmif_spmi_write_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid, - struct pmif *arb = spmi_controller_get_drvdata(ctrl); - struct ch_reg *inf_reg; - int ret; -- u32 data, cmd; -+ u32 data, wdata, cmd; -+ unsigned long flags; - - if (len > 4) { - dev_err(&ctrl->dev, "pmif supports 1..4 bytes per trans, but:%zu requested", len); -@@ -394,6 +400,10 @@ static int pmif_spmi_write_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid, - else - return -EINVAL; - -+ /* Set the write data. */ -+ memcpy(&wdata, buf, len); -+ -+ raw_spin_lock_irqsave(&arb->lock, flags); - /* Wait for Software Interface FSM state to be IDLE. */ - inf_reg = &arb->chan; - ret = readl_poll_timeout_atomic(arb->base + arb->data->regs[inf_reg->ch_sta], -@@ -403,17 +413,17 @@ static int pmif_spmi_write_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid, - /* set channel ready if the data has transferred */ - if (pmif_is_fsm_vldclr(arb)) - pmif_writel(arb, 1, inf_reg->ch_rdy); -+ raw_spin_unlock_irqrestore(&arb->lock, flags); - dev_err(&ctrl->dev, "failed to wait for SWINF_IDLE\n"); - return ret; - } - -- /* Set the write data. */ -- memcpy(&data, buf, len); -- pmif_writel(arb, data, inf_reg->wdata); -+ pmif_writel(arb, wdata, inf_reg->wdata); - - /* Send the command. */ - cmd = (opc << 30) | BIT(29) | (sid << 24) | ((len - 1) << 16) | addr; - pmif_writel(arb, cmd, inf_reg->ch_send); -+ raw_spin_unlock_irqrestore(&arb->lock, flags); - - return 0; - } -@@ -488,6 +498,8 @@ static int mtk_spmi_probe(struct platform_device *pdev) - arb->chan.ch_send = PMIF_SWINF_0_ACC + chan_offset; - arb->chan.ch_rdy = PMIF_SWINF_0_VLD_CLR + chan_offset; - -+ raw_spin_lock_init(&arb->lock); -+ - platform_set_drvdata(pdev, ctrl); - - err = spmi_controller_add(ctrl); --- -2.43.2 - -From 66b7b771d16e3ae525d1527b91ee4e43ad61b1ad Mon Sep 17 00:00:00 2001 -From: Ayush Singh <ayushdevel1325@gmail.com> -Date: Sun, 17 Dec 2023 17:41:32 +0530 -Subject: [PATCH 0572/1501] greybus: gb-beagleplay: Remove use of pad bytes -Content-Length: 3909 -Lines: 112 - -[ Upstream commit 08b3485540d9e94ed8335f82e5fc491fc02f8423 ] - -Make gb-beagleplay greybus spec compliant by moving cport information to -transport layer instead of using `header->pad` bytes. - -Greybus HDLC frame now has the following payload: -1. le16 cport -2. gb_operation_msg_hdr msg_header -3. u8 *msg_payload - -Fixes: ec558bbfea67 ("greybus: Add BeaglePlay Linux Driver") -Signed-off-by: Ayush Singh <ayushdevel1325@gmail.com> -Link: https://lore.kernel.org/r/20231217121133.74703-2-ayushdevel1325@gmail.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/greybus/gb-beagleplay.c | 58 ++++++++++++++++++++++++--------- - 1 file changed, 43 insertions(+), 15 deletions(-) - -diff --git a/drivers/greybus/gb-beagleplay.c b/drivers/greybus/gb-beagleplay.c -index 43318c1993ba..7d98ae1a8263 100644 ---- a/drivers/greybus/gb-beagleplay.c -+++ b/drivers/greybus/gb-beagleplay.c -@@ -85,17 +85,31 @@ struct hdlc_payload { - void *buf; - }; - -+/** -+ * struct hdlc_greybus_frame - Structure to represent greybus HDLC frame payload -+ * -+ * @cport: cport id -+ * @hdr: greybus operation header -+ * @payload: greybus message payload -+ * -+ * The HDLC payload sent over UART for greybus address has cport preappended to greybus message -+ */ -+struct hdlc_greybus_frame { -+ __le16 cport; -+ struct gb_operation_msg_hdr hdr; -+ u8 payload[]; -+} __packed; -+ - static void hdlc_rx_greybus_frame(struct gb_beagleplay *bg, u8 *buf, u16 len) - { -- u16 cport_id; -- struct gb_operation_msg_hdr *hdr = (struct gb_operation_msg_hdr *)buf; -- -- memcpy(&cport_id, hdr->pad, sizeof(cport_id)); -+ struct hdlc_greybus_frame *gb_frame = (struct hdlc_greybus_frame *)buf; -+ u16 cport_id = le16_to_cpu(gb_frame->cport); -+ u16 gb_msg_len = le16_to_cpu(gb_frame->hdr.size); - - dev_dbg(&bg->sd->dev, "Greybus Operation %u type %X cport %u status %u received", -- hdr->operation_id, hdr->type, cport_id, hdr->result); -+ gb_frame->hdr.operation_id, gb_frame->hdr.type, cport_id, gb_frame->hdr.result); - -- greybus_data_rcvd(bg->gb_hd, cport_id, buf, len); -+ greybus_data_rcvd(bg->gb_hd, cport_id, (u8 *)&gb_frame->hdr, gb_msg_len); - } - - static void hdlc_rx_dbg_frame(const struct gb_beagleplay *bg, const char *buf, u16 len) -@@ -336,25 +350,39 @@ static struct serdev_device_ops gb_beagleplay_ops = { - .write_wakeup = gb_tty_wakeup, - }; - -+/** -+ * gb_message_send() - Send greybus message using HDLC over UART -+ * -+ * @hd: pointer to greybus host device -+ * @cport: AP cport where message originates -+ * @msg: greybus message to send -+ * @mask: gfp mask -+ * -+ * Greybus HDLC frame has the following payload: -+ * 1. le16 cport -+ * 2. gb_operation_msg_hdr msg_header -+ * 3. u8 *msg_payload -+ */ - static int gb_message_send(struct gb_host_device *hd, u16 cport, struct gb_message *msg, gfp_t mask) - { - struct gb_beagleplay *bg = dev_get_drvdata(&hd->dev); -- struct hdlc_payload payloads[2]; -+ struct hdlc_payload payloads[3]; -+ __le16 cport_id = cpu_to_le16(cport); - - dev_dbg(&hd->dev, "Sending greybus message with Operation %u, Type: %X on Cport %u", - msg->header->operation_id, msg->header->type, cport); - -- if (msg->header->size > RX_HDLC_PAYLOAD) -+ if (le16_to_cpu(msg->header->size) > RX_HDLC_PAYLOAD) - return dev_err_probe(&hd->dev, -E2BIG, "Greybus message too big"); - -- memcpy(msg->header->pad, &cport, sizeof(cport)); -+ payloads[0].buf = &cport_id; -+ payloads[0].len = sizeof(cport_id); -+ payloads[1].buf = msg->header; -+ payloads[1].len = sizeof(*msg->header); -+ payloads[2].buf = msg->payload; -+ payloads[2].len = msg->payload_size; - -- payloads[0].buf = msg->header; -- payloads[0].len = sizeof(*msg->header); -- payloads[1].buf = msg->payload; -- payloads[1].len = msg->payload_size; -- -- hdlc_tx_frames(bg, ADDRESS_GREYBUS, 0x03, payloads, 2); -+ hdlc_tx_frames(bg, ADDRESS_GREYBUS, 0x03, payloads, 3); - greybus_message_sent(bg->gb_hd, msg, 0); - - return 0; --- -2.43.2 - -From 5e23e283910c9f30248732ae0770bcb0c9438abf Mon Sep 17 00:00:00 2001 -From: Ashish Mhetre <amhetre@nvidia.com> -Date: Tue, 5 Dec 2023 12:26:56 +0530 -Subject: [PATCH 0573/1501] iommu: Don't reserve 0-length IOVA region -Content-Length: 1866 -Lines: 42 - -[ Upstream commit bb57f6705960bebeb832142ce9abf43220c3eab1 ] - -When the bootloader/firmware doesn't setup the framebuffers, their -address and size are 0 in "iommu-addresses" property. If IOVA region is -reserved with 0 length, then it ends up corrupting the IOVA rbtree with -an entry which has pfn_hi < pfn_lo. -If we intend to use display driver in kernel without framebuffer then -it's causing the display IOMMU mappings to fail as entire valid IOVA -space is reserved when address and length are passed as 0. -An ideal solution would be firmware removing the "iommu-addresses" -property and corresponding "memory-region" if display is not present. -But the kernel should be able to handle this by checking for size of -IOVA region and skipping the IOVA reservation if size is 0. Also, add -a warning if firmware is requesting 0-length IOVA region reservation. - -Fixes: a5bf3cfce8cb ("iommu: Implement of_iommu_get_resv_regions()") -Signed-off-by: Ashish Mhetre <amhetre@nvidia.com> -Acked-by: Robin Murphy <robin.murphy@arm.com> -Link: https://lore.kernel.org/r/20231205065656.9544-1-amhetre@nvidia.com -Signed-off-by: Joerg Roedel <jroedel@suse.de> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/iommu/of_iommu.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/iommu/of_iommu.c b/drivers/iommu/of_iommu.c -index 47302b637cc0..42cffb0ee5e2 100644 ---- a/drivers/iommu/of_iommu.c -+++ b/drivers/iommu/of_iommu.c -@@ -264,6 +264,10 @@ void of_iommu_get_resv_regions(struct device *dev, struct list_head *list) - prot |= IOMMU_CACHE; - - maps = of_translate_dma_region(np, maps, &iova, &length); -+ if (length == 0) { -+ dev_warn(dev, "Cannot reserve IOVA region of 0 size\n"); -+ continue; -+ } - type = iommu_resv_region_get_type(dev, &phys, iova, length); - - region = iommu_alloc_resv_region(iova, length, prot, type, --- -2.43.2 - -From 7b64e5d1a1dc59a16b1220973bf3da2d3051479c Mon Sep 17 00:00:00 2001 -From: Jing Zhang <renyu.zj@linux.alibaba.com> -Date: Thu, 21 Dec 2023 14:03:13 +0800 -Subject: [PATCH 0574/1501] perf vendor events: Remove UTF-8 characters from - cmn.json -Content-Length: 2153 -Lines: 51 - -[ Upstream commit 457caadce7ab71a54ee2d4f032ee4a55b4a28776 ] - -cmn.json contains UTF-8 characters in brief description which -could break the perf build on some distros. - -Fix this issue by removing the UTF-8 characters from cmn.json. - -without this fix: - - $find tools/perf/pmu-events/ -name "*.json" | xargs file -i | grep -v us-ascii - tools/perf/pmu-events/arch/arm64/arm/cmn/sys/cmn.json: application/json; charset=utf-8 - -with it: - - $ file -i tools/perf/pmu-events/arch/arm64/arm/cmn/sys/cmn.json - tools/perf/pmu-events/arch/arm64/arm/cmn/sys/cmn.json: text/plain; charset=us-ascii - -Fixes: 0b4de7bdf46c5215 ("perf jevents: Add support for Arm CMN PMU aliasing") -Reported-by: Arnaldo Carvalho de Melo <acme@kernel.com> -Signed-off-by: Jing Zhang <renyu.zj@linux.alibaba.com> -Cc: Adrian Hunter <adrian.hunter@intel.com> -Cc: Heiko Carstens <hca@linux.ibm.com> -Cc: Ian Rogers <irogers@google.com> -Cc: Jing Zhang <renyu.zj@linux.alibaba.com> -Cc: Jiri Olsa <jolsa@kernel.org> -Cc: Kajol Jain <kjain@linux.ibm.com> -Cc: Namhyung Kim <namhyung@kernel.org> -Cc: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com> -Cc: Thomas Richter <tmricht@linux.ibm.com> -Link: https://lore.kernel.org/r/1703138593-50486-1-git-send-email-renyu.zj@linux.alibaba.com -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/perf/pmu-events/arch/arm64/arm/cmn/sys/cmn.json | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/tools/perf/pmu-events/arch/arm64/arm/cmn/sys/cmn.json b/tools/perf/pmu-events/arch/arm64/arm/cmn/sys/cmn.json -index 428605c37d10..5ec157c39f0d 100644 ---- a/tools/perf/pmu-events/arch/arm64/arm/cmn/sys/cmn.json -+++ b/tools/perf/pmu-events/arch/arm64/arm/cmn/sys/cmn.json -@@ -107,7 +107,7 @@ - "EventName": "hnf_qos_hh_retry", - "EventidCode": "0xe", - "NodeType": "0x5", -- "BriefDescription": "Counts number of times a HighHigh priority request is protocolretried at the HN‑F.", -+ "BriefDescription": "Counts number of times a HighHigh priority request is protocolretried at the HN-F.", - "Unit": "arm_cmn", - "Compat": "(434|436|43c|43a).*" - }, --- -2.43.2 - -From bd3d2ec447ede9da822addf3960a5f4275e3ae76 Mon Sep 17 00:00:00 2001 -From: Kunwu Chan <chentao@kylinos.cn> -Date: Fri, 24 Nov 2023 15:50:21 +0800 -Subject: [PATCH 0575/1501] power: supply: Fix null pointer dereference in - smb2_probe -Content-Length: 1368 -Lines: 35 - -[ Upstream commit 88f04bc3e737155e13caddf0ba8ed19db87f0212 ] - -devm_kasprintf and devm_kzalloc return a pointer to dynamically -allocated memory which can be NULL upon failure. - -Fixes: 8648aeb5d7b7 ("power: supply: add Qualcomm PMI8998 SMB2 Charger driver") -Signed-off-by: Kunwu Chan <chentao@kylinos.cn> -Link: https://lore.kernel.org/r/20231124075021.1335289-1-chentao@kylinos.cn -Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/power/supply/qcom_pmi8998_charger.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/power/supply/qcom_pmi8998_charger.c b/drivers/power/supply/qcom_pmi8998_charger.c -index 8acf63ee6897..9bb777406013 100644 ---- a/drivers/power/supply/qcom_pmi8998_charger.c -+++ b/drivers/power/supply/qcom_pmi8998_charger.c -@@ -972,10 +972,14 @@ static int smb2_probe(struct platform_device *pdev) - supply_config.of_node = pdev->dev.of_node; - - desc = devm_kzalloc(chip->dev, sizeof(smb2_psy_desc), GFP_KERNEL); -+ if (!desc) -+ return -ENOMEM; - memcpy(desc, &smb2_psy_desc, sizeof(smb2_psy_desc)); - desc->name = - devm_kasprintf(chip->dev, GFP_KERNEL, "%s-charger", - (const char *)device_get_match_data(chip->dev)); -+ if (!desc->name) -+ return -ENOMEM; - - chip->chg_psy = - devm_power_supply_register(chip->dev, desc, &supply_config); --- -2.43.2 - -From ed2b9948574f6dd44fcf63f77be231399168395b Mon Sep 17 00:00:00 2001 -From: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Date: Thu, 20 Oct 2022 21:21:09 +0200 -Subject: [PATCH 0576/1501] vdpa: Fix an error handling path in - eni_vdpa_probe() -Content-Length: 1611 -Lines: 47 - -[ Upstream commit c1b9f2c66eed3261db76cccd8a22a9affae8dcbf ] - -After a successful vp_legacy_probe() call, vp_legacy_remove() should be -called in the error handling path, as already done in the remove function. - -Add the missing call. - -Fixes: e85087beedca ("eni_vdpa: add vDPA driver for Alibaba ENI") -Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Message-Id: <a7b0ef1eabd081f1c7c894e9b11de01678e85dee.1666293559.git.christophe.jaillet@wanadoo.fr> -Signed-off-by: Michael S. Tsirkin <mst@redhat.com> -Acked-by: Jason Wang <jasowang@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/vdpa/alibaba/eni_vdpa.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/drivers/vdpa/alibaba/eni_vdpa.c b/drivers/vdpa/alibaba/eni_vdpa.c -index 5a09a09cca70..cce3d1837104 100644 ---- a/drivers/vdpa/alibaba/eni_vdpa.c -+++ b/drivers/vdpa/alibaba/eni_vdpa.c -@@ -497,7 +497,7 @@ static int eni_vdpa_probe(struct pci_dev *pdev, const struct pci_device_id *id) - if (!eni_vdpa->vring) { - ret = -ENOMEM; - ENI_ERR(pdev, "failed to allocate virtqueues\n"); -- goto err; -+ goto err_remove_vp_legacy; - } - - for (i = 0; i < eni_vdpa->queues; i++) { -@@ -509,11 +509,13 @@ static int eni_vdpa_probe(struct pci_dev *pdev, const struct pci_device_id *id) - ret = vdpa_register_device(&eni_vdpa->vdpa, eni_vdpa->queues); - if (ret) { - ENI_ERR(pdev, "failed to register to vdpa bus\n"); -- goto err; -+ goto err_remove_vp_legacy; - } - - return 0; - -+err_remove_vp_legacy: -+ vp_legacy_remove(&eni_vdpa->ldev); - err: - put_device(&eni_vdpa->vdpa.dev); - return ret; --- -2.43.2 - -From 4c546abf22de9a31c2753e5a9753df12e5792237 Mon Sep 17 00:00:00 2001 -From: John Johansen <john.johansen@canonical.com> -Date: Fri, 29 Dec 2023 06:54:41 -0800 -Subject: [PATCH 0577/1501] apparmor: Fix ref count leak in task_kill -Content-Length: 986 -Lines: 27 - -[ Upstream commit 2cb54a19ac7153b9a26a72098c495187f64c2276 ] - -apparmor_task_kill was not putting the task_cred reference tc, or the -cred_label reference tc when dealing with a passed in cred, fix this -by using a single fn exit. - -Fixes: 90c436a64a6e ("apparmor: pass cred through to audit info.") -Signed-off-by: John Johansen <john.johansen@canonical.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - security/apparmor/lsm.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c -index 4981bdf02993..608a849a7468 100644 ---- a/security/apparmor/lsm.c -+++ b/security/apparmor/lsm.c -@@ -954,7 +954,6 @@ static int apparmor_task_kill(struct task_struct *target, struct kernel_siginfo - cl = aa_get_newest_cred_label(cred); - error = aa_may_signal(cred, cl, tc, tl, sig); - aa_put_label(cl); -- return error; - } else { - cl = __begin_current_label_crit_section(); - error = aa_may_signal(current_cred(), cl, tc, tl, sig); --- -2.43.2 - -From 70154e8d015c9b4fb56c1a2ef1fc8b83d45c7f68 Mon Sep 17 00:00:00 2001 -From: Maurizio Lombardi <mlombard@redhat.com> -Date: Fri, 22 Dec 2023 16:17:48 +0100 -Subject: [PATCH 0578/1501] nvmet-tcp: Fix a kernel panic when host sends an - invalid H2C PDU length -Content-Length: 2687 -Lines: 75 - -[ Upstream commit efa56305908ba20de2104f1b8508c6a7401833be ] - -If the host sends an H2CData command with an invalid DATAL, -the kernel may crash in nvmet_tcp_build_pdu_iovec(). - -Unable to handle kernel NULL pointer dereference at -virtual address 0000000000000000 -lr : nvmet_tcp_io_work+0x6ac/0x718 [nvmet_tcp] -Call trace: - process_one_work+0x174/0x3c8 - worker_thread+0x2d0/0x3e8 - kthread+0x104/0x110 - -Fix the bug by raising a fatal error if DATAL isn't coherent -with the packet size. -Also, the PDU length should never exceed the MAXH2CDATA parameter which -has been communicated to the host in nvmet_tcp_handle_icreq(). - -Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") -Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> -Reviewed-by: Sagi Grimberg <sagi@grimberg.me> -Signed-off-by: Keith Busch <kbusch@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/nvme/target/tcp.c | 13 ++++++++++++- - 1 file changed, 12 insertions(+), 1 deletion(-) - -diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c -index 4cc27856aa8f..ad16795934b8 100644 ---- a/drivers/nvme/target/tcp.c -+++ b/drivers/nvme/target/tcp.c -@@ -24,6 +24,7 @@ - #include "nvmet.h" - - #define NVMET_TCP_DEF_INLINE_DATA_SIZE (4 * PAGE_SIZE) -+#define NVMET_TCP_MAXH2CDATA 0x400000 /* 16M arbitrary limit */ - - static int param_store_val(const char *str, int *val, int min, int max) - { -@@ -923,7 +924,7 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue) - icresp->hdr.pdo = 0; - icresp->hdr.plen = cpu_to_le32(icresp->hdr.hlen); - icresp->pfv = cpu_to_le16(NVME_TCP_PFV_1_0); -- icresp->maxdata = cpu_to_le32(0x400000); /* 16M arbitrary limit */ -+ icresp->maxdata = cpu_to_le32(NVMET_TCP_MAXH2CDATA); - icresp->cpda = 0; - if (queue->hdr_digest) - icresp->digest |= NVME_TCP_HDR_DIGEST_ENABLE; -@@ -978,6 +979,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) - { - struct nvme_tcp_data_pdu *data = &queue->pdu.data; - struct nvmet_tcp_cmd *cmd; -+ unsigned int plen; - - if (likely(queue->nr_cmds)) { - if (unlikely(data->ttag >= queue->nr_cmds)) { -@@ -1001,7 +1003,16 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) - return -EPROTO; - } - -+ plen = le32_to_cpu(data->hdr.plen); - cmd->pdu_len = le32_to_cpu(data->data_length); -+ if (unlikely(cmd->pdu_len != (plen - sizeof(*data)) || -+ cmd->pdu_len == 0 || -+ cmd->pdu_len > NVMET_TCP_MAXH2CDATA)) { -+ pr_err("H2CData PDU len %u is invalid\n", cmd->pdu_len); -+ /* FIXME: use proper transport errors */ -+ nvmet_tcp_fatal_error(queue); -+ return -EPROTO; -+ } - cmd->pdu_recv = 0; - nvmet_tcp_build_pdu_iovec(cmd); - queue->cmd = cmd; --- -2.43.2 - -From c32d355f507fa81cf23aaa4dd4150e696cb8ebaf Mon Sep 17 00:00:00 2001 -From: Maurizio Lombardi <mlombard@redhat.com> -Date: Fri, 22 Dec 2023 16:17:49 +0100 -Subject: [PATCH 0579/1501] nvmet-tcp: fix a crash in nvmet_req_complete() -Content-Length: 1364 -Lines: 37 - -[ Upstream commit 0849a5441358cef02586fb2d60f707c0db195628 ] - -in nvmet_tcp_handle_h2c_data_pdu(), if the host sends a data_offset -different from rbytes_done, the driver ends up calling nvmet_req_complete() -passing a status error. -The problem is that at this point cmd->req is not yet initialized, -the kernel will crash after dereferencing a NULL pointer. - -Fix the bug by replacing the call to nvmet_req_complete() with -nvmet_tcp_fatal_error(). - -Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") -Reviewed-by: Keith Busch <kbsuch@kernel.org> -Reviewed-by: Sagi Grimberg <sagi@grimberg.me> -Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> -Signed-off-by: Keith Busch <kbusch@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/nvme/target/tcp.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c -index ad16795934b8..b4b6a8ac8089 100644 ---- a/drivers/nvme/target/tcp.c -+++ b/drivers/nvme/target/tcp.c -@@ -998,8 +998,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) - data->ttag, le32_to_cpu(data->data_offset), - cmd->rbytes_done); - /* FIXME: use path and transport errors */ -- nvmet_req_complete(&cmd->req, -- NVME_SC_INVALID_FIELD | NVME_SC_DNR); -+ nvmet_tcp_fatal_error(queue); - return -EPROTO; - } - --- -2.43.2 - -From 43bfda92f23ce4ba6bf013572c11670f91b5e2b8 Mon Sep 17 00:00:00 2001 -From: Christoph Hellwig <hch@lst.de> -Date: Tue, 26 Dec 2023 08:13:29 +0000 -Subject: [PATCH 0580/1501] nvmet-tcp: fix a missing endianess conversion in - nvmet_tcp_try_peek_pdu -Content-Length: 1085 -Lines: 28 - -[ Upstream commit 3a96bff229d6e3016805fd6c3dba0655ccba01eb ] - -No, a __le32 cast doesn't magically byteswap on big-endian systems.. - -Fixes: 70525e5d82f6 ("nvmet-tcp: peek icreq before starting TLS") -Signed-off-by: Christoph Hellwig <hch@lst.de> -Reviewed-by: Sagi Grimberg <sagi@grimberg.me> -Signed-off-by: Keith Busch <kbusch@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/nvme/target/tcp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c -index b4b6a8ac8089..e5a2cd9e8c13 100644 ---- a/drivers/nvme/target/tcp.c -+++ b/drivers/nvme/target/tcp.c -@@ -1778,7 +1778,7 @@ static int nvmet_tcp_try_peek_pdu(struct nvmet_tcp_queue *queue) - (int)sizeof(struct nvme_tcp_icreq_pdu)); - if (hdr->type == nvme_tcp_icreq && - hdr->hlen == sizeof(struct nvme_tcp_icreq_pdu) && -- hdr->plen == (__le32)sizeof(struct nvme_tcp_icreq_pdu)) { -+ hdr->plen == cpu_to_le32(sizeof(struct nvme_tcp_icreq_pdu))) { - pr_debug("queue %d: icreq detected\n", - queue->idx); - return len; --- -2.43.2 - -From bcb9321b63e9355bfdf99d93d46ff02d6f61c68b Mon Sep 17 00:00:00 2001 -From: Fedor Pchelkin <pchelkin@ispras.ru> -Date: Mon, 27 Nov 2023 20:59:04 +0300 -Subject: [PATCH 0581/1501] apparmor: free the allocated pdb objects -Content-Length: 2380 -Lines: 66 - -[ Upstream commit 1af5aa82c976753e93eb52b72784e586a7d2844b ] - -policy_db objects are allocated with kzalloc() inside aa_alloc_pdb() and -are not cleared in the corresponding aa_free_pdb() function causing leak: - -unreferenced object 0xffff88801f0a1400 (size 192): - comm "apparmor_parser", pid 1247, jiffies 4295122827 (age 2306.399s) - hex dump (first 32 bytes): - 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ - 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ - backtrace: - [<ffffffff81ddc612>] __kmem_cache_alloc_node+0x1e2/0x2d0 - [<ffffffff81c47c55>] kmalloc_trace+0x25/0xc0 - [<ffffffff83eb9a12>] aa_alloc_pdb+0x82/0x140 - [<ffffffff83ec4077>] unpack_pdb+0xc7/0x2700 - [<ffffffff83ec6b10>] unpack_profile+0x450/0x4960 - [<ffffffff83ecc129>] aa_unpack+0x309/0x15e0 - [<ffffffff83ebdb23>] aa_replace_profiles+0x213/0x33c0 - [<ffffffff83e8d341>] policy_update+0x261/0x370 - [<ffffffff83e8d66e>] profile_replace+0x20e/0x2a0 - [<ffffffff81eadfaf>] vfs_write+0x2af/0xe00 - [<ffffffff81eaf4c6>] ksys_write+0x126/0x250 - [<ffffffff890fa0b6>] do_syscall_64+0x46/0xf0 - [<ffffffff892000ea>] entry_SYSCALL_64_after_hwframe+0x6e/0x76 - -Free the pdbs inside aa_free_pdb(). While at it, rename the variable -representing an aa_policydb object to make the function more unified with -aa_pdb_free_kref() and aa_alloc_pdb(). - -Found by Linux Verification Center (linuxtesting.org). - -Fixes: 98b824ff8984 ("apparmor: refcount the pdb") -Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> -Signed-off-by: John Johansen <john.johansen@canonical.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - security/apparmor/policy.c | 13 +++++++------ - 1 file changed, 7 insertions(+), 6 deletions(-) - -diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c -index ed4c9803c8fa..957654d253dd 100644 ---- a/security/apparmor/policy.c -+++ b/security/apparmor/policy.c -@@ -99,13 +99,14 @@ const char *const aa_profile_mode_names[] = { - }; - - --static void aa_free_pdb(struct aa_policydb *policy) -+static void aa_free_pdb(struct aa_policydb *pdb) - { -- if (policy) { -- aa_put_dfa(policy->dfa); -- if (policy->perms) -- kvfree(policy->perms); -- aa_free_str_table(&policy->trans); -+ if (pdb) { -+ aa_put_dfa(pdb->dfa); -+ if (pdb->perms) -+ kvfree(pdb->perms); -+ aa_free_str_table(&pdb->trans); -+ kfree(pdb); - } - } - --- -2.43.2 - -From 351b158cf30450bd1090e21b54c1b44748d36749 Mon Sep 17 00:00:00 2001 -From: Ian Rogers <irogers@google.com> -Date: Wed, 6 Dec 2023 17:46:55 -0800 -Subject: [PATCH 0582/1501] perf env: Avoid recursively taking - env->bpf_progs.lock -Content-Length: 9220 -Lines: 268 - -[ Upstream commit 9c51f8788b5d4e9f46afbcf563255cfd355690b3 ] - -Add variants of perf_env__insert_bpf_prog_info(), perf_env__insert_btf() -and perf_env__find_btf prefixed with __ to indicate the -env->bpf_progs.lock is assumed held. - -Call these variants when the lock is held to avoid recursively taking it -and potentially having a thread deadlock with itself. - -Fixes: f8dfeae009effc0b ("perf bpf: Show more BPF program info in print_bpf_prog_info()") -Signed-off-by: Ian Rogers <irogers@google.com> -Acked-by: Jiri Olsa <jolsa@kernel.org> -Acked-by: Song Liu <song@kernel.org> -Cc: Adrian Hunter <adrian.hunter@intel.com> -Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> -Cc: Huacai Chen <chenhuacai@kernel.org> -Cc: Ingo Molnar <mingo@redhat.com> -Cc: K Prateek Nayak <kprateek.nayak@amd.com> -Cc: Kan Liang <kan.liang@linux.intel.com> -Cc: Mark Rutland <mark.rutland@arm.com> -Cc: Ming Wang <wangming01@loongson.cn> -Cc: Namhyung Kim <namhyung@kernel.org> -Cc: Peter Zijlstra <peterz@infradead.org> -Cc: Ravi Bangoria <ravi.bangoria@amd.com> -Link: https://lore.kernel.org/r/20231207014655.1252484-1-irogers@google.com -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/perf/util/bpf-event.c | 8 +++--- - tools/perf/util/bpf-event.h | 12 ++++----- - tools/perf/util/env.c | 50 ++++++++++++++++++++++++------------- - tools/perf/util/env.h | 4 +++ - tools/perf/util/header.c | 8 +++--- - 5 files changed, 50 insertions(+), 32 deletions(-) - -diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c -index 38fcf3ba5749..b00b5a2634c3 100644 ---- a/tools/perf/util/bpf-event.c -+++ b/tools/perf/util/bpf-event.c -@@ -542,9 +542,9 @@ int evlist__add_bpf_sb_event(struct evlist *evlist, struct perf_env *env) - return evlist__add_sb_event(evlist, &attr, bpf_event__sb_cb, env); - } - --void bpf_event__print_bpf_prog_info(struct bpf_prog_info *info, -- struct perf_env *env, -- FILE *fp) -+void __bpf_event__print_bpf_prog_info(struct bpf_prog_info *info, -+ struct perf_env *env, -+ FILE *fp) - { - __u32 *prog_lens = (__u32 *)(uintptr_t)(info->jited_func_lens); - __u64 *prog_addrs = (__u64 *)(uintptr_t)(info->jited_ksyms); -@@ -560,7 +560,7 @@ void bpf_event__print_bpf_prog_info(struct bpf_prog_info *info, - if (info->btf_id) { - struct btf_node *node; - -- node = perf_env__find_btf(env, info->btf_id); -+ node = __perf_env__find_btf(env, info->btf_id); - if (node) - btf = btf__new((__u8 *)(node->data), - node->data_size); -diff --git a/tools/perf/util/bpf-event.h b/tools/perf/util/bpf-event.h -index 1bcbd4fb6c66..e2f0420905f5 100644 ---- a/tools/perf/util/bpf-event.h -+++ b/tools/perf/util/bpf-event.h -@@ -33,9 +33,9 @@ struct btf_node { - int machine__process_bpf(struct machine *machine, union perf_event *event, - struct perf_sample *sample); - int evlist__add_bpf_sb_event(struct evlist *evlist, struct perf_env *env); --void bpf_event__print_bpf_prog_info(struct bpf_prog_info *info, -- struct perf_env *env, -- FILE *fp); -+void __bpf_event__print_bpf_prog_info(struct bpf_prog_info *info, -+ struct perf_env *env, -+ FILE *fp); - #else - static inline int machine__process_bpf(struct machine *machine __maybe_unused, - union perf_event *event __maybe_unused, -@@ -50,9 +50,9 @@ static inline int evlist__add_bpf_sb_event(struct evlist *evlist __maybe_unused, - return 0; - } - --static inline void bpf_event__print_bpf_prog_info(struct bpf_prog_info *info __maybe_unused, -- struct perf_env *env __maybe_unused, -- FILE *fp __maybe_unused) -+static inline void __bpf_event__print_bpf_prog_info(struct bpf_prog_info *info __maybe_unused, -+ struct perf_env *env __maybe_unused, -+ FILE *fp __maybe_unused) - { - - } -diff --git a/tools/perf/util/env.c b/tools/perf/util/env.c -index 44140b7f596a..8da0e2c763e2 100644 ---- a/tools/perf/util/env.c -+++ b/tools/perf/util/env.c -@@ -22,13 +22,19 @@ struct perf_env perf_env; - - void perf_env__insert_bpf_prog_info(struct perf_env *env, - struct bpf_prog_info_node *info_node) -+{ -+ down_write(&env->bpf_progs.lock); -+ __perf_env__insert_bpf_prog_info(env, info_node); -+ up_write(&env->bpf_progs.lock); -+} -+ -+void __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info_node *info_node) - { - __u32 prog_id = info_node->info_linear->info.id; - struct bpf_prog_info_node *node; - struct rb_node *parent = NULL; - struct rb_node **p; - -- down_write(&env->bpf_progs.lock); - p = &env->bpf_progs.infos.rb_node; - - while (*p != NULL) { -@@ -40,15 +46,13 @@ void perf_env__insert_bpf_prog_info(struct perf_env *env, - p = &(*p)->rb_right; - } else { - pr_debug("duplicated bpf prog info %u\n", prog_id); -- goto out; -+ return; - } - } - - rb_link_node(&info_node->rb_node, parent, p); - rb_insert_color(&info_node->rb_node, &env->bpf_progs.infos); - env->bpf_progs.infos_cnt++; --out: -- up_write(&env->bpf_progs.lock); - } - - struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env, -@@ -77,14 +81,22 @@ struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env, - } - - bool perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node) -+{ -+ bool ret; -+ -+ down_write(&env->bpf_progs.lock); -+ ret = __perf_env__insert_btf(env, btf_node); -+ up_write(&env->bpf_progs.lock); -+ return ret; -+} -+ -+bool __perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node) - { - struct rb_node *parent = NULL; - __u32 btf_id = btf_node->id; - struct btf_node *node; - struct rb_node **p; -- bool ret = true; - -- down_write(&env->bpf_progs.lock); - p = &env->bpf_progs.btfs.rb_node; - - while (*p != NULL) { -@@ -96,25 +108,31 @@ bool perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node) - p = &(*p)->rb_right; - } else { - pr_debug("duplicated btf %u\n", btf_id); -- ret = false; -- goto out; -+ return false; - } - } - - rb_link_node(&btf_node->rb_node, parent, p); - rb_insert_color(&btf_node->rb_node, &env->bpf_progs.btfs); - env->bpf_progs.btfs_cnt++; --out: -- up_write(&env->bpf_progs.lock); -- return ret; -+ return true; - } - - struct btf_node *perf_env__find_btf(struct perf_env *env, __u32 btf_id) -+{ -+ struct btf_node *res; -+ -+ down_read(&env->bpf_progs.lock); -+ res = __perf_env__find_btf(env, btf_id); -+ up_read(&env->bpf_progs.lock); -+ return res; -+} -+ -+struct btf_node *__perf_env__find_btf(struct perf_env *env, __u32 btf_id) - { - struct btf_node *node = NULL; - struct rb_node *n; - -- down_read(&env->bpf_progs.lock); - n = env->bpf_progs.btfs.rb_node; - - while (n) { -@@ -124,13 +142,9 @@ struct btf_node *perf_env__find_btf(struct perf_env *env, __u32 btf_id) - else if (btf_id > node->id) - n = n->rb_right; - else -- goto out; -+ return node; - } -- node = NULL; -- --out: -- up_read(&env->bpf_progs.lock); -- return node; -+ return NULL; - } - - /* purge data in bpf_progs.infos tree */ -diff --git a/tools/perf/util/env.h b/tools/perf/util/env.h -index 4566c51f2fd9..359eff51cb85 100644 ---- a/tools/perf/util/env.h -+++ b/tools/perf/util/env.h -@@ -164,12 +164,16 @@ const char *perf_env__raw_arch(struct perf_env *env); - int perf_env__nr_cpus_avail(struct perf_env *env); - - void perf_env__init(struct perf_env *env); -+void __perf_env__insert_bpf_prog_info(struct perf_env *env, -+ struct bpf_prog_info_node *info_node); - void perf_env__insert_bpf_prog_info(struct perf_env *env, - struct bpf_prog_info_node *info_node); - struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env, - __u32 prog_id); - bool perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node); -+bool __perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node); - struct btf_node *perf_env__find_btf(struct perf_env *env, __u32 btf_id); -+struct btf_node *__perf_env__find_btf(struct perf_env *env, __u32 btf_id); - - int perf_env__numa_node(struct perf_env *env, struct perf_cpu cpu); - char *perf_env__find_pmu_cap(struct perf_env *env, const char *pmu_name, -diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c -index b39b3e4cec8a..8b274ccab7a9 100644 ---- a/tools/perf/util/header.c -+++ b/tools/perf/util/header.c -@@ -1849,8 +1849,8 @@ static void print_bpf_prog_info(struct feat_fd *ff, FILE *fp) - node = rb_entry(next, struct bpf_prog_info_node, rb_node); - next = rb_next(&node->rb_node); - -- bpf_event__print_bpf_prog_info(&node->info_linear->info, -- env, fp); -+ __bpf_event__print_bpf_prog_info(&node->info_linear->info, -+ env, fp); - } - - up_read(&env->bpf_progs.lock); -@@ -3180,7 +3180,7 @@ static int process_bpf_prog_info(struct feat_fd *ff, void *data __maybe_unused) - /* after reading from file, translate offset to address */ - bpil_offs_to_addr(info_linear); - info_node->info_linear = info_linear; -- perf_env__insert_bpf_prog_info(env, info_node); -+ __perf_env__insert_bpf_prog_info(env, info_node); - } - - up_write(&env->bpf_progs.lock); -@@ -3227,7 +3227,7 @@ static int process_bpf_btf(struct feat_fd *ff, void *data __maybe_unused) - if (__do_read(ff, node->data, data_size)) - goto out; - -- perf_env__insert_btf(env, node); -+ __perf_env__insert_btf(env, node); - node = NULL; - } - --- -2.43.2 - -From fa5ade5ec5d45cf56cdfffe1332c15c4fae88a91 Mon Sep 17 00:00:00 2001 -From: Ian Rogers <irogers@google.com> -Date: Mon, 11 Dec 2023 10:12:41 -0800 -Subject: [PATCH 0583/1501] perf stat: Fix hard coded LL miss units -Content-Length: 1553 -Lines: 39 - -[ Upstream commit f2567e12a090f0eb22553a4468d4c4fe04aad906 ] - -Copy-paste error where LL cache misses are reported as l1i. - -Fixes: 0a57b910807ad163 ("perf stat: Use counts rather than saved_value") -Suggested-by: Guillaume Endignoux <guillaumee@google.com> -Reviewed-by: Kan Liang <kan.liang@linux.intel.com> -Signed-off-by: Ian Rogers <irogers@google.com> -Cc: Adrian Hunter <adrian.hunter@intel.com> -Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> -Cc: Ian Rogers <irogers@google.com> -Cc: Ingo Molnar <mingo@redhat.com> -Cc: Jiri Olsa <jolsa@kernel.org> -Cc: John Garry <john.g.garry@oracle.com> -Cc: Mark Rutland <mark.rutland@arm.com> -Cc: Namhyung Kim <namhyung@kernel.org> -Cc: Peter Zijlstra <peterz@infradead.org> -Link: https://lore.kernel.org/r/20231211181242.1721059-1-irogers@google.com -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/perf/util/stat-shadow.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/tools/perf/util/stat-shadow.c b/tools/perf/util/stat-shadow.c -index 1c5c3eeba4cf..e31426167852 100644 ---- a/tools/perf/util/stat-shadow.c -+++ b/tools/perf/util/stat-shadow.c -@@ -264,7 +264,7 @@ static void print_ll_miss(struct perf_stat_config *config, - static const double color_ratios[3] = {20.0, 10.0, 5.0}; - - print_ratio(config, evsel, aggr_idx, misses, out, STAT_LL_CACHE, color_ratios, -- "of all L1-icache accesses"); -+ "of all LL-cache accesses"); - } - - static void print_dtlb_miss(struct perf_stat_config *config, --- -2.43.2 - -From e7a0c01d442b07ea80d090c188c9cb1cc64cd9d9 Mon Sep 17 00:00:00 2001 -From: Jim Harris <jim.harris@samsung.com> -Date: Fri, 3 Nov 2023 20:18:34 +0000 -Subject: [PATCH 0584/1501] cxl/region: fix x9 interleave typo -Content-Length: 1128 -Lines: 30 - -[ Upstream commit c7ad3dc3649730af483ee1e78be5d0362da25bfe ] - -CXL supports x3, x6 and x12 - not x9. - -Fixes: 80d10a6cee050 ("cxl/region: Add interleave geometry attributes") -Signed-off-by: Jim Harris <jim.harris@samsung.com> -Reviewed-by: Dave Jiang <dave.jiang@intel.com> -Reviewed-by: Fan Ni <fan.ni@samsung.com> -Link: https://lore.kernel.org/r/169904271254.204936.8580772404462743630.stgit@ubuntu -Signed-off-by: Dan Williams <dan.j.williams@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/cxl/core/region.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c -index 3e817a6f94c6..76fec47a13a4 100644 ---- a/drivers/cxl/core/region.c -+++ b/drivers/cxl/core/region.c -@@ -397,7 +397,7 @@ static ssize_t interleave_ways_store(struct device *dev, - return rc; - - /* -- * Even for x3, x9, and x12 interleaves the region interleave must be a -+ * Even for x3, x6, and x12 interleaves the region interleave must be a - * power of 2 multiple of the host bridge interleave. - */ - if (!is_power_of_2(val / cxld->interleave_ways) || --- -2.43.2 - -From c6bdba19ba5472b046c5a717325bb80d27264162 Mon Sep 17 00:00:00 2001 -From: Fedor Pchelkin <pchelkin@ispras.ru> -Date: Mon, 4 Dec 2023 21:19:44 +0300 -Subject: [PATCH 0585/1501] apparmor: fix possible memory leak in - unpack_trans_table -Content-Length: 3040 -Lines: 84 - -[ Upstream commit 1342ad786073e96fa813ad943c19f586157ae297 ] - -If we fail to unpack the transition table then the table elements which -have been already allocated are not freed on error path. - -unreferenced object 0xffff88802539e000 (size 128): - comm "apparmor_parser", pid 903, jiffies 4294914938 (age 35.085s) - hex dump (first 32 bytes): - 20 73 6f 6d 65 20 6e 61 73 74 79 20 73 74 72 69 some nasty stri - 6e 67 20 73 6f 6d 65 20 6e 61 73 74 79 20 73 74 ng some nasty st - backtrace: - [<ffffffff81ddb312>] __kmem_cache_alloc_node+0x1e2/0x2d0 - [<ffffffff81c47194>] __kmalloc_node_track_caller+0x54/0x170 - [<ffffffff81c225b9>] kmemdup+0x29/0x60 - [<ffffffff83e1ee65>] aa_unpack_strdup+0xe5/0x1b0 - [<ffffffff83e20808>] unpack_pdb+0xeb8/0x2700 - [<ffffffff83e23567>] unpack_profile+0x1507/0x4a30 - [<ffffffff83e27bfa>] aa_unpack+0x36a/0x1560 - [<ffffffff83e194c3>] aa_replace_profiles+0x213/0x33c0 - [<ffffffff83de9461>] policy_update+0x261/0x370 - [<ffffffff83de978e>] profile_replace+0x20e/0x2a0 - [<ffffffff81eac8bf>] vfs_write+0x2af/0xe00 - [<ffffffff81eaddd6>] ksys_write+0x126/0x250 - [<ffffffff88f34fb6>] do_syscall_64+0x46/0xf0 - [<ffffffff890000ea>] entry_SYSCALL_64_after_hwframe+0x6e/0x76 - -Call aa_free_str_table() on error path as was done before the blamed -commit. It implements all necessary checks, frees str_table if it is -available and nullifies the pointers. - -Found by Linux Verification Center (linuxtesting.org). - -Fixes: a0792e2ceddc ("apparmor: make transition table unpack generic so it can be reused") -Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> -Signed-off-by: John Johansen <john.johansen@canonical.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - security/apparmor/lib.c | 1 + - security/apparmor/policy_unpack.c | 7 +++---- - 2 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c -index 4c198d273f09..cd569fbbfe36 100644 ---- a/security/apparmor/lib.c -+++ b/security/apparmor/lib.c -@@ -41,6 +41,7 @@ void aa_free_str_table(struct aa_str_table *t) - kfree_sensitive(t->table[i]); - kfree_sensitive(t->table); - t->table = NULL; -+ t->size = 0; - } - } - -diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c -index 47ec097d6741..9575da5fd4cb 100644 ---- a/security/apparmor/policy_unpack.c -+++ b/security/apparmor/policy_unpack.c -@@ -478,6 +478,8 @@ static bool unpack_trans_table(struct aa_ext *e, struct aa_str_table *strs) - if (!table) - goto fail; - -+ strs->table = table; -+ strs->size = size; - for (i = 0; i < size; i++) { - char *str; - int c, j, pos, size2 = aa_unpack_strdup(e, &str, NULL); -@@ -520,14 +522,11 @@ static bool unpack_trans_table(struct aa_ext *e, struct aa_str_table *strs) - goto fail; - if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) - goto fail; -- -- strs->table = table; -- strs->size = size; - } - return true; - - fail: -- kfree_sensitive(table); -+ aa_free_str_table(strs); - e->pos = saved_pos; - return false; - } --- -2.43.2 - -From 77ab09b92f16c8439a948d1af489196953dc4a0e Mon Sep 17 00:00:00 2001 -From: Fedor Pchelkin <pchelkin@ispras.ru> -Date: Thu, 28 Dec 2023 19:07:43 +0300 -Subject: [PATCH 0586/1501] apparmor: avoid crash when parsed profile name is - empty -Content-Length: 2729 -Lines: 74 - -[ Upstream commit 55a8210c9e7d21ff2644809699765796d4bfb200 ] - -When processing a packed profile in unpack_profile() described like - - "profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}" - -a string ":samba-dcerpcd" is unpacked as a fully-qualified name and then -passed to aa_splitn_fqname(). - -aa_splitn_fqname() treats ":samba-dcerpcd" as only containing a namespace. -Thus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Later -aa_alloc_profile() crashes as the new profile name is NULL now. - -general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI -KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] -CPU: 6 PID: 1657 Comm: apparmor_parser Not tainted 6.7.0-rc2-dirty #16 -Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 -RIP: 0010:strlen+0x1e/0xa0 -Call Trace: - <TASK> - ? strlen+0x1e/0xa0 - aa_policy_init+0x1bb/0x230 - aa_alloc_profile+0xb1/0x480 - unpack_profile+0x3bc/0x4960 - aa_unpack+0x309/0x15e0 - aa_replace_profiles+0x213/0x33c0 - policy_update+0x261/0x370 - profile_replace+0x20e/0x2a0 - vfs_write+0x2af/0xe00 - ksys_write+0x126/0x250 - do_syscall_64+0x46/0xf0 - entry_SYSCALL_64_after_hwframe+0x6e/0x76 - </TASK> ----[ end trace 0000000000000000 ]--- -RIP: 0010:strlen+0x1e/0xa0 - -It seems such behaviour of aa_splitn_fqname() is expected and checked in -other places where it is called (e.g. aa_remove_profiles). Well, there -is an explicit comment "a ns name without a following profile is allowed" -inside. - -AFAICS, nothing can prevent unpacked "name" to be in form like -":samba-dcerpcd" - it is passed from userspace. - -Deny the whole profile set replacement in such case and inform user with -EPROTO and an explaining message. - -Found by Linux Verification Center (linuxtesting.org). - -Fixes: 04dc715e24d0 ("apparmor: audit policy ns specified in policy load") -Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> -Signed-off-by: John Johansen <john.johansen@canonical.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - security/apparmor/policy_unpack.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c -index 9575da5fd4cb..dbf7d96257ad 100644 ---- a/security/apparmor/policy_unpack.c -+++ b/security/apparmor/policy_unpack.c -@@ -832,6 +832,10 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) - - tmpname = aa_splitn_fqname(name, strlen(name), &tmpns, &ns_len); - if (tmpns) { -+ if (!tmpname) { -+ info = "empty profile name"; -+ goto fail; -+ } - *ns_name = kstrndup(tmpns, ns_len, GFP_KERNEL); - if (!*ns_name) { - info = "out of memory"; --- -2.43.2 - -From 777c324c32f0fa8e21c3bce06ea0c81135a11b79 Mon Sep 17 00:00:00 2001 -From: Christoph Niedermaier <cniedermaier@dh-electronics.com> -Date: Sun, 24 Dec 2023 10:32:09 +0100 -Subject: [PATCH 0588/1501] serial: imx: Correct clock error message in - function probe() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1140 -Lines: 29 - -[ Upstream commit 3e189470cad27d41a3a9dc02649f965b7ed1c90f ] - -Correct the clock error message by changing the clock name. - -Fixes: 1e512d45332b ("serial: imx: add error messages when .probe fails") -Signed-off-by: Christoph Niedermaier <cniedermaier@dh-electronics.com> -Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> -Link: https://lore.kernel.org/r/20231224093209.2612-1-cniedermaier@dh-electronics.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/tty/serial/imx.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c -index 16207b9a8c81..81557a58f86f 100644 ---- a/drivers/tty/serial/imx.c -+++ b/drivers/tty/serial/imx.c -@@ -2315,7 +2315,7 @@ static int imx_uart_probe(struct platform_device *pdev) - /* For register access, we only need to enable the ipg clock. */ - ret = clk_prepare_enable(sport->clk_ipg); - if (ret) { -- dev_err(&pdev->dev, "failed to enable per clk: %d\n", ret); -+ dev_err(&pdev->dev, "failed to enable ipg clk: %d\n", ret); - return ret; - } - --- -2.43.2 - -From b695460641b95bd4ab38b8c4d2684c7b6775f6e6 Mon Sep 17 00:00:00 2001 -From: Sam Ravnborg <sam@ravnborg.org> -Date: Tue, 26 Dec 2023 13:16:07 +0100 -Subject: [PATCH 0589/1501] serial: apbuart: fix console prompt on qemu -Content-Length: 1901 -Lines: 52 - -[ Upstream commit c6dcd8050fb7c2efec6946ae9c49bc186b0a7475 ] - -When using a leon kernel with qemu there where no console prompt. -The root cause is the handling of the fifo size in the tx part of the -apbuart driver. - -The qemu uart driver only have a very rudimentary status handling and do -not report the number of chars queued in the tx fifo in the status register. -So the driver ends up with a fifo size of 1. - -In the tx path the fifo size is divided by 2 - resulting in a fifo -size of zero. - -The original implementation would always try to send one char, but -after the introduction of uart_port_tx_limited() the fifo size is -respected even for the first char. - -There seems to be no good reason to divide the fifo size with two - so -remove this. It looks like something copied from the original amba driver. - -With qemu we now have a minimum fifo size of one char, so we show -the prompt. - -Signed-off-by: Sam Ravnborg <sam@ravnborg.org> -Fixes: d11cc8c3c4b6 ("tty: serial: use uart_port_tx_limited()") -Cc: Andreas Larsson <andreas@gaisler.com> -Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Cc: Jiri Slaby <jirislaby@kernel.org> -Cc: <linux-serial@vger.kernel.org> -Cc: <sparclinux@vger.kernel.org> -Link: https://lore.kernel.org/r/20231226121607.GA2622970@ravnborg.org -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/tty/serial/apbuart.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/tty/serial/apbuart.c b/drivers/tty/serial/apbuart.c -index 716cb014c028..364599f256db 100644 ---- a/drivers/tty/serial/apbuart.c -+++ b/drivers/tty/serial/apbuart.c -@@ -122,7 +122,7 @@ static void apbuart_tx_chars(struct uart_port *port) - { - u8 ch; - -- uart_port_tx_limited(port, ch, port->fifosize >> 1, -+ uart_port_tx_limited(port, ch, port->fifosize, - true, - UART_PUT_CHAR(port, ch), - ({})); --- -2.43.2 - -From 5850303d1d9ea165807b5f6a2523ab82e95c1f76 Mon Sep 17 00:00:00 2001 -From: Dan Carpenter <dan.carpenter@linaro.org> -Date: Tue, 2 Jan 2024 16:10:21 +0300 -Subject: [PATCH 0590/1501] cdx: call of_node_put() on error path -Content-Length: 1317 -Lines: 40 - -[ Upstream commit 87736ae12e1427bb2e6fd11f37b2ff76ed69aa0f ] - -Add a missing call to of_node_put(np) on error. - -There was a second error path where "np" was NULL, but that situation is -impossible. The for_each_compatible_node() loop iterator is always -non-NULL. Just deleted that error path. - -Fixes: 54b406e10f03 ("cdx: Remove cdx controller list from cdx bus system") -Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> -Acked-by: Abhijit Gangurde <abhijit.gangurde@amd.com> -Link: https://lore.kernel.org/r/2e66efc4-a13a-4774-8c9d-763455fe4834@moroto.mountain -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/cdx/cdx.c | 7 +++---- - 1 file changed, 3 insertions(+), 4 deletions(-) - -diff --git a/drivers/cdx/cdx.c b/drivers/cdx/cdx.c -index d84d153078d7..40035dd2e299 100644 ---- a/drivers/cdx/cdx.c -+++ b/drivers/cdx/cdx.c -@@ -572,12 +572,11 @@ static ssize_t rescan_store(const struct bus_type *bus, - - /* Rescan all the devices */ - for_each_compatible_node(np, NULL, compat_node_name) { -- if (!np) -- return -EINVAL; -- - pd = of_find_device_by_node(np); -- if (!pd) -+ if (!pd) { -+ of_node_put(np); - return -EINVAL; -+ } - - cdx = platform_get_drvdata(pd); - if (cdx && cdx->controller_registered && cdx->ops->scan) --- -2.43.2 - -From 92c5466b44b8b9cc3092034561d20c067c2d6fc9 Mon Sep 17 00:00:00 2001 -From: Dan Carpenter <dan.carpenter@linaro.org> -Date: Tue, 2 Jan 2024 16:11:16 +0300 -Subject: [PATCH 0591/1501] cdx: Unlock on error path in rescan_store() -Content-Length: 1178 -Lines: 39 - -[ Upstream commit 1960932eef9183e2dab662fe75126f7fa46e0e6d ] - -We added locking to this function but these two error paths were -accidentally overlooked. - -Fixes: f0af81683466 ("cdx: Introduce lock to protect controller ops") -Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> -Acked-by: Abhijit Gangurde <abhijit.gangurde@amd.com> -Link: https://lore.kernel.org/r/a7994b47-6f78-4e2c-a30a-ee5995d428ec@moroto.mountain -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/cdx/cdx.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/cdx/cdx.c b/drivers/cdx/cdx.c -index 40035dd2e299..7c1c1f82a326 100644 ---- a/drivers/cdx/cdx.c -+++ b/drivers/cdx/cdx.c -@@ -575,7 +575,8 @@ static ssize_t rescan_store(const struct bus_type *bus, - pd = of_find_device_by_node(np); - if (!pd) { - of_node_put(np); -- return -EINVAL; -+ count = -EINVAL; -+ goto unlock; - } - - cdx = platform_get_drvdata(pd); -@@ -585,6 +586,7 @@ static ssize_t rescan_store(const struct bus_type *bus, - put_device(&pd->dev); - } - -+unlock: - mutex_unlock(&cdx_controller_lock); - - return count; --- -2.43.2 - -From 3974719e9e7e400ec5d346673fef14cc4ecf90cf Mon Sep 17 00:00:00 2001 -From: Ben Gainey <ben.gainey@arm.com> -Date: Thu, 7 Dec 2023 14:09:11 +0000 -Subject: [PATCH 0592/1501] perf db-export: Fix missing reference count get in - call_path_from_sample() -Content-Length: 2224 -Lines: 65 - -[ Upstream commit 1e24ce402c97dc3c0ab050593f1d5f6fde524564 ] - -The addr_location map and maps fields in the inner loop were missing -calls to map__get()/maps__get(). The subsequent addr_location__exit() -call in each loop puts the map/maps fields causing use-after-free -aborts. - -This issue reproduces on at least arm64 and x86_64 with something -simple like `perf record -g ls` followed by `perf script -s script.py` -with the following script: - - perf_db_export_mode = True - perf_db_export_calls = False - perf_db_export_callchains = True - - def sample_table(*args): - print(f'sample_table({args})') - - def call_path_table(*args): - print(f'call_path_table({args}') - -Committer testing: - -This test, just introduced by Ian Rogers, now passes, not segfaulting -anymore: - - # perf test "perf script tests" - 95: perf script tests : Ok - # - -Fixes: 0dd5041c9a0eaf8c ("perf addr_location: Add init/exit/copy functions") -Signed-off-by: Ben Gainey <ben.gainey@arm.com> -Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Tested-by: Ian Rogers <irogers@google.com> -Cc: Adrian Hunter <adrian.hunter@intel.com> -Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> -Cc: Ingo Molnar <mingo@redhat.com> -Cc: Jiri Olsa <jolsa@kernel.org> -Cc: Mark Rutland <mark.rutland@arm.com> -Cc: Namhyung Kim <namhyung@kernel.org> -Cc: Peter Zijlstra <peterz@infradead.org> -Link: https://lore.kernel.org/r/20231207140911.3240408-1-ben.gainey@arm.com -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/perf/util/db-export.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/tools/perf/util/db-export.c b/tools/perf/util/db-export.c -index b9fb71ab7a73..106429155c2e 100644 ---- a/tools/perf/util/db-export.c -+++ b/tools/perf/util/db-export.c -@@ -253,8 +253,8 @@ static struct call_path *call_path_from_sample(struct db_export *dbe, - */ - addr_location__init(&al); - al.sym = node->ms.sym; -- al.map = node->ms.map; -- al.maps = thread__maps(thread); -+ al.map = map__get(node->ms.map); -+ al.maps = maps__get(thread__maps(thread)); - al.addr = node->ip; - - if (al.map && !al.sym) --- -2.43.2 - -From 3ad5f285fad23b3861029ff85fa0e2147132f7c6 Mon Sep 17 00:00:00 2001 -From: Dan Williams <dan.j.williams@intel.com> -Date: Thu, 21 Dec 2023 21:05:01 -0800 -Subject: [PATCH 0593/1501] cxl/port: Fix missing target list lock -Content-Length: 3579 -Lines: 111 - -[ Upstream commit 5459e186a5c9f412334321cff58d70dcb0e48a04 ] - -cxl_port_setup_targets() modifies the ->targets[] array of a switch -decoder. target_list_show() expects to be able to emit a coherent -snapshot of that array by "holding" ->target_lock for read. The -target_lock is held for write during initialization of the ->targets[] -array, but it is not held for write during cxl_port_setup_targets(). - -The ->target_lock() predates the introduction of @cxl_region_rwsem. That -semaphore protects changes to host-physical-address (HPA) decode which -is precisely what writes to a switch decoder's target list affects. - -Replace ->target_lock with @cxl_region_rwsem. - -Now the side-effect of snapshotting a unstable view of a decoder's -target list is likely benign so the Fixes: tag is presumptive. - -Fixes: 27b3f8d13830 ("cxl/region: Program target lists") -Reviewed-by: Alison Schofield <alison.schofield@intel.com> -Reviewed-by: Dave Jiang <dave.jiang@intel.com> -Signed-off-by: Dan Williams <dan.j.williams@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/cxl/core/port.c | 22 +++++++--------------- - drivers/cxl/cxl.h | 2 -- - 2 files changed, 7 insertions(+), 17 deletions(-) - -diff --git a/drivers/cxl/core/port.c b/drivers/cxl/core/port.c -index 57495cdc181f..6b386771cc25 100644 ---- a/drivers/cxl/core/port.c -+++ b/drivers/cxl/core/port.c -@@ -172,14 +172,10 @@ static ssize_t target_list_show(struct device *dev, - { - struct cxl_switch_decoder *cxlsd = to_cxl_switch_decoder(dev); - ssize_t offset; -- unsigned int seq; - int rc; - -- do { -- seq = read_seqbegin(&cxlsd->target_lock); -- rc = emit_target_list(cxlsd, buf); -- } while (read_seqretry(&cxlsd->target_lock, seq)); -- -+ guard(rwsem_read)(&cxl_region_rwsem); -+ rc = emit_target_list(cxlsd, buf); - if (rc < 0) - return rc; - offset = rc; -@@ -1633,7 +1629,7 @@ EXPORT_SYMBOL_NS_GPL(cxl_mem_find_port, CXL); - static int decoder_populate_targets(struct cxl_switch_decoder *cxlsd, - struct cxl_port *port, int *target_map) - { -- int i, rc = 0; -+ int i; - - if (!target_map) - return 0; -@@ -1643,19 +1639,16 @@ static int decoder_populate_targets(struct cxl_switch_decoder *cxlsd, - if (xa_empty(&port->dports)) - return -EINVAL; - -- write_seqlock(&cxlsd->target_lock); -+ guard(rwsem_write)(&cxl_region_rwsem); - for (i = 0; i < cxlsd->cxld.interleave_ways; i++) { - struct cxl_dport *dport = find_dport(port, target_map[i]); - -- if (!dport) { -- rc = -ENXIO; -- break; -- } -+ if (!dport) -+ return -ENXIO; - cxlsd->target[i] = dport; - } -- write_sequnlock(&cxlsd->target_lock); - -- return rc; -+ return 0; - } - - struct cxl_dport *cxl_hb_modulo(struct cxl_root_decoder *cxlrd, int pos) -@@ -1725,7 +1718,6 @@ static int cxl_switch_decoder_init(struct cxl_port *port, - return -EINVAL; - - cxlsd->nr_targets = nr_targets; -- seqlock_init(&cxlsd->target_lock); - return cxl_decoder_init(port, &cxlsd->cxld); - } - -diff --git a/drivers/cxl/cxl.h b/drivers/cxl/cxl.h -index 687043ece101..62fa96f8567e 100644 ---- a/drivers/cxl/cxl.h -+++ b/drivers/cxl/cxl.h -@@ -412,7 +412,6 @@ struct cxl_endpoint_decoder { - /** - * struct cxl_switch_decoder - Switch specific CXL HDM Decoder - * @cxld: base cxl_decoder object -- * @target_lock: coordinate coherent reads of the target list - * @nr_targets: number of elements in @target - * @target: active ordered target list in current decoder configuration - * -@@ -424,7 +423,6 @@ struct cxl_endpoint_decoder { - */ - struct cxl_switch_decoder { - struct cxl_decoder cxld; -- seqlock_t target_lock; - int nr_targets; - struct cxl_dport *target[]; - }; --- -2.43.2 - -From 7d73071c166a4652892ca2a091d940cd7b228afa Mon Sep 17 00:00:00 2001 -From: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Date: Fri, 5 Jan 2024 15:21:00 +0100 -Subject: [PATCH 0594/1501] spi: coldfire-qspi: Remove an erroneous - clk_disable_unprepare() from the remove function -Content-Length: 1203 -Lines: 33 - -[ Upstream commit 17dc11a02d8dacc7e78968daa2a8c16281eb7d1e ] - -The commit in Fixes has changed a devm_clk_get()/clk_prepare_enable() into -a devm_clk_get_enabled(). -It has updated the error handling path of the probe accordingly, but the -remove has been left unchanged. - -Remove now the redundant clk_disable_unprepare() call from the remove -function. - -Fixes: a90a987ebe00 ("spi: use devm_clk_get_enabled() in mcfqspi_probe()") -Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Link: https://msgid.link/r/6670aed303e1f7680e0911387606a8ae069e2cef.1704464447.git.christophe.jaillet@wanadoo.fr -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/spi/spi-coldfire-qspi.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/drivers/spi/spi-coldfire-qspi.c b/drivers/spi/spi-coldfire-qspi.c -index f0b630fe16c3..b341b6908df0 100644 ---- a/drivers/spi/spi-coldfire-qspi.c -+++ b/drivers/spi/spi-coldfire-qspi.c -@@ -441,7 +441,6 @@ static void mcfqspi_remove(struct platform_device *pdev) - mcfqspi_wr_qmr(mcfqspi, MCFQSPI_QMR_MSTR); - - mcfqspi_cs_teardown(mcfqspi); -- clk_disable_unprepare(mcfqspi->clk); - } - - #ifdef CONFIG_PM_SLEEP --- -2.43.2 - -From 6bda81e24a35a856f58e6a5786de579b07371603 Mon Sep 17 00:00:00 2001 -From: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com> -Date: Mon, 20 Nov 2023 09:14:06 +0000 -Subject: [PATCH 0595/1501] hisi_acc_vfio_pci: Update migration data pointer - correctly on saving/resume -Content-Length: 2663 -Lines: 61 - -[ Upstream commit be12ad45e15b5ee0e2526a50266ba1d295d26a88 ] - -When the optional PRE_COPY support was added to speed up the device -compatibility check, it failed to update the saving/resuming data -pointers based on the fd offset. This results in migration data -corruption and when the device gets started on the destination the -following error is reported in some cases, - -[ 478.907684] arm-smmu-v3 arm-smmu-v3.2.auto: event 0x10 received: -[ 478.913691] arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000310200000010 -[ 478.919603] arm-smmu-v3 arm-smmu-v3.2.auto: 0x000002088000007f -[ 478.925515] arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000000000000000 -[ 478.931425] arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000000000000000 -[ 478.947552] hisi_zip 0000:31:00.0: qm_axi_rresp [error status=0x1] found -[ 478.955930] hisi_zip 0000:31:00.0: qm_db_timeout [error status=0x400] found -[ 478.955944] hisi_zip 0000:31:00.0: qm sq doorbell timeout in function 2 - -Fixes: d9a871e4a143 ("hisi_acc_vfio_pci: Introduce support for PRE_COPY state transitions") -Signed-off-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com> -Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> -Link: https://lore.kernel.org/r/20231120091406.780-1-shameerali.kolothum.thodi@huawei.com -Signed-off-by: Alex Williamson <alex.williamson@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c -index b2f9778c8366..4d27465c8f1a 100644 ---- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c -+++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c -@@ -694,6 +694,7 @@ static ssize_t hisi_acc_vf_resume_write(struct file *filp, const char __user *bu - size_t len, loff_t *pos) - { - struct hisi_acc_vf_migration_file *migf = filp->private_data; -+ u8 *vf_data = (u8 *)&migf->vf_data; - loff_t requested_length; - ssize_t done = 0; - int ret; -@@ -715,7 +716,7 @@ static ssize_t hisi_acc_vf_resume_write(struct file *filp, const char __user *bu - goto out_unlock; - } - -- ret = copy_from_user(&migf->vf_data, buf, len); -+ ret = copy_from_user(vf_data + *pos, buf, len); - if (ret) { - done = -EFAULT; - goto out_unlock; -@@ -835,7 +836,9 @@ static ssize_t hisi_acc_vf_save_read(struct file *filp, char __user *buf, size_t - - len = min_t(size_t, migf->total_length - *pos, len); - if (len) { -- ret = copy_to_user(buf, &migf->vf_data, len); -+ u8 *vf_data = (u8 *)&migf->vf_data; -+ -+ ret = copy_to_user(buf, vf_data + *pos, len); - if (ret) { - done = -EFAULT; - goto out_unlock; --- -2.43.2 - -From 0fbaa908f7c257e1cec9371873fe4c83828c1152 Mon Sep 17 00:00:00 2001 -From: Arnd Bergmann <arnd@arndb.de> -Date: Wed, 3 Jan 2024 16:56:55 +0100 -Subject: [PATCH 0596/1501] nvmet: re-fix tracing strncpy() warning -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1540 -Lines: 40 - -[ Upstream commit 4ee7ffeb4ce50c80bc4504db6f39b25a2df6bcf4 ] - -An earlier patch had tried to address a warning about a string copy with -missing zero termination: - -drivers/nvme/target/trace.h:52:3: warning: ‘strncpy’ specified bound 32 equals destination size [-Wstringop-truncation] - -The new version causes a different warning with some compiler versions, notably -gcc-9 and gcc-10, and also misses the zero padding that was apparently done -intentionally in the original code: - -drivers/nvme/target/trace.h:56:2: error: 'strncpy' specified bound depends on the length of the source argument [-Werror=stringop-overflow=] - -Change it to use strscpy_pad() with the original length, which will give -a properly padded and zero-terminated string as well as avoiding the warning. - -Fixes: d86481e924a7 ("nvmet: use min of device_path and disk len") -Signed-off-by: Arnd Bergmann <arnd@arndb.de> -Signed-off-by: Keith Busch <kbusch@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/nvme/target/trace.h | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/drivers/nvme/target/trace.h b/drivers/nvme/target/trace.h -index 6109b3806b12..155334ddc13f 100644 ---- a/drivers/nvme/target/trace.h -+++ b/drivers/nvme/target/trace.h -@@ -53,8 +53,7 @@ static inline void __assign_req_name(char *name, struct nvmet_req *req) - return; - } - -- strncpy(name, req->ns->device_path, -- min_t(size_t, DISK_NAME_LEN, strlen(req->ns->device_path))); -+ strscpy_pad(name, req->ns->device_path, DISK_NAME_LEN); - } - #endif - --- -2.43.2 - -From b669b08ef0573738706a51009148a4ee9bdce4b5 Mon Sep 17 00:00:00 2001 -From: Arnd Bergmann <arnd@arndb.de> -Date: Wed, 3 Jan 2024 16:56:56 +0100 -Subject: [PATCH 0597/1501] nvme: trace: avoid memcpy overflow warning -Content-Length: 1606 -Lines: 37 - -[ Upstream commit a7de1dea76cd6a3707707af4ea2f8bc3cdeaeb11 ] - -A previous patch introduced a struct_group() in nvme_common_command to help -stringop fortification figure out the length of the fields, but one function -is not currently using them: - -In file included from drivers/nvme/target/core.c:7: -In file included from include/linux/string.h:254: -include/linux/fortify-string.h:592:4: error: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror,-Wattribute-warning] - __read_overflow2_field(q_size_field, size); - ^ - -Change this one to use the correct field name to avoid the warning. - -Fixes: 5c629dc9609dc ("nvme: use struct group for generic command dwords") -Signed-off-by: Arnd Bergmann <arnd@arndb.de> -Signed-off-by: Keith Busch <kbusch@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/nvme/target/trace.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/nvme/target/trace.h b/drivers/nvme/target/trace.h -index 155334ddc13f..974d99d47f51 100644 ---- a/drivers/nvme/target/trace.h -+++ b/drivers/nvme/target/trace.h -@@ -84,7 +84,7 @@ TRACE_EVENT(nvmet_req_init, - __entry->flags = cmd->common.flags; - __entry->nsid = le32_to_cpu(cmd->common.nsid); - __entry->metadata = le64_to_cpu(cmd->common.metadata); -- memcpy(__entry->cdw10, &cmd->common.cdw10, -+ memcpy(__entry->cdw10, &cmd->common.cdws, - sizeof(__entry->cdw10)); - ), - TP_printk("nvmet%s: %sqid=%d, cmdid=%u, nsid=%u, flags=%#x, " --- -2.43.2 - -From 6bb073bcbacf51c06e901322b3fffd8909e9c298 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= <kwilczynski@kernel.org> -Date: Sat, 6 Jan 2024 12:43:28 +0000 -Subject: [PATCH 0598/1501] PCI: xilinx-xdma: Fix uninitialized symbols in - xilinx_pl_dma_pcie_setup_irq() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2135 -Lines: 48 - -[ Upstream commit 7aa5f8fcd6d95b713a39fe52c296a6892eda7f02 ] - -The error paths that follow calls to the devm_request_irq() functions -within the xilinx_pl_dma_pcie_setup_irq() reference an uninitialized -symbol each that also so happens to be incorrect. - -Thus, fix this omission and reference the correct variable when invoking -a given dev_err() function following an error. - -This problem was found using smatch via the 0-DAY CI Kernel Test service: - - drivers/pci/controller/pcie-xilinx-dma-pl.c:638 xilinx_pl_dma_pcie_setup_irq() error: uninitialized symbol 'irq'. - drivers/pci/controller/pcie-xilinx-dma-pl.c:645 xilinx_pl_dma_pcie_setup_irq() error: uninitialized symbol 'irq'. - -Fixes: 8d786149d78c ("PCI: xilinx-xdma: Add Xilinx XDMA Root Port driver") -Link: https://lore.kernel.org/oe-kbuild/202312120248.5DblxkBp-lkp@intel.com/ -Reported-by: kernel test robot <lkp@intel.com> -Reported-by: Dan Carpenter <dan.carpenter@linaro.org> -Closes: https://lore.kernel.org/r/202312120248.5DblxkBp-lkp@intel.com/ -Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/pci/controller/pcie-xilinx-dma-pl.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/pci/controller/pcie-xilinx-dma-pl.c b/drivers/pci/controller/pcie-xilinx-dma-pl.c -index 2f7d676c683c..96aedc85802a 100644 ---- a/drivers/pci/controller/pcie-xilinx-dma-pl.c -+++ b/drivers/pci/controller/pcie-xilinx-dma-pl.c -@@ -635,14 +635,14 @@ static int xilinx_pl_dma_pcie_setup_irq(struct pl_dma_pcie *port) - err = devm_request_irq(dev, port->intx_irq, xilinx_pl_dma_pcie_intx_flow, - IRQF_SHARED | IRQF_NO_THREAD, NULL, port); - if (err) { -- dev_err(dev, "Failed to request INTx IRQ %d\n", irq); -+ dev_err(dev, "Failed to request INTx IRQ %d\n", port->intx_irq); - return err; - } - - err = devm_request_irq(dev, port->irq, xilinx_pl_dma_pcie_event_flow, - IRQF_SHARED | IRQF_NO_THREAD, NULL, port); - if (err) { -- dev_err(dev, "Failed to request event IRQ %d\n", irq); -+ dev_err(dev, "Failed to request event IRQ %d\n", port->irq); - return err; - } - --- -2.43.2 - -From fb1961baa0f46832ea2624b7bf5f01a76535a839 Mon Sep 17 00:00:00 2001 -From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> -Date: Mon, 30 Oct 2023 00:27:57 -0700 -Subject: [PATCH 0599/1501] PCI: xilinx-xdma: Fix error code in - xilinx_pl_dma_pcie_init_irq_domain() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1568 -Lines: 36 - -[ Upstream commit 2324be17b5e05ac682e7c81fcbfc7b36a9b1becb ] - -Currently, if the function irq_domain_add_linear() fails to allocate -a new IRQ domain and returns NULL, we would then still return a success -from the xilinx_pl_dma_pcie_init_irq_domain() function regardless, as -the PTR_ERR(NULL) would return a value of zero. This is not a desirable -outcome. - -Thus, fix the incorrect error code and return the -ENOMEM error code if -the irq_domain_add_linear() fails to allocate a new IRQ domain. - -[kwilczynski: commit log] -Link: https://lore.kernel.org/linux-pci/20231030072757.3236546-1-harshit.m.mogalapalli@oracle.com -Fixes: 8d786149d78c ("PCI: xilinx-xdma: Add Xilinx XDMA Root Port driver") -Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> -Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/pci/controller/pcie-xilinx-dma-pl.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/pci/controller/pcie-xilinx-dma-pl.c b/drivers/pci/controller/pcie-xilinx-dma-pl.c -index 96aedc85802a..3d7f280edade 100644 ---- a/drivers/pci/controller/pcie-xilinx-dma-pl.c -+++ b/drivers/pci/controller/pcie-xilinx-dma-pl.c -@@ -576,7 +576,7 @@ static int xilinx_pl_dma_pcie_init_irq_domain(struct pl_dma_pcie *port) - &intx_domain_ops, port); - if (!port->intx_domain) { - dev_err(dev, "Failed to get a INTx IRQ domain\n"); -- return PTR_ERR(port->intx_domain); -+ return -ENOMEM; - } - - irq_domain_update_bus_token(port->intx_domain, DOMAIN_BUS_WIRED); --- -2.43.2 - -From 547ee6039fe467668449564b1d9997fecf0eac9c Mon Sep 17 00:00:00 2001 -From: Maurizio Lombardi <mlombard@redhat.com> -Date: Fri, 5 Jan 2024 09:14:44 +0100 -Subject: [PATCH 0600/1501] nvmet-tcp: Fix the H2C expected PDU len calculation -Content-Length: 1775 -Lines: 47 - -[ Upstream commit 9a1abc24850eb759e36a2f8869161c3b7254c904 ] - -The nvmet_tcp_handle_h2c_data_pdu() function should take into -consideration the possibility that the header digest and/or the data -digests are enabled when calculating the expected PDU length, before -comparing it to the value stored in cmd->pdu_len. - -Fixes: efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") -Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> -Reviewed-by: Sagi Grimberg <sagi@grimberg.me> -Signed-off-by: Keith Busch <kbusch@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/nvme/target/tcp.c | 10 +++++++--- - 1 file changed, 7 insertions(+), 3 deletions(-) - -diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c -index e5a2cd9e8c13..80db64a4b09f 100644 ---- a/drivers/nvme/target/tcp.c -+++ b/drivers/nvme/target/tcp.c -@@ -979,7 +979,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) - { - struct nvme_tcp_data_pdu *data = &queue->pdu.data; - struct nvmet_tcp_cmd *cmd; -- unsigned int plen; -+ unsigned int exp_data_len; - - if (likely(queue->nr_cmds)) { - if (unlikely(data->ttag >= queue->nr_cmds)) { -@@ -1002,9 +1002,13 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) - return -EPROTO; - } - -- plen = le32_to_cpu(data->hdr.plen); -+ exp_data_len = le32_to_cpu(data->hdr.plen) - -+ nvmet_tcp_hdgst_len(queue) - -+ nvmet_tcp_ddgst_len(queue) - -+ sizeof(*data); -+ - cmd->pdu_len = le32_to_cpu(data->data_length); -- if (unlikely(cmd->pdu_len != (plen - sizeof(*data)) || -+ if (unlikely(cmd->pdu_len != exp_data_len || - cmd->pdu_len == 0 || - cmd->pdu_len > NVMET_TCP_MAXH2CDATA)) { - pr_err("H2CData PDU len %u is invalid\n", cmd->pdu_len); --- -2.43.2 - -From 8a8137376bc3b2c19d75d32b1215df9a5828c3dc Mon Sep 17 00:00:00 2001 -From: Siddharth Vadapalli <s-vadapalli@ti.com> -Date: Wed, 27 Sep 2023 09:48:45 +0530 -Subject: [PATCH 0601/1501] PCI: keystone: Fix race condition when initializing - PHYs -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2161 -Lines: 53 - -[ Upstream commit c12ca110c613a81cb0f0099019c839d078cd0f38 ] - -The PCI driver invokes the PHY APIs using the ks_pcie_enable_phy() -function. The PHY in this case is the Serdes. It is possible that the -PCI instance is configured for two lane operation across two different -Serdes instances, using one lane of each Serdes. - -In such a configuration, if the reference clock for one Serdes is -provided by the other Serdes, it results in a race condition. After the -Serdes providing the reference clock is initialized by the PCI driver by -invoking its PHY APIs, it is not guaranteed that this Serdes remains -powered on long enough for the PHY APIs based initialization of the -dependent Serdes. In such cases, the PLL of the dependent Serdes fails -to lock due to the absence of the reference clock from the former Serdes -which has been powered off by the PM Core. - -Fix this by obtaining reference to the PHYs before invoking the PHY -initialization APIs and releasing reference after the initialization is -complete. - -Link: https://lore.kernel.org/linux-pci/20230927041845.1222080-1-s-vadapalli@ti.com -Fixes: 49229238ab47 ("PCI: keystone: Cleanup PHY handling") -Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com> -Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org> -Acked-by: Ravi Gunasekaran <r-gunasekaran@ti.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/pci/controller/dwc/pci-keystone.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c -index 0def919f89fa..cf3836561316 100644 ---- a/drivers/pci/controller/dwc/pci-keystone.c -+++ b/drivers/pci/controller/dwc/pci-keystone.c -@@ -1218,7 +1218,16 @@ static int ks_pcie_probe(struct platform_device *pdev) - goto err_link; - } - -+ /* Obtain references to the PHYs */ -+ for (i = 0; i < num_lanes; i++) -+ phy_pm_runtime_get_sync(ks_pcie->phy[i]); -+ - ret = ks_pcie_enable_phy(ks_pcie); -+ -+ /* Release references to the PHYs */ -+ for (i = 0; i < num_lanes; i++) -+ phy_pm_runtime_put_sync(ks_pcie->phy[i]); -+ - if (ret) { - dev_err(dev, "failed to enable phy\n"); - goto err_link; --- -2.43.2 - -From a5745b111005bc8928845628a13b2bee252887b6 Mon Sep 17 00:00:00 2001 -From: Gaosheng Cui <cuigaosheng1@huawei.com> -Date: Fri, 5 Jan 2024 10:01:26 +0800 -Subject: [PATCH 0602/1501] apparmor: Fix memory leak in unpack_profile() -Content-Length: 2160 -Lines: 55 - -[ Upstream commit 8ead196be219adade3bd0d4115cc9b8506643121 ] - -The aa_put_pdb(rules->file) should be called when rules->file is -reassigned, otherwise there may be a memory leak. - -This was found via kmemleak: - -unreferenced object 0xffff986c17056600 (size 192): - comm "apparmor_parser", pid 875, jiffies 4294893488 - hex dump (first 32 bytes): - 00 00 00 00 00 00 00 00 00 89 14 04 6c 98 ff ff ............l... - 00 00 8c 11 6c 98 ff ff bc 0c 00 00 00 00 00 00 ....l........... - backtrace (crc e28c80c4): - [<ffffffffba25087f>] kmemleak_alloc+0x4f/0x90 - [<ffffffffb95ecd42>] kmalloc_trace+0x2d2/0x340 - [<ffffffffb98a7b3d>] aa_alloc_pdb+0x4d/0x90 - [<ffffffffb98ab3b8>] unpack_pdb+0x48/0x660 - [<ffffffffb98ac073>] unpack_profile+0x693/0x1090 - [<ffffffffb98acf5a>] aa_unpack+0x10a/0x6e0 - [<ffffffffb98a93e3>] aa_replace_profiles+0xa3/0x1210 - [<ffffffffb989a183>] policy_update+0x163/0x2a0 - [<ffffffffb989a381>] profile_replace+0xb1/0x130 - [<ffffffffb966cb64>] vfs_write+0xd4/0x3d0 - [<ffffffffb966d05b>] ksys_write+0x6b/0xf0 - [<ffffffffb966d10e>] __x64_sys_write+0x1e/0x30 - [<ffffffffba242316>] do_syscall_64+0x76/0x120 - [<ffffffffba4000e5>] entry_SYSCALL_64_after_hwframe+0x6c/0x74 - -So add aa_put_pdb(rules->file) to fix it when rules->file is reassigned. - -Fixes: 98b824ff8984 ("apparmor: refcount the pdb") -Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com> -Signed-off-by: John Johansen <john.johansen@canonical.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - security/apparmor/policy_unpack.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c -index dbf7d96257ad..5e578ef0ddff 100644 ---- a/security/apparmor/policy_unpack.c -+++ b/security/apparmor/policy_unpack.c -@@ -1025,8 +1025,10 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) - } - } else if (rules->policy->dfa && - rules->policy->start[AA_CLASS_FILE]) { -+ aa_put_pdb(rules->file); - rules->file = aa_get_pdb(rules->policy); - } else { -+ aa_put_pdb(rules->file); - rules->file = aa_get_pdb(nullpdb); - } - error = -EPROTO; --- -2.43.2 - -From 40d9d2179ff96898f3b1534b214f6ae6f331483b Mon Sep 17 00:00:00 2001 -From: Jianjun Wang <jianjun.wang@mediatek.com> -Date: Mon, 23 Oct 2023 16:14:23 +0800 -Subject: [PATCH 0603/1501] PCI: mediatek-gen3: Fix translation window size - calculation -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 5240 -Lines: 148 - -[ Upstream commit 9ccc1318cf4bd90601f221268e42c3374703d681 ] - -When using the fls() helper, the translation table should be a power of -two; otherwise, the resulting value will not be correct. - -For example, given fls(0x3e00000) - 1 = 25, the PCIe translation window -size will be set to 0x2000000 instead of the expected size 0x3e00000. - -Fix the translation window by splitting the MMIO space into multiple tables -if its size is not a power of two. - -[kwilczynski: commit log] -Link: https://lore.kernel.org/linux-pci/20231023081423.18559-1-jianjun.wang@mediatek.com -Fixes: d3bf75b579b9 ("PCI: mediatek-gen3: Add MediaTek Gen3 driver for MT8192") -Signed-off-by: Jianjun Wang <jianjun.wang@mediatek.com> -Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org> -Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> -Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/pci/controller/pcie-mediatek-gen3.c | 89 ++++++++++++--------- - 1 file changed, 52 insertions(+), 37 deletions(-) - -diff --git a/drivers/pci/controller/pcie-mediatek-gen3.c b/drivers/pci/controller/pcie-mediatek-gen3.c -index e0e27645fdf4..975b3024fb08 100644 ---- a/drivers/pci/controller/pcie-mediatek-gen3.c -+++ b/drivers/pci/controller/pcie-mediatek-gen3.c -@@ -245,35 +245,60 @@ static int mtk_pcie_set_trans_table(struct mtk_gen3_pcie *pcie, - resource_size_t cpu_addr, - resource_size_t pci_addr, - resource_size_t size, -- unsigned long type, int num) -+ unsigned long type, int *num) - { -+ resource_size_t remaining = size; -+ resource_size_t table_size; -+ resource_size_t addr_align; -+ const char *range_type; - void __iomem *table; - u32 val; - -- if (num >= PCIE_MAX_TRANS_TABLES) { -- dev_err(pcie->dev, "not enough translate table for addr: %#llx, limited to [%d]\n", -- (unsigned long long)cpu_addr, PCIE_MAX_TRANS_TABLES); -- return -ENODEV; -+ while (remaining && (*num < PCIE_MAX_TRANS_TABLES)) { -+ /* Table size needs to be a power of 2 */ -+ table_size = BIT(fls(remaining) - 1); -+ -+ if (cpu_addr > 0) { -+ addr_align = BIT(ffs(cpu_addr) - 1); -+ table_size = min(table_size, addr_align); -+ } -+ -+ /* Minimum size of translate table is 4KiB */ -+ if (table_size < 0x1000) { -+ dev_err(pcie->dev, "illegal table size %#llx\n", -+ (unsigned long long)table_size); -+ return -EINVAL; -+ } -+ -+ table = pcie->base + PCIE_TRANS_TABLE_BASE_REG + *num * PCIE_ATR_TLB_SET_OFFSET; -+ writel_relaxed(lower_32_bits(cpu_addr) | PCIE_ATR_SIZE(fls(table_size) - 1), table); -+ writel_relaxed(upper_32_bits(cpu_addr), table + PCIE_ATR_SRC_ADDR_MSB_OFFSET); -+ writel_relaxed(lower_32_bits(pci_addr), table + PCIE_ATR_TRSL_ADDR_LSB_OFFSET); -+ writel_relaxed(upper_32_bits(pci_addr), table + PCIE_ATR_TRSL_ADDR_MSB_OFFSET); -+ -+ if (type == IORESOURCE_IO) { -+ val = PCIE_ATR_TYPE_IO | PCIE_ATR_TLP_TYPE_IO; -+ range_type = "IO"; -+ } else { -+ val = PCIE_ATR_TYPE_MEM | PCIE_ATR_TLP_TYPE_MEM; -+ range_type = "MEM"; -+ } -+ -+ writel_relaxed(val, table + PCIE_ATR_TRSL_PARAM_OFFSET); -+ -+ dev_dbg(pcie->dev, "set %s trans window[%d]: cpu_addr = %#llx, pci_addr = %#llx, size = %#llx\n", -+ range_type, *num, (unsigned long long)cpu_addr, -+ (unsigned long long)pci_addr, (unsigned long long)table_size); -+ -+ cpu_addr += table_size; -+ pci_addr += table_size; -+ remaining -= table_size; -+ (*num)++; - } - -- table = pcie->base + PCIE_TRANS_TABLE_BASE_REG + -- num * PCIE_ATR_TLB_SET_OFFSET; -- -- writel_relaxed(lower_32_bits(cpu_addr) | PCIE_ATR_SIZE(fls(size) - 1), -- table); -- writel_relaxed(upper_32_bits(cpu_addr), -- table + PCIE_ATR_SRC_ADDR_MSB_OFFSET); -- writel_relaxed(lower_32_bits(pci_addr), -- table + PCIE_ATR_TRSL_ADDR_LSB_OFFSET); -- writel_relaxed(upper_32_bits(pci_addr), -- table + PCIE_ATR_TRSL_ADDR_MSB_OFFSET); -- -- if (type == IORESOURCE_IO) -- val = PCIE_ATR_TYPE_IO | PCIE_ATR_TLP_TYPE_IO; -- else -- val = PCIE_ATR_TYPE_MEM | PCIE_ATR_TLP_TYPE_MEM; -- -- writel_relaxed(val, table + PCIE_ATR_TRSL_PARAM_OFFSET); -+ if (remaining) -+ dev_warn(pcie->dev, "not enough translate table for addr: %#llx, limited to [%d]\n", -+ (unsigned long long)cpu_addr, PCIE_MAX_TRANS_TABLES); - - return 0; - } -@@ -380,30 +405,20 @@ static int mtk_pcie_startup_port(struct mtk_gen3_pcie *pcie) - resource_size_t cpu_addr; - resource_size_t pci_addr; - resource_size_t size; -- const char *range_type; - -- if (type == IORESOURCE_IO) { -+ if (type == IORESOURCE_IO) - cpu_addr = pci_pio_to_address(res->start); -- range_type = "IO"; -- } else if (type == IORESOURCE_MEM) { -+ else if (type == IORESOURCE_MEM) - cpu_addr = res->start; -- range_type = "MEM"; -- } else { -+ else - continue; -- } - - pci_addr = res->start - entry->offset; - size = resource_size(res); - err = mtk_pcie_set_trans_table(pcie, cpu_addr, pci_addr, size, -- type, table_index); -+ type, &table_index); - if (err) - return err; -- -- dev_dbg(pcie->dev, "set %s trans window[%d]: cpu_addr = %#llx, pci_addr = %#llx, size = %#llx\n", -- range_type, table_index, (unsigned long long)cpu_addr, -- (unsigned long long)pci_addr, (unsigned long long)size); -- -- table_index++; - } - - return 0; --- -2.43.2 - -From cde6ca5872bf67744dffa875a7cb521ab007b7ef Mon Sep 17 00:00:00 2001 -From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> -Date: Thu, 11 Jan 2024 11:52:26 +0100 -Subject: [PATCH 0604/1501] ASoC: mediatek: sof-common: Add NULL check for - normal_link string -Content-Length: 1623 -Lines: 37 - -[ Upstream commit e3b3ec967a7d93b9010a5af9a2394c8b5c8f31ed ] - -It's not granted that all entries of struct sof_conn_stream declare -a `normal_link` (a non-SOF, direct link) string, and this is the case -for SoCs that support only SOF paths (hence do not support both direct -and SOF usecases). - -For example, in the case of MT8188 there is no normal_link string in -any of the sof_conn_stream entries and there will be more drivers -doing that in the future. - -To avoid possible NULL pointer KPs, add a NULL check for `normal_link`. - -Fixes: 0caf1120c583 ("ASoC: mediatek: mt8195: extract SOF common code") -Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> -Link: https://msgid.link/r/20240111105226.117603-1-angelogioacchino.delregno@collabora.com -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - sound/soc/mediatek/common/mtk-dsp-sof-common.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/sound/soc/mediatek/common/mtk-dsp-sof-common.c b/sound/soc/mediatek/common/mtk-dsp-sof-common.c -index f3894010f656..7ec8965a70c0 100644 ---- a/sound/soc/mediatek/common/mtk-dsp-sof-common.c -+++ b/sound/soc/mediatek/common/mtk-dsp-sof-common.c -@@ -24,7 +24,7 @@ int mtk_sof_dai_link_fixup(struct snd_soc_pcm_runtime *rtd, - struct snd_soc_dai_link *sof_dai_link = NULL; - const struct sof_conn_stream *conn = &sof_priv->conn_streams[i]; - -- if (strcmp(rtd->dai_link->name, conn->normal_link)) -+ if (conn->normal_link && strcmp(rtd->dai_link->name, conn->normal_link)) - continue; - - for_each_card_rtds(card, runtime) { --- -2.43.2 - -From 2c272aa079d797c3011e5202aafce264838a2186 Mon Sep 17 00:00:00 2001 -From: Niklas Schnelle <schnelle@linux.ibm.com> -Date: Tue, 28 Nov 2023 16:22:49 +0100 -Subject: [PATCH 0605/1501] s390/pci: fix max size calculation in - zpci_memcpy_toio() -Content-Length: 4920 -Lines: 137 - -[ Upstream commit 80df7d6af7f6d229b34cf237b2cc9024c07111cd ] - -The zpci_get_max_write_size() helper is used to determine the maximum -size a PCI store or load can use at a given __iomem address. - -For the PCI block store the following restrictions apply: - -1. The dst + len must not cross a 4K boundary in the (pseudo-)MMIO space -2. len must not exceed ZPCI_MAX_WRITE_SIZE -3. len must be a multiple of 8 bytes -4. The src address must be double word (8 byte) aligned -5. The dst address must be double word (8 byte) aligned - -Otherwise only a normal PCI store which takes its src value from -a register can be used. For these PCI store restriction 1 still applies. -Similarly 1 also applies to PCI loads. - -It turns out zpci_max_write_size() instead implements stricter -conditions which prevents PCI block stores from being used where they -can and should be used. In particular instead of conditions 4 and 5 it -wrongly enforces both dst and src to be size aligned. This indirectly -covers condition 1 but also prevents many legal PCI block stores. - -On top of the functional shortcomings the zpci_get_max_write_size() is -misnamed as it is used for both read and write size calculations. Rename -it to zpci_get_max_io_size() and implement the listed conditions -explicitly. - -Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> -Fixes: cd24834130ac ("s390/pci: base support") -Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com> -[agordeev@linux.ibm.com replaced spaces with tabs] -Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/s390/include/asm/pci_io.h | 32 ++++++++++++++++++-------------- - arch/s390/pci/pci_mmio.c | 12 ++++++------ - 2 files changed, 24 insertions(+), 20 deletions(-) - -diff --git a/arch/s390/include/asm/pci_io.h b/arch/s390/include/asm/pci_io.h -index 287bb88f7698..2686bee800e3 100644 ---- a/arch/s390/include/asm/pci_io.h -+++ b/arch/s390/include/asm/pci_io.h -@@ -11,6 +11,8 @@ - /* I/O size constraints */ - #define ZPCI_MAX_READ_SIZE 8 - #define ZPCI_MAX_WRITE_SIZE 128 -+#define ZPCI_BOUNDARY_SIZE (1 << 12) -+#define ZPCI_BOUNDARY_MASK (ZPCI_BOUNDARY_SIZE - 1) - - /* I/O Map */ - #define ZPCI_IOMAP_SHIFT 48 -@@ -125,16 +127,18 @@ static inline int zpci_read_single(void *dst, const volatile void __iomem *src, - int zpci_write_block(volatile void __iomem *dst, const void *src, - unsigned long len); - --static inline u8 zpci_get_max_write_size(u64 src, u64 dst, int len, int max) -+static inline int zpci_get_max_io_size(u64 src, u64 dst, int len, int max) - { -- int count = len > max ? max : len, size = 1; -+ int offset = dst & ZPCI_BOUNDARY_MASK; -+ int size; - -- while (!(src & 0x1) && !(dst & 0x1) && ((size << 1) <= count)) { -- dst = dst >> 1; -- src = src >> 1; -- size = size << 1; -- } -- return size; -+ size = min3(len, ZPCI_BOUNDARY_SIZE - offset, max); -+ if (IS_ALIGNED(src, 8) && IS_ALIGNED(dst, 8) && IS_ALIGNED(size, 8)) -+ return size; -+ -+ if (size >= 8) -+ return 8; -+ return rounddown_pow_of_two(size); - } - - static inline int zpci_memcpy_fromio(void *dst, -@@ -144,9 +148,9 @@ static inline int zpci_memcpy_fromio(void *dst, - int size, rc = 0; - - while (n > 0) { -- size = zpci_get_max_write_size((u64 __force) src, -- (u64) dst, n, -- ZPCI_MAX_READ_SIZE); -+ size = zpci_get_max_io_size((u64 __force) src, -+ (u64) dst, n, -+ ZPCI_MAX_READ_SIZE); - rc = zpci_read_single(dst, src, size); - if (rc) - break; -@@ -166,9 +170,9 @@ static inline int zpci_memcpy_toio(volatile void __iomem *dst, - return -EINVAL; - - while (n > 0) { -- size = zpci_get_max_write_size((u64 __force) dst, -- (u64) src, n, -- ZPCI_MAX_WRITE_SIZE); -+ size = zpci_get_max_io_size((u64 __force) dst, -+ (u64) src, n, -+ ZPCI_MAX_WRITE_SIZE); - if (size > 8) /* main path */ - rc = zpci_write_block(dst, src, size); - else -diff --git a/arch/s390/pci/pci_mmio.c b/arch/s390/pci/pci_mmio.c -index 588089332931..a90499c087f0 100644 ---- a/arch/s390/pci/pci_mmio.c -+++ b/arch/s390/pci/pci_mmio.c -@@ -97,9 +97,9 @@ static inline int __memcpy_toio_inuser(void __iomem *dst, - return -EINVAL; - - while (n > 0) { -- size = zpci_get_max_write_size((u64 __force) dst, -- (u64 __force) src, n, -- ZPCI_MAX_WRITE_SIZE); -+ size = zpci_get_max_io_size((u64 __force) dst, -+ (u64 __force) src, n, -+ ZPCI_MAX_WRITE_SIZE); - if (size > 8) /* main path */ - rc = __pcistb_mio_inuser(dst, src, size, &status); - else -@@ -242,9 +242,9 @@ static inline int __memcpy_fromio_inuser(void __user *dst, - u8 status; - - while (n > 0) { -- size = zpci_get_max_write_size((u64 __force) src, -- (u64 __force) dst, n, -- ZPCI_MAX_READ_SIZE); -+ size = zpci_get_max_io_size((u64 __force) src, -+ (u64 __force) dst, n, -+ ZPCI_MAX_READ_SIZE); - rc = __pcilg_mio_inuser(dst, src, size, &status); - if (rc) - break; --- -2.43.2 - -From 17d06a5c44d8fd2e8e61bac295b09153496f87e1 Mon Sep 17 00:00:00 2001 -From: Lin Ma <linma@zju.edu.cn> -Date: Wed, 10 Jan 2024 14:14:00 +0800 -Subject: [PATCH 0606/1501] net: qualcomm: rmnet: fix global oob in - rmnet_policy -Content-Length: 4760 -Lines: 97 - -[ Upstream commit b33fb5b801c6db408b774a68e7c8722796b59ecc ] - -The variable rmnet_link_ops assign a *bigger* maxtype which leads to a -global out-of-bounds read when parsing the netlink attributes. See bug -trace below: - -================================================================== -BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline] -BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 -Read of size 1 at addr ffffffff92c438d0 by task syz-executor.6/84207 - -CPU: 0 PID: 84207 Comm: syz-executor.6 Tainted: G N 6.1.0 #3 -Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 -Call Trace: - <TASK> - __dump_stack lib/dump_stack.c:88 [inline] - dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106 - print_address_description mm/kasan/report.c:284 [inline] - print_report+0x172/0x475 mm/kasan/report.c:395 - kasan_report+0xbb/0x1c0 mm/kasan/report.c:495 - validate_nla lib/nlattr.c:386 [inline] - __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 - __nla_parse+0x3e/0x50 lib/nlattr.c:697 - nla_parse_nested_deprecated include/net/netlink.h:1248 [inline] - __rtnl_newlink+0x50a/0x1880 net/core/rtnetlink.c:3485 - rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3594 - rtnetlink_rcv_msg+0x43c/0xd70 net/core/rtnetlink.c:6091 - netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540 - netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] - netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345 - netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921 - sock_sendmsg_nosec net/socket.c:714 [inline] - sock_sendmsg+0x154/0x190 net/socket.c:734 - ____sys_sendmsg+0x6df/0x840 net/socket.c:2482 - ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 - __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 - do_syscall_x64 arch/x86/entry/common.c:50 [inline] - do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 - entry_SYSCALL_64_after_hwframe+0x63/0xcd -RIP: 0033:0x7fdcf2072359 -Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 -RSP: 002b:00007fdcf13e3168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e -RAX: ffffffffffffffda RBX: 00007fdcf219ff80 RCX: 00007fdcf2072359 -RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003 -RBP: 00007fdcf20bd493 R08: 0000000000000000 R09: 0000000000000000 -R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 -R13: 00007fffbb8d7bdf R14: 00007fdcf13e3300 R15: 0000000000022000 - </TASK> - -The buggy address belongs to the variable: - rmnet_policy+0x30/0xe0 - -The buggy address belongs to the physical page: -page:0000000065bdeb3c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x155243 -flags: 0x200000000001000(reserved|node=0|zone=2) -raw: 0200000000001000 ffffea00055490c8 ffffea00055490c8 0000000000000000 -raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 -page dumped because: kasan: bad access detected - -Memory state around the buggy address: - ffffffff92c43780: f9 f9 f9 f9 00 00 00 02 f9 f9 f9 f9 00 00 00 07 - ffffffff92c43800: f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 06 f9 f9 f9 ->ffffffff92c43880: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 - ^ - ffffffff92c43900: 00 00 00 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9 f9 - ffffffff92c43980: 00 00 00 07 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 - -According to the comment of `nla_parse_nested_deprecated`, the maxtype -should be len(destination array) - 1. Hence use `IFLA_RMNET_MAX` here. - -Fixes: 14452ca3b5ce ("net: qualcomm: rmnet: Export mux_id and flags to netlink") -Signed-off-by: Lin Ma <linma@zju.edu.cn> -Reviewed-by: Subash Abhinov Kasiviswanathan <quic_subashab@quicinc.com> -Reviewed-by: Simon Horman <horms@kernel.org> -Reviewed-by: Jiri Pirko <jiri@nvidia.com> -Link: https://lore.kernel.org/r/20240110061400.3356108-1-linma@zju.edu.cn -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c -index 39d24e07f306..5b69b9268c75 100644 ---- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c -+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c -@@ -396,7 +396,7 @@ static int rmnet_fill_info(struct sk_buff *skb, const struct net_device *dev) - - struct rtnl_link_ops rmnet_link_ops __read_mostly = { - .kind = "rmnet", -- .maxtype = __IFLA_RMNET_MAX, -+ .maxtype = IFLA_RMNET_MAX, - .priv_size = sizeof(struct rmnet_priv), - .setup = rmnet_vnd_setup, - .validate = rmnet_rtnl_validate, --- -2.43.2 - -From dbd909c20c11f0d29c0054d41e0d1f668a60e8c8 Mon Sep 17 00:00:00 2001 -From: Vladimir Oltean <vladimir.oltean@nxp.com> -Date: Wed, 10 Jan 2024 02:33:54 +0200 -Subject: [PATCH 0607/1501] net: dsa: fix netdev_priv() dereference before - check on non-DSA netdevice events -Content-Length: 3702 -Lines: 94 - -[ Upstream commit 844f104790bd69c2e4dbb9ee3eba46fde1fcea7b ] - -After the blamed commit, we started doing this dereference for every -NETDEV_CHANGEUPPER and NETDEV_PRECHANGEUPPER event in the system. - -static inline struct dsa_port *dsa_user_to_port(const struct net_device *dev) -{ - struct dsa_user_priv *p = netdev_priv(dev); - - return p->dp; -} - -Which is obviously bogus, because not all net_devices have a netdev_priv() -of type struct dsa_user_priv. But struct dsa_user_priv is fairly small, -and p->dp means dereferencing 8 bytes starting with offset 16. Most -drivers allocate that much private memory anyway, making our access not -fault, and we discard the bogus data quickly afterwards, so this wasn't -caught. - -But the dummy interface is somewhat special in that it calls -alloc_netdev() with a priv size of 0. So every netdev_priv() dereference -is invalid, and we get this when we emit a NETDEV_PRECHANGEUPPER event -with a VLAN as its new upper: - -$ ip link add dummy1 type dummy -$ ip link add link dummy1 name dummy1.100 type vlan id 100 -[ 43.309174] ================================================================== -[ 43.316456] BUG: KASAN: slab-out-of-bounds in dsa_user_prechangeupper+0x30/0xe8 -[ 43.323835] Read of size 8 at addr ffff3f86481d2990 by task ip/374 -[ 43.330058] -[ 43.342436] Call trace: -[ 43.366542] dsa_user_prechangeupper+0x30/0xe8 -[ 43.371024] dsa_user_netdevice_event+0xb38/0xee8 -[ 43.375768] notifier_call_chain+0xa4/0x210 -[ 43.379985] raw_notifier_call_chain+0x24/0x38 -[ 43.384464] __netdev_upper_dev_link+0x3ec/0x5d8 -[ 43.389120] netdev_upper_dev_link+0x70/0xa8 -[ 43.393424] register_vlan_dev+0x1bc/0x310 -[ 43.397554] vlan_newlink+0x210/0x248 -[ 43.401247] rtnl_newlink+0x9fc/0xe30 -[ 43.404942] rtnetlink_rcv_msg+0x378/0x580 - -Avoid the kernel oops by dereferencing after the type check, as customary. - -Fixes: 4c3f80d22b2e ("net: dsa: walk through all changeupper notifier functions") -Reported-and-tested-by: syzbot+d81bcd883824180500c8@syzkaller.appspotmail.com -Closes: https://lore.kernel.org/netdev/0000000000001d4255060e87545c@google.com/ -Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> -Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> -Reviewed-by: Eric Dumazet <edumazet@google.com> -Link: https://lore.kernel.org/r/20240110003354.2796778-1-vladimir.oltean@nxp.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/dsa/user.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/net/dsa/user.c b/net/dsa/user.c -index d438884a4eb0..a82c7f5a1a12 100644 ---- a/net/dsa/user.c -+++ b/net/dsa/user.c -@@ -2829,13 +2829,14 @@ EXPORT_SYMBOL_GPL(dsa_user_dev_check); - static int dsa_user_changeupper(struct net_device *dev, - struct netdev_notifier_changeupper_info *info) - { -- struct dsa_port *dp = dsa_user_to_port(dev); - struct netlink_ext_ack *extack; - int err = NOTIFY_DONE; -+ struct dsa_port *dp; - - if (!dsa_user_dev_check(dev)) - return err; - -+ dp = dsa_user_to_port(dev); - extack = netdev_notifier_info_to_extack(&info->info); - - if (netif_is_bridge_master(info->upper_dev)) { -@@ -2888,11 +2889,13 @@ static int dsa_user_changeupper(struct net_device *dev, - static int dsa_user_prechangeupper(struct net_device *dev, - struct netdev_notifier_changeupper_info *info) - { -- struct dsa_port *dp = dsa_user_to_port(dev); -+ struct dsa_port *dp; - - if (!dsa_user_dev_check(dev)) - return NOTIFY_DONE; - -+ dp = dsa_user_to_port(dev); -+ - if (netif_is_bridge_master(info->upper_dev) && !info->linking) - dsa_port_pre_bridge_leave(dp, info->upper_dev); - else if (netif_is_lag_master(info->upper_dev) && !info->linking) --- -2.43.2 - -From 84941032777d994c3035a0d1f8d5fd15b8c851b1 Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Tue, 9 Jan 2024 15:10:48 +0000 -Subject: [PATCH 0608/1501] rxrpc: Fix use of Don't Fragment flag -Content-Length: 4577 -Lines: 113 - -[ Upstream commit 8722014311e613244f33952354956a82fa4b0472 ] - -rxrpc normally has the Don't Fragment flag set on the UDP packets it -transmits, except when it has decided that DATA packets aren't getting -through - in which case it turns it off just for the DATA transmissions. -This can be a problem, however, for RESPONSE packets that convey -authentication and crypto data from the client to the server as ticket may -be larger than can fit in the MTU. - -In such a case, rxrpc gets itself into an infinite loop as the sendmsg -returns an error (EMSGSIZE), which causes rxkad_send_response() to return --EAGAIN - and the CHALLENGE packet is put back on the Rx queue to retry, -leading to the I/O thread endlessly attempting to perform the transmission. - -Fix this by disabling DF on RESPONSE packets for now. The use of DF and -best data MTU determination needs reconsidering at some point in the -future. - -Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both") -Reported-by: Marc Dionne <marc.dionne@auristor.com> -Signed-off-by: David Howells <dhowells@redhat.com> -cc: linux-afs@lists.infradead.org -Acked-by: Paolo Abeni <pabeni@redhat.com> -Link: https://lore.kernel.org/r/1581852.1704813048@warthog.procyon.org.uk -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/rxrpc/ar-internal.h | 1 + - net/rxrpc/local_object.c | 13 ++++++++++++- - net/rxrpc/output.c | 6 ++---- - net/rxrpc/rxkad.c | 2 ++ - 4 files changed, 17 insertions(+), 5 deletions(-) - -diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h -index e8e14c6f904d..e8b43408136a 100644 ---- a/net/rxrpc/ar-internal.h -+++ b/net/rxrpc/ar-internal.h -@@ -1076,6 +1076,7 @@ void rxrpc_send_version_request(struct rxrpc_local *local, - /* - * local_object.c - */ -+void rxrpc_local_dont_fragment(const struct rxrpc_local *local, bool set); - struct rxrpc_local *rxrpc_lookup_local(struct net *, const struct sockaddr_rxrpc *); - struct rxrpc_local *rxrpc_get_local(struct rxrpc_local *, enum rxrpc_local_trace); - struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *, enum rxrpc_local_trace); -diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c -index c553a30e9c83..34d307368135 100644 ---- a/net/rxrpc/local_object.c -+++ b/net/rxrpc/local_object.c -@@ -36,6 +36,17 @@ static void rxrpc_encap_err_rcv(struct sock *sk, struct sk_buff *skb, int err, - return ipv6_icmp_error(sk, skb, err, port, info, payload); - } - -+/* -+ * Set or clear the Don't Fragment flag on a socket. -+ */ -+void rxrpc_local_dont_fragment(const struct rxrpc_local *local, bool set) -+{ -+ if (set) -+ ip_sock_set_mtu_discover(local->socket->sk, IP_PMTUDISC_DO); -+ else -+ ip_sock_set_mtu_discover(local->socket->sk, IP_PMTUDISC_DONT); -+} -+ - /* - * Compare a local to an address. Return -ve, 0 or +ve to indicate less than, - * same or greater than. -@@ -203,7 +214,7 @@ static int rxrpc_open_socket(struct rxrpc_local *local, struct net *net) - ip_sock_set_recverr(usk); - - /* we want to set the don't fragment bit */ -- ip_sock_set_mtu_discover(usk, IP_PMTUDISC_DO); -+ rxrpc_local_dont_fragment(local, true); - - /* We want receive timestamps. */ - sock_enable_timestamps(usk); -diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c -index 5e53429c6922..a0906145e829 100644 ---- a/net/rxrpc/output.c -+++ b/net/rxrpc/output.c -@@ -494,14 +494,12 @@ int rxrpc_send_data_packet(struct rxrpc_call *call, struct rxrpc_txbuf *txb) - switch (conn->local->srx.transport.family) { - case AF_INET6: - case AF_INET: -- ip_sock_set_mtu_discover(conn->local->socket->sk, -- IP_PMTUDISC_DONT); -+ rxrpc_local_dont_fragment(conn->local, false); - rxrpc_inc_stat(call->rxnet, stat_tx_data_send_frag); - ret = do_udp_sendmsg(conn->local->socket, &msg, len); - conn->peer->last_tx_at = ktime_get_seconds(); - -- ip_sock_set_mtu_discover(conn->local->socket->sk, -- IP_PMTUDISC_DO); -+ rxrpc_local_dont_fragment(conn->local, true); - break; - - default: -diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c -index 1bf571a66e02..b52dedcebce0 100644 ---- a/net/rxrpc/rxkad.c -+++ b/net/rxrpc/rxkad.c -@@ -724,7 +724,9 @@ static int rxkad_send_response(struct rxrpc_connection *conn, - serial = atomic_inc_return(&conn->serial); - whdr.serial = htonl(serial); - -+ rxrpc_local_dont_fragment(conn->local, false); - ret = kernel_sendmsg(conn->local->socket, &msg, iov, 3, len); -+ rxrpc_local_dont_fragment(conn->local, true); - if (ret < 0) { - trace_rxrpc_tx_fail(conn->debug_id, serial, ret, - rxrpc_tx_point_rxkad_response); --- -2.43.2 - -From b612a34cae181b0a1845d28bad5553d83316afe0 Mon Sep 17 00:00:00 2001 -From: Nithin Dabilpuram <ndabilpuram@marvell.com> -Date: Mon, 8 Jan 2024 13:00:36 +0530 -Subject: [PATCH 0609/1501] octeontx2-af: CN10KB: Fix FIFO length calculation - for RPM2 -Content-Length: 1750 -Lines: 45 - -[ Upstream commit a0cb76a770083a22167659e64ba69af6425b1d9b ] - -RPM0 and RPM1 on the CN10KB SoC have 8 LMACs each, whereas RPM2 -has only 4 LMACs. Similarly, the RPM0 and RPM1 have 256KB FIFO, -whereas RPM2 has 128KB FIFO. This patch fixes an issue with -improper TX credit programming for the RPM2 link. - -Fixes: b9d0fedc6234 ("octeontx2-af: cn10kb: Add RPM_USX MAC support") -Signed-off-by: Nithin Dabilpuram <ndabilpuram@marvell.com> -Signed-off-by: Naveen Mamindlapalli <naveenm@marvell.com> -Reviewed-by: Simon Horman <horms@kernel.org> -Link: https://lore.kernel.org/r/20240108073036.8766-1-naveenm@marvell.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/marvell/octeontx2/af/rpm.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c -index 4728ba34b0e3..76218f1cb459 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c -@@ -506,6 +506,7 @@ u32 rpm2_get_lmac_fifo_len(void *rpmd, int lmac_id) - rpm_t *rpm = rpmd; - u8 num_lmacs; - u32 fifo_len; -+ u16 max_lmac; - - lmac_info = rpm_read(rpm, 0, RPM2_CMRX_RX_LMACS); - /* LMACs are divided into two groups and each group -@@ -513,7 +514,11 @@ u32 rpm2_get_lmac_fifo_len(void *rpmd, int lmac_id) - * Group0 lmac_id range {0..3} - * Group1 lmac_id range {4..7} - */ -- fifo_len = rpm->mac_ops->fifo_len / 2; -+ max_lmac = (rpm_read(rpm, 0, CGX_CONST) >> 24) & 0xFF; -+ if (max_lmac > 4) -+ fifo_len = rpm->mac_ops->fifo_len / 2; -+ else -+ fifo_len = rpm->mac_ops->fifo_len; - - if (lmac_id < 4) { - num_lmacs = hweight8(lmac_info & 0xF); --- -2.43.2 - -From ba176e7d6a3c7b1a28ea2bd94e06d7aeff14647f Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Sanju=C3=A1n=20Garc=C3=ADa=2C=20Jorge?= - <Jorge.SanjuanGarcia@duagon.com> -Date: Fri, 5 Jan 2024 08:55:43 +0000 -Subject: [PATCH 0610/1501] net: ethernet: ti: am65-cpsw: Fix max mtu to fit - ethernet frames -Content-Length: 2234 -Lines: 52 - -[ Upstream commit 64e47d8afb5ca533b27efc006405e5bcae2c4a7b ] - -The value of AM65_CPSW_MAX_PACKET_SIZE represents the maximum length -of a received frame. This value is written to the register -AM65_CPSW_PORT_REG_RX_MAXLEN. - -The maximum MTU configured on the network device should then leave -some room for the ethernet headers and frame check. Otherwise, if -the network interface is configured to its maximum mtu possible, -the frames will be larger than AM65_CPSW_MAX_PACKET_SIZE and will -get dropped as oversized. - -The switch supports ethernet frame sizes between 64 and 2024 bytes -(including VLAN) as stated in the technical reference manual, so -define AM65_CPSW_MAX_PACKET_SIZE with that maximum size. - -Fixes: 93a76530316a ("net: ethernet: ti: introduce am65x/j721e gigabit eth subsystem driver") -Signed-off-by: Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com> -Reviewed-by: Horatiu Vultur <horatiu.vultur@microchip.com> -Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com> -Link: https://lore.kernel.org/r/20240105085530.14070-2-jorge.sanjuangarcia@duagon.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/ti/am65-cpsw-nuss.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c -index ece9f8df98ae..f7a6d720ebb3 100644 ---- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c -+++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c -@@ -56,7 +56,7 @@ - #define AM65_CPSW_MAX_PORTS 8 - - #define AM65_CPSW_MIN_PACKET_SIZE VLAN_ETH_ZLEN --#define AM65_CPSW_MAX_PACKET_SIZE (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN) -+#define AM65_CPSW_MAX_PACKET_SIZE 2024 - - #define AM65_CPSW_REG_CTL 0x004 - #define AM65_CPSW_REG_STAT_PORT_EN 0x014 -@@ -2167,7 +2167,8 @@ am65_cpsw_nuss_init_port_ndev(struct am65_cpsw_common *common, u32 port_idx) - eth_hw_addr_set(port->ndev, port->slave.mac_addr); - - port->ndev->min_mtu = AM65_CPSW_MIN_PACKET_SIZE; -- port->ndev->max_mtu = AM65_CPSW_MAX_PACKET_SIZE; -+ port->ndev->max_mtu = AM65_CPSW_MAX_PACKET_SIZE - -+ (VLAN_ETH_HLEN + ETH_FCS_LEN); - port->ndev->hw_features = NETIF_F_SG | - NETIF_F_RXCSUM | - NETIF_F_HW_CSUM | --- -2.43.2 - -From aec366faed8cb743efe0e233d9586d72e1443e46 Mon Sep 17 00:00:00 2001 -From: Taehee Yoo <ap420073@gmail.com> -Date: Sun, 7 Jan 2024 14:42:41 +0000 -Subject: [PATCH 0611/1501] amt: do not use overwrapped cb area -Content-Length: 1862 -Lines: 52 - -[ Upstream commit bec161add35b478a7746bf58bcdea6faa19129ef ] - -amt driver uses skb->cb for storing tunnel information. -This job is worked before TC layer and then amt driver load tunnel info -from skb->cb after TC layer. -So, its cb area should not be overwrapped with CB area used by TC. -In order to not use cb area used by TC, it skips the biggest cb -structure used by TC, which was qdisc_skb_cb. -But it's not anymore. -Currently, biggest structure of TC's CB is tc_skb_cb. -So, it should skip size of tc_skb_cb instead of qdisc_skb_cb. - -Fixes: ec624fe740b4 ("net/sched: Extend qdisc control block with tc control block") -Signed-off-by: Taehee Yoo <ap420073@gmail.com> -Acked-by: Paolo Abeni <pabeni@redhat.com> -Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com> -Link: https://lore.kernel.org/r/20240107144241.4169520-1-ap420073@gmail.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/amt.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/net/amt.c b/drivers/net/amt.c -index 53415e83821c..68e79b1272f6 100644 ---- a/drivers/net/amt.c -+++ b/drivers/net/amt.c -@@ -11,7 +11,7 @@ - #include <linux/net.h> - #include <linux/igmp.h> - #include <linux/workqueue.h> --#include <net/sch_generic.h> -+#include <net/pkt_sched.h> - #include <net/net_namespace.h> - #include <net/ip.h> - #include <net/udp.h> -@@ -80,11 +80,11 @@ static struct mld2_grec mldv2_zero_grec; - - static struct amt_skb_cb *amt_skb_cb(struct sk_buff *skb) - { -- BUILD_BUG_ON(sizeof(struct amt_skb_cb) + sizeof(struct qdisc_skb_cb) > -+ BUILD_BUG_ON(sizeof(struct amt_skb_cb) + sizeof(struct tc_skb_cb) > - sizeof_field(struct sk_buff, cb)); - - return (struct amt_skb_cb *)((void *)skb->cb + -- sizeof(struct qdisc_skb_cb)); -+ sizeof(struct tc_skb_cb)); - } - - static void __amt_source_gc_work(void) --- -2.43.2 - -From a0dcbde1371408f2d8f016d8ffe1fd844be69ce8 Mon Sep 17 00:00:00 2001 -From: Horatiu Vultur <horatiu.vultur@microchip.com> -Date: Wed, 10 Jan 2024 12:37:30 +0100 -Subject: [PATCH 0613/1501] net: micrel: Fix PTP frame parsing for lan8841 -Content-Length: 2309 -Lines: 52 - -[ Upstream commit acd66c2126eb9b5da2d89ae07dbcd73b909c2111 ] - -The HW has the capability to check each frame if it is a PTP frame, -which domain it is, which ptp frame type it is, different ip address in -the frame. And if one of these checks fail then the frame is not -timestamp. Most of these checks were disabled except checking the field -minorVersionPTP inside the PTP header. Meaning that once a partner sends -a frame compliant to 8021AS which has minorVersionPTP set to 1, then the -frame was not timestamp because the HW expected by default a value of 0 -in minorVersionPTP. -Fix this issue by removing this check so the userspace can decide on this. - -Fixes: cafc3662ee3f ("net: micrel: Add PHC support for lan8841") -Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com> -Reviewed-by: Divya Koppera <divya.koppera@microchip.com> -Reviewed-by: Rahul Rameshbabu <rrameshbabu@nvidia.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/phy/micrel.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c -index 08e3915001c3..73ee81c583ef 100644 ---- a/drivers/net/phy/micrel.c -+++ b/drivers/net/phy/micrel.c -@@ -3335,8 +3335,10 @@ static int lan8814_probe(struct phy_device *phydev) - #define LAN8841_ADC_CHANNEL_MASK 198 - #define LAN8841_PTP_RX_PARSE_L2_ADDR_EN 370 - #define LAN8841_PTP_RX_PARSE_IP_ADDR_EN 371 -+#define LAN8841_PTP_RX_VERSION 374 - #define LAN8841_PTP_TX_PARSE_L2_ADDR_EN 434 - #define LAN8841_PTP_TX_PARSE_IP_ADDR_EN 435 -+#define LAN8841_PTP_TX_VERSION 438 - #define LAN8841_PTP_CMD_CTL 256 - #define LAN8841_PTP_CMD_CTL_PTP_ENABLE BIT(2) - #define LAN8841_PTP_CMD_CTL_PTP_DISABLE BIT(1) -@@ -3380,6 +3382,12 @@ static int lan8841_config_init(struct phy_device *phydev) - phy_write_mmd(phydev, KSZ9131RN_MMD_COMMON_CTRL_REG, - LAN8841_PTP_RX_PARSE_IP_ADDR_EN, 0); - -+ /* Disable checking for minorVersionPTP field */ -+ phy_write_mmd(phydev, KSZ9131RN_MMD_COMMON_CTRL_REG, -+ LAN8841_PTP_RX_VERSION, 0xff00); -+ phy_write_mmd(phydev, KSZ9131RN_MMD_COMMON_CTRL_REG, -+ LAN8841_PTP_TX_VERSION, 0xff00); -+ - /* 100BT Clause 40 improvenent errata */ - phy_write_mmd(phydev, LAN8841_MMD_ANALOG_REG, - LAN8841_ANALOG_CONTROL_1, --- -2.43.2 - -From 91df6604bbe5417af6d0cd4b0de55442e418b654 Mon Sep 17 00:00:00 2001 -From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> -Date: Fri, 5 Jan 2024 10:52:42 +0200 -Subject: [PATCH 0614/1501] net: phy: micrel: populate .soft_reset for KSZ9131 -Content-Length: 3532 -Lines: 92 - -[ Upstream commit e398822c4751017fe401f57409488f5948d12fb5 ] - -The RZ/G3S SMARC Module has 2 KSZ9131 PHYs. In this setup, the KSZ9131 PHY -is used with the ravb Ethernet driver. It has been discovered that when -bringing the Ethernet interface down/up continuously, e.g., with the -following sh script: - -$ while :; do ifconfig eth0 down; ifconfig eth0 up; done - -the link speed and duplex are wrong after interrupting the bring down/up -operation even though the Ethernet interface is up. To recover from this -state the following configuration sequence is necessary (executed -manually): - -$ ifconfig eth0 down -$ ifconfig eth0 up - -The behavior has been identified also on the Microchip SAMA7G5-EK board -which runs the macb driver and uses the same PHY. - -The order of PHY-related operations in ravb_open() is as follows: -ravb_open() -> - ravb_phy_start() -> - ravb_phy_init() -> - of_phy_connect() -> - phy_connect_direct() -> - phy_attach_direct() -> - phy_init_hw() -> - phydev->drv->soft_reset() - phydev->drv->config_init() - phydev->drv->config_intr() - phy_resume() - kszphy_resume() - -The order of PHY-related operations in ravb_close is as follows: -ravb_close() -> - phy_stop() -> - phy_suspend() -> - kszphy_suspend() -> - genphy_suspend() - // set BMCR_PDOWN bit in MII_BMCR - -In genphy_suspend() setting the BMCR_PDWN bit in MII_BMCR switches the PHY -to Software Power-Down (SPD) mode (according to the KSZ9131 datasheet). -Thus, when opening the interface after it has been previously closed (via -ravb_close()), the phydev->drv->config_init() and -phydev->drv->config_intr() reach the KSZ9131 PHY driver via the -ksz9131_config_init() and kszphy_config_intr() functions. - -KSZ9131 specifies that the MII management interface remains operational -during SPD (Software Power-Down), but (according to manual): -- Only access to the standard registers (0 through 31) is supported. -- Access to MMD address spaces other than MMD address space 1 is possible - if the spd_clock_gate_override bit is set. -- Access to MMD address space 1 is not possible. - -The spd_clock_gate_override bit is not used in the KSZ9131 driver. - -ksz9131_config_init() configures RGMII delay, pad skews and LEDs by -accessesing MMD registers other than those in address space 1. - -The datasheet for the KSZ9131 does not specify what happens if registers -from an unsupported address space are accessed while the PHY is in SPD. - -To fix the issue the .soft_reset method has been instantiated for KSZ9131, -too. This resets the PHY to the default state before doing any -configurations to it, thus switching it out of SPD. - -Fixes: bff5b4b37372 ("net: phy: micrel: add Microchip KSZ9131 initial driver") -Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> -Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> -Reviewed-by: Andrew Lunn <andrew@lunn.ch> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/phy/micrel.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c -index 73ee81c583ef..ce5ad4a82481 100644 ---- a/drivers/net/phy/micrel.c -+++ b/drivers/net/phy/micrel.c -@@ -4850,6 +4850,7 @@ static struct phy_driver ksphy_driver[] = { - .flags = PHY_POLL_CABLE_TEST, - .driver_data = &ksz9131_type, - .probe = kszphy_probe, -+ .soft_reset = genphy_soft_reset, - .config_init = ksz9131_config_init, - .config_intr = kszphy_config_intr, - .config_aneg = ksz9131_config_aneg, --- -2.43.2 - -From a1902c92cac31c7e860fbc02ebe7e27b23d63976 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Thu, 11 Jan 2024 19:49:13 +0000 -Subject: [PATCH 0616/1501] mptcp: mptcp_parse_option() fix for - MPTCPOPT_MP_JOIN -Content-Length: 2560 -Lines: 69 - -[ Upstream commit 89e23277f9c16df6f9f9c1a1a07f8f132339c15c ] - -mptcp_parse_option() currently sets OPTIONS_MPTCP_MPJ, for the three -possible cases handled for MPTCPOPT_MP_JOIN option. - -OPTIONS_MPTCP_MPJ is the combination of three flags: -- OPTION_MPTCP_MPJ_SYN -- OPTION_MPTCP_MPJ_SYNACK -- OPTION_MPTCP_MPJ_ACK - -This is a problem, because backup, join_id, token, nonce and/or hmac fields -could be left uninitialized in some cases. - -Distinguish the three cases, as following patches will need this step. - -Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests") -Signed-off-by: Eric Dumazet <edumazet@google.com> -Cc: Florian Westphal <fw@strlen.de> -Cc: Peter Krystad <peter.krystad@linux.intel.com> -Cc: Matthieu Baerts <matttbe@kernel.org> -Cc: Mat Martineau <martineau@kernel.org> -Cc: Geliang Tang <geliang.tang@linux.dev> -Reviewed-by: Simon Horman <horms@kernel.org> -Acked-by: Paolo Abeni <pabeni@redhat.com> -Reviewed-by: Mat Martineau <martineau@kernel.org> -Link: https://lore.kernel.org/r/20240111194917.4044654-2-edumazet@google.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/mptcp/options.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/net/mptcp/options.c b/net/mptcp/options.c -index c53914012d01..d2527d189a79 100644 ---- a/net/mptcp/options.c -+++ b/net/mptcp/options.c -@@ -123,8 +123,8 @@ static void mptcp_parse_option(const struct sk_buff *skb, - break; - - case MPTCPOPT_MP_JOIN: -- mp_opt->suboptions |= OPTIONS_MPTCP_MPJ; - if (opsize == TCPOLEN_MPTCP_MPJ_SYN) { -+ mp_opt->suboptions |= OPTION_MPTCP_MPJ_SYN; - mp_opt->backup = *ptr++ & MPTCPOPT_BACKUP; - mp_opt->join_id = *ptr++; - mp_opt->token = get_unaligned_be32(ptr); -@@ -135,6 +135,7 @@ static void mptcp_parse_option(const struct sk_buff *skb, - mp_opt->backup, mp_opt->join_id, - mp_opt->token, mp_opt->nonce); - } else if (opsize == TCPOLEN_MPTCP_MPJ_SYNACK) { -+ mp_opt->suboptions |= OPTION_MPTCP_MPJ_SYNACK; - mp_opt->backup = *ptr++ & MPTCPOPT_BACKUP; - mp_opt->join_id = *ptr++; - mp_opt->thmac = get_unaligned_be64(ptr); -@@ -145,11 +146,10 @@ static void mptcp_parse_option(const struct sk_buff *skb, - mp_opt->backup, mp_opt->join_id, - mp_opt->thmac, mp_opt->nonce); - } else if (opsize == TCPOLEN_MPTCP_MPJ_ACK) { -+ mp_opt->suboptions |= OPTION_MPTCP_MPJ_ACK; - ptr += 2; - memcpy(mp_opt->hmac, ptr, MPTCPOPT_HMAC_LEN); - pr_debug("MP_JOIN hmac"); -- } else { -- mp_opt->suboptions &= ~OPTIONS_MPTCP_MPJ; - } - break; - --- -2.43.2 - -From aa8ed638efa85808e3911d680295fa5829a7e644 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Thu, 11 Jan 2024 19:49:14 +0000 -Subject: [PATCH 0617/1501] mptcp: strict validation before using mp_opt->hmac -Content-Length: 1533 -Lines: 39 - -[ Upstream commit c1665273bdc7c201766c65e561c06711f2e050dc ] - -mp_opt->hmac contains uninitialized data unless OPTION_MPTCP_MPJ_ACK -was set in mptcp_parse_option(). - -We must refine the condition before we call subflow_hmac_valid(). - -Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests") -Signed-off-by: Eric Dumazet <edumazet@google.com> -Cc: Florian Westphal <fw@strlen.de> -Cc: Peter Krystad <peter.krystad@linux.intel.com> -Cc: Matthieu Baerts <matttbe@kernel.org> -Cc: Mat Martineau <martineau@kernel.org> -Cc: Geliang Tang <geliang.tang@linux.dev> -Reviewed-by: Simon Horman <horms@kernel.org> -Acked-by: Paolo Abeni <pabeni@redhat.com> -Reviewed-by: Mat Martineau <martineau@kernel.org> -Link: https://lore.kernel.org/r/20240111194917.4044654-3-edumazet@google.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/mptcp/subflow.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c -index 852b3f4af000..613bf6f1f3a0 100644 ---- a/net/mptcp/subflow.c -+++ b/net/mptcp/subflow.c -@@ -788,7 +788,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, - - } else if (subflow_req->mp_join) { - mptcp_get_options(skb, &mp_opt); -- if (!(mp_opt.suboptions & OPTIONS_MPTCP_MPJ) || -+ if (!(mp_opt.suboptions & OPTION_MPTCP_MPJ_ACK) || - !subflow_hmac_valid(req, &mp_opt) || - !mptcp_can_accept_new_subflow(subflow_req->msk)) { - SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINACKMAC); --- -2.43.2 - -From 76e8de7273a22a00d27e9b8b7d4d043d6433416a Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Thu, 11 Jan 2024 19:49:15 +0000 -Subject: [PATCH 0618/1501] mptcp: use OPTION_MPTCP_MPJ_SYNACK in - subflow_finish_connect() -Content-Length: 1458 -Lines: 38 - -[ Upstream commit be1d9d9d38da922bd4beeec5b6dd821ff5a1dfeb ] - -subflow_finish_connect() uses four fields (backup, join_id, thmac, none) -that may contain garbage unless OPTION_MPTCP_MPJ_SYNACK has been set -in mptcp_parse_option() - -Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests") -Signed-off-by: Eric Dumazet <edumazet@google.com> -Cc: Florian Westphal <fw@strlen.de> -Cc: Peter Krystad <peter.krystad@linux.intel.com> -Cc: Matthieu Baerts <matttbe@kernel.org> -Cc: Mat Martineau <martineau@kernel.org> -Cc: Geliang Tang <geliang.tang@linux.dev> -Reviewed-by: Simon Horman <horms@kernel.org> -Acked-by: Paolo Abeni <pabeni@redhat.com> -Reviewed-by: Mat Martineau <martineau@kernel.org> -Link: https://lore.kernel.org/r/20240111194917.4044654-4-edumazet@google.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/mptcp/subflow.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c -index 613bf6f1f3a0..d720314debb0 100644 ---- a/net/mptcp/subflow.c -+++ b/net/mptcp/subflow.c -@@ -506,7 +506,7 @@ static void subflow_finish_connect(struct sock *sk, const struct sk_buff *skb) - } else if (subflow->request_join) { - u8 hmac[SHA256_DIGEST_SIZE]; - -- if (!(mp_opt.suboptions & OPTIONS_MPTCP_MPJ)) { -+ if (!(mp_opt.suboptions & OPTION_MPTCP_MPJ_SYNACK)) { - subflow->reset_reason = MPTCP_RST_EMPTCP; - goto do_reset; - } --- -2.43.2 - -From 141cb8981670926fed23f650be4699460f54cb5f Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Thu, 11 Jan 2024 19:49:16 +0000 -Subject: [PATCH 0619/1501] mptcp: use OPTION_MPTCP_MPJ_SYN in - subflow_check_req() -Content-Length: 4227 -Lines: 97 - -[ Upstream commit 66ff70df1a919a066942844bb095d6fcb748d78d ] - -syzbot reported that subflow_check_req() was using uninitialized data in -subflow_check_req() [1] - -This is because mp_opt.token is only set when OPTION_MPTCP_MPJ_SYN is also set. - -While we are are it, fix mptcp_subflow_init_cookie_req() -to test for OPTION_MPTCP_MPJ_ACK. - -[1] - -BUG: KMSAN: uninit-value in subflow_token_join_request net/mptcp/subflow.c:91 [inline] - BUG: KMSAN: uninit-value in subflow_check_req+0x1028/0x15d0 net/mptcp/subflow.c:209 - subflow_token_join_request net/mptcp/subflow.c:91 [inline] - subflow_check_req+0x1028/0x15d0 net/mptcp/subflow.c:209 - subflow_v6_route_req+0x269/0x410 net/mptcp/subflow.c:367 - tcp_conn_request+0x153a/0x4240 net/ipv4/tcp_input.c:7164 - subflow_v6_conn_request+0x3ee/0x510 - tcp_rcv_state_process+0x2e1/0x4ac0 net/ipv4/tcp_input.c:6659 - tcp_v6_do_rcv+0x11bf/0x1fe0 net/ipv6/tcp_ipv6.c:1669 - tcp_v6_rcv+0x480b/0x4fb0 net/ipv6/tcp_ipv6.c:1900 - ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438 - ip6_input_finish net/ipv6/ip6_input.c:483 [inline] - NF_HOOK include/linux/netfilter.h:314 [inline] - ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492 - dst_input include/net/dst.h:461 [inline] - ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79 - NF_HOOK include/linux/netfilter.h:314 [inline] - ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310 - __netif_receive_skb_one_core net/core/dev.c:5532 [inline] - __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5646 - netif_receive_skb_internal net/core/dev.c:5732 [inline] - netif_receive_skb+0x58/0x660 net/core/dev.c:5791 - tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 - tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002 - tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 - call_write_iter include/linux/fs.h:2020 [inline] - new_sync_write fs/read_write.c:491 [inline] - vfs_write+0x8ef/0x1490 fs/read_write.c:584 - ksys_write+0x20f/0x4c0 fs/read_write.c:637 - __do_sys_write fs/read_write.c:649 [inline] - __se_sys_write fs/read_write.c:646 [inline] - __x64_sys_write+0x93/0xd0 fs/read_write.c:646 - do_syscall_x64 arch/x86/entry/common.c:52 [inline] - do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 - entry_SYSCALL_64_after_hwframe+0x63/0x6b - -Local variable mp_opt created at: - subflow_check_req+0x6d/0x15d0 net/mptcp/subflow.c:145 - subflow_v6_route_req+0x269/0x410 net/mptcp/subflow.c:367 - -CPU: 1 PID: 5924 Comm: syz-executor.3 Not tainted 6.7.0-rc8-syzkaller-00055-g5eff55d725a4 #0 -Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 - -Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests") -Reported-by: syzbot <syzkaller@googlegroups.com> -Signed-off-by: Eric Dumazet <edumazet@google.com> -Cc: Florian Westphal <fw@strlen.de> -Cc: Peter Krystad <peter.krystad@linux.intel.com> -Cc: Matthieu Baerts <matttbe@kernel.org> -Cc: Mat Martineau <martineau@kernel.org> -Cc: Geliang Tang <geliang.tang@linux.dev> -Reviewed-by: Simon Horman <horms@kernel.org> -Acked-by: Paolo Abeni <pabeni@redhat.com> -Reviewed-by: Mat Martineau <martineau@kernel.org> -Link: https://lore.kernel.org/r/20240111194917.4044654-5-edumazet@google.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/mptcp/subflow.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c -index d720314debb0..09312d619018 100644 ---- a/net/mptcp/subflow.c -+++ b/net/mptcp/subflow.c -@@ -158,7 +158,7 @@ static int subflow_check_req(struct request_sock *req, - mptcp_get_options(skb, &mp_opt); - - opt_mp_capable = !!(mp_opt.suboptions & OPTIONS_MPTCP_MPC); -- opt_mp_join = !!(mp_opt.suboptions & OPTIONS_MPTCP_MPJ); -+ opt_mp_join = !!(mp_opt.suboptions & OPTION_MPTCP_MPJ_SYN); - if (opt_mp_capable) { - SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MPCAPABLEPASSIVE); - -@@ -255,7 +255,7 @@ int mptcp_subflow_init_cookie_req(struct request_sock *req, - mptcp_get_options(skb, &mp_opt); - - opt_mp_capable = !!(mp_opt.suboptions & OPTIONS_MPTCP_MPC); -- opt_mp_join = !!(mp_opt.suboptions & OPTIONS_MPTCP_MPJ); -+ opt_mp_join = !!(mp_opt.suboptions & OPTION_MPTCP_MPJ_ACK); - if (opt_mp_capable && opt_mp_join) - return -EINVAL; - --- -2.43.2 - -From 3a13eb36bbaabc35968fab94d12c9b836ddca373 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Thu, 11 Jan 2024 19:49:17 +0000 -Subject: [PATCH 0620/1501] mptcp: refine opt_mp_capable determination -Content-Length: 2714 -Lines: 72 - -[ Upstream commit 724b00c12957973656d312dce2a110c75ae2c680 ] - -OPTIONS_MPTCP_MPC is a combination of three flags. - -It would be better to be strict about testing what -flag is expected, at least for code readability. - -mptcp_parse_option() already makes the distinction. - -- subflow_check_req() should use OPTION_MPTCP_MPC_SYN. - -- mptcp_subflow_init_cookie_req() should use OPTION_MPTCP_MPC_ACK. - -- subflow_finish_connect() should use OPTION_MPTCP_MPC_SYNACK - -- subflow_syn_recv_sock should use OPTION_MPTCP_MPC_ACK - -Suggested-by: Paolo Abeni <pabeni@redhat.com> -Signed-off-by: Eric Dumazet <edumazet@google.com> -Reviewed-by: Simon Horman <horms@kernel.org> -Acked-by: Paolo Abeni <pabeni@redhat.com> -Reviewed-by: Mat Martineau <martineau@kernel.org> -Fixes: 74c7dfbee3e1 ("mptcp: consolidate in_opt sub-options fields in a bitmask") -Link: https://lore.kernel.org/r/20240111194917.4044654-6-edumazet@google.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/mptcp/subflow.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c -index 09312d619018..91c1cda4228f 100644 ---- a/net/mptcp/subflow.c -+++ b/net/mptcp/subflow.c -@@ -157,7 +157,7 @@ static int subflow_check_req(struct request_sock *req, - - mptcp_get_options(skb, &mp_opt); - -- opt_mp_capable = !!(mp_opt.suboptions & OPTIONS_MPTCP_MPC); -+ opt_mp_capable = !!(mp_opt.suboptions & OPTION_MPTCP_MPC_SYN); - opt_mp_join = !!(mp_opt.suboptions & OPTION_MPTCP_MPJ_SYN); - if (opt_mp_capable) { - SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MPCAPABLEPASSIVE); -@@ -254,7 +254,7 @@ int mptcp_subflow_init_cookie_req(struct request_sock *req, - subflow_init_req(req, sk_listener); - mptcp_get_options(skb, &mp_opt); - -- opt_mp_capable = !!(mp_opt.suboptions & OPTIONS_MPTCP_MPC); -+ opt_mp_capable = !!(mp_opt.suboptions & OPTION_MPTCP_MPC_ACK); - opt_mp_join = !!(mp_opt.suboptions & OPTION_MPTCP_MPJ_ACK); - if (opt_mp_capable && opt_mp_join) - return -EINVAL; -@@ -486,7 +486,7 @@ static void subflow_finish_connect(struct sock *sk, const struct sk_buff *skb) - - mptcp_get_options(skb, &mp_opt); - if (subflow->request_mptcp) { -- if (!(mp_opt.suboptions & OPTIONS_MPTCP_MPC)) { -+ if (!(mp_opt.suboptions & OPTION_MPTCP_MPC_SYNACK)) { - MPTCP_INC_STATS(sock_net(sk), - MPTCP_MIB_MPCAPABLEACTIVEFALLBACK); - mptcp_do_fallback(sk); -@@ -783,7 +783,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, - * options. - */ - mptcp_get_options(skb, &mp_opt); -- if (!(mp_opt.suboptions & OPTIONS_MPTCP_MPC)) -+ if (!(mp_opt.suboptions & OPTION_MPTCP_MPC_ACK)) - fallback = true; - - } else if (subflow_req->mp_join) { --- -2.43.2 - -From 85fedfd9916c677bc1179468406dbb3581ee3a95 Mon Sep 17 00:00:00 2001 -From: Jens Axboe <axboe@kernel.dk> -Date: Fri, 12 Jan 2024 09:12:20 -0700 -Subject: [PATCH 0621/1501] block: ensure we hold a queue reference when using - queue limits -Content-Length: 1942 -Lines: 63 - -[ Upstream commit 7b4f36cd22a65b750b4cb6ac14804fb7d6e6c67d ] - -q_usage_counter is the only thing preventing us from the limits changing -under us in __bio_split_to_limits, but blk_mq_submit_bio doesn't hold -it while calling into it. - -Move the splitting inside the region where we know we've got a queue -reference. Ideally this could still remain a shared section of code, but -let's keep the fix simple and defer any refactoring here to later. - -Reported-by: Christoph Hellwig <hch@lst.de> -Fixes: 900e08075202 ("block: move queue enter logic into blk_mq_submit_bio()") -Reviewed-by: Christoph Hellwig <hch@lst.de> -Reviewed-by: Ming Lei <ming.lei@redhat.com> -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - block/blk-mq.c | 16 ++++++++++------ - 1 file changed, 10 insertions(+), 6 deletions(-) - -diff --git a/block/blk-mq.c b/block/blk-mq.c -index ac18f802c027..7e743ac58c31 100644 ---- a/block/blk-mq.c -+++ b/block/blk-mq.c -@@ -2951,12 +2951,6 @@ void blk_mq_submit_bio(struct bio *bio) - blk_status_t ret; - - bio = blk_queue_bounce(bio, q); -- if (bio_may_exceed_limits(bio, &q->limits)) { -- bio = __bio_split_to_limits(bio, &q->limits, &nr_segs); -- if (!bio) -- return; -- } -- - bio_set_ioprio(bio); - - if (plug) { -@@ -2965,6 +2959,11 @@ void blk_mq_submit_bio(struct bio *bio) - rq = NULL; - } - if (rq) { -+ if (unlikely(bio_may_exceed_limits(bio, &q->limits))) { -+ bio = __bio_split_to_limits(bio, &q->limits, &nr_segs); -+ if (!bio) -+ return; -+ } - if (!bio_integrity_prep(bio)) - return; - if (blk_mq_attempt_bio_merge(q, bio, nr_segs)) -@@ -2975,6 +2974,11 @@ void blk_mq_submit_bio(struct bio *bio) - } else { - if (unlikely(bio_queue_enter(bio))) - return; -+ if (unlikely(bio_may_exceed_limits(bio, &q->limits))) { -+ bio = __bio_split_to_limits(bio, &q->limits, &nr_segs); -+ if (!bio) -+ goto fail; -+ } - if (!bio_integrity_prep(bio)) - goto fail; - } --- -2.43.2 - -From 204f2d03020601028080473181fc0176c44ab73b Mon Sep 17 00:00:00 2001 -From: Sneh Shah <quic_snehshah@quicinc.com> -Date: Tue, 9 Jan 2024 20:17:29 +0530 -Subject: [PATCH 0622/1501] net: stmmac: Fix ethool link settings ops for - integrated PCS -Content-Length: 1910 -Lines: 46 - -[ Upstream commit 08300adac3b8dab9e2fd3be0155c7d3093c755f4 ] - -Currently get/set_link_ksettings ethtool ops are dependent on PCS. -When PCS is integrated, it will not have separate link config. -Bypass configuring and checking PCS for integrated PCS. - -Fixes: aa571b6275fb ("net: stmmac: add new switch to struct plat_stmmacenet_data") -Tested-by: Andrew Halaney <ahalaney@redhat.com> # sa8775p-ride -Signed-off-by: Sneh Shah <quic_snehshah@quicinc.com> -Reviewed-by: Simon Horman <horms@kernel.org> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 10 ++++++---- - 1 file changed, 6 insertions(+), 4 deletions(-) - -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -index 112a36a698f1..bfd146ad6937 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -@@ -311,8 +311,9 @@ static int stmmac_ethtool_get_link_ksettings(struct net_device *dev, - { - struct stmmac_priv *priv = netdev_priv(dev); - -- if (priv->hw->pcs & STMMAC_PCS_RGMII || -- priv->hw->pcs & STMMAC_PCS_SGMII) { -+ if (!(priv->plat->flags & STMMAC_FLAG_HAS_INTEGRATED_PCS) && -+ (priv->hw->pcs & STMMAC_PCS_RGMII || -+ priv->hw->pcs & STMMAC_PCS_SGMII)) { - struct rgmii_adv adv; - u32 supported, advertising, lp_advertising; - -@@ -397,8 +398,9 @@ stmmac_ethtool_set_link_ksettings(struct net_device *dev, - { - struct stmmac_priv *priv = netdev_priv(dev); - -- if (priv->hw->pcs & STMMAC_PCS_RGMII || -- priv->hw->pcs & STMMAC_PCS_SGMII) { -+ if (!(priv->plat->flags & STMMAC_FLAG_HAS_INTEGRATED_PCS) && -+ (priv->hw->pcs & STMMAC_PCS_RGMII || -+ priv->hw->pcs & STMMAC_PCS_SGMII)) { - /* Only support ANE */ - if (cmd->base.autoneg != AUTONEG_ENABLE) - return -EINVAL; --- -2.43.2 - -From ac1815b6162d89a7d00598022e37ec241c0cb95f Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Fri, 12 Jan 2024 10:44:27 +0000 -Subject: [PATCH 0623/1501] udp: annotate data-races around up->pending -Content-Length: 6047 -Lines: 186 - -[ Upstream commit 482521d8e0c6520429478aa6866cd44128b33d5d ] - -up->pending can be read without holding the socket lock, -as pointed out by syzbot [1] - -Add READ_ONCE() in lockless contexts, and WRITE_ONCE() -on write side. - -[1] -BUG: KCSAN: data-race in udpv6_sendmsg / udpv6_sendmsg - -write to 0xffff88814e5eadf0 of 4 bytes by task 15547 on cpu 1: - udpv6_sendmsg+0x1405/0x1530 net/ipv6/udp.c:1596 - inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:657 - sock_sendmsg_nosec net/socket.c:730 [inline] - __sock_sendmsg net/socket.c:745 [inline] - __sys_sendto+0x257/0x310 net/socket.c:2192 - __do_sys_sendto net/socket.c:2204 [inline] - __se_sys_sendto net/socket.c:2200 [inline] - __x64_sys_sendto+0x78/0x90 net/socket.c:2200 - do_syscall_x64 arch/x86/entry/common.c:52 [inline] - do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 - entry_SYSCALL_64_after_hwframe+0x63/0x6b - -read to 0xffff88814e5eadf0 of 4 bytes by task 15551 on cpu 0: - udpv6_sendmsg+0x22c/0x1530 net/ipv6/udp.c:1373 - inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:657 - sock_sendmsg_nosec net/socket.c:730 [inline] - __sock_sendmsg net/socket.c:745 [inline] - ____sys_sendmsg+0x37c/0x4d0 net/socket.c:2586 - ___sys_sendmsg net/socket.c:2640 [inline] - __sys_sendmmsg+0x269/0x500 net/socket.c:2726 - __do_sys_sendmmsg net/socket.c:2755 [inline] - __se_sys_sendmmsg net/socket.c:2752 [inline] - __x64_sys_sendmmsg+0x57/0x60 net/socket.c:2752 - do_syscall_x64 arch/x86/entry/common.c:52 [inline] - do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 - entry_SYSCALL_64_after_hwframe+0x63/0x6b - -value changed: 0x00000000 -> 0x0000000a - -Reported by Kernel Concurrency Sanitizer on: -CPU: 0 PID: 15551 Comm: syz-executor.1 Tainted: G W 6.7.0-syzkaller #0 -Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 - -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Reported-by: syzbot+8d482d0e407f665d9d10@syzkaller.appspotmail.com -Link: https://lore.kernel.org/netdev/0000000000009e46c3060ebcdffd@google.com/ -Signed-off-by: Eric Dumazet <edumazet@google.com> -Reviewed-by: Jiri Pirko <jiri@nvidia.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/ipv4/udp.c | 12 ++++++------ - net/ipv6/udp.c | 16 ++++++++-------- - 2 files changed, 14 insertions(+), 14 deletions(-) - -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index 89e5a806b82e..5f742d0b9e07 100644 ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -805,7 +805,7 @@ void udp_flush_pending_frames(struct sock *sk) - - if (up->pending) { - up->len = 0; -- up->pending = 0; -+ WRITE_ONCE(up->pending, 0); - ip_flush_pending_frames(sk); - } - } -@@ -993,7 +993,7 @@ int udp_push_pending_frames(struct sock *sk) - - out: - up->len = 0; -- up->pending = 0; -+ WRITE_ONCE(up->pending, 0); - return err; - } - EXPORT_SYMBOL(udp_push_pending_frames); -@@ -1070,7 +1070,7 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) - getfrag = is_udplite ? udplite_getfrag : ip_generic_getfrag; - - fl4 = &inet->cork.fl.u.ip4; -- if (up->pending) { -+ if (READ_ONCE(up->pending)) { - /* - * There are pending frames. - * The socket lock must be held while it's corked. -@@ -1269,7 +1269,7 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) - fl4->saddr = saddr; - fl4->fl4_dport = dport; - fl4->fl4_sport = inet->inet_sport; -- up->pending = AF_INET; -+ WRITE_ONCE(up->pending, AF_INET); - - do_append_data: - up->len += ulen; -@@ -1281,7 +1281,7 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) - else if (!corkreq) - err = udp_push_pending_frames(sk); - else if (unlikely(skb_queue_empty(&sk->sk_write_queue))) -- up->pending = 0; -+ WRITE_ONCE(up->pending, 0); - release_sock(sk); - - out: -@@ -1319,7 +1319,7 @@ void udp_splice_eof(struct socket *sock) - struct sock *sk = sock->sk; - struct udp_sock *up = udp_sk(sk); - -- if (!up->pending || udp_test_bit(CORK, sk)) -+ if (!READ_ONCE(up->pending) || udp_test_bit(CORK, sk)) - return; - - lock_sock(sk); -diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index 622b10a549f7..a1a79ff46fd9 100644 ---- a/net/ipv6/udp.c -+++ b/net/ipv6/udp.c -@@ -1135,7 +1135,7 @@ static void udp_v6_flush_pending_frames(struct sock *sk) - udp_flush_pending_frames(sk); - else if (up->pending) { - up->len = 0; -- up->pending = 0; -+ WRITE_ONCE(up->pending, 0); - ip6_flush_pending_frames(sk); - } - } -@@ -1313,7 +1313,7 @@ static int udp_v6_push_pending_frames(struct sock *sk) - &inet_sk(sk)->cork.base); - out: - up->len = 0; -- up->pending = 0; -+ WRITE_ONCE(up->pending, 0); - return err; - } - -@@ -1370,7 +1370,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) - default: - return -EINVAL; - } -- } else if (!up->pending) { -+ } else if (!READ_ONCE(up->pending)) { - if (sk->sk_state != TCP_ESTABLISHED) - return -EDESTADDRREQ; - daddr = &sk->sk_v6_daddr; -@@ -1401,8 +1401,8 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) - return -EMSGSIZE; - - getfrag = is_udplite ? udplite_getfrag : ip_generic_getfrag; -- if (up->pending) { -- if (up->pending == AF_INET) -+ if (READ_ONCE(up->pending)) { -+ if (READ_ONCE(up->pending) == AF_INET) - return udp_sendmsg(sk, msg, len); - /* - * There are pending frames. -@@ -1593,7 +1593,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) - goto out; - } - -- up->pending = AF_INET6; -+ WRITE_ONCE(up->pending, AF_INET6); - - do_append_data: - if (ipc6.dontfrag < 0) -@@ -1607,7 +1607,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) - else if (!corkreq) - err = udp_v6_push_pending_frames(sk); - else if (unlikely(skb_queue_empty(&sk->sk_write_queue))) -- up->pending = 0; -+ WRITE_ONCE(up->pending, 0); - - if (err > 0) - err = inet6_test_bit(RECVERR6, sk) ? net_xmit_errno(err) : 0; -@@ -1648,7 +1648,7 @@ static void udpv6_splice_eof(struct socket *sock) - struct sock *sk = sock->sk; - struct udp_sock *up = udp_sk(sk); - -- if (!up->pending || udp_test_bit(CORK, sk)) -+ if (!READ_ONCE(up->pending) || udp_test_bit(CORK, sk)) - return; - - lock_sock(sk); --- -2.43.2 - -From eed24b816e50c6cd18cbee0ff0d7218c8fced199 Mon Sep 17 00:00:00 2001 -From: Gao Xiang <hsiangkao@linux.alibaba.com> -Date: Sat, 13 Jan 2024 23:06:02 +0800 -Subject: [PATCH 0624/1501] erofs: fix inconsistent per-file compression format -Content-Length: 3265 -Lines: 86 - -[ Upstream commit 118a8cf504d7dfa519562d000f423ee3ca75d2c4 ] - -EROFS can select compression algorithms on a per-file basis, and each -per-file compression algorithm needs to be marked in the on-disk -superblock for initialization. - -However, syzkaller can generate inconsistent crafted images that use -an unsupported algorithmtype for specific inodes, e.g. use MicroLZMA -algorithmtype even it's not set in `sbi->available_compr_algs`. This -can lead to an unexpected "BUG: kernel NULL pointer dereference" if -the corresponding decompressor isn't built-in. - -Fix this by checking against `sbi->available_compr_algs` for each -m_algorithmformat request. Incorrect !erofs_sb_has_compr_cfgs preset -bitmap is now fixed together since it was harmless previously. - -Reported-by: <bugreport@ubisectech.com> -Fixes: 8f89926290c4 ("erofs: get compression algorithms directly on mapping") -Fixes: 622ceaddb764 ("erofs: lzma compression support") -Reviewed-by: Yue Hu <huyue2@coolpad.com> -Link: https://lore.kernel.org/r/20240113150602.1471050-1-hsiangkao@linux.alibaba.com -Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/erofs/decompressor.c | 2 +- - fs/erofs/zmap.c | 23 +++++++++++++---------- - 2 files changed, 14 insertions(+), 11 deletions(-) - -diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c -index 021be5feb1bc..af98e88908ee 100644 ---- a/fs/erofs/decompressor.c -+++ b/fs/erofs/decompressor.c -@@ -398,7 +398,7 @@ int z_erofs_parse_cfgs(struct super_block *sb, struct erofs_super_block *dsb) - int size, ret = 0; - - if (!erofs_sb_has_compr_cfgs(sbi)) { -- sbi->available_compr_algs = Z_EROFS_COMPRESSION_LZ4; -+ sbi->available_compr_algs = 1 << Z_EROFS_COMPRESSION_LZ4; - return z_erofs_load_lz4_config(sb, dsb, NULL, 0); - } - -diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c -index 7b55111fd533..7a1a24ae4a2d 100644 ---- a/fs/erofs/zmap.c -+++ b/fs/erofs/zmap.c -@@ -458,7 +458,7 @@ static int z_erofs_do_map_blocks(struct inode *inode, - .map = map, - }; - int err = 0; -- unsigned int lclusterbits, endoff; -+ unsigned int lclusterbits, endoff, afmt; - unsigned long initial_lcn; - unsigned long long ofs, end; - -@@ -547,17 +547,20 @@ static int z_erofs_do_map_blocks(struct inode *inode, - err = -EFSCORRUPTED; - goto unmap_out; - } -- if (vi->z_advise & Z_EROFS_ADVISE_INTERLACED_PCLUSTER) -- map->m_algorithmformat = -- Z_EROFS_COMPRESSION_INTERLACED; -- else -- map->m_algorithmformat = -- Z_EROFS_COMPRESSION_SHIFTED; -- } else if (m.headtype == Z_EROFS_LCLUSTER_TYPE_HEAD2) { -- map->m_algorithmformat = vi->z_algorithmtype[1]; -+ afmt = vi->z_advise & Z_EROFS_ADVISE_INTERLACED_PCLUSTER ? -+ Z_EROFS_COMPRESSION_INTERLACED : -+ Z_EROFS_COMPRESSION_SHIFTED; - } else { -- map->m_algorithmformat = vi->z_algorithmtype[0]; -+ afmt = m.headtype == Z_EROFS_LCLUSTER_TYPE_HEAD2 ? -+ vi->z_algorithmtype[1] : vi->z_algorithmtype[0]; -+ if (!(EROFS_I_SB(inode)->available_compr_algs & (1 << afmt))) { -+ erofs_err(inode->i_sb, "inconsistent algorithmtype %u for nid %llu", -+ afmt, vi->nid); -+ err = -EFSCORRUPTED; -+ goto unmap_out; -+ } - } -+ map->m_algorithmformat = afmt; - - if ((flags & EROFS_GET_BLOCKS_FIEMAP) || - ((flags & EROFS_GET_BLOCKS_READMORE) && --- -2.43.2 - -From 765290b628c2fb764bdfaf8088754439665751e8 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Fri, 12 Jan 2024 12:28:16 +0000 -Subject: [PATCH 0625/1501] net: add more sanity check in - virtio_net_hdr_to_skb() -Content-Length: 5146 -Lines: 128 - -[ Upstream commit 9181d6f8a2bb32d158de66a84164fac05e3ddd18 ] - -syzbot/KMSAN reports access to uninitialized data from gso_features_check() [1] - -The repro use af_packet, injecting a gso packet and hdrlen == 0. - -We could fix the issue making gso_features_check() more careful -while dealing with NETIF_F_TSO_MANGLEID in fast path. - -Or we can make sure virtio_net_hdr_to_skb() pulls minimal network and -transport headers as intended. - -Note that for GSO packets coming from untrusted sources, SKB_GSO_DODGY -bit forces a proper header validation (and pull) before the packet can -hit any device ndo_start_xmit(), thus we do not need a precise disection -at virtio_net_hdr_to_skb() stage. - -[1] -BUG: KMSAN: uninit-value in skb_gso_segment include/net/gso.h:83 [inline] -BUG: KMSAN: uninit-value in validate_xmit_skb+0x10f2/0x1930 net/core/dev.c:3629 - skb_gso_segment include/net/gso.h:83 [inline] - validate_xmit_skb+0x10f2/0x1930 net/core/dev.c:3629 - __dev_queue_xmit+0x1eac/0x5130 net/core/dev.c:4341 - dev_queue_xmit include/linux/netdevice.h:3134 [inline] - packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 - packet_snd net/packet/af_packet.c:3087 [inline] - packet_sendmsg+0x8b1d/0x9f30 net/packet/af_packet.c:3119 - sock_sendmsg_nosec net/socket.c:730 [inline] - __sock_sendmsg net/socket.c:745 [inline] - ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 - ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 - __sys_sendmsg net/socket.c:2667 [inline] - __do_sys_sendmsg net/socket.c:2676 [inline] - __se_sys_sendmsg net/socket.c:2674 [inline] - __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 - do_syscall_x64 arch/x86/entry/common.c:52 [inline] - do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 - entry_SYSCALL_64_after_hwframe+0x63/0x6b - -Uninit was created at: - slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 - slab_alloc_node mm/slub.c:3478 [inline] - kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523 - kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560 - __alloc_skb+0x318/0x740 net/core/skbuff.c:651 - alloc_skb include/linux/skbuff.h:1286 [inline] - alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334 - sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2780 - packet_alloc_skb net/packet/af_packet.c:2936 [inline] - packet_snd net/packet/af_packet.c:3030 [inline] - packet_sendmsg+0x70e8/0x9f30 net/packet/af_packet.c:3119 - sock_sendmsg_nosec net/socket.c:730 [inline] - __sock_sendmsg net/socket.c:745 [inline] - ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 - ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 - __sys_sendmsg net/socket.c:2667 [inline] - __do_sys_sendmsg net/socket.c:2676 [inline] - __se_sys_sendmsg net/socket.c:2674 [inline] - __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 - do_syscall_x64 arch/x86/entry/common.c:52 [inline] - do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 - entry_SYSCALL_64_after_hwframe+0x63/0x6b - -CPU: 0 PID: 5025 Comm: syz-executor279 Not tainted 6.7.0-rc7-syzkaller-00003-gfbafc3e621c3 #0 -Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 - -Reported-by: syzbot+7f4d0ea3df4d4fa9a65f@syzkaller.appspotmail.com -Link: https://lore.kernel.org/netdev/0000000000005abd7b060eb160cd@google.com/ -Fixes: 9274124f023b ("net: stricter validation of untrusted gso packets") -Signed-off-by: Eric Dumazet <edumazet@google.com> -Cc: Willem de Bruijn <willemb@google.com> -Reviewed-by: Willem de Bruijn <willemb@google.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/linux/virtio_net.h | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - -diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h -index 27cc1d464321..4dfa9b69ca8d 100644 ---- a/include/linux/virtio_net.h -+++ b/include/linux/virtio_net.h -@@ -3,6 +3,8 @@ - #define _LINUX_VIRTIO_NET_H - - #include <linux/if_vlan.h> -+#include <linux/ip.h> -+#include <linux/ipv6.h> - #include <linux/udp.h> - #include <uapi/linux/tcp.h> - #include <uapi/linux/virtio_net.h> -@@ -49,6 +51,7 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, - const struct virtio_net_hdr *hdr, - bool little_endian) - { -+ unsigned int nh_min_len = sizeof(struct iphdr); - unsigned int gso_type = 0; - unsigned int thlen = 0; - unsigned int p_off = 0; -@@ -65,6 +68,7 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, - gso_type = SKB_GSO_TCPV6; - ip_proto = IPPROTO_TCP; - thlen = sizeof(struct tcphdr); -+ nh_min_len = sizeof(struct ipv6hdr); - break; - case VIRTIO_NET_HDR_GSO_UDP: - gso_type = SKB_GSO_UDP; -@@ -100,7 +104,8 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, - if (!skb_partial_csum_set(skb, start, off)) - return -EINVAL; - -- p_off = skb_transport_offset(skb) + thlen; -+ nh_min_len = max_t(u32, nh_min_len, skb_transport_offset(skb)); -+ p_off = nh_min_len + thlen; - if (!pskb_may_pull(skb, p_off)) - return -EINVAL; - } else { -@@ -140,7 +145,7 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, - - skb_set_transport_header(skb, keys.control.thoff); - } else if (gso_type) { -- p_off = thlen; -+ p_off = nh_min_len + thlen; - if (!pskb_may_pull(skb, p_off)) - return -EINVAL; - } --- -2.43.2 - -From d36f0df8fbabbd562ab0f1c97dc95785735dc8ee Mon Sep 17 00:00:00 2001 -From: Marc Kleine-Budde <mkl@pengutronix.de> -Date: Fri, 12 Jan 2024 17:13:14 +0100 -Subject: [PATCH 0626/1501] net: netdev_queue: netdev_txq_completed_mb(): fix - wake condition -Content-Length: 1141 -Lines: 31 - -[ Upstream commit 894d7508316e7ad722df597d68b4b1797a9eee11 ] - -netif_txq_try_stop() uses "get_desc >= start_thrs" as the check for -the call to netif_tx_start_queue(). - -Use ">=" i netdev_txq_completed_mb(), too. - -Fixes: c91c46de6bbc ("net: provide macros for commonly copied lockless queue stop/wake code") -Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> -Acked-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/net/netdev_queues.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/include/net/netdev_queues.h b/include/net/netdev_queues.h -index d68b0a483431..8b8ed4e13d74 100644 ---- a/include/net/netdev_queues.h -+++ b/include/net/netdev_queues.h -@@ -128,7 +128,7 @@ netdev_txq_completed_mb(struct netdev_queue *dev_queue, - netdev_txq_completed_mb(txq, pkts, bytes); \ - \ - _res = -1; \ -- if (pkts && likely(get_desc > start_thrs)) { \ -+ if (pkts && likely(get_desc >= start_thrs)) { \ - _res = 1; \ - if (unlikely(netif_tx_queue_stopped(txq)) && \ - !(down_cond)) { \ --- -2.43.2 - -From 588d38744d3f3be362cd73790713b2113df2138c Mon Sep 17 00:00:00 2001 -From: Martin KaFai Lau <martin.lau@kernel.org> -Date: Fri, 12 Jan 2024 11:05:28 -0800 -Subject: [PATCH 0627/1501] bpf: iter_udp: Retry with a larger batch size - without going back to the previous bucket -Content-Length: 1446 -Lines: 40 - -[ Upstream commit 19ca0823f6eaad01d18f664a00550abe912c034c ] - -The current logic is to use a default size 16 to batch the whole bucket. -If it is too small, it will retry with a larger batch size. - -The current code accidentally does a state->bucket-- before retrying. -This goes back to retry with the previous bucket which has already -been done. This patch fixed it. - -It is hard to create a selftest. I added a WARN_ON(state->bucket < 0), -forced a particular port to be hashed to the first bucket, -created >16 sockets, and observed the for-loop went back -to the "-1" bucket. - -Cc: Aditi Ghag <aditi.ghag@isovalent.com> -Fixes: c96dac8d369f ("bpf: udp: Implement batching for sockets iterator") -Acked-by: Yonghong Song <yonghong.song@linux.dev> -Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org> -Reviewed-by: Aditi Ghag <aditi.ghag@isovalent.com> -Link: https://lore.kernel.org/r/20240112190530.3751661-2-martin.lau@linux.dev -Signed-off-by: Alexei Starovoitov <ast@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/ipv4/udp.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index 5f742d0b9e07..79050d83e736 100644 ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -3213,7 +3213,6 @@ static struct sock *bpf_iter_udp_batch(struct seq_file *seq) - /* After allocating a larger batch, retry one more time to grab - * the whole bucket. - */ -- state->bucket--; - goto again; - } - done: --- -2.43.2 - -From 294e7ea85f34748f04e5f3f9dba6f6b911d31aa8 Mon Sep 17 00:00:00 2001 -From: John Fastabend <john.fastabend@gmail.com> -Date: Fri, 12 Jan 2024 16:32:57 -0800 -Subject: [PATCH 0629/1501] net: tls, fix WARNIING in __sk_msg_free -Content-Length: 2130 -Lines: 54 - -[ Upstream commit dc9dfc8dc629e42f2234e3327b75324ffc752bc9 ] - -A splice with MSG_SPLICE_PAGES will cause tls code to use the -tls_sw_sendmsg_splice path in the TLS sendmsg code to move the user -provided pages from the msg into the msg_pl. This will loop over the -msg until msg_pl is full, checked by sk_msg_full(msg_pl). The user -can also set the MORE flag to hint stack to delay sending until receiving -more pages and ideally a full buffer. - -If the user adds more pages to the msg than can fit in the msg_pl -scatterlist (MAX_MSG_FRAGS) we should ignore the MORE flag and send -the buffer anyways. - -What actually happens though is we abort the msg to msg_pl scatterlist -setup and then because we forget to set 'full record' indicating we -can no longer consume data without a send we fallthrough to the 'continue' -path which will check if msg_data_left(msg) has more bytes to send and -then attempts to fit them in the already full msg_pl. Then next -iteration of sender doing send will encounter a full msg_pl and throw -the warning in the syzbot report. - -To fix simply check if we have a full_record in splice code path and -if not send the msg regardless of MORE flag. - -Reported-and-tested-by: syzbot+f2977222e0e95cec15c8@syzkaller.appspotmail.com -Reported-by: Edward Adam Davis <eadavis@qq.com> -Fixes: fe1e81d4f73b ("tls/sw: Support MSG_SPLICE_PAGES") -Reviewed-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: John Fastabend <john.fastabend@gmail.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/tls/tls_sw.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c -index e37b4d2e2acd..31e8a94dfc11 100644 ---- a/net/tls/tls_sw.c -+++ b/net/tls/tls_sw.c -@@ -1052,7 +1052,11 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, - if (ret < 0) - goto send_end; - tls_ctx->pending_open_record_frags = true; -- if (full_record || eor || sk_msg_full(msg_pl)) -+ -+ if (sk_msg_full(msg_pl)) -+ full_record = true; -+ -+ if (full_record || eor) - goto copied; - continue; - } --- -2.43.2 - -From 129d5832debef10b33e423d3ddb137564d36088e Mon Sep 17 00:00:00 2001 -From: Nikita Yushchenko <nikita.yoush@cogentembedded.com> -Date: Sat, 13 Jan 2024 10:22:21 +0600 -Subject: [PATCH 0630/1501] net: ravb: Fix dma_addr_t truncation in error case -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1684 -Lines: 42 - -[ Upstream commit e327b2372bc0f18c30433ac40be07741b59231c5 ] - -In ravb_start_xmit(), ravb driver uses u32 variable to store result of -dma_map_single() call. Since ravb hardware has 32-bit address fields in -descriptors, this works properly when mapping is successful - it is -platform's job to provide mapping addresses that fit into hardware -limitations. - -However, in failure case dma_map_single() returns DMA_MAPPING_ERROR -constant that is 64-bit when dma_addr_t is 64-bit. Storing this constant -in u32 leads to truncation, and further call to dma_mapping_error() -fails to notice the error. - -Fix that by storing result of dma_map_single() in a dma_addr_t -variable. - -Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") -Signed-off-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com> -Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> -Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru> -Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/renesas/ravb_main.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c -index 8649b3e90edb..0e3731f50fc2 100644 ---- a/drivers/net/ethernet/renesas/ravb_main.c -+++ b/drivers/net/ethernet/renesas/ravb_main.c -@@ -1949,7 +1949,7 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev) - struct ravb_tstamp_skb *ts_skb; - struct ravb_tx_desc *desc; - unsigned long flags; -- u32 dma_addr; -+ dma_addr_t dma_addr; - void *buffer; - u32 entry; - u32 len; --- -2.43.2 - -From 7a1fff06e247c5141fe4cc9bdc171d368dc224d3 Mon Sep 17 00:00:00 2001 -From: Michal Simek <michal.simek@amd.com> -Date: Fri, 12 Jan 2024 12:32:58 +0100 -Subject: [PATCH 0631/1501] dt-bindings: gpio: xilinx: Fix node address in gpio -Content-Length: 1167 -Lines: 28 - -[ Upstream commit 314c020c4ed3de72b15603eb6892250bc4b51702 ] - -Node address doesn't match reg property which is not correct. - -Fixes: ba96b2e7974b ("dt-bindings: gpio: gpio-xilinx: Convert Xilinx axi gpio binding to YAML") -Signed-off-by: Michal Simek <michal.simek@amd.com> -Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> -Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - Documentation/devicetree/bindings/gpio/xlnx,gpio-xilinx.yaml | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Documentation/devicetree/bindings/gpio/xlnx,gpio-xilinx.yaml b/Documentation/devicetree/bindings/gpio/xlnx,gpio-xilinx.yaml -index c1060e5fcef3..d3d8a2e143ed 100644 ---- a/Documentation/devicetree/bindings/gpio/xlnx,gpio-xilinx.yaml -+++ b/Documentation/devicetree/bindings/gpio/xlnx,gpio-xilinx.yaml -@@ -126,7 +126,7 @@ examples: - - | - #include <dt-bindings/interrupt-controller/arm-gic.h> - -- gpio@e000a000 { -+ gpio@a0020000 { - compatible = "xlnx,xps-gpio-1.00.a"; - reg = <0xa0020000 0x10000>; - #gpio-cells = <2>; --- -2.43.2 - -From 63bf2258210f9d7f87d983d842738702972acfa9 Mon Sep 17 00:00:00 2001 -From: Su Hui <suhui@nfschina.com> -Date: Fri, 12 Jan 2024 12:24:04 +0800 -Subject: [PATCH 0632/1501] gpio: mlxbf3: add an error code check in - mlxbf3_gpio_probe -Content-Length: 1123 -Lines: 30 - -[ Upstream commit d460e9c2075164e9b1fa9c4c95f8c05517bd8752 ] - -Clang static checker warning: Value stored to 'ret' is never read. -bgpio_init() returns error code if failed, it's better to add this -check. - -Fixes: cd33f216d241 ("gpio: mlxbf3: Add gpio driver support") -Signed-off-by: Su Hui <suhui@nfschina.com> -[Bartosz: add the Fixes: tag] -Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpio/gpio-mlxbf3.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/gpio/gpio-mlxbf3.c b/drivers/gpio/gpio-mlxbf3.c -index 7a3e1760fc5b..d5906d419b0a 100644 ---- a/drivers/gpio/gpio-mlxbf3.c -+++ b/drivers/gpio/gpio-mlxbf3.c -@@ -215,6 +215,8 @@ static int mlxbf3_gpio_probe(struct platform_device *pdev) - gs->gpio_clr_io + MLXBF_GPIO_FW_DATA_OUT_CLEAR, - gs->gpio_set_io + MLXBF_GPIO_FW_OUTPUT_ENABLE_SET, - gs->gpio_clr_io + MLXBF_GPIO_FW_OUTPUT_ENABLE_CLEAR, 0); -+ if (ret) -+ return dev_err_probe(dev, ret, "%s: bgpio_init() failed", __func__); - - gc->request = gpiochip_generic_request; - gc->free = gpiochip_generic_free; --- -2.43.2 - -From 768708af8d8f8b2f4d92a8be0486a948ef6baa3e Mon Sep 17 00:00:00 2001 -From: Kai Vehmanen <kai.vehmanen@linux.intel.com> -Date: Mon, 15 Jan 2024 11:22:09 +0200 -Subject: [PATCH 0633/1501] ASoC: SOF: ipc4-loader: remove the CPC check - warnings -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2068 -Lines: 48 - -[ Upstream commit ab09fb9c629ed3aaea6a82467f08595dbc549726 ] - -Warnings related to missing data in firmware manifest have -proven to be too verbose. This relates to description of -DSP module cost expressed in cycles per chunk (CPC). If -a matching value is not found in the manifest, kernel will -pass a zero value and DSP firmware will use a conservative -value in its place. - -Downgrade the warnings to dev_dbg(). - -Fixes: d8a2c9879349 ("ASoC: SOF: ipc4-loader/topology: Query the CPC value from manifest") -Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com> -Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> -Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com> -Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com> -Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> -Link: https://msgid.link/r/20240115092209.7184-3-peter.ujfalusi@linux.intel.com -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - sound/soc/sof/ipc4-loader.c | 11 ++++------- - 1 file changed, 4 insertions(+), 7 deletions(-) - -diff --git a/sound/soc/sof/ipc4-loader.c b/sound/soc/sof/ipc4-loader.c -index eaa04762eb11..4d37e89b592a 100644 ---- a/sound/soc/sof/ipc4-loader.c -+++ b/sound/soc/sof/ipc4-loader.c -@@ -479,13 +479,10 @@ void sof_ipc4_update_cpc_from_manifest(struct snd_sof_dev *sdev, - msg = "No CPC match in the firmware file's manifest"; - - no_cpc: -- dev_warn(sdev->dev, "%s (UUID: %pUL): %s (ibs/obs: %u/%u)\n", -- fw_module->man4_module_entry.name, -- &fw_module->man4_module_entry.uuid, msg, basecfg->ibs, -- basecfg->obs); -- dev_warn_once(sdev->dev, "Please try to update the firmware.\n"); -- dev_warn_once(sdev->dev, "If the issue persists, file a bug at\n"); -- dev_warn_once(sdev->dev, "https://github.com/thesofproject/sof/issues/\n"); -+ dev_dbg(sdev->dev, "%s (UUID: %pUL): %s (ibs/obs: %u/%u)\n", -+ fw_module->man4_module_entry.name, -+ &fw_module->man4_module_entry.uuid, msg, basecfg->ibs, -+ basecfg->obs); - } - - const struct sof_ipc_fw_loader_ops ipc4_loader_ops = { --- -2.43.2 - -From 79e1bbfbff1f1ba07d60d22fd292442525e874d5 Mon Sep 17 00:00:00 2001 -From: Lukas Wunner <lukas@wunner.de> -Date: Mon, 15 Jan 2024 16:05:26 +0100 -Subject: [PATCH 0634/1501] gpiolib: Fix scope-based gpio_device refcounting -Content-Length: 1360 -Lines: 35 - -[ Upstream commit 832b371097eb928d077c827b8f117bf5b99d35c0 ] - -Commit 9e4555d1e54a ("gpiolib: add support for scope-based management to -gpio_device") sought to add scope-based gpio_device refcounting, but -erroneously forgot a negation of IS_ERR_OR_NULL(). - -As a result, gpio_device_put() is not called if the gpio_device pointer -is valid (meaning the ref is leaked), but only called if the pointer is -NULL or an ERR_PTR(). - -While at it drop a superfluous trailing semicolon. - -Fixes: 9e4555d1e54a ("gpiolib: add support for scope-based management to gpio_device") -Signed-off-by: Lukas Wunner <lukas@wunner.de> -Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/linux/gpio/driver.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/include/linux/gpio/driver.h b/include/linux/gpio/driver.h -index 0aed62f0c633..f2878b361463 100644 ---- a/include/linux/gpio/driver.h -+++ b/include/linux/gpio/driver.h -@@ -614,7 +614,7 @@ struct gpio_device *gpio_device_get(struct gpio_device *gdev); - void gpio_device_put(struct gpio_device *gdev); - - DEFINE_FREE(gpio_device_put, struct gpio_device *, -- if (IS_ERR_OR_NULL(_T)) gpio_device_put(_T)); -+ if (!IS_ERR_OR_NULL(_T)) gpio_device_put(_T)) - - struct device *gpio_device_to_device(struct gpio_device *gdev); - --- -2.43.2 - -From 1b37284a3c5dbdbf88f3c95a39a2be3cb6c71250 Mon Sep 17 00:00:00 2001 -From: Dafna Hirschfeld <dhirschfeld@habana.ai> -Date: Sun, 7 Jan 2024 15:07:00 +0200 -Subject: [PATCH 0635/1501] drm/amdkfd: fixes for HMM mem allocation -Content-Length: 1600 -Lines: 42 - -[ Upstream commit 02eed83abc1395a1207591aafad9bcfc5cb1abcb ] - -Fix err return value and reset pgmap->type after checking it. - -Fixes: c83dee9b6394 ("drm/amdkfd: add SPM support for SVM") -Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> -Signed-off-by: Dafna Hirschfeld <dhirschfeld@habana.ai> -Signed-off-by: Felix Kuehling <felix.kuehling@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c -index 6c25dab051d5..b8680e0753ca 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c -@@ -1021,7 +1021,7 @@ int kgd2kfd_init_zone_device(struct amdgpu_device *adev) - } else { - res = devm_request_free_mem_region(adev->dev, &iomem_resource, size); - if (IS_ERR(res)) -- return -ENOMEM; -+ return PTR_ERR(res); - pgmap->range.start = res->start; - pgmap->range.end = res->end; - pgmap->type = MEMORY_DEVICE_PRIVATE; -@@ -1037,10 +1037,10 @@ int kgd2kfd_init_zone_device(struct amdgpu_device *adev) - r = devm_memremap_pages(adev->dev, pgmap); - if (IS_ERR(r)) { - pr_err("failed to register HMM device memory\n"); -- /* Disable SVM support capability */ -- pgmap->type = 0; - if (pgmap->type == MEMORY_DEVICE_PRIVATE) - devm_release_mem_region(adev->dev, res->start, resource_size(res)); -+ /* Disable SVM support capability */ -+ pgmap->type = 0; - return PTR_ERR(r); - } - --- -2.43.2 - -From 1db180f547056f90d2bd43bab2674e0c6d413f7c Mon Sep 17 00:00:00 2001 -From: Alex Deucher <alexander.deucher@amd.com> -Date: Mon, 2 Oct 2023 14:43:06 -0400 -Subject: [PATCH 0636/1501] drm/amdgpu: fall back to INPUT power for AVG power - via INFO IOCTL -Content-Length: 1226 -Lines: 33 - -[ Upstream commit d02069850fc102b07ae923535d5e212f2c8a34e9 ] - -For backwards compatibility with userspace. - -Fixes: 47f1724db4fe ("drm/amd: Introduce `AMDGPU_PP_SENSOR_GPU_INPUT_POWER`") -Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2897 -Reviewed-by: Yang Wang <kevinyang.wang@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -index 583cf03950cd..598867919c4f 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -@@ -1105,7 +1105,12 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) - if (amdgpu_dpm_read_sensor(adev, - AMDGPU_PP_SENSOR_GPU_AVG_POWER, - (void *)&ui32, &ui32_size)) { -- return -EINVAL; -+ /* fall back to input power for backwards compat */ -+ if (amdgpu_dpm_read_sensor(adev, -+ AMDGPU_PP_SENSOR_GPU_INPUT_POWER, -+ (void *)&ui32, &ui32_size)) { -+ return -EINVAL; -+ } - } - ui32 >>= 8; - break; --- -2.43.2 - -From 7a4d71c93e322ba362d6e05e7d468232516d0c00 Mon Sep 17 00:00:00 2001 -From: Qiang Ma <maqianga@uniontech.com> -Date: Fri, 12 Jan 2024 10:12:49 +0800 -Subject: [PATCH 0638/1501] net: stmmac: ethtool: Fixed calltrace caused by - unbalanced disable_irq_wake calls -Content-Length: 4242 -Lines: 96 - -[ Upstream commit a23aa04042187cbde16f470b49d4ad60d32e9206 ] - -We found the following dmesg calltrace when testing the GMAC NIC notebook: - -[9.448656] ------------[ cut here ]------------ -[9.448658] Unbalanced IRQ 43 wake disable -[9.448673] WARNING: CPU: 3 PID: 1083 at kernel/irq/manage.c:688 irq_set_irq_wake+0xe0/0x128 -[9.448717] CPU: 3 PID: 1083 Comm: ethtool Tainted: G O 4.19 #1 -[9.448773] ... -[9.448774] Call Trace: -[9.448781] [<9000000000209b5c>] show_stack+0x34/0x140 -[9.448788] [<9000000000d52700>] dump_stack+0x98/0xd0 -[9.448794] [<9000000000228610>] __warn+0xa8/0x120 -[9.448797] [<9000000000d2fb60>] report_bug+0x98/0x130 -[9.448800] [<900000000020a418>] do_bp+0x248/0x2f0 -[9.448805] [<90000000002035f4>] handle_bp_int+0x4c/0x78 -[9.448808] [<900000000029ea40>] irq_set_irq_wake+0xe0/0x128 -[9.448813] [<9000000000a96a7c>] stmmac_set_wol+0x134/0x150 -[9.448819] [<9000000000be6ed0>] dev_ethtool+0x1368/0x2440 -[9.448824] [<9000000000c08350>] dev_ioctl+0x1f8/0x3e0 -[9.448827] [<9000000000bb2a34>] sock_ioctl+0x2a4/0x450 -[9.448832] [<900000000046f044>] do_vfs_ioctl+0xa4/0x738 -[9.448834] [<900000000046f778>] ksys_ioctl+0xa0/0xe8 -[9.448837] [<900000000046f7d8>] sys_ioctl+0x18/0x28 -[9.448840] [<9000000000211ab4>] syscall_common+0x20/0x34 -[9.448842] ---[ end trace 40c18d9aec863c3e ]--- - -Multiple disable_irq_wake() calls will keep decreasing the IRQ -wake_depth, When wake_depth is 0, calling disable_irq_wake() again, -will report the above calltrace. - -Due to the need to appear in pairs, we cannot call disable_irq_wake() -without calling enable_irq_wake(). Fix this by making sure there are -no unbalanced disable_irq_wake() calls. - -Fixes: 3172d3afa998 ("stmmac: support wake up irq from external sources (v3)") -Signed-off-by: Qiang Ma <maqianga@uniontech.com> -Reviewed-by: Simon Horman <horms@kernel.org> -Link: https://lore.kernel.org/r/20240112021249.24598-1-maqianga@uniontech.com -Signed-off-by: Paolo Abeni <pabeni@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/stmicro/stmmac/stmmac.h | 1 + - drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 10 ++++++++-- - drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 + - 3 files changed, 10 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h -index cd7a9768de5f..b8c93b881a65 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h -@@ -255,6 +255,7 @@ struct stmmac_priv { - u32 msg_enable; - int wolopts; - int wol_irq; -+ bool wol_irq_disabled; - int clk_csr; - struct timer_list eee_ctrl_timer; - int lpi_irq; -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -index bfd146ad6937..67bc98f99135 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -@@ -822,10 +822,16 @@ static int stmmac_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol) - if (wol->wolopts) { - pr_info("stmmac: wakeup enable\n"); - device_set_wakeup_enable(priv->device, 1); -- enable_irq_wake(priv->wol_irq); -+ /* Avoid unbalanced enable_irq_wake calls */ -+ if (priv->wol_irq_disabled) -+ enable_irq_wake(priv->wol_irq); -+ priv->wol_irq_disabled = false; - } else { - device_set_wakeup_enable(priv->device, 0); -- disable_irq_wake(priv->wol_irq); -+ /* Avoid unbalanced disable_irq_wake calls */ -+ if (!priv->wol_irq_disabled) -+ disable_irq_wake(priv->wol_irq); -+ priv->wol_irq_disabled = true; - } - - mutex_lock(&priv->lock); -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index 5b9da19743b9..49b81daf7411 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -3565,6 +3565,7 @@ static int stmmac_request_irq_multi_msi(struct net_device *dev) - /* Request the Wake IRQ in case of another line - * is used for WoL - */ -+ priv->wol_irq_disabled = true; - if (priv->wol_irq > 0 && priv->wol_irq != dev->irq) { - int_name = priv->int_name_wol; - sprintf(int_name, "%s:%s", dev->name, "wol"); --- -2.43.2 - -From 91f9ecaeaba1223dd3066c36bfdf20de400294a6 Mon Sep 17 00:00:00 2001 -From: Kunwu Chan <chentao@kylinos.cn> -Date: Thu, 11 Jan 2024 15:20:18 +0800 -Subject: [PATCH 0640/1501] net: dsa: vsc73xx: Add null pointer check to - vsc73xx_gpio_probe -Content-Length: 1150 -Lines: 31 - -[ Upstream commit 776dac5a662774f07a876b650ba578d0a62d20db ] - -devm_kasprintf() returns a pointer to dynamically allocated memory -which can be NULL upon failure. - -Fixes: 05bd97fc559d ("net: dsa: Add Vitesse VSC73xx DSA router driver") -Signed-off-by: Kunwu Chan <chentao@kylinos.cn> -Suggested-by: Jakub Kicinski <kuba@kernel.org> -Reviewed-by: Simon Horman <horms@kernel.org> -Link: https://lore.kernel.org/r/20240111072018.75971-1-chentao@kylinos.cn -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/dsa/vitesse-vsc73xx-core.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/net/dsa/vitesse-vsc73xx-core.c b/drivers/net/dsa/vitesse-vsc73xx-core.c -index e6f29e4e508c..571f037fe649 100644 ---- a/drivers/net/dsa/vitesse-vsc73xx-core.c -+++ b/drivers/net/dsa/vitesse-vsc73xx-core.c -@@ -1135,6 +1135,8 @@ static int vsc73xx_gpio_probe(struct vsc73xx *vsc) - - vsc->gc.label = devm_kasprintf(vsc->dev, GFP_KERNEL, "VSC%04x", - vsc->chipid); -+ if (!vsc->gc.label) -+ return -ENOMEM; - vsc->gc.ngpio = 4; - vsc->gc.owner = THIS_MODULE; - vsc->gc.parent = vsc->dev; --- -2.43.2 - -From 77c63a08cd633695b8221f993dfe19aae1d1ce2f Mon Sep 17 00:00:00 2001 -From: Paolo Abeni <pabeni@redhat.com> -Date: Tue, 16 Jan 2024 18:18:47 +0100 -Subject: [PATCH 0642/1501] mptcp: relax check on MPC passive fallback -Content-Length: 1184 -Lines: 34 - -[ Upstream commit c0f5aec28edf98906d28f08daace6522adf9ee7a ] - -While testing the blamed commit below, I was able to miss (!) -packetdrill failures in the fastopen test-cases. - -On passive fastopen the child socket is created by incoming TCP MPC syn, -allow for both MPC_SYN and MPC_ACK header. - -Fixes: 724b00c12957 ("mptcp: refine opt_mp_capable determination") -Reviewed-by: Matthieu Baerts <matttbe@kernel.org> -Signed-off-by: Paolo Abeni <pabeni@redhat.com> -Reviewed-by: Eric Dumazet <edumazet@google.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/mptcp/subflow.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c -index 91c1cda4228f..7785cda48e6b 100644 ---- a/net/mptcp/subflow.c -+++ b/net/mptcp/subflow.c -@@ -783,7 +783,8 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, - * options. - */ - mptcp_get_options(skb, &mp_opt); -- if (!(mp_opt.suboptions & OPTION_MPTCP_MPC_ACK)) -+ if (!(mp_opt.suboptions & -+ (OPTION_MPTCP_MPC_SYN | OPTION_MPTCP_MPC_ACK))) - fallback = true; - - } else if (subflow_req->mp_join) { --- -2.43.2 - -From c5068e442eed063d2f1658e6b6d3c1c6fcf1e588 Mon Sep 17 00:00:00 2001 -From: Jakub Kicinski <kuba@kernel.org> -Date: Tue, 16 Jan 2024 11:14:00 -0800 -Subject: [PATCH 0643/1501] net: netdevsim: don't try to destroy PHC on VFs -Content-Length: 2171 -Lines: 68 - -[ Upstream commit ea937f77208323d35ffe2f8d8fc81b00118bfcda ] - -PHC gets initialized in nsim_init_netdevsim(), which -is only called if (nsim_dev_port_is_pf()). - -Create a counterpart of nsim_init_netdevsim() and -move the mock_phc_destroy() there. - -This fixes a crash trying to destroy netdevsim with -VFs instantiated, as caught by running the devlink.sh test: - - BUG: kernel NULL pointer dereference, address: 00000000000000b8 - RIP: 0010:mock_phc_destroy+0xd/0x30 - Call Trace: - <TASK> - nsim_destroy+0x4a/0x70 [netdevsim] - __nsim_dev_port_del+0x47/0x70 [netdevsim] - nsim_dev_reload_destroy+0x105/0x120 [netdevsim] - nsim_drv_remove+0x2f/0xb0 [netdevsim] - device_release_driver_internal+0x1a1/0x210 - bus_remove_device+0xd5/0x120 - device_del+0x159/0x490 - device_unregister+0x12/0x30 - del_device_store+0x11a/0x1a0 [netdevsim] - kernfs_fop_write_iter+0x130/0x1d0 - vfs_write+0x30b/0x4b0 - ksys_write+0x69/0xf0 - do_syscall_64+0xcc/0x1e0 - entry_SYSCALL_64_after_hwframe+0x6f/0x77 - -Fixes: b63e78fca889 ("net: netdevsim: use mock PHC driver") -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Reviewed-by: Simon Horman <horms@kernel.org> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/netdevsim/netdev.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c -index aecaf5f44374..77e8250282a5 100644 ---- a/drivers/net/netdevsim/netdev.c -+++ b/drivers/net/netdevsim/netdev.c -@@ -369,6 +369,12 @@ static int nsim_init_netdevsim_vf(struct netdevsim *ns) - return err; - } - -+static void nsim_exit_netdevsim(struct netdevsim *ns) -+{ -+ nsim_udp_tunnels_info_destroy(ns->netdev); -+ mock_phc_destroy(ns->phc); -+} -+ - struct netdevsim * - nsim_create(struct nsim_dev *nsim_dev, struct nsim_dev_port *nsim_dev_port) - { -@@ -417,8 +423,7 @@ void nsim_destroy(struct netdevsim *ns) - } - rtnl_unlock(); - if (nsim_dev_port_is_pf(ns->nsim_dev_port)) -- nsim_udp_tunnels_info_destroy(dev); -- mock_phc_destroy(ns->phc); -+ nsim_exit_netdevsim(ns); - free_netdev(dev); - } - --- -2.43.2 - -From 7d2d03936a97903ecb7d9554971982947cd86f86 Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso <pablo@netfilter.org> -Date: Wed, 3 Jan 2024 23:34:58 +0100 -Subject: [PATCH 0644/1501] netfilter: nf_tables: reject invalid set policy -Content-Length: 1142 -Lines: 36 - -[ Upstream commit 0617c3de9b4026b87be12b0cb5c35f42c7c66fcb ] - -Report -EINVAL in case userspace provides a unsupported set backend -policy. - -Fixes: c50b960ccc59 ("netfilter: nf_tables: implement proper set selection") -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nf_tables_api.c | 10 +++++++++- - 1 file changed, 9 insertions(+), 1 deletion(-) - -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 5e7994898c76..3912a133324c 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -5048,8 +5048,16 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, - } - - desc.policy = NFT_SET_POL_PERFORMANCE; -- if (nla[NFTA_SET_POLICY] != NULL) -+ if (nla[NFTA_SET_POLICY] != NULL) { - desc.policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY])); -+ switch (desc.policy) { -+ case NFT_SET_POL_PERFORMANCE: -+ case NFT_SET_POL_MEMORY: -+ break; -+ default: -+ return -EOPNOTSUPP; -+ } -+ } - - if (nla[NFTA_SET_DESC] != NULL) { - err = nf_tables_set_desc_parse(&desc, nla[NFTA_SET_DESC]); --- -2.43.2 - -From ae6c0543ff13b892ad4092b97ff9813d9fb3ad8a Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso <pablo@netfilter.org> -Date: Wed, 10 Jan 2024 00:42:37 +0100 -Subject: [PATCH 0645/1501] netfilter: nft_limit: do not ignore unsupported - flags -Content-Length: 1703 -Lines: 58 - -[ Upstream commit 91a139cee1202a4599a380810d93c69b5bac6197 ] - -Bail out if userspace provides unsupported flags, otherwise future -extensions to the limit expression will be silently ignored by the -kernel. - -Fixes: c7862a5f0de5 ("netfilter: nft_limit: allow to invert matching criteria") -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nft_limit.c | 19 ++++++++++++------- - 1 file changed, 12 insertions(+), 7 deletions(-) - -diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c -index 145dc62c6247..79039afde34e 100644 ---- a/net/netfilter/nft_limit.c -+++ b/net/netfilter/nft_limit.c -@@ -58,6 +58,7 @@ static inline bool nft_limit_eval(struct nft_limit_priv *priv, u64 cost) - static int nft_limit_init(struct nft_limit_priv *priv, - const struct nlattr * const tb[], bool pkts) - { -+ bool invert = false; - u64 unit, tokens; - - if (tb[NFTA_LIMIT_RATE] == NULL || -@@ -90,19 +91,23 @@ static int nft_limit_init(struct nft_limit_priv *priv, - priv->rate); - } - -+ if (tb[NFTA_LIMIT_FLAGS]) { -+ u32 flags = ntohl(nla_get_be32(tb[NFTA_LIMIT_FLAGS])); -+ -+ if (flags & ~NFT_LIMIT_F_INV) -+ return -EOPNOTSUPP; -+ -+ if (flags & NFT_LIMIT_F_INV) -+ invert = true; -+ } -+ - priv->limit = kmalloc(sizeof(*priv->limit), GFP_KERNEL_ACCOUNT); - if (!priv->limit) - return -ENOMEM; - - priv->limit->tokens = tokens; - priv->tokens_max = priv->limit->tokens; -- -- if (tb[NFTA_LIMIT_FLAGS]) { -- u32 flags = ntohl(nla_get_be32(tb[NFTA_LIMIT_FLAGS])); -- -- if (flags & NFT_LIMIT_F_INV) -- priv->invert = true; -- } -+ priv->invert = invert; - priv->limit->last = ktime_get_ns(); - spin_lock_init(&priv->limit->lock); - --- -2.43.2 - -From 0a12e679b6c7bc5dce521ef56c42a1f8146e5876 Mon Sep 17 00:00:00 2001 -From: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> -Date: Thu, 11 Jan 2024 23:06:37 +0800 -Subject: [PATCH 0646/1501] netfilter: nfnetlink_log: use proper helper for - fetching physinif -Content-Length: 1571 -Lines: 44 - -[ Upstream commit c3f9fd54cd87233f53bdf0e191a86b3a5e960e02 ] - -We don't use physindev in __build_packet_message except for getting -physinif from it. So let's switch to nf_bridge_get_physinif to get what -we want directly. - -Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> -Reviewed-by: Simon Horman <horms@kernel.org> -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Stable-dep-of: 9874808878d9 ("netfilter: bridge: replace physindev with physinif in nf_bridge_info") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nfnetlink_log.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c -index f03f4d4d7d88..134e05d31061 100644 ---- a/net/netfilter/nfnetlink_log.c -+++ b/net/netfilter/nfnetlink_log.c -@@ -508,7 +508,7 @@ __build_packet_message(struct nfnl_log_net *log, - htonl(br_port_get_rcu(indev)->br->dev->ifindex))) - goto nla_put_failure; - } else { -- struct net_device *physindev; -+ int physinif; - - /* Case 2: indev is bridge group, we need to look for - * physical device (when called from ipv4) */ -@@ -516,10 +516,10 @@ __build_packet_message(struct nfnl_log_net *log, - htonl(indev->ifindex))) - goto nla_put_failure; - -- physindev = nf_bridge_get_physindev(skb); -- if (physindev && -+ physinif = nf_bridge_get_physinif(skb); -+ if (physinif && - nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSINDEV, -- htonl(physindev->ifindex))) -+ htonl(physinif))) - goto nla_put_failure; - } - #endif --- -2.43.2 - -From 108494937a67ecbd4678326761106bd3e5d2012e Mon Sep 17 00:00:00 2001 -From: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> -Date: Thu, 11 Jan 2024 23:06:38 +0800 -Subject: [PATCH 0647/1501] netfilter: nf_queue: remove excess nf_bridge - variable -Content-Length: 1219 -Lines: 33 - -[ Upstream commit aeaa44075f8e49e2e0ad4507d925e690b7950145 ] - -We don't really need nf_bridge variable here. And nf_bridge_info_exists -is better replacement for nf_bridge_info_get in case we are only -checking for existence. - -Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> -Reviewed-by: Simon Horman <horms@kernel.org> -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Stable-dep-of: 9874808878d9 ("netfilter: bridge: replace physindev with physinif in nf_bridge_info") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nf_queue.c | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - -diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c -index 63d1516816b1..3dfcb3ac5cb4 100644 ---- a/net/netfilter/nf_queue.c -+++ b/net/netfilter/nf_queue.c -@@ -82,10 +82,8 @@ static void __nf_queue_entry_init_physdevs(struct nf_queue_entry *entry) - { - #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) - const struct sk_buff *skb = entry->skb; -- struct nf_bridge_info *nf_bridge; - -- nf_bridge = nf_bridge_info_get(skb); -- if (nf_bridge) { -+ if (nf_bridge_info_exists(skb)) { - entry->physin = nf_bridge_get_physindev(skb); - entry->physout = nf_bridge_get_physoutdev(skb); - } else { --- -2.43.2 - -From eb4170437f45b91eef518dcb017197b115b52852 Mon Sep 17 00:00:00 2001 -From: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> -Date: Thu, 11 Jan 2024 23:06:39 +0800 -Subject: [PATCH 0648/1501] netfilter: propagate net to nf_bridge_get_physindev -Content-Length: 7360 -Lines: 181 - -[ Upstream commit a54e72197037d2c9bfcd70dddaac8c8ccb5b41ba ] - -This is a preparation patch for replacing physindev with physinif on -nf_bridge_info structure. We will use dev_get_by_index_rcu to resolve -device, when needed, and it requires net to be available. - -Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> -Reviewed-by: Simon Horman <horms@kernel.org> -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Stable-dep-of: 9874808878d9 ("netfilter: bridge: replace physindev with physinif in nf_bridge_info") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/linux/netfilter_bridge.h | 2 +- - net/ipv4/netfilter/nf_reject_ipv4.c | 2 +- - net/ipv6/netfilter/nf_reject_ipv6.c | 2 +- - net/netfilter/ipset/ip_set_hash_netiface.c | 8 ++++---- - net/netfilter/nf_log_syslog.c | 13 +++++++------ - net/netfilter/nf_queue.c | 2 +- - net/netfilter/xt_physdev.c | 2 +- - 7 files changed, 16 insertions(+), 15 deletions(-) - -diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h -index f980edfdd278..e927b9a15a55 100644 ---- a/include/linux/netfilter_bridge.h -+++ b/include/linux/netfilter_bridge.h -@@ -56,7 +56,7 @@ static inline int nf_bridge_get_physoutif(const struct sk_buff *skb) - } - - static inline struct net_device * --nf_bridge_get_physindev(const struct sk_buff *skb) -+nf_bridge_get_physindev(const struct sk_buff *skb, struct net *net) - { - const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); - -diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c -index f01b038fc1cd..86e7d390671a 100644 ---- a/net/ipv4/netfilter/nf_reject_ipv4.c -+++ b/net/ipv4/netfilter/nf_reject_ipv4.c -@@ -289,7 +289,7 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb, - * build the eth header using the original destination's MAC as the - * source, and send the RST packet directly. - */ -- br_indev = nf_bridge_get_physindev(oldskb); -+ br_indev = nf_bridge_get_physindev(oldskb, net); - if (br_indev) { - struct ethhdr *oeth = eth_hdr(oldskb); - -diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c -index d45bc54b7ea5..27b2164f4c43 100644 ---- a/net/ipv6/netfilter/nf_reject_ipv6.c -+++ b/net/ipv6/netfilter/nf_reject_ipv6.c -@@ -354,7 +354,7 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb, - * build the eth header using the original destination's MAC as the - * source, and send the RST packet directly. - */ -- br_indev = nf_bridge_get_physindev(oldskb); -+ br_indev = nf_bridge_get_physindev(oldskb, net); - if (br_indev) { - struct ethhdr *oeth = eth_hdr(oldskb); - -diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c -index 95aeb31c60e0..30a655e5c4fd 100644 ---- a/net/netfilter/ipset/ip_set_hash_netiface.c -+++ b/net/netfilter/ipset/ip_set_hash_netiface.c -@@ -138,9 +138,9 @@ hash_netiface4_data_next(struct hash_netiface4_elem *next, - #include "ip_set_hash_gen.h" - - #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) --static const char *get_physindev_name(const struct sk_buff *skb) -+static const char *get_physindev_name(const struct sk_buff *skb, struct net *net) - { -- struct net_device *dev = nf_bridge_get_physindev(skb); -+ struct net_device *dev = nf_bridge_get_physindev(skb, net); - - return dev ? dev->name : NULL; - } -@@ -177,7 +177,7 @@ hash_netiface4_kadt(struct ip_set *set, const struct sk_buff *skb, - - if (opt->cmdflags & IPSET_FLAG_PHYSDEV) { - #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) -- const char *eiface = SRCDIR ? get_physindev_name(skb) : -+ const char *eiface = SRCDIR ? get_physindev_name(skb, xt_net(par)) : - get_physoutdev_name(skb); - - if (!eiface) -@@ -395,7 +395,7 @@ hash_netiface6_kadt(struct ip_set *set, const struct sk_buff *skb, - - if (opt->cmdflags & IPSET_FLAG_PHYSDEV) { - #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) -- const char *eiface = SRCDIR ? get_physindev_name(skb) : -+ const char *eiface = SRCDIR ? get_physindev_name(skb, xt_net(par)) : - get_physoutdev_name(skb); - - if (!eiface) -diff --git a/net/netfilter/nf_log_syslog.c b/net/netfilter/nf_log_syslog.c -index c66689ad2b49..58402226045e 100644 ---- a/net/netfilter/nf_log_syslog.c -+++ b/net/netfilter/nf_log_syslog.c -@@ -111,7 +111,8 @@ nf_log_dump_packet_common(struct nf_log_buf *m, u8 pf, - unsigned int hooknum, const struct sk_buff *skb, - const struct net_device *in, - const struct net_device *out, -- const struct nf_loginfo *loginfo, const char *prefix) -+ const struct nf_loginfo *loginfo, const char *prefix, -+ struct net *net) - { - const struct net_device *physoutdev __maybe_unused; - const struct net_device *physindev __maybe_unused; -@@ -121,7 +122,7 @@ nf_log_dump_packet_common(struct nf_log_buf *m, u8 pf, - in ? in->name : "", - out ? out->name : ""); - #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) -- physindev = nf_bridge_get_physindev(skb); -+ physindev = nf_bridge_get_physindev(skb, net); - if (physindev && in != physindev) - nf_log_buf_add(m, "PHYSIN=%s ", physindev->name); - physoutdev = nf_bridge_get_physoutdev(skb); -@@ -148,7 +149,7 @@ static void nf_log_arp_packet(struct net *net, u_int8_t pf, - loginfo = &default_loginfo; - - nf_log_dump_packet_common(m, pf, hooknum, skb, in, out, loginfo, -- prefix); -+ prefix, net); - dump_arp_packet(m, loginfo, skb, skb_network_offset(skb)); - - nf_log_buf_close(m); -@@ -845,7 +846,7 @@ static void nf_log_ip_packet(struct net *net, u_int8_t pf, - loginfo = &default_loginfo; - - nf_log_dump_packet_common(m, pf, hooknum, skb, in, -- out, loginfo, prefix); -+ out, loginfo, prefix, net); - - if (in) - dump_mac_header(m, loginfo, skb); -@@ -880,7 +881,7 @@ static void nf_log_ip6_packet(struct net *net, u_int8_t pf, - loginfo = &default_loginfo; - - nf_log_dump_packet_common(m, pf, hooknum, skb, in, out, -- loginfo, prefix); -+ loginfo, prefix, net); - - if (in) - dump_mac_header(m, loginfo, skb); -@@ -916,7 +917,7 @@ static void nf_log_unknown_packet(struct net *net, u_int8_t pf, - loginfo = &default_loginfo; - - nf_log_dump_packet_common(m, pf, hooknum, skb, in, out, loginfo, -- prefix); -+ prefix, net); - - dump_mac_header(m, loginfo, skb); - -diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c -index 3dfcb3ac5cb4..e2f334f70281 100644 ---- a/net/netfilter/nf_queue.c -+++ b/net/netfilter/nf_queue.c -@@ -84,7 +84,7 @@ static void __nf_queue_entry_init_physdevs(struct nf_queue_entry *entry) - const struct sk_buff *skb = entry->skb; - - if (nf_bridge_info_exists(skb)) { -- entry->physin = nf_bridge_get_physindev(skb); -+ entry->physin = nf_bridge_get_physindev(skb, entry->state.net); - entry->physout = nf_bridge_get_physoutdev(skb); - } else { - entry->physin = NULL; -diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c -index ec6ed6fda96c..343e65f377d4 100644 ---- a/net/netfilter/xt_physdev.c -+++ b/net/netfilter/xt_physdev.c -@@ -59,7 +59,7 @@ physdev_mt(const struct sk_buff *skb, struct xt_action_param *par) - (!!outdev ^ !(info->invert & XT_PHYSDEV_OP_BRIDGED))) - return false; - -- physdev = nf_bridge_get_physindev(skb); -+ physdev = nf_bridge_get_physindev(skb, xt_net(par)); - indev = physdev ? physdev->name : NULL; - - if ((info->bitmask & XT_PHYSDEV_OP_ISIN && --- -2.43.2 - -From 544add1f1cfb78c3dfa3e6edcf4668f6be5e730c Mon Sep 17 00:00:00 2001 -From: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> -Date: Thu, 11 Jan 2024 23:06:40 +0800 -Subject: [PATCH 0649/1501] netfilter: bridge: replace physindev with physinif - in nf_bridge_info -Content-Length: 10776 -Lines: 298 - -[ Upstream commit 9874808878d9eed407e3977fd11fee49de1e1d86 ] - -An skb can be added to a neigh->arp_queue while waiting for an arp -reply. Where original skb's skb->dev can be different to neigh's -neigh->dev. For instance in case of bridging dnated skb from one veth to -another, the skb would be added to a neigh->arp_queue of the bridge. - -As skb->dev can be reset back to nf_bridge->physindev and used, and as -there is no explicit mechanism that prevents this physindev from been -freed under us (for instance neigh_flush_dev doesn't cleanup skbs from -different device's neigh queue) we can crash on e.g. this stack: - -arp_process - neigh_update - skb = __skb_dequeue(&neigh->arp_queue) - neigh_resolve_output(..., skb) - ... - br_nf_dev_xmit - br_nf_pre_routing_finish_bridge_slow - skb->dev = nf_bridge->physindev - br_handle_frame_finish - -Let's use plain ifindex instead of net_device link. To peek into the -original net_device we will use dev_get_by_index_rcu(). Thus either we -get device and are safe to use it or we don't get it and drop skb. - -Fixes: c4e70a87d975 ("netfilter: bridge: rename br_netfilter.c to br_netfilter_hooks.c") -Suggested-by: Florian Westphal <fw@strlen.de> -Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/linux/netfilter_bridge.h | 4 +-- - include/linux/skbuff.h | 2 +- - net/bridge/br_netfilter_hooks.c | 42 +++++++++++++++++++++++------ - net/bridge/br_netfilter_ipv6.c | 14 +++++++--- - net/ipv4/netfilter/nf_reject_ipv4.c | 9 ++++--- - net/ipv6/netfilter/nf_reject_ipv6.c | 11 +++++--- - 6 files changed, 61 insertions(+), 21 deletions(-) - -diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h -index e927b9a15a55..743475ca7e9d 100644 ---- a/include/linux/netfilter_bridge.h -+++ b/include/linux/netfilter_bridge.h -@@ -42,7 +42,7 @@ static inline int nf_bridge_get_physinif(const struct sk_buff *skb) - if (!nf_bridge) - return 0; - -- return nf_bridge->physindev ? nf_bridge->physindev->ifindex : 0; -+ return nf_bridge->physinif; - } - - static inline int nf_bridge_get_physoutif(const struct sk_buff *skb) -@@ -60,7 +60,7 @@ nf_bridge_get_physindev(const struct sk_buff *skb, struct net *net) - { - const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); - -- return nf_bridge ? nf_bridge->physindev : NULL; -+ return nf_bridge ? dev_get_by_index_rcu(net, nf_bridge->physinif) : NULL; - } - - static inline struct net_device * -diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h -index 27998f73183e..763e9264402f 100644 ---- a/include/linux/skbuff.h -+++ b/include/linux/skbuff.h -@@ -295,7 +295,7 @@ struct nf_bridge_info { - u8 bridged_dnat:1; - u8 sabotage_in_done:1; - __u16 frag_max_size; -- struct net_device *physindev; -+ int physinif; - - /* always valid & non-NULL from FORWARD on, for physdev match */ - struct net_device *physoutdev; -diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c -index 6adcb45bca75..ed1720890757 100644 ---- a/net/bridge/br_netfilter_hooks.c -+++ b/net/bridge/br_netfilter_hooks.c -@@ -279,8 +279,17 @@ int br_nf_pre_routing_finish_bridge(struct net *net, struct sock *sk, struct sk_ - - if ((READ_ONCE(neigh->nud_state) & NUD_CONNECTED) && - READ_ONCE(neigh->hh.hh_len)) { -+ struct net_device *br_indev; -+ -+ br_indev = nf_bridge_get_physindev(skb, net); -+ if (!br_indev) { -+ neigh_release(neigh); -+ goto free_skb; -+ } -+ - neigh_hh_bridge(&neigh->hh, skb); -- skb->dev = nf_bridge->physindev; -+ skb->dev = br_indev; -+ - ret = br_handle_frame_finish(net, sk, skb); - } else { - /* the neighbour function below overwrites the complete -@@ -352,12 +361,18 @@ br_nf_ipv4_daddr_was_changed(const struct sk_buff *skb, - */ - static int br_nf_pre_routing_finish(struct net *net, struct sock *sk, struct sk_buff *skb) - { -- struct net_device *dev = skb->dev; -+ struct net_device *dev = skb->dev, *br_indev; - struct iphdr *iph = ip_hdr(skb); - struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); - struct rtable *rt; - int err; - -+ br_indev = nf_bridge_get_physindev(skb, net); -+ if (!br_indev) { -+ kfree_skb(skb); -+ return 0; -+ } -+ - nf_bridge->frag_max_size = IPCB(skb)->frag_max_size; - - if (nf_bridge->pkt_otherhost) { -@@ -397,7 +412,7 @@ static int br_nf_pre_routing_finish(struct net *net, struct sock *sk, struct sk_ - } else { - if (skb_dst(skb)->dev == dev) { - bridged_dnat: -- skb->dev = nf_bridge->physindev; -+ skb->dev = br_indev; - nf_bridge_update_protocol(skb); - nf_bridge_push_encap_header(skb); - br_nf_hook_thresh(NF_BR_PRE_ROUTING, -@@ -410,7 +425,7 @@ static int br_nf_pre_routing_finish(struct net *net, struct sock *sk, struct sk_ - skb->pkt_type = PACKET_HOST; - } - } else { -- rt = bridge_parent_rtable(nf_bridge->physindev); -+ rt = bridge_parent_rtable(br_indev); - if (!rt) { - kfree_skb(skb); - return 0; -@@ -419,7 +434,7 @@ static int br_nf_pre_routing_finish(struct net *net, struct sock *sk, struct sk_ - skb_dst_set_noref(skb, &rt->dst); - } - -- skb->dev = nf_bridge->physindev; -+ skb->dev = br_indev; - nf_bridge_update_protocol(skb); - nf_bridge_push_encap_header(skb); - br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb, skb->dev, NULL, -@@ -456,7 +471,7 @@ struct net_device *setup_pre_routing(struct sk_buff *skb, const struct net *net) - } - - nf_bridge->in_prerouting = 1; -- nf_bridge->physindev = skb->dev; -+ nf_bridge->physinif = skb->dev->ifindex; - skb->dev = brnf_get_logical_dev(skb, skb->dev, net); - - if (skb->protocol == htons(ETH_P_8021Q)) -@@ -553,7 +568,11 @@ static int br_nf_forward_finish(struct net *net, struct sock *sk, struct sk_buff - if (skb->protocol == htons(ETH_P_IPV6)) - nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size; - -- in = nf_bridge->physindev; -+ in = nf_bridge_get_physindev(skb, net); -+ if (!in) { -+ kfree_skb(skb); -+ return 0; -+ } - if (nf_bridge->pkt_otherhost) { - skb->pkt_type = PACKET_OTHERHOST; - nf_bridge->pkt_otherhost = false; -@@ -899,6 +918,13 @@ static unsigned int ip_sabotage_in(void *priv, - static void br_nf_pre_routing_finish_bridge_slow(struct sk_buff *skb) - { - struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); -+ struct net_device *br_indev; -+ -+ br_indev = nf_bridge_get_physindev(skb, dev_net(skb->dev)); -+ if (!br_indev) { -+ kfree_skb(skb); -+ return; -+ } - - skb_pull(skb, ETH_HLEN); - nf_bridge->bridged_dnat = 0; -@@ -908,7 +934,7 @@ static void br_nf_pre_routing_finish_bridge_slow(struct sk_buff *skb) - skb_copy_to_linear_data_offset(skb, -(ETH_HLEN - ETH_ALEN), - nf_bridge->neigh_header, - ETH_HLEN - ETH_ALEN); -- skb->dev = nf_bridge->physindev; -+ skb->dev = br_indev; - - nf_bridge->physoutdev = NULL; - br_handle_frame_finish(dev_net(skb->dev), NULL, skb); -diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c -index 2e24a743f917..e0421eaa3abc 100644 ---- a/net/bridge/br_netfilter_ipv6.c -+++ b/net/bridge/br_netfilter_ipv6.c -@@ -102,9 +102,15 @@ static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struc - { - struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); - struct rtable *rt; -- struct net_device *dev = skb->dev; -+ struct net_device *dev = skb->dev, *br_indev; - const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops(); - -+ br_indev = nf_bridge_get_physindev(skb, net); -+ if (!br_indev) { -+ kfree_skb(skb); -+ return 0; -+ } -+ - nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size; - - if (nf_bridge->pkt_otherhost) { -@@ -122,7 +128,7 @@ static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struc - } - - if (skb_dst(skb)->dev == dev) { -- skb->dev = nf_bridge->physindev; -+ skb->dev = br_indev; - nf_bridge_update_protocol(skb); - nf_bridge_push_encap_header(skb); - br_nf_hook_thresh(NF_BR_PRE_ROUTING, -@@ -133,7 +139,7 @@ static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struc - ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr); - skb->pkt_type = PACKET_HOST; - } else { -- rt = bridge_parent_rtable(nf_bridge->physindev); -+ rt = bridge_parent_rtable(br_indev); - if (!rt) { - kfree_skb(skb); - return 0; -@@ -142,7 +148,7 @@ static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struc - skb_dst_set_noref(skb, &rt->dst); - } - -- skb->dev = nf_bridge->physindev; -+ skb->dev = br_indev; - nf_bridge_update_protocol(skb); - nf_bridge_push_encap_header(skb); - br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb, -diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c -index 86e7d390671a..04504b2b51df 100644 ---- a/net/ipv4/netfilter/nf_reject_ipv4.c -+++ b/net/ipv4/netfilter/nf_reject_ipv4.c -@@ -239,7 +239,6 @@ static int nf_reject_fill_skb_dst(struct sk_buff *skb_in) - void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb, - int hook) - { -- struct net_device *br_indev __maybe_unused; - struct sk_buff *nskb; - struct iphdr *niph; - const struct tcphdr *oth; -@@ -289,9 +288,13 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb, - * build the eth header using the original destination's MAC as the - * source, and send the RST packet directly. - */ -- br_indev = nf_bridge_get_physindev(oldskb, net); -- if (br_indev) { -+ if (nf_bridge_info_exists(oldskb)) { - struct ethhdr *oeth = eth_hdr(oldskb); -+ struct net_device *br_indev; -+ -+ br_indev = nf_bridge_get_physindev(oldskb, net); -+ if (!br_indev) -+ goto free_nskb; - - nskb->dev = br_indev; - niph->tot_len = htons(nskb->len); -diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c -index 27b2164f4c43..196dd4ecb5e2 100644 ---- a/net/ipv6/netfilter/nf_reject_ipv6.c -+++ b/net/ipv6/netfilter/nf_reject_ipv6.c -@@ -278,7 +278,6 @@ static int nf_reject6_fill_skb_dst(struct sk_buff *skb_in) - void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb, - int hook) - { -- struct net_device *br_indev __maybe_unused; - struct sk_buff *nskb; - struct tcphdr _otcph; - const struct tcphdr *otcph; -@@ -354,9 +353,15 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb, - * build the eth header using the original destination's MAC as the - * source, and send the RST packet directly. - */ -- br_indev = nf_bridge_get_physindev(oldskb, net); -- if (br_indev) { -+ if (nf_bridge_info_exists(oldskb)) { - struct ethhdr *oeth = eth_hdr(oldskb); -+ struct net_device *br_indev; -+ -+ br_indev = nf_bridge_get_physindev(oldskb, net); -+ if (!br_indev) { -+ kfree_skb(nskb); -+ return; -+ } - - nskb->dev = br_indev; - nskb->protocol = htons(ETH_P_IPV6); --- -2.43.2 - -From ff67e3e488090908dc015ba04d7407d8bd467f7e Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso <pablo@netfilter.org> -Date: Sun, 14 Jan 2024 23:53:39 +0100 -Subject: [PATCH 0650/1501] netfilter: nf_tables: do not allow mismatch field - size and set key length -Content-Length: 1490 -Lines: 42 - -[ Upstream commit 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 ] - -The set description provides the size of each field in the set whose sum -should not mismatch the set key length, bail out otherwise. - -I did not manage to crash nft_set_pipapo with mismatch fields and set key -length so far, but this is UB which must be disallowed. - -Fixes: f3a2181e16f1 ("netfilter: nf_tables: Support for sets with multiple ranged fields") -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nf_tables_api.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 3912a133324c..7775bf5224ac 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -4811,8 +4811,8 @@ static int nft_set_desc_concat_parse(const struct nlattr *attr, - static int nft_set_desc_concat(struct nft_set_desc *desc, - const struct nlattr *nla) - { -+ u32 num_regs = 0, key_num_regs = 0; - struct nlattr *attr; -- u32 num_regs = 0; - int rem, err, i; - - nla_for_each_nested(attr, nla, rem) { -@@ -4827,6 +4827,10 @@ static int nft_set_desc_concat(struct nft_set_desc *desc, - for (i = 0; i < desc->field_count; i++) - num_regs += DIV_ROUND_UP(desc->field_len[i], sizeof(u32)); - -+ key_num_regs = DIV_ROUND_UP(desc->klen, sizeof(u32)); -+ if (key_num_regs != num_regs) -+ return -EINVAL; -+ - if (num_regs > NFT_REG32_COUNT) - return -E2BIG; - --- -2.43.2 - -From 9f0254479da4180d194fce950cee1dc975416177 Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso <pablo@netfilter.org> -Date: Mon, 15 Jan 2024 00:14:38 +0100 -Subject: [PATCH 0651/1501] netfilter: nf_tables: skip dead set elements in - netlink dump -Content-Length: 1523 -Lines: 39 - -[ Upstream commit 6b1ca88e4bb63673dc9f9c7f23c899f22c3cb17a ] - -Delete from packet path relies on the garbage collector to purge -elements with NFT_SET_ELEM_DEAD_BIT on. - -Skip these dead elements from nf_tables_dump_setelem() path, I very -rarely see tests/shell/testcases/maps/typeof_maps_add_delete reports -[DUMP FAILED] showing a mismatch in the expected output with an element -that should not be there. - -If the netlink dump happens before GC worker run, it might show dead -elements in the ruleset listing. - -nft_rhash_get() already skips dead elements in nft_rhash_cmp(), -therefore, it already does not show the element when getting a single -element via netlink control plane. - -Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane") -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nf_tables_api.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 7775bf5224ac..47ffb9e4c353 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -5716,7 +5716,7 @@ static int nf_tables_dump_setelem(const struct nft_ctx *ctx, - const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); - struct nft_set_dump_args *args; - -- if (nft_set_elem_expired(ext)) -+ if (nft_set_elem_expired(ext) || nft_set_elem_is_dead(ext)) - return 0; - - args = container_of(iter, struct nft_set_dump_args, iter); --- -2.43.2 - -From ce2189d3985be2d72628b78a7e0e2b6d7db15c10 Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso <pablo@netfilter.org> -Date: Mon, 15 Jan 2024 12:50:29 +0100 -Subject: [PATCH 0652/1501] netfilter: nf_tables: reject NFT_SET_CONCAT with - not field length description -Content-Length: 1100 -Lines: 32 - -[ Upstream commit 113661e07460a6604aacc8ae1b23695a89e7d4b3 ] - -It is still possible to set on the NFT_SET_CONCAT flag by specifying a -set size and no field description, report EINVAL in such case. - -Fixes: 1b6345d4160e ("netfilter: nf_tables: check NFT_SET_CONCAT flag if field_count is specified") -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nf_tables_api.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 47ffb9e4c353..f032c29f1da6 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -5068,8 +5068,12 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, - if (err < 0) - return err; - -- if (desc.field_count > 1 && !(flags & NFT_SET_CONCAT)) -+ if (desc.field_count > 1) { -+ if (!(flags & NFT_SET_CONCAT)) -+ return -EINVAL; -+ } else if (flags & NFT_SET_CONCAT) { - return -EINVAL; -+ } - } else if (flags & NFT_SET_CONCAT) { - return -EINVAL; - } --- -2.43.2 - -From c149cc7c88cadf956111bd85cd03c5c11618c0b7 Mon Sep 17 00:00:00 2001 -From: Fedor Pchelkin <pchelkin@ispras.ru> -Date: Mon, 15 Jan 2024 17:39:22 +0300 -Subject: [PATCH 0653/1501] ipvs: avoid stat macros calls from preemptible - context -Content-Length: 2567 -Lines: 75 - -[ Upstream commit d6938c1c76c64f42363d0d1f051e1b4641c2ad40 ] - -Inside decrement_ttl() upon discovering that the packet ttl has exceeded, -__IP_INC_STATS and __IP6_INC_STATS macros can be called from preemptible -context having the following backtrace: - -check_preemption_disabled: 48 callbacks suppressed -BUG: using __this_cpu_add() in preemptible [00000000] code: curl/1177 -caller is decrement_ttl+0x217/0x830 -CPU: 5 PID: 1177 Comm: curl Not tainted 6.7.0+ #34 -Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 04/01/2014 -Call Trace: - <TASK> - dump_stack_lvl+0xbd/0xe0 - check_preemption_disabled+0xd1/0xe0 - decrement_ttl+0x217/0x830 - __ip_vs_get_out_rt+0x4e0/0x1ef0 - ip_vs_nat_xmit+0x205/0xcd0 - ip_vs_in_hook+0x9b1/0x26a0 - nf_hook_slow+0xc2/0x210 - nf_hook+0x1fb/0x770 - __ip_local_out+0x33b/0x640 - ip_local_out+0x2a/0x490 - __ip_queue_xmit+0x990/0x1d10 - __tcp_transmit_skb+0x288b/0x3d10 - tcp_connect+0x3466/0x5180 - tcp_v4_connect+0x1535/0x1bb0 - __inet_stream_connect+0x40d/0x1040 - inet_stream_connect+0x57/0xa0 - __sys_connect_file+0x162/0x1a0 - __sys_connect+0x137/0x160 - __x64_sys_connect+0x72/0xb0 - do_syscall_64+0x6f/0x140 - entry_SYSCALL_64_after_hwframe+0x6e/0x76 -RIP: 0033:0x7fe6dbbc34e0 - -Use the corresponding preemption-aware variants: IP_INC_STATS and -IP6_INC_STATS. - -Found by Linux Verification Center (linuxtesting.org). - -Fixes: 8d8e20e2d7bb ("ipvs: Decrement ttl") -Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> -Acked-by: Julian Anastasov <ja@ssi.bg> -Acked-by: Simon Horman <horms@kernel.org> -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/ipvs/ip_vs_xmit.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c -index 9193e109e6b3..65e0259178da 100644 ---- a/net/netfilter/ipvs/ip_vs_xmit.c -+++ b/net/netfilter/ipvs/ip_vs_xmit.c -@@ -271,7 +271,7 @@ static inline bool decrement_ttl(struct netns_ipvs *ipvs, - skb->dev = dst->dev; - icmpv6_send(skb, ICMPV6_TIME_EXCEED, - ICMPV6_EXC_HOPLIMIT, 0); -- __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS); -+ IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS); - - return false; - } -@@ -286,7 +286,7 @@ static inline bool decrement_ttl(struct netns_ipvs *ipvs, - { - if (ip_hdr(skb)->ttl <= 1) { - /* Tell the sender its packet died... */ -- __IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS); -+ IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS); - icmp_send(skb, ICMP_TIME_EXCEEDED, ICMP_EXC_TTL, 0); - return false; - } --- -2.43.2 - -From e24bf5b47a5788a8f9c74012c808f5a9bc149a7f Mon Sep 17 00:00:00 2001 -From: Pavel Begunkov <asml.silence@gmail.com> -Date: Wed, 17 Jan 2024 00:57:26 +0000 -Subject: [PATCH 0654/1501] io_uring: adjust defer tw counting -Content-Length: 1531 -Lines: 37 - -[ Upstream commit dc12d1799ce710fd90abbe0ced71e7e1ae0894fc ] - -The UINT_MAX work item counting bias in io_req_local_work_add() in case -of !IOU_F_TWQ_LAZY_WAKE works in a sense that we will not miss a wake up, -however it's still eerie. In particular, if we add a lazy work item -after a non-lazy one, we'll increment it and get nr_tw==0, and -subsequent adds may try to unnecessarily wake up the task, which is -though not so likely to happen in real workloads. - -Half the bias, it's still large enough to be larger than any valid -->cq_wait_nr, which is limited by IORING_MAX_CQ_ENTRIES, but further -have a good enough of space before it overflows. - -Fixes: 8751d15426a31 ("io_uring: reduce scheduling due to tw") -Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> -Link: https://lore.kernel.org/r/108b971e958deaf7048342930c341ba90f75d806.1705438669.git.asml.silence@gmail.com -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - io_uring/io_uring.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c -index 7f62f5990152..59f5791c90c3 100644 ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -1346,7 +1346,7 @@ static inline void io_req_local_work_add(struct io_kiocb *req, unsigned flags) - nr_tw = nr_tw_prev + 1; - /* Large enough to fail the nr_wait comparison below */ - if (!(flags & IOU_F_TWQ_LAZY_WAKE)) -- nr_tw = -1U; -+ nr_tw = INT_MAX; - - req->nr_tw = nr_tw; - req->io_task_work.node.next = first; --- -2.43.2 - -From ae836b7f6c4ee1521203b23b5c441d8e2a31daf3 Mon Sep 17 00:00:00 2001 -From: Mark Brown <broonie@kernel.org> -Date: Mon, 15 Jan 2024 18:42:38 +0000 -Subject: [PATCH 0656/1501] arm64/ptrace: Don't flush ZA/ZT storage when - writing ZA via ptrace -Content-Length: 1681 -Lines: 47 - -[ Upstream commit b7c510d049049409e8945b932f4b0b357fa17415 ] - -When writing ZA we currently unconditionally flush the buffer used to store -it as part of ensuring that it is allocated. Since this buffer is shared -with ZT0 this means that a write to ZA when PSTATE.ZA is already set will -corrupt the value of ZT0 on a SME2 system. Fix this by only flushing the -backing storage if PSTATE.ZA was not previously set. - -This will mean that short or failed writes may leave stale data in the -buffer, this seems as correct as our current behaviour and unlikely to be -something that userspace will rely on. - -Fixes: f90b529bcbe5 ("arm64/sme: Implement ZT0 ptrace support") -Signed-off-by: Mark Brown <broonie@kernel.org> -Link: https://lore.kernel.org/r/20240115-arm64-fix-ptrace-za-zt-v1-1-48617517028a@kernel.org -Signed-off-by: Will Deacon <will@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/arm64/kernel/ptrace.c | 13 +++++++------ - 1 file changed, 7 insertions(+), 6 deletions(-) - -diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c -index 20d7ef82de90..b3f64144b5cd 100644 ---- a/arch/arm64/kernel/ptrace.c -+++ b/arch/arm64/kernel/ptrace.c -@@ -1107,12 +1107,13 @@ static int za_set(struct task_struct *target, - } - } - -- /* Allocate/reinit ZA storage */ -- sme_alloc(target, true); -- if (!target->thread.sme_state) { -- ret = -ENOMEM; -- goto out; -- } -+ /* -+ * Only flush the storage if PSTATE.ZA was not already set, -+ * otherwise preserve any existing data. -+ */ -+ sme_alloc(target, !thread_za_enabled(&target->thread)); -+ if (!target->thread.sme_state) -+ return -ENOMEM; - - /* If there is no data then disable ZA */ - if (!count) { --- -2.43.2 - -From 21d86d37b27de8d3ef2d0e585d26090af3ecf1d7 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ludvig=20P=C3=A4rsson?= <ludvig.parsson@axis.com> -Date: Wed, 17 Jan 2024 13:03:14 +0100 -Subject: [PATCH 0657/1501] ethtool: netlink: Add missing - ethnl_ops_begin/complete -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1808 -Lines: 53 - -[ Upstream commit f1172f3ee3a98754d95b968968920a7d03fdebcc ] - -Accessing an ethernet device that is powered off or clock gated might -cause the CPU to hang. Add ethnl_ops_begin/complete in -ethnl_set_features() to protect against this. - -Fixes: 0980bfcd6954 ("ethtool: set netdev features with FEATURES_SET request") -Signed-off-by: Ludvig Pärsson <ludvig.parsson@axis.com> -Link: https://lore.kernel.org/r/20240117-etht2-v2-1-1a96b6e8c650@axis.com -Signed-off-by: Paolo Abeni <pabeni@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/ethtool/features.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - -diff --git a/net/ethtool/features.c b/net/ethtool/features.c -index a79af8c25a07..b6cb101d7f19 100644 ---- a/net/ethtool/features.c -+++ b/net/ethtool/features.c -@@ -234,17 +234,20 @@ int ethnl_set_features(struct sk_buff *skb, struct genl_info *info) - dev = req_info.dev; - - rtnl_lock(); -+ ret = ethnl_ops_begin(dev); -+ if (ret < 0) -+ goto out_rtnl; - ethnl_features_to_bitmap(old_active, dev->features); - ethnl_features_to_bitmap(old_wanted, dev->wanted_features); - ret = ethnl_parse_bitset(req_wanted, req_mask, NETDEV_FEATURE_COUNT, - tb[ETHTOOL_A_FEATURES_WANTED], - netdev_features_strings, info->extack); - if (ret < 0) -- goto out_rtnl; -+ goto out_ops; - if (ethnl_bitmap_to_features(req_mask) & ~NETIF_F_ETHTOOL_BITS) { - GENL_SET_ERR_MSG(info, "attempt to change non-ethtool features"); - ret = -EINVAL; -- goto out_rtnl; -+ goto out_ops; - } - - /* set req_wanted bits not in req_mask from old_wanted */ -@@ -281,6 +284,8 @@ int ethnl_set_features(struct sk_buff *skb, struct genl_info *info) - if (mod) - netdev_features_change(dev); - -+out_ops: -+ ethnl_ops_complete(dev); - out_rtnl: - rtnl_unlock(); - ethnl_parse_header_dev_put(&req_info); --- -2.43.2 - -From df4bb78489b85dea545c57f3d8568022dea57f2a Mon Sep 17 00:00:00 2001 -From: Christoph Hellwig <hch@lst.de> -Date: Wed, 17 Jan 2024 18:59:01 +0100 -Subject: [PATCH 0658/1501] loop: fix the the direct I/O support check when - used on top of block devices -Content-Length: 3560 -Lines: 99 - -[ Upstream commit baa7d536077dcdfe2b70c476a8873d1745d3de0f ] - -__loop_update_dio only checks the alignment requirement for block backed -file systems, but misses them for the case where the loop device is -created directly on top of another block device. Due to this creating -a loop device with default option plus the direct I/O flag on a > 512 byte -sector size file system will lead to incorrect I/O being submitted to the -lower block device and a lot of error from the lock layer. This can -be seen with xfstests generic/563. - -Fix the code in __loop_update_dio by factoring the alignment check into -a helper, and calling that also for the struct block_device of a block -device inode. - -Also remove the TODO comment talking about dynamically switching between -buffered and direct I/O, which is a would be a recipe for horrible -performance and occasional data loss. - -Fixes: 2e5ab5f379f9 ("block: loop: prepare for supporing direct IO") -Signed-off-by: Christoph Hellwig <hch@lst.de> -Reviewed-by: Ming Lei <ming.lei@redhat.com> -Link: https://lore.kernel.org/r/20240117175901.871796-1-hch@lst.de -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/block/loop.c | 52 +++++++++++++++++++++----------------------- - 1 file changed, 25 insertions(+), 27 deletions(-) - -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index 9f2d412fc560..552f56a84a7e 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -165,39 +165,37 @@ static loff_t get_loop_size(struct loop_device *lo, struct file *file) - return get_size(lo->lo_offset, lo->lo_sizelimit, file); - } - -+/* -+ * We support direct I/O only if lo_offset is aligned with the logical I/O size -+ * of backing device, and the logical block size of loop is bigger than that of -+ * the backing device. -+ */ -+static bool lo_bdev_can_use_dio(struct loop_device *lo, -+ struct block_device *backing_bdev) -+{ -+ unsigned short sb_bsize = bdev_logical_block_size(backing_bdev); -+ -+ if (queue_logical_block_size(lo->lo_queue) < sb_bsize) -+ return false; -+ if (lo->lo_offset & (sb_bsize - 1)) -+ return false; -+ return true; -+} -+ - static void __loop_update_dio(struct loop_device *lo, bool dio) - { - struct file *file = lo->lo_backing_file; -- struct address_space *mapping = file->f_mapping; -- struct inode *inode = mapping->host; -- unsigned short sb_bsize = 0; -- unsigned dio_align = 0; -+ struct inode *inode = file->f_mapping->host; -+ struct block_device *backing_bdev = NULL; - bool use_dio; - -- if (inode->i_sb->s_bdev) { -- sb_bsize = bdev_logical_block_size(inode->i_sb->s_bdev); -- dio_align = sb_bsize - 1; -- } -+ if (S_ISBLK(inode->i_mode)) -+ backing_bdev = I_BDEV(inode); -+ else if (inode->i_sb->s_bdev) -+ backing_bdev = inode->i_sb->s_bdev; - -- /* -- * We support direct I/O only if lo_offset is aligned with the -- * logical I/O size of backing device, and the logical block -- * size of loop is bigger than the backing device's. -- * -- * TODO: the above condition may be loosed in the future, and -- * direct I/O may be switched runtime at that time because most -- * of requests in sane applications should be PAGE_SIZE aligned -- */ -- if (dio) { -- if (queue_logical_block_size(lo->lo_queue) >= sb_bsize && -- !(lo->lo_offset & dio_align) && -- (file->f_mode & FMODE_CAN_ODIRECT)) -- use_dio = true; -- else -- use_dio = false; -- } else { -- use_dio = false; -- } -+ use_dio = dio && (file->f_mode & FMODE_CAN_ODIRECT) && -+ (!backing_bdev || lo_bdev_can_use_dio(lo, backing_bdev)); - - if (lo->use_dio == use_dio) - return; --- -2.43.2 - -From 1a720f3ec16e510ff1e0d384119475bc0bdc4e26 Mon Sep 17 00:00:00 2001 -From: Amit Cohen <amcohen@nvidia.com> -Date: Wed, 17 Jan 2024 16:04:16 +0100 -Subject: [PATCH 0659/1501] mlxsw: spectrum_acl_erp: Fix error flow of pool - allocation failure -Content-Length: 6927 -Lines: 177 - -[ Upstream commit 6d6eeabcfaba2fcadf5443b575789ea606f9de83 ] - -Lately, a bug was found when many TC filters are added - at some point, -several bugs are printed to dmesg [1] and the switch is crashed with -segmentation fault. - -The issue starts when gen_pool_free() fails because of unexpected -behavior - a try to free memory which is already freed, this leads to BUG() -call which crashes the switch and makes many other bugs. - -Trying to track down the unexpected behavior led to a bug in eRP code. The -function mlxsw_sp_acl_erp_table_alloc() gets a pointer to the allocated -index, sets the value and returns an error code. When gen_pool_alloc() -fails it returns address 0, we track it and return -ENOBUFS outside, BUT -the call for gen_pool_alloc() already override the index in erp_table -structure. This is a problem when such allocation is done as part of -table expansion. This is not a new table, which will not be used in case -of allocation failure. We try to expand eRP table and override the -current index (non-zero) with zero. Then, it leads to an unexpected -behavior when address 0 is freed twice. Note that address 0 is valid in -erp_table->base_index and indeed other tables use it. - -gen_pool_alloc() fails in case that there is no space left in the -pre-allocated pool, in our case, the pool is limited to -ACL_MAX_ERPT_BANK_SIZE, which is read from hardware. When more than max -erp entries are required, we exceed the limit and return an error, this -error leads to "Failed to migrate vregion" print. - -Fix this by changing erp_table->base_index only in case of a successful -allocation. - -Add a test case for such a scenario. Without this fix it causes -segmentation fault: - -$ TESTS="max_erp_entries_test" ./tc_flower.sh -./tc_flower.sh: line 988: 1560 Segmentation fault tc filter del dev $h2 ingress chain $i protocol ip pref $i handle $j flower &>/dev/null - -[1]: -kernel BUG at lib/genalloc.c:508! -invalid opcode: 0000 [#1] PREEMPT SMP -CPU: 6 PID: 3531 Comm: tc Not tainted 6.7.0-rc5-custom-ga6893f479f5e #1 -Hardware name: Mellanox Technologies Ltd. MSN4700/VMOD0010, BIOS 5.11 07/12/2021 -RIP: 0010:gen_pool_free_owner+0xc9/0xe0 -... -Call Trace: - <TASK> - __mlxsw_sp_acl_erp_table_other_dec+0x70/0xa0 [mlxsw_spectrum] - mlxsw_sp_acl_erp_mask_destroy+0xf5/0x110 [mlxsw_spectrum] - objagg_obj_root_destroy+0x18/0x80 [objagg] - objagg_obj_destroy+0x12c/0x130 [objagg] - mlxsw_sp_acl_erp_mask_put+0x37/0x50 [mlxsw_spectrum] - mlxsw_sp_acl_ctcam_region_entry_remove+0x74/0xa0 [mlxsw_spectrum] - mlxsw_sp_acl_ctcam_entry_del+0x1e/0x40 [mlxsw_spectrum] - mlxsw_sp_acl_tcam_ventry_del+0x78/0xd0 [mlxsw_spectrum] - mlxsw_sp_flower_destroy+0x4d/0x70 [mlxsw_spectrum] - mlxsw_sp_flow_block_cb+0x73/0xb0 [mlxsw_spectrum] - tc_setup_cb_destroy+0xc1/0x180 - fl_hw_destroy_filter+0x94/0xc0 [cls_flower] - __fl_delete+0x1ac/0x1c0 [cls_flower] - fl_destroy+0xc2/0x150 [cls_flower] - tcf_proto_destroy+0x1a/0xa0 -... -mlxsw_spectrum3 0000:07:00.0: Failed to migrate vregion -mlxsw_spectrum3 0000:07:00.0: Failed to migrate vregion - -Fixes: f465261aa105 ("mlxsw: spectrum_acl: Implement common eRP core") -Signed-off-by: Amit Cohen <amcohen@nvidia.com> -Signed-off-by: Ido Schimmel <idosch@nvidia.com> -Signed-off-by: Petr Machata <petrm@nvidia.com> -Acked-by: Paolo Abeni <pabeni@redhat.com> -Link: https://lore.kernel.org/r/4cfca254dfc0e5d283974801a24371c7b6db5989.1705502064.git.petrm@nvidia.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../mellanox/mlxsw/spectrum_acl_erp.c | 8 +-- - .../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 52 ++++++++++++++++++- - 2 files changed, 56 insertions(+), 4 deletions(-) - -diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c -index 4c98950380d5..d231f4d2888b 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c -@@ -301,6 +301,7 @@ mlxsw_sp_acl_erp_table_alloc(struct mlxsw_sp_acl_erp_core *erp_core, - unsigned long *p_index) - { - unsigned int num_rows, entry_size; -+ unsigned long index; - - /* We only allow allocations of entire rows */ - if (num_erps % erp_core->num_erp_banks != 0) -@@ -309,10 +310,11 @@ mlxsw_sp_acl_erp_table_alloc(struct mlxsw_sp_acl_erp_core *erp_core, - entry_size = erp_core->erpt_entries_size[region_type]; - num_rows = num_erps / erp_core->num_erp_banks; - -- *p_index = gen_pool_alloc(erp_core->erp_tables, num_rows * entry_size); -- if (*p_index == 0) -+ index = gen_pool_alloc(erp_core->erp_tables, num_rows * entry_size); -+ if (!index) - return -ENOBUFS; -- *p_index -= MLXSW_SP_ACL_ERP_GENALLOC_OFFSET; -+ -+ *p_index = index - MLXSW_SP_ACL_ERP_GENALLOC_OFFSET; - - return 0; - } -diff --git a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh -index fb850e0ec837..7bf56ea161e3 100755 ---- a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh -+++ b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh -@@ -10,7 +10,8 @@ lib_dir=$(dirname $0)/../../../../net/forwarding - ALL_TESTS="single_mask_test identical_filters_test two_masks_test \ - multiple_masks_test ctcam_edge_cases_test delta_simple_test \ - delta_two_masks_one_key_test delta_simple_rehash_test \ -- bloom_simple_test bloom_complex_test bloom_delta_test" -+ bloom_simple_test bloom_complex_test bloom_delta_test \ -+ max_erp_entries_test" - NUM_NETIFS=2 - source $lib_dir/lib.sh - source $lib_dir/tc_common.sh -@@ -983,6 +984,55 @@ bloom_delta_test() - log_test "bloom delta test ($tcflags)" - } - -+max_erp_entries_test() -+{ -+ # The number of eRP entries is limited. Once the maximum number of eRPs -+ # has been reached, filters cannot be added. This test verifies that -+ # when this limit is reached, inserstion fails without crashing. -+ -+ RET=0 -+ -+ local num_masks=32 -+ local num_regions=15 -+ local chain_failed -+ local mask_failed -+ local ret -+ -+ if [[ "$tcflags" != "skip_sw" ]]; then -+ return 0; -+ fi -+ -+ for ((i=1; i < $num_regions; i++)); do -+ for ((j=$num_masks; j >= 0; j--)); do -+ tc filter add dev $h2 ingress chain $i protocol ip \ -+ pref $i handle $j flower $tcflags \ -+ dst_ip 192.1.0.0/$j &> /dev/null -+ ret=$? -+ -+ if [ $ret -ne 0 ]; then -+ chain_failed=$i -+ mask_failed=$j -+ break 2 -+ fi -+ done -+ done -+ -+ # We expect to exceed the maximum number of eRP entries, so that -+ # insertion eventually fails. Otherwise, the test should be adjusted to -+ # add more filters. -+ check_fail $ret "expected to exceed number of eRP entries" -+ -+ for ((; i >= 1; i--)); do -+ for ((j=0; j <= $num_masks; j++)); do -+ tc filter del dev $h2 ingress chain $i protocol ip \ -+ pref $i handle $j flower &> /dev/null -+ done -+ done -+ -+ log_test "max eRP entries test ($tcflags). " \ -+ "max chain $chain_failed, mask $mask_failed" -+} -+ - setup_prepare() - { - h1=${NETIFS[p1]} --- -2.43.2 - -From d0a1efe417c97a1e9b914056ee6b86f1ef75fe1f Mon Sep 17 00:00:00 2001 -From: Ido Schimmel <idosch@nvidia.com> -Date: Wed, 17 Jan 2024 16:04:17 +0100 -Subject: [PATCH 0660/1501] mlxsw: spectrum_acl_tcam: Fix NULL pointer - dereference in error path -Content-Length: 2516 -Lines: 67 - -[ Upstream commit efeb7dfea8ee10cdec11b6b6ba4e405edbe75809 ] - -When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after -failing to attach the region to an ACL group, we hit a NULL pointer -dereference upon 'region->group->tcam' [1]. - -Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam(). - -[1] -BUG: kernel NULL pointer dereference, address: 0000000000000000 -[...] -RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 -[...] -Call Trace: - mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 - mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 - mlxsw_sp_acl_rule_add+0x47/0x240 - mlxsw_sp_flower_replace+0x1a9/0x1d0 - tc_setup_cb_add+0xdc/0x1c0 - fl_hw_replace_filter+0x146/0x1f0 - fl_change+0xc17/0x1360 - tc_new_tfilter+0x472/0xb90 - rtnetlink_rcv_msg+0x313/0x3b0 - netlink_rcv_skb+0x58/0x100 - netlink_unicast+0x244/0x390 - netlink_sendmsg+0x1e4/0x440 - ____sys_sendmsg+0x164/0x260 - ___sys_sendmsg+0x9a/0xe0 - __sys_sendmsg+0x7a/0xc0 - do_syscall_64+0x40/0xe0 - entry_SYSCALL_64_after_hwframe+0x63/0x6b - -Fixes: 22a677661f56 ("mlxsw: spectrum: Introduce ACL core with simple TCAM implementation") -Signed-off-by: Ido Schimmel <idosch@nvidia.com> -Reviewed-by: Amit Cohen <amcohen@nvidia.com> -Reviewed-by: Jiri Pirko <jiri@nvidia.com> -Signed-off-by: Petr Machata <petrm@nvidia.com> -Acked-by: Paolo Abeni <pabeni@redhat.com> -Link: https://lore.kernel.org/r/fb6a4542bbc9fcab5a523802d97059bffbca7126.1705502064.git.petrm@nvidia.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c -index d50786b0a6ce..7d1e91196e94 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c -@@ -681,13 +681,13 @@ static void - mlxsw_sp_acl_tcam_region_destroy(struct mlxsw_sp *mlxsw_sp, - struct mlxsw_sp_acl_tcam_region *region) - { -+ struct mlxsw_sp_acl_tcam *tcam = mlxsw_sp_acl_to_tcam(mlxsw_sp->acl); - const struct mlxsw_sp_acl_tcam_ops *ops = mlxsw_sp->acl_tcam_ops; - - ops->region_fini(mlxsw_sp, region->priv); - mlxsw_sp_acl_tcam_region_disable(mlxsw_sp, region); - mlxsw_sp_acl_tcam_region_free(mlxsw_sp, region); -- mlxsw_sp_acl_tcam_region_id_put(region->group->tcam, -- region->id); -+ mlxsw_sp_acl_tcam_region_id_put(tcam, region->id); - kfree(region); - } - --- -2.43.2 - -From a361c2c1da5dbb13ca67601cf961ab3ad68af383 Mon Sep 17 00:00:00 2001 -From: Ido Schimmel <idosch@nvidia.com> -Date: Wed, 17 Jan 2024 16:04:18 +0100 -Subject: [PATCH 0661/1501] mlxsw: spectrum_acl_tcam: Fix stack corruption -Content-Length: 5756 -Lines: 154 - -[ Upstream commit 483ae90d8f976f8339cf81066312e1329f2d3706 ] - -When tc filters are first added to a net device, the corresponding local -port gets bound to an ACL group in the device. The group contains a list -of ACLs. In turn, each ACL points to a different TCAM region where the -filters are stored. During forwarding, the ACLs are sequentially -evaluated until a match is found. - -One reason to place filters in different regions is when they are added -with decreasing priorities and in an alternating order so that two -consecutive filters can never fit in the same region because of their -key usage. - -In Spectrum-2 and newer ASICs the firmware started to report that the -maximum number of ACLs in a group is more than 16, but the layout of the -register that configures ACL groups (PAGT) was not updated to account -for that. It is therefore possible to hit stack corruption [1] in the -rare case where more than 16 ACLs in a group are required. - -Fix by limiting the maximum ACL group size to the minimum between what -the firmware reports and the maximum ACLs that fit in the PAGT register. - -Add a test case to make sure the machine does not crash when this -condition is hit. - -[1] -Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: mlxsw_sp_acl_tcam_group_update+0x116/0x120 -[...] - dump_stack_lvl+0x36/0x50 - panic+0x305/0x330 - __stack_chk_fail+0x15/0x20 - mlxsw_sp_acl_tcam_group_update+0x116/0x120 - mlxsw_sp_acl_tcam_group_region_attach+0x69/0x110 - mlxsw_sp_acl_tcam_vchunk_get+0x492/0xa20 - mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 - mlxsw_sp_acl_rule_add+0x47/0x240 - mlxsw_sp_flower_replace+0x1a9/0x1d0 - tc_setup_cb_add+0xdc/0x1c0 - fl_hw_replace_filter+0x146/0x1f0 - fl_change+0xc17/0x1360 - tc_new_tfilter+0x472/0xb90 - rtnetlink_rcv_msg+0x313/0x3b0 - netlink_rcv_skb+0x58/0x100 - netlink_unicast+0x244/0x390 - netlink_sendmsg+0x1e4/0x440 - ____sys_sendmsg+0x164/0x260 - ___sys_sendmsg+0x9a/0xe0 - __sys_sendmsg+0x7a/0xc0 - do_syscall_64+0x40/0xe0 - entry_SYSCALL_64_after_hwframe+0x63/0x6b - -Fixes: c3ab435466d5 ("mlxsw: spectrum: Extend to support Spectrum-2 ASIC") -Reported-by: Orel Hagag <orelh@nvidia.com> -Signed-off-by: Ido Schimmel <idosch@nvidia.com> -Reviewed-by: Amit Cohen <amcohen@nvidia.com> -Signed-off-by: Petr Machata <petrm@nvidia.com> -Acked-by: Paolo Abeni <pabeni@redhat.com> -Link: https://lore.kernel.org/r/2d91c89afba59c22587b444994ae419dbea8d876.1705502064.git.petrm@nvidia.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../mellanox/mlxsw/spectrum_acl_tcam.c | 2 + - .../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 56 ++++++++++++++++++- - 2 files changed, 57 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c -index 7d1e91196e94..50ea1eff02b2 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c -@@ -1564,6 +1564,8 @@ int mlxsw_sp_acl_tcam_init(struct mlxsw_sp *mlxsw_sp, - tcam->max_groups = max_groups; - tcam->max_group_size = MLXSW_CORE_RES_GET(mlxsw_sp->core, - ACL_MAX_GROUP_SIZE); -+ tcam->max_group_size = min_t(unsigned int, tcam->max_group_size, -+ MLXSW_REG_PAGT_ACL_MAX_NUM); - - err = ops->init(mlxsw_sp, tcam->priv, tcam); - if (err) -diff --git a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh -index 7bf56ea161e3..616d3581419c 100755 ---- a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh -+++ b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh -@@ -11,7 +11,7 @@ ALL_TESTS="single_mask_test identical_filters_test two_masks_test \ - multiple_masks_test ctcam_edge_cases_test delta_simple_test \ - delta_two_masks_one_key_test delta_simple_rehash_test \ - bloom_simple_test bloom_complex_test bloom_delta_test \ -- max_erp_entries_test" -+ max_erp_entries_test max_group_size_test" - NUM_NETIFS=2 - source $lib_dir/lib.sh - source $lib_dir/tc_common.sh -@@ -1033,6 +1033,60 @@ max_erp_entries_test() - "max chain $chain_failed, mask $mask_failed" - } - -+max_group_size_test() -+{ -+ # The number of ACLs in an ACL group is limited. Once the maximum -+ # number of ACLs has been reached, filters cannot be added. This test -+ # verifies that when this limit is reached, insertion fails without -+ # crashing. -+ -+ RET=0 -+ -+ local num_acls=32 -+ local max_size -+ local ret -+ -+ if [[ "$tcflags" != "skip_sw" ]]; then -+ return 0; -+ fi -+ -+ for ((i=1; i < $num_acls; i++)); do -+ if [[ $(( i % 2 )) == 1 ]]; then -+ tc filter add dev $h2 ingress pref $i proto ipv4 \ -+ flower $tcflags dst_ip 198.51.100.1/32 \ -+ ip_proto tcp tcp_flags 0x01/0x01 \ -+ action drop &> /dev/null -+ else -+ tc filter add dev $h2 ingress pref $i proto ipv6 \ -+ flower $tcflags dst_ip 2001:db8:1::1/128 \ -+ action drop &> /dev/null -+ fi -+ -+ ret=$? -+ [[ $ret -ne 0 ]] && max_size=$((i - 1)) && break -+ done -+ -+ # We expect to exceed the maximum number of ACLs in a group, so that -+ # insertion eventually fails. Otherwise, the test should be adjusted to -+ # add more filters. -+ check_fail $ret "expected to exceed number of ACLs in a group" -+ -+ for ((; i >= 1; i--)); do -+ if [[ $(( i % 2 )) == 1 ]]; then -+ tc filter del dev $h2 ingress pref $i proto ipv4 \ -+ flower $tcflags dst_ip 198.51.100.1/32 \ -+ ip_proto tcp tcp_flags 0x01/0x01 \ -+ action drop &> /dev/null -+ else -+ tc filter del dev $h2 ingress pref $i proto ipv6 \ -+ flower $tcflags dst_ip 2001:db8:1::1/128 \ -+ action drop &> /dev/null -+ fi -+ done -+ -+ log_test "max ACL group size test ($tcflags). max size $max_size" -+} -+ - setup_prepare() - { - h1=${NETIFS[p1]} --- -2.43.2 - -From c5aa144f2ace920fe55c086d16530fd6101fe842 Mon Sep 17 00:00:00 2001 -From: Petr Machata <petrm@nvidia.com> -Date: Wed, 17 Jan 2024 16:04:19 +0100 -Subject: [PATCH 0662/1501] mlxsw: spectrum_router: Register netdevice notifier - before nexthop -Content-Length: 5622 -Lines: 106 - -[ Upstream commit 62bef63646c194e0f82b40304a0f2d060b28687b ] - -If there are IPIP nexthops at the time when the driver is loaded (or the -devlink instance reloaded), the driver looks up the corresponding IPIP -entry. But IPIP entries are only created as a result of netdevice -notifications. Since the netdevice notifier is registered after the nexthop -notifier, mlxsw_sp_nexthop_type_init() never finds the IPIP entry, -registers the nexthop MLXSW_SP_NEXTHOP_TYPE_ETH, and fails to assign a CRIF -to the nexthop. Later on when the CRIF is necessary, the WARN_ON in -mlxsw_sp_nexthop_rif() triggers, causing the splat [1]. - -In order to fix the issue, reorder the netdevice notifier to be registered -before the nexthop one. - -[1] (edited for clarity): - - WARNING: CPU: 1 PID: 1364 at drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:3245 mlxsw_sp_nexthop_rif (drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:3246 (discriminator 1)) mlxsw_spectrum - Hardware name: Mellanox Technologies Ltd. MSN4410/VMOD0010, BIOS 5.11 01/06/2019 - Call Trace: - ? mlxsw_sp_nexthop_rif (drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:3246 (discriminator 1)) mlxsw_spectrum - __mlxsw_sp_nexthop_eth_update (drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:3637) mlxsw_spectrum - mlxsw_sp_nexthop_update (drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:3679 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:3727) mlxsw_spectrum - mlxsw_sp_nexthop_group_update (drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:3757) mlxsw_spectrum - mlxsw_sp_nexthop_group_refresh (drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:4112) mlxsw_spectrum - mlxsw_sp_nexthop_obj_event (drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:5118 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:5191 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:5315 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:5500) mlxsw_spectrum - nexthops_dump (net/ipv4/nexthop.c:217 net/ipv4/nexthop.c:440 net/ipv4/nexthop.c:3609) - register_nexthop_notifier (net/ipv4/nexthop.c:3624) - mlxsw_sp_router_init (drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:11486) mlxsw_spectrum - mlxsw_sp_init (drivers/net/ethernet/mellanox/mlxsw/spectrum.c:3267) mlxsw_spectrum - __mlxsw_core_bus_device_register (drivers/net/ethernet/mellanox/mlxsw/core.c:2202) mlxsw_core - mlxsw_devlink_core_bus_device_reload_up (drivers/net/ethernet/mellanox/mlxsw/core.c:2265 drivers/net/ethernet/mellanox/mlxsw/core.c:1603) mlxsw_core - devlink_reload (net/devlink/dev.c:314 net/devlink/dev.c:475) - [...] - -Fixes: 9464a3d68ea9 ("mlxsw: spectrum_router: Track next hops at CRIFs") -Reported-by: Maksym Yaremchuk <maksymy@nvidia.com> -Signed-off-by: Petr Machata <petrm@nvidia.com> -Reviewed-by: Ido Schimmel <idosch@nvidia.com> -Acked-by: Paolo Abeni <pabeni@redhat.com> -Link: https://lore.kernel.org/r/74edb8d45d004e8d8f5318eede6ccc3d786d8ba9.1705502064.git.petrm@nvidia.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../ethernet/mellanox/mlxsw/spectrum_router.c | 24 +++++++++---------- - 1 file changed, 12 insertions(+), 12 deletions(-) - -diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c -index 82a95125d9ca..39e6d941fd91 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c -@@ -11458,6 +11458,13 @@ int mlxsw_sp_router_init(struct mlxsw_sp *mlxsw_sp, - if (err) - goto err_register_netevent_notifier; - -+ mlxsw_sp->router->netdevice_nb.notifier_call = -+ mlxsw_sp_router_netdevice_event; -+ err = register_netdevice_notifier_net(mlxsw_sp_net(mlxsw_sp), -+ &mlxsw_sp->router->netdevice_nb); -+ if (err) -+ goto err_register_netdev_notifier; -+ - mlxsw_sp->router->nexthop_nb.notifier_call = - mlxsw_sp_nexthop_obj_event; - err = register_nexthop_notifier(mlxsw_sp_net(mlxsw_sp), -@@ -11473,22 +11480,15 @@ int mlxsw_sp_router_init(struct mlxsw_sp *mlxsw_sp, - if (err) - goto err_register_fib_notifier; - -- mlxsw_sp->router->netdevice_nb.notifier_call = -- mlxsw_sp_router_netdevice_event; -- err = register_netdevice_notifier_net(mlxsw_sp_net(mlxsw_sp), -- &mlxsw_sp->router->netdevice_nb); -- if (err) -- goto err_register_netdev_notifier; -- - return 0; - --err_register_netdev_notifier: -- unregister_fib_notifier(mlxsw_sp_net(mlxsw_sp), -- &mlxsw_sp->router->fib_nb); - err_register_fib_notifier: - unregister_nexthop_notifier(mlxsw_sp_net(mlxsw_sp), - &mlxsw_sp->router->nexthop_nb); - err_register_nexthop_notifier: -+ unregister_netdevice_notifier_net(mlxsw_sp_net(mlxsw_sp), -+ &router->netdevice_nb); -+err_register_netdev_notifier: - unregister_netevent_notifier(&mlxsw_sp->router->netevent_nb); - err_register_netevent_notifier: - unregister_inet6addr_validator_notifier(&router->inet6addr_valid_nb); -@@ -11536,11 +11536,11 @@ void mlxsw_sp_router_fini(struct mlxsw_sp *mlxsw_sp) - { - struct mlxsw_sp_router *router = mlxsw_sp->router; - -- unregister_netdevice_notifier_net(mlxsw_sp_net(mlxsw_sp), -- &router->netdevice_nb); - unregister_fib_notifier(mlxsw_sp_net(mlxsw_sp), &router->fib_nb); - unregister_nexthop_notifier(mlxsw_sp_net(mlxsw_sp), - &router->nexthop_nb); -+ unregister_netdevice_notifier_net(mlxsw_sp_net(mlxsw_sp), -+ &router->netdevice_nb); - unregister_netevent_notifier(&router->netevent_nb); - unregister_inet6addr_validator_notifier(&router->inet6addr_valid_nb); - unregister_inetaddr_validator_notifier(&router->inetaddr_valid_nb); --- -2.43.2 - -From 3bb5849675ae1d592929798a2b37ea450879c855 Mon Sep 17 00:00:00 2001 -From: Nikita Zhandarovich <n.zhandarovich@fintech.ru> -Date: Wed, 17 Jan 2024 09:21:02 -0800 -Subject: [PATCH 0664/1501] ipv6: mcast: fix data-race in ipv6_mc_down / - mld_ifc_work -Content-Length: 2813 -Lines: 73 - -[ Upstream commit 2e7ef287f07c74985f1bf2858bedc62bd9ebf155 ] - -idev->mc_ifc_count can be written over without proper locking. - -Originally found by syzbot [1], fix this issue by encapsulating calls -to mld_ifc_stop_work() (and mld_gq_stop_work() for good measure) with -mutex_lock() and mutex_unlock() accordingly as these functions -should only be called with mc_lock per their declarations. - -[1] -BUG: KCSAN: data-race in ipv6_mc_down / mld_ifc_work - -write to 0xffff88813a80c832 of 1 bytes by task 3771 on cpu 0: - mld_ifc_stop_work net/ipv6/mcast.c:1080 [inline] - ipv6_mc_down+0x10a/0x280 net/ipv6/mcast.c:2725 - addrconf_ifdown+0xe32/0xf10 net/ipv6/addrconf.c:3949 - addrconf_notify+0x310/0x980 - notifier_call_chain kernel/notifier.c:93 [inline] - raw_notifier_call_chain+0x6b/0x1c0 kernel/notifier.c:461 - __dev_notify_flags+0x205/0x3d0 - dev_change_flags+0xab/0xd0 net/core/dev.c:8685 - do_setlink+0x9f6/0x2430 net/core/rtnetlink.c:2916 - rtnl_group_changelink net/core/rtnetlink.c:3458 [inline] - __rtnl_newlink net/core/rtnetlink.c:3717 [inline] - rtnl_newlink+0xbb3/0x1670 net/core/rtnetlink.c:3754 - rtnetlink_rcv_msg+0x807/0x8c0 net/core/rtnetlink.c:6558 - netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2545 - rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6576 - netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] - netlink_unicast+0x589/0x650 net/netlink/af_netlink.c:1368 - netlink_sendmsg+0x66e/0x770 net/netlink/af_netlink.c:1910 - ... - -write to 0xffff88813a80c832 of 1 bytes by task 22 on cpu 1: - mld_ifc_work+0x54c/0x7b0 net/ipv6/mcast.c:2653 - process_one_work kernel/workqueue.c:2627 [inline] - process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2700 - worker_thread+0x525/0x730 kernel/workqueue.c:2781 - ... - -Fixes: 2d9a93b4902b ("mld: convert from timer to delayed work") -Reported-by: syzbot+a9400cabb1d784e49abf@syzkaller.appspotmail.com -Link: https://lore.kernel.org/all/000000000000994e09060ebcdffb@google.com/ -Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru> -Acked-by: Taehee Yoo <ap420073@gmail.com> -Reviewed-by: Eric Dumazet <edumazet@google.com> -Reviewed-by: Hangbin Liu <liuhangbin@gmail.com> -Link: https://lore.kernel.org/r/20240117172102.12001-1-n.zhandarovich@fintech.ru -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/ipv6/mcast.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c -index b75d3c9d41bb..bc6e0a0bad3c 100644 ---- a/net/ipv6/mcast.c -+++ b/net/ipv6/mcast.c -@@ -2722,8 +2722,12 @@ void ipv6_mc_down(struct inet6_dev *idev) - synchronize_net(); - mld_query_stop_work(idev); - mld_report_stop_work(idev); -+ -+ mutex_lock(&idev->mc_lock); - mld_ifc_stop_work(idev); - mld_gq_stop_work(idev); -+ mutex_unlock(&idev->mc_lock); -+ - mld_dad_stop_work(idev); - } - --- -2.43.2 - -From a4f8ee0fbe9a089ff95e1333fa18d2062cee1bdc Mon Sep 17 00:00:00 2001 -From: Marek Szyprowski <m.szyprowski@samsung.com> -Date: Wed, 8 Nov 2023 17:43:52 +0100 -Subject: [PATCH 0665/1501] i2c: s3c24xx: fix read transfers in polling mode -Content-Length: 1470 -Lines: 42 - -[ Upstream commit 0d9cf23ed55d7ba3ab26d617a3ae507863674c8f ] - -To properly handle read transfers in polling mode, no waiting for the ACK -state is needed as it will never come. Just wait a bit to ensure start -state is on the bus and continue processing next bytes. - -Fixes: 117053f77a5a ("i2c: s3c2410: Add polling mode support") -Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> -Reviewed-by: Chanho Park <chanho61.park@samsung.com> -Reviewed-by: Andi Shyti <andi.shyti@kernel.org> -Signed-off-by: Wolfram Sang <wsa@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/i2c/busses/i2c-s3c2410.c | 13 +++++++++++-- - 1 file changed, 11 insertions(+), 2 deletions(-) - -diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c -index c56886af724e..bf9a5670ef33 100644 ---- a/drivers/i2c/busses/i2c-s3c2410.c -+++ b/drivers/i2c/busses/i2c-s3c2410.c -@@ -216,8 +216,17 @@ static bool is_ack(struct s3c24xx_i2c *i2c) - int tries; - - for (tries = 50; tries; --tries) { -- if (readl(i2c->regs + S3C2410_IICCON) -- & S3C2410_IICCON_IRQPEND) { -+ unsigned long tmp = readl(i2c->regs + S3C2410_IICCON); -+ -+ if (!(tmp & S3C2410_IICCON_ACKEN)) { -+ /* -+ * Wait a bit for the bus to stabilize, -+ * delay estimated experimentally. -+ */ -+ usleep_range(100, 200); -+ return true; -+ } -+ if (tmp & S3C2410_IICCON_IRQPEND) { - if (!(readl(i2c->regs + S3C2410_IICSTAT) - & S3C2410_IICSTAT_LASTBIT)) - return true; --- -2.43.2 - -From 63dee5ad48c3ba0ecf37d3e9f8fd2cd58c4032b0 Mon Sep 17 00:00:00 2001 -From: Marek Szyprowski <m.szyprowski@samsung.com> -Date: Wed, 8 Nov 2023 17:43:53 +0100 -Subject: [PATCH 0666/1501] i2c: s3c24xx: fix transferring more than one - message in polling mode -Content-Length: 2696 -Lines: 80 - -[ Upstream commit 990489e1042c6c5d6bccf56deca68f8dbeed8180 ] - -To properly handle ACK on the bus when transferring more than one -message in polling mode, move the polling handling loop from -s3c24xx_i2c_message_start() to s3c24xx_i2c_doxfer(). This way -i2c_s3c_irq_nextbyte() is always executed till the end, properly -acknowledging the IRQ bits and no recursive calls to -i2c_s3c_irq_nextbyte() are made. - -While touching this, also fix finishing transfers in polling mode by -using common code path and always waiting for the bus to become idle -and disabled. - -Fixes: 117053f77a5a ("i2c: s3c2410: Add polling mode support") -Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> -Reviewed-by: Andi Shyti <andi.shyti@kernel.org> -Signed-off-by: Wolfram Sang <wsa@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/i2c/busses/i2c-s3c2410.c | 27 ++++++++++----------------- - 1 file changed, 10 insertions(+), 17 deletions(-) - -diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c -index bf9a5670ef33..c0fe96a4f2c4 100644 ---- a/drivers/i2c/busses/i2c-s3c2410.c -+++ b/drivers/i2c/busses/i2c-s3c2410.c -@@ -279,16 +279,6 @@ static void s3c24xx_i2c_message_start(struct s3c24xx_i2c *i2c, - - stat |= S3C2410_IICSTAT_START; - writel(stat, i2c->regs + S3C2410_IICSTAT); -- -- if (i2c->quirks & QUIRK_POLL) { -- while ((i2c->msg_num != 0) && is_ack(i2c)) { -- i2c_s3c_irq_nextbyte(i2c, stat); -- stat = readl(i2c->regs + S3C2410_IICSTAT); -- -- if (stat & S3C2410_IICSTAT_ARBITR) -- dev_err(i2c->dev, "deal with arbitration loss\n"); -- } -- } - } - - static inline void s3c24xx_i2c_stop(struct s3c24xx_i2c *i2c, int ret) -@@ -694,7 +684,7 @@ static void s3c24xx_i2c_wait_idle(struct s3c24xx_i2c *i2c) - static int s3c24xx_i2c_doxfer(struct s3c24xx_i2c *i2c, - struct i2c_msg *msgs, int num) - { -- unsigned long timeout; -+ unsigned long timeout = 0; - int ret; - - ret = s3c24xx_i2c_set_master(i2c); -@@ -714,16 +704,19 @@ static int s3c24xx_i2c_doxfer(struct s3c24xx_i2c *i2c, - s3c24xx_i2c_message_start(i2c, msgs); - - if (i2c->quirks & QUIRK_POLL) { -- ret = i2c->msg_idx; -+ while ((i2c->msg_num != 0) && is_ack(i2c)) { -+ unsigned long stat = readl(i2c->regs + S3C2410_IICSTAT); - -- if (ret != num) -- dev_dbg(i2c->dev, "incomplete xfer (%d)\n", ret); -+ i2c_s3c_irq_nextbyte(i2c, stat); - -- goto out; -+ stat = readl(i2c->regs + S3C2410_IICSTAT); -+ if (stat & S3C2410_IICSTAT_ARBITR) -+ dev_err(i2c->dev, "deal with arbitration loss\n"); -+ } -+ } else { -+ timeout = wait_event_timeout(i2c->wait, i2c->msg_num == 0, HZ * 5); - } - -- timeout = wait_event_timeout(i2c->wait, i2c->msg_num == 0, HZ * 5); -- - ret = i2c->msg_idx; - - /* --- -2.43.2 - -From b5beb861861c7d63fec0f96387fbedef566c099c Mon Sep 17 00:00:00 2001 -From: Mimi Zohar <zohar@linux.ibm.com> -Date: Wed, 24 Jan 2024 14:21:44 -0500 -Subject: [PATCH 0667/1501] Revert "KEYS: encrypted: Add check for strsep" -Content-Length: 1072 -Lines: 32 - -commit 1ed4b563100230ea68821a2b25a3d9f25388a3e6 upstream. - -This reverts commit b4af096b5df5dd131ab796c79cedc7069d8f4882. - -New encrypted keys are created either from kernel-generated random -numbers or user-provided decrypted data. Revert the change requiring -user-provided decrypted data. - -Reported-by: Vishal Verma <vishal.l.verma@intel.com> -Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - security/keys/encrypted-keys/encrypted.c | 4 ---- - 1 file changed, 4 deletions(-) - -diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c -index 76f55dd13cb8..8af2136069d2 100644 ---- a/security/keys/encrypted-keys/encrypted.c -+++ b/security/keys/encrypted-keys/encrypted.c -@@ -237,10 +237,6 @@ static int datablob_parse(char *datablob, const char **format, - break; - } - *decrypted_data = strsep(&datablob, " \t"); -- if (!*decrypted_data) { -- pr_info("encrypted_key: decrypted_data is missing\n"); -- break; -- } - ret = 0; - break; - case Opt_load: --- -2.43.2 - -From 87165c64fe1a98bbab7280c58df3c83be2c98478 Mon Sep 17 00:00:00 2001 -From: Song Liu <song@kernel.org> -Date: Thu, 25 Jan 2024 00:21:31 -0800 -Subject: [PATCH 0669/1501] Revert "Revert "md/raid5: Wait for - MD_SB_CHANGE_PENDING in raid5d"" -Content-Length: 2054 -Lines: 60 - -This reverts commit bed9e27baf52a09b7ba2a3714f1e24e17ced386d. - -The original set [1][2] was expected to undo a suboptimal fix in [2], and -replace it with a better fix [1]. However, as reported by Dan Moulding [2] -causes an issue with raid5 with journal device. - -Revert [2] for now to close the issue. We will follow up on another issue -reported by Juxiao Bi, as [2] is expected to fix it. We believe this is a -good trade-off, because the latter issue happens less freqently. - -In the meanwhile, we will NOT revert [1], as it contains the right logic. - -[1] commit d6e035aad6c0 ("md: bypass block throttle for superblock update") -[2] commit bed9e27baf52 ("Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"") - -Reported-by: Dan Moulding <dan@danm.net> -Closes: https://lore.kernel.org/linux-raid/20240123005700.9302-1-dan@danm.net/ -Fixes: bed9e27baf52 ("Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"") -Cc: stable@vger.kernel.org # v5.19+ -Cc: Junxiao Bi <junxiao.bi@oracle.com> -Cc: Yu Kuai <yukuai3@huawei.com> -Signed-off-by: Song Liu <song@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/md/raid5.c | 12 ++++++++++++ - 1 file changed, 12 insertions(+) - -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index b02b1a3010f7..26e1e8a5e941 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -36,6 +36,7 @@ - */ - - #include <linux/blkdev.h> -+#include <linux/delay.h> - #include <linux/kthread.h> - #include <linux/raid/pq.h> - #include <linux/async_tx.h> -@@ -6819,7 +6820,18 @@ static void raid5d(struct md_thread *thread) - spin_unlock_irq(&conf->device_lock); - md_check_recovery(mddev); - spin_lock_irq(&conf->device_lock); -+ -+ /* -+ * Waiting on MD_SB_CHANGE_PENDING below may deadlock -+ * seeing md_check_recovery() is needed to clear -+ * the flag when using mdmon. -+ */ -+ continue; - } -+ -+ wait_event_lock_irq(mddev->sb_wait, -+ !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags), -+ conf->device_lock); - } - pr_debug("%d stripes handled\n", handled); - --- -2.43.2 - -From 7bbf3b67cb49d0f8a20e64b7473923041b758211 Mon Sep 17 00:00:00 2001 -From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Date: Thu, 25 Jan 2024 15:45:31 -0800 -Subject: [PATCH 0670/1501] Linux 6.7.2 -Content-Length: 1279 -Lines: 37 - -Link: https://lore.kernel.org/r/20240122235818.091081209@linuxfoundation.org -Tested-by: SeongJae Park <sj@kernel.org> -Tested-by: Ronald Warsow <rwarsow@gmx.de> -Tested-by: Luna Jernberg <droidbittin@gmail.com> -Tested-by: Ron Economos <re@w6rz.net> -Tested-by: Allen Pais <apais@linux.microsoft.com> -Link: https://lore.kernel.org/r/20240123174544.648088948@linuxfoundation.org -Tested-by: Ronald Warsow <rwarsow@gmx.de> -Tested-by: SeongJae Park <sj@kernel.org> -Tested-by: Salvatore Bonaccorso <carnil@debian.org> -Tested-by: Justin M. Forbes <jforbes@fedoraproject.org> -Tested-by: Luna Jernberg <droidbittin@gmail.com> -Tested-by: Bagas Sanjaya <bagasdotme@gmail.com> -Tested-by: Jon Hunter <jonathanh@nvidia.com> -Tested-by: Linux Kernel Functional Testing <lkft@linaro.org> -Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> -Tested-by: Miguel Ojeda <ojeda@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - Makefile | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Makefile b/Makefile -index 186da2386a06..0564d3d09395 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 7 --SUBLEVEL = 1 -+SUBLEVEL = 2 - EXTRAVERSION = - NAME = Hurr durr I'ma ninja sloth - --- -2.43.2 - -From 7364e2e244d833ed48b0084f2eeeb817a2c687f5 Mon Sep 17 00:00:00 2001 -From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> -Date: Tue, 17 Oct 2023 11:09:32 -0500 -Subject: [PATCH 0671/1501] soundwire: bus: introduce controller_id -Content-Length: 6097 -Lines: 154 - -[ Upstream commit 6543ac13c623f906200dfd3f1c407d8d333b6995 ] - -The existing SoundWire support misses a clear Controller/Manager -hiearchical definition to deal with all variants across SOC vendors. - -a) Intel platforms have one controller with 4 or more Managers. -b) AMD platforms have two controllers with one Manager each, but due -to BIOS issues use two different link_id values within the scope of a -single controller. -c) QCOM platforms have one or more controller with one Manager each. - -This patch adds a 'controller_id' which can be set by higher -levels. If assigned to -1, the controller_id will be set to the -system-unique IDA-assigned bus->id. - -The main change is that the bus->id is no longer used for any device -name, which makes the definition completely predictable and not -dependent on any enumeration order. The bus->id is only used to insert -the Managers in the stream rt context. - -Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> -Reviewed-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> -Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> -Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> -Tested-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> -Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> -Link: https://lore.kernel.org/stable/20231017160933.12624-2-pierre-louis.bossart%40linux.intel.com -Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> -Link: https://lore.kernel.org/r/20231017160933.12624-2-pierre-louis.bossart@linux.intel.com -Signed-off-by: Vinod Koul <vkoul@kernel.org> -Stable-dep-of: 8a8a9ac8a497 ("soundwire: fix initializing sysfs for same devices on different buses") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/soundwire/amd_manager.c | 8 ++++++++ - drivers/soundwire/bus.c | 4 ++++ - drivers/soundwire/debugfs.c | 2 +- - drivers/soundwire/intel_auxdevice.c | 3 +++ - drivers/soundwire/master.c | 2 +- - drivers/soundwire/qcom.c | 3 +++ - include/linux/soundwire/sdw.h | 4 +++- - 7 files changed, 23 insertions(+), 3 deletions(-) - -diff --git a/drivers/soundwire/amd_manager.c b/drivers/soundwire/amd_manager.c -index 3a99f6dcdfaf..a3b1f4e6f0f9 100644 ---- a/drivers/soundwire/amd_manager.c -+++ b/drivers/soundwire/amd_manager.c -@@ -927,6 +927,14 @@ static int amd_sdw_manager_probe(struct platform_device *pdev) - amd_manager->bus.clk_stop_timeout = 200; - amd_manager->bus.link_id = amd_manager->instance; - -+ /* -+ * Due to BIOS compatibility, the two links are exposed within -+ * the scope of a single controller. If this changes, the -+ * controller_id will have to be updated with drv_data -+ * information. -+ */ -+ amd_manager->bus.controller_id = 0; -+ - switch (amd_manager->instance) { - case ACP_SDW0: - amd_manager->num_dout_ports = AMD_SDW0_MAX_TX_PORTS; -diff --git a/drivers/soundwire/bus.c b/drivers/soundwire/bus.c -index 41b0d9adf68e..f3fec15c3112 100644 ---- a/drivers/soundwire/bus.c -+++ b/drivers/soundwire/bus.c -@@ -22,6 +22,10 @@ static int sdw_get_id(struct sdw_bus *bus) - return rc; - - bus->id = rc; -+ -+ if (bus->controller_id == -1) -+ bus->controller_id = rc; -+ - return 0; - } - -diff --git a/drivers/soundwire/debugfs.c b/drivers/soundwire/debugfs.c -index d1553cb77187..67abd7e52f09 100644 ---- a/drivers/soundwire/debugfs.c -+++ b/drivers/soundwire/debugfs.c -@@ -20,7 +20,7 @@ void sdw_bus_debugfs_init(struct sdw_bus *bus) - return; - - /* create the debugfs master-N */ -- snprintf(name, sizeof(name), "master-%d-%d", bus->id, bus->link_id); -+ snprintf(name, sizeof(name), "master-%d-%d", bus->controller_id, bus->link_id); - bus->debugfs = debugfs_create_dir(name, sdw_debugfs_root); - } - -diff --git a/drivers/soundwire/intel_auxdevice.c b/drivers/soundwire/intel_auxdevice.c -index 7f15e3549e53..93698532deac 100644 ---- a/drivers/soundwire/intel_auxdevice.c -+++ b/drivers/soundwire/intel_auxdevice.c -@@ -234,6 +234,9 @@ static int intel_link_probe(struct auxiliary_device *auxdev, - cdns->instance = sdw->instance; - cdns->msg_count = 0; - -+ /* single controller for all SoundWire links */ -+ bus->controller_id = 0; -+ - bus->link_id = auxdev->id; - bus->clk_stop_timeout = 1; - -diff --git a/drivers/soundwire/master.c b/drivers/soundwire/master.c -index 9b05c9e25ebe..51abedbbaa66 100644 ---- a/drivers/soundwire/master.c -+++ b/drivers/soundwire/master.c -@@ -145,7 +145,7 @@ int sdw_master_device_add(struct sdw_bus *bus, struct device *parent, - md->dev.fwnode = fwnode; - md->dev.dma_mask = parent->dma_mask; - -- dev_set_name(&md->dev, "sdw-master-%d", bus->id); -+ dev_set_name(&md->dev, "sdw-master-%d-%d", bus->controller_id, bus->link_id); - - ret = device_register(&md->dev); - if (ret) { -diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c -index a1e2d6c98186..8e027eee8b73 100644 ---- a/drivers/soundwire/qcom.c -+++ b/drivers/soundwire/qcom.c -@@ -1624,6 +1624,9 @@ static int qcom_swrm_probe(struct platform_device *pdev) - } - } - -+ /* FIXME: is there a DT-defined value to use ? */ -+ ctrl->bus.controller_id = -1; -+ - ret = sdw_bus_master_add(&ctrl->bus, dev, dev->fwnode); - if (ret) { - dev_err(dev, "Failed to register Soundwire controller (%d)\n", -diff --git a/include/linux/soundwire/sdw.h b/include/linux/soundwire/sdw.h -index 4f3d14bb1538..c383579a008b 100644 ---- a/include/linux/soundwire/sdw.h -+++ b/include/linux/soundwire/sdw.h -@@ -886,7 +886,8 @@ struct sdw_master_ops { - * struct sdw_bus - SoundWire bus - * @dev: Shortcut to &bus->md->dev to avoid changing the entire code. - * @md: Master device -- * @link_id: Link id number, can be 0 to N, unique for each Master -+ * @controller_id: system-unique controller ID. If set to -1, the bus @id will be used. -+ * @link_id: Link id number, can be 0 to N, unique for each Controller - * @id: bus system-wide unique id - * @slaves: list of Slaves on this bus - * @assigned: Bitmap for Slave device numbers. -@@ -918,6 +919,7 @@ struct sdw_master_ops { - struct sdw_bus { - struct device *dev; - struct sdw_master_device *md; -+ int controller_id; - unsigned int link_id; - int id; - struct list_head slaves; --- -2.43.2 - -From a434c75e0671f925f0c534b0a2284de7b8f164e0 Mon Sep 17 00:00:00 2001 -From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> -Date: Tue, 17 Oct 2023 11:09:33 -0500 -Subject: [PATCH 0672/1501] soundwire: fix initializing sysfs for same devices - on different buses -Content-Length: 3642 -Lines: 81 - -[ Upstream commit 8a8a9ac8a4972ee69d3dd3d1ae43963ae39cee18 ] - -If same devices with same device IDs are present on different soundwire -buses, the probe fails due to conflicting device names and sysfs -entries: - - sysfs: cannot create duplicate filename '/bus/soundwire/devices/sdw:0:0217:0204:00:0' - -The link ID is 0 for both devices, so they should be differentiated by -the controller ID. Add the controller ID so, the device names and sysfs entries look -like: - - sdw:1:0:0217:0204:00:0 -> ../../../devices/platform/soc@0/6ab0000.soundwire-controller/sdw-master-1-0/sdw:1:0:0217:0204:00:0 - sdw:3:0:0217:0204:00:0 -> ../../../devices/platform/soc@0/6b10000.soundwire-controller/sdw-master-3-0/sdw:3:0:0217:0204:00:0 - -[PLB changes: use bus->controller_id instead of bus->id] - -Fixes: 7c3cd189b86d ("soundwire: Add Master registration") -Cc: stable@vger.kernel.org -Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> -Reviewed-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> -Co-developed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> -Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> -Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> -Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> -Tested-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> -Acked-by: Mark Brown <broonie@kernel.org> -Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> -Link: https://lore.kernel.org/r/20231017160933.12624-3-pierre-louis.bossart@linux.intel.com -Signed-off-by: Vinod Koul <vkoul@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/soundwire/slave.c | 12 ++++++------ - sound/soc/intel/boards/sof_sdw.c | 4 ++-- - 2 files changed, 8 insertions(+), 8 deletions(-) - -diff --git a/drivers/soundwire/slave.c b/drivers/soundwire/slave.c -index c1c1a2ac293a..060c2982e26b 100644 ---- a/drivers/soundwire/slave.c -+++ b/drivers/soundwire/slave.c -@@ -39,14 +39,14 @@ int sdw_slave_add(struct sdw_bus *bus, - slave->dev.fwnode = fwnode; - - if (id->unique_id == SDW_IGNORED_UNIQUE_ID) { -- /* name shall be sdw:link:mfg:part:class */ -- dev_set_name(&slave->dev, "sdw:%01x:%04x:%04x:%02x", -- bus->link_id, id->mfg_id, id->part_id, -+ /* name shall be sdw:ctrl:link:mfg:part:class */ -+ dev_set_name(&slave->dev, "sdw:%01x:%01x:%04x:%04x:%02x", -+ bus->controller_id, bus->link_id, id->mfg_id, id->part_id, - id->class_id); - } else { -- /* name shall be sdw:link:mfg:part:class:unique */ -- dev_set_name(&slave->dev, "sdw:%01x:%04x:%04x:%02x:%01x", -- bus->link_id, id->mfg_id, id->part_id, -+ /* name shall be sdw:ctrl:link:mfg:part:class:unique */ -+ dev_set_name(&slave->dev, "sdw:%01x:%01x:%04x:%04x:%02x:%01x", -+ bus->controller_id, bus->link_id, id->mfg_id, id->part_id, - id->class_id, id->unique_id); - } - -diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c -index 4e4284729773..1e788859c863 100644 ---- a/sound/soc/intel/boards/sof_sdw.c -+++ b/sound/soc/intel/boards/sof_sdw.c -@@ -1232,11 +1232,11 @@ static int fill_sdw_codec_dlc(struct device *dev, - else if (is_unique_device(adr_link, sdw_version, mfg_id, part_id, - class_id, adr_index)) - codec->name = devm_kasprintf(dev, GFP_KERNEL, -- "sdw:%01x:%04x:%04x:%02x", link_id, -+ "sdw:0:%01x:%04x:%04x:%02x", link_id, - mfg_id, part_id, class_id); - else - codec->name = devm_kasprintf(dev, GFP_KERNEL, -- "sdw:%01x:%04x:%04x:%02x:%01x", link_id, -+ "sdw:0:%01x:%04x:%04x:%02x:%01x", link_id, - mfg_id, part_id, class_id, unique_id); - - if (!codec->name) --- -2.43.2 - -From b05c9588c7c0f97d86dc6442cc86c97b2341beec Mon Sep 17 00:00:00 2001 -From: Marcelo Schmitt <marcelo.schmitt@analog.com> -Date: Sat, 16 Dec 2023 14:46:37 -0300 -Subject: [PATCH 0673/1501] iio: adc: ad7091r: Set alert bit in config register -Content-Length: 1758 -Lines: 45 - -[ Upstream commit 149694f5e79b0c7a36ceb76e7c0d590db8f151c1 ] - -The ad7091r-base driver sets up an interrupt handler for firing events -when inputs are either above or below a certain threshold. -However, for the interrupt signal to come from the device it must be -configured to enable the ALERT/BUSY/GPO pin to be used as ALERT, which -was not being done until now. -Enable interrupt signals on the ALERT/BUSY/GPO pin by setting the proper -bit in the configuration register. - -Signed-off-by: Marcelo Schmitt <marcelo.schmitt@analog.com> -Link: https://lore.kernel.org/r/e8da2ee98d6df88318b14baf3dc9630e20218418.1702746240.git.marcelo.schmitt1@gmail.com -Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> -Stable-dep-of: 020e71c7ffc2 ("iio: adc: ad7091r: Allow users to configure device events") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/iio/adc/ad7091r-base.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/drivers/iio/adc/ad7091r-base.c b/drivers/iio/adc/ad7091r-base.c -index 0e5d3d2e9c98..8aaa854f816f 100644 ---- a/drivers/iio/adc/ad7091r-base.c -+++ b/drivers/iio/adc/ad7091r-base.c -@@ -28,6 +28,7 @@ - #define AD7091R_REG_RESULT_CONV_RESULT(x) ((x) & 0xfff) - - /* AD7091R_REG_CONF */ -+#define AD7091R_REG_CONF_ALERT_EN BIT(4) - #define AD7091R_REG_CONF_AUTO BIT(8) - #define AD7091R_REG_CONF_CMD BIT(10) - -@@ -232,6 +233,11 @@ int ad7091r_probe(struct device *dev, const char *name, - iio_dev->channels = chip_info->channels; - - if (irq) { -+ ret = regmap_update_bits(st->map, AD7091R_REG_CONF, -+ AD7091R_REG_CONF_ALERT_EN, BIT(4)); -+ if (ret) -+ return ret; -+ - ret = devm_request_threaded_irq(dev, irq, NULL, - ad7091r_event_handler, - IRQF_TRIGGER_FALLING | IRQF_ONESHOT, name, iio_dev); --- -2.43.2 - -From 55aca2ce91a63740278502066beaddbd841af9c6 Mon Sep 17 00:00:00 2001 -From: Marcelo Schmitt <marcelo.schmitt@analog.com> -Date: Tue, 19 Dec 2023 17:26:01 -0300 -Subject: [PATCH 0674/1501] iio: adc: ad7091r: Allow users to configure device - events -Content-Length: 8815 -Lines: 287 - -[ Upstream commit 020e71c7ffc25dfe29ed9be6c2d39af7bd7f661f ] - -AD7091R-5 devices are supported by the ad7091r-5 driver together with -the ad7091r-base driver. Those drivers declared iio events for notifying -user space when ADC readings fall bellow the thresholds of low limit -registers or above the values set in high limit registers. -However, to configure iio events and their thresholds, a set of callback -functions must be implemented and those were not present until now. -The consequence of trying to configure ad7091r-5 events without the -proper callback functions was a null pointer dereference in the kernel -because the pointers to the callback functions were not set. - -Implement event configuration callbacks allowing users to read/write -event thresholds and enable/disable event generation. - -Since the event spec structs are generic to AD7091R devices, also move -those from the ad7091r-5 driver the base driver so they can be reused -when support for ad7091r-2/-4/-8 be added. - -Fixes: ca69300173b6 ("iio: adc: Add support for AD7091R5 ADC") -Suggested-by: David Lechner <dlechner@baylibre.com> -Signed-off-by: Marcelo Schmitt <marcelo.schmitt@analog.com> -Link: https://lore.kernel.org/r/59552d3548dabd56adc3107b7b4869afee2b0c3c.1703013352.git.marcelo.schmitt1@gmail.com -Cc: <Stable@vger.kernel.org> -Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/iio/adc/ad7091r-base.c | 156 +++++++++++++++++++++++++++++++++ - drivers/iio/adc/ad7091r-base.h | 6 ++ - drivers/iio/adc/ad7091r5.c | 28 +----- - 3 files changed, 166 insertions(+), 24 deletions(-) - -diff --git a/drivers/iio/adc/ad7091r-base.c b/drivers/iio/adc/ad7091r-base.c -index 8aaa854f816f..3d36bcd26b0c 100644 ---- a/drivers/iio/adc/ad7091r-base.c -+++ b/drivers/iio/adc/ad7091r-base.c -@@ -6,6 +6,7 @@ - */ - - #include <linux/bitops.h> -+#include <linux/bitfield.h> - #include <linux/iio/events.h> - #include <linux/iio/iio.h> - #include <linux/interrupt.h> -@@ -50,6 +51,27 @@ struct ad7091r_state { - struct mutex lock; /*lock to prevent concurent reads */ - }; - -+const struct iio_event_spec ad7091r_events[] = { -+ { -+ .type = IIO_EV_TYPE_THRESH, -+ .dir = IIO_EV_DIR_RISING, -+ .mask_separate = BIT(IIO_EV_INFO_VALUE) | -+ BIT(IIO_EV_INFO_ENABLE), -+ }, -+ { -+ .type = IIO_EV_TYPE_THRESH, -+ .dir = IIO_EV_DIR_FALLING, -+ .mask_separate = BIT(IIO_EV_INFO_VALUE) | -+ BIT(IIO_EV_INFO_ENABLE), -+ }, -+ { -+ .type = IIO_EV_TYPE_THRESH, -+ .dir = IIO_EV_DIR_EITHER, -+ .mask_separate = BIT(IIO_EV_INFO_HYSTERESIS), -+ }, -+}; -+EXPORT_SYMBOL_NS_GPL(ad7091r_events, IIO_AD7091R); -+ - static int ad7091r_set_mode(struct ad7091r_state *st, enum ad7091r_mode mode) - { - int ret, conf; -@@ -169,8 +191,142 @@ static int ad7091r_read_raw(struct iio_dev *iio_dev, - return ret; - } - -+static int ad7091r_read_event_config(struct iio_dev *indio_dev, -+ const struct iio_chan_spec *chan, -+ enum iio_event_type type, -+ enum iio_event_direction dir) -+{ -+ struct ad7091r_state *st = iio_priv(indio_dev); -+ int val, ret; -+ -+ switch (dir) { -+ case IIO_EV_DIR_RISING: -+ ret = regmap_read(st->map, -+ AD7091R_REG_CH_HIGH_LIMIT(chan->channel), -+ &val); -+ if (ret) -+ return ret; -+ return val != AD7091R_HIGH_LIMIT; -+ case IIO_EV_DIR_FALLING: -+ ret = regmap_read(st->map, -+ AD7091R_REG_CH_LOW_LIMIT(chan->channel), -+ &val); -+ if (ret) -+ return ret; -+ return val != AD7091R_LOW_LIMIT; -+ default: -+ return -EINVAL; -+ } -+} -+ -+static int ad7091r_write_event_config(struct iio_dev *indio_dev, -+ const struct iio_chan_spec *chan, -+ enum iio_event_type type, -+ enum iio_event_direction dir, int state) -+{ -+ struct ad7091r_state *st = iio_priv(indio_dev); -+ -+ if (state) { -+ return regmap_set_bits(st->map, AD7091R_REG_CONF, -+ AD7091R_REG_CONF_ALERT_EN); -+ } else { -+ /* -+ * Set thresholds either to 0 or to 2^12 - 1 as appropriate to -+ * prevent alerts and thus disable event generation. -+ */ -+ switch (dir) { -+ case IIO_EV_DIR_RISING: -+ return regmap_write(st->map, -+ AD7091R_REG_CH_HIGH_LIMIT(chan->channel), -+ AD7091R_HIGH_LIMIT); -+ case IIO_EV_DIR_FALLING: -+ return regmap_write(st->map, -+ AD7091R_REG_CH_LOW_LIMIT(chan->channel), -+ AD7091R_LOW_LIMIT); -+ default: -+ return -EINVAL; -+ } -+ } -+} -+ -+static int ad7091r_read_event_value(struct iio_dev *indio_dev, -+ const struct iio_chan_spec *chan, -+ enum iio_event_type type, -+ enum iio_event_direction dir, -+ enum iio_event_info info, int *val, int *val2) -+{ -+ struct ad7091r_state *st = iio_priv(indio_dev); -+ int ret; -+ -+ switch (info) { -+ case IIO_EV_INFO_VALUE: -+ switch (dir) { -+ case IIO_EV_DIR_RISING: -+ ret = regmap_read(st->map, -+ AD7091R_REG_CH_HIGH_LIMIT(chan->channel), -+ val); -+ if (ret) -+ return ret; -+ return IIO_VAL_INT; -+ case IIO_EV_DIR_FALLING: -+ ret = regmap_read(st->map, -+ AD7091R_REG_CH_LOW_LIMIT(chan->channel), -+ val); -+ if (ret) -+ return ret; -+ return IIO_VAL_INT; -+ default: -+ return -EINVAL; -+ } -+ case IIO_EV_INFO_HYSTERESIS: -+ ret = regmap_read(st->map, -+ AD7091R_REG_CH_HYSTERESIS(chan->channel), -+ val); -+ if (ret) -+ return ret; -+ return IIO_VAL_INT; -+ default: -+ return -EINVAL; -+ } -+} -+ -+static int ad7091r_write_event_value(struct iio_dev *indio_dev, -+ const struct iio_chan_spec *chan, -+ enum iio_event_type type, -+ enum iio_event_direction dir, -+ enum iio_event_info info, int val, int val2) -+{ -+ struct ad7091r_state *st = iio_priv(indio_dev); -+ -+ switch (info) { -+ case IIO_EV_INFO_VALUE: -+ switch (dir) { -+ case IIO_EV_DIR_RISING: -+ return regmap_write(st->map, -+ AD7091R_REG_CH_HIGH_LIMIT(chan->channel), -+ val); -+ case IIO_EV_DIR_FALLING: -+ return regmap_write(st->map, -+ AD7091R_REG_CH_LOW_LIMIT(chan->channel), -+ val); -+ default: -+ return -EINVAL; -+ } -+ case IIO_EV_INFO_HYSTERESIS: -+ return regmap_write(st->map, -+ AD7091R_REG_CH_HYSTERESIS(chan->channel), -+ val); -+ default: -+ return -EINVAL; -+ } -+} -+ - static const struct iio_info ad7091r_info = { - .read_raw = ad7091r_read_raw, -+ .read_event_config = &ad7091r_read_event_config, -+ .write_event_config = &ad7091r_write_event_config, -+ .read_event_value = &ad7091r_read_event_value, -+ .write_event_value = &ad7091r_write_event_value, - }; - - static irqreturn_t ad7091r_event_handler(int irq, void *private) -diff --git a/drivers/iio/adc/ad7091r-base.h b/drivers/iio/adc/ad7091r-base.h -index 509748aef9b1..7a78976a2f80 100644 ---- a/drivers/iio/adc/ad7091r-base.h -+++ b/drivers/iio/adc/ad7091r-base.h -@@ -8,6 +8,10 @@ - #ifndef __DRIVERS_IIO_ADC_AD7091R_BASE_H__ - #define __DRIVERS_IIO_ADC_AD7091R_BASE_H__ - -+/* AD7091R_REG_CH_LIMIT */ -+#define AD7091R_HIGH_LIMIT 0xFFF -+#define AD7091R_LOW_LIMIT 0x0 -+ - struct device; - struct ad7091r_state; - -@@ -17,6 +21,8 @@ struct ad7091r_chip_info { - unsigned int vref_mV; - }; - -+extern const struct iio_event_spec ad7091r_events[3]; -+ - extern const struct regmap_config ad7091r_regmap_config; - - int ad7091r_probe(struct device *dev, const char *name, -diff --git a/drivers/iio/adc/ad7091r5.c b/drivers/iio/adc/ad7091r5.c -index 2f048527b7b7..dae98c95ebb8 100644 ---- a/drivers/iio/adc/ad7091r5.c -+++ b/drivers/iio/adc/ad7091r5.c -@@ -12,26 +12,6 @@ - - #include "ad7091r-base.h" - --static const struct iio_event_spec ad7091r5_events[] = { -- { -- .type = IIO_EV_TYPE_THRESH, -- .dir = IIO_EV_DIR_RISING, -- .mask_separate = BIT(IIO_EV_INFO_VALUE) | -- BIT(IIO_EV_INFO_ENABLE), -- }, -- { -- .type = IIO_EV_TYPE_THRESH, -- .dir = IIO_EV_DIR_FALLING, -- .mask_separate = BIT(IIO_EV_INFO_VALUE) | -- BIT(IIO_EV_INFO_ENABLE), -- }, -- { -- .type = IIO_EV_TYPE_THRESH, -- .dir = IIO_EV_DIR_EITHER, -- .mask_separate = BIT(IIO_EV_INFO_HYSTERESIS), -- }, --}; -- - #define AD7091R_CHANNEL(idx, bits, ev, num_ev) { \ - .type = IIO_VOLTAGE, \ - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), \ -@@ -44,10 +24,10 @@ static const struct iio_event_spec ad7091r5_events[] = { - .scan_type.realbits = bits, \ - } - static const struct iio_chan_spec ad7091r5_channels_irq[] = { -- AD7091R_CHANNEL(0, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)), -- AD7091R_CHANNEL(1, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)), -- AD7091R_CHANNEL(2, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)), -- AD7091R_CHANNEL(3, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)), -+ AD7091R_CHANNEL(0, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)), -+ AD7091R_CHANNEL(1, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)), -+ AD7091R_CHANNEL(2, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)), -+ AD7091R_CHANNEL(3, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)), - }; - - static const struct iio_chan_spec ad7091r5_channels_noirq[] = { --- -2.43.2 - -From 6fb70694f8d1ac34e45246b0ac988f025e1e5b55 Mon Sep 17 00:00:00 2001 -From: Lukas Schauer <lukas@schauer.dev> -Date: Fri, 1 Dec 2023 11:11:28 +0100 -Subject: [PATCH 0675/1501] pipe: wakeup wr_wait after setting max_usage -Content-Length: 1932 -Lines: 54 - -commit e95aada4cb93d42e25c30a0ef9eb2923d9711d4a upstream. - -Commit c73be61cede5 ("pipe: Add general notification queue support") a -regression was introduced that would lock up resized pipes under certain -conditions. See the reproducer in [1]. - -The commit resizing the pipe ring size was moved to a different -function, doing that moved the wakeup for pipe->wr_wait before actually -raising pipe->max_usage. If a pipe was full before the resize occured it -would result in the wakeup never actually triggering pipe_write. - -Set @max_usage and @nr_accounted before waking writers if this isn't a -watch queue. - -Link: https://bugzilla.kernel.org/show_bug.cgi?id=212295 [1] -Link: https://lore.kernel.org/r/20231201-orchideen-modewelt-e009de4562c6@brauner -Fixes: c73be61cede5 ("pipe: Add general notification queue support") -Reviewed-by: David Howells <dhowells@redhat.com> -Cc: <stable@vger.kernel.org> -Signed-off-by: Lukas Schauer <lukas@schauer.dev> -[Christian Brauner <brauner@kernel.org>: rewrite to account for watch queues] -Signed-off-by: Christian Brauner <brauner@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/pipe.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/fs/pipe.c b/fs/pipe.c -index 226e7f66b590..8d9286a1f2e8 100644 ---- a/fs/pipe.c -+++ b/fs/pipe.c -@@ -1324,6 +1324,11 @@ int pipe_resize_ring(struct pipe_inode_info *pipe, unsigned int nr_slots) - pipe->tail = tail; - pipe->head = head; - -+ if (!pipe_has_watch_queue(pipe)) { -+ pipe->max_usage = nr_slots; -+ pipe->nr_accounted = nr_slots; -+ } -+ - spin_unlock_irq(&pipe->rd_wait.lock); - - /* This might have made more room for writers */ -@@ -1375,8 +1380,6 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned int arg) - if (ret < 0) - goto out_revert_acct; - -- pipe->max_usage = nr_slots; -- pipe->nr_accounted = nr_slots; - return pipe->max_usage * PAGE_SIZE; - - out_revert_acct: --- -2.43.2 - -From d0f0780f03df54d08ced118d27834ee5008724e4 Mon Sep 17 00:00:00 2001 -From: Geoff Levand <geoff@infradead.org> -Date: Sun, 24 Dec 2023 09:52:46 +0900 -Subject: [PATCH 0676/1501] powerpc/ps3_defconfig: Disable - PPC64_BIG_ENDIAN_ELF_ABI_V2 -Content-Length: 1710 -Lines: 44 - -commit 482b718a84f08b6fc84879c3e90cc57dba11c115 upstream. - -Commit 8c5fa3b5c4df ("powerpc/64: Make ELFv2 the default for big-endian -builds"), merged in Linux-6.5-rc1 changes the calling ABI in a way -that is incompatible with the current code for the PS3's LV1 hypervisor -calls. - -This change just adds the line '# CONFIG_PPC64_BIG_ENDIAN_ELF_ABI_V2 is not set' -to the ps3_defconfig file so that the PPC64_ELF_ABI_V1 is used. - -Fixes run time errors like these: - - BUG: Kernel NULL pointer dereference at 0x00000000 - Faulting instruction address: 0xc000000000047cf0 - Oops: Kernel access of bad area, sig: 11 [#1] - Call Trace: - [c0000000023039e0] [c00000000100ebfc] ps3_create_spu+0xc4/0x2b0 (unreliable) - [c000000002303ab0] [c00000000100d4c4] create_spu+0xcc/0x3c4 - [c000000002303b40] [c00000000100eae4] ps3_enumerate_spus+0xa4/0xf8 - -Fixes: 8c5fa3b5c4df ("powerpc/64: Make ELFv2 the default for big-endian builds") -Cc: stable@vger.kernel.org # v6.5+ -Signed-off-by: Geoff Levand <geoff@infradead.org> -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Link: https://msgid.link/df906ac1-5f17-44b9-b0bb-7cd292a0df65@infradead.org -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/powerpc/configs/ps3_defconfig | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/arch/powerpc/configs/ps3_defconfig b/arch/powerpc/configs/ps3_defconfig -index 2b175ddf82f0..aa8bb0208bcc 100644 ---- a/arch/powerpc/configs/ps3_defconfig -+++ b/arch/powerpc/configs/ps3_defconfig -@@ -24,6 +24,7 @@ CONFIG_PS3_VRAM=m - CONFIG_PS3_LPM=m - # CONFIG_PPC_OF_BOOT_TRAMPOLINE is not set - CONFIG_KEXEC=y -+# CONFIG_PPC64_BIG_ENDIAN_ELF_ABI_V2 is not set - CONFIG_PPC_4K_PAGES=y - CONFIG_SCHED_SMT=y - CONFIG_PM=y --- -2.43.2 - -From 73986e8d2808c24b88c7b36a081fb351d2bf6a30 Mon Sep 17 00:00:00 2001 -From: Suraj Jitindar Singh <surajjs@amazon.com> -Date: Wed, 13 Dec 2023 16:16:35 +1100 -Subject: [PATCH 0677/1501] ext4: allow for the last group to be marked as - trimmed -Content-Length: 3206 -Lines: 83 - -commit 7c784d624819acbeefb0018bac89e632467cca5a upstream. - -The ext4 filesystem tracks the trim status of blocks at the group -level. When an entire group has been trimmed then it is marked as -such and subsequent trim invocations with the same minimum trim size -will not be attempted on that group unless it is marked as able to be -trimmed again such as when a block is freed. - -Currently the last group can't be marked as trimmed due to incorrect -logic in ext4_last_grp_cluster(). ext4_last_grp_cluster() is supposed -to return the zero based index of the last cluster in a group. This is -then used by ext4_try_to_trim_range() to determine if the trim -operation spans the entire group and as such if the trim status of the -group should be recorded. - -ext4_last_grp_cluster() takes a 0 based group index, thus the valid -values for grp are 0..(ext4_get_groups_count - 1). Any group index -less than (ext4_get_groups_count - 1) is not the last group and must -have EXT4_CLUSTERS_PER_GROUP(sb) clusters. For the last group we need -to calculate the number of clusters based on the number of blocks in -the group. Finally subtract 1 from the number of clusters as zero -based indexing is expected. Rearrange the function slightly to make -it clear what we are calculating and returning. - -Reproducer: -// Create file system where the last group has fewer blocks than -// blocks per group -$ mkfs.ext4 -b 4096 -g 8192 /dev/nvme0n1 8191 -$ mount /dev/nvme0n1 /mnt - -Before Patch: -$ fstrim -v /mnt -/mnt: 25.9 MiB (27156480 bytes) trimmed -// Group not marked as trimmed so second invocation still discards blocks -$ fstrim -v /mnt -/mnt: 25.9 MiB (27156480 bytes) trimmed - -After Patch: -fstrim -v /mnt -/mnt: 25.9 MiB (27156480 bytes) trimmed -// Group marked as trimmed so second invocation DOESN'T discard any blocks -fstrim -v /mnt -/mnt: 0 B (0 bytes) trimmed - -Fixes: 45e4ab320c9b ("ext4: move setting of trimmed bit into ext4_try_to_trim_range()") -Cc: <stable@vger.kernel.org> # 4.19+ -Signed-off-by: Suraj Jitindar Singh <surajjs@amazon.com> -Reviewed-by: Jan Kara <jack@suse.cz> -Link: https://lore.kernel.org/r/20231213051635.37731-1-surajjs@amazon.com -Signed-off-by: Theodore Ts'o <tytso@mit.edu> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/ext4/mballoc.c | 15 ++++++++++----- - 1 file changed, 10 insertions(+), 5 deletions(-) - -diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index d72b5e3c92ec..ab023d709f72 100644 ---- a/fs/ext4/mballoc.c -+++ b/fs/ext4/mballoc.c -@@ -6735,11 +6735,16 @@ __acquires(bitlock) - static ext4_grpblk_t ext4_last_grp_cluster(struct super_block *sb, - ext4_group_t grp) - { -- if (grp < ext4_get_groups_count(sb)) -- return EXT4_CLUSTERS_PER_GROUP(sb) - 1; -- return (ext4_blocks_count(EXT4_SB(sb)->s_es) - -- ext4_group_first_block_no(sb, grp) - 1) >> -- EXT4_CLUSTER_BITS(sb); -+ unsigned long nr_clusters_in_group; -+ -+ if (grp < (ext4_get_groups_count(sb) - 1)) -+ nr_clusters_in_group = EXT4_CLUSTERS_PER_GROUP(sb); -+ else -+ nr_clusters_in_group = (ext4_blocks_count(EXT4_SB(sb)->s_es) - -+ ext4_group_first_block_no(sb, grp)) -+ >> EXT4_CLUSTER_BITS(sb); -+ -+ return nr_clusters_in_group - 1; - } - - static bool ext4_trim_interrupted(void) --- -2.43.2 - -From 8ae1a4fd03bd36694758e75f6f77644a6dc0db3b Mon Sep 17 00:00:00 2001 -From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com> -Date: Wed, 27 Dec 2023 21:37:02 +0100 -Subject: [PATCH 0678/1501] async: Split async_schedule_node_domain() -Content-Length: 2873 -Lines: 94 - -commit 6aa09a5bccd8e224d917afdb4c278fc66aacde4d upstream. - -In preparation for subsequent changes, split async_schedule_node_domain() -in two pieces so as to allow the bottom part of it to be called from a -somewhat different code path. - -No functional impact. - -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Reviewed-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com> -Tested-by: Youngmin Nam <youngmin.nam@samsung.com> -Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - kernel/async.c | 56 ++++++++++++++++++++++++++++++-------------------- - 1 file changed, 34 insertions(+), 22 deletions(-) - -diff --git a/kernel/async.c b/kernel/async.c -index b2c4ba5686ee..cffe6b4cff9f 100644 ---- a/kernel/async.c -+++ b/kernel/async.c -@@ -145,6 +145,39 @@ static void async_run_entry_fn(struct work_struct *work) - wake_up(&async_done); - } - -+static async_cookie_t __async_schedule_node_domain(async_func_t func, -+ void *data, int node, -+ struct async_domain *domain, -+ struct async_entry *entry) -+{ -+ async_cookie_t newcookie; -+ unsigned long flags; -+ -+ INIT_LIST_HEAD(&entry->domain_list); -+ INIT_LIST_HEAD(&entry->global_list); -+ INIT_WORK(&entry->work, async_run_entry_fn); -+ entry->func = func; -+ entry->data = data; -+ entry->domain = domain; -+ -+ spin_lock_irqsave(&async_lock, flags); -+ -+ /* allocate cookie and queue */ -+ newcookie = entry->cookie = next_cookie++; -+ -+ list_add_tail(&entry->domain_list, &domain->pending); -+ if (domain->registered) -+ list_add_tail(&entry->global_list, &async_global_pending); -+ -+ atomic_inc(&entry_count); -+ spin_unlock_irqrestore(&async_lock, flags); -+ -+ /* schedule for execution */ -+ queue_work_node(node, system_unbound_wq, &entry->work); -+ -+ return newcookie; -+} -+ - /** - * async_schedule_node_domain - NUMA specific version of async_schedule_domain - * @func: function to execute asynchronously -@@ -186,29 +219,8 @@ async_cookie_t async_schedule_node_domain(async_func_t func, void *data, - func(data, newcookie); - return newcookie; - } -- INIT_LIST_HEAD(&entry->domain_list); -- INIT_LIST_HEAD(&entry->global_list); -- INIT_WORK(&entry->work, async_run_entry_fn); -- entry->func = func; -- entry->data = data; -- entry->domain = domain; - -- spin_lock_irqsave(&async_lock, flags); -- -- /* allocate cookie and queue */ -- newcookie = entry->cookie = next_cookie++; -- -- list_add_tail(&entry->domain_list, &domain->pending); -- if (domain->registered) -- list_add_tail(&entry->global_list, &async_global_pending); -- -- atomic_inc(&entry_count); -- spin_unlock_irqrestore(&async_lock, flags); -- -- /* schedule for execution */ -- queue_work_node(node, system_unbound_wq, &entry->work); -- -- return newcookie; -+ return __async_schedule_node_domain(func, data, node, domain, entry); - } - EXPORT_SYMBOL_GPL(async_schedule_node_domain); - --- -2.43.2 - -From 22f7c9cb05cd5153100c859099da64982e9c1d1f Mon Sep 17 00:00:00 2001 -From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com> -Date: Wed, 27 Dec 2023 21:38:23 +0100 -Subject: [PATCH 0679/1501] async: Introduce async_schedule_dev_nocall() -Content-Length: 2661 -Lines: 74 - -commit 7d4b5d7a37bdd63a5a3371b988744b060d5bb86f upstream. - -In preparation for subsequent changes, introduce a specialized variant -of async_schedule_dev() that will not invoke the argument function -synchronously when it cannot be scheduled for asynchronous execution. - -The new function, async_schedule_dev_nocall(), will be used for fixing -possible deadlocks in the system-wide power management core code. - -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Reviewed-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com> for the series. -Tested-by: Youngmin Nam <youngmin.nam@samsung.com> -Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - include/linux/async.h | 2 ++ - kernel/async.c | 29 +++++++++++++++++++++++++++++ - 2 files changed, 31 insertions(+) - -diff --git a/include/linux/async.h b/include/linux/async.h -index cce4ad31e8fc..33c9ff4afb49 100644 ---- a/include/linux/async.h -+++ b/include/linux/async.h -@@ -90,6 +90,8 @@ async_schedule_dev(async_func_t func, struct device *dev) - return async_schedule_node(func, dev, dev_to_node(dev)); - } - -+bool async_schedule_dev_nocall(async_func_t func, struct device *dev); -+ - /** - * async_schedule_dev_domain - A device specific version of async_schedule_domain - * @func: function to execute asynchronously -diff --git a/kernel/async.c b/kernel/async.c -index cffe6b4cff9f..673bba6bdf3a 100644 ---- a/kernel/async.c -+++ b/kernel/async.c -@@ -243,6 +243,35 @@ async_cookie_t async_schedule_node(async_func_t func, void *data, int node) - } - EXPORT_SYMBOL_GPL(async_schedule_node); - -+/** -+ * async_schedule_dev_nocall - A simplified variant of async_schedule_dev() -+ * @func: function to execute asynchronously -+ * @dev: device argument to be passed to function -+ * -+ * @dev is used as both the argument for the function and to provide NUMA -+ * context for where to run the function. -+ * -+ * If the asynchronous execution of @func is scheduled successfully, return -+ * true. Otherwise, do nothing and return false, unlike async_schedule_dev() -+ * that will run the function synchronously then. -+ */ -+bool async_schedule_dev_nocall(async_func_t func, struct device *dev) -+{ -+ struct async_entry *entry; -+ -+ entry = kzalloc(sizeof(struct async_entry), GFP_KERNEL); -+ -+ /* Give up if there is no memory or too much work. */ -+ if (!entry || atomic_read(&entry_count) > MAX_WORK) { -+ kfree(entry); -+ return false; -+ } -+ -+ __async_schedule_node_domain(func, dev, dev_to_node(dev), -+ &async_dfl_domain, entry); -+ return true; -+} -+ - /** - * async_synchronize_full - synchronize all asynchronous function calls - * --- -2.43.2 - -From 9bd3dce27b01c51295b60e1433e1dadfb16649f7 Mon Sep 17 00:00:00 2001 -From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com> -Date: Wed, 27 Dec 2023 21:41:06 +0100 -Subject: [PATCH 0680/1501] PM: sleep: Fix possible deadlocks in core - system-wide PM code -Content-Length: 10049 -Lines: 321 - -commit 7839d0078e0d5e6cc2fa0b0dfbee71de74f1e557 upstream. - -It is reported that in low-memory situations the system-wide resume core -code deadlocks, because async_schedule_dev() executes its argument -function synchronously if it cannot allocate memory (and not only in -that case) and that function attempts to acquire a mutex that is already -held. Executing the argument function synchronously from within -dpm_async_fn() may also be problematic for ordering reasons (it may -cause a consumer device's resume callback to be invoked before a -requisite supplier device's one, for example). - -Address this by changing the code in question to use -async_schedule_dev_nocall() for scheduling the asynchronous -execution of device suspend and resume functions and to directly -run them synchronously if async_schedule_dev_nocall() returns false. - -Link: https://lore.kernel.org/linux-pm/ZYvjiqX6EsL15moe@perf/ -Reported-by: Youngmin Nam <youngmin.nam@samsung.com> -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Reviewed-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com> -Tested-by: Youngmin Nam <youngmin.nam@samsung.com> -Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org> -Cc: 5.7+ <stable@vger.kernel.org> # 5.7+: 6aa09a5bccd8 async: Split async_schedule_node_domain() -Cc: 5.7+ <stable@vger.kernel.org> # 5.7+: 7d4b5d7a37bd async: Introduce async_schedule_dev_nocall() -Cc: 5.7+ <stable@vger.kernel.org> # 5.7+ -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/base/power/main.c | 148 ++++++++++++++++++-------------------- - 1 file changed, 68 insertions(+), 80 deletions(-) - -diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c -index f85f3515c258..9c5a5f4dba5a 100644 ---- a/drivers/base/power/main.c -+++ b/drivers/base/power/main.c -@@ -579,7 +579,7 @@ bool dev_pm_skip_resume(struct device *dev) - } - - /** -- * device_resume_noirq - Execute a "noirq resume" callback for given device. -+ * __device_resume_noirq - Execute a "noirq resume" callback for given device. - * @dev: Device to handle. - * @state: PM transition of the system being carried out. - * @async: If true, the device is being resumed asynchronously. -@@ -587,7 +587,7 @@ bool dev_pm_skip_resume(struct device *dev) - * The driver of @dev will not receive interrupts while this function is being - * executed. - */ --static int device_resume_noirq(struct device *dev, pm_message_t state, bool async) -+static void __device_resume_noirq(struct device *dev, pm_message_t state, bool async) - { - pm_callback_t callback = NULL; - const char *info = NULL; -@@ -655,7 +655,13 @@ static int device_resume_noirq(struct device *dev, pm_message_t state, bool asyn - Out: - complete_all(&dev->power.completion); - TRACE_RESUME(error); -- return error; -+ -+ if (error) { -+ suspend_stats.failed_resume_noirq++; -+ dpm_save_failed_step(SUSPEND_RESUME_NOIRQ); -+ dpm_save_failed_dev(dev_name(dev)); -+ pm_dev_err(dev, state, async ? " async noirq" : " noirq", error); -+ } - } - - static bool is_async(struct device *dev) -@@ -668,11 +674,15 @@ static bool dpm_async_fn(struct device *dev, async_func_t func) - { - reinit_completion(&dev->power.completion); - -- if (is_async(dev)) { -- get_device(dev); -- async_schedule_dev(func, dev); -+ if (!is_async(dev)) -+ return false; -+ -+ get_device(dev); -+ -+ if (async_schedule_dev_nocall(func, dev)) - return true; -- } -+ -+ put_device(dev); - - return false; - } -@@ -680,15 +690,19 @@ static bool dpm_async_fn(struct device *dev, async_func_t func) - static void async_resume_noirq(void *data, async_cookie_t cookie) - { - struct device *dev = data; -- int error; -- -- error = device_resume_noirq(dev, pm_transition, true); -- if (error) -- pm_dev_err(dev, pm_transition, " async", error); - -+ __device_resume_noirq(dev, pm_transition, true); - put_device(dev); - } - -+static void device_resume_noirq(struct device *dev) -+{ -+ if (dpm_async_fn(dev, async_resume_noirq)) -+ return; -+ -+ __device_resume_noirq(dev, pm_transition, false); -+} -+ - static void dpm_noirq_resume_devices(pm_message_t state) - { - struct device *dev; -@@ -698,14 +712,6 @@ static void dpm_noirq_resume_devices(pm_message_t state) - mutex_lock(&dpm_list_mtx); - pm_transition = state; - -- /* -- * Advanced the async threads upfront, -- * in case the starting of async threads is -- * delayed by non-async resuming devices. -- */ -- list_for_each_entry(dev, &dpm_noirq_list, power.entry) -- dpm_async_fn(dev, async_resume_noirq); -- - while (!list_empty(&dpm_noirq_list)) { - dev = to_device(dpm_noirq_list.next); - get_device(dev); -@@ -713,17 +719,7 @@ static void dpm_noirq_resume_devices(pm_message_t state) - - mutex_unlock(&dpm_list_mtx); - -- if (!is_async(dev)) { -- int error; -- -- error = device_resume_noirq(dev, state, false); -- if (error) { -- suspend_stats.failed_resume_noirq++; -- dpm_save_failed_step(SUSPEND_RESUME_NOIRQ); -- dpm_save_failed_dev(dev_name(dev)); -- pm_dev_err(dev, state, " noirq", error); -- } -- } -+ device_resume_noirq(dev); - - put_device(dev); - -@@ -751,14 +747,14 @@ void dpm_resume_noirq(pm_message_t state) - } - - /** -- * device_resume_early - Execute an "early resume" callback for given device. -+ * __device_resume_early - Execute an "early resume" callback for given device. - * @dev: Device to handle. - * @state: PM transition of the system being carried out. - * @async: If true, the device is being resumed asynchronously. - * - * Runtime PM is disabled for @dev while this function is being executed. - */ --static int device_resume_early(struct device *dev, pm_message_t state, bool async) -+static void __device_resume_early(struct device *dev, pm_message_t state, bool async) - { - pm_callback_t callback = NULL; - const char *info = NULL; -@@ -811,21 +807,31 @@ static int device_resume_early(struct device *dev, pm_message_t state, bool asyn - - pm_runtime_enable(dev); - complete_all(&dev->power.completion); -- return error; -+ -+ if (error) { -+ suspend_stats.failed_resume_early++; -+ dpm_save_failed_step(SUSPEND_RESUME_EARLY); -+ dpm_save_failed_dev(dev_name(dev)); -+ pm_dev_err(dev, state, async ? " async early" : " early", error); -+ } - } - - static void async_resume_early(void *data, async_cookie_t cookie) - { - struct device *dev = data; -- int error; -- -- error = device_resume_early(dev, pm_transition, true); -- if (error) -- pm_dev_err(dev, pm_transition, " async", error); - -+ __device_resume_early(dev, pm_transition, true); - put_device(dev); - } - -+static void device_resume_early(struct device *dev) -+{ -+ if (dpm_async_fn(dev, async_resume_early)) -+ return; -+ -+ __device_resume_early(dev, pm_transition, false); -+} -+ - /** - * dpm_resume_early - Execute "early resume" callbacks for all devices. - * @state: PM transition of the system being carried out. -@@ -839,14 +845,6 @@ void dpm_resume_early(pm_message_t state) - mutex_lock(&dpm_list_mtx); - pm_transition = state; - -- /* -- * Advanced the async threads upfront, -- * in case the starting of async threads is -- * delayed by non-async resuming devices. -- */ -- list_for_each_entry(dev, &dpm_late_early_list, power.entry) -- dpm_async_fn(dev, async_resume_early); -- - while (!list_empty(&dpm_late_early_list)) { - dev = to_device(dpm_late_early_list.next); - get_device(dev); -@@ -854,17 +852,7 @@ void dpm_resume_early(pm_message_t state) - - mutex_unlock(&dpm_list_mtx); - -- if (!is_async(dev)) { -- int error; -- -- error = device_resume_early(dev, state, false); -- if (error) { -- suspend_stats.failed_resume_early++; -- dpm_save_failed_step(SUSPEND_RESUME_EARLY); -- dpm_save_failed_dev(dev_name(dev)); -- pm_dev_err(dev, state, " early", error); -- } -- } -+ device_resume_early(dev); - - put_device(dev); - -@@ -888,12 +876,12 @@ void dpm_resume_start(pm_message_t state) - EXPORT_SYMBOL_GPL(dpm_resume_start); - - /** -- * device_resume - Execute "resume" callbacks for given device. -+ * __device_resume - Execute "resume" callbacks for given device. - * @dev: Device to handle. - * @state: PM transition of the system being carried out. - * @async: If true, the device is being resumed asynchronously. - */ --static int device_resume(struct device *dev, pm_message_t state, bool async) -+static void __device_resume(struct device *dev, pm_message_t state, bool async) - { - pm_callback_t callback = NULL; - const char *info = NULL; -@@ -975,20 +963,30 @@ static int device_resume(struct device *dev, pm_message_t state, bool async) - - TRACE_RESUME(error); - -- return error; -+ if (error) { -+ suspend_stats.failed_resume++; -+ dpm_save_failed_step(SUSPEND_RESUME); -+ dpm_save_failed_dev(dev_name(dev)); -+ pm_dev_err(dev, state, async ? " async" : "", error); -+ } - } - - static void async_resume(void *data, async_cookie_t cookie) - { - struct device *dev = data; -- int error; - -- error = device_resume(dev, pm_transition, true); -- if (error) -- pm_dev_err(dev, pm_transition, " async", error); -+ __device_resume(dev, pm_transition, true); - put_device(dev); - } - -+static void device_resume(struct device *dev) -+{ -+ if (dpm_async_fn(dev, async_resume)) -+ return; -+ -+ __device_resume(dev, pm_transition, false); -+} -+ - /** - * dpm_resume - Execute "resume" callbacks for non-sysdev devices. - * @state: PM transition of the system being carried out. -@@ -1008,27 +1006,17 @@ void dpm_resume(pm_message_t state) - pm_transition = state; - async_error = 0; - -- list_for_each_entry(dev, &dpm_suspended_list, power.entry) -- dpm_async_fn(dev, async_resume); -- - while (!list_empty(&dpm_suspended_list)) { - dev = to_device(dpm_suspended_list.next); -+ - get_device(dev); -- if (!is_async(dev)) { -- int error; - -- mutex_unlock(&dpm_list_mtx); -+ mutex_unlock(&dpm_list_mtx); - -- error = device_resume(dev, state, false); -- if (error) { -- suspend_stats.failed_resume++; -- dpm_save_failed_step(SUSPEND_RESUME); -- dpm_save_failed_dev(dev_name(dev)); -- pm_dev_err(dev, state, "", error); -- } -+ device_resume(dev); -+ -+ mutex_lock(&dpm_list_mtx); - -- mutex_lock(&dpm_list_mtx); -- } - if (!list_empty(&dev->power.entry)) - list_move_tail(&dev->power.entry, &dpm_prepared_list); - --- -2.43.2 - -From 5c57ec3cf4bf208a2992aa601f060e1e3915facd Mon Sep 17 00:00:00 2001 -From: Josef Bacik <josef@toxicpanda.com> -Date: Thu, 14 Dec 2023 11:18:50 -0500 -Subject: [PATCH 0681/1501] arm64: properly install vmlinuz.efi -Content-Length: 1542 -Lines: 39 - -commit 7b21ed7d119dc06b0ed2ba3e406a02cafe3a8d03 upstream. - -If you select CONFIG_EFI_ZBOOT, we will generate vmlinuz.efi, and then -when we go to install the kernel we'll install the vmlinux instead -because install.sh only recognizes Image.gz as wanting the compressed -install image. With CONFIG_EFI_ZBOOT we don't get the proper kernel -installed, which means it doesn't boot, which makes for a very confused -and subsequently angry kernel developer. - -Fix this by properly installing our compressed kernel if we've enabled -CONFIG_EFI_ZBOOT. - -Signed-off-by: Josef Bacik <josef@toxicpanda.com> -Cc: <stable@vger.kernel.org> # 6.1.x -Fixes: c37b830fef13 ("arm64: efi: enable generic EFI compressed boot") -Reviewed-by: Simon Glass <sjg@chromium.org> -Link: https://lore.kernel.org/r/6edb1402769c2c14c4fbef8f7eaedb3167558789.1702570674.git.josef@toxicpanda.com -Signed-off-by: Will Deacon <will@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/arm64/boot/install.sh | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/arch/arm64/boot/install.sh b/arch/arm64/boot/install.sh -index 7399d706967a..9b7a09808a3d 100755 ---- a/arch/arm64/boot/install.sh -+++ b/arch/arm64/boot/install.sh -@@ -17,7 +17,8 @@ - # $3 - kernel map file - # $4 - default install path (blank if root directory) - --if [ "$(basename $2)" = "Image.gz" ]; then -+if [ "$(basename $2)" = "Image.gz" ] || [ "$(basename $2)" = "vmlinuz.efi" ] -+then - # Compressed install - echo "Installing compressed kernel" - base=vmlinuz --- -2.43.2 - -From 78653c35206c9d2d24d6d4c91c29cab5165d0cb7 Mon Sep 17 00:00:00 2001 -From: Viresh Kumar <viresh.kumar@linaro.org> -Date: Fri, 5 Jan 2024 13:55:37 +0530 -Subject: [PATCH 0682/1501] OPP: Pass rounded rate to _set_opp() -Content-Length: 1363 -Lines: 39 - -commit 7269c250db1b89cda72ca419b7bd5e37997309d6 upstream. - -The OPP core finds the eventual frequency to set with the help of -clk_round_rate() and the same was earlier getting passed to _set_opp() -and that's what would get configured. - -The commit 1efae8d2e777 ("OPP: Make dev_pm_opp_set_opp() independent of -frequency") mistakenly changed that. Fix it. - -Fixes: 1efae8d2e777 ("OPP: Make dev_pm_opp_set_opp() independent of frequency") -Cc: v5.18+ <stable@vger.kernel.org> # v6.0+ -Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/opp/core.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/opp/core.c b/drivers/opp/core.c -index 84f345c69ea5..b2971dd95335 100644 ---- a/drivers/opp/core.c -+++ b/drivers/opp/core.c -@@ -1378,12 +1378,12 @@ int dev_pm_opp_set_rate(struct device *dev, unsigned long target_freq) - * value of the frequency. In such a case, do not abort but - * configure the hardware to the desired frequency forcefully. - */ -- forced = opp_table->rate_clk_single != target_freq; -+ forced = opp_table->rate_clk_single != freq; - } - -- ret = _set_opp(dev, opp_table, opp, &target_freq, forced); -+ ret = _set_opp(dev, opp_table, opp, &freq, forced); - -- if (target_freq) -+ if (freq) - dev_pm_opp_put(opp); - - put_opp_table: --- -2.43.2 - -From b135aafeac4b3adfa54d1990d443cdd168dd3703 Mon Sep 17 00:00:00 2001 -From: David Disseldorp <ddiss@suse.de> -Date: Fri, 8 Dec 2023 11:41:56 +1100 -Subject: [PATCH 0683/1501] btrfs: sysfs: validate scrub_speed_max value -Content-Length: 1055 -Lines: 32 - -commit 2b0122aaa800b021e36027d7f29e206f87c761d6 upstream. - -The value set as scrub_speed_max accepts size with suffixes -(k/m/g/t/p/e) but we should still validate it for trailing characters, -similar to what we do with chunk_size_store. - -CC: stable@vger.kernel.org # 5.15+ -Signed-off-by: David Disseldorp <ddiss@suse.de> -Reviewed-by: David Sterba <dsterba@suse.com> -Signed-off-by: David Sterba <dsterba@suse.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/btrfs/sysfs.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c -index e6b51fb3ddc1..84c05246ffd8 100644 ---- a/fs/btrfs/sysfs.c -+++ b/fs/btrfs/sysfs.c -@@ -1783,6 +1783,10 @@ static ssize_t btrfs_devinfo_scrub_speed_max_store(struct kobject *kobj, - unsigned long long limit; - - limit = memparse(buf, &endptr); -+ /* There could be trailing '\n', also catch any typos after the value. */ -+ endptr = skip_spaces(endptr); -+ if (*endptr != 0) -+ return -EINVAL; - WRITE_ONCE(device->scrub_speed_max, limit); - return len; - } --- -2.43.2 - -From 7abdfd45a650c714d5ebab564bb1b988f14d9b49 Mon Sep 17 00:00:00 2001 -From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com> -Date: Thu, 14 Dec 2023 11:08:34 +0800 -Subject: [PATCH 0684/1501] crypto: lib/mpi - Fix unexpected pointer access in - mpi_ec_init -Content-Length: 1213 -Lines: 34 - -commit ba3c5574203034781ac4231acf117da917efcd2a upstream. - -When the mpi_ec_ctx structure is initialized, some fields are not -cleared, causing a crash when referencing the field when the -structure was released. Initially, this issue was ignored because -memory for mpi_ec_ctx is allocated with the __GFP_ZERO flag. -For example, this error will be triggered when calculating the -Za value for SM2 separately. - -Fixes: d58bb7e55a8a ("lib/mpi: Introduce ec implementation to MPI library") -Cc: stable@vger.kernel.org # v6.5 -Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - lib/crypto/mpi/ec.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/lib/crypto/mpi/ec.c b/lib/crypto/mpi/ec.c -index 40f5908e57a4..e16dca1e23d5 100644 ---- a/lib/crypto/mpi/ec.c -+++ b/lib/crypto/mpi/ec.c -@@ -584,6 +584,9 @@ void mpi_ec_init(struct mpi_ec_ctx *ctx, enum gcry_mpi_ec_models model, - ctx->a = mpi_copy(a); - ctx->b = mpi_copy(b); - -+ ctx->d = NULL; -+ ctx->t.two_inv_p = NULL; -+ - ctx->t.p_barrett = use_barrett > 0 ? mpi_barrett_init(ctx->p, 0) : NULL; - - mpi_ec_get_reset(ctx); --- -2.43.2 - -From bffc4cc334c5bb31ded54bc3cfd651735a3cb79e Mon Sep 17 00:00:00 2001 -From: Gao Xiang <hsiangkao@linux.alibaba.com> -Date: Wed, 6 Dec 2023 12:55:34 +0800 -Subject: [PATCH 0685/1501] erofs: fix lz4 inplace decompression -Content-Length: 5160 -Lines: 134 - -commit 3c12466b6b7bf1e56f9b32c366a3d83d87afb4de upstream. - -Currently EROFS can map another compressed buffer for inplace -decompression, that was used to handle the cases that some pages of -compressed data are actually not in-place I/O. - -However, like most simple LZ77 algorithms, LZ4 expects the compressed -data is arranged at the end of the decompressed buffer and it -explicitly uses memmove() to handle overlapping: - __________________________________________________________ - |_ direction of decompression --> ____ |_ compressed data _| - -Although EROFS arranges compressed data like this, it typically maps two -individual virtual buffers so the relative order is uncertain. -Previously, it was hardly observed since LZ4 only uses memmove() for -short overlapped literals and x86/arm64 memmove implementations seem to -completely cover it up and they don't have this issue. Juhyung reported -that EROFS data corruption can be found on a new Intel x86 processor. -After some analysis, it seems that recent x86 processors with the new -FSRM feature expose this issue with "rep movsb". - -Let's strictly use the decompressed buffer for lz4 inplace -decompression for now. Later, as an useful improvement, we could try -to tie up these two buffers together in the correct order. - -Reported-and-tested-by: Juhyung Park <qkrwngud825@gmail.com> -Closes: https://lore.kernel.org/r/CAD14+f2AVKf8Fa2OO1aAUdDNTDsVzzR6ctU_oJSmTyd6zSYR2Q@mail.gmail.com -Fixes: 0ffd71bcc3a0 ("staging: erofs: introduce LZ4 decompression inplace") -Fixes: 598162d05080 ("erofs: support decompress big pcluster for lz4 backend") -Cc: stable <stable@vger.kernel.org> # 5.4+ -Tested-by: Yifan Zhao <zhaoyifan@sjtu.edu.cn> -Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com> -Link: https://lore.kernel.org/r/20231206045534.3920847-1-hsiangkao@linux.alibaba.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/erofs/decompressor.c | 31 ++++++++++++++++--------------- - 1 file changed, 16 insertions(+), 15 deletions(-) - -diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c -index af98e88908ee..066ddc03b7b4 100644 ---- a/fs/erofs/decompressor.c -+++ b/fs/erofs/decompressor.c -@@ -121,11 +121,11 @@ static int z_erofs_lz4_prepare_dstpages(struct z_erofs_lz4_decompress_ctx *ctx, - } - - static void *z_erofs_lz4_handle_overlap(struct z_erofs_lz4_decompress_ctx *ctx, -- void *inpage, unsigned int *inputmargin, int *maptype, -- bool may_inplace) -+ void *inpage, void *out, unsigned int *inputmargin, -+ int *maptype, bool may_inplace) - { - struct z_erofs_decompress_req *rq = ctx->rq; -- unsigned int omargin, total, i, j; -+ unsigned int omargin, total, i; - struct page **in; - void *src, *tmp; - -@@ -135,12 +135,13 @@ static void *z_erofs_lz4_handle_overlap(struct z_erofs_lz4_decompress_ctx *ctx, - omargin < LZ4_DECOMPRESS_INPLACE_MARGIN(rq->inputsize)) - goto docopy; - -- for (i = 0; i < ctx->inpages; ++i) { -- DBG_BUGON(rq->in[i] == NULL); -- for (j = 0; j < ctx->outpages - ctx->inpages + i; ++j) -- if (rq->out[j] == rq->in[i]) -- goto docopy; -- } -+ for (i = 0; i < ctx->inpages; ++i) -+ if (rq->out[ctx->outpages - ctx->inpages + i] != -+ rq->in[i]) -+ goto docopy; -+ kunmap_local(inpage); -+ *maptype = 3; -+ return out + ((ctx->outpages - ctx->inpages) << PAGE_SHIFT); - } - - if (ctx->inpages <= 1) { -@@ -148,7 +149,6 @@ static void *z_erofs_lz4_handle_overlap(struct z_erofs_lz4_decompress_ctx *ctx, - return inpage; - } - kunmap_local(inpage); -- might_sleep(); - src = erofs_vm_map_ram(rq->in, ctx->inpages); - if (!src) - return ERR_PTR(-ENOMEM); -@@ -204,12 +204,12 @@ int z_erofs_fixup_insize(struct z_erofs_decompress_req *rq, const char *padbuf, - } - - static int z_erofs_lz4_decompress_mem(struct z_erofs_lz4_decompress_ctx *ctx, -- u8 *out) -+ u8 *dst) - { - struct z_erofs_decompress_req *rq = ctx->rq; - bool support_0padding = false, may_inplace = false; - unsigned int inputmargin; -- u8 *headpage, *src; -+ u8 *out, *headpage, *src; - int ret, maptype; - - DBG_BUGON(*rq->in == NULL); -@@ -230,11 +230,12 @@ static int z_erofs_lz4_decompress_mem(struct z_erofs_lz4_decompress_ctx *ctx, - } - - inputmargin = rq->pageofs_in; -- src = z_erofs_lz4_handle_overlap(ctx, headpage, &inputmargin, -+ src = z_erofs_lz4_handle_overlap(ctx, headpage, dst, &inputmargin, - &maptype, may_inplace); - if (IS_ERR(src)) - return PTR_ERR(src); - -+ out = dst + rq->pageofs_out; - /* legacy format could compress extra data in a pcluster. */ - if (rq->partial_decoding || !support_0padding) - ret = LZ4_decompress_safe_partial(src + inputmargin, out, -@@ -265,7 +266,7 @@ static int z_erofs_lz4_decompress_mem(struct z_erofs_lz4_decompress_ctx *ctx, - vm_unmap_ram(src, ctx->inpages); - } else if (maptype == 2) { - erofs_put_pcpubuf(src); -- } else { -+ } else if (maptype != 3) { - DBG_BUGON(1); - return -EFAULT; - } -@@ -308,7 +309,7 @@ static int z_erofs_lz4_decompress(struct z_erofs_decompress_req *rq, - } - - dstmap_out: -- ret = z_erofs_lz4_decompress_mem(&ctx, dst + rq->pageofs_out); -+ ret = z_erofs_lz4_decompress_mem(&ctx, dst); - if (!dst_maptype) - kunmap_local(dst); - else if (dst_maptype == 2) --- -2.43.2 - -From 7a09e2a77a8d4b133cc7e5e4f9a4ccf4c2283d58 Mon Sep 17 00:00:00 2001 -From: Herbert Xu <herbert@gondor.apana.org.au> -Date: Thu, 7 Dec 2023 18:36:57 +0800 -Subject: [PATCH 0686/1501] crypto: api - Disallow identical driver names -Content-Length: 822 -Lines: 26 - -commit 27016f75f5ed47e2d8e0ca75a8ff1f40bc1a5e27 upstream. - -Disallow registration of two algorithms with identical driver names. - -Cc: <stable@vger.kernel.org> -Reported-by: Ovidiu Panait <ovidiu.panait@windriver.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - crypto/algapi.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/crypto/algapi.c b/crypto/algapi.c -index 4fe95c448047..85bc279b4233 100644 ---- a/crypto/algapi.c -+++ b/crypto/algapi.c -@@ -341,6 +341,7 @@ __crypto_register_alg(struct crypto_alg *alg, struct list_head *algs_to_put) - } - - if (!strcmp(q->cra_driver_name, alg->cra_name) || -+ !strcmp(q->cra_driver_name, alg->cra_driver_name) || - !strcmp(q->cra_name, alg->cra_driver_name)) - goto err; - } --- -2.43.2 - -From 2ea043279a2c92c1025e2deeed1ffbc3289afd94 Mon Sep 17 00:00:00 2001 -From: Hongchen Zhang <zhanghongchen@loongson.cn> -Date: Thu, 16 Nov 2023 08:56:09 +0800 -Subject: [PATCH 0687/1501] PM: hibernate: Enforce ordering during image - compression/decompression -Content-Length: 6263 -Lines: 199 - -commit 71cd7e80cfde548959952eac7063aeaea1f2e1c6 upstream. - -An S4 (suspend to disk) test on the LoongArch 3A6000 platform sometimes -fails with the following error messaged in the dmesg log: - - Invalid LZO compressed length - -That happens because when compressing/decompressing the image, the -synchronization between the control thread and the compress/decompress/crc -thread is based on a relaxed ordering interface, which is unreliable, and the -following situation may occur: - -CPU 0 CPU 1 -save_image_lzo lzo_compress_threadfn - atomic_set(&d->stop, 1); - atomic_read(&data[thr].stop) - data[thr].cmp = data[thr].cmp_len; - WRITE data[thr].cmp_len - -Then CPU0 gets a stale cmp_len and writes it to disk. During resume from S4, -wrong cmp_len is loaded. - -To maintain data consistency between the two threads, use the acquire/release -variants of atomic set and read operations. - -Fixes: 081a9d043c98 ("PM / Hibernate: Improve performance of LZO/plain hibernation, checksum image") -Cc: All applicable <stable@vger.kernel.org> -Signed-off-by: Hongchen Zhang <zhanghongchen@loongson.cn> -Co-developed-by: Weihao Li <liweihao@loongson.cn> -Signed-off-by: Weihao Li <liweihao@loongson.cn> -[ rjw: Subject rewrite and changelog edits ] -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - kernel/power/swap.c | 38 +++++++++++++++++++------------------- - 1 file changed, 19 insertions(+), 19 deletions(-) - -diff --git a/kernel/power/swap.c b/kernel/power/swap.c -index a2cb0babb5ec..d44f5937f1e5 100644 ---- a/kernel/power/swap.c -+++ b/kernel/power/swap.c -@@ -606,11 +606,11 @@ static int crc32_threadfn(void *data) - unsigned i; - - while (1) { -- wait_event(d->go, atomic_read(&d->ready) || -+ wait_event(d->go, atomic_read_acquire(&d->ready) || - kthread_should_stop()); - if (kthread_should_stop()) { - d->thr = NULL; -- atomic_set(&d->stop, 1); -+ atomic_set_release(&d->stop, 1); - wake_up(&d->done); - break; - } -@@ -619,7 +619,7 @@ static int crc32_threadfn(void *data) - for (i = 0; i < d->run_threads; i++) - *d->crc32 = crc32_le(*d->crc32, - d->unc[i], *d->unc_len[i]); -- atomic_set(&d->stop, 1); -+ atomic_set_release(&d->stop, 1); - wake_up(&d->done); - } - return 0; -@@ -649,12 +649,12 @@ static int lzo_compress_threadfn(void *data) - struct cmp_data *d = data; - - while (1) { -- wait_event(d->go, atomic_read(&d->ready) || -+ wait_event(d->go, atomic_read_acquire(&d->ready) || - kthread_should_stop()); - if (kthread_should_stop()) { - d->thr = NULL; - d->ret = -1; -- atomic_set(&d->stop, 1); -+ atomic_set_release(&d->stop, 1); - wake_up(&d->done); - break; - } -@@ -663,7 +663,7 @@ static int lzo_compress_threadfn(void *data) - d->ret = lzo1x_1_compress(d->unc, d->unc_len, - d->cmp + LZO_HEADER, &d->cmp_len, - d->wrk); -- atomic_set(&d->stop, 1); -+ atomic_set_release(&d->stop, 1); - wake_up(&d->done); - } - return 0; -@@ -798,7 +798,7 @@ static int save_image_lzo(struct swap_map_handle *handle, - - data[thr].unc_len = off; - -- atomic_set(&data[thr].ready, 1); -+ atomic_set_release(&data[thr].ready, 1); - wake_up(&data[thr].go); - } - -@@ -806,12 +806,12 @@ static int save_image_lzo(struct swap_map_handle *handle, - break; - - crc->run_threads = thr; -- atomic_set(&crc->ready, 1); -+ atomic_set_release(&crc->ready, 1); - wake_up(&crc->go); - - for (run_threads = thr, thr = 0; thr < run_threads; thr++) { - wait_event(data[thr].done, -- atomic_read(&data[thr].stop)); -+ atomic_read_acquire(&data[thr].stop)); - atomic_set(&data[thr].stop, 0); - - ret = data[thr].ret; -@@ -850,7 +850,7 @@ static int save_image_lzo(struct swap_map_handle *handle, - } - } - -- wait_event(crc->done, atomic_read(&crc->stop)); -+ wait_event(crc->done, atomic_read_acquire(&crc->stop)); - atomic_set(&crc->stop, 0); - } - -@@ -1132,12 +1132,12 @@ static int lzo_decompress_threadfn(void *data) - struct dec_data *d = data; - - while (1) { -- wait_event(d->go, atomic_read(&d->ready) || -+ wait_event(d->go, atomic_read_acquire(&d->ready) || - kthread_should_stop()); - if (kthread_should_stop()) { - d->thr = NULL; - d->ret = -1; -- atomic_set(&d->stop, 1); -+ atomic_set_release(&d->stop, 1); - wake_up(&d->done); - break; - } -@@ -1150,7 +1150,7 @@ static int lzo_decompress_threadfn(void *data) - flush_icache_range((unsigned long)d->unc, - (unsigned long)d->unc + d->unc_len); - -- atomic_set(&d->stop, 1); -+ atomic_set_release(&d->stop, 1); - wake_up(&d->done); - } - return 0; -@@ -1335,7 +1335,7 @@ static int load_image_lzo(struct swap_map_handle *handle, - } - - if (crc->run_threads) { -- wait_event(crc->done, atomic_read(&crc->stop)); -+ wait_event(crc->done, atomic_read_acquire(&crc->stop)); - atomic_set(&crc->stop, 0); - crc->run_threads = 0; - } -@@ -1371,7 +1371,7 @@ static int load_image_lzo(struct swap_map_handle *handle, - pg = 0; - } - -- atomic_set(&data[thr].ready, 1); -+ atomic_set_release(&data[thr].ready, 1); - wake_up(&data[thr].go); - } - -@@ -1390,7 +1390,7 @@ static int load_image_lzo(struct swap_map_handle *handle, - - for (run_threads = thr, thr = 0; thr < run_threads; thr++) { - wait_event(data[thr].done, -- atomic_read(&data[thr].stop)); -+ atomic_read_acquire(&data[thr].stop)); - atomic_set(&data[thr].stop, 0); - - ret = data[thr].ret; -@@ -1421,7 +1421,7 @@ static int load_image_lzo(struct swap_map_handle *handle, - ret = snapshot_write_next(snapshot); - if (ret <= 0) { - crc->run_threads = thr + 1; -- atomic_set(&crc->ready, 1); -+ atomic_set_release(&crc->ready, 1); - wake_up(&crc->go); - goto out_finish; - } -@@ -1429,13 +1429,13 @@ static int load_image_lzo(struct swap_map_handle *handle, - } - - crc->run_threads = thr; -- atomic_set(&crc->ready, 1); -+ atomic_set_release(&crc->ready, 1); - wake_up(&crc->go); - } - - out_finish: - if (crc->run_threads) { -- wait_event(crc->done, atomic_read(&crc->stop)); -+ wait_event(crc->done, atomic_read_acquire(&crc->stop)); - atomic_set(&crc->stop, 0); - } - stop = ktime_get(); --- -2.43.2 - -From 6822a14271786150e178869f1495cc03e74c5029 Mon Sep 17 00:00:00 2001 -From: Herbert Xu <herbert@gondor.apana.org.au> -Date: Sat, 2 Dec 2023 09:01:54 +0800 -Subject: [PATCH 0688/1501] hwrng: core - Fix page fault dead lock on mmap-ed - hwrng -Content-Length: 3207 -Lines: 115 - -commit 78aafb3884f6bc6636efcc1760c891c8500b9922 upstream. - -There is a dead-lock in the hwrng device read path. This triggers -when the user reads from /dev/hwrng into memory also mmap-ed from -/dev/hwrng. The resulting page fault triggers a recursive read -which then dead-locks. - -Fix this by using a stack buffer when calling copy_to_user. - -Reported-by: Edward Adam Davis <eadavis@qq.com> -Reported-by: syzbot+c52ab18308964d248092@syzkaller.appspotmail.com -Fixes: 9996508b3353 ("hwrng: core - Replace u32 in driver API with byte array") -Cc: <stable@vger.kernel.org> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/char/hw_random/core.c | 36 +++++++++++++++++++++-------------- - 1 file changed, 22 insertions(+), 14 deletions(-) - -diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c -index 420f155d251f..a3bbdd6e60fc 100644 ---- a/drivers/char/hw_random/core.c -+++ b/drivers/char/hw_random/core.c -@@ -23,10 +23,13 @@ - #include <linux/sched.h> - #include <linux/sched/signal.h> - #include <linux/slab.h> -+#include <linux/string.h> - #include <linux/uaccess.h> - - #define RNG_MODULE_NAME "hw_random" - -+#define RNG_BUFFER_SIZE (SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES) -+ - static struct hwrng *current_rng; - /* the current rng has been explicitly chosen by user via sysfs */ - static int cur_rng_set_by_user; -@@ -58,7 +61,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, - - static size_t rng_buffer_size(void) - { -- return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES; -+ return RNG_BUFFER_SIZE; - } - - static void add_early_randomness(struct hwrng *rng) -@@ -209,6 +212,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, - static ssize_t rng_dev_read(struct file *filp, char __user *buf, - size_t size, loff_t *offp) - { -+ u8 buffer[RNG_BUFFER_SIZE]; - ssize_t ret = 0; - int err = 0; - int bytes_read, len; -@@ -236,34 +240,37 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, - if (bytes_read < 0) { - err = bytes_read; - goto out_unlock_reading; -- } -- data_avail = bytes_read; -- } -- -- if (!data_avail) { -- if (filp->f_flags & O_NONBLOCK) { -+ } else if (bytes_read == 0 && -+ (filp->f_flags & O_NONBLOCK)) { - err = -EAGAIN; - goto out_unlock_reading; - } -- } else { -- len = data_avail; -+ -+ data_avail = bytes_read; -+ } -+ -+ len = data_avail; -+ if (len) { - if (len > size) - len = size; - - data_avail -= len; - -- if (copy_to_user(buf + ret, rng_buffer + data_avail, -- len)) { -+ memcpy(buffer, rng_buffer + data_avail, len); -+ } -+ mutex_unlock(&reading_mutex); -+ put_rng(rng); -+ -+ if (len) { -+ if (copy_to_user(buf + ret, buffer, len)) { - err = -EFAULT; -- goto out_unlock_reading; -+ goto out; - } - - size -= len; - ret += len; - } - -- mutex_unlock(&reading_mutex); -- put_rng(rng); - - if (need_resched()) - schedule_timeout_interruptible(1); -@@ -274,6 +281,7 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, - } - } - out: -+ memzero_explicit(buffer, sizeof(buffer)); - return ret ? : err; - - out_unlock_reading: --- -2.43.2 - -From e78f1a43e72daf77705ad5b9946de66fc708b874 Mon Sep 17 00:00:00 2001 -From: Herbert Xu <herbert@gondor.apana.org.au> -Date: Tue, 28 Nov 2023 14:22:13 +0800 -Subject: [PATCH 0689/1501] crypto: s390/aes - Fix buffer overread in CTR mode -Status: RO -Content-Length: 2076 -Lines: 53 - -commit d07f951903fa9922c375b8ab1ce81b18a0034e3b upstream. - -When processing the last block, the s390 ctr code will always read -a whole block, even if there isn't a whole block of data left. Fix -this by using the actual length left and copy it into a buffer first -for processing. - -Fixes: 0200f3ecc196 ("crypto: s390 - add System z hardware support for CTR mode") -Cc: <stable@vger.kernel.org> -Reported-by: Guangwu Zhang <guazhang@redhat.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Reviewd-by: Harald Freudenberger <freude@de.ibm.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/s390/crypto/aes_s390.c | 4 +++- - arch/s390/crypto/paes_s390.c | 4 +++- - 2 files changed, 6 insertions(+), 2 deletions(-) - -diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c -index c773820e4af9..c6fe5405de4a 100644 ---- a/arch/s390/crypto/aes_s390.c -+++ b/arch/s390/crypto/aes_s390.c -@@ -597,7 +597,9 @@ static int ctr_aes_crypt(struct skcipher_request *req) - * final block may be < AES_BLOCK_SIZE, copy only nbytes - */ - if (nbytes) { -- cpacf_kmctr(sctx->fc, sctx->key, buf, walk.src.virt.addr, -+ memset(buf, 0, AES_BLOCK_SIZE); -+ memcpy(buf, walk.src.virt.addr, nbytes); -+ cpacf_kmctr(sctx->fc, sctx->key, buf, buf, - AES_BLOCK_SIZE, walk.iv); - memcpy(walk.dst.virt.addr, buf, nbytes); - crypto_inc(walk.iv, AES_BLOCK_SIZE); -diff --git a/arch/s390/crypto/paes_s390.c b/arch/s390/crypto/paes_s390.c -index 8b541e44151d..55ee5567a5ea 100644 ---- a/arch/s390/crypto/paes_s390.c -+++ b/arch/s390/crypto/paes_s390.c -@@ -693,9 +693,11 @@ static int ctr_paes_crypt(struct skcipher_request *req) - * final block may be < AES_BLOCK_SIZE, copy only nbytes - */ - if (nbytes) { -+ memset(buf, 0, AES_BLOCK_SIZE); -+ memcpy(buf, walk.src.virt.addr, nbytes); - while (1) { - if (cpacf_kmctr(ctx->fc, ¶m, buf, -- walk.src.virt.addr, AES_BLOCK_SIZE, -+ buf, AES_BLOCK_SIZE, - walk.iv) == AES_BLOCK_SIZE) - break; - if (__paes_convert_key(ctx)) --- -2.43.2 - -From 8fc366549f9b11544827883329a515f6a4af037c Mon Sep 17 00:00:00 2001 -From: Anthony Krowiak <akrowiak@linux.ibm.com> -Date: Thu, 9 Nov 2023 11:44:20 -0500 -Subject: [PATCH 0690/1501] s390/vfio-ap: unpin pages on gisc registration - failure -Content-Length: 1633 -Lines: 36 - -commit 7b2d039da622daa9ba259ac6f38701d542b237c3 upstream. - -In the vfio_ap_irq_enable function, after the page containing the -notification indicator byte (NIB) is pinned, the function attempts -to register the guest ISC. If registration fails, the function sets the -status response code and returns without unpinning the page containing -the NIB. In order to avoid a memory leak, the NIB should be unpinned before -returning from the vfio_ap_irq_enable function. - -Co-developed-by: Janosch Frank <frankja@linux.ibm.com> -Signed-off-by: Janosch Frank <frankja@linux.ibm.com> -Signed-off-by: Anthony Krowiak <akrowiak@linux.ibm.com> -Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> -Fixes: 783f0a3ccd79 ("s390/vfio-ap: add s390dbf logging to the vfio_ap_irq_enable function") -Cc: <stable@vger.kernel.org> -Link: https://lore.kernel.org/r/20231109164427.460493-2-akrowiak@linux.ibm.com -Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/s390/crypto/vfio_ap_ops.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c -index 4db538a55192..9cb28978c186 100644 ---- a/drivers/s390/crypto/vfio_ap_ops.c -+++ b/drivers/s390/crypto/vfio_ap_ops.c -@@ -457,6 +457,7 @@ static struct ap_queue_status vfio_ap_irq_enable(struct vfio_ap_queue *q, - VFIO_AP_DBF_WARN("%s: gisc registration failed: nisc=%d, isc=%d, apqn=%#04x\n", - __func__, nisc, isc, q->apqn); - -+ vfio_unpin_pages(&q->matrix_mdev->vdev, nib, 1); - status.response_code = AP_RESPONSE_INVALID_GISA; - return status; - } --- -2.43.2 - -From 1168d6b79d2fafb41299fbc1b528e20644c562a5 Mon Sep 17 00:00:00 2001 -From: Miquel Raynal <miquel.raynal@bootlin.com> -Date: Tue, 5 Dec 2023 08:59:36 +0100 -Subject: [PATCH 0692/1501] mtd: maps: vmu-flash: Fix the (mtd core) switch to - ref counters -Content-Length: 1228 -Lines: 32 - -commit a7d84a2e7663bbe12394cc771107e04668ea313a upstream. - -While switching to ref counters for track mtd devices use, the vmu-flash -driver was forgotten. The reason for reading the ref counter seems -debatable, but let's just fix the build for now. - -Fixes: 19bfa9ebebb5 ("mtd: use refcount to prevent corruption") -Reported-by: kernel test robot <lkp@intel.com> -Closes: https://lore.kernel.org/oe-kbuild-all/202312022315.79twVRZw-lkp@intel.com/ -Cc: stable@vger.kernel.org -Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> -Link: https://lore.kernel.org/linux-mtd/20231205075936.13831-1-miquel.raynal@bootlin.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/mtd/maps/vmu-flash.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/mtd/maps/vmu-flash.c b/drivers/mtd/maps/vmu-flash.c -index a7ec947a3ebb..53019d313db7 100644 ---- a/drivers/mtd/maps/vmu-flash.c -+++ b/drivers/mtd/maps/vmu-flash.c -@@ -719,7 +719,7 @@ static int vmu_can_unload(struct maple_device *mdev) - card = maple_get_drvdata(mdev); - for (x = 0; x < card->partitions; x++) { - mtd = &((card->mtd)[x]); -- if (mtd->usecount > 0) -+ if (kref_read(&mtd->refcnt)) - return 0; - } - return 1; --- -2.43.2 - -From 427f8206e84d4de1f49d639576ebf4ca74455da5 Mon Sep 17 00:00:00 2001 -From: Miquel Raynal <miquel.raynal@bootlin.com> -Date: Fri, 15 Dec 2023 13:32:05 +0100 -Subject: [PATCH 0693/1501] mtd: rawnand: Prevent crossing LUN boundaries - during sequential reads -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 4686 -Lines: 122 - -commit bbcd80f53a5e8c27c2511f539fec8c373f500cf4 upstream. - -The ONFI specification states that devices do not need to support -sequential reads across LUN boundaries. In order to prevent such event -from happening and possibly failing, let's introduce the concept of -"pause" in the sequential read to handle these cases. The first/last -pages remain the same but any time we cross a LUN boundary we will end -and restart (if relevant) the sequential read operation. - -Cc: stable@vger.kernel.org -Fixes: 003fe4b9545b ("mtd: rawnand: Support for sequential cache reads") -Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> -Tested-by: Martin Hundebøll <martin@geanix.com> -Link: https://lore.kernel.org/linux-mtd/20231215123208.516590-2-miquel.raynal@bootlin.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/mtd/nand/raw/nand_base.c | 43 +++++++++++++++++++++++++++----- - include/linux/mtd/rawnand.h | 2 ++ - 2 files changed, 39 insertions(+), 6 deletions(-) - -diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c -index 9e24bedffd89..04e80ace4182 100644 ---- a/drivers/mtd/nand/raw/nand_base.c -+++ b/drivers/mtd/nand/raw/nand_base.c -@@ -1207,6 +1207,23 @@ static int nand_lp_exec_read_page_op(struct nand_chip *chip, unsigned int page, - return nand_exec_op(chip, &op); - } - -+static void rawnand_cap_cont_reads(struct nand_chip *chip) -+{ -+ struct nand_memory_organization *memorg; -+ unsigned int pages_per_lun, first_lun, last_lun; -+ -+ memorg = nanddev_get_memorg(&chip->base); -+ pages_per_lun = memorg->pages_per_eraseblock * memorg->eraseblocks_per_lun; -+ first_lun = chip->cont_read.first_page / pages_per_lun; -+ last_lun = chip->cont_read.last_page / pages_per_lun; -+ -+ /* Prevent sequential cache reads across LUN boundaries */ -+ if (first_lun != last_lun) -+ chip->cont_read.pause_page = first_lun * pages_per_lun + pages_per_lun - 1; -+ else -+ chip->cont_read.pause_page = chip->cont_read.last_page; -+} -+ - static int nand_lp_exec_cont_read_page_op(struct nand_chip *chip, unsigned int page, - unsigned int offset_in_page, void *buf, - unsigned int len, bool check_only) -@@ -1225,7 +1242,7 @@ static int nand_lp_exec_cont_read_page_op(struct nand_chip *chip, unsigned int p - NAND_OP_DATA_IN(len, buf, 0), - }; - struct nand_op_instr cont_instrs[] = { -- NAND_OP_CMD(page == chip->cont_read.last_page ? -+ NAND_OP_CMD(page == chip->cont_read.pause_page ? - NAND_CMD_READCACHEEND : NAND_CMD_READCACHESEQ, - NAND_COMMON_TIMING_NS(conf, tWB_max)), - NAND_OP_WAIT_RDY(NAND_COMMON_TIMING_MS(conf, tR_max), -@@ -1262,16 +1279,29 @@ static int nand_lp_exec_cont_read_page_op(struct nand_chip *chip, unsigned int p - } - - if (page == chip->cont_read.first_page) -- return nand_exec_op(chip, &start_op); -+ ret = nand_exec_op(chip, &start_op); - else -- return nand_exec_op(chip, &cont_op); -+ ret = nand_exec_op(chip, &cont_op); -+ if (ret) -+ return ret; -+ -+ if (!chip->cont_read.ongoing) -+ return 0; -+ -+ if (page == chip->cont_read.pause_page && -+ page != chip->cont_read.last_page) { -+ chip->cont_read.first_page = chip->cont_read.pause_page + 1; -+ rawnand_cap_cont_reads(chip); -+ } else if (page == chip->cont_read.last_page) { -+ chip->cont_read.ongoing = false; -+ } -+ -+ return 0; - } - - static bool rawnand_cont_read_ongoing(struct nand_chip *chip, unsigned int page) - { -- return chip->cont_read.ongoing && -- page >= chip->cont_read.first_page && -- page <= chip->cont_read.last_page; -+ return chip->cont_read.ongoing && page >= chip->cont_read.first_page; - } - - /** -@@ -3445,6 +3475,7 @@ static void rawnand_enable_cont_reads(struct nand_chip *chip, unsigned int page, - if (col) - chip->cont_read.first_page++; - chip->cont_read.last_page = page + ((readlen >> chip->page_shift) & chip->pagemask); -+ rawnand_cap_cont_reads(chip); - } - - /** -diff --git a/include/linux/mtd/rawnand.h b/include/linux/mtd/rawnand.h -index c29ace15a053..9d0fc5109af6 100644 ---- a/include/linux/mtd/rawnand.h -+++ b/include/linux/mtd/rawnand.h -@@ -1265,6 +1265,7 @@ struct nand_secure_region { - * @cont_read: Sequential page read internals - * @cont_read.ongoing: Whether a continuous read is ongoing or not - * @cont_read.first_page: Start of the continuous read operation -+ * @cont_read.pause_page: End of the current sequential cache read operation - * @cont_read.last_page: End of the continuous read operation - * @controller: The hardware controller structure which is shared among multiple - * independent devices -@@ -1321,6 +1322,7 @@ struct nand_chip { - struct { - bool ongoing; - unsigned int first_page; -+ unsigned int pause_page; - unsigned int last_page; - } cont_read; - --- -2.43.2 - -From 2a3cc28b600f267f6f1804cf84b14e39c3c744dd Mon Sep 17 00:00:00 2001 -From: Miquel Raynal <miquel.raynal@bootlin.com> -Date: Fri, 15 Dec 2023 13:32:06 +0100 -Subject: [PATCH 0694/1501] mtd: rawnand: Fix core interference with sequential - reads -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2956 -Lines: 66 - -commit 7c9414c870c027737d0f2ed7b0ed10f26edb1c61 upstream. - -A couple of reports pointed at some strange failures happening a bit -randomly since the introduction of sequential page reads support. After -investigation it turned out the most likely reason for these issues was -the fact that sometimes a (longer) read might happen, starting at the -same page that was read previously. This is optimized by the raw NAND -core, by not sending the READ_PAGE command to the NAND device and just -reading out the data in a local cache. When this page is also flagged as -being the starting point for a sequential read, it means the page right -next will be accessed without the right instructions. The NAND chip will -be confused and will not output correct data. In order to avoid such -situation from happening anymore, we can however handle this case with a -bit of additional logic, to postpone the initialization of the read -sequence by one page. - -Reported-by: Alexander Shiyan <eagle.alexander923@gmail.com> -Closes: https://lore.kernel.org/linux-mtd/CAP1tNvS=NVAm-vfvYWbc3k9Cx9YxMc2uZZkmXk8h1NhGX877Zg@mail.gmail.com/ -Reported-by: Måns Rullgård <mans@mansr.com> -Closes: https://lore.kernel.org/linux-mtd/yw1xfs6j4k6q.fsf@mansr.com/ -Reported-by: Martin Hundebøll <martin@geanix.com> -Closes: https://lore.kernel.org/linux-mtd/9d0c42fcde79bfedfe5b05d6a4e9fdef71d3dd52.camel@geanix.com/ -Fixes: 003fe4b9545b ("mtd: rawnand: Support for sequential cache reads") -Cc: stable@vger.kernel.org -Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> -Tested-by: Martin Hundebøll <martin@geanix.com> -Link: https://lore.kernel.org/linux-mtd/20231215123208.516590-3-miquel.raynal@bootlin.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/mtd/nand/raw/nand_base.c | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) - -diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c -index 04e80ace4182..1b0a984d181d 100644 ---- a/drivers/mtd/nand/raw/nand_base.c -+++ b/drivers/mtd/nand/raw/nand_base.c -@@ -3478,6 +3478,18 @@ static void rawnand_enable_cont_reads(struct nand_chip *chip, unsigned int page, - rawnand_cap_cont_reads(chip); - } - -+static void rawnand_cont_read_skip_first_page(struct nand_chip *chip, unsigned int page) -+{ -+ if (!chip->cont_read.ongoing || page != chip->cont_read.first_page) -+ return; -+ -+ chip->cont_read.first_page++; -+ if (chip->cont_read.first_page == chip->cont_read.pause_page) -+ chip->cont_read.first_page++; -+ if (chip->cont_read.first_page >= chip->cont_read.last_page) -+ chip->cont_read.ongoing = false; -+} -+ - /** - * nand_setup_read_retry - [INTERN] Set the READ RETRY mode - * @chip: NAND chip object -@@ -3652,6 +3664,8 @@ static int nand_do_read_ops(struct nand_chip *chip, loff_t from, - buf += bytes; - max_bitflips = max_t(unsigned int, max_bitflips, - chip->pagecache.bitflips); -+ -+ rawnand_cont_read_skip_first_page(chip, page); - } - - readlen -= bytes; --- -2.43.2 - -From 17413aeae039336ce410d873415fda13c62adb98 Mon Sep 17 00:00:00 2001 -From: Miquel Raynal <miquel.raynal@bootlin.com> -Date: Fri, 15 Dec 2023 13:32:07 +0100 -Subject: [PATCH 0695/1501] mtd: rawnand: Prevent sequential reads with on-die - ECC engines -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1541 -Lines: 39 - -commit a62c4597953fe54c6af04166a5e2872efd0e1490 upstream. - -Some devices support sequential reads when using the on-die ECC engines, -some others do not. It is a bit hard to know which ones will break other -than experimentally, so in order to avoid such a difficult and painful -task, let's just pretend all devices should avoid using this -optimization when configured like this. - -Cc: stable@vger.kernel.org -Fixes: 003fe4b9545b ("mtd: rawnand: Support for sequential cache reads") -Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> -Tested-by: Martin Hundebøll <martin@geanix.com> -Link: https://lore.kernel.org/linux-mtd/20231215123208.516590-4-miquel.raynal@bootlin.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/mtd/nand/raw/nand_base.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c -index 1b0a984d181d..139fdf3e58c0 100644 ---- a/drivers/mtd/nand/raw/nand_base.c -+++ b/drivers/mtd/nand/raw/nand_base.c -@@ -5170,6 +5170,14 @@ static void rawnand_late_check_supported_ops(struct nand_chip *chip) - /* The supported_op fields should not be set by individual drivers */ - WARN_ON_ONCE(chip->controller->supported_op.cont_read); - -+ /* -+ * Too many devices do not support sequential cached reads with on-die -+ * ECC correction enabled, so in this case refuse to perform the -+ * automation. -+ */ -+ if (chip->ecc.engine_type == NAND_ECC_ENGINE_TYPE_ON_DIE) -+ return; -+ - if (!nand_has_exec_op(chip)) - return; - --- -2.43.2 - -From f97b329d1f98ab1b757110b2baa247c0f77b17e5 Mon Sep 17 00:00:00 2001 -From: Miquel Raynal <miquel.raynal@bootlin.com> -Date: Fri, 15 Dec 2023 13:32:08 +0100 -Subject: [PATCH 0696/1501] mtd: rawnand: Clarify conditions to enable - continuous reads -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2185 -Lines: 64 - -commit 828f6df1bcba7f64729166efc7086ea657070445 upstream. - -The current logic is probably fine but is a bit convoluted. Plus, we -don't want partial pages to be part of the sequential operation just in -case the core would optimize the page read with a subpage read (which -would break the sequence). This may happen on the first and last page -only, so if the start offset or the end offset is not aligned with a -page boundary, better avoid them to prevent any risk. - -Cc: stable@vger.kernel.org -Fixes: 003fe4b9545b ("mtd: rawnand: Support for sequential cache reads") -Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> -Tested-by: Martin Hundebøll <martin@geanix.com> -Link: https://lore.kernel.org/linux-mtd/20231215123208.516590-5-miquel.raynal@bootlin.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/mtd/nand/raw/nand_base.c | 26 +++++++++++++++++--------- - 1 file changed, 17 insertions(+), 9 deletions(-) - -diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c -index 139fdf3e58c0..bbdcfbe643f3 100644 ---- a/drivers/mtd/nand/raw/nand_base.c -+++ b/drivers/mtd/nand/raw/nand_base.c -@@ -3460,21 +3460,29 @@ static void rawnand_enable_cont_reads(struct nand_chip *chip, unsigned int page, - u32 readlen, int col) - { - struct mtd_info *mtd = nand_to_mtd(chip); -+ unsigned int end_page, end_col; -+ -+ chip->cont_read.ongoing = false; - - if (!chip->controller->supported_op.cont_read) - return; - -- if ((col && col + readlen < (3 * mtd->writesize)) || -- (!col && readlen < (2 * mtd->writesize))) { -- chip->cont_read.ongoing = false; -- return; -- } -+ end_page = DIV_ROUND_UP(col + readlen, mtd->writesize); -+ end_col = (col + readlen) % mtd->writesize; - -- chip->cont_read.ongoing = true; -- chip->cont_read.first_page = page; - if (col) -- chip->cont_read.first_page++; -- chip->cont_read.last_page = page + ((readlen >> chip->page_shift) & chip->pagemask); -+ page++; -+ -+ if (end_col && end_page) -+ end_page--; -+ -+ if (page + 1 > end_page) -+ return; -+ -+ chip->cont_read.first_page = page; -+ chip->cont_read.last_page = end_page; -+ chip->cont_read.ongoing = true; -+ - rawnand_cap_cont_reads(chip); - } - --- -2.43.2 - -From d26edf4ee3672cc9828f2a3ffae34086a712574d Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan+linaro@kernel.org> -Date: Thu, 9 Nov 2023 10:31:00 +0100 -Subject: [PATCH 0697/1501] soc: qcom: pmic_glink_altmode: fix port sanity - check -Content-Length: 1893 -Lines: 44 - -commit c4fb7d2eac9ff9bfc35a2e4d40c7169a332416e0 upstream. - -The PMIC GLINK altmode driver currently supports at most two ports. - -Fix the incomplete port sanity check on notifications to avoid -accessing and corrupting memory beyond the port array if we ever get a -notification for an unsupported port. - -Fixes: 080b4e24852b ("soc: qcom: pmic_glink: Introduce altmode support") -Cc: stable@vger.kernel.org # 6.3 -Signed-off-by: Johan Hovold <johan+linaro@kernel.org> -Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org> -Link: https://lore.kernel.org/r/20231109093100.19971-1-johan+linaro@kernel.org -Signed-off-by: Bjorn Andersson <andersson@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/soc/qcom/pmic_glink_altmode.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/soc/qcom/pmic_glink_altmode.c b/drivers/soc/qcom/pmic_glink_altmode.c -index b78279e2f54c..7ee52cf2570f 100644 ---- a/drivers/soc/qcom/pmic_glink_altmode.c -+++ b/drivers/soc/qcom/pmic_glink_altmode.c -@@ -285,7 +285,7 @@ static void pmic_glink_altmode_sc8180xp_notify(struct pmic_glink_altmode *altmod - - svid = mux == 2 ? USB_TYPEC_DP_SID : 0; - -- if (!altmode->ports[port].altmode) { -+ if (port >= ARRAY_SIZE(altmode->ports) || !altmode->ports[port].altmode) { - dev_dbg(altmode->dev, "notification on undefined port %d\n", port); - return; - } -@@ -328,7 +328,7 @@ static void pmic_glink_altmode_sc8280xp_notify(struct pmic_glink_altmode *altmod - hpd_state = FIELD_GET(SC8280XP_HPD_STATE_MASK, notify->payload[8]); - hpd_irq = FIELD_GET(SC8280XP_HPD_IRQ_MASK, notify->payload[8]); - -- if (!altmode->ports[port].altmode) { -+ if (port >= ARRAY_SIZE(altmode->ports) || !altmode->ports[port].altmode) { - dev_dbg(altmode->dev, "notification on undefined port %d\n", port); - return; - } --- -2.43.2 - -From 15914e41d0735398b70954bdfc9b6a76a2ddc3f5 Mon Sep 17 00:00:00 2001 -From: Bingbu Cao <bingbu.cao@intel.com> -Date: Wed, 22 Nov 2023 17:46:06 +0800 -Subject: [PATCH 0698/1501] media: imx355: Enable runtime PM before registering - async sub-device -Content-Length: 1807 -Lines: 54 - -commit efa5fe19c0a9199f49e36e1f5242ed5c88da617d upstream. - -As the sensor device maybe accessible right after its async sub-device is -registered, such as ipu-bridge will try to power up sensor by sensor's -client device's runtime PM from the async notifier callback, if runtime PM -is not enabled, it will fail. - -So runtime PM should be ready before its async sub-device is registered -and accessible by others. - -Fixes: df0b5c4a7ddd ("media: add imx355 camera sensor driver") -Cc: stable@vger.kernel.org -Signed-off-by: Bingbu Cao <bingbu.cao@intel.com> -Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/media/i2c/imx355.c | 12 +++++++----- - 1 file changed, 7 insertions(+), 5 deletions(-) - -diff --git a/drivers/media/i2c/imx355.c b/drivers/media/i2c/imx355.c -index 9c58c1a80cba..81bb61407bdc 100644 ---- a/drivers/media/i2c/imx355.c -+++ b/drivers/media/i2c/imx355.c -@@ -1748,10 +1748,6 @@ static int imx355_probe(struct i2c_client *client) - goto error_handler_free; - } - -- ret = v4l2_async_register_subdev_sensor(&imx355->sd); -- if (ret < 0) -- goto error_media_entity; -- - /* - * Device is already turned on by i2c-core with ACPI domain PM. - * Enable runtime PM and turn off the device. -@@ -1760,9 +1756,15 @@ static int imx355_probe(struct i2c_client *client) - pm_runtime_enable(&client->dev); - pm_runtime_idle(&client->dev); - -+ ret = v4l2_async_register_subdev_sensor(&imx355->sd); -+ if (ret < 0) -+ goto error_media_entity_runtime_pm; -+ - return 0; - --error_media_entity: -+error_media_entity_runtime_pm: -+ pm_runtime_disable(&client->dev); -+ pm_runtime_set_suspended(&client->dev); - media_entity_cleanup(&imx355->sd.entity); - - error_handler_free: --- -2.43.2 - -From 9a416d624e5fb7246ea97c11fbfea7e0e27abf43 Mon Sep 17 00:00:00 2001 -From: Xiaolei Wang <xiaolei.wang@windriver.com> -Date: Fri, 15 Dec 2023 10:00:49 +0800 -Subject: [PATCH 0699/1501] rpmsg: virtio: Free driver_override when - rpmsg_remove() -Content-Length: 2233 -Lines: 52 - -commit d5362c37e1f8a40096452fc201c30e705750e687 upstream. - -Free driver_override when rpmsg_remove(), otherwise -the following memory leak will occur: - -unreferenced object 0xffff0000d55d7080 (size 128): - comm "kworker/u8:2", pid 56, jiffies 4294893188 (age 214.272s) - hex dump (first 32 bytes): - 72 70 6d 73 67 5f 6e 73 00 00 00 00 00 00 00 00 rpmsg_ns........ - 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ - backtrace: - [<000000009c94c9c1>] __kmem_cache_alloc_node+0x1f8/0x320 - [<000000002300d89b>] __kmalloc_node_track_caller+0x44/0x70 - [<00000000228a60c3>] kstrndup+0x4c/0x90 - [<0000000077158695>] driver_set_override+0xd0/0x164 - [<000000003e9c4ea5>] rpmsg_register_device_override+0x98/0x170 - [<000000001c0c89a8>] rpmsg_ns_register_device+0x24/0x30 - [<000000008bbf8fa2>] rpmsg_probe+0x2e0/0x3ec - [<00000000e65a68df>] virtio_dev_probe+0x1c0/0x280 - [<00000000443331cc>] really_probe+0xbc/0x2dc - [<00000000391064b1>] __driver_probe_device+0x78/0xe0 - [<00000000a41c9a5b>] driver_probe_device+0xd8/0x160 - [<000000009c3bd5df>] __device_attach_driver+0xb8/0x140 - [<0000000043cd7614>] bus_for_each_drv+0x7c/0xd4 - [<000000003b929a36>] __device_attach+0x9c/0x19c - [<00000000a94e0ba8>] device_initial_probe+0x14/0x20 - [<000000003c999637>] bus_probe_device+0xa0/0xac - -Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com> -Fixes: b0b03b811963 ("rpmsg: Release rpmsg devices in backends") -Cc: stable@vger.kernel.org -Link: https://lore.kernel.org/r/20231215020049.78750-1-xiaolei.wang@windriver.com -Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/rpmsg/virtio_rpmsg_bus.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c -index dc87965f8164..1062939c3264 100644 ---- a/drivers/rpmsg/virtio_rpmsg_bus.c -+++ b/drivers/rpmsg/virtio_rpmsg_bus.c -@@ -378,6 +378,7 @@ static void virtio_rpmsg_release_device(struct device *dev) - struct rpmsg_device *rpdev = to_rpmsg_device(dev); - struct virtio_rpmsg_channel *vch = to_virtio_rpmsg_channel(rpdev); - -+ kfree(rpdev->driver_override); - kfree(vch); - } - --- -2.43.2 - -From 7dd53e14a6e98b42e746edf5f60fd89e90d5d376 Mon Sep 17 00:00:00 2001 -From: Bingbu Cao <bingbu.cao@intel.com> -Date: Wed, 22 Nov 2023 17:46:09 +0800 -Subject: [PATCH 0700/1501] media: ov9734: Enable runtime PM before registering - async sub-device -Content-Length: 2315 -Lines: 68 - -commit e242e9c144050ed120cf666642ba96b7c4462a4c upstream. - -As the sensor device maybe accessible right after its async sub-device is -registered, such as ipu-bridge will try to power up sensor by sensor's -client device's runtime PM from the async notifier callback, if runtime PM -is not enabled, it will fail. - -So runtime PM should be ready before its async sub-device is registered -and accessible by others. - -Fixes: d3f863a63fe4 ("media: i2c: Add ov9734 image sensor driver") -Cc: stable@vger.kernel.org -Signed-off-by: Bingbu Cao <bingbu.cao@intel.com> -Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/media/i2c/ov9734.c | 19 +++++++++++-------- - 1 file changed, 11 insertions(+), 8 deletions(-) - -diff --git a/drivers/media/i2c/ov9734.c b/drivers/media/i2c/ov9734.c -index ee3315299605..f1377c305bce 100644 ---- a/drivers/media/i2c/ov9734.c -+++ b/drivers/media/i2c/ov9734.c -@@ -894,6 +894,7 @@ static void ov9734_remove(struct i2c_client *client) - media_entity_cleanup(&sd->entity); - v4l2_ctrl_handler_free(sd->ctrl_handler); - pm_runtime_disable(&client->dev); -+ pm_runtime_set_suspended(&client->dev); - mutex_destroy(&ov9734->mutex); - } - -@@ -939,13 +940,6 @@ static int ov9734_probe(struct i2c_client *client) - goto probe_error_v4l2_ctrl_handler_free; - } - -- ret = v4l2_async_register_subdev_sensor(&ov9734->sd); -- if (ret < 0) { -- dev_err(&client->dev, "failed to register V4L2 subdev: %d", -- ret); -- goto probe_error_media_entity_cleanup; -- } -- - /* - * Device is already turned on by i2c-core with ACPI domain PM. - * Enable runtime PM and turn off the device. -@@ -954,9 +948,18 @@ static int ov9734_probe(struct i2c_client *client) - pm_runtime_enable(&client->dev); - pm_runtime_idle(&client->dev); - -+ ret = v4l2_async_register_subdev_sensor(&ov9734->sd); -+ if (ret < 0) { -+ dev_err(&client->dev, "failed to register V4L2 subdev: %d", -+ ret); -+ goto probe_error_media_entity_cleanup_pm; -+ } -+ - return 0; - --probe_error_media_entity_cleanup: -+probe_error_media_entity_cleanup_pm: -+ pm_runtime_disable(&client->dev); -+ pm_runtime_set_suspended(&client->dev); - media_entity_cleanup(&ov9734->sd.entity); - - probe_error_v4l2_ctrl_handler_free: --- -2.43.2 - -From a14314c065c14fa370cd7915b072d300fbead269 Mon Sep 17 00:00:00 2001 -From: Bingbu Cao <bingbu.cao@intel.com> -Date: Wed, 22 Nov 2023 17:46:08 +0800 -Subject: [PATCH 0701/1501] media: ov13b10: Enable runtime PM before - registering async sub-device -Content-Length: 2164 -Lines: 67 - -commit 7b0454cfd8edb3509619407c3b9f78a6d0dee1a5 upstream. - -As the sensor device maybe accessible right after its async sub-device is -registered, such as ipu-bridge will try to power up sensor by sensor's -client device's runtime PM from the async notifier callback, if runtime PM -is not enabled, it will fail. - -So runtime PM should be ready before its async sub-device is registered -and accessible by others. - -Fixes: 7ee850546822 ("media: Add sensor driver support for the ov13b10 camera.") -Cc: stable@vger.kernel.org -Signed-off-by: Bingbu Cao <bingbu.cao@intel.com> -Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/media/i2c/ov13b10.c | 14 +++++++++----- - 1 file changed, 9 insertions(+), 5 deletions(-) - -diff --git a/drivers/media/i2c/ov13b10.c b/drivers/media/i2c/ov13b10.c -index 970d2caeb3d6..2793e4675c6d 100644 ---- a/drivers/media/i2c/ov13b10.c -+++ b/drivers/media/i2c/ov13b10.c -@@ -1556,24 +1556,27 @@ static int ov13b10_probe(struct i2c_client *client) - goto error_handler_free; - } - -- ret = v4l2_async_register_subdev_sensor(&ov13b->sd); -- if (ret < 0) -- goto error_media_entity; - - /* - * Device is already turned on by i2c-core with ACPI domain PM. - * Enable runtime PM and turn off the device. - */ -- - /* Set the device's state to active if it's in D0 state. */ - if (full_power) - pm_runtime_set_active(&client->dev); - pm_runtime_enable(&client->dev); - pm_runtime_idle(&client->dev); - -+ ret = v4l2_async_register_subdev_sensor(&ov13b->sd); -+ if (ret < 0) -+ goto error_media_entity_runtime_pm; -+ - return 0; - --error_media_entity: -+error_media_entity_runtime_pm: -+ pm_runtime_disable(&client->dev); -+ if (full_power) -+ pm_runtime_set_suspended(&client->dev); - media_entity_cleanup(&ov13b->sd.entity); - - error_handler_free: -@@ -1596,6 +1599,7 @@ static void ov13b10_remove(struct i2c_client *client) - ov13b10_free_controls(ov13b); - - pm_runtime_disable(&client->dev); -+ pm_runtime_set_suspended(&client->dev); - } - - static DEFINE_RUNTIME_DEV_PM_OPS(ov13b10_pm_ops, ov13b10_suspend, --- -2.43.2 - -From 900a5edf278b3c96eedd6fc49443ba058bcda5ff Mon Sep 17 00:00:00 2001 -From: Bingbu Cao <bingbu.cao@intel.com> -Date: Wed, 22 Nov 2023 17:46:07 +0800 -Subject: [PATCH 0702/1501] media: ov01a10: Enable runtime PM before - registering async sub-device -Content-Length: 2213 -Lines: 70 - -commit 47a78052db51b16e8045524fbf33373b58f1323b upstream. - -As the sensor device maybe accessible right after its async sub-device is -registered, such as ipu-bridge will try to power up sensor by sensor's -client device's runtime PM from the async notifier callback, if runtime PM -is not enabled, it will fail. - -So runtime PM should be ready before its async sub-device is registered -and accessible by others. - -It also sets the runtime PM status to active as the sensor was turned -on by i2c-core. - -Fixes: 0827b58dabff ("media: i2c: add ov01a10 image sensor driver") -Cc: stable@vger.kernel.org -Signed-off-by: Bingbu Cao <bingbu.cao@intel.com> -Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/media/i2c/ov01a10.c | 22 ++++++++++++++++------ - 1 file changed, 16 insertions(+), 6 deletions(-) - -diff --git a/drivers/media/i2c/ov01a10.c b/drivers/media/i2c/ov01a10.c -index bbd5740d2280..02de09edc3f9 100644 ---- a/drivers/media/i2c/ov01a10.c -+++ b/drivers/media/i2c/ov01a10.c -@@ -859,6 +859,7 @@ static void ov01a10_remove(struct i2c_client *client) - v4l2_ctrl_handler_free(sd->ctrl_handler); - - pm_runtime_disable(&client->dev); -+ pm_runtime_set_suspended(&client->dev); - } - - static int ov01a10_probe(struct i2c_client *client) -@@ -905,17 +906,26 @@ static int ov01a10_probe(struct i2c_client *client) - goto err_media_entity_cleanup; - } - -- ret = v4l2_async_register_subdev_sensor(&ov01a10->sd); -- if (ret < 0) { -- dev_err(dev, "Failed to register subdev: %d\n", ret); -- goto err_media_entity_cleanup; -- } -- -+ /* -+ * Device is already turned on by i2c-core with ACPI domain PM. -+ * Enable runtime PM and turn off the device. -+ */ -+ pm_runtime_set_active(&client->dev); - pm_runtime_enable(dev); - pm_runtime_idle(dev); - -+ ret = v4l2_async_register_subdev_sensor(&ov01a10->sd); -+ if (ret < 0) { -+ dev_err(dev, "Failed to register subdev: %d\n", ret); -+ goto err_pm_disable; -+ } -+ - return 0; - -+err_pm_disable: -+ pm_runtime_disable(dev); -+ pm_runtime_set_suspended(&client->dev); -+ - err_media_entity_cleanup: - media_entity_cleanup(&ov01a10->sd.entity); - --- -2.43.2 - -From c17fcc9673676fc7a4a8ccd899e7c1203393a9a8 Mon Sep 17 00:00:00 2001 -From: Herve Codina <herve.codina@bootlin.com> -Date: Tue, 5 Dec 2023 16:20:58 +0100 -Subject: [PATCH 0703/1501] soc: fsl: cpm1: tsa: Fix __iomem addresses - declaration -Content-Length: 3001 -Lines: 98 - -commit fc0c64154e5ddeb6f63c954735bd646ce5b8d9a4 upstream. - -Running sparse (make C=1) on tsa.c raises a lot of warning such as: - --- 8< --- - warning: incorrect type in assignment (different address spaces) - expected void *[noderef] si_regs - got void [noderef] __iomem * - --- 8< --- - -Indeed, some variable were declared 'type *__iomem var' instead of -'type __iomem *var'. - -Use the correct declaration to remove these warnings. - -Fixes: 1d4ba0b81c1c ("soc: fsl: cpm1: Add support for TSA") -Cc: stable@vger.kernel.org -Reported-by: kernel test robot <lkp@intel.com> -Closes: https://lore.kernel.org/oe-kbuild-all/202312051959.9YdRIYbg-lkp@intel.com/ -Signed-off-by: Herve Codina <herve.codina@bootlin.com> -Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu> -Link: https://lore.kernel.org/r/20231205152116.122512-2-herve.codina@bootlin.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/soc/fsl/qe/tsa.c | 22 +++++++++++----------- - 1 file changed, 11 insertions(+), 11 deletions(-) - -diff --git a/drivers/soc/fsl/qe/tsa.c b/drivers/soc/fsl/qe/tsa.c -index 3f9981335590..6c5741cf5e9d 100644 ---- a/drivers/soc/fsl/qe/tsa.c -+++ b/drivers/soc/fsl/qe/tsa.c -@@ -98,9 +98,9 @@ - #define TSA_SIRP 0x10 - - struct tsa_entries_area { -- void *__iomem entries_start; -- void *__iomem entries_next; -- void *__iomem last_entry; -+ void __iomem *entries_start; -+ void __iomem *entries_next; -+ void __iomem *last_entry; - }; - - struct tsa_tdm { -@@ -117,8 +117,8 @@ struct tsa_tdm { - - struct tsa { - struct device *dev; -- void *__iomem si_regs; -- void *__iomem si_ram; -+ void __iomem *si_regs; -+ void __iomem *si_ram; - resource_size_t si_ram_sz; - spinlock_t lock; - int tdms; /* TSA_TDMx ORed */ -@@ -135,27 +135,27 @@ static inline struct tsa *tsa_serial_get_tsa(struct tsa_serial *tsa_serial) - return container_of(tsa_serial, struct tsa, serials[tsa_serial->id]); - } - --static inline void tsa_write32(void *__iomem addr, u32 val) -+static inline void tsa_write32(void __iomem *addr, u32 val) - { - iowrite32be(val, addr); - } - --static inline void tsa_write8(void *__iomem addr, u32 val) -+static inline void tsa_write8(void __iomem *addr, u32 val) - { - iowrite8(val, addr); - } - --static inline u32 tsa_read32(void *__iomem addr) -+static inline u32 tsa_read32(void __iomem *addr) - { - return ioread32be(addr); - } - --static inline void tsa_clrbits32(void *__iomem addr, u32 clr) -+static inline void tsa_clrbits32(void __iomem *addr, u32 clr) - { - tsa_write32(addr, tsa_read32(addr) & ~clr); - } - --static inline void tsa_clrsetbits32(void *__iomem addr, u32 clr, u32 set) -+static inline void tsa_clrsetbits32(void __iomem *addr, u32 clr, u32 set) - { - tsa_write32(addr, (tsa_read32(addr) & ~clr) | set); - } -@@ -313,7 +313,7 @@ static u32 tsa_serial_id2csel(struct tsa *tsa, u32 serial_id) - static int tsa_add_entry(struct tsa *tsa, struct tsa_entries_area *area, - u32 count, u32 serial_id) - { -- void *__iomem addr; -+ void __iomem *addr; - u32 left; - u32 val; - u32 cnt; --- -2.43.2 - -From 4c1080e07d206a4120c0a4828da68ff0200ccf10 Mon Sep 17 00:00:00 2001 -From: Herve Codina <herve.codina@bootlin.com> -Date: Tue, 5 Dec 2023 16:20:59 +0100 -Subject: [PATCH 0704/1501] soc: fsl: cpm1: qmc: Fix __iomem addresses - declaration -Content-Length: 4266 -Lines: 151 - -commit a5ec3a21220da06bdda2e686012ca64fdb6c513d upstream. - -Running sparse (make C=1) on qmc.c raises a lot of warning such as: - ... - warning: incorrect type in assignment (different address spaces) - expected struct cpm_buf_desc [usertype] *[noderef] __iomem bd - got struct cpm_buf_desc [noderef] [usertype] __iomem *txbd_free - ... - -Indeed, some variable were declared 'type *__iomem var' instead of -'type __iomem *var'. - -Use the correct declaration to remove these warnings. - -Fixes: 3178d58e0b97 ("soc: fsl: cpm1: Add support for QMC") -Cc: stable@vger.kernel.org -Signed-off-by: Herve Codina <herve.codina@bootlin.com> -Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu> -Link: https://lore.kernel.org/r/20231205152116.122512-3-herve.codina@bootlin.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/soc/fsl/qe/qmc.c | 34 +++++++++++++++++----------------- - 1 file changed, 17 insertions(+), 17 deletions(-) - -diff --git a/drivers/soc/fsl/qe/qmc.c b/drivers/soc/fsl/qe/qmc.c -index 92ec76c03965..3f3de1351c96 100644 ---- a/drivers/soc/fsl/qe/qmc.c -+++ b/drivers/soc/fsl/qe/qmc.c -@@ -175,7 +175,7 @@ struct qmc_chan { - struct list_head list; - unsigned int id; - struct qmc *qmc; -- void *__iomem s_param; -+ void __iomem *s_param; - enum qmc_mode mode; - u64 tx_ts_mask; - u64 rx_ts_mask; -@@ -203,9 +203,9 @@ struct qmc_chan { - struct qmc { - struct device *dev; - struct tsa_serial *tsa_serial; -- void *__iomem scc_regs; -- void *__iomem scc_pram; -- void *__iomem dpram; -+ void __iomem *scc_regs; -+ void __iomem *scc_pram; -+ void __iomem *dpram; - u16 scc_pram_offset; - cbd_t __iomem *bd_table; - dma_addr_t bd_dma_addr; -@@ -218,37 +218,37 @@ struct qmc { - struct qmc_chan *chans[64]; - }; - --static inline void qmc_write16(void *__iomem addr, u16 val) -+static inline void qmc_write16(void __iomem *addr, u16 val) - { - iowrite16be(val, addr); - } - --static inline u16 qmc_read16(void *__iomem addr) -+static inline u16 qmc_read16(void __iomem *addr) - { - return ioread16be(addr); - } - --static inline void qmc_setbits16(void *__iomem addr, u16 set) -+static inline void qmc_setbits16(void __iomem *addr, u16 set) - { - qmc_write16(addr, qmc_read16(addr) | set); - } - --static inline void qmc_clrbits16(void *__iomem addr, u16 clr) -+static inline void qmc_clrbits16(void __iomem *addr, u16 clr) - { - qmc_write16(addr, qmc_read16(addr) & ~clr); - } - --static inline void qmc_write32(void *__iomem addr, u32 val) -+static inline void qmc_write32(void __iomem *addr, u32 val) - { - iowrite32be(val, addr); - } - --static inline u32 qmc_read32(void *__iomem addr) -+static inline u32 qmc_read32(void __iomem *addr) - { - return ioread32be(addr); - } - --static inline void qmc_setbits32(void *__iomem addr, u32 set) -+static inline void qmc_setbits32(void __iomem *addr, u32 set) - { - qmc_write32(addr, qmc_read32(addr) | set); - } -@@ -318,7 +318,7 @@ int qmc_chan_write_submit(struct qmc_chan *chan, dma_addr_t addr, size_t length, - { - struct qmc_xfer_desc *xfer_desc; - unsigned long flags; -- cbd_t *__iomem bd; -+ cbd_t __iomem *bd; - u16 ctrl; - int ret; - -@@ -374,7 +374,7 @@ static void qmc_chan_write_done(struct qmc_chan *chan) - void (*complete)(void *context); - unsigned long flags; - void *context; -- cbd_t *__iomem bd; -+ cbd_t __iomem *bd; - u16 ctrl; - - /* -@@ -425,7 +425,7 @@ int qmc_chan_read_submit(struct qmc_chan *chan, dma_addr_t addr, size_t length, - { - struct qmc_xfer_desc *xfer_desc; - unsigned long flags; -- cbd_t *__iomem bd; -+ cbd_t __iomem *bd; - u16 ctrl; - int ret; - -@@ -488,7 +488,7 @@ static void qmc_chan_read_done(struct qmc_chan *chan) - void (*complete)(void *context, size_t size); - struct qmc_xfer_desc *xfer_desc; - unsigned long flags; -- cbd_t *__iomem bd; -+ cbd_t __iomem *bd; - void *context; - u16 datalen; - u16 ctrl; -@@ -663,7 +663,7 @@ static void qmc_chan_reset_rx(struct qmc_chan *chan) - { - struct qmc_xfer_desc *xfer_desc; - unsigned long flags; -- cbd_t *__iomem bd; -+ cbd_t __iomem *bd; - u16 ctrl; - - spin_lock_irqsave(&chan->rx_lock, flags); -@@ -694,7 +694,7 @@ static void qmc_chan_reset_tx(struct qmc_chan *chan) - { - struct qmc_xfer_desc *xfer_desc; - unsigned long flags; -- cbd_t *__iomem bd; -+ cbd_t __iomem *bd; - u16 ctrl; - - spin_lock_irqsave(&chan->tx_lock, flags); --- -2.43.2 - -From 6ce2041036098207757c63db9649fc8ec5e231b2 Mon Sep 17 00:00:00 2001 -From: Herve Codina <herve.codina@bootlin.com> -Date: Tue, 5 Dec 2023 16:21:00 +0100 -Subject: [PATCH 0705/1501] soc: fsl: cpm1: qmc: Fix rx channel reset -Content-Length: 1283 -Lines: 37 - -commit dfe66d012af2ddfa566cf9c860b8472b412fb7e4 upstream. - -The qmc_chan_reset_rx() set the is_rx_stopped flag. This leads to an -inconsistent state in the following sequence. - qmc_chan_stop() - qmc_chan_reset() -Indeed, after the qmc_chan_reset() call, the channel must still be -stopped. Only a qmc_chan_start() call can move the channel from stopped -state to started state. - -Fix the issue removing the is_rx_stopped flag setting from -qmc_chan_reset() - -Fixes: 3178d58e0b97 ("soc: fsl: cpm1: Add support for QMC") -Cc: stable@vger.kernel.org -Signed-off-by: Herve Codina <herve.codina@bootlin.com> -Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu> -Link: https://lore.kernel.org/r/20231205152116.122512-4-herve.codina@bootlin.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/soc/fsl/qe/qmc.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/drivers/soc/fsl/qe/qmc.c b/drivers/soc/fsl/qe/qmc.c -index 3f3de1351c96..2312152a44b3 100644 ---- a/drivers/soc/fsl/qe/qmc.c -+++ b/drivers/soc/fsl/qe/qmc.c -@@ -685,7 +685,6 @@ static void qmc_chan_reset_rx(struct qmc_chan *chan) - qmc_read16(chan->s_param + QMC_SPE_RBASE)); - - chan->rx_pending = 0; -- chan->is_rx_stopped = false; - - spin_unlock_irqrestore(&chan->rx_lock, flags); - } --- -2.43.2 - -From cdd134d56138302976685e6c7bc4755450b3880e Mon Sep 17 00:00:00 2001 -From: Tony Krowiak <akrowiak@linux.ibm.com> -Date: Mon, 15 Jan 2024 13:54:31 -0500 -Subject: [PATCH 0706/1501] s390/vfio-ap: always filter entire AP matrix -Content-Length: 6949 -Lines: 179 - -commit 850fb7fa8c684a4c6bf0e4b6978f4ddcc5d43d11 upstream. - -The vfio_ap_mdev_filter_matrix function is called whenever a new adapter or -domain is assigned to the mdev. The purpose of the function is to update -the guest's AP configuration by filtering the matrix of adapters and -domains assigned to the mdev. When an adapter or domain is assigned, only -the APQNs associated with the APID of the new adapter or APQI of the new -domain are inspected. If an APQN does not reference a queue device bound to -the vfio_ap device driver, then it's APID will be filtered from the mdev's -matrix when updating the guest's AP configuration. - -Inspecting only the APID of the new adapter or APQI of the new domain will -result in passing AP queues through to a guest that are not bound to the -vfio_ap device driver under certain circumstances. Consider the following: - -guest's AP configuration (all also assigned to the mdev's matrix): -14.0004 -14.0005 -14.0006 -16.0004 -16.0005 -16.0006 - -unassign domain 4 -unbind queue 16.0005 -assign domain 4 - -When domain 4 is re-assigned, since only domain 4 will be inspected, the -APQNs that will be examined will be: -14.0004 -16.0004 - -Since both of those APQNs reference queue devices that are bound to the -vfio_ap device driver, nothing will get filtered from the mdev's matrix -when updating the guest's AP configuration. Consequently, queue 16.0005 -will get passed through despite not being bound to the driver. This -violates the linux device model requirement that a guest shall only be -given access to devices bound to the device driver facilitating their -pass-through. - -To resolve this problem, every adapter and domain assigned to the mdev will -be inspected when filtering the mdev's matrix. - -Signed-off-by: Tony Krowiak <akrowiak@linux.ibm.com> -Acked-by: Halil Pasic <pasic@linux.ibm.com> -Fixes: 48cae940c31d ("s390/vfio-ap: refresh guest's APCB by filtering AP resources assigned to mdev") -Cc: stable@vger.kernel.org -Link: https://lore.kernel.org/r/20240115185441.31526-2-akrowiak@linux.ibm.com -Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/s390/crypto/vfio_ap_ops.c | 55 +++++++++---------------------- - 1 file changed, 16 insertions(+), 39 deletions(-) - -diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c -index 9cb28978c186..f4c6561594da 100644 ---- a/drivers/s390/crypto/vfio_ap_ops.c -+++ b/drivers/s390/crypto/vfio_ap_ops.c -@@ -671,8 +671,7 @@ static bool vfio_ap_mdev_filter_cdoms(struct ap_matrix_mdev *matrix_mdev) - * Return: a boolean value indicating whether the KVM guest's APCB was changed - * by the filtering or not. - */ --static bool vfio_ap_mdev_filter_matrix(unsigned long *apm, unsigned long *aqm, -- struct ap_matrix_mdev *matrix_mdev) -+static bool vfio_ap_mdev_filter_matrix(struct ap_matrix_mdev *matrix_mdev) - { - unsigned long apid, apqi, apqn; - DECLARE_BITMAP(prev_shadow_apm, AP_DEVICES); -@@ -693,8 +692,8 @@ static bool vfio_ap_mdev_filter_matrix(unsigned long *apm, unsigned long *aqm, - bitmap_and(matrix_mdev->shadow_apcb.aqm, matrix_mdev->matrix.aqm, - (unsigned long *)matrix_dev->info.aqm, AP_DOMAINS); - -- for_each_set_bit_inv(apid, apm, AP_DEVICES) { -- for_each_set_bit_inv(apqi, aqm, AP_DOMAINS) { -+ for_each_set_bit_inv(apid, matrix_mdev->matrix.apm, AP_DEVICES) { -+ for_each_set_bit_inv(apqi, matrix_mdev->matrix.aqm, AP_DOMAINS) { - /* - * If the APQN is not bound to the vfio_ap device - * driver, then we can't assign it to the guest's -@@ -959,7 +958,6 @@ static ssize_t assign_adapter_store(struct device *dev, - { - int ret; - unsigned long apid; -- DECLARE_BITMAP(apm_delta, AP_DEVICES); - struct ap_matrix_mdev *matrix_mdev = dev_get_drvdata(dev); - - mutex_lock(&ap_perms_mutex); -@@ -988,11 +986,8 @@ static ssize_t assign_adapter_store(struct device *dev, - } - - vfio_ap_mdev_link_adapter(matrix_mdev, apid); -- memset(apm_delta, 0, sizeof(apm_delta)); -- set_bit_inv(apid, apm_delta); - -- if (vfio_ap_mdev_filter_matrix(apm_delta, -- matrix_mdev->matrix.aqm, matrix_mdev)) -+ if (vfio_ap_mdev_filter_matrix(matrix_mdev)) - vfio_ap_mdev_update_guest_apcb(matrix_mdev); - - ret = count; -@@ -1168,7 +1163,6 @@ static ssize_t assign_domain_store(struct device *dev, - { - int ret; - unsigned long apqi; -- DECLARE_BITMAP(aqm_delta, AP_DOMAINS); - struct ap_matrix_mdev *matrix_mdev = dev_get_drvdata(dev); - - mutex_lock(&ap_perms_mutex); -@@ -1197,11 +1191,8 @@ static ssize_t assign_domain_store(struct device *dev, - } - - vfio_ap_mdev_link_domain(matrix_mdev, apqi); -- memset(aqm_delta, 0, sizeof(aqm_delta)); -- set_bit_inv(apqi, aqm_delta); - -- if (vfio_ap_mdev_filter_matrix(matrix_mdev->matrix.apm, aqm_delta, -- matrix_mdev)) -+ if (vfio_ap_mdev_filter_matrix(matrix_mdev)) - vfio_ap_mdev_update_guest_apcb(matrix_mdev); - - ret = count; -@@ -2092,9 +2083,7 @@ int vfio_ap_mdev_probe_queue(struct ap_device *apdev) - if (matrix_mdev) { - vfio_ap_mdev_link_queue(matrix_mdev, q); - -- if (vfio_ap_mdev_filter_matrix(matrix_mdev->matrix.apm, -- matrix_mdev->matrix.aqm, -- matrix_mdev)) -+ if (vfio_ap_mdev_filter_matrix(matrix_mdev)) - vfio_ap_mdev_update_guest_apcb(matrix_mdev); - } - dev_set_drvdata(&apdev->device, q); -@@ -2444,34 +2433,22 @@ void vfio_ap_on_cfg_changed(struct ap_config_info *cur_cfg_info, - - static void vfio_ap_mdev_hot_plug_cfg(struct ap_matrix_mdev *matrix_mdev) - { -- bool do_hotplug = false; -- int filter_domains = 0; -- int filter_adapters = 0; -- DECLARE_BITMAP(apm, AP_DEVICES); -- DECLARE_BITMAP(aqm, AP_DOMAINS); -+ bool filter_domains, filter_adapters, filter_cdoms, do_hotplug = false; - - mutex_lock(&matrix_mdev->kvm->lock); - mutex_lock(&matrix_dev->mdevs_lock); - -- filter_adapters = bitmap_and(apm, matrix_mdev->matrix.apm, -- matrix_mdev->apm_add, AP_DEVICES); -- filter_domains = bitmap_and(aqm, matrix_mdev->matrix.aqm, -- matrix_mdev->aqm_add, AP_DOMAINS); -+ filter_adapters = bitmap_intersects(matrix_mdev->matrix.apm, -+ matrix_mdev->apm_add, AP_DEVICES); -+ filter_domains = bitmap_intersects(matrix_mdev->matrix.aqm, -+ matrix_mdev->aqm_add, AP_DOMAINS); -+ filter_cdoms = bitmap_intersects(matrix_mdev->matrix.adm, -+ matrix_mdev->adm_add, AP_DOMAINS); - -- if (filter_adapters && filter_domains) -- do_hotplug |= vfio_ap_mdev_filter_matrix(apm, aqm, matrix_mdev); -- else if (filter_adapters) -- do_hotplug |= -- vfio_ap_mdev_filter_matrix(apm, -- matrix_mdev->shadow_apcb.aqm, -- matrix_mdev); -- else -- do_hotplug |= -- vfio_ap_mdev_filter_matrix(matrix_mdev->shadow_apcb.apm, -- aqm, matrix_mdev); -+ if (filter_adapters || filter_domains) -+ do_hotplug = vfio_ap_mdev_filter_matrix(matrix_mdev); - -- if (bitmap_intersects(matrix_mdev->matrix.adm, matrix_mdev->adm_add, -- AP_DOMAINS)) -+ if (filter_cdoms) - do_hotplug |= vfio_ap_mdev_filter_cdoms(matrix_mdev); - - if (do_hotplug) --- -2.43.2 - -From 24f07b64c791c957be6f437a374d2ca8fdfad4bc Mon Sep 17 00:00:00 2001 -From: Tony Krowiak <akrowiak@linux.ibm.com> -Date: Mon, 15 Jan 2024 13:54:32 -0500 -Subject: [PATCH 0707/1501] s390/vfio-ap: loop over the shadow APCB when - filtering guest's AP configuration -Content-Length: 2571 -Lines: 53 - -commit 16fb78cbf56e42b8efb2682a4444ab59e32e7959 upstream. - -While filtering the mdev matrix, it doesn't make sense - and will have -unexpected results - to filter an APID from the matrix if the APID or one -of the associated APQIs is not in the host's AP configuration. There are -two reasons for this: - -1. An adapter or domain that is not in the host's AP configuration can be - assigned to the matrix; this is known as over-provisioning. Queue - devices, however, are only created for adapters and domains in the - host's AP configuration, so there will be no queues associated with an - over-provisioned adapter or domain to filter. - -2. The adapter or domain may have been externally removed from the host's - configuration via an SE or HMC attached to a DPM enabled LPAR. In this - case, the vfio_ap device driver would have been notified by the AP bus - via the on_config_changed callback and the adapter or domain would - have already been filtered. - -Since the matrix_mdev->shadow_apcb.apm and matrix_mdev->shadow_apcb.aqm are -copied from the mdev matrix sans the APIDs and APQIs not in the host's AP -configuration, let's loop over those bitmaps instead of those assigned to -the matrix. - -Signed-off-by: Tony Krowiak <akrowiak@linux.ibm.com> -Reviewed-by: Halil Pasic <pasic@linux.ibm.com> -Fixes: 48cae940c31d ("s390/vfio-ap: refresh guest's APCB by filtering AP resources assigned to mdev") -Cc: stable@vger.kernel.org -Link: https://lore.kernel.org/r/20240115185441.31526-3-akrowiak@linux.ibm.com -Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/s390/crypto/vfio_ap_ops.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c -index f4c6561594da..cba6a03a0ab1 100644 ---- a/drivers/s390/crypto/vfio_ap_ops.c -+++ b/drivers/s390/crypto/vfio_ap_ops.c -@@ -692,8 +692,9 @@ static bool vfio_ap_mdev_filter_matrix(struct ap_matrix_mdev *matrix_mdev) - bitmap_and(matrix_mdev->shadow_apcb.aqm, matrix_mdev->matrix.aqm, - (unsigned long *)matrix_dev->info.aqm, AP_DOMAINS); - -- for_each_set_bit_inv(apid, matrix_mdev->matrix.apm, AP_DEVICES) { -- for_each_set_bit_inv(apqi, matrix_mdev->matrix.aqm, AP_DOMAINS) { -+ for_each_set_bit_inv(apid, matrix_mdev->shadow_apcb.apm, AP_DEVICES) { -+ for_each_set_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm, -+ AP_DOMAINS) { - /* - * If the APQN is not bound to the vfio_ap device - * driver, then we can't assign it to the guest's --- -2.43.2 - -From c706b3e6acc4bd3c52bdb6fc63baa5f331636965 Mon Sep 17 00:00:00 2001 -From: Tony Krowiak <akrowiak@linux.ibm.com> -Date: Mon, 15 Jan 2024 13:54:33 -0500 -Subject: [PATCH 0708/1501] s390/vfio-ap: let on_scan_complete() callback - filter matrix and update guest's APCB -Content-Length: 2967 -Lines: 64 - -commit 774d10196e648e2c0b78da817f631edfb3dfa557 upstream. - -When adapters and/or domains are added to the host's AP configuration, this -may result in multiple queue devices getting created and probed by the -vfio_ap device driver. For each queue device probed, the matrix of adapters -and domains assigned to a matrix mdev will be filtered to update the -guest's APCB. If any adapters or domains get added to or removed from the -APCB, the guest's AP configuration will be dynamically updated (i.e., hot -plug/unplug). To dynamically update the guest's configuration, its VCPUs -must be taken out of SIE for the period of time it takes to make the -update. This is disruptive to the guest's operation and if there are many -queues probed due to a change in the host's AP configuration, this could be -troublesome. The problem is exacerbated by the fact that the -'on_scan_complete' callback also filters the mdev's matrix and updates -the guest's AP configuration. - -In order to reduce the potential amount of disruption to the guest that may -result from a change to the host's AP configuration, let's bypass the -filtering of the matrix and updating of the guest's AP configuration in the -probe callback - if due to a host config change - and defer it until the -'on_scan_complete' callback is invoked after the AP bus finishes its device -scan operation. This way the filtering and updating will be performed only -once regardless of the number of queues added. - -Signed-off-by: Tony Krowiak <akrowiak@linux.ibm.com> -Reviewed-by: Halil Pasic <pasic@linux.ibm.com> -Fixes: 48cae940c31d ("s390/vfio-ap: refresh guest's APCB by filtering AP resources assigned to mdev") -Cc: stable@vger.kernel.org -Link: https://lore.kernel.org/r/20240115185441.31526-4-akrowiak@linux.ibm.com -Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/s390/crypto/vfio_ap_ops.c | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - -diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c -index cba6a03a0ab1..29ac0b9390e4 100644 ---- a/drivers/s390/crypto/vfio_ap_ops.c -+++ b/drivers/s390/crypto/vfio_ap_ops.c -@@ -2084,9 +2084,22 @@ int vfio_ap_mdev_probe_queue(struct ap_device *apdev) - if (matrix_mdev) { - vfio_ap_mdev_link_queue(matrix_mdev, q); - -+ /* -+ * If we're in the process of handling the adding of adapters or -+ * domains to the host's AP configuration, then let the -+ * vfio_ap device driver's on_scan_complete callback filter the -+ * matrix and update the guest's AP configuration after all of -+ * the new queue devices are probed. -+ */ -+ if (!bitmap_empty(matrix_mdev->apm_add, AP_DEVICES) || -+ !bitmap_empty(matrix_mdev->aqm_add, AP_DOMAINS)) -+ goto done; -+ - if (vfio_ap_mdev_filter_matrix(matrix_mdev)) - vfio_ap_mdev_update_guest_apcb(matrix_mdev); - } -+ -+done: - dev_set_drvdata(&apdev->device, q); - release_update_locks_for_mdev(matrix_mdev); - --- -2.43.2 - -From 44992a765642df2f9c18ab2cf46d901a9752001d Mon Sep 17 00:00:00 2001 -From: Tony Krowiak <akrowiak@linux.ibm.com> -Date: Mon, 15 Jan 2024 13:54:34 -0500 -Subject: [PATCH 0709/1501] s390/vfio-ap: reset queues filtered from the - guest's AP config -Content-Length: 16345 -Lines: 451 - -commit f848cba767e59f8d5c54984b1d45451aae040d50 upstream. - -When filtering the adapters from the configuration profile for a guest to -create or update a guest's AP configuration, if the APID of an adapter and -the APQI of a domain identify a queue device that is not bound to the -vfio_ap device driver, the APID of the adapter will be filtered because an -individual APQN can not be filtered due to the fact the APQNs are assigned -to an AP configuration as a matrix of APIDs and APQIs. Consequently, a -guest will not have access to all of the queues associated with the -filtered adapter. If the queues are subsequently made available again to -the guest, they should re-appear in a reset state; so, let's make sure all -queues associated with an adapter unplugged from the guest are reset. - -In order to identify the set of queues that need to be reset, let's allow a -vfio_ap_queue object to be simultaneously stored in both a hashtable and a -list: A hashtable used to store all of the queues assigned -to a matrix mdev; and/or, a list used to store a subset of the queues that -need to be reset. For example, when an adapter is hot unplugged from a -guest, all guest queues associated with that adapter must be reset. Since -that may be a subset of those assigned to the matrix mdev, they can be -stored in a list that can be passed to the vfio_ap_mdev_reset_queues -function. - -Signed-off-by: Tony Krowiak <akrowiak@linux.ibm.com> -Acked-by: Halil Pasic <pasic@linux.ibm.com> -Fixes: 48cae940c31d ("s390/vfio-ap: refresh guest's APCB by filtering AP resources assigned to mdev") -Cc: stable@vger.kernel.org -Link: https://lore.kernel.org/r/20240115185441.31526-5-akrowiak@linux.ibm.com -Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/s390/crypto/vfio_ap_ops.c | 171 +++++++++++++++++++------- - drivers/s390/crypto/vfio_ap_private.h | 3 + - 2 files changed, 129 insertions(+), 45 deletions(-) - -diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c -index 29ac0b9390e4..82a3511823d9 100644 ---- a/drivers/s390/crypto/vfio_ap_ops.c -+++ b/drivers/s390/crypto/vfio_ap_ops.c -@@ -32,7 +32,8 @@ - - #define AP_RESET_INTERVAL 20 /* Reset sleep interval (20ms) */ - --static int vfio_ap_mdev_reset_queues(struct ap_queue_table *qtable); -+static int vfio_ap_mdev_reset_queues(struct ap_matrix_mdev *matrix_mdev); -+static int vfio_ap_mdev_reset_qlist(struct list_head *qlist); - static struct vfio_ap_queue *vfio_ap_find_queue(int apqn); - static const struct vfio_device_ops vfio_ap_matrix_dev_ops; - static void vfio_ap_mdev_reset_queue(struct vfio_ap_queue *q); -@@ -662,16 +663,23 @@ static bool vfio_ap_mdev_filter_cdoms(struct ap_matrix_mdev *matrix_mdev) - * device driver. - * - * @matrix_mdev: the matrix mdev whose matrix is to be filtered. -+ * @apm_filtered: a 256-bit bitmap for storing the APIDs filtered from the -+ * guest's AP configuration that are still in the host's AP -+ * configuration. - * - * Note: If an APQN referencing a queue device that is not bound to the vfio_ap - * driver, its APID will be filtered from the guest's APCB. The matrix - * structure precludes filtering an individual APQN, so its APID will be -- * filtered. -+ * filtered. Consequently, all queues associated with the adapter that -+ * are in the host's AP configuration must be reset. If queues are -+ * subsequently made available again to the guest, they should re-appear -+ * in a reset state - * - * Return: a boolean value indicating whether the KVM guest's APCB was changed - * by the filtering or not. - */ --static bool vfio_ap_mdev_filter_matrix(struct ap_matrix_mdev *matrix_mdev) -+static bool vfio_ap_mdev_filter_matrix(struct ap_matrix_mdev *matrix_mdev, -+ unsigned long *apm_filtered) - { - unsigned long apid, apqi, apqn; - DECLARE_BITMAP(prev_shadow_apm, AP_DEVICES); -@@ -681,6 +689,7 @@ static bool vfio_ap_mdev_filter_matrix(struct ap_matrix_mdev *matrix_mdev) - bitmap_copy(prev_shadow_apm, matrix_mdev->shadow_apcb.apm, AP_DEVICES); - bitmap_copy(prev_shadow_aqm, matrix_mdev->shadow_apcb.aqm, AP_DOMAINS); - vfio_ap_matrix_init(&matrix_dev->info, &matrix_mdev->shadow_apcb); -+ bitmap_clear(apm_filtered, 0, AP_DEVICES); - - /* - * Copy the adapters, domains and control domains to the shadow_apcb -@@ -706,8 +715,16 @@ static bool vfio_ap_mdev_filter_matrix(struct ap_matrix_mdev *matrix_mdev) - apqn = AP_MKQID(apid, apqi); - q = vfio_ap_mdev_get_queue(matrix_mdev, apqn); - if (!q || q->reset_status.response_code) { -- clear_bit_inv(apid, -- matrix_mdev->shadow_apcb.apm); -+ clear_bit_inv(apid, matrix_mdev->shadow_apcb.apm); -+ -+ /* -+ * If the adapter was previously plugged into -+ * the guest, let's let the caller know that -+ * the APID was filtered. -+ */ -+ if (test_bit_inv(apid, prev_shadow_apm)) -+ set_bit_inv(apid, apm_filtered); -+ - break; - } - } -@@ -809,7 +826,7 @@ static void vfio_ap_mdev_remove(struct mdev_device *mdev) - - mutex_lock(&matrix_dev->guests_lock); - mutex_lock(&matrix_dev->mdevs_lock); -- vfio_ap_mdev_reset_queues(&matrix_mdev->qtable); -+ vfio_ap_mdev_reset_queues(matrix_mdev); - vfio_ap_mdev_unlink_fr_queues(matrix_mdev); - list_del(&matrix_mdev->node); - mutex_unlock(&matrix_dev->mdevs_lock); -@@ -919,6 +936,47 @@ static void vfio_ap_mdev_link_adapter(struct ap_matrix_mdev *matrix_mdev, - AP_MKQID(apid, apqi)); - } - -+static int reset_queues_for_apids(struct ap_matrix_mdev *matrix_mdev, -+ unsigned long *apm_reset) -+{ -+ struct vfio_ap_queue *q, *tmpq; -+ struct list_head qlist; -+ unsigned long apid, apqi; -+ int apqn, ret = 0; -+ -+ if (bitmap_empty(apm_reset, AP_DEVICES)) -+ return 0; -+ -+ INIT_LIST_HEAD(&qlist); -+ -+ for_each_set_bit_inv(apid, apm_reset, AP_DEVICES) { -+ for_each_set_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm, -+ AP_DOMAINS) { -+ /* -+ * If the domain is not in the host's AP configuration, -+ * then resetting it will fail with response code 01 -+ * (APQN not valid). -+ */ -+ if (!test_bit_inv(apqi, -+ (unsigned long *)matrix_dev->info.aqm)) -+ continue; -+ -+ apqn = AP_MKQID(apid, apqi); -+ q = vfio_ap_mdev_get_queue(matrix_mdev, apqn); -+ -+ if (q) -+ list_add_tail(&q->reset_qnode, &qlist); -+ } -+ } -+ -+ ret = vfio_ap_mdev_reset_qlist(&qlist); -+ -+ list_for_each_entry_safe(q, tmpq, &qlist, reset_qnode) -+ list_del(&q->reset_qnode); -+ -+ return ret; -+} -+ - /** - * assign_adapter_store - parses the APID from @buf and sets the - * corresponding bit in the mediated matrix device's APM -@@ -959,6 +1017,7 @@ static ssize_t assign_adapter_store(struct device *dev, - { - int ret; - unsigned long apid; -+ DECLARE_BITMAP(apm_filtered, AP_DEVICES); - struct ap_matrix_mdev *matrix_mdev = dev_get_drvdata(dev); - - mutex_lock(&ap_perms_mutex); -@@ -988,8 +1047,10 @@ static ssize_t assign_adapter_store(struct device *dev, - - vfio_ap_mdev_link_adapter(matrix_mdev, apid); - -- if (vfio_ap_mdev_filter_matrix(matrix_mdev)) -+ if (vfio_ap_mdev_filter_matrix(matrix_mdev, apm_filtered)) { - vfio_ap_mdev_update_guest_apcb(matrix_mdev); -+ reset_queues_for_apids(matrix_mdev, apm_filtered); -+ } - - ret = count; - done: -@@ -1020,11 +1081,12 @@ static struct vfio_ap_queue - * adapter was assigned. - * @matrix_mdev: the matrix mediated device to which the adapter was assigned. - * @apid: the APID of the unassigned adapter. -- * @qtable: table for storing queues associated with unassigned adapter. -+ * @qlist: list for storing queues associated with unassigned adapter that -+ * need to be reset. - */ - static void vfio_ap_mdev_unlink_adapter(struct ap_matrix_mdev *matrix_mdev, - unsigned long apid, -- struct ap_queue_table *qtable) -+ struct list_head *qlist) - { - unsigned long apqi; - struct vfio_ap_queue *q; -@@ -1032,11 +1094,10 @@ static void vfio_ap_mdev_unlink_adapter(struct ap_matrix_mdev *matrix_mdev, - for_each_set_bit_inv(apqi, matrix_mdev->matrix.aqm, AP_DOMAINS) { - q = vfio_ap_unlink_apqn_fr_mdev(matrix_mdev, apid, apqi); - -- if (q && qtable) { -+ if (q && qlist) { - if (test_bit_inv(apid, matrix_mdev->shadow_apcb.apm) && - test_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm)) -- hash_add(qtable->queues, &q->mdev_qnode, -- q->apqn); -+ list_add_tail(&q->reset_qnode, qlist); - } - } - } -@@ -1044,26 +1105,23 @@ static void vfio_ap_mdev_unlink_adapter(struct ap_matrix_mdev *matrix_mdev, - static void vfio_ap_mdev_hot_unplug_adapter(struct ap_matrix_mdev *matrix_mdev, - unsigned long apid) - { -- int loop_cursor; -- struct vfio_ap_queue *q; -- struct ap_queue_table *qtable = kzalloc(sizeof(*qtable), GFP_KERNEL); -+ struct vfio_ap_queue *q, *tmpq; -+ struct list_head qlist; - -- hash_init(qtable->queues); -- vfio_ap_mdev_unlink_adapter(matrix_mdev, apid, qtable); -+ INIT_LIST_HEAD(&qlist); -+ vfio_ap_mdev_unlink_adapter(matrix_mdev, apid, &qlist); - - if (test_bit_inv(apid, matrix_mdev->shadow_apcb.apm)) { - clear_bit_inv(apid, matrix_mdev->shadow_apcb.apm); - vfio_ap_mdev_update_guest_apcb(matrix_mdev); - } - -- vfio_ap_mdev_reset_queues(qtable); -+ vfio_ap_mdev_reset_qlist(&qlist); - -- hash_for_each(qtable->queues, loop_cursor, q, mdev_qnode) { -+ list_for_each_entry_safe(q, tmpq, &qlist, reset_qnode) { - vfio_ap_unlink_mdev_fr_queue(q); -- hash_del(&q->mdev_qnode); -+ list_del(&q->reset_qnode); - } -- -- kfree(qtable); - } - - /** -@@ -1164,6 +1222,7 @@ static ssize_t assign_domain_store(struct device *dev, - { - int ret; - unsigned long apqi; -+ DECLARE_BITMAP(apm_filtered, AP_DEVICES); - struct ap_matrix_mdev *matrix_mdev = dev_get_drvdata(dev); - - mutex_lock(&ap_perms_mutex); -@@ -1193,8 +1252,10 @@ static ssize_t assign_domain_store(struct device *dev, - - vfio_ap_mdev_link_domain(matrix_mdev, apqi); - -- if (vfio_ap_mdev_filter_matrix(matrix_mdev)) -+ if (vfio_ap_mdev_filter_matrix(matrix_mdev, apm_filtered)) { - vfio_ap_mdev_update_guest_apcb(matrix_mdev); -+ reset_queues_for_apids(matrix_mdev, apm_filtered); -+ } - - ret = count; - done: -@@ -1207,7 +1268,7 @@ static DEVICE_ATTR_WO(assign_domain); - - static void vfio_ap_mdev_unlink_domain(struct ap_matrix_mdev *matrix_mdev, - unsigned long apqi, -- struct ap_queue_table *qtable) -+ struct list_head *qlist) - { - unsigned long apid; - struct vfio_ap_queue *q; -@@ -1215,11 +1276,10 @@ static void vfio_ap_mdev_unlink_domain(struct ap_matrix_mdev *matrix_mdev, - for_each_set_bit_inv(apid, matrix_mdev->matrix.apm, AP_DEVICES) { - q = vfio_ap_unlink_apqn_fr_mdev(matrix_mdev, apid, apqi); - -- if (q && qtable) { -+ if (q && qlist) { - if (test_bit_inv(apid, matrix_mdev->shadow_apcb.apm) && - test_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm)) -- hash_add(qtable->queues, &q->mdev_qnode, -- q->apqn); -+ list_add_tail(&q->reset_qnode, qlist); - } - } - } -@@ -1227,26 +1287,23 @@ static void vfio_ap_mdev_unlink_domain(struct ap_matrix_mdev *matrix_mdev, - static void vfio_ap_mdev_hot_unplug_domain(struct ap_matrix_mdev *matrix_mdev, - unsigned long apqi) - { -- int loop_cursor; -- struct vfio_ap_queue *q; -- struct ap_queue_table *qtable = kzalloc(sizeof(*qtable), GFP_KERNEL); -+ struct vfio_ap_queue *q, *tmpq; -+ struct list_head qlist; - -- hash_init(qtable->queues); -- vfio_ap_mdev_unlink_domain(matrix_mdev, apqi, qtable); -+ INIT_LIST_HEAD(&qlist); -+ vfio_ap_mdev_unlink_domain(matrix_mdev, apqi, &qlist); - - if (test_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm)) { - clear_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm); - vfio_ap_mdev_update_guest_apcb(matrix_mdev); - } - -- vfio_ap_mdev_reset_queues(qtable); -+ vfio_ap_mdev_reset_qlist(&qlist); - -- hash_for_each(qtable->queues, loop_cursor, q, mdev_qnode) { -+ list_for_each_entry_safe(q, tmpq, &qlist, reset_qnode) { - vfio_ap_unlink_mdev_fr_queue(q); -- hash_del(&q->mdev_qnode); -+ list_del(&q->reset_qnode); - } -- -- kfree(qtable); - } - - /** -@@ -1601,7 +1658,7 @@ static void vfio_ap_mdev_unset_kvm(struct ap_matrix_mdev *matrix_mdev) - get_update_locks_for_kvm(kvm); - - kvm_arch_crypto_clear_masks(kvm); -- vfio_ap_mdev_reset_queues(&matrix_mdev->qtable); -+ vfio_ap_mdev_reset_queues(matrix_mdev); - kvm_put_kvm(kvm); - matrix_mdev->kvm = NULL; - -@@ -1737,15 +1794,33 @@ static void vfio_ap_mdev_reset_queue(struct vfio_ap_queue *q) - } - } - --static int vfio_ap_mdev_reset_queues(struct ap_queue_table *qtable) -+static int vfio_ap_mdev_reset_queues(struct ap_matrix_mdev *matrix_mdev) - { - int ret = 0, loop_cursor; - struct vfio_ap_queue *q; - -- hash_for_each(qtable->queues, loop_cursor, q, mdev_qnode) -+ hash_for_each(matrix_mdev->qtable.queues, loop_cursor, q, mdev_qnode) - vfio_ap_mdev_reset_queue(q); - -- hash_for_each(qtable->queues, loop_cursor, q, mdev_qnode) { -+ hash_for_each(matrix_mdev->qtable.queues, loop_cursor, q, mdev_qnode) { -+ flush_work(&q->reset_work); -+ -+ if (q->reset_status.response_code) -+ ret = -EIO; -+ } -+ -+ return ret; -+} -+ -+static int vfio_ap_mdev_reset_qlist(struct list_head *qlist) -+{ -+ int ret = 0; -+ struct vfio_ap_queue *q; -+ -+ list_for_each_entry(q, qlist, reset_qnode) -+ vfio_ap_mdev_reset_queue(q); -+ -+ list_for_each_entry(q, qlist, reset_qnode) { - flush_work(&q->reset_work); - - if (q->reset_status.response_code) -@@ -1931,7 +2006,7 @@ static ssize_t vfio_ap_mdev_ioctl(struct vfio_device *vdev, - ret = vfio_ap_mdev_get_device_info(arg); - break; - case VFIO_DEVICE_RESET: -- ret = vfio_ap_mdev_reset_queues(&matrix_mdev->qtable); -+ ret = vfio_ap_mdev_reset_queues(matrix_mdev); - break; - case VFIO_DEVICE_GET_IRQ_INFO: - ret = vfio_ap_get_irq_info(arg); -@@ -2063,6 +2138,7 @@ int vfio_ap_mdev_probe_queue(struct ap_device *apdev) - { - int ret; - struct vfio_ap_queue *q; -+ DECLARE_BITMAP(apm_filtered, AP_DEVICES); - struct ap_matrix_mdev *matrix_mdev; - - ret = sysfs_create_group(&apdev->device.kobj, &vfio_queue_attr_group); -@@ -2095,15 +2171,17 @@ int vfio_ap_mdev_probe_queue(struct ap_device *apdev) - !bitmap_empty(matrix_mdev->aqm_add, AP_DOMAINS)) - goto done; - -- if (vfio_ap_mdev_filter_matrix(matrix_mdev)) -+ if (vfio_ap_mdev_filter_matrix(matrix_mdev, apm_filtered)) { - vfio_ap_mdev_update_guest_apcb(matrix_mdev); -+ reset_queues_for_apids(matrix_mdev, apm_filtered); -+ } - } - - done: - dev_set_drvdata(&apdev->device, q); - release_update_locks_for_mdev(matrix_mdev); - -- return 0; -+ return ret; - - err_remove_group: - sysfs_remove_group(&apdev->device.kobj, &vfio_queue_attr_group); -@@ -2447,6 +2525,7 @@ void vfio_ap_on_cfg_changed(struct ap_config_info *cur_cfg_info, - - static void vfio_ap_mdev_hot_plug_cfg(struct ap_matrix_mdev *matrix_mdev) - { -+ DECLARE_BITMAP(apm_filtered, AP_DEVICES); - bool filter_domains, filter_adapters, filter_cdoms, do_hotplug = false; - - mutex_lock(&matrix_mdev->kvm->lock); -@@ -2460,7 +2539,7 @@ static void vfio_ap_mdev_hot_plug_cfg(struct ap_matrix_mdev *matrix_mdev) - matrix_mdev->adm_add, AP_DOMAINS); - - if (filter_adapters || filter_domains) -- do_hotplug = vfio_ap_mdev_filter_matrix(matrix_mdev); -+ do_hotplug = vfio_ap_mdev_filter_matrix(matrix_mdev, apm_filtered); - - if (filter_cdoms) - do_hotplug |= vfio_ap_mdev_filter_cdoms(matrix_mdev); -@@ -2468,6 +2547,8 @@ static void vfio_ap_mdev_hot_plug_cfg(struct ap_matrix_mdev *matrix_mdev) - if (do_hotplug) - vfio_ap_mdev_update_guest_apcb(matrix_mdev); - -+ reset_queues_for_apids(matrix_mdev, apm_filtered); -+ - mutex_unlock(&matrix_dev->mdevs_lock); - mutex_unlock(&matrix_mdev->kvm->lock); - } -diff --git a/drivers/s390/crypto/vfio_ap_private.h b/drivers/s390/crypto/vfio_ap_private.h -index 88aff8b81f2f..98d37aa27044 100644 ---- a/drivers/s390/crypto/vfio_ap_private.h -+++ b/drivers/s390/crypto/vfio_ap_private.h -@@ -133,6 +133,8 @@ struct ap_matrix_mdev { - * @apqn: the APQN of the AP queue device - * @saved_isc: the guest ISC registered with the GIB interface - * @mdev_qnode: allows the vfio_ap_queue struct to be added to a hashtable -+ * @reset_qnode: allows the vfio_ap_queue struct to be added to a list of queues -+ * that need to be reset - * @reset_status: the status from the last reset of the queue - * @reset_work: work to wait for queue reset to complete - */ -@@ -143,6 +145,7 @@ struct vfio_ap_queue { - #define VFIO_AP_ISC_INVALID 0xff - unsigned char saved_isc; - struct hlist_node mdev_qnode; -+ struct list_head reset_qnode; - struct ap_queue_status reset_status; - struct work_struct reset_work; - }; --- -2.43.2 - -From 2c9bb887dcb5b6ce59ef5cc0a04100f4e9ed6c4c Mon Sep 17 00:00:00 2001 -From: Tony Krowiak <akrowiak@linux.ibm.com> -Date: Mon, 15 Jan 2024 13:54:35 -0500 -Subject: [PATCH 0710/1501] s390/vfio-ap: reset queues associated with adapter - for queue unbound from driver -Content-Length: 4660 -Lines: 144 - -commit f009cfa466558b7dfe97f167ba1875d6f9ea4c07 upstream. - -When a queue is unbound from the vfio_ap device driver, if that queue is -assigned to a guest's AP configuration, its associated adapter is removed -because queues are defined to a guest via a matrix of adapters and -domains; so, it is not possible to remove a single queue. - -If an adapter is removed from the guest's AP configuration, all associated -queues must be reset to prevent leaking crypto data should any of them be -assigned to a different guest or device driver. The one caveat is that if -the queue is being removed because the adapter or domain has been removed -from the host's AP configuration, then an attempt to reset the queue will -fail with response code 01, AP-queue number not valid; so resetting these -queues should be skipped. - -Acked-by: Halil Pasic <pasic@linux.ibm.com> -Signed-off-by: Tony Krowiak <akrowiak@linux.ibm.com> -Fixes: 09d31ff78793 ("s390/vfio-ap: hot plug/unplug of AP devices when probed/removed") -Cc: stable@vger.kernel.org -Link: https://lore.kernel.org/r/20240115185441.31526-6-akrowiak@linux.ibm.com -Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/s390/crypto/vfio_ap_ops.c | 76 +++++++++++++++++-------------- - 1 file changed, 41 insertions(+), 35 deletions(-) - -diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c -index 82a3511823d9..ba963788a730 100644 ---- a/drivers/s390/crypto/vfio_ap_ops.c -+++ b/drivers/s390/crypto/vfio_ap_ops.c -@@ -936,45 +936,45 @@ static void vfio_ap_mdev_link_adapter(struct ap_matrix_mdev *matrix_mdev, - AP_MKQID(apid, apqi)); - } - -+static void collect_queues_to_reset(struct ap_matrix_mdev *matrix_mdev, -+ unsigned long apid, -+ struct list_head *qlist) -+{ -+ struct vfio_ap_queue *q; -+ unsigned long apqi; -+ -+ for_each_set_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm, AP_DOMAINS) { -+ q = vfio_ap_mdev_get_queue(matrix_mdev, AP_MKQID(apid, apqi)); -+ if (q) -+ list_add_tail(&q->reset_qnode, qlist); -+ } -+} -+ -+static void reset_queues_for_apid(struct ap_matrix_mdev *matrix_mdev, -+ unsigned long apid) -+{ -+ struct list_head qlist; -+ -+ INIT_LIST_HEAD(&qlist); -+ collect_queues_to_reset(matrix_mdev, apid, &qlist); -+ vfio_ap_mdev_reset_qlist(&qlist); -+} -+ - static int reset_queues_for_apids(struct ap_matrix_mdev *matrix_mdev, - unsigned long *apm_reset) - { -- struct vfio_ap_queue *q, *tmpq; - struct list_head qlist; -- unsigned long apid, apqi; -- int apqn, ret = 0; -+ unsigned long apid; - - if (bitmap_empty(apm_reset, AP_DEVICES)) - return 0; - - INIT_LIST_HEAD(&qlist); - -- for_each_set_bit_inv(apid, apm_reset, AP_DEVICES) { -- for_each_set_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm, -- AP_DOMAINS) { -- /* -- * If the domain is not in the host's AP configuration, -- * then resetting it will fail with response code 01 -- * (APQN not valid). -- */ -- if (!test_bit_inv(apqi, -- (unsigned long *)matrix_dev->info.aqm)) -- continue; -+ for_each_set_bit_inv(apid, apm_reset, AP_DEVICES) -+ collect_queues_to_reset(matrix_mdev, apid, &qlist); - -- apqn = AP_MKQID(apid, apqi); -- q = vfio_ap_mdev_get_queue(matrix_mdev, apqn); -- -- if (q) -- list_add_tail(&q->reset_qnode, &qlist); -- } -- } -- -- ret = vfio_ap_mdev_reset_qlist(&qlist); -- -- list_for_each_entry_safe(q, tmpq, &qlist, reset_qnode) -- list_del(&q->reset_qnode); -- -- return ret; -+ return vfio_ap_mdev_reset_qlist(&qlist); - } - - /** -@@ -2200,24 +2200,30 @@ void vfio_ap_mdev_remove_queue(struct ap_device *apdev) - matrix_mdev = q->matrix_mdev; - - if (matrix_mdev) { -- vfio_ap_unlink_queue_fr_mdev(q); -- - apid = AP_QID_CARD(q->apqn); - apqi = AP_QID_QUEUE(q->apqn); -- -- /* -- * If the queue is assigned to the guest's APCB, then remove -- * the adapter's APID from the APCB and hot it into the guest. -- */ -+ /* If the queue is assigned to the guest's AP configuration */ - if (test_bit_inv(apid, matrix_mdev->shadow_apcb.apm) && - test_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm)) { -+ /* -+ * Since the queues are defined via a matrix of adapters -+ * and domains, it is not possible to hot unplug a -+ * single queue; so, let's unplug the adapter. -+ */ - clear_bit_inv(apid, matrix_mdev->shadow_apcb.apm); - vfio_ap_mdev_update_guest_apcb(matrix_mdev); -+ reset_queues_for_apid(matrix_mdev, apid); -+ goto done; - } - } - - vfio_ap_mdev_reset_queue(q); - flush_work(&q->reset_work); -+ -+done: -+ if (matrix_mdev) -+ vfio_ap_unlink_queue_fr_mdev(q); -+ - dev_set_drvdata(&apdev->device, NULL); - kfree(q); - release_update_locks_for_mdev(matrix_mdev); --- -2.43.2 - -From 7abe1494896c052d5dcf4ba910656777aff72fbb Mon Sep 17 00:00:00 2001 -From: Tony Krowiak <akrowiak@linux.ibm.com> -Date: Mon, 15 Jan 2024 13:54:36 -0500 -Subject: [PATCH 0711/1501] s390/vfio-ap: do not reset queue removed from host - config -Content-Length: 2422 -Lines: 60 - -commit b9bd10c43456d16abd97b717446f51afb3b88411 upstream. - -When a queue is unbound from the vfio_ap device driver, it is reset to -ensure its crypto data is not leaked when it is bound to another device -driver. If the queue is unbound due to the fact that the adapter or domain -was removed from the host's AP configuration, then attempting to reset it -will fail with response code 01 (APID not valid) getting returned from the -reset command. Let's ensure that the queue is assigned to the host's -configuration before resetting it. - -Signed-off-by: Tony Krowiak <akrowiak@linux.ibm.com> -Reviewed-by: "Jason J. Herne" <jjherne@linux.ibm.com> -Reviewed-by: Halil Pasic <pasic@linux.ibm.com> -Fixes: eeb386aeb5b7 ("s390/vfio-ap: handle config changed and scan complete notification") -Cc: stable@vger.kernel.org -Link: https://lore.kernel.org/r/20240115185441.31526-7-akrowiak@linux.ibm.com -Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/s390/crypto/vfio_ap_ops.c | 16 ++++++++++++---- - 1 file changed, 12 insertions(+), 4 deletions(-) - -diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c -index ba963788a730..88f41f95cc94 100644 ---- a/drivers/s390/crypto/vfio_ap_ops.c -+++ b/drivers/s390/crypto/vfio_ap_ops.c -@@ -2198,10 +2198,10 @@ void vfio_ap_mdev_remove_queue(struct ap_device *apdev) - q = dev_get_drvdata(&apdev->device); - get_update_locks_for_queue(q); - matrix_mdev = q->matrix_mdev; -+ apid = AP_QID_CARD(q->apqn); -+ apqi = AP_QID_QUEUE(q->apqn); - - if (matrix_mdev) { -- apid = AP_QID_CARD(q->apqn); -- apqi = AP_QID_QUEUE(q->apqn); - /* If the queue is assigned to the guest's AP configuration */ - if (test_bit_inv(apid, matrix_mdev->shadow_apcb.apm) && - test_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm)) { -@@ -2217,8 +2217,16 @@ void vfio_ap_mdev_remove_queue(struct ap_device *apdev) - } - } - -- vfio_ap_mdev_reset_queue(q); -- flush_work(&q->reset_work); -+ /* -+ * If the queue is not in the host's AP configuration, then resetting -+ * it will fail with response code 01, (APQN not valid); so, let's make -+ * sure it is in the host's config. -+ */ -+ if (test_bit_inv(apid, (unsigned long *)matrix_dev->info.apm) && -+ test_bit_inv(apqi, (unsigned long *)matrix_dev->info.aqm)) { -+ vfio_ap_mdev_reset_queue(q); -+ flush_work(&q->reset_work); -+ } - - done: - if (matrix_mdev) --- -2.43.2 - -From b997bf417d44e121d59ec4d39fdef5b60b4b768e Mon Sep 17 00:00:00 2001 -From: Nathan Lynch <nathanl@linux.ibm.com> -Date: Tue, 16 Jan 2024 08:09:25 -0600 -Subject: [PATCH 0712/1501] seq_buf: Make DECLARE_SEQ_BUF() usable -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1605 -Lines: 48 - -commit 7a8e9cdf9405819105ae7405cd91e482bf574b01 upstream. - -Using the address operator on the array doesn't work: - -./include/linux/seq_buf.h:27:27: error: initialization of ‘char *’ - from incompatible pointer type ‘char (*)[128]’ - [-Werror=incompatible-pointer-types] - 27 | .buffer = &__ ## NAME ## _buffer, \ - | ^ - -Apart from fixing that, we can improve DECLARE_SEQ_BUF() by using a -compound literal to define the buffer array without attaching a name -to it. This makes the macro a single statement, allowing constructs -such as: - - static DECLARE_SEQ_BUF(my_seq_buf, MYSB_SIZE); - -to work as intended. - -Link: https://lkml.kernel.org/r/20240116-declare-seq-buf-fix-v1-1-915db4692f32@linux.ibm.com - -Cc: stable@vger.kernel.org -Acked-by: Kees Cook <keescook@chromium.org> -Fixes: dcc4e5728eea ("seq_buf: Introduce DECLARE_SEQ_BUF and seq_buf_str()") -Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com> -Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - include/linux/seq_buf.h | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/include/linux/seq_buf.h b/include/linux/seq_buf.h -index 5fb1f12c33f9..c44f4b47b945 100644 ---- a/include/linux/seq_buf.h -+++ b/include/linux/seq_buf.h -@@ -22,9 +22,8 @@ struct seq_buf { - }; - - #define DECLARE_SEQ_BUF(NAME, SIZE) \ -- char __ ## NAME ## _buffer[SIZE] = ""; \ - struct seq_buf NAME = { \ -- .buffer = &__ ## NAME ## _buffer, \ -+ .buffer = (char[SIZE]) { 0 }, \ - .size = SIZE, \ - } - --- -2.43.2 - -From b0028f333420a65a53a63978522db680b37379dd Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Fri, 12 Jan 2024 13:26:57 +0000 -Subject: [PATCH 0713/1501] nbd: always initialize struct msghdr completely -Content-Length: 2814 -Lines: 74 - -commit 78fbb92af27d0982634116c7a31065f24d092826 upstream. - -syzbot complains that msg->msg_get_inq value can be uninitialized [1] - -struct msghdr got many new fields recently, we should always make -sure their values is zero by default. - -[1] - BUG: KMSAN: uninit-value in tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 - tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 - inet_recvmsg+0x131/0x580 net/ipv4/af_inet.c:879 - sock_recvmsg_nosec net/socket.c:1044 [inline] - sock_recvmsg+0x12b/0x1e0 net/socket.c:1066 - __sock_xmit+0x236/0x5c0 drivers/block/nbd.c:538 - nbd_read_reply drivers/block/nbd.c:732 [inline] - recv_work+0x262/0x3100 drivers/block/nbd.c:863 - process_one_work kernel/workqueue.c:2627 [inline] - process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2700 - worker_thread+0xf45/0x1490 kernel/workqueue.c:2781 - kthread+0x3ed/0x540 kernel/kthread.c:388 - ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147 - ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 - -Local variable msg created at: - __sock_xmit+0x4c/0x5c0 drivers/block/nbd.c:513 - nbd_read_reply drivers/block/nbd.c:732 [inline] - recv_work+0x262/0x3100 drivers/block/nbd.c:863 - -CPU: 1 PID: 7465 Comm: kworker/u5:1 Not tainted 6.7.0-rc7-syzkaller-00041-gf016f7547aee #0 -Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 -Workqueue: nbd5-recv recv_work - -Fixes: f94fd25cb0aa ("tcp: pass back data left in socket after receive") -Reported-by: syzbot <syzkaller@googlegroups.com> -Signed-off-by: Eric Dumazet <edumazet@google.com> -Cc: stable@vger.kernel.org -Cc: Josef Bacik <josef@toxicpanda.com> -Cc: Jens Axboe <axboe@kernel.dk> -Cc: linux-block@vger.kernel.org -Cc: nbd@other.debian.org -Reviewed-by: Simon Horman <horms@kernel.org> -Link: https://lore.kernel.org/r/20240112132657.647112-1-edumazet@google.com -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/block/nbd.c | 6 +----- - 1 file changed, 1 insertion(+), 5 deletions(-) - -diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c -index b6414e1e645b..aa65313aabb8 100644 ---- a/drivers/block/nbd.c -+++ b/drivers/block/nbd.c -@@ -510,7 +510,7 @@ static int __sock_xmit(struct nbd_device *nbd, struct socket *sock, int send, - struct iov_iter *iter, int msg_flags, int *sent) - { - int result; -- struct msghdr msg; -+ struct msghdr msg = {} ; - unsigned int noreclaim_flag; - - if (unlikely(!sock)) { -@@ -526,10 +526,6 @@ static int __sock_xmit(struct nbd_device *nbd, struct socket *sock, int send, - do { - sock->sk->sk_allocation = GFP_NOIO | __GFP_MEMALLOC; - sock->sk->sk_use_task_frag = false; -- msg.msg_name = NULL; -- msg.msg_namelen = 0; -- msg.msg_control = NULL; -- msg.msg_controllen = 0; - msg.msg_flags = msg_flags | MSG_NOSIGNAL; - - if (send) --- -2.43.2 - -From d157f10b96216d8c3b7f27023e13aa70b2b1c8a6 Mon Sep 17 00:00:00 2001 -From: Serge Semin <fancer.lancer@gmail.com> -Date: Sat, 2 Dec 2023 14:14:20 +0300 -Subject: [PATCH 0714/1501] mips: Fix max_mapnr being uninitialized on early - stages -Content-Length: 3071 -Lines: 83 - -commit e1a9ae45736989c972a8d1c151bc390678ae6205 upstream. - -max_mapnr variable is utilized in the pfn_valid() method in order to -determine the upper PFN space boundary. Having it uninitialized -effectively makes any PFN passed to that method invalid. That in its turn -causes the kernel mm-subsystem occasion malfunctions even after the -max_mapnr variable is actually properly updated. For instance, -pfn_valid() is called in the init_unavailable_range() method in the -framework of the calls-chain on MIPS: -setup_arch() -+-> paging_init() - +-> free_area_init() - +-> memmap_init() - +-> memmap_init_zone_range() - +-> init_unavailable_range() - -Since pfn_valid() always returns "false" value before max_mapnr is -initialized in the mem_init() method, any flatmem page-holes will be left -in the poisoned/uninitialized state including the IO-memory pages. Thus -any further attempts to map/remap the IO-memory by using MMU may fail. -In particular it happened in my case on attempt to map the SRAM region. -The kernel bootup procedure just crashed on the unhandled unaligned access -bug raised in the __update_cache() method: - -> Unhandled kernel unaligned access[#1]: -> CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc1-XXX-dirty #2056 -> ... -> Call Trace: -> [<8011ef9c>] __update_cache+0x88/0x1bc -> [<80385944>] ioremap_page_range+0x110/0x2a4 -> [<80126948>] ioremap_prot+0x17c/0x1f4 -> [<80711b80>] __devm_ioremap+0x8c/0x120 -> [<80711e0c>] __devm_ioremap_resource+0xf4/0x218 -> [<808bf244>] sram_probe+0x4f4/0x930 -> [<80889d20>] platform_probe+0x68/0xec -> ... - -Let's fix the problem by initializing the max_mapnr variable as soon as -the required data is available. In particular it can be done right in the -paging_init() method before free_area_init() is called since all the PFN -zone boundaries have already been calculated by that time. - -Cc: stable@vger.kernel.org -Signed-off-by: Serge Semin <fancer.lancer@gmail.com> -Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/mips/mm/init.c | 12 +++++------- - 1 file changed, 5 insertions(+), 7 deletions(-) - -diff --git a/arch/mips/mm/init.c b/arch/mips/mm/init.c -index 5dcb525a8995..6e368a4658b5 100644 ---- a/arch/mips/mm/init.c -+++ b/arch/mips/mm/init.c -@@ -422,7 +422,12 @@ void __init paging_init(void) - (highend_pfn - max_low_pfn) << (PAGE_SHIFT - 10)); - max_zone_pfns[ZONE_HIGHMEM] = max_low_pfn; - } -+ -+ max_mapnr = highend_pfn ? highend_pfn : max_low_pfn; -+#else -+ max_mapnr = max_low_pfn; - #endif -+ high_memory = (void *) __va(max_low_pfn << PAGE_SHIFT); - - free_area_init(max_zone_pfns); - } -@@ -458,13 +463,6 @@ void __init mem_init(void) - */ - BUILD_BUG_ON(IS_ENABLED(CONFIG_32BIT) && (PFN_PTE_SHIFT > PAGE_SHIFT)); - --#ifdef CONFIG_HIGHMEM -- max_mapnr = highend_pfn ? highend_pfn : max_low_pfn; --#else -- max_mapnr = max_low_pfn; --#endif -- high_memory = (void *) __va(max_low_pfn << PAGE_SHIFT); -- - maar_init(); - memblock_free_all(); - setup_zero_pages(); /* Setup zeroed pages. */ --- -2.43.2 - -From ecf8320111822a1ae5d5fc512953eab46d543d0b Mon Sep 17 00:00:00 2001 -From: Krishna chaitanya chundru <quic_krichai@quicinc.com> -Date: Tue, 31 Oct 2023 15:21:05 +0530 -Subject: [PATCH 0715/1501] bus: mhi: host: Add alignment check for event ring - read pointer -Content-Length: 1708 -Lines: 38 - -commit eff9704f5332a13b08fbdbe0f84059c9e7051d5f upstream. - -Though we do check the event ring read pointer by "is_valid_ring_ptr" -to make sure it is in the buffer range, but there is another risk the -pointer may be not aligned. Since we are expecting event ring elements -are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer -could lead to multiple issues like DoS or ring buffer memory corruption. - -So add a alignment check for event ring read pointer. - -Fixes: ec32332df764 ("bus: mhi: core: Sanity check values from remote device before use") -cc: stable@vger.kernel.org -Signed-off-by: Krishna chaitanya chundru <quic_krichai@quicinc.com> -Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com> -Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> -Link: https://lore.kernel.org/r/20231031-alignment_check-v2-1-1441db7c5efd@quicinc.com -Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/bus/mhi/host/main.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c -index dcf627b36e82..3a6ccab94300 100644 ---- a/drivers/bus/mhi/host/main.c -+++ b/drivers/bus/mhi/host/main.c -@@ -268,7 +268,8 @@ static void mhi_del_ring_element(struct mhi_controller *mhi_cntrl, - - static bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr) - { -- return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len; -+ return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len && -+ !(addr & (sizeof(struct mhi_ring_element) - 1)); - } - - int mhi_destroy_device(struct device *dev, void *data) --- -2.43.2 - -From 642adb03541673f3897f64bbb62856ffd73807f5 Mon Sep 17 00:00:00 2001 -From: Bhaumik Bhatt <bbhatt@codeaurora.org> -Date: Mon, 11 Dec 2023 14:42:51 +0800 -Subject: [PATCH 0717/1501] bus: mhi: host: Add spinlock to protect WP access - when queueing TREs -Content-Length: 3100 -Lines: 92 - -commit b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9 upstream. - -Protect WP accesses such that multiple threads queueing buffers for -incoming data do not race. - -Meanwhile, if CONFIG_TRACE_IRQFLAGS is enabled, irq will be enabled once -__local_bh_enable_ip is called as part of write_unlock_bh. Hence, let's -take irqsave lock after TRE is generated to avoid running write_unlock_bh -when irqsave lock is held. - -Cc: stable@vger.kernel.org -Fixes: 189ff97cca53 ("bus: mhi: core: Add support for data transfer") -Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org> -Signed-off-by: Qiang Yu <quic_qianyu@quicinc.com> -Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com> -Tested-by: Jeffrey Hugo <quic_jhugo@quicinc.com> -Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> -Link: https://lore.kernel.org/r/1702276972-41296-2-git-send-email-quic_qianyu@quicinc.com -Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/bus/mhi/host/main.c | 22 +++++++++++++--------- - 1 file changed, 13 insertions(+), 9 deletions(-) - -diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c -index 25a4745da75e..d6653cbcf94a 100644 ---- a/drivers/bus/mhi/host/main.c -+++ b/drivers/bus/mhi/host/main.c -@@ -1127,17 +1127,15 @@ static int mhi_queue(struct mhi_device *mhi_dev, struct mhi_buf_info *buf_info, - if (unlikely(MHI_PM_IN_ERROR_STATE(mhi_cntrl->pm_state))) - return -EIO; - -- read_lock_irqsave(&mhi_cntrl->pm_lock, flags); -- - ret = mhi_is_ring_full(mhi_cntrl, tre_ring); -- if (unlikely(ret)) { -- ret = -EAGAIN; -- goto exit_unlock; -- } -+ if (unlikely(ret)) -+ return -EAGAIN; - - ret = mhi_gen_tre(mhi_cntrl, mhi_chan, buf_info, mflags); - if (unlikely(ret)) -- goto exit_unlock; -+ return ret; -+ -+ read_lock_irqsave(&mhi_cntrl->pm_lock, flags); - - /* Packet is queued, take a usage ref to exit M3 if necessary - * for host->device buffer, balanced put is done on buffer completion -@@ -1157,7 +1155,6 @@ static int mhi_queue(struct mhi_device *mhi_dev, struct mhi_buf_info *buf_info, - if (dir == DMA_FROM_DEVICE) - mhi_cntrl->runtime_put(mhi_cntrl); - --exit_unlock: - read_unlock_irqrestore(&mhi_cntrl->pm_lock, flags); - - return ret; -@@ -1209,6 +1206,9 @@ int mhi_gen_tre(struct mhi_controller *mhi_cntrl, struct mhi_chan *mhi_chan, - int eot, eob, chain, bei; - int ret; - -+ /* Protect accesses for reading and incrementing WP */ -+ write_lock_bh(&mhi_chan->lock); -+ - buf_ring = &mhi_chan->buf_ring; - tre_ring = &mhi_chan->tre_ring; - -@@ -1226,8 +1226,10 @@ int mhi_gen_tre(struct mhi_controller *mhi_cntrl, struct mhi_chan *mhi_chan, - - if (!info->pre_mapped) { - ret = mhi_cntrl->map_single(mhi_cntrl, buf_info); -- if (ret) -+ if (ret) { -+ write_unlock_bh(&mhi_chan->lock); - return ret; -+ } - } - - eob = !!(flags & MHI_EOB); -@@ -1244,6 +1246,8 @@ int mhi_gen_tre(struct mhi_controller *mhi_cntrl, struct mhi_chan *mhi_chan, - mhi_add_ring_element(mhi_cntrl, tre_ring); - mhi_add_ring_element(mhi_cntrl, buf_ring); - -+ write_unlock_bh(&mhi_chan->lock); -+ - return 0; - } - --- -2.43.2 - -From 166aa1d2834440a41587a4b87ed91d297a453deb Mon Sep 17 00:00:00 2001 -From: Helge Deller <deller@gmx.de> -Date: Wed, 3 Jan 2024 21:02:16 +0100 -Subject: [PATCH 0718/1501] parisc/firmware: Fix F-extend for PDC addresses -Content-Length: 1421 -Lines: 38 - -commit 735ae74f73e55c191d48689bd11ff4a06ea0508f upstream. - -When running with narrow firmware (64-bit kernel using a 32-bit -firmware), extend PDC addresses into the 0xfffffff0.00000000 -region instead of the 0xf0f0f0f0.00000000 region. - -This fixes the power button on the C3700 machine in qemu (64-bit CPU -with 32-bit firmware), and my assumption is that the previous code was -really never used (because most 64-bit machines have a 64-bit firmware), -or it just worked on very old machines because they may only decode -40-bit of virtual addresses. - -Cc: stable@vger.kernel.org -Signed-off-by: Helge Deller <deller@gmx.de> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/parisc/kernel/firmware.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/arch/parisc/kernel/firmware.c b/arch/parisc/kernel/firmware.c -index 904ca3b9e7a7..c69f6d5946e9 100644 ---- a/arch/parisc/kernel/firmware.c -+++ b/arch/parisc/kernel/firmware.c -@@ -123,10 +123,10 @@ static unsigned long f_extend(unsigned long address) - #ifdef CONFIG_64BIT - if(unlikely(parisc_narrow_firmware)) { - if((address & 0xff000000) == 0xf0000000) -- return 0xf0f0f0f000000000UL | (u32)address; -+ return (0xfffffff0UL << 32) | (u32)address; - - if((address & 0xf0000000) == 0xf0000000) -- return 0xffffffff00000000UL | (u32)address; -+ return (0xffffffffUL << 32) | (u32)address; - } - #endif - return address; --- -2.43.2 - -From 49bf4d6a3da669d398cb22f1ded0fa01e2ddf7d7 Mon Sep 17 00:00:00 2001 -From: Helge Deller <deller@gmx.de> -Date: Wed, 3 Jan 2024 21:17:23 +0100 -Subject: [PATCH 0719/1501] parisc/power: Fix power soft-off button emulation - on qemu -Content-Length: 1088 -Lines: 29 - -commit 6472036581f947109b20664121db1d143e916f0b upstream. - -Make sure to start the kthread to check the power button on qemu as -well if the power button address was provided. -This fixes the qemu built-in system_powerdown runtime command. - -Fixes: d0c219472980 ("parisc/power: Add power soft-off when running on qemu") -Signed-off-by: Helge Deller <deller@gmx.de> -Cc: stable@vger.kernel.org # v6.0+ -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/parisc/power.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/parisc/power.c b/drivers/parisc/power.c -index bb0d92461b08..7a6a3e7f2825 100644 ---- a/drivers/parisc/power.c -+++ b/drivers/parisc/power.c -@@ -213,7 +213,7 @@ static int __init power_init(void) - if (running_on_qemu && soft_power_reg) - register_sys_off_handler(SYS_OFF_MODE_POWER_OFF, SYS_OFF_PRIO_DEFAULT, - qemu_power_off, (void *)soft_power_reg); -- else -+ if (!running_on_qemu || soft_power_reg) - power_task = kthread_run(kpowerswd, (void*)soft_power_reg, - KTHREAD_NAME); - if (IS_ERR(power_task)) { --- -2.43.2 - -From ba1c101b28935c192d939ed8e27cfb689781dcbf Mon Sep 17 00:00:00 2001 -From: Marcelo Schmitt <marcelo.schmitt@analog.com> -Date: Tue, 19 Dec 2023 17:26:27 -0300 -Subject: [PATCH 0720/1501] iio: adc: ad7091r: Enable internal vref if external - vref is not supplied -Content-Length: 2249 -Lines: 58 - -[ Upstream commit e71c5c89bcb165a02df35325aa13d1ee40112401 ] - -The ADC needs a voltage reference to work correctly. -Users can provide an external voltage reference or use the chip internal -reference to operate the ADC. -The availability of an in chip reference for the ADC saves the user from -having to supply an external voltage reference, which makes the external -reference an optional property as described in the device tree -documentation. -Though, to use the internal reference, it must be enabled by writing to -the configuration register. -Enable AD7091R internal voltage reference if no external vref is supplied. - -Fixes: 260442cc5be4 ("iio: adc: ad7091r5: Add scale and external VREF support") -Signed-off-by: Marcelo Schmitt <marcelo.schmitt@analog.com> -Link: https://lore.kernel.org/r/b865033fa6a4fc4bf2b4a98ec51a6144e0f64f77.1703013352.git.marcelo.schmitt1@gmail.com -Cc: <Stable@vger.kernel.org> -Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/iio/adc/ad7091r-base.c | 7 +++++++ - drivers/iio/adc/ad7091r-base.h | 2 ++ - 2 files changed, 9 insertions(+) - -diff --git a/drivers/iio/adc/ad7091r-base.c b/drivers/iio/adc/ad7091r-base.c -index 3d36bcd26b0c..76002b91c86a 100644 ---- a/drivers/iio/adc/ad7091r-base.c -+++ b/drivers/iio/adc/ad7091r-base.c -@@ -405,7 +405,14 @@ int ad7091r_probe(struct device *dev, const char *name, - if (IS_ERR(st->vref)) { - if (PTR_ERR(st->vref) == -EPROBE_DEFER) - return -EPROBE_DEFER; -+ - st->vref = NULL; -+ /* Enable internal vref */ -+ ret = regmap_set_bits(st->map, AD7091R_REG_CONF, -+ AD7091R_REG_CONF_INT_VREF); -+ if (ret) -+ return dev_err_probe(st->dev, ret, -+ "Error on enable internal reference\n"); - } else { - ret = regulator_enable(st->vref); - if (ret) -diff --git a/drivers/iio/adc/ad7091r-base.h b/drivers/iio/adc/ad7091r-base.h -index 7a78976a2f80..b9e1c8bf3440 100644 ---- a/drivers/iio/adc/ad7091r-base.h -+++ b/drivers/iio/adc/ad7091r-base.h -@@ -8,6 +8,8 @@ - #ifndef __DRIVERS_IIO_ADC_AD7091R_BASE_H__ - #define __DRIVERS_IIO_ADC_AD7091R_BASE_H__ - -+#define AD7091R_REG_CONF_INT_VREF BIT(0) -+ - /* AD7091R_REG_CH_LIMIT */ - #define AD7091R_HIGH_LIMIT 0xFFF - #define AD7091R_LOW_LIMIT 0x0 --- -2.43.2 - -From 0515904b169e0d0aa5eecdacd481a437c8114556 Mon Sep 17 00:00:00 2001 -From: Frank Li <Frank.Li@nxp.com> -Date: Tue, 14 Nov 2023 10:48:21 -0500 -Subject: [PATCH 0721/1501] dmaengine: fsl-edma: fix eDMAv4 channel allocation - issue -Content-Length: 1845 -Lines: 50 - -[ Upstream commit dc51b4442dd94ab12c146c1897bbdb40e16d5636 ] - -The eDMAv4 channel mux has a limitation where certain requests must use -even channels, while others must use odd numbers. - -Add two flags (ARGS_EVEN_CH and ARGS_ODD_CH) to reflect this limitation. -The device tree source (dts) files need to be updated accordingly. - -This issue was identified by the following commit: -commit a725990557e7 ("arm64: dts: imx93: Fix the dmas entries order") - -Reverting channel orders triggered this problem. - -Fixes: 72f5801a4e2b ("dmaengine: fsl-edma: integrate v3 support") -Signed-off-by: Frank Li <Frank.Li@nxp.com> -Link: https://lore.kernel.org/r/20231114154824.3617255-2-Frank.Li@nxp.com -Signed-off-by: Vinod Koul <vkoul@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/dma/fsl-edma-main.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/drivers/dma/fsl-edma-main.c b/drivers/dma/fsl-edma-main.c -index 238a69bd0d6f..75cae7ccae27 100644 ---- a/drivers/dma/fsl-edma-main.c -+++ b/drivers/dma/fsl-edma-main.c -@@ -24,6 +24,8 @@ - #define ARGS_RX BIT(0) - #define ARGS_REMOTE BIT(1) - #define ARGS_MULTI_FIFO BIT(2) -+#define ARGS_EVEN_CH BIT(3) -+#define ARGS_ODD_CH BIT(4) - - static void fsl_edma_synchronize(struct dma_chan *chan) - { -@@ -157,6 +159,12 @@ static struct dma_chan *fsl_edma3_xlate(struct of_phandle_args *dma_spec, - fsl_chan->is_remote = dma_spec->args[2] & ARGS_REMOTE; - fsl_chan->is_multi_fifo = dma_spec->args[2] & ARGS_MULTI_FIFO; - -+ if ((dma_spec->args[2] & ARGS_EVEN_CH) && (i & 0x1)) -+ continue; -+ -+ if ((dma_spec->args[2] & ARGS_ODD_CH) && !(i & 0x1)) -+ continue; -+ - if (!b_chmux && i == dma_spec->args[0]) { - chan = dma_get_slave_channel(chan); - chan->device->privatecnt++; --- -2.43.2 - -From 9263fd2a63487c6d04cbb7b74a48fb12e1e352d0 Mon Sep 17 00:00:00 2001 -From: Amelie Delaunay <amelie.delaunay@foss.st.com> -Date: Wed, 13 Dec 2023 17:04:52 +0100 -Subject: [PATCH 0722/1501] dmaengine: fix NULL pointer in channel - unregistration function -Content-Length: 1945 -Lines: 47 - -[ Upstream commit f5c24d94512f1b288262beda4d3dcb9629222fc7 ] - -__dma_async_device_channel_register() can fail. In case of failure, -chan->local is freed (with free_percpu()), and chan->local is nullified. -When dma_async_device_unregister() is called (because of managed API or -intentionally by DMA controller driver), channels are unconditionally -unregistered, leading to this NULL pointer: -[ 1.318693] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0 -[...] -[ 1.484499] Call trace: -[ 1.486930] device_del+0x40/0x394 -[ 1.490314] device_unregister+0x20/0x7c -[ 1.494220] __dma_async_device_channel_unregister+0x68/0xc0 - -Look at dma_async_device_register() function error path, channel device -unregistration is done only if chan->local is not NULL. - -Then add the same condition at the beginning of -__dma_async_device_channel_unregister() function, to avoid NULL pointer -issue whatever the API used to reach this function. - -Fixes: d2fb0a043838 ("dmaengine: break out channel registration") -Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com> -Reviewed-by: Dave Jiang <dave.jiang@intel.com> -Link: https://lore.kernel.org/r/20231213160452.2598073-1-amelie.delaunay@foss.st.com -Signed-off-by: Vinod Koul <vkoul@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/dma/dmaengine.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c -index b7388ae62d7f..491b22240221 100644 ---- a/drivers/dma/dmaengine.c -+++ b/drivers/dma/dmaengine.c -@@ -1103,6 +1103,9 @@ EXPORT_SYMBOL_GPL(dma_async_device_channel_register); - static void __dma_async_device_channel_unregister(struct dma_device *device, - struct dma_chan *chan) - { -+ if (chan->local == NULL) -+ return; -+ - WARN_ONCE(!device->device_release && chan->client_count, - "%s called while %d clients hold a reference\n", - __func__, chan->client_count); --- -2.43.2 - -From 0a32a2d8467079fe1995454499521b488fb58c00 Mon Sep 17 00:00:00 2001 -From: Rex Zhang <rex.zhang@intel.com> -Date: Tue, 12 Dec 2023 10:21:58 +0800 -Subject: [PATCH 0723/1501] dmaengine: idxd: Move dma_free_coherent() out of - spinlocked context -Content-Length: 2189 -Lines: 64 - -[ Upstream commit e271c0ba3f919c48e90c64b703538fbb7865cb63 ] - -Task may be rescheduled within dma_free_coherent(). So dma_free_coherent() -can't be called between spin_lock() and spin_unlock() to avoid Call Trace: - Call Trace: - <TASK> - dump_stack_lvl+0x37/0x50 - __might_resched+0x16a/0x1c0 - vunmap+0x2c/0x70 - __iommu_dma_free+0x96/0x100 - idxd_device_evl_free+0xd5/0x100 [idxd] - device_release_driver_internal+0x197/0x200 - unbind_store+0xa1/0xb0 - kernfs_fop_write_iter+0x120/0x1c0 - vfs_write+0x2d3/0x400 - ksys_write+0x63/0xe0 - do_syscall_64+0x44/0xa0 - entry_SYSCALL_64_after_hwframe+0x6e/0xd8 -Move it out of the context. - -Fixes: 244da66cda35 ("dmaengine: idxd: setup event log configuration") -Signed-off-by: Rex Zhang <rex.zhang@intel.com> -Reviewed-by: Dave Jiang <dave.jiang@intel.com> -Reviewed-by: Fenghua Yu <fenghua.yu@intel.com> -Link: https://lore.kernel.org/r/20231212022158.358619-2-rex.zhang@intel.com -Signed-off-by: Vinod Koul <vkoul@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/dma/idxd/device.c | 9 ++++++++- - 1 file changed, 8 insertions(+), 1 deletion(-) - -diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c -index 8f754f922217..fa0f880beae6 100644 ---- a/drivers/dma/idxd/device.c -+++ b/drivers/dma/idxd/device.c -@@ -802,6 +802,9 @@ static int idxd_device_evl_setup(struct idxd_device *idxd) - - static void idxd_device_evl_free(struct idxd_device *idxd) - { -+ void *evl_log; -+ unsigned int evl_log_size; -+ dma_addr_t evl_dma; - union gencfg_reg gencfg; - union genctrl_reg genctrl; - struct device *dev = &idxd->pdev->dev; -@@ -822,11 +825,15 @@ static void idxd_device_evl_free(struct idxd_device *idxd) - iowrite64(0, idxd->reg_base + IDXD_EVLCFG_OFFSET); - iowrite64(0, idxd->reg_base + IDXD_EVLCFG_OFFSET + 8); - -- dma_free_coherent(dev, evl->log_size, evl->log, evl->dma); - bitmap_free(evl->bmap); -+ evl_log = evl->log; -+ evl_log_size = evl->log_size; -+ evl_dma = evl->dma; - evl->log = NULL; - evl->size = IDXD_EVL_SIZE_MIN; - spin_unlock(&evl->lock); -+ -+ dma_free_coherent(dev, evl_log_size, evl_log, evl_dma); - } - - static void idxd_group_config_write(struct idxd_group *group) --- -2.43.2 - -From 7ff852b6b012aa0554b4f1c0f10e324563001a1e Mon Sep 17 00:00:00 2001 -From: Miquel Raynal <miquel.raynal@bootlin.com> -Date: Thu, 30 Nov 2023 12:13:12 +0100 -Subject: [PATCH 0724/1501] dmaengine: xilinx: xdma: Fix the count of elapsed - periods in cyclic mode -Content-Length: 1411 -Lines: 43 - -[ Upstream commit 26ee018ff6d1c326ac9b9be36513e35870ed09db ] - -Xilinx DMA engine is capable of keeping track of the number of elapsed -periods and this is an increasing 32-bit counter which is only reset -when turning off the engine. No need to add this value to our local -counter. - -Fixes: cd8c732ce1a5 ("dmaengine: xilinx: xdma: Support cyclic transfers") -Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> -Link: https://lore.kernel.org/r/20231130111315.729430-2-miquel.raynal@bootlin.com -Signed-off-by: Vinod Koul <vkoul@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/dma/xilinx/xdma.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/drivers/dma/xilinx/xdma.c b/drivers/dma/xilinx/xdma.c -index 84a88029226f..2c9c72d4b5a2 100644 ---- a/drivers/dma/xilinx/xdma.c -+++ b/drivers/dma/xilinx/xdma.c -@@ -754,9 +754,9 @@ static irqreturn_t xdma_channel_isr(int irq, void *dev_id) - if (ret) - goto out; - -- desc->completed_desc_num += complete_desc_num; -- - if (desc->cyclic) { -+ desc->completed_desc_num = complete_desc_num; -+ - ret = regmap_read(xdev->rmap, xchan->base + XDMA_CHAN_STATUS, - &st); - if (ret) -@@ -768,6 +768,8 @@ static irqreturn_t xdma_channel_isr(int irq, void *dev_id) - goto out; - } - -+ desc->completed_desc_num += complete_desc_num; -+ - /* - * if all data blocks are transferred, remove and complete the request - */ --- -2.43.2 - -From 691bb9b5c0d6d59bfa2dd0bc56a1b832a271b0c3 Mon Sep 17 00:00:00 2001 -From: Bart Van Assche <bvanassche@acm.org> -Date: Mon, 18 Dec 2023 14:52:15 -0800 -Subject: [PATCH 0725/1501] scsi: ufs: core: Remove the ufshcd_hba_exit() call - from ufshcd_async_scan() -Content-Length: 1426 -Lines: 39 - -[ Upstream commit ee36710912b2075c417100a8acc642c9c6496501 ] - -Calling ufshcd_hba_exit() from a function that is called asynchronously -from ufshcd_init() is wrong because this triggers multiple race -conditions. Instead of calling ufshcd_hba_exit(), log an error message. - -Reported-by: Daniel Mentz <danielmentz@google.com> -Fixes: 1d337ec2f35e ("ufs: improve init sequence") -Signed-off-by: Bart Van Assche <bvanassche@acm.org> -Link: https://lore.kernel.org/r/20231218225229.2542156-3-bvanassche@acm.org -Reviewed-by: Can Guo <quic_cang@quicinc.com> -Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/ufs/core/ufshcd.c | 7 ++----- - 1 file changed, 2 insertions(+), 5 deletions(-) - -diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c -index ce2f76769fb0..1f8d86b9c4fa 100644 ---- a/drivers/ufs/core/ufshcd.c -+++ b/drivers/ufs/core/ufshcd.c -@@ -8916,12 +8916,9 @@ static void ufshcd_async_scan(void *data, async_cookie_t cookie) - - out: - pm_runtime_put_sync(hba->dev); -- /* -- * If we failed to initialize the device or the device is not -- * present, turn off the power/clocks etc. -- */ -+ - if (ret) -- ufshcd_hba_exit(hba); -+ dev_err(hba->dev, "%s failed: %d\n", __func__, ret); - } - - static enum scsi_timeout_action ufshcd_eh_timed_out(struct scsi_cmnd *scmd) --- -2.43.2 - -From 2fa79badf4bfeffda6b5032cf62b828486ec9a99 Mon Sep 17 00:00:00 2001 -From: Charlie Jenkins <charlie@rivosinc.com> -Date: Thu, 4 Jan 2024 11:42:47 -0800 -Subject: [PATCH 0726/1501] riscv: Fix module loading free order -Content-Length: 1338 -Lines: 36 - -[ Upstream commit 78996eee79ebdfe8b6f0e54cb6dcc792d5129291 ] - -Reverse order of kfree calls to resolve use-after-free error. - -Signed-off-by: Charlie Jenkins <charlie@rivosinc.com> -Fixes: d8792a5734b0 ("riscv: Safely remove entries from relocation list") -Reported-by: kernel test robot <lkp@intel.com> -Reported-by: Dan Carpenter <error27@gmail.com> -Closes: https://lore.kernel.org/r/202312132019.iYGTwW0L-lkp@intel.com/ -Reported-by: kernel test robot <lkp@intel.com> -Reported-by: Julia Lawall <julia.lawall@inria.fr> -Closes: https://lore.kernel.org/r/202312120044.wTI1Uyaa-lkp@intel.com/ -Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> -Link: https://lore.kernel.org/r/20240104-module_loading_fix-v3-1-a71f8de6ce0f@rivosinc.com -Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/riscv/kernel/module.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c -index 862834bb1d64..5cf3a693482d 100644 ---- a/arch/riscv/kernel/module.c -+++ b/arch/riscv/kernel/module.c -@@ -723,8 +723,8 @@ static int add_relocation_to_accumulate(struct module *me, int type, - - if (!bucket) { - kfree(entry); -- kfree(rel_head); - kfree(rel_head->rel_entry); -+ kfree(rel_head); - return -ENOMEM; - } - --- -2.43.2 - -From 72301e18d8b0a3666bd567dcdfee7aafb1cdcbbd Mon Sep 17 00:00:00 2001 -From: Charlie Jenkins <charlie@rivosinc.com> -Date: Thu, 4 Jan 2024 11:42:48 -0800 -Subject: [PATCH 0727/1501] riscv: Correctly free relocation hashtable on error -Content-Length: 2455 -Lines: 62 - -[ Upstream commit 4b38b36bfbd83b23e20c172d08dd85773791e3bd ] - -When there is not enough allocatable memory for the relocation -hashtable, module loading should exit gracefully. Previously, this was -attempted to be accomplished by checking if an unsigned number is less -than zero which does not work. Instead have the caller check if the -hashtable was correctly allocated and add a comment explaining that -hashtable_bits that is 0 is valid. - -Signed-off-by: Charlie Jenkins <charlie@rivosinc.com> -Fixes: d8792a5734b0 ("riscv: Safely remove entries from relocation list") -Reported-by: kernel test robot <lkp@intel.com> -Reported-by: Dan Carpenter <dan.carpenter@linaro.org> -Closes: https://lore.kernel.org/r/202312132019.iYGTwW0L-lkp@intel.com/ -Reported-by: kernel test robot <lkp@intel.com> -Reported-by: Julia Lawall <julia.lawall@inria.fr> -Closes: https://lore.kernel.org/r/202312120044.wTI1Uyaa-lkp@intel.com/ -Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> -Link: https://lore.kernel.org/r/20240104-module_loading_fix-v3-2-a71f8de6ce0f@rivosinc.com -Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/riscv/kernel/module.c | 10 +++++++--- - 1 file changed, 7 insertions(+), 3 deletions(-) - -diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c -index 5cf3a693482d..91f7cd221afc 100644 ---- a/arch/riscv/kernel/module.c -+++ b/arch/riscv/kernel/module.c -@@ -747,6 +747,10 @@ initialize_relocation_hashtable(unsigned int num_relocations, - { - /* Can safely assume that bits is not greater than sizeof(long) */ - unsigned long hashtable_size = roundup_pow_of_two(num_relocations); -+ /* -+ * When hashtable_size == 1, hashtable_bits == 0. -+ * This is valid because the hashing algorithm returns 0 in this case. -+ */ - unsigned int hashtable_bits = ilog2(hashtable_size); - - /* -@@ -763,7 +767,7 @@ initialize_relocation_hashtable(unsigned int num_relocations, - sizeof(*relocation_hashtable), - GFP_KERNEL); - if (!*relocation_hashtable) -- return -ENOMEM; -+ return 0; - - __hash_init(*relocation_hashtable, hashtable_size); - -@@ -789,8 +793,8 @@ int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, - hashtable_bits = initialize_relocation_hashtable(num_relocations, - &relocation_hashtable); - -- if (hashtable_bits < 0) -- return hashtable_bits; -+ if (!relocation_hashtable) -+ return -ENOMEM; - - INIT_LIST_HEAD(&used_buckets_list); - --- -2.43.2 - -From 7a5b2ca3f643c6e8655efc9043cb65cbdc697d53 Mon Sep 17 00:00:00 2001 -From: Charlie Jenkins <charlie@rivosinc.com> -Date: Thu, 4 Jan 2024 11:42:49 -0800 -Subject: [PATCH 0728/1501] riscv: Fix relocation_hashtable size -Content-Length: 1297 -Lines: 33 - -[ Upstream commit a35551c7244d9d061643a01eb96cc3ba04eaf45c ] - -A second dereference is needed to get the accurate size of the -relocation_hashtable. - -Signed-off-by: Charlie Jenkins <charlie@rivosinc.com> -Fixes: d8792a5734b0 ("riscv: Safely remove entries from relocation list") -Reported-by: kernel test robot <lkp@intel.com> -Reported-by: Julia Lawall <julia.lawall@inria.fr> -Closes: https://lore.kernel.org/r/202312120044.wTI1Uyaa-lkp@intel.com/ -Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> -Link: https://lore.kernel.org/r/20240104-module_loading_fix-v3-3-a71f8de6ce0f@rivosinc.com -Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/riscv/kernel/module.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c -index 91f7cd221afc..c9d59a5448b6 100644 ---- a/arch/riscv/kernel/module.c -+++ b/arch/riscv/kernel/module.c -@@ -764,7 +764,7 @@ initialize_relocation_hashtable(unsigned int num_relocations, - hashtable_size <<= should_double_size; - - *relocation_hashtable = kmalloc_array(hashtable_size, -- sizeof(*relocation_hashtable), -+ sizeof(**relocation_hashtable), - GFP_KERNEL); - if (!*relocation_hashtable) - return 0; --- -2.43.2 - -From 838127ab54fe4c2425070e1f3b9f3327f38d6ce5 Mon Sep 17 00:00:00 2001 -From: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Date: Sun, 29 Oct 2023 08:20:40 +0100 -Subject: [PATCH 0729/1501] riscv: Fix an off-by-one in get_early_cmdline() -Content-Length: 1382 -Lines: 32 - -[ Upstream commit adb1f95d388a43c4c564ef3e436f18900dde978e ] - -The ending NULL is not taken into account by strncat(), so switch to -strlcat() to correctly compute the size of the available memory when -appending CONFIG_CMDLINE to 'early_cmdline'. - -Fixes: 26e7aacb83df ("riscv: Allow to downgrade paging mode from the command line") -Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com> -Link: https://lore.kernel.org/r/9f66d2b58c8052d4055e90b8477ee55d9a0914f9.1698564026.git.christophe.jaillet@wanadoo.fr -Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/riscv/kernel/pi/cmdline_early.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/arch/riscv/kernel/pi/cmdline_early.c b/arch/riscv/kernel/pi/cmdline_early.c -index 68e786c84c94..f6d4dedffb84 100644 ---- a/arch/riscv/kernel/pi/cmdline_early.c -+++ b/arch/riscv/kernel/pi/cmdline_early.c -@@ -38,8 +38,7 @@ static char *get_early_cmdline(uintptr_t dtb_pa) - if (IS_ENABLED(CONFIG_CMDLINE_EXTEND) || - IS_ENABLED(CONFIG_CMDLINE_FORCE) || - fdt_cmdline_size == 0 /* CONFIG_CMDLINE_FALLBACK */) { -- strncat(early_cmdline, CONFIG_CMDLINE, -- COMMAND_LINE_SIZE - fdt_cmdline_size); -+ strlcat(early_cmdline, CONFIG_CMDLINE, COMMAND_LINE_SIZE); - } - - return early_cmdline; --- -2.43.2 - -From d95dcb15cd42a3706b5dd47cbf1d5d37d28520b4 Mon Sep 17 00:00:00 2001 -From: Niklas Cassel <cassel@kernel.org> -Date: Thu, 11 Jan 2024 13:05:32 +0100 -Subject: [PATCH 0730/1501] scsi: core: Kick the requeue list after inserting - when flushing -Content-Length: 3791 -Lines: 89 - -[ Upstream commit 6df0e077d76bd144c533b61d6182676aae6b0a85 ] - -When libata calls ata_link_abort() to abort all ata queued commands, it -calls blk_abort_request() on the SCSI command representing each QC. - -This causes scsi_timeout() to be called, which calls scsi_eh_scmd_add() for -each SCSI command. - -scsi_eh_scmd_add() sets the SCSI host to state recovery, and then adds the -command to shost->eh_cmd_q. - -This will wake up the SCSI EH, and eventually the libata EH strategy -handler will be called, which calls scsi_eh_flush_done_q() to either flush -retry or flush finish each failed command. - -The commands that are flush retried by scsi_eh_flush_done_q() are done so -using scsi_queue_insert(). - -Before commit 8b566edbdbfb ("scsi: core: Only kick the requeue list if -necessary"), __scsi_queue_insert() called blk_mq_requeue_request() with the -second argument set to true, indicating that it should always kick/run the -requeue list after inserting. - -After commit 8b566edbdbfb ("scsi: core: Only kick the requeue list if -necessary"), __scsi_queue_insert() does not kick/run the requeue list after -inserting, if the current SCSI host state is recovery (which is the case in -the libata example above). - -This optimization is probably fine in most cases, as I can only assume that -most often someone will eventually kick/run the queues. - -However, that is not the case for scsi_eh_flush_done_q(), where we can see -that the request gets inserted to the requeue list, but the queue is never -started after the request has been inserted, leading to the block layer -waiting for the completion of command that never gets to run. - -Since scsi_eh_flush_done_q() is called by SCSI EH context, the SCSI host -state is most likely always in recovery when this function is called. - -Thus, let scsi_eh_flush_done_q() explicitly kick the requeue list after -inserting a flush retry command, so that scsi_eh_flush_done_q() keeps the -same behavior as before commit 8b566edbdbfb ("scsi: core: Only kick the -requeue list if necessary"). - -Simple reproducer for the libata example above: -$ hdparm -Y /dev/sda -$ echo 1 > /sys/class/scsi_device/0\:0\:0\:0/device/delete - -Fixes: 8b566edbdbfb ("scsi: core: Only kick the requeue list if necessary") -Reported-by: Kevin Locke <kevin@kevinlocke.name> -Closes: https://lore.kernel.org/linux-scsi/ZZw3Th70wUUvCiCY@kevinlocke.name/ -Signed-off-by: Niklas Cassel <cassel@kernel.org> -Link: https://lore.kernel.org/r/20240111120533.3612509-1-cassel@kernel.org -Reviewed-by: Bart Van Assche <bvanassche@acm.org> -Reviewed-by: Damien Le Moal <dlemoal@kernel.org> -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/scsi/scsi_error.c | 9 ++++++--- - 1 file changed, 6 insertions(+), 3 deletions(-) - -diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c -index 1223d34c04da..d983f4a0e9f1 100644 ---- a/drivers/scsi/scsi_error.c -+++ b/drivers/scsi/scsi_error.c -@@ -2196,15 +2196,18 @@ void scsi_eh_flush_done_q(struct list_head *done_q) - struct scsi_cmnd *scmd, *next; - - list_for_each_entry_safe(scmd, next, done_q, eh_entry) { -+ struct scsi_device *sdev = scmd->device; -+ - list_del_init(&scmd->eh_entry); -- if (scsi_device_online(scmd->device) && -- !scsi_noretry_cmd(scmd) && scsi_cmd_retry_allowed(scmd) && -- scsi_eh_should_retry_cmd(scmd)) { -+ if (scsi_device_online(sdev) && !scsi_noretry_cmd(scmd) && -+ scsi_cmd_retry_allowed(scmd) && -+ scsi_eh_should_retry_cmd(scmd)) { - SCSI_LOG_ERROR_RECOVERY(3, - scmd_printk(KERN_INFO, scmd, - "%s: flush retry cmd\n", - current->comm)); - scsi_queue_insert(scmd, SCSI_MLQUEUE_EH_RETRY); -+ blk_mq_kick_requeue_list(sdev->request_queue); - } else { - /* - * If just we got sense for the device (called --- -2.43.2 - -From 144a2afd8ad54b2973aee4e60a6a511f0da49278 Mon Sep 17 00:00:00 2001 -From: Geert Uytterhoeven <geert+renesas@glider.be> -Date: Mon, 25 Sep 2023 13:10:22 +0200 -Subject: [PATCH 0731/1501] sh: ecovec24: Rename missed backlight field from - fbdev to dev -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1817 -Lines: 41 - -[ Upstream commit d87123aa9a7920e88633ffc5c5a0a22ab08bdc06 ] - -One instance of gpio_backlight_platform_data.fbdev was renamed, but the -second instance was forgotten, causing a build failure: - - arch/sh/boards/mach-ecovec24/setup.c: In function ‘arch_setup’: - arch/sh/boards/mach-ecovec24/setup.c:1223:37: error: ‘struct gpio_backlight_platform_data’ has no member named ‘fbdev’; did you mean ‘dev’? - 1223 | gpio_backlight_data.fbdev = NULL; - | ^~~~~ - | dev - -Fix this by updating the second instance. - -Fixes: ed369def91c1579a ("backlight/gpio_backlight: Rename field 'fbdev' to 'dev'") -Reported-by: kernel test robot <lkp@intel.com> -Closes: https://lore.kernel.org/oe-kbuild-all/202309231601.Uu6qcRnU-lkp@intel.com/ -Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> -Acked-by: Thomas Zimmermann <tzimmermann@suse.de> -Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> -Link: https://lore.kernel.org/r/20230925111022.3626362-1-geert+renesas@glider.be -Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/sh/boards/mach-ecovec24/setup.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/sh/boards/mach-ecovec24/setup.c b/arch/sh/boards/mach-ecovec24/setup.c -index 0f279360838a..30d117f9ad7e 100644 ---- a/arch/sh/boards/mach-ecovec24/setup.c -+++ b/arch/sh/boards/mach-ecovec24/setup.c -@@ -1220,7 +1220,7 @@ static int __init arch_setup(void) - lcdc_info.ch[0].num_modes = ARRAY_SIZE(ecovec_dvi_modes); - - /* No backlight */ -- gpio_backlight_data.fbdev = NULL; -+ gpio_backlight_data.dev = NULL; - - gpio_set_value(GPIO_PTA2, 1); - gpio_set_value(GPIO_PTU1, 1); --- -2.43.2 - -From 9201b54603496dc227ecc07bb6b8a78d5e711d8e Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara <pc@manguebit.com> -Date: Fri, 19 Jan 2024 01:08:26 -0300 -Subject: [PATCH 0732/1501] smb: client: fix parsing of SMB3.1.1 POSIX create - context -Content-Length: 1103 -Lines: 32 - -[ Upstream commit 76025cc2285d9ede3d717fe4305d66f8be2d9346 ] - -The data offset for the SMB3.1.1 POSIX create context will always be -8-byte aligned so having the check 'noff + nlen >= doff' in -smb2_parse_contexts() is wrong as it will lead to -EINVAL because noff -+ nlen == doff. - -Fix the sanity check to correctly handle aligned create context data. - -Fixes: af1689a9b770 ("smb: client: fix potential OOBs in smb2_parse_contexts()") -Signed-off-by: Paulo Alcantara <pc@manguebit.com> -Signed-off-by: Steve French <stfrench@microsoft.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/smb/client/smb2pdu.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c -index 4f971c1061f0..12e41fcd0b46 100644 ---- a/fs/smb/client/smb2pdu.c -+++ b/fs/smb/client/smb2pdu.c -@@ -2279,7 +2279,7 @@ int smb2_parse_contexts(struct TCP_Server_Info *server, - - noff = le16_to_cpu(cc->NameOffset); - nlen = le16_to_cpu(cc->NameLength); -- if (noff + nlen >= doff) -+ if (noff + nlen > doff) - return -EINVAL; - - name = (char *)cc + noff; --- -2.43.2 - -From d61ba1d71ea6039eca7ada870bf3f0c3c8fc12e4 Mon Sep 17 00:00:00 2001 -From: Shyam Prasad N <sprasad@microsoft.com> -Date: Tue, 2 Jan 2024 13:14:46 +0000 -Subject: [PATCH 0733/1501] cifs: handle servers that still advertise - multichannel after disabling -Content-Length: 6993 -Lines: 212 - -[ Upstream commit f591062bdbf4742b7f1622173017f19e927057b0 ] - -Some servers like Azure SMB servers always advertise multichannel -capability in server capabilities list. Such servers return error -STATUS_NOT_IMPLEMENTED for ioctl calls to query server interfaces, -and expect clients to consider that as a sign that they do not support -multichannel. - -We already handled this at mount time. Soon after the tree connect, -we query server interfaces. And when server returned STATUS_NOT_IMPLEMENTED, -we kept interface list as empty. When cifs_try_adding_channels gets -called, it would not find any interfaces, so will not add channels. - -For the case where an active multichannel mount exists, and multichannel -is disabled by such a server, this change will now allow the client -to disable secondary channels on the mount. It will check the return -status of query server interfaces call soon after a tree reconnect. -If the return status is EOPNOTSUPP, then instead of the check to add -more channels, we'll disable the secondary channels instead. - -For better code reuse, this change also moves the common code for -disabling multichannel to a helper function. - -Signed-off-by: Shyam Prasad N <sprasad@microsoft.com> -Signed-off-by: Steve French <stfrench@microsoft.com> -Stable-dep-of: 78e727e58e54 ("cifs: update iface_last_update on each query-and-update") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/smb/client/smb2ops.c | 8 +-- - fs/smb/client/smb2pdu.c | 107 +++++++++++++++++++++++++--------------- - 2 files changed, 69 insertions(+), 46 deletions(-) - -diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c -index 14bc745de199..17310f3a9d89 100644 ---- a/fs/smb/client/smb2ops.c -+++ b/fs/smb/client/smb2ops.c -@@ -614,7 +614,7 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, - "multichannel not available\n" - "Empty network interface list returned by server %s\n", - ses->server->hostname); -- rc = -EINVAL; -+ rc = -EOPNOTSUPP; - goto out; - } - -@@ -734,12 +734,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, - if ((bytes_left > 8) || p->Next) - cifs_dbg(VFS, "%s: incomplete interface info\n", __func__); - -- -- if (!ses->iface_count) { -- rc = -EINVAL; -- goto out; -- } -- - out: - /* - * Go through the list again and put the inactive entries -diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c -index 12e41fcd0b46..bfec2ca0f4e6 100644 ---- a/fs/smb/client/smb2pdu.c -+++ b/fs/smb/client/smb2pdu.c -@@ -156,6 +156,57 @@ smb2_hdr_assemble(struct smb2_hdr *shdr, __le16 smb2_cmd, - return; - } - -+/* helper function for code reuse */ -+static int -+cifs_chan_skip_or_disable(struct cifs_ses *ses, -+ struct TCP_Server_Info *server, -+ bool from_reconnect) -+{ -+ struct TCP_Server_Info *pserver; -+ unsigned int chan_index; -+ -+ if (SERVER_IS_CHAN(server)) { -+ cifs_dbg(VFS, -+ "server %s does not support multichannel anymore. Skip secondary channel\n", -+ ses->server->hostname); -+ -+ spin_lock(&ses->chan_lock); -+ chan_index = cifs_ses_get_chan_index(ses, server); -+ if (chan_index == CIFS_INVAL_CHAN_INDEX) { -+ spin_unlock(&ses->chan_lock); -+ goto skip_terminate; -+ } -+ -+ ses->chans[chan_index].server = NULL; -+ spin_unlock(&ses->chan_lock); -+ -+ /* -+ * the above reference of server by channel -+ * needs to be dropped without holding chan_lock -+ * as cifs_put_tcp_session takes a higher lock -+ * i.e. cifs_tcp_ses_lock -+ */ -+ cifs_put_tcp_session(server, from_reconnect); -+ -+ server->terminate = true; -+ cifs_signal_cifsd_for_reconnect(server, false); -+ -+ /* mark primary server as needing reconnect */ -+ pserver = server->primary_server; -+ cifs_signal_cifsd_for_reconnect(pserver, false); -+skip_terminate: -+ mutex_unlock(&ses->session_mutex); -+ return -EHOSTDOWN; -+ } -+ -+ cifs_server_dbg(VFS, -+ "server does not support multichannel anymore. Disable all other channels\n"); -+ cifs_disable_secondary_channels(ses); -+ -+ -+ return 0; -+} -+ - static int - smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, - struct TCP_Server_Info *server, bool from_reconnect) -@@ -164,8 +215,6 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, - struct nls_table *nls_codepage = NULL; - struct cifs_ses *ses; - int xid; -- struct TCP_Server_Info *pserver; -- unsigned int chan_index; - - /* - * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so -@@ -310,44 +359,11 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, - */ - if (ses->chan_count > 1 && - !(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) { -- if (SERVER_IS_CHAN(server)) { -- cifs_dbg(VFS, "server %s does not support " \ -- "multichannel anymore. skipping secondary channel\n", -- ses->server->hostname); -- -- spin_lock(&ses->chan_lock); -- chan_index = cifs_ses_get_chan_index(ses, server); -- if (chan_index == CIFS_INVAL_CHAN_INDEX) { -- spin_unlock(&ses->chan_lock); -- goto skip_terminate; -- } -- -- ses->chans[chan_index].server = NULL; -- spin_unlock(&ses->chan_lock); -- -- /* -- * the above reference of server by channel -- * needs to be dropped without holding chan_lock -- * as cifs_put_tcp_session takes a higher lock -- * i.e. cifs_tcp_ses_lock -- */ -- cifs_put_tcp_session(server, from_reconnect); -- -- server->terminate = true; -- cifs_signal_cifsd_for_reconnect(server, false); -- -- /* mark primary server as needing reconnect */ -- pserver = server->primary_server; -- cifs_signal_cifsd_for_reconnect(pserver, false); -- --skip_terminate: -+ rc = cifs_chan_skip_or_disable(ses, server, -+ from_reconnect); -+ if (rc) { - mutex_unlock(&ses->session_mutex); -- rc = -EHOSTDOWN; - goto out; -- } else { -- cifs_server_dbg(VFS, "does not support " \ -- "multichannel anymore. disabling all other channels\n"); -- cifs_disable_secondary_channels(ses); - } - } - -@@ -395,11 +411,23 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, - rc = SMB3_request_interfaces(xid, tcon, false); - free_xid(xid); - -- if (rc) -+ if (rc == -EOPNOTSUPP) { -+ /* -+ * some servers like Azure SMB server do not advertise -+ * that multichannel has been disabled with server -+ * capabilities, rather return STATUS_NOT_IMPLEMENTED. -+ * treat this as server not supporting multichannel -+ */ -+ -+ rc = cifs_chan_skip_or_disable(ses, server, -+ from_reconnect); -+ goto skip_add_channels; -+ } else if (rc) - cifs_dbg(FYI, "%s: failed to query server interfaces: %d\n", - __func__, rc); - - if (ses->chan_max > ses->chan_count && -+ ses->iface_count && - !SERVER_IS_CHAN(server)) { - if (ses->chan_count == 1) - cifs_server_dbg(VFS, "supports multichannel now\n"); -@@ -409,6 +437,7 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, - } else { - mutex_unlock(&ses->session_mutex); - } -+skip_add_channels: - - if (smb2_command != SMB2_INTERNAL_CMD) - mod_delayed_work(cifsiod_wq, &server->reconnect, 0); --- -2.43.2 - -From 4e2eba51b39c42ab4645195693a3dd1c0be60c4f Mon Sep 17 00:00:00 2001 -From: Shyam Prasad N <sprasad@microsoft.com> -Date: Wed, 3 Jan 2024 12:51:49 +0000 -Subject: [PATCH 0734/1501] cifs: update iface_last_update on each - query-and-update -Content-Length: 1907 -Lines: 54 - -[ Upstream commit 78e727e58e54efca4c23863fbd9e16e9d2d83f81 ] - -iface_last_update was an unused field when it was introduced. -Later, when we had periodic update of server interface list, -this field was used regularly to decide when to update next. - -However, with the new logic of updating the interfaces, it -becomes crucial that this field be updated whenever -parse_server_interfaces runs successfully. - -This change updates this field when either the server does -not support query of interfaces; so that we do not query -the interfaces repeatedly. It also updates the field when -the function reaches the end. - -Fixes: aa45dadd34e4 ("cifs: change iface_list from array to sorted linked list") -Signed-off-by: Shyam Prasad N <sprasad@microsoft.com> -Signed-off-by: Steve French <stfrench@microsoft.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/smb/client/smb2ops.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c -index 17310f3a9d89..beb81fa00cff 100644 ---- a/fs/smb/client/smb2ops.c -+++ b/fs/smb/client/smb2ops.c -@@ -615,6 +615,7 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, - "Empty network interface list returned by server %s\n", - ses->server->hostname); - rc = -EOPNOTSUPP; -+ ses->iface_last_update = jiffies; - goto out; - } - -@@ -712,7 +713,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, - - ses->iface_count++; - spin_unlock(&ses->iface_lock); -- ses->iface_last_update = jiffies; - next_iface: - nb_iface++; - next = le32_to_cpu(p->Next); -@@ -734,6 +734,8 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, - if ((bytes_left > 8) || p->Next) - cifs_dbg(VFS, "%s: incomplete interface info\n", __func__); - -+ ses->iface_last_update = jiffies; -+ - out: - /* - * Go through the list again and put the inactive entries --- -2.43.2 - -From 1818ee771c3afcff013fe25043b0ffa2017ecfb9 Mon Sep 17 00:00:00 2001 -From: Alfred Piccioni <alpic@google.com> -Date: Tue, 19 Dec 2023 10:09:09 +0100 -Subject: [PATCH 0762/1501] lsm: new security_file_ioctl_compat() hook -Content-Length: 7554 -Lines: 196 - -commit f1bb47a31dff6d4b34fb14e99850860ee74bb003 upstream. - -Some ioctl commands do not require ioctl permission, but are routed to -other permissions such as FILE_GETATTR or FILE_SETATTR. This routing is -done by comparing the ioctl cmd to a set of 64-bit flags (FS_IOC_*). - -However, if a 32-bit process is running on a 64-bit kernel, it emits -32-bit flags (FS_IOC32_*) for certain ioctl operations. These flags are -being checked erroneously, which leads to these ioctl operations being -routed to the ioctl permission, rather than the correct file -permissions. - -This was also noted in a RED-PEN finding from a while back - -"/* RED-PEN how should LSM module know it's handling 32bit? */". - -This patch introduces a new hook, security_file_ioctl_compat(), that is -called from the compat ioctl syscall. All current LSMs have been changed -to support this hook. - -Reviewing the three places where we are currently using -security_file_ioctl(), it appears that only SELinux needs a dedicated -compat change; TOMOYO and SMACK appear to be functional without any -change. - -Cc: stable@vger.kernel.org -Fixes: 0b24dcb7f2f7 ("Revert "selinux: simplify ioctl checking"") -Signed-off-by: Alfred Piccioni <alpic@google.com> -Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com> -[PM: subject tweak, line length fixes, and alignment corrections] -Signed-off-by: Paul Moore <paul@paul-moore.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/ioctl.c | 3 +-- - include/linux/lsm_hook_defs.h | 2 ++ - include/linux/security.h | 9 +++++++++ - security/security.c | 18 ++++++++++++++++++ - security/selinux/hooks.c | 28 ++++++++++++++++++++++++++++ - security/smack/smack_lsm.c | 1 + - security/tomoyo/tomoyo.c | 1 + - 7 files changed, 60 insertions(+), 2 deletions(-) - -diff --git a/fs/ioctl.c b/fs/ioctl.c -index f5fd99d6b0d4..76cf22ac97d7 100644 ---- a/fs/ioctl.c -+++ b/fs/ioctl.c -@@ -920,8 +920,7 @@ COMPAT_SYSCALL_DEFINE3(ioctl, unsigned int, fd, unsigned int, cmd, - if (!f.file) - return -EBADF; - -- /* RED-PEN how should LSM module know it's handling 32bit? */ -- error = security_file_ioctl(f.file, cmd, arg); -+ error = security_file_ioctl_compat(f.file, cmd, arg); - if (error) - goto out; - -diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h -index ff217a5ce552..472cb16458b0 100644 ---- a/include/linux/lsm_hook_defs.h -+++ b/include/linux/lsm_hook_defs.h -@@ -171,6 +171,8 @@ LSM_HOOK(int, 0, file_alloc_security, struct file *file) - LSM_HOOK(void, LSM_RET_VOID, file_free_security, struct file *file) - LSM_HOOK(int, 0, file_ioctl, struct file *file, unsigned int cmd, - unsigned long arg) -+LSM_HOOK(int, 0, file_ioctl_compat, struct file *file, unsigned int cmd, -+ unsigned long arg) - LSM_HOOK(int, 0, mmap_addr, unsigned long addr) - LSM_HOOK(int, 0, mmap_file, struct file *file, unsigned long reqprot, - unsigned long prot, unsigned long flags) -diff --git a/include/linux/security.h b/include/linux/security.h -index 1d1df326c881..9d3138c6364c 100644 ---- a/include/linux/security.h -+++ b/include/linux/security.h -@@ -389,6 +389,8 @@ int security_file_permission(struct file *file, int mask); - int security_file_alloc(struct file *file); - void security_file_free(struct file *file); - int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg); -+int security_file_ioctl_compat(struct file *file, unsigned int cmd, -+ unsigned long arg); - int security_mmap_file(struct file *file, unsigned long prot, - unsigned long flags); - int security_mmap_addr(unsigned long addr); -@@ -987,6 +989,13 @@ static inline int security_file_ioctl(struct file *file, unsigned int cmd, - return 0; - } - -+static inline int security_file_ioctl_compat(struct file *file, -+ unsigned int cmd, -+ unsigned long arg) -+{ -+ return 0; -+} -+ - static inline int security_mmap_file(struct file *file, unsigned long prot, - unsigned long flags) - { -diff --git a/security/security.c b/security/security.c -index dcb3e7014f9b..266cec94369b 100644 ---- a/security/security.c -+++ b/security/security.c -@@ -2648,6 +2648,24 @@ int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - } - EXPORT_SYMBOL_GPL(security_file_ioctl); - -+/** -+ * security_file_ioctl_compat() - Check if an ioctl is allowed in compat mode -+ * @file: associated file -+ * @cmd: ioctl cmd -+ * @arg: ioctl arguments -+ * -+ * Compat version of security_file_ioctl() that correctly handles 32-bit -+ * processes running on 64-bit kernels. -+ * -+ * Return: Returns 0 if permission is granted. -+ */ -+int security_file_ioctl_compat(struct file *file, unsigned int cmd, -+ unsigned long arg) -+{ -+ return call_int_hook(file_ioctl_compat, 0, file, cmd, arg); -+} -+EXPORT_SYMBOL_GPL(security_file_ioctl_compat); -+ - static inline unsigned long mmap_prot(struct file *file, unsigned long prot) - { - /* -diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index 0fb890bd72cb..102a1f0c09e0 100644 ---- a/security/selinux/hooks.c -+++ b/security/selinux/hooks.c -@@ -3725,6 +3725,33 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd, - return error; - } - -+static int selinux_file_ioctl_compat(struct file *file, unsigned int cmd, -+ unsigned long arg) -+{ -+ /* -+ * If we are in a 64-bit kernel running 32-bit userspace, we need to -+ * make sure we don't compare 32-bit flags to 64-bit flags. -+ */ -+ switch (cmd) { -+ case FS_IOC32_GETFLAGS: -+ cmd = FS_IOC_GETFLAGS; -+ break; -+ case FS_IOC32_SETFLAGS: -+ cmd = FS_IOC_SETFLAGS; -+ break; -+ case FS_IOC32_GETVERSION: -+ cmd = FS_IOC_GETVERSION; -+ break; -+ case FS_IOC32_SETVERSION: -+ cmd = FS_IOC_SETVERSION; -+ break; -+ default: -+ break; -+ } -+ -+ return selinux_file_ioctl(file, cmd, arg); -+} -+ - static int default_noexec __ro_after_init; - - static int file_map_prot_check(struct file *file, unsigned long prot, int shared) -@@ -7037,6 +7064,7 @@ static struct security_hook_list selinux_hooks[] __ro_after_init = { - LSM_HOOK_INIT(file_permission, selinux_file_permission), - LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security), - LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl), -+ LSM_HOOK_INIT(file_ioctl_compat, selinux_file_ioctl_compat), - LSM_HOOK_INIT(mmap_file, selinux_mmap_file), - LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr), - LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect), -diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c -index 65130a791f57..1f1ea8529421 100644 ---- a/security/smack/smack_lsm.c -+++ b/security/smack/smack_lsm.c -@@ -4973,6 +4973,7 @@ static struct security_hook_list smack_hooks[] __ro_after_init = { - - LSM_HOOK_INIT(file_alloc_security, smack_file_alloc_security), - LSM_HOOK_INIT(file_ioctl, smack_file_ioctl), -+ LSM_HOOK_INIT(file_ioctl_compat, smack_file_ioctl), - LSM_HOOK_INIT(file_lock, smack_file_lock), - LSM_HOOK_INIT(file_fcntl, smack_file_fcntl), - LSM_HOOK_INIT(mmap_file, smack_mmap_file), -diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c -index 255f1b470295..1bf4b3da9cbc 100644 ---- a/security/tomoyo/tomoyo.c -+++ b/security/tomoyo/tomoyo.c -@@ -568,6 +568,7 @@ static struct security_hook_list tomoyo_hooks[] __ro_after_init = { - LSM_HOOK_INIT(path_rename, tomoyo_path_rename), - LSM_HOOK_INIT(inode_getattr, tomoyo_inode_getattr), - LSM_HOOK_INIT(file_ioctl, tomoyo_file_ioctl), -+ LSM_HOOK_INIT(file_ioctl_compat, tomoyo_file_ioctl), - LSM_HOOK_INIT(path_chmod, tomoyo_path_chmod), - LSM_HOOK_INIT(path_chown, tomoyo_path_chown), - LSM_HOOK_INIT(path_chroot, tomoyo_path_chroot), --- -2.43.2 - -From 4ecf1864f2076872b7aea29d463e785ef6fc9909 Mon Sep 17 00:00:00 2001 -From: Jordan Rife <jrife@google.com> -Date: Mon, 6 Nov 2023 15:24:38 -0600 -Subject: [PATCH 0763/1501] dlm: use kernel_connect() and kernel_bind() -Content-Length: 2769 -Lines: 71 - -commit e9cdebbe23f1aa9a1caea169862f479ab3fa2773 upstream. - -Recent changes to kernel_connect() and kernel_bind() ensure that -callers are insulated from changes to the address parameter made by BPF -SOCK_ADDR hooks. This patch wraps direct calls to ops->connect() and -ops->bind() with kernel_connect() and kernel_bind() to protect callers -in such cases. - -Link: https://lore.kernel.org/netdev/9944248dba1bce861375fcce9de663934d933ba9.camel@redhat.com/ -Fixes: d74bad4e74ee ("bpf: Hooks for sys_connect") -Fixes: 4fbac77d2d09 ("bpf: Hooks for sys_bind") -Cc: stable@vger.kernel.org -Signed-off-by: Jordan Rife <jrife@google.com> -Signed-off-by: David Teigland <teigland@redhat.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/dlm/lowcomms.c | 14 +++++++------- - 1 file changed, 7 insertions(+), 7 deletions(-) - -diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c -index 67f8dd8a05ef..6296c62c10fa 100644 ---- a/fs/dlm/lowcomms.c -+++ b/fs/dlm/lowcomms.c -@@ -1817,8 +1817,8 @@ static int dlm_tcp_bind(struct socket *sock) - memcpy(&src_addr, &dlm_local_addr[0], sizeof(src_addr)); - make_sockaddr(&src_addr, 0, &addr_len); - -- result = sock->ops->bind(sock, (struct sockaddr *)&src_addr, -- addr_len); -+ result = kernel_bind(sock, (struct sockaddr *)&src_addr, -+ addr_len); - if (result < 0) { - /* This *may* not indicate a critical error */ - log_print("could not bind for connect: %d", result); -@@ -1830,7 +1830,7 @@ static int dlm_tcp_bind(struct socket *sock) - static int dlm_tcp_connect(struct connection *con, struct socket *sock, - struct sockaddr *addr, int addr_len) - { -- return sock->ops->connect(sock, addr, addr_len, O_NONBLOCK); -+ return kernel_connect(sock, addr, addr_len, O_NONBLOCK); - } - - static int dlm_tcp_listen_validate(void) -@@ -1862,8 +1862,8 @@ static int dlm_tcp_listen_bind(struct socket *sock) - - /* Bind to our port */ - make_sockaddr(&dlm_local_addr[0], dlm_config.ci_tcp_port, &addr_len); -- return sock->ops->bind(sock, (struct sockaddr *)&dlm_local_addr[0], -- addr_len); -+ return kernel_bind(sock, (struct sockaddr *)&dlm_local_addr[0], -+ addr_len); - } - - static const struct dlm_proto_ops dlm_tcp_ops = { -@@ -1888,12 +1888,12 @@ static int dlm_sctp_connect(struct connection *con, struct socket *sock, - int ret; - - /* -- * Make sock->ops->connect() function return in specified time, -+ * Make kernel_connect() function return in specified time, - * since O_NONBLOCK argument in connect() function does not work here, - * then, we should restore the default value of this attribute. - */ - sock_set_sndtimeo(sock->sk, 5); -- ret = sock->ops->connect(sock, addr, addr_len, 0); -+ ret = kernel_connect(sock, addr, addr_len, 0); - sock_set_sndtimeo(sock->sk, 0); - return ret; - } --- -2.43.2 - -From 78d757c607225a43e583edffdac3fdf3f5ee922e Mon Sep 17 00:00:00 2001 -From: Vegard Nossum <vegard.nossum@oracle.com> -Date: Mon, 1 Jan 2024 00:59:59 +0100 -Subject: [PATCH 0764/1501] docs: kernel_abi.py: fix command injection -Content-Length: 5783 -Lines: 155 - -commit 3231dd5862779c2e15633c96133a53205ad660ce upstream. - -The kernel-abi directive passes its argument straight to the shell. -This is unfortunate and unnecessary. - -Let's always use paths relative to $srctree/Documentation/ and use -subprocess.check_call() instead of subprocess.Popen(shell=True). - -This also makes the code shorter. - -Link: https://fosstodon.org/@jani/111676532203641247 -Reported-by: Jani Nikula <jani.nikula@intel.com> -Cc: stable@vger.kernel.org -Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com> -Signed-off-by: Jonathan Corbet <corbet@lwn.net> -Link: https://lore.kernel.org/r/20231231235959.3342928-2-vegard.nossum@oracle.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - Documentation/admin-guide/abi-obsolete.rst | 2 +- - Documentation/admin-guide/abi-removed.rst | 2 +- - Documentation/admin-guide/abi-stable.rst | 2 +- - Documentation/admin-guide/abi-testing.rst | 2 +- - Documentation/sphinx/kernel_abi.py | 56 ++++------------------ - 5 files changed, 14 insertions(+), 50 deletions(-) - -diff --git a/Documentation/admin-guide/abi-obsolete.rst b/Documentation/admin-guide/abi-obsolete.rst -index d095867899c5..594e697aa1b2 100644 ---- a/Documentation/admin-guide/abi-obsolete.rst -+++ b/Documentation/admin-guide/abi-obsolete.rst -@@ -7,5 +7,5 @@ marked to be removed at some later point in time. - The description of the interface will document the reason why it is - obsolete and when it can be expected to be removed. - --.. kernel-abi:: $srctree/Documentation/ABI/obsolete -+.. kernel-abi:: ABI/obsolete - :rst: -diff --git a/Documentation/admin-guide/abi-removed.rst b/Documentation/admin-guide/abi-removed.rst -index f7e9e43023c1..f9e000c81828 100644 ---- a/Documentation/admin-guide/abi-removed.rst -+++ b/Documentation/admin-guide/abi-removed.rst -@@ -1,5 +1,5 @@ - ABI removed symbols - =================== - --.. kernel-abi:: $srctree/Documentation/ABI/removed -+.. kernel-abi:: ABI/removed - :rst: -diff --git a/Documentation/admin-guide/abi-stable.rst b/Documentation/admin-guide/abi-stable.rst -index 70490736e0d3..fc3361d847b1 100644 ---- a/Documentation/admin-guide/abi-stable.rst -+++ b/Documentation/admin-guide/abi-stable.rst -@@ -10,5 +10,5 @@ for at least 2 years. - Most interfaces (like syscalls) are expected to never change and always - be available. - --.. kernel-abi:: $srctree/Documentation/ABI/stable -+.. kernel-abi:: ABI/stable - :rst: -diff --git a/Documentation/admin-guide/abi-testing.rst b/Documentation/admin-guide/abi-testing.rst -index b205b16a72d0..19767926b344 100644 ---- a/Documentation/admin-guide/abi-testing.rst -+++ b/Documentation/admin-guide/abi-testing.rst -@@ -16,5 +16,5 @@ Programs that use these interfaces are strongly encouraged to add their - name to the description of these interfaces, so that the kernel - developers can easily notify them if any changes occur. - --.. kernel-abi:: $srctree/Documentation/ABI/testing -+.. kernel-abi:: ABI/testing - :rst: -diff --git a/Documentation/sphinx/kernel_abi.py b/Documentation/sphinx/kernel_abi.py -index 49797c55479c..5911bd0d7965 100644 ---- a/Documentation/sphinx/kernel_abi.py -+++ b/Documentation/sphinx/kernel_abi.py -@@ -39,8 +39,6 @@ import sys - import re - import kernellog - --from os import path -- - from docutils import nodes, statemachine - from docutils.statemachine import ViewList - from docutils.parsers.rst import directives, Directive -@@ -73,60 +71,26 @@ class KernelCmd(Directive): - } - - def run(self): -- - doc = self.state.document - if not doc.settings.file_insertion_enabled: - raise self.warning("docutils: file insertion disabled") - -- env = doc.settings.env -- cwd = path.dirname(doc.current_source) -- cmd = "get_abi.pl rest --enable-lineno --dir " -- cmd += self.arguments[0] -+ srctree = os.path.abspath(os.environ["srctree"]) -+ -+ args = [ -+ os.path.join(srctree, 'scripts/get_abi.pl'), -+ 'rest', -+ '--enable-lineno', -+ '--dir', os.path.join(srctree, 'Documentation', self.arguments[0]), -+ ] - - if 'rst' in self.options: -- cmd += " --rst-source" -+ args.append('--rst-source') - -- srctree = path.abspath(os.environ["srctree"]) -- -- fname = cmd -- -- # extend PATH with $(srctree)/scripts -- path_env = os.pathsep.join([ -- srctree + os.sep + "scripts", -- os.environ["PATH"] -- ]) -- shell_env = os.environ.copy() -- shell_env["PATH"] = path_env -- shell_env["srctree"] = srctree -- -- lines = self.runCmd(cmd, shell=True, cwd=cwd, env=shell_env) -+ lines = subprocess.check_output(args, cwd=os.path.dirname(doc.current_source)).decode('utf-8') - nodeList = self.nestedParse(lines, self.arguments[0]) - return nodeList - -- def runCmd(self, cmd, **kwargs): -- u"""Run command ``cmd`` and return its stdout as unicode.""" -- -- try: -- proc = subprocess.Popen( -- cmd -- , stdout = subprocess.PIPE -- , stderr = subprocess.PIPE -- , **kwargs -- ) -- out, err = proc.communicate() -- -- out, err = codecs.decode(out, 'utf-8'), codecs.decode(err, 'utf-8') -- -- if proc.returncode != 0: -- raise self.severe( -- u"command '%s' failed with return code %d" -- % (cmd, proc.returncode) -- ) -- except OSError as exc: -- raise self.severe(u"problems with '%s' directive: %s." -- % (self.name, ErrorString(exc))) -- return out -- - def nestedParse(self, lines, fname): - env = self.state.document.settings.env - content = ViewList() --- -2.43.2 - -From fd956ce66beb7eba60aad707d9b36e583e24878c Mon Sep 17 00:00:00 2001 -From: Vegard Nossum <vegard.nossum@oracle.com> -Date: Mon, 1 Jan 2024 00:59:58 +0100 -Subject: [PATCH 0765/1501] scripts/get_abi: fix source path leak -Content-Length: 1236 -Lines: 37 - -commit 5889d6ede53bc17252f79c142387e007224aa554 upstream. - -The code currently leaks the absolute path of the ABI files into the -rendered documentation. - -There exists code to prevent this, but it is not effective when an -absolute path is passed, which it is when $srctree is used. - -I consider this to be a minimal, stop-gap fix; a better fix would strip -off the actual prefix instead of hacking it off with a regex. - -Link: https://mastodon.social/@vegard/111677490643495163 -Cc: Jani Nikula <jani.nikula@intel.com> -Cc: stable@vger.kernel.org -Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com> -Signed-off-by: Jonathan Corbet <corbet@lwn.net> -Link: https://lore.kernel.org/r/20231231235959.3342928-1-vegard.nossum@oracle.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - scripts/get_abi.pl | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/scripts/get_abi.pl b/scripts/get_abi.pl -index 0ffd5531242a..408bfd0216da 100755 ---- a/scripts/get_abi.pl -+++ b/scripts/get_abi.pl -@@ -98,7 +98,7 @@ sub parse_abi { - $name =~ s,.*/,,; - - my $fn = $file; -- $fn =~ s,Documentation/ABI/,,; -+ $fn =~ s,.*Documentation/ABI/,,; - - my $nametag = "File $fn"; - $data{$nametag}->{what} = "File $name"; --- -2.43.2 - -From f7013649c5423b419e16fb4c0828c4962e34abe1 Mon Sep 17 00:00:00 2001 -From: Michael Grzeschik <m.grzeschik@pengutronix.de> -Date: Thu, 23 Nov 2023 23:32:05 +0100 -Subject: [PATCH 0766/1501] media: videobuf2-dma-sg: fix vmap callback -Content-Length: 1444 -Lines: 41 - -commit 608ca5a60ee47b48fec210aeb7a795a64eb5dcee upstream. - -For dmabuf import users to be able to use the vaddr from another -videobuf2-dma-sg source, the exporter needs to set a proper vaddr on -vb2_dma_sg_dmabuf_ops_vmap callback. This patch adds vmap on map if -buf->vaddr was not set. - -Cc: stable@kernel.org -Fixes: 7938f4218168 ("dma-buf-map: Rename to iosys-map") -Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> -Acked-by: Tomasz Figa <tfiga@chromium.org> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/media/common/videobuf2/videobuf2-dma-sg.c | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - -diff --git a/drivers/media/common/videobuf2/videobuf2-dma-sg.c b/drivers/media/common/videobuf2/videobuf2-dma-sg.c -index 28f3fdfe23a2..6975a71d740f 100644 ---- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c -+++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c -@@ -487,9 +487,15 @@ vb2_dma_sg_dmabuf_ops_end_cpu_access(struct dma_buf *dbuf, - static int vb2_dma_sg_dmabuf_ops_vmap(struct dma_buf *dbuf, - struct iosys_map *map) - { -- struct vb2_dma_sg_buf *buf = dbuf->priv; -+ struct vb2_dma_sg_buf *buf; -+ void *vaddr; - -- iosys_map_set_vaddr(map, buf->vaddr); -+ buf = dbuf->priv; -+ vaddr = vb2_dma_sg_vaddr(buf->vb, buf); -+ if (!vaddr) -+ return -EINVAL; -+ -+ iosys_map_set_vaddr(map, vaddr); - - return 0; - } --- -2.43.2 - -From eed9119f8f8e8fbf225c08abdbb58597fba807e0 Mon Sep 17 00:00:00 2001 -From: Avri Altman <avri.altman@wdc.com> -Date: Wed, 29 Nov 2023 11:25:35 +0200 -Subject: [PATCH 0767/1501] mmc: core: Use mrq.sbc in close-ended ffu -Content-Length: 4804 -Lines: 142 - -commit 4d0c8d0aef6355660b6775d57ccd5d4ea2e15802 upstream. - -Field Firmware Update (ffu) may use close-ended or open ended sequence. -Each such sequence is comprised of a write commands enclosed between 2 -switch commands - to and from ffu mode. So for the close-ended case, it -will be: cmd6->cmd23-cmd25-cmd6. - -Some host controllers however, get confused when multi-block rw is sent -without sbc, and may generate auto-cmd12 which breaks the ffu sequence. -I encountered this issue while testing fwupd (github.com/fwupd/fwupd) -on HP Chromebook x2, a qualcomm based QC-7c, code name - strongbad. - -Instead of a quirk, or hooking the request function of the msm ops, -it would be better to fix the ioctl handling and make it use mrq.sbc -instead of issuing SET_BLOCK_COUNT separately. - -Signed-off-by: Avri Altman <avri.altman@wdc.com> -Acked-by: Adrian Hunter <adrian.hunter@intel.com> -Cc: stable@vger.kernel.org -Link: https://lore.kernel.org/r/20231129092535.3278-1-avri.altman@wdc.com -Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/mmc/core/block.c | 46 +++++++++++++++++++++++++++++++++++++--- - 1 file changed, 43 insertions(+), 3 deletions(-) - -diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c -index 134c36edb6cf..32d49100dff5 100644 ---- a/drivers/mmc/core/block.c -+++ b/drivers/mmc/core/block.c -@@ -400,6 +400,10 @@ struct mmc_blk_ioc_data { - struct mmc_ioc_cmd ic; - unsigned char *buf; - u64 buf_bytes; -+ unsigned int flags; -+#define MMC_BLK_IOC_DROP BIT(0) /* drop this mrq */ -+#define MMC_BLK_IOC_SBC BIT(1) /* use mrq.sbc */ -+ - struct mmc_rpmb_data *rpmb; - }; - -@@ -465,7 +469,7 @@ static int mmc_blk_ioctl_copy_to_user(struct mmc_ioc_cmd __user *ic_ptr, - } - - static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, -- struct mmc_blk_ioc_data *idata) -+ struct mmc_blk_ioc_data **idatas, int i) - { - struct mmc_command cmd = {}, sbc = {}; - struct mmc_data data = {}; -@@ -475,10 +479,18 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, - unsigned int busy_timeout_ms; - int err; - unsigned int target_part; -+ struct mmc_blk_ioc_data *idata = idatas[i]; -+ struct mmc_blk_ioc_data *prev_idata = NULL; - - if (!card || !md || !idata) - return -EINVAL; - -+ if (idata->flags & MMC_BLK_IOC_DROP) -+ return 0; -+ -+ if (idata->flags & MMC_BLK_IOC_SBC) -+ prev_idata = idatas[i - 1]; -+ - /* - * The RPMB accesses comes in from the character device, so we - * need to target these explicitly. Else we just target the -@@ -532,7 +544,7 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, - return err; - } - -- if (idata->rpmb) { -+ if (idata->rpmb || prev_idata) { - sbc.opcode = MMC_SET_BLOCK_COUNT; - /* - * We don't do any blockcount validation because the max size -@@ -540,6 +552,8 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, - * 'Reliable Write' bit here. - */ - sbc.arg = data.blocks | (idata->ic.write_flag & BIT(31)); -+ if (prev_idata) -+ sbc.arg = prev_idata->ic.arg; - sbc.flags = MMC_RSP_R1 | MMC_CMD_AC; - mrq.sbc = &sbc; - } -@@ -557,6 +571,15 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, - mmc_wait_for_req(card->host, &mrq); - memcpy(&idata->ic.response, cmd.resp, sizeof(cmd.resp)); - -+ if (prev_idata) { -+ memcpy(&prev_idata->ic.response, sbc.resp, sizeof(sbc.resp)); -+ if (sbc.error) { -+ dev_err(mmc_dev(card->host), "%s: sbc error %d\n", -+ __func__, sbc.error); -+ return sbc.error; -+ } -+ } -+ - if (cmd.error) { - dev_err(mmc_dev(card->host), "%s: cmd error %d\n", - __func__, cmd.error); -@@ -1034,6 +1057,20 @@ static inline void mmc_blk_reset_success(struct mmc_blk_data *md, int type) - md->reset_done &= ~type; - } - -+static void mmc_blk_check_sbc(struct mmc_queue_req *mq_rq) -+{ -+ struct mmc_blk_ioc_data **idata = mq_rq->drv_op_data; -+ int i; -+ -+ for (i = 1; i < mq_rq->ioc_count; i++) { -+ if (idata[i - 1]->ic.opcode == MMC_SET_BLOCK_COUNT && -+ mmc_op_multi(idata[i]->ic.opcode)) { -+ idata[i - 1]->flags |= MMC_BLK_IOC_DROP; -+ idata[i]->flags |= MMC_BLK_IOC_SBC; -+ } -+ } -+} -+ - /* - * The non-block commands come back from the block layer after it queued it and - * processed it with all other requests and then they get issued in this -@@ -1061,11 +1098,14 @@ static void mmc_blk_issue_drv_op(struct mmc_queue *mq, struct request *req) - if (ret) - break; - } -+ -+ mmc_blk_check_sbc(mq_rq); -+ - fallthrough; - case MMC_DRV_OP_IOCTL_RPMB: - idata = mq_rq->drv_op_data; - for (i = 0, ret = 0; i < mq_rq->ioc_count; i++) { -- ret = __mmc_blk_ioctl_cmd(card, md, idata[i]); -+ ret = __mmc_blk_ioctl_cmd(card, md, idata, i); - if (ret) - break; - } --- -2.43.2 - -From b9ecc0494d4b62d1723be2ce1c3382852aae1546 Mon Sep 17 00:00:00 2001 -From: Alain Volmat <alain.volmat@foss.st.com> -Date: Mon, 13 Nov 2023 15:57:30 +0100 -Subject: [PATCH 0769/1501] media: i2c: st-mipid02: correct format propagation -Content-Length: 1880 -Lines: 50 - -commit b33cb0cbe2893b96ecbfa16254407153f4b55d16 upstream. - -Use a copy of the struct v4l2_subdev_format when propagating -format from the sink to source pad in order to avoid impacting the -sink format returned to the application. - -Thanks to Jacopo Mondi for pointing the issue. - -Fixes: 6c01e6f3f27b ("media: st-mipid02: Propagate format from sink to source pad") -Signed-off-by: Alain Volmat <alain.volmat@foss.st.com> -Cc: stable@vger.kernel.org -Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> -Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> -Reviewed-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com> -Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/media/i2c/st-mipid02.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - -diff --git a/drivers/media/i2c/st-mipid02.c b/drivers/media/i2c/st-mipid02.c -index fa27638edc07..dab14787116b 100644 ---- a/drivers/media/i2c/st-mipid02.c -+++ b/drivers/media/i2c/st-mipid02.c -@@ -770,6 +770,7 @@ static void mipid02_set_fmt_sink(struct v4l2_subdev *sd, - struct v4l2_subdev_format *format) - { - struct mipid02_dev *bridge = to_mipid02_dev(sd); -+ struct v4l2_subdev_format source_fmt; - struct v4l2_mbus_framefmt *fmt; - - format->format.code = get_fmt_code(format->format.code); -@@ -781,8 +782,12 @@ static void mipid02_set_fmt_sink(struct v4l2_subdev *sd, - - *fmt = format->format; - -- /* Propagate the format change to the source pad */ -- mipid02_set_fmt_source(sd, sd_state, format); -+ /* -+ * Propagate the format change to the source pad, taking -+ * care not to update the format pointer given back to user -+ */ -+ source_fmt = *format; -+ mipid02_set_fmt_source(sd, sd_state, &source_fmt); - } - - static int mipid02_set_fmt(struct v4l2_subdev *sd, --- -2.43.2 - -From a195de026417fc8f530d649ff792fdf0fbec1e30 Mon Sep 17 00:00:00 2001 -From: Zheng Wang <zyytlz.wz@163.com> -Date: Mon, 6 Nov 2023 15:48:11 +0100 -Subject: [PATCH 0770/1501] media: mtk-jpeg: Fix timeout schedule error in - mtk_jpegdec_worker. -Content-Length: 2021 -Lines: 48 - -commit 38e1857933def4b3fafc28cc34ff3bbc84cad2c3 upstream. - -In mtk_jpegdec_worker, if error occurs in mtk_jpeg_set_dec_dst, it -will start the timeout worker and invoke v4l2_m2m_job_finish at -the same time. This will break the logic of design for there should -be only one function to call v4l2_m2m_job_finish. But now the timeout -handler and mtk_jpegdec_worker will both invoke it. - -Fix it by start the worker only if mtk_jpeg_set_dec_dst successfully -finished. - -Fixes: da4ede4b7fd6 ("media: mtk-jpeg: move data/code inside CONFIG_OF blocks") -Signed-off-by: Zheng Wang <zyytlz.wz@163.com> -Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> -Cc: stable@vger.kernel.org -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c -index 60425c99a2b8..c3f706452203 100644 ---- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c -+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c -@@ -1749,9 +1749,6 @@ static void mtk_jpegdec_worker(struct work_struct *work) - v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx); - v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx); - -- schedule_delayed_work(&comp_jpeg[hw_id]->job_timeout_work, -- msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC)); -- - mtk_jpeg_set_dec_src(ctx, &src_buf->vb2_buf, &bs); - if (mtk_jpeg_set_dec_dst(ctx, - &jpeg_src_buf->dec_param, -@@ -1761,6 +1758,9 @@ static void mtk_jpegdec_worker(struct work_struct *work) - goto setdst_end; - } - -+ schedule_delayed_work(&comp_jpeg[hw_id]->job_timeout_work, -+ msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC)); -+ - spin_lock_irqsave(&comp_jpeg[hw_id]->hw_lock, flags); - ctx->total_frame_num++; - mtk_jpeg_dec_reset(comp_jpeg[hw_id]->reg_base); --- -2.43.2 - -From 6e2f37022f0fc0893da4d85a0500c9d547fffd4c Mon Sep 17 00:00:00 2001 -From: Zheng Wang <zyytlz.wz@163.com> -Date: Mon, 6 Nov 2023 15:48:10 +0100 -Subject: [PATCH 0771/1501] media: mtk-jpeg: Fix use after free bug due to - error path handling in mtk_jpeg_dec_device_run -Content-Length: 2504 -Lines: 66 - -commit 206c857dd17d4d026de85866f1b5f0969f2a109e upstream. - -In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with -mtk_jpeg_job_timeout_work. - -In mtk_jpeg_dec_device_run, if error happens in -mtk_jpeg_set_dec_dst, it will finally start the worker while -mark the job as finished by invoking v4l2_m2m_job_finish. - -There are two methods to trigger the bug. If we remove the -module, it which will call mtk_jpeg_remove to make cleanup. -The possible sequence is as follows, which will cause a -use-after-free bug. - -CPU0 CPU1 -mtk_jpeg_dec_... | - start worker | - |mtk_jpeg_job_timeout_work -mtk_jpeg_remove | - v4l2_m2m_release | - kfree(m2m_dev); | - | - | v4l2_m2m_get_curr_priv - | m2m_dev->curr_ctx //use - -If we close the file descriptor, which will call mtk_jpeg_release, -it will have a similar sequence. - -Fix this bug by starting timeout worker only if started jpegdec worker -successfully. Then v4l2_m2m_job_finish will only be called in -either mtk_jpeg_job_timeout_work or mtk_jpeg_dec_device_run. - -Fixes: b2f0d2724ba4 ("[media] vcodec: mediatek: Add Mediatek JPEG Decoder Driver") -Signed-off-by: Zheng Wang <zyytlz.wz@163.com> -Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> -Cc: stable@vger.kernel.org -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c -index c3f706452203..c3456c700c07 100644 ---- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c -+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c -@@ -1021,13 +1021,13 @@ static void mtk_jpeg_dec_device_run(void *priv) - if (ret < 0) - goto dec_end; - -- schedule_delayed_work(&jpeg->job_timeout_work, -- msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC)); -- - mtk_jpeg_set_dec_src(ctx, &src_buf->vb2_buf, &bs); - if (mtk_jpeg_set_dec_dst(ctx, &jpeg_src_buf->dec_param, &dst_buf->vb2_buf, &fb)) - goto dec_end; - -+ schedule_delayed_work(&jpeg->job_timeout_work, -+ msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC)); -+ - spin_lock_irqsave(&jpeg->hw_lock, flags); - mtk_jpeg_dec_reset(jpeg->reg_base); - mtk_jpeg_dec_set_config(jpeg->reg_base, --- -2.43.2 - -From abc8175e34a065f0e04ece3d2eb35596af02218a Mon Sep 17 00:00:00 2001 -From: Guo Ren <guoren@linux.alibaba.com> -Date: Fri, 22 Dec 2023 06:57:01 -0500 -Subject: [PATCH 0772/1501] riscv: mm: Fixup compat arch_get_mmap_end -Content-Length: 1304 -Lines: 35 - -commit 97b7ac69be2e5a683e898f5267f659fde52efdd5 upstream. - -When the task is in COMPAT mode, the arch_get_mmap_end should be 2GB, -not TASK_SIZE_64. The TASK_SIZE has contained is_compat_mode() -detection, so change the definition of STACK_TOP_MAX to TASK_SIZE -directly. - -Cc: stable@vger.kernel.org -Fixes: add2cc6b6515 ("RISC-V: mm: Restrict address space for sv39,sv48,sv57") -Signed-off-by: Guo Ren <guoren@linux.alibaba.com> -Signed-off-by: Guo Ren <guoren@kernel.org> -Reviewed-by: Leonardo Bras <leobras@redhat.com> -Reviewed-by: Charlie Jenkins <charlie@rivosinc.com> -Link: https://lore.kernel.org/r/20231222115703.2404036-3-guoren@kernel.org -Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/riscv/include/asm/processor.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/riscv/include/asm/processor.h b/arch/riscv/include/asm/processor.h -index f19f861cda54..e1944ff0757a 100644 ---- a/arch/riscv/include/asm/processor.h -+++ b/arch/riscv/include/asm/processor.h -@@ -16,7 +16,7 @@ - - #ifdef CONFIG_64BIT - #define DEFAULT_MAP_WINDOW (UL(1) << (MMAP_VA_BITS - 1)) --#define STACK_TOP_MAX TASK_SIZE_64 -+#define STACK_TOP_MAX TASK_SIZE - - #define arch_get_mmap_end(addr, len, flags) \ - ({ \ --- -2.43.2 - -From 69343951738f7a1ab1475777aa5d57a7d07cb4d5 Mon Sep 17 00:00:00 2001 -From: Guo Ren <guoren@linux.alibaba.com> -Date: Fri, 22 Dec 2023 06:57:00 -0500 -Subject: [PATCH 0773/1501] riscv: mm: Fixup compat mode boot failure -Content-Length: 1675 -Lines: 43 - -commit 5f449e245e5b0d9d63eef6c8968fbdc3a8594407 upstream. - -In COMPAT mode, the STACK_TOP is DEFAULT_MAP_WINDOW (0x80000000), but -the TASK_SIZE is 0x7fff000. When the user stack is upon 0x7fff000, it -will cause a user segment fault. Sometimes, it would cause boot -failure when the whole rootfs is rv32. - -Freeing unused kernel image (initmem) memory: 2236K -Run /sbin/init as init process -Starting init: /sbin/init exists but couldn't execute it (error -14) -Run /etc/init as init process -... - -Increase the TASK_SIZE to cover STACK_TOP. - -Cc: stable@vger.kernel.org -Fixes: add2cc6b6515 ("RISC-V: mm: Restrict address space for sv39,sv48,sv57") -Signed-off-by: Guo Ren <guoren@linux.alibaba.com> -Signed-off-by: Guo Ren <guoren@kernel.org> -Reviewed-by: Leonardo Bras <leobras@redhat.com> -Reviewed-by: Charlie Jenkins <charlie@rivosinc.com> -Link: https://lore.kernel.org/r/20231222115703.2404036-2-guoren@kernel.org -Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/riscv/include/asm/pgtable.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h -index ab00235b018f..74ffb2178f54 100644 ---- a/arch/riscv/include/asm/pgtable.h -+++ b/arch/riscv/include/asm/pgtable.h -@@ -881,7 +881,7 @@ static inline pte_t pte_swp_clear_exclusive(pte_t pte) - #define TASK_SIZE_MIN (PGDIR_SIZE_L3 * PTRS_PER_PGD / 2) - - #ifdef CONFIG_COMPAT --#define TASK_SIZE_32 (_AC(0x80000000, UL) - PAGE_SIZE) -+#define TASK_SIZE_32 (_AC(0x80000000, UL)) - #define TASK_SIZE (test_thread_flag(TIF_32BIT) ? \ - TASK_SIZE_32 : TASK_SIZE_64) - #else --- -2.43.2 - -From 625a9e25192141a101a2dc62d40c71b020df6e25 Mon Sep 17 00:00:00 2001 -From: Rob Herring <robh@kernel.org> -Date: Wed, 10 Jan 2024 11:29:20 -0600 -Subject: [PATCH 0775/1501] arm64: Rename ARM64_WORKAROUND_2966298 -Content-Length: 2885 -Lines: 84 - -commit 546b7cde9b1dd36089649101b75266564600ffe5 upstream. - -In preparation to apply ARM64_WORKAROUND_2966298 for multiple errata, -rename the kconfig and capability. No functional change. - -Cc: stable@vger.kernel.org -Signed-off-by: Rob Herring <robh@kernel.org> -Reviewed-by: Mark Rutland <mark.rutland@arm.com> -Link: https://lore.kernel.org/r/20240110-arm-errata-a510-v1-1-d02bc51aeeee@kernel.org -Signed-off-by: Will Deacon <will@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/arm64/Kconfig | 4 ++++ - arch/arm64/kernel/cpu_errata.c | 4 ++-- - arch/arm64/kernel/entry.S | 2 +- - arch/arm64/tools/cpucaps | 2 +- - 4 files changed, 8 insertions(+), 4 deletions(-) - -diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig -index 7b071a00425d..ba9f6ceddbbe 100644 ---- a/arch/arm64/Kconfig -+++ b/arch/arm64/Kconfig -@@ -1037,8 +1037,12 @@ config ARM64_ERRATUM_2645198 - - If unsure, say Y. - -+config ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD -+ bool -+ - config ARM64_ERRATUM_2966298 - bool "Cortex-A520: 2966298: workaround for speculatively executed unprivileged load" -+ select ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD - default y - help - This option adds the workaround for ARM Cortex-A520 erratum 2966298. -diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c -index e29e0fea63fb..cb5e0622168d 100644 ---- a/arch/arm64/kernel/cpu_errata.c -+++ b/arch/arm64/kernel/cpu_errata.c -@@ -713,10 +713,10 @@ const struct arm64_cpu_capabilities arm64_errata[] = { - MIDR_FIXED(MIDR_CPU_VAR_REV(1,1), BIT(25)), - }, - #endif --#ifdef CONFIG_ARM64_ERRATUM_2966298 -+#ifdef CONFIG_ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD - { - .desc = "ARM erratum 2966298", -- .capability = ARM64_WORKAROUND_2966298, -+ .capability = ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD, - /* Cortex-A520 r0p0 - r0p1 */ - ERRATA_MIDR_REV_RANGE(MIDR_CORTEX_A520, 0, 0, 1), - }, -diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S -index a6030913cd58..544ab46649f3 100644 ---- a/arch/arm64/kernel/entry.S -+++ b/arch/arm64/kernel/entry.S -@@ -428,7 +428,7 @@ alternative_else_nop_endif - ldp x28, x29, [sp, #16 * 14] - - .if \el == 0 --alternative_if ARM64_WORKAROUND_2966298 -+alternative_if ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD - tlbi vale1, xzr - dsb nsh - alternative_else_nop_endif -diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps -index b98c38288a9d..3781ad1d0b26 100644 ---- a/arch/arm64/tools/cpucaps -+++ b/arch/arm64/tools/cpucaps -@@ -84,7 +84,6 @@ WORKAROUND_2077057 - WORKAROUND_2457168 - WORKAROUND_2645198 - WORKAROUND_2658417 --WORKAROUND_2966298 - WORKAROUND_AMPERE_AC03_CPU_38 - WORKAROUND_TRBE_OVERWRITE_FILL_MODE - WORKAROUND_TSB_FLUSH_FAILURE -@@ -100,3 +99,4 @@ WORKAROUND_NVIDIA_CARMEL_CNP - WORKAROUND_QCOM_FALKOR_E1003 - WORKAROUND_REPEAT_TLBI - WORKAROUND_SPECULATIVE_AT -+WORKAROUND_SPECULATIVE_UNPRIV_LOAD --- -2.43.2 - -From 0d600ea11f4c966f156f3d73ff8f348de016d863 Mon Sep 17 00:00:00 2001 -From: Rob Herring <robh@kernel.org> -Date: Wed, 10 Jan 2024 11:29:21 -0600 -Subject: [PATCH 0776/1501] arm64: errata: Add Cortex-A510 speculative - unprivileged load workaround -Content-Length: 4149 -Lines: 101 - -commit f827bcdafa2a2ac21c91e47f587e8d0c76195409 upstream. - -Implement the workaround for ARM Cortex-A510 erratum 3117295. On an -affected Cortex-A510 core, a speculatively executed unprivileged load -might leak data from a privileged load via a cache side channel. The -issue only exists for loads within a translation regime with the same -translation (e.g. same ASID and VMID). Therefore, the issue only affects -the return to EL0. - -The erratum and workaround are the same as ARM Cortex-A520 erratum -2966298, so reuse the existing workaround. - -Cc: stable@vger.kernel.org -Signed-off-by: Rob Herring <robh@kernel.org> -Reviewed-by: Mark Rutland <mark.rutland@arm.com> -Link: https://lore.kernel.org/r/20240110-arm-errata-a510-v1-2-d02bc51aeeee@kernel.org -Signed-off-by: Will Deacon <will@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - Documentation/arch/arm64/silicon-errata.rst | 2 ++ - arch/arm64/Kconfig | 14 ++++++++++++++ - arch/arm64/kernel/cpu_errata.c | 17 +++++++++++++++-- - 3 files changed, 31 insertions(+), 2 deletions(-) - -diff --git a/Documentation/arch/arm64/silicon-errata.rst b/Documentation/arch/arm64/silicon-errata.rst -index f47f63bcf67c..7acd64c61f50 100644 ---- a/Documentation/arch/arm64/silicon-errata.rst -+++ b/Documentation/arch/arm64/silicon-errata.rst -@@ -71,6 +71,8 @@ stable kernels. - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A510 | #2658417 | ARM64_ERRATUM_2658417 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-A510 | #3117295 | ARM64_ERRATUM_3117295 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A520 | #2966298 | ARM64_ERRATUM_2966298 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A53 | #826319 | ARM64_ERRATUM_826319 | -diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig -index ba9f6ceddbbe..456e8680e16e 100644 ---- a/arch/arm64/Kconfig -+++ b/arch/arm64/Kconfig -@@ -1054,6 +1054,20 @@ config ARM64_ERRATUM_2966298 - - If unsure, say Y. - -+config ARM64_ERRATUM_3117295 -+ bool "Cortex-A510: 3117295: workaround for speculatively executed unprivileged load" -+ select ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD -+ default y -+ help -+ This option adds the workaround for ARM Cortex-A510 erratum 3117295. -+ -+ On an affected Cortex-A510 core, a speculatively executed unprivileged -+ load might leak data from a privileged level via a cache side channel. -+ -+ Work around this problem by executing a TLBI before returning to EL0. -+ -+ If unsure, say Y. -+ - config CAVIUM_ERRATUM_22375 - bool "Cavium erratum 22375, 24313" - default y -diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c -index cb5e0622168d..967c7c7a4e7d 100644 ---- a/arch/arm64/kernel/cpu_errata.c -+++ b/arch/arm64/kernel/cpu_errata.c -@@ -416,6 +416,19 @@ static struct midr_range broken_aarch32_aes[] = { - }; - #endif /* CONFIG_ARM64_WORKAROUND_TRBE_WRITE_OUT_OF_RANGE */ - -+#ifdef CONFIG_ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD -+static const struct midr_range erratum_spec_unpriv_load_list[] = { -+#ifdef CONFIG_ARM64_ERRATUM_3117295 -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A510), -+#endif -+#ifdef CONFIG_ARM64_ERRATUM_2966298 -+ /* Cortex-A520 r0p0 to r0p1 */ -+ MIDR_REV_RANGE(MIDR_CORTEX_A520, 0, 0, 1), -+#endif -+ {}, -+}; -+#endif -+ - const struct arm64_cpu_capabilities arm64_errata[] = { - #ifdef CONFIG_ARM64_WORKAROUND_CLEAN_CACHE - { -@@ -715,10 +728,10 @@ const struct arm64_cpu_capabilities arm64_errata[] = { - #endif - #ifdef CONFIG_ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD - { -- .desc = "ARM erratum 2966298", -+ .desc = "ARM errata 2966298, 3117295", - .capability = ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD, - /* Cortex-A520 r0p0 - r0p1 */ -- ERRATA_MIDR_REV_RANGE(MIDR_CORTEX_A520, 0, 0, 1), -+ ERRATA_MIDR_RANGE_LIST(erratum_spec_unpriv_load_list), - }, - #endif - #ifdef CONFIG_AMPERE_ERRATUM_AC03_CPU_38 --- -2.43.2 - -From 814af6b4e6000e574e74d92197190edf07cc3680 Mon Sep 17 00:00:00 2001 -From: Mark Brown <broonie@kernel.org> -Date: Mon, 15 Jan 2024 20:15:46 +0000 -Subject: [PATCH 0777/1501] arm64/sme: Always exit sme_alloc() early with - existing storage -Content-Length: 1445 -Lines: 39 - -commit dc7eb8755797ed41a0d1b5c0c39df3c8f401b3d9 upstream. - -When sme_alloc() is called with existing storage and we are not flushing we -will always allocate new storage, both leaking the existing storage and -corrupting the state. Fix this by separating the checks for flushing and -for existing storage as we do for SVE. - -Callers that reallocate (eg, due to changing the vector length) should -call sme_free() themselves. - -Fixes: 5d0a8d2fba50 ("arm64/ptrace: Ensure that SME is set up for target when writing SSVE state") -Signed-off-by: Mark Brown <broonie@kernel.org> -Cc: <stable@vger.kernel.org> -Link: https://lore.kernel.org/r/20240115-arm64-sme-flush-v1-1-7472bd3459b7@kernel.org -Signed-off-by: Will Deacon <will@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/arm64/kernel/fpsimd.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c -index 1559c706d32d..7363f2eb98e8 100644 ---- a/arch/arm64/kernel/fpsimd.c -+++ b/arch/arm64/kernel/fpsimd.c -@@ -1245,8 +1245,10 @@ void fpsimd_release_task(struct task_struct *dead_task) - */ - void sme_alloc(struct task_struct *task, bool flush) - { -- if (task->thread.sme_state && flush) { -- memset(task->thread.sme_state, 0, sme_state_size(task)); -+ if (task->thread.sme_state) { -+ if (flush) -+ memset(task->thread.sme_state, 0, -+ sme_state_size(task)); - return; - } - --- -2.43.2 - -From baa0aaac16432019651e0d60c41cd34a0c3c3477 Mon Sep 17 00:00:00 2001 -From: Mark Rutland <mark.rutland@arm.com> -Date: Tue, 16 Jan 2024 11:02:20 +0000 -Subject: [PATCH 0778/1501] arm64: entry: fix - ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD -Content-Length: 4447 -Lines: 131 - -commit 832dd634bd1b4e3bbe9f10b9c9ba5db6f6f2b97f upstream. - -Currently the ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD workaround isn't -quite right, as it is supposed to be applied after the last explicit -memory access, but is immediately followed by an LDR. - -The ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD workaround is used to -handle Cortex-A520 erratum 2966298 and Cortex-A510 erratum 3117295, -which are described in: - -* https://developer.arm.com/documentation/SDEN2444153/0600/?lang=en -* https://developer.arm.com/documentation/SDEN1873361/1600/?lang=en - -In both cases the workaround is described as: - -| If pagetable isolation is disabled, the context switch logic in the -| kernel can be updated to execute the following sequence on affected -| cores before exiting to EL0, and after all explicit memory accesses: -| -| 1. A non-shareable TLBI to any context and/or address, including -| unused contexts or addresses, such as a `TLBI VALE1 Xzr`. -| -| 2. A DSB NSH to guarantee completion of the TLBI. - -The important part being that the TLBI+DSB must be placed "after all -explicit memory accesses". - -Unfortunately, as-implemented, the TLBI+DSB is immediately followed by -an LDR, as we have: - -| alternative_if ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD -| tlbi vale1, xzr -| dsb nsh -| alternative_else_nop_endif -| alternative_if_not ARM64_UNMAP_KERNEL_AT_EL0 -| ldr lr, [sp, #S_LR] -| add sp, sp, #PT_REGS_SIZE // restore sp -| eret -| alternative_else_nop_endif -| -| [ ... KPTI exception return path ... ] - -This patch fixes this by reworking the logic to place the TLBI+DSB -immediately before the ERET, after all explicit memory accesses. - -The ERET is currently in a separate alternative block, and alternatives -cannot be nested. To account for this, the alternative block for -ARM64_UNMAP_KERNEL_AT_EL0 is replaced with a single alternative branch -to skip the KPTI logic, with the new shape of the logic being: - -| alternative_insn "b .L_skip_tramp_exit_\@", nop, ARM64_UNMAP_KERNEL_AT_EL0 -| [ ... KPTI exception return path ... ] -| .L_skip_tramp_exit_\@: -| -| ldr lr, [sp, #S_LR] -| add sp, sp, #PT_REGS_SIZE // restore sp -| -| alternative_if ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD -| tlbi vale1, xzr -| dsb nsh -| alternative_else_nop_endif -| eret - -The new structure means that the workaround is only applied when KPTI is -not in use; this is fine as noted in the documented implications of the -erratum: - -| Pagetable isolation between EL0 and higher level ELs prevents the -| issue from occurring. - -... and as per the workaround description quoted above, the workaround -is only necessary "If pagetable isolation is disabled". - -Fixes: 471470bc7052 ("arm64: errata: Add Cortex-A520 speculative unprivileged load workaround") -Signed-off-by: Mark Rutland <mark.rutland@arm.com> -Cc: Catalin Marinas <catalin.marinas@arm.com> -Cc: James Morse <james.morse@arm.com> -Cc: Rob Herring <robh@kernel.org> -Cc: Will Deacon <will@kernel.org> -Cc: stable@vger.kernel.org -Link: https://lore.kernel.org/r/20240116110221.420467-2-mark.rutland@arm.com -Signed-off-by: Will Deacon <will@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/arm64/kernel/entry.S | 22 +++++++++++++--------- - 1 file changed, 13 insertions(+), 9 deletions(-) - -diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S -index 544ab46649f3..7fcbee0f6c0e 100644 ---- a/arch/arm64/kernel/entry.S -+++ b/arch/arm64/kernel/entry.S -@@ -428,16 +428,9 @@ alternative_else_nop_endif - ldp x28, x29, [sp, #16 * 14] - - .if \el == 0 --alternative_if ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD -- tlbi vale1, xzr -- dsb nsh --alternative_else_nop_endif --alternative_if_not ARM64_UNMAP_KERNEL_AT_EL0 -- ldr lr, [sp, #S_LR] -- add sp, sp, #PT_REGS_SIZE // restore sp -- eret --alternative_else_nop_endif - #ifdef CONFIG_UNMAP_KERNEL_AT_EL0 -+ alternative_insn "b .L_skip_tramp_exit_\@", nop, ARM64_UNMAP_KERNEL_AT_EL0 -+ - msr far_el1, x29 - - ldr_this_cpu x30, this_cpu_vector, x29 -@@ -446,7 +439,18 @@ alternative_else_nop_endif - ldr lr, [sp, #S_LR] // restore x30 - add sp, sp, #PT_REGS_SIZE // restore sp - br x29 -+ -+.L_skip_tramp_exit_\@: - #endif -+ ldr lr, [sp, #S_LR] -+ add sp, sp, #PT_REGS_SIZE // restore sp -+ -+ /* This must be after the last explicit memory access */ -+alternative_if ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD -+ tlbi vale1, xzr -+ dsb nsh -+alternative_else_nop_endif -+ eret - .else - ldr lr, [sp, #S_LR] - add sp, sp, #PT_REGS_SIZE // restore sp --- -2.43.2 - -From dea7cc6ca45a04146b71d099316f320cbf3d636e Mon Sep 17 00:00:00 2001 -From: Mario Limonciello <mario.limonciello@amd.com> -Date: Mon, 6 Nov 2023 10:23:10 -0600 -Subject: [PATCH 0779/1501] rtc: cmos: Use ACPI alarm for non-Intel x86 systems - too -Content-Length: 2074 -Lines: 67 - -commit 3d762e21d56370a43478b55e604b4a83dd85aafc upstream. - -Intel systems > 2015 have been configured to use ACPI alarm instead -of HPET to avoid s2idle issues. - -Having HPET programmed for wakeup causes problems on AMD systems with -s2idle as well. - -One particular case is that the systemd "SuspendThenHibernate" feature -doesn't work properly on the Framework 13" AMD model. Switching to -using ACPI alarm fixes the issue. - -Adjust the quirk to apply to AMD/Hygon systems from 2021 onwards. -This matches what has been tested and is specifically to avoid potential -risk to older systems. - -Cc: <stable@vger.kernel.org> # 6.1+ -Reported-by: <alvin.zhuge@gmail.com> -Reported-by: <renzhamin@gmail.com> -Closes: https://github.com/systemd/systemd/issues/24279 -Reported-by: Kelvie Wong <kelvie@kelvie.ca> -Closes: https://community.frame.work/t/systemd-suspend-then-hibernate-wakes-up-after-5-minutes/39392 -Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> -Link: https://lore.kernel.org/r/20231106162310.85711-1-mario.limonciello@amd.com -Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/rtc/rtc-cmos.c | 18 ++++++++++++------ - 1 file changed, 12 insertions(+), 6 deletions(-) - -diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c -index 228fb2d11c70..696cfa7025de 100644 ---- a/drivers/rtc/rtc-cmos.c -+++ b/drivers/rtc/rtc-cmos.c -@@ -818,18 +818,24 @@ static void rtc_wake_off(struct device *dev) - } - - #ifdef CONFIG_X86 --/* Enable use_acpi_alarm mode for Intel platforms no earlier than 2015 */ - static void use_acpi_alarm_quirks(void) - { -- if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL) -+ switch (boot_cpu_data.x86_vendor) { -+ case X86_VENDOR_INTEL: -+ if (dmi_get_bios_year() < 2015) -+ return; -+ break; -+ case X86_VENDOR_AMD: -+ case X86_VENDOR_HYGON: -+ if (dmi_get_bios_year() < 2021) -+ return; -+ break; -+ default: - return; -- -+ } - if (!is_hpet_enabled()) - return; - -- if (dmi_get_bios_year() < 2015) -- return; -- - use_acpi_alarm = true; - } - #else --- -2.43.2 - -From e949b1642b29f9ffd32f5ac41953e4c402903c32 Mon Sep 17 00:00:00 2001 -From: Mario Limonciello <mario.limonciello@amd.com> -Date: Mon, 27 Nov 2023 23:36:51 -0600 -Subject: [PATCH 0780/1501] rtc: Adjust failure return code for - cmos_set_alarm() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1704 -Lines: 44 - -commit 1311a8f0d4b23f58bbababa13623aa40b8ad4e0c upstream. - -When mc146818_avoid_UIP() fails to return a valid value, this is because -UIP didn't clear in the timeout period. Adjust the return code in this -case to -ETIMEDOUT. - -Tested-by: Mateusz Jończyk <mat.jonczyk@o2.pl> -Reviewed-by: Mateusz Jończyk <mat.jonczyk@o2.pl> -Acked-by: Mateusz Jończyk <mat.jonczyk@o2.pl> -Cc: <stable@vger.kernel.org> -Fixes: cdedc45c579f ("rtc: cmos: avoid UIP when reading alarm time") -Fixes: cd17420ebea5 ("rtc: cmos: avoid UIP when writing alarm time") -Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> -Link: https://lore.kernel.org/r/20231128053653.101798-3-mario.limonciello@amd.com -Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/rtc/rtc-cmos.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c -index 696cfa7025de..2a1a83caf081 100644 ---- a/drivers/rtc/rtc-cmos.c -+++ b/drivers/rtc/rtc-cmos.c -@@ -292,7 +292,7 @@ static int cmos_read_alarm(struct device *dev, struct rtc_wkalrm *t) - - /* This not only a rtc_op, but also called directly */ - if (!is_valid_irq(cmos->irq)) -- return -EIO; -+ return -ETIMEDOUT; - - /* Basic alarms only support hour, minute, and seconds fields. - * Some also support day and month, for alarms up to a year in -@@ -557,7 +557,7 @@ static int cmos_set_alarm(struct device *dev, struct rtc_wkalrm *t) - * Use mc146818_avoid_UIP() to avoid this. - */ - if (!mc146818_avoid_UIP(cmos_set_alarm_callback, &p)) -- return -EIO; -+ return -ETIMEDOUT; - - cmos->alarm_expires = rtc_tm_to_time64(&t->time); - --- -2.43.2 - -From f18817875b96a89fff702fcebe23b5feee3a37b1 Mon Sep 17 00:00:00 2001 -From: Mario Limonciello <mario.limonciello@amd.com> -Date: Mon, 27 Nov 2023 23:36:50 -0600 -Subject: [PATCH 0781/1501] rtc: mc146818-lib: Adjust failure return code for - mc146818_get_time() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1484 -Lines: 38 - -commit af838635a3eb9b1bc0d98599c101ebca98f31311 upstream. - -mc146818_get_time() calls mc146818_avoid_UIP() to avoid fetching the -time while RTC update is in progress (UIP). When this fails, the return -code is -EIO, but actually there was no IO failure. - -The reason for the return from mc146818_avoid_UIP() is that the UIP -wasn't cleared in the time period. Adjust the return code to -ETIMEDOUT -to match the behavior. - -Tested-by: Mateusz Jończyk <mat.jonczyk@o2.pl> -Reviewed-by: Mateusz Jończyk <mat.jonczyk@o2.pl> -Acked-by: Mateusz Jończyk <mat.jonczyk@o2.pl> -Cc: <stable@vger.kernel.org> -Fixes: 2a61b0ac5493 ("rtc: mc146818-lib: refactor mc146818_get_time") -Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> -Link: https://lore.kernel.org/r/20231128053653.101798-2-mario.limonciello@amd.com -Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/rtc/rtc-mc146818-lib.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c -index f1c09f1db044..43a28e82674e 100644 ---- a/drivers/rtc/rtc-mc146818-lib.c -+++ b/drivers/rtc/rtc-mc146818-lib.c -@@ -138,7 +138,7 @@ int mc146818_get_time(struct rtc_time *time) - - if (!mc146818_avoid_UIP(mc146818_get_time_callback, &p)) { - memset(time, 0, sizeof(*time)); -- return -EIO; -+ return -ETIMEDOUT; - } - - if (!(p.ctrl & RTC_DM_BINARY) || RTC_ALWAYS_BCD) --- -2.43.2 - -From 0181f829da16c92dd8a910bc31d7b0aa1f98f1ed Mon Sep 17 00:00:00 2001 -From: Mario Limonciello <mario.limonciello@amd.com> -Date: Mon, 27 Nov 2023 23:36:52 -0600 -Subject: [PATCH 0782/1501] rtc: Add support for configuring the UIP timeout - for RTC reads -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 8251 -Lines: 237 - -commit 120931db07b49252aba2073096b595482d71857c upstream. - -The UIP timeout is hardcoded to 10ms for all RTC reads, but in some -contexts this might not be enough time. Add a timeout parameter to -mc146818_get_time() and mc146818_get_time_callback(). - -If UIP timeout is configured by caller to be >=100 ms and a call -takes this long, log a warning. - -Make all callers use 10ms to ensure no functional changes. - -Cc: <stable@vger.kernel.org> # 6.1.y -Fixes: ec5895c0f2d8 ("rtc: mc146818-lib: extract mc146818_avoid_UIP") -Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> -Tested-by: Mateusz Jończyk <mat.jonczyk@o2.pl> -Reviewed-by: Mateusz Jończyk <mat.jonczyk@o2.pl> -Acked-by: Mateusz Jończyk <mat.jonczyk@o2.pl> -Link: https://lore.kernel.org/r/20231128053653.101798-4-mario.limonciello@amd.com -Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/alpha/kernel/rtc.c | 2 +- - arch/x86/kernel/hpet.c | 2 +- - arch/x86/kernel/rtc.c | 2 +- - drivers/base/power/trace.c | 2 +- - drivers/rtc/rtc-cmos.c | 6 +++--- - drivers/rtc/rtc-mc146818-lib.c | 37 ++++++++++++++++++++++++++-------- - include/linux/mc146818rtc.h | 3 ++- - 7 files changed, 38 insertions(+), 16 deletions(-) - -diff --git a/arch/alpha/kernel/rtc.c b/arch/alpha/kernel/rtc.c -index fb3025396ac9..cfdf90bc8b3f 100644 ---- a/arch/alpha/kernel/rtc.c -+++ b/arch/alpha/kernel/rtc.c -@@ -80,7 +80,7 @@ init_rtc_epoch(void) - static int - alpha_rtc_read_time(struct device *dev, struct rtc_time *tm) - { -- int ret = mc146818_get_time(tm); -+ int ret = mc146818_get_time(tm, 10); - - if (ret < 0) { - dev_err_ratelimited(dev, "unable to read current time\n"); -diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c -index 41eecf180b7f..17adad4cbe78 100644 ---- a/arch/x86/kernel/hpet.c -+++ b/arch/x86/kernel/hpet.c -@@ -1438,7 +1438,7 @@ irqreturn_t hpet_rtc_interrupt(int irq, void *dev_id) - memset(&curr_time, 0, sizeof(struct rtc_time)); - - if (hpet_rtc_flags & (RTC_UIE | RTC_AIE)) { -- if (unlikely(mc146818_get_time(&curr_time) < 0)) { -+ if (unlikely(mc146818_get_time(&curr_time, 10) < 0)) { - pr_err_ratelimited("unable to read current time from RTC\n"); - return IRQ_HANDLED; - } -diff --git a/arch/x86/kernel/rtc.c b/arch/x86/kernel/rtc.c -index 1309b9b05338..961ebc7f1872 100644 ---- a/arch/x86/kernel/rtc.c -+++ b/arch/x86/kernel/rtc.c -@@ -67,7 +67,7 @@ void mach_get_cmos_time(struct timespec64 *now) - return; - } - -- if (mc146818_get_time(&tm)) { -+ if (mc146818_get_time(&tm, 10)) { - pr_err("Unable to read current time from RTC\n"); - now->tv_sec = now->tv_nsec = 0; - return; -diff --git a/drivers/base/power/trace.c b/drivers/base/power/trace.c -index 72b7a92337b1..c2e925357474 100644 ---- a/drivers/base/power/trace.c -+++ b/drivers/base/power/trace.c -@@ -120,7 +120,7 @@ static unsigned int read_magic_time(void) - struct rtc_time time; - unsigned int val; - -- if (mc146818_get_time(&time) < 0) { -+ if (mc146818_get_time(&time, 10) < 0) { - pr_err("Unable to read current time from RTC\n"); - return 0; - } -diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c -index 2a1a83caf081..468ccd99f218 100644 ---- a/drivers/rtc/rtc-cmos.c -+++ b/drivers/rtc/rtc-cmos.c -@@ -231,7 +231,7 @@ static int cmos_read_time(struct device *dev, struct rtc_time *t) - if (!pm_trace_rtc_valid()) - return -EIO; - -- ret = mc146818_get_time(t); -+ ret = mc146818_get_time(t, 10); - if (ret < 0) { - dev_err_ratelimited(dev, "unable to read current time\n"); - return ret; -@@ -307,7 +307,7 @@ static int cmos_read_alarm(struct device *dev, struct rtc_wkalrm *t) - * - * Use the mc146818_avoid_UIP() function to avoid this. - */ -- if (!mc146818_avoid_UIP(cmos_read_alarm_callback, &p)) -+ if (!mc146818_avoid_UIP(cmos_read_alarm_callback, 10, &p)) - return -EIO; - - if (!(p.rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD) { -@@ -556,7 +556,7 @@ static int cmos_set_alarm(struct device *dev, struct rtc_wkalrm *t) - * - * Use mc146818_avoid_UIP() to avoid this. - */ -- if (!mc146818_avoid_UIP(cmos_set_alarm_callback, &p)) -+ if (!mc146818_avoid_UIP(cmos_set_alarm_callback, 10, &p)) - return -ETIMEDOUT; - - cmos->alarm_expires = rtc_tm_to_time64(&t->time); -diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c -index 43a28e82674e..4c17b3cef11e 100644 ---- a/drivers/rtc/rtc-mc146818-lib.c -+++ b/drivers/rtc/rtc-mc146818-lib.c -@@ -8,26 +8,31 @@ - #include <linux/acpi.h> - #endif - -+#define UIP_RECHECK_DELAY 100 /* usec */ -+#define UIP_RECHECK_DELAY_MS (USEC_PER_MSEC / UIP_RECHECK_DELAY) -+#define UIP_RECHECK_LOOPS_MS(x) (x / UIP_RECHECK_DELAY_MS) -+ - /* - * Execute a function while the UIP (Update-in-progress) bit of the RTC is -- * unset. -+ * unset. The timeout is configurable by the caller in ms. - * - * Warning: callback may be executed more then once. - */ - bool mc146818_avoid_UIP(void (*callback)(unsigned char seconds, void *param), -+ int timeout, - void *param) - { - int i; - unsigned long flags; - unsigned char seconds; - -- for (i = 0; i < 100; i++) { -+ for (i = 0; UIP_RECHECK_LOOPS_MS(i) < timeout; i++) { - spin_lock_irqsave(&rtc_lock, flags); - - /* - * Check whether there is an update in progress during which the - * readout is unspecified. The maximum update time is ~2ms. Poll -- * every 100 usec for completion. -+ * for completion. - * - * Store the second value before checking UIP so a long lasting - * NMI which happens to hit after the UIP check cannot make -@@ -37,7 +42,7 @@ bool mc146818_avoid_UIP(void (*callback)(unsigned char seconds, void *param), - - if (CMOS_READ(RTC_FREQ_SELECT) & RTC_UIP) { - spin_unlock_irqrestore(&rtc_lock, flags); -- udelay(100); -+ udelay(UIP_RECHECK_DELAY); - continue; - } - -@@ -56,7 +61,7 @@ bool mc146818_avoid_UIP(void (*callback)(unsigned char seconds, void *param), - */ - if (CMOS_READ(RTC_FREQ_SELECT) & RTC_UIP) { - spin_unlock_irqrestore(&rtc_lock, flags); -- udelay(100); -+ udelay(UIP_RECHECK_DELAY); - continue; - } - -@@ -72,6 +77,10 @@ bool mc146818_avoid_UIP(void (*callback)(unsigned char seconds, void *param), - } - spin_unlock_irqrestore(&rtc_lock, flags); - -+ if (UIP_RECHECK_LOOPS_MS(i) >= 100) -+ pr_warn("Reading current time from RTC took around %li ms\n", -+ UIP_RECHECK_LOOPS_MS(i)); -+ - return true; - } - return false; -@@ -84,7 +93,7 @@ EXPORT_SYMBOL_GPL(mc146818_avoid_UIP); - */ - bool mc146818_does_rtc_work(void) - { -- return mc146818_avoid_UIP(NULL, NULL); -+ return mc146818_avoid_UIP(NULL, 10, NULL); - } - EXPORT_SYMBOL_GPL(mc146818_does_rtc_work); - -@@ -130,13 +139,25 @@ static void mc146818_get_time_callback(unsigned char seconds, void *param_in) - p->ctrl = CMOS_READ(RTC_CONTROL); - } - --int mc146818_get_time(struct rtc_time *time) -+/** -+ * mc146818_get_time - Get the current time from the RTC -+ * @time: pointer to struct rtc_time to store the current time -+ * @timeout: timeout value in ms -+ * -+ * This function reads the current time from the RTC and stores it in the -+ * provided struct rtc_time. The timeout parameter specifies the maximum -+ * time to wait for the RTC to become ready. -+ * -+ * Return: 0 on success, -ETIMEDOUT if the RTC did not become ready within -+ * the specified timeout, or another error code if an error occurred. -+ */ -+int mc146818_get_time(struct rtc_time *time, int timeout) - { - struct mc146818_get_time_callback_param p = { - .time = time - }; - -- if (!mc146818_avoid_UIP(mc146818_get_time_callback, &p)) { -+ if (!mc146818_avoid_UIP(mc146818_get_time_callback, timeout, &p)) { - memset(time, 0, sizeof(*time)); - return -ETIMEDOUT; - } -diff --git a/include/linux/mc146818rtc.h b/include/linux/mc146818rtc.h -index b0da04fe087b..34dfcc77f505 100644 ---- a/include/linux/mc146818rtc.h -+++ b/include/linux/mc146818rtc.h -@@ -126,10 +126,11 @@ struct cmos_rtc_board_info { - #endif /* ARCH_RTC_LOCATION */ - - bool mc146818_does_rtc_work(void); --int mc146818_get_time(struct rtc_time *time); -+int mc146818_get_time(struct rtc_time *time, int timeout); - int mc146818_set_time(struct rtc_time *time); - - bool mc146818_avoid_UIP(void (*callback)(unsigned char seconds, void *param), -+ int timeout, - void *param); - - #endif /* _MC146818RTC_H */ --- -2.43.2 - -From 3d049da3f1de6d1033b0e91164ad8eb82d5c6027 Mon Sep 17 00:00:00 2001 -From: Mario Limonciello <mario.limonciello@amd.com> -Date: Mon, 27 Nov 2023 23:36:53 -0600 -Subject: [PATCH 0783/1501] rtc: Extend timeout for waiting for UIP to clear to - 1s -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 3067 -Lines: 85 - -commit cef9ecc8e938dd48a560f7dd9be1246359248d20 upstream. - -Specs don't say anything about UIP being cleared within 10ms. They -only say that UIP won't occur for another 244uS. If a long NMI occurs -while UIP is still updating it might not be possible to get valid -data in 10ms. - -This has been observed in the wild that around s2idle some calls can -take up to 480ms before UIP is clear. - -Adjust callers from outside an interrupt context to wait for up to a -1s instead of 10ms. - -Cc: <stable@vger.kernel.org> # 6.1.y -Fixes: ec5895c0f2d8 ("rtc: mc146818-lib: extract mc146818_avoid_UIP") -Reported-by: Carsten Hatger <xmb8dsv4@gmail.com> -Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217626 -Tested-by: Mateusz Jończyk <mat.jonczyk@o2.pl> -Reviewed-by: Mateusz Jończyk <mat.jonczyk@o2.pl> -Acked-by: Mateusz Jończyk <mat.jonczyk@o2.pl> -Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> -Link: https://lore.kernel.org/r/20231128053653.101798-5-mario.limonciello@amd.com -Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/x86/kernel/rtc.c | 2 +- - drivers/base/power/trace.c | 2 +- - drivers/rtc/rtc-cmos.c | 2 +- - drivers/rtc/rtc-mc146818-lib.c | 2 +- - 4 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/arch/x86/kernel/rtc.c b/arch/x86/kernel/rtc.c -index 961ebc7f1872..2e7066980f3e 100644 ---- a/arch/x86/kernel/rtc.c -+++ b/arch/x86/kernel/rtc.c -@@ -67,7 +67,7 @@ void mach_get_cmos_time(struct timespec64 *now) - return; - } - -- if (mc146818_get_time(&tm, 10)) { -+ if (mc146818_get_time(&tm, 1000)) { - pr_err("Unable to read current time from RTC\n"); - now->tv_sec = now->tv_nsec = 0; - return; -diff --git a/drivers/base/power/trace.c b/drivers/base/power/trace.c -index c2e925357474..cd6e559648b2 100644 ---- a/drivers/base/power/trace.c -+++ b/drivers/base/power/trace.c -@@ -120,7 +120,7 @@ static unsigned int read_magic_time(void) - struct rtc_time time; - unsigned int val; - -- if (mc146818_get_time(&time, 10) < 0) { -+ if (mc146818_get_time(&time, 1000) < 0) { - pr_err("Unable to read current time from RTC\n"); - return 0; - } -diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c -index 468ccd99f218..7d99cd2c37a0 100644 ---- a/drivers/rtc/rtc-cmos.c -+++ b/drivers/rtc/rtc-cmos.c -@@ -231,7 +231,7 @@ static int cmos_read_time(struct device *dev, struct rtc_time *t) - if (!pm_trace_rtc_valid()) - return -EIO; - -- ret = mc146818_get_time(t, 10); -+ ret = mc146818_get_time(t, 1000); - if (ret < 0) { - dev_err_ratelimited(dev, "unable to read current time\n"); - return ret; -diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c -index 4c17b3cef11e..651bf3c279c7 100644 ---- a/drivers/rtc/rtc-mc146818-lib.c -+++ b/drivers/rtc/rtc-mc146818-lib.c -@@ -93,7 +93,7 @@ EXPORT_SYMBOL_GPL(mc146818_avoid_UIP); - */ - bool mc146818_does_rtc_work(void) - { -- return mc146818_avoid_UIP(NULL, 10, NULL); -+ return mc146818_avoid_UIP(NULL, 1000, NULL); - } - EXPORT_SYMBOL_GPL(mc146818_does_rtc_work); - --- -2.43.2 - -From e3d4454f7c004ff3eef2fb9c4896b7bef830d647 Mon Sep 17 00:00:00 2001 -From: Dave Airlie <airlied@redhat.com> -Date: Thu, 18 Jan 2024 06:19:57 +1000 -Subject: [PATCH 0784/1501] nouveau/vmm: don't set addr on the fail path to - avoid warning -Content-Length: 5376 -Lines: 77 - -commit cacea81390fd8c8c85404e5eb2adeb83d87a912e upstream. - -nvif_vmm_put gets called if addr is set, but if the allocation -fails we don't need to call put, otherwise we get a warning like - -[523232.435671] ------------[ cut here ]------------ -[523232.435674] WARNING: CPU: 8 PID: 1505697 at drivers/gpu/drm/nouveau/nvif/vmm.c:68 nvif_vmm_put+0x72/0x80 [nouveau] -[523232.435795] Modules linked in: uinput rfcomm snd_seq_dummy snd_hrtimer nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables nfnetlink qrtr bnep sunrpc binfmt_misc intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common isst_if_common iwlmvm nfit libnvdimm vfat fat x86_pkg_temp_thermal intel_powerclamp mac80211 snd_soc_avs snd_soc_hda_codec coretemp snd_hda_ext_core snd_soc_core snd_hda_codec_realtek kvm_intel snd_hda_codec_hdmi snd_compress snd_hda_codec_generic ac97_bus snd_pcm_dmaengine snd_hda_intel libarc4 snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec kvm iwlwifi snd_hda_core btusb snd_hwdep btrtl snd_seq btintel irqbypass btbcm rapl snd_seq_device eeepc_wmi btmtk intel_cstate iTCO_wdt cfg80211 snd_pcm asus_wmi bluetooth intel_pmc_bxt iTCO_vendor_support snd_timer ledtrig_audio pktcdvd snd mei_me -[523232.435828] sparse_keymap intel_uncore i2c_i801 platform_profile wmi_bmof mei pcspkr ioatdma soundcore i2c_smbus rfkill idma64 dca joydev acpi_tad loop zram nouveau drm_ttm_helper ttm video drm_exec drm_gpuvm gpu_sched crct10dif_pclmul i2c_algo_bit nvme crc32_pclmul crc32c_intel drm_display_helper polyval_clmulni nvme_core polyval_generic e1000e mxm_wmi cec ghash_clmulni_intel r8169 sha512_ssse3 nvme_common wmi pinctrl_sunrisepoint uas usb_storage ip6_tables ip_tables fuse -[523232.435849] CPU: 8 PID: 1505697 Comm: gnome-shell Tainted: G W 6.6.0-rc7-nvk-uapi+ #12 -[523232.435851] Hardware name: System manufacturer System Product Name/ROG STRIX X299-E GAMING II, BIOS 1301 09/24/2021 -[523232.435852] RIP: 0010:nvif_vmm_put+0x72/0x80 [nouveau] -[523232.435934] Code: 00 00 48 89 e2 be 02 00 00 00 48 c7 04 24 00 00 00 00 48 89 44 24 08 e8 fc bf ff ff 85 -c0 75 0a 48 c7 43 08 00 00 00 00 eb b3 <0f> 0b eb f2 e8 f5 c9 b2 e6 0f 1f 44 00 00 90 90 90 90 90 90 90 90 -[523232.435936] RSP: 0018:ffffc900077ffbd8 EFLAGS: 00010282 -[523232.435937] RAX: 00000000fffffffe RBX: ffffc900077ffc00 RCX: 0000000000000010 -[523232.435938] RDX: 0000000000000010 RSI: ffffc900077ffb38 RDI: ffffc900077ffbd8 -[523232.435940] RBP: ffff888e1c4f2140 R08: 0000000000000000 R09: 0000000000000000 -[523232.435940] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888503811800 -[523232.435941] R13: ffffc900077ffca0 R14: ffff888e1c4f2140 R15: ffff88810317e1e0 -[523232.435942] FS: 00007f933a769640(0000) GS:ffff88905fa00000(0000) knlGS:0000000000000000 -[523232.435943] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -[523232.435944] CR2: 00007f930bef7000 CR3: 00000005d0322001 CR4: 00000000003706e0 -[523232.435945] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 -[523232.435946] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 -[523232.435964] Call Trace: -[523232.435965] <TASK> -[523232.435966] ? nvif_vmm_put+0x72/0x80 [nouveau] -[523232.436051] ? __warn+0x81/0x130 -[523232.436055] ? nvif_vmm_put+0x72/0x80 [nouveau] -[523232.436138] ? report_bug+0x171/0x1a0 -[523232.436142] ? handle_bug+0x3c/0x80 -[523232.436144] ? exc_invalid_op+0x17/0x70 -[523232.436145] ? asm_exc_invalid_op+0x1a/0x20 -[523232.436149] ? nvif_vmm_put+0x72/0x80 [nouveau] -[523232.436230] ? nvif_vmm_put+0x64/0x80 [nouveau] -[523232.436342] nouveau_vma_del+0x80/0xd0 [nouveau] -[523232.436506] nouveau_vma_new+0x1a0/0x210 [nouveau] -[523232.436671] nouveau_gem_object_open+0x1d0/0x1f0 [nouveau] -[523232.436835] drm_gem_handle_create_tail+0xd1/0x180 -[523232.436840] drm_prime_fd_to_handle_ioctl+0x12e/0x200 -[523232.436844] ? __pfx_drm_prime_fd_to_handle_ioctl+0x10/0x10 -[523232.436847] drm_ioctl_kernel+0xd3/0x180 -[523232.436849] drm_ioctl+0x26d/0x4b0 -[523232.436851] ? __pfx_drm_prime_fd_to_handle_ioctl+0x10/0x10 -[523232.436855] nouveau_drm_ioctl+0x5a/0xb0 [nouveau] -[523232.437032] __x64_sys_ioctl+0x94/0xd0 -[523232.437036] do_syscall_64+0x5d/0x90 -[523232.437040] ? syscall_exit_to_user_mode+0x2b/0x40 -[523232.437044] ? do_syscall_64+0x6c/0x90 -[523232.437046] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 - -Reported-by: Faith Ekstrand <faith.ekstrand@collabora.com> -Cc: stable@vger.kernel.org -Signed-off-by: Dave Airlie <airlied@redhat.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20240117213852.295565-1-airlied@gmail.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/nouveau/nouveau_vmm.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/gpu/drm/nouveau/nouveau_vmm.c b/drivers/gpu/drm/nouveau/nouveau_vmm.c -index a6602c012671..3dda885df5b2 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_vmm.c -+++ b/drivers/gpu/drm/nouveau/nouveau_vmm.c -@@ -108,6 +108,9 @@ nouveau_vma_new(struct nouveau_bo *nvbo, struct nouveau_vmm *vmm, - } else { - ret = nvif_vmm_get(&vmm->vmm, PTES, false, mem->mem.page, 0, - mem->mem.size, &tmp); -+ if (ret) -+ goto done; -+ - vma->addr = tmp.addr; - } - --- -2.43.2 - -From f66509fd27be96713a5181479d4d0bfb095da6fd Mon Sep 17 00:00:00 2001 -From: Dave Airlie <airlied@redhat.com> -Date: Wed, 10 Jan 2024 11:14:05 +1000 -Subject: [PATCH 0785/1501] nouveau/gsp: handle engines in runl without - nonstall interrupts. -Content-Length: 2606 -Lines: 67 - -commit 205e18c13545ab43cc4fe4930732b4feef551198 upstream. - -It appears on TU106 GPUs (2070), that some of the nvdec engines -are in the runlist but have no valid nonstall interrupt, nouveau -didn't handle that too well. - -This should let nouveau/gsp work on those. - -Cc: stable@vger.kernel.org # v6.7+ -Signed-off-by: Dave Airlie <airlied@redhat.com> -Link: https://lore.kernel.org/all/20240110011826.3996289-1-airlied@gmail.com/ -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c | 4 ++++ - drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c | 2 +- - drivers/gpu/drm/nouveau/nvkm/subdev/gsp/base.c | 8 ++------ - 3 files changed, 7 insertions(+), 7 deletions(-) - -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c -index c8ce7ff18713..e74493a4569e 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c -@@ -550,6 +550,10 @@ ga100_fifo_nonstall_ctor(struct nvkm_fifo *fifo) - struct nvkm_engn *engn = list_first_entry(&runl->engns, typeof(*engn), head); - - runl->nonstall.vector = engn->func->nonstall(engn); -+ -+ /* if no nonstall vector just keep going */ -+ if (runl->nonstall.vector == -1) -+ continue; - if (runl->nonstall.vector < 0) { - RUNL_ERROR(runl, "nonstall %d", runl->nonstall.vector); - return runl->nonstall.vector; -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c -index b903785056b5..3454c7d29502 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c -@@ -351,7 +351,7 @@ r535_engn_nonstall(struct nvkm_engn *engn) - int ret; - - ret = nvkm_gsp_intr_nonstall(subdev->device->gsp, subdev->type, subdev->inst); -- WARN_ON(ret < 0); -+ WARN_ON(ret == -ENOENT); - return ret; - } - -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/base.c -index 04bceaa28a19..da1bebb896f7 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/base.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/base.c -@@ -25,12 +25,8 @@ int - nvkm_gsp_intr_nonstall(struct nvkm_gsp *gsp, enum nvkm_subdev_type type, int inst) - { - for (int i = 0; i < gsp->intr_nr; i++) { -- if (gsp->intr[i].type == type && gsp->intr[i].inst == inst) { -- if (gsp->intr[i].nonstall != ~0) -- return gsp->intr[i].nonstall; -- -- return -EINVAL; -- } -+ if (gsp->intr[i].type == type && gsp->intr[i].inst == inst) -+ return gsp->intr[i].nonstall; - } - - return -ENOENT; --- -2.43.2 - -From 8afa41bb2d31d382325b1e9d875df906c821331c Mon Sep 17 00:00:00 2001 -From: Ma Wupeng <mawupeng1@huawei.com> -Date: Tue, 9 Jan 2024 12:15:36 +0800 -Subject: [PATCH 0786/1501] efi: disable mirror feature during crashkernel -Content-Length: 1342 -Lines: 44 - -commit 7ea6ec4c25294e8bc8788148ef854df92ee8dc5e upstream. - -If the system has no mirrored memory or uses crashkernel.high while -kernelcore=mirror is enabled on the command line then during crashkernel, -there will be limited mirrored memory and this usually leads to OOM. - -To solve this problem, disable the mirror feature during crashkernel. - -Link: https://lkml.kernel.org/r/20240109041536.3903042-1-mawupeng1@huawei.com -Signed-off-by: Ma Wupeng <mawupeng1@huawei.com> -Acked-by: Mike Rapoport (IBM) <rppt@kernel.org> -Cc: <stable@vger.kernel.org> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - mm/mm_init.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/mm/mm_init.c b/mm/mm_init.c -index 077bfe393b5e..513bad672708 100644 ---- a/mm/mm_init.c -+++ b/mm/mm_init.c -@@ -26,6 +26,7 @@ - #include <linux/pgtable.h> - #include <linux/swap.h> - #include <linux/cma.h> -+#include <linux/crash_dump.h> - #include "internal.h" - #include "slab.h" - #include "shuffle.h" -@@ -381,6 +382,11 @@ static void __init find_zone_movable_pfns_for_nodes(void) - goto out; - } - -+ if (is_kdump_kernel()) { -+ pr_warn("The system is under kdump, ignore kernelcore=mirror.\n"); -+ goto out; -+ } -+ - for_each_mem_region(r) { - if (memblock_is_mirror(r)) - continue; --- -2.43.2 - -From 8b745a045e885a35bfd282504870032c824294f1 Mon Sep 17 00:00:00 2001 -From: Huacai Chen <chenhuacai@loongson.cn> -Date: Fri, 29 Dec 2023 16:02:13 +0800 -Subject: [PATCH 0787/1501] kdump: defer the insertion of crashkernel resources -Content-Length: 3992 -Lines: 117 - -commit 4a693ce65b186fddc1a73621bd6f941e6e3eca21 upstream. - -In /proc/iomem, sub-regions should be inserted after their parent, -otherwise the insertion of parent resource fails. But after generic -crashkernel reservation applied, in both RISC-V and ARM64 (LoongArch will -also use generic reservation later on), crashkernel resources are inserted -before their parent, which causes the parent disappear in /proc/iomem. So -we defer the insertion of crashkernel resources to an early_initcall(). - -1, Without 'crashkernel' parameter: - - 100d0100-100d01ff : LOON0001:00 - 100d0100-100d01ff : LOON0001:00 LOON0001:00 - 100e0000-100e0bff : LOON0002:00 - 100e0000-100e0bff : LOON0002:00 LOON0002:00 - 1fe001e0-1fe001e7 : serial - 90400000-fa17ffff : System RAM - f6220000-f622ffff : Reserved - f9ee0000-f9ee3fff : Reserved - fa120000-fa17ffff : Reserved - fa190000-fe0bffff : System RAM - fa190000-fa1bffff : Reserved - fe4e0000-47fffffff : System RAM - 43c000000-441ffffff : Reserved - 47ff98000-47ffa3fff : Reserved - 47ffa4000-47ffa7fff : Reserved - 47ffa8000-47ffabfff : Reserved - 47ffac000-47ffaffff : Reserved - 47ffb0000-47ffb3fff : Reserved - -2, With 'crashkernel' parameter, before this patch: - - 100d0100-100d01ff : LOON0001:00 - 100d0100-100d01ff : LOON0001:00 LOON0001:00 - 100e0000-100e0bff : LOON0002:00 - 100e0000-100e0bff : LOON0002:00 LOON0002:00 - 1fe001e0-1fe001e7 : serial - e6200000-f61fffff : Crash kernel - fa190000-fe0bffff : System RAM - fa190000-fa1bffff : Reserved - fe4e0000-47fffffff : System RAM - 43c000000-441ffffff : Reserved - 47ff98000-47ffa3fff : Reserved - 47ffa4000-47ffa7fff : Reserved - 47ffa8000-47ffabfff : Reserved - 47ffac000-47ffaffff : Reserved - 47ffb0000-47ffb3fff : Reserved - -3, With 'crashkernel' parameter, after this patch: - - 100d0100-100d01ff : LOON0001:00 - 100d0100-100d01ff : LOON0001:00 LOON0001:00 - 100e0000-100e0bff : LOON0002:00 - 100e0000-100e0bff : LOON0002:00 LOON0002:00 - 1fe001e0-1fe001e7 : serial - 90400000-fa17ffff : System RAM - e6200000-f61fffff : Crash kernel - f6220000-f622ffff : Reserved - f9ee0000-f9ee3fff : Reserved - fa120000-fa17ffff : Reserved - fa190000-fe0bffff : System RAM - fa190000-fa1bffff : Reserved - fe4e0000-47fffffff : System RAM - 43c000000-441ffffff : Reserved - 47ff98000-47ffa3fff : Reserved - 47ffa4000-47ffa7fff : Reserved - 47ffa8000-47ffabfff : Reserved - 47ffac000-47ffaffff : Reserved - 47ffb0000-47ffb3fff : Reserved - -Link: https://lkml.kernel.org/r/20231229080213.2622204-1-chenhuacai@loongson.cn -Signed-off-by: Huacai Chen <chenhuacai@loongson.cn> -Fixes: 0ab97169aa05 ("crash_core: add generic function to do reservation") -Cc: Baoquan He <bhe@redhat.com> -Cc: Zhen Lei <thunder.leizhen@huawei.com> -Cc: <stable@vger.kernel.org> [6.6+] -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - kernel/crash_core.c | 14 ++++++++++++-- - 1 file changed, 12 insertions(+), 2 deletions(-) - -diff --git a/kernel/crash_core.c b/kernel/crash_core.c -index d4313b53837e..755d8d4ef5b0 100644 ---- a/kernel/crash_core.c -+++ b/kernel/crash_core.c -@@ -377,7 +377,6 @@ static int __init reserve_crashkernel_low(unsigned long long low_size) - - crashk_low_res.start = low_base; - crashk_low_res.end = low_base + low_size - 1; -- insert_resource(&iomem_resource, &crashk_low_res); - #endif - return 0; - } -@@ -459,8 +458,19 @@ void __init reserve_crashkernel_generic(char *cmdline, - - crashk_res.start = crash_base; - crashk_res.end = crash_base + crash_size - 1; -- insert_resource(&iomem_resource, &crashk_res); - } -+ -+static __init int insert_crashkernel_resources(void) -+{ -+ if (crashk_res.start < crashk_res.end) -+ insert_resource(&iomem_resource, &crashk_res); -+ -+ if (crashk_low_res.start < crashk_low_res.end) -+ insert_resource(&iomem_resource, &crashk_low_res); -+ -+ return 0; -+} -+early_initcall(insert_crashkernel_resources); - #endif - - int crash_prepare_elf64_headers(struct crash_mem *mem, int need_kernel_map, --- -2.43.2 - -From b499289e6338b580b27589baf346f3fecda0c887 Mon Sep 17 00:00:00 2001 -From: Zhihao Cheng <chengzhihao1@huawei.com> -Date: Fri, 22 Dec 2023 16:54:46 +0800 -Subject: [PATCH 0788/1501] ubifs: ubifs_symlink: Fix memleak of inode->i_link - in error path -Content-Length: 2097 -Lines: 53 - -commit 1e022216dcd248326a5bb95609d12a6815bca4e2 upstream. - -For error handling path in ubifs_symlink(), inode will be marked as -bad first, then iput() is invoked. If inode->i_link is initialized by -fscrypt_encrypt_symlink() in encryption scenario, inode->i_link won't -be freed by callchain ubifs_free_inode -> fscrypt_free_inode in error -handling path, because make_bad_inode() has changed 'inode->i_mode' as -'S_IFREG'. -Following kmemleak is easy to be reproduced by injecting error in -ubifs_jnl_update() when doing symlink in encryption scenario: - unreferenced object 0xffff888103da3d98 (size 8): - comm "ln", pid 1692, jiffies 4294914701 (age 12.045s) - backtrace: - kmemdup+0x32/0x70 - __fscrypt_encrypt_symlink+0xed/0x1c0 - ubifs_symlink+0x210/0x300 [ubifs] - vfs_symlink+0x216/0x360 - do_symlinkat+0x11a/0x190 - do_syscall_64+0x3b/0xe0 -There are two ways fixing it: - 1. Remove make_bad_inode() in error handling path. We can do that - because ubifs_evict_inode() will do same processes for good - symlink inode and bad symlink inode, for inode->i_nlink checking - is before is_bad_inode(). - 2. Free inode->i_link before marking inode bad. -Method 2 is picked, it has less influence, personally, I think. - -Cc: stable@vger.kernel.org -Fixes: 2c58d548f570 ("fscrypt: cache decrypted symlink target in ->i_link") -Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> -Suggested-by: Eric Biggers <ebiggers@kernel.org> -Reviewed-by: Eric Biggers <ebiggers@google.com> -Signed-off-by: Richard Weinberger <richard@nod.at> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/ubifs/dir.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c -index 3b13c648d490..e413a9cf8ee3 100644 ---- a/fs/ubifs/dir.c -+++ b/fs/ubifs/dir.c -@@ -1234,6 +1234,8 @@ static int ubifs_symlink(struct mnt_idmap *idmap, struct inode *dir, - dir_ui->ui_size = dir->i_size; - mutex_unlock(&dir_ui->ui_mutex); - out_inode: -+ /* Free inode->i_link before inode is marked as bad. */ -+ fscrypt_free_inode(inode); - make_bad_inode(inode); - iput(inode); - out_fname: --- -2.43.2 - -From 538db7912d9bd8d92f5afef03c0d5eafe1ef0fbe Mon Sep 17 00:00:00 2001 -From: Di Shen <di.shen@unisoc.com> -Date: Wed, 10 Jan 2024 19:55:26 +0800 -Subject: [PATCH 0789/1501] thermal: gov_power_allocator: avoid inability to - reset a cdev -Content-Length: 2587 -Lines: 64 - -commit e95fa7404716f6e25021e66067271a4ad8eb1486 upstream. - -Commit 0952177f2a1f ("thermal/core/power_allocator: Update once -cooling devices when temp is low") adds an update flag to avoid -triggering a thermal event when there is no need, and the thermal -cdev is updated once when the temperature is low. - -But when the trips are writable, and switch_on_temp is set to be a -higher value, the cooling device state may not be reset to 0, -because last_temperature is smaller than switch_on_temp. - -For example: -First: -switch_on_temp=70 control_temp=85; -Then userspace change the trip_temp: -switch_on_temp=45 control_temp=55 cur_temp=54 - -Then userspace reset the trip_temp: -switch_on_temp=70 control_temp=85 cur_temp=57 last_temp=54 - -At this time, the cooling device state should be reset to 0. -However, because cur_temp(57) < switch_on_temp(70) -last_temp(54) < switch_on_temp(70) ----> update = false, -update is false, the cooling device state can not be reset. - -Using the observation that tz->passive can also be regarded as the -temperature status, set the update flag to the tz->passive value. - -When the temperature drops below switch_on for the first time, the -states of cooling devices can be reset once, and tz->passive is updated -to 0. In the next round, because tz->passive is 0, cdev->state will not -be updated. - -By using the tz->passive value as the "update" flag, the issue above -can be solved, and the cooling devices can be updated only once when the -temperature is low. - -Fixes: 0952177f2a1f ("thermal/core/power_allocator: Update once cooling devices when temp is low") -Cc: 5.13+ <stable@vger.kernel.org> # 5.13+ -Suggested-by: Wei Wang <wvw@google.com> -Signed-off-by: Di Shen <di.shen@unisoc.com> -Reviewed-by: Lukasz Luba <lukasz.luba@arm.com> -[ rjw: Subject and changelog edits ] -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/thermal/gov_power_allocator.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/thermal/gov_power_allocator.c b/drivers/thermal/gov_power_allocator.c -index 83d4f451b1a9..931cd88425e4 100644 ---- a/drivers/thermal/gov_power_allocator.c -+++ b/drivers/thermal/gov_power_allocator.c -@@ -693,7 +693,7 @@ static int power_allocator_throttle(struct thermal_zone_device *tz, - - trip = params->trip_switch_on; - if (trip && tz->temperature < trip->temperature) { -- update = tz->last_temperature >= trip->temperature; -+ update = tz->passive; - tz->passive = 0; - reset_pid_controller(params); - allow_maximum_power(tz, update); --- -2.43.2 - -From 05509adf297924f51e1493aa86f9fcde1433ed80 Mon Sep 17 00:00:00 2001 -From: Muhammad Usama Anjum <usama.anjum@collabora.com> -Date: Tue, 9 Jan 2024 16:24:42 +0500 -Subject: [PATCH 0790/1501] fs/proc/task_mmu: move mmu notification mechanism - inside mm lock -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 3826 -Lines: 100 - -commit 4cccb6221cae6d020270606b9e52b1678fc8b71a upstream. - -Move mmu notification mechanism inside mm lock to prevent race condition -in other components which depend on it. The notifier will invalidate -memory range. Depending upon the number of iterations, different memory -ranges would be invalidated. - -The following warning would be removed by this patch: -WARNING: CPU: 0 PID: 5067 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 kvm_mmu_notifier_change_pte+0x860/0x960 arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 - -There is no behavioural and performance change with this patch when -there is no component registered with the mmu notifier. - -[akpm@linux-foundation.org: narrow the scope of `range', per Sean] -Link: https://lkml.kernel.org/r/20240109112445.590736-1-usama.anjum@collabora.com -Fixes: 52526ca7fdb9 ("fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs") -Signed-off-by: Muhammad Usama Anjum <usama.anjum@collabora.com> -Reported-by: syzbot+81227d2bd69e9dedb802@syzkaller.appspotmail.com -Link: https://lore.kernel.org/all/000000000000f6d051060c6785bc@google.com/ -Reviewed-by: Sean Christopherson <seanjc@google.com> -Cc: Andrei Vagin <avagin@google.com> -Cc: Arnd Bergmann <arnd@arndb.de> -Cc: David Hildenbrand <david@redhat.com> -Cc: Hugh Dickins <hughd@google.com> -Cc: Kefeng Wang <wangkefeng.wang@huawei.com> -Cc: Liam R. Howlett <Liam.Howlett@oracle.com> -Cc: Michał Mirosław <mirq-linux@rere.qmqm.pl> -Cc: Peter Xu <peterx@redhat.com> -Cc: Ryan Roberts <ryan.roberts@arm.com> -Cc: Stephen Rothwell <sfr@canb.auug.org.au> -Cc: Suren Baghdasaryan <surenb@google.com> -Cc: <stable@vger.kernel.org> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/proc/task_mmu.c | 24 +++++++++++++----------- - 1 file changed, 13 insertions(+), 11 deletions(-) - -diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c -index 435b61054b5b..4905420d339f 100644 ---- a/fs/proc/task_mmu.c -+++ b/fs/proc/task_mmu.c -@@ -2415,7 +2415,6 @@ static long pagemap_scan_flush_buffer(struct pagemap_scan_private *p) - - static long do_pagemap_scan(struct mm_struct *mm, unsigned long uarg) - { -- struct mmu_notifier_range range; - struct pagemap_scan_private p = {0}; - unsigned long walk_start; - size_t n_ranges_out = 0; -@@ -2431,15 +2430,9 @@ static long do_pagemap_scan(struct mm_struct *mm, unsigned long uarg) - if (ret) - return ret; - -- /* Protection change for the range is going to happen. */ -- if (p.arg.flags & PM_SCAN_WP_MATCHING) { -- mmu_notifier_range_init(&range, MMU_NOTIFY_PROTECTION_VMA, 0, -- mm, p.arg.start, p.arg.end); -- mmu_notifier_invalidate_range_start(&range); -- } -- - for (walk_start = p.arg.start; walk_start < p.arg.end; - walk_start = p.arg.walk_end) { -+ struct mmu_notifier_range range; - long n_out; - - if (fatal_signal_pending(current)) { -@@ -2450,8 +2443,20 @@ static long do_pagemap_scan(struct mm_struct *mm, unsigned long uarg) - ret = mmap_read_lock_killable(mm); - if (ret) - break; -+ -+ /* Protection change for the range is going to happen. */ -+ if (p.arg.flags & PM_SCAN_WP_MATCHING) { -+ mmu_notifier_range_init(&range, MMU_NOTIFY_PROTECTION_VMA, 0, -+ mm, walk_start, p.arg.end); -+ mmu_notifier_invalidate_range_start(&range); -+ } -+ - ret = walk_page_range(mm, walk_start, p.arg.end, - &pagemap_scan_ops, &p); -+ -+ if (p.arg.flags & PM_SCAN_WP_MATCHING) -+ mmu_notifier_invalidate_range_end(&range); -+ - mmap_read_unlock(mm); - - n_out = pagemap_scan_flush_buffer(&p); -@@ -2477,9 +2482,6 @@ static long do_pagemap_scan(struct mm_struct *mm, unsigned long uarg) - if (pagemap_scan_writeback_args(&p.arg, uarg)) - ret = -EFAULT; - -- if (p.arg.flags & PM_SCAN_WP_MATCHING) -- mmu_notifier_invalidate_range_end(&range); -- - kfree(p.vec_buf); - return ret; - } --- -2.43.2 - -From 61c8b879f9949aa98ecd1c390c48c2aa809996ee Mon Sep 17 00:00:00 2001 -From: James Gowans <jgowans@amazon.com> -Date: Wed, 13 Dec 2023 08:40:04 +0200 -Subject: [PATCH 0791/1501] kexec: do syscore_shutdown() in kernel_kexec -Content-Length: 4389 -Lines: 91 - -commit 7bb943806ff61e83ae4cceef8906b7fe52453e8a upstream. - -syscore_shutdown() runs driver and module callbacks to get the system into -a state where it can be correctly shut down. In commit 6f389a8f1dd2 ("PM -/ reboot: call syscore_shutdown() after disable_nonboot_cpus()") -syscore_shutdown() was removed from kernel_restart_prepare() and hence got -(incorrectly?) removed from the kexec flow. This was innocuous until -commit 6735150b6997 ("KVM: Use syscore_ops instead of reboot_notifier to -hook restart/shutdown") changed the way that KVM registered its shutdown -callbacks, switching from reboot notifiers to syscore_ops.shutdown. As -syscore_shutdown() is missing from kexec, KVM's shutdown hook is not run -and virtualisation is left enabled on the boot CPU which results in triple -faults when switching to the new kernel on Intel x86 VT-x with VMXE -enabled. - -Fix this by adding syscore_shutdown() to the kexec sequence. In terms of -where to add it, it is being added after migrating the kexec task to the -boot CPU, but before APs are shut down. It is not totally clear if this -is the best place: in commit 6f389a8f1dd2 ("PM / reboot: call -syscore_shutdown() after disable_nonboot_cpus()") it is stated that -"syscore_ops operations should be carried with one CPU on-line and -interrupts disabled." APs are only offlined later in machine_shutdown(), -so this syscore_shutdown() is being run while APs are still online. This -seems to be the correct place as it matches where syscore_shutdown() is -run in the reboot and halt flows - they also run it before APs are shut -down. The assumption is that the commit message in commit 6f389a8f1dd2 -("PM / reboot: call syscore_shutdown() after disable_nonboot_cpus()") is -no longer valid. - -KVM has been discussed here as it is what broke loudly by not having -syscore_shutdown() in kexec, but this change impacts more than just KVM; -all drivers/modules which register a syscore_ops.shutdown callback will -now be invoked in the kexec flow. Looking at some of them like x86 MCE it -is probably more correct to also shut these down during kexec. -Maintainers of all drivers which use syscore_ops.shutdown are added on CC -for visibility. They are: - -arch/powerpc/platforms/cell/spu_base.c .shutdown = spu_shutdown, -arch/x86/kernel/cpu/mce/core.c .shutdown = mce_syscore_shutdown, -arch/x86/kernel/i8259.c .shutdown = i8259A_shutdown, -drivers/irqchip/irq-i8259.c .shutdown = i8259A_shutdown, -drivers/irqchip/irq-sun6i-r.c .shutdown = sun6i_r_intc_shutdown, -drivers/leds/trigger/ledtrig-cpu.c .shutdown = ledtrig_cpu_syscore_shutdown, -drivers/power/reset/sc27xx-poweroff.c .shutdown = sc27xx_poweroff_shutdown, -kernel/irq/generic-chip.c .shutdown = irq_gc_shutdown, -virt/kvm/kvm_main.c .shutdown = kvm_shutdown, - -This has been tested by doing a kexec on x86_64 and aarch64. - -Link: https://lkml.kernel.org/r/20231213064004.2419447-1-jgowans@amazon.com -Fixes: 6735150b6997 ("KVM: Use syscore_ops instead of reboot_notifier to hook restart/shutdown") -Signed-off-by: James Gowans <jgowans@amazon.com> -Cc: Baoquan He <bhe@redhat.com> -Cc: Eric Biederman <ebiederm@xmission.com> -Cc: Paolo Bonzini <pbonzini@redhat.com> -Cc: Sean Christopherson <seanjc@google.com> -Cc: Marc Zyngier <maz@kernel.org> -Cc: Arnd Bergmann <arnd@arndb.de> -Cc: Tony Luck <tony.luck@intel.com> -Cc: Borislav Petkov <bp@alien8.de> -Cc: Thomas Gleixner <tglx@linutronix.de> -Cc: Ingo Molnar <mingo@redhat.com> -Cc: Chen-Yu Tsai <wens@csie.org> -Cc: Jernej Skrabec <jernej.skrabec@gmail.com> -Cc: Samuel Holland <samuel@sholland.org> -Cc: Pavel Machek <pavel@ucw.cz> -Cc: Sebastian Reichel <sre@kernel.org> -Cc: Orson Zhai <orsonzhai@gmail.com> -Cc: Alexander Graf <graf@amazon.de> -Cc: Jan H. Schoenherr <jschoenh@amazon.de> -Cc: <stable@vger.kernel.org> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - kernel/kexec_core.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c -index be5642a4ec49..b926c4db8a91 100644 ---- a/kernel/kexec_core.c -+++ b/kernel/kexec_core.c -@@ -1254,6 +1254,7 @@ int kernel_kexec(void) - kexec_in_progress = true; - kernel_restart_prepare("kexec reboot"); - migrate_to_reboot_cpu(); -+ syscore_shutdown(); - - /* - * migrate_to_reboot_cpu() disables CPU hotplug assuming that --- -2.43.2 - -From 16002a2a365d3c851e890af3df5980648701b411 Mon Sep 17 00:00:00 2001 -From: "Steven Rostedt (Google)" <rostedt@goodmis.org> -Date: Fri, 1 Dec 2023 14:59:36 -0500 -Subject: [PATCH 0793/1501] mm/rmap: fix misplaced parenthesis of a likely() -Content-Length: 2568 -Lines: 61 - -commit f67f8d4a8c1e1ebc85a6cbdb9a7266f14863461c upstream. - -Running my yearly branch profiler to see where likely/unlikely annotation -may be added or removed, I discovered this: - -correct incorrect % Function File Line - ------- --------- - -------- ---- ---- - 0 457918 100 page_try_dup_anon_rmap rmap.h 264 -[..] - 458021 0 0 page_try_dup_anon_rmap rmap.h 265 - -I thought it was interesting that line 264 of rmap.h had a 100% incorrect -annotation, but the line directly below it was 100% correct. Looking at the -code: - - if (likely(!is_device_private_page(page) && - unlikely(page_needs_cow_for_dma(vma, page)))) - -It didn't make sense. The "likely()" was around the entire if statement -(not just the "!is_device_private_page(page)"), which also included the -"unlikely()" portion of that if condition. - -If the unlikely portion is unlikely to be true, that would make the entire -if condition unlikely to be true, so it made no sense at all to say the -entire if condition is true. - -What is more likely to be likely is just the first part of the if statement -before the && operation. It's likely to be a misplaced parenthesis. And -after making the if condition broken into a likely() && unlikely(), both -now appear to be correct! - -Link: https://lkml.kernel.org/r/20231201145936.5ddfdb50@gandalf.local.home -Fixes:fb3d824d1a46c ("mm/rmap: split page_dup_rmap() into page_dup_file_rmap() and page_try_dup_anon_rmap()") -Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> -Acked-by: Vlastimil Babka <vbabka@suse.cz> -Cc: David Hildenbrand <david@redhat.com> -Cc: Vlastimil Babka <vbabka@suse.cz> -Cc: <stable@vger.kernel.org> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - include/linux/rmap.h | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/include/linux/rmap.h b/include/linux/rmap.h -index b26fe858fd44..3c2fc291b071 100644 ---- a/include/linux/rmap.h -+++ b/include/linux/rmap.h -@@ -261,8 +261,8 @@ static inline int page_try_dup_anon_rmap(struct page *page, bool compound, - * guarantee the pinned page won't be randomly replaced in the - * future on write faults. - */ -- if (likely(!is_device_private_page(page) && -- unlikely(page_needs_cow_for_dma(vma, page)))) -+ if (likely(!is_device_private_page(page)) && -+ unlikely(page_needs_cow_for_dma(vma, page))) - return -EBUSY; - - ClearPageAnonExclusive(page); --- -2.43.2 - -From 3889a418b6eb9a1113fb989aaadecf2f64964767 Mon Sep 17 00:00:00 2001 -From: Baolin Wang <baolin.wang@linux.alibaba.com> -Date: Fri, 15 Dec 2023 20:07:52 +0800 -Subject: [PATCH 0794/1501] mm: migrate: fix getting incorrect page mapping - during page migration -Content-Length: 4770 -Lines: 126 - -commit d1adb25df7111de83b64655a80b5a135adbded61 upstream. - -When running stress-ng testing, we found below kernel crash after a few hours: - -Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 -pc : dentry_name+0xd8/0x224 -lr : pointer+0x22c/0x370 -sp : ffff800025f134c0 -...... -Call trace: - dentry_name+0xd8/0x224 - pointer+0x22c/0x370 - vsnprintf+0x1ec/0x730 - vscnprintf+0x2c/0x60 - vprintk_store+0x70/0x234 - vprintk_emit+0xe0/0x24c - vprintk_default+0x3c/0x44 - vprintk_func+0x84/0x2d0 - printk+0x64/0x88 - __dump_page+0x52c/0x530 - dump_page+0x14/0x20 - set_migratetype_isolate+0x110/0x224 - start_isolate_page_range+0xc4/0x20c - offline_pages+0x124/0x474 - memory_block_offline+0x44/0xf4 - memory_subsys_offline+0x3c/0x70 - device_offline+0xf0/0x120 - ...... - -After analyzing the vmcore, I found this issue is caused by page migration. -The scenario is that, one thread is doing page migration, and we will use the -target page's ->mapping field to save 'anon_vma' pointer between page unmap and -page move, and now the target page is locked and refcount is 1. - -Currently, there is another stress-ng thread performing memory hotplug, -attempting to offline the target page that is being migrated. It discovers that -the refcount of this target page is 1, preventing the offline operation, thus -proceeding to dump the page. However, page_mapping() of the target page may -return an incorrect file mapping to crash the system in dump_mapping(), since -the target page->mapping only saves 'anon_vma' pointer without setting -PAGE_MAPPING_ANON flag. - -There are seveval ways to fix this issue: -(1) Setting the PAGE_MAPPING_ANON flag for target page's ->mapping when saving -'anon_vma', but this can confuse PageAnon() for PFN walkers, since the target -page has not built mappings yet. -(2) Getting the page lock to call page_mapping() in __dump_page() to avoid crashing -the system, however, there are still some PFN walkers that call page_mapping() -without holding the page lock, such as compaction. -(3) Using target page->private field to save the 'anon_vma' pointer and 2 bits -page state, just as page->mapping records an anonymous page, which can remove -the page_mapping() impact for PFN walkers and also seems a simple way. - -So I choose option 3 to fix this issue, and this can also fix other potential -issues for PFN walkers, such as compaction. - -Link: https://lkml.kernel.org/r/e60b17a88afc38cb32f84c3e30837ec70b343d2b.1702641709.git.baolin.wang@linux.alibaba.com -Fixes: 64c8902ed441 ("migrate_pages: split unmap_and_move() to _unmap() and _move()") -Signed-off-by: Baolin Wang <baolin.wang@linux.alibaba.com> -Reviewed-by: "Huang, Ying" <ying.huang@intel.com> -Cc: Matthew Wilcox <willy@infradead.org> -Cc: David Hildenbrand <david@redhat.com> -Cc: Xu Yu <xuyu@linux.alibaba.com> -Cc: Zi Yan <ziy@nvidia.com> -Cc: <stable@vger.kernel.org> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - mm/migrate.c | 27 ++++++++++----------------- - 1 file changed, 10 insertions(+), 17 deletions(-) - -diff --git a/mm/migrate.c b/mm/migrate.c -index 397f2a6e34cb..bad3039d165e 100644 ---- a/mm/migrate.c -+++ b/mm/migrate.c -@@ -1025,38 +1025,31 @@ static int move_to_new_folio(struct folio *dst, struct folio *src, - } - - /* -- * To record some information during migration, we use some unused -- * fields (mapping and private) of struct folio of the newly allocated -- * destination folio. This is safe because nobody is using them -- * except us. -+ * To record some information during migration, we use unused private -+ * field of struct folio of the newly allocated destination folio. -+ * This is safe because nobody is using it except us. - */ --union migration_ptr { -- struct anon_vma *anon_vma; -- struct address_space *mapping; --}; -- - enum { - PAGE_WAS_MAPPED = BIT(0), - PAGE_WAS_MLOCKED = BIT(1), -+ PAGE_OLD_STATES = PAGE_WAS_MAPPED | PAGE_WAS_MLOCKED, - }; - - static void __migrate_folio_record(struct folio *dst, -- unsigned long old_page_state, -+ int old_page_state, - struct anon_vma *anon_vma) - { -- union migration_ptr ptr = { .anon_vma = anon_vma }; -- dst->mapping = ptr.mapping; -- dst->private = (void *)old_page_state; -+ dst->private = (void *)anon_vma + old_page_state; - } - - static void __migrate_folio_extract(struct folio *dst, - int *old_page_state, - struct anon_vma **anon_vmap) - { -- union migration_ptr ptr = { .mapping = dst->mapping }; -- *anon_vmap = ptr.anon_vma; -- *old_page_state = (unsigned long)dst->private; -- dst->mapping = NULL; -+ unsigned long private = (unsigned long)dst->private; -+ -+ *anon_vmap = (struct anon_vma *)(private & ~PAGE_OLD_STATES); -+ *old_page_state = private & PAGE_OLD_STATES; - dst->private = NULL; - } - --- -2.43.2 - -From 3a01daace71b521563c38bbbf874e14c3e58adb7 Mon Sep 17 00:00:00 2001 -From: Charan Teja Kalla <quic_charante@quicinc.com> -Date: Fri, 13 Oct 2023 18:34:27 +0530 -Subject: [PATCH 0795/1501] mm/sparsemem: fix race in accessing - memory_section->usage -Content-Length: 8262 -Lines: 205 - -commit 5ec8e8ea8b7783fab150cf86404fc38cb4db8800 upstream. - -The below race is observed on a PFN which falls into the device memory -region with the system memory configuration where PFN's are such that -[ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL]. Since normal zone start and end -pfn contains the device memory PFN's as well, the compaction triggered -will try on the device memory PFN's too though they end up in NOP(because -pfn_to_online_page() returns NULL for ZONE_DEVICE memory sections). When -from other core, the section mappings are being removed for the -ZONE_DEVICE region, that the PFN in question belongs to, on which -compaction is currently being operated is resulting into the kernel crash -with CONFIG_SPASEMEM_VMEMAP enabled. The crash logs can be seen at [1]. - -compact_zone() memunmap_pages -------------- --------------- -__pageblock_pfn_to_page - ...... - (a)pfn_valid(): - valid_section()//return true - (b)__remove_pages()-> - sparse_remove_section()-> - section_deactivate(): - [Free the array ms->usage and set - ms->usage = NULL] - pfn_section_valid() - [Access ms->usage which - is NULL] - -NOTE: From the above it can be said that the race is reduced to between -the pfn_valid()/pfn_section_valid() and the section deactivate with -SPASEMEM_VMEMAP enabled. - -The commit b943f045a9af("mm/sparse: fix kernel crash with -pfn_section_valid check") tried to address the same problem by clearing -the SECTION_HAS_MEM_MAP with the expectation of valid_section() returns -false thus ms->usage is not accessed. - -Fix this issue by the below steps: - -a) Clear SECTION_HAS_MEM_MAP before freeing the ->usage. - -b) RCU protected read side critical section will either return NULL - when SECTION_HAS_MEM_MAP is cleared or can successfully access ->usage. - -c) Free the ->usage with kfree_rcu() and set ms->usage = NULL. No - attempt will be made to access ->usage after this as the - SECTION_HAS_MEM_MAP is cleared thus valid_section() return false. - -Thanks to David/Pavan for their inputs on this patch. - -[1] https://lore.kernel.org/linux-mm/994410bb-89aa-d987-1f50-f514903c55aa@quicinc.com/ - -On Snapdragon SoC, with the mentioned memory configuration of PFN's as -[ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL], we are able to see bunch of -issues daily while testing on a device farm. - -For this particular issue below is the log. Though the below log is -not directly pointing to the pfn_section_valid(){ ms->usage;}, when we -loaded this dump on T32 lauterbach tool, it is pointing. - -[ 540.578056] Unable to handle kernel NULL pointer dereference at -virtual address 0000000000000000 -[ 540.578068] Mem abort info: -[ 540.578070] ESR = 0x0000000096000005 -[ 540.578073] EC = 0x25: DABT (current EL), IL = 32 bits -[ 540.578077] SET = 0, FnV = 0 -[ 540.578080] EA = 0, S1PTW = 0 -[ 540.578082] FSC = 0x05: level 1 translation fault -[ 540.578085] Data abort info: -[ 540.578086] ISV = 0, ISS = 0x00000005 -[ 540.578088] CM = 0, WnR = 0 -[ 540.579431] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBSBTYPE=--) -[ 540.579436] pc : __pageblock_pfn_to_page+0x6c/0x14c -[ 540.579454] lr : compact_zone+0x994/0x1058 -[ 540.579460] sp : ffffffc03579b510 -[ 540.579463] x29: ffffffc03579b510 x28: 0000000000235800 x27:000000000000000c -[ 540.579470] x26: 0000000000235c00 x25: 0000000000000068 x24:ffffffc03579b640 -[ 540.579477] x23: 0000000000000001 x22: ffffffc03579b660 x21:0000000000000000 -[ 540.579483] x20: 0000000000235bff x19: ffffffdebf7e3940 x18:ffffffdebf66d140 -[ 540.579489] x17: 00000000739ba063 x16: 00000000739ba063 x15:00000000009f4bff -[ 540.579495] x14: 0000008000000000 x13: 0000000000000000 x12:0000000000000001 -[ 540.579501] x11: 0000000000000000 x10: 0000000000000000 x9 :ffffff897d2cd440 -[ 540.579507] x8 : 0000000000000000 x7 : 0000000000000000 x6 :ffffffc03579b5b4 -[ 540.579512] x5 : 0000000000027f25 x4 : ffffffc03579b5b8 x3 :0000000000000001 -[ 540.579518] x2 : ffffffdebf7e3940 x1 : 0000000000235c00 x0 :0000000000235800 -[ 540.579524] Call trace: -[ 540.579527] __pageblock_pfn_to_page+0x6c/0x14c -[ 540.579533] compact_zone+0x994/0x1058 -[ 540.579536] try_to_compact_pages+0x128/0x378 -[ 540.579540] __alloc_pages_direct_compact+0x80/0x2b0 -[ 540.579544] __alloc_pages_slowpath+0x5c0/0xe10 -[ 540.579547] __alloc_pages+0x250/0x2d0 -[ 540.579550] __iommu_dma_alloc_noncontiguous+0x13c/0x3fc -[ 540.579561] iommu_dma_alloc+0xa0/0x320 -[ 540.579565] dma_alloc_attrs+0xd4/0x108 - -[quic_charante@quicinc.com: use kfree_rcu() in place of synchronize_rcu(), per David] - Link: https://lkml.kernel.org/r/1698403778-20938-1-git-send-email-quic_charante@quicinc.com -Link: https://lkml.kernel.org/r/1697202267-23600-1-git-send-email-quic_charante@quicinc.com -Fixes: f46edbd1b151 ("mm/sparsemem: add helpers track active portions of a section at boot") -Signed-off-by: Charan Teja Kalla <quic_charante@quicinc.com> -Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com> -Cc: Dan Williams <dan.j.williams@intel.com> -Cc: David Hildenbrand <david@redhat.com> -Cc: Mel Gorman <mgorman@techsingularity.net> -Cc: Oscar Salvador <osalvador@suse.de> -Cc: Vlastimil Babka <vbabka@suse.cz> -Cc: <stable@vger.kernel.org> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - include/linux/mmzone.h | 14 +++++++++++--- - mm/sparse.c | 17 +++++++++-------- - 2 files changed, 20 insertions(+), 11 deletions(-) - -diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h -index 9db36e197712..a7c32324c263 100644 ---- a/include/linux/mmzone.h -+++ b/include/linux/mmzone.h -@@ -1793,6 +1793,7 @@ static inline unsigned long section_nr_to_pfn(unsigned long sec) - #define SUBSECTION_ALIGN_DOWN(pfn) ((pfn) & PAGE_SUBSECTION_MASK) - - struct mem_section_usage { -+ struct rcu_head rcu; - #ifdef CONFIG_SPARSEMEM_VMEMMAP - DECLARE_BITMAP(subsection_map, SUBSECTIONS_PER_SECTION); - #endif -@@ -1986,7 +1987,7 @@ static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn) - { - int idx = subsection_map_index(pfn); - -- return test_bit(idx, ms->usage->subsection_map); -+ return test_bit(idx, READ_ONCE(ms->usage)->subsection_map); - } - #else - static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn) -@@ -2010,6 +2011,7 @@ static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn) - static inline int pfn_valid(unsigned long pfn) - { - struct mem_section *ms; -+ int ret; - - /* - * Ensure the upper PAGE_SHIFT bits are clear in the -@@ -2023,13 +2025,19 @@ static inline int pfn_valid(unsigned long pfn) - if (pfn_to_section_nr(pfn) >= NR_MEM_SECTIONS) - return 0; - ms = __pfn_to_section(pfn); -- if (!valid_section(ms)) -+ rcu_read_lock(); -+ if (!valid_section(ms)) { -+ rcu_read_unlock(); - return 0; -+ } - /* - * Traditionally early sections always returned pfn_valid() for - * the entire section-sized span. - */ -- return early_section(ms) || pfn_section_valid(ms, pfn); -+ ret = early_section(ms) || pfn_section_valid(ms, pfn); -+ rcu_read_unlock(); -+ -+ return ret; - } - #endif - -diff --git a/mm/sparse.c b/mm/sparse.c -index 77d91e565045..338cf946dee8 100644 ---- a/mm/sparse.c -+++ b/mm/sparse.c -@@ -791,6 +791,13 @@ static void section_deactivate(unsigned long pfn, unsigned long nr_pages, - if (empty) { - unsigned long section_nr = pfn_to_section_nr(pfn); - -+ /* -+ * Mark the section invalid so that valid_section() -+ * return false. This prevents code from dereferencing -+ * ms->usage array. -+ */ -+ ms->section_mem_map &= ~SECTION_HAS_MEM_MAP; -+ - /* - * When removing an early section, the usage map is kept (as the - * usage maps of other sections fall into the same page). It -@@ -799,16 +806,10 @@ static void section_deactivate(unsigned long pfn, unsigned long nr_pages, - * was allocated during boot. - */ - if (!PageReserved(virt_to_page(ms->usage))) { -- kfree(ms->usage); -- ms->usage = NULL; -+ kfree_rcu(ms->usage, rcu); -+ WRITE_ONCE(ms->usage, NULL); - } - memmap = sparse_decode_mem_map(ms->section_mem_map, section_nr); -- /* -- * Mark the section invalid so that valid_section() -- * return false. This prevents code from dereferencing -- * ms->usage array. -- */ -- ms->section_mem_map &= ~SECTION_HAS_MEM_MAP; - } - - /* --- -2.43.2 - -From cbb5ec8f75b74175e2a0d41b8281a1d4ca6a6089 Mon Sep 17 00:00:00 2001 -From: Al Viro <viro@zeniv.linux.org.uk> -Date: Sun, 19 Nov 2023 20:25:58 -0500 -Subject: [PATCH 0796/1501] rename(): fix the locking of subdirectories -Content-Length: 11870 -Lines: 279 - -commit 22e111ed6c83dcde3037fc81176012721bc34c0b upstream. - - We should never lock two subdirectories without having taken -->s_vfs_rename_mutex; inode pointer order or not, the "order" proposed -in 28eceeda130f "fs: Lock moved directories" is not transitive, with -the usual consequences. - - The rationale for locking renamed subdirectory in all cases was -the possibility of race between rename modifying .. in a subdirectory to -reflect the new parent and another thread modifying the same subdirectory. -For a lot of filesystems that's not a problem, but for some it can lead -to trouble (e.g. the case when short directory contents is kept in the -inode, but creating a file in it might push it across the size limit -and copy its contents into separate data block(s)). - - However, we need that only in case when the parent does change - -otherwise ->rename() doesn't need to do anything with .. entry in the -first place. Some instances are lazy and do a tautological update anyway, -but it's really not hard to avoid. - -Amended locking rules for rename(): - find the parent(s) of source and target - if source and target have the same parent - lock the common parent - else - lock ->s_vfs_rename_mutex - lock both parents, in ancestor-first order; if neither - is an ancestor of another, lock the parent of source - first. - find the source and target. - if source and target have the same parent - if operation is an overwriting rename of a subdirectory - lock the target subdirectory - else - if source is a subdirectory - lock the source - if target is a subdirectory - lock the target - lock non-directories involved, in inode pointer order if both - source and target are such. - -That way we are guaranteed that parents are locked (for obvious reasons), -that any renamed non-directory is locked (nfsd relies upon that), -that any victim is locked (emptiness check needs that, among other things) -and subdirectory that changes parent is locked (needed to protect the update -of .. entries). We are also guaranteed that any operation locking more -than one directory either takes ->s_vfs_rename_mutex or locks a parent -followed by its child. - -Cc: stable@vger.kernel.org -Fixes: 28eceeda130f "fs: Lock moved directories" -Reviewed-by: Jan Kara <jack@suse.cz> -Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - .../filesystems/directory-locking.rst | 29 ++++----- - Documentation/filesystems/locking.rst | 5 +- - Documentation/filesystems/porting.rst | 18 ++++++ - fs/namei.c | 60 ++++++++++++------- - 4 files changed, 74 insertions(+), 38 deletions(-) - -diff --git a/Documentation/filesystems/directory-locking.rst b/Documentation/filesystems/directory-locking.rst -index dccd61c7c5c3..193c22687851 100644 ---- a/Documentation/filesystems/directory-locking.rst -+++ b/Documentation/filesystems/directory-locking.rst -@@ -22,13 +22,16 @@ exclusive. - 3) object removal. Locking rules: caller locks parent, finds victim, - locks victim and calls the method. Locks are exclusive. - --4) rename() that is _not_ cross-directory. Locking rules: caller locks the --parent and finds source and target. We lock both (provided they exist). If we --need to lock two inodes of different type (dir vs non-dir), we lock directory --first. If we need to lock two inodes of the same type, lock them in inode --pointer order. Then call the method. All locks are exclusive. --NB: we might get away with locking the source (and target in exchange --case) shared. -+4) rename() that is _not_ cross-directory. Locking rules: caller locks -+the parent and finds source and target. Then we decide which of the -+source and target need to be locked. Source needs to be locked if it's a -+non-directory; target - if it's a non-directory or about to be removed. -+Take the locks that need to be taken, in inode pointer order if need -+to take both (that can happen only when both source and target are -+non-directories - the source because it wouldn't be locked otherwise -+and the target because mixing directory and non-directory is allowed -+only with RENAME_EXCHANGE, and that won't be removing the target). -+After the locks had been taken, call the method. All locks are exclusive. - - 5) link creation. Locking rules: - -@@ -44,20 +47,17 @@ rules: - - * lock the filesystem - * lock parents in "ancestors first" order. If one is not ancestor of -- the other, lock them in inode pointer order. -+ the other, lock the parent of source first. - * find source and target. - * if old parent is equal to or is a descendent of target - fail with -ENOTEMPTY - * if new parent is equal to or is a descendent of source - fail with -ELOOP -- * Lock both the source and the target provided they exist. If we -- need to lock two inodes of different type (dir vs non-dir), we lock -- the directory first. If we need to lock two inodes of the same type, -- lock them in inode pointer order. -+ * Lock subdirectories involved (source before target). -+ * Lock non-directories involved, in inode pointer order. - * call the method. - --All ->i_rwsem are taken exclusive. Again, we might get away with locking --the source (and target in exchange case) shared. -+All ->i_rwsem are taken exclusive. - - The rules above obviously guarantee that all directories that are going to be - read, modified or removed by method will be locked by caller. -@@ -67,6 +67,7 @@ If no directory is its own ancestor, the scheme above is deadlock-free. - - Proof: - -+[XXX: will be updated once we are done massaging the lock_rename()] - First of all, at any moment we have a linear ordering of the - objects - A < B iff (A is an ancestor of B) or (B is not an ancestor - of A and ptr(A) < ptr(B)). -diff --git a/Documentation/filesystems/locking.rst b/Documentation/filesystems/locking.rst -index 7be2900806c8..bd12f2f850ad 100644 ---- a/Documentation/filesystems/locking.rst -+++ b/Documentation/filesystems/locking.rst -@@ -101,7 +101,7 @@ symlink: exclusive - mkdir: exclusive - unlink: exclusive (both) - rmdir: exclusive (both)(see below) --rename: exclusive (all) (see below) -+rename: exclusive (both parents, some children) (see below) - readlink: no - get_link: no - setattr: exclusive -@@ -123,6 +123,9 @@ get_offset_ctx no - Additionally, ->rmdir(), ->unlink() and ->rename() have ->i_rwsem - exclusive on victim. - cross-directory ->rename() has (per-superblock) ->s_vfs_rename_sem. -+ ->unlink() and ->rename() have ->i_rwsem exclusive on all non-directories -+ involved. -+ ->rename() has ->i_rwsem exclusive on any subdirectory that changes parent. - - See Documentation/filesystems/directory-locking.rst for more detailed discussion - of the locking scheme for directory operations. -diff --git a/Documentation/filesystems/porting.rst b/Documentation/filesystems/porting.rst -index 878e72b2f8b7..9100969e7de6 100644 ---- a/Documentation/filesystems/porting.rst -+++ b/Documentation/filesystems/porting.rst -@@ -1061,3 +1061,21 @@ export_operations ->encode_fh() no longer has a default implementation to - encode FILEID_INO32_GEN* file handles. - Filesystems that used the default implementation may use the generic helper - generic_encode_ino32_fh() explicitly. -+ -+--- -+ -+**mandatory** -+ -+If ->rename() update of .. on cross-directory move needs an exclusion with -+directory modifications, do *not* lock the subdirectory in question in your -+->rename() - it's done by the caller now [that item should've been added in -+28eceeda130f "fs: Lock moved directories"]. -+ -+--- -+ -+**mandatory** -+ -+On same-directory ->rename() the (tautological) update of .. is not protected -+by any locks; just don't do it if the old parent is the same as the new one. -+We really can't lock two subdirectories in same-directory rename - not without -+deadlocks. -diff --git a/fs/namei.c b/fs/namei.c -index 71c13b2990b4..29bafbdb44ca 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -3021,20 +3021,14 @@ static struct dentry *lock_two_directories(struct dentry *p1, struct dentry *p2) - p = d_ancestor(p2, p1); - if (p) { - inode_lock_nested(p2->d_inode, I_MUTEX_PARENT); -- inode_lock_nested(p1->d_inode, I_MUTEX_CHILD); -+ inode_lock_nested(p1->d_inode, I_MUTEX_PARENT2); - return p; - } - - p = d_ancestor(p1, p2); -- if (p) { -- inode_lock_nested(p1->d_inode, I_MUTEX_PARENT); -- inode_lock_nested(p2->d_inode, I_MUTEX_CHILD); -- return p; -- } -- -- lock_two_inodes(p1->d_inode, p2->d_inode, -- I_MUTEX_PARENT, I_MUTEX_PARENT2); -- return NULL; -+ inode_lock_nested(p1->d_inode, I_MUTEX_PARENT); -+ inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2); -+ return p; - } - - /* -@@ -4716,11 +4710,12 @@ SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname - * - * a) we can get into loop creation. - * b) race potential - two innocent renames can create a loop together. -- * That's where 4.4 screws up. Current fix: serialization on -+ * That's where 4.4BSD screws up. Current fix: serialization on - * sb->s_vfs_rename_mutex. We might be more accurate, but that's another - * story. -- * c) we have to lock _four_ objects - parents and victim (if it exists), -- * and source. -+ * c) we may have to lock up to _four_ objects - parents and victim (if it exists), -+ * and source (if it's a non-directory or a subdirectory that moves to -+ * different parent). - * And that - after we got ->i_mutex on parents (until then we don't know - * whether the target exists). Solution: try to be smart with locking - * order for inodes. We rely on the fact that tree topology may change -@@ -4752,6 +4747,7 @@ int vfs_rename(struct renamedata *rd) - bool new_is_dir = false; - unsigned max_links = new_dir->i_sb->s_max_links; - struct name_snapshot old_name; -+ bool lock_old_subdir, lock_new_subdir; - - if (source == target) - return 0; -@@ -4805,15 +4801,32 @@ int vfs_rename(struct renamedata *rd) - take_dentry_name_snapshot(&old_name, old_dentry); - dget(new_dentry); - /* -- * Lock all moved children. Moved directories may need to change parent -- * pointer so they need the lock to prevent against concurrent -- * directory changes moving parent pointer. For regular files we've -- * historically always done this. The lockdep locking subclasses are -- * somewhat arbitrary but RENAME_EXCHANGE in particular can swap -- * regular files and directories so it's difficult to tell which -- * subclasses to use. -+ * Lock children. -+ * The source subdirectory needs to be locked on cross-directory -+ * rename or cross-directory exchange since its parent changes. -+ * The target subdirectory needs to be locked on cross-directory -+ * exchange due to parent change and on any rename due to becoming -+ * a victim. -+ * Non-directories need locking in all cases (for NFS reasons); -+ * they get locked after any subdirectories (in inode address order). -+ * -+ * NOTE: WE ONLY LOCK UNRELATED DIRECTORIES IN CROSS-DIRECTORY CASE. -+ * NEVER, EVER DO THAT WITHOUT ->s_vfs_rename_mutex. - */ -- lock_two_inodes(source, target, I_MUTEX_NORMAL, I_MUTEX_NONDIR2); -+ lock_old_subdir = new_dir != old_dir; -+ lock_new_subdir = new_dir != old_dir || !(flags & RENAME_EXCHANGE); -+ if (is_dir) { -+ if (lock_old_subdir) -+ inode_lock_nested(source, I_MUTEX_CHILD); -+ if (target && (!new_is_dir || lock_new_subdir)) -+ inode_lock(target); -+ } else if (new_is_dir) { -+ if (lock_new_subdir) -+ inode_lock_nested(target, I_MUTEX_CHILD); -+ inode_lock(source); -+ } else { -+ lock_two_nondirectories(source, target); -+ } - - error = -EPERM; - if (IS_SWAPFILE(source) || (target && IS_SWAPFILE(target))) -@@ -4861,8 +4874,9 @@ int vfs_rename(struct renamedata *rd) - d_exchange(old_dentry, new_dentry); - } - out: -- inode_unlock(source); -- if (target) -+ if (!is_dir || lock_old_subdir) -+ inode_unlock(source); -+ if (target && (!new_is_dir || lock_new_subdir)) - inode_unlock(target); - dput(new_dentry); - if (!error) { --- -2.43.2 - -From 0c84cb41133f3c36b42b88d8a73f629d9d8dbf48 Mon Sep 17 00:00:00 2001 -From: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Date: Mon, 30 Oct 2023 17:14:47 -0400 -Subject: [PATCH 0797/1501] serial: sc16is7xx: improve regmap debugfs by using - one regmap per port -Content-Length: 15095 -Lines: 434 - -commit 3837a0379533aabb9e4483677077479f7c6aa910 upstream. - -With this current driver regmap implementation, it is hard to make sense -of the register addresses displayed using the regmap debugfs interface, -because they do not correspond to the actual register addresses documented -in the datasheet. For example, register 1 is displayed as registers 04 thru -07: - -$ cat /sys/kernel/debug/regmap/spi0.0/registers - 04: 10 -> Port 0, register offset 1 - 05: 10 -> Port 1, register offset 1 - 06: 00 -> Port 2, register offset 1 -> invalid - 07: 00 -> port 3, register offset 1 -> invalid - ... - -The reason is that bits 0 and 1 of the register address correspond to the -channel (port) bits, so the register address itself starts at bit 2, and we -must 'mentally' shift each register address by 2 bits to get its real -address/offset. - -Also, only channels 0 and 1 are supported by the chip, so channel mask -combinations of 10b and 11b are invalid, and the display of these -registers is useless. - -This patch adds a separate regmap configuration for each port, similar to -what is done in the max310x driver, so that register addresses displayed -match the register addresses in the chip datasheet. Also, each port now has -its own debugfs entry. - -Example with new regmap implementation: - -$ cat /sys/kernel/debug/regmap/spi0.0-port0/registers -1: 10 -2: 01 -3: 00 -... - -$ cat /sys/kernel/debug/regmap/spi0.0-port1/registers -1: 10 -2: 01 -3: 00 - -As an added bonus, this also simplifies some operations (read/write/modify) -because it is no longer necessary to manually shift register addresses. - -Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Link: https://lore.kernel.org/r/20231030211447.974779-1-hugo@hugovil.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/tty/serial/sc16is7xx.c | 143 +++++++++++++++++++-------------- - 1 file changed, 81 insertions(+), 62 deletions(-) - -diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c -index d5bb0da95376..d5e88fe52c50 100644 ---- a/drivers/tty/serial/sc16is7xx.c -+++ b/drivers/tty/serial/sc16is7xx.c -@@ -301,8 +301,8 @@ - - - /* Misc definitions */ -+#define SC16IS7XX_SPI_READ_BIT BIT(7) - #define SC16IS7XX_FIFO_SIZE (64) --#define SC16IS7XX_REG_SHIFT 2 - #define SC16IS7XX_GPIOS_PER_BANK 4 - - struct sc16is7xx_devtype { -@@ -324,6 +324,7 @@ struct sc16is7xx_one_config { - struct sc16is7xx_one { - struct uart_port port; - u8 line; -+ struct regmap *regmap; - struct kthread_work tx_work; - struct kthread_work reg_work; - struct kthread_delayed_work ms_work; -@@ -361,48 +362,37 @@ static void sc16is7xx_stop_tx(struct uart_port *port); - - #define to_sc16is7xx_one(p,e) ((container_of((p), struct sc16is7xx_one, e))) - --static int sc16is7xx_line(struct uart_port *port) --{ -- struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); -- -- return one->line; --} -- - static u8 sc16is7xx_port_read(struct uart_port *port, u8 reg) - { -- struct sc16is7xx_port *s = dev_get_drvdata(port->dev); -+ struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); - unsigned int val = 0; -- const u8 line = sc16is7xx_line(port); - -- regmap_read(s->regmap, (reg << SC16IS7XX_REG_SHIFT) | line, &val); -+ regmap_read(one->regmap, reg, &val); - - return val; - } - - static void sc16is7xx_port_write(struct uart_port *port, u8 reg, u8 val) - { -- struct sc16is7xx_port *s = dev_get_drvdata(port->dev); -- const u8 line = sc16is7xx_line(port); -+ struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); - -- regmap_write(s->regmap, (reg << SC16IS7XX_REG_SHIFT) | line, val); -+ regmap_write(one->regmap, reg, val); - } - - static void sc16is7xx_fifo_read(struct uart_port *port, unsigned int rxlen) - { - struct sc16is7xx_port *s = dev_get_drvdata(port->dev); -- const u8 line = sc16is7xx_line(port); -- u8 addr = (SC16IS7XX_RHR_REG << SC16IS7XX_REG_SHIFT) | line; -+ struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); - -- regcache_cache_bypass(s->regmap, true); -- regmap_raw_read(s->regmap, addr, s->buf, rxlen); -- regcache_cache_bypass(s->regmap, false); -+ regcache_cache_bypass(one->regmap, true); -+ regmap_raw_read(one->regmap, SC16IS7XX_RHR_REG, s->buf, rxlen); -+ regcache_cache_bypass(one->regmap, false); - } - - static void sc16is7xx_fifo_write(struct uart_port *port, u8 to_send) - { - struct sc16is7xx_port *s = dev_get_drvdata(port->dev); -- const u8 line = sc16is7xx_line(port); -- u8 addr = (SC16IS7XX_THR_REG << SC16IS7XX_REG_SHIFT) | line; -+ struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); - - /* - * Don't send zero-length data, at least on SPI it confuses the chip -@@ -411,19 +401,17 @@ static void sc16is7xx_fifo_write(struct uart_port *port, u8 to_send) - if (unlikely(!to_send)) - return; - -- regcache_cache_bypass(s->regmap, true); -- regmap_raw_write(s->regmap, addr, s->buf, to_send); -- regcache_cache_bypass(s->regmap, false); -+ regcache_cache_bypass(one->regmap, true); -+ regmap_raw_write(one->regmap, SC16IS7XX_THR_REG, s->buf, to_send); -+ regcache_cache_bypass(one->regmap, false); - } - - static void sc16is7xx_port_update(struct uart_port *port, u8 reg, - u8 mask, u8 val) - { -- struct sc16is7xx_port *s = dev_get_drvdata(port->dev); -- const u8 line = sc16is7xx_line(port); -+ struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); - -- regmap_update_bits(s->regmap, (reg << SC16IS7XX_REG_SHIFT) | line, -- mask, val); -+ regmap_update_bits(one->regmap, reg, mask, val); - } - - static int sc16is7xx_alloc_line(void) -@@ -478,7 +466,7 @@ static const struct sc16is7xx_devtype sc16is762_devtype = { - - static bool sc16is7xx_regmap_volatile(struct device *dev, unsigned int reg) - { -- switch (reg >> SC16IS7XX_REG_SHIFT) { -+ switch (reg) { - case SC16IS7XX_RHR_REG: - case SC16IS7XX_IIR_REG: - case SC16IS7XX_LSR_REG: -@@ -497,7 +485,7 @@ static bool sc16is7xx_regmap_volatile(struct device *dev, unsigned int reg) - - static bool sc16is7xx_regmap_precious(struct device *dev, unsigned int reg) - { -- switch (reg >> SC16IS7XX_REG_SHIFT) { -+ switch (reg) { - case SC16IS7XX_RHR_REG: - return true; - default: -@@ -510,6 +498,7 @@ static bool sc16is7xx_regmap_precious(struct device *dev, unsigned int reg) - static int sc16is7xx_set_baud(struct uart_port *port, int baud) - { - struct sc16is7xx_port *s = dev_get_drvdata(port->dev); -+ struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); - u8 lcr; - u8 prescaler = 0; - unsigned long clk = port->uartclk, div = clk / 16 / baud; -@@ -541,12 +530,12 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) - SC16IS7XX_LCR_CONF_MODE_B); - - /* Enable enhanced features */ -- regcache_cache_bypass(s->regmap, true); -+ regcache_cache_bypass(one->regmap, true); - sc16is7xx_port_update(port, SC16IS7XX_EFR_REG, - SC16IS7XX_EFR_ENABLE_BIT, - SC16IS7XX_EFR_ENABLE_BIT); - -- regcache_cache_bypass(s->regmap, false); -+ regcache_cache_bypass(one->regmap, false); - - /* Put LCR back to the normal mode */ - sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr); -@@ -562,10 +551,10 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) - SC16IS7XX_LCR_CONF_MODE_A); - - /* Write the new divisor */ -- regcache_cache_bypass(s->regmap, true); -+ regcache_cache_bypass(one->regmap, true); - sc16is7xx_port_write(port, SC16IS7XX_DLH_REG, div / 256); - sc16is7xx_port_write(port, SC16IS7XX_DLL_REG, div % 256); -- regcache_cache_bypass(s->regmap, false); -+ regcache_cache_bypass(one->regmap, false); - - /* Put LCR back to the normal mode */ - sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr); -@@ -1091,7 +1080,7 @@ static void sc16is7xx_set_termios(struct uart_port *port, - SC16IS7XX_LCR_CONF_MODE_B); - - /* Configure flow control */ -- regcache_cache_bypass(s->regmap, true); -+ regcache_cache_bypass(one->regmap, true); - sc16is7xx_port_write(port, SC16IS7XX_XON1_REG, termios->c_cc[VSTART]); - sc16is7xx_port_write(port, SC16IS7XX_XOFF1_REG, termios->c_cc[VSTOP]); - -@@ -1110,7 +1099,7 @@ static void sc16is7xx_set_termios(struct uart_port *port, - SC16IS7XX_EFR_REG, - SC16IS7XX_EFR_FLOWCTRL_BITS, - flow); -- regcache_cache_bypass(s->regmap, false); -+ regcache_cache_bypass(one->regmap, false); - - /* Update LCR register */ - sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr); -@@ -1161,7 +1150,6 @@ static int sc16is7xx_config_rs485(struct uart_port *port, struct ktermios *termi - static int sc16is7xx_startup(struct uart_port *port) - { - struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); -- struct sc16is7xx_port *s = dev_get_drvdata(port->dev); - unsigned int val; - unsigned long flags; - -@@ -1178,7 +1166,7 @@ static int sc16is7xx_startup(struct uart_port *port) - sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, - SC16IS7XX_LCR_CONF_MODE_B); - -- regcache_cache_bypass(s->regmap, true); -+ regcache_cache_bypass(one->regmap, true); - - /* Enable write access to enhanced features and internal clock div */ - sc16is7xx_port_update(port, SC16IS7XX_EFR_REG, -@@ -1196,7 +1184,7 @@ static int sc16is7xx_startup(struct uart_port *port) - SC16IS7XX_TCR_RX_RESUME(24) | - SC16IS7XX_TCR_RX_HALT(48)); - -- regcache_cache_bypass(s->regmap, false); -+ regcache_cache_bypass(one->regmap, false); - - /* Now, initialize the UART */ - sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, SC16IS7XX_LCR_WORD_LEN_8); -@@ -1477,7 +1465,7 @@ static int sc16is7xx_setup_mctrl_ports(struct sc16is7xx_port *s) - if (s->mctrl_mask) - regmap_update_bits( - s->regmap, -- SC16IS7XX_IOCONTROL_REG << SC16IS7XX_REG_SHIFT, -+ SC16IS7XX_IOCONTROL_REG, - SC16IS7XX_IOCONTROL_MODEM_A_BIT | - SC16IS7XX_IOCONTROL_MODEM_B_BIT, s->mctrl_mask); - -@@ -1492,7 +1480,7 @@ static const struct serial_rs485 sc16is7xx_rs485_supported = { - - static int sc16is7xx_probe(struct device *dev, - const struct sc16is7xx_devtype *devtype, -- struct regmap *regmap, int irq) -+ struct regmap *regmaps[], int irq) - { - unsigned long freq = 0, *pfreq = dev_get_platdata(dev); - unsigned int val; -@@ -1500,16 +1488,16 @@ static int sc16is7xx_probe(struct device *dev, - int i, ret; - struct sc16is7xx_port *s; - -- if (IS_ERR(regmap)) -- return PTR_ERR(regmap); -+ for (i = 0; i < devtype->nr_uart; i++) -+ if (IS_ERR(regmaps[i])) -+ return PTR_ERR(regmaps[i]); - - /* - * This device does not have an identification register that would - * tell us if we are really connected to the correct device. - * The best we can do is to check if communication is at all possible. - */ -- ret = regmap_read(regmap, -- SC16IS7XX_LSR_REG << SC16IS7XX_REG_SHIFT, &val); -+ ret = regmap_read(regmaps[0], SC16IS7XX_LSR_REG, &val); - if (ret < 0) - return -EPROBE_DEFER; - -@@ -1543,7 +1531,7 @@ static int sc16is7xx_probe(struct device *dev, - return -EINVAL; - } - -- s->regmap = regmap; -+ s->regmap = regmaps[0]; - s->devtype = devtype; - dev_set_drvdata(dev, s); - mutex_init(&s->efr_lock); -@@ -1558,8 +1546,8 @@ static int sc16is7xx_probe(struct device *dev, - sched_set_fifo(s->kworker_task); - - /* reset device, purging any pending irq / data */ -- regmap_write(s->regmap, SC16IS7XX_IOCONTROL_REG << SC16IS7XX_REG_SHIFT, -- SC16IS7XX_IOCONTROL_SRESET_BIT); -+ regmap_write(s->regmap, SC16IS7XX_IOCONTROL_REG, -+ SC16IS7XX_IOCONTROL_SRESET_BIT); - - for (i = 0; i < devtype->nr_uart; ++i) { - s->p[i].line = i; -@@ -1583,6 +1571,7 @@ static int sc16is7xx_probe(struct device *dev, - s->p[i].port.ops = &sc16is7xx_ops; - s->p[i].old_mctrl = 0; - s->p[i].port.line = sc16is7xx_alloc_line(); -+ s->p[i].regmap = regmaps[i]; - - if (s->p[i].port.line >= SC16IS7XX_MAX_DEVS) { - ret = -ENOMEM; -@@ -1611,13 +1600,13 @@ static int sc16is7xx_probe(struct device *dev, - sc16is7xx_port_write(&s->p[i].port, SC16IS7XX_LCR_REG, - SC16IS7XX_LCR_CONF_MODE_B); - -- regcache_cache_bypass(s->regmap, true); -+ regcache_cache_bypass(regmaps[i], true); - - /* Enable write access to enhanced features */ - sc16is7xx_port_write(&s->p[i].port, SC16IS7XX_EFR_REG, - SC16IS7XX_EFR_ENABLE_BIT); - -- regcache_cache_bypass(s->regmap, false); -+ regcache_cache_bypass(regmaps[i], false); - - /* Restore access to general registers */ - sc16is7xx_port_write(&s->p[i].port, SC16IS7XX_LCR_REG, 0x00); -@@ -1711,19 +1700,36 @@ static const struct of_device_id __maybe_unused sc16is7xx_dt_ids[] = { - MODULE_DEVICE_TABLE(of, sc16is7xx_dt_ids); - - static struct regmap_config regcfg = { -- .reg_bits = 7, -- .pad_bits = 1, -+ .reg_bits = 5, -+ .pad_bits = 3, - .val_bits = 8, - .cache_type = REGCACHE_RBTREE, - .volatile_reg = sc16is7xx_regmap_volatile, - .precious_reg = sc16is7xx_regmap_precious, -+ .max_register = SC16IS7XX_EFCR_REG, - }; - -+static const char *sc16is7xx_regmap_name(unsigned int port_id) -+{ -+ static char buf[6]; -+ -+ snprintf(buf, sizeof(buf), "port%d", port_id); -+ -+ return buf; -+} -+ -+static unsigned int sc16is7xx_regmap_port_mask(unsigned int port_id) -+{ -+ /* CH1,CH0 are at bits 2:1. */ -+ return port_id << 1; -+} -+ - #ifdef CONFIG_SERIAL_SC16IS7XX_SPI - static int sc16is7xx_spi_probe(struct spi_device *spi) - { - const struct sc16is7xx_devtype *devtype; -- struct regmap *regmap; -+ struct regmap *regmaps[2]; -+ unsigned int i; - int ret; - - /* Setup SPI bus */ -@@ -1748,11 +1754,20 @@ static int sc16is7xx_spi_probe(struct spi_device *spi) - devtype = (struct sc16is7xx_devtype *)id_entry->driver_data; - } - -- regcfg.max_register = (0xf << SC16IS7XX_REG_SHIFT) | -- (devtype->nr_uart - 1); -- regmap = devm_regmap_init_spi(spi, ®cfg); -+ for (i = 0; i < devtype->nr_uart; i++) { -+ regcfg.name = sc16is7xx_regmap_name(i); -+ /* -+ * If read_flag_mask is 0, the regmap code sets it to a default -+ * of 0x80. Since we specify our own mask, we must add the READ -+ * bit ourselves: -+ */ -+ regcfg.read_flag_mask = sc16is7xx_regmap_port_mask(i) | -+ SC16IS7XX_SPI_READ_BIT; -+ regcfg.write_flag_mask = sc16is7xx_regmap_port_mask(i); -+ regmaps[i] = devm_regmap_init_spi(spi, ®cfg); -+ } - -- return sc16is7xx_probe(&spi->dev, devtype, regmap, spi->irq); -+ return sc16is7xx_probe(&spi->dev, devtype, regmaps, spi->irq); - } - - static void sc16is7xx_spi_remove(struct spi_device *spi) -@@ -1791,7 +1806,8 @@ static int sc16is7xx_i2c_probe(struct i2c_client *i2c) - { - const struct i2c_device_id *id = i2c_client_get_device_id(i2c); - const struct sc16is7xx_devtype *devtype; -- struct regmap *regmap; -+ struct regmap *regmaps[2]; -+ unsigned int i; - - if (i2c->dev.of_node) { - devtype = device_get_match_data(&i2c->dev); -@@ -1801,11 +1817,14 @@ static int sc16is7xx_i2c_probe(struct i2c_client *i2c) - devtype = (struct sc16is7xx_devtype *)id->driver_data; - } - -- regcfg.max_register = (0xf << SC16IS7XX_REG_SHIFT) | -- (devtype->nr_uart - 1); -- regmap = devm_regmap_init_i2c(i2c, ®cfg); -+ for (i = 0; i < devtype->nr_uart; i++) { -+ regcfg.name = sc16is7xx_regmap_name(i); -+ regcfg.read_flag_mask = sc16is7xx_regmap_port_mask(i); -+ regcfg.write_flag_mask = sc16is7xx_regmap_port_mask(i); -+ regmaps[i] = devm_regmap_init_i2c(i2c, ®cfg); -+ } - -- return sc16is7xx_probe(&i2c->dev, devtype, regmap, i2c->irq); -+ return sc16is7xx_probe(&i2c->dev, devtype, regmaps, i2c->irq); - } - - static void sc16is7xx_i2c_remove(struct i2c_client *client) --- -2.43.2 - -From 052181baa70e2504cfc6292f5c350420dfff6bef Mon Sep 17 00:00:00 2001 -From: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Date: Mon, 11 Dec 2023 12:13:49 -0500 -Subject: [PATCH 0799/1501] serial: sc16is7xx: remove global regmap from struct - sc16is7xx_port -Content-Length: 3056 -Lines: 87 - -commit f6959c5217bd799bcb770b95d3c09b3244e175c6 upstream. - -Remove global struct regmap so that it is more obvious that this -regmap is to be used only in the probe function. - -Also add a comment to that effect in probe function. - -Fixes: 3837a0379533 ("serial: sc16is7xx: improve regmap debugfs by using one regmap per port") -Cc: <stable@vger.kernel.org> -Suggested-by: Andy Shevchenko <andy.shevchenko@gmail.com> -Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Link: https://lore.kernel.org/r/20231211171353.2901416-3-hugo@hugovil.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/tty/serial/sc16is7xx.c | 15 +++++++++------ - 1 file changed, 9 insertions(+), 6 deletions(-) - -diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c -index e956a242ecc5..cd46f53f8b7a 100644 ---- a/drivers/tty/serial/sc16is7xx.c -+++ b/drivers/tty/serial/sc16is7xx.c -@@ -335,7 +335,6 @@ struct sc16is7xx_one { - - struct sc16is7xx_port { - const struct sc16is7xx_devtype *devtype; -- struct regmap *regmap; - struct clk *clk; - #ifdef CONFIG_GPIOLIB - struct gpio_chip gpio; -@@ -1435,7 +1434,8 @@ static void sc16is7xx_setup_irda_ports(struct sc16is7xx_port *s) - /* - * Configure ports designated to operate as modem control lines. - */ --static int sc16is7xx_setup_mctrl_ports(struct sc16is7xx_port *s) -+static int sc16is7xx_setup_mctrl_ports(struct sc16is7xx_port *s, -+ struct regmap *regmap) - { - int i; - int ret; -@@ -1464,7 +1464,7 @@ static int sc16is7xx_setup_mctrl_ports(struct sc16is7xx_port *s) - - if (s->mctrl_mask) - regmap_update_bits( -- s->regmap, -+ regmap, - SC16IS7XX_IOCONTROL_REG, - SC16IS7XX_IOCONTROL_MODEM_A_BIT | - SC16IS7XX_IOCONTROL_MODEM_B_BIT, s->mctrl_mask); -@@ -1496,6 +1496,10 @@ static int sc16is7xx_probe(struct device *dev, - * This device does not have an identification register that would - * tell us if we are really connected to the correct device. - * The best we can do is to check if communication is at all possible. -+ * -+ * Note: regmap[0] is used in the probe function to access registers -+ * common to all channels/ports, as it is guaranteed to be present on -+ * all variants. - */ - ret = regmap_read(regmaps[0], SC16IS7XX_LSR_REG, &val); - if (ret < 0) -@@ -1531,7 +1535,6 @@ static int sc16is7xx_probe(struct device *dev, - return -EINVAL; - } - -- s->regmap = regmaps[0]; - s->devtype = devtype; - dev_set_drvdata(dev, s); - mutex_init(&s->efr_lock); -@@ -1546,7 +1549,7 @@ static int sc16is7xx_probe(struct device *dev, - sched_set_fifo(s->kworker_task); - - /* reset device, purging any pending irq / data */ -- regmap_write(s->regmap, SC16IS7XX_IOCONTROL_REG, -+ regmap_write(regmaps[0], SC16IS7XX_IOCONTROL_REG, - SC16IS7XX_IOCONTROL_SRESET_BIT); - - for (i = 0; i < devtype->nr_uart; ++i) { -@@ -1617,7 +1620,7 @@ static int sc16is7xx_probe(struct device *dev, - - sc16is7xx_setup_irda_ports(s); - -- ret = sc16is7xx_setup_mctrl_ports(s); -+ ret = sc16is7xx_setup_mctrl_ports(s, regmaps[0]); - if (ret) - goto out_ports; - --- -2.43.2 - -From b7fbd3e4c2404e02455b555113ca240d9b39805f Mon Sep 17 00:00:00 2001 -From: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Date: Mon, 11 Dec 2023 12:13:50 -0500 -Subject: [PATCH 0800/1501] serial: sc16is7xx: remove unused line structure - member -Content-Length: 1253 -Lines: 36 - -commit 41a308cbedb2a68a6831f0f2e992e296c4b8aff0 upstream. - -Now that the driver has been converted to use one regmap per port, the line -structure member is no longer used, so remove it. - -Fixes: 3837a0379533 ("serial: sc16is7xx: improve regmap debugfs by using one regmap per port") -Cc: <stable@vger.kernel.org> -Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Link: https://lore.kernel.org/r/20231211171353.2901416-4-hugo@hugovil.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/tty/serial/sc16is7xx.c | 2 -- - 1 file changed, 2 deletions(-) - -diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c -index cd46f53f8b7a..fda3b402c187 100644 ---- a/drivers/tty/serial/sc16is7xx.c -+++ b/drivers/tty/serial/sc16is7xx.c -@@ -323,7 +323,6 @@ struct sc16is7xx_one_config { - - struct sc16is7xx_one { - struct uart_port port; -- u8 line; - struct regmap *regmap; - struct kthread_work tx_work; - struct kthread_work reg_work; -@@ -1553,7 +1552,6 @@ static int sc16is7xx_probe(struct device *dev, - SC16IS7XX_IOCONTROL_SRESET_BIT); - - for (i = 0; i < devtype->nr_uart; ++i) { -- s->p[i].line = i; - /* Initialize port data */ - s->p[i].port.dev = dev; - s->p[i].port.irq = irq; --- -2.43.2 - -From dbe196ca489f3833e0f9eeb86ac346194f131c91 Mon Sep 17 00:00:00 2001 -From: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Date: Mon, 11 Dec 2023 12:13:51 -0500 -Subject: [PATCH 0801/1501] serial: sc16is7xx: change EFR lock to operate on - each channels -Content-Length: 6571 -Lines: 203 - -commit 4409df5866b7ff7686ba27e449ca97a92ee063c9 upstream. - -Now that the driver has been converted to use one regmap per port, change -efr locking to operate on a channel basis instead of on the whole IC. - -Fixes: 3837a0379533 ("serial: sc16is7xx: improve regmap debugfs by using one regmap per port") -Cc: <stable@vger.kernel.org> # 6.1.x: 3837a03 serial: sc16is7xx: improve regmap debugfs by using one regmap per port -Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Link: https://lore.kernel.org/r/20231211171353.2901416-5-hugo@hugovil.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/tty/serial/sc16is7xx.c | 49 ++++++++++++++++++---------------- - 1 file changed, 26 insertions(+), 23 deletions(-) - -diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c -index fda3b402c187..b37e7f45632b 100644 ---- a/drivers/tty/serial/sc16is7xx.c -+++ b/drivers/tty/serial/sc16is7xx.c -@@ -324,6 +324,7 @@ struct sc16is7xx_one_config { - struct sc16is7xx_one { - struct uart_port port; - struct regmap *regmap; -+ struct mutex efr_lock; /* EFR registers access */ - struct kthread_work tx_work; - struct kthread_work reg_work; - struct kthread_delayed_work ms_work; -@@ -343,7 +344,6 @@ struct sc16is7xx_port { - unsigned char buf[SC16IS7XX_FIFO_SIZE]; - struct kthread_worker kworker; - struct task_struct *kworker_task; -- struct mutex efr_lock; - struct sc16is7xx_one p[]; - }; - -@@ -495,7 +495,6 @@ static bool sc16is7xx_regmap_precious(struct device *dev, unsigned int reg) - - static int sc16is7xx_set_baud(struct uart_port *port, int baud) - { -- struct sc16is7xx_port *s = dev_get_drvdata(port->dev); - struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); - u8 lcr; - u8 prescaler = 0; -@@ -519,7 +518,7 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) - * because the bulk of the interrupt processing is run as a workqueue - * job in thread context. - */ -- mutex_lock(&s->efr_lock); -+ mutex_lock(&one->efr_lock); - - lcr = sc16is7xx_port_read(port, SC16IS7XX_LCR_REG); - -@@ -538,7 +537,7 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) - /* Put LCR back to the normal mode */ - sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr); - -- mutex_unlock(&s->efr_lock); -+ mutex_unlock(&one->efr_lock); - - sc16is7xx_port_update(port, SC16IS7XX_MCR_REG, - SC16IS7XX_MCR_CLKSEL_BIT, -@@ -706,11 +705,10 @@ static unsigned int sc16is7xx_get_hwmctrl(struct uart_port *port) - static void sc16is7xx_update_mlines(struct sc16is7xx_one *one) - { - struct uart_port *port = &one->port; -- struct sc16is7xx_port *s = dev_get_drvdata(port->dev); - unsigned long flags; - unsigned int status, changed; - -- lockdep_assert_held_once(&s->efr_lock); -+ lockdep_assert_held_once(&one->efr_lock); - - status = sc16is7xx_get_hwmctrl(port); - changed = status ^ one->old_mctrl; -@@ -736,15 +734,20 @@ static void sc16is7xx_update_mlines(struct sc16is7xx_one *one) - - static bool sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) - { -+ bool rc = true; - struct uart_port *port = &s->p[portno].port; -+ struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); -+ -+ mutex_lock(&one->efr_lock); - - do { - unsigned int iir, rxlen; -- struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); - - iir = sc16is7xx_port_read(port, SC16IS7XX_IIR_REG); -- if (iir & SC16IS7XX_IIR_NO_INT_BIT) -- return false; -+ if (iir & SC16IS7XX_IIR_NO_INT_BIT) { -+ rc = false; -+ goto out_port_irq; -+ } - - iir &= SC16IS7XX_IIR_ID_MASK; - -@@ -784,15 +787,17 @@ static bool sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) - break; - } - } while (0); -- return true; -+ -+out_port_irq: -+ mutex_unlock(&one->efr_lock); -+ -+ return rc; - } - - static irqreturn_t sc16is7xx_irq(int irq, void *dev_id) - { - struct sc16is7xx_port *s = (struct sc16is7xx_port *)dev_id; - -- mutex_lock(&s->efr_lock); -- - while (1) { - bool keep_polling = false; - int i; -@@ -803,24 +808,22 @@ static irqreturn_t sc16is7xx_irq(int irq, void *dev_id) - break; - } - -- mutex_unlock(&s->efr_lock); -- - return IRQ_HANDLED; - } - - static void sc16is7xx_tx_proc(struct kthread_work *ws) - { - struct uart_port *port = &(to_sc16is7xx_one(ws, tx_work)->port); -- struct sc16is7xx_port *s = dev_get_drvdata(port->dev); -+ struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); - unsigned long flags; - - if ((port->rs485.flags & SER_RS485_ENABLED) && - (port->rs485.delay_rts_before_send > 0)) - msleep(port->rs485.delay_rts_before_send); - -- mutex_lock(&s->efr_lock); -+ mutex_lock(&one->efr_lock); - sc16is7xx_handle_tx(port); -- mutex_unlock(&s->efr_lock); -+ mutex_unlock(&one->efr_lock); - - uart_port_lock_irqsave(port, &flags); - sc16is7xx_ier_set(port, SC16IS7XX_IER_THRI_BIT); -@@ -927,9 +930,9 @@ static void sc16is7xx_ms_proc(struct kthread_work *ws) - struct sc16is7xx_port *s = dev_get_drvdata(one->port.dev); - - if (one->port.state) { -- mutex_lock(&s->efr_lock); -+ mutex_lock(&one->efr_lock); - sc16is7xx_update_mlines(one); -- mutex_unlock(&s->efr_lock); -+ mutex_unlock(&one->efr_lock); - - kthread_queue_delayed_work(&s->kworker, &one->ms_work, HZ); - } -@@ -1013,7 +1016,6 @@ static void sc16is7xx_set_termios(struct uart_port *port, - struct ktermios *termios, - const struct ktermios *old) - { -- struct sc16is7xx_port *s = dev_get_drvdata(port->dev); - struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); - unsigned int lcr, flow = 0; - int baud; -@@ -1072,7 +1074,7 @@ static void sc16is7xx_set_termios(struct uart_port *port, - port->ignore_status_mask |= SC16IS7XX_LSR_BRK_ERROR_MASK; - - /* As above, claim the mutex while accessing the EFR. */ -- mutex_lock(&s->efr_lock); -+ mutex_lock(&one->efr_lock); - - sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, - SC16IS7XX_LCR_CONF_MODE_B); -@@ -1102,7 +1104,7 @@ static void sc16is7xx_set_termios(struct uart_port *port, - /* Update LCR register */ - sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr); - -- mutex_unlock(&s->efr_lock); -+ mutex_unlock(&one->efr_lock); - - /* Get baud rate generator configuration */ - baud = uart_get_baud_rate(port, termios, old, -@@ -1536,7 +1538,6 @@ static int sc16is7xx_probe(struct device *dev, - - s->devtype = devtype; - dev_set_drvdata(dev, s); -- mutex_init(&s->efr_lock); - - kthread_init_worker(&s->kworker); - s->kworker_task = kthread_run(kthread_worker_fn, &s->kworker, -@@ -1579,6 +1580,8 @@ static int sc16is7xx_probe(struct device *dev, - goto out_ports; - } - -+ mutex_init(&s->p[i].efr_lock); -+ - ret = uart_get_rs485_mode(&s->p[i].port); - if (ret) - goto out_ports; --- -2.43.2 - -From aa7cb4787698add9367b19f7afc667662c9bdb23 Mon Sep 17 00:00:00 2001 -From: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Date: Mon, 11 Dec 2023 12:13:52 -0500 -Subject: [PATCH 0802/1501] serial: sc16is7xx: convert from _raw_ to _noinc_ - regmap functions for FIFO -Content-Length: 3345 -Lines: 80 - -commit dbf4ab821804df071c8b566d9813083125e6d97b upstream. - -The SC16IS7XX IC supports a burst mode to access the FIFOs where the -initial register address is sent ($00), followed by all the FIFO data -without having to resend the register address each time. In this mode, the -IC doesn't increment the register address for each R/W byte. - -The regmap_raw_read() and regmap_raw_write() are functions which can -perform IO over multiple registers. They are currently used to read/write -from/to the FIFO, and although they operate correctly in this burst mode on -the SPI bus, they would corrupt the regmap cache if it was not disabled -manually. The reason is that when the R/W size is more than 1 byte, these -functions assume that the register address is incremented and handle the -cache accordingly. - -Convert FIFO R/W functions to use the regmap _noinc_ versions in order to -remove the manual cache control which was a workaround when using the -_raw_ versions. FIFO registers are properly declared as volatile so -cache will not be used/updated for FIFO accesses. - -Fixes: dfeae619d781 ("serial: sc16is7xx") -Cc: <stable@vger.kernel.org> -Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Link: https://lore.kernel.org/r/20231211171353.2901416-6-hugo@hugovil.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/tty/serial/sc16is7xx.c | 17 +++++++++++------ - 1 file changed, 11 insertions(+), 6 deletions(-) - -diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c -index b37e7f45632b..5fd3167d7021 100644 ---- a/drivers/tty/serial/sc16is7xx.c -+++ b/drivers/tty/serial/sc16is7xx.c -@@ -382,9 +382,7 @@ static void sc16is7xx_fifo_read(struct uart_port *port, unsigned int rxlen) - struct sc16is7xx_port *s = dev_get_drvdata(port->dev); - struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); - -- regcache_cache_bypass(one->regmap, true); -- regmap_raw_read(one->regmap, SC16IS7XX_RHR_REG, s->buf, rxlen); -- regcache_cache_bypass(one->regmap, false); -+ regmap_noinc_read(one->regmap, SC16IS7XX_RHR_REG, s->buf, rxlen); - } - - static void sc16is7xx_fifo_write(struct uart_port *port, u8 to_send) -@@ -399,9 +397,7 @@ static void sc16is7xx_fifo_write(struct uart_port *port, u8 to_send) - if (unlikely(!to_send)) - return; - -- regcache_cache_bypass(one->regmap, true); -- regmap_raw_write(one->regmap, SC16IS7XX_THR_REG, s->buf, to_send); -- regcache_cache_bypass(one->regmap, false); -+ regmap_noinc_write(one->regmap, SC16IS7XX_THR_REG, s->buf, to_send); - } - - static void sc16is7xx_port_update(struct uart_port *port, u8 reg, -@@ -493,6 +489,11 @@ static bool sc16is7xx_regmap_precious(struct device *dev, unsigned int reg) - return false; - } - -+static bool sc16is7xx_regmap_noinc(struct device *dev, unsigned int reg) -+{ -+ return reg == SC16IS7XX_RHR_REG; -+} -+ - static int sc16is7xx_set_baud(struct uart_port *port, int baud) - { - struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); -@@ -1710,6 +1711,10 @@ static struct regmap_config regcfg = { - .cache_type = REGCACHE_RBTREE, - .volatile_reg = sc16is7xx_regmap_volatile, - .precious_reg = sc16is7xx_regmap_precious, -+ .writeable_noinc_reg = sc16is7xx_regmap_noinc, -+ .readable_noinc_reg = sc16is7xx_regmap_noinc, -+ .max_raw_read = SC16IS7XX_FIFO_SIZE, -+ .max_raw_write = SC16IS7XX_FIFO_SIZE, - .max_register = SC16IS7XX_EFCR_REG, - }; - --- -2.43.2 - -From 181acce4f316d3dc3266be0b27a45c2cbbfd1dab Mon Sep 17 00:00:00 2001 -From: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Date: Mon, 11 Dec 2023 12:13:53 -0500 -Subject: [PATCH 0803/1501] serial: sc16is7xx: fix unconditional activation of - THRI interrupt -Content-Length: 2848 -Lines: 67 - -commit 9915753037eba7135b209fef4f2afeca841af816 upstream. - -Commit cc4c1d05eb10 ("sc16is7xx: Properly resume TX after stop") changed -behavior to unconditionnaly set the THRI interrupt in sc16is7xx_tx_proc(). - -For example when sending a 65 bytes message, and assuming the Tx FIFO is -initially empty, sc16is7xx_handle_tx() will write the first 64 bytes of the -message to the FIFO and sc16is7xx_tx_proc() will then activate THRI. When -the THRI IRQ is fired, the driver will write the remaining byte of the -message to the FIFO, and disable THRI by calling sc16is7xx_stop_tx(). - -When sending a 2 bytes message, sc16is7xx_handle_tx() will write the 2 -bytes of the message to the FIFO and call sc16is7xx_stop_tx(), disabling -THRI. After sc16is7xx_handle_tx() exits, control returns to -sc16is7xx_tx_proc() which will unconditionally set THRI. When the THRI IRQ -is fired, the driver simply acknowledges the interrupt and does nothing -more, since all the data has already been written to the FIFO. This results -in 2 register writes and 4 register reads all for nothing and taking -precious cycles from the I2C/SPI bus. - -Fix this by enabling the THRI interrupt only when we fill the Tx FIFO to -its maximum capacity and there are remaining bytes to send in the message. - -Fixes: cc4c1d05eb10 ("sc16is7xx: Properly resume TX after stop") -Cc: <stable@vger.kernel.org> -Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Link: https://lore.kernel.org/r/20231211171353.2901416-7-hugo@hugovil.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/tty/serial/sc16is7xx.c | 7 ++----- - 1 file changed, 2 insertions(+), 5 deletions(-) - -diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c -index 5fd3167d7021..1e6f69127a35 100644 ---- a/drivers/tty/serial/sc16is7xx.c -+++ b/drivers/tty/serial/sc16is7xx.c -@@ -688,6 +688,8 @@ static void sc16is7xx_handle_tx(struct uart_port *port) - - if (uart_circ_empty(xmit)) - sc16is7xx_stop_tx(port); -+ else -+ sc16is7xx_ier_set(port, SC16IS7XX_IER_THRI_BIT); - uart_port_unlock_irqrestore(port, flags); - } - -@@ -816,7 +818,6 @@ static void sc16is7xx_tx_proc(struct kthread_work *ws) - { - struct uart_port *port = &(to_sc16is7xx_one(ws, tx_work)->port); - struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); -- unsigned long flags; - - if ((port->rs485.flags & SER_RS485_ENABLED) && - (port->rs485.delay_rts_before_send > 0)) -@@ -825,10 +826,6 @@ static void sc16is7xx_tx_proc(struct kthread_work *ws) - mutex_lock(&one->efr_lock); - sc16is7xx_handle_tx(port); - mutex_unlock(&one->efr_lock); -- -- uart_port_lock_irqsave(port, &flags); -- sc16is7xx_ier_set(port, SC16IS7XX_IER_THRI_BIT); -- uart_port_unlock_irqrestore(port, flags); - } - - static void sc16is7xx_reconf_rs485(struct uart_port *port) --- -2.43.2 - -From ec79957c2d592fb530471089818ee4f9396c5919 Mon Sep 17 00:00:00 2001 -From: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Date: Thu, 21 Dec 2023 18:18:08 -0500 -Subject: [PATCH 0804/1501] serial: sc16is7xx: fix invalid sc16is7xx_lines - bitfield in case of probe error -Content-Length: 4345 -Lines: 125 - -commit 8a1060ce974919f2a79807527ad82ac39336eda2 upstream. - -If an error occurs during probing, the sc16is7xx_lines bitfield may be left -in a state that doesn't represent the correct state of lines allocation. - -For example, in a system with two SC16 devices, if an error occurs only -during probing of channel (port) B of the second device, sc16is7xx_lines -final state will be 00001011b instead of the expected 00000011b. - -This is caused in part because of the "i--" in the for/loop located in -the out_ports: error path. - -Fix this by checking the return value of uart_add_one_port() and set line -allocation bit only if this was successful. This allows the refactor of -the obfuscated for(i--...) loop in the error path, and properly call -uart_remove_one_port() only when needed, and properly unset line allocation -bits. - -Also use same mechanism in remove() when calling uart_remove_one_port(). - -Fixes: c64349722d14 ("sc16is7xx: support multiple devices") -Cc: <stable@vger.kernel.org> -Cc: Yury Norov <yury.norov@gmail.com> -Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Link: https://lore.kernel.org/r/20231221231823.2327894-2-hugo@hugovil.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/tty/serial/sc16is7xx.c | 44 ++++++++++++++-------------------- - 1 file changed, 18 insertions(+), 26 deletions(-) - -diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c -index 1e6f69127a35..b341f80e0f83 100644 ---- a/drivers/tty/serial/sc16is7xx.c -+++ b/drivers/tty/serial/sc16is7xx.c -@@ -408,19 +408,6 @@ static void sc16is7xx_port_update(struct uart_port *port, u8 reg, - regmap_update_bits(one->regmap, reg, mask, val); - } - --static int sc16is7xx_alloc_line(void) --{ -- int i; -- -- BUILD_BUG_ON(SC16IS7XX_MAX_DEVS > BITS_PER_LONG); -- -- for (i = 0; i < SC16IS7XX_MAX_DEVS; i++) -- if (!test_and_set_bit(i, &sc16is7xx_lines)) -- break; -- -- return i; --} -- - static void sc16is7xx_power(struct uart_port *port, int on) - { - sc16is7xx_port_update(port, SC16IS7XX_IER_REG, -@@ -1551,6 +1538,13 @@ static int sc16is7xx_probe(struct device *dev, - SC16IS7XX_IOCONTROL_SRESET_BIT); - - for (i = 0; i < devtype->nr_uart; ++i) { -+ s->p[i].port.line = find_first_zero_bit(&sc16is7xx_lines, -+ SC16IS7XX_MAX_DEVS); -+ if (s->p[i].port.line >= SC16IS7XX_MAX_DEVS) { -+ ret = -ERANGE; -+ goto out_ports; -+ } -+ - /* Initialize port data */ - s->p[i].port.dev = dev; - s->p[i].port.irq = irq; -@@ -1570,14 +1564,8 @@ static int sc16is7xx_probe(struct device *dev, - s->p[i].port.rs485_supported = sc16is7xx_rs485_supported; - s->p[i].port.ops = &sc16is7xx_ops; - s->p[i].old_mctrl = 0; -- s->p[i].port.line = sc16is7xx_alloc_line(); - s->p[i].regmap = regmaps[i]; - -- if (s->p[i].port.line >= SC16IS7XX_MAX_DEVS) { -- ret = -ENOMEM; -- goto out_ports; -- } -- - mutex_init(&s->p[i].efr_lock); - - ret = uart_get_rs485_mode(&s->p[i].port); -@@ -1595,8 +1583,13 @@ static int sc16is7xx_probe(struct device *dev, - kthread_init_work(&s->p[i].tx_work, sc16is7xx_tx_proc); - kthread_init_work(&s->p[i].reg_work, sc16is7xx_reg_proc); - kthread_init_delayed_work(&s->p[i].ms_work, sc16is7xx_ms_proc); -+ - /* Register port */ -- uart_add_one_port(&sc16is7xx_uart, &s->p[i].port); -+ ret = uart_add_one_port(&sc16is7xx_uart, &s->p[i].port); -+ if (ret) -+ goto out_ports; -+ -+ set_bit(s->p[i].port.line, &sc16is7xx_lines); - - /* Enable EFR */ - sc16is7xx_port_write(&s->p[i].port, SC16IS7XX_LCR_REG, -@@ -1654,10 +1647,9 @@ static int sc16is7xx_probe(struct device *dev, - #endif - - out_ports: -- for (i--; i >= 0; i--) { -- uart_remove_one_port(&sc16is7xx_uart, &s->p[i].port); -- clear_bit(s->p[i].port.line, &sc16is7xx_lines); -- } -+ for (i = 0; i < devtype->nr_uart; i++) -+ if (test_and_clear_bit(s->p[i].port.line, &sc16is7xx_lines)) -+ uart_remove_one_port(&sc16is7xx_uart, &s->p[i].port); - - kthread_stop(s->kworker_task); - -@@ -1679,8 +1671,8 @@ static void sc16is7xx_remove(struct device *dev) - - for (i = 0; i < s->devtype->nr_uart; i++) { - kthread_cancel_delayed_work_sync(&s->p[i].ms_work); -- uart_remove_one_port(&sc16is7xx_uart, &s->p[i].port); -- clear_bit(s->p[i].port.line, &sc16is7xx_lines); -+ if (test_and_clear_bit(s->p[i].port.line, &sc16is7xx_lines)) -+ uart_remove_one_port(&sc16is7xx_uart, &s->p[i].port); - sc16is7xx_power(&s->p[i].port, 0); - } - --- -2.43.2 - -From 30b6b173fc8db6df58aef834cbbe487a81fe271b Mon Sep 17 00:00:00 2001 -From: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Date: Thu, 21 Dec 2023 18:18:11 -0500 -Subject: [PATCH 0805/1501] serial: sc16is7xx: remove obsolete loop in - sc16is7xx_port_irq() -Content-Length: 3754 -Lines: 123 - -commit ed647256e8f226241ecff7baaecdb8632ffc7ec1 upstream. - -Commit 834449872105 ("sc16is7xx: Fix for multi-channel stall") changed -sc16is7xx_port_irq() from looping multiple times when there was still -interrupts to serve. It simply changed the do {} while(1) loop to a -do {} while(0) loop, which makes the loop itself now obsolete. - -Clean the code by removing this obsolete do {} while(0) loop. - -Fixes: 834449872105 ("sc16is7xx: Fix for multi-channel stall") -Cc: <stable@vger.kernel.org> -Suggested-by: Andy Shevchenko <andy.shevchenko@gmail.com> -Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Link: https://lore.kernel.org/r/20231221231823.2327894-5-hugo@hugovil.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/tty/serial/sc16is7xx.c | 81 ++++++++++++++++------------------ - 1 file changed, 39 insertions(+), 42 deletions(-) - -diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c -index b341f80e0f83..f88bed8fed82 100644 ---- a/drivers/tty/serial/sc16is7xx.c -+++ b/drivers/tty/serial/sc16is7xx.c -@@ -725,58 +725,55 @@ static void sc16is7xx_update_mlines(struct sc16is7xx_one *one) - static bool sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) - { - bool rc = true; -+ unsigned int iir, rxlen; - struct uart_port *port = &s->p[portno].port; - struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); - - mutex_lock(&one->efr_lock); - -- do { -- unsigned int iir, rxlen; -+ iir = sc16is7xx_port_read(port, SC16IS7XX_IIR_REG); -+ if (iir & SC16IS7XX_IIR_NO_INT_BIT) { -+ rc = false; -+ goto out_port_irq; -+ } - -- iir = sc16is7xx_port_read(port, SC16IS7XX_IIR_REG); -- if (iir & SC16IS7XX_IIR_NO_INT_BIT) { -- rc = false; -- goto out_port_irq; -- } -+ iir &= SC16IS7XX_IIR_ID_MASK; - -- iir &= SC16IS7XX_IIR_ID_MASK; -+ switch (iir) { -+ case SC16IS7XX_IIR_RDI_SRC: -+ case SC16IS7XX_IIR_RLSE_SRC: -+ case SC16IS7XX_IIR_RTOI_SRC: -+ case SC16IS7XX_IIR_XOFFI_SRC: -+ rxlen = sc16is7xx_port_read(port, SC16IS7XX_RXLVL_REG); - -- switch (iir) { -- case SC16IS7XX_IIR_RDI_SRC: -- case SC16IS7XX_IIR_RLSE_SRC: -- case SC16IS7XX_IIR_RTOI_SRC: -- case SC16IS7XX_IIR_XOFFI_SRC: -- rxlen = sc16is7xx_port_read(port, SC16IS7XX_RXLVL_REG); -+ /* -+ * There is a silicon bug that makes the chip report a -+ * time-out interrupt but no data in the FIFO. This is -+ * described in errata section 18.1.4. -+ * -+ * When this happens, read one byte from the FIFO to -+ * clear the interrupt. -+ */ -+ if (iir == SC16IS7XX_IIR_RTOI_SRC && !rxlen) -+ rxlen = 1; - -- /* -- * There is a silicon bug that makes the chip report a -- * time-out interrupt but no data in the FIFO. This is -- * described in errata section 18.1.4. -- * -- * When this happens, read one byte from the FIFO to -- * clear the interrupt. -- */ -- if (iir == SC16IS7XX_IIR_RTOI_SRC && !rxlen) -- rxlen = 1; -- -- if (rxlen) -- sc16is7xx_handle_rx(port, rxlen, iir); -- break; -+ if (rxlen) -+ sc16is7xx_handle_rx(port, rxlen, iir); -+ break; - /* CTSRTS interrupt comes only when CTS goes inactive */ -- case SC16IS7XX_IIR_CTSRTS_SRC: -- case SC16IS7XX_IIR_MSI_SRC: -- sc16is7xx_update_mlines(one); -- break; -- case SC16IS7XX_IIR_THRI_SRC: -- sc16is7xx_handle_tx(port); -- break; -- default: -- dev_err_ratelimited(port->dev, -- "ttySC%i: Unexpected interrupt: %x", -- port->line, iir); -- break; -- } -- } while (0); -+ case SC16IS7XX_IIR_CTSRTS_SRC: -+ case SC16IS7XX_IIR_MSI_SRC: -+ sc16is7xx_update_mlines(one); -+ break; -+ case SC16IS7XX_IIR_THRI_SRC: -+ sc16is7xx_handle_tx(port); -+ break; -+ default: -+ dev_err_ratelimited(port->dev, -+ "ttySC%i: Unexpected interrupt: %x", -+ port->line, iir); -+ break; -+ } - - out_port_irq: - mutex_unlock(&one->efr_lock); --- -2.43.2 - -From 3554e2d33723eb95366e6f02f0502fc461790c43 Mon Sep 17 00:00:00 2001 -From: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Date: Thu, 21 Dec 2023 18:18:12 -0500 -Subject: [PATCH 0806/1501] serial: sc16is7xx: improve do/while loop in - sc16is7xx_irq() -Content-Length: 1387 -Lines: 46 - -commit d5078509c8b06c5c472a60232815e41af81c6446 upstream. - -Simplify and improve readability by replacing while(1) loop with -do {} while, and by using the keep_polling variable as the exit -condition, making it more explicit. - -Fixes: 834449872105 ("sc16is7xx: Fix for multi-channel stall") -Cc: <stable@vger.kernel.org> -Suggested-by: Andy Shevchenko <andy.shevchenko@gmail.com> -Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> -Link: https://lore.kernel.org/r/20231221231823.2327894-6-hugo@hugovil.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/tty/serial/sc16is7xx.c | 11 ++++++----- - 1 file changed, 6 insertions(+), 5 deletions(-) - -diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c -index f88bed8fed82..dba25e70903c 100644 ---- a/drivers/tty/serial/sc16is7xx.c -+++ b/drivers/tty/serial/sc16is7xx.c -@@ -783,17 +783,18 @@ static bool sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) - - static irqreturn_t sc16is7xx_irq(int irq, void *dev_id) - { -+ bool keep_polling; -+ - struct sc16is7xx_port *s = (struct sc16is7xx_port *)dev_id; - -- while (1) { -- bool keep_polling = false; -+ do { - int i; - -+ keep_polling = false; -+ - for (i = 0; i < s->devtype->nr_uart; ++i) - keep_polling |= sc16is7xx_port_irq(s, i); -- if (!keep_polling) -- break; -- } -+ } while (keep_polling); - - return IRQ_HANDLED; - } --- -2.43.2 - -From 5506bcf75d89bd28fb4645fc969e2a1eb0273083 Mon Sep 17 00:00:00 2001 -From: Charan Teja Kalla <quic_charante@quicinc.com> -Date: Fri, 24 Nov 2023 16:27:25 +0530 -Subject: [PATCH 0807/1501] mm: page_alloc: unreserve highatomic page blocks - before oom -Content-Length: 4013 -Lines: 101 - -commit ac3f3b0a55518056bc80ed32a41931c99e1f7d81 upstream. - -__alloc_pages_direct_reclaim() is called from slowpath allocation where -high atomic reserves can be unreserved after there is a progress in -reclaim and yet no suitable page is found. Later should_reclaim_retry() -gets called from slow path allocation to decide if the reclaim needs to be -retried before OOM kill path is taken. - -should_reclaim_retry() checks the available(reclaimable + free pages) -memory against the min wmark levels of a zone and returns: - -a) true, if it is above the min wmark so that slow path allocation will - do the reclaim retries. - -b) false, thus slowpath allocation takes oom kill path. - -should_reclaim_retry() can also unreserves the high atomic reserves **but -only after all the reclaim retries are exhausted.** - -In a case where there are almost none reclaimable memory and free pages -contains mostly the high atomic reserves but allocation context can't use -these high atomic reserves, makes the available memory below min wmark -levels hence false is returned from should_reclaim_retry() leading the -allocation request to take OOM kill path. This can turn into a early oom -kill if high atomic reserves are holding lot of free memory and -unreserving of them is not attempted. - -(early)OOM is encountered on a VM with the below state: -[ 295.998653] Normal free:7728kB boost:0kB min:804kB low:1004kB -high:1204kB reserved_highatomic:8192KB active_anon:4kB inactive_anon:0kB -active_file:24kB inactive_file:24kB unevictable:1220kB writepending:0kB -present:70732kB managed:49224kB mlocked:0kB bounce:0kB free_pcp:688kB -local_pcp:492kB free_cma:0kB -[ 295.998656] lowmem_reserve[]: 0 32 -[ 295.998659] Normal: 508*4kB (UMEH) 241*8kB (UMEH) 143*16kB (UMEH) -33*32kB (UH) 7*64kB (UH) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB -0*4096kB = 7752kB - -Per above log, the free memory of ~7MB exist in the high atomic reserves -is not freed up before falling back to oom kill path. - -Fix it by trying to unreserve the high atomic reserves in -should_reclaim_retry() before __alloc_pages_direct_reclaim() can fallback -to oom kill path. - -Link: https://lkml.kernel.org/r/1700823445-27531-1-git-send-email-quic_charante@quicinc.com -Fixes: 0aaa29a56e4f ("mm, page_alloc: reserve pageblocks for high-order atomic allocations on demand") -Signed-off-by: Charan Teja Kalla <quic_charante@quicinc.com> -Reported-by: Chris Goldsworthy <quic_cgoldswo@quicinc.com> -Suggested-by: Michal Hocko <mhocko@suse.com> -Acked-by: Michal Hocko <mhocko@suse.com> -Acked-by: David Rientjes <rientjes@google.com> -Cc: Chris Goldsworthy <quic_cgoldswo@quicinc.com> -Cc: David Hildenbrand <david@redhat.com> -Cc: Johannes Weiner <hannes@cmpxchg.org> -Cc: Mel Gorman <mgorman@techsingularity.net> -Cc: Pavankumar Kondeti <quic_pkondeti@quicinc.com> -Cc: Vlastimil Babka <vbabka@suse.cz> -Cc: Joakim Tjernlund <Joakim.Tjernlund@infinera.com> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - mm/page_alloc.c | 16 ++++++++-------- - 1 file changed, 8 insertions(+), 8 deletions(-) - -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 733732e7e0ba..6d2a74138f45 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -3951,14 +3951,9 @@ should_reclaim_retry(gfp_t gfp_mask, unsigned order, - else - (*no_progress_loops)++; - -- /* -- * Make sure we converge to OOM if we cannot make any progress -- * several times in the row. -- */ -- if (*no_progress_loops > MAX_RECLAIM_RETRIES) { -- /* Before OOM, exhaust highatomic_reserve */ -- return unreserve_highatomic_pageblock(ac, true); -- } -+ if (*no_progress_loops > MAX_RECLAIM_RETRIES) -+ goto out; -+ - - /* - * Keep reclaiming pages while there is a chance this will lead -@@ -4001,6 +3996,11 @@ should_reclaim_retry(gfp_t gfp_mask, unsigned order, - schedule_timeout_uninterruptible(1); - else - cond_resched(); -+out: -+ /* Before OOM, exhaust highatomic_reserve */ -+ if (!ret) -+ return unreserve_highatomic_pageblock(ac, true); -+ - return ret; - } - --- -2.43.2 - -From 9b1a6e31edf953542643466299b23d9c9e822e92 Mon Sep 17 00:00:00 2001 -From: Namjae Jeon <linkinjeon@kernel.org> -Date: Tue, 23 Jan 2024 20:42:24 +0900 -Subject: [PATCH 0808/1501] ksmbd: set v2 lease version on lease upgrade -Content-Length: 1442 -Lines: 39 - -[ Upstream commit bb05367a66a9990d2c561282f5620bb1dbe40c28 ] - -If file opened with v2 lease is upgraded with v1 lease, smb server -should response v2 lease create context to client. -This patch fix smb2.lease.v2_epoch2 test failure. - -This test case assumes the following scenario: - 1. smb2 create with v2 lease(R, LEASE1 key) - 2. smb server return smb2 create response with v2 lease context(R, -LEASE1 key, epoch + 1) - 3. smb2 create with v1 lease(RH, LEASE1 key) - 4. smb server return smb2 create response with v2 lease context(RH, -LEASE1 key, epoch + 2) - -i.e. If same client(same lease key) try to open a file that is being -opened with v2 lease with v1 lease, smb server should return v2 lease. - -Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> -Acked-by: Tom Talpey <tom@talpey.com> -Signed-off-by: Steve French <stfrench@microsoft.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/smb/server/oplock.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c -index e0eb7cb2a525..c58ff61cf7fd 100644 ---- a/fs/smb/server/oplock.c -+++ b/fs/smb/server/oplock.c -@@ -1036,6 +1036,7 @@ static void copy_lease(struct oplock_info *op1, struct oplock_info *op2) - lease2->duration = lease1->duration; - lease2->flags = lease1->flags; - lease2->epoch = lease1->epoch++; -+ lease2->version = lease1->version; - } - - static int add_lease_global_list(struct oplock_info *opinfo) --- -2.43.2 - -From aa74ce30a8a40d19a4256de4ae5322e71344a274 Mon Sep 17 00:00:00 2001 -From: Benjamin Berg <benjamin.berg@intel.com> -Date: Mon, 15 Jan 2024 11:18:05 +0100 -Subject: [PATCH 0809/1501] wifi: ath11k: rely on mac80211 debugfs handling for - vif -Content-Length: 6034 -Lines: 162 - -commit 556857aa1d0855aba02b1c63bc52b91ec63fc2cc upstream. - -mac80211 started to delete debugfs entries in certain cases, causing a -ath11k to crash when it tried to delete the entries later. Fix this by -relying on mac80211 to delete the entries when appropriate and adding -them from the vif_add_debugfs handler. - -Fixes: 0a3d898ee9a8 ("wifi: mac80211: add/remove driver debugfs entries as appropriate") -Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218364 -Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> -Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://msgid.link/20240115101805.1277949-1-benjamin@sipsolutions.net -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/net/wireless/ath/ath11k/core.h | 4 ---- - drivers/net/wireless/ath/ath11k/debugfs.c | 25 +++++++++-------------- - drivers/net/wireless/ath/ath11k/debugfs.h | 12 ++--------- - drivers/net/wireless/ath/ath11k/mac.c | 12 +---------- - 4 files changed, 13 insertions(+), 40 deletions(-) - -diff --git a/drivers/net/wireless/ath/ath11k/core.h b/drivers/net/wireless/ath/ath11k/core.h -index f12b606e2d2e..667d55e26156 100644 ---- a/drivers/net/wireless/ath/ath11k/core.h -+++ b/drivers/net/wireless/ath/ath11k/core.h -@@ -368,10 +368,6 @@ struct ath11k_vif { - struct ieee80211_chanctx_conf chanctx; - struct ath11k_arp_ns_offload arp_ns_offload; - struct ath11k_rekey_data rekey_data; -- --#ifdef CONFIG_ATH11K_DEBUGFS -- struct dentry *debugfs_twt; --#endif /* CONFIG_ATH11K_DEBUGFS */ - }; - - struct ath11k_vif_iter { -diff --git a/drivers/net/wireless/ath/ath11k/debugfs.c b/drivers/net/wireless/ath/ath11k/debugfs.c -index be76e7d1c436..0796f4d92b47 100644 ---- a/drivers/net/wireless/ath/ath11k/debugfs.c -+++ b/drivers/net/wireless/ath/ath11k/debugfs.c -@@ -1893,35 +1893,30 @@ static const struct file_operations ath11k_fops_twt_resume_dialog = { - .open = simple_open - }; - --void ath11k_debugfs_add_interface(struct ath11k_vif *arvif) -+void ath11k_debugfs_op_vif_add(struct ieee80211_hw *hw, -+ struct ieee80211_vif *vif) - { -+ struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif); - struct ath11k_base *ab = arvif->ar->ab; -+ struct dentry *debugfs_twt; - - if (arvif->vif->type != NL80211_IFTYPE_AP && - !(arvif->vif->type == NL80211_IFTYPE_STATION && - test_bit(WMI_TLV_SERVICE_STA_TWT, ab->wmi_ab.svc_map))) - return; - -- arvif->debugfs_twt = debugfs_create_dir("twt", -- arvif->vif->debugfs_dir); -- debugfs_create_file("add_dialog", 0200, arvif->debugfs_twt, -+ debugfs_twt = debugfs_create_dir("twt", -+ arvif->vif->debugfs_dir); -+ debugfs_create_file("add_dialog", 0200, debugfs_twt, - arvif, &ath11k_fops_twt_add_dialog); - -- debugfs_create_file("del_dialog", 0200, arvif->debugfs_twt, -+ debugfs_create_file("del_dialog", 0200, debugfs_twt, - arvif, &ath11k_fops_twt_del_dialog); - -- debugfs_create_file("pause_dialog", 0200, arvif->debugfs_twt, -+ debugfs_create_file("pause_dialog", 0200, debugfs_twt, - arvif, &ath11k_fops_twt_pause_dialog); - -- debugfs_create_file("resume_dialog", 0200, arvif->debugfs_twt, -+ debugfs_create_file("resume_dialog", 0200, debugfs_twt, - arvif, &ath11k_fops_twt_resume_dialog); - } - --void ath11k_debugfs_remove_interface(struct ath11k_vif *arvif) --{ -- if (!arvif->debugfs_twt) -- return; -- -- debugfs_remove_recursive(arvif->debugfs_twt); -- arvif->debugfs_twt = NULL; --} -diff --git a/drivers/net/wireless/ath/ath11k/debugfs.h b/drivers/net/wireless/ath/ath11k/debugfs.h -index 3af0169f6cf2..6f630b42e95c 100644 ---- a/drivers/net/wireless/ath/ath11k/debugfs.h -+++ b/drivers/net/wireless/ath/ath11k/debugfs.h -@@ -306,8 +306,8 @@ static inline int ath11k_debugfs_rx_filter(struct ath11k *ar) - return ar->debug.rx_filter; - } - --void ath11k_debugfs_add_interface(struct ath11k_vif *arvif); --void ath11k_debugfs_remove_interface(struct ath11k_vif *arvif); -+void ath11k_debugfs_op_vif_add(struct ieee80211_hw *hw, -+ struct ieee80211_vif *vif); - void ath11k_debugfs_add_dbring_entry(struct ath11k *ar, - enum wmi_direct_buffer_module id, - enum ath11k_dbg_dbr_event event, -@@ -386,14 +386,6 @@ static inline int ath11k_debugfs_get_fw_stats(struct ath11k *ar, - return 0; - } - --static inline void ath11k_debugfs_add_interface(struct ath11k_vif *arvif) --{ --} -- --static inline void ath11k_debugfs_remove_interface(struct ath11k_vif *arvif) --{ --} -- - static inline void - ath11k_debugfs_add_dbring_entry(struct ath11k *ar, - enum wmi_direct_buffer_module id, -diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c -index 7f7b39817773..71c6dab1aedb 100644 ---- a/drivers/net/wireless/ath/ath11k/mac.c -+++ b/drivers/net/wireless/ath/ath11k/mac.c -@@ -6750,13 +6750,6 @@ static int ath11k_mac_op_add_interface(struct ieee80211_hw *hw, - goto err; - } - -- /* In the case of hardware recovery, debugfs files are -- * not deleted since ieee80211_ops.remove_interface() is -- * not invoked. In such cases, try to delete the files. -- * These will be re-created later. -- */ -- ath11k_debugfs_remove_interface(arvif); -- - memset(arvif, 0, sizeof(*arvif)); - - arvif->ar = ar; -@@ -6933,8 +6926,6 @@ static int ath11k_mac_op_add_interface(struct ieee80211_hw *hw, - - ath11k_dp_vdev_tx_attach(ar, arvif); - -- ath11k_debugfs_add_interface(arvif); -- - if (vif->type != NL80211_IFTYPE_MONITOR && - test_bit(ATH11K_FLAG_MONITOR_CONF_ENABLED, &ar->monitor_flags)) { - ret = ath11k_mac_monitor_vdev_create(ar); -@@ -7050,8 +7041,6 @@ static void ath11k_mac_op_remove_interface(struct ieee80211_hw *hw, - /* Recalc txpower for remaining vdev */ - ath11k_mac_txpower_recalc(ar); - -- ath11k_debugfs_remove_interface(arvif); -- - /* TODO: recal traffic pause state based on the available vdevs */ - - mutex_unlock(&ar->conf_mutex); -@@ -9149,6 +9138,7 @@ static const struct ieee80211_ops ath11k_ops = { - #endif - - #ifdef CONFIG_ATH11K_DEBUGFS -+ .vif_add_debugfs = ath11k_debugfs_op_vif_add, - .sta_add_debugfs = ath11k_debugfs_sta_op_add, - #endif - --- -2.43.2 - -From bbaf2a0ecd0c5305a577bd1dc87b949a3d87dd7b Mon Sep 17 00:00:00 2001 -From: Jonathan Gray <jsg@jsg.id.au> -Date: Sat, 27 Jan 2024 12:03:59 +1100 -Subject: [PATCH 0810/1501] Revert "drm/amd: Enable PCIe PME from D3" -Content-Length: 844 -Lines: 27 - -This reverts commit 05f7a3475af0faa8bf77f8637c4a40349db4f78f. - -duplicated a change made in 6.7 -6967741d26c87300a51b5e50d4acd104bc1a9759 - -Cc: stable@vger.kernel.org # 6.7 -Signed-off-by: Jonathan Gray <jsg@jsg.id.au> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 -- - 1 file changed, 2 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -index f4174eebe993..c0e8e030b96f 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -@@ -2265,8 +2265,6 @@ static int amdgpu_pci_probe(struct pci_dev *pdev, - - pci_wake_from_d3(pdev, TRUE); - -- pci_wake_from_d3(pdev, TRUE); -- - /* - * For runpm implemented via BACO, PMFW will handle the - * timing for BACO in and out: --- -2.43.2 - -From ecfd93955994ecc2a1308f5ee4bd90c7fca9a8c6 Mon Sep 17 00:00:00 2001 -From: Namjae Jeon <linkinjeon@kernel.org> -Date: Tue, 23 Jan 2024 20:42:25 +0900 -Subject: [PATCH 0811/1501] ksmbd: fix potential circular locking issue in - smb2_set_ea() -Content-Length: 1716 -Lines: 51 - -[ Upstream commit 6fc0a265e1b932e5e97a038f99e29400a93baad0 ] - -smb2_set_ea() can be called in parent inode lock range. -So add get_write argument to smb2_set_ea() not to call nested -mnt_want_write(). - -Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> -Signed-off-by: Steve French <stfrench@microsoft.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/smb/server/smb2pdu.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index 948665f8370f..b67b2a7c1a43 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -2323,11 +2323,12 @@ static noinline int create_smb2_pipe(struct ksmbd_work *work) - * @eabuf: set info command buffer - * @buf_len: set info command buffer length - * @path: dentry path for get ea -+ * @get_write: get write access to a mount - * - * Return: 0 on success, otherwise error - */ - static int smb2_set_ea(struct smb2_ea_info *eabuf, unsigned int buf_len, -- const struct path *path) -+ const struct path *path, bool get_write) - { - struct mnt_idmap *idmap = mnt_idmap(path->mnt); - char *attr_name = NULL, *value; -@@ -3015,7 +3016,7 @@ int smb2_open(struct ksmbd_work *work) - - rc = smb2_set_ea(&ea_buf->ea, - le32_to_cpu(ea_buf->ccontext.DataLength), -- &path); -+ &path, false); - if (rc == -EOPNOTSUPP) - rc = 0; - else if (rc) -@@ -5992,7 +5993,7 @@ static int smb2_set_info_file(struct ksmbd_work *work, struct ksmbd_file *fp, - return -EINVAL; - - return smb2_set_ea((struct smb2_ea_info *)req->Buffer, -- buf_len, &fp->filp->f_path); -+ buf_len, &fp->filp->f_path, true); - } - case FILE_POSITION_INFORMATION: - { --- -2.43.2 - -From c9520770de70300d716528d07b6ed182e3a90be9 Mon Sep 17 00:00:00 2001 -From: Namjae Jeon <linkinjeon@kernel.org> -Date: Tue, 23 Jan 2024 20:42:26 +0900 -Subject: [PATCH 0812/1501] ksmbd: don't increment epoch if current state and - request state are same -Content-Length: 2038 -Lines: 55 - -[ Upstream commit b6e9a44e99603fe10e1d78901fdd97681a539612 ] - -If existing lease state and request state are same, don't increment -epoch in create context. - -Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> -Signed-off-by: Steve French <stfrench@microsoft.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/smb/server/oplock.c | 9 ++++++--- - 1 file changed, 6 insertions(+), 3 deletions(-) - -diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c -index c58ff61cf7fd..3209ace41ab4 100644 ---- a/fs/smb/server/oplock.c -+++ b/fs/smb/server/oplock.c -@@ -105,7 +105,7 @@ static int alloc_lease(struct oplock_info *opinfo, struct lease_ctx_info *lctx) - lease->is_dir = lctx->is_dir; - memcpy(lease->parent_lease_key, lctx->parent_lease_key, SMB2_LEASE_KEY_SIZE); - lease->version = lctx->version; -- lease->epoch = le16_to_cpu(lctx->epoch); -+ lease->epoch = le16_to_cpu(lctx->epoch) + 1; - INIT_LIST_HEAD(&opinfo->lease_entry); - opinfo->o_lease = lease; - -@@ -541,6 +541,9 @@ static struct oplock_info *same_client_has_lease(struct ksmbd_inode *ci, - continue; - } - -+ if (lctx->req_state != lease->state) -+ lease->epoch++; -+ - /* upgrading lease */ - if ((atomic_read(&ci->op_count) + - atomic_read(&ci->sop_count)) == 1) { -@@ -1035,7 +1038,7 @@ static void copy_lease(struct oplock_info *op1, struct oplock_info *op2) - SMB2_LEASE_KEY_SIZE); - lease2->duration = lease1->duration; - lease2->flags = lease1->flags; -- lease2->epoch = lease1->epoch++; -+ lease2->epoch = lease1->epoch; - lease2->version = lease1->version; - } - -@@ -1454,7 +1457,7 @@ void create_lease_buf(u8 *rbuf, struct lease *lease) - memcpy(buf->lcontext.LeaseKey, lease->lease_key, - SMB2_LEASE_KEY_SIZE); - buf->lcontext.LeaseFlags = lease->flags; -- buf->lcontext.Epoch = cpu_to_le16(++lease->epoch); -+ buf->lcontext.Epoch = cpu_to_le16(lease->epoch); - buf->lcontext.LeaseState = lease->state; - memcpy(buf->lcontext.ParentLeaseKey, lease->parent_lease_key, - SMB2_LEASE_KEY_SIZE); --- -2.43.2 - -From 0bf525e64fd3ccc0fd136a3a70bb4922f93e90a6 Mon Sep 17 00:00:00 2001 -From: Namjae Jeon <linkinjeon@kernel.org> -Date: Tue, 23 Jan 2024 20:42:27 +0900 -Subject: [PATCH 0813/1501] ksmbd: send lease break notification on - FILE_RENAME_INFORMATION -Content-Length: 2185 -Lines: 67 - -[ Upstream commit 3fc74c65b367476874da5fe6f633398674b78e5a ] - -Send lease break notification on FILE_RENAME_INFORMATION request. -This patch fix smb2.lease.v2_epoch2 test failure. - -Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> -Signed-off-by: Steve French <stfrench@microsoft.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/smb/server/oplock.c | 12 +++++++----- - fs/smb/server/smb2pdu.c | 1 + - 2 files changed, 8 insertions(+), 5 deletions(-) - -diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c -index 3209ace41ab4..53dfaac425c6 100644 ---- a/fs/smb/server/oplock.c -+++ b/fs/smb/server/oplock.c -@@ -541,14 +541,12 @@ static struct oplock_info *same_client_has_lease(struct ksmbd_inode *ci, - continue; - } - -- if (lctx->req_state != lease->state) -- lease->epoch++; -- - /* upgrading lease */ - if ((atomic_read(&ci->op_count) + - atomic_read(&ci->sop_count)) == 1) { - if (lease->state != SMB2_LEASE_NONE_LE && - lease->state == (lctx->req_state & lease->state)) { -+ lease->epoch++; - lease->state |= lctx->req_state; - if (lctx->req_state & - SMB2_LEASE_WRITE_CACHING_LE) -@@ -559,13 +557,17 @@ static struct oplock_info *same_client_has_lease(struct ksmbd_inode *ci, - atomic_read(&ci->sop_count)) > 1) { - if (lctx->req_state == - (SMB2_LEASE_READ_CACHING_LE | -- SMB2_LEASE_HANDLE_CACHING_LE)) -+ SMB2_LEASE_HANDLE_CACHING_LE)) { -+ lease->epoch++; - lease->state = lctx->req_state; -+ } - } - - if (lctx->req_state && lease->state == -- SMB2_LEASE_NONE_LE) -+ SMB2_LEASE_NONE_LE) { -+ lease->epoch++; - lease_none_upgrade(opinfo, lctx->req_state); -+ } - } - read_lock(&ci->m_lock); - } -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index b67b2a7c1a43..ba7a72a6a4f4 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -5581,6 +5581,7 @@ static int smb2_rename(struct ksmbd_work *work, - if (!file_info->ReplaceIfExists) - flags = RENAME_NOREPLACE; - -+ smb_break_all_levII_oplock(work, fp, 0); - rc = ksmbd_vfs_rename(work, &fp->filp->f_path, new_name, flags); - out: - kfree(new_name); --- -2.43.2 - -From e4b7b15c93d340e8591d89794667e131a869d80d Mon Sep 17 00:00:00 2001 -From: Namjae Jeon <linkinjeon@kernel.org> -Date: Tue, 23 Jan 2024 20:42:28 +0900 -Subject: [PATCH 0814/1501] ksmbd: Add missing set_freezable() for freezable - kthread -Content-Length: 1013 -Lines: 31 - -From: Kevin Hao <haokexin@gmail.com> - -[ Upstream commit 8fb7b723924cc9306bc161f45496497aec733904 ] - -The kernel thread function ksmbd_conn_handler_loop() invokes -the try_to_freeze() in its loop. But all the kernel threads are -non-freezable by default. So if we want to make a kernel thread to be -freezable, we have to invoke set_freezable() explicitly. - -Signed-off-by: Kevin Hao <haokexin@gmail.com> -Acked-by: Namjae Jeon <linkinjeon@kernel.org> -Signed-off-by: Steve French <stfrench@microsoft.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/smb/server/connection.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c -index 7977827c6541..09e1e7771592 100644 ---- a/fs/smb/server/connection.c -+++ b/fs/smb/server/connection.c -@@ -284,6 +284,7 @@ int ksmbd_conn_handler_loop(void *p) - goto out; - - conn->last_active = jiffies; -+ set_freezable(); - while (ksmbd_conn_alive(conn)) { - if (try_to_freeze()) - continue; --- -2.43.2 - -From ebb67233acf708c0a943475af58b53da2b23ff3d Mon Sep 17 00:00:00 2001 -From: Lucas Stach <l.stach@pengutronix.de> -Date: Wed, 17 Jan 2024 22:06:28 +0100 -Subject: [PATCH 0815/1501] SUNRPC: use request size to initialize bio_vec in - svc_udp_sendto() -Content-Length: 1170 -Lines: 34 - -[ Upstream commit 1d9cabe2817edd215779dc9c2fe5e7ab9aac0704 ] - -Use the proper size when setting up the bio_vec, as otherwise only -zero-length UDP packets will be sent. - -Fixes: baabf59c2414 ("SUNRPC: Convert svc_udp_sendto() to use the per-socket bio_vec array") -Signed-off-by: Lucas Stach <l.stach@pengutronix.de> -Signed-off-by: Chuck Lever <chuck.lever@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/sunrpc/svcsock.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c -index 998687421fa6..e0ce4276274b 100644 ---- a/net/sunrpc/svcsock.c -+++ b/net/sunrpc/svcsock.c -@@ -717,12 +717,12 @@ static int svc_udp_sendto(struct svc_rqst *rqstp) - ARRAY_SIZE(rqstp->rq_bvec), xdr); - - iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, rqstp->rq_bvec, -- count, 0); -+ count, rqstp->rq_res.len); - err = sock_sendmsg(svsk->sk_sock, &msg); - if (err == -ECONNREFUSED) { - /* ICMP error on earlier request. */ - iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, rqstp->rq_bvec, -- count, 0); -+ count, rqstp->rq_res.len); - err = sock_sendmsg(svsk->sk_sock, &msg); - } - --- -2.43.2 - -From e04bf59bdba0fa45d52160be676114e16be855a9 Mon Sep 17 00:00:00 2001 -From: Johannes Berg <johannes.berg@intel.com> -Date: Thu, 11 Jan 2024 18:17:44 +0200 -Subject: [PATCH 0816/1501] wifi: mac80211: fix potential sta-link leak -Content-Length: 1310 -Lines: 36 - -[ Upstream commit b01a74b3ca6fd51b62c67733ba7c3280fa6c5d26 ] - -When a station is allocated, links are added but not -set to valid yet (e.g. during connection to an AP MLD), -we might remove the station without ever marking links -valid, and leak them. Fix that. - -Fixes: cb71f1d136a6 ("wifi: mac80211: add sta link addition/removal") -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Reviewed-by: Ilan Peer <ilan.peer@intel.com> -Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> -Link: https://msgid.link/20240111181514.6573998beaf8.I09ac2e1d41c80f82a5a616b8bd1d9d8dd709a6a6@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/mac80211/sta_info.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c -index 0ba613dd1cc4..c33decbb97f2 100644 ---- a/net/mac80211/sta_info.c -+++ b/net/mac80211/sta_info.c -@@ -404,7 +404,10 @@ void sta_info_free(struct ieee80211_local *local, struct sta_info *sta) - int i; - - for (i = 0; i < ARRAY_SIZE(sta->link); i++) { -- if (!(sta->sta.valid_links & BIT(i))) -+ struct link_sta_info *link_sta; -+ -+ link_sta = rcu_access_pointer(sta->link[i]); -+ if (!link_sta) - continue; - - sta_remove_link(sta, i, false); --- -2.43.2 - -From 34de0f04684ec00c093a0455648be055f0e8e24f Mon Sep 17 00:00:00 2001 -From: Qu Wenruo <wqu@suse.com> -Date: Wed, 17 Jan 2024 11:02:25 +1030 -Subject: [PATCH 0817/1501] btrfs: scrub: avoid use-after-free when chunk - length is not 64K aligned -Content-Length: 6276 -Lines: 152 - -[ Upstream commit f546c4282673497a06ecb6190b50ae7f6c85b02f ] - -[BUG] -There is a bug report that, on a ext4-converted btrfs, scrub leads to -various problems, including: - -- "unable to find chunk map" errors - BTRFS info (device vdb): scrub: started on devid 1 - BTRFS critical (device vdb): unable to find chunk map for logical 2214744064 length 4096 - BTRFS critical (device vdb): unable to find chunk map for logical 2214744064 length 45056 - - This would lead to unrepariable errors. - -- Use-after-free KASAN reports: - ================================================================== - BUG: KASAN: slab-use-after-free in __blk_rq_map_sg+0x18f/0x7c0 - Read of size 8 at addr ffff8881013c9040 by task btrfs/909 - CPU: 0 PID: 909 Comm: btrfs Not tainted 6.7.0-x64v3-dbg #11 c50636e9419a8354555555245df535e380563b2b - Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 2023.11-2 12/24/2023 - Call Trace: - <TASK> - dump_stack_lvl+0x43/0x60 - print_report+0xcf/0x640 - kasan_report+0xa6/0xd0 - __blk_rq_map_sg+0x18f/0x7c0 - virtblk_prep_rq.isra.0+0x215/0x6a0 [virtio_blk 19a65eeee9ae6fcf02edfad39bb9ddee07dcdaff] - virtio_queue_rqs+0xc4/0x310 [virtio_blk 19a65eeee9ae6fcf02edfad39bb9ddee07dcdaff] - blk_mq_flush_plug_list.part.0+0x780/0x860 - __blk_flush_plug+0x1ba/0x220 - blk_finish_plug+0x3b/0x60 - submit_initial_group_read+0x10a/0x290 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] - flush_scrub_stripes+0x38e/0x430 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] - scrub_stripe+0x82a/0xae0 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] - scrub_chunk+0x178/0x200 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] - scrub_enumerate_chunks+0x4bc/0xa30 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] - btrfs_scrub_dev+0x398/0x810 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] - btrfs_ioctl+0x4b9/0x3020 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] - __x64_sys_ioctl+0xbd/0x100 - do_syscall_64+0x5d/0xe0 - entry_SYSCALL_64_after_hwframe+0x63/0x6b - RIP: 0033:0x7f47e5e0952b - -- Crash, mostly due to above use-after-free - -[CAUSE] -The converted fs has the following data chunk layout: - - item 2 key (FIRST_CHUNK_TREE CHUNK_ITEM 2214658048) itemoff 16025 itemsize 80 - length 86016 owner 2 stripe_len 65536 type DATA|single - -For above logical bytenr 2214744064, it's at the chunk end -(2214658048 + 86016 = 2214744064). - -This means btrfs_submit_bio() would split the bio, and trigger endio -function for both of the two halves. - -However scrub_submit_initial_read() would only expect the endio function -to be called once, not any more. -This means the first endio function would already free the bbio::bio, -leaving the bvec freed, thus the 2nd endio call would lead to -use-after-free. - -[FIX] -- Make sure scrub_read_endio() only updates bits in its range - Since we may read less than 64K at the end of the chunk, we should not - touch the bits beyond chunk boundary. - -- Make sure scrub_submit_initial_read() only to read the chunk range - This is done by calculating the real number of sectors we need to - read, and add sector-by-sector to the bio. - -Thankfully the scrub read repair path won't need extra fixes: - -- scrub_stripe_submit_repair_read() - With above fixes, we won't update error bit for range beyond chunk, - thus scrub_stripe_submit_repair_read() should never submit any read - beyond the chunk. - -Reported-by: Rongrong <i@rong.moe> -Fixes: e02ee89baa66 ("btrfs: scrub: switch scrub_simple_mirror() to scrub_stripe infrastructure") -Tested-by: Rongrong <i@rong.moe> -Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com> -Signed-off-by: Qu Wenruo <wqu@suse.com> -Signed-off-by: David Sterba <dsterba@suse.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/btrfs/scrub.c | 29 ++++++++++++++++++++++------- - 1 file changed, 22 insertions(+), 7 deletions(-) - -diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c -index f62a408671cb..443d2519f0a9 100644 ---- a/fs/btrfs/scrub.c -+++ b/fs/btrfs/scrub.c -@@ -1099,12 +1099,22 @@ static void scrub_stripe_read_repair_worker(struct work_struct *work) - static void scrub_read_endio(struct btrfs_bio *bbio) - { - struct scrub_stripe *stripe = bbio->private; -+ struct bio_vec *bvec; -+ int sector_nr = calc_sector_number(stripe, bio_first_bvec_all(&bbio->bio)); -+ int num_sectors; -+ u32 bio_size = 0; -+ int i; -+ -+ ASSERT(sector_nr < stripe->nr_sectors); -+ bio_for_each_bvec_all(bvec, &bbio->bio, i) -+ bio_size += bvec->bv_len; -+ num_sectors = bio_size >> stripe->bg->fs_info->sectorsize_bits; - - if (bbio->bio.bi_status) { -- bitmap_set(&stripe->io_error_bitmap, 0, stripe->nr_sectors); -- bitmap_set(&stripe->error_bitmap, 0, stripe->nr_sectors); -+ bitmap_set(&stripe->io_error_bitmap, sector_nr, num_sectors); -+ bitmap_set(&stripe->error_bitmap, sector_nr, num_sectors); - } else { -- bitmap_clear(&stripe->io_error_bitmap, 0, stripe->nr_sectors); -+ bitmap_clear(&stripe->io_error_bitmap, sector_nr, num_sectors); - } - bio_put(&bbio->bio); - if (atomic_dec_and_test(&stripe->pending_io)) { -@@ -1705,6 +1715,9 @@ static void scrub_submit_initial_read(struct scrub_ctx *sctx, - { - struct btrfs_fs_info *fs_info = sctx->fs_info; - struct btrfs_bio *bbio; -+ unsigned int nr_sectors = min(BTRFS_STRIPE_LEN, stripe->bg->start + -+ stripe->bg->length - stripe->logical) >> -+ fs_info->sectorsize_bits; - int mirror = stripe->mirror_num; - - ASSERT(stripe->bg); -@@ -1719,14 +1732,16 @@ static void scrub_submit_initial_read(struct scrub_ctx *sctx, - bbio = btrfs_bio_alloc(SCRUB_STRIPE_PAGES, REQ_OP_READ, fs_info, - scrub_read_endio, stripe); - -- /* Read the whole stripe. */ - bbio->bio.bi_iter.bi_sector = stripe->logical >> SECTOR_SHIFT; -- for (int i = 0; i < BTRFS_STRIPE_LEN >> PAGE_SHIFT; i++) { -+ /* Read the whole range inside the chunk boundary. */ -+ for (unsigned int cur = 0; cur < nr_sectors; cur++) { -+ struct page *page = scrub_stripe_get_page(stripe, cur); -+ unsigned int pgoff = scrub_stripe_get_page_offset(stripe, cur); - int ret; - -- ret = bio_add_page(&bbio->bio, stripe->pages[i], PAGE_SIZE, 0); -+ ret = bio_add_page(&bbio->bio, page, fs_info->sectorsize, pgoff); - /* We should have allocated enough bio vectors. */ -- ASSERT(ret == PAGE_SIZE); -+ ASSERT(ret == fs_info->sectorsize); - } - atomic_inc(&stripe->pending_io); - --- -2.43.2 - -From 8f3f9186e5bb96a9c9654c41653210e3ea7e48a6 Mon Sep 17 00:00:00 2001 -From: Wen Gu <guwen@linux.alibaba.com> -Date: Thu, 18 Jan 2024 12:32:10 +0800 -Subject: [PATCH 0818/1501] net/smc: fix illegal rmb_desc access in SMC-D - connection dump -Content-Length: 2854 -Lines: 79 - -[ Upstream commit dbc153fd3c142909e564bb256da087e13fbf239c ] - -A crash was found when dumping SMC-D connections. It can be reproduced -by following steps: - -- run nginx/wrk test: - smc_run nginx - smc_run wrk -t 16 -c 1000 -d <duration> -H 'Connection: Close' <URL> - -- continuously dump SMC-D connections in parallel: - watch -n 1 'smcss -D' - - BUG: kernel NULL pointer dereference, address: 0000000000000030 - CPU: 2 PID: 7204 Comm: smcss Kdump: loaded Tainted: G E 6.7.0+ #55 - RIP: 0010:__smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag] - Call Trace: - <TASK> - ? __die+0x24/0x70 - ? page_fault_oops+0x66/0x150 - ? exc_page_fault+0x69/0x140 - ? asm_exc_page_fault+0x26/0x30 - ? __smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag] - ? __kmalloc_node_track_caller+0x35d/0x430 - ? __alloc_skb+0x77/0x170 - smc_diag_dump_proto+0xd0/0xf0 [smc_diag] - smc_diag_dump+0x26/0x60 [smc_diag] - netlink_dump+0x19f/0x320 - __netlink_dump_start+0x1dc/0x300 - smc_diag_handler_dump+0x6a/0x80 [smc_diag] - ? __pfx_smc_diag_dump+0x10/0x10 [smc_diag] - sock_diag_rcv_msg+0x121/0x140 - ? __pfx_sock_diag_rcv_msg+0x10/0x10 - netlink_rcv_skb+0x5a/0x110 - sock_diag_rcv+0x28/0x40 - netlink_unicast+0x22a/0x330 - netlink_sendmsg+0x1f8/0x420 - __sock_sendmsg+0xb0/0xc0 - ____sys_sendmsg+0x24e/0x300 - ? copy_msghdr_from_user+0x62/0x80 - ___sys_sendmsg+0x7c/0xd0 - ? __do_fault+0x34/0x160 - ? do_read_fault+0x5f/0x100 - ? do_fault+0xb0/0x110 - ? __handle_mm_fault+0x2b0/0x6c0 - __sys_sendmsg+0x4d/0x80 - do_syscall_64+0x69/0x180 - entry_SYSCALL_64_after_hwframe+0x6e/0x76 - -It is possible that the connection is in process of being established -when we dump it. Assumed that the connection has been registered in a -link group by smc_conn_create() but the rmb_desc has not yet been -initialized by smc_buf_create(), thus causing the illegal access to -conn->rmb_desc. So fix it by checking before dump. - -Fixes: 4b1b7d3b30a6 ("net/smc: add SMC-D diag support") -Signed-off-by: Wen Gu <guwen@linux.alibaba.com> -Reviewed-by: Dust Li <dust.li@linux.alibaba.com> -Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/smc/smc_diag.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/smc/smc_diag.c b/net/smc/smc_diag.c -index 5cc376834c57..fb9e5cc1285e 100644 ---- a/net/smc/smc_diag.c -+++ b/net/smc/smc_diag.c -@@ -163,7 +163,7 @@ static int __smc_diag_dump(struct sock *sk, struct sk_buff *skb, - } - if (smc_conn_lgr_valid(&smc->conn) && smc->conn.lgr->is_smcd && - (req->diag_ext & (1 << (SMC_DIAG_DMBINFO - 1))) && -- !list_empty(&smc->conn.lgr->list)) { -+ !list_empty(&smc->conn.lgr->list) && smc->conn.rmb_desc) { - struct smc_connection *conn = &smc->conn; - struct smcd_diag_dmbinfo dinfo; - struct smcd_dev *smcd = conn->lgr->smcd; --- -2.43.2 - -From 3982fe726a63fb3de6005e534e2ac8ca7e0aca2a Mon Sep 17 00:00:00 2001 -From: Zhengchao Shao <shaozhengchao@huawei.com> -Date: Thu, 18 Jan 2024 09:20:19 +0800 -Subject: [PATCH 0820/1501] tcp: make sure init the accept_queue's spinlocks - once -Content-Length: 7328 -Lines: 162 - -[ Upstream commit 198bc90e0e734e5f98c3d2833e8390cac3df61b2 ] - -When I run syz's reproduction C program locally, it causes the following -issue: -pvqspinlock: lock 0xffff9d181cd5c660 has corrupted value 0x0! -WARNING: CPU: 19 PID: 21160 at __pv_queued_spin_unlock_slowpath (kernel/locking/qspinlock_paravirt.h:508) -Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 -RIP: 0010:__pv_queued_spin_unlock_slowpath (kernel/locking/qspinlock_paravirt.h:508) -Code: 73 56 3a ff 90 c3 cc cc cc cc 8b 05 bb 1f 48 01 85 c0 74 05 c3 cc cc cc cc 8b 17 48 89 fe 48 c7 c7 -30 20 ce 8f e8 ad 56 42 ff <0f> 0b c3 cc cc cc cc 0f 0b 0f 1f 40 00 90 90 90 90 90 90 90 90 90 -RSP: 0018:ffffa8d200604cb8 EFLAGS: 00010282 -RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff9d1ef60e0908 -RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff9d1ef60e0900 -RBP: ffff9d181cd5c280 R08: 0000000000000000 R09: 00000000ffff7fff -R10: ffffa8d200604b68 R11: ffffffff907dcdc8 R12: 0000000000000000 -R13: ffff9d181cd5c660 R14: ffff9d1813a3f330 R15: 0000000000001000 -FS: 00007fa110184640(0000) GS:ffff9d1ef60c0000(0000) knlGS:0000000000000000 -CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -CR2: 0000000020000000 CR3: 000000011f65e000 CR4: 00000000000006f0 -Call Trace: -<IRQ> - _raw_spin_unlock (kernel/locking/spinlock.c:186) - inet_csk_reqsk_queue_add (net/ipv4/inet_connection_sock.c:1321) - inet_csk_complete_hashdance (net/ipv4/inet_connection_sock.c:1358) - tcp_check_req (net/ipv4/tcp_minisocks.c:868) - tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2260) - ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205) - ip_local_deliver_finish (net/ipv4/ip_input.c:234) - __netif_receive_skb_one_core (net/core/dev.c:5529) - process_backlog (./include/linux/rcupdate.h:779) - __napi_poll (net/core/dev.c:6533) - net_rx_action (net/core/dev.c:6604) - __do_softirq (./arch/x86/include/asm/jump_label.h:27) - do_softirq (kernel/softirq.c:454 kernel/softirq.c:441) -</IRQ> -<TASK> - __local_bh_enable_ip (kernel/softirq.c:381) - __dev_queue_xmit (net/core/dev.c:4374) - ip_finish_output2 (./include/net/neighbour.h:540 net/ipv4/ip_output.c:235) - __ip_queue_xmit (net/ipv4/ip_output.c:535) - __tcp_transmit_skb (net/ipv4/tcp_output.c:1462) - tcp_rcv_synsent_state_process (net/ipv4/tcp_input.c:6469) - tcp_rcv_state_process (net/ipv4/tcp_input.c:6657) - tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1929) - __release_sock (./include/net/sock.h:1121 net/core/sock.c:2968) - release_sock (net/core/sock.c:3536) - inet_wait_for_connect (net/ipv4/af_inet.c:609) - __inet_stream_connect (net/ipv4/af_inet.c:702) - inet_stream_connect (net/ipv4/af_inet.c:748) - __sys_connect (./include/linux/file.h:45 net/socket.c:2064) - __x64_sys_connect (net/socket.c:2073 net/socket.c:2070 net/socket.c:2070) - do_syscall_64 (arch/x86/entry/common.c:51 arch/x86/entry/common.c:82) - entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:129) - RIP: 0033:0x7fa10ff05a3d - Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 - c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ab a3 0e 00 f7 d8 64 89 01 48 - RSP: 002b:00007fa110183de8 EFLAGS: 00000202 ORIG_RAX: 000000000000002a - RAX: ffffffffffffffda RBX: 0000000020000054 RCX: 00007fa10ff05a3d - RDX: 000000000000001c RSI: 0000000020000040 RDI: 0000000000000003 - RBP: 00007fa110183e20 R08: 0000000000000000 R09: 0000000000000000 - R10: 0000000000000000 R11: 0000000000000202 R12: 00007fa110184640 - R13: 0000000000000000 R14: 00007fa10fe8b060 R15: 00007fff73e23b20 -</TASK> - -The issue triggering process is analyzed as follows: -Thread A Thread B -tcp_v4_rcv //receive ack TCP packet inet_shutdown - tcp_check_req tcp_disconnect //disconnect sock - ... tcp_set_state(sk, TCP_CLOSE) - inet_csk_complete_hashdance ... - inet_csk_reqsk_queue_add inet_listen //start listen - spin_lock(&queue->rskq_lock) inet_csk_listen_start - ... reqsk_queue_alloc - ... spin_lock_init - spin_unlock(&queue->rskq_lock) //warning - -When the socket receives the ACK packet during the three-way handshake, -it will hold spinlock. And then the user actively shutdowns the socket -and listens to the socket immediately, the spinlock will be initialized. -When the socket is going to release the spinlock, a warning is generated. -Also the same issue to fastopenq.lock. - -Move init spinlock to inet_create and inet_accept to make sure init the -accept_queue's spinlocks once. - -Fixes: fff1f3001cc5 ("tcp: add a spinlock to protect struct request_sock_queue") -Fixes: 168a8f58059a ("tcp: TCP Fast Open Server - main code path") -Reported-by: Ming Shu <sming56@aliyun.com> -Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com> -Reviewed-by: Eric Dumazet <edumazet@google.com> -Link: https://lore.kernel.org/r/20240118012019.1751966-1-shaozhengchao@huawei.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/net/inet_connection_sock.h | 8 ++++++++ - net/core/request_sock.c | 3 --- - net/ipv4/af_inet.c | 3 +++ - net/ipv4/inet_connection_sock.c | 4 ++++ - 4 files changed, 15 insertions(+), 3 deletions(-) - -diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h -index d0a2f827d5f2..9ab4bf704e86 100644 ---- a/include/net/inet_connection_sock.h -+++ b/include/net/inet_connection_sock.h -@@ -357,4 +357,12 @@ static inline bool inet_csk_has_ulp(const struct sock *sk) - return inet_test_bit(IS_ICSK, sk) && !!inet_csk(sk)->icsk_ulp_ops; - } - -+static inline void inet_init_csk_locks(struct sock *sk) -+{ -+ struct inet_connection_sock *icsk = inet_csk(sk); -+ -+ spin_lock_init(&icsk->icsk_accept_queue.rskq_lock); -+ spin_lock_init(&icsk->icsk_accept_queue.fastopenq.lock); -+} -+ - #endif /* _INET_CONNECTION_SOCK_H */ -diff --git a/net/core/request_sock.c b/net/core/request_sock.c -index f35c2e998406..63de5c635842 100644 ---- a/net/core/request_sock.c -+++ b/net/core/request_sock.c -@@ -33,9 +33,6 @@ - - void reqsk_queue_alloc(struct request_sock_queue *queue) - { -- spin_lock_init(&queue->rskq_lock); -- -- spin_lock_init(&queue->fastopenq.lock); - queue->fastopenq.rskq_rst_head = NULL; - queue->fastopenq.rskq_rst_tail = NULL; - queue->fastopenq.qlen = 0; -diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c -index ea0b0334a0fb..1c58bd72e124 100644 ---- a/net/ipv4/af_inet.c -+++ b/net/ipv4/af_inet.c -@@ -330,6 +330,9 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, - if (INET_PROTOSW_REUSE & answer_flags) - sk->sk_reuse = SK_CAN_REUSE; - -+ if (INET_PROTOSW_ICSK & answer_flags) -+ inet_init_csk_locks(sk); -+ - inet = inet_sk(sk); - inet_assign_bit(IS_ICSK, sk, INET_PROTOSW_ICSK & answer_flags); - -diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c -index 394a498c2823..762817d6c8d7 100644 ---- a/net/ipv4/inet_connection_sock.c -+++ b/net/ipv4/inet_connection_sock.c -@@ -730,6 +730,10 @@ struct sock *inet_csk_accept(struct sock *sk, int flags, int *err, bool kern) - } - if (req) - reqsk_put(req); -+ -+ if (newsk) -+ inet_init_csk_locks(newsk); -+ - return newsk; - out_err: - newsk = NULL; --- -2.43.2 - -From 4bc28baf37927613a24df363a407eefa163296ae Mon Sep 17 00:00:00 2001 -From: Michael Chan <michael.chan@broadcom.com> -Date: Wed, 17 Jan 2024 15:45:11 -0800 -Subject: [PATCH 0821/1501] bnxt_en: Wait for FLR to complete during probe -Content-Length: 1374 -Lines: 35 - -[ Upstream commit 3c1069fa42872f95cf3c6fedf80723d391e12d57 ] - -The first message to firmware may fail if the device is undergoing FLR. -The driver has some recovery logic for this failure scenario but we must -wait 100 msec for FLR to complete before proceeding. Otherwise the -recovery will always fail. - -Fixes: ba02629ff6cb ("bnxt_en: log firmware status on firmware init failure") -Reviewed-by: Damodharam Ammepalli <damodharam.ammepalli@broadcom.com> -Signed-off-by: Michael Chan <michael.chan@broadcom.com> -Link: https://lore.kernel.org/r/20240117234515.226944-2-michael.chan@broadcom.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index e1f1e646cf48..1019b4dc7bed 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -12298,6 +12298,11 @@ static int bnxt_fw_init_one_p1(struct bnxt *bp) - - bp->fw_cap = 0; - rc = bnxt_hwrm_ver_get(bp); -+ /* FW may be unresponsive after FLR. FLR must complete within 100 msec -+ * so wait before continuing with recovery. -+ */ -+ if (rc) -+ msleep(100); - bnxt_try_map_fw_health_reg(bp); - if (rc) { - rc = bnxt_try_recover_fw(bp); --- -2.43.2 - -From 5338331880831ca91598f3d7f4d57824a0556f4b Mon Sep 17 00:00:00 2001 -From: Michael Chan <michael.chan@broadcom.com> -Date: Wed, 17 Jan 2024 15:45:14 -0800 -Subject: [PATCH 0822/1501] bnxt_en: Prevent kernel warning when running - offline self test -Content-Length: 4375 -Lines: 105 - -[ Upstream commit c20f482129a582455f02eb9a6dcb2a4215274599 ] - -We call bnxt_half_open_nic() to setup the chip partially to run -loopback tests. The rings and buffers are initialized normally -so that we can transmit and receive packets in loopback mode. -That means page pool buffers are allocated for the aggregation ring -just like the normal case. NAPI is not needed because we are just -polling for the loopback packets. - -When we're done with the loopback tests, we call bnxt_half_close_nic() -to clean up. When freeing the page pools, we hit a WARN_ON() -in page_pool_unlink_napi() because the NAPI state linked to the -page pool is uninitialized. - -The simplest way to avoid this warning is just to initialize the -NAPIs during half open and delete the NAPIs during half close. -Trying to skip the page pool initialization or skip linking of -NAPI during half open will be more complicated. - -This fix avoids this warning: - -WARNING: CPU: 4 PID: 46967 at net/core/page_pool.c:946 page_pool_unlink_napi+0x1f/0x30 -CPU: 4 PID: 46967 Comm: ethtool Tainted: G S W 6.7.0-rc5+ #22 -Hardware name: Dell Inc. PowerEdge R750/06V45N, BIOS 1.3.8 08/31/2021 -RIP: 0010:page_pool_unlink_napi+0x1f/0x30 -Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 8b 47 18 48 85 c0 74 1b 48 8b 50 10 83 e2 01 74 08 8b 40 34 83 f8 ff 74 02 <0f> 0b 48 c7 47 18 00 00 00 00 c3 cc cc cc cc 66 90 90 90 90 90 90 -RSP: 0018:ffa000003d0dfbe8 EFLAGS: 00010246 -RAX: ff110003607ce640 RBX: ff110010baf5d000 RCX: 0000000000000008 -RDX: 0000000000000000 RSI: ff110001e5e522c0 RDI: ff110010baf5d000 -RBP: ff11000145539b40 R08: 0000000000000001 R09: ffffffffc063f641 -R10: ff110001361eddb8 R11: 000000000040000f R12: 0000000000000001 -R13: 000000000000001c R14: ff1100014553a080 R15: 0000000000003fc0 -FS: 00007f9301c4f740(0000) GS:ff1100103fd00000(0000) knlGS:0000000000000000 -CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -CR2: 00007f91344fa8f0 CR3: 00000003527cc005 CR4: 0000000000771ef0 -DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 -DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 -PKRU: 55555554 -Call Trace: - <TASK> - ? __warn+0x81/0x140 - ? page_pool_unlink_napi+0x1f/0x30 - ? report_bug+0x102/0x200 - ? handle_bug+0x44/0x70 - ? exc_invalid_op+0x13/0x60 - ? asm_exc_invalid_op+0x16/0x20 - ? bnxt_free_ring.isra.123+0xb1/0xd0 [bnxt_en] - ? page_pool_unlink_napi+0x1f/0x30 - page_pool_destroy+0x3e/0x150 - bnxt_free_mem+0x441/0x5e0 [bnxt_en] - bnxt_half_close_nic+0x2a/0x40 [bnxt_en] - bnxt_self_test+0x21d/0x450 [bnxt_en] - __dev_ethtool+0xeda/0x2e30 - ? native_queued_spin_lock_slowpath+0x17f/0x2b0 - ? __link_object+0xa1/0x160 - ? _raw_spin_unlock_irqrestore+0x23/0x40 - ? __create_object+0x5f/0x90 - ? __kmem_cache_alloc_node+0x317/0x3c0 - ? dev_ethtool+0x59/0x170 - dev_ethtool+0xa7/0x170 - dev_ioctl+0xc3/0x530 - sock_do_ioctl+0xa8/0xf0 - sock_ioctl+0x270/0x310 - __x64_sys_ioctl+0x8c/0xc0 - do_syscall_64+0x3e/0xf0 - entry_SYSCALL_64_after_hwframe+0x6e/0x76 - -Fixes: 294e39e0d034 ("bnxt: hook NAPIs to page pools") -Reviewed-by: Andy Gospodarek <andrew.gospodarek@broadcom.com> -Reviewed-by: Ajit Khaparde <ajit.khaparde@broadcom.com> -Signed-off-by: Michael Chan <michael.chan@broadcom.com> -Link: https://lore.kernel.org/r/20240117234515.226944-5-michael.chan@broadcom.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index 1019b4dc7bed..22c8bfb5ed9d 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -10627,10 +10627,12 @@ int bnxt_half_open_nic(struct bnxt *bp) - netdev_err(bp->dev, "bnxt_alloc_mem err: %x\n", rc); - goto half_open_err; - } -+ bnxt_init_napi(bp); - set_bit(BNXT_STATE_HALF_OPEN, &bp->state); - rc = bnxt_init_nic(bp, true); - if (rc) { - clear_bit(BNXT_STATE_HALF_OPEN, &bp->state); -+ bnxt_del_napi(bp); - netdev_err(bp->dev, "bnxt_init_nic err: %x\n", rc); - goto half_open_err; - } -@@ -10649,6 +10651,7 @@ int bnxt_half_open_nic(struct bnxt *bp) - void bnxt_half_close_nic(struct bnxt *bp) - { - bnxt_hwrm_resource_free(bp, false, true); -+ bnxt_del_napi(bp); - bnxt_free_skbs(bp); - bnxt_free_mem(bp, true); - clear_bit(BNXT_STATE_HALF_OPEN, &bp->state); --- -2.43.2 - -From 6260c32d63d53347b9c29dede29eb4833bda8c59 Mon Sep 17 00:00:00 2001 -From: Lin Ma <linma@zju.edu.cn> -Date: Thu, 18 Jan 2024 21:03:06 +0800 -Subject: [PATCH 0823/1501] vlan: skip nested type that is not - IFLA_VLAN_QOS_MAPPING -Content-Length: 2041 -Lines: 50 - -[ Upstream commit 6c21660fe221a15c789dee2bc2fd95516bc5aeaf ] - -In the vlan_changelink function, a loop is used to parse the nested -attributes IFLA_VLAN_EGRESS_QOS and IFLA_VLAN_INGRESS_QOS in order to -obtain the struct ifla_vlan_qos_mapping. These two nested attributes are -checked in the vlan_validate_qos_map function, which calls -nla_validate_nested_deprecated with the vlan_map_policy. - -However, this deprecated validator applies a LIBERAL strictness, allowing -the presence of an attribute with the type IFLA_VLAN_QOS_UNSPEC. -Consequently, the loop in vlan_changelink may parse an attribute of type -IFLA_VLAN_QOS_UNSPEC and believe it carries a payload of -struct ifla_vlan_qos_mapping, which is not necessarily true. - -To address this issue and ensure compatibility, this patch introduces two -type checks that skip attributes whose type is not IFLA_VLAN_QOS_MAPPING. - -Fixes: 07b5b17e157b ("[VLAN]: Use rtnl_link API") -Signed-off-by: Lin Ma <linma@zju.edu.cn> -Reviewed-by: Simon Horman <horms@kernel.org> -Link: https://lore.kernel.org/r/20240118130306.1644001-1-linma@zju.edu.cn -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/8021q/vlan_netlink.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c -index 214532173536..a3b68243fd4b 100644 ---- a/net/8021q/vlan_netlink.c -+++ b/net/8021q/vlan_netlink.c -@@ -118,12 +118,16 @@ static int vlan_changelink(struct net_device *dev, struct nlattr *tb[], - } - if (data[IFLA_VLAN_INGRESS_QOS]) { - nla_for_each_nested(attr, data[IFLA_VLAN_INGRESS_QOS], rem) { -+ if (nla_type(attr) != IFLA_VLAN_QOS_MAPPING) -+ continue; - m = nla_data(attr); - vlan_dev_set_ingress_priority(dev, m->to, m->from); - } - } - if (data[IFLA_VLAN_EGRESS_QOS]) { - nla_for_each_nested(attr, data[IFLA_VLAN_EGRESS_QOS], rem) { -+ if (nla_type(attr) != IFLA_VLAN_QOS_MAPPING) -+ continue; - m = nla_data(attr); - err = vlan_dev_set_egress_priority(dev, m->from, m->to); - if (err) --- -2.43.2 - -From c451c008f563d56d5e676c9dcafae565fcad84bb Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Thu, 18 Jan 2024 18:36:25 +0000 -Subject: [PATCH 0824/1501] llc: make llc_ui_sendmsg() more robust against - bonding changes -Content-Length: 6150 -Lines: 146 - -[ Upstream commit dad555c816a50c6a6a8a86be1f9177673918c647 ] - -syzbot was able to trick llc_ui_sendmsg(), allocating an skb with no -headroom, but subsequently trying to push 14 bytes of Ethernet header [1] - -Like some others, llc_ui_sendmsg() releases the socket lock before -calling sock_alloc_send_skb(). -Then it acquires it again, but does not redo all the sanity checks -that were performed. - -This fix: - -- Uses LL_RESERVED_SPACE() to reserve space. -- Check all conditions again after socket lock is held again. -- Do not account Ethernet header for mtu limitation. - -[1] - -skbuff: skb_under_panic: text:ffff800088baa334 len:1514 put:14 head:ffff0000c9c37000 data:ffff0000c9c36ff2 tail:0x5dc end:0x6c0 dev:bond0 - - kernel BUG at net/core/skbuff.c:193 ! -Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP -Modules linked in: -CPU: 0 PID: 6875 Comm: syz-executor.0 Not tainted 6.7.0-rc8-syzkaller-00101-g0802e17d9aca-dirty #0 -Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 -pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) - pc : skb_panic net/core/skbuff.c:189 [inline] - pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 - lr : skb_panic net/core/skbuff.c:189 [inline] - lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 -sp : ffff800096f97000 -x29: ffff800096f97010 x28: ffff80008cc8d668 x27: dfff800000000000 -x26: ffff0000cb970c90 x25: 00000000000005dc x24: ffff0000c9c36ff2 -x23: ffff0000c9c37000 x22: 00000000000005ea x21: 00000000000006c0 -x20: 000000000000000e x19: ffff800088baa334 x18: 1fffe000368261ce -x17: ffff80008e4ed000 x16: ffff80008a8310f8 x15: 0000000000000001 -x14: 1ffff00012df2d58 x13: 0000000000000000 x12: 0000000000000000 -x11: 0000000000000001 x10: 0000000000ff0100 x9 : e28a51f1087e8400 -x8 : e28a51f1087e8400 x7 : ffff80008028f8d0 x6 : 0000000000000000 -x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff800082b78714 -x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000089 -Call trace: - skb_panic net/core/skbuff.c:189 [inline] - skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 - skb_push+0xf0/0x108 net/core/skbuff.c:2451 - eth_header+0x44/0x1f8 net/ethernet/eth.c:83 - dev_hard_header include/linux/netdevice.h:3188 [inline] - llc_mac_hdr_init+0x110/0x17c net/llc/llc_output.c:33 - llc_sap_action_send_xid_c+0x170/0x344 net/llc/llc_s_ac.c:85 - llc_exec_sap_trans_actions net/llc/llc_sap.c:153 [inline] - llc_sap_next_state net/llc/llc_sap.c:182 [inline] - llc_sap_state_process+0x1ec/0x774 net/llc/llc_sap.c:209 - llc_build_and_send_xid_pkt+0x12c/0x1c0 net/llc/llc_sap.c:270 - llc_ui_sendmsg+0x7bc/0xb1c net/llc/af_llc.c:997 - sock_sendmsg_nosec net/socket.c:730 [inline] - __sock_sendmsg net/socket.c:745 [inline] - sock_sendmsg+0x194/0x274 net/socket.c:767 - splice_to_socket+0x7cc/0xd58 fs/splice.c:881 - do_splice_from fs/splice.c:933 [inline] - direct_splice_actor+0xe4/0x1c0 fs/splice.c:1142 - splice_direct_to_actor+0x2a0/0x7e4 fs/splice.c:1088 - do_splice_direct+0x20c/0x348 fs/splice.c:1194 - do_sendfile+0x4bc/0xc70 fs/read_write.c:1254 - __do_sys_sendfile64 fs/read_write.c:1322 [inline] - __se_sys_sendfile64 fs/read_write.c:1308 [inline] - __arm64_sys_sendfile64+0x160/0x3b4 fs/read_write.c:1308 - __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] - invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51 - el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136 - do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155 - el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678 - el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696 - el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595 -Code: aa1803e6 aa1903e7 a90023f5 94792f6a (d4210000) - -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Reported-and-tested-by: syzbot+2a7024e9502df538e8ef@syzkaller.appspotmail.com -Signed-off-by: Eric Dumazet <edumazet@google.com> -Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> -Link: https://lore.kernel.org/r/20240118183625.4007013-1-edumazet@google.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/llc/af_llc.c | 24 ++++++++++++++++-------- - 1 file changed, 16 insertions(+), 8 deletions(-) - -diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c -index 9b06c380866b..20551cfb7da6 100644 ---- a/net/llc/af_llc.c -+++ b/net/llc/af_llc.c -@@ -928,14 +928,15 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, - */ - static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) - { -+ DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name); - struct sock *sk = sock->sk; - struct llc_sock *llc = llc_sk(sk); -- DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name); - int flags = msg->msg_flags; - int noblock = flags & MSG_DONTWAIT; -+ int rc = -EINVAL, copied = 0, hdrlen, hh_len; - struct sk_buff *skb = NULL; -+ struct net_device *dev; - size_t size = 0; -- int rc = -EINVAL, copied = 0, hdrlen; - - dprintk("%s: sending from %02X to %02X\n", __func__, - llc->laddr.lsap, llc->daddr.lsap); -@@ -955,22 +956,29 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) - if (rc) - goto out; - } -- hdrlen = llc->dev->hard_header_len + llc_ui_header_len(sk, addr); -+ dev = llc->dev; -+ hh_len = LL_RESERVED_SPACE(dev); -+ hdrlen = llc_ui_header_len(sk, addr); - size = hdrlen + len; -- if (size > llc->dev->mtu) -- size = llc->dev->mtu; -+ size = min_t(size_t, size, READ_ONCE(dev->mtu)); - copied = size - hdrlen; - rc = -EINVAL; - if (copied < 0) - goto out; - release_sock(sk); -- skb = sock_alloc_send_skb(sk, size, noblock, &rc); -+ skb = sock_alloc_send_skb(sk, hh_len + size, noblock, &rc); - lock_sock(sk); - if (!skb) - goto out; -- skb->dev = llc->dev; -+ if (sock_flag(sk, SOCK_ZAPPED) || -+ llc->dev != dev || -+ hdrlen != llc_ui_header_len(sk, addr) || -+ hh_len != LL_RESERVED_SPACE(dev) || -+ size > READ_ONCE(dev->mtu)) -+ goto out; -+ skb->dev = dev; - skb->protocol = llc_proto_type(addr->sllc_arphrd); -- skb_reserve(skb, hdrlen); -+ skb_reserve(skb, hh_len + hdrlen); - rc = memcpy_from_msg(skb_put(skb, copied), msg, copied); - if (rc) - goto out; --- -2.43.2 - -From df57fc2f2abf548aa889a36ab0bdcc94a75399dc Mon Sep 17 00:00:00 2001 -From: Kuniyuki Iwashima <kuniyu@amazon.com> -Date: Thu, 18 Jan 2024 17:55:15 -0800 -Subject: [PATCH 0825/1501] llc: Drop support for ETH_P_TR_802_2. -Content-Length: 4484 -Lines: 122 - -[ Upstream commit e3f9bed9bee261e3347131764e42aeedf1ffea61 ] - -syzbot reported an uninit-value bug below. [0] - -llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2 -(0x0011), and syzbot abused the latter to trigger the bug. - - write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, ')', "90e5dd"}}}}, 0x16) - -llc_conn_handler() initialises local variables {saddr,daddr}.mac -based on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes -them to __llc_lookup(). - -However, the initialisation is done only when skb->protocol is -htons(ETH_P_802_2), otherwise, __llc_lookup_established() and -__llc_lookup_listener() will read garbage. - -The missing initialisation existed prior to commit 211ed865108e -("net: delete all instances of special processing for token ring"). - -It removed the part to kick out the token ring stuff but forgot to -close the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv(). - -Let's remove llc_tr_packet_type and complete the deprecation. - -[0]: -BUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90 - __llc_lookup_established+0xe9d/0xf90 - __llc_lookup net/llc/llc_conn.c:611 [inline] - llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791 - llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 - __netif_receive_skb_one_core net/core/dev.c:5527 [inline] - __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641 - netif_receive_skb_internal net/core/dev.c:5727 [inline] - netif_receive_skb+0x58/0x660 net/core/dev.c:5786 - tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 - tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002 - tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 - call_write_iter include/linux/fs.h:2020 [inline] - new_sync_write fs/read_write.c:491 [inline] - vfs_write+0x8ef/0x1490 fs/read_write.c:584 - ksys_write+0x20f/0x4c0 fs/read_write.c:637 - __do_sys_write fs/read_write.c:649 [inline] - __se_sys_write fs/read_write.c:646 [inline] - __x64_sys_write+0x93/0xd0 fs/read_write.c:646 - do_syscall_x64 arch/x86/entry/common.c:51 [inline] - do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 - entry_SYSCALL_64_after_hwframe+0x63/0x6b - -Local variable daddr created at: - llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783 - llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 - -CPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0 -Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 - -Fixes: 211ed865108e ("net: delete all instances of special processing for token ring") -Reported-by: syzbot+b5ad66046b913bc04c6f@syzkaller.appspotmail.com -Closes: https://syzkaller.appspot.com/bug?extid=b5ad66046b913bc04c6f -Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> -Reviewed-by: Eric Dumazet <edumazet@google.com> -Link: https://lore.kernel.org/r/20240119015515.61898-1-kuniyu@amazon.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/net/llc_pdu.h | 6 ++---- - net/llc/llc_core.c | 7 ------- - 2 files changed, 2 insertions(+), 11 deletions(-) - -diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h -index 7e73f8e5e497..1d55ba7c45be 100644 ---- a/include/net/llc_pdu.h -+++ b/include/net/llc_pdu.h -@@ -262,8 +262,7 @@ static inline void llc_pdu_header_init(struct sk_buff *skb, u8 type, - */ - static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa) - { -- if (skb->protocol == htons(ETH_P_802_2)) -- memcpy(sa, eth_hdr(skb)->h_source, ETH_ALEN); -+ memcpy(sa, eth_hdr(skb)->h_source, ETH_ALEN); - } - - /** -@@ -275,8 +274,7 @@ static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa) - */ - static inline void llc_pdu_decode_da(struct sk_buff *skb, u8 *da) - { -- if (skb->protocol == htons(ETH_P_802_2)) -- memcpy(da, eth_hdr(skb)->h_dest, ETH_ALEN); -+ memcpy(da, eth_hdr(skb)->h_dest, ETH_ALEN); - } - - /** -diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c -index 6e387aadffce..4f16d9c88350 100644 ---- a/net/llc/llc_core.c -+++ b/net/llc/llc_core.c -@@ -135,22 +135,15 @@ static struct packet_type llc_packet_type __read_mostly = { - .func = llc_rcv, - }; - --static struct packet_type llc_tr_packet_type __read_mostly = { -- .type = cpu_to_be16(ETH_P_TR_802_2), -- .func = llc_rcv, --}; -- - static int __init llc_init(void) - { - dev_add_pack(&llc_packet_type); -- dev_add_pack(&llc_tr_packet_type); - return 0; - } - - static void __exit llc_exit(void) - { - dev_remove_pack(&llc_packet_type); -- dev_remove_pack(&llc_tr_packet_type); - } - - module_init(llc_init); --- -2.43.2 - -From 4ff8c69389f221ac1ebedd4fb15be6d2b83d44bb Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Thu, 18 Jan 2024 20:17:49 +0000 -Subject: [PATCH 0826/1501] udp: fix busy polling -Content-Length: 4061 -Lines: 126 - -[ Upstream commit a54d51fb2dfb846aedf3751af501e9688db447f5 ] - -Generic sk_busy_loop_end() only looks at sk->sk_receive_queue -for presence of packets. - -Problem is that for UDP sockets after blamed commit, some packets -could be present in another queue: udp_sk(sk)->reader_queue - -In some cases, a busy poller could spin until timeout expiration, -even if some packets are available in udp_sk(sk)->reader_queue. - -v3: - make sk_busy_loop_end() nicer (Willem) - -v2: - add a READ_ONCE(sk->sk_family) in sk_is_inet() to avoid KCSAN splats. - - add a sk_is_inet() check in sk_is_udp() (Willem feedback) - - add a sk_is_inet() check in sk_is_tcp(). - -Fixes: 2276f58ac589 ("udp: use a separate rx queue for packet reception") -Signed-off-by: Eric Dumazet <edumazet@google.com> -Reviewed-by: Paolo Abeni <pabeni@redhat.com> -Reviewed-by: Willem de Bruijn <willemb@google.com> -Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/linux/skmsg.h | 6 ------ - include/net/inet_sock.h | 5 ----- - include/net/sock.h | 18 +++++++++++++++++- - net/core/sock.c | 11 +++++++++-- - 4 files changed, 26 insertions(+), 14 deletions(-) - -diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h -index c953b8c0d2f4..bd4418377bac 100644 ---- a/include/linux/skmsg.h -+++ b/include/linux/skmsg.h -@@ -500,12 +500,6 @@ static inline bool sk_psock_strp_enabled(struct sk_psock *psock) - return !!psock->saved_data_ready; - } - --static inline bool sk_is_udp(const struct sock *sk) --{ -- return sk->sk_type == SOCK_DGRAM && -- sk->sk_protocol == IPPROTO_UDP; --} -- - #if IS_ENABLED(CONFIG_NET_SOCK_MSG) - - #define BPF_F_STRPARSER (1UL << 1) -diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h -index 74db6d97cae1..8d5fe15b0f6f 100644 ---- a/include/net/inet_sock.h -+++ b/include/net/inet_sock.h -@@ -310,11 +310,6 @@ static inline unsigned long inet_cmsg_flags(const struct inet_sock *inet) - #define inet_assign_bit(nr, sk, val) \ - assign_bit(INET_FLAGS_##nr, &inet_sk(sk)->inet_flags, val) - --static inline bool sk_is_inet(struct sock *sk) --{ -- return sk->sk_family == AF_INET || sk->sk_family == AF_INET6; --} -- - /** - * sk_to_full_sk - Access to a full socket - * @sk: pointer to a socket -diff --git a/include/net/sock.h b/include/net/sock.h -index 0201136b0b9c..f9a9f61fa122 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -2794,9 +2794,25 @@ static inline void skb_setup_tx_timestamp(struct sk_buff *skb, __u16 tsflags) - &skb_shinfo(skb)->tskey); - } - -+static inline bool sk_is_inet(const struct sock *sk) -+{ -+ int family = READ_ONCE(sk->sk_family); -+ -+ return family == AF_INET || family == AF_INET6; -+} -+ - static inline bool sk_is_tcp(const struct sock *sk) - { -- return sk->sk_type == SOCK_STREAM && sk->sk_protocol == IPPROTO_TCP; -+ return sk_is_inet(sk) && -+ sk->sk_type == SOCK_STREAM && -+ sk->sk_protocol == IPPROTO_TCP; -+} -+ -+static inline bool sk_is_udp(const struct sock *sk) -+{ -+ return sk_is_inet(sk) && -+ sk->sk_type == SOCK_DGRAM && -+ sk->sk_protocol == IPPROTO_UDP; - } - - static inline bool sk_is_stream_unix(const struct sock *sk) -diff --git a/net/core/sock.c b/net/core/sock.c -index d02534c77413..e5d43a068f8e 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -107,6 +107,7 @@ - #include <linux/interrupt.h> - #include <linux/poll.h> - #include <linux/tcp.h> -+#include <linux/udp.h> - #include <linux/init.h> - #include <linux/highmem.h> - #include <linux/user_namespace.h> -@@ -4148,8 +4149,14 @@ bool sk_busy_loop_end(void *p, unsigned long start_time) - { - struct sock *sk = p; - -- return !skb_queue_empty_lockless(&sk->sk_receive_queue) || -- sk_busy_loop_timeout(sk, start_time); -+ if (!skb_queue_empty_lockless(&sk->sk_receive_queue)) -+ return true; -+ -+ if (sk_is_udp(sk) && -+ !skb_queue_empty_lockless(&udp_sk(sk)->reader_queue)) -+ return true; -+ -+ return sk_busy_loop_timeout(sk, start_time); - } - EXPORT_SYMBOL(sk_busy_loop_end); - #endif /* CONFIG_NET_RX_BUSY_POLL */ --- -2.43.2 - -From 22346088d33f051a0c848d711534daa3e47cf6af Mon Sep 17 00:00:00 2001 -From: Michal Schmidt <mschmidt@redhat.com> -Date: Thu, 18 Jan 2024 21:50:40 +0100 -Subject: [PATCH 0827/1501] idpf: distinguish vports by the dev_port attribute -Content-Length: 1780 -Lines: 44 - -[ Upstream commit 359724fa3ab79fbe9f42c6263cddc2afae32eef3 ] - -idpf registers multiple netdevs (virtual ports) for one PCI function, -but it does not provide a way for userspace to distinguish them with -sysfs attributes. Per Documentation/ABI/testing/sysfs-class-net, it is -a bug not to set dev_port for independent ports on the same PCI bus, -device and function. - -Without dev_port set, systemd-udevd's default naming policy attempts -to assign the same name ("ens2f0") to all four idpf netdevs on my test -system and obviously fails, leaving three of them with the initial -eth<N> name. - -With this patch, systemd-udevd is able to assign unique names to the -netdevs (e.g. "ens2f0", "ens2f0d1", "ens2f0d2", "ens2f0d3"). - -The Intel-provided out-of-tree idpf driver already sets dev_port. In -this patch I chose to do it in the same place in the idpf_cfg_netdev -function. - -Fixes: 0fe45467a104 ("idpf: add create vport and netdev configuration") -Signed-off-by: Michal Schmidt <mschmidt@redhat.com> -Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/intel/idpf/idpf_lib.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c b/drivers/net/ethernet/intel/idpf/idpf_lib.c -index 19809b0ddcd9..0241e498cc20 100644 ---- a/drivers/net/ethernet/intel/idpf/idpf_lib.c -+++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c -@@ -783,6 +783,8 @@ static int idpf_cfg_netdev(struct idpf_vport *vport) - /* setup watchdog timeout value to be 5 second */ - netdev->watchdog_timeo = 5 * HZ; - -+ netdev->dev_port = idx; -+ - /* configure default MTU size */ - netdev->min_mtu = ETH_MIN_MTU; - netdev->max_mtu = vport->max_mtu; --- -2.43.2 - -From 8072699aa9e67d1727692cfb3c347263bb627fb9 Mon Sep 17 00:00:00 2001 -From: Jakub Kicinski <kuba@kernel.org> -Date: Thu, 18 Jan 2024 16:58:59 -0800 -Subject: [PATCH 0828/1501] net: fix removing a namespace with conflicting - altnames -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2802 -Lines: 70 - -[ Upstream commit d09486a04f5da0a812c26217213b89a3b1acf836 ] - -Mark reports a BUG() when a net namespace is removed. - - kernel BUG at net/core/dev.c:11520! - -Physical interfaces moved outside of init_net get "refunded" -to init_net when that namespace disappears. The main interface -name may get overwritten in the process if it would have -conflicted. We need to also discard all conflicting altnames. -Recent fixes addressed ensuring that altnames get moved -with the main interface, which surfaced this problem. - -Reported-by: Марк Коренберг <socketpair@gmail.com> -Link: https://lore.kernel.org/all/CAEmTpZFZ4Sv3KwqFOY2WKDHeZYdi0O7N5H1nTvcGp=SAEavtDg@mail.gmail.com/ -Fixes: 7663d522099e ("net: check for altname conflicts when changing netdev's netns") -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Reviewed-by: Eric Dumazet <edumazet@google.com> -Reviewed-by: Jiri Pirko <jiri@nvidia.com> -Reviewed-by: Xin Long <lucien.xin@gmail.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/core/dev.c | 9 +++++++++ - net/core/dev.h | 3 +++ - 2 files changed, 12 insertions(+) - -diff --git a/net/core/dev.c b/net/core/dev.c -index ad20bebe153f..add22ca0dff9 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -11509,6 +11509,7 @@ static struct pernet_operations __net_initdata netdev_net_ops = { - - static void __net_exit default_device_exit_net(struct net *net) - { -+ struct netdev_name_node *name_node, *tmp; - struct net_device *dev, *aux; - /* - * Push all migratable network devices back to the -@@ -11531,6 +11532,14 @@ static void __net_exit default_device_exit_net(struct net *net) - snprintf(fb_name, IFNAMSIZ, "dev%d", dev->ifindex); - if (netdev_name_in_use(&init_net, fb_name)) - snprintf(fb_name, IFNAMSIZ, "dev%%d"); -+ -+ netdev_for_each_altname_safe(dev, name_node, tmp) -+ if (netdev_name_in_use(&init_net, name_node->name)) { -+ netdev_name_node_del(name_node); -+ synchronize_rcu(); -+ __netdev_name_node_alt_destroy(name_node); -+ } -+ - err = dev_change_net_namespace(dev, &init_net, fb_name); - if (err) { - pr_emerg("%s: failed to move %s to init_net: %d\n", -diff --git a/net/core/dev.h b/net/core/dev.h -index 5aa45f0fd4ae..3f5eb92396b6 100644 ---- a/net/core/dev.h -+++ b/net/core/dev.h -@@ -64,6 +64,9 @@ int dev_change_name(struct net_device *dev, const char *newname); - - #define netdev_for_each_altname(dev, namenode) \ - list_for_each_entry((namenode), &(dev)->name_node->list, list) -+#define netdev_for_each_altname_safe(dev, namenode, next) \ -+ list_for_each_entry_safe((namenode), (next), &(dev)->name_node->list, \ -+ list) - - int netdev_name_node_alt_create(struct net_device *dev, const char *name); - int netdev_name_node_alt_destroy(struct net_device *dev, const char *name); --- -2.43.2 - -From 4efd09da0d49fb2a5d0138f339d973e7a41a966c Mon Sep 17 00:00:00 2001 -From: Yunjian Wang <wangyunjian@huawei.com> -Date: Fri, 19 Jan 2024 18:22:35 +0800 -Subject: [PATCH 0829/1501] tun: fix missing dropped counter in tun_xdp_act -Content-Length: 1349 -Lines: 44 - -[ Upstream commit 5744ba05e7c4bff8fec133dd0f9e51ddffba92f5 ] - -The commit 8ae1aff0b331 ("tuntap: split out XDP logic") includes -dropped counter for XDP_DROP, XDP_ABORTED, and invalid XDP actions. -Unfortunately, that commit missed the dropped counter when error -occurs during XDP_TX and XDP_REDIRECT actions. This patch fixes -this issue. - -Fixes: 8ae1aff0b331 ("tuntap: split out XDP logic") -Signed-off-by: Yunjian Wang <wangyunjian@huawei.com> -Reviewed-by: Willem de Bruijn <willemb@google.com> -Acked-by: Jason Wang <jasowang@redhat.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/tun.c | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index afa5497f7c35..237fef557ba5 100644 ---- a/drivers/net/tun.c -+++ b/drivers/net/tun.c -@@ -1630,13 +1630,17 @@ static int tun_xdp_act(struct tun_struct *tun, struct bpf_prog *xdp_prog, - switch (act) { - case XDP_REDIRECT: - err = xdp_do_redirect(tun->dev, xdp, xdp_prog); -- if (err) -+ if (err) { -+ dev_core_stats_rx_dropped_inc(tun->dev); - return err; -+ } - break; - case XDP_TX: - err = tun_xdp_tx(tun->dev, xdp); -- if (err < 0) -+ if (err < 0) { -+ dev_core_stats_rx_dropped_inc(tun->dev); - return err; -+ } - break; - case XDP_PASS: - break; --- -2.43.2 - -From 6438382dd9f80ba8d51ad8b86d20061b783d8702 Mon Sep 17 00:00:00 2001 -From: Yunjian Wang <wangyunjian@huawei.com> -Date: Fri, 19 Jan 2024 18:22:56 +0800 -Subject: [PATCH 0830/1501] tun: add missing rx stats accounting in tun_xdp_act -Content-Length: 1460 -Lines: 41 - -[ Upstream commit f1084c427f55d573fcd5688d9ba7b31b78019716 ] - -The TUN can be used as vhost-net backend, and it is necessary to -count the packets transmitted from TUN to vhost-net/virtio-net. -However, there are some places in the receive path that were not -taken into account when using XDP. It would be beneficial to also -include new accounting for successfully received bytes using -dev_sw_netstats_rx_add. - -Fixes: 761876c857cb ("tap: XDP support") -Signed-off-by: Yunjian Wang <wangyunjian@huawei.com> -Reviewed-by: Willem de Bruijn <willemb@google.com> -Acked-by: Jason Wang <jasowang@redhat.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/tun.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index 237fef557ba5..4a4f8c8e79fa 100644 ---- a/drivers/net/tun.c -+++ b/drivers/net/tun.c -@@ -1634,6 +1634,7 @@ static int tun_xdp_act(struct tun_struct *tun, struct bpf_prog *xdp_prog, - dev_core_stats_rx_dropped_inc(tun->dev); - return err; - } -+ dev_sw_netstats_rx_add(tun->dev, xdp->data_end - xdp->data); - break; - case XDP_TX: - err = tun_xdp_tx(tun->dev, xdp); -@@ -1641,6 +1642,7 @@ static int tun_xdp_act(struct tun_struct *tun, struct bpf_prog *xdp_prog, - dev_core_stats_rx_dropped_inc(tun->dev); - return err; - } -+ dev_sw_netstats_rx_add(tun->dev, xdp->data_end - xdp->data); - break; - case XDP_PASS: - break; --- -2.43.2 - -From 79fc259dca8689150c30869e3c667fb635d543c8 Mon Sep 17 00:00:00 2001 -From: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> -Date: Fri, 19 Jan 2024 14:43:01 +0100 -Subject: [PATCH 0831/1501] dpll: fix broken error path in dpll_pin_alloc(..) -Content-Length: 1537 -Lines: 46 - -[ Upstream commit b6a11a7fc4d6337f7ea720b9287d1b9749c4eae0 ] - -If pin type is not expected, or pin properities failed to allocate -memory, the unwind error path shall not destroy pin's xarrays, which -were not yet initialized. -Add new goto label and use it to fix broken error path. - -Reviewed-by: Jiri Pirko <jiri@nvidia.com> -Signed-off-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Stable-dep-of: 830ead5fb0c5 ("dpll: fix pin dump crash for rebound module") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/dpll/dpll_core.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/drivers/dpll/dpll_core.c b/drivers/dpll/dpll_core.c -index 3568149b9562..36f5c0eaf604 100644 ---- a/drivers/dpll/dpll_core.c -+++ b/drivers/dpll/dpll_core.c -@@ -440,7 +440,7 @@ dpll_pin_alloc(u64 clock_id, u32 pin_idx, struct module *module, - if (WARN_ON(prop->type < DPLL_PIN_TYPE_MUX || - prop->type > DPLL_PIN_TYPE_MAX)) { - ret = -EINVAL; -- goto err; -+ goto err_pin_prop; - } - pin->prop = prop; - refcount_set(&pin->refcount, 1); -@@ -448,11 +448,12 @@ dpll_pin_alloc(u64 clock_id, u32 pin_idx, struct module *module, - xa_init_flags(&pin->parent_refs, XA_FLAGS_ALLOC); - ret = xa_alloc(&dpll_pin_xa, &pin->id, pin, xa_limit_16b, GFP_KERNEL); - if (ret) -- goto err; -+ goto err_xa_alloc; - return pin; --err: -+err_xa_alloc: - xa_destroy(&pin->dpll_refs); - xa_destroy(&pin->parent_refs); -+err_pin_prop: - kfree(pin); - return ERR_PTR(ret); - } --- -2.43.2 - -From 5050a5b9d8b4d3c6f7e376e07670e437db7ccf9c Mon Sep 17 00:00:00 2001 -From: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> -Date: Fri, 19 Jan 2024 14:43:02 +0100 -Subject: [PATCH 0832/1501] dpll: fix pin dump crash for rebound module -Content-Length: 8936 -Lines: 250 - -[ Upstream commit 830ead5fb0c5855ce4d70ba2ed4a673b5f1e7d9b ] - -When a kernel module is unbound but the pin resources were not entirely -freed (other kernel module instance of the same PCI device have had kept -the reference to that pin), and kernel module is again bound, the pin -properties would not be updated (the properties are only assigned when -memory for the pin is allocated), prop pointer still points to the -kernel module memory of the kernel module which was deallocated on the -unbind. - -If the pin dump is invoked in this state, the result is a kernel crash. -Prevent the crash by storing persistent pin properties in dpll subsystem, -copy the content from the kernel module when pin is allocated, instead of -using memory of the kernel module. - -Fixes: 9431063ad323 ("dpll: core: Add DPLL framework base functions") -Fixes: 9d71b54b65b1 ("dpll: netlink: Add DPLL framework base functions") -Reviewed-by: Jan Glaza <jan.glaza@intel.com> -Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> -Signed-off-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> -Reviewed-by: Jiri Pirko <jiri@nvidia.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/dpll/dpll_core.c | 55 +++++++++++++++++++++++++++++++++++-- - drivers/dpll/dpll_core.h | 4 +-- - drivers/dpll/dpll_netlink.c | 28 +++++++++---------- - 3 files changed, 69 insertions(+), 18 deletions(-) - -diff --git a/drivers/dpll/dpll_core.c b/drivers/dpll/dpll_core.c -index 36f5c0eaf604..5e3b9b5679f9 100644 ---- a/drivers/dpll/dpll_core.c -+++ b/drivers/dpll/dpll_core.c -@@ -424,6 +424,53 @@ void dpll_device_unregister(struct dpll_device *dpll, - } - EXPORT_SYMBOL_GPL(dpll_device_unregister); - -+static void dpll_pin_prop_free(struct dpll_pin_properties *prop) -+{ -+ kfree(prop->package_label); -+ kfree(prop->panel_label); -+ kfree(prop->board_label); -+ kfree(prop->freq_supported); -+} -+ -+static int dpll_pin_prop_dup(const struct dpll_pin_properties *src, -+ struct dpll_pin_properties *dst) -+{ -+ memcpy(dst, src, sizeof(*dst)); -+ if (src->freq_supported && src->freq_supported_num) { -+ size_t freq_size = src->freq_supported_num * -+ sizeof(*src->freq_supported); -+ dst->freq_supported = kmemdup(src->freq_supported, -+ freq_size, GFP_KERNEL); -+ if (!src->freq_supported) -+ return -ENOMEM; -+ } -+ if (src->board_label) { -+ dst->board_label = kstrdup(src->board_label, GFP_KERNEL); -+ if (!dst->board_label) -+ goto err_board_label; -+ } -+ if (src->panel_label) { -+ dst->panel_label = kstrdup(src->panel_label, GFP_KERNEL); -+ if (!dst->panel_label) -+ goto err_panel_label; -+ } -+ if (src->package_label) { -+ dst->package_label = kstrdup(src->package_label, GFP_KERNEL); -+ if (!dst->package_label) -+ goto err_package_label; -+ } -+ -+ return 0; -+ -+err_package_label: -+ kfree(dst->panel_label); -+err_panel_label: -+ kfree(dst->board_label); -+err_board_label: -+ kfree(dst->freq_supported); -+ return -ENOMEM; -+} -+ - static struct dpll_pin * - dpll_pin_alloc(u64 clock_id, u32 pin_idx, struct module *module, - const struct dpll_pin_properties *prop) -@@ -442,7 +489,9 @@ dpll_pin_alloc(u64 clock_id, u32 pin_idx, struct module *module, - ret = -EINVAL; - goto err_pin_prop; - } -- pin->prop = prop; -+ ret = dpll_pin_prop_dup(prop, &pin->prop); -+ if (ret) -+ goto err_pin_prop; - refcount_set(&pin->refcount, 1); - xa_init_flags(&pin->dpll_refs, XA_FLAGS_ALLOC); - xa_init_flags(&pin->parent_refs, XA_FLAGS_ALLOC); -@@ -453,6 +502,7 @@ dpll_pin_alloc(u64 clock_id, u32 pin_idx, struct module *module, - err_xa_alloc: - xa_destroy(&pin->dpll_refs); - xa_destroy(&pin->parent_refs); -+ dpll_pin_prop_free(&pin->prop); - err_pin_prop: - kfree(pin); - return ERR_PTR(ret); -@@ -513,6 +563,7 @@ void dpll_pin_put(struct dpll_pin *pin) - xa_destroy(&pin->dpll_refs); - xa_destroy(&pin->parent_refs); - xa_erase(&dpll_pin_xa, pin->id); -+ dpll_pin_prop_free(&pin->prop); - kfree(pin); - } - mutex_unlock(&dpll_lock); -@@ -635,7 +686,7 @@ int dpll_pin_on_pin_register(struct dpll_pin *parent, struct dpll_pin *pin, - unsigned long i, stop; - int ret; - -- if (WARN_ON(parent->prop->type != DPLL_PIN_TYPE_MUX)) -+ if (WARN_ON(parent->prop.type != DPLL_PIN_TYPE_MUX)) - return -EINVAL; - - if (WARN_ON(!ops) || -diff --git a/drivers/dpll/dpll_core.h b/drivers/dpll/dpll_core.h -index 5585873c5c1b..717f715015c7 100644 ---- a/drivers/dpll/dpll_core.h -+++ b/drivers/dpll/dpll_core.h -@@ -44,7 +44,7 @@ struct dpll_device { - * @module: module of creator - * @dpll_refs: hold referencees to dplls pin was registered with - * @parent_refs: hold references to parent pins pin was registered with -- * @prop: pointer to pin properties given by registerer -+ * @prop: pin properties copied from the registerer - * @rclk_dev_name: holds name of device when pin can recover clock from it - * @refcount: refcount - **/ -@@ -55,7 +55,7 @@ struct dpll_pin { - struct module *module; - struct xarray dpll_refs; - struct xarray parent_refs; -- const struct dpll_pin_properties *prop; -+ struct dpll_pin_properties prop; - refcount_t refcount; - }; - -diff --git a/drivers/dpll/dpll_netlink.c b/drivers/dpll/dpll_netlink.c -index ce7cf736f020..4c64611d32ac 100644 ---- a/drivers/dpll/dpll_netlink.c -+++ b/drivers/dpll/dpll_netlink.c -@@ -278,17 +278,17 @@ dpll_msg_add_pin_freq(struct sk_buff *msg, struct dpll_pin *pin, - if (nla_put_64bit(msg, DPLL_A_PIN_FREQUENCY, sizeof(freq), &freq, - DPLL_A_PIN_PAD)) - return -EMSGSIZE; -- for (fs = 0; fs < pin->prop->freq_supported_num; fs++) { -+ for (fs = 0; fs < pin->prop.freq_supported_num; fs++) { - nest = nla_nest_start(msg, DPLL_A_PIN_FREQUENCY_SUPPORTED); - if (!nest) - return -EMSGSIZE; -- freq = pin->prop->freq_supported[fs].min; -+ freq = pin->prop.freq_supported[fs].min; - if (nla_put_64bit(msg, DPLL_A_PIN_FREQUENCY_MIN, sizeof(freq), - &freq, DPLL_A_PIN_PAD)) { - nla_nest_cancel(msg, nest); - return -EMSGSIZE; - } -- freq = pin->prop->freq_supported[fs].max; -+ freq = pin->prop.freq_supported[fs].max; - if (nla_put_64bit(msg, DPLL_A_PIN_FREQUENCY_MAX, sizeof(freq), - &freq, DPLL_A_PIN_PAD)) { - nla_nest_cancel(msg, nest); -@@ -304,9 +304,9 @@ static bool dpll_pin_is_freq_supported(struct dpll_pin *pin, u32 freq) - { - int fs; - -- for (fs = 0; fs < pin->prop->freq_supported_num; fs++) -- if (freq >= pin->prop->freq_supported[fs].min && -- freq <= pin->prop->freq_supported[fs].max) -+ for (fs = 0; fs < pin->prop.freq_supported_num; fs++) -+ if (freq >= pin->prop.freq_supported[fs].min && -+ freq <= pin->prop.freq_supported[fs].max) - return true; - return false; - } -@@ -396,7 +396,7 @@ static int - dpll_cmd_pin_get_one(struct sk_buff *msg, struct dpll_pin *pin, - struct netlink_ext_ack *extack) - { -- const struct dpll_pin_properties *prop = pin->prop; -+ const struct dpll_pin_properties *prop = &pin->prop; - struct dpll_pin_ref *ref; - int ret; - -@@ -689,7 +689,7 @@ dpll_pin_on_pin_state_set(struct dpll_pin *pin, u32 parent_idx, - int ret; - - if (!(DPLL_PIN_CAPABILITIES_STATE_CAN_CHANGE & -- pin->prop->capabilities)) { -+ pin->prop.capabilities)) { - NL_SET_ERR_MSG(extack, "state changing is not allowed"); - return -EOPNOTSUPP; - } -@@ -725,7 +725,7 @@ dpll_pin_state_set(struct dpll_device *dpll, struct dpll_pin *pin, - int ret; - - if (!(DPLL_PIN_CAPABILITIES_STATE_CAN_CHANGE & -- pin->prop->capabilities)) { -+ pin->prop.capabilities)) { - NL_SET_ERR_MSG(extack, "state changing is not allowed"); - return -EOPNOTSUPP; - } -@@ -752,7 +752,7 @@ dpll_pin_prio_set(struct dpll_device *dpll, struct dpll_pin *pin, - int ret; - - if (!(DPLL_PIN_CAPABILITIES_PRIORITY_CAN_CHANGE & -- pin->prop->capabilities)) { -+ pin->prop.capabilities)) { - NL_SET_ERR_MSG(extack, "prio changing is not allowed"); - return -EOPNOTSUPP; - } -@@ -780,7 +780,7 @@ dpll_pin_direction_set(struct dpll_pin *pin, struct dpll_device *dpll, - int ret; - - if (!(DPLL_PIN_CAPABILITIES_DIRECTION_CAN_CHANGE & -- pin->prop->capabilities)) { -+ pin->prop.capabilities)) { - NL_SET_ERR_MSG(extack, "direction changing is not allowed"); - return -EOPNOTSUPP; - } -@@ -810,8 +810,8 @@ dpll_pin_phase_adj_set(struct dpll_pin *pin, struct nlattr *phase_adj_attr, - int ret; - - phase_adj = nla_get_s32(phase_adj_attr); -- if (phase_adj > pin->prop->phase_range.max || -- phase_adj < pin->prop->phase_range.min) { -+ if (phase_adj > pin->prop.phase_range.max || -+ phase_adj < pin->prop.phase_range.min) { - NL_SET_ERR_MSG_ATTR(extack, phase_adj_attr, - "phase adjust value not supported"); - return -EINVAL; -@@ -995,7 +995,7 @@ dpll_pin_find(u64 clock_id, struct nlattr *mod_name_attr, - unsigned long i; - - xa_for_each_marked(&dpll_pin_xa, i, pin, DPLL_REGISTERED) { -- prop = pin->prop; -+ prop = &pin->prop; - cid_match = clock_id ? pin->clock_id == clock_id : true; - mod_match = mod_name_attr && module_name(pin->module) ? - !nla_strcmp(mod_name_attr, --- -2.43.2 - -From 1e741ec11f244f0ee5e5338c984b7c9880864e32 Mon Sep 17 00:00:00 2001 -From: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> -Date: Fri, 19 Jan 2024 14:43:03 +0100 -Subject: [PATCH 0833/1501] dpll: fix userspace availability of pins -Content-Length: 3248 -Lines: 90 - -[ Upstream commit db2ec3c94667eaeecc6a74d96594fab6baf80fdc ] - -If parent pin was unregistered but child pin was not, the userspace -would see the "zombie" pins - the ones that were registered with -a parent pin (dpll_pin_on_pin_register(..)). -Technically those are not available - as there is no dpll device in the -system. Do not dump those pins and prevent userspace from any -interaction with them. Provide a unified function to determine if the -pin is available and use it before acting/responding for user requests. - -Fixes: 9d71b54b65b1 ("dpll: netlink: Add DPLL framework base functions") -Reviewed-by: Jan Glaza <jan.glaza@intel.com> -Reviewed-by: Jiri Pirko <jiri@nvidia.com> -Signed-off-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/dpll/dpll_netlink.c | 29 +++++++++++++++++++++++++++-- - 1 file changed, 27 insertions(+), 2 deletions(-) - -diff --git a/drivers/dpll/dpll_netlink.c b/drivers/dpll/dpll_netlink.c -index 4c64611d32ac..7cc99d627942 100644 ---- a/drivers/dpll/dpll_netlink.c -+++ b/drivers/dpll/dpll_netlink.c -@@ -525,6 +525,24 @@ __dpll_device_change_ntf(struct dpll_device *dpll) - return dpll_device_event_send(DPLL_CMD_DEVICE_CHANGE_NTF, dpll); - } - -+static bool dpll_pin_available(struct dpll_pin *pin) -+{ -+ struct dpll_pin_ref *par_ref; -+ unsigned long i; -+ -+ if (!xa_get_mark(&dpll_pin_xa, pin->id, DPLL_REGISTERED)) -+ return false; -+ xa_for_each(&pin->parent_refs, i, par_ref) -+ if (xa_get_mark(&dpll_pin_xa, par_ref->pin->id, -+ DPLL_REGISTERED)) -+ return true; -+ xa_for_each(&pin->dpll_refs, i, par_ref) -+ if (xa_get_mark(&dpll_device_xa, par_ref->dpll->id, -+ DPLL_REGISTERED)) -+ return true; -+ return false; -+} -+ - /** - * dpll_device_change_ntf - notify that the dpll device has been changed - * @dpll: registered dpll pointer -@@ -551,7 +569,7 @@ dpll_pin_event_send(enum dpll_cmd event, struct dpll_pin *pin) - int ret = -ENOMEM; - void *hdr; - -- if (WARN_ON(!xa_get_mark(&dpll_pin_xa, pin->id, DPLL_REGISTERED))) -+ if (!dpll_pin_available(pin)) - return -ENODEV; - - msg = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); -@@ -1102,6 +1120,10 @@ int dpll_nl_pin_id_get_doit(struct sk_buff *skb, struct genl_info *info) - } - pin = dpll_pin_find_from_nlattr(info); - if (!IS_ERR(pin)) { -+ if (!dpll_pin_available(pin)) { -+ nlmsg_free(msg); -+ return -ENODEV; -+ } - ret = dpll_msg_add_pin_handle(msg, pin); - if (ret) { - nlmsg_free(msg); -@@ -1151,6 +1173,8 @@ int dpll_nl_pin_get_dumpit(struct sk_buff *skb, struct netlink_callback *cb) - - xa_for_each_marked_start(&dpll_pin_xa, i, pin, DPLL_REGISTERED, - ctx->idx) { -+ if (!dpll_pin_available(pin)) -+ continue; - hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, - cb->nlh->nlmsg_seq, - &dpll_nl_family, NLM_F_MULTI, -@@ -1413,7 +1437,8 @@ int dpll_pin_pre_doit(const struct genl_split_ops *ops, struct sk_buff *skb, - } - info->user_ptr[0] = xa_load(&dpll_pin_xa, - nla_get_u32(info->attrs[DPLL_A_PIN_ID])); -- if (!info->user_ptr[0]) { -+ if (!info->user_ptr[0] || -+ !dpll_pin_available(info->user_ptr[0])) { - NL_SET_ERR_MSG(info->extack, "pin not found"); - ret = -ENODEV; - goto unlock_dev; --- -2.43.2 - -From fe7fc23a95035b08fae299655c34e495a03ca6db Mon Sep 17 00:00:00 2001 -From: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> -Date: Fri, 19 Jan 2024 14:43:04 +0100 -Subject: [PATCH 0834/1501] dpll: fix register pin with unregistered parent pin -Content-Length: 2525 -Lines: 61 - -[ Upstream commit 7dc5b18ff71bd6f948810ab8a08b6a6ff8b315c5 ] - -In case of multiple kernel module instances using the same dpll device: -if only one registers dpll device, then only that one can register -directly connected pins with a dpll device. When unregistered parent is -responsible for determining if the muxed pin can be registered with it -or not, the drivers need to be loaded in serialized order to work -correctly - first the driver instance which registers the direct pins -needs to be loaded, then the other instances could register muxed type -pins. - -Allow registration of a pin with a parent even if the parent was not -yet registered, thus allow ability for unserialized driver instance -load order. -Do not WARN_ON notification for unregistered pin, which can be invoked -for described case, instead just return error. - -Fixes: 9431063ad323 ("dpll: core: Add DPLL framework base functions") -Fixes: 9d71b54b65b1 ("dpll: netlink: Add DPLL framework base functions") -Reviewed-by: Jan Glaza <jan.glaza@intel.com> -Reviewed-by: Jiri Pirko <jiri@nvidia.com> -Signed-off-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/dpll/dpll_core.c | 6 ------ - 1 file changed, 6 deletions(-) - -diff --git a/drivers/dpll/dpll_core.c b/drivers/dpll/dpll_core.c -index 5e3b9b5679f9..f8fbf0394288 100644 ---- a/drivers/dpll/dpll_core.c -+++ b/drivers/dpll/dpll_core.c -@@ -28,8 +28,6 @@ static u32 dpll_xa_id; - WARN_ON_ONCE(!xa_get_mark(&dpll_device_xa, (d)->id, DPLL_REGISTERED)) - #define ASSERT_DPLL_NOT_REGISTERED(d) \ - WARN_ON_ONCE(xa_get_mark(&dpll_device_xa, (d)->id, DPLL_REGISTERED)) --#define ASSERT_PIN_REGISTERED(p) \ -- WARN_ON_ONCE(!xa_get_mark(&dpll_pin_xa, (p)->id, DPLL_REGISTERED)) - - struct dpll_device_registration { - struct list_head list; -@@ -614,8 +612,6 @@ dpll_pin_register(struct dpll_device *dpll, struct dpll_pin *pin, - WARN_ON(!ops->state_on_dpll_get) || - WARN_ON(!ops->direction_get)) - return -EINVAL; -- if (ASSERT_DPLL_REGISTERED(dpll)) -- return -EINVAL; - - mutex_lock(&dpll_lock); - if (WARN_ON(!(dpll->module == pin->module && -@@ -693,8 +689,6 @@ int dpll_pin_on_pin_register(struct dpll_pin *parent, struct dpll_pin *pin, - WARN_ON(!ops->state_on_pin_get) || - WARN_ON(!ops->direction_get)) - return -EINVAL; -- if (ASSERT_PIN_REGISTERED(parent)) -- return -EINVAL; - - mutex_lock(&dpll_lock); - ret = dpll_xa_ref_pin_add(&pin->parent_refs, parent, ops, priv); --- -2.43.2 - -From 3d0b8f9bd0c15239e23da22f048d9a3daa91cc15 Mon Sep 17 00:00:00 2001 -From: Horatiu Vultur <horatiu.vultur@microchip.com> -Date: Fri, 19 Jan 2024 11:47:50 +0100 -Subject: [PATCH 0835/1501] net: micrel: Fix PTP frame parsing for lan8814 -Content-Length: 2291 -Lines: 53 - -[ Upstream commit aaf632f7ab6dec57bc9329a438f94504fe8034b9 ] - -The HW has the capability to check each frame if it is a PTP frame, -which domain it is, which ptp frame type it is, different ip address in -the frame. And if one of these checks fail then the frame is not -timestamp. Most of these checks were disabled except checking the field -minorVersionPTP inside the PTP header. Meaning that once a partner sends -a frame compliant to 8021AS which has minorVersionPTP set to 1, then the -frame was not timestamp because the HW expected by default a value of 0 -in minorVersionPTP. This is exactly the same issue as on lan8841. -Fix this issue by removing this check so the userspace can decide on this. - -Fixes: ece19502834d ("net: phy: micrel: 1588 support for LAN8814 phy") -Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com> -Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> -Reviewed-by: Divya Koppera <divya.koppera@microchip.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/phy/micrel.c | 11 +++++++++++ - 1 file changed, 11 insertions(+) - -diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c -index ce5ad4a82481..858175ca58cd 100644 ---- a/drivers/net/phy/micrel.c -+++ b/drivers/net/phy/micrel.c -@@ -120,6 +120,11 @@ - */ - #define LAN8814_1PPM_FORMAT 17179 - -+#define PTP_RX_VERSION 0x0248 -+#define PTP_TX_VERSION 0x0288 -+#define PTP_MAX_VERSION(x) (((x) & GENMASK(7, 0)) << 8) -+#define PTP_MIN_VERSION(x) ((x) & GENMASK(7, 0)) -+ - #define PTP_RX_MOD 0x024F - #define PTP_RX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ BIT(3) - #define PTP_RX_TIMESTAMP_EN 0x024D -@@ -3147,6 +3152,12 @@ static void lan8814_ptp_init(struct phy_device *phydev) - lanphy_write_page_reg(phydev, 5, PTP_TX_PARSE_IP_ADDR_EN, 0); - lanphy_write_page_reg(phydev, 5, PTP_RX_PARSE_IP_ADDR_EN, 0); - -+ /* Disable checking for minorVersionPTP field */ -+ lanphy_write_page_reg(phydev, 5, PTP_RX_VERSION, -+ PTP_MAX_VERSION(0xff) | PTP_MIN_VERSION(0x0)); -+ lanphy_write_page_reg(phydev, 5, PTP_TX_VERSION, -+ PTP_MAX_VERSION(0xff) | PTP_MIN_VERSION(0x0)); -+ - skb_queue_head_init(&ptp_priv->tx_queue); - skb_queue_head_init(&ptp_priv->rx_queue); - INIT_LIST_HEAD(&ptp_priv->rx_ts_list); --- -2.43.2 - -From 0b787c2dea15e7a2828fa3a74a5447df4ed57711 Mon Sep 17 00:00:00 2001 -From: Sharath Srinivasan <sharath.srinivasan@oracle.com> -Date: Fri, 19 Jan 2024 17:48:39 -0800 -Subject: [PATCH 0836/1501] net/rds: Fix UBSAN: array-index-out-of-bounds in - rds_cmsg_recv -Content-Length: 2653 -Lines: 63 - -[ Upstream commit 13e788deb7348cc88df34bed736c3b3b9927ea52 ] - -Syzcaller UBSAN crash occurs in rds_cmsg_recv(), -which reads inc->i_rx_lat_trace[j + 1] with index 4 (3 + 1), -but with array size of 4 (RDS_RX_MAX_TRACES). -Here 'j' is assigned from rs->rs_rx_trace[i] and in-turn from -trace.rx_trace_pos[i] in rds_recv_track_latency(), -with both arrays sized 3 (RDS_MSG_RX_DGRAM_TRACE_MAX). So fix the -off-by-one bounds check in rds_recv_track_latency() to prevent -a potential crash in rds_cmsg_recv(). - -Found by syzcaller: -================================================================= -UBSAN: array-index-out-of-bounds in net/rds/recv.c:585:39 -index 4 is out of range for type 'u64 [4]' -CPU: 1 PID: 8058 Comm: syz-executor228 Not tainted 6.6.0-gd2f51b3516da #1 -Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), -BIOS 1.15.0-1 04/01/2014 -Call Trace: - <TASK> - __dump_stack lib/dump_stack.c:88 [inline] - dump_stack_lvl+0x136/0x150 lib/dump_stack.c:106 - ubsan_epilogue lib/ubsan.c:217 [inline] - __ubsan_handle_out_of_bounds+0xd5/0x130 lib/ubsan.c:348 - rds_cmsg_recv+0x60d/0x700 net/rds/recv.c:585 - rds_recvmsg+0x3fb/0x1610 net/rds/recv.c:716 - sock_recvmsg_nosec net/socket.c:1044 [inline] - sock_recvmsg+0xe2/0x160 net/socket.c:1066 - __sys_recvfrom+0x1b6/0x2f0 net/socket.c:2246 - __do_sys_recvfrom net/socket.c:2264 [inline] - __se_sys_recvfrom net/socket.c:2260 [inline] - __x64_sys_recvfrom+0xe0/0x1b0 net/socket.c:2260 - do_syscall_x64 arch/x86/entry/common.c:51 [inline] - do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 - entry_SYSCALL_64_after_hwframe+0x63/0x6b -================================================================== - -Fixes: 3289025aedc0 ("RDS: add receive message trace used by application") -Reported-by: Chenyuan Yang <chenyuan0y@gmail.com> -Closes: https://lore.kernel.org/linux-rdma/CALGdzuoVdq-wtQ4Az9iottBqC5cv9ZhcE5q8N7LfYFvkRsOVcw@mail.gmail.com/ -Signed-off-by: Sharath Srinivasan <sharath.srinivasan@oracle.com> -Reviewed-by: Simon Horman <horms@kernel.org> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/rds/af_rds.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c -index 01c4cdfef45d..8435a20968ef 100644 ---- a/net/rds/af_rds.c -+++ b/net/rds/af_rds.c -@@ -419,7 +419,7 @@ static int rds_recv_track_latency(struct rds_sock *rs, sockptr_t optval, - - rs->rs_rx_traces = trace.rx_traces; - for (i = 0; i < rs->rs_rx_traces; i++) { -- if (trace.rx_trace_pos[i] > RDS_MSG_RX_DGRAM_TRACE_MAX) { -+ if (trace.rx_trace_pos[i] >= RDS_MSG_RX_DGRAM_TRACE_MAX) { - rs->rs_rx_traces = 0; - return -EFAULT; - } --- -2.43.2 - -From 4200ad3e46ce50f410fdda302745489441bc70f0 Mon Sep 17 00:00:00 2001 -From: Dan Carpenter <dan.carpenter@linaro.org> -Date: Fri, 12 Jan 2024 09:59:41 +0300 -Subject: [PATCH 0837/1501] netfs, fscache: Prevent Oops in fscache_put_cache() -Content-Length: 1142 -Lines: 36 - -[ Upstream commit 3be0b3ed1d76c6703b9ee482b55f7e01c369cc68 ] - -This function dereferences "cache" and then checks if it's -IS_ERR_OR_NULL(). Check first, then dereference. - -Fixes: 9549332df4ed ("fscache: Implement cache registration") -Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> -Signed-off-by: David Howells <dhowells@redhat.com> -Link: https://lore.kernel.org/r/e84bc740-3502-4f16-982a-a40d5676615c@moroto.mountain/ # v2 -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/fscache/cache.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/fs/fscache/cache.c b/fs/fscache/cache.c -index d645f8b302a2..9397ed39b0b4 100644 ---- a/fs/fscache/cache.c -+++ b/fs/fscache/cache.c -@@ -179,13 +179,14 @@ EXPORT_SYMBOL(fscache_acquire_cache); - void fscache_put_cache(struct fscache_cache *cache, - enum fscache_cache_trace where) - { -- unsigned int debug_id = cache->debug_id; -+ unsigned int debug_id; - bool zero; - int ref; - - if (IS_ERR_OR_NULL(cache)) - return; - -+ debug_id = cache->debug_id; - zero = __refcount_dec_and_test(&cache->ref, &ref); - trace_fscache_cache(debug_id, ref - 1, where); - --- -2.43.2 - -From bf4aeff7da85c3becd39fb73bac94122331c30fb Mon Sep 17 00:00:00 2001 -From: Petr Pavlu <petr.pavlu@suse.com> -Date: Mon, 22 Jan 2024 16:09:28 +0100 -Subject: [PATCH 0838/1501] tracing: Ensure visibility when inserting an - element into tracing_map -Content-Length: 5812 -Lines: 121 - -[ Upstream commit 2b44760609e9eaafc9d234a6883d042fc21132a7 ] - -Running the following two commands in parallel on a multi-processor -AArch64 machine can sporadically produce an unexpected warning about -duplicate histogram entries: - - $ while true; do - echo hist:key=id.syscall:val=hitcount > \ - /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/trigger - cat /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/hist - sleep 0.001 - done - $ stress-ng --sysbadaddr $(nproc) - -The warning looks as follows: - -[ 2911.172474] ------------[ cut here ]------------ -[ 2911.173111] Duplicates detected: 1 -[ 2911.173574] WARNING: CPU: 2 PID: 12247 at kernel/trace/tracing_map.c:983 tracing_map_sort_entries+0x3e0/0x408 -[ 2911.174702] Modules linked in: iscsi_ibft(E) iscsi_boot_sysfs(E) rfkill(E) af_packet(E) nls_iso8859_1(E) nls_cp437(E) vfat(E) fat(E) ena(E) tiny_power_button(E) qemu_fw_cfg(E) button(E) fuse(E) efi_pstore(E) ip_tables(E) x_tables(E) xfs(E) libcrc32c(E) aes_ce_blk(E) aes_ce_cipher(E) crct10dif_ce(E) polyval_ce(E) polyval_generic(E) ghash_ce(E) gf128mul(E) sm4_ce_gcm(E) sm4_ce_ccm(E) sm4_ce(E) sm4_ce_cipher(E) sm4(E) sm3_ce(E) sm3(E) sha3_ce(E) sha512_ce(E) sha512_arm64(E) sha2_ce(E) sha256_arm64(E) nvme(E) sha1_ce(E) nvme_core(E) nvme_auth(E) t10_pi(E) sg(E) scsi_mod(E) scsi_common(E) efivarfs(E) -[ 2911.174738] Unloaded tainted modules: cppc_cpufreq(E):1 -[ 2911.180985] CPU: 2 PID: 12247 Comm: cat Kdump: loaded Tainted: G E 6.7.0-default #2 1b58bbb22c97e4399dc09f92d309344f69c44a01 -[ 2911.182398] Hardware name: Amazon EC2 c7g.8xlarge/, BIOS 1.0 11/1/2018 -[ 2911.183208] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) -[ 2911.184038] pc : tracing_map_sort_entries+0x3e0/0x408 -[ 2911.184667] lr : tracing_map_sort_entries+0x3e0/0x408 -[ 2911.185310] sp : ffff8000a1513900 -[ 2911.185750] x29: ffff8000a1513900 x28: ffff0003f272fe80 x27: 0000000000000001 -[ 2911.186600] x26: ffff0003f272fe80 x25: 0000000000000030 x24: 0000000000000008 -[ 2911.187458] x23: ffff0003c5788000 x22: ffff0003c16710c8 x21: ffff80008017f180 -[ 2911.188310] x20: ffff80008017f000 x19: ffff80008017f180 x18: ffffffffffffffff -[ 2911.189160] x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000a15134b8 -[ 2911.190015] x14: 0000000000000000 x13: 205d373432323154 x12: 5b5d313131333731 -[ 2911.190844] x11: 00000000fffeffff x10: 00000000fffeffff x9 : ffffd1b78274a13c -[ 2911.191716] x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 000000000057ffa8 -[ 2911.192554] x5 : ffff0012f6c24ec0 x4 : 0000000000000000 x3 : ffff2e5b72b5d000 -[ 2911.193404] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0003ff254480 -[ 2911.194259] Call trace: -[ 2911.194626] tracing_map_sort_entries+0x3e0/0x408 -[ 2911.195220] hist_show+0x124/0x800 -[ 2911.195692] seq_read_iter+0x1d4/0x4e8 -[ 2911.196193] seq_read+0xe8/0x138 -[ 2911.196638] vfs_read+0xc8/0x300 -[ 2911.197078] ksys_read+0x70/0x108 -[ 2911.197534] __arm64_sys_read+0x24/0x38 -[ 2911.198046] invoke_syscall+0x78/0x108 -[ 2911.198553] el0_svc_common.constprop.0+0xd0/0xf8 -[ 2911.199157] do_el0_svc+0x28/0x40 -[ 2911.199613] el0_svc+0x40/0x178 -[ 2911.200048] el0t_64_sync_handler+0x13c/0x158 -[ 2911.200621] el0t_64_sync+0x1a8/0x1b0 -[ 2911.201115] ---[ end trace 0000000000000000 ]--- - -The problem appears to be caused by CPU reordering of writes issued from -__tracing_map_insert(). - -The check for the presence of an element with a given key in this -function is: - - val = READ_ONCE(entry->val); - if (val && keys_match(key, val->key, map->key_size)) ... - -The write of a new entry is: - - elt = get_free_elt(map); - memcpy(elt->key, key, map->key_size); - entry->val = elt; - -The "memcpy(elt->key, key, map->key_size);" and "entry->val = elt;" -stores may become visible in the reversed order on another CPU. This -second CPU might then incorrectly determine that a new key doesn't match -an already present val->key and subsequently insert a new element, -resulting in a duplicate. - -Fix the problem by adding a write barrier between -"memcpy(elt->key, key, map->key_size);" and "entry->val = elt;", and for -good measure, also use WRITE_ONCE(entry->val, elt) for publishing the -element. The sequence pairs with the mentioned "READ_ONCE(entry->val);" -and the "val->key" check which has an address dependency. - -The barrier is placed on a path executed when adding an element for -a new key. Subsequent updates targeting the same key remain unaffected. - -From the user's perspective, the issue was introduced by commit -c193707dde77 ("tracing: Remove code which merges duplicates"), which -followed commit cbf4100efb8f ("tracing: Add support to detect and avoid -duplicates"). The previous code operated differently; it inherently -expected potential races which result in duplicates but merged them -later when they occurred. - -Link: https://lore.kernel.org/linux-trace-kernel/20240122150928.27725-1-petr.pavlu@suse.com - -Fixes: c193707dde77 ("tracing: Remove code which merges duplicates") -Signed-off-by: Petr Pavlu <petr.pavlu@suse.com> -Acked-by: Tom Zanussi <tom.zanussi@linux.intel.com> -Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - kernel/trace/tracing_map.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c -index c774e560f2f9..a4dcf0f24352 100644 ---- a/kernel/trace/tracing_map.c -+++ b/kernel/trace/tracing_map.c -@@ -574,7 +574,12 @@ __tracing_map_insert(struct tracing_map *map, void *key, bool lookup_only) - } - - memcpy(elt->key, key, map->key_size); -- entry->val = elt; -+ /* -+ * Ensure the initialization is visible and -+ * publish the elt. -+ */ -+ smp_wmb(); -+ WRITE_ONCE(entry->val, elt); - atomic64_inc(&map->hits); - - return entry->val; --- -2.43.2 - -From fa70c6954aabbfbca1fe39b9b60f82cf2e8cec38 Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Mon, 8 Jan 2024 17:22:36 +0000 -Subject: [PATCH 0839/1501] afs: Hide silly-rename files from userspace -Content-Length: 1589 -Lines: 46 - -[ Upstream commit 57e9d49c54528c49b8bffe6d99d782ea051ea534 ] - -There appears to be a race between silly-rename files being created/removed -and various userspace tools iterating over the contents of a directory, -leading to such errors as: - - find: './kernel/.tmp_cpio_dir/include/dt-bindings/reset/.__afs2080': No such file or directory - tar: ./include/linux/greybus/.__afs3C95: File removed before we read it - -when building a kernel. - -Fix afs_readdir() so that it doesn't return .__afsXXXX silly-rename files -to userspace. This doesn't stop them being looked up directly by name as -we need to be able to look them up from within the kernel as part of the -silly-rename algorithm. - -Fixes: 79ddbfa500b3 ("afs: Implement sillyrename for unlink and rename") -Signed-off-by: David Howells <dhowells@redhat.com> -cc: Marc Dionne <marc.dionne@auristor.com> -cc: linux-afs@lists.infradead.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/afs/dir.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/fs/afs/dir.c b/fs/afs/dir.c -index 5219182e52e1..2df2e9ee130d 100644 ---- a/fs/afs/dir.c -+++ b/fs/afs/dir.c -@@ -474,6 +474,14 @@ static int afs_dir_iterate_block(struct afs_vnode *dvnode, - continue; - } - -+ /* Don't expose silly rename entries to userspace. */ -+ if (nlen > 6 && -+ dire->u.name[0] == '.' && -+ ctx->actor != afs_lookup_filldir && -+ ctx->actor != afs_lookup_one_filldir && -+ memcmp(dire->u.name, ".__afs", 6) == 0) -+ continue; -+ - /* found the next entry */ - if (!dir_emit(ctx, dire->u.name, nlen, - ntohl(dire->u.vnode), --- -2.43.2 - -From 3f3aae10b7b06b5170faa781da50b9d38f0dfeb9 Mon Sep 17 00:00:00 2001 -From: Oleg Nesterov <oleg@redhat.com> -Date: Thu, 30 Nov 2023 12:56:14 +0100 -Subject: [PATCH 0840/1501] afs: fix the usage of read_seqbegin_or_lock() in - afs_find_server*() -Content-Length: 3041 -Lines: 82 - -[ Upstream commit 1702e0654ca9a7bcd7c7619c8a5004db58945b71 ] - -David Howells says: - - (5) afs_find_server(). - - There could be a lot of servers in the list and each server can have - multiple addresses, so I think this would be better with an exclusive - second pass. - - The server list isn't likely to change all that often, but when it does - change, there's a good chance several servers are going to be - added/removed one after the other. Further, this is only going to be - used for incoming cache management/callback requests from the server, - which hopefully aren't going to happen too often - but it is remotely - drivable. - - (6) afs_find_server_by_uuid(). - - Similarly to (5), there could be a lot of servers to search through, but - they are in a tree not a flat list, so it should be faster to process. - Again, it's not likely to change that often and, again, when it does - change it's likely to involve multiple changes. This can be driven - remotely by an incoming cache management request but is mostly going to - be driven by setting up or reconfiguring a volume's server list - - something that also isn't likely to happen often. - -Make the "seq" counter odd on the 2nd pass, otherwise read_seqbegin_or_lock() -never takes the lock. - -Signed-off-by: Oleg Nesterov <oleg@redhat.com> -Signed-off-by: David Howells <dhowells@redhat.com> -cc: Marc Dionne <marc.dionne@auristor.com> -cc: linux-afs@lists.infradead.org -Link: https://lore.kernel.org/r/20231130115614.GA21581@redhat.com/ -Stable-dep-of: 17ba6f0bd14f ("afs: Fix error handling with lookup via FS.InlineBulkStatus") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/afs/server.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/fs/afs/server.c b/fs/afs/server.c -index b5237206eac3..0bd2f5ba6900 100644 ---- a/fs/afs/server.c -+++ b/fs/afs/server.c -@@ -27,7 +27,7 @@ struct afs_server *afs_find_server(struct afs_net *net, - const struct afs_addr_list *alist; - struct afs_server *server = NULL; - unsigned int i; -- int seq = 0, diff; -+ int seq = 1, diff; - - rcu_read_lock(); - -@@ -35,6 +35,7 @@ struct afs_server *afs_find_server(struct afs_net *net, - if (server) - afs_unuse_server_notime(net, server, afs_server_trace_put_find_rsq); - server = NULL; -+ seq++; /* 2 on the 1st/lockless path, otherwise odd */ - read_seqbegin_or_lock(&net->fs_addr_lock, &seq); - - if (srx->transport.family == AF_INET6) { -@@ -90,7 +91,7 @@ struct afs_server *afs_find_server_by_uuid(struct afs_net *net, const uuid_t *uu - { - struct afs_server *server = NULL; - struct rb_node *p; -- int diff, seq = 0; -+ int diff, seq = 1; - - _enter("%pU", uuid); - -@@ -102,7 +103,7 @@ struct afs_server *afs_find_server_by_uuid(struct afs_net *net, const uuid_t *uu - if (server) - afs_unuse_server(net, server, afs_server_trace_put_uuid_rsq); - server = NULL; -- -+ seq++; /* 2 on the 1st/lockless path, otherwise odd */ - read_seqbegin_or_lock(&net->fs_lock, &seq); - - p = net->fs_servers.rb_node; --- -2.43.2 - -From b838e39d922930ddc097c7160931adfbadc3dc1f Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Wed, 18 Oct 2023 08:42:18 +0100 -Subject: [PATCH 0841/1501] afs: Add comments on abort handling -Content-Length: 7056 -Lines: 181 - -[ Upstream commit fe245c8fcdac339e6b42076c828a6bede3a5e948 ] - -Add some comments on AFS abort code handling in the rotation algorithm and -adjust the errors produced to match. - -Reported-by: Jeffrey E Altman <jaltman@auristor.com> -Signed-off-by: David Howells <dhowells@redhat.com> -Reviewed-by: Jeffrey Altman <jaltman@auristor.com> -cc: Marc Dionne <marc.dionne@auristor.com> -cc: linux-afs@lists.infradead.org -Stable-dep-of: 17ba6f0bd14f ("afs: Fix error handling with lookup via FS.InlineBulkStatus") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/afs/rotate.c | 101 ++++++++++++++++++++++++++++++++++++++++++------ - 1 file changed, 90 insertions(+), 11 deletions(-) - -diff --git a/fs/afs/rotate.c b/fs/afs/rotate.c -index a840c3588ebb..a3d127953ac6 100644 ---- a/fs/afs/rotate.c -+++ b/fs/afs/rotate.c -@@ -13,6 +13,7 @@ - #include <linux/sched/signal.h> - #include "internal.h" - #include "afs_fs.h" -+#include "protocol_uae.h" - - /* - * Begin iteration through a server list, starting with the vnode's last used -@@ -143,6 +144,11 @@ bool afs_select_fileserver(struct afs_operation *op) - case -ECONNABORTED: - /* The far side rejected the operation on some grounds. This - * might involve the server being busy or the volume having been moved. -+ * -+ * Note that various V* errors should not be sent to a cache manager -+ * by a fileserver as they should be translated to more modern UAE* -+ * errors instead. IBM AFS and OpenAFS fileservers, however, do leak -+ * these abort codes. - */ - switch (op->ac.abort_code) { - case VNOVOL: -@@ -150,6 +156,11 @@ bool afs_select_fileserver(struct afs_operation *op) - * - May indicate that the VL is wrong - retry once and compare - * the results. - * - May indicate that the fileserver couldn't attach to the vol. -+ * - The volume might have been temporarily removed so that it can -+ * be replaced by a volume restore. "vos" might have ended one -+ * transaction and has yet to create the next. -+ * - The volume might not be blessed or might not be in-service -+ * (administrative action). - */ - if (op->flags & AFS_OPERATION_VNOVOL) { - op->error = -EREMOTEIO; -@@ -183,16 +194,56 @@ bool afs_select_fileserver(struct afs_operation *op) - _leave(" = t [vnovol]"); - return true; - -- case VSALVAGE: /* TODO: Should this return an error or iterate? */ - case VVOLEXISTS: -- case VNOSERVICE: - case VONLINE: -- case VDISKFULL: -- case VOVERQUOTA: -- op->error = afs_abort_to_error(op->ac.abort_code); -+ /* These should not be returned from the fileserver. */ -+ pr_warn("Fileserver returned unexpected abort %d\n", -+ op->ac.abort_code); -+ op->error = -EREMOTEIO; - goto next_server; - -+ case VNOSERVICE: -+ /* Prior to AFS 3.2 VNOSERVICE was returned from the fileserver -+ * if the volume was neither in-service nor administratively -+ * blessed. All usage was replaced by VNOVOL because AFS 3.1 and -+ * earlier cache managers did not handle VNOSERVICE and assumed -+ * it was the client OSes errno 105. -+ * -+ * Starting with OpenAFS 1.4.8 VNOSERVICE was repurposed as the -+ * fileserver idle dead time error which was sent in place of -+ * RX_CALL_TIMEOUT (-3). The error was intended to be sent if the -+ * fileserver took too long to send a reply to the client. -+ * RX_CALL_TIMEOUT would have caused the cache manager to mark the -+ * server down whereas VNOSERVICE since AFS 3.2 would cause cache -+ * manager to temporarily (up to 15 minutes) mark the volume -+ * instance as unusable. -+ * -+ * The idle dead logic resulted in cache inconsistency since a -+ * state changing call that the cache manager assumed was dead -+ * could still be processed to completion by the fileserver. This -+ * logic was removed in OpenAFS 1.8.0 and VNOSERVICE is no longer -+ * returned. However, many 1.4.8 through 1.6.24 fileservers are -+ * still in existence. -+ * -+ * AuriStorFS fileservers have never returned VNOSERVICE. -+ * -+ * VNOSERVICE should be treated as an alias for RX_CALL_TIMEOUT. -+ */ -+ case RX_CALL_TIMEOUT: -+ op->error = -ETIMEDOUT; -+ goto next_server; -+ -+ case VSALVAGING: /* This error should not be leaked to cache managers -+ * but is from OpenAFS demand attach fileservers. -+ * It should be treated as an alias for VOFFLINE. -+ */ -+ case VSALVAGE: /* VSALVAGE should be treated as a synonym of VOFFLINE */ - case VOFFLINE: -+ /* The volume is in use by the volserver or another volume utility -+ * for an operation that might alter the contents. The volume is -+ * expected to come back but it might take a long time (could be -+ * days). -+ */ - if (!test_and_set_bit(AFS_VOLUME_OFFLINE, &op->volume->flags)) { - afs_busy(op->volume, op->ac.abort_code); - clear_bit(AFS_VOLUME_BUSY, &op->volume->flags); -@@ -207,11 +258,20 @@ bool afs_select_fileserver(struct afs_operation *op) - } - goto busy; - -- case VSALVAGING: -- case VRESTARTING: -+ case VRESTARTING: /* The fileserver is either shutting down or starting up. */ - case VBUSY: -- /* Retry after going round all the servers unless we -- * have a file lock we need to maintain. -+ /* The volume is in use by the volserver or another volume -+ * utility for an operation that is not expected to alter the -+ * contents of the volume. VBUSY does not need to be returned -+ * for a ROVOL or BACKVOL bound to an ITBusy volserver -+ * transaction. The fileserver is permitted to continue serving -+ * content from ROVOLs and BACKVOLs during an ITBusy transaction -+ * because the content will not change. However, many fileserver -+ * releases do return VBUSY for ROVOL and BACKVOL instances under -+ * many circumstances. -+ * -+ * Retry after going round all the servers unless we have a file -+ * lock we need to maintain. - */ - if (op->flags & AFS_OPERATION_NO_VSLEEP) { - op->error = -EBUSY; -@@ -226,7 +286,7 @@ bool afs_select_fileserver(struct afs_operation *op) - if (!afs_sleep_and_retry(op)) - goto failed; - -- /* Retry with same server & address */ -+ /* Retry with same server & address */ - _leave(" = t [vbusy]"); - return true; - } -@@ -270,10 +330,29 @@ bool afs_select_fileserver(struct afs_operation *op) - - goto restart_from_beginning; - -+ case VDISKFULL: -+ case UAENOSPC: -+ /* The partition is full. Only applies to RWVOLs. -+ * Translate locally and return ENOSPC. -+ * No replicas to failover to. -+ */ -+ op->error = -ENOSPC; -+ goto failed_but_online; -+ -+ case VOVERQUOTA: -+ case UAEDQUOT: -+ /* Volume is full. Only applies to RWVOLs. -+ * Translate locally and return EDQUOT. -+ * No replicas to failover to. -+ */ -+ op->error = -EDQUOT; -+ goto failed_but_online; -+ - default: -+ op->error = afs_abort_to_error(op->ac.abort_code); -+ failed_but_online: - clear_bit(AFS_VOLUME_OFFLINE, &op->volume->flags); - clear_bit(AFS_VOLUME_BUSY, &op->volume->flags); -- op->error = afs_abort_to_error(op->ac.abort_code); - goto failed; - } - --- -2.43.2 - -From b87cf8db84d29d3d880d9f75729a259937ececfa Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Wed, 18 Oct 2023 15:38:14 +0100 -Subject: [PATCH 0842/1501] afs: Turn the afs_addr_list address array into an - array of structs -Content-Length: 10345 -Lines: 261 - -[ Upstream commit 07f3502b33a260f873e35708d2fa693eb52225cb ] - -Turn the afs_addr_list address array into an array of structs, thereby -allowing per-address (such as RTT) info to be added. - -Signed-off-by: David Howells <dhowells@redhat.com> -cc: Marc Dionne <marc.dionne@auristor.com> -cc: linux-afs@lists.infradead.org -Stable-dep-of: 17ba6f0bd14f ("afs: Fix error handling with lookup via FS.InlineBulkStatus") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/afs/addr_list.c | 10 +++++----- - fs/afs/fs_probe.c | 6 +++--- - fs/afs/internal.h | 6 +++++- - fs/afs/proc.c | 4 ++-- - fs/afs/rotate.c | 2 +- - fs/afs/rxrpc.c | 4 ++-- - fs/afs/server.c | 4 ++-- - fs/afs/vl_alias.c | 4 ++-- - fs/afs/vl_probe.c | 6 +++--- - fs/afs/vl_rotate.c | 2 +- - 10 files changed, 26 insertions(+), 22 deletions(-) - -diff --git a/fs/afs/addr_list.c b/fs/afs/addr_list.c -index de1ae0bead3b..ac05a59e9d46 100644 ---- a/fs/afs/addr_list.c -+++ b/fs/afs/addr_list.c -@@ -45,7 +45,7 @@ struct afs_addr_list *afs_alloc_addrlist(unsigned int nr, - alist->max_addrs = nr; - - for (i = 0; i < nr; i++) { -- struct sockaddr_rxrpc *srx = &alist->addrs[i]; -+ struct sockaddr_rxrpc *srx = &alist->addrs[i].srx; - srx->srx_family = AF_RXRPC; - srx->srx_service = service; - srx->transport_type = SOCK_DGRAM; -@@ -281,7 +281,7 @@ void afs_merge_fs_addr4(struct afs_addr_list *alist, __be32 xdr, u16 port) - return; - - for (i = 0; i < alist->nr_ipv4; i++) { -- struct sockaddr_in *a = &alist->addrs[i].transport.sin; -+ struct sockaddr_in *a = &alist->addrs[i].srx.transport.sin; - u32 a_addr = ntohl(a->sin_addr.s_addr); - u16 a_port = ntohs(a->sin_port); - -@@ -298,7 +298,7 @@ void afs_merge_fs_addr4(struct afs_addr_list *alist, __be32 xdr, u16 port) - alist->addrs + i, - sizeof(alist->addrs[0]) * (alist->nr_addrs - i)); - -- srx = &alist->addrs[i]; -+ srx = &alist->addrs[i].srx; - srx->srx_family = AF_RXRPC; - srx->transport_type = SOCK_DGRAM; - srx->transport_len = sizeof(srx->transport.sin); -@@ -321,7 +321,7 @@ void afs_merge_fs_addr6(struct afs_addr_list *alist, __be32 *xdr, u16 port) - return; - - for (i = alist->nr_ipv4; i < alist->nr_addrs; i++) { -- struct sockaddr_in6 *a = &alist->addrs[i].transport.sin6; -+ struct sockaddr_in6 *a = &alist->addrs[i].srx.transport.sin6; - u16 a_port = ntohs(a->sin6_port); - - diff = memcmp(xdr, &a->sin6_addr, 16); -@@ -338,7 +338,7 @@ void afs_merge_fs_addr6(struct afs_addr_list *alist, __be32 *xdr, u16 port) - alist->addrs + i, - sizeof(alist->addrs[0]) * (alist->nr_addrs - i)); - -- srx = &alist->addrs[i]; -+ srx = &alist->addrs[i].srx; - srx->srx_family = AF_RXRPC; - srx->transport_type = SOCK_DGRAM; - srx->transport_len = sizeof(srx->transport.sin6); -diff --git a/fs/afs/fs_probe.c b/fs/afs/fs_probe.c -index daaf3810cc92..3dd24842f277 100644 ---- a/fs/afs/fs_probe.c -+++ b/fs/afs/fs_probe.c -@@ -153,12 +153,12 @@ void afs_fileserver_probe_result(struct afs_call *call) - if (call->service_id == YFS_FS_SERVICE) { - server->probe.is_yfs = true; - set_bit(AFS_SERVER_FL_IS_YFS, &server->flags); -- alist->addrs[index].srx_service = call->service_id; -+ alist->addrs[index].srx.srx_service = call->service_id; - } else { - server->probe.not_yfs = true; - if (!server->probe.is_yfs) { - clear_bit(AFS_SERVER_FL_IS_YFS, &server->flags); -- alist->addrs[index].srx_service = call->service_id; -+ alist->addrs[index].srx.srx_service = call->service_id; - } - cap0 = ntohl(call->tmp); - if (cap0 & AFS3_VICED_CAPABILITY_64BITFILES) -@@ -182,7 +182,7 @@ void afs_fileserver_probe_result(struct afs_call *call) - spin_unlock(&server->probe_lock); - - _debug("probe %pU [%u] %pISpc rtt=%u ret=%d", -- &server->uuid, index, &alist->addrs[index].transport, -+ &server->uuid, index, &alist->addrs[index].srx.transport, - rtt_us, ret); - - return afs_done_one_fs_probe(call->net, server); -diff --git a/fs/afs/internal.h b/fs/afs/internal.h -index 7385d62c8cf5..e2adb314ab6a 100644 ---- a/fs/afs/internal.h -+++ b/fs/afs/internal.h -@@ -87,7 +87,9 @@ struct afs_addr_list { - enum dns_lookup_status status:8; - unsigned long failed; /* Mask of addrs that failed locally/ICMP */ - unsigned long responded; /* Mask of addrs that responded */ -- struct sockaddr_rxrpc addrs[] __counted_by(max_addrs); -+ struct { -+ struct sockaddr_rxrpc srx; -+ } addrs[] __counted_by(max_addrs); - #define AFS_MAX_ADDRESSES ((unsigned int)(sizeof(unsigned long) * 8)) - }; - -@@ -969,6 +971,8 @@ extern void afs_put_addrlist(struct afs_addr_list *); - extern struct afs_vlserver_list *afs_parse_text_addrs(struct afs_net *, - const char *, size_t, char, - unsigned short, unsigned short); -+bool afs_addr_list_same(const struct afs_addr_list *a, -+ const struct afs_addr_list *b); - extern struct afs_vlserver_list *afs_dns_query(struct afs_cell *, time64_t *); - extern bool afs_iterate_addresses(struct afs_addr_cursor *); - extern int afs_end_cursor(struct afs_addr_cursor *); -diff --git a/fs/afs/proc.c b/fs/afs/proc.c -index 2a0c83d71565..ab9cd986cfd9 100644 ---- a/fs/afs/proc.c -+++ b/fs/afs/proc.c -@@ -307,7 +307,7 @@ static int afs_proc_cell_vlservers_show(struct seq_file *m, void *v) - for (i = 0; i < alist->nr_addrs; i++) - seq_printf(m, " %c %pISpc\n", - alist->preferred == i ? '>' : '-', -- &alist->addrs[i].transport); -+ &alist->addrs[i].srx.transport); - } - seq_printf(m, " info: fl=%lx rtt=%d\n", vlserver->flags, vlserver->rtt); - seq_printf(m, " probe: fl=%x e=%d ac=%d out=%d\n", -@@ -399,7 +399,7 @@ static int afs_proc_servers_show(struct seq_file *m, void *v) - alist->version, alist->responded, alist->failed); - for (i = 0; i < alist->nr_addrs; i++) - seq_printf(m, " [%x] %pISpc%s\n", -- i, &alist->addrs[i].transport, -+ i, &alist->addrs[i].srx.transport, - alist->preferred == i ? "*" : ""); - return 0; - } -diff --git a/fs/afs/rotate.c b/fs/afs/rotate.c -index a3d127953ac6..46081e5da6f5 100644 ---- a/fs/afs/rotate.c -+++ b/fs/afs/rotate.c -@@ -488,7 +488,7 @@ bool afs_select_fileserver(struct afs_operation *op) - - _debug("address [%u] %u/%u %pISp", - op->index, op->ac.index, op->ac.alist->nr_addrs, -- &op->ac.alist->addrs[op->ac.index].transport); -+ &op->ac.alist->addrs[op->ac.index].srx.transport); - - _leave(" = t"); - return true; -diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c -index d642d06a453b..181317126e43 100644 ---- a/fs/afs/rxrpc.c -+++ b/fs/afs/rxrpc.c -@@ -296,7 +296,7 @@ static void afs_notify_end_request_tx(struct sock *sock, - */ - void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp) - { -- struct sockaddr_rxrpc *srx = &ac->alist->addrs[ac->index]; -+ struct sockaddr_rxrpc *srx = &ac->alist->addrs[ac->index].srx; - struct rxrpc_call *rxcall; - struct msghdr msg; - struct kvec iov[1]; -@@ -461,7 +461,7 @@ static void afs_log_error(struct afs_call *call, s32 remote_abort) - max = m + 1; - pr_notice("kAFS: Peer reported %s failure on %s [%pISp]\n", - msg, call->type->name, -- &call->alist->addrs[call->addr_ix].transport); -+ &call->alist->addrs[call->addr_ix].srx.transport); - } - } - -diff --git a/fs/afs/server.c b/fs/afs/server.c -index 0bd2f5ba6900..b8e2d211d4a1 100644 ---- a/fs/afs/server.c -+++ b/fs/afs/server.c -@@ -43,7 +43,7 @@ struct afs_server *afs_find_server(struct afs_net *net, - hlist_for_each_entry_rcu(server, &net->fs_addresses6, addr6_link) { - alist = rcu_dereference(server->addresses); - for (i = alist->nr_ipv4; i < alist->nr_addrs; i++) { -- b = &alist->addrs[i].transport.sin6; -+ b = &alist->addrs[i].srx.transport.sin6; - diff = ((u16 __force)a->sin6_port - - (u16 __force)b->sin6_port); - if (diff == 0) -@@ -59,7 +59,7 @@ struct afs_server *afs_find_server(struct afs_net *net, - hlist_for_each_entry_rcu(server, &net->fs_addresses4, addr4_link) { - alist = rcu_dereference(server->addresses); - for (i = 0; i < alist->nr_ipv4; i++) { -- b = &alist->addrs[i].transport.sin; -+ b = &alist->addrs[i].srx.transport.sin; - diff = ((u16 __force)a->sin_port - - (u16 __force)b->sin_port); - if (diff == 0) -diff --git a/fs/afs/vl_alias.c b/fs/afs/vl_alias.c -index f04a80e4f5c3..d3c0df70a1a5 100644 ---- a/fs/afs/vl_alias.c -+++ b/fs/afs/vl_alias.c -@@ -94,8 +94,8 @@ static int afs_compare_fs_alists(const struct afs_server *server_a, - lb = rcu_dereference(server_b->addresses); - - while (a < la->nr_addrs && b < lb->nr_addrs) { -- const struct sockaddr_rxrpc *srx_a = &la->addrs[a]; -- const struct sockaddr_rxrpc *srx_b = &lb->addrs[b]; -+ const struct sockaddr_rxrpc *srx_a = &la->addrs[a].srx; -+ const struct sockaddr_rxrpc *srx_b = &lb->addrs[b].srx; - int diff = afs_compare_addrs(srx_a, srx_b); - - if (diff < 0) { -diff --git a/fs/afs/vl_probe.c b/fs/afs/vl_probe.c -index 58452b86e672..bdd9372e3fb2 100644 ---- a/fs/afs/vl_probe.c -+++ b/fs/afs/vl_probe.c -@@ -106,12 +106,12 @@ void afs_vlserver_probe_result(struct afs_call *call) - if (call->service_id == YFS_VL_SERVICE) { - server->probe.flags |= AFS_VLSERVER_PROBE_IS_YFS; - set_bit(AFS_VLSERVER_FL_IS_YFS, &server->flags); -- alist->addrs[index].srx_service = call->service_id; -+ alist->addrs[index].srx.srx_service = call->service_id; - } else { - server->probe.flags |= AFS_VLSERVER_PROBE_NOT_YFS; - if (!(server->probe.flags & AFS_VLSERVER_PROBE_IS_YFS)) { - clear_bit(AFS_VLSERVER_FL_IS_YFS, &server->flags); -- alist->addrs[index].srx_service = call->service_id; -+ alist->addrs[index].srx.srx_service = call->service_id; - } - } - -@@ -131,7 +131,7 @@ void afs_vlserver_probe_result(struct afs_call *call) - spin_unlock(&server->probe_lock); - - _debug("probe [%u][%u] %pISpc rtt=%u ret=%d", -- server_index, index, &alist->addrs[index].transport, rtt_us, ret); -+ server_index, index, &alist->addrs[index].srx.transport, rtt_us, ret); - - afs_done_one_vl_probe(server, have_result); - } -diff --git a/fs/afs/vl_rotate.c b/fs/afs/vl_rotate.c -index eb415ce56360..e52b9d4c8a0a 100644 ---- a/fs/afs/vl_rotate.c -+++ b/fs/afs/vl_rotate.c -@@ -249,7 +249,7 @@ bool afs_select_vlserver(struct afs_vl_cursor *vc) - - _debug("VL address %d/%d", vc->ac.index, vc->ac.alist->nr_addrs); - -- _leave(" = t %pISpc", &vc->ac.alist->addrs[vc->ac.index].transport); -+ _leave(" = t %pISpc", &vc->ac.alist->addrs[vc->ac.index].srx.transport); - return true; - - next_server: --- -2.43.2 - -From 056fc740be000d39a7dba700a935f3bbfbc664e6 Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Thu, 19 Oct 2023 12:55:11 +0100 -Subject: [PATCH 0843/1501] rxrpc, afs: Allow afs to pin rxrpc_peer objects -Content-Length: 43835 -Lines: 1269 - -[ Upstream commit 72904d7b9bfbf2dd146254edea93958bc35bbbfe ] - -Change rxrpc's API such that: - - (1) A new function, rxrpc_kernel_lookup_peer(), is provided to look up an - rxrpc_peer record for a remote address and a corresponding function, - rxrpc_kernel_put_peer(), is provided to dispose of it again. - - (2) When setting up a call, the rxrpc_peer object used during a call is - now passed in rather than being set up by rxrpc_connect_call(). For - afs, this meenat passing it to rxrpc_kernel_begin_call() rather than - the full address (the service ID then has to be passed in as a - separate parameter). - - (3) A new function, rxrpc_kernel_remote_addr(), is added so that afs can - get a pointer to the transport address for display purposed, and - another, rxrpc_kernel_remote_srx(), to gain a pointer to the full - rxrpc address. - - (4) The function to retrieve the RTT from a call, rxrpc_kernel_get_srtt(), - is then altered to take a peer. This now returns the RTT or -1 if - there are insufficient samples. - - (5) Rename rxrpc_kernel_get_peer() to rxrpc_kernel_call_get_peer(). - - (6) Provide a new function, rxrpc_kernel_get_peer(), to get a ref on a - peer the caller already has. - -This allows the afs filesystem to pin the rxrpc_peer records that it is -using, allowing faster lookups and pointer comparisons rather than -comparing sockaddr_rxrpc contents. It also makes it easier to get hold of -the RTT. The following changes are made to afs: - - (1) The addr_list struct's addrs[] elements now hold a peer struct pointer - and a service ID rather than a sockaddr_rxrpc. - - (2) When displaying the transport address, rxrpc_kernel_remote_addr() is - used. - - (3) The port arg is removed from afs_alloc_addrlist() since it's always - overridden. - - (4) afs_merge_fs_addr4() and afs_merge_fs_addr6() do peer lookup and may - now return an error that must be handled. - - (5) afs_find_server() now takes a peer pointer to specify the address. - - (6) afs_find_server(), afs_compare_fs_alists() and afs_merge_fs_addr[46]{} - now do peer pointer comparison rather than address comparison. - -Signed-off-by: David Howells <dhowells@redhat.com> -cc: Marc Dionne <marc.dionne@auristor.com> -cc: linux-afs@lists.infradead.org -Stable-dep-of: 17ba6f0bd14f ("afs: Fix error handling with lookup via FS.InlineBulkStatus") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/afs/addr_list.c | 125 ++++++++++++++++++----------------- - fs/afs/cmservice.c | 5 +- - fs/afs/fs_probe.c | 11 +-- - fs/afs/internal.h | 26 ++++---- - fs/afs/proc.c | 9 +-- - fs/afs/rotate.c | 6 +- - fs/afs/rxrpc.c | 10 +-- - fs/afs/server.c | 41 ++---------- - fs/afs/vl_alias.c | 55 +-------------- - fs/afs/vl_list.c | 15 +++-- - fs/afs/vl_probe.c | 12 ++-- - fs/afs/vl_rotate.c | 6 +- - fs/afs/vlclient.c | 22 ++++-- - include/net/af_rxrpc.h | 15 +++-- - include/trace/events/rxrpc.h | 3 + - net/rxrpc/af_rxrpc.c | 62 ++++++++++++++--- - net/rxrpc/ar-internal.h | 2 +- - net/rxrpc/call_object.c | 17 ++--- - net/rxrpc/peer_object.c | 60 +++++++++++------ - net/rxrpc/sendmsg.c | 11 ++- - 20 files changed, 274 insertions(+), 239 deletions(-) - -diff --git a/fs/afs/addr_list.c b/fs/afs/addr_list.c -index ac05a59e9d46..519821f5aedc 100644 ---- a/fs/afs/addr_list.c -+++ b/fs/afs/addr_list.c -@@ -13,26 +13,33 @@ - #include "internal.h" - #include "afs_fs.h" - -+static void afs_free_addrlist(struct rcu_head *rcu) -+{ -+ struct afs_addr_list *alist = container_of(rcu, struct afs_addr_list, rcu); -+ unsigned int i; -+ -+ for (i = 0; i < alist->nr_addrs; i++) -+ rxrpc_kernel_put_peer(alist->addrs[i].peer); -+} -+ - /* - * Release an address list. - */ - void afs_put_addrlist(struct afs_addr_list *alist) - { - if (alist && refcount_dec_and_test(&alist->usage)) -- kfree_rcu(alist, rcu); -+ call_rcu(&alist->rcu, afs_free_addrlist); - } - - /* - * Allocate an address list. - */ --struct afs_addr_list *afs_alloc_addrlist(unsigned int nr, -- unsigned short service, -- unsigned short port) -+struct afs_addr_list *afs_alloc_addrlist(unsigned int nr, u16 service_id) - { - struct afs_addr_list *alist; - unsigned int i; - -- _enter("%u,%u,%u", nr, service, port); -+ _enter("%u,%u", nr, service_id); - - if (nr > AFS_MAX_ADDRESSES) - nr = AFS_MAX_ADDRESSES; -@@ -44,16 +51,8 @@ struct afs_addr_list *afs_alloc_addrlist(unsigned int nr, - refcount_set(&alist->usage, 1); - alist->max_addrs = nr; - -- for (i = 0; i < nr; i++) { -- struct sockaddr_rxrpc *srx = &alist->addrs[i].srx; -- srx->srx_family = AF_RXRPC; -- srx->srx_service = service; -- srx->transport_type = SOCK_DGRAM; -- srx->transport_len = sizeof(srx->transport.sin6); -- srx->transport.sin6.sin6_family = AF_INET6; -- srx->transport.sin6.sin6_port = htons(port); -- } -- -+ for (i = 0; i < nr; i++) -+ alist->addrs[i].service_id = service_id; - return alist; - } - -@@ -126,7 +125,7 @@ struct afs_vlserver_list *afs_parse_text_addrs(struct afs_net *net, - if (!vllist->servers[0].server) - goto error_vl; - -- alist = afs_alloc_addrlist(nr, service, AFS_VL_PORT); -+ alist = afs_alloc_addrlist(nr, service); - if (!alist) - goto error; - -@@ -197,9 +196,11 @@ struct afs_vlserver_list *afs_parse_text_addrs(struct afs_net *net, - } - - if (family == AF_INET) -- afs_merge_fs_addr4(alist, x[0], xport); -+ ret = afs_merge_fs_addr4(net, alist, x[0], xport); - else -- afs_merge_fs_addr6(alist, x, xport); -+ ret = afs_merge_fs_addr6(net, alist, x, xport); -+ if (ret < 0) -+ goto error; - - } while (p < end); - -@@ -271,25 +272,33 @@ struct afs_vlserver_list *afs_dns_query(struct afs_cell *cell, time64_t *_expiry - /* - * Merge an IPv4 entry into a fileserver address list. - */ --void afs_merge_fs_addr4(struct afs_addr_list *alist, __be32 xdr, u16 port) -+int afs_merge_fs_addr4(struct afs_net *net, struct afs_addr_list *alist, -+ __be32 xdr, u16 port) - { -- struct sockaddr_rxrpc *srx; -- u32 addr = ntohl(xdr); -+ struct sockaddr_rxrpc srx; -+ struct rxrpc_peer *peer; - int i; - - if (alist->nr_addrs >= alist->max_addrs) -- return; -+ return 0; -+ -+ srx.srx_family = AF_RXRPC; -+ srx.transport_type = SOCK_DGRAM; -+ srx.transport_len = sizeof(srx.transport.sin); -+ srx.transport.sin.sin_family = AF_INET; -+ srx.transport.sin.sin_port = htons(port); -+ srx.transport.sin.sin_addr.s_addr = xdr; -+ -+ peer = rxrpc_kernel_lookup_peer(net->socket, &srx, GFP_KERNEL); -+ if (!peer) -+ return -ENOMEM; - - for (i = 0; i < alist->nr_ipv4; i++) { -- struct sockaddr_in *a = &alist->addrs[i].srx.transport.sin; -- u32 a_addr = ntohl(a->sin_addr.s_addr); -- u16 a_port = ntohs(a->sin_port); -- -- if (addr == a_addr && port == a_port) -- return; -- if (addr == a_addr && port < a_port) -- break; -- if (addr < a_addr) -+ if (peer == alist->addrs[i].peer) { -+ rxrpc_kernel_put_peer(peer); -+ return 0; -+ } -+ if (peer <= alist->addrs[i].peer) - break; - } - -@@ -298,38 +307,42 @@ void afs_merge_fs_addr4(struct afs_addr_list *alist, __be32 xdr, u16 port) - alist->addrs + i, - sizeof(alist->addrs[0]) * (alist->nr_addrs - i)); - -- srx = &alist->addrs[i].srx; -- srx->srx_family = AF_RXRPC; -- srx->transport_type = SOCK_DGRAM; -- srx->transport_len = sizeof(srx->transport.sin); -- srx->transport.sin.sin_family = AF_INET; -- srx->transport.sin.sin_port = htons(port); -- srx->transport.sin.sin_addr.s_addr = xdr; -+ alist->addrs[i].peer = peer; - alist->nr_ipv4++; - alist->nr_addrs++; -+ return 0; - } - - /* - * Merge an IPv6 entry into a fileserver address list. - */ --void afs_merge_fs_addr6(struct afs_addr_list *alist, __be32 *xdr, u16 port) -+int afs_merge_fs_addr6(struct afs_net *net, struct afs_addr_list *alist, -+ __be32 *xdr, u16 port) - { -- struct sockaddr_rxrpc *srx; -- int i, diff; -+ struct sockaddr_rxrpc srx; -+ struct rxrpc_peer *peer; -+ int i; - - if (alist->nr_addrs >= alist->max_addrs) -- return; -+ return 0; -+ -+ srx.srx_family = AF_RXRPC; -+ srx.transport_type = SOCK_DGRAM; -+ srx.transport_len = sizeof(srx.transport.sin6); -+ srx.transport.sin6.sin6_family = AF_INET6; -+ srx.transport.sin6.sin6_port = htons(port); -+ memcpy(&srx.transport.sin6.sin6_addr, xdr, 16); -+ -+ peer = rxrpc_kernel_lookup_peer(net->socket, &srx, GFP_KERNEL); -+ if (!peer) -+ return -ENOMEM; - - for (i = alist->nr_ipv4; i < alist->nr_addrs; i++) { -- struct sockaddr_in6 *a = &alist->addrs[i].srx.transport.sin6; -- u16 a_port = ntohs(a->sin6_port); -- -- diff = memcmp(xdr, &a->sin6_addr, 16); -- if (diff == 0 && port == a_port) -- return; -- if (diff == 0 && port < a_port) -- break; -- if (diff < 0) -+ if (peer == alist->addrs[i].peer) { -+ rxrpc_kernel_put_peer(peer); -+ return 0; -+ } -+ if (peer <= alist->addrs[i].peer) - break; - } - -@@ -337,15 +350,9 @@ void afs_merge_fs_addr6(struct afs_addr_list *alist, __be32 *xdr, u16 port) - memmove(alist->addrs + i + 1, - alist->addrs + i, - sizeof(alist->addrs[0]) * (alist->nr_addrs - i)); -- -- srx = &alist->addrs[i].srx; -- srx->srx_family = AF_RXRPC; -- srx->transport_type = SOCK_DGRAM; -- srx->transport_len = sizeof(srx->transport.sin6); -- srx->transport.sin6.sin6_family = AF_INET6; -- srx->transport.sin6.sin6_port = htons(port); -- memcpy(&srx->transport.sin6.sin6_addr, xdr, 16); -+ alist->addrs[i].peer = peer; - alist->nr_addrs++; -+ return 0; - } - - /* -diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c -index d4ddb20d6732..99a3f20bc786 100644 ---- a/fs/afs/cmservice.c -+++ b/fs/afs/cmservice.c -@@ -146,10 +146,11 @@ static int afs_find_cm_server_by_peer(struct afs_call *call) - { - struct sockaddr_rxrpc srx; - struct afs_server *server; -+ struct rxrpc_peer *peer; - -- rxrpc_kernel_get_peer(call->net->socket, call->rxcall, &srx); -+ peer = rxrpc_kernel_get_call_peer(call->net->socket, call->rxcall); - -- server = afs_find_server(call->net, &srx); -+ server = afs_find_server(call->net, peer); - if (!server) { - trace_afs_cm_no_server(call, &srx); - return 0; -diff --git a/fs/afs/fs_probe.c b/fs/afs/fs_probe.c -index 3dd24842f277..58d28b82571e 100644 ---- a/fs/afs/fs_probe.c -+++ b/fs/afs/fs_probe.c -@@ -101,6 +101,7 @@ static void afs_fs_probe_not_done(struct afs_net *net, - void afs_fileserver_probe_result(struct afs_call *call) - { - struct afs_addr_list *alist = call->alist; -+ struct afs_address *addr = &alist->addrs[call->addr_ix]; - struct afs_server *server = call->server; - unsigned int index = call->addr_ix; - unsigned int rtt_us = 0, cap0; -@@ -153,12 +154,12 @@ void afs_fileserver_probe_result(struct afs_call *call) - if (call->service_id == YFS_FS_SERVICE) { - server->probe.is_yfs = true; - set_bit(AFS_SERVER_FL_IS_YFS, &server->flags); -- alist->addrs[index].srx.srx_service = call->service_id; -+ addr->service_id = call->service_id; - } else { - server->probe.not_yfs = true; - if (!server->probe.is_yfs) { - clear_bit(AFS_SERVER_FL_IS_YFS, &server->flags); -- alist->addrs[index].srx.srx_service = call->service_id; -+ addr->service_id = call->service_id; - } - cap0 = ntohl(call->tmp); - if (cap0 & AFS3_VICED_CAPABILITY_64BITFILES) -@@ -167,7 +168,7 @@ void afs_fileserver_probe_result(struct afs_call *call) - clear_bit(AFS_SERVER_FL_HAS_FS64, &server->flags); - } - -- rxrpc_kernel_get_srtt(call->net->socket, call->rxcall, &rtt_us); -+ rtt_us = rxrpc_kernel_get_srtt(addr->peer); - if (rtt_us < server->probe.rtt) { - server->probe.rtt = rtt_us; - server->rtt = rtt_us; -@@ -181,8 +182,8 @@ void afs_fileserver_probe_result(struct afs_call *call) - out: - spin_unlock(&server->probe_lock); - -- _debug("probe %pU [%u] %pISpc rtt=%u ret=%d", -- &server->uuid, index, &alist->addrs[index].srx.transport, -+ _debug("probe %pU [%u] %pISpc rtt=%d ret=%d", -+ &server->uuid, index, rxrpc_kernel_remote_addr(alist->addrs[index].peer), - rtt_us, ret); - - return afs_done_one_fs_probe(call->net, server); -diff --git a/fs/afs/internal.h b/fs/afs/internal.h -index e2adb314ab6a..ec08b4a7e499 100644 ---- a/fs/afs/internal.h -+++ b/fs/afs/internal.h -@@ -72,6 +72,11 @@ enum afs_call_state { - AFS_CALL_COMPLETE, /* Completed or failed */ - }; - -+struct afs_address { -+ struct rxrpc_peer *peer; -+ u16 service_id; -+}; -+ - /* - * List of server addresses. - */ -@@ -87,9 +92,7 @@ struct afs_addr_list { - enum dns_lookup_status status:8; - unsigned long failed; /* Mask of addrs that failed locally/ICMP */ - unsigned long responded; /* Mask of addrs that responded */ -- struct { -- struct sockaddr_rxrpc srx; -- } addrs[] __counted_by(max_addrs); -+ struct afs_address addrs[] __counted_by(max_addrs); - #define AFS_MAX_ADDRESSES ((unsigned int)(sizeof(unsigned long) * 8)) - }; - -@@ -420,7 +423,7 @@ struct afs_vlserver { - atomic_t probe_outstanding; - spinlock_t probe_lock; - struct { -- unsigned int rtt; /* RTT in uS */ -+ unsigned int rtt; /* Best RTT in uS (or UINT_MAX) */ - u32 abort_code; - short error; - unsigned short flags; -@@ -537,7 +540,7 @@ struct afs_server { - atomic_t probe_outstanding; - spinlock_t probe_lock; - struct { -- unsigned int rtt; /* RTT in uS */ -+ unsigned int rtt; /* Best RTT in uS (or UINT_MAX) */ - u32 abort_code; - short error; - bool responded:1; -@@ -964,9 +967,7 @@ static inline struct afs_addr_list *afs_get_addrlist(struct afs_addr_list *alist - refcount_inc(&alist->usage); - return alist; - } --extern struct afs_addr_list *afs_alloc_addrlist(unsigned int, -- unsigned short, -- unsigned short); -+extern struct afs_addr_list *afs_alloc_addrlist(unsigned int nr, u16 service_id); - extern void afs_put_addrlist(struct afs_addr_list *); - extern struct afs_vlserver_list *afs_parse_text_addrs(struct afs_net *, - const char *, size_t, char, -@@ -977,8 +978,10 @@ extern struct afs_vlserver_list *afs_dns_query(struct afs_cell *, time64_t *); - extern bool afs_iterate_addresses(struct afs_addr_cursor *); - extern int afs_end_cursor(struct afs_addr_cursor *); - --extern void afs_merge_fs_addr4(struct afs_addr_list *, __be32, u16); --extern void afs_merge_fs_addr6(struct afs_addr_list *, __be32 *, u16); -+extern int afs_merge_fs_addr4(struct afs_net *net, struct afs_addr_list *addr, -+ __be32 xdr, u16 port); -+extern int afs_merge_fs_addr6(struct afs_net *net, struct afs_addr_list *addr, -+ __be32 *xdr, u16 port); - - /* - * callback.c -@@ -1405,8 +1408,7 @@ extern void __exit afs_clean_up_permit_cache(void); - */ - extern spinlock_t afs_server_peer_lock; - --extern struct afs_server *afs_find_server(struct afs_net *, -- const struct sockaddr_rxrpc *); -+extern struct afs_server *afs_find_server(struct afs_net *, const struct rxrpc_peer *); - extern struct afs_server *afs_find_server_by_uuid(struct afs_net *, const uuid_t *); - extern struct afs_server *afs_lookup_server(struct afs_cell *, struct key *, const uuid_t *, u32); - extern struct afs_server *afs_get_server(struct afs_server *, enum afs_server_trace); -diff --git a/fs/afs/proc.c b/fs/afs/proc.c -index ab9cd986cfd9..8a65a06908d2 100644 ---- a/fs/afs/proc.c -+++ b/fs/afs/proc.c -@@ -307,7 +307,7 @@ static int afs_proc_cell_vlservers_show(struct seq_file *m, void *v) - for (i = 0; i < alist->nr_addrs; i++) - seq_printf(m, " %c %pISpc\n", - alist->preferred == i ? '>' : '-', -- &alist->addrs[i].srx.transport); -+ rxrpc_kernel_remote_addr(alist->addrs[i].peer)); - } - seq_printf(m, " info: fl=%lx rtt=%d\n", vlserver->flags, vlserver->rtt); - seq_printf(m, " probe: fl=%x e=%d ac=%d out=%d\n", -@@ -398,9 +398,10 @@ static int afs_proc_servers_show(struct seq_file *m, void *v) - seq_printf(m, " - ALIST v=%u rsp=%lx f=%lx\n", - alist->version, alist->responded, alist->failed); - for (i = 0; i < alist->nr_addrs; i++) -- seq_printf(m, " [%x] %pISpc%s\n", -- i, &alist->addrs[i].srx.transport, -- alist->preferred == i ? "*" : ""); -+ seq_printf(m, " [%x] %pISpc%s rtt=%d\n", -+ i, rxrpc_kernel_remote_addr(alist->addrs[i].peer), -+ alist->preferred == i ? "*" : "", -+ rxrpc_kernel_get_srtt(alist->addrs[i].peer)); - return 0; - } - -diff --git a/fs/afs/rotate.c b/fs/afs/rotate.c -index 46081e5da6f5..59aed7a6dd11 100644 ---- a/fs/afs/rotate.c -+++ b/fs/afs/rotate.c -@@ -113,7 +113,7 @@ bool afs_select_fileserver(struct afs_operation *op) - struct afs_server *server; - struct afs_vnode *vnode = op->file[0].vnode; - struct afs_error e; -- u32 rtt; -+ unsigned int rtt; - int error = op->ac.error, i; - - _enter("%lx[%d],%lx[%d],%d,%d", -@@ -420,7 +420,7 @@ bool afs_select_fileserver(struct afs_operation *op) - } - - op->index = -1; -- rtt = U32_MAX; -+ rtt = UINT_MAX; - for (i = 0; i < op->server_list->nr_servers; i++) { - struct afs_server *s = op->server_list->servers[i].server; - -@@ -488,7 +488,7 @@ bool afs_select_fileserver(struct afs_operation *op) - - _debug("address [%u] %u/%u %pISp", - op->index, op->ac.index, op->ac.alist->nr_addrs, -- &op->ac.alist->addrs[op->ac.index].srx.transport); -+ rxrpc_kernel_remote_addr(op->ac.alist->addrs[op->ac.index].peer)); - - _leave(" = t"); - return true; -diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c -index 181317126e43..2603db03b7ff 100644 ---- a/fs/afs/rxrpc.c -+++ b/fs/afs/rxrpc.c -@@ -296,7 +296,8 @@ static void afs_notify_end_request_tx(struct sock *sock, - */ - void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp) - { -- struct sockaddr_rxrpc *srx = &ac->alist->addrs[ac->index].srx; -+ struct afs_address *addr = &ac->alist->addrs[ac->index]; -+ struct rxrpc_peer *peer = addr->peer; - struct rxrpc_call *rxcall; - struct msghdr msg; - struct kvec iov[1]; -@@ -304,7 +305,7 @@ void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp) - s64 tx_total_len; - int ret; - -- _enter(",{%pISp},", &srx->transport); -+ _enter(",{%pISp},", rxrpc_kernel_remote_addr(addr->peer)); - - ASSERT(call->type != NULL); - ASSERT(call->type->name != NULL); -@@ -333,7 +334,7 @@ void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp) - } - - /* create a call */ -- rxcall = rxrpc_kernel_begin_call(call->net->socket, srx, call->key, -+ rxcall = rxrpc_kernel_begin_call(call->net->socket, peer, call->key, - (unsigned long)call, - tx_total_len, - call->max_lifespan, -@@ -341,6 +342,7 @@ void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp) - (call->async ? - afs_wake_up_async_call : - afs_wake_up_call_waiter), -+ addr->service_id, - call->upgrade, - (call->intr ? RXRPC_PREINTERRUPTIBLE : - RXRPC_UNINTERRUPTIBLE), -@@ -461,7 +463,7 @@ static void afs_log_error(struct afs_call *call, s32 remote_abort) - max = m + 1; - pr_notice("kAFS: Peer reported %s failure on %s [%pISp]\n", - msg, call->type->name, -- &call->alist->addrs[call->addr_ix].srx.transport); -+ rxrpc_kernel_remote_addr(call->alist->addrs[call->addr_ix].peer)); - } - } - -diff --git a/fs/afs/server.c b/fs/afs/server.c -index b8e2d211d4a1..5b5fa94005c9 100644 ---- a/fs/afs/server.c -+++ b/fs/afs/server.c -@@ -21,13 +21,12 @@ static void __afs_put_server(struct afs_net *, struct afs_server *); - /* - * Find a server by one of its addresses. - */ --struct afs_server *afs_find_server(struct afs_net *net, -- const struct sockaddr_rxrpc *srx) -+struct afs_server *afs_find_server(struct afs_net *net, const struct rxrpc_peer *peer) - { - const struct afs_addr_list *alist; - struct afs_server *server = NULL; - unsigned int i; -- int seq = 1, diff; -+ int seq = 1; - - rcu_read_lock(); - -@@ -38,37 +37,11 @@ struct afs_server *afs_find_server(struct afs_net *net, - seq++; /* 2 on the 1st/lockless path, otherwise odd */ - read_seqbegin_or_lock(&net->fs_addr_lock, &seq); - -- if (srx->transport.family == AF_INET6) { -- const struct sockaddr_in6 *a = &srx->transport.sin6, *b; -- hlist_for_each_entry_rcu(server, &net->fs_addresses6, addr6_link) { -- alist = rcu_dereference(server->addresses); -- for (i = alist->nr_ipv4; i < alist->nr_addrs; i++) { -- b = &alist->addrs[i].srx.transport.sin6; -- diff = ((u16 __force)a->sin6_port - -- (u16 __force)b->sin6_port); -- if (diff == 0) -- diff = memcmp(&a->sin6_addr, -- &b->sin6_addr, -- sizeof(struct in6_addr)); -- if (diff == 0) -- goto found; -- } -- } -- } else { -- const struct sockaddr_in *a = &srx->transport.sin, *b; -- hlist_for_each_entry_rcu(server, &net->fs_addresses4, addr4_link) { -- alist = rcu_dereference(server->addresses); -- for (i = 0; i < alist->nr_ipv4; i++) { -- b = &alist->addrs[i].srx.transport.sin; -- diff = ((u16 __force)a->sin_port - -- (u16 __force)b->sin_port); -- if (diff == 0) -- diff = ((u32 __force)a->sin_addr.s_addr - -- (u32 __force)b->sin_addr.s_addr); -- if (diff == 0) -- goto found; -- } -- } -+ hlist_for_each_entry_rcu(server, &net->fs_addresses6, addr6_link) { -+ alist = rcu_dereference(server->addresses); -+ for (i = 0; i < alist->nr_addrs; i++) -+ if (alist->addrs[i].peer == peer) -+ goto found; - } - - server = NULL; -diff --git a/fs/afs/vl_alias.c b/fs/afs/vl_alias.c -index d3c0df70a1a5..6fdf9f1bedc0 100644 ---- a/fs/afs/vl_alias.c -+++ b/fs/afs/vl_alias.c -@@ -32,55 +32,6 @@ static struct afs_volume *afs_sample_volume(struct afs_cell *cell, struct key *k - return volume; - } - --/* -- * Compare two addresses. -- */ --static int afs_compare_addrs(const struct sockaddr_rxrpc *srx_a, -- const struct sockaddr_rxrpc *srx_b) --{ -- short port_a, port_b; -- int addr_a, addr_b, diff; -- -- diff = (short)srx_a->transport_type - (short)srx_b->transport_type; -- if (diff) -- goto out; -- -- switch (srx_a->transport_type) { -- case AF_INET: { -- const struct sockaddr_in *a = &srx_a->transport.sin; -- const struct sockaddr_in *b = &srx_b->transport.sin; -- addr_a = ntohl(a->sin_addr.s_addr); -- addr_b = ntohl(b->sin_addr.s_addr); -- diff = addr_a - addr_b; -- if (diff == 0) { -- port_a = ntohs(a->sin_port); -- port_b = ntohs(b->sin_port); -- diff = port_a - port_b; -- } -- break; -- } -- -- case AF_INET6: { -- const struct sockaddr_in6 *a = &srx_a->transport.sin6; -- const struct sockaddr_in6 *b = &srx_b->transport.sin6; -- diff = memcmp(&a->sin6_addr, &b->sin6_addr, 16); -- if (diff == 0) { -- port_a = ntohs(a->sin6_port); -- port_b = ntohs(b->sin6_port); -- diff = port_a - port_b; -- } -- break; -- } -- -- default: -- WARN_ON(1); -- diff = 1; -- } -- --out: -- return diff; --} -- - /* - * Compare the address lists of a pair of fileservers. - */ -@@ -94,9 +45,9 @@ static int afs_compare_fs_alists(const struct afs_server *server_a, - lb = rcu_dereference(server_b->addresses); - - while (a < la->nr_addrs && b < lb->nr_addrs) { -- const struct sockaddr_rxrpc *srx_a = &la->addrs[a].srx; -- const struct sockaddr_rxrpc *srx_b = &lb->addrs[b].srx; -- int diff = afs_compare_addrs(srx_a, srx_b); -+ unsigned long pa = (unsigned long)la->addrs[a].peer; -+ unsigned long pb = (unsigned long)lb->addrs[b].peer; -+ long diff = pa - pb; - - if (diff < 0) { - a++; -diff --git a/fs/afs/vl_list.c b/fs/afs/vl_list.c -index acc48216136a..ba89140eee9e 100644 ---- a/fs/afs/vl_list.c -+++ b/fs/afs/vl_list.c -@@ -83,14 +83,15 @@ static u16 afs_extract_le16(const u8 **_b) - /* - * Build a VL server address list from a DNS queried server list. - */ --static struct afs_addr_list *afs_extract_vl_addrs(const u8 **_b, const u8 *end, -+static struct afs_addr_list *afs_extract_vl_addrs(struct afs_net *net, -+ const u8 **_b, const u8 *end, - u8 nr_addrs, u16 port) - { - struct afs_addr_list *alist; - const u8 *b = *_b; - int ret = -EINVAL; - -- alist = afs_alloc_addrlist(nr_addrs, VL_SERVICE, port); -+ alist = afs_alloc_addrlist(nr_addrs, VL_SERVICE); - if (!alist) - return ERR_PTR(-ENOMEM); - if (nr_addrs == 0) -@@ -109,7 +110,9 @@ static struct afs_addr_list *afs_extract_vl_addrs(const u8 **_b, const u8 *end, - goto error; - } - memcpy(x, b, 4); -- afs_merge_fs_addr4(alist, x[0], port); -+ ret = afs_merge_fs_addr4(net, alist, x[0], port); -+ if (ret < 0) -+ goto error; - b += 4; - break; - -@@ -119,7 +122,9 @@ static struct afs_addr_list *afs_extract_vl_addrs(const u8 **_b, const u8 *end, - goto error; - } - memcpy(x, b, 16); -- afs_merge_fs_addr6(alist, x, port); -+ ret = afs_merge_fs_addr6(net, alist, x, port); -+ if (ret < 0) -+ goto error; - b += 16; - break; - -@@ -247,7 +252,7 @@ struct afs_vlserver_list *afs_extract_vlserver_list(struct afs_cell *cell, - /* Extract the addresses - note that we can't skip this as we - * have to advance the payload pointer. - */ -- addrs = afs_extract_vl_addrs(&b, end, bs.nr_addrs, bs.port); -+ addrs = afs_extract_vl_addrs(cell->net, &b, end, bs.nr_addrs, bs.port); - if (IS_ERR(addrs)) { - ret = PTR_ERR(addrs); - goto error_2; -diff --git a/fs/afs/vl_probe.c b/fs/afs/vl_probe.c -index bdd9372e3fb2..9551aef07cee 100644 ---- a/fs/afs/vl_probe.c -+++ b/fs/afs/vl_probe.c -@@ -48,6 +48,7 @@ void afs_vlserver_probe_result(struct afs_call *call) - { - struct afs_addr_list *alist = call->alist; - struct afs_vlserver *server = call->vlserver; -+ struct afs_address *addr = &alist->addrs[call->addr_ix]; - unsigned int server_index = call->server_index; - unsigned int rtt_us = 0; - unsigned int index = call->addr_ix; -@@ -106,16 +107,16 @@ void afs_vlserver_probe_result(struct afs_call *call) - if (call->service_id == YFS_VL_SERVICE) { - server->probe.flags |= AFS_VLSERVER_PROBE_IS_YFS; - set_bit(AFS_VLSERVER_FL_IS_YFS, &server->flags); -- alist->addrs[index].srx.srx_service = call->service_id; -+ addr->service_id = call->service_id; - } else { - server->probe.flags |= AFS_VLSERVER_PROBE_NOT_YFS; - if (!(server->probe.flags & AFS_VLSERVER_PROBE_IS_YFS)) { - clear_bit(AFS_VLSERVER_FL_IS_YFS, &server->flags); -- alist->addrs[index].srx.srx_service = call->service_id; -+ addr->service_id = call->service_id; - } - } - -- rxrpc_kernel_get_srtt(call->net->socket, call->rxcall, &rtt_us); -+ rtt_us = rxrpc_kernel_get_srtt(addr->peer); - if (rtt_us < server->probe.rtt) { - server->probe.rtt = rtt_us; - server->rtt = rtt_us; -@@ -130,8 +131,9 @@ void afs_vlserver_probe_result(struct afs_call *call) - out: - spin_unlock(&server->probe_lock); - -- _debug("probe [%u][%u] %pISpc rtt=%u ret=%d", -- server_index, index, &alist->addrs[index].srx.transport, rtt_us, ret); -+ _debug("probe [%u][%u] %pISpc rtt=%d ret=%d", -+ server_index, index, rxrpc_kernel_remote_addr(addr->peer), -+ rtt_us, ret); - - afs_done_one_vl_probe(server, have_result); - } -diff --git a/fs/afs/vl_rotate.c b/fs/afs/vl_rotate.c -index e52b9d4c8a0a..f8f255c966ae 100644 ---- a/fs/afs/vl_rotate.c -+++ b/fs/afs/vl_rotate.c -@@ -92,7 +92,7 @@ bool afs_select_vlserver(struct afs_vl_cursor *vc) - struct afs_addr_list *alist; - struct afs_vlserver *vlserver; - struct afs_error e; -- u32 rtt; -+ unsigned int rtt; - int error = vc->ac.error, i; - - _enter("%lx[%d],%lx[%d],%d,%d", -@@ -194,7 +194,7 @@ bool afs_select_vlserver(struct afs_vl_cursor *vc) - goto selected_server; - - vc->index = -1; -- rtt = U32_MAX; -+ rtt = UINT_MAX; - for (i = 0; i < vc->server_list->nr_servers; i++) { - struct afs_vlserver *s = vc->server_list->servers[i].server; - -@@ -249,7 +249,7 @@ bool afs_select_vlserver(struct afs_vl_cursor *vc) - - _debug("VL address %d/%d", vc->ac.index, vc->ac.alist->nr_addrs); - -- _leave(" = t %pISpc", &vc->ac.alist->addrs[vc->ac.index].srx.transport); -+ _leave(" = t %pISpc", rxrpc_kernel_remote_addr(vc->ac.alist->addrs[vc->ac.index].peer)); - return true; - - next_server: -diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c -index 00fca3c66ba6..41e7932d75c6 100644 ---- a/fs/afs/vlclient.c -+++ b/fs/afs/vlclient.c -@@ -208,7 +208,7 @@ static int afs_deliver_vl_get_addrs_u(struct afs_call *call) - count = ntohl(*bp); - - nentries = min(nentries, count); -- alist = afs_alloc_addrlist(nentries, FS_SERVICE, AFS_FS_PORT); -+ alist = afs_alloc_addrlist(nentries, FS_SERVICE); - if (!alist) - return -ENOMEM; - alist->version = uniquifier; -@@ -230,9 +230,13 @@ static int afs_deliver_vl_get_addrs_u(struct afs_call *call) - alist = call->ret_alist; - bp = call->buffer; - count = min(call->count, 4U); -- for (i = 0; i < count; i++) -- if (alist->nr_addrs < call->count2) -- afs_merge_fs_addr4(alist, *bp++, AFS_FS_PORT); -+ for (i = 0; i < count; i++) { -+ if (alist->nr_addrs < call->count2) { -+ ret = afs_merge_fs_addr4(call->net, alist, *bp++, AFS_FS_PORT); -+ if (ret < 0) -+ return ret; -+ } -+ } - - call->count -= count; - if (call->count > 0) -@@ -450,7 +454,7 @@ static int afs_deliver_yfsvl_get_endpoints(struct afs_call *call) - if (call->count > YFS_MAXENDPOINTS) - return afs_protocol_error(call, afs_eproto_yvl_fsendpt_num); - -- alist = afs_alloc_addrlist(call->count, FS_SERVICE, AFS_FS_PORT); -+ alist = afs_alloc_addrlist(call->count, FS_SERVICE); - if (!alist) - return -ENOMEM; - alist->version = uniquifier; -@@ -488,14 +492,18 @@ static int afs_deliver_yfsvl_get_endpoints(struct afs_call *call) - if (ntohl(bp[0]) != sizeof(__be32) * 2) - return afs_protocol_error( - call, afs_eproto_yvl_fsendpt4_len); -- afs_merge_fs_addr4(alist, bp[1], ntohl(bp[2])); -+ ret = afs_merge_fs_addr4(call->net, alist, bp[1], ntohl(bp[2])); -+ if (ret < 0) -+ return ret; - bp += 3; - break; - case YFS_ENDPOINT_IPV6: - if (ntohl(bp[0]) != sizeof(__be32) * 5) - return afs_protocol_error( - call, afs_eproto_yvl_fsendpt6_len); -- afs_merge_fs_addr6(alist, bp + 1, ntohl(bp[5])); -+ ret = afs_merge_fs_addr6(call->net, alist, bp + 1, ntohl(bp[5])); -+ if (ret < 0) -+ return ret; - bp += 6; - break; - default: -diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h -index 5531dd08061e..0754c463224a 100644 ---- a/include/net/af_rxrpc.h -+++ b/include/net/af_rxrpc.h -@@ -15,6 +15,7 @@ struct key; - struct sock; - struct socket; - struct rxrpc_call; -+struct rxrpc_peer; - enum rxrpc_abort_reason; - - enum rxrpc_interruptibility { -@@ -41,13 +42,14 @@ void rxrpc_kernel_new_call_notification(struct socket *, - rxrpc_notify_new_call_t, - rxrpc_discard_new_call_t); - struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock, -- struct sockaddr_rxrpc *srx, -+ struct rxrpc_peer *peer, - struct key *key, - unsigned long user_call_ID, - s64 tx_total_len, - u32 hard_timeout, - gfp_t gfp, - rxrpc_notify_rx_t notify_rx, -+ u16 service_id, - bool upgrade, - enum rxrpc_interruptibility interruptibility, - unsigned int debug_id); -@@ -60,9 +62,14 @@ bool rxrpc_kernel_abort_call(struct socket *, struct rxrpc_call *, - u32, int, enum rxrpc_abort_reason); - void rxrpc_kernel_shutdown_call(struct socket *sock, struct rxrpc_call *call); - void rxrpc_kernel_put_call(struct socket *sock, struct rxrpc_call *call); --void rxrpc_kernel_get_peer(struct socket *, struct rxrpc_call *, -- struct sockaddr_rxrpc *); --bool rxrpc_kernel_get_srtt(struct socket *, struct rxrpc_call *, u32 *); -+struct rxrpc_peer *rxrpc_kernel_lookup_peer(struct socket *sock, -+ struct sockaddr_rxrpc *srx, gfp_t gfp); -+void rxrpc_kernel_put_peer(struct rxrpc_peer *peer); -+struct rxrpc_peer *rxrpc_kernel_get_peer(struct rxrpc_peer *peer); -+struct rxrpc_peer *rxrpc_kernel_get_call_peer(struct socket *sock, struct rxrpc_call *call); -+const struct sockaddr_rxrpc *rxrpc_kernel_remote_srx(const struct rxrpc_peer *peer); -+const struct sockaddr *rxrpc_kernel_remote_addr(const struct rxrpc_peer *peer); -+unsigned int rxrpc_kernel_get_srtt(const struct rxrpc_peer *); - int rxrpc_kernel_charge_accept(struct socket *, rxrpc_notify_rx_t, - rxrpc_user_attach_call_t, unsigned long, gfp_t, - unsigned int); -diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h -index f7e537f64db4..4c1ef7b3705c 100644 ---- a/include/trace/events/rxrpc.h -+++ b/include/trace/events/rxrpc.h -@@ -178,7 +178,9 @@ - #define rxrpc_peer_traces \ - EM(rxrpc_peer_free, "FREE ") \ - EM(rxrpc_peer_get_accept, "GET accept ") \ -+ EM(rxrpc_peer_get_application, "GET app ") \ - EM(rxrpc_peer_get_bundle, "GET bundle ") \ -+ EM(rxrpc_peer_get_call, "GET call ") \ - EM(rxrpc_peer_get_client_conn, "GET cln-conn") \ - EM(rxrpc_peer_get_input, "GET input ") \ - EM(rxrpc_peer_get_input_error, "GET inpt-err") \ -@@ -187,6 +189,7 @@ - EM(rxrpc_peer_get_service_conn, "GET srv-conn") \ - EM(rxrpc_peer_new_client, "NEW client ") \ - EM(rxrpc_peer_new_prealloc, "NEW prealloc") \ -+ EM(rxrpc_peer_put_application, "PUT app ") \ - EM(rxrpc_peer_put_bundle, "PUT bundle ") \ - EM(rxrpc_peer_put_call, "PUT call ") \ - EM(rxrpc_peer_put_conn, "PUT conn ") \ -diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c -index fa8aec78f63d..465bfe5eb061 100644 ---- a/net/rxrpc/af_rxrpc.c -+++ b/net/rxrpc/af_rxrpc.c -@@ -258,16 +258,62 @@ static int rxrpc_listen(struct socket *sock, int backlog) - return ret; - } - -+/** -+ * rxrpc_kernel_lookup_peer - Obtain remote transport endpoint for an address -+ * @sock: The socket through which it will be accessed -+ * @srx: The network address -+ * @gfp: Allocation flags -+ * -+ * Lookup or create a remote transport endpoint record for the specified -+ * address and return it with a ref held. -+ */ -+struct rxrpc_peer *rxrpc_kernel_lookup_peer(struct socket *sock, -+ struct sockaddr_rxrpc *srx, gfp_t gfp) -+{ -+ struct rxrpc_sock *rx = rxrpc_sk(sock->sk); -+ int ret; -+ -+ ret = rxrpc_validate_address(rx, srx, sizeof(*srx)); -+ if (ret < 0) -+ return ERR_PTR(ret); -+ -+ return rxrpc_lookup_peer(rx->local, srx, gfp); -+} -+EXPORT_SYMBOL(rxrpc_kernel_lookup_peer); -+ -+/** -+ * rxrpc_kernel_get_peer - Get a reference on a peer -+ * @peer: The peer to get a reference on. -+ * -+ * Get a record for the remote peer in a call. -+ */ -+struct rxrpc_peer *rxrpc_kernel_get_peer(struct rxrpc_peer *peer) -+{ -+ return peer ? rxrpc_get_peer(peer, rxrpc_peer_get_application) : NULL; -+} -+EXPORT_SYMBOL(rxrpc_kernel_get_peer); -+ -+/** -+ * rxrpc_kernel_put_peer - Allow a kernel app to drop a peer reference -+ * @peer: The peer to drop a ref on -+ */ -+void rxrpc_kernel_put_peer(struct rxrpc_peer *peer) -+{ -+ rxrpc_put_peer(peer, rxrpc_peer_put_application); -+} -+EXPORT_SYMBOL(rxrpc_kernel_put_peer); -+ - /** - * rxrpc_kernel_begin_call - Allow a kernel service to begin a call - * @sock: The socket on which to make the call -- * @srx: The address of the peer to contact -+ * @peer: The peer to contact - * @key: The security context to use (defaults to socket setting) - * @user_call_ID: The ID to use - * @tx_total_len: Total length of data to transmit during the call (or -1) - * @hard_timeout: The maximum lifespan of the call in sec - * @gfp: The allocation constraints - * @notify_rx: Where to send notifications instead of socket queue -+ * @service_id: The ID of the service to contact - * @upgrade: Request service upgrade for call - * @interruptibility: The call is interruptible, or can be canceled. - * @debug_id: The debug ID for tracing to be assigned to the call -@@ -280,13 +326,14 @@ static int rxrpc_listen(struct socket *sock, int backlog) - * supplying @srx and @key. - */ - struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock, -- struct sockaddr_rxrpc *srx, -+ struct rxrpc_peer *peer, - struct key *key, - unsigned long user_call_ID, - s64 tx_total_len, - u32 hard_timeout, - gfp_t gfp, - rxrpc_notify_rx_t notify_rx, -+ u16 service_id, - bool upgrade, - enum rxrpc_interruptibility interruptibility, - unsigned int debug_id) -@@ -295,13 +342,11 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock, - struct rxrpc_call_params p; - struct rxrpc_call *call; - struct rxrpc_sock *rx = rxrpc_sk(sock->sk); -- int ret; - - _enter(",,%x,%lx", key_serial(key), user_call_ID); - -- ret = rxrpc_validate_address(rx, srx, sizeof(*srx)); -- if (ret < 0) -- return ERR_PTR(ret); -+ if (WARN_ON_ONCE(peer->local != rx->local)) -+ return ERR_PTR(-EIO); - - lock_sock(&rx->sk); - -@@ -319,12 +364,13 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock, - - memset(&cp, 0, sizeof(cp)); - cp.local = rx->local; -+ cp.peer = peer; - cp.key = key; - cp.security_level = rx->min_sec_level; - cp.exclusive = false; - cp.upgrade = upgrade; -- cp.service_id = srx->srx_service; -- call = rxrpc_new_client_call(rx, &cp, srx, &p, gfp, debug_id); -+ cp.service_id = service_id; -+ call = rxrpc_new_client_call(rx, &cp, &p, gfp, debug_id); - /* The socket has been unlocked. */ - if (!IS_ERR(call)) { - call->notify_rx = notify_rx; -diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h -index e8b43408136a..5d5b19f20d1e 100644 ---- a/net/rxrpc/ar-internal.h -+++ b/net/rxrpc/ar-internal.h -@@ -364,6 +364,7 @@ struct rxrpc_conn_proto { - - struct rxrpc_conn_parameters { - struct rxrpc_local *local; /* Representation of local endpoint */ -+ struct rxrpc_peer *peer; /* Representation of remote endpoint */ - struct key *key; /* Security details */ - bool exclusive; /* T if conn is exclusive */ - bool upgrade; /* T if service ID can be upgraded */ -@@ -867,7 +868,6 @@ struct rxrpc_call *rxrpc_find_call_by_user_ID(struct rxrpc_sock *, unsigned long - struct rxrpc_call *rxrpc_alloc_call(struct rxrpc_sock *, gfp_t, unsigned int); - struct rxrpc_call *rxrpc_new_client_call(struct rxrpc_sock *, - struct rxrpc_conn_parameters *, -- struct sockaddr_rxrpc *, - struct rxrpc_call_params *, gfp_t, - unsigned int); - void rxrpc_start_call_timer(struct rxrpc_call *call); -diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c -index f10b37c14772..0943e54370ba 100644 ---- a/net/rxrpc/call_object.c -+++ b/net/rxrpc/call_object.c -@@ -193,7 +193,6 @@ struct rxrpc_call *rxrpc_alloc_call(struct rxrpc_sock *rx, gfp_t gfp, - * Allocate a new client call. - */ - static struct rxrpc_call *rxrpc_alloc_client_call(struct rxrpc_sock *rx, -- struct sockaddr_rxrpc *srx, - struct rxrpc_conn_parameters *cp, - struct rxrpc_call_params *p, - gfp_t gfp, -@@ -211,10 +210,12 @@ static struct rxrpc_call *rxrpc_alloc_client_call(struct rxrpc_sock *rx, - now = ktime_get_real(); - call->acks_latest_ts = now; - call->cong_tstamp = now; -- call->dest_srx = *srx; -+ call->dest_srx = cp->peer->srx; -+ call->dest_srx.srx_service = cp->service_id; - call->interruptibility = p->interruptibility; - call->tx_total_len = p->tx_total_len; - call->key = key_get(cp->key); -+ call->peer = rxrpc_get_peer(cp->peer, rxrpc_peer_get_call); - call->local = rxrpc_get_local(cp->local, rxrpc_local_get_call); - call->security_level = cp->security_level; - if (p->kernel) -@@ -306,10 +307,6 @@ static int rxrpc_connect_call(struct rxrpc_call *call, gfp_t gfp) - - _enter("{%d,%lx},", call->debug_id, call->user_call_ID); - -- call->peer = rxrpc_lookup_peer(local, &call->dest_srx, gfp); -- if (!call->peer) -- goto error; -- - ret = rxrpc_look_up_bundle(call, gfp); - if (ret < 0) - goto error; -@@ -334,7 +331,6 @@ static int rxrpc_connect_call(struct rxrpc_call *call, gfp_t gfp) - */ - struct rxrpc_call *rxrpc_new_client_call(struct rxrpc_sock *rx, - struct rxrpc_conn_parameters *cp, -- struct sockaddr_rxrpc *srx, - struct rxrpc_call_params *p, - gfp_t gfp, - unsigned int debug_id) -@@ -349,13 +345,18 @@ struct rxrpc_call *rxrpc_new_client_call(struct rxrpc_sock *rx, - - _enter("%p,%lx", rx, p->user_call_ID); - -+ if (WARN_ON_ONCE(!cp->peer)) { -+ release_sock(&rx->sk); -+ return ERR_PTR(-EIO); -+ } -+ - limiter = rxrpc_get_call_slot(p, gfp); - if (!limiter) { - release_sock(&rx->sk); - return ERR_PTR(-ERESTARTSYS); - } - -- call = rxrpc_alloc_client_call(rx, srx, cp, p, gfp, debug_id); -+ call = rxrpc_alloc_client_call(rx, cp, p, gfp, debug_id); - if (IS_ERR(call)) { - release_sock(&rx->sk); - up(limiter); -diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c -index 8d7a715a0bb1..49dcda67a0d5 100644 ---- a/net/rxrpc/peer_object.c -+++ b/net/rxrpc/peer_object.c -@@ -22,6 +22,8 @@ - #include <net/ip6_route.h> - #include "ar-internal.h" - -+static const struct sockaddr_rxrpc rxrpc_null_addr; -+ - /* - * Hash a peer key. - */ -@@ -457,39 +459,53 @@ void rxrpc_destroy_all_peers(struct rxrpc_net *rxnet) - } - - /** -- * rxrpc_kernel_get_peer - Get the peer address of a call -+ * rxrpc_kernel_get_call_peer - Get the peer address of a call - * @sock: The socket on which the call is in progress. - * @call: The call to query -- * @_srx: Where to place the result - * -- * Get the address of the remote peer in a call. -+ * Get a record for the remote peer in a call. - */ --void rxrpc_kernel_get_peer(struct socket *sock, struct rxrpc_call *call, -- struct sockaddr_rxrpc *_srx) -+struct rxrpc_peer *rxrpc_kernel_get_call_peer(struct socket *sock, struct rxrpc_call *call) - { -- *_srx = call->peer->srx; -+ return call->peer; - } --EXPORT_SYMBOL(rxrpc_kernel_get_peer); -+EXPORT_SYMBOL(rxrpc_kernel_get_call_peer); - - /** - * rxrpc_kernel_get_srtt - Get a call's peer smoothed RTT -- * @sock: The socket on which the call is in progress. -- * @call: The call to query -- * @_srtt: Where to store the SRTT value. -+ * @peer: The peer to query - * -- * Get the call's peer smoothed RTT in uS. -+ * Get the call's peer smoothed RTT in uS or UINT_MAX if we have no samples. - */ --bool rxrpc_kernel_get_srtt(struct socket *sock, struct rxrpc_call *call, -- u32 *_srtt) -+unsigned int rxrpc_kernel_get_srtt(const struct rxrpc_peer *peer) - { -- struct rxrpc_peer *peer = call->peer; -- -- if (peer->rtt_count == 0) { -- *_srtt = 1000000; /* 1S */ -- return false; -- } -- -- *_srtt = call->peer->srtt_us >> 3; -- return true; -+ return peer->rtt_count > 0 ? peer->srtt_us >> 3 : UINT_MAX; - } - EXPORT_SYMBOL(rxrpc_kernel_get_srtt); -+ -+/** -+ * rxrpc_kernel_remote_srx - Get the address of a peer -+ * @peer: The peer to query -+ * -+ * Get a pointer to the address from a peer record. The caller is responsible -+ * for making sure that the address is not deallocated. -+ */ -+const struct sockaddr_rxrpc *rxrpc_kernel_remote_srx(const struct rxrpc_peer *peer) -+{ -+ return peer ? &peer->srx : &rxrpc_null_addr; -+} -+EXPORT_SYMBOL(rxrpc_kernel_remote_srx); -+ -+/** -+ * rxrpc_kernel_remote_addr - Get the peer transport address of a call -+ * @peer: The peer to query -+ * -+ * Get a pointer to the transport address from a peer record. The caller is -+ * responsible for making sure that the address is not deallocated. -+ */ -+const struct sockaddr *rxrpc_kernel_remote_addr(const struct rxrpc_peer *peer) -+{ -+ return (const struct sockaddr *) -+ (peer ? &peer->srx.transport : &rxrpc_null_addr.transport); -+} -+EXPORT_SYMBOL(rxrpc_kernel_remote_addr); -diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c -index 8e0b94714e84..5677d5690a02 100644 ---- a/net/rxrpc/sendmsg.c -+++ b/net/rxrpc/sendmsg.c -@@ -572,6 +572,7 @@ rxrpc_new_client_call_for_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, - __acquires(&call->user_mutex) - { - struct rxrpc_conn_parameters cp; -+ struct rxrpc_peer *peer; - struct rxrpc_call *call; - struct key *key; - -@@ -584,21 +585,29 @@ rxrpc_new_client_call_for_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, - return ERR_PTR(-EDESTADDRREQ); - } - -+ peer = rxrpc_lookup_peer(rx->local, srx, GFP_KERNEL); -+ if (!peer) { -+ release_sock(&rx->sk); -+ return ERR_PTR(-ENOMEM); -+ } -+ - key = rx->key; - if (key && !rx->key->payload.data[0]) - key = NULL; - - memset(&cp, 0, sizeof(cp)); - cp.local = rx->local; -+ cp.peer = peer; - cp.key = rx->key; - cp.security_level = rx->min_sec_level; - cp.exclusive = rx->exclusive | p->exclusive; - cp.upgrade = p->upgrade; - cp.service_id = srx->srx_service; -- call = rxrpc_new_client_call(rx, &cp, srx, &p->call, GFP_KERNEL, -+ call = rxrpc_new_client_call(rx, &cp, &p->call, GFP_KERNEL, - atomic_inc_return(&rxrpc_debug_id)); - /* The socket is now unlocked */ - -+ rxrpc_put_peer(peer, rxrpc_peer_put_application); - _leave(" = %p\n", call); - return call; - } --- -2.43.2 - -From 3cd9a24aaa63c7f15b8b9588b911312dd62bad4c Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Fri, 20 Oct 2023 16:00:18 +0100 -Subject: [PATCH 0844/1501] afs: Handle the VIO and UAEIO aborts explicitly -Content-Length: 1157 -Lines: 36 - -[ Upstream commit eb8eae65f0c713bcef84b082aa919f72c3d83268 ] - -When processing the result of a call, handle the VIO and UAEIO abort -specifically rather than leaving it to a default case. Rather than -erroring out unconditionally, see if there's another server if the volume -has more than one server available, otherwise return -EREMOTEIO. - -Signed-off-by: David Howells <dhowells@redhat.com> -cc: Marc Dionne <marc.dionne@auristor.com> -cc: linux-afs@lists.infradead.org -Stable-dep-of: 17ba6f0bd14f ("afs: Fix error handling with lookup via FS.InlineBulkStatus") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/afs/rotate.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/fs/afs/rotate.c b/fs/afs/rotate.c -index 59aed7a6dd11..a108cd55bb4e 100644 ---- a/fs/afs/rotate.c -+++ b/fs/afs/rotate.c -@@ -330,6 +330,13 @@ bool afs_select_fileserver(struct afs_operation *op) - - goto restart_from_beginning; - -+ case UAEIO: -+ case VIO: -+ op->error = -EREMOTEIO; -+ if (op->volume->type != AFSVL_RWVOL) -+ goto next_server; -+ goto failed; -+ - case VDISKFULL: - case UAENOSPC: - /* The partition is full. Only applies to RWVOLs. --- -2.43.2 - -From 06fefb477d42b8ff405b721c05aba56962cd48d0 Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Fri, 20 Oct 2023 16:04:52 +0100 -Subject: [PATCH 0845/1501] afs: Use op->nr_iterations=-1 to indicate to begin - fileserver iteration -Content-Length: 2580 -Lines: 77 - -[ Upstream commit 075171fd22be33acf4ab354814bfa6de1c3412ce ] - -Set op->nr_iterations to -1 to indicate that we need to begin fileserver -iteration rather than setting error to SHRT_MAX. This makes it easier to -eliminate the address cursor. - -Signed-off-by: David Howells <dhowells@redhat.com> -cc: Marc Dionne <marc.dionne@auristor.com> -cc: linux-afs@lists.infradead.org -Stable-dep-of: 17ba6f0bd14f ("afs: Fix error handling with lookup via FS.InlineBulkStatus") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/afs/fs_operation.c | 2 +- - fs/afs/internal.h | 2 +- - fs/afs/rotate.c | 11 ++++++----- - 3 files changed, 8 insertions(+), 7 deletions(-) - -diff --git a/fs/afs/fs_operation.c b/fs/afs/fs_operation.c -index 7a3803ce3a22..3e31fae9a149 100644 ---- a/fs/afs/fs_operation.c -+++ b/fs/afs/fs_operation.c -@@ -41,7 +41,7 @@ struct afs_operation *afs_alloc_operation(struct key *key, struct afs_volume *vo - op->cb_v_break = volume->cb_v_break; - op->debug_id = atomic_inc_return(&afs_operation_debug_counter); - op->error = -EDESTADDRREQ; -- op->ac.error = SHRT_MAX; -+ op->nr_iterations = -1; - - _leave(" = [op=%08x]", op->debug_id); - return op; -diff --git a/fs/afs/internal.h b/fs/afs/internal.h -index ec08b4a7e499..88381935bd66 100644 ---- a/fs/afs/internal.h -+++ b/fs/afs/internal.h -@@ -859,7 +859,7 @@ struct afs_operation { - struct afs_call *call; - unsigned long untried; /* Bitmask of untried servers */ - short index; /* Current server */ -- unsigned short nr_iterations; /* Number of server iterations */ -+ short nr_iterations; /* Number of server iterations */ - - unsigned int flags; - #define AFS_OPERATION_STOP 0x0001 /* Set to cease iteration */ -diff --git a/fs/afs/rotate.c b/fs/afs/rotate.c -index a108cd55bb4e..4084e023ff43 100644 ---- a/fs/afs/rotate.c -+++ b/fs/afs/rotate.c -@@ -116,7 +116,10 @@ bool afs_select_fileserver(struct afs_operation *op) - unsigned int rtt; - int error = op->ac.error, i; - -- _enter("%lx[%d],%lx[%d],%d,%d", -+ op->nr_iterations++; -+ -+ _enter("OP=%x+%x,%llx,%lx[%d],%lx[%d],%d,%d", -+ op->debug_id, op->nr_iterations, op->volume->vid, - op->untried, op->index, - op->ac.tried, op->ac.index, - error, op->ac.abort_code); -@@ -126,13 +129,11 @@ bool afs_select_fileserver(struct afs_operation *op) - return false; - } - -- op->nr_iterations++; -+ if (op->nr_iterations == 0) -+ goto start; - - /* Evaluate the result of the previous operation, if there was one. */ - switch (error) { -- case SHRT_MAX: -- goto start; -- - case 0: - default: - /* Success or local failure. Stop. */ --- -2.43.2 - -From eeb4b31f4e1f0a3f2249e99289fd88bc61685dd4 Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Thu, 26 Oct 2023 09:43:23 +0100 -Subject: [PATCH 0846/1501] afs: Wrap most op->error accesses with inline funcs -Content-Length: 18047 -Lines: 583 - -[ Upstream commit 2de5599f63babb416e09b1a6be429a47910dd47c ] - -Wrap most op->error accesses with inline funcs which will make it easier -for a subsequent patch to replace op->error with something else. Two -functions are added to this end: - - (1) afs_op_error() - Get the error code. - - (2) afs_op_set_error() - Set the error code. - -Signed-off-by: David Howells <dhowells@redhat.com> -cc: Marc Dionne <marc.dionne@auristor.com> -cc: linux-afs@lists.infradead.org -Stable-dep-of: 17ba6f0bd14f ("afs: Fix error handling with lookup via FS.InlineBulkStatus") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/afs/dir.c | 38 +++++++++++++++--------------- - fs/afs/file.c | 4 ++-- - fs/afs/fs_operation.c | 21 ++++++++++------- - fs/afs/fsclient.c | 2 +- - fs/afs/inode.c | 2 +- - fs/afs/internal.h | 20 ++++++++++++---- - fs/afs/rotate.c | 55 ++++++++++++++++++++++++------------------- - fs/afs/server.c | 6 ++--- - fs/afs/write.c | 6 ++--- - 9 files changed, 87 insertions(+), 67 deletions(-) - -diff --git a/fs/afs/dir.c b/fs/afs/dir.c -index 2df2e9ee130d..15763418a938 100644 ---- a/fs/afs/dir.c -+++ b/fs/afs/dir.c -@@ -886,14 +886,14 @@ static struct inode *afs_do_lookup(struct inode *dir, struct dentry *dentry, - * lookups contained therein are stored in the reply without aborting - * the whole operation. - */ -- op->error = -ENOTSUPP; -+ afs_op_set_error(op, -ENOTSUPP); - if (!cookie->one_only) { - op->ops = &afs_inline_bulk_status_operation; - afs_begin_vnode_operation(op); - afs_wait_for_operation(op); - } - -- if (op->error == -ENOTSUPP) { -+ if (afs_op_error(op) == -ENOTSUPP) { - /* We could try FS.BulkStatus next, but this aborts the entire - * op if any of the lookups fails - so, for the moment, revert - * to FS.FetchStatus for op->file[1]. -@@ -903,10 +903,10 @@ static struct inode *afs_do_lookup(struct inode *dir, struct dentry *dentry, - afs_begin_vnode_operation(op); - afs_wait_for_operation(op); - } -- inode = ERR_PTR(op->error); -+ inode = ERR_PTR(afs_op_error(op)); - - out_op: -- if (op->error == 0) { -+ if (!afs_op_error(op)) { - inode = &op->file[1].vnode->netfs.inode; - op->file[1].vnode = NULL; - } -@@ -1281,7 +1281,7 @@ static void afs_vnode_new_inode(struct afs_operation *op) - - _enter(""); - -- ASSERTCMP(op->error, ==, 0); -+ ASSERTCMP(afs_op_error(op), ==, 0); - - inode = afs_iget(op, vp); - if (IS_ERR(inode)) { -@@ -1294,7 +1294,7 @@ static void afs_vnode_new_inode(struct afs_operation *op) - - vnode = AFS_FS_I(inode); - set_bit(AFS_VNODE_NEW_CONTENT, &vnode->flags); -- if (!op->error) -+ if (!afs_op_error(op)) - afs_cache_permit(vnode, op->key, vnode->cb_break, &vp->scb); - d_instantiate(op->dentry, inode); - } -@@ -1328,7 +1328,7 @@ static void afs_create_put(struct afs_operation *op) - { - _enter("op=%08x", op->debug_id); - -- if (op->error) -+ if (afs_op_error(op)) - d_drop(op->dentry); - } - -@@ -1488,7 +1488,7 @@ static void afs_dir_remove_link(struct afs_operation *op) - struct dentry *dentry = op->dentry; - int ret; - -- if (op->error != 0 || -+ if (afs_op_error(op) || - (op->file[1].scb.have_status && op->file[1].scb.have_error)) - return; - if (d_really_is_positive(dentry)) -@@ -1512,10 +1512,10 @@ static void afs_dir_remove_link(struct afs_operation *op) - - ret = afs_validate(vnode, op->key); - if (ret != -ESTALE) -- op->error = ret; -+ afs_op_set_error(op, ret); - } - -- _debug("nlink %d [val %d]", vnode->netfs.inode.i_nlink, op->error); -+ _debug("nlink %d [val %d]", vnode->netfs.inode.i_nlink, afs_op_error(op)); - } - - static void afs_unlink_success(struct afs_operation *op) -@@ -1546,7 +1546,7 @@ static void afs_unlink_edit_dir(struct afs_operation *op) - static void afs_unlink_put(struct afs_operation *op) - { - _enter("op=%08x", op->debug_id); -- if (op->unlink.need_rehash && op->error < 0 && op->error != -ENOENT) -+ if (op->unlink.need_rehash && afs_op_error(op) < 0 && afs_op_error(op) != -ENOENT) - d_rehash(op->dentry); - } - -@@ -1587,7 +1587,7 @@ static int afs_unlink(struct inode *dir, struct dentry *dentry) - /* Try to make sure we have a callback promise on the victim. */ - ret = afs_validate(vnode, op->key); - if (ret < 0) { -- op->error = ret; -+ afs_op_set_error(op, ret); - goto error; - } - -@@ -1596,7 +1596,7 @@ static int afs_unlink(struct inode *dir, struct dentry *dentry) - spin_unlock(&dentry->d_lock); - /* Start asynchronous writeout of the inode */ - write_inode_now(d_inode(dentry), 0); -- op->error = afs_sillyrename(dvnode, vnode, dentry, op->key); -+ afs_op_set_error(op, afs_sillyrename(dvnode, vnode, dentry, op->key)); - goto error; - } - if (!d_unhashed(dentry)) { -@@ -1617,7 +1617,7 @@ static int afs_unlink(struct inode *dir, struct dentry *dentry) - /* If there was a conflict with a third party, check the status of the - * unlinked vnode. - */ -- if (op->error == 0 && (op->flags & AFS_OPERATION_DIR_CONFLICT)) { -+ if (afs_op_error(op) == 0 && (op->flags & AFS_OPERATION_DIR_CONFLICT)) { - op->file[1].update_ctime = false; - op->fetch_status.which = 1; - op->ops = &afs_fetch_status_operation; -@@ -1699,7 +1699,7 @@ static void afs_link_success(struct afs_operation *op) - static void afs_link_put(struct afs_operation *op) - { - _enter("op=%08x", op->debug_id); -- if (op->error) -+ if (afs_op_error(op)) - d_drop(op->dentry); - } - -@@ -1897,7 +1897,7 @@ static void afs_rename_put(struct afs_operation *op) - if (op->rename.rehash) - d_rehash(op->rename.rehash); - dput(op->rename.tmp); -- if (op->error) -+ if (afs_op_error(op)) - d_rehash(op->dentry); - } - -@@ -1942,7 +1942,7 @@ static int afs_rename(struct mnt_idmap *idmap, struct inode *old_dir, - return PTR_ERR(op); - - ret = afs_validate(vnode, op->key); -- op->error = ret; -+ afs_op_set_error(op, ret); - if (ret < 0) - goto error; - -@@ -1979,7 +1979,7 @@ static int afs_rename(struct mnt_idmap *idmap, struct inode *old_dir, - op->rename.tmp = d_alloc(new_dentry->d_parent, - &new_dentry->d_name); - if (!op->rename.tmp) { -- op->error = -ENOMEM; -+ afs_op_nomem(op); - goto error; - } - -@@ -1987,7 +1987,7 @@ static int afs_rename(struct mnt_idmap *idmap, struct inode *old_dir, - AFS_FS_I(d_inode(new_dentry)), - new_dentry, op->key); - if (ret) { -- op->error = ret; -+ afs_op_set_error(op, ret); - goto error; - } - -diff --git a/fs/afs/file.c b/fs/afs/file.c -index d37dd201752b..0c81c39c32f5 100644 ---- a/fs/afs/file.c -+++ b/fs/afs/file.c -@@ -243,7 +243,7 @@ static void afs_fetch_data_notify(struct afs_operation *op) - { - struct afs_read *req = op->fetch.req; - struct netfs_io_subrequest *subreq = req->subreq; -- int error = op->error; -+ int error = afs_op_error(op); - - if (error == -ECONNABORTED) - error = afs_abort_to_error(op->ac.abort_code); -@@ -271,7 +271,7 @@ static void afs_fetch_data_success(struct afs_operation *op) - - static void afs_fetch_data_put(struct afs_operation *op) - { -- op->fetch.req->error = op->error; -+ op->fetch.req->error = afs_op_error(op); - afs_put_read(op->fetch.req); - } - -diff --git a/fs/afs/fs_operation.c b/fs/afs/fs_operation.c -index 3e31fae9a149..bfb9a7634bd9 100644 ---- a/fs/afs/fs_operation.c -+++ b/fs/afs/fs_operation.c -@@ -40,8 +40,8 @@ struct afs_operation *afs_alloc_operation(struct key *key, struct afs_volume *vo - op->net = volume->cell->net; - op->cb_v_break = volume->cb_v_break; - op->debug_id = atomic_inc_return(&afs_operation_debug_counter); -- op->error = -EDESTADDRREQ; - op->nr_iterations = -1; -+ afs_op_set_error(op, -EDESTADDRREQ); - - _leave(" = [op=%08x]", op->debug_id); - return op; -@@ -71,7 +71,7 @@ static bool afs_get_io_locks(struct afs_operation *op) - swap(vnode, vnode2); - - if (mutex_lock_interruptible(&vnode->io_lock) < 0) { -- op->error = -ERESTARTSYS; -+ afs_op_set_error(op, -ERESTARTSYS); - op->flags |= AFS_OPERATION_STOP; - _leave(" = f [I 0]"); - return false; -@@ -80,7 +80,7 @@ static bool afs_get_io_locks(struct afs_operation *op) - - if (vnode2) { - if (mutex_lock_interruptible_nested(&vnode2->io_lock, 1) < 0) { -- op->error = -ERESTARTSYS; -+ afs_op_set_error(op, -ERESTARTSYS); - op->flags |= AFS_OPERATION_STOP; - mutex_unlock(&vnode->io_lock); - op->flags &= ~AFS_OPERATION_LOCK_0; -@@ -159,11 +159,14 @@ static void afs_end_vnode_operation(struct afs_operation *op) - { - _enter(""); - -- if (op->error == -EDESTADDRREQ || -- op->error == -EADDRNOTAVAIL || -- op->error == -ENETUNREACH || -- op->error == -EHOSTUNREACH) -+ switch (afs_op_error(op)) { -+ case -EDESTADDRREQ: -+ case -EADDRNOTAVAIL: -+ case -ENETUNREACH: -+ case -EHOSTUNREACH: - afs_dump_edestaddrreq(op); -+ break; -+ } - - afs_drop_io_locks(op); - -@@ -209,7 +212,7 @@ void afs_wait_for_operation(struct afs_operation *op) - - afs_end_vnode_operation(op); - -- if (op->error == 0 && op->ops->edit_dir) { -+ if (!afs_op_error(op) && op->ops->edit_dir) { - _debug("edit_dir"); - op->ops->edit_dir(op); - } -@@ -221,7 +224,7 @@ void afs_wait_for_operation(struct afs_operation *op) - */ - int afs_put_operation(struct afs_operation *op) - { -- int i, ret = op->error; -+ int i, ret = afs_op_error(op); - - _enter("op=%08x,%d", op->debug_id, ret); - -diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c -index 7d37f63ef0f0..6821ce0f9d63 100644 ---- a/fs/afs/fsclient.c -+++ b/fs/afs/fsclient.c -@@ -1899,7 +1899,7 @@ void afs_fs_inline_bulk_status(struct afs_operation *op) - int i; - - if (test_bit(AFS_SERVER_FL_NO_IBULK, &op->server->flags)) { -- op->error = -ENOTSUPP; -+ afs_op_set_error(op, -ENOTSUPP); - return; - } - -diff --git a/fs/afs/inode.c b/fs/afs/inode.c -index 78efc9719349..d6eed332507f 100644 ---- a/fs/afs/inode.c -+++ b/fs/afs/inode.c -@@ -331,7 +331,7 @@ static void afs_fetch_status_success(struct afs_operation *op) - - if (vnode->netfs.inode.i_state & I_NEW) { - ret = afs_inode_init_from_status(op, vp, vnode); -- op->error = ret; -+ afs_op_set_error(op, ret); - if (ret == 0) - afs_cache_permit(vnode, op->key, vp->cb_break_before, &vp->scb); - } else { -diff --git a/fs/afs/internal.h b/fs/afs/internal.h -index 88381935bd66..1a306df267b0 100644 ---- a/fs/afs/internal.h -+++ b/fs/afs/internal.h -@@ -1140,11 +1140,6 @@ extern bool afs_begin_vnode_operation(struct afs_operation *); - extern void afs_wait_for_operation(struct afs_operation *); - extern int afs_do_sync_operation(struct afs_operation *); - --static inline void afs_op_nomem(struct afs_operation *op) --{ -- op->error = -ENOMEM; --} -- - static inline void afs_op_set_vnode(struct afs_operation *op, unsigned int n, - struct afs_vnode *vnode) - { -@@ -1238,6 +1233,21 @@ static inline void __afs_stat(atomic_t *s) - extern int afs_abort_to_error(u32); - extern void afs_prioritise_error(struct afs_error *, int, u32); - -+static inline void afs_op_nomem(struct afs_operation *op) -+{ -+ op->error = -ENOMEM; -+} -+ -+static inline int afs_op_error(const struct afs_operation *op) -+{ -+ return op->error; -+} -+ -+static inline int afs_op_set_error(struct afs_operation *op, int error) -+{ -+ return op->error = error; -+} -+ - /* - * mntpt.c - */ -diff --git a/fs/afs/rotate.c b/fs/afs/rotate.c -index 4084e023ff43..d64c1d90faed 100644 ---- a/fs/afs/rotate.c -+++ b/fs/afs/rotate.c -@@ -51,7 +51,7 @@ static bool afs_start_fs_iteration(struct afs_operation *op, - * and have to return an error. - */ - if (op->flags & AFS_OPERATION_CUR_ONLY) { -- op->error = -ESTALE; -+ afs_op_set_error(op, -ESTALE); - return false; - } - -@@ -93,7 +93,7 @@ static bool afs_sleep_and_retry(struct afs_operation *op) - if (!(op->flags & AFS_OPERATION_UNINTR)) { - msleep_interruptible(1000); - if (signal_pending(current)) { -- op->error = -ERESTARTSYS; -+ afs_op_set_error(op, -ERESTARTSYS); - return false; - } - } else { -@@ -137,7 +137,7 @@ bool afs_select_fileserver(struct afs_operation *op) - case 0: - default: - /* Success or local failure. Stop. */ -- op->error = error; -+ afs_op_set_error(op, error); - op->flags |= AFS_OPERATION_STOP; - _leave(" = f [okay/local %d]", error); - return false; -@@ -174,11 +174,13 @@ bool afs_select_fileserver(struct afs_operation *op) - - set_bit(AFS_VOLUME_NEEDS_UPDATE, &op->volume->flags); - error = afs_check_volume_status(op->volume, op); -- if (error < 0) -- goto failed_set_error; -+ if (error < 0) { -+ afs_op_set_error(op, error); -+ goto failed; -+ } - - if (test_bit(AFS_VOLUME_DELETED, &op->volume->flags)) { -- op->error = -ENOMEDIUM; -+ afs_op_set_error(op, -ENOMEDIUM); - goto failed; - } - -@@ -250,11 +252,11 @@ bool afs_select_fileserver(struct afs_operation *op) - clear_bit(AFS_VOLUME_BUSY, &op->volume->flags); - } - if (op->flags & AFS_OPERATION_NO_VSLEEP) { -- op->error = -EADV; -+ afs_op_set_error(op, -EADV); - goto failed; - } - if (op->flags & AFS_OPERATION_CUR_ONLY) { -- op->error = -ESTALE; -+ afs_op_set_error(op, -ESTALE); - goto failed; - } - goto busy; -@@ -275,7 +277,7 @@ bool afs_select_fileserver(struct afs_operation *op) - * lock we need to maintain. - */ - if (op->flags & AFS_OPERATION_NO_VSLEEP) { -- op->error = -EBUSY; -+ afs_op_set_error(op, -EBUSY); - goto failed; - } - if (!test_and_set_bit(AFS_VOLUME_BUSY, &op->volume->flags)) { -@@ -304,7 +306,7 @@ bool afs_select_fileserver(struct afs_operation *op) - * honour, just in case someone sets up a loop. - */ - if (op->flags & AFS_OPERATION_VMOVED) { -- op->error = -EREMOTEIO; -+ afs_op_set_error(op, -EREMOTEIO); - goto failed; - } - op->flags |= AFS_OPERATION_VMOVED; -@@ -312,8 +314,10 @@ bool afs_select_fileserver(struct afs_operation *op) - set_bit(AFS_VOLUME_WAIT, &op->volume->flags); - set_bit(AFS_VOLUME_NEEDS_UPDATE, &op->volume->flags); - error = afs_check_volume_status(op->volume, op); -- if (error < 0) -- goto failed_set_error; -+ if (error < 0) { -+ afs_op_set_error(op, error); -+ goto failed; -+ } - - /* If the server list didn't change, then the VLDB is - * out of sync with the fileservers. This is hopefully -@@ -344,7 +348,7 @@ bool afs_select_fileserver(struct afs_operation *op) - * Translate locally and return ENOSPC. - * No replicas to failover to. - */ -- op->error = -ENOSPC; -+ afs_op_set_error(op, -ENOSPC); - goto failed_but_online; - - case VOVERQUOTA: -@@ -353,7 +357,7 @@ bool afs_select_fileserver(struct afs_operation *op) - * Translate locally and return EDQUOT. - * No replicas to failover to. - */ -- op->error = -EDQUOT; -+ afs_op_set_error(op, -EDQUOT); - goto failed_but_online; - - default: -@@ -366,7 +370,7 @@ bool afs_select_fileserver(struct afs_operation *op) - - case -ETIMEDOUT: - case -ETIME: -- if (op->error != -EDESTADDRREQ) -+ if (afs_op_error(op) != -EDESTADDRREQ) - goto iterate_address; - fallthrough; - case -ERFKILL: -@@ -385,7 +389,7 @@ bool afs_select_fileserver(struct afs_operation *op) - fallthrough; - case -ECONNRESET: - _debug("call reset"); -- op->error = error; -+ afs_op_set_error(op, error); - goto failed; - } - -@@ -401,8 +405,10 @@ bool afs_select_fileserver(struct afs_operation *op) - * volume may have moved or even have been deleted. - */ - error = afs_check_volume_status(op->volume, op); -- if (error < 0) -- goto failed_set_error; -+ if (error < 0) { -+ afs_op_set_error(op, error); -+ goto failed; -+ } - - if (!afs_start_fs_iteration(op, vnode)) - goto failed; -@@ -413,8 +419,10 @@ bool afs_select_fileserver(struct afs_operation *op) - _debug("pick [%lx]", op->untried); - - error = afs_wait_for_fs_probes(op->server_list, op->untried); -- if (error < 0) -- goto failed_set_error; -+ if (error < 0) { -+ afs_op_set_error(op, error); -+ goto failed; -+ } - - /* Pick the untried server with the lowest RTT. If we have outstanding - * callbacks, we stick with the server we're already using if we can. -@@ -515,7 +523,8 @@ bool afs_select_fileserver(struct afs_operation *op) - op->flags &= ~AFS_OPERATION_RETRY_SERVER; - goto retry_server; - case -ERESTARTSYS: -- goto failed_set_error; -+ afs_op_set_error(op, error); -+ goto failed; - case -ETIME: - case -EDESTADDRREQ: - goto next_server; -@@ -544,13 +553,11 @@ bool afs_select_fileserver(struct afs_operation *op) - } - - error = e.error; -- --failed_set_error: - op->error = error; - failed: - op->flags |= AFS_OPERATION_STOP; - afs_end_cursor(&op->ac); -- _leave(" = f [failed %d]", op->error); -+ _leave(" = f [failed %d]", afs_op_error(op)); - return false; - } - -diff --git a/fs/afs/server.c b/fs/afs/server.c -index 5b5fa94005c9..2826e6eced71 100644 ---- a/fs/afs/server.c -+++ b/fs/afs/server.c -@@ -629,8 +629,8 @@ static noinline bool afs_update_server_record(struct afs_operation *op, - _leave(" = t [intr]"); - return true; - } -- op->error = PTR_ERR(alist); -- _leave(" = f [%d]", op->error); -+ afs_op_set_error(op, PTR_ERR(alist)); -+ _leave(" = f [%d]", afs_op_error(op)); - return false; - } - -@@ -684,7 +684,7 @@ bool afs_check_server_record(struct afs_operation *op, struct afs_server *server - (op->flags & AFS_OPERATION_UNINTR) ? - TASK_UNINTERRUPTIBLE : TASK_INTERRUPTIBLE); - if (ret == -ERESTARTSYS) { -- op->error = ret; -+ afs_op_set_error(op, ret); - _leave(" = f [intr]"); - return false; - } -diff --git a/fs/afs/write.c b/fs/afs/write.c -index 4a168781936b..9f90d8970ce9 100644 ---- a/fs/afs/write.c -+++ b/fs/afs/write.c -@@ -366,7 +366,7 @@ static void afs_store_data_success(struct afs_operation *op) - - op->ctime = op->file[0].scb.status.mtime_client; - afs_vnode_commit_status(op, &op->file[0]); -- if (op->error == 0) { -+ if (!afs_op_error(op)) { - if (!op->store.laundering) - afs_pages_written_back(vnode, op->store.pos, op->store.size); - afs_stat_v(vnode, n_stores); -@@ -428,7 +428,7 @@ static int afs_store_data(struct afs_vnode *vnode, struct iov_iter *iter, loff_t - - afs_wait_for_operation(op); - -- switch (op->error) { -+ switch (afs_op_error(op)) { - case -EACCES: - case -EPERM: - case -ENOKEY: -@@ -447,7 +447,7 @@ static int afs_store_data(struct afs_vnode *vnode, struct iov_iter *iter, loff_t - } - - afs_put_wb_key(wbk); -- _leave(" = %d", op->error); -+ _leave(" = %d", afs_op_error(op)); - return afs_put_operation(op); - } - --- -2.43.2 - -From bc0a7ccd9ebf5c7d7245c6f560e17b443009a410 Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Thu, 26 Oct 2023 09:54:07 +0100 -Subject: [PATCH 0847/1501] afs: Don't put afs_call in - afs_wait_for_call_to_complete() -Content-Length: 10211 -Lines: 345 - -[ Upstream commit 6f2ff7e89bd05677f4c08fccafcf625ca3e09c1c ] - -Don't put the afs_call struct in afs_wait_for_call_to_complete() but rather -have the caller do it. This will allow the caller to fish stuff out of the -afs_call struct rather than the afs_addr_cursor struct, thereby allowing a -subsequent patch to subsume it. - -Signed-off-by: David Howells <dhowells@redhat.com> -cc: Marc Dionne <marc.dionne@auristor.com> -cc: linux-afs@lists.infradead.org -Stable-dep-of: 17ba6f0bd14f ("afs: Fix error handling with lookup via FS.InlineBulkStatus") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/afs/fs_operation.c | 7 ++-- - fs/afs/fsclient.c | 5 ++- - fs/afs/internal.h | 2 +- - fs/afs/rxrpc.c | 75 ++++++++++++++++--------------------------- - fs/afs/vlclient.c | 64 +++++++++++++++++++++--------------- - 5 files changed, 76 insertions(+), 77 deletions(-) - -diff --git a/fs/afs/fs_operation.c b/fs/afs/fs_operation.c -index bfb9a7634bd9..1c22d6e77846 100644 ---- a/fs/afs/fs_operation.c -+++ b/fs/afs/fs_operation.c -@@ -191,8 +191,11 @@ void afs_wait_for_operation(struct afs_operation *op) - else - op->ac.error = -ENOTSUPP; - -- if (op->call) -- op->error = afs_wait_for_call_to_complete(op->call, &op->ac); -+ if (op->call) { -+ afs_wait_for_call_to_complete(op->call, &op->ac); -+ op->error = op->ac.error; -+ afs_put_call(op->call); -+ } - } - - switch (op->error) { -diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c -index 6821ce0f9d63..020073387111 100644 ---- a/fs/afs/fsclient.c -+++ b/fs/afs/fsclient.c -@@ -1612,6 +1612,7 @@ int afs_fs_give_up_all_callbacks(struct afs_net *net, - { - struct afs_call *call; - __be32 *bp; -+ int ret; - - _enter(""); - -@@ -1627,7 +1628,9 @@ int afs_fs_give_up_all_callbacks(struct afs_net *net, - - call->server = afs_use_server(server, afs_server_trace_give_up_cb); - afs_make_call(ac, call, GFP_NOFS); -- return afs_wait_for_call_to_complete(call, ac); -+ afs_wait_for_call_to_complete(call, ac); -+ afs_put_call(call); -+ return ret; - } - - /* -diff --git a/fs/afs/internal.h b/fs/afs/internal.h -index 1a306df267b0..45c4526b56be 100644 ---- a/fs/afs/internal.h -+++ b/fs/afs/internal.h -@@ -1291,7 +1291,7 @@ extern void __net_exit afs_close_socket(struct afs_net *); - extern void afs_charge_preallocation(struct work_struct *); - extern void afs_put_call(struct afs_call *); - extern void afs_make_call(struct afs_addr_cursor *, struct afs_call *, gfp_t); --extern long afs_wait_for_call_to_complete(struct afs_call *, struct afs_addr_cursor *); -+void afs_wait_for_call_to_complete(struct afs_call *call, struct afs_addr_cursor *ac); - extern struct afs_call *afs_alloc_flat_call(struct afs_net *, - const struct afs_call_type *, - size_t, size_t); -diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c -index 2603db03b7ff..dad8efadbc44 100644 ---- a/fs/afs/rxrpc.c -+++ b/fs/afs/rxrpc.c -@@ -575,48 +575,44 @@ static void afs_deliver_to_call(struct afs_call *call) - /* - * Wait synchronously for a call to complete and clean up the call struct. - */ --long afs_wait_for_call_to_complete(struct afs_call *call, -- struct afs_addr_cursor *ac) -+void afs_wait_for_call_to_complete(struct afs_call *call, struct afs_addr_cursor *ac) - { -- long ret; - bool rxrpc_complete = false; - -- DECLARE_WAITQUEUE(myself, current); -- - _enter(""); - -- ret = call->error; -- if (ret < 0) -- goto out; -+ if (!afs_check_call_state(call, AFS_CALL_COMPLETE)) { -+ DECLARE_WAITQUEUE(myself, current); - -- add_wait_queue(&call->waitq, &myself); -- for (;;) { -- set_current_state(TASK_UNINTERRUPTIBLE); -+ add_wait_queue(&call->waitq, &myself); -+ for (;;) { -+ set_current_state(TASK_UNINTERRUPTIBLE); - -- /* deliver any messages that are in the queue */ -- if (!afs_check_call_state(call, AFS_CALL_COMPLETE) && -- call->need_attention) { -- call->need_attention = false; -- __set_current_state(TASK_RUNNING); -- afs_deliver_to_call(call); -- continue; -+ /* deliver any messages that are in the queue */ -+ if (!afs_check_call_state(call, AFS_CALL_COMPLETE) && -+ call->need_attention) { -+ call->need_attention = false; -+ __set_current_state(TASK_RUNNING); -+ afs_deliver_to_call(call); -+ continue; -+ } -+ -+ if (afs_check_call_state(call, AFS_CALL_COMPLETE)) -+ break; -+ -+ if (!rxrpc_kernel_check_life(call->net->socket, call->rxcall)) { -+ /* rxrpc terminated the call. */ -+ rxrpc_complete = true; -+ break; -+ } -+ -+ schedule(); - } - -- if (afs_check_call_state(call, AFS_CALL_COMPLETE)) -- break; -- -- if (!rxrpc_kernel_check_life(call->net->socket, call->rxcall)) { -- /* rxrpc terminated the call. */ -- rxrpc_complete = true; -- break; -- } -- -- schedule(); -+ remove_wait_queue(&call->waitq, &myself); -+ __set_current_state(TASK_RUNNING); - } - -- remove_wait_queue(&call->waitq, &myself); -- __set_current_state(TASK_RUNNING); -- - if (!afs_check_call_state(call, AFS_CALL_COMPLETE)) { - if (rxrpc_complete) { - afs_set_call_complete(call, call->error, call->abort_code); -@@ -635,23 +631,8 @@ long afs_wait_for_call_to_complete(struct afs_call *call, - ac->error = call->error; - spin_unlock_bh(&call->state_lock); - -- ret = ac->error; -- switch (ret) { -- case 0: -- ret = call->ret0; -- call->ret0 = 0; -- -- fallthrough; -- case -ECONNABORTED: -+ if (call->error == 0 || call->error == -ECONNABORTED) - ac->responded = true; -- break; -- } -- --out: -- _debug("call complete"); -- afs_put_call(call); -- _leave(" = %p", (void *)ret); -- return ret; - } - - /* -diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c -index 41e7932d75c6..650534892a20 100644 ---- a/fs/afs/vlclient.c -+++ b/fs/afs/vlclient.c -@@ -106,12 +106,6 @@ static int afs_deliver_vl_get_entry_by_name_u(struct afs_call *call) - return 0; - } - --static void afs_destroy_vl_get_entry_by_name_u(struct afs_call *call) --{ -- kfree(call->ret_vldb); -- afs_flat_call_destructor(call); --} -- - /* - * VL.GetEntryByNameU operation type. - */ -@@ -119,7 +113,7 @@ static const struct afs_call_type afs_RXVLGetEntryByNameU = { - .name = "VL.GetEntryByNameU", - .op = afs_VL_GetEntryByNameU, - .deliver = afs_deliver_vl_get_entry_by_name_u, -- .destructor = afs_destroy_vl_get_entry_by_name_u, -+ .destructor = afs_flat_call_destructor, - }; - - /* -@@ -166,7 +160,13 @@ struct afs_vldb_entry *afs_vl_get_entry_by_name_u(struct afs_vl_cursor *vc, - - trace_afs_make_vl_call(call); - afs_make_call(&vc->ac, call, GFP_KERNEL); -- return (struct afs_vldb_entry *)afs_wait_for_call_to_complete(call, &vc->ac); -+ afs_wait_for_call_to_complete(call, &vc->ac); -+ afs_put_call(call); -+ if (vc->ac.error) { -+ kfree(entry); -+ return ERR_PTR(vc->ac.error); -+ } -+ return entry; - } - - /* -@@ -249,12 +249,6 @@ static int afs_deliver_vl_get_addrs_u(struct afs_call *call) - return 0; - } - --static void afs_vl_get_addrs_u_destructor(struct afs_call *call) --{ -- afs_put_addrlist(call->ret_alist); -- return afs_flat_call_destructor(call); --} -- - /* - * VL.GetAddrsU operation type. - */ -@@ -262,7 +256,7 @@ static const struct afs_call_type afs_RXVLGetAddrsU = { - .name = "VL.GetAddrsU", - .op = afs_VL_GetAddrsU, - .deliver = afs_deliver_vl_get_addrs_u, -- .destructor = afs_vl_get_addrs_u_destructor, -+ .destructor = afs_flat_call_destructor, - }; - - /* -@@ -273,6 +267,7 @@ struct afs_addr_list *afs_vl_get_addrs_u(struct afs_vl_cursor *vc, - const uuid_t *uuid) - { - struct afs_ListAddrByAttributes__xdr *r; -+ struct afs_addr_list *alist; - const struct afs_uuid *u = (const struct afs_uuid *)uuid; - struct afs_call *call; - struct afs_net *net = vc->cell->net; -@@ -309,7 +304,14 @@ struct afs_addr_list *afs_vl_get_addrs_u(struct afs_vl_cursor *vc, - - trace_afs_make_vl_call(call); - afs_make_call(&vc->ac, call, GFP_KERNEL); -- return (struct afs_addr_list *)afs_wait_for_call_to_complete(call, &vc->ac); -+ afs_wait_for_call_to_complete(call, &vc->ac); -+ alist = call->ret_alist; -+ afs_put_call(call); -+ if (vc->ac.error) { -+ afs_put_addrlist(alist); -+ return ERR_PTR(vc->ac.error); -+ } -+ return alist; - } - - /* -@@ -618,7 +620,7 @@ static const struct afs_call_type afs_YFSVLGetEndpoints = { - .name = "YFSVL.GetEndpoints", - .op = afs_YFSVL_GetEndpoints, - .deliver = afs_deliver_yfsvl_get_endpoints, -- .destructor = afs_vl_get_addrs_u_destructor, -+ .destructor = afs_flat_call_destructor, - }; - - /* -@@ -628,6 +630,7 @@ static const struct afs_call_type afs_YFSVLGetEndpoints = { - struct afs_addr_list *afs_yfsvl_get_endpoints(struct afs_vl_cursor *vc, - const uuid_t *uuid) - { -+ struct afs_addr_list *alist; - struct afs_call *call; - struct afs_net *net = vc->cell->net; - __be32 *bp; -@@ -652,7 +655,14 @@ struct afs_addr_list *afs_yfsvl_get_endpoints(struct afs_vl_cursor *vc, - - trace_afs_make_vl_call(call); - afs_make_call(&vc->ac, call, GFP_KERNEL); -- return (struct afs_addr_list *)afs_wait_for_call_to_complete(call, &vc->ac); -+ afs_wait_for_call_to_complete(call, &vc->ac); -+ alist = call->ret_alist; -+ afs_put_call(call); -+ if (vc->ac.error) { -+ afs_put_addrlist(alist); -+ return ERR_PTR(vc->ac.error); -+ } -+ return alist; - } - - /* -@@ -717,12 +727,6 @@ static int afs_deliver_yfsvl_get_cell_name(struct afs_call *call) - return 0; - } - --static void afs_destroy_yfsvl_get_cell_name(struct afs_call *call) --{ -- kfree(call->ret_str); -- afs_flat_call_destructor(call); --} -- - /* - * VL.GetCapabilities operation type - */ -@@ -730,7 +734,7 @@ static const struct afs_call_type afs_YFSVLGetCellName = { - .name = "YFSVL.GetCellName", - .op = afs_YFSVL_GetCellName, - .deliver = afs_deliver_yfsvl_get_cell_name, -- .destructor = afs_destroy_yfsvl_get_cell_name, -+ .destructor = afs_flat_call_destructor, - }; - - /* -@@ -745,6 +749,7 @@ char *afs_yfsvl_get_cell_name(struct afs_vl_cursor *vc) - struct afs_call *call; - struct afs_net *net = vc->cell->net; - __be32 *bp; -+ char *cellname; - - _enter(""); - -@@ -763,5 +768,12 @@ char *afs_yfsvl_get_cell_name(struct afs_vl_cursor *vc) - /* Can't take a ref on server */ - trace_afs_make_vl_call(call); - afs_make_call(&vc->ac, call, GFP_KERNEL); -- return (char *)afs_wait_for_call_to_complete(call, &vc->ac); -+ afs_wait_for_call_to_complete(call, &vc->ac); -+ cellname = call->ret_str; -+ afs_put_call(call); -+ if (vc->ac.error) { -+ kfree(cellname); -+ return ERR_PTR(vc->ac.error); -+ } -+ return cellname; - } --- -2.43.2 - -From ca8e060fd4cb11d174fb67c1af0f6d5d4b78c5f6 Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Wed, 25 Oct 2023 17:53:33 +0100 -Subject: [PATCH 0848/1501] afs: Simplify error handling -Content-Length: 33057 -Lines: 1020 - -[ Upstream commit aa453becce5d1ae1b94b7fc22f47d7b05d22b14e ] - -Simplify error handling a bit by moving it from the afs_addr_cursor struct -to the afs_operation and afs_vl_cursor structs and using the error -prioritisation function for accumulating errors from multiple sources (AFS -tries to rotate between multiple fileservers, some of which may be -inaccessible or in some state of offlinedness). - -Signed-off-by: David Howells <dhowells@redhat.com> -cc: Marc Dionne <marc.dionne@auristor.com> -cc: linux-afs@lists.infradead.org -Stable-dep-of: 17ba6f0bd14f ("afs: Fix error handling with lookup via FS.InlineBulkStatus") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/afs/addr_list.c | 8 ++-- - fs/afs/dir.c | 14 ++++--- - fs/afs/dir_silly.c | 2 +- - fs/afs/file.c | 3 -- - fs/afs/fs_operation.c | 24 +++++------ - fs/afs/fsclient.c | 1 + - fs/afs/internal.h | 44 +++++++++++++++------ - fs/afs/misc.c | 10 ++++- - fs/afs/rotate.c | 58 ++++++++++++++------------- - fs/afs/rxrpc.c | 17 ++++---- - fs/afs/server.c | 1 - - fs/afs/vl_alias.c | 2 +- - fs/afs/vl_probe.c | 7 ++-- - fs/afs/vl_rotate.c | 92 +++++++++++++++++++++---------------------- - fs/afs/vlclient.c | 34 ++++++++++------ - 15 files changed, 174 insertions(+), 143 deletions(-) - -diff --git a/fs/afs/addr_list.c b/fs/afs/addr_list.c -index 519821f5aedc..f4837c3b8ae2 100644 ---- a/fs/afs/addr_list.c -+++ b/fs/afs/addr_list.c -@@ -386,26 +386,24 @@ bool afs_iterate_addresses(struct afs_addr_cursor *ac) - selected: - ac->index = index; - set_bit(index, &ac->tried); -- ac->responded = false; -+ ac->call_responded = false; - return true; - } - - /* - * Release an address list cursor. - */ --int afs_end_cursor(struct afs_addr_cursor *ac) -+void afs_end_cursor(struct afs_addr_cursor *ac) - { - struct afs_addr_list *alist; - - alist = ac->alist; - if (alist) { -- if (ac->responded && -+ if (ac->call_responded && - ac->index != alist->preferred && - test_bit(ac->alist->preferred, &ac->tried)) - WRITE_ONCE(alist->preferred, ac->index); - afs_put_addrlist(alist); - ac->alist = NULL; - } -- -- return ac->error; - } -diff --git a/fs/afs/dir.c b/fs/afs/dir.c -index 15763418a938..75896a677b96 100644 ---- a/fs/afs/dir.c -+++ b/fs/afs/dir.c -@@ -701,8 +701,9 @@ static void afs_do_lookup_success(struct afs_operation *op) - vp = &op->file[0]; - abort_code = vp->scb.status.abort_code; - if (abort_code != 0) { -- op->ac.abort_code = abort_code; -- op->error = afs_abort_to_error(abort_code); -+ op->call_abort_code = abort_code; -+ afs_op_set_error(op, afs_abort_to_error(abort_code)); -+ op->cumul_error.abort_code = abort_code; - } - break; - -@@ -854,13 +855,14 @@ static struct inode *afs_do_lookup(struct inode *dir, struct dentry *dentry, - _debug("nr_files %u", op->nr_files); - - /* Need space for examining all the selected files */ -- op->error = -ENOMEM; - if (op->nr_files > 2) { - op->more_files = kvcalloc(op->nr_files - 2, - sizeof(struct afs_vnode_param), - GFP_KERNEL); -- if (!op->more_files) -+ if (!op->more_files) { -+ afs_op_nomem(op); - goto out_op; -+ } - - for (i = 2; i < op->nr_files; i++) { - vp = &op->more_files[i - 2]; -@@ -1263,7 +1265,7 @@ void afs_check_for_remote_deletion(struct afs_operation *op) - { - struct afs_vnode *vnode = op->file[0].vnode; - -- switch (op->ac.abort_code) { -+ switch (afs_op_abort_code(op)) { - case VNOVNODE: - set_bit(AFS_VNODE_DELETED, &vnode->flags); - afs_break_callback(vnode, afs_cb_break_for_deleted); -@@ -1288,7 +1290,7 @@ static void afs_vnode_new_inode(struct afs_operation *op) - /* ENOMEM or EINTR at a really inconvenient time - just abandon - * the new directory on the server. - */ -- op->error = PTR_ERR(inode); -+ afs_op_accumulate_error(op, PTR_ERR(inode), 0); - return; - } - -diff --git a/fs/afs/dir_silly.c b/fs/afs/dir_silly.c -index bb5807e87fa4..a1e581946b93 100644 ---- a/fs/afs/dir_silly.c -+++ b/fs/afs/dir_silly.c -@@ -218,7 +218,7 @@ static int afs_do_silly_unlink(struct afs_vnode *dvnode, struct afs_vnode *vnode - /* If there was a conflict with a third party, check the status of the - * unlinked vnode. - */ -- if (op->error == 0 && (op->flags & AFS_OPERATION_DIR_CONFLICT)) { -+ if (op->cumul_error.error == 0 && (op->flags & AFS_OPERATION_DIR_CONFLICT)) { - op->file[1].update_ctime = false; - op->fetch_status.which = 1; - op->ops = &afs_fetch_status_operation; -diff --git a/fs/afs/file.c b/fs/afs/file.c -index 0c81c39c32f5..8f9b42427569 100644 ---- a/fs/afs/file.c -+++ b/fs/afs/file.c -@@ -245,10 +245,7 @@ static void afs_fetch_data_notify(struct afs_operation *op) - struct netfs_io_subrequest *subreq = req->subreq; - int error = afs_op_error(op); - -- if (error == -ECONNABORTED) -- error = afs_abort_to_error(op->ac.abort_code); - req->error = error; -- - if (subreq) { - __set_bit(NETFS_SREQ_CLEAR_TAIL, &subreq->flags); - netfs_subreq_terminated(subreq, error ?: req->actual_len, false); -diff --git a/fs/afs/fs_operation.c b/fs/afs/fs_operation.c -index 1c22d6e77846..cebe4fad8192 100644 ---- a/fs/afs/fs_operation.c -+++ b/fs/afs/fs_operation.c -@@ -169,9 +169,6 @@ static void afs_end_vnode_operation(struct afs_operation *op) - } - - afs_drop_io_locks(op); -- -- if (op->error == -ECONNABORTED) -- op->error = afs_abort_to_error(op->ac.abort_code); - } - - /* -@@ -182,6 +179,8 @@ void afs_wait_for_operation(struct afs_operation *op) - _enter(""); - - while (afs_select_fileserver(op)) { -+ op->call_error = 0; -+ op->call_abort_code = 0; - op->cb_s_break = op->server->cb_s_break; - if (test_bit(AFS_SERVER_FL_IS_YFS, &op->server->flags) && - op->ops->issue_yfs_rpc) -@@ -189,28 +188,29 @@ void afs_wait_for_operation(struct afs_operation *op) - else if (op->ops->issue_afs_rpc) - op->ops->issue_afs_rpc(op); - else -- op->ac.error = -ENOTSUPP; -+ op->call_error = -ENOTSUPP; - - if (op->call) { - afs_wait_for_call_to_complete(op->call, &op->ac); -- op->error = op->ac.error; -+ op->call_abort_code = op->call->abort_code; -+ op->call_error = op->call->error; -+ op->call_responded = op->call->responded; -+ op->ac.call_responded = true; -+ WRITE_ONCE(op->ac.alist->addrs[op->ac.index].last_error, -+ op->call_error); - afs_put_call(op->call); - } - } - -- switch (op->error) { -- case 0: -+ if (!afs_op_error(op)) { - _debug("success"); - op->ops->success(op); -- break; -- case -ECONNABORTED: -+ } else if (op->cumul_error.aborted) { - if (op->ops->aborted) - op->ops->aborted(op); -- fallthrough; -- default: -+ } else { - if (op->ops->failed) - op->ops->failed(op); -- break; - } - - afs_end_vnode_operation(op); -diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c -index 020073387111..2a56dea22519 100644 ---- a/fs/afs/fsclient.c -+++ b/fs/afs/fsclient.c -@@ -1629,6 +1629,7 @@ int afs_fs_give_up_all_callbacks(struct afs_net *net, - call->server = afs_use_server(server, afs_server_trace_give_up_cb); - afs_make_call(ac, call, GFP_NOFS); - afs_wait_for_call_to_complete(call, ac); -+ ret = call->error; - afs_put_call(call); - return ret; - } -diff --git a/fs/afs/internal.h b/fs/afs/internal.h -index 45c4526b56be..5f6db0ac06ac 100644 ---- a/fs/afs/internal.h -+++ b/fs/afs/internal.h -@@ -75,6 +75,7 @@ enum afs_call_state { - struct afs_address { - struct rxrpc_peer *peer; - u16 service_id; -+ short last_error; /* Last error from this address */ - }; - - /* -@@ -121,7 +122,6 @@ struct afs_call { - }; - void *buffer; /* reply receive buffer */ - union { -- long ret0; /* Value to reply with instead of 0 */ - struct afs_addr_list *ret_alist; - struct afs_vldb_entry *ret_vldb; - char *ret_str; -@@ -145,6 +145,7 @@ struct afs_call { - bool upgrade; /* T to request service upgrade */ - bool intr; /* T if interruptible */ - bool unmarshalling_error; /* T if an unmarshalling error occurred */ -+ bool responded; /* Got a response from the call (may be abort) */ - u16 service_id; /* Actual service ID (after upgrade) */ - unsigned int debug_id; /* Trace ID */ - u32 operation_ID; /* operation ID for an incoming call */ -@@ -719,8 +720,10 @@ struct afs_permits { - * Error prioritisation and accumulation. - */ - struct afs_error { -- short error; /* Accumulated error */ -+ s32 abort_code; /* Cumulative abort code */ -+ short error; /* Cumulative error */ - bool responded; /* T if server responded */ -+ bool aborted; /* T if ->error is from an abort */ - }; - - /* -@@ -730,10 +733,8 @@ struct afs_addr_cursor { - struct afs_addr_list *alist; /* Current address list (pins ref) */ - unsigned long tried; /* Tried addresses */ - signed char index; /* Current address */ -- bool responded; /* T if the current address responded */ - unsigned short nr_iterations; /* Number of address iterations */ -- short error; -- u32 abort_code; -+ bool call_responded; - }; - - /* -@@ -746,13 +747,16 @@ struct afs_vl_cursor { - struct afs_vlserver *server; /* Server on which this resides */ - struct key *key; /* Key for the server */ - unsigned long untried; /* Bitmask of untried servers */ -+ struct afs_error cumul_error; /* Cumulative error */ -+ s32 call_abort_code; - short index; /* Current server */ -- short error; -+ short call_error; /* Error from single call */ - unsigned short flags; - #define AFS_VL_CURSOR_STOP 0x0001 /* Set to cease iteration */ - #define AFS_VL_CURSOR_RETRY 0x0002 /* Set to do a retry */ - #define AFS_VL_CURSOR_RETRIED 0x0004 /* Set if started a retry */ -- unsigned short nr_iterations; /* Number of server iterations */ -+ short nr_iterations; /* Number of server iterations */ -+ bool call_responded; /* T if the current address responded */ - }; - - /* -@@ -803,8 +807,10 @@ struct afs_operation { - struct dentry *dentry_2; /* Second dentry to be altered */ - struct timespec64 mtime; /* Modification time to record */ - struct timespec64 ctime; /* Change time to set */ -+ struct afs_error cumul_error; /* Cumulative error */ - short nr_files; /* Number of entries in file[], more_files */ -- short error; -+ short call_error; /* Error from single call */ -+ s32 call_abort_code; /* Abort code from single call */ - unsigned int debug_id; - - unsigned int cb_v_break; /* Volume break counter before op */ -@@ -860,6 +866,8 @@ struct afs_operation { - unsigned long untried; /* Bitmask of untried servers */ - short index; /* Current server */ - short nr_iterations; /* Number of server iterations */ -+ bool call_responded; /* T if the current address responded */ -+ - - unsigned int flags; - #define AFS_OPERATION_STOP 0x0001 /* Set to cease iteration */ -@@ -976,7 +984,7 @@ bool afs_addr_list_same(const struct afs_addr_list *a, - const struct afs_addr_list *b); - extern struct afs_vlserver_list *afs_dns_query(struct afs_cell *, time64_t *); - extern bool afs_iterate_addresses(struct afs_addr_cursor *); --extern int afs_end_cursor(struct afs_addr_cursor *); -+extern void afs_end_cursor(struct afs_addr_cursor *ac); - - extern int afs_merge_fs_addr4(struct afs_net *net, struct afs_addr_list *addr, - __be32 xdr, u16 port); -@@ -1235,17 +1243,27 @@ extern void afs_prioritise_error(struct afs_error *, int, u32); - - static inline void afs_op_nomem(struct afs_operation *op) - { -- op->error = -ENOMEM; -+ op->cumul_error.error = -ENOMEM; - } - - static inline int afs_op_error(const struct afs_operation *op) - { -- return op->error; -+ return op->cumul_error.error; -+} -+ -+static inline s32 afs_op_abort_code(const struct afs_operation *op) -+{ -+ return op->cumul_error.abort_code; - } - - static inline int afs_op_set_error(struct afs_operation *op, int error) - { -- return op->error = error; -+ return op->cumul_error.error = error; -+} -+ -+static inline void afs_op_accumulate_error(struct afs_operation *op, int error, s32 abort_code) -+{ -+ afs_prioritise_error(&op->cumul_error, error, abort_code); - } - - /* -@@ -1619,7 +1637,7 @@ static inline void afs_update_dentry_version(struct afs_operation *op, - struct afs_vnode_param *dir_vp, - struct dentry *dentry) - { -- if (!op->error) -+ if (!op->cumul_error.error) - dentry->d_fsdata = - (void *)(unsigned long)dir_vp->scb.status.data_version; - } -diff --git a/fs/afs/misc.c b/fs/afs/misc.c -index 805328ca5428..b8180bf2281f 100644 ---- a/fs/afs/misc.c -+++ b/fs/afs/misc.c -@@ -116,6 +116,8 @@ void afs_prioritise_error(struct afs_error *e, int error, u32 abort_code) - { - switch (error) { - case 0: -+ e->aborted = false; -+ e->error = 0; - return; - default: - if (e->error == -ETIMEDOUT || -@@ -161,12 +163,16 @@ void afs_prioritise_error(struct afs_error *e, int error, u32 abort_code) - if (e->responded) - return; - e->error = error; -+ e->aborted = false; - return; - - case -ECONNABORTED: -- error = afs_abort_to_error(abort_code); -- fallthrough; -+ e->error = afs_abort_to_error(abort_code); -+ e->aborted = true; -+ e->responded = true; -+ return; - case -ENETRESET: /* Responded, but we seem to have changed address */ -+ e->aborted = false; - e->responded = true; - e->error = error; - return; -diff --git a/fs/afs/rotate.c b/fs/afs/rotate.c -index d64c1d90faed..68c88e3a0916 100644 ---- a/fs/afs/rotate.c -+++ b/fs/afs/rotate.c -@@ -112,9 +112,9 @@ bool afs_select_fileserver(struct afs_operation *op) - struct afs_addr_list *alist; - struct afs_server *server; - struct afs_vnode *vnode = op->file[0].vnode; -- struct afs_error e; - unsigned int rtt; -- int error = op->ac.error, i; -+ s32 abort_code = op->call_abort_code; -+ int error = op->call_error, i; - - op->nr_iterations++; - -@@ -122,7 +122,7 @@ bool afs_select_fileserver(struct afs_operation *op) - op->debug_id, op->nr_iterations, op->volume->vid, - op->untried, op->index, - op->ac.tried, op->ac.index, -- error, op->ac.abort_code); -+ error, abort_code); - - if (op->flags & AFS_OPERATION_STOP) { - _leave(" = f [stopped]"); -@@ -133,8 +133,10 @@ bool afs_select_fileserver(struct afs_operation *op) - goto start; - - /* Evaluate the result of the previous operation, if there was one. */ -- switch (error) { -+ switch (op->call_error) { - case 0: -+ op->cumul_error.responded = true; -+ fallthrough; - default: - /* Success or local failure. Stop. */ - afs_op_set_error(op, error); -@@ -151,7 +153,8 @@ bool afs_select_fileserver(struct afs_operation *op) - * errors instead. IBM AFS and OpenAFS fileservers, however, do leak - * these abort codes. - */ -- switch (op->ac.abort_code) { -+ op->cumul_error.responded = true; -+ switch (abort_code) { - case VNOVOL: - /* This fileserver doesn't know about the volume. - * - May indicate that the VL is wrong - retry once and compare -@@ -164,7 +167,7 @@ bool afs_select_fileserver(struct afs_operation *op) - * (administrative action). - */ - if (op->flags & AFS_OPERATION_VNOVOL) { -- op->error = -EREMOTEIO; -+ afs_op_accumulate_error(op, -EREMOTEIO, abort_code); - goto next_server; - } - -@@ -188,7 +191,7 @@ bool afs_select_fileserver(struct afs_operation *op) - * it's the fileserver having trouble. - */ - if (rcu_access_pointer(op->volume->servers) == op->server_list) { -- op->error = -EREMOTEIO; -+ afs_op_accumulate_error(op, -EREMOTEIO, abort_code); - goto next_server; - } - -@@ -201,8 +204,8 @@ bool afs_select_fileserver(struct afs_operation *op) - case VONLINE: - /* These should not be returned from the fileserver. */ - pr_warn("Fileserver returned unexpected abort %d\n", -- op->ac.abort_code); -- op->error = -EREMOTEIO; -+ abort_code); -+ afs_op_accumulate_error(op, -EREMOTEIO, abort_code); - goto next_server; - - case VNOSERVICE: -@@ -233,7 +236,7 @@ bool afs_select_fileserver(struct afs_operation *op) - * VNOSERVICE should be treated as an alias for RX_CALL_TIMEOUT. - */ - case RX_CALL_TIMEOUT: -- op->error = -ETIMEDOUT; -+ afs_op_accumulate_error(op, -ETIMEDOUT, abort_code); - goto next_server; - - case VSALVAGING: /* This error should not be leaked to cache managers -@@ -248,7 +251,7 @@ bool afs_select_fileserver(struct afs_operation *op) - * days). - */ - if (!test_and_set_bit(AFS_VOLUME_OFFLINE, &op->volume->flags)) { -- afs_busy(op->volume, op->ac.abort_code); -+ afs_busy(op->volume, abort_code); - clear_bit(AFS_VOLUME_BUSY, &op->volume->flags); - } - if (op->flags & AFS_OPERATION_NO_VSLEEP) { -@@ -281,7 +284,7 @@ bool afs_select_fileserver(struct afs_operation *op) - goto failed; - } - if (!test_and_set_bit(AFS_VOLUME_BUSY, &op->volume->flags)) { -- afs_busy(op->volume, op->ac.abort_code); -+ afs_busy(op->volume, abort_code); - clear_bit(AFS_VOLUME_OFFLINE, &op->volume->flags); - } - busy: -@@ -329,7 +332,7 @@ bool afs_select_fileserver(struct afs_operation *op) - * TODO: Retry a few times with sleeps. - */ - if (rcu_access_pointer(op->volume->servers) == op->server_list) { -- op->error = -ENOMEDIUM; -+ afs_op_accumulate_error(op, -ENOMEDIUM, abort_code); - goto failed; - } - -@@ -337,7 +340,7 @@ bool afs_select_fileserver(struct afs_operation *op) - - case UAEIO: - case VIO: -- op->error = -EREMOTEIO; -+ afs_op_accumulate_error(op, -EREMOTEIO, abort_code); - if (op->volume->type != AFSVL_RWVOL) - goto next_server; - goto failed; -@@ -361,7 +364,7 @@ bool afs_select_fileserver(struct afs_operation *op) - goto failed_but_online; - - default: -- op->error = afs_abort_to_error(op->ac.abort_code); -+ afs_op_accumulate_error(op, error, abort_code); - failed_but_online: - clear_bit(AFS_VOLUME_OFFLINE, &op->volume->flags); - clear_bit(AFS_VOLUME_BUSY, &op->volume->flags); -@@ -380,7 +383,7 @@ bool afs_select_fileserver(struct afs_operation *op) - case -EHOSTDOWN: - case -ECONNREFUSED: - _debug("no conn"); -- op->error = error; -+ afs_op_accumulate_error(op, error, 0); - goto iterate_address; - - case -ENETRESET: -@@ -506,6 +509,7 @@ bool afs_select_fileserver(struct afs_operation *op) - op->index, op->ac.index, op->ac.alist->nr_addrs, - rxrpc_kernel_remote_addr(op->ac.alist->addrs[op->ac.index].peer)); - -+ op->call_responded = false; - _leave(" = t"); - return true; - -@@ -543,17 +547,14 @@ bool afs_select_fileserver(struct afs_operation *op) - if (op->flags & AFS_OPERATION_VBUSY) - goto restart_from_beginning; - -- e.error = -EDESTADDRREQ; -- e.responded = false; - for (i = 0; i < op->server_list->nr_servers; i++) { - struct afs_server *s = op->server_list->servers[i].server; - -- afs_prioritise_error(&e, READ_ONCE(s->probe.error), -- s->probe.abort_code); -+ error = READ_ONCE(s->probe.error); -+ if (error < 0) -+ afs_op_accumulate_error(op, error, s->probe.abort_code); - } - -- error = e.error; -- op->error = error; - failed: - op->flags |= AFS_OPERATION_STOP; - afs_end_cursor(&op->ac); -@@ -576,11 +577,13 @@ void afs_dump_edestaddrreq(const struct afs_operation *op) - rcu_read_lock(); - - pr_notice("EDESTADDR occurred\n"); -- pr_notice("FC: cbb=%x cbb2=%x fl=%x err=%hd\n", -+ pr_notice("OP: cbb=%x cbb2=%x fl=%x err=%hd\n", - op->file[0].cb_break_before, -- op->file[1].cb_break_before, op->flags, op->error); -- pr_notice("FC: ut=%lx ix=%d ni=%u\n", -+ op->file[1].cb_break_before, op->flags, op->cumul_error.error); -+ pr_notice("OP: ut=%lx ix=%d ni=%u\n", - op->untried, op->index, op->nr_iterations); -+ pr_notice("OP: call er=%d ac=%d r=%u\n", -+ op->call_error, op->call_abort_code, op->call_responded); - - if (op->server_list) { - const struct afs_server_list *sl = op->server_list; -@@ -605,8 +608,7 @@ void afs_dump_edestaddrreq(const struct afs_operation *op) - } - } - -- pr_notice("AC: t=%lx ax=%u ac=%d er=%d r=%u ni=%u\n", -- op->ac.tried, op->ac.index, op->ac.abort_code, op->ac.error, -- op->ac.responded, op->ac.nr_iterations); -+ pr_notice("AC: t=%lx ax=%u ni=%u\n", -+ op->ac.tried, op->ac.index, op->ac.nr_iterations); - rcu_read_unlock(); - } -diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c -index dad8efadbc44..0b3e2f20b0e0 100644 ---- a/fs/afs/rxrpc.c -+++ b/fs/afs/rxrpc.c -@@ -408,8 +408,7 @@ void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp) - rxrpc_kernel_recv_data(call->net->socket, rxcall, - &msg.msg_iter, &len, false, - &call->abort_code, &call->service_id); -- ac->abort_code = call->abort_code; -- ac->responded = true; -+ call->responded = true; - } - call->error = ret; - trace_afs_call_done(call); -@@ -429,7 +428,7 @@ void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp) - afs_set_call_complete(call, ret, 0); - } - -- ac->error = ret; -+ call->error = ret; - call->state = AFS_CALL_COMPLETE; - _leave(" = %d", ret); - } -@@ -510,6 +509,7 @@ static void afs_deliver_to_call(struct afs_call *call) - ret = -EBADMSG; - switch (ret) { - case 0: -+ call->responded = true; - afs_queue_call_work(call); - if (state == AFS_CALL_CL_PROC_REPLY) { - if (call->op) -@@ -524,9 +524,11 @@ static void afs_deliver_to_call(struct afs_call *call) - goto out; - case -ECONNABORTED: - ASSERTCMP(state, ==, AFS_CALL_COMPLETE); -+ call->responded = true; - afs_log_error(call, call->abort_code); - goto done; - case -ENOTSUPP: -+ call->responded = true; - abort_code = RXGEN_OPCODE; - rxrpc_kernel_abort_call(call->net->socket, call->rxcall, - abort_code, ret, -@@ -573,7 +575,7 @@ static void afs_deliver_to_call(struct afs_call *call) - } - - /* -- * Wait synchronously for a call to complete and clean up the call struct. -+ * Wait synchronously for a call to complete. - */ - void afs_wait_for_call_to_complete(struct afs_call *call, struct afs_addr_cursor *ac) - { -@@ -626,13 +628,8 @@ void afs_wait_for_call_to_complete(struct afs_call *call, struct afs_addr_cursor - } - } - -- spin_lock_bh(&call->state_lock); -- ac->abort_code = call->abort_code; -- ac->error = call->error; -- spin_unlock_bh(&call->state_lock); -- - if (call->error == 0 || call->error == -ECONNABORTED) -- ac->responded = true; -+ call->responded = true; - } - - /* -diff --git a/fs/afs/server.c b/fs/afs/server.c -index 2826e6eced71..f7791ef13618 100644 ---- a/fs/afs/server.c -+++ b/fs/afs/server.c -@@ -437,7 +437,6 @@ static void afs_give_up_callbacks(struct afs_net *net, struct afs_server *server - struct afs_addr_cursor ac = { - .alist = alist, - .index = alist->preferred, -- .error = 0, - }; - - afs_fs_give_up_all_callbacks(net, server, &ac, NULL); -diff --git a/fs/afs/vl_alias.c b/fs/afs/vl_alias.c -index 6fdf9f1bedc0..89cadd9a69e1 100644 ---- a/fs/afs/vl_alias.c -+++ b/fs/afs/vl_alias.c -@@ -236,7 +236,7 @@ static char *afs_vl_get_cell_name(struct afs_cell *cell, struct key *key) - - while (afs_select_vlserver(&vc)) { - if (!test_bit(AFS_VLSERVER_FL_IS_YFS, &vc.server->flags)) { -- vc.ac.error = -EOPNOTSUPP; -+ vc.call_error = -EOPNOTSUPP; - skipped = true; - continue; - } -diff --git a/fs/afs/vl_probe.c b/fs/afs/vl_probe.c -index 9551aef07cee..2f8a13c2bf0c 100644 ---- a/fs/afs/vl_probe.c -+++ b/fs/afs/vl_probe.c -@@ -169,10 +169,11 @@ static bool afs_do_probe_vlserver(struct afs_net *net, - call = afs_vl_get_capabilities(net, &ac, key, server, - server_index); - if (!IS_ERR(call)) { -+ afs_prioritise_error(_e, call->error, call->abort_code); - afs_put_call(call); - in_progress = true; - } else { -- afs_prioritise_error(_e, PTR_ERR(call), ac.abort_code); -+ afs_prioritise_error(_e, PTR_ERR(call), 0); - afs_done_one_vl_probe(server, false); - } - } -@@ -187,12 +188,10 @@ int afs_send_vl_probes(struct afs_net *net, struct key *key, - struct afs_vlserver_list *vllist) - { - struct afs_vlserver *server; -- struct afs_error e; -+ struct afs_error e = {}; - bool in_progress = false; - int i; - -- e.error = 0; -- e.responded = false; - for (i = 0; i < vllist->nr_servers; i++) { - server = vllist->servers[i].server; - if (test_bit(AFS_VLSERVER_FL_PROBED, &server->flags)) -diff --git a/fs/afs/vl_rotate.c b/fs/afs/vl_rotate.c -index f8f255c966ae..e2dc54082a05 100644 ---- a/fs/afs/vl_rotate.c -+++ b/fs/afs/vl_rotate.c -@@ -20,11 +20,11 @@ bool afs_begin_vlserver_operation(struct afs_vl_cursor *vc, struct afs_cell *cel - memset(vc, 0, sizeof(*vc)); - vc->cell = cell; - vc->key = key; -- vc->error = -EDESTADDRREQ; -- vc->ac.error = SHRT_MAX; -+ vc->cumul_error.error = -EDESTADDRREQ; -+ vc->nr_iterations = -1; - - if (signal_pending(current)) { -- vc->error = -EINTR; -+ vc->cumul_error.error = -EINTR; - vc->flags |= AFS_VL_CURSOR_STOP; - return false; - } -@@ -52,7 +52,7 @@ static bool afs_start_vl_iteration(struct afs_vl_cursor *vc) - &cell->dns_lookup_count, - smp_load_acquire(&cell->dns_lookup_count) - != dns_lookup_count) < 0) { -- vc->error = -ERESTARTSYS; -+ vc->cumul_error.error = -ERESTARTSYS; - return false; - } - } -@@ -60,12 +60,12 @@ static bool afs_start_vl_iteration(struct afs_vl_cursor *vc) - /* Status load is ordered after lookup counter load */ - if (cell->dns_status == DNS_LOOKUP_GOT_NOT_FOUND) { - pr_warn("No record of cell %s\n", cell->name); -- vc->error = -ENOENT; -+ vc->cumul_error.error = -ENOENT; - return false; - } - - if (cell->dns_source == DNS_RECORD_UNAVAILABLE) { -- vc->error = -EDESTADDRREQ; -+ vc->cumul_error.error = -EDESTADDRREQ; - return false; - } - } -@@ -91,52 +91,52 @@ bool afs_select_vlserver(struct afs_vl_cursor *vc) - { - struct afs_addr_list *alist; - struct afs_vlserver *vlserver; -- struct afs_error e; - unsigned int rtt; -- int error = vc->ac.error, i; -+ s32 abort_code = vc->call_abort_code; -+ int error = vc->call_error, i; -+ -+ vc->nr_iterations++; - - _enter("%lx[%d],%lx[%d],%d,%d", - vc->untried, vc->index, - vc->ac.tried, vc->ac.index, -- error, vc->ac.abort_code); -+ error, abort_code); - - if (vc->flags & AFS_VL_CURSOR_STOP) { - _leave(" = f [stopped]"); - return false; - } - -- vc->nr_iterations++; -+ if (vc->nr_iterations == 0) -+ goto start; - - /* Evaluate the result of the previous operation, if there was one. */ - switch (error) { -- case SHRT_MAX: -- goto start; -- - default: - case 0: - /* Success or local failure. Stop. */ -- vc->error = error; -+ vc->cumul_error.error = error; - vc->flags |= AFS_VL_CURSOR_STOP; -- _leave(" = f [okay/local %d]", vc->ac.error); -+ _leave(" = f [okay/local %d]", vc->cumul_error.error); - return false; - - case -ECONNABORTED: - /* The far side rejected the operation on some grounds. This - * might involve the server being busy or the volume having been moved. - */ -- switch (vc->ac.abort_code) { -+ switch (abort_code) { - case AFSVL_IO: - case AFSVL_BADVOLOPER: - case AFSVL_NOMEM: - /* The server went weird. */ -- vc->error = -EREMOTEIO; -+ afs_prioritise_error(&vc->cumul_error, -EREMOTEIO, abort_code); - //write_lock(&vc->cell->vl_servers_lock); - //vc->server_list->weird_mask |= 1 << vc->index; - //write_unlock(&vc->cell->vl_servers_lock); - goto next_server; - - default: -- vc->error = afs_abort_to_error(vc->ac.abort_code); -+ afs_prioritise_error(&vc->cumul_error, error, abort_code); - goto failed; - } - -@@ -149,12 +149,12 @@ bool afs_select_vlserver(struct afs_vl_cursor *vc) - case -ETIMEDOUT: - case -ETIME: - _debug("no conn %d", error); -- vc->error = error; -+ afs_prioritise_error(&vc->cumul_error, error, 0); - goto iterate_address; - - case -ECONNRESET: - _debug("call reset"); -- vc->error = error; -+ afs_prioritise_error(&vc->cumul_error, error, 0); - vc->flags |= AFS_VL_CURSOR_RETRY; - goto next_server; - -@@ -178,15 +178,19 @@ bool afs_select_vlserver(struct afs_vl_cursor *vc) - goto failed; - - error = afs_send_vl_probes(vc->cell->net, vc->key, vc->server_list); -- if (error < 0) -- goto failed_set_error; -+ if (error < 0) { -+ afs_prioritise_error(&vc->cumul_error, error, 0); -+ goto failed; -+ } - - pick_server: - _debug("pick [%lx]", vc->untried); - - error = afs_wait_for_vl_probes(vc->server_list, vc->untried); -- if (error < 0) -- goto failed_set_error; -+ if (error < 0) { -+ afs_prioritise_error(&vc->cumul_error, error, 0); -+ goto failed; -+ } - - /* Pick the untried server with the lowest RTT. */ - vc->index = vc->server_list->preferred; -@@ -249,6 +253,7 @@ bool afs_select_vlserver(struct afs_vl_cursor *vc) - - _debug("VL address %d/%d", vc->ac.index, vc->ac.alist->nr_addrs); - -+ vc->call_responded = false; - _leave(" = t %pISpc", rxrpc_kernel_remote_addr(vc->ac.alist->addrs[vc->ac.index].peer)); - return true; - -@@ -264,25 +269,19 @@ bool afs_select_vlserver(struct afs_vl_cursor *vc) - if (vc->flags & AFS_VL_CURSOR_RETRY) - goto restart_from_beginning; - -- e.error = -EDESTADDRREQ; -- e.responded = false; - for (i = 0; i < vc->server_list->nr_servers; i++) { - struct afs_vlserver *s = vc->server_list->servers[i].server; - - if (test_bit(AFS_VLSERVER_FL_RESPONDING, &s->flags)) -- e.responded = true; -- afs_prioritise_error(&e, READ_ONCE(s->probe.error), -+ vc->cumul_error.responded = true; -+ afs_prioritise_error(&vc->cumul_error, READ_ONCE(s->probe.error), - s->probe.abort_code); - } - -- error = e.error; -- --failed_set_error: -- vc->error = error; - failed: - vc->flags |= AFS_VL_CURSOR_STOP; - afs_end_cursor(&vc->ac); -- _leave(" = f [failed %d]", vc->error); -+ _leave(" = f [failed %d]", vc->cumul_error.error); - return false; - } - -@@ -305,7 +304,10 @@ static void afs_vl_dump_edestaddrreq(const struct afs_vl_cursor *vc) - pr_notice("DNS: src=%u st=%u lc=%x\n", - cell->dns_source, cell->dns_status, cell->dns_lookup_count); - pr_notice("VC: ut=%lx ix=%u ni=%hu fl=%hx err=%hd\n", -- vc->untried, vc->index, vc->nr_iterations, vc->flags, vc->error); -+ vc->untried, vc->index, vc->nr_iterations, vc->flags, -+ vc->cumul_error.error); -+ pr_notice("VC: call er=%d ac=%d r=%u\n", -+ vc->call_error, vc->call_abort_code, vc->call_responded); - - if (vc->server_list) { - const struct afs_vlserver_list *sl = vc->server_list; -@@ -329,9 +331,8 @@ static void afs_vl_dump_edestaddrreq(const struct afs_vl_cursor *vc) - } - } - -- pr_notice("AC: t=%lx ax=%u ac=%d er=%d r=%u ni=%u\n", -- vc->ac.tried, vc->ac.index, vc->ac.abort_code, vc->ac.error, -- vc->ac.responded, vc->ac.nr_iterations); -+ pr_notice("AC: t=%lx ax=%u ni=%u\n", -+ vc->ac.tried, vc->ac.index, vc->ac.nr_iterations); - rcu_read_unlock(); - } - -@@ -342,17 +343,16 @@ int afs_end_vlserver_operation(struct afs_vl_cursor *vc) - { - struct afs_net *net = vc->cell->net; - -- if (vc->error == -EDESTADDRREQ || -- vc->error == -EADDRNOTAVAIL || -- vc->error == -ENETUNREACH || -- vc->error == -EHOSTUNREACH) -+ switch (vc->cumul_error.error) { -+ case -EDESTADDRREQ: -+ case -EADDRNOTAVAIL: -+ case -ENETUNREACH: -+ case -EHOSTUNREACH: - afs_vl_dump_edestaddrreq(vc); -+ break; -+ } - - afs_end_cursor(&vc->ac); - afs_put_vlserverlist(net, vc->server_list); -- -- if (vc->error == -ECONNABORTED) -- vc->error = afs_abort_to_error(vc->ac.abort_code); -- -- return vc->error; -+ return vc->cumul_error.error; - } -diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c -index 650534892a20..db7e94584e87 100644 ---- a/fs/afs/vlclient.c -+++ b/fs/afs/vlclient.c -@@ -161,10 +161,13 @@ struct afs_vldb_entry *afs_vl_get_entry_by_name_u(struct afs_vl_cursor *vc, - trace_afs_make_vl_call(call); - afs_make_call(&vc->ac, call, GFP_KERNEL); - afs_wait_for_call_to_complete(call, &vc->ac); -+ vc->call_abort_code = call->abort_code; -+ vc->call_error = call->error; -+ vc->call_responded = call->responded; - afs_put_call(call); -- if (vc->ac.error) { -+ if (vc->call_error) { - kfree(entry); -- return ERR_PTR(vc->ac.error); -+ return ERR_PTR(vc->call_error); - } - return entry; - } -@@ -305,11 +308,14 @@ struct afs_addr_list *afs_vl_get_addrs_u(struct afs_vl_cursor *vc, - trace_afs_make_vl_call(call); - afs_make_call(&vc->ac, call, GFP_KERNEL); - afs_wait_for_call_to_complete(call, &vc->ac); -- alist = call->ret_alist; -+ vc->call_abort_code = call->abort_code; -+ vc->call_error = call->error; -+ vc->call_responded = call->responded; -+ alist = call->ret_alist; - afs_put_call(call); -- if (vc->ac.error) { -+ if (vc->call_error) { - afs_put_addrlist(alist); -- return ERR_PTR(vc->ac.error); -+ return ERR_PTR(vc->call_error); - } - return alist; - } -@@ -656,11 +662,14 @@ struct afs_addr_list *afs_yfsvl_get_endpoints(struct afs_vl_cursor *vc, - trace_afs_make_vl_call(call); - afs_make_call(&vc->ac, call, GFP_KERNEL); - afs_wait_for_call_to_complete(call, &vc->ac); -- alist = call->ret_alist; -+ vc->call_abort_code = call->abort_code; -+ vc->call_error = call->error; -+ vc->call_responded = call->responded; -+ alist = call->ret_alist; - afs_put_call(call); -- if (vc->ac.error) { -+ if (vc->call_error) { - afs_put_addrlist(alist); -- return ERR_PTR(vc->ac.error); -+ return ERR_PTR(vc->call_error); - } - return alist; - } -@@ -769,11 +778,14 @@ char *afs_yfsvl_get_cell_name(struct afs_vl_cursor *vc) - trace_afs_make_vl_call(call); - afs_make_call(&vc->ac, call, GFP_KERNEL); - afs_wait_for_call_to_complete(call, &vc->ac); -- cellname = call->ret_str; -+ vc->call_abort_code = call->abort_code; -+ vc->call_error = call->error; -+ vc->call_responded = call->responded; -+ cellname = call->ret_str; - afs_put_call(call); -- if (vc->ac.error) { -+ if (vc->call_error) { - kfree(cellname); -- return ERR_PTR(vc->ac.error); -+ return ERR_PTR(vc->call_error); - } - return cellname; - } --- -2.43.2 - -From 3b91566b0bebe3f7699ddf2ed595b5241dfdf0d5 Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Tue, 2 Jan 2024 14:02:37 +0000 -Subject: [PATCH 0849/1501] afs: Fix error handling with lookup via - FS.InlineBulkStatus -Content-Length: 4145 -Lines: 113 - -[ Upstream commit 17ba6f0bd14fe3ac606aac6bebe5e69bdaad8ba1 ] - -When afs does a lookup, it tries to use FS.InlineBulkStatus to preemptively -look up a bunch of files in the parent directory and cache this locally, on -the basis that we might want to look at them too (for example if someone -does an ls on a directory, they may want want to then stat every file -listed). - -FS.InlineBulkStatus can be considered a compound op with the normal abort -code applying to the compound as a whole. Each status fetch within the -compound is then given its own individual abort code - but assuming no -error that prevents the bulk fetch from returning the compound result will -be 0, even if all the constituent status fetches failed. - -At the conclusion of afs_do_lookup(), we should use the abort code from the -appropriate status to determine the error to return, if any - but instead -it is assumed that we were successful if the op as a whole succeeded and we -return an incompletely initialised inode, resulting in ENOENT, no matter -the actual reason. In the particular instance reported, a vnode with no -permission granted to be accessed is being given a UAEACCES abort code -which should be reported as EACCES, but is instead being reported as -ENOENT. - -Fix this by abandoning the inode (which will be cleaned up with the op) if -file[1] has an abort code indicated and turn that abort code into an error -instead. - -Whilst we're at it, add a tracepoint so that the abort codes of the -individual subrequests of FS.InlineBulkStatus can be logged. At the moment -only the container abort code can be 0. - -Fixes: e49c7b2f6de7 ("afs: Build an abstraction around an "operation" concept") -Reported-by: Jeffrey Altman <jaltman@auristor.com> -Signed-off-by: David Howells <dhowells@redhat.com> -Reviewed-by: Marc Dionne <marc.dionne@auristor.com> -cc: linux-afs@lists.infradead.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/afs/dir.c | 12 +++++++++--- - include/trace/events/afs.h | 25 +++++++++++++++++++++++++ - 2 files changed, 34 insertions(+), 3 deletions(-) - -diff --git a/fs/afs/dir.c b/fs/afs/dir.c -index 75896a677b96..9140780be5a4 100644 ---- a/fs/afs/dir.c -+++ b/fs/afs/dir.c -@@ -716,6 +716,8 @@ static void afs_do_lookup_success(struct afs_operation *op) - break; - } - -+ if (vp->scb.status.abort_code) -+ trace_afs_bulkstat_error(op, &vp->fid, i, vp->scb.status.abort_code); - if (!vp->scb.have_status && !vp->scb.have_error) - continue; - -@@ -905,12 +907,16 @@ static struct inode *afs_do_lookup(struct inode *dir, struct dentry *dentry, - afs_begin_vnode_operation(op); - afs_wait_for_operation(op); - } -- inode = ERR_PTR(afs_op_error(op)); - - out_op: - if (!afs_op_error(op)) { -- inode = &op->file[1].vnode->netfs.inode; -- op->file[1].vnode = NULL; -+ if (op->file[1].scb.status.abort_code) { -+ afs_op_accumulate_error(op, -ECONNABORTED, -+ op->file[1].scb.status.abort_code); -+ } else { -+ inode = &op->file[1].vnode->netfs.inode; -+ op->file[1].vnode = NULL; -+ } - } - - if (op->file[0].scb.have_status) -diff --git a/include/trace/events/afs.h b/include/trace/events/afs.h -index e9d412d19dbb..caec276515dc 100644 ---- a/include/trace/events/afs.h -+++ b/include/trace/events/afs.h -@@ -1216,6 +1216,31 @@ TRACE_EVENT(afs_file_error, - __print_symbolic(__entry->where, afs_file_errors)) - ); - -+TRACE_EVENT(afs_bulkstat_error, -+ TP_PROTO(struct afs_operation *op, struct afs_fid *fid, unsigned int index, s32 abort), -+ -+ TP_ARGS(op, fid, index, abort), -+ -+ TP_STRUCT__entry( -+ __field_struct(struct afs_fid, fid) -+ __field(unsigned int, op) -+ __field(unsigned int, index) -+ __field(s32, abort) -+ ), -+ -+ TP_fast_assign( -+ __entry->op = op->debug_id; -+ __entry->fid = *fid; -+ __entry->index = index; -+ __entry->abort = abort; -+ ), -+ -+ TP_printk("OP=%08x[%02x] %llx:%llx:%x a=%d", -+ __entry->op, __entry->index, -+ __entry->fid.vid, __entry->fid.vnode, __entry->fid.unique, -+ __entry->abort) -+ ); -+ - TRACE_EVENT(afs_cm_no_server, - TP_PROTO(struct afs_call *call, struct sockaddr_rxrpc *srx), - --- -2.43.2 - -From 782f5ec085380ec10ca1d50b3595ed9c7c21dd82 Mon Sep 17 00:00:00 2001 -From: Salvatore Dipietro <dipiets@amazon.com> -Date: Fri, 19 Jan 2024 11:01:33 -0800 -Subject: [PATCH 0850/1501] tcp: Add memory barrier to tcp_push() -Content-Length: 3423 -Lines: 93 - -[ Upstream commit 7267e8dcad6b2f9fce05a6a06335d7040acbc2b6 ] - -On CPUs with weak memory models, reads and updates performed by tcp_push -to the sk variables can get reordered leaving the socket throttled when -it should not. The tasklet running tcp_wfree() may also not observe the -memory updates in time and will skip flushing any packets throttled by -tcp_push(), delaying the sending. This can pathologically cause 40ms -extra latency due to bad interactions with delayed acks. - -Adding a memory barrier in tcp_push removes the bug, similarly to the -previous commit bf06200e732d ("tcp: tsq: fix nonagle handling"). -smp_mb__after_atomic() is used to not incur in unnecessary overhead -on x86 since not affected. - -Patch has been tested using an AWS c7g.2xlarge instance with Ubuntu -22.04 and Apache Tomcat 9.0.83 running the basic servlet below: - -import java.io.IOException; -import java.io.OutputStreamWriter; -import java.io.PrintWriter; -import javax.servlet.ServletException; -import javax.servlet.http.HttpServlet; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; - -public class HelloWorldServlet extends HttpServlet { - @Override - protected void doGet(HttpServletRequest request, HttpServletResponse response) - throws ServletException, IOException { - response.setContentType("text/html;charset=utf-8"); - OutputStreamWriter osw = new OutputStreamWriter(response.getOutputStream(),"UTF-8"); - String s = "a".repeat(3096); - osw.write(s,0,s.length()); - osw.flush(); - } -} - -Load was applied using wrk2 (https://github.com/kinvolk/wrk2) from an AWS -c6i.8xlarge instance. Before the patch an additional 40ms latency from P99.99+ -values is observed while, with the patch, the extra latency disappears. - -No patch and tcp_autocorking=1 -./wrk -t32 -c128 -d40s --latency -R10000 http://172.31.60.173:8080/hello/hello - ... - 50.000% 0.91ms - 75.000% 1.13ms - 90.000% 1.46ms - 99.000% 1.74ms - 99.900% 1.89ms - 99.990% 41.95ms <<< 40+ ms extra latency - 99.999% 48.32ms -100.000% 48.96ms - -With patch and tcp_autocorking=1 -./wrk -t32 -c128 -d40s --latency -R10000 http://172.31.60.173:8080/hello/hello - ... - 50.000% 0.90ms - 75.000% 1.13ms - 90.000% 1.45ms - 99.000% 1.72ms - 99.900% 1.83ms - 99.990% 2.11ms <<< no 40+ ms extra latency - 99.999% 2.53ms -100.000% 2.62ms - -Patch has been also tested on x86 (m7i.2xlarge instance) which it is not -affected by this issue and the patch doesn't introduce any additional -delay. - -Fixes: 7aa5470c2c09 ("tcp: tsq: move tsq_flags close to sk_wmem_alloc") -Signed-off-by: Salvatore Dipietro <dipiets@amazon.com> -Reviewed-by: Eric Dumazet <edumazet@google.com> -Link: https://lore.kernel.org/r/20240119190133.43698-1-dipiets@amazon.com -Signed-off-by: Paolo Abeni <pabeni@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/ipv4/tcp.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index ff6838ca2e58..7bce79beca2b 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -722,6 +722,7 @@ void tcp_push(struct sock *sk, int flags, int mss_now, - if (!test_bit(TSQ_THROTTLED, &sk->sk_tsq_flags)) { - NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPAUTOCORKING); - set_bit(TSQ_THROTTLED, &sk->sk_tsq_flags); -+ smp_mb__after_atomic(); - } - /* It is possible TX completion already happened - * before we set TSQ_THROTTLED. --- -2.43.2 - -From 581ae53049fa559c990d62e9e96193bd21ce3ac5 Mon Sep 17 00:00:00 2001 -From: Kuniyuki Iwashima <kuniyu@amazon.com> -Date: Fri, 19 Jan 2024 19:16:42 -0800 -Subject: [PATCH 0851/1501] selftest: Don't reuse port for SO_INCOMING_CPU - test. -Content-Length: 7003 -Lines: 223 - -[ Upstream commit 97de5a15edf2d22184f5ff588656030bbb7fa358 ] - -Jakub reported that ASSERT_EQ(cpu, i) in so_incoming_cpu.c seems to -fire somewhat randomly. - - # # RUN so_incoming_cpu.before_reuseport.test3 ... - # # so_incoming_cpu.c:191:test3:Expected cpu (32) == i (0) - # # test3: Test terminated by assertion - # # FAIL so_incoming_cpu.before_reuseport.test3 - # not ok 3 so_incoming_cpu.before_reuseport.test3 - -When the test failed, not-yet-accepted CLOSE_WAIT sockets received -SYN with a "challenging" SEQ number, which was sent from an unexpected -CPU that did not create the receiver. - -The test basically does: - - 1. for each cpu: - 1-1. create a server - 1-2. set SO_INCOMING_CPU - - 2. for each cpu: - 2-1. set cpu affinity - 2-2. create some clients - 2-3. let clients connect() to the server on the same cpu - 2-4. close() clients - - 3. for each server: - 3-1. accept() all child sockets - 3-2. check if all children have the same SO_INCOMING_CPU with the server - -The root cause was the close() in 2-4. and net.ipv4.tcp_tw_reuse. - -In a loop of 2., close() changed the client state to FIN_WAIT_2, and -the peer transitioned to CLOSE_WAIT. - -In another loop of 2., connect() happened to select the same port of -the FIN_WAIT_2 socket, and it was reused as the default value of -net.ipv4.tcp_tw_reuse is 2. - -As a result, the new client sent SYN to the CLOSE_WAIT socket from -a different CPU, and the receiver's sk_incoming_cpu was overwritten -with unexpected CPU ID. - -Also, the SYN had a different SEQ number, so the CLOSE_WAIT socket -responded with Challenge ACK. The new client properly returned RST -and effectively killed the CLOSE_WAIT socket. - -This way, all clients were created successfully, but the error was -detected later by 3-2., ASSERT_EQ(cpu, i). - -To avoid the failure, let's make sure that (i) the number of clients -is less than the number of available ports and (ii) such reuse never -happens. - -Fixes: 6df96146b202 ("selftest: Add test for SO_INCOMING_CPU.") -Reported-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> -Tested-by: Jakub Kicinski <kuba@kernel.org> -Link: https://lore.kernel.org/r/20240120031642.67014-1-kuniyu@amazon.com -Signed-off-by: Paolo Abeni <pabeni@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/testing/selftests/net/so_incoming_cpu.c | 68 ++++++++++++++----- - 1 file changed, 50 insertions(+), 18 deletions(-) - -diff --git a/tools/testing/selftests/net/so_incoming_cpu.c b/tools/testing/selftests/net/so_incoming_cpu.c -index a14818164102..e9fa14e10732 100644 ---- a/tools/testing/selftests/net/so_incoming_cpu.c -+++ b/tools/testing/selftests/net/so_incoming_cpu.c -@@ -3,19 +3,16 @@ - #define _GNU_SOURCE - #include <sched.h> - -+#include <fcntl.h> -+ - #include <netinet/in.h> - #include <sys/socket.h> - #include <sys/sysinfo.h> - - #include "../kselftest_harness.h" - --#define CLIENT_PER_SERVER 32 /* More sockets, more reliable */ --#define NR_SERVER self->nproc --#define NR_CLIENT (CLIENT_PER_SERVER * NR_SERVER) -- - FIXTURE(so_incoming_cpu) - { -- int nproc; - int *servers; - union { - struct sockaddr addr; -@@ -56,12 +53,47 @@ FIXTURE_VARIANT_ADD(so_incoming_cpu, after_all_listen) - .when_to_set = AFTER_ALL_LISTEN, - }; - -+static void write_sysctl(struct __test_metadata *_metadata, -+ char *filename, char *string) -+{ -+ int fd, len, ret; -+ -+ fd = open(filename, O_WRONLY); -+ ASSERT_NE(fd, -1); -+ -+ len = strlen(string); -+ ret = write(fd, string, len); -+ ASSERT_EQ(ret, len); -+} -+ -+static void setup_netns(struct __test_metadata *_metadata) -+{ -+ ASSERT_EQ(unshare(CLONE_NEWNET), 0); -+ ASSERT_EQ(system("ip link set lo up"), 0); -+ -+ write_sysctl(_metadata, "/proc/sys/net/ipv4/ip_local_port_range", "10000 60001"); -+ write_sysctl(_metadata, "/proc/sys/net/ipv4/tcp_tw_reuse", "0"); -+} -+ -+#define NR_PORT (60001 - 10000 - 1) -+#define NR_CLIENT_PER_SERVER_DEFAULT 32 -+static int nr_client_per_server, nr_server, nr_client; -+ - FIXTURE_SETUP(so_incoming_cpu) - { -- self->nproc = get_nprocs(); -- ASSERT_LE(2, self->nproc); -+ setup_netns(_metadata); - -- self->servers = malloc(sizeof(int) * NR_SERVER); -+ nr_server = get_nprocs(); -+ ASSERT_LE(2, nr_server); -+ -+ if (NR_CLIENT_PER_SERVER_DEFAULT * nr_server < NR_PORT) -+ nr_client_per_server = NR_CLIENT_PER_SERVER_DEFAULT; -+ else -+ nr_client_per_server = NR_PORT / nr_server; -+ -+ nr_client = nr_client_per_server * nr_server; -+ -+ self->servers = malloc(sizeof(int) * nr_server); - ASSERT_NE(self->servers, NULL); - - self->in_addr.sin_family = AF_INET; -@@ -74,7 +106,7 @@ FIXTURE_TEARDOWN(so_incoming_cpu) - { - int i; - -- for (i = 0; i < NR_SERVER; i++) -+ for (i = 0; i < nr_server; i++) - close(self->servers[i]); - - free(self->servers); -@@ -110,10 +142,10 @@ int create_server(struct __test_metadata *_metadata, - if (variant->when_to_set == BEFORE_LISTEN) - set_so_incoming_cpu(_metadata, fd, cpu); - -- /* We don't use CLIENT_PER_SERVER here not to block -+ /* We don't use nr_client_per_server here not to block - * this test at connect() if SO_INCOMING_CPU is broken. - */ -- ret = listen(fd, NR_CLIENT); -+ ret = listen(fd, nr_client); - ASSERT_EQ(ret, 0); - - if (variant->when_to_set == AFTER_LISTEN) -@@ -128,7 +160,7 @@ void create_servers(struct __test_metadata *_metadata, - { - int i, ret; - -- for (i = 0; i < NR_SERVER; i++) { -+ for (i = 0; i < nr_server; i++) { - self->servers[i] = create_server(_metadata, self, variant, i); - - if (i == 0) { -@@ -138,7 +170,7 @@ void create_servers(struct __test_metadata *_metadata, - } - - if (variant->when_to_set == AFTER_ALL_LISTEN) { -- for (i = 0; i < NR_SERVER; i++) -+ for (i = 0; i < nr_server; i++) - set_so_incoming_cpu(_metadata, self->servers[i], i); - } - } -@@ -149,7 +181,7 @@ void create_clients(struct __test_metadata *_metadata, - cpu_set_t cpu_set; - int i, j, fd, ret; - -- for (i = 0; i < NR_SERVER; i++) { -+ for (i = 0; i < nr_server; i++) { - CPU_ZERO(&cpu_set); - - CPU_SET(i, &cpu_set); -@@ -162,7 +194,7 @@ void create_clients(struct __test_metadata *_metadata, - ret = sched_setaffinity(0, sizeof(cpu_set), &cpu_set); - ASSERT_EQ(ret, 0); - -- for (j = 0; j < CLIENT_PER_SERVER; j++) { -+ for (j = 0; j < nr_client_per_server; j++) { - fd = socket(AF_INET, SOCK_STREAM, 0); - ASSERT_NE(fd, -1); - -@@ -180,8 +212,8 @@ void verify_incoming_cpu(struct __test_metadata *_metadata, - int i, j, fd, cpu, ret, total = 0; - socklen_t len = sizeof(int); - -- for (i = 0; i < NR_SERVER; i++) { -- for (j = 0; j < CLIENT_PER_SERVER; j++) { -+ for (i = 0; i < nr_server; i++) { -+ for (j = 0; j < nr_client_per_server; j++) { - /* If we see -EAGAIN here, SO_INCOMING_CPU is broken */ - fd = accept(self->servers[i], &self->addr, &self->addrlen); - ASSERT_NE(fd, -1); -@@ -195,7 +227,7 @@ void verify_incoming_cpu(struct __test_metadata *_metadata, - } - } - -- ASSERT_EQ(total, NR_CLIENT); -+ ASSERT_EQ(total, nr_client); - TH_LOG("SO_INCOMING_CPU is very likely to be " - "working correctly with %d sockets.", total); - } --- -2.43.2 - -From 597ee30fd36af2f3bb64e3bae281c15642c7536e Mon Sep 17 00:00:00 2001 -From: Zhengchao Shao <shaozhengchao@huawei.com> -Date: Mon, 22 Jan 2024 09:18:07 +0800 -Subject: [PATCH 0852/1501] netlink: fix potential sleeping issue in - mqueue_flush_file -Content-Length: 2876 -Lines: 68 - -[ Upstream commit 234ec0b6034b16869d45128b8cd2dc6ffe596f04 ] - -I analyze the potential sleeping issue of the following processes: -Thread A Thread B -... netlink_create //ref = 1 -do_mq_notify ... - sock = netlink_getsockbyfilp ... //ref = 2 - info->notify_sock = sock; ... -... netlink_sendmsg -... skb = netlink_alloc_large_skb //skb->head is vmalloced -... netlink_unicast -... sk = netlink_getsockbyportid //ref = 3 -... netlink_sendskb -... __netlink_sendskb -... skb_queue_tail //put skb to sk_receive_queue -... sock_put //ref = 2 -... ... -... netlink_release -... deferred_put_nlk_sk //ref = 1 -mqueue_flush_file - spin_lock - remove_notification - netlink_sendskb - sock_put //ref = 0 - sk_free - ... - __sk_destruct - netlink_sock_destruct - skb_queue_purge //get skb from sk_receive_queue - ... - __skb_queue_purge_reason - kfree_skb_reason - __kfree_skb - ... - skb_release_all - skb_release_head_state - netlink_skb_destructor - vfree(skb->head) //sleeping while holding spinlock - -In netlink_sendmsg, if the memory pointed to by skb->head is allocated by -vmalloc, and is put to sk_receive_queue queue, also the skb is not freed. -When the mqueue executes flush, the sleeping bug will occur. Use -vfree_atomic instead of vfree in netlink_skb_destructor to solve the issue. - -Fixes: c05cdb1b864f ("netlink: allow large data transfers from user-space") -Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com> -Link: https://lore.kernel.org/r/20240122011807.2110357-1-shaozhengchao@huawei.com -Signed-off-by: Paolo Abeni <pabeni@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netlink/af_netlink.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index eb086b06d60d..d9107b545d36 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -374,7 +374,7 @@ static void netlink_skb_destructor(struct sk_buff *skb) - if (is_vmalloc_addr(skb->head)) { - if (!skb->cloned || - !atomic_dec_return(&(skb_shinfo(skb)->dataref))) -- vfree(skb->head); -+ vfree_atomic(skb->head); - - skb->head = NULL; - } --- -2.43.2 - -From 7986be39e4e1627312538f8b4ad7efebf845ae11 Mon Sep 17 00:00:00 2001 -From: Zhengchao Shao <shaozhengchao@huawei.com> -Date: Mon, 22 Jan 2024 18:20:01 +0800 -Subject: [PATCH 0853/1501] ipv6: init the accept_queue's spinlocks in - inet6_create -Content-Length: 2750 -Lines: 62 - -[ Upstream commit 435e202d645c197dcfd39d7372eb2a56529b6640 ] - -In commit 198bc90e0e73("tcp: make sure init the accept_queue's spinlocks -once"), the spinlocks of accept_queue are initialized only when socket is -created in the inet4 scenario. The locks are not initialized when socket -is created in the inet6 scenario. The kernel reports the following error: -INFO: trying to register non-static key. -The code is fine but needs lockdep annotation, or maybe -you didn't initialize this object before use? -turning off the locking correctness validator. -Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 -Call Trace: -<TASK> - dump_stack_lvl (lib/dump_stack.c:107) - register_lock_class (kernel/locking/lockdep.c:1289) - __lock_acquire (kernel/locking/lockdep.c:5015) - lock_acquire.part.0 (kernel/locking/lockdep.c:5756) - _raw_spin_lock_bh (kernel/locking/spinlock.c:178) - inet_csk_listen_stop (net/ipv4/inet_connection_sock.c:1386) - tcp_disconnect (net/ipv4/tcp.c:2981) - inet_shutdown (net/ipv4/af_inet.c:935) - __sys_shutdown (./include/linux/file.h:32 net/socket.c:2438) - __x64_sys_shutdown (net/socket.c:2445) - do_syscall_64 (arch/x86/entry/common.c:52) - entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:129) -RIP: 0033:0x7f52ecd05a3d -Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 -48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff -ff 73 01 c3 48 8b 0d ab a3 0e 00 f7 d8 64 89 01 48 -RSP: 002b:00007f52ecf5dde8 EFLAGS: 00000293 ORIG_RAX: 0000000000000030 -RAX: ffffffffffffffda RBX: 00007f52ecf5e640 RCX: 00007f52ecd05a3d -RDX: 00007f52ecc8b188 RSI: 0000000000000000 RDI: 0000000000000004 -RBP: 00007f52ecf5de20 R08: 00007ffdae45c69f R09: 0000000000000000 -R10: 0000000000000000 R11: 0000000000000293 R12: 00007f52ecf5e640 -R13: 0000000000000000 R14: 00007f52ecc8b060 R15: 00007ffdae45c6e0 - -Fixes: 198bc90e0e73 ("tcp: make sure init the accept_queue's spinlocks once") -Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com> -Reviewed-by: Eric Dumazet <edumazet@google.com> -Link: https://lore.kernel.org/r/20240122102001.2851701-1-shaozhengchao@huawei.com -Signed-off-by: Paolo Abeni <pabeni@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/ipv6/af_inet6.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c -index 13a1833a4df5..959bfd9f6344 100644 ---- a/net/ipv6/af_inet6.c -+++ b/net/ipv6/af_inet6.c -@@ -199,6 +199,9 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, - if (INET_PROTOSW_REUSE & answer_flags) - sk->sk_reuse = SK_CAN_REUSE; - -+ if (INET_PROTOSW_ICSK & answer_flags) -+ inet_init_csk_locks(sk); -+ - inet = inet_sk(sk); - inet_assign_bit(IS_ICSK, sk, INET_PROTOSW_ICSK & answer_flags); - --- -2.43.2 - -From c04709b2cc99ae31c346f79f0211752d7b74df01 Mon Sep 17 00:00:00 2001 -From: Ido Schimmel <idosch@nvidia.com> -Date: Mon, 22 Jan 2024 15:28:43 +0200 -Subject: [PATCH 0855/1501] net/sched: flower: Fix chain template offload -Content-Length: 7693 -Lines: 182 - -[ Upstream commit 32f2a0afa95fae0d1ceec2ff06e0e816939964b8 ] - -When a qdisc is deleted from a net device the stack instructs the -underlying driver to remove its flow offload callback from the -associated filter block using the 'FLOW_BLOCK_UNBIND' command. The stack -then continues to replay the removal of the filters in the block for -this driver by iterating over the chains in the block and invoking the -'reoffload' operation of the classifier being used. In turn, the -classifier in its 'reoffload' operation prepares and emits a -'FLOW_CLS_DESTROY' command for each filter. - -However, the stack does not do the same for chain templates and the -underlying driver never receives a 'FLOW_CLS_TMPLT_DESTROY' command when -a qdisc is deleted. This results in a memory leak [1] which can be -reproduced using [2]. - -Fix by introducing a 'tmplt_reoffload' operation and have the stack -invoke it with the appropriate arguments as part of the replay. -Implement the operation in the sole classifier that supports chain -templates (flower) by emitting the 'FLOW_CLS_TMPLT_{CREATE,DESTROY}' -command based on whether a flow offload callback is being bound to a -filter block or being unbound from one. - -As far as I can tell, the issue happens since cited commit which -reordered tcf_block_offload_unbind() before tcf_block_flush_all_chains() -in __tcf_block_put(). The order cannot be reversed as the filter block -is expected to be freed after flushing all the chains. - -[1] -unreferenced object 0xffff888107e28800 (size 2048): - comm "tc", pid 1079, jiffies 4294958525 (age 3074.287s) - hex dump (first 32 bytes): - b1 a6 7c 11 81 88 ff ff e0 5b b3 10 81 88 ff ff ..|......[...... - 01 00 00 00 00 00 00 00 e0 aa b0 84 ff ff ff ff ................ - backtrace: - [<ffffffff81c06a68>] __kmem_cache_alloc_node+0x1e8/0x320 - [<ffffffff81ab374e>] __kmalloc+0x4e/0x90 - [<ffffffff832aec6d>] mlxsw_sp_acl_ruleset_get+0x34d/0x7a0 - [<ffffffff832bc195>] mlxsw_sp_flower_tmplt_create+0x145/0x180 - [<ffffffff832b2e1a>] mlxsw_sp_flow_block_cb+0x1ea/0x280 - [<ffffffff83a10613>] tc_setup_cb_call+0x183/0x340 - [<ffffffff83a9f85a>] fl_tmplt_create+0x3da/0x4c0 - [<ffffffff83a22435>] tc_ctl_chain+0xa15/0x1170 - [<ffffffff838a863c>] rtnetlink_rcv_msg+0x3cc/0xed0 - [<ffffffff83ac87f0>] netlink_rcv_skb+0x170/0x440 - [<ffffffff83ac6270>] netlink_unicast+0x540/0x820 - [<ffffffff83ac6e28>] netlink_sendmsg+0x8d8/0xda0 - [<ffffffff83793def>] ____sys_sendmsg+0x30f/0xa80 - [<ffffffff8379d29a>] ___sys_sendmsg+0x13a/0x1e0 - [<ffffffff8379d50c>] __sys_sendmsg+0x11c/0x1f0 - [<ffffffff843b9ce0>] do_syscall_64+0x40/0xe0 -unreferenced object 0xffff88816d2c0400 (size 1024): - comm "tc", pid 1079, jiffies 4294958525 (age 3074.287s) - hex dump (first 32 bytes): - 40 00 00 00 00 00 00 00 57 f6 38 be 00 00 00 00 @.......W.8..... - 10 04 2c 6d 81 88 ff ff 10 04 2c 6d 81 88 ff ff ..,m......,m.... - backtrace: - [<ffffffff81c06a68>] __kmem_cache_alloc_node+0x1e8/0x320 - [<ffffffff81ab36c1>] __kmalloc_node+0x51/0x90 - [<ffffffff81a8ed96>] kvmalloc_node+0xa6/0x1f0 - [<ffffffff82827d03>] bucket_table_alloc.isra.0+0x83/0x460 - [<ffffffff82828d2b>] rhashtable_init+0x43b/0x7c0 - [<ffffffff832aed48>] mlxsw_sp_acl_ruleset_get+0x428/0x7a0 - [<ffffffff832bc195>] mlxsw_sp_flower_tmplt_create+0x145/0x180 - [<ffffffff832b2e1a>] mlxsw_sp_flow_block_cb+0x1ea/0x280 - [<ffffffff83a10613>] tc_setup_cb_call+0x183/0x340 - [<ffffffff83a9f85a>] fl_tmplt_create+0x3da/0x4c0 - [<ffffffff83a22435>] tc_ctl_chain+0xa15/0x1170 - [<ffffffff838a863c>] rtnetlink_rcv_msg+0x3cc/0xed0 - [<ffffffff83ac87f0>] netlink_rcv_skb+0x170/0x440 - [<ffffffff83ac6270>] netlink_unicast+0x540/0x820 - [<ffffffff83ac6e28>] netlink_sendmsg+0x8d8/0xda0 - [<ffffffff83793def>] ____sys_sendmsg+0x30f/0xa80 - -[2] - # tc qdisc add dev swp1 clsact - # tc chain add dev swp1 ingress proto ip chain 1 flower dst_ip 0.0.0.0/32 - # tc qdisc del dev swp1 clsact - # devlink dev reload pci/0000:06:00.0 - -Fixes: bbf73830cd48 ("net: sched: traverse chains in block with tcf_get_next_chain()") -Signed-off-by: Ido Schimmel <idosch@nvidia.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/net/sch_generic.h | 4 ++++ - net/sched/cls_api.c | 9 ++++++++- - net/sched/cls_flower.c | 23 +++++++++++++++++++++++ - 3 files changed, 35 insertions(+), 1 deletion(-) - -diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h -index dcb9160e6467..959a7725c27b 100644 ---- a/include/net/sch_generic.h -+++ b/include/net/sch_generic.h -@@ -375,6 +375,10 @@ struct tcf_proto_ops { - struct nlattr **tca, - struct netlink_ext_ack *extack); - void (*tmplt_destroy)(void *tmplt_priv); -+ void (*tmplt_reoffload)(struct tcf_chain *chain, -+ bool add, -+ flow_setup_cb_t *cb, -+ void *cb_priv); - struct tcf_exts * (*get_exts)(const struct tcf_proto *tp, - u32 handle); - -diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c -index 1976bd163986..02c594baa1d9 100644 ---- a/net/sched/cls_api.c -+++ b/net/sched/cls_api.c -@@ -1536,6 +1536,9 @@ tcf_block_playback_offloads(struct tcf_block *block, flow_setup_cb_t *cb, - chain_prev = chain, - chain = __tcf_get_next_chain(block, chain), - tcf_chain_put(chain_prev)) { -+ if (chain->tmplt_ops && add) -+ chain->tmplt_ops->tmplt_reoffload(chain, true, cb, -+ cb_priv); - for (tp = __tcf_get_next_proto(chain, NULL); tp; - tp_prev = tp, - tp = __tcf_get_next_proto(chain, tp), -@@ -1551,6 +1554,9 @@ tcf_block_playback_offloads(struct tcf_block *block, flow_setup_cb_t *cb, - goto err_playback_remove; - } - } -+ if (chain->tmplt_ops && !add) -+ chain->tmplt_ops->tmplt_reoffload(chain, false, cb, -+ cb_priv); - } - - return 0; -@@ -2971,7 +2977,8 @@ static int tc_chain_tmplt_add(struct tcf_chain *chain, struct net *net, - ops = tcf_proto_lookup_ops(name, true, extack); - if (IS_ERR(ops)) - return PTR_ERR(ops); -- if (!ops->tmplt_create || !ops->tmplt_destroy || !ops->tmplt_dump) { -+ if (!ops->tmplt_create || !ops->tmplt_destroy || !ops->tmplt_dump || -+ !ops->tmplt_reoffload) { - NL_SET_ERR_MSG(extack, "Chain templates are not supported with specified classifier"); - module_put(ops->owner); - return -EOPNOTSUPP; -diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c -index e5314a31f75a..efb9d2811b73 100644 ---- a/net/sched/cls_flower.c -+++ b/net/sched/cls_flower.c -@@ -2721,6 +2721,28 @@ static void fl_tmplt_destroy(void *tmplt_priv) - kfree(tmplt); - } - -+static void fl_tmplt_reoffload(struct tcf_chain *chain, bool add, -+ flow_setup_cb_t *cb, void *cb_priv) -+{ -+ struct fl_flow_tmplt *tmplt = chain->tmplt_priv; -+ struct flow_cls_offload cls_flower = {}; -+ -+ cls_flower.rule = flow_rule_alloc(0); -+ if (!cls_flower.rule) -+ return; -+ -+ cls_flower.common.chain_index = chain->index; -+ cls_flower.command = add ? FLOW_CLS_TMPLT_CREATE : -+ FLOW_CLS_TMPLT_DESTROY; -+ cls_flower.cookie = (unsigned long) tmplt; -+ cls_flower.rule->match.dissector = &tmplt->dissector; -+ cls_flower.rule->match.mask = &tmplt->mask; -+ cls_flower.rule->match.key = &tmplt->dummy_key; -+ -+ cb(TC_SETUP_CLSFLOWER, &cls_flower, cb_priv); -+ kfree(cls_flower.rule); -+} -+ - static int fl_dump_key_val(struct sk_buff *skb, - void *val, int val_type, - void *mask, int mask_type, int len) -@@ -3628,6 +3650,7 @@ static struct tcf_proto_ops cls_fl_ops __read_mostly = { - .bind_class = fl_bind_class, - .tmplt_create = fl_tmplt_create, - .tmplt_destroy = fl_tmplt_destroy, -+ .tmplt_reoffload = fl_tmplt_reoffload, - .tmplt_dump = fl_tmplt_dump, - .get_exts = fl_get_exts, - .owner = THIS_MODULE, --- -2.43.2 - -From 33cdeae8c6fb58cc445f859b67c014dc9f60b4e0 Mon Sep 17 00:00:00 2001 -From: Rahul Rameshbabu <rrameshbabu@nvidia.com> -Date: Wed, 22 Nov 2023 18:32:11 -0800 -Subject: [PATCH 0856/1501] net/mlx5e: Fix operation precedence bug in port - timestamping napi_poll context -Content-Length: 1532 -Lines: 32 - -[ Upstream commit 3876638b2c7ebb2c9d181de1191db0de8cac143a ] - -Indirection (*) is of lower precedence than postfix increment (++). Logic -in napi_poll context would cause an out-of-bound read by first increment -the pointer address by byte address space and then dereference the value. -Rather, the intended logic was to dereference first and then increment the -underlying value. - -Fixes: 92214be5979c ("net/mlx5e: Update doorbell for port timestamping CQ before the software counter") -Signed-off-by: Rahul Rameshbabu <rrameshbabu@nvidia.com> -Reviewed-by: Tariq Toukan <tariqt@nvidia.com> -Signed-off-by: Saeed Mahameed <saeedm@nvidia.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -index af3928eddafd..803035d4e597 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -@@ -213,7 +213,7 @@ static void mlx5e_ptp_handle_ts_cqe(struct mlx5e_ptpsq *ptpsq, - mlx5e_ptpsq_mark_ts_cqes_undelivered(ptpsq, hwtstamp); - out: - napi_consume_skb(skb, budget); -- md_buff[*md_buff_sz++] = metadata_id; -+ md_buff[(*md_buff_sz)++] = metadata_id; - if (unlikely(mlx5e_ptp_metadata_map_unhealthy(&ptpsq->metadata_map)) && - !test_and_set_bit(MLX5E_SQ_STATE_RECOVERING, &sq->state)) - queue_work(ptpsq->txqsq.priv->wq, &ptpsq->report_unhealthy_work); --- -2.43.2 - -From b7077d52ca22562e85141a7705e3b49e012469a5 Mon Sep 17 00:00:00 2001 -From: Tariq Toukan <tariqt@nvidia.com> -Date: Sun, 5 Nov 2023 17:09:46 +0200 -Subject: [PATCH 0857/1501] net/mlx5e: Fix inconsistent hairpin RQT sizes -Content-Length: 1583 -Lines: 36 - -[ Upstream commit c20767fd45e82d64352db82d4fc8d281a43e4783 ] - -The processing of traffic in hairpin queues occurs in HW/FW and does not -involve the cpus, hence the upper bound on max num channels does not -apply to them. Using this bound for the hairpin RQT max_table_size is -wrong. It could be too small, and cause the error below [1]. As the -RQT size provided on init does not get modified later, use the same -value for both actual and max table sizes. - -[1] -mlx5_core 0000:08:00.1: mlx5_cmd_out_err:805:(pid 1200): CREATE_RQT(0x916) op_mod(0x0) failed, status bad parameter(0x3), syndrome (0x538faf), err(-22) - -Fixes: 74a8dadac17e ("net/mlx5e: Preparations for supporting larger number of channels") -Signed-off-by: Tariq Toukan <tariqt@nvidia.com> -Reviewed-by: Gal Pressman <gal@nvidia.com> -Signed-off-by: Saeed Mahameed <saeedm@nvidia.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -index 96af9e2ab1d8..b61d82f08e65 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -@@ -761,7 +761,7 @@ static int mlx5e_hairpin_create_indirect_rqt(struct mlx5e_hairpin *hp) - - err = mlx5e_rss_params_indir_init(&indir, mdev, - mlx5e_rqt_size(mdev, hp->num_channels), -- mlx5e_rqt_size(mdev, priv->max_nch)); -+ mlx5e_rqt_size(mdev, hp->num_channels)); - if (err) - return err; - --- -2.43.2 - -From e24d6f5a7f2d95a98a46257a5a5a5381d572894f Mon Sep 17 00:00:00 2001 -From: Vlad Buslov <vladbu@nvidia.com> -Date: Fri, 10 Nov 2023 11:10:22 +0100 -Subject: [PATCH 0858/1501] net/mlx5e: Fix peer flow lists handling -Content-Length: 6891 -Lines: 118 - -[ Upstream commit d76fdd31f953ac5046555171620f2562715e9b71 ] - -The cited change refactored mlx5e_tc_del_fdb_peer_flow() to only clear DUP -flag when list of peer flows has become empty. However, if any concurrent -user holds a reference to a peer flow (for example, the neighbor update -workqueue task is updating peer flow's parent encap entry concurrently), -then the flow will not be removed from the peer list and, consecutively, -DUP flag will remain set. Since mlx5e_tc_del_fdb_peers_flow() calls -mlx5e_tc_del_fdb_peer_flow() for every possible peer index the algorithm -will try to remove the flow from eswitch instances that it has never peered -with causing either NULL pointer dereference when trying to remove the flow -peer list head of peer_index that was never initialized or a warning if the -list debug config is enabled[0]. - -Fix the issue by always removing the peer flow from the list even when not -releasing the last reference to it. - -[0]: - -[ 3102.985806] ------------[ cut here ]------------ -[ 3102.986223] list_del corruption, ffff888139110698->next is NULL -[ 3102.986757] WARNING: CPU: 2 PID: 22109 at lib/list_debug.c:53 __list_del_entry_valid_or_report+0x4f/0xc0 -[ 3102.987561] Modules linked in: act_ct nf_flow_table bonding act_tunnel_key act_mirred act_skbedit vxlan cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress mlx5_vdpa vringh vhost_iotlb vdpa openvswitch nsh xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcg -ss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5_core [last unloaded: bonding] -[ 3102.991113] CPU: 2 PID: 22109 Comm: revalidator28 Not tainted 6.6.0-rc6+ #3 -[ 3102.991695] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 -[ 3102.992605] RIP: 0010:__list_del_entry_valid_or_report+0x4f/0xc0 -[ 3102.993122] Code: 39 c2 74 56 48 8b 32 48 39 fe 75 62 48 8b 51 08 48 39 f2 75 73 b8 01 00 00 00 c3 48 89 fe 48 c7 c7 48 fd 0a 82 e8 41 0b ad ff <0f> 0b 31 c0 c3 48 89 fe 48 c7 c7 70 fd 0a 82 e8 2d 0b ad ff 0f 0b -[ 3102.994615] RSP: 0018:ffff8881383e7710 EFLAGS: 00010286 -[ 3102.995078] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000 -[ 3102.995670] RDX: 0000000000000001 RSI: ffff88885f89b640 RDI: ffff88885f89b640 -[ 3102.997188] DEL flow 00000000be367878 on port 0 -[ 3102.998594] RBP: dead000000000122 R08: 0000000000000000 R09: c0000000ffffdfff -[ 3102.999604] R10: 0000000000000008 R11: ffff8881383e7598 R12: dead000000000100 -[ 3103.000198] R13: 0000000000000002 R14: ffff888139110000 R15: ffff888101901240 -[ 3103.000790] FS: 00007f424cde4700(0000) GS:ffff88885f880000(0000) knlGS:0000000000000000 -[ 3103.001486] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -[ 3103.001986] CR2: 00007fd42e8dcb70 CR3: 000000011e68a003 CR4: 0000000000370ea0 -[ 3103.002596] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 -[ 3103.003190] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 -[ 3103.003787] Call Trace: -[ 3103.004055] <TASK> -[ 3103.004297] ? __warn+0x7d/0x130 -[ 3103.004623] ? __list_del_entry_valid_or_report+0x4f/0xc0 -[ 3103.005094] ? report_bug+0xf1/0x1c0 -[ 3103.005439] ? console_unlock+0x4a/0xd0 -[ 3103.005806] ? handle_bug+0x3f/0x70 -[ 3103.006149] ? exc_invalid_op+0x13/0x60 -[ 3103.006531] ? asm_exc_invalid_op+0x16/0x20 -[ 3103.007430] ? __list_del_entry_valid_or_report+0x4f/0xc0 -[ 3103.007910] mlx5e_tc_del_fdb_peers_flow+0xcf/0x240 [mlx5_core] -[ 3103.008463] mlx5e_tc_del_flow+0x46/0x270 [mlx5_core] -[ 3103.008944] mlx5e_flow_put+0x26/0x50 [mlx5_core] -[ 3103.009401] mlx5e_delete_flower+0x25f/0x380 [mlx5_core] -[ 3103.009901] tc_setup_cb_destroy+0xab/0x180 -[ 3103.010292] fl_hw_destroy_filter+0x99/0xc0 [cls_flower] -[ 3103.010779] __fl_delete+0x2d4/0x2f0 [cls_flower] -[ 3103.011207] fl_delete+0x36/0x80 [cls_flower] -[ 3103.011614] tc_del_tfilter+0x56f/0x750 -[ 3103.011982] rtnetlink_rcv_msg+0xff/0x3a0 -[ 3103.012362] ? netlink_ack+0x1c7/0x4e0 -[ 3103.012719] ? rtnl_calcit.isra.44+0x130/0x130 -[ 3103.013134] netlink_rcv_skb+0x54/0x100 -[ 3103.013533] netlink_unicast+0x1ca/0x2b0 -[ 3103.013902] netlink_sendmsg+0x361/0x4d0 -[ 3103.014269] __sock_sendmsg+0x38/0x60 -[ 3103.014643] ____sys_sendmsg+0x1f2/0x200 -[ 3103.015018] ? copy_msghdr_from_user+0x72/0xa0 -[ 3103.015265] ___sys_sendmsg+0x87/0xd0 -[ 3103.016608] ? copy_msghdr_from_user+0x72/0xa0 -[ 3103.017014] ? ___sys_recvmsg+0x9b/0xd0 -[ 3103.017381] ? ttwu_do_activate.isra.137+0x58/0x180 -[ 3103.017821] ? wake_up_q+0x49/0x90 -[ 3103.018157] ? futex_wake+0x137/0x160 -[ 3103.018521] ? __sys_sendmsg+0x51/0x90 -[ 3103.018882] __sys_sendmsg+0x51/0x90 -[ 3103.019230] ? exit_to_user_mode_prepare+0x56/0x130 -[ 3103.019670] do_syscall_64+0x3c/0x80 -[ 3103.020017] entry_SYSCALL_64_after_hwframe+0x46/0xb0 -[ 3103.020469] RIP: 0033:0x7f4254811ef4 -[ 3103.020816] Code: 89 f3 48 83 ec 10 48 89 7c 24 08 48 89 14 24 e8 42 eb ff ff 48 8b 14 24 41 89 c0 48 89 de 48 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 30 44 89 c7 48 89 04 24 e8 78 eb ff ff 48 8b -[ 3103.022290] RSP: 002b:00007f424cdd9480 EFLAGS: 00000293 ORIG_RAX: 000000000000002e -[ 3103.022970] RAX: ffffffffffffffda RBX: 00007f424cdd9510 RCX: 00007f4254811ef4 -[ 3103.023564] RDX: 0000000000000000 RSI: 00007f424cdd9510 RDI: 0000000000000012 -[ 3103.024158] RBP: 00007f424cdda238 R08: 0000000000000000 R09: 00007f41d801a4b0 -[ 3103.024748] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 -[ 3103.025341] R13: 00007f424cdd9510 R14: 00007f424cdda240 R15: 00007f424cdd99a0 -[ 3103.025931] </TASK> -[ 3103.026182] ---[ end trace 0000000000000000 ]--- -[ 3103.027033] ------------[ cut here ]------------ - -Fixes: 9be6c21fdcf8 ("net/mlx5e: Handle offloads flows per peer") -Signed-off-by: Vlad Buslov <vladbu@nvidia.com> -Reviewed-by: Mark Bloch <mbloch@nvidia.com> -Signed-off-by: Saeed Mahameed <saeedm@nvidia.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -index b61d82f08e65..404dd1d9b28b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -@@ -2014,9 +2014,10 @@ static void mlx5e_tc_del_fdb_peer_flow(struct mlx5e_tc_flow *flow, - list_for_each_entry_safe(peer_flow, tmp, &flow->peer_flows, peer_flows) { - if (peer_index != mlx5_get_dev_index(peer_flow->priv->mdev)) - continue; -+ -+ list_del(&peer_flow->peer_flows); - if (refcount_dec_and_test(&peer_flow->refcnt)) { - mlx5e_tc_del_fdb_flow(peer_flow->priv, peer_flow); -- list_del(&peer_flow->peer_flows); - kfree(peer_flow); - } - } --- -2.43.2 - -From fc18f59d0f88ae25d8334887f84e5d3e66a7ea72 Mon Sep 17 00:00:00 2001 -From: Yishai Hadas <yishaih@nvidia.com> -Date: Sun, 31 Dec 2023 15:19:50 +0200 -Subject: [PATCH 0859/1501] net/mlx5: Fix a WARN upon a callback command - failure -Content-Length: 5764 -Lines: 141 - -[ Upstream commit cc8091587779cfaddb6b29c9e9edb9079a282cad ] - -The below WARN [1] is reported once a callback command failed. - -As a callback runs under an interrupt context, needs to use the IRQ -save/restore variant. - -[1] -DEBUG_LOCKS_WARN_ON(lockdep_hardirq_context()) -WARNING: CPU: 15 PID: 0 at kernel/locking/lockdep.c:4353 - lockdep_hardirqs_on_prepare+0x11b/0x180 -Modules linked in: vhost_net vhost tap mlx5_vfio_pci -vfio_pci vfio_pci_core vfio_iommu_type1 vfio mlx5_vdpa vringh -vhost_iotlb vdpa nfnetlink_cttimeout openvswitch nsh ip6table_mangle -ip6table_nat ip6table_filter ip6_tables iptable_mangle -xt_conntrackxt_MASQUERADE nf_conntrack_netlink nfnetlink -xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 -auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi -scsi_transport_iscsi rdma_cm iw_cm ib_umad ib_ipoib ib_cm -mlx5_ib ib_uverbs ib_core fuse mlx5_core -CPU: 15 PID: 0 Comm: swapper/15 Tainted: G W 6.7.0-rc4+ #1587 -Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS -rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 -RIP: 0010:lockdep_hardirqs_on_prepare+0x11b/0x180 -Code: 00 5b c3 c3 e8 e6 0d 58 00 85 c0 74 d6 8b 15 f0 c3 - 76 01 85 d2 75 cc 48 c7 c6 04 a5 3b 82 48 c7 c7 f1 - e9 39 82 e8 95 12 f9 ff <0f> 0b 5b c3 e8 bc 0d 58 00 - 85 c0 74 ac 8b 3d c6 c3 76 01 85 ff 75 -RSP: 0018:ffffc900003ecd18 EFLAGS: 00010086 -RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000027 -RDX: 0000000000000000 RSI: ffff88885fbdb880 RDI: ffff88885fbdb888 -RBP: 00000000ffffff87 R08: 0000000000000000 R09: 0000000000000001 -R10: 0000000000000000 R11: 284e4f5f4e524157 R12: 00000000002c9aa1 -R13: ffff88810aace980 R14: ffff88810aace9b8 R15: 0000000000000003 -FS: 0000000000000000(0000) GS:ffff88885fbc0000(0000) -knlGS:0000000000000000 -CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -CR2: 00007f731436f4c8 CR3: 000000010aae6001 CR4: 0000000000372eb0 -DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 -DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 -Call Trace: - <IRQ> -? __warn+0x81/0x170 -? lockdep_hardirqs_on_prepare+0x11b/0x180 -? report_bug+0xf8/0x1c0 -? handle_bug+0x3f/0x70 -? exc_invalid_op+0x13/0x60 -? asm_exc_invalid_op+0x16/0x20 -? lockdep_hardirqs_on_prepare+0x11b/0x180 -? lockdep_hardirqs_on_prepare+0x11b/0x180 -trace_hardirqs_on+0x4a/0xa0 -raw_spin_unlock_irq+0x24/0x30 -cmd_status_err+0xc0/0x1a0 [mlx5_core] -cmd_status_err+0x1a0/0x1a0 [mlx5_core] -mlx5_cmd_exec_cb_handler+0x24/0x40 [mlx5_core] -mlx5_cmd_comp_handler+0x129/0x4b0 [mlx5_core] -cmd_comp_notifier+0x1a/0x20 [mlx5_core] -notifier_call_chain+0x3e/0xe0 -atomic_notifier_call_chain+0x5f/0x130 -mlx5_eq_async_int+0xe7/0x200 [mlx5_core] -notifier_call_chain+0x3e/0xe0 -atomic_notifier_call_chain+0x5f/0x130 -irq_int_handler+0x11/0x20 [mlx5_core] -__handle_irq_event_percpu+0x99/0x220 -? tick_irq_enter+0x5d/0x80 -handle_irq_event_percpu+0xf/0x40 -handle_irq_event+0x3a/0x60 -handle_edge_irq+0xa2/0x1c0 -__common_interrupt+0x55/0x140 -common_interrupt+0x7d/0xa0 -</IRQ> -<TASK> -asm_common_interrupt+0x22/0x40 -RIP: 0010:default_idle+0x13/0x20 -Code: c0 08 00 00 00 4d 29 c8 4c 01 c7 4c 29 c2 e9 72 ff -ff ff cc cc cc cc 8b 05 ea 08 25 01 85 c0 7e 07 0f 00 2d 7f b0 26 00 fb -f4 <fa> c3 90 66 2e 0f 1f 84 00 00 00 00 00 65 48 8b 04 25 80 d0 02 00 -RSP: 0018:ffffc9000010fec8 EFLAGS: 00000242 -RAX: 0000000000000001 RBX: 000000000000000f RCX: 4000000000000000 -RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff811c410c -RBP: ffffffff829478c0 R08: 0000000000000001 R09: 0000000000000001 -R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 -R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 -? do_idle+0x1ec/0x210 -default_idle_call+0x6c/0x90 -do_idle+0x1ec/0x210 -cpu_startup_entry+0x26/0x30 -start_secondary+0x11b/0x150 -secondary_startup_64_no_verify+0x165/0x16b -</TASK> -irq event stamp: 833284 -hardirqs last enabled at (833283): [<ffffffff811c410c>] -do_idle+0x1ec/0x210 -hardirqs last disabled at (833284): [<ffffffff81daf9ef>] -common_interrupt+0xf/0xa0 -softirqs last enabled at (833224): [<ffffffff81dc199f>] -__do_softirq+0x2bf/0x40e -softirqs last disabled at (833177): [<ffffffff81178ddf>] -irq_exit_rcu+0x7f/0xa0 - -Fixes: 34f46ae0d4b3 ("net/mlx5: Add command failures data to debugfs") -Signed-off-by: Yishai Hadas <yishaih@nvidia.com> -Reviewed-by: Moshe Shemesh <moshe@nvidia.com> -Signed-off-by: Saeed Mahameed <saeedm@nvidia.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -index a7b1f9686c09..4957412ff1f6 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -@@ -1923,6 +1923,7 @@ static void cmd_status_log(struct mlx5_core_dev *dev, u16 opcode, u8 status, - { - const char *namep = mlx5_command_str(opcode); - struct mlx5_cmd_stats *stats; -+ unsigned long flags; - - if (!err || !(strcmp(namep, "unknown command opcode"))) - return; -@@ -1930,7 +1931,7 @@ static void cmd_status_log(struct mlx5_core_dev *dev, u16 opcode, u8 status, - stats = xa_load(&dev->cmd.stats, opcode); - if (!stats) - return; -- spin_lock_irq(&stats->lock); -+ spin_lock_irqsave(&stats->lock, flags); - stats->failed++; - if (err < 0) - stats->last_failed_errno = -err; -@@ -1939,7 +1940,7 @@ static void cmd_status_log(struct mlx5_core_dev *dev, u16 opcode, u8 status, - stats->last_failed_mbox_status = status; - stats->last_failed_syndrome = syndrome; - } -- spin_unlock_irq(&stats->lock); -+ spin_unlock_irqrestore(&stats->lock, flags); - } - - /* preserve -EREMOTEIO for outbox.status != OK, otherwise return err as is */ --- -2.43.2 - -From 0d704520a93989565a19a859a85fee2006ce9524 Mon Sep 17 00:00:00 2001 -From: Moshe Shemesh <moshe@nvidia.com> -Date: Sat, 30 Dec 2023 22:40:37 +0200 -Subject: [PATCH 0860/1501] net/mlx5: Bridge, fix multicast packets sent to - uplink -Content-Length: 3754 -Lines: 86 - -[ Upstream commit ec7cc38ef9f83553102e84c82536971a81630739 ] - -To enable multicast packets which are offloaded in bridge multicast -offload mode to be sent also to uplink, FTE bit uplink_hairpin_en should -be set. Add this bit to FTE for the bridge multicast offload rules. - -Fixes: 18c2916cee12 ("net/mlx5: Bridge, snoop igmp/mld packets") -Signed-off-by: Moshe Shemesh <moshe@nvidia.com> -Reviewed-by: Gal Pressman <gal@nvidia.com> -Signed-off-by: Saeed Mahameed <saeedm@nvidia.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/mellanox/mlx5/core/esw/bridge_mcast.c | 3 +++ - drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c | 2 ++ - include/linux/mlx5/fs.h | 1 + - include/linux/mlx5/mlx5_ifc.h | 2 +- - 4 files changed, 7 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge_mcast.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge_mcast.c -index a7ed87e9d842..22dd30cf8033 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge_mcast.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge_mcast.c -@@ -83,6 +83,7 @@ mlx5_esw_bridge_mdb_flow_create(u16 esw_owner_vhca_id, struct mlx5_esw_bridge_md - i++; - } - -+ rule_spec->flow_context.flags |= FLOW_CONTEXT_UPLINK_HAIRPIN_EN; - rule_spec->match_criteria_enable = MLX5_MATCH_OUTER_HEADERS; - dmac_v = MLX5_ADDR_OF(fte_match_param, rule_spec->match_value, outer_headers.dmac_47_16); - ether_addr_copy(dmac_v, entry->key.addr); -@@ -587,6 +588,7 @@ mlx5_esw_bridge_mcast_vlan_flow_create(u16 vlan_proto, struct mlx5_esw_bridge_po - if (!rule_spec) - return ERR_PTR(-ENOMEM); - -+ rule_spec->flow_context.flags |= FLOW_CONTEXT_UPLINK_HAIRPIN_EN; - rule_spec->match_criteria_enable = MLX5_MATCH_OUTER_HEADERS; - - flow_act.action |= MLX5_FLOW_CONTEXT_ACTION_PACKET_REFORMAT; -@@ -662,6 +664,7 @@ mlx5_esw_bridge_mcast_fwd_flow_create(struct mlx5_esw_bridge_port *port) - dest.vport.flags = MLX5_FLOW_DEST_VPORT_VHCA_ID; - dest.vport.vhca_id = port->esw_owner_vhca_id; - } -+ rule_spec->flow_context.flags |= FLOW_CONTEXT_UPLINK_HAIRPIN_EN; - handle = mlx5_add_flow_rules(port->mcast.ft, rule_spec, &flow_act, &dest, 1); - - kvfree(rule_spec); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c -index a4b925331661..b29299c49ab3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c -@@ -566,6 +566,8 @@ static int mlx5_cmd_set_fte(struct mlx5_core_dev *dev, - fte->flow_context.flow_tag); - MLX5_SET(flow_context, in_flow_context, flow_source, - fte->flow_context.flow_source); -+ MLX5_SET(flow_context, in_flow_context, uplink_hairpin_en, -+ !!(fte->flow_context.flags & FLOW_CONTEXT_UPLINK_HAIRPIN_EN)); - - MLX5_SET(flow_context, in_flow_context, extended_destination, - extended_dest); -diff --git a/include/linux/mlx5/fs.h b/include/linux/mlx5/fs.h -index 6f7725238abc..3fb428ce7d1c 100644 ---- a/include/linux/mlx5/fs.h -+++ b/include/linux/mlx5/fs.h -@@ -132,6 +132,7 @@ struct mlx5_flow_handle; - - enum { - FLOW_CONTEXT_HAS_TAG = BIT(0), -+ FLOW_CONTEXT_UPLINK_HAIRPIN_EN = BIT(1), - }; - - struct mlx5_flow_context { -diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h -index 3f7b664d625b..fb8d26a15df4 100644 ---- a/include/linux/mlx5/mlx5_ifc.h -+++ b/include/linux/mlx5/mlx5_ifc.h -@@ -3557,7 +3557,7 @@ struct mlx5_ifc_flow_context_bits { - u8 action[0x10]; - - u8 extended_destination[0x1]; -- u8 reserved_at_81[0x1]; -+ u8 uplink_hairpin_en[0x1]; - u8 flow_source[0x2]; - u8 encrypt_decrypt_type[0x4]; - u8 destination_list_size[0x18]; --- -2.43.2 - -From c3a974bcfd651e4560f7857c5d45432ee0bc4483 Mon Sep 17 00:00:00 2001 -From: Yevgeny Kliteynik <kliteyn@nvidia.com> -Date: Sun, 17 Dec 2023 11:24:08 +0200 -Subject: [PATCH 0861/1501] net/mlx5: DR, Use the right GVMI number for drop - action -Content-Length: 1317 -Lines: 31 - -[ Upstream commit 5665954293f13642f9c052ead83c1e9d8cff186f ] - -When FW provides ICM addresses for drop RX/TX, the provided capability -is 64 bits that contain its GVMI as well as the ICM address itself. -In case of TX DROP this GVMI is different from the GVMI that the -domain is operating on. - -This patch fixes the action to use these GVMI IDs, as provided by FW. - -Fixes: 9db810ed2d37 ("net/mlx5: DR, Expose steering action functionality") -Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com> -Signed-off-by: Saeed Mahameed <saeedm@nvidia.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c -index e3ec559369fa..74fc318b5027 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c -@@ -788,6 +788,7 @@ int mlx5dr_actions_build_ste_arr(struct mlx5dr_matcher *matcher, - switch (action_type) { - case DR_ACTION_TYP_DROP: - attr.final_icm_addr = nic_dmn->drop_icm_addr; -+ attr.hit_gvmi = nic_dmn->drop_icm_addr >> 48; - break; - case DR_ACTION_TYP_FT: - dest_action = action; --- -2.43.2 - -From ad896e88a3fc9fdf49da07014dec885994e67825 Mon Sep 17 00:00:00 2001 -From: Yevgeny Kliteynik <kliteyn@nvidia.com> -Date: Sun, 17 Dec 2023 13:20:36 +0200 -Subject: [PATCH 0862/1501] net/mlx5: DR, Can't go to uplink vport on RX rule -Content-Length: 1829 -Lines: 43 - -[ Upstream commit 5b2a2523eeea5f03d39a9d1ff1bad2e9f8eb98d2 ] - -Go-To-Vport action on RX is not allowed when the vport is uplink. -In such case, the packet should be dropped. - -Fixes: 9db810ed2d37 ("net/mlx5: DR, Expose steering action functionality") -Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com> -Reviewed-by: Erez Shitrit <erezsh@nvidia.com> -Signed-off-by: Saeed Mahameed <saeedm@nvidia.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../mellanox/mlx5/core/steering/dr_action.c | 16 +++++++++++----- - 1 file changed, 11 insertions(+), 5 deletions(-) - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c -index 74fc318b5027..d2b65a0ce47b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c -@@ -874,11 +874,17 @@ int mlx5dr_actions_build_ste_arr(struct mlx5dr_matcher *matcher, - action->sampler->tx_icm_addr; - break; - case DR_ACTION_TYP_VPORT: -- attr.hit_gvmi = action->vport->caps->vhca_gvmi; -- dest_action = action; -- attr.final_icm_addr = rx_rule ? -- action->vport->caps->icm_address_rx : -- action->vport->caps->icm_address_tx; -+ if (unlikely(rx_rule && action->vport->caps->num == MLX5_VPORT_UPLINK)) { -+ /* can't go to uplink on RX rule - dropping instead */ -+ attr.final_icm_addr = nic_dmn->drop_icm_addr; -+ attr.hit_gvmi = nic_dmn->drop_icm_addr >> 48; -+ } else { -+ attr.hit_gvmi = action->vport->caps->vhca_gvmi; -+ dest_action = action; -+ attr.final_icm_addr = rx_rule ? -+ action->vport->caps->icm_address_rx : -+ action->vport->caps->icm_address_tx; -+ } - break; - case DR_ACTION_TYP_POP_VLAN: - if (!rx_rule && !(dmn->ste_ctx->actions_caps & --- -2.43.2 - -From 8ed2f78eb5af74b12dd0b07520a1c9e49831f6fa Mon Sep 17 00:00:00 2001 -From: Rahul Rameshbabu <rrameshbabu@nvidia.com> -Date: Tue, 28 Nov 2023 14:01:54 -0800 -Subject: [PATCH 0863/1501] net/mlx5: Use mlx5 device constant for selecting CQ - period mode for ASO -Content-Length: 1425 -Lines: 30 - -[ Upstream commit 20cbf8cbb827094197f3b17db60d71449415db1e ] - -mlx5 devices have specific constants for choosing the CQ period mode. These -constants do not have to match the constants used by the kernel software -API for DIM period mode selection. - -Fixes: cdd04f4d4d71 ("net/mlx5: Add support to create SQ and CQ for ASO") -Signed-off-by: Rahul Rameshbabu <rrameshbabu@nvidia.com> -Reviewed-by: Jianbo Liu <jianbol@nvidia.com> -Signed-off-by: Saeed Mahameed <saeedm@nvidia.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/mellanox/mlx5/core/lib/aso.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/aso.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/aso.c -index 40c7be124041..58bd749b5e4d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/aso.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/aso.c -@@ -98,7 +98,7 @@ static int create_aso_cq(struct mlx5_aso_cq *cq, void *cqc_data) - mlx5_fill_page_frag_array(&cq->wq_ctrl.buf, - (__be64 *)MLX5_ADDR_OF(create_cq_in, in, pas)); - -- MLX5_SET(cqc, cqc, cq_period_mode, DIM_CQ_PERIOD_MODE_START_FROM_EQE); -+ MLX5_SET(cqc, cqc, cq_period_mode, MLX5_CQ_PERIOD_MODE_START_FROM_EQE); - MLX5_SET(cqc, cqc, c_eqn_or_apu_element, eqn); - MLX5_SET(cqc, cqc, uar_page, mdev->priv.uar->index); - MLX5_SET(cqc, cqc, log_page_size, cq->wq_ctrl.buf.page_shift - --- -2.43.2 - -From f8462e8a95adfbe3218de178bafa3eff92c609d1 Mon Sep 17 00:00:00 2001 -From: Leon Romanovsky <leonro@nvidia.com> -Date: Tue, 12 Dec 2023 13:52:55 +0200 -Subject: [PATCH 0864/1501] net/mlx5e: Allow software parsing when IPsec crypto - is enabled -Content-Length: 1338 -Lines: 31 - -[ Upstream commit 20f5468a7988dedd94a57ba8acd65ebda6a59723 ] - -All ConnectX devices have software parsing capability enabled, but it is -more correct to set allow_swp only if capability exists, which for IPsec -means that crypto offload is supported. - -Fixes: 2451da081a34 ("net/mlx5: Unify device IPsec capabilities check") -Signed-off-by: Leon Romanovsky <leonro@nvidia.com> -Signed-off-by: Saeed Mahameed <saeedm@nvidia.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/mellanox/mlx5/core/en/params.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -index e097f336e1c4..30507b7c2fb1 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -@@ -1062,8 +1062,8 @@ void mlx5e_build_sq_param(struct mlx5_core_dev *mdev, - void *wq = MLX5_ADDR_OF(sqc, sqc, wq); - bool allow_swp; - -- allow_swp = -- mlx5_geneve_tx_allowed(mdev) || !!mlx5_ipsec_device_caps(mdev); -+ allow_swp = mlx5_geneve_tx_allowed(mdev) || -+ (mlx5_ipsec_device_caps(mdev) & MLX5_IPSEC_CAP_CRYPTO); - mlx5e_build_sq_param_common(mdev, param); - MLX5_SET(wq, wq, log_wq_sz, params->log_sq_size); - MLX5_SET(sqc, sqc, allow_swp, allow_swp); --- -2.43.2 - -From f8ec9a7bd98c7d4cc42e0af3017658e35ac78629 Mon Sep 17 00:00:00 2001 -From: Leon Romanovsky <leonro@nvidia.com> -Date: Sun, 26 Nov 2023 11:08:10 +0200 -Subject: [PATCH 0865/1501] net/mlx5e: Ignore IPsec replay window values on - sender side -Content-Length: 2264 -Lines: 60 - -[ Upstream commit 315a597f9bcfe7fe9980985031413457bee95510 ] - -XFRM stack doesn't prevent from users to configure replay window -in TX side and strongswan sets replay_window to be 1. It causes -to failures in validation logic when trying to offload the SA. - -Replay window is not relevant in TX side and should be ignored. - -Fixes: cded6d80129b ("net/mlx5e: Store replay window in XFRM attributes") -Signed-off-by: Aya Levin <ayal@nvidia.com> -Signed-off-by: Leon Romanovsky <leonro@nvidia.com> -Signed-off-by: Saeed Mahameed <saeedm@nvidia.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -index 161c5190c236..05612d9c6080 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -@@ -336,12 +336,17 @@ void mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry, - /* iv len */ - aes_gcm->icv_len = x->aead->alg_icv_len; - -+ attrs->dir = x->xso.dir; -+ - /* esn */ - if (x->props.flags & XFRM_STATE_ESN) { - attrs->replay_esn.trigger = true; - attrs->replay_esn.esn = sa_entry->esn_state.esn; - attrs->replay_esn.esn_msb = sa_entry->esn_state.esn_msb; - attrs->replay_esn.overlap = sa_entry->esn_state.overlap; -+ if (attrs->dir == XFRM_DEV_OFFLOAD_OUT) -+ goto skip_replay_window; -+ - switch (x->replay_esn->replay_window) { - case 32: - attrs->replay_esn.replay_window = -@@ -365,7 +370,7 @@ void mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry, - } - } - -- attrs->dir = x->xso.dir; -+skip_replay_window: - /* spi */ - attrs->spi = be32_to_cpu(x->id.spi); - -@@ -501,7 +506,8 @@ static int mlx5e_xfrm_validate_state(struct mlx5_core_dev *mdev, - return -EINVAL; - } - -- if (x->replay_esn && x->replay_esn->replay_window != 32 && -+ if (x->replay_esn && x->xso.dir == XFRM_DEV_OFFLOAD_IN && -+ x->replay_esn->replay_window != 32 && - x->replay_esn->replay_window != 64 && - x->replay_esn->replay_window != 128 && - x->replay_esn->replay_window != 256) { --- -2.43.2 - -From 66cc521a739ccd5da057a1cb3d6346c6d0e7619b Mon Sep 17 00:00:00 2001 -From: Zhipeng Lu <alexious@zju.edu.cn> -Date: Wed, 17 Jan 2024 15:17:36 +0800 -Subject: [PATCH 0866/1501] net/mlx5e: fix a double-free in arfs_create_groups -Content-Length: 2634 -Lines: 92 - -[ Upstream commit 3c6d5189246f590e4e1f167991558bdb72a4738b ] - -When `in` allocated by kvzalloc fails, arfs_create_groups will free -ft->g and return an error. However, arfs_create_table, the only caller of -arfs_create_groups, will hold this error and call to -mlx5e_destroy_flow_table, in which the ft->g will be freed again. - -Fixes: 1cabe6b0965e ("net/mlx5e: Create aRFS flow tables") -Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn> -Reviewed-by: Simon Horman <horms@kernel.org> -Signed-off-by: Saeed Mahameed <saeedm@nvidia.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../net/ethernet/mellanox/mlx5/core/en_arfs.c | 26 +++++++++++-------- - 1 file changed, 15 insertions(+), 11 deletions(-) - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c -index bb7f86c993e5..e66f486faafe 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c -@@ -254,11 +254,13 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, - - ft->g = kcalloc(MLX5E_ARFS_NUM_GROUPS, - sizeof(*ft->g), GFP_KERNEL); -- in = kvzalloc(inlen, GFP_KERNEL); -- if (!in || !ft->g) { -- kfree(ft->g); -- kvfree(in); -+ if (!ft->g) - return -ENOMEM; -+ -+ in = kvzalloc(inlen, GFP_KERNEL); -+ if (!in) { -+ err = -ENOMEM; -+ goto err_free_g; - } - - mc = MLX5_ADDR_OF(create_flow_group_in, in, match_criteria); -@@ -278,7 +280,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, - break; - default: - err = -EINVAL; -- goto out; -+ goto err_free_in; - } - - switch (type) { -@@ -300,7 +302,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, - break; - default: - err = -EINVAL; -- goto out; -+ goto err_free_in; - } - - MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS); -@@ -309,7 +311,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, - MLX5_SET_CFG(in, end_flow_index, ix - 1); - ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in); - if (IS_ERR(ft->g[ft->num_groups])) -- goto err; -+ goto err_clean_group; - ft->num_groups++; - - memset(in, 0, inlen); -@@ -318,18 +320,20 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, - MLX5_SET_CFG(in, end_flow_index, ix - 1); - ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in); - if (IS_ERR(ft->g[ft->num_groups])) -- goto err; -+ goto err_clean_group; - ft->num_groups++; - - kvfree(in); - return 0; - --err: -+err_clean_group: - err = PTR_ERR(ft->g[ft->num_groups]); - ft->g[ft->num_groups] = NULL; --out: -+err_free_in: - kvfree(in); -- -+err_free_g: -+ kfree(ft->g); -+ ft->g = NULL; - return err; - } - --- -2.43.2 - -From 65a4ade8a6d205979292e88beeb6a626ddbd4779 Mon Sep 17 00:00:00 2001 -From: Dinghao Liu <dinghao.liu@zju.edu.cn> -Date: Tue, 28 Nov 2023 17:29:01 +0800 -Subject: [PATCH 0867/1501] net/mlx5e: fix a potential double-free in - fs_any_create_groups -Content-Length: 1311 -Lines: 32 - -[ Upstream commit aef855df7e1bbd5aa4484851561211500b22707e ] - -When kcalloc() for ft->g succeeds but kvzalloc() for in fails, -fs_any_create_groups() will free ft->g. However, its caller -fs_any_create_table() will free ft->g again through calling -mlx5e_destroy_flow_table(), which will lead to a double-free. -Fix this by setting ft->g to NULL in fs_any_create_groups(). - -Fixes: 0f575c20bf06 ("net/mlx5e: Introduce Flow Steering ANY API") -Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> -Reviewed-by: Tariq Toukan <tariqt@nvidia.com> -Reviewed-by: Simon Horman <horms@kernel.org> -Signed-off-by: Saeed Mahameed <saeedm@nvidia.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c -index e1283531e0b8..671adbad0a40 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c -@@ -436,6 +436,7 @@ static int fs_any_create_groups(struct mlx5e_flow_table *ft) - in = kvzalloc(inlen, GFP_KERNEL); - if (!in || !ft->g) { - kfree(ft->g); -+ ft->g = NULL; - kvfree(in); - return -ENOMEM; - } --- -2.43.2 - -From b01ccd9f1c3d6220f1ce2e9e2eb009e98b11803c Mon Sep 17 00:00:00 2001 -From: Frederic Weisbecker <frederic@kernel.org> -Date: Tue, 19 Dec 2023 00:19:15 +0100 -Subject: [PATCH 0868/1501] rcu: Defer RCU kthreads wakeup when CPU is dying -Content-Length: 4755 -Lines: 133 - -[ Upstream commit e787644caf7628ad3269c1fbd321c3255cf51710 ] - -When the CPU goes idle for the last time during the CPU down hotplug -process, RCU reports a final quiescent state for the current CPU. If -this quiescent state propagates up to the top, some tasks may then be -woken up to complete the grace period: the main grace period kthread -and/or the expedited main workqueue (or kworker). - -If those kthreads have a SCHED_FIFO policy, the wake up can indirectly -arm the RT bandwith timer to the local offline CPU. Since this happens -after hrtimers have been migrated at CPUHP_AP_HRTIMERS_DYING stage, the -timer gets ignored. Therefore if the RCU kthreads are waiting for RT -bandwidth to be available, they may never be actually scheduled. - -This triggers TREE03 rcutorture hangs: - - rcu: INFO: rcu_preempt self-detected stall on CPU - rcu: 4-...!: (1 GPs behind) idle=9874/1/0x4000000000000000 softirq=0/0 fqs=20 rcuc=21071 jiffies(starved) - rcu: (t=21035 jiffies g=938281 q=40787 ncpus=6) - rcu: rcu_preempt kthread starved for 20964 jiffies! g938281 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 - rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. - rcu: RCU grace-period kthread stack dump: - task:rcu_preempt state:R running task stack:14896 pid:14 tgid:14 ppid:2 flags:0x00004000 - Call Trace: - <TASK> - __schedule+0x2eb/0xa80 - schedule+0x1f/0x90 - schedule_timeout+0x163/0x270 - ? __pfx_process_timeout+0x10/0x10 - rcu_gp_fqs_loop+0x37c/0x5b0 - ? __pfx_rcu_gp_kthread+0x10/0x10 - rcu_gp_kthread+0x17c/0x200 - kthread+0xde/0x110 - ? __pfx_kthread+0x10/0x10 - ret_from_fork+0x2b/0x40 - ? __pfx_kthread+0x10/0x10 - ret_from_fork_asm+0x1b/0x30 - </TASK> - -The situation can't be solved with just unpinning the timer. The hrtimer -infrastructure and the nohz heuristics involved in finding the best -remote target for an unpinned timer would then also need to handle -enqueues from an offline CPU in the most horrendous way. - -So fix this on the RCU side instead and defer the wake up to an online -CPU if it's too late for the local one. - -Reported-by: Paul E. McKenney <paulmck@kernel.org> -Fixes: 5c0930ccaad5 ("hrtimers: Push pending hrtimers away from outgoing CPU earlier") -Signed-off-by: Frederic Weisbecker <frederic@kernel.org> -Signed-off-by: Paul E. McKenney <paulmck@kernel.org> -Signed-off-by: Neeraj Upadhyay (AMD) <neeraj.iitr10@gmail.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - kernel/rcu/tree.c | 34 +++++++++++++++++++++++++++++++++- - kernel/rcu/tree_exp.h | 3 +-- - 2 files changed, 34 insertions(+), 3 deletions(-) - -diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c -index 3ac3c846105f..157f3ca2a9b5 100644 ---- a/kernel/rcu/tree.c -+++ b/kernel/rcu/tree.c -@@ -1013,6 +1013,38 @@ static bool rcu_future_gp_cleanup(struct rcu_node *rnp) - return needmore; - } - -+static void swake_up_one_online_ipi(void *arg) -+{ -+ struct swait_queue_head *wqh = arg; -+ -+ swake_up_one(wqh); -+} -+ -+static void swake_up_one_online(struct swait_queue_head *wqh) -+{ -+ int cpu = get_cpu(); -+ -+ /* -+ * If called from rcutree_report_cpu_starting(), wake up -+ * is dangerous that late in the CPU-down hotplug process. The -+ * scheduler might queue an ignored hrtimer. Defer the wake up -+ * to an online CPU instead. -+ */ -+ if (unlikely(cpu_is_offline(cpu))) { -+ int target; -+ -+ target = cpumask_any_and(housekeeping_cpumask(HK_TYPE_RCU), -+ cpu_online_mask); -+ -+ smp_call_function_single(target, swake_up_one_online_ipi, -+ wqh, 0); -+ put_cpu(); -+ } else { -+ put_cpu(); -+ swake_up_one(wqh); -+ } -+} -+ - /* - * Awaken the grace-period kthread. Don't do a self-awaken (unless in an - * interrupt or softirq handler, in which case we just might immediately -@@ -1037,7 +1069,7 @@ static void rcu_gp_kthread_wake(void) - return; - WRITE_ONCE(rcu_state.gp_wake_time, jiffies); - WRITE_ONCE(rcu_state.gp_wake_seq, READ_ONCE(rcu_state.gp_seq)); -- swake_up_one(&rcu_state.gp_wq); -+ swake_up_one_online(&rcu_state.gp_wq); - } - - /* -diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h -index 6d7cea5d591f..2ac440bc7e10 100644 ---- a/kernel/rcu/tree_exp.h -+++ b/kernel/rcu/tree_exp.h -@@ -173,7 +173,6 @@ static bool sync_rcu_exp_done_unlocked(struct rcu_node *rnp) - return ret; - } - -- - /* - * Report the exit from RCU read-side critical section for the last task - * that queued itself during or before the current expedited preemptible-RCU -@@ -201,7 +200,7 @@ static void __rcu_report_exp_rnp(struct rcu_node *rnp, - raw_spin_unlock_irqrestore_rcu_node(rnp, flags); - if (wake) { - smp_mb(); /* EGP done before wake_up(). */ -- swake_up_one(&rcu_state.expedited_wq); -+ swake_up_one_online(&rcu_state.expedited_wq); - } - break; - } --- -2.43.2 - -From 00c2c29aa36d1d1827c51a3720e9f893a22c7c6a Mon Sep 17 00:00:00 2001 -From: Florian Westphal <fw@strlen.de> -Date: Fri, 19 Jan 2024 13:11:32 +0100 -Subject: [PATCH 0869/1501] netfilter: nft_limit: reject configurations that - cause integer overflow -Content-Length: 2452 -Lines: 74 - -[ Upstream commit c9d9eb9c53d37cdebbad56b91e40baf42d5a97aa ] - -Reject bogus configs where internal token counter wraps around. -This only occurs with very very large requests, such as 17gbyte/s. - -Its better to reject this rather than having incorrect ratelimit. - -Fixes: d2168e849ebf ("netfilter: nft_limit: add per-byte limiting") -Signed-off-by: Florian Westphal <fw@strlen.de> -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nft_limit.c | 23 ++++++++++++++++------- - 1 file changed, 16 insertions(+), 7 deletions(-) - -diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c -index 79039afde34e..cefa25e0dbb0 100644 ---- a/net/netfilter/nft_limit.c -+++ b/net/netfilter/nft_limit.c -@@ -58,17 +58,19 @@ static inline bool nft_limit_eval(struct nft_limit_priv *priv, u64 cost) - static int nft_limit_init(struct nft_limit_priv *priv, - const struct nlattr * const tb[], bool pkts) - { -+ u64 unit, tokens, rate_with_burst; - bool invert = false; -- u64 unit, tokens; - - if (tb[NFTA_LIMIT_RATE] == NULL || - tb[NFTA_LIMIT_UNIT] == NULL) - return -EINVAL; - - priv->rate = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_RATE])); -+ if (priv->rate == 0) -+ return -EINVAL; -+ - unit = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_UNIT])); -- priv->nsecs = unit * NSEC_PER_SEC; -- if (priv->rate == 0 || priv->nsecs < unit) -+ if (check_mul_overflow(unit, NSEC_PER_SEC, &priv->nsecs)) - return -EOVERFLOW; - - if (tb[NFTA_LIMIT_BURST]) -@@ -77,18 +79,25 @@ static int nft_limit_init(struct nft_limit_priv *priv, - if (pkts && priv->burst == 0) - priv->burst = NFT_LIMIT_PKT_BURST_DEFAULT; - -- if (priv->rate + priv->burst < priv->rate) -+ if (check_add_overflow(priv->rate, priv->burst, &rate_with_burst)) - return -EOVERFLOW; - - if (pkts) { -- tokens = div64_u64(priv->nsecs, priv->rate) * priv->burst; -+ u64 tmp = div64_u64(priv->nsecs, priv->rate); -+ -+ if (check_mul_overflow(tmp, priv->burst, &tokens)) -+ return -EOVERFLOW; - } else { -+ u64 tmp; -+ - /* The token bucket size limits the number of tokens can be - * accumulated. tokens_max specifies the bucket size. - * tokens_max = unit * (rate + burst) / rate. - */ -- tokens = div64_u64(priv->nsecs * (priv->rate + priv->burst), -- priv->rate); -+ if (check_mul_overflow(priv->nsecs, rate_with_burst, &tmp)) -+ return -EOVERFLOW; -+ -+ tokens = div64_u64(tmp, priv->rate); - } - - if (tb[NFTA_LIMIT_FLAGS]) { --- -2.43.2 - -From 496f722faeab9b42318dc3b1fb9988e38b8e8718 Mon Sep 17 00:00:00 2001 -From: Florian Westphal <fw@strlen.de> -Date: Fri, 19 Jan 2024 13:34:32 +0100 -Subject: [PATCH 0870/1501] netfilter: nf_tables: restrict anonymous set and - map names to 16 bytes -Content-Length: 1846 -Lines: 51 - -[ Upstream commit b462579b2b86a8f5230543cadd3a4836be27baf7 ] - -nftables has two types of sets/maps, one where userspace defines the -name, and anonymous sets/maps, where userspace defines a template name. - -For the latter, kernel requires presence of exactly one "%d". -nftables uses "__set%d" and "__map%d" for this. The kernel will -expand the format specifier and replaces it with the smallest unused -number. - -As-is, userspace could define a template name that allows to move -the set name past the 256 bytes upperlimit (post-expansion). - -I don't see how this could be a problem, but I would prefer if userspace -cannot do this, so add a limit of 16 bytes for the '%d' template name. - -16 bytes is the old total upper limit for set names that existed when -nf_tables was merged initially. - -Fixes: 387454901bd6 ("netfilter: nf_tables: Allow set names of up to 255 chars") -Signed-off-by: Florian Westphal <fw@strlen.de> -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nf_tables_api.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index f032c29f1da6..5282e8377782 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -24,6 +24,7 @@ - #include <net/sock.h> - - #define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-")) -+#define NFT_SET_MAX_ANONLEN 16 - - unsigned int nf_tables_net_id __read_mostly; - -@@ -4411,6 +4412,9 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set, - if (p[1] != 'd' || strchr(p + 2, '%')) - return -EINVAL; - -+ if (strnlen(name, NFT_SET_MAX_ANONLEN) >= NFT_SET_MAX_ANONLEN) -+ return -EINVAL; -+ - inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL); - if (inuse == NULL) - return -ENOMEM; --- -2.43.2 - -From 86cca272a250cb6bc18a1ec96a4419cbcfa1108f Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso <pablo@netfilter.org> -Date: Tue, 23 Jan 2024 16:38:25 +0100 -Subject: [PATCH 0871/1501] netfilter: nf_tables: validate NFPROTO_* family -Content-Length: 6671 -Lines: 188 - -[ Upstream commit d0009effa8862c20a13af4cb7475d9771b905693 ] - -Several expressions explicitly refer to NF_INET_* hook definitions -from expr->ops->validate, however, family is not validated. - -Bail out with EOPNOTSUPP in case they are used from unsupported -families. - -Fixes: 0ca743a55991 ("netfilter: nf_tables: add compatibility layer for x_tables") -Fixes: a3c90f7a2323 ("netfilter: nf_tables: flow offload expression") -Fixes: 2fa841938c64 ("netfilter: nf_tables: introduce routing expression") -Fixes: 554ced0a6e29 ("netfilter: nf_tables: add support for native socket matching") -Fixes: ad49d86e07a4 ("netfilter: nf_tables: Add synproxy support") -Fixes: 4ed8eb6570a4 ("netfilter: nf_tables: Add native tproxy support") -Fixes: 6c47260250fc ("netfilter: nf_tables: add xfrm expression") -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nft_compat.c | 12 ++++++++++++ - net/netfilter/nft_flow_offload.c | 5 +++++ - net/netfilter/nft_nat.c | 5 +++++ - net/netfilter/nft_rt.c | 5 +++++ - net/netfilter/nft_socket.c | 5 +++++ - net/netfilter/nft_synproxy.c | 7 +++++-- - net/netfilter/nft_tproxy.c | 5 +++++ - net/netfilter/nft_xfrm.c | 5 +++++ - 8 files changed, 47 insertions(+), 2 deletions(-) - -diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c -index 5284cd2ad532..f0eeda97bfcd 100644 ---- a/net/netfilter/nft_compat.c -+++ b/net/netfilter/nft_compat.c -@@ -350,6 +350,12 @@ static int nft_target_validate(const struct nft_ctx *ctx, - unsigned int hook_mask = 0; - int ret; - -+ if (ctx->family != NFPROTO_IPV4 && -+ ctx->family != NFPROTO_IPV6 && -+ ctx->family != NFPROTO_BRIDGE && -+ ctx->family != NFPROTO_ARP) -+ return -EOPNOTSUPP; -+ - if (nft_is_base_chain(ctx->chain)) { - const struct nft_base_chain *basechain = - nft_base_chain(ctx->chain); -@@ -595,6 +601,12 @@ static int nft_match_validate(const struct nft_ctx *ctx, - unsigned int hook_mask = 0; - int ret; - -+ if (ctx->family != NFPROTO_IPV4 && -+ ctx->family != NFPROTO_IPV6 && -+ ctx->family != NFPROTO_BRIDGE && -+ ctx->family != NFPROTO_ARP) -+ return -EOPNOTSUPP; -+ - if (nft_is_base_chain(ctx->chain)) { - const struct nft_base_chain *basechain = - nft_base_chain(ctx->chain); -diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c -index ab3362c483b4..397351fa4d5f 100644 ---- a/net/netfilter/nft_flow_offload.c -+++ b/net/netfilter/nft_flow_offload.c -@@ -384,6 +384,11 @@ static int nft_flow_offload_validate(const struct nft_ctx *ctx, - { - unsigned int hook_mask = (1 << NF_INET_FORWARD); - -+ if (ctx->family != NFPROTO_IPV4 && -+ ctx->family != NFPROTO_IPV6 && -+ ctx->family != NFPROTO_INET) -+ return -EOPNOTSUPP; -+ - return nft_chain_validate_hooks(ctx->chain, hook_mask); - } - -diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c -index 583885ce7232..808f5802c270 100644 ---- a/net/netfilter/nft_nat.c -+++ b/net/netfilter/nft_nat.c -@@ -143,6 +143,11 @@ static int nft_nat_validate(const struct nft_ctx *ctx, - struct nft_nat *priv = nft_expr_priv(expr); - int err; - -+ if (ctx->family != NFPROTO_IPV4 && -+ ctx->family != NFPROTO_IPV6 && -+ ctx->family != NFPROTO_INET) -+ return -EOPNOTSUPP; -+ - err = nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT); - if (err < 0) - return err; -diff --git a/net/netfilter/nft_rt.c b/net/netfilter/nft_rt.c -index 35a2c28caa60..24d977138572 100644 ---- a/net/netfilter/nft_rt.c -+++ b/net/netfilter/nft_rt.c -@@ -166,6 +166,11 @@ static int nft_rt_validate(const struct nft_ctx *ctx, const struct nft_expr *exp - const struct nft_rt *priv = nft_expr_priv(expr); - unsigned int hooks; - -+ if (ctx->family != NFPROTO_IPV4 && -+ ctx->family != NFPROTO_IPV6 && -+ ctx->family != NFPROTO_INET) -+ return -EOPNOTSUPP; -+ - switch (priv->key) { - case NFT_RT_NEXTHOP4: - case NFT_RT_NEXTHOP6: -diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c -index 9ed85be79452..f30163e2ca62 100644 ---- a/net/netfilter/nft_socket.c -+++ b/net/netfilter/nft_socket.c -@@ -242,6 +242,11 @@ static int nft_socket_validate(const struct nft_ctx *ctx, - const struct nft_expr *expr, - const struct nft_data **data) - { -+ if (ctx->family != NFPROTO_IPV4 && -+ ctx->family != NFPROTO_IPV6 && -+ ctx->family != NFPROTO_INET) -+ return -EOPNOTSUPP; -+ - return nft_chain_validate_hooks(ctx->chain, - (1 << NF_INET_PRE_ROUTING) | - (1 << NF_INET_LOCAL_IN) | -diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c -index 13da882669a4..1d737f89dfc1 100644 ---- a/net/netfilter/nft_synproxy.c -+++ b/net/netfilter/nft_synproxy.c -@@ -186,7 +186,6 @@ static int nft_synproxy_do_init(const struct nft_ctx *ctx, - break; - #endif - case NFPROTO_INET: -- case NFPROTO_BRIDGE: - err = nf_synproxy_ipv4_init(snet, ctx->net); - if (err) - goto nf_ct_failure; -@@ -219,7 +218,6 @@ static void nft_synproxy_do_destroy(const struct nft_ctx *ctx) - break; - #endif - case NFPROTO_INET: -- case NFPROTO_BRIDGE: - nf_synproxy_ipv4_fini(snet, ctx->net); - nf_synproxy_ipv6_fini(snet, ctx->net); - break; -@@ -253,6 +251,11 @@ static int nft_synproxy_validate(const struct nft_ctx *ctx, - const struct nft_expr *expr, - const struct nft_data **data) - { -+ if (ctx->family != NFPROTO_IPV4 && -+ ctx->family != NFPROTO_IPV6 && -+ ctx->family != NFPROTO_INET) -+ return -EOPNOTSUPP; -+ - return nft_chain_validate_hooks(ctx->chain, (1 << NF_INET_LOCAL_IN) | - (1 << NF_INET_FORWARD)); - } -diff --git a/net/netfilter/nft_tproxy.c b/net/netfilter/nft_tproxy.c -index ae15cd693f0e..71412adb73d4 100644 ---- a/net/netfilter/nft_tproxy.c -+++ b/net/netfilter/nft_tproxy.c -@@ -316,6 +316,11 @@ static int nft_tproxy_validate(const struct nft_ctx *ctx, - const struct nft_expr *expr, - const struct nft_data **data) - { -+ if (ctx->family != NFPROTO_IPV4 && -+ ctx->family != NFPROTO_IPV6 && -+ ctx->family != NFPROTO_INET) -+ return -EOPNOTSUPP; -+ - return nft_chain_validate_hooks(ctx->chain, 1 << NF_INET_PRE_ROUTING); - } - -diff --git a/net/netfilter/nft_xfrm.c b/net/netfilter/nft_xfrm.c -index 452f8587adda..1c866757db55 100644 ---- a/net/netfilter/nft_xfrm.c -+++ b/net/netfilter/nft_xfrm.c -@@ -235,6 +235,11 @@ static int nft_xfrm_validate(const struct nft_ctx *ctx, const struct nft_expr *e - const struct nft_xfrm *priv = nft_expr_priv(expr); - unsigned int hooks; - -+ if (ctx->family != NFPROTO_IPV4 && -+ ctx->family != NFPROTO_IPV6 && -+ ctx->family != NFPROTO_INET) -+ return -EOPNOTSUPP; -+ - switch (priv->dir) { - case XFRM_POLICY_IN: - hooks = (1 << NF_INET_FORWARD) | --- -2.43.2 - -From 4e7ef904929b002f533ac7d5067e488f3b559d0b Mon Sep 17 00:00:00 2001 -From: Bernd Edlinger <bernd.edlinger@hotmail.de> -Date: Mon, 22 Jan 2024 19:19:09 +0100 -Subject: [PATCH 0872/1501] net: stmmac: Wait a bit for the reset to take - effect -Content-Length: 2443 -Lines: 55 - -[ Upstream commit a5f5eee282a0aae80227697e1d9c811b1726d31d ] - -otherwise the synopsys_id value may be read out wrong, -because the GMAC_VERSION register might still be in reset -state, for at least 1 us after the reset is de-asserted. - -Add a wait for 10 us before continuing to be on the safe side. - -> From what have you got that delay value? - -Just try and error, with very old linux versions and old gcc versions -the synopsys_id was read out correctly most of the time (but not always), -with recent linux versions and recnet gcc versions it was read out -wrongly most of the time, but again not always. -I don't have access to the VHDL code in question, so I cannot -tell why it takes so long to get the correct values, I also do not -have more than a few hardware samples, so I cannot tell how long -this timeout must be in worst case. -Experimentally I can tell that the register is read several times -as zero immediately after the reset is de-asserted, also adding several -no-ops is not enough, adding a printk is enough, also udelay(1) seems to -be enough but I tried that not very often, and I have not access to many -hardware samples to be 100% sure about the necessary delay. -And since the udelay here is only executed once per device instance, -it seems acceptable to delay the boot for 10 us. - -BTW: my hardware's synopsys id is 0x37. - -Fixes: c5e4ddbdfa11 ("net: stmmac: Add support for optional reset control") -Signed-off-by: Bernd Edlinger <bernd.edlinger@hotmail.de> -Reviewed-by: Jiri Pirko <jiri@nvidia.com> -Reviewed-by: Serge Semin <fancer.lancer@gmail.com> -Link: https://lore.kernel.org/r/AS8P193MB1285A810BD78C111E7F6AA34E4752@AS8P193MB1285.EURP193.PROD.OUTLOOK.COM -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index 49b81daf7411..d094c3c1e2ee 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -7467,6 +7467,9 @@ int stmmac_dvr_probe(struct device *device, - dev_err(priv->device, "unable to bring out of ahb reset: %pe\n", - ERR_PTR(ret)); - -+ /* Wait a bit for the reset to take effect */ -+ udelay(10); -+ - /* Init MAC and get the capabilities */ - ret = stmmac_hw_init(priv); - if (ret) --- -2.43.2 - -From dc77f6ab5c3759df60ff87ed24f4d45df0f3b4c4 Mon Sep 17 00:00:00 2001 -From: Jenishkumar Maheshbhai Patel <jpatel2@marvell.com> -Date: Thu, 18 Jan 2024 19:59:14 -0800 -Subject: [PATCH 0873/1501] net: mvpp2: clear BM pool before initialization -Content-Length: 2473 -Lines: 69 - -[ Upstream commit 9f538b415db862e74b8c5d3abbccfc1b2b6caa38 ] - -Register value persist after booting the kernel using -kexec which results in kernel panic. Thus clear the -BM pool registers before initialisation to fix the issue. - -Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit") -Signed-off-by: Jenishkumar Maheshbhai Patel <jpatel2@marvell.com> -Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> -Link: https://lore.kernel.org/r/20240119035914.2595665-1-jpatel2@marvell.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../net/ethernet/marvell/mvpp2/mvpp2_main.c | 27 ++++++++++++++++++- - 1 file changed, 26 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c -index 93137606869e..065f07392c96 100644 ---- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c -+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c -@@ -614,12 +614,38 @@ static void mvpp23_bm_set_8pool_mode(struct mvpp2 *priv) - mvpp2_write(priv, MVPP22_BM_POOL_BASE_ADDR_HIGH_REG, val); - } - -+/* Cleanup pool before actual initialization in the OS */ -+static void mvpp2_bm_pool_cleanup(struct mvpp2 *priv, int pool_id) -+{ -+ unsigned int thread = mvpp2_cpu_to_thread(priv, get_cpu()); -+ u32 val; -+ int i; -+ -+ /* Drain the BM from all possible residues left by firmware */ -+ for (i = 0; i < MVPP2_BM_POOL_SIZE_MAX; i++) -+ mvpp2_thread_read(priv, thread, MVPP2_BM_PHY_ALLOC_REG(pool_id)); -+ -+ put_cpu(); -+ -+ /* Stop the BM pool */ -+ val = mvpp2_read(priv, MVPP2_BM_POOL_CTRL_REG(pool_id)); -+ val |= MVPP2_BM_STOP_MASK; -+ mvpp2_write(priv, MVPP2_BM_POOL_CTRL_REG(pool_id), val); -+} -+ - static int mvpp2_bm_init(struct device *dev, struct mvpp2 *priv) - { - enum dma_data_direction dma_dir = DMA_FROM_DEVICE; - int i, err, poolnum = MVPP2_BM_POOLS_NUM; - struct mvpp2_port *port; - -+ if (priv->percpu_pools) -+ poolnum = mvpp2_get_nrxqs(priv) * 2; -+ -+ /* Clean up the pool state in case it contains stale state */ -+ for (i = 0; i < poolnum; i++) -+ mvpp2_bm_pool_cleanup(priv, i); -+ - if (priv->percpu_pools) { - for (i = 0; i < priv->port_count; i++) { - port = priv->port_list[i]; -@@ -629,7 +655,6 @@ static int mvpp2_bm_init(struct device *dev, struct mvpp2 *priv) - } - } - -- poolnum = mvpp2_get_nrxqs(priv) * 2; - for (i = 0; i < poolnum; i++) { - /* the pool in use */ - int pn = i / (poolnum / 2); --- -2.43.2 - -From c75708b288ae8713a0e1bdae4523814c16be63d3 Mon Sep 17 00:00:00 2001 -From: Maciej Fijalkowski <maciej.fijalkowski@intel.com> -Date: Wed, 24 Jan 2024 20:15:55 +0100 -Subject: [PATCH 0879/1501] ice: work on pre-XDP prog frag count -Content-Length: 6004 -Lines: 162 - -[ Upstream commit ad2047cf5d9313200e308612aed516548873d124 ] - -Fix an OOM panic in XDP_DRV mode when a XDP program shrinks a -multi-buffer packet by 4k bytes and then redirects it to an AF_XDP -socket. - -Since support for handling multi-buffer frames was added to XDP, usage -of bpf_xdp_adjust_tail() helper within XDP program can free the page -that given fragment occupies and in turn decrease the fragment count -within skb_shared_info that is embedded in xdp_buff struct. In current -ice driver codebase, it can become problematic when page recycling logic -decides not to reuse the page. In such case, __page_frag_cache_drain() -is used with ice_rx_buf::pagecnt_bias that was not adjusted after -refcount of page was changed by XDP prog which in turn does not drain -the refcount to 0 and page is never freed. - -To address this, let us store the count of frags before the XDP program -was executed on Rx ring struct. This will be used to compare with -current frag count from skb_shared_info embedded in xdp_buff. A smaller -value in the latter indicates that XDP prog freed frag(s). Then, for -given delta decrement pagecnt_bias for XDP_DROP verdict. - -While at it, let us also handle the EOP frag within -ice_set_rx_bufs_act() to make our life easier, so all of the adjustments -needed to be applied against freed frags are performed in the single -place. - -Fixes: 2fba7dc5157b ("ice: Add support for XDP multi-buffer on Rx side") -Acked-by: Magnus Karlsson <magnus.karlsson@intel.com> -Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> -Link: https://lore.kernel.org/r/20240124191602.566724-5-maciej.fijalkowski@intel.com -Signed-off-by: Alexei Starovoitov <ast@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/intel/ice/ice_txrx.c | 14 ++++++--- - drivers/net/ethernet/intel/ice/ice_txrx.h | 1 + - drivers/net/ethernet/intel/ice/ice_txrx_lib.h | 31 +++++++++++++------ - 3 files changed, 32 insertions(+), 14 deletions(-) - -diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c -index 9e97ea863068..6878448ba112 100644 ---- a/drivers/net/ethernet/intel/ice/ice_txrx.c -+++ b/drivers/net/ethernet/intel/ice/ice_txrx.c -@@ -600,9 +600,7 @@ ice_run_xdp(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp, - ret = ICE_XDP_CONSUMED; - } - exit: -- rx_buf->act = ret; -- if (unlikely(xdp_buff_has_frags(xdp))) -- ice_set_rx_bufs_act(xdp, rx_ring, ret); -+ ice_set_rx_bufs_act(xdp, rx_ring, ret); - } - - /** -@@ -890,14 +888,17 @@ ice_add_xdp_frag(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp, - } - - if (unlikely(sinfo->nr_frags == MAX_SKB_FRAGS)) { -- if (unlikely(xdp_buff_has_frags(xdp))) -- ice_set_rx_bufs_act(xdp, rx_ring, ICE_XDP_CONSUMED); -+ ice_set_rx_bufs_act(xdp, rx_ring, ICE_XDP_CONSUMED); - return -ENOMEM; - } - - __skb_fill_page_desc_noacc(sinfo, sinfo->nr_frags++, rx_buf->page, - rx_buf->page_offset, size); - sinfo->xdp_frags_size += size; -+ /* remember frag count before XDP prog execution; bpf_xdp_adjust_tail() -+ * can pop off frags but driver has to handle it on its own -+ */ -+ rx_ring->nr_frags = sinfo->nr_frags; - - if (page_is_pfmemalloc(rx_buf->page)) - xdp_buff_set_frag_pfmemalloc(xdp); -@@ -1249,6 +1250,7 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget) - - xdp->data = NULL; - rx_ring->first_desc = ntc; -+ rx_ring->nr_frags = 0; - continue; - construct_skb: - if (likely(ice_ring_uses_build_skb(rx_ring))) -@@ -1264,10 +1266,12 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget) - ICE_XDP_CONSUMED); - xdp->data = NULL; - rx_ring->first_desc = ntc; -+ rx_ring->nr_frags = 0; - break; - } - xdp->data = NULL; - rx_ring->first_desc = ntc; -+ rx_ring->nr_frags = 0; - - stat_err_bits = BIT(ICE_RX_FLEX_DESC_STATUS0_RXE_S); - if (unlikely(ice_test_staterr(rx_desc->wb.status_error0, -diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.h b/drivers/net/ethernet/intel/ice/ice_txrx.h -index daf7b9dbb143..b28b9826bbcd 100644 ---- a/drivers/net/ethernet/intel/ice/ice_txrx.h -+++ b/drivers/net/ethernet/intel/ice/ice_txrx.h -@@ -333,6 +333,7 @@ struct ice_rx_ring { - struct ice_channel *ch; - struct ice_tx_ring *xdp_ring; - struct xsk_buff_pool *xsk_pool; -+ u32 nr_frags; - dma_addr_t dma; /* physical address of ring */ - u64 cached_phctime; - u16 rx_buf_len; -diff --git a/drivers/net/ethernet/intel/ice/ice_txrx_lib.h b/drivers/net/ethernet/intel/ice/ice_txrx_lib.h -index 115969ecdf7b..b0e56675f98b 100644 ---- a/drivers/net/ethernet/intel/ice/ice_txrx_lib.h -+++ b/drivers/net/ethernet/intel/ice/ice_txrx_lib.h -@@ -12,26 +12,39 @@ - * act: action to store onto Rx buffers related to XDP buffer parts - * - * Set action that should be taken before putting Rx buffer from first frag -- * to one before last. Last one is handled by caller of this function as it -- * is the EOP frag that is currently being processed. This function is -- * supposed to be called only when XDP buffer contains frags. -+ * to the last. - */ - static inline void - ice_set_rx_bufs_act(struct xdp_buff *xdp, const struct ice_rx_ring *rx_ring, - const unsigned int act) - { -- const struct skb_shared_info *sinfo = xdp_get_shared_info_from_buff(xdp); -- u32 first = rx_ring->first_desc; -- u32 nr_frags = sinfo->nr_frags; -+ u32 sinfo_frags = xdp_get_shared_info_from_buff(xdp)->nr_frags; -+ u32 nr_frags = rx_ring->nr_frags + 1; -+ u32 idx = rx_ring->first_desc; - u32 cnt = rx_ring->count; - struct ice_rx_buf *buf; - - for (int i = 0; i < nr_frags; i++) { -- buf = &rx_ring->rx_buf[first]; -+ buf = &rx_ring->rx_buf[idx]; - buf->act = act; - -- if (++first == cnt) -- first = 0; -+ if (++idx == cnt) -+ idx = 0; -+ } -+ -+ /* adjust pagecnt_bias on frags freed by XDP prog */ -+ if (sinfo_frags < rx_ring->nr_frags && act == ICE_XDP_CONSUMED) { -+ u32 delta = rx_ring->nr_frags - sinfo_frags; -+ -+ while (delta) { -+ if (idx == 0) -+ idx = cnt - 1; -+ else -+ idx--; -+ buf = &rx_ring->rx_buf[idx]; -+ buf->pagecnt_bias--; -+ delta--; -+ } - } - } - --- -2.43.2 - -From 663e87702f446b18956b35b6df44ef6b3423cb3f Mon Sep 17 00:00:00 2001 -From: Maciej Fijalkowski <maciej.fijalkowski@intel.com> -Date: Wed, 24 Jan 2024 20:15:57 +0100 -Subject: [PATCH 0881/1501] ice: remove redundant xdp_rxq_info registration -Content-Length: 2108 -Lines: 50 - -[ Upstream commit 2ee788c06493d02ee85855414cca39825e768aaf ] - -xdp_rxq_info struct can be registered by drivers via two functions - -xdp_rxq_info_reg() and __xdp_rxq_info_reg(). The latter one allows -drivers that support XDP multi-buffer to set up xdp_rxq_info::frag_size -which in turn will make it possible to grow the packet via -bpf_xdp_adjust_tail() BPF helper. - -Currently, ice registers xdp_rxq_info in two spots: -1) ice_setup_rx_ring() // via xdp_rxq_info_reg(), BUG -2) ice_vsi_cfg_rxq() // via __xdp_rxq_info_reg(), OK - -Cited commit under fixes tag took care of setting up frag_size and -updated registration scheme in 2) but it did not help as -1) is called before 2) and as shown above it uses old registration -function. This means that 2) sees that xdp_rxq_info is already -registered and never calls __xdp_rxq_info_reg() which leaves us with -xdp_rxq_info::frag_size being set to 0. - -To fix this misbehavior, simply remove xdp_rxq_info_reg() call from -ice_setup_rx_ring(). - -Fixes: 2fba7dc5157b ("ice: Add support for XDP multi-buffer on Rx side") -Acked-by: Magnus Karlsson <magnus.karlsson@intel.com> -Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> -Link: https://lore.kernel.org/r/20240124191602.566724-7-maciej.fijalkowski@intel.com -Signed-off-by: Alexei Starovoitov <ast@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/intel/ice/ice_txrx.c | 5 ----- - 1 file changed, 5 deletions(-) - -diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c -index 6878448ba112..9170a3e8f088 100644 ---- a/drivers/net/ethernet/intel/ice/ice_txrx.c -+++ b/drivers/net/ethernet/intel/ice/ice_txrx.c -@@ -513,11 +513,6 @@ int ice_setup_rx_ring(struct ice_rx_ring *rx_ring) - if (ice_is_xdp_ena_vsi(rx_ring->vsi)) - WRITE_ONCE(rx_ring->xdp_prog, rx_ring->vsi->xdp_prog); - -- if (rx_ring->vsi->type == ICE_VSI_PF && -- !xdp_rxq_info_is_reg(&rx_ring->xdp_rxq)) -- if (xdp_rxq_info_reg(&rx_ring->xdp_rxq, rx_ring->netdev, -- rx_ring->q_index, rx_ring->q_vector->napi.napi_id)) -- goto err; - return 0; - - err: --- -2.43.2 - -From 8bd491e5dcb55269856db759a14ba796cf0b05c9 Mon Sep 17 00:00:00 2001 -From: Maciej Fijalkowski <maciej.fijalkowski@intel.com> -Date: Wed, 24 Jan 2024 20:15:59 +0100 -Subject: [PATCH 0883/1501] ice: update xdp_rxq_info::frag_size for ZC enabled - Rx queue -Content-Length: 3045 -Lines: 83 - -[ Upstream commit 3de38c87174225487fc93befeea7d380db80aef6 ] - -Now that ice driver correctly sets up frag_size in xdp_rxq_info, let us -make it work for ZC multi-buffer as well. ice_rx_ring::rx_buf_len for ZC -is being set via xsk_pool_get_rx_frame_size() and this needs to be -propagated up to xdp_rxq_info. - -Use a bigger hammer and instead of unregistering only xdp_rxq_info's -memory model, unregister it altogether and register it again and have -xdp_rxq_info with correct frag_size value. - -Fixes: 1bbc04de607b ("ice: xsk: add RX multi-buffer support") -Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> -Link: https://lore.kernel.org/r/20240124191602.566724-9-maciej.fijalkowski@intel.com -Signed-off-by: Alexei Starovoitov <ast@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/intel/ice/ice_base.c | 37 ++++++++++++++--------- - 1 file changed, 23 insertions(+), 14 deletions(-) - -diff --git a/drivers/net/ethernet/intel/ice/ice_base.c b/drivers/net/ethernet/intel/ice/ice_base.c -index 7fa43827a3f0..4f3e65b47cdc 100644 ---- a/drivers/net/ethernet/intel/ice/ice_base.c -+++ b/drivers/net/ethernet/intel/ice/ice_base.c -@@ -534,19 +534,27 @@ int ice_vsi_cfg_rxq(struct ice_rx_ring *ring) - ring->rx_buf_len = ring->vsi->rx_buf_len; - - if (ring->vsi->type == ICE_VSI_PF) { -- if (!xdp_rxq_info_is_reg(&ring->xdp_rxq)) -- /* coverity[check_return] */ -- __xdp_rxq_info_reg(&ring->xdp_rxq, ring->netdev, -- ring->q_index, -- ring->q_vector->napi.napi_id, -- ring->vsi->rx_buf_len); -+ if (!xdp_rxq_info_is_reg(&ring->xdp_rxq)) { -+ err = __xdp_rxq_info_reg(&ring->xdp_rxq, ring->netdev, -+ ring->q_index, -+ ring->q_vector->napi.napi_id, -+ ring->rx_buf_len); -+ if (err) -+ return err; -+ } - - ring->xsk_pool = ice_xsk_pool(ring); - if (ring->xsk_pool) { -- xdp_rxq_info_unreg_mem_model(&ring->xdp_rxq); -+ xdp_rxq_info_unreg(&ring->xdp_rxq); - - ring->rx_buf_len = - xsk_pool_get_rx_frame_size(ring->xsk_pool); -+ err = __xdp_rxq_info_reg(&ring->xdp_rxq, ring->netdev, -+ ring->q_index, -+ ring->q_vector->napi.napi_id, -+ ring->rx_buf_len); -+ if (err) -+ return err; - err = xdp_rxq_info_reg_mem_model(&ring->xdp_rxq, - MEM_TYPE_XSK_BUFF_POOL, - NULL); -@@ -557,13 +565,14 @@ int ice_vsi_cfg_rxq(struct ice_rx_ring *ring) - dev_info(dev, "Registered XDP mem model MEM_TYPE_XSK_BUFF_POOL on Rx ring %d\n", - ring->q_index); - } else { -- if (!xdp_rxq_info_is_reg(&ring->xdp_rxq)) -- /* coverity[check_return] */ -- __xdp_rxq_info_reg(&ring->xdp_rxq, -- ring->netdev, -- ring->q_index, -- ring->q_vector->napi.napi_id, -- ring->vsi->rx_buf_len); -+ if (!xdp_rxq_info_is_reg(&ring->xdp_rxq)) { -+ err = __xdp_rxq_info_reg(&ring->xdp_rxq, ring->netdev, -+ ring->q_index, -+ ring->q_vector->napi.napi_id, -+ ring->rx_buf_len); -+ if (err) -+ return err; -+ } - - err = xdp_rxq_info_reg_mem_model(&ring->xdp_rxq, - MEM_TYPE_PAGE_SHARED, --- -2.43.2 - -From 7113fa239a4ef03bce5b8d4ec9b24b740ca26743 Mon Sep 17 00:00:00 2001 -From: Maciej Fijalkowski <maciej.fijalkowski@intel.com> -Date: Wed, 24 Jan 2024 20:16:01 +0100 -Subject: [PATCH 0885/1501] i40e: set xdp_rxq_info::frag_size -Content-Length: 4178 -Lines: 122 - -[ Upstream commit a045d2f2d03d23e7db6772dd83e0ba2705dfad93 ] - -i40e support XDP multi-buffer so it is supposed to use -__xdp_rxq_info_reg() instead of xdp_rxq_info_reg() and set the -frag_size. It can not be simply converted at existing callsite because -rx_buf_len could be un-initialized, so let us register xdp_rxq_info -within i40e_configure_rx_ring(), which happen to be called with already -initialized rx_buf_len value. - -Commit 5180ff1364bc ("i40e: use int for i40e_status") converted 'err' to -int, so two variables to deal with return codes are not needed within -i40e_configure_rx_ring(). Remove 'ret' and use 'err' to handle status -from xdp_rxq_info registration. - -Fixes: e213ced19bef ("i40e: add support for XDP multi-buffer Rx") -Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> -Link: https://lore.kernel.org/r/20240124191602.566724-11-maciej.fijalkowski@intel.com -Signed-off-by: Alexei Starovoitov <ast@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/intel/i40e/i40e_main.c | 40 ++++++++++++--------- - drivers/net/ethernet/intel/i40e/i40e_txrx.c | 9 ----- - 2 files changed, 24 insertions(+), 25 deletions(-) - -diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c -index d5519af34657..f97a63812141 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_main.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c -@@ -3588,40 +3588,48 @@ static int i40e_configure_rx_ring(struct i40e_ring *ring) - struct i40e_hmc_obj_rxq rx_ctx; - int err = 0; - bool ok; -- int ret; - - bitmap_zero(ring->state, __I40E_RING_STATE_NBITS); - - /* clear the context structure first */ - memset(&rx_ctx, 0, sizeof(rx_ctx)); - -- if (ring->vsi->type == I40E_VSI_MAIN) -- xdp_rxq_info_unreg_mem_model(&ring->xdp_rxq); -+ ring->rx_buf_len = vsi->rx_buf_len; -+ -+ /* XDP RX-queue info only needed for RX rings exposed to XDP */ -+ if (ring->vsi->type != I40E_VSI_MAIN) -+ goto skip; -+ -+ if (!xdp_rxq_info_is_reg(&ring->xdp_rxq)) { -+ err = __xdp_rxq_info_reg(&ring->xdp_rxq, ring->netdev, -+ ring->queue_index, -+ ring->q_vector->napi.napi_id, -+ ring->rx_buf_len); -+ if (err) -+ return err; -+ } - - ring->xsk_pool = i40e_xsk_pool(ring); - if (ring->xsk_pool) { -- ring->rx_buf_len = -- xsk_pool_get_rx_frame_size(ring->xsk_pool); -- ret = xdp_rxq_info_reg_mem_model(&ring->xdp_rxq, -+ ring->rx_buf_len = xsk_pool_get_rx_frame_size(ring->xsk_pool); -+ err = xdp_rxq_info_reg_mem_model(&ring->xdp_rxq, - MEM_TYPE_XSK_BUFF_POOL, - NULL); -- if (ret) -- return ret; -+ if (err) -+ return err; - dev_info(&vsi->back->pdev->dev, - "Registered XDP mem model MEM_TYPE_XSK_BUFF_POOL on Rx ring %d\n", - ring->queue_index); - - } else { -- ring->rx_buf_len = vsi->rx_buf_len; -- if (ring->vsi->type == I40E_VSI_MAIN) { -- ret = xdp_rxq_info_reg_mem_model(&ring->xdp_rxq, -- MEM_TYPE_PAGE_SHARED, -- NULL); -- if (ret) -- return ret; -- } -+ err = xdp_rxq_info_reg_mem_model(&ring->xdp_rxq, -+ MEM_TYPE_PAGE_SHARED, -+ NULL); -+ if (err) -+ return err; - } - -+skip: - xdp_init_buff(&ring->xdp, i40e_rx_pg_size(ring) / 2, &ring->xdp_rxq); - - rx_ctx.dbuff = DIV_ROUND_UP(ring->rx_buf_len, -diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c -index 35e1bb6fe5e1..071ef309a3a4 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c -@@ -1555,7 +1555,6 @@ void i40e_free_rx_resources(struct i40e_ring *rx_ring) - int i40e_setup_rx_descriptors(struct i40e_ring *rx_ring) - { - struct device *dev = rx_ring->dev; -- int err; - - u64_stats_init(&rx_ring->syncp); - -@@ -1576,14 +1575,6 @@ int i40e_setup_rx_descriptors(struct i40e_ring *rx_ring) - rx_ring->next_to_process = 0; - rx_ring->next_to_use = 0; - -- /* XDP RX-queue info only needed for RX rings exposed to XDP */ -- if (rx_ring->vsi->type == I40E_VSI_MAIN) { -- err = xdp_rxq_info_reg(&rx_ring->xdp_rxq, rx_ring->netdev, -- rx_ring->queue_index, rx_ring->q_vector->napi.napi_id); -- if (err < 0) -- return err; -- } -- - rx_ring->xdp_prog = rx_ring->vsi->xdp_prog; - - rx_ring->rx_bi = --- -2.43.2 - -From 3df7f34a7d4237a9a18eae04510e6b149f2b60fb Mon Sep 17 00:00:00 2001 -From: Maciej Fijalkowski <maciej.fijalkowski@intel.com> -Date: Wed, 24 Jan 2024 20:16:02 +0100 -Subject: [PATCH 0886/1501] i40e: update xdp_rxq_info::frag_size for ZC enabled - Rx queue -Content-Length: 1546 -Lines: 38 - -[ Upstream commit 0cbb08707c932b3f004bc1a8ec6200ef572c1f5f ] - -Now that i40e driver correctly sets up frag_size in xdp_rxq_info, let us -make it work for ZC multi-buffer as well. i40e_ring::rx_buf_len for ZC -is being set via xsk_pool_get_rx_frame_size() and this needs to be -propagated up to xdp_rxq_info. - -Fixes: 1c9ba9c14658 ("i40e: xsk: add RX multi-buffer support") -Acked-by: Magnus Karlsson <magnus.karlsson@intel.com> -Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> -Link: https://lore.kernel.org/r/20240124191602.566724-12-maciej.fijalkowski@intel.com -Signed-off-by: Alexei Starovoitov <ast@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/intel/i40e/i40e_main.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c -index f97a63812141..2bd7b29fb251 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_main.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c -@@ -3611,7 +3611,14 @@ static int i40e_configure_rx_ring(struct i40e_ring *ring) - - ring->xsk_pool = i40e_xsk_pool(ring); - if (ring->xsk_pool) { -+ xdp_rxq_info_unreg(&ring->xdp_rxq); - ring->rx_buf_len = xsk_pool_get_rx_frame_size(ring->xsk_pool); -+ err = __xdp_rxq_info_reg(&ring->xdp_rxq, ring->netdev, -+ ring->queue_index, -+ ring->q_vector->napi.napi_id, -+ ring->rx_buf_len); -+ if (err) -+ return err; - err = xdp_rxq_info_reg_mem_model(&ring->xdp_rxq, - MEM_TYPE_XSK_BUFF_POOL, - NULL); --- -2.43.2 - -From 4f060f6bccbf49afed27e3d13bed821053811e15 Mon Sep 17 00:00:00 2001 -From: Zhipeng Lu <alexious@zju.edu.cn> -Date: Tue, 23 Jan 2024 01:24:42 +0800 -Subject: [PATCH 0887/1501] fjes: fix memleaks in fjes_hw_setup -Content-Length: 3011 -Lines: 101 - -[ Upstream commit f6cc4b6a3ae53df425771000e9c9540cce9b7bb1 ] - -In fjes_hw_setup, it allocates several memory and delay the deallocation -to the fjes_hw_exit in fjes_probe through the following call chain: - -fjes_probe - |-> fjes_hw_init - |-> fjes_hw_setup - |-> fjes_hw_exit - -However, when fjes_hw_setup fails, fjes_hw_exit won't be called and thus -all the resources allocated in fjes_hw_setup will be leaked. In this -patch, we free those resources in fjes_hw_setup and prevents such leaks. - -Fixes: 2fcbca687702 ("fjes: platform_driver's .probe and .remove routine") -Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn> -Reviewed-by: Simon Horman <horms@kernel.org> -Link: https://lore.kernel.org/r/20240122172445.3841883-1-alexious@zju.edu.cn -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/fjes/fjes_hw.c | 37 ++++++++++++++++++++++++++++++------- - 1 file changed, 30 insertions(+), 7 deletions(-) - -diff --git a/drivers/net/fjes/fjes_hw.c b/drivers/net/fjes/fjes_hw.c -index 704e949484d0..b9b5554ea862 100644 ---- a/drivers/net/fjes/fjes_hw.c -+++ b/drivers/net/fjes/fjes_hw.c -@@ -221,21 +221,25 @@ static int fjes_hw_setup(struct fjes_hw *hw) - - mem_size = FJES_DEV_REQ_BUF_SIZE(hw->max_epid); - hw->hw_info.req_buf = kzalloc(mem_size, GFP_KERNEL); -- if (!(hw->hw_info.req_buf)) -- return -ENOMEM; -+ if (!(hw->hw_info.req_buf)) { -+ result = -ENOMEM; -+ goto free_ep_info; -+ } - - hw->hw_info.req_buf_size = mem_size; - - mem_size = FJES_DEV_RES_BUF_SIZE(hw->max_epid); - hw->hw_info.res_buf = kzalloc(mem_size, GFP_KERNEL); -- if (!(hw->hw_info.res_buf)) -- return -ENOMEM; -+ if (!(hw->hw_info.res_buf)) { -+ result = -ENOMEM; -+ goto free_req_buf; -+ } - - hw->hw_info.res_buf_size = mem_size; - - result = fjes_hw_alloc_shared_status_region(hw); - if (result) -- return result; -+ goto free_res_buf; - - hw->hw_info.buffer_share_bit = 0; - hw->hw_info.buffer_unshare_reserve_bit = 0; -@@ -246,11 +250,11 @@ static int fjes_hw_setup(struct fjes_hw *hw) - - result = fjes_hw_alloc_epbuf(&buf_pair->tx); - if (result) -- return result; -+ goto free_epbuf; - - result = fjes_hw_alloc_epbuf(&buf_pair->rx); - if (result) -- return result; -+ goto free_epbuf; - - spin_lock_irqsave(&hw->rx_status_lock, flags); - fjes_hw_setup_epbuf(&buf_pair->tx, mac, -@@ -273,6 +277,25 @@ static int fjes_hw_setup(struct fjes_hw *hw) - fjes_hw_init_command_registers(hw, ¶m); - - return 0; -+ -+free_epbuf: -+ for (epidx = 0; epidx < hw->max_epid ; epidx++) { -+ if (epidx == hw->my_epid) -+ continue; -+ fjes_hw_free_epbuf(&hw->ep_shm_info[epidx].tx); -+ fjes_hw_free_epbuf(&hw->ep_shm_info[epidx].rx); -+ } -+ fjes_hw_free_shared_status_region(hw); -+free_res_buf: -+ kfree(hw->hw_info.res_buf); -+ hw->hw_info.res_buf = NULL; -+free_req_buf: -+ kfree(hw->hw_info.req_buf); -+ hw->hw_info.req_buf = NULL; -+free_ep_info: -+ kfree(hw->ep_shm_info); -+ hw->ep_shm_info = NULL; -+ return result; - } - - static void fjes_hw_cleanup(struct fjes_hw *hw) --- -2.43.2 - -From 9216b473c693417674d51faa67ce4aecdb9e5653 Mon Sep 17 00:00:00 2001 -From: Shenwei Wang <shenwei.wang@nxp.com> -Date: Tue, 23 Jan 2024 10:51:41 -0600 -Subject: [PATCH 0889/1501] net: fec: fix the unhandled context fault from smmu -Content-Length: 1932 -Lines: 50 - -[ Upstream commit 5e344807735023cd3a67c37a1852b849caa42620 ] - -When repeatedly changing the interface link speed using the command below: - -ethtool -s eth0 speed 100 duplex full -ethtool -s eth0 speed 1000 duplex full - -The following errors may sometimes be reported by the ARM SMMU driver: - -[ 5395.035364] fec 5b040000.ethernet eth0: Link is Down -[ 5395.039255] arm-smmu 51400000.iommu: Unhandled context fault: -fsr=0x402, iova=0x00000000, fsynr=0x100001, cbfrsynra=0x852, cb=2 -[ 5398.108460] fec 5b040000.ethernet eth0: Link is Up - 100Mbps/Full - -flow control off - -It is identified that the FEC driver does not properly stop the TX queue -during the link speed transitions, and this results in the invalid virtual -I/O address translations from the SMMU and causes the context faults. - -Fixes: dbc64a8ea231 ("net: fec: move calls to quiesce/resume packet processing out of fec_restart()") -Signed-off-by: Shenwei Wang <shenwei.wang@nxp.com> -Link: https://lore.kernel.org/r/20240123165141.2008104-1-shenwei.wang@nxp.com -Signed-off-by: Paolo Abeni <pabeni@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/freescale/fec_main.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c -index e08c7b572497..c107680985e4 100644 ---- a/drivers/net/ethernet/freescale/fec_main.c -+++ b/drivers/net/ethernet/freescale/fec_main.c -@@ -2036,6 +2036,7 @@ static void fec_enet_adjust_link(struct net_device *ndev) - - /* if any of the above changed restart the FEC */ - if (status_change) { -+ netif_stop_queue(ndev); - napi_disable(&fep->napi); - netif_tx_lock_bh(ndev); - fec_restart(ndev); -@@ -2045,6 +2046,7 @@ static void fec_enet_adjust_link(struct net_device *ndev) - } - } else { - if (fep->link) { -+ netif_stop_queue(ndev); - napi_disable(&fep->napi); - netif_tx_lock_bh(ndev); - fec_stop(ndev); --- -2.43.2 - -From 9db354014dce82292586d2909b8c0e7995f19227 Mon Sep 17 00:00:00 2001 -From: Gerhard Engleder <gerhard@engleder-embedded.com> -Date: Tue, 23 Jan 2024 21:09:17 +0100 -Subject: [PATCH 0890/1501] tsnep: Remove FCS for XDP data path -Content-Length: 1714 -Lines: 41 - -[ Upstream commit 50bad6f797d4d501c5ef416a6f92e1912ab5aa8b ] - -The RX data buffer includes the FCS. The FCS is already stripped for the -normal data path. But for the XDP data path the FCS is included and -acts like additional/useless data. - -Remove the FCS from the RX data buffer also for XDP. - -Fixes: 65b28c810035 ("tsnep: Add XDP RX support") -Fixes: 3fc2333933fd ("tsnep: Add XDP socket zero-copy RX support") -Signed-off-by: Gerhard Engleder <gerhard@engleder-embedded.com> -Signed-off-by: Paolo Abeni <pabeni@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/engleder/tsnep_main.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/ethernet/engleder/tsnep_main.c b/drivers/net/ethernet/engleder/tsnep_main.c -index df40c720e7b2..456e0336f3f6 100644 ---- a/drivers/net/ethernet/engleder/tsnep_main.c -+++ b/drivers/net/ethernet/engleder/tsnep_main.c -@@ -1485,7 +1485,7 @@ static int tsnep_rx_poll(struct tsnep_rx *rx, struct napi_struct *napi, - - xdp_prepare_buff(&xdp, page_address(entry->page), - XDP_PACKET_HEADROOM + TSNEP_RX_INLINE_METADATA_SIZE, -- length, false); -+ length - ETH_FCS_LEN, false); - - consume = tsnep_xdp_run_prog(rx, prog, &xdp, - &xdp_status, tx_nq, tx); -@@ -1568,7 +1568,7 @@ static int tsnep_rx_poll_zc(struct tsnep_rx *rx, struct napi_struct *napi, - prefetch(entry->xdp->data); - length = __le32_to_cpu(entry->desc_wb->properties) & - TSNEP_DESC_LENGTH_MASK; -- xsk_buff_set_size(entry->xdp, length); -+ xsk_buff_set_size(entry->xdp, length - ETH_FCS_LEN); - xsk_buff_dma_sync_for_cpu(entry->xdp, rx->xsk_pool); - - /* RX metadata with timestamps is in front of actual data, --- -2.43.2 - -From 246f72777e887f69c052129671c2e1dd009fea50 Mon Sep 17 00:00:00 2001 -From: Gerhard Engleder <gerhard@engleder-embedded.com> -Date: Tue, 23 Jan 2024 21:09:18 +0100 -Subject: [PATCH 0891/1501] tsnep: Fix XDP_RING_NEED_WAKEUP for empty fill ring -Content-Length: 1567 -Lines: 44 - -[ Upstream commit 9a91c05f4bd6f6bdd6b8f90445e0da92e3ac956c ] - -The fill ring of the XDP socket may contain not enough buffers to -completey fill the RX queue during socket creation. In this case the -flag XDP_RING_NEED_WAKEUP is not set as this flag is only set if the RX -queue is not completely filled during polling. - -Set XDP_RING_NEED_WAKEUP flag also if RX queue is not completely filled -during XDP socket creation. - -Fixes: 3fc2333933fd ("tsnep: Add XDP socket zero-copy RX support") -Signed-off-by: Gerhard Engleder <gerhard@engleder-embedded.com> -Signed-off-by: Paolo Abeni <pabeni@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/engleder/tsnep_main.c | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - -diff --git a/drivers/net/ethernet/engleder/tsnep_main.c b/drivers/net/ethernet/engleder/tsnep_main.c -index 456e0336f3f6..9aeff2b37a61 100644 ---- a/drivers/net/ethernet/engleder/tsnep_main.c -+++ b/drivers/net/ethernet/engleder/tsnep_main.c -@@ -1762,6 +1762,19 @@ static void tsnep_rx_reopen_xsk(struct tsnep_rx *rx) - allocated--; - } - } -+ -+ /* set need wakeup flag immediately if ring is not filled completely, -+ * first polling would be too late as need wakeup signalisation would -+ * be delayed for an indefinite time -+ */ -+ if (xsk_uses_need_wakeup(rx->xsk_pool)) { -+ int desc_available = tsnep_rx_desc_available(rx); -+ -+ if (desc_available) -+ xsk_set_rx_need_wakeup(rx->xsk_pool); -+ else -+ xsk_clear_rx_need_wakeup(rx->xsk_pool); -+ } - } - - static bool tsnep_pending(struct tsnep_queue *queue) --- -2.43.2 - -From 1908e9d01e5395adff68d9d308a0fb15337e6272 Mon Sep 17 00:00:00 2001 -From: Naohiro Aota <naohiro.aota@wdc.com> -Date: Fri, 22 Dec 2023 13:56:34 +0900 -Subject: [PATCH 0892/1501] btrfs: zoned: fix lock ordering in - btrfs_zone_activate() -Content-Length: 3372 -Lines: 96 - -commit b18f3b60b35a8c01c9a2a0f0d6424c6d73971dc3 upstream. - -The btrfs CI reported a lockdep warning as follows by running generic -generic/129. - - WARNING: possible circular locking dependency detected - 6.7.0-rc5+ #1 Not tainted - ------------------------------------------------------ - kworker/u5:5/793427 is trying to acquire lock: - ffff88813256d028 (&cache->lock){+.+.}-{2:2}, at: btrfs_zone_finish_one_bg+0x5e/0x130 - but task is already holding lock: - ffff88810a23a318 (&fs_info->zone_active_bgs_lock){+.+.}-{2:2}, at: btrfs_zone_finish_one_bg+0x34/0x130 - which lock already depends on the new lock. - - the existing dependency chain (in reverse order) is: - -> #1 (&fs_info->zone_active_bgs_lock){+.+.}-{2:2}: - ... - -> #0 (&cache->lock){+.+.}-{2:2}: - ... - -This is because we take fs_info->zone_active_bgs_lock after a block_group's -lock in btrfs_zone_activate() while doing the opposite in other places. - -Fix the issue by expanding the fs_info->zone_active_bgs_lock's critical -section and taking it before a block_group's lock. - -Fixes: a7e1ac7bdc5a ("btrfs: zoned: reserve zones for an active metadata/system block group") -CC: stable@vger.kernel.org # 6.6 -Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com> -Reviewed-by: David Sterba <dsterba@suse.com> -Signed-off-by: David Sterba <dsterba@suse.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/btrfs/zoned.c | 8 ++------ - 1 file changed, 2 insertions(+), 6 deletions(-) - -diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c -index 188378ca19c7..3779e76a15d6 100644 ---- a/fs/btrfs/zoned.c -+++ b/fs/btrfs/zoned.c -@@ -2094,6 +2094,7 @@ bool btrfs_zone_activate(struct btrfs_block_group *block_group) - - map = block_group->physical_map; - -+ spin_lock(&fs_info->zone_active_bgs_lock); - spin_lock(&block_group->lock); - if (test_bit(BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE, &block_group->runtime_flags)) { - ret = true; -@@ -2106,7 +2107,6 @@ bool btrfs_zone_activate(struct btrfs_block_group *block_group) - goto out_unlock; - } - -- spin_lock(&fs_info->zone_active_bgs_lock); - for (i = 0; i < map->num_stripes; i++) { - struct btrfs_zoned_device_info *zinfo; - int reserved = 0; -@@ -2126,20 +2126,17 @@ bool btrfs_zone_activate(struct btrfs_block_group *block_group) - */ - if (atomic_read(&zinfo->active_zones_left) <= reserved) { - ret = false; -- spin_unlock(&fs_info->zone_active_bgs_lock); - goto out_unlock; - } - - if (!btrfs_dev_set_active_zone(device, physical)) { - /* Cannot activate the zone */ - ret = false; -- spin_unlock(&fs_info->zone_active_bgs_lock); - goto out_unlock; - } - if (!is_data) - zinfo->reserved_active_zones--; - } -- spin_unlock(&fs_info->zone_active_bgs_lock); - - /* Successfully activated all the zones */ - set_bit(BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE, &block_group->runtime_flags); -@@ -2147,8 +2144,6 @@ bool btrfs_zone_activate(struct btrfs_block_group *block_group) - - /* For the active block group list */ - btrfs_get_block_group(block_group); -- -- spin_lock(&fs_info->zone_active_bgs_lock); - list_add_tail(&block_group->active_bg_list, &fs_info->zone_active_bgs); - spin_unlock(&fs_info->zone_active_bgs_lock); - -@@ -2156,6 +2151,7 @@ bool btrfs_zone_activate(struct btrfs_block_group *block_group) - - out_unlock: - spin_unlock(&block_group->lock); -+ spin_unlock(&fs_info->zone_active_bgs_lock); - return ret; - } - --- -2.43.2 - -From 337c5da28f1f6f18fabf6690d1185111a6094f29 Mon Sep 17 00:00:00 2001 -From: Omar Sandoval <osandov@fb.com> -Date: Thu, 4 Jan 2024 11:48:47 -0800 -Subject: [PATCH 0893/1501] btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to - snapshot of subvolume being deleted -Content-Length: 4029 -Lines: 113 - -commit 3324d0547861b16cf436d54abba7052e0c8aa9de upstream. - -Sweet Tea spotted a race between subvolume deletion and snapshotting -that can result in the root item for the snapshot having the -BTRFS_ROOT_SUBVOL_DEAD flag set. The race is: - -Thread 1 | Thread 2 -----------------------------------------------|---------- -btrfs_delete_subvolume | - btrfs_set_root_flags(BTRFS_ROOT_SUBVOL_DEAD)| - |btrfs_mksubvol - | down_read(subvol_sem) - | create_snapshot - | ... - | create_pending_snapshot - | copy root item from source - down_write(subvol_sem) | - -This flag is only checked in send and swap activate, which this would -cause to fail mysteriously. - -create_snapshot() now checks the root refs to reject a deleted -subvolume, so we can fix this by locking subvol_sem earlier so that the -BTRFS_ROOT_SUBVOL_DEAD flag and the root refs are updated atomically. - -CC: stable@vger.kernel.org # 4.14+ -Reported-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me> -Reviewed-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me> -Reviewed-by: Anand Jain <anand.jain@oracle.com> -Signed-off-by: Omar Sandoval <osandov@fb.com> -Reviewed-by: David Sterba <dsterba@suse.com> -Signed-off-by: David Sterba <dsterba@suse.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/btrfs/inode.c | 22 +++++++++++++--------- - 1 file changed, 13 insertions(+), 9 deletions(-) - -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index fb3c3f43c3fa..97cd57e710cb 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -4449,6 +4449,8 @@ int btrfs_delete_subvolume(struct btrfs_inode *dir, struct dentry *dentry) - u64 root_flags; - int ret; - -+ down_write(&fs_info->subvol_sem); -+ - /* - * Don't allow to delete a subvolume with send in progress. This is - * inside the inode lock so the error handling that has to drop the bit -@@ -4460,25 +4462,25 @@ int btrfs_delete_subvolume(struct btrfs_inode *dir, struct dentry *dentry) - btrfs_warn(fs_info, - "attempt to delete subvolume %llu during send", - dest->root_key.objectid); -- return -EPERM; -+ ret = -EPERM; -+ goto out_up_write; - } - if (atomic_read(&dest->nr_swapfiles)) { - spin_unlock(&dest->root_item_lock); - btrfs_warn(fs_info, - "attempt to delete subvolume %llu with active swapfile", - root->root_key.objectid); -- return -EPERM; -+ ret = -EPERM; -+ goto out_up_write; - } - root_flags = btrfs_root_flags(&dest->root_item); - btrfs_set_root_flags(&dest->root_item, - root_flags | BTRFS_ROOT_SUBVOL_DEAD); - spin_unlock(&dest->root_item_lock); - -- down_write(&fs_info->subvol_sem); -- - ret = may_destroy_subvol(dest); - if (ret) -- goto out_up_write; -+ goto out_undead; - - btrfs_init_block_rsv(&block_rsv, BTRFS_BLOCK_RSV_TEMP); - /* -@@ -4488,7 +4490,7 @@ int btrfs_delete_subvolume(struct btrfs_inode *dir, struct dentry *dentry) - */ - ret = btrfs_subvolume_reserve_metadata(root, &block_rsv, 5, true); - if (ret) -- goto out_up_write; -+ goto out_undead; - - trans = btrfs_start_transaction(root, 0); - if (IS_ERR(trans)) { -@@ -4554,15 +4556,17 @@ int btrfs_delete_subvolume(struct btrfs_inode *dir, struct dentry *dentry) - inode->i_flags |= S_DEAD; - out_release: - btrfs_subvolume_release_metadata(root, &block_rsv); --out_up_write: -- up_write(&fs_info->subvol_sem); -+out_undead: - if (ret) { - spin_lock(&dest->root_item_lock); - root_flags = btrfs_root_flags(&dest->root_item); - btrfs_set_root_flags(&dest->root_item, - root_flags & ~BTRFS_ROOT_SUBVOL_DEAD); - spin_unlock(&dest->root_item_lock); -- } else { -+ } -+out_up_write: -+ up_write(&fs_info->subvol_sem); -+ if (!ret) { - d_invalidate(dentry); - btrfs_prune_dentries(dest); - ASSERT(dest->send_in_progress == 0); --- -2.43.2 - -From 12885229ea0709a50891a396c5d7e66e5b7b85af Mon Sep 17 00:00:00 2001 -From: Fedor Pchelkin <pchelkin@ispras.ru> -Date: Wed, 3 Jan 2024 13:31:27 +0300 -Subject: [PATCH 0894/1501] btrfs: ref-verify: free ref cache before clearing - mount opt -Content-Length: 1835 -Lines: 54 - -commit f03e274a8b29d1d1c1bbd7f764766cb5ca537ab7 upstream. - -As clearing REF_VERIFY mount option indicates there were some errors in a -ref-verify process, a ref cache is not relevant anymore and should be -freed. - -btrfs_free_ref_cache() requires REF_VERIFY option being set so call -it just before clearing the mount option. - -Found by Linux Verification Center (linuxtesting.org) with Syzkaller. - -Reported-by: syzbot+be14ed7728594dc8bd42@syzkaller.appspotmail.com -Fixes: fd708b81d972 ("Btrfs: add a extent ref verify tool") -CC: stable@vger.kernel.org # 5.4+ -Closes: https://lore.kernel.org/lkml/000000000000e5a65c05ee832054@google.com/ -Reported-by: syzbot+c563a3c79927971f950f@syzkaller.appspotmail.com -Closes: https://lore.kernel.org/lkml/0000000000007fe09705fdc6086c@google.com/ -Reviewed-by: Anand Jain <anand.jain@oracle.com> -Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> -Reviewed-by: David Sterba <dsterba@suse.com> -Signed-off-by: David Sterba <dsterba@suse.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/btrfs/ref-verify.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c -index 6486f0d7e993..8c4fc98ca9ce 100644 ---- a/fs/btrfs/ref-verify.c -+++ b/fs/btrfs/ref-verify.c -@@ -889,8 +889,10 @@ int btrfs_ref_tree_mod(struct btrfs_fs_info *fs_info, - out_unlock: - spin_unlock(&fs_info->ref_verify_lock); - out: -- if (ret) -+ if (ret) { -+ btrfs_free_ref_cache(fs_info); - btrfs_clear_opt(fs_info->mount_opt, REF_VERIFY); -+ } - return ret; - } - -@@ -1021,8 +1023,8 @@ int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info) - } - } - if (ret) { -- btrfs_clear_opt(fs_info->mount_opt, REF_VERIFY); - btrfs_free_ref_cache(fs_info); -+ btrfs_clear_opt(fs_info->mount_opt, REF_VERIFY); - } - btrfs_free_path(path); - return ret; --- -2.43.2 - -From 299d3e2d5aa5350429cd0a5d0f1339d29186942c Mon Sep 17 00:00:00 2001 -From: Chung-Chiang Cheng <cccheng@synology.com> -Date: Fri, 12 Jan 2024 15:41:05 +0800 -Subject: [PATCH 0895/1501] btrfs: tree-checker: fix inline ref size in error - messages -Content-Length: 1183 -Lines: 32 - -commit f398e70dd69e6ceea71463a5380e6118f219197e upstream. - -The error message should accurately reflect the size rather than the -type. - -Fixes: f82d1c7ca8ae ("btrfs: tree-checker: Add EXTENT_ITEM and METADATA_ITEM check") -CC: stable@vger.kernel.org # 5.4+ -Reviewed-by: Filipe Manana <fdmanana@suse.com> -Reviewed-by: Qu Wenruo <wqu@suse.com> -Signed-off-by: Chung-Chiang Cheng <cccheng@synology.com> -Reviewed-by: David Sterba <dsterba@suse.com> -Signed-off-by: David Sterba <dsterba@suse.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/btrfs/tree-checker.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c -index 50fdc69fdddf..6eccf8496486 100644 ---- a/fs/btrfs/tree-checker.c -+++ b/fs/btrfs/tree-checker.c -@@ -1436,7 +1436,7 @@ static int check_extent_item(struct extent_buffer *leaf, - if (unlikely(ptr + btrfs_extent_inline_ref_size(inline_type) > end)) { - extent_err(leaf, slot, - "inline ref item overflows extent item, ptr %lu iref size %u end %lu", -- ptr, inline_type, end); -+ ptr, btrfs_extent_inline_ref_size(inline_type), end); - return -EUCLEAN; - } - --- -2.43.2 - -From 877409a6dd350d6d8656a79b29b6cf350aeaa186 Mon Sep 17 00:00:00 2001 -From: David Sterba <dsterba@suse.com> -Date: Mon, 15 Jan 2024 20:30:26 +0100 -Subject: [PATCH 0896/1501] btrfs: don't warn if discard range is not aligned - to sector -Content-Length: 1388 -Lines: 34 - -commit a208b3f132b48e1f94f620024e66fea635925877 upstream. - -There's a warning in btrfs_issue_discard() when the range is not aligned -to 512 bytes, originally added in 4d89d377bbb0 ("btrfs: -btrfs_issue_discard ensure offset/length are aligned to sector -boundaries"). We can't do sub-sector writes anyway so the adjustment is -the only thing that we can do and the warning is unnecessary. - -CC: stable@vger.kernel.org # 4.19+ -Reported-by: syzbot+4a4f1eba14eb5c3417d1@syzkaller.appspotmail.com -Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com> -Reviewed-by: Anand Jain <anand.jain@oracle.com> -Signed-off-by: David Sterba <dsterba@suse.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/btrfs/extent-tree.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index 01423670bc8a..9c8b00a917bd 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -1260,7 +1260,8 @@ static int btrfs_issue_discard(struct block_device *bdev, u64 start, u64 len, - u64 bytes_left, end; - u64 aligned_start = ALIGN(start, 1 << SECTOR_SHIFT); - -- if (WARN_ON(start != aligned_start)) { -+ /* Adjust the range to be aligned to 512B sectors if necessary. */ -+ if (start != aligned_start) { - len -= aligned_start - start; - len = round_down(len, 1 << SECTOR_SHIFT); - start = aligned_start; --- -2.43.2 - -From ed1e9ca4e56af02d0c4c2a1f05460ffe5450c564 Mon Sep 17 00:00:00 2001 -From: Qu Wenruo <wqu@suse.com> -Date: Wed, 10 Jan 2024 08:58:26 +1030 -Subject: [PATCH 0897/1501] btrfs: defrag: reject unknown flags of - btrfs_ioctl_defrag_range_args -Content-Length: 1894 -Lines: 53 - -commit 173431b274a9a54fc10b273b46e67f46bcf62d2e upstream. - -Add extra sanity check for btrfs_ioctl_defrag_range_args::flags. - -This is not really to enhance fuzzing tests, but as a preparation for -future expansion on btrfs_ioctl_defrag_range_args. - -In the future we're going to add new members, allowing more fine tuning -for btrfs defrag. Without the -ENONOTSUPP error, there would be no way -to detect if the kernel supports those new defrag features. - -CC: stable@vger.kernel.org # 4.14+ -Reviewed-by: Filipe Manana <fdmanana@suse.com> -Signed-off-by: Qu Wenruo <wqu@suse.com> -Reviewed-by: David Sterba <dsterba@suse.com> -Signed-off-by: David Sterba <dsterba@suse.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/btrfs/ioctl.c | 4 ++++ - include/uapi/linux/btrfs.h | 3 +++ - 2 files changed, 7 insertions(+) - -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index a1743904202b..3a846b983b28 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -2608,6 +2608,10 @@ static int btrfs_ioctl_defrag(struct file *file, void __user *argp) - ret = -EFAULT; - goto out; - } -+ if (range.flags & ~BTRFS_DEFRAG_RANGE_FLAGS_SUPP) { -+ ret = -EOPNOTSUPP; -+ goto out; -+ } - /* compression requires us to start the IO */ - if ((range.flags & BTRFS_DEFRAG_RANGE_COMPRESS)) { - range.flags |= BTRFS_DEFRAG_RANGE_START_IO; -diff --git a/include/uapi/linux/btrfs.h b/include/uapi/linux/btrfs.h -index 7c29d82db9ee..f8bc34a6bcfa 100644 ---- a/include/uapi/linux/btrfs.h -+++ b/include/uapi/linux/btrfs.h -@@ -614,6 +614,9 @@ struct btrfs_ioctl_clone_range_args { - */ - #define BTRFS_DEFRAG_RANGE_COMPRESS 1 - #define BTRFS_DEFRAG_RANGE_START_IO 2 -+#define BTRFS_DEFRAG_RANGE_FLAGS_SUPP (BTRFS_DEFRAG_RANGE_COMPRESS | \ -+ BTRFS_DEFRAG_RANGE_START_IO) -+ - struct btrfs_ioctl_defrag_range_args { - /* start of the defrag operation */ - __u64 start; --- -2.43.2 - -From d8680b722f0ff6d7a01ddacc1844e0d52354d6ff Mon Sep 17 00:00:00 2001 -From: Omar Sandoval <osandov@fb.com> -Date: Thu, 4 Jan 2024 11:48:46 -0800 -Subject: [PATCH 0898/1501] btrfs: don't abort filesystem when attempting to - snapshot deleted subvolume -Content-Length: 4247 -Lines: 94 - -commit 7081929ab2572920e94d70be3d332e5c9f97095a upstream. - -If the source file descriptor to the snapshot ioctl refers to a deleted -subvolume, we get the following abort: - - BTRFS: Transaction aborted (error -2) - WARNING: CPU: 0 PID: 833 at fs/btrfs/transaction.c:1875 create_pending_snapshot+0x1040/0x1190 [btrfs] - Modules linked in: pata_acpi btrfs ata_piix libata scsi_mod virtio_net blake2b_generic xor net_failover virtio_rng failover scsi_common rng_core raid6_pq libcrc32c - CPU: 0 PID: 833 Comm: t_snapshot_dele Not tainted 6.7.0-rc6 #2 - Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 - RIP: 0010:create_pending_snapshot+0x1040/0x1190 [btrfs] - RSP: 0018:ffffa09c01337af8 EFLAGS: 00010282 - RAX: 0000000000000000 RBX: ffff9982053e7c78 RCX: 0000000000000027 - RDX: ffff99827dc20848 RSI: 0000000000000001 RDI: ffff99827dc20840 - RBP: ffffa09c01337c00 R08: 0000000000000000 R09: ffffa09c01337998 - R10: 0000000000000003 R11: ffffffffb96da248 R12: fffffffffffffffe - R13: ffff99820535bb28 R14: ffff99820b7bd000 R15: ffff99820381ea80 - FS: 00007fe20aadabc0(0000) GS:ffff99827dc00000(0000) knlGS:0000000000000000 - CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 - CR2: 0000559a120b502f CR3: 00000000055b6000 CR4: 00000000000006f0 - Call Trace: - <TASK> - ? create_pending_snapshot+0x1040/0x1190 [btrfs] - ? __warn+0x81/0x130 - ? create_pending_snapshot+0x1040/0x1190 [btrfs] - ? report_bug+0x171/0x1a0 - ? handle_bug+0x3a/0x70 - ? exc_invalid_op+0x17/0x70 - ? asm_exc_invalid_op+0x1a/0x20 - ? create_pending_snapshot+0x1040/0x1190 [btrfs] - ? create_pending_snapshot+0x1040/0x1190 [btrfs] - create_pending_snapshots+0x92/0xc0 [btrfs] - btrfs_commit_transaction+0x66b/0xf40 [btrfs] - btrfs_mksubvol+0x301/0x4d0 [btrfs] - btrfs_mksnapshot+0x80/0xb0 [btrfs] - __btrfs_ioctl_snap_create+0x1c2/0x1d0 [btrfs] - btrfs_ioctl_snap_create_v2+0xc4/0x150 [btrfs] - btrfs_ioctl+0x8a6/0x2650 [btrfs] - ? kmem_cache_free+0x22/0x340 - ? do_sys_openat2+0x97/0xe0 - __x64_sys_ioctl+0x97/0xd0 - do_syscall_64+0x46/0xf0 - entry_SYSCALL_64_after_hwframe+0x6e/0x76 - RIP: 0033:0x7fe20abe83af - RSP: 002b:00007ffe6eff1360 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 - RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fe20abe83af - RDX: 00007ffe6eff23c0 RSI: 0000000050009417 RDI: 0000000000000003 - RBP: 0000000000000003 R08: 0000000000000000 R09: 00007fe20ad16cd0 - R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 - R13: 00007ffe6eff13c0 R14: 00007fe20ad45000 R15: 0000559a120b6d58 - </TASK> - ---[ end trace 0000000000000000 ]--- - BTRFS: error (device vdc: state A) in create_pending_snapshot:1875: errno=-2 No such entry - BTRFS info (device vdc: state EA): forced readonly - BTRFS warning (device vdc: state EA): Skipping commit of aborted transaction. - BTRFS: error (device vdc: state EA) in cleanup_transaction:2055: errno=-2 No such entry - -This happens because create_pending_snapshot() initializes the new root -item as a copy of the source root item. This includes the refs field, -which is 0 for a deleted subvolume. The call to btrfs_insert_root() -therefore inserts a root with refs == 0. btrfs_get_new_fs_root() then -finds the root and returns -ENOENT if refs == 0, which causes -create_pending_snapshot() to abort. - -Fix it by checking the source root's refs before attempting the -snapshot, but after locking subvol_sem to avoid racing with deletion. - -CC: stable@vger.kernel.org # 4.14+ -Reviewed-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me> -Reviewed-by: Anand Jain <anand.jain@oracle.com> -Signed-off-by: Omar Sandoval <osandov@fb.com> -Reviewed-by: David Sterba <dsterba@suse.com> -Signed-off-by: David Sterba <dsterba@suse.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/btrfs/ioctl.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index 3a846b983b28..69e91341fd63 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -790,6 +790,9 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir, - return -EOPNOTSUPP; - } - -+ if (btrfs_root_refs(&root->root_item) == 0) -+ return -ENOENT; -+ - if (!test_bit(BTRFS_ROOT_SHAREABLE, &root->state)) - return -EINVAL; - --- -2.43.2 - -From aaa054e78d0a7d1b559599a70d9c0c7573eab967 Mon Sep 17 00:00:00 2001 -From: Ilya Dryomov <idryomov@gmail.com> -Date: Wed, 17 Jan 2024 18:59:44 +0100 -Subject: [PATCH 0899/1501] rbd: don't move requests to the running list on - errors -Content-Length: 2807 -Lines: 74 - -commit ded080c86b3f99683774af0441a58fc2e3d60cae upstream. - -The running list is supposed to contain requests that are pinning the -exclusive lock, i.e. those that must be flushed before exclusive lock -is released. When wake_lock_waiters() is called to handle an error, -requests on the acquiring list are failed with that error and no -flushing takes place. Briefly moving them to the running list is not -only pointless but also harmful: if exclusive lock gets acquired -before all of their state machines are scheduled and go through -rbd_lock_del_request(), we trigger - - rbd_assert(list_empty(&rbd_dev->running_list)); - -in rbd_try_acquire_lock(). - -Cc: stable@vger.kernel.org -Fixes: 637cd060537d ("rbd: new exclusive lock wait/wake code") -Signed-off-by: Ilya Dryomov <idryomov@gmail.com> -Reviewed-by: Dongsheng Yang <dongsheng.yang@easystack.cn> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/block/rbd.c | 22 ++++++++++++++-------- - 1 file changed, 14 insertions(+), 8 deletions(-) - -diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c -index a999b698b131..1e2596c5efd8 100644 ---- a/drivers/block/rbd.c -+++ b/drivers/block/rbd.c -@@ -3452,14 +3452,15 @@ static bool rbd_lock_add_request(struct rbd_img_request *img_req) - static void rbd_lock_del_request(struct rbd_img_request *img_req) - { - struct rbd_device *rbd_dev = img_req->rbd_dev; -- bool need_wakeup; -+ bool need_wakeup = false; - - lockdep_assert_held(&rbd_dev->lock_rwsem); - spin_lock(&rbd_dev->lock_lists_lock); -- rbd_assert(!list_empty(&img_req->lock_item)); -- list_del_init(&img_req->lock_item); -- need_wakeup = (rbd_dev->lock_state == RBD_LOCK_STATE_RELEASING && -- list_empty(&rbd_dev->running_list)); -+ if (!list_empty(&img_req->lock_item)) { -+ list_del_init(&img_req->lock_item); -+ need_wakeup = (rbd_dev->lock_state == RBD_LOCK_STATE_RELEASING && -+ list_empty(&rbd_dev->running_list)); -+ } - spin_unlock(&rbd_dev->lock_lists_lock); - if (need_wakeup) - complete(&rbd_dev->releasing_wait); -@@ -3842,14 +3843,19 @@ static void wake_lock_waiters(struct rbd_device *rbd_dev, int result) - return; - } - -- list_for_each_entry(img_req, &rbd_dev->acquiring_list, lock_item) { -+ while (!list_empty(&rbd_dev->acquiring_list)) { -+ img_req = list_first_entry(&rbd_dev->acquiring_list, -+ struct rbd_img_request, lock_item); - mutex_lock(&img_req->state_mutex); - rbd_assert(img_req->state == RBD_IMG_EXCLUSIVE_LOCK); -+ if (!result) -+ list_move_tail(&img_req->lock_item, -+ &rbd_dev->running_list); -+ else -+ list_del_init(&img_req->lock_item); - rbd_img_schedule(img_req, result); - mutex_unlock(&img_req->state_mutex); - } -- -- list_splice_tail_init(&rbd_dev->acquiring_list, &rbd_dev->running_list); - } - - static bool locker_equal(const struct ceph_locker *lhs, --- -2.43.2 - -From 69a6f8ee9da574166a907997c8524dd8b000aafb Mon Sep 17 00:00:00 2001 -From: Bernd Edlinger <bernd.edlinger@hotmail.de> -Date: Mon, 22 Jan 2024 19:34:21 +0100 -Subject: [PATCH 0900/1501] exec: Fix error handling in begin_new_exec() -Content-Length: 1142 -Lines: 34 - -commit 84c39ec57d409e803a9bb6e4e85daf1243e0e80b upstream. - -If get_unused_fd_flags() fails, the error handling is incomplete because -bprm->cred is already set to NULL, and therefore free_bprm will not -unlock the cred_guard_mutex. Note there are two error conditions which -end up here, one before and one after bprm->cred is cleared. - -Fixes: b8a61c9e7b4a ("exec: Generic execfd support") -Signed-off-by: Bernd Edlinger <bernd.edlinger@hotmail.de> -Acked-by: Eric W. Biederman <ebiederm@xmission.com> -Link: https://lore.kernel.org/r/AS8P193MB128517ADB5EFF29E04389EDAE4752@AS8P193MB1285.EURP193.PROD.OUTLOOK.COM -Cc: stable@vger.kernel.org -Signed-off-by: Kees Cook <keescook@chromium.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/exec.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/fs/exec.c b/fs/exec.c -index 4aa19b24f281..6d9ed2d765ef 100644 ---- a/fs/exec.c -+++ b/fs/exec.c -@@ -1408,6 +1408,9 @@ int begin_new_exec(struct linux_binprm * bprm) - - out_unlock: - up_write(&me->signal->exec_update_lock); -+ if (!bprm->cred) -+ mutex_unlock(&me->signal->cred_guard_mutex); -+ - out: - return retval; - } --- -2.43.2 - -From f32a81999d0b8e5ce60afb5f6a3dd7241c17dd67 Mon Sep 17 00:00:00 2001 -From: Emmanuel Grumbach <emmanuel.grumbach@intel.com> -Date: Thu, 11 Jan 2024 15:07:25 +0200 -Subject: [PATCH 0901/1501] wifi: iwlwifi: fix a memory corruption -Content-Length: 1723 -Lines: 41 - -commit cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d upstream. - -iwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that -if we copy to iwl_fw_ini_trigger_tlv::data + offset while offset is in -bytes, we'll write past the buffer. - -Cc: stable@vger.kernel.org -Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218233 -Fixes: cf29c5b66b9f ("iwlwifi: dbg_ini: implement time point handling") -Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> -Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> -Link: https://msgid.link/20240111150610.2d2b8b870194.I14ed76505a5cf87304e0c9cc05cc0ae85ed3bf91@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c -index b658cf228fbe..9160d81a871e 100644 ---- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c -+++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c -@@ -1,6 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause - /* -- * Copyright (C) 2018-2023 Intel Corporation -+ * Copyright (C) 2018-2024 Intel Corporation - */ - #include <linux/firmware.h> - #include "iwl-drv.h" -@@ -1096,7 +1096,7 @@ static int iwl_dbg_tlv_override_trig_node(struct iwl_fw_runtime *fwrt, - node_trig = (void *)node_tlv->data; - } - -- memcpy(node_trig->data + offset, trig->data, trig_data_len); -+ memcpy((u8 *)node_trig->data + offset, trig->data, trig_data_len); - node_tlv->length = cpu_to_le32(size); - - if (policy & IWL_FW_INI_APPLY_POLICY_OVERRIDE_CFG) { --- -2.43.2 - -From 8f5b860de87039b007e84a28a5eefc888154e098 Mon Sep 17 00:00:00 2001 -From: NeilBrown <neilb@suse.de> -Date: Mon, 22 Jan 2024 14:58:16 +1100 -Subject: [PATCH 0902/1501] nfsd: fix RELEASE_LOCKOWNER -Content-Length: 5598 -Lines: 141 - -commit edcf9725150e42beeca42d085149f4c88fa97afd upstream. - -The test on so_count in nfsd4_release_lockowner() is nonsense and -harmful. Revert to using check_for_locks(), changing that to not sleep. - -First: harmful. -As is documented in the kdoc comment for nfsd4_release_lockowner(), the -test on so_count can transiently return a false positive resulting in a -return of NFS4ERR_LOCKS_HELD when in fact no locks are held. This is -clearly a protocol violation and with the Linux NFS client it can cause -incorrect behaviour. - -If RELEASE_LOCKOWNER is sent while some other thread is still -processing a LOCK request which failed because, at the time that request -was received, the given owner held a conflicting lock, then the nfsd -thread processing that LOCK request can hold a reference (conflock) to -the lock owner that causes nfsd4_release_lockowner() to return an -incorrect error. - -The Linux NFS client ignores that NFS4ERR_LOCKS_HELD error because it -never sends NFS4_RELEASE_LOCKOWNER without first releasing any locks, so -it knows that the error is impossible. It assumes the lock owner was in -fact released so it feels free to use the same lock owner identifier in -some later locking request. - -When it does reuse a lock owner identifier for which a previous RELEASE -failed, it will naturally use a lock_seqid of zero. However the server, -which didn't release the lock owner, will expect a larger lock_seqid and -so will respond with NFS4ERR_BAD_SEQID. - -So clearly it is harmful to allow a false positive, which testing -so_count allows. - -The test is nonsense because ... well... it doesn't mean anything. - -so_count is the sum of three different counts. -1/ the set of states listed on so_stateids -2/ the set of active vfs locks owned by any of those states -3/ various transient counts such as for conflicting locks. - -When it is tested against '2' it is clear that one of these is the -transient reference obtained by find_lockowner_str_locked(). It is not -clear what the other one is expected to be. - -In practice, the count is often 2 because there is precisely one state -on so_stateids. If there were more, this would fail. - -In my testing I see two circumstances when RELEASE_LOCKOWNER is called. -In one case, CLOSE is called before RELEASE_LOCKOWNER. That results in -all the lock states being removed, and so the lockowner being discarded -(it is removed when there are no more references which usually happens -when the lock state is discarded). When nfsd4_release_lockowner() finds -that the lock owner doesn't exist, it returns success. - -The other case shows an so_count of '2' and precisely one state listed -in so_stateid. It appears that the Linux client uses a separate lock -owner for each file resulting in one lock state per lock owner, so this -test on '2' is safe. For another client it might not be safe. - -So this patch changes check_for_locks() to use the (newish) -find_any_file_locked() so that it doesn't take a reference on the -nfs4_file and so never calls nfsd_file_put(), and so never sleeps. With -this check is it safe to restore the use of check_for_locks() rather -than testing so_count against the mysterious '2'. - -Fixes: ce3c4ad7f4ce ("NFSD: Fix possible sleep during nfsd4_release_lockowner()") -Signed-off-by: NeilBrown <neilb@suse.de> -Reviewed-by: Jeff Layton <jlayton@kernel.org> -Cc: stable@vger.kernel.org # v6.2+ -Signed-off-by: Chuck Lever <chuck.lever@oracle.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/nfsd/nfs4state.c | 26 +++++++++++++++----------- - 1 file changed, 15 insertions(+), 11 deletions(-) - -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index 3edbfa0233e6..21180fa95380 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -7911,14 +7911,16 @@ check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner) - { - struct file_lock *fl; - int status = false; -- struct nfsd_file *nf = find_any_file(fp); -+ struct nfsd_file *nf; - struct inode *inode; - struct file_lock_context *flctx; - -+ spin_lock(&fp->fi_lock); -+ nf = find_any_file_locked(fp); - if (!nf) { - /* Any valid lock stateid should have some sort of access */ - WARN_ON_ONCE(1); -- return status; -+ goto out; - } - - inode = file_inode(nf->nf_file); -@@ -7934,7 +7936,8 @@ check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner) - } - spin_unlock(&flctx->flc_lock); - } -- nfsd_file_put(nf); -+out: -+ spin_unlock(&fp->fi_lock); - return status; - } - -@@ -7944,10 +7947,8 @@ check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner) - * @cstate: NFSv4 COMPOUND state - * @u: RELEASE_LOCKOWNER arguments - * -- * The lockowner's so_count is bumped when a lock record is added -- * or when copying a conflicting lock. The latter case is brief, -- * but can lead to fleeting false positives when looking for -- * locks-in-use. -+ * Check if theree are any locks still held and if not - free the lockowner -+ * and any lock state that is owned. - * - * Return values: - * %nfs_ok: lockowner released or not found -@@ -7983,10 +7984,13 @@ nfsd4_release_lockowner(struct svc_rqst *rqstp, - spin_unlock(&clp->cl_lock); - return nfs_ok; - } -- if (atomic_read(&lo->lo_owner.so_count) != 2) { -- spin_unlock(&clp->cl_lock); -- nfs4_put_stateowner(&lo->lo_owner); -- return nfserr_locks_held; -+ -+ list_for_each_entry(stp, &lo->lo_owner.so_stateids, st_perstateowner) { -+ if (check_for_locks(stp->st_stid.sc_file, lo)) { -+ spin_unlock(&clp->cl_lock); -+ nfs4_put_stateowner(&lo->lo_owner); -+ return nfserr_locks_held; -+ } - } - unhash_lockowner_locked(lo); - while (!list_empty(&lo->lo_owner.so_stateids)) { --- -2.43.2 - -From eedc92622b102943c4c1e483c6e07b936106e936 Mon Sep 17 00:00:00 2001 -From: Amir Goldstein <amir73il@gmail.com> -Date: Sat, 20 Jan 2024 12:18:39 +0200 -Subject: [PATCH 0903/1501] ovl: mark xwhiteouts directory with - overlay.opaque='x' -Content-Length: 17498 -Lines: 468 - -commit 420332b94119cdc7db4477cc88484691cb92ae71 upstream. - -An opaque directory cannot have xwhiteouts, so instead of marking an -xwhiteouts directory with a new xattr, overload overlay.opaque xattr -for marking both opaque dir ('y') and xwhiteouts dir ('x'). - -This is more efficient as the overlay.opaque xattr is checked during -lookup of directory anyway. - -This also prevents unnecessary checking the xattr when reading a -directory without xwhiteouts, i.e. most of the time. - -Note that the xwhiteouts marker is not checked on the upper layer and -on the last layer in lowerstack, where xwhiteouts are not expected. - -Fixes: bc8df7a3dc03 ("ovl: Add an alternative type of whiteout") -Cc: <stable@vger.kernel.org> # v6.7 -Reviewed-by: Alexander Larsson <alexl@redhat.com> -Tested-by: Alexander Larsson <alexl@redhat.com> -Signed-off-by: Amir Goldstein <amir73il@gmail.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - Documentation/filesystems/overlayfs.rst | 16 ++++++-- - fs/overlayfs/namei.c | 43 ++++++++++++-------- - fs/overlayfs/overlayfs.h | 23 ++++++++--- - fs/overlayfs/ovl_entry.h | 4 +- - fs/overlayfs/readdir.c | 7 ++-- - fs/overlayfs/super.c | 15 +++++++ - fs/overlayfs/util.c | 53 +++++++++++++++---------- - 7 files changed, 110 insertions(+), 51 deletions(-) - -diff --git a/Documentation/filesystems/overlayfs.rst b/Documentation/filesystems/overlayfs.rst -index 0407f361f32a..b28e5e3c239f 100644 ---- a/Documentation/filesystems/overlayfs.rst -+++ b/Documentation/filesystems/overlayfs.rst -@@ -145,7 +145,9 @@ filesystem, an overlay filesystem needs to record in the upper filesystem - that files have been removed. This is done using whiteouts and opaque - directories (non-directories are always opaque). - --A whiteout is created as a character device with 0/0 device number. -+A whiteout is created as a character device with 0/0 device number or -+as a zero-size regular file with the xattr "trusted.overlay.whiteout". -+ - When a whiteout is found in the upper level of a merged directory, any - matching name in the lower level is ignored, and the whiteout itself - is also hidden. -@@ -154,6 +156,13 @@ A directory is made opaque by setting the xattr "trusted.overlay.opaque" - to "y". Where the upper filesystem contains an opaque directory, any - directory in the lower filesystem with the same name is ignored. - -+An opaque directory should not conntain any whiteouts, because they do not -+serve any purpose. A merge directory containing regular files with the xattr -+"trusted.overlay.whiteout", should be additionally marked by setting the xattr -+"trusted.overlay.opaque" to "x" on the merge directory itself. -+This is needed to avoid the overhead of checking the "trusted.overlay.whiteout" -+on all entries during readdir in the common case. -+ - readdir - ------- - -@@ -534,8 +543,9 @@ A lower dir with a regular whiteout will always be handled by the overlayfs - mount, so to support storing an effective whiteout file in an overlayfs mount an - alternative form of whiteout is supported. This form is a regular, zero-size - file with the "overlay.whiteout" xattr set, inside a directory with the --"overlay.whiteouts" xattr set. Such whiteouts are never created by overlayfs, --but can be used by userspace tools (like containers) that generate lower layers. -+"overlay.opaque" xattr set to "x" (see `whiteouts and opaque directories`_). -+These alternative whiteouts are never created by overlayfs, but can be used by -+userspace tools (like containers) that generate lower layers. - These alternative whiteouts can be escaped using the standard xattr escape - mechanism in order to properly nest to any depth. - -diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c -index 03bc8d5dfa31..22c29e540e3c 100644 ---- a/fs/overlayfs/namei.c -+++ b/fs/overlayfs/namei.c -@@ -18,10 +18,11 @@ - - struct ovl_lookup_data { - struct super_block *sb; -- struct vfsmount *mnt; -+ const struct ovl_layer *layer; - struct qstr name; - bool is_dir; - bool opaque; -+ bool xwhiteouts; - bool stop; - bool last; - char *redirect; -@@ -201,17 +202,13 @@ struct dentry *ovl_decode_real_fh(struct ovl_fs *ofs, struct ovl_fh *fh, - return real; - } - --static bool ovl_is_opaquedir(struct ovl_fs *ofs, const struct path *path) --{ -- return ovl_path_check_dir_xattr(ofs, path, OVL_XATTR_OPAQUE); --} -- - static struct dentry *ovl_lookup_positive_unlocked(struct ovl_lookup_data *d, - const char *name, - struct dentry *base, int len, - bool drop_negative) - { -- struct dentry *ret = lookup_one_unlocked(mnt_idmap(d->mnt), name, base, len); -+ struct dentry *ret = lookup_one_unlocked(mnt_idmap(d->layer->mnt), name, -+ base, len); - - if (!IS_ERR(ret) && d_flags_negative(smp_load_acquire(&ret->d_flags))) { - if (drop_negative && ret->d_lockref.count == 1) { -@@ -232,10 +229,13 @@ static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d, - size_t prelen, const char *post, - struct dentry **ret, bool drop_negative) - { -+ struct ovl_fs *ofs = OVL_FS(d->sb); - struct dentry *this; - struct path path; - int err; - bool last_element = !post[0]; -+ bool is_upper = d->layer->idx == 0; -+ char val; - - this = ovl_lookup_positive_unlocked(d, name, base, namelen, drop_negative); - if (IS_ERR(this)) { -@@ -253,8 +253,8 @@ static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d, - } - - path.dentry = this; -- path.mnt = d->mnt; -- if (ovl_path_is_whiteout(OVL_FS(d->sb), &path)) { -+ path.mnt = d->layer->mnt; -+ if (ovl_path_is_whiteout(ofs, &path)) { - d->stop = d->opaque = true; - goto put_and_out; - } -@@ -272,7 +272,7 @@ static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d, - d->stop = true; - goto put_and_out; - } -- err = ovl_check_metacopy_xattr(OVL_FS(d->sb), &path, NULL); -+ err = ovl_check_metacopy_xattr(ofs, &path, NULL); - if (err < 0) - goto out_err; - -@@ -292,7 +292,12 @@ static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d, - if (d->last) - goto out; - -- if (ovl_is_opaquedir(OVL_FS(d->sb), &path)) { -+ /* overlay.opaque=x means xwhiteouts directory */ -+ val = ovl_get_opaquedir_val(ofs, &path); -+ if (last_element && !is_upper && val == 'x') { -+ d->xwhiteouts = true; -+ ovl_layer_set_xwhiteouts(ofs, d->layer); -+ } else if (val == 'y') { - d->stop = true; - if (last_element) - d->opaque = true; -@@ -863,7 +868,8 @@ struct dentry *ovl_lookup_index(struct ovl_fs *ofs, struct dentry *upper, - * Returns next layer in stack starting from top. - * Returns -1 if this is the last layer. - */ --int ovl_path_next(int idx, struct dentry *dentry, struct path *path) -+int ovl_path_next(int idx, struct dentry *dentry, struct path *path, -+ const struct ovl_layer **layer) - { - struct ovl_entry *oe = OVL_E(dentry); - struct ovl_path *lowerstack = ovl_lowerstack(oe); -@@ -871,13 +877,16 @@ int ovl_path_next(int idx, struct dentry *dentry, struct path *path) - BUG_ON(idx < 0); - if (idx == 0) { - ovl_path_upper(dentry, path); -- if (path->dentry) -+ if (path->dentry) { -+ *layer = &OVL_FS(dentry->d_sb)->layers[0]; - return ovl_numlower(oe) ? 1 : -1; -+ } - idx++; - } - BUG_ON(idx > ovl_numlower(oe)); - path->dentry = lowerstack[idx - 1].dentry; -- path->mnt = lowerstack[idx - 1].layer->mnt; -+ *layer = lowerstack[idx - 1].layer; -+ path->mnt = (*layer)->mnt; - - return (idx < ovl_numlower(oe)) ? idx + 1 : -1; - } -@@ -1055,7 +1064,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry, - old_cred = ovl_override_creds(dentry->d_sb); - upperdir = ovl_dentry_upper(dentry->d_parent); - if (upperdir) { -- d.mnt = ovl_upper_mnt(ofs); -+ d.layer = &ofs->layers[0]; - err = ovl_lookup_layer(upperdir, &d, &upperdentry, true); - if (err) - goto out; -@@ -1111,7 +1120,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry, - else if (d.is_dir || !ofs->numdatalayer) - d.last = lower.layer->idx == ovl_numlower(roe); - -- d.mnt = lower.layer->mnt; -+ d.layer = lower.layer; - err = ovl_lookup_layer(lower.dentry, &d, &this, false); - if (err) - goto out_put; -@@ -1278,6 +1287,8 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry, - - if (upperopaque) - ovl_dentry_set_opaque(dentry); -+ if (d.xwhiteouts) -+ ovl_dentry_set_xwhiteouts(dentry); - - if (upperdentry) - ovl_dentry_set_upper_alias(dentry); -diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h -index 05c3dd597fa8..18132ab04ead 100644 ---- a/fs/overlayfs/overlayfs.h -+++ b/fs/overlayfs/overlayfs.h -@@ -50,7 +50,6 @@ enum ovl_xattr { - OVL_XATTR_METACOPY, - OVL_XATTR_PROTATTR, - OVL_XATTR_XWHITEOUT, -- OVL_XATTR_XWHITEOUTS, - }; - - enum ovl_inode_flag { -@@ -70,6 +69,8 @@ enum ovl_entry_flag { - OVL_E_UPPER_ALIAS, - OVL_E_OPAQUE, - OVL_E_CONNECTED, -+ /* Lower stack may contain xwhiteout entries */ -+ OVL_E_XWHITEOUTS, - }; - - enum { -@@ -471,6 +472,10 @@ bool ovl_dentry_test_flag(unsigned long flag, struct dentry *dentry); - bool ovl_dentry_is_opaque(struct dentry *dentry); - bool ovl_dentry_is_whiteout(struct dentry *dentry); - void ovl_dentry_set_opaque(struct dentry *dentry); -+bool ovl_dentry_has_xwhiteouts(struct dentry *dentry); -+void ovl_dentry_set_xwhiteouts(struct dentry *dentry); -+void ovl_layer_set_xwhiteouts(struct ovl_fs *ofs, -+ const struct ovl_layer *layer); - bool ovl_dentry_has_upper_alias(struct dentry *dentry); - void ovl_dentry_set_upper_alias(struct dentry *dentry); - bool ovl_dentry_needs_data_copy_up(struct dentry *dentry, int flags); -@@ -488,11 +493,10 @@ struct file *ovl_path_open(const struct path *path, int flags); - int ovl_copy_up_start(struct dentry *dentry, int flags); - void ovl_copy_up_end(struct dentry *dentry); - bool ovl_already_copied_up(struct dentry *dentry, int flags); --bool ovl_path_check_dir_xattr(struct ovl_fs *ofs, const struct path *path, -- enum ovl_xattr ox); -+char ovl_get_dir_xattr_val(struct ovl_fs *ofs, const struct path *path, -+ enum ovl_xattr ox); - bool ovl_path_check_origin_xattr(struct ovl_fs *ofs, const struct path *path); - bool ovl_path_check_xwhiteout_xattr(struct ovl_fs *ofs, const struct path *path); --bool ovl_path_check_xwhiteouts_xattr(struct ovl_fs *ofs, const struct path *path); - bool ovl_init_uuid_xattr(struct super_block *sb, struct ovl_fs *ofs, - const struct path *upperpath); - -@@ -567,7 +571,13 @@ static inline bool ovl_is_impuredir(struct super_block *sb, - .mnt = ovl_upper_mnt(ofs), - }; - -- return ovl_path_check_dir_xattr(ofs, &upperpath, OVL_XATTR_IMPURE); -+ return ovl_get_dir_xattr_val(ofs, &upperpath, OVL_XATTR_IMPURE) == 'y'; -+} -+ -+static inline char ovl_get_opaquedir_val(struct ovl_fs *ofs, -+ const struct path *path) -+{ -+ return ovl_get_dir_xattr_val(ofs, path, OVL_XATTR_OPAQUE); - } - - static inline bool ovl_redirect_follow(struct ovl_fs *ofs) -@@ -674,7 +684,8 @@ int ovl_get_index_name(struct ovl_fs *ofs, struct dentry *origin, - struct dentry *ovl_get_index_fh(struct ovl_fs *ofs, struct ovl_fh *fh); - struct dentry *ovl_lookup_index(struct ovl_fs *ofs, struct dentry *upper, - struct dentry *origin, bool verify); --int ovl_path_next(int idx, struct dentry *dentry, struct path *path); -+int ovl_path_next(int idx, struct dentry *dentry, struct path *path, -+ const struct ovl_layer **layer); - int ovl_verify_lowerdata(struct dentry *dentry); - struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry, - unsigned int flags); -diff --git a/fs/overlayfs/ovl_entry.h b/fs/overlayfs/ovl_entry.h -index d82d2a043da2..f02c4bf23182 100644 ---- a/fs/overlayfs/ovl_entry.h -+++ b/fs/overlayfs/ovl_entry.h -@@ -40,6 +40,8 @@ struct ovl_layer { - int idx; - /* One fsid per unique underlying sb (upper fsid == 0) */ - int fsid; -+ /* xwhiteouts were found on this layer */ -+ bool has_xwhiteouts; - }; - - struct ovl_path { -@@ -59,7 +61,7 @@ struct ovl_fs { - unsigned int numfs; - /* Number of data-only lower layers */ - unsigned int numdatalayer; -- const struct ovl_layer *layers; -+ struct ovl_layer *layers; - struct ovl_sb *fs; - /* workbasedir is the path at workdir= mount option */ - struct dentry *workbasedir; -diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c -index a490fc47c3e7..8e8545bc273f 100644 ---- a/fs/overlayfs/readdir.c -+++ b/fs/overlayfs/readdir.c -@@ -305,8 +305,6 @@ static inline int ovl_dir_read(const struct path *realpath, - if (IS_ERR(realfile)) - return PTR_ERR(realfile); - -- rdd->in_xwhiteouts_dir = rdd->dentry && -- ovl_path_check_xwhiteouts_xattr(OVL_FS(rdd->dentry->d_sb), realpath); - rdd->first_maybe_whiteout = NULL; - rdd->ctx.pos = 0; - do { -@@ -359,10 +357,13 @@ static int ovl_dir_read_merged(struct dentry *dentry, struct list_head *list, - .is_lowest = false, - }; - int idx, next; -+ const struct ovl_layer *layer; - - for (idx = 0; idx != -1; idx = next) { -- next = ovl_path_next(idx, dentry, &realpath); -+ next = ovl_path_next(idx, dentry, &realpath, &layer); - rdd.is_upper = ovl_dentry_upper(dentry) == realpath.dentry; -+ rdd.in_xwhiteouts_dir = layer->has_xwhiteouts && -+ ovl_dentry_has_xwhiteouts(dentry); - - if (next != -1) { - err = ovl_dir_read(&realpath, &rdd); -diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c -index a0967bb25003..36543e9ffd74 100644 ---- a/fs/overlayfs/super.c -+++ b/fs/overlayfs/super.c -@@ -1250,6 +1250,7 @@ static struct dentry *ovl_get_root(struct super_block *sb, - struct ovl_entry *oe) - { - struct dentry *root; -+ struct ovl_fs *ofs = OVL_FS(sb); - struct ovl_path *lowerpath = ovl_lowerstack(oe); - unsigned long ino = d_inode(lowerpath->dentry)->i_ino; - int fsid = lowerpath->layer->fsid; -@@ -1271,6 +1272,20 @@ static struct dentry *ovl_get_root(struct super_block *sb, - ovl_set_flag(OVL_IMPURE, d_inode(root)); - } - -+ /* Look for xwhiteouts marker except in the lowermost layer */ -+ for (int i = 0; i < ovl_numlower(oe) - 1; i++, lowerpath++) { -+ struct path path = { -+ .mnt = lowerpath->layer->mnt, -+ .dentry = lowerpath->dentry, -+ }; -+ -+ /* overlay.opaque=x means xwhiteouts directory */ -+ if (ovl_get_opaquedir_val(ofs, &path) == 'x') { -+ ovl_layer_set_xwhiteouts(ofs, lowerpath->layer); -+ ovl_dentry_set_xwhiteouts(root); -+ } -+ } -+ - /* Root is always merge -> can have whiteouts */ - ovl_set_flag(OVL_WHITEOUTS, d_inode(root)); - ovl_dentry_set_flag(OVL_E_CONNECTED, root); -diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c -index c3f020ca13a8..cd0722309e5d 100644 ---- a/fs/overlayfs/util.c -+++ b/fs/overlayfs/util.c -@@ -461,6 +461,33 @@ void ovl_dentry_set_opaque(struct dentry *dentry) - ovl_dentry_set_flag(OVL_E_OPAQUE, dentry); - } - -+bool ovl_dentry_has_xwhiteouts(struct dentry *dentry) -+{ -+ return ovl_dentry_test_flag(OVL_E_XWHITEOUTS, dentry); -+} -+ -+void ovl_dentry_set_xwhiteouts(struct dentry *dentry) -+{ -+ ovl_dentry_set_flag(OVL_E_XWHITEOUTS, dentry); -+} -+ -+/* -+ * ovl_layer_set_xwhiteouts() is called before adding the overlay dir -+ * dentry to dcache, while readdir of that same directory happens after -+ * the overlay dir dentry is in dcache, so if some cpu observes that -+ * ovl_dentry_is_xwhiteouts(), it will also observe layer->has_xwhiteouts -+ * for the layers where xwhiteouts marker was found in that merge dir. -+ */ -+void ovl_layer_set_xwhiteouts(struct ovl_fs *ofs, -+ const struct ovl_layer *layer) -+{ -+ if (layer->has_xwhiteouts) -+ return; -+ -+ /* Write once to read-mostly layer properties */ -+ ofs->layers[layer->idx].has_xwhiteouts = true; -+} -+ - /* - * For hard links and decoded file handles, it's possible for ovl_dentry_upper() - * to return positive, while there's no actual upper alias for the inode. -@@ -739,19 +766,6 @@ bool ovl_path_check_xwhiteout_xattr(struct ovl_fs *ofs, const struct path *path) - return res >= 0; - } - --bool ovl_path_check_xwhiteouts_xattr(struct ovl_fs *ofs, const struct path *path) --{ -- struct dentry *dentry = path->dentry; -- int res; -- -- /* xattr.whiteouts must be a directory */ -- if (!d_is_dir(dentry)) -- return false; -- -- res = ovl_path_getxattr(ofs, path, OVL_XATTR_XWHITEOUTS, NULL, 0); -- return res >= 0; --} -- - /* - * Load persistent uuid from xattr into s_uuid if found, or store a new - * random generated value in s_uuid and in xattr. -@@ -811,20 +825,17 @@ bool ovl_init_uuid_xattr(struct super_block *sb, struct ovl_fs *ofs, - return false; - } - --bool ovl_path_check_dir_xattr(struct ovl_fs *ofs, const struct path *path, -- enum ovl_xattr ox) -+char ovl_get_dir_xattr_val(struct ovl_fs *ofs, const struct path *path, -+ enum ovl_xattr ox) - { - int res; - char val; - - if (!d_is_dir(path->dentry)) -- return false; -+ return 0; - - res = ovl_path_getxattr(ofs, path, ox, &val, 1); -- if (res == 1 && val == 'y') -- return true; -- -- return false; -+ return res == 1 ? val : 0; - } - - #define OVL_XATTR_OPAQUE_POSTFIX "opaque" -@@ -837,7 +848,6 @@ bool ovl_path_check_dir_xattr(struct ovl_fs *ofs, const struct path *path, - #define OVL_XATTR_METACOPY_POSTFIX "metacopy" - #define OVL_XATTR_PROTATTR_POSTFIX "protattr" - #define OVL_XATTR_XWHITEOUT_POSTFIX "whiteout" --#define OVL_XATTR_XWHITEOUTS_POSTFIX "whiteouts" - - #define OVL_XATTR_TAB_ENTRY(x) \ - [x] = { [false] = OVL_XATTR_TRUSTED_PREFIX x ## _POSTFIX, \ -@@ -854,7 +864,6 @@ const char *const ovl_xattr_table[][2] = { - OVL_XATTR_TAB_ENTRY(OVL_XATTR_METACOPY), - OVL_XATTR_TAB_ENTRY(OVL_XATTR_PROTATTR), - OVL_XATTR_TAB_ENTRY(OVL_XATTR_XWHITEOUT), -- OVL_XATTR_TAB_ENTRY(OVL_XATTR_XWHITEOUTS), - }; - - int ovl_check_setxattr(struct ovl_fs *ofs, struct dentry *upperdentry, --- -2.43.2 - -From 3c798a636ba0f3563b893d6168bf0bade90c1d42 Mon Sep 17 00:00:00 2001 -From: Michael Kelley <mhklinux@outlook.com> -Date: Mon, 22 Jan 2024 08:20:28 -0800 -Subject: [PATCH 0904/1501] hv_netvsc: Calculate correct ring size when - PAGE_SIZE is not 4 Kbytes -Content-Length: 2253 -Lines: 53 - -commit 6941f67ad37d5465b75b9ffc498fcf6897a3c00e upstream. - -Current code in netvsc_drv_init() incorrectly assumes that PAGE_SIZE -is 4 Kbytes, which is wrong on ARM64 with 16K or 64K page size. As a -result, the default VMBus ring buffer size on ARM64 with 64K page size -is 8 Mbytes instead of the expected 512 Kbytes. While this doesn't break -anything, a typical VM with 8 vCPUs and 8 netvsc channels wastes 120 -Mbytes (8 channels * 2 ring buffers/channel * 7.5 Mbytes/ring buffer). - -Unfortunately, the module parameter specifying the ring buffer size -is in units of 4 Kbyte pages. Ideally, it should be in units that -are independent of PAGE_SIZE, but backwards compatibility prevents -changing that now. - -Fix this by having netvsc_drv_init() hardcode 4096 instead of using -PAGE_SIZE when calculating the ring buffer size in bytes. Also -use the VMBUS_RING_SIZE macro to ensure proper alignment when running -with page size larger than 4K. - -Cc: <stable@vger.kernel.org> # 5.15.x -Fixes: 7aff79e297ee ("Drivers: hv: Enable Hyper-V code to be built on ARM64") -Signed-off-by: Michael Kelley <mhklinux@outlook.com> -Link: https://lore.kernel.org/r/20240122162028.348885-1-mhklinux@outlook.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/net/hyperv/netvsc_drv.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c -index 706ea5263e87..cd15d7b380ab 100644 ---- a/drivers/net/hyperv/netvsc_drv.c -+++ b/drivers/net/hyperv/netvsc_drv.c -@@ -44,7 +44,7 @@ - - static unsigned int ring_size __ro_after_init = 128; - module_param(ring_size, uint, 0444); --MODULE_PARM_DESC(ring_size, "Ring buffer size (# of pages)"); -+MODULE_PARM_DESC(ring_size, "Ring buffer size (# of 4K pages)"); - unsigned int netvsc_ring_bytes __ro_after_init; - - static const u32 default_msg = NETIF_MSG_DRV | NETIF_MSG_PROBE | -@@ -2805,7 +2805,7 @@ static int __init netvsc_drv_init(void) - pr_info("Increased ring_size to %u (min allowed)\n", - ring_size); - } -- netvsc_ring_bytes = ring_size * PAGE_SIZE; -+ netvsc_ring_bytes = VMBUS_RING_SIZE(ring_size * 4096); - - register_netdevice_notifier(&netvsc_netdev_notifier); - --- -2.43.2 - -From 36a0a80f32209238469deb481967d777a3d539ee Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso <pablo@netfilter.org> -Date: Thu, 18 Jan 2024 10:56:26 +0100 -Subject: [PATCH 0905/1501] netfilter: nft_chain_filter: handle - NETDEV_UNREGISTER for inet/ingress basechain -Content-Length: 1863 -Lines: 54 - -commit 01acb2e8666a6529697141a6017edbf206921913 upstream. - -Remove netdevice from inet/ingress basechain in case NETDEV_UNREGISTER -event is reported, otherwise a stale reference to netdevice remains in -the hook list. - -Fixes: 60a3815da702 ("netfilter: add inet ingress support") -Cc: stable@vger.kernel.org -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - net/netfilter/nft_chain_filter.c | 11 +++++++++-- - 1 file changed, 9 insertions(+), 2 deletions(-) - -diff --git a/net/netfilter/nft_chain_filter.c b/net/netfilter/nft_chain_filter.c -index 680fe557686e..274b6f7e6bb5 100644 ---- a/net/netfilter/nft_chain_filter.c -+++ b/net/netfilter/nft_chain_filter.c -@@ -357,9 +357,10 @@ static int nf_tables_netdev_event(struct notifier_block *this, - unsigned long event, void *ptr) - { - struct net_device *dev = netdev_notifier_info_to_dev(ptr); -+ struct nft_base_chain *basechain; - struct nftables_pernet *nft_net; -- struct nft_table *table; - struct nft_chain *chain, *nr; -+ struct nft_table *table; - struct nft_ctx ctx = { - .net = dev_net(dev), - }; -@@ -371,7 +372,8 @@ static int nf_tables_netdev_event(struct notifier_block *this, - nft_net = nft_pernet(ctx.net); - mutex_lock(&nft_net->commit_mutex); - list_for_each_entry(table, &nft_net->tables, list) { -- if (table->family != NFPROTO_NETDEV) -+ if (table->family != NFPROTO_NETDEV && -+ table->family != NFPROTO_INET) - continue; - - ctx.family = table->family; -@@ -380,6 +382,11 @@ static int nf_tables_netdev_event(struct notifier_block *this, - if (!nft_is_base_chain(chain)) - continue; - -+ basechain = nft_base_chain(chain); -+ if (table->family == NFPROTO_INET && -+ basechain->ops.hooknum != NF_INET_INGRESS) -+ continue; -+ - ctx.chain = chain; - nft_netdev_event(event, dev, &ctx); - } --- -2.43.2 - -From f05a497e7bc8851eeeb3a58da180ba469efebb05 Mon Sep 17 00:00:00 2001 -From: Florian Westphal <fw@strlen.de> -Date: Sat, 20 Jan 2024 22:50:04 +0100 -Subject: [PATCH 0906/1501] netfilter: nf_tables: reject QUEUE/DROP verdict - parameters -Content-Length: 2019 -Lines: 66 - -commit f342de4e2f33e0e39165d8639387aa6c19dff660 upstream. - -This reverts commit e0abdadcc6e1. - -core.c:nf_hook_slow assumes that the upper 16 bits of NF_DROP -verdicts contain a valid errno, i.e. -EPERM, -EHOSTUNREACH or similar, -or 0. - -Due to the reverted commit, its possible to provide a positive -value, e.g. NF_ACCEPT (1), which results in use-after-free. - -Its not clear to me why this commit was made. - -NF_QUEUE is not used by nftables; "queue" rules in nftables -will result in use of "nft_queue" expression. - -If we later need to allow specifiying errno values from userspace -(do not know why), this has to call NF_DROP_GETERR and check that -"err <= 0" holds true. - -Fixes: e0abdadcc6e1 ("netfilter: nf_tables: accept QUEUE/DROP verdict parameters") -Cc: stable@vger.kernel.org -Reported-by: Notselwyn <notselwyn@pwning.tech> -Signed-off-by: Florian Westphal <fw@strlen.de> -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - net/netfilter/nf_tables_api.c | 16 ++++++---------- - 1 file changed, 6 insertions(+), 10 deletions(-) - -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 5282e8377782..6a987b36d0bb 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -10909,16 +10909,10 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, - data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE])); - - switch (data->verdict.code) { -- default: -- switch (data->verdict.code & NF_VERDICT_MASK) { -- case NF_ACCEPT: -- case NF_DROP: -- case NF_QUEUE: -- break; -- default: -- return -EINVAL; -- } -- fallthrough; -+ case NF_ACCEPT: -+ case NF_DROP: -+ case NF_QUEUE: -+ break; - case NFT_CONTINUE: - case NFT_BREAK: - case NFT_RETURN: -@@ -10953,6 +10947,8 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, - - data->verdict.chain = chain; - break; -+ default: -+ return -EINVAL; - } - - desc->len = sizeof(data->verdict); --- -2.43.2 - -From 70c5aecd830d132c514d0cee9fcadcdc7263f119 Mon Sep 17 00:00:00 2001 -From: Nathan Chancellor <nathan@kernel.org> -Date: Thu, 4 Jan 2024 15:59:03 -0700 -Subject: [PATCH 0907/1501] platform/x86: intel-uncore-freq: Fix types in sysfs - callbacks -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 13005 -Lines: 262 - -commit 416de0246f35f43d871a57939671fe814f4455ee upstream. - -When booting a kernel with CONFIG_CFI_CLANG, there is a CFI failure when -accessing any of the values under -/sys/devices/system/cpu/intel_uncore_frequency/package_00_die_00: - - $ cat /sys/devices/system/cpu/intel_uncore_frequency/package_00_die_00/max_freq_khz - fish: Job 1, 'cat /sys/devices/system/cpu/int…' terminated by signal SIGSEGV (Address boundary error) - - $ sudo dmesg &| grep 'CFI failure' - [ 170.953925] CFI failure at kobj_attr_show+0x19/0x30 (target: show_max_freq_khz+0x0/0xc0 [intel_uncore_frequency_common]; expected type: 0xd34078c5 - -The sysfs callback functions such as show_domain_id() are written as if -they are going to be called by dev_attr_show() but as the above message -shows, they are instead called by kobj_attr_show(). kCFI checks that the -destination of an indirect jump has the exact same type as the prototype -of the function pointer it is called through and fails when they do not. - -These callbacks are called through kobj_attr_show() because -uncore_root_kobj was initialized with kobject_create_and_add(), which -means uncore_root_kobj has a ->sysfs_ops of kobj_sysfs_ops from -kobject_create(), which uses kobj_attr_show() as its ->show() value. - -The only reason there has not been a more noticeable problem until this -point is that 'struct kobj_attribute' and 'struct device_attribute' have -the same layout, so getting the callback from container_of() works the -same with either value. - -Change all the callbacks and their uses to be compatible with -kobj_attr_show() and kobj_attr_store(), which resolves the kCFI failure -and allows the sysfs files to work properly. - -Closes: https://github.com/ClangBuiltLinux/linux/issues/1974 -Fixes: ae7b2ce57851 ("platform/x86/intel/uncore-freq: Use sysfs API to create attributes") -Cc: stable@vger.kernel.org -Signed-off-by: Nathan Chancellor <nathan@kernel.org> -Reviewed-by: Sami Tolvanen <samitolvanen@google.com> -Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> -Link: https://lore.kernel.org/r/20240104-intel-uncore-freq-kcfi-fix-v1-1-bf1e8939af40@kernel.org -Signed-off-by: Hans de Goede <hdegoede@redhat.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - .../uncore-frequency-common.c | 82 +++++++++---------- - .../uncore-frequency-common.h | 32 ++++---- - 2 files changed, 57 insertions(+), 57 deletions(-) - -diff --git a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-common.c b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-common.c -index 33ab207493e3..33bb58dc3f78 100644 ---- a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-common.c -+++ b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-common.c -@@ -23,23 +23,23 @@ static int (*uncore_read)(struct uncore_data *data, unsigned int *min, unsigned - static int (*uncore_write)(struct uncore_data *data, unsigned int input, unsigned int min_max); - static int (*uncore_read_freq)(struct uncore_data *data, unsigned int *freq); - --static ssize_t show_domain_id(struct device *dev, struct device_attribute *attr, char *buf) -+static ssize_t show_domain_id(struct kobject *kobj, struct kobj_attribute *attr, char *buf) - { -- struct uncore_data *data = container_of(attr, struct uncore_data, domain_id_dev_attr); -+ struct uncore_data *data = container_of(attr, struct uncore_data, domain_id_kobj_attr); - - return sprintf(buf, "%u\n", data->domain_id); - } - --static ssize_t show_fabric_cluster_id(struct device *dev, struct device_attribute *attr, char *buf) -+static ssize_t show_fabric_cluster_id(struct kobject *kobj, struct kobj_attribute *attr, char *buf) - { -- struct uncore_data *data = container_of(attr, struct uncore_data, fabric_cluster_id_dev_attr); -+ struct uncore_data *data = container_of(attr, struct uncore_data, fabric_cluster_id_kobj_attr); - - return sprintf(buf, "%u\n", data->cluster_id); - } - --static ssize_t show_package_id(struct device *dev, struct device_attribute *attr, char *buf) -+static ssize_t show_package_id(struct kobject *kobj, struct kobj_attribute *attr, char *buf) - { -- struct uncore_data *data = container_of(attr, struct uncore_data, package_id_dev_attr); -+ struct uncore_data *data = container_of(attr, struct uncore_data, package_id_kobj_attr); - - return sprintf(buf, "%u\n", data->package_id); - } -@@ -97,30 +97,30 @@ static ssize_t show_perf_status_freq_khz(struct uncore_data *data, char *buf) - } - - #define store_uncore_min_max(name, min_max) \ -- static ssize_t store_##name(struct device *dev, \ -- struct device_attribute *attr, \ -+ static ssize_t store_##name(struct kobject *kobj, \ -+ struct kobj_attribute *attr, \ - const char *buf, size_t count) \ - { \ -- struct uncore_data *data = container_of(attr, struct uncore_data, name##_dev_attr);\ -+ struct uncore_data *data = container_of(attr, struct uncore_data, name##_kobj_attr);\ - \ - return store_min_max_freq_khz(data, buf, count, \ - min_max); \ - } - - #define show_uncore_min_max(name, min_max) \ -- static ssize_t show_##name(struct device *dev, \ -- struct device_attribute *attr, char *buf)\ -+ static ssize_t show_##name(struct kobject *kobj, \ -+ struct kobj_attribute *attr, char *buf)\ - { \ -- struct uncore_data *data = container_of(attr, struct uncore_data, name##_dev_attr);\ -+ struct uncore_data *data = container_of(attr, struct uncore_data, name##_kobj_attr);\ - \ - return show_min_max_freq_khz(data, buf, min_max); \ - } - - #define show_uncore_perf_status(name) \ -- static ssize_t show_##name(struct device *dev, \ -- struct device_attribute *attr, char *buf)\ -+ static ssize_t show_##name(struct kobject *kobj, \ -+ struct kobj_attribute *attr, char *buf)\ - { \ -- struct uncore_data *data = container_of(attr, struct uncore_data, name##_dev_attr);\ -+ struct uncore_data *data = container_of(attr, struct uncore_data, name##_kobj_attr);\ - \ - return show_perf_status_freq_khz(data, buf); \ - } -@@ -134,11 +134,11 @@ show_uncore_min_max(max_freq_khz, 1); - show_uncore_perf_status(current_freq_khz); - - #define show_uncore_data(member_name) \ -- static ssize_t show_##member_name(struct device *dev, \ -- struct device_attribute *attr, char *buf)\ -+ static ssize_t show_##member_name(struct kobject *kobj, \ -+ struct kobj_attribute *attr, char *buf)\ - { \ - struct uncore_data *data = container_of(attr, struct uncore_data,\ -- member_name##_dev_attr);\ -+ member_name##_kobj_attr);\ - \ - return sysfs_emit(buf, "%u\n", \ - data->member_name); \ -@@ -149,29 +149,29 @@ show_uncore_data(initial_max_freq_khz); - - #define init_attribute_rw(_name) \ - do { \ -- sysfs_attr_init(&data->_name##_dev_attr.attr); \ -- data->_name##_dev_attr.show = show_##_name; \ -- data->_name##_dev_attr.store = store_##_name; \ -- data->_name##_dev_attr.attr.name = #_name; \ -- data->_name##_dev_attr.attr.mode = 0644; \ -+ sysfs_attr_init(&data->_name##_kobj_attr.attr); \ -+ data->_name##_kobj_attr.show = show_##_name; \ -+ data->_name##_kobj_attr.store = store_##_name; \ -+ data->_name##_kobj_attr.attr.name = #_name; \ -+ data->_name##_kobj_attr.attr.mode = 0644; \ - } while (0) - - #define init_attribute_ro(_name) \ - do { \ -- sysfs_attr_init(&data->_name##_dev_attr.attr); \ -- data->_name##_dev_attr.show = show_##_name; \ -- data->_name##_dev_attr.store = NULL; \ -- data->_name##_dev_attr.attr.name = #_name; \ -- data->_name##_dev_attr.attr.mode = 0444; \ -+ sysfs_attr_init(&data->_name##_kobj_attr.attr); \ -+ data->_name##_kobj_attr.show = show_##_name; \ -+ data->_name##_kobj_attr.store = NULL; \ -+ data->_name##_kobj_attr.attr.name = #_name; \ -+ data->_name##_kobj_attr.attr.mode = 0444; \ - } while (0) - - #define init_attribute_root_ro(_name) \ - do { \ -- sysfs_attr_init(&data->_name##_dev_attr.attr); \ -- data->_name##_dev_attr.show = show_##_name; \ -- data->_name##_dev_attr.store = NULL; \ -- data->_name##_dev_attr.attr.name = #_name; \ -- data->_name##_dev_attr.attr.mode = 0400; \ -+ sysfs_attr_init(&data->_name##_kobj_attr.attr); \ -+ data->_name##_kobj_attr.show = show_##_name; \ -+ data->_name##_kobj_attr.store = NULL; \ -+ data->_name##_kobj_attr.attr.name = #_name; \ -+ data->_name##_kobj_attr.attr.mode = 0400; \ - } while (0) - - static int create_attr_group(struct uncore_data *data, char *name) -@@ -186,21 +186,21 @@ static int create_attr_group(struct uncore_data *data, char *name) - - if (data->domain_id != UNCORE_DOMAIN_ID_INVALID) { - init_attribute_root_ro(domain_id); -- data->uncore_attrs[index++] = &data->domain_id_dev_attr.attr; -+ data->uncore_attrs[index++] = &data->domain_id_kobj_attr.attr; - init_attribute_root_ro(fabric_cluster_id); -- data->uncore_attrs[index++] = &data->fabric_cluster_id_dev_attr.attr; -+ data->uncore_attrs[index++] = &data->fabric_cluster_id_kobj_attr.attr; - init_attribute_root_ro(package_id); -- data->uncore_attrs[index++] = &data->package_id_dev_attr.attr; -+ data->uncore_attrs[index++] = &data->package_id_kobj_attr.attr; - } - -- data->uncore_attrs[index++] = &data->max_freq_khz_dev_attr.attr; -- data->uncore_attrs[index++] = &data->min_freq_khz_dev_attr.attr; -- data->uncore_attrs[index++] = &data->initial_min_freq_khz_dev_attr.attr; -- data->uncore_attrs[index++] = &data->initial_max_freq_khz_dev_attr.attr; -+ data->uncore_attrs[index++] = &data->max_freq_khz_kobj_attr.attr; -+ data->uncore_attrs[index++] = &data->min_freq_khz_kobj_attr.attr; -+ data->uncore_attrs[index++] = &data->initial_min_freq_khz_kobj_attr.attr; -+ data->uncore_attrs[index++] = &data->initial_max_freq_khz_kobj_attr.attr; - - ret = uncore_read_freq(data, &freq); - if (!ret) -- data->uncore_attrs[index++] = &data->current_freq_khz_dev_attr.attr; -+ data->uncore_attrs[index++] = &data->current_freq_khz_kobj_attr.attr; - - data->uncore_attrs[index] = NULL; - -diff --git a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-common.h b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-common.h -index 7afb69977c7e..0e5bf507e555 100644 ---- a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-common.h -+++ b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-common.h -@@ -26,14 +26,14 @@ - * @instance_id: Unique instance id to append to directory name - * @name: Sysfs entry name for this instance - * @uncore_attr_group: Attribute group storage -- * @max_freq_khz_dev_attr: Storage for device attribute max_freq_khz -- * @mix_freq_khz_dev_attr: Storage for device attribute min_freq_khz -- * @initial_max_freq_khz_dev_attr: Storage for device attribute initial_max_freq_khz -- * @initial_min_freq_khz_dev_attr: Storage for device attribute initial_min_freq_khz -- * @current_freq_khz_dev_attr: Storage for device attribute current_freq_khz -- * @domain_id_dev_attr: Storage for device attribute domain_id -- * @fabric_cluster_id_dev_attr: Storage for device attribute fabric_cluster_id -- * @package_id_dev_attr: Storage for device attribute package_id -+ * @max_freq_khz_kobj_attr: Storage for kobject attribute max_freq_khz -+ * @mix_freq_khz_kobj_attr: Storage for kobject attribute min_freq_khz -+ * @initial_max_freq_khz_kobj_attr: Storage for kobject attribute initial_max_freq_khz -+ * @initial_min_freq_khz_kobj_attr: Storage for kobject attribute initial_min_freq_khz -+ * @current_freq_khz_kobj_attr: Storage for kobject attribute current_freq_khz -+ * @domain_id_kobj_attr: Storage for kobject attribute domain_id -+ * @fabric_cluster_id_kobj_attr: Storage for kobject attribute fabric_cluster_id -+ * @package_id_kobj_attr: Storage for kobject attribute package_id - * @uncore_attrs: Attribute storage for group creation - * - * This structure is used to encapsulate all data related to uncore sysfs -@@ -53,14 +53,14 @@ struct uncore_data { - char name[32]; - - struct attribute_group uncore_attr_group; -- struct device_attribute max_freq_khz_dev_attr; -- struct device_attribute min_freq_khz_dev_attr; -- struct device_attribute initial_max_freq_khz_dev_attr; -- struct device_attribute initial_min_freq_khz_dev_attr; -- struct device_attribute current_freq_khz_dev_attr; -- struct device_attribute domain_id_dev_attr; -- struct device_attribute fabric_cluster_id_dev_attr; -- struct device_attribute package_id_dev_attr; -+ struct kobj_attribute max_freq_khz_kobj_attr; -+ struct kobj_attribute min_freq_khz_kobj_attr; -+ struct kobj_attribute initial_max_freq_khz_kobj_attr; -+ struct kobj_attribute initial_min_freq_khz_kobj_attr; -+ struct kobj_attribute current_freq_khz_kobj_attr; -+ struct kobj_attribute domain_id_kobj_attr; -+ struct kobj_attribute fabric_cluster_id_kobj_attr; -+ struct kobj_attribute package_id_kobj_attr; - struct attribute *uncore_attrs[9]; - }; - --- -2.43.2 - -From d281ac9a987c553d93211b90fd4fe97d8eca32cd Mon Sep 17 00:00:00 2001 -From: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com> -Date: Mon, 8 Jan 2024 15:20:58 +0900 -Subject: [PATCH 0908/1501] platform/x86: p2sb: Allow p2sb_bar() calls during - PCI device probe -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 9053 -Lines: 296 - -commit 5913320eb0b3ec88158cfcb0fa5e996bf4ef681b upstream. - -p2sb_bar() unhides P2SB device to get resources from the device. It -guards the operation by locking pci_rescan_remove_lock so that parallel -rescans do not find the P2SB device. However, this lock causes deadlock -when PCI bus rescan is triggered by /sys/bus/pci/rescan. The rescan -locks pci_rescan_remove_lock and probes PCI devices. When PCI devices -call p2sb_bar() during probe, it locks pci_rescan_remove_lock again. -Hence the deadlock. - -To avoid the deadlock, do not lock pci_rescan_remove_lock in p2sb_bar(). -Instead, do the lock at fs_initcall. Introduce p2sb_cache_resources() -for fs_initcall which gets and caches the P2SB resources. At p2sb_bar(), -refer the cache and return to the caller. - -Before operating the device at P2SB DEVFN for resource cache, check -that its device class is PCI_CLASS_MEMORY_OTHER 0x0580 that PCH -specifications define. This avoids unexpected operation to other devices -at the same DEVFN. - -Link: https://lore.kernel.org/linux-pci/6xb24fjmptxxn5js2fjrrddjae6twex5bjaftwqsuawuqqqydx@7cl3uik5ef6j/ -Fixes: 9745fb07474f ("platform/x86/intel: Add Primary to Sideband (P2SB) bridge support") -Cc: stable@vger.kernel.org -Suggested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com> -Link: https://lore.kernel.org/r/20240108062059.3583028-2-shinichiro.kawasaki@wdc.com -Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> -Tested-by Klara Modin <klarasmodin@gmail.com> -Reviewed-by: Hans de Goede <hdegoede@redhat.com> -Signed-off-by: Hans de Goede <hdegoede@redhat.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/platform/x86/p2sb.c | 202 ++++++++++++++++++++++++++---------- - 1 file changed, 150 insertions(+), 52 deletions(-) - -diff --git a/drivers/platform/x86/p2sb.c b/drivers/platform/x86/p2sb.c -index 1cf2471d54dd..17cc4b45e023 100644 ---- a/drivers/platform/x86/p2sb.c -+++ b/drivers/platform/x86/p2sb.c -@@ -26,6 +26,21 @@ static const struct x86_cpu_id p2sb_cpu_ids[] = { - {} - }; - -+/* -+ * Cache BAR0 of P2SB device functions 0 to 7. -+ * TODO: The constant 8 is the number of functions that PCI specification -+ * defines. Same definitions exist tree-wide. Unify this definition and -+ * the other definitions then move to include/uapi/linux/pci.h. -+ */ -+#define NR_P2SB_RES_CACHE 8 -+ -+struct p2sb_res_cache { -+ u32 bus_dev_id; -+ struct resource res; -+}; -+ -+static struct p2sb_res_cache p2sb_resources[NR_P2SB_RES_CACHE]; -+ - static int p2sb_get_devfn(unsigned int *devfn) - { - unsigned int fn = P2SB_DEVFN_DEFAULT; -@@ -39,8 +54,16 @@ static int p2sb_get_devfn(unsigned int *devfn) - return 0; - } - -+static bool p2sb_valid_resource(struct resource *res) -+{ -+ if (res->flags) -+ return true; -+ -+ return false; -+} -+ - /* Copy resource from the first BAR of the device in question */ --static int p2sb_read_bar0(struct pci_dev *pdev, struct resource *mem) -+static void p2sb_read_bar0(struct pci_dev *pdev, struct resource *mem) - { - struct resource *bar0 = &pdev->resource[0]; - -@@ -56,22 +79,108 @@ static int p2sb_read_bar0(struct pci_dev *pdev, struct resource *mem) - mem->end = bar0->end; - mem->flags = bar0->flags; - mem->desc = bar0->desc; -+} -+ -+static void p2sb_scan_and_cache_devfn(struct pci_bus *bus, unsigned int devfn) -+{ -+ struct p2sb_res_cache *cache = &p2sb_resources[PCI_FUNC(devfn)]; -+ struct pci_dev *pdev; -+ -+ pdev = pci_scan_single_device(bus, devfn); -+ if (!pdev) -+ return; -+ -+ p2sb_read_bar0(pdev, &cache->res); -+ cache->bus_dev_id = bus->dev.id; -+ -+ pci_stop_and_remove_bus_device(pdev); -+} -+ -+static int p2sb_scan_and_cache(struct pci_bus *bus, unsigned int devfn) -+{ -+ unsigned int slot, fn; -+ -+ if (PCI_FUNC(devfn) == 0) { -+ /* -+ * When function number of the P2SB device is zero, scan it and -+ * other function numbers, and if devices are available, cache -+ * their BAR0s. -+ */ -+ slot = PCI_SLOT(devfn); -+ for (fn = 0; fn < NR_P2SB_RES_CACHE; fn++) -+ p2sb_scan_and_cache_devfn(bus, PCI_DEVFN(slot, fn)); -+ } else { -+ /* Scan the P2SB device and cache its BAR0 */ -+ p2sb_scan_and_cache_devfn(bus, devfn); -+ } -+ -+ if (!p2sb_valid_resource(&p2sb_resources[PCI_FUNC(devfn)].res)) -+ return -ENOENT; - - return 0; - } - --static int p2sb_scan_and_read(struct pci_bus *bus, unsigned int devfn, struct resource *mem) -+static struct pci_bus *p2sb_get_bus(struct pci_bus *bus) - { -- struct pci_dev *pdev; -+ static struct pci_bus *p2sb_bus; -+ -+ bus = bus ?: p2sb_bus; -+ if (bus) -+ return bus; -+ -+ /* Assume P2SB is on the bus 0 in domain 0 */ -+ p2sb_bus = pci_find_bus(0, 0); -+ return p2sb_bus; -+} -+ -+static int p2sb_cache_resources(void) -+{ -+ unsigned int devfn_p2sb; -+ u32 value = P2SBC_HIDE; -+ struct pci_bus *bus; -+ u16 class; - int ret; - -- pdev = pci_scan_single_device(bus, devfn); -- if (!pdev) -+ /* Get devfn for P2SB device itself */ -+ ret = p2sb_get_devfn(&devfn_p2sb); -+ if (ret) -+ return ret; -+ -+ bus = p2sb_get_bus(NULL); -+ if (!bus) - return -ENODEV; - -- ret = p2sb_read_bar0(pdev, mem); -+ /* -+ * When a device with same devfn exists and its device class is not -+ * PCI_CLASS_MEMORY_OTHER for P2SB, do not touch it. -+ */ -+ pci_bus_read_config_word(bus, devfn_p2sb, PCI_CLASS_DEVICE, &class); -+ if (!PCI_POSSIBLE_ERROR(class) && class != PCI_CLASS_MEMORY_OTHER) -+ return -ENODEV; -+ -+ /* -+ * Prevent concurrent PCI bus scan from seeing the P2SB device and -+ * removing via sysfs while it is temporarily exposed. -+ */ -+ pci_lock_rescan_remove(); -+ -+ /* -+ * The BIOS prevents the P2SB device from being enumerated by the PCI -+ * subsystem, so we need to unhide and hide it back to lookup the BAR. -+ * Unhide the P2SB device here, if needed. -+ */ -+ pci_bus_read_config_dword(bus, devfn_p2sb, P2SBC, &value); -+ if (value & P2SBC_HIDE) -+ pci_bus_write_config_dword(bus, devfn_p2sb, P2SBC, 0); -+ -+ ret = p2sb_scan_and_cache(bus, devfn_p2sb); -+ -+ /* Hide the P2SB device, if it was hidden */ -+ if (value & P2SBC_HIDE) -+ pci_bus_write_config_dword(bus, devfn_p2sb, P2SBC, P2SBC_HIDE); -+ -+ pci_unlock_rescan_remove(); - -- pci_stop_and_remove_bus_device(pdev); - return ret; - } - -@@ -81,64 +190,53 @@ static int p2sb_scan_and_read(struct pci_bus *bus, unsigned int devfn, struct re - * @devfn: PCI slot and function to communicate with - * @mem: memory resource to be filled in - * -- * The BIOS prevents the P2SB device from being enumerated by the PCI -- * subsystem, so we need to unhide and hide it back to lookup the BAR. -- * -- * if @bus is NULL, the bus 0 in domain 0 will be used. -+ * If @bus is NULL, the bus 0 in domain 0 will be used. - * If @devfn is 0, it will be replaced by devfn of the P2SB device. - * - * Caller must provide a valid pointer to @mem. - * -- * Locking is handled by pci_rescan_remove_lock mutex. -- * - * Return: - * 0 on success or appropriate errno value on error. - */ - int p2sb_bar(struct pci_bus *bus, unsigned int devfn, struct resource *mem) - { -- struct pci_dev *pdev_p2sb; -- unsigned int devfn_p2sb; -- u32 value = P2SBC_HIDE; -+ struct p2sb_res_cache *cache; - int ret; - -- /* Get devfn for P2SB device itself */ -- ret = p2sb_get_devfn(&devfn_p2sb); -- if (ret) -- return ret; -- -- /* if @bus is NULL, use bus 0 in domain 0 */ -- bus = bus ?: pci_find_bus(0, 0); -- -- /* -- * Prevent concurrent PCI bus scan from seeing the P2SB device and -- * removing via sysfs while it is temporarily exposed. -- */ -- pci_lock_rescan_remove(); -- -- /* Unhide the P2SB device, if needed */ -- pci_bus_read_config_dword(bus, devfn_p2sb, P2SBC, &value); -- if (value & P2SBC_HIDE) -- pci_bus_write_config_dword(bus, devfn_p2sb, P2SBC, 0); -- -- pdev_p2sb = pci_scan_single_device(bus, devfn_p2sb); -- if (devfn) -- ret = p2sb_scan_and_read(bus, devfn, mem); -- else -- ret = p2sb_read_bar0(pdev_p2sb, mem); -- pci_stop_and_remove_bus_device(pdev_p2sb); -- -- /* Hide the P2SB device, if it was hidden */ -- if (value & P2SBC_HIDE) -- pci_bus_write_config_dword(bus, devfn_p2sb, P2SBC, P2SBC_HIDE); -- -- pci_unlock_rescan_remove(); -- -- if (ret) -- return ret; -- -- if (mem->flags == 0) -+ bus = p2sb_get_bus(bus); -+ if (!bus) - return -ENODEV; - -+ if (!devfn) { -+ ret = p2sb_get_devfn(&devfn); -+ if (ret) -+ return ret; -+ } -+ -+ cache = &p2sb_resources[PCI_FUNC(devfn)]; -+ if (cache->bus_dev_id != bus->dev.id) -+ return -ENODEV; -+ -+ if (!p2sb_valid_resource(&cache->res)) -+ return -ENOENT; -+ -+ memcpy(mem, &cache->res, sizeof(*mem)); - return 0; - } - EXPORT_SYMBOL_GPL(p2sb_bar); -+ -+static int __init p2sb_fs_init(void) -+{ -+ p2sb_cache_resources(); -+ return 0; -+} -+ -+/* -+ * pci_rescan_remove_lock to avoid access to unhidden P2SB devices can -+ * not be locked in sysfs pci bus rescan path because of deadlock. To -+ * avoid the deadlock, access to P2SB devices with the lock at an early -+ * step in kernel initialization and cache required resources. This -+ * should happen after subsys_initcall which initializes PCI subsystem -+ * and before device_initcall which requires P2SB resources. -+ */ -+fs_initcall(p2sb_fs_init); --- -2.43.2 - -From 6993328a4cd62a24df254b587c0796a4a1eecc95 Mon Sep 17 00:00:00 2001 -From: Lin Ma <linma@zju.edu.cn> -Date: Sun, 21 Jan 2024 15:35:06 +0800 -Subject: [PATCH 0909/1501] ksmbd: fix global oob in ksmbd_nl_policy -Content-Length: 5591 -Lines: 125 - -commit ebeae8adf89d9a82359f6659b1663d09beec2faa upstream. - -Similar to a reported issue (check the commit b33fb5b801c6 ("net: -qualcomm: rmnet: fix global oob in rmnet_policy"), my local fuzzer finds -another global out-of-bounds read for policy ksmbd_nl_policy. See bug -trace below: - -================================================================== -BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline] -BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 -Read of size 1 at addr ffffffff8f24b100 by task syz-executor.1/62810 - -CPU: 0 PID: 62810 Comm: syz-executor.1 Tainted: G N 6.1.0 #3 -Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 -Call Trace: - <TASK> - __dump_stack lib/dump_stack.c:88 [inline] - dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106 - print_address_description mm/kasan/report.c:284 [inline] - print_report+0x172/0x475 mm/kasan/report.c:395 - kasan_report+0xbb/0x1c0 mm/kasan/report.c:495 - validate_nla lib/nlattr.c:386 [inline] - __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 - __nla_parse+0x3e/0x50 lib/nlattr.c:697 - __nlmsg_parse include/net/netlink.h:748 [inline] - genl_family_rcv_msg_attrs_parse.constprop.0+0x1b0/0x290 net/netlink/genetlink.c:565 - genl_family_rcv_msg_doit+0xda/0x330 net/netlink/genetlink.c:734 - genl_family_rcv_msg net/netlink/genetlink.c:833 [inline] - genl_rcv_msg+0x441/0x780 net/netlink/genetlink.c:850 - netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540 - genl_rcv+0x24/0x40 net/netlink/genetlink.c:861 - netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] - netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345 - netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921 - sock_sendmsg_nosec net/socket.c:714 [inline] - sock_sendmsg+0x154/0x190 net/socket.c:734 - ____sys_sendmsg+0x6df/0x840 net/socket.c:2482 - ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 - __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 - do_syscall_x64 arch/x86/entry/common.c:50 [inline] - do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 - entry_SYSCALL_64_after_hwframe+0x63/0xcd -RIP: 0033:0x7fdd66a8f359 -Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 -RSP: 002b:00007fdd65e00168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e -RAX: ffffffffffffffda RBX: 00007fdd66bbcf80 RCX: 00007fdd66a8f359 -RDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000003 -RBP: 00007fdd66ada493 R08: 0000000000000000 R09: 0000000000000000 -R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 -R13: 00007ffc84b81aff R14: 00007fdd65e00300 R15: 0000000000022000 - </TASK> - -The buggy address belongs to the variable: - ksmbd_nl_policy+0x100/0xa80 - -The buggy address belongs to the physical page: -page:0000000034f47940 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1ccc4b -flags: 0x200000000001000(reserved|node=0|zone=2) -raw: 0200000000001000 ffffea00073312c8 ffffea00073312c8 0000000000000000 -raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 -page dumped because: kasan: bad access detected - -Memory state around the buggy address: - ffffffff8f24b000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - ffffffff8f24b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ->ffffffff8f24b100: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 07 f9 - ^ - ffffffff8f24b180: f9 f9 f9 f9 00 05 f9 f9 f9 f9 f9 f9 00 00 00 05 - ffffffff8f24b200: f9 f9 f9 f9 00 00 03 f9 f9 f9 f9 f9 00 00 04 f9 -================================================================== - -To fix it, add a placeholder named __KSMBD_EVENT_MAX and let -KSMBD_EVENT_MAX to be its original value - 1 according to what other -netlink families do. Also change two sites that refer the -KSMBD_EVENT_MAX to correct value. - -Cc: stable@vger.kernel.org -Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") -Signed-off-by: Lin Ma <linma@zju.edu.cn> -Acked-by: Namjae Jeon <linkinjeon@kernel.org> -Signed-off-by: Steve French <stfrench@microsoft.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/smb/server/ksmbd_netlink.h | 3 ++- - fs/smb/server/transport_ipc.c | 4 ++-- - 2 files changed, 4 insertions(+), 3 deletions(-) - -diff --git a/fs/smb/server/ksmbd_netlink.h b/fs/smb/server/ksmbd_netlink.h -index b7521e41402e..0ebf91ffa236 100644 ---- a/fs/smb/server/ksmbd_netlink.h -+++ b/fs/smb/server/ksmbd_netlink.h -@@ -304,7 +304,8 @@ enum ksmbd_event { - KSMBD_EVENT_SPNEGO_AUTHEN_REQUEST, - KSMBD_EVENT_SPNEGO_AUTHEN_RESPONSE = 15, - -- KSMBD_EVENT_MAX -+ __KSMBD_EVENT_MAX, -+ KSMBD_EVENT_MAX = __KSMBD_EVENT_MAX - 1 - }; - - /* -diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c -index b49d47bdafc9..f29bb03f0dc4 100644 ---- a/fs/smb/server/transport_ipc.c -+++ b/fs/smb/server/transport_ipc.c -@@ -74,7 +74,7 @@ static int handle_unsupported_event(struct sk_buff *skb, struct genl_info *info) - static int handle_generic_event(struct sk_buff *skb, struct genl_info *info); - static int ksmbd_ipc_heartbeat_request(void); - --static const struct nla_policy ksmbd_nl_policy[KSMBD_EVENT_MAX] = { -+static const struct nla_policy ksmbd_nl_policy[KSMBD_EVENT_MAX + 1] = { - [KSMBD_EVENT_UNSPEC] = { - .len = 0, - }, -@@ -403,7 +403,7 @@ static int handle_generic_event(struct sk_buff *skb, struct genl_info *info) - return -EPERM; - #endif - -- if (type >= KSMBD_EVENT_MAX) { -+ if (type > KSMBD_EVENT_MAX) { - WARN_ON(1); - return -EINVAL; - } --- -2.43.2 - -From 12dc4217f16551d6dee9cbefc23fdb5659558cda Mon Sep 17 00:00:00 2001 -From: Cristian Marussi <cristian.marussi@arm.com> -Date: Wed, 20 Dec 2023 17:21:12 +0000 -Subject: [PATCH 0910/1501] firmware: arm_scmi: Check mailbox/SMT channel for - consistency -Content-Length: 4352 -Lines: 97 - -commit 437a310b22244d4e0b78665c3042e5d1c0f45306 upstream. - -On reception of a completion interrupt the shared memory area is accessed -to retrieve the message header at first and then, if the message sequence -number identifies a transaction which is still pending, the related -payload is fetched too. - -When an SCMI command times out the channel ownership remains with the -platform until eventually a late reply is received and, as a consequence, -any further transmission attempt remains pending, waiting for the channel -to be relinquished by the platform. - -Once that late reply is received the channel ownership is given back -to the agent and any pending request is then allowed to proceed and -overwrite the SMT area of the just delivered late reply; then the wait -for the reply to the new request starts. - -It has been observed that the spurious IRQ related to the late reply can -be wrongly associated with the freshly enqueued request: when that happens -the SCMI stack in-flight lookup procedure is fooled by the fact that the -message header now present in the SMT area is related to the new pending -transaction, even though the real reply has still to arrive. - -This race-condition on the A2P channel can be detected by looking at the -channel status bits: a genuine reply from the platform will have set the -channel free bit before triggering the completion IRQ. - -Add a consistency check to validate such condition in the A2P ISR. - -Reported-by: Xinglong Yang <xinglong.yang@cixtech.com> -Closes: https://lore.kernel.org/all/PUZPR06MB54981E6FA00D82BFDBB864FBF08DA@PUZPR06MB5498.apcprd06.prod.outlook.com/ -Fixes: 5c8a47a5a91d ("firmware: arm_scmi: Make scmi core independent of the transport type") -Cc: stable@vger.kernel.org # 5.15+ -Signed-off-by: Cristian Marussi <cristian.marussi@arm.com> -Tested-by: Xinglong Yang <xinglong.yang@cixtech.com> -Link: https://lore.kernel.org/r/20231220172112.763539-1-cristian.marussi@arm.com -Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/firmware/arm_scmi/common.h | 1 + - drivers/firmware/arm_scmi/mailbox.c | 14 ++++++++++++++ - drivers/firmware/arm_scmi/shmem.c | 6 ++++++ - 3 files changed, 21 insertions(+) - -diff --git a/drivers/firmware/arm_scmi/common.h b/drivers/firmware/arm_scmi/common.h -index c46dc5215af7..00b165d1f502 100644 ---- a/drivers/firmware/arm_scmi/common.h -+++ b/drivers/firmware/arm_scmi/common.h -@@ -314,6 +314,7 @@ void shmem_fetch_notification(struct scmi_shared_mem __iomem *shmem, - void shmem_clear_channel(struct scmi_shared_mem __iomem *shmem); - bool shmem_poll_done(struct scmi_shared_mem __iomem *shmem, - struct scmi_xfer *xfer); -+bool shmem_channel_free(struct scmi_shared_mem __iomem *shmem); - - /* declarations for message passing transports */ - struct scmi_msg_payld; -diff --git a/drivers/firmware/arm_scmi/mailbox.c b/drivers/firmware/arm_scmi/mailbox.c -index 19246ed1f01f..b8d470417e8f 100644 ---- a/drivers/firmware/arm_scmi/mailbox.c -+++ b/drivers/firmware/arm_scmi/mailbox.c -@@ -45,6 +45,20 @@ static void rx_callback(struct mbox_client *cl, void *m) - { - struct scmi_mailbox *smbox = client_to_scmi_mailbox(cl); - -+ /* -+ * An A2P IRQ is NOT valid when received while the platform still has -+ * the ownership of the channel, because the platform at first releases -+ * the SMT channel and then sends the completion interrupt. -+ * -+ * This addresses a possible race condition in which a spurious IRQ from -+ * a previous timed-out reply which arrived late could be wrongly -+ * associated with the next pending transaction. -+ */ -+ if (cl->knows_txdone && !shmem_channel_free(smbox->shmem)) { -+ dev_warn(smbox->cinfo->dev, "Ignoring spurious A2P IRQ !\n"); -+ return; -+ } -+ - scmi_rx_callback(smbox->cinfo, shmem_read_header(smbox->shmem), NULL); - } - -diff --git a/drivers/firmware/arm_scmi/shmem.c b/drivers/firmware/arm_scmi/shmem.c -index 87b4f4d35f06..517d52fb3bcb 100644 ---- a/drivers/firmware/arm_scmi/shmem.c -+++ b/drivers/firmware/arm_scmi/shmem.c -@@ -122,3 +122,9 @@ bool shmem_poll_done(struct scmi_shared_mem __iomem *shmem, - (SCMI_SHMEM_CHAN_STAT_CHANNEL_ERROR | - SCMI_SHMEM_CHAN_STAT_CHANNEL_FREE); - } -+ -+bool shmem_channel_free(struct scmi_shared_mem __iomem *shmem) -+{ -+ return (ioread32(&shmem->channel_status) & -+ SCMI_SHMEM_CHAN_STAT_CHANNEL_FREE); -+} --- -2.43.2 - -From 29faedc76f549cf67f0e17b91682a7d59a2b7277 Mon Sep 17 00:00:00 2001 -From: Thomas Zimmermann <tzimmermann@suse.de> -Date: Tue, 23 Jan 2024 13:09:26 +0100 -Subject: [PATCH 0911/1501] Revert "drivers/firmware: Move sysfb_init() from - device_initcall to subsys_initcall_sync" -Content-Length: 1846 -Lines: 44 - -commit d1b163aa0749706379055e40a52cf7a851abf9dc upstream. - -This reverts commit 60aebc9559492cea6a9625f514a8041717e3a2e4. - -Commit 60aebc9559492cea ("drivers/firmware: Move sysfb_init() from -device_initcall to subsys_initcall_sync") messes up initialization order -of the graphics drivers and leads to blank displays on some systems. So -revert the commit. - -To make the display drivers fully independent from initialization -order requires to track framebuffer memory by device and independently -from the loaded drivers. The kernel currently lacks the infrastructure -to do so. - -Reported-by: Jaak Ristioja <jaak@ristioja.ee> -Closes: https://lore.kernel.org/dri-devel/ZUnNi3q3yB3zZfTl@P70.localdomain/T/#t -Reported-by: Huacai Chen <chenhuacai@loongson.cn> -Closes: https://lore.kernel.org/dri-devel/20231108024613.2898921-1-chenhuacai@loongson.cn/ -Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/10133 -Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> -Cc: Javier Martinez Canillas <javierm@redhat.com> -Cc: Thorsten Leemhuis <regressions@leemhuis.info> -Cc: Jani Nikula <jani.nikula@linux.intel.com> -Cc: stable@vger.kernel.org # v6.5+ -Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> -Acked-by: Jani Nikula <jani.nikula@intel.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20240123120937.27736-1-tzimmermann@suse.de -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/firmware/sysfb.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/firmware/sysfb.c b/drivers/firmware/sysfb.c -index 82fcfd29bc4d..3c197db42c9d 100644 ---- a/drivers/firmware/sysfb.c -+++ b/drivers/firmware/sysfb.c -@@ -128,4 +128,4 @@ static __init int sysfb_init(void) - } - - /* must execute after PCI subsystem for EFI quirks */ --subsys_initcall_sync(sysfb_init); -+device_initcall(sysfb_init); --- -2.43.2 - -From d3887448486caeef9687fb5dfebd4ff91e0f25aa Mon Sep 17 00:00:00 2001 -From: Ma Jun <Jun.Ma2@amd.com> -Date: Fri, 12 Jan 2024 13:33:24 +0800 -Subject: [PATCH 0912/1501] drm/amdgpu: Fix the null pointer when load rlc - firmware -Content-Length: 1884 -Lines: 46 - -commit bc03c02cc1991a066b23e69bbcc0f66e8f1f7453 upstream. - -If the RLC firmware is invalid because of wrong header size, -the pointer to the rlc firmware is released in function -amdgpu_ucode_request. There will be a null pointer error -in subsequent use. So skip validation to fix it. - -Fixes: 3da9b71563cb ("drm/amd: Use `amdgpu_ucode_*` helpers for GFX10") -Signed-off-by: Ma Jun <Jun.Ma2@amd.com> -Acked-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 15 ++++++--------- - 1 file changed, 6 insertions(+), 9 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c -index c8a3bf01743f..67c198ea8211 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c -@@ -3996,16 +3996,13 @@ static int gfx_v10_0_init_microcode(struct amdgpu_device *adev) - - if (!amdgpu_sriov_vf(adev)) { - snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", ucode_prefix); -- err = amdgpu_ucode_request(adev, &adev->gfx.rlc_fw, fw_name); -- /* don't check this. There are apparently firmwares in the wild with -- * incorrect size in the header -- */ -- if (err == -ENODEV) -- goto out; -+ err = request_firmware(&adev->gfx.rlc_fw, fw_name, adev->dev); - if (err) -- dev_dbg(adev->dev, -- "gfx10: amdgpu_ucode_request() failed \"%s\"\n", -- fw_name); -+ goto out; -+ -+ /* don't validate this firmware. There are apparently firmwares -+ * in the wild with incorrect size in the header -+ */ - rlc_hdr = (const struct rlc_firmware_header_v2_0 *)adev->gfx.rlc_fw->data; - version_major = le16_to_cpu(rlc_hdr->header.header_version_major); - version_minor = le16_to_cpu(rlc_hdr->header.header_version_minor); --- -2.43.2 - -From ff31e8358ab2da5755a91c87392b178495b2d961 Mon Sep 17 00:00:00 2001 -From: Dave Chinner <dchinner@redhat.com> -Date: Tue, 16 Jan 2024 15:33:07 +1100 -Subject: [PATCH 0913/1501] xfs: read only mounts with fsopen mount API are - busted -Content-Length: 4425 -Lines: 124 - -commit d8d222e09dab84a17bb65dda4b94d01c565f5327 upstream. - -Recently xfs/513 started failing on my test machines testing "-o -ro,norecovery" mount options. This was being emitted in dmesg: - -[ 9906.932724] XFS (pmem0): no-recovery mounts must be read-only. - -Turns out, readonly mounts with the fsopen()/fsconfig() mount API -have been busted since day zero. It's only taken 5 years for debian -unstable to start using this "new" mount API, and shortly after this -I noticed xfs/513 had started to fail as per above. - -The syscall trace is: - -fsopen("xfs", FSOPEN_CLOEXEC) = 3 -mount_setattr(-1, NULL, 0, NULL, 0) = -1 EINVAL (Invalid argument) -..... -fsconfig(3, FSCONFIG_SET_STRING, "source", "/dev/pmem0", 0) = 0 -fsconfig(3, FSCONFIG_SET_FLAG, "ro", NULL, 0) = 0 -fsconfig(3, FSCONFIG_SET_FLAG, "norecovery", NULL, 0) = 0 -fsconfig(3, FSCONFIG_CMD_CREATE, NULL, NULL, 0) = -1 EINVAL (Invalid argument) -close(3) = 0 - -Showing that the actual mount instantiation (FSCONFIG_CMD_CREATE) is -what threw out the error. - -During mount instantiation, we call xfs_fs_validate_params() which -does: - - /* No recovery flag requires a read-only mount */ - if (xfs_has_norecovery(mp) && !xfs_is_readonly(mp)) { - xfs_warn(mp, "no-recovery mounts must be read-only."); - return -EINVAL; - } - -and xfs_is_readonly() checks internal mount flags for read only -state. This state is set in xfs_init_fs_context() from the -context superblock flag state: - - /* - * Copy binary VFS mount flags we are interested in. - */ - if (fc->sb_flags & SB_RDONLY) - set_bit(XFS_OPSTATE_READONLY, &mp->m_opstate); - -With the old mount API, all of the VFS specific superblock flags -had already been parsed and set before xfs_init_fs_context() is -called, so this all works fine. - -However, in the brave new fsopen/fsconfig world, -xfs_init_fs_context() is called from fsopen() context, before any -VFS superblock have been set or parsed. Hence if we use fsopen(), -the internal XFS readonly state is *never set*. Hence anything that -depends on xfs_is_readonly() actually returning true for read only -mounts is broken if fsopen() has been used to mount the filesystem. - -Fix this by moving this internal state initialisation to -xfs_fs_fill_super() before we attempt to validate the parameters -that have been set prior to the FSCONFIG_CMD_CREATE call being made. - -Signed-off-by: Dave Chinner <dchinner@redhat.com> -Fixes: 73e5fff98b64 ("xfs: switch to use the new mount-api") -cc: stable@vger.kernel.org -Reviewed-by: Christoph Hellwig <hch@lst.de> -Signed-off-by: Chandan Babu R <chandanbabu@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/xfs/xfs_super.c | 27 +++++++++++++++++---------- - 1 file changed, 17 insertions(+), 10 deletions(-) - -diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c -index 764304595e8b..3f8e6233fff7 100644 ---- a/fs/xfs/xfs_super.c -+++ b/fs/xfs/xfs_super.c -@@ -1510,6 +1510,18 @@ xfs_fs_fill_super( - - mp->m_super = sb; - -+ /* -+ * Copy VFS mount flags from the context now that all parameter parsing -+ * is guaranteed to have been completed by either the old mount API or -+ * the newer fsopen/fsconfig API. -+ */ -+ if (fc->sb_flags & SB_RDONLY) -+ set_bit(XFS_OPSTATE_READONLY, &mp->m_opstate); -+ if (fc->sb_flags & SB_DIRSYNC) -+ mp->m_features |= XFS_FEAT_DIRSYNC; -+ if (fc->sb_flags & SB_SYNCHRONOUS) -+ mp->m_features |= XFS_FEAT_WSYNC; -+ - error = xfs_fs_validate_params(mp); - if (error) - return error; -@@ -1979,6 +1991,11 @@ static const struct fs_context_operations xfs_context_ops = { - .free = xfs_fs_free, - }; - -+/* -+ * WARNING: do not initialise any parameters in this function that depend on -+ * mount option parsing having already been performed as this can be called from -+ * fsopen() before any parameters have been set. -+ */ - static int xfs_init_fs_context( - struct fs_context *fc) - { -@@ -2010,16 +2027,6 @@ static int xfs_init_fs_context( - mp->m_logbsize = -1; - mp->m_allocsize_log = 16; /* 64k */ - -- /* -- * Copy binary VFS mount flags we are interested in. -- */ -- if (fc->sb_flags & SB_RDONLY) -- set_bit(XFS_OPSTATE_READONLY, &mp->m_opstate); -- if (fc->sb_flags & SB_DIRSYNC) -- mp->m_features |= XFS_FEAT_DIRSYNC; -- if (fc->sb_flags & SB_SYNCHRONOUS) -- mp->m_features |= XFS_FEAT_WSYNC; -- - fc->s_fs_info = mp; - fc->ops = &xfs_context_ops; - --- -2.43.2 - -From 11d9f99757315a1c4b82170ccf57ef1969be65cd Mon Sep 17 00:00:00 2001 -From: Mario Limonciello <mario.limonciello@amd.com> -Date: Wed, 17 Jan 2024 08:29:42 -0600 -Subject: [PATCH 0914/1501] gpiolib: acpi: Ignore touchpad wakeup on GPD - G1619-04 -Content-Length: 1383 -Lines: 43 - -commit 805c74eac8cb306dc69b87b6b066ab4da77ceaf1 upstream. - -Spurious wakeups are reported on the GPD G1619-04 which -can be absolved by programming the GPIO to ignore wakeups. - -Cc: stable@vger.kernel.org -Reported-and-tested-by: George Melikov <mail@gmelikov.ru> -Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3073 -Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> -Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpio/gpiolib-acpi.c | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) - -diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c -index 88066826d8e5..cd3e9657cc36 100644 ---- a/drivers/gpio/gpiolib-acpi.c -+++ b/drivers/gpio/gpiolib-acpi.c -@@ -1651,6 +1651,20 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] __initconst = { - .ignore_interrupt = "INT33FC:00@3", - }, - }, -+ { -+ /* -+ * Spurious wakeups from TP_ATTN# pin -+ * Found in BIOS 0.35 -+ * https://gitlab.freedesktop.org/drm/amd/-/issues/3073 -+ */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "GPD"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "G1619-04"), -+ }, -+ .driver_data = &(struct acpi_gpiolib_dmi_quirk) { -+ .ignore_wake = "PNP0C50:00@8", -+ }, -+ }, - {} /* Terminating entry */ - }; - --- -2.43.2 - -From 13eb8c89762d96d6086bb4da7d5763f8ec0d93c2 Mon Sep 17 00:00:00 2001 -From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com> -Date: Mon, 22 Jan 2024 15:18:11 +0100 -Subject: [PATCH 0915/1501] cpufreq: intel_pstate: Refine computation of - P-state for given frequency -Content-Length: 5022 -Lines: 135 - -commit 192cdb1c907fd8df2d764c5bb17496e415e59391 upstream. - -On systems using HWP, if a given frequency is equal to the maximum turbo -frequency or the maximum non-turbo frequency, the HWP performance level -corresponding to it is already known and can be used directly without -any computation. - -Accordingly, adjust the code to use the known HWP performance levels in -the cases mentioned above. - -This also helps to avoid limiting CPU capacity artificially in some -cases when the BIOS produces the HWP_CAP numbers using a different -E-core-to-P-core performance scaling factor than expected by the kernel. - -Fixes: f5c8cf2a4992 ("cpufreq: intel_pstate: hybrid: Use known scaling factor for P-cores") -Cc: 6.1+ <stable@vger.kernel.org> # 6.1+ -Tested-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/cpufreq/intel_pstate.c | 55 +++++++++++++++++++++------------- - 1 file changed, 34 insertions(+), 21 deletions(-) - -diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c -index a534a1f7f1ee..f5c69fa230d9 100644 ---- a/drivers/cpufreq/intel_pstate.c -+++ b/drivers/cpufreq/intel_pstate.c -@@ -526,6 +526,30 @@ static int intel_pstate_cppc_get_scaling(int cpu) - } - #endif /* CONFIG_ACPI_CPPC_LIB */ - -+static int intel_pstate_freq_to_hwp_rel(struct cpudata *cpu, int freq, -+ unsigned int relation) -+{ -+ if (freq == cpu->pstate.turbo_freq) -+ return cpu->pstate.turbo_pstate; -+ -+ if (freq == cpu->pstate.max_freq) -+ return cpu->pstate.max_pstate; -+ -+ switch (relation) { -+ case CPUFREQ_RELATION_H: -+ return freq / cpu->pstate.scaling; -+ case CPUFREQ_RELATION_C: -+ return DIV_ROUND_CLOSEST(freq, cpu->pstate.scaling); -+ } -+ -+ return DIV_ROUND_UP(freq, cpu->pstate.scaling); -+} -+ -+static int intel_pstate_freq_to_hwp(struct cpudata *cpu, int freq) -+{ -+ return intel_pstate_freq_to_hwp_rel(cpu, freq, CPUFREQ_RELATION_L); -+} -+ - /** - * intel_pstate_hybrid_hwp_adjust - Calibrate HWP performance levels. - * @cpu: Target CPU. -@@ -543,6 +567,7 @@ static void intel_pstate_hybrid_hwp_adjust(struct cpudata *cpu) - int perf_ctl_scaling = cpu->pstate.perf_ctl_scaling; - int perf_ctl_turbo = pstate_funcs.get_turbo(cpu->cpu); - int scaling = cpu->pstate.scaling; -+ int freq; - - pr_debug("CPU%d: perf_ctl_max_phys = %d\n", cpu->cpu, perf_ctl_max_phys); - pr_debug("CPU%d: perf_ctl_turbo = %d\n", cpu->cpu, perf_ctl_turbo); -@@ -556,16 +581,16 @@ static void intel_pstate_hybrid_hwp_adjust(struct cpudata *cpu) - cpu->pstate.max_freq = rounddown(cpu->pstate.max_pstate * scaling, - perf_ctl_scaling); - -- cpu->pstate.max_pstate_physical = -- DIV_ROUND_UP(perf_ctl_max_phys * perf_ctl_scaling, -- scaling); -+ freq = perf_ctl_max_phys * perf_ctl_scaling; -+ cpu->pstate.max_pstate_physical = intel_pstate_freq_to_hwp(cpu, freq); - -- cpu->pstate.min_freq = cpu->pstate.min_pstate * perf_ctl_scaling; -+ freq = cpu->pstate.min_pstate * perf_ctl_scaling; -+ cpu->pstate.min_freq = freq; - /* - * Cast the min P-state value retrieved via pstate_funcs.get_min() to - * the effective range of HWP performance levels. - */ -- cpu->pstate.min_pstate = DIV_ROUND_UP(cpu->pstate.min_freq, scaling); -+ cpu->pstate.min_pstate = intel_pstate_freq_to_hwp(cpu, freq); - } - - static inline void update_turbo_state(void) -@@ -2524,13 +2549,12 @@ static void intel_pstate_update_perf_limits(struct cpudata *cpu, - * abstract values to represent performance rather than pure ratios. - */ - if (hwp_active && cpu->pstate.scaling != perf_ctl_scaling) { -- int scaling = cpu->pstate.scaling; - int freq; - - freq = max_policy_perf * perf_ctl_scaling; -- max_policy_perf = DIV_ROUND_UP(freq, scaling); -+ max_policy_perf = intel_pstate_freq_to_hwp(cpu, freq); - freq = min_policy_perf * perf_ctl_scaling; -- min_policy_perf = DIV_ROUND_UP(freq, scaling); -+ min_policy_perf = intel_pstate_freq_to_hwp(cpu, freq); - } - - pr_debug("cpu:%d min_policy_perf:%d max_policy_perf:%d\n", -@@ -2904,18 +2928,7 @@ static int intel_cpufreq_target(struct cpufreq_policy *policy, - - cpufreq_freq_transition_begin(policy, &freqs); - -- switch (relation) { -- case CPUFREQ_RELATION_L: -- target_pstate = DIV_ROUND_UP(freqs.new, cpu->pstate.scaling); -- break; -- case CPUFREQ_RELATION_H: -- target_pstate = freqs.new / cpu->pstate.scaling; -- break; -- default: -- target_pstate = DIV_ROUND_CLOSEST(freqs.new, cpu->pstate.scaling); -- break; -- } -- -+ target_pstate = intel_pstate_freq_to_hwp_rel(cpu, freqs.new, relation); - target_pstate = intel_cpufreq_update_pstate(policy, target_pstate, false); - - freqs.new = target_pstate * cpu->pstate.scaling; -@@ -2933,7 +2946,7 @@ static unsigned int intel_cpufreq_fast_switch(struct cpufreq_policy *policy, - - update_turbo_state(); - -- target_pstate = DIV_ROUND_UP(target_freq, cpu->pstate.scaling); -+ target_pstate = intel_pstate_freq_to_hwp(cpu, target_freq); - - target_pstate = intel_cpufreq_update_pstate(policy, target_pstate, true); - --- -2.43.2 - -From 2e55e7dabeec38a1c1b405d6d741c1be2e20ddb6 Mon Sep 17 00:00:00 2001 -From: Dave Airlie <airlied@redhat.com> -Date: Sat, 27 Jan 2024 04:04:34 +1000 -Subject: [PATCH 0916/1501] Revert "nouveau: push event block/allowing out of - the fence context" -Content-Length: 3693 -Lines: 115 - -commit 4d7acc8f48bcf27d0dc068f02e55c77e840b9110 upstream. - -This reverts commit eacabb5462717a52fccbbbba458365a4f5e61f35. - -This commit causes some regressions in desktop usage, this will -reintroduce the original deadlock in DRI_PRIME situations, I've -got an idea to fix it by offloading to a workqueue in a different -spot, however this code has a race condition where we sometimes -miss interrupts so I'd like to fix that as well. - -Cc: stable@vger.kernel.org -Signed-off-by: Dave Airlie <airlied@redhat.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/nouveau/nouveau_fence.c | 28 +++++-------------------- - drivers/gpu/drm/nouveau/nouveau_fence.h | 5 +---- - 2 files changed, 6 insertions(+), 27 deletions(-) - -diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c -index 5057d976fa57..ca762ea55413 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_fence.c -+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c -@@ -62,7 +62,7 @@ nouveau_fence_signal(struct nouveau_fence *fence) - if (test_bit(DMA_FENCE_FLAG_USER_BITS, &fence->base.flags)) { - struct nouveau_fence_chan *fctx = nouveau_fctx(fence); - -- if (atomic_dec_and_test(&fctx->notify_ref)) -+ if (!--fctx->notify_ref) - drop = 1; - } - -@@ -103,7 +103,6 @@ nouveau_fence_context_kill(struct nouveau_fence_chan *fctx, int error) - void - nouveau_fence_context_del(struct nouveau_fence_chan *fctx) - { -- cancel_work_sync(&fctx->allow_block_work); - nouveau_fence_context_kill(fctx, 0); - nvif_event_dtor(&fctx->event); - fctx->dead = 1; -@@ -168,18 +167,6 @@ nouveau_fence_wait_uevent_handler(struct nvif_event *event, void *repv, u32 repc - return ret; - } - --static void --nouveau_fence_work_allow_block(struct work_struct *work) --{ -- struct nouveau_fence_chan *fctx = container_of(work, struct nouveau_fence_chan, -- allow_block_work); -- -- if (atomic_read(&fctx->notify_ref) == 0) -- nvif_event_block(&fctx->event); -- else -- nvif_event_allow(&fctx->event); --} -- - void - nouveau_fence_context_new(struct nouveau_channel *chan, struct nouveau_fence_chan *fctx) - { -@@ -191,7 +178,6 @@ nouveau_fence_context_new(struct nouveau_channel *chan, struct nouveau_fence_cha - } args; - int ret; - -- INIT_WORK(&fctx->allow_block_work, nouveau_fence_work_allow_block); - INIT_LIST_HEAD(&fctx->flip); - INIT_LIST_HEAD(&fctx->pending); - spin_lock_init(&fctx->lock); -@@ -535,19 +521,15 @@ static bool nouveau_fence_enable_signaling(struct dma_fence *f) - struct nouveau_fence *fence = from_fence(f); - struct nouveau_fence_chan *fctx = nouveau_fctx(fence); - bool ret; -- bool do_work; - -- if (atomic_inc_return(&fctx->notify_ref) == 0) -- do_work = true; -+ if (!fctx->notify_ref++) -+ nvif_event_allow(&fctx->event); - - ret = nouveau_fence_no_signaling(f); - if (ret) - set_bit(DMA_FENCE_FLAG_USER_BITS, &fence->base.flags); -- else if (atomic_dec_and_test(&fctx->notify_ref)) -- do_work = true; -- -- if (do_work) -- schedule_work(&fctx->allow_block_work); -+ else if (!--fctx->notify_ref) -+ nvif_event_block(&fctx->event); - - return ret; - } -diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.h b/drivers/gpu/drm/nouveau/nouveau_fence.h -index 28f5cf013b89..64d33ae7f356 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_fence.h -+++ b/drivers/gpu/drm/nouveau/nouveau_fence.h -@@ -3,7 +3,6 @@ - #define __NOUVEAU_FENCE_H__ - - #include <linux/dma-fence.h> --#include <linux/workqueue.h> - #include <nvif/event.h> - - struct nouveau_drm; -@@ -46,9 +45,7 @@ struct nouveau_fence_chan { - char name[32]; - - struct nvif_event event; -- struct work_struct allow_block_work; -- atomic_t notify_ref; -- int dead, killed; -+ int notify_ref, dead, killed; - }; - - struct nouveau_fence_priv { --- -2.43.2 - -From 04272ccd2a19da0b238d8f6a7d130c97c6243e6d Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com> -Date: Tue, 16 Jan 2024 23:08:21 +0200 -Subject: [PATCH 0917/1501] Revert "drm/i915/dsi: Do display on sequence later - on icl+" -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2478 -Lines: 57 - -commit 6992eb815d087858f8d7e4020529c2fe800456b3 upstream. - -This reverts commit 88b065943cb583e890324d618e8d4b23460d51a3. - -Lenovo 82TQ is unhappy if we do the display on sequence this -late. The display output shows severe corruption. - -It's unclear if this is a failure on our part (perhaps -something to do with sending commands in LP mode after HS -/video mode transmission has been started? Though the backlight -on command at least seems to work) or simply that there are -some commands in the sequence that are needed to be done -earlier (eg. could be some DSC init stuff?). If the latter -then I don't think the current Windows code would work -either, but maybe this was originally tested with an older -driver, who knows. - -Root causing this fully would likely require a lot of -experimentation which isn't really feasible without direct -access to the machine, so let's just accept failure and -go back to the original sequence. - -Cc: stable@vger.kernel.org -Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/10071 -Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20240116210821.30194-1-ville.syrjala@linux.intel.com -Acked-by: Jani Nikula <jani.nikula@intel.com> -(cherry picked from commit dc524d05974f615b145404191fcf91b478950499) -Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/i915/display/icl_dsi.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/i915/display/icl_dsi.c b/drivers/gpu/drm/i915/display/icl_dsi.c -index 67143a0f5189..bf0dbd7d0697 100644 ---- a/drivers/gpu/drm/i915/display/icl_dsi.c -+++ b/drivers/gpu/drm/i915/display/icl_dsi.c -@@ -1155,6 +1155,7 @@ static void gen11_dsi_powerup_panel(struct intel_encoder *encoder) - } - - intel_dsi_vbt_exec_sequence(intel_dsi, MIPI_SEQ_INIT_OTP); -+ intel_dsi_vbt_exec_sequence(intel_dsi, MIPI_SEQ_DISPLAY_ON); - - /* ensure all panel commands dispatched before enabling transcoder */ - wait_for_cmds_dispatched_to_panel(encoder); -@@ -1255,8 +1256,6 @@ static void gen11_dsi_enable(struct intel_atomic_state *state, - /* step6d: enable dsi transcoder */ - gen11_dsi_enable_transcoder(encoder); - -- intel_dsi_vbt_exec_sequence(intel_dsi, MIPI_SEQ_DISPLAY_ON); -- - /* step7: enable backlight */ - intel_backlight_enable(crtc_state, conn_state); - intel_dsi_vbt_exec_sequence(intel_dsi, MIPI_SEQ_BACKLIGHT_ON); --- -2.43.2 - -From bfd0feb1b109cb63b87fdcd00122603787c75a1a Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com> -Date: Mon, 11 Dec 2023 10:16:24 +0200 -Subject: [PATCH 0918/1501] drm: Don't unref the same fb many times by mistake - due to deadlock handling -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1732 -Lines: 42 - -commit cb4daf271302d71a6b9a7c01bd0b6d76febd8f0c upstream. - -If we get a deadlock after the fb lookup in drm_mode_page_flip_ioctl() -we proceed to unref the fb and then retry the whole thing from the top. -But we forget to reset the fb pointer back to NULL, and so if we then -get another error during the retry, before the fb lookup, we proceed -the unref the same fb again without having gotten another reference. -The end result is that the fb will (eventually) end up being freed -while it's still in use. - -Reset fb to NULL once we've unreffed it to avoid doing it again -until we've done another fb lookup. - -This turned out to be pretty easy to hit on a DG2 when doing async -flips (and CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y). The first symptom I -saw that drm_closefb() simply got stuck in a busy loop while walking -the framebuffer list. Fortunately I was able to convince it to oops -instead, and from there it was easier to track down the culprit. - -Cc: stable@vger.kernel.org -Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20231211081625.25704-1-ville.syrjala@linux.intel.com -Acked-by: Javier Martinez Canillas <javierm@redhat.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/drm_plane.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c -index 24e7998d1731..01fbd3fb7b9e 100644 ---- a/drivers/gpu/drm/drm_plane.c -+++ b/drivers/gpu/drm/drm_plane.c -@@ -1387,6 +1387,7 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev, - out: - if (fb) - drm_framebuffer_put(fb); -+ fb = NULL; - if (plane->old_fb) - drm_framebuffer_put(plane->old_fb); - plane->old_fb = NULL; --- -2.43.2 - -From bd8f006d4b6ff221e0cf54d6d98f59489d0dd3c8 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com> -Date: Thu, 18 Jan 2024 23:21:31 +0200 -Subject: [PATCH 0919/1501] drm/i915/psr: Only allow PSR in LPSP mode on HSW - non-ULT -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2909 -Lines: 62 - -commit f9f031dd21a7ce13a13862fa5281d32e1029c70f upstream. - -On HSW non-ULT (or at least on Dell Latitude E6540) external displays -start to flicker when we enable PSR on the eDP. We observe a much higher -SR and PC6 residency than should be possible with an external display, -and indeen much higher than what we observe with eDP disabled and -only the external display enabled. Looks like the hardware is somehow -ignoring the fact that the external display is active during PSR. - -I wasn't able to redproduce this on my HSW ULT machine, or BDW. -So either there's something specific about this particular laptop -(eg. some unknown firmware thing) or the issue is limited to just -non-ULT HSW systems. All known registers that could affect this -look perfectly reasonable on the affected machine. - -As a workaround let's unmask the LPSP event to prevent PSR entry -except while in LPSP mode (only pipe A + eDP active). This -will prevent PSR entry entirely when multiple pipes are active. -The one slight downside is that we now also prevent PSR entry -when driving eDP with pipe B or C, but I think that's a reasonable -tradeoff to avoid having to implement a more complex workaround. - -Cc: stable@vger.kernel.org -Fixes: 783d8b80871f ("drm/i915/psr: Re-enable PSR1 on hsw/bdw") -Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/10092 -Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20240118212131.31868-1-ville.syrjala@linux.intel.com -Reviewed-by: Jouni Högander <jouni.hogander@intel.com> -(cherry picked from commit 94501c3ca6400e463ff6cc0c9cf4a2feb6a9205d) -Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/i915/display/intel_psr.c | 14 ++++++++++++-- - 1 file changed, 12 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/i915/display/intel_psr.c b/drivers/gpu/drm/i915/display/intel_psr.c -index 4f1f31fc9529..614b4534ef96 100644 ---- a/drivers/gpu/drm/i915/display/intel_psr.c -+++ b/drivers/gpu/drm/i915/display/intel_psr.c -@@ -1401,8 +1401,18 @@ static void intel_psr_enable_source(struct intel_dp *intel_dp, - * can rely on frontbuffer tracking. - */ - mask = EDP_PSR_DEBUG_MASK_MEMUP | -- EDP_PSR_DEBUG_MASK_HPD | -- EDP_PSR_DEBUG_MASK_LPSP; -+ EDP_PSR_DEBUG_MASK_HPD; -+ -+ /* -+ * For some unknown reason on HSW non-ULT (or at least on -+ * Dell Latitude E6540) external displays start to flicker -+ * when PSR is enabled on the eDP. SR/PC6 residency is much -+ * higher than should be possible with an external display. -+ * As a workaround leave LPSP unmasked to prevent PSR entry -+ * when external displays are active. -+ */ -+ if (DISPLAY_VER(dev_priv) >= 8 || IS_HASWELL_ULT(dev_priv)) -+ mask |= EDP_PSR_DEBUG_MASK_LPSP; - - if (DISPLAY_VER(dev_priv) < 20) - mask |= EDP_PSR_DEBUG_MASK_MAX_SLEEP; --- -2.43.2 - -From aa2a2dc68b001fbbc9ba6866b458a6ff7887cce9 Mon Sep 17 00:00:00 2001 -From: Dan Carpenter <dan.carpenter@linaro.org> -Date: Mon, 4 Dec 2023 15:29:00 +0300 -Subject: [PATCH 0920/1501] drm/bridge: nxp-ptn3460: fix i2c_master_send() - error checking -Content-Length: 2023 -Lines: 55 - -commit 914437992876838662c968cb416f832110fb1093 upstream. - -The i2c_master_send/recv() functions return negative error codes or the -number of bytes that were able to be sent/received. This code has -two problems. 1) Instead of checking if all the bytes were sent or -received, it checks that at least one byte was sent or received. -2) If there was a partial send/receive then we should return a negative -error code but this code returns success. - -Fixes: a9fe713d7d45 ("drm/bridge: Add PTN3460 bridge driver") -Cc: stable@vger.kernel.org -Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> -Reviewed-by: Robert Foss <rfoss@kernel.org> -Signed-off-by: Robert Foss <rfoss@kernel.org> -Link: https://patchwork.freedesktop.org/patch/msgid/0cdc2dce-ca89-451a-9774-1482ab2f4762@moroto.mountain -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/bridge/nxp-ptn3460.c | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/drivers/gpu/drm/bridge/nxp-ptn3460.c b/drivers/gpu/drm/bridge/nxp-ptn3460.c -index d81920227a8a..9b7eb8c669c1 100644 ---- a/drivers/gpu/drm/bridge/nxp-ptn3460.c -+++ b/drivers/gpu/drm/bridge/nxp-ptn3460.c -@@ -56,13 +56,13 @@ static int ptn3460_read_bytes(struct ptn3460_bridge *ptn_bridge, char addr, - ret = i2c_master_send(ptn_bridge->client, &addr, 1); - if (ret <= 0) { - DRM_ERROR("Failed to send i2c command, ret=%d\n", ret); -- return ret; -+ return ret ?: -EIO; - } - - ret = i2c_master_recv(ptn_bridge->client, buf, len); -- if (ret <= 0) { -+ if (ret != len) { - DRM_ERROR("Failed to recv i2c data, ret=%d\n", ret); -- return ret; -+ return ret < 0 ? ret : -EIO; - } - - return 0; -@@ -78,9 +78,9 @@ static int ptn3460_write_byte(struct ptn3460_bridge *ptn_bridge, char addr, - buf[1] = val; - - ret = i2c_master_send(ptn_bridge->client, buf, ARRAY_SIZE(buf)); -- if (ret <= 0) { -+ if (ret != ARRAY_SIZE(buf)) { - DRM_ERROR("Failed to send i2c command, ret=%d\n", ret); -- return ret; -+ return ret < 0 ? ret : -EIO; - } - - return 0; --- -2.43.2 - -From 5fdbdd9f0a1a9e36bdaaad0738627601672d14a0 Mon Sep 17 00:00:00 2001 -From: Thomas Zimmermann <tzimmermann@suse.de> -Date: Wed, 22 Nov 2023 13:09:31 +0100 -Subject: [PATCH 0921/1501] drm: Fix TODO list mentioning non-KMS drivers -Content-Length: 2228 -Lines: 55 - -commit 9cf5ca1f485cae406968947a92bf304603999fa1 upstream. - -Non-KMS drivers have been removed from DRM. Update the TODO list -accordingly. - -Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> -Fixes: a276afc19eec ("drm: Remove some obsolete drm pciids(tdfx, mga, i810, savage, r128, sis, via)") -Cc: Cai Huoqing <cai.huoqing@linux.dev> -Cc: Daniel Vetter <daniel.vetter@ffwll.ch> -Cc: Dave Airlie <airlied@redhat.com> -Cc: Thomas Zimmermann <tzimmermann@suse.de> -Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> -Cc: Maxime Ripard <mripard@kernel.org> -Cc: David Airlie <airlied@gmail.com> -Cc: Daniel Vetter <daniel@ffwll.ch> -Cc: Jonathan Corbet <corbet@lwn.net> -Cc: dri-devel@lists.freedesktop.org -Cc: <stable@vger.kernel.org> # v6.3+ -Cc: linux-doc@vger.kernel.org -Reviewed-by: David Airlie <airlied@gmail.com> -Reviewed-by: Daniel Vetter <daniel@ffwll.ch> -Acked-by: Alex Deucher <alexander.deucher@amd.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20231122122449.11588-3-tzimmermann@suse.de -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - Documentation/gpu/todo.rst | 7 +++---- - 1 file changed, 3 insertions(+), 4 deletions(-) - -diff --git a/Documentation/gpu/todo.rst b/Documentation/gpu/todo.rst -index 03fe5d1247be..85bbe0543609 100644 ---- a/Documentation/gpu/todo.rst -+++ b/Documentation/gpu/todo.rst -@@ -337,8 +337,8 @@ connector register/unregister fixes - - Level: Intermediate - --Remove load/unload callbacks from all non-DRIVER_LEGACY drivers ----------------------------------------------------------------- -+Remove load/unload callbacks -+---------------------------- - - The load/unload callbacks in struct &drm_driver are very much midlayers, plus - for historical reasons they get the ordering wrong (and we can't fix that) -@@ -347,8 +347,7 @@ between setting up the &drm_driver structure and calling drm_dev_register(). - - Rework drivers to no longer use the load/unload callbacks, directly coding the - load/unload sequence into the driver's probe function. - --- Once all non-DRIVER_LEGACY drivers are converted, disallow the load/unload -- callbacks for all modern drivers. -+- Once all drivers are converted, remove the load/unload callbacks. - - Contact: Daniel Vetter - --- -2.43.2 - -From f26a6eac4c7209b81a235a88b9dc322332d2818c Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Thu, 9 Nov 2023 09:38:03 +0200 -Subject: [PATCH 0922/1501] drm/tidss: Fix atomic_flush check -Content-Length: 2075 -Lines: 51 - -commit 95d4b471953411854f9c80b568da7fcf753f3801 upstream. - -tidss_crtc_atomic_flush() checks if the crtc is enabled, and if not, -returns immediately as there's no reason to do any register changes. - -However, the code checks for 'crtc->state->enable', which does not -reflect the actual HW state. We should instead look at the -'crtc->state->active' flag. - -This causes the tidss_crtc_atomic_flush() to proceed with the flush even -if the active state is false, which then causes us to hit the -WARN_ON(!crtc->state->event) check. - -Fix this by checking the active flag, and while at it, fix the related -debug print which had "active" and "needs modeset" wrong way. - -Cc: <stable@vger.kernel.org> -Fixes: 32a1795f57ee ("drm/tidss: New driver for TI Keystone platform Display SubSystem") -Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com> -Link: https://lore.kernel.org/r/20231109-tidss-probe-v2-10-ac91b5ea35c0@ideasonboard.com -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/tidss/tidss_crtc.c | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/drivers/gpu/drm/tidss/tidss_crtc.c b/drivers/gpu/drm/tidss/tidss_crtc.c -index 5e5e466f35d1..7c78c074e3a2 100644 ---- a/drivers/gpu/drm/tidss/tidss_crtc.c -+++ b/drivers/gpu/drm/tidss/tidss_crtc.c -@@ -169,13 +169,13 @@ static void tidss_crtc_atomic_flush(struct drm_crtc *crtc, - struct tidss_device *tidss = to_tidss(ddev); - unsigned long flags; - -- dev_dbg(ddev->dev, -- "%s: %s enabled %d, needs modeset %d, event %p\n", __func__, -- crtc->name, drm_atomic_crtc_needs_modeset(crtc->state), -- crtc->state->enable, crtc->state->event); -+ dev_dbg(ddev->dev, "%s: %s is %sactive, %s modeset, event %p\n", -+ __func__, crtc->name, crtc->state->active ? "" : "not ", -+ drm_atomic_crtc_needs_modeset(crtc->state) ? "needs" : "doesn't need", -+ crtc->state->event); - - /* There is nothing to do if CRTC is not going to be enabled. */ -- if (!crtc->state->enable) -+ if (!crtc->state->active) - return; - - /* --- -2.43.2 - -From c038f9c471a90da8da2509457255ec7fb4c02b79 Mon Sep 17 00:00:00 2001 -From: Zack Rusin <zackr@vmware.com> -Date: Mon, 23 Oct 2023 09:46:05 +0200 -Subject: [PATCH 0923/1501] drm: Disable the cursor plane on atomic contexts - with virtualized drivers -Content-Length: 7065 -Lines: 172 - -commit 4e3b70da64a53784683cfcbac2deda5d6e540407 upstream. - -Cursor planes on virtualized drivers have special meaning and require -that the clients handle them in specific ways, e.g. the cursor plane -should react to the mouse movement the way a mouse cursor would be -expected to and the client is required to set hotspot properties on it -in order for the mouse events to be routed correctly. - -This breaks the contract as specified by the "universal planes". Fix it -by disabling the cursor planes on virtualized drivers while adding -a foundation on top of which it's possible to special case mouse cursor -planes for clients that want it. - -Disabling the cursor planes makes some kms compositors which were broken, -e.g. Weston, fallback to software cursor which works fine or at least -better than currently while having no effect on others, e.g. gnome-shell -or kwin, which put virtualized drivers on a deny-list when running in -atomic context to make them fallback to legacy kms and avoid this issue. - -Signed-off-by: Zack Rusin <zackr@vmware.com> -Fixes: 681e7ec73044 ("drm: Allow userspace to ask for universal plane list (v2)") -Cc: <stable@vger.kernel.org> # v5.4+ -Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> -Cc: Maxime Ripard <mripard@kernel.org> -Cc: Thomas Zimmermann <tzimmermann@suse.de> -Cc: David Airlie <airlied@linux.ie> -Cc: Daniel Vetter <daniel@ffwll.ch> -Cc: Dave Airlie <airlied@redhat.com> -Cc: Gerd Hoffmann <kraxel@redhat.com> -Cc: Hans de Goede <hdegoede@redhat.com> -Cc: Gurchetan Singh <gurchetansingh@chromium.org> -Cc: Chia-I Wu <olvaffe@gmail.com> -Cc: dri-devel@lists.freedesktop.org -Cc: virtualization@lists.linux-foundation.org -Cc: spice-devel@lists.freedesktop.org -Acked-by: Pekka Paalanen <pekka.paalanen@collabora.com> -Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> -Acked-by: Simon Ser <contact@emersion.fr> -Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20231023074613.41327-2-aesteve@redhat.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/drm_plane.c | 13 +++++++++++++ - drivers/gpu/drm/qxl/qxl_drv.c | 2 +- - drivers/gpu/drm/vboxvideo/vbox_drv.c | 2 +- - drivers/gpu/drm/virtio/virtgpu_drv.c | 2 +- - drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 2 +- - include/drm/drm_drv.h | 9 +++++++++ - include/drm/drm_file.h | 12 ++++++++++++ - 7 files changed, 38 insertions(+), 4 deletions(-) - -diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c -index 01fbd3fb7b9e..311e179904a2 100644 ---- a/drivers/gpu/drm/drm_plane.c -+++ b/drivers/gpu/drm/drm_plane.c -@@ -678,6 +678,19 @@ int drm_mode_getplane_res(struct drm_device *dev, void *data, - !file_priv->universal_planes) - continue; - -+ /* -+ * If we're running on a virtualized driver then, -+ * unless userspace advertizes support for the -+ * virtualized cursor plane, disable cursor planes -+ * because they'll be broken due to missing cursor -+ * hotspot info. -+ */ -+ if (plane->type == DRM_PLANE_TYPE_CURSOR && -+ drm_core_check_feature(dev, DRIVER_CURSOR_HOTSPOT) && -+ file_priv->atomic && -+ !file_priv->supports_virtualized_cursor_plane) -+ continue; -+ - if (drm_lease_held(file_priv, plane->base.id)) { - if (count < plane_resp->count_planes && - put_user(plane->base.id, plane_ptr + count)) -diff --git a/drivers/gpu/drm/qxl/qxl_drv.c b/drivers/gpu/drm/qxl/qxl_drv.c -index 46de4f171970..beee5563031a 100644 ---- a/drivers/gpu/drm/qxl/qxl_drv.c -+++ b/drivers/gpu/drm/qxl/qxl_drv.c -@@ -285,7 +285,7 @@ static const struct drm_ioctl_desc qxl_ioctls[] = { - }; - - static struct drm_driver qxl_driver = { -- .driver_features = DRIVER_GEM | DRIVER_MODESET | DRIVER_ATOMIC, -+ .driver_features = DRIVER_GEM | DRIVER_MODESET | DRIVER_ATOMIC | DRIVER_CURSOR_HOTSPOT, - - .dumb_create = qxl_mode_dumb_create, - .dumb_map_offset = drm_gem_ttm_dumb_map_offset, -diff --git a/drivers/gpu/drm/vboxvideo/vbox_drv.c b/drivers/gpu/drm/vboxvideo/vbox_drv.c -index 047b95812334..cd9e66a06596 100644 ---- a/drivers/gpu/drm/vboxvideo/vbox_drv.c -+++ b/drivers/gpu/drm/vboxvideo/vbox_drv.c -@@ -182,7 +182,7 @@ DEFINE_DRM_GEM_FOPS(vbox_fops); - - static const struct drm_driver driver = { - .driver_features = -- DRIVER_MODESET | DRIVER_GEM | DRIVER_ATOMIC, -+ DRIVER_MODESET | DRIVER_GEM | DRIVER_ATOMIC | DRIVER_CURSOR_HOTSPOT, - - .fops = &vbox_fops, - .name = DRIVER_NAME, -diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c -index 4334c7608408..f8e9abe647b9 100644 ---- a/drivers/gpu/drm/virtio/virtgpu_drv.c -+++ b/drivers/gpu/drm/virtio/virtgpu_drv.c -@@ -177,7 +177,7 @@ static const struct drm_driver driver = { - * out via drm_device::driver_features: - */ - .driver_features = DRIVER_MODESET | DRIVER_GEM | DRIVER_RENDER | DRIVER_ATOMIC | -- DRIVER_SYNCOBJ | DRIVER_SYNCOBJ_TIMELINE, -+ DRIVER_SYNCOBJ | DRIVER_SYNCOBJ_TIMELINE | DRIVER_CURSOR_HOTSPOT, - .open = virtio_gpu_driver_open, - .postclose = virtio_gpu_driver_postclose, - -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -index 8b24ecf60e3e..d3e308fdfd5b 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -@@ -1611,7 +1611,7 @@ static const struct file_operations vmwgfx_driver_fops = { - - static const struct drm_driver driver = { - .driver_features = -- DRIVER_MODESET | DRIVER_RENDER | DRIVER_ATOMIC | DRIVER_GEM, -+ DRIVER_MODESET | DRIVER_RENDER | DRIVER_ATOMIC | DRIVER_GEM | DRIVER_CURSOR_HOTSPOT, - .ioctls = vmw_ioctls, - .num_ioctls = ARRAY_SIZE(vmw_ioctls), - .master_set = vmw_master_set, -diff --git a/include/drm/drm_drv.h b/include/drm/drm_drv.h -index e2640dc64e08..ea36aa79dca2 100644 ---- a/include/drm/drm_drv.h -+++ b/include/drm/drm_drv.h -@@ -110,6 +110,15 @@ enum drm_driver_feature { - * Driver supports user defined GPU VA bindings for GEM objects. - */ - DRIVER_GEM_GPUVA = BIT(8), -+ /** -+ * @DRIVER_CURSOR_HOTSPOT: -+ * -+ * Driver supports and requires cursor hotspot information in the -+ * cursor plane (e.g. cursor plane has to actually track the mouse -+ * cursor and the clients are required to set hotspot in order for -+ * the cursor planes to work correctly). -+ */ -+ DRIVER_CURSOR_HOTSPOT = BIT(9), - - /* IMPORTANT: Below are all the legacy flags, add new ones above. */ - -diff --git a/include/drm/drm_file.h b/include/drm/drm_file.h -index e1b5b4282f75..8f35dcea82d3 100644 ---- a/include/drm/drm_file.h -+++ b/include/drm/drm_file.h -@@ -226,6 +226,18 @@ struct drm_file { - */ - bool is_master; - -+ /** -+ * @supports_virtualized_cursor_plane: -+ * -+ * This client is capable of handling the cursor plane with the -+ * restrictions imposed on it by the virtualized drivers. -+ * -+ * This implies that the cursor plane has to behave like a cursor -+ * i.e. track cursor movement. It also requires setting of the -+ * hotspot properties by the client on the cursor plane. -+ */ -+ bool supports_virtualized_cursor_plane; -+ - /** - * @master: - * --- -2.43.2 - -From 07fcfd45b2eaed23c8375224333d64292dbe59b9 Mon Sep 17 00:00:00 2001 -From: Javier Martinez Canillas <javierm@redhat.com> -Date: Thu, 23 Nov 2023 23:13:01 +0100 -Subject: [PATCH 0924/1501] drm/virtio: Disable damage clipping if FB changed - since last page-flip -Content-Length: 2196 -Lines: 50 - -commit 0240db231dfe5ee5b7a3a03cba96f0844b7a673d upstream. - -The driver does per-buffer uploads and needs to force a full plane update -if the plane's attached framebuffer has change since the last page-flip. - -Fixes: 01f05940a9a7 ("drm/virtio: Enable fb damage clips property for the primary plane") -Cc: <stable@vger.kernel.org> # v6.4+ -Reported-by: nerdopolis <bluescreen_avenger@verizon.net> -Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218115 -Suggested-by: Sima Vetter <daniel.vetter@ffwll.ch> -Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> -Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> -Reviewed-by: Zack Rusin <zackr@vmware.com> -Acked-by: Sima Vetter <daniel.vetter@ffwll.ch> -Link: https://patchwork.freedesktop.org/patch/msgid/20231123221315.3579454-3-javierm@redhat.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/virtio/virtgpu_plane.c | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -diff --git a/drivers/gpu/drm/virtio/virtgpu_plane.c b/drivers/gpu/drm/virtio/virtgpu_plane.c -index a2e045f3a000..a1ef657eba07 100644 ---- a/drivers/gpu/drm/virtio/virtgpu_plane.c -+++ b/drivers/gpu/drm/virtio/virtgpu_plane.c -@@ -79,6 +79,8 @@ static int virtio_gpu_plane_atomic_check(struct drm_plane *plane, - { - struct drm_plane_state *new_plane_state = drm_atomic_get_new_plane_state(state, - plane); -+ struct drm_plane_state *old_plane_state = drm_atomic_get_old_plane_state(state, -+ plane); - bool is_cursor = plane->type == DRM_PLANE_TYPE_CURSOR; - struct drm_crtc_state *crtc_state; - int ret; -@@ -86,6 +88,14 @@ static int virtio_gpu_plane_atomic_check(struct drm_plane *plane, - if (!new_plane_state->fb || WARN_ON(!new_plane_state->crtc)) - return 0; - -+ /* -+ * Ignore damage clips if the framebuffer attached to the plane's state -+ * has changed since the last plane update (page-flip). In this case, a -+ * full plane update should happen because uploads are done per-buffer. -+ */ -+ if (old_plane_state->fb != new_plane_state->fb) -+ new_plane_state->ignore_damage_clips = true; -+ - crtc_state = drm_atomic_get_crtc_state(state, - new_plane_state->crtc); - if (IS_ERR(crtc_state)) --- -2.43.2 - -From 03971c801baf1c322e926cb7dac94e16f2350676 Mon Sep 17 00:00:00 2001 -From: Javier Martinez Canillas <javierm@redhat.com> -Date: Thu, 23 Nov 2023 23:13:00 +0100 -Subject: [PATCH 0925/1501] drm: Allow drivers to indicate the damage helpers - to ignore damage clips -Content-Length: 3156 -Lines: 81 - -commit 35ed38d58257336c1df26b14fd5110b026e2adde upstream. - -It allows drivers to set a struct drm_plane_state .ignore_damage_clips in -their plane's .atomic_check callback, as an indication to damage helpers -such as drm_atomic_helper_damage_iter_init() that the damage clips should -be ignored. - -To be used by drivers that do per-buffer (e.g: virtio-gpu) uploads (rather -than per-plane uploads), since these type of drivers need to handle buffer -damages instead of frame damages. - -That way, these drivers could force a full plane update if the framebuffer -attached to a plane's state has changed since the last update (page-flip). - -Fixes: 01f05940a9a7 ("drm/virtio: Enable fb damage clips property for the primary plane") -Cc: <stable@vger.kernel.org> # v6.4+ -Reported-by: nerdopolis <bluescreen_avenger@verizon.net> -Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218115 -Suggested-by: Thomas Zimmermann <tzimmermann@suse.de> -Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> -Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> -Reviewed-by: Zack Rusin <zackr@vmware.com> -Acked-by: Sima Vetter <daniel.vetter@ffwll.ch> -Link: https://patchwork.freedesktop.org/patch/msgid/20231123221315.3579454-2-javierm@redhat.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - Documentation/gpu/drm-kms.rst | 2 ++ - drivers/gpu/drm/drm_damage_helper.c | 3 ++- - include/drm/drm_plane.h | 10 ++++++++++ - 3 files changed, 14 insertions(+), 1 deletion(-) - -diff --git a/Documentation/gpu/drm-kms.rst b/Documentation/gpu/drm-kms.rst -index 270d320407c7..a98a7e04e86f 100644 ---- a/Documentation/gpu/drm-kms.rst -+++ b/Documentation/gpu/drm-kms.rst -@@ -548,6 +548,8 @@ Plane Composition Properties - .. kernel-doc:: drivers/gpu/drm/drm_blend.c - :doc: overview - -+.. _damage_tracking_properties: -+ - Damage Tracking Properties - -------------------------- - -diff --git a/drivers/gpu/drm/drm_damage_helper.c b/drivers/gpu/drm/drm_damage_helper.c -index d8b2955e88fd..afb02aae707b 100644 ---- a/drivers/gpu/drm/drm_damage_helper.c -+++ b/drivers/gpu/drm/drm_damage_helper.c -@@ -241,7 +241,8 @@ drm_atomic_helper_damage_iter_init(struct drm_atomic_helper_damage_iter *iter, - iter->plane_src.x2 = (src.x2 >> 16) + !!(src.x2 & 0xFFFF); - iter->plane_src.y2 = (src.y2 >> 16) + !!(src.y2 & 0xFFFF); - -- if (!iter->clips || !drm_rect_equals(&state->src, &old_state->src)) { -+ if (!iter->clips || state->ignore_damage_clips || -+ !drm_rect_equals(&state->src, &old_state->src)) { - iter->clips = NULL; - iter->num_clips = 0; - iter->full_update = true; -diff --git a/include/drm/drm_plane.h b/include/drm/drm_plane.h -index 79d62856defb..fef775200a81 100644 ---- a/include/drm/drm_plane.h -+++ b/include/drm/drm_plane.h -@@ -190,6 +190,16 @@ struct drm_plane_state { - */ - struct drm_property_blob *fb_damage_clips; - -+ /** -+ * @ignore_damage_clips: -+ * -+ * Set by drivers to indicate the drm_atomic_helper_damage_iter_init() -+ * helper that the @fb_damage_clips blob property should be ignored. -+ * -+ * See :ref:`damage_tracking_properties` for more information. -+ */ -+ bool ignore_damage_clips; -+ - /** - * @src: - * --- -2.43.2 - -From f829932e011b31b85d89cba0ce757ee875f68d5f Mon Sep 17 00:00:00 2001 -From: Melissa Wen <mwen@igalia.com> -Date: Fri, 29 Dec 2023 15:25:00 -0100 -Subject: [PATCH 0926/1501] drm/amd/display: fix bandwidth validation failure - on DCN 2.1 -Content-Length: 1664 -Lines: 35 - -commit 3a0fa3bc245ef92838a8296e0055569b8dff94c4 upstream. - -IGT `amdgpu/amd_color/crtc-lut-accuracy` fails right at the beginning of -the test execution, during atomic check, because DC rejects the -bandwidth state for a fb sizing 64x64. The test was previously working -with the deprecated dc_commit_state(). Now using -dc_validate_with_context() approach, the atomic check needs to perform a -full state validation. Therefore, set fast_validation to false in the -dc_validate_global_state call for atomic check. - -Cc: stable@vger.kernel.org -Fixes: b8272241ff9d ("drm/amd/display: Drop dc_commit_state in favor of dc_commit_streams") -Signed-off-by: Melissa Wen <mwen@igalia.com> -Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index a9bd020b165a..7c27906c654c 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -10479,7 +10479,7 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev, - DRM_DEBUG_DRIVER("drm_dp_mst_atomic_check() failed\n"); - goto fail; - } -- status = dc_validate_global_state(dc, dm_state->context, true); -+ status = dc_validate_global_state(dc, dm_state->context, false); - if (status != DC_OK) { - DRM_DEBUG_DRIVER("DC global validation failure: %s (%d)", - dc_status_to_str(status), status); --- -2.43.2 - -From f015d8b6405d950f30826b4d8d9e1084dd9ea2a4 Mon Sep 17 00:00:00 2001 -From: Mario Limonciello <mario.limonciello@amd.com> -Date: Mon, 19 Jun 2023 15:04:24 -0500 -Subject: [PATCH 0927/1501] drm/amd/display: Disable PSR-SU on Parade 0803 TCON - again -Content-Length: 2045 -Lines: 45 - -commit 571c2fa26aa654946447c282a09d40a56c7ff128 upstream. - -When screen brightness is rapidly changed and PSR-SU is enabled the -display hangs on panels with this TCON even on the latest DCN 3.1.4 -microcode (0x8002a81 at this time). - -This was disabled previously as commit 072030b17830 ("drm/amd: Disable -PSR-SU on Parade 0803 TCON") but reverted as commit 1e66a17ce546 ("Revert -"drm/amd: Disable PSR-SU on Parade 0803 TCON"") in favor of testing for -a new enough microcode (commit cd2e31a9ab93 ("drm/amd/display: Set minimum -requirement for using PSR-SU on Phoenix")). - -As hangs are still happening specifically with this TCON, disable PSR-SU -again for it until it can be root caused. - -Cc: stable@vger.kernel.org -Cc: aaron.ma@canonical.com -Cc: binli@gnome.org -Cc: Marc Rossi <Marc.Rossi@amd.com> -Cc: Hamza Mahfooz <Hamza.Mahfooz@amd.com> -Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> -Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2046131 -Acked-by: Alex Deucher <alexander.deucher@amd.com> -Reviewed-by: Harry Wentland <harry.wentland@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/display/modules/power/power_helpers.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c -index 1675314a3ff2..7806056ca1dd 100644 ---- a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c -+++ b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c -@@ -841,6 +841,8 @@ bool is_psr_su_specific_panel(struct dc_link *link) - isPSRSUSupported = false; - else if (dpcd_caps->sink_dev_id_str[1] == 0x08 && dpcd_caps->sink_dev_id_str[0] == 0x03) - isPSRSUSupported = false; -+ else if (dpcd_caps->sink_dev_id_str[1] == 0x08 && dpcd_caps->sink_dev_id_str[0] == 0x03) -+ isPSRSUSupported = false; - else if (dpcd_caps->psr_info.force_psrsu_cap == 0x1) - isPSRSUSupported = true; - } --- -2.43.2 - -From 435edec678163de4d0420eb86ee13dd3ccc52c35 Mon Sep 17 00:00:00 2001 -From: Ivan Lipski <ivlipski@amd.com> -Date: Fri, 5 Jan 2024 19:40:50 -0500 -Subject: [PATCH 0928/1501] Revert "drm/amd/display: fix bandwidth validation - failure on DCN 2.1" -Content-Length: 1604 -Lines: 43 - -commit c2ab9ce0ee7225fc05f58a6671c43b8a3684f530 upstream. - -This commit causes dmesg-warn on several IGT tests on DCN 3.1.6: *ERROR* -link_enc_cfg_validate: Invalid link encoder assignments - 0x1c - -Affected IGT tests include: -- amdgpu/[amd_assr|amd_plane|amd_hotplug] -- kms_atomic -- kms_color -- kms_flip -- kms_properties -- kms_universal_plane - -and some other tests - -This reverts commit 3a0fa3bc245ef92838a8296e0055569b8dff94c4. - -Cc: Melissa Wen <mwen@igalia.com> -Cc: Hamza Mahfooz <hamza.mahfooz@amd.com> -Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> -Signed-off-by: Ivan Lipski <ivlipski@amd.com> -Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 7c27906c654c..a9bd020b165a 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -10479,7 +10479,7 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev, - DRM_DEBUG_DRIVER("drm_dp_mst_atomic_check() failed\n"); - goto fail; - } -- status = dc_validate_global_state(dc, dm_state->context, false); -+ status = dc_validate_global_state(dc, dm_state->context, true); - if (status != DC_OK) { - DRM_DEBUG_DRIVER("DC global validation failure: %s (%d)", - dc_status_to_str(status), status); --- -2.43.2 - -From 76161cb064ff98cf2190f4ab375f84bf583b01e9 Mon Sep 17 00:00:00 2001 -From: Dan Carpenter <dan.carpenter@linaro.org> -Date: Wed, 6 Dec 2023 18:05:15 +0300 -Subject: [PATCH 0929/1501] drm/bridge: nxp-ptn3460: simplify some error - checking -Content-Length: 2088 -Lines: 59 - -commit 28d3d0696688154cc04983f343011d07bf0508e4 upstream. - -The i2c_master_send/recv() functions return negative error codes or -they return "len" on success. So the error handling here can be written -as just normal checks for "if (ret < 0) return ret;". No need to -complicate things. - -Btw, in this code the "len" parameter can never be zero, but even if -it were, then I feel like this would still be the best way to write it. - -Fixes: 914437992876 ("drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking") -Suggested-by: Neil Armstrong <neil.armstrong@linaro.org> -Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> -Reviewed-by: Robert Foss <rfoss@kernel.org> -Signed-off-by: Robert Foss <rfoss@kernel.org> -Link: https://patchwork.freedesktop.org/patch/msgid/04242630-42d8-4920-8c67-24ac9db6b3c9@moroto.mountain -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/bridge/nxp-ptn3460.c | 12 ++++++------ - 1 file changed, 6 insertions(+), 6 deletions(-) - -diff --git a/drivers/gpu/drm/bridge/nxp-ptn3460.c b/drivers/gpu/drm/bridge/nxp-ptn3460.c -index 9b7eb8c669c1..7c0076e49953 100644 ---- a/drivers/gpu/drm/bridge/nxp-ptn3460.c -+++ b/drivers/gpu/drm/bridge/nxp-ptn3460.c -@@ -54,15 +54,15 @@ static int ptn3460_read_bytes(struct ptn3460_bridge *ptn_bridge, char addr, - int ret; - - ret = i2c_master_send(ptn_bridge->client, &addr, 1); -- if (ret <= 0) { -+ if (ret < 0) { - DRM_ERROR("Failed to send i2c command, ret=%d\n", ret); -- return ret ?: -EIO; -+ return ret; - } - - ret = i2c_master_recv(ptn_bridge->client, buf, len); -- if (ret != len) { -+ if (ret < 0) { - DRM_ERROR("Failed to recv i2c data, ret=%d\n", ret); -- return ret < 0 ? ret : -EIO; -+ return ret; - } - - return 0; -@@ -78,9 +78,9 @@ static int ptn3460_write_byte(struct ptn3460_bridge *ptn_bridge, char addr, - buf[1] = val; - - ret = i2c_master_send(ptn_bridge->client, buf, ARRAY_SIZE(buf)); -- if (ret != ARRAY_SIZE(buf)) { -+ if (ret < 0) { - DRM_ERROR("Failed to send i2c command, ret=%d\n", ret); -- return ret < 0 ? ret : -EIO; -+ return ret; - } - - return 0; --- -2.43.2 - -From 43235db21fc23559f50a62f8f273002eeb506f5a Mon Sep 17 00:00:00 2001 -From: Aurabindo Pillai <aurabindo.pillai@amd.com> -Date: Fri, 27 Oct 2023 15:59:48 -0400 -Subject: [PATCH 0930/1501] drm/amd/display: Fix a debugfs null pointer error -Content-Length: 1785 -Lines: 42 - -commit efb91fea652a42fcc037d2a9ef4ecd1ffc5ff4b7 upstream. - -[WHY & HOW] -Check whether get_subvp_en() callback exists before calling it. - -Cc: Mario Limonciello <mario.limonciello@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org -Reviewed-by: Alex Hung <alex.hung@amd.com> -Acked-by: Alex Hung <alex.hung@amd.com> -Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com> -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c -index 13a177d34376..45c972f2630d 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c -@@ -3647,12 +3647,16 @@ static int capabilities_show(struct seq_file *m, void *unused) - bool mall_supported = dc->caps.mall_size_total; - bool subvp_supported = dc->caps.subvp_fw_processing_delay_us; - unsigned int mall_in_use = false; -- unsigned int subvp_in_use = dc->cap_funcs.get_subvp_en(dc, dc->current_state); -+ unsigned int subvp_in_use = false; -+ - struct hubbub *hubbub = dc->res_pool->hubbub; - - if (hubbub->funcs->get_mall_en) - hubbub->funcs->get_mall_en(hubbub, &mall_in_use); - -+ if (dc->cap_funcs.get_subvp_en) -+ subvp_in_use = dc->cap_funcs.get_subvp_en(dc, dc->current_state); -+ - seq_printf(m, "mall supported: %s, enabled: %s\n", - mall_supported ? "yes" : "no", mall_in_use ? "yes" : "no"); - seq_printf(m, "sub-viewport supported: %s, enabled: %s\n", --- -2.43.2 - -From 48683e4dcf805274125b37ec4b617a1e10929075 Mon Sep 17 00:00:00 2001 -From: Ori Messinger <Ori.Messinger@amd.com> -Date: Wed, 22 Nov 2023 00:12:13 -0500 -Subject: [PATCH 0931/1501] drm/amdgpu: Enable GFXOFF for Compute on GFX11 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1982 -Lines: 42 - -commit aa0901a9008eeb2710292aff94e615adf7884d5f upstream. - -On GFX version 11, GFXOFF was disabled due to a MES KIQ firmware -issue, which has since been fixed after version 64. -This patch only re-enables GFXOFF for GFX version 11 if the GPU's -MES KIQ firmware version is newer than version 64. - -V2: Keep GFXOFF disabled on GFX11 if MES KIQ is below version 64. -V3: Add parentheses to avoid GCC warning for parentheses: -"suggest parentheses around comparison in operand of ‘&’" -V4: Remove "V3" from commit title -V5: Change commit description and insert 'Acked-by' - -Signed-off-by: Ori Messinger <Ori.Messinger@amd.com> -Acked-by: Alex Deucher <alexander.deucher@amd.com> -Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 6 ++---- - 1 file changed, 2 insertions(+), 4 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c -index 75dc58470393..3d126f2967a5 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c -@@ -684,10 +684,8 @@ int amdgpu_amdkfd_submit_ib(struct amdgpu_device *adev, - void amdgpu_amdkfd_set_compute_idle(struct amdgpu_device *adev, bool idle) - { - enum amd_powergating_state state = idle ? AMD_PG_STATE_GATE : AMD_PG_STATE_UNGATE; -- /* Temporary workaround to fix issues observed in some -- * compute applications when GFXOFF is enabled on GFX11. -- */ -- if (IP_VERSION_MAJ(amdgpu_ip_version(adev, GC_HWIP, 0)) == 11) { -+ if (IP_VERSION_MAJ(amdgpu_ip_version(adev, GC_HWIP, 0)) == 11 && -+ ((adev->mes.kiq_version & AMDGPU_MES_VERSION_MASK) <= 64)) { - pr_debug("GFXOFF is %s\n", idle ? "enabled" : "disabled"); - amdgpu_gfx_off_ctrl(adev, idle); - } else if ((IP_VERSION_MAJ(amdgpu_ip_version(adev, GC_HWIP, 0)) == 9) && --- -2.43.2 - -From 35ab8ad6c12630f0fbb6dc58f9ce8e2b4fd86254 Mon Sep 17 00:00:00 2001 -From: Alex Deucher <alexander.deucher@amd.com> -Date: Tue, 9 Jan 2024 10:45:42 -0500 -Subject: [PATCH 0932/1501] drm/amdgpu: drop exp hw support check for GC 9.4.3 -Content-Length: 976 -Lines: 27 - -commit c3d5e297dcae88274dc6924db337a2159279eced upstream. - -No longer needed. - -Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org # 6.7.x -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 2 -- - 1 file changed, 2 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c -index 0431eafa86b5..c7d60dd0fb97 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c -@@ -1963,8 +1963,6 @@ static int amdgpu_discovery_set_gc_ip_blocks(struct amdgpu_device *adev) - amdgpu_device_ip_block_add(adev, &gfx_v9_0_ip_block); - break; - case IP_VERSION(9, 4, 3): -- if (!amdgpu_exp_hw_support) -- return -EINVAL; - amdgpu_device_ip_block_add(adev, &gfx_v9_4_3_ip_block); - break; - case IP_VERSION(10, 1, 10): --- -2.43.2 - -From 14d31c45985d2c6977f8f568bfe622a8ac44655f Mon Sep 17 00:00:00 2001 -From: Yifan Zhang <yifan1.zhang@amd.com> -Date: Tue, 9 Jan 2024 09:19:22 +0800 -Subject: [PATCH 0933/1501] drm/amdgpu: update regGL2C_CTRL4 value in golden - setting -Content-Length: 1378 -Lines: 28 - -commit 2b9a073b7304f4a9e130d04794c91a0c4f9a5c12 upstream. - -This patch to update regGL2C_CTRL4 in golden setting. - -Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com> -Reviewed-by: Tim Huang <Tim.Huang@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org # 6.7.x -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -index 8ed4a6fb147a..83bf842717b4 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -@@ -114,7 +114,7 @@ static const struct soc15_reg_golden golden_settings_gc_11_5_0[] = { - SOC15_REG_GOLDEN_VALUE(GC, 0, regGL2C_ADDR_MATCH_MASK, 0xffffffff, 0xfffffff3), - SOC15_REG_GOLDEN_VALUE(GC, 0, regGL2C_CTRL, 0xffffffff, 0xf37fff3f), - SOC15_REG_GOLDEN_VALUE(GC, 0, regGL2C_CTRL3, 0xfffffffb, 0x00f40188), -- SOC15_REG_GOLDEN_VALUE(GC, 0, regGL2C_CTRL4, 0xf0ffffff, 0x8000b007), -+ SOC15_REG_GOLDEN_VALUE(GC, 0, regGL2C_CTRL4, 0xf0ffffff, 0x80009007), - SOC15_REG_GOLDEN_VALUE(GC, 0, regPA_CL_ENHANCE, 0xf1ffffff, 0x00880007), - SOC15_REG_GOLDEN_VALUE(GC, 0, regPC_CONFIG_CNTL_1, 0xffffffff, 0x00010000), - SOC15_REG_GOLDEN_VALUE(GC, 0, regTA_CNTL_AUX, 0xf7f7ffff, 0x01030000), --- -2.43.2 - -From 562ef60ac05f75d1aa4309caf05f40bef1bde7d3 Mon Sep 17 00:00:00 2001 -From: Likun Gao <Likun.Gao@amd.com> -Date: Fri, 5 Jan 2024 17:33:34 +0800 -Subject: [PATCH 0934/1501] drm/amdgpu: correct the cu count for gfx v11 -Content-Length: 1149 -Lines: 30 - -commit f4a94dbb6dc0bed10a5fc63718d00f1de45b12c0 upstream. - -Correct the algorithm of active CU to skip disabled -sa for gfx v11. - -Signed-off-by: Likun Gao <Likun.Gao@amd.com> -Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -index 83bf842717b4..cddf3737e8a3 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -@@ -6328,6 +6328,9 @@ static int gfx_v11_0_get_cu_info(struct amdgpu_device *adev, - mutex_lock(&adev->grbm_idx_mutex); - for (i = 0; i < adev->gfx.config.max_shader_engines; i++) { - for (j = 0; j < adev->gfx.config.max_sh_per_se; j++) { -+ bitmap = i * adev->gfx.config.max_sh_per_se + j; -+ if (!((gfx_v11_0_get_sa_active_bitmap(adev) >> bitmap) & 1)) -+ continue; - mask = 1; - counter = 0; - gfx_v11_0_select_se_sh(adev, i, j, 0xffffffff, 0); --- -2.43.2 - -From e39165fdec04467fcaf01b26d0dd0e61b0583066 Mon Sep 17 00:00:00 2001 -From: Lijo Lazar <lijo.lazar@amd.com> -Date: Thu, 11 Jan 2024 15:28:53 +0530 -Subject: [PATCH 0935/1501] drm/amd/pm: Fix smuv13.0.6 current clock reporting -Content-Length: 1281 -Lines: 32 - -commit a992c90d8ed3929b70ae815ce21ca5651cc0a692 upstream. - -When current clock is equal to max dpm level clock, the level is not -indicated correctly with *. Fix by comparing current clock against dpm -level value. - -Signed-off-by: Lijo Lazar <lijo.lazar@amd.com> -Reviewed-by: Asad Kamal <asad.kamal@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org # 6.7.x -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c -index b64e07b75937..8d59c6921157 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c -@@ -924,7 +924,9 @@ static int smu_v13_0_6_print_clks(struct smu_context *smu, char *buf, int size, - if (i < (clocks.num_levels - 1)) - clk2 = clocks.data[i + 1].clocks_in_khz / 1000; - -- if (curr_clk >= clk1 && curr_clk < clk2) { -+ if (curr_clk == clk1) { -+ level = i; -+ } else if (curr_clk >= clk1 && curr_clk < clk2) { - level = (curr_clk - clk1) <= (clk2 - curr_clk) ? - i : - i + 1; --- -2.43.2 - -From cde4c4f391f45a7b369c9f97fb15160ab268dbdc Mon Sep 17 00:00:00 2001 -From: Lijo Lazar <lijo.lazar@amd.com> -Date: Thu, 11 Jan 2024 09:47:33 +0530 -Subject: [PATCH 0936/1501] drm/amd/pm: Add error log for smu v13.0.6 reset -Content-Length: 1235 -Lines: 43 - -commit 91739a897c12dcec699e53f390be1b4abdeef3a0 upstream. - -For all mode-2 reset fail cases, add error log. - -Signed-off-by: Lijo Lazar <lijo.lazar@amd.com> -Reviewed-by: Asad Kamal <asad.kamal@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org # 6.7.x -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 11 ++++++----- - 1 file changed, 6 insertions(+), 5 deletions(-) - -diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c -index 8d59c6921157..8cd2b8cc3d58 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c -@@ -2192,17 +2192,18 @@ static int smu_v13_0_6_mode2_reset(struct smu_context *smu) - continue; - } - -- if (ret) { -- dev_err(adev->dev, -- "failed to send mode2 message \tparam: 0x%08x error code %d\n", -- SMU_RESET_MODE_2, ret); -+ if (ret) - goto out; -- } -+ - } while (ret == -ETIME && timeout); - - out: - mutex_unlock(&smu->message_lock); - -+ if (ret) -+ dev_err(adev->dev, "failed to send mode2 reset, error code %d", -+ ret); -+ - return ret; - } - --- -2.43.2 - -From c02d257c654191ecda1dc1af6875d527e85310e7 Mon Sep 17 00:00:00 2001 -From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Date: Mon, 8 Jan 2024 21:20:28 +0530 -Subject: [PATCH 0937/1501] drm/amd/display: Fix variable deferencing before - NULL check in edp_setup_replay() -Content-Length: 2430 -Lines: 60 - -commit 7073934f5d73f8b53308963cee36f0d389ea857c upstream. - -In edp_setup_replay(), 'struct dc *dc' & 'struct dmub_replay *replay' -was dereferenced before the pointer 'link' & 'replay' NULL check. - -Fixes the below: -drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_edp_panel_control.c:947 edp_setup_replay() warn: variable dereferenced before check 'link' (see line 933) - -Cc: stable@vger.kernel.org -Cc: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com> -Cc: Harry Wentland <harry.wentland@amd.com> -Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> -Cc: Aurabindo Pillai <aurabindo.pillai@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - .../dc/link/protocols/link_edp_panel_control.c | 11 +++++++---- - 1 file changed, 7 insertions(+), 4 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c -index e5cfaaef70b3..bdae54c4648b 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c -+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c -@@ -927,8 +927,8 @@ bool edp_get_replay_state(const struct dc_link *link, uint64_t *state) - bool edp_setup_replay(struct dc_link *link, const struct dc_stream_state *stream) - { - /* To-do: Setup Replay */ -- struct dc *dc = link->ctx->dc; -- struct dmub_replay *replay = dc->res_pool->replay; -+ struct dc *dc; -+ struct dmub_replay *replay; - int i; - unsigned int panel_inst; - struct replay_context replay_context = { 0 }; -@@ -944,6 +944,10 @@ bool edp_setup_replay(struct dc_link *link, const struct dc_stream_state *stream - if (!link) - return false; - -+ dc = link->ctx->dc; -+ -+ replay = dc->res_pool->replay; -+ - if (!replay) - return false; - -@@ -972,8 +976,7 @@ bool edp_setup_replay(struct dc_link *link, const struct dc_stream_state *stream - - replay_context.line_time_in_ns = lineTimeInNs; - -- if (replay) -- link->replay_settings.replay_feature_enabled = -+ link->replay_settings.replay_feature_enabled = - replay->funcs->replay_copy_settings(replay, link, &replay_context, panel_inst); - if (link->replay_settings.replay_feature_enabled) { - --- -2.43.2 - -From 58063cc9bcc3bd39f6f8fb8e68f9de8453b229d3 Mon Sep 17 00:00:00 2001 -From: Ovidiu Bunea <ovidiu.bunea@amd.com> -Date: Mon, 18 Dec 2023 21:40:45 -0500 -Subject: [PATCH 0938/1501] drm/amd/display: Fix DML2 watermark calculation -Content-Length: 3058 -Lines: 49 - -commit d3579f5df0536c2f0fabaa3ea80bb2d179884195 upstream. - -[Why] -core_mode_programming in DML2 should output watermark calculations -to locals, but it incorrectly uses mode_lib - -[How] -update code to match HW DML2 - -Cc: Mario Limonciello <mario.limonciello@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org -Reviewed-by: Charlene Liu <charlene.liu@amd.com> -Acked-by: Alex Hung <alex.hung@amd.com> -Signed-off-by: Ovidiu Bunea <ovidiu.bunea@amd.com> -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - .../drm/amd/display/dc/dml2/display_mode_core.c | 14 +++++++------- - 1 file changed, 7 insertions(+), 7 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c -index b95bf27f2fe2..4899e9e8c163 100644 ---- a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c -+++ b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c -@@ -9446,13 +9446,13 @@ void dml_core_mode_programming(struct display_mode_lib_st *mode_lib, const struc - CalculateWatermarks_params->CompressedBufferSizeInkByte = locals->CompressedBufferSizeInkByte; - - // Output -- CalculateWatermarks_params->Watermark = &s->dummy_watermark; // Watermarks *Watermark -- CalculateWatermarks_params->DRAMClockChangeSupport = &mode_lib->ms.support.DRAMClockChangeSupport[0]; -- CalculateWatermarks_params->MaxActiveDRAMClockChangeLatencySupported = &s->dummy_single_array[0][0]; // dml_float_t *MaxActiveDRAMClockChangeLatencySupported[] -- CalculateWatermarks_params->SubViewportLinesNeededInMALL = &mode_lib->ms.SubViewportLinesNeededInMALL[j]; // dml_uint_t SubViewportLinesNeededInMALL[] -- CalculateWatermarks_params->FCLKChangeSupport = &mode_lib->ms.support.FCLKChangeSupport[0]; -- CalculateWatermarks_params->MaxActiveFCLKChangeLatencySupported = &s->dummy_single[0]; // dml_float_t *MaxActiveFCLKChangeLatencySupported -- CalculateWatermarks_params->USRRetrainingSupport = &mode_lib->ms.support.USRRetrainingSupport[0]; -+ CalculateWatermarks_params->Watermark = &locals->Watermark; // Watermarks *Watermark -+ CalculateWatermarks_params->DRAMClockChangeSupport = &locals->DRAMClockChangeSupport; -+ CalculateWatermarks_params->MaxActiveDRAMClockChangeLatencySupported = locals->MaxActiveDRAMClockChangeLatencySupported; // dml_float_t *MaxActiveDRAMClockChangeLatencySupported[] -+ CalculateWatermarks_params->SubViewportLinesNeededInMALL = locals->SubViewportLinesNeededInMALL; // dml_uint_t SubViewportLinesNeededInMALL[] -+ CalculateWatermarks_params->FCLKChangeSupport = &locals->FCLKChangeSupport; -+ CalculateWatermarks_params->MaxActiveFCLKChangeLatencySupported = &locals->MaxActiveFCLKChangeLatencySupported; // dml_float_t *MaxActiveFCLKChangeLatencySupported -+ CalculateWatermarks_params->USRRetrainingSupport = &locals->USRRetrainingSupport; - - CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport( - &mode_lib->scratch, --- -2.43.2 - -From 717fc1bd64261d9d25ad613ad1c9d3995a1de677 Mon Sep 17 00:00:00 2001 -From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> -Date: Fri, 15 Dec 2023 11:01:42 -0500 -Subject: [PATCH 0939/1501] drm/amd/display: Port DENTIST hang and TDR fixes to - OTG disable W/A -Content-Length: 3217 -Lines: 80 - -commit 4b56f7d47be87cde5f368b67bc7fac53a2c3e8d2 upstream. - -[Why] -We can experience DENTIST hangs during optimize_bandwidth or TDRs if -FIFO is toggled and hangs. - -[How] -Port the DCN35 fixes to DCN314. - -Cc: Mario Limonciello <mario.limonciello@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org -Reviewed-by: Charlene Liu <charlene.liu@amd.com> -Acked-by: Alex Hung <alex.hung@amd.com> -Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - .../dc/clk_mgr/dcn314/dcn314_clk_mgr.c | 21 ++++++++----------- - 1 file changed, 9 insertions(+), 12 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c -index 7326b7565846..2618504e260e 100644 ---- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c -@@ -131,30 +131,27 @@ static int dcn314_get_active_display_cnt_wa( - return display_count; - } - --static void dcn314_disable_otg_wa(struct clk_mgr *clk_mgr_base, struct dc_state *context, bool disable) -+static void dcn314_disable_otg_wa(struct clk_mgr *clk_mgr_base, struct dc_state *context, -+ bool safe_to_lower, bool disable) - { - struct dc *dc = clk_mgr_base->ctx->dc; - int i; - - for (i = 0; i < dc->res_pool->pipe_count; ++i) { -- struct pipe_ctx *pipe = &dc->current_state->res_ctx.pipe_ctx[i]; -+ struct pipe_ctx *pipe = safe_to_lower -+ ? &context->res_ctx.pipe_ctx[i] -+ : &dc->current_state->res_ctx.pipe_ctx[i]; - - if (pipe->top_pipe || pipe->prev_odm_pipe) - continue; - if (pipe->stream && (pipe->stream->dpms_off || dc_is_virtual_signal(pipe->stream->signal))) { -- struct stream_encoder *stream_enc = pipe->stream_res.stream_enc; -- - if (disable) { -- if (stream_enc && stream_enc->funcs->disable_fifo) -- pipe->stream_res.stream_enc->funcs->disable_fifo(stream_enc); -+ if (pipe->stream_res.tg && pipe->stream_res.tg->funcs->immediate_disable_crtc) -+ pipe->stream_res.tg->funcs->immediate_disable_crtc(pipe->stream_res.tg); - -- pipe->stream_res.tg->funcs->immediate_disable_crtc(pipe->stream_res.tg); - reset_sync_context_for_pipe(dc, context, i); - } else { - pipe->stream_res.tg->funcs->enable_crtc(pipe->stream_res.tg); -- -- if (stream_enc && stream_enc->funcs->enable_fifo) -- pipe->stream_res.stream_enc->funcs->enable_fifo(stream_enc); - } - } - } -@@ -252,11 +249,11 @@ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base, - } - - if (should_set_clock(safe_to_lower, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz)) { -- dcn314_disable_otg_wa(clk_mgr_base, context, true); -+ dcn314_disable_otg_wa(clk_mgr_base, context, safe_to_lower, true); - - clk_mgr_base->clks.dispclk_khz = new_clocks->dispclk_khz; - dcn314_smu_set_dispclk(clk_mgr, clk_mgr_base->clks.dispclk_khz); -- dcn314_disable_otg_wa(clk_mgr_base, context, false); -+ dcn314_disable_otg_wa(clk_mgr_base, context, safe_to_lower, false); - - update_dispclk = true; - } --- -2.43.2 - -From 86195357c9211068b8c4c8147232b1915ed29fbe Mon Sep 17 00:00:00 2001 -From: Wayne Lin <Wayne.Lin@amd.com> -Date: Tue, 2 Jan 2024 14:20:37 +0800 -Subject: [PATCH 0940/1501] drm/amd/display: Align the returned error code with - legacy DP -Content-Length: 1503 -Lines: 41 - -commit bfe79f5fff1300d96203383582b078c7b0aec80a upstream. - -[Why] -For usb4 connector, AUX transaction is handled by dmub utilizing a differnt -code path comparing to legacy DP connector. If the usb4 DP connector is -disconnected, AUX access will report EBUSY and cause igt@kms_dp_aux_dev -fail. - -[How] -Align the error code with the one reported by legacy DP as EIO. - -Cc: Mario Limonciello <mario.limonciello@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org -Acked-by: Alex Hung <alex.hung@amd.com> -Signed-off-by: Wayne Lin <Wayne.Lin@amd.com> -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c -index aac98f93545a..4fad9c478c8a 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c -@@ -965,6 +965,11 @@ int dm_helper_dmub_aux_transfer_sync( - struct aux_payload *payload, - enum aux_return_code_type *operation_result) - { -+ if (!link->hpd_status) { -+ *operation_result = AUX_RET_ERROR_HPD_DISCON; -+ return -1; -+ } -+ - return amdgpu_dm_process_dmub_aux_transfer_sync(ctx, link->link_index, payload, - operation_result); - } --- -2.43.2 - -From cf656fc7276e5b3709a81bc9d9639459be2b2647 Mon Sep 17 00:00:00 2001 -From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Date: Wed, 10 Jan 2024 20:58:35 +0530 -Subject: [PATCH 0941/1501] drm/amd/display: Fix late derefrence 'dsc' check in - 'link_set_dsc_pps_packet()' -Content-Length: 1790 -Lines: 47 - -commit 3bb9b1f958c3d986ed90a3ff009f1e77e9553207 upstream. - -In link_set_dsc_pps_packet(), 'struct display_stream_compressor *dsc' -was dereferenced in a DC_LOGGER_INIT(dsc->ctx->logger); before the 'dsc' -NULL pointer check. - -Fixes the below: -drivers/gpu/drm/amd/amdgpu/../display/dc/link/link_dpms.c:905 link_set_dsc_pps_packet() warn: variable dereferenced before check 'dsc' (see line 903) - -Cc: stable@vger.kernel.org -Cc: Aurabindo Pillai <aurabindo.pillai@amd.com> -Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> -Cc: Hamza Mahfooz <hamza.mahfooz@amd.com> -Cc: Wenjing Liu <wenjing.liu@amd.com> -Cc: Qingqing Zhuo <qingqing.zhuo@amd.com> -Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c -index f8e01ca09d96..04d1ecd6e593 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c -+++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c -@@ -875,11 +875,15 @@ bool link_set_dsc_pps_packet(struct pipe_ctx *pipe_ctx, bool enable, bool immedi - { - struct display_stream_compressor *dsc = pipe_ctx->stream_res.dsc; - struct dc_stream_state *stream = pipe_ctx->stream; -- DC_LOGGER_INIT(dsc->ctx->logger); - -- if (!pipe_ctx->stream->timing.flags.DSC || !dsc) -+ if (!pipe_ctx->stream->timing.flags.DSC) - return false; - -+ if (!dsc) -+ return false; -+ -+ DC_LOGGER_INIT(dsc->ctx->logger); -+ - if (enable) { - struct dsc_config dsc_cfg; - uint8_t dsc_packed_pps[128]; --- -2.43.2 - -From 4ed605220dced43aa4eca93820c32ac9eb52ae6c Mon Sep 17 00:00:00 2001 -From: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Date: Sat, 13 Jan 2024 15:58:21 +0100 -Subject: [PATCH 0942/1501] drm/amd/display: Fix a switch statement in - populate_dml_output_cfg_from_stream_state() -Content-Length: 1329 -Lines: 31 - -commit 05638ff6dd6f0f38734b6b3ee2c7cf15520f5c00 upstream. - -It is likely that the statement related to 'dml_edp' is misplaced. So move -it in the correct "case SIGNAL_TYPE_EDP". - -Fixes: 7966f319c66d ("drm/amd/display: Introduce DML2") -Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c b/drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c -index db06a5b749b4..bcc03b184e5e 100644 ---- a/drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c -+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c -@@ -624,8 +624,8 @@ static void populate_dml_output_cfg_from_stream_state(struct dml_output_cfg_st * - if (is_dp2p0_output_encoder(pipe)) - out->OutputEncoder[location] = dml_dp2p0; - break; -- out->OutputEncoder[location] = dml_edp; - case SIGNAL_TYPE_EDP: -+ out->OutputEncoder[location] = dml_edp; - break; - case SIGNAL_TYPE_HDMI_TYPE_A: - case SIGNAL_TYPE_DVI_SINGLE_LINK: --- -2.43.2 - -From e5e134f0e14ee09c2e1b95b819fe8baec3383e78 Mon Sep 17 00:00:00 2001 -From: Tom St Denis <tom.stdenis@amd.com> -Date: Wed, 17 Jan 2024 12:47:37 -0500 -Subject: [PATCH 0943/1501] drm/amd/amdgpu: Assign GART pages to AMD device - mapping -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1950 -Lines: 56 - -commit e7a8594cc2af920a905db15653c19c362d4ebd3f upstream. - -This allows kernel mapped pages like the PDB and PTB to be -read via the iomem debugfs when there is no vram in the system. - -Signed-off-by: Tom St Denis <tom.stdenis@amd.com> -Reviewed-by: Christian König <christian.koenig@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org # 6.7.x -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c -index 73b8cca35bab..c623e23049d1 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c -@@ -121,6 +121,7 @@ int amdgpu_gart_table_ram_alloc(struct amdgpu_device *adev) - struct amdgpu_bo_param bp; - dma_addr_t dma_addr; - struct page *p; -+ unsigned long x; - int ret; - - if (adev->gart.bo != NULL) -@@ -130,6 +131,10 @@ int amdgpu_gart_table_ram_alloc(struct amdgpu_device *adev) - if (!p) - return -ENOMEM; - -+ /* assign pages to this device */ -+ for (x = 0; x < (1UL << order); x++) -+ p[x].mapping = adev->mman.bdev.dev_mapping; -+ - /* If the hardware does not support UTCL2 snooping of the CPU caches - * then set_memory_wc() could be used as a workaround to mark the pages - * as write combine memory. -@@ -223,6 +228,7 @@ void amdgpu_gart_table_ram_free(struct amdgpu_device *adev) - unsigned int order = get_order(adev->gart.table_size); - struct sg_table *sg = adev->gart.bo->tbo.sg; - struct page *p; -+ unsigned long x; - int ret; - - ret = amdgpu_bo_reserve(adev->gart.bo, false); -@@ -234,6 +240,8 @@ void amdgpu_gart_table_ram_free(struct amdgpu_device *adev) - sg_free_table(sg); - kfree(sg); - p = virt_to_page(adev->gart.ptr); -+ for (x = 0; x < (1UL << order); x++) -+ p[x].mapping = NULL; - __free_pages(p, order); - - adev->gart.ptr = NULL; --- -2.43.2 - -From 31e967c68c351b25201cf263cc5f6a1355587f44 Mon Sep 17 00:00:00 2001 -From: Lijo Lazar <lijo.lazar@amd.com> -Date: Thu, 18 Jan 2024 14:25:35 +0530 -Subject: [PATCH 0944/1501] drm/amd/pm: Fetch current power limit from FW -Content-Length: 1067 -Lines: 28 - -commit f1807682de0edbff6c1e46b19642a517d2e15c57 upstream. - -Power limit of SMUv13.0.6 SOCs can be updated by out-of-band ways. Fetch -the limit from firmware instead of using cached values. - -Signed-off-by: Lijo Lazar <lijo.lazar@amd.com> -Reviewed-by: Asad Kamal <asad.kamal@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org # 6.7.x -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c -index e1a5ee911dbb..1d828d64f627 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c -@@ -2502,6 +2502,7 @@ int smu_get_power_limit(void *handle, - case SMU_PPT_LIMIT_CURRENT: - switch (amdgpu_ip_version(adev, MP1_HWIP, 0)) { - case IP_VERSION(13, 0, 2): -+ case IP_VERSION(13, 0, 6): - case IP_VERSION(11, 0, 7): - case IP_VERSION(11, 0, 11): - case IP_VERSION(11, 0, 12): --- -2.43.2 - -From 10b0d6ea0ea96e84b9ecd2e5622953b6a3cfb0a4 Mon Sep 17 00:00:00 2001 -From: Lijo Lazar <lijo.lazar@amd.com> -Date: Sat, 20 Jan 2024 13:32:51 +0530 -Subject: [PATCH 0945/1501] drm/amdgpu: Avoid fetching vram vendor information -Content-Length: 1164 -Lines: 30 - -commit 90751bdeee4e3ac87ebf814bf282b0fa97edfeab upstream. - -For GFX 9.4.3 APUs, the current method of fetching vram vendor -information is not reliable. Avoid fetching the information. - -Signed-off-by: Lijo Lazar <lijo.lazar@amd.com> -Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org # 6.7.x -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c -index 2ac5820e9c92..77e625f24cd0 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c -@@ -1950,7 +1950,8 @@ static void gmc_v9_4_3_init_vram_info(struct amdgpu_device *adev) - static const u32 regBIF_BIOS_SCRATCH_4 = 0x50; - u32 vram_info; - -- if (!amdgpu_sriov_vf(adev)) { -+ /* Only for dGPU, vendor informaton is reliable */ -+ if (!amdgpu_sriov_vf(adev) && !(adev->flags & AMD_IS_APU)) { - vram_info = RREG32(regBIF_BIOS_SCRATCH_4); - adev->gmc.vram_vendor = vram_info & 0xF; - } --- -2.43.2 - -From 5c0cc185d44895d5c6bb8304f18a03f7bc9b819f Mon Sep 17 00:00:00 2001 -From: Lijo Lazar <lijo.lazar@amd.com> -Date: Sat, 20 Jan 2024 13:48:09 +0530 -Subject: [PATCH 0946/1501] drm/amdgpu: Show vram vendor only if available -Content-Length: 1411 -Lines: 44 - -commit 89a7c0bd74918f723c94c10452265e25063cba9b upstream. - -Ony if vram vendor info is available, show in sysfs. - -Signed-off-by: Lijo Lazar <lijo.lazar@amd.com> -Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org # 6.7.x -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 17 ++++++++++++++++- - 1 file changed, 16 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c -index 08916538a615..8db880244324 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c -@@ -221,8 +221,23 @@ static struct attribute *amdgpu_vram_mgr_attributes[] = { - NULL - }; - -+static umode_t amdgpu_vram_attrs_is_visible(struct kobject *kobj, -+ struct attribute *attr, int i) -+{ -+ struct device *dev = kobj_to_dev(kobj); -+ struct drm_device *ddev = dev_get_drvdata(dev); -+ struct amdgpu_device *adev = drm_to_adev(ddev); -+ -+ if (attr == &dev_attr_mem_info_vram_vendor.attr && -+ !adev->gmc.vram_vendor) -+ return 0; -+ -+ return attr->mode; -+} -+ - const struct attribute_group amdgpu_vram_mgr_attr_group = { -- .attrs = amdgpu_vram_mgr_attributes -+ .attrs = amdgpu_vram_mgr_attributes, -+ .is_visible = amdgpu_vram_attrs_is_visible - }; - - /** --- -2.43.2 - -From bf2fb650b1b605ae248c92b2c354bd623c7b12f1 Mon Sep 17 00:00:00 2001 -From: Kenneth Feng <kenneth.feng@amd.com> -Date: Fri, 19 Jan 2024 16:12:00 +0800 -Subject: [PATCH 0947/1501] drm/amd/pm: update the power cap setting -Content-Length: 7427 -Lines: 189 - -commit 30269954745c6cac730352829ac9850918457440 upstream. - -update the power cap setting for smu_v13.0.0/smu_v13.0.7 - -Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2356 -Signed-off-by: Kenneth Feng <kenneth.feng@amd.com> -Acked-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - .../drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 54 ++++++++++++++++++- - .../drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 54 ++++++++++++++++++- - 2 files changed, 104 insertions(+), 4 deletions(-) - -diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c -index 82c4e1f1c6f0..2a76064d909f 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c -@@ -2352,6 +2352,7 @@ static int smu_v13_0_0_get_power_limit(struct smu_context *smu, - PPTable_t *pptable = table_context->driver_pptable; - SkuTable_t *skutable = &pptable->SkuTable; - uint32_t power_limit, od_percent_upper, od_percent_lower; -+ uint32_t msg_limit = skutable->MsgLimits.Power[PPT_THROTTLER_PPT0][POWER_SOURCE_AC]; - - if (smu_v13_0_get_current_power_limit(smu, &power_limit)) - power_limit = smu->adev->pm.ac_power ? -@@ -2375,7 +2376,7 @@ static int smu_v13_0_0_get_power_limit(struct smu_context *smu, - od_percent_upper, od_percent_lower, power_limit); - - if (max_power_limit) { -- *max_power_limit = power_limit * (100 + od_percent_upper); -+ *max_power_limit = msg_limit * (100 + od_percent_upper); - *max_power_limit /= 100; - } - -@@ -2970,6 +2971,55 @@ static ssize_t smu_v13_0_0_get_ecc_info(struct smu_context *smu, - return ret; - } - -+static int smu_v13_0_0_set_power_limit(struct smu_context *smu, -+ enum smu_ppt_limit_type limit_type, -+ uint32_t limit) -+{ -+ PPTable_t *pptable = smu->smu_table.driver_pptable; -+ SkuTable_t *skutable = &pptable->SkuTable; -+ uint32_t msg_limit = skutable->MsgLimits.Power[PPT_THROTTLER_PPT0][POWER_SOURCE_AC]; -+ struct smu_table_context *table_context = &smu->smu_table; -+ OverDriveTableExternal_t *od_table = -+ (OverDriveTableExternal_t *)table_context->overdrive_table; -+ int ret = 0; -+ -+ if (limit_type != SMU_DEFAULT_PPT_LIMIT) -+ return -EINVAL; -+ -+ if (limit <= msg_limit) { -+ if (smu->current_power_limit > msg_limit) { -+ od_table->OverDriveTable.Ppt = 0; -+ od_table->OverDriveTable.FeatureCtrlMask |= 1U << PP_OD_FEATURE_PPT_BIT; -+ -+ ret = smu_v13_0_0_upload_overdrive_table(smu, od_table); -+ if (ret) { -+ dev_err(smu->adev->dev, "Failed to upload overdrive table!\n"); -+ return ret; -+ } -+ } -+ return smu_v13_0_set_power_limit(smu, limit_type, limit); -+ } else if (smu->od_enabled) { -+ ret = smu_v13_0_set_power_limit(smu, limit_type, msg_limit); -+ if (ret) -+ return ret; -+ -+ od_table->OverDriveTable.Ppt = (limit * 100) / msg_limit - 100; -+ od_table->OverDriveTable.FeatureCtrlMask |= 1U << PP_OD_FEATURE_PPT_BIT; -+ -+ ret = smu_v13_0_0_upload_overdrive_table(smu, od_table); -+ if (ret) { -+ dev_err(smu->adev->dev, "Failed to upload overdrive table!\n"); -+ return ret; -+ } -+ -+ smu->current_power_limit = limit; -+ } else { -+ return -EINVAL; -+ } -+ -+ return 0; -+} -+ - static const struct pptable_funcs smu_v13_0_0_ppt_funcs = { - .get_allowed_feature_mask = smu_v13_0_0_get_allowed_feature_mask, - .set_default_dpm_table = smu_v13_0_0_set_default_dpm_table, -@@ -3024,7 +3074,7 @@ static const struct pptable_funcs smu_v13_0_0_ppt_funcs = { - .set_fan_control_mode = smu_v13_0_set_fan_control_mode, - .enable_mgpu_fan_boost = smu_v13_0_0_enable_mgpu_fan_boost, - .get_power_limit = smu_v13_0_0_get_power_limit, -- .set_power_limit = smu_v13_0_set_power_limit, -+ .set_power_limit = smu_v13_0_0_set_power_limit, - .set_power_source = smu_v13_0_set_power_source, - .get_power_profile_mode = smu_v13_0_0_get_power_profile_mode, - .set_power_profile_mode = smu_v13_0_0_set_power_profile_mode, -diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c -index 81eafed76045..d380a53e8f77 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c -@@ -2316,6 +2316,7 @@ static int smu_v13_0_7_get_power_limit(struct smu_context *smu, - PPTable_t *pptable = table_context->driver_pptable; - SkuTable_t *skutable = &pptable->SkuTable; - uint32_t power_limit, od_percent_upper, od_percent_lower; -+ uint32_t msg_limit = skutable->MsgLimits.Power[PPT_THROTTLER_PPT0][POWER_SOURCE_AC]; - - if (smu_v13_0_get_current_power_limit(smu, &power_limit)) - power_limit = smu->adev->pm.ac_power ? -@@ -2339,7 +2340,7 @@ static int smu_v13_0_7_get_power_limit(struct smu_context *smu, - od_percent_upper, od_percent_lower, power_limit); - - if (max_power_limit) { -- *max_power_limit = power_limit * (100 + od_percent_upper); -+ *max_power_limit = msg_limit * (100 + od_percent_upper); - *max_power_limit /= 100; - } - -@@ -2567,6 +2568,55 @@ static int smu_v13_0_7_set_df_cstate(struct smu_context *smu, - NULL); - } - -+static int smu_v13_0_7_set_power_limit(struct smu_context *smu, -+ enum smu_ppt_limit_type limit_type, -+ uint32_t limit) -+{ -+ PPTable_t *pptable = smu->smu_table.driver_pptable; -+ SkuTable_t *skutable = &pptable->SkuTable; -+ uint32_t msg_limit = skutable->MsgLimits.Power[PPT_THROTTLER_PPT0][POWER_SOURCE_AC]; -+ struct smu_table_context *table_context = &smu->smu_table; -+ OverDriveTableExternal_t *od_table = -+ (OverDriveTableExternal_t *)table_context->overdrive_table; -+ int ret = 0; -+ -+ if (limit_type != SMU_DEFAULT_PPT_LIMIT) -+ return -EINVAL; -+ -+ if (limit <= msg_limit) { -+ if (smu->current_power_limit > msg_limit) { -+ od_table->OverDriveTable.Ppt = 0; -+ od_table->OverDriveTable.FeatureCtrlMask |= 1U << PP_OD_FEATURE_PPT_BIT; -+ -+ ret = smu_v13_0_7_upload_overdrive_table(smu, od_table); -+ if (ret) { -+ dev_err(smu->adev->dev, "Failed to upload overdrive table!\n"); -+ return ret; -+ } -+ } -+ return smu_v13_0_set_power_limit(smu, limit_type, limit); -+ } else if (smu->od_enabled) { -+ ret = smu_v13_0_set_power_limit(smu, limit_type, msg_limit); -+ if (ret) -+ return ret; -+ -+ od_table->OverDriveTable.Ppt = (limit * 100) / msg_limit - 100; -+ od_table->OverDriveTable.FeatureCtrlMask |= 1U << PP_OD_FEATURE_PPT_BIT; -+ -+ ret = smu_v13_0_7_upload_overdrive_table(smu, od_table); -+ if (ret) { -+ dev_err(smu->adev->dev, "Failed to upload overdrive table!\n"); -+ return ret; -+ } -+ -+ smu->current_power_limit = limit; -+ } else { -+ return -EINVAL; -+ } -+ -+ return 0; -+} -+ - static const struct pptable_funcs smu_v13_0_7_ppt_funcs = { - .get_allowed_feature_mask = smu_v13_0_7_get_allowed_feature_mask, - .set_default_dpm_table = smu_v13_0_7_set_default_dpm_table, -@@ -2618,7 +2668,7 @@ static const struct pptable_funcs smu_v13_0_7_ppt_funcs = { - .set_fan_control_mode = smu_v13_0_set_fan_control_mode, - .enable_mgpu_fan_boost = smu_v13_0_7_enable_mgpu_fan_boost, - .get_power_limit = smu_v13_0_7_get_power_limit, -- .set_power_limit = smu_v13_0_set_power_limit, -+ .set_power_limit = smu_v13_0_7_set_power_limit, - .set_power_source = smu_v13_0_set_power_source, - .get_power_profile_mode = smu_v13_0_7_get_power_profile_mode, - .set_power_profile_mode = smu_v13_0_7_set_power_profile_mode, --- -2.43.2 - -From 2d2c9032d61164e15a1d98558ba8575c00d621dd Mon Sep 17 00:00:00 2001 -From: Ma Jun <Jun.Ma2@amd.com> -Date: Wed, 17 Jan 2024 14:35:29 +0800 -Subject: [PATCH 0948/1501] drm/amdgpu/pm: Fix the power source flag error -Content-Length: 3087 -Lines: 85 - -commit ca1ffb174f16b699c536734fc12a4162097c49f4 upstream. - -The power source flag should be updated when -[1] System receives an interrupt indicating that the power source -has changed. -[2] System resumes from suspend or runtime suspend - -Signed-off-by: Ma Jun <Jun.Ma2@amd.com> -Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 13 +++---------- - drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 2 ++ - drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 2 ++ - 3 files changed, 7 insertions(+), 10 deletions(-) - -diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c -index 1d828d64f627..cd252e2b584c 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c -@@ -24,6 +24,7 @@ - - #include <linux/firmware.h> - #include <linux/pci.h> -+#include <linux/power_supply.h> - #include <linux/reboot.h> - - #include "amdgpu.h" -@@ -817,16 +818,8 @@ static int smu_late_init(void *handle) - * handle the switch automatically. Driver involvement - * is unnecessary. - */ -- if (!smu->dc_controlled_by_gpio) { -- ret = smu_set_power_source(smu, -- adev->pm.ac_power ? SMU_POWER_SOURCE_AC : -- SMU_POWER_SOURCE_DC); -- if (ret) { -- dev_err(adev->dev, "Failed to switch to %s mode!\n", -- adev->pm.ac_power ? "AC" : "DC"); -- return ret; -- } -- } -+ adev->pm.ac_power = power_supply_is_system_supplied() > 0; -+ smu_set_ac_dc(smu); - - if ((amdgpu_ip_version(adev, MP1_HWIP, 0) == IP_VERSION(13, 0, 1)) || - (amdgpu_ip_version(adev, MP1_HWIP, 0) == IP_VERSION(13, 0, 3))) -diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c -index 5a314d0316c1..c7bfa68bf00f 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c -@@ -1442,10 +1442,12 @@ static int smu_v11_0_irq_process(struct amdgpu_device *adev, - case 0x3: - dev_dbg(adev->dev, "Switched to AC mode!\n"); - schedule_work(&smu->interrupt_work); -+ adev->pm.ac_power = true; - break; - case 0x4: - dev_dbg(adev->dev, "Switched to DC mode!\n"); - schedule_work(&smu->interrupt_work); -+ adev->pm.ac_power = false; - break; - case 0x7: - /* -diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c -index cf1b84060bc3..68981086b5a2 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c -@@ -1379,10 +1379,12 @@ static int smu_v13_0_irq_process(struct amdgpu_device *adev, - case 0x3: - dev_dbg(adev->dev, "Switched to AC mode!\n"); - smu_v13_0_ack_ac_dc_interrupt(smu); -+ adev->pm.ac_power = true; - break; - case 0x4: - dev_dbg(adev->dev, "Switched to DC mode!\n"); - smu_v13_0_ack_ac_dc_interrupt(smu); -+ adev->pm.ac_power = false; - break; - case 0x7: - /* --- -2.43.2 - -From 170a9dac29720869398c56cc554142004a0e4157 Mon Sep 17 00:00:00 2001 -From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Date: Wed, 17 Jan 2024 08:41:52 +0530 -Subject: [PATCH 0949/1501] drm/amd/display: Fix uninitialized variable usage - in core_link_ 'read_dpcd() & write_dpcd()' functions -Content-Length: 2066 -Lines: 50 - -commit a58371d632ebab9ea63f10893a6b6731196b6f8d upstream. - -The 'status' variable in 'core_link_read_dpcd()' & -'core_link_write_dpcd()' was uninitialized. - -Thus, initializing 'status' variable to 'DC_ERROR_UNEXPECTED' by default. - -Fixes the below: -drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_dpcd.c:226 core_link_read_dpcd() error: uninitialized symbol 'status'. -drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_dpcd.c:248 core_link_write_dpcd() error: uninitialized symbol 'status'. - -Cc: stable@vger.kernel.org -Cc: Jerry Zuo <jerry.zuo@amd.com> -Cc: Jun Lei <Jun.Lei@amd.com> -Cc: Wayne Lin <Wayne.Lin@amd.com> -Cc: Aurabindo Pillai <aurabindo.pillai@amd.com> -Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> -Cc: Hamza Mahfooz <hamza.mahfooz@amd.com> -Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c -index 5c9a30211c10..fc50931c2aec 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c -+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c -@@ -205,7 +205,7 @@ enum dc_status core_link_read_dpcd( - uint32_t extended_size; - /* size of the remaining partitioned address space */ - uint32_t size_left_to_read; -- enum dc_status status; -+ enum dc_status status = DC_ERROR_UNEXPECTED; - /* size of the next partition to be read from */ - uint32_t partition_size; - uint32_t data_index = 0; -@@ -234,7 +234,7 @@ enum dc_status core_link_write_dpcd( - { - uint32_t partition_size; - uint32_t data_index = 0; -- enum dc_status status; -+ enum dc_status status = DC_ERROR_UNEXPECTED; - - while (size) { - partition_size = dpcd_get_next_partition_size(address, size); --- -2.43.2 - -From b326de729f87b3ad53a382c871701f3016582e24 Mon Sep 17 00:00:00 2001 -From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com> -Date: Tue, 2 Jan 2024 20:14:56 -0800 -Subject: [PATCH 0950/1501] thermal: intel: hfi: Refactor enabling code into - helper functions -Content-Length: 3375 -Lines: 100 - -[ Upstream commit 8a8b6bb93c704776c4b05cb517c3fa8baffb72f5 ] - -In preparation for the addition of a suspend notifier, wrap the logic to -enable HFI and program its memory buffer into helper functions. Both the -CPU hotplug callback and the suspend notifier will use them. - -This refactoring does not introduce functional changes. - -Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com> -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Stable-dep-of: 97566d09fd02 ("thermal: intel: hfi: Add syscore callbacks for system-wide PM") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/thermal/intel/intel_hfi.c | 43 ++++++++++++++++--------------- - 1 file changed, 22 insertions(+), 21 deletions(-) - -diff --git a/drivers/thermal/intel/intel_hfi.c b/drivers/thermal/intel/intel_hfi.c -index c69db6c90869..820613e293cd 100644 ---- a/drivers/thermal/intel/intel_hfi.c -+++ b/drivers/thermal/intel/intel_hfi.c -@@ -347,6 +347,26 @@ static void init_hfi_instance(struct hfi_instance *hfi_instance) - hfi_instance->data = hfi_instance->hdr + hfi_features.hdr_size; - } - -+/* Caller must hold hfi_instance_lock. */ -+static void hfi_enable(void) -+{ -+ u64 msr_val; -+ -+ rdmsrl(MSR_IA32_HW_FEEDBACK_CONFIG, msr_val); -+ msr_val |= HW_FEEDBACK_CONFIG_HFI_ENABLE_BIT; -+ wrmsrl(MSR_IA32_HW_FEEDBACK_CONFIG, msr_val); -+} -+ -+static void hfi_set_hw_table(struct hfi_instance *hfi_instance) -+{ -+ phys_addr_t hw_table_pa; -+ u64 msr_val; -+ -+ hw_table_pa = virt_to_phys(hfi_instance->hw_table); -+ msr_val = hw_table_pa | HW_FEEDBACK_PTR_VALID_BIT; -+ wrmsrl(MSR_IA32_HW_FEEDBACK_PTR, msr_val); -+} -+ - /** - * intel_hfi_online() - Enable HFI on @cpu - * @cpu: CPU in which the HFI will be enabled -@@ -364,8 +384,6 @@ void intel_hfi_online(unsigned int cpu) - { - struct hfi_instance *hfi_instance; - struct hfi_cpu_info *info; -- phys_addr_t hw_table_pa; -- u64 msr_val; - u16 die_id; - - /* Nothing to do if hfi_instances are missing. */ -@@ -409,8 +427,6 @@ void intel_hfi_online(unsigned int cpu) - if (!hfi_instance->hw_table) - goto unlock; - -- hw_table_pa = virt_to_phys(hfi_instance->hw_table); -- - /* - * Allocate memory to keep a local copy of the table that - * hardware generates. -@@ -420,16 +436,6 @@ void intel_hfi_online(unsigned int cpu) - if (!hfi_instance->local_table) - goto free_hw_table; - -- /* -- * Program the address of the feedback table of this die/package. On -- * some processors, hardware remembers the old address of the HFI table -- * even after having been reprogrammed and re-enabled. Thus, do not free -- * the pages allocated for the table or reprogram the hardware with a -- * new base address. Namely, program the hardware only once. -- */ -- msr_val = hw_table_pa | HW_FEEDBACK_PTR_VALID_BIT; -- wrmsrl(MSR_IA32_HW_FEEDBACK_PTR, msr_val); -- - init_hfi_instance(hfi_instance); - - INIT_DELAYED_WORK(&hfi_instance->update_work, hfi_update_work_fn); -@@ -438,13 +444,8 @@ void intel_hfi_online(unsigned int cpu) - - cpumask_set_cpu(cpu, hfi_instance->cpus); - -- /* -- * Enable the hardware feedback interface and never disable it. See -- * comment on programming the address of the table. -- */ -- rdmsrl(MSR_IA32_HW_FEEDBACK_CONFIG, msr_val); -- msr_val |= HW_FEEDBACK_CONFIG_HFI_ENABLE_BIT; -- wrmsrl(MSR_IA32_HW_FEEDBACK_CONFIG, msr_val); -+ hfi_set_hw_table(hfi_instance); -+ hfi_enable(); - - unlock: - mutex_unlock(&hfi_instance_lock); --- -2.43.2 - -From 74090a40021a7d78429bd7af6f7cd7e90e489444 Mon Sep 17 00:00:00 2001 -From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com> -Date: Tue, 2 Jan 2024 20:14:58 -0800 -Subject: [PATCH 0951/1501] thermal: intel: hfi: Disable an HFI instance when - all its CPUs go offline -Content-Length: 3042 -Lines: 89 - -[ Upstream commit 1c53081d773c2cb4461636559b0d55b46559ceec ] - -In preparation to support hibernation, add functionality to disable an HFI -instance during CPU offline. The last CPU of an instance that goes offline -will disable such instance. - -The Intel Software Development Manual states that the operating system must -wait for the hardware to set MSR_IA32_PACKAGE_THERM_STATUS[26] after -disabling an HFI instance to ensure that it will no longer write on the HFI -memory. Some processors, however, do not ever set such bit. Wait a minimum -of 2ms to give time hardware to complete any pending memory writes. - -Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com> -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Stable-dep-of: 97566d09fd02 ("thermal: intel: hfi: Add syscore callbacks for system-wide PM") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/thermal/intel/intel_hfi.c | 35 +++++++++++++++++++++++++++++++ - 1 file changed, 35 insertions(+) - -diff --git a/drivers/thermal/intel/intel_hfi.c b/drivers/thermal/intel/intel_hfi.c -index 820613e293cd..bb25c75acd45 100644 ---- a/drivers/thermal/intel/intel_hfi.c -+++ b/drivers/thermal/intel/intel_hfi.c -@@ -24,6 +24,7 @@ - #include <linux/bitops.h> - #include <linux/cpufeature.h> - #include <linux/cpumask.h> -+#include <linux/delay.h> - #include <linux/gfp.h> - #include <linux/io.h> - #include <linux/kernel.h> -@@ -367,6 +368,32 @@ static void hfi_set_hw_table(struct hfi_instance *hfi_instance) - wrmsrl(MSR_IA32_HW_FEEDBACK_PTR, msr_val); - } - -+/* Caller must hold hfi_instance_lock. */ -+static void hfi_disable(void) -+{ -+ u64 msr_val; -+ int i; -+ -+ rdmsrl(MSR_IA32_HW_FEEDBACK_CONFIG, msr_val); -+ msr_val &= ~HW_FEEDBACK_CONFIG_HFI_ENABLE_BIT; -+ wrmsrl(MSR_IA32_HW_FEEDBACK_CONFIG, msr_val); -+ -+ /* -+ * Wait for hardware to acknowledge the disabling of HFI. Some -+ * processors may not do it. Wait for ~2ms. This is a reasonable -+ * time for hardware to complete any pending actions on the HFI -+ * memory. -+ */ -+ for (i = 0; i < 2000; i++) { -+ rdmsrl(MSR_IA32_PACKAGE_THERM_STATUS, msr_val); -+ if (msr_val & PACKAGE_THERM_STATUS_HFI_UPDATED) -+ break; -+ -+ udelay(1); -+ cpu_relax(); -+ } -+} -+ - /** - * intel_hfi_online() - Enable HFI on @cpu - * @cpu: CPU in which the HFI will be enabled -@@ -421,6 +448,10 @@ void intel_hfi_online(unsigned int cpu) - /* - * Hardware is programmed with the physical address of the first page - * frame of the table. Hence, the allocated memory must be page-aligned. -+ * -+ * Some processors do not forget the initial address of the HFI table -+ * even after having been reprogrammed. Keep using the same pages. Do -+ * not free them. - */ - hfi_instance->hw_table = alloc_pages_exact(hfi_features.nr_table_pages, - GFP_KERNEL | __GFP_ZERO); -@@ -485,6 +516,10 @@ void intel_hfi_offline(unsigned int cpu) - - mutex_lock(&hfi_instance_lock); - cpumask_clear_cpu(cpu, hfi_instance->cpus); -+ -+ if (!cpumask_weight(hfi_instance->cpus)) -+ hfi_disable(); -+ - mutex_unlock(&hfi_instance_lock); - } - --- -2.43.2 - -From c9d6d63b6c03afaa6f185df249af693a7939577c Mon Sep 17 00:00:00 2001 -From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com> -Date: Tue, 9 Jan 2024 19:07:04 -0800 -Subject: [PATCH 0952/1501] thermal: intel: hfi: Add syscore callbacks for - system-wide PM -Content-Length: 3051 -Lines: 93 - -[ Upstream commit 97566d09fd02d2ab329774bb89a2cdf2267e86d9 ] - -The kernel allocates a memory buffer and provides its location to the -hardware, which uses it to update the HFI table. This allocation occurs -during boot and remains constant throughout runtime. - -When resuming from hibernation, the restore kernel allocates a second -memory buffer and reprograms the HFI hardware with the new location as -part of a normal boot. The location of the second memory buffer may -differ from the one allocated by the image kernel. - -When the restore kernel transfers control to the image kernel, its HFI -buffer becomes invalid, potentially leading to memory corruption if the -hardware writes to it (the hardware continues to use the buffer from the -restore kernel). - -It is also possible that the hardware "forgets" the address of the memory -buffer when resuming from "deep" suspend. Memory corruption may also occur -in such a scenario. - -To prevent the described memory corruption, disable HFI when preparing to -suspend or hibernate. Enable it when resuming. - -Add syscore callbacks to handle the package of the boot CPU (packages of -non-boot CPUs are handled via CPU offline). Syscore ops always run on the -boot CPU. Additionally, HFI only needs to be disabled during "deep" suspend -and hibernation. Syscore ops only run in these cases. - -Cc: 6.1+ <stable@vger.kernel.org> # 6.1+ -Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com> -[ rjw: Comment adjustment, subject and changelog edits ] -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/thermal/intel/intel_hfi.c | 28 ++++++++++++++++++++++++++++ - 1 file changed, 28 insertions(+) - -diff --git a/drivers/thermal/intel/intel_hfi.c b/drivers/thermal/intel/intel_hfi.c -index bb25c75acd45..1c5a429b2e3e 100644 ---- a/drivers/thermal/intel/intel_hfi.c -+++ b/drivers/thermal/intel/intel_hfi.c -@@ -35,7 +35,9 @@ - #include <linux/processor.h> - #include <linux/slab.h> - #include <linux/spinlock.h> -+#include <linux/suspend.h> - #include <linux/string.h> -+#include <linux/syscore_ops.h> - #include <linux/topology.h> - #include <linux/workqueue.h> - -@@ -568,6 +570,30 @@ static __init int hfi_parse_features(void) - return 0; - } - -+static void hfi_do_enable(void) -+{ -+ /* This code runs only on the boot CPU. */ -+ struct hfi_cpu_info *info = &per_cpu(hfi_cpu_info, 0); -+ struct hfi_instance *hfi_instance = info->hfi_instance; -+ -+ /* No locking needed. There is no concurrency with CPU online. */ -+ hfi_set_hw_table(hfi_instance); -+ hfi_enable(); -+} -+ -+static int hfi_do_disable(void) -+{ -+ /* No locking needed. There is no concurrency with CPU offline. */ -+ hfi_disable(); -+ -+ return 0; -+} -+ -+static struct syscore_ops hfi_pm_ops = { -+ .resume = hfi_do_enable, -+ .suspend = hfi_do_disable, -+}; -+ - void __init intel_hfi_init(void) - { - struct hfi_instance *hfi_instance; -@@ -599,6 +625,8 @@ void __init intel_hfi_init(void) - if (!hfi_updates_wq) - goto err_nomem; - -+ register_syscore_ops(&hfi_pm_ops); -+ - return; - - err_nomem: --- -2.43.2 - -From a7a60c8301245a916ddfdddc8ea29704bcc9ad4f Mon Sep 17 00:00:00 2001 -From: Sakari Ailus <sakari.ailus@linux.intel.com> -Date: Tue, 7 Nov 2023 10:45:30 +0200 -Subject: [PATCH 0953/1501] media: v4l: cci: Include linux/bits.h -Content-Length: 866 -Lines: 28 - -[ Upstream commit eba5058633b4d11e2a4d65eae9f1fce0b96365d9 ] - -linux/bits.h is needed for GENMASK(). Include it. - -Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> -Reviewed-by: Hans de Goede <hdegoede@redhat.com> -Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Stable-dep-of: d92e7a013ff3 ("media: v4l2-cci: Add support for little-endian encoded registers") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/media/v4l2-cci.h | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/include/media/v4l2-cci.h b/include/media/v4l2-cci.h -index 0f6803e4b17e..f2c2962e936b 100644 ---- a/include/media/v4l2-cci.h -+++ b/include/media/v4l2-cci.h -@@ -7,6 +7,7 @@ - #ifndef _V4L2_CCI_H - #define _V4L2_CCI_H - -+#include <linux/bits.h> - #include <linux/types.h> - - struct i2c_client; --- -2.43.2 - -From b6d4d288de9cdad765be357b89f651dabc1c6fcc Mon Sep 17 00:00:00 2001 -From: Sakari Ailus <sakari.ailus@linux.intel.com> -Date: Tue, 7 Nov 2023 17:42:40 +0200 -Subject: [PATCH 0954/1501] media: v4l: cci: Add macros to obtain register - width and address -Content-Length: 2442 -Lines: 71 - -[ Upstream commit cd93cc245dfe334c38da98c14b34f9597e1b4ea6 ] - -Add CCI_REG_WIDTH() macro to obtain register width in bits and similarly, -CCI_REG_WIDTH_BYTES() to obtain it in bytes. - -Also add CCI_REG_ADDR() macro to obtain the address of a register. - -Use both macros in v4l2-cci.c, too. - -Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> -Reviewed-by: Hans de Goede <hdegoede@redhat.com> -Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Stable-dep-of: d92e7a013ff3 ("media: v4l2-cci: Add support for little-endian encoded registers") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/v4l2-core/v4l2-cci.c | 8 ++++---- - include/media/v4l2-cci.h | 5 +++++ - 2 files changed, 9 insertions(+), 4 deletions(-) - -diff --git a/drivers/media/v4l2-core/v4l2-cci.c b/drivers/media/v4l2-core/v4l2-cci.c -index bc2dbec019b0..3179160abde3 100644 ---- a/drivers/media/v4l2-core/v4l2-cci.c -+++ b/drivers/media/v4l2-core/v4l2-cci.c -@@ -25,8 +25,8 @@ int cci_read(struct regmap *map, u32 reg, u64 *val, int *err) - if (err && *err) - return *err; - -- len = FIELD_GET(CCI_REG_WIDTH_MASK, reg); -- reg = FIELD_GET(CCI_REG_ADDR_MASK, reg); -+ len = CCI_REG_WIDTH_BYTES(reg); -+ reg = CCI_REG_ADDR(reg); - - ret = regmap_bulk_read(map, reg, buf, len); - if (ret) { -@@ -75,8 +75,8 @@ int cci_write(struct regmap *map, u32 reg, u64 val, int *err) - if (err && *err) - return *err; - -- len = FIELD_GET(CCI_REG_WIDTH_MASK, reg); -- reg = FIELD_GET(CCI_REG_ADDR_MASK, reg); -+ len = CCI_REG_WIDTH_BYTES(reg); -+ reg = CCI_REG_ADDR(reg); - - switch (len) { - case 1: -diff --git a/include/media/v4l2-cci.h b/include/media/v4l2-cci.h -index f2c2962e936b..a2835a663df5 100644 ---- a/include/media/v4l2-cci.h -+++ b/include/media/v4l2-cci.h -@@ -7,6 +7,7 @@ - #ifndef _V4L2_CCI_H - #define _V4L2_CCI_H - -+#include <linux/bitfield.h> - #include <linux/bits.h> - #include <linux/types.h> - -@@ -34,6 +35,10 @@ struct cci_reg_sequence { - #define CCI_REG_WIDTH_SHIFT 16 - #define CCI_REG_WIDTH_MASK GENMASK(19, 16) - -+#define CCI_REG_WIDTH_BYTES(x) FIELD_GET(CCI_REG_WIDTH_MASK, x) -+#define CCI_REG_WIDTH(x) (CCI_REG_WIDTH_BYTES(x) << 3) -+#define CCI_REG_ADDR(x) FIELD_GET(CCI_REG_ADDR_MASK, x) -+ - #define CCI_REG8(x) ((1 << CCI_REG_WIDTH_SHIFT) | (x)) - #define CCI_REG16(x) ((2 << CCI_REG_WIDTH_SHIFT) | (x)) - #define CCI_REG24(x) ((3 << CCI_REG_WIDTH_SHIFT) | (x)) --- -2.43.2 - -From d5d66144c75fdf3f225b935504c21bf33386990b Mon Sep 17 00:00:00 2001 -From: Alexander Stein <alexander.stein@ew.tq-group.com> -Date: Thu, 2 Nov 2023 10:50:47 +0100 -Subject: [PATCH 0955/1501] media: v4l2-cci: Add support for little-endian - encoded registers -Content-Length: 4587 -Lines: 146 - -[ Upstream commit d92e7a013ff33f4e0b31bbf768d0c85a8acefebf ] - -Some sensors, e.g. Sony IMX290, are using little-endian registers. Add -support for those by encoding the endianness into Bit 20 of the register -address. - -Fixes: af73323b9770 ("media: imx290: Convert to new CCI register access helpers") -Cc: stable@vger.kernel.org -Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> -Reviewed-by: Hans de Goede <hdegoede@redhat.com> -Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> -[Sakari Ailus: Fixed commit message.] -Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/v4l2-core/v4l2-cci.c | 44 ++++++++++++++++++++++++------ - include/media/v4l2-cci.h | 5 ++++ - 2 files changed, 41 insertions(+), 8 deletions(-) - -diff --git a/drivers/media/v4l2-core/v4l2-cci.c b/drivers/media/v4l2-core/v4l2-cci.c -index 3179160abde3..10005c80f43b 100644 ---- a/drivers/media/v4l2-core/v4l2-cci.c -+++ b/drivers/media/v4l2-core/v4l2-cci.c -@@ -18,6 +18,7 @@ - - int cci_read(struct regmap *map, u32 reg, u64 *val, int *err) - { -+ bool little_endian; - unsigned int len; - u8 buf[8]; - int ret; -@@ -25,6 +26,7 @@ int cci_read(struct regmap *map, u32 reg, u64 *val, int *err) - if (err && *err) - return *err; - -+ little_endian = reg & CCI_REG_LE; - len = CCI_REG_WIDTH_BYTES(reg); - reg = CCI_REG_ADDR(reg); - -@@ -40,16 +42,28 @@ int cci_read(struct regmap *map, u32 reg, u64 *val, int *err) - *val = buf[0]; - break; - case 2: -- *val = get_unaligned_be16(buf); -+ if (little_endian) -+ *val = get_unaligned_le16(buf); -+ else -+ *val = get_unaligned_be16(buf); - break; - case 3: -- *val = get_unaligned_be24(buf); -+ if (little_endian) -+ *val = get_unaligned_le24(buf); -+ else -+ *val = get_unaligned_be24(buf); - break; - case 4: -- *val = get_unaligned_be32(buf); -+ if (little_endian) -+ *val = get_unaligned_le32(buf); -+ else -+ *val = get_unaligned_be32(buf); - break; - case 8: -- *val = get_unaligned_be64(buf); -+ if (little_endian) -+ *val = get_unaligned_le64(buf); -+ else -+ *val = get_unaligned_be64(buf); - break; - default: - dev_err(regmap_get_device(map), "Error invalid reg-width %u for reg 0x%04x\n", -@@ -68,6 +82,7 @@ EXPORT_SYMBOL_GPL(cci_read); - - int cci_write(struct regmap *map, u32 reg, u64 val, int *err) - { -+ bool little_endian; - unsigned int len; - u8 buf[8]; - int ret; -@@ -75,6 +90,7 @@ int cci_write(struct regmap *map, u32 reg, u64 val, int *err) - if (err && *err) - return *err; - -+ little_endian = reg & CCI_REG_LE; - len = CCI_REG_WIDTH_BYTES(reg); - reg = CCI_REG_ADDR(reg); - -@@ -83,16 +99,28 @@ int cci_write(struct regmap *map, u32 reg, u64 val, int *err) - buf[0] = val; - break; - case 2: -- put_unaligned_be16(val, buf); -+ if (little_endian) -+ put_unaligned_le16(val, buf); -+ else -+ put_unaligned_be16(val, buf); - break; - case 3: -- put_unaligned_be24(val, buf); -+ if (little_endian) -+ put_unaligned_le24(val, buf); -+ else -+ put_unaligned_be24(val, buf); - break; - case 4: -- put_unaligned_be32(val, buf); -+ if (little_endian) -+ put_unaligned_le32(val, buf); -+ else -+ put_unaligned_be32(val, buf); - break; - case 8: -- put_unaligned_be64(val, buf); -+ if (little_endian) -+ put_unaligned_le64(val, buf); -+ else -+ put_unaligned_be64(val, buf); - break; - default: - dev_err(regmap_get_device(map), "Error invalid reg-width %u for reg 0x%04x\n", -diff --git a/include/media/v4l2-cci.h b/include/media/v4l2-cci.h -index a2835a663df5..8b0b361b464c 100644 ---- a/include/media/v4l2-cci.h -+++ b/include/media/v4l2-cci.h -@@ -38,12 +38,17 @@ struct cci_reg_sequence { - #define CCI_REG_WIDTH_BYTES(x) FIELD_GET(CCI_REG_WIDTH_MASK, x) - #define CCI_REG_WIDTH(x) (CCI_REG_WIDTH_BYTES(x) << 3) - #define CCI_REG_ADDR(x) FIELD_GET(CCI_REG_ADDR_MASK, x) -+#define CCI_REG_LE BIT(20) - - #define CCI_REG8(x) ((1 << CCI_REG_WIDTH_SHIFT) | (x)) - #define CCI_REG16(x) ((2 << CCI_REG_WIDTH_SHIFT) | (x)) - #define CCI_REG24(x) ((3 << CCI_REG_WIDTH_SHIFT) | (x)) - #define CCI_REG32(x) ((4 << CCI_REG_WIDTH_SHIFT) | (x)) - #define CCI_REG64(x) ((8 << CCI_REG_WIDTH_SHIFT) | (x)) -+#define CCI_REG16_LE(x) (CCI_REG_LE | (2U << CCI_REG_WIDTH_SHIFT) | (x)) -+#define CCI_REG24_LE(x) (CCI_REG_LE | (3U << CCI_REG_WIDTH_SHIFT) | (x)) -+#define CCI_REG32_LE(x) (CCI_REG_LE | (4U << CCI_REG_WIDTH_SHIFT) | (x)) -+#define CCI_REG64_LE(x) (CCI_REG_LE | (8U << CCI_REG_WIDTH_SHIFT) | (x)) - - /** - * cci_read() - Read a value from a single CCI register --- -2.43.2 - -From 6e6b4f93614a13466d6629750d7e9acaf6d8fa4c Mon Sep 17 00:00:00 2001 -From: Alexander Stein <alexander.stein@ew.tq-group.com> -Date: Thu, 2 Nov 2023 10:50:48 +0100 -Subject: [PATCH 0956/1501] media: i2c: imx290: Properly encode registers as - little-endian -Content-Length: 4070 -Lines: 94 - -[ Upstream commit 60fc87a69523c294eb23a1316af922f6665a6f8c ] - -The conversion to CCI also converted the multi-byte register access to -big-endian. Correct the register definition by using the correct -little-endian ones. - -Fixes: af73323b9770 ("media: imx290: Convert to new CCI register access helpers") -Cc: stable@vger.kernel.org -Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> -Reviewed-by: Hans de Goede <hdegoede@redhat.com> -Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> -[Sakari Ailus: Fixed the Fixes: tag.] -Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/i2c/imx290.c | 42 +++++++++++++++++++------------------- - 1 file changed, 21 insertions(+), 21 deletions(-) - -diff --git a/drivers/media/i2c/imx290.c b/drivers/media/i2c/imx290.c -index 29098612813c..c6fea5837a19 100644 ---- a/drivers/media/i2c/imx290.c -+++ b/drivers/media/i2c/imx290.c -@@ -41,18 +41,18 @@ - #define IMX290_WINMODE_720P (1 << 4) - #define IMX290_WINMODE_CROP (4 << 4) - #define IMX290_FR_FDG_SEL CCI_REG8(0x3009) --#define IMX290_BLKLEVEL CCI_REG16(0x300a) -+#define IMX290_BLKLEVEL CCI_REG16_LE(0x300a) - #define IMX290_GAIN CCI_REG8(0x3014) --#define IMX290_VMAX CCI_REG24(0x3018) -+#define IMX290_VMAX CCI_REG24_LE(0x3018) - #define IMX290_VMAX_MAX 0x3ffff --#define IMX290_HMAX CCI_REG16(0x301c) -+#define IMX290_HMAX CCI_REG16_LE(0x301c) - #define IMX290_HMAX_MAX 0xffff --#define IMX290_SHS1 CCI_REG24(0x3020) -+#define IMX290_SHS1 CCI_REG24_LE(0x3020) - #define IMX290_WINWV_OB CCI_REG8(0x303a) --#define IMX290_WINPV CCI_REG16(0x303c) --#define IMX290_WINWV CCI_REG16(0x303e) --#define IMX290_WINPH CCI_REG16(0x3040) --#define IMX290_WINWH CCI_REG16(0x3042) -+#define IMX290_WINPV CCI_REG16_LE(0x303c) -+#define IMX290_WINWV CCI_REG16_LE(0x303e) -+#define IMX290_WINPH CCI_REG16_LE(0x3040) -+#define IMX290_WINWH CCI_REG16_LE(0x3042) - #define IMX290_OUT_CTRL CCI_REG8(0x3046) - #define IMX290_ODBIT_10BIT (0 << 0) - #define IMX290_ODBIT_12BIT (1 << 0) -@@ -78,28 +78,28 @@ - #define IMX290_ADBIT2 CCI_REG8(0x317c) - #define IMX290_ADBIT2_10BIT 0x12 - #define IMX290_ADBIT2_12BIT 0x00 --#define IMX290_CHIP_ID CCI_REG16(0x319a) -+#define IMX290_CHIP_ID CCI_REG16_LE(0x319a) - #define IMX290_ADBIT3 CCI_REG8(0x31ec) - #define IMX290_ADBIT3_10BIT 0x37 - #define IMX290_ADBIT3_12BIT 0x0e - #define IMX290_REPETITION CCI_REG8(0x3405) - #define IMX290_PHY_LANE_NUM CCI_REG8(0x3407) - #define IMX290_OPB_SIZE_V CCI_REG8(0x3414) --#define IMX290_Y_OUT_SIZE CCI_REG16(0x3418) --#define IMX290_CSI_DT_FMT CCI_REG16(0x3441) -+#define IMX290_Y_OUT_SIZE CCI_REG16_LE(0x3418) -+#define IMX290_CSI_DT_FMT CCI_REG16_LE(0x3441) - #define IMX290_CSI_DT_FMT_RAW10 0x0a0a - #define IMX290_CSI_DT_FMT_RAW12 0x0c0c - #define IMX290_CSI_LANE_MODE CCI_REG8(0x3443) --#define IMX290_EXTCK_FREQ CCI_REG16(0x3444) --#define IMX290_TCLKPOST CCI_REG16(0x3446) --#define IMX290_THSZERO CCI_REG16(0x3448) --#define IMX290_THSPREPARE CCI_REG16(0x344a) --#define IMX290_TCLKTRAIL CCI_REG16(0x344c) --#define IMX290_THSTRAIL CCI_REG16(0x344e) --#define IMX290_TCLKZERO CCI_REG16(0x3450) --#define IMX290_TCLKPREPARE CCI_REG16(0x3452) --#define IMX290_TLPX CCI_REG16(0x3454) --#define IMX290_X_OUT_SIZE CCI_REG16(0x3472) -+#define IMX290_EXTCK_FREQ CCI_REG16_LE(0x3444) -+#define IMX290_TCLKPOST CCI_REG16_LE(0x3446) -+#define IMX290_THSZERO CCI_REG16_LE(0x3448) -+#define IMX290_THSPREPARE CCI_REG16_LE(0x344a) -+#define IMX290_TCLKTRAIL CCI_REG16_LE(0x344c) -+#define IMX290_THSTRAIL CCI_REG16_LE(0x344e) -+#define IMX290_TCLKZERO CCI_REG16_LE(0x3450) -+#define IMX290_TCLKPREPARE CCI_REG16_LE(0x3452) -+#define IMX290_TLPX CCI_REG16_LE(0x3454) -+#define IMX290_X_OUT_SIZE CCI_REG16_LE(0x3472) - #define IMX290_INCKSEL7 CCI_REG8(0x3480) - - #define IMX290_PGCTRL_REGEN BIT(0) --- -2.43.2 - -From 2333a3ed959eb61547ef6681bfe585719d1adda1 Mon Sep 17 00:00:00 2001 -From: Naohiro Aota <naohiro.aota@wdc.com> -Date: Tue, 19 Dec 2023 01:02:28 +0900 -Subject: [PATCH 0957/1501] btrfs: zoned: factor out prepare_allocation_zoned() -Content-Length: 2304 -Lines: 67 - -[ Upstream commit b271fee9a41ca1474d30639fd6cc912c9901d0f8 ] - -Factor out prepare_allocation_zoned() for further extension. While at -it, optimize the if-branch a bit. - -Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com> -Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com> -Reviewed-by: David Sterba <dsterba@suse.com> -Signed-off-by: David Sterba <dsterba@suse.com> -Stable-dep-of: 02444f2ac26e ("btrfs: zoned: optimize hint byte for zoned allocator") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/btrfs/extent-tree.c | 32 +++++++++++++++++++------------- - 1 file changed, 19 insertions(+), 13 deletions(-) - -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index 9c8b00a917bd..9307891b4a85 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -4301,6 +4301,24 @@ static int prepare_allocation_clustered(struct btrfs_fs_info *fs_info, - return 0; - } - -+static int prepare_allocation_zoned(struct btrfs_fs_info *fs_info, -+ struct find_free_extent_ctl *ffe_ctl) -+{ -+ if (ffe_ctl->for_treelog) { -+ spin_lock(&fs_info->treelog_bg_lock); -+ if (fs_info->treelog_bg) -+ ffe_ctl->hint_byte = fs_info->treelog_bg; -+ spin_unlock(&fs_info->treelog_bg_lock); -+ } else if (ffe_ctl->for_data_reloc) { -+ spin_lock(&fs_info->relocation_bg_lock); -+ if (fs_info->data_reloc_bg) -+ ffe_ctl->hint_byte = fs_info->data_reloc_bg; -+ spin_unlock(&fs_info->relocation_bg_lock); -+ } -+ -+ return 0; -+} -+ - static int prepare_allocation(struct btrfs_fs_info *fs_info, - struct find_free_extent_ctl *ffe_ctl, - struct btrfs_space_info *space_info, -@@ -4311,19 +4329,7 @@ static int prepare_allocation(struct btrfs_fs_info *fs_info, - return prepare_allocation_clustered(fs_info, ffe_ctl, - space_info, ins); - case BTRFS_EXTENT_ALLOC_ZONED: -- if (ffe_ctl->for_treelog) { -- spin_lock(&fs_info->treelog_bg_lock); -- if (fs_info->treelog_bg) -- ffe_ctl->hint_byte = fs_info->treelog_bg; -- spin_unlock(&fs_info->treelog_bg_lock); -- } -- if (ffe_ctl->for_data_reloc) { -- spin_lock(&fs_info->relocation_bg_lock); -- if (fs_info->data_reloc_bg) -- ffe_ctl->hint_byte = fs_info->data_reloc_bg; -- spin_unlock(&fs_info->relocation_bg_lock); -- } -- return 0; -+ return prepare_allocation_zoned(fs_info, ffe_ctl); - default: - BUG(); - } --- -2.43.2 - -From 6f64fb8ed7b00fe806d683c02ea0f91cc47a235c Mon Sep 17 00:00:00 2001 -From: Naohiro Aota <naohiro.aota@wdc.com> -Date: Tue, 19 Dec 2023 01:02:29 +0900 -Subject: [PATCH 0958/1501] btrfs: zoned: optimize hint byte for zoned - allocator -Content-Length: 2022 -Lines: 55 - -[ Upstream commit 02444f2ac26eae6385a65fcd66915084d15dffba ] - -Writing sequentially to a huge file on btrfs on a SMR HDD revealed a -decline of the performance (220 MiB/s to 30 MiB/s after 500 minutes). - -The performance goes down because of increased latency of the extent -allocation, which is induced by a traversing of a lot of full block groups. - -So, this patch optimizes the ffe_ctl->hint_byte by choosing a block group -with sufficient size from the active block group list, which does not -contain full block groups. - -After applying the patch, the performance is maintained well. - -Fixes: 2eda57089ea3 ("btrfs: zoned: implement sequential extent allocation") -CC: stable@vger.kernel.org # 5.15+ -Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com> -Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com> -Signed-off-by: David Sterba <dsterba@suse.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/btrfs/extent-tree.c | 18 ++++++++++++++++++ - 1 file changed, 18 insertions(+) - -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index 9307891b4a85..31d64812bb60 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -4314,6 +4314,24 @@ static int prepare_allocation_zoned(struct btrfs_fs_info *fs_info, - if (fs_info->data_reloc_bg) - ffe_ctl->hint_byte = fs_info->data_reloc_bg; - spin_unlock(&fs_info->relocation_bg_lock); -+ } else if (ffe_ctl->flags & BTRFS_BLOCK_GROUP_DATA) { -+ struct btrfs_block_group *block_group; -+ -+ spin_lock(&fs_info->zone_active_bgs_lock); -+ list_for_each_entry(block_group, &fs_info->zone_active_bgs, active_bg_list) { -+ /* -+ * No lock is OK here because avail is monotinically -+ * decreasing, and this is just a hint. -+ */ -+ u64 avail = block_group->zone_capacity - block_group->alloc_offset; -+ -+ if (block_group_bits(block_group, ffe_ctl->flags) && -+ avail >= ffe_ctl->num_bytes) { -+ ffe_ctl->hint_byte = block_group->start; -+ break; -+ } -+ } -+ spin_unlock(&fs_info->zone_active_bgs_lock); - } - - return 0; --- -2.43.2 - -From 839895c804416ff39d726c919bcdc37eb6a4e630 Mon Sep 17 00:00:00 2001 -From: Samson Tam <samson.tam@amd.com> -Date: Tue, 28 Nov 2023 16:53:12 -0500 -Subject: [PATCH 0959/1501] drm/amd/display: do not send commands to DMUB if - DMUB is inactive from S3 -Content-Length: 6586 -Lines: 179 - -[ Upstream commit 0f657938e4345a77be871d906f3e0de3c58a7a49 ] - -[Why] -On resume from S3, may get apply_idle_optimizations call while DMUB -is inactive which will just time out. - -[How] -Set and track power state in dmub_srv and check power state before -sending commands to DMUB. Add interface in both dmub_srv and -dc_dmub_srv - -Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> -Acked-by: Wayne Lin <wayne.lin@amd.com> -Signed-off-by: Samson Tam <samson.tam@amd.com> -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Stable-dep-of: 8892780834ae ("drm/amd/display: Wake DMCUB before sending a command") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +++ - drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 14 +++++++++++++ - drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h | 2 ++ - drivers/gpu/drm/amd/display/dmub/dmub_srv.h | 21 +++++++++++++++++++ - .../gpu/drm/amd/display/dmub/src/dmub_srv.c | 15 +++++++++++++ - 5 files changed, 55 insertions(+) - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index a9bd020b165a..4d534ac18356 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -2656,6 +2656,7 @@ static int dm_suspend(void *handle) - hpd_rx_irq_work_suspend(dm); - - dc_set_power_state(dm->dc, DC_ACPI_CM_POWER_STATE_D3); -+ dc_dmub_srv_set_power_state(dm->dc->ctx->dmub_srv, DC_ACPI_CM_POWER_STATE_D3); - - return 0; - } -@@ -2851,6 +2852,7 @@ static int dm_resume(void *handle) - if (r) - DRM_ERROR("DMUB interface failed to initialize: status=%d\n", r); - -+ dc_dmub_srv_set_power_state(dm->dc->ctx->dmub_srv, DC_ACPI_CM_POWER_STATE_D0); - dc_set_power_state(dm->dc, DC_ACPI_CM_POWER_STATE_D0); - - dc_resume(dm->dc); -@@ -2901,6 +2903,7 @@ static int dm_resume(void *handle) - } - - /* power on hardware */ -+ dc_dmub_srv_set_power_state(dm->dc->ctx->dmub_srv, DC_ACPI_CM_POWER_STATE_D0); - dc_set_power_state(dm->dc, DC_ACPI_CM_POWER_STATE_D0); - - /* program HPD filter */ -diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c -index 0e07699c1e83..0c963dfd6061 100644 ---- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c -+++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c -@@ -1251,3 +1251,17 @@ void dc_dmub_srv_exit_low_power_state(const struct dc *dc) - ASSERT(0); - } - -+void dc_dmub_srv_set_power_state(struct dc_dmub_srv *dc_dmub_srv, enum dc_acpi_cm_power_state powerState) -+{ -+ struct dmub_srv *dmub; -+ -+ if (!dc_dmub_srv) -+ return; -+ -+ dmub = dc_dmub_srv->dmub; -+ -+ if (powerState == DC_ACPI_CM_POWER_STATE_D0) -+ dmub_srv_set_power_state(dmub, DMUB_POWER_STATE_D0); -+ else -+ dmub_srv_set_power_state(dmub, DMUB_POWER_STATE_D3); -+} -diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h -index d4a60f53faab..c25ce7546f71 100644 ---- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h -+++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h -@@ -102,4 +102,6 @@ void dc_dmub_srv_subvp_save_surf_addr(const struct dc_dmub_srv *dc_dmub_srv, con - bool dc_dmub_srv_is_hw_pwr_up(struct dc_dmub_srv *dc_dmub_srv, bool wait); - void dc_dmub_srv_notify_idle(const struct dc *dc, bool allow_idle); - void dc_dmub_srv_exit_low_power_state(const struct dc *dc); -+ -+void dc_dmub_srv_set_power_state(struct dc_dmub_srv *dc_dmub_srv, enum dc_acpi_cm_power_state powerState); - #endif /* _DMUB_DC_SRV_H_ */ -diff --git a/drivers/gpu/drm/amd/display/dmub/dmub_srv.h b/drivers/gpu/drm/amd/display/dmub/dmub_srv.h -index df63aa8f01e9..d1a4ed6f5916 100644 ---- a/drivers/gpu/drm/amd/display/dmub/dmub_srv.h -+++ b/drivers/gpu/drm/amd/display/dmub/dmub_srv.h -@@ -150,6 +150,13 @@ enum dmub_memory_access_type { - DMUB_MEMORY_ACCESS_DMA - }; - -+/* enum dmub_power_state type - to track DC power state in dmub_srv */ -+enum dmub_srv_power_state_type { -+ DMUB_POWER_STATE_UNDEFINED = 0, -+ DMUB_POWER_STATE_D0 = 1, -+ DMUB_POWER_STATE_D3 = 8 -+}; -+ - /** - * struct dmub_region - dmub hw memory region - * @base: base address for region, must be 256 byte aligned -@@ -485,6 +492,8 @@ struct dmub_srv { - /* Feature capabilities reported by fw */ - struct dmub_feature_caps feature_caps; - struct dmub_visual_confirm_color visual_confirm_color; -+ -+ enum dmub_srv_power_state_type power_state; - }; - - /** -@@ -889,6 +898,18 @@ enum dmub_status dmub_srv_clear_inbox0_ack(struct dmub_srv *dmub); - */ - void dmub_srv_subvp_save_surf_addr(struct dmub_srv *dmub, const struct dc_plane_address *addr, uint8_t subvp_index); - -+/** -+ * dmub_srv_set_power_state() - Track DC power state in dmub_srv -+ * @dmub: The dmub service -+ * @power_state: DC power state setting -+ * -+ * Store DC power state in dmub_srv. If dmub_srv is in D3, then don't send messages to DMUB -+ * -+ * Return: -+ * void -+ */ -+void dmub_srv_set_power_state(struct dmub_srv *dmub, enum dmub_srv_power_state_type dmub_srv_power_state); -+ - #if defined(__cplusplus) - } - #endif -diff --git a/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c b/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c -index 38360adc53d9..59d4e64845ca 100644 ---- a/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c -+++ b/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c -@@ -713,6 +713,7 @@ enum dmub_status dmub_srv_hw_init(struct dmub_srv *dmub, - dmub->hw_funcs.reset_release(dmub); - - dmub->hw_init = true; -+ dmub->power_state = DMUB_POWER_STATE_D0; - - return DMUB_STATUS_OK; - } -@@ -766,6 +767,9 @@ enum dmub_status dmub_srv_cmd_queue(struct dmub_srv *dmub, - if (!dmub->hw_init) - return DMUB_STATUS_INVALID; - -+ if (dmub->power_state != DMUB_POWER_STATE_D0) -+ return DMUB_STATUS_INVALID; -+ - if (dmub->inbox1_rb.rptr > dmub->inbox1_rb.capacity || - dmub->inbox1_rb.wrpt > dmub->inbox1_rb.capacity) { - return DMUB_STATUS_HW_FAILURE; -@@ -784,6 +788,9 @@ enum dmub_status dmub_srv_cmd_execute(struct dmub_srv *dmub) - if (!dmub->hw_init) - return DMUB_STATUS_INVALID; - -+ if (dmub->power_state != DMUB_POWER_STATE_D0) -+ return DMUB_STATUS_INVALID; -+ - /** - * Read back all the queued commands to ensure that they've - * been flushed to framebuffer memory. Otherwise DMCUB might -@@ -1100,3 +1107,11 @@ void dmub_srv_subvp_save_surf_addr(struct dmub_srv *dmub, const struct dc_plane_ - subvp_index); - } - } -+ -+void dmub_srv_set_power_state(struct dmub_srv *dmub, enum dmub_srv_power_state_type dmub_srv_power_state) -+{ -+ if (!dmub || !dmub->hw_init) -+ return; -+ -+ dmub->power_state = dmub_srv_power_state; -+} --- -2.43.2 - -From 820c3870c491946a78950cdf961bf40e28c1025f Mon Sep 17 00:00:00 2001 -From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> -Date: Mon, 4 Dec 2023 14:10:05 -0500 -Subject: [PATCH 0960/1501] drm/amd/display: Refactor DMCUB enter/exit idle - interface -Content-Length: 7397 -Lines: 197 - -[ Upstream commit 8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa ] - -[Why] -We can hang in place trying to send commands when the DMCUB isn't -powered on. - -[How] -We need to exit out of the idle state prior to sending a command, -but the process that performs the exit also invokes a command itself. - -Fixing this issue involves the following: - -1. Using a software state to track whether or not we need to start - the process to exit idle or notify idle. - -It's possible for the hardware to have exited an idle state without -driver knowledge, but entering one is always restricted to a driver -allow - which makes the SW state vs HW state mismatch issue purely one -of optimization, which should seldomly be hit, if at all. - -2. Refactor any instances of exit/notify idle to use a single wrapper - that maintains this SW state. - -This works simialr to dc_allow_idle_optimizations, but works at the -DMCUB level and makes sure the state is marked prior to any notify/exit -idle so we don't enter an infinite loop. - -3. Make sure we exit out of idle prior to sending any commands or - waiting for DMCUB idle. - -This patch takes care of 1/2. A future patch will take care of wrapping -DMCUB command submission with calls to this new interface. - -Cc: Mario Limonciello <mario.limonciello@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org -Reviewed-by: Hansen Dsouza <hansen.dsouza@amd.com> -Acked-by: Wayne Lin <wayne.lin@amd.com> -Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Stable-dep-of: 8892780834ae ("drm/amd/display: Wake DMCUB before sending a command") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 +- - drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 37 ++++++++++++++++++- - drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h | 6 ++- - .../amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 8 +--- - 4 files changed, 43 insertions(+), 12 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 4d534ac18356..292335b7145c 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -2825,7 +2825,7 @@ static int dm_resume(void *handle) - bool need_hotplug = false; - - if (dm->dc->caps.ips_support) { -- dc_dmub_srv_exit_low_power_state(dm->dc); -+ dc_dmub_srv_apply_idle_power_optimizations(dm->dc, false); - } - - if (amdgpu_in_reset(adev)) { -@@ -8771,7 +8771,7 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state) - if (new_con_state->crtc && - new_con_state->crtc->state->active && - drm_atomic_crtc_needs_modeset(new_con_state->crtc->state)) { -- dc_dmub_srv_exit_low_power_state(dm->dc); -+ dc_dmub_srv_apply_idle_power_optimizations(dm->dc, false); - break; - } - } -diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c -index 0c963dfd6061..9488f739737e 100644 ---- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c -+++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c -@@ -1143,6 +1143,9 @@ bool dc_dmub_srv_is_hw_pwr_up(struct dc_dmub_srv *dc_dmub_srv, bool wait) - struct dc_context *dc_ctx = dc_dmub_srv->ctx; - enum dmub_status status; - -+ if (!dc_dmub_srv || !dc_dmub_srv->dmub) -+ return true; -+ - if (dc_dmub_srv->ctx->dc->debug.dmcub_emulation) - return true; - -@@ -1158,7 +1161,7 @@ bool dc_dmub_srv_is_hw_pwr_up(struct dc_dmub_srv *dc_dmub_srv, bool wait) - return true; - } - --void dc_dmub_srv_notify_idle(const struct dc *dc, bool allow_idle) -+static void dc_dmub_srv_notify_idle(const struct dc *dc, bool allow_idle) - { - union dmub_rb_cmd cmd = {0}; - -@@ -1182,7 +1185,7 @@ void dc_dmub_srv_notify_idle(const struct dc *dc, bool allow_idle) - dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - --void dc_dmub_srv_exit_low_power_state(const struct dc *dc) -+static void dc_dmub_srv_exit_low_power_state(const struct dc *dc) - { - const uint32_t max_num_polls = 10000; - uint32_t allow_state = 0; -@@ -1195,6 +1198,9 @@ void dc_dmub_srv_exit_low_power_state(const struct dc *dc) - if (!dc->idle_optimizations_allowed) - return; - -+ if (!dc->ctx->dmub_srv || !dc->ctx->dmub_srv->dmub) -+ return; -+ - if (dc->hwss.get_idle_state && - dc->hwss.set_idle_state && - dc->clk_mgr->funcs->exit_low_power_state) { -@@ -1265,3 +1271,30 @@ void dc_dmub_srv_set_power_state(struct dc_dmub_srv *dc_dmub_srv, enum dc_acpi_c - else - dmub_srv_set_power_state(dmub, DMUB_POWER_STATE_D3); - } -+ -+void dc_dmub_srv_apply_idle_power_optimizations(const struct dc *dc, bool allow_idle) -+{ -+ struct dc_dmub_srv *dc_dmub_srv = dc->ctx->dmub_srv; -+ -+ if (!dc_dmub_srv || !dc_dmub_srv->dmub) -+ return; -+ -+ if (dc_dmub_srv->idle_allowed == allow_idle) -+ return; -+ -+ /* -+ * Entering a low power state requires a driver notification. -+ * Powering up the hardware requires notifying PMFW and DMCUB. -+ * Clearing the driver idle allow requires a DMCUB command. -+ * DMCUB commands requires the DMCUB to be powered up and restored. -+ * -+ * Exit out early to prevent an infinite loop of DMCUB commands -+ * triggering exit low power - use software state to track this. -+ */ -+ dc_dmub_srv->idle_allowed = allow_idle; -+ -+ if (!allow_idle) -+ dc_dmub_srv_exit_low_power_state(dc); -+ else -+ dc_dmub_srv_notify_idle(dc, allow_idle); -+} -diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h -index c25ce7546f71..b63cba6235fc 100644 ---- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h -+++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h -@@ -50,6 +50,8 @@ struct dc_dmub_srv { - - struct dc_context *ctx; - void *dm; -+ -+ bool idle_allowed; - }; - - void dc_dmub_srv_wait_idle(struct dc_dmub_srv *dc_dmub_srv); -@@ -100,8 +102,8 @@ void dc_dmub_srv_enable_dpia_trace(const struct dc *dc); - void dc_dmub_srv_subvp_save_surf_addr(const struct dc_dmub_srv *dc_dmub_srv, const struct dc_plane_address *addr, uint8_t subvp_index); - - bool dc_dmub_srv_is_hw_pwr_up(struct dc_dmub_srv *dc_dmub_srv, bool wait); --void dc_dmub_srv_notify_idle(const struct dc *dc, bool allow_idle); --void dc_dmub_srv_exit_low_power_state(const struct dc *dc); -+ -+void dc_dmub_srv_apply_idle_power_optimizations(const struct dc *dc, bool allow_idle); - - void dc_dmub_srv_set_power_state(struct dc_dmub_srv *dc_dmub_srv, enum dc_acpi_cm_power_state powerState); - #endif /* _DMUB_DC_SRV_H_ */ -diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c -index 5a8258287438..cf26d2ad4008 100644 ---- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c -@@ -671,11 +671,7 @@ bool dcn35_apply_idle_power_optimizations(struct dc *dc, bool enable) - } - - // TODO: review other cases when idle optimization is allowed -- -- if (!enable) -- dc_dmub_srv_exit_low_power_state(dc); -- else -- dc_dmub_srv_notify_idle(dc, enable); -+ dc_dmub_srv_apply_idle_power_optimizations(dc, enable); - - return true; - } -@@ -685,7 +681,7 @@ void dcn35_z10_restore(const struct dc *dc) - if (dc->debug.disable_z10) - return; - -- dc_dmub_srv_exit_low_power_state(dc); -+ dc_dmub_srv_apply_idle_power_optimizations(dc, false); - - dcn31_z10_restore(dc); - } --- -2.43.2 - -From 303197775a97416b62d4da69280d0c120a20e009 Mon Sep 17 00:00:00 2001 -From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> -Date: Mon, 4 Dec 2023 16:35:04 -0500 -Subject: [PATCH 0961/1501] drm/amd/display: Wake DMCUB before sending a - command -Content-Length: 38571 -Lines: 818 - -[ Upstream commit 8892780834ae294bc3697c7d0e056d7743900b39 ] - -[Why] -We can hang in place trying to send commands when the DMCUB isn't -powered on. - -[How] -For functions that execute within a DC context or DC lock we can -wrap the direct calls to dm_execute_dmub_cmd/list with code that -exits idle power optimizations and reallows once we're done with -the command submission on success. - -For DM direct submissions the DM will need to manage the enter/exit -sequencing manually. - -We cannot invoke a DMCUB command directly within the DM execution -helper or we can deadlock. - -Cc: Mario Limonciello <mario.limonciello@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org -Reviewed-by: Hansen Dsouza <hansen.dsouza@amd.com> -Acked-by: Wayne Lin <wayne.lin@amd.com> -Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- - .../drm/amd/display/dc/bios/command_table2.c | 12 ++--- - .../display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c | 2 +- - .../dc/clk_mgr/dcn314/dcn314_clk_mgr.c | 2 +- - .../dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 2 +- - .../dc/clk_mgr/dcn316/dcn316_clk_mgr.c | 2 +- - .../display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 2 +- - drivers/gpu/drm/amd/display/dc/core/dc.c | 12 ++--- - .../drm/amd/display/dc/core/dc_hw_sequencer.c | 2 +- - drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 53 ++++++++++++++++--- - drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h | 40 ++++++++++++++ - drivers/gpu/drm/amd/display/dc/dc_helper.c | 6 +-- - .../gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c | 14 ++--- - .../drm/amd/display/dc/dce/dmub_hw_lock_mgr.c | 2 +- - .../gpu/drm/amd/display/dc/dce/dmub_outbox.c | 2 +- - drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c | 14 ++--- - .../gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c | 2 +- - .../display/dc/dcn31/dcn31_dio_link_encoder.c | 4 +- - .../amd/display/dc/dcn31/dcn31_panel_cntl.c | 4 +- - .../amd/display/dc/hwss/dcn21/dcn21_hwseq.c | 4 +- - .../amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 8 +-- - .../amd/display/dc/hwss/dcn31/dcn31_hwseq.c | 4 +- - .../amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 6 +-- - .../dc/link/protocols/link_dp_capability.c | 2 +- - .../display/dc/link/protocols/link_dp_dpia.c | 3 +- - 25 files changed, 143 insertions(+), 63 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 292335b7145c..9dbbaeb8c6cf 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -10620,7 +10620,7 @@ static bool dm_edid_parser_send_cea(struct amdgpu_display_manager *dm, - input->cea_total_length = total_length; - memcpy(input->payload, data, length); - -- res = dm_execute_dmub_cmd(dm->dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY); -+ res = dc_wake_and_execute_dmub_cmd(dm->dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY); - if (!res) { - DRM_ERROR("EDID CEA parser failed\n"); - return false; -diff --git a/drivers/gpu/drm/amd/display/dc/bios/command_table2.c b/drivers/gpu/drm/amd/display/dc/bios/command_table2.c -index ab0adabf9dd4..293a919d605d 100644 ---- a/drivers/gpu/drm/amd/display/dc/bios/command_table2.c -+++ b/drivers/gpu/drm/amd/display/dc/bios/command_table2.c -@@ -123,7 +123,7 @@ static void encoder_control_dmcub( - sizeof(cmd.digx_encoder_control.header); - cmd.digx_encoder_control.encoder_control.dig.stream_param = *dig; - -- dm_execute_dmub_cmd(dmcub->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dmcub->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - static enum bp_result encoder_control_digx_v1_5( -@@ -259,7 +259,7 @@ static void transmitter_control_dmcub( - sizeof(cmd.dig1_transmitter_control.header); - cmd.dig1_transmitter_control.transmitter_control.dig = *dig; - -- dm_execute_dmub_cmd(dmcub->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dmcub->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - static enum bp_result transmitter_control_v1_6( -@@ -321,7 +321,7 @@ static void transmitter_control_dmcub_v1_7( - sizeof(cmd.dig1_transmitter_control.header); - cmd.dig1_transmitter_control.transmitter_control.dig_v1_7 = *dig; - -- dm_execute_dmub_cmd(dmcub->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dmcub->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - static enum bp_result transmitter_control_v1_7( -@@ -429,7 +429,7 @@ static void set_pixel_clock_dmcub( - sizeof(cmd.set_pixel_clock.header); - cmd.set_pixel_clock.pixel_clock.clk = *clk; - -- dm_execute_dmub_cmd(dmcub->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dmcub->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - static enum bp_result set_pixel_clock_v7( -@@ -796,7 +796,7 @@ static void enable_disp_power_gating_dmcub( - sizeof(cmd.enable_disp_power_gating.header); - cmd.enable_disp_power_gating.power_gating.pwr = *pwr; - -- dm_execute_dmub_cmd(dmcub->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dmcub->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - static enum bp_result enable_disp_power_gating_v2_1( -@@ -1006,7 +1006,7 @@ static void enable_lvtma_control_dmcub( - pwrseq_instance; - cmd.lvtma_control.data.bypass_panel_control_wait = - bypass_panel_control_wait; -- dm_execute_dmub_cmd(dmcub->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dmcub->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - static enum bp_result enable_lvtma_control( -diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c -index 3db4ef564b99..ce1386e22576 100644 ---- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c -@@ -253,7 +253,7 @@ void dcn31_update_clocks(struct clk_mgr *clk_mgr_base, - cmd.notify_clocks.clocks.dispclk_khz = clk_mgr_base->clks.dispclk_khz; - cmd.notify_clocks.clocks.dppclk_khz = clk_mgr_base->clks.dppclk_khz; - -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - static int get_vco_frequency_from_reg(struct clk_mgr_internal *clk_mgr) -diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c -index 2618504e260e..59c2a3545db3 100644 ---- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c -@@ -281,7 +281,7 @@ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base, - cmd.notify_clocks.clocks.dispclk_khz = clk_mgr_base->clks.dispclk_khz; - cmd.notify_clocks.clocks.dppclk_khz = clk_mgr_base->clks.dppclk_khz; - -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - static int get_vco_frequency_from_reg(struct clk_mgr_internal *clk_mgr) -diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c -index 8776055bbeaa..644da4637320 100644 ---- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c -@@ -232,7 +232,7 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base, - cmd.notify_clocks.clocks.dispclk_khz = clk_mgr_base->clks.dispclk_khz; - cmd.notify_clocks.clocks.dppclk_khz = clk_mgr_base->clks.dppclk_khz; - -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - static void dcn315_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass, -diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c -index 09151cc56ce4..12f3e8aa46d8 100644 ---- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c -@@ -239,7 +239,7 @@ static void dcn316_update_clocks(struct clk_mgr *clk_mgr_base, - cmd.notify_clocks.clocks.dispclk_khz = clk_mgr_base->clks.dispclk_khz; - cmd.notify_clocks.clocks.dppclk_khz = clk_mgr_base->clks.dppclk_khz; - -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - static void dcn316_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass, -diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c -index d5fde7d23fbf..45ede6440a79 100644 ---- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c -@@ -349,7 +349,7 @@ void dcn35_update_clocks(struct clk_mgr *clk_mgr_base, - cmd.notify_clocks.clocks.dispclk_khz = clk_mgr_base->clks.dispclk_khz; - cmd.notify_clocks.clocks.dppclk_khz = clk_mgr_base->clks.dppclk_khz; - -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - static int get_vco_frequency_from_reg(struct clk_mgr_internal *clk_mgr) -diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c -index 5c1185206645..c535ddb45a36 100644 ---- a/drivers/gpu/drm/amd/display/dc/core/dc.c -+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c -@@ -519,7 +519,7 @@ dc_stream_forward_dmub_crc_window(struct dc_dmub_srv *dmub_srv, - cmd.secure_display.roi_info.y_end = rect->y + rect->height; - } - -- dm_execute_dmub_cmd(dmub_srv->ctx, &cmd, DM_DMUB_WAIT_TYPE_NO_WAIT); -+ dc_wake_and_execute_dmub_cmd(dmub_srv->ctx, &cmd, DM_DMUB_WAIT_TYPE_NO_WAIT); - } - - static inline void -@@ -3386,7 +3386,7 @@ void dc_dmub_update_dirty_rect(struct dc *dc, - - update_dirty_rect->panel_inst = panel_inst; - update_dirty_rect->pipe_idx = j; -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_NO_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_NO_WAIT); - } - } - } -@@ -5213,7 +5213,7 @@ bool dc_process_dmub_aux_transfer_async(struct dc *dc, - ); - } - -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - - return true; - } -@@ -5267,7 +5267,7 @@ bool dc_process_dmub_set_config_async(struct dc *dc, - cmd.set_config_access.set_config_control.cmd_pkt.msg_type = payload->msg_type; - cmd.set_config_access.set_config_control.cmd_pkt.msg_data = payload->msg_data; - -- if (!dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY)) { -+ if (!dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY)) { - /* command is not processed by dmub */ - notify->sc_status = SET_CONFIG_UNKNOWN_ERROR; - return is_cmd_complete; -@@ -5310,7 +5310,7 @@ enum dc_status dc_process_dmub_set_mst_slots(const struct dc *dc, - cmd.set_mst_alloc_slots.mst_slots_control.instance = dc->links[link_index]->ddc_hw_inst; - cmd.set_mst_alloc_slots.mst_slots_control.mst_alloc_slots = mst_alloc_slots; - -- if (!dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY)) -+ if (!dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY)) - /* command is not processed by dmub */ - return DC_ERROR_UNEXPECTED; - -@@ -5348,7 +5348,7 @@ void dc_process_dmub_dpia_hpd_int_enable(const struct dc *dc, - cmd.dpia_hpd_int_enable.header.type = DMUB_CMD__DPIA_HPD_INT_ENABLE; - cmd.dpia_hpd_int_enable.enable = hpd_int_enable; - -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - - DC_LOG_DEBUG("%s: hpd_int_enable(%d)\n", __func__, hpd_int_enable); - } -diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c -index fe07160932d6..fc18b9dc946f 100644 ---- a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c -+++ b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c -@@ -724,7 +724,7 @@ void hwss_send_dmcub_cmd(union block_sequence_params *params) - union dmub_rb_cmd *cmd = params->send_dmcub_cmd_params.cmd; - enum dm_dmub_wait_type wait_type = params->send_dmcub_cmd_params.wait_type; - -- dm_execute_dmub_cmd(ctx, cmd, wait_type); -+ dc_wake_and_execute_dmub_cmd(ctx, cmd, wait_type); - } - - void hwss_program_manual_trigger(union block_sequence_params *params) -diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c -index 9488f739737e..50f1e6d5321e 100644 ---- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c -+++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c -@@ -341,7 +341,7 @@ void dc_dmub_srv_drr_update_cmd(struct dc *dc, uint32_t tg_inst, uint32_t vtotal - cmd.drr_update.header.payload_bytes = sizeof(cmd.drr_update) - sizeof(cmd.drr_update.header); - - // Send the command to the DMCUB. -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - void dc_dmub_srv_set_drr_manual_trigger_cmd(struct dc *dc, uint32_t tg_inst) -@@ -355,7 +355,7 @@ void dc_dmub_srv_set_drr_manual_trigger_cmd(struct dc *dc, uint32_t tg_inst) - cmd.drr_update.header.payload_bytes = sizeof(cmd.drr_update) - sizeof(cmd.drr_update.header); - - // Send the command to the DMCUB. -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - static uint8_t dc_dmub_srv_get_pipes_for_stream(struct dc *dc, struct dc_stream_state *stream) -@@ -448,7 +448,7 @@ bool dc_dmub_srv_p_state_delegate(struct dc *dc, bool should_manage_pstate, stru - sizeof(cmd.fw_assisted_mclk_switch) - sizeof(cmd.fw_assisted_mclk_switch.header); - - // Send the command to the DMCUB. -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - - return true; - } -@@ -469,7 +469,7 @@ void dc_dmub_srv_query_caps_cmd(struct dc_dmub_srv *dc_dmub_srv) - cmd.query_feature_caps.header.payload_bytes = sizeof(struct dmub_cmd_query_feature_caps_data); - - /* If command was processed, copy feature caps to dmub srv */ -- if (dm_execute_dmub_cmd(dc_dmub_srv->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY) && -+ if (dc_wake_and_execute_dmub_cmd(dc_dmub_srv->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY) && - cmd.query_feature_caps.header.ret_status == 0) { - memcpy(&dc_dmub_srv->dmub->feature_caps, - &cmd.query_feature_caps.query_feature_caps_data, -@@ -494,7 +494,7 @@ void dc_dmub_srv_get_visual_confirm_color_cmd(struct dc *dc, struct pipe_ctx *pi - cmd.visual_confirm_color.visual_confirm_color_data.visual_confirm_color.panel_inst = panel_inst; - - // If command was processed, copy feature caps to dmub srv -- if (dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY) && -+ if (dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY) && - cmd.visual_confirm_color.header.ret_status == 0) { - memcpy(&dc->ctx->dmub_srv->dmub->visual_confirm_color, - &cmd.visual_confirm_color.visual_confirm_color_data, -@@ -856,7 +856,7 @@ void dc_dmub_setup_subvp_dmub_command(struct dc *dc, - cmd.fw_assisted_mclk_switch_v2.config_data.watermark_a_cache = wm_val_refclk < 0xFFFF ? wm_val_refclk : 0xFFFF; - } - -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - bool dc_dmub_srv_get_diagnostic_data(struct dc_dmub_srv *dc_dmub_srv, struct dmub_diagnostic_data *diag_data) -@@ -1093,7 +1093,7 @@ void dc_send_update_cursor_info_to_dmu( - pipe_idx, pCtx->plane_res.hubp, pCtx->plane_res.dpp); - - /* Combine 2nd cmds update_curosr_info to DMU */ -- dm_execute_dmub_cmd_list(pCtx->stream->ctx, 2, cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd_list(pCtx->stream->ctx, 2, cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - } - -@@ -1182,6 +1182,7 @@ static void dc_dmub_srv_notify_idle(const struct dc *dc, bool allow_idle) - dc->hwss.set_idle_state(dc, true); - } - -+ /* NOTE: This does not use the "wake" interface since this is part of the wake path. */ - dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - -@@ -1298,3 +1299,41 @@ void dc_dmub_srv_apply_idle_power_optimizations(const struct dc *dc, bool allow_ - else - dc_dmub_srv_notify_idle(dc, allow_idle); - } -+ -+bool dc_wake_and_execute_dmub_cmd(const struct dc_context *ctx, union dmub_rb_cmd *cmd, -+ enum dm_dmub_wait_type wait_type) -+{ -+ return dc_wake_and_execute_dmub_cmd_list(ctx, 1, cmd, wait_type); -+} -+ -+bool dc_wake_and_execute_dmub_cmd_list(const struct dc_context *ctx, unsigned int count, -+ union dmub_rb_cmd *cmd, enum dm_dmub_wait_type wait_type) -+{ -+ struct dc_dmub_srv *dc_dmub_srv = ctx->dmub_srv; -+ bool result = false, reallow_idle = false; -+ -+ if (!dc_dmub_srv || !dc_dmub_srv->dmub) -+ return false; -+ -+ if (count == 0) -+ return true; -+ -+ if (dc_dmub_srv->idle_allowed) { -+ dc_dmub_srv_apply_idle_power_optimizations(ctx->dc, false); -+ reallow_idle = true; -+ } -+ -+ /* -+ * These may have different implementations in DM, so ensure -+ * that we guide it to the expected helper. -+ */ -+ if (count > 1) -+ result = dm_execute_dmub_cmd_list(ctx, count, cmd, wait_type); -+ else -+ result = dm_execute_dmub_cmd(ctx, cmd, wait_type); -+ -+ if (result && reallow_idle) -+ dc_dmub_srv_apply_idle_power_optimizations(ctx->dc, true); -+ -+ return result; -+} -diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h -index b63cba6235fc..784ca3e44414 100644 ---- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h -+++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h -@@ -106,4 +106,44 @@ bool dc_dmub_srv_is_hw_pwr_up(struct dc_dmub_srv *dc_dmub_srv, bool wait); - void dc_dmub_srv_apply_idle_power_optimizations(const struct dc *dc, bool allow_idle); - - void dc_dmub_srv_set_power_state(struct dc_dmub_srv *dc_dmub_srv, enum dc_acpi_cm_power_state powerState); -+ -+/** -+ * dc_wake_and_execute_dmub_cmd() - Wrapper for DMUB command execution. -+ * -+ * Refer to dc_wake_and_execute_dmub_cmd_list() for usage and limitations, -+ * This function is a convenience wrapper for a single command execution. -+ * -+ * @ctx: DC context -+ * @cmd: The command to send/receive -+ * @wait_type: The wait behavior for the execution -+ * -+ * Return: true on command submission success, false otherwise -+ */ -+bool dc_wake_and_execute_dmub_cmd(const struct dc_context *ctx, union dmub_rb_cmd *cmd, -+ enum dm_dmub_wait_type wait_type); -+ -+/** -+ * dc_wake_and_execute_dmub_cmd_list() - Wrapper for DMUB command list execution. -+ * -+ * If the DMCUB hardware was asleep then it wakes the DMUB before -+ * executing the command and attempts to re-enter if the command -+ * submission was successful. -+ * -+ * This should be the preferred command submission interface provided -+ * the DC lock is acquired. -+ * -+ * Entry/exit out of idle power optimizations would need to be -+ * manually performed otherwise through dc_allow_idle_optimizations(). -+ * -+ * @ctx: DC context -+ * @count: Number of commands to send/receive -+ * @cmd: Array of commands to send -+ * @wait_type: The wait behavior for the execution -+ * -+ * Return: true on command submission success, false otherwise -+ */ -+bool dc_wake_and_execute_dmub_cmd_list(const struct dc_context *ctx, unsigned int count, -+ union dmub_rb_cmd *cmd, enum dm_dmub_wait_type wait_type); -+ -+ - #endif /* _DMUB_DC_SRV_H_ */ -diff --git a/drivers/gpu/drm/amd/display/dc/dc_helper.c b/drivers/gpu/drm/amd/display/dc/dc_helper.c -index cb6eaddab720..8f9a67825615 100644 ---- a/drivers/gpu/drm/amd/display/dc/dc_helper.c -+++ b/drivers/gpu/drm/amd/display/dc/dc_helper.c -@@ -50,7 +50,7 @@ static inline void submit_dmub_read_modify_write( - cmd_buf->header.payload_bytes = - sizeof(struct dmub_cmd_read_modify_write_sequence) * offload->reg_seq_count; - -- dm_execute_dmub_cmd(ctx, &offload->cmd_data, DM_DMUB_WAIT_TYPE_NO_WAIT); -+ dc_wake_and_execute_dmub_cmd(ctx, &offload->cmd_data, DM_DMUB_WAIT_TYPE_NO_WAIT); - - memset(cmd_buf, 0, sizeof(*cmd_buf)); - -@@ -67,7 +67,7 @@ static inline void submit_dmub_burst_write( - cmd_buf->header.payload_bytes = - sizeof(uint32_t) * offload->reg_seq_count; - -- dm_execute_dmub_cmd(ctx, &offload->cmd_data, DM_DMUB_WAIT_TYPE_NO_WAIT); -+ dc_wake_and_execute_dmub_cmd(ctx, &offload->cmd_data, DM_DMUB_WAIT_TYPE_NO_WAIT); - - memset(cmd_buf, 0, sizeof(*cmd_buf)); - -@@ -80,7 +80,7 @@ static inline void submit_dmub_reg_wait( - { - struct dmub_rb_cmd_reg_wait *cmd_buf = &offload->cmd_data.reg_wait; - -- dm_execute_dmub_cmd(ctx, &offload->cmd_data, DM_DMUB_WAIT_TYPE_NO_WAIT); -+ dc_wake_and_execute_dmub_cmd(ctx, &offload->cmd_data, DM_DMUB_WAIT_TYPE_NO_WAIT); - - memset(cmd_buf, 0, sizeof(*cmd_buf)); - offload->reg_seq_count = 0; -diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c -index 42c802afc468..4cff36351f40 100644 ---- a/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c -+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c -@@ -76,7 +76,7 @@ static void dmub_abm_enable_fractional_pwm(struct dc_context *dc) - cmd.abm_set_pwm_frac.abm_set_pwm_frac_data.panel_mask = panel_mask; - cmd.abm_set_pwm_frac.header.payload_bytes = sizeof(struct dmub_cmd_abm_set_pwm_frac_data); - -- dm_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - void dmub_abm_init(struct abm *abm, uint32_t backlight) -@@ -155,7 +155,7 @@ bool dmub_abm_set_level(struct abm *abm, uint32_t level, uint8_t panel_mask) - cmd.abm_set_level.abm_set_level_data.panel_mask = panel_mask; - cmd.abm_set_level.header.payload_bytes = sizeof(struct dmub_cmd_abm_set_level_data); - -- dm_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - - return true; - } -@@ -186,7 +186,7 @@ void dmub_abm_init_config(struct abm *abm, - - cmd.abm_init_config.header.payload_bytes = sizeof(struct dmub_cmd_abm_init_config_data); - -- dm_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - - } - -@@ -203,7 +203,7 @@ bool dmub_abm_set_pause(struct abm *abm, bool pause, unsigned int panel_inst, un - cmd.abm_pause.abm_pause_data.panel_mask = panel_mask; - cmd.abm_set_level.header.payload_bytes = sizeof(struct dmub_cmd_abm_pause_data); - -- dm_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - - return true; - } -@@ -246,7 +246,7 @@ bool dmub_abm_save_restore( - - cmd.abm_save_restore.header.payload_bytes = sizeof(struct dmub_rb_cmd_abm_save_restore); - -- dm_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - - // Copy iramtable data into local structure - memcpy((void *)pData, dc->dmub_srv->dmub->scratch_mem_fb.cpu_addr, bytes); -@@ -274,7 +274,7 @@ bool dmub_abm_set_pipe(struct abm *abm, - cmd.abm_set_pipe.abm_set_pipe_data.ramping_boundary = ramping_boundary; - cmd.abm_set_pipe.header.payload_bytes = sizeof(struct dmub_cmd_abm_set_pipe_data); - -- dm_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - - return true; - } -@@ -296,7 +296,7 @@ bool dmub_abm_set_backlight_level(struct abm *abm, - cmd.abm_set_backlight.abm_set_backlight_data.panel_mask = (0x01 << panel_inst); - cmd.abm_set_backlight.header.payload_bytes = sizeof(struct dmub_cmd_abm_set_backlight_data); - -- dm_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - - return true; - } -diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c -index 2aa0e01a6891..ba1fec3016d5 100644 ---- a/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c -@@ -47,7 +47,7 @@ void dmub_hw_lock_mgr_cmd(struct dc_dmub_srv *dmub_srv, - if (!lock) - cmd.lock_hw.lock_hw_data.should_release = 1; - -- dm_execute_dmub_cmd(dmub_srv->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dmub_srv->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - void dmub_hw_lock_mgr_inbox0_cmd(struct dc_dmub_srv *dmub_srv, -diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_outbox.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_outbox.c -index d8009b2dc56a..98a778996e1a 100644 ---- a/drivers/gpu/drm/amd/display/dc/dce/dmub_outbox.c -+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_outbox.c -@@ -48,5 +48,5 @@ void dmub_enable_outbox_notification(struct dc_dmub_srv *dmub_srv) - sizeof(cmd.outbox1_enable.header); - cmd.outbox1_enable.enable = true; - -- dm_execute_dmub_cmd(dmub_srv->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dmub_srv->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } -diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c -index 9d4170a356a2..3d7cef17f881 100644 ---- a/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c -+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c -@@ -171,7 +171,7 @@ static bool dmub_psr_set_version(struct dmub_psr *dmub, struct dc_stream_state * - cmd.psr_set_version.psr_set_version_data.panel_inst = panel_inst; - cmd.psr_set_version.header.payload_bytes = sizeof(struct dmub_cmd_psr_set_version_data); - -- dm_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - - return true; - } -@@ -199,7 +199,7 @@ static void dmub_psr_enable(struct dmub_psr *dmub, bool enable, bool wait, uint8 - - cmd.psr_enable.header.payload_bytes = 0; // Send header only - -- dm_execute_dmub_cmd(dc->dmub_srv->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->dmub_srv->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - - /* Below loops 1000 x 500us = 500 ms. - * Exit PSR may need to wait 1-2 frames to power up. Timeout after at -@@ -248,7 +248,7 @@ static void dmub_psr_set_level(struct dmub_psr *dmub, uint16_t psr_level, uint8_ - cmd.psr_set_level.psr_set_level_data.psr_level = psr_level; - cmd.psr_set_level.psr_set_level_data.cmd_version = DMUB_CMD_PSR_CONTROL_VERSION_1; - cmd.psr_set_level.psr_set_level_data.panel_inst = panel_inst; -- dm_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - /* -@@ -267,7 +267,7 @@ static void dmub_psr_set_sink_vtotal_in_psr_active(struct dmub_psr *dmub, - cmd.psr_set_vtotal.psr_set_vtotal_data.psr_vtotal_idle = psr_vtotal_idle; - cmd.psr_set_vtotal.psr_set_vtotal_data.psr_vtotal_su = psr_vtotal_su; - -- dm_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - /* -@@ -286,7 +286,7 @@ static void dmub_psr_set_power_opt(struct dmub_psr *dmub, unsigned int power_opt - cmd.psr_set_power_opt.psr_set_power_opt_data.power_opt = power_opt; - cmd.psr_set_power_opt.psr_set_power_opt_data.panel_inst = panel_inst; - -- dm_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - /* -@@ -423,7 +423,7 @@ static bool dmub_psr_copy_settings(struct dmub_psr *dmub, - copy_settings_data->relock_delay_frame_cnt = 2; - copy_settings_data->dsc_slice_height = psr_context->dsc_slice_height; - -- dm_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - - return true; - } -@@ -444,7 +444,7 @@ static void dmub_psr_force_static(struct dmub_psr *dmub, uint8_t panel_inst) - cmd.psr_force_static.header.sub_type = DMUB_CMD__PSR_FORCE_STATIC; - cmd.psr_enable.header.payload_bytes = 0; - -- dm_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - /* -diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c -index 68cad55c72ab..e13d69a22c1c 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c -@@ -691,7 +691,7 @@ static void dmcub_PLAT_54186_wa(struct hubp *hubp, - cmd.PLAT_54186_wa.flip.flip_params.vmid = flip_regs->vmid; - - PERF_TRACE(); // TODO: remove after performance is stable. -- dm_execute_dmub_cmd(hubp->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(hubp->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - PERF_TRACE(); // TODO: remove after performance is stable. - } - -diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c -index 4596f3bac1b4..26be5fee7411 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c -@@ -125,7 +125,7 @@ static bool query_dp_alt_from_dmub(struct link_encoder *enc, - cmd->query_dp_alt.header.payload_bytes = sizeof(cmd->query_dp_alt.data); - cmd->query_dp_alt.data.phy_id = phy_id_from_transmitter(enc10->base.transmitter); - -- if (!dm_execute_dmub_cmd(enc->ctx, cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY)) -+ if (!dc_wake_and_execute_dmub_cmd(enc->ctx, cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY)) - return false; - - return true; -@@ -436,7 +436,7 @@ static bool link_dpia_control(struct dc_context *dc_ctx, - - cmd.dig1_dpia_control.dpia_control = *dpia_control; - -- dm_execute_dmub_cmd(dc_ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc_ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - - return true; - } -diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_panel_cntl.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_panel_cntl.c -index d849b1eaa4a5..03248422d6ff 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_panel_cntl.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_panel_cntl.c -@@ -52,7 +52,7 @@ static bool dcn31_query_backlight_info(struct panel_cntl *panel_cntl, union dmub - cmd->panel_cntl.header.payload_bytes = sizeof(cmd->panel_cntl.data); - cmd->panel_cntl.data.pwrseq_inst = dcn31_panel_cntl->base.pwrseq_inst; - -- return dm_execute_dmub_cmd(dc_dmub_srv->ctx, cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY); -+ return dc_wake_and_execute_dmub_cmd(dc_dmub_srv->ctx, cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY); - } - - static uint32_t dcn31_get_16_bit_backlight_from_pwm(struct panel_cntl *panel_cntl) -@@ -85,7 +85,7 @@ static uint32_t dcn31_panel_cntl_hw_init(struct panel_cntl *panel_cntl) - panel_cntl->stored_backlight_registers.LVTMA_PWRSEQ_REF_DIV_BL_PWM_REF_DIV; - cmd.panel_cntl.data.bl_pwm_ref_div2 = - panel_cntl->stored_backlight_registers.PANEL_PWRSEQ_REF_DIV2; -- if (!dm_execute_dmub_cmd(dc_dmub_srv->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY)) -+ if (!dc_wake_and_execute_dmub_cmd(dc_dmub_srv->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY)) - return 0; - - panel_cntl->stored_backlight_registers.BL_PWM_CNTL = cmd.panel_cntl.data.bl_pwm_cntl; -diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c -index 08783ad097d2..8e88dcaf88f5 100644 ---- a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c -@@ -154,7 +154,7 @@ static bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, - cmd.abm_set_pipe.abm_set_pipe_data.ramping_boundary = ramping_boundary; - cmd.abm_set_pipe.header.payload_bytes = sizeof(struct dmub_cmd_abm_set_pipe_data); - -- dm_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - - return true; - } -@@ -173,7 +173,7 @@ static void dmub_abm_set_backlight(struct dc_context *dc, uint32_t backlight_pwm - cmd.abm_set_backlight.abm_set_backlight_data.panel_mask = (0x01 << panel_inst); - cmd.abm_set_backlight.header.payload_bytes = sizeof(struct dmub_cmd_abm_set_backlight_data); - -- dm_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - void dcn21_set_abm_immediate_disable(struct pipe_ctx *pipe_ctx) -diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c -index d71faf2ecd41..772dc0db916f 100644 ---- a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c -@@ -750,7 +750,7 @@ bool dcn30_apply_idle_power_optimizations(struct dc *dc, bool enable) - cmd.mall.header.sub_type = DMUB_CMD__MALL_ACTION_NO_DF_REQ; - cmd.mall.header.payload_bytes = sizeof(cmd.mall) - sizeof(cmd.mall.header); - -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_NO_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_NO_WAIT); - - return true; - } -@@ -872,7 +872,7 @@ bool dcn30_apply_idle_power_optimizations(struct dc *dc, bool enable) - cmd.mall.cursor_height = cursor_attr.height; - cmd.mall.cursor_pitch = cursor_attr.pitch; - -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - - /* Use copied cursor, and it's okay to not switch back */ - cursor_attr.address.quad_part = cmd.mall.cursor_copy_dst.quad_part; -@@ -888,7 +888,7 @@ bool dcn30_apply_idle_power_optimizations(struct dc *dc, bool enable) - cmd.mall.tmr_scale = tmr_scale; - cmd.mall.debug_bits = dc->debug.mall_error_as_fatal; - -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_NO_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_NO_WAIT); - - return true; - } -@@ -905,7 +905,7 @@ bool dcn30_apply_idle_power_optimizations(struct dc *dc, bool enable) - cmd.mall.header.payload_bytes = - sizeof(cmd.mall) - sizeof(cmd.mall.header); - -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - - return true; - } -diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c -index 97798cee876e..52656691ae48 100644 ---- a/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c -@@ -415,7 +415,7 @@ void dcn31_z10_save_init(struct dc *dc) - cmd.dcn_restore.header.type = DMUB_CMD__IDLE_OPT; - cmd.dcn_restore.header.sub_type = DMUB_CMD__IDLE_OPT_DCN_SAVE_INIT; - -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - void dcn31_z10_restore(const struct dc *dc) -@@ -433,7 +433,7 @@ void dcn31_z10_restore(const struct dc *dc) - cmd.dcn_restore.header.type = DMUB_CMD__IDLE_OPT; - cmd.dcn_restore.header.sub_type = DMUB_CMD__IDLE_OPT_DCN_RESTORE; - -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - } - - void dcn31_hubp_pg_control(struct dce_hwseq *hws, unsigned int hubp_inst, bool power_on) -diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c -index c1a9b746c43f..5bf9e7c1e052 100644 ---- a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c -@@ -277,7 +277,7 @@ bool dcn32_apply_idle_power_optimizations(struct dc *dc, bool enable) - cmd.cab.header.sub_type = DMUB_CMD__CAB_NO_DCN_REQ; - cmd.cab.header.payload_bytes = sizeof(cmd.cab) - sizeof(cmd.cab.header); - -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_NO_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_NO_WAIT); - - return true; - } -@@ -311,7 +311,7 @@ bool dcn32_apply_idle_power_optimizations(struct dc *dc, bool enable) - cmd.cab.header.payload_bytes = sizeof(cmd.cab) - sizeof(cmd.cab.header); - cmd.cab.cab_alloc_ways = (uint8_t)ways; - -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_NO_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_NO_WAIT); - - return true; - } -@@ -327,7 +327,7 @@ bool dcn32_apply_idle_power_optimizations(struct dc *dc, bool enable) - cmd.cab.header.payload_bytes = - sizeof(cmd.cab) - sizeof(cmd.cab.header); - -- dm_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); -+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); - - return true; - } -diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c -index db87aa7b5c90..2f11eaabbe5f 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c -+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c -@@ -1392,7 +1392,7 @@ static bool get_usbc_cable_id(struct dc_link *link, union dp_cable_id *cable_id) - cmd.cable_id.header.payload_bytes = sizeof(cmd.cable_id.data); - cmd.cable_id.data.input.phy_inst = resource_transmitter_to_phy_idx( - link->dc, link->link_enc->transmitter); -- if (dm_execute_dmub_cmd(link->dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY) && -+ if (dc_wake_and_execute_dmub_cmd(link->dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY) && - cmd.cable_id.header.ret_status == 1) { - cable_id->raw = cmd.cable_id.data.output_raw; - DC_LOG_DC("usbc_cable_id = %d.\n", cable_id->raw); -diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia.c -index 0bb749133909..982eda3c46f5 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia.c -+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia.c -@@ -90,7 +90,8 @@ bool dpia_query_hpd_status(struct dc_link *link) - cmd.query_hpd.data.ch_type = AUX_CHANNEL_DPIA; - - /* Return HPD status reported by DMUB if query successfully executed. */ -- if (dm_execute_dmub_cmd(dmub_srv->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY) && cmd.query_hpd.data.status == AUX_RET_SUCCESS) -+ if (dc_wake_and_execute_dmub_cmd(dmub_srv->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY) && -+ cmd.query_hpd.data.status == AUX_RET_SUCCESS) - is_hpd_high = cmd.query_hpd.data.result; - - DC_LOG_DEBUG("%s: link(%d) dpia(%d) cmd_status(%d) result(%d)\n", --- -2.43.2 - -From 2ef98c6d753a744e333b7e34b9cf687040fba57d Mon Sep 17 00:00:00 2001 -From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> -Date: Tue, 5 Dec 2023 11:22:56 -0500 -Subject: [PATCH 0962/1501] drm/amd/display: Wake DMCUB before executing GPINT - commands -Content-Length: 7743 -Lines: 208 - -[ Upstream commit e5ffd1263dd5b44929c676171802e7b6af483f21 ] - -[Why] -DMCUB can be in idle when we attempt to interface with the HW through -the GPINT mailbox resulting in a system hang. - -[How] -Add dc_wake_and_execute_gpint() to wrap the wake, execute, sleep -sequence. - -If the GPINT executes successfully then DMCUB will be put back into -sleep after the optional response is returned. - -It functions similar to the inbox command interface. - -Cc: Mario Limonciello <mario.limonciello@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org -Reviewed-by: Hansen Dsouza <hansen.dsouza@amd.com> -Acked-by: Wayne Lin <wayne.lin@amd.com> -Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 72 ++++++++++++++----- - drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h | 11 +++ - drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c | 19 ++--- - 3 files changed, 72 insertions(+), 30 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c -index 50f1e6d5321e..61d1b4eadbee 100644 ---- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c -+++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c -@@ -282,17 +282,11 @@ bool dc_dmub_srv_optimized_init_done(struct dc_dmub_srv *dc_dmub_srv) - bool dc_dmub_srv_notify_stream_mask(struct dc_dmub_srv *dc_dmub_srv, - unsigned int stream_mask) - { -- struct dmub_srv *dmub; -- const uint32_t timeout = 30; -- - if (!dc_dmub_srv || !dc_dmub_srv->dmub) - return false; - -- dmub = dc_dmub_srv->dmub; -- -- return dmub_srv_send_gpint_command( -- dmub, DMUB_GPINT__IDLE_OPT_NOTIFY_STREAM_MASK, -- stream_mask, timeout) == DMUB_STATUS_OK; -+ return dc_wake_and_execute_gpint(dc_dmub_srv->ctx, DMUB_GPINT__IDLE_OPT_NOTIFY_STREAM_MASK, -+ stream_mask, NULL, DM_DMUB_WAIT_TYPE_WAIT); - } - - bool dc_dmub_srv_is_restore_required(struct dc_dmub_srv *dc_dmub_srv) -@@ -1107,25 +1101,20 @@ bool dc_dmub_check_min_version(struct dmub_srv *srv) - void dc_dmub_srv_enable_dpia_trace(const struct dc *dc) - { - struct dc_dmub_srv *dc_dmub_srv = dc->ctx->dmub_srv; -- struct dmub_srv *dmub; -- enum dmub_status status; -- static const uint32_t timeout_us = 30; - - if (!dc_dmub_srv || !dc_dmub_srv->dmub) { - DC_LOG_ERROR("%s: invalid parameters.", __func__); - return; - } - -- dmub = dc_dmub_srv->dmub; -- -- status = dmub_srv_send_gpint_command(dmub, DMUB_GPINT__SET_TRACE_BUFFER_MASK_WORD1, 0x0010, timeout_us); -- if (status != DMUB_STATUS_OK) { -+ if (!dc_wake_and_execute_gpint(dc->ctx, DMUB_GPINT__SET_TRACE_BUFFER_MASK_WORD1, -+ 0x0010, NULL, DM_DMUB_WAIT_TYPE_WAIT)) { - DC_LOG_ERROR("timeout updating trace buffer mask word\n"); - return; - } - -- status = dmub_srv_send_gpint_command(dmub, DMUB_GPINT__UPDATE_TRACE_BUFFER_MASK, 0x0000, timeout_us); -- if (status != DMUB_STATUS_OK) { -+ if (!dc_wake_and_execute_gpint(dc->ctx, DMUB_GPINT__UPDATE_TRACE_BUFFER_MASK, -+ 0x0000, NULL, DM_DMUB_WAIT_TYPE_WAIT)) { - DC_LOG_ERROR("timeout updating trace buffer mask word\n"); - return; - } -@@ -1337,3 +1326,52 @@ bool dc_wake_and_execute_dmub_cmd_list(const struct dc_context *ctx, unsigned in - - return result; - } -+ -+static bool dc_dmub_execute_gpint(const struct dc_context *ctx, enum dmub_gpint_command command_code, -+ uint16_t param, uint32_t *response, enum dm_dmub_wait_type wait_type) -+{ -+ struct dc_dmub_srv *dc_dmub_srv = ctx->dmub_srv; -+ const uint32_t wait_us = wait_type == DM_DMUB_WAIT_TYPE_NO_WAIT ? 0 : 30; -+ enum dmub_status status; -+ -+ if (response) -+ *response = 0; -+ -+ if (!dc_dmub_srv || !dc_dmub_srv->dmub) -+ return false; -+ -+ status = dmub_srv_send_gpint_command(dc_dmub_srv->dmub, command_code, param, wait_us); -+ if (status != DMUB_STATUS_OK) { -+ if (status == DMUB_STATUS_TIMEOUT && wait_type == DM_DMUB_WAIT_TYPE_NO_WAIT) -+ return true; -+ -+ return false; -+ } -+ -+ if (response && wait_type == DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY) -+ dmub_srv_get_gpint_response(dc_dmub_srv->dmub, response); -+ -+ return true; -+} -+ -+bool dc_wake_and_execute_gpint(const struct dc_context *ctx, enum dmub_gpint_command command_code, -+ uint16_t param, uint32_t *response, enum dm_dmub_wait_type wait_type) -+{ -+ struct dc_dmub_srv *dc_dmub_srv = ctx->dmub_srv; -+ bool result = false, reallow_idle = false; -+ -+ if (!dc_dmub_srv || !dc_dmub_srv->dmub) -+ return false; -+ -+ if (dc_dmub_srv->idle_allowed) { -+ dc_dmub_srv_apply_idle_power_optimizations(ctx->dc, false); -+ reallow_idle = true; -+ } -+ -+ result = dc_dmub_execute_gpint(ctx, command_code, param, response, wait_type); -+ -+ if (result && reallow_idle) -+ dc_dmub_srv_apply_idle_power_optimizations(ctx->dc, true); -+ -+ return result; -+} -diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h -index 784ca3e44414..952bfb368886 100644 ---- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h -+++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h -@@ -145,5 +145,16 @@ bool dc_wake_and_execute_dmub_cmd(const struct dc_context *ctx, union dmub_rb_cm - bool dc_wake_and_execute_dmub_cmd_list(const struct dc_context *ctx, unsigned int count, - union dmub_rb_cmd *cmd, enum dm_dmub_wait_type wait_type); - -+/** -+ * dc_wake_and_execute_gpint() -+ * -+ * @ctx: DC context -+ * @command_code: The command ID to send to DMCUB -+ * @param: The parameter to message DMCUB -+ * @response: Optional response out value - may be NULL. -+ * @wait_type: The wait behavior for the execution -+ */ -+bool dc_wake_and_execute_gpint(const struct dc_context *ctx, enum dmub_gpint_command command_code, -+ uint16_t param, uint32_t *response, enum dm_dmub_wait_type wait_type); - - #endif /* _DMUB_DC_SRV_H_ */ -diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c -index 3d7cef17f881..3e243e407bb8 100644 ---- a/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c -+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c -@@ -105,23 +105,18 @@ static enum dc_psr_state convert_psr_state(uint32_t raw_state) - */ - static void dmub_psr_get_state(struct dmub_psr *dmub, enum dc_psr_state *state, uint8_t panel_inst) - { -- struct dmub_srv *srv = dmub->ctx->dmub_srv->dmub; - uint32_t raw_state = 0; - uint32_t retry_count = 0; -- enum dmub_status status; - - do { - // Send gpint command and wait for ack -- status = dmub_srv_send_gpint_command(srv, DMUB_GPINT__GET_PSR_STATE, panel_inst, 30); -- -- if (status == DMUB_STATUS_OK) { -- // GPINT was executed, get response -- dmub_srv_get_gpint_response(srv, &raw_state); -+ if (dc_wake_and_execute_gpint(dmub->ctx, DMUB_GPINT__GET_PSR_STATE, panel_inst, &raw_state, -+ DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY)) { - *state = convert_psr_state(raw_state); -- } else -+ } else { - // Return invalid state when GPINT times out - *state = PSR_STATE_INVALID; -- -+ } - } while (++retry_count <= 1000 && *state == PSR_STATE_INVALID); - - // Assert if max retry hit -@@ -452,13 +447,11 @@ static void dmub_psr_force_static(struct dmub_psr *dmub, uint8_t panel_inst) - */ - static void dmub_psr_get_residency(struct dmub_psr *dmub, uint32_t *residency, uint8_t panel_inst) - { -- struct dmub_srv *srv = dmub->ctx->dmub_srv->dmub; - uint16_t param = (uint16_t)(panel_inst << 8); - - /* Send gpint command and wait for ack */ -- dmub_srv_send_gpint_command(srv, DMUB_GPINT__PSR_RESIDENCY, param, 30); -- -- dmub_srv_get_gpint_response(srv, residency); -+ dc_wake_and_execute_gpint(dmub->ctx, DMUB_GPINT__PSR_RESIDENCY, param, residency, -+ DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY); - } - - static const struct dmub_psr_funcs psr_funcs = { --- -2.43.2 - -From 886942651af86e85ade7a8b560bdd6157cdc5014 Mon Sep 17 00:00:00 2001 -From: Taimur Hassan <syed.hassan@amd.com> -Date: Fri, 10 Nov 2023 10:15:28 -0500 -Subject: [PATCH 0963/1501] drm/amd/display: Fix conversions between bytes and - KB -Content-Length: 6946 -Lines: 97 - -[ Upstream commit 22136ff27c4e01fae81f6588033363a46c72ed8c ] - -[Why] -There are a number of instances where we convert HostVMMinPageSize or -GPUVMMinPageSize from bytes to KB by dividing (rather than multiplying) and -vice versa. -Additionally, in some cases, a parameter is passed through DML in KB but -later checked as if it were in bytes. - -Cc: stable@vger.kernel.org -Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> -Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> -Signed-off-by: Taimur Hassan <syed.hassan@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../drm/amd/display/dc/dml2/display_mode_core.c | 16 ++++++++-------- - 1 file changed, 8 insertions(+), 8 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c -index 4899e9e8c163..62ce95bac8f2 100644 ---- a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c -+++ b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c -@@ -6329,7 +6329,7 @@ static void dml_prefetch_check(struct display_mode_lib_st *mode_lib) - mode_lib->ms.NoOfDPPThisState, - mode_lib->ms.dpte_group_bytes, - s->HostVMInefficiencyFactor, -- mode_lib->ms.soc.hostvm_min_page_size_kbytes, -+ mode_lib->ms.soc.hostvm_min_page_size_kbytes * 1024, - mode_lib->ms.cache_display_cfg.plane.HostVMMaxPageTableLevels); - - s->NextMaxVStartup = s->MaxVStartupAllPlanes[j]; -@@ -6542,7 +6542,7 @@ static void dml_prefetch_check(struct display_mode_lib_st *mode_lib) - mode_lib->ms.cache_display_cfg.plane.HostVMEnable, - mode_lib->ms.cache_display_cfg.plane.HostVMMaxPageTableLevels, - mode_lib->ms.cache_display_cfg.plane.GPUVMEnable, -- mode_lib->ms.soc.hostvm_min_page_size_kbytes, -+ mode_lib->ms.soc.hostvm_min_page_size_kbytes * 1024, - mode_lib->ms.PDEAndMetaPTEBytesPerFrame[j][k], - mode_lib->ms.MetaRowBytes[j][k], - mode_lib->ms.DPTEBytesPerRow[j][k], -@@ -7687,7 +7687,7 @@ dml_bool_t dml_core_mode_support(struct display_mode_lib_st *mode_lib) - CalculateVMRowAndSwath_params->HostVMMaxNonCachedPageTableLevels = mode_lib->ms.cache_display_cfg.plane.HostVMMaxPageTableLevels; - CalculateVMRowAndSwath_params->GPUVMMaxPageTableLevels = mode_lib->ms.cache_display_cfg.plane.GPUVMMaxPageTableLevels; - CalculateVMRowAndSwath_params->GPUVMMinPageSizeKBytes = mode_lib->ms.cache_display_cfg.plane.GPUVMMinPageSizeKBytes; -- CalculateVMRowAndSwath_params->HostVMMinPageSize = mode_lib->ms.soc.hostvm_min_page_size_kbytes; -+ CalculateVMRowAndSwath_params->HostVMMinPageSize = mode_lib->ms.soc.hostvm_min_page_size_kbytes * 1024; - CalculateVMRowAndSwath_params->PTEBufferModeOverrideEn = mode_lib->ms.cache_display_cfg.plane.PTEBufferModeOverrideEn; - CalculateVMRowAndSwath_params->PTEBufferModeOverrideVal = mode_lib->ms.cache_display_cfg.plane.PTEBufferMode; - CalculateVMRowAndSwath_params->PTEBufferSizeNotExceeded = mode_lib->ms.PTEBufferSizeNotExceededPerState; -@@ -7957,7 +7957,7 @@ dml_bool_t dml_core_mode_support(struct display_mode_lib_st *mode_lib) - UseMinimumDCFCLK_params->GPUVMMaxPageTableLevels = mode_lib->ms.cache_display_cfg.plane.GPUVMMaxPageTableLevels; - UseMinimumDCFCLK_params->HostVMEnable = mode_lib->ms.cache_display_cfg.plane.HostVMEnable; - UseMinimumDCFCLK_params->NumberOfActiveSurfaces = mode_lib->ms.num_active_planes; -- UseMinimumDCFCLK_params->HostVMMinPageSize = mode_lib->ms.soc.hostvm_min_page_size_kbytes; -+ UseMinimumDCFCLK_params->HostVMMinPageSize = mode_lib->ms.soc.hostvm_min_page_size_kbytes * 1024; - UseMinimumDCFCLK_params->HostVMMaxNonCachedPageTableLevels = mode_lib->ms.cache_display_cfg.plane.HostVMMaxPageTableLevels; - UseMinimumDCFCLK_params->DynamicMetadataVMEnabled = mode_lib->ms.ip.dynamic_metadata_vm_enabled; - UseMinimumDCFCLK_params->ImmediateFlipRequirement = s->ImmediateFlipRequiredFinal; -@@ -8699,7 +8699,7 @@ void dml_core_mode_programming(struct display_mode_lib_st *mode_lib, const struc - CalculateVMRowAndSwath_params->HostVMMaxNonCachedPageTableLevels = mode_lib->ms.cache_display_cfg.plane.HostVMMaxPageTableLevels; - CalculateVMRowAndSwath_params->GPUVMMaxPageTableLevels = mode_lib->ms.cache_display_cfg.plane.GPUVMMaxPageTableLevels; - CalculateVMRowAndSwath_params->GPUVMMinPageSizeKBytes = mode_lib->ms.cache_display_cfg.plane.GPUVMMinPageSizeKBytes; -- CalculateVMRowAndSwath_params->HostVMMinPageSize = mode_lib->ms.soc.hostvm_min_page_size_kbytes; -+ CalculateVMRowAndSwath_params->HostVMMinPageSize = mode_lib->ms.soc.hostvm_min_page_size_kbytes * 1024; - CalculateVMRowAndSwath_params->PTEBufferModeOverrideEn = mode_lib->ms.cache_display_cfg.plane.PTEBufferModeOverrideEn; - CalculateVMRowAndSwath_params->PTEBufferModeOverrideVal = mode_lib->ms.cache_display_cfg.plane.PTEBufferMode; - CalculateVMRowAndSwath_params->PTEBufferSizeNotExceeded = s->dummy_boolean_array[0]; -@@ -8805,7 +8805,7 @@ void dml_core_mode_programming(struct display_mode_lib_st *mode_lib, const struc - mode_lib->ms.cache_display_cfg.hw.DPPPerSurface, - locals->dpte_group_bytes, - s->HostVMInefficiencyFactor, -- mode_lib->ms.soc.hostvm_min_page_size_kbytes, -+ mode_lib->ms.soc.hostvm_min_page_size_kbytes * 1024, - mode_lib->ms.cache_display_cfg.plane.HostVMMaxPageTableLevels); - - locals->TCalc = 24.0 / locals->DCFCLKDeepSleep; -@@ -8995,7 +8995,7 @@ void dml_core_mode_programming(struct display_mode_lib_st *mode_lib, const struc - CalculatePrefetchSchedule_params->GPUVMEnable = mode_lib->ms.cache_display_cfg.plane.GPUVMEnable; - CalculatePrefetchSchedule_params->HostVMEnable = mode_lib->ms.cache_display_cfg.plane.HostVMEnable; - CalculatePrefetchSchedule_params->HostVMMaxNonCachedPageTableLevels = mode_lib->ms.cache_display_cfg.plane.HostVMMaxPageTableLevels; -- CalculatePrefetchSchedule_params->HostVMMinPageSize = mode_lib->ms.soc.hostvm_min_page_size_kbytes; -+ CalculatePrefetchSchedule_params->HostVMMinPageSize = mode_lib->ms.soc.hostvm_min_page_size_kbytes * 1024; - CalculatePrefetchSchedule_params->DynamicMetadataEnable = mode_lib->ms.cache_display_cfg.plane.DynamicMetadataEnable[k]; - CalculatePrefetchSchedule_params->DynamicMetadataVMEnabled = mode_lib->ms.ip.dynamic_metadata_vm_enabled; - CalculatePrefetchSchedule_params->DynamicMetadataLinesBeforeActiveRequired = mode_lib->ms.cache_display_cfg.plane.DynamicMetadataLinesBeforeActiveRequired[k]; -@@ -9240,7 +9240,7 @@ void dml_core_mode_programming(struct display_mode_lib_st *mode_lib, const struc - mode_lib->ms.cache_display_cfg.plane.HostVMEnable, - mode_lib->ms.cache_display_cfg.plane.HostVMMaxPageTableLevels, - mode_lib->ms.cache_display_cfg.plane.GPUVMEnable, -- mode_lib->ms.soc.hostvm_min_page_size_kbytes, -+ mode_lib->ms.soc.hostvm_min_page_size_kbytes * 1024, - locals->PDEAndMetaPTEBytesFrame[k], - locals->MetaRowByte[k], - locals->PixelPTEBytesPerRow[k], --- -2.43.2 - -From 21aadc548ca2b802928ee0246b6d99e1ae08b430 Mon Sep 17 00:00:00 2001 -From: Sheng-Liang Pan <sheng-liang.pan@quanta.corp-partner.google.com> -Date: Fri, 27 Oct 2023 11:04:56 +0800 -Subject: [PATCH 0964/1501] drm/panel-edp: Add AUO B116XTN02, BOE - NT116WHM-N21,836X2, NV116WHM-N49 V8.0 -Content-Length: 2425 -Lines: 41 - -[ Upstream commit 3db2420422a5912d97966e0176050bb0fc9aa63e ] - -Add panel identification entry for -- AUO B116XTN02 family (product ID:0x235c) -- BOE NT116WHM-N21,836X2 (product ID:0x09c3) -- BOE NV116WHM-N49 V8.0 (product ID:0x0979) - -Signed-off-by: Sheng-Liang Pan <sheng-liang.pan@quanta.corp-partner.google.com> -Signed-off-by: Douglas Anderson <dianders@chromium.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20231027110435.1.Ia01fe9ec1c0953e0050a232eaa782fef2c037516@changeid -Stable-dep-of: fc6e76792965 ("drm/panel-edp: drm/panel-edp: Fix AUO B116XAK01 name and timing") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/panel/panel-edp.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c -index 95c8472d878a..5bf28c8443ef 100644 ---- a/drivers/gpu/drm/panel/panel-edp.c -+++ b/drivers/gpu/drm/panel/panel-edp.c -@@ -1840,6 +1840,7 @@ static const struct edp_panel_entry edp_panels[] = { - EDP_PANEL_ENTRY('A', 'U', 'O', 0x145c, &delay_200_500_e50, "B116XAB01.4"), - EDP_PANEL_ENTRY('A', 'U', 'O', 0x1e9b, &delay_200_500_e50, "B133UAN02.1"), - EDP_PANEL_ENTRY('A', 'U', 'O', 0x1ea5, &delay_200_500_e50, "B116XAK01.6"), -+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x235c, &delay_200_500_e50, "B116XTN02"), - EDP_PANEL_ENTRY('A', 'U', 'O', 0x405c, &auo_b116xak01.delay, "B116XAK01"), - EDP_PANEL_ENTRY('A', 'U', 'O', 0x582d, &delay_200_500_e50, "B133UAN01.0"), - EDP_PANEL_ENTRY('A', 'U', 'O', 0x615c, &delay_200_500_e50, "B116XAN06.1"), -@@ -1848,8 +1849,10 @@ static const struct edp_panel_entry edp_panels[] = { - EDP_PANEL_ENTRY('B', 'O', 'E', 0x0786, &delay_200_500_p2e80, "NV116WHM-T01"), - EDP_PANEL_ENTRY('B', 'O', 'E', 0x07d1, &boe_nv133fhm_n61.delay, "NV133FHM-N61"), - EDP_PANEL_ENTRY('B', 'O', 'E', 0x082d, &boe_nv133fhm_n61.delay, "NV133FHM-N62"), -+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x09c3, &delay_200_500_e50, "NT116WHM-N21,836X2"), - EDP_PANEL_ENTRY('B', 'O', 'E', 0x094b, &delay_200_500_e50, "NT116WHM-N21"), - EDP_PANEL_ENTRY('B', 'O', 'E', 0x095f, &delay_200_500_e50, "NE135FBM-N41 v8.1"), -+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0979, &delay_200_500_e50, "NV116WHM-N49 V8.0"), - EDP_PANEL_ENTRY('B', 'O', 'E', 0x098d, &boe_nv110wtm_n61.delay, "NV110WTM-N61"), - EDP_PANEL_ENTRY('B', 'O', 'E', 0x09dd, &delay_200_500_e50, "NT116WHM-N21"), - EDP_PANEL_ENTRY('B', 'O', 'E', 0x0a5d, &delay_200_500_e50, "NV116WHM-N45"), --- -2.43.2 - -From 779eb323e2bfe5d9c7a0965a9e68f2b8fe90030c Mon Sep 17 00:00:00 2001 -From: Hsin-Yi Wang <hsinyi@chromium.org> -Date: Tue, 7 Nov 2023 12:41:51 -0800 -Subject: [PATCH 0965/1501] drm/panel-edp: drm/panel-edp: Fix AUO B116XAK01 - name and timing -Content-Length: 1824 -Lines: 42 - -[ Upstream commit fc6e7679296530106ee0954e8ddef1aa58b2e0b5 ] - -Rename AUO 0x405c B116XAK01 to B116XAK01.0 and adjust the timing of -auo_b116xak01: T3=200, T12=500, T7_max = 50 according to decoding edid -and datasheet. - -Fixes: da458286a5e2 ("drm/panel: Add support for AUO B116XAK01 panel") -Cc: stable@vger.kernel.org -Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org> -Reviewed-by: Douglas Anderson <dianders@chromium.org> -Acked-by: Maxime Ripard <mripard@kernel.org> -Signed-off-by: Douglas Anderson <dianders@chromium.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20231107204611.3082200-2-hsinyi@chromium.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/panel/panel-edp.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c -index 5bf28c8443ef..e93e54a98260 100644 ---- a/drivers/gpu/drm/panel/panel-edp.c -+++ b/drivers/gpu/drm/panel/panel-edp.c -@@ -973,6 +973,8 @@ static const struct panel_desc auo_b116xak01 = { - }, - .delay = { - .hpd_absent = 200, -+ .unprepare = 500, -+ .enable = 50, - }, - }; - -@@ -1841,7 +1843,7 @@ static const struct edp_panel_entry edp_panels[] = { - EDP_PANEL_ENTRY('A', 'U', 'O', 0x1e9b, &delay_200_500_e50, "B133UAN02.1"), - EDP_PANEL_ENTRY('A', 'U', 'O', 0x1ea5, &delay_200_500_e50, "B116XAK01.6"), - EDP_PANEL_ENTRY('A', 'U', 'O', 0x235c, &delay_200_500_e50, "B116XTN02"), -- EDP_PANEL_ENTRY('A', 'U', 'O', 0x405c, &auo_b116xak01.delay, "B116XAK01"), -+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x405c, &auo_b116xak01.delay, "B116XAK01.0"), - EDP_PANEL_ENTRY('A', 'U', 'O', 0x582d, &delay_200_500_e50, "B133UAN01.0"), - EDP_PANEL_ENTRY('A', 'U', 'O', 0x615c, &delay_200_500_e50, "B116XAN06.1"), - EDP_PANEL_ENTRY('A', 'U', 'O', 0x8594, &delay_200_500_e50, "B133UAN01.0"), --- -2.43.2 - -From b1b67136af67b5cfa9800a0debf117da855669f6 Mon Sep 17 00:00:00 2001 -From: Hsin-Yi Wang <hsinyi@chromium.org> -Date: Tue, 7 Nov 2023 12:41:52 -0800 -Subject: [PATCH 0966/1501] drm/panel-edp: drm/panel-edp: Fix AUO B116XTN02 - name -Content-Length: 1609 -Lines: 31 - -[ Upstream commit 962845c090c4f85fa4f6872a5b6c89ee61f53cc0 ] - -Rename AUO 0x235c B116XTN02 to B116XTN02.3 according to decoding edid. - -Fixes: 3db2420422a5 ("drm/panel-edp: Add AUO B116XTN02, BOE NT116WHM-N21,836X2, NV116WHM-N49 V8.0") -Cc: stable@vger.kernel.org -Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org> -Reviewed-by: Douglas Anderson <dianders@chromium.org> -Acked-by: Maxime Ripard <mripard@kernel.org> -Signed-off-by: Douglas Anderson <dianders@chromium.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20231107204611.3082200-3-hsinyi@chromium.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/panel/panel-edp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c -index e93e54a98260..7dc6fb7308ce 100644 ---- a/drivers/gpu/drm/panel/panel-edp.c -+++ b/drivers/gpu/drm/panel/panel-edp.c -@@ -1842,7 +1842,7 @@ static const struct edp_panel_entry edp_panels[] = { - EDP_PANEL_ENTRY('A', 'U', 'O', 0x145c, &delay_200_500_e50, "B116XAB01.4"), - EDP_PANEL_ENTRY('A', 'U', 'O', 0x1e9b, &delay_200_500_e50, "B133UAN02.1"), - EDP_PANEL_ENTRY('A', 'U', 'O', 0x1ea5, &delay_200_500_e50, "B116XAK01.6"), -- EDP_PANEL_ENTRY('A', 'U', 'O', 0x235c, &delay_200_500_e50, "B116XTN02"), -+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x235c, &delay_200_500_e50, "B116XTN02.3"), - EDP_PANEL_ENTRY('A', 'U', 'O', 0x405c, &auo_b116xak01.delay, "B116XAK01.0"), - EDP_PANEL_ENTRY('A', 'U', 'O', 0x582d, &delay_200_500_e50, "B133UAN01.0"), - EDP_PANEL_ENTRY('A', 'U', 'O', 0x615c, &delay_200_500_e50, "B116XAN06.1"), --- -2.43.2 - -From 4b6b479b2da6badff099b2e3abf0248936eefbf5 Mon Sep 17 00:00:00 2001 -From: Ilya Bakoulin <ilya.bakoulin@amd.com> -Date: Fri, 8 Dec 2023 12:19:33 -0500 -Subject: [PATCH 0967/1501] drm/amd/display: Fix hang/underflow when - transitioning to ODM4:1 -Content-Length: 2169 -Lines: 60 - -[ Upstream commit e7b2b108cdeab76a7e7324459e50b0c1214c0386 ] - -[Why] -Under some circumstances, disabling an OPTC and attempting to reclaim -its OPP(s) for a different OPTC could cause a hang/underflow due to OPPs -not being properly disconnected from the disabled OPTC. - -[How] -Ensure that all OPPs are unassigned from an OPTC when it gets disabled. - -Reviewed-by: Alvin Lee <alvin.lee2@amd.com> -Acked-by: Wayne Lin <wayne.lin@amd.com> -Signed-off-by: Ilya Bakoulin <ilya.bakoulin@amd.com> -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Stable-dep-of: 3ba2a0bfd8cf ("drm/amd/display: Clear OPTC mem select on disable") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c | 7 +++++++ - drivers/gpu/drm/amd/display/dc/dcn35/dcn35_optc.c | 7 +++++++ - 2 files changed, 14 insertions(+) - -diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c -index a2c4db2cebdd..91ea0d4da06a 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c -@@ -172,6 +172,13 @@ static bool optc32_disable_crtc(struct timing_generator *optc) - REG_UPDATE(OTG_CONTROL, - OTG_MASTER_EN, 0); - -+ REG_UPDATE_5(OPTC_DATA_SOURCE_SELECT, -+ OPTC_SEG0_SRC_SEL, 0xf, -+ OPTC_SEG1_SRC_SEL, 0xf, -+ OPTC_SEG2_SRC_SEL, 0xf, -+ OPTC_SEG3_SRC_SEL, 0xf, -+ OPTC_NUM_OF_INPUT_SEGMENT, 0); -+ - REG_UPDATE(CONTROL, - VTG0_ENABLE, 0); - -diff --git a/drivers/gpu/drm/amd/display/dc/dcn35/dcn35_optc.c b/drivers/gpu/drm/amd/display/dc/dcn35/dcn35_optc.c -index a4a39f1638cf..08a59cf449ca 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn35/dcn35_optc.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn35/dcn35_optc.c -@@ -144,6 +144,13 @@ static bool optc35_disable_crtc(struct timing_generator *optc) - REG_UPDATE(OTG_CONTROL, - OTG_MASTER_EN, 0); - -+ REG_UPDATE_5(OPTC_DATA_SOURCE_SELECT, -+ OPTC_SEG0_SRC_SEL, 0xf, -+ OPTC_SEG1_SRC_SEL, 0xf, -+ OPTC_SEG2_SRC_SEL, 0xf, -+ OPTC_SEG3_SRC_SEL, 0xf, -+ OPTC_NUM_OF_INPUT_SEGMENT, 0); -+ - REG_UPDATE(CONTROL, - VTG0_ENABLE, 0); - --- -2.43.2 - -From dd9c923a582cf4590018973a7c003614cd3b3215 Mon Sep 17 00:00:00 2001 -From: George Shen <george.shen@amd.com> -Date: Sun, 17 Dec 2023 17:17:57 -0500 -Subject: [PATCH 0968/1501] drm/amd/display: Disconnect phantom pipe OPP from - OPTC being disabled -Content-Length: 3391 -Lines: 101 - -[ Upstream commit 7bdbfb4e36e34eb788e44f27666bf0a2b3b90803 ] - -[Why] -If an OPP is used for a different OPTC without first being disconnected -from the previous OPTC, unexpected behaviour can occur. This also -applies to phantom pipes, which is what the current logic missed. - -[How] -Disconnect OPPs from OPTC for phantom pipes before disabling OTG master. - -Also move the disconnection to before the OTG master disable, since the -register is double buffered. - -Reviewed-by: Dillon Varone <dillon.varone@amd.com> -Acked-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com> -Signed-off-by: George Shen <george.shen@amd.com> -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Stable-dep-of: 3ba2a0bfd8cf ("drm/amd/display: Clear OPTC mem select on disable") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../gpu/drm/amd/display/dc/dcn32/dcn32_optc.c | 19 +++++++++++++------ - .../gpu/drm/amd/display/dc/dcn35/dcn35_optc.c | 12 ++++++------ - 2 files changed, 19 insertions(+), 12 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c -index 91ea0d4da06a..1788eb29474b 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c -@@ -166,12 +166,6 @@ static bool optc32_disable_crtc(struct timing_generator *optc) - { - struct optc *optc1 = DCN10TG_FROM_TG(optc); - -- /* disable otg request until end of the first line -- * in the vertical blank region -- */ -- REG_UPDATE(OTG_CONTROL, -- OTG_MASTER_EN, 0); -- - REG_UPDATE_5(OPTC_DATA_SOURCE_SELECT, - OPTC_SEG0_SRC_SEL, 0xf, - OPTC_SEG1_SRC_SEL, 0xf, -@@ -179,6 +173,12 @@ static bool optc32_disable_crtc(struct timing_generator *optc) - OPTC_SEG3_SRC_SEL, 0xf, - OPTC_NUM_OF_INPUT_SEGMENT, 0); - -+ /* disable otg request until end of the first line -+ * in the vertical blank region -+ */ -+ REG_UPDATE(OTG_CONTROL, -+ OTG_MASTER_EN, 0); -+ - REG_UPDATE(CONTROL, - VTG0_ENABLE, 0); - -@@ -205,6 +205,13 @@ static void optc32_disable_phantom_otg(struct timing_generator *optc) - { - struct optc *optc1 = DCN10TG_FROM_TG(optc); - -+ REG_UPDATE_5(OPTC_DATA_SOURCE_SELECT, -+ OPTC_SEG0_SRC_SEL, 0xf, -+ OPTC_SEG1_SRC_SEL, 0xf, -+ OPTC_SEG2_SRC_SEL, 0xf, -+ OPTC_SEG3_SRC_SEL, 0xf, -+ OPTC_NUM_OF_INPUT_SEGMENT, 0); -+ - REG_UPDATE(OTG_CONTROL, OTG_MASTER_EN, 0); - } - -diff --git a/drivers/gpu/drm/amd/display/dc/dcn35/dcn35_optc.c b/drivers/gpu/drm/amd/display/dc/dcn35/dcn35_optc.c -index 08a59cf449ca..3d6c1b2c2b4d 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn35/dcn35_optc.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn35/dcn35_optc.c -@@ -138,12 +138,6 @@ static bool optc35_disable_crtc(struct timing_generator *optc) - { - struct optc *optc1 = DCN10TG_FROM_TG(optc); - -- /* disable otg request until end of the first line -- * in the vertical blank region -- */ -- REG_UPDATE(OTG_CONTROL, -- OTG_MASTER_EN, 0); -- - REG_UPDATE_5(OPTC_DATA_SOURCE_SELECT, - OPTC_SEG0_SRC_SEL, 0xf, - OPTC_SEG1_SRC_SEL, 0xf, -@@ -151,6 +145,12 @@ static bool optc35_disable_crtc(struct timing_generator *optc) - OPTC_SEG3_SRC_SEL, 0xf, - OPTC_NUM_OF_INPUT_SEGMENT, 0); - -+ /* disable otg request until end of the first line -+ * in the vertical blank region -+ */ -+ REG_UPDATE(OTG_CONTROL, -+ OTG_MASTER_EN, 0); -+ - REG_UPDATE(CONTROL, - VTG0_ENABLE, 0); - --- -2.43.2 - -From 7f0b58f2b24f39e9131f7fc01e9d8346ec8bac4c Mon Sep 17 00:00:00 2001 -From: Ilya Bakoulin <ilya.bakoulin@amd.com> -Date: Wed, 3 Jan 2024 09:42:04 -0500 -Subject: [PATCH 0969/1501] drm/amd/display: Clear OPTC mem select on disable -Content-Length: 2017 -Lines: 54 - -[ Upstream commit 3ba2a0bfd8cf94eb225e1c60dff16e5c35bde1da ] - -[Why] -Not clearing the memory select bits prior to OPTC disable can cause DSC -corruption issues when attempting to reuse a memory instance for another -OPTC that enables ODM. - -[How] -Clear the memory select bits prior to disabling an OPTC. - -Cc: Mario Limonciello <mario.limonciello@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org -Reviewed-by: Charlene Liu <charlene.liu@amd.com> -Acked-by: Alex Hung <alex.hung@amd.com> -Signed-off-by: Ilya Bakoulin <ilya.bakoulin@amd.com> -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c | 3 +++ - drivers/gpu/drm/amd/display/dc/dcn35/dcn35_optc.c | 3 +++ - 2 files changed, 6 insertions(+) - -diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c -index 1788eb29474b..823493543325 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c -@@ -173,6 +173,9 @@ static bool optc32_disable_crtc(struct timing_generator *optc) - OPTC_SEG3_SRC_SEL, 0xf, - OPTC_NUM_OF_INPUT_SEGMENT, 0); - -+ REG_UPDATE(OPTC_MEMORY_CONFIG, -+ OPTC_MEM_SEL, 0); -+ - /* disable otg request until end of the first line - * in the vertical blank region - */ -diff --git a/drivers/gpu/drm/amd/display/dc/dcn35/dcn35_optc.c b/drivers/gpu/drm/amd/display/dc/dcn35/dcn35_optc.c -index 3d6c1b2c2b4d..5b1547508850 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn35/dcn35_optc.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn35/dcn35_optc.c -@@ -145,6 +145,9 @@ static bool optc35_disable_crtc(struct timing_generator *optc) - OPTC_SEG3_SRC_SEL, 0xf, - OPTC_NUM_OF_INPUT_SEGMENT, 0); - -+ REG_UPDATE(OPTC_MEMORY_CONFIG, -+ OPTC_MEM_SEL, 0); -+ - /* disable otg request until end of the first line - * in the vertical blank region - */ --- -2.43.2 - -From eeb8ae770f8ae0933103a20e4d3c32ce3ea05b9c Mon Sep 17 00:00:00 2001 -From: Charlene Liu <charlene.liu@amd.com> -Date: Thu, 28 Dec 2023 13:19:33 -0500 -Subject: [PATCH 0970/1501] drm/amd/display: Add logging resource checks -Content-Length: 3033 -Lines: 68 - -[ Upstream commit 8a51cc097dd590a86e8eec5398934ef389ff9a7b ] - -[Why] -When mapping resources, resources could be unavailable. - -Cc: Mario Limonciello <mario.limonciello@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org -Reviewed-by: Sung joon Kim <sungjoon.kim@amd.com> -Acked-by: Alex Hung <alex.hung@amd.com> -Signed-off-by: Charlene Liu <charlene.liu@amd.com> -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/display/dc/core/dc.c | 4 +++- - drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 7 ++++++- - 2 files changed, 9 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c -index c535ddb45a36..bc098098345c 100644 ---- a/drivers/gpu/drm/amd/display/dc/core/dc.c -+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c -@@ -3626,7 +3626,7 @@ static void commit_planes_for_stream(struct dc *dc, - top_pipe_to_program = resource_get_otg_master_for_stream( - &context->res_ctx, - stream); -- -+ ASSERT(top_pipe_to_program != NULL); - for (i = 0; i < dc->res_pool->pipe_count; i++) { - struct pipe_ctx *old_pipe = &dc->current_state->res_ctx.pipe_ctx[i]; - -@@ -4457,6 +4457,8 @@ static bool should_commit_minimal_transition_for_windowed_mpo_odm(struct dc *dc, - - cur_pipe = resource_get_otg_master_for_stream(&dc->current_state->res_ctx, stream); - new_pipe = resource_get_otg_master_for_stream(&context->res_ctx, stream); -+ if (!cur_pipe || !new_pipe) -+ return false; - cur_is_odm_in_use = resource_get_odm_slice_count(cur_pipe) > 1; - new_is_odm_in_use = resource_get_odm_slice_count(new_pipe) > 1; - if (cur_is_odm_in_use == new_is_odm_in_use) -diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -index e4bb1e25ee3b..ae275f1780d5 100644 ---- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -@@ -2170,6 +2170,10 @@ void resource_log_pipe_topology_update(struct dc *dc, struct dc_state *state) - for (stream_idx = 0; stream_idx < state->stream_count; stream_idx++) { - otg_master = resource_get_otg_master_for_stream( - &state->res_ctx, state->streams[stream_idx]); -+ if (!otg_master || otg_master->stream_res.tg == NULL) { -+ DC_LOG_DC("topology update: otg_master NULL stream_idx %d!\n", stream_idx); -+ return; -+ } - slice_count = resource_get_opp_heads_for_otg_master(otg_master, - &state->res_ctx, opp_heads); - for (slice_idx = 0; slice_idx < slice_count; slice_idx++) { -@@ -2990,7 +2994,8 @@ bool dc_add_plane_to_context( - - otg_master_pipe = resource_get_otg_master_for_stream( - &context->res_ctx, stream); -- added = resource_append_dpp_pipes_for_plane_composition(context, -+ if (otg_master_pipe) -+ added = resource_append_dpp_pipes_for_plane_composition(context, - dc->current_state, pool, otg_master_pipe, plane_state); - - if (added) { --- -2.43.2 - -From 30985683549b150b4e55c032034cad0175b98e7a Mon Sep 17 00:00:00 2001 -From: Wenjing Liu <wenjing.liu@amd.com> -Date: Thu, 2 Nov 2023 14:59:13 -0400 -Subject: [PATCH 0971/1501] drm/amd/display: update pixel clock params after - stream slice count change in context -Content-Length: 7282 -Lines: 159 - -[ Upstream commit cfab803884f426b36b58dbe1f86f99742767c208 ] - -[why] -When ODM slice count is changed, otg master pipe's pixel clock params is -no longer valid as the value is dependent on ODM slice count. - -Reviewed-by: Chaitanya Dhere <chaitanya.dhere@amd.com> -Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> -Signed-off-by: Wenjing Liu <wenjing.liu@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Stable-dep-of: aa36d8971fcc ("drm/amd/display: Init link enc resources in dc_state only if res_pool presents") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../gpu/drm/amd/display/dc/core/dc_resource.c | 9 ++++++--- - .../drm/amd/display/dc/dcn20/dcn20_resource.c | 16 ++++++++++------ - .../drm/amd/display/dc/dcn20/dcn20_resource.h | 1 + - .../drm/amd/display/dc/dcn32/dcn32_resource.c | 1 + - .../drm/amd/display/dc/dcn321/dcn321_resource.c | 1 + - .../gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 6 +----- - drivers/gpu/drm/amd/display/dc/inc/core_types.h | 1 + - 7 files changed, 21 insertions(+), 14 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -index ae275f1780d5..c16190a10883 100644 ---- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -@@ -2237,7 +2237,7 @@ static struct pipe_ctx *get_last_dpp_pipe_in_mpcc_combine( - } - - static bool update_pipe_params_after_odm_slice_count_change( -- const struct dc_stream_state *stream, -+ struct pipe_ctx *otg_master, - struct dc_state *context, - const struct resource_pool *pool) - { -@@ -2247,9 +2247,12 @@ static bool update_pipe_params_after_odm_slice_count_change( - - for (i = 0; i < pool->pipe_count && result; i++) { - pipe = &context->res_ctx.pipe_ctx[i]; -- if (pipe->stream == stream && pipe->plane_state) -+ if (pipe->stream == otg_master->stream && pipe->plane_state) - result = resource_build_scaling_params(pipe); - } -+ -+ if (pool->funcs->build_pipe_pix_clk_params) -+ pool->funcs->build_pipe_pix_clk_params(otg_master); - return result; - } - -@@ -2932,7 +2935,7 @@ bool resource_update_pipes_for_stream_with_slice_count( - otg_master, new_ctx, pool); - if (result) - result = update_pipe_params_after_odm_slice_count_change( -- otg_master->stream, new_ctx, pool); -+ otg_master, new_ctx, pool); - return result; - } - -diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c -index 0a422fbb14bc..e73e59754837 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c -@@ -1273,15 +1273,19 @@ static void build_clamping_params(struct dc_stream_state *stream) - stream->clamping.pixel_encoding = stream->timing.pixel_encoding; - } - -+void dcn20_build_pipe_pix_clk_params(struct pipe_ctx *pipe_ctx) -+{ -+ get_pixel_clock_parameters(pipe_ctx, &pipe_ctx->stream_res.pix_clk_params); -+ pipe_ctx->clock_source->funcs->get_pix_clk_dividers( -+ pipe_ctx->clock_source, -+ &pipe_ctx->stream_res.pix_clk_params, -+ &pipe_ctx->pll_settings); -+} -+ - static enum dc_status build_pipe_hw_param(struct pipe_ctx *pipe_ctx) - { - -- get_pixel_clock_parameters(pipe_ctx, &pipe_ctx->stream_res.pix_clk_params); -- -- pipe_ctx->clock_source->funcs->get_pix_clk_dividers( -- pipe_ctx->clock_source, -- &pipe_ctx->stream_res.pix_clk_params, -- &pipe_ctx->pll_settings); -+ dcn20_build_pipe_pix_clk_params(pipe_ctx); - - pipe_ctx->stream->clamping.pixel_encoding = pipe_ctx->stream->timing.pixel_encoding; - -diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.h b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.h -index 37ecaccc5d12..4cee3fa11a7f 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.h -+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.h -@@ -165,6 +165,7 @@ enum dc_status dcn20_add_stream_to_ctx(struct dc *dc, struct dc_state *new_ctx, - enum dc_status dcn20_add_dsc_to_stream_resource(struct dc *dc, struct dc_state *dc_ctx, struct dc_stream_state *dc_stream); - enum dc_status dcn20_remove_stream_from_ctx(struct dc *dc, struct dc_state *new_ctx, struct dc_stream_state *dc_stream); - enum dc_status dcn20_patch_unknown_plane_state(struct dc_plane_state *plane_state); -+void dcn20_build_pipe_pix_clk_params(struct pipe_ctx *pipe_ctx); - - #endif /* __DC_RESOURCE_DCN20_H__ */ - -diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c -index 89b072447dba..e940dd0f92b7 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c -@@ -2041,6 +2041,7 @@ static struct resource_funcs dcn32_res_pool_funcs = { - .retain_phantom_pipes = dcn32_retain_phantom_pipes, - .save_mall_state = dcn32_save_mall_state, - .restore_mall_state = dcn32_restore_mall_state, -+ .build_pipe_pix_clk_params = dcn20_build_pipe_pix_clk_params, - }; - - static uint32_t read_pipe_fuses(struct dc_context *ctx) -diff --git a/drivers/gpu/drm/amd/display/dc/dcn321/dcn321_resource.c b/drivers/gpu/drm/amd/display/dc/dcn321/dcn321_resource.c -index f7de3eca1225..4156a8cc2bc7 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn321/dcn321_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn321/dcn321_resource.c -@@ -1609,6 +1609,7 @@ static struct resource_funcs dcn321_res_pool_funcs = { - .retain_phantom_pipes = dcn32_retain_phantom_pipes, - .save_mall_state = dcn32_save_mall_state, - .restore_mall_state = dcn32_restore_mall_state, -+ .build_pipe_pix_clk_params = dcn20_build_pipe_pix_clk_params, - }; - - static uint32_t read_pipe_fuses(struct dc_context *ctx) -diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c -index b46cde525066..92e2ddc9ab7e 100644 ---- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c -+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c -@@ -1237,15 +1237,11 @@ static void update_pipes_with_slice_table(struct dc *dc, struct dc_state *contex - { - int i; - -- for (i = 0; i < table->odm_combine_count; i++) { -+ for (i = 0; i < table->odm_combine_count; i++) - resource_update_pipes_for_stream_with_slice_count(context, - dc->current_state, dc->res_pool, - table->odm_combines[i].stream, - table->odm_combines[i].slice_count); -- /* TODO: move this into the function above */ -- dcn20_build_mapped_resource(dc, context, -- table->odm_combines[i].stream); -- } - - for (i = 0; i < table->mpc_combine_count; i++) - resource_update_pipes_for_plane_with_slice_count(context, -diff --git a/drivers/gpu/drm/amd/display/dc/inc/core_types.h b/drivers/gpu/drm/amd/display/dc/inc/core_types.h -index bac1420b1de8..10397d4dfb07 100644 ---- a/drivers/gpu/drm/amd/display/dc/inc/core_types.h -+++ b/drivers/gpu/drm/amd/display/dc/inc/core_types.h -@@ -205,6 +205,7 @@ struct resource_funcs { - void (*get_panel_config_defaults)(struct dc_panel_config *panel_config); - void (*save_mall_state)(struct dc *dc, struct dc_state *context, struct mall_temp_config *temp_config); - void (*restore_mall_state)(struct dc *dc, struct dc_state *context, struct mall_temp_config *temp_config); -+ void (*build_pipe_pix_clk_params)(struct pipe_ctx *pipe_ctx); - }; - - struct audio_support{ --- -2.43.2 - -From da37d00c636966c8a0856417d02cb79811b61692 Mon Sep 17 00:00:00 2001 -From: Dillon Varone <dillon.varone@amd.com> -Date: Thu, 28 Dec 2023 21:36:39 -0500 -Subject: [PATCH 0972/1501] drm/amd/display: Init link enc resources in - dc_state only if res_pool presents -Content-Length: 1296 -Lines: 36 - -[ Upstream commit aa36d8971fccb55ef3241cbfff9d1799e31d8628 ] - -[Why & How] -res_pool is not initialized in all situations such as virtual -environments, and therefore link encoder resources should not be -initialized if res_pool is NULL. - -Cc: Mario Limonciello <mario.limonciello@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org -Reviewed-by: Martin Leung <martin.leung@amd.com> -Acked-by: Alex Hung <alex.hung@amd.com> -Signed-off-by: Dillon Varone <dillon.varone@amd.com> -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -index c16190a10883..990d775e4cea 100644 ---- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -@@ -3774,7 +3774,8 @@ void dc_resource_state_construct( - dst_ctx->clk_mgr = dc->clk_mgr; - - /* Initialise DIG link encoder resource tracking variables. */ -- link_enc_cfg_init(dc, dst_ctx); -+ if (dc->res_pool) -+ link_enc_cfg_init(dc, dst_ctx); - } - - --- -2.43.2 - -From 50a7e7868f753602cda77d641e53dc8a6f01d6bc Mon Sep 17 00:00:00 2001 -From: Friedrich Vock <friedrich.vock@gmx.de> -Date: Sat, 2 Dec 2023 01:17:40 +0100 -Subject: [PATCH 0973/1501] drm/amdgpu: Enable tunneling on high-priority - compute queues -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 4971 -Lines: 111 - -[ Upstream commit 91963397c49aa2907aeafa52d929555dcbc9cd07 ] - -This improves latency if the GPU is already busy with other work. -This is useful for VR compositors that submit highly latency-sensitive -compositing work on high-priority compute queues while the GPU is busy -rendering the next frame. - -Userspace merge request: -https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/26462 - -v2: bump driver version (Alex) - -Reviewed-by: Marek Olšák <marek.olsak@amd.com> -Signed-off-by: Friedrich Vock <friedrich.vock@gmx.de> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Stable-dep-of: 03ff6d7238b7 ("drm/amdgpu/gfx10: set UNORD_DISPATCH in compute MQDs") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + - drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 ++- - drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 10 ++++++---- - drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 3 ++- - drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 3 ++- - 5 files changed, 13 insertions(+), 7 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -index 9d92ca157677..50f57d4dfd8f 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -@@ -757,6 +757,7 @@ struct amdgpu_mqd_prop { - uint64_t eop_gpu_addr; - uint32_t hqd_pipe_priority; - uint32_t hqd_queue_priority; -+ bool allow_tunneling; - bool hqd_active; - }; - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -index c0e8e030b96f..a7ad77ed09ca 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -@@ -115,9 +115,10 @@ - * 3.54.0 - Add AMDGPU_CTX_QUERY2_FLAGS_RESET_IN_PROGRESS support - * - 3.55.0 - Add AMDGPU_INFO_GPUVM_FAULT query - * - 3.56.0 - Update IB start address and size alignment for decode and encode -+ * - 3.57.0 - Compute tunneling on GFX10+ - */ - #define KMS_DRIVER_MAJOR 3 --#define KMS_DRIVER_MINOR 56 -+#define KMS_DRIVER_MINOR 57 - #define KMS_DRIVER_PATCHLEVEL 0 - - /* -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c -index 6a80d3ec887e..45424ebf9681 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c -@@ -642,6 +642,10 @@ static void amdgpu_ring_to_mqd_prop(struct amdgpu_ring *ring, - struct amdgpu_mqd_prop *prop) - { - struct amdgpu_device *adev = ring->adev; -+ bool is_high_prio_compute = ring->funcs->type == AMDGPU_RING_TYPE_COMPUTE && -+ amdgpu_gfx_is_high_priority_compute_queue(adev, ring); -+ bool is_high_prio_gfx = ring->funcs->type == AMDGPU_RING_TYPE_GFX && -+ amdgpu_gfx_is_high_priority_graphics_queue(adev, ring); - - memset(prop, 0, sizeof(*prop)); - -@@ -659,10 +663,8 @@ static void amdgpu_ring_to_mqd_prop(struct amdgpu_ring *ring, - */ - prop->hqd_active = ring->funcs->type == AMDGPU_RING_TYPE_KIQ; - -- if ((ring->funcs->type == AMDGPU_RING_TYPE_COMPUTE && -- amdgpu_gfx_is_high_priority_compute_queue(adev, ring)) || -- (ring->funcs->type == AMDGPU_RING_TYPE_GFX && -- amdgpu_gfx_is_high_priority_graphics_queue(adev, ring))) { -+ prop->allow_tunneling = is_high_prio_compute; -+ if (is_high_prio_compute || is_high_prio_gfx) { - prop->hqd_pipe_priority = AMDGPU_GFX_PIPE_PRIO_HIGH; - prop->hqd_queue_priority = AMDGPU_GFX_QUEUE_PRIORITY_MAXIMUM; - } -diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c -index 67c198ea8211..d63cab294883 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c -@@ -6590,7 +6590,8 @@ static int gfx_v10_0_compute_mqd_init(struct amdgpu_device *adev, void *m, - tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, ENDIAN_SWAP, 1); - #endif - tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, UNORD_DISPATCH, 0); -- tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, TUNNEL_DISPATCH, 0); -+ tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, TUNNEL_DISPATCH, -+ prop->allow_tunneling); - tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, PRIV_STATE, 1); - tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, KMD_QUEUE, 1); - mqd->cp_hqd_pq_control = tmp; -diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -index cddf3737e8a3..4824a4c04d35 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -@@ -3839,7 +3839,8 @@ static int gfx_v11_0_compute_mqd_init(struct amdgpu_device *adev, void *m, - tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, RPTR_BLOCK_SIZE, - (order_base_2(AMDGPU_GPU_PAGE_SIZE / 4) - 1)); - tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, UNORD_DISPATCH, 0); -- tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, TUNNEL_DISPATCH, 0); -+ tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, TUNNEL_DISPATCH, -+ prop->allow_tunneling); - tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, PRIV_STATE, 1); - tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, KMD_QUEUE, 1); - mqd->cp_hqd_pq_control = tmp; --- -2.43.2 - -From e664165d4bea5de733a3c19b518ecc207e503bba Mon Sep 17 00:00:00 2001 -From: Alex Deucher <alexander.deucher@amd.com> -Date: Fri, 19 Jan 2024 12:23:55 -0500 -Subject: [PATCH 0974/1501] drm/amdgpu/gfx10: set UNORD_DISPATCH in compute - MQDs -Content-Length: 2058 -Lines: 44 - -[ Upstream commit 03ff6d7238b77e5fb2b85dc5fe01d2db9eb893bd ] - -This needs to be set to 1 to avoid a potential deadlock in -the GC 10.x and newer. On GC 9.x and older, this needs -to be set to 0. This can lead to hangs in some mixed -graphics and compute workloads. Updated firmware is also -required for AQL. - -Reviewed-by: Feifei Xu <Feifei.Xu@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +- - drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c | 1 + - 2 files changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c -index d63cab294883..ecb622b7f970 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c -@@ -6589,7 +6589,7 @@ static int gfx_v10_0_compute_mqd_init(struct amdgpu_device *adev, void *m, - #ifdef __BIG_ENDIAN - tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, ENDIAN_SWAP, 1); - #endif -- tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, UNORD_DISPATCH, 0); -+ tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, UNORD_DISPATCH, 1); - tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, TUNNEL_DISPATCH, - prop->allow_tunneling); - tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, PRIV_STATE, 1); -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c -index 8b7fed913526..22cbfa1bdadd 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c -@@ -170,6 +170,7 @@ static void update_mqd(struct mqd_manager *mm, void *mqd, - m->cp_hqd_pq_control = 5 << CP_HQD_PQ_CONTROL__RPTR_BLOCK_SIZE__SHIFT; - m->cp_hqd_pq_control |= - ffs(q->queue_size / sizeof(unsigned int)) - 1 - 1; -+ m->cp_hqd_pq_control |= CP_HQD_PQ_CONTROL__UNORD_DISPATCH_MASK; - pr_debug("cp_hqd_pq_control 0x%x\n", m->cp_hqd_pq_control); - - m->cp_hqd_pq_base_lo = lower_32_bits((uint64_t)q->queue_address >> 8); --- -2.43.2 - -From 2b132089a9eb49508b017b4b742dfc98bb5b405f Mon Sep 17 00:00:00 2001 -From: Alex Deucher <alexander.deucher@amd.com> -Date: Fri, 19 Jan 2024 12:32:59 -0500 -Subject: [PATCH 0975/1501] drm/amdgpu/gfx11: set UNORD_DISPATCH in compute - MQDs -Content-Length: 2133 -Lines: 44 - -[ Upstream commit 3380fcad2c906872110d31ddf7aa1fdea57f9df6 ] - -This needs to be set to 1 to avoid a potential deadlock in -the GC 10.x and newer. On GC 9.x and older, this needs -to be set to 0. This can lead to hangs in some mixed -graphics and compute workloads. Updated firmware is also -required for AQL. - -Reviewed-by: Feifei Xu <Feifei.Xu@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Cc: stable@vger.kernel.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 +- - drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c | 1 + - 2 files changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -index 4824a4c04d35..806a8cf90487 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -@@ -3838,7 +3838,7 @@ static int gfx_v11_0_compute_mqd_init(struct amdgpu_device *adev, void *m, - (order_base_2(prop->queue_size / 4) - 1)); - tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, RPTR_BLOCK_SIZE, - (order_base_2(AMDGPU_GPU_PAGE_SIZE / 4) - 1)); -- tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, UNORD_DISPATCH, 0); -+ tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, UNORD_DISPATCH, 1); - tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, TUNNEL_DISPATCH, - prop->allow_tunneling); - tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_CONTROL, PRIV_STATE, 1); -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c -index 15277f1d5cf0..d722cbd31783 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c -@@ -224,6 +224,7 @@ static void update_mqd(struct mqd_manager *mm, void *mqd, - m->cp_hqd_pq_control = 5 << CP_HQD_PQ_CONTROL__RPTR_BLOCK_SIZE__SHIFT; - m->cp_hqd_pq_control |= - ffs(q->queue_size / sizeof(unsigned int)) - 1 - 1; -+ m->cp_hqd_pq_control |= CP_HQD_PQ_CONTROL__UNORD_DISPATCH_MASK; - pr_debug("cp_hqd_pq_control 0x%x\n", m->cp_hqd_pq_control); - - m->cp_hqd_pq_base_lo = lower_32_bits((uint64_t)q->queue_address >> 8); --- -2.43.2 - -From 31976a047b8a2fae7fa2c3df858314dc3016b06d Mon Sep 17 00:00:00 2001 -From: Douglas Anderson <dianders@chromium.org> -Date: Thu, 21 Dec 2023 13:55:48 -0800 -Subject: [PATCH 0976/1501] drm/bridge: parade-ps8640: Wait for HPD when doing - an AUX transfer -Content-Length: 1835 -Lines: 43 - -[ Upstream commit 024b32db43a359e0ded3fcc6cd86247cbbed4224 ] - -Unlike what is claimed in commit f5aa7d46b0ee ("drm/bridge: -parade-ps8640: Provide wait_hpd_asserted() in struct drm_dp_aux"), if -someone manually tries to do an AUX transfer (like via `i2cdump ${bus} -0x50 i`) while the panel is off we don't just get a simple transfer -error. Instead, the whole ps8640 gets thrown for a loop and goes into -a bad state. - -Let's put the function to wait for the HPD (and the magical 50 ms -after first reset) back in when we're doing an AUX transfer. This -shouldn't actually make things much slower (assuming the panel is on) -because we should immediately poll and see the HPD high. Mostly this -is just an extra i2c transfer to the bridge. - -Fixes: f5aa7d46b0ee ("drm/bridge: parade-ps8640: Provide wait_hpd_asserted() in struct drm_dp_aux") -Tested-by: Pin-yen Lin <treapking@chromium.org> -Reviewed-by: Pin-yen Lin <treapking@chromium.org> -Signed-off-by: Douglas Anderson <dianders@chromium.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20231221135548.1.I10f326a9305d57ad32cee7f8d9c60518c8be20fb@changeid -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/bridge/parade-ps8640.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/drivers/gpu/drm/bridge/parade-ps8640.c b/drivers/gpu/drm/bridge/parade-ps8640.c -index 541e4f5afc4c..fb5e9ae9ad81 100644 ---- a/drivers/gpu/drm/bridge/parade-ps8640.c -+++ b/drivers/gpu/drm/bridge/parade-ps8640.c -@@ -346,6 +346,11 @@ static ssize_t ps8640_aux_transfer(struct drm_dp_aux *aux, - int ret; - - pm_runtime_get_sync(dev); -+ ret = _ps8640_wait_hpd_asserted(ps_bridge, 200 * 1000); -+ if (ret) { -+ pm_runtime_put_sync_suspend(dev); -+ return ret; -+ } - ret = ps8640_aux_transfer_msg(aux, msg); - pm_runtime_mark_last_busy(dev); - pm_runtime_put_autosuspend(dev); --- -2.43.2 - -From ba7e07633f04bd16b8b0ab34bac461e03da106b4 Mon Sep 17 00:00:00 2001 -From: Markus Niebel <Markus.Niebel@ew.tq-group.com> -Date: Thu, 12 Oct 2023 10:42:08 +0200 -Subject: [PATCH 0977/1501] drm: panel-simple: add missing bus flags for Tianma - tm070jvhg[30/33] -Content-Length: 1664 -Lines: 41 - -[ Upstream commit 45dd7df26cee741b31c25ffdd44fb8794eb45ccd ] - -The DE signal is active high on this display, fill in the missing -bus_flags. This aligns panel_desc with its display_timing. - -Fixes: 9a2654c0f62a ("drm/panel: Add and fill drm_panel type field") -Fixes: b3bfcdf8a3b6 ("drm/panel: simple: add Tianma TM070JVHG33") - -Signed-off-by: Markus Niebel <Markus.Niebel@ew.tq-group.com> -Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> -Reviewed-by: Sam Ravnborg <sam@ravnborg.org> -Link: https://lore.kernel.org/r/20231012084208.2731650-1-alexander.stein@ew.tq-group.com -Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20231012084208.2731650-1-alexander.stein@ew.tq-group.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/panel/panel-simple.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c -index 9367a4572dcf..1ba633fd5696 100644 ---- a/drivers/gpu/drm/panel/panel-simple.c -+++ b/drivers/gpu/drm/panel/panel-simple.c -@@ -3861,6 +3861,7 @@ static const struct panel_desc tianma_tm070jdhg30 = { - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, - .connector_type = DRM_MODE_CONNECTOR_LVDS, -+ .bus_flags = DRM_BUS_FLAG_DE_HIGH, - }; - - static const struct panel_desc tianma_tm070jvhg33 = { -@@ -3873,6 +3874,7 @@ static const struct panel_desc tianma_tm070jvhg33 = { - }, - .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, - .connector_type = DRM_MODE_CONNECTOR_LVDS, -+ .bus_flags = DRM_BUS_FLAG_DE_HIGH, - }; - - static const struct display_timing tianma_tm070rvhg71_timing = { --- -2.43.2 - -From 462faf589c126ecaffd3a6b780741f5c24d02b98 Mon Sep 17 00:00:00 2001 -From: Artur Weber <aweber.kernel@gmail.com> -Date: Fri, 5 Jan 2024 07:53:02 +0100 -Subject: [PATCH 0978/1501] drm/panel: samsung-s6d7aa0: drop - DRM_BUS_FLAG_DE_HIGH for lsl080al02 -Content-Length: 1516 -Lines: 34 - -[ Upstream commit 62b143b5ec4a14e1ae0dede5aabaf1832e3b0073 ] - -It turns out that I had misconfigured the device I was using the panel -with; the bus data polarity is not high for this panel, I had to change -the config on the display controller's side. - -Fix the panel config to properly reflect its accurate settings. - -Fixes: 6810bb390282 ("drm/panel: Add Samsung S6D7AA0 panel controller driver") -Reviewed-by: Jessica Zhang <quic_jesszhan@quicinc.com> -Signed-off-by: Artur Weber <aweber.kernel@gmail.com> -Link: https://lore.kernel.org/r/20240105-tab3-display-fixes-v2-2-904d1207bf6f@gmail.com -Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20240105-tab3-display-fixes-v2-2-904d1207bf6f@gmail.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/panel/panel-samsung-s6d7aa0.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/panel/panel-samsung-s6d7aa0.c b/drivers/gpu/drm/panel/panel-samsung-s6d7aa0.c -index ea5a85779382..f23d8832a1ad 100644 ---- a/drivers/gpu/drm/panel/panel-samsung-s6d7aa0.c -+++ b/drivers/gpu/drm/panel/panel-samsung-s6d7aa0.c -@@ -309,7 +309,7 @@ static const struct s6d7aa0_panel_desc s6d7aa0_lsl080al02_desc = { - .off_func = s6d7aa0_lsl080al02_off, - .drm_mode = &s6d7aa0_lsl080al02_mode, - .mode_flags = MIPI_DSI_MODE_VSYNC_FLUSH | MIPI_DSI_MODE_VIDEO_NO_HFP, -- .bus_flags = DRM_BUS_FLAG_DE_HIGH, -+ .bus_flags = 0, - - .has_backlight = false, - .use_passwd3 = false, --- -2.43.2 - -From f98cf99578c25e001dc979e88ec3c5ea77ad835b Mon Sep 17 00:00:00 2001 -From: Arnd Bergmann <arnd@arndb.de> -Date: Mon, 23 Oct 2023 13:55:58 +0200 -Subject: [PATCH 0979/1501] drm/panel/raydium-rm692e5: select - CONFIG_DRM_DISPLAY_DP_HELPER -Content-Length: 1440 -Lines: 36 - -[ Upstream commit 589830b13ac21bddf99b9bc5a4ec17813d0869ef ] - -As with several other panel drivers, this fails to link without the DP -helper library: - -ld: drivers/gpu/drm/panel/panel-raydium-rm692e5.o: in function `rm692e5_prepare': -panel-raydium-rm692e5.c:(.text+0x11f4): undefined reference to `drm_dsc_pps_payload_pack' - -Select the same symbols that the others already use. - -Fixes: 988d0ff29ecf7 ("drm/panel: Add driver for BOE RM692E5 AMOLED panel") -Signed-off-by: Arnd Bergmann <arnd@arndb.de> -Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> -Link: https://lore.kernel.org/r/20231023115619.3551348-1-arnd@kernel.org -Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20231023115619.3551348-1-arnd@kernel.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/panel/Kconfig | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/gpu/drm/panel/Kconfig b/drivers/gpu/drm/panel/Kconfig -index 99e14dc212ec..a4ac4b47777f 100644 ---- a/drivers/gpu/drm/panel/Kconfig -+++ b/drivers/gpu/drm/panel/Kconfig -@@ -530,6 +530,8 @@ config DRM_PANEL_RAYDIUM_RM692E5 - depends on OF - depends on DRM_MIPI_DSI - depends on BACKLIGHT_CLASS_DEVICE -+ select DRM_DISPLAY_DP_HELPER -+ select DRM_DISPLAY_HELPER - help - Say Y here if you want to enable support for Raydium RM692E5-based - display panels, such as the one found in the Fairphone 5 smartphone. --- -2.43.2 - -From 2a4c6af7934a7b4c304542c38fee35e09cc1770c Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Wed, 3 Jan 2024 15:31:07 +0200 -Subject: [PATCH 0980/1501] drm/bridge: sii902x: Fix probing race issue -Content-Length: 4696 -Lines: 122 - -[ Upstream commit 08ac6f132dd77e40f786d8af51140c96c6d739c9 ] - -A null pointer dereference crash has been observed rarely on TI -platforms using sii9022 bridge: - -[ 53.271356] sii902x_get_edid+0x34/0x70 [sii902x] -[ 53.276066] sii902x_bridge_get_edid+0x14/0x20 [sii902x] -[ 53.281381] drm_bridge_get_edid+0x20/0x34 [drm] -[ 53.286305] drm_bridge_connector_get_modes+0x8c/0xcc [drm_kms_helper] -[ 53.292955] drm_helper_probe_single_connector_modes+0x190/0x538 [drm_kms_helper] -[ 53.300510] drm_client_modeset_probe+0x1f0/0xbd4 [drm] -[ 53.305958] __drm_fb_helper_initial_config_and_unlock+0x50/0x510 [drm_kms_helper] -[ 53.313611] drm_fb_helper_initial_config+0x48/0x58 [drm_kms_helper] -[ 53.320039] drm_fbdev_dma_client_hotplug+0x84/0xd4 [drm_dma_helper] -[ 53.326401] drm_client_register+0x5c/0xa0 [drm] -[ 53.331216] drm_fbdev_dma_setup+0xc8/0x13c [drm_dma_helper] -[ 53.336881] tidss_probe+0x128/0x264 [tidss] -[ 53.341174] platform_probe+0x68/0xc4 -[ 53.344841] really_probe+0x188/0x3c4 -[ 53.348501] __driver_probe_device+0x7c/0x16c -[ 53.352854] driver_probe_device+0x3c/0x10c -[ 53.357033] __device_attach_driver+0xbc/0x158 -[ 53.361472] bus_for_each_drv+0x88/0xe8 -[ 53.365303] __device_attach+0xa0/0x1b4 -[ 53.369135] device_initial_probe+0x14/0x20 -[ 53.373314] bus_probe_device+0xb0/0xb4 -[ 53.377145] deferred_probe_work_func+0xcc/0x124 -[ 53.381757] process_one_work+0x1f0/0x518 -[ 53.385770] worker_thread+0x1e8/0x3dc -[ 53.389519] kthread+0x11c/0x120 -[ 53.392750] ret_from_fork+0x10/0x20 - -The issue here is as follows: - -- tidss probes, but is deferred as sii902x is still missing. -- sii902x starts probing and enters sii902x_init(). -- sii902x calls drm_bridge_add(). Now the sii902x bridge is ready from - DRM's perspective. -- sii902x calls sii902x_audio_codec_init() and - platform_device_register_data() -- The registration of the audio platform device causes probing of the - deferred devices. -- tidss probes, which eventually causes sii902x_bridge_get_edid() to be - called. -- sii902x_bridge_get_edid() tries to use the i2c to read the edid. - However, the sii902x driver has not set up the i2c part yet, leading - to the crash. - -Fix this by moving the drm_bridge_add() to the end of the -sii902x_init(), which is also at the very end of sii902x_probe(). - -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Fixes: 21d808405fe4 ("drm/bridge/sii902x: Fix EDID readback") -Acked-by: Linus Walleij <linus.walleij@linaro.org> -Link: https://lore.kernel.org/r/20240103-si902x-fixes-v1-1-b9fd3e448411@ideasonboard.com -Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20240103-si902x-fixes-v1-1-b9fd3e448411@ideasonboard.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/bridge/sii902x.c | 29 ++++++++++++++++------------- - 1 file changed, 16 insertions(+), 13 deletions(-) - -diff --git a/drivers/gpu/drm/bridge/sii902x.c b/drivers/gpu/drm/bridge/sii902x.c -index 2bdc5b439beb..69da73e414a9 100644 ---- a/drivers/gpu/drm/bridge/sii902x.c -+++ b/drivers/gpu/drm/bridge/sii902x.c -@@ -1080,16 +1080,6 @@ static int sii902x_init(struct sii902x *sii902x) - return ret; - } - -- sii902x->bridge.funcs = &sii902x_bridge_funcs; -- sii902x->bridge.of_node = dev->of_node; -- sii902x->bridge.timings = &default_sii902x_timings; -- sii902x->bridge.ops = DRM_BRIDGE_OP_DETECT | DRM_BRIDGE_OP_EDID; -- -- if (sii902x->i2c->irq > 0) -- sii902x->bridge.ops |= DRM_BRIDGE_OP_HPD; -- -- drm_bridge_add(&sii902x->bridge); -- - sii902x_audio_codec_init(sii902x, dev); - - i2c_set_clientdata(sii902x->i2c, sii902x); -@@ -1102,7 +1092,21 @@ static int sii902x_init(struct sii902x *sii902x) - return -ENOMEM; - - sii902x->i2cmux->priv = sii902x; -- return i2c_mux_add_adapter(sii902x->i2cmux, 0, 0, 0); -+ ret = i2c_mux_add_adapter(sii902x->i2cmux, 0, 0, 0); -+ if (ret) -+ return ret; -+ -+ sii902x->bridge.funcs = &sii902x_bridge_funcs; -+ sii902x->bridge.of_node = dev->of_node; -+ sii902x->bridge.timings = &default_sii902x_timings; -+ sii902x->bridge.ops = DRM_BRIDGE_OP_DETECT | DRM_BRIDGE_OP_EDID; -+ -+ if (sii902x->i2c->irq > 0) -+ sii902x->bridge.ops |= DRM_BRIDGE_OP_HPD; -+ -+ drm_bridge_add(&sii902x->bridge); -+ -+ return 0; - } - - static int sii902x_probe(struct i2c_client *client) -@@ -1170,12 +1174,11 @@ static int sii902x_probe(struct i2c_client *client) - } - - static void sii902x_remove(struct i2c_client *client) -- - { - struct sii902x *sii902x = i2c_get_clientdata(client); - -- i2c_mux_del_adapters(sii902x->i2cmux); - drm_bridge_remove(&sii902x->bridge); -+ i2c_mux_del_adapters(sii902x->i2cmux); - } - - static const struct of_device_id sii902x_dt_ids[] = { --- -2.43.2 - -From 218c1f41c8c0fbbb16752dc6abefdc2033240efd Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Wed, 3 Jan 2024 15:31:08 +0200 -Subject: [PATCH 0981/1501] drm/bridge: sii902x: Fix audio codec unregistration -Content-Length: 2498 -Lines: 77 - -[ Upstream commit 3fc6c76a8d208d3955c9e64b382d0ff370bc61fc ] - -The driver never unregisters the audio codec platform device, which can -lead to a crash on module reloading, nor does it handle the return value -from sii902x_audio_codec_init(). - -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Fixes: ff5781634c41 ("drm/bridge: sii902x: Implement HDMI audio support") -Cc: Jyri Sarha <jsarha@ti.com> -Acked-by: Linus Walleij <linus.walleij@linaro.org> -Link: https://lore.kernel.org/r/20240103-si902x-fixes-v1-2-b9fd3e448411@ideasonboard.com -Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20240103-si902x-fixes-v1-2-b9fd3e448411@ideasonboard.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/bridge/sii902x.c | 21 +++++++++++++++++---- - 1 file changed, 17 insertions(+), 4 deletions(-) - -diff --git a/drivers/gpu/drm/bridge/sii902x.c b/drivers/gpu/drm/bridge/sii902x.c -index 69da73e414a9..4560ae9cbce1 100644 ---- a/drivers/gpu/drm/bridge/sii902x.c -+++ b/drivers/gpu/drm/bridge/sii902x.c -@@ -1080,7 +1080,9 @@ static int sii902x_init(struct sii902x *sii902x) - return ret; - } - -- sii902x_audio_codec_init(sii902x, dev); -+ ret = sii902x_audio_codec_init(sii902x, dev); -+ if (ret) -+ return ret; - - i2c_set_clientdata(sii902x->i2c, sii902x); - -@@ -1088,13 +1090,15 @@ static int sii902x_init(struct sii902x *sii902x) - 1, 0, I2C_MUX_GATE, - sii902x_i2c_bypass_select, - sii902x_i2c_bypass_deselect); -- if (!sii902x->i2cmux) -- return -ENOMEM; -+ if (!sii902x->i2cmux) { -+ ret = -ENOMEM; -+ goto err_unreg_audio; -+ } - - sii902x->i2cmux->priv = sii902x; - ret = i2c_mux_add_adapter(sii902x->i2cmux, 0, 0, 0); - if (ret) -- return ret; -+ goto err_unreg_audio; - - sii902x->bridge.funcs = &sii902x_bridge_funcs; - sii902x->bridge.of_node = dev->of_node; -@@ -1107,6 +1111,12 @@ static int sii902x_init(struct sii902x *sii902x) - drm_bridge_add(&sii902x->bridge); - - return 0; -+ -+err_unreg_audio: -+ if (!PTR_ERR_OR_ZERO(sii902x->audio.pdev)) -+ platform_device_unregister(sii902x->audio.pdev); -+ -+ return ret; - } - - static int sii902x_probe(struct i2c_client *client) -@@ -1179,6 +1189,9 @@ static void sii902x_remove(struct i2c_client *client) - - drm_bridge_remove(&sii902x->bridge); - i2c_mux_del_adapters(sii902x->i2cmux); -+ -+ if (!PTR_ERR_OR_ZERO(sii902x->audio.pdev)) -+ platform_device_unregister(sii902x->audio.pdev); - } - - static const struct of_device_id sii902x_dt_ids[] = { --- -2.43.2 - -From 5a3a33a18221e14b6368203970b07943e6ef6a1b Mon Sep 17 00:00:00 2001 -From: Pin-yen Lin <treapking@chromium.org> -Date: Tue, 9 Jan 2024 20:04:57 +0800 -Subject: [PATCH 0982/1501] drm/bridge: parade-ps8640: Ensure bridge is - suspended in .post_disable() -Content-Length: 2798 -Lines: 77 - -[ Upstream commit 26db46bc9c675e43230cc6accd110110a7654299 ] - -The ps8640 bridge seems to expect everything to be power cycled at the -disable process, but sometimes ps8640_aux_transfer() holds the runtime -PM reference and prevents the bridge from suspend. - -Prevent that by introducing a mutex lock between ps8640_aux_transfer() -and .post_disable() to make sure the bridge is really powered off. - -Fixes: 826cff3f7ebb ("drm/bridge: parade-ps8640: Enable runtime power management") -Signed-off-by: Pin-yen Lin <treapking@chromium.org> -Reviewed-by: Douglas Anderson <dianders@chromium.org> -Signed-off-by: Douglas Anderson <dianders@chromium.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20240109120528.1292601-1-treapking@chromium.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/bridge/parade-ps8640.c | 16 ++++++++++++++++ - 1 file changed, 16 insertions(+) - -diff --git a/drivers/gpu/drm/bridge/parade-ps8640.c b/drivers/gpu/drm/bridge/parade-ps8640.c -index fb5e9ae9ad81..166bfc725ef4 100644 ---- a/drivers/gpu/drm/bridge/parade-ps8640.c -+++ b/drivers/gpu/drm/bridge/parade-ps8640.c -@@ -107,6 +107,7 @@ struct ps8640 { - struct device_link *link; - bool pre_enabled; - bool need_post_hpd_delay; -+ struct mutex aux_lock; - }; - - static const struct regmap_config ps8640_regmap_config[] = { -@@ -345,6 +346,7 @@ static ssize_t ps8640_aux_transfer(struct drm_dp_aux *aux, - struct device *dev = &ps_bridge->page[PAGE0_DP_CNTL]->dev; - int ret; - -+ mutex_lock(&ps_bridge->aux_lock); - pm_runtime_get_sync(dev); - ret = _ps8640_wait_hpd_asserted(ps_bridge, 200 * 1000); - if (ret) { -@@ -354,6 +356,7 @@ static ssize_t ps8640_aux_transfer(struct drm_dp_aux *aux, - ret = ps8640_aux_transfer_msg(aux, msg); - pm_runtime_mark_last_busy(dev); - pm_runtime_put_autosuspend(dev); -+ mutex_unlock(&ps_bridge->aux_lock); - - return ret; - } -@@ -475,7 +478,18 @@ static void ps8640_atomic_post_disable(struct drm_bridge *bridge, - ps_bridge->pre_enabled = false; - - ps8640_bridge_vdo_control(ps_bridge, DISABLE); -+ -+ /* -+ * The bridge seems to expect everything to be power cycled at the -+ * disable process, so grab a lock here to make sure -+ * ps8640_aux_transfer() is not holding a runtime PM reference and -+ * preventing the bridge from suspend. -+ */ -+ mutex_lock(&ps_bridge->aux_lock); -+ - pm_runtime_put_sync_suspend(&ps_bridge->page[PAGE0_DP_CNTL]->dev); -+ -+ mutex_unlock(&ps_bridge->aux_lock); - } - - static int ps8640_bridge_attach(struct drm_bridge *bridge, -@@ -624,6 +638,8 @@ static int ps8640_probe(struct i2c_client *client) - if (!ps_bridge) - return -ENOMEM; - -+ mutex_init(&ps_bridge->aux_lock); -+ - ps_bridge->supplies[0].supply = "vdd12"; - ps_bridge->supplies[1].supply = "vdd33"; - ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(ps_bridge->supplies), --- -2.43.2 - -From 161f3651798bca0597f971766a631b5626f4238c Mon Sep 17 00:00:00 2001 -From: Douglas Anderson <dianders@chromium.org> -Date: Wed, 17 Jan 2024 10:35:03 -0800 -Subject: [PATCH 0983/1501] drm/bridge: parade-ps8640: Make sure we drop the - AUX mutex in the error case -Content-Length: 1381 -Lines: 37 - -[ Upstream commit a20f1b02bafcbf5a32d96a1d4185d6981cf7d016 ] - -After commit 26db46bc9c67 ("drm/bridge: parade-ps8640: Ensure bridge -is suspended in .post_disable()"), if we hit the error case in -ps8640_aux_transfer() then we return without dropping the mutex. Fix -this oversight. - -Fixes: 26db46bc9c67 ("drm/bridge: parade-ps8640: Ensure bridge is suspended in .post_disable()") -Reviewed-by: Hsin-Yi Wang <hsinyi@chromium.org> -Signed-off-by: Douglas Anderson <dianders@chromium.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20240117103502.1.Ib726a0184913925efc7e99c4d4fc801982e1bc24@changeid -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/bridge/parade-ps8640.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/bridge/parade-ps8640.c b/drivers/gpu/drm/bridge/parade-ps8640.c -index 166bfc725ef4..14d4dcf239da 100644 ---- a/drivers/gpu/drm/bridge/parade-ps8640.c -+++ b/drivers/gpu/drm/bridge/parade-ps8640.c -@@ -351,11 +351,13 @@ static ssize_t ps8640_aux_transfer(struct drm_dp_aux *aux, - ret = _ps8640_wait_hpd_asserted(ps_bridge, 200 * 1000); - if (ret) { - pm_runtime_put_sync_suspend(dev); -- return ret; -+ goto exit; - } - ret = ps8640_aux_transfer_msg(aux, msg); - pm_runtime_mark_last_busy(dev); - pm_runtime_put_autosuspend(dev); -+ -+exit: - mutex_unlock(&ps_bridge->aux_lock); - - return ret; --- -2.43.2 - -From 4101ba70a03a85700193ca9f93a793b7f444e03d Mon Sep 17 00:00:00 2001 -From: Yajun Deng <yajun.deng@linux.dev> -Date: Thu, 18 Jan 2024 14:18:53 +0800 -Subject: [PATCH 0984/1501] memblock: fix crash when reserved memory is not - added to memory -Content-Length: 1307 -Lines: 38 - -[ Upstream commit 6a9531c3a88096a26cf3ac582f7ec44f94a7dcb2 ] - -After commit 61167ad5fecd ("mm: pass nid to reserve_bootmem_region()") -nid of a reserved region is used by init_reserved_page() (with -CONFIG_DEFERRED_STRUCT_PAGE_INIT=y) to access node strucure. -In many cases the nid of the reserved memory is not set and this causes -a crash. - -When the nid of a reserved region is not set, fall back to -early_pfn_to_nid(), so that nid of the first_online_node will be passed -to init_reserved_page(). - -Fixes: 61167ad5fecd ("mm: pass nid to reserve_bootmem_region()") -Signed-off-by: Yajun Deng <yajun.deng@linux.dev> -Link: https://lore.kernel.org/r/20240118061853.2652295-1-yajun.deng@linux.dev -[rppt: massaged the commit message] -Signed-off-by: Mike Rapoport (IBM) <rppt@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - mm/memblock.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/mm/memblock.c b/mm/memblock.c -index 5a88d6d24d79..4823ad979b72 100644 ---- a/mm/memblock.c -+++ b/mm/memblock.c -@@ -2141,6 +2141,9 @@ static void __init memmap_init_reserved_pages(void) - start = region->base; - end = start + region->size; - -+ if (nid == NUMA_NO_NODE || nid >= MAX_NUMNODES) -+ nid = early_pfn_to_nid(PFN_DOWN(start)); -+ - reserve_bootmem_region(start, end, nid); - } - } --- -2.43.2 - -From 0745fef8a97d6a569c5c16353be9922d073c3bb0 Mon Sep 17 00:00:00 2001 -From: Sebastian Andrzej Siewior <bigeasy@linutronix.de> -Date: Thu, 18 Jan 2024 12:54:51 +0100 -Subject: [PATCH 0985/1501] futex: Prevent the reuse of stale pi_state -Content-Length: 5111 -Lines: 128 - -[ Upstream commit e626cb02ee8399fd42c415e542d031d185783903 ] - -Jiri Slaby reported a futex state inconsistency resulting in -EINVAL during -a lock operation for a PI futex. It requires that the a lock process is -interrupted by a timeout or signal: - - T1 Owns the futex in user space. - - T2 Tries to acquire the futex in kernel (futex_lock_pi()). Allocates a - pi_state and attaches itself to it. - - T2 Times out and removes its rt_waiter from the rt_mutex. Drops the - rtmutex lock and tries to acquire the hash bucket lock to remove - the futex_q. The lock is contended and T2 schedules out. - - T1 Unlocks the futex (futex_unlock_pi()). Finds a futex_q but no - rt_waiter. Unlocks the futex (do_uncontended) and makes it available - to user space. - - T3 Acquires the futex in user space. - - T4 Tries to acquire the futex in kernel (futex_lock_pi()). Finds the - existing futex_q of T2 and tries to attach itself to the existing - pi_state. This (attach_to_pi_state()) fails with -EINVAL because uval - contains the TID of T3 but pi_state points to T1. - -It's incorrect to unlock the futex and make it available for user space to -acquire as long as there is still an existing state attached to it in the -kernel. - -T1 cannot hand over the futex to T2 because T2 already gave up and started -to clean up and is blocked on the hash bucket lock, so T2's futex_q with -the pi_state pointing to T1 is still queued. - -T2 observes the futex_q, but ignores it as there is no waiter on the -corresponding rt_mutex and takes the uncontended path which allows the -subsequent caller of futex_lock_pi() (T4) to observe that stale state. - -To prevent this the unlock path must dequeue all futex_q entries which -point to the same pi_state when there is no waiter on the rt mutex. This -requires obviously to make the dequeue conditional in the locking path to -prevent a double dequeue. With that it's guaranteed that user space cannot -observe an uncontended futex which has kernel state attached. - -Fixes: fbeb558b0dd0d ("futex/pi: Fix recursive rt_mutex waiter state") -Reported-by: Jiri Slaby <jirislaby@kernel.org> -Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> -Signed-off-by: Thomas Gleixner <tglx@linutronix.de> -Tested-by: Jiri Slaby <jirislaby@kernel.org> -Link: https://lore.kernel.org/r/20240118115451.0TkD_ZhB@linutronix.de -Closes: https://lore.kernel.org/all/4611bcf2-44d0-4c34-9b84-17406f881003@kernel.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - kernel/futex/core.c | 15 ++++++++++++--- - kernel/futex/pi.c | 11 ++++++++--- - 2 files changed, 20 insertions(+), 6 deletions(-) - -diff --git a/kernel/futex/core.c b/kernel/futex/core.c -index dad981a865b8..52d0bf67e715 100644 ---- a/kernel/futex/core.c -+++ b/kernel/futex/core.c -@@ -626,12 +626,21 @@ int futex_unqueue(struct futex_q *q) - } - - /* -- * PI futexes can not be requeued and must remove themselves from the -- * hash bucket. The hash bucket lock (i.e. lock_ptr) is held. -+ * PI futexes can not be requeued and must remove themselves from the hash -+ * bucket. The hash bucket lock (i.e. lock_ptr) is held. - */ - void futex_unqueue_pi(struct futex_q *q) - { -- __futex_unqueue(q); -+ /* -+ * If the lock was not acquired (due to timeout or signal) then the -+ * rt_waiter is removed before futex_q is. If this is observed by -+ * an unlocker after dropping the rtmutex wait lock and before -+ * acquiring the hash bucket lock, then the unlocker dequeues the -+ * futex_q from the hash bucket list to guarantee consistent state -+ * vs. userspace. Therefore the dequeue here must be conditional. -+ */ -+ if (!plist_node_empty(&q->list)) -+ __futex_unqueue(q); - - BUG_ON(!q->pi_state); - put_pi_state(q->pi_state); -diff --git a/kernel/futex/pi.c b/kernel/futex/pi.c -index 90e5197f4e56..5722467f2737 100644 ---- a/kernel/futex/pi.c -+++ b/kernel/futex/pi.c -@@ -1135,6 +1135,7 @@ int futex_unlock_pi(u32 __user *uaddr, unsigned int flags) - - hb = futex_hash(&key); - spin_lock(&hb->lock); -+retry_hb: - - /* - * Check waiters first. We do not trust user space values at -@@ -1177,12 +1178,17 @@ int futex_unlock_pi(u32 __user *uaddr, unsigned int flags) - /* - * Futex vs rt_mutex waiter state -- if there are no rt_mutex - * waiters even though futex thinks there are, then the waiter -- * is leaving and the uncontended path is safe to take. -+ * is leaving. The entry needs to be removed from the list so a -+ * new futex_lock_pi() is not using this stale PI-state while -+ * the futex is available in user space again. -+ * There can be more than one task on its way out so it needs -+ * to retry. - */ - rt_waiter = rt_mutex_top_waiter(&pi_state->pi_mutex); - if (!rt_waiter) { -+ __futex_unqueue(top_waiter); - raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock); -- goto do_uncontended; -+ goto retry_hb; - } - - get_pi_state(pi_state); -@@ -1217,7 +1223,6 @@ int futex_unlock_pi(u32 __user *uaddr, unsigned int flags) - return ret; - } - --do_uncontended: - /* - * We have no kernel internal state, i.e. no waiters in the - * kernel. Waiters which are about to queue themselves are stuck --- -2.43.2 - -From dd25db729ae8431c04ad5bc14f1b3186aa168981 Mon Sep 17 00:00:00 2001 -From: Arnd Bergmann <arnd@arndb.de> -Date: Thu, 14 Dec 2023 13:32:15 +0100 -Subject: [PATCH 0986/1501] drm/exynos: fix accidental on-stack copy of - exynos_drm_plane -Content-Length: 2729 -Lines: 58 - -[ Upstream commit 960b537e91725bcb17dd1b19e48950e62d134078 ] - -gcc rightfully complains about excessive stack usage in the fimd_win_set_pixfmt() -function: - -drivers/gpu/drm/exynos/exynos_drm_fimd.c: In function 'fimd_win_set_pixfmt': -drivers/gpu/drm/exynos/exynos_drm_fimd.c:750:1: error: the frame size of 1032 bytes is larger than 1024 byte -drivers/gpu/drm/exynos/exynos5433_drm_decon.c: In function 'decon_win_set_pixfmt': -drivers/gpu/drm/exynos/exynos5433_drm_decon.c:381:1: error: the frame size of 1032 bytes is larger than 1024 bytes - -There is really no reason to copy the large exynos_drm_plane -structure to the stack before using one of its members, so just -use a pointer instead. - -Fixes: 6f8ee5c21722 ("drm/exynos: fimd: Make plane alpha configurable") -Signed-off-by: Arnd Bergmann <arnd@arndb.de> -Reviewed-by: Marek Szyprowski <m.szyprowski@samsung.com> -Signed-off-by: Inki Dae <inki.dae@samsung.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/exynos/exynos5433_drm_decon.c | 4 ++-- - drivers/gpu/drm/exynos/exynos_drm_fimd.c | 4 ++-- - 2 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c -index 4d986077738b..bce027552474 100644 ---- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c -+++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c -@@ -319,9 +319,9 @@ static void decon_win_set_bldmod(struct decon_context *ctx, unsigned int win, - static void decon_win_set_pixfmt(struct decon_context *ctx, unsigned int win, - struct drm_framebuffer *fb) - { -- struct exynos_drm_plane plane = ctx->planes[win]; -+ struct exynos_drm_plane *plane = &ctx->planes[win]; - struct exynos_drm_plane_state *state = -- to_exynos_plane_state(plane.base.state); -+ to_exynos_plane_state(plane->base.state); - unsigned int alpha = state->base.alpha; - unsigned int pixel_alpha; - unsigned long val; -diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c -index 8dde7b1e9b35..5bdc246f5fad 100644 ---- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c -+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c -@@ -661,9 +661,9 @@ static void fimd_win_set_bldmod(struct fimd_context *ctx, unsigned int win, - static void fimd_win_set_pixfmt(struct fimd_context *ctx, unsigned int win, - struct drm_framebuffer *fb, int width) - { -- struct exynos_drm_plane plane = ctx->planes[win]; -+ struct exynos_drm_plane *plane = &ctx->planes[win]; - struct exynos_drm_plane_state *state = -- to_exynos_plane_state(plane.base.state); -+ to_exynos_plane_state(plane->base.state); - uint32_t pixel_format = fb->format->format; - unsigned int alpha = state->base.alpha; - u32 val = WINCONx_ENWIN; --- -2.43.2 - -From 81499dc7be07888d976c38a184a85437772829d2 Mon Sep 17 00:00:00 2001 -From: Fedor Pchelkin <pchelkin@ispras.ru> -Date: Wed, 20 Dec 2023 12:53:15 +0300 -Subject: [PATCH 0987/1501] drm/exynos: gsc: minor fix for loop iteration in - gsc_runtime_resume -Content-Length: 1117 -Lines: 31 - -[ Upstream commit 4050957c7c2c14aa795dbf423b4180d5ac04e113 ] - -Do not forget to call clk_disable_unprepare() on the first element of -ctx->clocks array. - -Found by Linux Verification Center (linuxtesting.org). - -Fixes: 8b7d3ec83aba ("drm/exynos: gsc: Convert driver to IPP v2 core API") -Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> -Reviewed-by: Marek Szyprowski <m.szyprowski@samsung.com> -Signed-off-by: Inki Dae <inki.dae@samsung.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/exynos/exynos_drm_gsc.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c -index 34cdabc30b4f..5302bebbe38c 100644 ---- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c -+++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c -@@ -1342,7 +1342,7 @@ static int __maybe_unused gsc_runtime_resume(struct device *dev) - for (i = 0; i < ctx->num_clocks; i++) { - ret = clk_prepare_enable(ctx->clocks[i]); - if (ret) { -- while (--i > 0) -+ while (--i >= 0) - clk_disable_unprepare(ctx->clocks[i]); - return ret; - } --- -2.43.2 - -From e69b3a04b5b538f6974e1aec633b3fcb80737d0b Mon Sep 17 00:00:00 2001 -From: Cristian Marussi <cristian.marussi@arm.com> -Date: Mon, 8 Jan 2024 18:50:49 +0000 -Subject: [PATCH 0988/1501] firmware: arm_scmi: Use xa_insert() to store opps -Content-Length: 2626 -Lines: 67 - -[ Upstream commit e8ef4bbe39b9576a73f104f6af743fb9c7b624ba ] - -When storing opps by level or index use xa_insert() instead of xa_store() -and add error-checking to spot bad duplicates indexes possibly wrongly -provided by the platform firmware. - -Fixes: 31c7c1397a33 ("firmware: arm_scmi: Add v3.2 perf level indexing mode support") -Signed-off-by: Cristian Marussi <cristian.marussi@arm.com> -Link: https://lore.kernel.org/r/20240108185050.1628687-1-cristian.marussi@arm.com -Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/firmware/arm_scmi/perf.c | 23 ++++++++++++++++++----- - 1 file changed, 18 insertions(+), 5 deletions(-) - -diff --git a/drivers/firmware/arm_scmi/perf.c b/drivers/firmware/arm_scmi/perf.c -index e11555de99ab..d26eca37dc14 100644 ---- a/drivers/firmware/arm_scmi/perf.c -+++ b/drivers/firmware/arm_scmi/perf.c -@@ -347,8 +347,8 @@ process_response_opp(struct scmi_opp *opp, unsigned int loop_idx, - } - - static inline void --process_response_opp_v4(struct perf_dom_info *dom, struct scmi_opp *opp, -- unsigned int loop_idx, -+process_response_opp_v4(struct device *dev, struct perf_dom_info *dom, -+ struct scmi_opp *opp, unsigned int loop_idx, - const struct scmi_msg_resp_perf_describe_levels_v4 *r) - { - opp->perf = le32_to_cpu(r->opp[loop_idx].perf_val); -@@ -359,10 +359,23 @@ process_response_opp_v4(struct perf_dom_info *dom, struct scmi_opp *opp, - /* Note that PERF v4 reports always five 32-bit words */ - opp->indicative_freq = le32_to_cpu(r->opp[loop_idx].indicative_freq); - if (dom->level_indexing_mode) { -+ int ret; -+ - opp->level_index = le32_to_cpu(r->opp[loop_idx].level_index); - -- xa_store(&dom->opps_by_idx, opp->level_index, opp, GFP_KERNEL); -- xa_store(&dom->opps_by_lvl, opp->perf, opp, GFP_KERNEL); -+ ret = xa_insert(&dom->opps_by_idx, opp->level_index, opp, -+ GFP_KERNEL); -+ if (ret) -+ dev_warn(dev, -+ "Failed to add opps_by_idx at %d - ret:%d\n", -+ opp->level_index, ret); -+ -+ ret = xa_insert(&dom->opps_by_lvl, opp->perf, opp, GFP_KERNEL); -+ if (ret) -+ dev_warn(dev, -+ "Failed to add opps_by_lvl at %d - ret:%d\n", -+ opp->perf, ret); -+ - hash_add(dom->opps_by_freq, &opp->hash, opp->indicative_freq); - } - } -@@ -379,7 +392,7 @@ iter_perf_levels_process_response(const struct scmi_protocol_handle *ph, - if (PROTOCOL_REV_MAJOR(p->version) <= 0x3) - process_response_opp(opp, st->loop_idx, response); - else -- process_response_opp_v4(p->perf_dom, opp, st->loop_idx, -+ process_response_opp_v4(ph->dev, p->perf_dom, opp, st->loop_idx, - response); - p->perf_dom->opp_count++; - --- -2.43.2 - -From 8d35f33c199c3ec7bd1b1e6ece3d99cbf4e63427 Mon Sep 17 00:00:00 2001 -From: Cristian Marussi <cristian.marussi@arm.com> -Date: Mon, 8 Jan 2024 18:50:50 +0000 -Subject: [PATCH 0989/1501] firmware: arm_scmi: Use xa_insert() when saving raw - queues -Content-Length: 1827 -Lines: 57 - -[ Upstream commit b5dc0ffd36560dbadaed9a3d9fd7838055d62d74 ] - -Use xa_insert() when saving per-channel raw queues to better check for -duplicates. - -Fixes: 7860701d1e6e ("firmware: arm_scmi: Add per-channel raw injection support") -Signed-off-by: Cristian Marussi <cristian.marussi@arm.com> -Link: https://lore.kernel.org/r/20240108185050.1628687-2-cristian.marussi@arm.com -Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/firmware/arm_scmi/raw_mode.c | 12 ++++++++---- - 1 file changed, 8 insertions(+), 4 deletions(-) - -diff --git a/drivers/firmware/arm_scmi/raw_mode.c b/drivers/firmware/arm_scmi/raw_mode.c -index 0493aa3c12bf..350573518503 100644 ---- a/drivers/firmware/arm_scmi/raw_mode.c -+++ b/drivers/firmware/arm_scmi/raw_mode.c -@@ -1111,7 +1111,6 @@ static int scmi_raw_mode_setup(struct scmi_raw_mode_info *raw, - int i; - - for (i = 0; i < num_chans; i++) { -- void *xret; - struct scmi_raw_queue *q; - - q = scmi_raw_queue_init(raw); -@@ -1120,13 +1119,12 @@ static int scmi_raw_mode_setup(struct scmi_raw_mode_info *raw, - goto err_xa; - } - -- xret = xa_store(&raw->chans_q, channels[i], q, -+ ret = xa_insert(&raw->chans_q, channels[i], q, - GFP_KERNEL); -- if (xa_err(xret)) { -+ if (ret) { - dev_err(dev, - "Fail to allocate Raw queue 0x%02X\n", - channels[i]); -- ret = xa_err(xret); - goto err_xa; - } - } -@@ -1322,6 +1320,12 @@ void scmi_raw_message_report(void *r, struct scmi_xfer *xfer, - dev = raw->handle->dev; - q = scmi_raw_queue_select(raw, idx, - SCMI_XFER_IS_CHAN_SET(xfer) ? chan_id : 0); -+ if (!q) { -+ dev_warn(dev, -+ "RAW[%d] - NO queue for chan 0x%X. Dropping report.\n", -+ idx, chan_id); -+ return; -+ } - - /* - * Grab the msg_q_lock upfront to avoid a possible race between --- -2.43.2 - -From 1e651b30824789076c3288438c5290b67a3b44d6 Mon Sep 17 00:00:00 2001 -From: Cristian Marussi <cristian.marussi@arm.com> -Date: Tue, 9 Jan 2024 15:01:06 +0000 -Subject: [PATCH 0990/1501] firmware: arm_scmi: Fix the clock protocol version - for v3.2 -Content-Length: 1435 -Lines: 35 - -[ Upstream commit 27600c96e2ffa6c1b2cb378ddc75c6620c628d04 ] - -The clock protocol version as per the SCMI v3.2 specification is 0x30000. -Enable the v3.0 clock protocol features only when clock protocol version -equals 0x30000. - -The previous beta version of the spec had this value set to 0x20001 and -th same value trickled down from the initial development. The version -update were missed in the driver. - -Fixes: e49e314a2cf7 ("firmware: arm_scmi: Add clock v3.2 CONFIG_SET support") -Signed-off-by: Cristian Marussi <cristian.marussi@arm.com> -Link: https://lore.kernel.org/r/20240109150106.2066739-1-cristian.marussi@arm.com -Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/firmware/arm_scmi/clock.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/drivers/firmware/arm_scmi/clock.c b/drivers/firmware/arm_scmi/clock.c -index 42b81c181d68..96b4f0694fed 100644 ---- a/drivers/firmware/arm_scmi/clock.c -+++ b/drivers/firmware/arm_scmi/clock.c -@@ -951,8 +951,7 @@ static int scmi_clock_protocol_init(const struct scmi_protocol_handle *ph) - scmi_clock_describe_rates_get(ph, clkid, clk); - } - -- if (PROTOCOL_REV_MAJOR(version) >= 0x2 && -- PROTOCOL_REV_MINOR(version) >= 0x1) { -+ if (PROTOCOL_REV_MAJOR(version) >= 0x3) { - cinfo->clock_config_set = scmi_clock_config_set_v2; - cinfo->clock_config_get = scmi_clock_config_get_v2; - } else { --- -2.43.2 - -From 895d16d6eb66d2f022455700ba8bb8bbb046d02b Mon Sep 17 00:00:00 2001 -From: Cristian Marussi <cristian.marussi@arm.com> -Date: Mon, 8 Jan 2024 12:34:11 +0000 -Subject: [PATCH 0991/1501] firmware: arm_ffa: Add missing rwlock_init() in - ffa_setup_partitions() -Content-Length: 1046 -Lines: 28 - -[ Upstream commit 59b2e242b13192e50bf47df3780bf8a7e2260e98 ] - -Add the missing rwlock initialization for the individual FF-A partition -information in ffa_setup_partitions(). - -Fixes: 0184450b8b1e ("firmware: arm_ffa: Add schedule receiver callback mechanism") -Signed-off-by: Cristian Marussi <cristian.marussi@arm.com> -Link: https://lore.kernel.org/r/20240108-ffa_fixes_6-8-v1-1-75bf7035bc50@arm.com -Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/firmware/arm_ffa/driver.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c -index 6146b2927d5c..ed1d6a24934e 100644 ---- a/drivers/firmware/arm_ffa/driver.c -+++ b/drivers/firmware/arm_ffa/driver.c -@@ -1226,6 +1226,7 @@ static void ffa_setup_partitions(void) - ffa_device_unregister(ffa_dev); - continue; - } -+ rwlock_init(&info->rw_lock); - xa_store(&drv_info->partition_info, tpbuf->id, info, GFP_KERNEL); - } - drv_info->partition_count = count; --- -2.43.2 - -From 39cd62bf8c11a85919e1e3ca3d4c4e2adc4ba7d1 Mon Sep 17 00:00:00 2001 -From: Cristian Marussi <cristian.marussi@arm.com> -Date: Mon, 8 Jan 2024 12:34:12 +0000 -Subject: [PATCH 0992/1501] firmware: arm_ffa: Add missing rwlock_init() for - the driver partition -Content-Length: 1223 -Lines: 30 - -[ Upstream commit 5ff30ade16cd9efc2466d3ea22bbaf370772941a ] - -Add the missing rwlock initialization for the FF-A partition associated -the driver in ffa_setup_partitions(). It will the primary scheduler -partition in the host or the VM partition in the virtualised environment. -IOW, it corresponds to the partition with VM ID == drv_info->vm_id. - -Fixes: 1b6bf41b7a65 ("firmware: arm_ffa: Add notification handling mechanism") -Signed-off-by: Cristian Marussi <cristian.marussi@arm.com> -Link: https://lore.kernel.org/r/20240108-ffa_fixes_6-8-v1-2-75bf7035bc50@arm.com -Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/firmware/arm_ffa/driver.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c -index ed1d6a24934e..8df92c9521f4 100644 ---- a/drivers/firmware/arm_ffa/driver.c -+++ b/drivers/firmware/arm_ffa/driver.c -@@ -1237,6 +1237,7 @@ static void ffa_setup_partitions(void) - info = kzalloc(sizeof(*info), GFP_KERNEL); - if (!info) - return; -+ rwlock_init(&info->rw_lock); - xa_store(&drv_info->partition_info, drv_info->vm_id, info, GFP_KERNEL); - drv_info->partition_count++; - } --- -2.43.2 - -From 26ef46b731576387fa56e9aafb6ccb75cf1d6cfd Mon Sep 17 00:00:00 2001 -From: Cristian Marussi <cristian.marussi@arm.com> -Date: Mon, 8 Jan 2024 12:34:13 +0000 -Subject: [PATCH 0993/1501] firmware: arm_ffa: Check xa_load() return value -Content-Length: 1658 -Lines: 46 - -[ Upstream commit c00d9738fd5fce15dc5494d05b7599dce23e8146 ] - -Add a check to verify the result of xa_load() during the partition -lookups done while registering/unregistering the scheduler receiver -interrupt callbacks and while executing the main scheduler receiver -interrupt callback handler. - -Fixes: 0184450b8b1e ("firmware: arm_ffa: Add schedule receiver callback mechanism") -Signed-off-by: Cristian Marussi <cristian.marussi@arm.com> -Link: https://lore.kernel.org/r/20240108-ffa_fixes_6-8-v1-3-75bf7035bc50@arm.com -Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/firmware/arm_ffa/driver.c | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c -index 8df92c9521f4..0ea1dd6e55c4 100644 ---- a/drivers/firmware/arm_ffa/driver.c -+++ b/drivers/firmware/arm_ffa/driver.c -@@ -733,6 +733,11 @@ static void __do_sched_recv_cb(u16 part_id, u16 vcpu, bool is_per_vcpu) - void *cb_data; - - partition = xa_load(&drv_info->partition_info, part_id); -+ if (!partition) { -+ pr_err("%s: Invalid partition ID 0x%x\n", __func__, part_id); -+ return; -+ } -+ - read_lock(&partition->rw_lock); - callback = partition->callback; - cb_data = partition->cb_data; -@@ -915,6 +920,11 @@ static int ffa_sched_recv_cb_update(u16 part_id, ffa_sched_recv_cb callback, - return -EOPNOTSUPP; - - partition = xa_load(&drv_info->partition_info, part_id); -+ if (!partition) { -+ pr_err("%s: Invalid partition ID 0x%x\n", __func__, part_id); -+ return -EINVAL; -+ } -+ - write_lock(&partition->rw_lock); - - cb_valid = !!partition->callback; --- -2.43.2 - -From 549b755efa423ca73ba21cbb8eff89a06c30250a Mon Sep 17 00:00:00 2001 -From: Armin Wolf <W_Armin@gmx.de> -Date: Wed, 3 Jan 2024 20:27:04 +0100 -Subject: [PATCH 0994/1501] platform/x86: wmi: Fix error handling in legacy WMI - notify handler functions -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2285 -Lines: 66 - -[ Upstream commit 6ba7843b59b77360812617d071313c7f35f3757a ] - -When wmi_install_notify_handler()/wmi_remove_notify_handler() are -unable to enable/disable the WMI device, they unconditionally return -an error to the caller. -When registering legacy WMI notify handlers, this means that the -callback remains registered despite wmi_install_notify_handler() -having returned an error. -When removing legacy WMI notify handlers, this means that the -callback is removed despite wmi_remove_notify_handler() having -returned an error. - -Fix this by only warning when the WMI device could not be enabled. -This behaviour matches the bus-based WMI interface. - -Tested on a Dell Inspiron 3505 and a Acer Aspire E1-731. - -Fixes: 58f6425eb92f ("WMI: Cater for multiple events with same GUID") -Signed-off-by: Armin Wolf <W_Armin@gmx.de> -Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> -Reviewed-by: Hans de Goede <hdegoede@redhat.com> -Link: https://lore.kernel.org/r/20240103192707.115512-2-W_Armin@gmx.de -Signed-off-by: Hans de Goede <hdegoede@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/platform/x86/wmi.c | 16 +++++++++------- - 1 file changed, 9 insertions(+), 7 deletions(-) - -diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c -index 5dd22258cb3b..bd017478e61b 100644 ---- a/drivers/platform/x86/wmi.c -+++ b/drivers/platform/x86/wmi.c -@@ -686,9 +686,10 @@ acpi_status wmi_install_notify_handler(const char *guid, - block->handler_data = data; - - wmi_status = wmi_method_enable(block, true); -- if ((wmi_status != AE_OK) || -- ((wmi_status == AE_OK) && (status == AE_NOT_EXIST))) -- status = wmi_status; -+ if (ACPI_FAILURE(wmi_status)) -+ dev_warn(&block->dev.dev, "Failed to enable device\n"); -+ -+ status = AE_OK; - } - } - -@@ -729,12 +730,13 @@ acpi_status wmi_remove_notify_handler(const char *guid) - status = AE_OK; - } else { - wmi_status = wmi_method_enable(block, false); -+ if (ACPI_FAILURE(wmi_status)) -+ dev_warn(&block->dev.dev, "Failed to disable device\n"); -+ - block->handler = NULL; - block->handler_data = NULL; -- if ((wmi_status != AE_OK) || -- ((wmi_status == AE_OK) && -- (status == AE_NOT_EXIST))) -- status = wmi_status; -+ -+ status = AE_OK; - } - } - } --- -2.43.2 - -From 32515e64a525feedd734a6e2eb7255d0a199932d Mon Sep 17 00:00:00 2001 -From: Wenhua Lin <Wenhua.Lin@unisoc.com> -Date: Tue, 9 Jan 2024 15:38:48 +0800 -Subject: [PATCH 0995/1501] gpio: eic-sprd: Clear interrupt after set the - interrupt type -Content-Length: 6233 -Lines: 152 - -[ Upstream commit 84aef4ed59705585d629e81d633a83b7d416f5fb ] - -The raw interrupt status of eic maybe set before the interrupt is enabled, -since the eic interrupt has a latch function, which would trigger the -interrupt event once enabled it from user side. To solve this problem, -interrupts generated before setting the interrupt trigger type are ignored. - -Fixes: 25518e024e3a ("gpio: Add Spreadtrum EIC driver support") -Acked-by: Chunyan Zhang <zhang.lyra@gmail.com> -Signed-off-by: Wenhua Lin <Wenhua.Lin@unisoc.com> -Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpio/gpio-eic-sprd.c | 32 ++++++++++++++++++++++++++++---- - 1 file changed, 28 insertions(+), 4 deletions(-) - -diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c -index be7f2fa5aa7b..806b88d8dfb7 100644 ---- a/drivers/gpio/gpio-eic-sprd.c -+++ b/drivers/gpio/gpio-eic-sprd.c -@@ -330,20 +330,27 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type) - switch (flow_type) { - case IRQ_TYPE_LEVEL_HIGH: - sprd_eic_update(chip, offset, SPRD_EIC_DBNC_IEV, 1); -+ sprd_eic_update(chip, offset, SPRD_EIC_DBNC_IC, 1); - break; - case IRQ_TYPE_LEVEL_LOW: - sprd_eic_update(chip, offset, SPRD_EIC_DBNC_IEV, 0); -+ sprd_eic_update(chip, offset, SPRD_EIC_DBNC_IC, 1); - break; - case IRQ_TYPE_EDGE_RISING: - case IRQ_TYPE_EDGE_FALLING: - case IRQ_TYPE_EDGE_BOTH: - state = sprd_eic_get(chip, offset); -- if (state) -+ if (state) { - sprd_eic_update(chip, offset, - SPRD_EIC_DBNC_IEV, 0); -- else -+ sprd_eic_update(chip, offset, -+ SPRD_EIC_DBNC_IC, 1); -+ } else { - sprd_eic_update(chip, offset, - SPRD_EIC_DBNC_IEV, 1); -+ sprd_eic_update(chip, offset, -+ SPRD_EIC_DBNC_IC, 1); -+ } - break; - default: - return -ENOTSUPP; -@@ -355,20 +362,27 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type) - switch (flow_type) { - case IRQ_TYPE_LEVEL_HIGH: - sprd_eic_update(chip, offset, SPRD_EIC_LATCH_INTPOL, 0); -+ sprd_eic_update(chip, offset, SPRD_EIC_LATCH_INTCLR, 1); - break; - case IRQ_TYPE_LEVEL_LOW: - sprd_eic_update(chip, offset, SPRD_EIC_LATCH_INTPOL, 1); -+ sprd_eic_update(chip, offset, SPRD_EIC_LATCH_INTCLR, 1); - break; - case IRQ_TYPE_EDGE_RISING: - case IRQ_TYPE_EDGE_FALLING: - case IRQ_TYPE_EDGE_BOTH: - state = sprd_eic_get(chip, offset); -- if (state) -+ if (state) { - sprd_eic_update(chip, offset, - SPRD_EIC_LATCH_INTPOL, 0); -- else -+ sprd_eic_update(chip, offset, -+ SPRD_EIC_LATCH_INTCLR, 1); -+ } else { - sprd_eic_update(chip, offset, - SPRD_EIC_LATCH_INTPOL, 1); -+ sprd_eic_update(chip, offset, -+ SPRD_EIC_LATCH_INTCLR, 1); -+ } - break; - default: - return -ENOTSUPP; -@@ -382,29 +396,34 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type) - sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 0); - sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 0); - sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTPOL, 1); -+ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTCLR, 1); - irq_set_handler_locked(data, handle_edge_irq); - break; - case IRQ_TYPE_EDGE_FALLING: - sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 0); - sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 0); - sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTPOL, 0); -+ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTCLR, 1); - irq_set_handler_locked(data, handle_edge_irq); - break; - case IRQ_TYPE_EDGE_BOTH: - sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 0); - sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 1); -+ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTCLR, 1); - irq_set_handler_locked(data, handle_edge_irq); - break; - case IRQ_TYPE_LEVEL_HIGH: - sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 0); - sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 1); - sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTPOL, 1); -+ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTCLR, 1); - irq_set_handler_locked(data, handle_level_irq); - break; - case IRQ_TYPE_LEVEL_LOW: - sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 0); - sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 1); - sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTPOL, 0); -+ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTCLR, 1); - irq_set_handler_locked(data, handle_level_irq); - break; - default: -@@ -417,29 +436,34 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type) - sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTBOTH, 0); - sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTMODE, 0); - sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTPOL, 1); -+ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTCLR, 1); - irq_set_handler_locked(data, handle_edge_irq); - break; - case IRQ_TYPE_EDGE_FALLING: - sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTBOTH, 0); - sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTMODE, 0); - sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTPOL, 0); -+ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTCLR, 1); - irq_set_handler_locked(data, handle_edge_irq); - break; - case IRQ_TYPE_EDGE_BOTH: - sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTMODE, 0); - sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTBOTH, 1); -+ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTCLR, 1); - irq_set_handler_locked(data, handle_edge_irq); - break; - case IRQ_TYPE_LEVEL_HIGH: - sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTBOTH, 0); - sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTMODE, 1); - sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTPOL, 1); -+ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTCLR, 1); - irq_set_handler_locked(data, handle_level_irq); - break; - case IRQ_TYPE_LEVEL_LOW: - sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTBOTH, 0); - sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTMODE, 1); - sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTPOL, 0); -+ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTCLR, 1); - irq_set_handler_locked(data, handle_level_irq); - break; - default: --- -2.43.2 - -From c34b46598069fa3439c253fdae756d6062c0f314 Mon Sep 17 00:00:00 2001 -From: Shravan Kumar Ramani <shravankr@nvidia.com> -Date: Wed, 17 Jan 2024 05:01:34 -0500 -Subject: [PATCH 0997/1501] platform/mellanox: mlxbf-pmc: Fix offset - calculation for crspace events -Content-Length: 1619 -Lines: 40 - -[ Upstream commit 732c35ce6d4892f7b07cc9aca61a6ad0fd400a26 ] - -The event selector fields for 2 counters are contained in one -32-bit register and the current logic does not account for this. - -Fixes: 423c3361855c ("platform/mellanox: mlxbf-pmc: Add support for BlueField-3") -Signed-off-by: Shravan Kumar Ramani <shravankr@nvidia.com> -Reviewed-by: David Thompson <davthompson@nvidia.com> -Reviewed-by: Vadim Pasternak <vadimp@nvidia.com> -Link: https://lore.kernel.org/r/8834cfa496c97c7c2fcebcfca5a2aa007e20ae96.1705485095.git.shravankr@nvidia.com -Signed-off-by: Hans de Goede <hdegoede@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/platform/mellanox/mlxbf-pmc.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c -index 1dd84c7a79de..b1995ac268d7 100644 ---- a/drivers/platform/mellanox/mlxbf-pmc.c -+++ b/drivers/platform/mellanox/mlxbf-pmc.c -@@ -1170,7 +1170,7 @@ static int mlxbf_pmc_program_crspace_counter(int blk_num, uint32_t cnt_num, - int ret; - - addr = pmc->block[blk_num].mmio_base + -- (rounddown(cnt_num, 2) * MLXBF_PMC_CRSPACE_PERFSEL_SZ); -+ ((cnt_num / 2) * MLXBF_PMC_CRSPACE_PERFSEL_SZ); - ret = mlxbf_pmc_readl(addr, &word); - if (ret) - return ret; -@@ -1413,7 +1413,7 @@ static int mlxbf_pmc_read_crspace_event(int blk_num, uint32_t cnt_num, - int ret; - - addr = pmc->block[blk_num].mmio_base + -- (rounddown(cnt_num, 2) * MLXBF_PMC_CRSPACE_PERFSEL_SZ); -+ ((cnt_num / 2) * MLXBF_PMC_CRSPACE_PERFSEL_SZ); - ret = mlxbf_pmc_readl(addr, &word); - if (ret) - return ret; --- -2.43.2 - -From 821acbb1dffbf830685e3333461b57cb4d849c7b Mon Sep 17 00:00:00 2001 -From: Mika Westerberg <mika.westerberg@linux.intel.com> -Date: Mon, 22 Jan 2024 14:00:33 +0200 -Subject: [PATCH 0998/1501] spi: intel-pci: Remove Meteor Lake-S SoC PCI ID - from the list -Content-Length: 1286 -Lines: 30 - -[ Upstream commit 6c314425b9ef6b247cefd0903e287eb072580c3b ] - -Turns out this "SoC" side controller does not support certain commands, -such as reading chip JEDEC ID, so the controller is pretty much unusable -in Linux. We should be using the "PCH" side controller instead. For this -reason remove this PCI ID from the list. - -Fixes: c2912d42e86e ("spi: intel-pci: Add support for Meteor Lake-S SPI serial flash") -Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com> -Link: https://msgid.link/r/20240122120034.2664812-2-mika.westerberg@linux.intel.com -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/spi/spi-intel-pci.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/drivers/spi/spi-intel-pci.c b/drivers/spi/spi-intel-pci.c -index 57d767a68e7b..b9918dcc3802 100644 ---- a/drivers/spi/spi-intel-pci.c -+++ b/drivers/spi/spi-intel-pci.c -@@ -84,7 +84,6 @@ static const struct pci_device_id intel_spi_pci_ids[] = { - { PCI_VDEVICE(INTEL, 0xa2a4), (unsigned long)&cnl_info }, - { PCI_VDEVICE(INTEL, 0xa324), (unsigned long)&cnl_info }, - { PCI_VDEVICE(INTEL, 0xa3a4), (unsigned long)&cnl_info }, -- { PCI_VDEVICE(INTEL, 0xae23), (unsigned long)&cnl_info }, - { }, - }; - MODULE_DEVICE_TABLE(pci, intel_spi_pci_ids); --- -2.43.2 - -From 0e29e13c4fb3c5d0b201f29a696ba71ce9644b5c Mon Sep 17 00:00:00 2001 -From: Li Lingfeng <lilingfeng3@huawei.com> -Date: Thu, 18 Jan 2024 21:04:01 +0800 -Subject: [PATCH 0999/1501] block: Move checking GENHD_FL_NO_PART to - bdev_add_partition() -Content-Length: 1932 -Lines: 52 - -[ Upstream commit 7777f47f2ea64efd1016262e7b59fab34adfb869 ] - -Commit 1a721de8489f ("block: don't add or resize partition on the disk -with GENHD_FL_NO_PART") prevented all operations about partitions on disks -with GENHD_FL_NO_PART in blkpg_do_ioctl() since they are meaningless. -However, it changed error code in some scenarios. So move checking -GENHD_FL_NO_PART to bdev_add_partition() to eliminate impact. - -Fixes: 1a721de8489f ("block: don't add or resize partition on the disk with GENHD_FL_NO_PART") -Reported-by: Allison Karlitskaya <allison.karlitskaya@redhat.com> -Closes: https://lore.kernel.org/all/CAOYeF9VsmqKMcQjo1k6YkGNujwN-nzfxY17N3F-CMikE1tYp+w@mail.gmail.com/ -Signed-off-by: Li Lingfeng <lilingfeng3@huawei.com> -Reviewed-by: Yu Kuai <yukuai3@huawei.com> -Link: https://lore.kernel.org/r/20240118130401.792757-1-lilingfeng@huaweicloud.com -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - block/ioctl.c | 2 -- - block/partitions/core.c | 5 +++++ - 2 files changed, 5 insertions(+), 2 deletions(-) - -diff --git a/block/ioctl.c b/block/ioctl.c -index 9c73a763ef88..438f79c564cf 100644 ---- a/block/ioctl.c -+++ b/block/ioctl.c -@@ -20,8 +20,6 @@ static int blkpg_do_ioctl(struct block_device *bdev, - struct blkpg_partition p; - sector_t start, length; - -- if (disk->flags & GENHD_FL_NO_PART) -- return -EINVAL; - if (!capable(CAP_SYS_ADMIN)) - return -EACCES; - if (copy_from_user(&p, upart, sizeof(struct blkpg_partition))) -diff --git a/block/partitions/core.c b/block/partitions/core.c -index f47ffcfdfcec..f14602022c5e 100644 ---- a/block/partitions/core.c -+++ b/block/partitions/core.c -@@ -447,6 +447,11 @@ int bdev_add_partition(struct gendisk *disk, int partno, sector_t start, - goto out; - } - -+ if (disk->flags & GENHD_FL_NO_PART) { -+ ret = -EINVAL; -+ goto out; -+ } -+ - if (partition_overlaps(disk, start, length, -1)) { - ret = -EBUSY; - goto out; --- -2.43.2 - -From c44ec974b4d15fcf426770f1f3a91a3f09a41594 Mon Sep 17 00:00:00 2001 -From: Hsin-Yi Wang <hsinyi@chromium.org> -Date: Wed, 17 Jan 2024 17:58:14 -0800 -Subject: [PATCH 1000/1501] drm/bridge: anx7625: Ensure bridge is suspended in - disable() -Content-Length: 3040 -Lines: 78 - -[ Upstream commit 4d5b7daa3c610af3f322ad1e91fc0c752ff32f0e ] - -Similar to commit 26db46bc9c67 ("drm/bridge: parade-ps8640: Ensure bridge -is suspended in .post_disable()"). Add a mutex to ensure that aux transfer -won't race with atomic_disable by holding the PM reference and prevent -the bridge from suspend. - -Also we need to use pm_runtime_put_sync_suspend() to suspend the bridge -instead of idle with pm_runtime_put_sync(). - -Fixes: 3203e497eb76 ("drm/bridge: anx7625: Synchronously run runtime suspend.") -Fixes: adca62ec370c ("drm/bridge: anx7625: Support reading edid through aux channel") -Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org> -Tested-by: Xuxin Xiong <xuxinxiong@huaqin.corp-partner.google.com> -Reviewed-by: Pin-yen Lin <treapking@chromium.org> -Reviewed-by: Douglas Anderson <dianders@chromium.org> -Signed-off-by: Douglas Anderson <dianders@chromium.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20240118015916.2296741-1-hsinyi@chromium.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/bridge/analogix/anx7625.c | 7 ++++++- - drivers/gpu/drm/bridge/analogix/anx7625.h | 2 ++ - 2 files changed, 8 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c -index 51abe42c639e..5168628f11cf 100644 ---- a/drivers/gpu/drm/bridge/analogix/anx7625.c -+++ b/drivers/gpu/drm/bridge/analogix/anx7625.c -@@ -1741,6 +1741,7 @@ static ssize_t anx7625_aux_transfer(struct drm_dp_aux *aux, - u8 request = msg->request & ~DP_AUX_I2C_MOT; - int ret = 0; - -+ mutex_lock(&ctx->aux_lock); - pm_runtime_get_sync(dev); - msg->reply = 0; - switch (request) { -@@ -1757,6 +1758,7 @@ static ssize_t anx7625_aux_transfer(struct drm_dp_aux *aux, - msg->size, msg->buffer); - pm_runtime_mark_last_busy(dev); - pm_runtime_put_autosuspend(dev); -+ mutex_unlock(&ctx->aux_lock); - - return ret; - } -@@ -2453,7 +2455,9 @@ static void anx7625_bridge_atomic_disable(struct drm_bridge *bridge, - ctx->connector = NULL; - anx7625_dp_stop(ctx); - -- pm_runtime_put_sync(dev); -+ mutex_lock(&ctx->aux_lock); -+ pm_runtime_put_sync_suspend(dev); -+ mutex_unlock(&ctx->aux_lock); - } - - static enum drm_connector_status -@@ -2647,6 +2651,7 @@ static int anx7625_i2c_probe(struct i2c_client *client) - - mutex_init(&platform->lock); - mutex_init(&platform->hdcp_wq_lock); -+ mutex_init(&platform->aux_lock); - - INIT_DELAYED_WORK(&platform->hdcp_work, hdcp_check_work_func); - platform->hdcp_workqueue = create_workqueue("hdcp workqueue"); -diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.h b/drivers/gpu/drm/bridge/analogix/anx7625.h -index 5af819611ebc..80d3fb4e985f 100644 ---- a/drivers/gpu/drm/bridge/analogix/anx7625.h -+++ b/drivers/gpu/drm/bridge/analogix/anx7625.h -@@ -471,6 +471,8 @@ struct anx7625_data { - struct workqueue_struct *hdcp_workqueue; - /* Lock for hdcp work queue */ - struct mutex hdcp_wq_lock; -+ /* Lock for aux transfer and disable */ -+ struct mutex aux_lock; - char edid_block; - struct display_timing dt; - u8 display_timing_valid; --- -2.43.2 - -From c794cc65bb3eef3142bbecd48f1fd43f1fa8d478 Mon Sep 17 00:00:00 2001 -From: Mario Limonciello <mario.limonciello@amd.com> -Date: Fri, 19 Jan 2024 05:33:19 -0600 -Subject: [PATCH 1001/1501] cpufreq/amd-pstate: Fix setting scaling max/min - freq values -Content-Length: 1649 -Lines: 39 - -[ Upstream commit 22fb4f041999f5f16ecbda15a2859b4ef4cbf47e ] - -Scaling min/max freq values were being cached and lagging a setting -each time. Fix the ordering of the clamp call to ensure they work. - -Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217931 -Fixes: febab20caeba ("cpufreq/amd-pstate: Fix scaling_min_freq and scaling_max_freq update") -Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> -Reviewed-by: Wyes Karny <wkarny@gmail.com> -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/cpufreq/amd-pstate.c | 7 +++---- - 1 file changed, 3 insertions(+), 4 deletions(-) - -diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c -index 1f6186475715..1791d37fbc53 100644 ---- a/drivers/cpufreq/amd-pstate.c -+++ b/drivers/cpufreq/amd-pstate.c -@@ -1232,14 +1232,13 @@ static void amd_pstate_epp_update_limit(struct cpufreq_policy *policy) - max_limit_perf = div_u64(policy->max * cpudata->highest_perf, cpudata->max_freq); - min_limit_perf = div_u64(policy->min * cpudata->highest_perf, cpudata->max_freq); - -+ WRITE_ONCE(cpudata->max_limit_perf, max_limit_perf); -+ WRITE_ONCE(cpudata->min_limit_perf, min_limit_perf); -+ - max_perf = clamp_t(unsigned long, max_perf, cpudata->min_limit_perf, - cpudata->max_limit_perf); - min_perf = clamp_t(unsigned long, min_perf, cpudata->min_limit_perf, - cpudata->max_limit_perf); -- -- WRITE_ONCE(cpudata->max_limit_perf, max_limit_perf); -- WRITE_ONCE(cpudata->min_limit_perf, min_limit_perf); -- - value = READ_ONCE(cpudata->cppc_req_cached); - - if (cpudata->policy == CPUFREQ_POLICY_PERFORMANCE) --- -2.43.2 - -From aa1408093e378d8d951550d8514b0b23a21d702a Mon Sep 17 00:00:00 2001 -From: Kamal Dasu <kamal.dasu@broadcom.com> -Date: Tue, 9 Jan 2024 16:00:32 -0500 -Subject: [PATCH 1002/1501] spi: bcm-qspi: fix SFDP BFPT read by usig mspi read -Content-Length: 1555 -Lines: 41 - -[ Upstream commit 574bf7bbe83794a902679846770f75a9b7f28176 ] - -SFDP read shall use the mspi reads when using the bcm_qspi_exec_mem_op() -call. This fixes SFDP parameter page read failures seen with parts that -now use SFDP protocol to read the basic flash parameter table. - -Fixes: 5f195ee7d830 ("spi: bcm-qspi: Implement the spi_mem interface") -Signed-off-by: Kamal Dasu <kamal.dasu@broadcom.com> -Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> -Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> -Link: https://msgid.link/r/20240109210033.43249-1-kamal.dasu@broadcom.com -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/spi/spi-bcm-qspi.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c -index ef08fcac2f6d..0407b91183ca 100644 ---- a/drivers/spi/spi-bcm-qspi.c -+++ b/drivers/spi/spi-bcm-qspi.c -@@ -19,7 +19,7 @@ - #include <linux/platform_device.h> - #include <linux/slab.h> - #include <linux/spi/spi.h> --#include <linux/spi/spi-mem.h> -+#include <linux/mtd/spi-nor.h> - #include <linux/sysfs.h> - #include <linux/types.h> - #include "spi-bcm-qspi.h" -@@ -1221,7 +1221,7 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem, - - /* non-aligned and very short transfers are handled by MSPI */ - if (!IS_ALIGNED((uintptr_t)addr, 4) || !IS_ALIGNED((uintptr_t)buf, 4) || -- len < 4) -+ len < 4 || op->cmd.opcode == SPINOR_OP_RDSFDP) - mspi_read = true; - - if (!has_bspi(qspi) || mspi_read) --- -2.43.2 - -From 1bda88547390761e12a5609742819cca8dbd2e77 Mon Sep 17 00:00:00 2001 -From: Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com> -Date: Mon, 18 Dec 2023 14:36:52 +0530 -Subject: [PATCH 1003/1501] spi: spi-cadence: Reverse the order of interleaved - write and read operations -Content-Length: 1735 -Lines: 55 - -[ Upstream commit 633cd6fe6e1993ba80e0954c2db127a0b1a3e66f ] - -In the existing implementation, when executing interleaved write and read -operations in the ISR for a transfer length greater than the FIFO size, -the TXFIFO write precedes the RXFIFO read. Consequently, the initially -received data in the RXFIFO is pushed out and lost, leading to a failure -in data integrity. To address this issue, reverse the order of interleaved -operations and conduct the RXFIFO read followed by the TXFIFO write. - -Fixes: 6afe2ae8dc48 ("spi: spi-cadence: Interleave write of TX and read of RX FIFO") -Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com> -Link: https://msgid.link/r/20231218090652.18403-1-amit.kumar-mahapatra@amd.com -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/spi/spi-cadence.c | 17 +++++++++-------- - 1 file changed, 9 insertions(+), 8 deletions(-) - -diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c -index a50eb4db79de..e5140532071d 100644 ---- a/drivers/spi/spi-cadence.c -+++ b/drivers/spi/spi-cadence.c -@@ -317,6 +317,15 @@ static void cdns_spi_process_fifo(struct cdns_spi *xspi, int ntx, int nrx) - xspi->rx_bytes -= nrx; - - while (ntx || nrx) { -+ if (nrx) { -+ u8 data = cdns_spi_read(xspi, CDNS_SPI_RXD); -+ -+ if (xspi->rxbuf) -+ *xspi->rxbuf++ = data; -+ -+ nrx--; -+ } -+ - if (ntx) { - if (xspi->txbuf) - cdns_spi_write(xspi, CDNS_SPI_TXD, *xspi->txbuf++); -@@ -326,14 +335,6 @@ static void cdns_spi_process_fifo(struct cdns_spi *xspi, int ntx, int nrx) - ntx--; - } - -- if (nrx) { -- u8 data = cdns_spi_read(xspi, CDNS_SPI_RXD); -- -- if (xspi->rxbuf) -- *xspi->rxbuf++ = data; -- -- nrx--; -- } - } - } - --- -2.43.2 - -From 0dea68be2a345a8b4b5c911d0de92cad831fbdb2 Mon Sep 17 00:00:00 2001 -From: Shyam Prasad N <sprasad@microsoft.com> -Date: Tue, 23 Jan 2024 05:07:57 +0000 -Subject: [PATCH 1004/1501] cifs: fix stray unlock in cifs_chan_skip_or_disable -Content-Length: 1006 -Lines: 31 - -[ Upstream commit 993d1c346b1a51ac41b2193609a0d4e51e9748f4 ] - -A recent change moved the code that decides to skip -a channel or disable multichannel entirely, into a -helper function. - -During this, a mutex_unlock of the session_mutex -should have been removed. Doing that here. - -Fixes: f591062bdbf4 ("cifs: handle servers that still advertise multichannel after disabling") -Signed-off-by: Shyam Prasad N <sprasad@microsoft.com> -Signed-off-by: Steve French <stfrench@microsoft.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/smb/client/smb2pdu.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c -index bfec2ca0f4e6..f5006aa97f5b 100644 ---- a/fs/smb/client/smb2pdu.c -+++ b/fs/smb/client/smb2pdu.c -@@ -195,7 +195,6 @@ cifs_chan_skip_or_disable(struct cifs_ses *ses, - pserver = server->primary_server; - cifs_signal_cifsd_for_reconnect(pserver, false); - skip_terminate: -- mutex_unlock(&ses->session_mutex); - return -EHOSTDOWN; - } - --- -2.43.2 - -From 19d73c253a444d2005a914d840822959eb5db8de Mon Sep 17 00:00:00 2001 -From: David Lechner <dlechner@baylibre.com> -Date: Thu, 25 Jan 2024 14:53:09 -0600 -Subject: [PATCH 1005/1501] spi: fix finalize message on error return -Content-Length: 1171 -Lines: 35 - -[ Upstream commit 8c2ae772fe08e33f3d7a83849e85539320701abd ] - -In __spi_pump_transfer_message(), the message was not finalized in the -first error return as it is in the other error return paths. Not -finalizing the message could cause anything waiting on the message to -complete to hang forever. - -This adds the missing call to spi_finalize_current_message(). - -Fixes: ae7d2346dc89 ("spi: Don't use the message queue if possible in spi_sync") -Signed-off-by: David Lechner <dlechner@baylibre.com> -Link: https://msgid.link/r/20240125205312.3458541-2-dlechner@baylibre.com -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/spi/spi.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c -index 8ead7acb99f3..4adc56dabf55 100644 ---- a/drivers/spi/spi.c -+++ b/drivers/spi/spi.c -@@ -1624,6 +1624,10 @@ static int __spi_pump_transfer_message(struct spi_controller *ctlr, - pm_runtime_put_noidle(ctlr->dev.parent); - dev_err(&ctlr->dev, "Failed to power device: %d\n", - ret); -+ -+ msg->status = ret; -+ spi_finalize_current_message(ctlr); -+ - return ret; - } - } --- -2.43.2 - -From 3cb11d189673ae012ecad07bbbcd70bb08ca884b Mon Sep 17 00:00:00 2001 -From: Huacai Chen <chenhuacai@loongson.cn> -Date: Fri, 26 Jan 2024 16:22:07 +0800 -Subject: [PATCH 1006/1501] LoongArch/smp: Call rcutree_report_cpu_starting() - at tlb_init() -Content-Length: 2576 -Lines: 72 - -[ Upstream commit 5056c596c3d1848021a4eaa76ee42f4c05c50346 ] - -Machines which have more than 8 nodes fail to boot SMP after commit -a2ccf46333d7b2cf96 ("LoongArch/smp: Call rcutree_report_cpu_starting() -earlier"). Because such machines use tlb-based per-cpu base address -rather than dmw-based per-cpu base address, resulting per-cpu variables -can only be accessed after tlb_init(). But rcutree_report_cpu_starting() -is now called before tlb_init() and accesses per-cpu variables indeed. - -Since the original patch want to avoid the lockdep warning caused by -page allocation in tlb_init(), we can move rcutree_report_cpu_starting() -to tlb_init() where after tlb exception configuration but before page -allocation. - -Fixes: a2ccf46333d7b2cf96 ("LoongArch/smp: Call rcutree_report_cpu_starting() earlier") -Signed-off-by: Huacai Chen <chenhuacai@loongson.cn> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/loongarch/kernel/smp.c | 1 - - arch/loongarch/mm/tlb.c | 16 ++++++++++------ - 2 files changed, 10 insertions(+), 7 deletions(-) - -diff --git a/arch/loongarch/kernel/smp.c b/arch/loongarch/kernel/smp.c -index 5bca12d16e06..2fbf541d7b4f 100644 ---- a/arch/loongarch/kernel/smp.c -+++ b/arch/loongarch/kernel/smp.c -@@ -506,7 +506,6 @@ asmlinkage void start_secondary(void) - sync_counter(); - cpu = raw_smp_processor_id(); - set_my_cpu_offset(per_cpu_offset(cpu)); -- rcutree_report_cpu_starting(cpu); - - cpu_probe(); - constant_clockevent_init(); -diff --git a/arch/loongarch/mm/tlb.c b/arch/loongarch/mm/tlb.c -index 2c0a411f23aa..0b95d32b30c9 100644 ---- a/arch/loongarch/mm/tlb.c -+++ b/arch/loongarch/mm/tlb.c -@@ -284,12 +284,16 @@ static void setup_tlb_handler(int cpu) - set_handler(EXCCODE_TLBNR * VECSIZE, handle_tlb_protect, VECSIZE); - set_handler(EXCCODE_TLBNX * VECSIZE, handle_tlb_protect, VECSIZE); - set_handler(EXCCODE_TLBPE * VECSIZE, handle_tlb_protect, VECSIZE); -- } -+ } else { -+ int vec_sz __maybe_unused; -+ void *addr __maybe_unused; -+ struct page *page __maybe_unused; -+ -+ /* Avoid lockdep warning */ -+ rcutree_report_cpu_starting(cpu); -+ - #ifdef CONFIG_NUMA -- else { -- void *addr; -- struct page *page; -- const int vec_sz = sizeof(exception_handlers); -+ vec_sz = sizeof(exception_handlers); - - if (pcpu_handlers[cpu]) - return; -@@ -305,8 +309,8 @@ static void setup_tlb_handler(int cpu) - csr_write64(pcpu_handlers[cpu], LOONGARCH_CSR_EENTRY); - csr_write64(pcpu_handlers[cpu], LOONGARCH_CSR_MERRENTRY); - csr_write64(pcpu_handlers[cpu] + 80*VECSIZE, LOONGARCH_CSR_TLBRENTRY); -- } - #endif -+ } - } - - void tlb_init(int cpu) --- -2.43.2 - -From ebdb4032174b3ab8beef0ed7847e8bf1e2f70677 Mon Sep 17 00:00:00 2001 -From: Aleksander Jan Bajkowski <olek2@wp.pl> -Date: Mon, 22 Jan 2024 19:47:09 +0100 -Subject: [PATCH 1007/1501] MIPS: lantiq: register smp_ops on non-smp platforms -Content-Length: 1241 -Lines: 36 - -[ Upstream commit 4bf2a626dc4bb46f0754d8ac02ec8584ff114ad5 ] - -Lantiq uses a common kernel config for devices with 24Kc and 34Kc cores. -The changes made previously to add support for interrupts on all cores -work on 24Kc platforms with SMP disabled and 34Kc platforms with SMP -enabled. This patch fixes boot issues on Danube (single core 24Kc) with -SMP enabled. - -Fixes: 730320fd770d ("MIPS: lantiq: enable all hardware interrupts on second VPE") -Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl> -Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/mips/lantiq/prom.c | 7 +++---- - 1 file changed, 3 insertions(+), 4 deletions(-) - -diff --git a/arch/mips/lantiq/prom.c b/arch/mips/lantiq/prom.c -index a3cf29365858..0c45767eacf6 100644 ---- a/arch/mips/lantiq/prom.c -+++ b/arch/mips/lantiq/prom.c -@@ -108,10 +108,9 @@ void __init prom_init(void) - prom_init_cmdline(); - - #if defined(CONFIG_MIPS_MT_SMP) -- if (cpu_has_mipsmt) { -- lantiq_smp_ops = vsmp_smp_ops; -+ lantiq_smp_ops = vsmp_smp_ops; -+ if (cpu_has_mipsmt) - lantiq_smp_ops.init_secondary = lantiq_init_secondary; -- register_smp_ops(&lantiq_smp_ops); -- } -+ register_smp_ops(&lantiq_smp_ops); - #endif - } --- -2.43.2 - -From 54ed6fed7cd7ee139dfd40d6818e40b1033e0643 Mon Sep 17 00:00:00 2001 -From: Michael Walle <mwalle@kernel.org> -Date: Mon, 13 Nov 2023 17:43:44 +0100 -Subject: [PATCH 1009/1501] drm: bridge: samsung-dsim: Don't use - FORCE_STOP_STATE -Content-Length: 4679 -Lines: 121 - -[ Upstream commit ff3d5d04db07e5374758baa7e877fde8d683ebab ] - -The FORCE_STOP_STATE bit is unsuitable to force the DSI link into LP-11 -mode. It seems the bridge internally queues DSI packets and when the -FORCE_STOP_STATE bit is cleared, they are sent in close succession -without any useful timing (this also means that the DSI lanes won't go -into LP-11 mode). The length of this gibberish varies between 1ms and -5ms. This sometimes breaks an attached bridge (TI SN65DSI84 in this -case). In our case, the bridge will fail in about 1 per 500 reboots. - -The FORCE_STOP_STATE handling was introduced to have the DSI lanes in -LP-11 state during the .pre_enable phase. But as it turns out, none of -this is needed at all. Between samsung_dsim_init() and -samsung_dsim_set_display_enable() the lanes are already in LP-11 mode. -The code as it was before commit 20c827683de0 ("drm: bridge: -samsung-dsim: Fix init during host transfer") and 0c14d3130654 ("drm: -bridge: samsung-dsim: Fix i.MX8M enable flow to meet spec") was correct -in this regard. - -This patch basically reverts both commits. It was tested on an i.MX8M -SoC with an SN65DSI84 bridge. The signals were probed and the DSI -packets were decoded during initialization and link start-up. After this -patch the first DSI packet on the link is a VSYNC packet and the timing -is correct. - -Command mode between .pre_enable and .enable was also briefly tested by -a quick hack. There was no DSI link partner which would have responded, -but it was made sure the DSI packet was send on the link. As a side -note, the command mode seems to just work in HS mode. I couldn't find -that the bridge will handle commands in LP mode. - -Fixes: 20c827683de0 ("drm: bridge: samsung-dsim: Fix init during host transfer") -Fixes: 0c14d3130654 ("drm: bridge: samsung-dsim: Fix i.MX8M enable flow to meet spec") -Signed-off-by: Michael Walle <mwalle@kernel.org> -Signed-off-by: Inki Dae <inki.dae@samsung.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20231113164344.1612602-1-mwalle@kernel.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/bridge/samsung-dsim.c | 32 ++------------------------- - 1 file changed, 2 insertions(+), 30 deletions(-) - -diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c b/drivers/gpu/drm/bridge/samsung-dsim.c -index be5914caa17d..63a1a0c88be4 100644 ---- a/drivers/gpu/drm/bridge/samsung-dsim.c -+++ b/drivers/gpu/drm/bridge/samsung-dsim.c -@@ -969,10 +969,6 @@ static int samsung_dsim_init_link(struct samsung_dsim *dsi) - reg = samsung_dsim_read(dsi, DSIM_ESCMODE_REG); - reg &= ~DSIM_STOP_STATE_CNT_MASK; - reg |= DSIM_STOP_STATE_CNT(driver_data->reg_values[STOP_STATE_CNT]); -- -- if (!samsung_dsim_hw_is_exynos(dsi->plat_data->hw_type)) -- reg |= DSIM_FORCE_STOP_STATE; -- - samsung_dsim_write(dsi, DSIM_ESCMODE_REG, reg); - - reg = DSIM_BTA_TIMEOUT(0xff) | DSIM_LPDR_TIMEOUT(0xffff); -@@ -1431,18 +1427,6 @@ static void samsung_dsim_disable_irq(struct samsung_dsim *dsi) - disable_irq(dsi->irq); - } - --static void samsung_dsim_set_stop_state(struct samsung_dsim *dsi, bool enable) --{ -- u32 reg = samsung_dsim_read(dsi, DSIM_ESCMODE_REG); -- -- if (enable) -- reg |= DSIM_FORCE_STOP_STATE; -- else -- reg &= ~DSIM_FORCE_STOP_STATE; -- -- samsung_dsim_write(dsi, DSIM_ESCMODE_REG, reg); --} -- - static int samsung_dsim_init(struct samsung_dsim *dsi) - { - const struct samsung_dsim_driver_data *driver_data = dsi->driver_data; -@@ -1492,9 +1476,6 @@ static void samsung_dsim_atomic_pre_enable(struct drm_bridge *bridge, - ret = samsung_dsim_init(dsi); - if (ret) - return; -- -- samsung_dsim_set_display_mode(dsi); -- samsung_dsim_set_display_enable(dsi, true); - } - } - -@@ -1503,12 +1484,8 @@ static void samsung_dsim_atomic_enable(struct drm_bridge *bridge, - { - struct samsung_dsim *dsi = bridge_to_dsi(bridge); - -- if (samsung_dsim_hw_is_exynos(dsi->plat_data->hw_type)) { -- samsung_dsim_set_display_mode(dsi); -- samsung_dsim_set_display_enable(dsi, true); -- } else { -- samsung_dsim_set_stop_state(dsi, false); -- } -+ samsung_dsim_set_display_mode(dsi); -+ samsung_dsim_set_display_enable(dsi, true); - - dsi->state |= DSIM_STATE_VIDOUT_AVAILABLE; - } -@@ -1521,9 +1498,6 @@ static void samsung_dsim_atomic_disable(struct drm_bridge *bridge, - if (!(dsi->state & DSIM_STATE_ENABLED)) - return; - -- if (!samsung_dsim_hw_is_exynos(dsi->plat_data->hw_type)) -- samsung_dsim_set_stop_state(dsi, true); -- - dsi->state &= ~DSIM_STATE_VIDOUT_AVAILABLE; - } - -@@ -1828,8 +1802,6 @@ static ssize_t samsung_dsim_host_transfer(struct mipi_dsi_host *host, - if (ret) - return ret; - -- samsung_dsim_set_stop_state(dsi, false); -- - ret = mipi_dsi_create_packet(&xfer.packet, msg); - if (ret < 0) - return ret; --- -2.43.2 - -From e8931ebb0143dc4a3ad302be6f963ae375548bc0 Mon Sep 17 00:00:00 2001 -From: Jithu Joseph <jithu.joseph@intel.com> -Date: Thu, 25 Jan 2024 00:22:50 -0800 -Subject: [PATCH 1010/1501] platform/x86/intel/ifs: Call release_firmware() - when handling errors. -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1435 -Lines: 37 - -[ Upstream commit 8c898ec07a2fc1d4694e81097a48e94a3816308d ] - -Missing release_firmware() due to error handling blocked any future image -loading. - -Fix the return code and release_fiwmare() to release the bad image. - -Fixes: 25a76dbb36dd ("platform/x86/intel/ifs: Validate image size") -Reported-by: Pengfei Xu <pengfei.xu@intel.com> -Signed-off-by: Jithu Joseph <jithu.joseph@intel.com> -Signed-off-by: Ashok Raj <ashok.raj@intel.com> -Tested-by: Pengfei Xu <pengfei.xu@intel.com> -Reviewed-by: Tony Luck <tony.luck@intel.com> -Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> -Link: https://lore.kernel.org/r/20240125082254.424859-2-ashok.raj@intel.com -Signed-off-by: Hans de Goede <hdegoede@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/platform/x86/intel/ifs/load.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/platform/x86/intel/ifs/load.c b/drivers/platform/x86/intel/ifs/load.c -index a1ee1a74fc3c..2cf3b4a8813f 100644 ---- a/drivers/platform/x86/intel/ifs/load.c -+++ b/drivers/platform/x86/intel/ifs/load.c -@@ -399,7 +399,8 @@ int ifs_load_firmware(struct device *dev) - if (fw->size != expected_size) { - dev_err(dev, "File size mismatch (expected %u, actual %zu). Corrupted IFS image.\n", - expected_size, fw->size); -- return -EINVAL; -+ ret = -EINVAL; -+ goto release; - } - - ret = image_sanity_check(dev, (struct microcode_header_intel *)fw->data); --- -2.43.2 - -From 026de45cd745028ca0b06c904ffbb99d0c78521a Mon Sep 17 00:00:00 2001 -From: Quanquan Cao <caoqq@fujitsu.com> -Date: Wed, 24 Jan 2024 17:15:26 +0800 -Subject: [PATCH 1011/1501] =?UTF-8?q?cxl/region=EF=BC=9AFix=20overflow=20i?= - =?UTF-8?q?ssue=20in=20alloc=5Fhpa()?= -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1808 -Lines: 46 - -commit d76779dd3681c01a4c6c3cae4d0627c9083e0ee6 upstream. - -Creating a region with 16 memory devices caused a problem. The div_u64_rem -function, used for dividing an unsigned 64-bit number by a 32-bit one, -faced an issue when SZ_256M * p->interleave_ways. The result surpassed -the maximum limit of the 32-bit divisor (4G), leading to an overflow -and a remainder of 0. -note: At this point, p->interleave_ways is 16, meaning 16 * 256M = 4G - -To fix this issue, I replaced the div_u64_rem function with div64_u64_rem -and adjusted the type of the remainder. - -Signed-off-by: Quanquan Cao <caoqq@fujitsu.com> -Reviewed-by: Dave Jiang <dave.jiang@intel.com> -Fixes: 23a22cd1c98b ("cxl/region: Allocate HPA capacity to regions") -Cc: <stable@vger.kernel.org> -Signed-off-by: Dan Williams <dan.j.williams@intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/cxl/core/region.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c -index 76fec47a13a4..7bb656237fa0 100644 ---- a/drivers/cxl/core/region.c -+++ b/drivers/cxl/core/region.c -@@ -525,7 +525,7 @@ static int alloc_hpa(struct cxl_region *cxlr, resource_size_t size) - struct cxl_root_decoder *cxlrd = to_cxl_root_decoder(cxlr->dev.parent); - struct cxl_region_params *p = &cxlr->params; - struct resource *res; -- u32 remainder = 0; -+ u64 remainder = 0; - - lockdep_assert_held_write(&cxl_region_rwsem); - -@@ -545,7 +545,7 @@ static int alloc_hpa(struct cxl_region *cxlr, resource_size_t size) - (cxlr->mode == CXL_DECODER_PMEM && uuid_is_null(&p->uuid))) - return -ENXIO; - -- div_u64_rem(size, SZ_256M * p->interleave_ways, &remainder); -+ div64_u64_rem(size, (u64)SZ_256M * p->interleave_ways, &remainder); - if (remainder) - return -EINVAL; - --- -2.43.2 - -From f869d597f001569a7a21aa6ca3859edb1c8f5ce0 Mon Sep 17 00:00:00 2001 -From: Xi Ruoyao <xry111@xry111.site> -Date: Sat, 27 Jan 2024 05:05:57 +0800 -Subject: [PATCH 1012/1501] mips: Call lose_fpu(0) before initializing fcr31 in - mips_set_personality_nan -Content-Length: 1771 -Lines: 54 - -commit 59be5c35850171e307ca5d3d703ee9ff4096b948 upstream. - -If we still own the FPU after initializing fcr31, when we are preempted -the dirty value in the FPU will be read out and stored into fcr31, -clobbering our setting. This can cause an improper floating-point -environment after execve(). For example: - - zsh% cat measure.c - #include <fenv.h> - int main() { return fetestexcept(FE_INEXACT); } - zsh% cc measure.c -o measure -lm - zsh% echo $((1.0/3)) # raising FE_INEXACT - 0.33333333333333331 - zsh% while ./measure; do ; done - (stopped in seconds) - -Call lose_fpu(0) before setting fcr31 to prevent this. - -Closes: https://lore.kernel.org/linux-mips/7a6aa1bbdbbe2e63ae96ff163fab0349f58f1b9e.camel@xry111.site/ -Fixes: 9b26616c8d9d ("MIPS: Respect the ISA level in FCSR handling") -Cc: stable@vger.kernel.org -Signed-off-by: Xi Ruoyao <xry111@xry111.site> -Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/mips/kernel/elf.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/arch/mips/kernel/elf.c b/arch/mips/kernel/elf.c -index 5582a4ca1e9e..7aa2c2360ff6 100644 ---- a/arch/mips/kernel/elf.c -+++ b/arch/mips/kernel/elf.c -@@ -11,6 +11,7 @@ - - #include <asm/cpu-features.h> - #include <asm/cpu-info.h> -+#include <asm/fpu.h> - - #ifdef CONFIG_MIPS_FP_SUPPORT - -@@ -309,6 +310,11 @@ void mips_set_personality_nan(struct arch_elf_state *state) - struct cpuinfo_mips *c = &boot_cpu_data; - struct task_struct *t = current; - -+ /* Do this early so t->thread.fpu.fcr31 won't be clobbered in case -+ * we are preempted before the lose_fpu(0) in start_thread. -+ */ -+ lose_fpu(0); -+ - t->thread.fpu.fcr31 = c->fpu_csr31; - switch (state->nan_2008) { - case 0: --- -2.43.2 - -From 7e4a79e6d9b4123361364aea3a6fd9a0523453e8 Mon Sep 17 00:00:00 2001 -From: Dawei Li <dawei.li@shingroup.cn> -Date: Mon, 22 Jan 2024 16:57:15 +0800 -Subject: [PATCH 1013/1501] genirq: Initialize resend_node hlist for all - interrupt descriptors -Content-Length: 1241 -Lines: 36 - -commit b184c8c2889ceef0a137c7d0567ef9fe3d92276e upstream. - -For a CONFIG_SPARSE_IRQ=n kernel, early_irq_init() is supposed to -initialize all interrupt descriptors. - -It does except for irq_desc::resend_node, which ia only initialized for the -first descriptor. - -Use the indexed decriptor and not the base pointer to address that. - -Fixes: bc06a9e08742 ("genirq: Use hlist for managing resend handlers") -Signed-off-by: Dawei Li <dawei.li@shingroup.cn> -Signed-off-by: Thomas Gleixner <tglx@linutronix.de> -Acked-by: Marc Zyngier <maz@kernel.org> -Cc: stable@vger.kernel.org -Link: https://lore.kernel.org/r/20240122085716.2999875-5-dawei.li@shingroup.cn -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - kernel/irq/irqdesc.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c -index 27ca1c866f29..371eb1711d34 100644 ---- a/kernel/irq/irqdesc.c -+++ b/kernel/irq/irqdesc.c -@@ -600,7 +600,7 @@ int __init early_irq_init(void) - mutex_init(&desc[i].request_mutex); - init_waitqueue_head(&desc[i].wait_for_threads); - desc_set_defaults(i, &desc[i], node, NULL, NULL); -- irq_resend_init(desc); -+ irq_resend_init(&desc[i]); - } - return arch_early_irq_init(); - } --- -2.43.2 - -From 4e5bed870706d55260b17d915437c7922b731859 Mon Sep 17 00:00:00 2001 -From: Jiri Wiesner <jwiesner@suse.de> -Date: Mon, 22 Jan 2024 18:23:50 +0100 -Subject: [PATCH 1014/1501] clocksource: Skip watchdog check for large watchdog - intervals -Content-Length: 6021 -Lines: 133 - -commit 644649553508b9bacf0fc7a5bdc4f9e0165576a5 upstream. - -There have been reports of the watchdog marking clocksources unstable on -machines with 8 NUMA nodes: - - clocksource: timekeeping watchdog on CPU373: - Marking clocksource 'tsc' as unstable because the skew is too large: - clocksource: 'hpet' wd_nsec: 14523447520 - clocksource: 'tsc' cs_nsec: 14524115132 - -The measured clocksource skew - the absolute difference between cs_nsec -and wd_nsec - was 668 microseconds: - - cs_nsec - wd_nsec = 14524115132 - 14523447520 = 667612 - -The kernel used 200 microseconds for the uncertainty_margin of both the -clocksource and watchdog, resulting in a threshold of 400 microseconds (the -md variable). Both the cs_nsec and the wd_nsec value indicate that the -readout interval was circa 14.5 seconds. The observed behaviour is that -watchdog checks failed for large readout intervals on 8 NUMA node -machines. This indicates that the size of the skew was directly proportinal -to the length of the readout interval on those machines. The measured -clocksource skew, 668 microseconds, was evaluated against a threshold (the -md variable) that is suited for readout intervals of roughly -WATCHDOG_INTERVAL, i.e. HZ >> 1, which is 0.5 second. - -The intention of 2e27e793e280 ("clocksource: Reduce clocksource-skew -threshold") was to tighten the threshold for evaluating skew and set the -lower bound for the uncertainty_margin of clocksources to twice -WATCHDOG_MAX_SKEW. Later in c37e85c135ce ("clocksource: Loosen clocksource -watchdog constraints"), the WATCHDOG_MAX_SKEW constant was increased to -125 microseconds to fit the limit of NTP, which is able to use a -clocksource that suffers from up to 500 microseconds of skew per second. -Both the TSC and the HPET use default uncertainty_margin. When the -readout interval gets stretched the default uncertainty_margin is no -longer a suitable lower bound for evaluating skew - it imposes a limit -that is far stricter than the skew with which NTP can deal. - -The root causes of the skew being directly proportinal to the length of -the readout interval are: - - * the inaccuracy of the shift/mult pairs of clocksources and the watchdog - * the conversion to nanoseconds is imprecise for large readout intervals - -Prevent this by skipping the current watchdog check if the readout -interval exceeds 2 * WATCHDOG_INTERVAL. Considering the maximum readout -interval of 2 * WATCHDOG_INTERVAL, the current default uncertainty margin -(of the TSC and HPET) corresponds to a limit on clocksource skew of 250 -ppm (microseconds of skew per second). To keep the limit imposed by NTP -(500 microseconds of skew per second) for all possible readout intervals, -the margins would have to be scaled so that the threshold value is -proportional to the length of the actual readout interval. - -As for why the readout interval may get stretched: Since the watchdog is -executed in softirq context the expiration of the watchdog timer can get -severely delayed on account of a ksoftirqd thread not getting to run in a -timely manner. Surely, a system with such belated softirq execution is not -working well and the scheduling issue should be looked into but the -clocksource watchdog should be able to deal with it accordingly. - -Fixes: 2e27e793e280 ("clocksource: Reduce clocksource-skew threshold") -Suggested-by: Feng Tang <feng.tang@intel.com> -Signed-off-by: Jiri Wiesner <jwiesner@suse.de> -Signed-off-by: Thomas Gleixner <tglx@linutronix.de> -Tested-by: Paul E. McKenney <paulmck@kernel.org> -Reviewed-by: Feng Tang <feng.tang@intel.com> -Cc: stable@vger.kernel.org -Link: https://lore.kernel.org/r/20240122172350.GA740@incl -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - kernel/time/clocksource.c | 25 ++++++++++++++++++++++++- - 1 file changed, 24 insertions(+), 1 deletion(-) - -diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c -index c108ed8a9804..3052b1f1168e 100644 ---- a/kernel/time/clocksource.c -+++ b/kernel/time/clocksource.c -@@ -99,6 +99,7 @@ static u64 suspend_start; - * Interval: 0.5sec. - */ - #define WATCHDOG_INTERVAL (HZ >> 1) -+#define WATCHDOG_INTERVAL_MAX_NS ((2 * WATCHDOG_INTERVAL) * (NSEC_PER_SEC / HZ)) - - /* - * Threshold: 0.0312s, when doubled: 0.0625s. -@@ -134,6 +135,7 @@ static DECLARE_WORK(watchdog_work, clocksource_watchdog_work); - static DEFINE_SPINLOCK(watchdog_lock); - static int watchdog_running; - static atomic_t watchdog_reset_pending; -+static int64_t watchdog_max_interval; - - static inline void clocksource_watchdog_lock(unsigned long *flags) - { -@@ -399,8 +401,8 @@ static inline void clocksource_reset_watchdog(void) - static void clocksource_watchdog(struct timer_list *unused) - { - u64 csnow, wdnow, cslast, wdlast, delta; -+ int64_t wd_nsec, cs_nsec, interval; - int next_cpu, reset_pending; -- int64_t wd_nsec, cs_nsec; - struct clocksource *cs; - enum wd_read_status read_ret; - unsigned long extra_wait = 0; -@@ -470,6 +472,27 @@ static void clocksource_watchdog(struct timer_list *unused) - if (atomic_read(&watchdog_reset_pending)) - continue; - -+ /* -+ * The processing of timer softirqs can get delayed (usually -+ * on account of ksoftirqd not getting to run in a timely -+ * manner), which causes the watchdog interval to stretch. -+ * Skew detection may fail for longer watchdog intervals -+ * on account of fixed margins being used. -+ * Some clocksources, e.g. acpi_pm, cannot tolerate -+ * watchdog intervals longer than a few seconds. -+ */ -+ interval = max(cs_nsec, wd_nsec); -+ if (unlikely(interval > WATCHDOG_INTERVAL_MAX_NS)) { -+ if (system_state > SYSTEM_SCHEDULING && -+ interval > 2 * watchdog_max_interval) { -+ watchdog_max_interval = interval; -+ pr_warn("Long readout interval, skipping watchdog check: cs_nsec: %lld wd_nsec: %lld\n", -+ cs_nsec, wd_nsec); -+ } -+ watchdog_timer.expires = jiffies; -+ continue; -+ } -+ - /* Check the deviation from the watchdog clocksource. */ - md = cs->uncertainty_margin + watchdog->uncertainty_margin; - if (abs(cs_nsec - wd_nsec) > md) { --- -2.43.2 - -From 155a09d38bfa39ca7e3eb7bf249b4a8d4ff8d443 Mon Sep 17 00:00:00 2001 -From: Tim Chen <tim.c.chen@linux.intel.com> -Date: Mon, 22 Jan 2024 15:35:34 -0800 -Subject: [PATCH 1015/1501] tick/sched: Preserve number of idle sleeps across - CPU hotplug events -Content-Length: 1672 -Lines: 49 - -commit 9a574ea9069be30b835a3da772c039993c43369b upstream. - -Commit 71fee48f ("tick-sched: Fix idle and iowait sleeptime accounting vs -CPU hotplug") preserved total idle sleep time and iowait sleeptime across -CPU hotplug events. - -Similar reasoning applies to the number of idle calls and idle sleeps to -get the proper average of sleep time per idle invocation. - -Preserve those fields too. - -Fixes: 71fee48f ("tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug") -Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com> -Signed-off-by: Thomas Gleixner <tglx@linutronix.de> -Cc: stable@vger.kernel.org -Link: https://lore.kernel.org/r/20240122233534.3094238-1-tim.c.chen@linux.intel.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - kernel/time/tick-sched.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c -index 2305366a818a..ca2d59579fce 100644 ---- a/kernel/time/tick-sched.c -+++ b/kernel/time/tick-sched.c -@@ -1574,6 +1574,7 @@ void tick_cancel_sched_timer(int cpu) - { - struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu); - ktime_t idle_sleeptime, iowait_sleeptime; -+ unsigned long idle_calls, idle_sleeps; - - # ifdef CONFIG_HIGH_RES_TIMERS - if (ts->sched_timer.base) -@@ -1582,9 +1583,13 @@ void tick_cancel_sched_timer(int cpu) - - idle_sleeptime = ts->idle_sleeptime; - iowait_sleeptime = ts->iowait_sleeptime; -+ idle_calls = ts->idle_calls; -+ idle_sleeps = ts->idle_sleeps; - memset(ts, 0, sizeof(*ts)); - ts->idle_sleeptime = idle_sleeptime; - ts->iowait_sleeptime = iowait_sleeptime; -+ ts->idle_calls = idle_calls; -+ ts->idle_sleeps = idle_sleeps; - } - #endif - --- -2.43.2 - -From 9547994f03fe96a96ab3985d959c4dbf1259be11 Mon Sep 17 00:00:00 2001 -From: Richard Palethorpe <rpalethorpe@suse.com> -Date: Wed, 10 Jan 2024 15:01:22 +0200 -Subject: [PATCH 1016/1501] x86/entry/ia32: Ensure s32 is sign extended to s64 -Content-Length: 3823 -Lines: 85 - -commit 56062d60f117dccfb5281869e0ab61e090baf864 upstream. - -Presently ia32 registers stored in ptregs are unconditionally cast to -unsigned int by the ia32 stub. They are then cast to long when passed to -__se_sys*, but will not be sign extended. - -This takes the sign of the syscall argument into account in the ia32 -stub. It still casts to unsigned int to avoid implementation specific -behavior. However then casts to int or unsigned int as necessary. So that -the following cast to long sign extends the value. - -This fixes the io_pgetevents02 LTP test when compiled with -m32. Presently -the systemcall io_pgetevents_time64() unexpectedly accepts -1 for the -maximum number of events. - -It doesn't appear other systemcalls with signed arguments are effected -because they all have compat variants defined and wired up. - -Fixes: ebeb8c82ffaf ("syscalls/x86: Use 'struct pt_regs' based syscall calling for IA32_EMULATION and x32") -Suggested-by: Arnd Bergmann <arnd@arndb.de> -Signed-off-by: Richard Palethorpe <rpalethorpe@suse.com> -Signed-off-by: Nikolay Borisov <nik.borisov@suse.com> -Signed-off-by: Thomas Gleixner <tglx@linutronix.de> -Reviewed-by: Arnd Bergmann <arnd@arndb.de> -Cc: stable@vger.kernel.org -Link: https://lore.kernel.org/r/20240110130122.3836513-1-nik.borisov@suse.com -Link: https://lore.kernel.org/ltp/20210921130127.24131-1-rpalethorpe@suse.com/ -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/x86/include/asm/syscall_wrapper.h | 25 +++++++++++++++++++++---- - include/linux/syscalls.h | 1 + - 2 files changed, 22 insertions(+), 4 deletions(-) - -diff --git a/arch/x86/include/asm/syscall_wrapper.h b/arch/x86/include/asm/syscall_wrapper.h -index 21f9407be5d3..7e88705e907f 100644 ---- a/arch/x86/include/asm/syscall_wrapper.h -+++ b/arch/x86/include/asm/syscall_wrapper.h -@@ -58,12 +58,29 @@ extern long __ia32_sys_ni_syscall(const struct pt_regs *regs); - ,,regs->di,,regs->si,,regs->dx \ - ,,regs->r10,,regs->r8,,regs->r9) \ - -+ -+/* SYSCALL_PT_ARGS is Adapted from s390x */ -+#define SYSCALL_PT_ARG6(m, t1, t2, t3, t4, t5, t6) \ -+ SYSCALL_PT_ARG5(m, t1, t2, t3, t4, t5), m(t6, (regs->bp)) -+#define SYSCALL_PT_ARG5(m, t1, t2, t3, t4, t5) \ -+ SYSCALL_PT_ARG4(m, t1, t2, t3, t4), m(t5, (regs->di)) -+#define SYSCALL_PT_ARG4(m, t1, t2, t3, t4) \ -+ SYSCALL_PT_ARG3(m, t1, t2, t3), m(t4, (regs->si)) -+#define SYSCALL_PT_ARG3(m, t1, t2, t3) \ -+ SYSCALL_PT_ARG2(m, t1, t2), m(t3, (regs->dx)) -+#define SYSCALL_PT_ARG2(m, t1, t2) \ -+ SYSCALL_PT_ARG1(m, t1), m(t2, (regs->cx)) -+#define SYSCALL_PT_ARG1(m, t1) m(t1, (regs->bx)) -+#define SYSCALL_PT_ARGS(x, ...) SYSCALL_PT_ARG##x(__VA_ARGS__) -+ -+#define __SC_COMPAT_CAST(t, a) \ -+ (__typeof(__builtin_choose_expr(__TYPE_IS_L(t), 0, 0U))) \ -+ (unsigned int)a -+ - /* Mapping of registers to parameters for syscalls on i386 */ - #define SC_IA32_REGS_TO_ARGS(x, ...) \ -- __MAP(x,__SC_ARGS \ -- ,,(unsigned int)regs->bx,,(unsigned int)regs->cx \ -- ,,(unsigned int)regs->dx,,(unsigned int)regs->si \ -- ,,(unsigned int)regs->di,,(unsigned int)regs->bp) -+ SYSCALL_PT_ARGS(x, __SC_COMPAT_CAST, \ -+ __MAP(x, __SC_TYPE, __VA_ARGS__)) \ - - #define __SYS_STUB0(abi, name) \ - long __##abi##_##name(const struct pt_regs *regs); \ -diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h -index fd9d12de7e92..59fdd4074055 100644 ---- a/include/linux/syscalls.h -+++ b/include/linux/syscalls.h -@@ -125,6 +125,7 @@ struct cachestat; - #define __TYPE_IS_LL(t) (__TYPE_AS(t, 0LL) || __TYPE_AS(t, 0ULL)) - #define __SC_LONG(t, a) __typeof(__builtin_choose_expr(__TYPE_IS_LL(t), 0LL, 0L)) a - #define __SC_CAST(t, a) (__force t) a -+#define __SC_TYPE(t, a) t - #define __SC_ARGS(t, a) a - #define __SC_TEST(t, a) (void)BUILD_BUG_ON_ZERO(!__TYPE_IS_LL(t) && sizeof(t) > sizeof(long)) - --- -2.43.2 - -From 01e08e5d7656e660c8a4852191e1e133cbdb0a66 Mon Sep 17 00:00:00 2001 -From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Date: Wed, 31 Jan 2024 16:21:21 -0800 -Subject: [PATCH 1017/1501] Linux 6.7.3 -Content-Length: 1082 -Lines: 33 - -Link: https://lore.kernel.org/r/20240129170016.356158639@linuxfoundation.org -Tested-by: Ronald Warsow <rwarsow@gmx.de> -Tested-by: SeongJae Park <sj@kernel.org> -Tested-by: Salvatore Bonaccorso <carnil@debian.org> -Tested-by: Shuah Khan <skhan@linuxfoundation.org> -Tested-by: Allen Pais <apais@linux.microsoft.com> -Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> -Tested-by: Bagas Sanjaya <bagasdotme@gmail.com> -Tested-by: Ron Economos <re@w6rz.net> -Tested-by: Jon Hunter <jonathanh@nvidia.com> -Tested-by: Linux Kernel Functional Testing <lkft@linaro.org> -Tested-by: Ricardo B. Marliere <ricardo@marliere.net> -Tested-by: Justin M. Forbes <jforbes@fedoraproject.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - Makefile | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Makefile b/Makefile -index 0564d3d09395..96a08c9f0faa 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 7 --SUBLEVEL = 2 -+SUBLEVEL = 3 - EXTRAVERSION = - NAME = Hurr durr I'ma ninja sloth - --- -2.43.2 - -From 60c333480967c643892f856e88d226f3126fe3a4 Mon Sep 17 00:00:00 2001 -From: Dmitry Torokhov <dmitry.torokhov@gmail.com> -Date: Sun, 7 Jan 2024 22:16:45 -0800 -Subject: [PATCH 1018/1501] asm-generic: make sparse happy with odd-sized - put_unaligned_*() -Content-Length: 2904 -Lines: 78 - -[ Upstream commit 1ab33c03145d0f6c345823fc2da935d9a1a9e9fc ] - -__put_unaligned_be24() and friends use implicit casts to convert -larger-sized data to bytes, which trips sparse truncation warnings when -the argument is a constant: - - CC [M] drivers/input/touchscreen/hynitron_cstxxx.o - CHECK drivers/input/touchscreen/hynitron_cstxxx.c - drivers/input/touchscreen/hynitron_cstxxx.c: note: in included file (through arch/x86/include/generated/asm/unaligned.h): - include/asm-generic/unaligned.h:119:16: warning: cast truncates bits from constant value (aa01a0 becomes a0) - include/asm-generic/unaligned.h:120:20: warning: cast truncates bits from constant value (aa01 becomes 1) - include/asm-generic/unaligned.h:119:16: warning: cast truncates bits from constant value (ab00d0 becomes d0) - include/asm-generic/unaligned.h:120:20: warning: cast truncates bits from constant value (ab00 becomes 0) - -To avoid this let's mask off upper bits explicitly, the resulting code -should be exactly the same, but it will keep sparse happy. - -Reported-by: kernel test robot <lkp@intel.com> -Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> -Closes: https://lore.kernel.org/oe-kbuild-all/202401070147.gqwVulOn-lkp@intel.com/ -Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/asm-generic/unaligned.h | 24 ++++++++++++------------ - 1 file changed, 12 insertions(+), 12 deletions(-) - -diff --git a/include/asm-generic/unaligned.h b/include/asm-generic/unaligned.h -index 699650f81970..a84c64e5f11e 100644 ---- a/include/asm-generic/unaligned.h -+++ b/include/asm-generic/unaligned.h -@@ -104,9 +104,9 @@ static inline u32 get_unaligned_le24(const void *p) - - static inline void __put_unaligned_be24(const u32 val, u8 *p) - { -- *p++ = val >> 16; -- *p++ = val >> 8; -- *p++ = val; -+ *p++ = (val >> 16) & 0xff; -+ *p++ = (val >> 8) & 0xff; -+ *p++ = val & 0xff; - } - - static inline void put_unaligned_be24(const u32 val, void *p) -@@ -116,9 +116,9 @@ static inline void put_unaligned_be24(const u32 val, void *p) - - static inline void __put_unaligned_le24(const u32 val, u8 *p) - { -- *p++ = val; -- *p++ = val >> 8; -- *p++ = val >> 16; -+ *p++ = val & 0xff; -+ *p++ = (val >> 8) & 0xff; -+ *p++ = (val >> 16) & 0xff; - } - - static inline void put_unaligned_le24(const u32 val, void *p) -@@ -128,12 +128,12 @@ static inline void put_unaligned_le24(const u32 val, void *p) - - static inline void __put_unaligned_be48(const u64 val, u8 *p) - { -- *p++ = val >> 40; -- *p++ = val >> 32; -- *p++ = val >> 24; -- *p++ = val >> 16; -- *p++ = val >> 8; -- *p++ = val; -+ *p++ = (val >> 40) & 0xff; -+ *p++ = (val >> 32) & 0xff; -+ *p++ = (val >> 24) & 0xff; -+ *p++ = (val >> 16) & 0xff; -+ *p++ = (val >> 8) & 0xff; -+ *p++ = val & 0xff; - } - - static inline void put_unaligned_be48(const u64 val, void *p) --- -2.43.2 - -From ffd29dc45bc0355393859049f6becddc3ed08f74 Mon Sep 17 00:00:00 2001 -From: Kunwu Chan <chentao@kylinos.cn> -Date: Mon, 4 Dec 2023 10:32:23 +0800 -Subject: [PATCH 1019/1501] powerpc/mm: Fix null-pointer dereference in - pgtable_cache_add -Content-Length: 1654 -Lines: 41 - -[ Upstream commit f46c8a75263f97bda13c739ba1c90aced0d3b071 ] - -kasprintf() returns a pointer to dynamically allocated memory -which can be NULL upon failure. Ensure the allocation was successful -by checking the pointer validity. - -Suggested-by: Christophe Leroy <christophe.leroy@csgroup.eu> -Suggested-by: Michael Ellerman <mpe@ellerman.id.au> -Signed-off-by: Kunwu Chan <chentao@kylinos.cn> -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Link: https://msgid.link/20231204023223.2447523-1-chentao@kylinos.cn -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/powerpc/mm/init-common.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/arch/powerpc/mm/init-common.c b/arch/powerpc/mm/init-common.c -index 119ef491f797..d3a7726ecf51 100644 ---- a/arch/powerpc/mm/init-common.c -+++ b/arch/powerpc/mm/init-common.c -@@ -126,7 +126,7 @@ void pgtable_cache_add(unsigned int shift) - * as to leave enough 0 bits in the address to contain it. */ - unsigned long minalign = max(MAX_PGTABLE_INDEX_SIZE + 1, - HUGEPD_SHIFT_MASK + 1); -- struct kmem_cache *new; -+ struct kmem_cache *new = NULL; - - /* It would be nice if this was a BUILD_BUG_ON(), but at the - * moment, gcc doesn't seem to recognize is_power_of_2 as a -@@ -139,7 +139,8 @@ void pgtable_cache_add(unsigned int shift) - - align = max_t(unsigned long, align, minalign); - name = kasprintf(GFP_KERNEL, "pgtable-2^%d", shift); -- new = kmem_cache_create(name, table_size, align, 0, ctor(shift)); -+ if (name) -+ new = kmem_cache_create(name, table_size, align, 0, ctor(shift)); - if (!new) - panic("Could not allocate pgtable cache for order %d", shift); - --- -2.43.2 - -From 8ba9ec639019aef9e2271858c2b70499edf4e54e Mon Sep 17 00:00:00 2001 -From: Huang Shijie <shijie@os.amperecomputing.com> -Date: Fri, 24 Nov 2023 11:15:13 +0800 -Subject: [PATCH 1020/1501] arm64: irq: set the correct node for VMAP stack -Content-Length: 3333 -Lines: 92 - -[ Upstream commit 75b5e0bf90bffaca4b1f19114065dc59f5cc161f ] - -In current code, init_irq_stacks() will call cpu_to_node(). -The cpu_to_node() depends on percpu "numa_node" which is initialized in: - arch_call_rest_init() --> rest_init() -- kernel_init() - --> kernel_init_freeable() --> smp_prepare_cpus() - -But init_irq_stacks() is called in init_IRQ() which is before -arch_call_rest_init(). - -So in init_irq_stacks(), the cpu_to_node() does not work, it -always return 0. In NUMA, it makes the node 1 cpu accesses the IRQ stack which -is in the node 0. - -This patch fixes it by: - 1.) export the early_cpu_to_node(), and use it in the init_irq_stacks(). - 2.) change init_irq_stacks() to __init function. - -Reviewed-by: Catalin Marinas <catalin.marinas@arm.com> -Signed-off-by: Huang Shijie <shijie@os.amperecomputing.com> -Link: https://lore.kernel.org/r/20231124031513.81548-1-shijie@os.amperecomputing.com -Signed-off-by: Will Deacon <will@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/arm64/kernel/irq.c | 5 +++-- - drivers/base/arch_numa.c | 2 +- - include/asm-generic/numa.h | 2 ++ - 3 files changed, 6 insertions(+), 3 deletions(-) - -diff --git a/arch/arm64/kernel/irq.c b/arch/arm64/kernel/irq.c -index 6ad5c6ef5329..9f253d8efe90 100644 ---- a/arch/arm64/kernel/irq.c -+++ b/arch/arm64/kernel/irq.c -@@ -22,6 +22,7 @@ - #include <linux/vmalloc.h> - #include <asm/daifflags.h> - #include <asm/exception.h> -+#include <asm/numa.h> - #include <asm/softirq_stack.h> - #include <asm/stacktrace.h> - #include <asm/vmap_stack.h> -@@ -51,13 +52,13 @@ static void init_irq_scs(void) - } - - #ifdef CONFIG_VMAP_STACK --static void init_irq_stacks(void) -+static void __init init_irq_stacks(void) - { - int cpu; - unsigned long *p; - - for_each_possible_cpu(cpu) { -- p = arch_alloc_vmap_stack(IRQ_STACK_SIZE, cpu_to_node(cpu)); -+ p = arch_alloc_vmap_stack(IRQ_STACK_SIZE, early_cpu_to_node(cpu)); - per_cpu(irq_stack_ptr, cpu) = p; - } - } -diff --git a/drivers/base/arch_numa.c b/drivers/base/arch_numa.c -index eaa31e567d1e..5b59d133b6af 100644 ---- a/drivers/base/arch_numa.c -+++ b/drivers/base/arch_numa.c -@@ -144,7 +144,7 @@ void __init early_map_cpu_to_node(unsigned int cpu, int nid) - unsigned long __per_cpu_offset[NR_CPUS] __read_mostly; - EXPORT_SYMBOL(__per_cpu_offset); - --static int __init early_cpu_to_node(int cpu) -+int __init early_cpu_to_node(int cpu) - { - return cpu_to_node_map[cpu]; - } -diff --git a/include/asm-generic/numa.h b/include/asm-generic/numa.h -index 1a3ad6d29833..c32e0cf23c90 100644 ---- a/include/asm-generic/numa.h -+++ b/include/asm-generic/numa.h -@@ -35,6 +35,7 @@ int __init numa_add_memblk(int nodeid, u64 start, u64 end); - void __init numa_set_distance(int from, int to, int distance); - void __init numa_free_distance(void); - void __init early_map_cpu_to_node(unsigned int cpu, int nid); -+int __init early_cpu_to_node(int cpu); - void numa_store_cpu_info(unsigned int cpu); - void numa_add_cpu(unsigned int cpu); - void numa_remove_cpu(unsigned int cpu); -@@ -46,6 +47,7 @@ static inline void numa_add_cpu(unsigned int cpu) { } - static inline void numa_remove_cpu(unsigned int cpu) { } - static inline void arch_numa_init(void) { } - static inline void early_map_cpu_to_node(unsigned int cpu, int nid) { } -+static inline int early_cpu_to_node(int cpu) { return 0; } - - #endif /* CONFIG_NUMA */ - --- -2.43.2 - -From ccf24e91ec189f4bb408c353d572d5f9890d1056 Mon Sep 17 00:00:00 2001 -From: Mark Rutland <mark.rutland@arm.com> -Date: Mon, 4 Dec 2023 11:58:47 +0000 -Subject: [PATCH 1021/1501] drivers/perf: pmuv3: don't expose SW_INCR event in - sysfs -Content-Length: 1999 -Lines: 47 - -[ Upstream commit ca6f537e459e2da4b331fe8928d1a0b0f9301f42 ] - -The SW_INCR event is somewhat unusual, and depends on the specific HW -counter that it is programmed into. When programmed into PMEVCNTR<n>, -SW_INCR will count any writes to PMSWINC_EL0 with bit n set, ignoring -writes to SW_INCR with bit n clear. - -Event rotation means that there's no fixed relationship between -perf_events and HW counters, so this isn't all that useful. - -Further, we program PMUSERENR.{SW,EN}=={0,0}, which causes EL0 writes to -PMSWINC_EL0 to be trapped and handled as UNDEFINED, resulting in a -SIGILL to userspace. - -Given that, it's not a good idea to expose SW_INCR in sysfs. Hide it as -we did for CHAIN back in commit: - - 4ba2578fa7b55701 ("arm64: perf: don't expose CHAIN event in sysfs") - -Signed-off-by: Mark Rutland <mark.rutland@arm.com> -Cc: Will Deacon <will@kernel.org> -Link: https://lore.kernel.org/r/20231204115847.2993026-1-mark.rutland@arm.com -Signed-off-by: Will Deacon <will@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/perf/arm_pmuv3.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/drivers/perf/arm_pmuv3.c b/drivers/perf/arm_pmuv3.c -index 6ca7be05229c..0e80fdc9f9ca 100644 ---- a/drivers/perf/arm_pmuv3.c -+++ b/drivers/perf/arm_pmuv3.c -@@ -169,7 +169,11 @@ armv8pmu_events_sysfs_show(struct device *dev, - PMU_EVENT_ATTR_ID(name, armv8pmu_events_sysfs_show, config) - - static struct attribute *armv8_pmuv3_event_attrs[] = { -- ARMV8_EVENT_ATTR(sw_incr, ARMV8_PMUV3_PERFCTR_SW_INCR), -+ /* -+ * Don't expose the sw_incr event in /sys. It's not usable as writes to -+ * PMSWINC_EL0 will trap as PMUSERENR.{SW,EN}=={0,0} and event rotation -+ * means we don't have a fixed event<->counter relationship regardless. -+ */ - ARMV8_EVENT_ATTR(l1i_cache_refill, ARMV8_PMUV3_PERFCTR_L1I_CACHE_REFILL), - ARMV8_EVENT_ATTR(l1i_tlb_refill, ARMV8_PMUV3_PERFCTR_L1I_TLB_REFILL), - ARMV8_EVENT_ATTR(l1d_cache_refill, ARMV8_PMUV3_PERFCTR_L1D_CACHE_REFILL), --- -2.43.2 - -From 0884f6aee51ec4620a6d913fe14aa68c90637a82 Mon Sep 17 00:00:00 2001 -From: Michael Ellerman <mpe@ellerman.id.au> -Date: Thu, 30 Nov 2023 22:44:33 +1100 -Subject: [PATCH 1022/1501] powerpc: Fix build error due to is_valid_bugaddr() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1172 -Lines: 37 - -[ Upstream commit f8d3555355653848082c351fa90775214fb8a4fa ] - -With CONFIG_GENERIC_BUG=n the build fails with: - - arch/powerpc/kernel/traps.c:1442:5: error: no previous prototype for ‘is_valid_bugaddr’ [-Werror=missing-prototypes] - 1442 | int is_valid_bugaddr(unsigned long addr) - | ^~~~~~~~~~~~~~~~ - -The prototype is only defined, and the function is only needed, when -CONFIG_GENERIC_BUG=y, so move the implementation under that. - -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Link: https://msgid.link/20231130114433.3053544-2-mpe@ellerman.id.au -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/powerpc/kernel/traps.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c -index 5ea2014aff90..11e062b47d3f 100644 ---- a/arch/powerpc/kernel/traps.c -+++ b/arch/powerpc/kernel/traps.c -@@ -1439,10 +1439,12 @@ static int emulate_instruction(struct pt_regs *regs) - return -EINVAL; - } - -+#ifdef CONFIG_GENERIC_BUG - int is_valid_bugaddr(unsigned long addr) - { - return is_kernel_addr(addr); - } -+#endif - - #ifdef CONFIG_MATH_EMULATION - static int emulate_math(struct pt_regs *regs) --- -2.43.2 - -From 66ddd3c89596ad7b3d1ce157af847d27b1ff84bb Mon Sep 17 00:00:00 2001 -From: Michael Ellerman <mpe@ellerman.id.au> -Date: Thu, 30 Nov 2023 22:44:32 +1100 -Subject: [PATCH 1023/1501] powerpc/mm: Fix build failures due to - arch_reserved_kernel_pages() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2183 -Lines: 57 - -[ Upstream commit d8c3f243d4db24675b653f0568bb65dae34e6455 ] - -With NUMA=n and FA_DUMP=y or PRESERVE_FA_DUMP=y the build fails with: - - arch/powerpc/kernel/fadump.c:1739:22: error: no previous prototype for ‘arch_reserved_kernel_pages’ [-Werror=missing-prototypes] - 1739 | unsigned long __init arch_reserved_kernel_pages(void) - | ^~~~~~~~~~~~~~~~~~~~~~~~~~ - -The prototype for arch_reserved_kernel_pages() is in include/linux/mm.h, -but it's guarded by __HAVE_ARCH_RESERVED_KERNEL_PAGES. The powerpc -headers define __HAVE_ARCH_RESERVED_KERNEL_PAGES in asm/mmzone.h, which -is not included into the generic headers when NUMA=n. - -Move the definition of __HAVE_ARCH_RESERVED_KERNEL_PAGES into asm/mmu.h -which is included regardless of NUMA=n. - -Additionally the ifdef around __HAVE_ARCH_RESERVED_KERNEL_PAGES needs to -also check for CONFIG_PRESERVE_FA_DUMP. - -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Link: https://msgid.link/20231130114433.3053544-1-mpe@ellerman.id.au -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/powerpc/include/asm/mmu.h | 4 ++++ - arch/powerpc/include/asm/mmzone.h | 3 --- - 2 files changed, 4 insertions(+), 3 deletions(-) - -diff --git a/arch/powerpc/include/asm/mmu.h b/arch/powerpc/include/asm/mmu.h -index 52cc25864a1b..d8b7e246a32f 100644 ---- a/arch/powerpc/include/asm/mmu.h -+++ b/arch/powerpc/include/asm/mmu.h -@@ -412,5 +412,9 @@ extern void *abatron_pteptrs[2]; - #include <asm/nohash/mmu.h> - #endif - -+#if defined(CONFIG_FA_DUMP) || defined(CONFIG_PRESERVE_FA_DUMP) -+#define __HAVE_ARCH_RESERVED_KERNEL_PAGES -+#endif -+ - #endif /* __KERNEL__ */ - #endif /* _ASM_POWERPC_MMU_H_ */ -diff --git a/arch/powerpc/include/asm/mmzone.h b/arch/powerpc/include/asm/mmzone.h -index 4c6c6dbd182f..3764d3585d30 100644 ---- a/arch/powerpc/include/asm/mmzone.h -+++ b/arch/powerpc/include/asm/mmzone.h -@@ -42,9 +42,6 @@ u64 memory_hotplug_max(void); - #else - #define memory_hotplug_max() memblock_end_of_DRAM() - #endif /* CONFIG_NUMA */ --#ifdef CONFIG_FA_DUMP --#define __HAVE_ARCH_RESERVED_KERNEL_PAGES --#endif - - #ifdef CONFIG_MEMORY_HOTPLUG - extern int create_section_mapping(unsigned long start, unsigned long end, --- -2.43.2 - -From 668067fbfaf433278eee092910cfd4a9acf86352 Mon Sep 17 00:00:00 2001 -From: Michael Ellerman <mpe@ellerman.id.au> -Date: Thu, 30 Nov 2023 00:19:19 +1100 -Subject: [PATCH 1024/1501] powerpc/64s: Fix CONFIG_NUMA=n build due to - create_section_mapping() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2004 -Lines: 54 - -[ Upstream commit ede66cd22441820cbd399936bf84fdc4294bc7fa ] - -With CONFIG_NUMA=n the build fails with: - - arch/powerpc/mm/book3s64/pgtable.c:275:15: error: no previous prototype for ‘create_section_mapping’ [-Werror=missing-prototypes] - 275 | int __meminit create_section_mapping(unsigned long start, unsigned long end, - | ^~~~~~~~~~~~~~~~~~~~~~ - -That happens because the prototype for create_section_mapping() is in -asm/mmzone.h, but asm/mmzone.h is only included by linux/mmzone.h -when CONFIG_NUMA=y. - -In fact the prototype is only needed by arch/powerpc/mm code, so move -the prototype into arch/powerpc/mm/mmu_decl.h, which also fixes the -build error. - -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Link: https://msgid.link/20231129131919.2528517-5-mpe@ellerman.id.au -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/powerpc/include/asm/mmzone.h | 5 ----- - arch/powerpc/mm/mmu_decl.h | 5 +++++ - 2 files changed, 5 insertions(+), 5 deletions(-) - -diff --git a/arch/powerpc/include/asm/mmzone.h b/arch/powerpc/include/asm/mmzone.h -index 3764d3585d30..da827d2d0866 100644 ---- a/arch/powerpc/include/asm/mmzone.h -+++ b/arch/powerpc/include/asm/mmzone.h -@@ -43,10 +43,5 @@ u64 memory_hotplug_max(void); - #define memory_hotplug_max() memblock_end_of_DRAM() - #endif /* CONFIG_NUMA */ - --#ifdef CONFIG_MEMORY_HOTPLUG --extern int create_section_mapping(unsigned long start, unsigned long end, -- int nid, pgprot_t prot); --#endif -- - #endif /* __KERNEL__ */ - #endif /* _ASM_MMZONE_H_ */ -diff --git a/arch/powerpc/mm/mmu_decl.h b/arch/powerpc/mm/mmu_decl.h -index 7f9ff0640124..72341b9fb552 100644 ---- a/arch/powerpc/mm/mmu_decl.h -+++ b/arch/powerpc/mm/mmu_decl.h -@@ -181,3 +181,8 @@ static inline bool debug_pagealloc_enabled_or_kfence(void) - { - return IS_ENABLED(CONFIG_KFENCE) || debug_pagealloc_enabled(); - } -+ -+#ifdef CONFIG_MEMORY_HOTPLUG -+int create_section_mapping(unsigned long start, unsigned long end, -+ int nid, pgprot_t prot); -+#endif --- -2.43.2 - -From 042dd3ac6870e6c8769e72cba8da4c76a686fe86 Mon Sep 17 00:00:00 2001 -From: Jun'ichi Nomura <junichi.nomura@nec.com> -Date: Wed, 29 Nov 2023 15:44:49 -0500 -Subject: [PATCH 1025/1501] x86/boot: Ignore NMIs during very early boot -Content-Length: 3261 -Lines: 86 - -[ Upstream commit 78a509fba9c9b1fcb77f95b7c6be30da3d24823a ] - -When there are two racing NMIs on x86, the first NMI invokes NMI handler and -the 2nd NMI is latched until IRET is executed. - -If panic on NMI and panic kexec are enabled, the first NMI triggers -panic and starts booting the next kernel via kexec. Note that the 2nd -NMI is still latched. During the early boot of the next kernel, once -an IRET is executed as a result of a page fault, then the 2nd NMI is -unlatched and invokes the NMI handler. - -However, NMI handler is not set up at the early stage of boot, which -results in a boot failure. - -Avoid such problems by setting up a NOP handler for early NMIs. - -[ mingo: Refined the changelog. ] - -Signed-off-by: Jun'ichi Nomura <junichi.nomura@nec.com> -Signed-off-by: Derek Barbosa <debarbos@redhat.com> -Signed-off-by: Ingo Molnar <mingo@kernel.org> -Cc: Kees Cook <keescook@chromium.org> -Cc: Linus Torvalds <torvalds@linux-foundation.org> -Cc: Paul E. McKenney <paulmck@kernel.org> -Cc: Andy Lutomirski <luto@kernel.org> -Cc: "H. Peter Anvin" <hpa@zytor.com> -Cc: Peter Zijlstra <peterz@infradead.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/x86/boot/compressed/ident_map_64.c | 5 +++++ - arch/x86/boot/compressed/idt_64.c | 1 + - arch/x86/boot/compressed/idt_handlers_64.S | 1 + - arch/x86/boot/compressed/misc.h | 1 + - 4 files changed, 8 insertions(+) - -diff --git a/arch/x86/boot/compressed/ident_map_64.c b/arch/x86/boot/compressed/ident_map_64.c -index 473ba59b82a8..d040080d7edb 100644 ---- a/arch/x86/boot/compressed/ident_map_64.c -+++ b/arch/x86/boot/compressed/ident_map_64.c -@@ -386,3 +386,8 @@ void do_boot_page_fault(struct pt_regs *regs, unsigned long error_code) - */ - kernel_add_identity_map(address, end); - } -+ -+void do_boot_nmi_trap(struct pt_regs *regs, unsigned long error_code) -+{ -+ /* Empty handler to ignore NMI during early boot */ -+} -diff --git a/arch/x86/boot/compressed/idt_64.c b/arch/x86/boot/compressed/idt_64.c -index 3cdf94b41456..d100284bbef4 100644 ---- a/arch/x86/boot/compressed/idt_64.c -+++ b/arch/x86/boot/compressed/idt_64.c -@@ -61,6 +61,7 @@ void load_stage2_idt(void) - boot_idt_desc.address = (unsigned long)boot_idt; - - set_idt_entry(X86_TRAP_PF, boot_page_fault); -+ set_idt_entry(X86_TRAP_NMI, boot_nmi_trap); - - #ifdef CONFIG_AMD_MEM_ENCRYPT - /* -diff --git a/arch/x86/boot/compressed/idt_handlers_64.S b/arch/x86/boot/compressed/idt_handlers_64.S -index 22890e199f5b..4d03c8562f63 100644 ---- a/arch/x86/boot/compressed/idt_handlers_64.S -+++ b/arch/x86/boot/compressed/idt_handlers_64.S -@@ -70,6 +70,7 @@ SYM_FUNC_END(\name) - .code64 - - EXCEPTION_HANDLER boot_page_fault do_boot_page_fault error_code=1 -+EXCEPTION_HANDLER boot_nmi_trap do_boot_nmi_trap error_code=0 - - #ifdef CONFIG_AMD_MEM_ENCRYPT - EXCEPTION_HANDLER boot_stage1_vc do_vc_no_ghcb error_code=1 -diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h -index c0d502bd8716..bc2f0f17fb90 100644 ---- a/arch/x86/boot/compressed/misc.h -+++ b/arch/x86/boot/compressed/misc.h -@@ -196,6 +196,7 @@ static inline void cleanup_exception_handling(void) { } - - /* IDT Entry Points */ - void boot_page_fault(void); -+void boot_nmi_trap(void); - void boot_stage1_vc(void); - void boot_stage2_vc(void); - --- -2.43.2 - -From eec31eb2baf23f950448b8ba356b4b9d32b4add6 Mon Sep 17 00:00:00 2001 -From: Stephen Rothwell <sfr@canb.auug.org.au> -Date: Mon, 27 Nov 2023 13:28:09 +1100 -Subject: [PATCH 1026/1501] powerpc: pmd_move_must_withdraw() is only needed - for CONFIG_TRANSPARENT_HUGEPAGE -Content-Length: 1634 -Lines: 47 - -[ Upstream commit 0d555b57ee660d8a871781c0eebf006e855e918d ] - -The linux-next build of powerpc64 allnoconfig fails with: - - arch/powerpc/mm/book3s64/pgtable.c:557:5: error: no previous prototype for 'pmd_move_must_withdraw' - 557 | int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl, - | ^~~~~~~~~~~~~~~~~~~~~~ - -Caused by commit: - - c6345dfa6e3e ("Makefile.extrawarn: turn on missing-prototypes globally") - -Fix it by moving the function definition under -CONFIG_TRANSPARENT_HUGEPAGE like the prototype. The function is only -called when CONFIG_TRANSPARENT_HUGEPAGE=y. - -Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au> -[mpe: Flesh out change log from linux-next patch] -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Link: https://msgid.link/20231127132809.45c2b398@canb.auug.org.au -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/powerpc/mm/book3s64/pgtable.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/arch/powerpc/mm/book3s64/pgtable.c b/arch/powerpc/mm/book3s64/pgtable.c -index be229290a6a7..3438ab72c346 100644 ---- a/arch/powerpc/mm/book3s64/pgtable.c -+++ b/arch/powerpc/mm/book3s64/pgtable.c -@@ -542,6 +542,7 @@ void ptep_modify_prot_commit(struct vm_area_struct *vma, unsigned long addr, - set_pte_at(vma->vm_mm, addr, ptep, pte); - } - -+#ifdef CONFIG_TRANSPARENT_HUGEPAGE - /* - * For hash translation mode, we use the deposited table to store hash slot - * information and they are stored at PTRS_PER_PMD offset from related pmd -@@ -563,6 +564,7 @@ int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl, - - return true; - } -+#endif - - /* - * Does the CPU support tlbie? --- -2.43.2 - -From 848e1d7fd710900397e1d0e7584680c1c04e3afd Mon Sep 17 00:00:00 2001 -From: Naveen N Rao <naveen@kernel.org> -Date: Thu, 23 Nov 2023 12:47:05 +0530 -Subject: [PATCH 1027/1501] powerpc/lib: Validate size for vector operations -Content-Length: 1972 -Lines: 63 - -[ Upstream commit 8f9abaa6d7de0a70fc68acaedce290c1f96e2e59 ] - -Some of the fp/vmx code in sstep.c assume a certain maximum size for the -instructions being emulated. The size of those operations however is -determined separately in analyse_instr(). - -Add a check to validate the assumption on the maximum size of the -operations, so as to prevent any unintended kernel stack corruption. - -Signed-off-by: Naveen N Rao <naveen@kernel.org> -Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> -Build-tested-by: Gustavo A. R. Silva <gustavoars@kernel.org> -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Link: https://msgid.link/20231123071705.397625-1-naveen@kernel.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/powerpc/lib/sstep.c | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c -index a4ab8625061a..6af97dc0f6d5 100644 ---- a/arch/powerpc/lib/sstep.c -+++ b/arch/powerpc/lib/sstep.c -@@ -586,6 +586,8 @@ static int do_fp_load(struct instruction_op *op, unsigned long ea, - } u; - - nb = GETSIZE(op->type); -+ if (nb > sizeof(u)) -+ return -EINVAL; - if (!address_ok(regs, ea, nb)) - return -EFAULT; - rn = op->reg; -@@ -636,6 +638,8 @@ static int do_fp_store(struct instruction_op *op, unsigned long ea, - } u; - - nb = GETSIZE(op->type); -+ if (nb > sizeof(u)) -+ return -EINVAL; - if (!address_ok(regs, ea, nb)) - return -EFAULT; - rn = op->reg; -@@ -680,6 +684,9 @@ static nokprobe_inline int do_vec_load(int rn, unsigned long ea, - u8 b[sizeof(__vector128)]; - } u = {}; - -+ if (size > sizeof(u)) -+ return -EINVAL; -+ - if (!address_ok(regs, ea & ~0xfUL, 16)) - return -EFAULT; - /* align to multiple of size */ -@@ -707,6 +714,9 @@ static nokprobe_inline int do_vec_store(int rn, unsigned long ea, - u8 b[sizeof(__vector128)]; - } u; - -+ if (size > sizeof(u)) -+ return -EINVAL; -+ - if (!address_ok(regs, ea & ~0xfUL, 16)) - return -EFAULT; - /* align to multiple of size */ --- -2.43.2 - -From 6182cb4d5272087a05ebe9c828367ec933910ea8 Mon Sep 17 00:00:00 2001 -From: Zhiquan Li <zhiquan1.li@intel.com> -Date: Thu, 26 Oct 2023 08:39:03 +0800 -Subject: [PATCH 1028/1501] x86/mce: Mark fatal MCE's page as poison to avoid - panic in the kdump kernel -Content-Length: 2594 -Lines: 74 - -[ Upstream commit 9f3b130048bfa2e44a8cfb1b616f826d9d5d8188 ] - -Memory errors don't happen very often, especially fatal ones. However, -in large-scale scenarios such as data centers, that probability -increases with the amount of machines present. - -When a fatal machine check happens, mce_panic() is called based on the -severity grading of that error. The page containing the error is not -marked as poison. - -However, when kexec is enabled, tools like makedumpfile understand when -pages are marked as poison and do not touch them so as not to cause -a fatal machine check exception again while dumping the previous -kernel's memory. - -Therefore, mark the page containing the error as poisoned so that the -kexec'ed kernel can avoid accessing the page. - - [ bp: Rewrite commit message and comment. ] - -Co-developed-by: Youquan Song <youquan.song@intel.com> -Signed-off-by: Youquan Song <youquan.song@intel.com> -Signed-off-by: Zhiquan Li <zhiquan1.li@intel.com> -Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> -Reviewed-by: Naoya Horiguchi <naoya.horiguchi@nec.com> -Link: https://lore.kernel.org/r/20231014051754.3759099-1-zhiquan1.li@intel.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/x86/kernel/cpu/mce/core.c | 16 ++++++++++++++++ - 1 file changed, 16 insertions(+) - -diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c -index 7b397370b4d6..df8d25e744d1 100644 ---- a/arch/x86/kernel/cpu/mce/core.c -+++ b/arch/x86/kernel/cpu/mce/core.c -@@ -44,6 +44,7 @@ - #include <linux/sync_core.h> - #include <linux/task_work.h> - #include <linux/hardirq.h> -+#include <linux/kexec.h> - - #include <asm/intel-family.h> - #include <asm/processor.h> -@@ -233,6 +234,7 @@ static noinstr void mce_panic(const char *msg, struct mce *final, char *exp) - struct llist_node *pending; - struct mce_evt_llist *l; - int apei_err = 0; -+ struct page *p; - - /* - * Allow instrumentation around external facilities usage. Not that it -@@ -286,6 +288,20 @@ static noinstr void mce_panic(const char *msg, struct mce *final, char *exp) - if (!fake_panic) { - if (panic_timeout == 0) - panic_timeout = mca_cfg.panic_timeout; -+ -+ /* -+ * Kdump skips the poisoned page in order to avoid -+ * touching the error bits again. Poison the page even -+ * if the error is fatal and the machine is about to -+ * panic. -+ */ -+ if (kexec_crash_loaded()) { -+ if (final && (final->status & MCI_STATUS_ADDRV)) { -+ p = pfn_to_online_page(final->addr >> PAGE_SHIFT); -+ if (p) -+ SetPageHWPoison(p); -+ } -+ } - panic(msg); - } else - pr_emerg(HW_ERR "Fake kernel panic: %s\n", msg); --- -2.43.2 - -From f1c4ed0b5f8b11aa5cd725f2bbaaa9ba6f8738f3 Mon Sep 17 00:00:00 2001 -From: Raghavendra K T <raghavendra.kt@amd.com> -Date: Fri, 20 Oct 2023 21:27:46 +0530 -Subject: [PATCH 1029/1501] sched/numa: Fix mm numa_scan_seq based - unconditional scan -Content-Length: 4090 -Lines: 112 - -[ Upstream commit 84db47ca7146d7bd00eb5cf2b93989a971c84650 ] - -Since commit fc137c0ddab2 ("sched/numa: enhance vma scanning logic") - -NUMA Balancing allows updating PTEs to trap NUMA hinting faults if the -task had previously accessed VMA. However unconditional scan of VMAs are -allowed during initial phase of VMA creation until process's -mm numa_scan_seq reaches 2 even though current task had not accessed VMA. - -Rationale: - - Without initial scan subsequent PTE update may never happen. - - Give fair opportunity to all the VMAs to be scanned and subsequently -understand the access pattern of all the VMAs. - -But it has a corner case where, if a VMA is created after some time, -process's mm numa_scan_seq could be already greater than 2. - -For e.g., values of mm numa_scan_seq when VMAs are created by running -mmtest autonuma benchmark briefly looks like: -start_seq=0 : 459 -start_seq=2 : 138 -start_seq=3 : 144 -start_seq=4 : 8 -start_seq=8 : 1 -start_seq=9 : 1 -This results in no unconditional PTE updates for those VMAs created after -some time. - -Fix: - - Note down the initial value of mm numa_scan_seq in per VMA start_seq. - - Allow unconditional scan till start_seq + 2. - -Result: -SUT: AMD EPYC Milan with 2 NUMA nodes 256 cpus. -base kernel: upstream 6.6-rc6 with Mels patches [1] applied. - -kernbench -========== base patched %gain -Amean elsp-128 165.09 ( 0.00%) 164.78 * 0.19%* - -Duration User 41404.28 41375.08 -Duration System 9862.22 9768.48 -Duration Elapsed 519.87 518.72 - -Ops NUMA PTE updates 1041416.00 831536.00 -Ops NUMA hint faults 263296.00 220966.00 -Ops NUMA pages migrated 258021.00 212769.00 -Ops AutoNUMA cost 1328.67 1114.69 - -autonumabench - -NUMA01_THREADLOCAL -================== -Amean elsp-NUMA01_THREADLOCAL 81.79 (0.00%) 67.74 * 17.18%* - -Duration User 54832.73 47379.67 -Duration System 75.00 185.75 -Duration Elapsed 576.72 476.09 - -Ops NUMA PTE updates 394429.00 11121044.00 -Ops NUMA hint faults 1001.00 8906404.00 -Ops NUMA pages migrated 288.00 2998694.00 -Ops AutoNUMA cost 7.77 44666.84 - -Signed-off-by: Raghavendra K T <raghavendra.kt@amd.com> -Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> -Acked-by: Mel Gorman <mgorman@suse.de> -Link: https://lore.kernel.org/r/2ea7cbce80ac7c62e90cbfb9653a7972f902439f.1697816692.git.raghavendra.kt@amd.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/linux/mm_types.h | 3 +++ - kernel/sched/fair.c | 4 +++- - 2 files changed, 6 insertions(+), 1 deletion(-) - -diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h -index 957ce38768b2..950df415d7de 100644 ---- a/include/linux/mm_types.h -+++ b/include/linux/mm_types.h -@@ -600,6 +600,9 @@ struct vma_numab_state { - */ - unsigned long pids_active[2]; - -+ /* MM scan sequence ID when scan first started after VMA creation */ -+ int start_scan_seq; -+ - /* - * MM scan sequence ID when the VMA was last completely scanned. - * A VMA is not eligible for scanning if prev_scan_seq == numa_scan_seq -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 4182fb118ce9..3070c6f7168e 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -3164,7 +3164,7 @@ static bool vma_is_accessed(struct mm_struct *mm, struct vm_area_struct *vma) - * This is also done to avoid any side effect of task scanning - * amplifying the unfairness of disjoint set of VMAs' access. - */ -- if (READ_ONCE(current->mm->numa_scan_seq) < 2) -+ if ((READ_ONCE(current->mm->numa_scan_seq) - vma->numab_state->start_scan_seq) < 2) - return true; - - pids = vma->numab_state->pids_active[0] | vma->numab_state->pids_active[1]; -@@ -3307,6 +3307,8 @@ static void task_numa_work(struct callback_head *work) - if (!vma->numab_state) - continue; - -+ vma->numab_state->start_scan_seq = mm->numa_scan_seq; -+ - vma->numab_state->next_scan = now + - msecs_to_jiffies(sysctl_numa_balancing_scan_delay); - --- -2.43.2 - -From 07786d86e6da363cc6f6303ed5b120704ab468d1 Mon Sep 17 00:00:00 2001 -From: Greg KH <gregkh@linuxfoundation.org> -Date: Mon, 12 Jun 2023 15:09:09 +0200 -Subject: [PATCH 1030/1501] perf/core: Fix narrow startup race when creating - the perf nr_addr_filters sysfs file -Content-Length: 1886 -Lines: 73 - -[ Upstream commit 652ffc2104ec1f69dd4a46313888c33527145ccf ] - -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> -Link: https://lkml.kernel.org/r/2023061204-decal-flyable-6090@gregkh -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - kernel/events/core.c | 40 ++++++++++++++++++++++++++++------------ - 1 file changed, 28 insertions(+), 12 deletions(-) - -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 9efd0d7775e7..fbecba5b00b1 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -11425,9 +11425,32 @@ static DEVICE_ATTR_RW(perf_event_mux_interval_ms); - static struct attribute *pmu_dev_attrs[] = { - &dev_attr_type.attr, - &dev_attr_perf_event_mux_interval_ms.attr, -+ &dev_attr_nr_addr_filters.attr, -+ NULL, -+}; -+ -+static umode_t pmu_dev_is_visible(struct kobject *kobj, struct attribute *a, int n) -+{ -+ struct device *dev = kobj_to_dev(kobj); -+ struct pmu *pmu = dev_get_drvdata(dev); -+ -+ if (!pmu->nr_addr_filters) -+ return 0; -+ -+ return a->mode; -+ -+ return 0; -+} -+ -+static struct attribute_group pmu_dev_attr_group = { -+ .is_visible = pmu_dev_is_visible, -+ .attrs = pmu_dev_attrs, -+}; -+ -+static const struct attribute_group *pmu_dev_groups[] = { -+ &pmu_dev_attr_group, - NULL, - }; --ATTRIBUTE_GROUPS(pmu_dev); - - static int pmu_bus_running; - static struct bus_type pmu_bus = { -@@ -11464,18 +11487,11 @@ static int pmu_dev_alloc(struct pmu *pmu) - if (ret) - goto free_dev; - -- /* For PMUs with address filters, throw in an extra attribute: */ -- if (pmu->nr_addr_filters) -- ret = device_create_file(pmu->dev, &dev_attr_nr_addr_filters); -- -- if (ret) -- goto del_dev; -- -- if (pmu->attr_update) -+ if (pmu->attr_update) { - ret = sysfs_update_groups(&pmu->dev->kobj, pmu->attr_update); -- -- if (ret) -- goto del_dev; -+ if (ret) -+ goto del_dev; -+ } - - out: - return ret; --- -2.43.2 - -From 2be831bbf57ba6cf76c85b9e96c008f4d04a26b1 Mon Sep 17 00:00:00 2001 -From: Andrzej Hajda <andrzej.hajda@intel.com> -Date: Wed, 25 Oct 2023 23:39:07 +0200 -Subject: [PATCH 1031/1501] debugobjects: Stop accessing objects after - releasing hash bucket lock -Content-Length: 11123 -Lines: 401 - -[ Upstream commit 9bb6362652f3f4d74a87d572a91ee1b38e673ef6 ] - -After release of the hashbucket lock the tracking object can be modified or -freed by a concurrent thread. Using it in such a case is error prone, even -for printing the object state: - - 1. T1 tries to deactivate destroyed object, debugobjects detects it, - hash bucket lock is released. - - 2. T2 preempts T1 and frees the tracking object. - - 3. The freed tracking object is allocated and initialized for a - different to be tracked kernel object. - - 4. T1 resumes and reports error for wrong kernel object. - -Create a local copy of the tracking object before releasing the hash bucket -lock and use the local copy for reporting and fixups to prevent this. - -Signed-off-by: Andrzej Hajda <andrzej.hajda@intel.com> -Signed-off-by: Thomas Gleixner <tglx@linutronix.de> -Link: https://lore.kernel.org/r/20231025-debugobjects_fix-v3-1-2bc3bf7084c2@intel.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - lib/debugobjects.c | 204 ++++++++++++++++++--------------------------- - 1 file changed, 80 insertions(+), 124 deletions(-) - -diff --git a/lib/debugobjects.c b/lib/debugobjects.c -index 2a8e9d63fbe3..fb12a9bacd2f 100644 ---- a/lib/debugobjects.c -+++ b/lib/debugobjects.c -@@ -620,9 +620,8 @@ static void debug_objects_fill_pool(void) - static void - __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstack) - { -- enum debug_obj_state state; -+ struct debug_obj *obj, o; - struct debug_bucket *db; -- struct debug_obj *obj; - unsigned long flags; - - debug_objects_fill_pool(); -@@ -643,24 +642,18 @@ __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstack - case ODEBUG_STATE_INIT: - case ODEBUG_STATE_INACTIVE: - obj->state = ODEBUG_STATE_INIT; -- break; -- -- case ODEBUG_STATE_ACTIVE: -- state = obj->state; - raw_spin_unlock_irqrestore(&db->lock, flags); -- debug_print_object(obj, "init"); -- debug_object_fixup(descr->fixup_init, addr, state); -- return; -- -- case ODEBUG_STATE_DESTROYED: -- raw_spin_unlock_irqrestore(&db->lock, flags); -- debug_print_object(obj, "init"); - return; - default: - break; - } - -+ o = *obj; - raw_spin_unlock_irqrestore(&db->lock, flags); -+ debug_print_object(&o, "init"); -+ -+ if (o.state == ODEBUG_STATE_ACTIVE) -+ debug_object_fixup(descr->fixup_init, addr, o.state); - } - - /** -@@ -701,11 +694,9 @@ EXPORT_SYMBOL_GPL(debug_object_init_on_stack); - int debug_object_activate(void *addr, const struct debug_obj_descr *descr) - { - struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr }; -- enum debug_obj_state state; - struct debug_bucket *db; - struct debug_obj *obj; - unsigned long flags; -- int ret; - - if (!debug_objects_enabled) - return 0; -@@ -717,49 +708,38 @@ int debug_object_activate(void *addr, const struct debug_obj_descr *descr) - raw_spin_lock_irqsave(&db->lock, flags); - - obj = lookup_object_or_alloc(addr, db, descr, false, true); -- if (likely(!IS_ERR_OR_NULL(obj))) { -- bool print_object = false; -- -+ if (unlikely(!obj)) { -+ raw_spin_unlock_irqrestore(&db->lock, flags); -+ debug_objects_oom(); -+ return 0; -+ } else if (likely(!IS_ERR(obj))) { - switch (obj->state) { -+ case ODEBUG_STATE_ACTIVE: -+ case ODEBUG_STATE_DESTROYED: -+ o = *obj; -+ break; - case ODEBUG_STATE_INIT: - case ODEBUG_STATE_INACTIVE: - obj->state = ODEBUG_STATE_ACTIVE; -- ret = 0; -- break; -- -- case ODEBUG_STATE_ACTIVE: -- state = obj->state; -- raw_spin_unlock_irqrestore(&db->lock, flags); -- debug_print_object(obj, "activate"); -- ret = debug_object_fixup(descr->fixup_activate, addr, state); -- return ret ? 0 : -EINVAL; -- -- case ODEBUG_STATE_DESTROYED: -- print_object = true; -- ret = -EINVAL; -- break; -+ fallthrough; - default: -- ret = 0; -- break; -+ raw_spin_unlock_irqrestore(&db->lock, flags); -+ return 0; - } -- raw_spin_unlock_irqrestore(&db->lock, flags); -- if (print_object) -- debug_print_object(obj, "activate"); -- return ret; - } - - raw_spin_unlock_irqrestore(&db->lock, flags); -- -- /* If NULL the allocation has hit OOM */ -- if (!obj) { -- debug_objects_oom(); -- return 0; -- } -- -- /* Object is neither static nor tracked. It's not initialized */ - debug_print_object(&o, "activate"); -- ret = debug_object_fixup(descr->fixup_activate, addr, ODEBUG_STATE_NOTAVAILABLE); -- return ret ? 0 : -EINVAL; -+ -+ switch (o.state) { -+ case ODEBUG_STATE_ACTIVE: -+ case ODEBUG_STATE_NOTAVAILABLE: -+ if (debug_object_fixup(descr->fixup_activate, addr, o.state)) -+ return 0; -+ fallthrough; -+ default: -+ return -EINVAL; -+ } - } - EXPORT_SYMBOL_GPL(debug_object_activate); - -@@ -770,10 +750,10 @@ EXPORT_SYMBOL_GPL(debug_object_activate); - */ - void debug_object_deactivate(void *addr, const struct debug_obj_descr *descr) - { -+ struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr }; - struct debug_bucket *db; - struct debug_obj *obj; - unsigned long flags; -- bool print_object = false; - - if (!debug_objects_enabled) - return; -@@ -785,33 +765,24 @@ void debug_object_deactivate(void *addr, const struct debug_obj_descr *descr) - obj = lookup_object(addr, db); - if (obj) { - switch (obj->state) { -+ case ODEBUG_STATE_DESTROYED: -+ break; - case ODEBUG_STATE_INIT: - case ODEBUG_STATE_INACTIVE: - case ODEBUG_STATE_ACTIVE: -- if (!obj->astate) -- obj->state = ODEBUG_STATE_INACTIVE; -- else -- print_object = true; -- break; -- -- case ODEBUG_STATE_DESTROYED: -- print_object = true; -- break; -+ if (obj->astate) -+ break; -+ obj->state = ODEBUG_STATE_INACTIVE; -+ fallthrough; - default: -- break; -+ raw_spin_unlock_irqrestore(&db->lock, flags); -+ return; - } -+ o = *obj; - } - - raw_spin_unlock_irqrestore(&db->lock, flags); -- if (!obj) { -- struct debug_obj o = { .object = addr, -- .state = ODEBUG_STATE_NOTAVAILABLE, -- .descr = descr }; -- -- debug_print_object(&o, "deactivate"); -- } else if (print_object) { -- debug_print_object(obj, "deactivate"); -- } -+ debug_print_object(&o, "deactivate"); - } - EXPORT_SYMBOL_GPL(debug_object_deactivate); - -@@ -822,11 +793,9 @@ EXPORT_SYMBOL_GPL(debug_object_deactivate); - */ - void debug_object_destroy(void *addr, const struct debug_obj_descr *descr) - { -- enum debug_obj_state state; -+ struct debug_obj *obj, o; - struct debug_bucket *db; -- struct debug_obj *obj; - unsigned long flags; -- bool print_object = false; - - if (!debug_objects_enabled) - return; -@@ -836,32 +805,31 @@ void debug_object_destroy(void *addr, const struct debug_obj_descr *descr) - raw_spin_lock_irqsave(&db->lock, flags); - - obj = lookup_object(addr, db); -- if (!obj) -- goto out_unlock; -+ if (!obj) { -+ raw_spin_unlock_irqrestore(&db->lock, flags); -+ return; -+ } - - switch (obj->state) { -+ case ODEBUG_STATE_ACTIVE: -+ case ODEBUG_STATE_DESTROYED: -+ break; - case ODEBUG_STATE_NONE: - case ODEBUG_STATE_INIT: - case ODEBUG_STATE_INACTIVE: - obj->state = ODEBUG_STATE_DESTROYED; -- break; -- case ODEBUG_STATE_ACTIVE: -- state = obj->state; -- raw_spin_unlock_irqrestore(&db->lock, flags); -- debug_print_object(obj, "destroy"); -- debug_object_fixup(descr->fixup_destroy, addr, state); -- return; -- -- case ODEBUG_STATE_DESTROYED: -- print_object = true; -- break; -+ fallthrough; - default: -- break; -+ raw_spin_unlock_irqrestore(&db->lock, flags); -+ return; - } --out_unlock: -+ -+ o = *obj; - raw_spin_unlock_irqrestore(&db->lock, flags); -- if (print_object) -- debug_print_object(obj, "destroy"); -+ debug_print_object(&o, "destroy"); -+ -+ if (o.state == ODEBUG_STATE_ACTIVE) -+ debug_object_fixup(descr->fixup_destroy, addr, o.state); - } - EXPORT_SYMBOL_GPL(debug_object_destroy); - -@@ -872,9 +840,8 @@ EXPORT_SYMBOL_GPL(debug_object_destroy); - */ - void debug_object_free(void *addr, const struct debug_obj_descr *descr) - { -- enum debug_obj_state state; -+ struct debug_obj *obj, o; - struct debug_bucket *db; -- struct debug_obj *obj; - unsigned long flags; - - if (!debug_objects_enabled) -@@ -885,24 +852,26 @@ void debug_object_free(void *addr, const struct debug_obj_descr *descr) - raw_spin_lock_irqsave(&db->lock, flags); - - obj = lookup_object(addr, db); -- if (!obj) -- goto out_unlock; -+ if (!obj) { -+ raw_spin_unlock_irqrestore(&db->lock, flags); -+ return; -+ } - - switch (obj->state) { - case ODEBUG_STATE_ACTIVE: -- state = obj->state; -- raw_spin_unlock_irqrestore(&db->lock, flags); -- debug_print_object(obj, "free"); -- debug_object_fixup(descr->fixup_free, addr, state); -- return; -+ break; - default: - hlist_del(&obj->node); - raw_spin_unlock_irqrestore(&db->lock, flags); - free_object(obj); - return; - } --out_unlock: -+ -+ o = *obj; - raw_spin_unlock_irqrestore(&db->lock, flags); -+ debug_print_object(&o, "free"); -+ -+ debug_object_fixup(descr->fixup_free, addr, o.state); - } - EXPORT_SYMBOL_GPL(debug_object_free); - -@@ -954,10 +923,10 @@ void - debug_object_active_state(void *addr, const struct debug_obj_descr *descr, - unsigned int expect, unsigned int next) - { -+ struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr }; - struct debug_bucket *db; - struct debug_obj *obj; - unsigned long flags; -- bool print_object = false; - - if (!debug_objects_enabled) - return; -@@ -970,28 +939,19 @@ debug_object_active_state(void *addr, const struct debug_obj_descr *descr, - if (obj) { - switch (obj->state) { - case ODEBUG_STATE_ACTIVE: -- if (obj->astate == expect) -- obj->astate = next; -- else -- print_object = true; -- break; -- -+ if (obj->astate != expect) -+ break; -+ obj->astate = next; -+ raw_spin_unlock_irqrestore(&db->lock, flags); -+ return; - default: -- print_object = true; - break; - } -+ o = *obj; - } - - raw_spin_unlock_irqrestore(&db->lock, flags); -- if (!obj) { -- struct debug_obj o = { .object = addr, -- .state = ODEBUG_STATE_NOTAVAILABLE, -- .descr = descr }; -- -- debug_print_object(&o, "active_state"); -- } else if (print_object) { -- debug_print_object(obj, "active_state"); -- } -+ debug_print_object(&o, "active_state"); - } - EXPORT_SYMBOL_GPL(debug_object_active_state); - -@@ -999,12 +959,10 @@ EXPORT_SYMBOL_GPL(debug_object_active_state); - static void __debug_check_no_obj_freed(const void *address, unsigned long size) - { - unsigned long flags, oaddr, saddr, eaddr, paddr, chunks; -- const struct debug_obj_descr *descr; -- enum debug_obj_state state; -+ int cnt, objs_checked = 0; -+ struct debug_obj *obj, o; - struct debug_bucket *db; - struct hlist_node *tmp; -- struct debug_obj *obj; -- int cnt, objs_checked = 0; - - saddr = (unsigned long) address; - eaddr = saddr + size; -@@ -1026,12 +984,10 @@ static void __debug_check_no_obj_freed(const void *address, unsigned long size) - - switch (obj->state) { - case ODEBUG_STATE_ACTIVE: -- descr = obj->descr; -- state = obj->state; -+ o = *obj; - raw_spin_unlock_irqrestore(&db->lock, flags); -- debug_print_object(obj, "free"); -- debug_object_fixup(descr->fixup_free, -- (void *) oaddr, state); -+ debug_print_object(&o, "free"); -+ debug_object_fixup(o.descr->fixup_free, (void *)oaddr, o.state); - goto repeat; - default: - hlist_del(&obj->node); --- -2.43.2 - -From c8b3ed00535aa66d22ea9d52fd1def7c28845587 Mon Sep 17 00:00:00 2001 -From: Vincent Guittot <vincent.guittot@linaro.org> -Date: Thu, 21 Dec 2023 17:40:14 +0100 -Subject: [PATCH 1032/1501] sched/fair: Fix tg->load when offlining a CPU -Content-Length: 12281 -Lines: 270 - -[ Upstream commit f60a631ab9ed5df15e446269ea515f2b8948ba0c ] - -When a CPU is taken offline, the contribution of its cfs_rqs to task_groups' -load may remain and will negatively impact the calculation of the share of -the online CPUs. - -To fix this bug, clear the contribution of an offlining CPU to task groups' -load and skip its contribution while it is inactive. - -Here's the reproducer of the anomaly, by Imran Khan: - - "So far I have encountered only one rather lengthy way of reproducing this issue, - which is as follows: - - 1. Take a KVM guest (booted with 4 CPUs and can be scaled up to 124 CPUs) and - create 2 custom cgroups: /sys/fs/cgroup/cpu/test_group_1 and /sys/fs/cgroup/ - cpu/test_group_2 - - 2. Assign a CPU intensive workload to each of these cgroups and start the - workload. - - For my tests I am using following app: - - int main(int argc, char *argv[]) - { - unsigned long count, i, val; - if (argc != 2) { - printf("usage: ./a.out <number of random nums to generate> \n"); - return 0; - } - - count = strtoul(argv[1], NULL, 10); - - printf("Generating %lu random numbers \n", count); - for (i = 0; i < count; i++) { - val = rand(); - val = val % 2; - //usleep(1); - } - printf("Generated %lu random numbers \n", count); - return 0; - } - - Also since the system is booted with 4 CPUs, in order to completely load the - system I am also launching 4 instances of same test app under: - - /sys/fs/cgroup/cpu/ - - 3. We can see that both of the cgroups get similar CPU time: - - # systemd-cgtop --depth 1 - Path Tasks %CPU Memory Input/s Output/s - / 659 - 5.5G - - - /system.slice - - 5.7G - - - /test_group_1 4 - - - - - /test_group_2 3 - - - - - /user.slice 31 - 56.5M - - - - Path Tasks %CPU Memory Input/s Output/s - / 659 394.6 5.5G - - - /test_group_2 3 65.7 - - - - /user.slice 29 55.1 48.0M - - - /test_group_1 4 47.3 - - - - /system.slice - 2.2 5.7G - - - - Path Tasks %CPU Memory Input/s Output/s - / 659 394.8 5.5G - - - /test_group_1 4 62.9 - - - - /user.slice 28 44.9 54.2M - - - /test_group_2 3 44.7 - - - - /system.slice - 0.9 5.7G - - - - Path Tasks %CPU Memory Input/s Output/s - / 659 394.4 5.5G - - - /test_group_2 3 58.8 - - - - /test_group_1 4 51.9 - - - - /user.slice 30 39.3 59.6M - - - /system.slice - 1.9 5.7G - - - - Path Tasks %CPU Memory Input/s Output/s - / 659 394.7 5.5G - - - /test_group_1 4 60.9 - - - - /test_group_2 3 57.9 - - - - /user.slice 28 43.5 36.9M - - - /system.slice - 3.0 5.7G - - - - Path Tasks %CPU Memory Input/s Output/s - / 659 395.0 5.5G - - - /test_group_1 4 66.8 - - - - /test_group_2 3 56.3 - - - - /user.slice 29 43.1 51.8M - - - /system.slice - 0.7 5.7G - - - - 4. Now move systemd-udevd to one of these test groups, say test_group_1, and - perform scale up to 124 CPUs followed by scale down back to 4 CPUs from the - host side. - - 5. Run the same workload i.e 4 instances of CPU hogger under /sys/fs/cgroup/cpu - and one instance of CPU hogger each in /sys/fs/cgroup/cpu/test_group_1 and - /sys/fs/cgroup/test_group_2. - - It can be seen that test_group_1 (the one where systemd-udevd was moved) is getting - much less CPU time than the test_group_2, even though at this point of time both of - these groups have only CPU hogger running: - - # systemd-cgtop --depth 1 - Path Tasks %CPU Memory Input/s Output/s - / 1219 - 5.4G - - - /system.slice - - 5.6G - - - /test_group_1 4 - - - - - /test_group_2 3 - - - - - /user.slice 26 - 91.3M - - - - Path Tasks %CPU Memory Input/s Output/s - / 1221 394.3 5.4G - - - /test_group_2 3 82.7 - - - - /test_group_1 4 14.3 - - - - /system.slice - 0.8 5.6G - - - /user.slice 26 0.4 91.2M - - - - Path Tasks %CPU Memory Input/s Output/s - / 1221 394.6 5.4G - - - /test_group_2 3 67.4 - - - - /system.slice - 24.6 5.6G - - - /test_group_1 4 12.5 - - - - /user.slice 26 0.4 91.2M - - - - Path Tasks %CPU Memory Input/s Output/s - / 1221 395.2 5.4G - - - /test_group_2 3 60.9 - - - - /system.slice - 27.9 5.6G - - - /test_group_1 4 12.2 - - - - /user.slice 26 0.4 91.2M - - - - Path Tasks %CPU Memory Input/s Output/s - / 1221 395.2 5.4G - - - /test_group_2 3 69.4 - - - - /test_group_1 4 13.9 - - - - /user.slice 28 1.6 92.0M - - - /system.slice - 1.0 5.6G - - - - Path Tasks %CPU Memory Input/s Output/s - / 1221 395.6 5.4G - - - /test_group_2 3 59.3 - - - - /test_group_1 4 14.1 - - - - /user.slice 28 1.3 92.2M - - - /system.slice - 0.7 5.6G - - - - Path Tasks %CPU Memory Input/s Output/s - / 1221 395.5 5.4G - - - /test_group_2 3 67.2 - - - - /test_group_1 4 11.5 - - - - /user.slice 28 1.3 92.5M - - - /system.slice - 0.6 5.6G - - - - Path Tasks %CPU Memory Input/s Output/s - / 1221 395.1 5.4G - - - /test_group_2 3 76.8 - - - - /test_group_1 4 12.9 - - - - /user.slice 28 1.3 92.8M - - - /system.slice - 1.2 5.6G - - - - From sched_debug data it can be seen that in bad case the load.weight of per-CPU - sched entities corresponding to test_group_1 has reduced significantly and - also load_avg of test_group_1 remains much higher than that of test_group_2, - even though systemd-udevd stopped running long time back and at this point of - time both cgroups just have the CPU hogger app as running entity." - -[ mingo: Added details from the original discussion, plus minor edits to the patch. ] - -Reported-by: Imran Khan <imran.f.khan@oracle.com> -Tested-by: Imran Khan <imran.f.khan@oracle.com> -Tested-by: Aaron Lu <aaron.lu@intel.com> -Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org> -Signed-off-by: Ingo Molnar <mingo@kernel.org> -Reviewed-by: Imran Khan <imran.f.khan@oracle.com> -Cc: Peter Zijlstra <peterz@infradead.org> -Cc: Borislav Petkov <bp@alien8.de> -Link: https://lore.kernel.org/r/20231223111545.62135-1-vincent.guittot@linaro.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - kernel/sched/fair.c | 52 +++++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 52 insertions(+) - -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 3070c6f7168e..7ac9f4b1d955 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -4098,6 +4098,10 @@ static inline void update_tg_load_avg(struct cfs_rq *cfs_rq) - if (cfs_rq->tg == &root_task_group) - return; - -+ /* rq has been offline and doesn't contribute to the share anymore: */ -+ if (!cpu_active(cpu_of(rq_of(cfs_rq)))) -+ return; -+ - /* - * For migration heavy workloads, access to tg->load_avg can be - * unbound. Limit the update rate to at most once per ms. -@@ -4114,6 +4118,49 @@ static inline void update_tg_load_avg(struct cfs_rq *cfs_rq) - } - } - -+static inline void clear_tg_load_avg(struct cfs_rq *cfs_rq) -+{ -+ long delta; -+ u64 now; -+ -+ /* -+ * No need to update load_avg for root_task_group, as it is not used. -+ */ -+ if (cfs_rq->tg == &root_task_group) -+ return; -+ -+ now = sched_clock_cpu(cpu_of(rq_of(cfs_rq))); -+ delta = 0 - cfs_rq->tg_load_avg_contrib; -+ atomic_long_add(delta, &cfs_rq->tg->load_avg); -+ cfs_rq->tg_load_avg_contrib = 0; -+ cfs_rq->last_update_tg_load_avg = now; -+} -+ -+/* CPU offline callback: */ -+static void __maybe_unused clear_tg_offline_cfs_rqs(struct rq *rq) -+{ -+ struct task_group *tg; -+ -+ lockdep_assert_rq_held(rq); -+ -+ /* -+ * The rq clock has already been updated in -+ * set_rq_offline(), so we should skip updating -+ * the rq clock again in unthrottle_cfs_rq(). -+ */ -+ rq_clock_start_loop_update(rq); -+ -+ rcu_read_lock(); -+ list_for_each_entry_rcu(tg, &task_groups, list) { -+ struct cfs_rq *cfs_rq = tg->cfs_rq[cpu_of(rq)]; -+ -+ clear_tg_load_avg(cfs_rq); -+ } -+ rcu_read_unlock(); -+ -+ rq_clock_stop_loop_update(rq); -+} -+ - /* - * Called within set_task_rq() right before setting a task's CPU. The - * caller only guarantees p->pi_lock is held; no other assumptions, -@@ -4410,6 +4457,8 @@ static inline bool skip_blocked_update(struct sched_entity *se) - - static inline void update_tg_load_avg(struct cfs_rq *cfs_rq) {} - -+static inline void clear_tg_offline_cfs_rqs(struct rq *rq) {} -+ - static inline int propagate_entity_load_avg(struct sched_entity *se) - { - return 0; -@@ -12415,6 +12464,9 @@ static void rq_offline_fair(struct rq *rq) - - /* Ensure any throttled groups are reachable by pick_next_task */ - unthrottle_offline_cfs_rqs(rq); -+ -+ /* Ensure that we remove rq contribution to group share: */ -+ clear_tg_offline_cfs_rqs(rq); - } - - #endif /* CONFIG_SMP */ --- -2.43.2 - -From 2801b6299f833ad47b4ee76b1dd998096497f455 Mon Sep 17 00:00:00 2001 -From: Rui Zhang <zr.zhang@vivo.com> -Date: Fri, 3 Nov 2023 15:42:31 +0800 -Subject: [PATCH 1033/1501] regulator: core: Only increment use_count when - enable_count changes -Content-Length: 3363 -Lines: 103 - -[ Upstream commit 7993d3a9c34f609c02171e115fd12c10e2105ff4 ] - -The use_count of a regulator should only be incremented when the -enable_count changes from 0 to 1. Similarly, the use_count should -only be decremented when the enable_count changes from 1 to 0. - -In the previous implementation, use_count was sometimes decremented -to 0 when some consumer called unbalanced disable, -leading to unexpected disable even the regulator is enabled by -other consumers. With this change, the use_count accurately reflects -the number of users which the regulator is enabled. - -This should make things more robust in the case where a consumer does -leak references. - -Signed-off-by: Rui Zhang <zr.zhang@vivo.com> -Link: https://lore.kernel.org/r/20231103074231.8031-1-zr.zhang@vivo.com -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/regulator/core.c | 52 +++++++++++++++++++++------------------- - 1 file changed, 28 insertions(+), 24 deletions(-) - -diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c -index 3137e40fcd3e..a7b3e548ea5a 100644 ---- a/drivers/regulator/core.c -+++ b/drivers/regulator/core.c -@@ -2918,7 +2918,8 @@ static int _regulator_enable(struct regulator *regulator) - /* Fallthrough on positive return values - already enabled */ - } - -- rdev->use_count++; -+ if (regulator->enable_count == 1) -+ rdev->use_count++; - - return 0; - -@@ -2993,37 +2994,40 @@ static int _regulator_disable(struct regulator *regulator) - - lockdep_assert_held_once(&rdev->mutex.base); - -- if (WARN(rdev->use_count <= 0, -+ if (WARN(regulator->enable_count == 0, - "unbalanced disables for %s\n", rdev_get_name(rdev))) - return -EIO; - -- /* are we the last user and permitted to disable ? */ -- if (rdev->use_count == 1 && -- (rdev->constraints && !rdev->constraints->always_on)) { -+ if (regulator->enable_count == 1) { -+ /* disabling last enable_count from this regulator */ -+ /* are we the last user and permitted to disable ? */ -+ if (rdev->use_count == 1 && -+ (rdev->constraints && !rdev->constraints->always_on)) { - -- /* we are last user */ -- if (regulator_ops_is_valid(rdev, REGULATOR_CHANGE_STATUS)) { -- ret = _notifier_call_chain(rdev, -- REGULATOR_EVENT_PRE_DISABLE, -- NULL); -- if (ret & NOTIFY_STOP_MASK) -- return -EINVAL; -+ /* we are last user */ -+ if (regulator_ops_is_valid(rdev, REGULATOR_CHANGE_STATUS)) { -+ ret = _notifier_call_chain(rdev, -+ REGULATOR_EVENT_PRE_DISABLE, -+ NULL); -+ if (ret & NOTIFY_STOP_MASK) -+ return -EINVAL; - -- ret = _regulator_do_disable(rdev); -- if (ret < 0) { -- rdev_err(rdev, "failed to disable: %pe\n", ERR_PTR(ret)); -- _notifier_call_chain(rdev, -- REGULATOR_EVENT_ABORT_DISABLE, -+ ret = _regulator_do_disable(rdev); -+ if (ret < 0) { -+ rdev_err(rdev, "failed to disable: %pe\n", ERR_PTR(ret)); -+ _notifier_call_chain(rdev, -+ REGULATOR_EVENT_ABORT_DISABLE, -+ NULL); -+ return ret; -+ } -+ _notifier_call_chain(rdev, REGULATOR_EVENT_DISABLE, - NULL); -- return ret; - } -- _notifier_call_chain(rdev, REGULATOR_EVENT_DISABLE, -- NULL); -- } - -- rdev->use_count = 0; -- } else if (rdev->use_count > 1) { -- rdev->use_count--; -+ rdev->use_count = 0; -+ } else if (rdev->use_count > 1) { -+ rdev->use_count--; -+ } - } - - if (ret == 0) --- -2.43.2 - -From aa7f84f6626fa2372588635b6bf6ce97dfd5379f Mon Sep 17 00:00:00 2001 -From: Chris Riches <chris.riches@nutanix.com> -Date: Wed, 18 Oct 2023 09:23:51 +0000 -Subject: [PATCH 1034/1501] audit: Send netlink ACK before setting connection - in auditd_set -Content-Length: 3921 -Lines: 109 - -[ Upstream commit 022732e3d846e197539712e51ecada90ded0572a ] - -When auditd_set sets the auditd_conn pointer, audit messages can -immediately be put on the socket by other kernel threads. If the backlog -is large or the rate is high, this can immediately fill the socket -buffer. If the audit daemon requested an ACK for this operation, a full -socket buffer causes the ACK to get dropped, also setting ENOBUFS on the -socket. - -To avoid this race and ensure ACKs get through, fast-track the ACK in -this specific case to ensure it is sent before auditd_conn is set. - -Signed-off-by: Chris Riches <chris.riches@nutanix.com> -[PM: fix some tab vs space damage] -Signed-off-by: Paul Moore <paul@paul-moore.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - kernel/audit.c | 31 ++++++++++++++++++++++++------- - 1 file changed, 24 insertions(+), 7 deletions(-) - -diff --git a/kernel/audit.c b/kernel/audit.c -index 16205dd29843..9c8e5f732c4c 100644 ---- a/kernel/audit.c -+++ b/kernel/audit.c -@@ -487,15 +487,19 @@ static void auditd_conn_free(struct rcu_head *rcu) - * @pid: auditd PID - * @portid: auditd netlink portid - * @net: auditd network namespace pointer -+ * @skb: the netlink command from the audit daemon -+ * @ack: netlink ack flag, cleared if ack'd here - * - * Description: - * This function will obtain and drop network namespace references as - * necessary. Returns zero on success, negative values on failure. - */ --static int auditd_set(struct pid *pid, u32 portid, struct net *net) -+static int auditd_set(struct pid *pid, u32 portid, struct net *net, -+ struct sk_buff *skb, bool *ack) - { - unsigned long flags; - struct auditd_connection *ac_old, *ac_new; -+ struct nlmsghdr *nlh; - - if (!pid || !net) - return -EINVAL; -@@ -507,6 +511,13 @@ static int auditd_set(struct pid *pid, u32 portid, struct net *net) - ac_new->portid = portid; - ac_new->net = get_net(net); - -+ /* send the ack now to avoid a race with the queue backlog */ -+ if (*ack) { -+ nlh = nlmsg_hdr(skb); -+ netlink_ack(skb, nlh, 0, NULL); -+ *ack = false; -+ } -+ - spin_lock_irqsave(&auditd_conn_lock, flags); - ac_old = rcu_dereference_protected(auditd_conn, - lockdep_is_held(&auditd_conn_lock)); -@@ -1200,7 +1211,8 @@ static int audit_replace(struct pid *pid) - return auditd_send_unicast_skb(skb); - } - --static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) -+static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh, -+ bool *ack) - { - u32 seq; - void *data; -@@ -1293,7 +1305,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) - /* register a new auditd connection */ - err = auditd_set(req_pid, - NETLINK_CB(skb).portid, -- sock_net(NETLINK_CB(skb).sk)); -+ sock_net(NETLINK_CB(skb).sk), -+ skb, ack); - if (audit_enabled != AUDIT_OFF) - audit_log_config_change("audit_pid", - new_pid, -@@ -1538,9 +1551,10 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) - * Parse the provided skb and deal with any messages that may be present, - * malformed skbs are discarded. - */ --static void audit_receive(struct sk_buff *skb) -+static void audit_receive(struct sk_buff *skb) - { - struct nlmsghdr *nlh; -+ bool ack; - /* - * len MUST be signed for nlmsg_next to be able to dec it below 0 - * if the nlmsg_len was not aligned -@@ -1553,9 +1567,12 @@ static void audit_receive(struct sk_buff *skb) - - audit_ctl_lock(); - while (nlmsg_ok(nlh, len)) { -- err = audit_receive_msg(skb, nlh); -- /* if err or if this message says it wants a response */ -- if (err || (nlh->nlmsg_flags & NLM_F_ACK)) -+ ack = nlh->nlmsg_flags & NLM_F_ACK; -+ err = audit_receive_msg(skb, nlh, &ack); -+ -+ /* send an ack if the user asked for one and audit_receive_msg -+ * didn't already do it, or if there was an error. */ -+ if (ack || err) - netlink_ack(skb, nlh, err, NULL); - - nlh = nlmsg_next(nlh, &len); --- -2.43.2 - -From b15552f629dd836d9d3d125cbe5731ce39151fb3 Mon Sep 17 00:00:00 2001 -From: Yuntao Wang <ytcoode@gmail.com> -Date: Mon, 20 Nov 2023 19:41:43 +0800 -Subject: [PATCH 1035/1501] ACPI: tables: Correct and clean up the logic of - acpi_parse_entries_array() -Content-Length: 4471 -Lines: 115 - -[ Upstream commit 4b3805daaacb2168665c6222f261e68accb120dc ] - -The original intention of acpi_parse_entries_array() is to return the -number of all matching entries on success. This number may be greater than -the value of the max_entries parameter. When this happens, the function -will output a warning message, indicating that `count - max_entries` -matching entries remain unprocessed and have been ignored. - -However, commit 4ceacd02f5a1 ("ACPI / table: Always count matched and -successfully parsed entries") changed this logic to return the number of -entries successfully processed by the handler. In this case, when the -max_entries parameter is not zero, the number of entries successfully -processed can never be greater than the value of max_entries. In other -words, the expression `count > max_entries` will always evaluate to false. -This means that the logic in the final if statement will never be executed. - -Commit 99b0efd7c886 ("ACPI / tables: do not report the number of entries -ignored by acpi_parse_entries()") mentioned this issue, but it tried to fix -it by removing part of the warning message. This is meaningless because the -pr_warn statement will never be executed in the first place. - -Commit 8726d4f44150 ("ACPI / tables: fix acpi_parse_entries_array() so it -traverses all subtables") introduced an errs variable, which is intended to -make acpi_parse_entries_array() always traverse all of the subtables, -calling as many of the callbacks as possible. However, it seems that the -commit does not achieve this goal. For example, when a handler returns an -error, none of the handlers will be called again in the subsequent -iterations. This result appears to be no different from before the change. - -This patch corrects and cleans up the logic of acpi_parse_entries_array(), -making it return the number of all matching entries, rather than the number -of entries successfully processed by handlers. Additionally, if an error -occurs when executing a handler, the function will return -EINVAL immediately. - -This patch should not affect existing users of acpi_parse_entries_array(). - -Signed-off-by: Yuntao Wang <ytcoode@gmail.com> -Reviewed-by: Dave Jiang <dave.jiang@intel.com> -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - lib/fw_table.c | 30 +++++++++--------------------- - 1 file changed, 9 insertions(+), 21 deletions(-) - -diff --git a/lib/fw_table.c b/lib/fw_table.c -index 294df54e33b6..c49a09ee3853 100644 ---- a/lib/fw_table.c -+++ b/lib/fw_table.c -@@ -85,11 +85,6 @@ acpi_get_subtable_type(char *id) - return ACPI_SUBTABLE_COMMON; - } - --static __init_or_acpilib bool has_handler(struct acpi_subtable_proc *proc) --{ -- return proc->handler || proc->handler_arg; --} -- - static __init_or_acpilib int call_handler(struct acpi_subtable_proc *proc, - union acpi_subtable_headers *hdr, - unsigned long end) -@@ -133,7 +128,6 @@ acpi_parse_entries_array(char *id, unsigned long table_size, - unsigned long table_end, subtable_len, entry_len; - struct acpi_subtable_entry entry; - int count = 0; -- int errs = 0; - int i; - - table_end = (unsigned long)table_header + table_header->length; -@@ -145,25 +139,19 @@ acpi_parse_entries_array(char *id, unsigned long table_size, - ((unsigned long)table_header + table_size); - subtable_len = acpi_get_subtable_header_length(&entry); - -- while (((unsigned long)entry.hdr) + subtable_len < table_end) { -- if (max_entries && count >= max_entries) -- break; -- -+ while (((unsigned long)entry.hdr) + subtable_len < table_end) { - for (i = 0; i < proc_num; i++) { - if (acpi_get_entry_type(&entry) != proc[i].id) - continue; -- if (!has_handler(&proc[i]) || -- (!errs && -- call_handler(&proc[i], entry.hdr, table_end))) { -- errs++; -- continue; -- } -+ -+ if (!max_entries || count < max_entries) -+ if (call_handler(&proc[i], entry.hdr, table_end)) -+ return -EINVAL; - - proc[i].count++; -+ count++; - break; - } -- if (i != proc_num) -- count++; - - /* - * If entry->length is 0, break from this loop to avoid -@@ -180,9 +168,9 @@ acpi_parse_entries_array(char *id, unsigned long table_size, - } - - if (max_entries && count > max_entries) { -- pr_warn("[%4.4s:0x%02x] found the maximum %i entries\n", -- id, proc->id, count); -+ pr_warn("[%4.4s:0x%02x] ignored %i entries of %i found\n", -+ id, proc->id, count - max_entries, count); - } - -- return errs ? -EINVAL : count; -+ return count; - } --- -2.43.2 - -From b74d7d3e9817b82fe376b30932dee31ad3824e47 Mon Sep 17 00:00:00 2001 -From: Yuluo Qiu <qyl27@outlook.com> -Date: Sun, 26 Nov 2023 21:59:13 +0800 -Subject: [PATCH 1036/1501] ACPI: video: Add quirk for the Colorful X15 AT 23 - Laptop -Content-Length: 1588 -Lines: 43 - -[ Upstream commit 143176a46bdd3bfbe9ba2462bf94458e80d65ebf ] - -The Colorful X15 AT 23 ACPI video-bus device report spurious -ACPI_VIDEO_NOTIFY_CYCLE events resulting in spurious KEY_SWITCHVIDEOMODE -events being reported to userspace (and causing trouble there) when -an external screen plugged in. - -Add a quirk setting the report_key_events mask to -REPORT_BRIGHTNESS_KEY_EVENTS so that the ACPI_VIDEO_NOTIFY_CYCLE -events will be ignored, while still reporting brightness up/down -hotkey-presses to userspace normally. - -Signed-off-by: Yuluo Qiu <qyl27@outlook.com> -Co-developed-by: Celeste Liu <CoelacanthusHex@gmail.com> -Signed-off-by: Celeste Liu <CoelacanthusHex@gmail.com> -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/acpi/acpi_video.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c -index 375010e575d0..33ddb447747e 100644 ---- a/drivers/acpi/acpi_video.c -+++ b/drivers/acpi/acpi_video.c -@@ -500,6 +500,15 @@ static const struct dmi_system_id video_dmi_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3350"), - }, - }, -+ { -+ .callback = video_set_report_key_events, -+ .driver_data = (void *)((uintptr_t)REPORT_BRIGHTNESS_KEY_EVENTS), -+ .ident = "COLORFUL X15 AT 23", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "COLORFUL"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "X15 AT 23"), -+ }, -+ }, - /* - * Some machines change the brightness themselves when a brightness - * hotkey gets pressed, despite us telling them not to. In this case --- -2.43.2 - -From 1fa669da8f22f1d35f1bc7bd1e8be7a70c0f605f Mon Sep 17 00:00:00 2001 -From: Dmitry Antipov <dmantipov@yandex.ru> -Date: Tue, 28 Nov 2023 05:52:10 +0300 -Subject: [PATCH 1037/1501] PNP: ACPI: fix fortify warning -Content-Length: 3523 -Lines: 75 - -[ Upstream commit ba3f5058db437d919f8468db50483dd9028ff688 ] - -When compiling with gcc version 14.0.0 20231126 (experimental) -and CONFIG_FORTIFY_SOURCE=y, I've noticed the following: - -In file included from ./include/linux/string.h:295, - from ./include/linux/bitmap.h:12, - from ./include/linux/cpumask.h:12, - from ./arch/x86/include/asm/paravirt.h:17, - from ./arch/x86/include/asm/cpuid.h:62, - from ./arch/x86/include/asm/processor.h:19, - from ./arch/x86/include/asm/cpufeature.h:5, - from ./arch/x86/include/asm/thread_info.h:53, - from ./include/linux/thread_info.h:60, - from ./arch/x86/include/asm/preempt.h:9, - from ./include/linux/preempt.h:79, - from ./include/linux/spinlock.h:56, - from ./include/linux/mmzone.h:8, - from ./include/linux/gfp.h:7, - from ./include/linux/slab.h:16, - from ./include/linux/resource_ext.h:11, - from ./include/linux/acpi.h:13, - from drivers/pnp/pnpacpi/rsparser.c:11: -In function 'fortify_memcpy_chk', - inlined from 'pnpacpi_parse_allocated_vendor' at drivers/pnp/pnpacpi/rsparser.c:158:3, - inlined from 'pnpacpi_allocated_resource' at drivers/pnp/pnpacpi/rsparser.c:249:3: -./include/linux/fortify-string.h:588:25: warning: call to '__read_overflow2_field' -declared with attribute warning: detected read beyond size of field (2nd parameter); -maybe use struct_group()? [-Wattribute-warning] - 588 | __read_overflow2_field(q_size_field, size); - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -According to the comments in include/linux/fortify-string.h, 'memcpy()', -'memmove()' and 'memset()' must not be used beyond individual struct -members to ensure that the compiler can enforce protection against -buffer overflows, and, IIUC, this also applies to partial copies from -the particular member ('vendor->byte_data' in this case). So it should -be better (and safer) to do both copies at once (and 'byte_data' of -'struct acpi_resource_vendor_typed' seems to be a good candidate for -'__counted_by(byte_length)' as well). - -Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> -Reviewed-by: Kees Cook <keescook@chromium.org> -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/pnp/pnpacpi/rsparser.c | 12 ++++++------ - 1 file changed, 6 insertions(+), 6 deletions(-) - -diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c -index 4f05f610391b..c02ce0834c2c 100644 ---- a/drivers/pnp/pnpacpi/rsparser.c -+++ b/drivers/pnp/pnpacpi/rsparser.c -@@ -151,13 +151,13 @@ static int vendor_resource_matches(struct pnp_dev *dev, - static void pnpacpi_parse_allocated_vendor(struct pnp_dev *dev, - struct acpi_resource_vendor_typed *vendor) - { -- if (vendor_resource_matches(dev, vendor, &hp_ccsr_uuid, 16)) { -- u64 start, length; -+ struct { u64 start, length; } range; - -- memcpy(&start, vendor->byte_data, sizeof(start)); -- memcpy(&length, vendor->byte_data + 8, sizeof(length)); -- -- pnp_add_mem_resource(dev, start, start + length - 1, 0); -+ if (vendor_resource_matches(dev, vendor, &hp_ccsr_uuid, -+ sizeof(range))) { -+ memcpy(&range, vendor->byte_data, sizeof(range)); -+ pnp_add_mem_resource(dev, range.start, range.start + -+ range.length - 1, 0); - } - } - --- -2.43.2 - -From 77846571b3ba6a6125a20ad109bb8514ba884cf9 Mon Sep 17 00:00:00 2001 -From: Prarit Bhargava <prarit@redhat.com> -Date: Mon, 4 Dec 2023 13:00:37 -0500 -Subject: [PATCH 1038/1501] ACPI: extlog: fix NULL pointer dereference check -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2017 -Lines: 48 - -[ Upstream commit 72d9b9747e78979510e9aafdd32eb99c7aa30dd1 ] - -The gcc plugin -fanalyzer [1] tries to detect various -patterns of incorrect behaviour. The tool reports: - -drivers/acpi/acpi_extlog.c: In function ‘extlog_exit’: -drivers/acpi/acpi_extlog.c:307:12: warning: check of ‘extlog_l1_addr’ for NULL after already dereferencing it [-Wanalyzer-deref-before-check] - | - | 306 | ((struct extlog_l1_head *)extlog_l1_addr)->flags &= ~FLAG_OS_OPTIN; - | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~ - | | | - | | (1) pointer ‘extlog_l1_addr’ is dereferenced here - | 307 | if (extlog_l1_addr) - | | ~ - | | | - | | (2) pointer ‘extlog_l1_addr’ is checked for NULL here but it was already dereferenced at (1) - | - -Fix the NULL pointer dereference check in extlog_exit(). - -Link: https://gcc.gnu.org/onlinedocs/gcc-10.1.0/gcc/Static-Analyzer-Options.html # [1] - -Signed-off-by: Prarit Bhargava <prarit@redhat.com> -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/acpi/acpi_extlog.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c -index 71e8d4e7a36c..ca87a0939135 100644 ---- a/drivers/acpi/acpi_extlog.c -+++ b/drivers/acpi/acpi_extlog.c -@@ -308,9 +308,10 @@ static int __init extlog_init(void) - static void __exit extlog_exit(void) - { - mce_unregister_decode_chain(&extlog_mce_dec); -- ((struct extlog_l1_head *)extlog_l1_addr)->flags &= ~FLAG_OS_OPTIN; -- if (extlog_l1_addr) -+ if (extlog_l1_addr) { -+ ((struct extlog_l1_head *)extlog_l1_addr)->flags &= ~FLAG_OS_OPTIN; - acpi_os_unmap_iomem(extlog_l1_addr, l1_size); -+ } - if (elog_addr) - acpi_os_unmap_iomem(elog_addr, elog_size); - release_mem_region(elog_base, elog_size); --- -2.43.2 - -From 00601d3f2993755c2420f6257e4f38b44c03f8b4 Mon Sep 17 00:00:00 2001 -From: Yuntao Wang <ytcoode@gmail.com> -Date: Wed, 6 Dec 2023 18:43:18 +0800 -Subject: [PATCH 1040/1501] ACPI: NUMA: Fix the logic of getting the fake_pxm - value -Content-Length: 1427 -Lines: 41 - -[ Upstream commit e3f577830ce216b0ca21d4750cbbd64cfc21efff ] - -The for loop does not iterate over the last element of the node_to_pxm_map -array. This could lead to a conflict between the final fake_pxm value and -the existing pxm values. That is, the final fake_pxm value can not be -guaranteed to be an unused pxm value. - -While at it, fix up white space in slit_valid(). - -Signed-off-by: Yuntao Wang <ytcoode@gmail.com> -[ rjw: Changelog edits ] -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/acpi/numa/srat.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/acpi/numa/srat.c b/drivers/acpi/numa/srat.c -index 12f330b0eac0..b57de78fbf14 100644 ---- a/drivers/acpi/numa/srat.c -+++ b/drivers/acpi/numa/srat.c -@@ -183,7 +183,7 @@ static int __init slit_valid(struct acpi_table_slit *slit) - int i, j; - int d = slit->locality_count; - for (i = 0; i < d; i++) { -- for (j = 0; j < d; j++) { -+ for (j = 0; j < d; j++) { - u8 val = slit->entry[d*i + j]; - if (i == j) { - if (val != LOCAL_DISTANCE) -@@ -532,7 +532,7 @@ int __init acpi_numa_init(void) - */ - - /* fake_pxm is the next unused PXM value after SRAT parsing */ -- for (i = 0, fake_pxm = -1; i < MAX_NUMNODES - 1; i++) { -+ for (i = 0, fake_pxm = -1; i < MAX_NUMNODES; i++) { - if (node_to_pxm_map[i] > fake_pxm) - fake_pxm = node_to_pxm_map[i]; - } --- -2.43.2 - -From 79b907b29b8f2fbd2f4a6723f91cae9372e0e413 Mon Sep 17 00:00:00 2001 -From: Rae Moar <rmoar@google.com> -Date: Thu, 7 Dec 2023 21:34:09 +0000 -Subject: [PATCH 1041/1501] kunit: tool: fix parsing of test attributes -Content-Length: 2000 -Lines: 49 - -[ Upstream commit 8ae27bc7fff4ef467a7964821a6cedb34a05d3b2 ] - -Add parsing of attributes as diagnostic data. Fixes issue with test plan -being parsed incorrectly as diagnostic data when located after -suite-level attributes. - -Note that if there does not exist a test plan line, the diagnostic lines -between the suite header and the first result will be saved in the suite -log rather than the first test case log. - -Signed-off-by: Rae Moar <rmoar@google.com> -Reviewed-by: David Gow <davidgow@google.com> -Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/testing/kunit/kunit_parser.py | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/tools/testing/kunit/kunit_parser.py b/tools/testing/kunit/kunit_parser.py -index 79d8832c862a..ce34be15c929 100644 ---- a/tools/testing/kunit/kunit_parser.py -+++ b/tools/testing/kunit/kunit_parser.py -@@ -450,7 +450,7 @@ def parse_diagnostic(lines: LineStream) -> List[str]: - Log of diagnostic lines - """ - log = [] # type: List[str] -- non_diagnostic_lines = [TEST_RESULT, TEST_HEADER, KTAP_START, TAP_START] -+ non_diagnostic_lines = [TEST_RESULT, TEST_HEADER, KTAP_START, TAP_START, TEST_PLAN] - while lines and not any(re.match(lines.peek()) - for re in non_diagnostic_lines): - log.append(lines.pop()) -@@ -726,6 +726,7 @@ def parse_test(lines: LineStream, expected_num: int, log: List[str], is_subtest: - # test plan - test.name = "main" - ktap_line = parse_ktap_header(lines, test) -+ test.log.extend(parse_diagnostic(lines)) - parse_test_plan(lines, test) - parent_test = True - else: -@@ -737,6 +738,7 @@ def parse_test(lines: LineStream, expected_num: int, log: List[str], is_subtest: - if parent_test: - # If KTAP version line and/or subtest header is found, attempt - # to parse test plan and print test header -+ test.log.extend(parse_diagnostic(lines)) - parse_test_plan(lines, test) - print_test_header(test) - expected_count = test.expected_count --- -2.43.2 - -From bc9b9c5026964ec66a307f6ba71cfd3428aaa2b4 Mon Sep 17 00:00:00 2001 -From: Michal Wajdeczko <michal.wajdeczko@intel.com> -Date: Fri, 15 Dec 2023 16:13:27 +0100 -Subject: [PATCH 1042/1501] kunit: Reset test->priv after each param iteration -Content-Length: 2841 -Lines: 74 - -[ Upstream commit 342fb9789267ee3908959bfa136b82e88e2ce918 ] - -If we run parameterized test that uses test->priv to prepare some -custom data, then value of test->priv will leak to the next param -iteration and may be unexpected. This could be easily seen if -we promote example_priv_test to parameterized test as then only -first test iteration will be successful: - -$ ./tools/testing/kunit/kunit.py run \ - --kunitconfig ./lib/kunit/.kunitconfig *.example_priv* - -[ ] Starting KUnit Kernel (1/1)... -[ ] ============================================================ -[ ] =================== example (1 subtest) ==================== -[ ] ==================== example_priv_test ==================== -[ ] [PASSED] example value 3 -[ ] # example_priv_test: initializing -[ ] # example_priv_test: ASSERTION FAILED at lib/kunit/kunit-example-test.c:230 -[ ] Expected test->priv == ((void *)0), but -[ ] test->priv == 0000000060dfe290 -[ ] ((void *)0) == 0000000000000000 -[ ] # example_priv_test: cleaning up -[ ] [FAILED] example value 2 -[ ] # example_priv_test: initializing -[ ] # example_priv_test: ASSERTION FAILED at lib/kunit/kunit-example-test.c:230 -[ ] Expected test->priv == ((void *)0), but -[ ] test->priv == 0000000060dfe290 -[ ] ((void *)0) == 0000000000000000 -[ ] # example_priv_test: cleaning up -[ ] [FAILED] example value 1 -[ ] # example_priv_test: initializing -[ ] # example_priv_test: ASSERTION FAILED at lib/kunit/kunit-example-test.c:230 -[ ] Expected test->priv == ((void *)0), but -[ ] test->priv == 0000000060dfe290 -[ ] ((void *)0) == 0000000000000000 -[ ] # example_priv_test: cleaning up -[ ] [FAILED] example value 0 -[ ] # example_priv_test: initializing -[ ] # example_priv_test: cleaning up -[ ] # example_priv_test: pass:1 fail:3 skip:0 total:4 -[ ] ================ [FAILED] example_priv_test ================ -[ ] # example: initializing suite -[ ] # module: kunit_example_test -[ ] # example: exiting suite -[ ] # Totals: pass:1 fail:3 skip:0 total:4 -[ ] ===================== [FAILED] example ===================== - -Fix that by resetting test->priv after each param iteration, in -similar way what we did for the test->status. - -Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> -Cc: David Gow <davidgow@google.com> -Cc: Rae Moar <rmoar@google.com> -Reviewed-by: David Gow <davidgow@google.com> -Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - lib/kunit/test.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/lib/kunit/test.c b/lib/kunit/test.c -index 7aceb07a1af9..1cdc405daa30 100644 ---- a/lib/kunit/test.c -+++ b/lib/kunit/test.c -@@ -660,6 +660,7 @@ int kunit_run_tests(struct kunit_suite *suite) - test.param_index++; - test.status = KUNIT_SUCCESS; - test.status_comment[0] = '\0'; -+ test.priv = NULL; - } - } - --- -2.43.2 - -From ae815e2fdc284ab31651d52460698bd89c0fce22 Mon Sep 17 00:00:00 2001 -From: Mukesh Ojha <quic_mojha@quicinc.com> -Date: Sat, 25 Nov 2023 02:41:58 +0530 -Subject: [PATCH 1043/1501] PM / devfreq: Synchronize - devfreq_monitor_[start/stop] -Content-Length: 6704 -Lines: 159 - -[ Upstream commit aed5ed595960c6d301dcd4ed31aeaa7a8054c0c6 ] - -There is a chance if a frequent switch of the governor -done in a loop result in timer list corruption where -timer cancel being done from two place one from -cancel_delayed_work_sync() and followed by expire_timers() -can be seen from the traces[1]. - -while true -do - echo "simple_ondemand" > /sys/class/devfreq/1d84000.ufshc/governor - echo "performance" > /sys/class/devfreq/1d84000.ufshc/governor -done - -It looks to be issue with devfreq driver where -device_monitor_[start/stop] need to synchronized so that -delayed work should get corrupted while it is either -being queued or running or being cancelled. - -Let's use polling flag and devfreq lock to synchronize the -queueing the timer instance twice and work data being -corrupted. - -[1] -... -.. -<idle>-0 [003] 9436.209662: timer_cancel timer=0xffffff80444f0428 -<idle>-0 [003] 9436.209664: timer_expire_entry timer=0xffffff80444f0428 now=0x10022da1c function=__typeid__ZTSFvP10timer_listE_global_addr baseclk=0x10022da1c -<idle>-0 [003] 9436.209718: timer_expire_exit timer=0xffffff80444f0428 -kworker/u16:6-14217 [003] 9436.209863: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2b now=0x10022da1c flags=182452227 -vendor.xxxyyy.ha-1593 [004] 9436.209888: timer_cancel timer=0xffffff80444f0428 -vendor.xxxyyy.ha-1593 [004] 9436.216390: timer_init timer=0xffffff80444f0428 -vendor.xxxyyy.ha-1593 [004] 9436.216392: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2c now=0x10022da1d flags=186646532 -vendor.xxxyyy.ha-1593 [005] 9436.220992: timer_cancel timer=0xffffff80444f0428 -xxxyyyTraceManag-7795 [004] 9436.261641: timer_cancel timer=0xffffff80444f0428 - -[2] - - 9436.261653][ C4] Unable to handle kernel paging request at virtual address dead00000000012a -[ 9436.261664][ C4] Mem abort info: -[ 9436.261666][ C4] ESR = 0x96000044 -[ 9436.261669][ C4] EC = 0x25: DABT (current EL), IL = 32 bits -[ 9436.261671][ C4] SET = 0, FnV = 0 -[ 9436.261673][ C4] EA = 0, S1PTW = 0 -[ 9436.261675][ C4] Data abort info: -[ 9436.261677][ C4] ISV = 0, ISS = 0x00000044 -[ 9436.261680][ C4] CM = 0, WnR = 1 -[ 9436.261682][ C4] [dead00000000012a] address between user and kernel address ranges -[ 9436.261685][ C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP -[ 9436.261701][ C4] Skip md ftrace buffer dump for: 0x3a982d0 -... - -[ 9436.262138][ C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S W O 5.10.149-android12-9-o-g17f915d29d0c #1 -[ 9436.262141][ C4] Hardware name: Qualcomm Technologies, Inc. (DT) -[ 9436.262144][ C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--) -[ 9436.262161][ C4] pc : expire_timers+0x9c/0x438 -[ 9436.262164][ C4] lr : expire_timers+0x2a4/0x438 -[ 9436.262168][ C4] sp : ffffffc010023dd0 -[ 9436.262171][ C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18 -[ 9436.262178][ C4] x27: ffffffd063569dd0 x26: ffffffd063536008 -[ 9436.262182][ C4] x25: 0000000000000001 x24: ffffff88f7c69280 -[ 9436.262185][ C4] x23: 00000000000000e0 x22: dead000000000122 -[ 9436.262188][ C4] x21: 000000010022da29 x20: ffffff8af72b4e80 -[ 9436.262191][ C4] x19: ffffffc010023e50 x18: ffffffc010025038 -[ 9436.262195][ C4] x17: 0000000000000240 x16: 0000000000000201 -[ 9436.262199][ C4] x15: ffffffffffffffff x14: ffffff889f3c3100 -[ 9436.262203][ C4] x13: ffffff889f3c3100 x12: 00000000049f56b8 -[ 9436.262207][ C4] x11: 00000000049f56b8 x10: 00000000ffffffff -[ 9436.262212][ C4] x9 : ffffffc010023e50 x8 : dead000000000122 -[ 9436.262216][ C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8 -[ 9436.262220][ C4] x5 : 0000000000000000 x4 : 0000000000000101 -[ 9436.262223][ C4] x3 : 0000000000000080 x2 : ffffff889edc155c -[ 9436.262227][ C4] x1 : ffffff8001005200 x0 : ffffff80444f0428 -[ 9436.262232][ C4] Call trace: -[ 9436.262236][ C4] expire_timers+0x9c/0x438 -[ 9436.262240][ C4] __run_timers+0x1f0/0x330 -[ 9436.262245][ C4] run_timer_softirq+0x28/0x58 -[ 9436.262255][ C4] efi_header_end+0x168/0x5ec -[ 9436.262265][ C4] __irq_exit_rcu+0x108/0x124 -[ 9436.262274][ C4] __handle_domain_irq+0x118/0x1e4 -[ 9436.262282][ C4] gic_handle_irq.30369+0x6c/0x2bc -[ 9436.262286][ C4] el0_irq_naked+0x60/0x6c - -Link: https://lore.kernel.org/all/1700860318-4025-1-git-send-email-quic_mojha@quicinc.com/ -Reported-by: Joyyoung Huang <huangzaiyang@oppo.com> -Acked-by: MyungJoo Ham <myungjoo.ham@samsung.com> -Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com> -Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/devfreq/devfreq.c | 24 ++++++++++++++++++++++-- - 1 file changed, 22 insertions(+), 2 deletions(-) - -diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c -index 907f50ab70ed..7162d2bad446 100644 ---- a/drivers/devfreq/devfreq.c -+++ b/drivers/devfreq/devfreq.c -@@ -461,10 +461,14 @@ static void devfreq_monitor(struct work_struct *work) - if (err) - dev_err(&devfreq->dev, "dvfs failed with (%d) error\n", err); - -+ if (devfreq->stop_polling) -+ goto out; -+ - queue_delayed_work(devfreq_wq, &devfreq->work, - msecs_to_jiffies(devfreq->profile->polling_ms)); -- mutex_unlock(&devfreq->lock); - -+out: -+ mutex_unlock(&devfreq->lock); - trace_devfreq_monitor(devfreq); - } - -@@ -483,6 +487,10 @@ void devfreq_monitor_start(struct devfreq *devfreq) - if (IS_SUPPORTED_FLAG(devfreq->governor->flags, IRQ_DRIVEN)) - return; - -+ mutex_lock(&devfreq->lock); -+ if (delayed_work_pending(&devfreq->work)) -+ goto out; -+ - switch (devfreq->profile->timer) { - case DEVFREQ_TIMER_DEFERRABLE: - INIT_DEFERRABLE_WORK(&devfreq->work, devfreq_monitor); -@@ -491,12 +499,16 @@ void devfreq_monitor_start(struct devfreq *devfreq) - INIT_DELAYED_WORK(&devfreq->work, devfreq_monitor); - break; - default: -- return; -+ goto out; - } - - if (devfreq->profile->polling_ms) - queue_delayed_work(devfreq_wq, &devfreq->work, - msecs_to_jiffies(devfreq->profile->polling_ms)); -+ -+out: -+ devfreq->stop_polling = false; -+ mutex_unlock(&devfreq->lock); - } - EXPORT_SYMBOL(devfreq_monitor_start); - -@@ -513,6 +525,14 @@ void devfreq_monitor_stop(struct devfreq *devfreq) - if (IS_SUPPORTED_FLAG(devfreq->governor->flags, IRQ_DRIVEN)) - return; - -+ mutex_lock(&devfreq->lock); -+ if (devfreq->stop_polling) { -+ mutex_unlock(&devfreq->lock); -+ return; -+ } -+ -+ devfreq->stop_polling = true; -+ mutex_unlock(&devfreq->lock); - cancel_delayed_work_sync(&devfreq->work); - } - EXPORT_SYMBOL(devfreq_monitor_stop); --- -2.43.2 - -From f6d6e9cfce7d6e576216ea54bfeae504dd6b4e73 Mon Sep 17 00:00:00 2001 -From: Shuai Xue <xueshuai@linux.alibaba.com> -Date: Mon, 18 Dec 2023 14:45:18 +0800 -Subject: [PATCH 1044/1501] ACPI: APEI: set memory failure flags as - MF_ACTION_REQUIRED on synchronous events -Content-Length: 5607 -Lines: 135 - -[ Upstream commit a70297d2213253853e95f5b49651f924990c6d3b ] - -There are two major types of uncorrected recoverable (UCR) errors : - - - Synchronous error: The error is detected and raised at the point of - the consumption in the execution flow, e.g. when a CPU tries to - access a poisoned cache line. The CPU will take a synchronous error - exception such as Synchronous External Abort (SEA) on Arm64 and - Machine Check Exception (MCE) on X86. OS requires to take action (for - example, offline failure page/kill failure thread) to recover this - uncorrectable error. - - - Asynchronous error: The error is detected out of processor execution - context, e.g. when an error is detected by a background scrubber. - Some data in the memory are corrupted. But the data have not been - consumed. OS is optional to take action to recover this uncorrectable - error. - -When APEI firmware first is enabled, a platform may describe one error -source for the handling of synchronous errors (e.g. MCE or SEA notification -), or for handling asynchronous errors (e.g. SCI or External Interrupt -notification). In other words, we can distinguish synchronous errors by -APEI notification. For synchronous errors, kernel will kill the current -process which accessing the poisoned page by sending SIGBUS with -BUS_MCEERR_AR. In addition, for asynchronous errors, kernel will notify the -process who owns the poisoned page by sending SIGBUS with BUS_MCEERR_AO in -early kill mode. However, the GHES driver always sets mf_flags to 0 so that -all synchronous errors are handled as asynchronous errors in memory failure. - -To this end, set memory failure flags as MF_ACTION_REQUIRED on synchronous -events. - -Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com> -Tested-by: Ma Wupeng <mawupeng1@huawei.com> -Reviewed-by: Kefeng Wang <wangkefeng.wang@huawei.com> -Reviewed-by: Xiaofei Tan <tanxiaofei@huawei.com> -Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com> -Reviewed-by: James Morse <james.morse@arm.com> -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/acpi/apei/ghes.c | 29 +++++++++++++++++++++++------ - 1 file changed, 23 insertions(+), 6 deletions(-) - -diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c -index 63ad0541db38..ab2a82cb1b0b 100644 ---- a/drivers/acpi/apei/ghes.c -+++ b/drivers/acpi/apei/ghes.c -@@ -101,6 +101,20 @@ static inline bool is_hest_type_generic_v2(struct ghes *ghes) - return ghes->generic->header.type == ACPI_HEST_TYPE_GENERIC_ERROR_V2; - } - -+/* -+ * A platform may describe one error source for the handling of synchronous -+ * errors (e.g. MCE or SEA), or for handling asynchronous errors (e.g. SCI -+ * or External Interrupt). On x86, the HEST notifications are always -+ * asynchronous, so only SEA on ARM is delivered as a synchronous -+ * notification. -+ */ -+static inline bool is_hest_sync_notify(struct ghes *ghes) -+{ -+ u8 notify_type = ghes->generic->notify.type; -+ -+ return notify_type == ACPI_HEST_NOTIFY_SEA; -+} -+ - /* - * This driver isn't really modular, however for the time being, - * continuing to use module_param is the easiest way to remain -@@ -489,7 +503,7 @@ static bool ghes_do_memory_failure(u64 physical_addr, int flags) - } - - static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata, -- int sev) -+ int sev, bool sync) - { - int flags = -1; - int sec_sev = ghes_severity(gdata->error_severity); -@@ -503,7 +517,7 @@ static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata, - (gdata->flags & CPER_SEC_ERROR_THRESHOLD_EXCEEDED)) - flags = MF_SOFT_OFFLINE; - if (sev == GHES_SEV_RECOVERABLE && sec_sev == GHES_SEV_RECOVERABLE) -- flags = 0; -+ flags = sync ? MF_ACTION_REQUIRED : 0; - - if (flags != -1) - return ghes_do_memory_failure(mem_err->physical_addr, flags); -@@ -511,9 +525,11 @@ static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata, - return false; - } - --static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, int sev) -+static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, -+ int sev, bool sync) - { - struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata); -+ int flags = sync ? MF_ACTION_REQUIRED : 0; - bool queued = false; - int sec_sev, i; - char *p; -@@ -538,7 +554,7 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, int s - * and don't filter out 'corrected' error here. - */ - if (is_cache && has_pa) { -- queued = ghes_do_memory_failure(err_info->physical_fault_addr, 0); -+ queued = ghes_do_memory_failure(err_info->physical_fault_addr, flags); - p += err_info->length; - continue; - } -@@ -666,6 +682,7 @@ static bool ghes_do_proc(struct ghes *ghes, - const guid_t *fru_id = &guid_null; - char *fru_text = ""; - bool queued = false; -+ bool sync = is_hest_sync_notify(ghes); - - sev = ghes_severity(estatus->error_severity); - apei_estatus_for_each_section(estatus, gdata) { -@@ -683,13 +700,13 @@ static bool ghes_do_proc(struct ghes *ghes, - atomic_notifier_call_chain(&ghes_report_chain, sev, mem_err); - - arch_apei_report_mem_error(sev, mem_err); -- queued = ghes_handle_memory_failure(gdata, sev); -+ queued = ghes_handle_memory_failure(gdata, sev, sync); - } - else if (guid_equal(sec_type, &CPER_SEC_PCIE)) { - ghes_handle_aer(gdata); - } - else if (guid_equal(sec_type, &CPER_SEC_PROC_ARM)) { -- queued = ghes_handle_arm_hw_error(gdata, sev); -+ queued = ghes_handle_arm_hw_error(gdata, sev, sync); - } else { - void *err = acpi_hest_get_payload(gdata); - --- -2.43.2 - -From 5f93c49247dc645aa249534ed1147d2739f698a1 Mon Sep 17 00:00:00 2001 -From: Viresh Kumar <viresh.kumar@linaro.org> -Date: Tue, 19 Dec 2023 11:32:39 +0530 -Subject: [PATCH 1045/1501] OPP: The level field is always of unsigned int type -Content-Length: 1876 -Lines: 57 - -[ Upstream commit ba367479c7ad0b870461024cd5ae7a1ea6e1e3db ] - -By mistake, dev_pm_opp_find_level_floor() used the level parameter as -unsigned long instead of unsigned int. Fix it. - -Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/opp/core.c | 9 +++++++-- - include/linux/pm_opp.h | 4 ++-- - 2 files changed, 9 insertions(+), 4 deletions(-) - -diff --git a/drivers/opp/core.c b/drivers/opp/core.c -index b2971dd95335..f1e54a3a15c7 100644 ---- a/drivers/opp/core.c -+++ b/drivers/opp/core.c -@@ -832,9 +832,14 @@ EXPORT_SYMBOL_GPL(dev_pm_opp_find_level_ceil); - * use. - */ - struct dev_pm_opp *dev_pm_opp_find_level_floor(struct device *dev, -- unsigned long *level) -+ unsigned int *level) - { -- return _find_key_floor(dev, level, 0, true, _read_level, NULL); -+ unsigned long temp = *level; -+ struct dev_pm_opp *opp; -+ -+ opp = _find_key_floor(dev, &temp, 0, true, _read_level, NULL); -+ *level = temp; -+ return opp; - } - EXPORT_SYMBOL_GPL(dev_pm_opp_find_level_floor); - -diff --git a/include/linux/pm_opp.h b/include/linux/pm_opp.h -index ccd97bcef269..18a102174c4f 100644 ---- a/include/linux/pm_opp.h -+++ b/include/linux/pm_opp.h -@@ -157,7 +157,7 @@ struct dev_pm_opp *dev_pm_opp_find_level_ceil(struct device *dev, - unsigned int *level); - - struct dev_pm_opp *dev_pm_opp_find_level_floor(struct device *dev, -- unsigned long *level); -+ unsigned int *level); - - struct dev_pm_opp *dev_pm_opp_find_bw_ceil(struct device *dev, - unsigned int *bw, int index); -@@ -324,7 +324,7 @@ static inline struct dev_pm_opp *dev_pm_opp_find_level_ceil(struct device *dev, - } - - static inline struct dev_pm_opp *dev_pm_opp_find_level_floor(struct device *dev, -- unsigned long *level) -+ unsigned int *level) - { - return ERR_PTR(-EOPNOTSUPP); - } --- -2.43.2 - -From f4a3fdbd26e7e94b4cf8c86aabec6a37a53e18e0 Mon Sep 17 00:00:00 2001 -From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com> -Date: Mon, 18 Dec 2023 20:25:02 +0100 -Subject: [PATCH 1046/1501] thermal: core: Fix thermal zone suspend-resume - synchronization -Content-Length: 4176 -Lines: 124 - -[ Upstream commit 4e814173a8c4f432fd068b1c796f0416328c9d99 ] - -There are 3 synchronization issues with thermal zone suspend-resume -during system-wide transitions: - - 1. The resume code runs in a PM notifier which is invoked after user - space has been thawed, so it can run concurrently with user space - which can trigger a thermal zone device removal. If that happens, - the thermal zone resume code may use a stale pointer to the next - list element and crash, because it does not hold thermal_list_lock - while walking thermal_tz_list. - - 2. The thermal zone resume code calls thermal_zone_device_init() - outside the zone lock, so user space or an update triggered by - the platform firmware may see an inconsistent state of a - thermal zone leading to unexpected behavior. - - 3. Clearing the in_suspend global variable in thermal_pm_notify() - allows __thermal_zone_device_update() to continue for all thermal - zones and it may as well run before the thermal_tz_list walk (or - at any point during the list walk for that matter) and attempt to - operate on a thermal zone that has not been resumed yet. It may - also race destructively with thermal_zone_device_init(). - -To address these issues, add thermal_list_lock locking to -thermal_pm_notify(), especially arount the thermal_tz_list, -make it call thermal_zone_device_init() back-to-back with -__thermal_zone_device_update() under the zone lock and replace -in_suspend with per-zone bool "suspend" indicators set and unset -under the given zone's lock. - -Link: https://lore.kernel.org/linux-pm/20231218162348.69101-1-bo.ye@mediatek.com/ -Reported-by: Bo Ye <bo.ye@mediatek.com> -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/thermal/thermal_core.c | 30 +++++++++++++++++++++++------- - include/linux/thermal.h | 2 ++ - 2 files changed, 25 insertions(+), 7 deletions(-) - -diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c -index 1bc7ba459406..45f51727410c 100644 ---- a/drivers/thermal/thermal_core.c -+++ b/drivers/thermal/thermal_core.c -@@ -37,8 +37,6 @@ static LIST_HEAD(thermal_governor_list); - static DEFINE_MUTEX(thermal_list_lock); - static DEFINE_MUTEX(thermal_governor_lock); - --static atomic_t in_suspend; -- - static struct thermal_governor *def_governor; - - /* -@@ -405,7 +403,7 @@ void __thermal_zone_device_update(struct thermal_zone_device *tz, - { - const struct thermal_trip *trip; - -- if (atomic_read(&in_suspend)) -+ if (tz->suspended) - return; - - if (WARN_ONCE(!tz->ops->get_temp, -@@ -1514,17 +1512,35 @@ static int thermal_pm_notify(struct notifier_block *nb, - case PM_HIBERNATION_PREPARE: - case PM_RESTORE_PREPARE: - case PM_SUSPEND_PREPARE: -- atomic_set(&in_suspend, 1); -+ mutex_lock(&thermal_list_lock); -+ -+ list_for_each_entry(tz, &thermal_tz_list, node) { -+ mutex_lock(&tz->lock); -+ -+ tz->suspended = true; -+ -+ mutex_unlock(&tz->lock); -+ } -+ -+ mutex_unlock(&thermal_list_lock); - break; - case PM_POST_HIBERNATION: - case PM_POST_RESTORE: - case PM_POST_SUSPEND: -- atomic_set(&in_suspend, 0); -+ mutex_lock(&thermal_list_lock); -+ - list_for_each_entry(tz, &thermal_tz_list, node) { -+ mutex_lock(&tz->lock); -+ -+ tz->suspended = false; -+ - thermal_zone_device_init(tz); -- thermal_zone_device_update(tz, -- THERMAL_EVENT_UNSPECIFIED); -+ __thermal_zone_device_update(tz, THERMAL_EVENT_UNSPECIFIED); -+ -+ mutex_unlock(&tz->lock); - } -+ -+ mutex_unlock(&thermal_list_lock); - break; - default: - break; -diff --git a/include/linux/thermal.h b/include/linux/thermal.h -index cee814d5d1ac..1da1739d75d9 100644 ---- a/include/linux/thermal.h -+++ b/include/linux/thermal.h -@@ -149,6 +149,7 @@ struct thermal_cooling_device { - * @node: node in thermal_tz_list (in thermal_core.c) - * @poll_queue: delayed work for polling - * @notify_event: Last notification event -+ * @suspended: thermal zone suspend indicator - */ - struct thermal_zone_device { - int id; -@@ -181,6 +182,7 @@ struct thermal_zone_device { - struct list_head node; - struct delayed_work poll_queue; - enum thermal_notify_event notify_event; -+ bool suspended; - }; - - /** --- -2.43.2 - -From 59342822276f753e49d27ef5eebffbba990572b9 Mon Sep 17 00:00:00 2001 -From: Osama Muhammad <osmtendev@gmail.com> -Date: Wed, 11 Oct 2023 23:46:37 +0500 -Subject: [PATCH 1047/1501] FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree -Content-Length: 3531 -Lines: 91 - -[ Upstream commit 9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68 ] - -Syzkaller reported the following issue: - -UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6 -index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]') -CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 -Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 -Call Trace: - <TASK> - __dump_stack lib/dump_stack.c:88 [inline] - dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 - ubsan_epilogue lib/ubsan.c:217 [inline] - __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 - dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 - dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 - dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 - dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] - dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 - txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 - txUpdateMap+0x342/0x9e0 - txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] - jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 - kthread+0x2d3/0x370 kernel/kthread.c:388 - ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 - ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 - </TASK> -================================================================================ -Kernel panic - not syncing: UBSAN: panic_on_warn set ... -CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 -Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 -Call Trace: - <TASK> - __dump_stack lib/dump_stack.c:88 [inline] - dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 - panic+0x30f/0x770 kernel/panic.c:340 - check_panic_on_warn+0x82/0xa0 kernel/panic.c:236 - ubsan_epilogue lib/ubsan.c:223 [inline] - __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348 - dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 - dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 - dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 - dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] - dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 - txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 - txUpdateMap+0x342/0x9e0 - txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] - jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 - kthread+0x2d3/0x370 kernel/kthread.c:388 - ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 - ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 - </TASK> -Kernel Offset: disabled -Rebooting in 86400 seconds.. - -The issue is caused when the value of lp becomes greater than -CTLTREESIZE which is the max size of stree. Adding a simple check -solves this issue. - -Dave: -As the function returns a void, good error handling -would require a more intrusive code reorganization, so I modified -Osama's patch at use WARN_ON_ONCE for lack of a cleaner option. - -The patch is tested via syzbot. - -Reported-by: syzbot+39ba34a099ac2e9bd3cb@syzkaller.appspotmail.com -Link: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb -Signed-off-by: Osama Muhammad <osmtendev@gmail.com> -Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/jfs/jfs_dmap.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c -index 11c77757ead9..d55f0dd8d754 100644 ---- a/fs/jfs/jfs_dmap.c -+++ b/fs/jfs/jfs_dmap.c -@@ -2871,6 +2871,9 @@ static void dbAdjTree(dmtree_t * tp, int leafno, int newval) - /* is the current value the same as the old value ? if so, - * there is nothing to do. - */ -+ if (WARN_ON_ONCE(lp >= CTLTREESIZE)) -+ return; -+ - if (tp->dmt_stree[lp] == newval) - return; - --- -2.43.2 - -From fc67a2e18f4c4e3f07e9f9ae463da24530470e73 Mon Sep 17 00:00:00 2001 -From: Manas Ghandat <ghandatmanas@gmail.com> -Date: Tue, 17 Oct 2023 17:33:56 +0530 -Subject: [PATCH 1050/1501] jfs: fix array-index-out-of-bounds in dbAdjTree -Content-Length: 7761 -Lines: 231 - -[ Upstream commit 74ecdda68242b174920fe7c6133a856fb7d8559b ] - -Currently there is a bound check missing in the dbAdjTree while -accessing the dmt_stree. To add the required check added the bool is_ctl -which is required to determine the size as suggest in the following -commit. -https://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e75f4fa@oracle.com/ - -Reported-by: syzbot+39ba34a099ac2e9bd3cb@syzkaller.appspotmail.com -Closes: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb -Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com> -Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/jfs/jfs_dmap.c | 60 ++++++++++++++++++++++++----------------------- - 1 file changed, 31 insertions(+), 29 deletions(-) - -diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c -index d55f0dd8d754..cb3cda1390ad 100644 ---- a/fs/jfs/jfs_dmap.c -+++ b/fs/jfs/jfs_dmap.c -@@ -63,10 +63,10 @@ - */ - static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, - int nblocks); --static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval); --static int dbBackSplit(dmtree_t * tp, int leafno); --static int dbJoin(dmtree_t * tp, int leafno, int newval); --static void dbAdjTree(dmtree_t * tp, int leafno, int newval); -+static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl); -+static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl); -+static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl); -+static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl); - static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, - int level); - static int dbAllocAny(struct bmap * bmp, s64 nblocks, int l2nb, s64 * results); -@@ -2103,7 +2103,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno, - * system. - */ - if (dp->tree.stree[word] == NOFREE) -- dbBackSplit((dmtree_t *) & dp->tree, word); -+ dbBackSplit((dmtree_t *)&dp->tree, word, false); - - dbAllocBits(bmp, dp, blkno, nblocks); - } -@@ -2189,7 +2189,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, - * the binary system of the leaves if need be. - */ - dbSplit(tp, word, BUDMIN, -- dbMaxBud((u8 *) & dp->wmap[word])); -+ dbMaxBud((u8 *)&dp->wmap[word]), false); - - word += 1; - } else { -@@ -2229,7 +2229,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, - * system of the leaves to reflect the current - * allocation (size). - */ -- dbSplit(tp, word, size, NOFREE); -+ dbSplit(tp, word, size, NOFREE, false); - - /* get the number of dmap words handled */ - nw = BUDSIZE(size, BUDMIN); -@@ -2336,7 +2336,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, - /* update the leaf for this dmap word. - */ - rc = dbJoin(tp, word, -- dbMaxBud((u8 *) & dp->wmap[word])); -+ dbMaxBud((u8 *)&dp->wmap[word]), false); - if (rc) - return rc; - -@@ -2369,7 +2369,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, - - /* update the leaf. - */ -- rc = dbJoin(tp, word, size); -+ rc = dbJoin(tp, word, size, false); - if (rc) - return rc; - -@@ -2521,16 +2521,16 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) - * that it is at the front of a binary buddy system. - */ - if (oldval == NOFREE) { -- rc = dbBackSplit((dmtree_t *) dcp, leafno); -+ rc = dbBackSplit((dmtree_t *)dcp, leafno, true); - if (rc) { - release_metapage(mp); - return rc; - } - oldval = dcp->stree[ti]; - } -- dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval); -+ dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval, true); - } else { -- rc = dbJoin((dmtree_t *) dcp, leafno, newval); -+ rc = dbJoin((dmtree_t *) dcp, leafno, newval, true); - if (rc) { - release_metapage(mp); - return rc; -@@ -2561,7 +2561,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) - */ - if (alloc) { - dbJoin((dmtree_t *) dcp, leafno, -- oldval); -+ oldval, true); - } else { - /* the dbJoin() above might have - * caused a larger binary buddy system -@@ -2571,9 +2571,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) - */ - if (dcp->stree[ti] == NOFREE) - dbBackSplit((dmtree_t *) -- dcp, leafno); -+ dcp, leafno, true); - dbSplit((dmtree_t *) dcp, leafno, -- dcp->budmin, oldval); -+ dcp->budmin, oldval, true); - } - - /* release the buffer and return the error. -@@ -2621,7 +2621,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) - * - * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; - */ --static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) -+static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl) - { - int budsz; - int cursz; -@@ -2643,7 +2643,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) - while (cursz >= splitsz) { - /* update the buddy's leaf with its new value. - */ -- dbAdjTree(tp, leafno ^ budsz, cursz); -+ dbAdjTree(tp, leafno ^ budsz, cursz, is_ctl); - - /* on to the next size and buddy. - */ -@@ -2655,7 +2655,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) - /* adjust the dmap tree to reflect the specified leaf's new - * value. - */ -- dbAdjTree(tp, leafno, newval); -+ dbAdjTree(tp, leafno, newval, is_ctl); - } - - -@@ -2686,7 +2686,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) - * - * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; - */ --static int dbBackSplit(dmtree_t * tp, int leafno) -+static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl) - { - int budsz, bud, w, bsz, size; - int cursz; -@@ -2737,7 +2737,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) - * system in two. - */ - cursz = leaf[bud] - 1; -- dbSplit(tp, bud, cursz, cursz); -+ dbSplit(tp, bud, cursz, cursz, is_ctl); - break; - } - } -@@ -2765,7 +2765,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) - * - * RETURN VALUES: none - */ --static int dbJoin(dmtree_t * tp, int leafno, int newval) -+static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl) - { - int budsz, buddy; - s8 *leaf; -@@ -2820,12 +2820,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) - if (leafno < buddy) { - /* leafno is the left buddy. - */ -- dbAdjTree(tp, buddy, NOFREE); -+ dbAdjTree(tp, buddy, NOFREE, is_ctl); - } else { - /* buddy is the left buddy and becomes - * leafno. - */ -- dbAdjTree(tp, leafno, NOFREE); -+ dbAdjTree(tp, leafno, NOFREE, is_ctl); - leafno = buddy; - } - -@@ -2838,7 +2838,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) - - /* update the leaf value. - */ -- dbAdjTree(tp, leafno, newval); -+ dbAdjTree(tp, leafno, newval, is_ctl); - - return 0; - } -@@ -2859,21 +2859,23 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) - * - * RETURN VALUES: none - */ --static void dbAdjTree(dmtree_t * tp, int leafno, int newval) -+static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl) - { - int lp, pp, k; -- int max; -+ int max, size; -+ -+ size = is_ctl ? CTLTREESIZE : TREESIZE; - - /* pick up the index of the leaf for this leafno. - */ - lp = leafno + le32_to_cpu(tp->dmt_leafidx); - -+ if (WARN_ON_ONCE(lp >= size || lp < 0)) -+ return; -+ - /* is the current value the same as the old value ? if so, - * there is nothing to do. - */ -- if (WARN_ON_ONCE(lp >= CTLTREESIZE)) -- return; -- - if (tp->dmt_stree[lp] == newval) - return; - --- -2.43.2 - -From bacdaa04251382d7efd4f09f9a0686bfcc297e2e Mon Sep 17 00:00:00 2001 -From: Edward Adam Davis <eadavis@qq.com> -Date: Tue, 31 Oct 2023 13:39:04 +0800 -Subject: [PATCH 1051/1501] jfs: fix uaf in jfs_evict_inode -Content-Length: 1303 -Lines: 42 - -[ Upstream commit e0e1958f4c365e380b17ccb35617345b31ef7bf3 ] - -When the execution of diMount(ipimap) fails, the object ipimap that has been -released may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs -when rcu_core() calls jfs_free_node(). - -Therefore, when diMount(ipimap) fails, sbi->ipimap should not be initialized as -ipimap. - -Reported-and-tested-by: syzbot+01cf2dbcbe2022454388@syzkaller.appspotmail.com -Signed-off-by: Edward Adam Davis <eadavis@qq.com> -Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/jfs/jfs_mount.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/fs/jfs/jfs_mount.c b/fs/jfs/jfs_mount.c -index 415eb65a36ff..9b5c6a20b30c 100644 ---- a/fs/jfs/jfs_mount.c -+++ b/fs/jfs/jfs_mount.c -@@ -172,15 +172,15 @@ int jfs_mount(struct super_block *sb) - } - jfs_info("jfs_mount: ipimap:0x%p", ipimap); - -- /* map further access of per fileset inodes by the fileset inode */ -- sbi->ipimap = ipimap; -- - /* initialize fileset inode allocation map */ - if ((rc = diMount(ipimap))) { - jfs_err("jfs_mount: diMount failed w/rc = %d", rc); - goto err_ipimap; - } - -+ /* map further access of per fileset inodes by the fileset inode */ -+ sbi->ipimap = ipimap; -+ - return rc; - - /* --- -2.43.2 - -From 942a6cd7fba20bccdcf486fe81839449f8d87360 Mon Sep 17 00:00:00 2001 -From: Jia Jie Ho <jiajie.ho@starfivetech.com> -Date: Mon, 20 Nov 2023 23:11:21 +0800 -Subject: [PATCH 1052/1501] hwrng: starfive - Fix dev_err_probe return error -Content-Length: 1215 -Lines: 30 - -[ Upstream commit 2d37b3649c412b3bcecfea932cb677f7a5775b15 ] - -Current dev_err_probe will return 0 instead of proper error code if -driver failed to get irq number. Fix the return err code. - -Signed-off-by: Jia Jie Ho <jiajie.ho@starfivetech.com> -Reported-by: kernel test robot <lkp@intel.com> -Reported-by: Dan Carpenter <error27@gmail.com> -Closes: https://lore.kernel.org/r/202311160649.3GhKCfhd-lkp@intel.com/ -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/char/hw_random/jh7110-trng.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/char/hw_random/jh7110-trng.c b/drivers/char/hw_random/jh7110-trng.c -index 38474d48a25e..b1f94e3c0c6a 100644 ---- a/drivers/char/hw_random/jh7110-trng.c -+++ b/drivers/char/hw_random/jh7110-trng.c -@@ -300,7 +300,7 @@ static int starfive_trng_probe(struct platform_device *pdev) - ret = devm_request_irq(&pdev->dev, irq, starfive_trng_irq, 0, pdev->name, - (void *)trng); - if (ret) -- return dev_err_probe(&pdev->dev, irq, -+ return dev_err_probe(&pdev->dev, ret, - "Failed to register interrupt handler\n"); - - trng->hclk = devm_clk_get(&pdev->dev, "hclk"); --- -2.43.2 - -From e85918ca8a2dc6a88c58f6d7bb34bd2e28bea421 Mon Sep 17 00:00:00 2001 -From: "Gustavo A. R. Silva" <gustavoars@kernel.org> -Date: Tue, 21 Nov 2023 12:52:44 -0600 -Subject: [PATCH 1053/1501] crypto: p10-aes-gcm - Avoid -Wstringop-overflow - warnings -Content-Length: 2482 -Lines: 50 - -[ Upstream commit aaa03fdb56c781db4a4831dd5d6ec8817918c726 ] - -The compiler doesn't know that `32` is an offset into the Hash table: - - 56 struct Hash_ctx { - 57 u8 H[16]; /* subkey */ - 58 u8 Htable[256]; /* Xi, Hash table(offset 32) */ - 59 }; - -So, it legitimately complains about a potential out-of-bounds issue -if `256 bytes` are accessed in `htable` (this implies going -`32 bytes` beyond the boundaries of `Htable`): - -arch/powerpc/crypto/aes-gcm-p10-glue.c: In function 'gcmp10_init': -arch/powerpc/crypto/aes-gcm-p10-glue.c:120:9: error: 'gcm_init_htable' accessing 256 bytes in a region of size 224 [-Werror=stringop-overflow=] - 120 | gcm_init_htable(hash->Htable+32, hash->H); - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -arch/powerpc/crypto/aes-gcm-p10-glue.c:120:9: note: referencing argument 1 of type 'unsigned char[256]' -arch/powerpc/crypto/aes-gcm-p10-glue.c:120:9: note: referencing argument 2 of type 'unsigned char[16]' -arch/powerpc/crypto/aes-gcm-p10-glue.c:40:17: note: in a call to function 'gcm_init_htable' - 40 | asmlinkage void gcm_init_htable(unsigned char htable[256], unsigned char Xi[16]); - | ^~~~~~~~~~~~~~~ - -Address this by avoiding specifying the size of `htable` in the function -prototype; and just for consistency, do the same for parameter `Xi`. - -Reported-by: Stephen Rothwell <sfr@canb.auug.org.au> -Closes: https://lore.kernel.org/linux-next/20231121131903.68a37932@canb.auug.org.au/ -Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/powerpc/crypto/aes-gcm-p10-glue.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/powerpc/crypto/aes-gcm-p10-glue.c b/arch/powerpc/crypto/aes-gcm-p10-glue.c -index 4b6e899895e7..f62ee54076c0 100644 ---- a/arch/powerpc/crypto/aes-gcm-p10-glue.c -+++ b/arch/powerpc/crypto/aes-gcm-p10-glue.c -@@ -37,7 +37,7 @@ asmlinkage void aes_p10_gcm_encrypt(u8 *in, u8 *out, size_t len, - void *rkey, u8 *iv, void *Xi); - asmlinkage void aes_p10_gcm_decrypt(u8 *in, u8 *out, size_t len, - void *rkey, u8 *iv, void *Xi); --asmlinkage void gcm_init_htable(unsigned char htable[256], unsigned char Xi[16]); -+asmlinkage void gcm_init_htable(unsigned char htable[], unsigned char Xi[]); - asmlinkage void gcm_ghash_p10(unsigned char *Xi, unsigned char *Htable, - unsigned char *aad, unsigned int alen); - --- -2.43.2 - -From cd40e43f870cf21726b22487a95ed223790b3542 Mon Sep 17 00:00:00 2001 -From: Weichen Chen <weichen.chen@mediatek.com> -Date: Fri, 24 Feb 2023 10:36:32 +0800 -Subject: [PATCH 1054/1501] pstore/ram: Fix crash when setting number of cpus - to an odd number -Content-Length: 1271 -Lines: 39 - -[ Upstream commit d49270a04623ce3c0afddbf3e984cb245aa48e9c ] - -When the number of cpu cores is adjusted to 7 or other odd numbers, -the zone size will become an odd number. -The address of the zone will become: - addr of zone0 = BASE - addr of zone1 = BASE + zone_size - addr of zone2 = BASE + zone_size*2 - ... -The address of zone1/3/5/7 will be mapped to non-alignment va. -Eventually crashes will occur when accessing these va. - -So, use ALIGN_DOWN() to make sure the zone size is even -to avoid this bug. - -Signed-off-by: Weichen Chen <weichen.chen@mediatek.com> -Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com> -Tested-by: "Guilherme G. Piccoli" <gpiccoli@igalia.com> -Link: https://lore.kernel.org/r/20230224023632.6840-1-weichen.chen@mediatek.com -Signed-off-by: Kees Cook <keescook@chromium.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/pstore/ram.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c -index d36702c7ab3c..88b34fdbf759 100644 ---- a/fs/pstore/ram.c -+++ b/fs/pstore/ram.c -@@ -529,6 +529,7 @@ static int ramoops_init_przs(const char *name, - } - - zone_sz = mem_sz / *cnt; -+ zone_sz = ALIGN_DOWN(zone_sz, 2); - if (!zone_sz) { - dev_err(dev, "%s zone size == 0\n", name); - goto fail; --- -2.43.2 - -From 22438a34d383ec2789eaf450728e38abc53051f8 Mon Sep 17 00:00:00 2001 -From: Gao Xiang <hsiangkao@linux.alibaba.com> -Date: Wed, 6 Dec 2023 17:10:55 +0800 -Subject: [PATCH 1055/1501] erofs: fix up compacted indexes for block size < - 4096 -Content-Length: 5064 -Lines: 139 - -[ Upstream commit 8d2517aaeea3ab8651bb517bca8f3c8664d318ea ] - -Previously, the block size always equaled to PAGE_SIZE, therefore -`lclusterbits` couldn't be less than 12. - -Since sub-page compressed blocks are now considered, `lobits` for -a lcluster in each pack cannot always be `lclusterbits` as before. -Otherwise, there is no enough room for the special value -`Z_EROFS_LI_D0_CBLKCNT`. - -To support smaller block sizes, `lobits` for each compacted lcluster is -now calculated as: - lobits = max(lclusterbits, ilog2(Z_EROFS_LI_D0_CBLKCNT) + 1) - -Reviewed-by: Yue Hu <huyue2@coolpad.com> -Reviewed-by: Chao Yu <chao@kernel.org> -Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com> -Link: https://lore.kernel.org/r/20231206091057.87027-4-hsiangkao@linux.alibaba.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/erofs/zmap.c | 32 ++++++++++++++------------------ - 1 file changed, 14 insertions(+), 18 deletions(-) - -diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c -index 7a1a24ae4a2d..e313c936351d 100644 ---- a/fs/erofs/zmap.c -+++ b/fs/erofs/zmap.c -@@ -82,29 +82,26 @@ static int z_erofs_load_full_lcluster(struct z_erofs_maprecorder *m, - } - - static unsigned int decode_compactedbits(unsigned int lobits, -- unsigned int lomask, - u8 *in, unsigned int pos, u8 *type) - { - const unsigned int v = get_unaligned_le32(in + pos / 8) >> (pos & 7); -- const unsigned int lo = v & lomask; -+ const unsigned int lo = v & ((1 << lobits) - 1); - - *type = (v >> lobits) & 3; - return lo; - } - --static int get_compacted_la_distance(unsigned int lclusterbits, -+static int get_compacted_la_distance(unsigned int lobits, - unsigned int encodebits, - unsigned int vcnt, u8 *in, int i) - { -- const unsigned int lomask = (1 << lclusterbits) - 1; - unsigned int lo, d1 = 0; - u8 type; - - DBG_BUGON(i >= vcnt); - - do { -- lo = decode_compactedbits(lclusterbits, lomask, -- in, encodebits * i, &type); -+ lo = decode_compactedbits(lobits, in, encodebits * i, &type); - - if (type != Z_EROFS_LCLUSTER_TYPE_NONHEAD) - return d1; -@@ -123,15 +120,14 @@ static int unpack_compacted_index(struct z_erofs_maprecorder *m, - { - struct erofs_inode *const vi = EROFS_I(m->inode); - const unsigned int lclusterbits = vi->z_logical_clusterbits; -- const unsigned int lomask = (1 << lclusterbits) - 1; -- unsigned int vcnt, base, lo, encodebits, nblk, eofs; -+ unsigned int vcnt, base, lo, lobits, encodebits, nblk, eofs; - int i; - u8 *in, type; - bool big_pcluster; - - if (1 << amortizedshift == 4 && lclusterbits <= 14) - vcnt = 2; -- else if (1 << amortizedshift == 2 && lclusterbits == 12) -+ else if (1 << amortizedshift == 2 && lclusterbits <= 12) - vcnt = 16; - else - return -EOPNOTSUPP; -@@ -140,6 +136,7 @@ static int unpack_compacted_index(struct z_erofs_maprecorder *m, - m->nextpackoff = round_down(pos, vcnt << amortizedshift) + - (vcnt << amortizedshift); - big_pcluster = vi->z_advise & Z_EROFS_ADVISE_BIG_PCLUSTER_1; -+ lobits = max(lclusterbits, ilog2(Z_EROFS_LI_D0_CBLKCNT) + 1U); - encodebits = ((vcnt << amortizedshift) - sizeof(__le32)) * 8 / vcnt; - eofs = erofs_blkoff(m->inode->i_sb, pos); - base = round_down(eofs, vcnt << amortizedshift); -@@ -147,15 +144,14 @@ static int unpack_compacted_index(struct z_erofs_maprecorder *m, - - i = (eofs - base) >> amortizedshift; - -- lo = decode_compactedbits(lclusterbits, lomask, -- in, encodebits * i, &type); -+ lo = decode_compactedbits(lobits, in, encodebits * i, &type); - m->type = type; - if (type == Z_EROFS_LCLUSTER_TYPE_NONHEAD) { - m->clusterofs = 1 << lclusterbits; - - /* figure out lookahead_distance: delta[1] if needed */ - if (lookahead) -- m->delta[1] = get_compacted_la_distance(lclusterbits, -+ m->delta[1] = get_compacted_la_distance(lobits, - encodebits, vcnt, in, i); - if (lo & Z_EROFS_LI_D0_CBLKCNT) { - if (!big_pcluster) { -@@ -174,8 +170,8 @@ static int unpack_compacted_index(struct z_erofs_maprecorder *m, - * of which lo saves delta[1] rather than delta[0]. - * Hence, get delta[0] by the previous lcluster indirectly. - */ -- lo = decode_compactedbits(lclusterbits, lomask, -- in, encodebits * (i - 1), &type); -+ lo = decode_compactedbits(lobits, in, -+ encodebits * (i - 1), &type); - if (type != Z_EROFS_LCLUSTER_TYPE_NONHEAD) - lo = 0; - else if (lo & Z_EROFS_LI_D0_CBLKCNT) -@@ -190,8 +186,8 @@ static int unpack_compacted_index(struct z_erofs_maprecorder *m, - nblk = 1; - while (i > 0) { - --i; -- lo = decode_compactedbits(lclusterbits, lomask, -- in, encodebits * i, &type); -+ lo = decode_compactedbits(lobits, in, -+ encodebits * i, &type); - if (type == Z_EROFS_LCLUSTER_TYPE_NONHEAD) - i -= lo; - -@@ -202,8 +198,8 @@ static int unpack_compacted_index(struct z_erofs_maprecorder *m, - nblk = 0; - while (i > 0) { - --i; -- lo = decode_compactedbits(lclusterbits, lomask, -- in, encodebits * i, &type); -+ lo = decode_compactedbits(lobits, in, -+ encodebits * i, &type); - if (type == Z_EROFS_LCLUSTER_TYPE_NONHEAD) { - if (lo & Z_EROFS_LI_D0_CBLKCNT) { - --i; --- -2.43.2 - -From cda72949e62f3717cf06fcf9b4064a1fe9f28011 Mon Sep 17 00:00:00 2001 -From: Jia Jie Ho <jiajie.ho@starfivetech.com> -Date: Mon, 4 Dec 2023 11:04:13 +0800 -Subject: [PATCH 1056/1501] crypto: starfive - Fix dev_err_probe return error -Content-Length: 1036 -Lines: 27 - -[ Upstream commit 8517c34e87025b3f74f3c07813d493828f369598 ] - -Current dev_err_probe will return 0 instead of proper error code if -driver failed to get irq number. Fix the return code. - -Signed-off-by: Jia Jie Ho <jiajie.ho@starfivetech.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/starfive/jh7110-cryp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/crypto/starfive/jh7110-cryp.c b/drivers/crypto/starfive/jh7110-cryp.c -index 3a67ddc4d936..4f5b6818208d 100644 ---- a/drivers/crypto/starfive/jh7110-cryp.c -+++ b/drivers/crypto/starfive/jh7110-cryp.c -@@ -168,7 +168,7 @@ static int starfive_cryp_probe(struct platform_device *pdev) - ret = devm_request_irq(&pdev->dev, irq, starfive_cryp_irq, 0, pdev->name, - (void *)cryp); - if (ret) -- return dev_err_probe(&pdev->dev, irq, -+ return dev_err_probe(&pdev->dev, ret, - "Failed to register interrupt handler\n"); - - clk_prepare_enable(cryp->hclk); --- -2.43.2 - -From e518dfc3ac1da98592a4dd0fa21d4ae18075d904 Mon Sep 17 00:00:00 2001 -From: Bharat Bhushan <bbhushan2@marvell.com> -Date: Mon, 11 Dec 2023 15:59:11 +0530 -Subject: [PATCH 1057/1501] crypto: octeontx2 - Fix cptvf driver cleanup -Content-Length: 2298 -Lines: 63 - -[ Upstream commit c480a421a4faf693c38e60b0fe6e554c9a3fee02 ] - -This patch fixes following cleanup issues: - - Missing instruction queue free on cleanup. This - will lead to memory leak. - - lfs->lfs_num is set to zero before cleanup, which - will lead to improper cleanup. - -Signed-off-by: Bharat Bhushan <bbhushan2@marvell.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/marvell/octeontx2/otx2_cptlf.c | 6 ++++-- - drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c | 3 +++ - 2 files changed, 7 insertions(+), 2 deletions(-) - -diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptlf.c b/drivers/crypto/marvell/octeontx2/otx2_cptlf.c -index 6edd27ff8c4e..e4bd3f030cec 100644 ---- a/drivers/crypto/marvell/octeontx2/otx2_cptlf.c -+++ b/drivers/crypto/marvell/octeontx2/otx2_cptlf.c -@@ -419,8 +419,8 @@ int otx2_cptlf_init(struct otx2_cptlfs_info *lfs, u8 eng_grp_mask, int pri, - return 0; - - free_iq: -- otx2_cpt_free_instruction_queues(lfs); - cptlf_hw_cleanup(lfs); -+ otx2_cpt_free_instruction_queues(lfs); - detach_rsrcs: - otx2_cpt_detach_rsrcs_msg(lfs); - clear_lfs_num: -@@ -431,11 +431,13 @@ EXPORT_SYMBOL_NS_GPL(otx2_cptlf_init, CRYPTO_DEV_OCTEONTX2_CPT); - - void otx2_cptlf_shutdown(struct otx2_cptlfs_info *lfs) - { -- lfs->lfs_num = 0; - /* Cleanup LFs hardware side */ - cptlf_hw_cleanup(lfs); -+ /* Free instruction queues */ -+ otx2_cpt_free_instruction_queues(lfs); - /* Send request to detach LFs */ - otx2_cpt_detach_rsrcs_msg(lfs); -+ lfs->lfs_num = 0; - } - EXPORT_SYMBOL_NS_GPL(otx2_cptlf_shutdown, CRYPTO_DEV_OCTEONTX2_CPT); - -diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c b/drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c -index bac729c885f9..215a1b17b6ce 100644 ---- a/drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c -+++ b/drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c -@@ -249,8 +249,11 @@ static void cptvf_lf_shutdown(struct otx2_cptlfs_info *lfs) - otx2_cptlf_unregister_interrupts(lfs); - /* Cleanup LFs software side */ - lf_sw_cleanup(lfs); -+ /* Free instruction queues */ -+ otx2_cpt_free_instruction_queues(lfs); - /* Send request to detach LFs */ - otx2_cpt_detach_rsrcs_msg(lfs); -+ lfs->lfs_num = 0; - } - - static int cptvf_lf_init(struct otx2_cptvf_dev *cptvf) --- -2.43.2 - -From ecf369741d4c3c2081e0d373c5de80c3b3309a7e Mon Sep 17 00:00:00 2001 -From: Gao Xiang <hsiangkao@linux.alibaba.com> -Date: Fri, 15 Dec 2023 00:13:37 +0800 -Subject: [PATCH 1058/1501] erofs: fix ztailpacking for subpage compressed - blocks -Content-Length: 1340 -Lines: 36 - -[ Upstream commit e5aba911dee5e20fa82efbe13e0af8f38ea459e7 ] - -`pageofs_in` should be the compressed data offset of the page rather -than of the block. - -Acked-by: Chao Yu <chao@kernel.org> -Reviewed-by: Yue Hu <huyue2@coolpad.com> -Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com> -Link: https://lore.kernel.org/r/20231214161337.753049-1-hsiangkao@linux.alibaba.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/erofs/zdata.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c -index a33cd6757f98..1c0e6167d8e7 100644 ---- a/fs/erofs/zdata.c -+++ b/fs/erofs/zdata.c -@@ -815,7 +815,6 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe) - - if (ztailpacking) { - pcl->obj.index = 0; /* which indicates ztailpacking */ -- pcl->pageofs_in = erofs_blkoff(fe->inode->i_sb, map->m_pa); - pcl->tailpacking_size = map->m_plen; - } else { - pcl->obj.index = map->m_pa >> PAGE_SHIFT; -@@ -893,6 +892,7 @@ static int z_erofs_pcluster_begin(struct z_erofs_decompress_frontend *fe) - } - get_page(map->buf.page); - WRITE_ONCE(fe->pcl->compressed_bvecs[0].page, map->buf.page); -+ fe->pcl->pageofs_in = map->m_pa & ~PAGE_MASK; - fe->mode = Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE; - } - /* file-backed inplace I/O pages are traversed in reverse order */ --- -2.43.2 - -From 08f5b181f51cb064aba0439da34aa5fd8eb4d4f6 Mon Sep 17 00:00:00 2001 -From: Thomas Bourgoin <thomas.bourgoin@foss.st.com> -Date: Fri, 15 Dec 2023 12:17:24 +0100 -Subject: [PATCH 1059/1501] crypto: stm32/crc32 - fix parsing list of devices -Content-Length: 1543 -Lines: 38 - -[ Upstream commit 0eaef675b94c746900dcea7f6c41b9a103ed5d53 ] - -smatch warnings: -drivers/crypto/stm32/stm32-crc32.c:108 stm32_crc_get_next_crc() warn: -can 'crc' even be NULL? - -Use list_first_entry_or_null instead of list_first_entry to retrieve -the first device registered. -The function list_first_entry always return a non NULL pointer even if -the list is empty. Hence checking if the pointer returned is NULL does -not tell if the list is empty or not. - -Reported-by: kernel test robot <lkp@intel.com> -Closes: https://lore.kernel.org/r/202311281111.ou2oUL2i-lkp@intel.com/ -Reported-by: Dan Carpenter <error27@gmail.com> -Closes: https://lore.kernel.org/r/202311281111.ou2oUL2i-lkp@intel.com/ -Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/stm32/stm32-crc32.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/crypto/stm32/stm32-crc32.c b/drivers/crypto/stm32/stm32-crc32.c -index b2d5c8921ab3..b0cf6d2fd352 100644 ---- a/drivers/crypto/stm32/stm32-crc32.c -+++ b/drivers/crypto/stm32/stm32-crc32.c -@@ -104,7 +104,7 @@ static struct stm32_crc *stm32_crc_get_next_crc(void) - struct stm32_crc *crc; - - spin_lock_bh(&crc_list.lock); -- crc = list_first_entry(&crc_list.dev_list, struct stm32_crc, list); -+ crc = list_first_entry_or_null(&crc_list.dev_list, struct stm32_crc, list); - if (crc) - list_move_tail(&crc->list, &crc_list.dev_list); - spin_unlock_bh(&crc_list.lock); --- -2.43.2 - -From 779f4b22fb253ed2fc278fdea4e64502817faf90 Mon Sep 17 00:00:00 2001 -From: Oleg Nesterov <oleg@redhat.com> -Date: Thu, 30 Nov 2023 12:56:06 +0100 -Subject: [PATCH 1060/1501] afs: fix the usage of read_seqbegin_or_lock() in - afs_lookup_volume_rcu() -Content-Length: 1453 -Lines: 45 - -[ Upstream commit 4121b4337146b64560d1e46ebec77196d9287802 ] - -David Howells says: - - (2) afs_lookup_volume_rcu(). - - There can be a lot of volumes known by a system. A thousand would - require a 10-step walk and this is drivable by remote operation, so I - think this should probably take a lock on the second pass too. - -Make the "seq" counter odd on the 2nd pass, otherwise read_seqbegin_or_lock() -never takes the lock. - -Signed-off-by: Oleg Nesterov <oleg@redhat.com> -Signed-off-by: David Howells <dhowells@redhat.com> -cc: Marc Dionne <marc.dionne@auristor.com> -cc: linux-afs@lists.infradead.org -Link: https://lore.kernel.org/r/20231130115606.GA21571@redhat.com/ -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/afs/callback.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/fs/afs/callback.c b/fs/afs/callback.c -index a484fa642808..90f9b2a46ff4 100644 ---- a/fs/afs/callback.c -+++ b/fs/afs/callback.c -@@ -110,13 +110,14 @@ static struct afs_volume *afs_lookup_volume_rcu(struct afs_cell *cell, - { - struct afs_volume *volume = NULL; - struct rb_node *p; -- int seq = 0; -+ int seq = 1; - - do { - /* Unfortunately, rbtree walking doesn't give reliable results - * under just the RCU read lock, so we have to check for - * changes. - */ -+ seq++; /* 2 on the 1st/lockless path, otherwise odd */ - read_seqbegin_or_lock(&cell->volume_lock, &seq); - - p = rcu_dereference_raw(cell->volumes.rb_node); --- -2.43.2 - -From 4c89c30d20c44bd01d5a62711cde924fd4e356e8 Mon Sep 17 00:00:00 2001 -From: Oleg Nesterov <oleg@redhat.com> -Date: Fri, 17 Nov 2023 17:48:46 +0100 -Subject: [PATCH 1061/1501] rxrpc_find_service_conn_rcu: fix the usage of - read_seqbegin_or_lock() -Content-Length: 1418 -Lines: 38 - -[ Upstream commit bad1a11c0f061aa073bab785389fe04f19ba02e1 ] - -rxrpc_find_service_conn_rcu() should make the "seq" counter odd on the -second pass, otherwise read_seqbegin_or_lock() never takes the lock. - -Signed-off-by: Oleg Nesterov <oleg@redhat.com> -Signed-off-by: David Howells <dhowells@redhat.com> -cc: Marc Dionne <marc.dionne@auristor.com> -cc: linux-afs@lists.infradead.org -Link: https://lore.kernel.org/r/20231117164846.GA10410@redhat.com/ -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/rxrpc/conn_service.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/net/rxrpc/conn_service.c b/net/rxrpc/conn_service.c -index 89ac05a711a4..39c908a3ca6e 100644 ---- a/net/rxrpc/conn_service.c -+++ b/net/rxrpc/conn_service.c -@@ -25,7 +25,7 @@ struct rxrpc_connection *rxrpc_find_service_conn_rcu(struct rxrpc_peer *peer, - struct rxrpc_conn_proto k; - struct rxrpc_skb_priv *sp = rxrpc_skb(skb); - struct rb_node *p; -- unsigned int seq = 0; -+ unsigned int seq = 1; - - k.epoch = sp->hdr.epoch; - k.cid = sp->hdr.cid & RXRPC_CIDMASK; -@@ -35,6 +35,7 @@ struct rxrpc_connection *rxrpc_find_service_conn_rcu(struct rxrpc_peer *peer, - * under just the RCU read lock, so we have to check for - * changes. - */ -+ seq++; /* 2 on the 1st/lockless path, otherwise odd */ - read_seqbegin_or_lock(&peer->service_conn_lock, &seq); - - p = rcu_dereference_raw(peer->service_conns.rb_node); --- -2.43.2 - -From 5a6660139195f5e2fbbda459eeecb8788f3885fe Mon Sep 17 00:00:00 2001 -From: Edward Adam Davis <eadavis@qq.com> -Date: Tue, 12 Dec 2023 09:36:22 +0800 -Subject: [PATCH 1062/1501] jfs: fix array-index-out-of-bounds in diNewExt -Content-Length: 2899 -Lines: 70 - -[ Upstream commit 49f9637aafa6e63ba686c13cb8549bf5e6920402 ] - -[Syz report] -UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:2360:2 -index -878706688 is out of range for type 'struct iagctl[128]' -CPU: 1 PID: 5065 Comm: syz-executor282 Not tainted 6.7.0-rc4-syzkaller-00009-gbee0e7762ad2 #0 -Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 -Call Trace: - <TASK> - __dump_stack lib/dump_stack.c:88 [inline] - dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 - ubsan_epilogue lib/ubsan.c:217 [inline] - __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 - diNewExt+0x3cf3/0x4000 fs/jfs/jfs_imap.c:2360 - diAllocExt fs/jfs/jfs_imap.c:1949 [inline] - diAllocAG+0xbe8/0x1e50 fs/jfs/jfs_imap.c:1666 - diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587 - ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56 - jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225 - vfs_mkdir+0x2f1/0x4b0 fs/namei.c:4106 - do_mkdirat+0x264/0x3a0 fs/namei.c:4129 - __do_sys_mkdir fs/namei.c:4149 [inline] - __se_sys_mkdir fs/namei.c:4147 [inline] - __x64_sys_mkdir+0x6e/0x80 fs/namei.c:4147 - do_syscall_x64 arch/x86/entry/common.c:51 [inline] - do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82 - entry_SYSCALL_64_after_hwframe+0x63/0x6b -RIP: 0033:0x7fcb7e6a0b57 -Code: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 -RSP: 002b:00007ffd83023038 EFLAGS: 00000286 ORIG_RAX: 0000000000000053 -RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007fcb7e6a0b57 -RDX: 00000000000a1020 RSI: 00000000000001ff RDI: 0000000020000140 -RBP: 0000000020000140 R08: 0000000000000000 R09: 0000000000000000 -R10: 0000000000000000 R11: 0000000000000286 R12: 00007ffd830230d0 -R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 - -[Analysis] -When the agstart is too large, it can cause agno overflow. - -[Fix] -After obtaining agno, if the value is invalid, exit the subsequent process. - -Reported-and-tested-by: syzbot+553d90297e6d2f50dbc7@syzkaller.appspotmail.com -Signed-off-by: Edward Adam Davis <eadavis@qq.com> - -Modified the test from agno > MAXAG to agno >= MAXAG based on linux-next -report by kernel test robot (Dan Carpenter). - -Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/jfs/jfs_imap.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c -index a037ee59e398..2ec35889ad24 100644 ---- a/fs/jfs/jfs_imap.c -+++ b/fs/jfs/jfs_imap.c -@@ -2179,6 +2179,9 @@ static int diNewExt(struct inomap * imap, struct iag * iagp, int extno) - /* get the ag and iag numbers for this iag. - */ - agno = BLKTOAG(le64_to_cpu(iagp->agstart), sbi); -+ if (agno >= MAXAG || agno < 0) -+ return -EIO; -+ - iagno = le32_to_cpu(iagp->iagnum); - - /* check if this is the last free extent within the --- -2.43.2 - -From b5a35d12e751c8641e73e40d9b1f521cc2bb9916 Mon Sep 17 00:00:00 2001 -From: Alexander Gordeev <agordeev@linux.ibm.com> -Date: Sun, 16 Jul 2023 10:56:00 +0200 -Subject: [PATCH 1063/1501] s390/boot: always align vmalloc area on segment - boundary -Content-Length: 2065 -Lines: 55 - -[ Upstream commit 65f8780e2d70257200547b5a7654974aa7c37ce1 ] - -The size of vmalloc area depends from various factors -on boot and could be set to: - -1. Default size as determined by VMALLOC_DEFAULT_SIZE macro; -2. One half of the virtual address space not occupied by - modules and fixed mappings; -3. The size provided by user with vmalloc= kernel command - line parameter; - -In cases [1] and [2] the vmalloc area base address is aligned -on Region3 table type boundary, while in case [3] in might get -aligned on page boundary. - -Limit the waste of page tables and always align vmalloc area -size and base address on segment boundary. - -Acked-by: Heiko Carstens <hca@linux.ibm.com> -Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/s390/boot/ipl_parm.c | 2 +- - arch/s390/boot/startup.c | 3 ++- - 2 files changed, 3 insertions(+), 2 deletions(-) - -diff --git a/arch/s390/boot/ipl_parm.c b/arch/s390/boot/ipl_parm.c -index 2ab4872fbee1..b24de9aabf7d 100644 ---- a/arch/s390/boot/ipl_parm.c -+++ b/arch/s390/boot/ipl_parm.c -@@ -274,7 +274,7 @@ void parse_boot_command_line(void) - memory_limit = round_down(memparse(val, NULL), PAGE_SIZE); - - if (!strcmp(param, "vmalloc") && val) { -- vmalloc_size = round_up(memparse(val, NULL), PAGE_SIZE); -+ vmalloc_size = round_up(memparse(val, NULL), _SEGMENT_SIZE); - vmalloc_size_set = 1; - } - -diff --git a/arch/s390/boot/startup.c b/arch/s390/boot/startup.c -index 8104e0e3d188..9cc76e631759 100644 ---- a/arch/s390/boot/startup.c -+++ b/arch/s390/boot/startup.c -@@ -255,7 +255,8 @@ static unsigned long setup_kernel_memory_layout(void) - VMALLOC_END = MODULES_VADDR; - - /* allow vmalloc area to occupy up to about 1/2 of the rest virtual space left */ -- vmalloc_size = min(vmalloc_size, round_down(VMALLOC_END / 2, _REGION3_SIZE)); -+ vsize = round_down(VMALLOC_END / 2, _SEGMENT_SIZE); -+ vmalloc_size = min(vmalloc_size, vsize); - VMALLOC_START = VMALLOC_END - vmalloc_size; - - /* split remaining virtual space between 1:1 mapping & vmemmap array */ --- -2.43.2 - -From 642102953a81561665055e27eb01a046f3ddb7b0 Mon Sep 17 00:00:00 2001 -From: Arnd Bergmann <arnd@arndb.de> -Date: Wed, 8 Nov 2023 13:58:29 +0100 -Subject: [PATCH 1064/1501] arch: consolidate arch_irq_work_raise prototypes -Content-Length: 4210 -Lines: 122 - -[ Upstream commit 64bac5ea17d527872121adddfee869c7a0618f8f ] - -The prototype was hidden in an #ifdef on x86, which causes a warning: - -kernel/irq_work.c:72:13: error: no previous prototype for 'arch_irq_work_raise' [-Werror=missing-prototypes] - -Some architectures have a working prototype, while others don't. -Fix this by providing it in only one place that is always visible. - -Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com> -Acked-by: Catalin Marinas <catalin.marinas@arm.com> -Acked-by: Palmer Dabbelt <palmer@rivosinc.com> -Acked-by: Guo Ren <guoren@kernel.org> -Signed-off-by: Arnd Bergmann <arnd@arndb.de> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/arm/include/asm/irq_work.h | 2 -- - arch/arm64/include/asm/irq_work.h | 2 -- - arch/csky/include/asm/irq_work.h | 2 +- - arch/powerpc/include/asm/irq_work.h | 1 - - arch/riscv/include/asm/irq_work.h | 2 +- - arch/s390/include/asm/irq_work.h | 2 -- - arch/x86/include/asm/irq_work.h | 1 - - include/linux/irq_work.h | 3 +++ - 8 files changed, 5 insertions(+), 10 deletions(-) - -diff --git a/arch/arm/include/asm/irq_work.h b/arch/arm/include/asm/irq_work.h -index 3149e4dc1b54..8895999834cc 100644 ---- a/arch/arm/include/asm/irq_work.h -+++ b/arch/arm/include/asm/irq_work.h -@@ -9,6 +9,4 @@ static inline bool arch_irq_work_has_interrupt(void) - return is_smp(); - } - --extern void arch_irq_work_raise(void); -- - #endif /* _ASM_ARM_IRQ_WORK_H */ -diff --git a/arch/arm64/include/asm/irq_work.h b/arch/arm64/include/asm/irq_work.h -index 81bbfa3a035b..a1020285ea75 100644 ---- a/arch/arm64/include/asm/irq_work.h -+++ b/arch/arm64/include/asm/irq_work.h -@@ -2,8 +2,6 @@ - #ifndef __ASM_IRQ_WORK_H - #define __ASM_IRQ_WORK_H - --extern void arch_irq_work_raise(void); -- - static inline bool arch_irq_work_has_interrupt(void) - { - return true; -diff --git a/arch/csky/include/asm/irq_work.h b/arch/csky/include/asm/irq_work.h -index 33aaf39d6f94..d39fcc1f5395 100644 ---- a/arch/csky/include/asm/irq_work.h -+++ b/arch/csky/include/asm/irq_work.h -@@ -7,5 +7,5 @@ static inline bool arch_irq_work_has_interrupt(void) - { - return true; - } --extern void arch_irq_work_raise(void); -+ - #endif /* __ASM_CSKY_IRQ_WORK_H */ -diff --git a/arch/powerpc/include/asm/irq_work.h b/arch/powerpc/include/asm/irq_work.h -index b8b0be8f1a07..c6d3078bd8c3 100644 ---- a/arch/powerpc/include/asm/irq_work.h -+++ b/arch/powerpc/include/asm/irq_work.h -@@ -6,6 +6,5 @@ static inline bool arch_irq_work_has_interrupt(void) - { - return true; - } --extern void arch_irq_work_raise(void); - - #endif /* _ASM_POWERPC_IRQ_WORK_H */ -diff --git a/arch/riscv/include/asm/irq_work.h b/arch/riscv/include/asm/irq_work.h -index b53891964ae0..b27a4d64fc6a 100644 ---- a/arch/riscv/include/asm/irq_work.h -+++ b/arch/riscv/include/asm/irq_work.h -@@ -6,5 +6,5 @@ static inline bool arch_irq_work_has_interrupt(void) - { - return IS_ENABLED(CONFIG_SMP); - } --extern void arch_irq_work_raise(void); -+ - #endif /* _ASM_RISCV_IRQ_WORK_H */ -diff --git a/arch/s390/include/asm/irq_work.h b/arch/s390/include/asm/irq_work.h -index 603783766d0a..f00c9f610d5a 100644 ---- a/arch/s390/include/asm/irq_work.h -+++ b/arch/s390/include/asm/irq_work.h -@@ -7,6 +7,4 @@ static inline bool arch_irq_work_has_interrupt(void) - return true; - } - --void arch_irq_work_raise(void); -- - #endif /* _ASM_S390_IRQ_WORK_H */ -diff --git a/arch/x86/include/asm/irq_work.h b/arch/x86/include/asm/irq_work.h -index 800ffce0db29..6b4d36c95165 100644 ---- a/arch/x86/include/asm/irq_work.h -+++ b/arch/x86/include/asm/irq_work.h -@@ -9,7 +9,6 @@ static inline bool arch_irq_work_has_interrupt(void) - { - return boot_cpu_has(X86_FEATURE_APIC); - } --extern void arch_irq_work_raise(void); - #else - static inline bool arch_irq_work_has_interrupt(void) - { -diff --git a/include/linux/irq_work.h b/include/linux/irq_work.h -index 8cd11a223260..136f2980cba3 100644 ---- a/include/linux/irq_work.h -+++ b/include/linux/irq_work.h -@@ -66,6 +66,9 @@ void irq_work_sync(struct irq_work *work); - void irq_work_run(void); - bool irq_work_needs_cpu(void); - void irq_work_single(void *arg); -+ -+void arch_irq_work_raise(void); -+ - #else - static inline bool irq_work_needs_cpu(void) { return false; } - static inline void irq_work_run(void) { } --- -2.43.2 - -From fc8b79112128911d5b6b96dc94fee0909911ae72 Mon Sep 17 00:00:00 2001 -From: Arnd Bergmann <arnd@arndb.de> -Date: Wed, 8 Nov 2023 13:58:30 +0100 -Subject: [PATCH 1065/1501] arch: fix asm-offsets.c building with - -Wmissing-prototypes -Content-Length: 5636 -Lines: 190 - -[ Upstream commit 4d86896793dd6eeacdf32b85af1ef130349db4be ] - -When -Wmissing-prototypes is enabled, the some asm-offsets.c files fail -to build, even when this warning is disabled in the Makefile for normal -files: - -arch/sparc/kernel/asm-offsets.c:22:5: error: no previous prototype for 'sparc32_foo' [-Werror=missing-prototypes] -arch/sparc/kernel/asm-offsets.c:48:5: error: no previous prototype for 'foo' [-Werror=missing-prototypes] - -Address this by making use of the same trick as x86, marking these -functions as 'static __used' to avoid the need for a prototype -by not drop them in dead-code elimination. - -Suggested-by: Masahiro Yamada <masahiroy@kernel.org> -Reviewed-by: Sam Ravnborg <sam@ravnborg.org> -Link: https://lore.kernel.org/lkml/CAK7LNARfEmFk0Du4Hed19eX_G6tUC5wG0zP+L1AyvdpOF4ybXQ@mail.gmail.com/ -Signed-off-by: Arnd Bergmann <arnd@arndb.de> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/alpha/kernel/asm-offsets.c | 2 +- - arch/loongarch/kernel/asm-offsets.c | 26 +++++++++++++------------- - arch/sparc/kernel/asm-offsets.c | 6 +++--- - 3 files changed, 17 insertions(+), 17 deletions(-) - -diff --git a/arch/alpha/kernel/asm-offsets.c b/arch/alpha/kernel/asm-offsets.c -index b121294bee26..bf1eedd27cf7 100644 ---- a/arch/alpha/kernel/asm-offsets.c -+++ b/arch/alpha/kernel/asm-offsets.c -@@ -12,7 +12,7 @@ - #include <linux/kbuild.h> - #include <asm/io.h> - --void foo(void) -+static void __used foo(void) - { - DEFINE(TI_TASK, offsetof(struct thread_info, task)); - DEFINE(TI_FLAGS, offsetof(struct thread_info, flags)); -diff --git a/arch/loongarch/kernel/asm-offsets.c b/arch/loongarch/kernel/asm-offsets.c -index 173fe514fc9e..bee9f7a3108f 100644 ---- a/arch/loongarch/kernel/asm-offsets.c -+++ b/arch/loongarch/kernel/asm-offsets.c -@@ -15,7 +15,7 @@ - #include <asm/processor.h> - #include <asm/ftrace.h> - --void output_ptreg_defines(void) -+static void __used output_ptreg_defines(void) - { - COMMENT("LoongArch pt_regs offsets."); - OFFSET(PT_R0, pt_regs, regs[0]); -@@ -62,7 +62,7 @@ void output_ptreg_defines(void) - BLANK(); - } - --void output_task_defines(void) -+static void __used output_task_defines(void) - { - COMMENT("LoongArch task_struct offsets."); - OFFSET(TASK_STATE, task_struct, __state); -@@ -77,7 +77,7 @@ void output_task_defines(void) - BLANK(); - } - --void output_thread_info_defines(void) -+static void __used output_thread_info_defines(void) - { - COMMENT("LoongArch thread_info offsets."); - OFFSET(TI_TASK, thread_info, task); -@@ -93,7 +93,7 @@ void output_thread_info_defines(void) - BLANK(); - } - --void output_thread_defines(void) -+static void __used output_thread_defines(void) - { - COMMENT("LoongArch specific thread_struct offsets."); - OFFSET(THREAD_REG01, task_struct, thread.reg01); -@@ -129,7 +129,7 @@ void output_thread_defines(void) - BLANK(); - } - --void output_thread_fpu_defines(void) -+static void __used output_thread_fpu_defines(void) - { - OFFSET(THREAD_FPR0, loongarch_fpu, fpr[0]); - OFFSET(THREAD_FPR1, loongarch_fpu, fpr[1]); -@@ -170,7 +170,7 @@ void output_thread_fpu_defines(void) - BLANK(); - } - --void output_thread_lbt_defines(void) -+static void __used output_thread_lbt_defines(void) - { - OFFSET(THREAD_SCR0, loongarch_lbt, scr0); - OFFSET(THREAD_SCR1, loongarch_lbt, scr1); -@@ -180,7 +180,7 @@ void output_thread_lbt_defines(void) - BLANK(); - } - --void output_mm_defines(void) -+static void __used output_mm_defines(void) - { - COMMENT("Size of struct page"); - DEFINE(STRUCT_PAGE_SIZE, sizeof(struct page)); -@@ -212,7 +212,7 @@ void output_mm_defines(void) - BLANK(); - } - --void output_sc_defines(void) -+static void __used output_sc_defines(void) - { - COMMENT("Linux sigcontext offsets."); - OFFSET(SC_REGS, sigcontext, sc_regs); -@@ -220,7 +220,7 @@ void output_sc_defines(void) - BLANK(); - } - --void output_signal_defines(void) -+static void __used output_signal_defines(void) - { - COMMENT("Linux signal numbers."); - DEFINE(_SIGHUP, SIGHUP); -@@ -258,7 +258,7 @@ void output_signal_defines(void) - } - - #ifdef CONFIG_SMP --void output_smpboot_defines(void) -+static void __used output_smpboot_defines(void) - { - COMMENT("Linux smp cpu boot offsets."); - OFFSET(CPU_BOOT_STACK, secondary_data, stack); -@@ -268,7 +268,7 @@ void output_smpboot_defines(void) - #endif - - #ifdef CONFIG_HIBERNATION --void output_pbe_defines(void) -+static void __used output_pbe_defines(void) - { - COMMENT("Linux struct pbe offsets."); - OFFSET(PBE_ADDRESS, pbe, address); -@@ -280,7 +280,7 @@ void output_pbe_defines(void) - #endif - - #ifdef CONFIG_FUNCTION_GRAPH_TRACER --void output_fgraph_ret_regs_defines(void) -+static void __used output_fgraph_ret_regs_defines(void) - { - COMMENT("LoongArch fgraph_ret_regs offsets."); - OFFSET(FGRET_REGS_A0, fgraph_ret_regs, regs[0]); -@@ -291,7 +291,7 @@ void output_fgraph_ret_regs_defines(void) - } - #endif - --void output_kvm_defines(void) -+static void __used output_kvm_defines(void) - { - COMMENT("KVM/LoongArch Specific offsets."); - -diff --git a/arch/sparc/kernel/asm-offsets.c b/arch/sparc/kernel/asm-offsets.c -index 5784f2df489a..3d9b9855dce9 100644 ---- a/arch/sparc/kernel/asm-offsets.c -+++ b/arch/sparc/kernel/asm-offsets.c -@@ -19,14 +19,14 @@ - #include <asm/hibernate.h> - - #ifdef CONFIG_SPARC32 --int sparc32_foo(void) -+static int __used sparc32_foo(void) - { - DEFINE(AOFF_thread_fork_kpsr, - offsetof(struct thread_struct, fork_kpsr)); - return 0; - } - #else --int sparc64_foo(void) -+static int __used sparc64_foo(void) - { - #ifdef CONFIG_HIBERNATION - BLANK(); -@@ -45,7 +45,7 @@ int sparc64_foo(void) - } - #endif - --int foo(void) -+static int __used foo(void) - { - BLANK(); - DEFINE(AOFF_task_thread, offsetof(struct task_struct, thread)); --- -2.43.2 - -From 72125978d7a04acce7142632c67895e9bd0ea8b1 Mon Sep 17 00:00:00 2001 -From: Tony Krowiak <akrowiak@linux.ibm.com> -Date: Wed, 8 Nov 2023 15:11:30 -0500 -Subject: [PATCH 1066/1501] s390/vfio-ap: fix sysfs status attribute for AP - queue devices -Content-Length: 3066 -Lines: 87 - -[ Upstream commit a0d8f4eeb7c4ffaee21702bcc91a09b3988c5b7a ] - -The 'status' attribute for AP queue devices bound to the vfio_ap device -driver displays incorrect status when the mediated device is attached to a -guest, but the queue device is not passed through. In the current -implementation, the status displayed is 'in_use' which is not correct; it -should be 'assigned'. This can happen if one of the queue devices -associated with a given adapter is not bound to the vfio_ap device driver. -For example: - -Queues listed in /sys/bus/ap/drivers/vfio_ap: -14.0005 -14.0006 -14.000d -16.0006 -16.000d - -Queues listed in /sys/devices/vfio_ap/matrix/$UUID/matrix -14.0005 -14.0006 -14.000d -16.0005 -16.0006 -16.000d - -Queues listed in /sys/devices/vfio_ap/matrix/$UUID/guest_matrix -14.0005 -14.0006 -14.000d - -The reason no queues for adapter 0x16 are listed in the guest_matrix is -because queue 16.0005 is not bound to the vfio_ap device driver, so no -queue associated with the adapter is passed through to the guest; -therefore, each queue device for adapter 0x16 should display 'assigned' -instead of 'in_use', because those queues are not in use by a guest, but -only assigned to the mediated device. - -Let's check the AP configuration for the guest to determine whether a -queue device is passed through before displaying a status of 'in_use'. - -Signed-off-by: Tony Krowiak <akrowiak@linux.ibm.com> -Acked-by: Halil Pasic <pasic@linux.ibm.com> -Acked-by: Harald Freudenberger <freude@linux.ibm.com> -Link: https://lore.kernel.org/r/20231108201135.351419-1-akrowiak@linux.ibm.com -Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/s390/crypto/vfio_ap_ops.c | 16 +++++++++++++++- - 1 file changed, 15 insertions(+), 1 deletion(-) - -diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c -index 88f41f95cc94..d6ea2fd4c2a0 100644 ---- a/drivers/s390/crypto/vfio_ap_ops.c -+++ b/drivers/s390/crypto/vfio_ap_ops.c -@@ -2044,6 +2044,7 @@ static ssize_t status_show(struct device *dev, - { - ssize_t nchars = 0; - struct vfio_ap_queue *q; -+ unsigned long apid, apqi; - struct ap_matrix_mdev *matrix_mdev; - struct ap_device *apdev = to_ap_dev(dev); - -@@ -2051,8 +2052,21 @@ static ssize_t status_show(struct device *dev, - q = dev_get_drvdata(&apdev->device); - matrix_mdev = vfio_ap_mdev_for_queue(q); - -+ /* If the queue is assigned to the matrix mediated device, then -+ * determine whether it is passed through to a guest; otherwise, -+ * indicate that it is unassigned. -+ */ - if (matrix_mdev) { -- if (matrix_mdev->kvm) -+ apid = AP_QID_CARD(q->apqn); -+ apqi = AP_QID_QUEUE(q->apqn); -+ /* -+ * If the queue is passed through to the guest, then indicate -+ * that it is in use; otherwise, indicate that it is -+ * merely assigned to a matrix mediated device. -+ */ -+ if (matrix_mdev->kvm && -+ test_bit_inv(apid, matrix_mdev->shadow_apcb.apm) && -+ test_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm)) - nchars = scnprintf(buf, PAGE_SIZE, "%s\n", - AP_QUEUE_IN_USE); - else --- -2.43.2 - -From bdce67df7f12fb0409fbc604ce7c4254703f56d4 Mon Sep 17 00:00:00 2001 -From: Heiko Carstens <hca@linux.ibm.com> -Date: Thu, 30 Nov 2023 18:55:59 +0100 -Subject: [PATCH 1067/1501] s390/ptrace: handle setting of fpc register - correctly -Content-Length: 2298 -Lines: 63 - -[ Upstream commit 8b13601d19c541158a6e18b278c00ba69ae37829 ] - -If the content of the floating point control (fpc) register of a traced -process is modified with the ptrace interface the new value is tested for -validity by temporarily loading it into the fpc register. - -This may lead to corruption of the fpc register of the tracing process: -if an interrupt happens while the value is temporarily loaded into the -fpc register, and within interrupt context floating point or vector -registers are used, the current fp/vx registers are saved with -save_fpu_regs() assuming they belong to user space and will be loaded into -fp/vx registers when returning to user space. - -test_fp_ctl() restores the original user space fpc register value, however -it will be discarded, when returning to user space. - -In result the tracer will incorrectly continue to run with the value that -was supposed to be used for the traced process. - -Fix this by saving fpu register contents with save_fpu_regs() before using -test_fp_ctl(). - -Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> -Signed-off-by: Heiko Carstens <hca@linux.ibm.com> -Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/s390/kernel/ptrace.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c -index 046403471c5d..c7ed302a6b59 100644 ---- a/arch/s390/kernel/ptrace.c -+++ b/arch/s390/kernel/ptrace.c -@@ -392,6 +392,7 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data) - /* - * floating point control reg. is in the thread structure - */ -+ save_fpu_regs(); - if ((unsigned int) data != 0 || - test_fp_ctl(data >> (BITS_PER_LONG - 32))) - return -EINVAL; -@@ -748,6 +749,7 @@ static int __poke_user_compat(struct task_struct *child, - /* - * floating point control reg. is in the thread structure - */ -+ save_fpu_regs(); - if (test_fp_ctl(tmp)) - return -EINVAL; - child->thread.fpu.fpc = data; -@@ -911,9 +913,7 @@ static int s390_fpregs_set(struct task_struct *target, - int rc = 0; - freg_t fprs[__NUM_FPRS]; - -- if (target == current) -- save_fpu_regs(); -- -+ save_fpu_regs(); - if (MACHINE_HAS_VX) - convert_vx_to_fp(fprs, target->thread.fpu.vxrs); - else --- -2.43.2 - -From 2823db0010c400e4b2b12d02aa5d0d3ecb15d7c7 Mon Sep 17 00:00:00 2001 -From: Heiko Carstens <hca@linux.ibm.com> -Date: Thu, 30 Nov 2023 18:56:00 +0100 -Subject: [PATCH 1068/1501] KVM: s390: fix setting of fpc register -Content-Length: 2454 -Lines: 62 - -[ Upstream commit b988b1bb0053c0dcd26187d29ef07566a565cf55 ] - -kvm_arch_vcpu_ioctl_set_fpu() allows to set the floating point control -(fpc) register of a guest cpu. The new value is tested for validity by -temporarily loading it into the fpc register. - -This may lead to corruption of the fpc register of the host process: -if an interrupt happens while the value is temporarily loaded into the fpc -register, and within interrupt context floating point or vector registers -are used, the current fp/vx registers are saved with save_fpu_regs() -assuming they belong to user space and will be loaded into fp/vx registers -when returning to user space. - -test_fp_ctl() restores the original user space / host process fpc register -value, however it will be discarded, when returning to user space. - -In result the host process will incorrectly continue to run with the value -that was supposed to be used for a guest cpu. - -Fix this by simply removing the test. There is another test right before -the SIE context is entered which will handles invalid values. - -This results in a change of behaviour: invalid values will now be accepted -instead of that the ioctl fails with -EINVAL. This seems to be acceptable, -given that this interface is most likely not used anymore, and this is in -addition the same behaviour implemented with the memory mapped interface -(replace invalid values with zero) - see sync_regs() in kvm-s390.c. - -Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> -Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> -Signed-off-by: Heiko Carstens <hca@linux.ibm.com> -Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/s390/kvm/kvm-s390.c | 5 ----- - 1 file changed, 5 deletions(-) - -diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c -index 7aa0e668488f..16e32174807f 100644 ---- a/arch/s390/kvm/kvm-s390.c -+++ b/arch/s390/kvm/kvm-s390.c -@@ -4316,10 +4316,6 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu) - - vcpu_load(vcpu); - -- if (test_fp_ctl(fpu->fpc)) { -- ret = -EINVAL; -- goto out; -- } - vcpu->run->s.regs.fpc = fpu->fpc; - if (MACHINE_HAS_VX) - convert_fp_to_vx((__vector128 *) vcpu->run->s.regs.vrs, -@@ -4327,7 +4323,6 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu) - else - memcpy(vcpu->run->s.regs.fprs, &fpu->fprs, sizeof(fpu->fprs)); - --out: - vcpu_put(vcpu); - return ret; - } --- -2.43.2 - -From 2ae7081bc10123b187e36a4f3a8e53768de31489 Mon Sep 17 00:00:00 2001 -From: Joel Granados <j.granados@samsung.com> -Date: Tue, 21 Nov 2023 12:02:18 +0100 -Subject: [PATCH 1069/1501] sysctl: Fix out of bounds access for empty sysctl - registers -Content-Length: 2277 -Lines: 59 - -[ Upstream commit 315552310c7de92baea4e570967066569937a843 ] - -When registering tables to the sysctl subsystem there is a check to see -if header is a permanently empty directory (used for mounts). This check -evaluates the first element of the ctl_table. This results in an out of -bounds evaluation when registering empty directories. - -The function register_sysctl_mount_point now passes a ctl_table of size -1 instead of size 0. It now relies solely on the type to identify -a permanently empty register. - -Make sure that the ctl_table has at least one element before testing for -permanent emptiness. - -Signed-off-by: Joel Granados <j.granados@samsung.com> -Reported-by: kernel test robot <oliver.sang@intel.com> -Closes: https://lore.kernel.org/oe-lkp/202311201431.57aae8f3-oliver.sang@intel.com -Signed-off-by: Luis Chamberlain <mcgrof@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/proc/proc_sysctl.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - -diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c -index 8064ea76f80b..84abf98340a0 100644 ---- a/fs/proc/proc_sysctl.c -+++ b/fs/proc/proc_sysctl.c -@@ -44,7 +44,7 @@ static struct ctl_table sysctl_mount_point[] = { - */ - struct ctl_table_header *register_sysctl_mount_point(const char *path) - { -- return register_sysctl_sz(path, sysctl_mount_point, 0); -+ return register_sysctl(path, sysctl_mount_point); - } - EXPORT_SYMBOL(register_sysctl_mount_point); - -@@ -233,7 +233,8 @@ static int insert_header(struct ctl_dir *dir, struct ctl_table_header *header) - return -EROFS; - - /* Am I creating a permanently empty directory? */ -- if (sysctl_is_perm_empty_ctl_table(header->ctl_table)) { -+ if (header->ctl_table_size > 0 && -+ sysctl_is_perm_empty_ctl_table(header->ctl_table)) { - if (!RB_EMPTY_ROOT(&dir->root)) - return -EINVAL; - sysctl_set_perm_empty_ctl_header(dir_h); -@@ -1213,6 +1214,10 @@ static bool get_links(struct ctl_dir *dir, - struct ctl_table_header *tmp_head; - struct ctl_table *entry, *link; - -+ if (header->ctl_table_size == 0 || -+ sysctl_is_perm_empty_ctl_table(header->ctl_table)) -+ return true; -+ - /* Are there links available for every entry in table? */ - list_for_each_table_entry(entry, header) { - const char *procname = entry->procname; --- -2.43.2 - -From 8f860c8407470baff2beb9982ad6b172c94f1d0a Mon Sep 17 00:00:00 2001 -From: Anna Schumaker <Anna.Schumaker@Netapp.com> -Date: Mon, 27 Nov 2023 17:06:18 -0500 -Subject: [PATCH 1070/1501] SUNRPC: Fix a suspicious RCU usage warning -Content-Length: 5743 -Lines: 113 - -[ Upstream commit 31b62908693c90d4d07db597e685d9f25a120073 ] - -I received the following warning while running cthon against an ontap -server running pNFS: - -[ 57.202521] ============================= -[ 57.202522] WARNING: suspicious RCU usage -[ 57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted -[ 57.202525] ----------------------------- -[ 57.202525] net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!! -[ 57.202527] - other info that might help us debug this: - -[ 57.202528] - rcu_scheduler_active = 2, debug_locks = 1 -[ 57.202529] no locks held by test5/3567. -[ 57.202530] - stack backtrace: -[ 57.202532] CPU: 0 PID: 3567 Comm: test5 Not tainted 6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e -[ 57.202534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 2/2/2022 -[ 57.202536] Call Trace: -[ 57.202537] <TASK> -[ 57.202540] dump_stack_lvl+0x77/0xb0 -[ 57.202551] lockdep_rcu_suspicious+0x154/0x1a0 -[ 57.202556] rpc_xprt_switch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] -[ 57.202596] rpc_clnt_setup_test_and_add_xprt+0x50/0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] -[ 57.202621] ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] -[ 57.202646] rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] -[ 57.202671] ? __pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] -[ 57.202696] nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] -[ 57.202728] ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] -[ 57.202754] nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a] -[ 57.202760] filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a] -[ 57.202765] pnfs_generic_pg_writepages+0xbe/0x230 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] -[ 57.202788] __nfs_pageio_add_request+0x3fd/0x520 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] -[ 57.202813] nfs_pageio_add_request+0x18b/0x390 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] -[ 57.202831] nfs_do_writepage+0x116/0x1e0 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] -[ 57.202849] nfs_writepages_callback+0x13/0x30 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] -[ 57.202866] write_cache_pages+0x265/0x450 -[ 57.202870] ? __pfx_nfs_writepages_callback+0x10/0x10 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] -[ 57.202891] nfs_writepages+0x141/0x230 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] -[ 57.202913] do_writepages+0xd2/0x230 -[ 57.202917] ? filemap_fdatawrite_wbc+0x5c/0x80 -[ 57.202921] filemap_fdatawrite_wbc+0x67/0x80 -[ 57.202924] filemap_write_and_wait_range+0xd9/0x170 -[ 57.202930] nfs_wb_all+0x49/0x180 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] -[ 57.202947] nfs4_file_flush+0x72/0xb0 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] -[ 57.202969] __se_sys_close+0x46/0xd0 -[ 57.202972] do_syscall_64+0x68/0x100 -[ 57.202975] ? do_syscall_64+0x77/0x100 -[ 57.202976] ? do_syscall_64+0x77/0x100 -[ 57.202979] entry_SYSCALL_64_after_hwframe+0x6e/0x76 -[ 57.202982] RIP: 0033:0x7fe2b12e4a94 -[ 57.202985] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d d5 18 0e 00 00 74 13 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 44 c3 0f 1f 00 48 83 ec 18 89 7c 24 0c e8 c3 -[ 57.202987] RSP: 002b:00007ffe857ddb38 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 -[ 57.202989] RAX: ffffffffffffffda RBX: 00007ffe857dfd68 RCX: 00007fe2b12e4a94 -[ 57.202991] RDX: 0000000000002000 RSI: 00007ffe857ddc40 RDI: 0000000000000003 -[ 57.202992] RBP: 00007ffe857dfc50 R08: 7fffffffffffffff R09: 0000000065650f49 -[ 57.202993] R10: 00007fe2b11f8300 R11: 0000000000000202 R12: 0000000000000000 -[ 57.202994] R13: 00007ffe857dfd80 R14: 00007fe2b1445000 R15: 0000000000000000 -[ 57.202999] </TASK> - -The problem seems to be that two out of three callers aren't taking the -rcu_read_lock() before calling the list_for_each_entry_rcu() function in -rpc_xprt_switch_has_addr(). I fix this by having -rpc_xprt_switch_has_addr() unconditionaly take the rcu_read_lock(), -which is okay to do recursively in the case that the lock has already -been taken by a caller. - -Reviewed-by: Jeff Layton <jlayton@kernel.org> -Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/sunrpc/xprtmultipath.c | 17 +++++++++++++++-- - 1 file changed, 15 insertions(+), 2 deletions(-) - -diff --git a/net/sunrpc/xprtmultipath.c b/net/sunrpc/xprtmultipath.c -index 74ee2271251e..720d3ba742ec 100644 ---- a/net/sunrpc/xprtmultipath.c -+++ b/net/sunrpc/xprtmultipath.c -@@ -336,8 +336,9 @@ struct rpc_xprt *xprt_iter_current_entry_offline(struct rpc_xprt_iter *xpi) - xprt_switch_find_current_entry_offline); - } - --bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps, -- const struct sockaddr *sap) -+static -+bool __rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps, -+ const struct sockaddr *sap) - { - struct list_head *head; - struct rpc_xprt *pos; -@@ -356,6 +357,18 @@ bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps, - return false; - } - -+bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps, -+ const struct sockaddr *sap) -+{ -+ bool res; -+ -+ rcu_read_lock(); -+ res = __rpc_xprt_switch_has_addr(xps, sap); -+ rcu_read_unlock(); -+ -+ return res; -+} -+ - static - struct rpc_xprt *xprt_switch_find_next_entry(struct list_head *head, - const struct rpc_xprt *cur, bool check_active) --- -2.43.2 - -From aafac00a0423531d6a1417ecfe780c28b8214500 Mon Sep 17 00:00:00 2001 -From: Ojaswin Mujoo <ojaswin@linux.ibm.com> -Date: Wed, 1 Nov 2023 22:08:10 +0530 -Subject: [PATCH 1071/1501] ext4: treat end of range as exclusive in - ext4_zero_range() -Content-Length: 1622 -Lines: 40 - -[ Upstream commit 92573369144f40397e8514440afdf59f24905b40 ] - -The call to filemap_write_and_wait_range() assumes the range passed to be -inclusive, so fix the call to make sure we follow that. - -Signed-off-by: Ojaswin Mujoo <ojaswin@linux.ibm.com> -Reviewed-by: Jan Kara <jack@suse.cz> -Link: https://lore.kernel.org/r/e503107a7c73a2b68dec645c5ad798c437717c45.1698856309.git.ojaswin@linux.ibm.com -Signed-off-by: Theodore Ts'o <tytso@mit.edu> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/ext4/extents.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index d5efe076d3d3..01299b55a567 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -4523,7 +4523,8 @@ static long ext4_zero_range(struct file *file, loff_t offset, - * Round up offset. This is not fallocate, we need to zero out - * blocks, so convert interior block aligned part of the range to - * unwritten and possibly manually zero out unaligned parts of the -- * range. -+ * range. Here, start and partial_begin are inclusive, end and -+ * partial_end are exclusive. - */ - start = round_up(offset, 1 << blkbits); - end = round_down((offset + len), 1 << blkbits); -@@ -4609,7 +4610,8 @@ static long ext4_zero_range(struct file *file, loff_t offset, - * disk in case of crash before zeroing trans is committed. - */ - if (ext4_should_journal_data(inode)) { -- ret = filemap_write_and_wait_range(mapping, start, end); -+ ret = filemap_write_and_wait_range(mapping, start, -+ end - 1); - if (ret) { - filemap_invalidate_unlock(mapping); - goto out_mutex; --- -2.43.2 - -From c699a983def5d6a7c3ac16d16bd831d37934a86f Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara <pc@manguebit.com> -Date: Sat, 25 Nov 2023 23:55:06 -0300 -Subject: [PATCH 1072/1501] smb: client: fix renaming of reparse points -Content-Length: 8030 -Lines: 207 - -[ Upstream commit 7435d51b7ea2ab7801279c43ecd72063e9d5c92f ] - -The client was sending an SMB2_CREATE request without setting -OPEN_REPARSE_POINT flag thus failing the entire rename operation. - -Fix this by setting OPEN_REPARSE_POINT in create options for -SMB2_CREATE request when the source inode is a repase point. - -Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com> -Signed-off-by: Steve French <stfrench@microsoft.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/smb/client/cifsglob.h | 22 +++++++++++++++++----- - fs/smb/client/cifsproto.h | 7 ++++--- - fs/smb/client/cifssmb.c | 8 ++++---- - fs/smb/client/inode.c | 3 ++- - fs/smb/client/smb2inode.c | 38 +++++++++++++++++++++++--------------- - fs/smb/client/smb2proto.h | 8 +++++--- - 6 files changed, 55 insertions(+), 31 deletions(-) - -diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h -index 5e32c79f03a7..4d07b96038d8 100644 ---- a/fs/smb/client/cifsglob.h -+++ b/fs/smb/client/cifsglob.h -@@ -205,9 +205,18 @@ struct cifs_open_info_data { - }; - }; - --#define cifs_open_data_reparse(d) \ -- ((d)->reparse_point || \ -- (le32_to_cpu((d)->fi.Attributes) & ATTR_REPARSE)) -+static inline bool cifs_open_data_reparse(struct cifs_open_info_data *data) -+{ -+ struct smb2_file_all_info *fi = &data->fi; -+ u32 attrs = le32_to_cpu(fi->Attributes); -+ bool ret; -+ -+ ret = data->reparse_point || (attrs & ATTR_REPARSE); -+ if (ret) -+ attrs |= ATTR_REPARSE; -+ fi->Attributes = cpu_to_le32(attrs); -+ return ret; -+} - - static inline void cifs_free_open_info(struct cifs_open_info_data *data) - { -@@ -390,8 +399,11 @@ struct smb_version_operations { - int (*rename_pending_delete)(const char *, struct dentry *, - const unsigned int); - /* send rename request */ -- int (*rename)(const unsigned int, struct cifs_tcon *, const char *, -- const char *, struct cifs_sb_info *); -+ int (*rename)(const unsigned int xid, -+ struct cifs_tcon *tcon, -+ struct dentry *source_dentry, -+ const char *from_name, const char *to_name, -+ struct cifs_sb_info *cifs_sb); - /* send create hardlink request */ - int (*create_hardlink)(const unsigned int, struct cifs_tcon *, - const char *, const char *, -diff --git a/fs/smb/client/cifsproto.h b/fs/smb/client/cifsproto.h -index 46feaa0880bd..5af921b400d7 100644 ---- a/fs/smb/client/cifsproto.h -+++ b/fs/smb/client/cifsproto.h -@@ -435,9 +435,10 @@ extern int CIFSPOSIXDelFile(const unsigned int xid, struct cifs_tcon *tcon, - int remap_special_chars); - extern int CIFSSMBDelFile(const unsigned int xid, struct cifs_tcon *tcon, - const char *name, struct cifs_sb_info *cifs_sb); --extern int CIFSSMBRename(const unsigned int xid, struct cifs_tcon *tcon, -- const char *from_name, const char *to_name, -- struct cifs_sb_info *cifs_sb); -+int CIFSSMBRename(const unsigned int xid, struct cifs_tcon *tcon, -+ struct dentry *source_dentry, -+ const char *from_name, const char *to_name, -+ struct cifs_sb_info *cifs_sb); - extern int CIFSSMBRenameOpenFile(const unsigned int xid, struct cifs_tcon *tcon, - int netfid, const char *target_name, - const struct nls_table *nls_codepage, -diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c -index 9ee348e6d106..5bdea01919e8 100644 ---- a/fs/smb/client/cifssmb.c -+++ b/fs/smb/client/cifssmb.c -@@ -2149,10 +2149,10 @@ CIFSSMBFlush(const unsigned int xid, struct cifs_tcon *tcon, int smb_file_id) - return rc; - } - --int --CIFSSMBRename(const unsigned int xid, struct cifs_tcon *tcon, -- const char *from_name, const char *to_name, -- struct cifs_sb_info *cifs_sb) -+int CIFSSMBRename(const unsigned int xid, struct cifs_tcon *tcon, -+ struct dentry *source_dentry, -+ const char *from_name, const char *to_name, -+ struct cifs_sb_info *cifs_sb) - { - int rc = 0; - RENAME_REQ *pSMB = NULL; -diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c -index 09c5c0f5c96e..eb54e4893777 100644 ---- a/fs/smb/client/inode.c -+++ b/fs/smb/client/inode.c -@@ -2219,7 +2219,8 @@ cifs_do_rename(const unsigned int xid, struct dentry *from_dentry, - return -ENOSYS; - - /* try path-based rename first */ -- rc = server->ops->rename(xid, tcon, from_path, to_path, cifs_sb); -+ rc = server->ops->rename(xid, tcon, from_dentry, -+ from_path, to_path, cifs_sb); - - /* - * Don't bother with rename by filehandle unless file is busy and -diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c -index c94940af5d4b..c3e28673e0cd 100644 ---- a/fs/smb/client/smb2inode.c -+++ b/fs/smb/client/smb2inode.c -@@ -781,11 +781,11 @@ smb2_unlink(const unsigned int xid, struct cifs_tcon *tcon, const char *name, - ACL_NO_MODE, NULL, SMB2_OP_DELETE, NULL, NULL, NULL, NULL, NULL); - } - --static int --smb2_set_path_attr(const unsigned int xid, struct cifs_tcon *tcon, -- const char *from_name, const char *to_name, -- struct cifs_sb_info *cifs_sb, __u32 access, int command, -- struct cifsFileInfo *cfile) -+static int smb2_set_path_attr(const unsigned int xid, struct cifs_tcon *tcon, -+ const char *from_name, const char *to_name, -+ struct cifs_sb_info *cifs_sb, -+ __u32 create_options, __u32 access, -+ int command, struct cifsFileInfo *cfile) - { - __le16 *smb2_to_name = NULL; - int rc; -@@ -796,25 +796,33 @@ smb2_set_path_attr(const unsigned int xid, struct cifs_tcon *tcon, - goto smb2_rename_path; - } - rc = smb2_compound_op(xid, tcon, cifs_sb, from_name, access, -- FILE_OPEN, 0, ACL_NO_MODE, smb2_to_name, -+ FILE_OPEN, create_options, ACL_NO_MODE, smb2_to_name, - command, cfile, NULL, NULL, NULL, NULL); - smb2_rename_path: - kfree(smb2_to_name); - return rc; - } - --int --smb2_rename_path(const unsigned int xid, struct cifs_tcon *tcon, -- const char *from_name, const char *to_name, -- struct cifs_sb_info *cifs_sb) -+int smb2_rename_path(const unsigned int xid, -+ struct cifs_tcon *tcon, -+ struct dentry *source_dentry, -+ const char *from_name, const char *to_name, -+ struct cifs_sb_info *cifs_sb) - { -+ struct cifsInodeInfo *ci; - struct cifsFileInfo *cfile; -+ __u32 co = 0; - -+ if (source_dentry) { -+ ci = CIFS_I(d_inode(source_dentry)); -+ if (ci->cifsAttrs & ATTR_REPARSE) -+ co |= OPEN_REPARSE_POINT; -+ } - drop_cached_dir_by_name(xid, tcon, from_name, cifs_sb); - cifs_get_writable_path(tcon, from_name, FIND_WR_WITH_DELETE, &cfile); - -- return smb2_set_path_attr(xid, tcon, from_name, to_name, -- cifs_sb, DELETE, SMB2_OP_RENAME, cfile); -+ return smb2_set_path_attr(xid, tcon, from_name, to_name, cifs_sb, -+ co, DELETE, SMB2_OP_RENAME, cfile); - } - - int -@@ -822,9 +830,9 @@ smb2_create_hardlink(const unsigned int xid, struct cifs_tcon *tcon, - const char *from_name, const char *to_name, - struct cifs_sb_info *cifs_sb) - { -- return smb2_set_path_attr(xid, tcon, from_name, to_name, cifs_sb, -- FILE_READ_ATTRIBUTES, SMB2_OP_HARDLINK, -- NULL); -+ return smb2_set_path_attr(xid, tcon, from_name, to_name, -+ cifs_sb, 0, FILE_READ_ATTRIBUTES, -+ SMB2_OP_HARDLINK, NULL); - } - - int -diff --git a/fs/smb/client/smb2proto.h b/fs/smb/client/smb2proto.h -index 0e371f7e2854..7cbf1a76b42d 100644 ---- a/fs/smb/client/smb2proto.h -+++ b/fs/smb/client/smb2proto.h -@@ -80,9 +80,11 @@ extern int smb2_rmdir(const unsigned int xid, struct cifs_tcon *tcon, - const char *name, struct cifs_sb_info *cifs_sb); - extern int smb2_unlink(const unsigned int xid, struct cifs_tcon *tcon, - const char *name, struct cifs_sb_info *cifs_sb); --extern int smb2_rename_path(const unsigned int xid, struct cifs_tcon *tcon, -- const char *from_name, const char *to_name, -- struct cifs_sb_info *cifs_sb); -+int smb2_rename_path(const unsigned int xid, -+ struct cifs_tcon *tcon, -+ struct dentry *source_dentry, -+ const char *from_name, const char *to_name, -+ struct cifs_sb_info *cifs_sb); - extern int smb2_create_hardlink(const unsigned int xid, struct cifs_tcon *tcon, - const char *from_name, const char *to_name, - struct cifs_sb_info *cifs_sb); --- -2.43.2 - -From d6e541105ccaf05ab0bd694332e0cd8bcd324891 Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara <pc@manguebit.com> -Date: Sat, 25 Nov 2023 23:55:07 -0300 -Subject: [PATCH 1073/1501] smb: client: fix hardlinking of reparse points -Content-Length: 6595 -Lines: 176 - -[ Upstream commit 5408990aa662bcfd6ba894734023a023a16e8729 ] - -The client was sending an SMB2_CREATE request without setting -OPEN_REPARSE_POINT flag thus failing the entire hardlink operation. - -Fix this by setting OPEN_REPARSE_POINT in create options for -SMB2_CREATE request when the source inode is a repase point. - -Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com> -Signed-off-by: Steve French <stfrench@microsoft.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/smb/client/cifsglob.h | 8 +++++--- - fs/smb/client/cifsproto.h | 8 +++++--- - fs/smb/client/cifssmb.c | 9 +++++---- - fs/smb/client/link.c | 4 ++-- - fs/smb/client/smb2inode.c | 33 +++++++++++++++++++++------------ - fs/smb/client/smb2proto.h | 8 +++++--- - 6 files changed, 43 insertions(+), 27 deletions(-) - -diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h -index 4d07b96038d8..942e6ece56b1 100644 ---- a/fs/smb/client/cifsglob.h -+++ b/fs/smb/client/cifsglob.h -@@ -405,9 +405,11 @@ struct smb_version_operations { - const char *from_name, const char *to_name, - struct cifs_sb_info *cifs_sb); - /* send create hardlink request */ -- int (*create_hardlink)(const unsigned int, struct cifs_tcon *, -- const char *, const char *, -- struct cifs_sb_info *); -+ int (*create_hardlink)(const unsigned int xid, -+ struct cifs_tcon *tcon, -+ struct dentry *source_dentry, -+ const char *from_name, const char *to_name, -+ struct cifs_sb_info *cifs_sb); - /* query symlink target */ - int (*query_symlink)(const unsigned int xid, - struct cifs_tcon *tcon, -diff --git a/fs/smb/client/cifsproto.h b/fs/smb/client/cifsproto.h -index 5af921b400d7..9516f5732324 100644 ---- a/fs/smb/client/cifsproto.h -+++ b/fs/smb/client/cifsproto.h -@@ -443,9 +443,11 @@ extern int CIFSSMBRenameOpenFile(const unsigned int xid, struct cifs_tcon *tcon, - int netfid, const char *target_name, - const struct nls_table *nls_codepage, - int remap_special_chars); --extern int CIFSCreateHardLink(const unsigned int xid, struct cifs_tcon *tcon, -- const char *from_name, const char *to_name, -- struct cifs_sb_info *cifs_sb); -+int CIFSCreateHardLink(const unsigned int xid, -+ struct cifs_tcon *tcon, -+ struct dentry *source_dentry, -+ const char *from_name, const char *to_name, -+ struct cifs_sb_info *cifs_sb); - extern int CIFSUnixCreateHardLink(const unsigned int xid, - struct cifs_tcon *tcon, - const char *fromName, const char *toName, -diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c -index 5bdea01919e8..e9e33b0b3ac4 100644 ---- a/fs/smb/client/cifssmb.c -+++ b/fs/smb/client/cifssmb.c -@@ -2530,10 +2530,11 @@ CIFSUnixCreateHardLink(const unsigned int xid, struct cifs_tcon *tcon, - return rc; - } - --int --CIFSCreateHardLink(const unsigned int xid, struct cifs_tcon *tcon, -- const char *from_name, const char *to_name, -- struct cifs_sb_info *cifs_sb) -+int CIFSCreateHardLink(const unsigned int xid, -+ struct cifs_tcon *tcon, -+ struct dentry *source_dentry, -+ const char *from_name, const char *to_name, -+ struct cifs_sb_info *cifs_sb) - { - int rc = 0; - NT_RENAME_REQ *pSMB = NULL; -diff --git a/fs/smb/client/link.c b/fs/smb/client/link.c -index a1da50e66fbb..3ef34218a790 100644 ---- a/fs/smb/client/link.c -+++ b/fs/smb/client/link.c -@@ -510,8 +510,8 @@ cifs_hardlink(struct dentry *old_file, struct inode *inode, - rc = -ENOSYS; - goto cifs_hl_exit; - } -- rc = server->ops->create_hardlink(xid, tcon, from_name, to_name, -- cifs_sb); -+ rc = server->ops->create_hardlink(xid, tcon, old_file, -+ from_name, to_name, cifs_sb); - if ((rc == -EIO) || (rc == -EINVAL)) - rc = -EOPNOTSUPP; - } -diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c -index c3e28673e0cd..6cac0b107a2d 100644 ---- a/fs/smb/client/smb2inode.c -+++ b/fs/smb/client/smb2inode.c -@@ -35,6 +35,18 @@ free_set_inf_compound(struct smb_rqst *rqst) - SMB2_close_free(&rqst[2]); - } - -+static inline __u32 file_create_options(struct dentry *dentry) -+{ -+ struct cifsInodeInfo *ci; -+ -+ if (dentry) { -+ ci = CIFS_I(d_inode(dentry)); -+ if (ci->cifsAttrs & ATTR_REPARSE) -+ return OPEN_REPARSE_POINT; -+ } -+ return 0; -+} -+ - /* - * note: If cfile is passed, the reference to it is dropped here. - * So make sure that you do not reuse cfile after return from this func. -@@ -809,15 +821,9 @@ int smb2_rename_path(const unsigned int xid, - const char *from_name, const char *to_name, - struct cifs_sb_info *cifs_sb) - { -- struct cifsInodeInfo *ci; - struct cifsFileInfo *cfile; -- __u32 co = 0; -+ __u32 co = file_create_options(source_dentry); - -- if (source_dentry) { -- ci = CIFS_I(d_inode(source_dentry)); -- if (ci->cifsAttrs & ATTR_REPARSE) -- co |= OPEN_REPARSE_POINT; -- } - drop_cached_dir_by_name(xid, tcon, from_name, cifs_sb); - cifs_get_writable_path(tcon, from_name, FIND_WR_WITH_DELETE, &cfile); - -@@ -825,13 +831,16 @@ int smb2_rename_path(const unsigned int xid, - co, DELETE, SMB2_OP_RENAME, cfile); - } - --int --smb2_create_hardlink(const unsigned int xid, struct cifs_tcon *tcon, -- const char *from_name, const char *to_name, -- struct cifs_sb_info *cifs_sb) -+int smb2_create_hardlink(const unsigned int xid, -+ struct cifs_tcon *tcon, -+ struct dentry *source_dentry, -+ const char *from_name, const char *to_name, -+ struct cifs_sb_info *cifs_sb) - { -+ __u32 co = file_create_options(source_dentry); -+ - return smb2_set_path_attr(xid, tcon, from_name, to_name, -- cifs_sb, 0, FILE_READ_ATTRIBUTES, -+ cifs_sb, co, FILE_READ_ATTRIBUTES, - SMB2_OP_HARDLINK, NULL); - } - -diff --git a/fs/smb/client/smb2proto.h b/fs/smb/client/smb2proto.h -index 7cbf1a76b42d..a8084ce7fcbd 100644 ---- a/fs/smb/client/smb2proto.h -+++ b/fs/smb/client/smb2proto.h -@@ -85,9 +85,11 @@ int smb2_rename_path(const unsigned int xid, - struct dentry *source_dentry, - const char *from_name, const char *to_name, - struct cifs_sb_info *cifs_sb); --extern int smb2_create_hardlink(const unsigned int xid, struct cifs_tcon *tcon, -- const char *from_name, const char *to_name, -- struct cifs_sb_info *cifs_sb); -+int smb2_create_hardlink(const unsigned int xid, -+ struct cifs_tcon *tcon, -+ struct dentry *source_dentry, -+ const char *from_name, const char *to_name, -+ struct cifs_sb_info *cifs_sb); - extern int smb3_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, - struct cifs_sb_info *cifs_sb, const unsigned char *path, - char *pbuf, unsigned int *pbytes_written); --- -2.43.2 - -From 3fee2dd3a30ee7b23b3ca741ca02b416877d6e8f Mon Sep 17 00:00:00 2001 -From: Shyam Prasad N <sprasad@microsoft.com> -Date: Fri, 29 Dec 2023 11:16:18 +0000 -Subject: [PATCH 1074/1501] cifs: fix in logging in cifs_chan_update_iface -Content-Length: 1691 -Lines: 51 - -[ Upstream commit 516eea97f92f1e7271f20835cfe9e73774b0f8cc ] - -Recently, cifs_chan_update_iface was modified to not -remove an iface if a suitable replacement was not found. -With that, there were two conditionals that were exactly -the same. This change removes that extra condition check. - -Also, fixed a logging in the same function to indicate -the correct message. - -Signed-off-by: Shyam Prasad N <sprasad@microsoft.com> -Signed-off-by: Steve French <stfrench@microsoft.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/smb/client/sess.c | 14 ++++++++------ - 1 file changed, 8 insertions(+), 6 deletions(-) - -diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c -index 2d3b332a79a1..a16e175731eb 100644 ---- a/fs/smb/client/sess.c -+++ b/fs/smb/client/sess.c -@@ -440,8 +440,14 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) - } - - if (!iface) { -- cifs_dbg(FYI, "unable to get the interface matching: %pIS\n", -- &ss); -+ if (!chan_index) -+ cifs_dbg(FYI, "unable to get the interface matching: %pIS\n", -+ &ss); -+ else { -+ cifs_dbg(FYI, "unable to find another interface to replace: %pIS\n", -+ &old_iface->sockaddr); -+ } -+ - spin_unlock(&ses->iface_lock); - return 0; - } -@@ -459,10 +465,6 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) - iface->weight_fulfilled++; - - kref_put(&old_iface->refcount, release_iface); -- } else if (old_iface) { -- /* if a new candidate is not found, keep things as is */ -- cifs_dbg(FYI, "could not replace iface: %pIS\n", -- &old_iface->sockaddr); - } else if (!chan_index) { - /* special case: update interface for primary channel */ - if (iface) { --- -2.43.2 - -From 69a23d44008aa0b85773d82c9b00993685738cd7 Mon Sep 17 00:00:00 2001 -From: Gabriel Krisman Bertazi <krisman@suse.de> -Date: Fri, 11 Aug 2023 14:38:12 -0400 -Subject: [PATCH 1075/1501] ecryptfs: Reject casefold directory inodes -Content-Length: 1362 -Lines: 38 - -[ Upstream commit cd72c7ef5fed44272272a105b1da22810c91be69 ] - -Even though it seems to be able to resolve some names of -case-insensitive directories, the lack of d_hash and d_compare means we -end up with a broken state in the d_cache. Considering it was never a -goal to support these two together, and we are preparing to use -d_revalidate in case-insensitive filesystems, which would make the -combination even more broken, reject any attempt to get a casefolded -inode from ecryptfs. - -Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de> -Reviewed-by: Eric Biggers <ebiggers@google.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/ecryptfs/inode.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c -index b0e8774c435a..d7193687b9b4 100644 ---- a/fs/ecryptfs/inode.c -+++ b/fs/ecryptfs/inode.c -@@ -78,6 +78,14 @@ static struct inode *__ecryptfs_get_inode(struct inode *lower_inode, - - if (lower_inode->i_sb != ecryptfs_superblock_to_lower(sb)) - return ERR_PTR(-EXDEV); -+ -+ /* Reject dealing with casefold directories. */ -+ if (IS_CASEFOLDED(lower_inode)) { -+ pr_err_ratelimited("%s: Can't handle casefolded directory.\n", -+ __func__); -+ return ERR_PTR(-EREMOTE); -+ } -+ - if (!igrab(lower_inode)) - return ERR_PTR(-ESTALE); - inode = iget5_locked(sb, (unsigned long)lower_inode, --- -2.43.2 - -From e623f147c8525199878cfacf9de7a0aac8d8fa0d Mon Sep 17 00:00:00 2001 -From: Ye Bin <yebin10@huawei.com> -Date: Sat, 16 Dec 2023 09:09:19 +0800 -Subject: [PATCH 1076/1501] ext4: fix inconsistent between segment fstrim and - full fstrim -Content-Length: 2330 -Lines: 58 - -[ Upstream commit 68da4c44b994aea797eb9821acb3a4a36015293e ] - -Suppose we issue two FITRIM ioctls for ranges [0,15] and [16,31] with -mininum length of trimmed range set to 8 blocks. If we have say a range of -blocks 10-22 free, this range will not be trimmed because it straddles the -boundary of the two FITRIM ranges and neither part is big enough. This is a -bit surprising to some users that call FITRIM on smaller ranges of blocks -to limit impact on the system. Also XFS trims all free space extents that -overlap with the specified range so we are inconsistent among filesystems. -Let's change ext4_try_to_trim_range() to consider for trimming the whole -free space extent that straddles the end of specified range, not just the -part of it within the range. - -Signed-off-by: Ye Bin <yebin10@huawei.com> -Reviewed-by: Jan Kara <jack@suse.cz> -Link: https://lore.kernel.org/r/20231216010919.1995851-1-yebin10@huawei.com -Signed-off-by: Theodore Ts'o <tytso@mit.edu> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/ext4/mballoc.c | 11 ++++++++--- - 1 file changed, 8 insertions(+), 3 deletions(-) - -diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index ab023d709f72..8408318e1d32 100644 ---- a/fs/ext4/mballoc.c -+++ b/fs/ext4/mballoc.c -@@ -6758,13 +6758,15 @@ static int ext4_try_to_trim_range(struct super_block *sb, - __acquires(ext4_group_lock_ptr(sb, e4b->bd_group)) - __releases(ext4_group_lock_ptr(sb, e4b->bd_group)) - { -- ext4_grpblk_t next, count, free_count; -+ ext4_grpblk_t next, count, free_count, last, origin_start; - bool set_trimmed = false; - void *bitmap; - -+ last = ext4_last_grp_cluster(sb, e4b->bd_group); - bitmap = e4b->bd_bitmap; -- if (start == 0 && max >= ext4_last_grp_cluster(sb, e4b->bd_group)) -+ if (start == 0 && max >= last) - set_trimmed = true; -+ origin_start = start; - start = max(e4b->bd_info->bb_first_free, start); - count = 0; - free_count = 0; -@@ -6773,7 +6775,10 @@ __releases(ext4_group_lock_ptr(sb, e4b->bd_group)) - start = mb_find_next_zero_bit(bitmap, max + 1, start); - if (start > max) - break; -- next = mb_find_next_bit(bitmap, max + 1, start); -+ -+ next = mb_find_next_bit(bitmap, last + 1, start); -+ if (origin_start == 0 && next >= last) -+ set_trimmed = true; - - if ((next - start) >= minblocks) { - int ret = ext4_trim_extent(sb, start, next - start, e4b); --- -2.43.2 - -From 3ea824b924b908cb79caea4e732e646332f8ae35 Mon Sep 17 00:00:00 2001 -From: Baokun Li <libaokun1@huawei.com> -Date: Mon, 23 Oct 2023 09:30:54 +0800 -Subject: [PATCH 1077/1501] ext4: unify the type of flexbg_size to unsigned int -Content-Length: 3311 -Lines: 82 - -[ Upstream commit 658a52344fb139f9531e7543a6e0015b630feb38 ] - -The maximum value of flexbg_size is 2^31, but the maximum value of int -is (2^31 - 1), so overflow may occur when the type of flexbg_size is -declared as int. - -For example, when uninit_mask is initialized in ext4_alloc_group_tables(), -if flexbg_size == 2^31, the initialized uninit_mask is incorrect, and this -may causes set_flexbg_block_bitmap() to trigger a BUG_ON(). - -Therefore, the flexbg_size type is declared as unsigned int to avoid -overflow and memory waste. - -Signed-off-by: Baokun Li <libaokun1@huawei.com> -Reviewed-by: Jan Kara <jack@suse.cz> -Link: https://lore.kernel.org/r/20231023013057.2117948-2-libaokun1@huawei.com -Signed-off-by: Theodore Ts'o <tytso@mit.edu> -Stable-dep-of: 5d1935ac02ca ("ext4: avoid online resizing failures due to oversized flex bg") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/ext4/resize.c | 13 +++++++------ - 1 file changed, 7 insertions(+), 6 deletions(-) - -diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c -index 4fe061edefdd..c6d4539d4c1f 100644 ---- a/fs/ext4/resize.c -+++ b/fs/ext4/resize.c -@@ -228,7 +228,7 @@ struct ext4_new_flex_group_data { - * - * Returns NULL on failure otherwise address of the allocated structure. - */ --static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned long flexbg_size) -+static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned int flexbg_size) - { - struct ext4_new_flex_group_data *flex_gd; - -@@ -283,7 +283,7 @@ static void free_flex_gd(struct ext4_new_flex_group_data *flex_gd) - */ - static int ext4_alloc_group_tables(struct super_block *sb, - struct ext4_new_flex_group_data *flex_gd, -- int flexbg_size) -+ unsigned int flexbg_size) - { - struct ext4_new_group_data *group_data = flex_gd->groups; - ext4_fsblk_t start_blk; -@@ -384,12 +384,12 @@ static int ext4_alloc_group_tables(struct super_block *sb, - group = group_data[0].group; - - printk(KERN_DEBUG "EXT4-fs: adding a flex group with " -- "%d groups, flexbg size is %d:\n", flex_gd->count, -+ "%u groups, flexbg size is %u:\n", flex_gd->count, - flexbg_size); - - for (i = 0; i < flex_gd->count; i++) { - ext4_debug( -- "adding %s group %u: %u blocks (%d free, %d mdata blocks)\n", -+ "adding %s group %u: %u blocks (%u free, %u mdata blocks)\n", - ext4_bg_has_super(sb, group + i) ? "normal" : - "no-super", group + i, - group_data[i].blocks_count, -@@ -1606,7 +1606,7 @@ static int ext4_flex_group_add(struct super_block *sb, - static int ext4_setup_next_flex_gd(struct super_block *sb, - struct ext4_new_flex_group_data *flex_gd, - ext4_fsblk_t n_blocks_count, -- unsigned long flexbg_size) -+ unsigned int flexbg_size) - { - struct ext4_sb_info *sbi = EXT4_SB(sb); - struct ext4_super_block *es = sbi->s_es; -@@ -1990,8 +1990,9 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count) - ext4_fsblk_t o_blocks_count; - ext4_fsblk_t n_blocks_count_retry = 0; - unsigned long last_update_time = 0; -- int err = 0, flexbg_size = 1 << sbi->s_log_groups_per_flex; -+ int err = 0; - int meta_bg; -+ unsigned int flexbg_size = ext4_flex_bg_size(sbi); - - /* See if the device is actually as big as what was requested */ - bh = ext4_sb_bread(sb, n_blocks_count - 1, 0); --- -2.43.2 - -From 4b07b03d24ff462ea8e1251a1674c8f85fda56e7 Mon Sep 17 00:00:00 2001 -From: Baokun Li <libaokun1@huawei.com> -Date: Mon, 23 Oct 2023 09:30:55 +0800 -Subject: [PATCH 1078/1501] ext4: remove unnecessary check from alloc_flex_gd() -Content-Length: 1452 -Lines: 37 - -[ Upstream commit b099eb87de105cf07cad731ded6fb40b2675108b ] - -In commit 967ac8af4475 ("ext4: fix potential integer overflow in -alloc_flex_gd()"), an overflow check is added to alloc_flex_gd() to -prevent the allocated memory from being smaller than expected due to -the overflow. However, after kmalloc() is replaced with kmalloc_array() -in commit 6da2ec56059c ("treewide: kmalloc() -> kmalloc_array()"), the -kmalloc_array() function has an overflow check, so the above problem -will not occur. Therefore, the extra check is removed. - -Signed-off-by: Baokun Li <libaokun1@huawei.com> -Reviewed-by: Jan Kara <jack@suse.cz> -Link: https://lore.kernel.org/r/20231023013057.2117948-3-libaokun1@huawei.com -Signed-off-by: Theodore Ts'o <tytso@mit.edu> -Stable-dep-of: 5d1935ac02ca ("ext4: avoid online resizing failures due to oversized flex bg") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/ext4/resize.c | 3 --- - 1 file changed, 3 deletions(-) - -diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c -index c6d4539d4c1f..0a57b199883c 100644 ---- a/fs/ext4/resize.c -+++ b/fs/ext4/resize.c -@@ -236,10 +236,7 @@ static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned int flexbg_size) - if (flex_gd == NULL) - goto out3; - -- if (flexbg_size >= UINT_MAX / sizeof(struct ext4_new_group_data)) -- goto out2; - flex_gd->count = flexbg_size; -- - flex_gd->groups = kmalloc_array(flexbg_size, - sizeof(struct ext4_new_group_data), - GFP_NOFS); --- -2.43.2 - -From dc3e0f55bec4410f3d74352c4a7c79f518088ee2 Mon Sep 17 00:00:00 2001 -From: Baokun Li <libaokun1@huawei.com> -Date: Mon, 23 Oct 2023 09:30:56 +0800 -Subject: [PATCH 1079/1501] ext4: avoid online resizing failures due to - oversized flex bg -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 4393 -Lines: 122 - -[ Upstream commit 5d1935ac02ca5aee364a449a35e2977ea84509b0 ] - -When we online resize an ext4 filesystem with a oversized flexbg_size, - - mkfs.ext4 -F -G 67108864 $dev -b 4096 100M - mount $dev $dir - resize2fs $dev 16G - -the following WARN_ON is triggered: -================================================================== -WARNING: CPU: 0 PID: 427 at mm/page_alloc.c:4402 __alloc_pages+0x411/0x550 -Modules linked in: sg(E) -CPU: 0 PID: 427 Comm: resize2fs Tainted: G E 6.6.0-rc5+ #314 -RIP: 0010:__alloc_pages+0x411/0x550 -Call Trace: - <TASK> - __kmalloc_large_node+0xa2/0x200 - __kmalloc+0x16e/0x290 - ext4_resize_fs+0x481/0xd80 - __ext4_ioctl+0x1616/0x1d90 - ext4_ioctl+0x12/0x20 - __x64_sys_ioctl+0xf0/0x150 - do_syscall_64+0x3b/0x90 -================================================================== - -This is because flexbg_size is too large and the size of the new_group_data -array to be allocated exceeds MAX_ORDER. Currently, the minimum value of -MAX_ORDER is 8, the minimum value of PAGE_SIZE is 4096, the corresponding -maximum number of groups that can be allocated is: - - (PAGE_SIZE << MAX_ORDER) / sizeof(struct ext4_new_group_data) ≈ 21845 - -And the value that is down-aligned to the power of 2 is 16384. Therefore, -this value is defined as MAX_RESIZE_BG, and the number of groups added -each time does not exceed this value during resizing, and is added multiple -times to complete the online resizing. The difference is that the metadata -in a flex_bg may be more dispersed. - -Signed-off-by: Baokun Li <libaokun1@huawei.com> -Reviewed-by: Jan Kara <jack@suse.cz> -Link: https://lore.kernel.org/r/20231023013057.2117948-4-libaokun1@huawei.com -Signed-off-by: Theodore Ts'o <tytso@mit.edu> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/ext4/resize.c | 25 +++++++++++++++++-------- - 1 file changed, 17 insertions(+), 8 deletions(-) - -diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c -index 0a57b199883c..e168a9f59600 100644 ---- a/fs/ext4/resize.c -+++ b/fs/ext4/resize.c -@@ -218,10 +218,17 @@ struct ext4_new_flex_group_data { - in the flex group */ - __u16 *bg_flags; /* block group flags of groups - in @groups */ -+ ext4_group_t resize_bg; /* number of allocated -+ new_group_data */ - ext4_group_t count; /* number of groups in @groups - */ - }; - -+/* -+ * Avoiding memory allocation failures due to too many groups added each time. -+ */ -+#define MAX_RESIZE_BG 16384 -+ - /* - * alloc_flex_gd() allocates a ext4_new_flex_group_data with size of - * @flexbg_size. -@@ -236,14 +243,18 @@ static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned int flexbg_size) - if (flex_gd == NULL) - goto out3; - -- flex_gd->count = flexbg_size; -- flex_gd->groups = kmalloc_array(flexbg_size, -+ if (unlikely(flexbg_size > MAX_RESIZE_BG)) -+ flex_gd->resize_bg = MAX_RESIZE_BG; -+ else -+ flex_gd->resize_bg = flexbg_size; -+ -+ flex_gd->groups = kmalloc_array(flex_gd->resize_bg, - sizeof(struct ext4_new_group_data), - GFP_NOFS); - if (flex_gd->groups == NULL) - goto out2; - -- flex_gd->bg_flags = kmalloc_array(flexbg_size, sizeof(__u16), -+ flex_gd->bg_flags = kmalloc_array(flex_gd->resize_bg, sizeof(__u16), - GFP_NOFS); - if (flex_gd->bg_flags == NULL) - goto out1; -@@ -1602,8 +1613,7 @@ static int ext4_flex_group_add(struct super_block *sb, - - static int ext4_setup_next_flex_gd(struct super_block *sb, - struct ext4_new_flex_group_data *flex_gd, -- ext4_fsblk_t n_blocks_count, -- unsigned int flexbg_size) -+ ext4_fsblk_t n_blocks_count) - { - struct ext4_sb_info *sbi = EXT4_SB(sb); - struct ext4_super_block *es = sbi->s_es; -@@ -1627,7 +1637,7 @@ static int ext4_setup_next_flex_gd(struct super_block *sb, - BUG_ON(last); - ext4_get_group_no_and_offset(sb, n_blocks_count - 1, &n_group, &last); - -- last_group = group | (flexbg_size - 1); -+ last_group = group | (flex_gd->resize_bg - 1); - if (last_group > n_group) - last_group = n_group; - -@@ -2130,8 +2140,7 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count) - /* Add flex groups. Note that a regular group is a - * flex group with 1 group. - */ -- while (ext4_setup_next_flex_gd(sb, flex_gd, n_blocks_count, -- flexbg_size)) { -+ while (ext4_setup_next_flex_gd(sb, flex_gd, n_blocks_count)) { - if (time_is_before_jiffies(last_update_time + HZ * 10)) { - if (last_update_time) - ext4_msg(sb, KERN_INFO, --- -2.43.2 - -From c039cda8d878522d8ea823b424b7ee4d863d4ee1 Mon Sep 17 00:00:00 2001 -From: Dmitry Antipov <dmantipov@yandex.ru> -Date: Tue, 24 Oct 2023 17:31:33 +0300 -Subject: [PATCH 1080/1501] wifi: rtw89: fix timeout calculation in - rtw89_roc_end() -Content-Length: 1314 -Lines: 33 - -[ Upstream commit e416514e309f7e25e577fee45a65f246f67b2261 ] - -Since 'rtw89_core_tx_kick_off_and_wait()' assumes timeout -(actually RTW89_ROC_TX_TIMEOUT) in milliseconds, I suppose -that RTW89_ROC_IDLE_TIMEOUT is in milliseconds as well. If -so, 'msecs_to_jiffies()' should be used in a call to -'ieee80211_queue_delayed_work()' from 'rtw89_roc_end()'. -Compile tested only. - -Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> -Acked-by: Ping-Ke Shih <pkshih@realtek.com> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://lore.kernel.org/r/20231024143137.30393-1-dmantipov@yandex.ru -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/realtek/rtw89/core.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c -index 3d75165e48be..a3624ebf01b7 100644 ---- a/drivers/net/wireless/realtek/rtw89/core.c -+++ b/drivers/net/wireless/realtek/rtw89/core.c -@@ -2886,7 +2886,7 @@ void rtw89_roc_end(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif) - - if (hw->conf.flags & IEEE80211_CONF_IDLE) - ieee80211_queue_delayed_work(hw, &roc->roc_work, -- RTW89_ROC_IDLE_TIMEOUT); -+ msecs_to_jiffies(RTW89_ROC_IDLE_TIMEOUT)); - } - - void rtw89_roc_work(struct work_struct *work) --- -2.43.2 - -From fdb580ed05df8973aa5149cafa598c64bebcd0cb Mon Sep 17 00:00:00 2001 -From: Shiji Yang <yangshiji66@outlook.com> -Date: Sat, 4 Nov 2023 16:58:00 +0800 -Subject: [PATCH 1081/1501] wifi: rt2x00: restart beacon queue when hardware - reset -Content-Length: 2867 -Lines: 71 - -[ Upstream commit a11d965a218f0cd95b13fe44d0bcd8a20ce134a8 ] - -When a hardware reset is triggered, all registers are reset, so all -queues are forced to stop in hardware interface. However, mac80211 -will not automatically stop the queue. If we don't manually stop the -beacon queue, the queue will be deadlocked and unable to start again. -This patch fixes the issue where Apple devices cannot connect to the -AP after calling ieee80211_restart_hw(). - -Signed-off-by: Shiji Yang <yangshiji66@outlook.com> -Acked-by: Stanislaw Gruszka <stf_xl@wp.pl> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://lore.kernel.org/r/TYAP286MB031530EB6D98DCE4DF20766CBCA4A@TYAP286MB0315.JPNP286.PROD.OUTLOOK.COM -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 3 +++ - drivers/net/wireless/ralink/rt2x00/rt2x00mac.c | 11 +++++++++++ - 2 files changed, 14 insertions(+) - -diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c -index c88ce446e117..9e7d9dbe954c 100644 ---- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c -+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c -@@ -101,6 +101,7 @@ void rt2x00lib_disable_radio(struct rt2x00_dev *rt2x00dev) - rt2x00link_stop_tuner(rt2x00dev); - rt2x00queue_stop_queues(rt2x00dev); - rt2x00queue_flush_queues(rt2x00dev, true); -+ rt2x00queue_stop_queue(rt2x00dev->bcn); - - /* - * Disable radio. -@@ -1286,6 +1287,7 @@ int rt2x00lib_start(struct rt2x00_dev *rt2x00dev) - rt2x00dev->intf_ap_count = 0; - rt2x00dev->intf_sta_count = 0; - rt2x00dev->intf_associated = 0; -+ rt2x00dev->intf_beaconing = 0; - - /* Enable the radio */ - retval = rt2x00lib_enable_radio(rt2x00dev); -@@ -1312,6 +1314,7 @@ void rt2x00lib_stop(struct rt2x00_dev *rt2x00dev) - rt2x00dev->intf_ap_count = 0; - rt2x00dev->intf_sta_count = 0; - rt2x00dev->intf_associated = 0; -+ rt2x00dev->intf_beaconing = 0; - } - - static inline void rt2x00lib_set_if_combinations(struct rt2x00_dev *rt2x00dev) -diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c -index 4202c6517783..75fda72c14ca 100644 ---- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c -+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c -@@ -598,6 +598,17 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw, - */ - if (changes & BSS_CHANGED_BEACON_ENABLED) { - mutex_lock(&intf->beacon_skb_mutex); -+ -+ /* -+ * Clear the 'enable_beacon' flag and clear beacon because -+ * the beacon queue has been stopped after hardware reset. -+ */ -+ if (test_bit(DEVICE_STATE_RESET, &rt2x00dev->flags) && -+ intf->enable_beacon) { -+ intf->enable_beacon = false; -+ rt2x00queue_clear_beacon(rt2x00dev, vif); -+ } -+ - if (!bss_conf->enable_beacon && intf->enable_beacon) { - rt2x00dev->intf_beaconing--; - intf->enable_beacon = false; --- -2.43.2 - -From 3eb0fff7fbbf2d33959b1a65e439710ce619b894 Mon Sep 17 00:00:00 2001 -From: Shiji Yang <yangshiji66@outlook.com> -Date: Thu, 9 Nov 2023 12:38:51 +0800 -Subject: [PATCH 1086/1501] wifi: rt2x00: correct wrong BBP register in RxDCOC - calibration -Content-Length: 1359 -Lines: 31 - -[ Upstream commit 50da74e1e8b682853d1e07fc8bbe3a0774ae5e09 ] - -Refer to Mediatek vendor driver RxDCOC_Calibration() function, when -performing gainfreeze calibration, we should write register 140 -instead of 141. This fix can reduce the total calibration time from -6 seconds to 1 second. - -Signed-off-by: Shiji Yang <yangshiji66@outlook.com> -Acked-by: Stanislaw Gruszka <stf_xl@wp.pl> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://lore.kernel.org/r/TYAP286MB0315B13B89DF57B6B27BB854BCAFA@TYAP286MB0315.JPNP286.PROD.OUTLOOK.COM -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c -index ee880f749b3c..1926ffdffb4f 100644 ---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c -+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c -@@ -8659,7 +8659,7 @@ static void rt2800_rxdcoc_calibration(struct rt2x00_dev *rt2x00dev) - rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, saverfb5r4); - rt2800_rfcsr_write_bank(rt2x00dev, 7, 4, saverfb7r4); - -- rt2800_bbp_write(rt2x00dev, 158, 141); -+ rt2800_bbp_write(rt2x00dev, 158, 140); - bbpreg = rt2800_bbp_read(rt2x00dev, 159); - bbpreg = bbpreg & (~0x40); - rt2800_bbp_write(rt2x00dev, 159, bbpreg); --- -2.43.2 - -From 548bdbbdcd355f5a844c7122c83c9aab115051fa Mon Sep 17 00:00:00 2001 -From: HariBabu Gattem <haribabu.gattem@xilinx.com> -Date: Thu, 26 Oct 2023 22:56:22 -0700 -Subject: [PATCH 1091/1501] soc: xilinx: Fix for call trace due to the usage of - smp_processor_id() -Content-Length: 2322 -Lines: 61 - -[ Upstream commit daed80ed07580e5adc0e6d8bc79933a35154135a ] - -When preemption is enabled in kernel and if any task which can be -preempted should not use smp_processor_id() directly, since CPU -switch can happen at any time, the previous value of cpu_id -differs with current cpu_id. As a result we see the below call trace -during xlnx_event_manager_probe. - -[ 6.140197] dump_backtrace+0x0/0x190 -[ 6.143884] show_stack+0x18/0x40 -[ 6.147220] dump_stack_lvl+0x7c/0xa0 -[ 6.150907] dump_stack+0x18/0x34 -[ 6.154241] check_preemption_disabled+0x124/0x134 -[ 6.159068] debug_smp_processor_id+0x20/0x2c -[ 6.163453] xlnx_event_manager_probe+0x48/0x250 - -To protect cpu_id, It is recommended to use get_cpu()/put_cpu() -to disable preemption, get the cpu_id and enable preemption respectively. -(For Reference, Documentation/locking/preempt-locking.rst and -Documentation/kernel-hacking/hacking.rst) - -Use preempt_disable()/smp_processor_id()/preempt_enable() -API's to achieve the same. - -Signed-off-by: HariBabu Gattem <haribabu.gattem@xilinx.com> -Signed-off-by: Jay Buddhabhatti <jay.buddhabhatti@amd.com> -Link: https://lore.kernel.org/r/20231027055622.21544-1-jay.buddhabhatti@amd.com -Signed-off-by: Michal Simek <michal.simek@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/soc/xilinx/xlnx_event_manager.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/drivers/soc/xilinx/xlnx_event_manager.c b/drivers/soc/xilinx/xlnx_event_manager.c -index 86a048a10a13..edfb1d5c10c6 100644 ---- a/drivers/soc/xilinx/xlnx_event_manager.c -+++ b/drivers/soc/xilinx/xlnx_event_manager.c -@@ -555,7 +555,7 @@ static void xlnx_disable_percpu_irq(void *data) - static int xlnx_event_init_sgi(struct platform_device *pdev) - { - int ret = 0; -- int cpu = smp_processor_id(); -+ int cpu; - /* - * IRQ related structures are used for the following: - * for each SGI interrupt ensure its mapped by GIC IRQ domain -@@ -592,9 +592,12 @@ static int xlnx_event_init_sgi(struct platform_device *pdev) - sgi_fwspec.param[0] = sgi_num; - virq_sgi = irq_create_fwspec_mapping(&sgi_fwspec); - -+ cpu = get_cpu(); - per_cpu(cpu_number1, cpu) = cpu; - ret = request_percpu_irq(virq_sgi, xlnx_event_handler, "xlnx_event_mgmt", - &cpu_number1); -+ put_cpu(); -+ - WARN_ON(ret); - if (ret) { - irq_dispose_mapping(virq_sgi); --- -2.43.2 - -From 1aab60bb9c203f7723cc23ad262d63420791293f Mon Sep 17 00:00:00 2001 -From: Tanmay Shah <tanmay.shah@xilinx.com> -Date: Fri, 27 Oct 2023 23:53:59 +0530 -Subject: [PATCH 1092/1501] soc: xilinx: fix unhandled SGI warning message -Content-Length: 1291 -Lines: 31 - -[ Upstream commit 9c6724abf969251af53cdae525ad8100ec78d3c2 ] - -Xen broadcasts SGI to each VM when multiple VMs run on Xen hypervisor. In -such case spurious SGI is expected if one event is registered by one VM and -not registered by another VM. We let users know that Unhandled SGI is not -error and expected if kernel is running on Xen hypervisor. - -Signed-off-by: Tanmay Shah <tanmay.shah@xilinx.com> -Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> -Link: https://lore.kernel.org/r/1698431039-2734260-1-git-send-email-radhey.shyam.pandey@amd.com -Signed-off-by: Michal Simek <michal.simek@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/soc/xilinx/xlnx_event_manager.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/soc/xilinx/xlnx_event_manager.c b/drivers/soc/xilinx/xlnx_event_manager.c -index edfb1d5c10c6..042553abe1bf 100644 ---- a/drivers/soc/xilinx/xlnx_event_manager.c -+++ b/drivers/soc/xilinx/xlnx_event_manager.c -@@ -477,7 +477,7 @@ static void xlnx_call_notify_cb_handler(const u32 *payload) - } - } - if (!is_callback_found) -- pr_warn("Didn't find any registered callback for 0x%x 0x%x\n", -+ pr_warn("Unhandled SGI node 0x%x event 0x%x. Expected with Xen hypervisor\n", - payload[1], payload[2]); - } - --- -2.43.2 - -From afcaecba1c4c2719b6cd323957bce77c88e19401 Mon Sep 17 00:00:00 2001 -From: Justin Tee <justin.tee@broadcom.com> -Date: Tue, 31 Oct 2023 12:12:17 -0700 -Subject: [PATCH 1093/1501] scsi: lpfc: Fix possible file string name overflow - when updating firmware -Content-Length: 2059 -Lines: 55 - -[ Upstream commit f5779b529240b715f0e358489ad0ed933bf77c97 ] - -Because file_name and phba->ModelName are both declared a size 80 bytes, -the extra ".grp" file extension could cause an overflow into file_name. - -Define a ELX_FW_NAME_SIZE macro with value 84. 84 incorporates the 4 extra -characters from ".grp". file_name is changed to be declared as a char and -initialized to zeros i.e. null chars. - -Signed-off-by: Justin Tee <justin.tee@broadcom.com> -Link: https://lore.kernel.org/r/20231031191224.150862-3-justintee8345@gmail.com -Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com> -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/scsi/lpfc/lpfc.h | 1 + - drivers/scsi/lpfc/lpfc_init.c | 4 ++-- - 2 files changed, 3 insertions(+), 2 deletions(-) - -diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h -index af15f7a22d25..04d608ea9106 100644 ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -33,6 +33,7 @@ - struct lpfc_sli2_slim; - - #define ELX_MODEL_NAME_SIZE 80 -+#define ELX_FW_NAME_SIZE 84 - - #define LPFC_PCI_DEV_LP 0x1 - #define LPFC_PCI_DEV_OC 0x2 -diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index e7c47ee185a4..70bcee64bc8c 100644 ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -14721,7 +14721,7 @@ lpfc_write_firmware(const struct firmware *fw, void *context) - int - lpfc_sli4_request_firmware_update(struct lpfc_hba *phba, uint8_t fw_upgrade) - { -- uint8_t file_name[ELX_MODEL_NAME_SIZE]; -+ char file_name[ELX_FW_NAME_SIZE] = {0}; - int ret; - const struct firmware *fw; - -@@ -14730,7 +14730,7 @@ lpfc_sli4_request_firmware_update(struct lpfc_hba *phba, uint8_t fw_upgrade) - LPFC_SLI_INTF_IF_TYPE_2) - return -EPERM; - -- snprintf(file_name, ELX_MODEL_NAME_SIZE, "%s.grp", phba->ModelName); -+ scnprintf(file_name, sizeof(file_name), "%s.grp", phba->ModelName); - - if (fw_upgrade == INT_FW_UPGRADE) { - ret = request_firmware_nowait(THIS_MODULE, FW_ACTION_UEVENT, --- -2.43.2 - -From af13b0b12ada31250124f2110e4cb11f86f37fcd Mon Sep 17 00:00:00 2001 -From: Kory Maincent <kory.maincent@bootlin.com> -Date: Tue, 14 Nov 2023 12:28:34 +0100 -Subject: [PATCH 1096/1501] net: phy: micrel: fix ts_info value in case of no - phc -Content-Length: 1151 -Lines: 33 - -[ Upstream commit 915d25a9d69be969c1cc6c1dd0c3861f6da7b55e ] - -In case of no phc we should not return SOFTWARE TIMESTAMPING flags as we do -not know whether the netdev supports of timestamping. -Remove it from the lan8841_ts_info and simply return 0. - -Signed-off-by: Kory Maincent <kory.maincent@bootlin.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/phy/micrel.c | 6 +----- - 1 file changed, 1 insertion(+), 5 deletions(-) - -diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c -index 858175ca58cd..ca2db4adcb35 100644 ---- a/drivers/net/phy/micrel.c -+++ b/drivers/net/phy/micrel.c -@@ -3650,12 +3650,8 @@ static int lan8841_ts_info(struct mii_timestamper *mii_ts, - - info->phc_index = ptp_priv->ptp_clock ? - ptp_clock_index(ptp_priv->ptp_clock) : -1; -- if (info->phc_index == -1) { -- info->so_timestamping |= SOF_TIMESTAMPING_TX_SOFTWARE | -- SOF_TIMESTAMPING_RX_SOFTWARE | -- SOF_TIMESTAMPING_SOFTWARE; -+ if (info->phc_index == -1) - return 0; -- } - - info->so_timestamping = SOF_TIMESTAMPING_TX_HARDWARE | - SOF_TIMESTAMPING_RX_HARDWARE | --- -2.43.2 - -From 6b0e5ba96f8f962a8651ec8b82ce9575eded277d Mon Sep 17 00:00:00 2001 -From: Ido Schimmel <idosch@nvidia.com> -Date: Wed, 15 Nov 2023 13:17:16 +0100 -Subject: [PATCH 1097/1501] PCI: Add no PM reset quirk for NVIDIA Spectrum - devices -Content-Length: 2142 -Lines: 54 - -[ Upstream commit 3ed48c80b28d8dcd584d6ddaf00c75b7673e1a05 ] - -Spectrum-{1,2,3,4} devices report that a D3hot->D0 transition causes a -reset (i.e., they advertise NoSoftRst-). However, this transition does -not have any effect on the device: It continues to be operational and -network ports remain up. Advertising this support makes it seem as if a -PM reset is viable for these devices. Mark it as unavailable to skip it -when testing reset methods. - -Before: - - # cat /sys/bus/pci/devices/0000\:03\:00.0/reset_method - pm bus - -After: - - # cat /sys/bus/pci/devices/0000\:03\:00.0/reset_method - bus - -Signed-off-by: Ido Schimmel <idosch@nvidia.com> -Acked-by: Bjorn Helgaas <bhelgaas@google.com> -Signed-off-by: Petr Machata <petrm@nvidia.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/pci/quirks.c | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index d55a3ffae4b8..a991710efa40 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -3786,6 +3786,19 @@ static void quirk_no_pm_reset(struct pci_dev *dev) - DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_ATI, PCI_ANY_ID, - PCI_CLASS_DISPLAY_VGA, 8, quirk_no_pm_reset); - -+/* -+ * Spectrum-{1,2,3,4} devices report that a D3hot->D0 transition causes a reset -+ * (i.e., they advertise NoSoftRst-). However, this transition does not have -+ * any effect on the device: It continues to be operational and network ports -+ * remain up. Advertising this support makes it seem as if a PM reset is viable -+ * for these devices. Mark it as unavailable to skip it when testing reset -+ * methods. -+ */ -+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcb84, quirk_no_pm_reset); -+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcf6c, quirk_no_pm_reset); -+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcf70, quirk_no_pm_reset); -+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcf80, quirk_no_pm_reset); -+ - /* - * Thunderbolt controllers with broken MSI hotplug signaling: - * Entire 1st generation (Light Ridge, Eagle Ridge, Light Peak) and part --- -2.43.2 - -From 00359cf5217a51ecdc540c03bc7e28d779b27d4a Mon Sep 17 00:00:00 2001 -From: Zhengchao Shao <shaozhengchao@huawei.com> -Date: Sat, 18 Nov 2023 16:16:53 +0800 -Subject: [PATCH 1098/1501] bonding: return -ENOMEM instead of BUG in - alb_upper_dev_walk -Content-Length: 2373 -Lines: 61 - -[ Upstream commit d6b83f1e3707c4d60acfa58afd3515e17e5d5384 ] - -If failed to allocate "tags" or could not find the final upper device from -start_dev's upper list in bond_verify_device_path(), only the loopback -detection of the current upper device should be affected, and the system is -no need to be panic. -So return -ENOMEM in alb_upper_dev_walk to stop walking, print some warn -information when failed to allocate memory for vlan tags in -bond_verify_device_path. - -I also think that the following function calls -netdev_walk_all_upper_dev_rcu ----->>>alb_upper_dev_walk ----------->>>bond_verify_device_path -From this way, "end device" can eventually be obtained from "start device" -in bond_verify_device_path, IS_ERR(tags) could be instead of -IS_ERR_OR_NULL(tags) in alb_upper_dev_walk. - -Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com> -Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com> -Link: https://lore.kernel.org/r/20231118081653.1481260-1-shaozhengchao@huawei.com -Signed-off-by: Paolo Abeni <pabeni@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/bonding/bond_alb.c | 3 ++- - drivers/net/bonding/bond_main.c | 5 ++++- - 2 files changed, 6 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c -index dc2c7b979656..7edf0fd58c34 100644 ---- a/drivers/net/bonding/bond_alb.c -+++ b/drivers/net/bonding/bond_alb.c -@@ -985,7 +985,8 @@ static int alb_upper_dev_walk(struct net_device *upper, - if (netif_is_macvlan(upper) && !strict_match) { - tags = bond_verify_device_path(bond->dev, upper, 0); - if (IS_ERR_OR_NULL(tags)) -- BUG(); -+ return -ENOMEM; -+ - alb_send_lp_vid(slave, upper->dev_addr, - tags[0].vlan_proto, tags[0].vlan_id); - kfree(tags); -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 8e6cc0e133b7..9c1652886f4e 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -2973,8 +2973,11 @@ struct bond_vlan_tag *bond_verify_device_path(struct net_device *start_dev, - - if (start_dev == end_dev) { - tags = kcalloc(level + 1, sizeof(*tags), GFP_ATOMIC); -- if (!tags) -+ if (!tags) { -+ net_err_ratelimited("%s: %s: Failed to allocate tags\n", -+ __func__, start_dev->name); - return ERR_PTR(-ENOMEM); -+ } - tags[level].vlan_proto = BOND_VLAN_PROTO_NONE; - return tags; - } --- -2.43.2 - -From aca1b66eb75e9e67df372398f1b4fa7058c08b5c Mon Sep 17 00:00:00 2001 -From: Sumit Saxena <sumit.saxena@broadcom.com> -Date: Thu, 23 Nov 2023 21:31:28 +0530 -Subject: [PATCH 1100/1501] scsi: mpi3mr: Add support for SAS5116 PCI IDs -Content-Length: 1169 -Lines: 33 - -[ Upstream commit 6fa21eab82be57a3ad2470fac27b982793805336 ] - -Add support for Broadcom's SAS5116 IO/RAID controllers PCI IDs. - -Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com> -Link: https://lore.kernel.org/r/20231123160132.4155-2-sumit.saxena@broadcom.com -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/scsi/mpi3mr/mpi3mr_os.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c -index e2f2c205df71..94adb0b1afc9 100644 ---- a/drivers/scsi/mpi3mr/mpi3mr_os.c -+++ b/drivers/scsi/mpi3mr/mpi3mr_os.c -@@ -5441,6 +5441,14 @@ static const struct pci_device_id mpi3mr_pci_id_table[] = { - PCI_DEVICE_SUB(MPI3_MFGPAGE_VENDORID_BROADCOM, - MPI3_MFGPAGE_DEVID_SAS4116, PCI_ANY_ID, PCI_ANY_ID) - }, -+ { -+ PCI_DEVICE_SUB(MPI3_MFGPAGE_VENDORID_BROADCOM, -+ MPI3_MFGPAGE_DEVID_SAS5116_MPI, PCI_ANY_ID, PCI_ANY_ID) -+ }, -+ { -+ PCI_DEVICE_SUB(MPI3_MFGPAGE_VENDORID_BROADCOM, -+ MPI3_MFGPAGE_DEVID_SAS5116_MPI_MGMT, PCI_ANY_ID, PCI_ANY_ID) -+ }, - { 0 } - }; - MODULE_DEVICE_TABLE(pci, mpi3mr_pci_id_table); --- -2.43.2 - -From 352ad5001b86b84466574b1e60c22ca7e68a47a3 Mon Sep 17 00:00:00 2001 -From: Sumit Saxena <sumit.saxena@broadcom.com> -Date: Thu, 23 Nov 2023 21:31:29 +0530 -Subject: [PATCH 1101/1501] scsi: mpi3mr: Add PCI checks where SAS5116 diverges - from SAS4116 -Content-Length: 1717 -Lines: 46 - -[ Upstream commit c9260ff28ee561fca5f96425c9328a9698e8427b ] - -Add PCI IDs checks for the cases where SAS5116 diverges from SAS4116 in -behavior. - -Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com> -Link: https://lore.kernel.org/r/20231123160132.4155-3-sumit.saxena@broadcom.com -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/scsi/mpi3mr/mpi3mr_fw.c | 3 ++- - drivers/scsi/mpi3mr/mpi3mr_os.c | 5 ++++- - 2 files changed, 6 insertions(+), 2 deletions(-) - -diff --git a/drivers/scsi/mpi3mr/mpi3mr_fw.c b/drivers/scsi/mpi3mr/mpi3mr_fw.c -index f039f1d98647..0d148c39ebcc 100644 ---- a/drivers/scsi/mpi3mr/mpi3mr_fw.c -+++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c -@@ -1892,7 +1892,8 @@ static int mpi3mr_create_op_reply_q(struct mpi3mr_ioc *mrioc, u16 qidx) - - reply_qid = qidx + 1; - op_reply_q->num_replies = MPI3MR_OP_REP_Q_QD; -- if (!mrioc->pdev->revision) -+ if ((mrioc->pdev->device == MPI3_MFGPAGE_DEVID_SAS4116) && -+ !mrioc->pdev->revision) - op_reply_q->num_replies = MPI3MR_OP_REP_Q_QD4K; - op_reply_q->ci = 0; - op_reply_q->ephase = 1; -diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c -index 94adb0b1afc9..872d4b809d08 100644 ---- a/drivers/scsi/mpi3mr/mpi3mr_os.c -+++ b/drivers/scsi/mpi3mr/mpi3mr_os.c -@@ -5112,7 +5112,10 @@ mpi3mr_probe(struct pci_dev *pdev, const struct pci_device_id *id) - mpi3mr_init_drv_cmd(&mrioc->evtack_cmds[i], - MPI3MR_HOSTTAG_EVTACKCMD_MIN + i); - -- if (pdev->revision) -+ if ((pdev->device == MPI3_MFGPAGE_DEVID_SAS4116) && -+ !pdev->revision) -+ mrioc->enable_segqueue = false; -+ else - mrioc->enable_segqueue = true; - - init_waitqueue_head(&mrioc->reset_waitq); --- -2.43.2 - -From ef015ff14fc285b69338f2a0eda40db0cb40b446 Mon Sep 17 00:00:00 2001 -From: ching Huang <ching2048@areca.com.tw> -Date: Mon, 2 Oct 2023 17:50:27 +0800 -Subject: [PATCH 1102/1501] scsi: arcmsr: Support new PCI device IDs 1883 and - 1886 -Content-Length: 2415 -Lines: 62 - -[ Upstream commit 41c8a1a1e90fa4721f856bf3cf71211fd16d6434 ] - -Add support for Areca RAID controllers with PCI device IDs 1883 and 1886. - -Signed-off-by: ching Huang <ching2048@areca.com.tw> -Link: https://lore.kernel.org/r/7732e743eaad57681b1552eec9c6a86c76dbe459.camel@areca.com.tw -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/scsi/arcmsr/arcmsr.h | 4 ++++ - drivers/scsi/arcmsr/arcmsr_hba.c | 6 ++++++ - 2 files changed, 10 insertions(+) - -diff --git a/drivers/scsi/arcmsr/arcmsr.h b/drivers/scsi/arcmsr/arcmsr.h -index ed8d9319862a..3819d559ebbb 100644 ---- a/drivers/scsi/arcmsr/arcmsr.h -+++ b/drivers/scsi/arcmsr/arcmsr.h -@@ -78,9 +78,13 @@ struct device_attribute; - #ifndef PCI_DEVICE_ID_ARECA_1203 - #define PCI_DEVICE_ID_ARECA_1203 0x1203 - #endif -+#ifndef PCI_DEVICE_ID_ARECA_1883 -+#define PCI_DEVICE_ID_ARECA_1883 0x1883 -+#endif - #ifndef PCI_DEVICE_ID_ARECA_1884 - #define PCI_DEVICE_ID_ARECA_1884 0x1884 - #endif -+#define PCI_DEVICE_ID_ARECA_1886_0 0x1886 - #define PCI_DEVICE_ID_ARECA_1886 0x188A - #define ARCMSR_HOURS (1000 * 60 * 60 * 4) - #define ARCMSR_MINUTES (1000 * 60 * 60) -diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c -index a66221c3b72f..01fb1396e1a9 100644 ---- a/drivers/scsi/arcmsr/arcmsr_hba.c -+++ b/drivers/scsi/arcmsr/arcmsr_hba.c -@@ -214,8 +214,12 @@ static struct pci_device_id arcmsr_device_id_table[] = { - .driver_data = ACB_ADAPTER_TYPE_A}, - {PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1880), - .driver_data = ACB_ADAPTER_TYPE_C}, -+ {PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1883), -+ .driver_data = ACB_ADAPTER_TYPE_C}, - {PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1884), - .driver_data = ACB_ADAPTER_TYPE_E}, -+ {PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1886_0), -+ .driver_data = ACB_ADAPTER_TYPE_F}, - {PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1886), - .driver_data = ACB_ADAPTER_TYPE_F}, - {0, 0}, /* Terminating entry */ -@@ -4706,9 +4710,11 @@ static const char *arcmsr_info(struct Scsi_Host *host) - case PCI_DEVICE_ID_ARECA_1680: - case PCI_DEVICE_ID_ARECA_1681: - case PCI_DEVICE_ID_ARECA_1880: -+ case PCI_DEVICE_ID_ARECA_1883: - case PCI_DEVICE_ID_ARECA_1884: - type = "SAS/SATA"; - break; -+ case PCI_DEVICE_ID_ARECA_1886_0: - case PCI_DEVICE_ID_ARECA_1886: - type = "NVMe/SAS/SATA"; - break; --- -2.43.2 - -From 58bb568d03eb21adcdb1c6902f2e6a1ef1feedd6 Mon Sep 17 00:00:00 2001 -From: Yonghong Song <yonghong.song@linux.dev> -Date: Sun, 26 Nov 2023 21:03:42 -0800 -Subject: [PATCH 1106/1501] bpf: Fix a few selftest failures due to llvm18 - change -Content-Length: 3155 -Lines: 91 - -[ Upstream commit b16904fd9f01b580db357ef2b1cc9e86d89576c2 ] - -With latest upstream llvm18, the following test cases failed: - - $ ./test_progs -j - #13/2 bpf_cookie/multi_kprobe_link_api:FAIL - #13/3 bpf_cookie/multi_kprobe_attach_api:FAIL - #13 bpf_cookie:FAIL - #77 fentry_fexit:FAIL - #78/1 fentry_test/fentry:FAIL - #78 fentry_test:FAIL - #82/1 fexit_test/fexit:FAIL - #82 fexit_test:FAIL - #112/1 kprobe_multi_test/skel_api:FAIL - #112/2 kprobe_multi_test/link_api_addrs:FAIL - [...] - #112 kprobe_multi_test:FAIL - #356/17 test_global_funcs/global_func17:FAIL - #356 test_global_funcs:FAIL - -Further analysis shows llvm upstream patch [1] is responsible for the above -failures. For example, for function bpf_fentry_test7() in net/bpf/test_run.c, -without [1], the asm code is: - - 0000000000000400 <bpf_fentry_test7>: - 400: f3 0f 1e fa endbr64 - 404: e8 00 00 00 00 callq 0x409 <bpf_fentry_test7+0x9> - 409: 48 89 f8 movq %rdi, %rax - 40c: c3 retq - 40d: 0f 1f 00 nopl (%rax) - -... and with [1], the asm code is: - - 0000000000005d20 <bpf_fentry_test7.specialized.1>: - 5d20: e8 00 00 00 00 callq 0x5d25 <bpf_fentry_test7.specialized.1+0x5> - 5d25: c3 retq - -... and <bpf_fentry_test7.specialized.1> is called instead of <bpf_fentry_test7> -and this caused test failures for #13/#77 etc. except #356. - -For test case #356/17, with [1] (progs/test_global_func17.c)), the main prog -looks like: - - 0000000000000000 <global_func17>: - 0: b4 00 00 00 2a 00 00 00 w0 = 0x2a - 1: 95 00 00 00 00 00 00 00 exit - -... which passed verification while the test itself expects a verification -failure. - -Let us add 'barrier_var' style asm code in both places to prevent function -specialization which caused selftests failure. - - [1] https://github.com/llvm/llvm-project/pull/72903 - -Signed-off-by: Yonghong Song <yonghong.song@linux.dev> -Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> -Link: https://lore.kernel.org/bpf/20231127050342.1945270-1-yonghong.song@linux.dev -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/bpf/test_run.c | 2 +- - tools/testing/selftests/bpf/progs/test_global_func17.c | 1 + - 2 files changed, 2 insertions(+), 1 deletion(-) - -diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c -index c9fdcc5cdce1..711cf5d59816 100644 ---- a/net/bpf/test_run.c -+++ b/net/bpf/test_run.c -@@ -542,7 +542,7 @@ struct bpf_fentry_test_t { - - int noinline bpf_fentry_test7(struct bpf_fentry_test_t *arg) - { -- asm volatile (""); -+ asm volatile ("": "+r"(arg)); - return (long)arg; - } - -diff --git a/tools/testing/selftests/bpf/progs/test_global_func17.c b/tools/testing/selftests/bpf/progs/test_global_func17.c -index a32e11c7d933..5de44b09e8ec 100644 ---- a/tools/testing/selftests/bpf/progs/test_global_func17.c -+++ b/tools/testing/selftests/bpf/progs/test_global_func17.c -@@ -5,6 +5,7 @@ - - __noinline int foo(int *p) - { -+ barrier_var(p); - return p ? (*p = 42) : 0; - } - --- -2.43.2 - -From be609c7002dd4504b15b069cb7582f4c778548d1 Mon Sep 17 00:00:00 2001 -From: Minsuk Kang <linuxlovemin@yonsei.ac.kr> -Date: Wed, 22 Nov 2023 20:31:04 +0200 -Subject: [PATCH 1107/1501] wifi: ath9k: Fix potential - array-index-out-of-bounds read in ath9k_htc_txstatus() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1751 -Lines: 49 - -[ Upstream commit 2adc886244dff60f948497b59affb6c6ebb3c348 ] - -Fix an array-index-out-of-bounds read in ath9k_htc_txstatus(). The bug -occurs when txs->cnt, data from a URB provided by a USB device, is -bigger than the size of the array txs->txstatus, which is -HTC_MAX_TX_STATUS. WARN_ON() already checks it, but there is no bug -handling code after the check. Make the function return if that is the -case. - -Found by a modified version of syzkaller. - -UBSAN: array-index-out-of-bounds in htc_drv_txrx.c -index 13 is out of range for type '__wmi_event_txstatus [12]' -Call Trace: - ath9k_htc_txstatus - ath9k_wmi_event_tasklet - tasklet_action_common - __do_softirq - irq_exit_rxu - sysvec_apic_timer_interrupt - -Signed-off-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr> -Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> -Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> -Link: https://lore.kernel.org/r/20231113065756.1491991-1-linuxlovemin@yonsei.ac.kr -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c -index 800177021baf..efcaeccb055a 100644 ---- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c -+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c -@@ -652,9 +652,10 @@ void ath9k_htc_txstatus(struct ath9k_htc_priv *priv, void *wmi_event) - struct ath9k_htc_tx_event *tx_pend; - int i; - -- for (i = 0; i < txs->cnt; i++) { -- WARN_ON(txs->cnt > HTC_MAX_TX_STATUS); -+ if (WARN_ON_ONCE(txs->cnt > HTC_MAX_TX_STATUS)) -+ return; - -+ for (i = 0; i < txs->cnt; i++) { - __txs = &txs->txstatus[i]; - - skb = ath9k_htc_tx_get_packet(priv, __txs); --- -2.43.2 - -From ecb6658d2b8b1947f023cd7ee7e3a7c20b6036e2 Mon Sep 17 00:00:00 2001 -From: Baochen Qiang <quic_bqiang@quicinc.com> -Date: Fri, 17 Nov 2023 08:39:19 +0800 -Subject: [PATCH 1108/1501] wifi: ath11k: fix race due to setting - ATH11K_FLAG_EXT_IRQ_ENABLED too early -Content-Length: 2502 -Lines: 66 - -[ Upstream commit 5082b3e3027eae393a4e86874bffb4ce3f83c26e ] - -We are seeing below error randomly in the case where only -one MSI vector is configured: - -kernel: ath11k_pci 0000:03:00.0: wmi command 16387 timeout - -The reason is, currently, in ath11k_pcic_ext_irq_enable(), -ATH11K_FLAG_EXT_IRQ_ENABLED is set before NAPI is enabled. -This results in a race condition: after -ATH11K_FLAG_EXT_IRQ_ENABLED is set but before NAPI enabled, -CE interrupt breaks in. Since IRQ is shared by CE and data -path, ath11k_pcic_ext_interrupt_handler() is also called -where we call disable_irq_nosync() to disable IRQ. Then -napi_schedule() is called but it does nothing because NAPI -is not enabled at that time, meaning -ath11k_pcic_ext_grp_napi_poll() will never run, so we have -no chance to call enable_irq() to enable IRQ back. Finally -we get above error. - -Fix it by setting ATH11K_FLAG_EXT_IRQ_ENABLED after all -NAPI and IRQ work are done. With the fix, we are sure that -by the time ATH11K_FLAG_EXT_IRQ_ENABLED is set, NAPI is -enabled. - -Note that the fix above also introduce some side effects: -if ath11k_pcic_ext_interrupt_handler() breaks in after NAPI -enabled but before ATH11K_FLAG_EXT_IRQ_ENABLED set, nothing -will be done by the handler this time, the work will be -postponed till the next time the IRQ fires. - -Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 - -Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com> -Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com> -Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> -Link: https://lore.kernel.org/r/20231117003919.26218-1-quic_bqiang@quicinc.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/ath/ath11k/pcic.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/wireless/ath/ath11k/pcic.c b/drivers/net/wireless/ath/ath11k/pcic.c -index 16d1e332193f..e602d4130105 100644 ---- a/drivers/net/wireless/ath/ath11k/pcic.c -+++ b/drivers/net/wireless/ath/ath11k/pcic.c -@@ -460,8 +460,6 @@ void ath11k_pcic_ext_irq_enable(struct ath11k_base *ab) - { - int i; - -- set_bit(ATH11K_FLAG_EXT_IRQ_ENABLED, &ab->dev_flags); -- - for (i = 0; i < ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) { - struct ath11k_ext_irq_grp *irq_grp = &ab->ext_irq_grp[i]; - -@@ -471,6 +469,8 @@ void ath11k_pcic_ext_irq_enable(struct ath11k_base *ab) - } - ath11k_pcic_ext_grp_enable(irq_grp); - } -+ -+ set_bit(ATH11K_FLAG_EXT_IRQ_ENABLED, &ab->dev_flags); - } - EXPORT_SYMBOL(ath11k_pcic_ext_irq_enable); - --- -2.43.2 - -From 4a3650a72daf8c2ae2135eaf398f432ea908fd13 Mon Sep 17 00:00:00 2001 -From: Po-Hao Huang <phhuang@realtek.com> -Date: Wed, 29 Nov 2023 15:00:43 +0800 -Subject: [PATCH 1109/1501] wifi: rtw89: fix not entering PS mode after AP - stops -Content-Length: 6477 -Lines: 165 - -[ Upstream commit 0052b3c401cdf39d3c3d12a0c3852175bc9a39c7 ] - -The attempt to enter power save mode might fail if there are still -beacons pending in the queue. This sometimes happens after stopping -P2P GO or AP mode. Extend stop AP function and flush all beacons to -resolve this. - -Signed-off-by: Po-Hao Huang <phhuang@realtek.com> -Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://lore.kernel.org/r/20231129070046.18443-2-pkshih@realtek.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/realtek/rtw89/mac.c | 71 ++++++++++++++++++++++-- - drivers/net/wireless/realtek/rtw89/reg.h | 17 ++++++ - 2 files changed, 82 insertions(+), 6 deletions(-) - -diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c -index 0c5768f41d55..add8a7ff01a5 100644 ---- a/drivers/net/wireless/realtek/rtw89/mac.c -+++ b/drivers/net/wireless/realtek/rtw89/mac.c -@@ -3747,6 +3747,50 @@ static const struct rtw89_port_reg rtw89_port_base_ax = { - R_AX_PORT_HGQ_WINDOW_CFG + 3}, - }; - -+static void rtw89_mac_check_packet_ctrl(struct rtw89_dev *rtwdev, -+ struct rtw89_vif *rtwvif, u8 type) -+{ -+ u8 mask = B_AX_PTCL_DBG_INFO_MASK_BY_PORT(rtwvif->port); -+ u32 reg_info, reg_ctrl; -+ u32 val; -+ int ret; -+ -+ reg_info = rtw89_mac_reg_by_idx(rtwdev, R_AX_PTCL_DBG_INFO, rtwvif->mac_idx); -+ reg_ctrl = rtw89_mac_reg_by_idx(rtwdev, R_AX_PTCL_DBG, rtwvif->mac_idx); -+ -+ rtw89_write32_mask(rtwdev, reg_ctrl, B_AX_PTCL_DBG_SEL_MASK, type); -+ rtw89_write32_set(rtwdev, reg_ctrl, B_AX_PTCL_DBG_EN); -+ fsleep(100); -+ -+ ret = read_poll_timeout(rtw89_read32_mask, val, val == 0, 1000, 100000, -+ true, rtwdev, reg_info, mask); -+ if (ret) -+ rtw89_warn(rtwdev, "Polling beacon packet empty fail\n"); -+} -+ -+static void rtw89_mac_bcn_drop(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif) -+{ -+ const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def; -+ const struct rtw89_port_reg *p = mac->port_base; -+ -+ rtw89_write32_set(rtwdev, R_AX_BCN_DROP_ALL0, BIT(rtwvif->port)); -+ rtw89_write32_port_mask(rtwdev, rtwvif, p->tbtt_prohib, B_AX_TBTT_SETUP_MASK, 1); -+ rtw89_write32_port_mask(rtwdev, rtwvif, p->bcn_area, B_AX_BCN_MSK_AREA_MASK, 0); -+ rtw89_write32_port_mask(rtwdev, rtwvif, p->tbtt_prohib, B_AX_TBTT_HOLD_MASK, 0); -+ rtw89_write32_port_mask(rtwdev, rtwvif, p->bcn_early, B_AX_BCNERLY_MASK, 2); -+ rtw89_write16_port_mask(rtwdev, rtwvif, p->tbtt_early, B_AX_TBTTERLY_MASK, 1); -+ rtw89_write32_port_mask(rtwdev, rtwvif, p->bcn_space, B_AX_BCN_SPACE_MASK, 1); -+ rtw89_write32_port_set(rtwdev, rtwvif, p->port_cfg, B_AX_BCNTX_EN); -+ -+ rtw89_mac_check_packet_ctrl(rtwdev, rtwvif, AX_PTCL_DBG_BCNQ_NUM0); -+ if (rtwvif->port == RTW89_PORT_0) -+ rtw89_mac_check_packet_ctrl(rtwdev, rtwvif, AX_PTCL_DBG_BCNQ_NUM1); -+ -+ rtw89_write32_clr(rtwdev, R_AX_BCN_DROP_ALL0, BIT(rtwvif->port)); -+ rtw89_write32_port_clr(rtwdev, rtwvif, p->port_cfg, B_AX_TBTT_PROHIB_EN); -+ fsleep(2); -+} -+ - #define BCN_INTERVAL 100 - #define BCN_ERLY_DEF 160 - #define BCN_SETUP_DEF 2 -@@ -3762,21 +3806,36 @@ static void rtw89_mac_port_cfg_func_sw(struct rtw89_dev *rtwdev, - const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def; - const struct rtw89_port_reg *p = mac->port_base; - struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif); -+ const struct rtw89_chip_info *chip = rtwdev->chip; -+ bool need_backup = false; -+ u32 backup_val; - - if (!rtw89_read32_port_mask(rtwdev, rtwvif, p->port_cfg, B_AX_PORT_FUNC_EN)) - return; - -- rtw89_write32_port_clr(rtwdev, rtwvif, p->tbtt_prohib, B_AX_TBTT_SETUP_MASK); -- rtw89_write32_port_mask(rtwdev, rtwvif, p->tbtt_prohib, B_AX_TBTT_HOLD_MASK, 1); -- rtw89_write16_port_clr(rtwdev, rtwvif, p->tbtt_early, B_AX_TBTTERLY_MASK); -- rtw89_write16_port_clr(rtwdev, rtwvif, p->bcn_early, B_AX_BCNERLY_MASK); -+ if (chip->chip_id == RTL8852A && rtwvif->port != RTW89_PORT_0) { -+ need_backup = true; -+ backup_val = rtw89_read32_port(rtwdev, rtwvif, p->tbtt_prohib); -+ } -+ -+ if (rtwvif->net_type == RTW89_NET_TYPE_AP_MODE) -+ rtw89_mac_bcn_drop(rtwdev, rtwvif); -+ -+ if (chip->chip_id == RTL8852A) { -+ rtw89_write32_port_clr(rtwdev, rtwvif, p->tbtt_prohib, B_AX_TBTT_SETUP_MASK); -+ rtw89_write32_port_mask(rtwdev, rtwvif, p->tbtt_prohib, B_AX_TBTT_HOLD_MASK, 1); -+ rtw89_write16_port_clr(rtwdev, rtwvif, p->tbtt_early, B_AX_TBTTERLY_MASK); -+ rtw89_write16_port_clr(rtwdev, rtwvif, p->bcn_early, B_AX_BCNERLY_MASK); -+ } - - msleep(vif->bss_conf.beacon_int + 1); -- - rtw89_write32_port_clr(rtwdev, rtwvif, p->port_cfg, B_AX_PORT_FUNC_EN | - B_AX_BRK_SETUP); - rtw89_write32_port_set(rtwdev, rtwvif, p->port_cfg, B_AX_TSFTR_RST); - rtw89_write32_port(rtwdev, rtwvif, p->bcn_cnt_tmr, 0); -+ -+ if (need_backup) -+ rtw89_write32_port(rtwdev, rtwvif, p->tbtt_prohib, backup_val); - } - - static void rtw89_mac_port_cfg_tx_rpt(struct rtw89_dev *rtwdev, -@@ -4261,7 +4320,7 @@ void rtw89_mac_set_he_obss_narrow_bw_ru(struct rtw89_dev *rtwdev, - - void rtw89_mac_stop_ap(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif) - { -- rtw89_mac_port_cfg_func_en(rtwdev, rtwvif, false); -+ rtw89_mac_port_cfg_func_sw(rtwdev, rtwvif); - } - - int rtw89_mac_add_vif(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif) -diff --git a/drivers/net/wireless/realtek/rtw89/reg.h b/drivers/net/wireless/realtek/rtw89/reg.h -index ccd5481e8a3d..672010b9e026 100644 ---- a/drivers/net/wireless/realtek/rtw89/reg.h -+++ b/drivers/net/wireless/realtek/rtw89/reg.h -@@ -2375,6 +2375,14 @@ - #define R_AX_TSFTR_HIGH_P4 0xC53C - #define B_AX_TSFTR_HIGH_MASK GENMASK(31, 0) - -+#define R_AX_BCN_DROP_ALL0 0xC560 -+#define R_AX_BCN_DROP_ALL0_C1 0xE560 -+#define B_AX_BCN_DROP_ALL_P4 BIT(4) -+#define B_AX_BCN_DROP_ALL_P3 BIT(3) -+#define B_AX_BCN_DROP_ALL_P2 BIT(2) -+#define B_AX_BCN_DROP_ALL_P1 BIT(1) -+#define B_AX_BCN_DROP_ALL_P0 BIT(0) -+ - #define R_AX_MBSSID_CTRL 0xC568 - #define R_AX_MBSSID_CTRL_C1 0xE568 - #define B_AX_P0MB_ALL_MASK GENMASK(23, 1) -@@ -2554,11 +2562,20 @@ - - #define R_AX_PTCL_DBG_INFO 0xC6F0 - #define R_AX_PTCL_DBG_INFO_C1 0xE6F0 -+#define B_AX_PTCL_DBG_INFO_MASK_BY_PORT(port) \ -+({\ -+ typeof(port) _port = (port); \ -+ GENMASK((_port) * 2 + 1, (_port) * 2); \ -+}) -+ - #define B_AX_PTCL_DBG_INFO_MASK GENMASK(31, 0) - #define R_AX_PTCL_DBG 0xC6F4 - #define R_AX_PTCL_DBG_C1 0xE6F4 - #define B_AX_PTCL_DBG_EN BIT(8) - #define B_AX_PTCL_DBG_SEL_MASK GENMASK(7, 0) -+#define AX_PTCL_DBG_BCNQ_NUM0 8 -+#define AX_PTCL_DBG_BCNQ_NUM1 9 -+ - - #define R_AX_DLE_CTRL 0xC800 - #define R_AX_DLE_CTRL_C1 0xE800 --- -2.43.2 - -From 5b89a66cde6601eee2ca3760631066d4fb906969 Mon Sep 17 00:00:00 2001 -From: Chih-Kang Chang <gary.chang@realtek.com> -Date: Wed, 29 Nov 2023 15:00:46 +0800 -Subject: [PATCH 1110/1501] wifi: rtw89: fix misbehavior of TX beacon in - concurrent mode -Content-Length: 6905 -Lines: 165 - -[ Upstream commit 756b31203d482d2dd1aa6c208978b0410dc7530f ] - -In concurrent mode, when STA interface is scanning, it causes -AP interface TX beacon on wrong channel. We modified it to scan -with the operating channel when one of the interfaces is already -connected. Additionally, STA interface need to stop scan when AP -interface is starting to avoid TX beacon on wrong channel. Finally, -AP interface need to stop TX beacon when STA interface is scanning -and switching to non-OP channel,This prevent other device to get -beacons on wrong channel. - -Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com> -Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://lore.kernel.org/r/20231129070046.18443-5-pkshih@realtek.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/realtek/rtw89/fw.c | 17 +++++++++-- - drivers/net/wireless/realtek/rtw89/mac.c | 29 +++++++++++++++---- - drivers/net/wireless/realtek/rtw89/mac.h | 1 + - drivers/net/wireless/realtek/rtw89/mac80211.c | 3 ++ - 4 files changed, 43 insertions(+), 7 deletions(-) - -diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c -index a732c22a2d54..313ed4c45464 100644 ---- a/drivers/net/wireless/realtek/rtw89/fw.c -+++ b/drivers/net/wireless/realtek/rtw89/fw.c -@@ -4043,6 +4043,7 @@ void rtw89_hw_scan_complete(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif, - rtw89_core_scan_complete(rtwdev, vif, true); - ieee80211_scan_completed(rtwdev->hw, &info); - ieee80211_wake_queues(rtwdev->hw); -+ rtw89_mac_enable_beacon_for_ap_vifs(rtwdev, true); - - rtw89_release_pkt_list(rtwdev); - rtwvif = (struct rtw89_vif *)vif->drv_priv; -@@ -4060,6 +4061,19 @@ void rtw89_hw_scan_abort(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif) - rtw89_hw_scan_complete(rtwdev, vif, true); - } - -+static bool rtw89_is_any_vif_connected_or_connecting(struct rtw89_dev *rtwdev) -+{ -+ struct rtw89_vif *rtwvif; -+ -+ rtw89_for_each_rtwvif(rtwdev, rtwvif) { -+ /* This variable implies connected or during attempt to connect */ -+ if (!is_zero_ether_addr(rtwvif->bssid)) -+ return true; -+ } -+ -+ return false; -+} -+ - int rtw89_hw_scan_offload(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif, - bool enable) - { -@@ -4072,8 +4086,7 @@ int rtw89_hw_scan_offload(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif, - if (!rtwvif) - return -EINVAL; - -- /* This variable implies connected or during attempt to connect */ -- connected = !is_zero_ether_addr(rtwvif->bssid); -+ connected = rtw89_is_any_vif_connected_or_connecting(rtwdev); - opt.enable = enable; - opt.target_ch_mode = connected; - if (enable) { -diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c -index add8a7ff01a5..d0c7de4e80dc 100644 ---- a/drivers/net/wireless/realtek/rtw89/mac.c -+++ b/drivers/net/wireless/realtek/rtw89/mac.c -@@ -3916,12 +3916,10 @@ static void rtw89_mac_port_cfg_rx_sync(struct rtw89_dev *rtwdev, - } - - static void rtw89_mac_port_cfg_tx_sw(struct rtw89_dev *rtwdev, -- struct rtw89_vif *rtwvif) -+ struct rtw89_vif *rtwvif, bool en) - { - const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def; - const struct rtw89_port_reg *p = mac->port_base; -- bool en = rtwvif->net_type == RTW89_NET_TYPE_AP_MODE || -- rtwvif->net_type == RTW89_NET_TYPE_AD_HOC; - - if (en) - rtw89_write32_port_set(rtwdev, rtwvif, p->port_cfg, B_AX_BCNTX_EN); -@@ -3929,6 +3927,24 @@ static void rtw89_mac_port_cfg_tx_sw(struct rtw89_dev *rtwdev, - rtw89_write32_port_clr(rtwdev, rtwvif, p->port_cfg, B_AX_BCNTX_EN); - } - -+static void rtw89_mac_port_cfg_tx_sw_by_nettype(struct rtw89_dev *rtwdev, -+ struct rtw89_vif *rtwvif) -+{ -+ bool en = rtwvif->net_type == RTW89_NET_TYPE_AP_MODE || -+ rtwvif->net_type == RTW89_NET_TYPE_AD_HOC; -+ -+ rtw89_mac_port_cfg_tx_sw(rtwdev, rtwvif, en); -+} -+ -+void rtw89_mac_enable_beacon_for_ap_vifs(struct rtw89_dev *rtwdev, bool en) -+{ -+ struct rtw89_vif *rtwvif; -+ -+ rtw89_for_each_rtwvif(rtwdev, rtwvif) -+ if (rtwvif->net_type == RTW89_NET_TYPE_AP_MODE) -+ rtw89_mac_port_cfg_tx_sw(rtwdev, rtwvif, en); -+} -+ - static void rtw89_mac_port_cfg_bcn_intv(struct rtw89_dev *rtwdev, - struct rtw89_vif *rtwvif) - { -@@ -4235,7 +4251,7 @@ int rtw89_mac_port_update(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif) - rtw89_mac_port_cfg_bcn_prct(rtwdev, rtwvif); - rtw89_mac_port_cfg_rx_sw(rtwdev, rtwvif); - rtw89_mac_port_cfg_rx_sync(rtwdev, rtwvif); -- rtw89_mac_port_cfg_tx_sw(rtwdev, rtwvif); -+ rtw89_mac_port_cfg_tx_sw_by_nettype(rtwdev, rtwvif); - rtw89_mac_port_cfg_bcn_intv(rtwdev, rtwvif); - rtw89_mac_port_cfg_hiq_win(rtwdev, rtwvif); - rtw89_mac_port_cfg_hiq_dtim(rtwdev, rtwvif); -@@ -4397,8 +4413,10 @@ rtw89_mac_c2h_scanofld_rsp(struct rtw89_dev *rtwdev, struct sk_buff *c2h, - - switch (reason) { - case RTW89_SCAN_LEAVE_CH_NOTIFY: -- if (rtw89_is_op_chan(rtwdev, band, chan)) -+ if (rtw89_is_op_chan(rtwdev, band, chan)) { -+ rtw89_mac_enable_beacon_for_ap_vifs(rtwdev, false); - ieee80211_stop_queues(rtwdev->hw); -+ } - return; - case RTW89_SCAN_END_SCAN_NOTIFY: - if (rtwvif && rtwvif->scan_req && -@@ -4416,6 +4434,7 @@ rtw89_mac_c2h_scanofld_rsp(struct rtw89_dev *rtwdev, struct sk_buff *c2h, - if (rtw89_is_op_chan(rtwdev, band, chan)) { - rtw89_assign_entity_chan(rtwdev, rtwvif->sub_entity_idx, - &rtwdev->scan_info.op_chan); -+ rtw89_mac_enable_beacon_for_ap_vifs(rtwdev, true); - ieee80211_wake_queues(rtwdev->hw); - } else { - rtw89_chan_create(&new, chan, chan, band, -diff --git a/drivers/net/wireless/realtek/rtw89/mac.h b/drivers/net/wireless/realtek/rtw89/mac.h -index c11c904f87fe..f9fef678f314 100644 ---- a/drivers/net/wireless/realtek/rtw89/mac.h -+++ b/drivers/net/wireless/realtek/rtw89/mac.h -@@ -992,6 +992,7 @@ int rtw89_mac_port_get_tsf(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif, - void rtw89_mac_set_he_obss_narrow_bw_ru(struct rtw89_dev *rtwdev, - struct ieee80211_vif *vif); - void rtw89_mac_stop_ap(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif); -+void rtw89_mac_enable_beacon_for_ap_vifs(struct rtw89_dev *rtwdev, bool en); - int rtw89_mac_remove_vif(struct rtw89_dev *rtwdev, struct rtw89_vif *vif); - int rtw89_mac_enable_bb_rf(struct rtw89_dev *rtwdev); - int rtw89_mac_disable_bb_rf(struct rtw89_dev *rtwdev); -diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c -index 31d1f7891675..b7ceaf5595eb 100644 ---- a/drivers/net/wireless/realtek/rtw89/mac80211.c -+++ b/drivers/net/wireless/realtek/rtw89/mac80211.c -@@ -477,6 +477,9 @@ static int rtw89_ops_start_ap(struct ieee80211_hw *hw, - return -EOPNOTSUPP; - } - -+ if (rtwdev->scanning) -+ rtw89_hw_scan_abort(rtwdev, rtwdev->scan_info.scanning_vif); -+ - ether_addr_copy(rtwvif->bssid, vif->bss_conf.bssid); - rtw89_cam_bssid_changed(rtwdev, rtwvif); - rtw89_mac_port_update(rtwdev, rtwvif); --- -2.43.2 - -From c7f1b6146f4a46d727c0d046284c28b6882c6304 Mon Sep 17 00:00:00 2001 -From: Hou Tao <houtao1@huawei.com> -Date: Mon, 4 Dec 2023 22:04:19 +0800 -Subject: [PATCH 1111/1501] bpf: Check rcu_read_lock_trace_held() before - calling bpf map helpers -Content-Length: 3303 -Lines: 87 - -[ Upstream commit 169410eba271afc9f0fb476d996795aa26770c6d ] - -These three bpf_map_{lookup,update,delete}_elem() helpers are also -available for sleepable bpf program, so add the corresponding lock -assertion for sleepable bpf program, otherwise the following warning -will be reported when a sleepable bpf program manipulates bpf map under -interpreter mode (aka bpf_jit_enable=0): - - WARNING: CPU: 3 PID: 4985 at kernel/bpf/helpers.c:40 ...... - CPU: 3 PID: 4985 Comm: test_progs Not tainted 6.6.0+ #2 - Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... - RIP: 0010:bpf_map_lookup_elem+0x54/0x60 - ...... - Call Trace: - <TASK> - ? __warn+0xa5/0x240 - ? bpf_map_lookup_elem+0x54/0x60 - ? report_bug+0x1ba/0x1f0 - ? handle_bug+0x40/0x80 - ? exc_invalid_op+0x18/0x50 - ? asm_exc_invalid_op+0x1b/0x20 - ? __pfx_bpf_map_lookup_elem+0x10/0x10 - ? rcu_lockdep_current_cpu_online+0x65/0xb0 - ? rcu_is_watching+0x23/0x50 - ? bpf_map_lookup_elem+0x54/0x60 - ? __pfx_bpf_map_lookup_elem+0x10/0x10 - ___bpf_prog_run+0x513/0x3b70 - __bpf_prog_run32+0x9d/0xd0 - ? __bpf_prog_enter_sleepable_recur+0xad/0x120 - ? __bpf_prog_enter_sleepable_recur+0x3e/0x120 - bpf_trampoline_6442580665+0x4d/0x1000 - __x64_sys_getpgid+0x5/0x30 - ? do_syscall_64+0x36/0xb0 - entry_SYSCALL_64_after_hwframe+0x6e/0x76 - </TASK> - -Signed-off-by: Hou Tao <houtao1@huawei.com> -Link: https://lore.kernel.org/r/20231204140425.1480317-2-houtao@huaweicloud.com -Signed-off-by: Alexei Starovoitov <ast@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - kernel/bpf/helpers.c | 13 ++++++++----- - 1 file changed, 8 insertions(+), 5 deletions(-) - -diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c -index 6950f0461634..991186520af0 100644 ---- a/kernel/bpf/helpers.c -+++ b/kernel/bpf/helpers.c -@@ -32,12 +32,13 @@ - * - * Different map implementations will rely on rcu in map methods - * lookup/update/delete, therefore eBPF programs must run under rcu lock -- * if program is allowed to access maps, so check rcu_read_lock_held in -- * all three functions. -+ * if program is allowed to access maps, so check rcu_read_lock_held() or -+ * rcu_read_lock_trace_held() in all three functions. - */ - BPF_CALL_2(bpf_map_lookup_elem, struct bpf_map *, map, void *, key) - { -- WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_bh_held()); -+ WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held() && -+ !rcu_read_lock_bh_held()); - return (unsigned long) map->ops->map_lookup_elem(map, key); - } - -@@ -53,7 +54,8 @@ const struct bpf_func_proto bpf_map_lookup_elem_proto = { - BPF_CALL_4(bpf_map_update_elem, struct bpf_map *, map, void *, key, - void *, value, u64, flags) - { -- WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_bh_held()); -+ WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held() && -+ !rcu_read_lock_bh_held()); - return map->ops->map_update_elem(map, key, value, flags); - } - -@@ -70,7 +72,8 @@ const struct bpf_func_proto bpf_map_update_elem_proto = { - - BPF_CALL_2(bpf_map_delete_elem, struct bpf_map *, map, void *, key) - { -- WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_bh_held()); -+ WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held() && -+ !rcu_read_lock_bh_held()); - return map->ops->map_delete_elem(map, key); - } - --- -2.43.2 - -From 776c56ef119a795260021f0608e9a1609832b658 Mon Sep 17 00:00:00 2001 -From: Hou Tao <houtao1@huawei.com> -Date: Mon, 4 Dec 2023 22:04:21 +0800 -Subject: [PATCH 1112/1501] bpf: Set need_defer as false when clearing fd array - during map free -Content-Length: 4158 -Lines: 119 - -[ Upstream commit 79d93b3c6ffd79abcd8e43345980aa1e904879c4 ] - -Both map deletion operation, map release and map free operation use -fd_array_map_delete_elem() to remove the element from fd array and -need_defer is always true in fd_array_map_delete_elem(). For the map -deletion operation and map release operation, need_defer=true is -necessary, because the bpf program, which accesses the element in fd -array, may still alive. However for map free operation, it is certain -that the bpf program which owns the fd array has already been exited, so -setting need_defer as false is appropriate for map free operation. - -So fix it by adding need_defer parameter to bpf_fd_array_map_clear() and -adding a new helper __fd_array_map_delete_elem() to handle the map -deletion, map release and map free operations correspondingly. - -Signed-off-by: Hou Tao <houtao1@huawei.com> -Link: https://lore.kernel.org/r/20231204140425.1480317-4-houtao@huaweicloud.com -Signed-off-by: Alexei Starovoitov <ast@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - kernel/bpf/arraymap.c | 23 ++++++++++++++--------- - 1 file changed, 14 insertions(+), 9 deletions(-) - -diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c -index 9bfad7e96913..c9843dde6908 100644 ---- a/kernel/bpf/arraymap.c -+++ b/kernel/bpf/arraymap.c -@@ -871,7 +871,7 @@ int bpf_fd_array_map_update_elem(struct bpf_map *map, struct file *map_file, - return 0; - } - --static long fd_array_map_delete_elem(struct bpf_map *map, void *key) -+static long __fd_array_map_delete_elem(struct bpf_map *map, void *key, bool need_defer) - { - struct bpf_array *array = container_of(map, struct bpf_array, map); - void *old_ptr; -@@ -890,13 +890,18 @@ static long fd_array_map_delete_elem(struct bpf_map *map, void *key) - } - - if (old_ptr) { -- map->ops->map_fd_put_ptr(map, old_ptr, true); -+ map->ops->map_fd_put_ptr(map, old_ptr, need_defer); - return 0; - } else { - return -ENOENT; - } - } - -+static long fd_array_map_delete_elem(struct bpf_map *map, void *key) -+{ -+ return __fd_array_map_delete_elem(map, key, true); -+} -+ - static void *prog_fd_array_get_ptr(struct bpf_map *map, - struct file *map_file, int fd) - { -@@ -925,13 +930,13 @@ static u32 prog_fd_array_sys_lookup_elem(void *ptr) - } - - /* decrement refcnt of all bpf_progs that are stored in this map */ --static void bpf_fd_array_map_clear(struct bpf_map *map) -+static void bpf_fd_array_map_clear(struct bpf_map *map, bool need_defer) - { - struct bpf_array *array = container_of(map, struct bpf_array, map); - int i; - - for (i = 0; i < array->map.max_entries; i++) -- fd_array_map_delete_elem(map, &i); -+ __fd_array_map_delete_elem(map, &i, need_defer); - } - - static void prog_array_map_seq_show_elem(struct bpf_map *map, void *key, -@@ -1072,7 +1077,7 @@ static void prog_array_map_clear_deferred(struct work_struct *work) - { - struct bpf_map *map = container_of(work, struct bpf_array_aux, - work)->map; -- bpf_fd_array_map_clear(map); -+ bpf_fd_array_map_clear(map, true); - bpf_map_put(map); - } - -@@ -1222,7 +1227,7 @@ static void perf_event_fd_array_release(struct bpf_map *map, - for (i = 0; i < array->map.max_entries; i++) { - ee = READ_ONCE(array->ptrs[i]); - if (ee && ee->map_file == map_file) -- fd_array_map_delete_elem(map, &i); -+ __fd_array_map_delete_elem(map, &i, true); - } - rcu_read_unlock(); - } -@@ -1230,7 +1235,7 @@ static void perf_event_fd_array_release(struct bpf_map *map, - static void perf_event_fd_array_map_free(struct bpf_map *map) - { - if (map->map_flags & BPF_F_PRESERVE_ELEMS) -- bpf_fd_array_map_clear(map); -+ bpf_fd_array_map_clear(map, false); - fd_array_map_free(map); - } - -@@ -1266,7 +1271,7 @@ static void cgroup_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_de - - static void cgroup_fd_array_free(struct bpf_map *map) - { -- bpf_fd_array_map_clear(map); -+ bpf_fd_array_map_clear(map, false); - fd_array_map_free(map); - } - -@@ -1311,7 +1316,7 @@ static void array_of_map_free(struct bpf_map *map) - * is protected by fdget/fdput. - */ - bpf_map_meta_free(map->inner_map_meta); -- bpf_fd_array_map_clear(map); -+ bpf_fd_array_map_clear(map, false); - fd_array_map_free(map); - } - --- -2.43.2 - -From 7409b7e5714dc8e59460b6de50c6c08692b2d1c1 Mon Sep 17 00:00:00 2001 -From: Kang Yang <quic_kangyang@quicinc.com> -Date: Fri, 1 Dec 2023 18:09:48 +0200 -Subject: [PATCH 1113/1501] wifi: ath12k: fix and enable AP mode for WCN7850 -Content-Length: 2460 -Lines: 66 - -[ Upstream commit ed7e818a7b501012038d6bc6fedadaf7375a380a ] - -For AP mode, the peer is created earlier in ath12k_mac_op_add_interface() but -ath12k_mac_op_assign_vif_chanctx() will try to create peer again. Then an -error will return which makes AP mode startup fail. - -Kernel log: - -[ 5017.665006] ath12k_pci 0000:04:00.0: failed to create peer after vdev start delay: -22 - -wpa_supplicant log: - -Failed to set beacon parameters -Interface initialization failed -wls1: interface state UNINITIALIZED->DISABLED -wls1: AP-DISABLED -wls1: Unable to setup interface. -Failed to initialize AP interface -wls1: interface state DISABLED->DISABLED -wls1: AP-DISABLED - -So fix this check and enable AP mode for WCN7850, as now AP mode works normally. - -Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 - -Signed-off-by: Kang Yang <quic_kangyang@quicinc.com> -Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com> -Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> -Link: https://lore.kernel.org/r/20231121022459.17209-1-quic_kangyang@quicinc.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/ath/ath12k/hw.c | 3 ++- - drivers/net/wireless/ath/ath12k/mac.c | 4 ++-- - 2 files changed, 4 insertions(+), 3 deletions(-) - -diff --git a/drivers/net/wireless/ath/ath12k/hw.c b/drivers/net/wireless/ath/ath12k/hw.c -index 2245fb510ba2..b55cf33e37bd 100644 ---- a/drivers/net/wireless/ath/ath12k/hw.c -+++ b/drivers/net/wireless/ath/ath12k/hw.c -@@ -949,7 +949,8 @@ static const struct ath12k_hw_params ath12k_hw_params[] = { - .rx_mac_buf_ring = true, - .vdev_start_delay = true, - -- .interface_modes = BIT(NL80211_IFTYPE_STATION), -+ .interface_modes = BIT(NL80211_IFTYPE_STATION) | -+ BIT(NL80211_IFTYPE_AP), - .supports_monitor = false, - - .idle_ps = true, -diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c -index fc0d14ea328e..b698e55a5b7b 100644 ---- a/drivers/net/wireless/ath/ath12k/mac.c -+++ b/drivers/net/wireless/ath/ath12k/mac.c -@@ -6380,8 +6380,8 @@ ath12k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw, - } - - if (ab->hw_params->vdev_start_delay && -- (arvif->vdev_type == WMI_VDEV_TYPE_AP || -- arvif->vdev_type == WMI_VDEV_TYPE_MONITOR)) { -+ arvif->vdev_type != WMI_VDEV_TYPE_AP && -+ arvif->vdev_type != WMI_VDEV_TYPE_MONITOR) { - param.vdev_id = arvif->vdev_id; - param.peer_type = WMI_PEER_TYPE_DEFAULT; - param.peer_addr = ar->mac_addr; --- -2.43.2 - -From 159442593f20443e5274c4d330f467e8bccca571 Mon Sep 17 00:00:00 2001 -From: Hannes Reinecke <hare@suse.de> -Date: Wed, 29 Nov 2023 17:58:30 +0100 -Subject: [PATCH 1114/1501] scsi: libfc: Don't schedule abort twice -Content-Length: 2273 -Lines: 60 - -[ Upstream commit b57c4db5d23b9df0118a25e2441c9288edd73710 ] - -The current FC error recovery is sending up to three REC (recovery) frames -in 10 second intervals, and as a final step sending an ABTS after 30 -seconds for the command itself. Unfortunately sending an ABTS is also the -action for the SCSI abort handler, and the default timeout for SCSI -commands is also 30 seconds. This causes two ABTS to be scheduled, with the -libfc one slightly earlier. The ABTS scheduled by SCSI EH then sees the -command to be already aborted, and will always return with a 'GOOD' status -irrespective on the actual result from the first ABTS. This causes the -SCSI EH abort handler to always succeed, and SCSI EH never to be engaged. -Fix this by not issuing an ABTS when a SCSI command is present for the -exchange, but rather wait for the abort scheduled from SCSI EH. And warn -if an abort is already scheduled to avoid similar errors in the future. - -Signed-off-by: Hannes Reinecke <hare@suse.de> -Link: https://lore.kernel.org/r/20231129165832.224100-2-hare@kernel.org -Reviewed-by: Christoph Hellwig <hch@lst.de> -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/scsi/libfc/fc_fcp.c | 16 +++++++++++----- - 1 file changed, 11 insertions(+), 5 deletions(-) - -diff --git a/drivers/scsi/libfc/fc_fcp.c b/drivers/scsi/libfc/fc_fcp.c -index 945adca5e72f..3f189cedf6db 100644 ---- a/drivers/scsi/libfc/fc_fcp.c -+++ b/drivers/scsi/libfc/fc_fcp.c -@@ -265,6 +265,11 @@ static int fc_fcp_send_abort(struct fc_fcp_pkt *fsp) - if (!fsp->seq_ptr) - return -EINVAL; - -+ if (fsp->state & FC_SRB_ABORT_PENDING) { -+ FC_FCP_DBG(fsp, "abort already pending\n"); -+ return -EBUSY; -+ } -+ - this_cpu_inc(fsp->lp->stats->FcpPktAborts); - - fsp->state |= FC_SRB_ABORT_PENDING; -@@ -1690,11 +1695,12 @@ static void fc_fcp_recovery(struct fc_fcp_pkt *fsp, u8 code) - fsp->status_code = code; - fsp->cdb_status = 0; - fsp->io_status = 0; -- /* -- * if this fails then we let the scsi command timer fire and -- * scsi-ml escalate. -- */ -- fc_fcp_send_abort(fsp); -+ if (!fsp->cmd) -+ /* -+ * Only abort non-scsi commands; otherwise let the -+ * scsi command timer fire and scsi-ml escalate. -+ */ -+ fc_fcp_send_abort(fsp); - } - - /** --- -2.43.2 - -From de201a8bd54e4df0594cb5982c18bf47eff207ec Mon Sep 17 00:00:00 2001 -From: Hannes Reinecke <hare@suse.de> -Date: Wed, 29 Nov 2023 17:58:31 +0100 -Subject: [PATCH 1115/1501] scsi: libfc: Fix up timeout error in - fc_fcp_rec_error() -Content-Length: 997 -Lines: 29 - -[ Upstream commit 53122a49f49796beb2c4a1bb702303b66347e29f ] - -We should set the status to FC_TIMED_OUT when a timeout error is passed to -fc_fcp_rec_error(). - -Signed-off-by: Hannes Reinecke <hare@suse.de> -Link: https://lore.kernel.org/r/20231129165832.224100-3-hare@kernel.org -Reviewed-by: Christoph Hellwig <hch@lst.de> -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/scsi/libfc/fc_fcp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/scsi/libfc/fc_fcp.c b/drivers/scsi/libfc/fc_fcp.c -index 3f189cedf6db..05be0810b5e3 100644 ---- a/drivers/scsi/libfc/fc_fcp.c -+++ b/drivers/scsi/libfc/fc_fcp.c -@@ -1676,7 +1676,7 @@ static void fc_fcp_rec_error(struct fc_fcp_pkt *fsp, struct fc_frame *fp) - if (fsp->recov_retry++ < FC_MAX_RECOV_RETRY) - fc_fcp_rec(fsp); - else -- fc_fcp_recovery(fsp, FC_ERROR); -+ fc_fcp_recovery(fsp, FC_TIMED_OUT); - break; - } - fc_fcp_unlock_pkt(fsp); --- -2.43.2 - -From d5be50156a26293f8bbb1a8accb3f081305ad2ad Mon Sep 17 00:00:00 2001 -From: Tobias Waldekranz <tobias@waldekranz.com> -Date: Mon, 4 Dec 2023 11:08:10 +0100 -Subject: [PATCH 1116/1501] net: mvmdio: Avoid excessive sleeps in polled mode -Content-Length: 4288 -Lines: 130 - -[ Upstream commit 7dd12fe34686d89c332b1a05104d18d728591f0a ] - -Before this change, when operating in polled mode, i.e. no IRQ is -available, every individual C45 access would be hit with a 150us sleep -after the bus access. - -For example, on a board with a CN9130 SoC connected to an MV88X3310 -PHY, a single C45 read would take around 165us: - - root@infix:~$ mdio f212a600.mdio-mii mmd 4:1 bench 0xc003 - Performed 1000 reads in 165ms - -By replacing the long sleep with a tighter poll loop, we observe a 10x -increase in bus throughput: - - root@infix:~$ mdio f212a600.mdio-mii mmd 4:1 bench 0xc003 - Performed 1000 reads in 15ms - -Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com> -Reviewed-by: Andrew Lunn <andrew@lunn.ch> -Tested-by: Andrew Lunn <andrew@lunn.ch> -Link: https://lore.kernel.org/r/20231204100811.2708884-3-tobias@waldekranz.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/marvell/mvmdio.c | 51 ++++++++------------------- - 1 file changed, 15 insertions(+), 36 deletions(-) - -diff --git a/drivers/net/ethernet/marvell/mvmdio.c b/drivers/net/ethernet/marvell/mvmdio.c -index 89f26402f8fb..5f66f779e56f 100644 ---- a/drivers/net/ethernet/marvell/mvmdio.c -+++ b/drivers/net/ethernet/marvell/mvmdio.c -@@ -23,6 +23,7 @@ - #include <linux/delay.h> - #include <linux/interrupt.h> - #include <linux/io.h> -+#include <linux/iopoll.h> - #include <linux/kernel.h> - #include <linux/mod_devicetable.h> - #include <linux/module.h> -@@ -58,11 +59,6 @@ - * - Armada 370 (Globalscale Mirabox): 41us to 43us (Polled) - */ - #define MVMDIO_SMI_TIMEOUT 1000 /* 1000us = 1ms */ --#define MVMDIO_SMI_POLL_INTERVAL_MIN 45 --#define MVMDIO_SMI_POLL_INTERVAL_MAX 55 -- --#define MVMDIO_XSMI_POLL_INTERVAL_MIN 150 --#define MVMDIO_XSMI_POLL_INTERVAL_MAX 160 - - struct orion_mdio_dev { - void __iomem *regs; -@@ -84,8 +80,6 @@ enum orion_mdio_bus_type { - - struct orion_mdio_ops { - int (*is_done)(struct orion_mdio_dev *); -- unsigned int poll_interval_min; -- unsigned int poll_interval_max; - }; - - /* Wait for the SMI unit to be ready for another operation -@@ -94,34 +88,23 @@ static int orion_mdio_wait_ready(const struct orion_mdio_ops *ops, - struct mii_bus *bus) - { - struct orion_mdio_dev *dev = bus->priv; -- unsigned long timeout = usecs_to_jiffies(MVMDIO_SMI_TIMEOUT); -- unsigned long end = jiffies + timeout; -- int timedout = 0; -+ unsigned long timeout; -+ int done; - -- while (1) { -- if (ops->is_done(dev)) -+ if (dev->err_interrupt <= 0) { -+ if (!read_poll_timeout_atomic(ops->is_done, done, done, 2, -+ MVMDIO_SMI_TIMEOUT, false, dev)) - return 0; -- else if (timedout) -- break; -+ } else { -+ /* wait_event_timeout does not guarantee a delay of at -+ * least one whole jiffie, so timeout must be no less -+ * than two. -+ */ -+ timeout = max(usecs_to_jiffies(MVMDIO_SMI_TIMEOUT), 2); - -- if (dev->err_interrupt <= 0) { -- usleep_range(ops->poll_interval_min, -- ops->poll_interval_max); -- -- if (time_is_before_jiffies(end)) -- ++timedout; -- } else { -- /* wait_event_timeout does not guarantee a delay of at -- * least one whole jiffie, so timeout must be no less -- * than two. -- */ -- if (timeout < 2) -- timeout = 2; -- wait_event_timeout(dev->smi_busy_wait, -- ops->is_done(dev), timeout); -- -- ++timedout; -- } -+ if (wait_event_timeout(dev->smi_busy_wait, -+ ops->is_done(dev), timeout)) -+ return 0; - } - - dev_err(bus->parent, "Timeout: SMI busy for too long\n"); -@@ -135,8 +118,6 @@ static int orion_mdio_smi_is_done(struct orion_mdio_dev *dev) - - static const struct orion_mdio_ops orion_mdio_smi_ops = { - .is_done = orion_mdio_smi_is_done, -- .poll_interval_min = MVMDIO_SMI_POLL_INTERVAL_MIN, -- .poll_interval_max = MVMDIO_SMI_POLL_INTERVAL_MAX, - }; - - static int orion_mdio_smi_read(struct mii_bus *bus, int mii_id, -@@ -194,8 +175,6 @@ static int orion_mdio_xsmi_is_done(struct orion_mdio_dev *dev) - - static const struct orion_mdio_ops orion_mdio_xsmi_ops = { - .is_done = orion_mdio_xsmi_is_done, -- .poll_interval_min = MVMDIO_XSMI_POLL_INTERVAL_MIN, -- .poll_interval_max = MVMDIO_XSMI_POLL_INTERVAL_MAX, - }; - - static int orion_mdio_xsmi_read_c45(struct mii_bus *bus, int mii_id, --- -2.43.2 - -From b6bbbba3b85c51f99830c29fd062a7c234c97f92 Mon Sep 17 00:00:00 2001 -From: MeiChia Chiu <meichia.chiu@mediatek.com> -Date: Thu, 2 Nov 2023 18:03:02 +0800 -Subject: [PATCH 1120/1501] wifi: mt76: connac: fix EHT phy mode check -Content-Length: 1215 -Lines: 29 - -[ Upstream commit 2c2f50bf6407e1fd43a1a257916aeaa5ffdacd6c ] - -Add a BSS eht_support check before returning EHT phy mode. Without this -patch, there might be an inconsistency where the softmac layer thinks -the BSS is in HE mode, while the FW thinks it is in EHT mode. - -Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com> -Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> -Signed-off-by: Felix Fietkau <nbd@nbd.name> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c -index ae6bf3c968df..b475555097ff 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c -+++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c -@@ -1359,7 +1359,7 @@ u8 mt76_connac_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif, - sband = phy->hw->wiphy->bands[band]; - eht_cap = ieee80211_get_eht_iftype_cap(sband, vif->type); - -- if (!eht_cap || !eht_cap->has_eht) -+ if (!eht_cap || !eht_cap->has_eht || !vif->bss_conf.eht_support) - return mode; - - switch (band) { --- -2.43.2 - -From 23587d856aa956183a083a0c16cc6e801aae10e7 Mon Sep 17 00:00:00 2001 -From: StanleyYP Wang <StanleyYP.Wang@mediatek.com> -Date: Mon, 13 Nov 2023 15:06:19 +0800 -Subject: [PATCH 1121/1501] wifi: mt76: mt7996: add PCI IDs for mt7992 -Content-Length: 1799 -Lines: 52 - -[ Upstream commit 3d3f117a259a65353bf2714a18e25731b3ca5770 ] - -Add PCI device IDs to enable mt7992 chipsets support. - -Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> -Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> -Signed-off-by: Felix Fietkau <nbd@nbd.name> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/mediatek/mt76/mt7996/pci.c | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c -index c5301050ff8b..67c015896243 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c -@@ -17,11 +17,13 @@ static u32 hif_idx; - - static const struct pci_device_id mt7996_pci_device_table[] = { - { PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7990) }, -+ { PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7992) }, - { }, - }; - - static const struct pci_device_id mt7996_hif_device_table[] = { - { PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7991) }, -+ { PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x799a) }, - { }, - }; - -@@ -60,7 +62,9 @@ static void mt7996_put_hif2(struct mt7996_hif *hif) - static struct mt7996_hif *mt7996_pci_init_hif2(struct pci_dev *pdev) - { - hif_idx++; -- if (!pci_get_device(PCI_VENDOR_ID_MEDIATEK, 0x7991, NULL)) -+ -+ if (!pci_get_device(PCI_VENDOR_ID_MEDIATEK, 0x7991, NULL) && -+ !pci_get_device(PCI_VENDOR_ID_MEDIATEK, 0x799a, NULL)) - return NULL; - - writel(hif_idx | MT_PCIE_RECOG_ID_SEM, -@@ -113,7 +117,7 @@ static int mt7996_pci_probe(struct pci_dev *pdev, - - mt76_pci_disable_aspm(pdev); - -- if (id->device == 0x7991) -+ if (id->device == 0x7991 || id->device == 0x799a) - return mt7996_pci_hif2_probe(pdev); - - dev = mt7996_mmio_probe(&pdev->dev, pcim_iomap_table(pdev)[0], --- -2.43.2 - -From fe77396943a02bc82b8d7c55fcb1838a015831ca Mon Sep 17 00:00:00 2001 -From: Hou Tao <houtao1@huawei.com> -Date: Fri, 8 Dec 2023 18:23:53 +0800 -Subject: [PATCH 1122/1501] bpf: Set uattr->batch.count as zero before batched - update or deletion -Content-Length: 1333 -Lines: 43 - -[ Upstream commit 06e5c999f10269a532304e89a6adb2fbfeb0593c ] - -generic_map_{delete,update}_batch() doesn't set uattr->batch.count as -zero before it tries to allocate memory for key. If the memory -allocation fails, the value of uattr->batch.count will be incorrect. - -Fix it by setting uattr->batch.count as zero beore batched update or -deletion. - -Signed-off-by: Hou Tao <houtao1@huawei.com> -Link: https://lore.kernel.org/r/20231208102355.2628918-6-houtao@huaweicloud.com -Signed-off-by: Alexei Starovoitov <ast@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - kernel/bpf/syscall.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c -index 58e34ff81197..349d735b4e1d 100644 ---- a/kernel/bpf/syscall.c -+++ b/kernel/bpf/syscall.c -@@ -1702,6 +1702,9 @@ int generic_map_delete_batch(struct bpf_map *map, - if (!max_count) - return 0; - -+ if (put_user(0, &uattr->batch.count)) -+ return -EFAULT; -+ - key = kvmalloc(map->key_size, GFP_USER | __GFP_NOWARN); - if (!key) - return -ENOMEM; -@@ -1759,6 +1762,9 @@ int generic_map_update_batch(struct bpf_map *map, struct file *map_file, - if (!max_count) - return 0; - -+ if (put_user(0, &uattr->batch.count)) -+ return -EFAULT; -+ - key = kvmalloc(map->key_size, GFP_USER | __GFP_NOWARN); - if (!key) - return -ENOMEM; --- -2.43.2 - -From 3739121443f5114c6bcf6d841a5124deb006b878 Mon Sep 17 00:00:00 2001 -From: Dmitry Antipov <dmantipov@yandex.ru> -Date: Mon, 4 Dec 2023 20:11:28 +0300 -Subject: [PATCH 1123/1501] wifi: wfx: fix possible NULL pointer dereference in - wfx_set_mfp_ap() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 3103 -Lines: 87 - -[ Upstream commit fe0a7776d4d19e613bb8dd80fe2d78ae49e8b49d ] - -Since 'ieee80211_beacon_get()' can return NULL, 'wfx_set_mfp_ap()' -should check the return value before examining skb data. So convert -the latter to return an appropriate error code and propagate it to -return from 'wfx_start_ap()' as well. Compile tested only. - -Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> -Tested-by: Jérôme Pouiller <jerome.pouiller@silabs.com> -Acked-by: Jérôme Pouiller <jerome.pouiller@silabs.com> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://lore.kernel.org/r/20231204171130.141394-1-dmantipov@yandex.ru -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/silabs/wfx/sta.c | 42 ++++++++++++++++----------- - 1 file changed, 25 insertions(+), 17 deletions(-) - -diff --git a/drivers/net/wireless/silabs/wfx/sta.c b/drivers/net/wireless/silabs/wfx/sta.c -index 1b6c158457b4..537caf9d914a 100644 ---- a/drivers/net/wireless/silabs/wfx/sta.c -+++ b/drivers/net/wireless/silabs/wfx/sta.c -@@ -336,29 +336,38 @@ static int wfx_upload_ap_templates(struct wfx_vif *wvif) - return 0; - } - --static void wfx_set_mfp_ap(struct wfx_vif *wvif) -+static int wfx_set_mfp_ap(struct wfx_vif *wvif) - { - struct ieee80211_vif *vif = wvif_to_vif(wvif); - struct sk_buff *skb = ieee80211_beacon_get(wvif->wdev->hw, vif, 0); - const int ieoffset = offsetof(struct ieee80211_mgmt, u.beacon.variable); -- const u16 *ptr = (u16 *)cfg80211_find_ie(WLAN_EID_RSN, skb->data + ieoffset, -- skb->len - ieoffset); - const int pairwise_cipher_suite_count_offset = 8 / sizeof(u16); - const int pairwise_cipher_suite_size = 4 / sizeof(u16); - const int akm_suite_size = 4 / sizeof(u16); -+ const u16 *ptr; - -- if (ptr) { -- ptr += pairwise_cipher_suite_count_offset; -- if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb))) -- return; -- ptr += 1 + pairwise_cipher_suite_size * *ptr; -- if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb))) -- return; -- ptr += 1 + akm_suite_size * *ptr; -- if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb))) -- return; -- wfx_hif_set_mfp(wvif, *ptr & BIT(7), *ptr & BIT(6)); -- } -+ if (unlikely(!skb)) -+ return -ENOMEM; -+ -+ ptr = (u16 *)cfg80211_find_ie(WLAN_EID_RSN, skb->data + ieoffset, -+ skb->len - ieoffset); -+ if (unlikely(!ptr)) -+ return -EINVAL; -+ -+ ptr += pairwise_cipher_suite_count_offset; -+ if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb))) -+ return -EINVAL; -+ -+ ptr += 1 + pairwise_cipher_suite_size * *ptr; -+ if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb))) -+ return -EINVAL; -+ -+ ptr += 1 + akm_suite_size * *ptr; -+ if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb))) -+ return -EINVAL; -+ -+ wfx_hif_set_mfp(wvif, *ptr & BIT(7), *ptr & BIT(6)); -+ return 0; - } - - int wfx_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif, -@@ -376,8 +385,7 @@ int wfx_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif, - ret = wfx_hif_start(wvif, &vif->bss_conf, wvif->channel); - if (ret > 0) - return -EIO; -- wfx_set_mfp_ap(wvif); -- return ret; -+ return wfx_set_mfp_ap(wvif); - } - - void wfx_stop_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif, --- -2.43.2 - -From 8c7e1faa0356beba8551bb6c4c6a57f717f37474 Mon Sep 17 00:00:00 2001 -From: Lingbo Kong <quic_lingbok@quicinc.com> -Date: Wed, 6 Dec 2023 22:17:59 +0800 -Subject: [PATCH 1124/1501] wifi: ath12k: fix the issue that the - multicast/broadcast indicator is not read correctly for WCN7850 -Content-Length: 1476 -Lines: 35 - -[ Upstream commit 7133b072dfbfac8763ffb017642c9c894894c50d ] - -We observe some packets are discarded in ieee80211_rx_handlers_result -function for WCN7850. This is because the way to get multicast/broadcast -indicator with RX_MSDU_END_INFO5_DA_IS_MCBC & info5 is incorrect. It should -use RX_MSDU_END_INFO13_MCAST_BCAST & info13 to get multicast/broadcast -indicator. - -Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 - -Signed-off-by: Lingbo Kong <quic_lingbok@quicinc.com> -Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> -Link: https://lore.kernel.org/r/20231206141759.5430-1-quic_lingbok@quicinc.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/ath/ath12k/hal.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/wireless/ath/ath12k/hal.c b/drivers/net/wireless/ath/ath12k/hal.c -index eca86fc25a60..b896dfe66dad 100644 ---- a/drivers/net/wireless/ath/ath12k/hal.c -+++ b/drivers/net/wireless/ath/ath12k/hal.c -@@ -889,8 +889,8 @@ static u8 *ath12k_hw_wcn7850_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc) - - static bool ath12k_hw_wcn7850_rx_desc_is_da_mcbc(struct hal_rx_desc *desc) - { -- return __le16_to_cpu(desc->u.wcn7850.msdu_end.info5) & -- RX_MSDU_END_INFO5_DA_IS_MCBC; -+ return __le32_to_cpu(desc->u.wcn7850.msdu_end.info13) & -+ RX_MSDU_END_INFO13_MCAST_BCAST; - } - - static void ath12k_hw_wcn7850_rx_desc_get_dot11_hdr(struct hal_rx_desc *desc, --- -2.43.2 - -From 01bb6c177452ef4f76c426191e5ce6ba8f8edbfd Mon Sep 17 00:00:00 2001 -From: Christian Marangi <ansuelsmth@gmail.com> -Date: Fri, 8 Dec 2023 15:51:48 +0100 -Subject: [PATCH 1130/1501] net: phy: at803x: fix passing the wrong reference - for config_intr -Content-Length: 1823 -Lines: 46 - -[ Upstream commit f8fdbf3389f44c7026f16e36cb1f2ff017f7f5b2 ] - -Fix passing the wrong reference for config_initr on passing the function -pointer, drop the wrong & from at803x_config_intr in the PHY struct. - -Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> -Reviewed-by: Andrew Lunn <andrew@lunn.ch> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/phy/at803x.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c -index 37fb033e1c29..ef203b0807e5 100644 ---- a/drivers/net/phy/at803x.c -+++ b/drivers/net/phy/at803x.c -@@ -2104,7 +2104,7 @@ static struct phy_driver at803x_driver[] = { - .write_page = at803x_write_page, - .get_features = at803x_get_features, - .read_status = at803x_read_status, -- .config_intr = &at803x_config_intr, -+ .config_intr = at803x_config_intr, - .handle_interrupt = at803x_handle_interrupt, - .get_tunable = at803x_get_tunable, - .set_tunable = at803x_set_tunable, -@@ -2134,7 +2134,7 @@ static struct phy_driver at803x_driver[] = { - .resume = at803x_resume, - .flags = PHY_POLL_CABLE_TEST, - /* PHY_BASIC_FEATURES */ -- .config_intr = &at803x_config_intr, -+ .config_intr = at803x_config_intr, - .handle_interrupt = at803x_handle_interrupt, - .cable_test_start = at803x_cable_test_start, - .cable_test_get_status = at803x_cable_test_get_status, -@@ -2150,7 +2150,7 @@ static struct phy_driver at803x_driver[] = { - .resume = at803x_resume, - .flags = PHY_POLL_CABLE_TEST, - /* PHY_BASIC_FEATURES */ -- .config_intr = &at803x_config_intr, -+ .config_intr = at803x_config_intr, - .handle_interrupt = at803x_handle_interrupt, - .cable_test_start = at803x_cable_test_start, - .cable_test_get_status = at803x_cable_test_get_status, --- -2.43.2 - -From c01dfb3ef3db07862c90b6ae1e78b85d38aded50 Mon Sep 17 00:00:00 2001 -From: Shannon Nelson <shannon.nelson@amd.com> -Date: Mon, 11 Dec 2023 10:57:57 -0800 -Subject: [PATCH 1131/1501] ionic: pass opcode to devcmd_wait -Content-Length: 2345 -Lines: 55 - -[ Upstream commit 24f110240c03c6b5368f1203bac72883d511e606 ] - -Don't rely on the PCI memory for the devcmd opcode because we -read a 0xff value if the PCI bus is broken, which can cause us -to report a bogus dev_cmd opcode later. - -Signed-off-by: Shannon Nelson <shannon.nelson@amd.com> -Reviewed-by: Brett Creeley <brett.creeley@amd.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/pensando/ionic/ionic_dev.c | 1 + - drivers/net/ethernet/pensando/ionic/ionic_dev.h | 1 + - drivers/net/ethernet/pensando/ionic/ionic_main.c | 2 +- - 3 files changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/pensando/ionic/ionic_dev.c b/drivers/net/ethernet/pensando/ionic/ionic_dev.c -index c06576f43916..22ab0a44fa8c 100644 ---- a/drivers/net/ethernet/pensando/ionic/ionic_dev.c -+++ b/drivers/net/ethernet/pensando/ionic/ionic_dev.c -@@ -321,6 +321,7 @@ void ionic_dev_cmd_comp(struct ionic_dev *idev, union ionic_dev_cmd_comp *comp) - - void ionic_dev_cmd_go(struct ionic_dev *idev, union ionic_dev_cmd *cmd) - { -+ idev->opcode = cmd->cmd.opcode; - memcpy_toio(&idev->dev_cmd_regs->cmd, cmd, sizeof(*cmd)); - iowrite32(0, &idev->dev_cmd_regs->done); - iowrite32(1, &idev->dev_cmd_regs->doorbell); -diff --git a/drivers/net/ethernet/pensando/ionic/ionic_dev.h b/drivers/net/ethernet/pensando/ionic/ionic_dev.h -index 9b5463040075..fd112bee4dcf 100644 ---- a/drivers/net/ethernet/pensando/ionic/ionic_dev.h -+++ b/drivers/net/ethernet/pensando/ionic/ionic_dev.h -@@ -153,6 +153,7 @@ struct ionic_dev { - bool fw_hb_ready; - bool fw_status_ready; - u8 fw_generation; -+ u8 opcode; - - u64 __iomem *db_pages; - dma_addr_t phy_db_pages; -diff --git a/drivers/net/ethernet/pensando/ionic/ionic_main.c b/drivers/net/ethernet/pensando/ionic/ionic_main.c -index 835577392178..1b547acfd8e9 100644 ---- a/drivers/net/ethernet/pensando/ionic/ionic_main.c -+++ b/drivers/net/ethernet/pensando/ionic/ionic_main.c -@@ -465,7 +465,7 @@ static int __ionic_dev_cmd_wait(struct ionic *ionic, unsigned long max_seconds, - */ - max_wait = jiffies + (max_seconds * HZ); - try_again: -- opcode = readb(&idev->dev_cmd_regs->cmd.cmd.opcode); -+ opcode = idev->opcode; - start_time = jiffies; - for (fw_up = ionic_is_fw_running(idev); - !done && fw_up && time_before(jiffies, max_wait); --- -2.43.2 - -From 5241fab05f1632b8a66726d9e7681f575b731df4 Mon Sep 17 00:00:00 2001 -From: Shannon Nelson <shannon.nelson@amd.com> -Date: Mon, 11 Dec 2023 10:57:59 -0800 -Subject: [PATCH 1132/1501] ionic: bypass firmware cmds when stuck in reset -Content-Length: 3387 -Lines: 92 - -[ Upstream commit ca5fdf9a7c5b65968c718f2be159cda4c13556a1 ] - -If the driver or firmware is stuck in reset state, don't bother -trying to use adminq commands. This speeds up shutdown and -prevents unnecessary timeouts and error messages. - -This includes a bit of rework on ionic_adminq_post_wait() -and ionic_adminq_post_wait_nomsg() to both use -__ionic_adminq_post_wait() which can do the checks needed in -both cases. - -Signed-off-by: Shannon Nelson <shannon.nelson@amd.com> -Reviewed-by: Brett Creeley <brett.creeley@amd.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../ethernet/pensando/ionic/ionic_bus_pci.c | 4 ++++ - .../net/ethernet/pensando/ionic/ionic_lif.c | 3 +++ - .../net/ethernet/pensando/ionic/ionic_main.c | 20 ++++++++++++------- - 3 files changed, 20 insertions(+), 7 deletions(-) - -diff --git a/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c b/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c -index d6ce113a4210..fa4237c27e06 100644 ---- a/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c -+++ b/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c -@@ -392,6 +392,10 @@ static void ionic_remove(struct pci_dev *pdev) - del_timer_sync(&ionic->watchdog_timer); - - if (ionic->lif) { -+ /* prevent adminq cmds if already known as down */ -+ if (test_and_clear_bit(IONIC_LIF_F_FW_RESET, ionic->lif->state)) -+ set_bit(IONIC_LIF_F_FW_STOPPING, ionic->lif->state); -+ - ionic_lif_unregister(ionic->lif); - ionic_devlink_unregister(ionic); - ionic_lif_deinit(ionic->lif); -diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c -index bad919343180..075e0e3fc2ea 100644 ---- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c -+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c -@@ -3238,6 +3238,9 @@ static void ionic_lif_reset(struct ionic_lif *lif) - { - struct ionic_dev *idev = &lif->ionic->idev; - -+ if (!ionic_is_fw_running(idev)) -+ return; -+ - mutex_lock(&lif->ionic->dev_cmd_lock); - ionic_dev_cmd_lif_reset(idev, lif->index); - ionic_dev_cmd_wait(lif->ionic, DEVCMD_TIMEOUT); -diff --git a/drivers/net/ethernet/pensando/ionic/ionic_main.c b/drivers/net/ethernet/pensando/ionic/ionic_main.c -index 1b547acfd8e9..83c413a10f79 100644 ---- a/drivers/net/ethernet/pensando/ionic/ionic_main.c -+++ b/drivers/net/ethernet/pensando/ionic/ionic_main.c -@@ -410,22 +410,28 @@ int ionic_adminq_wait(struct ionic_lif *lif, struct ionic_admin_ctx *ctx, - do_msg); - } - --int ionic_adminq_post_wait(struct ionic_lif *lif, struct ionic_admin_ctx *ctx) -+static int __ionic_adminq_post_wait(struct ionic_lif *lif, -+ struct ionic_admin_ctx *ctx, -+ const bool do_msg) - { - int err; - -+ if (!ionic_is_fw_running(&lif->ionic->idev)) -+ return 0; -+ - err = ionic_adminq_post(lif, ctx); - -- return ionic_adminq_wait(lif, ctx, err, true); -+ return ionic_adminq_wait(lif, ctx, err, do_msg); -+} -+ -+int ionic_adminq_post_wait(struct ionic_lif *lif, struct ionic_admin_ctx *ctx) -+{ -+ return __ionic_adminq_post_wait(lif, ctx, true); - } - - int ionic_adminq_post_wait_nomsg(struct ionic_lif *lif, struct ionic_admin_ctx *ctx) - { -- int err; -- -- err = ionic_adminq_post(lif, ctx); -- -- return ionic_adminq_wait(lif, ctx, err, false); -+ return __ionic_adminq_post_wait(lif, ctx, false); - } - - static void ionic_dev_cmd_clean(struct ionic *ionic) --- -2.43.2 - -From a2c6206f18104fba7f887bf4dbbfe4c41adc4339 Mon Sep 17 00:00:00 2001 -From: Kees Cook <keescook@chromium.org> -Date: Tue, 12 Dec 2023 13:47:42 -0800 -Subject: [PATCH 1133/1501] block/rnbd-srv: Check for unlikely string overflow -Content-Length: 3300 -Lines: 80 - -[ Upstream commit 9e4bf6a08d1e127bcc4bd72557f2dfafc6bc7f41 ] - -Since "dev_search_path" can technically be as large as PATH_MAX, -there was a risk of truncation when copying it and a second string -into "full_path" since it was also PATH_MAX sized. The W=1 builds were -reporting this warning: - -drivers/block/rnbd/rnbd-srv.c: In function 'process_msg_open.isra': -drivers/block/rnbd/rnbd-srv.c:616:51: warning: '%s' directive output may be truncated writing up to 254 bytes into a region of size between 0 and 4095 [-Wformat-truncation=] - 616 | snprintf(full_path, PATH_MAX, "%s/%s", - | ^~ -In function 'rnbd_srv_get_full_path', - inlined from 'process_msg_open.isra' at drivers/block/rnbd/rnbd-srv.c:721:14: drivers/block/rnbd/rnbd-srv.c:616:17: note: 'snprintf' output between 2 and 4351 bytes into a destination of size 4096 - 616 | snprintf(full_path, PATH_MAX, "%s/%s", - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - 617 | dev_search_path, dev_name); - | ~~~~~~~~~~~~~~~~~~~~~~~~~~ - -To fix this, unconditionally check for truncation (as was already done -for the case where "%SESSNAME%" was present). - -Reported-by: kernel test robot <lkp@intel.com> -Closes: https://lore.kernel.org/oe-kbuild-all/202312100355.lHoJPgKy-lkp@intel.com/ -Cc: Md. Haris Iqbal <haris.iqbal@ionos.com> -Cc: Jack Wang <jinpu.wang@ionos.com> -Cc: Jens Axboe <axboe@kernel.dk> -Cc: <linux-block@vger.kernel.org> -Signed-off-by: Kees Cook <keescook@chromium.org> -Acked-by: Guoqing Jiang <guoqing.jiang@linux.dev> -Acked-by: Jack Wang <jinpu.wang@ionos.com> -Link: https://lore.kernel.org/r/20231212214738.work.169-kees@kernel.org -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/block/rnbd/rnbd-srv.c | 19 ++++++++++--------- - 1 file changed, 10 insertions(+), 9 deletions(-) - -diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c -index 65de51f3dfd9..ab78eab97d98 100644 ---- a/drivers/block/rnbd/rnbd-srv.c -+++ b/drivers/block/rnbd/rnbd-srv.c -@@ -585,6 +585,7 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess, - { - char *full_path; - char *a, *b; -+ int len; - - full_path = kmalloc(PATH_MAX, GFP_KERNEL); - if (!full_path) -@@ -596,19 +597,19 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess, - */ - a = strnstr(dev_search_path, "%SESSNAME%", sizeof(dev_search_path)); - if (a) { -- int len = a - dev_search_path; -+ len = a - dev_search_path; - - len = snprintf(full_path, PATH_MAX, "%.*s/%s/%s", len, - dev_search_path, srv_sess->sessname, dev_name); -- if (len >= PATH_MAX) { -- pr_err("Too long path: %s, %s, %s\n", -- dev_search_path, srv_sess->sessname, dev_name); -- kfree(full_path); -- return ERR_PTR(-EINVAL); -- } - } else { -- snprintf(full_path, PATH_MAX, "%s/%s", -- dev_search_path, dev_name); -+ len = snprintf(full_path, PATH_MAX, "%s/%s", -+ dev_search_path, dev_name); -+ } -+ if (len >= PATH_MAX) { -+ pr_err("Too long path: %s, %s, %s\n", -+ dev_search_path, srv_sess->sessname, dev_name); -+ kfree(full_path); -+ return ERR_PTR(-EINVAL); - } - - /* eliminitate duplicated slashes */ --- -2.43.2 - -From 6b82b1e83ceaf7df2b8a1ff93080f1762314d349 Mon Sep 17 00:00:00 2001 -From: Michal Simek <michal.simek@amd.com> -Date: Thu, 30 Nov 2023 10:59:15 +0100 -Subject: [PATCH 1134/1501] arm64: zynqmp: Move fixed clock to / for kv260 -Content-Length: 3335 -Lines: 109 - -[ Upstream commit 6a10a19a6bd2fd8d27a510678bf87bd9408f51d8 ] - -fixed clock nodes can't be on the bus because they are missing reg -property. That's why move them to root. -And because it is root it is good to have it as the first node in a file. - -Signed-off-by: Michal Simek <michal.simek@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../boot/dts/xilinx/zynqmp-sck-kv-g-revA.dtso | 28 ++++++++--------- - .../boot/dts/xilinx/zynqmp-sck-kv-g-revB.dtso | 30 +++++++++---------- - 2 files changed, 29 insertions(+), 29 deletions(-) - -diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revA.dtso b/arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revA.dtso -index ae1b9b2bdbee..dee238739290 100644 ---- a/arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revA.dtso -+++ b/arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revA.dtso -@@ -21,20 +21,7 @@ - /dts-v1/; - /plugin/; - --&i2c1 { /* I2C_SCK C23/C24 - MIO from SOM */ -- #address-cells = <1>; -- #size-cells = <0>; -- pinctrl-names = "default", "gpio"; -- pinctrl-0 = <&pinctrl_i2c1_default>; -- pinctrl-1 = <&pinctrl_i2c1_gpio>; -- scl-gpios = <&gpio 24 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; -- sda-gpios = <&gpio 25 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; -- -- /* u14 - 0x40 - ina260 */ -- /* u27 - 0xe0 - STDP4320 DP/HDMI splitter */ --}; -- --&amba { -+&{/} { - si5332_0: si5332_0 { /* u17 */ - compatible = "fixed-clock"; - #clock-cells = <0>; -@@ -72,6 +59,19 @@ si5332_5: si5332_5 { /* u17 */ - }; - }; - -+&i2c1 { /* I2C_SCK C23/C24 - MIO from SOM */ -+ #address-cells = <1>; -+ #size-cells = <0>; -+ pinctrl-names = "default", "gpio"; -+ pinctrl-0 = <&pinctrl_i2c1_default>; -+ pinctrl-1 = <&pinctrl_i2c1_gpio>; -+ scl-gpios = <&gpio 24 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; -+ sda-gpios = <&gpio 25 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; -+ -+ /* u14 - 0x40 - ina260 */ -+ /* u27 - 0xe0 - STDP4320 DP/HDMI splitter */ -+}; -+ - /* DP/USB 3.0 and SATA */ - &psgtr { - status = "okay"; -diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revB.dtso b/arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revB.dtso -index b59e48be6465..73c5cb156caf 100644 ---- a/arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revB.dtso -+++ b/arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revB.dtso -@@ -16,21 +16,7 @@ - /dts-v1/; - /plugin/; - --&i2c1 { /* I2C_SCK C23/C24 - MIO from SOM */ -- #address-cells = <1>; -- #size-cells = <0>; -- pinctrl-names = "default", "gpio"; -- pinctrl-0 = <&pinctrl_i2c1_default>; -- pinctrl-1 = <&pinctrl_i2c1_gpio>; -- scl-gpios = <&gpio 24 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; -- sda-gpios = <&gpio 25 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; -- -- /* u14 - 0x40 - ina260 */ -- /* u43 - 0x2d - usb5744 */ -- /* u27 - 0xe0 - STDP4320 DP/HDMI splitter */ --}; -- --&amba { -+&{/} { - si5332_0: si5332_0 { /* u17 */ - compatible = "fixed-clock"; - #clock-cells = <0>; -@@ -68,6 +54,20 @@ si5332_5: si5332_5 { /* u17 */ - }; - }; - -+&i2c1 { /* I2C_SCK C23/C24 - MIO from SOM */ -+ #address-cells = <1>; -+ #size-cells = <0>; -+ pinctrl-names = "default", "gpio"; -+ pinctrl-0 = <&pinctrl_i2c1_default>; -+ pinctrl-1 = <&pinctrl_i2c1_gpio>; -+ scl-gpios = <&gpio 24 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; -+ sda-gpios = <&gpio 25 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; -+ -+ /* u14 - 0x40 - ina260 */ -+ /* u43 - 0x2d - usb5744 */ -+ /* u27 - 0xe0 - STDP4320 DP/HDMI splitter */ -+}; -+ - /* DP/USB 3.0 */ - &psgtr { - status = "okay"; --- -2.43.2 - -From 916bc604dbe4afb30d2bfeef698ae57dae973f6f Mon Sep 17 00:00:00 2001 -From: Michal Simek <michal.simek@amd.com> -Date: Thu, 30 Nov 2023 10:59:16 +0100 -Subject: [PATCH 1135/1501] arm64: zynqmp: Fix clock node name in kv260 cards -Content-Length: 2979 -Lines: 109 - -[ Upstream commit 0bfb7950cc1975372c4c58c3d3f9803f05245d46 ] - -node name shouldn't use '_' that's why convert it to '-'. - -Signed-off-by: Michal Simek <michal.simek@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revA.dtso | 12 ++++++------ - arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revB.dtso | 12 ++++++------ - 2 files changed, 12 insertions(+), 12 deletions(-) - -diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revA.dtso b/arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revA.dtso -index dee238739290..92f4190d564d 100644 ---- a/arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revA.dtso -+++ b/arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revA.dtso -@@ -22,37 +22,37 @@ - /plugin/; - - &{/} { -- si5332_0: si5332_0 { /* u17 */ -+ si5332_0: si5332-0 { /* u17 */ - compatible = "fixed-clock"; - #clock-cells = <0>; - clock-frequency = <125000000>; - }; - -- si5332_1: si5332_1 { /* u17 */ -+ si5332_1: si5332-1 { /* u17 */ - compatible = "fixed-clock"; - #clock-cells = <0>; - clock-frequency = <25000000>; - }; - -- si5332_2: si5332_2 { /* u17 */ -+ si5332_2: si5332-2 { /* u17 */ - compatible = "fixed-clock"; - #clock-cells = <0>; - clock-frequency = <48000000>; - }; - -- si5332_3: si5332_3 { /* u17 */ -+ si5332_3: si5332-3 { /* u17 */ - compatible = "fixed-clock"; - #clock-cells = <0>; - clock-frequency = <24000000>; - }; - -- si5332_4: si5332_4 { /* u17 */ -+ si5332_4: si5332-4 { /* u17 */ - compatible = "fixed-clock"; - #clock-cells = <0>; - clock-frequency = <26000000>; - }; - -- si5332_5: si5332_5 { /* u17 */ -+ si5332_5: si5332-5 { /* u17 */ - compatible = "fixed-clock"; - #clock-cells = <0>; - clock-frequency = <27000000>; -diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revB.dtso b/arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revB.dtso -index 73c5cb156caf..f88b71f5b07a 100644 ---- a/arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revB.dtso -+++ b/arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revB.dtso -@@ -17,37 +17,37 @@ - /plugin/; - - &{/} { -- si5332_0: si5332_0 { /* u17 */ -+ si5332_0: si5332-0 { /* u17 */ - compatible = "fixed-clock"; - #clock-cells = <0>; - clock-frequency = <125000000>; - }; - -- si5332_1: si5332_1 { /* u17 */ -+ si5332_1: si5332-1 { /* u17 */ - compatible = "fixed-clock"; - #clock-cells = <0>; - clock-frequency = <25000000>; - }; - -- si5332_2: si5332_2 { /* u17 */ -+ si5332_2: si5332-2 { /* u17 */ - compatible = "fixed-clock"; - #clock-cells = <0>; - clock-frequency = <48000000>; - }; - -- si5332_3: si5332_3 { /* u17 */ -+ si5332_3: si5332-3 { /* u17 */ - compatible = "fixed-clock"; - #clock-cells = <0>; - clock-frequency = <24000000>; - }; - -- si5332_4: si5332_4 { /* u17 */ -+ si5332_4: si5332-4 { /* u17 */ - compatible = "fixed-clock"; - #clock-cells = <0>; - clock-frequency = <26000000>; - }; - -- si5332_5: si5332_5 { /* u17 */ -+ si5332_5: si5332-5 { /* u17 */ - compatible = "fixed-clock"; - #clock-cells = <0>; - clock-frequency = <27000000>; --- -2.43.2 - -From fa5561b6b30118fdd38ae213bc736f1949364f17 Mon Sep 17 00:00:00 2001 -From: Justin Tee <justin.tee@broadcom.com> -Date: Thu, 7 Dec 2023 14:40:37 -0800 -Subject: [PATCH 1142/1501] scsi: lpfc: Reinitialize an NPIV's VMID data - structures after FDISC -Content-Length: 1188 -Lines: 37 - -[ Upstream commit 8dc8eb89f4df74593ba4bf30c3d31a0fc6d3ea47 ] - -After a follow up FDISC cmpl, an NPIV's VMID data structures are not -updated. - -Fix by calling lpfc_reinit_vmid and copying the physical port's vmid_flag -to the NPIV's vmid_flag in the NPIV registration cmpl code path. - -Signed-off-by: Justin Tee <justin.tee@broadcom.com> -Link: https://lore.kernel.org/r/20231207224039.35466-3-justintee8345@gmail.com -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/scsi/lpfc/lpfc_els.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 0829fe6ddff8..7e9b93460e64 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -11130,6 +11130,14 @@ lpfc_cmpl_reg_new_vport(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb) - lpfc_nlp_put(ndlp); - - mempool_free(pmb, phba->mbox_mem_pool); -+ -+ /* reinitialize the VMID datastructure before returning. -+ * this is specifically for vport -+ */ -+ if (lpfc_is_vmid_enabled(phba)) -+ lpfc_reinit_vmid(vport); -+ vport->vmid_flag = vport->phba->pport->vmid_flag; -+ - return; - } - --- -2.43.2 - -From 48f61faa585fa610d20dbc7a1898e9f92c841184 Mon Sep 17 00:00:00 2001 -From: Justin Tee <justin.tee@broadcom.com> -Date: Thu, 7 Dec 2023 14:40:38 -0800 -Subject: [PATCH 1143/1501] scsi: lpfc: Move determination of vmid_flag after - VMID reinitialization completes -Content-Length: 2157 -Lines: 53 - -[ Upstream commit aba0fb0ef607a71511d23a07406f11130c1a54c5 ] - -If priority tagging is set in the service parameters of a FLOGI cmpl, then -we update the vmid_flag. In the current logic, if a follow up FLOGI cmpl -updates its service parameters such that priority tagging is no longer set, -then the vmid_flag ends up keeping stale data. - -Fix by ensuring we clear the vmid_flag member during lpfc_reinit_vmid, and -check the priority tagging service parameter after reinitialization of the -vmid data structures. - -Signed-off-by: Justin Tee <justin.tee@broadcom.com> -Link: https://lore.kernel.org/r/20231207224039.35466-4-justintee8345@gmail.com -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/scsi/lpfc/lpfc_els.c | 6 +++--- - drivers/scsi/lpfc/lpfc_vmid.c | 1 + - 2 files changed, 4 insertions(+), 3 deletions(-) - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 7e9b93460e64..385e1636f139 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -1130,12 +1130,12 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - vport->port_state, vport->fc_flag, - sp->cmn.priority_tagging, kref_read(&ndlp->kref)); - -- if (sp->cmn.priority_tagging) -- vport->phba->pport->vmid_flag |= (LPFC_VMID_ISSUE_QFPA | -- LPFC_VMID_TYPE_PRIO); - /* reinitialize the VMID datastructure before returning */ - if (lpfc_is_vmid_enabled(phba)) - lpfc_reinit_vmid(vport); -+ if (sp->cmn.priority_tagging) -+ vport->phba->pport->vmid_flag |= (LPFC_VMID_ISSUE_QFPA | -+ LPFC_VMID_TYPE_PRIO); - - /* - * Address a timing race with dev_loss. If dev_loss is active on -diff --git a/drivers/scsi/lpfc/lpfc_vmid.c b/drivers/scsi/lpfc/lpfc_vmid.c -index cf8ba840d0ea..773e02ae20c3 100644 ---- a/drivers/scsi/lpfc/lpfc_vmid.c -+++ b/drivers/scsi/lpfc/lpfc_vmid.c -@@ -321,5 +321,6 @@ lpfc_reinit_vmid(struct lpfc_vport *vport) - if (!hash_empty(vport->hash_table)) - hash_for_each_safe(vport->hash_table, bucket, tmp, cur, hnode) - hash_del(&cur->hnode); -+ vport->vmid_flag = 0; - write_unlock(&vport->vmid_lock); - } --- -2.43.2 - -From f9403653ca98d7842cc35cead82b42fe05a6a121 Mon Sep 17 00:00:00 2001 -From: Yihang Li <liyihang9@huawei.com> -Date: Thu, 14 Dec 2023 11:45:12 +0800 -Subject: [PATCH 1144/1501] scsi: hisi_sas: Set .phy_attached before notifing - phyup event HISI_PHYE_PHY_UP_PM -Content-Length: 1690 -Lines: 48 - -[ Upstream commit ce26497c745d0541aec930d5211b431a1c26af97 ] - -Currently in directly attached scenario, the phyup event -HISI_PHYE_PHY_UP_PM is notified before .phy_attached is set - this may -cause the phyup work hisi_sas_bytes_dmaed() execution failed and the -attached device will not be found. - -To fix it, set .phy_attached before notifing phyup event. - -Signed-off-by: Yihang Li <liyihang9@huawei.com> -Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com> -Link: https://lore.kernel.org/r/1702525516-51258-2-git-send-email-chenxiang66@hisilicon.com -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -index 6d8577423d32..b56fbc61a15a 100644 ---- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -@@ -1605,6 +1605,11 @@ static irqreturn_t phy_up_v3_hw(int phy_no, struct hisi_hba *hisi_hba) - } - - phy->port_id = port_id; -+ spin_lock(&phy->lock); -+ /* Delete timer and set phy_attached atomically */ -+ del_timer(&phy->timer); -+ phy->phy_attached = 1; -+ spin_unlock(&phy->lock); - - /* - * Call pm_runtime_get_noresume() which pairs with -@@ -1618,11 +1623,6 @@ static irqreturn_t phy_up_v3_hw(int phy_no, struct hisi_hba *hisi_hba) - - res = IRQ_HANDLED; - -- spin_lock(&phy->lock); -- /* Delete timer and set phy_attached atomically */ -- del_timer(&phy->timer); -- phy->phy_attached = 1; -- spin_unlock(&phy->lock); - end: - if (phy->reset_completion) - complete(phy->reset_completion); --- -2.43.2 - -From 447ac7fccdc96ead9d063554159f95e004faaa62 Mon Sep 17 00:00:00 2001 -From: Ahmed Zaki <ahmed.zaki@intel.com> -Date: Tue, 12 Dec 2023 17:33:17 -0700 -Subject: [PATCH 1145/1501] ice: fix ICE_AQ_VSI_Q_OPT_RSS_* register values -Content-Length: 4149 -Lines: 93 - -[ Upstream commit 20f73b60bb5c276cee9b1a530f100c677bc74af8 ] - -Fix the values of the ICE_AQ_VSI_Q_OPT_RSS_* registers. Shifting is -already done when the values are used, no need to double shift. Bug was -not discovered earlier since only ICE_AQ_VSI_Q_OPT_RSS_TPLZ (Zero) is -currently used. - -Also, rename ICE_AQ_VSI_Q_OPT_RSS_XXX to ICE_AQ_VSI_Q_OPT_RSS_HASH_XXX -for consistency. - -Co-developed-by: Jesse Brandeburg <jesse.brandeburg@intel.com> -Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> -Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com> -Signed-off-by: Ahmed Zaki <ahmed.zaki@intel.com> -Link: https://lore.kernel.org/r/20231213003321.605376-5-ahmed.zaki@intel.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 8 ++++---- - drivers/net/ethernet/intel/ice/ice_lib.c | 4 ++-- - drivers/net/ethernet/intel/ice/ice_virtchnl.c | 12 +++++------- - 3 files changed, 11 insertions(+), 13 deletions(-) - -diff --git a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h -index fbd5d92182d3..812a35d79b95 100644 ---- a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h -+++ b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h -@@ -491,10 +491,10 @@ struct ice_aqc_vsi_props { - #define ICE_AQ_VSI_Q_OPT_RSS_GBL_LUT_M (0xF << ICE_AQ_VSI_Q_OPT_RSS_GBL_LUT_S) - #define ICE_AQ_VSI_Q_OPT_RSS_HASH_S 6 - #define ICE_AQ_VSI_Q_OPT_RSS_HASH_M (0x3 << ICE_AQ_VSI_Q_OPT_RSS_HASH_S) --#define ICE_AQ_VSI_Q_OPT_RSS_TPLZ (0x0 << ICE_AQ_VSI_Q_OPT_RSS_HASH_S) --#define ICE_AQ_VSI_Q_OPT_RSS_SYM_TPLZ (0x1 << ICE_AQ_VSI_Q_OPT_RSS_HASH_S) --#define ICE_AQ_VSI_Q_OPT_RSS_XOR (0x2 << ICE_AQ_VSI_Q_OPT_RSS_HASH_S) --#define ICE_AQ_VSI_Q_OPT_RSS_JHASH (0x3 << ICE_AQ_VSI_Q_OPT_RSS_HASH_S) -+#define ICE_AQ_VSI_Q_OPT_RSS_HASH_TPLZ 0x0U -+#define ICE_AQ_VSI_Q_OPT_RSS_HASH_SYM_TPLZ 0x1U -+#define ICE_AQ_VSI_Q_OPT_RSS_HASH_XOR 0x2U -+#define ICE_AQ_VSI_Q_OPT_RSS_HASH_JHASH 0x3U - u8 q_opt_tc; - #define ICE_AQ_VSI_Q_OPT_TC_OVR_S 0 - #define ICE_AQ_VSI_Q_OPT_TC_OVR_M (0x1F << ICE_AQ_VSI_Q_OPT_TC_OVR_S) -diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c -index 1bad6e17f9be..24f95880a2ed 100644 ---- a/drivers/net/ethernet/intel/ice/ice_lib.c -+++ b/drivers/net/ethernet/intel/ice/ice_lib.c -@@ -1186,12 +1186,12 @@ static void ice_set_rss_vsi_ctx(struct ice_vsi_ctx *ctxt, struct ice_vsi *vsi) - case ICE_VSI_PF: - /* PF VSI will inherit RSS instance of PF */ - lut_type = ICE_AQ_VSI_Q_OPT_RSS_LUT_PF; -- hash_type = ICE_AQ_VSI_Q_OPT_RSS_TPLZ; -+ hash_type = ICE_AQ_VSI_Q_OPT_RSS_HASH_TPLZ; - break; - case ICE_VSI_VF: - /* VF VSI will gets a small RSS table which is a VSI LUT type */ - lut_type = ICE_AQ_VSI_Q_OPT_RSS_LUT_VSI; -- hash_type = ICE_AQ_VSI_Q_OPT_RSS_TPLZ; -+ hash_type = ICE_AQ_VSI_Q_OPT_RSS_HASH_TPLZ; - break; - default: - dev_dbg(dev, "Unsupported VSI type %s\n", -diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl.c b/drivers/net/ethernet/intel/ice/ice_virtchnl.c -index 1c7b4ded948b..8872f7a4f432 100644 ---- a/drivers/net/ethernet/intel/ice/ice_virtchnl.c -+++ b/drivers/net/ethernet/intel/ice/ice_virtchnl.c -@@ -823,8 +823,8 @@ static int ice_vc_handle_rss_cfg(struct ice_vf *vf, u8 *msg, bool add) - int status; - - lut_type = ICE_AQ_VSI_Q_OPT_RSS_LUT_VSI; -- hash_type = add ? ICE_AQ_VSI_Q_OPT_RSS_XOR : -- ICE_AQ_VSI_Q_OPT_RSS_TPLZ; -+ hash_type = add ? ICE_AQ_VSI_Q_OPT_RSS_HASH_XOR : -+ ICE_AQ_VSI_Q_OPT_RSS_HASH_TPLZ; - - ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); - if (!ctx) { -@@ -832,11 +832,9 @@ static int ice_vc_handle_rss_cfg(struct ice_vf *vf, u8 *msg, bool add) - goto error_param; - } - -- ctx->info.q_opt_rss = ((lut_type << -- ICE_AQ_VSI_Q_OPT_RSS_LUT_S) & -- ICE_AQ_VSI_Q_OPT_RSS_LUT_M) | -- (hash_type & -- ICE_AQ_VSI_Q_OPT_RSS_HASH_M); -+ ctx->info.q_opt_rss = -+ FIELD_PREP(ICE_AQ_VSI_Q_OPT_RSS_LUT_M, lut_type) | -+ FIELD_PREP(ICE_AQ_VSI_Q_OPT_RSS_HASH_M, hash_type); - - /* Preserve existing queueing option setting */ - ctx->info.q_opt_rss |= (vsi->info.q_opt_rss & --- -2.43.2 - -From d1fde4a7e1dcc4d49cce285107a7a43c3030878d Mon Sep 17 00:00:00 2001 -From: Igor Russkikh <irusskikh@marvell.com> -Date: Wed, 13 Dec 2023 10:50:44 +0100 -Subject: [PATCH 1146/1501] net: atlantic: eliminate double free in error - handling logic -Content-Length: 8880 -Lines: 280 - -[ Upstream commit b3cb7a830a24527877b0bc900b9bd74a96aea928 ] - -Driver has a logic leak in ring data allocation/free, -where aq_ring_free could be called multiple times on same ring, -if system is under stress and got memory allocation error. - -Ring pointer was used as an indicator of failure, but this is -not correct since only ring data is allocated/deallocated. -Ring itself is an array member. - -Changing ring allocation functions to return error code directly. -This simplifies error handling and eliminates aq_ring_free -on higher layer. - -Signed-off-by: Igor Russkikh <irusskikh@marvell.com> -Link: https://lore.kernel.org/r/20231213095044.23146-1-irusskikh@marvell.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../net/ethernet/aquantia/atlantic/aq_ptp.c | 28 +++------ - .../net/ethernet/aquantia/atlantic/aq_ring.c | 61 +++++-------------- - .../net/ethernet/aquantia/atlantic/aq_ring.h | 22 +++---- - .../net/ethernet/aquantia/atlantic/aq_vec.c | 23 +++---- - 4 files changed, 47 insertions(+), 87 deletions(-) - -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c b/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c -index 28c9b6f1a54f..abd4832e4ed2 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c -@@ -953,8 +953,6 @@ int aq_ptp_ring_alloc(struct aq_nic_s *aq_nic) - { - struct aq_ptp_s *aq_ptp = aq_nic->aq_ptp; - unsigned int tx_ring_idx, rx_ring_idx; -- struct aq_ring_s *hwts; -- struct aq_ring_s *ring; - int err; - - if (!aq_ptp) -@@ -962,29 +960,23 @@ int aq_ptp_ring_alloc(struct aq_nic_s *aq_nic) - - tx_ring_idx = aq_ptp_ring_idx(aq_nic->aq_nic_cfg.tc_mode); - -- ring = aq_ring_tx_alloc(&aq_ptp->ptp_tx, aq_nic, -- tx_ring_idx, &aq_nic->aq_nic_cfg); -- if (!ring) { -- err = -ENOMEM; -+ err = aq_ring_tx_alloc(&aq_ptp->ptp_tx, aq_nic, -+ tx_ring_idx, &aq_nic->aq_nic_cfg); -+ if (err) - goto err_exit; -- } - - rx_ring_idx = aq_ptp_ring_idx(aq_nic->aq_nic_cfg.tc_mode); - -- ring = aq_ring_rx_alloc(&aq_ptp->ptp_rx, aq_nic, -- rx_ring_idx, &aq_nic->aq_nic_cfg); -- if (!ring) { -- err = -ENOMEM; -+ err = aq_ring_rx_alloc(&aq_ptp->ptp_rx, aq_nic, -+ rx_ring_idx, &aq_nic->aq_nic_cfg); -+ if (err) - goto err_exit_ptp_tx; -- } - -- hwts = aq_ring_hwts_rx_alloc(&aq_ptp->hwts_rx, aq_nic, PTP_HWST_RING_IDX, -- aq_nic->aq_nic_cfg.rxds, -- aq_nic->aq_nic_cfg.aq_hw_caps->rxd_size); -- if (!hwts) { -- err = -ENOMEM; -+ err = aq_ring_hwts_rx_alloc(&aq_ptp->hwts_rx, aq_nic, PTP_HWST_RING_IDX, -+ aq_nic->aq_nic_cfg.rxds, -+ aq_nic->aq_nic_cfg.aq_hw_caps->rxd_size); -+ if (err) - goto err_exit_ptp_rx; -- } - - err = aq_ptp_skb_ring_init(&aq_ptp->skb_ring, aq_nic->aq_nic_cfg.rxds); - if (err != 0) { -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c -index e1885c1eb100..cda8597b4e14 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c -@@ -132,8 +132,8 @@ static int aq_get_rxpages(struct aq_ring_s *self, struct aq_ring_buff_s *rxbuf) - return 0; - } - --static struct aq_ring_s *aq_ring_alloc(struct aq_ring_s *self, -- struct aq_nic_s *aq_nic) -+static int aq_ring_alloc(struct aq_ring_s *self, -+ struct aq_nic_s *aq_nic) - { - int err = 0; - -@@ -156,46 +156,29 @@ static struct aq_ring_s *aq_ring_alloc(struct aq_ring_s *self, - err_exit: - if (err < 0) { - aq_ring_free(self); -- self = NULL; - } - -- return self; -+ return err; - } - --struct aq_ring_s *aq_ring_tx_alloc(struct aq_ring_s *self, -- struct aq_nic_s *aq_nic, -- unsigned int idx, -- struct aq_nic_cfg_s *aq_nic_cfg) -+int aq_ring_tx_alloc(struct aq_ring_s *self, -+ struct aq_nic_s *aq_nic, -+ unsigned int idx, -+ struct aq_nic_cfg_s *aq_nic_cfg) - { -- int err = 0; -- - self->aq_nic = aq_nic; - self->idx = idx; - self->size = aq_nic_cfg->txds; - self->dx_size = aq_nic_cfg->aq_hw_caps->txd_size; - -- self = aq_ring_alloc(self, aq_nic); -- if (!self) { -- err = -ENOMEM; -- goto err_exit; -- } -- --err_exit: -- if (err < 0) { -- aq_ring_free(self); -- self = NULL; -- } -- -- return self; -+ return aq_ring_alloc(self, aq_nic); - } - --struct aq_ring_s *aq_ring_rx_alloc(struct aq_ring_s *self, -- struct aq_nic_s *aq_nic, -- unsigned int idx, -- struct aq_nic_cfg_s *aq_nic_cfg) -+int aq_ring_rx_alloc(struct aq_ring_s *self, -+ struct aq_nic_s *aq_nic, -+ unsigned int idx, -+ struct aq_nic_cfg_s *aq_nic_cfg) - { -- int err = 0; -- - self->aq_nic = aq_nic; - self->idx = idx; - self->size = aq_nic_cfg->rxds; -@@ -217,22 +200,10 @@ struct aq_ring_s *aq_ring_rx_alloc(struct aq_ring_s *self, - self->tail_size = 0; - } - -- self = aq_ring_alloc(self, aq_nic); -- if (!self) { -- err = -ENOMEM; -- goto err_exit; -- } -- --err_exit: -- if (err < 0) { -- aq_ring_free(self); -- self = NULL; -- } -- -- return self; -+ return aq_ring_alloc(self, aq_nic); - } - --struct aq_ring_s * -+int - aq_ring_hwts_rx_alloc(struct aq_ring_s *self, struct aq_nic_s *aq_nic, - unsigned int idx, unsigned int size, unsigned int dx_size) - { -@@ -250,10 +221,10 @@ aq_ring_hwts_rx_alloc(struct aq_ring_s *self, struct aq_nic_s *aq_nic, - GFP_KERNEL); - if (!self->dx_ring) { - aq_ring_free(self); -- return NULL; -+ return -ENOMEM; - } - -- return self; -+ return 0; - } - - int aq_ring_init(struct aq_ring_s *self, const enum atl_ring_type ring_type) -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h -index 0a6c34438c1d..52847310740a 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h -@@ -183,14 +183,14 @@ static inline unsigned int aq_ring_avail_dx(struct aq_ring_s *self) - self->sw_head - self->sw_tail - 1); - } - --struct aq_ring_s *aq_ring_tx_alloc(struct aq_ring_s *self, -- struct aq_nic_s *aq_nic, -- unsigned int idx, -- struct aq_nic_cfg_s *aq_nic_cfg); --struct aq_ring_s *aq_ring_rx_alloc(struct aq_ring_s *self, -- struct aq_nic_s *aq_nic, -- unsigned int idx, -- struct aq_nic_cfg_s *aq_nic_cfg); -+int aq_ring_tx_alloc(struct aq_ring_s *self, -+ struct aq_nic_s *aq_nic, -+ unsigned int idx, -+ struct aq_nic_cfg_s *aq_nic_cfg); -+int aq_ring_rx_alloc(struct aq_ring_s *self, -+ struct aq_nic_s *aq_nic, -+ unsigned int idx, -+ struct aq_nic_cfg_s *aq_nic_cfg); - - int aq_ring_init(struct aq_ring_s *self, const enum atl_ring_type ring_type); - void aq_ring_rx_deinit(struct aq_ring_s *self); -@@ -207,9 +207,9 @@ int aq_ring_rx_clean(struct aq_ring_s *self, - int budget); - int aq_ring_rx_fill(struct aq_ring_s *self); - --struct aq_ring_s *aq_ring_hwts_rx_alloc(struct aq_ring_s *self, -- struct aq_nic_s *aq_nic, unsigned int idx, -- unsigned int size, unsigned int dx_size); -+int aq_ring_hwts_rx_alloc(struct aq_ring_s *self, -+ struct aq_nic_s *aq_nic, unsigned int idx, -+ unsigned int size, unsigned int dx_size); - void aq_ring_hwts_rx_clean(struct aq_ring_s *self, struct aq_nic_s *aq_nic); - - unsigned int aq_ring_fill_stats_data(struct aq_ring_s *self, u64 *data); -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c -index f5db1c44e9b9..9769ab4f9bef 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c -@@ -136,35 +136,32 @@ int aq_vec_ring_alloc(struct aq_vec_s *self, struct aq_nic_s *aq_nic, - const unsigned int idx_ring = AQ_NIC_CFG_TCVEC2RING(aq_nic_cfg, - i, idx); - -- ring = aq_ring_tx_alloc(&self->ring[i][AQ_VEC_TX_ID], aq_nic, -- idx_ring, aq_nic_cfg); -- if (!ring) { -- err = -ENOMEM; -+ ring = &self->ring[i][AQ_VEC_TX_ID]; -+ err = aq_ring_tx_alloc(ring, aq_nic, idx_ring, aq_nic_cfg); -+ if (err) - goto err_exit; -- } - - ++self->tx_rings; - - aq_nic_set_tx_ring(aq_nic, idx_ring, ring); - -- if (xdp_rxq_info_reg(&self->ring[i][AQ_VEC_RX_ID].xdp_rxq, -+ ring = &self->ring[i][AQ_VEC_RX_ID]; -+ if (xdp_rxq_info_reg(&ring->xdp_rxq, - aq_nic->ndev, idx, - self->napi.napi_id) < 0) { - err = -ENOMEM; - goto err_exit; - } -- if (xdp_rxq_info_reg_mem_model(&self->ring[i][AQ_VEC_RX_ID].xdp_rxq, -+ if (xdp_rxq_info_reg_mem_model(&ring->xdp_rxq, - MEM_TYPE_PAGE_SHARED, NULL) < 0) { -- xdp_rxq_info_unreg(&self->ring[i][AQ_VEC_RX_ID].xdp_rxq); -+ xdp_rxq_info_unreg(&ring->xdp_rxq); - err = -ENOMEM; - goto err_exit; - } - -- ring = aq_ring_rx_alloc(&self->ring[i][AQ_VEC_RX_ID], aq_nic, -- idx_ring, aq_nic_cfg); -- if (!ring) { -- xdp_rxq_info_unreg(&self->ring[i][AQ_VEC_RX_ID].xdp_rxq); -- err = -ENOMEM; -+ err = aq_ring_rx_alloc(ring, aq_nic, idx_ring, aq_nic_cfg); -+ if (err) { -+ xdp_rxq_info_unreg(&ring->xdp_rxq); - goto err_exit; - } - --- -2.43.2 - -From bb844806b58d869ed83ad4448feea778b8496dcd Mon Sep 17 00:00:00 2001 -From: Tobias Waldekranz <tobias@waldekranz.com> -Date: Thu, 14 Dec 2023 14:50:24 +0100 -Subject: [PATCH 1147/1501] net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats - error path -Content-Length: 4035 -Lines: 94 - -[ Upstream commit fc82a08ae795ee6b73fb6b50785f7be248bec7b5 ] - -mv88e6xxx_get_stats, which collects stats from various sources, -expects all callees to return the number of stats read. If an error -occurs, 0 should be returned. - -Prevent future mishaps of this kind by updating the return type to -reflect this contract. - -Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com> -Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> -Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/dsa/mv88e6xxx/chip.h | 4 ++-- - drivers/net/dsa/mv88e6xxx/serdes.c | 10 +++++----- - drivers/net/dsa/mv88e6xxx/serdes.h | 8 ++++---- - 3 files changed, 11 insertions(+), 11 deletions(-) - -diff --git a/drivers/net/dsa/mv88e6xxx/chip.h b/drivers/net/dsa/mv88e6xxx/chip.h -index 44383a03ef2f..c54d305a1d83 100644 ---- a/drivers/net/dsa/mv88e6xxx/chip.h -+++ b/drivers/net/dsa/mv88e6xxx/chip.h -@@ -601,8 +601,8 @@ struct mv88e6xxx_ops { - int (*serdes_get_sset_count)(struct mv88e6xxx_chip *chip, int port); - int (*serdes_get_strings)(struct mv88e6xxx_chip *chip, int port, - uint8_t *data); -- int (*serdes_get_stats)(struct mv88e6xxx_chip *chip, int port, -- uint64_t *data); -+ size_t (*serdes_get_stats)(struct mv88e6xxx_chip *chip, int port, -+ uint64_t *data); - - /* SERDES registers for ethtool */ - int (*serdes_get_regs_len)(struct mv88e6xxx_chip *chip, int port); -diff --git a/drivers/net/dsa/mv88e6xxx/serdes.c b/drivers/net/dsa/mv88e6xxx/serdes.c -index 3b4b42651fa3..01ea53940786 100644 ---- a/drivers/net/dsa/mv88e6xxx/serdes.c -+++ b/drivers/net/dsa/mv88e6xxx/serdes.c -@@ -177,8 +177,8 @@ static uint64_t mv88e6352_serdes_get_stat(struct mv88e6xxx_chip *chip, - return val; - } - --int mv88e6352_serdes_get_stats(struct mv88e6xxx_chip *chip, int port, -- uint64_t *data) -+size_t mv88e6352_serdes_get_stats(struct mv88e6xxx_chip *chip, int port, -+ uint64_t *data) - { - struct mv88e6xxx_port *mv88e6xxx_port = &chip->ports[port]; - struct mv88e6352_serdes_hw_stat *stat; -@@ -187,7 +187,7 @@ int mv88e6352_serdes_get_stats(struct mv88e6xxx_chip *chip, int port, - - err = mv88e6352_g2_scratch_port_has_serdes(chip, port); - if (err <= 0) -- return err; -+ return 0; - - BUILD_BUG_ON(ARRAY_SIZE(mv88e6352_serdes_hw_stats) > - ARRAY_SIZE(mv88e6xxx_port->serdes_stats)); -@@ -429,8 +429,8 @@ static uint64_t mv88e6390_serdes_get_stat(struct mv88e6xxx_chip *chip, int lane, - return reg[0] | ((u64)reg[1] << 16) | ((u64)reg[2] << 32); - } - --int mv88e6390_serdes_get_stats(struct mv88e6xxx_chip *chip, int port, -- uint64_t *data) -+size_t mv88e6390_serdes_get_stats(struct mv88e6xxx_chip *chip, int port, -+ uint64_t *data) - { - struct mv88e6390_serdes_hw_stat *stat; - int lane; -diff --git a/drivers/net/dsa/mv88e6xxx/serdes.h b/drivers/net/dsa/mv88e6xxx/serdes.h -index aac95cab46e3..ff5c3ab31e15 100644 ---- a/drivers/net/dsa/mv88e6xxx/serdes.h -+++ b/drivers/net/dsa/mv88e6xxx/serdes.h -@@ -127,13 +127,13 @@ unsigned int mv88e6390_serdes_irq_mapping(struct mv88e6xxx_chip *chip, - int mv88e6352_serdes_get_sset_count(struct mv88e6xxx_chip *chip, int port); - int mv88e6352_serdes_get_strings(struct mv88e6xxx_chip *chip, - int port, uint8_t *data); --int mv88e6352_serdes_get_stats(struct mv88e6xxx_chip *chip, int port, -- uint64_t *data); -+size_t mv88e6352_serdes_get_stats(struct mv88e6xxx_chip *chip, int port, -+ uint64_t *data); - int mv88e6390_serdes_get_sset_count(struct mv88e6xxx_chip *chip, int port); - int mv88e6390_serdes_get_strings(struct mv88e6xxx_chip *chip, - int port, uint8_t *data); --int mv88e6390_serdes_get_stats(struct mv88e6xxx_chip *chip, int port, -- uint64_t *data); -+size_t mv88e6390_serdes_get_stats(struct mv88e6xxx_chip *chip, int port, -+ uint64_t *data); - - int mv88e6352_serdes_get_regs_len(struct mv88e6xxx_chip *chip, int port); - void mv88e6352_serdes_get_regs(struct mv88e6xxx_chip *chip, int port, void *_p); --- -2.43.2 - -From 9f75ebaad75d183c38b4081edb1035bab27b6ee7 Mon Sep 17 00:00:00 2001 -From: Christoph Hellwig <hch@lst.de> -Date: Mon, 4 Dec 2023 18:34:18 +0100 -Subject: [PATCH 1150/1501] block: prevent an integer overflow in - bvec_try_merge_hw_page -Content-Length: 940 -Lines: 28 - -[ Upstream commit 3f034c374ad55773c12dd8f3c1607328e17c0072 ] - -Reordered a check to avoid a possible overflow when adding len to bv_len. - -Signed-off-by: Christoph Hellwig <hch@lst.de> -Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com> -Link: https://lore.kernel.org/r/20231204173419.782378-2-hch@lst.de -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - block/bio.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/block/bio.c b/block/bio.c -index 5eba53ca953b..270f6b99926e 100644 ---- a/block/bio.c -+++ b/block/bio.c -@@ -944,7 +944,7 @@ bool bvec_try_merge_hw_page(struct request_queue *q, struct bio_vec *bv, - - if ((addr1 | mask) != (addr2 | mask)) - return false; -- if (bv->bv_len + len > queue_max_segment_size(q)) -+ if (len > queue_max_segment_size(q) - bv->bv_len) - return false; - return bvec_try_merge_page(bv, page, len, offset, same_page); - } --- -2.43.2 - -From 10e40cdeebdfedc1871c2046873dc0db9673a34a Mon Sep 17 00:00:00 2001 -From: Alex Lyakas <alex.lyakas@zadara.com> -Date: Wed, 13 Dec 2023 14:24:31 +0200 -Subject: [PATCH 1151/1501] md: Whenassemble the array, consult the superblock - of the freshest device -Content-Length: 6144 -Lines: 146 - -[ Upstream commit dc1cc22ed58f11d58d8553c5ec5f11cbfc3e3039 ] - -Upon assembling the array, both kernel and mdadm allow the devices to have event -counter difference of 1, and still consider them as up-to-date. -However, a device whose event count is behind by 1, may in fact not be up-to-date, -and array resync with such a device may cause data corruption. -To avoid this, consult the superblock of the freshest device about the status -of a device, whose event counter is behind by 1. - -Signed-off-by: Alex Lyakas <alex.lyakas@zadara.com> -Signed-off-by: Song Liu <song@kernel.org> -Link: https://lore.kernel.org/r/1702470271-16073-1-git-send-email-alex.lyakas@zadara.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/md/md.c | 54 ++++++++++++++++++++++++++++++++++++++++--------- - 1 file changed, 44 insertions(+), 10 deletions(-) - -diff --git a/drivers/md/md.c b/drivers/md/md.c -index 22b54788bcea..21b04607d53a 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -1219,6 +1219,7 @@ struct super_type { - struct md_rdev *refdev, - int minor_version); - int (*validate_super)(struct mddev *mddev, -+ struct md_rdev *freshest, - struct md_rdev *rdev); - void (*sync_super)(struct mddev *mddev, - struct md_rdev *rdev); -@@ -1356,8 +1357,9 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor - - /* - * validate_super for 0.90.0 -+ * note: we are not using "freshest" for 0.9 superblock - */ --static int super_90_validate(struct mddev *mddev, struct md_rdev *rdev) -+static int super_90_validate(struct mddev *mddev, struct md_rdev *freshest, struct md_rdev *rdev) - { - mdp_disk_t *desc; - mdp_super_t *sb = page_address(rdev->sb_page); -@@ -1869,7 +1871,7 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_ - return ret; - } - --static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev) -+static int super_1_validate(struct mddev *mddev, struct md_rdev *freshest, struct md_rdev *rdev) - { - struct mdp_superblock_1 *sb = page_address(rdev->sb_page); - __u64 ev1 = le64_to_cpu(sb->events); -@@ -1965,13 +1967,15 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev) - } - } else if (mddev->pers == NULL) { - /* Insist of good event counter while assembling, except for -- * spares (which don't need an event count) */ -- ++ev1; -+ * spares (which don't need an event count). -+ * Similar to mdadm, we allow event counter difference of 1 -+ * from the freshest device. -+ */ - if (rdev->desc_nr >= 0 && - rdev->desc_nr < le32_to_cpu(sb->max_dev) && - (le16_to_cpu(sb->dev_roles[rdev->desc_nr]) < MD_DISK_ROLE_MAX || - le16_to_cpu(sb->dev_roles[rdev->desc_nr]) == MD_DISK_ROLE_JOURNAL)) -- if (ev1 < mddev->events) -+ if (ev1 + 1 < mddev->events) - return -EINVAL; - } else if (mddev->bitmap) { - /* If adding to array with a bitmap, then we can accept an -@@ -1992,8 +1996,38 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev) - rdev->desc_nr >= le32_to_cpu(sb->max_dev)) { - role = MD_DISK_ROLE_SPARE; - rdev->desc_nr = -1; -- } else -+ } else if (mddev->pers == NULL && freshest && ev1 < mddev->events) { -+ /* -+ * If we are assembling, and our event counter is smaller than the -+ * highest event counter, we cannot trust our superblock about the role. -+ * It could happen that our rdev was marked as Faulty, and all other -+ * superblocks were updated with +1 event counter. -+ * Then, before the next superblock update, which typically happens when -+ * remove_and_add_spares() removes the device from the array, there was -+ * a crash or reboot. -+ * If we allow current rdev without consulting the freshest superblock, -+ * we could cause data corruption. -+ * Note that in this case our event counter is smaller by 1 than the -+ * highest, otherwise, this rdev would not be allowed into array; -+ * both kernel and mdadm allow event counter difference of 1. -+ */ -+ struct mdp_superblock_1 *freshest_sb = page_address(freshest->sb_page); -+ u32 freshest_max_dev = le32_to_cpu(freshest_sb->max_dev); -+ -+ if (rdev->desc_nr >= freshest_max_dev) { -+ /* this is unexpected, better not proceed */ -+ pr_warn("md: %s: rdev[%pg]: desc_nr(%d) >= freshest(%pg)->sb->max_dev(%u)\n", -+ mdname(mddev), rdev->bdev, rdev->desc_nr, -+ freshest->bdev, freshest_max_dev); -+ return -EUCLEAN; -+ } -+ -+ role = le16_to_cpu(freshest_sb->dev_roles[rdev->desc_nr]); -+ pr_debug("md: %s: rdev[%pg]: role=%d(0x%x) according to freshest %pg\n", -+ mdname(mddev), rdev->bdev, role, role, freshest->bdev); -+ } else { - role = le16_to_cpu(sb->dev_roles[rdev->desc_nr]); -+ } - switch(role) { - case MD_DISK_ROLE_SPARE: /* spare */ - break; -@@ -2900,7 +2934,7 @@ static int add_bound_rdev(struct md_rdev *rdev) - * and should be added immediately. - */ - super_types[mddev->major_version]. -- validate_super(mddev, rdev); -+ validate_super(mddev, NULL/*freshest*/, rdev); - err = mddev->pers->hot_add_disk(mddev, rdev); - if (err) { - md_kick_rdev_from_array(rdev); -@@ -3837,7 +3871,7 @@ static int analyze_sbs(struct mddev *mddev) - } - - super_types[mddev->major_version]. -- validate_super(mddev, freshest); -+ validate_super(mddev, NULL/*freshest*/, freshest); - - i = 0; - rdev_for_each_safe(rdev, tmp, mddev) { -@@ -3852,7 +3886,7 @@ static int analyze_sbs(struct mddev *mddev) - } - if (rdev != freshest) { - if (super_types[mddev->major_version]. -- validate_super(mddev, rdev)) { -+ validate_super(mddev, freshest, rdev)) { - pr_warn("md: kicking non-fresh %pg from array!\n", - rdev->bdev); - md_kick_rdev_from_array(rdev); -@@ -6843,7 +6877,7 @@ int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info) - rdev->saved_raid_disk = rdev->raid_disk; - } else - super_types[mddev->major_version]. -- validate_super(mddev, rdev); -+ validate_super(mddev, NULL/*freshest*/, rdev); - if ((info->state & (1<<MD_DISK_SYNC)) && - rdev->raid_disk != info->raid_disk) { - /* This was a hot-add request, but events doesn't --- -2.43.2 - -From 450371ed5b66334091aa5c7d360570d7cad758f4 Mon Sep 17 00:00:00 2001 -From: Alexei Starovoitov <alexei.starovoitov@gmail.com> -Date: Fri, 15 Dec 2023 10:12:23 +0100 -Subject: [PATCH 1152/1501] x86/cfi,bpf: Fix bpf_exception_cb() signature -Content-Length: 1880 -Lines: 47 - -[ Upstream commit 852486b35f344887786d63250946dd921a05d7e8 ] - -As per the earlier patches, BPF sub-programs have bpf_callback_t -signature and CFI expects callers to have matching signature. This is -violated by bpf_prog_aux::bpf_exception_cb(). - -[peterz: Changelog] -Reported-by: Peter Zijlstra <peterz@infradead.org> -Signed-off-by: Alexei Starovoitov <alexei.starovoitov@gmail.com> -Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> -Link: https://lkml.kernel.org/r/CAADnVQ+Z7UcXXBBhMubhcMM=R-dExk-uHtfOLtoLxQ1XxEpqEA@mail.gmail.com -Link: https://lore.kernel.org/r/20231215092707.910319166@infradead.org -Signed-off-by: Alexei Starovoitov <ast@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/linux/bpf.h | 2 +- - kernel/bpf/helpers.c | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/include/linux/bpf.h b/include/linux/bpf.h -index 7a7859a5cce4..cfc6d2f98058 100644 ---- a/include/linux/bpf.h -+++ b/include/linux/bpf.h -@@ -1447,7 +1447,7 @@ struct bpf_prog_aux { - int cgroup_atype; /* enum cgroup_bpf_attach_type */ - struct bpf_map *cgroup_storage[MAX_BPF_CGROUP_STORAGE_TYPE]; - char name[BPF_OBJ_NAME_LEN]; -- unsigned int (*bpf_exception_cb)(u64 cookie, u64 sp, u64 bp); -+ u64 (*bpf_exception_cb)(u64 cookie, u64 sp, u64 bp, u64, u64); - #ifdef CONFIG_SECURITY - void *security; - #endif -diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c -index 991186520af0..b3053af6427d 100644 ---- a/kernel/bpf/helpers.c -+++ b/kernel/bpf/helpers.c -@@ -2509,7 +2509,7 @@ __bpf_kfunc void bpf_throw(u64 cookie) - * which skips compiler generated instrumentation to do the same. - */ - kasan_unpoison_task_stack_below((void *)(long)ctx.sp); -- ctx.aux->bpf_exception_cb(cookie, ctx.sp, ctx.bp); -+ ctx.aux->bpf_exception_cb(cookie, ctx.sp, ctx.bp, 0, 0); - WARN(1, "A call to BPF exception callback should never return\n"); - } - --- -2.43.2 - -From 2c8cd52a0298493ea62f9f180edaf326f20c01c3 Mon Sep 17 00:00:00 2001 -From: Jesse Brandeburg <jesse.brandeburg@intel.com> -Date: Tue, 5 Dec 2023 17:01:01 -0800 -Subject: [PATCH 1156/1501] intel: add bit macro includes where needed -Content-Length: 10095 -Lines: 297 - -[ Upstream commit 3314f2097dee43defc20554f961a8b17f4787e2d ] - -This series is introducing the use of FIELD_GET and FIELD_PREP which -requires bitfield.h to be included. Fix all the includes in this one -change, and rearrange includes into alphabetical order to ease -readability and future maintenance. - -virtchnl.h and it's usage was modified to have it's own includes as it -should. This required including bits.h for virtchnl.h. - -Reviewed-by: Marcin Szycik <marcin.szycik@linux.intel.com> -Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> -Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/intel/e1000/e1000_hw.c | 1 + - drivers/net/ethernet/intel/fm10k/fm10k_pf.c | 1 + - drivers/net/ethernet/intel/fm10k/fm10k_vf.c | 1 + - drivers/net/ethernet/intel/i40e/i40e_common.c | 1 + - drivers/net/ethernet/intel/i40e/i40e_dcb.c | 2 ++ - drivers/net/ethernet/intel/i40e/i40e_nvm.c | 1 + - drivers/net/ethernet/intel/iavf/iavf_common.c | 3 +- - .../net/ethernet/intel/iavf/iavf_ethtool.c | 5 ++-- - drivers/net/ethernet/intel/iavf/iavf_fdir.c | 1 + - drivers/net/ethernet/intel/iavf/iavf_txrx.c | 1 + - drivers/net/ethernet/intel/igb/e1000_i210.c | 4 +-- - drivers/net/ethernet/intel/igb/e1000_nvm.c | 4 +-- - drivers/net/ethernet/intel/igb/e1000_phy.c | 4 +-- - drivers/net/ethernet/intel/igbvf/netdev.c | 28 +++++++++---------- - drivers/net/ethernet/intel/igc/igc_i225.c | 1 + - drivers/net/ethernet/intel/igc/igc_phy.c | 1 + - include/linux/avf/virtchnl.h | 1 + - 17 files changed, 37 insertions(+), 23 deletions(-) - -diff --git a/drivers/net/ethernet/intel/e1000/e1000_hw.c b/drivers/net/ethernet/intel/e1000/e1000_hw.c -index 4542e2bc28e8..4576511c99f5 100644 ---- a/drivers/net/ethernet/intel/e1000/e1000_hw.c -+++ b/drivers/net/ethernet/intel/e1000/e1000_hw.c -@@ -5,6 +5,7 @@ - * Shared functions for accessing and configuring the MAC - */ - -+#include <linux/bitfield.h> - #include "e1000.h" - - static s32 e1000_check_downshift(struct e1000_hw *hw); -diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c -index af1b0cde3670..ae700a1807c6 100644 ---- a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c -+++ b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c -@@ -1,6 +1,7 @@ - // SPDX-License-Identifier: GPL-2.0 - /* Copyright(c) 2013 - 2019 Intel Corporation. */ - -+#include <linux/bitfield.h> - #include "fm10k_pf.h" - #include "fm10k_vf.h" - -diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c -index dc8ccd378ec9..c50928ec14ff 100644 ---- a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c -+++ b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c -@@ -1,6 +1,7 @@ - // SPDX-License-Identifier: GPL-2.0 - /* Copyright(c) 2013 - 2019 Intel Corporation. */ - -+#include <linux/bitfield.h> - #include "fm10k_vf.h" - - /** -diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c -index d7e24d661724..3eb6564c1cbc 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_common.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_common.c -@@ -2,6 +2,7 @@ - /* Copyright(c) 2013 - 2021 Intel Corporation. */ - - #include <linux/avf/virtchnl.h> -+#include <linux/bitfield.h> - #include <linux/delay.h> - #include <linux/etherdevice.h> - #include <linux/pci.h> -diff --git a/drivers/net/ethernet/intel/i40e/i40e_dcb.c b/drivers/net/ethernet/intel/i40e/i40e_dcb.c -index 68602fc375f6..d57dd30b024f 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_dcb.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_dcb.c -@@ -1,6 +1,8 @@ - // SPDX-License-Identifier: GPL-2.0 - /* Copyright(c) 2013 - 2021 Intel Corporation. */ - -+#include <linux/bitfield.h> -+#include "i40e_adminq.h" - #include "i40e_alloc.h" - #include "i40e_dcb.h" - #include "i40e_prototype.h" -diff --git a/drivers/net/ethernet/intel/i40e/i40e_nvm.c b/drivers/net/ethernet/intel/i40e/i40e_nvm.c -index 77cdbfc19d47..e5aec09d58e2 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_nvm.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_nvm.c -@@ -1,6 +1,7 @@ - // SPDX-License-Identifier: GPL-2.0 - /* Copyright(c) 2013 - 2018 Intel Corporation. */ - -+#include <linux/bitfield.h> - #include <linux/delay.h> - #include "i40e_alloc.h" - #include "i40e_prototype.h" -diff --git a/drivers/net/ethernet/intel/iavf/iavf_common.c b/drivers/net/ethernet/intel/iavf/iavf_common.c -index 8091e6feca01..6a10c0ecf2b5 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_common.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_common.c -@@ -1,10 +1,11 @@ - // SPDX-License-Identifier: GPL-2.0 - /* Copyright(c) 2013 - 2018 Intel Corporation. */ - -+#include <linux/avf/virtchnl.h> -+#include <linux/bitfield.h> - #include "iavf_type.h" - #include "iavf_adminq.h" - #include "iavf_prototype.h" --#include <linux/avf/virtchnl.h> - - /** - * iavf_aq_str - convert AQ err code to a string -diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c -index dc499fe7734e..25ba5653ac6b 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c -@@ -1,11 +1,12 @@ - // SPDX-License-Identifier: GPL-2.0 - /* Copyright(c) 2013 - 2018 Intel Corporation. */ - -+#include <linux/bitfield.h> -+#include <linux/uaccess.h> -+ - /* ethtool support for iavf */ - #include "iavf.h" - --#include <linux/uaccess.h> -- - /* ethtool statistics helpers */ - - /** -diff --git a/drivers/net/ethernet/intel/iavf/iavf_fdir.c b/drivers/net/ethernet/intel/iavf/iavf_fdir.c -index 03e774bd2a5b..65ddcd81c993 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_fdir.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_fdir.c -@@ -3,6 +3,7 @@ - - /* flow director ethtool support for iavf */ - -+#include <linux/bitfield.h> - #include "iavf.h" - - #define GTPU_PORT 2152 -diff --git a/drivers/net/ethernet/intel/iavf/iavf_txrx.c b/drivers/net/ethernet/intel/iavf/iavf_txrx.c -index d64c4997136b..fb7edba9c2f8 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_txrx.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_txrx.c -@@ -1,6 +1,7 @@ - // SPDX-License-Identifier: GPL-2.0 - /* Copyright(c) 2013 - 2018 Intel Corporation. */ - -+#include <linux/bitfield.h> - #include <linux/prefetch.h> - - #include "iavf.h" -diff --git a/drivers/net/ethernet/intel/igb/e1000_i210.c b/drivers/net/ethernet/intel/igb/e1000_i210.c -index b9b9d35494d2..53b396fd194a 100644 ---- a/drivers/net/ethernet/intel/igb/e1000_i210.c -+++ b/drivers/net/ethernet/intel/igb/e1000_i210.c -@@ -5,9 +5,9 @@ - * e1000_i211 - */ - --#include <linux/types.h> -+#include <linux/bitfield.h> - #include <linux/if_ether.h> -- -+#include <linux/types.h> - #include "e1000_hw.h" - #include "e1000_i210.h" - -diff --git a/drivers/net/ethernet/intel/igb/e1000_nvm.c b/drivers/net/ethernet/intel/igb/e1000_nvm.c -index fa136e6e9328..0da57e89593a 100644 ---- a/drivers/net/ethernet/intel/igb/e1000_nvm.c -+++ b/drivers/net/ethernet/intel/igb/e1000_nvm.c -@@ -1,9 +1,9 @@ - // SPDX-License-Identifier: GPL-2.0 - /* Copyright(c) 2007 - 2018 Intel Corporation. */ - --#include <linux/if_ether.h> -+#include <linux/bitfield.h> - #include <linux/delay.h> -- -+#include <linux/if_ether.h> - #include "e1000_mac.h" - #include "e1000_nvm.h" - -diff --git a/drivers/net/ethernet/intel/igb/e1000_phy.c b/drivers/net/ethernet/intel/igb/e1000_phy.c -index a018000f7db9..3c1b562a3271 100644 ---- a/drivers/net/ethernet/intel/igb/e1000_phy.c -+++ b/drivers/net/ethernet/intel/igb/e1000_phy.c -@@ -1,9 +1,9 @@ - // SPDX-License-Identifier: GPL-2.0 - /* Copyright(c) 2007 - 2018 Intel Corporation. */ - --#include <linux/if_ether.h> -+#include <linux/bitfield.h> - #include <linux/delay.h> -- -+#include <linux/if_ether.h> - #include "e1000_mac.h" - #include "e1000_phy.h" - -diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c -index fd712585af27..e6c1fbee049e 100644 ---- a/drivers/net/ethernet/intel/igbvf/netdev.c -+++ b/drivers/net/ethernet/intel/igbvf/netdev.c -@@ -3,25 +3,25 @@ - - #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt - --#include <linux/module.h> --#include <linux/types.h> --#include <linux/init.h> --#include <linux/pci.h> --#include <linux/vmalloc.h> --#include <linux/pagemap.h> -+#include <linux/bitfield.h> - #include <linux/delay.h> --#include <linux/netdevice.h> --#include <linux/tcp.h> --#include <linux/ipv6.h> --#include <linux/slab.h> --#include <net/checksum.h> --#include <net/ip6_checksum.h> --#include <linux/mii.h> - #include <linux/ethtool.h> - #include <linux/if_vlan.h> -+#include <linux/init.h> -+#include <linux/ipv6.h> -+#include <linux/mii.h> -+#include <linux/module.h> -+#include <linux/netdevice.h> -+#include <linux/pagemap.h> -+#include <linux/pci.h> - #include <linux/prefetch.h> - #include <linux/sctp.h> -- -+#include <linux/slab.h> -+#include <linux/tcp.h> -+#include <linux/types.h> -+#include <linux/vmalloc.h> -+#include <net/checksum.h> -+#include <net/ip6_checksum.h> - #include "igbvf.h" - - char igbvf_driver_name[] = "igbvf"; -diff --git a/drivers/net/ethernet/intel/igc/igc_i225.c b/drivers/net/ethernet/intel/igc/igc_i225.c -index 17546a035ab1..d2562c8e8015 100644 ---- a/drivers/net/ethernet/intel/igc/igc_i225.c -+++ b/drivers/net/ethernet/intel/igc/igc_i225.c -@@ -1,6 +1,7 @@ - // SPDX-License-Identifier: GPL-2.0 - /* Copyright (c) 2018 Intel Corporation */ - -+#include <linux/bitfield.h> - #include <linux/delay.h> - - #include "igc_hw.h" -diff --git a/drivers/net/ethernet/intel/igc/igc_phy.c b/drivers/net/ethernet/intel/igc/igc_phy.c -index 53b77c969c85..d0d9e7170154 100644 ---- a/drivers/net/ethernet/intel/igc/igc_phy.c -+++ b/drivers/net/ethernet/intel/igc/igc_phy.c -@@ -1,6 +1,7 @@ - // SPDX-License-Identifier: GPL-2.0 - /* Copyright (c) 2018 Intel Corporation */ - -+#include <linux/bitfield.h> - #include "igc_phy.h" - - /** -diff --git a/include/linux/avf/virtchnl.h b/include/linux/avf/virtchnl.h -index 6b3acf15be5c..99ae7960a8d1 100644 ---- a/include/linux/avf/virtchnl.h -+++ b/include/linux/avf/virtchnl.h -@@ -5,6 +5,7 @@ - #define _VIRTCHNL_H_ - - #include <linux/bitops.h> -+#include <linux/bits.h> - #include <linux/overflow.h> - #include <uapi/linux/if_ether.h> - --- -2.43.2 - -From 55fd6e3c348ddbb6d2b7f6b707ca1ae343030cc3 Mon Sep 17 00:00:00 2001 -From: Jesse Brandeburg <jesse.brandeburg@intel.com> -Date: Tue, 5 Dec 2023 17:01:06 -0800 -Subject: [PATCH 1157/1501] ice: fix pre-shifted bit usage -Content-Length: 5155 -Lines: 113 - -[ Upstream commit 7173be21ae29ef50ada42fd4464056a9d3f55bb3 ] - -While converting to FIELD_PREP() and FIELD_GET(), it was noticed that -some of the RSS defines had *included* the shift in their definitions. -This is completely outside of normal, such that a developer could easily -make a mistake and shift at the usage site (like when using -FIELD_PREP()). - -Rename the defines and set them to the "pre-shifted values" so they -match the template the driver normally uses for masks and the member -bits of the mask, which also allows the driver to use FIELD_PREP -correctly with these values. Use GENMASK() for this changed MASK value. - -Do the same for the VLAN EMODE defines as well. - -Reviewed-by: Marcin Szycik <marcin.szycik@linux.intel.com> -Reviewed-by: Simon Horman <horms@kernel.org> -Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> -Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel) -Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 10 +++++----- - drivers/net/ethernet/intel/ice/ice_lib.c | 3 ++- - .../net/ethernet/intel/ice/ice_vsi_vlan_lib.c | 16 +++++++++++----- - 3 files changed, 18 insertions(+), 11 deletions(-) - -diff --git a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h -index 812a35d79b95..b8437c36ff38 100644 ---- a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h -+++ b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h -@@ -421,10 +421,10 @@ struct ice_aqc_vsi_props { - #define ICE_AQ_VSI_INNER_VLAN_INSERT_PVID BIT(2) - #define ICE_AQ_VSI_INNER_VLAN_EMODE_S 3 - #define ICE_AQ_VSI_INNER_VLAN_EMODE_M (0x3 << ICE_AQ_VSI_INNER_VLAN_EMODE_S) --#define ICE_AQ_VSI_INNER_VLAN_EMODE_STR_BOTH (0x0 << ICE_AQ_VSI_INNER_VLAN_EMODE_S) --#define ICE_AQ_VSI_INNER_VLAN_EMODE_STR_UP (0x1 << ICE_AQ_VSI_INNER_VLAN_EMODE_S) --#define ICE_AQ_VSI_INNER_VLAN_EMODE_STR (0x2 << ICE_AQ_VSI_INNER_VLAN_EMODE_S) --#define ICE_AQ_VSI_INNER_VLAN_EMODE_NOTHING (0x3 << ICE_AQ_VSI_INNER_VLAN_EMODE_S) -+#define ICE_AQ_VSI_INNER_VLAN_EMODE_STR_BOTH 0x0U -+#define ICE_AQ_VSI_INNER_VLAN_EMODE_STR_UP 0x1U -+#define ICE_AQ_VSI_INNER_VLAN_EMODE_STR 0x2U -+#define ICE_AQ_VSI_INNER_VLAN_EMODE_NOTHING 0x3U - u8 inner_vlan_reserved2[3]; - /* ingress egress up sections */ - __le32 ingress_table; /* bitmap, 3 bits per up */ -@@ -490,7 +490,7 @@ struct ice_aqc_vsi_props { - #define ICE_AQ_VSI_Q_OPT_RSS_GBL_LUT_S 2 - #define ICE_AQ_VSI_Q_OPT_RSS_GBL_LUT_M (0xF << ICE_AQ_VSI_Q_OPT_RSS_GBL_LUT_S) - #define ICE_AQ_VSI_Q_OPT_RSS_HASH_S 6 --#define ICE_AQ_VSI_Q_OPT_RSS_HASH_M (0x3 << ICE_AQ_VSI_Q_OPT_RSS_HASH_S) -+#define ICE_AQ_VSI_Q_OPT_RSS_HASH_M GENMASK(7, 6) - #define ICE_AQ_VSI_Q_OPT_RSS_HASH_TPLZ 0x0U - #define ICE_AQ_VSI_Q_OPT_RSS_HASH_SYM_TPLZ 0x1U - #define ICE_AQ_VSI_Q_OPT_RSS_HASH_XOR 0x2U -diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c -index 24f95880a2ed..c01950de44ce 100644 ---- a/drivers/net/ethernet/intel/ice/ice_lib.c -+++ b/drivers/net/ethernet/intel/ice/ice_lib.c -@@ -979,7 +979,8 @@ static void ice_set_dflt_vsi_ctx(struct ice_hw *hw, struct ice_vsi_ctx *ctxt) - */ - if (ice_is_dvm_ena(hw)) { - ctxt->info.inner_vlan_flags |= -- ICE_AQ_VSI_INNER_VLAN_EMODE_NOTHING; -+ FIELD_PREP(ICE_AQ_VSI_INNER_VLAN_EMODE_M, -+ ICE_AQ_VSI_INNER_VLAN_EMODE_NOTHING); - ctxt->info.outer_vlan_flags = - (ICE_AQ_VSI_OUTER_VLAN_TX_MODE_ALL << - ICE_AQ_VSI_OUTER_VLAN_TX_MODE_S) & -diff --git a/drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.c b/drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.c -index 76266e709a39..8307902115ff 100644 ---- a/drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.c -+++ b/drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.c -@@ -131,6 +131,7 @@ static int ice_vsi_manage_vlan_stripping(struct ice_vsi *vsi, bool ena) - { - struct ice_hw *hw = &vsi->back->hw; - struct ice_vsi_ctx *ctxt; -+ u8 *ivf; - int err; - - /* do not allow modifying VLAN stripping when a port VLAN is configured -@@ -143,19 +144,24 @@ static int ice_vsi_manage_vlan_stripping(struct ice_vsi *vsi, bool ena) - if (!ctxt) - return -ENOMEM; - -+ ivf = &ctxt->info.inner_vlan_flags; -+ - /* Here we are configuring what the VSI should do with the VLAN tag in - * the Rx packet. We can either leave the tag in the packet or put it in - * the Rx descriptor. - */ -- if (ena) -+ if (ena) { - /* Strip VLAN tag from Rx packet and put it in the desc */ -- ctxt->info.inner_vlan_flags = ICE_AQ_VSI_INNER_VLAN_EMODE_STR_BOTH; -- else -+ *ivf = FIELD_PREP(ICE_AQ_VSI_INNER_VLAN_EMODE_M, -+ ICE_AQ_VSI_INNER_VLAN_EMODE_STR_BOTH); -+ } else { - /* Disable stripping. Leave tag in packet */ -- ctxt->info.inner_vlan_flags = ICE_AQ_VSI_INNER_VLAN_EMODE_NOTHING; -+ *ivf = FIELD_PREP(ICE_AQ_VSI_INNER_VLAN_EMODE_M, -+ ICE_AQ_VSI_INNER_VLAN_EMODE_NOTHING); -+ } - - /* Allow all packets untagged/tagged */ -- ctxt->info.inner_vlan_flags |= ICE_AQ_VSI_INNER_VLAN_TX_MODE_ALL; -+ *ivf |= ICE_AQ_VSI_INNER_VLAN_TX_MODE_ALL; - - ctxt->info.valid_sections = cpu_to_le16(ICE_AQ_VSI_PROP_VLAN_VALID); - --- -2.43.2 - -From f84e56599f3b08e2ac35218f493acacb8a6889dc Mon Sep 17 00:00:00 2001 -From: Ching-Te Ku <ku920601@realtek.com> -Date: Mon, 18 Dec 2023 14:13:31 +0800 -Subject: [PATCH 1160/1501] wifi: rtw89: coex: Fix wrong Wi-Fi role info and - FDDT parameter members -Content-Length: 3060 -Lines: 70 - -[ Upstream commit acc55d7dd4de525ac07e43e90ea3cc630677ec8a ] - -The Wi-Fi firmware 29.29.X should use version 2 role info format. FDDT -mechanism version 5 use the same cell members to judge traffic situation, -don't need to add another new format. - -Signed-off-by: Ching-Te Ku <ku920601@realtek.com> -Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://msgid.link/20231218061341.51255-2-pkshih@realtek.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/realtek/rtw89/coex.c | 4 ++-- - drivers/net/wireless/realtek/rtw89/core.h | 12 +++--------- - 2 files changed, 5 insertions(+), 11 deletions(-) - -diff --git a/drivers/net/wireless/realtek/rtw89/coex.c b/drivers/net/wireless/realtek/rtw89/coex.c -index bdcc172639e4..ace7bbf2cf94 100644 ---- a/drivers/net/wireless/realtek/rtw89/coex.c -+++ b/drivers/net/wireless/realtek/rtw89/coex.c -@@ -131,7 +131,7 @@ static const struct rtw89_btc_ver rtw89_btc_ver_defs[] = { - .fcxbtcrpt = 105, .fcxtdma = 3, .fcxslots = 1, .fcxcysta = 5, - .fcxstep = 3, .fcxnullsta = 2, .fcxmreg = 2, .fcxgpiodbg = 1, - .fcxbtver = 1, .fcxbtscan = 2, .fcxbtafh = 2, .fcxbtdevinfo = 1, -- .fwlrole = 1, .frptmap = 3, .fcxctrl = 1, -+ .fwlrole = 2, .frptmap = 3, .fcxctrl = 1, - .info_buf = 1800, .max_role_num = 6, - }, - {RTL8852C, RTW89_FW_VER_CODE(0, 27, 57, 0), -@@ -159,7 +159,7 @@ static const struct rtw89_btc_ver rtw89_btc_ver_defs[] = { - .fcxbtcrpt = 105, .fcxtdma = 3, .fcxslots = 1, .fcxcysta = 5, - .fcxstep = 3, .fcxnullsta = 2, .fcxmreg = 2, .fcxgpiodbg = 1, - .fcxbtver = 1, .fcxbtscan = 2, .fcxbtafh = 2, .fcxbtdevinfo = 1, -- .fwlrole = 1, .frptmap = 3, .fcxctrl = 1, -+ .fwlrole = 2, .frptmap = 3, .fcxctrl = 1, - .info_buf = 1800, .max_role_num = 6, - }, - {RTL8852B, RTW89_FW_VER_CODE(0, 29, 14, 0), -diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h -index 91e4d4e79eea..8f59461e58f2 100644 ---- a/drivers/net/wireless/realtek/rtw89/core.h -+++ b/drivers/net/wireless/realtek/rtw89/core.h -@@ -2294,12 +2294,6 @@ struct rtw89_btc_fbtc_fddt_cell_status { - u8 state_phase; /* [0:3] train state, [4:7] train phase */ - } __packed; - --struct rtw89_btc_fbtc_fddt_cell_status_v5 { -- s8 wl_tx_pwr; -- s8 bt_tx_pwr; -- s8 bt_rx_gain; --} __packed; -- - struct rtw89_btc_fbtc_cysta_v3 { /* statistics for cycles */ - u8 fver; - u8 rsvd; -@@ -2363,9 +2357,9 @@ struct rtw89_btc_fbtc_cysta_v5 { /* statistics for cycles */ - struct rtw89_btc_fbtc_cycle_a2dp_empty_info a2dp_ept; - struct rtw89_btc_fbtc_a2dp_trx_stat_v4 a2dp_trx[BTC_CYCLE_SLOT_MAX]; - struct rtw89_btc_fbtc_cycle_fddt_info_v5 fddt_trx[BTC_CYCLE_SLOT_MAX]; -- struct rtw89_btc_fbtc_fddt_cell_status_v5 fddt_cells[FDD_TRAIN_WL_DIRECTION] -- [FDD_TRAIN_WL_RSSI_LEVEL] -- [FDD_TRAIN_BT_RSSI_LEVEL]; -+ struct rtw89_btc_fbtc_fddt_cell_status fddt_cells[FDD_TRAIN_WL_DIRECTION] -+ [FDD_TRAIN_WL_RSSI_LEVEL] -+ [FDD_TRAIN_BT_RSSI_LEVEL]; - __le32 except_map; - } __packed; - --- -2.43.2 - -From ab26541270c722eedf8eefd62797c3ce3d18a91b Mon Sep 17 00:00:00 2001 -From: Mingyi Zhang <zhangmingyi5@huawei.com> -Date: Thu, 21 Dec 2023 11:39:47 +0800 -Subject: [PATCH 1161/1501] libbpf: Fix NULL pointer dereference in - bpf_object__collect_prog_relos -Content-Length: 2507 -Lines: 64 - -[ Upstream commit fc3a5534e2a8855427403113cbeb54af5837bbe0 ] - -An issue occurred while reading an ELF file in libbpf.c during fuzzing: - - Program received signal SIGSEGV, Segmentation fault. - 0x0000000000958e97 in bpf_object.collect_prog_relos () at libbpf.c:4206 - 4206 in libbpf.c - (gdb) bt - #0 0x0000000000958e97 in bpf_object.collect_prog_relos () at libbpf.c:4206 - #1 0x000000000094f9d6 in bpf_object.collect_relos () at libbpf.c:6706 - #2 0x000000000092bef3 in bpf_object_open () at libbpf.c:7437 - #3 0x000000000092c046 in bpf_object.open_mem () at libbpf.c:7497 - #4 0x0000000000924afa in LLVMFuzzerTestOneInput () at fuzz/bpf-object-fuzzer.c:16 - #5 0x000000000060be11 in testblitz_engine::fuzzer::Fuzzer::run_one () - #6 0x000000000087ad92 in tracing::span::Span::in_scope () - #7 0x00000000006078aa in testblitz_engine::fuzzer::util::walkdir () - #8 0x00000000005f3217 in testblitz_engine::entrypoint::main::{{closure}} () - #9 0x00000000005f2601 in main () - (gdb) - -scn_data was null at this code(tools/lib/bpf/src/libbpf.c): - - if (rel->r_offset % BPF_INSN_SZ || rel->r_offset >= scn_data->d_size) { - -The scn_data is derived from the code above: - - scn = elf_sec_by_idx(obj, sec_idx); - scn_data = elf_sec_data(obj, scn); - - relo_sec_name = elf_sec_str(obj, shdr->sh_name); - sec_name = elf_sec_name(obj, scn); - if (!relo_sec_name || !sec_name)// don't check whether scn_data is NULL - return -EINVAL; - -In certain special scenarios, such as reading a malformed ELF file, -it is possible that scn_data may be a null pointer - -Signed-off-by: Mingyi Zhang <zhangmingyi5@huawei.com> -Signed-off-by: Xin Liu <liuxin350@huawei.com> -Signed-off-by: Changye Wu <wuchangye@huawei.com> -Signed-off-by: Andrii Nakryiko <andrii@kernel.org> -Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> -Acked-by: Daniel Borkmann <daniel@iogearbox.net> -Link: https://lore.kernel.org/bpf/20231221033947.154564-1-liuxin350@huawei.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/lib/bpf/libbpf.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c -index e067be95da3c..df1b550f7460 100644 ---- a/tools/lib/bpf/libbpf.c -+++ b/tools/lib/bpf/libbpf.c -@@ -4344,6 +4344,8 @@ bpf_object__collect_prog_relos(struct bpf_object *obj, Elf64_Shdr *shdr, Elf_Dat - - scn = elf_sec_by_idx(obj, sec_idx); - scn_data = elf_sec_data(obj, scn); -+ if (!scn_data) -+ return -LIBBPF_ERRNO__FORMAT; - - relo_sec_name = elf_sec_str(obj, shdr->sh_name); - sec_name = elf_sec_name(obj, scn); --- -2.43.2 - -From c369a21382a68ee5ee9e0856d48c26c43bd99e8f Mon Sep 17 00:00:00 2001 -From: Su Hui <suhui@nfschina.com> -Date: Tue, 19 Dec 2023 14:57:39 +0800 -Subject: [PATCH 1162/1501] wifi: rtlwifi: rtl8723{be,ae}: using - calculate_bit_shift() -Content-Length: 2968 -Lines: 69 - -[ Upstream commit 5c16618bc06a41ad68fd8499a21d35ef57ca06c2 ] - -Using calculate_bit_shift() to replace rtl8723_phy_calculate_bit_shift(). -And fix an undefined bitwise shift behavior problem. - -Signed-off-by: Su Hui <suhui@nfschina.com> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://msgid.link/20231219065739.1895666-12-suhui@nfschina.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/realtek/rtlwifi/rtl8723ae/phy.c | 6 +++--- - drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c | 4 ++-- - 2 files changed, 5 insertions(+), 5 deletions(-) - -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/phy.c -index fe9b407dc2af..71e29b103da5 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/phy.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/phy.c -@@ -49,7 +49,7 @@ u32 rtl8723e_phy_query_rf_reg(struct ieee80211_hw *hw, - rfpath, regaddr); - } - -- bitshift = rtl8723_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - readback_value = (original_value & bitmask) >> bitshift; - - spin_unlock(&rtlpriv->locks.rf_lock); -@@ -80,7 +80,7 @@ void rtl8723e_phy_set_rf_reg(struct ieee80211_hw *hw, - original_value = rtl8723_phy_rf_serial_read(hw, - rfpath, - regaddr); -- bitshift = rtl8723_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = - ((original_value & (~bitmask)) | - (data << bitshift)); -@@ -89,7 +89,7 @@ void rtl8723e_phy_set_rf_reg(struct ieee80211_hw *hw, - rtl8723_phy_rf_serial_write(hw, rfpath, regaddr, data); - } else { - if (bitmask != RFREG_OFFSET_MASK) { -- bitshift = rtl8723_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = - ((original_value & (~bitmask)) | - (data << bitshift)); -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c -index 2b9313cb93db..094cb36153f5 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c -@@ -41,7 +41,7 @@ u32 rtl8723be_phy_query_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath, - spin_lock(&rtlpriv->locks.rf_lock); - - original_value = rtl8723_phy_rf_serial_read(hw, rfpath, regaddr); -- bitshift = rtl8723_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - readback_value = (original_value & bitmask) >> bitshift; - - spin_unlock(&rtlpriv->locks.rf_lock); -@@ -68,7 +68,7 @@ void rtl8723be_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path path, - if (bitmask != RFREG_OFFSET_MASK) { - original_value = rtl8723_phy_rf_serial_read(hw, path, - regaddr); -- bitshift = rtl8723_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = ((original_value & (~bitmask)) | - (data << bitshift)); - } --- -2.43.2 - -From 357c371dfd06f0fda3c690de84ed4bceff43e1f7 Mon Sep 17 00:00:00 2001 -From: Benjamin Berg <benjamin.berg@intel.com> -Date: Wed, 20 Dec 2023 13:41:41 +0200 -Subject: [PATCH 1163/1501] wifi: cfg80211: free beacon_ies when overridden - from hidden BSS -Content-Length: 1334 -Lines: 36 - -[ Upstream commit 32af9a9e1069e55bc02741fb00ac9d0ca1a2eaef ] - -This is a more of a cosmetic fix. The branch will only be taken if -proberesp_ies is set, which implies that beacon_ies is not set unless we -are connected to an AP that just did a channel switch. And, in that case -we should have found the BSS in the internal storage to begin with. - -Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> -Reviewed-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> -Link: https://msgid.link/20231220133549.b898e22dadff.Id8c4c10aedd176ef2e18a4cad747b299f150f9df@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/wireless/scan.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/net/wireless/scan.c b/net/wireless/scan.c -index 0d6c3fc1238a..082f0bd4ebdd 100644 ---- a/net/wireless/scan.c -+++ b/net/wireless/scan.c -@@ -1864,8 +1864,12 @@ __cfg80211_bss_update(struct cfg80211_registered_device *rdev, - list_add(&new->hidden_list, - &hidden->hidden_list); - hidden->refcount++; -+ -+ ies = (void *)rcu_dereference(new->pub.beacon_ies); - rcu_assign_pointer(new->pub.beacon_ies, - hidden->pub.beacon_ies); -+ if (ies) -+ kfree_rcu(ies, rcu_head); - } - } else { - /* --- -2.43.2 - -From d9763a01e308fa1b60548354a76d6074f9c05594 Mon Sep 17 00:00:00 2001 -From: Zijun Hu <quic_zijuhu@quicinc.com> -Date: Mon, 6 Nov 2023 14:02:46 +0800 -Subject: [PATCH 1164/1501] Bluetooth: qca: Set both WIDEBAND_SPEECH and - LE_STATES quirks for QCA2066 -Content-Length: 934 -Lines: 26 - -[ Upstream commit 5d192b697c7417254cdd9edc3d5e9e0364eb9045 ] - -Set both WIDEBAND_SPEECH_SUPPORTED and VALID_LE_STATES quirks -for QCA2066. - -Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com> -Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/bluetooth/hci_qca.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c -index 067e248e3599..35f74f209d1f 100644 ---- a/drivers/bluetooth/hci_qca.c -+++ b/drivers/bluetooth/hci_qca.c -@@ -2039,6 +2039,7 @@ static const struct qca_device_data qca_soc_data_wcn3998 __maybe_unused = { - static const struct qca_device_data qca_soc_data_qca2066 __maybe_unused = { - .soc_type = QCA_QCA2066, - .num_vregs = 0, -+ .capabilities = QCA_CAP_WIDEBAND_SPEECH | QCA_CAP_VALID_LE_STATES, - }; - - static const struct qca_device_data qca_soc_data_qca6390 __maybe_unused = { --- -2.43.2 - -From f291566ad1b10986ce5725ce9348a54e771e19ec Mon Sep 17 00:00:00 2001 -From: Iulia Tanasescu <iulia.tanasescu@nxp.com> -Date: Tue, 5 Dec 2023 18:11:40 +0200 -Subject: [PATCH 1165/1501] Bluetooth: ISO: Avoid creating child socket if PA - sync is terminating -Content-Length: 3966 -Lines: 130 - -[ Upstream commit 9f150019f176078144b02c4b9b9dbe7fd5a2fcc3 ] - -When a PA sync socket is closed, the associated hcon is also unlinked -and cleaned up. If there are no other hcons marked with the -HCI_CONN_PA_SYNC flag, HCI_OP_LE_PA_TERM_SYNC is sent to controller. - -Between the time of the command and the moment PA sync is terminated -in controller, residual BIGInfo reports might continue to come. -This causes a new PA sync hcon to be added, and a new socket to be -notified to user space. - -This commit fixs this by adding a flag on a Broadcast listening -socket to mark when the PA sync child has been closed. - -This flag is checked when BIGInfo reports are indicated in -iso_connect_ind, to avoid recreating a hcon and socket if -residual reports arrive before PA sync is terminated. - -Signed-off-by: Iulia Tanasescu <iulia.tanasescu@nxp.com> -Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/bluetooth/iso.c | 51 ++++++++++++++++++++++++++++++++++++++++++--- - 1 file changed, 48 insertions(+), 3 deletions(-) - -diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c -index 07b80e97aead..fd81289fd3e5 100644 ---- a/net/bluetooth/iso.c -+++ b/net/bluetooth/iso.c -@@ -54,6 +54,7 @@ static void iso_sock_kill(struct sock *sk); - enum { - BT_SK_BIG_SYNC, - BT_SK_PA_SYNC, -+ BT_SK_PA_SYNC_TERM, - }; - - struct iso_pinfo { -@@ -82,6 +83,11 @@ static bool iso_match_sid(struct sock *sk, void *data); - static bool iso_match_sync_handle(struct sock *sk, void *data); - static void iso_sock_disconn(struct sock *sk); - -+typedef bool (*iso_sock_match_t)(struct sock *sk, void *data); -+ -+static struct sock *iso_get_sock_listen(bdaddr_t *src, bdaddr_t *dst, -+ iso_sock_match_t match, void *data); -+ - /* ---- ISO timers ---- */ - #define ISO_CONN_TIMEOUT (HZ * 40) - #define ISO_DISCONN_TIMEOUT (HZ * 2) -@@ -190,10 +196,21 @@ static void iso_chan_del(struct sock *sk, int err) - sock_set_flag(sk, SOCK_ZAPPED); - } - -+static bool iso_match_conn_sync_handle(struct sock *sk, void *data) -+{ -+ struct hci_conn *hcon = data; -+ -+ if (test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) -+ return false; -+ -+ return hcon->sync_handle == iso_pi(sk)->sync_handle; -+} -+ - static void iso_conn_del(struct hci_conn *hcon, int err) - { - struct iso_conn *conn = hcon->iso_data; - struct sock *sk; -+ struct sock *parent; - - if (!conn) - return; -@@ -209,6 +226,25 @@ static void iso_conn_del(struct hci_conn *hcon, int err) - - if (sk) { - lock_sock(sk); -+ -+ /* While a PA sync hcon is in the process of closing, -+ * mark parent socket with a flag, so that any residual -+ * BIGInfo adv reports that arrive before PA sync is -+ * terminated are not processed anymore. -+ */ -+ if (test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) { -+ parent = iso_get_sock_listen(&hcon->src, -+ &hcon->dst, -+ iso_match_conn_sync_handle, -+ hcon); -+ -+ if (parent) { -+ set_bit(BT_SK_PA_SYNC_TERM, -+ &iso_pi(parent)->flags); -+ sock_put(parent); -+ } -+ } -+ - iso_sock_clear_timer(sk); - iso_chan_del(sk, err); - release_sock(sk); -@@ -545,8 +581,6 @@ static struct sock *__iso_get_sock_listen_by_sid(bdaddr_t *ba, bdaddr_t *bc, - return NULL; - } - --typedef bool (*iso_sock_match_t)(struct sock *sk, void *data); -- - /* Find socket listening: - * source bdaddr (Unicast) - * destination bdaddr (Broadcast only) -@@ -1759,9 +1793,20 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) - /* Try to get PA sync listening socket, if it exists */ - sk = iso_get_sock_listen(&hdev->bdaddr, bdaddr, - iso_match_pa_sync_flag, NULL); -- if (!sk) -+ -+ if (!sk) { - sk = iso_get_sock_listen(&hdev->bdaddr, bdaddr, - iso_match_sync_handle, ev2); -+ -+ /* If PA Sync is in process of terminating, -+ * do not handle any more BIGInfo adv reports. -+ */ -+ -+ if (sk && test_bit(BT_SK_PA_SYNC_TERM, -+ &iso_pi(sk)->flags)) -+ return lm; -+ } -+ - if (sk) { - int err; - --- -2.43.2 - -From d5761e2f66b3ecea483147855935320590d22096 Mon Sep 17 00:00:00 2001 -From: clancy shang <clancy.shang@quectel.com> -Date: Mon, 18 Dec 2023 18:24:17 +0800 -Subject: [PATCH 1166/1501] Bluetooth: hci_sync: fix BR/EDR wakeup bug -Content-Length: 1379 -Lines: 39 - -[ Upstream commit d4b70ba1eab450eff9c5ef536f07c01d424b7eda ] - -when Bluetooth set the event mask and enter suspend, the controller -has hci mode change event coming, it cause controller can not enter -sleep mode. so it should to set the hci mode change event mask before -enter suspend. - -Signed-off-by: clancy shang <clancy.shang@quectel.com> -Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/bluetooth/hci_sync.c | 10 ++++++---- - 1 file changed, 6 insertions(+), 4 deletions(-) - -diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c -index d85a7091a116..97284d9b2a2e 100644 ---- a/net/bluetooth/hci_sync.c -+++ b/net/bluetooth/hci_sync.c -@@ -3800,12 +3800,14 @@ static int hci_set_event_mask_sync(struct hci_dev *hdev) - if (lmp_bredr_capable(hdev)) { - events[4] |= 0x01; /* Flow Specification Complete */ - -- /* Don't set Disconnect Complete when suspended as that -- * would wakeup the host when disconnecting due to -- * suspend. -+ /* Don't set Disconnect Complete and mode change when -+ * suspended as that would wakeup the host when disconnecting -+ * due to suspend. - */ -- if (hdev->suspended) -+ if (hdev->suspended) { - events[0] &= 0xef; -+ events[2] &= 0xf7; -+ } - } else { - /* Use a different default for LE-only devices */ - memset(events, 0, sizeof(events)); --- -2.43.2 - -From d136385406676ff6f9021762bd66d6b387c5cf3e Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Danis?= <frederic.danis@collabora.com> -Date: Tue, 19 Dec 2023 09:10:22 +0100 -Subject: [PATCH 1167/1501] Bluetooth: L2CAP: Fix possible multiple reject send -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1134 -Lines: 31 - -[ Upstream commit 96a3398b467ab8aada3df2f3a79f4b7835d068b8 ] - -In case of an incomplete command or a command with a null identifier 2 -reject packets will be sent, one with the identifier and one with 0. -Consuming the data of the command will prevent it. -This allows to send a reject packet for each corrupted command in a -multi-command packet. - -Signed-off-by: Frédéric Danis <frederic.danis@collabora.com> -Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/bluetooth/l2cap_core.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index baeebee41cd9..60298975d5c4 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -6526,7 +6526,8 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn, - if (len > skb->len || !cmd->ident) { - BT_DBG("corrupted command"); - l2cap_sig_send_rej(conn, cmd->ident); -- break; -+ skb_pull(skb, len > skb->len ? skb->len : len); -+ continue; - } - - err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data); --- -2.43.2 - -From 57bd38eb97a8bcb72dc7f0c890f012538103c216 Mon Sep 17 00:00:00 2001 -From: Wen Gu <guwen@linux.alibaba.com> -Date: Tue, 19 Dec 2023 22:26:15 +0800 -Subject: [PATCH 1168/1501] net/smc: disable SEID on non-s390 archs where - virtual ISM may be used -Content-Length: 2456 -Lines: 83 - -[ Upstream commit c6b8b8eb49904018e22e4e4b1fa502e57dc747d9 ] - -The system EID (SEID) is an internal EID used by SMC-D to represent the -s390 physical machine that OS is executing on. On s390 architecture, it -predefined by fixed string and part of cpuid and is enabled regardless -of whether underlay device is virtual ISM or platform firmware ISM. - -However on non-s390 architectures where SMC-D can be used with virtual -ISM devices, there is no similar information to identify physical -machines, especially in virtualization scenarios. So in such cases, SEID -is forcibly disabled and the user-defined UEID will be used to represent -the communicable space. - -Signed-off-by: Wen Gu <guwen@linux.alibaba.com> -Reviewed-and-tested-by: Wenjia Zhang <wenjia@linux.ibm.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/smc/smc_clc.c | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) - -diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c -index 72f4d81a3f41..1489a8421d78 100644 ---- a/net/smc/smc_clc.c -+++ b/net/smc/smc_clc.c -@@ -155,10 +155,12 @@ static int smc_clc_ueid_remove(char *ueid) - rc = 0; - } - } -+#if IS_ENABLED(CONFIG_S390) - if (!rc && !smc_clc_eid_table.ueid_cnt) { - smc_clc_eid_table.seid_enabled = 1; - rc = -EAGAIN; /* indicate success and enabling of seid */ - } -+#endif - write_unlock(&smc_clc_eid_table.lock); - return rc; - } -@@ -273,22 +275,30 @@ int smc_nl_dump_seid(struct sk_buff *skb, struct netlink_callback *cb) - - int smc_nl_enable_seid(struct sk_buff *skb, struct genl_info *info) - { -+#if IS_ENABLED(CONFIG_S390) - write_lock(&smc_clc_eid_table.lock); - smc_clc_eid_table.seid_enabled = 1; - write_unlock(&smc_clc_eid_table.lock); - return 0; -+#else -+ return -EOPNOTSUPP; -+#endif - } - - int smc_nl_disable_seid(struct sk_buff *skb, struct genl_info *info) - { - int rc = 0; - -+#if IS_ENABLED(CONFIG_S390) - write_lock(&smc_clc_eid_table.lock); - if (!smc_clc_eid_table.ueid_cnt) - rc = -ENOENT; - else - smc_clc_eid_table.seid_enabled = 0; - write_unlock(&smc_clc_eid_table.lock); -+#else -+ rc = -EOPNOTSUPP; -+#endif - return rc; - } - -@@ -1269,7 +1279,11 @@ void __init smc_clc_init(void) - INIT_LIST_HEAD(&smc_clc_eid_table.list); - rwlock_init(&smc_clc_eid_table.lock); - smc_clc_eid_table.ueid_cnt = 0; -+#if IS_ENABLED(CONFIG_S390) - smc_clc_eid_table.seid_enabled = 1; -+#else -+ smc_clc_eid_table.seid_enabled = 0; -+#endif - } - - void smc_clc_exit(void) --- -2.43.2 - -From 2d6edeaf0d9fa8e34a6385b1c340cb35606e9af6 Mon Sep 17 00:00:00 2001 -From: Lin Ma <linma@zju.edu.cn> -Date: Thu, 21 Dec 2023 00:34:51 +0800 -Subject: [PATCH 1169/1501] bridge: cfm: fix enum typo in br_cc_ccm_tx_parse -Content-Length: 1510 -Lines: 38 - -[ Upstream commit c2b2ee36250d967c21890cb801e24af4b6a9eaa5 ] - -It appears that there is a typo in the code where the nlattr array is -being parsed with policy br_cfm_cc_ccm_tx_policy, but the instance is -being accessed via IFLA_BRIDGE_CFM_CC_RDI_INSTANCE, which is associated -with the policy br_cfm_cc_rdi_policy. - -This problem was introduced by commit 2be665c3940d ("bridge: cfm: Netlink -SET configuration Interface."). - -Though it seems like a harmless typo since these two enum owns the exact -same value (1 here), it is quite misleading hence fix it by using the -correct enum IFLA_BRIDGE_CFM_CC_CCM_TX_INSTANCE here. - -Signed-off-by: Lin Ma <linma@zju.edu.cn> -Reviewed-by: Simon Horman <horms@kernel.org> -Acked-by: Nikolay Aleksandrov <razor@blackwall.org> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/bridge/br_cfm_netlink.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/bridge/br_cfm_netlink.c b/net/bridge/br_cfm_netlink.c -index 5c4c369f8536..2faab44652e7 100644 ---- a/net/bridge/br_cfm_netlink.c -+++ b/net/bridge/br_cfm_netlink.c -@@ -362,7 +362,7 @@ static int br_cc_ccm_tx_parse(struct net_bridge *br, struct nlattr *attr, - - memset(&tx_info, 0, sizeof(tx_info)); - -- instance = nla_get_u32(tb[IFLA_BRIDGE_CFM_CC_RDI_INSTANCE]); -+ instance = nla_get_u32(tb[IFLA_BRIDGE_CFM_CC_CCM_TX_INSTANCE]); - nla_memcpy(&tx_info.dmac.addr, - tb[IFLA_BRIDGE_CFM_CC_CCM_TX_DMAC], - sizeof(tx_info.dmac.addr)); --- -2.43.2 - -From 087ef07c32ed8105e2ec2c5ed2ecfd7f94106e7c Mon Sep 17 00:00:00 2001 -From: Andrii Staikov <andrii.staikov@intel.com> -Date: Wed, 29 Nov 2023 15:24:12 +0100 -Subject: [PATCH 1172/1501] i40e: Fix VF disable behavior to block all traffic -Content-Length: 4151 -Lines: 112 - -[ Upstream commit 31deb12e85c35ddd2c037f0107d05d8674cab2c0 ] - -Currently, if a VF is disabled using the -'ip link set dev $ETHX vf $VF_NUM state disable' command, the VF is still -able to receive traffic. - -Fix the behavior of the 'ip link set dev $ETHX vf $VF_NUM state disable' -to completely shutdown the VF's queues making it entirely disabled and -not able to receive or send any traffic. - -Modify the behavior of the 'ip link set $ETHX vf $VF_NUM state enable' -command to make a VF do reinitialization bringing the queues back up. - -Co-developed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> -Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> -Reviewed-by: Jan Sokolowski <jan.sokolowski@intel.com> -Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com> -Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> -Signed-off-by: Andrii Staikov <andrii.staikov@intel.com> -Tested-by: Rafal Romanowski <rafal.romanowski@intel.com> -Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 32 +++++++++++++++++++ - .../ethernet/intel/i40e/i40e_virtchnl_pf.h | 1 + - 2 files changed, 33 insertions(+) - -diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -index de5ec4e6bedf..7db89b294510 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -@@ -2607,6 +2607,14 @@ static int i40e_vc_enable_queues_msg(struct i40e_vf *vf, u8 *msg) - int aq_ret = 0; - int i; - -+ if (vf->is_disabled_from_host) { -+ aq_ret = -EPERM; -+ dev_info(&pf->pdev->dev, -+ "Admin has disabled VF %d, will not enable queues\n", -+ vf->vf_id); -+ goto error_param; -+ } -+ - if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) { - aq_ret = -EINVAL; - goto error_param; -@@ -4734,9 +4742,12 @@ int i40e_ndo_set_vf_link_state(struct net_device *netdev, int vf_id, int link) - struct i40e_link_status *ls = &pf->hw.phy.link_info; - struct virtchnl_pf_event pfe; - struct i40e_hw *hw = &pf->hw; -+ struct i40e_vsi *vsi; -+ unsigned long q_map; - struct i40e_vf *vf; - int abs_vf_id; - int ret = 0; -+ int tmp; - - if (test_and_set_bit(__I40E_VIRTCHNL_OP_PENDING, pf->state)) { - dev_warn(&pf->pdev->dev, "Unable to configure VFs, other operation is pending.\n"); -@@ -4759,17 +4770,38 @@ int i40e_ndo_set_vf_link_state(struct net_device *netdev, int vf_id, int link) - switch (link) { - case IFLA_VF_LINK_STATE_AUTO: - vf->link_forced = false; -+ vf->is_disabled_from_host = false; -+ /* reset needed to reinit VF resources */ -+ i40e_vc_reset_vf(vf, true); - i40e_set_vf_link_state(vf, &pfe, ls); - break; - case IFLA_VF_LINK_STATE_ENABLE: - vf->link_forced = true; - vf->link_up = true; -+ vf->is_disabled_from_host = false; -+ /* reset needed to reinit VF resources */ -+ i40e_vc_reset_vf(vf, true); - i40e_set_vf_link_state(vf, &pfe, ls); - break; - case IFLA_VF_LINK_STATE_DISABLE: - vf->link_forced = true; - vf->link_up = false; - i40e_set_vf_link_state(vf, &pfe, ls); -+ -+ vsi = pf->vsi[vf->lan_vsi_idx]; -+ q_map = BIT(vsi->num_queue_pairs) - 1; -+ -+ vf->is_disabled_from_host = true; -+ -+ /* Try to stop both Tx&Rx rings even if one of the calls fails -+ * to ensure we stop the rings even in case of errors. -+ * If any of them returns with an error then the first -+ * error that occurred will be returned. -+ */ -+ tmp = i40e_ctrl_vf_tx_rings(vsi, q_map, false); -+ ret = i40e_ctrl_vf_rx_rings(vsi, q_map, false); -+ -+ ret = tmp ? tmp : ret; - break; - default: - ret = -EINVAL; -diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h -index 5fd607c0de0a..66f95e2f3146 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h -+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h -@@ -100,6 +100,7 @@ struct i40e_vf { - bool link_forced; - bool link_up; /* only valid if VF link is forced */ - bool spoofchk; -+ bool is_disabled_from_host; /* PF ctrl of VF enable/disable */ - u16 num_vlan; - - /* ADq related variables */ --- -2.43.2 - -From 90d76270f7fe89a209f52182dd1c0d46f538a268 Mon Sep 17 00:00:00 2001 -From: Suman Ghosh <sumang@marvell.com> -Date: Mon, 1 Jan 2024 20:20:42 +0530 -Subject: [PATCH 1173/1501] octeontx2-af: Fix max NPC MCAM entry check while - validating ref_entry -Content-Length: 1848 -Lines: 46 - -[ Upstream commit 4ebb1f95e0c3c3e0eec5bb21aa43097580c4b6e4 ] - -As of today, the last MCAM entry was not getting allocated because of -a <= check with the max_bmap count. This patch modifies that and if the -requested entry is greater than the available entries then set it to the -max value. - -Signed-off-by: Suman Ghosh <sumang@marvell.com> -Link: https://lore.kernel.org/r/20240101145042.419697-1-sumang@marvell.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 13 ++++++------- - 1 file changed, 6 insertions(+), 7 deletions(-) - -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c -index 0bcf3e559280..3784347b6fd8 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c -@@ -2678,18 +2678,17 @@ int rvu_mbox_handler_npc_mcam_alloc_entry(struct rvu *rvu, - rsp->entry = NPC_MCAM_ENTRY_INVALID; - rsp->free_count = 0; - -- /* Check if ref_entry is within range */ -- if (req->priority && req->ref_entry >= mcam->bmap_entries) { -- dev_err(rvu->dev, "%s: reference entry %d is out of range\n", -- __func__, req->ref_entry); -- return NPC_MCAM_INVALID_REQ; -- } -+ /* Check if ref_entry is greater that the range -+ * then set it to max value. -+ */ -+ if (req->ref_entry > mcam->bmap_entries) -+ req->ref_entry = mcam->bmap_entries; - - /* ref_entry can't be '0' if requested priority is high. - * Can't be last entry if requested priority is low. - */ - if ((!req->ref_entry && req->priority == NPC_MCAM_HIGHER_PRIO) || -- ((req->ref_entry == (mcam->bmap_entries - 1)) && -+ ((req->ref_entry == mcam->bmap_entries) && - req->priority == NPC_MCAM_LOWER_PRIO)) - return NPC_MCAM_INVALID_REQ; - --- -2.43.2 - -From ad39ed642f0afa6f47e3e6a871ccefd32bd59f2f Mon Sep 17 00:00:00 2001 -From: Mina Almasry <almasrymina@google.com> -Date: Tue, 2 Jan 2024 12:59:58 -0800 -Subject: [PATCH 1174/1501] net: kcm: fix direct access to bv_len -Content-Length: 1015 -Lines: 29 - -[ Upstream commit b15a4cfe100b9acd097d3ae7052448bd1cdc2a3b ] - -Minor fix for kcm: code wanting to access the fields inside an skb -frag should use the skb_frag_*() helpers, instead of accessing the -fields directly. - -Signed-off-by: Mina Almasry <almasrymina@google.com> -Link: https://lore.kernel.org/r/20240102205959.794513-1-almasrymina@google.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/kcm/kcmsock.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c -index 65d1f6755f98..1184d40167b8 100644 ---- a/net/kcm/kcmsock.c -+++ b/net/kcm/kcmsock.c -@@ -634,7 +634,7 @@ static int kcm_write_msgs(struct kcm_sock *kcm) - - msize = 0; - for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) -- msize += skb_shinfo(skb)->frags[i].bv_len; -+ msize += skb_frag_size(&skb_shinfo(skb)->frags[i]); - - iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, - skb_shinfo(skb)->frags, skb_shinfo(skb)->nr_frags, --- -2.43.2 - -From 6a849b5e91d8ac24441282ae92a35da560de623d Mon Sep 17 00:00:00 2001 -From: Vladimir Oltean <vladimir.oltean@nxp.com> -Date: Thu, 4 Jan 2024 16:00:31 +0200 -Subject: [PATCH 1175/1501] net: dsa: qca8k: put MDIO bus OF node on - qca8k_mdio_register() failure -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2766 -Lines: 84 - -[ Upstream commit 68e1010cda7967cfca9c8650ee1f4efcae54ab90 ] - -of_get_child_by_name() gives us an OF node with an elevated refcount, -which should be dropped when we're done with it. This is so that, -if (of_node_check_flag(node, OF_DYNAMIC)) is true, the node's memory can -eventually be freed. - -There are 2 distinct paths to be considered in qca8k_mdio_register(): - -- devm_of_mdiobus_register() succeeds: since commit 3b73a7b8ec38 ("net: - mdio_bus: add refcounting for fwnodes to mdiobus"), the MDIO core - treats this well. - -- devm_of_mdiobus_register() or anything up to that point fails: it is - the duty of the qca8k driver to release the OF node. - -This change addresses the second case by making sure that the OF node -reference is not leaked. - -The "mdio" node may be NULL, but of_node_put(NULL) is safe. - -Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> -Reviewed-by: Alvin Šipraga <alsi@bang-olufsen.dk> -Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/dsa/qca/qca8k-8xxx.c | 21 ++++++++++++++++----- - 1 file changed, 16 insertions(+), 5 deletions(-) - -diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c -index ec57d9d52072..5f47a290bd6e 100644 ---- a/drivers/net/dsa/qca/qca8k-8xxx.c -+++ b/drivers/net/dsa/qca/qca8k-8xxx.c -@@ -949,10 +949,15 @@ qca8k_mdio_register(struct qca8k_priv *priv) - struct dsa_switch *ds = priv->ds; - struct device_node *mdio; - struct mii_bus *bus; -+ int err; -+ -+ mdio = of_get_child_by_name(priv->dev->of_node, "mdio"); - - bus = devm_mdiobus_alloc(ds->dev); -- if (!bus) -- return -ENOMEM; -+ if (!bus) { -+ err = -ENOMEM; -+ goto out_put_node; -+ } - - bus->priv = (void *)priv; - snprintf(bus->id, MII_BUS_ID_SIZE, "qca8k-%d.%d", -@@ -962,12 +967,12 @@ qca8k_mdio_register(struct qca8k_priv *priv) - ds->user_mii_bus = bus; - - /* Check if the devicetree declare the port:phy mapping */ -- mdio = of_get_child_by_name(priv->dev->of_node, "mdio"); - if (of_device_is_available(mdio)) { - bus->name = "qca8k user mii"; - bus->read = qca8k_internal_mdio_read; - bus->write = qca8k_internal_mdio_write; -- return devm_of_mdiobus_register(priv->dev, bus, mdio); -+ err = devm_of_mdiobus_register(priv->dev, bus, mdio); -+ goto out_put_node; - } - - /* If a mapping can't be found the legacy mapping is used, -@@ -976,7 +981,13 @@ qca8k_mdio_register(struct qca8k_priv *priv) - bus->name = "qca8k-legacy user mii"; - bus->read = qca8k_legacy_mdio_read; - bus->write = qca8k_legacy_mdio_write; -- return devm_mdiobus_register(priv->dev, bus); -+ -+ err = devm_mdiobus_register(priv->dev, bus); -+ -+out_put_node: -+ of_node_put(mdio); -+ -+ return err; - } - - static int --- -2.43.2 - -From b29cc6e29b5e6037e1bcd2b2ac67b7d89acd194c Mon Sep 17 00:00:00 2001 -From: Chao Yu <chao@kernel.org> -Date: Thu, 16 Nov 2023 14:25:56 +0800 -Subject: [PATCH 1177/1501] f2fs: fix to check return value of - f2fs_reserve_new_block() -Content-Length: 1791 -Lines: 61 - -[ Upstream commit 956fa1ddc132e028f3b7d4cf17e6bfc8cb36c7fd ] - -Let's check return value of f2fs_reserve_new_block() in do_recover_data() -rather than letting it fails silently. - -Also refactoring check condition on return value of f2fs_reserve_new_block() -as below: -- trigger f2fs_bug_on() only for ENOSPC case; -- use do-while statement to avoid redundant codes; - -Signed-off-by: Chao Yu <chao@kernel.org> -Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/f2fs/recovery.c | 23 +++++++++++++++++------ - 1 file changed, 17 insertions(+), 6 deletions(-) - -diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c -index b56d0f1078a7..16415c770b45 100644 ---- a/fs/f2fs/recovery.c -+++ b/fs/f2fs/recovery.c -@@ -712,7 +712,16 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode, - */ - if (dest == NEW_ADDR) { - f2fs_truncate_data_blocks_range(&dn, 1); -- f2fs_reserve_new_block(&dn); -+ do { -+ err = f2fs_reserve_new_block(&dn); -+ if (err == -ENOSPC) { -+ f2fs_bug_on(sbi, 1); -+ break; -+ } -+ } while (err && -+ IS_ENABLED(CONFIG_F2FS_FAULT_INJECTION)); -+ if (err) -+ goto err; - continue; - } - -@@ -720,12 +729,14 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode, - if (f2fs_is_valid_blkaddr(sbi, dest, META_POR)) { - - if (src == NULL_ADDR) { -- err = f2fs_reserve_new_block(&dn); -- while (err && -- IS_ENABLED(CONFIG_F2FS_FAULT_INJECTION)) -+ do { - err = f2fs_reserve_new_block(&dn); -- /* We should not get -ENOSPC */ -- f2fs_bug_on(sbi, err); -+ if (err == -ENOSPC) { -+ f2fs_bug_on(sbi, 1); -+ break; -+ } -+ } while (err && -+ IS_ENABLED(CONFIG_F2FS_FAULT_INJECTION)); - if (err) - goto err; - } --- -2.43.2 - -From 21e906f941d0576523bc82fc143f2b8f31e9b005 Mon Sep 17 00:00:00 2001 -From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> -Date: Tue, 21 Nov 2023 14:07:51 +0200 -Subject: [PATCH 1179/1501] ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument -Content-Length: 1140 -Lines: 29 - -[ Upstream commit 67c7666fe808c3a7af3cc6f9d0a3dd3acfd26115 ] - -The virtual widget example makes use of an undefined SND_SOC_DAPM_NOPM -argument passed to SND_SOC_DAPM_MIXER(). Replace with the correct -SND_SOC_NOPM definition. - -Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> -Link: https://lore.kernel.org/r/20231121120751.77355-1-cristian.ciocaltea@collabora.com -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - Documentation/sound/soc/dapm.rst | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Documentation/sound/soc/dapm.rst b/Documentation/sound/soc/dapm.rst -index 8e44107933ab..c3154ce6e1b2 100644 ---- a/Documentation/sound/soc/dapm.rst -+++ b/Documentation/sound/soc/dapm.rst -@@ -234,7 +234,7 @@ corresponding soft power control. In this case it is necessary to create - a virtual widget - a widget with no control bits e.g. - :: - -- SND_SOC_DAPM_MIXER("AC97 Mixer", SND_SOC_DAPM_NOPM, 0, 0, NULL, 0), -+ SND_SOC_DAPM_MIXER("AC97 Mixer", SND_SOC_NOPM, 0, 0, NULL, 0), - - This can be used to merge to signal paths together in software. - --- -2.43.2 - -From b0be96903d4fcf6d5cf763985b9712020b23a2ea Mon Sep 17 00:00:00 2001 -From: Al Viro <viro@zeniv.linux.org.uk> -Date: Wed, 1 Nov 2023 01:08:54 -0400 -Subject: [PATCH 1180/1501] fast_dput(): handle underflows gracefully -Content-Length: 2653 -Lines: 70 - -[ Upstream commit 504e08cebe1d4e1efe25f915234f646e74a364a8 ] - -If refcount is less than 1, we should just warn, unlock dentry and -return true, so that the caller doesn't try to do anything else. - -Taking care of that leaves the rest of "lockref_put_return() has -failed" case equivalent to "decrement refcount and rejoin the -normal slow path after the point where we grab ->d_lock". - -NOTE: lockref_put_return() is strictly a fastpath thing - unlike -the rest of lockref primitives, it does not contain a fallback. -Caller (and it looks like fast_dput() is the only legitimate one -in the entire kernel) has to do that itself. Reasons for -lockref_put_return() failures: - * ->d_lock held by somebody - * refcount <= 0 - * ... or an architecture not supporting lockref use of -cmpxchg - sparc, anything non-SMP, config with spinlock debugging... - -We could add a fallback, but it would be a clumsy API - we'd have -to distinguish between: - (1) refcount > 1 - decremented, lock not held on return - (2) refcount < 1 - left alone, probably no sense to hold the lock - (3) refcount is 1, no cmphxcg - decremented, lock held on return - (4) refcount is 1, cmphxcg supported - decremented, lock *NOT* held - on return. -We want to return with no lock held in case (4); that's the whole point of that -thing. We very much do not want to have the fallback in case (3) return without -a lock, since the caller might have to retake it in that case. -So it wouldn't be more convenient than doing the fallback in the caller and -it would be very easy to screw up, especially since the test coverage would -suck - no way to test (3) and (4) on the same kernel build. - -Reviewed-by: Christian Brauner <brauner@kernel.org> -Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/dcache.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/fs/dcache.c b/fs/dcache.c -index c82ae731df9a..d1ab857a69ca 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -787,12 +787,12 @@ static inline bool fast_dput(struct dentry *dentry) - */ - if (unlikely(ret < 0)) { - spin_lock(&dentry->d_lock); -- if (dentry->d_lockref.count > 1) { -- dentry->d_lockref.count--; -+ if (WARN_ON_ONCE(dentry->d_lockref.count <= 0)) { - spin_unlock(&dentry->d_lock); - return true; - } -- return false; -+ dentry->d_lockref.count--; -+ goto locked; - } - - /* -@@ -850,6 +850,7 @@ static inline bool fast_dput(struct dentry *dentry) - * else could have killed it and marked it dead. Either way, we - * don't need to do anything else. - */ -+locked: - if (dentry->d_lockref.count) { - spin_unlock(&dentry->d_lock); - return true; --- -2.43.2 - -From c04c162f82ac403917780eb6d1654694455d4e7c Mon Sep 17 00:00:00 2001 -From: Jan Kara <jack@suse.cz> -Date: Thu, 12 Oct 2023 23:14:20 +0200 -Subject: [PATCH 1181/1501] reiserfs: Avoid touching renamed directory if - parent does not change -Content-Length: 4191 -Lines: 135 - -[ Upstream commit 49db9b1b86a82448dfaf3fcfefcf678dee56c8ed ] - -The VFS will not be locking moved directory if its parent does not -change. Change reiserfs rename code to avoid touching renamed directory -if its parent does not change as without locking that can corrupt the -filesystem. - -Signed-off-by: Jan Kara <jack@suse.cz> -Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/reiserfs/namei.c | 54 ++++++++++++++++++++++++--------------------- - 1 file changed, 29 insertions(+), 25 deletions(-) - -diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c -index 994d6e6995ab..5996197ba40c 100644 ---- a/fs/reiserfs/namei.c -+++ b/fs/reiserfs/namei.c -@@ -1324,8 +1324,8 @@ static int reiserfs_rename(struct mnt_idmap *idmap, - struct inode *old_inode, *new_dentry_inode; - struct reiserfs_transaction_handle th; - int jbegin_count; -- umode_t old_inode_mode; - unsigned long savelink = 1; -+ bool update_dir_parent = false; - - if (flags & ~RENAME_NOREPLACE) - return -EINVAL; -@@ -1375,8 +1375,7 @@ static int reiserfs_rename(struct mnt_idmap *idmap, - return -ENOENT; - } - -- old_inode_mode = old_inode->i_mode; -- if (S_ISDIR(old_inode_mode)) { -+ if (S_ISDIR(old_inode->i_mode)) { - /* - * make sure that directory being renamed has correct ".." - * and that its new parent directory has not too many links -@@ -1389,24 +1388,28 @@ static int reiserfs_rename(struct mnt_idmap *idmap, - } - } - -- /* -- * directory is renamed, its parent directory will be changed, -- * so find ".." entry -- */ -- dot_dot_de.de_gen_number_bit_string = NULL; -- retval = -- reiserfs_find_entry(old_inode, "..", 2, &dot_dot_entry_path, -+ if (old_dir != new_dir) { -+ /* -+ * directory is renamed, its parent directory will be -+ * changed, so find ".." entry -+ */ -+ dot_dot_de.de_gen_number_bit_string = NULL; -+ retval = -+ reiserfs_find_entry(old_inode, "..", 2, -+ &dot_dot_entry_path, - &dot_dot_de); -- pathrelse(&dot_dot_entry_path); -- if (retval != NAME_FOUND) { -- reiserfs_write_unlock(old_dir->i_sb); -- return -EIO; -- } -+ pathrelse(&dot_dot_entry_path); -+ if (retval != NAME_FOUND) { -+ reiserfs_write_unlock(old_dir->i_sb); -+ return -EIO; -+ } - -- /* inode number of .. must equal old_dir->i_ino */ -- if (dot_dot_de.de_objectid != old_dir->i_ino) { -- reiserfs_write_unlock(old_dir->i_sb); -- return -EIO; -+ /* inode number of .. must equal old_dir->i_ino */ -+ if (dot_dot_de.de_objectid != old_dir->i_ino) { -+ reiserfs_write_unlock(old_dir->i_sb); -+ return -EIO; -+ } -+ update_dir_parent = true; - } - } - -@@ -1486,7 +1489,7 @@ static int reiserfs_rename(struct mnt_idmap *idmap, - - reiserfs_prepare_for_journal(old_inode->i_sb, new_de.de_bh, 1); - -- if (S_ISDIR(old_inode->i_mode)) { -+ if (update_dir_parent) { - if ((retval = - search_by_entry_key(new_dir->i_sb, - &dot_dot_de.de_entry_key, -@@ -1534,14 +1537,14 @@ static int reiserfs_rename(struct mnt_idmap *idmap, - new_de.de_bh); - reiserfs_restore_prepared_buffer(old_inode->i_sb, - old_de.de_bh); -- if (S_ISDIR(old_inode_mode)) -+ if (update_dir_parent) - reiserfs_restore_prepared_buffer(old_inode-> - i_sb, - dot_dot_de. - de_bh); - continue; - } -- if (S_ISDIR(old_inode_mode)) { -+ if (update_dir_parent) { - if (item_moved(&dot_dot_ih, &dot_dot_entry_path) || - !entry_points_to_object("..", 2, &dot_dot_de, - old_dir)) { -@@ -1559,7 +1562,7 @@ static int reiserfs_rename(struct mnt_idmap *idmap, - } - } - -- RFALSE(S_ISDIR(old_inode_mode) && -+ RFALSE(update_dir_parent && - !buffer_journal_prepared(dot_dot_de.de_bh), ""); - - break; -@@ -1592,11 +1595,12 @@ static int reiserfs_rename(struct mnt_idmap *idmap, - savelink = new_dentry_inode->i_nlink; - } - -- if (S_ISDIR(old_inode_mode)) { -+ if (update_dir_parent) { - /* adjust ".." of renamed directory */ - set_ino_in_dir_entry(&dot_dot_de, INODE_PKEY(new_dir)); - journal_mark_dirty(&th, dot_dot_de.de_bh); -- -+ } -+ if (S_ISDIR(old_inode->i_mode)) { - /* - * there (in new_dir) was no directory, so it got new link - * (".." of renamed directory) --- -2.43.2 - -From de940cede3c41624e2de27f805b490999f419df9 Mon Sep 17 00:00:00 2001 -From: Jan Kara <jack@suse.cz> -Date: Thu, 12 Oct 2023 23:14:21 +0200 -Subject: [PATCH 1182/1501] ocfs2: Avoid touching renamed directory if parent - does not change -Content-Length: 1402 -Lines: 49 - -[ Upstream commit 9d618d19b29c2943527e3a43da0a35aea91062fc ] - -The VFS will not be locking moved directory if its parent does not -change. Change ocfs2 rename code to avoid touching renamed directory if -its parent does not change as without locking that can corrupt the -filesystem. - -Signed-off-by: Jan Kara <jack@suse.cz> -Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/ocfs2/namei.c | 8 +++++--- - 1 file changed, 5 insertions(+), 3 deletions(-) - -diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c -index 814733ba2f4b..9221a33f917b 100644 ---- a/fs/ocfs2/namei.c -+++ b/fs/ocfs2/namei.c -@@ -1336,7 +1336,7 @@ static int ocfs2_rename(struct mnt_idmap *idmap, - goto bail; - } - -- if (S_ISDIR(old_inode->i_mode)) { -+ if (S_ISDIR(old_inode->i_mode) && new_dir != old_dir) { - u64 old_inode_parent; - - update_dot_dot = 1; -@@ -1353,8 +1353,7 @@ static int ocfs2_rename(struct mnt_idmap *idmap, - goto bail; - } - -- if (!new_inode && new_dir != old_dir && -- new_dir->i_nlink >= ocfs2_link_max(osb)) { -+ if (!new_inode && new_dir->i_nlink >= ocfs2_link_max(osb)) { - status = -EMLINK; - goto bail; - } -@@ -1601,6 +1600,9 @@ static int ocfs2_rename(struct mnt_idmap *idmap, - mlog_errno(status); - goto bail; - } -+ } -+ -+ if (S_ISDIR(old_inode->i_mode)) { - drop_nlink(old_dir); - if (new_inode) { - drop_nlink(new_inode); --- -2.43.2 - -From 5bc1b5ce24fb761dd14aa4ebe6884801fe371eb8 Mon Sep 17 00:00:00 2001 -From: Danylo Piliaiev <dpiliaiev@igalia.com> -Date: Sat, 25 Nov 2023 11:11:51 -0800 -Subject: [PATCH 1183/1501] drm/msm/a690: Fix reg values for a690 -Content-Length: 3305 -Lines: 84 - -[ Upstream commit 07e6de738aa6f0e873463e9ca88bdb7081c4bfd4 ] - -KGSL doesn't support a690 so all reg values were the same as -on a660. Now we know the values and they are different from the -windows driver. - -This fixes hangs on D3D12 games and some CTS tests. - -Signed-off-by: Danylo Piliaiev <dpiliaiev@igalia.com> -Signed-off-by: Rob Clark <robdclark@chromium.org> -Patchwork: https://patchwork.freedesktop.org/patch/568931/ -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 23 +++++++++++++---------- - 1 file changed, 13 insertions(+), 10 deletions(-) - -diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c -index 7a0220d29a23..500ed2d183fc 100644 ---- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c -+++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c -@@ -1312,6 +1312,7 @@ static void a6xx_set_ubwc_config(struct msm_gpu *gpu) - - if (adreno_is_a650(adreno_gpu) || - adreno_is_a660(adreno_gpu) || -+ adreno_is_a690(adreno_gpu) || - adreno_is_a730(adreno_gpu) || - adreno_is_a740_family(adreno_gpu)) { - /* TODO: get ddr type from bootloader and use 2 for LPDDR4 */ -@@ -1321,13 +1322,6 @@ static void a6xx_set_ubwc_config(struct msm_gpu *gpu) - uavflagprd_inv = 2; - } - -- if (adreno_is_a690(adreno_gpu)) { -- hbb_lo = 2; -- amsbc = 1; -- rgb565_predicator = 1; -- uavflagprd_inv = 2; -- } -- - if (adreno_is_7c3(adreno_gpu)) { - hbb_lo = 1; - amsbc = 1; -@@ -1741,7 +1735,9 @@ static int hw_init(struct msm_gpu *gpu) - /* Setting the primFifo thresholds default values, - * and vccCacheSkipDis=1 bit (0x200) for A640 and newer - */ -- if (adreno_is_a650(adreno_gpu) || adreno_is_a660(adreno_gpu) || adreno_is_a690(adreno_gpu)) -+ if (adreno_is_a690(adreno_gpu)) -+ gpu_write(gpu, REG_A6XX_PC_DBG_ECO_CNTL, 0x00800200); -+ else if (adreno_is_a650(adreno_gpu) || adreno_is_a660(adreno_gpu)) - gpu_write(gpu, REG_A6XX_PC_DBG_ECO_CNTL, 0x00300200); - else if (adreno_is_a640_family(adreno_gpu) || adreno_is_7c3(adreno_gpu)) - gpu_write(gpu, REG_A6XX_PC_DBG_ECO_CNTL, 0x00200200); -@@ -1775,6 +1771,8 @@ static int hw_init(struct msm_gpu *gpu) - if (adreno_is_a730(adreno_gpu) || - adreno_is_a740_family(adreno_gpu)) - gpu_write(gpu, REG_A6XX_RBBM_INTERFACE_HANG_INT_CNTL, (1 << 30) | 0xcfffff); -+ else if (adreno_is_a690(adreno_gpu)) -+ gpu_write(gpu, REG_A6XX_RBBM_INTERFACE_HANG_INT_CNTL, (1 << 30) | 0x4fffff); - else if (adreno_is_a619(adreno_gpu)) - gpu_write(gpu, REG_A6XX_RBBM_INTERFACE_HANG_INT_CNTL, (1 << 30) | 0x3fffff); - else if (adreno_is_a610(adreno_gpu)) -@@ -1808,12 +1806,17 @@ static int hw_init(struct msm_gpu *gpu) - a6xx_set_cp_protect(gpu); - - if (adreno_is_a660_family(adreno_gpu)) { -- gpu_write(gpu, REG_A6XX_CP_CHICKEN_DBG, 0x1); -+ if (adreno_is_a690(adreno_gpu)) -+ gpu_write(gpu, REG_A6XX_CP_CHICKEN_DBG, 0x00028801); -+ else -+ gpu_write(gpu, REG_A6XX_CP_CHICKEN_DBG, 0x1); - gpu_write(gpu, REG_A6XX_RBBM_GBIF_CLIENT_QOS_CNTL, 0x0); - } - -+ if (adreno_is_a690(adreno_gpu)) -+ gpu_write(gpu, REG_A6XX_UCHE_CMDQ_CONFIG, 0x90); - /* Set dualQ + disable afull for A660 GPU */ -- if (adreno_is_a660(adreno_gpu)) -+ else if (adreno_is_a660(adreno_gpu)) - gpu_write(gpu, REG_A6XX_UCHE_CMDQ_CONFIG, 0x66906); - else if (adreno_is_a7xx(adreno_gpu)) - gpu_write(gpu, REG_A6XX_UCHE_CMDQ_CONFIG, --- -2.43.2 - -From c5d1f47450c5a73a550e628bd643c50045d42918 Mon Sep 17 00:00:00 2001 -From: Jack Wang <jinpu.wang@ionos.com> -Date: Tue, 21 Nov 2023 14:03:15 +0100 -Subject: [PATCH 1184/1501] RDMA/IPoIB: Fix error code return in - ipoib_mcast_join -Content-Length: 925 -Lines: 26 - -[ Upstream commit 753fff78f430704548f45eda52d6d55371a52c0f ] - -Return the error code in case of ib_sa_join_multicast fail. - -Signed-off-by: Jack Wang <jinpu.wang@ionos.com> -Link: https://lore.kernel.org/r/20231121130316.126364-2-jinpu.wang@ionos.com -Signed-off-by: Leon Romanovsky <leon@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c -index 5b3154503bf4..9e6967a40042 100644 ---- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c -+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c -@@ -546,6 +546,7 @@ static int ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast) - spin_unlock_irq(&priv->lock); - complete(&mcast->done); - spin_lock_irq(&priv->lock); -+ return ret; - } - return 0; - } --- -2.43.2 - -From 4306ce2a1f24a2d4bf32ff38dbad1c0a6dd59ed1 Mon Sep 17 00:00:00 2001 -From: Hsin-Yi Wang <hsinyi@chromium.org> -Date: Fri, 17 Nov 2023 13:46:32 -0800 -Subject: [PATCH 1185/1501] drm/panel-edp: Add override_edid_mode quirk for - generic edp -Content-Length: 3447 -Lines: 104 - -[ Upstream commit 9f7843b515811aea6c56527eb195b622e9c01f12 ] - -Generic edp gets mode from edid. However, some panels report incorrect -mode in this way, resulting in glitches on panel. Introduce a new quirk -additional_mode to the generic edid to pick a correct hardcoded mode. - -Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org> -Reviewed-by: Douglas Anderson <dianders@chromium.org> -Signed-off-by: Douglas Anderson <dianders@chromium.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20231117215056.1883314-2-hsinyi@chromium.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/panel/panel-edp.c | 48 +++++++++++++++++++++++++++++-- - 1 file changed, 45 insertions(+), 3 deletions(-) - -diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c -index 7dc6fb7308ce..cba5a93e6082 100644 ---- a/drivers/gpu/drm/panel/panel-edp.c -+++ b/drivers/gpu/drm/panel/panel-edp.c -@@ -203,6 +203,9 @@ struct edp_panel_entry { - - /** @name: Name of this panel (for printing to logs). */ - const char *name; -+ -+ /** @override_edid_mode: Override the mode obtained by edid. */ -+ const struct drm_display_mode *override_edid_mode; - }; - - struct panel_edp { -@@ -301,6 +304,24 @@ static unsigned int panel_edp_get_display_modes(struct panel_edp *panel, - return num; - } - -+static int panel_edp_override_edid_mode(struct panel_edp *panel, -+ struct drm_connector *connector, -+ const struct drm_display_mode *override_mode) -+{ -+ struct drm_display_mode *mode; -+ -+ mode = drm_mode_duplicate(connector->dev, override_mode); -+ if (!mode) { -+ dev_err(panel->base.dev, "failed to add additional mode\n"); -+ return 0; -+ } -+ -+ mode->type |= DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED; -+ drm_mode_set_name(mode); -+ drm_mode_probed_add(connector, mode); -+ return 1; -+} -+ - static int panel_edp_get_non_edid_modes(struct panel_edp *panel, - struct drm_connector *connector) - { -@@ -568,6 +589,9 @@ static int panel_edp_get_modes(struct drm_panel *panel, - { - struct panel_edp *p = to_panel_edp(panel); - int num = 0; -+ bool has_override_edid_mode = p->detected_panel && -+ p->detected_panel != ERR_PTR(-EINVAL) && -+ p->detected_panel->override_edid_mode; - - /* probe EDID if a DDC bus is available */ - if (p->ddc) { -@@ -575,9 +599,18 @@ static int panel_edp_get_modes(struct drm_panel *panel, - - if (!p->edid) - p->edid = drm_get_edid(connector, p->ddc); -- -- if (p->edid) -- num += drm_add_edid_modes(connector, p->edid); -+ if (p->edid) { -+ if (has_override_edid_mode) { -+ /* -+ * override_edid_mode is specified. Use -+ * override_edid_mode instead of from edid. -+ */ -+ num += panel_edp_override_edid_mode(p, connector, -+ p->detected_panel->override_edid_mode); -+ } else { -+ num += drm_add_edid_modes(connector, p->edid); -+ } -+ } - - pm_runtime_mark_last_busy(panel->dev); - pm_runtime_put_autosuspend(panel->dev); -@@ -1830,6 +1863,15 @@ static const struct panel_delay delay_200_500_e200 = { - .delay = _delay \ - } - -+#define EDP_PANEL_ENTRY2(vend_chr_0, vend_chr_1, vend_chr_2, product_id, _delay, _name, _mode) \ -+{ \ -+ .name = _name, \ -+ .panel_id = drm_edid_encode_panel_id(vend_chr_0, vend_chr_1, vend_chr_2, \ -+ product_id), \ -+ .delay = _delay, \ -+ .override_edid_mode = _mode \ -+} -+ - /* - * This table is used to figure out power sequencing delays for panels that - * are detected by EDID. Entries here may point to entries in the --- -2.43.2 - -From e856bb6079d12f16cafc75bf6efb5430aae91b8c Mon Sep 17 00:00:00 2001 -From: Xin Ji <xji@analogixsemi.com> -Date: Mon, 20 Nov 2023 17:10:37 +0800 -Subject: [PATCH 1186/1501] drm/bridge: anx7625: Fix Set HPD irq detect window - to 2ms -Content-Length: 3819 -Lines: 111 - -[ Upstream commit e3af7053de3f685c96158373bc234b2feca1f160 ] - -Polling firmware HPD GPIO status, set HPD irq detect window to 2ms -after firmware HPD GPIO initial done - -Signed-off-by: Xin Ji <xji@analogixsemi.com> -Reviewed-by: Robert Foss <rfoss@kernel.org> -Signed-off-by: Robert Foss <rfoss@kernel.org> -Link: https://patchwork.freedesktop.org/patch/msgid/20231120091038.284825-2-xji@analogixsemi.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/bridge/analogix/anx7625.c | 51 ++++++++++++++++------- - drivers/gpu/drm/bridge/analogix/anx7625.h | 4 ++ - 2 files changed, 40 insertions(+), 15 deletions(-) - -diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c -index 5168628f11cf..29d91493b101 100644 ---- a/drivers/gpu/drm/bridge/analogix/anx7625.c -+++ b/drivers/gpu/drm/bridge/analogix/anx7625.c -@@ -1298,10 +1298,32 @@ static void anx7625_config(struct anx7625_data *ctx) - XTAL_FRQ_SEL, XTAL_FRQ_27M); - } - -+static int anx7625_hpd_timer_config(struct anx7625_data *ctx) -+{ -+ int ret; -+ -+ /* Set irq detect window to 2ms */ -+ ret = anx7625_reg_write(ctx, ctx->i2c.tx_p2_client, -+ HPD_DET_TIMER_BIT0_7, HPD_TIME & 0xFF); -+ ret |= anx7625_reg_write(ctx, ctx->i2c.tx_p2_client, -+ HPD_DET_TIMER_BIT8_15, -+ (HPD_TIME >> 8) & 0xFF); -+ ret |= anx7625_reg_write(ctx, ctx->i2c.tx_p2_client, -+ HPD_DET_TIMER_BIT16_23, -+ (HPD_TIME >> 16) & 0xFF); -+ -+ return ret; -+} -+ -+static int anx7625_read_hpd_gpio_config_status(struct anx7625_data *ctx) -+{ -+ return anx7625_reg_read(ctx, ctx->i2c.rx_p0_client, GPIO_CTRL_2); -+} -+ - static void anx7625_disable_pd_protocol(struct anx7625_data *ctx) - { - struct device *dev = ctx->dev; -- int ret; -+ int ret, val; - - /* Reset main ocm */ - ret = anx7625_reg_write(ctx, ctx->i2c.rx_p0_client, 0x88, 0x40); -@@ -1315,6 +1337,19 @@ static void anx7625_disable_pd_protocol(struct anx7625_data *ctx) - DRM_DEV_DEBUG_DRIVER(dev, "disable PD feature fail.\n"); - else - DRM_DEV_DEBUG_DRIVER(dev, "disable PD feature succeeded.\n"); -+ -+ /* -+ * Make sure the HPD GPIO already be configured after OCM release before -+ * setting HPD detect window register. Here we poll the status register -+ * at maximum 40ms, then config HPD irq detect window register -+ */ -+ readx_poll_timeout(anx7625_read_hpd_gpio_config_status, -+ ctx, val, -+ ((val & HPD_SOURCE) || (val < 0)), -+ 2000, 2000 * 20); -+ -+ /* Set HPD irq detect window to 2ms */ -+ anx7625_hpd_timer_config(ctx); - } - - static int anx7625_ocm_loading_check(struct anx7625_data *ctx) -@@ -1437,20 +1472,6 @@ static void anx7625_start_dp_work(struct anx7625_data *ctx) - - static int anx7625_read_hpd_status_p0(struct anx7625_data *ctx) - { -- int ret; -- -- /* Set irq detect window to 2ms */ -- ret = anx7625_reg_write(ctx, ctx->i2c.tx_p2_client, -- HPD_DET_TIMER_BIT0_7, HPD_TIME & 0xFF); -- ret |= anx7625_reg_write(ctx, ctx->i2c.tx_p2_client, -- HPD_DET_TIMER_BIT8_15, -- (HPD_TIME >> 8) & 0xFF); -- ret |= anx7625_reg_write(ctx, ctx->i2c.tx_p2_client, -- HPD_DET_TIMER_BIT16_23, -- (HPD_TIME >> 16) & 0xFF); -- if (ret < 0) -- return ret; -- - return anx7625_reg_read(ctx, ctx->i2c.rx_p0_client, SYSTEM_STSTUS); - } - -diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.h b/drivers/gpu/drm/bridge/analogix/anx7625.h -index 80d3fb4e985f..39ed35d33836 100644 ---- a/drivers/gpu/drm/bridge/analogix/anx7625.h -+++ b/drivers/gpu/drm/bridge/analogix/anx7625.h -@@ -259,6 +259,10 @@ - #define AP_MIPI_RX_EN BIT(5) /* 1: MIPI RX input in 0: no RX in */ - #define AP_DISABLE_PD BIT(6) - #define AP_DISABLE_DISPLAY BIT(7) -+ -+#define GPIO_CTRL_2 0x49 -+#define HPD_SOURCE BIT(6) -+ - /***************************************************************/ - /* Register definition of device address 0x84 */ - #define MIPI_PHY_CONTROL_3 0x03 --- -2.43.2 - -From 10d0701ad7a38960b06ea5715c8baadfd12ffbbe Mon Sep 17 00:00:00 2001 -From: Meenakshikumar Somasundaram <meenakshikumar.somasundaram@amd.com> -Date: Thu, 9 Nov 2023 00:04:36 -0500 -Subject: [PATCH 1187/1501] drm/amd/display: Fix tiled display misalignment -Content-Length: 1290 -Lines: 35 - -[ Upstream commit c4b8394e76adba4f50a3c2696c75b214a291e24a ] - -[Why] -When otg workaround is applied during clock update, otgs of -tiled display went out of sync. - -[How] -To call dc_trigger_sync() after clock update to sync otgs again. - -Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> -Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> -Signed-off-by: Meenakshikumar Somasundaram <meenakshikumar.somasundaram@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/display/dc/core/dc.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c -index bc098098345c..bbdeda489768 100644 ---- a/drivers/gpu/drm/amd/display/dc/core/dc.c -+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c -@@ -1964,6 +1964,10 @@ static enum dc_status dc_commit_state_no_check(struct dc *dc, struct dc_state *c - wait_for_no_pipes_pending(dc, context); - /* pplib is notified if disp_num changed */ - dc->hwss.optimize_bandwidth(dc, context); -+ /* Need to do otg sync again as otg could be out of sync due to otg -+ * workaround applied during clock update -+ */ -+ dc_trigger_sync(dc, context); - } - - if (dc->hwss.update_dsc_pg) --- -2.43.2 - -From bc64437cfa833dbe5001d796f68af1afab72eabb Mon Sep 17 00:00:00 2001 -From: Jaegeuk Kim <jaegeuk@kernel.org> -Date: Sat, 2 Dec 2023 00:08:57 -0800 -Subject: [PATCH 1188/1501] f2fs: fix write pointers on zoned device after roll - forward -Content-Length: 859 -Lines: 29 - -[ Upstream commit 9dad4d964291295ef48243d4e03972b85138bc9f ] - -1. do roll forward recovery -2. update current segments pointers -3. fix the entire zones' write pointers -4. do checkpoint - -Reviewed-by: Daeho Jeong <daehojeong@google.com> -Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/f2fs/recovery.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c -index 16415c770b45..d0f24ccbd1ac 100644 ---- a/fs/f2fs/recovery.c -+++ b/fs/f2fs/recovery.c -@@ -917,6 +917,8 @@ int f2fs_recover_fsync_data(struct f2fs_sb_info *sbi, bool check_only) - if (!err && fix_curseg_write_pointer && !f2fs_readonly(sbi->sb) && - f2fs_sb_has_blkzoned(sbi)) { - err = f2fs_fix_curseg_write_pointer(sbi); -+ if (!err) -+ err = f2fs_check_write_pointer(sbi); - ret = err; - } - --- -2.43.2 - -From 4b6986b170f2f23e390bbd2d50784caa9cb67093 Mon Sep 17 00:00:00 2001 -From: Venkata Prasad Potturu <venkataprasad.potturu@amd.com> -Date: Wed, 6 Dec 2023 16:36:12 +0530 -Subject: [PATCH 1189/1501] ASoC: amd: Add new dmi entries for acp5x platform -Content-Length: 1404 -Lines: 47 - -[ Upstream commit c3ab23a10771bbe06300e5374efa809789c65455 ] - -Add sys_vendor and product_name dmi entries for acp5x platform. - -Signed-off-by: Venkata Prasad Potturu <venkataprasad.potturu@amd.com> -Link: https://lore.kernel.org/r/20231206110620.1695591-1-venkataprasad.potturu@amd.com -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - sound/soc/amd/acp-config.c | 15 ++++++++++++++- - 1 file changed, 14 insertions(+), 1 deletion(-) - -diff --git a/sound/soc/amd/acp-config.c b/sound/soc/amd/acp-config.c -index 3bc4b2e41650..dea6d367b9e8 100644 ---- a/sound/soc/amd/acp-config.c -+++ b/sound/soc/amd/acp-config.c -@@ -3,7 +3,7 @@ - // This file is provided under a dual BSD/GPLv2 license. When using or - // redistributing this file, you may do so under either license. - // --// Copyright(c) 2021 Advanced Micro Devices, Inc. -+// Copyright(c) 2021, 2023 Advanced Micro Devices, Inc. - // - // Authors: Ajit Kumar Pandey <AjitKumar.Pandey@amd.com> - // -@@ -47,6 +47,19 @@ static const struct config_entry config_table[] = { - {} - }, - }, -+ { -+ .flags = FLAG_AMD_LEGACY, -+ .device = ACP_PCI_DEV_ID, -+ .dmi_table = (const struct dmi_system_id []) { -+ { -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Valve"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Jupiter"), -+ }, -+ }, -+ {} -+ }, -+ }, - { - .flags = FLAG_AMD_SOF, - .device = ACP_PCI_DEV_ID, --- -2.43.2 - -From d38bc19978f26415979a58b1572e1a9c785c5eaf Mon Sep 17 00:00:00 2001 -From: Ilya Bakoulin <ilya.bakoulin@amd.com> -Date: Fri, 1 Dec 2023 06:25:06 -0700 -Subject: [PATCH 1190/1501] drm/amd/display: Fix MST PBN/X.Y value calculations -Content-Length: 1939 -Lines: 49 - -[ Upstream commit 94bbf802efd0a8f13147d6664af6e653637340a8 ] - -Changing PBN calculation to be more in line with spec. We don't need to -inflate PBN_NATIVE value by the 1.006 margin, since that is already -taken care of in the get_pbn_per_slot function. - -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Reviewed-by: Wenjing Liu <wenjing.liu@amd.com> -Acked-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com> -Signed-off-by: Ilya Bakoulin <ilya.bakoulin@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 13 ++++++++----- - 1 file changed, 8 insertions(+), 5 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c -index 04d1ecd6e593..d28564b1b28a 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c -+++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c -@@ -1061,18 +1061,21 @@ static struct fixed31_32 get_pbn_from_bw_in_kbps(uint64_t kbps) - uint32_t denominator = 1; - - /* -- * margin 5300ppm + 300ppm ~ 0.6% as per spec, factor is 1.006 -+ * The 1.006 factor (margin 5300ppm + 300ppm ~ 0.6% as per spec) is not -+ * required when determining PBN/time slot utilization on the link between -+ * us and the branch, since that overhead is already accounted for in -+ * the get_pbn_per_slot function. -+ * - * The unit of 54/64Mbytes/sec is an arbitrary unit chosen based on - * common multiplier to render an integer PBN for all link rate/lane - * counts combinations - * calculate -- * peak_kbps *= (1006/1000) - * peak_kbps *= (64/54) -- * peak_kbps *= 8 convert to bytes -+ * peak_kbps /= (8 * 1000) convert to bytes - */ - -- numerator = 64 * PEAK_FACTOR_X1000; -- denominator = 54 * 8 * 1000 * 1000; -+ numerator = 64; -+ denominator = 54 * 8 * 1000; - kbps *= numerator; - peak_kbps = dc_fixpt_from_fraction(kbps, denominator); - --- -2.43.2 - -From ce29728ef6485a367934cc100249c66dd3cde5b6 Mon Sep 17 00:00:00 2001 -From: Nicholas Susanto <nicholas.susanto@amd.com> -Date: Fri, 1 Dec 2023 06:25:15 -0700 -Subject: [PATCH 1191/1501] drm/amd/display: Fix disable_otg_wa logic -Content-Length: 2132 -Lines: 52 - -[ Upstream commit 2ce156482a6fef349d2eba98e5070c412d3af662 ] - -[Why] -When switching to another HDMI mode, we are unnecesarilly -disabling/enabling FIFO causing both HPO and DIG registers to be set at -the same time when only HPO is supposed to be set. - -This can lead to a system hang the next time we change refresh rates as -there are cases when we don't disable OTG/FIFO but FIFO is enabled when -it isn't supposed to be. - -[How] -Removing the enable/disable FIFO entirely. - -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> -Acked-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com> -Signed-off-by: Nicholas Susanto <nicholas.susanto@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 8 -------- - 1 file changed, 8 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c -index 45ede6440a79..4ef90a3add1c 100644 ---- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c -@@ -126,21 +126,13 @@ static void dcn35_disable_otg_wa(struct clk_mgr *clk_mgr_base, struct dc_state * - continue; - if (pipe->stream && (pipe->stream->dpms_off || dc_is_virtual_signal(pipe->stream->signal) || - !pipe->stream->link_enc)) { -- struct stream_encoder *stream_enc = pipe->stream_res.stream_enc; -- - if (disable) { -- if (stream_enc && stream_enc->funcs->disable_fifo) -- pipe->stream_res.stream_enc->funcs->disable_fifo(stream_enc); -- - if (pipe->stream_res.tg && pipe->stream_res.tg->funcs->immediate_disable_crtc) - pipe->stream_res.tg->funcs->immediate_disable_crtc(pipe->stream_res.tg); - - reset_sync_context_for_pipe(dc, context, i); - } else { - pipe->stream_res.tg->funcs->enable_crtc(pipe->stream_res.tg); -- -- if (stream_enc && stream_enc->funcs->enable_fifo) -- pipe->stream_res.stream_enc->funcs->enable_fifo(stream_enc); - } - } - } --- -2.43.2 - -From 89824a09dda528236af70a4ca375c3cd69539744 Mon Sep 17 00:00:00 2001 -From: Dennis Chan <dennis.chan@amd.com> -Date: Fri, 1 Dec 2023 06:25:19 -0700 -Subject: [PATCH 1192/1501] drm/amd/display: Fix Replay Desync Error IRQ - handler -Content-Length: 2260 -Lines: 54 - -[ Upstream commit dd5c6362ddcd8bdb07704faff8648593885ecfa1 ] - -In previous case, Replay didn't identify the IRQ type, This commit fixes -the issues for the interrupt. - -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Reviewed-by: Robin Chen <robin.chen@amd.com> -Acked-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com> -Signed-off-by: Dennis Chan <dennis.chan@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../display/dc/link/protocols/link_dp_irq_handler.c | 12 ++++++------ - 1 file changed, 6 insertions(+), 6 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_irq_handler.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_irq_handler.c -index 0c00e94e90b1..9eadc2c7f221 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_irq_handler.c -+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_irq_handler.c -@@ -190,9 +190,6 @@ static void handle_hpd_irq_replay_sink(struct dc_link *link) - /*AMD Replay version reuse DP_PSR_ERROR_STATUS for REPLAY_ERROR status.*/ - union psr_error_status replay_error_status; - -- if (link->replay_settings.config.force_disable_desync_error_check) -- return; -- - if (!link->replay_settings.replay_feature_enabled) - return; - -@@ -210,9 +207,6 @@ static void handle_hpd_irq_replay_sink(struct dc_link *link) - &replay_error_status.raw, - sizeof(replay_error_status.raw)); - -- if (replay_configuration.bits.DESYNC_ERROR_STATUS) -- link->replay_settings.config.received_desync_error_hpd = 1; -- - link->replay_settings.config.replay_error_status.bits.LINK_CRC_ERROR = - replay_error_status.bits.LINK_CRC_ERROR; - link->replay_settings.config.replay_error_status.bits.DESYNC_ERROR = -@@ -225,6 +219,12 @@ static void handle_hpd_irq_replay_sink(struct dc_link *link) - link->replay_settings.config.replay_error_status.bits.STATE_TRANSITION_ERROR) { - bool allow_active; - -+ if (link->replay_settings.config.replay_error_status.bits.DESYNC_ERROR) -+ link->replay_settings.config.received_desync_error_hpd = 1; -+ -+ if (link->replay_settings.config.force_disable_desync_error_check) -+ return; -+ - /* Acknowledge and clear configuration bits */ - dm_helpers_dp_write_dpcd( - link->ctx, --- -2.43.2 - -From 17ba4ac891142a9d6d3909bfb33426b6e987e867 Mon Sep 17 00:00:00 2001 -From: Wenjing Liu <wenjing.liu@amd.com> -Date: Fri, 1 Dec 2023 06:25:20 -0700 -Subject: [PATCH 1193/1501] drm/amd/display: add support for DTO genarated - dscclk -Content-Length: 8186 -Lines: 170 - -[ Upstream commit 08a32addf17317b9fac55be9b31275cbf6e41fb7 ] - -Current implementation will choose to use refclk as dscclk. This is not -recommended by hardware team as refclk is a fixed value which could -cause unnecessary power consumption or it could be not enough for large -DSC timings. So we are adding new interfaces so we could switch to use -dynamically generated DSCCLK by DTO. So DSCCLK is programmable based on -current pixel clock and dispclk. - -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Reviewed-by: Chaitanya Dhere <chaitanya.dhere@amd.com> -Acked-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com> -Signed-off-by: Wenjing Liu <wenjing.liu@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 25 +++++++++++++++++ - drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h | 4 +++ - .../gpu/drm/amd/display/dc/link/link_dpms.c | 27 ++++++++++++++++++- - 3 files changed, 55 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c -index 5bf9e7c1e052..cb9d8389329f 100644 ---- a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c -@@ -995,9 +995,22 @@ static int calc_mpc_flow_ctrl_cnt(const struct dc_stream_state *stream, - static void update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable) - { - struct display_stream_compressor *dsc = pipe_ctx->stream_res.dsc; -+ struct dc *dc = pipe_ctx->stream->ctx->dc; - struct dc_stream_state *stream = pipe_ctx->stream; - struct pipe_ctx *odm_pipe; - int opp_cnt = 1; -+ struct dccg *dccg = dc->res_pool->dccg; -+ /* It has been found that when DSCCLK is lower than 16Mhz, we will get DCN -+ * register access hung. When DSCCLk is based on refclk, DSCCLk is always a -+ * fixed value higher than 16Mhz so the issue doesn't occur. When DSCCLK is -+ * generated by DTO, DSCCLK would be based on 1/3 dispclk. For small timings -+ * with DSC such as 480p60Hz, the dispclk could be low enough to trigger -+ * this problem. We are implementing a workaround here to keep using dscclk -+ * based on fixed value refclk when timing is smaller than 3x16Mhz (i.e -+ * 48Mhz) pixel clock to avoid hitting this problem. -+ */ -+ bool should_use_dto_dscclk = (dccg->funcs->set_dto_dscclk != NULL) && -+ stream->timing.pix_clk_100hz > 480000; - - ASSERT(dsc); - for (odm_pipe = pipe_ctx->next_odm_pipe; odm_pipe; odm_pipe = odm_pipe->next_odm_pipe) -@@ -1020,12 +1033,16 @@ static void update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable) - - dsc->funcs->dsc_set_config(dsc, &dsc_cfg, &dsc_optc_cfg); - dsc->funcs->dsc_enable(dsc, pipe_ctx->stream_res.opp->inst); -+ if (should_use_dto_dscclk) -+ dccg->funcs->set_dto_dscclk(dccg, dsc->inst); - for (odm_pipe = pipe_ctx->next_odm_pipe; odm_pipe; odm_pipe = odm_pipe->next_odm_pipe) { - struct display_stream_compressor *odm_dsc = odm_pipe->stream_res.dsc; - - ASSERT(odm_dsc); - odm_dsc->funcs->dsc_set_config(odm_dsc, &dsc_cfg, &dsc_optc_cfg); - odm_dsc->funcs->dsc_enable(odm_dsc, odm_pipe->stream_res.opp->inst); -+ if (should_use_dto_dscclk) -+ dccg->funcs->set_dto_dscclk(dccg, odm_dsc->inst); - } - dsc_cfg.dc_dsc_cfg.num_slices_h *= opp_cnt; - dsc_cfg.pic_width *= opp_cnt; -@@ -1045,9 +1062,13 @@ static void update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable) - OPTC_DSC_DISABLED, 0, 0); - - /* disable DSC block */ -+ if (dccg->funcs->set_ref_dscclk) -+ dccg->funcs->set_ref_dscclk(dccg, pipe_ctx->stream_res.dsc->inst); - dsc->funcs->dsc_disable(pipe_ctx->stream_res.dsc); - for (odm_pipe = pipe_ctx->next_odm_pipe; odm_pipe; odm_pipe = odm_pipe->next_odm_pipe) { - ASSERT(odm_pipe->stream_res.dsc); -+ if (dccg->funcs->set_ref_dscclk) -+ dccg->funcs->set_ref_dscclk(dccg, odm_pipe->stream_res.dsc->inst); - odm_pipe->stream_res.dsc->funcs->dsc_disable(odm_pipe->stream_res.dsc); - } - } -@@ -1130,6 +1151,10 @@ void dcn32_update_odm(struct dc *dc, struct dc_state *context, struct pipe_ctx * - if (!pipe_ctx->next_odm_pipe && current_pipe_ctx->next_odm_pipe && - current_pipe_ctx->next_odm_pipe->stream_res.dsc) { - struct display_stream_compressor *dsc = current_pipe_ctx->next_odm_pipe->stream_res.dsc; -+ struct dccg *dccg = dc->res_pool->dccg; -+ -+ if (dccg->funcs->set_ref_dscclk) -+ dccg->funcs->set_ref_dscclk(dccg, dsc->inst); - /* disconnect DSC block from stream */ - dsc->funcs->dsc_disconnect(dsc); - } -diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h b/drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h -index ce2f0c0e82bd..6b44557fcb1a 100644 ---- a/drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h -+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h -@@ -201,6 +201,10 @@ struct dccg_funcs { - struct dccg *dccg, - enum streamclk_source src, - uint32_t otg_inst); -+ void (*set_dto_dscclk)( -+ struct dccg *dccg, -+ uint32_t dsc_inst); -+ void (*set_ref_dscclk)(struct dccg *dccg, uint32_t dsc_inst); - }; - - #endif //__DAL_DCCG_H__ -diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c -index d28564b1b28a..a08ae59c1ea9 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c -+++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c -@@ -776,10 +776,26 @@ static bool dp_set_dsc_on_rx(struct pipe_ctx *pipe_ctx, bool enable) - */ - void link_set_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable) - { -+ /* TODO: Move this to HWSS as this is hardware programming sequence not a -+ * link layer sequence -+ */ - struct display_stream_compressor *dsc = pipe_ctx->stream_res.dsc; -+ struct dc *dc = pipe_ctx->stream->ctx->dc; - struct dc_stream_state *stream = pipe_ctx->stream; - struct pipe_ctx *odm_pipe; - int opp_cnt = 1; -+ struct dccg *dccg = dc->res_pool->dccg; -+ /* It has been found that when DSCCLK is lower than 16Mhz, we will get DCN -+ * register access hung. When DSCCLk is based on refclk, DSCCLk is always a -+ * fixed value higher than 16Mhz so the issue doesn't occur. When DSCCLK is -+ * generated by DTO, DSCCLK would be based on 1/3 dispclk. For small timings -+ * with DSC such as 480p60Hz, the dispclk could be low enough to trigger -+ * this problem. We are implementing a workaround here to keep using dscclk -+ * based on fixed value refclk when timing is smaller than 3x16Mhz (i.e -+ * 48Mhz) pixel clock to avoid hitting this problem. -+ */ -+ bool should_use_dto_dscclk = (dccg->funcs->set_dto_dscclk != NULL) && -+ stream->timing.pix_clk_100hz > 480000; - DC_LOGGER_INIT(dsc->ctx->logger); - - for (odm_pipe = pipe_ctx->next_odm_pipe; odm_pipe; odm_pipe = odm_pipe->next_odm_pipe) -@@ -802,11 +818,15 @@ void link_set_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable) - - dsc->funcs->dsc_set_config(dsc, &dsc_cfg, &dsc_optc_cfg); - dsc->funcs->dsc_enable(dsc, pipe_ctx->stream_res.opp->inst); -+ if (should_use_dto_dscclk) -+ dccg->funcs->set_dto_dscclk(dccg, dsc->inst); - for (odm_pipe = pipe_ctx->next_odm_pipe; odm_pipe; odm_pipe = odm_pipe->next_odm_pipe) { - struct display_stream_compressor *odm_dsc = odm_pipe->stream_res.dsc; - - odm_dsc->funcs->dsc_set_config(odm_dsc, &dsc_cfg, &dsc_optc_cfg); - odm_dsc->funcs->dsc_enable(odm_dsc, odm_pipe->stream_res.opp->inst); -+ if (should_use_dto_dscclk) -+ dccg->funcs->set_dto_dscclk(dccg, odm_dsc->inst); - } - dsc_cfg.dc_dsc_cfg.num_slices_h *= opp_cnt; - dsc_cfg.pic_width *= opp_cnt; -@@ -856,9 +876,14 @@ void link_set_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable) - } - - /* disable DSC block */ -+ if (dccg->funcs->set_ref_dscclk) -+ dccg->funcs->set_ref_dscclk(dccg, pipe_ctx->stream_res.dsc->inst); - pipe_ctx->stream_res.dsc->funcs->dsc_disable(pipe_ctx->stream_res.dsc); -- for (odm_pipe = pipe_ctx->next_odm_pipe; odm_pipe; odm_pipe = odm_pipe->next_odm_pipe) -+ for (odm_pipe = pipe_ctx->next_odm_pipe; odm_pipe; odm_pipe = odm_pipe->next_odm_pipe) { -+ if (dccg->funcs->set_ref_dscclk) -+ dccg->funcs->set_ref_dscclk(dccg, odm_pipe->stream_res.dsc->inst); - odm_pipe->stream_res.dsc->funcs->dsc_disable(odm_pipe->stream_res.dsc); -+ } - } - } - --- -2.43.2 - -From 87ea60fce614decaa56e53cd45f3766860464f4f Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Fri, 3 Nov 2023 15:14:03 +0200 -Subject: [PATCH 1194/1501] drm/drm_file: fix use of uninitialized variable -Content-Length: 1379 -Lines: 35 - -[ Upstream commit 1d3062fad9c7313fff9970a88e0538a24480ffb8 ] - -smatch reports: - -drivers/gpu/drm/drm_file.c:967 drm_show_memory_stats() error: uninitialized symbol 'supported_status'. - -'supported_status' is only set in one code path. I'm not familiar with -the code to say if that path will always be ran in real life, but -whether that is the case or not, I think it is good to initialize -'supported_status' to 0 to silence the warning (and possibly fix a bug). - -Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> -Acked-by: Maxime Ripard <mripard@kernel.org> -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20231103-uninit-fixes-v2-1-c22b2444f5f5@ideasonboard.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/drm_file.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c -index 446458aca8e9..54a7103c1c0f 100644 ---- a/drivers/gpu/drm/drm_file.c -+++ b/drivers/gpu/drm/drm_file.c -@@ -958,7 +958,7 @@ void drm_show_memory_stats(struct drm_printer *p, struct drm_file *file) - { - struct drm_gem_object *obj; - struct drm_memory_stats status = {}; -- enum drm_gem_object_status supported_status; -+ enum drm_gem_object_status supported_status = 0; - int id; - - spin_lock(&file->table_lock); --- -2.43.2 - -From 813bd97cf175dec86d60bd7cb7cbd87c4798aebc Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Thu, 21 Sep 2023 13:50:32 +0300 -Subject: [PATCH 1196/1501] drm/mipi-dsi: Fix detach call without attach -Content-Length: 4598 -Lines: 130 - -[ Upstream commit 90d50b8d85834e73536fdccd5aa913b30494fef0 ] - -It's been reported that DSI host driver's detach can be called without -the attach ever happening: - -https://lore.kernel.org/all/20230412073954.20601-1-tony@atomide.com/ - -After reading the code, I think this is what happens: - -We have a DSI host defined in the device tree and a DSI peripheral under -that host (i.e. an i2c device using the DSI as data bus doesn't exhibit -this behavior). - -The host driver calls mipi_dsi_host_register(), which causes (via a few -functions) mipi_dsi_device_add() to be called for the DSI peripheral. So -now we have a DSI device under the host, but attach hasn't been called. - -Normally the probing of the devices continues, and eventually the DSI -peripheral's driver will call mipi_dsi_attach(), attaching the -peripheral. - -However, if the host driver's probe encounters an error after calling -mipi_dsi_host_register(), and before the peripheral has called -mipi_dsi_attach(), the host driver will do cleanups and return an error -from its probe function. The cleanups include calling -mipi_dsi_host_unregister(). - -mipi_dsi_host_unregister() will call two functions for all its DSI -peripheral devices: mipi_dsi_detach() and mipi_dsi_device_unregister(). -The latter makes sense, as the device exists, but the former may be -wrong as attach has not necessarily been done. - -To fix this, track the attached state of the peripheral, and only detach -from mipi_dsi_host_unregister() if the peripheral was attached. - -Note that I have only tested this with a board with an i2c DSI -peripheral, not with a "pure" DSI peripheral. - -However, slightly related, the unregister machinery still seems broken. -E.g. if the DSI host driver is unbound, it'll detach and unregister the -DSI peripherals. After that, when the DSI peripheral driver unbound -it'll call detach either directly or using the devm variant, leading to -a crash. And probably the driver will crash if it happens, for some -reason, to try to send a message via the DSI bus. - -But that's another topic. - -Tested-by: H. Nikolaus Schaller <hns@goldelico.com> -Acked-by: Maxime Ripard <mripard@kernel.org> -Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com> -Tested-by: Tony Lindgren <tony@atomide.com> -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20230921-dsi-detach-fix-v1-1-d0de2d1621d9@ideasonboard.com -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/drm_mipi_dsi.c | 17 +++++++++++++++-- - include/drm/drm_mipi_dsi.h | 2 ++ - 2 files changed, 17 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c -index 14201f73aab1..843a6dbda93a 100644 ---- a/drivers/gpu/drm/drm_mipi_dsi.c -+++ b/drivers/gpu/drm/drm_mipi_dsi.c -@@ -347,7 +347,8 @@ static int mipi_dsi_remove_device_fn(struct device *dev, void *priv) - { - struct mipi_dsi_device *dsi = to_mipi_dsi_device(dev); - -- mipi_dsi_detach(dsi); -+ if (dsi->attached) -+ mipi_dsi_detach(dsi); - mipi_dsi_device_unregister(dsi); - - return 0; -@@ -370,11 +371,18 @@ EXPORT_SYMBOL(mipi_dsi_host_unregister); - int mipi_dsi_attach(struct mipi_dsi_device *dsi) - { - const struct mipi_dsi_host_ops *ops = dsi->host->ops; -+ int ret; - - if (!ops || !ops->attach) - return -ENOSYS; - -- return ops->attach(dsi->host, dsi); -+ ret = ops->attach(dsi->host, dsi); -+ if (ret) -+ return ret; -+ -+ dsi->attached = true; -+ -+ return 0; - } - EXPORT_SYMBOL(mipi_dsi_attach); - -@@ -386,9 +394,14 @@ int mipi_dsi_detach(struct mipi_dsi_device *dsi) - { - const struct mipi_dsi_host_ops *ops = dsi->host->ops; - -+ if (WARN_ON(!dsi->attached)) -+ return -EINVAL; -+ - if (!ops || !ops->detach) - return -ENOSYS; - -+ dsi->attached = false; -+ - return ops->detach(dsi->host, dsi); - } - EXPORT_SYMBOL(mipi_dsi_detach); -diff --git a/include/drm/drm_mipi_dsi.h b/include/drm/drm_mipi_dsi.h -index c9df0407980c..c0aec0d4d664 100644 ---- a/include/drm/drm_mipi_dsi.h -+++ b/include/drm/drm_mipi_dsi.h -@@ -168,6 +168,7 @@ struct mipi_dsi_device_info { - * struct mipi_dsi_device - DSI peripheral device - * @host: DSI host for this peripheral - * @dev: driver model device node for this peripheral -+ * @attached: the DSI device has been successfully attached - * @name: DSI peripheral chip type - * @channel: virtual channel assigned to the peripheral - * @format: pixel format for video mode -@@ -184,6 +185,7 @@ struct mipi_dsi_device_info { - struct mipi_dsi_device { - struct mipi_dsi_host *host; - struct device dev; -+ bool attached; - - char name[DSI_DEV_NAME_SIZE]; - unsigned int channel; --- -2.43.2 - -From 5786d24b00f62a8838060c0dcc13932b32d9d082 Mon Sep 17 00:00:00 2001 -From: Ghanshyam Agrawal <ghanshyam1898@gmail.com> -Date: Sat, 25 Nov 2023 14:32:36 +0530 -Subject: [PATCH 1197/1501] media: stk1160: Fixed high volume of stk1160_dbg - messages -Content-Length: 1503 -Lines: 39 - -[ Upstream commit b3695e86d25aafbe175dd51f6aaf6f68d341d590 ] - -The function stk1160_dbg gets called too many times, which causes -the output to get flooded with messages. Since stk1160_dbg uses -printk, it is now replaced with printk_ratelimited. - -Suggested-by: Phillip Potter <phil@philpotter.co.uk> -Signed-off-by: Ghanshyam Agrawal <ghanshyam1898@gmail.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/usb/stk1160/stk1160-video.c | 5 ++--- - 1 file changed, 2 insertions(+), 3 deletions(-) - -diff --git a/drivers/media/usb/stk1160/stk1160-video.c b/drivers/media/usb/stk1160/stk1160-video.c -index 4e966f6bf608..366f0e4a5dc0 100644 ---- a/drivers/media/usb/stk1160/stk1160-video.c -+++ b/drivers/media/usb/stk1160/stk1160-video.c -@@ -107,8 +107,7 @@ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len) - - /* - * TODO: These stk1160_dbg are very spammy! -- * We should 1) check why we are getting them -- * and 2) add ratelimit. -+ * We should check why we are getting them. - * - * UPDATE: One of the reasons (the only one?) for getting these - * is incorrect standard (mismatch between expected and configured). -@@ -151,7 +150,7 @@ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len) - - /* Let the bug hunt begin! sanity checks! */ - if (lencopy < 0) { -- stk1160_dbg("copy skipped: negative lencopy\n"); -+ printk_ratelimited(KERN_DEBUG "copy skipped: negative lencopy\n"); - return; - } - --- -2.43.2 - -From e6b4dfc22148534c318103dbb53d678ed1dd17b3 Mon Sep 17 00:00:00 2001 -From: Michael Tretter <m.tretter@pengutronix.de> -Date: Fri, 13 Oct 2023 13:00:22 +0200 -Subject: [PATCH 1198/1501] media: rockchip: rga: fix swizzling for RGB formats -Content-Length: 2214 -Lines: 66 - -[ Upstream commit 9e7dc39260edac180c206bb6149595a40eabae3e ] - -When using 32 bit RGB formats, the RGA on the rk3568 produces wrong -colors as the wrong color channels are read or written. The reason is -that the format description for the channel swizzeling is wrong and the -wrong bits are configured. For example, when converting ARGB32 to NV12, -the alpha channel is used as blue channel.. This doesn't happen if the -color format is the same on both sides. - -Fix the color_swap settings of the formats to correctly handle 32 bit -RGB formats. - -For RGA_COLOR_FMT_XBGR8888, the RGA_COLOR_ALPHA_SWAP bit doesn't have an -effect. Thus, it isn't possible to handle the V4L2_PIX_FMT_XRGB32. Thus, -it is removed from the list of supported formats. - -Signed-off-by: Michael Tretter <m.tretter@pengutronix.de> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/platform/rockchip/rga/rga.c | 15 +++------------ - 1 file changed, 3 insertions(+), 12 deletions(-) - -diff --git a/drivers/media/platform/rockchip/rga/rga.c b/drivers/media/platform/rockchip/rga/rga.c -index f1c532a5802a..25f5b5eebf13 100644 ---- a/drivers/media/platform/rockchip/rga/rga.c -+++ b/drivers/media/platform/rockchip/rga/rga.c -@@ -184,25 +184,16 @@ static int rga_setup_ctrls(struct rga_ctx *ctx) - static struct rga_fmt formats[] = { - { - .fourcc = V4L2_PIX_FMT_ARGB32, -- .color_swap = RGA_COLOR_RB_SWAP, -+ .color_swap = RGA_COLOR_ALPHA_SWAP, - .hw_format = RGA_COLOR_FMT_ABGR8888, - .depth = 32, - .uv_factor = 1, - .y_div = 1, - .x_div = 1, - }, -- { -- .fourcc = V4L2_PIX_FMT_XRGB32, -- .color_swap = RGA_COLOR_RB_SWAP, -- .hw_format = RGA_COLOR_FMT_XBGR8888, -- .depth = 32, -- .uv_factor = 1, -- .y_div = 1, -- .x_div = 1, -- }, - { - .fourcc = V4L2_PIX_FMT_ABGR32, -- .color_swap = RGA_COLOR_ALPHA_SWAP, -+ .color_swap = RGA_COLOR_RB_SWAP, - .hw_format = RGA_COLOR_FMT_ABGR8888, - .depth = 32, - .uv_factor = 1, -@@ -211,7 +202,7 @@ static struct rga_fmt formats[] = { - }, - { - .fourcc = V4L2_PIX_FMT_XBGR32, -- .color_swap = RGA_COLOR_ALPHA_SWAP, -+ .color_swap = RGA_COLOR_RB_SWAP, - .hw_format = RGA_COLOR_FMT_XBGR8888, - .depth = 32, - .uv_factor = 1, --- -2.43.2 - -From 831513ab600633eea6d1c8d28cfb5978f4171d78 Mon Sep 17 00:00:00 2001 -From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> -Date: Mon, 4 Dec 2023 15:27:06 -0600 -Subject: [PATCH 1199/1501] PCI: add INTEL_HDA_ARL to pci_ids.h -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1173 -Lines: 30 - -[ Upstream commit 5ec42bf04d72fd6d0a6855810cc779e0ee31dfd7 ] - -The PCI ID insertion follows the increasing order in the table, but -this hardware follows MTL (MeteorLake). - -Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> -Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com> -Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com> -Acked-by: Mark Brown <broonie@kernel.org> -Link: https://lore.kernel.org/r/20231204212710.185976-2-pierre-louis.bossart@linux.intel.com -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/linux/pci_ids.h | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h -index 275799b5f535..97cc0baad0f4 100644 ---- a/include/linux/pci_ids.h -+++ b/include/linux/pci_ids.h -@@ -3065,6 +3065,7 @@ - #define PCI_DEVICE_ID_INTEL_82443GX_0 0x71a0 - #define PCI_DEVICE_ID_INTEL_82443GX_2 0x71a2 - #define PCI_DEVICE_ID_INTEL_82372FB_1 0x7601 -+#define PCI_DEVICE_ID_INTEL_HDA_ARL 0x7728 - #define PCI_DEVICE_ID_INTEL_HDA_RPL_S 0x7a50 - #define PCI_DEVICE_ID_INTEL_HDA_ADL_S 0x7ad0 - #define PCI_DEVICE_ID_INTEL_HDA_MTL 0x7e28 --- -2.43.2 - -From 610c86fa6494e23f49cbdd55630d0ec047f7dc6f Mon Sep 17 00:00:00 2001 -From: Neil Armstrong <neil.armstrong@linaro.org> -Date: Thu, 7 Dec 2023 17:37:18 +0100 -Subject: [PATCH 1202/1501] drm/msm/dp: Add DisplayPort controller for SM8650 -Content-Length: 1707 -Lines: 42 - -[ Upstream commit 1b2d98bdd7b7c64265732f5f0dace4c52c9ba8a8 ] - -The Qualcomm SM8650 platform comes with a DisplayPort controller -with a different base offset than the previous SM8550 SoC, -add support for this in the DisplayPort driver. - -Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> -Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Patchwork: https://patchwork.freedesktop.org/patch/571132/ -Link: https://lore.kernel.org/r/20231207-topic-sm8650-upstream-dp-v1-2-b762c06965bb@linaro.org -Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/msm/dp/dp_display.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c -index 1b88fb52726f..4f89c9939501 100644 ---- a/drivers/gpu/drm/msm/dp/dp_display.c -+++ b/drivers/gpu/drm/msm/dp/dp_display.c -@@ -170,6 +170,11 @@ static const struct msm_dp_desc sm8350_dp_descs[] = { - {} - }; - -+static const struct msm_dp_desc sm8650_dp_descs[] = { -+ { .io_start = 0x0af54000, .id = MSM_DP_CONTROLLER_0, .connector_type = DRM_MODE_CONNECTOR_DisplayPort }, -+ {} -+}; -+ - static const struct of_device_id dp_dt_match[] = { - { .compatible = "qcom,sc7180-dp", .data = &sc7180_dp_descs }, - { .compatible = "qcom,sc7280-dp", .data = &sc7280_dp_descs }, -@@ -180,6 +185,7 @@ static const struct of_device_id dp_dt_match[] = { - { .compatible = "qcom,sc8280xp-edp", .data = &sc8280xp_edp_descs }, - { .compatible = "qcom,sdm845-dp", .data = &sc7180_dp_descs }, - { .compatible = "qcom,sm8350-dp", .data = &sm8350_dp_descs }, -+ { .compatible = "qcom,sm8650-dp", .data = &sm8650_dp_descs }, - {} - }; - --- -2.43.2 - -From 0b4ea7fff0f0e0ed17e90ae9b9575fd8360ae62b Mon Sep 17 00:00:00 2001 -From: Ricardo Ribalda <ribalda@chromium.org> -Date: Tue, 5 Sep 2023 17:29:52 +0200 -Subject: [PATCH 1203/1501] media: uvcvideo: Fix power line control for a - Chicony camera -Content-Length: 1484 -Lines: 39 - -[ Upstream commit dba3e701917a4cce92920f8ccb9fa4d4ee5ac07e ] - -The device does not implement the control properly. - -Fixes v4l2-compliance error: - -info: checking control 'Power Line Frequency' (0x00980918) -fail: v4l2-test-controls.cpp(552): could not set valid menu item 3 - -Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> -Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/usb/uvc/uvc_driver.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c -index 08fcd2ffa727..4b5ea3501753 100644 ---- a/drivers/media/usb/uvc/uvc_driver.c -+++ b/drivers/media/usb/uvc/uvc_driver.c -@@ -2592,6 +2592,15 @@ static const struct usb_device_id uvc_ids[] = { - .bInterfaceSubClass = 1, - .bInterfaceProtocol = 0, - .driver_info = (kernel_ulong_t)&uvc_ctrl_power_line_limited }, -+ /* Chicony Electronics Co., Ltd Integrated Camera */ -+ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE -+ | USB_DEVICE_ID_MATCH_INT_INFO, -+ .idVendor = 0x04f2, -+ .idProduct = 0xb67c, -+ .bInterfaceClass = USB_CLASS_VIDEO, -+ .bInterfaceSubClass = 1, -+ .bInterfaceProtocol = UVC_PC_PROTOCOL_15, -+ .driver_info = (kernel_ulong_t)&uvc_ctrl_power_line_uvc11 }, - /* Chicony EasyCamera */ - { .match_flags = USB_DEVICE_ID_MATCH_DEVICE - | USB_DEVICE_ID_MATCH_INT_INFO, --- -2.43.2 - -From b8b7a0e09ac678a24cc29c76dba581b710c5692c Mon Sep 17 00:00:00 2001 -From: Ricardo Ribalda <ribalda@chromium.org> -Date: Sat, 28 Oct 2023 09:55:04 +0200 -Subject: [PATCH 1204/1501] media: uvcvideo: Fix power line control for - SunplusIT camera -Content-Length: 2025 -Lines: 56 - -[ Upstream commit 6180056b0e0c097dad5d1569dcd661eaf509ea43 ] - -The device does not implement the power line frequency control -correctly. It is a UVC 1.5 device, but implements the control as a UVC -1.1 device. - -Add the corresponding control mapping override. - -Bus 003 Device 002: ID 2b7e:b752 SunplusIT Inc HD Camera -Device Descriptor: - bLength 18 - bDescriptorType 1 - bcdUSB 2.01 - bDeviceClass 239 Miscellaneous Device - bDeviceSubClass 2 - bDeviceProtocol 1 Interface Association - bMaxPacketSize0 64 - idVendor 0x2b7e - idProduct 0xb752 - bcdDevice 0.04 - iManufacturer 1 SunplusIT Inc - iProduct 2 HD Camera - iSerial 3 01.00.00 - bNumConfigurations 1 - -Cc: Yunke Cao <yunkec@chromium.org> -Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> -Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/usb/uvc/uvc_driver.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c -index 4b5ea3501753..bbd90123a4e7 100644 ---- a/drivers/media/usb/uvc/uvc_driver.c -+++ b/drivers/media/usb/uvc/uvc_driver.c -@@ -3003,6 +3003,15 @@ static const struct usb_device_id uvc_ids[] = { - .bInterfaceSubClass = 1, - .bInterfaceProtocol = 0, - .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_FORCE_BPP) }, -+ /* SunplusIT Inc HD Camera */ -+ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE -+ | USB_DEVICE_ID_MATCH_INT_INFO, -+ .idVendor = 0x2b7e, -+ .idProduct = 0xb752, -+ .bInterfaceClass = USB_CLASS_VIDEO, -+ .bInterfaceSubClass = 1, -+ .bInterfaceProtocol = UVC_PC_PROTOCOL_15, -+ .driver_info = (kernel_ulong_t)&uvc_ctrl_power_line_uvc11 }, - /* Lenovo Integrated Camera */ - { .match_flags = USB_DEVICE_ID_MATCH_DEVICE - | USB_DEVICE_ID_MATCH_INT_INFO, --- -2.43.2 - -From c58cf93e879d0dd0021909e72e0ba6378aa87ab7 Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Thu, 7 Dec 2023 08:57:45 +0100 -Subject: [PATCH 1205/1501] media: rkisp1: Drop IRQF_SHARED -Content-Length: 1577 -Lines: 36 - -[ Upstream commit 85d2a31fe4d9be1555f621ead7a520d8791e0f74 ] - -In all known platforms the ISP has dedicated IRQ lines, but for some -reason the driver uses IRQF_SHARED. - -Supporting IRQF_SHARED properly requires handling interrupts even when -our device is disabled, and the driver does not handle this. To avoid -adding such code, and to be sure the driver won't accidentally be used -in a platform with shared interrupts, let's drop the IRQF_SHARED flag. - -Link: https://lore.kernel.org/r/20231207-rkisp-irq-fix-v3-1-358a2c871a3c@ideasonboard.com - -Tested-by: Adam Ford <aford173@gmail.com> #imx8mp-beacon -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c -index 894d5afaff4e..b676db9bff62 100644 ---- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c -+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c -@@ -542,7 +542,7 @@ static int rkisp1_probe(struct platform_device *pdev) - if (irq < 0) - return irq; - -- ret = devm_request_irq(dev, irq, info->isrs[i].isr, IRQF_SHARED, -+ ret = devm_request_irq(dev, irq, info->isrs[i].isr, 0, - dev_driver_string(dev), dev); - if (ret) { - dev_err(dev, "request irq failed: %d\n", ret); --- -2.43.2 - -From e970de041399ba3dc1a44c840eee44f45aa681d7 Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Thu, 7 Dec 2023 08:57:46 +0100 -Subject: [PATCH 1206/1501] media: rkisp1: Fix IRQ handler return values -Content-Length: 1921 -Lines: 56 - -[ Upstream commit 3eb7910e1b16a2c136be26a8380f21469225b2f6 ] - -The IRQ handler rkisp1_isr() calls sub-handlers, all of which returns an -irqreturn_t value, but rkisp1_isr() ignores those values and always -returns IRQ_HANDLED. - -Fix this by collecting the return values, and returning IRQ_HANDLED or -IRQ_NONE as appropriate. - -Link: https://lore.kernel.org/r/20231207-rkisp-irq-fix-v3-2-358a2c871a3c@ideasonboard.com - -Tested-by: Adam Ford <aford173@gmail.com> #imx8mp-beacon -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../media/platform/rockchip/rkisp1/rkisp1-dev.c | 16 ++++++++++++---- - 1 file changed, 12 insertions(+), 4 deletions(-) - -diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c -index b676db9bff62..7b8a361d4c4a 100644 ---- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c -+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c -@@ -442,17 +442,25 @@ static int rkisp1_entities_register(struct rkisp1_device *rkisp1) - - static irqreturn_t rkisp1_isr(int irq, void *ctx) - { -+ irqreturn_t ret = IRQ_NONE; -+ - /* - * Call rkisp1_capture_isr() first to handle the frame that - * potentially completed using the current frame_sequence number before - * it is potentially incremented by rkisp1_isp_isr() in the vertical - * sync. - */ -- rkisp1_capture_isr(irq, ctx); -- rkisp1_isp_isr(irq, ctx); -- rkisp1_csi_isr(irq, ctx); - -- return IRQ_HANDLED; -+ if (rkisp1_capture_isr(irq, ctx) == IRQ_HANDLED) -+ ret = IRQ_HANDLED; -+ -+ if (rkisp1_isp_isr(irq, ctx) == IRQ_HANDLED) -+ ret = IRQ_HANDLED; -+ -+ if (rkisp1_csi_isr(irq, ctx) == IRQ_HANDLED) -+ ret = IRQ_HANDLED; -+ -+ return ret; - } - - static const char * const px30_isp_clks[] = { --- -2.43.2 - -From b53352b73501a3cea827c56b9dd094221f399f30 Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Thu, 7 Dec 2023 08:57:47 +0100 -Subject: [PATCH 1207/1501] media: rkisp1: Store IRQ lines -Content-Length: 4173 -Lines: 118 - -[ Upstream commit 0753874617de883c6d4da903142f334f76a75d70 ] - -Store the IRQ lines used by the driver for easy access. These are needed -in future patches which fix IRQ race issues. - -Link: https://lore.kernel.org/r/20231207-rkisp-irq-fix-v3-3-358a2c871a3c@ideasonboard.com - -Tested-by: Adam Ford <aford173@gmail.com> #imx8mp-beacon -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../platform/rockchip/rkisp1/rkisp1-common.h | 11 ++++++++++- - .../media/platform/rockchip/rkisp1/rkisp1-dev.c | 17 +++++++++++++---- - 2 files changed, 23 insertions(+), 5 deletions(-) - -diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h -index 1e7cea1bea5e..2d7f06281c39 100644 ---- a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h -+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h -@@ -61,6 +61,14 @@ struct dentry; - RKISP1_CIF_ISP_EXP_END | \ - RKISP1_CIF_ISP_HIST_MEASURE_RDY) - -+/* IRQ lines */ -+enum rkisp1_irq_line { -+ RKISP1_IRQ_ISP = 0, -+ RKISP1_IRQ_MI, -+ RKISP1_IRQ_MIPI, -+ RKISP1_NUM_IRQS, -+}; -+ - /* enum for the resizer pads */ - enum rkisp1_rsz_pad { - RKISP1_RSZ_PAD_SINK, -@@ -423,7 +431,6 @@ struct rkisp1_debug { - * struct rkisp1_device - ISP platform device - * - * @base_addr: base register address -- * @irq: the irq number - * @dev: a pointer to the struct device - * @clk_size: number of clocks - * @clks: array of clocks -@@ -441,6 +448,7 @@ struct rkisp1_debug { - * @stream_lock: serializes {start/stop}_streaming callbacks between the capture devices. - * @debug: debug params to be exposed on debugfs - * @info: version-specific ISP information -+ * @irqs: IRQ line numbers - */ - struct rkisp1_device { - void __iomem *base_addr; -@@ -461,6 +469,7 @@ struct rkisp1_device { - struct mutex stream_lock; /* serialize {start/stop}_streaming cb between capture devices */ - struct rkisp1_debug debug; - const struct rkisp1_info *info; -+ int irqs[RKISP1_NUM_IRQS]; - }; - - /* -diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c -index 7b8a361d4c4a..f96f821a7b50 100644 ---- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c -+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c -@@ -114,6 +114,7 @@ - struct rkisp1_isr_data { - const char *name; - irqreturn_t (*isr)(int irq, void *ctx); -+ u32 line_mask; - }; - - /* ---------------------------------------------------------------------------- -@@ -471,9 +472,9 @@ static const char * const px30_isp_clks[] = { - }; - - static const struct rkisp1_isr_data px30_isp_isrs[] = { -- { "isp", rkisp1_isp_isr }, -- { "mi", rkisp1_capture_isr }, -- { "mipi", rkisp1_csi_isr }, -+ { "isp", rkisp1_isp_isr, BIT(RKISP1_IRQ_ISP) }, -+ { "mi", rkisp1_capture_isr, BIT(RKISP1_IRQ_MI) }, -+ { "mipi", rkisp1_csi_isr, BIT(RKISP1_IRQ_MIPI) }, - }; - - static const struct rkisp1_info px30_isp_info = { -@@ -492,7 +493,7 @@ static const char * const rk3399_isp_clks[] = { - }; - - static const struct rkisp1_isr_data rk3399_isp_isrs[] = { -- { NULL, rkisp1_isr }, -+ { NULL, rkisp1_isr, BIT(RKISP1_IRQ_ISP) | BIT(RKISP1_IRQ_MI) | BIT(RKISP1_IRQ_MIPI) }, - }; - - static const struct rkisp1_info rk3399_isp_info = { -@@ -543,6 +544,9 @@ static int rkisp1_probe(struct platform_device *pdev) - if (IS_ERR(rkisp1->base_addr)) - return PTR_ERR(rkisp1->base_addr); - -+ for (unsigned int il = 0; il < ARRAY_SIZE(rkisp1->irqs); ++il) -+ rkisp1->irqs[il] = -1; -+ - for (i = 0; i < info->isr_size; i++) { - irq = info->isrs[i].name - ? platform_get_irq_byname(pdev, info->isrs[i].name) -@@ -550,6 +554,11 @@ static int rkisp1_probe(struct platform_device *pdev) - if (irq < 0) - return irq; - -+ for (unsigned int il = 0; il < ARRAY_SIZE(rkisp1->irqs); ++il) { -+ if (info->isrs[i].line_mask & BIT(il)) -+ rkisp1->irqs[il] = irq; -+ } -+ - ret = devm_request_irq(dev, irq, info->isrs[i].isr, 0, - dev_driver_string(dev), dev); - if (ret) { --- -2.43.2 - -From 7bb1a2822aa2c2de4e09bf7c56dd93bd532f1fa7 Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Date: Thu, 7 Dec 2023 08:57:48 +0100 -Subject: [PATCH 1208/1501] media: rkisp1: Fix IRQ disable race issue -Content-Length: 3724 -Lines: 91 - -[ Upstream commit 870565f063a58576e8a4529f122cac4325c6b395 ] - -In rkisp1_isp_stop() and rkisp1_csi_disable() the driver masks the -interrupts and then apparently assumes that the interrupt handler won't -be running, and proceeds in the stop procedure. This is not the case, as -the interrupt handler can already be running, which would lead to the -ISP being disabled while the interrupt handler handling a captured -frame. - -This brings up two issues: 1) the ISP could be powered off while the -interrupt handler is still running and accessing registers, leading to -board lockup, and 2) the interrupt handler code and the code that -disables the streaming might do things that conflict. - -It is not clear to me if 2) causes a real issue, but 1) can be seen with -a suitable delay (or printk in my case) in the interrupt handler, -leading to board lockup. - -Link: https://lore.kernel.org/r/20231207-rkisp-irq-fix-v3-4-358a2c871a3c@ideasonboard.com - -Tested-by: Adam Ford <aford173@gmail.com> #imx8mp-beacon -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../platform/rockchip/rkisp1/rkisp1-csi.c | 14 ++++++++++++- - .../platform/rockchip/rkisp1/rkisp1-isp.c | 20 ++++++++++++++++--- - 2 files changed, 30 insertions(+), 4 deletions(-) - -diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c -index 6e17b2817e61..702adee83322 100644 ---- a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c -+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c -@@ -125,8 +125,20 @@ static void rkisp1_csi_disable(struct rkisp1_csi *csi) - struct rkisp1_device *rkisp1 = csi->rkisp1; - u32 val; - -- /* Mask and clear interrupts. */ -+ /* Mask MIPI interrupts. */ - rkisp1_write(rkisp1, RKISP1_CIF_MIPI_IMSC, 0); -+ -+ /* Flush posted writes */ -+ rkisp1_read(rkisp1, RKISP1_CIF_MIPI_IMSC); -+ -+ /* -+ * Wait until the IRQ handler has ended. The IRQ handler may get called -+ * even after this, but it will return immediately as the MIPI -+ * interrupts have been masked. -+ */ -+ synchronize_irq(rkisp1->irqs[RKISP1_IRQ_MIPI]); -+ -+ /* Clear MIPI interrupt status */ - rkisp1_write(rkisp1, RKISP1_CIF_MIPI_ICR, ~0); - - val = rkisp1_read(rkisp1, RKISP1_CIF_MIPI_CTRL); -diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c -index 45d1ab96fc6e..5fbc47bda683 100644 ---- a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c -+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c -@@ -254,11 +254,25 @@ static void rkisp1_isp_stop(struct rkisp1_isp *isp) - * ISP(mi) stop in mi frame end -> Stop ISP(mipi) -> - * Stop ISP(isp) ->wait for ISP isp off - */ -- /* stop and clear MI and ISP interrupts */ -- rkisp1_write(rkisp1, RKISP1_CIF_ISP_IMSC, 0); -- rkisp1_write(rkisp1, RKISP1_CIF_ISP_ICR, ~0); - -+ /* Mask MI and ISP interrupts */ -+ rkisp1_write(rkisp1, RKISP1_CIF_ISP_IMSC, 0); - rkisp1_write(rkisp1, RKISP1_CIF_MI_IMSC, 0); -+ -+ /* Flush posted writes */ -+ rkisp1_read(rkisp1, RKISP1_CIF_MI_IMSC); -+ -+ /* -+ * Wait until the IRQ handler has ended. The IRQ handler may get called -+ * even after this, but it will return immediately as the MI and ISP -+ * interrupts have been masked. -+ */ -+ synchronize_irq(rkisp1->irqs[RKISP1_IRQ_ISP]); -+ if (rkisp1->irqs[RKISP1_IRQ_ISP] != rkisp1->irqs[RKISP1_IRQ_MI]) -+ synchronize_irq(rkisp1->irqs[RKISP1_IRQ_MI]); -+ -+ /* Clear MI and ISP interrupt status */ -+ rkisp1_write(rkisp1, RKISP1_CIF_ISP_ICR, ~0); - rkisp1_write(rkisp1, RKISP1_CIF_MI_ICR, ~0); - - /* stop ISP */ --- -2.43.2 - -From 6b24d0d8d16850d59170b8848592956a7d9bdd9a Mon Sep 17 00:00:00 2001 -From: Laurent Pinchart <laurent.pinchart@ideasonboard.com> -Date: Sun, 26 Nov 2023 03:09:48 +0100 -Subject: [PATCH 1209/1501] media: rkisp1: resizer: Stop manual allocation of - v4l2_subdev_state -Content-Length: 3051 -Lines: 91 - -[ Upstream commit efa28efd9cba015f8c3d88123527c3c3cfcd13d0 ] - -Supported media bus codes on the resizer sink pad are identical to the -ISP source pad. The .enum_mbus_code() handler thus delegates the -enumeration to the ISP's operation. This is problematic for two -reasons: - -- Format enumeration on the ISP source pad is dependent on the format - configured on the ISP sink pad for the same subdev state (TRY or - ACTIVE), while format enumeration on the resizer sink pad should - return all formats supported by the resizer subdev, regardless of the - ISP configuration. - -- Delegating the operation involves creating a fake v4l2_subdev_state on - the stack to pass to the ISP .enum_mbus_code() handler. This gets in - the way of evolution of both the ISP enumeration handler and, more - generally, the V4L2 subdev state infrastructure. - -Fix those two issues by implementing format enumeration manually for the -resizer. - -Link: https://lore.kernel.org/r/20231126020948.2700-1-laurent.pinchart@ideasonboard.com - -Reviewed-by: Paul Elder <paul.elder@ideasonboard.com> -Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> -Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> -Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../platform/rockchip/rkisp1/rkisp1-resizer.c | 38 ++++++++++++------- - 1 file changed, 24 insertions(+), 14 deletions(-) - -diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-resizer.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-resizer.c -index 28ecc7347d54..6297870ee9e9 100644 ---- a/drivers/media/platform/rockchip/rkisp1/rkisp1-resizer.c -+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-resizer.c -@@ -335,12 +335,8 @@ static int rkisp1_rsz_enum_mbus_code(struct v4l2_subdev *sd, - { - struct rkisp1_resizer *rsz = - container_of(sd, struct rkisp1_resizer, sd); -- struct v4l2_subdev_pad_config dummy_cfg; -- struct v4l2_subdev_state pad_state = { -- .pads = &dummy_cfg -- }; -- u32 pad = code->pad; -- int ret; -+ unsigned int index = code->index; -+ unsigned int i; - - if (code->pad == RKISP1_RSZ_PAD_SRC) { - /* supported mbus codes on the src are the same as in the capture */ -@@ -360,15 +356,29 @@ static int rkisp1_rsz_enum_mbus_code(struct v4l2_subdev *sd, - return 0; - } - -- /* supported mbus codes on the sink pad are the same as isp src pad */ -- code->pad = RKISP1_ISP_PAD_SOURCE_VIDEO; -- ret = v4l2_subdev_call(&rsz->rkisp1->isp.sd, pad, enum_mbus_code, -- &pad_state, code); -+ /* -+ * Supported mbus codes on the sink pad are the same as on the ISP -+ * source pad. -+ */ -+ for (i = 0; ; i++) { -+ const struct rkisp1_mbus_info *fmt = -+ rkisp1_mbus_info_get_by_index(i); - -- /* restore pad */ -- code->pad = pad; -- code->flags = 0; -- return ret; -+ if (!fmt) -+ break; -+ -+ if (!(fmt->direction & RKISP1_ISP_SD_SRC)) -+ continue; -+ -+ if (!index) { -+ code->code = fmt->mbus_code; -+ return 0; -+ } -+ -+ index--; -+ } -+ -+ return -EINVAL; - } - - static int rkisp1_rsz_init_config(struct v4l2_subdev *sd, --- -2.43.2 - -From fd9c8c60c7945a85c0ec7aabd92c5af1d67b1a1b Mon Sep 17 00:00:00 2001 -From: Xing Tong Wu <xingtong.wu@siemens.com> -Date: Tue, 21 Nov 2023 16:16:04 +0800 -Subject: [PATCH 1210/1501] hwmon: (nct6775) Fix fan speed set failure in - automatic mode -Content-Length: 1144 -Lines: 34 - -[ Upstream commit 8b3800256abad20e91c2698607f9b28591407b19 ] - -Setting the fan speed is only valid in manual mode; it is not possible -to set the fan's speed in automatic mode. -Return error when attempting to set the fan speed in automatic mode. - -Signed-off-by: Xing Tong Wu <xingtong.wu@siemens.com> -Link: https://lore.kernel.org/r/20231121081604.2499-3-xingtong_wu@163.com -Signed-off-by: Guenter Roeck <linux@roeck-us.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/hwmon/nct6775-core.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c -index d928eb8ae5a3..92a49fafe2c0 100644 ---- a/drivers/hwmon/nct6775-core.c -+++ b/drivers/hwmon/nct6775-core.c -@@ -2553,6 +2553,13 @@ store_pwm(struct device *dev, struct device_attribute *attr, const char *buf, - int err; - u16 reg; - -+ /* -+ * The fan control mode should be set to manual if the user wants to adjust -+ * the fan speed. Otherwise, it will fail to set. -+ */ -+ if (index == 0 && data->pwm_enable[nr] > manual) -+ return -EBUSY; -+ - err = kstrtoul(buf, 10, &val); - if (err < 0) - return err; --- -2.43.2 - -From 30ec53ab595a54f66e4ec09345c5c8698c6b3123 Mon Sep 17 00:00:00 2001 -From: James Seo <james@equiv.tech> -Date: Wed, 22 Nov 2023 21:49:19 -0800 -Subject: [PATCH 1211/1501] hwmon: (hp-wmi-sensors) Fix failure to load on - EliteDesk 800 G6 -Content-Length: 7926 -Lines: 263 - -[ Upstream commit c9ba592580947b81f33f514320aeef02ddc001fd ] - -The EliteDesk 800 G6 stores a raw WMI string within the ACPI object in its -BIOS corresponding to one instance of HPBIOS_PlatformEvents.Name. This is -evidently a valid way of representing a WMI data item as far as the -Microsoft ACPI-WMI mapper is concerned, but is preventing the driver from -loading. - -This seems quite rare, but add support for such strings. Treating this as a -quirk pretty much means adding that support anyway. - -Also clean up an oversight in update_numeric_sensor_from_wobj() in which -the result of hp_wmi_strdup() was being used without error checking. - -Reported-by: Lukasz Stelmach <l.stelmach@samsung.com> -Closes: https://lore.kernel.org/linux-hwmon/7850a0bd-60e7-88f8-1d6c-0bb0e3234fdc@roeck-us.net/ -Tested-by: Lukasz Stelmach <l.stelmach@samsung.com> -Signed-off-by: James Seo <james@equiv.tech> -Link: https://lore.kernel.org/r/20231123054918.157098-1-james@equiv.tech -Signed-off-by: Guenter Roeck <linux@roeck-us.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/hwmon/hp-wmi-sensors.c | 125 +++++++++++++++++++++++++++++---- - 1 file changed, 110 insertions(+), 15 deletions(-) - -diff --git a/drivers/hwmon/hp-wmi-sensors.c b/drivers/hwmon/hp-wmi-sensors.c -index 17ae62f88bbf..b5325d0e72b9 100644 ---- a/drivers/hwmon/hp-wmi-sensors.c -+++ b/drivers/hwmon/hp-wmi-sensors.c -@@ -17,6 +17,8 @@ - * Available: https://github.com/linuxhw/ACPI - * [4] P. Rohár, "bmfdec - Decompile binary MOF file (BMF) from WMI buffer", - * 2017. [Online]. Available: https://github.com/pali/bmfdec -+ * [5] Microsoft Corporation, "Driver-Defined WMI Data Items", 2017. [Online]. -+ * Available: https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/driver-defined-wmi-data-items - */ - - #include <linux/acpi.h> -@@ -24,6 +26,7 @@ - #include <linux/hwmon.h> - #include <linux/jiffies.h> - #include <linux/mutex.h> -+#include <linux/nls.h> - #include <linux/units.h> - #include <linux/wmi.h> - -@@ -395,6 +398,50 @@ struct hp_wmi_sensors { - struct mutex lock; /* Lock polling WMI and driver state changes. */ - }; - -+static bool is_raw_wmi_string(const u8 *pointer, u32 length) -+{ -+ const u16 *ptr; -+ u16 len; -+ -+ /* WMI strings are length-prefixed UTF-16 [5]. */ -+ if (length <= sizeof(*ptr)) -+ return false; -+ -+ length -= sizeof(*ptr); -+ ptr = (const u16 *)pointer; -+ len = *ptr; -+ -+ return len <= length && !(len & 1); -+} -+ -+static char *convert_raw_wmi_string(const u8 *buf) -+{ -+ const wchar_t *src; -+ unsigned int cps; -+ unsigned int len; -+ char *dst; -+ int i; -+ -+ src = (const wchar_t *)buf; -+ -+ /* Count UTF-16 code points. Exclude trailing null padding. */ -+ cps = *src / sizeof(*src); -+ while (cps && !src[cps]) -+ cps--; -+ -+ /* Each code point becomes up to 3 UTF-8 characters. */ -+ len = min(cps * 3, HP_WMI_MAX_STR_SIZE - 1); -+ -+ dst = kmalloc((len + 1) * sizeof(*dst), GFP_KERNEL); -+ if (!dst) -+ return NULL; -+ -+ i = utf16s_to_utf8s(++src, cps, UTF16_LITTLE_ENDIAN, dst, len); -+ dst[i] = '\0'; -+ -+ return dst; -+} -+ - /* hp_wmi_strdup - devm_kstrdup, but length-limited */ - static char *hp_wmi_strdup(struct device *dev, const char *src) - { -@@ -412,6 +459,23 @@ static char *hp_wmi_strdup(struct device *dev, const char *src) - return dst; - } - -+/* hp_wmi_wstrdup - hp_wmi_strdup, but for a raw WMI string */ -+static char *hp_wmi_wstrdup(struct device *dev, const u8 *buf) -+{ -+ char *src; -+ char *dst; -+ -+ src = convert_raw_wmi_string(buf); -+ if (!src) -+ return NULL; -+ -+ dst = hp_wmi_strdup(dev, strim(src)); /* Note: Copy is trimmed. */ -+ -+ kfree(src); -+ -+ return dst; -+} -+ - /* - * hp_wmi_get_wobj - poll WMI for a WMI object instance - * @guid: WMI object GUID -@@ -462,8 +526,14 @@ static int check_wobj(const union acpi_object *wobj, - for (prop = 0; prop <= last_prop; prop++) { - type = elements[prop].type; - valid_type = property_map[prop]; -- if (type != valid_type) -+ if (type != valid_type) { -+ if (type == ACPI_TYPE_BUFFER && -+ valid_type == ACPI_TYPE_STRING && -+ is_raw_wmi_string(elements[prop].buffer.pointer, -+ elements[prop].buffer.length)) -+ continue; - return -EINVAL; -+ } - } - - return 0; -@@ -480,7 +550,9 @@ static int extract_acpi_value(struct device *dev, - break; - - case ACPI_TYPE_STRING: -- *out_string = hp_wmi_strdup(dev, strim(element->string.pointer)); -+ *out_string = element->type == ACPI_TYPE_BUFFER ? -+ hp_wmi_wstrdup(dev, element->buffer.pointer) : -+ hp_wmi_strdup(dev, strim(element->string.pointer)); - if (!*out_string) - return -ENOMEM; - break; -@@ -861,7 +933,9 @@ update_numeric_sensor_from_wobj(struct device *dev, - { - const union acpi_object *elements; - const union acpi_object *element; -- const char *string; -+ const char *new_string; -+ char *trimmed; -+ char *string; - bool is_new; - int offset; - u8 size; -@@ -885,11 +959,21 @@ update_numeric_sensor_from_wobj(struct device *dev, - offset = is_new ? size - 1 : -2; - - element = &elements[HP_WMI_PROPERTY_CURRENT_STATE + offset]; -- string = strim(element->string.pointer); -+ string = element->type == ACPI_TYPE_BUFFER ? -+ convert_raw_wmi_string(element->buffer.pointer) : -+ element->string.pointer; - -- if (strcmp(string, nsensor->current_state)) { -- devm_kfree(dev, nsensor->current_state); -- nsensor->current_state = hp_wmi_strdup(dev, string); -+ if (string) { -+ trimmed = strim(string); -+ if (strcmp(trimmed, nsensor->current_state)) { -+ new_string = hp_wmi_strdup(dev, trimmed); -+ if (new_string) { -+ devm_kfree(dev, nsensor->current_state); -+ nsensor->current_state = new_string; -+ } -+ } -+ if (element->type == ACPI_TYPE_BUFFER) -+ kfree(string); - } - - /* Old variant: -2 (not -1) because it lacks the Size property. */ -@@ -996,11 +1080,15 @@ static int check_event_wobj(const union acpi_object *wobj) - HP_WMI_EVENT_PROPERTY_STATUS); - } - --static int populate_event_from_wobj(struct hp_wmi_event *event, -+static int populate_event_from_wobj(struct device *dev, -+ struct hp_wmi_event *event, - union acpi_object *wobj) - { - int prop = HP_WMI_EVENT_PROPERTY_NAME; - union acpi_object *element; -+ acpi_object_type type; -+ char *string; -+ u32 value; - int err; - - err = check_event_wobj(wobj); -@@ -1009,20 +1097,24 @@ static int populate_event_from_wobj(struct hp_wmi_event *event, - - element = wobj->package.elements; - -- /* Extracted strings are NOT device-managed copies. */ -- - for (; prop <= HP_WMI_EVENT_PROPERTY_CATEGORY; prop++, element++) { -+ type = hp_wmi_event_property_map[prop]; -+ -+ err = extract_acpi_value(dev, element, type, &value, &string); -+ if (err) -+ return err; -+ - switch (prop) { - case HP_WMI_EVENT_PROPERTY_NAME: -- event->name = strim(element->string.pointer); -+ event->name = string; - break; - - case HP_WMI_EVENT_PROPERTY_DESCRIPTION: -- event->description = strim(element->string.pointer); -+ event->description = string; - break; - - case HP_WMI_EVENT_PROPERTY_CATEGORY: -- event->category = element->integer.value; -+ event->category = value; - break; - - default: -@@ -1511,8 +1603,8 @@ static void hp_wmi_notify(u32 value, void *context) - struct acpi_buffer out = { ACPI_ALLOCATE_BUFFER, NULL }; - struct hp_wmi_sensors *state = context; - struct device *dev = &state->wdev->dev; -+ struct hp_wmi_event event = {}; - struct hp_wmi_info *fan_info; -- struct hp_wmi_event event; - union acpi_object *wobj; - acpi_status err; - int event_type; -@@ -1546,7 +1638,7 @@ static void hp_wmi_notify(u32 value, void *context) - - wobj = out.pointer; - -- err = populate_event_from_wobj(&event, wobj); -+ err = populate_event_from_wobj(dev, &event, wobj); - if (err) { - dev_warn(dev, "Bad event data (ACPI type %d)\n", wobj->type); - goto out_free_wobj; -@@ -1577,6 +1669,9 @@ static void hp_wmi_notify(u32 value, void *context) - out_free_wobj: - kfree(wobj); - -+ devm_kfree(dev, event.name); -+ devm_kfree(dev, event.description); -+ - out_unlock: - mutex_unlock(&state->lock); - } --- -2.43.2 - -From b8094c0f1aae329b1c60a275a780d6c2c9ff7aa3 Mon Sep 17 00:00:00 2001 -From: Chao Yu <chao@kernel.org> -Date: Sun, 10 Dec 2023 19:35:42 +0800 -Subject: [PATCH 1212/1501] f2fs: fix to tag gcing flag on page during block - migration -Content-Length: 1784 -Lines: 56 - -[ Upstream commit 4961acdd65c956e97c1a000c82d91a8c1cdbe44b ] - -It needs to add missing gcing flag on page during block migration, -in order to garantee migrated data be persisted during checkpoint, -otherwise out-of-order persistency between data and node may cause -data corruption after SPOR. - -Similar issue was fixed by commit 2d1fe8a86bf5 ("f2fs: fix to tag -gcing flag on page during file defragment"). - -Signed-off-by: Chao Yu <chao@kernel.org> -Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/f2fs/compress.c | 4 +++- - fs/f2fs/file.c | 2 ++ - 2 files changed, 5 insertions(+), 1 deletion(-) - -diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c -index 36e5dab6baae..62119f3f7206 100644 ---- a/fs/f2fs/compress.c -+++ b/fs/f2fs/compress.c -@@ -1036,8 +1036,10 @@ static void set_cluster_dirty(struct compress_ctx *cc) - int i; - - for (i = 0; i < cc->cluster_size; i++) -- if (cc->rpages[i]) -+ if (cc->rpages[i]) { - set_page_dirty(cc->rpages[i]); -+ set_page_private_gcing(cc->rpages[i]); -+ } - } - - static int prepare_compress_overwrite(struct compress_ctx *cc, -diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c -index 8912511980ae..a05781e708d6 100644 ---- a/fs/f2fs/file.c -+++ b/fs/f2fs/file.c -@@ -1317,6 +1317,7 @@ static int __clone_blkaddrs(struct inode *src_inode, struct inode *dst_inode, - } - memcpy_page(pdst, 0, psrc, 0, PAGE_SIZE); - set_page_dirty(pdst); -+ set_page_private_gcing(pdst); - f2fs_put_page(pdst, 1); - f2fs_put_page(psrc, 1); - -@@ -4059,6 +4060,7 @@ static int redirty_blocks(struct inode *inode, pgoff_t page_idx, int len) - f2fs_bug_on(F2FS_I_SB(inode), !page); - - set_page_dirty(page); -+ set_page_private_gcing(page); - f2fs_put_page(page, 1); - f2fs_put_page(page, 0); - } --- -2.43.2 - -From c53dd64daa697e58b885e2810c111b5a76809893 Mon Sep 17 00:00:00 2001 -From: Douglas Anderson <dianders@chromium.org> -Date: Thu, 21 Sep 2023 12:26:52 -0700 -Subject: [PATCH 1213/1501] drm/exynos: Call drm_atomic_helper_shutdown() at - shutdown/unbind time -Content-Length: 2942 -Lines: 78 - -[ Upstream commit 16ac5b21b31b439f03cdf44c153c5f5af94fb3eb ] - -Based on grepping through the source code this driver appears to be -missing a call to drm_atomic_helper_shutdown() at system shutdown time -and at driver unbind time. Among other things, this means that if a -panel is in use that it won't be cleanly powered off at system -shutdown time. - -The fact that we should call drm_atomic_helper_shutdown() in the case -of OS shutdown/restart and at driver remove (or unbind) time comes -straight out of the kernel doc "driver instance overview" in -drm_drv.c. - -A few notes about this fix: -- When adding drm_atomic_helper_shutdown() to the unbind path, I added - it after drm_kms_helper_poll_fini() since that's when other drivers - seemed to have it. -- Technically with a previous patch, ("drm/atomic-helper: - drm_atomic_helper_shutdown(NULL) should be a noop"), we don't - actually need to check to see if our "drm" pointer is NULL before - calling drm_atomic_helper_shutdown(). We'll leave the "if" test in, - though, so that this patch can land without any dependencies. It - could potentially be removed later. -- This patch also makes sure to set the drvdata to NULL in the case of - bind errors to make sure that shutdown can't access freed data. - -Suggested-by: Maxime Ripard <mripard@kernel.org> -Reviewed-by: Maxime Ripard <mripard@kernel.org> -Signed-off-by: Douglas Anderson <dianders@chromium.org> -Tested-by: Marek Szyprowski <m.szyprowski@samsung.com> -Reviewed-by: Marek Szyprowski <m.szyprowski@samsung.com> -Signed-off-by: Inki Dae <inki.dae@samsung.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/exynos/exynos_drm_drv.c | 11 +++++++++++ - 1 file changed, 11 insertions(+) - -diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c -index 8399256cb5c9..5380fb6c55ae 100644 ---- a/drivers/gpu/drm/exynos/exynos_drm_drv.c -+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c -@@ -300,6 +300,7 @@ static int exynos_drm_bind(struct device *dev) - drm_mode_config_cleanup(drm); - exynos_drm_cleanup_dma(drm); - kfree(private); -+ dev_set_drvdata(dev, NULL); - err_free_drm: - drm_dev_put(drm); - -@@ -313,6 +314,7 @@ static void exynos_drm_unbind(struct device *dev) - drm_dev_unregister(drm); - - drm_kms_helper_poll_fini(drm); -+ drm_atomic_helper_shutdown(drm); - - component_unbind_all(drm->dev, drm); - drm_mode_config_cleanup(drm); -@@ -350,9 +352,18 @@ static int exynos_drm_platform_remove(struct platform_device *pdev) - return 0; - } - -+static void exynos_drm_platform_shutdown(struct platform_device *pdev) -+{ -+ struct drm_device *drm = platform_get_drvdata(pdev); -+ -+ if (drm) -+ drm_atomic_helper_shutdown(drm); -+} -+ - static struct platform_driver exynos_drm_platform_driver = { - .probe = exynos_drm_platform_probe, - .remove = exynos_drm_platform_remove, -+ .shutdown = exynos_drm_platform_shutdown, - .driver = { - .name = "exynos-drm", - .pm = &exynos_drm_pm_ops, --- -2.43.2 - -From 7c7bd4d561e9dc6f5b7df9e184974915f6701a89 Mon Sep 17 00:00:00 2001 -From: Daniel Vacek <neelx@redhat.com> -Date: Tue, 12 Dec 2023 09:07:45 +0100 -Subject: [PATCH 1214/1501] IB/ipoib: Fix mcast list locking -Content-Length: 4277 -Lines: 86 - -[ Upstream commit 4f973e211b3b1c6d36f7c6a19239d258856749f9 ] - -Releasing the `priv->lock` while iterating the `priv->multicast_list` in -`ipoib_mcast_join_task()` opens a window for `ipoib_mcast_dev_flush()` to -remove the items while in the middle of iteration. If the mcast is removed -while the lock was dropped, the for loop spins forever resulting in a hard -lockup (as was reported on RHEL 4.18.0-372.75.1.el8_6 kernel): - - Task A (kworker/u72:2 below) | Task B (kworker/u72:0 below) - -----------------------------------+----------------------------------- - ipoib_mcast_join_task(work) | ipoib_ib_dev_flush_light(work) - spin_lock_irq(&priv->lock) | __ipoib_ib_dev_flush(priv, ...) - list_for_each_entry(mcast, | ipoib_mcast_dev_flush(dev = priv->dev) - &priv->multicast_list, list) | - ipoib_mcast_join(dev, mcast) | - spin_unlock_irq(&priv->lock) | - | spin_lock_irqsave(&priv->lock, flags) - | list_for_each_entry_safe(mcast, tmcast, - | &priv->multicast_list, list) - | list_del(&mcast->list); - | list_add_tail(&mcast->list, &remove_list) - | spin_unlock_irqrestore(&priv->lock, flags) - spin_lock_irq(&priv->lock) | - | ipoib_mcast_remove_list(&remove_list) - (Here, `mcast` is no longer on the | list_for_each_entry_safe(mcast, tmcast, - `priv->multicast_list` and we keep | remove_list, list) - spinning on the `remove_list` of | >>> wait_for_completion(&mcast->done) - the other thread which is blocked | - and the list is still valid on | - it's stack.) - -Fix this by keeping the lock held and changing to GFP_ATOMIC to prevent -eventual sleeps. -Unfortunately we could not reproduce the lockup and confirm this fix but -based on the code review I think this fix should address such lockups. - -crash> bc 31 -PID: 747 TASK: ff1c6a1a007e8000 CPU: 31 COMMAND: "kworker/u72:2" --- - [exception RIP: ipoib_mcast_join_task+0x1b1] - RIP: ffffffffc0944ac1 RSP: ff646f199a8c7e00 RFLAGS: 00000002 - RAX: 0000000000000000 RBX: ff1c6a1a04dc82f8 RCX: 0000000000000000 - work (&priv->mcast_task{,.work}) - RDX: ff1c6a192d60ac68 RSI: 0000000000000286 RDI: ff1c6a1a04dc8000 - &mcast->list - RBP: ff646f199a8c7e90 R8: ff1c699980019420 R9: ff1c6a1920c9a000 - R10: ff646f199a8c7e00 R11: ff1c6a191a7d9800 R12: ff1c6a192d60ac00 - mcast - R13: ff1c6a1d82200000 R14: ff1c6a1a04dc8000 R15: ff1c6a1a04dc82d8 - dev priv (&priv->lock) &priv->multicast_list (aka head) - ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 - -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 6 +----- - 1 file changed, 1 insertion(+), 5 deletions(-) - -diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c -index 9e6967a40042..319d4288eddd 100644 ---- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c -+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c -@@ -531,21 +531,17 @@ static int ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast) - if (test_bit(IPOIB_MCAST_FLAG_SENDONLY, &mcast->flags)) - rec.join_state = SENDONLY_FULLMEMBER_JOIN; - } -- spin_unlock_irq(&priv->lock); - - multicast = ib_sa_join_multicast(&ipoib_sa_client, priv->ca, priv->port, -- &rec, comp_mask, GFP_KERNEL, -+ &rec, comp_mask, GFP_ATOMIC, - ipoib_mcast_join_complete, mcast); -- spin_lock_irq(&priv->lock); - if (IS_ERR(multicast)) { - ret = PTR_ERR(multicast); - ipoib_warn(priv, "ib_sa_join_multicast failed, status %d\n", ret); - /* Requeue this join task with a backoff delay */ - __ipoib_mcast_schedule_join_thread(priv, mcast, 1); - clear_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags); -- spin_unlock_irq(&priv->lock); - complete(&mcast->done); -- spin_lock_irq(&priv->lock); - return ret; - } - return 0; --- -2.43.2 - -From 2398e29ad47294a5ccca5dab0f82ddfeed4d7a72 Mon Sep 17 00:00:00 2001 -From: Ming Qian <ming.qian@nxp.com> -Date: Fri, 8 Dec 2023 15:33:42 +0800 -Subject: [PATCH 1215/1501] media: amphion: remove mutext lock in condition of - wait_event -Content-Length: 5275 -Lines: 152 - -[ Upstream commit f9c8ddce2fe3b767582f299d03fc8fb85943568c ] - -mutext_lock should not be called in condition of wait_event, otherwise, -when CONFIG_DEBUG_ATOMIC_SLEEP is enabled, we may meet the following -warning: -do not call blocking ops when !TASK_RUNNING; state=2 -WARNING: CPU: 5 PID: 741 at kernel/sched/core.c:9859 -__might_sleep+0x80/0xa4 -Hardware name: Freescale i.MX8QM MEK (DT) -pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : -__might_sleep+0x80/0xa4 lr : __might_sleep+0x80/0xa4 sp : ffffffc0123738a0 -x29: ffffffc0123738a0 x28: ffffffc009194c48 x27: ffffffc00bbc1050 -x26: ffffff8814b282f0 x25: ffffff8814b280d0 x24: ffffff8814b28080 -x23: 0000000000000001 x22: 0000000000000032 x21: ffffffc00bbc1000 -x20: 000000000000011b x19: ffffffc009324670 x18: 00000000fffffffd -x17: 30303c5b20746120 x16: 74657320323d6574 x15: 617473203b474e49 -x14: 00058b5b8b9aa1f1 x13: ffffffc00903cda0 x12: 00000000d744fcc9 -x11: 000000000000001c x10: 00000000000009a0 x9 : ffffffc0090201f4 -x8 : ffffff8828245000 x7 : 0000000000000001 x6 : 0000000000000001 -x5 : 00000000410fd080 x4 : 0000000000000002 x3 : ffffff8815aab4c8 -x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffff8828244600 -Call trace: - __might_sleep+0x80/0xa4 - mutex_lock+0x2c/0x80 - sync_session_response+0x110/0x310 - vpu_session_send_cmd+0x18c/0x244 - vpu_session_start+0x38/0x70 - vdec_start_session+0x1b4/0x3e0 - vpu_vb2_start_streaming+0xa0/0x1c4 - vb2_start_streaming+0x74/0x160 - vb2_core_qbuf+0x488/0x650 - vb2_qbuf+0x9c/0x100 - v4l2_m2m_qbuf+0x7c/0x224 - v4l2_m2m_ioctl_qbuf+0x20/0x2c - v4l_qbuf+0x50/0x6c - __video_do_ioctl+0x174/0x3f0 - video_usercopy+0x210/0x7cc - video_ioctl2+0x20/0x30 - v4l2_ioctl+0x48/0x6c - -we need to refine check_is_responsed() to remove the mutext_lock, each -cmd has a monotonically increasing id, and cmds are executed -sequentially, so we can check the id of the last reponsed cmd, then -determine whether a command has been responded or not. - -Signed-off-by: Ming Qian <ming.qian@nxp.com> -CC: Xiaolei Wang <xiaolei.wang@windriver.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/platform/amphion/vpu.h | 3 ++- - drivers/media/platform/amphion/vpu_cmds.c | 28 ++++++++--------------- - drivers/media/platform/amphion/vpu_v4l2.c | 1 + - 3 files changed, 12 insertions(+), 20 deletions(-) - -diff --git a/drivers/media/platform/amphion/vpu.h b/drivers/media/platform/amphion/vpu.h -index 5a701f64289e..0246cf0ac3a8 100644 ---- a/drivers/media/platform/amphion/vpu.h -+++ b/drivers/media/platform/amphion/vpu.h -@@ -154,7 +154,6 @@ struct vpu_core { - struct vpu_mbox tx_type; - struct vpu_mbox tx_data; - struct vpu_mbox rx; -- unsigned long cmd_seq; - - wait_queue_head_t ack_wq; - struct completion cmp; -@@ -253,6 +252,8 @@ struct vpu_inst { - - struct list_head cmd_q; - void *pending; -+ unsigned long cmd_seq; -+ atomic_long_t last_response_cmd; - - struct vpu_inst_ops *ops; - const struct vpu_format *formats; -diff --git a/drivers/media/platform/amphion/vpu_cmds.c b/drivers/media/platform/amphion/vpu_cmds.c -index c2337812573e..5695f5c1cb3e 100644 ---- a/drivers/media/platform/amphion/vpu_cmds.c -+++ b/drivers/media/platform/amphion/vpu_cmds.c -@@ -32,6 +32,7 @@ struct vpu_cmd_t { - struct vpu_cmd_request *request; - struct vpu_rpc_event *pkt; - unsigned long key; -+ atomic_long_t *last_response_cmd; - }; - - static struct vpu_cmd_request vpu_cmd_requests[] = { -@@ -115,6 +116,8 @@ static void vpu_free_cmd(struct vpu_cmd_t *cmd) - { - if (!cmd) - return; -+ if (cmd->last_response_cmd) -+ atomic_long_set(cmd->last_response_cmd, cmd->key); - vfree(cmd->pkt); - vfree(cmd); - } -@@ -172,7 +175,8 @@ static int vpu_request_cmd(struct vpu_inst *inst, u32 id, void *data, - return -ENOMEM; - - mutex_lock(&core->cmd_lock); -- cmd->key = core->cmd_seq++; -+ cmd->key = ++inst->cmd_seq; -+ cmd->last_response_cmd = &inst->last_response_cmd; - if (key) - *key = cmd->key; - if (sync) -@@ -246,26 +250,12 @@ void vpu_clear_request(struct vpu_inst *inst) - - static bool check_is_responsed(struct vpu_inst *inst, unsigned long key) - { -- struct vpu_core *core = inst->core; -- struct vpu_cmd_t *cmd; -- bool flag = true; -+ unsigned long last_response = atomic_long_read(&inst->last_response_cmd); - -- mutex_lock(&core->cmd_lock); -- cmd = inst->pending; -- if (cmd && key == cmd->key) { -- flag = false; -- goto exit; -- } -- list_for_each_entry(cmd, &inst->cmd_q, list) { -- if (key == cmd->key) { -- flag = false; -- break; -- } -- } --exit: -- mutex_unlock(&core->cmd_lock); -+ if (key <= last_response && (last_response - key) < (ULONG_MAX >> 1)) -+ return true; - -- return flag; -+ return false; - } - - static int sync_session_response(struct vpu_inst *inst, unsigned long key, long timeout, int try) -diff --git a/drivers/media/platform/amphion/vpu_v4l2.c b/drivers/media/platform/amphion/vpu_v4l2.c -index 0f6e4c666440..d7e0de49b3dc 100644 ---- a/drivers/media/platform/amphion/vpu_v4l2.c -+++ b/drivers/media/platform/amphion/vpu_v4l2.c -@@ -716,6 +716,7 @@ int vpu_v4l2_open(struct file *file, struct vpu_inst *inst) - func = &vpu->decoder; - - atomic_set(&inst->ref_count, 0); -+ atomic_long_set(&inst->last_response_cmd, 0); - vpu_inst_get(inst); - inst->vpu = vpu; - inst->core = vpu_request_core(vpu, inst->type); --- -2.43.2 - -From 39a2ed12a6c9f9e8ea2c39c743e760d96e4e9b8c Mon Sep 17 00:00:00 2001 -From: Su Hui <suhui@nfschina.com> -Date: Fri, 20 Oct 2023 17:17:23 +0800 -Subject: [PATCH 1216/1501] media: ddbridge: fix an error code problem in - ddb_probe -Content-Length: 880 -Lines: 26 - -[ Upstream commit 09b4195021be69af1e1936cca995712a6d0f2562 ] - -Error code is assigned to 'stat', return 'stat' rather than '-1'. - -Signed-off-by: Su Hui <suhui@nfschina.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/pci/ddbridge/ddbridge-main.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/media/pci/ddbridge/ddbridge-main.c b/drivers/media/pci/ddbridge/ddbridge-main.c -index 91733ab9f58c..363badab7cf0 100644 ---- a/drivers/media/pci/ddbridge/ddbridge-main.c -+++ b/drivers/media/pci/ddbridge/ddbridge-main.c -@@ -238,7 +238,7 @@ static int ddb_probe(struct pci_dev *pdev, - ddb_unmap(dev); - pci_set_drvdata(pdev, NULL); - pci_disable_device(pdev); -- return -1; -+ return stat; - } - - /****************************************************************************/ --- -2.43.2 - -From c5883a8a3676b94fe7cefde97c8eec50bb879eb2 Mon Sep 17 00:00:00 2001 -From: Hans de Goede <hdegoede@redhat.com> -Date: Mon, 4 Dec 2023 13:39:42 +0100 -Subject: [PATCH 1217/1501] media: ov2740: Fix hts value -Content-Length: 2337 -Lines: 69 - -[ Upstream commit 3735228bbe3511f844e03dfcc4003fadb59dde23 ] - -HTS must be more then width, so the 1080 value clearly is wrong, -this is then corrected with some weird math dividing clocks in -to_pixels_per_line() which results in the hts getting multiplied by 2, -resulting in 2160. - -Instead just directly set hts to the correct value of 2160 and -drop to_pixels_per_line(). - -Signed-off-by: Hans de Goede <hdegoede@redhat.com> -Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/i2c/ov2740.c | 17 +++-------------- - 1 file changed, 3 insertions(+), 14 deletions(-) - -diff --git a/drivers/media/i2c/ov2740.c b/drivers/media/i2c/ov2740.c -index 24e468485fbf..6be22586c3d2 100644 ---- a/drivers/media/i2c/ov2740.c -+++ b/drivers/media/i2c/ov2740.c -@@ -310,7 +310,7 @@ static const struct ov2740_mode supported_modes[] = { - { - .width = 1932, - .height = 1092, -- .hts = 1080, -+ .hts = 2160, - .vts_def = OV2740_VTS_DEF, - .vts_min = OV2740_VTS_MIN, - .reg_list = { -@@ -357,15 +357,6 @@ static u64 to_pixel_rate(u32 f_index) - return pixel_rate; - } - --static u64 to_pixels_per_line(u32 hts, u32 f_index) --{ -- u64 ppl = hts * to_pixel_rate(f_index); -- -- do_div(ppl, OV2740_SCLK); -- -- return ppl; --} -- - static int ov2740_read_reg(struct ov2740 *ov2740, u16 reg, u16 len, u32 *val) - { - struct i2c_client *client = v4l2_get_subdevdata(&ov2740->sd); -@@ -598,8 +589,7 @@ static int ov2740_init_controls(struct ov2740 *ov2740) - V4L2_CID_VBLANK, vblank_min, - vblank_max, 1, vblank_default); - -- h_blank = to_pixels_per_line(cur_mode->hts, cur_mode->link_freq_index); -- h_blank -= cur_mode->width; -+ h_blank = cur_mode->hts - cur_mode->width; - ov2740->hblank = v4l2_ctrl_new_std(ctrl_hdlr, &ov2740_ctrl_ops, - V4L2_CID_HBLANK, h_blank, h_blank, 1, - h_blank); -@@ -842,8 +832,7 @@ static int ov2740_set_format(struct v4l2_subdev *sd, - mode->vts_min - mode->height, - OV2740_VTS_MAX - mode->height, 1, vblank_def); - __v4l2_ctrl_s_ctrl(ov2740->vblank, vblank_def); -- h_blank = to_pixels_per_line(mode->hts, mode->link_freq_index) - -- mode->width; -+ h_blank = mode->hts - mode->width; - __v4l2_ctrl_modify_range(ov2740->hblank, h_blank, h_blank, 1, h_blank); - - return 0; --- -2.43.2 - -From fadb7d053de5d48d081fd5d5203ecad31fab53e2 Mon Sep 17 00:00:00 2001 -From: Kieran Bingham <kieran.bingham@ideasonboard.com> -Date: Mon, 11 Dec 2023 18:29:48 +0530 -Subject: [PATCH 1218/1501] media: i2c: imx335: Fix hblank min/max values -Content-Length: 1137 -Lines: 33 - -[ Upstream commit d7b95ad7a8d56248dfc34f861e445fad7a4004f4 ] - -The V4L2_CID_HBLANK control is marked as readonly and can only be a -single value. - -Set the minimum and maximum value to match the mode value. - -Reviewed-by: Umang Jain <umang.jain@ideasonboard.com> -Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com> -Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> -Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/media/i2c/imx335.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/media/i2c/imx335.c b/drivers/media/i2c/imx335.c -index ec729126274b..964a81bec5a4 100644 ---- a/drivers/media/i2c/imx335.c -+++ b/drivers/media/i2c/imx335.c -@@ -962,8 +962,8 @@ static int imx335_init_controls(struct imx335 *imx335) - imx335->hblank_ctrl = v4l2_ctrl_new_std(ctrl_hdlr, - &imx335_ctrl_ops, - V4L2_CID_HBLANK, -- IMX335_REG_MIN, -- IMX335_REG_MAX, -+ mode->hblank, -+ mode->hblank, - 1, mode->hblank); - if (imx335->hblank_ctrl) - imx335->hblank_ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY; --- -2.43.2 - -From 44d12324d342ac0e28df81a027a79d50f7cc95e0 Mon Sep 17 00:00:00 2001 -From: Alvin Lee <alvin.lee2@amd.com> -Date: Wed, 6 Dec 2023 14:52:31 -0500 -Subject: [PATCH 1219/1501] drm/amd/display: For prefetch mode > 0, extend - prefetch if possible -Content-Length: 5940 -Lines: 116 - -[ Upstream commit dd4e4bb28843393065eed279e869fac248d03f0f ] - -[Description] -For mode programming we want to extend the prefetch as much as possible -(up to oto, or as long as we can for equ) if we're not already applying -the 60us prefetch requirement. This is to avoid intermittent underflow -issues during prefetch. - -The prefetch extension is applied under the following scenarios: -1. We're in prefetch mode 1 (i.e. we don't support MCLK switch in blank) -2. We're using subvp or drr methods of p-state switch, in which case we - we don't care if prefetch takes up more of the blanking time - -Mode programming typically chooses the smallest prefetch time possible -(i.e. highest bandwidth during prefetch) presumably to create margin between -p-states / c-states that happen in vblank and prefetch. Therefore we only -apply this prefetch extension when p-state in vblank is not required (UCLK -p-states take up the most vblank time). - -Reviewed-by: Jun Lei <jun.lei@amd.com> -Acked-by: Aurabindo Pillai <aurabindo.pillai@amd.com> -Signed-off-by: Alvin Lee <alvin.lee2@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../dc/dml/dcn32/display_mode_vba_32.c | 3 ++ - .../dc/dml/dcn32/display_mode_vba_util_32.c | 33 +++++++++++++++---- - .../dc/dml/dcn32/display_mode_vba_util_32.h | 1 + - 3 files changed, 31 insertions(+), 6 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c -index cbdfb762c10c..6c84b0fa40f4 100644 ---- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c -+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c -@@ -813,6 +813,8 @@ static void DISPCLKDPPCLKDCFCLKDeepSleepPrefetchParametersWatermarksAndPerforman - (v->DRAMSpeedPerState[mode_lib->vba.VoltageLevel] <= MEM_STROBE_FREQ_MHZ || - v->DCFCLKPerState[mode_lib->vba.VoltageLevel] <= DCFCLK_FREQ_EXTRA_PREFETCH_REQ_MHZ) ? - mode_lib->vba.ip.min_prefetch_in_strobe_us : 0, -+ mode_lib->vba.PrefetchModePerState[mode_lib->vba.VoltageLevel][mode_lib->vba.maxMpcComb] > 0 || mode_lib->vba.DRAMClockChangeRequirementFinal == false, -+ - /* Output */ - &v->DSTXAfterScaler[k], - &v->DSTYAfterScaler[k], -@@ -3317,6 +3319,7 @@ void dml32_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l - v->SwathHeightCThisState[k], v->TWait, - (v->DRAMSpeedPerState[i] <= MEM_STROBE_FREQ_MHZ || v->DCFCLKState[i][j] <= DCFCLK_FREQ_EXTRA_PREFETCH_REQ_MHZ) ? - mode_lib->vba.ip.min_prefetch_in_strobe_us : 0, -+ mode_lib->vba.PrefetchModePerState[i][j] > 0 || mode_lib->vba.DRAMClockChangeRequirementFinal == false, - - /* Output */ - &v->dummy_vars.dml32_ModeSupportAndSystemConfigurationFull.DSTXAfterScaler[k], -diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c -index d940dfa5ae43..80fccd4999a5 100644 ---- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c -+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c -@@ -3423,6 +3423,7 @@ bool dml32_CalculatePrefetchSchedule( - unsigned int SwathHeightC, - double TWait, - double TPreReq, -+ bool ExtendPrefetchIfPossible, - /* Output */ - double *DSTXAfterScaler, - double *DSTYAfterScaler, -@@ -3892,12 +3893,32 @@ bool dml32_CalculatePrefetchSchedule( - /* Clamp to oto for bandwidth calculation */ - LinesForPrefetchBandwidth = dst_y_prefetch_oto; - } else { -- *DestinationLinesForPrefetch = dst_y_prefetch_equ; -- TimeForFetchingMetaPTE = Tvm_equ; -- TimeForFetchingRowInVBlank = Tr0_equ; -- *PrefetchBandwidth = prefetch_bw_equ; -- /* Clamp to equ for bandwidth calculation */ -- LinesForPrefetchBandwidth = dst_y_prefetch_equ; -+ /* For mode programming we want to extend the prefetch as much as possible -+ * (up to oto, or as long as we can for equ) if we're not already applying -+ * the 60us prefetch requirement. This is to avoid intermittent underflow -+ * issues during prefetch. -+ * -+ * The prefetch extension is applied under the following scenarios: -+ * 1. We're in prefetch mode > 0 (i.e. we don't support MCLK switch in blank) -+ * 2. We're using subvp or drr methods of p-state switch, in which case we -+ * we don't care if prefetch takes up more of the blanking time -+ * -+ * Mode programming typically chooses the smallest prefetch time possible -+ * (i.e. highest bandwidth during prefetch) presumably to create margin between -+ * p-states / c-states that happen in vblank and prefetch. Therefore we only -+ * apply this prefetch extension when p-state in vblank is not required (UCLK -+ * p-states take up the most vblank time). -+ */ -+ if (ExtendPrefetchIfPossible && TPreReq == 0 && VStartup < MaxVStartup) { -+ MyError = true; -+ } else { -+ *DestinationLinesForPrefetch = dst_y_prefetch_equ; -+ TimeForFetchingMetaPTE = Tvm_equ; -+ TimeForFetchingRowInVBlank = Tr0_equ; -+ *PrefetchBandwidth = prefetch_bw_equ; -+ /* Clamp to equ for bandwidth calculation */ -+ LinesForPrefetchBandwidth = dst_y_prefetch_equ; -+ } - } - - *DestinationLinesToRequestVMInVBlank = dml_ceil(4.0 * TimeForFetchingMetaPTE / LineTime, 1.0) / 4.0; -diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.h b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.h -index 592d174df6c6..5d34735df83d 100644 ---- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.h -+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.h -@@ -747,6 +747,7 @@ bool dml32_CalculatePrefetchSchedule( - unsigned int SwathHeightC, - double TWait, - double TPreReq, -+ bool ExtendPrefetchIfPossible, - /* Output */ - double *DSTXAfterScaler, - double *DSTYAfterScaler, --- -2.43.2 - -From fb93e7f26fb80143bcf96e731275a4dec0fb11e3 Mon Sep 17 00:00:00 2001 -From: Alvin Lee <alvin.lee2@amd.com> -Date: Wed, 6 Dec 2023 14:52:32 -0500 -Subject: [PATCH 1220/1501] drm/amd/display: Force p-state disallow if leaving - no plane config -Content-Length: 2511 -Lines: 68 - -[ Upstream commit 9a902a9073c287353e25913c0761bfed49d75a88 ] - -[Description] -- When we're in a no plane config, DCN is always asserting - P-State allow -- This creates a scenario where the P-State blackout can start - just as VUPDATE takes place and transitions the DCN config to - a one where one or more HUBP's are active which can result in - underflow -- To fix this issue, force p-state disallow and unforce after - the transition from no planes case -> one or more planes active - -Reviewed-by: Samson Tam <samson.tam@amd.com> -Acked-by: Aurabindo Pillai <aurabindo.pillai@amd.com> -Signed-off-by: Alvin Lee <alvin.lee2@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 20 +++++++++++++++++++ - 1 file changed, 20 insertions(+) - -diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c -index 608221b0dd5d..c3c83178eb1e 100644 ---- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c -@@ -1877,6 +1877,8 @@ void dcn20_program_front_end_for_ctx( - int i; - struct dce_hwseq *hws = dc->hwseq; - DC_LOGGER_INIT(dc->ctx->logger); -+ unsigned int prev_hubp_count = 0; -+ unsigned int hubp_count = 0; - - if (resource_is_pipe_topology_changed(dc->current_state, context)) - resource_log_pipe_topology_update(dc, context); -@@ -1894,6 +1896,20 @@ void dcn20_program_front_end_for_ctx( - } - } - -+ for (i = 0; i < dc->res_pool->pipe_count; i++) { -+ if (dc->current_state->res_ctx.pipe_ctx[i].plane_state) -+ prev_hubp_count++; -+ if (context->res_ctx.pipe_ctx[i].plane_state) -+ hubp_count++; -+ } -+ -+ if (prev_hubp_count == 0 && hubp_count > 0) { -+ if (dc->res_pool->hubbub->funcs->force_pstate_change_control) -+ dc->res_pool->hubbub->funcs->force_pstate_change_control( -+ dc->res_pool->hubbub, true, false); -+ udelay(500); -+ } -+ - /* Set pipe update flags and lock pipes */ - for (i = 0; i < dc->res_pool->pipe_count; i++) - dcn20_detect_pipe_changes(&dc->current_state->res_ctx.pipe_ctx[i], -@@ -2039,6 +2055,10 @@ void dcn20_post_unlock_program_front_end( - } - } - -+ if (dc->res_pool->hubbub->funcs->force_pstate_change_control) -+ dc->res_pool->hubbub->funcs->force_pstate_change_control( -+ dc->res_pool->hubbub, false, false); -+ - for (i = 0; i < dc->res_pool->pipe_count; i++) { - struct pipe_ctx *pipe = &context->res_ctx.pipe_ctx[i]; - --- -2.43.2 - -From 83271b65f701356f0e34dde6e994744ff0ec5347 Mon Sep 17 00:00:00 2001 -From: Jonathan Kim <jonathan.kim@amd.com> -Date: Tue, 5 Dec 2023 12:22:07 -0500 -Subject: [PATCH 1221/1501] drm/amdkfd: fix mes set shader debugger process - management -Content-Length: 5794 -Lines: 149 - -[ Upstream commit bd33bb1409b494558a2935f7bbc7842def957fcd ] - -MES provides the driver a call to explicitly flush stale process memory -within the MES to avoid a race condition that results in a fatal -memory violation. - -When SET_SHADER_DEBUGGER is called, the driver passes a memory address -that represents a process context address MES uses to keep track of -future per-process calls. - -Normally, MES will purge its process context list when the last queue -has been removed. The driver, however, can call SET_SHADER_DEBUGGER -regardless of whether a queue has been added or not. - -If SET_SHADER_DEBUGGER has been called with no queues as the last call -prior to process termination, the passed process context address will -still reside within MES. - -On a new process call to SET_SHADER_DEBUGGER, the driver may end up -passing an identical process context address value (based on per-process -gpu memory address) to MES but is now pointing to a new allocated buffer -object during KFD process creation. Since the MES is unaware of this, -access of the passed address points to the stale object within MES and -triggers a fatal memory violation. - -The solution is for KFD to explicitly flush the process context address -from MES on process termination. - -Note that the flush call and the MES debugger calls use the same MES -interface but are separated as KFD calls to avoid conflicting with each -other. - -Signed-off-by: Jonathan Kim <jonathan.kim@amd.com> -Tested-by: Alice Wong <shiwei.wong@amd.com> -Reviewed-by: Eric Huang <jinhuieric.huang@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 31 +++++++++++++++++++ - drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h | 10 +++--- - .../amd/amdkfd/kfd_process_queue_manager.c | 1 + - drivers/gpu/drm/amd/include/mes_v11_api_def.h | 3 +- - 4 files changed, 40 insertions(+), 5 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c -index 9ddbf1494326..30c010836658 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c -@@ -886,6 +886,11 @@ int amdgpu_mes_set_shader_debugger(struct amdgpu_device *adev, - op_input.op = MES_MISC_OP_SET_SHADER_DEBUGGER; - op_input.set_shader_debugger.process_context_addr = process_context_addr; - op_input.set_shader_debugger.flags.u32all = flags; -+ -+ /* use amdgpu mes_flush_shader_debugger instead */ -+ if (op_input.set_shader_debugger.flags.process_ctx_flush) -+ return -EINVAL; -+ - op_input.set_shader_debugger.spi_gdbg_per_vmid_cntl = spi_gdbg_per_vmid_cntl; - memcpy(op_input.set_shader_debugger.tcp_watch_cntl, tcp_watch_cntl, - sizeof(op_input.set_shader_debugger.tcp_watch_cntl)); -@@ -905,6 +910,32 @@ int amdgpu_mes_set_shader_debugger(struct amdgpu_device *adev, - return r; - } - -+int amdgpu_mes_flush_shader_debugger(struct amdgpu_device *adev, -+ uint64_t process_context_addr) -+{ -+ struct mes_misc_op_input op_input = {0}; -+ int r; -+ -+ if (!adev->mes.funcs->misc_op) { -+ DRM_ERROR("mes flush shader debugger is not supported!\n"); -+ return -EINVAL; -+ } -+ -+ op_input.op = MES_MISC_OP_SET_SHADER_DEBUGGER; -+ op_input.set_shader_debugger.process_context_addr = process_context_addr; -+ op_input.set_shader_debugger.flags.process_ctx_flush = true; -+ -+ amdgpu_mes_lock(&adev->mes); -+ -+ r = adev->mes.funcs->misc_op(&adev->mes, &op_input); -+ if (r) -+ DRM_ERROR("failed to set_shader_debugger\n"); -+ -+ amdgpu_mes_unlock(&adev->mes); -+ -+ return r; -+} -+ - static void - amdgpu_mes_ring_to_queue_props(struct amdgpu_device *adev, - struct amdgpu_ring *ring, -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h -index a27b424ffe00..c2c88b772361 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h -@@ -291,9 +291,10 @@ struct mes_misc_op_input { - uint64_t process_context_addr; - union { - struct { -- uint64_t single_memop : 1; -- uint64_t single_alu_op : 1; -- uint64_t reserved: 30; -+ uint32_t single_memop : 1; -+ uint32_t single_alu_op : 1; -+ uint32_t reserved: 29; -+ uint32_t process_ctx_flush: 1; - }; - uint32_t u32all; - } flags; -@@ -369,7 +370,8 @@ int amdgpu_mes_set_shader_debugger(struct amdgpu_device *adev, - const uint32_t *tcp_watch_cntl, - uint32_t flags, - bool trap_en); -- -+int amdgpu_mes_flush_shader_debugger(struct amdgpu_device *adev, -+ uint64_t process_context_addr); - int amdgpu_mes_add_ring(struct amdgpu_device *adev, int gang_id, - int queue_type, int idx, - struct amdgpu_mes_ctx_data *ctx_data, -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c -index 77f493262e05..8e55e78fce4e 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c -@@ -87,6 +87,7 @@ void kfd_process_dequeue_from_device(struct kfd_process_device *pdd) - return; - - dev->dqm->ops.process_termination(dev->dqm, &pdd->qpd); -+ amdgpu_mes_flush_shader_debugger(dev->adev, pdd->proc_ctx_gpu_addr); - pdd->already_dequeued = true; - } - -diff --git a/drivers/gpu/drm/amd/include/mes_v11_api_def.h b/drivers/gpu/drm/amd/include/mes_v11_api_def.h -index b1db2b190187..e07e93167a82 100644 ---- a/drivers/gpu/drm/amd/include/mes_v11_api_def.h -+++ b/drivers/gpu/drm/amd/include/mes_v11_api_def.h -@@ -571,7 +571,8 @@ struct SET_SHADER_DEBUGGER { - struct { - uint32_t single_memop : 1; /* SQ_DEBUG.single_memop */ - uint32_t single_alu_op : 1; /* SQ_DEBUG.single_alu_op */ -- uint32_t reserved : 30; -+ uint32_t reserved : 29; -+ uint32_t process_ctx_flush : 1; - }; - uint32_t u32all; - } flags; --- -2.43.2 - -From 3139efb47d85d4329ee174eb4c6cb96e2f76abd5 Mon Sep 17 00:00:00 2001 -From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Date: Sun, 3 Dec 2023 03:27:42 +0300 -Subject: [PATCH 1222/1501] drm/msm/dpu: enable writeback on SM8350 -Content-Length: 2120 -Lines: 58 - -[ Upstream commit c2949a49dfe960e952400029e14751dceff79d38 ] - -Enable WB2 hardware block, enabling writeback support on this platform. - -Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com> -Patchwork: https://patchwork.freedesktop.org/patch/570188/ -Link: https://lore.kernel.org/r/20231203002743.1291956-3-dmitry.baryshkov@linaro.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../drm/msm/disp/dpu1/catalog/dpu_7_0_sm8350.h | 18 ++++++++++++++++++ - 1 file changed, 18 insertions(+) - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_0_sm8350.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_0_sm8350.h -index 1709ba57f384..022b0408c24d 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_0_sm8350.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_0_sm8350.h -@@ -31,6 +31,7 @@ static const struct dpu_mdp_cfg sm8350_mdp = { - [DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 }, - [DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2bc, .bit_off = 8 }, - [DPU_CLK_CTRL_DMA3] = { .reg_off = 0x2c4, .bit_off = 8 }, -+ [DPU_CLK_CTRL_WB2] = { .reg_off = 0x2bc, .bit_off = 16 }, - [DPU_CLK_CTRL_REG_DMA] = { .reg_off = 0x2bc, .bit_off = 20 }, - }, - }; -@@ -298,6 +299,21 @@ static const struct dpu_dsc_cfg sm8350_dsc[] = { - }, - }; - -+static const struct dpu_wb_cfg sm8350_wb[] = { -+ { -+ .name = "wb_2", .id = WB_2, -+ .base = 0x65000, .len = 0x2c8, -+ .features = WB_SM8250_MASK, -+ .format_list = wb2_formats, -+ .num_formats = ARRAY_SIZE(wb2_formats), -+ .clk_ctrl = DPU_CLK_CTRL_WB2, -+ .xin_id = 6, -+ .vbif_idx = VBIF_RT, -+ .maxlinewidth = 4096, -+ .intr_wb_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 4), -+ }, -+}; -+ - static const struct dpu_intf_cfg sm8350_intf[] = { - { - .name = "intf_0", .id = INTF_0, -@@ -393,6 +409,8 @@ const struct dpu_mdss_cfg dpu_sm8350_cfg = { - .dsc = sm8350_dsc, - .merge_3d_count = ARRAY_SIZE(sm8350_merge_3d), - .merge_3d = sm8350_merge_3d, -+ .wb_count = ARRAY_SIZE(sm8350_wb), -+ .wb = sm8350_wb, - .intf_count = ARRAY_SIZE(sm8350_intf), - .intf = sm8350_intf, - .vbif_count = ARRAY_SIZE(sdm845_vbif), --- -2.43.2 - -From 9275c0d534cc3315c25c68a8381d18ba5c7515a2 Mon Sep 17 00:00:00 2001 -From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Date: Sun, 3 Dec 2023 03:27:43 +0300 -Subject: [PATCH 1223/1501] drm/msm/dpu: enable writeback on SM8450 -Content-Length: 2120 -Lines: 58 - -[ Upstream commit eaa647cdbf2e357b4a14903f2f1e47ed9c4f8df3 ] - -Enable WB2 hardware block, enabling writeback support on this platform. - -Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com> -Patchwork: https://patchwork.freedesktop.org/patch/570187/ -Link: https://lore.kernel.org/r/20231203002743.1291956-4-dmitry.baryshkov@linaro.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h | 18 ++++++++++++++++++ - 1 file changed, 18 insertions(+) - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h -index 72b0f547242f..7adc42257e1e 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h -@@ -32,6 +32,7 @@ static const struct dpu_mdp_cfg sm8450_mdp = { - [DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 }, - [DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2bc, .bit_off = 8 }, - [DPU_CLK_CTRL_DMA3] = { .reg_off = 0x2c4, .bit_off = 8 }, -+ [DPU_CLK_CTRL_WB2] = { .reg_off = 0x2bc, .bit_off = 16 }, - [DPU_CLK_CTRL_REG_DMA] = { .reg_off = 0x2bc, .bit_off = 20 }, - }, - }; -@@ -316,6 +317,21 @@ static const struct dpu_dsc_cfg sm8450_dsc[] = { - }, - }; - -+static const struct dpu_wb_cfg sm8450_wb[] = { -+ { -+ .name = "wb_2", .id = WB_2, -+ .base = 0x65000, .len = 0x2c8, -+ .features = WB_SM8250_MASK, -+ .format_list = wb2_formats, -+ .num_formats = ARRAY_SIZE(wb2_formats), -+ .clk_ctrl = DPU_CLK_CTRL_WB2, -+ .xin_id = 6, -+ .vbif_idx = VBIF_RT, -+ .maxlinewidth = 4096, -+ .intr_wb_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 4), -+ }, -+}; -+ - static const struct dpu_intf_cfg sm8450_intf[] = { - { - .name = "intf_0", .id = INTF_0, -@@ -411,6 +427,8 @@ const struct dpu_mdss_cfg dpu_sm8450_cfg = { - .dsc = sm8450_dsc, - .merge_3d_count = ARRAY_SIZE(sm8450_merge_3d), - .merge_3d = sm8450_merge_3d, -+ .wb_count = ARRAY_SIZE(sm8450_wb), -+ .wb = sm8450_wb, - .intf_count = ARRAY_SIZE(sm8450_intf), - .intf = sm8450_intf, - .vbif_count = ARRAY_SIZE(sdm845_vbif), --- -2.43.2 - -From cc74988a5b07d251e3a59c35bd4a1e380249cd61 Mon Sep 17 00:00:00 2001 -From: Rob Clark <robdclark@chromium.org> -Date: Mon, 11 Dec 2023 10:19:55 -0800 -Subject: [PATCH 1224/1501] drm/msm/dpu: Ratelimit framedone timeout msgs -Content-Length: 2185 -Lines: 54 - -[ Upstream commit 2b72e50c62de60ad2d6bcd86aa38d4ccbdd633f2 ] - -When we start getting these, we get a *lot*. So ratelimit it to not -flood dmesg. - -Signed-off-by: Rob Clark <robdclark@chromium.org> -Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com> -Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org> -Patchwork: https://patchwork.freedesktop.org/patch/571584/ -Link: https://lore.kernel.org/r/20231211182000.218088-1-robdclark@gmail.com -Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 5 ++++- - drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h | 1 + - 2 files changed, 5 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -index 5dbb5d27bbea..0dd95b7ff1f9 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -@@ -39,6 +39,9 @@ - #define DPU_ERROR_ENC(e, fmt, ...) DPU_ERROR("enc%d " fmt,\ - (e) ? (e)->base.base.id : -1, ##__VA_ARGS__) - -+#define DPU_ERROR_ENC_RATELIMITED(e, fmt, ...) DPU_ERROR_RATELIMITED("enc%d " fmt,\ -+ (e) ? (e)->base.base.id : -1, ##__VA_ARGS__) -+ - /* - * Two to anticipate panels that can do cmd/vid dynamic switching - * plan is to create all possible physical encoder types, and switch between -@@ -2339,7 +2342,7 @@ static void dpu_encoder_frame_done_timeout(struct timer_list *t) - return; - } - -- DPU_ERROR_ENC(dpu_enc, "frame done timeout\n"); -+ DPU_ERROR_ENC_RATELIMITED(dpu_enc, "frame done timeout\n"); - - event = DPU_ENCODER_FRAME_EVENT_ERROR; - trace_dpu_enc_frame_done_timeout(DRMID(drm_enc), event); -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h -index b6f53ca6e962..f5473d4dea92 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h -@@ -51,6 +51,7 @@ - } while (0) - - #define DPU_ERROR(fmt, ...) pr_err("[dpu error]" fmt, ##__VA_ARGS__) -+#define DPU_ERROR_RATELIMITED(fmt, ...) pr_err_ratelimited("[dpu error]" fmt, ##__VA_ARGS__) - - /** - * ktime_compare_safe - compare two ktime structures --- -2.43.2 - -From c9348e01c308e333ddbb49c4944427d2fa697cc8 Mon Sep 17 00:00:00 2001 -From: Abhinav Kumar <quic_abhinavk@quicinc.com> -Date: Tue, 12 Dec 2023 12:52:41 -0800 -Subject: [PATCH 1225/1501] drm/msm/dpu: fix writeback programming for YUV - cases -Content-Length: 1309 -Lines: 36 - -[ Upstream commit 79caf2f2202b9eaad3a5a726e4b33807f67d0f1b ] - -For YUV cases, setting the required format bits was missed -out in the register programming. Lets fix it now in preparation -of adding YUV formats support for writeback. - -changes in v2: - - dropped the fixes tag as its not a fix but adding - new functionality - -Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com> -Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Patchwork: https://patchwork.freedesktop.org/patch/571814/ -Link: https://lore.kernel.org/r/20231212205254.12422-4-quic_abhinavk@quicinc.com -Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c -index 9668fb97c047..d49b3ef7689e 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c -@@ -87,6 +87,9 @@ static void dpu_hw_wb_setup_format(struct dpu_hw_wb *ctx, - dst_format |= BIT(14); /* DST_ALPHA_X */ - } - -+ if (DPU_FORMAT_IS_YUV(fmt)) -+ dst_format |= BIT(15); -+ - pattern = (fmt->element[3] << 24) | - (fmt->element[2] << 16) | - (fmt->element[1] << 8) | --- -2.43.2 - -From 14f109bf74dd67e1d0469fed859c8e506b0df53f Mon Sep 17 00:00:00 2001 -From: Paloma Arellano <quic_parellan@quicinc.com> -Date: Tue, 12 Dec 2023 15:10:58 -0800 -Subject: [PATCH 1226/1501] drm/msm/dpu: Add mutex lock in control vblank irq -Content-Length: 8005 -Lines: 200 - -[ Upstream commit 45284ff733e4caf6c118aae5131eb7e7cf3eea5a ] - -Add a mutex lock to control vblank irq to synchronize vblank -enable/disable operations happening from different threads to prevent -race conditions while registering/unregistering the vblank irq callback. - -v4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a - parameter of dpu_encoder_phys. - -Switch from atomic refcnt to a simple int counter as mutex has - now been added -v3: Mistakenly did not change wording in last version. It is done now. -v2: Slightly changed wording of commit message - -Signed-off-by: Paloma Arellano <quic_parellan@quicinc.com> -Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Patchwork: https://patchwork.freedesktop.org/patch/571854/ -Link: https://lore.kernel.org/r/20231212231101.9240-2-quic_parellan@quicinc.com -Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 1 - - .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h | 4 ++- - .../drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 32 ++++++++++++------ - .../drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 33 ++++++++++++------- - 4 files changed, 47 insertions(+), 23 deletions(-) - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -index 0dd95b7ff1f9..b9f0093389a8 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -@@ -2500,7 +2500,6 @@ void dpu_encoder_phys_init(struct dpu_encoder_phys *phys_enc, - phys_enc->enc_spinlock = p->enc_spinlock; - phys_enc->enable_state = DPU_ENC_DISABLED; - -- atomic_set(&phys_enc->vblank_refcount, 0); - atomic_set(&phys_enc->pending_kickoff_cnt, 0); - atomic_set(&phys_enc->pending_ctlstart_cnt, 0); - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h -index 6f04c3d56e77..96bda57b6959 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h -@@ -155,6 +155,7 @@ enum dpu_intr_idx { - * @hw_wb: Hardware interface to the wb registers - * @dpu_kms: Pointer to the dpu_kms top level - * @cached_mode: DRM mode cached at mode_set time, acted on in enable -+ * @vblank_ctl_lock: Vblank ctl mutex lock to protect vblank_refcount - * @enabled: Whether the encoder has enabled and running a mode - * @split_role: Role to play in a split-panel configuration - * @intf_mode: Interface mode -@@ -183,11 +184,12 @@ struct dpu_encoder_phys { - struct dpu_hw_wb *hw_wb; - struct dpu_kms *dpu_kms; - struct drm_display_mode cached_mode; -+ struct mutex vblank_ctl_lock; - enum dpu_enc_split_role split_role; - enum dpu_intf_mode intf_mode; - spinlock_t *enc_spinlock; - enum dpu_enc_enable_state enable_state; -- atomic_t vblank_refcount; -+ int vblank_refcount; - atomic_t vsync_cnt; - atomic_t underrun_cnt; - atomic_t pending_ctlstart_cnt; -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c -index be185fe69793..2d788c5e26a8 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c -@@ -244,7 +244,8 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( - return -EINVAL; - } - -- refcount = atomic_read(&phys_enc->vblank_refcount); -+ mutex_lock(&phys_enc->vblank_ctl_lock); -+ refcount = phys_enc->vblank_refcount; - - /* Slave encoders don't report vblank */ - if (!dpu_encoder_phys_cmd_is_master(phys_enc)) -@@ -260,16 +261,24 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( - phys_enc->hw_pp->idx - PINGPONG_0, - enable ? "true" : "false", refcount); - -- if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) -- ret = dpu_core_irq_register_callback(phys_enc->dpu_kms, -- phys_enc->irq[INTR_IDX_RDPTR], -- dpu_encoder_phys_cmd_te_rd_ptr_irq, -- phys_enc); -- else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) -- ret = dpu_core_irq_unregister_callback(phys_enc->dpu_kms, -- phys_enc->irq[INTR_IDX_RDPTR]); -+ if (enable) { -+ if (phys_enc->vblank_refcount == 0) -+ ret = dpu_core_irq_register_callback(phys_enc->dpu_kms, -+ phys_enc->irq[INTR_IDX_RDPTR], -+ dpu_encoder_phys_cmd_te_rd_ptr_irq, -+ phys_enc); -+ if (!ret) -+ phys_enc->vblank_refcount++; -+ } else if (!enable) { -+ if (phys_enc->vblank_refcount == 1) -+ ret = dpu_core_irq_unregister_callback(phys_enc->dpu_kms, -+ phys_enc->irq[INTR_IDX_RDPTR]); -+ if (!ret) -+ phys_enc->vblank_refcount--; -+ } - - end: -+ mutex_unlock(&phys_enc->vblank_ctl_lock); - if (ret) { - DRM_ERROR("vblank irq err id:%u pp:%d ret:%d, enable %s/%d\n", - DRMID(phys_enc->parent), -@@ -285,7 +294,7 @@ static void dpu_encoder_phys_cmd_irq_control(struct dpu_encoder_phys *phys_enc, - { - trace_dpu_enc_phys_cmd_irq_ctrl(DRMID(phys_enc->parent), - phys_enc->hw_pp->idx - PINGPONG_0, -- enable, atomic_read(&phys_enc->vblank_refcount)); -+ enable, phys_enc->vblank_refcount); - - if (enable) { - dpu_core_irq_register_callback(phys_enc->dpu_kms, -@@ -763,6 +772,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( - - dpu_encoder_phys_init(phys_enc, p); - -+ mutex_init(&phys_enc->vblank_ctl_lock); -+ phys_enc->vblank_refcount = 0; -+ - dpu_encoder_phys_cmd_init_ops(&phys_enc->ops); - phys_enc->intf_mode = INTF_MODE_CMD; - cmd_enc->stream_sel = 0; -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c -index a01fda711883..eeb0acf9665e 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c -@@ -364,7 +364,8 @@ static int dpu_encoder_phys_vid_control_vblank_irq( - int ret = 0; - int refcount; - -- refcount = atomic_read(&phys_enc->vblank_refcount); -+ mutex_lock(&phys_enc->vblank_ctl_lock); -+ refcount = phys_enc->vblank_refcount; - - /* Slave encoders don't report vblank */ - if (!dpu_encoder_phys_vid_is_master(phys_enc)) -@@ -377,18 +378,26 @@ static int dpu_encoder_phys_vid_control_vblank_irq( - } - - DRM_DEBUG_VBL("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, -- atomic_read(&phys_enc->vblank_refcount)); -+ refcount); - -- if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) -- ret = dpu_core_irq_register_callback(phys_enc->dpu_kms, -- phys_enc->irq[INTR_IDX_VSYNC], -- dpu_encoder_phys_vid_vblank_irq, -- phys_enc); -- else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) -- ret = dpu_core_irq_unregister_callback(phys_enc->dpu_kms, -- phys_enc->irq[INTR_IDX_VSYNC]); -+ if (enable) { -+ if (phys_enc->vblank_refcount == 0) -+ ret = dpu_core_irq_register_callback(phys_enc->dpu_kms, -+ phys_enc->irq[INTR_IDX_VSYNC], -+ dpu_encoder_phys_vid_vblank_irq, -+ phys_enc); -+ if (!ret) -+ phys_enc->vblank_refcount++; -+ } else if (!enable) { -+ if (phys_enc->vblank_refcount == 1) -+ ret = dpu_core_irq_unregister_callback(phys_enc->dpu_kms, -+ phys_enc->irq[INTR_IDX_VSYNC]); -+ if (!ret) -+ phys_enc->vblank_refcount--; -+ } - - end: -+ mutex_unlock(&phys_enc->vblank_ctl_lock); - if (ret) { - DRM_ERROR("failed: id:%u intf:%d ret:%d enable:%d refcnt:%d\n", - DRMID(phys_enc->parent), -@@ -618,7 +627,7 @@ static void dpu_encoder_phys_vid_irq_control(struct dpu_encoder_phys *phys_enc, - trace_dpu_enc_phys_vid_irq_ctrl(DRMID(phys_enc->parent), - phys_enc->hw_intf->idx - INTF_0, - enable, -- atomic_read(&phys_enc->vblank_refcount)); -+ phys_enc->vblank_refcount); - - if (enable) { - ret = dpu_encoder_phys_vid_control_vblank_irq(phys_enc, true); -@@ -713,6 +722,8 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( - DPU_DEBUG_VIDENC(phys_enc, "\n"); - - dpu_encoder_phys_init(phys_enc, p); -+ mutex_init(&phys_enc->vblank_ctl_lock); -+ phys_enc->vblank_refcount = 0; - - dpu_encoder_phys_vid_init_ops(&phys_enc->ops); - phys_enc->intf_mode = INTF_MODE_VIDEO; --- -2.43.2 - -From 1cd2b612474c07b17a21e27f2eed8dff75cb5057 Mon Sep 17 00:00:00 2001 -From: "Wang, Beyond" <Wang.Beyond@amd.com> -Date: Tue, 12 Dec 2023 21:03:04 +0800 -Subject: [PATCH 1227/1501] drm/amdgpu: fix ftrace event amdgpu_bo_move always - move on same heap -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 4116 -Lines: 103 - -[ Upstream commit 94aeb4117343d072e3a35b9595bcbfc0058ee724 ] - -Issue: during evict or validate happened on amdgpu_bo, the 'from' and -'to' is always same in ftrace event of amdgpu_bo_move - -where calling the 'trace_amdgpu_bo_move', the comment says move_notify -is called before move happens, but actually it is called after move -happens, here the new_mem is same as bo->resource - -Fix: move trace_amdgpu_bo_move from move_notify to amdgpu_bo_move - -Signed-off-by: Wang, Beyond <Wang.Beyond@amd.com> -Reviewed-by: Christian König <christian.koenig@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 +------------ - drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 4 +--- - drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 5 +++-- - 3 files changed, 5 insertions(+), 17 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c -index 5ad03f2afdb4..425cebcc5cbf 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c -@@ -1245,19 +1245,15 @@ int amdgpu_bo_get_metadata(struct amdgpu_bo *bo, void *buffer, - * amdgpu_bo_move_notify - notification about a memory move - * @bo: pointer to a buffer object - * @evict: if this move is evicting the buffer from the graphics address space -- * @new_mem: new information of the bufer object - * - * Marks the corresponding &amdgpu_bo buffer object as invalid, also performs - * bookkeeping. - * TTM driver callback which is called when ttm moves a buffer. - */ --void amdgpu_bo_move_notify(struct ttm_buffer_object *bo, -- bool evict, -- struct ttm_resource *new_mem) -+void amdgpu_bo_move_notify(struct ttm_buffer_object *bo, bool evict) - { - struct amdgpu_device *adev = amdgpu_ttm_adev(bo->bdev); - struct amdgpu_bo *abo; -- struct ttm_resource *old_mem = bo->resource; - - if (!amdgpu_bo_is_amdgpu_bo(bo)) - return; -@@ -1274,13 +1270,6 @@ void amdgpu_bo_move_notify(struct ttm_buffer_object *bo, - /* remember the eviction */ - if (evict) - atomic64_inc(&adev->num_evictions); -- -- /* update statistics */ -- if (!new_mem) -- return; -- -- /* move_notify is called before move happens */ -- trace_amdgpu_bo_move(abo, new_mem->mem_type, old_mem->mem_type); - } - - void amdgpu_bo_get_memory(struct amdgpu_bo *bo, -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h -index d28e21baef16..a3ea8a82db23 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h -@@ -344,9 +344,7 @@ int amdgpu_bo_set_metadata (struct amdgpu_bo *bo, void *metadata, - int amdgpu_bo_get_metadata(struct amdgpu_bo *bo, void *buffer, - size_t buffer_size, uint32_t *metadata_size, - uint64_t *flags); --void amdgpu_bo_move_notify(struct ttm_buffer_object *bo, -- bool evict, -- struct ttm_resource *new_mem); -+void amdgpu_bo_move_notify(struct ttm_buffer_object *bo, bool evict); - void amdgpu_bo_release_notify(struct ttm_buffer_object *bo); - vm_fault_t amdgpu_bo_fault_reserve_notify(struct ttm_buffer_object *bo); - void amdgpu_bo_fence(struct amdgpu_bo *bo, struct dma_fence *fence, -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c -index ab4a762aed5b..75c9fd2c6c2a 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c -@@ -545,10 +545,11 @@ static int amdgpu_bo_move(struct ttm_buffer_object *bo, bool evict, - return r; - } - -+ trace_amdgpu_bo_move(abo, new_mem->mem_type, old_mem->mem_type); - out: - /* update statistics */ - atomic64_add(bo->base.size, &adev->num_bytes_moved); -- amdgpu_bo_move_notify(bo, evict, new_mem); -+ amdgpu_bo_move_notify(bo, evict); - return 0; - } - -@@ -1553,7 +1554,7 @@ static int amdgpu_ttm_access_memory(struct ttm_buffer_object *bo, - static void - amdgpu_bo_delete_mem_notify(struct ttm_buffer_object *bo) - { -- amdgpu_bo_move_notify(bo, false, NULL); -+ amdgpu_bo_move_notify(bo, false); - } - - static struct ttm_device_funcs amdgpu_bo_driver = { --- -2.43.2 - -From 2fece04533d249a8e6611e704beeda725b9710b2 Mon Sep 17 00:00:00 2001 -From: Kuan-Wei Chiu <visitorckw@gmail.com> -Date: Mon, 11 Dec 2023 00:50:40 +0800 -Subject: [PATCH 1228/1501] clk: hi3620: Fix memory leak in - hi3620_mmc_clk_init() -Content-Length: 1201 -Lines: 33 - -[ Upstream commit bfbea9e5667cfa9552c3d88f023386f017f6c308 ] - -In cases where kcalloc() fails for the 'clk_data->clks' allocation, the -code path does not handle the failure gracefully, potentially leading -to a memory leak. This fix ensures proper cleanup by freeing the -allocated memory for 'clk_data' before returning. - -Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com> -Link: https://lore.kernel.org/r/20231210165040.3407545-1-visitorckw@gmail.com -Signed-off-by: Stephen Boyd <sboyd@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/clk/hisilicon/clk-hi3620.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/clk/hisilicon/clk-hi3620.c b/drivers/clk/hisilicon/clk-hi3620.c -index 2d7186905abd..5d0226530fdb 100644 ---- a/drivers/clk/hisilicon/clk-hi3620.c -+++ b/drivers/clk/hisilicon/clk-hi3620.c -@@ -466,8 +466,10 @@ static void __init hi3620_mmc_clk_init(struct device_node *node) - return; - - clk_data->clks = kcalloc(num, sizeof(*clk_data->clks), GFP_KERNEL); -- if (!clk_data->clks) -+ if (!clk_data->clks) { -+ kfree(clk_data); - return; -+ } - - for (i = 0; i < num; i++) { - struct hisi_mmc_clock *mmc_clk = &hi3620_mmc_clks[i]; --- -2.43.2 - -From bc53dc88f7072dc42ddbeaa23961f77e5b58505d Mon Sep 17 00:00:00 2001 -From: Kuan-Wei Chiu <visitorckw@gmail.com> -Date: Mon, 11 Dec 2023 01:52:32 +0800 -Subject: [PATCH 1229/1501] clk: mmp: pxa168: Fix memory leak in - pxa168_clk_init() -Content-Length: 1359 -Lines: 43 - -[ Upstream commit 2fbabea626b6467eb4e6c4cb7a16523da12e43b4 ] - -In cases where mapping of mpmu/apmu/apbc registers fails, the code path -does not handle the failure gracefully, potentially leading to a memory -leak. This fix ensures proper cleanup by freeing the allocated memory -for 'pxa_unit' before returning. - -Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com> -Link: https://lore.kernel.org/r/20231210175232.3414584-1-visitorckw@gmail.com -Signed-off-by: Stephen Boyd <sboyd@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/clk/mmp/clk-of-pxa168.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/clk/mmp/clk-of-pxa168.c b/drivers/clk/mmp/clk-of-pxa168.c -index fb0df64cf053..c5a7ba1deaa3 100644 ---- a/drivers/clk/mmp/clk-of-pxa168.c -+++ b/drivers/clk/mmp/clk-of-pxa168.c -@@ -308,18 +308,21 @@ static void __init pxa168_clk_init(struct device_node *np) - pxa_unit->mpmu_base = of_iomap(np, 0); - if (!pxa_unit->mpmu_base) { - pr_err("failed to map mpmu registers\n"); -+ kfree(pxa_unit); - return; - } - - pxa_unit->apmu_base = of_iomap(np, 1); - if (!pxa_unit->apmu_base) { - pr_err("failed to map apmu registers\n"); -+ kfree(pxa_unit); - return; - } - - pxa_unit->apbc_base = of_iomap(np, 2); - if (!pxa_unit->apbc_base) { - pr_err("failed to map apbc registers\n"); -+ kfree(pxa_unit); - return; - } - --- -2.43.2 - -From c6235cd5162d529620412a80be7df4a2edd818df Mon Sep 17 00:00:00 2001 -From: Ben Dooks <ben.dooks@codethink.co.uk> -Date: Wed, 22 Nov 2023 08:51:18 +0000 -Subject: [PATCH 1230/1501] watchdog: starfive: add lock annotations to fix - context imbalances -Content-Length: 1578 -Lines: 40 - -[ Upstream commit f77999887235f8c378af343df11a6bcedda5b284 ] - -Add the necessary __acquires() and __releases() to the functions -that take and release the wdt lock to avoid the following sparse -warnings: - -drivers/watchdog/starfive-wdt.c:204:13: warning: context imbalance in 'starfive_wdt_unlock' - wrong count at exit -drivers/watchdog/starfive-wdt.c:212:9: warning: context imbalance in 'starfive_wdt_lock' - unexpected unlock - -Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk> -Reviewed-by: Guenter Roeck <linux@roeck-us.net> -Link: https://lore.kernel.org/r/20231122085118.177589-1-ben.dooks@codethink.co.uk -Signed-off-by: Guenter Roeck <linux@roeck-us.net> -Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/watchdog/starfive-wdt.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/watchdog/starfive-wdt.c b/drivers/watchdog/starfive-wdt.c -index 5f501b41faf9..49b38ecc092d 100644 ---- a/drivers/watchdog/starfive-wdt.c -+++ b/drivers/watchdog/starfive-wdt.c -@@ -202,12 +202,14 @@ static u32 starfive_wdt_ticks_to_sec(struct starfive_wdt *wdt, u32 ticks) - - /* Write unlock-key to unlock. Write other value to lock. */ - static void starfive_wdt_unlock(struct starfive_wdt *wdt) -+ __acquires(&wdt->lock) - { - spin_lock(&wdt->lock); - writel(wdt->variant->unlock_key, wdt->base + wdt->variant->unlock); - } - - static void starfive_wdt_lock(struct starfive_wdt *wdt) -+ __releases(&wdt->lock) - { - writel(~wdt->variant->unlock_key, wdt->base + wdt->variant->unlock); - spin_unlock(&wdt->lock); --- -2.43.2 - -From bd77f5e86d5239091af0ab45b32f7c597cc21a1e Mon Sep 17 00:00:00 2001 -From: Werner Fischer <devlists@wefi.net> -Date: Wed, 13 Dec 2023 10:45:25 +0100 -Subject: [PATCH 1231/1501] watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified - for IT8784/IT8786 -Content-Length: 2056 -Lines: 63 - -[ Upstream commit d12971849d71781c1e4ffd1117d4878ce233d319 ] - -WDTCTRL bit 3 sets the mode choice for the clock input of IT8784/IT8786. -Some motherboards require this bit to be set to 1 (= PCICLK mode), -otherwise the watchdog functionality gets broken. The BIOS of those -motherboards sets WDTCTRL bit 3 already to 1. - -Instead of setting all bits of WDTCTRL to 0 by writing 0x00 to it, keep -bit 3 of it unchanged for IT8784/IT8786 chips. In this way, bit 3 keeps -the status as set by the BIOS of the motherboard. - -Watchdog tests have been successful with this patch with the following -systems: - IT8784: Thomas-Krenn LES plus v2 (YANLING YL-KBRL2 V2) - IT8786: Thomas-Krenn LES plus v3 (YANLING YL-CLU L2) - IT8786: Thomas-Krenn LES network 6L v2 (YANLING YL-CLU6L) - -Link: https://lore.kernel.org/all/140b264d-341f-465b-8715-dacfe84b3f71@roeck-us.net/ - -Signed-off-by: Werner Fischer <devlists@wefi.net> -Reviewed-by: Guenter Roeck <linux@roeck-us.net> -Link: https://lore.kernel.org/r/20231213094525.11849-4-devlists@wefi.net -Signed-off-by: Guenter Roeck <linux@roeck-us.net> -Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/watchdog/it87_wdt.c | 14 +++++++++++++- - 1 file changed, 13 insertions(+), 1 deletion(-) - -diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c -index e888b1bdd1f2..8c1ee072f48b 100644 ---- a/drivers/watchdog/it87_wdt.c -+++ b/drivers/watchdog/it87_wdt.c -@@ -256,6 +256,7 @@ static struct watchdog_device wdt_dev = { - static int __init it87_wdt_init(void) - { - u8 chip_rev; -+ u8 ctrl; - int rc; - - rc = superio_enter(); -@@ -315,7 +316,18 @@ static int __init it87_wdt_init(void) - - superio_select(GPIO); - superio_outb(WDT_TOV1, WDTCFG); -- superio_outb(0x00, WDTCTRL); -+ -+ switch (chip_type) { -+ case IT8784_ID: -+ case IT8786_ID: -+ ctrl = superio_inb(WDTCTRL); -+ ctrl &= 0x08; -+ superio_outb(ctrl, WDTCTRL); -+ break; -+ default: -+ superio_outb(0x00, WDTCTRL); -+ } -+ - superio_exit(); - - if (timeout < 1 || timeout > max_units * 60) { --- -2.43.2 - -From 014bc0f4a5255b2562305d2d08aee17e81b5ceeb Mon Sep 17 00:00:00 2001 -From: Oded Gabbay <ogabbay@kernel.org> -Date: Mon, 30 Oct 2023 12:23:57 +0200 -Subject: [PATCH 1232/1501] accel/habanalabs: add support for Gaudi2C device -Content-Length: 3894 -Lines: 104 - -[ Upstream commit 42422993cf28d456778ee9168d73758ec037cd51 ] - -Gaudi2 with PCI revision ID with the value of '3' represents Gaudi2C -device and should be detected and initialized as Gaudi2. - -Signed-off-by: Oded Gabbay <ogabbay@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/accel/habanalabs/common/device.c | 3 +++ - drivers/accel/habanalabs/common/habanalabs.h | 2 ++ - drivers/accel/habanalabs/common/habanalabs_drv.c | 3 +++ - drivers/accel/habanalabs/common/mmu/mmu.c | 1 + - drivers/accel/habanalabs/common/sysfs.c | 3 +++ - drivers/accel/habanalabs/include/hw_ip/pci/pci_general.h | 1 + - 6 files changed, 13 insertions(+) - -diff --git a/drivers/accel/habanalabs/common/device.c b/drivers/accel/habanalabs/common/device.c -index 9711e8fc979d..9e461c03e705 100644 ---- a/drivers/accel/habanalabs/common/device.c -+++ b/drivers/accel/habanalabs/common/device.c -@@ -853,6 +853,9 @@ static int device_early_init(struct hl_device *hdev) - gaudi2_set_asic_funcs(hdev); - strscpy(hdev->asic_name, "GAUDI2B", sizeof(hdev->asic_name)); - break; -+ case ASIC_GAUDI2C: -+ gaudi2_set_asic_funcs(hdev); -+ strscpy(hdev->asic_name, "GAUDI2C", sizeof(hdev->asic_name)); - break; - default: - dev_err(hdev->dev, "Unrecognized ASIC type %d\n", -diff --git a/drivers/accel/habanalabs/common/habanalabs.h b/drivers/accel/habanalabs/common/habanalabs.h -index 1655c101c705..d0fd77bb6a74 100644 ---- a/drivers/accel/habanalabs/common/habanalabs.h -+++ b/drivers/accel/habanalabs/common/habanalabs.h -@@ -1262,6 +1262,7 @@ struct hl_dec { - * @ASIC_GAUDI_SEC: Gaudi secured device (HL-2000). - * @ASIC_GAUDI2: Gaudi2 device. - * @ASIC_GAUDI2B: Gaudi2B device. -+ * @ASIC_GAUDI2C: Gaudi2C device. - */ - enum hl_asic_type { - ASIC_INVALID, -@@ -1270,6 +1271,7 @@ enum hl_asic_type { - ASIC_GAUDI_SEC, - ASIC_GAUDI2, - ASIC_GAUDI2B, -+ ASIC_GAUDI2C, - }; - - struct hl_cs_parser; -diff --git a/drivers/accel/habanalabs/common/habanalabs_drv.c b/drivers/accel/habanalabs/common/habanalabs_drv.c -index 306a5bc9bf89..51fb04bbe376 100644 ---- a/drivers/accel/habanalabs/common/habanalabs_drv.c -+++ b/drivers/accel/habanalabs/common/habanalabs_drv.c -@@ -141,6 +141,9 @@ static enum hl_asic_type get_asic_type(struct hl_device *hdev) - case REV_ID_B: - asic_type = ASIC_GAUDI2B; - break; -+ case REV_ID_C: -+ asic_type = ASIC_GAUDI2C; -+ break; - default: - break; - } -diff --git a/drivers/accel/habanalabs/common/mmu/mmu.c b/drivers/accel/habanalabs/common/mmu/mmu.c -index b2145716c605..b654302a68fc 100644 ---- a/drivers/accel/habanalabs/common/mmu/mmu.c -+++ b/drivers/accel/habanalabs/common/mmu/mmu.c -@@ -596,6 +596,7 @@ int hl_mmu_if_set_funcs(struct hl_device *hdev) - break; - case ASIC_GAUDI2: - case ASIC_GAUDI2B: -+ case ASIC_GAUDI2C: - /* MMUs in Gaudi2 are always host resident */ - hl_mmu_v2_hr_set_funcs(hdev, &hdev->mmu_func[MMU_HR_PGT]); - break; -diff --git a/drivers/accel/habanalabs/common/sysfs.c b/drivers/accel/habanalabs/common/sysfs.c -index 01f89f029355..278606373055 100644 ---- a/drivers/accel/habanalabs/common/sysfs.c -+++ b/drivers/accel/habanalabs/common/sysfs.c -@@ -251,6 +251,9 @@ static ssize_t device_type_show(struct device *dev, - case ASIC_GAUDI2B: - str = "GAUDI2B"; - break; -+ case ASIC_GAUDI2C: -+ str = "GAUDI2C"; -+ break; - default: - dev_err(hdev->dev, "Unrecognized ASIC type %d\n", - hdev->asic_type); -diff --git a/drivers/accel/habanalabs/include/hw_ip/pci/pci_general.h b/drivers/accel/habanalabs/include/hw_ip/pci/pci_general.h -index f5d497dc9bdc..4f951cada077 100644 ---- a/drivers/accel/habanalabs/include/hw_ip/pci/pci_general.h -+++ b/drivers/accel/habanalabs/include/hw_ip/pci/pci_general.h -@@ -25,6 +25,7 @@ enum hl_revision_id { - REV_ID_INVALID = 0x00, - REV_ID_A = 0x01, - REV_ID_B = 0x02, -+ REV_ID_C = 0x03 - }; - - #endif /* INCLUDE_PCI_GENERAL_H_ */ --- -2.43.2 - -From d312312f3e918c89617a1cafec14d9415e9e15eb Mon Sep 17 00:00:00 2001 -From: Farah Kassabri <fkassabri@habana.ai> -Date: Tue, 31 Oct 2023 12:20:36 +0200 -Subject: [PATCH 1233/1501] accel/habanalabs: fix EQ heartbeat mechanism -Content-Length: 2021 -Lines: 56 - -[ Upstream commit d1958dce5ab6a3e089c60cf474e8c9b7e96e70ad ] - -Stop rescheduling another heartbeat check when EQ heartbeat check fails -as it generates confusing logs in dmesg that the heartbeat fails. - -Signed-off-by: Farah Kassabri <fkassabri@habana.ai> -Reviewed-by: Oded Gabbay <ogabbay@kernel.org> -Signed-off-by: Oded Gabbay <ogabbay@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/accel/habanalabs/common/device.c | 14 +++++++------- - 1 file changed, 7 insertions(+), 7 deletions(-) - -diff --git a/drivers/accel/habanalabs/common/device.c b/drivers/accel/habanalabs/common/device.c -index 9e461c03e705..9290d4374551 100644 ---- a/drivers/accel/habanalabs/common/device.c -+++ b/drivers/accel/habanalabs/common/device.c -@@ -1044,18 +1044,19 @@ static bool is_pci_link_healthy(struct hl_device *hdev) - return (vendor_id == PCI_VENDOR_ID_HABANALABS); - } - --static void hl_device_eq_heartbeat(struct hl_device *hdev) -+static int hl_device_eq_heartbeat_check(struct hl_device *hdev) - { -- u64 event_mask = HL_NOTIFIER_EVENT_DEVICE_RESET | HL_NOTIFIER_EVENT_DEVICE_UNAVAILABLE; - struct asic_fixed_properties *prop = &hdev->asic_prop; - - if (!prop->cpucp_info.eq_health_check_supported) -- return; -+ return 0; - - if (hdev->eq_heartbeat_received) - hdev->eq_heartbeat_received = false; - else -- hl_device_cond_reset(hdev, HL_DRV_RESET_HARD, event_mask); -+ return -EIO; -+ -+ return 0; - } - - static void hl_device_heartbeat(struct work_struct *work) -@@ -1072,10 +1073,9 @@ static void hl_device_heartbeat(struct work_struct *work) - /* - * For EQ health check need to check if driver received the heartbeat eq event - * in order to validate the eq is working. -+ * Only if both the EQ is healthy and we managed to send the next heartbeat reschedule. - */ -- hl_device_eq_heartbeat(hdev); -- -- if (!hdev->asic_funcs->send_heartbeat(hdev)) -+ if ((!hl_device_eq_heartbeat_check(hdev)) && (!hdev->asic_funcs->send_heartbeat(hdev))) - goto reschedule; - - if (hl_device_operational(hdev, NULL)) --- -2.43.2 - -From a27dcc218c33d4a5a6b020ae6a85706e976f0e54 Mon Sep 17 00:00:00 2001 -From: Dafna Hirschfeld <dhirschfeld@habana.ai> -Date: Tue, 31 Oct 2023 13:51:10 +0200 -Subject: [PATCH 1234/1501] accel/habanalabs/gaudi2: fix undef opcode reporting -Content-Length: 1947 -Lines: 48 - -[ Upstream commit 0ec346779644039c4c05cfa7f071b1a24e54d8d9 ] - -currently the undefined opcode event bit in set only for lower cp and -only if 'write_enable' is true. It should be set anyway and for all -streams in order to report that event to userspace. - -Signed-off-by: Dafna Hirschfeld <dhirschfeld@habana.ai> -Reviewed-by: Oded Gabbay <ogabbay@kernel.org> -Signed-off-by: Oded Gabbay <ogabbay@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/accel/habanalabs/gaudi2/gaudi2.c | 14 ++++++-------- - 1 file changed, 6 insertions(+), 8 deletions(-) - -diff --git a/drivers/accel/habanalabs/gaudi2/gaudi2.c b/drivers/accel/habanalabs/gaudi2/gaudi2.c -index 819660c684cf..bc6e338ef2fd 100644 ---- a/drivers/accel/habanalabs/gaudi2/gaudi2.c -+++ b/drivers/accel/habanalabs/gaudi2/gaudi2.c -@@ -7929,21 +7929,19 @@ static int gaudi2_handle_qman_err_generic(struct hl_device *hdev, u16 event_type - error_count++; - } - -- if (i == QMAN_STREAMS && error_count) { -- /* check for undefined opcode */ -- if (glbl_sts_val & PDMA0_QM_GLBL_ERR_STS_CP_UNDEF_CMD_ERR_MASK && -- hdev->captured_err_info.undef_opcode.write_enable) { -+ /* check for undefined opcode */ -+ if (glbl_sts_val & PDMA0_QM_GLBL_ERR_STS_CP_UNDEF_CMD_ERR_MASK) { -+ *event_mask |= HL_NOTIFIER_EVENT_UNDEFINED_OPCODE; -+ if (hdev->captured_err_info.undef_opcode.write_enable) { - memset(&hdev->captured_err_info.undef_opcode, 0, - sizeof(hdev->captured_err_info.undef_opcode)); -- -- hdev->captured_err_info.undef_opcode.write_enable = false; - hdev->captured_err_info.undef_opcode.timestamp = ktime_get(); - hdev->captured_err_info.undef_opcode.engine_id = - gaudi2_queue_id_to_engine_id[qid_base]; -- *event_mask |= HL_NOTIFIER_EVENT_UNDEFINED_OPCODE; - } - -- handle_lower_qman_data_on_err(hdev, qman_base, *event_mask); -+ if (i == QMAN_STREAMS) -+ handle_lower_qman_data_on_err(hdev, qman_base, *event_mask); - } - } - --- -2.43.2 - -From b80ca22d47f600c3121b5e9f2c1202fdc075dc88 Mon Sep 17 00:00:00 2001 -From: Josip Pavic <josip.pavic@amd.com> -Date: Tue, 5 Dec 2023 12:01:05 -0500 -Subject: [PATCH 1235/1501] drm/amd/display: make flip_timestamp_in_us a 64-bit - variable -Content-Length: 1202 -Lines: 35 - -[ Upstream commit 6fb12518ca58412dc51054e2a7400afb41328d85 ] - -[Why] -This variable currently overflows after about 71 minutes. This doesn't -cause any known functional issues but it does make debugging more -difficult. - -[How] -Make it a 64-bit variable. - -Reviewed-by: Aric Cyr <aric.cyr@amd.com> -Acked-by: Wayne Lin <wayne.lin@amd.com> -Signed-off-by: Josip Pavic <josip.pavic@amd.com> -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/display/dc/dc_hw_types.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/dc_hw_types.h b/drivers/gpu/drm/amd/display/dc/dc_hw_types.h -index e2a3aa8812df..811474f4419b 100644 ---- a/drivers/gpu/drm/amd/display/dc/dc_hw_types.h -+++ b/drivers/gpu/drm/amd/display/dc/dc_hw_types.h -@@ -244,7 +244,7 @@ enum pixel_format { - #define DC_MAX_DIRTY_RECTS 3 - struct dc_flip_addrs { - struct dc_plane_address address; -- unsigned int flip_timestamp_in_us; -+ unsigned long long flip_timestamp_in_us; - bool flip_immediate; - /* TODO: add flip duration for FreeSync */ - bool triplebuffer_flips; --- -2.43.2 - -From ae5c2289b2b98fc8479c5b7c19e82c7ca34eb290 Mon Sep 17 00:00:00 2001 -From: Michael Strauss <michael.strauss@amd.com> -Date: Thu, 30 Nov 2023 10:44:36 -0500 -Subject: [PATCH 1237/1501] drm/amd/display: Fix lightup regression with DP2 - single display configs -Content-Length: 1756 -Lines: 40 - -[ Upstream commit 5a82b8d6c05f9b30828ede1b103b9ee5cb5c912e ] - -[WHY] -Previous fix for multiple displays downstream of DP2 MST hub caused regression - -[HOW] -Match sink IDs instead of sink struct addresses - -Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> -Reviewed-by: Charlene Liu <charlene.liu@amd.com> -Acked-by: Wayne Lin <wayne.lin@amd.com> -Signed-off-by: Michael Strauss <michael.strauss@amd.com> -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/display/dc/dml2/dml2_utils.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml2_utils.c b/drivers/gpu/drm/amd/display/dc/dml2/dml2_utils.c -index 2498b8341199..d6a68484153c 100644 ---- a/drivers/gpu/drm/amd/display/dc/dml2/dml2_utils.c -+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml2_utils.c -@@ -157,6 +157,14 @@ bool is_dp2p0_output_encoder(const struct pipe_ctx *pipe_ctx) - { - /* If this assert is hit then we have a link encoder dynamic management issue */ - ASSERT(pipe_ctx->stream_res.hpo_dp_stream_enc ? pipe_ctx->link_res.hpo_dp_link_enc != NULL : true); -+ /* Count MST hubs once by treating only 1st remote sink in topology as an encoder */ -+ if (pipe_ctx->stream->link && pipe_ctx->stream->link->remote_sinks[0]) { -+ return (pipe_ctx->stream_res.hpo_dp_stream_enc && -+ pipe_ctx->link_res.hpo_dp_link_enc && -+ dc_is_dp_signal(pipe_ctx->stream->signal) && -+ (pipe_ctx->stream->link->remote_sinks[0]->sink_id == pipe_ctx->stream->sink->sink_id)); -+ } -+ - return (pipe_ctx->stream_res.hpo_dp_stream_enc && - pipe_ctx->link_res.hpo_dp_link_enc && - dc_is_dp_signal(pipe_ctx->stream->signal)); --- -2.43.2 - -From 2c046cb3339c2b5b2c0dbd8c6f5cf0a692299fcc Mon Sep 17 00:00:00 2001 -From: Alvin Lee <alvin.lee2@amd.com> -Date: Fri, 8 Dec 2023 11:56:56 -0500 -Subject: [PATCH 1238/1501] drm/amd/display: Only clear symclk otg flag for - HDMI -Content-Length: 4314 -Lines: 86 - -[ Upstream commit dff45f03f508c92cd8eb2050e27b726726b8ae0b ] - -[Description] -There is a corner case where the symclk otg flag is cleared -when disabling the phantom pipe for subvp (because the phantom -and main pipe share the same link). This is undesired because -we need the maintain the correct symclk otg flag state for -the main pipe. - -For now only clear the flag only for HDMI signal type, since -it's only set for HDMI signal type (phantom is virtual). The -ideal solution is to not clear it if the stream is phantom but -currently there's a bug that doesn't allow us to do this. Once -this issue is fixed the proper fix can be implemented. - -Reviewed-by: Samson Tam <samson.tam@amd.com> -Acked-by: Wayne Lin <wayne.lin@amd.com> -Signed-off-by: Alvin Lee <alvin.lee2@amd.com> -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 3 ++- - drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 3 ++- - drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 3 ++- - drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c | 3 ++- - 4 files changed, 8 insertions(+), 4 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c -index 9b8299d97e40..578e51a19fdd 100644 ---- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c -@@ -2124,7 +2124,8 @@ static void dce110_reset_hw_ctx_wrap( - BREAK_TO_DEBUGGER(); - } - pipe_ctx_old->stream_res.tg->funcs->disable_crtc(pipe_ctx_old->stream_res.tg); -- pipe_ctx_old->stream->link->phy_state.symclk_ref_cnts.otg = 0; -+ if (dc_is_hdmi_tmds_signal(pipe_ctx_old->stream->signal)) -+ pipe_ctx_old->stream->link->phy_state.symclk_ref_cnts.otg = 0; - pipe_ctx_old->plane_res.mi->funcs->free_mem_input( - pipe_ctx_old->plane_res.mi, dc->current_state->stream_count); - -diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c -index cdb903116eb7..1fc8436c8130 100644 ---- a/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c -@@ -1057,7 +1057,8 @@ static void dcn10_reset_back_end_for_pipe( - if (pipe_ctx->stream_res.tg->funcs->set_drr) - pipe_ctx->stream_res.tg->funcs->set_drr( - pipe_ctx->stream_res.tg, NULL); -- pipe_ctx->stream->link->phy_state.symclk_ref_cnts.otg = 0; -+ if (dc_is_hdmi_tmds_signal(pipe_ctx->stream->signal)) -+ pipe_ctx->stream->link->phy_state.symclk_ref_cnts.otg = 0; - } - - for (i = 0; i < dc->res_pool->pipe_count; i++) -diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c -index c3c83178eb1e..da0181fef411 100644 ---- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c -@@ -2610,7 +2610,8 @@ static void dcn20_reset_back_end_for_pipe( - * the case where the same symclk is shared across multiple otg - * instances - */ -- link->phy_state.symclk_ref_cnts.otg = 0; -+ if (dc_is_hdmi_tmds_signal(pipe_ctx->stream->signal)) -+ link->phy_state.symclk_ref_cnts.otg = 0; - if (link->phy_state.symclk_state == SYMCLK_ON_TX_OFF) { - link_hwss->disable_link_output(link, - &pipe_ctx->link_res, pipe_ctx->stream->signal); -diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c -index 52656691ae48..3a70a3cbc274 100644 ---- a/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c -@@ -523,7 +523,8 @@ static void dcn31_reset_back_end_for_pipe( - if (pipe_ctx->stream_res.tg->funcs->set_odm_bypass) - pipe_ctx->stream_res.tg->funcs->set_odm_bypass( - pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing); -- pipe_ctx->stream->link->phy_state.symclk_ref_cnts.otg = 0; -+ if (dc_is_hdmi_tmds_signal(pipe_ctx->stream->signal)) -+ pipe_ctx->stream->link->phy_state.symclk_ref_cnts.otg = 0; - - if (pipe_ctx->stream_res.tg->funcs->set_drr) - pipe_ctx->stream_res.tg->funcs->set_drr( --- -2.43.2 - -From 37bc012fcbdfd26dd4007a81a5012d7f30352974 Mon Sep 17 00:00:00 2001 -From: Kuan-Wei Chiu <visitorckw@gmail.com> -Date: Mon, 11 Dec 2023 01:19:07 +0800 -Subject: [PATCH 1239/1501] clk: imx: scu: Fix memory leak in - __imx_clk_gpr_scu() -Content-Length: 1173 -Lines: 34 - -[ Upstream commit 21c0efbcb45cf94724d17b040ebc03fcd4a81f22 ] - -In cases where imx_clk_is_resource_owned() returns false, the code path -does not handle the failure gracefully, potentially leading to a memory -leak. This fix ensures proper cleanup by freeing the allocated memory -for 'clk_node' before returning. - -Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com> -Reviewed-by: Peng Fan <peng.fan@nxp.com> -Link: https://lore.kernel.org/all/20231210171907.3410922-1-visitorckw@gmail.com/ -Signed-off-by: Abel Vesa <abel.vesa@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/clk/imx/clk-scu.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/clk/imx/clk-scu.c b/drivers/clk/imx/clk-scu.c -index be89180dd19c..e48a904c0013 100644 ---- a/drivers/clk/imx/clk-scu.c -+++ b/drivers/clk/imx/clk-scu.c -@@ -886,8 +886,10 @@ struct clk_hw *__imx_clk_gpr_scu(const char *name, const char * const *parent_na - return ERR_PTR(-EINVAL); - } - -- if (!imx_clk_is_resource_owned(rsrc_id)) -+ if (!imx_clk_is_resource_owned(rsrc_id)) { -+ kfree(clk_node); - return NULL; -+ } - - clk = kzalloc(sizeof(*clk), GFP_KERNEL); - if (!clk) { --- -2.43.2 - -From 8c959a1e82f5d55322d7c70fc8ee49101afff7f2 Mon Sep 17 00:00:00 2001 -From: Alexander Stein <alexander.stein@ew.tq-group.com> -Date: Mon, 18 Dec 2023 13:24:07 +0100 -Subject: [PATCH 1240/1501] clk: imx: clk-imx8qxp: fix LVDS bypass, pixel and - phy clocks -Content-Length: 3284 -Lines: 69 - -[ Upstream commit 3f5f63adeea7e7aa715e101ffe4b4ac9705f9664 ] - -To be compatible with SCU firmware based on 1.15 a different clock -routing for LVDS is needed. - -Signed-off-by: Oliver F. Brown <oliver.brown@oss.nxp.com> -Signed-off-by: Ranjani Vaidyanathan <ranjani.vaidyanathan@nxp.com> -Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> -Reviewed-by: Abel Vesa <abel.vesa@linaro.org> -Link: https://lore.kernel.org/r/20231218122407.2757175-1-alexander.stein@ew.tq-group.com/ -Signed-off-by: Abel Vesa <abel.vesa@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/clk/imx/clk-imx8qxp.c | 24 ++++++++++++++++++++---- - 1 file changed, 20 insertions(+), 4 deletions(-) - -diff --git a/drivers/clk/imx/clk-imx8qxp.c b/drivers/clk/imx/clk-imx8qxp.c -index 41f0a45aa162..7d8883916cac 100644 ---- a/drivers/clk/imx/clk-imx8qxp.c -+++ b/drivers/clk/imx/clk-imx8qxp.c -@@ -66,6 +66,22 @@ static const char * const lcd_pxl_sels[] = { - "lcd_pxl_bypass_div_clk", - }; - -+static const char *const lvds0_sels[] = { -+ "clk_dummy", -+ "clk_dummy", -+ "clk_dummy", -+ "clk_dummy", -+ "mipi0_lvds_bypass_clk", -+}; -+ -+static const char *const lvds1_sels[] = { -+ "clk_dummy", -+ "clk_dummy", -+ "clk_dummy", -+ "clk_dummy", -+ "mipi1_lvds_bypass_clk", -+}; -+ - static const char * const mipi_sels[] = { - "clk_dummy", - "clk_dummy", -@@ -207,9 +223,9 @@ static int imx8qxp_clk_probe(struct platform_device *pdev) - /* MIPI-LVDS SS */ - imx_clk_scu("mipi0_bypass_clk", IMX_SC_R_MIPI_0, IMX_SC_PM_CLK_BYPASS); - imx_clk_scu("mipi0_pixel_clk", IMX_SC_R_MIPI_0, IMX_SC_PM_CLK_PER); -- imx_clk_scu("mipi0_lvds_pixel_clk", IMX_SC_R_LVDS_0, IMX_SC_PM_CLK_MISC2); - imx_clk_scu("mipi0_lvds_bypass_clk", IMX_SC_R_LVDS_0, IMX_SC_PM_CLK_BYPASS); -- imx_clk_scu("mipi0_lvds_phy_clk", IMX_SC_R_LVDS_0, IMX_SC_PM_CLK_MISC3); -+ imx_clk_scu2("mipi0_lvds_pixel_clk", lvds0_sels, ARRAY_SIZE(lvds0_sels), IMX_SC_R_LVDS_0, IMX_SC_PM_CLK_MISC2); -+ imx_clk_scu2("mipi0_lvds_phy_clk", lvds0_sels, ARRAY_SIZE(lvds0_sels), IMX_SC_R_LVDS_0, IMX_SC_PM_CLK_MISC3); - imx_clk_scu2("mipi0_dsi_tx_esc_clk", mipi_sels, ARRAY_SIZE(mipi_sels), IMX_SC_R_MIPI_0, IMX_SC_PM_CLK_MST_BUS); - imx_clk_scu2("mipi0_dsi_rx_esc_clk", mipi_sels, ARRAY_SIZE(mipi_sels), IMX_SC_R_MIPI_0, IMX_SC_PM_CLK_SLV_BUS); - imx_clk_scu2("mipi0_dsi_phy_clk", mipi_sels, ARRAY_SIZE(mipi_sels), IMX_SC_R_MIPI_0, IMX_SC_PM_CLK_PHY); -@@ -219,9 +235,9 @@ static int imx8qxp_clk_probe(struct platform_device *pdev) - - imx_clk_scu("mipi1_bypass_clk", IMX_SC_R_MIPI_1, IMX_SC_PM_CLK_BYPASS); - imx_clk_scu("mipi1_pixel_clk", IMX_SC_R_MIPI_1, IMX_SC_PM_CLK_PER); -- imx_clk_scu("mipi1_lvds_pixel_clk", IMX_SC_R_LVDS_1, IMX_SC_PM_CLK_MISC2); - imx_clk_scu("mipi1_lvds_bypass_clk", IMX_SC_R_LVDS_1, IMX_SC_PM_CLK_BYPASS); -- imx_clk_scu("mipi1_lvds_phy_clk", IMX_SC_R_LVDS_1, IMX_SC_PM_CLK_MISC3); -+ imx_clk_scu2("mipi1_lvds_pixel_clk", lvds1_sels, ARRAY_SIZE(lvds1_sels), IMX_SC_R_LVDS_1, IMX_SC_PM_CLK_MISC2); -+ imx_clk_scu2("mipi1_lvds_phy_clk", lvds1_sels, ARRAY_SIZE(lvds1_sels), IMX_SC_R_LVDS_1, IMX_SC_PM_CLK_MISC3); - - imx_clk_scu2("mipi1_dsi_tx_esc_clk", mipi_sels, ARRAY_SIZE(mipi_sels), IMX_SC_R_MIPI_1, IMX_SC_PM_CLK_MST_BUS); - imx_clk_scu2("mipi1_dsi_rx_esc_clk", mipi_sels, ARRAY_SIZE(mipi_sels), IMX_SC_R_MIPI_1, IMX_SC_PM_CLK_SLV_BUS); --- -2.43.2 - -From c028919a4717909b610eb19f4911a76a32b49d8d Mon Sep 17 00:00:00 2001 -From: "Stanley.Yang" <Stanley.Yang@amd.com> -Date: Fri, 15 Dec 2023 16:13:23 +0800 -Subject: [PATCH 1241/1501] drm/amdgpu: Fix ecc irq enable/disable unpaired -Content-Length: 3935 -Lines: 116 - -[ Upstream commit a32c6f7f5737cc7e31cd7ad5133f0d96fca12ea6 ] - -The ecc_irq is disabled while GPU mode2 reset suspending process, -but not be enabled during GPU mode2 reset resume process. - -Changed from V1: - only do sdma/gfx ras_late_init in aldebaran_mode2_restore_ip - delete amdgpu_ras_late_resume function - -Changed from V2: - check umc ras supported before put ecc_irq - -Signed-off-by: Stanley.Yang <Stanley.Yang@amd.com> -Reviewed-by: Tao Zhou <tao.zhou1@amd.com> -Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdgpu/aldebaran.c | 26 +++++++++++++++++++++++++- - drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c | 4 ++++ - drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c | 5 +++++ - drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 4 ++++ - 4 files changed, 38 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/aldebaran.c b/drivers/gpu/drm/amd/amdgpu/aldebaran.c -index 02f4c6f9d4f6..576067d66bb9 100644 ---- a/drivers/gpu/drm/amd/amdgpu/aldebaran.c -+++ b/drivers/gpu/drm/amd/amdgpu/aldebaran.c -@@ -330,6 +330,7 @@ aldebaran_mode2_restore_hwcontext(struct amdgpu_reset_control *reset_ctl, - { - struct list_head *reset_device_list = reset_context->reset_device_list; - struct amdgpu_device *tmp_adev = NULL; -+ struct amdgpu_ras *con; - int r; - - if (reset_device_list == NULL) -@@ -355,7 +356,30 @@ aldebaran_mode2_restore_hwcontext(struct amdgpu_reset_control *reset_ctl, - */ - amdgpu_register_gpu_instance(tmp_adev); - -- /* Resume RAS */ -+ /* Resume RAS, ecc_irq */ -+ con = amdgpu_ras_get_context(tmp_adev); -+ if (!amdgpu_sriov_vf(tmp_adev) && con) { -+ if (tmp_adev->sdma.ras && -+ tmp_adev->sdma.ras->ras_block.ras_late_init) { -+ r = tmp_adev->sdma.ras->ras_block.ras_late_init(tmp_adev, -+ &tmp_adev->sdma.ras->ras_block.ras_comm); -+ if (r) { -+ dev_err(tmp_adev->dev, "SDMA failed to execute ras_late_init! ret:%d\n", r); -+ goto end; -+ } -+ } -+ -+ if (tmp_adev->gfx.ras && -+ tmp_adev->gfx.ras->ras_block.ras_late_init) { -+ r = tmp_adev->gfx.ras->ras_block.ras_late_init(tmp_adev, -+ &tmp_adev->gfx.ras->ras_block.ras_comm); -+ if (r) { -+ dev_err(tmp_adev->dev, "GFX failed to execute ras_late_init! ret:%d\n", r); -+ goto end; -+ } -+ } -+ } -+ - amdgpu_ras_resume(tmp_adev); - - /* Update PSP FW topology after reset */ -diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c -index a5a05c16c10d..6c5185608854 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c -@@ -1041,6 +1041,10 @@ static int gmc_v10_0_hw_fini(void *handle) - - amdgpu_irq_put(adev, &adev->gmc.vm_fault, 0); - -+ if (adev->gmc.ecc_irq.funcs && -+ amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__UMC)) -+ amdgpu_irq_put(adev, &adev->gmc.ecc_irq, 0); -+ - return 0; - } - -diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c -index 23d7b548d13f..c9c653cfc765 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c -@@ -941,6 +941,11 @@ static int gmc_v11_0_hw_fini(void *handle) - } - - amdgpu_irq_put(adev, &adev->gmc.vm_fault, 0); -+ -+ if (adev->gmc.ecc_irq.funcs && -+ amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__UMC)) -+ amdgpu_irq_put(adev, &adev->gmc.ecc_irq, 0); -+ - gmc_v11_0_gart_disable(adev); - - return 0; -diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c -index 77e625f24cd0..776acdfc7209 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c -@@ -2381,6 +2381,10 @@ static int gmc_v9_0_hw_fini(void *handle) - - amdgpu_irq_put(adev, &adev->gmc.vm_fault, 0); - -+ if (adev->gmc.ecc_irq.funcs && -+ amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__UMC)) -+ amdgpu_irq_put(adev, &adev->gmc.ecc_irq, 0); -+ - return 0; - } - --- -2.43.2 - -From 0ebb69e30d20957e1a151301799f620a4f80261e Mon Sep 17 00:00:00 2001 -From: Meenakshikumar Somasundaram <meenakshikumar.somasundaram@amd.com> -Date: Mon, 4 Dec 2023 10:57:45 -0500 -Subject: [PATCH 1242/1501] drm/amd/display: Fix minor issues in BW Allocation - Phase2 -Content-Length: 15715 -Lines: 453 - -[ Upstream commit aa5dc05340eb97486a631ce6bccb8d020bf6b56b ] - -[Why] -Fix minor issues in BW Allocation Phase2. - -[How] -- In set_usb4_req_bw_req(), link->dpia_bw_alloc_config.response_ready - flag should be reset before writing DPCD REQUEST_BW. -- Fix the granularity for value of 2 in get_bw_granularity(). -- Removed bandwidth allocation support display fw boot option as - the fw would read feature enable status from bios. -- Clean up DPIA_EST_BW_CHANGED and DPIA_BW_REQ_SUCCESS cases in - dpia_handle_bw_alloc_response(). -- Removed allocate_usb4_bw and deallocate_usb4_bw. -- Optimized loop in get_lowest_dpia_index(). -- Updated link_dp_dpia_allocate_usb4_bandwidth_for_stream() and - set_usb4_req_bw_req() to always issue request bw. - -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Reviewed-by: PeiChen Huang <peichen.huang@amd.com> -Acked-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com> -Signed-off-by: Meenakshikumar Somasundaram <meenakshikumar.somasundaram@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../dc/link/protocols/link_dp_dpia_bw.c | 221 ++++++++---------- - .../dc/link/protocols/link_dp_dpia_bw.h | 4 +- - 2 files changed, 101 insertions(+), 124 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c -index 7581023daa47..d6e1f969bfd5 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c -+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c -@@ -50,6 +50,7 @@ static bool get_bw_alloc_proceed_flag(struct dc_link *tmp) - && tmp->hpd_status - && tmp->dpia_bw_alloc_config.bw_alloc_enabled); - } -+ - static void reset_bw_alloc_struct(struct dc_link *link) - { - link->dpia_bw_alloc_config.bw_alloc_enabled = false; -@@ -59,6 +60,11 @@ static void reset_bw_alloc_struct(struct dc_link *link) - link->dpia_bw_alloc_config.bw_granularity = 0; - link->dpia_bw_alloc_config.response_ready = false; - } -+ -+#define BW_GRANULARITY_0 4 // 0.25 Gbps -+#define BW_GRANULARITY_1 2 // 0.5 Gbps -+#define BW_GRANULARITY_2 1 // 1 Gbps -+ - static uint8_t get_bw_granularity(struct dc_link *link) - { - uint8_t bw_granularity = 0; -@@ -71,16 +77,20 @@ static uint8_t get_bw_granularity(struct dc_link *link) - - switch (bw_granularity & 0x3) { - case 0: -- bw_granularity = 4; -+ bw_granularity = BW_GRANULARITY_0; - break; - case 1: -+ bw_granularity = BW_GRANULARITY_1; -+ break; -+ case 2: - default: -- bw_granularity = 2; -+ bw_granularity = BW_GRANULARITY_2; - break; - } - - return bw_granularity; - } -+ - static int get_estimated_bw(struct dc_link *link) - { - uint8_t bw_estimated_bw = 0; -@@ -93,31 +103,7 @@ static int get_estimated_bw(struct dc_link *link) - - return bw_estimated_bw * (Kbps_TO_Gbps / link->dpia_bw_alloc_config.bw_granularity); - } --static bool allocate_usb4_bw(int *stream_allocated_bw, int bw_needed, struct dc_link *link) --{ -- if (bw_needed > 0) -- *stream_allocated_bw += bw_needed; - -- return true; --} --static bool deallocate_usb4_bw(int *stream_allocated_bw, int bw_to_dealloc, struct dc_link *link) --{ -- bool ret = false; -- -- if (*stream_allocated_bw > 0) { -- *stream_allocated_bw -= bw_to_dealloc; -- ret = true; -- } else { -- //Do nothing for now -- ret = true; -- } -- -- // Unplug so reset values -- if (!link->hpd_status) -- reset_bw_alloc_struct(link); -- -- return ret; --} - /* - * Read all New BW alloc configuration ex: estimated_bw, allocated_bw, - * granuality, Driver_ID, CM_Group, & populate the BW allocation structs -@@ -128,7 +114,12 @@ static void init_usb4_bw_struct(struct dc_link *link) - // Init the known values - link->dpia_bw_alloc_config.bw_granularity = get_bw_granularity(link); - link->dpia_bw_alloc_config.estimated_bw = get_estimated_bw(link); -+ -+ DC_LOG_DEBUG("%s: bw_granularity(%d), estimated_bw(%d)\n", -+ __func__, link->dpia_bw_alloc_config.bw_granularity, -+ link->dpia_bw_alloc_config.estimated_bw); - } -+ - static uint8_t get_lowest_dpia_index(struct dc_link *link) - { - const struct dc *dc_struct = link->dc; -@@ -141,12 +132,15 @@ static uint8_t get_lowest_dpia_index(struct dc_link *link) - dc_struct->links[i]->ep_type != DISPLAY_ENDPOINT_USB4_DPIA) - continue; - -- if (idx > dc_struct->links[i]->link_index) -+ if (idx > dc_struct->links[i]->link_index) { - idx = dc_struct->links[i]->link_index; -+ break; -+ } - } - - return idx; - } -+ - /* - * Get the Max Available BW or Max Estimated BW for each Host Router - * -@@ -186,6 +180,7 @@ static int get_host_router_total_bw(struct dc_link *link, uint8_t type) - - return total_bw; - } -+ - /* - * Cleanup function for when the dpia is unplugged to reset struct - * and perform any required clean up -@@ -194,42 +189,50 @@ static int get_host_router_total_bw(struct dc_link *link, uint8_t type) - * - * return: none - */ --static bool dpia_bw_alloc_unplug(struct dc_link *link) -+static void dpia_bw_alloc_unplug(struct dc_link *link) - { -- if (!link) -- return true; -- -- return deallocate_usb4_bw(&link->dpia_bw_alloc_config.sink_allocated_bw, -- link->dpia_bw_alloc_config.sink_allocated_bw, link); -+ if (link) { -+ DC_LOG_DEBUG("%s: resetting bw alloc config for link(%d)\n", -+ __func__, link->link_index); -+ link->dpia_bw_alloc_config.sink_allocated_bw = 0; -+ reset_bw_alloc_struct(link); -+ } - } -+ - static void set_usb4_req_bw_req(struct dc_link *link, int req_bw) - { - uint8_t requested_bw; - uint32_t temp; - -- // 1. Add check for this corner case #1 -- if (req_bw > link->dpia_bw_alloc_config.estimated_bw) -+ /* Error check whether request bw greater than allocated */ -+ if (req_bw > link->dpia_bw_alloc_config.estimated_bw) { -+ DC_LOG_ERROR("%s: Request bw greater than estimated bw for link(%d)\n", -+ __func__, link->link_index); - req_bw = link->dpia_bw_alloc_config.estimated_bw; -+ } - - temp = req_bw * link->dpia_bw_alloc_config.bw_granularity; - requested_bw = temp / Kbps_TO_Gbps; - -- // Always make sure to add more to account for floating points -+ /* Always make sure to add more to account for floating points */ - if (temp % Kbps_TO_Gbps) - ++requested_bw; - -- // 2. Add check for this corner case #2 -+ /* Error check whether requested and allocated are equal */ - req_bw = requested_bw * (Kbps_TO_Gbps / link->dpia_bw_alloc_config.bw_granularity); -- if (req_bw == link->dpia_bw_alloc_config.sink_allocated_bw) -- return; -+ if (req_bw == link->dpia_bw_alloc_config.sink_allocated_bw) { -+ DC_LOG_ERROR("%s: Request bw equals to allocated bw for link(%d)\n", -+ __func__, link->link_index); -+ } - -- if (core_link_write_dpcd( -+ link->dpia_bw_alloc_config.response_ready = false; // Reset flag -+ core_link_write_dpcd( - link, - REQUESTED_BW, - &requested_bw, -- sizeof(uint8_t)) == DC_OK) -- link->dpia_bw_alloc_config.response_ready = false; // Reset flag -+ sizeof(uint8_t)); - } -+ - /* - * Return the response_ready flag from dc_link struct - * -@@ -241,6 +244,7 @@ static bool get_cm_response_ready_flag(struct dc_link *link) - { - return link->dpia_bw_alloc_config.response_ready; - } -+ - // ------------------------------------------------------------------ - // PUBLIC FUNCTIONS - // ------------------------------------------------------------------ -@@ -277,27 +281,27 @@ bool link_dp_dpia_set_dptx_usb4_bw_alloc_support(struct dc_link *link) - DPTX_BW_ALLOCATION_MODE_CONTROL, - &response, - sizeof(uint8_t)) != DC_OK) { -- DC_LOG_DEBUG("%s: **** FAILURE Enabling DPtx BW Allocation Mode Support ***\n", -- __func__); -+ DC_LOG_DEBUG("%s: FAILURE Enabling DPtx BW Allocation Mode Support for link(%d)\n", -+ __func__, link->link_index); - } else { - // SUCCESS Enabled DPtx BW Allocation Mode Support -- link->dpia_bw_alloc_config.bw_alloc_enabled = true; -- DC_LOG_DEBUG("%s: **** SUCCESS Enabling DPtx BW Allocation Mode Support ***\n", -- __func__); -+ DC_LOG_DEBUG("%s: SUCCESS Enabling DPtx BW Allocation Mode Support for link(%d)\n", -+ __func__, link->link_index); - - ret = true; - init_usb4_bw_struct(link); -+ link->dpia_bw_alloc_config.bw_alloc_enabled = true; - } - } - - out: - return ret; - } -+ - void dpia_handle_bw_alloc_response(struct dc_link *link, uint8_t bw, uint8_t result) - { - int bw_needed = 0; - int estimated = 0; -- int host_router_total_estimated_bw = 0; - - if (!get_bw_alloc_proceed_flag((link))) - return; -@@ -306,14 +310,22 @@ void dpia_handle_bw_alloc_response(struct dc_link *link, uint8_t bw, uint8_t res - - case DPIA_BW_REQ_FAILED: - -- DC_LOG_DEBUG("%s: *** *** BW REQ FAILURE for DP-TX Request *** ***\n", __func__); -+ /* -+ * Ideally, we shouldn't run into this case as we always validate available -+ * bandwidth and request within that limit -+ */ -+ estimated = bw * (Kbps_TO_Gbps / link->dpia_bw_alloc_config.bw_granularity); - -- // Update the new Estimated BW value updated by CM -- link->dpia_bw_alloc_config.estimated_bw = -- bw * (Kbps_TO_Gbps / link->dpia_bw_alloc_config.bw_granularity); -+ DC_LOG_ERROR("%s: BW REQ FAILURE for DP-TX Request for link(%d)\n", -+ __func__, link->link_index); -+ DC_LOG_ERROR("%s: current estimated_bw(%d), new estimated_bw(%d)\n", -+ __func__, link->dpia_bw_alloc_config.estimated_bw, estimated); - -+ /* Update the new Estimated BW value updated by CM */ -+ link->dpia_bw_alloc_config.estimated_bw = estimated; -+ -+ /* Allocate the previously requested bandwidth */ - set_usb4_req_bw_req(link, link->dpia_bw_alloc_config.estimated_bw); -- link->dpia_bw_alloc_config.response_ready = false; - - /* - * If FAIL then it is either: -@@ -326,68 +338,34 @@ void dpia_handle_bw_alloc_response(struct dc_link *link, uint8_t bw, uint8_t res - - case DPIA_BW_REQ_SUCCESS: - -- DC_LOG_DEBUG("%s: *** BW REQ SUCCESS for DP-TX Request ***\n", __func__); -- -- // 1. SUCCESS 1st time before any Pruning is done -- // 2. SUCCESS after prev. FAIL before any Pruning is done -- // 3. SUCCESS after Pruning is done but before enabling link -- - bw_needed = bw * (Kbps_TO_Gbps / link->dpia_bw_alloc_config.bw_granularity); - -- // 1. -- if (!link->dpia_bw_alloc_config.sink_allocated_bw) { -+ DC_LOG_DEBUG("%s: BW REQ SUCCESS for DP-TX Request for link(%d)\n", -+ __func__, link->link_index); -+ DC_LOG_DEBUG("%s: current allocated_bw(%d), new allocated_bw(%d)\n", -+ __func__, link->dpia_bw_alloc_config.sink_allocated_bw, bw_needed); - -- allocate_usb4_bw(&link->dpia_bw_alloc_config.sink_allocated_bw, bw_needed, link); -- link->dpia_bw_alloc_config.sink_verified_bw = -- link->dpia_bw_alloc_config.sink_allocated_bw; -- -- // SUCCESS from first attempt -- if (link->dpia_bw_alloc_config.sink_allocated_bw > -- link->dpia_bw_alloc_config.sink_max_bw) -- link->dpia_bw_alloc_config.sink_verified_bw = -- link->dpia_bw_alloc_config.sink_max_bw; -- } -- // 3. -- else if (link->dpia_bw_alloc_config.sink_allocated_bw) { -- -- // Find out how much do we need to de-alloc -- if (link->dpia_bw_alloc_config.sink_allocated_bw > bw_needed) -- deallocate_usb4_bw(&link->dpia_bw_alloc_config.sink_allocated_bw, -- link->dpia_bw_alloc_config.sink_allocated_bw - bw_needed, link); -- else -- allocate_usb4_bw(&link->dpia_bw_alloc_config.sink_allocated_bw, -- bw_needed - link->dpia_bw_alloc_config.sink_allocated_bw, link); -- } -- -- // 4. If this is the 2nd sink then any unused bw will be reallocated to master DPIA -- // => check if estimated_bw changed -+ link->dpia_bw_alloc_config.sink_allocated_bw = bw_needed; - - link->dpia_bw_alloc_config.response_ready = true; - break; - - case DPIA_EST_BW_CHANGED: - -- DC_LOG_DEBUG("%s: *** ESTIMATED BW CHANGED for DP-TX Request ***\n", __func__); -- - estimated = bw * (Kbps_TO_Gbps / link->dpia_bw_alloc_config.bw_granularity); -- host_router_total_estimated_bw = get_host_router_total_bw(link, HOST_ROUTER_BW_ESTIMATED); - -- // 1. If due to unplug of other sink -- if (estimated == host_router_total_estimated_bw) { -- // First update the estimated & max_bw fields -- if (link->dpia_bw_alloc_config.estimated_bw < estimated) -- link->dpia_bw_alloc_config.estimated_bw = estimated; -- } -- // 2. If due to realloc bw btw 2 dpia due to plug OR realloc unused Bw -- else { -- // We lost estimated bw usually due to plug event of other dpia -- link->dpia_bw_alloc_config.estimated_bw = estimated; -- } -+ DC_LOG_DEBUG("%s: ESTIMATED BW CHANGED for link(%d)\n", -+ __func__, link->link_index); -+ DC_LOG_DEBUG("%s: current estimated_bw(%d), new estimated_bw(%d)\n", -+ __func__, link->dpia_bw_alloc_config.estimated_bw, estimated); -+ -+ link->dpia_bw_alloc_config.estimated_bw = estimated; - break; - - case DPIA_BW_ALLOC_CAPS_CHANGED: - -- DC_LOG_DEBUG("%s: *** BW ALLOC CAPABILITY CHANGED for DP-TX Request ***\n", __func__); -+ DC_LOG_ERROR("%s: BW ALLOC CAPABILITY CHANGED to Disabled for link(%d)\n", -+ __func__, link->link_index); - link->dpia_bw_alloc_config.bw_alloc_enabled = false; - break; - } -@@ -409,11 +387,11 @@ int dpia_handle_usb4_bandwidth_allocation_for_link(struct dc_link *link, int pea - set_usb4_req_bw_req(link, link->dpia_bw_alloc_config.sink_max_bw); - - do { -- if (!(timeout > 0)) -+ if (timeout > 0) - timeout--; - else - break; -- fsleep(10 * 1000); -+ msleep(10); - } while (!get_cm_response_ready_flag(link)); - - if (!timeout) -@@ -428,37 +406,36 @@ int dpia_handle_usb4_bandwidth_allocation_for_link(struct dc_link *link, int pea - out: - return ret; - } --int link_dp_dpia_allocate_usb4_bandwidth_for_stream(struct dc_link *link, int req_bw) -+ -+bool link_dp_dpia_allocate_usb4_bandwidth_for_stream(struct dc_link *link, int req_bw) - { -- int ret = 0; -+ bool ret = false; - uint8_t timeout = 10; - -+ DC_LOG_DEBUG("%s: ENTER: link(%d), hpd_status(%d), current allocated_bw(%d), req_bw(%d)\n", -+ __func__, link->link_index, link->hpd_status, -+ link->dpia_bw_alloc_config.sink_allocated_bw, req_bw); -+ - if (!get_bw_alloc_proceed_flag(link)) - goto out; - -- /* -- * Sometimes stream uses same timing parameters as the already -- * allocated max sink bw so no need to re-alloc -- */ -- if (req_bw != link->dpia_bw_alloc_config.sink_allocated_bw) { -- set_usb4_req_bw_req(link, req_bw); -- do { -- if (!(timeout > 0)) -- timeout--; -- else -- break; -- udelay(10 * 1000); -- } while (!get_cm_response_ready_flag(link)); -+ set_usb4_req_bw_req(link, req_bw); -+ do { -+ if (timeout > 0) -+ timeout--; -+ else -+ break; -+ msleep(10); -+ } while (!get_cm_response_ready_flag(link)); - -- if (!timeout) -- ret = 0;// ERROR TIMEOUT waiting for response for allocating bw -- else if (link->dpia_bw_alloc_config.sink_allocated_bw > 0) -- ret = get_host_router_total_bw(link, HOST_ROUTER_BW_ALLOCATED); -- } -+ if (timeout) -+ ret = true; - - out: -+ DC_LOG_DEBUG("%s: EXIT: timeout(%d), ret(%d)\n", __func__, timeout, ret); - return ret; - } -+ - bool dpia_validate_usb4_bw(struct dc_link **link, int *bw_needed_per_dpia, const unsigned int num_dpias) - { - bool ret = true; -diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.h b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.h -index 7292690383ae..981bc4eb6120 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.h -+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.h -@@ -59,9 +59,9 @@ bool link_dp_dpia_set_dptx_usb4_bw_alloc_support(struct dc_link *link); - * @link: pointer to the dc_link struct instance - * @req_bw: Bw requested by the stream - * -- * return: allocated bw else return 0 -+ * return: true if allocated successfully - */ --int link_dp_dpia_allocate_usb4_bandwidth_for_stream(struct dc_link *link, int req_bw); -+bool link_dp_dpia_allocate_usb4_bandwidth_for_stream(struct dc_link *link, int req_bw); - - /* - * Handle the USB4 BW Allocation related functionality here: --- -2.43.2 - -From 03d5ec901a2377920990e4bf157b82564e7f78a6 Mon Sep 17 00:00:00 2001 -From: Felix Kuehling <Felix.Kuehling@amd.com> -Date: Mon, 18 Dec 2023 16:17:23 -0500 -Subject: [PATCH 1243/1501] drm/amdgpu: Let KFD sync with VM fences -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1258 -Lines: 31 - -[ Upstream commit ec9ba4821fa52b5efdbc4cdf0a77497990655231 ] - -Change the rules for amdgpu_sync_resv to let KFD synchronize with VM -fences on page table reservations. This fixes intermittent memory -corruption after evictions when using amdgpu_vm_handle_moved to update -page tables for VM mappings managed through render nodes. - -Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com> -Reviewed-by: Christian König <christian.koenig@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c -index dcd8c066bc1f..1b013a44ca99 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c -@@ -191,7 +191,8 @@ static bool amdgpu_sync_test_fence(struct amdgpu_device *adev, - - /* Never sync to VM updates either. */ - if (fence_owner == AMDGPU_FENCE_OWNER_VM && -- owner != AMDGPU_FENCE_OWNER_UNDEFINED) -+ owner != AMDGPU_FENCE_OWNER_UNDEFINED && -+ owner != AMDGPU_FENCE_OWNER_KFD) - return false; - - /* Ignore fences depending on the sync mode */ --- -2.43.2 - -From 8a89fc4f75c0c0b49321d12558b8a846d6419408 Mon Sep 17 00:00:00 2001 -From: Ivan Lipski <ivlipski@amd.com> -Date: Mon, 2 Oct 2023 13:47:54 -0400 -Subject: [PATCH 1244/1501] Re-revert "drm/amd/display: Enable Replay for - static screen use cases" -Content-Length: 5062 -Lines: 132 - -[ Upstream commit d6398866a6b47e92319ef6efdb0126a4fbb7796a ] - -This reverts commit 44e60b14d5a72f91fd0bdeae8da59ae37a3ca8e5. - -Since, it causes a regression in which eDP displays with PSR support, -but no Replay support (Sink support <= 0x03), fail to enable PSR and -consequently all IGT amd_psr tests fail. So, revert this until a more -suitable fix can be found. - -This got brought back accidently with the backmerge. - -Acked-by: Leo Li <sunpeng.li@amd.com> -Signed-off-by: Ivan Lipski <ivlipski@amd.com> -Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 22 ------------------- - .../amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 9 +------- - drivers/gpu/drm/amd/include/amd_shared.h | 2 -- - 3 files changed, 1 insertion(+), 32 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 9dbbaeb8c6cf..6f7d7f79ef89 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -65,7 +65,6 @@ - #include "amdgpu_dm_debugfs.h" - #endif - #include "amdgpu_dm_psr.h" --#include "amdgpu_dm_replay.h" - - #include "ivsrcid/ivsrcid_vislands30.h" - -@@ -4348,7 +4347,6 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev) - enum dc_connection_type new_connection_type = dc_connection_none; - const struct dc_plane_cap *plane; - bool psr_feature_enabled = false; -- bool replay_feature_enabled = false; - int max_overlay = dm->dc->caps.max_slave_planes; - - dm->display_indexes_num = dm->dc->caps.max_streams; -@@ -4460,20 +4458,6 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev) - } - } - -- if (!(amdgpu_dc_debug_mask & DC_DISABLE_REPLAY)) { -- switch (adev->ip_versions[DCE_HWIP][0]) { -- case IP_VERSION(3, 1, 4): -- case IP_VERSION(3, 1, 5): -- case IP_VERSION(3, 1, 6): -- case IP_VERSION(3, 2, 0): -- case IP_VERSION(3, 2, 1): -- replay_feature_enabled = true; -- break; -- default: -- replay_feature_enabled = amdgpu_dc_feature_mask & DC_REPLAY_MASK; -- break; -- } -- } - /* loops over all connectors on the board */ - for (i = 0; i < link_cnt; i++) { - struct dc_link *link = NULL; -@@ -4522,12 +4506,6 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev) - amdgpu_dm_update_connector_after_detect(aconnector); - setup_backlight_device(dm, aconnector); - -- /* -- * Disable psr if replay can be enabled -- */ -- if (replay_feature_enabled && amdgpu_dm_setup_replay(link, aconnector)) -- psr_feature_enabled = false; -- - if (psr_feature_enabled) - amdgpu_dm_set_psr_caps(link); - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c -index cb0b48bb2a7d..d2834ad85a54 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c -@@ -29,7 +29,6 @@ - #include "dc.h" - #include "amdgpu.h" - #include "amdgpu_dm_psr.h" --#include "amdgpu_dm_replay.h" - #include "amdgpu_dm_crtc.h" - #include "amdgpu_dm_plane.h" - #include "amdgpu_dm_trace.h" -@@ -124,12 +123,7 @@ static void amdgpu_dm_crtc_vblank_control_worker(struct work_struct *work) - * fill_dc_dirty_rects(). - */ - if (vblank_work->stream && vblank_work->stream->link) { -- /* -- * Prioritize replay, instead of psr -- */ -- if (vblank_work->stream->link->replay_settings.replay_feature_enabled) -- amdgpu_dm_replay_enable(vblank_work->stream, false); -- else if (vblank_work->enable) { -+ if (vblank_work->enable) { - if (vblank_work->stream->link->psr_settings.psr_version < DC_PSR_VERSION_SU_1 && - vblank_work->stream->link->psr_settings.psr_allow_active) - amdgpu_dm_psr_disable(vblank_work->stream); -@@ -138,7 +132,6 @@ static void amdgpu_dm_crtc_vblank_control_worker(struct work_struct *work) - #ifdef CONFIG_DRM_AMD_SECURE_DISPLAY - !amdgpu_dm_crc_window_is_activated(&vblank_work->acrtc->base) && - #endif -- vblank_work->stream->link->panel_config.psr.disallow_replay && - vblank_work->acrtc->dm_irq_params.allow_psr_entry) { - amdgpu_dm_psr_enable(vblank_work->stream); - } -diff --git a/drivers/gpu/drm/amd/include/amd_shared.h b/drivers/gpu/drm/amd/include/amd_shared.h -index 7f98394338c2..579977f6ad52 100644 ---- a/drivers/gpu/drm/amd/include/amd_shared.h -+++ b/drivers/gpu/drm/amd/include/amd_shared.h -@@ -244,7 +244,6 @@ enum DC_FEATURE_MASK { - DC_DISABLE_LTTPR_DP2_0 = (1 << 6), //0x40, disabled by default - DC_PSR_ALLOW_SMU_OPT = (1 << 7), //0x80, disabled by default - DC_PSR_ALLOW_MULTI_DISP_OPT = (1 << 8), //0x100, disabled by default -- DC_REPLAY_MASK = (1 << 9), //0x200, disabled by default for dcn < 3.1.4 - }; - - enum DC_DEBUG_MASK { -@@ -255,7 +254,6 @@ enum DC_DEBUG_MASK { - DC_DISABLE_PSR = 0x10, - DC_FORCE_SUBVP_MCLK_SWITCH = 0x20, - DC_DISABLE_MPO = 0x40, -- DC_DISABLE_REPLAY = 0x50, - DC_ENABLE_DPIA_TRACE = 0x80, - }; - --- -2.43.2 - -From 195a6289282e039024ad30ba66e6f94a4d0fbe49 Mon Sep 17 00:00:00 2001 -From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Date: Tue, 26 Dec 2023 15:32:19 +0530 -Subject: [PATCH 1245/1501] drm/amdgpu: Fix possible NULL dereference in - amdgpu_ras_query_error_status_helper() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1423 -Lines: 37 - -[ Upstream commit b8d55a90fd55b767c25687747e2b24abd1ef8680 ] - -Return invalid error code -EINVAL for invalid block id. - -Fixes the below: - -drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c:1183 amdgpu_ras_query_error_status_helper() error: we previously assumed 'info' could be null (see line 1176) - -Suggested-by: Hawking Zhang <Hawking.Zhang@amd.com> -Cc: Tao Zhou <tao.zhou1@amd.com> -Cc: Hawking Zhang <Hawking.Zhang@amd.com> -Cc: Christian König <christian.koenig@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c -index 63fb4cd85e53..4a3726bb6da1 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c -@@ -1174,6 +1174,9 @@ static int amdgpu_ras_query_error_status_helper(struct amdgpu_device *adev, - enum amdgpu_ras_block blk = info ? info->head.block : AMDGPU_RAS_BLOCK_COUNT; - struct amdgpu_ras_block_object *block_obj = NULL; - -+ if (blk == AMDGPU_RAS_BLOCK_COUNT) -+ return -EINVAL; -+ - if (error_query_mode == AMDGPU_RAS_INVALID_ERROR_QUERY) - return -EINVAL; - --- -2.43.2 - -From 7b5d58c07024516c0e81b95e98f37710cf402c53 Mon Sep 17 00:00:00 2001 -From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Date: Wed, 3 Jan 2024 22:05:16 +0530 -Subject: [PATCH 1246/1501] drm/amdgpu: Fix variable 'mca_funcs' dereferenced - before NULL check in 'amdgpu_mca_smu_get_mca_entry()' -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2576 -Lines: 79 - -[ Upstream commit 4f32504a2f85a7b40fe149436881381f48e9c0c0 ] - -Fixes the below: - -drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c:377 amdgpu_mca_smu_get_mca_entry() warn: variable dereferenced before check 'mca_funcs' (see line 368) - -357 int amdgpu_mca_smu_get_mca_entry(struct amdgpu_device *adev, - enum amdgpu_mca_error_type type, -358 int idx, struct mca_bank_entry *entry) -359 { -360 const struct amdgpu_mca_smu_funcs *mca_funcs = - adev->mca.mca_funcs; -361 int count; -362 -363 switch (type) { -364 case AMDGPU_MCA_ERROR_TYPE_UE: -365 count = mca_funcs->max_ue_count; - -mca_funcs is dereferenced here. - -366 break; -367 case AMDGPU_MCA_ERROR_TYPE_CE: -368 count = mca_funcs->max_ce_count; - -mca_funcs is dereferenced here. - -369 break; -370 default: -371 return -EINVAL; -372 } -373 -374 if (idx >= count) -375 return -EINVAL; -376 -377 if (mca_funcs && mca_funcs->mca_get_mca_entry) - ^^^^^^^^^ - -Checked too late! - -Cc: Yang Wang <kevinyang.wang@amd.com> -Cc: Hawking Zhang <Hawking.Zhang@amd.com> -Cc: Christian König <christian.koenig@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Reviewed-by: Yang Wang <kevinyang.wang@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c -index cf33eb219e25..061d88f4480d 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c -@@ -351,6 +351,9 @@ int amdgpu_mca_smu_get_mca_entry(struct amdgpu_device *adev, enum amdgpu_mca_err - const struct amdgpu_mca_smu_funcs *mca_funcs = adev->mca.mca_funcs; - int count; - -+ if (!mca_funcs || !mca_funcs->mca_get_mca_entry) -+ return -EOPNOTSUPP; -+ - switch (type) { - case AMDGPU_MCA_ERROR_TYPE_UE: - count = mca_funcs->max_ue_count; -@@ -365,10 +368,7 @@ int amdgpu_mca_smu_get_mca_entry(struct amdgpu_device *adev, enum amdgpu_mca_err - if (idx >= count) - return -EINVAL; - -- if (mca_funcs && mca_funcs->mca_get_mca_entry) -- return mca_funcs->mca_get_mca_entry(adev, type, idx, entry); -- -- return -EOPNOTSUPP; -+ return mca_funcs->mca_get_mca_entry(adev, type, idx, entry); - } - - #if defined(CONFIG_DEBUG_FS) --- -2.43.2 - -From ed145ab7381eff99c263089d876867daeb3b8112 Mon Sep 17 00:00:00 2001 -From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Date: Wed, 3 Jan 2024 22:22:44 +0530 -Subject: [PATCH 1247/1501] drm/amdgpu: Fix '*fw' from request_firmware() not - released in 'amdgpu_ucode_request()' -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1299 -Lines: 38 - -[ Upstream commit 13a1851f923d9a7a78a477497295c2dfd16ad4a4 ] - -Fixes the below: -drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c:1404 amdgpu_ucode_request() warn: '*fw' from request_firmware() not released on lines: 1404. - -Cc: Mario Limonciello <mario.limonciello@amd.com> -Cc: Lijo Lazar <lijo.lazar@amd.com> -Cc: Christian König <christian.koenig@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Reviewed-by: Christian König <christian.koenig@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c -index b14127429f30..0efb2568cb65 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c -@@ -1397,9 +1397,13 @@ int amdgpu_ucode_request(struct amdgpu_device *adev, const struct firmware **fw, - - if (err) - return -ENODEV; -+ - err = amdgpu_ucode_validate(*fw); -- if (err) -+ if (err) { - dev_dbg(adev->dev, "\"%s\" failed to validate\n", fw_name); -+ release_firmware(*fw); -+ *fw = NULL; -+ } - - return err; - } --- -2.43.2 - -From a26a9b16c469c018f2bf8cc422a92091aec38a46 Mon Sep 17 00:00:00 2001 -From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Date: Wed, 27 Dec 2023 12:54:44 +0530 -Subject: [PATCH 1248/1501] drm/amdgpu: Drop 'fence' check in - 'to_amdgpu_amdkfd_fence()' -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1334 -Lines: 34 - -[ Upstream commit bf2ad4fb8adca89374b54b225d494e0b1956dbea ] - -Return value of container_of(...) can't be null, so null check is not -required for 'fence'. Hence drop its NULL check. - -Fixes the below: -drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c:93 to_amdgpu_amdkfd_fence() warn: can 'fence' even be NULL? - -Cc: Felix Kuehling <Felix.Kuehling@amd.com> -Cc: Christian König <christian.koenig@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c -index 469785d33791..1ef758ac5076 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c -@@ -90,7 +90,7 @@ struct amdgpu_amdkfd_fence *to_amdgpu_amdkfd_fence(struct dma_fence *f) - return NULL; - - fence = container_of(f, struct amdgpu_amdkfd_fence, base); -- if (fence && f->ops == &amdkfd_fence_ops) -+ if (f->ops == &amdkfd_fence_ops) - return fence; - - return NULL; --- -2.43.2 - -From 0b2672804eba6234599a89b2295d356eed7c26f8 Mon Sep 17 00:00:00 2001 -From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Date: Fri, 29 Dec 2023 15:07:09 +0530 -Subject: [PATCH 1249/1501] drm/amdkfd: Fix iterator used outside loop in - 'kfd_add_peer_prop()' -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2103 -Lines: 52 - -[ Upstream commit b1a428b45dc7e47c7acc2ad0d08d8a6dda910c4c ] - -Fix the following about iterator use: -drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1456 kfd_add_peer_prop() warn: iterator used outside loop: 'iolink3' - -Cc: Felix Kuehling <Felix.Kuehling@amd.com> -Cc: Christian König <christian.koenig@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 22 ++++++++++++---------- - 1 file changed, 12 insertions(+), 10 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c -index 58d775a0668d..e5f7c92eebcb 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c -@@ -1452,17 +1452,19 @@ static int kfd_add_peer_prop(struct kfd_topology_device *kdev, - /* CPU->CPU link*/ - cpu_dev = kfd_topology_device_by_proximity_domain(iolink1->node_to); - if (cpu_dev) { -- list_for_each_entry(iolink3, &cpu_dev->io_link_props, list) -- if (iolink3->node_to == iolink2->node_to) -- break; -+ list_for_each_entry(iolink3, &cpu_dev->io_link_props, list) { -+ if (iolink3->node_to != iolink2->node_to) -+ continue; - -- props->weight += iolink3->weight; -- props->min_latency += iolink3->min_latency; -- props->max_latency += iolink3->max_latency; -- props->min_bandwidth = min(props->min_bandwidth, -- iolink3->min_bandwidth); -- props->max_bandwidth = min(props->max_bandwidth, -- iolink3->max_bandwidth); -+ props->weight += iolink3->weight; -+ props->min_latency += iolink3->min_latency; -+ props->max_latency += iolink3->max_latency; -+ props->min_bandwidth = min(props->min_bandwidth, -+ iolink3->min_bandwidth); -+ props->max_bandwidth = min(props->max_bandwidth, -+ iolink3->max_bandwidth); -+ break; -+ } - } else { - WARN(1, "CPU node not found"); - } --- -2.43.2 - -From 180357b6d2756a137281dea219fb490cb621eb04 Mon Sep 17 00:00:00 2001 -From: Alex Deucher <alexander.deucher@amd.com> -Date: Wed, 3 Jan 2024 11:55:53 -0500 -Subject: [PATCH 1250/1501] drm/amdgpu: apply the RV2 system aperture fix to - RN/CZN as well -Content-Length: 4259 -Lines: 89 - -[ Upstream commit 16783d8ef08448815e149e40c82fc1e1fc41ddbf ] - -These chips needs the same fix. This was previously not seen -on then since the AGP aperture expanded the system aperture, -but this showed up again when AGP was disabled. - -Reviewed-and-tested-by: Jiadong Zhu <Jiadong.Zhu@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c | 4 +++- - drivers/gpu/drm/amd/amdgpu/gfxhub_v1_2.c | 4 +++- - drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c | 4 +++- - drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 ++++++-- - 4 files changed, 15 insertions(+), 5 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c b/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c -index 53a2ba5fcf4b..22175da0e16a 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c -@@ -102,7 +102,9 @@ static void gfxhub_v1_0_init_system_aperture_regs(struct amdgpu_device *adev) - WREG32_SOC15_RLC(GC, 0, mmMC_VM_SYSTEM_APERTURE_LOW_ADDR, - min(adev->gmc.fb_start, adev->gmc.agp_start) >> 18); - -- if (adev->apu_flags & AMD_APU_IS_RAVEN2) -+ if (adev->apu_flags & (AMD_APU_IS_RAVEN2 | -+ AMD_APU_IS_RENOIR | -+ AMD_APU_IS_GREEN_SARDINE)) - /* - * Raven2 has a HW issue that it is unable to use the - * vram which is out of MC_VM_SYSTEM_APERTURE_HIGH_ADDR. -diff --git a/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_2.c b/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_2.c -index 55423ff1bb49..95d06da544e2 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_2.c -+++ b/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_2.c -@@ -139,7 +139,9 @@ gfxhub_v1_2_xcc_init_system_aperture_regs(struct amdgpu_device *adev, - WREG32_SOC15_RLC(GC, GET_INST(GC, i), regMC_VM_SYSTEM_APERTURE_LOW_ADDR, - min(adev->gmc.fb_start, adev->gmc.agp_start) >> 18); - -- if (adev->apu_flags & AMD_APU_IS_RAVEN2) -+ if (adev->apu_flags & (AMD_APU_IS_RAVEN2 | -+ AMD_APU_IS_RENOIR | -+ AMD_APU_IS_GREEN_SARDINE)) - /* - * Raven2 has a HW issue that it is unable to use the - * vram which is out of MC_VM_SYSTEM_APERTURE_HIGH_ADDR. -diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c -index 843219a91736..e3ddd22aa172 100644 ---- a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c -@@ -96,7 +96,9 @@ static void mmhub_v1_0_init_system_aperture_regs(struct amdgpu_device *adev) - WREG32_SOC15(MMHUB, 0, mmMC_VM_SYSTEM_APERTURE_LOW_ADDR, - min(adev->gmc.fb_start, adev->gmc.agp_start) >> 18); - -- if (adev->apu_flags & AMD_APU_IS_RAVEN2) -+ if (adev->apu_flags & (AMD_APU_IS_RAVEN2 | -+ AMD_APU_IS_RENOIR | -+ AMD_APU_IS_GREEN_SARDINE)) - /* - * Raven2 has a HW issue that it is unable to use the vram which - * is out of MC_VM_SYSTEM_APERTURE_HIGH_ADDR. So here is the -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 6f7d7f79ef89..affc628004ff 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -1257,7 +1257,9 @@ static void mmhub_read_system_context(struct amdgpu_device *adev, struct dc_phy_ - /* AGP aperture is disabled */ - if (agp_bot > agp_top) { - logical_addr_low = adev->gmc.fb_start >> 18; -- if (adev->apu_flags & AMD_APU_IS_RAVEN2) -+ if (adev->apu_flags & (AMD_APU_IS_RAVEN2 | -+ AMD_APU_IS_RENOIR | -+ AMD_APU_IS_GREEN_SARDINE)) - /* - * Raven2 has a HW issue that it is unable to use the vram which - * is out of MC_VM_SYSTEM_APERTURE_HIGH_ADDR. So here is the -@@ -1269,7 +1271,9 @@ static void mmhub_read_system_context(struct amdgpu_device *adev, struct dc_phy_ - logical_addr_high = adev->gmc.fb_end >> 18; - } else { - logical_addr_low = min(adev->gmc.fb_start, adev->gmc.agp_start) >> 18; -- if (adev->apu_flags & AMD_APU_IS_RAVEN2) -+ if (adev->apu_flags & (AMD_APU_IS_RAVEN2 | -+ AMD_APU_IS_RENOIR | -+ AMD_APU_IS_GREEN_SARDINE)) - /* - * Raven2 has a HW issue that it is unable to use the vram which - * is out of MC_VM_SYSTEM_APERTURE_HIGH_ADDR. So here is the --- -2.43.2 - -From b84c91d34b4454a329951d14a6ed45b453591216 Mon Sep 17 00:00:00 2001 -From: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Date: Wed, 22 Nov 2023 19:50:36 +0200 -Subject: [PATCH 1252/1501] pinctrl: baytrail: Fix types of config value in - byt_pin_config_set() -Content-Length: 1258 -Lines: 34 - -[ Upstream commit 1a856a22e6036c5f0d6da7568b4550270f989038 ] - -When unpacked, the config value is split to two of different types. -Fix the types accordingly. - -Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> -Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/pinctrl/intel/pinctrl-baytrail.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c -index 3cd0798ee631..f1af21dbd5fb 100644 ---- a/drivers/pinctrl/intel/pinctrl-baytrail.c -+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c -@@ -918,13 +918,14 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev, - unsigned int num_configs) - { - struct intel_pinctrl *vg = pinctrl_dev_get_drvdata(pctl_dev); -- unsigned int param, arg; - void __iomem *conf_reg = byt_gpio_reg(vg, offset, BYT_CONF0_REG); - void __iomem *val_reg = byt_gpio_reg(vg, offset, BYT_VAL_REG); - void __iomem *db_reg = byt_gpio_reg(vg, offset, BYT_DEBOUNCE_REG); - u32 conf, val, db_pulse, debounce; -+ enum pin_config_param param; - unsigned long flags; - int i, ret = 0; -+ u32 arg; - - raw_spin_lock_irqsave(&byt_lock, flags); - --- -2.43.2 - -From a42a9307aef242a7e916facd29e8884f97aff336 Mon Sep 17 00:00:00 2001 -From: Heiner Kallweit <hkallweit1@gmail.com> -Date: Sat, 16 Dec 2023 21:05:33 +0100 -Subject: [PATCH 1253/1501] leds: trigger: panic: Don't register panic notifier - if creating the trigger failed -Content-Length: 1089 -Lines: 34 - -[ Upstream commit afacb21834bb02785ddb0c3ec197208803b74faa ] - -It doesn't make sense to register the panic notifier if creating the -panic trigger failed. - -Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> -Link: https://lore.kernel.org/r/8a61e229-5388-46c7-919a-4d18cc7362b2@gmail.com -Signed-off-by: Lee Jones <lee@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/leds/trigger/ledtrig-panic.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/drivers/leds/trigger/ledtrig-panic.c b/drivers/leds/trigger/ledtrig-panic.c -index 64abf2e91608..5a6b21bfeb9a 100644 ---- a/drivers/leds/trigger/ledtrig-panic.c -+++ b/drivers/leds/trigger/ledtrig-panic.c -@@ -64,10 +64,13 @@ static long led_panic_blink(int state) - - static int __init ledtrig_panic_init(void) - { -+ led_trigger_register_simple("panic", &trigger); -+ if (!trigger) -+ return -ENOMEM; -+ - atomic_notifier_chain_register(&panic_notifier_list, - &led_trigger_panic_nb); - -- led_trigger_register_simple("panic", &trigger); - panic_blink = led_panic_blink; - return 0; - } --- -2.43.2 - -From 9d44712788ef4814487ab8574f2422a6f2108ec5 Mon Sep 17 00:00:00 2001 -From: Anton Ivanov <anton.ivanov@cambridgegreys.com> -Date: Thu, 21 Sep 2023 15:34:44 +0100 -Subject: [PATCH 1254/1501] um: Fix naming clash between UML and scheduler -Content-Length: 2675 -Lines: 74 - -[ Upstream commit 541d4e4d435c8b9bfd29f70a1da4a2db97794e0a ] - -__cant_sleep was already used and exported by the scheduler. -The name had to be changed to a UML specific one. - -Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com> -Reviewed-by: Peter Lafreniere <peter@n8pjl.ca> -Signed-off-by: Richard Weinberger <richard@nod.at> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/um/include/shared/kern_util.h | 2 +- - arch/um/kernel/process.c | 2 +- - arch/um/os-Linux/helper.c | 6 +++--- - 3 files changed, 5 insertions(+), 5 deletions(-) - -diff --git a/arch/um/include/shared/kern_util.h b/arch/um/include/shared/kern_util.h -index d8b8b4f07e42..444bae755b16 100644 ---- a/arch/um/include/shared/kern_util.h -+++ b/arch/um/include/shared/kern_util.h -@@ -50,7 +50,7 @@ extern void do_uml_exitcalls(void); - * Are we disallowed to sleep? Used to choose between GFP_KERNEL and - * GFP_ATOMIC. - */ --extern int __cant_sleep(void); -+extern int __uml_cant_sleep(void); - extern int get_current_pid(void); - extern int copy_from_user_proc(void *to, void *from, int size); - extern char *uml_strdup(const char *string); -diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c -index 106b7da2f8d6..6daffb9d8a8d 100644 ---- a/arch/um/kernel/process.c -+++ b/arch/um/kernel/process.c -@@ -220,7 +220,7 @@ void arch_cpu_idle(void) - um_idle_sleep(); - } - --int __cant_sleep(void) { -+int __uml_cant_sleep(void) { - return in_atomic() || irqs_disabled() || in_interrupt(); - /* Is in_interrupt() really needed? */ - } -diff --git a/arch/um/os-Linux/helper.c b/arch/um/os-Linux/helper.c -index b459745f52e2..3cb8ac63be6e 100644 ---- a/arch/um/os-Linux/helper.c -+++ b/arch/um/os-Linux/helper.c -@@ -46,7 +46,7 @@ int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv) - unsigned long stack, sp; - int pid, fds[2], ret, n; - -- stack = alloc_stack(0, __cant_sleep()); -+ stack = alloc_stack(0, __uml_cant_sleep()); - if (stack == 0) - return -ENOMEM; - -@@ -70,7 +70,7 @@ int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv) - data.pre_data = pre_data; - data.argv = argv; - data.fd = fds[1]; -- data.buf = __cant_sleep() ? uml_kmalloc(PATH_MAX, UM_GFP_ATOMIC) : -+ data.buf = __uml_cant_sleep() ? uml_kmalloc(PATH_MAX, UM_GFP_ATOMIC) : - uml_kmalloc(PATH_MAX, UM_GFP_KERNEL); - pid = clone(helper_child, (void *) sp, CLONE_VM, &data); - if (pid < 0) { -@@ -121,7 +121,7 @@ int run_helper_thread(int (*proc)(void *), void *arg, unsigned int flags, - unsigned long stack, sp; - int pid, status, err; - -- stack = alloc_stack(0, __cant_sleep()); -+ stack = alloc_stack(0, __uml_cant_sleep()); - if (stack == 0) - return -ENOMEM; - --- -2.43.2 - -From dcfd9ceb7338a53f988a39bcb67a3f831bcc7c78 Mon Sep 17 00:00:00 2001 -From: Benjamin Berg <benjamin@sipsolutions.net> -Date: Fri, 10 Nov 2023 12:03:41 +0100 -Subject: [PATCH 1255/1501] um: Don't use vfprintf() for os_info() -Content-Length: 1814 -Lines: 64 - -[ Upstream commit 236f9fe39b02c15fa5530b53e9cca48354394389 ] - -The threads allocated inside the kernel have only a single page of -stack. Unfortunately, the vfprintf function in standard glibc may use -too much stack-space, overflowing it. - -To make os_info safe to be used by helper threads, use the kernel -vscnprintf function into a smallish buffer and write out the information -to stderr. - -Signed-off-by: Benjamin Berg <benjamin@sipsolutions.net> -Signed-off-by: Richard Weinberger <richard@nod.at> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/um/os-Linux/util.c | 19 +++++++++++++++++-- - 1 file changed, 17 insertions(+), 2 deletions(-) - -diff --git a/arch/um/os-Linux/util.c b/arch/um/os-Linux/util.c -index fc0f2a9dee5a..1dca4ffbd572 100644 ---- a/arch/um/os-Linux/util.c -+++ b/arch/um/os-Linux/util.c -@@ -173,23 +173,38 @@ __uml_setup("quiet", quiet_cmd_param, - "quiet\n" - " Turns off information messages during boot.\n\n"); - -+/* -+ * The os_info/os_warn functions will be called by helper threads. These -+ * have a very limited stack size and using the libc formatting functions -+ * may overflow the stack. -+ * So pull in the kernel vscnprintf and use that instead with a fixed -+ * on-stack buffer. -+ */ -+int vscnprintf(char *buf, size_t size, const char *fmt, va_list args); -+ - void os_info(const char *fmt, ...) - { -+ char buf[256]; - va_list list; -+ int len; - - if (quiet_info) - return; - - va_start(list, fmt); -- vfprintf(stderr, fmt, list); -+ len = vscnprintf(buf, sizeof(buf), fmt, list); -+ fwrite(buf, len, 1, stderr); - va_end(list); - } - - void os_warn(const char *fmt, ...) - { -+ char buf[256]; - va_list list; -+ int len; - - va_start(list, fmt); -- vfprintf(stderr, fmt, list); -+ len = vscnprintf(buf, sizeof(buf), fmt, list); -+ fwrite(buf, len, 1, stderr); - va_end(list); - } --- -2.43.2 - -From 96cec20795cf563a11ebf361f498c5e279603d32 Mon Sep 17 00:00:00 2001 -From: Nathan Chancellor <nathan@kernel.org> -Date: Wed, 6 Dec 2023 09:49:46 -0700 -Subject: [PATCH 1256/1501] um: net: Fix return type of uml_net_start_xmit() -Content-Length: 2243 -Lines: 45 - -[ Upstream commit 7d748f60a4b82b50bf25fad1bd42d33f049f76aa ] - -With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), -indirect call targets are validated against the expected function -pointer prototype to make sure the call target is valid to help mitigate -ROP attacks. If they are not identical, there is a failure at run time, -which manifests as either a kernel panic or thread getting killed. A -warning in clang aims to catch these at compile time, which reveals: - - arch/um/drivers/net_kern.c:353:21: warning: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Wincompatible-function-pointer-types-strict] - 353 | .ndo_start_xmit = uml_net_start_xmit, - | ^~~~~~~~~~~~~~~~~~ - 1 warning generated. - -->ndo_start_xmit() in 'struct net_device_ops' expects a return type of -'netdev_tx_t', not 'int'. Adjust the return type of uml_net_start_xmit() -to match the prototype's to resolve the warning. While UML does not -currently implement support for kCFI, it could in the future, which -means this warning becomes a fatal CFI failure at run time. - -Reported-by: kernel test robot <lkp@intel.com> -Closes: https://lore.kernel.org/oe-kbuild-all/202310031340.v1vPh207-lkp@intel.com/ -Acked-by: Anton Ivanov <anton.ivanov@cambridgegreys.com> -Signed-off-by: Nathan Chancellor <nathan@kernel.org> -Signed-off-by: Richard Weinberger <richard@nod.at> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/um/drivers/net_kern.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/um/drivers/net_kern.c b/arch/um/drivers/net_kern.c -index 3d7836c46507..cabcc501b448 100644 ---- a/arch/um/drivers/net_kern.c -+++ b/arch/um/drivers/net_kern.c -@@ -204,7 +204,7 @@ static int uml_net_close(struct net_device *dev) - return 0; - } - --static int uml_net_start_xmit(struct sk_buff *skb, struct net_device *dev) -+static netdev_tx_t uml_net_start_xmit(struct sk_buff *skb, struct net_device *dev) - { - struct uml_net_private *lp = netdev_priv(dev); - unsigned long flags; --- -2.43.2 - -From b427f55e9d4185f6f17cc1e3296eb8d0c4425283 Mon Sep 17 00:00:00 2001 -From: Johannes Berg <johannes.berg@intel.com> -Date: Wed, 25 Oct 2023 22:45:05 +0200 -Subject: [PATCH 1257/1501] um: time-travel: fix time corruption -Content-Length: 2812 -Lines: 85 - -[ Upstream commit abe4eaa8618bb36c2b33e9cdde0499296a23448c ] - -In 'basic' time-travel mode (without =inf-cpu or =ext), we -still get timer interrupts. These can happen at arbitrary -points in time, i.e. while in timer_read(), which pushes -time forward just a little bit. Then, if we happen to get -the interrupt after calculating the new time to push to, -but before actually finishing that, the interrupt will set -the time to a value that's incompatible with the forward, -and we'll crash because time goes backwards when we do the -forwarding. - -Fix this by reading the time_travel_time, calculating the -adjustment, and doing the adjustment all with interrupts -disabled. - -Reported-by: Vincent Whitchurch <Vincent.Whitchurch@axis.com> -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Richard Weinberger <richard@nod.at> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/um/kernel/time.c | 32 +++++++++++++++++++++++++++----- - 1 file changed, 27 insertions(+), 5 deletions(-) - -diff --git a/arch/um/kernel/time.c b/arch/um/kernel/time.c -index fddd1dec27e6..3e270da6b6f6 100644 ---- a/arch/um/kernel/time.c -+++ b/arch/um/kernel/time.c -@@ -432,9 +432,29 @@ static void time_travel_update_time(unsigned long long next, bool idle) - time_travel_del_event(&ne); - } - -+static void time_travel_update_time_rel(unsigned long long offs) -+{ -+ unsigned long flags; -+ -+ /* -+ * Disable interrupts before calculating the new time so -+ * that a real timer interrupt (signal) can't happen at -+ * a bad time e.g. after we read time_travel_time but -+ * before we've completed updating the time. -+ */ -+ local_irq_save(flags); -+ time_travel_update_time(time_travel_time + offs, false); -+ local_irq_restore(flags); -+} -+ - void time_travel_ndelay(unsigned long nsec) - { -- time_travel_update_time(time_travel_time + nsec, false); -+ /* -+ * Not strictly needed to use _rel() version since this is -+ * only used in INFCPU/EXT modes, but it doesn't hurt and -+ * is more readable too. -+ */ -+ time_travel_update_time_rel(nsec); - } - EXPORT_SYMBOL(time_travel_ndelay); - -@@ -568,7 +588,11 @@ static void time_travel_set_start(void) - #define time_travel_time 0 - #define time_travel_ext_waiting 0 - --static inline void time_travel_update_time(unsigned long long ns, bool retearly) -+static inline void time_travel_update_time(unsigned long long ns, bool idle) -+{ -+} -+ -+static inline void time_travel_update_time_rel(unsigned long long offs) - { - } - -@@ -720,9 +744,7 @@ static u64 timer_read(struct clocksource *cs) - */ - if (!irqs_disabled() && !in_interrupt() && !in_softirq() && - !time_travel_ext_waiting) -- time_travel_update_time(time_travel_time + -- TIMER_MULTIPLIER, -- false); -+ time_travel_update_time_rel(TIMER_MULTIPLIER); - return time_travel_time / TIMER_MULTIPLIER; - } - --- -2.43.2 - -From 5b6831d90078a9f81cddaa95a184e29dd59fc820 Mon Sep 17 00:00:00 2001 -From: Harshit Shah <harshitshah.opendev@gmail.com> -Date: Sat, 30 Dec 2023 14:41:23 +0530 -Subject: [PATCH 1258/1501] i3c: master: cdns: Update maximum prescaler value - for i2c clock -Content-Length: 1950 -Lines: 51 - -[ Upstream commit 374c13f9080a1b9835a5ed3e7bea93cf8e2dc262 ] - -As per the Cadence IP document fixed the I2C clock divider value limit from -16 bits instead of 10 bits. Without this change setting up the I2C clock to -low frequencies will not work as the prescaler value might be greater than -10 bit number. - -I3C clock divider value is 10 bits only. Updating the macro names for both. - -Signed-off-by: Harshit Shah <harshitshah.opendev@gmail.com> -Link: https://lore.kernel.org/r/1703927483-28682-1-git-send-email-harshitshah.opendev@gmail.com -Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/i3c/master/i3c-master-cdns.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/drivers/i3c/master/i3c-master-cdns.c b/drivers/i3c/master/i3c-master-cdns.c -index bcbe8f914149..c1627f3552ce 100644 ---- a/drivers/i3c/master/i3c-master-cdns.c -+++ b/drivers/i3c/master/i3c-master-cdns.c -@@ -76,7 +76,8 @@ - #define PRESCL_CTRL0 0x14 - #define PRESCL_CTRL0_I2C(x) ((x) << 16) - #define PRESCL_CTRL0_I3C(x) (x) --#define PRESCL_CTRL0_MAX GENMASK(9, 0) -+#define PRESCL_CTRL0_I3C_MAX GENMASK(9, 0) -+#define PRESCL_CTRL0_I2C_MAX GENMASK(15, 0) - - #define PRESCL_CTRL1 0x18 - #define PRESCL_CTRL1_PP_LOW_MASK GENMASK(15, 8) -@@ -1233,7 +1234,7 @@ static int cdns_i3c_master_bus_init(struct i3c_master_controller *m) - return -EINVAL; - - pres = DIV_ROUND_UP(sysclk_rate, (bus->scl_rate.i3c * 4)) - 1; -- if (pres > PRESCL_CTRL0_MAX) -+ if (pres > PRESCL_CTRL0_I3C_MAX) - return -ERANGE; - - bus->scl_rate.i3c = sysclk_rate / ((pres + 1) * 4); -@@ -1246,7 +1247,7 @@ static int cdns_i3c_master_bus_init(struct i3c_master_controller *m) - max_i2cfreq = bus->scl_rate.i2c; - - pres = (sysclk_rate / (max_i2cfreq * 5)) - 1; -- if (pres > PRESCL_CTRL0_MAX) -+ if (pres > PRESCL_CTRL0_I2C_MAX) - return -ERANGE; - - bus->scl_rate.i2c = sysclk_rate / ((pres + 1) * 5); --- -2.43.2 - -From 8e7b6adcb89016321575ab498e9e39e62dd4eb41 Mon Sep 17 00:00:00 2001 -From: Ben Mayo <benny1091@gmail.com> -Date: Sat, 6 Jan 2024 21:13:23 -0500 -Subject: [PATCH 1259/1501] ACPI: resource: Add DMI quirks for ASUS Vivobook - E1504GA and E1504GAB -Content-Length: 1589 -Lines: 49 - -[ Upstream commit d2aaf19965045f70bb2ece514399cdc6fcce2e73 ] - -Asus Vivobook E1504GA and E1504GAB notebooks are affected by bug #216158 -(DSDT specifies the kbd IRQ as level active-low and using the override -changes this to rising edge, stopping the keyboard from working). - -Users of these notebooks do not have a working keyboard unless they add -their DMI information to the struct irq1_level_low_skip_override array -and compile a custom kernel. - -Add support for these computers to the Linux kernel without requiring -the end-user to recompile the kernel. - -Link: https://bugzilla.kernel.org/show_bug.cgi?id=216158 -Signed-off-by: Ben Mayo <benny1091@gmail.com> -[ rjw: Link tag, subject and changelog edits ] -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/acpi/resource.c | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) - -diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c -index c3536c236be9..7d58d8b4ca76 100644 ---- a/drivers/acpi/resource.c -+++ b/drivers/acpi/resource.c -@@ -482,6 +482,20 @@ static const struct dmi_system_id irq1_level_low_skip_override[] = { - DMI_MATCH(DMI_BOARD_NAME, "B2502CBA"), - }, - }, -+ { -+ /* Asus Vivobook E1504GA */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), -+ DMI_MATCH(DMI_BOARD_NAME, "E1504GA"), -+ }, -+ }, -+ { -+ /* Asus Vivobook E1504GAB */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), -+ DMI_MATCH(DMI_BOARD_NAME, "E1504GAB"), -+ }, -+ }, - { - /* LG Electronics 17U70P */ - .matches = { --- -2.43.2 - -From 499197b5ec5c591a11a4938f30d199a0311e2c30 Mon Sep 17 00:00:00 2001 -From: Michael Maltsev <mekosko@projectyo.network> -Date: Sun, 7 Jan 2024 13:53:07 +0500 -Subject: [PATCH 1260/1501] ACPI: resource: Skip IRQ override on ASUS - ExpertBook B1502CGA -Content-Length: 1497 -Lines: 43 - -[ Upstream commit e315e8692f7922cd1b2a26bd7a1741cc8ce77085 ] - -Like the ASUS ExpertBook B1502CBA and various ASUS laptops, the -ASUS ExpertBook B1502CGA has an ACPI DSDT table that describes IRQ 1 as -ActiveLow while the kernel overrides it to Edge_High. - - $ sudo dmesg | grep DMI - [ 0.000000] DMI: ASUSTeK COMPUTER INC. ASUS EXPERTBOOK B1502CGA_B1502CGA/B1502CGA, BIOS B1502CGA.303 06/05/2023 - $ grep -A 40 PS2K dsdt.dsl | grep IRQ -A 1 - IRQ (Level, ActiveLow, Exclusive, ) - {1} - -This prevents the keyboard from working. To fix this issue, add this laptop -to the skip_override_table so that the kernel does not override IRQ 1. - -Signed-off-by: Michael Maltsev <mekosko@projectyo.network> -[ rjw: rebase, replace .ident field with a comment ] -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/acpi/resource.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c -index 7d58d8b4ca76..03b52d31a3e3 100644 ---- a/drivers/acpi/resource.c -+++ b/drivers/acpi/resource.c -@@ -461,6 +461,13 @@ static const struct dmi_system_id irq1_level_low_skip_override[] = { - DMI_MATCH(DMI_BOARD_NAME, "B1502CBA"), - }, - }, -+ { -+ /* Asus ExpertBook B1502CGA */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), -+ DMI_MATCH(DMI_BOARD_NAME, "B1502CGA"), -+ }, -+ }, - { - /* Asus ExpertBook B2402CBA */ - .matches = { --- -2.43.2 - -From 7d174793ca1eab16f65b117d4436fd5e0455fc11 Mon Sep 17 00:00:00 2001 -From: Frederik Haxel <haxel@fzi.de> -Date: Tue, 12 Dec 2023 14:01:12 +0100 -Subject: [PATCH 1261/1501] riscv: Make XIP bootable again -Content-Length: 2507 -Lines: 71 - -[ Upstream commit 66f1e68093979816a23412a3fad066f5bcbc0360 ] - -Currently, the XIP kernel seems to fail to boot due to missing -XIP_FIXUP and a wrong page_offset value. A superfluous XIP_FIXUP -has also been removed. - -Signed-off-by: Frederik Haxel <haxel@fzi.de> -Link: https://lore.kernel.org/r/20231212130116.848530-2-haxel@fzi.de -Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/riscv/kernel/head.S | 1 + - arch/riscv/mm/init.c | 8 ++++++-- - 2 files changed, 7 insertions(+), 2 deletions(-) - -diff --git a/arch/riscv/kernel/head.S b/arch/riscv/kernel/head.S -index 76ace1e0b46f..663881785b2b 100644 ---- a/arch/riscv/kernel/head.S -+++ b/arch/riscv/kernel/head.S -@@ -89,6 +89,7 @@ relocate_enable_mmu: - /* Compute satp for kernel page tables, but don't load it yet */ - srl a2, a0, PAGE_SHIFT - la a1, satp_mode -+ XIP_FIXUP_OFFSET a1 - REG_L a1, 0(a1) - or a2, a2, a1 - -diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c -index 2e011cbddf3a..a65937336cdc 100644 ---- a/arch/riscv/mm/init.c -+++ b/arch/riscv/mm/init.c -@@ -174,6 +174,9 @@ void __init mem_init(void) - - /* Limit the memory size via mem. */ - static phys_addr_t memory_limit; -+#ifdef CONFIG_XIP_KERNEL -+#define memory_limit (*(phys_addr_t *)XIP_FIXUP(&memory_limit)) -+#endif /* CONFIG_XIP_KERNEL */ - - static int __init early_mem(char *p) - { -@@ -952,7 +955,7 @@ static void __init create_fdt_early_page_table(uintptr_t fix_fdt_va, - * setup_vm_final installs the linear mapping. For 32-bit kernel, as the - * kernel is mapped in the linear mapping, that makes no difference. - */ -- dtb_early_va = kernel_mapping_pa_to_va(XIP_FIXUP(dtb_pa)); -+ dtb_early_va = kernel_mapping_pa_to_va(dtb_pa); - #endif - - dtb_early_pa = dtb_pa; -@@ -1055,9 +1058,9 @@ asmlinkage void __init setup_vm(uintptr_t dtb_pa) - #endif - - kernel_map.virt_addr = KERNEL_LINK_ADDR + kernel_map.virt_offset; -- kernel_map.page_offset = _AC(CONFIG_PAGE_OFFSET, UL); - - #ifdef CONFIG_XIP_KERNEL -+ kernel_map.page_offset = PAGE_OFFSET_L3; - kernel_map.xiprom = (uintptr_t)CONFIG_XIP_PHYS_ADDR; - kernel_map.xiprom_sz = (uintptr_t)(&_exiprom) - (uintptr_t)(&_xiprom); - -@@ -1067,6 +1070,7 @@ asmlinkage void __init setup_vm(uintptr_t dtb_pa) - - kernel_map.va_kernel_xip_pa_offset = kernel_map.virt_addr - kernel_map.xiprom; - #else -+ kernel_map.page_offset = _AC(CONFIG_PAGE_OFFSET, UL); - kernel_map.phys_addr = (uintptr_t)(&_start); - kernel_map.size = (uintptr_t)(&_end) - kernel_map.phys_addr; - #endif --- -2.43.2 - -From bd50a7b5c13e84c5db3b030b7cb71106c1582308 Mon Sep 17 00:00:00 2001 -From: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com> -Date: Sun, 7 Jan 2024 12:34:26 +0200 -Subject: [PATCH 1262/1501] xen/gntdev: Fix the abuse of underlying struct page - in DMA-buf import -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 4619 -Lines: 142 - -[ Upstream commit 2d2db7d40254d5fb53b11ebd703cd1ed0c5de7a1 ] - -DO NOT access the underlying struct page of an sg table exported -by DMA-buf in dmabuf_imp_to_refs(), this is not allowed. -Please see drivers/dma-buf/dma-buf.c:mangle_sg_table() for details. - -Fortunately, here (for special Xen device) we can avoid using -pages and calculate gfns directly from dma addresses provided by -the sg table. - -Suggested-by: Daniel Vetter <daniel@ffwll.ch> -Signed-off-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com> -Acked-by: Christian König <christian.koenig@amd.com> -Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> -Acked-by: Daniel Vetter <daniel@ffwll.ch> -Link: https://lore.kernel.org/r/20240107103426.2038075-1-olekstysh@gmail.com -Signed-off-by: Juergen Gross <jgross@suse.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/xen/gntdev-dmabuf.c | 54 ++++++++++++++++++------------------- - 1 file changed, 27 insertions(+), 27 deletions(-) - -diff --git a/drivers/xen/gntdev-dmabuf.c b/drivers/xen/gntdev-dmabuf.c -index 4440e626b797..42adc2c1e06b 100644 ---- a/drivers/xen/gntdev-dmabuf.c -+++ b/drivers/xen/gntdev-dmabuf.c -@@ -11,6 +11,7 @@ - #include <linux/kernel.h> - #include <linux/errno.h> - #include <linux/dma-buf.h> -+#include <linux/dma-direct.h> - #include <linux/slab.h> - #include <linux/types.h> - #include <linux/uaccess.h> -@@ -50,7 +51,7 @@ struct gntdev_dmabuf { - - /* Number of pages this buffer has. */ - int nr_pages; -- /* Pages of this buffer. */ -+ /* Pages of this buffer (only for dma-buf export). */ - struct page **pages; - }; - -@@ -484,7 +485,7 @@ static int dmabuf_exp_from_refs(struct gntdev_priv *priv, int flags, - /* DMA buffer import support. */ - - static int --dmabuf_imp_grant_foreign_access(struct page **pages, u32 *refs, -+dmabuf_imp_grant_foreign_access(unsigned long *gfns, u32 *refs, - int count, int domid) - { - grant_ref_t priv_gref_head; -@@ -507,7 +508,7 @@ dmabuf_imp_grant_foreign_access(struct page **pages, u32 *refs, - } - - gnttab_grant_foreign_access_ref(cur_ref, domid, -- xen_page_to_gfn(pages[i]), 0); -+ gfns[i], 0); - refs[i] = cur_ref; - } - -@@ -529,7 +530,6 @@ static void dmabuf_imp_end_foreign_access(u32 *refs, int count) - - static void dmabuf_imp_free_storage(struct gntdev_dmabuf *gntdev_dmabuf) - { -- kfree(gntdev_dmabuf->pages); - kfree(gntdev_dmabuf->u.imp.refs); - kfree(gntdev_dmabuf); - } -@@ -549,12 +549,6 @@ static struct gntdev_dmabuf *dmabuf_imp_alloc_storage(int count) - if (!gntdev_dmabuf->u.imp.refs) - goto fail; - -- gntdev_dmabuf->pages = kcalloc(count, -- sizeof(gntdev_dmabuf->pages[0]), -- GFP_KERNEL); -- if (!gntdev_dmabuf->pages) -- goto fail; -- - gntdev_dmabuf->nr_pages = count; - - for (i = 0; i < count; i++) -@@ -576,7 +570,8 @@ dmabuf_imp_to_refs(struct gntdev_dmabuf_priv *priv, struct device *dev, - struct dma_buf *dma_buf; - struct dma_buf_attachment *attach; - struct sg_table *sgt; -- struct sg_page_iter sg_iter; -+ struct sg_dma_page_iter sg_iter; -+ unsigned long *gfns; - int i; - - dma_buf = dma_buf_get(fd); -@@ -624,26 +619,31 @@ dmabuf_imp_to_refs(struct gntdev_dmabuf_priv *priv, struct device *dev, - - gntdev_dmabuf->u.imp.sgt = sgt; - -- /* Now convert sgt to array of pages and check for page validity. */ -- i = 0; -- for_each_sgtable_page(sgt, &sg_iter, 0) { -- struct page *page = sg_page_iter_page(&sg_iter); -- /* -- * Check if page is valid: this can happen if we are given -- * a page from VRAM or other resources which are not backed -- * by a struct page. -- */ -- if (!pfn_valid(page_to_pfn(page))) { -- ret = ERR_PTR(-EINVAL); -- goto fail_unmap; -- } -- -- gntdev_dmabuf->pages[i++] = page; -+ gfns = kcalloc(count, sizeof(*gfns), GFP_KERNEL); -+ if (!gfns) { -+ ret = ERR_PTR(-ENOMEM); -+ goto fail_unmap; - } - -- ret = ERR_PTR(dmabuf_imp_grant_foreign_access(gntdev_dmabuf->pages, -+ /* -+ * Now convert sgt to array of gfns without accessing underlying pages. -+ * It is not allowed to access the underlying struct page of an sg table -+ * exported by DMA-buf, but since we deal with special Xen dma device here -+ * (not a normal physical one) look at the dma addresses in the sg table -+ * and then calculate gfns directly from them. -+ */ -+ i = 0; -+ for_each_sgtable_dma_page(sgt, &sg_iter, 0) { -+ dma_addr_t addr = sg_page_iter_dma_address(&sg_iter); -+ unsigned long pfn = bfn_to_pfn(XEN_PFN_DOWN(dma_to_phys(dev, addr))); -+ -+ gfns[i++] = pfn_to_gfn(pfn); -+ } -+ -+ ret = ERR_PTR(dmabuf_imp_grant_foreign_access(gfns, - gntdev_dmabuf->u.imp.refs, - count, domid)); -+ kfree(gfns); - if (IS_ERR(ret)) - goto fail_end_access; - --- -2.43.2 - -From bf1214df42def9e55906abafa47589825b7696ef Mon Sep 17 00:00:00 2001 -From: Peter Robinson <pbrobinson@gmail.com> -Date: Wed, 20 Dec 2023 15:56:39 +0000 -Subject: [PATCH 1263/1501] mfd: ti_am335x_tscadc: Fix TI SoC dependencies -Content-Length: 843 -Lines: 27 - -[ Upstream commit 284d16c456e5d4b143f375b8ccc4038ab3f4ee0f ] - -The ti_am335x_tscadc is specific to some TI SoCs, update -the dependencies for those SoCs and compile testing. - -Signed-off-by: Peter Robinson <pbrobinson@gmail.com> -Link: https://lore.kernel.org/r/20231220155643.445849-1-pbrobinson@gmail.com -Signed-off-by: Lee Jones <lee@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/mfd/Kconfig | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig -index 90ce58fd629e..68d71b4b55bd 100644 ---- a/drivers/mfd/Kconfig -+++ b/drivers/mfd/Kconfig -@@ -1483,6 +1483,7 @@ config MFD_SYSCON - - config MFD_TI_AM335X_TSCADC - tristate "TI ADC / Touch Screen chip support" -+ depends on ARCH_OMAP2PLUS || ARCH_K3 || COMPILE_TEST - select MFD_CORE - select REGMAP - select REGMAP_MMIO --- -2.43.2 - -From 1e6d636c5d8fea807954fe310fa3f427358a6ca8 Mon Sep 17 00:00:00 2001 -From: "Xiaowu.ding" <xiaowu.ding@jaguarmicro.com> -Date: Tue, 12 Dec 2023 19:37:22 +0800 -Subject: [PATCH 1264/1501] mailbox: arm_mhuv2: Fix a bug for - mhuv2_sender_interrupt -Content-Length: 2078 -Lines: 52 - -[ Upstream commit ee01c0b4384d19ecc5dfa7db3fd4303f965c3eba ] - -Message Handling Unit version is v2.1. - -When arm_mhuv2 working with the data protocol transfer mode. -We have split one mhu into two channels, and every channel -include four channel windows, the two channels share -one gic spi interrupt. - -There is a problem with the sending scenario. - -The first channel will take up 0-3 channel windows, and the second -channel take up 4-7 channel windows. When the first channel send the -data, and the receiver will clear all the four channels status. -Although we only enabled the interrupt on the last channel window with -register CH_INT_EN,the register CHCOMB_INT_ST0 will be 0xf, not be 0x8. -Currently we just clear the last channel windows int status with the -data proctol mode.So after that,the CHCOMB_INT_ST0 status will be 0x7, -not be the 0x0. - -Then the second channel send the data, the receiver read the -data, clear all the four channel windows status, trigger the sender -interrupt. But currently the CHCOMB_INT_ST0 register will be 0xf7, -get_irq_chan_comb function will always return the first channel. - -So this patch clear all channel windows int status to avoid this interrupt -confusion. - -Signed-off-by: Xiaowu.ding <xiaowu.ding@jaguarmicro.com> -Acked-by: Viresh Kumar <viresh.kumar@linaro.org> -Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/mailbox/arm_mhuv2.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/mailbox/arm_mhuv2.c b/drivers/mailbox/arm_mhuv2.c -index c6d4957c4da8..0ec21dcdbde7 100644 ---- a/drivers/mailbox/arm_mhuv2.c -+++ b/drivers/mailbox/arm_mhuv2.c -@@ -553,7 +553,8 @@ static irqreturn_t mhuv2_sender_interrupt(int irq, void *data) - priv = chan->con_priv; - - if (!IS_PROTOCOL_DOORBELL(priv)) { -- writel_relaxed(1, &mhu->send->ch_wn[priv->ch_wn_idx + priv->windows - 1].int_clr); -+ for (i = 0; i < priv->windows; i++) -+ writel_relaxed(1, &mhu->send->ch_wn[priv->ch_wn_idx + i].int_clr); - - if (chan->cl) { - mbox_chan_txdone(chan, 0); --- -2.43.2 - -From e129c7fa7070fbce57feb0bfc5eaa65eef44b693 Mon Sep 17 00:00:00 2001 -From: Daniel Stodden <dns@arista.com> -Date: Tue, 21 Nov 2023 20:23:16 -0800 -Subject: [PATCH 1266/1501] PCI: switchtec: Fix stdev_release() crash after - surprise hot remove -Content-Length: 3301 -Lines: 96 - -[ Upstream commit df25461119d987b8c81d232cfe4411e91dcabe66 ] - -A PCI device hot removal may occur while stdev->cdev is held open. The call -to stdev_release() then happens during close or exit, at a point way past -switchtec_pci_remove(). Otherwise the last ref would vanish with the -trailing put_device(), just before return. - -At that later point in time, the devm cleanup has already removed the -stdev->mmio_mrpc mapping. Also, the stdev->pdev reference was not a counted -one. Therefore, in DMA mode, the iowrite32() in stdev_release() will cause -a fatal page fault, and the subsequent dma_free_coherent(), if reached, -would pass a stale &stdev->pdev->dev pointer. - -Fix by moving MRPC DMA shutdown into switchtec_pci_remove(), after -stdev_kill(). Counting the stdev->pdev ref is now optional, but may prevent -future accidents. - -Reproducible via the script at -https://lore.kernel.org/r/20231113212150.96410-1-dns@arista.com - -Link: https://lore.kernel.org/r/20231122042316.91208-2-dns@arista.com -Signed-off-by: Daniel Stodden <dns@arista.com> -Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> -Reviewed-by: Logan Gunthorpe <logang@deltatee.com> -Reviewed-by: Dmitry Safonov <dima@arista.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/pci/switch/switchtec.c | 25 +++++++++++++++++-------- - 1 file changed, 17 insertions(+), 8 deletions(-) - -diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c -index 5b921387eca6..1804794d0e68 100644 ---- a/drivers/pci/switch/switchtec.c -+++ b/drivers/pci/switch/switchtec.c -@@ -1308,13 +1308,6 @@ static void stdev_release(struct device *dev) - { - struct switchtec_dev *stdev = to_stdev(dev); - -- if (stdev->dma_mrpc) { -- iowrite32(0, &stdev->mmio_mrpc->dma_en); -- flush_wc_buf(stdev); -- writeq(0, &stdev->mmio_mrpc->dma_addr); -- dma_free_coherent(&stdev->pdev->dev, sizeof(*stdev->dma_mrpc), -- stdev->dma_mrpc, stdev->dma_mrpc_dma_addr); -- } - kfree(stdev); - } - -@@ -1358,7 +1351,7 @@ static struct switchtec_dev *stdev_create(struct pci_dev *pdev) - return ERR_PTR(-ENOMEM); - - stdev->alive = true; -- stdev->pdev = pdev; -+ stdev->pdev = pci_dev_get(pdev); - INIT_LIST_HEAD(&stdev->mrpc_queue); - mutex_init(&stdev->mrpc_mutex); - stdev->mrpc_busy = 0; -@@ -1391,6 +1384,7 @@ static struct switchtec_dev *stdev_create(struct pci_dev *pdev) - return stdev; - - err_put: -+ pci_dev_put(stdev->pdev); - put_device(&stdev->dev); - return ERR_PTR(rc); - } -@@ -1644,6 +1638,18 @@ static int switchtec_init_pci(struct switchtec_dev *stdev, - return 0; - } - -+static void switchtec_exit_pci(struct switchtec_dev *stdev) -+{ -+ if (stdev->dma_mrpc) { -+ iowrite32(0, &stdev->mmio_mrpc->dma_en); -+ flush_wc_buf(stdev); -+ writeq(0, &stdev->mmio_mrpc->dma_addr); -+ dma_free_coherent(&stdev->pdev->dev, sizeof(*stdev->dma_mrpc), -+ stdev->dma_mrpc, stdev->dma_mrpc_dma_addr); -+ stdev->dma_mrpc = NULL; -+ } -+} -+ - static int switchtec_pci_probe(struct pci_dev *pdev, - const struct pci_device_id *id) - { -@@ -1703,6 +1709,9 @@ static void switchtec_pci_remove(struct pci_dev *pdev) - ida_free(&switchtec_minor_ida, MINOR(stdev->dev.devt)); - dev_info(&stdev->dev, "unregistered.\n"); - stdev_kill(stdev); -+ switchtec_exit_pci(stdev); -+ pci_dev_put(stdev->pdev); -+ stdev->pdev = NULL; - put_device(&stdev->dev); - } - --- -2.43.2 - -From ad3710d297a51050988615f90e76de13eaf2d1d2 Mon Sep 17 00:00:00 2001 -From: James Clark <james.clark@arm.com> -Date: Fri, 1 Sep 2023 14:37:15 +0100 -Subject: [PATCH 1267/1501] perf cs-etm: Bump minimum OpenCSD version to ensure - a bugfix is present -Content-Length: 1893 -Lines: 50 - -[ Upstream commit 2dbba30fd69b604802a9535b74bddb5bcca23793 ] - -Since commit d927ef5004ef ("perf cs-etm: Add exception level consistency -check"), the exception that was added to Perf will be triggered unless -the following bugfix from OpenCSD is present: - - - _Version 1.2.1_: - - __Bugfix__: - ETM4x / ETE - output of context elements to client can in some - circumstances be delayed until after subsequent atoms have been - processed leading to incorrect memory decode access via the client - callbacks. Fixed to flush context elements immediately they are - committed. - -Rather than remove the assert and silently fail, just increase the -minimum version requirement to avoid hard to debug issues and -regressions. - -Reviewed-by: Ian Rogers <irogers@google.com> -Signed-off-by: James Clark <james.clark@arm.com> -Tested-by: Leo Yan <leo.yan@linaro.org> -Cc: John Garry <john.g.garry@oracle.com> -Cc: Mike Leach <mike.leach@linaro.org> -Cc: Will Deacon <will@kernel.org> -Cc: linux-arm-kernel@lists.infradead.org -Link: https://lore.kernel.org/r/20230901133716.677499-1-james.clark@arm.com -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/build/feature/test-libopencsd.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/tools/build/feature/test-libopencsd.c b/tools/build/feature/test-libopencsd.c -index eb6303ff446e..4cfcef9da3e4 100644 ---- a/tools/build/feature/test-libopencsd.c -+++ b/tools/build/feature/test-libopencsd.c -@@ -4,9 +4,9 @@ - /* - * Check OpenCSD library version is sufficient to provide required features - */ --#define OCSD_MIN_VER ((1 << 16) | (1 << 8) | (1)) -+#define OCSD_MIN_VER ((1 << 16) | (2 << 8) | (1)) - #if !defined(OCSD_VER_NUM) || (OCSD_VER_NUM < OCSD_MIN_VER) --#error "OpenCSD >= 1.1.1 is required" -+#error "OpenCSD >= 1.2.1 is required" - #endif - - int main(void) --- -2.43.2 - -From 25ae41fc398a870562cf08e594eca055cc82ba97 Mon Sep 17 00:00:00 2001 -From: Yaxiong Tian <tianyaxiong@kylinos.cn> -Date: Fri, 24 Nov 2023 09:49:13 +0800 -Subject: [PATCH 1268/1501] extcon: fix possible name leak in - extcon_dev_register() -Content-Length: 1234 -Lines: 37 - -[ Upstream commit e66523c72c9aae0ff0dae6859eb77b04de1e8e5f ] - -In the error path after calling dev_set_name(), the device -name is leaked. To fix this, moving dev_set_name() after the -error path and before device_register. - -Link: https://lore.kernel.org/lkml/TYZPR01MB4784ADCD3E951E0863F3DB72D5B8A@TYZPR01MB4784.apcprd01.prod.exchangelabs.com/ -Signed-off-by: Yaxiong Tian <tianyaxiong@kylinos.cn> -Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/extcon/extcon.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c -index 6f7a60d2ed91..e7f55c021e56 100644 ---- a/drivers/extcon/extcon.c -+++ b/drivers/extcon/extcon.c -@@ -1280,8 +1280,6 @@ int extcon_dev_register(struct extcon_dev *edev) - - edev->id = ret; - -- dev_set_name(&edev->dev, "extcon%d", edev->id); -- - ret = extcon_alloc_cables(edev); - if (ret < 0) - goto err_alloc_cables; -@@ -1310,6 +1308,7 @@ int extcon_dev_register(struct extcon_dev *edev) - RAW_INIT_NOTIFIER_HEAD(&edev->nh_all); - - dev_set_drvdata(&edev->dev, edev); -+ dev_set_name(&edev->dev, "extcon%d", edev->id); - edev->state = 0; - - ret = device_register(&edev->dev); --- -2.43.2 - -From 2e95411fb60505c389fde2f8aad974c353822dd2 Mon Sep 17 00:00:00 2001 -From: Adrian Reber <areber@redhat.com> -Date: Fri, 8 Dec 2023 15:36:56 +0100 -Subject: [PATCH 1272/1501] tty: allow TIOCSLCKTRMIOS with - CAP_CHECKPOINT_RESTORE -Content-Length: 2160 -Lines: 55 - -[ Upstream commit e0f25b8992345aa5f113da2815f5add98738c611 ] - -The capability CAP_CHECKPOINT_RESTORE was introduced to allow non-root -users to checkpoint and restore processes as non-root with CRIU. - -This change extends CAP_CHECKPOINT_RESTORE to enable the CRIU option -'--shell-job' as non-root. CRIU's man-page describes the '--shell-job' -option like this: - - Allow one to dump shell jobs. This implies the restored task will - inherit session and process group ID from the criu itself. This option - also allows to migrate a single external tty connection, to migrate - applications like top. - -TIOCSLCKTRMIOS can only be done if the process has CAP_SYS_ADMIN and -this change extends it to CAP_SYS_ADMIN or CAP_CHECKPOINT_RESTORE. - -With this change it is possible to checkpoint and restore processes -which have a tty connection as non-root if CAP_CHECKPOINT_RESTORE is -set. - -Acked-by: Christian Brauner <brauner@kernel.org> -Signed-off-by: Adrian Reber <areber@redhat.com> -Acked-by: Andrei Vagin <avagin@gmail.com> -Link: https://lore.kernel.org/r/20231208143656.1019-1-areber@redhat.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/tty/tty_ioctl.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c -index 4b499301a3db..85de90eebc7b 100644 ---- a/drivers/tty/tty_ioctl.c -+++ b/drivers/tty/tty_ioctl.c -@@ -844,7 +844,7 @@ int tty_mode_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg) - ret = -EFAULT; - return ret; - case TIOCSLCKTRMIOS: -- if (!capable(CAP_SYS_ADMIN)) -+ if (!checkpoint_restore_ns_capable(&init_user_ns)) - return -EPERM; - copy_termios_locked(real_tty, &kterm); - if (user_termios_to_kernel_termios(&kterm, -@@ -861,7 +861,7 @@ int tty_mode_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg) - ret = -EFAULT; - return ret; - case TIOCSLCKTRMIOS: -- if (!capable(CAP_SYS_ADMIN)) -+ if (!checkpoint_restore_ns_capable(&init_user_ns)) - return -EPERM; - copy_termios_locked(real_tty, &kterm); - if (user_termios_to_kernel_termios_1(&kterm, --- -2.43.2 - -From aacfe589fcfd92b8cc65634502eedc3aa0e6e10c Mon Sep 17 00:00:00 2001 -From: Crescent CY Hsieh <crescentcy.hsieh@moxa.com> -Date: Thu, 14 Dec 2023 14:02:34 +0800 -Subject: [PATCH 1273/1501] tty: serial: 8250: Set RS422 interface by default - to fix Moxa RS422/RS485 PCIe boards -Content-Length: 3190 -Lines: 109 - -[ Upstream commit 43f012df3c1e979966524f79b5371fde6545488a ] - -MOXA PCIe RS422/RS485 boards will not function by default because of the -initial default serial interface of all MOXA PCIe boards is set to -RS232. - -This patch fixes the problem above by setting the initial default serial -interface to RS422 for those MOXA RS422/RS485 PCIe boards. - -Signed-off-by: Crescent CY Hsieh <crescentcy.hsieh@moxa.com> -Reviewed-by: Jiri Slaby <jirislaby@kernel.org> -Link: https://lore.kernel.org/r/20231214060234.6147-1-crescentcy.hsieh@moxa.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/tty/serial/8250/8250_pci.c | 58 +++++++++++++++++++++++++++++- - 1 file changed, 57 insertions(+), 1 deletion(-) - -diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c -index 614be0f13a31..8ccf691935b7 100644 ---- a/drivers/tty/serial/8250/8250_pci.c -+++ b/drivers/tty/serial/8250/8250_pci.c -@@ -19,6 +19,7 @@ - #include <linux/serial_core.h> - #include <linux/8250_pci.h> - #include <linux/bitops.h> -+#include <linux/bitfield.h> - - #include <asm/byteorder.h> - #include <asm/io.h> -@@ -1970,6 +1971,20 @@ pci_sunix_setup(struct serial_private *priv, - - #define MOXA_GPIO_PIN2 BIT(2) - -+#define MOXA_RS232 0x00 -+#define MOXA_RS422 0x01 -+#define MOXA_RS485_4W 0x0B -+#define MOXA_RS485_2W 0x0F -+#define MOXA_UIR_OFFSET 0x04 -+#define MOXA_EVEN_RS_MASK GENMASK(3, 0) -+#define MOXA_ODD_RS_MASK GENMASK(7, 4) -+ -+enum { -+ MOXA_SUPP_RS232 = BIT(0), -+ MOXA_SUPP_RS422 = BIT(1), -+ MOXA_SUPP_RS485 = BIT(2), -+}; -+ - static bool pci_moxa_is_mini_pcie(unsigned short device) - { - if (device == PCI_DEVICE_ID_MOXA_CP102N || -@@ -1983,13 +1998,54 @@ static bool pci_moxa_is_mini_pcie(unsigned short device) - return false; - } - -+static unsigned int pci_moxa_supported_rs(struct pci_dev *dev) -+{ -+ switch (dev->device & 0x0F00) { -+ case 0x0000: -+ case 0x0600: -+ return MOXA_SUPP_RS232; -+ case 0x0100: -+ return MOXA_SUPP_RS232 | MOXA_SUPP_RS422 | MOXA_SUPP_RS485; -+ case 0x0300: -+ return MOXA_SUPP_RS422 | MOXA_SUPP_RS485; -+ } -+ return 0; -+} -+ -+static int pci_moxa_set_interface(const struct pci_dev *dev, -+ unsigned int port_idx, -+ u8 mode) -+{ -+ resource_size_t iobar_addr = pci_resource_start(dev, 2); -+ resource_size_t UIR_addr = iobar_addr + MOXA_UIR_OFFSET + port_idx / 2; -+ u8 val; -+ -+ val = inb(UIR_addr); -+ -+ if (port_idx % 2) { -+ val &= ~MOXA_ODD_RS_MASK; -+ val |= FIELD_PREP(MOXA_ODD_RS_MASK, mode); -+ } else { -+ val &= ~MOXA_EVEN_RS_MASK; -+ val |= FIELD_PREP(MOXA_EVEN_RS_MASK, mode); -+ } -+ outb(val, UIR_addr); -+ -+ return 0; -+} -+ - static int pci_moxa_init(struct pci_dev *dev) - { - unsigned short device = dev->device; - resource_size_t iobar_addr = pci_resource_start(dev, 2); -- unsigned int num_ports = (device & 0x00F0) >> 4; -+ unsigned int num_ports = (device & 0x00F0) >> 4, i; - u8 val; - -+ if (!(pci_moxa_supported_rs(dev) & MOXA_SUPP_RS232)) { -+ for (i = 0; i < num_ports; ++i) -+ pci_moxa_set_interface(dev, i, MOXA_RS422); -+ } -+ - /* - * Enable hardware buffer to prevent break signal output when system boots up. - * This hardware buffer is only supported on Mini PCIe series. --- -2.43.2 - -From 6a85606425955b1b6f4e1febde1c9278c2ea2fb3 Mon Sep 17 00:00:00 2001 -From: Max Kellermann <max.kellermann@ionos.com> -Date: Fri, 8 Dec 2023 10:33:10 +0100 -Subject: [PATCH 1274/1501] fs/kernfs/dir: obey S_ISGID -Content-Length: 1593 -Lines: 50 - -[ Upstream commit 5133bee62f0ea5d4c316d503cc0040cac5637601 ] - -Handling of S_ISGID is usually done by inode_init_owner() in all other -filesystems, but kernfs doesn't use that function. In kernfs, struct -kernfs_node is the primary data structure, and struct inode is only -created from it on demand. Therefore, inode_init_owner() can't be -used and we need to imitate its behavior. - -S_ISGID support is useful for the cgroup filesystem; it allows -subtrees managed by an unprivileged process to retain a certain owner -gid, which then enables sharing access to the subtree with another -unprivileged process. - --- -v1 -> v2: minor coding style fix (comment) - -Signed-off-by: Max Kellermann <max.kellermann@ionos.com> -Acked-by: Tejun Heo <tj@kernel.org> -Link: https://lore.kernel.org/r/20231208093310.297233-2-max.kellermann@ionos.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/kernfs/dir.c | 12 ++++++++++++ - 1 file changed, 12 insertions(+) - -diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c -index 8b2bd65d70e7..62d39ecf0a46 100644 ---- a/fs/kernfs/dir.c -+++ b/fs/kernfs/dir.c -@@ -676,6 +676,18 @@ struct kernfs_node *kernfs_new_node(struct kernfs_node *parent, - { - struct kernfs_node *kn; - -+ if (parent->mode & S_ISGID) { -+ /* this code block imitates inode_init_owner() for -+ * kernfs -+ */ -+ -+ if (parent->iattr) -+ gid = parent->iattr->ia_gid; -+ -+ if (flags & KERNFS_DIR) -+ mode |= S_ISGID; -+ } -+ - kn = __kernfs_new_node(kernfs_root(parent), parent, - name, mode, uid, gid, flags); - if (kn) { --- -2.43.2 - -From 9a3881b1f07db1bb55cb0108e6f05cfd027eaf2e Mon Sep 17 00:00:00 2001 -From: Yu-Che Cheng <giver@chromium.org> -Date: Wed, 6 Dec 2023 15:17:25 -0800 -Subject: [PATCH 1275/1501] spmi: mediatek: Fix UAF on device remove -Content-Length: 2663 -Lines: 70 - -[ Upstream commit e821d50ab5b956ed0effa49faaf29912fd4106d9 ] - -The pmif driver data that contains the clocks is allocated along with -spmi_controller. -On device remove, spmi_controller will be freed first, and then devres -, including the clocks, will be cleanup. -This leads to UAF because putting the clocks will access the clocks in -the pmif driver data, which is already freed along with spmi_controller. - -This can be reproduced by enabling DEBUG_TEST_DRIVER_REMOVE and -building the kernel with KASAN. - -Fix the UAF issue by using unmanaged clk_bulk_get() and putting the -clocks before freeing spmi_controller. - -Reported-by: Fei Shao <fshao@chromium.org> -Signed-off-by: Yu-Che Cheng <giver@chromium.org> -Link: https://lore.kernel.org/r/20230717173934.1.If004a6e055a189c7f2d0724fa814422c26789839@changeid -Tested-by: Fei Shao <fshao@chromium.org> -Reviewed-by: Fei Shao <fshao@chromium.org> -Reviewed-by: Chen-Yu Tsai <wenst@chromium.org> -Signed-off-by: Stephen Boyd <sboyd@kernel.org> -Link: https://lore.kernel.org/r/20231206231733.4031901-3-sboyd@kernel.org -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/spmi/spmi-mtk-pmif.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/drivers/spmi/spmi-mtk-pmif.c b/drivers/spmi/spmi-mtk-pmif.c -index 54c35f5535cb..1261f381cae6 100644 ---- a/drivers/spmi/spmi-mtk-pmif.c -+++ b/drivers/spmi/spmi-mtk-pmif.c -@@ -475,7 +475,7 @@ static int mtk_spmi_probe(struct platform_device *pdev) - for (i = 0; i < arb->nclks; i++) - arb->clks[i].id = pmif_clock_names[i]; - -- err = devm_clk_bulk_get(&pdev->dev, arb->nclks, arb->clks); -+ err = clk_bulk_get(&pdev->dev, arb->nclks, arb->clks); - if (err) { - dev_err(&pdev->dev, "Failed to get clocks: %d\n", err); - goto err_put_ctrl; -@@ -484,7 +484,7 @@ static int mtk_spmi_probe(struct platform_device *pdev) - err = clk_bulk_prepare_enable(arb->nclks, arb->clks); - if (err) { - dev_err(&pdev->dev, "Failed to enable clocks: %d\n", err); -- goto err_put_ctrl; -+ goto err_put_clks; - } - - ctrl->cmd = pmif_arb_cmd; -@@ -510,6 +510,8 @@ static int mtk_spmi_probe(struct platform_device *pdev) - - err_domain_remove: - clk_bulk_disable_unprepare(arb->nclks, arb->clks); -+err_put_clks: -+ clk_bulk_put(arb->nclks, arb->clks); - err_put_ctrl: - spmi_controller_put(ctrl); - return err; -@@ -521,6 +523,7 @@ static void mtk_spmi_remove(struct platform_device *pdev) - struct pmif *arb = spmi_controller_get_drvdata(ctrl); - - clk_bulk_disable_unprepare(arb->nclks, arb->clks); -+ clk_bulk_put(arb->nclks, arb->clks); - spmi_controller_remove(ctrl); - spmi_controller_put(ctrl); - } --- -2.43.2 - -From 07c1243457aa63dbbe8fa9718ceaa3e75f353192 Mon Sep 17 00:00:00 2001 -From: Piro Yang <piroyangg@gmail.com> -Date: Wed, 20 Dec 2023 01:04:47 +0800 -Subject: [PATCH 1276/1501] staging: vme_user: Fix the issue of return the - wrong error code -Content-Length: 1091 -Lines: 31 - -[ Upstream commit 5090a4bc2a2f04b7693b49500ad1287e8d0fb6c3 ] - -Fix the issue of returning the -ENOSYS error code when an error occurs. - -The error code of -ENOSYS indicates Invalid system call number, but -there is not system call error. So replace -ENOSYS error code by the -return -EINVAL error code. - -Signed-off-by: Piro Yang <piroyangg@gmail.com> -Link: https://lore.kernel.org/r/20231219170447.51237-1-piroyangg@gmail.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/staging/vme_user/vme.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/staging/vme_user/vme.c b/drivers/staging/vme_user/vme.c -index 5c416c31ec57..9bc2d35405af 100644 ---- a/drivers/staging/vme_user/vme.c -+++ b/drivers/staging/vme_user/vme.c -@@ -341,7 +341,7 @@ int vme_slave_set(struct vme_resource *resource, int enabled, - - if (!bridge->slave_set) { - dev_err(bridge->parent, "Function not supported\n"); -- return -ENOSYS; -+ return -EINVAL; - } - - if (!(((image->address_attr & aspace) == aspace) && --- -2.43.2 - -From 5924739486f08fa85e82794cdab2d62da25e70fc Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@linux.intel.com> -Date: Tue, 2 Jan 2024 19:27:00 +0200 -Subject: [PATCH 1277/1501] PCI: Fix 64GT/s effective data rate calculation -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1125 -Lines: 29 - -[ Upstream commit ac4f1897fa5433a1b07a625503a91b6aa9d7e643 ] - -Unlike the lower rates, the PCIe 64GT/s Data Rate uses 1b/1b encoding, not -128b/130b (PCIe r6.1 sec 1.2, Table 1-1). Correct the PCIE_SPEED2MBS_ENC() -calculation to reflect that. - -Link: https://lore.kernel.org/r/20240102172701.65501-1-ilpo.jarvinen@linux.intel.com -Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> -Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/pci/pci.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h -index f43873049d52..c6283ba78197 100644 ---- a/drivers/pci/pci.h -+++ b/drivers/pci/pci.h -@@ -272,7 +272,7 @@ void pci_bus_put(struct pci_bus *bus); - - /* PCIe speed to Mb/s reduced by encoding overhead */ - #define PCIE_SPEED2MBS_ENC(speed) \ -- ((speed) == PCIE_SPEED_64_0GT ? 64000*128/130 : \ -+ ((speed) == PCIE_SPEED_64_0GT ? 64000*1/1 : \ - (speed) == PCIE_SPEED_32_0GT ? 32000*128/130 : \ - (speed) == PCIE_SPEED_16_0GT ? 16000*128/130 : \ - (speed) == PCIE_SPEED_8_0GT ? 8000*128/130 : \ --- -2.43.2 - -From 98806139562988f93d0fab881408995628ae115f Mon Sep 17 00:00:00 2001 -From: Bjorn Helgaas <bhelgaas@google.com> -Date: Wed, 6 Dec 2023 16:42:30 -0600 -Subject: [PATCH 1278/1501] PCI/AER: Decode Requester ID when no error info - found -Content-Length: 2558 -Lines: 61 - -[ Upstream commit 1291b716bbf969e101d517bfb8ba18d958f758b8 ] - -When a device with AER detects an error, it logs error information in its -own AER Error Status registers. It may send an Error Message to the Root -Port (RCEC in the case of an RCiEP), which logs the fact that an Error -Message was received (Root Error Status) and the Requester ID of the -message source (Error Source Identification). - -aer_print_port_info() prints the Requester ID from the Root Port Error -Source in the usual Linux "bb:dd.f" format, but when find_source_device() -finds no error details in the hierarchy below the Root Port, it printed the -raw Requester ID without decoding it. - -Decode the Requester ID in the usual Linux format so it matches other -messages. - -Sample message changes: - - - pcieport 0000:00:1c.5: AER: Correctable error received: 0000:00:1c.5 - - pcieport 0000:00:1c.5: AER: can't find device of ID00e5 - + pcieport 0000:00:1c.5: AER: Correctable error message received from 0000:00:1c.5 - + pcieport 0000:00:1c.5: AER: found no error details for 0000:00:1c.5 - -Link: https://lore.kernel.org/r/20231206224231.732765-3-helgaas@kernel.org -Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> -Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> -Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/pci/pcie/aer.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - -diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c -index 42a3bd35a3e1..38e3346772cc 100644 ---- a/drivers/pci/pcie/aer.c -+++ b/drivers/pci/pcie/aer.c -@@ -740,7 +740,7 @@ static void aer_print_port_info(struct pci_dev *dev, struct aer_err_info *info) - u8 bus = info->id >> 8; - u8 devfn = info->id & 0xff; - -- pci_info(dev, "%s%s error received: %04x:%02x:%02x.%d\n", -+ pci_info(dev, "%s%s error message received from %04x:%02x:%02x.%d\n", - info->multi_error_valid ? "Multiple " : "", - aer_error_severity_string[info->severity], - pci_domain_nr(dev->bus), bus, PCI_SLOT(devfn), -@@ -929,7 +929,12 @@ static bool find_source_device(struct pci_dev *parent, - pci_walk_bus(parent->subordinate, find_device_iter, e_info); - - if (!e_info->error_dev_num) { -- pci_info(parent, "can't find device of ID%04x\n", e_info->id); -+ u8 bus = e_info->id >> 8; -+ u8 devfn = e_info->id & 0xff; -+ -+ pci_info(parent, "found no error details for %04x:%02x:%02x.%d\n", -+ pci_domain_nr(parent->bus), bus, PCI_SLOT(devfn), -+ PCI_FUNC(devfn)); - return false; - } - return true; --- -2.43.2 - -From 763d40980339507b2c30759f7290405a387b166a Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Tue, 2 Jan 2024 20:33:17 +0000 -Subject: [PATCH 1279/1501] 9p: Fix initialisation of netfs_inode for 9p -Content-Length: 3108 -Lines: 90 - -[ Upstream commit 9546ac78b232bac56ff975072b1965e0e755ebd4 ] - -The 9p filesystem is calling netfs_inode_init() in v9fs_init_inode() - -before the struct inode fields have been initialised from the obtained file -stats (ie. after v9fs_stat2inode*() has been called), but netfslib wants to -set a couple of its fields from i_size. - -Reported-by: Marc Dionne <marc.dionne@auristor.com> -Signed-off-by: David Howells <dhowells@redhat.com> -Tested-by: Marc Dionne <marc.dionne@auristor.com> -Tested-by: Dominique Martinet <asmadeus@codewreck.org> -Acked-by: Dominique Martinet <asmadeus@codewreck.org> -cc: Eric Van Hensbergen <ericvh@kernel.org> -cc: Latchesar Ionkov <lucho@ionkov.net> -cc: Dominique Martinet <asmadeus@codewreck.org> -cc: Christian Schoenebeck <linux_oss@crudebyte.com> -cc: v9fs@lists.linux.dev -cc: linux-cachefs@redhat.com -cc: linux-fsdevel@vger.kernel.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/9p/v9fs_vfs.h | 1 + - fs/9p/vfs_inode.c | 6 +++--- - fs/9p/vfs_inode_dotl.c | 1 + - 3 files changed, 5 insertions(+), 3 deletions(-) - -diff --git a/fs/9p/v9fs_vfs.h b/fs/9p/v9fs_vfs.h -index 731e3d14b67d..0e8418066a48 100644 ---- a/fs/9p/v9fs_vfs.h -+++ b/fs/9p/v9fs_vfs.h -@@ -42,6 +42,7 @@ struct inode *v9fs_alloc_inode(struct super_block *sb); - void v9fs_free_inode(struct inode *inode); - struct inode *v9fs_get_inode(struct super_block *sb, umode_t mode, - dev_t rdev); -+void v9fs_set_netfs_context(struct inode *inode); - int v9fs_init_inode(struct v9fs_session_info *v9ses, - struct inode *inode, umode_t mode, dev_t rdev); - void v9fs_evict_inode(struct inode *inode); -diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c -index b845ee18a80b..90dc5ef75516 100644 ---- a/fs/9p/vfs_inode.c -+++ b/fs/9p/vfs_inode.c -@@ -246,7 +246,7 @@ void v9fs_free_inode(struct inode *inode) - /* - * Set parameters for the netfs library - */ --static void v9fs_set_netfs_context(struct inode *inode) -+void v9fs_set_netfs_context(struct inode *inode) - { - struct v9fs_inode *v9inode = V9FS_I(inode); - netfs_inode_init(&v9inode->netfs, &v9fs_req_ops); -@@ -326,8 +326,6 @@ int v9fs_init_inode(struct v9fs_session_info *v9ses, - err = -EINVAL; - goto error; - } -- -- v9fs_set_netfs_context(inode); - error: - return err; - -@@ -359,6 +357,7 @@ struct inode *v9fs_get_inode(struct super_block *sb, umode_t mode, dev_t rdev) - iput(inode); - return ERR_PTR(err); - } -+ v9fs_set_netfs_context(inode); - return inode; - } - -@@ -464,6 +463,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb, - goto error; - - v9fs_stat2inode(st, inode, sb, 0); -+ v9fs_set_netfs_context(inode); - v9fs_cache_inode_get_cookie(inode); - unlock_new_inode(inode); - return inode; -diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c -index c7319af2f471..d0636b99f05b 100644 ---- a/fs/9p/vfs_inode_dotl.c -+++ b/fs/9p/vfs_inode_dotl.c -@@ -128,6 +128,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb, - goto error; - - v9fs_stat2inode_dotl(st, inode, 0); -+ v9fs_set_netfs_context(inode); - v9fs_cache_inode_get_cookie(inode); - retval = v9fs_get_acl(inode, fid); - if (retval) --- -2.43.2 - -From 9c2ac5e0ea7899411fd900d4681890722a020735 Mon Sep 17 00:00:00 2001 -From: "Steven Rostedt (Google)" <rostedt@goodmis.org> -Date: Wed, 3 Jan 2024 21:50:16 -0500 -Subject: [PATCH 1280/1501] tracefs/eventfs: Use root and instance inodes as - default ownership -Content-Length: 15073 -Lines: 480 - -[ Upstream commit 8186fff7ab649085e2c60d032d9a20a85af1d87c ] - -Instead of walking the dentries on mount/remount to update the gid values of -all the dentries if a gid option is specified on mount, just update the root -inode. Add .getattr, .setattr, and .permissions on the tracefs inode -operations to update the permissions of the files and directories. - -For all files and directories in the top level instance: - - /sys/kernel/tracing/* - -It will use the root inode as the default permissions. The inode that -represents: /sys/kernel/tracing (or wherever it is mounted). - -When an instance is created: - - mkdir /sys/kernel/tracing/instance/foo - -The directory "foo" and all its files and directories underneath will use -the default of what foo is when it was created. A remount of tracefs will -not affect it. - -If a user were to modify the permissions of any file or directory in -tracefs, it will also no longer be modified by a change in ownership of a -remount. - -The events directory, if it is in the top level instance, will use the -tracefs root inode as the default ownership for itself and all the files and -directories below it. - -For the events directory in an instance ("foo"), it will keep the ownership -of what it was when it was created, and that will be used as the default -ownership for the files and directories beneath it. - -Link: https://lore.kernel.org/linux-trace-kernel/CAHk-=wjVdGkjDXBbvLn2wbZnqP4UsH46E3gqJ9m7UG6DpX2+WA@mail.gmail.com/ -Link: https://lore.kernel.org/linux-trace-kernel/20240103215016.1e0c9811@gandalf.local.home - -Cc: Masami Hiramatsu <mhiramat@kernel.org> -Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> -Cc: Linus Torvalds <torvalds@linux-foundation.org> -Cc: Al Viro <viro@ZenIV.linux.org.uk> -Cc: Christian Brauner <brauner@kernel.org> -Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/tracefs/event_inode.c | 79 +++++++++++++++- - fs/tracefs/inode.c | 198 ++++++++++++++++++++++----------------- - fs/tracefs/internal.h | 3 + - 3 files changed, 190 insertions(+), 90 deletions(-) - -diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c -index f0677ea0ec24..517f1ae1a058 100644 ---- a/fs/tracefs/event_inode.c -+++ b/fs/tracefs/event_inode.c -@@ -45,6 +45,7 @@ enum { - EVENTFS_SAVE_MODE = BIT(16), - EVENTFS_SAVE_UID = BIT(17), - EVENTFS_SAVE_GID = BIT(18), -+ EVENTFS_TOPLEVEL = BIT(19), - }; - - #define EVENTFS_MODE_MASK (EVENTFS_SAVE_MODE - 1) -@@ -117,10 +118,17 @@ static int eventfs_set_attr(struct mnt_idmap *idmap, struct dentry *dentry, - * The events directory dentry is never freed, unless its - * part of an instance that is deleted. It's attr is the - * default for its child files and directories. -- * Do not update it. It's not used for its own mode or ownership -+ * Do not update it. It's not used for its own mode or ownership. - */ -- if (!ei->is_events) -+ if (ei->is_events) { -+ /* But it still needs to know if it was modified */ -+ if (iattr->ia_valid & ATTR_UID) -+ ei->attr.mode |= EVENTFS_SAVE_UID; -+ if (iattr->ia_valid & ATTR_GID) -+ ei->attr.mode |= EVENTFS_SAVE_GID; -+ } else { - update_attr(&ei->attr, iattr); -+ } - - } else { - name = dentry->d_name.name; -@@ -138,9 +146,66 @@ static int eventfs_set_attr(struct mnt_idmap *idmap, struct dentry *dentry, - return ret; - } - -+static void update_top_events_attr(struct eventfs_inode *ei, struct dentry *dentry) -+{ -+ struct inode *inode; -+ -+ /* Only update if the "events" was on the top level */ -+ if (!ei || !(ei->attr.mode & EVENTFS_TOPLEVEL)) -+ return; -+ -+ /* Get the tracefs root inode. */ -+ inode = d_inode(dentry->d_sb->s_root); -+ ei->attr.uid = inode->i_uid; -+ ei->attr.gid = inode->i_gid; -+} -+ -+static void set_top_events_ownership(struct inode *inode) -+{ -+ struct tracefs_inode *ti = get_tracefs(inode); -+ struct eventfs_inode *ei = ti->private; -+ struct dentry *dentry; -+ -+ /* The top events directory doesn't get automatically updated */ -+ if (!ei || !ei->is_events || !(ei->attr.mode & EVENTFS_TOPLEVEL)) -+ return; -+ -+ dentry = ei->dentry; -+ -+ update_top_events_attr(ei, dentry); -+ -+ if (!(ei->attr.mode & EVENTFS_SAVE_UID)) -+ inode->i_uid = ei->attr.uid; -+ -+ if (!(ei->attr.mode & EVENTFS_SAVE_GID)) -+ inode->i_gid = ei->attr.gid; -+} -+ -+static int eventfs_get_attr(struct mnt_idmap *idmap, -+ const struct path *path, struct kstat *stat, -+ u32 request_mask, unsigned int flags) -+{ -+ struct dentry *dentry = path->dentry; -+ struct inode *inode = d_backing_inode(dentry); -+ -+ set_top_events_ownership(inode); -+ -+ generic_fillattr(idmap, request_mask, inode, stat); -+ return 0; -+} -+ -+static int eventfs_permission(struct mnt_idmap *idmap, -+ struct inode *inode, int mask) -+{ -+ set_top_events_ownership(inode); -+ return generic_permission(idmap, inode, mask); -+} -+ - static const struct inode_operations eventfs_root_dir_inode_operations = { - .lookup = eventfs_root_lookup, - .setattr = eventfs_set_attr, -+ .getattr = eventfs_get_attr, -+ .permission = eventfs_permission, - }; - - static const struct inode_operations eventfs_file_inode_operations = { -@@ -178,6 +243,8 @@ static struct eventfs_inode *eventfs_find_events(struct dentry *dentry) - } while (!ei->is_events); - mutex_unlock(&eventfs_mutex); - -+ update_top_events_attr(ei, dentry); -+ - return ei; - } - -@@ -968,6 +1035,14 @@ struct eventfs_inode *eventfs_create_events_dir(const char *name, struct dentry - uid = d_inode(dentry->d_parent)->i_uid; - gid = d_inode(dentry->d_parent)->i_gid; - -+ /* -+ * If the events directory is of the top instance, then parent -+ * is NULL. Set the attr.mode to reflect this and its permissions will -+ * default to the tracefs root dentry. -+ */ -+ if (!parent) -+ ei->attr.mode = EVENTFS_TOPLEVEL; -+ - /* This is used as the default ownership of the files and directories */ - ei->attr.uid = uid; - ei->attr.gid = gid; -diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c -index bc86ffdb103b..e1b172c0e091 100644 ---- a/fs/tracefs/inode.c -+++ b/fs/tracefs/inode.c -@@ -91,6 +91,7 @@ static int tracefs_syscall_mkdir(struct mnt_idmap *idmap, - struct inode *inode, struct dentry *dentry, - umode_t mode) - { -+ struct tracefs_inode *ti; - char *name; - int ret; - -@@ -98,6 +99,15 @@ static int tracefs_syscall_mkdir(struct mnt_idmap *idmap, - if (!name) - return -ENOMEM; - -+ /* -+ * This is a new directory that does not take the default of -+ * the rootfs. It becomes the default permissions for all the -+ * files and directories underneath it. -+ */ -+ ti = get_tracefs(inode); -+ ti->flags |= TRACEFS_INSTANCE_INODE; -+ ti->private = inode; -+ - /* - * The mkdir call can call the generic functions that create - * the files within the tracefs system. It is up to the individual -@@ -141,10 +151,76 @@ static int tracefs_syscall_rmdir(struct inode *inode, struct dentry *dentry) - return ret; - } - --static const struct inode_operations tracefs_dir_inode_operations = { -+static void set_tracefs_inode_owner(struct inode *inode) -+{ -+ struct tracefs_inode *ti = get_tracefs(inode); -+ struct inode *root_inode = ti->private; -+ -+ /* -+ * If this inode has never been referenced, then update -+ * the permissions to the superblock. -+ */ -+ if (!(ti->flags & TRACEFS_UID_PERM_SET)) -+ inode->i_uid = root_inode->i_uid; -+ -+ if (!(ti->flags & TRACEFS_GID_PERM_SET)) -+ inode->i_gid = root_inode->i_gid; -+} -+ -+static int tracefs_permission(struct mnt_idmap *idmap, -+ struct inode *inode, int mask) -+{ -+ set_tracefs_inode_owner(inode); -+ return generic_permission(idmap, inode, mask); -+} -+ -+static int tracefs_getattr(struct mnt_idmap *idmap, -+ const struct path *path, struct kstat *stat, -+ u32 request_mask, unsigned int flags) -+{ -+ struct inode *inode = d_backing_inode(path->dentry); -+ -+ set_tracefs_inode_owner(inode); -+ generic_fillattr(idmap, request_mask, inode, stat); -+ return 0; -+} -+ -+static int tracefs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, -+ struct iattr *attr) -+{ -+ unsigned int ia_valid = attr->ia_valid; -+ struct inode *inode = d_inode(dentry); -+ struct tracefs_inode *ti = get_tracefs(inode); -+ -+ if (ia_valid & ATTR_UID) -+ ti->flags |= TRACEFS_UID_PERM_SET; -+ -+ if (ia_valid & ATTR_GID) -+ ti->flags |= TRACEFS_GID_PERM_SET; -+ -+ return simple_setattr(idmap, dentry, attr); -+} -+ -+static const struct inode_operations tracefs_instance_dir_inode_operations = { - .lookup = simple_lookup, - .mkdir = tracefs_syscall_mkdir, - .rmdir = tracefs_syscall_rmdir, -+ .permission = tracefs_permission, -+ .getattr = tracefs_getattr, -+ .setattr = tracefs_setattr, -+}; -+ -+static const struct inode_operations tracefs_dir_inode_operations = { -+ .lookup = simple_lookup, -+ .permission = tracefs_permission, -+ .getattr = tracefs_getattr, -+ .setattr = tracefs_setattr, -+}; -+ -+static const struct inode_operations tracefs_file_inode_operations = { -+ .permission = tracefs_permission, -+ .getattr = tracefs_getattr, -+ .setattr = tracefs_setattr, - }; - - struct inode *tracefs_get_inode(struct super_block *sb) -@@ -183,87 +259,6 @@ struct tracefs_fs_info { - struct tracefs_mount_opts mount_opts; - }; - --static void change_gid(struct dentry *dentry, kgid_t gid) --{ -- if (!dentry->d_inode) -- return; -- dentry->d_inode->i_gid = gid; --} -- --/* -- * Taken from d_walk, but without he need for handling renames. -- * Nothing can be renamed while walking the list, as tracefs -- * does not support renames. This is only called when mounting -- * or remounting the file system, to set all the files to -- * the given gid. -- */ --static void set_gid(struct dentry *parent, kgid_t gid) --{ -- struct dentry *this_parent; -- struct list_head *next; -- -- this_parent = parent; -- spin_lock(&this_parent->d_lock); -- -- change_gid(this_parent, gid); --repeat: -- next = this_parent->d_subdirs.next; --resume: -- while (next != &this_parent->d_subdirs) { -- struct tracefs_inode *ti; -- struct list_head *tmp = next; -- struct dentry *dentry = list_entry(tmp, struct dentry, d_child); -- next = tmp->next; -- -- /* Note, getdents() can add a cursor dentry with no inode */ -- if (!dentry->d_inode) -- continue; -- -- spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); -- -- change_gid(dentry, gid); -- -- /* If this is the events directory, update that too */ -- ti = get_tracefs(dentry->d_inode); -- if (ti && (ti->flags & TRACEFS_EVENT_INODE)) -- eventfs_update_gid(dentry, gid); -- -- if (!list_empty(&dentry->d_subdirs)) { -- spin_unlock(&this_parent->d_lock); -- spin_release(&dentry->d_lock.dep_map, _RET_IP_); -- this_parent = dentry; -- spin_acquire(&this_parent->d_lock.dep_map, 0, 1, _RET_IP_); -- goto repeat; -- } -- spin_unlock(&dentry->d_lock); -- } -- /* -- * All done at this level ... ascend and resume the search. -- */ -- rcu_read_lock(); --ascend: -- if (this_parent != parent) { -- struct dentry *child = this_parent; -- this_parent = child->d_parent; -- -- spin_unlock(&child->d_lock); -- spin_lock(&this_parent->d_lock); -- -- /* go into the first sibling still alive */ -- do { -- next = child->d_child.next; -- if (next == &this_parent->d_subdirs) -- goto ascend; -- child = list_entry(next, struct dentry, d_child); -- } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)); -- rcu_read_unlock(); -- goto resume; -- } -- rcu_read_unlock(); -- spin_unlock(&this_parent->d_lock); -- return; --} -- - static int tracefs_parse_options(char *data, struct tracefs_mount_opts *opts) - { - substring_t args[MAX_OPT_ARGS]; -@@ -336,10 +331,8 @@ static int tracefs_apply_options(struct super_block *sb, bool remount) - if (!remount || opts->opts & BIT(Opt_uid)) - inode->i_uid = opts->uid; - -- if (!remount || opts->opts & BIT(Opt_gid)) { -- /* Set all the group ids to the mount option */ -- set_gid(sb->s_root, opts->gid); -- } -+ if (!remount || opts->opts & BIT(Opt_gid)) -+ inode->i_gid = opts->gid; - - return 0; - } -@@ -573,6 +566,26 @@ struct dentry *eventfs_end_creating(struct dentry *dentry) - return dentry; - } - -+/* Find the inode that this will use for default */ -+static struct inode *instance_inode(struct dentry *parent, struct inode *inode) -+{ -+ struct tracefs_inode *ti; -+ -+ /* If parent is NULL then use root inode */ -+ if (!parent) -+ return d_inode(inode->i_sb->s_root); -+ -+ /* Find the inode that is flagged as an instance or the root inode */ -+ while (!IS_ROOT(parent)) { -+ ti = get_tracefs(d_inode(parent)); -+ if (ti->flags & TRACEFS_INSTANCE_INODE) -+ break; -+ parent = parent->d_parent; -+ } -+ -+ return d_inode(parent); -+} -+ - /** - * tracefs_create_file - create a file in the tracefs filesystem - * @name: a pointer to a string containing the name of the file to create. -@@ -603,6 +616,7 @@ struct dentry *tracefs_create_file(const char *name, umode_t mode, - struct dentry *parent, void *data, - const struct file_operations *fops) - { -+ struct tracefs_inode *ti; - struct dentry *dentry; - struct inode *inode; - -@@ -621,7 +635,11 @@ struct dentry *tracefs_create_file(const char *name, umode_t mode, - if (unlikely(!inode)) - return tracefs_failed_creating(dentry); - -+ ti = get_tracefs(inode); -+ ti->private = instance_inode(parent, inode); -+ - inode->i_mode = mode; -+ inode->i_op = &tracefs_file_inode_operations; - inode->i_fop = fops ? fops : &tracefs_file_operations; - inode->i_private = data; - inode->i_uid = d_inode(dentry->d_parent)->i_uid; -@@ -634,6 +652,7 @@ struct dentry *tracefs_create_file(const char *name, umode_t mode, - static struct dentry *__create_dir(const char *name, struct dentry *parent, - const struct inode_operations *ops) - { -+ struct tracefs_inode *ti; - struct dentry *dentry = tracefs_start_creating(name, parent); - struct inode *inode; - -@@ -651,6 +670,9 @@ static struct dentry *__create_dir(const char *name, struct dentry *parent, - inode->i_uid = d_inode(dentry->d_parent)->i_uid; - inode->i_gid = d_inode(dentry->d_parent)->i_gid; - -+ ti = get_tracefs(inode); -+ ti->private = instance_inode(parent, inode); -+ - /* directory inodes start off with i_nlink == 2 (for "." entry) */ - inc_nlink(inode); - d_instantiate(dentry, inode); -@@ -681,7 +703,7 @@ struct dentry *tracefs_create_dir(const char *name, struct dentry *parent) - if (security_locked_down(LOCKDOWN_TRACEFS)) - return NULL; - -- return __create_dir(name, parent, &simple_dir_inode_operations); -+ return __create_dir(name, parent, &tracefs_dir_inode_operations); - } - - /** -@@ -712,7 +734,7 @@ __init struct dentry *tracefs_create_instance_dir(const char *name, - if (WARN_ON(tracefs_ops.mkdir || tracefs_ops.rmdir)) - return NULL; - -- dentry = __create_dir(name, parent, &tracefs_dir_inode_operations); -+ dentry = __create_dir(name, parent, &tracefs_instance_dir_inode_operations); - if (!dentry) - return NULL; - -diff --git a/fs/tracefs/internal.h b/fs/tracefs/internal.h -index 42bdeb471a07..12b7d0150ae9 100644 ---- a/fs/tracefs/internal.h -+++ b/fs/tracefs/internal.h -@@ -5,6 +5,9 @@ - enum { - TRACEFS_EVENT_INODE = BIT(1), - TRACEFS_EVENT_TOP_INODE = BIT(2), -+ TRACEFS_GID_PERM_SET = BIT(3), -+ TRACEFS_UID_PERM_SET = BIT(4), -+ TRACEFS_INSTANCE_INODE = BIT(5), - }; - - struct tracefs_inode { --- -2.43.2 - -From 755182e1e8667272a082506a2a20b4cdd78ab4c2 Mon Sep 17 00:00:00 2001 -From: Hans de Goede <hdegoede@redhat.com> -Date: Sun, 24 Dec 2023 19:34:02 +0100 -Subject: [PATCH 1282/1501] misc: lis3lv02d_i2c: Add missing setting of the - reg_ctrl callback -Content-Length: 2038 -Lines: 52 - -[ Upstream commit b1b9f7a494400c0c39f8cd83de3aaa6111c55087 ] - -The lis3lv02d_i2c driver was missing a line to set the lis3_dev's -reg_ctrl callback. - -lis3_reg_ctrl(on) is called from the init callback, but due to -the missing reg_ctrl callback the regulators where never turned off -again leading to the following oops/backtrace when detaching the driver: - -[ 82.313527] ------------[ cut here ]------------ -[ 82.313546] WARNING: CPU: 1 PID: 1724 at drivers/regulator/core.c:2396 _regulator_put+0x219/0x230 -... -[ 82.313695] RIP: 0010:_regulator_put+0x219/0x230 -... -[ 82.314767] Call Trace: -[ 82.314770] <TASK> -[ 82.314772] ? _regulator_put+0x219/0x230 -[ 82.314777] ? __warn+0x81/0x170 -[ 82.314784] ? _regulator_put+0x219/0x230 -[ 82.314791] ? report_bug+0x18d/0x1c0 -[ 82.314801] ? handle_bug+0x3c/0x80 -[ 82.314806] ? exc_invalid_op+0x13/0x60 -[ 82.314812] ? asm_exc_invalid_op+0x16/0x20 -[ 82.314845] ? _regulator_put+0x219/0x230 -[ 82.314857] regulator_bulk_free+0x39/0x60 -[ 82.314865] i2c_device_remove+0x22/0xb0 - -Add the missing setting of the callback so that the regulators -properly get turned off again when not used. - -Signed-off-by: Hans de Goede <hdegoede@redhat.com> -Link: https://lore.kernel.org/r/20231224183402.95640-1-hdegoede@redhat.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/misc/lis3lv02d/lis3lv02d_i2c.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/misc/lis3lv02d/lis3lv02d_i2c.c b/drivers/misc/lis3lv02d/lis3lv02d_i2c.c -index 3882e97e96a7..c6eb27d46cb0 100644 ---- a/drivers/misc/lis3lv02d/lis3lv02d_i2c.c -+++ b/drivers/misc/lis3lv02d/lis3lv02d_i2c.c -@@ -150,6 +150,7 @@ static int lis3lv02d_i2c_probe(struct i2c_client *client) - lis3_dev.init = lis3_i2c_init; - lis3_dev.read = lis3_i2c_read; - lis3_dev.write = lis3_i2c_write; -+ lis3_dev.reg_ctrl = lis3_reg_ctrl; - lis3_dev.irq = client->irq; - lis3_dev.ac = lis3lv02d_axis_map; - lis3_dev.pm_dev = &client->dev; --- -2.43.2 - -From c331709fb533b52f390067c635a219aaac805a02 Mon Sep 17 00:00:00 2001 -From: Ian Rogers <irogers@google.com> -Date: Thu, 7 Dec 2023 16:05:13 -0800 -Subject: [PATCH 1283/1501] libsubcmd: Fix memory leak in uniq() -Content-Length: 1719 -Lines: 54 - -[ Upstream commit ad30469a841b50dbb541df4d6971d891f703c297 ] - -uniq() will write one command name over another causing the overwritten -string to be leaked. Fix by doing a pass that removes duplicates and a -second that removes the holes. - -Signed-off-by: Ian Rogers <irogers@google.com> -Cc: Adrian Hunter <adrian.hunter@intel.com> -Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> -Cc: Chenyuan Mi <cymi20@fudan.edu.cn> -Cc: Ingo Molnar <mingo@redhat.com> -Cc: Jiri Olsa <jolsa@kernel.org> -Cc: Mark Rutland <mark.rutland@arm.com> -Cc: Namhyung Kim <namhyung@kernel.org> -Cc: Peter Zijlstra <peterz@infradead.org> -Link: https://lore.kernel.org/r/20231208000515.1693746-1-irogers@google.com -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/lib/subcmd/help.c | 18 ++++++++++++++---- - 1 file changed, 14 insertions(+), 4 deletions(-) - -diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c -index adfbae27dc36..8561b0f01a24 100644 ---- a/tools/lib/subcmd/help.c -+++ b/tools/lib/subcmd/help.c -@@ -52,11 +52,21 @@ void uniq(struct cmdnames *cmds) - if (!cmds->cnt) - return; - -- for (i = j = 1; i < cmds->cnt; i++) -- if (strcmp(cmds->names[i]->name, cmds->names[i-1]->name)) -- cmds->names[j++] = cmds->names[i]; -- -+ for (i = 1; i < cmds->cnt; i++) { -+ if (!strcmp(cmds->names[i]->name, cmds->names[i-1]->name)) -+ zfree(&cmds->names[i - 1]); -+ } -+ for (i = 0, j = 0; i < cmds->cnt; i++) { -+ if (cmds->names[i]) { -+ if (i == j) -+ j++; -+ else -+ cmds->names[j++] = cmds->names[i]; -+ } -+ } - cmds->cnt = j; -+ while (j < i) -+ cmds->names[j++] = NULL; - } - - void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes) --- -2.43.2 - -From 2c272ff9859601eb2ede3275af8f58777fd87928 Mon Sep 17 00:00:00 2001 -From: ChiYuan Huang <cy_huang@richtek.com> -Date: Fri, 29 Dec 2023 09:46:01 +0800 -Subject: [PATCH 1284/1501] ASoC: codecs: rtq9128: Fix PM_RUNTIME usage -Content-Length: 1082 -Lines: 32 - -[ Upstream commit 35040410372ca27a33cec8382d42c90b6b6c99f6 ] - -If 'pm_runtime_resume_and_get' is used, must check the return value to -prevent the active count not matched problem. - -Signed-off-by: ChiYuan Huang <cy_huang@richtek.com> -Link: https://msgid.link/r/bebd9e2bed9e0528a7fd9c528d785da02caf4f1a.1703813842.git.cy_huang@richtek.com -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - sound/soc/codecs/rtq9128.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/sound/soc/codecs/rtq9128.c b/sound/soc/codecs/rtq9128.c -index c22b047115cc..bda64f9eeb62 100644 ---- a/sound/soc/codecs/rtq9128.c -+++ b/sound/soc/codecs/rtq9128.c -@@ -391,7 +391,11 @@ static int rtq9128_component_probe(struct snd_soc_component *comp) - unsigned int val; - int i, ret; - -- pm_runtime_resume_and_get(comp->dev); -+ ret = pm_runtime_resume_and_get(comp->dev); -+ if (ret < 0) { -+ dev_err(comp->dev, "Failed to resume device (%d)\n", ret); -+ return ret; -+ } - - val = snd_soc_component_read(comp, RTQ9128_REG_EFUSE_DATA); - --- -2.43.2 - -From 242b5bffa23a9c108aa3383d207b6fc31d4de95b Mon Sep 17 00:00:00 2001 -From: ChiYuan Huang <cy_huang@richtek.com> -Date: Fri, 29 Dec 2023 09:46:02 +0800 -Subject: [PATCH 1285/1501] ASoC: codecs: rtq9128: Fix TDM enable and DAI - format control flow -Content-Length: 4066 -Lines: 130 - -[ Upstream commit 415d10ccef712f3ec73cd880c1fef3eb48601c3a ] - -To enable TDM mode, the current control flow limits the function -calling order should be 'set_tdm_slot->set_dai_fmt'. But not all -platform sound card like as simeple card to follow this design. -To bypass this limit, adjust the DAI format setting in runtime -'hw_param' callback. - -Signed-off-by: ChiYuan Huang <cy_huang@richtek.com> -Link: https://msgid.link/r/c4c8df00d8d179b8b5b39a8521de3a85325c57e8.1703813842.git.cy_huang@richtek.com -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - sound/soc/codecs/rtq9128.c | 67 ++++++++++++++++++++------------------ - 1 file changed, 36 insertions(+), 31 deletions(-) - -diff --git a/sound/soc/codecs/rtq9128.c b/sound/soc/codecs/rtq9128.c -index bda64f9eeb62..aa3eadecd974 100644 ---- a/sound/soc/codecs/rtq9128.c -+++ b/sound/soc/codecs/rtq9128.c -@@ -59,6 +59,7 @@ - - struct rtq9128_data { - struct gpio_desc *enable; -+ unsigned int daifmt; - int tdm_slots; - int tdm_slot_width; - bool tdm_input_data2_select; -@@ -441,10 +442,7 @@ static const struct snd_soc_component_driver rtq9128_comp_driver = { - static int rtq9128_dai_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) - { - struct rtq9128_data *data = snd_soc_dai_get_drvdata(dai); -- struct snd_soc_component *comp = dai->component; - struct device *dev = dai->dev; -- unsigned int audfmt, fmtval; -- int ret; - - dev_dbg(dev, "%s: fmt 0x%8x\n", __func__, fmt); - -@@ -454,35 +452,10 @@ static int rtq9128_dai_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) - return -EINVAL; - } - -- fmtval = fmt & SND_SOC_DAIFMT_FORMAT_MASK; -- if (data->tdm_slots && fmtval != SND_SOC_DAIFMT_DSP_A && fmtval != SND_SOC_DAIFMT_DSP_B) { -- dev_err(dev, "TDM is used, format only support DSP_A or DSP_B\n"); -- return -EINVAL; -- } -+ /* Store here and will be used in runtime hw_params for DAI format setting */ -+ data->daifmt = fmt; - -- switch (fmtval) { -- case SND_SOC_DAIFMT_I2S: -- audfmt = 8; -- break; -- case SND_SOC_DAIFMT_LEFT_J: -- audfmt = 9; -- break; -- case SND_SOC_DAIFMT_RIGHT_J: -- audfmt = 10; -- break; -- case SND_SOC_DAIFMT_DSP_A: -- audfmt = data->tdm_slots ? 12 : 11; -- break; -- case SND_SOC_DAIFMT_DSP_B: -- audfmt = data->tdm_slots ? 4 : 3; -- break; -- default: -- dev_err(dev, "Unsupported format 0x%8x\n", fmt); -- return -EINVAL; -- } -- -- ret = snd_soc_component_write_field(comp, RTQ9128_REG_I2S_OPT, RTQ9128_AUDFMT_MASK, audfmt); -- return ret < 0 ? ret : 0; -+ return 0; - } - - static int rtq9128_dai_set_tdm_slot(struct snd_soc_dai *dai, unsigned int tx_mask, -@@ -558,10 +531,38 @@ static int rtq9128_dai_hw_params(struct snd_pcm_substream *stream, struct snd_pc - unsigned int width, slot_width, bitrate, audbit, dolen; - struct snd_soc_component *comp = dai->component; - struct device *dev = dai->dev; -+ unsigned int fmtval, audfmt; - int ret; - - dev_dbg(dev, "%s: width %d\n", __func__, params_width(param)); - -+ fmtval = FIELD_GET(SND_SOC_DAIFMT_FORMAT_MASK, data->daifmt); -+ if (data->tdm_slots && fmtval != SND_SOC_DAIFMT_DSP_A && fmtval != SND_SOC_DAIFMT_DSP_B) { -+ dev_err(dev, "TDM is used, format only support DSP_A or DSP_B\n"); -+ return -EINVAL; -+ } -+ -+ switch (fmtval) { -+ case SND_SOC_DAIFMT_I2S: -+ audfmt = 8; -+ break; -+ case SND_SOC_DAIFMT_LEFT_J: -+ audfmt = 9; -+ break; -+ case SND_SOC_DAIFMT_RIGHT_J: -+ audfmt = 10; -+ break; -+ case SND_SOC_DAIFMT_DSP_A: -+ audfmt = data->tdm_slots ? 12 : 11; -+ break; -+ case SND_SOC_DAIFMT_DSP_B: -+ audfmt = data->tdm_slots ? 4 : 3; -+ break; -+ default: -+ dev_err(dev, "Unsupported format 0x%8x\n", fmtval); -+ return -EINVAL; -+ } -+ - switch (width = params_width(param)) { - case 16: - audbit = 0; -@@ -615,6 +616,10 @@ static int rtq9128_dai_hw_params(struct snd_pcm_substream *stream, struct snd_pc - return -EINVAL; - } - -+ ret = snd_soc_component_write_field(comp, RTQ9128_REG_I2S_OPT, RTQ9128_AUDFMT_MASK, audfmt); -+ if (ret < 0) -+ return ret; -+ - ret = snd_soc_component_write_field(comp, RTQ9128_REG_I2S_OPT, RTQ9128_AUDBIT_MASK, audbit); - if (ret < 0) - return ret; --- -2.43.2 - -From cb96e492d72d143d57db2d2bc143a1cee8741807 Mon Sep 17 00:00:00 2001 -From: Felix Kuehling <felix.kuehling@amd.com> -Date: Tue, 2 Jan 2024 15:07:44 -0500 -Subject: [PATCH 1286/1501] drm/amdkfd: Fix lock dependency warning -Content-Length: 5128 -Lines: 137 - -[ Upstream commit 47bf0f83fc86df1bf42b385a91aadb910137c5c9 ] - -====================================================== -WARNING: possible circular locking dependency detected -6.5.0-kfd-fkuehlin #276 Not tainted ------------------------------------------------------- -kworker/8:2/2676 is trying to acquire lock: -ffff9435aae95c88 ((work_completion)(&svm_bo->eviction_work)){+.+.}-{0:0}, at: __flush_work+0x52/0x550 - -but task is already holding lock: -ffff9435cd8e1720 (&svms->lock){+.+.}-{3:3}, at: svm_range_deferred_list_work+0xe8/0x340 [amdgpu] - -which lock already depends on the new lock. - -the existing dependency chain (in reverse order) is: - --> #2 (&svms->lock){+.+.}-{3:3}: - __mutex_lock+0x97/0xd30 - kfd_ioctl_alloc_memory_of_gpu+0x6d/0x3c0 [amdgpu] - kfd_ioctl+0x1b2/0x5d0 [amdgpu] - __x64_sys_ioctl+0x86/0xc0 - do_syscall_64+0x39/0x80 - entry_SYSCALL_64_after_hwframe+0x63/0xcd - --> #1 (&mm->mmap_lock){++++}-{3:3}: - down_read+0x42/0x160 - svm_range_evict_svm_bo_worker+0x8b/0x340 [amdgpu] - process_one_work+0x27a/0x540 - worker_thread+0x53/0x3e0 - kthread+0xeb/0x120 - ret_from_fork+0x31/0x50 - ret_from_fork_asm+0x11/0x20 - --> #0 ((work_completion)(&svm_bo->eviction_work)){+.+.}-{0:0}: - __lock_acquire+0x1426/0x2200 - lock_acquire+0xc1/0x2b0 - __flush_work+0x80/0x550 - __cancel_work_timer+0x109/0x190 - svm_range_bo_release+0xdc/0x1c0 [amdgpu] - svm_range_free+0x175/0x180 [amdgpu] - svm_range_deferred_list_work+0x15d/0x340 [amdgpu] - process_one_work+0x27a/0x540 - worker_thread+0x53/0x3e0 - kthread+0xeb/0x120 - ret_from_fork+0x31/0x50 - ret_from_fork_asm+0x11/0x20 - -other info that might help us debug this: - -Chain exists of: - (work_completion)(&svm_bo->eviction_work) --> &mm->mmap_lock --> &svms->lock - - Possible unsafe locking scenario: - - CPU0 CPU1 - ---- ---- - lock(&svms->lock); - lock(&mm->mmap_lock); - lock(&svms->lock); - lock((work_completion)(&svm_bo->eviction_work)); - -I believe this cannot really lead to a deadlock in practice, because -svm_range_evict_svm_bo_worker only takes the mmap_read_lock if the BO -refcount is non-0. That means it's impossible that svm_range_bo_release -is running concurrently. However, there is no good way to annotate this. - -To avoid the problem, take a BO reference in -svm_range_schedule_evict_svm_bo instead of in the worker. That way it's -impossible for a BO to get freed while eviction work is pending and the -cancel_work_sync call in svm_range_bo_release can be eliminated. - -v2: Use svm_bo_ref_unless_zero and explained why that's safe. Also -removed redundant checks that are already done in -amdkfd_fence_enable_signaling. - -Signed-off-by: Felix Kuehling <felix.kuehling@amd.com> -Reviewed-by: Philip Yang <philip.yang@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 26 ++++++++++---------------- - 1 file changed, 10 insertions(+), 16 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c -index a15bfb5223e8..92d8b1513e57 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c -@@ -400,14 +400,9 @@ static void svm_range_bo_release(struct kref *kref) - spin_lock(&svm_bo->list_lock); - } - spin_unlock(&svm_bo->list_lock); -- if (!dma_fence_is_signaled(&svm_bo->eviction_fence->base)) { -- /* We're not in the eviction worker. -- * Signal the fence and synchronize with any -- * pending eviction work. -- */ -+ if (!dma_fence_is_signaled(&svm_bo->eviction_fence->base)) -+ /* We're not in the eviction worker. Signal the fence. */ - dma_fence_signal(&svm_bo->eviction_fence->base); -- cancel_work_sync(&svm_bo->eviction_work); -- } - dma_fence_put(&svm_bo->eviction_fence->base); - amdgpu_bo_unref(&svm_bo->bo); - kfree(svm_bo); -@@ -3447,13 +3442,14 @@ svm_range_trigger_migration(struct mm_struct *mm, struct svm_range *prange, - - int svm_range_schedule_evict_svm_bo(struct amdgpu_amdkfd_fence *fence) - { -- if (!fence) -- return -EINVAL; -- -- if (dma_fence_is_signaled(&fence->base)) -- return 0; -- -- if (fence->svm_bo) { -+ /* Dereferencing fence->svm_bo is safe here because the fence hasn't -+ * signaled yet and we're under the protection of the fence->lock. -+ * After the fence is signaled in svm_range_bo_release, we cannot get -+ * here any more. -+ * -+ * Reference is dropped in svm_range_evict_svm_bo_worker. -+ */ -+ if (svm_bo_ref_unless_zero(fence->svm_bo)) { - WRITE_ONCE(fence->svm_bo->evicting, 1); - schedule_work(&fence->svm_bo->eviction_work); - } -@@ -3468,8 +3464,6 @@ static void svm_range_evict_svm_bo_worker(struct work_struct *work) - int r = 0; - - svm_bo = container_of(work, struct svm_range_bo, eviction_work); -- if (!svm_bo_ref_unless_zero(svm_bo)) -- return; /* svm_bo was freed while eviction was pending */ - - if (mmget_not_zero(svm_bo->eviction_fence->mm)) { - mm = svm_bo->eviction_fence->mm; --- -2.43.2 - -From 61b918ca6094a7db965827f2217b60f4ad0ac602 Mon Sep 17 00:00:00 2001 -From: Martin Tsai <martin.tsai@amd.com> -Date: Mon, 18 Dec 2023 16:36:44 +0800 -Subject: [PATCH 1287/1501] drm/amd/display: To adjust dprefclk by down spread - percentage -Content-Length: 10854 -Lines: 261 - -[ Upstream commit 17e74e11ac2b46e7514705ae7abfb93ac0e20bd6 ] - -[Why] -Panels show corruption with high refresh rate timings when ssc is -enabled. - -[How] -Read down-spread percentage from lut to adjust dprefclk. Issues come -from S0i3 with this commit has been fixed by SMU. - -Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> -Acked-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com> -Signed-off-by: Martin Tsai <martin.tsai@amd.com> -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../dc/clk_mgr/dcn314/dcn314_clk_mgr.c | 71 ++++++++++++++++++- - .../dc/clk_mgr/dcn314/dcn314_clk_mgr.h | 11 +++ - .../gpu/drm/amd/display/dc/dce/dce_audio.c | 2 +- - .../drm/amd/display/dc/dce/dce_clock_source.c | 9 ++- - .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 2 +- - .../gpu/drm/amd/display/dc/inc/hw/clk_mgr.h | 1 + - .../gpu/drm/amd/display/include/audio_types.h | 2 +- - 7 files changed, 93 insertions(+), 5 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c -index 59c2a3545db3..a84f1e376dee 100644 ---- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c -@@ -87,6 +87,20 @@ static const struct IP_BASE CLK_BASE = { { { { 0x00016C00, 0x02401800, 0, 0, 0, - #define CLK1_CLK_PLL_REQ__PllSpineDiv_MASK 0x0000F000L - #define CLK1_CLK_PLL_REQ__FbMult_frac_MASK 0xFFFF0000L - -+#define regCLK1_CLK2_BYPASS_CNTL 0x029c -+#define regCLK1_CLK2_BYPASS_CNTL_BASE_IDX 0 -+ -+#define CLK1_CLK2_BYPASS_CNTL__CLK2_BYPASS_SEL__SHIFT 0x0 -+#define CLK1_CLK2_BYPASS_CNTL__CLK2_BYPASS_DIV__SHIFT 0x10 -+#define CLK1_CLK2_BYPASS_CNTL__CLK2_BYPASS_SEL_MASK 0x00000007L -+#define CLK1_CLK2_BYPASS_CNTL__CLK2_BYPASS_DIV_MASK 0x000F0000L -+ -+#define regCLK6_0_CLK6_spll_field_8 0x464b -+#define regCLK6_0_CLK6_spll_field_8_BASE_IDX 0 -+ -+#define CLK6_0_CLK6_spll_field_8__spll_ssc_en__SHIFT 0xd -+#define CLK6_0_CLK6_spll_field_8__spll_ssc_en_MASK 0x00002000L -+ - #define REG(reg_name) \ - (CLK_BASE.instance[0].segment[reg ## reg_name ## _BASE_IDX] + reg ## reg_name) - -@@ -157,6 +171,37 @@ static void dcn314_disable_otg_wa(struct clk_mgr *clk_mgr_base, struct dc_state - } - } - -+bool dcn314_is_spll_ssc_enabled(struct clk_mgr *clk_mgr_base) -+{ -+ struct clk_mgr_internal *clk_mgr = TO_CLK_MGR_INTERNAL(clk_mgr_base); -+ uint32_t ssc_enable; -+ -+ REG_GET(CLK6_0_CLK6_spll_field_8, spll_ssc_en, &ssc_enable); -+ -+ return ssc_enable == 1; -+} -+ -+void dcn314_init_clocks(struct clk_mgr *clk_mgr) -+{ -+ struct clk_mgr_internal *clk_mgr_int = TO_CLK_MGR_INTERNAL(clk_mgr); -+ uint32_t ref_dtbclk = clk_mgr->clks.ref_dtbclk_khz; -+ -+ memset(&(clk_mgr->clks), 0, sizeof(struct dc_clocks)); -+ // Assumption is that boot state always supports pstate -+ clk_mgr->clks.ref_dtbclk_khz = ref_dtbclk; // restore ref_dtbclk -+ clk_mgr->clks.p_state_change_support = true; -+ clk_mgr->clks.prev_p_state_change_support = true; -+ clk_mgr->clks.pwr_state = DCN_PWR_STATE_UNKNOWN; -+ clk_mgr->clks.zstate_support = DCN_ZSTATE_SUPPORT_UNKNOWN; -+ -+ // to adjust dp_dto reference clock if ssc is enable otherwise to apply dprefclk -+ if (dcn314_is_spll_ssc_enabled(clk_mgr)) -+ clk_mgr->dp_dto_source_clock_in_khz = -+ dce_adjust_dp_ref_freq_for_ss(clk_mgr_int, clk_mgr->dprefclk_khz); -+ else -+ clk_mgr->dp_dto_source_clock_in_khz = clk_mgr->dprefclk_khz; -+} -+ - void dcn314_update_clocks(struct clk_mgr *clk_mgr_base, - struct dc_state *context, - bool safe_to_lower) -@@ -433,6 +478,11 @@ static DpmClocks314_t dummy_clocks; - - static struct dcn314_watermarks dummy_wms = { 0 }; - -+static struct dcn314_ss_info_table ss_info_table = { -+ .ss_divider = 1000, -+ .ss_percentage = {0, 0, 375, 375, 375} -+}; -+ - static void dcn314_build_watermark_ranges(struct clk_bw_params *bw_params, struct dcn314_watermarks *table) - { - int i, num_valid_sets; -@@ -705,13 +755,31 @@ static struct clk_mgr_funcs dcn314_funcs = { - .get_dp_ref_clk_frequency = dce12_get_dp_ref_freq_khz, - .get_dtb_ref_clk_frequency = dcn31_get_dtb_ref_freq_khz, - .update_clocks = dcn314_update_clocks, -- .init_clocks = dcn31_init_clocks, -+ .init_clocks = dcn314_init_clocks, - .enable_pme_wa = dcn314_enable_pme_wa, - .are_clock_states_equal = dcn314_are_clock_states_equal, - .notify_wm_ranges = dcn314_notify_wm_ranges - }; - extern struct clk_mgr_funcs dcn3_fpga_funcs; - -+static void dcn314_read_ss_info_from_lut(struct clk_mgr_internal *clk_mgr) -+{ -+ uint32_t clock_source; -+ //uint32_t ssc_enable; -+ -+ REG_GET(CLK1_CLK2_BYPASS_CNTL, CLK2_BYPASS_SEL, &clock_source); -+ //REG_GET(CLK6_0_CLK6_spll_field_8, spll_ssc_en, &ssc_enable); -+ -+ if (dcn314_is_spll_ssc_enabled(&clk_mgr->base) && (clock_source < ARRAY_SIZE(ss_info_table.ss_percentage))) { -+ clk_mgr->dprefclk_ss_percentage = ss_info_table.ss_percentage[clock_source]; -+ -+ if (clk_mgr->dprefclk_ss_percentage != 0) { -+ clk_mgr->ss_on_dprefclk = true; -+ clk_mgr->dprefclk_ss_divider = ss_info_table.ss_divider; -+ } -+ } -+} -+ - void dcn314_clk_mgr_construct( - struct dc_context *ctx, - struct clk_mgr_dcn314 *clk_mgr, -@@ -779,6 +847,7 @@ void dcn314_clk_mgr_construct( - clk_mgr->base.base.dprefclk_khz = 600000; - clk_mgr->base.base.clks.ref_dtbclk_khz = 600000; - dce_clock_read_ss_info(&clk_mgr->base); -+ dcn314_read_ss_info_from_lut(&clk_mgr->base); - /*if bios enabled SS, driver needs to adjust dtb clock, only enable with correct bios*/ - - clk_mgr->base.base.bw_params = &dcn314_bw_params; -diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h -index 171f84340eb2..002c28e80720 100644 ---- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h -+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h -@@ -28,6 +28,8 @@ - #define __DCN314_CLK_MGR_H__ - #include "clk_mgr_internal.h" - -+#define DCN314_NUM_CLOCK_SOURCES 5 -+ - struct dcn314_watermarks; - - struct dcn314_smu_watermark_set { -@@ -40,9 +42,18 @@ struct clk_mgr_dcn314 { - struct dcn314_smu_watermark_set smu_wm_set; - }; - -+struct dcn314_ss_info_table { -+ uint32_t ss_divider; -+ uint32_t ss_percentage[DCN314_NUM_CLOCK_SOURCES]; -+}; -+ - bool dcn314_are_clock_states_equal(struct dc_clocks *a, - struct dc_clocks *b); - -+bool dcn314_is_spll_ssc_enabled(struct clk_mgr *clk_mgr_base); -+ -+void dcn314_init_clocks(struct clk_mgr *clk_mgr); -+ - void dcn314_update_clocks(struct clk_mgr *clk_mgr_base, - struct dc_state *context, - bool safe_to_lower); -diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_audio.c b/drivers/gpu/drm/amd/display/dc/dce/dce_audio.c -index 140598f18bbd..f0458b8f00af 100644 ---- a/drivers/gpu/drm/amd/display/dc/dce/dce_audio.c -+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_audio.c -@@ -782,7 +782,7 @@ static void get_azalia_clock_info_dp( - /*audio_dto_module = dpDtoSourceClockInkhz * 10,000; - * [khz] ->[100Hz] */ - azalia_clock_info->audio_dto_module = -- pll_info->dp_dto_source_clock_in_khz * 10; -+ pll_info->audio_dto_source_clock_in_khz * 10; - } - - void dce_aud_wall_dto_setup( -diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c -index 5d3f6fa1011e..970644b695cd 100644 ---- a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c -+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c -@@ -975,6 +975,9 @@ static bool dcn31_program_pix_clk( - look_up_in_video_optimized_rate_tlb(pix_clk_params->requested_pix_clk_100hz / 10); - struct bp_pixel_clock_parameters bp_pc_params = {0}; - enum transmitter_color_depth bp_pc_colour_depth = TRANSMITTER_COLOR_DEPTH_24; -+ -+ if (clock_source->ctx->dc->clk_mgr->dp_dto_source_clock_in_khz != 0) -+ dp_dto_ref_khz = clock_source->ctx->dc->clk_mgr->dp_dto_source_clock_in_khz; - // For these signal types Driver to program DP_DTO without calling VBIOS Command table - if (dc_is_dp_signal(pix_clk_params->signal_type) || dc_is_virtual_signal(pix_clk_params->signal_type)) { - if (e) { -@@ -1088,6 +1091,10 @@ static bool get_pixel_clk_frequency_100hz( - struct dce110_clk_src *clk_src = TO_DCE110_CLK_SRC(clock_source); - unsigned int clock_hz = 0; - unsigned int modulo_hz = 0; -+ unsigned int dp_dto_ref_khz = clock_source->ctx->dc->clk_mgr->dprefclk_khz; -+ -+ if (clock_source->ctx->dc->clk_mgr->dp_dto_source_clock_in_khz != 0) -+ dp_dto_ref_khz = clock_source->ctx->dc->clk_mgr->dp_dto_source_clock_in_khz; - - if (clock_source->id == CLOCK_SOURCE_ID_DP_DTO) { - clock_hz = REG_READ(PHASE[inst]); -@@ -1100,7 +1107,7 @@ static bool get_pixel_clk_frequency_100hz( - modulo_hz = REG_READ(MODULO[inst]); - if (modulo_hz) - *pixel_clk_khz = div_u64((uint64_t)clock_hz* -- clock_source->ctx->dc->clk_mgr->dprefclk_khz*10, -+ dp_dto_ref_khz*10, - modulo_hz); - else - *pixel_clk_khz = 0; -diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c -index 578e51a19fdd..9fedf9947569 100644 ---- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c -@@ -1353,7 +1353,7 @@ static void build_audio_output( - if (state->clk_mgr && - (pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT || - pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST)) { -- audio_output->pll_info.dp_dto_source_clock_in_khz = -+ audio_output->pll_info.audio_dto_source_clock_in_khz = - state->clk_mgr->funcs->get_dp_ref_clk_frequency( - state->clk_mgr); - } -diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr.h b/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr.h -index fa9614bcb160..55ded5fb8a38 100644 ---- a/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr.h -+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr.h -@@ -314,6 +314,7 @@ struct clk_mgr { - bool force_smu_not_present; - bool dc_mode_softmax_enabled; - int dprefclk_khz; // Used by program pixel clock in clock source funcs, need to figureout where this goes -+ int dp_dto_source_clock_in_khz; // Used to program DP DTO with ss adjustment on DCN314 - int dentist_vco_freq_khz; - struct clk_state_registers_and_bypass boot_snapshot; - struct clk_bw_params *bw_params; -diff --git a/drivers/gpu/drm/amd/display/include/audio_types.h b/drivers/gpu/drm/amd/display/include/audio_types.h -index 66a54da0641c..915a031a43cb 100644 ---- a/drivers/gpu/drm/amd/display/include/audio_types.h -+++ b/drivers/gpu/drm/amd/display/include/audio_types.h -@@ -64,7 +64,7 @@ enum audio_dto_source { - /* PLL information required for AZALIA DTO calculation */ - - struct audio_pll_info { -- uint32_t dp_dto_source_clock_in_khz; -+ uint32_t audio_dto_source_clock_in_khz; - uint32_t feed_back_divider; - enum audio_dto_source dto_source; - bool ss_enabled; --- -2.43.2 - -From ce330615d4aebef3ff292ba3e403207dd7e1e1a0 Mon Sep 17 00:00:00 2001 -From: Daniel Miess <daniel.miess@amd.com> -Date: Wed, 20 Dec 2023 10:34:32 -0500 -Subject: [PATCH 1288/1501] Revert "drm/amd/display: Fix conversions between - bytes and KB" -Content-Length: 2003 -Lines: 32 - -[ Upstream commit bf282eb92b84709d99186ad5940b9997eb3c1ff2 ] - -This reverts commit d0f639c5869399bf6dde4d694d5f8c0ab8c0ec46. - -The previous commit causes failure to light up for 1080p -eDP + 8k HDMI panel combo. - -Reviewed-by: Charlene Liu <charlene.liu@amd.com> -Acked-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com> -Signed-off-by: Daniel Miess <daniel.miess@amd.com> -Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c -index 62ce95bac8f2..9be5ebf3a8c0 100644 ---- a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c -+++ b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c -@@ -6229,7 +6229,7 @@ static void set_calculate_prefetch_schedule_params(struct display_mode_lib_st *m - CalculatePrefetchSchedule_params->GPUVMEnable = mode_lib->ms.cache_display_cfg.plane.GPUVMEnable; - CalculatePrefetchSchedule_params->HostVMEnable = mode_lib->ms.cache_display_cfg.plane.HostVMEnable; - CalculatePrefetchSchedule_params->HostVMMaxNonCachedPageTableLevels = mode_lib->ms.cache_display_cfg.plane.HostVMMaxPageTableLevels; -- CalculatePrefetchSchedule_params->HostVMMinPageSize = mode_lib->ms.soc.hostvm_min_page_size_kbytes; -+ CalculatePrefetchSchedule_params->HostVMMinPageSize = mode_lib->ms.soc.hostvm_min_page_size_kbytes * 1024; - CalculatePrefetchSchedule_params->DynamicMetadataEnable = mode_lib->ms.cache_display_cfg.plane.DynamicMetadataEnable[k]; - CalculatePrefetchSchedule_params->DynamicMetadataVMEnabled = mode_lib->ms.ip.dynamic_metadata_vm_enabled; - CalculatePrefetchSchedule_params->DynamicMetadataLinesBeforeActiveRequired = mode_lib->ms.cache_display_cfg.plane.DynamicMetadataLinesBeforeActiveRequired[k]; --- -2.43.2 - -From 1556c242e64cdffe58736aa650b0b395854fe4d4 Mon Sep 17 00:00:00 2001 -From: Philip Yang <Philip.Yang@amd.com> -Date: Fri, 29 Dec 2023 15:19:25 -0500 -Subject: [PATCH 1289/1501] drm/amdkfd: Fix lock dependency warning with srcu -Content-Length: 3370 -Lines: 95 - -[ Upstream commit 2a9de42e8d3c82c6990d226198602be44f43f340 ] - -====================================================== -WARNING: possible circular locking dependency detected -6.5.0-kfd-yangp #2289 Not tainted ------------------------------------------------------- -kworker/0:2/996 is trying to acquire lock: - (srcu){.+.+}-{0:0}, at: __synchronize_srcu+0x5/0x1a0 - -but task is already holding lock: - ((work_completion)(&svms->deferred_list_work)){+.+.}-{0:0}, at: - process_one_work+0x211/0x560 - -which lock already depends on the new lock. - -the existing dependency chain (in reverse order) is: - --> #3 ((work_completion)(&svms->deferred_list_work)){+.+.}-{0:0}: - __flush_work+0x88/0x4f0 - svm_range_list_lock_and_flush_work+0x3d/0x110 [amdgpu] - svm_range_set_attr+0xd6/0x14c0 [amdgpu] - kfd_ioctl+0x1d1/0x630 [amdgpu] - __x64_sys_ioctl+0x88/0xc0 - --> #2 (&info->lock#2){+.+.}-{3:3}: - __mutex_lock+0x99/0xc70 - amdgpu_amdkfd_gpuvm_restore_process_bos+0x54/0x740 [amdgpu] - restore_process_helper+0x22/0x80 [amdgpu] - restore_process_worker+0x2d/0xa0 [amdgpu] - process_one_work+0x29b/0x560 - worker_thread+0x3d/0x3d0 - --> #1 ((work_completion)(&(&process->restore_work)->work)){+.+.}-{0:0}: - __flush_work+0x88/0x4f0 - __cancel_work_timer+0x12c/0x1c0 - kfd_process_notifier_release_internal+0x37/0x1f0 [amdgpu] - __mmu_notifier_release+0xad/0x240 - exit_mmap+0x6a/0x3a0 - mmput+0x6a/0x120 - do_exit+0x322/0xb90 - do_group_exit+0x37/0xa0 - __x64_sys_exit_group+0x18/0x20 - do_syscall_64+0x38/0x80 - --> #0 (srcu){.+.+}-{0:0}: - __lock_acquire+0x1521/0x2510 - lock_sync+0x5f/0x90 - __synchronize_srcu+0x4f/0x1a0 - __mmu_notifier_release+0x128/0x240 - exit_mmap+0x6a/0x3a0 - mmput+0x6a/0x120 - svm_range_deferred_list_work+0x19f/0x350 [amdgpu] - process_one_work+0x29b/0x560 - worker_thread+0x3d/0x3d0 - -other info that might help us debug this: -Chain exists of: - srcu --> &info->lock#2 --> (work_completion)(&svms->deferred_list_work) - -Possible unsafe locking scenario: - - CPU0 CPU1 - ---- ---- - lock((work_completion)(&svms->deferred_list_work)); - lock(&info->lock#2); - lock((work_completion)(&svms->deferred_list_work)); - sync(srcu); - -Signed-off-by: Philip Yang <Philip.Yang@amd.com> -Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c -index 92d8b1513e57..f66f88d2b643 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c -@@ -2366,8 +2366,10 @@ static void svm_range_deferred_list_work(struct work_struct *work) - mutex_unlock(&svms->lock); - mmap_write_unlock(mm); - -- /* Pairs with mmget in svm_range_add_list_work */ -- mmput(mm); -+ /* Pairs with mmget in svm_range_add_list_work. If dropping the -+ * last mm refcount, schedule release work to avoid circular locking -+ */ -+ mmput_async(mm); - - spin_lock(&svms->deferred_list_lock); - } --- -2.43.2 - -From b2b4599cd10c210191bd4d7362c54db1fdd84976 Mon Sep 17 00:00:00 2001 -From: Zhu Yanjun <yanjun.zhu@linux.dev> -Date: Thu, 4 Jan 2024 10:09:02 +0800 -Subject: [PATCH 1290/1501] =?UTF-8?q?virtio=5Fnet:=20Fix=20"=E2=80=98%d?= - =?UTF-8?q?=E2=80=99=20directive=20writing=20between=201=20and=2011=20byte?= - =?UTF-8?q?s=20into=20a=20region=20of=20size=2010"=20warnings?= -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 3226 -Lines: 71 - -[ Upstream commit e3fe8d28c67bf6c291e920c6d04fa22afa14e6e4 ] - -Fix the warnings when building virtio_net driver. - -" -drivers/net/virtio_net.c: In function ‘init_vqs’: -drivers/net/virtio_net.c:4551:48: warning: ‘%d’ directive writing between 1 and 11 bytes into a region of size 10 [-Wformat-overflow=] - 4551 | sprintf(vi->rq[i].name, "input.%d", i); - | ^~ -In function ‘virtnet_find_vqs’, - inlined from ‘init_vqs’ at drivers/net/virtio_net.c:4645:8: -drivers/net/virtio_net.c:4551:41: note: directive argument in the range [-2147483643, 65534] - 4551 | sprintf(vi->rq[i].name, "input.%d", i); - | ^~~~~~~~~~ -drivers/net/virtio_net.c:4551:17: note: ‘sprintf’ output between 8 and 18 bytes into a destination of size 16 - 4551 | sprintf(vi->rq[i].name, "input.%d", i); - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -drivers/net/virtio_net.c: In function ‘init_vqs’: -drivers/net/virtio_net.c:4552:49: warning: ‘%d’ directive writing between 1 and 11 bytes into a region of size 9 [-Wformat-overflow=] - 4552 | sprintf(vi->sq[i].name, "output.%d", i); - | ^~ -In function ‘virtnet_find_vqs’, - inlined from ‘init_vqs’ at drivers/net/virtio_net.c:4645:8: -drivers/net/virtio_net.c:4552:41: note: directive argument in the range [-2147483643, 65534] - 4552 | sprintf(vi->sq[i].name, "output.%d", i); - | ^~~~~~~~~~~ -drivers/net/virtio_net.c:4552:17: note: ‘sprintf’ output between 9 and 19 bytes into a destination of size 16 - 4552 | sprintf(vi->sq[i].name, "output.%d", i); - -" - -Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com> -Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev> -Link: https://lore.kernel.org/r/20240104020902.2753599-1-yanjun.zhu@intel.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/virtio_net.c | 9 +++++---- - 1 file changed, 5 insertions(+), 4 deletions(-) - -diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c -index 51b1868d2f22..1caf21fd5032 100644 ---- a/drivers/net/virtio_net.c -+++ b/drivers/net/virtio_net.c -@@ -4096,10 +4096,11 @@ static int virtnet_find_vqs(struct virtnet_info *vi) - { - vq_callback_t **callbacks; - struct virtqueue **vqs; -- int ret = -ENOMEM; -- int i, total_vqs; - const char **names; -+ int ret = -ENOMEM; -+ int total_vqs; - bool *ctx; -+ u16 i; - - /* We expect 1 RX virtqueue followed by 1 TX virtqueue, followed by - * possible N-1 RX/TX queue pairs used in multiqueue mode, followed by -@@ -4136,8 +4137,8 @@ static int virtnet_find_vqs(struct virtnet_info *vi) - for (i = 0; i < vi->max_queue_pairs; i++) { - callbacks[rxq2vq(i)] = skb_recv_done; - callbacks[txq2vq(i)] = skb_xmit_done; -- sprintf(vi->rq[i].name, "input.%d", i); -- sprintf(vi->sq[i].name, "output.%d", i); -+ sprintf(vi->rq[i].name, "input.%u", i); -+ sprintf(vi->sq[i].name, "output.%u", i); - names[rxq2vq(i)] = vi->rq[i].name; - names[txq2vq(i)] = vi->sq[i].name; - if (ctx) --- -2.43.2 - -From f1bc0d8163f8ee84a8d5affdf624cfad657df1d2 Mon Sep 17 00:00:00 2001 -From: Ming Lei <ming.lei@redhat.com> -Date: Fri, 12 Jan 2024 20:26:26 +0800 -Subject: [PATCH 1291/1501] blk-mq: fix IO hang from sbitmap wakeup race -Content-Length: 2516 -Lines: 64 - -[ Upstream commit 5266caaf5660529e3da53004b8b7174cab6374ed ] - -In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered -with the following blk_mq_get_driver_tag() in case of getting driver -tag failure. - -Then in __sbitmap_queue_wake_up(), waitqueue_active() may not observe -the added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime -blk_mq_mark_tag_wait() can't get driver tag successfully. - -This issue can be reproduced by running the following test in loop, and -fio hang can be observed in < 30min when running it on my test VM -in laptop. - - modprobe -r scsi_debug - modprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4 - dev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename` - fio --filename=/dev/"$dev" --direct=1 --rw=randrw --bs=4k --iodepth=1 \ - --runtime=100 --numjobs=40 --time_based --name=test \ - --ioengine=libaio - -Fix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which -is just fine in case of running out of tag. - -Cc: Jan Kara <jack@suse.cz> -Cc: Kemeng Shi <shikemeng@huaweicloud.com> -Reported-by: Changhui Zhong <czhong@redhat.com> -Signed-off-by: Ming Lei <ming.lei@redhat.com> -Link: https://lore.kernel.org/r/20240112122626.4181044-1-ming.lei@redhat.com -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - block/blk-mq.c | 16 ++++++++++++++++ - 1 file changed, 16 insertions(+) - -diff --git a/block/blk-mq.c b/block/blk-mq.c -index 7e743ac58c31..a71974a5e57c 100644 ---- a/block/blk-mq.c -+++ b/block/blk-mq.c -@@ -1858,6 +1858,22 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx, - wait->flags &= ~WQ_FLAG_EXCLUSIVE; - __add_wait_queue(wq, wait); - -+ /* -+ * Add one explicit barrier since blk_mq_get_driver_tag() may -+ * not imply barrier in case of failure. -+ * -+ * Order adding us to wait queue and allocating driver tag. -+ * -+ * The pair is the one implied in sbitmap_queue_wake_up() which -+ * orders clearing sbitmap tag bits and waitqueue_active() in -+ * __sbitmap_queue_wake_up(), since waitqueue_active() is lockless -+ * -+ * Otherwise, re-order of adding wait queue and getting driver tag -+ * may cause __sbitmap_queue_wake_up() to wake up nothing because -+ * the waitqueue_active() may not observe us in wait queue. -+ */ -+ smp_mb(); -+ - /* - * It's possible that a tag was freed in the window between the - * allocation failure and adding the hardware queue to the wait --- -2.43.2 - -From 62b3b5271bd974a26b67aa5087e0a651b77d7b22 Mon Sep 17 00:00:00 2001 -From: Venky Shankar <vshankar@redhat.com> -Date: Mon, 6 Nov 2023 10:02:32 +0530 -Subject: [PATCH 1292/1501] ceph: reinitialize mds feature bit even when - session in open -Content-Length: 1457 -Lines: 38 - -[ Upstream commit f48e0342a74d7770cdf1d11894bdc3b6d989b29e ] - -Following along the same lines as per the user-space fix. Right -now this isn't really an issue with the ceph kernel driver because -of the feature bit laginess, however, that can change over time -(when the new snaprealm info type is ported to the kernel driver) -and depending on the MDS version that's being upgraded can cause -message decoding issues - so, fix that early on. - -Link: http://tracker.ceph.com/issues/63188 -Signed-off-by: Venky Shankar <vshankar@redhat.com> -Reviewed-by: Xiubo Li <xiubli@redhat.com> -Signed-off-by: Ilya Dryomov <idryomov@gmail.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/ceph/mds_client.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c -index d95eb525519a..558c3af44449 100644 ---- a/fs/ceph/mds_client.c -+++ b/fs/ceph/mds_client.c -@@ -4128,12 +4128,12 @@ static void handle_session(struct ceph_mds_session *session, - pr_info_client(cl, "mds%d reconnect success\n", - session->s_mds); - -+ session->s_features = features; - if (session->s_state == CEPH_MDS_SESSION_OPEN) { - pr_notice_client(cl, "mds%d is already opened\n", - session->s_mds); - } else { - session->s_state = CEPH_MDS_SESSION_OPEN; -- session->s_features = features; - renewed_caps(mdsc, session, 0); - if (test_bit(CEPHFS_FEATURE_METRIC_COLLECT, - &session->s_features)) --- -2.43.2 - -From 76cb2aa3421fee4fde706dec41b1344bc0a9ad67 Mon Sep 17 00:00:00 2001 -From: Xiubo Li <xiubli@redhat.com> -Date: Fri, 17 Nov 2023 13:26:18 +0800 -Subject: [PATCH 1293/1501] ceph: fix deadlock or deadcode of misusing dget() -Content-Length: 1819 -Lines: 56 - -[ Upstream commit b493ad718b1f0357394d2cdecbf00a44a36fa085 ] - -The lock order is incorrect between denty and its parent, we should -always make sure that the parent get the lock first. - -But since this deadcode is never used and the parent dir will always -be set from the callers, let's just remove it. - -Link: https://lore.kernel.org/r/20231116081919.GZ1957730@ZenIV -Reported-by: Al Viro <viro@zeniv.linux.org.uk> -Signed-off-by: Xiubo Li <xiubli@redhat.com> -Reviewed-by: Jeff Layton <jlayton@kernel.org> -Signed-off-by: Ilya Dryomov <idryomov@gmail.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/ceph/caps.c | 9 +++------ - 1 file changed, 3 insertions(+), 6 deletions(-) - -diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c -index 2c0b8dc3dd0d..9c02f328c966 100644 ---- a/fs/ceph/caps.c -+++ b/fs/ceph/caps.c -@@ -4887,13 +4887,15 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, - struct inode *dir, - int mds, int drop, int unless) - { -- struct dentry *parent = NULL; - struct ceph_mds_request_release *rel = *p; - struct ceph_dentry_info *di = ceph_dentry(dentry); - struct ceph_client *cl; - int force = 0; - int ret; - -+ /* This shouldn't happen */ -+ BUG_ON(!dir); -+ - /* - * force an record for the directory caps if we have a dentry lease. - * this is racy (can't take i_ceph_lock and d_lock together), but it -@@ -4903,14 +4905,9 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, - spin_lock(&dentry->d_lock); - if (di->lease_session && di->lease_session->s_mds == mds) - force = 1; -- if (!dir) { -- parent = dget(dentry->d_parent); -- dir = d_inode(parent); -- } - spin_unlock(&dentry->d_lock); - - ret = ceph_encode_inode_release(p, dir, mds, drop, unless, force); -- dput(parent); - - cl = ceph_inode_to_client(dir); - spin_lock(&dentry->d_lock); --- -2.43.2 - -From f3113dfb5a39a8afb9eb6c425ca09835ab84e420 Mon Sep 17 00:00:00 2001 -From: Wenchao Hao <haowenchao2@huawei.com> -Date: Thu, 23 Nov 2023 09:53:40 +0800 -Subject: [PATCH 1294/1501] ceph: fix invalid pointer access if get_quota_realm - return ERR_PTR -Content-Length: 4717 -Lines: 131 - -[ Upstream commit 0f4cf64eabc6e16cfc2704f1960e82dc79d91c8d ] - -This issue is reported by smatch that get_quota_realm() might return -ERR_PTR but we did not handle it. It's not a immediate bug, while we -still should address it to avoid potential bugs if get_quota_realm() -is changed to return other ERR_PTR in future. - -Set ceph_snap_realm's pointer in get_quota_realm()'s to address this -issue, the pointer would be set to NULL if get_quota_realm() failed -to get struct ceph_snap_realm, so no ERR_PTR would happen any more. - -[ xiubli: minor code style clean up ] - -Signed-off-by: Wenchao Hao <haowenchao2@huawei.com> -Reviewed-by: Xiubo Li <xiubli@redhat.com> -Signed-off-by: Ilya Dryomov <idryomov@gmail.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/ceph/quota.c | 39 ++++++++++++++++++++++----------------- - 1 file changed, 22 insertions(+), 17 deletions(-) - -diff --git a/fs/ceph/quota.c b/fs/ceph/quota.c -index 9d36c3532de1..06ee397e0c3a 100644 ---- a/fs/ceph/quota.c -+++ b/fs/ceph/quota.c -@@ -197,10 +197,10 @@ void ceph_cleanup_quotarealms_inodes(struct ceph_mds_client *mdsc) - } - - /* -- * This function walks through the snaprealm for an inode and returns the -- * ceph_snap_realm for the first snaprealm that has quotas set (max_files, -+ * This function walks through the snaprealm for an inode and set the -+ * realmp with the first snaprealm that has quotas set (max_files, - * max_bytes, or any, depending on the 'which_quota' argument). If the root is -- * reached, return the root ceph_snap_realm instead. -+ * reached, set the realmp with the root ceph_snap_realm instead. - * - * Note that the caller is responsible for calling ceph_put_snap_realm() on the - * returned realm. -@@ -211,10 +211,9 @@ void ceph_cleanup_quotarealms_inodes(struct ceph_mds_client *mdsc) - * this function will return -EAGAIN; otherwise, the snaprealms walk-through - * will be restarted. - */ --static struct ceph_snap_realm *get_quota_realm(struct ceph_mds_client *mdsc, -- struct inode *inode, -- enum quota_get_realm which_quota, -- bool retry) -+static int get_quota_realm(struct ceph_mds_client *mdsc, struct inode *inode, -+ enum quota_get_realm which_quota, -+ struct ceph_snap_realm **realmp, bool retry) - { - struct ceph_client *cl = mdsc->fsc->client; - struct ceph_inode_info *ci = NULL; -@@ -222,8 +221,10 @@ static struct ceph_snap_realm *get_quota_realm(struct ceph_mds_client *mdsc, - struct inode *in; - bool has_quota; - -+ if (realmp) -+ *realmp = NULL; - if (ceph_snap(inode) != CEPH_NOSNAP) -- return NULL; -+ return 0; - - restart: - realm = ceph_inode(inode)->i_snap_realm; -@@ -250,7 +251,7 @@ static struct ceph_snap_realm *get_quota_realm(struct ceph_mds_client *mdsc, - break; - ceph_put_snap_realm(mdsc, realm); - if (!retry) -- return ERR_PTR(-EAGAIN); -+ return -EAGAIN; - goto restart; - } - -@@ -259,8 +260,11 @@ static struct ceph_snap_realm *get_quota_realm(struct ceph_mds_client *mdsc, - iput(in); - - next = realm->parent; -- if (has_quota || !next) -- return realm; -+ if (has_quota || !next) { -+ if (realmp) -+ *realmp = realm; -+ return 0; -+ } - - ceph_get_snap_realm(mdsc, next); - ceph_put_snap_realm(mdsc, realm); -@@ -269,7 +273,7 @@ static struct ceph_snap_realm *get_quota_realm(struct ceph_mds_client *mdsc, - if (realm) - ceph_put_snap_realm(mdsc, realm); - -- return NULL; -+ return 0; - } - - bool ceph_quota_is_same_realm(struct inode *old, struct inode *new) -@@ -277,6 +281,7 @@ bool ceph_quota_is_same_realm(struct inode *old, struct inode *new) - struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(old->i_sb); - struct ceph_snap_realm *old_realm, *new_realm; - bool is_same; -+ int ret; - - restart: - /* -@@ -286,9 +291,9 @@ bool ceph_quota_is_same_realm(struct inode *old, struct inode *new) - * dropped and we can then restart the whole operation. - */ - down_read(&mdsc->snap_rwsem); -- old_realm = get_quota_realm(mdsc, old, QUOTA_GET_ANY, true); -- new_realm = get_quota_realm(mdsc, new, QUOTA_GET_ANY, false); -- if (PTR_ERR(new_realm) == -EAGAIN) { -+ get_quota_realm(mdsc, old, QUOTA_GET_ANY, &old_realm, true); -+ ret = get_quota_realm(mdsc, new, QUOTA_GET_ANY, &new_realm, false); -+ if (ret == -EAGAIN) { - up_read(&mdsc->snap_rwsem); - if (old_realm) - ceph_put_snap_realm(mdsc, old_realm); -@@ -492,8 +497,8 @@ bool ceph_quota_update_statfs(struct ceph_fs_client *fsc, struct kstatfs *buf) - bool is_updated = false; - - down_read(&mdsc->snap_rwsem); -- realm = get_quota_realm(mdsc, d_inode(fsc->sb->s_root), -- QUOTA_GET_MAX_BYTES, true); -+ get_quota_realm(mdsc, d_inode(fsc->sb->s_root), QUOTA_GET_MAX_BYTES, -+ &realm, true); - up_read(&mdsc->snap_rwsem); - if (!realm) - return false; --- -2.43.2 - -From d72a91de56bbbf918d44da6dfcfd6909daf8c1b9 Mon Sep 17 00:00:00 2001 -From: Alex Deucher <alexander.deucher@amd.com> -Date: Mon, 2 Oct 2023 14:27:13 -0400 -Subject: [PATCH 1295/1501] drm/amdgpu: fix avg vs input power reporting on - smu7 -Content-Length: 1943 -Lines: 49 - -[ Upstream commit 25852d4b97572ff62ffee574cb8bb4bc551af23a ] - -Hawaii, Bonaire, Fiji, and Tonga support average power, the others -support current power. - -Reviewed-by: Yang Wang <kevinyang.wang@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 17 ++++++++++++++++- - 1 file changed, 16 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c -index b1a8799e2dee..aa91730e4eaf 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c -@@ -3999,6 +3999,7 @@ static int smu7_read_sensor(struct pp_hwmgr *hwmgr, int idx, - uint32_t sclk, mclk, activity_percent; - uint32_t offset, val_vid; - struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend); -+ struct amdgpu_device *adev = hwmgr->adev; - - /* size must be at least 4 bytes for all sensors */ - if (*size < 4) -@@ -4042,7 +4043,21 @@ static int smu7_read_sensor(struct pp_hwmgr *hwmgr, int idx, - *size = 4; - return 0; - case AMDGPU_PP_SENSOR_GPU_INPUT_POWER: -- return smu7_get_gpu_power(hwmgr, (uint32_t *)value); -+ if ((adev->asic_type != CHIP_HAWAII) && -+ (adev->asic_type != CHIP_BONAIRE) && -+ (adev->asic_type != CHIP_FIJI) && -+ (adev->asic_type != CHIP_TONGA)) -+ return smu7_get_gpu_power(hwmgr, (uint32_t *)value); -+ else -+ return -EOPNOTSUPP; -+ case AMDGPU_PP_SENSOR_GPU_AVG_POWER: -+ if ((adev->asic_type != CHIP_HAWAII) && -+ (adev->asic_type != CHIP_BONAIRE) && -+ (adev->asic_type != CHIP_FIJI) && -+ (adev->asic_type != CHIP_TONGA)) -+ return -EOPNOTSUPP; -+ else -+ return smu7_get_gpu_power(hwmgr, (uint32_t *)value); - case AMDGPU_PP_SENSOR_VDDGFX: - if ((data->vr_config & VRCONF_VDDGFX_MASK) == - (VR_SVI2_PLANE_2 << VRCONF_VDDGFX_SHIFT)) --- -2.43.2 - -From 3a4391fb28cbe0e649e56ce670486667b36f1999 Mon Sep 17 00:00:00 2001 -From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Date: Fri, 5 Jan 2024 12:05:09 +0530 -Subject: [PATCH 1296/1501] drm/amd/powerplay: Fix kzalloc parameter - 'ATOM_Tonga_PPM_Table' in 'get_platform_power_management_table()' -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1670 -Lines: 35 - -[ Upstream commit 6616b5e1999146b1304abe78232af810080c67e3 ] - -In 'struct phm_ppm_table *ptr' allocation using kzalloc, an incorrect -structure type is passed to sizeof() in kzalloc, larger structure types -were used, thus using correct type 'struct phm_ppm_table' fixes the -below: - -drivers/gpu/drm/amd/amdgpu/../pm/powerplay/hwmgr/process_pptables_v1_0.c:203 get_platform_power_management_table() warn: struct type mismatch 'phm_ppm_table vs _ATOM_Tonga_PPM_Table' - -Cc: Eric Huang <JinHuiEric.Huang@amd.com> -Cc: Christian König <christian.koenig@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Acked-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c -index f2a55c1413f5..17882f8dfdd3 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c -@@ -200,7 +200,7 @@ static int get_platform_power_management_table( - struct pp_hwmgr *hwmgr, - ATOM_Tonga_PPM_Table *atom_ppm_table) - { -- struct phm_ppm_table *ptr = kzalloc(sizeof(ATOM_Tonga_PPM_Table), GFP_KERNEL); -+ struct phm_ppm_table *ptr = kzalloc(sizeof(*ptr), GFP_KERNEL); - struct phm_ppt_v1_information *pp_table_information = - (struct phm_ppt_v1_information *)(hwmgr->pptable); - --- -2.43.2 - -From 12c8628dc53e030e008abc25b9a3a59ae56e4c5b Mon Sep 17 00:00:00 2001 -From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Date: Thu, 4 Jan 2024 15:26:42 +0530 -Subject: [PATCH 1297/1501] drm/amdgpu: Fix with right return code '-EIO' in - 'amdgpu_gmc_vram_checking()' -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2155 -Lines: 67 - -[ Upstream commit fac4ebd79fed60e79cccafdad45a2bb8d3795044 ] - -The amdgpu_gmc_vram_checking() function in emulation checks whether -all of the memory range of shared system memory could be accessed by -GPU, from this aspect, -EIO is returned for error scenarios. - -Fixes the below: -drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c:919 gmc_v6_0_hw_init() warn: missing error code? 'r' -drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c:1103 gmc_v7_0_hw_init() warn: missing error code? 'r' -drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c:1223 gmc_v8_0_hw_init() warn: missing error code? 'r' -drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c:2344 gmc_v9_0_hw_init() warn: missing error code? 'r' - -Cc: Xiaojian Du <Xiaojian.Du@amd.com> -Cc: Lijo Lazar <lijo.lazar@amd.com> -Cc: Christian König <christian.koenig@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Suggested-by: Christian König <christian.koenig@amd.com> -Reviewed-by: Christian König <christian.koenig@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 21 ++++++++++++++------- - 1 file changed, 14 insertions(+), 7 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c -index d2f273d77e59..55784a9f26c4 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c -@@ -1045,21 +1045,28 @@ int amdgpu_gmc_vram_checking(struct amdgpu_device *adev) - * seconds, so here, we just pick up three parts for emulation. - */ - ret = memcmp(vram_ptr, cptr, 10); -- if (ret) -- return ret; -+ if (ret) { -+ ret = -EIO; -+ goto release_buffer; -+ } - - ret = memcmp(vram_ptr + (size / 2), cptr, 10); -- if (ret) -- return ret; -+ if (ret) { -+ ret = -EIO; -+ goto release_buffer; -+ } - - ret = memcmp(vram_ptr + size - 10, cptr, 10); -- if (ret) -- return ret; -+ if (ret) { -+ ret = -EIO; -+ goto release_buffer; -+ } - -+release_buffer: - amdgpu_bo_free_kernel(&vram_bo, &vram_gpu, - &vram_ptr); - -- return 0; -+ return ret; - } - - static ssize_t current_memory_partition_show( --- -2.43.2 - -From ee3dbf27cfba42fb960cdc6c64867405401ce7fb Mon Sep 17 00:00:00 2001 -From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Date: Thu, 21 Dec 2023 18:13:11 +0530 -Subject: [PATCH 1298/1501] drm/amdgpu: Release 'adev->pm.fw' before return in - 'amdgpu_device_need_post()' -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1384 -Lines: 36 - -[ Upstream commit 8a44fdd3cf91debbd09b43bd2519ad2b2486ccf4 ] - -In function 'amdgpu_device_need_post(struct amdgpu_device *adev)' - -'adev->pm.fw' may not be released before return. - -Using the function release_firmware() to release adev->pm.fw. - -Thus fixing the below: -drivers/gpu/drm/amd/amdgpu/amdgpu_device.c:1571 amdgpu_device_need_post() warn: 'adev->pm.fw' from request_firmware() not released on lines: 1554. - -Cc: Monk Liu <Monk.Liu@amd.com> -Cc: Christian König <christian.koenig@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Suggested-by: Lijo Lazar <lijo.lazar@amd.com> -Reviewed-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -index 3677d644183b..9257c9af3fee 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -@@ -1485,6 +1485,7 @@ bool amdgpu_device_need_post(struct amdgpu_device *adev) - return true; - - fw_ver = *((uint32_t *)adev->pm.fw->data + 69); -+ release_firmware(adev->pm.fw); - if (fw_ver < 0x00160e00) - return true; - } --- -2.43.2 - -From 9b12bd7679990bb87684ed82350982f9615fe4de Mon Sep 17 00:00:00 2001 -From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Date: Tue, 9 Jan 2024 16:57:26 +0530 -Subject: [PATCH 1299/1501] drm/amdkfd: Fix 'node' NULL check in - 'svm_range_get_range_boundaries()' -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2137 -Lines: 55 - -[ Upstream commit d7a254fad873775ce6c32b77796c81e81e6b7f2e ] - -Range interval [start, last] is ordered by rb_tree, rb_prev, rb_next -return value still needs NULL check, thus modified from "node" to "rb_node". - -Fixes the below: -drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_svm.c:2691 svm_range_get_range_boundaries() warn: can 'node' even be NULL? - -Suggested-by: Philip Yang <Philip.Yang@amd.com> -Cc: Felix Kuehling <Felix.Kuehling@amd.com> -Cc: Christian König <christian.koenig@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c -index f66f88d2b643..9af1d094385a 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c -@@ -2680,6 +2680,7 @@ svm_range_get_range_boundaries(struct kfd_process *p, int64_t addr, - { - struct vm_area_struct *vma; - struct interval_tree_node *node; -+ struct rb_node *rb_node; - unsigned long start_limit, end_limit; - - vma = vma_lookup(p->mm, addr << PAGE_SHIFT); -@@ -2699,16 +2700,15 @@ svm_range_get_range_boundaries(struct kfd_process *p, int64_t addr, - if (node) { - end_limit = min(end_limit, node->start); - /* Last range that ends before the fault address */ -- node = container_of(rb_prev(&node->rb), -- struct interval_tree_node, rb); -+ rb_node = rb_prev(&node->rb); - } else { - /* Last range must end before addr because - * there was no range after addr - */ -- node = container_of(rb_last(&p->svms.objects.rb_root), -- struct interval_tree_node, rb); -+ rb_node = rb_last(&p->svms.objects.rb_root); - } -- if (node) { -+ if (rb_node) { -+ node = container_of(rb_node, struct interval_tree_node, rb); - if (node->last >= addr) { - WARN(1, "Overlap with prev node and page fault addr\n"); - return -EFAULT; --- -2.43.2 - -From df1fdef5e64c8de0ca0a665973b4f2a571f37227 Mon Sep 17 00:00:00 2001 -From: Tim Lunn <tim@feathertop.org> -Date: Sun, 3 Dec 2023 23:39:59 +1100 -Subject: [PATCH 1300/1501] i2c: rk3x: Adjust mask/value offset for i2c2 on - rv1126 -Content-Length: 1305 -Lines: 38 - -[ Upstream commit 92a85b7c6262f19c65a1c115cf15f411ba65a57c ] - -Rockchip RV1126 is using old style i2c controller, the i2c2 -bus uses a non-sequential offset in the grf register for the -mask/value bits for this bus. - -This patch fixes i2c2 bus on rv1126 SoCs. - -Signed-off-by: Tim Lunn <tim@feathertop.org> -Acked-by: Heiko Stuebner <heiko@sntech.de> -Reviewed-by: Andi Shyti <andi.shyti@kernel.org> -Signed-off-by: Wolfram Sang <wsa@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/i2c/busses/i2c-rk3x.c | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - -diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c -index 4362db7c5789..086fdf262e7b 100644 ---- a/drivers/i2c/busses/i2c-rk3x.c -+++ b/drivers/i2c/busses/i2c-rk3x.c -@@ -1295,8 +1295,12 @@ static int rk3x_i2c_probe(struct platform_device *pdev) - return -EINVAL; - } - -- /* 27+i: write mask, 11+i: value */ -- value = BIT(27 + bus_nr) | BIT(11 + bus_nr); -+ /* rv1126 i2c2 uses non-sequential write mask 20, value 4 */ -+ if (i2c->soc_data == &rv1126_soc_data && bus_nr == 2) -+ value = BIT(20) | BIT(4); -+ else -+ /* 27+i: write mask, 11+i: value */ -+ value = BIT(27 + bus_nr) | BIT(11 + bus_nr); - - ret = regmap_write(grf, i2c->soc_data->grf_offset, value); - if (ret != 0) { --- -2.43.2 - -From bb94033815c1d1fd1241885604e4ba60563172e2 Mon Sep 17 00:00:00 2001 -From: Peter Zijlstra <peterz@infradead.org> -Date: Wed, 22 Nov 2023 11:07:56 +0100 -Subject: [PATCH 1301/1501] perf: Fix the nr_addr_filters fix -Content-Length: 1403 -Lines: 42 - -[ Upstream commit 388a1fb7da6aaa1970c7e2a7d7fcd983a87a8484 ] - -Thomas reported that commit 652ffc2104ec ("perf/core: Fix narrow -startup race when creating the perf nr_addr_filters sysfs file") made -the entire attribute group vanish, instead of only the nr_addr_filters -attribute. - -Additionally a stray return. - -Insufficient coffee was involved with both writing and merging the -patch. - -Fixes: 652ffc2104ec ("perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file") -Reported-by: Thomas Richter <tmricht@linux.ibm.com> -Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> -Tested-by: Thomas Richter <tmricht@linux.ibm.com> -Link: https://lkml.kernel.org/r/20231122100756.GP8262@noisy.programming.kicks-ass.net -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - kernel/events/core.c | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - -diff --git a/kernel/events/core.c b/kernel/events/core.c -index fbecba5b00b1..7c0330579718 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -11434,12 +11434,10 @@ static umode_t pmu_dev_is_visible(struct kobject *kobj, struct attribute *a, int - struct device *dev = kobj_to_dev(kobj); - struct pmu *pmu = dev_get_drvdata(dev); - -- if (!pmu->nr_addr_filters) -+ if (n == 2 && !pmu->nr_addr_filters) - return 0; - - return a->mode; -- -- return 0; - } - - static struct attribute_group pmu_dev_attr_group = { --- -2.43.2 - -From 171cd66ffd0a05082cb08e09f7037866c960179b Mon Sep 17 00:00:00 2001 -From: Edward Adam Davis <eadavis@qq.com> -Date: Wed, 3 Jan 2024 20:13:51 +0800 -Subject: [PATCH 1302/1501] wifi: cfg80211: fix RCU dereference in - __cfg80211_bss_update -Content-Length: 1170 -Lines: 30 - -[ Upstream commit 1184950e341c11b6f82bc5b59564411d9537ab27 ] - -Replace rcu_dereference() with rcu_access_pointer() since we hold -the lock here (and aren't in an RCU critical section). - -Fixes: 32af9a9e1069 ("wifi: cfg80211: free beacon_ies when overridden from hidden BSS") -Reported-and-tested-by: syzbot+864a269c27ee06b58374@syzkaller.appspotmail.com -Signed-off-by: Edward Adam Davis <eadavis@qq.com> -Link: https://msgid.link/tencent_BF8F0DF0258C8DBF124CDDE4DD8D992DCF07@qq.com -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/wireless/scan.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/wireless/scan.c b/net/wireless/scan.c -index 082f0bd4ebdd..b9da6f5152cb 100644 ---- a/net/wireless/scan.c -+++ b/net/wireless/scan.c -@@ -1865,7 +1865,7 @@ __cfg80211_bss_update(struct cfg80211_registered_device *rdev, - &hidden->hidden_list); - hidden->refcount++; - -- ies = (void *)rcu_dereference(new->pub.beacon_ies); -+ ies = (void *)rcu_access_pointer(new->pub.beacon_ies); - rcu_assign_pointer(new->pub.beacon_ies, - hidden->pub.beacon_ies); - if (ies) --- -2.43.2 - -From e2dc8036aed0f57adba59b1ebee034a372e509a5 Mon Sep 17 00:00:00 2001 -From: Stephen Rothwell <sfr@canb.auug.org.au> -Date: Tue, 19 Dec 2023 14:57:34 +1100 -Subject: [PATCH 1303/1501] drm: using mul_u32_u32() requires linux/math64.h -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1319 -Lines: 34 - -[ Upstream commit 933a2a376fb3f22ba4774f74233571504ac56b02 ] - -Some pending include file cleanups produced this error: - -In file included from include/linux/kernel.h:27, - from drivers/gpu/ipu-v3/ipu-dp.c:7: -include/drm/drm_color_mgmt.h: In function 'drm_color_lut_extract': -include/drm/drm_color_mgmt.h:45:46: error: implicit declaration of function 'mul_u32_u32' [-Werror=implicit-function-declaration] - 45 | return DIV_ROUND_CLOSEST_ULL(mul_u32_u32(user_input, (1 << bit_precision) - 1), - | ^~~~~~~~~~~ - -Fixes: c6fbb6bca108 ("drm: Fix color LUT rounding") -Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au> -Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> -Link: https://patchwork.freedesktop.org/patch/msgid/20231219145734.13e40e1e@canb.auug.org.au -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/drm/drm_color_mgmt.h | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/include/drm/drm_color_mgmt.h b/include/drm/drm_color_mgmt.h -index 81c298488b0c..6b5eec10c3db 100644 ---- a/include/drm/drm_color_mgmt.h -+++ b/include/drm/drm_color_mgmt.h -@@ -24,6 +24,7 @@ - #define __DRM_COLOR_MGMT_H__ - - #include <linux/ctype.h> -+#include <linux/math64.h> - #include <drm/drm_property.h> - - struct drm_crtc; --- -2.43.2 - -From 86bd8334af92440253f0a9b18e85e97b70659dea Mon Sep 17 00:00:00 2001 -From: Rob Clark <robdclark@chromium.org> -Date: Thu, 30 Nov 2023 11:21:18 -0800 -Subject: [PATCH 1304/1501] drm/msm/dpu: Correct UBWC settings for sc8280xp -Content-Length: 1246 -Lines: 34 - -[ Upstream commit 0b414c731432917c83353c446e60ee838c9a9cfd ] - -The UBWC settings need to match between the display and GPU. When we -updated the GPU settings, we forgot to make the corresponding update on -the display side. - -Reported-by: Steev Klimaszewski <steev@kali.org> -Fixes: 07e6de738aa6 ("drm/msm/a690: Fix reg values for a690") -Signed-off-by: Rob Clark <robdclark@chromium.org> -Tested-by: Steev Klimaszewski <steev@kali.org> -Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com> -Patchwork: https://patchwork.freedesktop.org/patch/569817/ -Link: https://lore.kernel.org/r/20231130192119.32538-1-robdclark@gmail.com -Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/msm/msm_mdss.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/msm/msm_mdss.c b/drivers/gpu/drm/msm/msm_mdss.c -index 6865db1e3ce8..29bb38f0bb2c 100644 ---- a/drivers/gpu/drm/msm/msm_mdss.c -+++ b/drivers/gpu/drm/msm/msm_mdss.c -@@ -545,7 +545,7 @@ static const struct msm_mdss_data sc8280xp_data = { - .ubwc_dec_version = UBWC_4_0, - .ubwc_swizzle = 6, - .ubwc_static = 1, -- .highest_bank_bit = 2, -+ .highest_bank_bit = 3, - .macrotile_mode = 1, - }; - --- -2.43.2 - -From 4df01ecba883c2b4ca3e24f746d3b01e528e19e0 Mon Sep 17 00:00:00 2001 -From: Jonathan Kim <jonathan.kim@amd.com> -Date: Wed, 13 Dec 2023 22:08:03 -0500 -Subject: [PATCH 1305/1501] drm/amdkfd: only flush mes process context if mes - support is there -Content-Length: 1305 -Lines: 31 - -[ Upstream commit 24149412dfc71f7f4a54868702e9145e396263d3 ] - -Fix up on mes process context flush to prevent non-mes devices from -spamming error messages or running into undefined behaviour during -process termination. - -Fixes: bd33bb1409b4 ("drm/amdkfd: fix mes set shader debugger process management") -Signed-off-by: Jonathan Kim <jonathan.kim@amd.com> -Reviewed-by: Eric Huang <jinhuieric.huang@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c -index 8e55e78fce4e..43eff221eae5 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c -@@ -87,7 +87,8 @@ void kfd_process_dequeue_from_device(struct kfd_process_device *pdd) - return; - - dev->dqm->ops.process_termination(dev->dqm, &pdd->qpd); -- amdgpu_mes_flush_shader_debugger(dev->adev, pdd->proc_ctx_gpu_addr); -+ if (dev->kfd->shared_resources.enable_mes) -+ amdgpu_mes_flush_shader_debugger(dev->adev, pdd->proc_ctx_gpu_addr); - pdd->already_dequeued = true; - } - --- -2.43.2 - -From 6fd3577b917a644b28134e6ed61420af453877de Mon Sep 17 00:00:00 2001 -From: Alexandre Ghiti <alexghiti@rivosinc.com> -Date: Thu, 18 Jan 2024 22:21:20 +0100 -Subject: [PATCH 1306/1501] riscv: Fix build error on rv32 + XIP -Content-Length: 1767 -Lines: 42 - -[ Upstream commit 66f962d8939fd2ac74de901d30d30310c8ddca79 ] - -commit 66f1e6809397 ("riscv: Make XIP bootable again") restricted page -offset to the sv39 page offset instead of the default sv57, which makes -sense since probably the platforms that target XIP kernels do not -support anything else than sv39 and we do not try to find out the -largest address space supported on XIP kernels (ie set_satp_mode()). - -But PAGE_OFFSET_L3 is not defined for rv32, so fix the build error by -restoring the previous behaviour which picks CONFIG_PAGE_OFFSET for rv32. - -Fixes: 66f1e6809397 ("riscv: Make XIP bootable again") -Reported-by: Randy Dunlap <rdunlap@infradead.org> -Closes: https://lore.kernel.org/linux-riscv/344dca85-5c48-44e1-bc64-4fa7973edd12@infradead.org/T/#u -Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com> -Acked-by: Randy Dunlap <rdunlap@infradead.org> -Tested-by: Randy Dunlap <rdunlap@infradead.org> # build-tested -Link: https://lore.kernel.org/r/20240118212120.2087803-1-alexghiti@rivosinc.com -Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/riscv/mm/init.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c -index a65937336cdc..ad77ed410d4d 100644 ---- a/arch/riscv/mm/init.c -+++ b/arch/riscv/mm/init.c -@@ -1060,7 +1060,11 @@ asmlinkage void __init setup_vm(uintptr_t dtb_pa) - kernel_map.virt_addr = KERNEL_LINK_ADDR + kernel_map.virt_offset; - - #ifdef CONFIG_XIP_KERNEL -+#ifdef CONFIG_64BIT - kernel_map.page_offset = PAGE_OFFSET_L3; -+#else -+ kernel_map.page_offset = _AC(CONFIG_PAGE_OFFSET, UL); -+#endif - kernel_map.xiprom = (uintptr_t)CONFIG_XIP_PHYS_ADDR; - kernel_map.xiprom_sz = (uintptr_t)(&_exiprom) - (uintptr_t)(&_xiprom); - --- -2.43.2 - -From 27dea596af6bc7fdc012b8ff27cbe8448a74c58a Mon Sep 17 00:00:00 2001 -From: Su Hui <suhui@nfschina.com> -Date: Fri, 12 Jan 2024 12:19:27 +0800 -Subject: [PATCH 1307/1501] scsi: isci: Fix an error code problem in - isci_io_request_build() -Content-Length: 1053 -Lines: 30 - -[ Upstream commit 658365c6b0857e6a306436e315a8633937e3af42 ] - -Clang static complains that Value stored to 'status' is never read. Return -'status' rather than 'SCI_SUCCESS'. - -Fixes: f1f52e75939b ("isci: uplevel request infrastructure") -Signed-off-by: Su Hui <suhui@nfschina.com> -Link: https://lore.kernel.org/r/20240112041926.3924315-1-suhui@nfschina.com -Reviewed-by: Artur Paszkiewicz <artur.paszkiewicz@intel.com> -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/scsi/isci/request.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/scsi/isci/request.c b/drivers/scsi/isci/request.c -index a7b3243b471d..7162a5029b37 100644 ---- a/drivers/scsi/isci/request.c -+++ b/drivers/scsi/isci/request.c -@@ -3390,7 +3390,7 @@ static enum sci_status isci_io_request_build(struct isci_host *ihost, - return SCI_FAILURE; - } - -- return SCI_SUCCESS; -+ return status; - } - - static struct isci_request *isci_request_from_tag(struct isci_host *ihost, u16 tag) --- -2.43.2 - -From c2112d9d1559a963dc7de5037b74870f5f6e3c87 Mon Sep 17 00:00:00 2001 -From: Marco Pagani <marpagan@redhat.com> -Date: Wed, 10 Jan 2024 16:59:47 +0100 -Subject: [PATCH 1308/1501] kunit: run test suites only after module - initialization completes -Content-Length: 4923 -Lines: 129 - -[ Upstream commit a1af6a2bfa0cb46d70b7df5352993e750da6c79b ] - -Commit 2810c1e99867 ("kunit: Fix wild-memory-access bug in -kunit_free_suite_set()") fixed a wild-memory-access bug that could have -happened during the loading phase of test suites built and executed as -loadable modules. However, it also introduced a problematic side effect -that causes test suites modules to crash when they attempt to register -fake devices. - -When a module is loaded, it traverses the MODULE_STATE_UNFORMED and -MODULE_STATE_COMING states before reaching the normal operating state -MODULE_STATE_LIVE. Finally, when the module is removed, it moves to -MODULE_STATE_GOING before being released. However, if the loading -function load_module() fails between complete_formation() and -do_init_module(), the module goes directly from MODULE_STATE_COMING to -MODULE_STATE_GOING without passing through MODULE_STATE_LIVE. - -This behavior was causing kunit_module_exit() to be called without -having first executed kunit_module_init(). Since kunit_module_exit() is -responsible for freeing the memory allocated by kunit_module_init() -through kunit_filter_suites(), this behavior was resulting in a -wild-memory-access bug. - -Commit 2810c1e99867 ("kunit: Fix wild-memory-access bug in -kunit_free_suite_set()") fixed this issue by running the tests when the -module is still in MODULE_STATE_COMING. However, modules in that state -are not fully initialized, lacking sysfs kobjects. Therefore, if a test -module attempts to register a fake device, it will inevitably crash. - -This patch proposes a different approach to fix the original -wild-memory-access bug while restoring the normal module execution flow -by making kunit_module_exit() able to detect if kunit_module_init() has -previously initialized the tests suite set. In this way, test modules -can once again register fake devices without crashing. - -This behavior is achieved by checking whether mod->kunit_suites is a -virtual or direct mapping address. If it is a virtual address, then -kunit_module_init() has allocated the suite_set in kunit_filter_suites() -using kmalloc_array(). On the contrary, if mod->kunit_suites is still -pointing to the original address that was set when looking up the -.kunit_test_suites section of the module, then the loading phase has -failed and there's no memory to be freed. - -v4: -- rebased on 6.8 -- noted that kunit_filter_suites() must return a virtual address -v3: -- add a comment to clarify why the start address is checked -v2: -- add include <linux/mm.h> - -Fixes: 2810c1e99867 ("kunit: Fix wild-memory-access bug in kunit_free_suite_set()") -Reviewed-by: David Gow <davidgow@google.com> -Tested-by: Rae Moar <rmoar@google.com> -Tested-by: Richard Fitzgerald <rf@opensource.cirrus.com> -Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> -Signed-off-by: Marco Pagani <marpagan@redhat.com> -Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - lib/kunit/executor.c | 4 ++++ - lib/kunit/test.c | 14 +++++++++++--- - 2 files changed, 15 insertions(+), 3 deletions(-) - -diff --git a/lib/kunit/executor.c b/lib/kunit/executor.c -index 1236b3cd2fbb..51013feba58b 100644 ---- a/lib/kunit/executor.c -+++ b/lib/kunit/executor.c -@@ -144,6 +144,10 @@ void kunit_free_suite_set(struct kunit_suite_set suite_set) - kfree(suite_set.start); - } - -+/* -+ * Filter and reallocate test suites. Must return the filtered test suites set -+ * allocated at a valid virtual address or NULL in case of error. -+ */ - struct kunit_suite_set - kunit_filter_suites(const struct kunit_suite_set *suite_set, - const char *filter_glob, -diff --git a/lib/kunit/test.c b/lib/kunit/test.c -index 1cdc405daa30..3dc9d66eca49 100644 ---- a/lib/kunit/test.c -+++ b/lib/kunit/test.c -@@ -16,6 +16,7 @@ - #include <linux/panic.h> - #include <linux/sched/debug.h> - #include <linux/sched.h> -+#include <linux/mm.h> - - #include "debugfs.h" - #include "hooks-impl.h" -@@ -776,12 +777,19 @@ static void kunit_module_exit(struct module *mod) - }; - const char *action = kunit_action(); - -+ /* -+ * Check if the start address is a valid virtual address to detect -+ * if the module load sequence has failed and the suite set has not -+ * been initialized and filtered. -+ */ -+ if (!suite_set.start || !virt_addr_valid(suite_set.start)) -+ return; -+ - if (!action) - __kunit_test_suites_exit(mod->kunit_suites, - mod->num_kunit_suites); - -- if (suite_set.start) -- kunit_free_suite_set(suite_set); -+ kunit_free_suite_set(suite_set); - } - - static int kunit_module_notify(struct notifier_block *nb, unsigned long val, -@@ -791,12 +799,12 @@ static int kunit_module_notify(struct notifier_block *nb, unsigned long val, - - switch (val) { - case MODULE_STATE_LIVE: -+ kunit_module_init(mod); - break; - case MODULE_STATE_GOING: - kunit_module_exit(mod); - break; - case MODULE_STATE_COMING: -- kunit_module_init(mod); - break; - case MODULE_STATE_UNFORMED: - break; --- -2.43.2 - -From 01091df9fa7c1412609eb30f5dd08c55ba74153f Mon Sep 17 00:00:00 2001 -From: Romain Naour <romain.naour@skf.com> -Date: Tue, 23 Jan 2024 12:14:56 +0100 -Subject: [PATCH 1309/1501] regulator: ti-abb: don't use - devm_platform_ioremap_resource_byname for shared interrupt register -Content-Length: 3789 -Lines: 94 - -[ Upstream commit a67e1f0bd4564b485e0f0c3ed7f6bf17688be268 ] - -We can't use devm_platform_ioremap_resource_byname() to remap the -interrupt register that can be shared between -regulator-abb-{ivahd,dspeve,gpu} drivers instances. - -The combined helper introduce a call to devm_request_mem_region() that -creates a new busy resource region on PRM_IRQSTATUS_MPU register -(0x4ae06010). The first devm_request_mem_region() call succeeds for -regulator-abb-ivahd but fails for the two other regulator-abb-dspeve -and regulator-abb-gpu. - - # cat /proc/iomem | grep -i 4ae06 - 4ae06010-4ae06013 : 4ae07e34.regulator-abb-ivahd int-address - 4ae06014-4ae06017 : 4ae07ddc.regulator-abb-mpu int-address - -regulator-abb-dspeve and regulator-abb-gpu are missing due to -devm_request_mem_region() failure (EBUSY): - - [ 1.326660] ti_abb 4ae07e30.regulator-abb-dspeve: can't request region for resource [mem 0x4ae06010-0x4ae06013] - [ 1.326660] ti_abb: probe of 4ae07e30.regulator-abb-dspeve failed with error -16 - [ 1.327239] ti_abb 4ae07de4.regulator-abb-gpu: can't request region for resource [mem 0x4ae06010-0x4ae06013] - [ 1.327270] ti_abb: probe of 4ae07de4.regulator-abb-gpu failed with error -16 - ->From arm/boot/dts/dra7.dtsi: - -The abb_mpu is the only instance using its own interrupt register: - (0x4ae06014) PRM_IRQSTATUS_MPU_2, ABB_MPU_DONE_ST (bit 7) - -The other tree instances (abb_ivahd, abb_dspeve, abb_gpu) share -PRM_IRQSTATUS_MPU register (0x4ae06010) but use different bits -ABB_IVA_DONE_ST (bit 30), ABB_DSPEVE_DONE_ST( bit 29) and -ABB_GPU_DONE_ST (but 28). - -The commit b36c6b1887ff ("regulator: ti-abb: Make use of the helper -function devm_ioremap related") overlooked the following comment -implicitly explaining why devm_ioremap() is used in this case: - - /* - * We may have shared interrupt register offsets which are - * write-1-to-clear between domains ensuring exclusivity. - */ - -Fixes and partially reverts commit b36c6b1887ff ("regulator: ti-abb: -Make use of the helper function devm_ioremap related"). - -Improve the existing comment to avoid further conversion to -devm_platform_ioremap_resource_byname(). - -Fixes: b36c6b1887ff ("regulator: ti-abb: Make use of the helper function devm_ioremap related") -Signed-off-by: Romain Naour <romain.naour@skf.com> -Reviewed-by: Yoann Congal <yoann.congal@smile.fr> -Link: https://msgid.link/r/20240123111456.739381-1-romain.naour@smile.fr -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/regulator/ti-abb-regulator.c | 22 +++++++++++++++++++--- - 1 file changed, 19 insertions(+), 3 deletions(-) - -diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c -index f48214e2c3b4..04133510e5af 100644 ---- a/drivers/regulator/ti-abb-regulator.c -+++ b/drivers/regulator/ti-abb-regulator.c -@@ -726,9 +726,25 @@ static int ti_abb_probe(struct platform_device *pdev) - return PTR_ERR(abb->setup_reg); - } - -- abb->int_base = devm_platform_ioremap_resource_byname(pdev, "int-address"); -- if (IS_ERR(abb->int_base)) -- return PTR_ERR(abb->int_base); -+ pname = "int-address"; -+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, pname); -+ if (!res) { -+ dev_err(dev, "Missing '%s' IO resource\n", pname); -+ return -ENODEV; -+ } -+ /* -+ * The MPU interrupt status register (PRM_IRQSTATUS_MPU) is -+ * shared between regulator-abb-{ivahd,dspeve,gpu} driver -+ * instances. Therefore use devm_ioremap() rather than -+ * devm_platform_ioremap_resource_byname() to avoid busy -+ * resource region conflicts. -+ */ -+ abb->int_base = devm_ioremap(dev, res->start, -+ resource_size(res)); -+ if (!abb->int_base) { -+ dev_err(dev, "Unable to map '%s'\n", pname); -+ return -ENOMEM; -+ } - - /* Map Optional resources */ - pname = "efuse-address"; --- -2.43.2 - -From 07e3ca0f17f579491b5f54e9ed05173d6c1d6fcb Mon Sep 17 00:00:00 2001 -From: Ming Lei <ming.lei@redhat.com> -Date: Fri, 12 Jan 2024 15:00:00 +0800 -Subject: [PATCH 1310/1501] scsi: core: Move scsi_host_busy() out of host lock - for waking up EH handler -Content-Length: 4439 -Lines: 107 - -[ Upstream commit 4373534a9850627a2695317944898eb1283a2db0 ] - -Inside scsi_eh_wakeup(), scsi_host_busy() is called & checked with host -lock every time for deciding if error handler kthread needs to be waken up. - -This can be too heavy in case of recovery, such as: - - - N hardware queues - - - queue depth is M for each hardware queue - - - each scsi_host_busy() iterates over (N * M) tag/requests - -If recovery is triggered in case that all requests are in-flight, each -scsi_eh_wakeup() is strictly serialized, when scsi_eh_wakeup() is called -for the last in-flight request, scsi_host_busy() has been run for (N * M - -1) times, and request has been iterated for (N*M - 1) * (N * M) times. - -If both N and M are big enough, hard lockup can be triggered on acquiring -host lock, and it is observed on mpi3mr(128 hw queues, queue depth 8169). - -Fix the issue by calling scsi_host_busy() outside the host lock. We don't -need the host lock for getting busy count because host the lock never -covers that. - -[mkp: Drop unnecessary 'busy' variables pointed out by Bart] - -Cc: Ewan Milne <emilne@redhat.com> -Fixes: 6eb045e092ef ("scsi: core: avoid host-wide host_busy counter for scsi_mq") -Signed-off-by: Ming Lei <ming.lei@redhat.com> -Link: https://lore.kernel.org/r/20240112070000.4161982-1-ming.lei@redhat.com -Reviewed-by: Ewan D. Milne <emilne@redhat.com> -Reviewed-by: Sathya Prakash Veerichetty <safhya.prakash@broadcom.com> -Tested-by: Sathya Prakash Veerichetty <safhya.prakash@broadcom.com> -Reviewed-by: Bart Van Assche <bvanassche@acm.org> -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/scsi/scsi_error.c | 8 ++++---- - drivers/scsi/scsi_lib.c | 2 +- - drivers/scsi/scsi_priv.h | 2 +- - 3 files changed, 6 insertions(+), 6 deletions(-) - -diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c -index d983f4a0e9f1..3328b175a832 100644 ---- a/drivers/scsi/scsi_error.c -+++ b/drivers/scsi/scsi_error.c -@@ -61,11 +61,11 @@ static int scsi_eh_try_stu(struct scsi_cmnd *scmd); - static enum scsi_disposition scsi_try_to_abort_cmd(const struct scsi_host_template *, - struct scsi_cmnd *); - --void scsi_eh_wakeup(struct Scsi_Host *shost) -+void scsi_eh_wakeup(struct Scsi_Host *shost, unsigned int busy) - { - lockdep_assert_held(shost->host_lock); - -- if (scsi_host_busy(shost) == shost->host_failed) { -+ if (busy == shost->host_failed) { - trace_scsi_eh_wakeup(shost); - wake_up_process(shost->ehandler); - SCSI_LOG_ERROR_RECOVERY(5, shost_printk(KERN_INFO, shost, -@@ -88,7 +88,7 @@ void scsi_schedule_eh(struct Scsi_Host *shost) - if (scsi_host_set_state(shost, SHOST_RECOVERY) == 0 || - scsi_host_set_state(shost, SHOST_CANCEL_RECOVERY) == 0) { - shost->host_eh_scheduled++; -- scsi_eh_wakeup(shost); -+ scsi_eh_wakeup(shost, scsi_host_busy(shost)); - } - - spin_unlock_irqrestore(shost->host_lock, flags); -@@ -286,7 +286,7 @@ static void scsi_eh_inc_host_failed(struct rcu_head *head) - - spin_lock_irqsave(shost->host_lock, flags); - shost->host_failed++; -- scsi_eh_wakeup(shost); -+ scsi_eh_wakeup(shost, scsi_host_busy(shost)); - spin_unlock_irqrestore(shost->host_lock, flags); - } - -diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c -index cf3864f72093..1fb80eae9a63 100644 ---- a/drivers/scsi/scsi_lib.c -+++ b/drivers/scsi/scsi_lib.c -@@ -280,7 +280,7 @@ static void scsi_dec_host_busy(struct Scsi_Host *shost, struct scsi_cmnd *cmd) - if (unlikely(scsi_host_in_recovery(shost))) { - spin_lock_irqsave(shost->host_lock, flags); - if (shost->host_failed || shost->host_eh_scheduled) -- scsi_eh_wakeup(shost); -+ scsi_eh_wakeup(shost, scsi_host_busy(shost)); - spin_unlock_irqrestore(shost->host_lock, flags); - } - rcu_read_unlock(); -diff --git a/drivers/scsi/scsi_priv.h b/drivers/scsi/scsi_priv.h -index 3f0dfb97db6b..1fbfe1b52c9f 100644 ---- a/drivers/scsi/scsi_priv.h -+++ b/drivers/scsi/scsi_priv.h -@@ -92,7 +92,7 @@ extern void scmd_eh_abort_handler(struct work_struct *work); - extern enum blk_eh_timer_return scsi_timeout(struct request *req); - extern int scsi_error_handler(void *host); - extern enum scsi_disposition scsi_decide_disposition(struct scsi_cmnd *cmd); --extern void scsi_eh_wakeup(struct Scsi_Host *shost); -+extern void scsi_eh_wakeup(struct Scsi_Host *shost, unsigned int busy); - extern void scsi_eh_scmd_add(struct scsi_cmnd *); - void scsi_eh_ready_devs(struct Scsi_Host *shost, - struct list_head *work_q, --- -2.43.2 - -From af6cf5a166641ebc8dbf5fa1697d0cfe327c80d3 Mon Sep 17 00:00:00 2001 -From: Su Hui <suhui@nfschina.com> -Date: Thu, 25 Jan 2024 14:32:26 +0800 -Subject: [PATCH 1311/1501] HID: hidraw: fix a problem of memory leak in - hidraw_release() -Content-Length: 1288 -Lines: 35 - -[ Upstream commit a3bdcdd022c68942a774e8e63424cc11c85aab78 ] - -'struct hidraw_list' is a circular queue whose head can be smaller than -tail. Using 'list->tail != list->head' to release all memory that should -be released. - -Fixes: a5623a203cff ("HID: hidraw: fix memory leak in hidraw_release()") -Signed-off-by: Su Hui <suhui@nfschina.com> -Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> -Signed-off-by: Jiri Kosina <jkosina@suse.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/hid/hidraw.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c -index 13c8dd8cd350..2bc762d31ac7 100644 ---- a/drivers/hid/hidraw.c -+++ b/drivers/hid/hidraw.c -@@ -357,8 +357,11 @@ static int hidraw_release(struct inode * inode, struct file * file) - down_write(&minors_rwsem); - - spin_lock_irqsave(&hidraw_table[minor]->list_lock, flags); -- for (int i = list->tail; i < list->head; i++) -- kfree(list->buffer[i].value); -+ while (list->tail != list->head) { -+ kfree(list->buffer[list->tail].value); -+ list->buffer[list->tail].value = NULL; -+ list->tail = (list->tail + 1) & (HIDRAW_BUFFER_SIZE - 1); -+ } - list_del(&list->node); - spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags); - kfree(list); --- -2.43.2 - -From 3d9c788612d1d6fc9038d0992b75949d93fc34eb Mon Sep 17 00:00:00 2001 -From: Praveen Kaligineedi <pkaligineedi@google.com> -Date: Wed, 24 Jan 2024 08:10:25 -0800 -Subject: [PATCH 1314/1501] gve: Fix skb truesize underestimation -Content-Length: 1984 -Lines: 52 - -[ Upstream commit 534326711000c318fe1523c77308450522baa499 ] - -For a skb frag with a newly allocated copy page, the true size is -incorrectly set to packet buffer size. It should be set to PAGE_SIZE -instead. - -Fixes: 82fd151d38d9 ("gve: Reduce alloc and copy costs in the GQ rx path") -Signed-off-by: Praveen Kaligineedi <pkaligineedi@google.com> -Link: https://lore.kernel.org/r/20240124161025.1819836-1-pkaligineedi@google.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/google/gve/gve_rx.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/drivers/net/ethernet/google/gve/gve_rx.c b/drivers/net/ethernet/google/gve/gve_rx.c -index 73655347902d..93ff7c8ec905 100644 ---- a/drivers/net/ethernet/google/gve/gve_rx.c -+++ b/drivers/net/ethernet/google/gve/gve_rx.c -@@ -362,7 +362,7 @@ static enum pkt_hash_types gve_rss_type(__be16 pkt_flags) - - static struct sk_buff *gve_rx_add_frags(struct napi_struct *napi, - struct gve_rx_slot_page_info *page_info, -- u16 packet_buffer_size, u16 len, -+ unsigned int truesize, u16 len, - struct gve_rx_ctx *ctx) - { - u32 offset = page_info->page_offset + page_info->pad; -@@ -395,10 +395,10 @@ static struct sk_buff *gve_rx_add_frags(struct napi_struct *napi, - if (skb != ctx->skb_head) { - ctx->skb_head->len += len; - ctx->skb_head->data_len += len; -- ctx->skb_head->truesize += packet_buffer_size; -+ ctx->skb_head->truesize += truesize; - } - skb_add_rx_frag(skb, num_frags, page_info->page, -- offset, len, packet_buffer_size); -+ offset, len, truesize); - - return ctx->skb_head; - } -@@ -492,7 +492,7 @@ static struct sk_buff *gve_rx_copy_to_pool(struct gve_rx_ring *rx, - - memcpy(alloc_page_info.page_address, src, page_info->pad + len); - skb = gve_rx_add_frags(napi, &alloc_page_info, -- rx->packet_buffer_size, -+ PAGE_SIZE, - len, ctx); - - u64_stats_update_begin(&rx->statss); --- -2.43.2 - -From 06cbb48eece99a509d95e3a8a3e3fbe1720d9f8c Mon Sep 17 00:00:00 2001 -From: Daniel Golle <daniel@makrotopia.org> -Date: Wed, 24 Jan 2024 16:22:09 +0000 -Subject: [PATCH 1315/1501] net: ethernet: mtk_eth_soc: set DMA coherent mask - to get PPE working -Content-Length: 1350 -Lines: 33 - -[ Upstream commit cae1f1c36661f28c92a1db9113961a9ebd61dbaa ] - -Set DMA coherent mask to 32-bit which makes PPE offloading engine start -working on BPi-R4 which got 4 GiB of RAM. - -Fixes: 2d75891ebc09 ("net: ethernet: mtk_eth_soc: support 36-bit DMA addressing on MT7988") -Suggested-by: Elad Yifee <eladwf@users.github.com> -Signed-off-by: Daniel Golle <daniel@makrotopia.org> -Link: https://lore.kernel.org/r/97e90925368b405f0974b9b15f1b7377c4a329ad.1706113251.git.daniel@makrotopia.org -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/mediatek/mtk_eth_soc.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c -index 3cf6589cfdac..d2c039f83019 100644 ---- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c -+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c -@@ -4758,7 +4758,10 @@ static int mtk_probe(struct platform_device *pdev) - } - - if (MTK_HAS_CAPS(eth->soc->caps, MTK_36BIT_DMA)) { -- err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(36)); -+ err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(36)); -+ if (!err) -+ err = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); -+ - if (err) { - dev_err(&pdev->dev, "Wrong DMA config\n"); - return -EINVAL; --- -2.43.2 - -From a9a9ebac5ccf173061dd7f359d2dd8691c7aeb0b Mon Sep 17 00:00:00 2001 -From: Daniel Golle <daniel@makrotopia.org> -Date: Wed, 24 Jan 2024 05:18:23 +0000 -Subject: [PATCH 1316/1501] net: phy: mediatek-ge-soc: sync driver with - MediaTek SDK -Content-Length: 8926 -Lines: 257 - -[ Upstream commit ff63cc2e95065bea978d2db01f7e7356cca3d021 ] - -Sync initialization and calibration routines with MediaTek's reference -driver. Improves compliance and resolves link stability issues with -CH340 IoT devices connected to MT798x built-in PHYs. - -Fixes: 98c485eaf509 ("net: phy: add driver for MediaTek SoC built-in GE PHYs") -Signed-off-by: Daniel Golle <daniel@makrotopia.org> -Link: https://lore.kernel.org/r/f2195279c234c0f618946424b8236026126bc595.1706071311.git.daniel@makrotopia.org -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/phy/mediatek-ge-soc.c | 147 ++++++++++++++++-------------- - 1 file changed, 81 insertions(+), 66 deletions(-) - -diff --git a/drivers/net/phy/mediatek-ge-soc.c b/drivers/net/phy/mediatek-ge-soc.c -index 8a20d9889f10..0f3a1538a8b8 100644 ---- a/drivers/net/phy/mediatek-ge-soc.c -+++ b/drivers/net/phy/mediatek-ge-soc.c -@@ -489,7 +489,7 @@ static int tx_r50_fill_result(struct phy_device *phydev, u16 tx_r50_cal_val, - u16 reg, val; - - if (phydev->drv->phy_id == MTK_GPHY_ID_MT7988) -- bias = -2; -+ bias = -1; - - val = clamp_val(bias + tx_r50_cal_val, 0, 63); - -@@ -705,6 +705,11 @@ static int tx_vcm_cal_sw(struct phy_device *phydev, u8 rg_txreserve_x) - static void mt798x_phy_common_finetune(struct phy_device *phydev) - { - phy_select_page(phydev, MTK_PHY_PAGE_EXTENDED_52B5); -+ /* SlvDSPreadyTime = 24, MasDSPreadyTime = 24 */ -+ __phy_write(phydev, 0x11, 0xc71); -+ __phy_write(phydev, 0x12, 0xc); -+ __phy_write(phydev, 0x10, 0x8fae); -+ - /* EnabRandUpdTrig = 1 */ - __phy_write(phydev, 0x11, 0x2f00); - __phy_write(phydev, 0x12, 0xe); -@@ -715,15 +720,56 @@ static void mt798x_phy_common_finetune(struct phy_device *phydev) - __phy_write(phydev, 0x12, 0x0); - __phy_write(phydev, 0x10, 0x83aa); - -- /* TrFreeze = 0 */ -+ /* FfeUpdGainForce = 1(Enable), FfeUpdGainForceVal = 4 */ -+ __phy_write(phydev, 0x11, 0x240); -+ __phy_write(phydev, 0x12, 0x0); -+ __phy_write(phydev, 0x10, 0x9680); -+ -+ /* TrFreeze = 0 (mt7988 default) */ - __phy_write(phydev, 0x11, 0x0); - __phy_write(phydev, 0x12, 0x0); - __phy_write(phydev, 0x10, 0x9686); - -+ /* SSTrKp100 = 5 */ -+ /* SSTrKf100 = 6 */ -+ /* SSTrKp1000Mas = 5 */ -+ /* SSTrKf1000Mas = 6 */ - /* SSTrKp1000Slv = 5 */ -+ /* SSTrKf1000Slv = 6 */ - __phy_write(phydev, 0x11, 0xbaef); - __phy_write(phydev, 0x12, 0x2e); - __phy_write(phydev, 0x10, 0x968c); -+ phy_restore_page(phydev, MTK_PHY_PAGE_STANDARD, 0); -+} -+ -+static void mt7981_phy_finetune(struct phy_device *phydev) -+{ -+ u16 val[8] = { 0x01ce, 0x01c1, -+ 0x020f, 0x0202, -+ 0x03d0, 0x03c0, -+ 0x0013, 0x0005 }; -+ int i, k; -+ -+ /* 100M eye finetune: -+ * Keep middle level of TX MLT3 shapper as default. -+ * Only change TX MLT3 overshoot level here. -+ */ -+ for (k = 0, i = 1; i < 12; i++) { -+ if (i % 3 == 0) -+ continue; -+ phy_write_mmd(phydev, MDIO_MMD_VEND1, i, val[k++]); -+ } -+ -+ phy_select_page(phydev, MTK_PHY_PAGE_EXTENDED_52B5); -+ /* ResetSyncOffset = 6 */ -+ __phy_write(phydev, 0x11, 0x600); -+ __phy_write(phydev, 0x12, 0x0); -+ __phy_write(phydev, 0x10, 0x8fc0); -+ -+ /* VgaDecRate = 1 */ -+ __phy_write(phydev, 0x11, 0x4c2a); -+ __phy_write(phydev, 0x12, 0x3e); -+ __phy_write(phydev, 0x10, 0x8fa4); - - /* MrvlTrFix100Kp = 3, MrvlTrFix100Kf = 2, - * MrvlTrFix1000Kp = 3, MrvlTrFix1000Kf = 2 -@@ -738,7 +784,7 @@ static void mt798x_phy_common_finetune(struct phy_device *phydev) - __phy_write(phydev, 0x10, 0x8ec0); - phy_restore_page(phydev, MTK_PHY_PAGE_STANDARD, 0); - -- /* TR_OPEN_LOOP_EN = 1, lpf_x_average = 9*/ -+ /* TR_OPEN_LOOP_EN = 1, lpf_x_average = 9 */ - phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_DEV1E_REG234, - MTK_PHY_TR_OPEN_LOOP_EN_MASK | MTK_PHY_LPF_X_AVERAGE_MASK, - BIT(0) | FIELD_PREP(MTK_PHY_LPF_X_AVERAGE_MASK, 0x9)); -@@ -771,48 +817,6 @@ static void mt798x_phy_common_finetune(struct phy_device *phydev) - phy_write_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_LDO_OUTPUT_V, 0x2222); - } - --static void mt7981_phy_finetune(struct phy_device *phydev) --{ -- u16 val[8] = { 0x01ce, 0x01c1, -- 0x020f, 0x0202, -- 0x03d0, 0x03c0, -- 0x0013, 0x0005 }; -- int i, k; -- -- /* 100M eye finetune: -- * Keep middle level of TX MLT3 shapper as default. -- * Only change TX MLT3 overshoot level here. -- */ -- for (k = 0, i = 1; i < 12; i++) { -- if (i % 3 == 0) -- continue; -- phy_write_mmd(phydev, MDIO_MMD_VEND1, i, val[k++]); -- } -- -- phy_select_page(phydev, MTK_PHY_PAGE_EXTENDED_52B5); -- /* SlvDSPreadyTime = 24, MasDSPreadyTime = 24 */ -- __phy_write(phydev, 0x11, 0xc71); -- __phy_write(phydev, 0x12, 0xc); -- __phy_write(phydev, 0x10, 0x8fae); -- -- /* ResetSyncOffset = 6 */ -- __phy_write(phydev, 0x11, 0x600); -- __phy_write(phydev, 0x12, 0x0); -- __phy_write(phydev, 0x10, 0x8fc0); -- -- /* VgaDecRate = 1 */ -- __phy_write(phydev, 0x11, 0x4c2a); -- __phy_write(phydev, 0x12, 0x3e); -- __phy_write(phydev, 0x10, 0x8fa4); -- -- /* FfeUpdGainForce = 4 */ -- __phy_write(phydev, 0x11, 0x240); -- __phy_write(phydev, 0x12, 0x0); -- __phy_write(phydev, 0x10, 0x9680); -- -- phy_restore_page(phydev, MTK_PHY_PAGE_STANDARD, 0); --} -- - static void mt7988_phy_finetune(struct phy_device *phydev) - { - u16 val[12] = { 0x0187, 0x01cd, 0x01c8, 0x0182, -@@ -827,17 +831,7 @@ static void mt7988_phy_finetune(struct phy_device *phydev) - /* TCT finetune */ - phy_write_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_TX_FILTER, 0x5); - -- /* Disable TX power saving */ -- phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RXADC_CTRL_RG7, -- MTK_PHY_DA_AD_BUF_BIAS_LP_MASK, 0x3 << 8); -- - phy_select_page(phydev, MTK_PHY_PAGE_EXTENDED_52B5); -- -- /* SlvDSPreadyTime = 24, MasDSPreadyTime = 12 */ -- __phy_write(phydev, 0x11, 0x671); -- __phy_write(phydev, 0x12, 0xc); -- __phy_write(phydev, 0x10, 0x8fae); -- - /* ResetSyncOffset = 5 */ - __phy_write(phydev, 0x11, 0x500); - __phy_write(phydev, 0x12, 0x0); -@@ -845,13 +839,27 @@ static void mt7988_phy_finetune(struct phy_device *phydev) - - /* VgaDecRate is 1 at default on mt7988 */ - -+ /* MrvlTrFix100Kp = 6, MrvlTrFix100Kf = 7, -+ * MrvlTrFix1000Kp = 6, MrvlTrFix1000Kf = 7 -+ */ -+ __phy_write(phydev, 0x11, 0xb90a); -+ __phy_write(phydev, 0x12, 0x6f); -+ __phy_write(phydev, 0x10, 0x8f82); -+ -+ /* RemAckCntLimitCtrl = 1 */ -+ __phy_write(phydev, 0x11, 0xfbba); -+ __phy_write(phydev, 0x12, 0xc3); -+ __phy_write(phydev, 0x10, 0x87f8); -+ - phy_restore_page(phydev, MTK_PHY_PAGE_STANDARD, 0); - -- phy_select_page(phydev, MTK_PHY_PAGE_EXTENDED_2A30); -- /* TxClkOffset = 2 */ -- __phy_modify(phydev, MTK_PHY_ANARG_RG, MTK_PHY_TCLKOFFSET_MASK, -- FIELD_PREP(MTK_PHY_TCLKOFFSET_MASK, 0x2)); -- phy_restore_page(phydev, MTK_PHY_PAGE_STANDARD, 0); -+ /* TR_OPEN_LOOP_EN = 1, lpf_x_average = 10 */ -+ phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_DEV1E_REG234, -+ MTK_PHY_TR_OPEN_LOOP_EN_MASK | MTK_PHY_LPF_X_AVERAGE_MASK, -+ BIT(0) | FIELD_PREP(MTK_PHY_LPF_X_AVERAGE_MASK, 0xa)); -+ -+ /* rg_tr_lpf_cnt_val = 1023 */ -+ phy_write_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_LPF_CNT_VAL, 0x3ff); - } - - static void mt798x_phy_eee(struct phy_device *phydev) -@@ -884,11 +892,11 @@ static void mt798x_phy_eee(struct phy_device *phydev) - MTK_PHY_LPI_SLV_SEND_TX_EN, - FIELD_PREP(MTK_PHY_LPI_SLV_SEND_TX_TIMER_MASK, 0x120)); - -- phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_DEV1E_REG239, -- MTK_PHY_LPI_SEND_LOC_TIMER_MASK | -- MTK_PHY_LPI_TXPCS_LOC_RCV, -- FIELD_PREP(MTK_PHY_LPI_SEND_LOC_TIMER_MASK, 0x117)); -+ /* Keep MTK_PHY_LPI_SEND_LOC_TIMER as 375 */ -+ phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_DEV1E_REG239, -+ MTK_PHY_LPI_TXPCS_LOC_RCV); - -+ /* This also fixes some IoT issues, such as CH340 */ - phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RG_DEV1E_REG2C7, - MTK_PHY_MAX_GAIN_MASK | MTK_PHY_MIN_GAIN_MASK, - FIELD_PREP(MTK_PHY_MAX_GAIN_MASK, 0x8) | -@@ -922,7 +930,7 @@ static void mt798x_phy_eee(struct phy_device *phydev) - __phy_write(phydev, 0x12, 0x0); - __phy_write(phydev, 0x10, 0x9690); - -- /* REG_EEE_st2TrKf1000 = 3 */ -+ /* REG_EEE_st2TrKf1000 = 2 */ - __phy_write(phydev, 0x11, 0x114f); - __phy_write(phydev, 0x12, 0x2); - __phy_write(phydev, 0x10, 0x969a); -@@ -947,7 +955,7 @@ static void mt798x_phy_eee(struct phy_device *phydev) - __phy_write(phydev, 0x12, 0x0); - __phy_write(phydev, 0x10, 0x96b8); - -- /* REGEEE_wake_slv_tr_wait_dfesigdet_en = 1 */ -+ /* REGEEE_wake_slv_tr_wait_dfesigdet_en = 0 */ - __phy_write(phydev, 0x11, 0x1463); - __phy_write(phydev, 0x12, 0x0); - __phy_write(phydev, 0x10, 0x96ca); -@@ -1459,6 +1467,13 @@ static int mt7988_phy_probe(struct phy_device *phydev) - if (err) - return err; - -+ /* Disable TX power saving at probing to: -+ * 1. Meet common mode compliance test criteria -+ * 2. Make sure that TX-VCM calibration works fine -+ */ -+ phy_modify_mmd(phydev, MDIO_MMD_VEND1, MTK_PHY_RXADC_CTRL_RG7, -+ MTK_PHY_DA_AD_BUF_BIAS_LP_MASK, 0x3 << 8); -+ - return mt798x_phy_calibration(phydev); - } - --- -2.43.2 - -From 1cb0d682a8b0cd196a88e90398157430793efdbd Mon Sep 17 00:00:00 2001 -From: Gaurav Jain <gaurav.jain@nxp.com> -Date: Thu, 18 Jan 2024 14:55:57 +0530 -Subject: [PATCH 1317/1501] crypto: caam - fix asynchronous hash -Content-Length: 3911 -Lines: 110 - -[ Upstream commit c5a2f74db71a849f3a60bc153d684d6d28a0c665 ] - -ahash_alg->setkey is updated to ahash_nosetkey in ahash.c -so checking setkey() function to determine hmac algorithm is not valid. - -to fix this added is_hmac variable in structure caam_hash_alg to determine -whether the algorithm is hmac or not. - -Fixes: 2f1f34c1bf7b ("crypto: ahash - optimize performance when wrapping shash") -Signed-off-by: Gaurav Jain <gaurav.jain@nxp.com> -Reviewed-by: Eric Biggers <ebiggers@google.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/crypto/caam/caamalg_qi2.c | 7 +++++-- - drivers/crypto/caam/caamhash.c | 7 +++++-- - 2 files changed, 10 insertions(+), 4 deletions(-) - -diff --git a/drivers/crypto/caam/caamalg_qi2.c b/drivers/crypto/caam/caamalg_qi2.c -index a148ff1f0872..a4f6884416a0 100644 ---- a/drivers/crypto/caam/caamalg_qi2.c -+++ b/drivers/crypto/caam/caamalg_qi2.c -@@ -4545,6 +4545,7 @@ struct caam_hash_alg { - struct list_head entry; - struct device *dev; - int alg_type; -+ bool is_hmac; - struct ahash_alg ahash_alg; - }; - -@@ -4571,7 +4572,7 @@ static int caam_hash_cra_init(struct crypto_tfm *tfm) - - ctx->dev = caam_hash->dev; - -- if (alg->setkey) { -+ if (caam_hash->is_hmac) { - ctx->adata.key_dma = dma_map_single_attrs(ctx->dev, ctx->key, - ARRAY_SIZE(ctx->key), - DMA_TO_DEVICE, -@@ -4611,7 +4612,7 @@ static int caam_hash_cra_init(struct crypto_tfm *tfm) - * For keyed hash algorithms shared descriptors - * will be created later in setkey() callback - */ -- return alg->setkey ? 0 : ahash_set_sh_desc(ahash); -+ return caam_hash->is_hmac ? 0 : ahash_set_sh_desc(ahash); - } - - static void caam_hash_cra_exit(struct crypto_tfm *tfm) -@@ -4646,12 +4647,14 @@ static struct caam_hash_alg *caam_hash_alloc(struct device *dev, - template->hmac_name); - snprintf(alg->cra_driver_name, CRYPTO_MAX_ALG_NAME, "%s", - template->hmac_driver_name); -+ t_alg->is_hmac = true; - } else { - snprintf(alg->cra_name, CRYPTO_MAX_ALG_NAME, "%s", - template->name); - snprintf(alg->cra_driver_name, CRYPTO_MAX_ALG_NAME, "%s", - template->driver_name); - t_alg->ahash_alg.setkey = NULL; -+ t_alg->is_hmac = false; - } - alg->cra_module = THIS_MODULE; - alg->cra_init = caam_hash_cra_init; -diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c -index 290c8500c247..fdd724228c2f 100644 ---- a/drivers/crypto/caam/caamhash.c -+++ b/drivers/crypto/caam/caamhash.c -@@ -1753,6 +1753,7 @@ static struct caam_hash_template driver_hash[] = { - struct caam_hash_alg { - struct list_head entry; - int alg_type; -+ bool is_hmac; - struct ahash_engine_alg ahash_alg; - }; - -@@ -1804,7 +1805,7 @@ static int caam_hash_cra_init(struct crypto_tfm *tfm) - } else { - if (priv->era >= 6) { - ctx->dir = DMA_BIDIRECTIONAL; -- ctx->key_dir = alg->setkey ? DMA_TO_DEVICE : DMA_NONE; -+ ctx->key_dir = caam_hash->is_hmac ? DMA_TO_DEVICE : DMA_NONE; - } else { - ctx->dir = DMA_TO_DEVICE; - ctx->key_dir = DMA_NONE; -@@ -1862,7 +1863,7 @@ static int caam_hash_cra_init(struct crypto_tfm *tfm) - * For keyed hash algorithms shared descriptors - * will be created later in setkey() callback - */ -- return alg->setkey ? 0 : ahash_set_sh_desc(ahash); -+ return caam_hash->is_hmac ? 0 : ahash_set_sh_desc(ahash); - } - - static void caam_hash_cra_exit(struct crypto_tfm *tfm) -@@ -1915,12 +1916,14 @@ caam_hash_alloc(struct caam_hash_template *template, - template->hmac_name); - snprintf(alg->cra_driver_name, CRYPTO_MAX_ALG_NAME, "%s", - template->hmac_driver_name); -+ t_alg->is_hmac = true; - } else { - snprintf(alg->cra_name, CRYPTO_MAX_ALG_NAME, "%s", - template->name); - snprintf(alg->cra_driver_name, CRYPTO_MAX_ALG_NAME, "%s", - template->driver_name); - halg->setkey = NULL; -+ t_alg->is_hmac = false; - } - alg->cra_module = THIS_MODULE; - alg->cra_init = caam_hash_cra_init; --- -2.43.2 - -From c835df3bcc14858ae9b27315dd7de76370b94f3a Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Thu, 25 Jan 2024 17:05:57 +0000 -Subject: [PATCH 1321/1501] ip6_tunnel: make sure to pull inner header in - __ip6_tnl_rcv() -Content-Length: 5395 -Lines: 131 - -[ Upstream commit 8d975c15c0cd744000ca386247432d57b21f9df0 ] - -syzbot found __ip6_tnl_rcv() could access unitiliazed data [1]. - -Call pskb_inet_may_pull() to fix this, and initialize ipv6h -variable after this call as it can change skb->head. - -[1] - BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] - BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] - BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321 - __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] - INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] - IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321 - ip6ip6_dscp_ecn_decapsulate+0x178/0x1b0 net/ipv6/ip6_tunnel.c:727 - __ip6_tnl_rcv+0xd4e/0x1590 net/ipv6/ip6_tunnel.c:845 - ip6_tnl_rcv+0xce/0x100 net/ipv6/ip6_tunnel.c:888 - gre_rcv+0x143f/0x1870 - ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438 - ip6_input_finish net/ipv6/ip6_input.c:483 [inline] - NF_HOOK include/linux/netfilter.h:314 [inline] - ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492 - ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586 - dst_input include/net/dst.h:461 [inline] - ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79 - NF_HOOK include/linux/netfilter.h:314 [inline] - ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310 - __netif_receive_skb_one_core net/core/dev.c:5532 [inline] - __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5646 - netif_receive_skb_internal net/core/dev.c:5732 [inline] - netif_receive_skb+0x58/0x660 net/core/dev.c:5791 - tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 - tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002 - tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 - call_write_iter include/linux/fs.h:2084 [inline] - new_sync_write fs/read_write.c:497 [inline] - vfs_write+0x786/0x1200 fs/read_write.c:590 - ksys_write+0x20f/0x4c0 fs/read_write.c:643 - __do_sys_write fs/read_write.c:655 [inline] - __se_sys_write fs/read_write.c:652 [inline] - __x64_sys_write+0x93/0xd0 fs/read_write.c:652 - do_syscall_x64 arch/x86/entry/common.c:52 [inline] - do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83 - entry_SYSCALL_64_after_hwframe+0x63/0x6b - -Uninit was created at: - slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 - slab_alloc_node mm/slub.c:3478 [inline] - kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523 - kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560 - __alloc_skb+0x318/0x740 net/core/skbuff.c:651 - alloc_skb include/linux/skbuff.h:1286 [inline] - alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334 - sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2787 - tun_alloc_skb drivers/net/tun.c:1531 [inline] - tun_get_user+0x1e8a/0x66d0 drivers/net/tun.c:1846 - tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 - call_write_iter include/linux/fs.h:2084 [inline] - new_sync_write fs/read_write.c:497 [inline] - vfs_write+0x786/0x1200 fs/read_write.c:590 - ksys_write+0x20f/0x4c0 fs/read_write.c:643 - __do_sys_write fs/read_write.c:655 [inline] - __se_sys_write fs/read_write.c:652 [inline] - __x64_sys_write+0x93/0xd0 fs/read_write.c:652 - do_syscall_x64 arch/x86/entry/common.c:52 [inline] - do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83 - entry_SYSCALL_64_after_hwframe+0x63/0x6b - -CPU: 0 PID: 5034 Comm: syz-executor331 Not tainted 6.7.0-syzkaller-00562-g9f8413c4a66f #0 -Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 - -Fixes: 0d3c703a9d17 ("ipv6: Cleanup IPv6 tunnel receive path") -Reported-by: syzbot <syzkaller@googlegroups.com> -Signed-off-by: Eric Dumazet <edumazet@google.com> -Reviewed-by: Simon Horman <horms@kernel.org> -Link: https://lore.kernel.org/r/20240125170557.2663942-1-edumazet@google.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/ipv6/ip6_tunnel.c | 21 ++++++++++++++++++--- - 1 file changed, 18 insertions(+), 3 deletions(-) - -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index 46c19bd48990..9bbabf750a21 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -796,8 +796,8 @@ static int __ip6_tnl_rcv(struct ip6_tnl *tunnel, struct sk_buff *skb, - struct sk_buff *skb), - bool log_ecn_err) - { -- const struct ipv6hdr *ipv6h = ipv6_hdr(skb); -- int err; -+ const struct ipv6hdr *ipv6h; -+ int nh, err; - - if ((!(tpi->flags & TUNNEL_CSUM) && - (tunnel->parms.i_flags & TUNNEL_CSUM)) || -@@ -829,7 +829,6 @@ static int __ip6_tnl_rcv(struct ip6_tnl *tunnel, struct sk_buff *skb, - goto drop; - } - -- ipv6h = ipv6_hdr(skb); - skb->protocol = eth_type_trans(skb, tunnel->dev); - skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN); - } else { -@@ -837,7 +836,23 @@ static int __ip6_tnl_rcv(struct ip6_tnl *tunnel, struct sk_buff *skb, - skb_reset_mac_header(skb); - } - -+ /* Save offset of outer header relative to skb->head, -+ * because we are going to reset the network header to the inner header -+ * and might change skb->head. -+ */ -+ nh = skb_network_header(skb) - skb->head; -+ - skb_reset_network_header(skb); -+ -+ if (!pskb_inet_may_pull(skb)) { -+ DEV_STATS_INC(tunnel->dev, rx_length_errors); -+ DEV_STATS_INC(tunnel->dev, rx_errors); -+ goto drop; -+ } -+ -+ /* Get the outer header. */ -+ ipv6h = (struct ipv6hdr *)(skb->head + nh); -+ - memset(skb->cb, 0, sizeof(struct inet6_skb_parm)); - - __skb_tunnel_rx(skb, tunnel->dev, tunnel->net); --- -2.43.2 - -From e151d85777d99a0b2ded3210bf2b636fc6aaf2fa Mon Sep 17 00:00:00 2001 -From: Daniel Golle <daniel@makrotopia.org> -Date: Wed, 24 Jan 2024 05:17:25 +0000 -Subject: [PATCH 1322/1501] net: dsa: mt7530: fix 10M/100M speed on MT7988 - switch -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1351 -Lines: 33 - -[ Upstream commit dfa988b4c7c3a48bde7c2713308920c7741fff29 ] - -Setup PMCR port register for actual speed and duplex on internally -connected PHYs of the MT7988 built-in switch. This fixes links with -speeds other than 1000M. - -Fixes: 110c18bfed41 ("net: dsa: mt7530: introduce driver for MT7988 built-in switch") -Signed-off-by: Daniel Golle <daniel@makrotopia.org> -Reviewed-by: Vladimir Oltean <olteanv@gmail.com> -Acked-by: Arınç ÜNAL <arinc.unal@arinc9.com> -Link: https://lore.kernel.org/r/a5b04dfa8256d8302f402545a51ac4c626fdba25.1706071272.git.daniel@makrotopia.org -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/dsa/mt7530.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c -index d27c6b70a2f6..2333f6383b54 100644 ---- a/drivers/net/dsa/mt7530.c -+++ b/drivers/net/dsa/mt7530.c -@@ -2838,8 +2838,7 @@ static void mt753x_phylink_mac_link_up(struct dsa_switch *ds, int port, - /* MT753x MAC works in 1G full duplex mode for all up-clocked - * variants. - */ -- if (interface == PHY_INTERFACE_MODE_INTERNAL || -- interface == PHY_INTERFACE_MODE_TRGMII || -+ if (interface == PHY_INTERFACE_MODE_TRGMII || - (phy_interface_mode_is_8023z(interface))) { - speed = SPEED_1000; - duplex = DUPLEX_FULL; --- -2.43.2 - -From 2e8c9ae40adda2be1ba41c05fd3cd1e61cce3207 Mon Sep 17 00:00:00 2001 -From: Nicolas Dichtel <nicolas.dichtel@6wind.com> -Date: Thu, 25 Jan 2024 15:18:47 +0100 -Subject: [PATCH 1323/1501] ipmr: fix kernel panic when forwarding mcast - packets -Content-Length: 8738 -Lines: 162 - -[ Upstream commit e622502c310f1069fd9f41cd38210553115f610a ] - -The stacktrace was: -[ 86.305548] BUG: kernel NULL pointer dereference, address: 0000000000000092 -[ 86.306815] #PF: supervisor read access in kernel mode -[ 86.307717] #PF: error_code(0x0000) - not-present page -[ 86.308624] PGD 0 P4D 0 -[ 86.309091] Oops: 0000 [#1] PREEMPT SMP NOPTI -[ 86.309883] CPU: 2 PID: 3139 Comm: pimd Tainted: G U 6.8.0-6wind-knet #1 -[ 86.311027] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org 04/01/2014 -[ 86.312728] RIP: 0010:ip_mr_forward (/build/work/knet/net/ipv4/ipmr.c:1985) -[ 86.313399] Code: f9 1f 0f 87 85 03 00 00 48 8d 04 5b 48 8d 04 83 49 8d 44 c5 00 48 8b 40 70 48 39 c2 0f 84 d9 00 00 00 49 8b 46 58 48 83 e0 fe <80> b8 92 00 00 00 00 0f 84 55 ff ff ff 49 83 47 38 01 45 85 e4 0f -[ 86.316565] RSP: 0018:ffffad21c0583ae0 EFLAGS: 00010246 -[ 86.317497] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 -[ 86.318596] RDX: ffff9559cb46c000 RSI: 0000000000000000 RDI: 0000000000000000 -[ 86.319627] RBP: ffffad21c0583b30 R08: 0000000000000000 R09: 0000000000000000 -[ 86.320650] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 -[ 86.321672] R13: ffff9559c093a000 R14: ffff9559cc00b800 R15: ffff9559c09c1d80 -[ 86.322873] FS: 00007f85db661980(0000) GS:ffff955a79d00000(0000) knlGS:0000000000000000 -[ 86.324291] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -[ 86.325314] CR2: 0000000000000092 CR3: 000000002f13a000 CR4: 0000000000350ef0 -[ 86.326589] Call Trace: -[ 86.327036] <TASK> -[ 86.327434] ? show_regs (/build/work/knet/arch/x86/kernel/dumpstack.c:479) -[ 86.328049] ? __die (/build/work/knet/arch/x86/kernel/dumpstack.c:421 /build/work/knet/arch/x86/kernel/dumpstack.c:434) -[ 86.328508] ? page_fault_oops (/build/work/knet/arch/x86/mm/fault.c:707) -[ 86.329107] ? do_user_addr_fault (/build/work/knet/arch/x86/mm/fault.c:1264) -[ 86.329756] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223) -[ 86.330350] ? __irq_work_queue_local (/build/work/knet/kernel/irq_work.c:111 (discriminator 1)) -[ 86.331013] ? exc_page_fault (/build/work/knet/./arch/x86/include/asm/paravirt.h:693 /build/work/knet/arch/x86/mm/fault.c:1515 /build/work/knet/arch/x86/mm/fault.c:1563) -[ 86.331702] ? asm_exc_page_fault (/build/work/knet/./arch/x86/include/asm/idtentry.h:570) -[ 86.332468] ? ip_mr_forward (/build/work/knet/net/ipv4/ipmr.c:1985) -[ 86.333183] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223) -[ 86.333920] ipmr_mfc_add (/build/work/knet/./include/linux/rcupdate.h:782 /build/work/knet/net/ipv4/ipmr.c:1009 /build/work/knet/net/ipv4/ipmr.c:1273) -[ 86.334583] ? __pfx_ipmr_hash_cmp (/build/work/knet/net/ipv4/ipmr.c:363) -[ 86.335357] ip_mroute_setsockopt (/build/work/knet/net/ipv4/ipmr.c:1470) -[ 86.336135] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223) -[ 86.336854] ? ip_mroute_setsockopt (/build/work/knet/net/ipv4/ipmr.c:1470) -[ 86.337679] do_ip_setsockopt (/build/work/knet/net/ipv4/ip_sockglue.c:944) -[ 86.338408] ? __pfx_unix_stream_read_actor (/build/work/knet/net/unix/af_unix.c:2862) -[ 86.339232] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223) -[ 86.339809] ? aa_sk_perm (/build/work/knet/security/apparmor/include/cred.h:153 /build/work/knet/security/apparmor/net.c:181) -[ 86.340342] ip_setsockopt (/build/work/knet/net/ipv4/ip_sockglue.c:1415) -[ 86.340859] raw_setsockopt (/build/work/knet/net/ipv4/raw.c:836) -[ 86.341408] ? security_socket_setsockopt (/build/work/knet/security/security.c:4561 (discriminator 13)) -[ 86.342116] sock_common_setsockopt (/build/work/knet/net/core/sock.c:3716) -[ 86.342747] do_sock_setsockopt (/build/work/knet/net/socket.c:2313) -[ 86.343363] __sys_setsockopt (/build/work/knet/./include/linux/file.h:32 /build/work/knet/net/socket.c:2336) -[ 86.344020] __x64_sys_setsockopt (/build/work/knet/net/socket.c:2340) -[ 86.344766] do_syscall_64 (/build/work/knet/arch/x86/entry/common.c:52 /build/work/knet/arch/x86/entry/common.c:83) -[ 86.345433] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223) -[ 86.346161] ? syscall_exit_work (/build/work/knet/./include/linux/audit.h:357 /build/work/knet/kernel/entry/common.c:160) -[ 86.346938] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223) -[ 86.347657] ? syscall_exit_to_user_mode (/build/work/knet/kernel/entry/common.c:215) -[ 86.348538] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223) -[ 86.349262] ? do_syscall_64 (/build/work/knet/./arch/x86/include/asm/cpufeature.h:171 /build/work/knet/arch/x86/entry/common.c:98) -[ 86.349971] entry_SYSCALL_64_after_hwframe (/build/work/knet/arch/x86/entry/entry_64.S:129) - -The original packet in ipmr_cache_report() may be queued and then forwarded -with ip_mr_forward(). This last function has the assumption that the skb -dst is set. - -After the below commit, the skb dst is dropped by ipv4_pktinfo_prepare(), -which causes the oops. - -Fixes: bb7403655b3c ("ipmr: support IP_PKTINFO on cache report IGMP msg") -Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> -Reviewed-by: Eric Dumazet <edumazet@google.com> -Link: https://lore.kernel.org/r/20240125141847.1931933-1-nicolas.dichtel@6wind.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/net/ip.h | 2 +- - net/ipv4/ip_sockglue.c | 6 ++++-- - net/ipv4/ipmr.c | 2 +- - net/ipv4/raw.c | 2 +- - net/ipv4/udp.c | 2 +- - 5 files changed, 8 insertions(+), 6 deletions(-) - -diff --git a/include/net/ip.h b/include/net/ip.h -index 1fc4c8d69e33..6390dd08da8c 100644 ---- a/include/net/ip.h -+++ b/include/net/ip.h -@@ -761,7 +761,7 @@ int ip_options_rcv_srr(struct sk_buff *skb, struct net_device *dev); - * Functions provided by ip_sockglue.c - */ - --void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb); -+void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb, bool drop_dst); - void ip_cmsg_recv_offset(struct msghdr *msg, struct sock *sk, - struct sk_buff *skb, int tlen, int offset); - int ip_cmsg_send(struct sock *sk, struct msghdr *msg, -diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c -index 2efc53526a38..8a88e705d827 100644 ---- a/net/ipv4/ip_sockglue.c -+++ b/net/ipv4/ip_sockglue.c -@@ -1366,12 +1366,13 @@ int do_ip_setsockopt(struct sock *sk, int level, int optname, - * ipv4_pktinfo_prepare - transfer some info from rtable to skb - * @sk: socket - * @skb: buffer -+ * @drop_dst: if true, drops skb dst - * - * To support IP_CMSG_PKTINFO option, we store rt_iif and specific - * destination in skb->cb[] before dst drop. - * This way, receiver doesn't make cache line misses to read rtable. - */ --void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb) -+void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb, bool drop_dst) - { - struct in_pktinfo *pktinfo = PKTINFO_SKB_CB(skb); - bool prepare = inet_test_bit(PKTINFO, sk) || -@@ -1400,7 +1401,8 @@ void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb) - pktinfo->ipi_ifindex = 0; - pktinfo->ipi_spec_dst.s_addr = 0; - } -- skb_dst_drop(skb); -+ if (drop_dst) -+ skb_dst_drop(skb); - } - - int ip_setsockopt(struct sock *sk, int level, int optname, sockptr_t optval, -diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c -index 0063a237253b..e49242706b5f 100644 ---- a/net/ipv4/ipmr.c -+++ b/net/ipv4/ipmr.c -@@ -1073,7 +1073,7 @@ static int ipmr_cache_report(const struct mr_table *mrt, - msg = (struct igmpmsg *)skb_network_header(skb); - msg->im_vif = vifi; - msg->im_vif_hi = vifi >> 8; -- ipv4_pktinfo_prepare(mroute_sk, pkt); -+ ipv4_pktinfo_prepare(mroute_sk, pkt, false); - memcpy(skb->cb, pkt->cb, sizeof(skb->cb)); - /* Add our header */ - igmp = skb_put(skb, sizeof(struct igmphdr)); -diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c -index 27da9d7294c0..aea89326c697 100644 ---- a/net/ipv4/raw.c -+++ b/net/ipv4/raw.c -@@ -292,7 +292,7 @@ static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb) - - /* Charge it to the socket. */ - -- ipv4_pktinfo_prepare(sk, skb); -+ ipv4_pktinfo_prepare(sk, skb, true); - if (sock_queue_rcv_skb_reason(sk, skb, &reason) < 0) { - kfree_skb_reason(skb, reason); - return NET_RX_DROP; -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index 148ffb007969..f631b0a21af4 100644 ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -2169,7 +2169,7 @@ static int udp_queue_rcv_one_skb(struct sock *sk, struct sk_buff *skb) - - udp_csum_pull_header(skb); - -- ipv4_pktinfo_prepare(sk, skb); -+ ipv4_pktinfo_prepare(sk, skb, true); - return __udp_queue_rcv_skb(sk, skb); - - csum_error: --- -2.43.2 - -From f006b7d61cc55e74159ec4170aaf28ffad99b241 Mon Sep 17 00:00:00 2001 -From: Horatiu Vultur <horatiu.vultur@microchip.com> -Date: Wed, 24 Jan 2024 11:17:58 +0100 -Subject: [PATCH 1324/1501] net: lan966x: Fix port configuration when using - SGMII interface -Content-Length: 1450 -Lines: 34 - -[ Upstream commit 62b4248105353e7d1debd30ca5c57ec5e5f28e35 ] - -In case the interface between the MAC and the PHY is SGMII, then the bit -GIGA_MODE on the MAC side needs to be set regardless of the speed at -which it is running. - -Fixes: d28d6d2e37d1 ("net: lan966x: add port module support") -Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com> -Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/microchip/lan966x/lan966x_port.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_port.c b/drivers/net/ethernet/microchip/lan966x/lan966x_port.c -index 92108d354051..2e83bbb9477e 100644 ---- a/drivers/net/ethernet/microchip/lan966x/lan966x_port.c -+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_port.c -@@ -168,9 +168,10 @@ static void lan966x_port_link_up(struct lan966x_port *port) - lan966x_taprio_speed_set(port, config->speed); - - /* Also the GIGA_MODE_ENA(1) needs to be set regardless of the -- * port speed for QSGMII ports. -+ * port speed for QSGMII or SGMII ports. - */ -- if (phy_interface_num_ports(config->portmode) == 4) -+ if (phy_interface_num_ports(config->portmode) == 4 || -+ config->portmode == PHY_INTERFACE_MODE_SGMII) - mode = DEV_MAC_MODE_CFG_GIGA_MODE_ENA_SET(1); - - lan_wr(config->duplex | mode, --- -2.43.2 - -From 7271930bc9de0c780676b0129b0f693419035bea Mon Sep 17 00:00:00 2001 -From: Linus Torvalds <torvalds@linux-foundation.org> -Date: Sat, 27 Jan 2024 13:21:14 -0800 -Subject: [PATCH 1325/1501] tracefs: remove stale 'update_gid' code -Content-Length: 2646 -Lines: 79 - -[ Upstream commit 29142dc92c37d3259a33aef15b03e6ee25b0d188 ] - -The 'eventfs_update_gid()' function is no longer called, so remove it -(and the helper function it uses). - -Link: https://lore.kernel.org/all/CAHk-=wj+DsZZ=2iTUkJ-Nojs9fjYMvPs1NuoM3yK7aTDtJfPYQ@mail.gmail.com/ - -Fixes: 8186fff7ab64 ("tracefs/eventfs: Use root and instance inodes as default ownership") -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/tracefs/event_inode.c | 38 -------------------------------------- - fs/tracefs/internal.h | 1 - - 2 files changed, 39 deletions(-) - -diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c -index 517f1ae1a058..f2d7ad155c00 100644 ---- a/fs/tracefs/event_inode.c -+++ b/fs/tracefs/event_inode.c -@@ -273,44 +273,6 @@ static void update_inode_attr(struct dentry *dentry, struct inode *inode, - inode->i_gid = attr->gid; - } - --static void update_gid(struct eventfs_inode *ei, kgid_t gid, int level) --{ -- struct eventfs_inode *ei_child; -- -- /* at most we have events/system/event */ -- if (WARN_ON_ONCE(level > 3)) -- return; -- -- ei->attr.gid = gid; -- -- if (ei->entry_attrs) { -- for (int i = 0; i < ei->nr_entries; i++) { -- ei->entry_attrs[i].gid = gid; -- } -- } -- -- /* -- * Only eventfs_inode with dentries are updated, make sure -- * all eventfs_inodes are updated. If one of the children -- * do not have a dentry, this function must traverse it. -- */ -- list_for_each_entry_srcu(ei_child, &ei->children, list, -- srcu_read_lock_held(&eventfs_srcu)) { -- if (!ei_child->dentry) -- update_gid(ei_child, gid, level + 1); -- } --} -- --void eventfs_update_gid(struct dentry *dentry, kgid_t gid) --{ -- struct eventfs_inode *ei = dentry->d_fsdata; -- int idx; -- -- idx = srcu_read_lock(&eventfs_srcu); -- update_gid(ei, gid, 0); -- srcu_read_unlock(&eventfs_srcu, idx); --} -- - /** - * create_file - create a file in the tracefs filesystem - * @name: the name of the file to create. -diff --git a/fs/tracefs/internal.h b/fs/tracefs/internal.h -index 12b7d0150ae9..af3b43fa75cd 100644 ---- a/fs/tracefs/internal.h -+++ b/fs/tracefs/internal.h -@@ -81,7 +81,6 @@ struct inode *tracefs_get_inode(struct super_block *sb); - struct dentry *eventfs_start_creating(const char *name, struct dentry *parent); - struct dentry *eventfs_failed_creating(struct dentry *dentry); - struct dentry *eventfs_end_creating(struct dentry *dentry); --void eventfs_update_gid(struct dentry *dentry, kgid_t gid); - void eventfs_set_ei_status_free(struct tracefs_inode *ti, struct dentry *dentry); - - #endif /* _TRACEFS_INTERNAL_H */ --- -2.43.2 - -From 1b8adcc0e2c584fec778add7777fe28e20781e60 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Thu, 25 Jan 2024 10:33:17 +0000 -Subject: [PATCH 1326/1501] tcp: add sanity checks to rx zerocopy -Content-Length: 2415 -Lines: 70 - -[ Upstream commit 577e4432f3ac810049cb7e6b71f4d96ec7c6e894 ] - -TCP rx zerocopy intent is to map pages initially allocated -from NIC drivers, not pages owned by a fs. - -This patch adds to can_map_frag() these additional checks: - -- Page must not be a compound one. -- page->mapping must be NULL. - -This fixes the panic reported by ZhangPeng. - -syzbot was able to loopback packets built with sendfile(), -mapping pages owned by an ext4 file to TCP rx zerocopy. - -r3 = socket$inet_tcp(0x2, 0x1, 0x0) -mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x0) -r4 = socket$inet_tcp(0x2, 0x1, 0x0) -bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e24, @multicast1}, 0x10) -connect$inet(r4, &(0x7f00000006c0)={0x2, 0x4e24, @empty}, 0x10) -r5 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', - 0x181e42, 0x0) -fallocate(r5, 0x0, 0x0, 0x85b8) -sendfile(r4, r5, 0x0, 0x8ba0) -getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23, - &(0x7f00000001c0)={&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, - 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000440)=0x40) -r6 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', - 0x181e42, 0x0) - -Fixes: 93ab6cc69162 ("tcp: implement mmap() for zero copy receive") -Link: https://lore.kernel.org/netdev/5106a58e-04da-372a-b836-9d3d0bd2507b@huawei.com/T/ -Reported-and-bisected-by: ZhangPeng <zhangpeng362@huawei.com> -Signed-off-by: Eric Dumazet <edumazet@google.com> -Cc: Arjun Roy <arjunroy@google.com> -Cc: Matthew Wilcox <willy@infradead.org> -Cc: linux-mm@vger.kernel.org -Cc: Andrew Morton <akpm@linux-foundation.org> -Cc: linux-fsdevel@vger.kernel.org -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/ipv4/tcp.c | 12 +++++++++++- - 1 file changed, 11 insertions(+), 1 deletion(-) - -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 7bce79beca2b..b30ef770a6cc 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -1786,7 +1786,17 @@ static skb_frag_t *skb_advance_to_frag(struct sk_buff *skb, u32 offset_skb, - - static bool can_map_frag(const skb_frag_t *frag) - { -- return skb_frag_size(frag) == PAGE_SIZE && !skb_frag_off(frag); -+ struct page *page; -+ -+ if (skb_frag_size(frag) != PAGE_SIZE || skb_frag_off(frag)) -+ return false; -+ -+ page = skb_frag_page(frag); -+ -+ if (PageCompound(page) || page->mapping) -+ return false; -+ -+ return true; - } - - static int find_next_mappable_frag(const skb_frag_t *frag, --- -2.43.2 - -From 8ad7b0ac9f6744d4aa7cb2d2481cf863be7a3f70 Mon Sep 17 00:00:00 2001 -From: Jacob Keller <jacob.e.keller@intel.com> -Date: Mon, 11 Dec 2023 18:05:52 -0800 -Subject: [PATCH 1327/1501] e1000e: correct maximum frequency adjustment values -Content-Length: 7017 -Lines: 167 - -[ Upstream commit f1f6a6b1830a8f1dc92ee26fae76333f446b0663 ] - -The e1000e driver supports hardware with a variety of different clock -speeds, and thus a variety of different increment values used for -programming its PTP hardware clock. - -The values currently programmed in e1000e_ptp_init are incorrect. In -particular, only two maximum adjustments are used: 24000000 - 1, and -600000000 - 1. These were originally intended to be used with the 96 MHz -clock and the 25 MHz clock. - -Both of these values are actually slightly too high. For the 96 MHz clock, -the actual maximum value that can safely be programmed is 23,999,938. For -the 25 MHz clock, the maximum value is 599,999,904. - -Worse, several devices use a 24 MHz clock or a 38.4 MHz clock. These parts -are incorrectly assigned one of either the 24million or 600million values. -For the 24 MHz clock, this is not a significant issue: its current -increment value can support an adjustment up to 7billion in the positive -direction. However, the 38.4 KHz clock uses an increment value which can -only support up to 230,769,157 before it starts overflowing. - -To understand where these values come from, consider that frequency -adjustments have the form of: - -new_incval = base_incval + (base_incval * adjustment) / (unit of adjustment) - -The maximum adjustment is reported in terms of parts per billion: -new_incval = base_incval + (base_incval * adjustment) / 1 billion - -The largest possible adjustment is thus given by the following: -max_incval = base_incval + (base_incval * max_adj) / 1 billion - -Re-arranging to solve for max_adj: -max_adj = (max_incval - base_incval) * 1 billion / base_incval - -We also need to ensure that negative adjustments cannot underflow. This can -be achieved simply by ensuring max_adj is always less than 1 billion. - -Introduce new macros in e1000.h codifying the maximum adjustment in PPB for -each frequency given its associated increment values. Also clarify where -these values come from by commenting about the above equations. - -Replace the switch statement in e1000e_ptp_init with one which mirrors the -increment value switch statement from e1000e_get_base_timinica. For each -device, assign the appropriate maximum adjustment based on its frequency. -Some parts can have one of two frequency modes as determined by -E1000_TSYNCRXCTL_SYSCFI. - -Since the new flow directly matches the assignments in -e1000e_get_base_timinca, and uses well defined macro names, it is much -easier to verify that the resulting maximum adjustments are correct. It -also avoids difficult to parse construction such as the "hw->mac.type < -e1000_phc_lpt", and the use of fallthrough which was especially confusing -when combined with a conditional block. - -Note that I believe the current increment value configuration used for -24MHz clocks is sub-par, as it leaves at least 3 extra bits available in -the INCVALUE register. However, fixing that requires more careful review of -the clock rate and associated values. - -Reported-by: Trey Harrison <harrisondigitalmedia@gmail.com> -Fixes: 68fe1d5da548 ("e1000e: Add Support for 38.4MHZ frequency") -Fixes: d89777bf0e42 ("e1000e: add support for IEEE-1588 PTP") -Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> -Tested-by: Naama Meir <naamax.meir@linux.intel.com> -Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/intel/e1000e/e1000.h | 20 ++++++++++++++++++++ - drivers/net/ethernet/intel/e1000e/ptp.c | 22 +++++++++++++++------- - 2 files changed, 35 insertions(+), 7 deletions(-) - -diff --git a/drivers/net/ethernet/intel/e1000e/e1000.h b/drivers/net/ethernet/intel/e1000e/e1000.h -index a187582d2299..ba9c19e6994c 100644 ---- a/drivers/net/ethernet/intel/e1000e/e1000.h -+++ b/drivers/net/ethernet/intel/e1000e/e1000.h -@@ -360,23 +360,43 @@ s32 e1000e_get_base_timinca(struct e1000_adapter *adapter, u32 *timinca); - * As a result, a shift of INCVALUE_SHIFT_n is used to fit a value of - * INCVALUE_n into the TIMINCA register allowing 32+8+(24-INCVALUE_SHIFT_n) - * bits to count nanoseconds leaving the rest for fractional nonseconds. -+ * -+ * Any given INCVALUE also has an associated maximum adjustment value. This -+ * maximum adjustment value is the largest increase (or decrease) which can be -+ * safely applied without overflowing the INCVALUE. Since INCVALUE has -+ * a maximum range of 24 bits, its largest value is 0xFFFFFF. -+ * -+ * To understand where the maximum value comes from, consider the following -+ * equation: -+ * -+ * new_incval = base_incval + (base_incval * adjustment) / 1billion -+ * -+ * To avoid overflow that means: -+ * max_incval = base_incval + (base_incval * max_adj) / billion -+ * -+ * Re-arranging: -+ * max_adj = floor(((max_incval - base_incval) * 1billion) / 1billion) - */ - #define INCVALUE_96MHZ 125 - #define INCVALUE_SHIFT_96MHZ 17 - #define INCPERIOD_SHIFT_96MHZ 2 - #define INCPERIOD_96MHZ (12 >> INCPERIOD_SHIFT_96MHZ) -+#define MAX_PPB_96MHZ 23999900 /* 23,999,900 ppb */ - - #define INCVALUE_25MHZ 40 - #define INCVALUE_SHIFT_25MHZ 18 - #define INCPERIOD_25MHZ 1 -+#define MAX_PPB_25MHZ 599999900 /* 599,999,900 ppb */ - - #define INCVALUE_24MHZ 125 - #define INCVALUE_SHIFT_24MHZ 14 - #define INCPERIOD_24MHZ 3 -+#define MAX_PPB_24MHZ 999999999 /* 999,999,999 ppb */ - - #define INCVALUE_38400KHZ 26 - #define INCVALUE_SHIFT_38400KHZ 19 - #define INCPERIOD_38400KHZ 1 -+#define MAX_PPB_38400KHZ 230769100 /* 230,769,100 ppb */ - - /* Another drawback of scaling the incvalue by a large factor is the - * 64-bit SYSTIM register overflows more quickly. This is dealt with -diff --git a/drivers/net/ethernet/intel/e1000e/ptp.c b/drivers/net/ethernet/intel/e1000e/ptp.c -index 02d871bc112a..bbcfd529399b 100644 ---- a/drivers/net/ethernet/intel/e1000e/ptp.c -+++ b/drivers/net/ethernet/intel/e1000e/ptp.c -@@ -280,8 +280,17 @@ void e1000e_ptp_init(struct e1000_adapter *adapter) - - switch (hw->mac.type) { - case e1000_pch2lan: -+ adapter->ptp_clock_info.max_adj = MAX_PPB_96MHZ; -+ break; - case e1000_pch_lpt: -+ if (er32(TSYNCRXCTL) & E1000_TSYNCRXCTL_SYSCFI) -+ adapter->ptp_clock_info.max_adj = MAX_PPB_96MHZ; -+ else -+ adapter->ptp_clock_info.max_adj = MAX_PPB_25MHZ; -+ break; - case e1000_pch_spt: -+ adapter->ptp_clock_info.max_adj = MAX_PPB_24MHZ; -+ break; - case e1000_pch_cnp: - case e1000_pch_tgp: - case e1000_pch_adp: -@@ -289,15 +298,14 @@ void e1000e_ptp_init(struct e1000_adapter *adapter) - case e1000_pch_lnp: - case e1000_pch_ptp: - case e1000_pch_nvp: -- if ((hw->mac.type < e1000_pch_lpt) || -- (er32(TSYNCRXCTL) & E1000_TSYNCRXCTL_SYSCFI)) { -- adapter->ptp_clock_info.max_adj = 24000000 - 1; -- break; -- } -- fallthrough; -+ if (er32(TSYNCRXCTL) & E1000_TSYNCRXCTL_SYSCFI) -+ adapter->ptp_clock_info.max_adj = MAX_PPB_24MHZ; -+ else -+ adapter->ptp_clock_info.max_adj = MAX_PPB_38400KHZ; -+ break; - case e1000_82574: - case e1000_82583: -- adapter->ptp_clock_info.max_adj = 600000000 - 1; -+ adapter->ptp_clock_info.max_adj = MAX_PPB_25MHZ; - break; - default: - break; --- -2.43.2 - -From 7de154f66db5f9d5beae82b61cf6a916725a8edc Mon Sep 17 00:00:00 2001 -From: Jedrzej Jagielski <jedrzej.jagielski@intel.com> -Date: Mon, 18 Dec 2023 11:39:26 +0100 -Subject: [PATCH 1328/1501] ixgbe: Refactor returning internal error codes -Content-Length: 76429 -Lines: 2361 - -[ Upstream commit 5795f533f30a80aa0473652876296ebc9129e33a ] - -Change returning codes to the kernel ones instead of -the internal ones for the entire ixgbe driver. - -Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> -Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> -Reviewed-by: Simon Horman <horms@kernel.org> -Signed-off-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com> -Tested-by: Sunitha Mekala <sunithax.d.mekala@intel.com> (A Contingent worker at Intel) -Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> -Stable-dep-of: bbc404d20d1b ("ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../net/ethernet/intel/ixgbe/ixgbe_82598.c | 36 ++--- - .../net/ethernet/intel/ixgbe/ixgbe_82599.c | 61 ++++---- - .../net/ethernet/intel/ixgbe/ixgbe_common.c | 145 ++++++++---------- - .../net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 2 +- - drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 26 ++-- - drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.c | 34 ++-- - drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h | 1 - - drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c | 84 +++++----- - .../net/ethernet/intel/ixgbe/ixgbe_sriov.c | 2 +- - drivers/net/ethernet/intel/ixgbe/ixgbe_type.h | 39 ----- - drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c | 44 +++--- - drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 107 +++++++------ - 12 files changed, 264 insertions(+), 317 deletions(-) - -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_82598.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_82598.c -index 100388968e4d..3d56481e16bc 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_82598.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_82598.c -@@ -123,14 +123,14 @@ static s32 ixgbe_init_phy_ops_82598(struct ixgbe_hw *hw) - if (ret_val) - return ret_val; - if (hw->phy.sfp_type == ixgbe_sfp_type_unknown) -- return IXGBE_ERR_SFP_NOT_SUPPORTED; -+ return -EOPNOTSUPP; - - /* Check to see if SFP+ module is supported */ - ret_val = ixgbe_get_sfp_init_sequence_offsets(hw, - &list_offset, - &data_offset); - if (ret_val) -- return IXGBE_ERR_SFP_NOT_SUPPORTED; -+ return -EOPNOTSUPP; - break; - default: - break; -@@ -213,7 +213,7 @@ static s32 ixgbe_get_link_capabilities_82598(struct ixgbe_hw *hw, - break; - - default: -- return IXGBE_ERR_LINK_SETUP; -+ return -EIO; - } - - return 0; -@@ -283,7 +283,7 @@ static s32 ixgbe_fc_enable_82598(struct ixgbe_hw *hw) - - /* Validate the water mark configuration */ - if (!hw->fc.pause_time) -- return IXGBE_ERR_INVALID_LINK_SETTINGS; -+ return -EINVAL; - - /* Low water mark of zero causes XOFF floods */ - for (i = 0; i < MAX_TRAFFIC_CLASS; i++) { -@@ -292,7 +292,7 @@ static s32 ixgbe_fc_enable_82598(struct ixgbe_hw *hw) - if (!hw->fc.low_water[i] || - hw->fc.low_water[i] >= hw->fc.high_water[i]) { - hw_dbg(hw, "Invalid water mark configuration\n"); -- return IXGBE_ERR_INVALID_LINK_SETTINGS; -+ return -EINVAL; - } - } - } -@@ -369,7 +369,7 @@ static s32 ixgbe_fc_enable_82598(struct ixgbe_hw *hw) - break; - default: - hw_dbg(hw, "Flow control param set incorrectly\n"); -- return IXGBE_ERR_CONFIG; -+ return -EIO; - } - - /* Set 802.3x based flow control settings. */ -@@ -438,7 +438,7 @@ static s32 ixgbe_start_mac_link_82598(struct ixgbe_hw *hw, - msleep(100); - } - if (!(links_reg & IXGBE_LINKS_KX_AN_COMP)) { -- status = IXGBE_ERR_AUTONEG_NOT_COMPLETE; -+ status = -EIO; - hw_dbg(hw, "Autonegotiation did not complete.\n"); - } - } -@@ -478,7 +478,7 @@ static s32 ixgbe_validate_link_ready(struct ixgbe_hw *hw) - - if (timeout == IXGBE_VALIDATE_LINK_READY_TIMEOUT) { - hw_dbg(hw, "Link was indicated but link is down\n"); -- return IXGBE_ERR_LINK_SETUP; -+ return -EIO; - } - - return 0; -@@ -594,7 +594,7 @@ static s32 ixgbe_setup_mac_link_82598(struct ixgbe_hw *hw, - speed &= link_capabilities; - - if (speed == IXGBE_LINK_SPEED_UNKNOWN) -- return IXGBE_ERR_LINK_SETUP; -+ return -EINVAL; - - /* Set KX4/KX support according to speed requested */ - else if (link_mode == IXGBE_AUTOC_LMS_KX4_AN || -@@ -701,9 +701,9 @@ static s32 ixgbe_reset_hw_82598(struct ixgbe_hw *hw) - - /* Init PHY and function pointers, perform SFP setup */ - phy_status = hw->phy.ops.init(hw); -- if (phy_status == IXGBE_ERR_SFP_NOT_SUPPORTED) -+ if (phy_status == -EOPNOTSUPP) - return phy_status; -- if (phy_status == IXGBE_ERR_SFP_NOT_PRESENT) -+ if (phy_status == -ENOENT) - goto mac_reset_top; - - hw->phy.ops.reset(hw); -@@ -727,7 +727,7 @@ static s32 ixgbe_reset_hw_82598(struct ixgbe_hw *hw) - udelay(1); - } - if (ctrl & IXGBE_CTRL_RST) { -- status = IXGBE_ERR_RESET_FAILED; -+ status = -EIO; - hw_dbg(hw, "Reset polling failed to complete.\n"); - } - -@@ -789,7 +789,7 @@ static s32 ixgbe_set_vmdq_82598(struct ixgbe_hw *hw, u32 rar, u32 vmdq) - /* Make sure we are using a valid rar index range */ - if (rar >= rar_entries) { - hw_dbg(hw, "RAR index %d is out of range.\n", rar); -- return IXGBE_ERR_INVALID_ARGUMENT; -+ return -EINVAL; - } - - rar_high = IXGBE_READ_REG(hw, IXGBE_RAH(rar)); -@@ -814,7 +814,7 @@ static s32 ixgbe_clear_vmdq_82598(struct ixgbe_hw *hw, u32 rar, u32 vmdq) - /* Make sure we are using a valid rar index range */ - if (rar >= rar_entries) { - hw_dbg(hw, "RAR index %d is out of range.\n", rar); -- return IXGBE_ERR_INVALID_ARGUMENT; -+ return -EINVAL; - } - - rar_high = IXGBE_READ_REG(hw, IXGBE_RAH(rar)); -@@ -845,7 +845,7 @@ static s32 ixgbe_set_vfta_82598(struct ixgbe_hw *hw, u32 vlan, u32 vind, - u32 vftabyte; - - if (vlan > 4095) -- return IXGBE_ERR_PARAM; -+ return -EINVAL; - - /* Determine 32-bit word position in array */ - regindex = (vlan >> 5) & 0x7F; /* upper seven bits */ -@@ -964,7 +964,7 @@ static s32 ixgbe_read_i2c_phy_82598(struct ixgbe_hw *hw, u8 dev_addr, - gssr = IXGBE_GSSR_PHY0_SM; - - if (hw->mac.ops.acquire_swfw_sync(hw, gssr) != 0) -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - - if (hw->phy.type == ixgbe_phy_nl) { - /* -@@ -993,7 +993,7 @@ static s32 ixgbe_read_i2c_phy_82598(struct ixgbe_hw *hw, u8 dev_addr, - - if (sfp_stat != IXGBE_I2C_EEPROM_STATUS_PASS) { - hw_dbg(hw, "EEPROM read did not pass.\n"); -- status = IXGBE_ERR_SFP_NOT_PRESENT; -+ status = -ENOENT; - goto out; - } - -@@ -1003,7 +1003,7 @@ static s32 ixgbe_read_i2c_phy_82598(struct ixgbe_hw *hw, u8 dev_addr, - - *eeprom_data = (u8)(sfp_data >> 8); - } else { -- status = IXGBE_ERR_PHY; -+ status = -EIO; - } - - out: -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_82599.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_82599.c -index 58ea959a4482..339e106a5732 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_82599.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_82599.c -@@ -117,7 +117,7 @@ static s32 ixgbe_setup_sfp_modules_82599(struct ixgbe_hw *hw) - ret_val = hw->mac.ops.acquire_swfw_sync(hw, - IXGBE_GSSR_MAC_CSR_SM); - if (ret_val) -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - - if (hw->eeprom.ops.read(hw, ++data_offset, &data_value)) - goto setup_sfp_err; -@@ -144,7 +144,7 @@ static s32 ixgbe_setup_sfp_modules_82599(struct ixgbe_hw *hw) - - if (ret_val) { - hw_dbg(hw, " sfp module setup not complete\n"); -- return IXGBE_ERR_SFP_SETUP_NOT_COMPLETE; -+ return -EIO; - } - } - -@@ -159,7 +159,7 @@ static s32 ixgbe_setup_sfp_modules_82599(struct ixgbe_hw *hw) - usleep_range(hw->eeprom.semaphore_delay * 1000, - hw->eeprom.semaphore_delay * 2000); - hw_err(hw, "eeprom read at offset %d failed\n", data_offset); -- return IXGBE_ERR_SFP_SETUP_NOT_COMPLETE; -+ return -EIO; - } - - /** -@@ -184,7 +184,7 @@ static s32 prot_autoc_read_82599(struct ixgbe_hw *hw, bool *locked, - ret_val = hw->mac.ops.acquire_swfw_sync(hw, - IXGBE_GSSR_MAC_CSR_SM); - if (ret_val) -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - - *locked = true; - } -@@ -219,7 +219,7 @@ static s32 prot_autoc_write_82599(struct ixgbe_hw *hw, u32 autoc, bool locked) - ret_val = hw->mac.ops.acquire_swfw_sync(hw, - IXGBE_GSSR_MAC_CSR_SM); - if (ret_val) -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - - locked = true; - } -@@ -400,7 +400,7 @@ static s32 ixgbe_get_link_capabilities_82599(struct ixgbe_hw *hw, - break; - - default: -- return IXGBE_ERR_LINK_SETUP; -+ return -EIO; - } - - if (hw->phy.multispeed_fiber) { -@@ -541,7 +541,7 @@ static s32 ixgbe_start_mac_link_82599(struct ixgbe_hw *hw, - msleep(100); - } - if (!(links_reg & IXGBE_LINKS_KX_AN_COMP)) { -- status = IXGBE_ERR_AUTONEG_NOT_COMPLETE; -+ status = -EIO; - hw_dbg(hw, "Autoneg did not complete.\n"); - } - } -@@ -794,7 +794,7 @@ static s32 ixgbe_setup_mac_link_82599(struct ixgbe_hw *hw, - speed &= link_capabilities; - - if (speed == IXGBE_LINK_SPEED_UNKNOWN) -- return IXGBE_ERR_LINK_SETUP; -+ return -EINVAL; - - /* Use stored value (EEPROM defaults) of AUTOC to find KR/KX4 support*/ - if (hw->mac.orig_link_settings_stored) -@@ -861,8 +861,7 @@ static s32 ixgbe_setup_mac_link_82599(struct ixgbe_hw *hw, - msleep(100); - } - if (!(links_reg & IXGBE_LINKS_KX_AN_COMP)) { -- status = -- IXGBE_ERR_AUTONEG_NOT_COMPLETE; -+ status = -EIO; - hw_dbg(hw, "Autoneg did not complete.\n"); - } - } -@@ -927,7 +926,7 @@ static s32 ixgbe_reset_hw_82599(struct ixgbe_hw *hw) - /* Identify PHY and related function pointers */ - status = hw->phy.ops.init(hw); - -- if (status == IXGBE_ERR_SFP_NOT_SUPPORTED) -+ if (status == -EOPNOTSUPP) - return status; - - /* Setup SFP module if there is one present. */ -@@ -936,7 +935,7 @@ static s32 ixgbe_reset_hw_82599(struct ixgbe_hw *hw) - hw->phy.sfp_setup_needed = false; - } - -- if (status == IXGBE_ERR_SFP_NOT_SUPPORTED) -+ if (status == -EOPNOTSUPP) - return status; - - /* Reset PHY */ -@@ -974,7 +973,7 @@ static s32 ixgbe_reset_hw_82599(struct ixgbe_hw *hw) - } - - if (ctrl & IXGBE_CTRL_RST_MASK) { -- status = IXGBE_ERR_RESET_FAILED; -+ status = -EIO; - hw_dbg(hw, "Reset polling failed to complete.\n"); - } - -@@ -1093,7 +1092,7 @@ static s32 ixgbe_fdir_check_cmd_complete(struct ixgbe_hw *hw, u32 *fdircmd) - udelay(10); - } - -- return IXGBE_ERR_FDIR_CMD_INCOMPLETE; -+ return -EIO; - } - - /** -@@ -1155,7 +1154,7 @@ s32 ixgbe_reinit_fdir_tables_82599(struct ixgbe_hw *hw) - } - if (i >= IXGBE_FDIR_INIT_DONE_POLL) { - hw_dbg(hw, "Flow Director Signature poll time exceeded!\n"); -- return IXGBE_ERR_FDIR_REINIT_FAILED; -+ return -EIO; - } - - /* Clear FDIR statistics registers (read to clear) */ -@@ -1387,7 +1386,7 @@ s32 ixgbe_fdir_add_signature_filter_82599(struct ixgbe_hw *hw, - break; - default: - hw_dbg(hw, " Error on flow type input\n"); -- return IXGBE_ERR_CONFIG; -+ return -EIO; - } - - /* configure FDIRCMD register */ -@@ -1546,7 +1545,7 @@ s32 ixgbe_fdir_set_input_mask_82599(struct ixgbe_hw *hw, - break; - default: - hw_dbg(hw, " Error on vm pool mask\n"); -- return IXGBE_ERR_CONFIG; -+ return -EIO; - } - - switch (input_mask->formatted.flow_type & IXGBE_ATR_L4TYPE_MASK) { -@@ -1555,14 +1554,14 @@ s32 ixgbe_fdir_set_input_mask_82599(struct ixgbe_hw *hw, - if (input_mask->formatted.dst_port || - input_mask->formatted.src_port) { - hw_dbg(hw, " Error on src/dst port mask\n"); -- return IXGBE_ERR_CONFIG; -+ return -EIO; - } - break; - case IXGBE_ATR_L4TYPE_MASK: - break; - default: - hw_dbg(hw, " Error on flow type mask\n"); -- return IXGBE_ERR_CONFIG; -+ return -EIO; - } - - switch (ntohs(input_mask->formatted.vlan_id) & 0xEFFF) { -@@ -1583,7 +1582,7 @@ s32 ixgbe_fdir_set_input_mask_82599(struct ixgbe_hw *hw, - break; - default: - hw_dbg(hw, " Error on VLAN mask\n"); -- return IXGBE_ERR_CONFIG; -+ return -EIO; - } - - switch ((__force u16)input_mask->formatted.flex_bytes & 0xFFFF) { -@@ -1595,7 +1594,7 @@ s32 ixgbe_fdir_set_input_mask_82599(struct ixgbe_hw *hw, - break; - default: - hw_dbg(hw, " Error on flexible byte mask\n"); -- return IXGBE_ERR_CONFIG; -+ return -EIO; - } - - /* Now mask VM pool and destination IPv6 - bits 5 and 2 */ -@@ -1824,7 +1823,7 @@ static s32 ixgbe_identify_phy_82599(struct ixgbe_hw *hw) - - /* Return error if SFP module has been detected but is not supported */ - if (hw->phy.type == ixgbe_phy_sfp_unsupported) -- return IXGBE_ERR_SFP_NOT_SUPPORTED; -+ return -EOPNOTSUPP; - - return status; - } -@@ -1863,13 +1862,13 @@ static s32 ixgbe_enable_rx_dma_82599(struct ixgbe_hw *hw, u32 regval) - * Verifies that installed the firmware version is 0.6 or higher - * for SFI devices. All 82599 SFI devices should have version 0.6 or higher. - * -- * Returns IXGBE_ERR_EEPROM_VERSION if the FW is not present or -- * if the FW version is not supported. -+ * Return: -EACCES if the FW is not present or if the FW version is -+ * not supported. - **/ - static s32 ixgbe_verify_fw_version_82599(struct ixgbe_hw *hw) - { -- s32 status = IXGBE_ERR_EEPROM_VERSION; - u16 fw_offset, fw_ptp_cfg_offset; -+ s32 status = -EACCES; - u16 offset; - u16 fw_version = 0; - -@@ -1883,7 +1882,7 @@ static s32 ixgbe_verify_fw_version_82599(struct ixgbe_hw *hw) - goto fw_version_err; - - if (fw_offset == 0 || fw_offset == 0xFFFF) -- return IXGBE_ERR_EEPROM_VERSION; -+ return -EACCES; - - /* get the offset to the Pass Through Patch Configuration block */ - offset = fw_offset + IXGBE_FW_PASSTHROUGH_PATCH_CONFIG_PTR; -@@ -1891,7 +1890,7 @@ static s32 ixgbe_verify_fw_version_82599(struct ixgbe_hw *hw) - goto fw_version_err; - - if (fw_ptp_cfg_offset == 0 || fw_ptp_cfg_offset == 0xFFFF) -- return IXGBE_ERR_EEPROM_VERSION; -+ return -EACCES; - - /* get the firmware version */ - offset = fw_ptp_cfg_offset + IXGBE_FW_PATCH_VERSION_4; -@@ -1905,7 +1904,7 @@ static s32 ixgbe_verify_fw_version_82599(struct ixgbe_hw *hw) - - fw_version_err: - hw_err(hw, "eeprom read at offset %d failed\n", offset); -- return IXGBE_ERR_EEPROM_VERSION; -+ return -EACCES; - } - - /** -@@ -2038,7 +2037,7 @@ static s32 ixgbe_reset_pipeline_82599(struct ixgbe_hw *hw) - - if (!(anlp1_reg & IXGBE_ANLP1_AN_STATE_MASK)) { - hw_dbg(hw, "auto negotiation not completed\n"); -- ret_val = IXGBE_ERR_RESET_FAILED; -+ ret_val = -EIO; - goto reset_pipeline_out; - } - -@@ -2087,7 +2086,7 @@ static s32 ixgbe_read_i2c_byte_82599(struct ixgbe_hw *hw, u8 byte_offset, - - if (!timeout) { - hw_dbg(hw, "Driver can't access resource, acquiring I2C bus timeout.\n"); -- status = IXGBE_ERR_I2C; -+ status = -EIO; - goto release_i2c_access; - } - } -@@ -2141,7 +2140,7 @@ static s32 ixgbe_write_i2c_byte_82599(struct ixgbe_hw *hw, u8 byte_offset, - - if (!timeout) { - hw_dbg(hw, "Driver can't access resource, acquiring I2C bus timeout.\n"); -- status = IXGBE_ERR_I2C; -+ status = -EIO; - goto release_i2c_access; - } - } -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c -index 878dd8dff528..b2a0f2aaa05b 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c -@@ -124,7 +124,7 @@ s32 ixgbe_setup_fc_generic(struct ixgbe_hw *hw) - */ - if (hw->fc.strict_ieee && hw->fc.requested_mode == ixgbe_fc_rx_pause) { - hw_dbg(hw, "ixgbe_fc_rx_pause not valid in strict IEEE mode\n"); -- return IXGBE_ERR_INVALID_LINK_SETTINGS; -+ return -EINVAL; - } - - /* -@@ -215,7 +215,7 @@ s32 ixgbe_setup_fc_generic(struct ixgbe_hw *hw) - break; - default: - hw_dbg(hw, "Flow control param set incorrectly\n"); -- return IXGBE_ERR_CONFIG; -+ return -EIO; - } - - if (hw->mac.type != ixgbe_mac_X540) { -@@ -500,7 +500,7 @@ s32 ixgbe_read_pba_string_generic(struct ixgbe_hw *hw, u8 *pba_num, - - if (pba_num == NULL) { - hw_dbg(hw, "PBA string buffer was null\n"); -- return IXGBE_ERR_INVALID_ARGUMENT; -+ return -EINVAL; - } - - ret_val = hw->eeprom.ops.read(hw, IXGBE_PBANUM0_PTR, &data); -@@ -526,7 +526,7 @@ s32 ixgbe_read_pba_string_generic(struct ixgbe_hw *hw, u8 *pba_num, - /* we will need 11 characters to store the PBA */ - if (pba_num_size < 11) { - hw_dbg(hw, "PBA string buffer too small\n"); -- return IXGBE_ERR_NO_SPACE; -+ return -ENOSPC; - } - - /* extract hex string from data and pba_ptr */ -@@ -563,13 +563,13 @@ s32 ixgbe_read_pba_string_generic(struct ixgbe_hw *hw, u8 *pba_num, - - if (length == 0xFFFF || length == 0) { - hw_dbg(hw, "NVM PBA number section invalid length\n"); -- return IXGBE_ERR_PBA_SECTION; -+ return -EIO; - } - - /* check if pba_num buffer is big enough */ - if (pba_num_size < (((u32)length * 2) - 1)) { - hw_dbg(hw, "PBA string buffer too small\n"); -- return IXGBE_ERR_NO_SPACE; -+ return -ENOSPC; - } - - /* trim pba length from start of string */ -@@ -805,7 +805,7 @@ s32 ixgbe_led_on_generic(struct ixgbe_hw *hw, u32 index) - u32 led_reg = IXGBE_READ_REG(hw, IXGBE_LEDCTL); - - if (index > 3) -- return IXGBE_ERR_PARAM; -+ return -EINVAL; - - /* To turn on the LED, set mode to ON. */ - led_reg &= ~IXGBE_LED_MODE_MASK(index); -@@ -826,7 +826,7 @@ s32 ixgbe_led_off_generic(struct ixgbe_hw *hw, u32 index) - u32 led_reg = IXGBE_READ_REG(hw, IXGBE_LEDCTL); - - if (index > 3) -- return IXGBE_ERR_PARAM; -+ return -EINVAL; - - /* To turn off the LED, set mode to OFF. */ - led_reg &= ~IXGBE_LED_MODE_MASK(index); -@@ -904,11 +904,8 @@ s32 ixgbe_write_eeprom_buffer_bit_bang_generic(struct ixgbe_hw *hw, u16 offset, - - hw->eeprom.ops.init_params(hw); - -- if (words == 0) -- return IXGBE_ERR_INVALID_ARGUMENT; -- -- if (offset + words > hw->eeprom.word_size) -- return IXGBE_ERR_EEPROM; -+ if (words == 0 || (offset + words > hw->eeprom.word_size)) -+ return -EINVAL; - - /* - * The EEPROM page size cannot be queried from the chip. We do lazy -@@ -962,7 +959,7 @@ static s32 ixgbe_write_eeprom_buffer_bit_bang(struct ixgbe_hw *hw, u16 offset, - - if (ixgbe_ready_eeprom(hw) != 0) { - ixgbe_release_eeprom(hw); -- return IXGBE_ERR_EEPROM; -+ return -EIO; - } - - for (i = 0; i < words; i++) { -@@ -1028,7 +1025,7 @@ s32 ixgbe_write_eeprom_generic(struct ixgbe_hw *hw, u16 offset, u16 data) - hw->eeprom.ops.init_params(hw); - - if (offset >= hw->eeprom.word_size) -- return IXGBE_ERR_EEPROM; -+ return -EINVAL; - - return ixgbe_write_eeprom_buffer_bit_bang(hw, offset, 1, &data); - } -@@ -1050,11 +1047,8 @@ s32 ixgbe_read_eeprom_buffer_bit_bang_generic(struct ixgbe_hw *hw, u16 offset, - - hw->eeprom.ops.init_params(hw); - -- if (words == 0) -- return IXGBE_ERR_INVALID_ARGUMENT; -- -- if (offset + words > hw->eeprom.word_size) -- return IXGBE_ERR_EEPROM; -+ if (words == 0 || (offset + words > hw->eeprom.word_size)) -+ return -EINVAL; - - /* - * We cannot hold synchronization semaphores for too long -@@ -1099,7 +1093,7 @@ static s32 ixgbe_read_eeprom_buffer_bit_bang(struct ixgbe_hw *hw, u16 offset, - - if (ixgbe_ready_eeprom(hw) != 0) { - ixgbe_release_eeprom(hw); -- return IXGBE_ERR_EEPROM; -+ return -EIO; - } - - for (i = 0; i < words; i++) { -@@ -1142,7 +1136,7 @@ s32 ixgbe_read_eeprom_bit_bang_generic(struct ixgbe_hw *hw, u16 offset, - hw->eeprom.ops.init_params(hw); - - if (offset >= hw->eeprom.word_size) -- return IXGBE_ERR_EEPROM; -+ return -EINVAL; - - return ixgbe_read_eeprom_buffer_bit_bang(hw, offset, 1, data); - } -@@ -1165,11 +1159,8 @@ s32 ixgbe_read_eerd_buffer_generic(struct ixgbe_hw *hw, u16 offset, - - hw->eeprom.ops.init_params(hw); - -- if (words == 0) -- return IXGBE_ERR_INVALID_ARGUMENT; -- -- if (offset >= hw->eeprom.word_size) -- return IXGBE_ERR_EEPROM; -+ if (words == 0 || offset >= hw->eeprom.word_size) -+ return -EINVAL; - - for (i = 0; i < words; i++) { - eerd = ((offset + i) << IXGBE_EEPROM_RW_ADDR_SHIFT) | -@@ -1262,11 +1253,8 @@ s32 ixgbe_write_eewr_buffer_generic(struct ixgbe_hw *hw, u16 offset, - - hw->eeprom.ops.init_params(hw); - -- if (words == 0) -- return IXGBE_ERR_INVALID_ARGUMENT; -- -- if (offset >= hw->eeprom.word_size) -- return IXGBE_ERR_EEPROM; -+ if (words == 0 || offset >= hw->eeprom.word_size) -+ return -EINVAL; - - for (i = 0; i < words; i++) { - eewr = ((offset + i) << IXGBE_EEPROM_RW_ADDR_SHIFT) | -@@ -1328,7 +1316,7 @@ static s32 ixgbe_poll_eerd_eewr_done(struct ixgbe_hw *hw, u32 ee_reg) - } - udelay(5); - } -- return IXGBE_ERR_EEPROM; -+ return -EIO; - } - - /** -@@ -1344,7 +1332,7 @@ static s32 ixgbe_acquire_eeprom(struct ixgbe_hw *hw) - u32 i; - - if (hw->mac.ops.acquire_swfw_sync(hw, IXGBE_GSSR_EEP_SM) != 0) -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - - eec = IXGBE_READ_REG(hw, IXGBE_EEC(hw)); - -@@ -1366,7 +1354,7 @@ static s32 ixgbe_acquire_eeprom(struct ixgbe_hw *hw) - hw_dbg(hw, "Could not acquire EEPROM grant\n"); - - hw->mac.ops.release_swfw_sync(hw, IXGBE_GSSR_EEP_SM); -- return IXGBE_ERR_EEPROM; -+ return -EIO; - } - - /* Setup EEPROM for Read/Write */ -@@ -1419,7 +1407,7 @@ static s32 ixgbe_get_eeprom_semaphore(struct ixgbe_hw *hw) - swsm = IXGBE_READ_REG(hw, IXGBE_SWSM(hw)); - if (swsm & IXGBE_SWSM_SMBI) { - hw_dbg(hw, "Software semaphore SMBI between device drivers not granted.\n"); -- return IXGBE_ERR_EEPROM; -+ return -EIO; - } - } - -@@ -1447,7 +1435,7 @@ static s32 ixgbe_get_eeprom_semaphore(struct ixgbe_hw *hw) - if (i >= timeout) { - hw_dbg(hw, "SWESMBI Software EEPROM semaphore not granted.\n"); - ixgbe_release_eeprom_semaphore(hw); -- return IXGBE_ERR_EEPROM; -+ return -EIO; - } - - return 0; -@@ -1503,7 +1491,7 @@ static s32 ixgbe_ready_eeprom(struct ixgbe_hw *hw) - */ - if (i >= IXGBE_EEPROM_MAX_RETRY_SPI) { - hw_dbg(hw, "SPI EEPROM Status error\n"); -- return IXGBE_ERR_EEPROM; -+ return -EIO; - } - - return 0; -@@ -1715,7 +1703,7 @@ s32 ixgbe_calc_eeprom_checksum_generic(struct ixgbe_hw *hw) - for (i = IXGBE_PCIE_ANALOG_PTR; i < IXGBE_FW_PTR; i++) { - if (hw->eeprom.ops.read(hw, i, &pointer)) { - hw_dbg(hw, "EEPROM read failed\n"); -- return IXGBE_ERR_EEPROM; -+ return -EIO; - } - - /* If the pointer seems invalid */ -@@ -1724,7 +1712,7 @@ s32 ixgbe_calc_eeprom_checksum_generic(struct ixgbe_hw *hw) - - if (hw->eeprom.ops.read(hw, pointer, &length)) { - hw_dbg(hw, "EEPROM read failed\n"); -- return IXGBE_ERR_EEPROM; -+ return -EIO; - } - - if (length == 0xFFFF || length == 0) -@@ -1733,7 +1721,7 @@ s32 ixgbe_calc_eeprom_checksum_generic(struct ixgbe_hw *hw) - for (j = pointer + 1; j <= pointer + length; j++) { - if (hw->eeprom.ops.read(hw, j, &word)) { - hw_dbg(hw, "EEPROM read failed\n"); -- return IXGBE_ERR_EEPROM; -+ return -EIO; - } - checksum += word; - } -@@ -1786,7 +1774,7 @@ s32 ixgbe_validate_eeprom_checksum_generic(struct ixgbe_hw *hw, - * calculated checksum - */ - if (read_checksum != checksum) -- status = IXGBE_ERR_EEPROM_CHECKSUM; -+ status = -EIO; - - /* If the user cares, return the calculated checksum */ - if (checksum_val) -@@ -1845,7 +1833,7 @@ s32 ixgbe_set_rar_generic(struct ixgbe_hw *hw, u32 index, u8 *addr, u32 vmdq, - /* Make sure we are using a valid rar index range */ - if (index >= rar_entries) { - hw_dbg(hw, "RAR index %d is out of range.\n", index); -- return IXGBE_ERR_INVALID_ARGUMENT; -+ return -EINVAL; - } - - /* setup VMDq pool selection before this RAR gets enabled */ -@@ -1897,7 +1885,7 @@ s32 ixgbe_clear_rar_generic(struct ixgbe_hw *hw, u32 index) - /* Make sure we are using a valid rar index range */ - if (index >= rar_entries) { - hw_dbg(hw, "RAR index %d is out of range.\n", index); -- return IXGBE_ERR_INVALID_ARGUMENT; -+ return -EINVAL; - } - - /* -@@ -2146,7 +2134,7 @@ s32 ixgbe_fc_enable_generic(struct ixgbe_hw *hw) - - /* Validate the water mark configuration. */ - if (!hw->fc.pause_time) -- return IXGBE_ERR_INVALID_LINK_SETTINGS; -+ return -EINVAL; - - /* Low water mark of zero causes XOFF floods */ - for (i = 0; i < MAX_TRAFFIC_CLASS; i++) { -@@ -2155,7 +2143,7 @@ s32 ixgbe_fc_enable_generic(struct ixgbe_hw *hw) - if (!hw->fc.low_water[i] || - hw->fc.low_water[i] >= hw->fc.high_water[i]) { - hw_dbg(hw, "Invalid water mark configuration\n"); -- return IXGBE_ERR_INVALID_LINK_SETTINGS; -+ return -EINVAL; - } - } - } -@@ -2212,7 +2200,7 @@ s32 ixgbe_fc_enable_generic(struct ixgbe_hw *hw) - break; - default: - hw_dbg(hw, "Flow control param set incorrectly\n"); -- return IXGBE_ERR_CONFIG; -+ return -EIO; - } - - /* Set 802.3x based flow control settings. */ -@@ -2269,7 +2257,7 @@ s32 ixgbe_negotiate_fc(struct ixgbe_hw *hw, u32 adv_reg, u32 lp_reg, - u32 adv_sym, u32 adv_asm, u32 lp_sym, u32 lp_asm) - { - if ((!(adv_reg)) || (!(lp_reg))) -- return IXGBE_ERR_FC_NOT_NEGOTIATED; -+ return -EINVAL; - - if ((adv_reg & adv_sym) && (lp_reg & lp_sym)) { - /* -@@ -2321,7 +2309,7 @@ static s32 ixgbe_fc_autoneg_fiber(struct ixgbe_hw *hw) - linkstat = IXGBE_READ_REG(hw, IXGBE_PCS1GLSTA); - if ((!!(linkstat & IXGBE_PCS1GLSTA_AN_COMPLETE) == 0) || - (!!(linkstat & IXGBE_PCS1GLSTA_AN_TIMED_OUT) == 1)) -- return IXGBE_ERR_FC_NOT_NEGOTIATED; -+ return -EIO; - - pcs_anadv_reg = IXGBE_READ_REG(hw, IXGBE_PCS1GANA); - pcs_lpab_reg = IXGBE_READ_REG(hw, IXGBE_PCS1GANLP); -@@ -2353,12 +2341,12 @@ static s32 ixgbe_fc_autoneg_backplane(struct ixgbe_hw *hw) - */ - links = IXGBE_READ_REG(hw, IXGBE_LINKS); - if ((links & IXGBE_LINKS_KX_AN_COMP) == 0) -- return IXGBE_ERR_FC_NOT_NEGOTIATED; -+ return -EIO; - - if (hw->mac.type == ixgbe_mac_82599EB) { - links2 = IXGBE_READ_REG(hw, IXGBE_LINKS2); - if ((links2 & IXGBE_LINKS2_AN_SUPPORTED) == 0) -- return IXGBE_ERR_FC_NOT_NEGOTIATED; -+ return -EIO; - } - /* - * Read the 10g AN autoc and LP ability registers and resolve -@@ -2407,8 +2395,8 @@ static s32 ixgbe_fc_autoneg_copper(struct ixgbe_hw *hw) - **/ - void ixgbe_fc_autoneg(struct ixgbe_hw *hw) - { -- s32 ret_val = IXGBE_ERR_FC_NOT_NEGOTIATED; - ixgbe_link_speed speed; -+ s32 ret_val = -EIO; - bool link_up; - - /* -@@ -2510,7 +2498,7 @@ static u32 ixgbe_pcie_timeout_poll(struct ixgbe_hw *hw) - * @hw: pointer to hardware structure - * - * Disables PCI-Express primary access and verifies there are no pending -- * requests. IXGBE_ERR_PRIMARY_REQUESTS_PENDING is returned if primary disable -+ * requests. -EALREADY is returned if primary disable - * bit hasn't caused the primary requests to be disabled, else 0 - * is returned signifying primary requests disabled. - **/ -@@ -2575,7 +2563,7 @@ static s32 ixgbe_disable_pcie_primary(struct ixgbe_hw *hw) - } - - hw_dbg(hw, "PCIe transaction pending bit also did not clear.\n"); -- return IXGBE_ERR_PRIMARY_REQUESTS_PENDING; -+ return -EALREADY; - } - - /** -@@ -2600,7 +2588,7 @@ s32 ixgbe_acquire_swfw_sync(struct ixgbe_hw *hw, u32 mask) - * SW_FW_SYNC bits (not just NVM) - */ - if (ixgbe_get_eeprom_semaphore(hw)) -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - - gssr = IXGBE_READ_REG(hw, IXGBE_GSSR); - if (!(gssr & (fwmask | swmask))) { -@@ -2620,7 +2608,7 @@ s32 ixgbe_acquire_swfw_sync(struct ixgbe_hw *hw, u32 mask) - ixgbe_release_swfw_sync(hw, gssr & (fwmask | swmask)); - - usleep_range(5000, 10000); -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - } - - /** -@@ -2757,7 +2745,7 @@ s32 ixgbe_blink_led_start_generic(struct ixgbe_hw *hw, u32 index) - s32 ret_val; - - if (index > 3) -- return IXGBE_ERR_PARAM; -+ return -EINVAL; - - /* - * Link must be up to auto-blink the LEDs; -@@ -2803,7 +2791,7 @@ s32 ixgbe_blink_led_stop_generic(struct ixgbe_hw *hw, u32 index) - s32 ret_val; - - if (index > 3) -- return IXGBE_ERR_PARAM; -+ return -EINVAL; - - ret_val = hw->mac.ops.prot_autoc_read(hw, &locked, &autoc_reg); - if (ret_val) -@@ -2963,7 +2951,7 @@ s32 ixgbe_clear_vmdq_generic(struct ixgbe_hw *hw, u32 rar, u32 vmdq) - /* Make sure we are using a valid rar index range */ - if (rar >= rar_entries) { - hw_dbg(hw, "RAR index %d is out of range.\n", rar); -- return IXGBE_ERR_INVALID_ARGUMENT; -+ return -EINVAL; - } - - mpsar_lo = IXGBE_READ_REG(hw, IXGBE_MPSAR_LO(rar)); -@@ -3014,7 +3002,7 @@ s32 ixgbe_set_vmdq_generic(struct ixgbe_hw *hw, u32 rar, u32 vmdq) - /* Make sure we are using a valid rar index range */ - if (rar >= rar_entries) { - hw_dbg(hw, "RAR index %d is out of range.\n", rar); -- return IXGBE_ERR_INVALID_ARGUMENT; -+ return -EINVAL; - } - - if (vmdq < 32) { -@@ -3091,7 +3079,7 @@ static s32 ixgbe_find_vlvf_slot(struct ixgbe_hw *hw, u32 vlan, bool vlvf_bypass) - * will simply bypass the VLVF if there are no entries present in the - * VLVF that contain our VLAN - */ -- first_empty_slot = vlvf_bypass ? IXGBE_ERR_NO_SPACE : 0; -+ first_empty_slot = vlvf_bypass ? -ENOSPC : 0; - - /* add VLAN enable bit for comparison */ - vlan |= IXGBE_VLVF_VIEN; -@@ -3115,7 +3103,7 @@ static s32 ixgbe_find_vlvf_slot(struct ixgbe_hw *hw, u32 vlan, bool vlvf_bypass) - if (!first_empty_slot) - hw_dbg(hw, "No space in VLVF.\n"); - -- return first_empty_slot ? : IXGBE_ERR_NO_SPACE; -+ return first_empty_slot ? : -ENOSPC; - } - - /** -@@ -3135,7 +3123,7 @@ s32 ixgbe_set_vfta_generic(struct ixgbe_hw *hw, u32 vlan, u32 vind, - s32 vlvf_index; - - if ((vlan > 4095) || (vind > 63)) -- return IXGBE_ERR_PARAM; -+ return -EINVAL; - - /* - * this is a 2 part operation - first the VFTA, then the -@@ -3611,7 +3599,8 @@ u8 ixgbe_calculate_checksum(u8 *buffer, u32 length) - * - * Communicates with the manageability block. On success return 0 - * else returns semaphore error when encountering an error acquiring -- * semaphore or IXGBE_ERR_HOST_INTERFACE_COMMAND when command fails. -+ * semaphore, -EINVAL when incorrect parameters passed or -EIO when -+ * command fails. - * - * This function assumes that the IXGBE_GSSR_SW_MNG_SM semaphore is held - * by the caller. -@@ -3624,7 +3613,7 @@ s32 ixgbe_hic_unlocked(struct ixgbe_hw *hw, u32 *buffer, u32 length, - - if (!length || length > IXGBE_HI_MAX_BLOCK_BYTE_LENGTH) { - hw_dbg(hw, "Buffer length failure buffersize-%d.\n", length); -- return IXGBE_ERR_HOST_INTERFACE_COMMAND; -+ return -EINVAL; - } - - /* Set bit 9 of FWSTS clearing FW reset indication */ -@@ -3635,13 +3624,13 @@ s32 ixgbe_hic_unlocked(struct ixgbe_hw *hw, u32 *buffer, u32 length, - hicr = IXGBE_READ_REG(hw, IXGBE_HICR); - if (!(hicr & IXGBE_HICR_EN)) { - hw_dbg(hw, "IXGBE_HOST_EN bit disabled.\n"); -- return IXGBE_ERR_HOST_INTERFACE_COMMAND; -+ return -EIO; - } - - /* Calculate length in DWORDs. We must be DWORD aligned */ - if (length % sizeof(u32)) { - hw_dbg(hw, "Buffer length failure, not aligned to dword"); -- return IXGBE_ERR_INVALID_ARGUMENT; -+ return -EINVAL; - } - - dword_len = length >> 2; -@@ -3666,7 +3655,7 @@ s32 ixgbe_hic_unlocked(struct ixgbe_hw *hw, u32 *buffer, u32 length, - /* Check command successful completion. */ - if ((timeout && i == timeout) || - !(IXGBE_READ_REG(hw, IXGBE_HICR) & IXGBE_HICR_SV)) -- return IXGBE_ERR_HOST_INTERFACE_COMMAND; -+ return -EIO; - - return 0; - } -@@ -3686,7 +3675,7 @@ s32 ixgbe_hic_unlocked(struct ixgbe_hw *hw, u32 *buffer, u32 length, - * in these cases. - * - * Communicates with the manageability block. On success return 0 -- * else return IXGBE_ERR_HOST_INTERFACE_COMMAND. -+ * else return -EIO or -EINVAL. - **/ - s32 ixgbe_host_interface_command(struct ixgbe_hw *hw, void *buffer, - u32 length, u32 timeout, -@@ -3701,7 +3690,7 @@ s32 ixgbe_host_interface_command(struct ixgbe_hw *hw, void *buffer, - - if (!length || length > IXGBE_HI_MAX_BLOCK_BYTE_LENGTH) { - hw_dbg(hw, "Buffer length failure buffersize-%d.\n", length); -- return IXGBE_ERR_HOST_INTERFACE_COMMAND; -+ return -EINVAL; - } - /* Take management host interface semaphore */ - status = hw->mac.ops.acquire_swfw_sync(hw, IXGBE_GSSR_SW_MNG_SM); -@@ -3731,7 +3720,7 @@ s32 ixgbe_host_interface_command(struct ixgbe_hw *hw, void *buffer, - - if (length < round_up(buf_len, 4) + hdr_size) { - hw_dbg(hw, "Buffer not large enough for reply message.\n"); -- status = IXGBE_ERR_HOST_INTERFACE_COMMAND; -+ status = -EIO; - goto rel_out; - } - -@@ -3762,8 +3751,8 @@ s32 ixgbe_host_interface_command(struct ixgbe_hw *hw, void *buffer, - * - * Sends driver version number to firmware through the manageability - * block. On success return 0 -- * else returns IXGBE_ERR_SWFW_SYNC when encountering an error acquiring -- * semaphore or IXGBE_ERR_HOST_INTERFACE_COMMAND when command fails. -+ * else returns -EBUSY when encountering an error acquiring -+ * semaphore or -EIO when command fails. - **/ - s32 ixgbe_set_fw_drv_ver_generic(struct ixgbe_hw *hw, u8 maj, u8 min, - u8 build, u8 sub, __always_unused u16 len, -@@ -3799,7 +3788,7 @@ s32 ixgbe_set_fw_drv_ver_generic(struct ixgbe_hw *hw, u8 maj, u8 min, - FW_CEM_RESP_STATUS_SUCCESS) - ret_val = 0; - else -- ret_val = IXGBE_ERR_HOST_INTERFACE_COMMAND; -+ ret_val = -EIO; - - break; - } -@@ -3897,14 +3886,14 @@ static s32 ixgbe_get_ets_data(struct ixgbe_hw *hw, u16 *ets_cfg, - return status; - - if ((*ets_offset == 0x0000) || (*ets_offset == 0xFFFF)) -- return IXGBE_NOT_IMPLEMENTED; -+ return -EOPNOTSUPP; - - status = hw->eeprom.ops.read(hw, *ets_offset, ets_cfg); - if (status) - return status; - - if ((*ets_cfg & IXGBE_ETS_TYPE_MASK) != IXGBE_ETS_TYPE_EMC_SHIFTED) -- return IXGBE_NOT_IMPLEMENTED; -+ return -EOPNOTSUPP; - - return 0; - } -@@ -3927,7 +3916,7 @@ s32 ixgbe_get_thermal_sensor_data_generic(struct ixgbe_hw *hw) - - /* Only support thermal sensors attached to physical port 0 */ - if ((IXGBE_READ_REG(hw, IXGBE_STATUS) & IXGBE_STATUS_LAN_ID_1)) -- return IXGBE_NOT_IMPLEMENTED; -+ return -EOPNOTSUPP; - - status = ixgbe_get_ets_data(hw, &ets_cfg, &ets_offset); - if (status) -@@ -3987,7 +3976,7 @@ s32 ixgbe_init_thermal_sensor_thresh_generic(struct ixgbe_hw *hw) - - /* Only support thermal sensors attached to physical port 0 */ - if ((IXGBE_READ_REG(hw, IXGBE_STATUS) & IXGBE_STATUS_LAN_ID_1)) -- return IXGBE_NOT_IMPLEMENTED; -+ return -EOPNOTSUPP; - - status = ixgbe_get_ets_data(hw, &ets_cfg, &ets_offset); - if (status) -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c -index 4dd897806fa5..e47461f3eaef 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c -@@ -3370,7 +3370,7 @@ static int ixgbe_get_module_eeprom(struct net_device *dev, - { - struct ixgbe_adapter *adapter = netdev_priv(dev); - struct ixgbe_hw *hw = &adapter->hw; -- s32 status = IXGBE_ERR_PHY_ADDR_INVALID; -+ s32 status = -EFAULT; - u8 databyte = 0xFF; - int i = 0; - -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -index 94bde2cad0f4..d9af3fcfe625 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -@@ -5512,7 +5512,7 @@ static int ixgbe_non_sfp_link_config(struct ixgbe_hw *hw) - { - u32 speed; - bool autoneg, link_up = false; -- int ret = IXGBE_ERR_LINK_SETUP; -+ int ret = -EIO; - - if (hw->mac.ops.check_link) - ret = hw->mac.ops.check_link(hw, &speed, &link_up, false); -@@ -5983,13 +5983,13 @@ void ixgbe_reset(struct ixgbe_adapter *adapter) - err = hw->mac.ops.init_hw(hw); - switch (err) { - case 0: -- case IXGBE_ERR_SFP_NOT_PRESENT: -- case IXGBE_ERR_SFP_NOT_SUPPORTED: -+ case -ENOENT: -+ case -EOPNOTSUPP: - break; -- case IXGBE_ERR_PRIMARY_REQUESTS_PENDING: -+ case -EALREADY: - e_dev_err("primary disable timed out\n"); - break; -- case IXGBE_ERR_EEPROM_VERSION: -+ case -EACCES: - /* We are running on a pre-production device, log a warning */ - e_dev_warn("This device is a pre-production adapter/LOM. " - "Please be aware there may be issues associated with " -@@ -7829,10 +7829,10 @@ static void ixgbe_sfp_detection_subtask(struct ixgbe_adapter *adapter) - adapter->sfp_poll_time = jiffies + IXGBE_SFP_POLL_JIFFIES - 1; - - err = hw->phy.ops.identify_sfp(hw); -- if (err == IXGBE_ERR_SFP_NOT_SUPPORTED) -+ if (err == -EOPNOTSUPP) - goto sfp_out; - -- if (err == IXGBE_ERR_SFP_NOT_PRESENT) { -+ if (err == -ENOENT) { - /* If no cable is present, then we need to reset - * the next time we find a good cable. */ - adapter->flags2 |= IXGBE_FLAG2_SFP_NEEDS_RESET; -@@ -7858,7 +7858,7 @@ static void ixgbe_sfp_detection_subtask(struct ixgbe_adapter *adapter) - else - err = hw->mac.ops.setup_sfp(hw); - -- if (err == IXGBE_ERR_SFP_NOT_SUPPORTED) -+ if (err == -EOPNOTSUPP) - goto sfp_out; - - adapter->flags |= IXGBE_FLAG_NEED_LINK_CONFIG; -@@ -7867,8 +7867,8 @@ static void ixgbe_sfp_detection_subtask(struct ixgbe_adapter *adapter) - sfp_out: - clear_bit(__IXGBE_IN_SFP_INIT, &adapter->state); - -- if ((err == IXGBE_ERR_SFP_NOT_SUPPORTED) && -- (adapter->netdev->reg_state == NETREG_REGISTERED)) { -+ if (err == -EOPNOTSUPP && -+ adapter->netdev->reg_state == NETREG_REGISTERED) { - e_dev_err("failed to initialize because an unsupported " - "SFP+ module type was detected.\n"); - e_dev_err("Reload the driver after installing a " -@@ -10922,9 +10922,9 @@ static int ixgbe_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - err = hw->mac.ops.reset_hw(hw); - hw->phy.reset_if_overtemp = false; - ixgbe_set_eee_capable(adapter); -- if (err == IXGBE_ERR_SFP_NOT_PRESENT) { -+ if (err == -ENOENT) { - err = 0; -- } else if (err == IXGBE_ERR_SFP_NOT_SUPPORTED) { -+ } else if (err == -EOPNOTSUPP) { - e_dev_err("failed to load because an unsupported SFP+ or QSFP module type was detected.\n"); - e_dev_err("Reload the driver after installing a supported module.\n"); - goto err_sw_init; -@@ -11143,7 +11143,7 @@ static int ixgbe_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - - /* reset the hardware with the new settings */ - err = hw->mac.ops.start_hw(hw); -- if (err == IXGBE_ERR_EEPROM_VERSION) { -+ if (err == -EACCES) { - /* We are running on a pre-production device, log a warning */ - e_dev_warn("This device is a pre-production adapter/LOM. " - "Please be aware there may be issues associated " -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.c -index 5679293e53f7..fe7ef5773369 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.c -@@ -24,7 +24,7 @@ s32 ixgbe_read_mbx(struct ixgbe_hw *hw, u32 *msg, u16 size, u16 mbx_id) - size = mbx->size; - - if (!mbx->ops) -- return IXGBE_ERR_MBX; -+ return -EIO; - - return mbx->ops->read(hw, msg, size, mbx_id); - } -@@ -43,10 +43,10 @@ s32 ixgbe_write_mbx(struct ixgbe_hw *hw, u32 *msg, u16 size, u16 mbx_id) - struct ixgbe_mbx_info *mbx = &hw->mbx; - - if (size > mbx->size) -- return IXGBE_ERR_MBX; -+ return -EINVAL; - - if (!mbx->ops) -- return IXGBE_ERR_MBX; -+ return -EIO; - - return mbx->ops->write(hw, msg, size, mbx_id); - } -@@ -63,7 +63,7 @@ s32 ixgbe_check_for_msg(struct ixgbe_hw *hw, u16 mbx_id) - struct ixgbe_mbx_info *mbx = &hw->mbx; - - if (!mbx->ops) -- return IXGBE_ERR_MBX; -+ return -EIO; - - return mbx->ops->check_for_msg(hw, mbx_id); - } -@@ -80,7 +80,7 @@ s32 ixgbe_check_for_ack(struct ixgbe_hw *hw, u16 mbx_id) - struct ixgbe_mbx_info *mbx = &hw->mbx; - - if (!mbx->ops) -- return IXGBE_ERR_MBX; -+ return -EIO; - - return mbx->ops->check_for_ack(hw, mbx_id); - } -@@ -97,7 +97,7 @@ s32 ixgbe_check_for_rst(struct ixgbe_hw *hw, u16 mbx_id) - struct ixgbe_mbx_info *mbx = &hw->mbx; - - if (!mbx->ops) -- return IXGBE_ERR_MBX; -+ return -EIO; - - return mbx->ops->check_for_rst(hw, mbx_id); - } -@@ -115,12 +115,12 @@ static s32 ixgbe_poll_for_msg(struct ixgbe_hw *hw, u16 mbx_id) - int countdown = mbx->timeout; - - if (!countdown || !mbx->ops) -- return IXGBE_ERR_MBX; -+ return -EIO; - - while (mbx->ops->check_for_msg(hw, mbx_id)) { - countdown--; - if (!countdown) -- return IXGBE_ERR_MBX; -+ return -EIO; - udelay(mbx->usec_delay); - } - -@@ -140,12 +140,12 @@ static s32 ixgbe_poll_for_ack(struct ixgbe_hw *hw, u16 mbx_id) - int countdown = mbx->timeout; - - if (!countdown || !mbx->ops) -- return IXGBE_ERR_MBX; -+ return -EIO; - - while (mbx->ops->check_for_ack(hw, mbx_id)) { - countdown--; - if (!countdown) -- return IXGBE_ERR_MBX; -+ return -EIO; - udelay(mbx->usec_delay); - } - -@@ -169,7 +169,7 @@ static s32 ixgbe_read_posted_mbx(struct ixgbe_hw *hw, u32 *msg, u16 size, - s32 ret_val; - - if (!mbx->ops) -- return IXGBE_ERR_MBX; -+ return -EIO; - - ret_val = ixgbe_poll_for_msg(hw, mbx_id); - if (ret_val) -@@ -197,7 +197,7 @@ static s32 ixgbe_write_posted_mbx(struct ixgbe_hw *hw, u32 *msg, u16 size, - - /* exit if either we can't write or there isn't a defined timeout */ - if (!mbx->ops || !mbx->timeout) -- return IXGBE_ERR_MBX; -+ return -EIO; - - /* send msg */ - ret_val = mbx->ops->write(hw, msg, size, mbx_id); -@@ -217,7 +217,7 @@ static s32 ixgbe_check_for_bit_pf(struct ixgbe_hw *hw, u32 mask, s32 index) - return 0; - } - -- return IXGBE_ERR_MBX; -+ return -EIO; - } - - /** -@@ -238,7 +238,7 @@ static s32 ixgbe_check_for_msg_pf(struct ixgbe_hw *hw, u16 vf_number) - return 0; - } - -- return IXGBE_ERR_MBX; -+ return -EIO; - } - - /** -@@ -259,7 +259,7 @@ static s32 ixgbe_check_for_ack_pf(struct ixgbe_hw *hw, u16 vf_number) - return 0; - } - -- return IXGBE_ERR_MBX; -+ return -EIO; - } - - /** -@@ -295,7 +295,7 @@ static s32 ixgbe_check_for_rst_pf(struct ixgbe_hw *hw, u16 vf_number) - return 0; - } - -- return IXGBE_ERR_MBX; -+ return -EIO; - } - - /** -@@ -317,7 +317,7 @@ static s32 ixgbe_obtain_mbx_lock_pf(struct ixgbe_hw *hw, u16 vf_number) - if (p2v_mailbox & IXGBE_PFMAILBOX_PFU) - return 0; - -- return IXGBE_ERR_MBX; -+ return -EIO; - } - - /** -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h -index 8f4316b19278..6434c190e7a4 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h -@@ -7,7 +7,6 @@ - #include "ixgbe_type.h" - - #define IXGBE_VFMAILBOX_SIZE 16 /* 16 32 bit words - 64 bytes */ --#define IXGBE_ERR_MBX -100 - - #define IXGBE_VFMAILBOX 0x002FC - #define IXGBE_VFMBMEM 0x00200 -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c -index 689470c1e8ad..7c0a1a0a5eda 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c -@@ -102,7 +102,7 @@ s32 ixgbe_read_i2c_combined_generic_int(struct ixgbe_hw *hw, u8 addr, - csum = ~csum; - do { - if (lock && hw->mac.ops.acquire_swfw_sync(hw, swfw_mask)) -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - ixgbe_i2c_start(hw); - /* Device Address and write indication */ - if (ixgbe_out_i2c_byte_ack(hw, addr)) -@@ -150,7 +150,7 @@ s32 ixgbe_read_i2c_combined_generic_int(struct ixgbe_hw *hw, u8 addr, - hw_dbg(hw, "I2C byte read combined error.\n"); - } while (retry < max_retry); - -- return IXGBE_ERR_I2C; -+ return -EIO; - } - - /** -@@ -179,7 +179,7 @@ s32 ixgbe_write_i2c_combined_generic_int(struct ixgbe_hw *hw, u8 addr, - csum = ~csum; - do { - if (lock && hw->mac.ops.acquire_swfw_sync(hw, swfw_mask)) -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - ixgbe_i2c_start(hw); - /* Device Address and write indication */ - if (ixgbe_out_i2c_byte_ack(hw, addr)) -@@ -215,7 +215,7 @@ s32 ixgbe_write_i2c_combined_generic_int(struct ixgbe_hw *hw, u8 addr, - hw_dbg(hw, "I2C byte write combined error.\n"); - } while (retry < max_retry); - -- return IXGBE_ERR_I2C; -+ return -EIO; - } - - /** -@@ -262,8 +262,8 @@ static bool ixgbe_probe_phy(struct ixgbe_hw *hw, u16 phy_addr) - **/ - s32 ixgbe_identify_phy_generic(struct ixgbe_hw *hw) - { -+ u32 status = -EFAULT; - u32 phy_addr; -- u32 status = IXGBE_ERR_PHY_ADDR_INVALID; - - if (!hw->phy.phy_semaphore_mask) { - if (hw->bus.lan_id) -@@ -282,7 +282,7 @@ s32 ixgbe_identify_phy_generic(struct ixgbe_hw *hw) - if (ixgbe_probe_phy(hw, phy_addr)) - return 0; - else -- return IXGBE_ERR_PHY_ADDR_INVALID; -+ return -EFAULT; - } - - for (phy_addr = 0; phy_addr < IXGBE_MAX_PHY_ADDR; phy_addr++) { -@@ -457,7 +457,7 @@ s32 ixgbe_reset_phy_generic(struct ixgbe_hw *hw) - - if (ctrl & MDIO_CTRL1_RESET) { - hw_dbg(hw, "PHY reset polling failed to complete.\n"); -- return IXGBE_ERR_RESET_FAILED; -+ return -EIO; - } - - return 0; -@@ -500,7 +500,7 @@ s32 ixgbe_read_phy_reg_mdi(struct ixgbe_hw *hw, u32 reg_addr, u32 device_type, - - if ((command & IXGBE_MSCA_MDI_COMMAND) != 0) { - hw_dbg(hw, "PHY address command did not complete.\n"); -- return IXGBE_ERR_PHY; -+ return -EIO; - } - - /* Address cycle complete, setup and write the read -@@ -527,7 +527,7 @@ s32 ixgbe_read_phy_reg_mdi(struct ixgbe_hw *hw, u32 reg_addr, u32 device_type, - - if ((command & IXGBE_MSCA_MDI_COMMAND) != 0) { - hw_dbg(hw, "PHY read command didn't complete\n"); -- return IXGBE_ERR_PHY; -+ return -EIO; - } - - /* Read operation is complete. Get the data -@@ -559,7 +559,7 @@ s32 ixgbe_read_phy_reg_generic(struct ixgbe_hw *hw, u32 reg_addr, - phy_data); - hw->mac.ops.release_swfw_sync(hw, gssr); - } else { -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - } - - return status; -@@ -604,7 +604,7 @@ s32 ixgbe_write_phy_reg_mdi(struct ixgbe_hw *hw, u32 reg_addr, - - if ((command & IXGBE_MSCA_MDI_COMMAND) != 0) { - hw_dbg(hw, "PHY address cmd didn't complete\n"); -- return IXGBE_ERR_PHY; -+ return -EIO; - } - - /* -@@ -632,7 +632,7 @@ s32 ixgbe_write_phy_reg_mdi(struct ixgbe_hw *hw, u32 reg_addr, - - if ((command & IXGBE_MSCA_MDI_COMMAND) != 0) { - hw_dbg(hw, "PHY write cmd didn't complete\n"); -- return IXGBE_ERR_PHY; -+ return -EIO; - } - - return 0; -@@ -657,7 +657,7 @@ s32 ixgbe_write_phy_reg_generic(struct ixgbe_hw *hw, u32 reg_addr, - phy_data); - hw->mac.ops.release_swfw_sync(hw, gssr); - } else { -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - } - - return status; -@@ -1430,7 +1430,7 @@ s32 ixgbe_reset_phy_nl(struct ixgbe_hw *hw) - - if ((phy_data & MDIO_CTRL1_RESET) != 0) { - hw_dbg(hw, "PHY reset did not complete.\n"); -- return IXGBE_ERR_PHY; -+ return -EIO; - } - - /* Get init offsets */ -@@ -1487,12 +1487,12 @@ s32 ixgbe_reset_phy_nl(struct ixgbe_hw *hw) - hw_dbg(hw, "SOL\n"); - } else { - hw_dbg(hw, "Bad control value\n"); -- return IXGBE_ERR_PHY; -+ return -EIO; - } - break; - default: - hw_dbg(hw, "Bad control type\n"); -- return IXGBE_ERR_PHY; -+ return -EIO; - } - } - -@@ -1500,7 +1500,7 @@ s32 ixgbe_reset_phy_nl(struct ixgbe_hw *hw) - - err_eeprom: - hw_err(hw, "eeprom read at offset %d failed\n", data_offset); -- return IXGBE_ERR_PHY; -+ return -EIO; - } - - /** -@@ -1518,10 +1518,10 @@ s32 ixgbe_identify_module_generic(struct ixgbe_hw *hw) - return ixgbe_identify_qsfp_module_generic(hw); - default: - hw->phy.sfp_type = ixgbe_sfp_type_not_present; -- return IXGBE_ERR_SFP_NOT_PRESENT; -+ return -ENOENT; - } - -- return IXGBE_ERR_SFP_NOT_PRESENT; -+ return -ENOENT; - } - - /** -@@ -1546,7 +1546,7 @@ s32 ixgbe_identify_sfp_module_generic(struct ixgbe_hw *hw) - - if (hw->mac.ops.get_media_type(hw) != ixgbe_media_type_fiber) { - hw->phy.sfp_type = ixgbe_sfp_type_not_present; -- return IXGBE_ERR_SFP_NOT_PRESENT; -+ return -ENOENT; - } - - /* LAN ID is needed for sfp_type determination */ -@@ -1561,7 +1561,7 @@ s32 ixgbe_identify_sfp_module_generic(struct ixgbe_hw *hw) - - if (identifier != IXGBE_SFF_IDENTIFIER_SFP) { - hw->phy.type = ixgbe_phy_sfp_unsupported; -- return IXGBE_ERR_SFP_NOT_SUPPORTED; -+ return -EOPNOTSUPP; - } - status = hw->phy.ops.read_i2c_eeprom(hw, - IXGBE_SFF_1GBE_COMP_CODES, -@@ -1752,7 +1752,7 @@ s32 ixgbe_identify_sfp_module_generic(struct ixgbe_hw *hw) - hw->phy.sfp_type == ixgbe_sfp_type_1g_sx_core0 || - hw->phy.sfp_type == ixgbe_sfp_type_1g_sx_core1)) { - hw->phy.type = ixgbe_phy_sfp_unsupported; -- return IXGBE_ERR_SFP_NOT_SUPPORTED; -+ return -EOPNOTSUPP; - } - - /* Anything else 82598-based is supported */ -@@ -1776,7 +1776,7 @@ s32 ixgbe_identify_sfp_module_generic(struct ixgbe_hw *hw) - } - hw_dbg(hw, "SFP+ module not supported\n"); - hw->phy.type = ixgbe_phy_sfp_unsupported; -- return IXGBE_ERR_SFP_NOT_SUPPORTED; -+ return -EOPNOTSUPP; - } - return 0; - -@@ -1786,7 +1786,7 @@ s32 ixgbe_identify_sfp_module_generic(struct ixgbe_hw *hw) - hw->phy.id = 0; - hw->phy.type = ixgbe_phy_unknown; - } -- return IXGBE_ERR_SFP_NOT_PRESENT; -+ return -ENOENT; - } - - /** -@@ -1813,7 +1813,7 @@ static s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw) - - if (hw->mac.ops.get_media_type(hw) != ixgbe_media_type_fiber_qsfp) { - hw->phy.sfp_type = ixgbe_sfp_type_not_present; -- return IXGBE_ERR_SFP_NOT_PRESENT; -+ return -ENOENT; - } - - /* LAN ID is needed for sfp_type determination */ -@@ -1827,7 +1827,7 @@ static s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw) - - if (identifier != IXGBE_SFF_IDENTIFIER_QSFP_PLUS) { - hw->phy.type = ixgbe_phy_sfp_unsupported; -- return IXGBE_ERR_SFP_NOT_SUPPORTED; -+ return -EOPNOTSUPP; - } - - hw->phy.id = identifier; -@@ -1895,7 +1895,7 @@ static s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw) - } else { - /* unsupported module type */ - hw->phy.type = ixgbe_phy_sfp_unsupported; -- return IXGBE_ERR_SFP_NOT_SUPPORTED; -+ return -EOPNOTSUPP; - } - } - -@@ -1955,7 +1955,7 @@ static s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw) - } - hw_dbg(hw, "QSFP module not supported\n"); - hw->phy.type = ixgbe_phy_sfp_unsupported; -- return IXGBE_ERR_SFP_NOT_SUPPORTED; -+ return -EOPNOTSUPP; - } - return 0; - } -@@ -1966,7 +1966,7 @@ static s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw) - hw->phy.id = 0; - hw->phy.type = ixgbe_phy_unknown; - -- return IXGBE_ERR_SFP_NOT_PRESENT; -+ return -ENOENT; - } - - /** -@@ -1986,14 +1986,14 @@ s32 ixgbe_get_sfp_init_sequence_offsets(struct ixgbe_hw *hw, - u16 sfp_type = hw->phy.sfp_type; - - if (hw->phy.sfp_type == ixgbe_sfp_type_unknown) -- return IXGBE_ERR_SFP_NOT_SUPPORTED; -+ return -EOPNOTSUPP; - - if (hw->phy.sfp_type == ixgbe_sfp_type_not_present) -- return IXGBE_ERR_SFP_NOT_PRESENT; -+ return -ENOENT; - - if ((hw->device_id == IXGBE_DEV_ID_82598_SR_DUAL_PORT_EM) && - (hw->phy.sfp_type == ixgbe_sfp_type_da_cu)) -- return IXGBE_ERR_SFP_NOT_SUPPORTED; -+ return -EOPNOTSUPP; - - /* - * Limiting active cables and 1G Phys must be initialized as -@@ -2014,11 +2014,11 @@ s32 ixgbe_get_sfp_init_sequence_offsets(struct ixgbe_hw *hw, - if (hw->eeprom.ops.read(hw, IXGBE_PHY_INIT_OFFSET_NL, list_offset)) { - hw_err(hw, "eeprom read at %d failed\n", - IXGBE_PHY_INIT_OFFSET_NL); -- return IXGBE_ERR_SFP_NO_INIT_SEQ_PRESENT; -+ return -EIO; - } - - if ((!*list_offset) || (*list_offset == 0xFFFF)) -- return IXGBE_ERR_SFP_NO_INIT_SEQ_PRESENT; -+ return -EIO; - - /* Shift offset to first ID word */ - (*list_offset)++; -@@ -2037,7 +2037,7 @@ s32 ixgbe_get_sfp_init_sequence_offsets(struct ixgbe_hw *hw, - goto err_phy; - if ((!*data_offset) || (*data_offset == 0xFFFF)) { - hw_dbg(hw, "SFP+ module not supported\n"); -- return IXGBE_ERR_SFP_NOT_SUPPORTED; -+ return -EOPNOTSUPP; - } else { - break; - } -@@ -2050,14 +2050,14 @@ s32 ixgbe_get_sfp_init_sequence_offsets(struct ixgbe_hw *hw, - - if (sfp_id == IXGBE_PHY_INIT_END_NL) { - hw_dbg(hw, "No matching SFP+ module found\n"); -- return IXGBE_ERR_SFP_NOT_SUPPORTED; -+ return -EOPNOTSUPP; - } - - return 0; - - err_phy: - hw_err(hw, "eeprom read at offset %d failed\n", *list_offset); -- return IXGBE_ERR_PHY; -+ return -EIO; - } - - /** -@@ -2152,7 +2152,7 @@ static s32 ixgbe_read_i2c_byte_generic_int(struct ixgbe_hw *hw, u8 byte_offset, - - do { - if (lock && hw->mac.ops.acquire_swfw_sync(hw, swfw_mask)) -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - - ixgbe_i2c_start(hw); - -@@ -2268,7 +2268,7 @@ static s32 ixgbe_write_i2c_byte_generic_int(struct ixgbe_hw *hw, u8 byte_offset, - u32 swfw_mask = hw->phy.phy_semaphore_mask; - - if (lock && hw->mac.ops.acquire_swfw_sync(hw, swfw_mask)) -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - - do { - ixgbe_i2c_start(hw); -@@ -2510,7 +2510,7 @@ static s32 ixgbe_get_i2c_ack(struct ixgbe_hw *hw) - - if (ack == 1) { - hw_dbg(hw, "I2C ack was not received.\n"); -- status = IXGBE_ERR_I2C; -+ status = -EIO; - } - - ixgbe_lower_i2c_clk(hw, &i2cctl); -@@ -2582,7 +2582,7 @@ static s32 ixgbe_clock_out_i2c_bit(struct ixgbe_hw *hw, bool data) - udelay(IXGBE_I2C_T_LOW); - } else { - hw_dbg(hw, "I2C data was not set to %X\n", data); -- return IXGBE_ERR_I2C; -+ return -EIO; - } - - return 0; -@@ -2678,7 +2678,7 @@ static s32 ixgbe_set_i2c_data(struct ixgbe_hw *hw, u32 *i2cctl, bool data) - *i2cctl = IXGBE_READ_REG(hw, IXGBE_I2CCTL(hw)); - if (data != ixgbe_get_i2c_data(hw, i2cctl)) { - hw_dbg(hw, "Error - I2C data was not set to %X.\n", data); -- return IXGBE_ERR_I2C; -+ return -EIO; - } - - return 0; -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c -index 9cfdfa8a4355..9379069c55c8 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c -@@ -1327,7 +1327,7 @@ static int ixgbe_rcv_msg_from_vf(struct ixgbe_adapter *adapter, u32 vf) - break; - default: - e_err(drv, "Unhandled Msg %8.8x\n", msgbuf[0]); -- retval = IXGBE_ERR_MBX; -+ retval = -EIO; - break; - } - -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h -index 2b00db92b08f..4b19b1282f28 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h -@@ -3665,45 +3665,6 @@ struct ixgbe_info { - const u32 *mvals; - }; - -- --/* Error Codes */ --#define IXGBE_ERR_EEPROM -1 --#define IXGBE_ERR_EEPROM_CHECKSUM -2 --#define IXGBE_ERR_PHY -3 --#define IXGBE_ERR_CONFIG -4 --#define IXGBE_ERR_PARAM -5 --#define IXGBE_ERR_MAC_TYPE -6 --#define IXGBE_ERR_UNKNOWN_PHY -7 --#define IXGBE_ERR_LINK_SETUP -8 --#define IXGBE_ERR_ADAPTER_STOPPED -9 --#define IXGBE_ERR_INVALID_MAC_ADDR -10 --#define IXGBE_ERR_DEVICE_NOT_SUPPORTED -11 --#define IXGBE_ERR_PRIMARY_REQUESTS_PENDING -12 --#define IXGBE_ERR_INVALID_LINK_SETTINGS -13 --#define IXGBE_ERR_AUTONEG_NOT_COMPLETE -14 --#define IXGBE_ERR_RESET_FAILED -15 --#define IXGBE_ERR_SWFW_SYNC -16 --#define IXGBE_ERR_PHY_ADDR_INVALID -17 --#define IXGBE_ERR_I2C -18 --#define IXGBE_ERR_SFP_NOT_SUPPORTED -19 --#define IXGBE_ERR_SFP_NOT_PRESENT -20 --#define IXGBE_ERR_SFP_NO_INIT_SEQ_PRESENT -21 --#define IXGBE_ERR_NO_SAN_ADDR_PTR -22 --#define IXGBE_ERR_FDIR_REINIT_FAILED -23 --#define IXGBE_ERR_EEPROM_VERSION -24 --#define IXGBE_ERR_NO_SPACE -25 --#define IXGBE_ERR_OVERTEMP -26 --#define IXGBE_ERR_FC_NOT_NEGOTIATED -27 --#define IXGBE_ERR_FC_NOT_SUPPORTED -28 --#define IXGBE_ERR_SFP_SETUP_NOT_COMPLETE -30 --#define IXGBE_ERR_PBA_SECTION -31 --#define IXGBE_ERR_INVALID_ARGUMENT -32 --#define IXGBE_ERR_HOST_INTERFACE_COMMAND -33 --#define IXGBE_ERR_FDIR_CMD_INCOMPLETE -38 --#define IXGBE_ERR_FW_RESP_INVALID -39 --#define IXGBE_ERR_TOKEN_RETRY -40 --#define IXGBE_NOT_IMPLEMENTED 0x7FFFFFFF -- - #define IXGBE_FUSES0_GROUP(_i) (0x11158 + ((_i) * 4)) - #define IXGBE_FUSES0_300MHZ BIT(5) - #define IXGBE_FUSES0_REV_MASK (3u << 6) -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c -index d5cfb51ff648..15325c549d9b 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c -@@ -84,7 +84,7 @@ s32 ixgbe_reset_hw_X540(struct ixgbe_hw *hw) - status = hw->mac.ops.acquire_swfw_sync(hw, swfw_mask); - if (status) { - hw_dbg(hw, "semaphore failed with %d", status); -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - } - - ctrl = IXGBE_CTRL_RST; -@@ -103,7 +103,7 @@ s32 ixgbe_reset_hw_X540(struct ixgbe_hw *hw) - } - - if (ctrl & IXGBE_CTRL_RST_MASK) { -- status = IXGBE_ERR_RESET_FAILED; -+ status = -EIO; - hw_dbg(hw, "Reset polling failed to complete.\n"); - } - msleep(100); -@@ -220,7 +220,7 @@ static s32 ixgbe_read_eerd_X540(struct ixgbe_hw *hw, u16 offset, u16 *data) - s32 status; - - if (hw->mac.ops.acquire_swfw_sync(hw, IXGBE_GSSR_EEP_SM)) -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - - status = ixgbe_read_eerd_generic(hw, offset, data); - -@@ -243,7 +243,7 @@ static s32 ixgbe_read_eerd_buffer_X540(struct ixgbe_hw *hw, - s32 status; - - if (hw->mac.ops.acquire_swfw_sync(hw, IXGBE_GSSR_EEP_SM)) -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - - status = ixgbe_read_eerd_buffer_generic(hw, offset, words, data); - -@@ -264,7 +264,7 @@ static s32 ixgbe_write_eewr_X540(struct ixgbe_hw *hw, u16 offset, u16 data) - s32 status; - - if (hw->mac.ops.acquire_swfw_sync(hw, IXGBE_GSSR_EEP_SM)) -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - - status = ixgbe_write_eewr_generic(hw, offset, data); - -@@ -287,7 +287,7 @@ static s32 ixgbe_write_eewr_buffer_X540(struct ixgbe_hw *hw, - s32 status; - - if (hw->mac.ops.acquire_swfw_sync(hw, IXGBE_GSSR_EEP_SM)) -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - - status = ixgbe_write_eewr_buffer_generic(hw, offset, words, data); - -@@ -324,7 +324,7 @@ static s32 ixgbe_calc_eeprom_checksum_X540(struct ixgbe_hw *hw) - for (i = 0; i < checksum_last_word; i++) { - if (ixgbe_read_eerd_generic(hw, i, &word)) { - hw_dbg(hw, "EEPROM read failed\n"); -- return IXGBE_ERR_EEPROM; -+ return -EIO; - } - checksum += word; - } -@@ -349,7 +349,7 @@ static s32 ixgbe_calc_eeprom_checksum_X540(struct ixgbe_hw *hw) - - if (ixgbe_read_eerd_generic(hw, pointer, &length)) { - hw_dbg(hw, "EEPROM read failed\n"); -- return IXGBE_ERR_EEPROM; -+ return -EIO; - } - - /* Skip pointer section if length is invalid. */ -@@ -360,7 +360,7 @@ static s32 ixgbe_calc_eeprom_checksum_X540(struct ixgbe_hw *hw) - for (j = pointer + 1; j <= pointer + length; j++) { - if (ixgbe_read_eerd_generic(hw, j, &word)) { - hw_dbg(hw, "EEPROM read failed\n"); -- return IXGBE_ERR_EEPROM; -+ return -EIO; - } - checksum += word; - } -@@ -397,7 +397,7 @@ static s32 ixgbe_validate_eeprom_checksum_X540(struct ixgbe_hw *hw, - } - - if (hw->mac.ops.acquire_swfw_sync(hw, IXGBE_GSSR_EEP_SM)) -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - - status = hw->eeprom.ops.calc_checksum(hw); - if (status < 0) -@@ -418,7 +418,7 @@ static s32 ixgbe_validate_eeprom_checksum_X540(struct ixgbe_hw *hw, - */ - if (read_checksum != checksum) { - hw_dbg(hw, "Invalid EEPROM checksum"); -- status = IXGBE_ERR_EEPROM_CHECKSUM; -+ status = -EIO; - } - - /* If the user cares, return the calculated checksum */ -@@ -455,7 +455,7 @@ static s32 ixgbe_update_eeprom_checksum_X540(struct ixgbe_hw *hw) - } - - if (hw->mac.ops.acquire_swfw_sync(hw, IXGBE_GSSR_EEP_SM)) -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - - status = hw->eeprom.ops.calc_checksum(hw); - if (status < 0) -@@ -490,7 +490,7 @@ static s32 ixgbe_update_flash_X540(struct ixgbe_hw *hw) - s32 status; - - status = ixgbe_poll_flash_update_done_X540(hw); -- if (status == IXGBE_ERR_EEPROM) { -+ if (status == -EIO) { - hw_dbg(hw, "Flash update time out\n"); - return status; - } -@@ -540,7 +540,7 @@ static s32 ixgbe_poll_flash_update_done_X540(struct ixgbe_hw *hw) - return 0; - udelay(5); - } -- return IXGBE_ERR_EEPROM; -+ return -EIO; - } - - /** -@@ -575,7 +575,7 @@ s32 ixgbe_acquire_swfw_sync_X540(struct ixgbe_hw *hw, u32 mask) - * SW_FW_SYNC bits (not just NVM) - */ - if (ixgbe_get_swfw_sync_semaphore(hw)) -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - - swfw_sync = IXGBE_READ_REG(hw, IXGBE_SWFW_SYNC(hw)); - if (!(swfw_sync & (fwmask | swmask | hwmask))) { -@@ -599,7 +599,7 @@ s32 ixgbe_acquire_swfw_sync_X540(struct ixgbe_hw *hw, u32 mask) - * bits in the SW_FW_SYNC register. - */ - if (ixgbe_get_swfw_sync_semaphore(hw)) -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - swfw_sync = IXGBE_READ_REG(hw, IXGBE_SWFW_SYNC(hw)); - if (swfw_sync & (fwmask | hwmask)) { - swfw_sync |= swmask; -@@ -622,11 +622,11 @@ s32 ixgbe_acquire_swfw_sync_X540(struct ixgbe_hw *hw, u32 mask) - rmask |= IXGBE_GSSR_I2C_MASK; - ixgbe_release_swfw_sync_X540(hw, rmask); - ixgbe_release_swfw_sync_semaphore(hw); -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - } - ixgbe_release_swfw_sync_semaphore(hw); - -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - } - - /** -@@ -680,7 +680,7 @@ static s32 ixgbe_get_swfw_sync_semaphore(struct ixgbe_hw *hw) - if (i == timeout) { - hw_dbg(hw, - "Software semaphore SMBI between device drivers not granted.\n"); -- return IXGBE_ERR_EEPROM; -+ return -EIO; - } - - /* Now get the semaphore between SW/FW through the REGSMP bit */ -@@ -697,7 +697,7 @@ static s32 ixgbe_get_swfw_sync_semaphore(struct ixgbe_hw *hw) - */ - hw_dbg(hw, "REGSMP Software NVM semaphore not granted\n"); - ixgbe_release_swfw_sync_semaphore(hw); -- return IXGBE_ERR_EEPROM; -+ return -EIO; - } - - /** -@@ -768,7 +768,7 @@ s32 ixgbe_blink_led_start_X540(struct ixgbe_hw *hw, u32 index) - bool link_up; - - if (index > 3) -- return IXGBE_ERR_PARAM; -+ return -EINVAL; - - /* Link should be up in order for the blink bit in the LED control - * register to work. Force link and speed in the MAC if link is down. -@@ -804,7 +804,7 @@ s32 ixgbe_blink_led_stop_X540(struct ixgbe_hw *hw, u32 index) - u32 ledctl_reg; - - if (index > 3) -- return IXGBE_ERR_PARAM; -+ return -EINVAL; - - /* Restore the LED to its default value. */ - ledctl_reg = IXGBE_READ_REG(hw, IXGBE_LEDCTL); -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -index aa4bf6c9a2f7..19de26520a88 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -@@ -206,13 +206,13 @@ static s32 ixgbe_reset_cs4227(struct ixgbe_hw *hw) - } - if (retry == IXGBE_CS4227_RETRIES) { - hw_err(hw, "CS4227 reset did not complete\n"); -- return IXGBE_ERR_PHY; -+ return -EIO; - } - - status = ixgbe_read_cs4227(hw, IXGBE_CS4227_EEPROM_STATUS, &value); - if (status || !(value & IXGBE_CS4227_EEPROM_LOAD_OK)) { - hw_err(hw, "CS4227 EEPROM did not load successfully\n"); -- return IXGBE_ERR_PHY; -+ return -EIO; - } - - return 0; -@@ -350,13 +350,13 @@ static s32 ixgbe_identify_phy_x550em(struct ixgbe_hw *hw) - static s32 ixgbe_read_phy_reg_x550em(struct ixgbe_hw *hw, u32 reg_addr, - u32 device_type, u16 *phy_data) - { -- return IXGBE_NOT_IMPLEMENTED; -+ return -EOPNOTSUPP; - } - - static s32 ixgbe_write_phy_reg_x550em(struct ixgbe_hw *hw, u32 reg_addr, - u32 device_type, u16 phy_data) - { -- return IXGBE_NOT_IMPLEMENTED; -+ return -EOPNOTSUPP; - } - - /** -@@ -463,7 +463,7 @@ s32 ixgbe_fw_phy_activity(struct ixgbe_hw *hw, u16 activity, - --retries; - } while (retries > 0); - -- return IXGBE_ERR_HOST_INTERFACE_COMMAND; -+ return -EIO; - } - - static const struct { -@@ -511,7 +511,7 @@ static s32 ixgbe_get_phy_id_fw(struct ixgbe_hw *hw) - hw->phy.id |= phy_id_lo & IXGBE_PHY_REVISION_MASK; - hw->phy.revision = phy_id_lo & ~IXGBE_PHY_REVISION_MASK; - if (!hw->phy.id || hw->phy.id == IXGBE_PHY_REVISION_MASK) -- return IXGBE_ERR_PHY_ADDR_INVALID; -+ return -EFAULT; - - hw->phy.autoneg_advertised = hw->phy.speeds_supported; - hw->phy.eee_speeds_supported = IXGBE_LINK_SPEED_100_FULL | -@@ -568,7 +568,7 @@ static s32 ixgbe_setup_fw_link(struct ixgbe_hw *hw) - - if (hw->fc.strict_ieee && hw->fc.requested_mode == ixgbe_fc_rx_pause) { - hw_err(hw, "rx_pause not valid in strict IEEE mode\n"); -- return IXGBE_ERR_INVALID_LINK_SETTINGS; -+ return -EINVAL; - } - - switch (hw->fc.requested_mode) { -@@ -675,7 +675,7 @@ static s32 ixgbe_iosf_wait(struct ixgbe_hw *hw, u32 *ctrl) - *ctrl = command; - if (i == IXGBE_MDIO_COMMAND_TIMEOUT) { - hw_dbg(hw, "IOSF wait timed out\n"); -- return IXGBE_ERR_PHY; -+ return -EIO; - } - - return 0; -@@ -715,7 +715,7 @@ static s32 ixgbe_read_iosf_sb_reg_x550(struct ixgbe_hw *hw, u32 reg_addr, - error = (command & IXGBE_SB_IOSF_CTRL_CMPL_ERR_MASK) >> - IXGBE_SB_IOSF_CTRL_CMPL_ERR_SHIFT; - hw_dbg(hw, "Failed to read, error %x\n", error); -- return IXGBE_ERR_PHY; -+ return -EIO; - } - - if (!ret) -@@ -750,9 +750,9 @@ static s32 ixgbe_get_phy_token(struct ixgbe_hw *hw) - if (token_cmd.hdr.cmd_or_resp.ret_status == FW_PHY_TOKEN_OK) - return 0; - if (token_cmd.hdr.cmd_or_resp.ret_status != FW_PHY_TOKEN_RETRY) -- return IXGBE_ERR_FW_RESP_INVALID; -+ return -EIO; - -- return IXGBE_ERR_TOKEN_RETRY; -+ return -EAGAIN; - } - - /** -@@ -778,7 +778,7 @@ static s32 ixgbe_put_phy_token(struct ixgbe_hw *hw) - return status; - if (token_cmd.hdr.cmd_or_resp.ret_status == FW_PHY_TOKEN_OK) - return 0; -- return IXGBE_ERR_FW_RESP_INVALID; -+ return -EIO; - } - - /** -@@ -942,7 +942,7 @@ static s32 ixgbe_checksum_ptr_x550(struct ixgbe_hw *hw, u16 ptr, - local_buffer = buf; - } else { - if (buffer_size < ptr) -- return IXGBE_ERR_PARAM; -+ return -EINVAL; - local_buffer = &buffer[ptr]; - } - -@@ -960,7 +960,7 @@ static s32 ixgbe_checksum_ptr_x550(struct ixgbe_hw *hw, u16 ptr, - } - - if (buffer && ((u32)start + (u32)length > buffer_size)) -- return IXGBE_ERR_PARAM; -+ return -EINVAL; - - for (i = start; length; i++, length--) { - if (i == bufsz && !buffer) { -@@ -1012,7 +1012,7 @@ static s32 ixgbe_calc_checksum_X550(struct ixgbe_hw *hw, u16 *buffer, - local_buffer = eeprom_ptrs; - } else { - if (buffer_size < IXGBE_EEPROM_LAST_WORD) -- return IXGBE_ERR_PARAM; -+ return -EINVAL; - local_buffer = buffer; - } - -@@ -1148,7 +1148,7 @@ static s32 ixgbe_validate_eeprom_checksum_X550(struct ixgbe_hw *hw, - * calculated checksum - */ - if (read_checksum != checksum) { -- status = IXGBE_ERR_EEPROM_CHECKSUM; -+ status = -EIO; - hw_dbg(hw, "Invalid EEPROM checksum"); - } - -@@ -1203,7 +1203,7 @@ static s32 ixgbe_write_ee_hostif_X550(struct ixgbe_hw *hw, u16 offset, u16 data) - hw->mac.ops.release_swfw_sync(hw, IXGBE_GSSR_EEP_SM); - } else { - hw_dbg(hw, "write ee hostif failed to get semaphore"); -- status = IXGBE_ERR_SWFW_SYNC; -+ status = -EBUSY; - } - - return status; -@@ -1415,7 +1415,7 @@ static s32 ixgbe_write_iosf_sb_reg_x550(struct ixgbe_hw *hw, u32 reg_addr, - error = (command & IXGBE_SB_IOSF_CTRL_CMPL_ERR_MASK) >> - IXGBE_SB_IOSF_CTRL_CMPL_ERR_SHIFT; - hw_dbg(hw, "Failed to write, error %x\n", error); -- return IXGBE_ERR_PHY; -+ return -EIO; - } - - out: -@@ -1558,7 +1558,7 @@ static s32 ixgbe_setup_ixfi_x550em(struct ixgbe_hw *hw, ixgbe_link_speed *speed) - - /* iXFI is only supported with X552 */ - if (mac->type != ixgbe_mac_X550EM_x) -- return IXGBE_ERR_LINK_SETUP; -+ return -EIO; - - /* Disable AN and force speed to 10G Serial. */ - status = ixgbe_read_iosf_sb_reg_x550(hw, -@@ -1580,7 +1580,7 @@ static s32 ixgbe_setup_ixfi_x550em(struct ixgbe_hw *hw, ixgbe_link_speed *speed) - break; - default: - /* Other link speeds are not supported by internal KR PHY. */ -- return IXGBE_ERR_LINK_SETUP; -+ return -EINVAL; - } - - status = ixgbe_write_iosf_sb_reg_x550(hw, -@@ -1611,7 +1611,7 @@ static s32 ixgbe_supported_sfp_modules_X550em(struct ixgbe_hw *hw, bool *linear) - { - switch (hw->phy.sfp_type) { - case ixgbe_sfp_type_not_present: -- return IXGBE_ERR_SFP_NOT_PRESENT; -+ return -ENOENT; - case ixgbe_sfp_type_da_cu_core0: - case ixgbe_sfp_type_da_cu_core1: - *linear = true; -@@ -1630,7 +1630,7 @@ static s32 ixgbe_supported_sfp_modules_X550em(struct ixgbe_hw *hw, bool *linear) - case ixgbe_sfp_type_1g_cu_core0: - case ixgbe_sfp_type_1g_cu_core1: - default: -- return IXGBE_ERR_SFP_NOT_SUPPORTED; -+ return -EOPNOTSUPP; - } - - return 0; -@@ -1660,7 +1660,7 @@ ixgbe_setup_mac_link_sfp_x550em(struct ixgbe_hw *hw, - * there is no reason to configure CS4227 and SFP not present error is - * not accepted in the setup MAC link flow. - */ -- if (status == IXGBE_ERR_SFP_NOT_PRESENT) -+ if (status == -ENOENT) - return 0; - - if (status) -@@ -1718,7 +1718,7 @@ static s32 ixgbe_setup_sfi_x550a(struct ixgbe_hw *hw, ixgbe_link_speed *speed) - break; - default: - /* Other link speeds are not supported by internal PHY. */ -- return IXGBE_ERR_LINK_SETUP; -+ return -EINVAL; - } - - (void)mac->ops.write_iosf_sb_reg(hw, -@@ -1803,7 +1803,7 @@ ixgbe_setup_mac_link_sfp_n(struct ixgbe_hw *hw, ixgbe_link_speed speed, - /* If no SFP module present, then return success. Return success since - * SFP not present error is not excepted in the setup MAC link flow. - */ -- if (ret_val == IXGBE_ERR_SFP_NOT_PRESENT) -+ if (ret_val == -ENOENT) - return 0; - - if (ret_val) -@@ -1853,7 +1853,7 @@ ixgbe_setup_mac_link_sfp_x550a(struct ixgbe_hw *hw, ixgbe_link_speed speed, - /* If no SFP module present, then return success. Return success since - * SFP not present error is not excepted in the setup MAC link flow. - */ -- if (ret_val == IXGBE_ERR_SFP_NOT_PRESENT) -+ if (ret_val == -ENOENT) - return 0; - - if (ret_val) -@@ -1863,7 +1863,7 @@ ixgbe_setup_mac_link_sfp_x550a(struct ixgbe_hw *hw, ixgbe_link_speed speed, - ixgbe_setup_kr_speed_x550em(hw, speed); - - if (hw->phy.mdio.prtad == MDIO_PRTAD_NONE) -- return IXGBE_ERR_PHY_ADDR_INVALID; -+ return -EFAULT; - - /* Get external PHY SKU id */ - ret_val = hw->phy.ops.read_reg(hw, IXGBE_CS4227_EFUSE_PDF_SKU, -@@ -1962,7 +1962,7 @@ static s32 ixgbe_check_link_t_X550em(struct ixgbe_hw *hw, - u16 i, autoneg_status; - - if (hw->mac.ops.get_media_type(hw) != ixgbe_media_type_copper) -- return IXGBE_ERR_CONFIG; -+ return -EIO; - - status = ixgbe_check_mac_link_generic(hw, speed, link_up, - link_up_wait_to_complete); -@@ -2145,9 +2145,9 @@ static s32 ixgbe_setup_sgmii_fw(struct ixgbe_hw *hw, ixgbe_link_speed speed, - */ - static void ixgbe_fc_autoneg_sgmii_x550em_a(struct ixgbe_hw *hw) - { -- s32 status = IXGBE_ERR_FC_NOT_NEGOTIATED; - u32 info[FW_PHY_ACT_DATA_COUNT] = { 0 }; - ixgbe_link_speed speed; -+ s32 status = -EIO; - bool link_up; - - /* AN should have completed when the cable was plugged in. -@@ -2165,7 +2165,7 @@ static void ixgbe_fc_autoneg_sgmii_x550em_a(struct ixgbe_hw *hw) - /* Check if auto-negotiation has completed */ - status = ixgbe_fw_phy_activity(hw, FW_PHY_ACT_GET_LINK_INFO, &info); - if (status || !(info[0] & FW_PHY_ACT_GET_LINK_INFO_AN_COMPLETE)) { -- status = IXGBE_ERR_FC_NOT_NEGOTIATED; -+ status = -EIO; - goto out; - } - -@@ -2692,7 +2692,7 @@ static s32 ixgbe_setup_internal_phy_t_x550em(struct ixgbe_hw *hw) - u16 speed; - - if (hw->mac.ops.get_media_type(hw) != ixgbe_media_type_copper) -- return IXGBE_ERR_CONFIG; -+ return -EIO; - - if (!(hw->mac.type == ixgbe_mac_X550EM_x && - !(hw->phy.nw_mng_if_sel & IXGBE_NW_MNG_IF_SEL_INT_PHY_MODE))) { -@@ -2735,7 +2735,7 @@ static s32 ixgbe_setup_internal_phy_t_x550em(struct ixgbe_hw *hw) - break; - default: - /* Internal PHY does not support anything else */ -- return IXGBE_ERR_INVALID_LINK_SETTINGS; -+ return -EINVAL; - } - - return ixgbe_setup_ixfi_x550em(hw, &force_speed); -@@ -2767,7 +2767,7 @@ static s32 ixgbe_led_on_t_x550em(struct ixgbe_hw *hw, u32 led_idx) - u16 phy_data; - - if (led_idx >= IXGBE_X557_MAX_LED_INDEX) -- return IXGBE_ERR_PARAM; -+ return -EINVAL; - - /* To turn on the LED, set mode to ON. */ - hw->phy.ops.read_reg(hw, IXGBE_X557_LED_PROVISIONING + led_idx, -@@ -2789,7 +2789,7 @@ static s32 ixgbe_led_off_t_x550em(struct ixgbe_hw *hw, u32 led_idx) - u16 phy_data; - - if (led_idx >= IXGBE_X557_MAX_LED_INDEX) -- return IXGBE_ERR_PARAM; -+ return -EINVAL; - - /* To turn on the LED, set mode to ON. */ - hw->phy.ops.read_reg(hw, IXGBE_X557_LED_PROVISIONING + led_idx, -@@ -2813,8 +2813,9 @@ static s32 ixgbe_led_off_t_x550em(struct ixgbe_hw *hw, u32 led_idx) - * - * Sends driver version number to firmware through the manageability - * block. On success return 0 -- * else returns IXGBE_ERR_SWFW_SYNC when encountering an error acquiring -- * semaphore or IXGBE_ERR_HOST_INTERFACE_COMMAND when command fails. -+ * else returns -EBUSY when encountering an error acquiring -+ * semaphore, -EIO when command fails or -ENIVAL when incorrect -+ * params passed. - **/ - static s32 ixgbe_set_fw_drv_ver_x550(struct ixgbe_hw *hw, u8 maj, u8 min, - u8 build, u8 sub, u16 len, -@@ -2825,7 +2826,7 @@ static s32 ixgbe_set_fw_drv_ver_x550(struct ixgbe_hw *hw, u8 maj, u8 min, - int i; - - if (!len || !driver_ver || (len > sizeof(fw_cmd.driver_string))) -- return IXGBE_ERR_INVALID_ARGUMENT; -+ return -EINVAL; - - fw_cmd.hdr.cmd = FW_CEM_CMD_DRIVER_INFO; - fw_cmd.hdr.buf_len = FW_CEM_CMD_DRIVER_INFO_LEN + len; -@@ -2850,7 +2851,7 @@ static s32 ixgbe_set_fw_drv_ver_x550(struct ixgbe_hw *hw, u8 maj, u8 min, - - if (fw_cmd.hdr.cmd_or_resp.ret_status != - FW_CEM_RESP_STATUS_SUCCESS) -- return IXGBE_ERR_HOST_INTERFACE_COMMAND; -+ return -EIO; - return 0; - } - -@@ -2907,7 +2908,7 @@ static s32 ixgbe_setup_fc_x550em(struct ixgbe_hw *hw) - /* Validate the requested mode */ - if (hw->fc.strict_ieee && hw->fc.requested_mode == ixgbe_fc_rx_pause) { - hw_err(hw, "ixgbe_fc_rx_pause not valid in strict IEEE mode\n"); -- return IXGBE_ERR_INVALID_LINK_SETTINGS; -+ return -EINVAL; - } - - /* 10gig parts do not have a word in the EEPROM to determine the -@@ -2942,7 +2943,7 @@ static s32 ixgbe_setup_fc_x550em(struct ixgbe_hw *hw) - break; - default: - hw_err(hw, "Flow control param set incorrectly\n"); -- return IXGBE_ERR_CONFIG; -+ return -EIO; - } - - switch (hw->device_id) { -@@ -2986,8 +2987,8 @@ static s32 ixgbe_setup_fc_x550em(struct ixgbe_hw *hw) - static void ixgbe_fc_autoneg_backplane_x550em_a(struct ixgbe_hw *hw) - { - u32 link_s1, lp_an_page_low, an_cntl_1; -- s32 status = IXGBE_ERR_FC_NOT_NEGOTIATED; - ixgbe_link_speed speed; -+ s32 status = -EIO; - bool link_up; - - /* AN should have completed when the cable was plugged in. -@@ -3013,7 +3014,7 @@ static void ixgbe_fc_autoneg_backplane_x550em_a(struct ixgbe_hw *hw) - - if (status || (link_s1 & IXGBE_KRM_LINK_S1_MAC_AN_COMPLETE) == 0) { - hw_dbg(hw, "Auto-Negotiation did not complete\n"); -- status = IXGBE_ERR_FC_NOT_NEGOTIATED; -+ status = -EIO; - goto out; - } - -@@ -3251,8 +3252,7 @@ static s32 ixgbe_init_phy_ops_X550em(struct ixgbe_hw *hw) - - /* Identify the PHY or SFP module */ - ret_val = phy->ops.identify(hw); -- if (ret_val == IXGBE_ERR_SFP_NOT_SUPPORTED || -- ret_val == IXGBE_ERR_PHY_ADDR_INVALID) -+ if (ret_val == -EOPNOTSUPP || ret_val == -EFAULT) - return ret_val; - - /* Setup function pointers based on detected hardware */ -@@ -3460,8 +3460,7 @@ static s32 ixgbe_reset_hw_X550em(struct ixgbe_hw *hw) - - /* PHY ops must be identified and initialized prior to reset */ - status = hw->phy.ops.init(hw); -- if (status == IXGBE_ERR_SFP_NOT_SUPPORTED || -- status == IXGBE_ERR_PHY_ADDR_INVALID) -+ if (status == -EOPNOTSUPP || status == -EFAULT) - return status; - - /* start the external PHY */ -@@ -3477,7 +3476,7 @@ static s32 ixgbe_reset_hw_X550em(struct ixgbe_hw *hw) - hw->phy.sfp_setup_needed = false; - } - -- if (status == IXGBE_ERR_SFP_NOT_SUPPORTED) -+ if (status == -EOPNOTSUPP) - return status; - - /* Reset PHY */ -@@ -3501,7 +3500,7 @@ static s32 ixgbe_reset_hw_X550em(struct ixgbe_hw *hw) - status = hw->mac.ops.acquire_swfw_sync(hw, swfw_mask); - if (status) { - hw_dbg(hw, "semaphore failed with %d", status); -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - } - - ctrl |= IXGBE_READ_REG(hw, IXGBE_CTRL); -@@ -3519,7 +3518,7 @@ static s32 ixgbe_reset_hw_X550em(struct ixgbe_hw *hw) - } - - if (ctrl & IXGBE_CTRL_RST_MASK) { -- status = IXGBE_ERR_RESET_FAILED; -+ status = -EIO; - hw_dbg(hw, "Reset polling failed to complete.\n"); - } - -@@ -3615,7 +3614,7 @@ static s32 ixgbe_setup_fc_backplane_x550em_a(struct ixgbe_hw *hw) - /* Validate the requested mode */ - if (hw->fc.strict_ieee && hw->fc.requested_mode == ixgbe_fc_rx_pause) { - hw_err(hw, "ixgbe_fc_rx_pause not valid in strict IEEE mode\n"); -- return IXGBE_ERR_INVALID_LINK_SETTINGS; -+ return -EINVAL; - } - - if (hw->fc.requested_mode == ixgbe_fc_default) -@@ -3672,7 +3671,7 @@ static s32 ixgbe_setup_fc_backplane_x550em_a(struct ixgbe_hw *hw) - break; - default: - hw_err(hw, "Flow control param set incorrectly\n"); -- return IXGBE_ERR_CONFIG; -+ return -EIO; - } - - status = hw->mac.ops.write_iosf_sb_reg(hw, -@@ -3768,7 +3767,7 @@ static s32 ixgbe_acquire_swfw_sync_x550em_a(struct ixgbe_hw *hw, u32 mask) - return 0; - if (hmask) - ixgbe_release_swfw_sync_X540(hw, hmask); -- if (status != IXGBE_ERR_TOKEN_RETRY) -+ if (status != -EAGAIN) - return status; - msleep(FW_PHY_TOKEN_DELAY); - } -@@ -3812,7 +3811,7 @@ static s32 ixgbe_read_phy_reg_x550a(struct ixgbe_hw *hw, u32 reg_addr, - s32 status; - - if (hw->mac.ops.acquire_swfw_sync(hw, mask)) -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - - status = hw->phy.ops.read_reg_mdi(hw, reg_addr, device_type, phy_data); - -@@ -3838,7 +3837,7 @@ static s32 ixgbe_write_phy_reg_x550a(struct ixgbe_hw *hw, u32 reg_addr, - s32 status; - - if (hw->mac.ops.acquire_swfw_sync(hw, mask)) -- return IXGBE_ERR_SWFW_SYNC; -+ return -EBUSY; - - status = ixgbe_write_phy_reg_mdi(hw, reg_addr, device_type, phy_data); - hw->mac.ops.release_swfw_sync(hw, mask); --- -2.43.2 - -From bbe51648a7ad96af5bb67459f1167c05dfff0879 Mon Sep 17 00:00:00 2001 -From: Jedrzej Jagielski <jedrzej.jagielski@intel.com> -Date: Mon, 18 Dec 2023 11:39:25 +0100 -Subject: [PATCH 1329/1501] ixgbe: Refactor overtemp event handling -Content-Length: 10286 -Lines: 285 - -[ Upstream commit 6c1b4af8c1b20c70dde01e58381685d6a4a1d2c8 ] - -Currently ixgbe driver is notified of overheating events -via internal IXGBE_ERR_OVERTEMP error code. - -Change the approach for handle_lasi() to use freshly introduced -is_overtemp function parameter which set when such event occurs. -Change check_overtemp() to bool and return true if overtemp -event occurs. - -Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> -Signed-off-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com> -Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> -Reviewed-by: Simon Horman <horms@kernel.org> -Tested-by: Sunitha Mekala <sunithax.d.mekala@intel.com> (A Contingent worker at Intel) -Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 16 +++----- - drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c | 21 +++++----- - drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h | 2 +- - drivers/net/ethernet/intel/ixgbe/ixgbe_type.h | 4 +- - drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 41 +++++++++++-------- - 5 files changed, 43 insertions(+), 41 deletions(-) - -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -index d9af3fcfe625..6a3f633406c4 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -@@ -2756,7 +2756,6 @@ static void ixgbe_check_overtemp_subtask(struct ixgbe_adapter *adapter) - { - struct ixgbe_hw *hw = &adapter->hw; - u32 eicr = adapter->interrupt_event; -- s32 rc; - - if (test_bit(__IXGBE_DOWN, &adapter->state)) - return; -@@ -2790,14 +2789,13 @@ static void ixgbe_check_overtemp_subtask(struct ixgbe_adapter *adapter) - } - - /* Check if this is not due to overtemp */ -- if (hw->phy.ops.check_overtemp(hw) != IXGBE_ERR_OVERTEMP) -+ if (!hw->phy.ops.check_overtemp(hw)) - return; - - break; - case IXGBE_DEV_ID_X550EM_A_1G_T: - case IXGBE_DEV_ID_X550EM_A_1G_T_L: -- rc = hw->phy.ops.check_overtemp(hw); -- if (rc != IXGBE_ERR_OVERTEMP) -+ if (!hw->phy.ops.check_overtemp(hw)) - return; - break; - default: -@@ -7938,7 +7936,7 @@ static void ixgbe_service_timer(struct timer_list *t) - static void ixgbe_phy_interrupt_subtask(struct ixgbe_adapter *adapter) - { - struct ixgbe_hw *hw = &adapter->hw; -- u32 status; -+ bool overtemp; - - if (!(adapter->flags2 & IXGBE_FLAG2_PHY_INTERRUPT)) - return; -@@ -7948,11 +7946,9 @@ static void ixgbe_phy_interrupt_subtask(struct ixgbe_adapter *adapter) - if (!hw->phy.ops.handle_lasi) - return; - -- status = hw->phy.ops.handle_lasi(&adapter->hw); -- if (status != IXGBE_ERR_OVERTEMP) -- return; -- -- e_crit(drv, "%s\n", ixgbe_overheat_msg); -+ hw->phy.ops.handle_lasi(&adapter->hw, &overtemp); -+ if (overtemp) -+ e_crit(drv, "%s\n", ixgbe_overheat_msg); - } - - static void ixgbe_reset_subtask(struct ixgbe_adapter *adapter) -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c -index 7c0a1a0a5eda..930dc5071936 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c -@@ -408,8 +408,7 @@ s32 ixgbe_reset_phy_generic(struct ixgbe_hw *hw) - return status; - - /* Don't reset PHY if it's shut down due to overtemp. */ -- if (!hw->phy.reset_if_overtemp && -- (IXGBE_ERR_OVERTEMP == hw->phy.ops.check_overtemp(hw))) -+ if (!hw->phy.reset_if_overtemp && hw->phy.ops.check_overtemp(hw)) - return 0; - - /* Blocked by MNG FW so bail */ -@@ -2748,22 +2747,24 @@ static void ixgbe_i2c_bus_clear(struct ixgbe_hw *hw) - * @hw: pointer to hardware structure - * - * Checks if the LASI temp alarm status was triggered due to overtemp -+ * -+ * Return true when an overtemp event detected, otherwise false. - **/ --s32 ixgbe_tn_check_overtemp(struct ixgbe_hw *hw) -+bool ixgbe_tn_check_overtemp(struct ixgbe_hw *hw) - { - u16 phy_data = 0; -+ u32 status; - - if (hw->device_id != IXGBE_DEV_ID_82599_T3_LOM) -- return 0; -+ return false; - - /* Check that the LASI temp alarm status was triggered */ -- hw->phy.ops.read_reg(hw, IXGBE_TN_LASI_STATUS_REG, -- MDIO_MMD_PMAPMD, &phy_data); -+ status = hw->phy.ops.read_reg(hw, IXGBE_TN_LASI_STATUS_REG, -+ MDIO_MMD_PMAPMD, &phy_data); -+ if (status) -+ return false; - -- if (!(phy_data & IXGBE_TN_LASI_STATUS_TEMP_ALARM)) -- return 0; -- -- return IXGBE_ERR_OVERTEMP; -+ return !!(phy_data & IXGBE_TN_LASI_STATUS_TEMP_ALARM); - } - - /** ixgbe_set_copper_phy_power - Control power for copper phy -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h -index 6544c4539c0d..ef72729d7c93 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h -@@ -155,7 +155,7 @@ s32 ixgbe_identify_sfp_module_generic(struct ixgbe_hw *hw); - s32 ixgbe_get_sfp_init_sequence_offsets(struct ixgbe_hw *hw, - u16 *list_offset, - u16 *data_offset); --s32 ixgbe_tn_check_overtemp(struct ixgbe_hw *hw); -+bool ixgbe_tn_check_overtemp(struct ixgbe_hw *hw); - s32 ixgbe_read_i2c_byte_generic(struct ixgbe_hw *hw, u8 byte_offset, - u8 dev_addr, u8 *data); - s32 ixgbe_read_i2c_byte_generic_unlocked(struct ixgbe_hw *hw, u8 byte_offset, -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h -index 4b19b1282f28..61b9774b3d31 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h -@@ -3509,10 +3509,10 @@ struct ixgbe_phy_operations { - s32 (*read_i2c_sff8472)(struct ixgbe_hw *, u8 , u8 *); - s32 (*read_i2c_eeprom)(struct ixgbe_hw *, u8 , u8 *); - s32 (*write_i2c_eeprom)(struct ixgbe_hw *, u8, u8); -- s32 (*check_overtemp)(struct ixgbe_hw *); -+ bool (*check_overtemp)(struct ixgbe_hw *); - s32 (*set_phy_power)(struct ixgbe_hw *, bool on); - s32 (*enter_lplu)(struct ixgbe_hw *); -- s32 (*handle_lasi)(struct ixgbe_hw *hw); -+ s32 (*handle_lasi)(struct ixgbe_hw *hw, bool *); - s32 (*read_i2c_byte_unlocked)(struct ixgbe_hw *, u8 offset, u8 addr, - u8 *value); - s32 (*write_i2c_byte_unlocked)(struct ixgbe_hw *, u8 offset, u8 addr, -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -index 19de26520a88..fe2d2d2f0494 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -@@ -600,8 +600,10 @@ static s32 ixgbe_setup_fw_link(struct ixgbe_hw *hw) - rc = ixgbe_fw_phy_activity(hw, FW_PHY_ACT_SETUP_LINK, &setup); - if (rc) - return rc; -+ - if (setup[0] == FW_PHY_ACT_SETUP_LINK_RSP_DOWN) -- return IXGBE_ERR_OVERTEMP; -+ return -EIO; -+ - return 0; - } - -@@ -2369,18 +2371,18 @@ static s32 ixgbe_get_link_capabilities_X550em(struct ixgbe_hw *hw, - * @hw: pointer to hardware structure - * @lsc: pointer to boolean flag which indicates whether external Base T - * PHY interrupt is lsc -+ * @is_overtemp: indicate whether an overtemp event encountered - * - * Determime if external Base T PHY interrupt cause is high temperature - * failure alarm or link status change. -- * -- * Return IXGBE_ERR_OVERTEMP if interrupt is high temperature -- * failure alarm, else return PHY access status. - **/ --static s32 ixgbe_get_lasi_ext_t_x550em(struct ixgbe_hw *hw, bool *lsc) -+static s32 ixgbe_get_lasi_ext_t_x550em(struct ixgbe_hw *hw, bool *lsc, -+ bool *is_overtemp) - { - u32 status; - u16 reg; - -+ *is_overtemp = false; - *lsc = false; - - /* Vendor alarm triggered */ -@@ -2412,7 +2414,8 @@ static s32 ixgbe_get_lasi_ext_t_x550em(struct ixgbe_hw *hw, bool *lsc) - if (reg & IXGBE_MDIO_GLOBAL_ALM_1_HI_TMP_FAIL) { - /* power down the PHY in case the PHY FW didn't already */ - ixgbe_set_copper_phy_power(hw, false); -- return IXGBE_ERR_OVERTEMP; -+ *is_overtemp = true; -+ return -EIO; - } - if (reg & IXGBE_MDIO_GLOBAL_ALM_1_DEV_FAULT) { - /* device fault alarm triggered */ -@@ -2426,7 +2429,8 @@ static s32 ixgbe_get_lasi_ext_t_x550em(struct ixgbe_hw *hw, bool *lsc) - if (reg == IXGBE_MDIO_GLOBAL_FAULT_MSG_HI_TMP) { - /* power down the PHY in case the PHY FW didn't */ - ixgbe_set_copper_phy_power(hw, false); -- return IXGBE_ERR_OVERTEMP; -+ *is_overtemp = true; -+ return -EIO; - } - } - -@@ -2462,12 +2466,12 @@ static s32 ixgbe_get_lasi_ext_t_x550em(struct ixgbe_hw *hw, bool *lsc) - **/ - static s32 ixgbe_enable_lasi_ext_t_x550em(struct ixgbe_hw *hw) - { -+ bool lsc, overtemp; - u32 status; - u16 reg; -- bool lsc; - - /* Clear interrupt flags */ -- status = ixgbe_get_lasi_ext_t_x550em(hw, &lsc); -+ status = ixgbe_get_lasi_ext_t_x550em(hw, &lsc, &overtemp); - - /* Enable link status change alarm */ - -@@ -2546,21 +2550,20 @@ static s32 ixgbe_enable_lasi_ext_t_x550em(struct ixgbe_hw *hw) - /** - * ixgbe_handle_lasi_ext_t_x550em - Handle external Base T PHY interrupt - * @hw: pointer to hardware structure -+ * @is_overtemp: indicate whether an overtemp event encountered - * - * Handle external Base T PHY interrupt. If high temperature - * failure alarm then return error, else if link status change - * then setup internal/external PHY link -- * -- * Return IXGBE_ERR_OVERTEMP if interrupt is high temperature -- * failure alarm, else return PHY access status. - **/ --static s32 ixgbe_handle_lasi_ext_t_x550em(struct ixgbe_hw *hw) -+static s32 ixgbe_handle_lasi_ext_t_x550em(struct ixgbe_hw *hw, -+ bool *is_overtemp) - { - struct ixgbe_phy_info *phy = &hw->phy; - bool lsc; - u32 status; - -- status = ixgbe_get_lasi_ext_t_x550em(hw, &lsc); -+ status = ixgbe_get_lasi_ext_t_x550em(hw, &lsc, is_overtemp); - if (status) - return status; - -@@ -3188,21 +3191,23 @@ static s32 ixgbe_reset_phy_fw(struct ixgbe_hw *hw) - /** - * ixgbe_check_overtemp_fw - Check firmware-controlled PHYs for overtemp - * @hw: pointer to hardware structure -+ * -+ * Return true when an overtemp event detected, otherwise false. - */ --static s32 ixgbe_check_overtemp_fw(struct ixgbe_hw *hw) -+static bool ixgbe_check_overtemp_fw(struct ixgbe_hw *hw) - { - u32 store[FW_PHY_ACT_DATA_COUNT] = { 0 }; - s32 rc; - - rc = ixgbe_fw_phy_activity(hw, FW_PHY_ACT_GET_LINK_INFO, &store); - if (rc) -- return rc; -+ return false; - - if (store[0] & FW_PHY_ACT_GET_LINK_INFO_TEMP) { - ixgbe_shutdown_fw_phy(hw); -- return IXGBE_ERR_OVERTEMP; -+ return true; - } -- return 0; -+ return false; - } - - /** --- -2.43.2 - -From b355270f96ab15a0ce6673a6cce275f4402125d6 Mon Sep 17 00:00:00 2001 -From: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Date: Sat, 20 Jan 2024 18:25:36 +0100 -Subject: [PATCH 1330/1501] ixgbe: Fix an error handling path in - ixgbe_read_iosf_sb_reg_x550() -Content-Length: 1389 -Lines: 36 - -[ Upstream commit bbc404d20d1b46d89b461918bc44587620eda200 ] - -All error handling paths, except this one, go to 'out' where -release_swfw_sync() is called. -This call balances the acquire_swfw_sync() call done at the beginning of -the function. - -Branch to the error handling path in order to correctly release some -resources in case of error. - -Fixes: ae14a1d8e104 ("ixgbe: Fix IOSF SB access issues") -Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Reviewed-by: Simon Horman <horms@kernel.org> -Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel) -Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -index fe2d2d2f0494..cdc912bba808 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -@@ -717,7 +717,8 @@ static s32 ixgbe_read_iosf_sb_reg_x550(struct ixgbe_hw *hw, u32 reg_addr, - error = (command & IXGBE_SB_IOSF_CTRL_CMPL_ERR_MASK) >> - IXGBE_SB_IOSF_CTRL_CMPL_ERR_SHIFT; - hw_dbg(hw, "Failed to read, error %x\n", error); -- return -EIO; -+ ret = -EIO; -+ goto out; - } - - if (!ret) --- -2.43.2 - -From 8fea8355a91687027adde80cdaf2bbeb613f820f Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Michal=20Vok=C3=A1=C4=8D?= <michal.vokac@ysoft.com> -Date: Fri, 26 Jan 2024 11:49:35 +0100 -Subject: [PATCH 1331/1501] net: dsa: qca8k: fix illegal usage of GPIO -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 1666 -Lines: 42 - -[ Upstream commit c44fc98f0a8ffd94fa0bd291928e7e312ffc7ca4 ] - -When working with GPIO, its direction must be set either when the GPIO is -requested by gpiod_get*() or later on by one of the gpiod_direction_*() -functions. Neither of this is done here which results in undefined -behavior on some systems. - -As the reset GPIO is used right after it is requested here, it makes sense -to configure it as GPIOD_OUT_HIGH right away. With that, the following -gpiod_set_value_cansleep(1) becomes redundant and can be safely -removed. - -Fixes: a653f2f538f9 ("net: dsa: qca8k: introduce reset via gpio feature") -Signed-off-by: Michal Vokáč <michal.vokac@ysoft.com> -Reviewed-by: Andrew Lunn <andrew@lunn.ch> -Link: https://lore.kernel.org/r/1706266175-3408-1-git-send-email-michal.vokac@ysoft.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/dsa/qca/qca8k-8xxx.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c -index 5f47a290bd6e..6f2a7aee7e5a 100644 ---- a/drivers/net/dsa/qca/qca8k-8xxx.c -+++ b/drivers/net/dsa/qca/qca8k-8xxx.c -@@ -2049,12 +2049,11 @@ qca8k_sw_probe(struct mdio_device *mdiodev) - priv->info = of_device_get_match_data(priv->dev); - - priv->reset_gpio = devm_gpiod_get_optional(priv->dev, "reset", -- GPIOD_ASIS); -+ GPIOD_OUT_HIGH); - if (IS_ERR(priv->reset_gpio)) - return PTR_ERR(priv->reset_gpio); - - if (priv->reset_gpio) { -- gpiod_set_value_cansleep(priv->reset_gpio, 1); - /* The active low duration must be greater than 10 ms - * and checkpatch.pl wants 20 ms. - */ --- -2.43.2 - -From 273bc8022cb8d818b26234b36ee5b00a237677bd Mon Sep 17 00:00:00 2001 -From: Helge Deller <deller@kernel.org> -Date: Fri, 26 Jan 2024 09:32:20 +0100 -Subject: [PATCH 1332/1501] ipv6: Ensure natural alignment of const ipv6 - loopback and router addresses -Content-Length: 3337 -Lines: 69 - -[ Upstream commit 60365049ccbacd101654a66ddcb299abfabd4fc5 ] - -On a parisc64 kernel I sometimes notice this kernel warning: -Kernel unaligned access to 0x40ff8814 at ndisc_send_skb+0xc0/0x4d8 - -The address 0x40ff8814 points to the in6addr_linklocal_allrouters -variable and the warning simply means that some ipv6 function tries to -read a 64-bit word directly from the not-64-bit aligned -in6addr_linklocal_allrouters variable. - -Unaligned accesses are non-critical as the architecture or exception -handlers usually will fix it up at runtime. Nevertheless it may trigger -a performance penality for some architectures. For details read the -"unaligned-memory-access" kernel documentation. - -The patch below ensures that the ipv6 loopback and router addresses will -always be naturally aligned. This prevents the unaligned accesses for -all architectures. - -Signed-off-by: Helge Deller <deller@gmx.de> -Fixes: 034dfc5df99eb ("ipv6: export in6addr_loopback to modules") -Acked-by: Paolo Abeni <pabeni@redhat.com> -Link: https://lore.kernel.org/r/ZbNuFM1bFqoH-UoY@p100 -Signed-off-by: Paolo Abeni <pabeni@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/ipv6/addrconf_core.c | 21 ++++++++++++++------- - 1 file changed, 14 insertions(+), 7 deletions(-) - -diff --git a/net/ipv6/addrconf_core.c b/net/ipv6/addrconf_core.c -index 507a8353a6bd..c008d21925d7 100644 ---- a/net/ipv6/addrconf_core.c -+++ b/net/ipv6/addrconf_core.c -@@ -220,19 +220,26 @@ const struct ipv6_stub *ipv6_stub __read_mostly = &(struct ipv6_stub) { - EXPORT_SYMBOL_GPL(ipv6_stub); - - /* IPv6 Wildcard Address and Loopback Address defined by RFC2553 */ --const struct in6_addr in6addr_loopback = IN6ADDR_LOOPBACK_INIT; -+const struct in6_addr in6addr_loopback __aligned(BITS_PER_LONG/8) -+ = IN6ADDR_LOOPBACK_INIT; - EXPORT_SYMBOL(in6addr_loopback); --const struct in6_addr in6addr_any = IN6ADDR_ANY_INIT; -+const struct in6_addr in6addr_any __aligned(BITS_PER_LONG/8) -+ = IN6ADDR_ANY_INIT; - EXPORT_SYMBOL(in6addr_any); --const struct in6_addr in6addr_linklocal_allnodes = IN6ADDR_LINKLOCAL_ALLNODES_INIT; -+const struct in6_addr in6addr_linklocal_allnodes __aligned(BITS_PER_LONG/8) -+ = IN6ADDR_LINKLOCAL_ALLNODES_INIT; - EXPORT_SYMBOL(in6addr_linklocal_allnodes); --const struct in6_addr in6addr_linklocal_allrouters = IN6ADDR_LINKLOCAL_ALLROUTERS_INIT; -+const struct in6_addr in6addr_linklocal_allrouters __aligned(BITS_PER_LONG/8) -+ = IN6ADDR_LINKLOCAL_ALLROUTERS_INIT; - EXPORT_SYMBOL(in6addr_linklocal_allrouters); --const struct in6_addr in6addr_interfacelocal_allnodes = IN6ADDR_INTERFACELOCAL_ALLNODES_INIT; -+const struct in6_addr in6addr_interfacelocal_allnodes __aligned(BITS_PER_LONG/8) -+ = IN6ADDR_INTERFACELOCAL_ALLNODES_INIT; - EXPORT_SYMBOL(in6addr_interfacelocal_allnodes); --const struct in6_addr in6addr_interfacelocal_allrouters = IN6ADDR_INTERFACELOCAL_ALLROUTERS_INIT; -+const struct in6_addr in6addr_interfacelocal_allrouters __aligned(BITS_PER_LONG/8) -+ = IN6ADDR_INTERFACELOCAL_ALLROUTERS_INIT; - EXPORT_SYMBOL(in6addr_interfacelocal_allrouters); --const struct in6_addr in6addr_sitelocal_allrouters = IN6ADDR_SITELOCAL_ALLROUTERS_INIT; -+const struct in6_addr in6addr_sitelocal_allrouters __aligned(BITS_PER_LONG/8) -+ = IN6ADDR_SITELOCAL_ALLROUTERS_INIT; - EXPORT_SYMBOL(in6addr_sitelocal_allrouters); - - static void snmp6_free_dev(struct inet6_dev *idev) --- -2.43.2 - -From 8e51f084b5716653f19e291ed5f026791d4b3ed4 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Fri, 26 Jan 2024 16:55:32 +0000 -Subject: [PATCH 1333/1501] llc: call sock_orphan() at release time -Content-Length: 9035 -Lines: 197 - -[ Upstream commit aa2b2eb3934859904c287bf5434647ba72e14c1c ] - -syzbot reported an interesting trace [1] caused by a stale sk->sk_wq -pointer in a closed llc socket. - -In commit ff7b11aa481f ("net: socket: set sock->sk to NULL after -calling proto_ops::release()") Eric Biggers hinted that some protocols -are missing a sock_orphan(), we need to perform a full audit. - -In net-next, I plan to clear sock->sk from sock_orphan() and -amend Eric patch to add a warning. - -[1] - BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:373 [inline] - BUG: KASAN: slab-use-after-free in waitqueue_active include/linux/wait.h:127 [inline] - BUG: KASAN: slab-use-after-free in sock_def_write_space_wfree net/core/sock.c:3384 [inline] - BUG: KASAN: slab-use-after-free in sock_wfree+0x9a8/0x9d0 net/core/sock.c:2468 -Read of size 8 at addr ffff88802f4fc880 by task ksoftirqd/1/27 - -CPU: 1 PID: 27 Comm: ksoftirqd/1 Not tainted 6.8.0-rc1-syzkaller-00049-g6098d87eaf31 #0 -Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 -Call Trace: - <TASK> - __dump_stack lib/dump_stack.c:88 [inline] - dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 - print_address_description mm/kasan/report.c:377 [inline] - print_report+0xc4/0x620 mm/kasan/report.c:488 - kasan_report+0xda/0x110 mm/kasan/report.c:601 - list_empty include/linux/list.h:373 [inline] - waitqueue_active include/linux/wait.h:127 [inline] - sock_def_write_space_wfree net/core/sock.c:3384 [inline] - sock_wfree+0x9a8/0x9d0 net/core/sock.c:2468 - skb_release_head_state+0xa3/0x2b0 net/core/skbuff.c:1080 - skb_release_all net/core/skbuff.c:1092 [inline] - napi_consume_skb+0x119/0x2b0 net/core/skbuff.c:1404 - e1000_unmap_and_free_tx_resource+0x144/0x200 drivers/net/ethernet/intel/e1000/e1000_main.c:1970 - e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3860 [inline] - e1000_clean+0x4a1/0x26e0 drivers/net/ethernet/intel/e1000/e1000_main.c:3801 - __napi_poll.constprop.0+0xb4/0x540 net/core/dev.c:6576 - napi_poll net/core/dev.c:6645 [inline] - net_rx_action+0x956/0xe90 net/core/dev.c:6778 - __do_softirq+0x21a/0x8de kernel/softirq.c:553 - run_ksoftirqd kernel/softirq.c:921 [inline] - run_ksoftirqd+0x31/0x60 kernel/softirq.c:913 - smpboot_thread_fn+0x660/0xa10 kernel/smpboot.c:164 - kthread+0x2c6/0x3a0 kernel/kthread.c:388 - ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 - ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 - </TASK> - -Allocated by task 5167: - kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 - kasan_save_track+0x14/0x30 mm/kasan/common.c:68 - unpoison_slab_object mm/kasan/common.c:314 [inline] - __kasan_slab_alloc+0x81/0x90 mm/kasan/common.c:340 - kasan_slab_alloc include/linux/kasan.h:201 [inline] - slab_post_alloc_hook mm/slub.c:3813 [inline] - slab_alloc_node mm/slub.c:3860 [inline] - kmem_cache_alloc_lru+0x142/0x6f0 mm/slub.c:3879 - alloc_inode_sb include/linux/fs.h:3019 [inline] - sock_alloc_inode+0x25/0x1c0 net/socket.c:308 - alloc_inode+0x5d/0x220 fs/inode.c:260 - new_inode_pseudo+0x16/0x80 fs/inode.c:1005 - sock_alloc+0x40/0x270 net/socket.c:634 - __sock_create+0xbc/0x800 net/socket.c:1535 - sock_create net/socket.c:1622 [inline] - __sys_socket_create net/socket.c:1659 [inline] - __sys_socket+0x14c/0x260 net/socket.c:1706 - __do_sys_socket net/socket.c:1720 [inline] - __se_sys_socket net/socket.c:1718 [inline] - __x64_sys_socket+0x72/0xb0 net/socket.c:1718 - do_syscall_x64 arch/x86/entry/common.c:52 [inline] - do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83 - entry_SYSCALL_64_after_hwframe+0x63/0x6b - -Freed by task 0: - kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 - kasan_save_track+0x14/0x30 mm/kasan/common.c:68 - kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640 - poison_slab_object mm/kasan/common.c:241 [inline] - __kasan_slab_free+0x121/0x1b0 mm/kasan/common.c:257 - kasan_slab_free include/linux/kasan.h:184 [inline] - slab_free_hook mm/slub.c:2121 [inline] - slab_free mm/slub.c:4299 [inline] - kmem_cache_free+0x129/0x350 mm/slub.c:4363 - i_callback+0x43/0x70 fs/inode.c:249 - rcu_do_batch kernel/rcu/tree.c:2158 [inline] - rcu_core+0x819/0x1680 kernel/rcu/tree.c:2433 - __do_softirq+0x21a/0x8de kernel/softirq.c:553 - -Last potentially related work creation: - kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 - __kasan_record_aux_stack+0xba/0x100 mm/kasan/generic.c:586 - __call_rcu_common.constprop.0+0x9a/0x7b0 kernel/rcu/tree.c:2683 - destroy_inode+0x129/0x1b0 fs/inode.c:315 - iput_final fs/inode.c:1739 [inline] - iput.part.0+0x560/0x7b0 fs/inode.c:1765 - iput+0x5c/0x80 fs/inode.c:1755 - dentry_unlink_inode+0x292/0x430 fs/dcache.c:400 - __dentry_kill+0x1ca/0x5f0 fs/dcache.c:603 - dput.part.0+0x4ac/0x9a0 fs/dcache.c:845 - dput+0x1f/0x30 fs/dcache.c:835 - __fput+0x3b9/0xb70 fs/file_table.c:384 - task_work_run+0x14d/0x240 kernel/task_work.c:180 - exit_task_work include/linux/task_work.h:38 [inline] - do_exit+0xa8a/0x2ad0 kernel/exit.c:871 - do_group_exit+0xd4/0x2a0 kernel/exit.c:1020 - __do_sys_exit_group kernel/exit.c:1031 [inline] - __se_sys_exit_group kernel/exit.c:1029 [inline] - __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1029 - do_syscall_x64 arch/x86/entry/common.c:52 [inline] - do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83 - entry_SYSCALL_64_after_hwframe+0x63/0x6b - -The buggy address belongs to the object at ffff88802f4fc800 - which belongs to the cache sock_inode_cache of size 1408 -The buggy address is located 128 bytes inside of - freed 1408-byte region [ffff88802f4fc800, ffff88802f4fcd80) - -The buggy address belongs to the physical page: -page:ffffea0000bd3e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2f4f8 -head:ffffea0000bd3e00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 -anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) -page_type: 0xffffffff() -raw: 00fff00000000840 ffff888013b06b40 0000000000000000 0000000000000001 -raw: 0000000000000000 0000000080150015 00000001ffffffff 0000000000000000 -page dumped because: kasan: bad access detected -page_owner tracks the page as allocated -page last allocated via order 3, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_RECLAIMABLE), pid 4956, tgid 4956 (sshd), ts 31423924727, free_ts 0 - set_page_owner include/linux/page_owner.h:31 [inline] - post_alloc_hook+0x2d0/0x350 mm/page_alloc.c:1533 - prep_new_page mm/page_alloc.c:1540 [inline] - get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3311 - __alloc_pages+0x22f/0x2440 mm/page_alloc.c:4567 - __alloc_pages_node include/linux/gfp.h:238 [inline] - alloc_pages_node include/linux/gfp.h:261 [inline] - alloc_slab_page mm/slub.c:2190 [inline] - allocate_slab mm/slub.c:2354 [inline] - new_slab+0xcc/0x3a0 mm/slub.c:2407 - ___slab_alloc+0x4af/0x19a0 mm/slub.c:3540 - __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3625 - __slab_alloc_node mm/slub.c:3678 [inline] - slab_alloc_node mm/slub.c:3850 [inline] - kmem_cache_alloc_lru+0x379/0x6f0 mm/slub.c:3879 - alloc_inode_sb include/linux/fs.h:3019 [inline] - sock_alloc_inode+0x25/0x1c0 net/socket.c:308 - alloc_inode+0x5d/0x220 fs/inode.c:260 - new_inode_pseudo+0x16/0x80 fs/inode.c:1005 - sock_alloc+0x40/0x270 net/socket.c:634 - __sock_create+0xbc/0x800 net/socket.c:1535 - sock_create net/socket.c:1622 [inline] - __sys_socket_create net/socket.c:1659 [inline] - __sys_socket+0x14c/0x260 net/socket.c:1706 - __do_sys_socket net/socket.c:1720 [inline] - __se_sys_socket net/socket.c:1718 [inline] - __x64_sys_socket+0x72/0xb0 net/socket.c:1718 - do_syscall_x64 arch/x86/entry/common.c:52 [inline] - do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83 - entry_SYSCALL_64_after_hwframe+0x63/0x6b -page_owner free stack trace missing - -Memory state around the buggy address: - ffff88802f4fc780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc - ffff88802f4fc800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ->ffff88802f4fc880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb - ^ - ffff88802f4fc900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb - ffff88802f4fc980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb - -Fixes: 43815482370c ("net: sock_def_readable() and friends RCU conversion") -Reported-and-tested-by: syzbot+32b89eaa102b372ff76d@syzkaller.appspotmail.com -Signed-off-by: Eric Dumazet <edumazet@google.com> -Cc: Eric Biggers <ebiggers@google.com> -Cc: Kuniyuki Iwashima <kuniyu@amazon.com> -Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> -Link: https://lore.kernel.org/r/20240126165532.3396702-1-edumazet@google.com -Signed-off-by: Paolo Abeni <pabeni@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/llc/af_llc.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c -index 20551cfb7da6..fde1140d899e 100644 ---- a/net/llc/af_llc.c -+++ b/net/llc/af_llc.c -@@ -226,6 +226,8 @@ static int llc_ui_release(struct socket *sock) - } - netdev_put(llc->dev, &llc->dev_tracker); - sock_put(sk); -+ sock_orphan(sk); -+ sock->sk = NULL; - llc_sk_free(sk); - out: - return 0; --- -2.43.2 - -From ef95493d6814bd72fcbb8d39c201bbbcdaaa4770 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue> -Date: Sat, 27 Jan 2024 18:50:32 +0100 -Subject: [PATCH 1335/1501] bridge: mcast: fix disabled snooping after long - uptime -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 6000 -Lines: 147 - -[ Upstream commit f5c3eb4b7251baba5cd72c9e93920e710ac8194a ] - -The original idea of the delay_time check was to not apply multicast -snooping too early when an MLD querier appears. And to instead wait at -least for MLD reports to arrive before switching from flooding to group -based, MLD snooped forwarding, to avoid temporary packet loss. - -However in a batman-adv mesh network it was noticed that after 248 days of -uptime 32bit MIPS based devices would start to signal that they had -stopped applying multicast snooping due to missing queriers - even though -they were the elected querier and still sending MLD queries themselves. - -While time_is_before_jiffies() generally is safe against jiffies -wrap-arounds, like the code comments in jiffies.h explain, it won't -be able to track a difference larger than ULONG_MAX/2. With a 32bit -large jiffies and one jiffies tick every 10ms (CONFIG_HZ=100) on these MIPS -devices running OpenWrt this would result in a difference larger than -ULONG_MAX/2 after 248 (= 2^32/100/60/60/24/2) days and -time_is_before_jiffies() would then start to return false instead of -true. Leading to multicast snooping not being applied to multicast -packets anymore. - -Fix this issue by using a proper timer_list object which won't have this -ULONG_MAX/2 difference limitation. - -Fixes: b00589af3b04 ("bridge: disable snooping if there is no querier") -Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue> -Acked-by: Nikolay Aleksandrov <razor@blackwall.org> -Link: https://lore.kernel.org/r/20240127175033.9640-1-linus.luessing@c0d3.blue -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/bridge/br_multicast.c | 20 +++++++++++++++----- - net/bridge/br_private.h | 4 ++-- - 2 files changed, 17 insertions(+), 7 deletions(-) - -diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c -index d7d021af1029..2d7b73242958 100644 ---- a/net/bridge/br_multicast.c -+++ b/net/bridge/br_multicast.c -@@ -1762,6 +1762,10 @@ static void br_ip6_multicast_querier_expired(struct timer_list *t) - } - #endif - -+static void br_multicast_query_delay_expired(struct timer_list *t) -+{ -+} -+ - static void br_multicast_select_own_querier(struct net_bridge_mcast *brmctx, - struct br_ip *ip, - struct sk_buff *skb) -@@ -3198,7 +3202,7 @@ br_multicast_update_query_timer(struct net_bridge_mcast *brmctx, - unsigned long max_delay) - { - if (!timer_pending(&query->timer)) -- query->delay_time = jiffies + max_delay; -+ mod_timer(&query->delay_timer, jiffies + max_delay); - - mod_timer(&query->timer, jiffies + brmctx->multicast_querier_interval); - } -@@ -4041,13 +4045,11 @@ void br_multicast_ctx_init(struct net_bridge *br, - brmctx->multicast_querier_interval = 255 * HZ; - brmctx->multicast_membership_interval = 260 * HZ; - -- brmctx->ip4_other_query.delay_time = 0; - brmctx->ip4_querier.port_ifidx = 0; - seqcount_spinlock_init(&brmctx->ip4_querier.seq, &br->multicast_lock); - brmctx->multicast_igmp_version = 2; - #if IS_ENABLED(CONFIG_IPV6) - brmctx->multicast_mld_version = 1; -- brmctx->ip6_other_query.delay_time = 0; - brmctx->ip6_querier.port_ifidx = 0; - seqcount_spinlock_init(&brmctx->ip6_querier.seq, &br->multicast_lock); - #endif -@@ -4056,6 +4058,8 @@ void br_multicast_ctx_init(struct net_bridge *br, - br_ip4_multicast_local_router_expired, 0); - timer_setup(&brmctx->ip4_other_query.timer, - br_ip4_multicast_querier_expired, 0); -+ timer_setup(&brmctx->ip4_other_query.delay_timer, -+ br_multicast_query_delay_expired, 0); - timer_setup(&brmctx->ip4_own_query.timer, - br_ip4_multicast_query_expired, 0); - #if IS_ENABLED(CONFIG_IPV6) -@@ -4063,6 +4067,8 @@ void br_multicast_ctx_init(struct net_bridge *br, - br_ip6_multicast_local_router_expired, 0); - timer_setup(&brmctx->ip6_other_query.timer, - br_ip6_multicast_querier_expired, 0); -+ timer_setup(&brmctx->ip6_other_query.delay_timer, -+ br_multicast_query_delay_expired, 0); - timer_setup(&brmctx->ip6_own_query.timer, - br_ip6_multicast_query_expired, 0); - #endif -@@ -4197,10 +4203,12 @@ static void __br_multicast_stop(struct net_bridge_mcast *brmctx) - { - del_timer_sync(&brmctx->ip4_mc_router_timer); - del_timer_sync(&brmctx->ip4_other_query.timer); -+ del_timer_sync(&brmctx->ip4_other_query.delay_timer); - del_timer_sync(&brmctx->ip4_own_query.timer); - #if IS_ENABLED(CONFIG_IPV6) - del_timer_sync(&brmctx->ip6_mc_router_timer); - del_timer_sync(&brmctx->ip6_other_query.timer); -+ del_timer_sync(&brmctx->ip6_other_query.delay_timer); - del_timer_sync(&brmctx->ip6_own_query.timer); - #endif - } -@@ -4643,13 +4651,15 @@ int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val) - max_delay = brmctx->multicast_query_response_interval; - - if (!timer_pending(&brmctx->ip4_other_query.timer)) -- brmctx->ip4_other_query.delay_time = jiffies + max_delay; -+ mod_timer(&brmctx->ip4_other_query.delay_timer, -+ jiffies + max_delay); - - br_multicast_start_querier(brmctx, &brmctx->ip4_own_query); - - #if IS_ENABLED(CONFIG_IPV6) - if (!timer_pending(&brmctx->ip6_other_query.timer)) -- brmctx->ip6_other_query.delay_time = jiffies + max_delay; -+ mod_timer(&brmctx->ip6_other_query.delay_timer, -+ jiffies + max_delay); - - br_multicast_start_querier(brmctx, &brmctx->ip6_own_query); - #endif -diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h -index 6b7f36769d03..f317d8295bf4 100644 ---- a/net/bridge/br_private.h -+++ b/net/bridge/br_private.h -@@ -78,7 +78,7 @@ struct bridge_mcast_own_query { - /* other querier */ - struct bridge_mcast_other_query { - struct timer_list timer; -- unsigned long delay_time; -+ struct timer_list delay_timer; - }; - - /* selected querier */ -@@ -1155,7 +1155,7 @@ __br_multicast_querier_exists(struct net_bridge_mcast *brmctx, - own_querier_enabled = false; - } - -- return time_is_before_jiffies(querier->delay_time) && -+ return !timer_pending(&querier->delay_timer) && - (own_querier_enabled || timer_pending(&querier->timer)); - } - --- -2.43.2 - -From 086160d08a1a369d83fb82f3eed6f0a49fcff056 Mon Sep 17 00:00:00 2001 -From: Parav Pandit <parav@nvidia.com> -Date: Mon, 29 Jan 2024 21:10:59 +0200 -Subject: [PATCH 1336/1501] devlink: Fix referring to hw_addr attribute during - state validation -Content-Length: 1265 -Lines: 33 - -[ Upstream commit 1a89e24f8bfd3e3562d69709c9d9cd185ded869b ] - -When port function state change is requested, and when the driver -does not support it, it refers to the hw address attribute instead -of state attribute. Seems like a copy paste error. - -Fix it by referring to the port function state attribute. - -Fixes: c0bea69d1ca7 ("devlink: Validate port function request") -Signed-off-by: Parav Pandit <parav@nvidia.com> -Reviewed-by: Jiri Pirko <jiri@nvidia.com> -Link: https://lore.kernel.org/r/20240129191059.129030-1-parav@nvidia.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/devlink/port.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/devlink/port.c b/net/devlink/port.c -index 7634f187fa50..841a3eafa328 100644 ---- a/net/devlink/port.c -+++ b/net/devlink/port.c -@@ -672,7 +672,7 @@ static int devlink_port_function_validate(struct devlink_port *devlink_port, - return -EOPNOTSUPP; - } - if (tb[DEVLINK_PORT_FN_ATTR_STATE] && !ops->port_fn_state_set) { -- NL_SET_ERR_MSG_ATTR(extack, tb[DEVLINK_PORT_FUNCTION_ATTR_HW_ADDR], -+ NL_SET_ERR_MSG_ATTR(extack, tb[DEVLINK_PORT_FN_ATTR_STATE], - "Function does not support state setting"); - return -EOPNOTSUPP; - } --- -2.43.2 - -From 03dc4dbcca5d408ebe978cb26ca7cfeb9314bd30 Mon Sep 17 00:00:00 2001 -From: Ryan Schaefer <ryanschf@amazon.com> -Date: Sun, 21 Jan 2024 21:51:44 +0000 -Subject: [PATCH 1338/1501] netfilter: conntrack: correct window scaling with - retransmitted SYN -Content-Length: 3100 -Lines: 76 - -[ Upstream commit fb366fc7541a1de521ab3df58471746aa793b833 ] - -commit c7aab4f17021 ("netfilter: nf_conntrack_tcp: re-init for syn packets -only") introduces a bug where SYNs in ORIGINAL direction on reused 5-tuple -result in incorrect window scale negotiation. This commit merged the SYN -re-initialization and simultaneous open or SYN retransmits cases. Merging -this block added the logic in tcp_init_sender() that performed window scale -negotiation to the retransmitted syn case. Previously. this would only -result in updating the sender's scale and flags. After the merge the -additional logic results in improperly clearing the scale in ORIGINAL -direction before any packets in the REPLY direction are received. This -results in packets incorrectly being marked invalid for being -out-of-window. - -This can be reproduced with the following trace: - -Packet Sequence: -> Flags [S], seq 1687765604, win 62727, options [.. wscale 7], length 0 -> Flags [S], seq 1944817196, win 62727, options [.. wscale 7], length 0 - -In order to fix the issue, only evaluate window negotiation for packets -in the REPLY direction. This was tested with simultaneous open, fast -open, and the above reproduction. - -Fixes: c7aab4f17021 ("netfilter: nf_conntrack_tcp: re-init for syn packets only") -Signed-off-by: Ryan Schaefer <ryanschf@amazon.com> -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nf_conntrack_proto_tcp.c | 10 ++++++---- - 1 file changed, 6 insertions(+), 4 deletions(-) - -diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c -index e573be5afde7..ae493599a3ef 100644 ---- a/net/netfilter/nf_conntrack_proto_tcp.c -+++ b/net/netfilter/nf_conntrack_proto_tcp.c -@@ -457,7 +457,8 @@ static void tcp_init_sender(struct ip_ct_tcp_state *sender, - const struct sk_buff *skb, - unsigned int dataoff, - const struct tcphdr *tcph, -- u32 end, u32 win) -+ u32 end, u32 win, -+ enum ip_conntrack_dir dir) - { - /* SYN-ACK in reply to a SYN - * or SYN from reply direction in simultaneous open. -@@ -471,7 +472,8 @@ static void tcp_init_sender(struct ip_ct_tcp_state *sender, - * Both sides must send the Window Scale option - * to enable window scaling in either direction. - */ -- if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE && -+ if (dir == IP_CT_DIR_REPLY && -+ !(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE && - receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE)) { - sender->td_scale = 0; - receiver->td_scale = 0; -@@ -542,7 +544,7 @@ tcp_in_window(struct nf_conn *ct, enum ip_conntrack_dir dir, - if (tcph->syn) { - tcp_init_sender(sender, receiver, - skb, dataoff, tcph, -- end, win); -+ end, win, dir); - if (!tcph->ack) - /* Simultaneous open */ - return NFCT_TCP_ACCEPT; -@@ -585,7 +587,7 @@ tcp_in_window(struct nf_conn *ct, enum ip_conntrack_dir dir, - */ - tcp_init_sender(sender, receiver, - skb, dataoff, tcph, -- end, win); -+ end, win, dir); - - if (dir == IP_CT_DIR_REPLY && !tcph->ack) - return NFCT_TCP_ACCEPT; --- -2.43.2 - -From 83505390aa28482a0deebb5866596a133101279b Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso <pablo@netfilter.org> -Date: Tue, 23 Jan 2024 23:45:32 +0100 -Subject: [PATCH 1339/1501] netfilter: nf_tables: restrict tunnel object to - NFPROTO_NETDEV -Content-Length: 3534 -Lines: 101 - -[ Upstream commit 776d451648443f9884be4a1b4e38e8faf1c621f9 ] - -Bail out on using the tunnel dst template from other than netdev family. -Add the infrastructure to check for the family in objects. - -Fixes: af308b94a2a4 ("netfilter: nf_tables: add tunnel support") -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/net/netfilter/nf_tables.h | 2 ++ - net/netfilter/nf_tables_api.c | 14 +++++++++----- - net/netfilter/nft_tunnel.c | 1 + - 3 files changed, 12 insertions(+), 5 deletions(-) - -diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h -index b157c5cafd14..4e8ecabc5f25 100644 ---- a/include/net/netfilter/nf_tables.h -+++ b/include/net/netfilter/nf_tables.h -@@ -1322,6 +1322,7 @@ void nft_obj_notify(struct net *net, const struct nft_table *table, - * @type: stateful object numeric type - * @owner: module owner - * @maxattr: maximum netlink attribute -+ * @family: address family for AF-specific object types - * @policy: netlink attribute policy - */ - struct nft_object_type { -@@ -1331,6 +1332,7 @@ struct nft_object_type { - struct list_head list; - u32 type; - unsigned int maxattr; -+ u8 family; - struct module *owner; - const struct nla_policy *policy; - }; -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 6a987b36d0bb..0e07f110a539 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -7468,11 +7468,15 @@ static int nft_object_dump(struct sk_buff *skb, unsigned int attr, - return -1; - } - --static const struct nft_object_type *__nft_obj_type_get(u32 objtype) -+static const struct nft_object_type *__nft_obj_type_get(u32 objtype, u8 family) - { - const struct nft_object_type *type; - - list_for_each_entry(type, &nf_tables_objects, list) { -+ if (type->family != NFPROTO_UNSPEC && -+ type->family != family) -+ continue; -+ - if (objtype == type->type) - return type; - } -@@ -7480,11 +7484,11 @@ static const struct nft_object_type *__nft_obj_type_get(u32 objtype) - } - - static const struct nft_object_type * --nft_obj_type_get(struct net *net, u32 objtype) -+nft_obj_type_get(struct net *net, u32 objtype, u8 family) - { - const struct nft_object_type *type; - -- type = __nft_obj_type_get(objtype); -+ type = __nft_obj_type_get(objtype, family); - if (type != NULL && try_module_get(type->owner)) - return type; - -@@ -7577,7 +7581,7 @@ static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info, - if (info->nlh->nlmsg_flags & NLM_F_REPLACE) - return -EOPNOTSUPP; - -- type = __nft_obj_type_get(objtype); -+ type = __nft_obj_type_get(objtype, family); - if (WARN_ON_ONCE(!type)) - return -ENOENT; - -@@ -7591,7 +7595,7 @@ static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info, - if (!nft_use_inc(&table->use)) - return -EMFILE; - -- type = nft_obj_type_get(net, objtype); -+ type = nft_obj_type_get(net, objtype, family); - if (IS_ERR(type)) { - err = PTR_ERR(type); - goto err_type; -diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c -index 9f21953c7433..f735d79d8be5 100644 ---- a/net/netfilter/nft_tunnel.c -+++ b/net/netfilter/nft_tunnel.c -@@ -713,6 +713,7 @@ static const struct nft_object_ops nft_tunnel_obj_ops = { - - static struct nft_object_type nft_tunnel_obj_type __read_mostly = { - .type = NFT_OBJECT_TUNNEL, -+ .family = NFPROTO_NETDEV, - .ops = &nft_tunnel_obj_ops, - .maxattr = NFTA_TUNNEL_KEY_MAX, - .policy = nft_tunnel_key_policy, --- -2.43.2 - -From 1c856889fe5fa106f16385646360704a2b25415a Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso <pablo@netfilter.org> -Date: Mon, 29 Jan 2024 11:09:43 +0100 -Subject: [PATCH 1340/1501] netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE - when putting logger -Content-Length: 1114 -Lines: 38 - -[ Upstream commit 259eb32971e9eb24d1777a28d82730659f50fdcb ] - -Module reference is bumped for each user, this should not ever happen. - -But BUG_ON check should use rcu_access_pointer() instead. - -If this ever happens, do WARN_ON_ONCE() instead of BUG_ON() and -consolidate pointer check under the rcu read side lock section. - -Fixes: fab4085f4e24 ("netfilter: log: nf_log_packet() as real unified interface") -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nf_log.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c -index 8cc52d2bd31b..e16f158388bb 100644 ---- a/net/netfilter/nf_log.c -+++ b/net/netfilter/nf_log.c -@@ -193,11 +193,12 @@ void nf_logger_put(int pf, enum nf_log_type type) - return; - } - -- BUG_ON(loggers[pf][type] == NULL); -- - rcu_read_lock(); - logger = rcu_dereference(loggers[pf][type]); -- module_put(logger->me); -+ if (!logger) -+ WARN_ON_ONCE(1); -+ else -+ module_put(logger->me); - rcu_read_unlock(); - } - EXPORT_SYMBOL_GPL(nf_logger_put); --- -2.43.2 - -From 38cc1605338d99205a263707f4dde76408d3e0e8 Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso <pablo@netfilter.org> -Date: Mon, 29 Jan 2024 13:12:33 +0100 -Subject: [PATCH 1341/1501] netfilter: nft_ct: sanitize layer 3 and 4 protocol - number in custom expectations -Content-Length: 1471 -Lines: 51 - -[ Upstream commit 8059918a1377f2f1fff06af4f5a4ed3d5acd6bc4 ] - -- Disallow families other than NFPROTO_{IPV4,IPV6,INET}. -- Disallow layer 4 protocol with no ports, since destination port is a - mandatory attribute for this object. - -Fixes: 857b46027d6f ("netfilter: nft_ct: add ct expectations support") -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nft_ct.c | 24 ++++++++++++++++++++++++ - 1 file changed, 24 insertions(+) - -diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c -index 86bb9d7797d9..aac98a3c966e 100644 ---- a/net/netfilter/nft_ct.c -+++ b/net/netfilter/nft_ct.c -@@ -1250,7 +1250,31 @@ static int nft_ct_expect_obj_init(const struct nft_ctx *ctx, - if (tb[NFTA_CT_EXPECT_L3PROTO]) - priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO])); - -+ switch (priv->l3num) { -+ case NFPROTO_IPV4: -+ case NFPROTO_IPV6: -+ if (priv->l3num != ctx->family) -+ return -EINVAL; -+ -+ fallthrough; -+ case NFPROTO_INET: -+ break; -+ default: -+ return -EOPNOTSUPP; -+ } -+ - priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]); -+ switch (priv->l4proto) { -+ case IPPROTO_TCP: -+ case IPPROTO_UDP: -+ case IPPROTO_UDPLITE: -+ case IPPROTO_DCCP: -+ case IPPROTO_SCTP: -+ break; -+ default: -+ return -EOPNOTSUPP; -+ } -+ - priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]); - priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]); - priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]); --- -2.43.2 - -From 205659dbb880b23a680e87dd1c814b97fc72be3d Mon Sep 17 00:00:00 2001 -From: Zhipeng Lu <alexious@zju.edu.cn> -Date: Mon, 29 Jan 2024 17:10:17 +0800 -Subject: [PATCH 1342/1501] net: ipv4: fix a memleak in ip_setup_cork -Content-Length: 1460 -Lines: 47 - -[ Upstream commit 5dee6d6923458e26966717f2a3eae7d09fc10bf6 ] - -When inetdev_valid_mtu fails, cork->opt should be freed if it is -allocated in ip_setup_cork. Otherwise there could be a memleak. - -Fixes: 501a90c94510 ("inet: protect against too small mtu values.") -Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn> -Reviewed-by: Eric Dumazet <edumazet@google.com> -Link: https://lore.kernel.org/r/20240129091017.2938835-1-alexious@zju.edu.cn -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/ipv4/ip_output.c | 12 ++++++------ - 1 file changed, 6 insertions(+), 6 deletions(-) - -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index b06f678b03a1..41537d18eecf 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -1287,6 +1287,12 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork, - if (unlikely(!rt)) - return -EFAULT; - -+ cork->fragsize = ip_sk_use_pmtu(sk) ? -+ dst_mtu(&rt->dst) : READ_ONCE(rt->dst.dev->mtu); -+ -+ if (!inetdev_valid_mtu(cork->fragsize)) -+ return -ENETUNREACH; -+ - /* - * setup for corking. - */ -@@ -1303,12 +1309,6 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork, - cork->addr = ipc->addr; - } - -- cork->fragsize = ip_sk_use_pmtu(sk) ? -- dst_mtu(&rt->dst) : READ_ONCE(rt->dst.dev->mtu); -- -- if (!inetdev_valid_mtu(cork->fragsize)) -- return -ENETUNREACH; -- - cork->gso_size = ipc->gso_size; - - cork->dst = &rt->dst; --- -2.43.2 - -From c2d272a9a1e8f22ba584589219f6fe1886a3595f Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Tue, 30 Jan 2024 18:42:35 +0000 -Subject: [PATCH 1343/1501] af_unix: fix lockdep positive in - sk_diag_dump_icons() -Content-Length: 9562 -Lines: 235 - -[ Upstream commit 4d322dce82a1d44f8c83f0f54f95dd1b8dcf46c9 ] - -syzbot reported a lockdep splat [1]. - -Blamed commit hinted about the possible lockdep -violation, and code used unix_state_lock_nested() -in an attempt to silence lockdep. - -It is not sufficient, because unix_state_lock_nested() -is already used from unix_state_double_lock(). - -We need to use a separate subclass. - -This patch adds a distinct enumeration to make things -more explicit. - -Also use swap() in unix_state_double_lock() as a clean up. - -v2: add a missing inline keyword to unix_state_lock_nested() - -[1] -WARNING: possible circular locking dependency detected -6.8.0-rc1-syzkaller-00356-g8a696a29c690 #0 Not tainted - -syz-executor.1/2542 is trying to acquire lock: - ffff88808b5df9e8 (rlock-AF_UNIX){+.+.}-{2:2}, at: skb_queue_tail+0x36/0x120 net/core/skbuff.c:3863 - -but task is already holding lock: - ffff88808b5dfe70 (&u->lock/1){+.+.}-{2:2}, at: unix_dgram_sendmsg+0xfc7/0x2200 net/unix/af_unix.c:2089 - -which lock already depends on the new lock. - -the existing dependency chain (in reverse order) is: - --> #1 (&u->lock/1){+.+.}-{2:2}: - lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754 - _raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378 - sk_diag_dump_icons net/unix/diag.c:87 [inline] - sk_diag_fill+0x6ea/0xfe0 net/unix/diag.c:157 - sk_diag_dump net/unix/diag.c:196 [inline] - unix_diag_dump+0x3e9/0x630 net/unix/diag.c:220 - netlink_dump+0x5c1/0xcd0 net/netlink/af_netlink.c:2264 - __netlink_dump_start+0x5d7/0x780 net/netlink/af_netlink.c:2370 - netlink_dump_start include/linux/netlink.h:338 [inline] - unix_diag_handler_dump+0x1c3/0x8f0 net/unix/diag.c:319 - sock_diag_rcv_msg+0xe3/0x400 - netlink_rcv_skb+0x1df/0x430 net/netlink/af_netlink.c:2543 - sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:280 - netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] - netlink_unicast+0x7e6/0x980 net/netlink/af_netlink.c:1367 - netlink_sendmsg+0xa37/0xd70 net/netlink/af_netlink.c:1908 - sock_sendmsg_nosec net/socket.c:730 [inline] - __sock_sendmsg net/socket.c:745 [inline] - sock_write_iter+0x39a/0x520 net/socket.c:1160 - call_write_iter include/linux/fs.h:2085 [inline] - new_sync_write fs/read_write.c:497 [inline] - vfs_write+0xa74/0xca0 fs/read_write.c:590 - ksys_write+0x1a0/0x2c0 fs/read_write.c:643 - do_syscall_x64 arch/x86/entry/common.c:52 [inline] - do_syscall_64+0xf5/0x230 arch/x86/entry/common.c:83 - entry_SYSCALL_64_after_hwframe+0x63/0x6b - --> #0 (rlock-AF_UNIX){+.+.}-{2:2}: - check_prev_add kernel/locking/lockdep.c:3134 [inline] - check_prevs_add kernel/locking/lockdep.c:3253 [inline] - validate_chain+0x1909/0x5ab0 kernel/locking/lockdep.c:3869 - __lock_acquire+0x1345/0x1fd0 kernel/locking/lockdep.c:5137 - lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754 - __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] - _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 - skb_queue_tail+0x36/0x120 net/core/skbuff.c:3863 - unix_dgram_sendmsg+0x15d9/0x2200 net/unix/af_unix.c:2112 - sock_sendmsg_nosec net/socket.c:730 [inline] - __sock_sendmsg net/socket.c:745 [inline] - ____sys_sendmsg+0x592/0x890 net/socket.c:2584 - ___sys_sendmsg net/socket.c:2638 [inline] - __sys_sendmmsg+0x3b2/0x730 net/socket.c:2724 - __do_sys_sendmmsg net/socket.c:2753 [inline] - __se_sys_sendmmsg net/socket.c:2750 [inline] - __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2750 - do_syscall_x64 arch/x86/entry/common.c:52 [inline] - do_syscall_64+0xf5/0x230 arch/x86/entry/common.c:83 - entry_SYSCALL_64_after_hwframe+0x63/0x6b - -other info that might help us debug this: - - Possible unsafe locking scenario: - - CPU0 CPU1 - ---- ---- - lock(&u->lock/1); - lock(rlock-AF_UNIX); - lock(&u->lock/1); - lock(rlock-AF_UNIX); - - *** DEADLOCK *** - -1 lock held by syz-executor.1/2542: - #0: ffff88808b5dfe70 (&u->lock/1){+.+.}-{2:2}, at: unix_dgram_sendmsg+0xfc7/0x2200 net/unix/af_unix.c:2089 - -stack backtrace: -CPU: 1 PID: 2542 Comm: syz-executor.1 Not tainted 6.8.0-rc1-syzkaller-00356-g8a696a29c690 #0 -Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 -Call Trace: - <TASK> - __dump_stack lib/dump_stack.c:88 [inline] - dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 - check_noncircular+0x366/0x490 kernel/locking/lockdep.c:2187 - check_prev_add kernel/locking/lockdep.c:3134 [inline] - check_prevs_add kernel/locking/lockdep.c:3253 [inline] - validate_chain+0x1909/0x5ab0 kernel/locking/lockdep.c:3869 - __lock_acquire+0x1345/0x1fd0 kernel/locking/lockdep.c:5137 - lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754 - __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] - _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 - skb_queue_tail+0x36/0x120 net/core/skbuff.c:3863 - unix_dgram_sendmsg+0x15d9/0x2200 net/unix/af_unix.c:2112 - sock_sendmsg_nosec net/socket.c:730 [inline] - __sock_sendmsg net/socket.c:745 [inline] - ____sys_sendmsg+0x592/0x890 net/socket.c:2584 - ___sys_sendmsg net/socket.c:2638 [inline] - __sys_sendmmsg+0x3b2/0x730 net/socket.c:2724 - __do_sys_sendmmsg net/socket.c:2753 [inline] - __se_sys_sendmmsg net/socket.c:2750 [inline] - __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2750 - do_syscall_x64 arch/x86/entry/common.c:52 [inline] - do_syscall_64+0xf5/0x230 arch/x86/entry/common.c:83 - entry_SYSCALL_64_after_hwframe+0x63/0x6b -RIP: 0033:0x7f26d887cda9 -Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 -RSP: 002b:00007f26d95a60c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 -RAX: ffffffffffffffda RBX: 00007f26d89abf80 RCX: 00007f26d887cda9 -RDX: 000000000000003e RSI: 00000000200bd000 RDI: 0000000000000004 -RBP: 00007f26d88c947a R08: 0000000000000000 R09: 0000000000000000 -R10: 00000000000008c0 R11: 0000000000000246 R12: 0000000000000000 -R13: 000000000000000b R14: 00007f26d89abf80 R15: 00007ffcfe081a68 - -Fixes: 2aac7a2cb0d9 ("unix_diag: Pending connections IDs NLA") -Reported-by: syzbot <syzkaller@googlegroups.com> -Signed-off-by: Eric Dumazet <edumazet@google.com> -Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> -Link: https://lore.kernel.org/r/20240130184235.1620738-1-edumazet@google.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/net/af_unix.h | 20 ++++++++++++++------ - net/unix/af_unix.c | 14 ++++++-------- - net/unix/diag.c | 2 +- - 3 files changed, 21 insertions(+), 15 deletions(-) - -diff --git a/include/net/af_unix.h b/include/net/af_unix.h -index 49c4640027d8..afd40dce40f3 100644 ---- a/include/net/af_unix.h -+++ b/include/net/af_unix.h -@@ -46,12 +46,6 @@ struct scm_stat { - - #define UNIXCB(skb) (*(struct unix_skb_parms *)&((skb)->cb)) - --#define unix_state_lock(s) spin_lock(&unix_sk(s)->lock) --#define unix_state_unlock(s) spin_unlock(&unix_sk(s)->lock) --#define unix_state_lock_nested(s) \ -- spin_lock_nested(&unix_sk(s)->lock, \ -- SINGLE_DEPTH_NESTING) -- - /* The AF_UNIX socket */ - struct unix_sock { - /* WARNING: sk has to be the first member */ -@@ -77,6 +71,20 @@ struct unix_sock { - #define unix_sk(ptr) container_of_const(ptr, struct unix_sock, sk) - #define unix_peer(sk) (unix_sk(sk)->peer) - -+#define unix_state_lock(s) spin_lock(&unix_sk(s)->lock) -+#define unix_state_unlock(s) spin_unlock(&unix_sk(s)->lock) -+enum unix_socket_lock_class { -+ U_LOCK_NORMAL, -+ U_LOCK_SECOND, /* for double locking, see unix_state_double_lock(). */ -+ U_LOCK_DIAG, /* used while dumping icons, see sk_diag_dump_icons(). */ -+}; -+ -+static inline void unix_state_lock_nested(struct sock *sk, -+ enum unix_socket_lock_class subclass) -+{ -+ spin_lock_nested(&unix_sk(sk)->lock, subclass); -+} -+ - #define peer_wait peer_wq.wait - - long unix_inq_len(struct sock *sk); -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index ac1f2bc18fc9..30b178ebba60 100644 ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -1344,13 +1344,11 @@ static void unix_state_double_lock(struct sock *sk1, struct sock *sk2) - unix_state_lock(sk1); - return; - } -- if (sk1 < sk2) { -- unix_state_lock(sk1); -- unix_state_lock_nested(sk2); -- } else { -- unix_state_lock(sk2); -- unix_state_lock_nested(sk1); -- } -+ if (sk1 > sk2) -+ swap(sk1, sk2); -+ -+ unix_state_lock(sk1); -+ unix_state_lock_nested(sk2, U_LOCK_SECOND); - } - - static void unix_state_double_unlock(struct sock *sk1, struct sock *sk2) -@@ -1591,7 +1589,7 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr, - goto out_unlock; - } - -- unix_state_lock_nested(sk); -+ unix_state_lock_nested(sk, U_LOCK_SECOND); - - if (sk->sk_state != st) { - unix_state_unlock(sk); -diff --git a/net/unix/diag.c b/net/unix/diag.c -index bec09a3a1d44..be19827eca36 100644 ---- a/net/unix/diag.c -+++ b/net/unix/diag.c -@@ -84,7 +84,7 @@ static int sk_diag_dump_icons(struct sock *sk, struct sk_buff *nlskb) - * queue lock. With the other's queue locked it's - * OK to lock the state. - */ -- unix_state_lock_nested(req); -+ unix_state_lock_nested(req, U_LOCK_DIAG); - peer = unix_sk(req)->peer; - buf[i++] = (peer ? sock_i_ino(peer) : 0); - unix_state_unlock(req); --- -2.43.2 - -From 46826a3844068c0d3919eb4a24c3ba7bf5d24449 Mon Sep 17 00:00:00 2001 -From: Brett Creeley <brett.creeley@amd.com> -Date: Mon, 29 Jan 2024 15:40:30 -0800 -Subject: [PATCH 1344/1501] pds_core: Prevent health thread from running during - reset/remove -Content-Length: 2509 -Lines: 78 - -[ Upstream commit d9407ff11809c6812bb84fe7be9c1367d758e5c8 ] - -The PCIe reset handlers can run at the same time as the -health thread. This can cause the health thread to -stomp on the PCIe reset. Fix this by preventing the -health thread from running while a PCIe reset is happening. - -As part of this use timer_shutdown_sync() during reset and -remove to make sure the timer doesn't ever get rearmed. - -Fixes: ffa55858330f ("pds_core: implement pci reset handlers") -Signed-off-by: Brett Creeley <brett.creeley@amd.com> -Reviewed-by: Shannon Nelson <shannon.nelson@amd.com> -Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> -Link: https://lore.kernel.org/r/20240129234035.69802-2-brett.creeley@amd.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/amd/pds_core/main.c | 19 +++++++++++++++++-- - 1 file changed, 17 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/ethernet/amd/pds_core/main.c b/drivers/net/ethernet/amd/pds_core/main.c -index 3080898d7b95..5172a5ad8ec6 100644 ---- a/drivers/net/ethernet/amd/pds_core/main.c -+++ b/drivers/net/ethernet/amd/pds_core/main.c -@@ -293,7 +293,7 @@ static int pdsc_init_pf(struct pdsc *pdsc) - err_out_teardown: - pdsc_teardown(pdsc, PDSC_TEARDOWN_REMOVING); - err_out_unmap_bars: -- del_timer_sync(&pdsc->wdtimer); -+ timer_shutdown_sync(&pdsc->wdtimer); - if (pdsc->wq) - destroy_workqueue(pdsc->wq); - mutex_destroy(&pdsc->config_lock); -@@ -420,7 +420,7 @@ static void pdsc_remove(struct pci_dev *pdev) - */ - pdsc_sriov_configure(pdev, 0); - -- del_timer_sync(&pdsc->wdtimer); -+ timer_shutdown_sync(&pdsc->wdtimer); - if (pdsc->wq) - destroy_workqueue(pdsc->wq); - -@@ -445,10 +445,24 @@ static void pdsc_remove(struct pci_dev *pdev) - devlink_free(dl); - } - -+static void pdsc_stop_health_thread(struct pdsc *pdsc) -+{ -+ timer_shutdown_sync(&pdsc->wdtimer); -+ if (pdsc->health_work.func) -+ cancel_work_sync(&pdsc->health_work); -+} -+ -+static void pdsc_restart_health_thread(struct pdsc *pdsc) -+{ -+ timer_setup(&pdsc->wdtimer, pdsc_wdtimer_cb, 0); -+ mod_timer(&pdsc->wdtimer, jiffies + 1); -+} -+ - void pdsc_reset_prepare(struct pci_dev *pdev) - { - struct pdsc *pdsc = pci_get_drvdata(pdev); - -+ pdsc_stop_health_thread(pdsc); - pdsc_fw_down(pdsc); - - pci_free_irq_vectors(pdev); -@@ -486,6 +500,7 @@ void pdsc_reset_done(struct pci_dev *pdev) - } - - pdsc_fw_up(pdsc); -+ pdsc_restart_health_thread(pdsc); - } - - static const struct pci_error_handlers pdsc_err_handler = { --- -2.43.2 - -From 26621164707b90dfcd122bb82b063b8ecd7280f9 Mon Sep 17 00:00:00 2001 -From: Brett Creeley <brett.creeley@amd.com> -Date: Mon, 29 Jan 2024 15:40:31 -0800 -Subject: [PATCH 1345/1501] pds_core: Cancel AQ work on teardown -Content-Length: 1811 -Lines: 45 - -[ Upstream commit d321067e2cfa4d5e45401a00912ca9da8d1af631 ] - -There is a small window where pdsc_work_thread() -calls pdsc_process_adminq() and pdsc_process_adminq() -passes the PDSC_S_STOPPING_DRIVER check and starts -to process adminq/notifyq work and then the driver -starts a fw_down cycle. This could cause some -undefined behavior if the notifyqcq/adminqcq are -free'd while pdsc_process_adminq() is running. Use -cancel_work_sync() on the adminqcq's work struct -to make sure any pending work items are cancelled -and any in progress work items are completed. - -Also, make sure to not call cancel_work_sync() if -the work item has not be initialized. Without this, -traces will happen in cases where a reset fails and -teardown is called again or if reset fails and the -driver is removed. - -Fixes: 01ba61b55b20 ("pds_core: Add adminq processing and commands") -Signed-off-by: Brett Creeley <brett.creeley@amd.com> -Reviewed-by: Shannon Nelson <shannon.nelson@amd.com> -Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> -Link: https://lore.kernel.org/r/20240129234035.69802-3-brett.creeley@amd.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/amd/pds_core/core.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/net/ethernet/amd/pds_core/core.c b/drivers/net/ethernet/amd/pds_core/core.c -index 0d2091e9eb28..b582729331eb 100644 ---- a/drivers/net/ethernet/amd/pds_core/core.c -+++ b/drivers/net/ethernet/amd/pds_core/core.c -@@ -464,6 +464,8 @@ void pdsc_teardown(struct pdsc *pdsc, bool removing) - - if (!pdsc->pdev->is_virtfn) - pdsc_devcmd_reset(pdsc); -+ if (pdsc->adminqcq.work.func) -+ cancel_work_sync(&pdsc->adminqcq.work); - pdsc_qcq_free(pdsc, &pdsc->notifyqcq); - pdsc_qcq_free(pdsc, &pdsc->adminqcq); - --- -2.43.2 - -From c1f105c92919741ada726f3efd1d31fa0499bf44 Mon Sep 17 00:00:00 2001 -From: Brett Creeley <brett.creeley@amd.com> -Date: Mon, 29 Jan 2024 15:40:32 -0800 -Subject: [PATCH 1346/1501] pds_core: Use struct pdsc for the pdsc_adminq_isr - private data -Content-Length: 2638 -Lines: 64 - -[ Upstream commit 951705151e50f9022bc96ec8b3fd5697380b1df6 ] - -The initial design for the adminq interrupt was done based -on client drivers having their own adminq and adminq -interrupt. So, each client driver's adminq isr would use -their specific adminqcq for the private data struct. For the -time being the design has changed to only use a single -adminq for all clients. So, instead use the struct pdsc for -the private data to simplify things a bit. - -This also has the benefit of not dereferencing the adminqcq -to access the pdsc struct when the PDSC_S_STOPPING_DRIVER bit -is set and the adminqcq has actually been cleared/freed. - -Fixes: 01ba61b55b20 ("pds_core: Add adminq processing and commands") -Signed-off-by: Brett Creeley <brett.creeley@amd.com> -Reviewed-by: Shannon Nelson <shannon.nelson@amd.com> -Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> -Link: https://lore.kernel.org/r/20240129234035.69802-4-brett.creeley@amd.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/amd/pds_core/adminq.c | 5 +++-- - drivers/net/ethernet/amd/pds_core/core.c | 2 +- - 2 files changed, 4 insertions(+), 3 deletions(-) - -diff --git a/drivers/net/ethernet/amd/pds_core/adminq.c b/drivers/net/ethernet/amd/pds_core/adminq.c -index 5beadabc2136..68be5ea251fc 100644 ---- a/drivers/net/ethernet/amd/pds_core/adminq.c -+++ b/drivers/net/ethernet/amd/pds_core/adminq.c -@@ -135,8 +135,8 @@ void pdsc_work_thread(struct work_struct *work) - - irqreturn_t pdsc_adminq_isr(int irq, void *data) - { -- struct pdsc_qcq *qcq = data; -- struct pdsc *pdsc = qcq->pdsc; -+ struct pdsc *pdsc = data; -+ struct pdsc_qcq *qcq; - - /* Don't process AdminQ when shutting down */ - if (pdsc->state & BIT_ULL(PDSC_S_STOPPING_DRIVER)) { -@@ -145,6 +145,7 @@ irqreturn_t pdsc_adminq_isr(int irq, void *data) - return IRQ_HANDLED; - } - -+ qcq = &pdsc->adminqcq; - queue_work(pdsc->wq, &qcq->work); - pds_core_intr_mask(&pdsc->intr_ctrl[qcq->intx], PDS_CORE_INTR_MASK_CLEAR); - -diff --git a/drivers/net/ethernet/amd/pds_core/core.c b/drivers/net/ethernet/amd/pds_core/core.c -index b582729331eb..0356e56a6e99 100644 ---- a/drivers/net/ethernet/amd/pds_core/core.c -+++ b/drivers/net/ethernet/amd/pds_core/core.c -@@ -125,7 +125,7 @@ static int pdsc_qcq_intr_alloc(struct pdsc *pdsc, struct pdsc_qcq *qcq) - - snprintf(name, sizeof(name), "%s-%d-%s", - PDS_CORE_DRV_NAME, pdsc->pdev->bus->number, qcq->q.name); -- index = pdsc_intr_alloc(pdsc, name, pdsc_adminq_isr, qcq); -+ index = pdsc_intr_alloc(pdsc, name, pdsc_adminq_isr, pdsc); - if (index < 0) - return index; - qcq->intx = index; --- -2.43.2 - -From 5939feb63ea1f011027576c64b68b681cbad31ca Mon Sep 17 00:00:00 2001 -From: Brett Creeley <brett.creeley@amd.com> -Date: Mon, 29 Jan 2024 15:40:33 -0800 -Subject: [PATCH 1347/1501] pds_core: Prevent race issues involving the adminq -Content-Length: 7242 -Lines: 195 - -[ Upstream commit 7e82a8745b951b1e794cc780d46f3fbee5e93447 ] - -There are multiple paths that can result in using the pdsc's -adminq. - -[1] pdsc_adminq_isr and the resulting work from queue_work(), - i.e. pdsc_work_thread()->pdsc_process_adminq() - -[2] pdsc_adminq_post() - -When the device goes through reset via PCIe reset and/or -a fw_down/fw_up cycle due to bad PCIe state or bad device -state the adminq is destroyed and recreated. - -A NULL pointer dereference can happen if [1] or [2] happens -after the adminq is already destroyed. - -In order to fix this, add some further state checks and -implement reference counting for adminq uses. Reference -counting was used because multiple threads can attempt to -access the adminq at the same time via [1] or [2]. Additionally, -multiple clients (i.e. pds-vfio-pci) can be using [2] -at the same time. - -The adminq_refcnt is initialized to 1 when the adminq has been -allocated and is ready to use. Users/clients of the adminq -(i.e. [1] and [2]) will increment the refcnt when they are using -the adminq. When the driver goes into a fw_down cycle it will -set the PDSC_S_FW_DEAD bit and then wait for the adminq_refcnt -to hit 1. Setting the PDSC_S_FW_DEAD before waiting will prevent -any further adminq_refcnt increments. Waiting for the -adminq_refcnt to hit 1 allows for any current users of the adminq -to finish before the driver frees the adminq. Once the -adminq_refcnt hits 1 the driver clears the refcnt to signify that -the adminq is deleted and cannot be used. On the fw_up cycle the -driver will once again initialize the adminq_refcnt to 1 allowing -the adminq to be used again. - -Fixes: 01ba61b55b20 ("pds_core: Add adminq processing and commands") -Signed-off-by: Brett Creeley <brett.creeley@amd.com> -Reviewed-by: Shannon Nelson <shannon.nelson@amd.com> -Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> -Link: https://lore.kernel.org/r/20240129234035.69802-5-brett.creeley@amd.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/amd/pds_core/adminq.c | 31 +++++++++++++++++----- - drivers/net/ethernet/amd/pds_core/core.c | 21 +++++++++++++++ - drivers/net/ethernet/amd/pds_core/core.h | 1 + - 3 files changed, 47 insertions(+), 6 deletions(-) - -diff --git a/drivers/net/ethernet/amd/pds_core/adminq.c b/drivers/net/ethernet/amd/pds_core/adminq.c -index 68be5ea251fc..5edff33d56f3 100644 ---- a/drivers/net/ethernet/amd/pds_core/adminq.c -+++ b/drivers/net/ethernet/amd/pds_core/adminq.c -@@ -63,6 +63,15 @@ static int pdsc_process_notifyq(struct pdsc_qcq *qcq) - return nq_work; - } - -+static bool pdsc_adminq_inc_if_up(struct pdsc *pdsc) -+{ -+ if (pdsc->state & BIT_ULL(PDSC_S_STOPPING_DRIVER) || -+ pdsc->state & BIT_ULL(PDSC_S_FW_DEAD)) -+ return false; -+ -+ return refcount_inc_not_zero(&pdsc->adminq_refcnt); -+} -+ - void pdsc_process_adminq(struct pdsc_qcq *qcq) - { - union pds_core_adminq_comp *comp; -@@ -75,9 +84,9 @@ void pdsc_process_adminq(struct pdsc_qcq *qcq) - int aq_work = 0; - int credits; - -- /* Don't process AdminQ when shutting down */ -- if (pdsc->state & BIT_ULL(PDSC_S_STOPPING_DRIVER)) { -- dev_err(pdsc->dev, "%s: called while PDSC_S_STOPPING_DRIVER\n", -+ /* Don't process AdminQ when it's not up */ -+ if (!pdsc_adminq_inc_if_up(pdsc)) { -+ dev_err(pdsc->dev, "%s: called while adminq is unavailable\n", - __func__); - return; - } -@@ -124,6 +133,7 @@ void pdsc_process_adminq(struct pdsc_qcq *qcq) - pds_core_intr_credits(&pdsc->intr_ctrl[qcq->intx], - credits, - PDS_CORE_INTR_CRED_REARM); -+ refcount_dec(&pdsc->adminq_refcnt); - } - - void pdsc_work_thread(struct work_struct *work) -@@ -138,9 +148,9 @@ irqreturn_t pdsc_adminq_isr(int irq, void *data) - struct pdsc *pdsc = data; - struct pdsc_qcq *qcq; - -- /* Don't process AdminQ when shutting down */ -- if (pdsc->state & BIT_ULL(PDSC_S_STOPPING_DRIVER)) { -- dev_err(pdsc->dev, "%s: called while PDSC_S_STOPPING_DRIVER\n", -+ /* Don't process AdminQ when it's not up */ -+ if (!pdsc_adminq_inc_if_up(pdsc)) { -+ dev_err(pdsc->dev, "%s: called while adminq is unavailable\n", - __func__); - return IRQ_HANDLED; - } -@@ -148,6 +158,7 @@ irqreturn_t pdsc_adminq_isr(int irq, void *data) - qcq = &pdsc->adminqcq; - queue_work(pdsc->wq, &qcq->work); - pds_core_intr_mask(&pdsc->intr_ctrl[qcq->intx], PDS_CORE_INTR_MASK_CLEAR); -+ refcount_dec(&pdsc->adminq_refcnt); - - return IRQ_HANDLED; - } -@@ -231,6 +242,12 @@ int pdsc_adminq_post(struct pdsc *pdsc, - int err = 0; - int index; - -+ if (!pdsc_adminq_inc_if_up(pdsc)) { -+ dev_dbg(pdsc->dev, "%s: preventing adminq cmd %u\n", -+ __func__, cmd->opcode); -+ return -ENXIO; -+ } -+ - wc.qcq = &pdsc->adminqcq; - index = __pdsc_adminq_post(pdsc, &pdsc->adminqcq, cmd, comp, &wc); - if (index < 0) { -@@ -286,6 +303,8 @@ int pdsc_adminq_post(struct pdsc *pdsc, - queue_work(pdsc->wq, &pdsc->health_work); - } - -+ refcount_dec(&pdsc->adminq_refcnt); -+ - return err; - } - EXPORT_SYMBOL_GPL(pdsc_adminq_post); -diff --git a/drivers/net/ethernet/amd/pds_core/core.c b/drivers/net/ethernet/amd/pds_core/core.c -index 0356e56a6e99..f44333bd1256 100644 ---- a/drivers/net/ethernet/amd/pds_core/core.c -+++ b/drivers/net/ethernet/amd/pds_core/core.c -@@ -450,6 +450,7 @@ int pdsc_setup(struct pdsc *pdsc, bool init) - pdsc_debugfs_add_viftype(pdsc); - } - -+ refcount_set(&pdsc->adminq_refcnt, 1); - clear_bit(PDSC_S_FW_DEAD, &pdsc->state); - return 0; - -@@ -514,6 +515,24 @@ void pdsc_stop(struct pdsc *pdsc) - PDS_CORE_INTR_MASK_SET); - } - -+static void pdsc_adminq_wait_and_dec_once_unused(struct pdsc *pdsc) -+{ -+ /* The driver initializes the adminq_refcnt to 1 when the adminq is -+ * allocated and ready for use. Other users/requesters will increment -+ * the refcnt while in use. If the refcnt is down to 1 then the adminq -+ * is not in use and the refcnt can be cleared and adminq freed. Before -+ * calling this function the driver will set PDSC_S_FW_DEAD, which -+ * prevent subsequent attempts to use the adminq and increment the -+ * refcnt to fail. This guarantees that this function will eventually -+ * exit. -+ */ -+ while (!refcount_dec_if_one(&pdsc->adminq_refcnt)) { -+ dev_dbg_ratelimited(pdsc->dev, "%s: adminq in use\n", -+ __func__); -+ cpu_relax(); -+ } -+} -+ - void pdsc_fw_down(struct pdsc *pdsc) - { - union pds_core_notifyq_comp reset_event = { -@@ -529,6 +548,8 @@ void pdsc_fw_down(struct pdsc *pdsc) - if (pdsc->pdev->is_virtfn) - return; - -+ pdsc_adminq_wait_and_dec_once_unused(pdsc); -+ - /* Notify clients of fw_down */ - if (pdsc->fw_reporter) - devlink_health_report(pdsc->fw_reporter, "FW down reported", pdsc); -diff --git a/drivers/net/ethernet/amd/pds_core/core.h b/drivers/net/ethernet/amd/pds_core/core.h -index e35d3e7006bf..cbd5716f46e6 100644 ---- a/drivers/net/ethernet/amd/pds_core/core.h -+++ b/drivers/net/ethernet/amd/pds_core/core.h -@@ -184,6 +184,7 @@ struct pdsc { - struct mutex devcmd_lock; /* lock for dev_cmd operations */ - struct mutex config_lock; /* lock for configuration operations */ - spinlock_t adminq_lock; /* lock for adminq operations */ -+ refcount_t adminq_refcnt; - struct pds_core_dev_info_regs __iomem *info_regs; - struct pds_core_dev_cmd_regs __iomem *cmd_regs; - struct pds_core_intr __iomem *intr_ctrl; --- -2.43.2 - -From 692488941283d72362274620b9abd28109fc459f Mon Sep 17 00:00:00 2001 -From: Brett Creeley <brett.creeley@amd.com> -Date: Mon, 29 Jan 2024 15:40:34 -0800 -Subject: [PATCH 1348/1501] pds_core: Clear BARs on reset -Content-Length: 6098 -Lines: 168 - -[ Upstream commit e96094c1d11cce4deb5da3c0500d49041ab845b8 ] - -During reset the BARs might be accessed when they are -unmapped. This can cause unexpected issues, so fix it by -clearing the cached BAR values so they are not accessed -until they are re-mapped. - -Also, make sure any places that can access the BARs -when they are NULL are prevented. - -Fixes: 49ce92fbee0b ("pds_core: add FW update feature to devlink") -Signed-off-by: Brett Creeley <brett.creeley@amd.com> -Reviewed-by: Shannon Nelson <shannon.nelson@amd.com> -Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> -Link: https://lore.kernel.org/r/20240129234035.69802-6-brett.creeley@amd.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/amd/pds_core/adminq.c | 24 +++++++++++++++------ - drivers/net/ethernet/amd/pds_core/core.c | 8 ++++++- - drivers/net/ethernet/amd/pds_core/dev.c | 9 +++++++- - drivers/net/ethernet/amd/pds_core/devlink.c | 3 ++- - drivers/net/ethernet/amd/pds_core/fw.c | 3 +++ - drivers/net/ethernet/amd/pds_core/main.c | 5 +++++ - 6 files changed, 43 insertions(+), 9 deletions(-) - -diff --git a/drivers/net/ethernet/amd/pds_core/adminq.c b/drivers/net/ethernet/amd/pds_core/adminq.c -index 5edff33d56f3..ea773cfa0af6 100644 ---- a/drivers/net/ethernet/amd/pds_core/adminq.c -+++ b/drivers/net/ethernet/amd/pds_core/adminq.c -@@ -191,10 +191,16 @@ static int __pdsc_adminq_post(struct pdsc *pdsc, - - /* Check that the FW is running */ - if (!pdsc_is_fw_running(pdsc)) { -- u8 fw_status = ioread8(&pdsc->info_regs->fw_status); -+ if (pdsc->info_regs) { -+ u8 fw_status = -+ ioread8(&pdsc->info_regs->fw_status); - -- dev_info(pdsc->dev, "%s: post failed - fw not running %#02x:\n", -- __func__, fw_status); -+ dev_info(pdsc->dev, "%s: post failed - fw not running %#02x:\n", -+ __func__, fw_status); -+ } else { -+ dev_info(pdsc->dev, "%s: post failed - BARs not setup\n", -+ __func__); -+ } - ret = -ENXIO; - - goto err_out_unlock; -@@ -266,10 +272,16 @@ int pdsc_adminq_post(struct pdsc *pdsc, - break; - - if (!pdsc_is_fw_running(pdsc)) { -- u8 fw_status = ioread8(&pdsc->info_regs->fw_status); -+ if (pdsc->info_regs) { -+ u8 fw_status = -+ ioread8(&pdsc->info_regs->fw_status); - -- dev_dbg(pdsc->dev, "%s: post wait failed - fw not running %#02x:\n", -- __func__, fw_status); -+ dev_dbg(pdsc->dev, "%s: post wait failed - fw not running %#02x:\n", -+ __func__, fw_status); -+ } else { -+ dev_dbg(pdsc->dev, "%s: post wait failed - BARs not setup\n", -+ __func__); -+ } - err = -ENXIO; - break; - } -diff --git a/drivers/net/ethernet/amd/pds_core/core.c b/drivers/net/ethernet/amd/pds_core/core.c -index f44333bd1256..65c8a7072e35 100644 ---- a/drivers/net/ethernet/amd/pds_core/core.c -+++ b/drivers/net/ethernet/amd/pds_core/core.c -@@ -600,7 +600,13 @@ void pdsc_fw_up(struct pdsc *pdsc) - - static void pdsc_check_pci_health(struct pdsc *pdsc) - { -- u8 fw_status = ioread8(&pdsc->info_regs->fw_status); -+ u8 fw_status; -+ -+ /* some sort of teardown already in progress */ -+ if (!pdsc->info_regs) -+ return; -+ -+ fw_status = ioread8(&pdsc->info_regs->fw_status); - - /* is PCI broken? */ - if (fw_status != PDS_RC_BAD_PCI) -diff --git a/drivers/net/ethernet/amd/pds_core/dev.c b/drivers/net/ethernet/amd/pds_core/dev.c -index 31940b857e0e..62a38e0a8454 100644 ---- a/drivers/net/ethernet/amd/pds_core/dev.c -+++ b/drivers/net/ethernet/amd/pds_core/dev.c -@@ -57,6 +57,9 @@ int pdsc_err_to_errno(enum pds_core_status_code code) - - bool pdsc_is_fw_running(struct pdsc *pdsc) - { -+ if (!pdsc->info_regs) -+ return false; -+ - pdsc->fw_status = ioread8(&pdsc->info_regs->fw_status); - pdsc->last_fw_time = jiffies; - pdsc->last_hb = ioread32(&pdsc->info_regs->fw_heartbeat); -@@ -182,13 +185,17 @@ int pdsc_devcmd_locked(struct pdsc *pdsc, union pds_core_dev_cmd *cmd, - { - int err; - -+ if (!pdsc->cmd_regs) -+ return -ENXIO; -+ - memcpy_toio(&pdsc->cmd_regs->cmd, cmd, sizeof(*cmd)); - pdsc_devcmd_dbell(pdsc); - err = pdsc_devcmd_wait(pdsc, cmd->opcode, max_seconds); -- memcpy_fromio(comp, &pdsc->cmd_regs->comp, sizeof(*comp)); - - if ((err == -ENXIO || err == -ETIMEDOUT) && pdsc->wq) - queue_work(pdsc->wq, &pdsc->health_work); -+ else -+ memcpy_fromio(comp, &pdsc->cmd_regs->comp, sizeof(*comp)); - - return err; - } -diff --git a/drivers/net/ethernet/amd/pds_core/devlink.c b/drivers/net/ethernet/amd/pds_core/devlink.c -index e9948ea5bbcd..54864f27c87a 100644 ---- a/drivers/net/ethernet/amd/pds_core/devlink.c -+++ b/drivers/net/ethernet/amd/pds_core/devlink.c -@@ -111,7 +111,8 @@ int pdsc_dl_info_get(struct devlink *dl, struct devlink_info_req *req, - - mutex_lock(&pdsc->devcmd_lock); - err = pdsc_devcmd_locked(pdsc, &cmd, &comp, pdsc->devcmd_timeout * 2); -- memcpy_fromio(&fw_list, pdsc->cmd_regs->data, sizeof(fw_list)); -+ if (!err) -+ memcpy_fromio(&fw_list, pdsc->cmd_regs->data, sizeof(fw_list)); - mutex_unlock(&pdsc->devcmd_lock); - if (err && err != -EIO) - return err; -diff --git a/drivers/net/ethernet/amd/pds_core/fw.c b/drivers/net/ethernet/amd/pds_core/fw.c -index 90a811f3878a..fa626719e68d 100644 ---- a/drivers/net/ethernet/amd/pds_core/fw.c -+++ b/drivers/net/ethernet/amd/pds_core/fw.c -@@ -107,6 +107,9 @@ int pdsc_firmware_update(struct pdsc *pdsc, const struct firmware *fw, - - dev_info(pdsc->dev, "Installing firmware\n"); - -+ if (!pdsc->cmd_regs) -+ return -ENXIO; -+ - dl = priv_to_devlink(pdsc); - devlink_flash_update_status_notify(dl, "Preparing to flash", - NULL, 0, 0); -diff --git a/drivers/net/ethernet/amd/pds_core/main.c b/drivers/net/ethernet/amd/pds_core/main.c -index 5172a5ad8ec6..05fdeb235e5f 100644 ---- a/drivers/net/ethernet/amd/pds_core/main.c -+++ b/drivers/net/ethernet/amd/pds_core/main.c -@@ -37,6 +37,11 @@ static void pdsc_unmap_bars(struct pdsc *pdsc) - struct pdsc_dev_bar *bars = pdsc->bars; - unsigned int i; - -+ pdsc->info_regs = NULL; -+ pdsc->cmd_regs = NULL; -+ pdsc->intr_status = NULL; -+ pdsc->intr_ctrl = NULL; -+ - for (i = 0; i < PDS_CORE_BARS_MAX; i++) { - if (bars[i].vaddr) - pci_iounmap(pdsc->pdev, bars[i].vaddr); --- -2.43.2 - -From 3ffe14c36985e3174933127c9efad82ac8f3fefb Mon Sep 17 00:00:00 2001 -From: Brett Creeley <brett.creeley@amd.com> -Date: Mon, 29 Jan 2024 15:40:35 -0800 -Subject: [PATCH 1349/1501] pds_core: Rework teardown/setup flow to be more - common -Content-Length: 5443 -Lines: 146 - -[ Upstream commit bc90fbe0c3182157d2be100a2f6c2edbb1820677 ] - -Currently the teardown/setup flow for driver probe/remove is quite -a bit different from the reset flows in pdsc_fw_down()/pdsc_fw_up(). -One key piece that's missing are the calls to pci_alloc_irq_vectors() -and pci_free_irq_vectors(). The pcie reset case is calling -pci_free_irq_vectors() on reset_prepare, but not calling the -corresponding pci_alloc_irq_vectors() on reset_done. This is causing -unexpected/unwanted interrupt behavior due to the adminq interrupt -being accidentally put into legacy interrupt mode. Also, the -pci_alloc_irq_vectors()/pci_free_irq_vectors() functions are being -called directly in probe/remove respectively. - -Fix this inconsistency by making the following changes: - 1. Always call pdsc_dev_init() in pdsc_setup(), which calls - pci_alloc_irq_vectors() and get rid of the now unused - pds_dev_reinit(). - 2. Always free/clear the pdsc->intr_info in pdsc_teardown() - since this structure will get re-alloced in pdsc_setup(). - 3. Move the calls of pci_free_irq_vectors() to pdsc_teardown() - since pci_alloc_irq_vectors() will always be called in - pdsc_setup()->pdsc_dev_init() for both the probe/remove and - reset flows. - 4. Make sure to only create the debugfs "identity" entry when it - doesn't already exist, which it will in the reset case because - it's already been created in the initial call to pdsc_dev_init(). - -Fixes: ffa55858330f ("pds_core: implement pci reset handlers") -Signed-off-by: Brett Creeley <brett.creeley@amd.com> -Reviewed-by: Shannon Nelson <shannon.nelson@amd.com> -Link: https://lore.kernel.org/r/20240129234035.69802-7-brett.creeley@amd.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/amd/pds_core/core.c | 13 +++++-------- - drivers/net/ethernet/amd/pds_core/core.h | 1 - - drivers/net/ethernet/amd/pds_core/debugfs.c | 4 ++++ - drivers/net/ethernet/amd/pds_core/dev.c | 7 ------- - drivers/net/ethernet/amd/pds_core/main.c | 2 -- - 5 files changed, 9 insertions(+), 18 deletions(-) - -diff --git a/drivers/net/ethernet/amd/pds_core/core.c b/drivers/net/ethernet/amd/pds_core/core.c -index 65c8a7072e35..7658a7286767 100644 ---- a/drivers/net/ethernet/amd/pds_core/core.c -+++ b/drivers/net/ethernet/amd/pds_core/core.c -@@ -404,10 +404,7 @@ int pdsc_setup(struct pdsc *pdsc, bool init) - int numdescs; - int err; - -- if (init) -- err = pdsc_dev_init(pdsc); -- else -- err = pdsc_dev_reinit(pdsc); -+ err = pdsc_dev_init(pdsc); - if (err) - return err; - -@@ -479,10 +476,9 @@ void pdsc_teardown(struct pdsc *pdsc, bool removing) - for (i = 0; i < pdsc->nintrs; i++) - pdsc_intr_free(pdsc, i); - -- if (removing) { -- kfree(pdsc->intr_info); -- pdsc->intr_info = NULL; -- } -+ kfree(pdsc->intr_info); -+ pdsc->intr_info = NULL; -+ pdsc->nintrs = 0; - } - - if (pdsc->kern_dbpage) { -@@ -490,6 +486,7 @@ void pdsc_teardown(struct pdsc *pdsc, bool removing) - pdsc->kern_dbpage = NULL; - } - -+ pci_free_irq_vectors(pdsc->pdev); - set_bit(PDSC_S_FW_DEAD, &pdsc->state); - } - -diff --git a/drivers/net/ethernet/amd/pds_core/core.h b/drivers/net/ethernet/amd/pds_core/core.h -index cbd5716f46e6..110c4b826b22 100644 ---- a/drivers/net/ethernet/amd/pds_core/core.h -+++ b/drivers/net/ethernet/amd/pds_core/core.h -@@ -281,7 +281,6 @@ int pdsc_devcmd_locked(struct pdsc *pdsc, union pds_core_dev_cmd *cmd, - union pds_core_dev_comp *comp, int max_seconds); - int pdsc_devcmd_init(struct pdsc *pdsc); - int pdsc_devcmd_reset(struct pdsc *pdsc); --int pdsc_dev_reinit(struct pdsc *pdsc); - int pdsc_dev_init(struct pdsc *pdsc); - - void pdsc_reset_prepare(struct pci_dev *pdev); -diff --git a/drivers/net/ethernet/amd/pds_core/debugfs.c b/drivers/net/ethernet/amd/pds_core/debugfs.c -index 8ec392299b7d..4e8579ca1c8c 100644 ---- a/drivers/net/ethernet/amd/pds_core/debugfs.c -+++ b/drivers/net/ethernet/amd/pds_core/debugfs.c -@@ -64,6 +64,10 @@ DEFINE_SHOW_ATTRIBUTE(identity); - - void pdsc_debugfs_add_ident(struct pdsc *pdsc) - { -+ /* This file will already exist in the reset flow */ -+ if (debugfs_lookup("identity", pdsc->dentry)) -+ return; -+ - debugfs_create_file("identity", 0400, pdsc->dentry, - pdsc, &identity_fops); - } -diff --git a/drivers/net/ethernet/amd/pds_core/dev.c b/drivers/net/ethernet/amd/pds_core/dev.c -index 62a38e0a8454..e65a1632df50 100644 ---- a/drivers/net/ethernet/amd/pds_core/dev.c -+++ b/drivers/net/ethernet/amd/pds_core/dev.c -@@ -316,13 +316,6 @@ static int pdsc_identify(struct pdsc *pdsc) - return 0; - } - --int pdsc_dev_reinit(struct pdsc *pdsc) --{ -- pdsc_init_devinfo(pdsc); -- -- return pdsc_identify(pdsc); --} -- - int pdsc_dev_init(struct pdsc *pdsc) - { - unsigned int nintrs; -diff --git a/drivers/net/ethernet/amd/pds_core/main.c b/drivers/net/ethernet/amd/pds_core/main.c -index 05fdeb235e5f..cdbf053b5376 100644 ---- a/drivers/net/ethernet/amd/pds_core/main.c -+++ b/drivers/net/ethernet/amd/pds_core/main.c -@@ -438,7 +438,6 @@ static void pdsc_remove(struct pci_dev *pdev) - mutex_destroy(&pdsc->config_lock); - mutex_destroy(&pdsc->devcmd_lock); - -- pci_free_irq_vectors(pdev); - pdsc_unmap_bars(pdsc); - pci_release_regions(pdev); - } -@@ -470,7 +469,6 @@ void pdsc_reset_prepare(struct pci_dev *pdev) - pdsc_stop_health_thread(pdsc); - pdsc_fw_down(pdsc); - -- pci_free_irq_vectors(pdev); - pdsc_unmap_bars(pdsc); - pci_release_regions(pdev); - pci_disable_device(pdev); --- -2.43.2 - -From 79d52172cfb1a5598da6dfbd4adf1ca91609b2eb Mon Sep 17 00:00:00 2001 -From: Geetha sowjanya <gakula@marvell.com> -Date: Tue, 30 Jan 2024 17:36:10 +0530 -Subject: [PATCH 1354/1501] octeontx2-pf: Remove xdp queues on program detach -Content-Length: 3417 -Lines: 81 - -[ Upstream commit 04f647c8e456fcfabe9c252a4dcaee03b586fa4f ] - -XDP queues are created/destroyed when a XDP program -is attached/detached. In current driver xdp_queues are not -getting destroyed on program exit due to incorrect xdp_queue -and tot_tx_queue count values. - -This patch fixes the issue by setting tot_tx_queue and xdp_queue -count to correct values. It also fixes xdp.data_hard_start address. - -Fixes: 06059a1a9a4a ("octeontx2-pf: Add XDP support to netdev PF") -Signed-off-by: Geetha sowjanya <gakula@marvell.com> -Link: https://lore.kernel.org/r/20240130120610.16673-1-gakula@marvell.com -Signed-off-by: Paolo Abeni <pabeni@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 1 - - drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 3 +-- - drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c | 7 +++---- - 3 files changed, 4 insertions(+), 7 deletions(-) - -diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c -index 53f6258a973c..8b7fc0af91ce 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c -+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c -@@ -314,7 +314,6 @@ static int otx2_set_channels(struct net_device *dev, - pfvf->hw.tx_queues = channel->tx_count; - if (pfvf->xdp_prog) - pfvf->hw.xdp_queues = channel->rx_count; -- pfvf->hw.non_qos_queues = pfvf->hw.tx_queues + pfvf->hw.xdp_queues; - - if (if_up) - err = dev->netdev_ops->ndo_open(dev); -diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c -index a57455aebff6..e5fe67e73865 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c -+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c -@@ -1744,6 +1744,7 @@ int otx2_open(struct net_device *netdev) - /* RQ and SQs are mapped to different CQs, - * so find out max CQ IRQs (i.e CINTs) needed. - */ -+ pf->hw.non_qos_queues = pf->hw.tx_queues + pf->hw.xdp_queues; - pf->hw.cint_cnt = max3(pf->hw.rx_queues, pf->hw.tx_queues, - pf->hw.tc_tx_queues); - -@@ -2643,8 +2644,6 @@ static int otx2_xdp_setup(struct otx2_nic *pf, struct bpf_prog *prog) - xdp_features_clear_redirect_target(dev); - } - -- pf->hw.non_qos_queues += pf->hw.xdp_queues; -- - if (if_up) - otx2_open(pf->netdev); - -diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c -index 4d519ea833b2..f828d32737af 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c -+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c -@@ -1403,7 +1403,7 @@ static bool otx2_xdp_rcv_pkt_handler(struct otx2_nic *pfvf, - struct otx2_cq_queue *cq, - bool *need_xdp_flush) - { -- unsigned char *hard_start, *data; -+ unsigned char *hard_start; - int qidx = cq->cq_idx; - struct xdp_buff xdp; - struct page *page; -@@ -1417,9 +1417,8 @@ static bool otx2_xdp_rcv_pkt_handler(struct otx2_nic *pfvf, - - xdp_init_buff(&xdp, pfvf->rbsize, &cq->xdp_rxq); - -- data = (unsigned char *)phys_to_virt(pa); -- hard_start = page_address(page); -- xdp_prepare_buff(&xdp, hard_start, data - hard_start, -+ hard_start = (unsigned char *)phys_to_virt(pa); -+ xdp_prepare_buff(&xdp, hard_start, OTX2_HEAD_ROOM, - cqe->sg.seg_size, false); - - act = bpf_prog_run_xdp(prog, &xdp); --- -2.43.2 - -From 648be8308114be1a276211f4eb0a37ebff5dd261 Mon Sep 17 00:00:00 2001 -From: Breno Leitao <leitao@debian.org> -Date: Wed, 31 Jan 2024 02:21:49 -0800 -Subject: [PATCH 1355/1501] net: sysfs: Fix /sys/class/net/<iface> path -Content-Length: 4611 -Lines: 119 - -[ Upstream commit ae3f4b44641dfff969604735a0dcbf931f383285 ] - -The documentation is pointing to the wrong path for the interface. -Documentation is pointing to /sys/class/<iface>, instead of -/sys/class/net/<iface>. - -Fix it by adding the `net/` directory before the interface. - -Fixes: 1a02ef76acfa ("net: sysfs: add documentation entries for /sys/class/<iface>/queues") -Signed-off-by: Breno Leitao <leitao@debian.org> -Link: https://lore.kernel.org/r/20240131102150.728960-2-leitao@debian.org -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../ABI/testing/sysfs-class-net-queues | 22 +++++++++---------- - 1 file changed, 11 insertions(+), 11 deletions(-) - -diff --git a/Documentation/ABI/testing/sysfs-class-net-queues b/Documentation/ABI/testing/sysfs-class-net-queues -index 906ff3ca928a..5bff64d256c2 100644 ---- a/Documentation/ABI/testing/sysfs-class-net-queues -+++ b/Documentation/ABI/testing/sysfs-class-net-queues -@@ -1,4 +1,4 @@ --What: /sys/class/<iface>/queues/rx-<queue>/rps_cpus -+What: /sys/class/net/<iface>/queues/rx-<queue>/rps_cpus - Date: March 2010 - KernelVersion: 2.6.35 - Contact: netdev@vger.kernel.org -@@ -8,7 +8,7 @@ Description: - network device queue. Possible values depend on the number - of available CPU(s) in the system. - --What: /sys/class/<iface>/queues/rx-<queue>/rps_flow_cnt -+What: /sys/class/net/<iface>/queues/rx-<queue>/rps_flow_cnt - Date: April 2010 - KernelVersion: 2.6.35 - Contact: netdev@vger.kernel.org -@@ -16,7 +16,7 @@ Description: - Number of Receive Packet Steering flows being currently - processed by this particular network device receive queue. - --What: /sys/class/<iface>/queues/tx-<queue>/tx_timeout -+What: /sys/class/net/<iface>/queues/tx-<queue>/tx_timeout - Date: November 2011 - KernelVersion: 3.3 - Contact: netdev@vger.kernel.org -@@ -24,7 +24,7 @@ Description: - Indicates the number of transmit timeout events seen by this - network interface transmit queue. - --What: /sys/class/<iface>/queues/tx-<queue>/tx_maxrate -+What: /sys/class/net/<iface>/queues/tx-<queue>/tx_maxrate - Date: March 2015 - KernelVersion: 4.1 - Contact: netdev@vger.kernel.org -@@ -32,7 +32,7 @@ Description: - A Mbps max-rate set for the queue, a value of zero means disabled, - default is disabled. - --What: /sys/class/<iface>/queues/tx-<queue>/xps_cpus -+What: /sys/class/net/<iface>/queues/tx-<queue>/xps_cpus - Date: November 2010 - KernelVersion: 2.6.38 - Contact: netdev@vger.kernel.org -@@ -42,7 +42,7 @@ Description: - network device transmit queue. Possible values depend on the - number of available CPU(s) in the system. - --What: /sys/class/<iface>/queues/tx-<queue>/xps_rxqs -+What: /sys/class/net/<iface>/queues/tx-<queue>/xps_rxqs - Date: June 2018 - KernelVersion: 4.18.0 - Contact: netdev@vger.kernel.org -@@ -53,7 +53,7 @@ Description: - number of available receive queue(s) in the network device. - Default is disabled. - --What: /sys/class/<iface>/queues/tx-<queue>/byte_queue_limits/hold_time -+What: /sys/class/net/<iface>/queues/tx-<queue>/byte_queue_limits/hold_time - Date: November 2011 - KernelVersion: 3.3 - Contact: netdev@vger.kernel.org -@@ -62,7 +62,7 @@ Description: - of this particular network device transmit queue. - Default value is 1000. - --What: /sys/class/<iface>/queues/tx-<queue>/byte_queue_limits/inflight -+What: /sys/class/net/<iface>/queues/tx-<queue>/byte_queue_limits/inflight - Date: November 2011 - KernelVersion: 3.3 - Contact: netdev@vger.kernel.org -@@ -70,7 +70,7 @@ Description: - Indicates the number of bytes (objects) in flight on this - network device transmit queue. - --What: /sys/class/<iface>/queues/tx-<queue>/byte_queue_limits/limit -+What: /sys/class/net/<iface>/queues/tx-<queue>/byte_queue_limits/limit - Date: November 2011 - KernelVersion: 3.3 - Contact: netdev@vger.kernel.org -@@ -79,7 +79,7 @@ Description: - on this network device transmit queue. This value is clamped - to be within the bounds defined by limit_max and limit_min. - --What: /sys/class/<iface>/queues/tx-<queue>/byte_queue_limits/limit_max -+What: /sys/class/net/<iface>/queues/tx-<queue>/byte_queue_limits/limit_max - Date: November 2011 - KernelVersion: 3.3 - Contact: netdev@vger.kernel.org -@@ -88,7 +88,7 @@ Description: - queued on this network device transmit queue. See - include/linux/dynamic_queue_limits.h for the default value. - --What: /sys/class/<iface>/queues/tx-<queue>/byte_queue_limits/limit_min -+What: /sys/class/net/<iface>/queues/tx-<queue>/byte_queue_limits/limit_min - Date: November 2011 - KernelVersion: 3.3 - Contact: netdev@vger.kernel.org --- -2.43.2 - -From 3ca3901a88c08279c118f7c13dc4390ce61f96dc Mon Sep 17 00:00:00 2001 -From: Pavan Kumar Linga <pavan.kumar.linga@intel.com> -Date: Wed, 31 Jan 2024 14:22:40 -0800 -Subject: [PATCH 1360/1501] idpf: avoid compiler padding in virtchnl2_ptype - struct -Content-Length: 2626 -Lines: 56 - -[ Upstream commit f0588b157f48b9c6277a75c9f14650e86d969e03 ] - -In the arm random config file, kconfig option 'CONFIG_AEABI' is -disabled which results in adding the compiler flag '-mabi=apcs-gnu'. -This causes the compiler to add padding in virtchnl2_ptype -structure to align it to 8 bytes, resulting in the following -size check failure: - -include/linux/build_bug.h:78:41: error: static assertion failed: "(6) == sizeof(struct virtchnl2_ptype)" - 78 | #define __static_assert(expr, msg, ...) _Static_assert(expr, msg) - | ^~~~~~~~~~~~~~ -include/linux/build_bug.h:77:34: note: in expansion of macro '__static_assert' - 77 | #define static_assert(expr, ...) __static_assert(expr, ##__VA_ARGS__, #expr) - | ^~~~~~~~~~~~~~~ -drivers/net/ethernet/intel/idpf/virtchnl2.h:26:9: note: in expansion of macro 'static_assert' - 26 | static_assert((n) == sizeof(struct X)) - | ^~~~~~~~~~~~~ -drivers/net/ethernet/intel/idpf/virtchnl2.h:982:1: note: in expansion of macro 'VIRTCHNL2_CHECK_STRUCT_LEN' - 982 | VIRTCHNL2_CHECK_STRUCT_LEN(6, virtchnl2_ptype); - | ^~~~~~~~~~~~~~~~~~~~~~~~~~ - -Avoid the compiler padding by using "__packed" structure -attribute for the virtchnl2_ptype struct. Also align the -structure by using "__aligned(2)" for better code optimization. - -Fixes: 0d7502a9b4a7 ("virtchnl: add virtchnl version 2 ops") -Reported-by: kernel test robot <lkp@intel.com> -Closes: https://lore.kernel.org/oe-kbuild-all/202312220250.ufEm8doQ-lkp@intel.com -Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> -Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> -Reviewed-by: Simon Horman <horms@kernel.org> -Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> -Tested-by: Krishneil Singh <krishneil.k.singh@intel.com> -Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> -Link: https://lore.kernel.org/r/20240131222241.2087516-1-anthony.l.nguyen@intel.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/intel/idpf/virtchnl2.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/intel/idpf/virtchnl2.h b/drivers/net/ethernet/intel/idpf/virtchnl2.h -index 8dc837889723..4a3c4454d25a 100644 ---- a/drivers/net/ethernet/intel/idpf/virtchnl2.h -+++ b/drivers/net/ethernet/intel/idpf/virtchnl2.h -@@ -978,7 +978,7 @@ struct virtchnl2_ptype { - u8 proto_id_count; - __le16 pad; - __le16 proto_id[]; --}; -+} __packed __aligned(2); - VIRTCHNL2_CHECK_STRUCT_LEN(6, virtchnl2_ptype); - - /** --- -2.43.2 - -From b625f148f540356e04264f4c4d90120d4ec6a928 Mon Sep 17 00:00:00 2001 -From: Huang Shijie <shijie@os.amperecomputing.com> -Date: Wed, 13 Dec 2023 09:20:46 +0800 -Subject: [PATCH 1361/1501] arm64: irq: set the correct node for shadow call - stack -Content-Length: 1212 -Lines: 35 - -commit 7b1a09e44dc64f4f5930659b6d14a27183c00705 upstream. - -The init_irq_stacks() has been changed to use the correct node: -https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git/commit/?id=75b5e0bf90bf - -The init_irq_scs() has the same issue with init_irq_stacks(): - cpu_to_node() is not initialized yet, it does not work. - -This patch uses early_cpu_to_node() to set the init_irq_scs() -with the correct node. - -Signed-off-by: Huang Shijie <shijie@os.amperecomputing.com> -Reviewed-by: Catalin Marinas <catalin.marinas@arm.com> -Link: https://lore.kernel.org/r/20231213012046.12014-1-shijie@os.amperecomputing.com -Signed-off-by: Will Deacon <will@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/arm64/kernel/irq.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/arm64/kernel/irq.c b/arch/arm64/kernel/irq.c -index 9f253d8efe90..85087e2df564 100644 ---- a/arch/arm64/kernel/irq.c -+++ b/arch/arm64/kernel/irq.c -@@ -48,7 +48,7 @@ static void init_irq_scs(void) - - for_each_possible_cpu(cpu) - per_cpu(irq_shadow_call_stack_ptr, cpu) = -- scs_alloc(cpu_to_node(cpu)); -+ scs_alloc(early_cpu_to_node(cpu)); - } - - #ifdef CONFIG_VMAP_STACK --- -2.43.2 - -From 5a33420599fa0288792537e6872fd19cc8607ea6 Mon Sep 17 00:00:00 2001 -From: Marco Elver <elver@google.com> -Date: Thu, 18 Jan 2024 11:59:14 +0100 -Subject: [PATCH 1362/1501] mm, kmsan: fix infinite recursion due to RCU - critical section -Content-Length: 5075 -Lines: 124 - -commit f6564fce256a3944aa1bc76cb3c40e792d97c1eb upstream. - -Alexander Potapenko writes in [1]: "For every memory access in the code -instrumented by KMSAN we call kmsan_get_metadata() to obtain the metadata -for the memory being accessed. For virtual memory the metadata pointers -are stored in the corresponding `struct page`, therefore we need to call -virt_to_page() to get them. - -According to the comment in arch/x86/include/asm/page.h, -virt_to_page(kaddr) returns a valid pointer iff virt_addr_valid(kaddr) is -true, so KMSAN needs to call virt_addr_valid() as well. - -To avoid recursion, kmsan_get_metadata() must not call instrumented code, -therefore ./arch/x86/include/asm/kmsan.h forks parts of -arch/x86/mm/physaddr.c to check whether a virtual address is valid or not. - -But the introduction of rcu_read_lock() to pfn_valid() added instrumented -RCU API calls to virt_to_page_or_null(), which is called by -kmsan_get_metadata(), so there is an infinite recursion now. I do not -think it is correct to stop that recursion by doing -kmsan_enter_runtime()/kmsan_exit_runtime() in kmsan_get_metadata(): that -would prevent instrumented functions called from within the runtime from -tracking the shadow values, which might introduce false positives." - -Fix the issue by switching pfn_valid() to the _sched() variant of -rcu_read_lock/unlock(), which does not require calling into RCU. Given -the critical section in pfn_valid() is very small, this is a reasonable -trade-off (with preemptible RCU). - -KMSAN further needs to be careful to suppress calls into the scheduler, -which would be another source of recursion. This can be done by wrapping -the call to pfn_valid() into preempt_disable/enable_no_resched(). The -downside is that this sacrifices breaking scheduling guarantees; however, -a kernel compiled with KMSAN has already given up any performance -guarantees due to being heavily instrumented. - -Note, KMSAN code already disables tracing via Makefile, and since mmzone.h -is included, it is not necessary to use the notrace variant, which is -generally preferred in all other cases. - -Link: https://lkml.kernel.org/r/20240115184430.2710652-1-glider@google.com [1] -Link: https://lkml.kernel.org/r/20240118110022.2538350-1-elver@google.com -Fixes: 5ec8e8ea8b77 ("mm/sparsemem: fix race in accessing memory_section->usage") -Signed-off-by: Marco Elver <elver@google.com> -Reported-by: Alexander Potapenko <glider@google.com> -Reported-by: syzbot+93a9e8a3dea8d6085e12@syzkaller.appspotmail.com -Reviewed-by: Alexander Potapenko <glider@google.com> -Tested-by: Alexander Potapenko <glider@google.com> -Cc: Charan Teja Kalla <quic_charante@quicinc.com> -Cc: Borislav Petkov (AMD) <bp@alien8.de> -Cc: Dave Hansen <dave.hansen@linux.intel.com> -Cc: Dmitry Vyukov <dvyukov@google.com> -Cc: "H. Peter Anvin" <hpa@zytor.com> -Cc: Ingo Molnar <mingo@redhat.com> -Cc: Thomas Gleixner <tglx@linutronix.de> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/x86/include/asm/kmsan.h | 17 ++++++++++++++++- - include/linux/mmzone.h | 6 +++--- - 2 files changed, 19 insertions(+), 4 deletions(-) - -diff --git a/arch/x86/include/asm/kmsan.h b/arch/x86/include/asm/kmsan.h -index 8fa6ac0e2d76..d91b37f5b4bb 100644 ---- a/arch/x86/include/asm/kmsan.h -+++ b/arch/x86/include/asm/kmsan.h -@@ -64,6 +64,7 @@ static inline bool kmsan_virt_addr_valid(void *addr) - { - unsigned long x = (unsigned long)addr; - unsigned long y = x - __START_KERNEL_map; -+ bool ret; - - /* use the carry flag to determine if x was < __START_KERNEL_map */ - if (unlikely(x > y)) { -@@ -79,7 +80,21 @@ static inline bool kmsan_virt_addr_valid(void *addr) - return false; - } - -- return pfn_valid(x >> PAGE_SHIFT); -+ /* -+ * pfn_valid() relies on RCU, and may call into the scheduler on exiting -+ * the critical section. However, this would result in recursion with -+ * KMSAN. Therefore, disable preemption here, and re-enable preemption -+ * below while suppressing reschedules to avoid recursion. -+ * -+ * Note, this sacrifices occasionally breaking scheduling guarantees. -+ * Although, a kernel compiled with KMSAN has already given up on any -+ * performance guarantees due to being heavily instrumented. -+ */ -+ preempt_disable(); -+ ret = pfn_valid(x >> PAGE_SHIFT); -+ preempt_enable_no_resched(); -+ -+ return ret; - } - - #endif /* !MODULE */ -diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h -index a7c32324c263..2c34e9325c9b 100644 ---- a/include/linux/mmzone.h -+++ b/include/linux/mmzone.h -@@ -2025,9 +2025,9 @@ static inline int pfn_valid(unsigned long pfn) - if (pfn_to_section_nr(pfn) >= NR_MEM_SECTIONS) - return 0; - ms = __pfn_to_section(pfn); -- rcu_read_lock(); -+ rcu_read_lock_sched(); - if (!valid_section(ms)) { -- rcu_read_unlock(); -+ rcu_read_unlock_sched(); - return 0; - } - /* -@@ -2035,7 +2035,7 @@ static inline int pfn_valid(unsigned long pfn) - * the entire section-sized span. - */ - ret = early_section(ms) || pfn_section_valid(ms, pfn); -- rcu_read_unlock(); -+ rcu_read_unlock_sched(); - - return ret; - } --- -2.43.2 - -From f9fd5a630b5b0df672367c84117e9a2e821be4aa Mon Sep 17 00:00:00 2001 -From: Jonathan Gray <jsg@jsg.id.au> -Date: Fri, 2 Feb 2024 13:05:05 +1100 -Subject: [PATCH 1363/1501] Revert "drm/amd/display: Disable PSR-SU on Parade - 0803 TCON again" -Content-Length: 1134 -Lines: 27 - -This reverts commit f015d8b6405d950f30826b4d8d9e1084dd9ea2a4. - -duplicated a change made in 6.7 -e7ab758741672acb21c5d841a9f0309d30e48a06 - -Cc: stable@vger.kernel.org # 6.7 -Signed-off-by: Jonathan Gray <jsg@jsg.id.au> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/display/modules/power/power_helpers.c | 2 -- - 1 file changed, 2 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c -index 7806056ca1dd..1675314a3ff2 100644 ---- a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c -+++ b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c -@@ -841,8 +841,6 @@ bool is_psr_su_specific_panel(struct dc_link *link) - isPSRSUSupported = false; - else if (dpcd_caps->sink_dev_id_str[1] == 0x08 && dpcd_caps->sink_dev_id_str[0] == 0x03) - isPSRSUSupported = false; -- else if (dpcd_caps->sink_dev_id_str[1] == 0x08 && dpcd_caps->sink_dev_id_str[0] == 0x03) -- isPSRSUSupported = false; - else if (dpcd_caps->psr_info.force_psrsu_cap == 0x1) - isPSRSUSupported = true; - } --- -2.43.2 - -From f65ab9e94bff28d3401ceda3cae62cad6d22336d Mon Sep 17 00:00:00 2001 -From: Konrad Dybcio <konrad.dybcio@linaro.org> -Date: Tue, 20 Jun 2023 13:43:21 +0200 -Subject: [PATCH 1364/1501] drm/msm/dsi: Enable runtime PM -Content-Length: 1313 -Lines: 33 - -commit 6ab502bc1cf3147ea1d8540d04b83a7a4cb6d1f1 upstream. - -Some devices power the DSI PHY/PLL through a power rail that we model -as a GENPD. Enable runtime PM to make it suspendable. - -Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> -Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Patchwork: https://patchwork.freedesktop.org/patch/543352/ -Link: https://lore.kernel.org/r/20230620-topic-dsiphy_rpm-v2-2-a11a751f34f0@linaro.org -Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Signed-off-by: Amit Pundir <amit.pundir@linaro.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c -index b6314bb66d2f..e49ebd9f6326 100644 ---- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c -+++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c -@@ -691,6 +691,10 @@ static int dsi_phy_driver_probe(struct platform_device *pdev) - return dev_err_probe(dev, PTR_ERR(phy->ahb_clk), - "Unable to get ahb clk\n"); - -+ ret = devm_pm_runtime_enable(&pdev->dev); -+ if (ret) -+ return ret; -+ - /* PLL init will call into clk_register which requires - * register access, so we need to enable power and ahb clock. - */ --- -2.43.2 - -From b8a8c5760d76aa73bfaa9b619bfdaffbc4038463 Mon Sep 17 00:00:00 2001 -From: Zhengchao Shao <shaozhengchao@huawei.com> -Date: Thu, 23 Nov 2023 09:55:15 +0800 -Subject: [PATCH 1366/1501] bonding: remove print in bond_verify_device_path -Content-Length: 1284 -Lines: 36 - -commit 486058f42a4728053ae69ebbf78e9731d8ce6f8b upstream. - -As suggested by Paolo in link[1], if the memory allocation fails, the mm -layer will emit a lot warning comprising the backtrace, so remove the -print. - -[1] https://lore.kernel.org/all/20231118081653.1481260-1-shaozhengchao@huawei.com/ - -Suggested-by: Paolo Abeni <pabeni@redhat.com> -Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com> -Reviewed-by: Hangbin Liu <liuhangbin@gmail.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/net/bonding/bond_main.c | 5 +---- - 1 file changed, 1 insertion(+), 4 deletions(-) - -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 9c1652886f4e..8e6cc0e133b7 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -2973,11 +2973,8 @@ struct bond_vlan_tag *bond_verify_device_path(struct net_device *start_dev, - - if (start_dev == end_dev) { - tags = kcalloc(level + 1, sizeof(*tags), GFP_ATOMIC); -- if (!tags) { -- net_err_ratelimited("%s: %s: Failed to allocate tags\n", -- __func__, start_dev->name); -+ if (!tags) - return ERR_PTR(-ENOMEM); -- } - tags[level].vlan_proto = BOND_VLAN_PROTO_NONE; - return tags; - } --- -2.43.2 - -From 1673211a38012e731373177b3a820a257b7964d2 Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan+linaro@kernel.org> -Date: Mon, 22 Jan 2024 19:18:17 +0100 -Subject: [PATCH 1367/1501] ASoC: qcom: sc8280xp: limit speaker volumes -Content-Length: 2165 -Lines: 52 - -commit c481016bb4f8a9c059c39ac06e7b65e233a61f6a upstream. - -The UCM configuration for the Lenovo ThinkPad X13s has up until now -been setting the speaker PA volume to the minimum -3 dB when enabling -the speakers, but this does not prevent the user from increasing the -volume further. - -Limit the digital gain and PA volumes to a combined -3 dB in the machine -driver to reduce the risk of speaker damage until we have active speaker -protection in place (or higher safe levels have been established). - -Note that the PA volume limit cannot be set lower than 0 dB or -PulseAudio gets confused when the first 16 levels all map to -3 dB. - -Also note that this will probably need to be generalised using -machine-specific limits, but a common limit should do for now. - -Cc: <stable@vger.kernel.org> # 6.5 -Signed-off-by: Johan Hovold <johan+linaro@kernel.org> -Link: https://msgid.link/r/20240122181819.4038-3-johan+linaro@kernel.org -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - sound/soc/qcom/sc8280xp.c | 12 +++++++----- - 1 file changed, 7 insertions(+), 5 deletions(-) - -diff --git a/sound/soc/qcom/sc8280xp.c b/sound/soc/qcom/sc8280xp.c -index 39cb0b889aff..e6efc2d10bbe 100644 ---- a/sound/soc/qcom/sc8280xp.c -+++ b/sound/soc/qcom/sc8280xp.c -@@ -34,12 +34,14 @@ static int sc8280xp_snd_init(struct snd_soc_pcm_runtime *rtd) - case WSA_CODEC_DMA_RX_0: - case WSA_CODEC_DMA_RX_1: - /* -- * set limit of 0dB on Digital Volume for Speakers, -- * this can prevent damage of speakers to some extent without -- * active speaker protection -+ * Set limit of -3 dB on Digital Volume and 0 dB on PA Volume -+ * to reduce the risk of speaker damage until we have active -+ * speaker protection in place. - */ -- snd_soc_limit_volume(card, "WSA_RX0 Digital Volume", 84); -- snd_soc_limit_volume(card, "WSA_RX1 Digital Volume", 84); -+ snd_soc_limit_volume(card, "WSA_RX0 Digital Volume", 81); -+ snd_soc_limit_volume(card, "WSA_RX1 Digital Volume", 81); -+ snd_soc_limit_volume(card, "SpkrLeft PA Volume", 17); -+ snd_soc_limit_volume(card, "SpkrRight PA Volume", 17); - break; - default: - break; --- -2.43.2 - -From 5b465d6384e4eb79a0e049c7646fb0284af0501f Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan+linaro@kernel.org> -Date: Mon, 22 Jan 2024 10:11:30 +0100 -Subject: [PATCH 1368/1501] ASoC: codecs: wcd938x: fix headphones volume - controls -Content-Length: 1273 -Lines: 34 - -commit 4d0e8bdfa4a57099dc7230952a460903f2e2f8de upstream. - -The lowest headphones volume setting does not mute so the leave the TLV -mute flag unset. - -This is specifically needed to let the sound server use the lowest gain -setting. - -Fixes: c03226ba15fe ("ASoC: codecs: wcd938x: fix dB range for HPHL and HPHR") -Cc: <stable@vger.kernel.org> # 6.5 -Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> -Signed-off-by: Johan Hovold <johan+linaro@kernel.org> -Link: https://msgid.link/r/20240122091130.27463-1-johan+linaro@kernel.org -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - sound/soc/codecs/wcd938x.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/sound/soc/codecs/wcd938x.c b/sound/soc/codecs/wcd938x.c -index faf8d3f9b3c5..98055dd39b78 100644 ---- a/sound/soc/codecs/wcd938x.c -+++ b/sound/soc/codecs/wcd938x.c -@@ -210,7 +210,7 @@ struct wcd938x_priv { - }; - - static const SNDRV_CTL_TLVD_DECLARE_DB_MINMAX(ear_pa_gain, 600, -1800); --static const DECLARE_TLV_DB_SCALE(line_gain, -3000, 150, -3000); -+static const DECLARE_TLV_DB_SCALE(line_gain, -3000, 150, 0); - static const SNDRV_CTL_TLVD_DECLARE_DB_MINMAX(analog_gain, 0, 3000); - - struct wcd938x_mbhc_zdet_param { --- -2.43.2 - -From 2f8e9b77ca2feab6d20938bc551dbb3d8a7a47e2 Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan+linaro@kernel.org> -Date: Fri, 19 Jan 2024 12:24:19 +0100 -Subject: [PATCH 1369/1501] ASoC: codecs: lpass-wsa-macro: fix compander volume - hack -Content-Length: 2845 -Lines: 71 - -commit 46188db080bd1df7d2d28031b89e56f2fdbabd67 upstream. - -The LPASS WSA macro codec driver is updating the digital gain settings -behind the back of user space on DAPM events if companding has been -enabled. - -As compander control is exported to user space, this can result in the -digital gain setting being incremented (or decremented) every time the -sound server is started and the codec suspended depending on what the -UCM configuration looks like. - -Soon enough playback will become distorted (or too quiet). - -This is specifically a problem on the Lenovo ThinkPad X13s as this -bypasses the limit for the digital gain setting that has been set by the -machine driver. - -Fix this by simply dropping the compander gain offset hack. If someone -cares about modelling the impact of the compander setting this can -possibly be done by exporting it as a volume control later. - -Note that the volume registers still need to be written after enabling -clocks in order for any prior updates to take effect. - -Fixes: 2c4066e5d428 ("ASoC: codecs: lpass-wsa-macro: add dapm widgets and route") -Cc: stable@vger.kernel.org # 5.11 -Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> -Signed-off-by: Johan Hovold <johan+linaro@kernel.org> -Link: https://msgid.link/r/20240119112420.7446-4-johan+linaro@kernel.org -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - sound/soc/codecs/lpass-wsa-macro.c | 7 ------- - 1 file changed, 7 deletions(-) - -diff --git a/sound/soc/codecs/lpass-wsa-macro.c b/sound/soc/codecs/lpass-wsa-macro.c -index 7e21cec3c2fb..6ce309980cd1 100644 ---- a/sound/soc/codecs/lpass-wsa-macro.c -+++ b/sound/soc/codecs/lpass-wsa-macro.c -@@ -1584,7 +1584,6 @@ static int wsa_macro_enable_interpolator(struct snd_soc_dapm_widget *w, - u16 gain_reg; - u16 reg; - int val; -- int offset_val = 0; - struct wsa_macro *wsa = snd_soc_component_get_drvdata(component); - - if (w->shift == WSA_MACRO_COMP1) { -@@ -1623,10 +1622,8 @@ static int wsa_macro_enable_interpolator(struct snd_soc_dapm_widget *w, - CDC_WSA_RX1_RX_PATH_MIX_SEC0, - CDC_WSA_RX_PGA_HALF_DB_MASK, - CDC_WSA_RX_PGA_HALF_DB_ENABLE); -- offset_val = -2; - } - val = snd_soc_component_read(component, gain_reg); -- val += offset_val; - snd_soc_component_write(component, gain_reg, val); - wsa_macro_config_ear_spkr_gain(component, wsa, - event, gain_reg); -@@ -1654,10 +1651,6 @@ static int wsa_macro_enable_interpolator(struct snd_soc_dapm_widget *w, - CDC_WSA_RX1_RX_PATH_MIX_SEC0, - CDC_WSA_RX_PGA_HALF_DB_MASK, - CDC_WSA_RX_PGA_HALF_DB_DISABLE); -- offset_val = 2; -- val = snd_soc_component_read(component, gain_reg); -- val += offset_val; -- snd_soc_component_write(component, gain_reg, val); - } - wsa_macro_config_ear_spkr_gain(component, wsa, - event, gain_reg); --- -2.43.2 - -From f3570675bf09af2f35516b2ac84ac59a075b32b0 Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan+linaro@kernel.org> -Date: Fri, 19 Jan 2024 12:24:17 +0100 -Subject: [PATCH 1370/1501] ASoC: codecs: wsa883x: fix PA volume control -Content-Length: 1661 -Lines: 45 - -commit b53cc6144a3f6c8b56afcdec89d81195c9b0dc69 upstream. - -The PA gain can be set in steps of 1.5 dB from -3 dB to 18 dB, that is, -in 15 levels. - -Fix the dB values for the PA volume control as experiments using wsa8835 -show that the first 16 levels all map to the same lowest gain while the -last three map to the highest gain. - -These values specifically need to be correct for the sound server to -provide proper volume control. - -Note that level 0 (-3 dB) does not mute the PA so the mute flag should -also not be set. - -Fixes: cdb09e623143 ("ASoC: codecs: wsa883x: add control, dapm widgets and map") -Cc: stable@vger.kernel.org # 6.0 -Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> -Signed-off-by: Johan Hovold <johan+linaro@kernel.org> -Link: https://msgid.link/r/20240119112420.7446-2-johan+linaro@kernel.org -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - sound/soc/codecs/wsa883x.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/sound/soc/codecs/wsa883x.c b/sound/soc/codecs/wsa883x.c -index cb83c569e18d..a2e86ef7d18f 100644 ---- a/sound/soc/codecs/wsa883x.c -+++ b/sound/soc/codecs/wsa883x.c -@@ -1098,7 +1098,11 @@ static int wsa_dev_mode_put(struct snd_kcontrol *kcontrol, - return 1; - } - --static const DECLARE_TLV_DB_SCALE(pa_gain, -300, 150, -300); -+static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(pa_gain, -+ 0, 14, TLV_DB_SCALE_ITEM(-300, 0, 0), -+ 15, 29, TLV_DB_SCALE_ITEM(-300, 150, 0), -+ 30, 31, TLV_DB_SCALE_ITEM(1800, 0, 0), -+); - - static int wsa883x_get_swr_port(struct snd_kcontrol *kcontrol, - struct snd_ctl_elem_value *ucontrol) --- -2.43.2 - -From 11a4f471d868b7fe5a8d8bb1653270b6e4e85591 Mon Sep 17 00:00:00 2001 -From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Date: Tue, 30 Jan 2024 12:10:38 +0530 -Subject: [PATCH 1371/1501] drm/amdgpu: Fix missing error code in - 'gmc_v6/7/8/9_0_hw_init()' -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2897 -Lines: 86 - -[ Upstream commit 16da399091dca3d1e48109086403587af37cc196 ] - -Return 0 for success scenairos in 'gmc_v6/7/8/9_0_hw_init()' - -Fixes the below: -drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c:920 gmc_v6_0_hw_init() warn: missing error code? 'r' -drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c:1104 gmc_v7_0_hw_init() warn: missing error code? 'r' -drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c:1224 gmc_v8_0_hw_init() warn: missing error code? 'r' -drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c:2347 gmc_v9_0_hw_init() warn: missing error code? 'r' - -Fixes: fac4ebd79fed ("drm/amdgpu: Fix with right return code '-EIO' in 'amdgpu_gmc_vram_checking()'") -Cc: Christian König <christian.koenig@amd.com> -Cc: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Reviewed-by: Christian König <christian.koenig@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c | 4 ++-- - drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c | 4 ++-- - drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 4 ++-- - drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 4 ++-- - 4 files changed, 8 insertions(+), 8 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c -index 42e103d7077d..59d9215e5556 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c -@@ -915,8 +915,8 @@ static int gmc_v6_0_hw_init(void *handle) - - if (amdgpu_emu_mode == 1) - return amdgpu_gmc_vram_checking(adev); -- else -- return r; -+ -+ return 0; - } - - static int gmc_v6_0_hw_fini(void *handle) -diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c -index efc16e580f1e..45a2f8e031a2 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c -@@ -1099,8 +1099,8 @@ static int gmc_v7_0_hw_init(void *handle) - - if (amdgpu_emu_mode == 1) - return amdgpu_gmc_vram_checking(adev); -- else -- return r; -+ -+ return 0; - } - - static int gmc_v7_0_hw_fini(void *handle) -diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c -index ff4ae73d27ec..4422b27a3cc2 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c -@@ -1219,8 +1219,8 @@ static int gmc_v8_0_hw_init(void *handle) - - if (amdgpu_emu_mode == 1) - return amdgpu_gmc_vram_checking(adev); -- else -- return r; -+ -+ return 0; - } - - static int gmc_v8_0_hw_fini(void *handle) -diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c -index 776acdfc7209..ad91329f227d 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c -@@ -2341,8 +2341,8 @@ static int gmc_v9_0_hw_init(void *handle) - - if (amdgpu_emu_mode == 1) - return amdgpu_gmc_vram_checking(adev); -- else -- return r; -+ -+ return 0; - } - - /** --- -2.43.2 - -From 18d179e11910a53ef98791eabc410d5abcfa377e Mon Sep 17 00:00:00 2001 -From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Date: Mon, 5 Feb 2024 20:17:12 +0000 -Subject: [PATCH 1372/1501] Linux 6.7.4 -Content-Length: 1165 -Lines: 34 - -Link: https://lore.kernel.org/r/20240203035403.657508530@linuxfoundation.org -Tested-by: Salvatore Bonaccorso <carnil@debian.org> -Tested-by: Ronald Warsow <rwarsow@gmx.de> -Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> -Link: https://lore.kernel.org/r/20240203174813.681845076@linuxfoundation.org -Tested-by: Luna Jernberg <droidbittin@gmail.com> -Tested-by: Ronald Warsow <rwarsow@gmx.de> -Tested-by: Ricardo B. Marliere <ricardo@marliere.net> -Tested-by: SeongJae Park <sj@kernel.org> -Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> -Tested-by: Bagas Sanjaya <bagasdotme@gmail.com> -Tested-by: Ron Economos <re@w6rz.net> -Tested-by: Linux Kernel Functional Testing <lkft@linaro.org> -Tested-by: Justin M. Forbes <jforbes@fedoraproject.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - Makefile | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Makefile b/Makefile -index 96a08c9f0faa..73a208d9d4c4 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 7 --SUBLEVEL = 3 -+SUBLEVEL = 4 - EXTRAVERSION = - NAME = Hurr durr I'ma ninja sloth - --- -2.43.2 - -From 6b0d48647935e4b8c7b75d1eccb9043fcd4ee581 Mon Sep 17 00:00:00 2001 -From: Baokun Li <libaokun1@huawei.com> -Date: Thu, 4 Jan 2024 22:20:35 +0800 -Subject: [PATCH 1373/1501] ext4: regenerate buddy after block freeing failed - if under fc replay -Content-Length: 2024 -Lines: 59 - -[ Upstream commit c9b528c35795b711331ed36dc3dbee90d5812d4e ] - -This mostly reverts commit 6bd97bf273bd ("ext4: remove redundant -mb_regenerate_buddy()") and reintroduces mb_regenerate_buddy(). Based on -code in mb_free_blocks(), fast commit replay can end up marking as free -blocks that are already marked as such. This causes corruption of the -buddy bitmap so we need to regenerate it in that case. - -Reported-by: Jan Kara <jack@suse.cz> -Fixes: 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()") -Signed-off-by: Baokun Li <libaokun1@huawei.com> -Reviewed-by: Jan Kara <jack@suse.cz> -Link: https://lore.kernel.org/r/20240104142040.2835097-4-libaokun1@huawei.com -Signed-off-by: Theodore Ts'o <tytso@mit.edu> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/ext4/mballoc.c | 20 ++++++++++++++++++++ - 1 file changed, 20 insertions(+) - -diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index 8408318e1d32..3c5786841c6c 100644 ---- a/fs/ext4/mballoc.c -+++ b/fs/ext4/mballoc.c -@@ -1233,6 +1233,24 @@ void ext4_mb_generate_buddy(struct super_block *sb, - atomic64_add(period, &sbi->s_mb_generation_time); - } - -+static void mb_regenerate_buddy(struct ext4_buddy *e4b) -+{ -+ int count; -+ int order = 1; -+ void *buddy; -+ -+ while ((buddy = mb_find_buddy(e4b, order++, &count))) -+ mb_set_bits(buddy, 0, count); -+ -+ e4b->bd_info->bb_fragments = 0; -+ memset(e4b->bd_info->bb_counters, 0, -+ sizeof(*e4b->bd_info->bb_counters) * -+ (e4b->bd_sb->s_blocksize_bits + 2)); -+ -+ ext4_mb_generate_buddy(e4b->bd_sb, e4b->bd_buddy, -+ e4b->bd_bitmap, e4b->bd_group, e4b->bd_info); -+} -+ - /* The buddy information is attached the buddy cache inode - * for convenience. The information regarding each group - * is loaded via ext4_mb_load_buddy. The information involve -@@ -1921,6 +1939,8 @@ static void mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b, - ext4_mark_group_bitmap_corrupted( - sb, e4b->bd_group, - EXT4_GROUP_INFO_BBITMAP_CORRUPT); -+ } else { -+ mb_regenerate_buddy(e4b); - } - goto done; - } --- -2.43.2 - -From 7e81c9e2f90329af279a7b2c988852c60d79ca02 Mon Sep 17 00:00:00 2001 -From: Guanhua Gao <guanhua.gao@nxp.com> -Date: Thu, 18 Jan 2024 11:29:16 -0500 -Subject: [PATCH 1374/1501] dmaengine: fsl-dpaa2-qdma: Fix the size of dma - pools -Content-Length: 1791 -Lines: 46 - -[ Upstream commit b73e43dcd7a8be26880ef8ff336053b29e79dbc5 ] - -In case of long format of qDMA command descriptor, there are one frame -descriptor, three entries in the frame list and two data entries. So the -size of dma_pool_create for these three fields should be the same with -the total size of entries respectively, or the contents may be overwritten -by the next allocated descriptor. - -Fixes: 7fdf9b05c73b ("dmaengine: fsl-dpaa2-qdma: Add NXP dpaa2 qDMA controller driver for Layerscape SoCs") -Signed-off-by: Guanhua Gao <guanhua.gao@nxp.com> -Signed-off-by: Frank Li <Frank.Li@nxp.com> -Link: https://lore.kernel.org/r/20240118162917.2951450-1-Frank.Li@nxp.com -Signed-off-by: Vinod Koul <vkoul@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c | 10 ++++++---- - 1 file changed, 6 insertions(+), 4 deletions(-) - -diff --git a/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c b/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c -index 7958ac33e36c..5a8061a307cd 100644 ---- a/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c -+++ b/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c -@@ -38,15 +38,17 @@ static int dpaa2_qdma_alloc_chan_resources(struct dma_chan *chan) - if (!dpaa2_chan->fd_pool) - goto err; - -- dpaa2_chan->fl_pool = dma_pool_create("fl_pool", dev, -- sizeof(struct dpaa2_fl_entry), -- sizeof(struct dpaa2_fl_entry), 0); -+ dpaa2_chan->fl_pool = -+ dma_pool_create("fl_pool", dev, -+ sizeof(struct dpaa2_fl_entry) * 3, -+ sizeof(struct dpaa2_fl_entry), 0); -+ - if (!dpaa2_chan->fl_pool) - goto err_fd; - - dpaa2_chan->sdd_pool = - dma_pool_create("sdd_pool", dev, -- sizeof(struct dpaa2_qdma_sd_d), -+ sizeof(struct dpaa2_qdma_sd_d) * 2, - sizeof(struct dpaa2_qdma_sd_d), 0); - if (!dpaa2_chan->sdd_pool) - goto err_fl; --- -2.43.2 - -From d48e89f29f235cf5b620c207be6b73e86f3022bb Mon Sep 17 00:00:00 2001 -From: Jai Luthra <j-luthra@ti.com> -Date: Wed, 3 Jan 2024 14:37:55 +0530 -Subject: [PATCH 1375/1501] dmaengine: ti: k3-udma: Report short packet errors -Content-Length: 2005 -Lines: 59 - -[ Upstream commit bc9847c9ba134cfe3398011e343dcf6588c1c902 ] - -Propagate the TR response status to the device using BCDMA -split-channels. For example CSI-RX driver should be able to check if a -frame was not transferred completely (short packet) and needs to be -discarded. - -Fixes: 25dcb5dd7b7c ("dmaengine: ti: New driver for K3 UDMA") -Signed-off-by: Jai Luthra <j-luthra@ti.com> -Acked-by: Peter Ujfalusi <peter.ujfalusi@gmail.com> -Link: https://lore.kernel.org/r/20240103-tr_resp_err-v1-1-2fdf6d48ab92@ti.com -Signed-off-by: Vinod Koul <vkoul@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/dma/ti/k3-udma.c | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - -diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c -index 30fd2f386f36..037f1408e798 100644 ---- a/drivers/dma/ti/k3-udma.c -+++ b/drivers/dma/ti/k3-udma.c -@@ -3968,6 +3968,7 @@ static void udma_desc_pre_callback(struct virt_dma_chan *vc, - { - struct udma_chan *uc = to_udma_chan(&vc->chan); - struct udma_desc *d; -+ u8 status; - - if (!vd) - return; -@@ -3977,12 +3978,12 @@ static void udma_desc_pre_callback(struct virt_dma_chan *vc, - if (d->metadata_size) - udma_fetch_epib(uc, d); - -- /* Provide residue information for the client */ - if (result) { - void *desc_vaddr = udma_curr_cppi5_desc_vaddr(d, d->desc_idx); - - if (cppi5_desc_get_type(desc_vaddr) == - CPPI5_INFO0_DESC_TYPE_VAL_HOST) { -+ /* Provide residue information for the client */ - result->residue = d->residue - - cppi5_hdesc_get_pktlen(desc_vaddr); - if (result->residue) -@@ -3991,7 +3992,12 @@ static void udma_desc_pre_callback(struct virt_dma_chan *vc, - result->result = DMA_TRANS_NOERROR; - } else { - result->residue = 0; -- result->result = DMA_TRANS_NOERROR; -+ /* Propagate TR Response errors to the client */ -+ status = d->hwdesc[0].tr_resp_base->status; -+ if (status) -+ result->result = DMA_TRANS_ABORTED; -+ else -+ result->result = DMA_TRANS_NOERROR; - } - } - } --- -2.43.2 - -From 1905e4f9479a843545ce5c189703cd2ec0d98477 Mon Sep 17 00:00:00 2001 -From: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Date: Sun, 7 Jan 2024 11:02:03 +0100 -Subject: [PATCH 1376/1501] dmaengine: fsl-qdma: Fix a memory leak related to - the status queue DMA -Content-Length: 2226 -Lines: 62 - -[ Upstream commit 968bc1d7203d384e72afe34124a1801b7af76514 ] - -This dma_alloc_coherent() is undone in the remove function, but not in the -error handling path of fsl_qdma_probe(). - -Switch to the managed version to fix the issue in the probe and simplify -the remove function. - -Fixes: b092529e0aa0 ("dmaengine: fsl-qdma: Add qDMA controller driver for Layerscape SoCs") -Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Link: https://lore.kernel.org/r/a0ef5d0f5a47381617ef339df776ddc68ce48173.1704621515.git.christophe.jaillet@wanadoo.fr -Signed-off-by: Vinod Koul <vkoul@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/dma/fsl-qdma.c | 18 +++++------------- - 1 file changed, 5 insertions(+), 13 deletions(-) - -diff --git a/drivers/dma/fsl-qdma.c b/drivers/dma/fsl-qdma.c -index 47cb28468049..38409e06040a 100644 ---- a/drivers/dma/fsl-qdma.c -+++ b/drivers/dma/fsl-qdma.c -@@ -563,11 +563,11 @@ static struct fsl_qdma_queue - /* - * Buffer for queue command - */ -- status_head->cq = dma_alloc_coherent(&pdev->dev, -- sizeof(struct fsl_qdma_format) * -- status_size, -- &status_head->bus_addr, -- GFP_KERNEL); -+ status_head->cq = dmam_alloc_coherent(&pdev->dev, -+ sizeof(struct fsl_qdma_format) * -+ status_size, -+ &status_head->bus_addr, -+ GFP_KERNEL); - if (!status_head->cq) { - devm_kfree(&pdev->dev, status_head); - return NULL; -@@ -1268,8 +1268,6 @@ static void fsl_qdma_cleanup_vchan(struct dma_device *dmadev) - - static void fsl_qdma_remove(struct platform_device *pdev) - { -- int i; -- struct fsl_qdma_queue *status; - struct device_node *np = pdev->dev.of_node; - struct fsl_qdma_engine *fsl_qdma = platform_get_drvdata(pdev); - -@@ -1277,12 +1275,6 @@ static void fsl_qdma_remove(struct platform_device *pdev) - fsl_qdma_cleanup_vchan(&fsl_qdma->dma_dev); - of_dma_controller_free(np); - dma_async_device_unregister(&fsl_qdma->dma_dev); -- -- for (i = 0; i < fsl_qdma->block_number; i++) { -- status = fsl_qdma->status[i]; -- dma_free_coherent(&pdev->dev, sizeof(struct fsl_qdma_format) * -- status->n_cq, status->cq, status->bus_addr); -- } - } - - static const struct of_device_id fsl_qdma_dt_ids[] = { --- -2.43.2 - -From 198270de9d8eb3b5d5f030825ea303ef95285d24 Mon Sep 17 00:00:00 2001 -From: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Date: Sun, 7 Jan 2024 11:02:04 +0100 -Subject: [PATCH 1377/1501] dmaengine: fsl-qdma: Fix a memory leak related to - the queue command DMA -Content-Length: 1401 -Lines: 39 - -[ Upstream commit 3aa58cb51318e329d203857f7a191678e60bb714 ] - -This dma_alloc_coherent() is undone neither in the remove function, nor in -the error handling path of fsl_qdma_probe(). - -Switch to the managed version to fix both issues. - -Fixes: b092529e0aa0 ("dmaengine: fsl-qdma: Add qDMA controller driver for Layerscape SoCs") -Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> -Link: https://lore.kernel.org/r/7f66aa14f59d32b13672dde28602b47deb294e1f.1704621515.git.christophe.jaillet@wanadoo.fr -Signed-off-by: Vinod Koul <vkoul@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/dma/fsl-qdma.c | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/drivers/dma/fsl-qdma.c b/drivers/dma/fsl-qdma.c -index 38409e06040a..3a5595a1d442 100644 ---- a/drivers/dma/fsl-qdma.c -+++ b/drivers/dma/fsl-qdma.c -@@ -514,11 +514,11 @@ static struct fsl_qdma_queue - queue_temp = queue_head + i + (j * queue_num); - - queue_temp->cq = -- dma_alloc_coherent(&pdev->dev, -- sizeof(struct fsl_qdma_format) * -- queue_size[i], -- &queue_temp->bus_addr, -- GFP_KERNEL); -+ dmam_alloc_coherent(&pdev->dev, -+ sizeof(struct fsl_qdma_format) * -+ queue_size[i], -+ &queue_temp->bus_addr, -+ GFP_KERNEL); - if (!queue_temp->cq) - return NULL; - queue_temp->block_base = fsl_qdma->block_base + --- -2.43.2 - -From fd17d7435944da41f9de119067b8afad5eda3973 Mon Sep 17 00:00:00 2001 -From: James Clark <james.clark@arm.com> -Date: Wed, 24 Jan 2024 09:43:57 +0000 -Subject: [PATCH 1383/1501] perf evlist: Fix evlist__new_default() for > 1 core - PMU -Content-Length: 3701 -Lines: 90 - -[ Upstream commit 7814fe24a6211a610db0b408d87420403b5b7a36 ] - -The 'Session topology' test currently fails with this message when -evlist__new_default() opens more than one event: - - 32: Session topology : - --- start --- - templ file: /tmp/perf-test-vv5YzZ - Using CPUID 0x00000000410fd070 - Opening: unknown-hardware:HG - ------------------------------------------------------------ - perf_event_attr: - type 0 (PERF_TYPE_HARDWARE) - config 0xb00000000 - disabled 1 - ------------------------------------------------------------ - sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 4 - Opening: unknown-hardware:HG - ------------------------------------------------------------ - perf_event_attr: - type 0 (PERF_TYPE_HARDWARE) - config 0xa00000000 - disabled 1 - ------------------------------------------------------------ - sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 5 - non matching sample_type - FAILED tests/topology.c:73 can't get session - ---- end ---- - Session topology: FAILED! - -This is because when re-opening the file and parsing the header, Perf -expects that any file that has more than one event has the sample ID -flag set. Perf record already sets the flag in a similar way when there -is more than one event, so add the same logic to evlist__new_default(). - -evlist__new_default() is only currently used in tests, so I don't -expect this change to have any other side effects. The other tests that -use it don't save and re-open the file so don't hit this issue. - -The session topology test has been failing on Arm big.LITTLE platforms -since commit 251aa040244a3b17 ("perf parse-events: Wildcard most -"numeric" events") when evlist__new_default() started opening multiple -events for 'cycles'. - -Fixes: 251aa040244a3b17 ("perf parse-events: Wildcard most "numeric" events") -Reviewed-by: Ian Rogers <irogers@google.com> -Signed-off-by: James Clark <james.clark@arm.com> -[ This was failing as well on a Rocket Lake Refresh/14700k Intel hybrid system - Arnaldo ] -Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Tested-by: Ian Rogers <irogers@google.com> -Tested-by: Kan Liang <kan.liang@linux.intel.com> -Cc: Adrian Hunter <adrian.hunter@intel.com> -Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> -Cc: Changbin Du <changbin.du@huawei.com> -Cc: Ingo Molnar <mingo@redhat.com> -Cc: Jiri Olsa <jolsa@kernel.org> -Cc: Mark Rutland <mark.rutland@arm.com> -Cc: Namhyung Kim <namhyung@kernel.org> -Cc: Peter Zijlstra <peterz@infradead.org> -Cc: Yang Jihong <yangjihong1@huawei.com> -Closes: https://lore.kernel.org/lkml/CAP-5=fWVQ-7ijjK3-w1q+k2WYVNHbAcejb-xY0ptbjRw476VKA@mail.gmail.com/ -Link: https://lore.kernel.org/r/20240124094358.489372-1-james.clark@arm.com -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - tools/perf/util/evlist.c | 9 ++++++++- - 1 file changed, 8 insertions(+), 1 deletion(-) - -diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c -index e36da58522ef..b0ed14a6da9d 100644 ---- a/tools/perf/util/evlist.c -+++ b/tools/perf/util/evlist.c -@@ -103,7 +103,14 @@ struct evlist *evlist__new_default(void) - err = parse_event(evlist, can_profile_kernel ? "cycles:P" : "cycles:Pu"); - if (err) { - evlist__delete(evlist); -- evlist = NULL; -+ return NULL; -+ } -+ -+ if (evlist->core.nr_entries > 1) { -+ struct evsel *evsel; -+ -+ evlist__for_each_entry(evlist, evsel) -+ evsel__set_sample_id(evsel, /*can_sample_identifier=*/false); - } - - return evlist; --- -2.43.2 - -From 4506077def6e779a42ed352ebd3a8fcc3cda11fb Mon Sep 17 00:00:00 2001 -From: Frank Li <Frank.Li@nxp.com> -Date: Tue, 23 Jan 2024 12:28:41 -0500 -Subject: [PATCH 1384/1501] dmaengine: fix is_slave_direction() return false - when DMA_DEV_TO_DEV -Content-Length: 1123 -Lines: 29 - -[ Upstream commit a22fe1d6dec7e98535b97249fdc95c2be79120bb ] - -is_slave_direction() should return true when direction is DMA_DEV_TO_DEV. - -Fixes: 49920bc66984 ("dmaengine: add new enum dma_transfer_direction") -Signed-off-by: Frank Li <Frank.Li@nxp.com> -Link: https://lore.kernel.org/r/20240123172842.3764529-1-Frank.Li@nxp.com -Signed-off-by: Vinod Koul <vkoul@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/linux/dmaengine.h | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h -index 3df70d6131c8..752dbde4cec1 100644 ---- a/include/linux/dmaengine.h -+++ b/include/linux/dmaengine.h -@@ -953,7 +953,8 @@ static inline int dmaengine_slave_config(struct dma_chan *chan, - - static inline bool is_slave_direction(enum dma_transfer_direction direction) - { -- return (direction == DMA_MEM_TO_DEV) || (direction == DMA_DEV_TO_MEM); -+ return (direction == DMA_MEM_TO_DEV) || (direction == DMA_DEV_TO_MEM) || -+ (direction == DMA_DEV_TO_DEV); - } - - static inline struct dma_async_tx_descriptor *dmaengine_prep_slave_single( --- -2.43.2 - -From 7454c0e3ec9ff2d6f12c2bccb4c70389f006ff2e Mon Sep 17 00:00:00 2001 -From: Shyam Prasad N <sprasad@microsoft.com> -Date: Thu, 1 Feb 2024 11:15:26 +0000 -Subject: [PATCH 1386/1501] cifs: avoid redundant calls to disable multichannel -Content-Length: 1281 -Lines: 34 - -[ Upstream commit e77e15fa5eb1c830597c5ca53ea7af973bae2f78 ] - -When the server reports query network interface info call -as unsupported following a tree connect, it means that -multichannel is unsupported, even if the server capabilities -report otherwise. - -When this happens, cifs_chan_skip_or_disable is called to -disable multichannel on the client. However, we only need -to call this when multichannel is currently setup. - -Fixes: f591062bdbf4 ("cifs: handle servers that still advertise multichannel after disabling") -Signed-off-by: Shyam Prasad N <sprasad@microsoft.com> -Signed-off-by: Steve French <stfrench@microsoft.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/smb/client/smb2pdu.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c -index f5006aa97f5b..5d9c87d2e1e0 100644 ---- a/fs/smb/client/smb2pdu.c -+++ b/fs/smb/client/smb2pdu.c -@@ -410,7 +410,7 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, - rc = SMB3_request_interfaces(xid, tcon, false); - free_xid(xid); - -- if (rc == -EOPNOTSUPP) { -+ if (rc == -EOPNOTSUPP && ses->chan_count > 1) { - /* - * some servers like Azure SMB server do not advertise - * that multichannel has been disabled with server --- -2.43.2 - -From 22a6c5b3425f327e7f4c3606a72277dce82c7d83 Mon Sep 17 00:00:00 2001 -From: Shyam Prasad N <sprasad@microsoft.com> -Date: Thu, 1 Feb 2024 11:15:29 +0000 -Subject: [PATCH 1387/1501] cifs: failure to add channel on iface should bump - up weight -Content-Length: 1656 -Lines: 43 - -[ Upstream commit 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 ] - -After the interface selection policy change to do a weighted -round robin, each iface maintains a weight_fulfilled. When the -weight_fulfilled reaches the total weight for the iface, we know -that the weights can be reset and ifaces can be allocated from -scratch again. - -During channel allocation failures on a particular channel, -weight_fulfilled is not incremented. If a few interfaces are -inactive, we could end up in a situation where the active -interfaces are all allocated for the total_weight, and inactive -ones are all that remain. This can cause a situation where -no more channels can be allocated further. - -This change fixes it by increasing weight_fulfilled, even when -channel allocation failure happens. This could mean that if -there are temporary failures in channel allocation, the iface -weights may not strictly be adhered to. But that's still okay. - -Fixes: a6d8fb54a515 ("cifs: distribute channels across interfaces based on speed") -Signed-off-by: Shyam Prasad N <sprasad@microsoft.com> -Signed-off-by: Steve French <stfrench@microsoft.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/smb/client/sess.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c -index a16e175731eb..a1b973456471 100644 ---- a/fs/smb/client/sess.c -+++ b/fs/smb/client/sess.c -@@ -269,6 +269,8 @@ int cifs_try_adding_channels(struct cifs_ses *ses) - &iface->sockaddr, - rc); - kref_put(&iface->refcount, release_iface); -+ /* failure to add chan should increase weight */ -+ iface->weight_fulfilled++; - continue; - } - --- -2.43.2 - -From 0615d27ab47892459c82780e34bbfa649b0e3b83 Mon Sep 17 00:00:00 2001 -From: Kuogee Hsieh <quic_khsieh@quicinc.com> -Date: Wed, 10 Jan 2024 12:18:51 -0800 -Subject: [PATCH 1388/1501] drm/msms/dp: fixed link clock divider bits be over - written in BPC unknown case -Content-Length: 2675 -Lines: 71 - -[ Upstream commit 77e8aad5519e04f6c1e132aaec1c5f8faf41844f ] - -Since the value of DP_TEST_BIT_DEPTH_8 is already left shifted, in the -BPC unknown case, the additional shift causes spill over to the other -bits of the [DP_CONFIGURATION_CTRL] register. -Fix this by changing the return value of dp_link_get_test_bits_depth() -in the BPC unknown case to (DP_TEST_BIT_DEPTH_8 >> DP_TEST_BIT_DEPTH_SHIFT). - -Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support") -Signed-off-by: Kuogee Hsieh <quic_khsieh@quicinc.com> -Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com> -Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Patchwork: https://patchwork.freedesktop.org/patch/573989/ -Link: https://lore.kernel.org/r/1704917931-30133-1-git-send-email-quic_khsieh@quicinc.com -[quic_abhinavk@quicinc.com: fix minor checkpatch warning to align with opening braces] -Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/msm/dp/dp_ctrl.c | 5 ----- - drivers/gpu/drm/msm/dp/dp_link.c | 10 +++++++--- - 2 files changed, 7 insertions(+), 8 deletions(-) - -diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c -index 77a8d9366ed7..fb588fde298a 100644 ---- a/drivers/gpu/drm/msm/dp/dp_ctrl.c -+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c -@@ -135,11 +135,6 @@ static void dp_ctrl_config_ctrl(struct dp_ctrl_private *ctrl) - tbd = dp_link_get_test_bits_depth(ctrl->link, - ctrl->panel->dp_mode.bpp); - -- if (tbd == DP_TEST_BIT_DEPTH_UNKNOWN) { -- pr_debug("BIT_DEPTH not set. Configure default\n"); -- tbd = DP_TEST_BIT_DEPTH_8; -- } -- - config |= tbd << DP_CONFIGURATION_CTRL_BPC_SHIFT; - - /* Num of Lanes */ -diff --git a/drivers/gpu/drm/msm/dp/dp_link.c b/drivers/gpu/drm/msm/dp/dp_link.c -index 98427d45e9a7..a0015b9e79eb 100644 ---- a/drivers/gpu/drm/msm/dp/dp_link.c -+++ b/drivers/gpu/drm/msm/dp/dp_link.c -@@ -1179,6 +1179,9 @@ void dp_link_reset_phy_params_vx_px(struct dp_link *dp_link) - u32 dp_link_get_test_bits_depth(struct dp_link *dp_link, u32 bpp) - { - u32 tbd; -+ struct dp_link_private *link; -+ -+ link = container_of(dp_link, struct dp_link_private, dp_link); - - /* - * Few simplistic rules and assumptions made here: -@@ -1196,12 +1199,13 @@ u32 dp_link_get_test_bits_depth(struct dp_link *dp_link, u32 bpp) - tbd = DP_TEST_BIT_DEPTH_10; - break; - default: -- tbd = DP_TEST_BIT_DEPTH_UNKNOWN; -+ drm_dbg_dp(link->drm_dev, "bpp=%d not supported, use bpc=8\n", -+ bpp); -+ tbd = DP_TEST_BIT_DEPTH_8; - break; - } - -- if (tbd != DP_TEST_BIT_DEPTH_UNKNOWN) -- tbd = (tbd >> DP_TEST_BIT_DEPTH_SHIFT); -+ tbd = (tbd >> DP_TEST_BIT_DEPTH_SHIFT); - - return tbd; - } --- -2.43.2 - -From e9ecfb56d3a5d21f5ce0736635b983166cbf159e Mon Sep 17 00:00:00 2001 -From: Kuogee Hsieh <quic_khsieh@quicinc.com> -Date: Wed, 17 Jan 2024 13:13:30 -0800 -Subject: [PATCH 1389/1501] drm/msm/dp: return correct Colorimetry for - DP_TEST_DYNAMIC_RANGE_CEA case -Content-Length: 2904 -Lines: 83 - -[ Upstream commit fcccdafd91f8bdde568b86ff70848cf83f029add ] - -MSA MISC0 bit 1 to 7 contains Colorimetry Indicator Field. -dp_link_get_colorimetry_config() returns wrong colorimetry value -in the DP_TEST_DYNAMIC_RANGE_CEA case in the current implementation. -Hence fix this problem by having dp_link_get_colorimetry_config() -return defined CEA RGB colorimetry value in the case of -DP_TEST_DYNAMIC_RANGE_CEA. - -Changes in V2: --- drop retrieving colorimetry from colorspace --- drop dr = link->dp_link.test_video.test_dyn_range assignment - -Changes in V3: --- move defined MISCr0a Colorimetry vale to dp_reg.h --- rewording commit title --- rewording commit text to more precise describe this patch - -Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support") -Signed-off-by: Kuogee Hsieh <quic_khsieh@quicinc.com> -Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Patchwork: https://patchwork.freedesktop.org/patch/574888/ -Link: https://lore.kernel.org/r/1705526010-597-1-git-send-email-quic_khsieh@quicinc.com -Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/msm/dp/dp_link.c | 12 +++++++----- - drivers/gpu/drm/msm/dp/dp_reg.h | 3 +++ - 2 files changed, 10 insertions(+), 5 deletions(-) - -diff --git a/drivers/gpu/drm/msm/dp/dp_link.c b/drivers/gpu/drm/msm/dp/dp_link.c -index a0015b9e79eb..49dfac1fd1ef 100644 ---- a/drivers/gpu/drm/msm/dp/dp_link.c -+++ b/drivers/gpu/drm/msm/dp/dp_link.c -@@ -7,6 +7,7 @@ - - #include <drm/drm_print.h> - -+#include "dp_reg.h" - #include "dp_link.h" - #include "dp_panel.h" - -@@ -1082,7 +1083,7 @@ int dp_link_process_request(struct dp_link *dp_link) - - int dp_link_get_colorimetry_config(struct dp_link *dp_link) - { -- u32 cc; -+ u32 cc = DP_MISC0_COLORIMERY_CFG_LEGACY_RGB; - struct dp_link_private *link; - - if (!dp_link) { -@@ -1096,10 +1097,11 @@ int dp_link_get_colorimetry_config(struct dp_link *dp_link) - * Unless a video pattern CTS test is ongoing, use RGB_VESA - * Only RGB_VESA and RGB_CEA supported for now - */ -- if (dp_link_is_video_pattern_requested(link)) -- cc = link->dp_link.test_video.test_dyn_range; -- else -- cc = DP_TEST_DYNAMIC_RANGE_VESA; -+ if (dp_link_is_video_pattern_requested(link)) { -+ if (link->dp_link.test_video.test_dyn_range & -+ DP_TEST_DYNAMIC_RANGE_CEA) -+ cc = DP_MISC0_COLORIMERY_CFG_CEA_RGB; -+ } - - return cc; - } -diff --git a/drivers/gpu/drm/msm/dp/dp_reg.h b/drivers/gpu/drm/msm/dp/dp_reg.h -index ea85a691e72b..78785ed4b40c 100644 ---- a/drivers/gpu/drm/msm/dp/dp_reg.h -+++ b/drivers/gpu/drm/msm/dp/dp_reg.h -@@ -143,6 +143,9 @@ - #define DP_MISC0_COLORIMETRY_CFG_SHIFT (0x00000001) - #define DP_MISC0_TEST_BITS_DEPTH_SHIFT (0x00000005) - -+#define DP_MISC0_COLORIMERY_CFG_LEGACY_RGB (0) -+#define DP_MISC0_COLORIMERY_CFG_CEA_RGB (0x04) -+ - #define REG_DP_VALID_BOUNDARY (0x00000030) - #define REG_DP_VALID_BOUNDARY_2 (0x00000034) - --- -2.43.2 - -From eb4f56f3ff5799ca754ae6d811803a63fe25a4a2 Mon Sep 17 00:00:00 2001 -From: Abhinav Kumar <quic_abhinavk@quicinc.com> -Date: Wed, 17 Jan 2024 11:41:09 -0800 -Subject: [PATCH 1390/1501] drm/msm/dpu: check for valid hw_pp in - dpu_encoder_helper_phys_cleanup -Content-Length: 1948 -Lines: 45 - -[ Upstream commit 7f3d03c48b1eb6bc45ab20ca98b8b11be25f9f52 ] - -The commit 8b45a26f2ba9 ("drm/msm/dpu: reserve cdm blocks for writeback -in case of YUV output") introduced a smatch warning about another -conditional block in dpu_encoder_helper_phys_cleanup() which had assumed -hw_pp will always be valid which may not necessarily be true. - -Lets fix the other conditional block by making sure hw_pp is valid -before dereferencing it. - -Reported-by: Dan Carpenter <dan.carpenter@linaro.org> -Fixes: ae4d721ce100 ("drm/msm/dpu: add an API to reset the encoder related hw blocks") -Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> -Patchwork: https://patchwork.freedesktop.org/patch/574878/ -Link: https://lore.kernel.org/r/20240117194109.21609-1-quic_abhinavk@quicinc.com -Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -index b9f0093389a8..cf0d44b6e7a3 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -@@ -2075,7 +2075,7 @@ void dpu_encoder_helper_phys_cleanup(struct dpu_encoder_phys *phys_enc) - } - - /* reset the merge 3D HW block */ -- if (phys_enc->hw_pp->merge_3d) { -+ if (phys_enc->hw_pp && phys_enc->hw_pp->merge_3d) { - phys_enc->hw_pp->merge_3d->ops.setup_3d_mode(phys_enc->hw_pp->merge_3d, - BLEND_3D_NONE); - if (phys_enc->hw_ctl->ops.update_pending_flush_merge_3d) -@@ -2097,7 +2097,7 @@ void dpu_encoder_helper_phys_cleanup(struct dpu_encoder_phys *phys_enc) - if (phys_enc->hw_wb) - intf_cfg.wb = phys_enc->hw_wb->idx; - -- if (phys_enc->hw_pp->merge_3d) -+ if (phys_enc->hw_pp && phys_enc->hw_pp->merge_3d) - intf_cfg.merge_3d = phys_enc->hw_pp->merge_3d->idx; - - if (ctl->ops.reset_intf_cfg) --- -2.43.2 - -From 8dcd2aa24bb6b140baff784ccfaab33768267115 Mon Sep 17 00:00:00 2001 -From: Benjamin Berg <benjamin.berg@intel.com> -Date: Tue, 23 Jan 2024 20:08:19 +0200 -Subject: [PATCH 1391/1501] wifi: iwlwifi: mvm: skip adding debugfs symlink for - reconfig -Content-Length: 2626 -Lines: 58 - -[ Upstream commit 3a3ef3940798e85121066a859127e72a528dc32a ] - -The function to add an interface may be called without a previous -removal if the HW is being reconfigured. As such, only add the symlink -if the hardware is not being reconfigured due to a HW_RESTART. - -Fixes: c36235acb34f ("wifi: iwlwifi: mvm: rework debugfs handling") -Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> -Reviewed-by: Gregory Greenman <gregory.greenman@intel.com> -Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> -Link: https://msgid.link/20240123200528.314395eacda4.I5823e962c3c3674b942383733debd10b3fe903e2@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 6 ++++-- - drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c | 3 ++- - 2 files changed, 6 insertions(+), 3 deletions(-) - -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -index a64600f0ed9f..586334eee056 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -@@ -1586,7 +1586,8 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw, - */ - if (vif->type == NL80211_IFTYPE_AP || - vif->type == NL80211_IFTYPE_ADHOC) { -- iwl_mvm_vif_dbgfs_add_link(mvm, vif); -+ if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) -+ iwl_mvm_vif_dbgfs_add_link(mvm, vif); - ret = 0; - goto out; - } -@@ -1626,7 +1627,8 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw, - iwl_mvm_chandef_get_primary_80(&vif->bss_conf.chandef); - } - -- iwl_mvm_vif_dbgfs_add_link(mvm, vif); -+ if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) -+ iwl_mvm_vif_dbgfs_add_link(mvm, vif); - - if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) && - vif->type == NL80211_IFTYPE_STATION && !vif->p2p && -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c -index 61170173f917..1f36e934ef69 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c -@@ -81,7 +81,8 @@ static int iwl_mvm_mld_mac_add_interface(struct ieee80211_hw *hw, - ieee80211_hw_set(mvm->hw, RX_INCLUDES_FCS); - } - -- iwl_mvm_vif_dbgfs_add_link(mvm, vif); -+ if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) -+ iwl_mvm_vif_dbgfs_add_link(mvm, vif); - - if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) && - vif->type == NL80211_IFTYPE_STATION && !vif->p2p && --- -2.43.2 - -From 7f3e756c763e7538a9dbc454da644c7715fbde3b Mon Sep 17 00:00:00 2001 -From: Ard Biesheuvel <ardb@kernel.org> -Date: Fri, 26 Jan 2024 12:14:30 +0100 -Subject: [PATCH 1392/1501] x86/efistub: Give up if memory attribute protocol - returns an error -Content-Length: 3980 -Lines: 112 - -[ Upstream commit a7a6a01f88e87dec4bf2365571dd2dc7403d52d0 ] - -The recently introduced EFI memory attributes protocol should be used -if it exists to ensure that the memory allocation created for the kernel -permits execution. This is needed for compatibility with tightened -requirements related to Windows logo certification for x86 PCs. - -Currently, we simply strip the execute protect (XP) attribute from the -entire range, but this might be rejected under some firmware security -policies, and so in a subsequent patch, this will be changed to only -strip XP from the executable region that runs early, and make it -read-only (RO) as well. - -In order to catch any issues early, ensure that the memory attribute -protocol works as intended, and give up if it produces spurious errors. - -Note that the DXE services based fallback was always based on best -effort, so don't propagate any errors returned by that API. - -Fixes: a1b87d54f4e4 ("x86/efistub: Avoid legacy decompressor when doing EFI boot") -Signed-off-by: Ard Biesheuvel <ardb@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/firmware/efi/libstub/x86-stub.c | 24 ++++++++++++++---------- - drivers/firmware/efi/libstub/x86-stub.h | 4 ++-- - 2 files changed, 16 insertions(+), 12 deletions(-) - -diff --git a/drivers/firmware/efi/libstub/x86-stub.c b/drivers/firmware/efi/libstub/x86-stub.c -index 0d510c9a06a4..cb0be88c8131 100644 ---- a/drivers/firmware/efi/libstub/x86-stub.c -+++ b/drivers/firmware/efi/libstub/x86-stub.c -@@ -223,8 +223,8 @@ static void retrieve_apple_device_properties(struct boot_params *boot_params) - } - } - --void efi_adjust_memory_range_protection(unsigned long start, -- unsigned long size) -+efi_status_t efi_adjust_memory_range_protection(unsigned long start, -+ unsigned long size) - { - efi_status_t status; - efi_gcd_memory_space_desc_t desc; -@@ -236,13 +236,17 @@ void efi_adjust_memory_range_protection(unsigned long start, - rounded_end = roundup(start + size, EFI_PAGE_SIZE); - - if (memattr != NULL) { -- efi_call_proto(memattr, clear_memory_attributes, rounded_start, -- rounded_end - rounded_start, EFI_MEMORY_XP); -- return; -+ status = efi_call_proto(memattr, clear_memory_attributes, -+ rounded_start, -+ rounded_end - rounded_start, -+ EFI_MEMORY_XP); -+ if (status != EFI_SUCCESS) -+ efi_warn("Failed to clear EFI_MEMORY_XP attribute\n"); -+ return status; - } - - if (efi_dxe_table == NULL) -- return; -+ return EFI_SUCCESS; - - /* - * Don't modify memory region attributes, they are -@@ -255,7 +259,7 @@ void efi_adjust_memory_range_protection(unsigned long start, - status = efi_dxe_call(get_memory_space_descriptor, start, &desc); - - if (status != EFI_SUCCESS) -- return; -+ break; - - next = desc.base_address + desc.length; - -@@ -280,8 +284,10 @@ void efi_adjust_memory_range_protection(unsigned long start, - unprotect_start, - unprotect_start + unprotect_size, - status); -+ break; - } - } -+ return EFI_SUCCESS; - } - - static void setup_unaccepted_memory(void) -@@ -805,9 +811,7 @@ static efi_status_t efi_decompress_kernel(unsigned long *kernel_entry) - - *kernel_entry = addr + entry; - -- efi_adjust_memory_range_protection(addr, kernel_total_size); -- -- return EFI_SUCCESS; -+ return efi_adjust_memory_range_protection(addr, kernel_total_size); - } - - static void __noreturn enter_kernel(unsigned long kernel_addr, -diff --git a/drivers/firmware/efi/libstub/x86-stub.h b/drivers/firmware/efi/libstub/x86-stub.h -index 37c5a36b9d8c..1c20e99a6494 100644 ---- a/drivers/firmware/efi/libstub/x86-stub.h -+++ b/drivers/firmware/efi/libstub/x86-stub.h -@@ -5,8 +5,8 @@ - extern void trampoline_32bit_src(void *, bool); - extern const u16 trampoline_ljmp_imm_offset; - --void efi_adjust_memory_range_protection(unsigned long start, -- unsigned long size); -+efi_status_t efi_adjust_memory_range_protection(unsigned long start, -+ unsigned long size); - - #ifdef CONFIG_X86_64 - efi_status_t efi_setup_5level_paging(void); --- -2.43.2 - -From 83eb64e6ac1b082f80aa2bba10d4c351aead3b65 Mon Sep 17 00:00:00 2001 -From: Ard Biesheuvel <ardb@kernel.org> -Date: Tue, 30 Jan 2024 19:01:35 +0100 -Subject: [PATCH 1393/1501] x86/efistub: Avoid placing the kernel below - LOAD_PHYSICAL_ADDR -Content-Length: 5645 -Lines: 134 - -[ Upstream commit 2f77465b05b1270c832b5e2ee27037672ad2a10a ] - -The EFI stub's kernel placement logic randomizes the physical placement -of the kernel by taking all available memory into account, and picking a -region at random, based on a random seed. - -When KASLR is disabled, this seed is set to 0x0, and this results in the -lowest available region of memory to be selected for loading the kernel, -even if this is below LOAD_PHYSICAL_ADDR. Some of this memory is -typically reserved for the GFP_DMA region, to accommodate masters that -can only access the first 16 MiB of system memory. - -Even if such devices are rare these days, we may still end up with a -warning in the kernel log, as reported by Tom: - - swapper/0: page allocation failure: order:10, mode:0xcc1(GFP_KERNEL|GFP_DMA), nodemask=(null),cpuset=/,mems_allowed=0 - -Fix this by tweaking the random allocation logic to accept a low bound -on the placement, and set it to LOAD_PHYSICAL_ADDR. - -Fixes: a1b87d54f4e4 ("x86/efistub: Avoid legacy decompressor when doing EFI boot") -Reported-by: Tom Englund <tomenglund26@gmail.com> -Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218404 -Signed-off-by: Ard Biesheuvel <ardb@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/firmware/efi/libstub/efistub.h | 3 ++- - drivers/firmware/efi/libstub/kaslr.c | 2 +- - drivers/firmware/efi/libstub/randomalloc.c | 12 +++++++----- - drivers/firmware/efi/libstub/x86-stub.c | 1 + - drivers/firmware/efi/libstub/zboot.c | 2 +- - 5 files changed, 12 insertions(+), 8 deletions(-) - -diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h -index 212687c30d79..c04b82ea40f2 100644 ---- a/drivers/firmware/efi/libstub/efistub.h -+++ b/drivers/firmware/efi/libstub/efistub.h -@@ -956,7 +956,8 @@ efi_status_t efi_get_random_bytes(unsigned long size, u8 *out); - - efi_status_t efi_random_alloc(unsigned long size, unsigned long align, - unsigned long *addr, unsigned long random_seed, -- int memory_type, unsigned long alloc_limit); -+ int memory_type, unsigned long alloc_min, -+ unsigned long alloc_max); - - efi_status_t efi_random_get_seed(void); - -diff --git a/drivers/firmware/efi/libstub/kaslr.c b/drivers/firmware/efi/libstub/kaslr.c -index 62d63f7a2645..1a9808012abd 100644 ---- a/drivers/firmware/efi/libstub/kaslr.c -+++ b/drivers/firmware/efi/libstub/kaslr.c -@@ -119,7 +119,7 @@ efi_status_t efi_kaslr_relocate_kernel(unsigned long *image_addr, - */ - status = efi_random_alloc(*reserve_size, min_kimg_align, - reserve_addr, phys_seed, -- EFI_LOADER_CODE, EFI_ALLOC_LIMIT); -+ EFI_LOADER_CODE, 0, EFI_ALLOC_LIMIT); - if (status != EFI_SUCCESS) - efi_warn("efi_random_alloc() failed: 0x%lx\n", status); - } else { -diff --git a/drivers/firmware/efi/libstub/randomalloc.c b/drivers/firmware/efi/libstub/randomalloc.c -index 674a064b8f7a..4e96a855fdf4 100644 ---- a/drivers/firmware/efi/libstub/randomalloc.c -+++ b/drivers/firmware/efi/libstub/randomalloc.c -@@ -17,7 +17,7 @@ - static unsigned long get_entry_num_slots(efi_memory_desc_t *md, - unsigned long size, - unsigned long align_shift, -- u64 alloc_limit) -+ u64 alloc_min, u64 alloc_max) - { - unsigned long align = 1UL << align_shift; - u64 first_slot, last_slot, region_end; -@@ -30,11 +30,11 @@ static unsigned long get_entry_num_slots(efi_memory_desc_t *md, - return 0; - - region_end = min(md->phys_addr + md->num_pages * EFI_PAGE_SIZE - 1, -- alloc_limit); -+ alloc_max); - if (region_end < size) - return 0; - -- first_slot = round_up(md->phys_addr, align); -+ first_slot = round_up(max(md->phys_addr, alloc_min), align); - last_slot = round_down(region_end - size + 1, align); - - if (first_slot > last_slot) -@@ -56,7 +56,8 @@ efi_status_t efi_random_alloc(unsigned long size, - unsigned long *addr, - unsigned long random_seed, - int memory_type, -- unsigned long alloc_limit) -+ unsigned long alloc_min, -+ unsigned long alloc_max) - { - unsigned long total_slots = 0, target_slot; - unsigned long total_mirrored_slots = 0; -@@ -78,7 +79,8 @@ efi_status_t efi_random_alloc(unsigned long size, - efi_memory_desc_t *md = (void *)map->map + map_offset; - unsigned long slots; - -- slots = get_entry_num_slots(md, size, ilog2(align), alloc_limit); -+ slots = get_entry_num_slots(md, size, ilog2(align), alloc_min, -+ alloc_max); - MD_NUM_SLOTS(md) = slots; - total_slots += slots; - if (md->attribute & EFI_MEMORY_MORE_RELIABLE) -diff --git a/drivers/firmware/efi/libstub/x86-stub.c b/drivers/firmware/efi/libstub/x86-stub.c -index cb0be88c8131..99429bc4b0c7 100644 ---- a/drivers/firmware/efi/libstub/x86-stub.c -+++ b/drivers/firmware/efi/libstub/x86-stub.c -@@ -799,6 +799,7 @@ static efi_status_t efi_decompress_kernel(unsigned long *kernel_entry) - - status = efi_random_alloc(alloc_size, CONFIG_PHYSICAL_ALIGN, &addr, - seed[0], EFI_LOADER_CODE, -+ LOAD_PHYSICAL_ADDR, - EFI_X86_KERNEL_ALLOC_LIMIT); - if (status != EFI_SUCCESS) - return status; -diff --git a/drivers/firmware/efi/libstub/zboot.c b/drivers/firmware/efi/libstub/zboot.c -index bdb17eac0cb4..1ceace956758 100644 ---- a/drivers/firmware/efi/libstub/zboot.c -+++ b/drivers/firmware/efi/libstub/zboot.c -@@ -119,7 +119,7 @@ efi_zboot_entry(efi_handle_t handle, efi_system_table_t *systab) - } - - status = efi_random_alloc(alloc_size, min_kimg_align, &image_base, -- seed, EFI_LOADER_CODE, EFI_ALLOC_LIMIT); -+ seed, EFI_LOADER_CODE, 0, EFI_ALLOC_LIMIT); - if (status != EFI_SUCCESS) { - efi_err("Failed to allocate memory\n"); - goto free_cmdline; --- -2.43.2 - -From 3b48c9e258c8691c2f093ee07b1ea3764caaa1b2 Mon Sep 17 00:00:00 2001 -From: Furong Xu <0x1207@gmail.com> -Date: Wed, 31 Jan 2024 10:08:28 +0800 -Subject: [PATCH 1394/1501] net: stmmac: xgmac: fix handling of DPP safety - error for DMA channels -Content-Length: 5743 -Lines: 150 - -[ Upstream commit 46eba193d04f8bd717e525eb4110f3c46c12aec3 ] - -Commit 56e58d6c8a56 ("net: stmmac: Implement Safety Features in -XGMAC core") checks and reports safety errors, but leaves the -Data Path Parity Errors for each channel in DMA unhandled at all, lead to -a storm of interrupt. -Fix it by checking and clearing the DMA_DPP_Interrupt_Status register. - -Fixes: 56e58d6c8a56 ("net: stmmac: Implement Safety Features in XGMAC core") -Signed-off-by: Furong Xu <0x1207@gmail.com> -Reviewed-by: Simon Horman <horms@kernel.org> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/stmicro/stmmac/common.h | 1 + - .../net/ethernet/stmicro/stmmac/dwxgmac2.h | 3 + - .../ethernet/stmicro/stmmac/dwxgmac2_core.c | 57 ++++++++++++++++++- - 3 files changed, 60 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h -index e3f650e88f82..588e44d57f29 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/common.h -+++ b/drivers/net/ethernet/stmicro/stmmac/common.h -@@ -216,6 +216,7 @@ struct stmmac_safety_stats { - unsigned long mac_errors[32]; - unsigned long mtl_errors[32]; - unsigned long dma_errors[32]; -+ unsigned long dma_dpp_errors[32]; - }; - - /* Number of fields in Safety Stats */ -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h -index a4e8b498dea9..7d7133ef4994 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h -+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h -@@ -319,6 +319,8 @@ - #define XGMAC_RXCEIE BIT(4) - #define XGMAC_TXCEIE BIT(0) - #define XGMAC_MTL_ECC_INT_STATUS 0x000010cc -+#define XGMAC_MTL_DPP_CONTROL 0x000010e0 -+#define XGMAC_DDPP_DISABLE BIT(0) - #define XGMAC_MTL_TXQ_OPMODE(x) (0x00001100 + (0x80 * (x))) - #define XGMAC_TQS GENMASK(25, 16) - #define XGMAC_TQS_SHIFT 16 -@@ -401,6 +403,7 @@ - #define XGMAC_DCEIE BIT(1) - #define XGMAC_TCEIE BIT(0) - #define XGMAC_DMA_ECC_INT_STATUS 0x0000306c -+#define XGMAC_DMA_DPP_INT_STATUS 0x00003074 - #define XGMAC_DMA_CH_CONTROL(x) (0x00003100 + (0x80 * (x))) - #define XGMAC_SPH BIT(24) - #define XGMAC_PBLx8 BIT(16) -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c -index a74e71db79f9..e7eccc0c406f 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c -@@ -830,6 +830,43 @@ static const struct dwxgmac3_error_desc dwxgmac3_dma_errors[32]= { - { false, "UNKNOWN", "Unknown Error" }, /* 31 */ - }; - -+static const char * const dpp_rx_err = "Read Rx Descriptor Parity checker Error"; -+static const char * const dpp_tx_err = "Read Tx Descriptor Parity checker Error"; -+static const struct dwxgmac3_error_desc dwxgmac3_dma_dpp_errors[32] = { -+ { true, "TDPES0", dpp_tx_err }, -+ { true, "TDPES1", dpp_tx_err }, -+ { true, "TDPES2", dpp_tx_err }, -+ { true, "TDPES3", dpp_tx_err }, -+ { true, "TDPES4", dpp_tx_err }, -+ { true, "TDPES5", dpp_tx_err }, -+ { true, "TDPES6", dpp_tx_err }, -+ { true, "TDPES7", dpp_tx_err }, -+ { true, "TDPES8", dpp_tx_err }, -+ { true, "TDPES9", dpp_tx_err }, -+ { true, "TDPES10", dpp_tx_err }, -+ { true, "TDPES11", dpp_tx_err }, -+ { true, "TDPES12", dpp_tx_err }, -+ { true, "TDPES13", dpp_tx_err }, -+ { true, "TDPES14", dpp_tx_err }, -+ { true, "TDPES15", dpp_tx_err }, -+ { true, "RDPES0", dpp_rx_err }, -+ { true, "RDPES1", dpp_rx_err }, -+ { true, "RDPES2", dpp_rx_err }, -+ { true, "RDPES3", dpp_rx_err }, -+ { true, "RDPES4", dpp_rx_err }, -+ { true, "RDPES5", dpp_rx_err }, -+ { true, "RDPES6", dpp_rx_err }, -+ { true, "RDPES7", dpp_rx_err }, -+ { true, "RDPES8", dpp_rx_err }, -+ { true, "RDPES9", dpp_rx_err }, -+ { true, "RDPES10", dpp_rx_err }, -+ { true, "RDPES11", dpp_rx_err }, -+ { true, "RDPES12", dpp_rx_err }, -+ { true, "RDPES13", dpp_rx_err }, -+ { true, "RDPES14", dpp_rx_err }, -+ { true, "RDPES15", dpp_rx_err }, -+}; -+ - static void dwxgmac3_handle_dma_err(struct net_device *ndev, - void __iomem *ioaddr, bool correctable, - struct stmmac_safety_stats *stats) -@@ -841,6 +878,13 @@ static void dwxgmac3_handle_dma_err(struct net_device *ndev, - - dwxgmac3_log_error(ndev, value, correctable, "DMA", - dwxgmac3_dma_errors, STAT_OFF(dma_errors), stats); -+ -+ value = readl(ioaddr + XGMAC_DMA_DPP_INT_STATUS); -+ writel(value, ioaddr + XGMAC_DMA_DPP_INT_STATUS); -+ -+ dwxgmac3_log_error(ndev, value, false, "DMA_DPP", -+ dwxgmac3_dma_dpp_errors, -+ STAT_OFF(dma_dpp_errors), stats); - } - - static int -@@ -881,6 +925,12 @@ dwxgmac3_safety_feat_config(void __iomem *ioaddr, unsigned int asp, - value |= XGMAC_TMOUTEN; /* FSM Timeout Feature */ - writel(value, ioaddr + XGMAC_MAC_FSM_CONTROL); - -+ /* 5. Enable Data Path Parity Protection */ -+ value = readl(ioaddr + XGMAC_MTL_DPP_CONTROL); -+ /* already enabled by default, explicit enable it again */ -+ value &= ~XGMAC_DDPP_DISABLE; -+ writel(value, ioaddr + XGMAC_MTL_DPP_CONTROL); -+ - return 0; - } - -@@ -914,7 +964,11 @@ static int dwxgmac3_safety_feat_irq_status(struct net_device *ndev, - ret |= !corr; - } - -- err = dma & (XGMAC_DEUIS | XGMAC_DECIS); -+ /* DMA_DPP_Interrupt_Status is indicated by MCSIS bit in -+ * DMA_Safety_Interrupt_Status, so we handle DMA Data Path -+ * Parity Errors here -+ */ -+ err = dma & (XGMAC_DEUIS | XGMAC_DECIS | XGMAC_MCSIS); - corr = dma & XGMAC_DECIS; - if (err) { - dwxgmac3_handle_dma_err(ndev, ioaddr, corr, stats); -@@ -930,6 +984,7 @@ static const struct dwxgmac3_error { - { dwxgmac3_mac_errors }, - { dwxgmac3_mtl_errors }, - { dwxgmac3_dma_errors }, -+ { dwxgmac3_dma_dpp_errors }, - }; - - static int dwxgmac3_safety_feat_dump(struct stmmac_safety_stats *stats, --- -2.43.2 - -From 7af9b4dc0bee19cf3559c24e753bb85c038118c8 Mon Sep 17 00:00:00 2001 -From: Benjamin Berg <benjamin.berg@intel.com> -Date: Mon, 11 Dec 2023 09:05:28 +0200 -Subject: [PATCH 1395/1501] wifi: cfg80211: consume both probe response and - beacon IEs -Content-Length: 1272 -Lines: 33 - -[ Upstream commit f510bcc21ed97911b811c5bf36ed43a0e94ab702 ] - -When doing a channel switch, cfg80211_update_known_bss may be called -with a BSS where both proberesp_ies and beacon_ies is set. If that -happens, both need to be consumed. - -Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> -Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> -Link: https://msgid.link/20231211085121.07a88656d7df.I0fe9fc599382de0eccf96455617e377d9c231966@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Stable-dep-of: 177fbbcb4ed6 ("wifi: cfg80211: detect stuck ECSA element in probe resp") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/wireless/scan.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/net/wireless/scan.c b/net/wireless/scan.c -index b9da6f5152cb..f819ca3891fc 100644 ---- a/net/wireless/scan.c -+++ b/net/wireless/scan.c -@@ -1746,7 +1746,9 @@ cfg80211_update_known_bss(struct cfg80211_registered_device *rdev, - new->pub.proberesp_ies); - if (old) - kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head); -- } else if (rcu_access_pointer(new->pub.beacon_ies)) { -+ } -+ -+ if (rcu_access_pointer(new->pub.beacon_ies)) { - const struct cfg80211_bss_ies *old; - - if (known->pub.hidden_beacon_bss && --- -2.43.2 - -From ce112c941c2b172afba3e913a90c380647d53975 Mon Sep 17 00:00:00 2001 -From: Johannes Berg <johannes.berg@intel.com> -Date: Mon, 29 Jan 2024 13:14:13 +0100 -Subject: [PATCH 1396/1501] wifi: cfg80211: detect stuck ECSA element in probe - resp -Content-Length: 4674 -Lines: 134 - -[ Upstream commit 177fbbcb4ed6b306c1626a277fac3fb1c495a4c7 ] - -We recently added some validation that we don't try to -connect to an AP that is currently in a channel switch -process, since that might want the channel to be quiet -or we might not be able to connect in time to hear the -switching in a beacon. This was in commit c09c4f31998b -("wifi: mac80211: don't connect to an AP while it's in -a CSA process"). - -However, we promptly got a report that this caused new -connection failures, and it turns out that the AP that -we now cannot connect to is permanently advertising an -extended channel switch announcement, even with quiet. -The AP in question was an Asus RT-AC53, with firmware -3.0.0.4.380_10760-g21a5898. - -As a first step, attempt to detect that we're dealing -with such a situation, so mac80211 can use this later. - -Reported-by: coldolt <andypalmadi@gmail.com> -Closes: https://lore.kernel.org/linux-wireless/CAJvGw+DQhBk_mHXeu6RTOds5iramMW2FbMB01VbKRA4YbHHDTA@mail.gmail.com/ -Fixes: c09c4f31998b ("wifi: mac80211: don't connect to an AP while it's in a CSA process") -Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> -Link: https://msgid.link/20240129131413.246972c8775e.Ibf834d7f52f9951a353b6872383da710a7358338@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/net/cfg80211.h | 4 +++ - net/wireless/scan.c | 59 +++++++++++++++++++++++++++++++++++++++++- - 2 files changed, 62 insertions(+), 1 deletion(-) - -diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h -index 4ecfb06c413d..8f2c48761833 100644 ---- a/include/net/cfg80211.h -+++ b/include/net/cfg80211.h -@@ -2865,6 +2865,8 @@ struct cfg80211_bss_ies { - * own the beacon_ies, but they're just pointers to the ones from the - * @hidden_beacon_bss struct) - * @proberesp_ies: the information elements from the last Probe Response frame -+ * @proberesp_ecsa_stuck: ECSA element is stuck in the Probe Response frame, -+ * cannot rely on it having valid data - * @hidden_beacon_bss: in case this BSS struct represents a probe response from - * a BSS that hides the SSID in its beacon, this points to the BSS struct - * that holds the beacon data. @beacon_ies is still valid, of course, and -@@ -2900,6 +2902,8 @@ struct cfg80211_bss { - u8 chains; - s8 chain_signal[IEEE80211_MAX_CHAINS]; - -+ u8 proberesp_ecsa_stuck:1; -+ - u8 bssid_index; - u8 max_bssid_indicator; - -diff --git a/net/wireless/scan.c b/net/wireless/scan.c -index f819ca3891fc..3f49f5c69916 100644 ---- a/net/wireless/scan.c -+++ b/net/wireless/scan.c -@@ -1725,6 +1725,61 @@ static void cfg80211_update_hidden_bsses(struct cfg80211_internal_bss *known, - } - } - -+static void cfg80211_check_stuck_ecsa(struct cfg80211_registered_device *rdev, -+ struct cfg80211_internal_bss *known, -+ const struct cfg80211_bss_ies *old) -+{ -+ const struct ieee80211_ext_chansw_ie *ecsa; -+ const struct element *elem_new, *elem_old; -+ const struct cfg80211_bss_ies *new, *bcn; -+ -+ if (known->pub.proberesp_ecsa_stuck) -+ return; -+ -+ new = rcu_dereference_protected(known->pub.proberesp_ies, -+ lockdep_is_held(&rdev->bss_lock)); -+ if (WARN_ON(!new)) -+ return; -+ -+ if (new->tsf - old->tsf < USEC_PER_SEC) -+ return; -+ -+ elem_old = cfg80211_find_elem(WLAN_EID_EXT_CHANSWITCH_ANN, -+ old->data, old->len); -+ if (!elem_old) -+ return; -+ -+ elem_new = cfg80211_find_elem(WLAN_EID_EXT_CHANSWITCH_ANN, -+ new->data, new->len); -+ if (!elem_new) -+ return; -+ -+ bcn = rcu_dereference_protected(known->pub.beacon_ies, -+ lockdep_is_held(&rdev->bss_lock)); -+ if (bcn && -+ cfg80211_find_elem(WLAN_EID_EXT_CHANSWITCH_ANN, -+ bcn->data, bcn->len)) -+ return; -+ -+ if (elem_new->datalen != elem_old->datalen) -+ return; -+ if (elem_new->datalen < sizeof(struct ieee80211_ext_chansw_ie)) -+ return; -+ if (memcmp(elem_new->data, elem_old->data, elem_new->datalen)) -+ return; -+ -+ ecsa = (void *)elem_new->data; -+ -+ if (!ecsa->mode) -+ return; -+ -+ if (ecsa->new_ch_num != -+ ieee80211_frequency_to_channel(known->pub.channel->center_freq)) -+ return; -+ -+ known->pub.proberesp_ecsa_stuck = 1; -+} -+ - static bool - cfg80211_update_known_bss(struct cfg80211_registered_device *rdev, - struct cfg80211_internal_bss *known, -@@ -1744,8 +1799,10 @@ cfg80211_update_known_bss(struct cfg80211_registered_device *rdev, - /* Override possible earlier Beacon frame IEs */ - rcu_assign_pointer(known->pub.ies, - new->pub.proberesp_ies); -- if (old) -+ if (old) { -+ cfg80211_check_stuck_ecsa(rdev, known, old); - kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head); -+ } - } - - if (rcu_access_pointer(new->pub.beacon_ies)) { --- -2.43.2 - -From ea88bde8e3fefbe4268f6991375dd629895a090a Mon Sep 17 00:00:00 2001 -From: Johannes Berg <johannes.berg@intel.com> -Date: Mon, 29 Jan 2024 13:14:14 +0100 -Subject: [PATCH 1397/1501] wifi: mac80211: improve CSA/ECSA connection refusal -Content-Length: 6443 -Lines: 179 - -[ Upstream commit 35e2385dbe787936c793d70755a5177d267a40aa ] - -As mentioned in the previous commit, we pretty quickly found -that some APs have ECSA elements stuck in their probe response, -so using that to not attempt to connect while CSA is happening -we never connect to such an AP. - -Improve this situation by checking more carefully and ignoring -the ECSA if cfg80211 has previously detected the ECSA element -being stuck in the probe response. - -Additionally, allow connecting to an AP that's switching to a -channel it's already using, unless it's using quiet mode. In -this case, we may just have to adjust bandwidth later. If it's -actually switching channels, it's better not to try to connect -in the middle of that. - -Reported-by: coldolt <andypalmadi@gmail.com> -Closes: https://lore.kernel.org/linux-wireless/CAJvGw+DQhBk_mHXeu6RTOds5iramMW2FbMB01VbKRA4YbHHDTA@mail.gmail.com/ -Fixes: c09c4f31998b ("wifi: mac80211: don't connect to an AP while it's in a CSA process") -Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> -Link: https://msgid.link/20240129131413.cc2d0a26226e.I682c016af76e35b6c47007db50e8554c5a426910@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/mac80211/mlme.c | 103 ++++++++++++++++++++++++++++++++------------ - 1 file changed, 76 insertions(+), 27 deletions(-) - -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index dcdaab19efbd..bbe36d87ac59 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -7288,6 +7288,75 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata, - return err; - } - -+static bool ieee80211_mgd_csa_present(struct ieee80211_sub_if_data *sdata, -+ const struct cfg80211_bss_ies *ies, -+ u8 cur_channel, bool ignore_ecsa) -+{ -+ const struct element *csa_elem, *ecsa_elem; -+ struct ieee80211_channel_sw_ie *csa = NULL; -+ struct ieee80211_ext_chansw_ie *ecsa = NULL; -+ -+ if (!ies) -+ return false; -+ -+ csa_elem = cfg80211_find_elem(WLAN_EID_CHANNEL_SWITCH, -+ ies->data, ies->len); -+ if (csa_elem && csa_elem->datalen == sizeof(*csa)) -+ csa = (void *)csa_elem->data; -+ -+ ecsa_elem = cfg80211_find_elem(WLAN_EID_EXT_CHANSWITCH_ANN, -+ ies->data, ies->len); -+ if (ecsa_elem && ecsa_elem->datalen == sizeof(*ecsa)) -+ ecsa = (void *)ecsa_elem->data; -+ -+ if (csa && csa->count == 0) -+ csa = NULL; -+ if (csa && !csa->mode && csa->new_ch_num == cur_channel) -+ csa = NULL; -+ -+ if (ecsa && ecsa->count == 0) -+ ecsa = NULL; -+ if (ecsa && !ecsa->mode && ecsa->new_ch_num == cur_channel) -+ ecsa = NULL; -+ -+ if (ignore_ecsa && ecsa) { -+ sdata_info(sdata, -+ "Ignoring ECSA in probe response - was considered stuck!\n"); -+ return csa; -+ } -+ -+ return csa || ecsa; -+} -+ -+static bool ieee80211_mgd_csa_in_process(struct ieee80211_sub_if_data *sdata, -+ struct cfg80211_bss *bss) -+{ -+ u8 cur_channel; -+ bool ret; -+ -+ cur_channel = ieee80211_frequency_to_channel(bss->channel->center_freq); -+ -+ rcu_read_lock(); -+ if (ieee80211_mgd_csa_present(sdata, -+ rcu_dereference(bss->beacon_ies), -+ cur_channel, false)) { -+ ret = true; -+ goto out; -+ } -+ -+ if (ieee80211_mgd_csa_present(sdata, -+ rcu_dereference(bss->proberesp_ies), -+ cur_channel, bss->proberesp_ecsa_stuck)) { -+ ret = true; -+ goto out; -+ } -+ -+ ret = false; -+out: -+ rcu_read_unlock(); -+ return ret; -+} -+ - /* config hooks */ - int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata, - struct cfg80211_auth_request *req) -@@ -7296,7 +7365,6 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata, - struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; - struct ieee80211_mgd_auth_data *auth_data; - struct ieee80211_link_data *link; -- const struct element *csa_elem, *ecsa_elem; - u16 auth_alg; - int err; - bool cont_auth; -@@ -7339,21 +7407,10 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata, - if (ifmgd->assoc_data) - return -EBUSY; - -- rcu_read_lock(); -- csa_elem = ieee80211_bss_get_elem(req->bss, WLAN_EID_CHANNEL_SWITCH); -- ecsa_elem = ieee80211_bss_get_elem(req->bss, -- WLAN_EID_EXT_CHANSWITCH_ANN); -- if ((csa_elem && -- csa_elem->datalen == sizeof(struct ieee80211_channel_sw_ie) && -- ((struct ieee80211_channel_sw_ie *)csa_elem->data)->count != 0) || -- (ecsa_elem && -- ecsa_elem->datalen == sizeof(struct ieee80211_ext_chansw_ie) && -- ((struct ieee80211_ext_chansw_ie *)ecsa_elem->data)->count != 0)) { -- rcu_read_unlock(); -+ if (ieee80211_mgd_csa_in_process(sdata, req->bss)) { - sdata_info(sdata, "AP is in CSA process, reject auth\n"); - return -EINVAL; - } -- rcu_read_unlock(); - - auth_data = kzalloc(sizeof(*auth_data) + req->auth_data_len + - req->ie_len, GFP_KERNEL); -@@ -7662,7 +7719,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata, - struct ieee80211_local *local = sdata->local; - struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; - struct ieee80211_mgd_assoc_data *assoc_data; -- const struct element *ssid_elem, *csa_elem, *ecsa_elem; -+ const struct element *ssid_elem; - struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg; - ieee80211_conn_flags_t conn_flags = 0; - struct ieee80211_link_data *link; -@@ -7685,23 +7742,15 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata, - - cbss = req->link_id < 0 ? req->bss : req->links[req->link_id].bss; - -- rcu_read_lock(); -- ssid_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_SSID); -- if (!ssid_elem || ssid_elem->datalen > sizeof(assoc_data->ssid)) { -- rcu_read_unlock(); -+ if (ieee80211_mgd_csa_in_process(sdata, cbss)) { -+ sdata_info(sdata, "AP is in CSA process, reject assoc\n"); - kfree(assoc_data); - return -EINVAL; - } - -- csa_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_CHANNEL_SWITCH); -- ecsa_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_EXT_CHANSWITCH_ANN); -- if ((csa_elem && -- csa_elem->datalen == sizeof(struct ieee80211_channel_sw_ie) && -- ((struct ieee80211_channel_sw_ie *)csa_elem->data)->count != 0) || -- (ecsa_elem && -- ecsa_elem->datalen == sizeof(struct ieee80211_ext_chansw_ie) && -- ((struct ieee80211_ext_chansw_ie *)ecsa_elem->data)->count != 0)) { -- sdata_info(sdata, "AP is in CSA process, reject assoc\n"); -+ rcu_read_lock(); -+ ssid_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_SSID); -+ if (!ssid_elem || ssid_elem->datalen > sizeof(assoc_data->ssid)) { - rcu_read_unlock(); - kfree(assoc_data); - return -EINVAL; --- -2.43.2 - -From c255c3b653c6e8b52ac658c305e2fece2825f7ad Mon Sep 17 00:00:00 2001 -From: Johannes Berg <johannes.berg@intel.com> -Date: Mon, 29 Jan 2024 15:53:48 +0100 -Subject: [PATCH 1398/1501] wifi: mac80211: fix RCU use in TDLS fast-xmit -Content-Length: 1216 -Lines: 34 - -[ Upstream commit 9480adfe4e0f0319b9da04b44e4eebd5ad07e0cd ] - -This looks up the link under RCU protection, but isn't -guaranteed to actually have protection. Fix that. - -Fixes: 8cc07265b691 ("wifi: mac80211: handle TDLS data frames with MLO") -Link: https://msgid.link/20240129155348.8a9c0b1e1d89.I553f96ce953bb41b0b877d592056164dec20d01c@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/mac80211/tx.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c -index ed4fdf655343..a94feb6b579b 100644 ---- a/net/mac80211/tx.c -+++ b/net/mac80211/tx.c -@@ -3100,10 +3100,11 @@ void ieee80211_check_fast_xmit(struct sta_info *sta) - /* DA SA BSSID */ - build.da_offs = offsetof(struct ieee80211_hdr, addr1); - build.sa_offs = offsetof(struct ieee80211_hdr, addr2); -+ rcu_read_lock(); - link = rcu_dereference(sdata->link[tdls_link_id]); -- if (WARN_ON_ONCE(!link)) -- break; -- memcpy(hdr->addr3, link->u.mgd.bssid, ETH_ALEN); -+ if (!WARN_ON_ONCE(!link)) -+ memcpy(hdr->addr3, link->u.mgd.bssid, ETH_ALEN); -+ rcu_read_unlock(); - build.hdr_len = 24; - break; - } --- -2.43.2 - -From f86f72f1bd754d27c7d9d1f4163238840f104f2f Mon Sep 17 00:00:00 2001 -From: Johannes Berg <johannes.berg@intel.com> -Date: Mon, 29 Jan 2024 19:57:30 +0100 -Subject: [PATCH 1399/1501] wifi: mac80211: fix unsolicited broadcast probe - config -Content-Length: 2735 -Lines: 75 - -[ Upstream commit 178e9d6adc4356c2f1659f575ecea626e7fbd05a ] - -There's a bug in ieee80211_set_unsol_bcast_probe_resp(), it tries -to return BSS_CHANGED_UNSOL_BCAST_PROBE_RESP (which has the value -1<<31) in an int, which makes it negative and considered an error. -Fix this by passing the changed flags to set separately. - -Fixes: 3b1c256eb4ae ("wifi: mac80211: fixes in FILS discovery updates") -Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com> -Link: https://msgid.link/20240129195729.965b0740bf80.I6bc6f5236863f686c17d689be541b1dd2633c417@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/mac80211/cfg.c | 14 +++++++------- - 1 file changed, 7 insertions(+), 7 deletions(-) - -diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c -index eb1d3ef84353..bfb06dea43c2 100644 ---- a/net/mac80211/cfg.c -+++ b/net/mac80211/cfg.c -@@ -5,7 +5,7 @@ - * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net> - * Copyright 2013-2015 Intel Mobile Communications GmbH - * Copyright (C) 2015-2017 Intel Deutschland GmbH -- * Copyright (C) 2018-2022 Intel Corporation -+ * Copyright (C) 2018-2024 Intel Corporation - */ - - #include <linux/ieee80211.h> -@@ -987,7 +987,8 @@ static int - ieee80211_set_unsol_bcast_probe_resp(struct ieee80211_sub_if_data *sdata, - struct cfg80211_unsol_bcast_probe_resp *params, - struct ieee80211_link_data *link, -- struct ieee80211_bss_conf *link_conf) -+ struct ieee80211_bss_conf *link_conf, -+ u64 *changed) - { - struct unsol_bcast_probe_resp_data *new, *old = NULL; - -@@ -1011,7 +1012,8 @@ ieee80211_set_unsol_bcast_probe_resp(struct ieee80211_sub_if_data *sdata, - RCU_INIT_POINTER(link->u.ap.unsol_bcast_probe_resp, NULL); - } - -- return BSS_CHANGED_UNSOL_BCAST_PROBE_RESP; -+ *changed |= BSS_CHANGED_UNSOL_BCAST_PROBE_RESP; -+ return 0; - } - - static int ieee80211_set_ftm_responder_params( -@@ -1450,10 +1452,9 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev, - - err = ieee80211_set_unsol_bcast_probe_resp(sdata, - ¶ms->unsol_bcast_probe_resp, -- link, link_conf); -+ link, link_conf, &changed); - if (err < 0) - goto error; -- changed |= err; - - err = drv_start_ap(sdata->local, sdata, link_conf); - if (err) { -@@ -1525,10 +1526,9 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev, - - err = ieee80211_set_unsol_bcast_probe_resp(sdata, - ¶ms->unsol_bcast_probe_resp, -- link, link_conf); -+ link, link_conf, &changed); - if (err < 0) - return err; -- changed |= err; - - if (beacon->he_bss_color_valid && - beacon->he_bss_color.enabled != link_conf->he_bss_color.enabled) { --- -2.43.2 - -From 1c91546bb78b59d838ae64525059d38d24c3b1e1 Mon Sep 17 00:00:00 2001 -From: Johannes Berg <johannes.berg@intel.com> -Date: Wed, 31 Jan 2024 16:48:56 +0100 -Subject: [PATCH 1400/1501] wifi: mac80211: fix waiting for beacons logic -Content-Length: 995 -Lines: 29 - -[ Upstream commit a0b4f2291319c5d47ecb196b90400814fdcfd126 ] - -This should be waiting if we don't have a beacon yet, -but somehow I managed to invert the logic. Fix that. - -Fixes: 74e1309acedc ("wifi: mac80211: mlme: look up beacon elems only if needed") -Link: https://msgid.link/20240131164856.922701229546.I239b379e7cee04608e73c016b737a5245e5b23dd@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/mac80211/mlme.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index bbe36d87ac59..5a03bf1de6bb 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -8025,8 +8025,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata, - - rcu_read_lock(); - beacon_ies = rcu_dereference(req->bss->beacon_ies); -- -- if (beacon_ies) { -+ if (!beacon_ies) { - /* - * Wait up to one beacon interval ... - * should this be more if we miss one? --- -2.43.2 - -From 2bedd9a21716455e6398fa3f663248688152e6cc Mon Sep 17 00:00:00 2001 -From: Miri Korenblit <miriam.rachel.korenblit@intel.com> -Date: Thu, 1 Feb 2024 16:17:39 +0200 -Subject: [PATCH 1401/1501] wifi: iwlwifi: exit eSR only after the FW does -Content-Length: 2110 -Lines: 52 - -[ Upstream commit 16867c38bcd3be2eb9016a3198a096f93959086e ] - -Currently the driver exits eSR by calling -iwl_mvm_esr_mode_inactive() before updating the FW -(by deactivating one of the links), and therefore before -sending the EML frame notifying that we are no longer in eSR. - -This is wrong for several reasons: -1. The driver sends SMPS activation frames when we are still in eSR - and SMPS should be disabled when in eSR -2. The driver restores RLC configuration as it was before eSR - entering, and RLC command shouldn't be sent in eSR - -Fix this by calling iwl_mvm_esr_mode_inactive() after FW update - -Fixes: 12bacfc2c065 ("wifi: iwlwifi: handle eSR transitions") -Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> -Reviewed-by: Ilan Peer <ilan.peer@intel.com> -Reviewed-by: Gregory Greenman <gregory.greenman@intel.com> -Link: https://msgid.link/20240201155157.d8d9dc277d4e.Ib5aee0fd05e35b1da7f18753eb3c8fa0a3f872f3@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c -index 1f36e934ef69..893b69fc841b 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c -@@ -438,6 +438,9 @@ __iwl_mvm_mld_unassign_vif_chanctx(struct iwl_mvm *mvm, - mvmvif->ap_ibss_active = false; - } - -+ iwl_mvm_link_changed(mvm, vif, link_conf, -+ LINK_CONTEXT_MODIFY_ACTIVE, false); -+ - if (iwl_mvm_is_esr_supported(mvm->fwrt.trans) && n_active > 1) { - int ret = iwl_mvm_esr_mode_inactive(mvm, vif); - -@@ -449,9 +452,6 @@ __iwl_mvm_mld_unassign_vif_chanctx(struct iwl_mvm *mvm, - if (vif->type == NL80211_IFTYPE_MONITOR) - iwl_mvm_mld_rm_snif_sta(mvm, vif); - -- iwl_mvm_link_changed(mvm, vif, link_conf, -- LINK_CONTEXT_MODIFY_ACTIVE, false); -- - if (switching_chanctx) - return; - mvmvif->link[link_id]->phy_ctxt = NULL; --- -2.43.2 - -From d32fe5515c8d39e25c858267cd068e88c0c73fe7 Mon Sep 17 00:00:00 2001 -From: Kees Cook <keescook@chromium.org> -Date: Fri, 26 Jan 2024 14:31:53 -0800 -Subject: [PATCH 1402/1501] wifi: brcmfmac: Adjust n_channels usage for - __counted_by -Content-Length: 2594 -Lines: 57 - -[ Upstream commit 5bdda0048c8d1bbe2019513b2d6200cc0d09c7bd ] - -After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct -cfg80211_scan_request with __counted_by"), the compiler may enforce -dynamic array indexing of req->channels to stay below n_channels. As a -result, n_channels needs to be increased _before_ accessing the newly -added array index. Increment it first, then use "i" for the prior index. -Solves this warning in the coming GCC that has __counted_by support: - -../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In function 'brcmf_internal_escan_add_info': -../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3783:46: warning: operation on 'req-> -n_channels' may be undefined [-Wsequence-point] - 3783 | req->channels[req->n_channels++] = chan; - | ~~~~~~~~~~~~~~~^~ - -Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by") -Cc: Arend van Spriel <aspriel@gmail.com> -Cc: Franky Lin <franky.lin@broadcom.com> -Cc: Hante Meuleman <hante.meuleman@broadcom.com> -Cc: Kalle Valo <kvalo@kernel.org> -Cc: Chi-hsien Lin <chi-hsien.lin@infineon.com> -Cc: Ian Lin <ian.lin@infineon.com> -Cc: Johannes Berg <johannes.berg@intel.com> -Cc: Wright Feng <wright.feng@cypress.com> -Cc: Hector Martin <marcan@marcan.st> -Cc: linux-wireless@vger.kernel.org -Cc: brcm80211-dev-list.pdl@broadcom.com -Signed-off-by: Kees Cook <keescook@chromium.org> -Reviewed-by: Hans de Goede <hdegoede@redhat.com> -Reviewed-by: Linus Walleij <linus.walleij@linaro.org> -Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> -Signed-off-by: Kalle Valo <kvalo@kernel.org> -Link: https://msgid.link/20240126223150.work.548-kees@kernel.org -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -index 667462369a32..44cea18dd20e 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -@@ -3779,8 +3779,10 @@ static int brcmf_internal_escan_add_info(struct cfg80211_scan_request *req, - if (req->channels[i] == chan) - break; - } -- if (i == req->n_channels) -- req->channels[req->n_channels++] = chan; -+ if (i == req->n_channels) { -+ req->n_channels++; -+ req->channels[i] = chan; -+ } - - for (i = 0; i < req->n_ssids; i++) { - if (req->ssids[i].ssid_len == ssid_len && --- -2.43.2 - -From d91964cdada76740811b7c621239f9c407820dbc Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Thu, 1 Feb 2024 17:53:24 +0000 -Subject: [PATCH 1403/1501] netdevsim: avoid potential loop in - nsim_dev_trap_report_work() -Content-Length: 4593 -Lines: 95 - -[ Upstream commit ba5e1272142d051dcc57ca1d3225ad8a089f9858 ] - -Many syzbot reports include the following trace [1] - -If nsim_dev_trap_report_work() can not grab the mutex, -it should rearm itself at least one jiffie later. - -[1] -Sending NMI from CPU 1 to CPUs 0: -NMI backtrace for cpu 0 -CPU: 0 PID: 32383 Comm: kworker/0:2 Not tainted 6.8.0-rc2-syzkaller-00031-g861c0981648f #0 -Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 -Workqueue: events nsim_dev_trap_report_work - RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:89 [inline] - RIP: 0010:memory_is_nonzero mm/kasan/generic.c:104 [inline] - RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:129 [inline] - RIP: 0010:memory_is_poisoned mm/kasan/generic.c:161 [inline] - RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline] - RIP: 0010:kasan_check_range+0x101/0x190 mm/kasan/generic.c:189 -Code: 07 49 39 d1 75 0a 45 3a 11 b8 01 00 00 00 7c 0b 44 89 c2 e8 21 ed ff ff 83 f0 01 5b 5d 41 5c c3 48 85 d2 74 4f 48 01 ea eb 09 <48> 83 c0 01 48 39 d0 74 41 80 38 00 74 f2 eb b6 41 bc 08 00 00 00 -RSP: 0018:ffffc90012dcf998 EFLAGS: 00000046 -RAX: fffffbfff258af1e RBX: fffffbfff258af1f RCX: ffffffff8168eda3 -RDX: fffffbfff258af1f RSI: 0000000000000004 RDI: ffffffff92c578f0 -RBP: fffffbfff258af1e R08: 0000000000000000 R09: fffffbfff258af1e -R10: ffffffff92c578f3 R11: ffffffff8acbcbc0 R12: 0000000000000002 -R13: ffff88806db38400 R14: 1ffff920025b9f42 R15: ffffffff92c578e8 -FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 -CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -CR2: 000000c00994e078 CR3: 000000002c250000 CR4: 00000000003506f0 -DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 -DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 -Call Trace: - <NMI> - </NMI> - <TASK> - instrument_atomic_read include/linux/instrumented.h:68 [inline] - atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline] - queued_spin_is_locked include/asm-generic/qspinlock.h:57 [inline] - debug_spin_unlock kernel/locking/spinlock_debug.c:101 [inline] - do_raw_spin_unlock+0x53/0x230 kernel/locking/spinlock_debug.c:141 - __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:150 [inline] - _raw_spin_unlock_irqrestore+0x22/0x70 kernel/locking/spinlock.c:194 - debug_object_activate+0x349/0x540 lib/debugobjects.c:726 - debug_work_activate kernel/workqueue.c:578 [inline] - insert_work+0x30/0x230 kernel/workqueue.c:1650 - __queue_work+0x62e/0x11d0 kernel/workqueue.c:1802 - __queue_delayed_work+0x1bf/0x270 kernel/workqueue.c:1953 - queue_delayed_work_on+0x106/0x130 kernel/workqueue.c:1989 - queue_delayed_work include/linux/workqueue.h:563 [inline] - schedule_delayed_work include/linux/workqueue.h:677 [inline] - nsim_dev_trap_report_work+0x9c0/0xc80 drivers/net/netdevsim/dev.c:842 - process_one_work+0x886/0x15d0 kernel/workqueue.c:2633 - process_scheduled_works kernel/workqueue.c:2706 [inline] - worker_thread+0x8b9/0x1290 kernel/workqueue.c:2787 - kthread+0x2c6/0x3a0 kernel/kthread.c:388 - ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 - ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 - </TASK> - -Fixes: 012ec02ae441 ("netdevsim: convert driver to use unlocked devlink API during init/fini") -Reported-by: syzbot <syzkaller@googlegroups.com> -Signed-off-by: Eric Dumazet <edumazet@google.com> -Reviewed-by: Jiri Pirko <jiri@nvidia.com> -Link: https://lore.kernel.org/r/20240201175324.3752746-1-edumazet@google.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/netdevsim/dev.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c -index b4d3b9cde8bd..92a7a36b93ac 100644 ---- a/drivers/net/netdevsim/dev.c -+++ b/drivers/net/netdevsim/dev.c -@@ -835,14 +835,14 @@ static void nsim_dev_trap_report_work(struct work_struct *work) - trap_report_dw.work); - nsim_dev = nsim_trap_data->nsim_dev; - -- /* For each running port and enabled packet trap, generate a UDP -- * packet with a random 5-tuple and report it. -- */ - if (!devl_trylock(priv_to_devlink(nsim_dev))) { -- schedule_delayed_work(&nsim_dev->trap_data->trap_report_dw, 0); -+ schedule_delayed_work(&nsim_dev->trap_data->trap_report_dw, 1); - return; - } - -+ /* For each running port and enabled packet trap, generate a UDP -+ * packet with a random 5-tuple and report it. -+ */ - list_for_each_entry(nsim_dev_port, &nsim_dev->port_list, list) { - if (!netif_running(nsim_dev_port->ns->netdev)) - continue; --- -2.43.2 - -From e42e334c645575be5432adee224975d4f536fdb1 Mon Sep 17 00:00:00 2001 -From: Ivan Vecera <ivecera@redhat.com> -Date: Thu, 1 Feb 2024 10:47:51 +0100 -Subject: [PATCH 1404/1501] net: atlantic: Fix DMA mapping for PTP hwts ring -Content-Length: 4621 -Lines: 114 - -[ Upstream commit 2e7d3b67630dfd8f178c41fa2217aa00e79a5887 ] - -Function aq_ring_hwts_rx_alloc() maps extra AQ_CFG_RXDS_DEF bytes -for PTP HWTS ring but then generic aq_ring_free() does not take this -into account. -Create and use a specific function to free HWTS ring to fix this -issue. - -Trace: -[ 215.351607] ------------[ cut here ]------------ -[ 215.351612] DMA-API: atlantic 0000:4b:00.0: device driver frees DMA memory with different size [device address=0x00000000fbdd0000] [map size=34816 bytes] [unmap size=32768 bytes] -[ 215.351635] WARNING: CPU: 33 PID: 10759 at kernel/dma/debug.c:988 check_unmap+0xa6f/0x2360 -... -[ 215.581176] Call Trace: -[ 215.583632] <TASK> -[ 215.585745] ? show_trace_log_lvl+0x1c4/0x2df -[ 215.590114] ? show_trace_log_lvl+0x1c4/0x2df -[ 215.594497] ? debug_dma_free_coherent+0x196/0x210 -[ 215.599305] ? check_unmap+0xa6f/0x2360 -[ 215.603147] ? __warn+0xca/0x1d0 -[ 215.606391] ? check_unmap+0xa6f/0x2360 -[ 215.610237] ? report_bug+0x1ef/0x370 -[ 215.613921] ? handle_bug+0x3c/0x70 -[ 215.617423] ? exc_invalid_op+0x14/0x50 -[ 215.621269] ? asm_exc_invalid_op+0x16/0x20 -[ 215.625480] ? check_unmap+0xa6f/0x2360 -[ 215.629331] ? mark_lock.part.0+0xca/0xa40 -[ 215.633445] debug_dma_free_coherent+0x196/0x210 -[ 215.638079] ? __pfx_debug_dma_free_coherent+0x10/0x10 -[ 215.643242] ? slab_free_freelist_hook+0x11d/0x1d0 -[ 215.648060] dma_free_attrs+0x6d/0x130 -[ 215.651834] aq_ring_free+0x193/0x290 [atlantic] -[ 215.656487] aq_ptp_ring_free+0x67/0x110 [atlantic] -... -[ 216.127540] ---[ end trace 6467e5964dd2640b ]--- -[ 216.132160] DMA-API: Mapped at: -[ 216.132162] debug_dma_alloc_coherent+0x66/0x2f0 -[ 216.132165] dma_alloc_attrs+0xf5/0x1b0 -[ 216.132168] aq_ring_hwts_rx_alloc+0x150/0x1f0 [atlantic] -[ 216.132193] aq_ptp_ring_alloc+0x1bb/0x540 [atlantic] -[ 216.132213] aq_nic_init+0x4a1/0x760 [atlantic] - -Fixes: 94ad94558b0f ("net: aquantia: add PTP rings infrastructure") -Signed-off-by: Ivan Vecera <ivecera@redhat.com> -Reviewed-by: Jiri Pirko <jiri@nvidia.com> -Link: https://lore.kernel.org/r/20240201094752.883026-1-ivecera@redhat.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/aquantia/atlantic/aq_ptp.c | 4 ++-- - drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 13 +++++++++++++ - drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 + - 3 files changed, 16 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c b/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c -index abd4832e4ed2..5acb3e16b567 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c -@@ -993,7 +993,7 @@ int aq_ptp_ring_alloc(struct aq_nic_s *aq_nic) - return 0; - - err_exit_hwts_rx: -- aq_ring_free(&aq_ptp->hwts_rx); -+ aq_ring_hwts_rx_free(&aq_ptp->hwts_rx); - err_exit_ptp_rx: - aq_ring_free(&aq_ptp->ptp_rx); - err_exit_ptp_tx: -@@ -1011,7 +1011,7 @@ void aq_ptp_ring_free(struct aq_nic_s *aq_nic) - - aq_ring_free(&aq_ptp->ptp_tx); - aq_ring_free(&aq_ptp->ptp_rx); -- aq_ring_free(&aq_ptp->hwts_rx); -+ aq_ring_hwts_rx_free(&aq_ptp->hwts_rx); - - aq_ptp_skb_ring_release(&aq_ptp->skb_ring); - } -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c -index cda8597b4e14..f7433abd6591 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c -@@ -919,6 +919,19 @@ void aq_ring_free(struct aq_ring_s *self) - } - } - -+void aq_ring_hwts_rx_free(struct aq_ring_s *self) -+{ -+ if (!self) -+ return; -+ -+ if (self->dx_ring) { -+ dma_free_coherent(aq_nic_get_dev(self->aq_nic), -+ self->size * self->dx_size + AQ_CFG_RXDS_DEF, -+ self->dx_ring, self->dx_ring_pa); -+ self->dx_ring = NULL; -+ } -+} -+ - unsigned int aq_ring_fill_stats_data(struct aq_ring_s *self, u64 *data) - { - unsigned int count; -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h -index 52847310740a..d627ace850ff 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h -@@ -210,6 +210,7 @@ int aq_ring_rx_fill(struct aq_ring_s *self); - int aq_ring_hwts_rx_alloc(struct aq_ring_s *self, - struct aq_nic_s *aq_nic, unsigned int idx, - unsigned int size, unsigned int dx_size); -+void aq_ring_hwts_rx_free(struct aq_ring_s *self); - void aq_ring_hwts_rx_clean(struct aq_ring_s *self, struct aq_nic_s *aq_nic); - - unsigned int aq_ring_fill_stats_data(struct aq_ring_s *self, u64 *data); --- -2.43.2 - -From f2e31907efed54a65ec4a3531896b5dba7437a5a Mon Sep 17 00:00:00 2001 -From: Gerhard Engleder <gerhard@engleder-embedded.com> -Date: Wed, 31 Jan 2024 21:14:13 +0100 -Subject: [PATCH 1411/1501] tsnep: Fix mapping for zero copy XDP_TX action -Content-Length: 2806 -Lines: 76 - -[ Upstream commit d7f5fb33cf77247b7bf9a871aaeea72ca4f51ad7 ] - -For XDP_TX action xdp_buff is converted to xdp_frame. The conversion is -done by xdp_convert_buff_to_frame(). The memory type of the resulting -xdp_frame depends on the memory type of the xdp_buff. For page pool -based xdp_buff it produces xdp_frame with memory type -MEM_TYPE_PAGE_POOL. For zero copy XSK pool based xdp_buff it produces -xdp_frame with memory type MEM_TYPE_PAGE_ORDER0. - -tsnep_xdp_xmit_back() is not prepared for that and uses always the page -pool buffer type TSNEP_TX_TYPE_XDP_TX. This leads to invalid mappings -and the transmission of undefined data. - -Improve tsnep_xdp_xmit_back() to use the generic buffer type -TSNEP_TX_TYPE_XDP_NDO for zero copy XDP_TX. - -Fixes: 3fc2333933fd ("tsnep: Add XDP socket zero-copy RX support") -Signed-off-by: Gerhard Engleder <gerhard@engleder-embedded.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ethernet/engleder/tsnep_main.c | 16 ++++++++++++---- - 1 file changed, 12 insertions(+), 4 deletions(-) - -diff --git a/drivers/net/ethernet/engleder/tsnep_main.c b/drivers/net/ethernet/engleder/tsnep_main.c -index 9aeff2b37a61..64eadd320798 100644 ---- a/drivers/net/ethernet/engleder/tsnep_main.c -+++ b/drivers/net/ethernet/engleder/tsnep_main.c -@@ -719,17 +719,25 @@ static void tsnep_xdp_xmit_flush(struct tsnep_tx *tx) - - static bool tsnep_xdp_xmit_back(struct tsnep_adapter *adapter, - struct xdp_buff *xdp, -- struct netdev_queue *tx_nq, struct tsnep_tx *tx) -+ struct netdev_queue *tx_nq, struct tsnep_tx *tx, -+ bool zc) - { - struct xdp_frame *xdpf = xdp_convert_buff_to_frame(xdp); - bool xmit; -+ u32 type; - - if (unlikely(!xdpf)) - return false; - -+ /* no page pool for zero copy */ -+ if (zc) -+ type = TSNEP_TX_TYPE_XDP_NDO; -+ else -+ type = TSNEP_TX_TYPE_XDP_TX; -+ - __netif_tx_lock(tx_nq, smp_processor_id()); - -- xmit = tsnep_xdp_xmit_frame_ring(xdpf, tx, TSNEP_TX_TYPE_XDP_TX); -+ xmit = tsnep_xdp_xmit_frame_ring(xdpf, tx, type); - - /* Avoid transmit queue timeout since we share it with the slow path */ - if (xmit) -@@ -1273,7 +1281,7 @@ static bool tsnep_xdp_run_prog(struct tsnep_rx *rx, struct bpf_prog *prog, - case XDP_PASS: - return false; - case XDP_TX: -- if (!tsnep_xdp_xmit_back(rx->adapter, xdp, tx_nq, tx)) -+ if (!tsnep_xdp_xmit_back(rx->adapter, xdp, tx_nq, tx, false)) - goto out_failure; - *status |= TSNEP_XDP_TX; - return true; -@@ -1323,7 +1331,7 @@ static bool tsnep_xdp_run_prog_zc(struct tsnep_rx *rx, struct bpf_prog *prog, - case XDP_PASS: - return false; - case XDP_TX: -- if (!tsnep_xdp_xmit_back(rx->adapter, xdp, tx_nq, tx)) -+ if (!tsnep_xdp_xmit_back(rx->adapter, xdp, tx_nq, tx, true)) - goto out_failure; - *status |= TSNEP_XDP_TX; - return true; --- -2.43.2 - -From 7dc9feb8b1705cf00de20563b6bc4831f4c99dab Mon Sep 17 00:00:00 2001 -From: Antoine Tenart <atenart@kernel.org> -Date: Thu, 1 Feb 2024 09:38:15 +0100 -Subject: [PATCH 1412/1501] tunnels: fix out of bounds access when building - IPv6 PMTU error -Content-Length: 1576 -Lines: 46 - -[ Upstream commit d75abeec401f8c86b470e7028a13fcdc87e5dd06 ] - -If the ICMPv6 error is built from a non-linear skb we get the following -splat, - - BUG: KASAN: slab-out-of-bounds in do_csum+0x220/0x240 - Read of size 4 at addr ffff88811d402c80 by task netperf/820 - CPU: 0 PID: 820 Comm: netperf Not tainted 6.8.0-rc1+ #543 - ... - kasan_report+0xd8/0x110 - do_csum+0x220/0x240 - csum_partial+0xc/0x20 - skb_tunnel_check_pmtu+0xeb9/0x3280 - vxlan_xmit_one+0x14c2/0x4080 - vxlan_xmit+0xf61/0x5c00 - dev_hard_start_xmit+0xfb/0x510 - __dev_queue_xmit+0x7cd/0x32a0 - br_dev_queue_push_xmit+0x39d/0x6a0 - -Use skb_checksum instead of csum_partial who cannot deal with non-linear -SKBs. - -Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets") -Signed-off-by: Antoine Tenart <atenart@kernel.org> -Reviewed-by: Jiri Pirko <jiri@nvidia.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/ipv4/ip_tunnel_core.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c -index 586b1b3e35b8..80ccd6661aa3 100644 ---- a/net/ipv4/ip_tunnel_core.c -+++ b/net/ipv4/ip_tunnel_core.c -@@ -332,7 +332,7 @@ static int iptunnel_pmtud_build_icmpv6(struct sk_buff *skb, int mtu) - }; - skb_reset_network_header(skb); - -- csum = csum_partial(icmp6h, len, 0); -+ csum = skb_checksum(skb, skb_transport_offset(skb), len, 0); - icmp6h->icmp6_cksum = csum_ipv6_magic(&nip6h->saddr, &nip6h->daddr, len, - IPPROTO_ICMPV6, csum); - --- -2.43.2 - -From c267f6347b19b860f72897f0ca655b6b5bd1e6ac Mon Sep 17 00:00:00 2001 -From: Zhipeng Lu <alexious@zju.edu.cn> -Date: Thu, 1 Feb 2024 20:41:05 +0800 -Subject: [PATCH 1413/1501] atm: idt77252: fix a memleak in open_card_ubr0 -Content-Length: 1080 -Lines: 38 - -[ Upstream commit f3616173bf9be9bf39d131b120d6eea4e6324cb5 ] - -When alloc_scq fails, card->vcs[0] (i.e. vc) should be freed. Otherwise, -in the following call chain: - -idt77252_init_one - |-> idt77252_dev_open - |-> open_card_ubr0 - |-> alloc_scq [failed] - |-> deinit_card - |-> vfree(card->vcs); - -card->vcs is freed and card->vcs[0] is leaked. - -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn> -Reviewed-by: Jiri Pirko <jiri@nvidia.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/atm/idt77252.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c -index e327a0229dc1..e7f713cd70d3 100644 ---- a/drivers/atm/idt77252.c -+++ b/drivers/atm/idt77252.c -@@ -2930,6 +2930,8 @@ open_card_ubr0(struct idt77252_dev *card) - vc->scq = alloc_scq(card, vc->class); - if (!vc->scq) { - printk("%s: can't get SCQ.\n", card->name); -+ kfree(card->vcs[0]); -+ card->vcs[0] = NULL; - return -ENOMEM; - } - --- -2.43.2 - -From 1731cb9650d2a21136a336c5d99359991fb4bfb9 Mon Sep 17 00:00:00 2001 -From: Zhipeng Lu <alexious@zju.edu.cn> -Date: Thu, 1 Feb 2024 20:47:13 +0800 -Subject: [PATCH 1414/1501] octeontx2-pf: Fix a memleak otx2_sq_init -Content-Length: 1511 -Lines: 49 - -[ Upstream commit b09b58e31b0f43d76f79b9943da3fb7c2843dcbb ] - -When qmem_alloc and pfvf->hw_ops->sq_aq_init fails, sq->sg should be -freed to prevent memleak. - -Fixes: c9c12d339d93 ("octeontx2-pf: Add support for PTP clock") -Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn> -Acked-by: Jiri Pirko <jiri@nvidia.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../ethernet/marvell/octeontx2/nic/otx2_common.c | 14 ++++++++++++-- - 1 file changed, 12 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c -index 7ca6941ea0b9..02d0b707aea5 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c -+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c -@@ -951,8 +951,11 @@ int otx2_sq_init(struct otx2_nic *pfvf, u16 qidx, u16 sqb_aura) - if (pfvf->ptp && qidx < pfvf->hw.tx_queues) { - err = qmem_alloc(pfvf->dev, &sq->timestamps, qset->sqe_cnt, - sizeof(*sq->timestamps)); -- if (err) -+ if (err) { -+ kfree(sq->sg); -+ sq->sg = NULL; - return err; -+ } - } - - sq->head = 0; -@@ -968,7 +971,14 @@ int otx2_sq_init(struct otx2_nic *pfvf, u16 qidx, u16 sqb_aura) - sq->stats.bytes = 0; - sq->stats.pkts = 0; - -- return pfvf->hw_ops->sq_aq_init(pfvf, qidx, sqb_aura); -+ err = pfvf->hw_ops->sq_aq_init(pfvf, qidx, sqb_aura); -+ if (err) { -+ kfree(sq->sg); -+ sq->sg = NULL; -+ return err; -+ } -+ -+ return 0; - - } - --- -2.43.2 - -From 8083fdfaa543802beccd768a02c9d0456e6ec7f7 Mon Sep 17 00:00:00 2001 -From: Loic Prylli <lprylli@netflix.com> -Date: Fri, 3 Nov 2023 11:30:55 +0100 -Subject: [PATCH 1415/1501] hwmon: (aspeed-pwm-tacho) mutex for tach reading -Content-Length: 2093 -Lines: 57 - -[ Upstream commit 1168491e7f53581ba7b6014a39a49cfbbb722feb ] - -the ASPEED_PTCR_RESULT Register can only hold the result for a -single fan input. Adding a mutex to protect the register until the -reading is done. - -Signed-off-by: Loic Prylli <lprylli@netflix.com> -Signed-off-by: Alexander Hansen <alexander.hansen@9elements.com> -Fixes: 2d7a548a3eff ("drivers: hwmon: Support for ASPEED PWM/Fan tach") -Link: https://lore.kernel.org/r/121d888762a1232ef403cf35230ccf7b3887083a.1699007401.git.alexander.hansen@9elements.com -Signed-off-by: Guenter Roeck <linux@roeck-us.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/hwmon/aspeed-pwm-tacho.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/drivers/hwmon/aspeed-pwm-tacho.c b/drivers/hwmon/aspeed-pwm-tacho.c -index 997df4b40509..b2ae2176f11f 100644 ---- a/drivers/hwmon/aspeed-pwm-tacho.c -+++ b/drivers/hwmon/aspeed-pwm-tacho.c -@@ -193,6 +193,8 @@ struct aspeed_pwm_tacho_data { - u8 fan_tach_ch_source[16]; - struct aspeed_cooling_device *cdev[8]; - const struct attribute_group *groups[3]; -+ /* protects access to shared ASPEED_PTCR_RESULT */ -+ struct mutex tach_lock; - }; - - enum type { TYPEM, TYPEN, TYPEO }; -@@ -527,6 +529,8 @@ static int aspeed_get_fan_tach_ch_rpm(struct aspeed_pwm_tacho_data *priv, - u8 fan_tach_ch_source, type, mode, both; - int ret; - -+ mutex_lock(&priv->tach_lock); -+ - regmap_write(priv->regmap, ASPEED_PTCR_TRIGGER, 0); - regmap_write(priv->regmap, ASPEED_PTCR_TRIGGER, 0x1 << fan_tach_ch); - -@@ -544,6 +548,8 @@ static int aspeed_get_fan_tach_ch_rpm(struct aspeed_pwm_tacho_data *priv, - ASPEED_RPM_STATUS_SLEEP_USEC, - usec); - -+ mutex_unlock(&priv->tach_lock); -+ - /* return -ETIMEDOUT if we didn't get an answer. */ - if (ret) - return ret; -@@ -903,6 +909,7 @@ static int aspeed_pwm_tacho_probe(struct platform_device *pdev) - priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL); - if (!priv) - return -ENOMEM; -+ mutex_init(&priv->tach_lock); - priv->regmap = devm_regmap_init(dev, NULL, (__force void *)regs, - &aspeed_pwm_tacho_regmap_config); - if (IS_ERR(priv->regmap)) --- -2.43.2 - -From 3a7753bda55985dc26fae17795cb10d825453ad1 Mon Sep 17 00:00:00 2001 -From: Zhang Rui <rui.zhang@intel.com> -Date: Fri, 2 Feb 2024 17:21:34 +0800 -Subject: [PATCH 1416/1501] hwmon: (coretemp) Fix out-of-bounds memory access -Content-Length: 1451 -Lines: 44 - -[ Upstream commit 4e440abc894585a34c2904a32cd54af1742311b3 ] - -Fix a bug that pdata->cpu_map[] is set before out-of-bounds check. -The problem might be triggered on systems with more than 128 cores per -package. - -Fixes: 7108b80a542b ("hwmon/coretemp: Handle large core ID value") -Signed-off-by: Zhang Rui <rui.zhang@intel.com> -Cc: <stable@vger.kernel.org> -Link: https://lore.kernel.org/r/20240202092144.71180-2-rui.zhang@intel.com -Signed-off-by: Guenter Roeck <linux@roeck-us.net> -Stable-dep-of: fdaf0c8629d4 ("hwmon: (coretemp) Fix bogus core_id to attr name mapping") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/hwmon/coretemp.c | 8 ++------ - 1 file changed, 2 insertions(+), 6 deletions(-) - -diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c -index ba82d1e79c13..e78c76919111 100644 ---- a/drivers/hwmon/coretemp.c -+++ b/drivers/hwmon/coretemp.c -@@ -509,18 +509,14 @@ static int create_core_data(struct platform_device *pdev, unsigned int cpu, - if (pkg_flag) { - attr_no = PKG_SYSFS_ATTR_NO; - } else { -- index = ida_alloc(&pdata->ida, GFP_KERNEL); -+ index = ida_alloc_max(&pdata->ida, NUM_REAL_CORES - 1, GFP_KERNEL); - if (index < 0) - return index; -+ - pdata->cpu_map[index] = topology_core_id(cpu); - attr_no = index + BASE_SYSFS_ATTR_NO; - } - -- if (attr_no > MAX_CORE_DATA - 1) { -- err = -ERANGE; -- goto ida_free; -- } -- - tdata = init_temp_data(cpu, pkg_flag); - if (!tdata) { - err = -ENOMEM; --- -2.43.2 - -From 8b8cbb0659ab055ebfa6f05bd9f658288dac84af Mon Sep 17 00:00:00 2001 -From: Zhang Rui <rui.zhang@intel.com> -Date: Fri, 2 Feb 2024 17:21:35 +0800 -Subject: [PATCH 1417/1501] hwmon: (coretemp) Fix bogus core_id to attr name - mapping -Content-Length: 4974 -Lines: 143 - -[ Upstream commit fdaf0c8629d4524a168cb9e4ad4231875749b28c ] - -Before commit 7108b80a542b ("hwmon/coretemp: Handle large core ID -value"), there is a fixed mapping between -1. cpu_core_id -2. the index in pdata->core_data[] array -3. the sysfs attr name, aka "tempX_" -The later two always equal cpu_core_id + 2. - -After the commit, pdata->core_data[] index is got from ida so that it -can handle sparse core ids and support more cores within a package. - -However, the commit erroneously maps the sysfs attr name to -pdata->core_data[] index instead of cpu_core_id + 2. - -As a result, the code is not aligned with the comments, and brings user -visible changes in hwmon sysfs on systems with sparse core id. - -For example, before commit 7108b80a542b ("hwmon/coretemp: Handle large -core ID value"), -/sys/class/hwmon/hwmon2/temp2_label:Core 0 -/sys/class/hwmon/hwmon2/temp3_label:Core 1 -/sys/class/hwmon/hwmon2/temp4_label:Core 2 -/sys/class/hwmon/hwmon2/temp5_label:Core 3 -/sys/class/hwmon/hwmon2/temp6_label:Core 4 -/sys/class/hwmon/hwmon3/temp10_label:Core 8 -/sys/class/hwmon/hwmon3/temp11_label:Core 9 -after commit, -/sys/class/hwmon/hwmon2/temp2_label:Core 0 -/sys/class/hwmon/hwmon2/temp3_label:Core 1 -/sys/class/hwmon/hwmon2/temp4_label:Core 2 -/sys/class/hwmon/hwmon2/temp5_label:Core 3 -/sys/class/hwmon/hwmon2/temp6_label:Core 4 -/sys/class/hwmon/hwmon2/temp7_label:Core 8 -/sys/class/hwmon/hwmon2/temp8_label:Core 9 - -Restore the previous behavior and rework the code, comments and variable -names to avoid future confusions. - -Fixes: 7108b80a542b ("hwmon/coretemp: Handle large core ID value") -Signed-off-by: Zhang Rui <rui.zhang@intel.com> -Link: https://lore.kernel.org/r/20240202092144.71180-3-rui.zhang@intel.com -Signed-off-by: Guenter Roeck <linux@roeck-us.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/hwmon/coretemp.c | 32 +++++++++++++++++++------------- - 1 file changed, 19 insertions(+), 13 deletions(-) - -diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c -index e78c76919111..95f4c0b00b2d 100644 ---- a/drivers/hwmon/coretemp.c -+++ b/drivers/hwmon/coretemp.c -@@ -419,7 +419,7 @@ static ssize_t show_temp(struct device *dev, - } - - static int create_core_attrs(struct temp_data *tdata, struct device *dev, -- int attr_no) -+ int index) - { - int i; - static ssize_t (*const rd_ptr[TOTAL_ATTRS]) (struct device *dev, -@@ -431,13 +431,20 @@ static int create_core_attrs(struct temp_data *tdata, struct device *dev, - }; - - for (i = 0; i < tdata->attr_size; i++) { -+ /* -+ * We map the attr number to core id of the CPU -+ * The attr number is always core id + 2 -+ * The Pkgtemp will always show up as temp1_*, if available -+ */ -+ int attr_no = tdata->is_pkg_data ? 1 : tdata->cpu_core_id + 2; -+ - snprintf(tdata->attr_name[i], CORETEMP_NAME_LENGTH, - "temp%d_%s", attr_no, suffixes[i]); - sysfs_attr_init(&tdata->sd_attrs[i].dev_attr.attr); - tdata->sd_attrs[i].dev_attr.attr.name = tdata->attr_name[i]; - tdata->sd_attrs[i].dev_attr.attr.mode = 0444; - tdata->sd_attrs[i].dev_attr.show = rd_ptr[i]; -- tdata->sd_attrs[i].index = attr_no; -+ tdata->sd_attrs[i].index = index; - tdata->attrs[i] = &tdata->sd_attrs[i].dev_attr.attr; - } - tdata->attr_group.attrs = tdata->attrs; -@@ -495,26 +502,25 @@ static int create_core_data(struct platform_device *pdev, unsigned int cpu, - struct platform_data *pdata = platform_get_drvdata(pdev); - struct cpuinfo_x86 *c = &cpu_data(cpu); - u32 eax, edx; -- int err, index, attr_no; -+ int err, index; - - if (!housekeeping_cpu(cpu, HK_TYPE_MISC)) - return 0; - - /* -- * Find attr number for sysfs: -- * We map the attr number to core id of the CPU -- * The attr number is always core id + 2 -- * The Pkgtemp will always show up as temp1_*, if available -+ * Get the index of tdata in pdata->core_data[] -+ * tdata for package: pdata->core_data[1] -+ * tdata for core: pdata->core_data[2] .. pdata->core_data[NUM_REAL_CORES + 1] - */ - if (pkg_flag) { -- attr_no = PKG_SYSFS_ATTR_NO; -+ index = PKG_SYSFS_ATTR_NO; - } else { - index = ida_alloc_max(&pdata->ida, NUM_REAL_CORES - 1, GFP_KERNEL); - if (index < 0) - return index; - - pdata->cpu_map[index] = topology_core_id(cpu); -- attr_no = index + BASE_SYSFS_ATTR_NO; -+ index += BASE_SYSFS_ATTR_NO; - } - - tdata = init_temp_data(cpu, pkg_flag); -@@ -540,20 +546,20 @@ static int create_core_data(struct platform_device *pdev, unsigned int cpu, - if (get_ttarget(tdata, &pdev->dev) >= 0) - tdata->attr_size++; - -- pdata->core_data[attr_no] = tdata; -+ pdata->core_data[index] = tdata; - - /* Create sysfs interfaces */ -- err = create_core_attrs(tdata, pdata->hwmon_dev, attr_no); -+ err = create_core_attrs(tdata, pdata->hwmon_dev, index); - if (err) - goto exit_free; - - return 0; - exit_free: -- pdata->core_data[attr_no] = NULL; -+ pdata->core_data[index] = NULL; - kfree(tdata); - ida_free: - if (!pkg_flag) -- ida_free(&pdata->ida, index); -+ ida_free(&pdata->ida, index - BASE_SYSFS_ATTR_NO); - return err; - } - --- -2.43.2 - -From 307fa8a75ab7423fa5c73573ec3d192de5027830 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Fri, 2 Feb 2024 09:54:04 +0000 -Subject: [PATCH 1418/1501] inet: read sk->sk_family once in inet_recv_error() -Content-Length: 1282 -Lines: 38 - -[ Upstream commit eef00a82c568944f113f2de738156ac591bbd5cd ] - -inet_recv_error() is called without holding the socket lock. - -IPv6 socket could mutate to IPv4 with IPV6_ADDRFORM -socket option and trigger a KCSAN warning. - -Fixes: f4713a3dfad0 ("net-timestamp: make tcp_recvmsg call ipv6_recv_error for AF_INET6 socks") -Signed-off-by: Eric Dumazet <edumazet@google.com> -Cc: Willem de Bruijn <willemb@google.com> -Reviewed-by: Willem de Bruijn <willemb@google.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/ipv4/af_inet.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c -index 1c58bd72e124..e59962f34caa 100644 ---- a/net/ipv4/af_inet.c -+++ b/net/ipv4/af_inet.c -@@ -1628,10 +1628,12 @@ EXPORT_SYMBOL(inet_current_timestamp); - - int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) - { -- if (sk->sk_family == AF_INET) -+ unsigned int family = READ_ONCE(sk->sk_family); -+ -+ if (family == AF_INET) - return ip_recv_error(sk, msg, len, addr_len); - #if IS_ENABLED(CONFIG_IPV6) -- if (sk->sk_family == AF_INET6) -+ if (family == AF_INET6) - return pingv6_ops.ipv6_recv_error(sk, msg, len, addr_len); - #endif - return -EINVAL; --- -2.43.2 - -From 86e0a0975ff731992a66f6bdb6cfc02eb11d6700 Mon Sep 17 00:00:00 2001 -From: Dan Carpenter <dan.carpenter@linaro.org> -Date: Fri, 26 Jan 2024 11:41:47 +0300 -Subject: [PATCH 1419/1501] drm/i915/gvt: Fix uninitialized variable in - handle_mmio() -Content-Length: 1446 -Lines: 33 - -[ Upstream commit 47caa96478b99d6d1199b89467cc3e5a6cc754ee ] - -This code prints the wrong variable in the warning message. It should -print "i" instead of "info->offset". On the first iteration "info" is -uninitialized leading to a crash and on subsequent iterations it prints -the previous offset instead of the current one. - -Fixes: e0f74ed4634d ("i915/gvt: Separate the MMIO tracking table from GVT-g") -Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> -Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com> -Link: http://patchwork.freedesktop.org/patch/msgid/11957c20-b178-4027-9b0a-e32e9591dd7c@moroto.mountain -Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/i915/gvt/handlers.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c -index a9f7fa9b90bd..d30f8814d9b1 100644 ---- a/drivers/gpu/drm/i915/gvt/handlers.c -+++ b/drivers/gpu/drm/i915/gvt/handlers.c -@@ -2850,8 +2850,7 @@ static int handle_mmio(struct intel_gvt_mmio_table_iter *iter, u32 offset, - for (i = start; i < end; i += 4) { - p = intel_gvt_find_mmio_info(gvt, i); - if (p) { -- WARN(1, "dup mmio definition offset %x\n", -- info->offset); -+ WARN(1, "dup mmio definition offset %x\n", i); - - /* We return -EEXIST here to make GVT-g load fail. - * So duplicated MMIO can be found as soon as --- -2.43.2 - -From 4adeeff8c12321cd453412a659c3c0eeb9bb2397 Mon Sep 17 00:00:00 2001 -From: Ard Biesheuvel <ardb@kernel.org> -Date: Mon, 5 Feb 2024 09:11:07 +0100 -Subject: [PATCH 1420/1501] x86/efistub: Use 1:1 file:memory mapping for - PE/COFF .compat section -Content-Length: 3711 -Lines: 112 - -[ Upstream commit 1ad55cecf22f05f1c884adf63cc09d3c3e609ebf ] - -The .compat section is a dummy PE section that contains the address of -the 32-bit entrypoint of the 64-bit kernel image if it is bootable from -32-bit firmware (i.e., CONFIG_EFI_MIXED=y) - -This section is only 8 bytes in size and is only referenced from the -loader, and so it is placed at the end of the memory view of the image, -to avoid the need for padding it to 4k, which is required for sections -appearing in the middle of the image. - -Unfortunately, this violates the PE/COFF spec, and even if most EFI -loaders will work correctly (including the Tianocore reference -implementation), PE loaders do exist that reject such images, on the -basis that both the file and memory views of the file contents should be -described by the section headers in a monotonically increasing manner -without leaving any gaps. - -So reorganize the sections to avoid this issue. This results in a slight -padding overhead (< 4k) which can be avoided if desired by disabling -CONFIG_EFI_MIXED (which is only needed in rare cases these days) - -Fixes: 3e3eabe26dc8 ("x86/boot: Increase section and file alignment to 4k/512") -Reported-by: Mike Beaton <mjsbeaton@gmail.com> -Link: https://lkml.kernel.org/r/CAHzAAWQ6srV6LVNdmfbJhOwhBw5ZzxxZZ07aHt9oKkfYAdvuQQ%40mail.gmail.com -Signed-off-by: Ard Biesheuvel <ardb@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/x86/boot/header.S | 14 ++++++-------- - arch/x86/boot/setup.ld | 6 +++--- - 2 files changed, 9 insertions(+), 11 deletions(-) - -diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S -index b2771710ed98..a1bbedd989e4 100644 ---- a/arch/x86/boot/header.S -+++ b/arch/x86/boot/header.S -@@ -106,8 +106,7 @@ extra_header_fields: - .word 0 # MinorSubsystemVersion - .long 0 # Win32VersionValue - -- .long setup_size + ZO__end + pecompat_vsize -- # SizeOfImage -+ .long setup_size + ZO__end # SizeOfImage - - .long salign # SizeOfHeaders - .long 0 # CheckSum -@@ -143,7 +142,7 @@ section_table: - .ascii ".setup" - .byte 0 - .byte 0 -- .long setup_size - salign # VirtualSize -+ .long pecompat_fstart - salign # VirtualSize - .long salign # VirtualAddress - .long pecompat_fstart - salign # SizeOfRawData - .long salign # PointerToRawData -@@ -156,8 +155,8 @@ section_table: - #ifdef CONFIG_EFI_MIXED - .asciz ".compat" - -- .long 8 # VirtualSize -- .long setup_size + ZO__end # VirtualAddress -+ .long pecompat_fsize # VirtualSize -+ .long pecompat_fstart # VirtualAddress - .long pecompat_fsize # SizeOfRawData - .long pecompat_fstart # PointerToRawData - -@@ -172,17 +171,16 @@ section_table: - * modes this image supports. - */ - .pushsection ".pecompat", "a", @progbits -- .balign falign -- .set pecompat_vsize, salign -+ .balign salign - .globl pecompat_fstart - pecompat_fstart: - .byte 0x1 # Version - .byte 8 # Size - .word IMAGE_FILE_MACHINE_I386 # PE machine type - .long setup_size + ZO_efi32_pe_entry # Entrypoint -+ .byte 0x0 # Sentinel - .popsection - #else -- .set pecompat_vsize, 0 - .set pecompat_fstart, setup_size - #endif - .ascii ".text" -diff --git a/arch/x86/boot/setup.ld b/arch/x86/boot/setup.ld -index 83bb7efad8ae..3a2d1360abb0 100644 ---- a/arch/x86/boot/setup.ld -+++ b/arch/x86/boot/setup.ld -@@ -24,6 +24,9 @@ SECTIONS - .text : { *(.text .text.*) } - .text32 : { *(.text32) } - -+ .pecompat : { *(.pecompat) } -+ PROVIDE(pecompat_fsize = setup_size - pecompat_fstart); -+ - . = ALIGN(16); - .rodata : { *(.rodata*) } - -@@ -36,9 +39,6 @@ SECTIONS - . = ALIGN(16); - .data : { *(.data*) } - -- .pecompat : { *(.pecompat) } -- PROVIDE(pecompat_fsize = setup_size - pecompat_fstart); -- - .signature : { - setup_sig = .; - LONG(0x5a5aaa55) --- -2.43.2 - -From edc8201823e93db7d17726c335a725815aa7d551 Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Fri, 2 Feb 2024 15:19:13 +0000 -Subject: [PATCH 1421/1501] rxrpc: Fix generation of serial numbers to skip - zero -Content-Length: 5951 -Lines: 161 - -[ Upstream commit f31041417bf7f4a4df8b3bfb52cb31bbe805b934 ] - -In the Rx protocol, every packet generated is marked with a per-connection -monotonically increasing serial number. This number can be referenced in -an ACK packet generated in response to an incoming packet - thereby -allowing the sender to use this for RTT determination, amongst other -things. - -However, if the reference field in the ACK is zero, it doesn't refer to any -incoming packet (it could be a ping to find out if a packet got lost, for -example) - so we shouldn't generate zero serial numbers. - -Fix the generation of serial numbers to retry if it comes up with a zero. - -Furthermore, since the serial numbers are only ever allocated within the -I/O thread this connection is bound to, there's no need for atomics so -remove that too. - -Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both") -Signed-off-by: David Howells <dhowells@redhat.com> -cc: Marc Dionne <marc.dionne@auristor.com> -cc: "David S. Miller" <davem@davemloft.net> -cc: Eric Dumazet <edumazet@google.com> -cc: Jakub Kicinski <kuba@kernel.org> -cc: Paolo Abeni <pabeni@redhat.com> -cc: linux-afs@lists.infradead.org -cc: netdev@vger.kernel.org -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/rxrpc/ar-internal.h | 16 +++++++++++++++- - net/rxrpc/conn_event.c | 2 +- - net/rxrpc/output.c | 8 ++++---- - net/rxrpc/proc.c | 2 +- - net/rxrpc/rxkad.c | 4 ++-- - 5 files changed, 23 insertions(+), 9 deletions(-) - -diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h -index 5d5b19f20d1e..efbe82926769 100644 ---- a/net/rxrpc/ar-internal.h -+++ b/net/rxrpc/ar-internal.h -@@ -507,7 +507,7 @@ struct rxrpc_connection { - enum rxrpc_call_completion completion; /* Completion condition */ - s32 abort_code; /* Abort code of connection abort */ - int debug_id; /* debug ID for printks */ -- atomic_t serial; /* packet serial number counter */ -+ rxrpc_serial_t tx_serial; /* Outgoing packet serial number counter */ - unsigned int hi_serial; /* highest serial number received */ - u32 service_id; /* Service ID, possibly upgraded */ - u32 security_level; /* Security level selected */ -@@ -819,6 +819,20 @@ static inline bool rxrpc_sending_to_client(const struct rxrpc_txbuf *txb) - - #include <trace/events/rxrpc.h> - -+/* -+ * Allocate the next serial number on a connection. 0 must be skipped. -+ */ -+static inline rxrpc_serial_t rxrpc_get_next_serial(struct rxrpc_connection *conn) -+{ -+ rxrpc_serial_t serial; -+ -+ serial = conn->tx_serial; -+ if (serial == 0) -+ serial = 1; -+ conn->tx_serial = serial + 1; -+ return serial; -+} -+ - /* - * af_rxrpc.c - */ -diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c -index 95f4bc206b3d..ec5eae60ab0c 100644 ---- a/net/rxrpc/conn_event.c -+++ b/net/rxrpc/conn_event.c -@@ -117,7 +117,7 @@ void rxrpc_conn_retransmit_call(struct rxrpc_connection *conn, - iov[2].iov_base = &ack_info; - iov[2].iov_len = sizeof(ack_info); - -- serial = atomic_inc_return(&conn->serial); -+ serial = rxrpc_get_next_serial(conn); - - pkt.whdr.epoch = htonl(conn->proto.epoch); - pkt.whdr.cid = htonl(conn->proto.cid | channel); -diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c -index a0906145e829..4a292f860ae3 100644 ---- a/net/rxrpc/output.c -+++ b/net/rxrpc/output.c -@@ -216,7 +216,7 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, struct rxrpc_txbuf *txb) - iov[0].iov_len = sizeof(txb->wire) + sizeof(txb->ack) + n; - len = iov[0].iov_len; - -- serial = atomic_inc_return(&conn->serial); -+ serial = rxrpc_get_next_serial(conn); - txb->wire.serial = htonl(serial); - trace_rxrpc_tx_ack(call->debug_id, serial, - ntohl(txb->ack.firstPacket), -@@ -302,7 +302,7 @@ int rxrpc_send_abort_packet(struct rxrpc_call *call) - iov[0].iov_base = &pkt; - iov[0].iov_len = sizeof(pkt); - -- serial = atomic_inc_return(&conn->serial); -+ serial = rxrpc_get_next_serial(conn); - pkt.whdr.serial = htonl(serial); - - iov_iter_kvec(&msg.msg_iter, WRITE, iov, 1, sizeof(pkt)); -@@ -334,7 +334,7 @@ int rxrpc_send_data_packet(struct rxrpc_call *call, struct rxrpc_txbuf *txb) - _enter("%x,{%d}", txb->seq, txb->len); - - /* Each transmission of a Tx packet needs a new serial number */ -- serial = atomic_inc_return(&conn->serial); -+ serial = rxrpc_get_next_serial(conn); - txb->wire.serial = htonl(serial); - - if (test_bit(RXRPC_CONN_PROBING_FOR_UPGRADE, &conn->flags) && -@@ -558,7 +558,7 @@ void rxrpc_send_conn_abort(struct rxrpc_connection *conn) - - len = iov[0].iov_len + iov[1].iov_len; - -- serial = atomic_inc_return(&conn->serial); -+ serial = rxrpc_get_next_serial(conn); - whdr.serial = htonl(serial); - - iov_iter_kvec(&msg.msg_iter, WRITE, iov, 2, len); -diff --git a/net/rxrpc/proc.c b/net/rxrpc/proc.c -index 682636d3b060..208312c244f6 100644 ---- a/net/rxrpc/proc.c -+++ b/net/rxrpc/proc.c -@@ -181,7 +181,7 @@ static int rxrpc_connection_seq_show(struct seq_file *seq, void *v) - atomic_read(&conn->active), - state, - key_serial(conn->key), -- atomic_read(&conn->serial), -+ conn->tx_serial, - conn->hi_serial, - conn->channels[0].call_id, - conn->channels[1].call_id, -diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c -index b52dedcebce0..6b32d61d4cdc 100644 ---- a/net/rxrpc/rxkad.c -+++ b/net/rxrpc/rxkad.c -@@ -664,7 +664,7 @@ static int rxkad_issue_challenge(struct rxrpc_connection *conn) - - len = iov[0].iov_len + iov[1].iov_len; - -- serial = atomic_inc_return(&conn->serial); -+ serial = rxrpc_get_next_serial(conn); - whdr.serial = htonl(serial); - - ret = kernel_sendmsg(conn->local->socket, &msg, iov, 2, len); -@@ -721,7 +721,7 @@ static int rxkad_send_response(struct rxrpc_connection *conn, - - len = iov[0].iov_len + iov[1].iov_len + iov[2].iov_len; - -- serial = atomic_inc_return(&conn->serial); -+ serial = rxrpc_get_next_serial(conn); - whdr.serial = htonl(serial); - - rxrpc_local_dont_fragment(conn->local, false); --- -2.43.2 - -From 63719f490e6a89896e9a463d2b45e8203eab23ae Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Fri, 2 Feb 2024 15:19:14 +0000 -Subject: [PATCH 1422/1501] rxrpc: Fix delayed ACKs to not set the reference - serial number -Content-Length: 2617 -Lines: 66 - -[ Upstream commit e7870cf13d20f56bfc19f9c3e89707c69cf104ef ] - -Fix the construction of delayed ACKs to not set the reference serial number -as they can't be used as an RTT reference. - -Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both") -Signed-off-by: David Howells <dhowells@redhat.com> -cc: Marc Dionne <marc.dionne@auristor.com> -cc: "David S. Miller" <davem@davemloft.net> -cc: Eric Dumazet <edumazet@google.com> -cc: Jakub Kicinski <kuba@kernel.org> -cc: Paolo Abeni <pabeni@redhat.com> -cc: linux-afs@lists.infradead.org -cc: netdev@vger.kernel.org -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/rxrpc/ar-internal.h | 1 - - net/rxrpc/call_event.c | 6 +----- - 2 files changed, 1 insertion(+), 6 deletions(-) - -diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h -index efbe82926769..041add7654b2 100644 ---- a/net/rxrpc/ar-internal.h -+++ b/net/rxrpc/ar-internal.h -@@ -693,7 +693,6 @@ struct rxrpc_call { - /* Receive-phase ACK management (ACKs we send). */ - u8 ackr_reason; /* reason to ACK */ - u16 ackr_sack_base; /* Starting slot in SACK table ring */ -- rxrpc_serial_t ackr_serial; /* serial of packet being ACK'd */ - rxrpc_seq_t ackr_window; /* Base of SACK window */ - rxrpc_seq_t ackr_wtop; /* Base of SACK window */ - unsigned int ackr_nr_unacked; /* Number of unacked packets */ -diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c -index e363f21a2014..c61efe08695d 100644 ---- a/net/rxrpc/call_event.c -+++ b/net/rxrpc/call_event.c -@@ -43,8 +43,6 @@ void rxrpc_propose_delay_ACK(struct rxrpc_call *call, rxrpc_serial_t serial, - unsigned long expiry = rxrpc_soft_ack_delay; - unsigned long now = jiffies, ack_at; - -- call->ackr_serial = serial; -- - if (rxrpc_soft_ack_delay < expiry) - expiry = rxrpc_soft_ack_delay; - if (call->peer->srtt_us != 0) -@@ -373,7 +371,6 @@ static void rxrpc_send_initial_ping(struct rxrpc_call *call) - bool rxrpc_input_call_event(struct rxrpc_call *call, struct sk_buff *skb) - { - unsigned long now, next, t; -- rxrpc_serial_t ackr_serial; - bool resend = false, expired = false; - s32 abort_code; - -@@ -423,8 +420,7 @@ bool rxrpc_input_call_event(struct rxrpc_call *call, struct sk_buff *skb) - if (time_after_eq(now, t)) { - trace_rxrpc_timer(call, rxrpc_timer_exp_ack, now); - cmpxchg(&call->delay_ack_at, t, now + MAX_JIFFY_OFFSET); -- ackr_serial = xchg(&call->ackr_serial, 0); -- rxrpc_send_ACK(call, RXRPC_ACK_DELAY, ackr_serial, -+ rxrpc_send_ACK(call, RXRPC_ACK_DELAY, 0, - rxrpc_propose_ack_ping_for_lost_ack); - } - --- -2.43.2 - -From 033edcf322939033927e7e72d0be4a7389552491 Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Fri, 2 Feb 2024 15:19:15 +0000 -Subject: [PATCH 1423/1501] rxrpc: Fix response to PING RESPONSE ACKs to a dead - call -Content-Length: 1449 -Lines: 42 - -[ Upstream commit 6f769f22822aa4124b556339781b04d810f0e038 ] - -Stop rxrpc from sending a DUP ACK in response to a PING RESPONSE ACK on a -dead call. We may have initiated the ping but the call may have beaten the -response to completion. - -Fixes: 18bfeba50dfd ("rxrpc: Perform terminal call ACK/ABORT retransmission from conn processor") -Signed-off-by: David Howells <dhowells@redhat.com> -cc: Marc Dionne <marc.dionne@auristor.com> -cc: "David S. Miller" <davem@davemloft.net> -cc: Eric Dumazet <edumazet@google.com> -cc: Jakub Kicinski <kuba@kernel.org> -cc: Paolo Abeni <pabeni@redhat.com> -cc: linux-afs@lists.infradead.org -cc: netdev@vger.kernel.org -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/rxrpc/conn_event.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c -index ec5eae60ab0c..1f251d758cb9 100644 ---- a/net/rxrpc/conn_event.c -+++ b/net/rxrpc/conn_event.c -@@ -95,6 +95,14 @@ void rxrpc_conn_retransmit_call(struct rxrpc_connection *conn, - - _enter("%d", conn->debug_id); - -+ if (sp && sp->hdr.type == RXRPC_PACKET_TYPE_ACK) { -+ if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header), -+ &pkt.ack, sizeof(pkt.ack)) < 0) -+ return; -+ if (pkt.ack.reason == RXRPC_ACK_PING_RESPONSE) -+ return; -+ } -+ - chan = &conn->channels[channel]; - - /* If the last call got moved on whilst we were waiting to run, just --- -2.43.2 - -From 2fb1d2b6cbd021e7597156f1571289e4cf3ec8a7 Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Fri, 2 Feb 2024 15:19:16 +0000 -Subject: [PATCH 1424/1501] rxrpc: Fix counting of new acks and nacks -Content-Length: 13950 -Lines: 377 - -[ Upstream commit 41b7fa157ea1c8c3a575ca7f5f32034de9bee3ae ] - -Fix the counting of new acks and nacks when parsing a packet - something -that is used in congestion control. - -As the code stands, it merely notes if there are any nacks whereas what we -really should do is compare the previous SACK table to the new one, -assuming we get two successive ACK packets with nacks in them. However, we -really don't want to do that if we can avoid it as the tables might not -correspond directly as one may be shifted from the other - something that -will only get harder to deal with once extended ACK tables come into full -use (with a capacity of up to 8192). - -Instead, count the number of nacks shifted out of the old SACK, the number -of nacks retained in the portion still active and the number of new acks -and nacks in the new table then calculate what we need. - -Note this ends up a bit of an estimate as the Rx protocol allows acks to be -withdrawn by the receiver and packets requested to be retransmitted. - -Fixes: d57a3a151660 ("rxrpc: Save last ACK's SACK table rather than marking txbufs") -Signed-off-by: David Howells <dhowells@redhat.com> -cc: Marc Dionne <marc.dionne@auristor.com> -cc: "David S. Miller" <davem@davemloft.net> -cc: Eric Dumazet <edumazet@google.com> -cc: Jakub Kicinski <kuba@kernel.org> -cc: Paolo Abeni <pabeni@redhat.com> -cc: linux-afs@lists.infradead.org -cc: netdev@vger.kernel.org -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/trace/events/rxrpc.h | 8 ++- - net/rxrpc/ar-internal.h | 20 ++++-- - net/rxrpc/call_event.c | 6 +- - net/rxrpc/call_object.c | 1 + - net/rxrpc/input.c | 115 +++++++++++++++++++++++++++++------ - 5 files changed, 122 insertions(+), 28 deletions(-) - -diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h -index 4c1ef7b3705c..87b8de9b6c1c 100644 ---- a/include/trace/events/rxrpc.h -+++ b/include/trace/events/rxrpc.h -@@ -128,6 +128,7 @@ - EM(rxrpc_skb_eaten_by_unshare_nomem, "ETN unshar-nm") \ - EM(rxrpc_skb_get_conn_secured, "GET conn-secd") \ - EM(rxrpc_skb_get_conn_work, "GET conn-work") \ -+ EM(rxrpc_skb_get_last_nack, "GET last-nack") \ - EM(rxrpc_skb_get_local_work, "GET locl-work") \ - EM(rxrpc_skb_get_reject_work, "GET rej-work ") \ - EM(rxrpc_skb_get_to_recvmsg, "GET to-recv ") \ -@@ -141,6 +142,7 @@ - EM(rxrpc_skb_put_error_report, "PUT error-rep") \ - EM(rxrpc_skb_put_input, "PUT input ") \ - EM(rxrpc_skb_put_jumbo_subpacket, "PUT jumbo-sub") \ -+ EM(rxrpc_skb_put_last_nack, "PUT last-nack") \ - EM(rxrpc_skb_put_purge, "PUT purge ") \ - EM(rxrpc_skb_put_rotate, "PUT rotate ") \ - EM(rxrpc_skb_put_unknown, "PUT unknown ") \ -@@ -1552,7 +1554,7 @@ TRACE_EVENT(rxrpc_congest, - memcpy(&__entry->sum, summary, sizeof(__entry->sum)); - ), - -- TP_printk("c=%08x r=%08x %s q=%08x %s cw=%u ss=%u nA=%u,%u+%u r=%u b=%u u=%u d=%u l=%x%s%s%s", -+ TP_printk("c=%08x r=%08x %s q=%08x %s cw=%u ss=%u nA=%u,%u+%u,%u b=%u u=%u d=%u l=%x%s%s%s", - __entry->call, - __entry->ack_serial, - __print_symbolic(__entry->sum.ack_reason, rxrpc_ack_names), -@@ -1560,9 +1562,9 @@ TRACE_EVENT(rxrpc_congest, - __print_symbolic(__entry->sum.mode, rxrpc_congest_modes), - __entry->sum.cwnd, - __entry->sum.ssthresh, -- __entry->sum.nr_acks, __entry->sum.saw_nacks, -+ __entry->sum.nr_acks, __entry->sum.nr_retained_nacks, - __entry->sum.nr_new_acks, -- __entry->sum.nr_rot_new_acks, -+ __entry->sum.nr_new_nacks, - __entry->top - __entry->hard_ack, - __entry->sum.cumulative_acks, - __entry->sum.dup_acks, -diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h -index 041add7654b2..027414dafe7f 100644 ---- a/net/rxrpc/ar-internal.h -+++ b/net/rxrpc/ar-internal.h -@@ -198,11 +198,19 @@ struct rxrpc_host_header { - */ - struct rxrpc_skb_priv { - struct rxrpc_connection *conn; /* Connection referred to (poke packet) */ -- u16 offset; /* Offset of data */ -- u16 len; /* Length of data */ -- u8 flags; -+ union { -+ struct { -+ u16 offset; /* Offset of data */ -+ u16 len; /* Length of data */ -+ u8 flags; - #define RXRPC_RX_VERIFIED 0x01 -- -+ }; -+ struct { -+ rxrpc_seq_t first_ack; /* First packet in acks table */ -+ u8 nr_acks; /* Number of acks+nacks */ -+ u8 nr_nacks; /* Number of nacks */ -+ }; -+ }; - struct rxrpc_host_header hdr; /* RxRPC packet header from this packet */ - }; - -@@ -689,6 +697,7 @@ struct rxrpc_call { - u8 cong_dup_acks; /* Count of ACKs showing missing packets */ - u8 cong_cumul_acks; /* Cumulative ACK count */ - ktime_t cong_tstamp; /* Last time cwnd was changed */ -+ struct sk_buff *cong_last_nack; /* Last ACK with nacks received */ - - /* Receive-phase ACK management (ACKs we send). */ - u8 ackr_reason; /* reason to ACK */ -@@ -726,7 +735,8 @@ struct rxrpc_call { - struct rxrpc_ack_summary { - u16 nr_acks; /* Number of ACKs in packet */ - u16 nr_new_acks; /* Number of new ACKs in packet */ -- u16 nr_rot_new_acks; /* Number of rotated new ACKs */ -+ u16 nr_new_nacks; /* Number of new nacks in packet */ -+ u16 nr_retained_nacks; /* Number of nacks retained between ACKs */ - u8 ack_reason; - bool saw_nacks; /* Saw NACKs in packet */ - bool new_low_nack; /* T if new low NACK found */ -diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c -index c61efe08695d..0f78544d043b 100644 ---- a/net/rxrpc/call_event.c -+++ b/net/rxrpc/call_event.c -@@ -112,6 +112,7 @@ static void rxrpc_congestion_timeout(struct rxrpc_call *call) - void rxrpc_resend(struct rxrpc_call *call, struct sk_buff *ack_skb) - { - struct rxrpc_ackpacket *ack = NULL; -+ struct rxrpc_skb_priv *sp; - struct rxrpc_txbuf *txb; - unsigned long resend_at; - rxrpc_seq_t transmitted = READ_ONCE(call->tx_transmitted); -@@ -139,14 +140,15 @@ void rxrpc_resend(struct rxrpc_call *call, struct sk_buff *ack_skb) - * explicitly NAK'd packets. - */ - if (ack_skb) { -+ sp = rxrpc_skb(ack_skb); - ack = (void *)ack_skb->data + sizeof(struct rxrpc_wire_header); - -- for (i = 0; i < ack->nAcks; i++) { -+ for (i = 0; i < sp->nr_acks; i++) { - rxrpc_seq_t seq; - - if (ack->acks[i] & 1) - continue; -- seq = ntohl(ack->firstPacket) + i; -+ seq = sp->first_ack + i; - if (after(txb->seq, transmitted)) - break; - if (after(txb->seq, seq)) -diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c -index 0943e54370ba..9fc9a6c3f685 100644 ---- a/net/rxrpc/call_object.c -+++ b/net/rxrpc/call_object.c -@@ -686,6 +686,7 @@ static void rxrpc_destroy_call(struct work_struct *work) - - del_timer_sync(&call->timer); - -+ rxrpc_free_skb(call->cong_last_nack, rxrpc_skb_put_last_nack); - rxrpc_cleanup_ring(call); - while ((txb = list_first_entry_or_null(&call->tx_sendmsg, - struct rxrpc_txbuf, call_link))) { -diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c -index 92495e73b869..9691de00ade7 100644 ---- a/net/rxrpc/input.c -+++ b/net/rxrpc/input.c -@@ -45,11 +45,9 @@ static void rxrpc_congestion_management(struct rxrpc_call *call, - } - - cumulative_acks += summary->nr_new_acks; -- cumulative_acks += summary->nr_rot_new_acks; - if (cumulative_acks > 255) - cumulative_acks = 255; - -- summary->mode = call->cong_mode; - summary->cwnd = call->cong_cwnd; - summary->ssthresh = call->cong_ssthresh; - summary->cumulative_acks = cumulative_acks; -@@ -151,6 +149,7 @@ static void rxrpc_congestion_management(struct rxrpc_call *call, - cwnd = RXRPC_TX_MAX_WINDOW; - call->cong_cwnd = cwnd; - call->cong_cumul_acks = cumulative_acks; -+ summary->mode = call->cong_mode; - trace_rxrpc_congest(call, summary, acked_serial, change); - if (resend) - rxrpc_resend(call, skb); -@@ -213,7 +212,6 @@ static bool rxrpc_rotate_tx_window(struct rxrpc_call *call, rxrpc_seq_t to, - list_for_each_entry_rcu(txb, &call->tx_buffer, call_link, false) { - if (before_eq(txb->seq, call->acks_hard_ack)) - continue; -- summary->nr_rot_new_acks++; - if (test_bit(RXRPC_TXBUF_LAST, &txb->flags)) { - set_bit(RXRPC_CALL_TX_LAST, &call->flags); - rot_last = true; -@@ -254,6 +252,11 @@ static void rxrpc_end_tx_phase(struct rxrpc_call *call, bool reply_begun, - { - ASSERT(test_bit(RXRPC_CALL_TX_LAST, &call->flags)); - -+ if (unlikely(call->cong_last_nack)) { -+ rxrpc_free_skb(call->cong_last_nack, rxrpc_skb_put_last_nack); -+ call->cong_last_nack = NULL; -+ } -+ - switch (__rxrpc_call_state(call)) { - case RXRPC_CALL_CLIENT_SEND_REQUEST: - case RXRPC_CALL_CLIENT_AWAIT_REPLY: -@@ -702,6 +705,43 @@ static void rxrpc_input_ackinfo(struct rxrpc_call *call, struct sk_buff *skb, - wake_up(&call->waitq); - } - -+/* -+ * Determine how many nacks from the previous ACK have now been satisfied. -+ */ -+static rxrpc_seq_t rxrpc_input_check_prev_ack(struct rxrpc_call *call, -+ struct rxrpc_ack_summary *summary, -+ rxrpc_seq_t seq) -+{ -+ struct sk_buff *skb = call->cong_last_nack; -+ struct rxrpc_ackpacket ack; -+ struct rxrpc_skb_priv *sp = rxrpc_skb(skb); -+ unsigned int i, new_acks = 0, retained_nacks = 0; -+ rxrpc_seq_t old_seq = sp->first_ack; -+ u8 *acks = skb->data + sizeof(struct rxrpc_wire_header) + sizeof(ack); -+ -+ if (after_eq(seq, old_seq + sp->nr_acks)) { -+ summary->nr_new_acks += sp->nr_nacks; -+ summary->nr_new_acks += seq - (old_seq + sp->nr_acks); -+ summary->nr_retained_nacks = 0; -+ } else if (seq == old_seq) { -+ summary->nr_retained_nacks = sp->nr_nacks; -+ } else { -+ for (i = 0; i < sp->nr_acks; i++) { -+ if (acks[i] == RXRPC_ACK_TYPE_NACK) { -+ if (before(old_seq + i, seq)) -+ new_acks++; -+ else -+ retained_nacks++; -+ } -+ } -+ -+ summary->nr_new_acks += new_acks; -+ summary->nr_retained_nacks = retained_nacks; -+ } -+ -+ return old_seq + sp->nr_acks; -+} -+ - /* - * Process individual soft ACKs. - * -@@ -711,25 +751,51 @@ static void rxrpc_input_ackinfo(struct rxrpc_call *call, struct sk_buff *skb, - * the timer on the basis that the peer might just not have processed them at - * the time the ACK was sent. - */ --static void rxrpc_input_soft_acks(struct rxrpc_call *call, u8 *acks, -- rxrpc_seq_t seq, int nr_acks, -- struct rxrpc_ack_summary *summary) -+static void rxrpc_input_soft_acks(struct rxrpc_call *call, -+ struct rxrpc_ack_summary *summary, -+ struct sk_buff *skb, -+ rxrpc_seq_t seq, -+ rxrpc_seq_t since) - { -- unsigned int i; -+ struct rxrpc_skb_priv *sp = rxrpc_skb(skb); -+ unsigned int i, old_nacks = 0; -+ rxrpc_seq_t lowest_nak = seq + sp->nr_acks; -+ u8 *acks = skb->data + sizeof(struct rxrpc_wire_header) + sizeof(struct rxrpc_ackpacket); - -- for (i = 0; i < nr_acks; i++) { -+ for (i = 0; i < sp->nr_acks; i++) { - if (acks[i] == RXRPC_ACK_TYPE_ACK) { - summary->nr_acks++; -- summary->nr_new_acks++; -+ if (after_eq(seq, since)) -+ summary->nr_new_acks++; - } else { -- if (!summary->saw_nacks && -- call->acks_lowest_nak != seq + i) { -- call->acks_lowest_nak = seq + i; -- summary->new_low_nack = true; -- } - summary->saw_nacks = true; -+ if (before(seq, since)) { -+ /* Overlap with previous ACK */ -+ old_nacks++; -+ } else { -+ summary->nr_new_nacks++; -+ sp->nr_nacks++; -+ } -+ -+ if (before(seq, lowest_nak)) -+ lowest_nak = seq; - } -+ seq++; - } -+ -+ if (lowest_nak != call->acks_lowest_nak) { -+ call->acks_lowest_nak = lowest_nak; -+ summary->new_low_nack = true; -+ } -+ -+ /* We *can* have more nacks than we did - the peer is permitted to drop -+ * packets it has soft-acked and re-request them. Further, it is -+ * possible for the nack distribution to change whilst the number of -+ * nacks stays the same or goes down. -+ */ -+ if (old_nacks < summary->nr_retained_nacks) -+ summary->nr_new_acks += summary->nr_retained_nacks - old_nacks; -+ summary->nr_retained_nacks = old_nacks; - } - - /* -@@ -773,7 +839,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) - struct rxrpc_skb_priv *sp = rxrpc_skb(skb); - struct rxrpc_ackinfo info; - rxrpc_serial_t ack_serial, acked_serial; -- rxrpc_seq_t first_soft_ack, hard_ack, prev_pkt; -+ rxrpc_seq_t first_soft_ack, hard_ack, prev_pkt, since; - int nr_acks, offset, ioffset; - - _enter(""); -@@ -789,6 +855,8 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) - prev_pkt = ntohl(ack.previousPacket); - hard_ack = first_soft_ack - 1; - nr_acks = ack.nAcks; -+ sp->first_ack = first_soft_ack; -+ sp->nr_acks = nr_acks; - summary.ack_reason = (ack.reason < RXRPC_ACK__INVALID ? - ack.reason : RXRPC_ACK__INVALID); - -@@ -858,6 +926,16 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) - if (nr_acks > 0) - skb_condense(skb); - -+ if (call->cong_last_nack) { -+ since = rxrpc_input_check_prev_ack(call, &summary, first_soft_ack); -+ rxrpc_free_skb(call->cong_last_nack, rxrpc_skb_put_last_nack); -+ call->cong_last_nack = NULL; -+ } else { -+ summary.nr_new_acks = first_soft_ack - call->acks_first_seq; -+ call->acks_lowest_nak = first_soft_ack + nr_acks; -+ since = first_soft_ack; -+ } -+ - call->acks_latest_ts = skb->tstamp; - call->acks_first_seq = first_soft_ack; - call->acks_prev_seq = prev_pkt; -@@ -866,7 +944,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) - case RXRPC_ACK_PING: - break; - default: -- if (after(acked_serial, call->acks_highest_serial)) -+ if (acked_serial && after(acked_serial, call->acks_highest_serial)) - call->acks_highest_serial = acked_serial; - break; - } -@@ -905,8 +983,9 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) - if (nr_acks > 0) { - if (offset > (int)skb->len - nr_acks) - return rxrpc_proto_abort(call, 0, rxrpc_eproto_ackr_short_sack); -- rxrpc_input_soft_acks(call, skb->data + offset, first_soft_ack, -- nr_acks, &summary); -+ rxrpc_input_soft_acks(call, &summary, skb, first_soft_ack, since); -+ rxrpc_get_skb(skb, rxrpc_skb_get_last_nack); -+ call->cong_last_nack = skb; - } - - if (test_bit(RXRPC_CALL_TX_LAST, &call->flags) && --- -2.43.2 - -From 0cd331dfd6023640c9669d0592bc0fd491205f87 Mon Sep 17 00:00:00 2001 -From: Shigeru Yoshida <syoshida@redhat.com> -Date: Thu, 1 Feb 2024 00:23:09 +0900 -Subject: [PATCH 1426/1501] tipc: Check the bearer type before calling - tipc_udp_nl_bearer_add() -Content-Length: 2975 -Lines: 72 - -[ Upstream commit 3871aa01e1a779d866fa9dfdd5a836f342f4eb87 ] - -syzbot reported the following general protection fault [1]: - -general protection fault, probably for non-canonical address 0xdffffc0000000010: 0000 [#1] PREEMPT SMP KASAN -KASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087] -... -RIP: 0010:tipc_udp_is_known_peer+0x9c/0x250 net/tipc/udp_media.c:291 -... -Call Trace: - <TASK> - tipc_udp_nl_bearer_add+0x212/0x2f0 net/tipc/udp_media.c:646 - tipc_nl_bearer_add+0x21e/0x360 net/tipc/bearer.c:1089 - genl_family_rcv_msg_doit+0x1fc/0x2e0 net/netlink/genetlink.c:972 - genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline] - genl_rcv_msg+0x561/0x800 net/netlink/genetlink.c:1067 - netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2544 - genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076 - netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] - netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1367 - netlink_sendmsg+0x8b7/0xd70 net/netlink/af_netlink.c:1909 - sock_sendmsg_nosec net/socket.c:730 [inline] - __sock_sendmsg+0xd5/0x180 net/socket.c:745 - ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584 - ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638 - __sys_sendmsg+0x117/0x1e0 net/socket.c:2667 - do_syscall_x64 arch/x86/entry/common.c:52 [inline] - do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 - entry_SYSCALL_64_after_hwframe+0x63/0x6b - -The cause of this issue is that when tipc_nl_bearer_add() is called with -the TIPC_NLA_BEARER_UDP_OPTS attribute, tipc_udp_nl_bearer_add() is called -even if the bearer is not UDP. - -tipc_udp_is_known_peer() called by tipc_udp_nl_bearer_add() assumes that -the media_ptr field of the tipc_bearer has an udp_bearer type object, so -the function goes crazy for non-UDP bearers. - -This patch fixes the issue by checking the bearer type before calling -tipc_udp_nl_bearer_add() in tipc_nl_bearer_add(). - -Fixes: ef20cd4dd163 ("tipc: introduce UDP replicast") -Reported-and-tested-by: syzbot+5142b87a9abc510e14fa@syzkaller.appspotmail.com -Closes: https://syzkaller.appspot.com/bug?extid=5142b87a9abc510e14fa [1] -Signed-off-by: Shigeru Yoshida <syoshida@redhat.com> -Reviewed-by: Tung Nguyen <tung.q.nguyen@dektech.com.au> -Link: https://lore.kernel.org/r/20240131152310.4089541-1-syoshida@redhat.com -Signed-off-by: Paolo Abeni <pabeni@redhat.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/tipc/bearer.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c -index 2cde375477e3..878415c43527 100644 ---- a/net/tipc/bearer.c -+++ b/net/tipc/bearer.c -@@ -1086,6 +1086,12 @@ int tipc_nl_bearer_add(struct sk_buff *skb, struct genl_info *info) - - #ifdef CONFIG_TIPC_MEDIA_UDP - if (attrs[TIPC_NLA_BEARER_UDP_OPTS]) { -+ if (b->media->type_id != TIPC_MEDIA_TYPE_UDP) { -+ rtnl_unlock(); -+ NL_SET_ERR_MSG(info->extack, "UDP option is unsupported"); -+ return -EINVAL; -+ } -+ - err = tipc_udp_nl_bearer_add(b, - attrs[TIPC_NLA_BEARER_UDP_OPTS]); - if (err) { --- -2.43.2 - -From 82ae47c5c3a6b27fdc0f9e83c1499cb439c56140 Mon Sep 17 00:00:00 2001 -From: Kuniyuki Iwashima <kuniyu@amazon.com> -Date: Sat, 3 Feb 2024 10:31:49 -0800 -Subject: [PATCH 1427/1501] af_unix: Call kfree_skb() for dead - unix_(sk)->oob_skb in GC. -Content-Length: 4551 -Lines: 104 - -[ Upstream commit 1279f9d9dec2d7462823a18c29ad61359e0a007d ] - -syzbot reported a warning [0] in __unix_gc() with a repro, which -creates a socketpair and sends one socket's fd to itself using the -peer. - - socketpair(AF_UNIX, SOCK_STREAM, 0, [3, 4]) = 0 - sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\360", iov_len=1}], - msg_iovlen=1, msg_control=[{cmsg_len=20, cmsg_level=SOL_SOCKET, - cmsg_type=SCM_RIGHTS, cmsg_data=[3]}], - msg_controllen=24, msg_flags=0}, MSG_OOB|MSG_PROBE|MSG_DONTWAIT|MSG_ZEROCOPY) = 1 - -This forms a self-cyclic reference that GC should finally untangle -but does not due to lack of MSG_OOB handling, resulting in memory -leak. - -Recently, commit 11498715f266 ("af_unix: Remove io_uring code for -GC.") removed io_uring's dead code in GC and revealed the problem. - -The code was executed at the final stage of GC and unconditionally -moved all GC candidates from gc_candidates to gc_inflight_list. -That papered over the reported problem by always making the following -WARN_ON_ONCE(!list_empty(&gc_candidates)) false. - -The problem has been there since commit 2aab4b969002 ("af_unix: fix -struct pid leaks in OOB support") added full scm support for MSG_OOB -while fixing another bug. - -To fix this problem, we must call kfree_skb() for unix_sk(sk)->oob_skb -if the socket still exists in gc_candidates after purging collected skb. - -Then, we need to set NULL to oob_skb before calling kfree_skb() because -it calls last fput() and triggers unix_release_sock(), where we call -duplicate kfree_skb(u->oob_skb) if not NULL. - -Note that the leaked socket remained being linked to a global list, so -kmemleak also could not detect it. We need to check /proc/net/protocol -to notice the unfreed socket. - -[0]: -WARNING: CPU: 0 PID: 2863 at net/unix/garbage.c:345 __unix_gc+0xc74/0xe80 net/unix/garbage.c:345 -Modules linked in: -CPU: 0 PID: 2863 Comm: kworker/u4:11 Not tainted 6.8.0-rc1-syzkaller-00583-g1701940b1a02 #0 -Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 -Workqueue: events_unbound __unix_gc -RIP: 0010:__unix_gc+0xc74/0xe80 net/unix/garbage.c:345 -Code: 8b 5c 24 50 e9 86 f8 ff ff e8 f8 e4 22 f8 31 d2 48 c7 c6 30 6a 69 89 4c 89 ef e8 97 ef ff ff e9 80 f9 ff ff e8 dd e4 22 f8 90 <0f> 0b 90 e9 7b fd ff ff 48 89 df e8 5c e7 7c f8 e9 d3 f8 ff ff e8 -RSP: 0018:ffffc9000b03fba0 EFLAGS: 00010293 -RAX: 0000000000000000 RBX: ffffc9000b03fc10 RCX: ffffffff816c493e -RDX: ffff88802c02d940 RSI: ffffffff896982f3 RDI: ffffc9000b03fb30 -RBP: ffffc9000b03fce0 R08: 0000000000000001 R09: fffff52001607f66 -R10: 0000000000000003 R11: 0000000000000002 R12: dffffc0000000000 -R13: ffffc9000b03fc10 R14: ffffc9000b03fc10 R15: 0000000000000001 -FS: 0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 -CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -CR2: 00005559c8677a60 CR3: 000000000d57a000 CR4: 00000000003506f0 -DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 -DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 -Call Trace: - <TASK> - process_one_work+0x889/0x15e0 kernel/workqueue.c:2633 - process_scheduled_works kernel/workqueue.c:2706 [inline] - worker_thread+0x8b9/0x12a0 kernel/workqueue.c:2787 - kthread+0x2c6/0x3b0 kernel/kthread.c:388 - ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 - ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242 - </TASK> - -Reported-by: syzbot+fa3ef895554bdbfd1183@syzkaller.appspotmail.com -Closes: https://syzkaller.appspot.com/bug?extid=fa3ef895554bdbfd1183 -Fixes: 2aab4b969002 ("af_unix: fix struct pid leaks in OOB support") -Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> -Reviewed-by: Eric Dumazet <edumazet@google.com> -Link: https://lore.kernel.org/r/20240203183149.63573-1-kuniyu@amazon.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/unix/garbage.c | 11 +++++++++++ - 1 file changed, 11 insertions(+) - -diff --git a/net/unix/garbage.c b/net/unix/garbage.c -index 2405f0f9af31..8f63f0b4bf01 100644 ---- a/net/unix/garbage.c -+++ b/net/unix/garbage.c -@@ -314,6 +314,17 @@ void unix_gc(void) - /* Here we are. Hitlist is filled. Die. */ - __skb_queue_purge(&hitlist); - -+#if IS_ENABLED(CONFIG_AF_UNIX_OOB) -+ list_for_each_entry_safe(u, next, &gc_candidates, link) { -+ struct sk_buff *skb = u->oob_skb; -+ -+ if (skb) { -+ u->oob_skb = NULL; -+ kfree_skb(skb); -+ } -+ } -+#endif -+ - spin_lock(&unix_gc_lock); - - /* There could be io_uring registered files, just push them back to --- -2.43.2 - -From 319d215a11265819516925f3b4cdee2b5adcbe6c Mon Sep 17 00:00:00 2001 -From: Jiri Pirko <jiri@nvidia.com> -Date: Mon, 5 Feb 2024 18:11:14 +0100 -Subject: [PATCH 1428/1501] devlink: avoid potential loop in - devlink_rel_nested_in_notify_work() -Content-Length: 2261 -Lines: 67 - -[ Upstream commit 58086721b7781c3e35b19c9b78c8f5a791070ba3 ] - -In case devlink_rel_nested_in_notify_work() can not take the devlink -lock mutex. Convert the work to delayed work and in case of reschedule -do it jiffie later and avoid potential looping. - -Suggested-by: Paolo Abeni <pabeni@redhat.com> -Fixes: c137743bce02 ("devlink: introduce object and nested devlink relationship infra") -Signed-off-by: Jiri Pirko <jiri@nvidia.com> -Link: https://lore.kernel.org/r/20240205171114.338679-1-jiri@resnulli.us -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/devlink/core.c | 12 ++++++------ - 1 file changed, 6 insertions(+), 6 deletions(-) - -diff --git a/net/devlink/core.c b/net/devlink/core.c -index 6984877e9f10..cbf8560c9375 100644 ---- a/net/devlink/core.c -+++ b/net/devlink/core.c -@@ -46,7 +46,7 @@ struct devlink_rel { - u32 obj_index; - devlink_rel_notify_cb_t *notify_cb; - devlink_rel_cleanup_cb_t *cleanup_cb; -- struct work_struct notify_work; -+ struct delayed_work notify_work; - } nested_in; - }; - -@@ -70,7 +70,7 @@ static void __devlink_rel_put(struct devlink_rel *rel) - static void devlink_rel_nested_in_notify_work(struct work_struct *work) - { - struct devlink_rel *rel = container_of(work, struct devlink_rel, -- nested_in.notify_work); -+ nested_in.notify_work.work); - struct devlink *devlink; - - devlink = devlinks_xa_get(rel->nested_in.devlink_index); -@@ -96,13 +96,13 @@ static void devlink_rel_nested_in_notify_work(struct work_struct *work) - return; - - reschedule_work: -- schedule_work(&rel->nested_in.notify_work); -+ schedule_delayed_work(&rel->nested_in.notify_work, 1); - } - - static void devlink_rel_nested_in_notify_work_schedule(struct devlink_rel *rel) - { - __devlink_rel_get(rel); -- schedule_work(&rel->nested_in.notify_work); -+ schedule_delayed_work(&rel->nested_in.notify_work, 0); - } - - static struct devlink_rel *devlink_rel_alloc(void) -@@ -123,8 +123,8 @@ static struct devlink_rel *devlink_rel_alloc(void) - } - - refcount_set(&rel->refcount, 1); -- INIT_WORK(&rel->nested_in.notify_work, -- &devlink_rel_nested_in_notify_work); -+ INIT_DELAYED_WORK(&rel->nested_in.notify_work, -+ &devlink_rel_nested_in_notify_work); - return rel; - } - --- -2.43.2 - -From 210d938f963dddc543b07e66a79b7d8d4bd00bd8 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Mon, 5 Feb 2024 17:10:04 +0000 -Subject: [PATCH 1429/1501] ppp_async: limit MRU to 64K -Content-Length: 3634 -Lines: 83 - -[ Upstream commit cb88cb53badb8aeb3955ad6ce80b07b598e310b8 ] - -syzbot triggered a warning [1] in __alloc_pages(): - -WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp) - -Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit MRU to 64K") - -Adopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU) - -[1]: - - WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 -Modules linked in: -CPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0 -Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 -Workqueue: events_unbound flush_to_ldisc -pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) - pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 - lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537 -sp : ffff800093967580 -x29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000 -x26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0 -x23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8 -x20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120 -x17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005 -x14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000 -x11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001 -x8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f -x5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020 -x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0 -Call trace: - __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 - __alloc_pages_node include/linux/gfp.h:238 [inline] - alloc_pages_node include/linux/gfp.h:261 [inline] - __kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926 - __do_kmalloc_node mm/slub.c:3969 [inline] - __kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001 - kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590 - __alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651 - __netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715 - netdev_alloc_skb include/linux/skbuff.h:3235 [inline] - dev_alloc_skb include/linux/skbuff.h:3248 [inline] - ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline] - ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341 - tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390 - tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37 - receive_buf drivers/tty/tty_buffer.c:444 [inline] - flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494 - process_one_work+0x694/0x1204 kernel/workqueue.c:2633 - process_scheduled_works kernel/workqueue.c:2706 [inline] - worker_thread+0x938/0xef4 kernel/workqueue.c:2787 - kthread+0x288/0x310 kernel/kthread.c:388 - ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 - -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Reported-and-tested-by: syzbot+c5da1f087c9e4ec6c933@syzkaller.appspotmail.com -Signed-off-by: Eric Dumazet <edumazet@google.com> -Reviewed-by: Willem de Bruijn <willemb@google.com> -Link: https://lore.kernel.org/r/20240205171004.1059724-1-edumazet@google.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/net/ppp/ppp_async.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/net/ppp/ppp_async.c b/drivers/net/ppp/ppp_async.c -index fbaaa8c102a1..e94a4b08fd63 100644 ---- a/drivers/net/ppp/ppp_async.c -+++ b/drivers/net/ppp/ppp_async.c -@@ -460,6 +460,10 @@ ppp_async_ioctl(struct ppp_channel *chan, unsigned int cmd, unsigned long arg) - case PPPIOCSMRU: - if (get_user(val, p)) - break; -+ if (val > U16_MAX) { -+ err = -EINVAL; -+ break; -+ } - if (val < PPP_MRU) - val = PPP_MRU; - ap->mru = val; --- -2.43.2 - -From 36e38d8703e26209285a4bb92a6c20f356362602 Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso <pablo@netfilter.org> -Date: Thu, 1 Feb 2024 22:58:36 +0100 -Subject: [PATCH 1431/1501] netfilter: nft_compat: narrow down revision to - unsigned 8-bits -Content-Length: 1682 -Lines: 44 - -[ Upstream commit 36fa8d697132b4bed2312d700310e8a78b000c84 ] - -xt_find_revision() expects u8, restrict it to this datatype. - -Fixes: 0ca743a55991 ("netfilter: nf_tables: add compatibility layer for x_tables") -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nft_compat.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c -index f0eeda97bfcd..001b6841a4b6 100644 ---- a/net/netfilter/nft_compat.c -+++ b/net/netfilter/nft_compat.c -@@ -135,7 +135,7 @@ static void nft_target_eval_bridge(const struct nft_expr *expr, - - static const struct nla_policy nft_target_policy[NFTA_TARGET_MAX + 1] = { - [NFTA_TARGET_NAME] = { .type = NLA_NUL_STRING }, -- [NFTA_TARGET_REV] = { .type = NLA_U32 }, -+ [NFTA_TARGET_REV] = NLA_POLICY_MAX(NLA_BE32, 255), - [NFTA_TARGET_INFO] = { .type = NLA_BINARY }, - }; - -@@ -419,7 +419,7 @@ static void nft_match_eval(const struct nft_expr *expr, - - static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX + 1] = { - [NFTA_MATCH_NAME] = { .type = NLA_NUL_STRING }, -- [NFTA_MATCH_REV] = { .type = NLA_U32 }, -+ [NFTA_MATCH_REV] = NLA_POLICY_MAX(NLA_BE32, 255), - [NFTA_MATCH_INFO] = { .type = NLA_BINARY }, - }; - -@@ -724,7 +724,7 @@ static int nfnl_compat_get_rcu(struct sk_buff *skb, - static const struct nla_policy nfnl_compat_policy_get[NFTA_COMPAT_MAX+1] = { - [NFTA_COMPAT_NAME] = { .type = NLA_NUL_STRING, - .len = NFT_COMPAT_NAME_MAX-1 }, -- [NFTA_COMPAT_REV] = { .type = NLA_U32 }, -+ [NFTA_COMPAT_REV] = NLA_POLICY_MAX(NLA_BE32, 255), - [NFTA_COMPAT_TYPE] = { .type = NLA_U32 }, - }; - --- -2.43.2 - -From af12244ecf92547aab00f0a40d006515b1628632 Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso <pablo@netfilter.org> -Date: Thu, 1 Feb 2024 23:33:29 +0100 -Subject: [PATCH 1432/1501] netfilter: nft_compat: reject unused compat flag -Content-Length: 1639 -Lines: 45 - -[ Upstream commit 292781c3c5485ce33bd22b2ef1b2bed709b4d672 ] - -Flag (1 << 0) is ignored is set, never used, reject it it with EINVAL -instead. - -Fixes: 0ca743a55991 ("netfilter: nf_tables: add compatibility layer for x_tables") -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/uapi/linux/netfilter/nf_tables.h | 2 ++ - net/netfilter/nft_compat.c | 3 ++- - 2 files changed, 4 insertions(+), 1 deletion(-) - -diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h -index ca30232b7bc8..117c6a9b845b 100644 ---- a/include/uapi/linux/netfilter/nf_tables.h -+++ b/include/uapi/linux/netfilter/nf_tables.h -@@ -285,9 +285,11 @@ enum nft_rule_attributes { - /** - * enum nft_rule_compat_flags - nf_tables rule compat flags - * -+ * @NFT_RULE_COMPAT_F_UNUSED: unused - * @NFT_RULE_COMPAT_F_INV: invert the check result - */ - enum nft_rule_compat_flags { -+ NFT_RULE_COMPAT_F_UNUSED = (1 << 0), - NFT_RULE_COMPAT_F_INV = (1 << 1), - NFT_RULE_COMPAT_F_MASK = NFT_RULE_COMPAT_F_INV, - }; -diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c -index 001b6841a4b6..ed71d5ecbe0a 100644 ---- a/net/netfilter/nft_compat.c -+++ b/net/netfilter/nft_compat.c -@@ -212,7 +212,8 @@ static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv) - return -EINVAL; - - flags = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_FLAGS])); -- if (flags & ~NFT_RULE_COMPAT_F_MASK) -+ if (flags & NFT_RULE_COMPAT_F_UNUSED || -+ flags & ~NFT_RULE_COMPAT_F_MASK) - return -EINVAL; - if (flags & NFT_RULE_COMPAT_F_INV) - *inv = true; --- -2.43.2 - -From c45aea37e00814c82b017e9d72760199630a6393 Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso <pablo@netfilter.org> -Date: Fri, 2 Feb 2024 00:05:23 +0100 -Subject: [PATCH 1433/1501] netfilter: nft_compat: restrict match/target - protocol to u16 -Content-Length: 1383 -Lines: 43 - -[ Upstream commit d694b754894c93fb4d71a7f3699439dec111decc ] - -xt_check_{match,target} expects u16, but NFTA_RULE_COMPAT_PROTO is u32. - -NLA_POLICY_MAX(NLA_BE32, 65535) cannot be used because .max in -nla_policy is s16, see 3e48be05f3c7 ("netlink: add attribute range -validation to policy"). - -Fixes: 0ca743a55991 ("netfilter: nf_tables: add compatibility layer for x_tables") -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nft_compat.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c -index ed71d5ecbe0a..1f9474fefe84 100644 ---- a/net/netfilter/nft_compat.c -+++ b/net/netfilter/nft_compat.c -@@ -200,6 +200,7 @@ static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1] - static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv) - { - struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1]; -+ u32 l4proto; - u32 flags; - int err; - -@@ -218,7 +219,12 @@ static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv) - if (flags & NFT_RULE_COMPAT_F_INV) - *inv = true; - -- *proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO])); -+ l4proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO])); -+ if (l4proto > U16_MAX) -+ return -EINVAL; -+ -+ *proto = l4proto; -+ - return 0; - } - --- -2.43.2 - -From 0c863cab0e9173f8b6c7bc328bee3b8625f131b5 Mon Sep 17 00:00:00 2001 -From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Date: Sat, 27 Jan 2024 18:34:01 +0530 -Subject: [PATCH 1434/1501] drm/amd/display: Fix 'panel_cntl' could be null in - 'dcn21_set_backlight_level()' -Content-Length: 2827 -Lines: 82 - -[ Upstream commit e96fddb32931d007db12b1fce9b5e8e4c080401b ] - -'panel_cntl' structure used to control the display panel could be null, -dereferencing it could lead to a null pointer access. - -Fixes the below: -drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn21/dcn21_hwseq.c:269 dcn21_set_backlight_level() error: we previously assumed 'panel_cntl' could be null (see line 250) - -Fixes: 474ac4a875ca ("drm/amd/display: Implement some asic specific abm call backs.") -Cc: Yongqiang Sun <yongqiang.sun@amd.com> -Cc: Anthony Koo <Anthony.Koo@amd.com> -Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> -Cc: Aurabindo Pillai <aurabindo.pillai@amd.com> -Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Reviewed-by: Anthony Koo <Anthony.Koo@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../amd/display/dc/hwss/dcn21/dcn21_hwseq.c | 39 ++++++++++--------- - 1 file changed, 20 insertions(+), 19 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c -index 8e88dcaf88f5..a9cd39f77360 100644 ---- a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c -@@ -237,34 +237,35 @@ bool dcn21_set_backlight_level(struct pipe_ctx *pipe_ctx, - { - struct dc_context *dc = pipe_ctx->stream->ctx; - struct abm *abm = pipe_ctx->stream_res.abm; -+ struct timing_generator *tg = pipe_ctx->stream_res.tg; - struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl; -+ uint32_t otg_inst; -+ -+ if (!abm && !tg && !panel_cntl) -+ return false; -+ -+ otg_inst = tg->inst; - - if (dc->dc->res_pool->dmcu) { - dce110_set_backlight_level(pipe_ctx, backlight_pwm_u16_16, frame_ramp); - return true; - } - -- if (abm != NULL) { -- uint32_t otg_inst = pipe_ctx->stream_res.tg->inst; -- -- if (abm && panel_cntl) { -- if (abm->funcs && abm->funcs->set_pipe_ex) { -- abm->funcs->set_pipe_ex(abm, -- otg_inst, -- SET_ABM_PIPE_NORMAL, -- panel_cntl->inst, -- panel_cntl->pwrseq_inst); -- } else { -- dmub_abm_set_pipe(abm, -- otg_inst, -- SET_ABM_PIPE_NORMAL, -- panel_cntl->inst, -- panel_cntl->pwrseq_inst); -- } -- } -+ if (abm->funcs && abm->funcs->set_pipe_ex) { -+ abm->funcs->set_pipe_ex(abm, -+ otg_inst, -+ SET_ABM_PIPE_NORMAL, -+ panel_cntl->inst, -+ panel_cntl->pwrseq_inst); -+ } else { -+ dmub_abm_set_pipe(abm, -+ otg_inst, -+ SET_ABM_PIPE_NORMAL, -+ panel_cntl->inst, -+ panel_cntl->pwrseq_inst); - } - -- if (abm && abm->funcs && abm->funcs->set_backlight_level_pwm) -+ if (abm->funcs && abm->funcs->set_backlight_level_pwm) - abm->funcs->set_backlight_level_pwm(abm, backlight_pwm_u16_16, - frame_ramp, 0, panel_cntl->inst); - else --- -2.43.2 - -From 39f24c08363af1cd945abad84e3c87fd3e3c845a Mon Sep 17 00:00:00 2001 -From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Date: Wed, 31 Jan 2024 08:49:41 +0530 -Subject: [PATCH 1435/1501] drm/amd/display: Add NULL test for 'timing - generator' in 'dcn21_set_pipe()' -Content-Length: 2273 -Lines: 68 - -[ Upstream commit 66951d98d9bf45ba25acf37fe0747253fafdf298 ] - -In "u32 otg_inst = pipe_ctx->stream_res.tg->inst;" -pipe_ctx->stream_res.tg could be NULL, it is relying on the caller to -ensure the tg is not NULL. - -Fixes: 474ac4a875ca ("drm/amd/display: Implement some asic specific abm call backs.") -Cc: Yongqiang Sun <yongqiang.sun@amd.com> -Cc: Anthony Koo <Anthony.Koo@amd.com> -Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> -Cc: Aurabindo Pillai <aurabindo.pillai@amd.com> -Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Reviewed-by: Anthony Koo <Anthony.Koo@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - .../amd/display/dc/hwss/dcn21/dcn21_hwseq.c | 24 +++++++++++-------- - 1 file changed, 14 insertions(+), 10 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c -index a9cd39f77360..5c7f380a84f9 100644 ---- a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c -@@ -206,28 +206,32 @@ void dcn21_set_abm_immediate_disable(struct pipe_ctx *pipe_ctx) - void dcn21_set_pipe(struct pipe_ctx *pipe_ctx) - { - struct abm *abm = pipe_ctx->stream_res.abm; -- uint32_t otg_inst = pipe_ctx->stream_res.tg->inst; -+ struct timing_generator *tg = pipe_ctx->stream_res.tg; - struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl; - struct dmcu *dmcu = pipe_ctx->stream->ctx->dc->res_pool->dmcu; -+ uint32_t otg_inst; -+ -+ if (!abm && !tg && !panel_cntl) -+ return; -+ -+ otg_inst = tg->inst; - - if (dmcu) { - dce110_set_pipe(pipe_ctx); - return; - } - -- if (abm && panel_cntl) { -- if (abm->funcs && abm->funcs->set_pipe_ex) { -- abm->funcs->set_pipe_ex(abm, -+ if (abm->funcs && abm->funcs->set_pipe_ex) { -+ abm->funcs->set_pipe_ex(abm, - otg_inst, - SET_ABM_PIPE_NORMAL, - panel_cntl->inst, - panel_cntl->pwrseq_inst); -- } else { -- dmub_abm_set_pipe(abm, otg_inst, -- SET_ABM_PIPE_NORMAL, -- panel_cntl->inst, -- panel_cntl->pwrseq_inst); -- } -+ } else { -+ dmub_abm_set_pipe(abm, otg_inst, -+ SET_ABM_PIPE_NORMAL, -+ panel_cntl->inst, -+ panel_cntl->pwrseq_inst); - } - } - --- -2.43.2 - -From a938eab9586eea31cfd129a507f552efae14d738 Mon Sep 17 00:00:00 2001 -From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Date: Wed, 7 Feb 2024 10:20:57 +0530 -Subject: [PATCH 1436/1501] drm/amd/display: Implement bounds check for stream - encoder creation in DCN301 -Content-Length: 2102 -Lines: 46 - -[ Upstream commit 58fca355ad37dcb5f785d9095db5f748b79c5dc2 ] - -'stream_enc_regs' array is an array of dcn10_stream_enc_registers -structures. The array is initialized with four elements, corresponding -to the four calls to stream_enc_regs() in the array initializer. This -means that valid indices for this array are 0, 1, 2, and 3. - -The error message 'stream_enc_regs' 4 <= 5 below, is indicating that -there is an attempt to access this array with an index of 5, which is -out of bounds. This could lead to undefined behavior - -Here, eng_id is used as an index to access the stream_enc_regs array. If -eng_id is 5, this would result in an out-of-bounds access on the -stream_enc_regs array. - -Thus fixing Buffer overflow error in dcn301_stream_encoder_create -reported by Smatch: -drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn301/dcn301_resource.c:1011 dcn301_stream_encoder_create() error: buffer overflow 'stream_enc_regs' 4 <= 5 - -Fixes: 3a83e4e64bb1 ("drm/amd/display: Add dcn3.01 support to DC (v2)") -Cc: Roman Li <Roman.Li@amd.com> -Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> -Cc: Aurabindo Pillai <aurabindo.pillai@amd.com> -Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> -Reviewed-by: Roman Li <roman.li@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c b/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c -index f3b75f283aa2..ce04caf35d80 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c -@@ -999,7 +999,7 @@ static struct stream_encoder *dcn301_stream_encoder_create(enum engine_id eng_id - vpg = dcn301_vpg_create(ctx, vpg_inst); - afmt = dcn301_afmt_create(ctx, afmt_inst); - -- if (!enc1 || !vpg || !afmt) { -+ if (!enc1 || !vpg || !afmt || eng_id >= ARRAY_SIZE(stream_enc_regs)) { - kfree(enc1); - kfree(vpg); - kfree(afmt); --- -2.43.2 - -From b4b257155aab1956f908387d93e84defd69c1162 Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso <pablo@netfilter.org> -Date: Fri, 2 Feb 2024 10:09:34 +0100 -Subject: [PATCH 1437/1501] netfilter: nft_set_pipapo: remove static in - nft_pipapo_get() -Content-Length: 1024 -Lines: 28 - -[ Upstream commit ab0beafd52b98dfb8b8244b2c6794efbc87478db ] - -This has slipped through when reducing memory footprint for set -elements, remove it. - -Fixes: 9dad402b89e8 ("netfilter: nf_tables: expose opaque set element as struct nft_elem_priv") -Reported-by: Florian Westphal <fw@strlen.de> -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nft_set_pipapo.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c -index 7252fcdae349..a65617cd8e2e 100644 ---- a/net/netfilter/nft_set_pipapo.c -+++ b/net/netfilter/nft_set_pipapo.c -@@ -603,7 +603,7 @@ static struct nft_elem_priv * - nft_pipapo_get(const struct net *net, const struct nft_set *set, - const struct nft_set_elem *elem, unsigned int flags) - { -- static struct nft_pipapo_elem *e; -+ struct nft_pipapo_elem *e; - - e = pipapo_get(net, set, (const u8 *)elem->key.val.data, - nft_genmask_cur(net)); --- -2.43.2 - -From fc46e23da74588753676e58ca5d3100a68a5632a Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso <pablo@netfilter.org> -Date: Mon, 5 Feb 2024 14:59:24 +0100 -Subject: [PATCH 1438/1501] netfilter: nft_ct: reject direction for ct id -Content-Length: 753 -Lines: 28 - -[ Upstream commit 38ed1c7062ada30d7c11e7a7acc749bf27aa14aa ] - -Direction attribute is ignored, reject it in case this ever needs to be -supported - -Fixes: 3087c3f7c23b ("netfilter: nft_ct: Add ct id support") -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nft_ct.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c -index aac98a3c966e..bfd3e5a14dab 100644 ---- a/net/netfilter/nft_ct.c -+++ b/net/netfilter/nft_ct.c -@@ -476,6 +476,9 @@ static int nft_ct_get_init(const struct nft_ctx *ctx, - break; - #endif - case NFT_CT_ID: -+ if (tb[NFTA_CT_DIRECTION]) -+ return -EINVAL; -+ - len = sizeof(u32); - break; - default: --- -2.43.2 - -From 383182db8d58c4237772ba0764cded4938a235c3 Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso <pablo@netfilter.org> -Date: Tue, 6 Feb 2024 00:11:40 +0100 -Subject: [PATCH 1439/1501] netfilter: nf_tables: use timestamp to check for - set element timeout -Content-Length: 11801 -Lines: 312 - -[ Upstream commit 7395dfacfff65e9938ac0889dafa1ab01e987d15 ] - -Add a timestamp field at the beginning of the transaction, store it -in the nftables per-netns area. - -Update set backend .insert, .deactivate and sync gc path to use the -timestamp, this avoids that an element expires while control plane -transaction is still unfinished. - -.lookup and .update, which are used from packet path, still use the -current time to check if the element has expired. And .get path and dump -also since this runs lockless under rcu read size lock. Then, there is -async gc which also needs to check the current time since it runs -asynchronously from a workqueue. - -Fixes: c3e1b005ed1c ("netfilter: nf_tables: add set element timeout support") -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/net/netfilter/nf_tables.h | 16 ++++++++++++++-- - net/netfilter/nf_tables_api.c | 4 +++- - net/netfilter/nft_set_hash.c | 8 +++++++- - net/netfilter/nft_set_pipapo.c | 18 +++++++++++------- - net/netfilter/nft_set_rbtree.c | 11 +++++++---- - 5 files changed, 42 insertions(+), 15 deletions(-) - -diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h -index 4e8ecabc5f25..62013d018411 100644 ---- a/include/net/netfilter/nf_tables.h -+++ b/include/net/netfilter/nf_tables.h -@@ -798,10 +798,16 @@ static inline struct nft_set_elem_expr *nft_set_ext_expr(const struct nft_set_ex - return nft_set_ext(ext, NFT_SET_EXT_EXPRESSIONS); - } - --static inline bool nft_set_elem_expired(const struct nft_set_ext *ext) -+static inline bool __nft_set_elem_expired(const struct nft_set_ext *ext, -+ u64 tstamp) - { - return nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION) && -- time_is_before_eq_jiffies64(*nft_set_ext_expiration(ext)); -+ time_after_eq64(tstamp, *nft_set_ext_expiration(ext)); -+} -+ -+static inline bool nft_set_elem_expired(const struct nft_set_ext *ext) -+{ -+ return __nft_set_elem_expired(ext, get_jiffies_64()); - } - - static inline struct nft_set_ext *nft_set_elem_ext(const struct nft_set *set, -@@ -1750,6 +1756,7 @@ struct nftables_pernet { - struct list_head notify_list; - struct mutex commit_mutex; - u64 table_handle; -+ u64 tstamp; - unsigned int base_seq; - unsigned int gc_seq; - u8 validate_state; -@@ -1762,6 +1769,11 @@ static inline struct nftables_pernet *nft_pernet(const struct net *net) - return net_generic(net, nf_tables_net_id); - } - -+static inline u64 nft_net_tstamp(const struct net *net) -+{ -+ return nft_pernet(net)->tstamp; -+} -+ - #define __NFT_REDUCE_READONLY 1UL - #define NFT_REDUCE_READONLY (void *)__NFT_REDUCE_READONLY - -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 0e07f110a539..04c5aa4debc7 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -9744,6 +9744,7 @@ struct nft_trans_gc *nft_trans_gc_catchall_async(struct nft_trans_gc *gc, - struct nft_trans_gc *nft_trans_gc_catchall_sync(struct nft_trans_gc *gc) - { - struct nft_set_elem_catchall *catchall, *next; -+ u64 tstamp = nft_net_tstamp(gc->net); - const struct nft_set *set = gc->set; - struct nft_elem_priv *elem_priv; - struct nft_set_ext *ext; -@@ -9753,7 +9754,7 @@ struct nft_trans_gc *nft_trans_gc_catchall_sync(struct nft_trans_gc *gc) - list_for_each_entry_safe(catchall, next, &set->catchall_list, list) { - ext = nft_set_elem_ext(set, catchall->elem); - -- if (!nft_set_elem_expired(ext)) -+ if (!__nft_set_elem_expired(ext, tstamp)) - continue; - - gc = nft_trans_gc_queue_sync(gc, GFP_KERNEL); -@@ -10539,6 +10540,7 @@ static bool nf_tables_valid_genid(struct net *net, u32 genid) - bool genid_ok; - - mutex_lock(&nft_net->commit_mutex); -+ nft_net->tstamp = get_jiffies_64(); - - genid_ok = genid == 0 || nft_net->base_seq == genid; - if (!genid_ok) -diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c -index 6c2061bfdae6..6968a3b34236 100644 ---- a/net/netfilter/nft_set_hash.c -+++ b/net/netfilter/nft_set_hash.c -@@ -36,6 +36,7 @@ struct nft_rhash_cmp_arg { - const struct nft_set *set; - const u32 *key; - u8 genmask; -+ u64 tstamp; - }; - - static inline u32 nft_rhash_key(const void *data, u32 len, u32 seed) -@@ -62,7 +63,7 @@ static inline int nft_rhash_cmp(struct rhashtable_compare_arg *arg, - return 1; - if (nft_set_elem_is_dead(&he->ext)) - return 1; -- if (nft_set_elem_expired(&he->ext)) -+ if (__nft_set_elem_expired(&he->ext, x->tstamp)) - return 1; - if (!nft_set_elem_active(&he->ext, x->genmask)) - return 1; -@@ -87,6 +88,7 @@ bool nft_rhash_lookup(const struct net *net, const struct nft_set *set, - .genmask = nft_genmask_cur(net), - .set = set, - .key = key, -+ .tstamp = get_jiffies_64(), - }; - - he = rhashtable_lookup(&priv->ht, &arg, nft_rhash_params); -@@ -106,6 +108,7 @@ nft_rhash_get(const struct net *net, const struct nft_set *set, - .genmask = nft_genmask_cur(net), - .set = set, - .key = elem->key.val.data, -+ .tstamp = get_jiffies_64(), - }; - - he = rhashtable_lookup(&priv->ht, &arg, nft_rhash_params); -@@ -131,6 +134,7 @@ static bool nft_rhash_update(struct nft_set *set, const u32 *key, - .genmask = NFT_GENMASK_ANY, - .set = set, - .key = key, -+ .tstamp = get_jiffies_64(), - }; - - he = rhashtable_lookup(&priv->ht, &arg, nft_rhash_params); -@@ -175,6 +179,7 @@ static int nft_rhash_insert(const struct net *net, const struct nft_set *set, - .genmask = nft_genmask_next(net), - .set = set, - .key = elem->key.val.data, -+ .tstamp = nft_net_tstamp(net), - }; - struct nft_rhash_elem *prev; - -@@ -216,6 +221,7 @@ nft_rhash_deactivate(const struct net *net, const struct nft_set *set, - .genmask = nft_genmask_next(net), - .set = set, - .key = elem->key.val.data, -+ .tstamp = nft_net_tstamp(net), - }; - - rcu_read_lock(); -diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c -index a65617cd8e2e..ffce43e14561 100644 ---- a/net/netfilter/nft_set_pipapo.c -+++ b/net/netfilter/nft_set_pipapo.c -@@ -504,6 +504,7 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set, - * @set: nftables API set representation - * @data: Key data to be matched against existing elements - * @genmask: If set, check that element is active in given genmask -+ * @tstamp: timestamp to check for expired elements - * - * This is essentially the same as the lookup function, except that it matches - * key data against the uncommitted copy and doesn't use preallocated maps for -@@ -513,7 +514,8 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set, - */ - static struct nft_pipapo_elem *pipapo_get(const struct net *net, - const struct nft_set *set, -- const u8 *data, u8 genmask) -+ const u8 *data, u8 genmask, -+ u64 tstamp) - { - struct nft_pipapo_elem *ret = ERR_PTR(-ENOENT); - struct nft_pipapo *priv = nft_set_priv(set); -@@ -566,7 +568,7 @@ static struct nft_pipapo_elem *pipapo_get(const struct net *net, - goto out; - - if (last) { -- if (nft_set_elem_expired(&f->mt[b].e->ext)) -+ if (__nft_set_elem_expired(&f->mt[b].e->ext, tstamp)) - goto next_match; - if ((genmask && - !nft_set_elem_active(&f->mt[b].e->ext, genmask))) -@@ -606,7 +608,7 @@ nft_pipapo_get(const struct net *net, const struct nft_set *set, - struct nft_pipapo_elem *e; - - e = pipapo_get(net, set, (const u8 *)elem->key.val.data, -- nft_genmask_cur(net)); -+ nft_genmask_cur(net), get_jiffies_64()); - if (IS_ERR(e)) - return ERR_CAST(e); - -@@ -1173,6 +1175,7 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, - struct nft_pipapo_match *m = priv->clone; - u8 genmask = nft_genmask_next(net); - struct nft_pipapo_elem *e, *dup; -+ u64 tstamp = nft_net_tstamp(net); - struct nft_pipapo_field *f; - const u8 *start_p, *end_p; - int i, bsize_max, err = 0; -@@ -1182,7 +1185,7 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, - else - end = start; - -- dup = pipapo_get(net, set, start, genmask); -+ dup = pipapo_get(net, set, start, genmask, tstamp); - if (!IS_ERR(dup)) { - /* Check if we already have the same exact entry */ - const struct nft_data *dup_key, *dup_end; -@@ -1204,7 +1207,7 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, - - if (PTR_ERR(dup) == -ENOENT) { - /* Look for partially overlapping entries */ -- dup = pipapo_get(net, set, end, nft_genmask_next(net)); -+ dup = pipapo_get(net, set, end, nft_genmask_next(net), tstamp); - } - - if (PTR_ERR(dup) != -ENOENT) { -@@ -1560,6 +1563,7 @@ static void pipapo_gc(struct nft_set *set, struct nft_pipapo_match *m) - { - struct nft_pipapo *priv = nft_set_priv(set); - struct net *net = read_pnet(&set->net); -+ u64 tstamp = nft_net_tstamp(net); - int rules_f0, first_rule = 0; - struct nft_pipapo_elem *e; - struct nft_trans_gc *gc; -@@ -1594,7 +1598,7 @@ static void pipapo_gc(struct nft_set *set, struct nft_pipapo_match *m) - /* synchronous gc never fails, there is no need to set on - * NFT_SET_ELEM_DEAD_BIT. - */ -- if (nft_set_elem_expired(&e->ext)) { -+ if (__nft_set_elem_expired(&e->ext, tstamp)) { - priv->dirty = true; - - gc = nft_trans_gc_queue_sync(gc, GFP_ATOMIC); -@@ -1769,7 +1773,7 @@ static void *pipapo_deactivate(const struct net *net, const struct nft_set *set, - { - struct nft_pipapo_elem *e; - -- e = pipapo_get(net, set, data, nft_genmask_next(net)); -+ e = pipapo_get(net, set, data, nft_genmask_next(net), nft_net_tstamp(net)); - if (IS_ERR(e)) - return NULL; - -diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c -index baa3fea4fe65..5fd74f993988 100644 ---- a/net/netfilter/nft_set_rbtree.c -+++ b/net/netfilter/nft_set_rbtree.c -@@ -313,6 +313,7 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set, - struct nft_rbtree *priv = nft_set_priv(set); - u8 cur_genmask = nft_genmask_cur(net); - u8 genmask = nft_genmask_next(net); -+ u64 tstamp = nft_net_tstamp(net); - int d; - - /* Descend the tree to search for an existing element greater than the -@@ -360,7 +361,7 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set, - /* perform garbage collection to avoid bogus overlap reports - * but skip new elements in this transaction. - */ -- if (nft_set_elem_expired(&rbe->ext) && -+ if (__nft_set_elem_expired(&rbe->ext, tstamp) && - nft_set_elem_active(&rbe->ext, cur_genmask)) { - const struct nft_rbtree_elem *removed_end; - -@@ -551,6 +552,7 @@ nft_rbtree_deactivate(const struct net *net, const struct nft_set *set, - const struct nft_rbtree *priv = nft_set_priv(set); - const struct rb_node *parent = priv->root.rb_node; - u8 genmask = nft_genmask_next(net); -+ u64 tstamp = nft_net_tstamp(net); - int d; - - while (parent != NULL) { -@@ -571,7 +573,7 @@ nft_rbtree_deactivate(const struct net *net, const struct nft_set *set, - nft_rbtree_interval_end(this)) { - parent = parent->rb_right; - continue; -- } else if (nft_set_elem_expired(&rbe->ext)) { -+ } else if (__nft_set_elem_expired(&rbe->ext, tstamp)) { - break; - } else if (!nft_set_elem_active(&rbe->ext, genmask)) { - parent = parent->rb_left; -@@ -624,9 +626,10 @@ static void nft_rbtree_gc(struct nft_set *set) - { - struct nft_rbtree *priv = nft_set_priv(set); - struct nft_rbtree_elem *rbe, *rbe_end = NULL; -+ struct net *net = read_pnet(&set->net); -+ u64 tstamp = nft_net_tstamp(net); - struct rb_node *node, *next; - struct nft_trans_gc *gc; -- struct net *net; - - set = nft_set_container_of(priv); - net = read_pnet(&set->net); -@@ -648,7 +651,7 @@ static void nft_rbtree_gc(struct nft_set *set) - rbe_end = rbe; - continue; - } -- if (!nft_set_elem_expired(&rbe->ext)) -+ if (!__nft_set_elem_expired(&rbe->ext, tstamp)) - continue; - - gc = nft_trans_gc_queue_sync(gc, GFP_KERNEL); --- -2.43.2 - -From 3c0c0cf930aa802ab2b4e4206e7307de17d64634 Mon Sep 17 00:00:00 2001 -From: Florian Westphal <fw@strlen.de> -Date: Tue, 6 Feb 2024 17:54:18 +0100 -Subject: [PATCH 1440/1501] netfilter: nfnetlink_queue: un-break NF_REPEAT -Content-Length: 1624 -Lines: 52 - -[ Upstream commit f82777e8ce6c039cdcacbcf1eb8619b99a20c06d ] - -Only override userspace verdict if the ct hook returns something -other than ACCEPT. - -Else, this replaces NF_REPEAT (run all hooks again) with NF_ACCEPT -(move to next hook). - -Fixes: 6291b3a67ad5 ("netfilter: conntrack: convert nf_conntrack_update to netfilter verdicts") -Reported-by: l.6diay@passmail.com -Signed-off-by: Florian Westphal <fw@strlen.de> -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nfnetlink_queue.c | 13 ++++++++++--- - 1 file changed, 10 insertions(+), 3 deletions(-) - -diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c -index 171d1f52d3dd..5cf38fc0a366 100644 ---- a/net/netfilter/nfnetlink_queue.c -+++ b/net/netfilter/nfnetlink_queue.c -@@ -232,18 +232,25 @@ static void nfqnl_reinject(struct nf_queue_entry *entry, unsigned int verdict) - if (verdict == NF_ACCEPT || - verdict == NF_REPEAT || - verdict == NF_STOP) { -+ unsigned int ct_verdict = verdict; -+ - rcu_read_lock(); - ct_hook = rcu_dereference(nf_ct_hook); - if (ct_hook) -- verdict = ct_hook->update(entry->state.net, entry->skb); -+ ct_verdict = ct_hook->update(entry->state.net, entry->skb); - rcu_read_unlock(); - -- switch (verdict & NF_VERDICT_MASK) { -+ switch (ct_verdict & NF_VERDICT_MASK) { -+ case NF_ACCEPT: -+ /* follow userspace verdict, could be REPEAT */ -+ break; - case NF_STOLEN: - nf_queue_entry_free(entry); - return; -+ default: -+ verdict = ct_verdict & NF_VERDICT_MASK; -+ break; - } -- - } - nf_reinject(entry, verdict); - } --- -2.43.2 - -From 70e02eb2b1634e1601e369c66d117ccfec8c8038 Mon Sep 17 00:00:00 2001 -From: Florian Westphal <fw@strlen.de> -Date: Wed, 7 Feb 2024 21:52:46 +0100 -Subject: [PATCH 1441/1501] netfilter: nft_set_pipapo: store index in scratch - maps -Content-Length: 9395 -Lines: 258 - -[ Upstream commit 76313d1a4aa9e30d5b43dee5efd8bcd4d8250006 ] - -Pipapo needs a scratchpad area to keep state during matching. -This state can be large and thus cannot reside on stack. - -Each set preallocates percpu areas for this. - -On each match stage, one scratchpad half starts with all-zero and the other -is inited to all-ones. - -At the end of each stage, the half that starts with all-ones is -always zero. Before next field is tested, pointers to the two halves -are swapped, i.e. resmap pointer turns into fill pointer and vice versa. - -After the last field has been processed, pipapo stashes the -index toggle in a percpu variable, with assumption that next packet -will start with the all-zero half and sets all bits in the other to 1. - -This isn't reliable. - -There can be multiple sets and we can't be sure that the upper -and lower half of all set scratch map is always in sync (lookups -can be conditional), so one set might have swapped, but other might -not have been queried. - -Thus we need to keep the index per-set-and-cpu, just like the -scratchpad. - -Note that this bug fix is incomplete, there is a related issue. - -avx2 and normal implementation might use slightly different areas of the -map array space due to the avx2 alignment requirements, so -m->scratch (generic/fallback implementation) and ->scratch_aligned -(avx) may partially overlap. scratch and scratch_aligned are not distinct -objects, the latter is just the aligned address of the former. - -After this change, write to scratch_align->map_index may write to -scratch->map, so this issue becomes more prominent, we can set to 1 -a bit in the supposedly-all-zero area of scratch->map[]. - -A followup patch will remove the scratch_aligned and makes generic and -avx code use the same (aligned) area. - -Its done in a separate change to ease review. - -Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") -Reviewed-by: Stefano Brivio <sbrivio@redhat.com> -Signed-off-by: Florian Westphal <fw@strlen.de> -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nft_set_pipapo.c | 41 ++++++++++++++++++----------- - net/netfilter/nft_set_pipapo.h | 14 ++++++++-- - net/netfilter/nft_set_pipapo_avx2.c | 15 +++++------ - 3 files changed, 44 insertions(+), 26 deletions(-) - -diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c -index ffce43e14561..535df7a95374 100644 ---- a/net/netfilter/nft_set_pipapo.c -+++ b/net/netfilter/nft_set_pipapo.c -@@ -342,9 +342,6 @@ - #include "nft_set_pipapo_avx2.h" - #include "nft_set_pipapo.h" - --/* Current working bitmap index, toggled between field matches */ --static DEFINE_PER_CPU(bool, nft_pipapo_scratch_index); -- - /** - * pipapo_refill() - For each set bit, set bits from selected mapping table item - * @map: Bitmap to be scanned for set bits -@@ -412,6 +409,7 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set, - const u32 *key, const struct nft_set_ext **ext) - { - struct nft_pipapo *priv = nft_set_priv(set); -+ struct nft_pipapo_scratch *scratch; - unsigned long *res_map, *fill_map; - u8 genmask = nft_genmask_cur(net); - const u8 *rp = (const u8 *)key; -@@ -422,15 +420,17 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set, - - local_bh_disable(); - -- map_index = raw_cpu_read(nft_pipapo_scratch_index); -- - m = rcu_dereference(priv->match); - - if (unlikely(!m || !*raw_cpu_ptr(m->scratch))) - goto out; - -- res_map = *raw_cpu_ptr(m->scratch) + (map_index ? m->bsize_max : 0); -- fill_map = *raw_cpu_ptr(m->scratch) + (map_index ? 0 : m->bsize_max); -+ scratch = *raw_cpu_ptr(m->scratch); -+ -+ map_index = scratch->map_index; -+ -+ res_map = scratch->map + (map_index ? m->bsize_max : 0); -+ fill_map = scratch->map + (map_index ? 0 : m->bsize_max); - - memset(res_map, 0xff, m->bsize_max * sizeof(*res_map)); - -@@ -460,7 +460,7 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set, - b = pipapo_refill(res_map, f->bsize, f->rules, fill_map, f->mt, - last); - if (b < 0) { -- raw_cpu_write(nft_pipapo_scratch_index, map_index); -+ scratch->map_index = map_index; - local_bh_enable(); - - return false; -@@ -477,7 +477,7 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set, - * current inactive bitmap is clean and can be reused as - * *next* bitmap (not initial) for the next packet. - */ -- raw_cpu_write(nft_pipapo_scratch_index, map_index); -+ scratch->map_index = map_index; - local_bh_enable(); - - return true; -@@ -1123,12 +1123,12 @@ static int pipapo_realloc_scratch(struct nft_pipapo_match *clone, - int i; - - for_each_possible_cpu(i) { -- unsigned long *scratch; -+ struct nft_pipapo_scratch *scratch; - #ifdef NFT_PIPAPO_ALIGN -- unsigned long *scratch_aligned; -+ void *scratch_aligned; - #endif -- -- scratch = kzalloc_node(bsize_max * sizeof(*scratch) * 2 + -+ scratch = kzalloc_node(struct_size(scratch, map, -+ bsize_max * 2) + - NFT_PIPAPO_ALIGN_HEADROOM, - GFP_KERNEL, cpu_to_node(i)); - if (!scratch) { -@@ -1147,7 +1147,16 @@ static int pipapo_realloc_scratch(struct nft_pipapo_match *clone, - *per_cpu_ptr(clone->scratch, i) = scratch; - - #ifdef NFT_PIPAPO_ALIGN -- scratch_aligned = NFT_PIPAPO_LT_ALIGN(scratch); -+ /* Align &scratch->map (not the struct itself): the extra -+ * %NFT_PIPAPO_ALIGN_HEADROOM bytes passed to kzalloc_node() -+ * above guarantee we can waste up to those bytes in order -+ * to align the map field regardless of its offset within -+ * the struct. -+ */ -+ BUILD_BUG_ON(offsetof(struct nft_pipapo_scratch, map) > NFT_PIPAPO_ALIGN_HEADROOM); -+ -+ scratch_aligned = NFT_PIPAPO_LT_ALIGN(&scratch->map); -+ scratch_aligned -= offsetof(struct nft_pipapo_scratch, map); - *per_cpu_ptr(clone->scratch_aligned, i) = scratch_aligned; - #endif - } -@@ -2136,7 +2145,7 @@ static int nft_pipapo_init(const struct nft_set *set, - m->field_count = field_count; - m->bsize_max = 0; - -- m->scratch = alloc_percpu(unsigned long *); -+ m->scratch = alloc_percpu(struct nft_pipapo_scratch *); - if (!m->scratch) { - err = -ENOMEM; - goto out_scratch; -@@ -2145,7 +2154,7 @@ static int nft_pipapo_init(const struct nft_set *set, - *per_cpu_ptr(m->scratch, i) = NULL; - - #ifdef NFT_PIPAPO_ALIGN -- m->scratch_aligned = alloc_percpu(unsigned long *); -+ m->scratch_aligned = alloc_percpu(struct nft_pipapo_scratch *); - if (!m->scratch_aligned) { - err = -ENOMEM; - goto out_free; -diff --git a/net/netfilter/nft_set_pipapo.h b/net/netfilter/nft_set_pipapo.h -index 1040223da5fa..d3bc1551694f 100644 ---- a/net/netfilter/nft_set_pipapo.h -+++ b/net/netfilter/nft_set_pipapo.h -@@ -130,6 +130,16 @@ struct nft_pipapo_field { - union nft_pipapo_map_bucket *mt; - }; - -+/** -+ * struct nft_pipapo_scratch - percpu data used for lookup and matching -+ * @map_index: Current working bitmap index, toggled between field matches -+ * @map: store partial matching results during lookup -+ */ -+struct nft_pipapo_scratch { -+ u8 map_index; -+ unsigned long map[]; -+}; -+ - /** - * struct nft_pipapo_match - Data used for lookup and matching - * @field_count Amount of fields in set -@@ -142,9 +152,9 @@ struct nft_pipapo_field { - struct nft_pipapo_match { - int field_count; - #ifdef NFT_PIPAPO_ALIGN -- unsigned long * __percpu *scratch_aligned; -+ struct nft_pipapo_scratch * __percpu *scratch_aligned; - #endif -- unsigned long * __percpu *scratch; -+ struct nft_pipapo_scratch * __percpu *scratch; - size_t bsize_max; - struct rcu_head rcu; - struct nft_pipapo_field f[] __counted_by(field_count); -diff --git a/net/netfilter/nft_set_pipapo_avx2.c b/net/netfilter/nft_set_pipapo_avx2.c -index 52e0d026d30a..78213c73af2e 100644 ---- a/net/netfilter/nft_set_pipapo_avx2.c -+++ b/net/netfilter/nft_set_pipapo_avx2.c -@@ -71,9 +71,6 @@ - #define NFT_PIPAPO_AVX2_ZERO(reg) \ - asm volatile("vpxor %ymm" #reg ", %ymm" #reg ", %ymm" #reg) - --/* Current working bitmap index, toggled between field matches */ --static DEFINE_PER_CPU(bool, nft_pipapo_avx2_scratch_index); -- - /** - * nft_pipapo_avx2_prepare() - Prepare before main algorithm body - * -@@ -1120,11 +1117,12 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set, - const u32 *key, const struct nft_set_ext **ext) - { - struct nft_pipapo *priv = nft_set_priv(set); -- unsigned long *res, *fill, *scratch; -+ struct nft_pipapo_scratch *scratch; - u8 genmask = nft_genmask_cur(net); - const u8 *rp = (const u8 *)key; - struct nft_pipapo_match *m; - struct nft_pipapo_field *f; -+ unsigned long *res, *fill; - bool map_index; - int i, ret = 0; - -@@ -1146,10 +1144,11 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set, - kernel_fpu_end(); - return false; - } -- map_index = raw_cpu_read(nft_pipapo_avx2_scratch_index); - -- res = scratch + (map_index ? m->bsize_max : 0); -- fill = scratch + (map_index ? 0 : m->bsize_max); -+ map_index = scratch->map_index; -+ -+ res = scratch->map + (map_index ? m->bsize_max : 0); -+ fill = scratch->map + (map_index ? 0 : m->bsize_max); - - /* Starting map doesn't need to be set for this implementation */ - -@@ -1221,7 +1220,7 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set, - - out: - if (i % 2) -- raw_cpu_write(nft_pipapo_avx2_scratch_index, !map_index); -+ scratch->map_index = !map_index; - kernel_fpu_end(); - - return ret >= 0; --- -2.43.2 - -From 14429a716d21902279362f4cb88ad08c721a7523 Mon Sep 17 00:00:00 2001 -From: Florian Westphal <fw@strlen.de> -Date: Wed, 7 Feb 2024 21:52:47 +0100 -Subject: [PATCH 1442/1501] netfilter: nft_set_pipapo: add helper to release - pcpu scratch area -Content-Length: 2794 -Lines: 90 - -[ Upstream commit 47b1c03c3c1a119435480a1e73f27197dc59131d ] - -After next patch simple kfree() is not enough anymore, so add -a helper for it. - -Reviewed-by: Stefano Brivio <sbrivio@redhat.com> -Signed-off-by: Florian Westphal <fw@strlen.de> -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Stable-dep-of: 5a8cdf6fd860 ("netfilter: nft_set_pipapo: remove scratch_aligned pointer") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nft_set_pipapo.c | 28 +++++++++++++++++++++++----- - 1 file changed, 23 insertions(+), 5 deletions(-) - -diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c -index 535df7a95374..dd6d81ddcff3 100644 ---- a/net/netfilter/nft_set_pipapo.c -+++ b/net/netfilter/nft_set_pipapo.c -@@ -1110,6 +1110,24 @@ static void pipapo_map(struct nft_pipapo_match *m, - f->mt[map[i].to + j].e = e; - } - -+/** -+ * pipapo_free_scratch() - Free per-CPU map at original (not aligned) address -+ * @m: Matching data -+ * @cpu: CPU number -+ */ -+static void pipapo_free_scratch(const struct nft_pipapo_match *m, unsigned int cpu) -+{ -+ struct nft_pipapo_scratch *s; -+ void *mem; -+ -+ s = *per_cpu_ptr(m->scratch, cpu); -+ if (!s) -+ return; -+ -+ mem = s; -+ kfree(mem); -+} -+ - /** - * pipapo_realloc_scratch() - Reallocate scratch maps for partial match results - * @clone: Copy of matching data with pending insertions and deletions -@@ -1142,7 +1160,7 @@ static int pipapo_realloc_scratch(struct nft_pipapo_match *clone, - return -ENOMEM; - } - -- kfree(*per_cpu_ptr(clone->scratch, i)); -+ pipapo_free_scratch(clone, i); - - *per_cpu_ptr(clone->scratch, i) = scratch; - -@@ -1369,7 +1387,7 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old) - } - out_scratch_realloc: - for_each_possible_cpu(i) -- kfree(*per_cpu_ptr(new->scratch, i)); -+ pipapo_free_scratch(new, i); - #ifdef NFT_PIPAPO_ALIGN - free_percpu(new->scratch_aligned); - #endif -@@ -1653,7 +1671,7 @@ static void pipapo_free_match(struct nft_pipapo_match *m) - int i; - - for_each_possible_cpu(i) -- kfree(*per_cpu_ptr(m->scratch, i)); -+ pipapo_free_scratch(m, i); - - #ifdef NFT_PIPAPO_ALIGN - free_percpu(m->scratch_aligned); -@@ -2253,7 +2271,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx, - free_percpu(m->scratch_aligned); - #endif - for_each_possible_cpu(cpu) -- kfree(*per_cpu_ptr(m->scratch, cpu)); -+ pipapo_free_scratch(m, cpu); - free_percpu(m->scratch); - pipapo_free_fields(m); - kfree(m); -@@ -2270,7 +2288,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx, - free_percpu(priv->clone->scratch_aligned); - #endif - for_each_possible_cpu(cpu) -- kfree(*per_cpu_ptr(priv->clone->scratch, cpu)); -+ pipapo_free_scratch(priv->clone, cpu); - free_percpu(priv->clone->scratch); - - pipapo_free_fields(priv->clone); --- -2.43.2 - -From f125d00e61baeb1831e9c35f4120ac7ef9ba1b56 Mon Sep 17 00:00:00 2001 -From: Florian Westphal <fw@strlen.de> -Date: Thu, 8 Feb 2024 10:31:29 +0100 -Subject: [PATCH 1443/1501] netfilter: nft_set_pipapo: remove scratch_aligned - pointer -Content-Length: 6364 -Lines: 194 - -[ Upstream commit 5a8cdf6fd860ac5e6d08d72edbcecee049a7fec4 ] - -use ->scratch for both avx2 and the generic implementation. - -After previous change the scratch->map member is always aligned properly -for AVX2, so we can just use scratch->map in AVX2 too. - -The alignoff delta is stored in the scratchpad so we can reconstruct -the correct address to free the area again. - -Fixes: 7400b063969b ("nft_set_pipapo: Introduce AVX2-based lookup implementation") -Reviewed-by: Stefano Brivio <sbrivio@redhat.com> -Signed-off-by: Florian Westphal <fw@strlen.de> -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/netfilter/nft_set_pipapo.c | 41 +++++------------------------ - net/netfilter/nft_set_pipapo.h | 6 ++--- - net/netfilter/nft_set_pipapo_avx2.c | 2 +- - 3 files changed, 10 insertions(+), 39 deletions(-) - -diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c -index dd6d81ddcff3..3089c4ca8fff 100644 ---- a/net/netfilter/nft_set_pipapo.c -+++ b/net/netfilter/nft_set_pipapo.c -@@ -1125,6 +1125,7 @@ static void pipapo_free_scratch(const struct nft_pipapo_match *m, unsigned int c - return; - - mem = s; -+ mem -= s->align_off; - kfree(mem); - } - -@@ -1144,6 +1145,7 @@ static int pipapo_realloc_scratch(struct nft_pipapo_match *clone, - struct nft_pipapo_scratch *scratch; - #ifdef NFT_PIPAPO_ALIGN - void *scratch_aligned; -+ u32 align_off; - #endif - scratch = kzalloc_node(struct_size(scratch, map, - bsize_max * 2) + -@@ -1162,8 +1164,6 @@ static int pipapo_realloc_scratch(struct nft_pipapo_match *clone, - - pipapo_free_scratch(clone, i); - -- *per_cpu_ptr(clone->scratch, i) = scratch; -- - #ifdef NFT_PIPAPO_ALIGN - /* Align &scratch->map (not the struct itself): the extra - * %NFT_PIPAPO_ALIGN_HEADROOM bytes passed to kzalloc_node() -@@ -1175,8 +1175,12 @@ static int pipapo_realloc_scratch(struct nft_pipapo_match *clone, - - scratch_aligned = NFT_PIPAPO_LT_ALIGN(&scratch->map); - scratch_aligned -= offsetof(struct nft_pipapo_scratch, map); -- *per_cpu_ptr(clone->scratch_aligned, i) = scratch_aligned; -+ align_off = scratch_aligned - (void *)scratch; -+ -+ scratch = scratch_aligned; -+ scratch->align_off = align_off; - #endif -+ *per_cpu_ptr(clone->scratch, i) = scratch; - } - - return 0; -@@ -1331,11 +1335,6 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old) - if (!new->scratch) - goto out_scratch; - --#ifdef NFT_PIPAPO_ALIGN -- new->scratch_aligned = alloc_percpu(*new->scratch_aligned); -- if (!new->scratch_aligned) -- goto out_scratch; --#endif - for_each_possible_cpu(i) - *per_cpu_ptr(new->scratch, i) = NULL; - -@@ -1388,9 +1387,6 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old) - out_scratch_realloc: - for_each_possible_cpu(i) - pipapo_free_scratch(new, i); --#ifdef NFT_PIPAPO_ALIGN -- free_percpu(new->scratch_aligned); --#endif - out_scratch: - free_percpu(new->scratch); - kfree(new); -@@ -1673,11 +1669,7 @@ static void pipapo_free_match(struct nft_pipapo_match *m) - for_each_possible_cpu(i) - pipapo_free_scratch(m, i); - --#ifdef NFT_PIPAPO_ALIGN -- free_percpu(m->scratch_aligned); --#endif - free_percpu(m->scratch); -- - pipapo_free_fields(m); - - kfree(m); -@@ -2171,16 +2163,6 @@ static int nft_pipapo_init(const struct nft_set *set, - for_each_possible_cpu(i) - *per_cpu_ptr(m->scratch, i) = NULL; - --#ifdef NFT_PIPAPO_ALIGN -- m->scratch_aligned = alloc_percpu(struct nft_pipapo_scratch *); -- if (!m->scratch_aligned) { -- err = -ENOMEM; -- goto out_free; -- } -- for_each_possible_cpu(i) -- *per_cpu_ptr(m->scratch_aligned, i) = NULL; --#endif -- - rcu_head_init(&m->rcu); - - nft_pipapo_for_each_field(f, i, m) { -@@ -2211,9 +2193,6 @@ static int nft_pipapo_init(const struct nft_set *set, - return 0; - - out_free: --#ifdef NFT_PIPAPO_ALIGN -- free_percpu(m->scratch_aligned); --#endif - free_percpu(m->scratch); - out_scratch: - kfree(m); -@@ -2267,9 +2246,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx, - - nft_set_pipapo_match_destroy(ctx, set, m); - --#ifdef NFT_PIPAPO_ALIGN -- free_percpu(m->scratch_aligned); --#endif - for_each_possible_cpu(cpu) - pipapo_free_scratch(m, cpu); - free_percpu(m->scratch); -@@ -2284,9 +2260,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx, - if (priv->dirty) - nft_set_pipapo_match_destroy(ctx, set, m); - --#ifdef NFT_PIPAPO_ALIGN -- free_percpu(priv->clone->scratch_aligned); --#endif - for_each_possible_cpu(cpu) - pipapo_free_scratch(priv->clone, cpu); - free_percpu(priv->clone->scratch); -diff --git a/net/netfilter/nft_set_pipapo.h b/net/netfilter/nft_set_pipapo.h -index d3bc1551694f..f59a0cd81105 100644 ---- a/net/netfilter/nft_set_pipapo.h -+++ b/net/netfilter/nft_set_pipapo.h -@@ -133,10 +133,12 @@ struct nft_pipapo_field { - /** - * struct nft_pipapo_scratch - percpu data used for lookup and matching - * @map_index: Current working bitmap index, toggled between field matches -+ * @align_off: Offset to get the originally allocated address - * @map: store partial matching results during lookup - */ - struct nft_pipapo_scratch { - u8 map_index; -+ u32 align_off; - unsigned long map[]; - }; - -@@ -144,16 +146,12 @@ struct nft_pipapo_scratch { - * struct nft_pipapo_match - Data used for lookup and matching - * @field_count Amount of fields in set - * @scratch: Preallocated per-CPU maps for partial matching results -- * @scratch_aligned: Version of @scratch aligned to NFT_PIPAPO_ALIGN bytes - * @bsize_max: Maximum lookup table bucket size of all fields, in longs - * @rcu Matching data is swapped on commits - * @f: Fields, with lookup and mapping tables - */ - struct nft_pipapo_match { - int field_count; --#ifdef NFT_PIPAPO_ALIGN -- struct nft_pipapo_scratch * __percpu *scratch_aligned; --#endif - struct nft_pipapo_scratch * __percpu *scratch; - size_t bsize_max; - struct rcu_head rcu; -diff --git a/net/netfilter/nft_set_pipapo_avx2.c b/net/netfilter/nft_set_pipapo_avx2.c -index 78213c73af2e..90e275bb3e5d 100644 ---- a/net/netfilter/nft_set_pipapo_avx2.c -+++ b/net/netfilter/nft_set_pipapo_avx2.c -@@ -1139,7 +1139,7 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set, - */ - kernel_fpu_begin_mask(0); - -- scratch = *raw_cpu_ptr(m->scratch_aligned); -+ scratch = *raw_cpu_ptr(m->scratch); - if (unlikely(!scratch)) { - kernel_fpu_end(); - return false; --- -2.43.2 - -From 686820fe141ea0220fc6fdfc7e5694f915cf64b2 Mon Sep 17 00:00:00 2001 -From: Dan Carpenter <dan.carpenter@linaro.org> -Date: Tue, 17 Oct 2023 17:04:39 +0300 -Subject: [PATCH 1444/1501] fs/ntfs3: Fix an NULL dereference bug -Content-Length: 1214 -Lines: 32 - -[ Upstream commit b2dd7b953c25ffd5912dda17e980e7168bebcf6c ] - -The issue here is when this is called from ntfs_load_attr_list(). The -"size" comes from le32_to_cpu(attr->res.data_size) so it can't overflow -on a 64bit systems but on 32bit systems the "+ 1023" can overflow and -the result is zero. This means that the kmalloc will succeed by -returning the ZERO_SIZE_PTR and then the memcpy() will crash with an -Oops on the next line. - -Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations") -Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> -Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/ntfs3/ntfs_fs.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h -index f6706143d14b..a46d30b84bf3 100644 ---- a/fs/ntfs3/ntfs_fs.h -+++ b/fs/ntfs3/ntfs_fs.h -@@ -473,7 +473,7 @@ bool al_delete_le(struct ntfs_inode *ni, enum ATTR_TYPE type, CLST vcn, - int al_update(struct ntfs_inode *ni, int sync); - static inline size_t al_aligned(size_t size) - { -- return (size + 1023) & ~(size_t)1023; -+ return size_add(size, 1023) & ~(size_t)1023; - } - - /* Globals from bitfunc.c */ --- -2.43.2 - -From 2b89c3f9d3d069924dc1bedd400cd6e93435980c Mon Sep 17 00:00:00 2001 -From: Alexandre Ghiti <alexghiti@rivosinc.com> -Date: Tue, 12 Dec 2023 22:34:56 +0100 -Subject: [PATCH 1445/1501] mm: Introduce flush_cache_vmap_early() -Content-Length: 12569 -Lines: 280 - -[ Upstream commit 7a92fc8b4d20680e4c20289a670d8fca2d1f2c1b ] - -The pcpu setup when using the page allocator sets up a new vmalloc -mapping very early in the boot process, so early that it cannot use the -flush_cache_vmap() function which may depend on structures not yet -initialized (for example in riscv, we currently send an IPI to flush -other cpus TLB). - -But on some architectures, we must call flush_cache_vmap(): for example, -in riscv, some uarchs can cache invalid TLB entries so we need to flush -the new established mapping to avoid taking an exception. - -So fix this by introducing a new function flush_cache_vmap_early() which -is called right after setting the new page table entry and before -accessing this new mapping. This new function implements a local flush -tlb on riscv and is no-op for other architectures (same as today). - -Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com> -Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> -Signed-off-by: Dennis Zhou <dennis@kernel.org> -Stable-dep-of: d9807d60c145 ("riscv: mm: execute local TLB flush after populating vmemmap") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/arc/include/asm/cacheflush.h | 1 + - arch/arm/include/asm/cacheflush.h | 2 ++ - arch/csky/abiv1/inc/abi/cacheflush.h | 1 + - arch/csky/abiv2/inc/abi/cacheflush.h | 1 + - arch/m68k/include/asm/cacheflush_mm.h | 1 + - arch/mips/include/asm/cacheflush.h | 2 ++ - arch/nios2/include/asm/cacheflush.h | 1 + - arch/parisc/include/asm/cacheflush.h | 1 + - arch/riscv/include/asm/cacheflush.h | 3 ++- - arch/riscv/include/asm/tlbflush.h | 1 + - arch/riscv/mm/tlbflush.c | 5 +++++ - arch/sh/include/asm/cacheflush.h | 1 + - arch/sparc/include/asm/cacheflush_32.h | 1 + - arch/sparc/include/asm/cacheflush_64.h | 1 + - arch/xtensa/include/asm/cacheflush.h | 6 ++++-- - include/asm-generic/cacheflush.h | 6 ++++++ - mm/percpu.c | 8 +------- - 17 files changed, 32 insertions(+), 10 deletions(-) - -diff --git a/arch/arc/include/asm/cacheflush.h b/arch/arc/include/asm/cacheflush.h -index 563af3e75f01..329c94cd45d8 100644 ---- a/arch/arc/include/asm/cacheflush.h -+++ b/arch/arc/include/asm/cacheflush.h -@@ -40,6 +40,7 @@ void dma_cache_wback(phys_addr_t start, unsigned long sz); - - /* TBD: optimize this */ - #define flush_cache_vmap(start, end) flush_cache_all() -+#define flush_cache_vmap_early(start, end) do { } while (0) - #define flush_cache_vunmap(start, end) flush_cache_all() - - #define flush_cache_dup_mm(mm) /* called on fork (VIVT only) */ -diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h -index f6181f69577f..1075534b0a2e 100644 ---- a/arch/arm/include/asm/cacheflush.h -+++ b/arch/arm/include/asm/cacheflush.h -@@ -340,6 +340,8 @@ static inline void flush_cache_vmap(unsigned long start, unsigned long end) - dsb(ishst); - } - -+#define flush_cache_vmap_early(start, end) do { } while (0) -+ - static inline void flush_cache_vunmap(unsigned long start, unsigned long end) - { - if (!cache_is_vipt_nonaliasing()) -diff --git a/arch/csky/abiv1/inc/abi/cacheflush.h b/arch/csky/abiv1/inc/abi/cacheflush.h -index 908d8b0bc4fd..d011a81575d2 100644 ---- a/arch/csky/abiv1/inc/abi/cacheflush.h -+++ b/arch/csky/abiv1/inc/abi/cacheflush.h -@@ -43,6 +43,7 @@ static inline void flush_anon_page(struct vm_area_struct *vma, - */ - extern void flush_cache_range(struct vm_area_struct *vma, unsigned long start, unsigned long end); - #define flush_cache_vmap(start, end) cache_wbinv_all() -+#define flush_cache_vmap_early(start, end) do { } while (0) - #define flush_cache_vunmap(start, end) cache_wbinv_all() - - #define flush_icache_range(start, end) cache_wbinv_range(start, end) -diff --git a/arch/csky/abiv2/inc/abi/cacheflush.h b/arch/csky/abiv2/inc/abi/cacheflush.h -index 40be16907267..6513ac5d2578 100644 ---- a/arch/csky/abiv2/inc/abi/cacheflush.h -+++ b/arch/csky/abiv2/inc/abi/cacheflush.h -@@ -41,6 +41,7 @@ void flush_icache_mm_range(struct mm_struct *mm, - void flush_icache_deferred(struct mm_struct *mm); - - #define flush_cache_vmap(start, end) do { } while (0) -+#define flush_cache_vmap_early(start, end) do { } while (0) - #define flush_cache_vunmap(start, end) do { } while (0) - - #define copy_to_user_page(vma, page, vaddr, dst, src, len) \ -diff --git a/arch/m68k/include/asm/cacheflush_mm.h b/arch/m68k/include/asm/cacheflush_mm.h -index ed12358c4783..9a71b0148461 100644 ---- a/arch/m68k/include/asm/cacheflush_mm.h -+++ b/arch/m68k/include/asm/cacheflush_mm.h -@@ -191,6 +191,7 @@ extern void cache_push_v(unsigned long vaddr, int len); - #define flush_cache_all() __flush_cache_all() - - #define flush_cache_vmap(start, end) flush_cache_all() -+#define flush_cache_vmap_early(start, end) do { } while (0) - #define flush_cache_vunmap(start, end) flush_cache_all() - - static inline void flush_cache_mm(struct mm_struct *mm) -diff --git a/arch/mips/include/asm/cacheflush.h b/arch/mips/include/asm/cacheflush.h -index f36c2519ed97..1f14132b3fc9 100644 ---- a/arch/mips/include/asm/cacheflush.h -+++ b/arch/mips/include/asm/cacheflush.h -@@ -97,6 +97,8 @@ static inline void flush_cache_vmap(unsigned long start, unsigned long end) - __flush_cache_vmap(); - } - -+#define flush_cache_vmap_early(start, end) do { } while (0) -+ - extern void (*__flush_cache_vunmap)(void); - - static inline void flush_cache_vunmap(unsigned long start, unsigned long end) -diff --git a/arch/nios2/include/asm/cacheflush.h b/arch/nios2/include/asm/cacheflush.h -index 348cea097792..81484a776b33 100644 ---- a/arch/nios2/include/asm/cacheflush.h -+++ b/arch/nios2/include/asm/cacheflush.h -@@ -38,6 +38,7 @@ void flush_icache_pages(struct vm_area_struct *vma, struct page *page, - #define flush_icache_pages flush_icache_pages - - #define flush_cache_vmap(start, end) flush_dcache_range(start, end) -+#define flush_cache_vmap_early(start, end) do { } while (0) - #define flush_cache_vunmap(start, end) flush_dcache_range(start, end) - - extern void copy_to_user_page(struct vm_area_struct *vma, struct page *page, -diff --git a/arch/parisc/include/asm/cacheflush.h b/arch/parisc/include/asm/cacheflush.h -index b4006f2a9705..ba4c05bc24d6 100644 ---- a/arch/parisc/include/asm/cacheflush.h -+++ b/arch/parisc/include/asm/cacheflush.h -@@ -41,6 +41,7 @@ void flush_kernel_vmap_range(void *vaddr, int size); - void invalidate_kernel_vmap_range(void *vaddr, int size); - - #define flush_cache_vmap(start, end) flush_cache_all() -+#define flush_cache_vmap_early(start, end) do { } while (0) - #define flush_cache_vunmap(start, end) flush_cache_all() - - void flush_dcache_folio(struct folio *folio); -diff --git a/arch/riscv/include/asm/cacheflush.h b/arch/riscv/include/asm/cacheflush.h -index 3cb53c4df27c..a129dac4521d 100644 ---- a/arch/riscv/include/asm/cacheflush.h -+++ b/arch/riscv/include/asm/cacheflush.h -@@ -37,7 +37,8 @@ static inline void flush_dcache_page(struct page *page) - flush_icache_mm(vma->vm_mm, 0) - - #ifdef CONFIG_64BIT --#define flush_cache_vmap(start, end) flush_tlb_kernel_range(start, end) -+#define flush_cache_vmap(start, end) flush_tlb_kernel_range(start, end) -+#define flush_cache_vmap_early(start, end) local_flush_tlb_kernel_range(start, end) - #endif - - #ifndef CONFIG_SMP -diff --git a/arch/riscv/include/asm/tlbflush.h b/arch/riscv/include/asm/tlbflush.h -index 8f3418c5f172..a60416bbe190 100644 ---- a/arch/riscv/include/asm/tlbflush.h -+++ b/arch/riscv/include/asm/tlbflush.h -@@ -41,6 +41,7 @@ void flush_tlb_page(struct vm_area_struct *vma, unsigned long addr); - void flush_tlb_range(struct vm_area_struct *vma, unsigned long start, - unsigned long end); - void flush_tlb_kernel_range(unsigned long start, unsigned long end); -+void local_flush_tlb_kernel_range(unsigned long start, unsigned long end); - #ifdef CONFIG_TRANSPARENT_HUGEPAGE - #define __HAVE_ARCH_FLUSH_PMD_TLB_RANGE - void flush_pmd_tlb_range(struct vm_area_struct *vma, unsigned long start, -diff --git a/arch/riscv/mm/tlbflush.c b/arch/riscv/mm/tlbflush.c -index e6659d7368b3..8aadc5f71c93 100644 ---- a/arch/riscv/mm/tlbflush.c -+++ b/arch/riscv/mm/tlbflush.c -@@ -66,6 +66,11 @@ static inline void local_flush_tlb_range_asid(unsigned long start, - local_flush_tlb_range_threshold_asid(start, size, stride, asid); - } - -+void local_flush_tlb_kernel_range(unsigned long start, unsigned long end) -+{ -+ local_flush_tlb_range_asid(start, end, PAGE_SIZE, FLUSH_TLB_NO_ASID); -+} -+ - static void __ipi_flush_tlb_all(void *info) - { - local_flush_tlb_all(); -diff --git a/arch/sh/include/asm/cacheflush.h b/arch/sh/include/asm/cacheflush.h -index 878b6b551bd2..51112f54552b 100644 ---- a/arch/sh/include/asm/cacheflush.h -+++ b/arch/sh/include/asm/cacheflush.h -@@ -90,6 +90,7 @@ extern void copy_from_user_page(struct vm_area_struct *vma, - unsigned long len); - - #define flush_cache_vmap(start, end) local_flush_cache_all(NULL) -+#define flush_cache_vmap_early(start, end) do { } while (0) - #define flush_cache_vunmap(start, end) local_flush_cache_all(NULL) - - #define flush_dcache_mmap_lock(mapping) do { } while (0) -diff --git a/arch/sparc/include/asm/cacheflush_32.h b/arch/sparc/include/asm/cacheflush_32.h -index f3b7270bf71b..9fee0ccfccb8 100644 ---- a/arch/sparc/include/asm/cacheflush_32.h -+++ b/arch/sparc/include/asm/cacheflush_32.h -@@ -48,6 +48,7 @@ static inline void flush_dcache_page(struct page *page) - #define flush_dcache_mmap_unlock(mapping) do { } while (0) - - #define flush_cache_vmap(start, end) flush_cache_all() -+#define flush_cache_vmap_early(start, end) do { } while (0) - #define flush_cache_vunmap(start, end) flush_cache_all() - - /* When a context switch happens we must flush all user windows so that -diff --git a/arch/sparc/include/asm/cacheflush_64.h b/arch/sparc/include/asm/cacheflush_64.h -index 0e879004efff..2b1261b77ecd 100644 ---- a/arch/sparc/include/asm/cacheflush_64.h -+++ b/arch/sparc/include/asm/cacheflush_64.h -@@ -75,6 +75,7 @@ void flush_ptrace_access(struct vm_area_struct *, struct page *, - #define flush_dcache_mmap_unlock(mapping) do { } while (0) - - #define flush_cache_vmap(start, end) do { } while (0) -+#define flush_cache_vmap_early(start, end) do { } while (0) - #define flush_cache_vunmap(start, end) do { } while (0) - - #endif /* !__ASSEMBLY__ */ -diff --git a/arch/xtensa/include/asm/cacheflush.h b/arch/xtensa/include/asm/cacheflush.h -index 785a00ce83c1..38bcecb0e457 100644 ---- a/arch/xtensa/include/asm/cacheflush.h -+++ b/arch/xtensa/include/asm/cacheflush.h -@@ -116,8 +116,9 @@ void flush_cache_page(struct vm_area_struct*, - #define flush_cache_mm(mm) flush_cache_all() - #define flush_cache_dup_mm(mm) flush_cache_mm(mm) - --#define flush_cache_vmap(start,end) flush_cache_all() --#define flush_cache_vunmap(start,end) flush_cache_all() -+#define flush_cache_vmap(start,end) flush_cache_all() -+#define flush_cache_vmap_early(start,end) do { } while (0) -+#define flush_cache_vunmap(start,end) flush_cache_all() - - void flush_dcache_folio(struct folio *folio); - #define flush_dcache_folio flush_dcache_folio -@@ -140,6 +141,7 @@ void local_flush_cache_page(struct vm_area_struct *vma, - #define flush_cache_dup_mm(mm) do { } while (0) - - #define flush_cache_vmap(start,end) do { } while (0) -+#define flush_cache_vmap_early(start,end) do { } while (0) - #define flush_cache_vunmap(start,end) do { } while (0) - - #define ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE 0 -diff --git a/include/asm-generic/cacheflush.h b/include/asm-generic/cacheflush.h -index 84ec53ccc450..7ee8a179d103 100644 ---- a/include/asm-generic/cacheflush.h -+++ b/include/asm-generic/cacheflush.h -@@ -91,6 +91,12 @@ static inline void flush_cache_vmap(unsigned long start, unsigned long end) - } - #endif - -+#ifndef flush_cache_vmap_early -+static inline void flush_cache_vmap_early(unsigned long start, unsigned long end) -+{ -+} -+#endif -+ - #ifndef flush_cache_vunmap - static inline void flush_cache_vunmap(unsigned long start, unsigned long end) - { -diff --git a/mm/percpu.c b/mm/percpu.c -index 7b97d31df767..4e11fc1e6def 100644 ---- a/mm/percpu.c -+++ b/mm/percpu.c -@@ -3333,13 +3333,7 @@ int __init pcpu_page_first_chunk(size_t reserved_size, pcpu_fc_cpu_to_node_fn_t - if (rc < 0) - panic("failed to map percpu area, err=%d\n", rc); - -- /* -- * FIXME: Archs with virtual cache should flush local -- * cache for the linear mapping here - something -- * equivalent to flush_cache_vmap() on the local cpu. -- * flush_cache_vmap() can't be used as most supporting -- * data structures are not set up yet. -- */ -+ flush_cache_vmap_early(unit_addr, unit_addr + ai->unit_size); - - /* copy static data */ - memcpy((void *)unit_addr, __per_cpu_load, ai->static_size); --- -2.43.2 - -From 4a67cb98e3ee81789a61e62f0dcb257a1e7056f2 Mon Sep 17 00:00:00 2001 -From: Vincent Chen <vincent.chen@sifive.com> -Date: Wed, 17 Jan 2024 22:03:33 +0800 -Subject: [PATCH 1446/1501] riscv: mm: execute local TLB flush after populating - vmemmap -Content-Length: 3167 -Lines: 72 - -[ Upstream commit d9807d60c145836043ffa602328ea1d66dc458b1 ] - -The spare_init() calls memmap_populate() many times to create VA to PA -mapping for the VMEMMAP area, where all "struct page" are located once -CONFIG_SPARSEMEM_VMEMMAP is defined. These "struct page" are later -initialized in the zone_sizes_init() function. However, during this -process, no sfence.vma instruction is executed for this VMEMMAP area. -This omission may cause the hart to fail to perform page table walk -because some data related to the address translation is invisible to the -hart. To solve this issue, the local_flush_tlb_kernel_range() is called -right after the sparse_init() to execute a sfence.vma instruction for this -VMEMMAP area, ensuring that all data related to the address translation -is visible to the hart. - -Fixes: d95f1a542c3d ("RISC-V: Implement sparsemem") -Signed-off-by: Vincent Chen <vincent.chen@sifive.com> -Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com> -Link: https://lore.kernel.org/r/20240117140333.2479667-1-vincent.chen@sifive.com -Fixes: 7a92fc8b4d20 ("mm: Introduce flush_cache_vmap_early()") -Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/riscv/include/asm/tlbflush.h | 1 + - arch/riscv/mm/init.c | 4 ++++ - arch/riscv/mm/tlbflush.c | 3 ++- - 3 files changed, 7 insertions(+), 1 deletion(-) - -diff --git a/arch/riscv/include/asm/tlbflush.h b/arch/riscv/include/asm/tlbflush.h -index a60416bbe190..51664ae4852e 100644 ---- a/arch/riscv/include/asm/tlbflush.h -+++ b/arch/riscv/include/asm/tlbflush.h -@@ -67,6 +67,7 @@ static inline void flush_tlb_kernel_range(unsigned long start, - - #define flush_tlb_mm(mm) flush_tlb_all() - #define flush_tlb_mm_range(mm, start, end, page_size) flush_tlb_all() -+#define local_flush_tlb_kernel_range(start, end) flush_tlb_all() - #endif /* !CONFIG_SMP || !CONFIG_MMU */ - - #endif /* _ASM_RISCV_TLBFLUSH_H */ -diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c -index ad77ed410d4d..ee224fe18d18 100644 ---- a/arch/riscv/mm/init.c -+++ b/arch/riscv/mm/init.c -@@ -1385,6 +1385,10 @@ void __init misc_mem_init(void) - early_memtest(min_low_pfn << PAGE_SHIFT, max_low_pfn << PAGE_SHIFT); - arch_numa_init(); - sparse_init(); -+#ifdef CONFIG_SPARSEMEM_VMEMMAP -+ /* The entire VMEMMAP region has been populated. Flush TLB for this region */ -+ local_flush_tlb_kernel_range(VMEMMAP_START, VMEMMAP_END); -+#endif - zone_sizes_init(); - arch_reserve_crashkernel(); - memblock_dump_all(); -diff --git a/arch/riscv/mm/tlbflush.c b/arch/riscv/mm/tlbflush.c -index 8aadc5f71c93..1f90721d22e9 100644 ---- a/arch/riscv/mm/tlbflush.c -+++ b/arch/riscv/mm/tlbflush.c -@@ -66,9 +66,10 @@ static inline void local_flush_tlb_range_asid(unsigned long start, - local_flush_tlb_range_threshold_asid(start, size, stride, asid); - } - -+/* Flush a range of kernel pages without broadcasting */ - void local_flush_tlb_kernel_range(unsigned long start, unsigned long end) - { -- local_flush_tlb_range_asid(start, end, PAGE_SIZE, FLUSH_TLB_NO_ASID); -+ local_flush_tlb_range_asid(start, end - start, PAGE_SIZE, FLUSH_TLB_NO_ASID); - } - - static void __ipi_flush_tlb_all(void *info) --- -2.43.2 - -From ee0948ba7820205524c7fff39249b55761c48012 Mon Sep 17 00:00:00 2001 -From: Alexandre Ghiti <alexghiti@rivosinc.com> -Date: Wed, 17 Jan 2024 20:57:40 +0100 -Subject: [PATCH 1447/1501] riscv: Fix set_huge_pte_at() for NAPOT mapping -Content-Length: 2579 -Lines: 82 - -[ Upstream commit 1458eb2c9d88ad4b35eb6d6a4aa1d43d8fbf7f62 ] - -As stated by the privileged specification, we must clear a NAPOT -mapping and emit a sfence.vma before setting a new translation. - -Fixes: 82a1a1f3bfb6 ("riscv: mm: support Svnapot in hugetlb page") -Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com> -Link: https://lore.kernel.org/r/20240117195741.1926459-2-alexghiti@rivosinc.com -Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/riscv/mm/hugetlbpage.c | 42 +++++++++++++++++++++++++++++++++++-- - 1 file changed, 40 insertions(+), 2 deletions(-) - -diff --git a/arch/riscv/mm/hugetlbpage.c b/arch/riscv/mm/hugetlbpage.c -index b52f0210481f..24c0179565d8 100644 ---- a/arch/riscv/mm/hugetlbpage.c -+++ b/arch/riscv/mm/hugetlbpage.c -@@ -177,13 +177,36 @@ pte_t arch_make_huge_pte(pte_t entry, unsigned int shift, vm_flags_t flags) - return entry; - } - -+static void clear_flush(struct mm_struct *mm, -+ unsigned long addr, -+ pte_t *ptep, -+ unsigned long pgsize, -+ unsigned long ncontig) -+{ -+ struct vm_area_struct vma = TLB_FLUSH_VMA(mm, 0); -+ unsigned long i, saddr = addr; -+ -+ for (i = 0; i < ncontig; i++, addr += pgsize, ptep++) -+ ptep_get_and_clear(mm, addr, ptep); -+ -+ flush_tlb_range(&vma, saddr, addr); -+} -+ -+/* -+ * When dealing with NAPOT mappings, the privileged specification indicates that -+ * "if an update needs to be made, the OS generally should first mark all of the -+ * PTEs invalid, then issue SFENCE.VMA instruction(s) covering all 4 KiB regions -+ * within the range, [...] then update the PTE(s), as described in Section -+ * 4.2.1.". That's the equivalent of the Break-Before-Make approach used by -+ * arm64. -+ */ - void set_huge_pte_at(struct mm_struct *mm, - unsigned long addr, - pte_t *ptep, - pte_t pte, - unsigned long sz) - { -- unsigned long hugepage_shift; -+ unsigned long hugepage_shift, pgsize; - int i, pte_num; - - if (sz >= PGDIR_SIZE) -@@ -198,7 +221,22 @@ void set_huge_pte_at(struct mm_struct *mm, - hugepage_shift = PAGE_SHIFT; - - pte_num = sz >> hugepage_shift; -- for (i = 0; i < pte_num; i++, ptep++, addr += (1 << hugepage_shift)) -+ pgsize = 1 << hugepage_shift; -+ -+ if (!pte_present(pte)) { -+ for (i = 0; i < pte_num; i++, ptep++, addr += pgsize) -+ set_ptes(mm, addr, ptep, pte, 1); -+ return; -+ } -+ -+ if (!pte_napot(pte)) { -+ set_ptes(mm, addr, ptep, pte, 1); -+ return; -+ } -+ -+ clear_flush(mm, addr, ptep, pgsize, pte_num); -+ -+ for (i = 0; i < pte_num; i++, ptep++, addr += pgsize) - set_pte_at(mm, addr, ptep, pte); - } - --- -2.43.2 - -From 0424da2f47adee12f1b78ed75b3917284b80d37e Mon Sep 17 00:00:00 2001 -From: Alexandre Ghiti <alexghiti@rivosinc.com> -Date: Wed, 17 Jan 2024 20:57:41 +0100 -Subject: [PATCH 1448/1501] riscv: Fix hugetlb_mask_last_page() when NAPOT is - enabled -Content-Length: 1376 -Lines: 47 - -[ Upstream commit a179a4bfb694f80f2709a1d0398469e787acb974 ] - -When NAPOT is enabled, a new hugepage size is available and then we need -to make hugetlb_mask_last_page() aware of that. - -Fixes: 82a1a1f3bfb6 ("riscv: mm: support Svnapot in hugetlb page") -Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com> -Link: https://lore.kernel.org/r/20240117195741.1926459-3-alexghiti@rivosinc.com -Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/riscv/mm/hugetlbpage.c | 20 ++++++++++++++++++++ - 1 file changed, 20 insertions(+) - -diff --git a/arch/riscv/mm/hugetlbpage.c b/arch/riscv/mm/hugetlbpage.c -index 24c0179565d8..87af75ee7186 100644 ---- a/arch/riscv/mm/hugetlbpage.c -+++ b/arch/riscv/mm/hugetlbpage.c -@@ -125,6 +125,26 @@ pte_t *huge_pte_offset(struct mm_struct *mm, - return pte; - } - -+unsigned long hugetlb_mask_last_page(struct hstate *h) -+{ -+ unsigned long hp_size = huge_page_size(h); -+ -+ switch (hp_size) { -+#ifndef __PAGETABLE_PMD_FOLDED -+ case PUD_SIZE: -+ return P4D_SIZE - PUD_SIZE; -+#endif -+ case PMD_SIZE: -+ return PUD_SIZE - PMD_SIZE; -+ case napot_cont_size(NAPOT_CONT64KB_ORDER): -+ return PMD_SIZE - napot_cont_size(NAPOT_CONT64KB_ORDER); -+ default: -+ break; -+ } -+ -+ return 0UL; -+} -+ - static pte_t get_clear_contig(struct mm_struct *mm, - unsigned long addr, - pte_t *ptep, --- -2.43.2 - -From 412dc6060e2853f6b074f4de625ac76f8e6e9473 Mon Sep 17 00:00:00 2001 -From: Ming Lei <ming.lei@redhat.com> -Date: Sat, 3 Feb 2024 10:45:21 +0800 -Subject: [PATCH 1449/1501] scsi: core: Move scsi_host_busy() out of host lock - if it is for per-command -Content-Length: 2476 -Lines: 60 - -[ Upstream commit 4e6c9011990726f4d175e2cdfebe5b0b8cce4839 ] - -Commit 4373534a9850 ("scsi: core: Move scsi_host_busy() out of host lock -for waking up EH handler") intended to fix a hard lockup issue triggered by -EH. The core idea was to move scsi_host_busy() out of the host lock when -processing individual commands for EH. However, a suggested style change -inadvertently caused scsi_host_busy() to remain under the host lock. Fix -this by calling scsi_host_busy() outside the lock. - -Fixes: 4373534a9850 ("scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler") -Cc: Sathya Prakash Veerichetty <safhya.prakash@broadcom.com> -Cc: Bart Van Assche <bvanassche@acm.org> -Cc: Ewan D. Milne <emilne@redhat.com> -Signed-off-by: Ming Lei <ming.lei@redhat.com> -Link: https://lore.kernel.org/r/20240203024521.2006455-1-ming.lei@redhat.com -Reviewed-by: Bart Van Assche <bvanassche@acm.org> -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/scsi/scsi_error.c | 3 ++- - drivers/scsi/scsi_lib.c | 4 +++- - 2 files changed, 5 insertions(+), 2 deletions(-) - -diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c -index 3328b175a832..43eff1107038 100644 ---- a/drivers/scsi/scsi_error.c -+++ b/drivers/scsi/scsi_error.c -@@ -282,11 +282,12 @@ static void scsi_eh_inc_host_failed(struct rcu_head *head) - { - struct scsi_cmnd *scmd = container_of(head, typeof(*scmd), rcu); - struct Scsi_Host *shost = scmd->device->host; -+ unsigned int busy = scsi_host_busy(shost); - unsigned long flags; - - spin_lock_irqsave(shost->host_lock, flags); - shost->host_failed++; -- scsi_eh_wakeup(shost, scsi_host_busy(shost)); -+ scsi_eh_wakeup(shost, busy); - spin_unlock_irqrestore(shost->host_lock, flags); - } - -diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c -index 1fb80eae9a63..df5ac03d5d6c 100644 ---- a/drivers/scsi/scsi_lib.c -+++ b/drivers/scsi/scsi_lib.c -@@ -278,9 +278,11 @@ static void scsi_dec_host_busy(struct Scsi_Host *shost, struct scsi_cmnd *cmd) - rcu_read_lock(); - __clear_bit(SCMD_STATE_INFLIGHT, &cmd->state); - if (unlikely(scsi_host_in_recovery(shost))) { -+ unsigned int busy = scsi_host_busy(shost); -+ - spin_lock_irqsave(shost->host_lock, flags); - if (shost->host_failed || shost->host_eh_scheduled) -- scsi_eh_wakeup(shost, scsi_host_busy(shost)); -+ scsi_eh_wakeup(shost, busy); - spin_unlock_irqrestore(shost->host_lock, flags); - } - rcu_read_unlock(); --- -2.43.2 - -From d3607acc4fc08acea4b7e76abc2bfbe6b2be064e Mon Sep 17 00:00:00 2001 -From: Alexandre Ghiti <alexghiti@rivosinc.com> -Date: Sun, 28 Jan 2024 13:04:05 +0100 -Subject: [PATCH 1450/1501] riscv: Flush the tlb when a page directory is freed -Content-Length: 1142 -Lines: 30 - -[ Upstream commit 97cf301fa42e8ea6e0a24de97bc0abcdc87d9504 ] - -The riscv privileged specification mandates to flush the TLB whenever a -page directory is modified, so add that to tlb_flush(). - -Fixes: c5e9b2c2ae82 ("riscv: Improve tlb_flush()") -Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com> -Reviewed-by: Charlie Jenkins <charlie@rivosinc.com> -Link: https://lore.kernel.org/r/20240128120405.25876-1-alexghiti@rivosinc.com -Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/riscv/include/asm/tlb.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/riscv/include/asm/tlb.h b/arch/riscv/include/asm/tlb.h -index 1eb5682b2af6..50b63b5c15bd 100644 ---- a/arch/riscv/include/asm/tlb.h -+++ b/arch/riscv/include/asm/tlb.h -@@ -16,7 +16,7 @@ static void tlb_flush(struct mmu_gather *tlb); - static inline void tlb_flush(struct mmu_gather *tlb) - { - #ifdef CONFIG_MMU -- if (tlb->fullmm || tlb->need_flush_all) -+ if (tlb->fullmm || tlb->need_flush_all || tlb->freed_tables) - flush_tlb_mm(tlb->mm); - else - flush_tlb_mm_range(tlb->mm, tlb->start, tlb->end, --- -2.43.2 - -From e6140f28c80b6fe655523810494c5f4213e15953 Mon Sep 17 00:00:00 2001 -From: Xiubo Li <xiubli@redhat.com> -Date: Thu, 14 Dec 2023 09:21:15 +0800 -Subject: [PATCH 1451/1501] libceph: rename read_sparse_msg_*() to - read_partial_sparse_msg_*() -Content-Length: 2339 -Lines: 60 - -[ Upstream commit ee97302fbc0c98a25732d736fc73aaf4d62c4128 ] - -These functions are supposed to behave like other read_partial_*() -handlers: the contract with messenger v1 is that the handler bails if -the area of the message it's responsible for is already processed. -This comes up when handling short reads from the socket. - -[ idryomov: changelog ] - -Signed-off-by: Xiubo Li <xiubli@redhat.com> -Acked-by: Jeff Layton <jlayton@kernel.org> -Signed-off-by: Ilya Dryomov <idryomov@gmail.com> -Stable-dep-of: 8e46a2d068c9 ("libceph: just wait for more data to be available on the socket") -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - net/ceph/messenger_v1.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/net/ceph/messenger_v1.c b/net/ceph/messenger_v1.c -index f9a50d7f0d20..4cb60bacf5f5 100644 ---- a/net/ceph/messenger_v1.c -+++ b/net/ceph/messenger_v1.c -@@ -991,7 +991,7 @@ static inline int read_partial_message_section(struct ceph_connection *con, - return read_partial_message_chunk(con, section, sec_len, crc); - } - --static int read_sparse_msg_extent(struct ceph_connection *con, u32 *crc) -+static int read_partial_sparse_msg_extent(struct ceph_connection *con, u32 *crc) - { - struct ceph_msg_data_cursor *cursor = &con->in_msg->cursor; - bool do_bounce = ceph_test_opt(from_msgr(con->msgr), RXBOUNCE); -@@ -1026,7 +1026,7 @@ static int read_sparse_msg_extent(struct ceph_connection *con, u32 *crc) - return 1; - } - --static int read_sparse_msg_data(struct ceph_connection *con) -+static int read_partial_sparse_msg_data(struct ceph_connection *con) - { - struct ceph_msg_data_cursor *cursor = &con->in_msg->cursor; - bool do_datacrc = !ceph_test_opt(from_msgr(con->msgr), NOCRC); -@@ -1043,7 +1043,7 @@ static int read_sparse_msg_data(struct ceph_connection *con) - con->v1.in_sr_len, - &crc); - else if (cursor->sr_resid > 0) -- ret = read_sparse_msg_extent(con, &crc); -+ ret = read_partial_sparse_msg_extent(con, &crc); - - if (ret <= 0) { - if (do_datacrc) -@@ -1254,7 +1254,7 @@ static int read_partial_message(struct ceph_connection *con) - return -EIO; - - if (m->sparse_read) -- ret = read_sparse_msg_data(con); -+ ret = read_partial_sparse_msg_data(con); - else if (ceph_test_opt(from_msgr(con->msgr), RXBOUNCE)) - ret = read_partial_msg_data_bounce(con); - else --- -2.43.2 - -From bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8 Mon Sep 17 00:00:00 2001 -From: Xiubo Li <xiubli@redhat.com> -Date: Thu, 14 Dec 2023 16:01:03 +0800 -Subject: [PATCH 1452/1501] libceph: just wait for more data to be available on - the socket -Content-Length: 5624 -Lines: 166 - -[ Upstream commit 8e46a2d068c92a905d01cbb018b00d66991585ab ] - -A short read may occur while reading the message footer from the -socket. Later, when the socket is ready for another read, the -messenger invokes all read_partial_*() handlers, including -read_partial_sparse_msg_data(). The expectation is that -read_partial_sparse_msg_data() would bail, allowing the messenger to -invoke read_partial() for the footer and pick up where it left off. - -However read_partial_sparse_msg_data() violates that and ends up -calling into the state machine in the OSD client. The sparse-read -state machine assumes that it's a new op and interprets some piece of -the footer as the sparse-read header and returns bogus extents/data -length, etc. - -To determine whether read_partial_sparse_msg_data() should bail, let's -reuse cursor->total_resid. Because once it reaches to zero that means -all the extents and data have been successfully received in last read, -else it could break out when partially reading any of the extents and -data. And then osd_sparse_read() could continue where it left off. - -[ idryomov: changelog ] - -Link: https://tracker.ceph.com/issues/63586 -Fixes: d396f89db39a ("libceph: add sparse read support to msgr1") -Signed-off-by: Xiubo Li <xiubli@redhat.com> -Reviewed-by: Jeff Layton <jlayton@kernel.org> -Signed-off-by: Ilya Dryomov <idryomov@gmail.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - include/linux/ceph/messenger.h | 2 +- - net/ceph/messenger_v1.c | 25 +++++++++++++------------ - net/ceph/messenger_v2.c | 4 ++-- - net/ceph/osd_client.c | 9 +++------ - 4 files changed, 19 insertions(+), 21 deletions(-) - -diff --git a/include/linux/ceph/messenger.h b/include/linux/ceph/messenger.h -index 2eaaabbe98cb..1717cc57cdac 100644 ---- a/include/linux/ceph/messenger.h -+++ b/include/linux/ceph/messenger.h -@@ -283,7 +283,7 @@ struct ceph_msg { - struct kref kref; - bool more_to_follow; - bool needs_out_seq; -- bool sparse_read; -+ u64 sparse_read_total; - int front_alloc_len; - - struct ceph_msgpool *pool; -diff --git a/net/ceph/messenger_v1.c b/net/ceph/messenger_v1.c -index 4cb60bacf5f5..0cb61c76b9b8 100644 ---- a/net/ceph/messenger_v1.c -+++ b/net/ceph/messenger_v1.c -@@ -160,8 +160,9 @@ static size_t sizeof_footer(struct ceph_connection *con) - static void prepare_message_data(struct ceph_msg *msg, u32 data_len) - { - /* Initialize data cursor if it's not a sparse read */ -- if (!msg->sparse_read) -- ceph_msg_data_cursor_init(&msg->cursor, msg, data_len); -+ u64 len = msg->sparse_read_total ? : data_len; -+ -+ ceph_msg_data_cursor_init(&msg->cursor, msg, len); - } - - /* -@@ -1036,7 +1037,7 @@ static int read_partial_sparse_msg_data(struct ceph_connection *con) - if (do_datacrc) - crc = con->in_data_crc; - -- do { -+ while (cursor->total_resid) { - if (con->v1.in_sr_kvec.iov_base) - ret = read_partial_message_chunk(con, - &con->v1.in_sr_kvec, -@@ -1044,23 +1045,23 @@ static int read_partial_sparse_msg_data(struct ceph_connection *con) - &crc); - else if (cursor->sr_resid > 0) - ret = read_partial_sparse_msg_extent(con, &crc); -- -- if (ret <= 0) { -- if (do_datacrc) -- con->in_data_crc = crc; -- return ret; -- } -+ if (ret <= 0) -+ break; - - memset(&con->v1.in_sr_kvec, 0, sizeof(con->v1.in_sr_kvec)); - ret = con->ops->sparse_read(con, cursor, - (char **)&con->v1.in_sr_kvec.iov_base); -+ if (ret <= 0) { -+ ret = ret ? ret : 1; /* must return > 0 to indicate success */ -+ break; -+ } - con->v1.in_sr_len = ret; -- } while (ret > 0); -+ } - - if (do_datacrc) - con->in_data_crc = crc; - -- return ret < 0 ? ret : 1; /* must return > 0 to indicate success */ -+ return ret; - } - - static int read_partial_msg_data(struct ceph_connection *con) -@@ -1253,7 +1254,7 @@ static int read_partial_message(struct ceph_connection *con) - if (!m->num_data_items) - return -EIO; - -- if (m->sparse_read) -+ if (m->sparse_read_total) - ret = read_partial_sparse_msg_data(con); - else if (ceph_test_opt(from_msgr(con->msgr), RXBOUNCE)) - ret = read_partial_msg_data_bounce(con); -diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c -index f8ec60e1aba3..a0ca5414b333 100644 ---- a/net/ceph/messenger_v2.c -+++ b/net/ceph/messenger_v2.c -@@ -1128,7 +1128,7 @@ static int decrypt_tail(struct ceph_connection *con) - struct sg_table enc_sgt = {}; - struct sg_table sgt = {}; - struct page **pages = NULL; -- bool sparse = con->in_msg->sparse_read; -+ bool sparse = !!con->in_msg->sparse_read_total; - int dpos = 0; - int tail_len; - int ret; -@@ -2060,7 +2060,7 @@ static int prepare_read_tail_plain(struct ceph_connection *con) - } - - if (data_len(msg)) { -- if (msg->sparse_read) -+ if (msg->sparse_read_total) - con->v2.in_state = IN_S_PREPARE_SPARSE_DATA; - else - con->v2.in_state = IN_S_PREPARE_READ_DATA; -diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c -index d3a759e052c8..8d9760397b88 100644 ---- a/net/ceph/osd_client.c -+++ b/net/ceph/osd_client.c -@@ -5510,7 +5510,7 @@ static struct ceph_msg *get_reply(struct ceph_connection *con, - } - - m = ceph_msg_get(req->r_reply); -- m->sparse_read = (bool)srlen; -+ m->sparse_read_total = srlen; - - dout("get_reply tid %lld %p\n", tid, m); - -@@ -5777,11 +5777,8 @@ static int prep_next_sparse_read(struct ceph_connection *con, - } - - if (o->o_sparse_op_idx < 0) { -- u64 srlen = sparse_data_requested(req); -- -- dout("%s: [%d] starting new sparse read req. srlen=0x%llx\n", -- __func__, o->o_osd, srlen); -- ceph_msg_data_cursor_init(cursor, con->in_msg, srlen); -+ dout("%s: [%d] starting new sparse read req\n", -+ __func__, o->o_osd); - } else { - u64 end; - --- -2.43.2 - -From 524b78875804bc905efdb84b181178c8be54f908 Mon Sep 17 00:00:00 2001 -From: Xiubo Li <xiubli@redhat.com> -Date: Thu, 18 Jan 2024 14:24:41 +0800 -Subject: [PATCH 1453/1501] ceph: always set initial i_blkbits to - CEPH_FSCRYPT_BLOCK_SHIFT -Content-Length: 1170 -Lines: 33 - -[ Upstream commit bbb20ea993f46743f7429092ddc52f1a5c5428ef ] - -The fscrypt code will use i_blkbits to setup ci_data_unit_bits when -allocating the new inode, but ceph will initiate i_blkbits ater when -filling the inode, which is too late. Since ci_data_unit_bits will only -be used by the fscrypt framework so initiating i_blkbits with -CEPH_FSCRYPT_BLOCK_SHIFT is safe. - -Link: https://tracker.ceph.com/issues/64035 -Fixes: 5b1188847180 ("fscrypt: support crypto data unit size less than filesystem block size") -Signed-off-by: Xiubo Li <xiubli@redhat.com> -Reviewed-by: Eric Biggers <ebiggers@google.com> -Signed-off-by: Ilya Dryomov <idryomov@gmail.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - fs/ceph/inode.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c -index 0679240f06db..7d41c3e03476 100644 ---- a/fs/ceph/inode.c -+++ b/fs/ceph/inode.c -@@ -78,6 +78,8 @@ struct inode *ceph_new_inode(struct inode *dir, struct dentry *dentry, - if (!inode) - return ERR_PTR(-ENOMEM); - -+ inode->i_blkbits = CEPH_FSCRYPT_BLOCK_SHIFT; -+ - if (!S_ISLNK(*mode)) { - err = ceph_pre_init_acls(dir, mode, as_ctx); - if (err < 0) --- -2.43.2 - -From ac4be33bcbde0166ba412c6cdf08d3bcd93ef5e0 Mon Sep 17 00:00:00 2001 -From: Alexandre Ghiti <alexghiti@rivosinc.com> -Date: Tue, 30 Jan 2024 13:01:14 +0100 -Subject: [PATCH 1454/1501] riscv: Fix arch_hugetlb_migration_supported() for - NAPOT -Content-Length: 2477 -Lines: 79 - -[ Upstream commit ce68c035457bdd025a9961e0ba2157323090c581 ] - -arch_hugetlb_migration_supported() must be reimplemented to add support -for NAPOT hugepages, which is done here. - -Fixes: 82a1a1f3bfb6 ("riscv: mm: support Svnapot in hugetlb page") -Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com> -Link: https://lore.kernel.org/r/20240130120114.106003-1-alexghiti@rivosinc.com -Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/riscv/include/asm/hugetlb.h | 3 +++ - arch/riscv/mm/hugetlbpage.c | 16 +++++++++++++--- - 2 files changed, 16 insertions(+), 3 deletions(-) - -diff --git a/arch/riscv/include/asm/hugetlb.h b/arch/riscv/include/asm/hugetlb.h -index 4c5b0e929890..20f9c3ba2341 100644 ---- a/arch/riscv/include/asm/hugetlb.h -+++ b/arch/riscv/include/asm/hugetlb.h -@@ -11,6 +11,9 @@ static inline void arch_clear_hugepage_flags(struct page *page) - } - #define arch_clear_hugepage_flags arch_clear_hugepage_flags - -+bool arch_hugetlb_migration_supported(struct hstate *h); -+#define arch_hugetlb_migration_supported arch_hugetlb_migration_supported -+ - #ifdef CONFIG_RISCV_ISA_SVNAPOT - #define __HAVE_ARCH_HUGE_PTE_CLEAR - void huge_pte_clear(struct mm_struct *mm, unsigned long addr, -diff --git a/arch/riscv/mm/hugetlbpage.c b/arch/riscv/mm/hugetlbpage.c -index 87af75ee7186..e7b69281875b 100644 ---- a/arch/riscv/mm/hugetlbpage.c -+++ b/arch/riscv/mm/hugetlbpage.c -@@ -364,7 +364,7 @@ void huge_pte_clear(struct mm_struct *mm, - pte_clear(mm, addr, ptep); - } - --static __init bool is_napot_size(unsigned long size) -+static bool is_napot_size(unsigned long size) - { - unsigned long order; - -@@ -392,7 +392,7 @@ arch_initcall(napot_hugetlbpages_init); - - #else - --static __init bool is_napot_size(unsigned long size) -+static bool is_napot_size(unsigned long size) - { - return false; - } -@@ -409,7 +409,7 @@ int pmd_huge(pmd_t pmd) - return pmd_leaf(pmd); - } - --bool __init arch_hugetlb_valid_size(unsigned long size) -+static bool __hugetlb_valid_size(unsigned long size) - { - if (size == HPAGE_SIZE) - return true; -@@ -421,6 +421,16 @@ bool __init arch_hugetlb_valid_size(unsigned long size) - return false; - } - -+bool __init arch_hugetlb_valid_size(unsigned long size) -+{ -+ return __hugetlb_valid_size(size); -+} -+ -+bool arch_hugetlb_migration_supported(struct hstate *h) -+{ -+ return __hugetlb_valid_size(huge_page_size(h)); -+} -+ - #ifdef CONFIG_CONTIG_ALLOC - static __init int gigantic_pages_init(void) - { --- -2.43.2 - -From 389870bd79adc4fde7c5edace2a0e978b7e91107 Mon Sep 17 00:00:00 2001 -From: Ben Dooks <ben.dooks@codethink.co.uk> -Date: Thu, 23 Nov 2023 13:42:14 +0000 -Subject: [PATCH 1455/1501] riscv: declare overflow_stack as exported from - traps.c -Content-Length: 1584 -Lines: 39 - -[ Upstream commit 2cf963787529f615f7c93bdcf13a5e82029e7f38 ] - -The percpu area overflow_stacks is exported from arch/riscv/kernel/traps.c -for use in the entry code, but is not declared anywhere. Add the relevant -declaration to arch/riscv/include/asm/stacktrace.h to silence the following -sparse warning: - -arch/riscv/kernel/traps.c:395:1: warning: symbol '__pcpu_scope_overflow_stack' was not declared. Should it be static? - -We don't add the stackinfo_get_overflow() call as for some of the other -architectures as this doesn't seem to be used yet, so just silence the -warning. - -Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk> -Reviewed-by: Conor Dooley <conor.dooley@microchip.com> -Fixes: be97d0db5f44 ("riscv: VMAP_STACK overflow detection thread-safe") -Link: https://lore.kernel.org/r/20231123134214.81481-1-ben.dooks@codethink.co.uk -Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - arch/riscv/include/asm/stacktrace.h | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/arch/riscv/include/asm/stacktrace.h b/arch/riscv/include/asm/stacktrace.h -index f7e8ef2418b9..b1495a7e06ce 100644 ---- a/arch/riscv/include/asm/stacktrace.h -+++ b/arch/riscv/include/asm/stacktrace.h -@@ -21,4 +21,9 @@ static inline bool on_thread_stack(void) - return !(((unsigned long)(current->stack) ^ current_stack_pointer) & ~(THREAD_SIZE - 1)); - } - -+ -+#ifdef CONFIG_VMAP_STACK -+DECLARE_PER_CPU(unsigned long [OVERFLOW_STACK_SIZE/sizeof(long)], overflow_stack); -+#endif /* CONFIG_VMAP_STACK */ -+ - #endif /* _ASM_RISCV_STACKTRACE_H */ --- -2.43.2 - -From dc1fc14047bd6cc7801f69e60aa36c8e44031bba Mon Sep 17 00:00:00 2001 -From: Maurizio Lombardi <mlombard@redhat.com> -Date: Thu, 18 Jan 2024 12:48:54 +0100 -Subject: [PATCH 1456/1501] nvme-host: fix the updating of the firmware version -Content-Length: 2392 -Lines: 66 - -[ Upstream commit f0377ff97509f5a4921993d5d61da000361bd884 ] - -The original code didn't update the firmware version if the -"next slot" of the AFI register isn't zero or if the -"current slot" field is zero; in those cases it assumed -that a reset was needed. - -However, the NVMe specification doesn't exclude the possibility that -the "next slot" value is equal to the "current slot" value, -meaning that the same firmware slot will be activated after performing -a controller level reset; in this case a reset is clearly not -necessary and we can safely update the firmware version. - -Modify the code so the kernel will report that a Controller Level Reset -is needed only in the following cases: - -1) If the "current slot" field is zero. This is invalid and means that - something is wrong, a reset is needed. - -or - -2) if the "next slot" field isn't zero AND it's not equal to the - "current slot" value. This means that at the next reset a different - firmware slot will be activated. - -Fixes: 983a338b96c8 ("nvme: update firmware version after commit") -Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> -Reviewed-by: Daniel Wagner <dwagner@suse.de> -Signed-off-by: Keith Busch <kbusch@kernel.org> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - drivers/nvme/host/core.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c -index 60f14019f981..86149275ccb8 100644 ---- a/drivers/nvme/host/core.c -+++ b/drivers/nvme/host/core.c -@@ -4107,6 +4107,7 @@ static bool nvme_ctrl_pp_status(struct nvme_ctrl *ctrl) - static void nvme_get_fw_slot_info(struct nvme_ctrl *ctrl) - { - struct nvme_fw_slot_info_log *log; -+ u8 next_fw_slot, cur_fw_slot; - - log = kmalloc(sizeof(*log), GFP_KERNEL); - if (!log) -@@ -4118,13 +4119,15 @@ static void nvme_get_fw_slot_info(struct nvme_ctrl *ctrl) - goto out_free_log; - } - -- if (log->afi & 0x70 || !(log->afi & 0x7)) { -+ cur_fw_slot = log->afi & 0x7; -+ next_fw_slot = (log->afi & 0x70) >> 4; -+ if (!cur_fw_slot || (next_fw_slot && (cur_fw_slot != next_fw_slot))) { - dev_info(ctrl->device, - "Firmware is activated after next Controller Level Reset\n"); - goto out_free_log; - } - -- memcpy(ctrl->subsys->firmware_rev, &log->frs[(log->afi & 0x7) - 1], -+ memcpy(ctrl->subsys->firmware_rev, &log->frs[cur_fw_slot - 1], - sizeof(ctrl->subsys->firmware_rev)); - - out_free_log: --- -2.43.2 - -From cd33b330cb21675189e747953845f5c3689e4912 Mon Sep 17 00:00:00 2001 -From: Tejun Heo <tj@kernel.org> -Date: Mon, 20 Nov 2023 12:25:56 -1000 -Subject: [PATCH 1458/1501] blk-iocost: Fix an UBSAN shift-out-of-bounds - warning -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 2238 -Lines: 61 - -[ Upstream commit 2a427b49d02995ea4a6ff93a1432c40fa4d36821 ] - -When iocg_kick_delay() is called from a CPU different than the one which set -the delay, @now may be in the past of @iocg->delay_at leading to the -following warning: - - UBSAN: shift-out-of-bounds in block/blk-iocost.c:1359:23 - shift exponent 18446744073709 is too large for 64-bit type 'u64' (aka 'unsigned long long') - ... - Call Trace: - <TASK> - dump_stack_lvl+0x79/0xc0 - __ubsan_handle_shift_out_of_bounds+0x2ab/0x300 - iocg_kick_delay+0x222/0x230 - ioc_rqos_merge+0x1d7/0x2c0 - __rq_qos_merge+0x2c/0x80 - bio_attempt_back_merge+0x83/0x190 - blk_attempt_plug_merge+0x101/0x150 - blk_mq_submit_bio+0x2b1/0x720 - submit_bio_noacct_nocheck+0x320/0x3e0 - __swap_writepage+0x2ab/0x9d0 - -The underflow itself doesn't really affect the behavior in any meaningful -way; however, the past timestamp may exaggerate the delay amount calculated -later in the code, which shouldn't be a material problem given the nature of -the delay mechanism. - -If @now is in the past, this CPU is racing another CPU which recently set up -the delay and there's nothing this CPU can contribute w.r.t. the delay. -Let's bail early from iocg_kick_delay() in such cases. - -Reported-by: Breno Leitão <leitao@debian.org> -Signed-off-by: Tejun Heo <tj@kernel.org> -Fixes: 5160a5a53c0c ("blk-iocost: implement delay adjustment hysteresis") -Link: https://lore.kernel.org/r/ZVvc9L_CYk5LO1fT@slm.duckdns.org -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Sasha Levin <sashal@kernel.org> ---- - block/blk-iocost.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/block/blk-iocost.c b/block/blk-iocost.c -index 089fcb9cfce3..7ee8d85c2c68 100644 ---- a/block/blk-iocost.c -+++ b/block/blk-iocost.c -@@ -1353,6 +1353,13 @@ static bool iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now) - - lockdep_assert_held(&iocg->waitq.lock); - -+ /* -+ * If the delay is set by another CPU, we may be in the past. No need to -+ * change anything if so. This avoids decay calculation underflow. -+ */ -+ if (time_before64(now->now, iocg->delay_at)) -+ return false; -+ - /* calculate the current delay in effect - 1/2 every second */ - tdelta = now->now - iocg->delay_at; - if (iocg->delay) --- -2.43.2 - -From f41943ee0ca79985a60a8de3200761fcecf7aba2 Mon Sep 17 00:00:00 2001 -From: Mario Limonciello <mario.limonciello@amd.com> -Date: Fri, 19 Jan 2024 03:08:37 -0600 -Subject: [PATCH 1466/1501] Revert "drm/amd/pm: fix the high voltage and - temperature issue" -Content-Length: 5751 -Lines: 170 - -commit c92c108403b09f75f3393588c2326ecad49ee2e2 upstream. - -This reverts commit 5f38ac54e60562323ea4abb1bfb37d043ee23357. -This causes issues with rebooting and the 7800XT. - -Cc: Kenneth Feng <kenneth.feng@amd.com> -Cc: stable@vger.kernel.org -Fixes: 5f38ac54e605 ("drm/amd/pm: fix the high voltage and temperature issue") -Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3062 -Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> -Acked-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 24 ++++---------- - drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 33 ++----------------- - drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 1 - - .../drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 8 +---- - .../drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 8 +---- - 5 files changed, 11 insertions(+), 63 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -index 9257c9af3fee..5fe1df95dc38 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -@@ -4051,23 +4051,13 @@ int amdgpu_device_init(struct amdgpu_device *adev, - } - } - } else { -- switch (amdgpu_ip_version(adev, MP1_HWIP, 0)) { -- case IP_VERSION(13, 0, 0): -- case IP_VERSION(13, 0, 7): -- case IP_VERSION(13, 0, 10): -- r = psp_gpu_reset(adev); -- break; -- default: -- tmp = amdgpu_reset_method; -- /* It should do a default reset when loading or reloading the driver, -- * regardless of the module parameter reset_method. -- */ -- amdgpu_reset_method = AMD_RESET_METHOD_NONE; -- r = amdgpu_asic_reset(adev); -- amdgpu_reset_method = tmp; -- break; -- } -- -+ tmp = amdgpu_reset_method; -+ /* It should do a default reset when loading or reloading the driver, -+ * regardless of the module parameter reset_method. -+ */ -+ amdgpu_reset_method = AMD_RESET_METHOD_NONE; -+ r = amdgpu_asic_reset(adev); -+ amdgpu_reset_method = tmp; - if (r) { - dev_err(adev->dev, "asic reset on init failed\n"); - goto failed; -diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c -index cd252e2b584c..60dce148b2d7 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c -@@ -734,7 +734,7 @@ static int smu_early_init(void *handle) - smu->adev = adev; - smu->pm_enabled = !!amdgpu_dpm; - smu->is_apu = false; -- smu->smu_baco.state = SMU_BACO_STATE_NONE; -+ smu->smu_baco.state = SMU_BACO_STATE_EXIT; - smu->smu_baco.platform_support = false; - smu->user_dpm_profile.fan_mode = -1; - -@@ -1746,31 +1746,10 @@ static int smu_smc_hw_cleanup(struct smu_context *smu) - return 0; - } - --static int smu_reset_mp1_state(struct smu_context *smu) --{ -- struct amdgpu_device *adev = smu->adev; -- int ret = 0; -- -- if ((!adev->in_runpm) && (!adev->in_suspend) && -- (!amdgpu_in_reset(adev))) -- switch (amdgpu_ip_version(adev, MP1_HWIP, 0)) { -- case IP_VERSION(13, 0, 0): -- case IP_VERSION(13, 0, 7): -- case IP_VERSION(13, 0, 10): -- ret = smu_set_mp1_state(smu, PP_MP1_STATE_UNLOAD); -- break; -- default: -- break; -- } -- -- return ret; --} -- - static int smu_hw_fini(void *handle) - { - struct amdgpu_device *adev = (struct amdgpu_device *)handle; - struct smu_context *smu = adev->powerplay.pp_handle; -- int ret; - - if (amdgpu_sriov_vf(adev) && !amdgpu_sriov_is_pp_one_vf(adev)) - return 0; -@@ -1788,15 +1767,7 @@ static int smu_hw_fini(void *handle) - - adev->pm.dpm_enabled = false; - -- ret = smu_smc_hw_cleanup(smu); -- if (ret) -- return ret; -- -- ret = smu_reset_mp1_state(smu); -- if (ret) -- return ret; -- -- return 0; -+ return smu_smc_hw_cleanup(smu); - } - - static void smu_late_fini(void *handle) -diff --git a/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h b/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h -index f8b2e6cc2568..e8329d157bfe 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h -+++ b/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h -@@ -419,7 +419,6 @@ enum smu_reset_mode { - enum smu_baco_state { - SMU_BACO_STATE_ENTER = 0, - SMU_BACO_STATE_EXIT, -- SMU_BACO_STATE_NONE, - }; - - struct smu_baco_context { -diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c -index 2a76064d909f..5625a6e5702a 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c -@@ -2773,13 +2773,7 @@ static int smu_v13_0_0_set_mp1_state(struct smu_context *smu, - - switch (mp1_state) { - case PP_MP1_STATE_UNLOAD: -- ret = smu_cmn_send_smc_msg_with_param(smu, -- SMU_MSG_PrepareMp1ForUnload, -- 0x55, NULL); -- -- if (!ret && smu->smu_baco.state == SMU_BACO_STATE_EXIT) -- ret = smu_v13_0_disable_pmfw_state(smu); -- -+ ret = smu_cmn_set_mp1_state(smu, mp1_state); - break; - default: - /* Ignore others */ -diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c -index d380a53e8f77..bc5891c3f648 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c -@@ -2500,13 +2500,7 @@ static int smu_v13_0_7_set_mp1_state(struct smu_context *smu, - - switch (mp1_state) { - case PP_MP1_STATE_UNLOAD: -- ret = smu_cmn_send_smc_msg_with_param(smu, -- SMU_MSG_PrepareMp1ForUnload, -- 0x55, NULL); -- -- if (!ret && smu->smu_baco.state == SMU_BACO_STATE_EXIT) -- ret = smu_v13_0_disable_pmfw_state(smu); -- -+ ret = smu_cmn_set_mp1_state(smu, mp1_state); - break; - default: - /* Ignore others */ --- -2.43.2 - -From 2da241c5ed78d0978228a1150735539fe1a60eca Mon Sep 17 00:00:00 2001 -From: Qiuxu Zhuo <qiuxu.zhuo@intel.com> -Date: Mon, 29 Jan 2024 14:38:42 +0800 -Subject: [PATCH 1467/1501] x86/lib: Revert to _ASM_EXTABLE_UA() for - {get,put}_user() fixups -Content-Length: 5256 -Lines: 126 - -commit 8eed4e00a370b37b4e5985ed983dccedd555ea9d upstream. - -During memory error injection test on kernels >= v6.4, the kernel panics -like below. However, this issue couldn't be reproduced on kernels <= v6.3. - - mce: [Hardware Error]: CPU 296: Machine Check Exception: f Bank 1: bd80000000100134 - mce: [Hardware Error]: RIP 10:<ffffffff821b9776> {__get_user_nocheck_4+0x6/0x20} - mce: [Hardware Error]: TSC 411a93533ed ADDR 346a8730040 MISC 86 - mce: [Hardware Error]: PROCESSOR 0:a06d0 TIME 1706000767 SOCKET 1 APIC 211 microcode 80001490 - mce: [Hardware Error]: Run the above through 'mcelog --ascii' - mce: [Hardware Error]: Machine check: Data load in unrecoverable area of kernel - Kernel panic - not syncing: Fatal local machine check - -The MCA code can recover from an in-kernel #MC if the fixup type is -EX_TYPE_UACCESS, explicitly indicating that the kernel is attempting to -access userspace memory. However, if the fixup type is EX_TYPE_DEFAULT -the only thing that is raised for an in-kernel #MC is a panic. - -ex_handler_uaccess() would warn if users gave a non-canonical addresses -(with bit 63 clear) to {get, put}_user(), which was unexpected. - -Therefore, commit - - b19b74bc99b1 ("x86/mm: Rework address range check in get_user() and put_user()") - -replaced _ASM_EXTABLE_UA() with _ASM_EXTABLE() for {get, put}_user() -fixups. However, the new fixup type EX_TYPE_DEFAULT results in a panic. - -Commit - - 6014bc27561f ("x86-64: make access_ok() independent of LAM") - -added the check gp_fault_address_ok() right before the WARN_ONCE() in -ex_handler_uaccess() to not warn about non-canonical user addresses due -to LAM. - -With that in place, revert back to _ASM_EXTABLE_UA() for {get,put}_user() -exception fixups in order to be able to handle in-kernel MCEs correctly -again. - - [ bp: Massage commit message. ] - -Fixes: b19b74bc99b1 ("x86/mm: Rework address range check in get_user() and put_user()") -Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com> -Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> -Reviewed-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> -Cc: <stable@kernel.org> -Link: https://lore.kernel.org/r/20240129063842.61584-1-qiuxu.zhuo@intel.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - arch/x86/lib/getuser.S | 24 ++++++++++++------------ - arch/x86/lib/putuser.S | 20 ++++++++++---------- - 2 files changed, 22 insertions(+), 22 deletions(-) - -diff --git a/arch/x86/lib/getuser.S b/arch/x86/lib/getuser.S -index 20ef350a60fb..10d5ed8b5990 100644 ---- a/arch/x86/lib/getuser.S -+++ b/arch/x86/lib/getuser.S -@@ -163,23 +163,23 @@ SYM_CODE_END(__get_user_8_handle_exception) - #endif - - /* get_user */ -- _ASM_EXTABLE(1b, __get_user_handle_exception) -- _ASM_EXTABLE(2b, __get_user_handle_exception) -- _ASM_EXTABLE(3b, __get_user_handle_exception) -+ _ASM_EXTABLE_UA(1b, __get_user_handle_exception) -+ _ASM_EXTABLE_UA(2b, __get_user_handle_exception) -+ _ASM_EXTABLE_UA(3b, __get_user_handle_exception) - #ifdef CONFIG_X86_64 -- _ASM_EXTABLE(4b, __get_user_handle_exception) -+ _ASM_EXTABLE_UA(4b, __get_user_handle_exception) - #else -- _ASM_EXTABLE(4b, __get_user_8_handle_exception) -- _ASM_EXTABLE(5b, __get_user_8_handle_exception) -+ _ASM_EXTABLE_UA(4b, __get_user_8_handle_exception) -+ _ASM_EXTABLE_UA(5b, __get_user_8_handle_exception) - #endif - - /* __get_user */ -- _ASM_EXTABLE(6b, __get_user_handle_exception) -- _ASM_EXTABLE(7b, __get_user_handle_exception) -- _ASM_EXTABLE(8b, __get_user_handle_exception) -+ _ASM_EXTABLE_UA(6b, __get_user_handle_exception) -+ _ASM_EXTABLE_UA(7b, __get_user_handle_exception) -+ _ASM_EXTABLE_UA(8b, __get_user_handle_exception) - #ifdef CONFIG_X86_64 -- _ASM_EXTABLE(9b, __get_user_handle_exception) -+ _ASM_EXTABLE_UA(9b, __get_user_handle_exception) - #else -- _ASM_EXTABLE(9b, __get_user_8_handle_exception) -- _ASM_EXTABLE(10b, __get_user_8_handle_exception) -+ _ASM_EXTABLE_UA(9b, __get_user_8_handle_exception) -+ _ASM_EXTABLE_UA(10b, __get_user_8_handle_exception) - #endif -diff --git a/arch/x86/lib/putuser.S b/arch/x86/lib/putuser.S -index 2877f5934177..975c9c18263d 100644 ---- a/arch/x86/lib/putuser.S -+++ b/arch/x86/lib/putuser.S -@@ -133,15 +133,15 @@ SYM_CODE_START_LOCAL(__put_user_handle_exception) - RET - SYM_CODE_END(__put_user_handle_exception) - -- _ASM_EXTABLE(1b, __put_user_handle_exception) -- _ASM_EXTABLE(2b, __put_user_handle_exception) -- _ASM_EXTABLE(3b, __put_user_handle_exception) -- _ASM_EXTABLE(4b, __put_user_handle_exception) -- _ASM_EXTABLE(5b, __put_user_handle_exception) -- _ASM_EXTABLE(6b, __put_user_handle_exception) -- _ASM_EXTABLE(7b, __put_user_handle_exception) -- _ASM_EXTABLE(9b, __put_user_handle_exception) -+ _ASM_EXTABLE_UA(1b, __put_user_handle_exception) -+ _ASM_EXTABLE_UA(2b, __put_user_handle_exception) -+ _ASM_EXTABLE_UA(3b, __put_user_handle_exception) -+ _ASM_EXTABLE_UA(4b, __put_user_handle_exception) -+ _ASM_EXTABLE_UA(5b, __put_user_handle_exception) -+ _ASM_EXTABLE_UA(6b, __put_user_handle_exception) -+ _ASM_EXTABLE_UA(7b, __put_user_handle_exception) -+ _ASM_EXTABLE_UA(9b, __put_user_handle_exception) - #ifdef CONFIG_X86_32 -- _ASM_EXTABLE(8b, __put_user_handle_exception) -- _ASM_EXTABLE(10b, __put_user_handle_exception) -+ _ASM_EXTABLE_UA(8b, __put_user_handle_exception) -+ _ASM_EXTABLE_UA(10b, __put_user_handle_exception) - #endif --- -2.43.2 - -From 783e69db8f44e2f68a942af4c523fac8ab7e9123 Mon Sep 17 00:00:00 2001 -From: Mathias Nyman <mathias.nyman@linux.intel.com> -Date: Thu, 25 Jan 2024 17:27:36 +0200 -Subject: [PATCH 1470/1501] xhci: process isoc TD properly when there was a - transaction error mid TD. -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-Length: 6099 -Lines: 173 - -commit 5372c65e1311a16351ef03dd096ff576e6477674 upstream. - -The last TRB of a isoc TD might not trigger an event if there was -an error event for a TRB mid TD. This is seen on a NEC Corporation -uPD720200 USB 3.0 Host - -After an error mid a multi-TRB TD the xHC should according to xhci 4.9.1 -generate events for passed TRBs with IOC flag set if it proceeds to the -next TD. This event is either a copy of the original error, or a -"success" transfer event. - -If that event is missing then the driver and xHC host get out of sync as -the driver is still expecting a transfer event for that first TD, while -xHC host is already sending events for the next TD in the list. -This leads to -"Transfer event TRB DMA ptr not part of current TD" messages. - -As a solution we tag the isoc TDs that get error events mid TD. -If an event doesn't match the first TD, then check if the tag is -set, and event points to the next TD. -In that case give back the fist TD and process the next TD normally - -Make sure TD status and transferred length stay valid in both cases -with and without final TD completion event. - -Reported-by: Michał Pecio <michal.pecio@gmail.com> -Closes: https://lore.kernel.org/linux-usb/20240112235205.1259f60c@foxbook/ -Tested-by: Michał Pecio <michal.pecio@gmail.com> -Cc: stable@vger.kernel.org -Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> -Link: https://lore.kernel.org/r/20240125152737.2983959-4-mathias.nyman@linux.intel.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/usb/host/xhci-ring.c | 74 +++++++++++++++++++++++++++++------- - drivers/usb/host/xhci.h | 1 + - 2 files changed, 61 insertions(+), 14 deletions(-) - -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index f3b5e6345858..22a4aa65e4c9 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -2375,6 +2375,9 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_virt_ep *ep, - /* handle completion code */ - switch (trb_comp_code) { - case COMP_SUCCESS: -+ /* Don't overwrite status if TD had an error, see xHCI 4.9.1 */ -+ if (td->error_mid_td) -+ break; - if (remaining) { - frame->status = short_framestatus; - if (xhci->quirks & XHCI_TRUST_TX_LENGTH) -@@ -2400,8 +2403,9 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_virt_ep *ep, - break; - case COMP_USB_TRANSACTION_ERROR: - frame->status = -EPROTO; -+ sum_trbs_for_length = true; - if (ep_trb != td->last_trb) -- return 0; -+ td->error_mid_td = true; - break; - case COMP_STOPPED: - sum_trbs_for_length = true; -@@ -2421,6 +2425,9 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_virt_ep *ep, - break; - } - -+ if (td->urb_length_set) -+ goto finish_td; -+ - if (sum_trbs_for_length) - frame->actual_length = sum_trb_lengths(xhci, ep->ring, ep_trb) + - ep_trb_len - remaining; -@@ -2429,6 +2436,14 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_virt_ep *ep, - - td->urb->actual_length += frame->actual_length; - -+finish_td: -+ /* Don't give back TD yet if we encountered an error mid TD */ -+ if (td->error_mid_td && ep_trb != td->last_trb) { -+ xhci_dbg(xhci, "Error mid isoc TD, wait for final completion event\n"); -+ td->urb_length_set = true; -+ return 0; -+ } -+ - return finish_td(xhci, ep, ep_ring, td, trb_comp_code); - } - -@@ -2807,17 +2822,51 @@ static int handle_tx_event(struct xhci_hcd *xhci, - } - - if (!ep_seg) { -- if (!ep->skip || -- !usb_endpoint_xfer_isoc(&td->urb->ep->desc)) { -- /* Some host controllers give a spurious -- * successful event after a short transfer. -- * Ignore it. -- */ -- if ((xhci->quirks & XHCI_SPURIOUS_SUCCESS) && -- ep_ring->last_td_was_short) { -- ep_ring->last_td_was_short = false; -- goto cleanup; -+ -+ if (ep->skip && usb_endpoint_xfer_isoc(&td->urb->ep->desc)) { -+ skip_isoc_td(xhci, td, ep, status); -+ goto cleanup; -+ } -+ -+ /* -+ * Some hosts give a spurious success event after a short -+ * transfer. Ignore it. -+ */ -+ if ((xhci->quirks & XHCI_SPURIOUS_SUCCESS) && -+ ep_ring->last_td_was_short) { -+ ep_ring->last_td_was_short = false; -+ goto cleanup; -+ } -+ -+ /* -+ * xhci 4.10.2 states isoc endpoints should continue -+ * processing the next TD if there was an error mid TD. -+ * So host like NEC don't generate an event for the last -+ * isoc TRB even if the IOC flag is set. -+ * xhci 4.9.1 states that if there are errors in mult-TRB -+ * TDs xHC should generate an error for that TRB, and if xHC -+ * proceeds to the next TD it should genete an event for -+ * any TRB with IOC flag on the way. Other host follow this. -+ * So this event might be for the next TD. -+ */ -+ if (td->error_mid_td && -+ !list_is_last(&td->td_list, &ep_ring->td_list)) { -+ struct xhci_td *td_next = list_next_entry(td, td_list); -+ -+ ep_seg = trb_in_td(xhci, td_next->start_seg, td_next->first_trb, -+ td_next->last_trb, ep_trb_dma, false); -+ if (ep_seg) { -+ /* give back previous TD, start handling new */ -+ xhci_dbg(xhci, "Missing TD completion event after mid TD error\n"); -+ ep_ring->dequeue = td->last_trb; -+ ep_ring->deq_seg = td->last_trb_seg; -+ inc_deq(xhci, ep_ring); -+ xhci_td_cleanup(xhci, td, ep_ring, td->status); -+ td = td_next; - } -+ } -+ -+ if (!ep_seg) { - /* HC is busted, give up! */ - xhci_err(xhci, - "ERROR Transfer event TRB DMA ptr not " -@@ -2829,9 +2878,6 @@ static int handle_tx_event(struct xhci_hcd *xhci, - ep_trb_dma, true); - return -ESHUTDOWN; - } -- -- skip_isoc_td(xhci, td, ep, status); -- goto cleanup; - } - if (trb_comp_code == COMP_SHORT_PACKET) - ep_ring->last_td_was_short = true; -diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h -index 3ea5c092bba7..6f53a950d9c0 100644 ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -1547,6 +1547,7 @@ struct xhci_td { - struct xhci_segment *bounce_seg; - /* actual_length of the URB has already been set */ - bool urb_length_set; -+ bool error_mid_td; - unsigned int num_trbs; - }; - --- -2.43.2 - -From 6424f6ebde6a876f262d0ab5afb1240a231ec896 Mon Sep 17 00:00:00 2001 -From: Frederic Weisbecker <frederic@kernel.org> -Date: Mon, 29 Jan 2024 15:56:36 -0800 -Subject: [PATCH 1473/1501] hrtimer: Report offline hrtimer enqueue -Content-Length: 2943 -Lines: 77 - -commit dad6a09f3148257ac1773cd90934d721d68ab595 upstream. - -The hrtimers migration on CPU-down hotplug process has been moved -earlier, before the CPU actually goes to die. This leaves a small window -of opportunity to queue an hrtimer in a blind spot, leaving it ignored. - -For example a practical case has been reported with RCU waking up a -SCHED_FIFO task right before the CPUHP_AP_IDLE_DEAD stage, queuing that -way a sched/rt timer to the local offline CPU. - -Make sure such situations never go unnoticed and warn when that happens. - -Fixes: 5c0930ccaad5 ("hrtimers: Push pending hrtimers away from outgoing CPU earlier") -Reported-by: Paul E. McKenney <paulmck@kernel.org> -Signed-off-by: Frederic Weisbecker <frederic@kernel.org> -Signed-off-by: Paul E. McKenney <paulmck@kernel.org> -Signed-off-by: Thomas Gleixner <tglx@linutronix.de> -Cc: stable@vger.kernel.org -Link: https://lore.kernel.org/r/20240129235646.3171983-4-boqun.feng@gmail.com -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - include/linux/hrtimer.h | 4 +++- - kernel/time/hrtimer.c | 3 +++ - 2 files changed, 6 insertions(+), 1 deletion(-) - -diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h -index f2044d5a652b..254d4a898179 100644 ---- a/include/linux/hrtimer.h -+++ b/include/linux/hrtimer.h -@@ -197,6 +197,7 @@ enum hrtimer_base_type { - * @max_hang_time: Maximum time spent in hrtimer_interrupt - * @softirq_expiry_lock: Lock which is taken while softirq based hrtimer are - * expired -+ * @online: CPU is online from an hrtimers point of view - * @timer_waiters: A hrtimer_cancel() invocation waits for the timer - * callback to finish. - * @expires_next: absolute time of the next event, is required for remote -@@ -219,7 +220,8 @@ struct hrtimer_cpu_base { - unsigned int hres_active : 1, - in_hrtirq : 1, - hang_detected : 1, -- softirq_activated : 1; -+ softirq_activated : 1, -+ online : 1; - #ifdef CONFIG_HIGH_RES_TIMERS - unsigned int nr_events; - unsigned short nr_retries; -diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c -index 760793998cdd..edb0f821dcea 100644 ---- a/kernel/time/hrtimer.c -+++ b/kernel/time/hrtimer.c -@@ -1085,6 +1085,7 @@ static int enqueue_hrtimer(struct hrtimer *timer, - enum hrtimer_mode mode) - { - debug_activate(timer, mode); -+ WARN_ON_ONCE(!base->cpu_base->online); - - base->cpu_base->active_bases |= 1 << base->index; - -@@ -2183,6 +2184,7 @@ int hrtimers_prepare_cpu(unsigned int cpu) - cpu_base->softirq_next_timer = NULL; - cpu_base->expires_next = KTIME_MAX; - cpu_base->softirq_expires_next = KTIME_MAX; -+ cpu_base->online = 1; - hrtimer_cpu_base_init_expiry_lock(cpu_base); - return 0; - } -@@ -2250,6 +2252,7 @@ int hrtimers_cpu_dying(unsigned int dying_cpu) - smp_call_function_single(ncpu, retrigger_next_event, NULL, 0); - - raw_spin_unlock(&new_base->lock); -+ old_base->online = 0; - raw_spin_unlock(&old_base->lock); - - return 0; --- -2.43.2 - -From 672049bbce4763f0001acf878989a924f4262d41 Mon Sep 17 00:00:00 2001 -From: Werner Sembach <wse@tuxedocomputers.com> -Date: Tue, 5 Dec 2023 17:36:01 +0100 -Subject: [PATCH 1474/1501] Input: i8042 - fix strange behavior of touchpad on - Clevo NS70PU -Content-Length: 1702 -Lines: 44 - -commit a60e6c3918d20848906ffcdfcf72ca6a8cfbcf2e upstream. - -When closing the laptop lid with an external screen connected, the mouse -pointer has a constant movement to the lower right corner. Opening the -lid again stops this movement, but after that the touchpad does no longer -register clicks. - -The touchpad is connected both via i2c-hid and PS/2, the predecessor of -this device (NS70MU) has the same layout in this regard and also strange -behaviour caused by the psmouse and the i2c-hid driver fighting over -touchpad control. This fix is reusing the same workaround by just -disabling the PS/2 aux port, that is only used by the touchpad, to give the -i2c-hid driver the lone control over the touchpad. - -v2: Rebased on current master - -Signed-off-by: Werner Sembach <wse@tuxedocomputers.com> -Cc: stable@vger.kernel.org -Link: https://lore.kernel.org/r/20231205163602.16106-1-wse@tuxedocomputers.com -Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/input/serio/i8042-acpipnpio.h | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/drivers/input/serio/i8042-acpipnpio.h b/drivers/input/serio/i8042-acpipnpio.h -index b585b1dab870..cd45a65e17f2 100644 ---- a/drivers/input/serio/i8042-acpipnpio.h -+++ b/drivers/input/serio/i8042-acpipnpio.h -@@ -1208,6 +1208,12 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { - SERIO_QUIRK_RESET_ALWAYS | SERIO_QUIRK_NOLOOP | - SERIO_QUIRK_NOPNP) - }, -+ { -+ .matches = { -+ DMI_MATCH(DMI_BOARD_NAME, "NS5x_7xPU"), -+ }, -+ .driver_data = (void *)(SERIO_QUIRK_NOAUX) -+ }, - { - .matches = { - DMI_MATCH(DMI_BOARD_NAME, "NJ50_70CU"), --- -2.43.2 - -From 2d470b1c3b3d846f8d0338bebbd4ee5d3816e50a Mon Sep 17 00:00:00 2001 -From: Hans de Goede <hdegoede@redhat.com> -Date: Fri, 26 Jan 2024 17:07:23 +0100 -Subject: [PATCH 1475/1501] Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping - ATKBD_CMD_GETID -Content-Length: 3030 -Lines: 79 - -commit 683cd8259a9b883a51973511f860976db2550a6e upstream. - -After commit 936e4d49ecbc ("Input: atkbd - skip ATKBD_CMD_GETID in -translated mode") the keyboard on Dell XPS 13 9350 / 9360 / 9370 models -has stopped working after a suspend/resume. - -The problem appears to be that atkbd_probe() fails when called -from atkbd_reconnect() on resume, which on systems where -ATKBD_CMD_GETID is skipped can only happen by ATKBD_CMD_SETLEDS -failing. ATKBD_CMD_SETLEDS failing because ATKBD_CMD_GETID was -skipped is weird, but apparently that is what is happening. - -Fix this by also skipping ATKBD_CMD_SETLEDS when skipping -ATKBD_CMD_GETID. - -Fixes: 936e4d49ecbc ("Input: atkbd - skip ATKBD_CMD_GETID in translated mode") -Reported-by: Paul Menzel <pmenzel@molgen.mpg.de> -Closes: https://lore.kernel.org/linux-input/0aa4a61f-c939-46fe-a572-08022e8931c7@molgen.mpg.de/ -Closes: https://bbs.archlinux.org/viewtopic.php?pid=2146300 -Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218424 -Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2260517 -Tested-by: Paul Menzel <pmenzel@molgen.mpg.de> -Cc: stable@vger.kernel.org -Signed-off-by: Hans de Goede <hdegoede@redhat.com> -Link: https://lore.kernel.org/r/20240126160724.13278-2-hdegoede@redhat.com -Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/input/keyboard/atkbd.c | 13 ++++++++----- - 1 file changed, 8 insertions(+), 5 deletions(-) - -diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c -index 13ef6284223d..c229bd6b3f7f 100644 ---- a/drivers/input/keyboard/atkbd.c -+++ b/drivers/input/keyboard/atkbd.c -@@ -811,7 +811,6 @@ static int atkbd_probe(struct atkbd *atkbd) - { - struct ps2dev *ps2dev = &atkbd->ps2dev; - unsigned char param[2]; -- bool skip_getid; - - /* - * Some systems, where the bit-twiddling when testing the io-lines of the -@@ -825,6 +824,11 @@ static int atkbd_probe(struct atkbd *atkbd) - "keyboard reset failed on %s\n", - ps2dev->serio->phys); - -+ if (atkbd_skip_getid(atkbd)) { -+ atkbd->id = 0xab83; -+ return 0; -+ } -+ - /* - * Then we check the keyboard ID. We should get 0xab83 under normal conditions. - * Some keyboards report different values, but the first byte is always 0xab or -@@ -833,18 +837,17 @@ static int atkbd_probe(struct atkbd *atkbd) - */ - - param[0] = param[1] = 0xa5; /* initialize with invalid values */ -- skip_getid = atkbd_skip_getid(atkbd); -- if (skip_getid || ps2_command(ps2dev, param, ATKBD_CMD_GETID)) { -+ if (ps2_command(ps2dev, param, ATKBD_CMD_GETID)) { - - /* -- * If the get ID command was skipped or failed, we check if we can at least set -+ * If the get ID command failed, we check if we can at least set - * the LEDs on the keyboard. This should work on every keyboard out there. - * It also turns the LEDs off, which we want anyway. - */ - param[0] = 0; - if (ps2_command(ps2dev, param, ATKBD_CMD_SETLEDS)) - return -1; -- atkbd->id = skip_getid ? 0xab83 : 0xabba; -+ atkbd->id = 0xabba; - return 0; - } - --- -2.43.2 - -From 30f3841215b7ebc350e123609bff696e8b5f96bc Mon Sep 17 00:00:00 2001 -From: Emmanuel Grumbach <emmanuel.grumbach@intel.com> -Date: Sun, 28 Jan 2024 08:53:57 +0200 -Subject: [PATCH 1476/1501] wifi: iwlwifi: mvm: fix a battery life regression -Content-Length: 1411 -Lines: 33 - -commit 1fa942f31665ea5dc5d4d95893dd13723eaa97cc upstream. - -Fix the DBG_CONFIG_TOKEN to not enable debug components that would -prevent the device to save power. - -Fixes: fc2fe0a5e856 ("wifi: iwlwifi: fw: disable firmware debug asserts") -Cc: stable@vger.kernel.org -Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> -Reviewed-by: Eilon Rinat <eilon.rinat@intel.com> -Reviewed-by: Gregory Greenman <gregory.greenman@intel.com> -Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> -Link: https://msgid.link/20240128084842.90d2600edc27.Id657ea2f0ddb131f5f9d0ac39aeb8c88754fe54b@changeid -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/net/wireless/intel/iwlwifi/fw/api/debug.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/debug.h b/drivers/net/wireless/intel/iwlwifi/fw/api/debug.h -index 7b18e098b125..8248c3beb18d 100644 ---- a/drivers/net/wireless/intel/iwlwifi/fw/api/debug.h -+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/debug.h -@@ -531,7 +531,7 @@ enum iwl_fw_dbg_config_cmd_type { - }; /* LDBG_CFG_CMD_TYPE_API_E_VER_1 */ - - /* this token disables debug asserts in the firmware */ --#define IWL_FW_DBG_CONFIG_TOKEN 0x00011301 -+#define IWL_FW_DBG_CONFIG_TOKEN 0x00010001 - - /** - * struct iwl_fw_dbg_config_cmd - configure FW debug --- -2.43.2 - -From 5f42b16f8656153da78e1f66744840e76e4465b1 Mon Sep 17 00:00:00 2001 -From: Jens Axboe <axboe@kernel.dk> -Date: Thu, 1 Feb 2024 06:42:36 -0700 -Subject: [PATCH 1477/1501] io_uring/net: fix sr->len for IORING_OP_RECV with - MSG_WAITALL and buffers -Content-Length: 1256 -Lines: 34 - -commit 72bd80252feeb3bef8724230ee15d9f7ab541c6e upstream. - -If we use IORING_OP_RECV with provided buffers and pass in '0' as the -length of the request, the length is retrieved from the selected buffer. -If MSG_WAITALL is also set and we get a short receive, then we may hit -the retry path which decrements sr->len and increments the buffer for -a retry. However, the length is still zero at this point, which means -that sr->len now becomes huge and import_ubuf() will cap it to -MAX_RW_COUNT and subsequently return -EFAULT for the range as a whole. - -Fix this by always assigning sr->len once the buffer has been selected. - -Cc: stable@vger.kernel.org -Fixes: 7ba89d2af17a ("io_uring: ensure recv and recvmsg handle MSG_WAITALL correctly") -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - io_uring/net.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/io_uring/net.c b/io_uring/net.c -index 75d494dad7e2..fb265c9dda5f 100644 ---- a/io_uring/net.c -+++ b/io_uring/net.c -@@ -902,6 +902,7 @@ int io_recv(struct io_kiocb *req, unsigned int issue_flags) - if (!buf) - return -ENOBUFS; - sr->buf = buf; -+ sr->len = len; - } - - ret = import_ubuf(ITER_DEST, sr->buf, len, &msg.msg_iter); --- -2.43.2 - -From 995d0204d94cea447184f5d1ab52a5fc2570a031 Mon Sep 17 00:00:00 2001 -From: Jens Axboe <axboe@kernel.dk> -Date: Mon, 29 Jan 2024 11:52:54 -0700 -Subject: [PATCH 1478/1501] io_uring/poll: move poll execution helpers higher - up -Content-Length: 1865 -Lines: 73 - -commit e84b01a880f635e3084a361afba41f95ff500d12 upstream. - -In preparation for calling __io_poll_execute() higher up, move the -functions to avoid forward declarations. - -No functional changes in this patch. - -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - io_uring/poll.c | 40 ++++++++++++++++++++-------------------- - 1 file changed, 20 insertions(+), 20 deletions(-) - -diff --git a/io_uring/poll.c b/io_uring/poll.c -index d59b74a99d4e..785a5b191003 100644 ---- a/io_uring/poll.c -+++ b/io_uring/poll.c -@@ -228,6 +228,26 @@ enum { - IOU_POLL_REISSUE = 3, - }; - -+static void __io_poll_execute(struct io_kiocb *req, int mask) -+{ -+ unsigned flags = 0; -+ -+ io_req_set_res(req, mask, 0); -+ req->io_task_work.func = io_poll_task_func; -+ -+ trace_io_uring_task_add(req, mask); -+ -+ if (!(req->flags & REQ_F_POLL_NO_LAZY)) -+ flags = IOU_F_TWQ_LAZY_WAKE; -+ __io_req_task_work_add(req, flags); -+} -+ -+static inline void io_poll_execute(struct io_kiocb *req, int res) -+{ -+ if (io_poll_get_ownership(req)) -+ __io_poll_execute(req, res); -+} -+ - /* - * All poll tw should go through this. Checks for poll events, manages - * references, does rewait, etc. -@@ -364,26 +384,6 @@ void io_poll_task_func(struct io_kiocb *req, struct io_tw_state *ts) - } - } - --static void __io_poll_execute(struct io_kiocb *req, int mask) --{ -- unsigned flags = 0; -- -- io_req_set_res(req, mask, 0); -- req->io_task_work.func = io_poll_task_func; -- -- trace_io_uring_task_add(req, mask); -- -- if (!(req->flags & REQ_F_POLL_NO_LAZY)) -- flags = IOU_F_TWQ_LAZY_WAKE; -- __io_req_task_work_add(req, flags); --} -- --static inline void io_poll_execute(struct io_kiocb *req, int res) --{ -- if (io_poll_get_ownership(req)) -- __io_poll_execute(req, res); --} -- - static void io_poll_cancel_req(struct io_kiocb *req) - { - io_poll_mark_cancelled(req); --- -2.43.2 - -From f43a63eb189afb3fa2d27e1350c0a4adb2298376 Mon Sep 17 00:00:00 2001 -From: Jens Axboe <axboe@kernel.dk> -Date: Mon, 29 Jan 2024 11:54:18 -0700 -Subject: [PATCH 1479/1501] io_uring/net: un-indent mshot retry path in - io_recv_finish() -Content-Length: 1928 -Lines: 64 - -commit 91e5d765a82fb2c9d0b7ad930d8953208081ddf1 upstream. - -In preparation for putting some retry logic in there, have the done -path just skip straight to the end rather than have too much nesting -in here. - -No functional changes in this patch. - -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - io_uring/net.c | 36 ++++++++++++++++++++---------------- - 1 file changed, 20 insertions(+), 16 deletions(-) - -diff --git a/io_uring/net.c b/io_uring/net.c -index fb265c9dda5f..5662733f5eed 100644 ---- a/io_uring/net.c -+++ b/io_uring/net.c -@@ -645,23 +645,27 @@ static inline bool io_recv_finish(struct io_kiocb *req, int *ret, - return true; - } - -- if (!mshot_finished) { -- if (io_fill_cqe_req_aux(req, issue_flags & IO_URING_F_COMPLETE_DEFER, -- *ret, cflags | IORING_CQE_F_MORE)) { -- io_recv_prep_retry(req); -- /* Known not-empty or unknown state, retry */ -- if (cflags & IORING_CQE_F_SOCK_NONEMPTY || -- msg->msg_inq == -1) -- return false; -- if (issue_flags & IO_URING_F_MULTISHOT) -- *ret = IOU_ISSUE_SKIP_COMPLETE; -- else -- *ret = -EAGAIN; -- return true; -- } -- /* Otherwise stop multishot but use the current result. */ -- } -+ if (mshot_finished) -+ goto finish; - -+ /* -+ * Fill CQE for this receive and see if we should keep trying to -+ * receive from this socket. -+ */ -+ if (io_fill_cqe_req_aux(req, issue_flags & IO_URING_F_COMPLETE_DEFER, -+ *ret, cflags | IORING_CQE_F_MORE)) { -+ io_recv_prep_retry(req); -+ /* Known not-empty or unknown state, retry */ -+ if (cflags & IORING_CQE_F_SOCK_NONEMPTY || msg->msg_inq == -1) -+ return false; -+ if (issue_flags & IO_URING_F_MULTISHOT) -+ *ret = IOU_ISSUE_SKIP_COMPLETE; -+ else -+ *ret = -EAGAIN; -+ return true; -+ } -+ /* Otherwise stop multishot but use the current result. */ -+finish: - io_req_set_res(req, *ret, cflags); - - if (issue_flags & IO_URING_F_MULTISHOT) --- -2.43.2 - -From 01960f151efbd8bed0c8b7cbbad1e8ac33d5daeb Mon Sep 17 00:00:00 2001 -From: Jens Axboe <axboe@kernel.dk> -Date: Sat, 27 Jan 2024 13:44:58 -0700 -Subject: [PATCH 1480/1501] io_uring/rw: ensure poll based multishot read - retries appropriately -Content-Length: 3207 -Lines: 88 - -commit c79f52f0656eeb3e4a12f7f358f760077ae111b6 upstream. - -io_read_mshot() always relies on poll triggering retries, and this works -fine as long as we do a retry per size of the buffer being read. The -buffer size is given by the size of the buffer(s) in the given buffer -group ID. - -But if we're reading less than what is available, then we don't always -get to read everything that is available. For example, if the buffers -available are 32 bytes and we have 64 bytes to read, then we'll -correctly read the first 32 bytes and then wait for another poll trigger -before we attempt the next read. This next poll trigger may never -happen, in which case we just sit forever and never make progress, or it -may trigger at some point in the future, and now we're just delivering -the available data much later than we should have. - -io_read_mshot() could do retries itself, but that is wasteful as we'll -be going through all of __io_read() again, and most likely in vain. -Rather than do that, bump our poll reference count and have -io_poll_check_events() do one more loop and check with vfs_poll() if we -have more data to read. If we do, io_read_mshot() will get invoked again -directly and we'll read the next chunk. - -io_poll_multishot_retry() must only get called from inside -io_poll_issue(), which is our multishot retry handler, as we know we -already "own" the request at this point. - -Cc: stable@vger.kernel.org -Link: https://github.com/axboe/liburing/issues/1041 -Fixes: fc68fcda0491 ("io_uring/rw: add support for IORING_OP_READ_MULTISHOT") -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - io_uring/poll.h | 9 +++++++++ - io_uring/rw.c | 10 +++++++++- - 2 files changed, 18 insertions(+), 1 deletion(-) - -diff --git a/io_uring/poll.h b/io_uring/poll.h -index ff4d5d753387..1dacae9e816c 100644 ---- a/io_uring/poll.h -+++ b/io_uring/poll.h -@@ -24,6 +24,15 @@ struct async_poll { - struct io_poll *double_poll; - }; - -+/* -+ * Must only be called inside issue_flags & IO_URING_F_MULTISHOT, or -+ * potentially other cases where we already "own" this poll request. -+ */ -+static inline void io_poll_multishot_retry(struct io_kiocb *req) -+{ -+ atomic_inc(&req->poll_refs); -+} -+ - int io_poll_add_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe); - int io_poll_add(struct io_kiocb *req, unsigned int issue_flags); - -diff --git a/io_uring/rw.c b/io_uring/rw.c -index 743732fba7a4..9394bf83e835 100644 ---- a/io_uring/rw.c -+++ b/io_uring/rw.c -@@ -18,6 +18,7 @@ - #include "opdef.h" - #include "kbuf.h" - #include "rsrc.h" -+#include "poll.h" - #include "rw.h" - - struct io_rw { -@@ -956,8 +957,15 @@ int io_read_mshot(struct io_kiocb *req, unsigned int issue_flags) - if (io_fill_cqe_req_aux(req, - issue_flags & IO_URING_F_COMPLETE_DEFER, - ret, cflags | IORING_CQE_F_MORE)) { -- if (issue_flags & IO_URING_F_MULTISHOT) -+ if (issue_flags & IO_URING_F_MULTISHOT) { -+ /* -+ * Force retry, as we might have more data to -+ * be read and otherwise it won't get retried -+ * until (if ever) another poll is triggered. -+ */ -+ io_poll_multishot_retry(req); - return IOU_ISSUE_SKIP_COMPLETE; -+ } - return -EAGAIN; - } - } --- -2.43.2 - -From ef90508574d7af48420bdc5f7b9a4f1cdd26bc70 Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan+linaro@kernel.org> -Date: Tue, 30 Jan 2024 11:02:43 +0100 -Subject: [PATCH 1481/1501] PCI/ASPM: Fix deadlock when enabling ASPM -Content-Length: 14886 -Lines: 400 - -commit 1e560864159d002b453da42bd2c13a1805515a20 upstream. - -A last minute revert in 6.7-final introduced a potential deadlock when -enabling ASPM during probe of Qualcomm PCIe controllers as reported by -lockdep: - - ============================================ - WARNING: possible recursive locking detected - 6.7.0 #40 Not tainted - -------------------------------------------- - kworker/u16:5/90 is trying to acquire lock: - ffffacfa78ced000 (pci_bus_sem){++++}-{3:3}, at: pcie_aspm_pm_state_change+0x58/0xdc - - but task is already holding lock: - ffffacfa78ced000 (pci_bus_sem){++++}-{3:3}, at: pci_walk_bus+0x34/0xbc - - other info that might help us debug this: - Possible unsafe locking scenario: - - CPU0 - ---- - lock(pci_bus_sem); - lock(pci_bus_sem); - - *** DEADLOCK *** - - Call trace: - print_deadlock_bug+0x25c/0x348 - __lock_acquire+0x10a4/0x2064 - lock_acquire+0x1e8/0x318 - down_read+0x60/0x184 - pcie_aspm_pm_state_change+0x58/0xdc - pci_set_full_power_state+0xa8/0x114 - pci_set_power_state+0xc4/0x120 - qcom_pcie_enable_aspm+0x1c/0x3c [pcie_qcom] - pci_walk_bus+0x64/0xbc - qcom_pcie_host_post_init_2_7_0+0x28/0x34 [pcie_qcom] - -The deadlock can easily be reproduced on machines like the Lenovo ThinkPad -X13s by adding a delay to increase the race window during asynchronous -probe where another thread can take a write lock. - -Add a new pci_set_power_state_locked() and associated helper functions that -can be called with the PCI bus semaphore held to avoid taking the read lock -twice. - -Link: https://lore.kernel.org/r/ZZu0qx2cmn7IwTyQ@hovoldconsulting.com -Link: https://lore.kernel.org/r/20240130100243.11011-1-johan+linaro@kernel.org -Fixes: f93e71aea6c6 ("Revert "PCI/ASPM: Remove pcie_aspm_pm_state_change()"") -Signed-off-by: Johan Hovold <johan+linaro@kernel.org> -Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> -Cc: <stable@vger.kernel.org> # 6.7 -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/pci/bus.c | 49 ++++++++++------ - drivers/pci/controller/dwc/pcie-qcom.c | 2 +- - drivers/pci/pci.c | 78 +++++++++++++++++--------- - drivers/pci/pci.h | 4 +- - drivers/pci/pcie/aspm.c | 13 +++-- - include/linux/pci.h | 5 ++ - 6 files changed, 101 insertions(+), 50 deletions(-) - -diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c -index 9c2137dae429..826b5016a101 100644 ---- a/drivers/pci/bus.c -+++ b/drivers/pci/bus.c -@@ -386,21 +386,8 @@ void pci_bus_add_devices(const struct pci_bus *bus) - } - EXPORT_SYMBOL(pci_bus_add_devices); - --/** pci_walk_bus - walk devices on/under bus, calling callback. -- * @top bus whose devices should be walked -- * @cb callback to be called for each device found -- * @userdata arbitrary pointer to be passed to callback. -- * -- * Walk the given bus, including any bridged devices -- * on buses under this bus. Call the provided callback -- * on each device found. -- * -- * We check the return of @cb each time. If it returns anything -- * other than 0, we break out. -- * -- */ --void pci_walk_bus(struct pci_bus *top, int (*cb)(struct pci_dev *, void *), -- void *userdata) -+static void __pci_walk_bus(struct pci_bus *top, int (*cb)(struct pci_dev *, void *), -+ void *userdata, bool locked) - { - struct pci_dev *dev; - struct pci_bus *bus; -@@ -408,7 +395,8 @@ void pci_walk_bus(struct pci_bus *top, int (*cb)(struct pci_dev *, void *), - int retval; - - bus = top; -- down_read(&pci_bus_sem); -+ if (!locked) -+ down_read(&pci_bus_sem); - next = top->devices.next; - for (;;) { - if (next == &bus->devices) { -@@ -431,10 +419,37 @@ void pci_walk_bus(struct pci_bus *top, int (*cb)(struct pci_dev *, void *), - if (retval) - break; - } -- up_read(&pci_bus_sem); -+ if (!locked) -+ up_read(&pci_bus_sem); -+} -+ -+/** -+ * pci_walk_bus - walk devices on/under bus, calling callback. -+ * @top: bus whose devices should be walked -+ * @cb: callback to be called for each device found -+ * @userdata: arbitrary pointer to be passed to callback -+ * -+ * Walk the given bus, including any bridged devices -+ * on buses under this bus. Call the provided callback -+ * on each device found. -+ * -+ * We check the return of @cb each time. If it returns anything -+ * other than 0, we break out. -+ */ -+void pci_walk_bus(struct pci_bus *top, int (*cb)(struct pci_dev *, void *), void *userdata) -+{ -+ __pci_walk_bus(top, cb, userdata, false); - } - EXPORT_SYMBOL_GPL(pci_walk_bus); - -+void pci_walk_bus_locked(struct pci_bus *top, int (*cb)(struct pci_dev *, void *), void *userdata) -+{ -+ lockdep_assert_held(&pci_bus_sem); -+ -+ __pci_walk_bus(top, cb, userdata, true); -+} -+EXPORT_SYMBOL_GPL(pci_walk_bus_locked); -+ - struct pci_bus *pci_bus_get(struct pci_bus *bus) - { - if (bus) -diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c -index 11c80555d975..cbc3f0881770 100644 ---- a/drivers/pci/controller/dwc/pcie-qcom.c -+++ b/drivers/pci/controller/dwc/pcie-qcom.c -@@ -972,7 +972,7 @@ static int qcom_pcie_enable_aspm(struct pci_dev *pdev, void *userdata) - * Downstream devices need to be in D0 state before enabling PCI PM - * substates. - */ -- pci_set_power_state(pdev, PCI_D0); -+ pci_set_power_state_locked(pdev, PCI_D0); - pci_enable_link_state_locked(pdev, PCIE_LINK_STATE_ALL); - - return 0; -diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c -index bdbf8a94b4d0..b2000b14faa0 100644 ---- a/drivers/pci/pci.c -+++ b/drivers/pci/pci.c -@@ -1291,6 +1291,7 @@ int pci_power_up(struct pci_dev *dev) - /** - * pci_set_full_power_state - Put a PCI device into D0 and update its state - * @dev: PCI device to power up -+ * @locked: whether pci_bus_sem is held - * - * Call pci_power_up() to put @dev into D0, read from its PCI_PM_CTRL register - * to confirm the state change, restore its BARs if they might be lost and -@@ -1300,7 +1301,7 @@ int pci_power_up(struct pci_dev *dev) - * to D0, it is more efficient to use pci_power_up() directly instead of this - * function. - */ --static int pci_set_full_power_state(struct pci_dev *dev) -+static int pci_set_full_power_state(struct pci_dev *dev, bool locked) - { - u16 pmcsr; - int ret; -@@ -1336,7 +1337,7 @@ static int pci_set_full_power_state(struct pci_dev *dev) - } - - if (dev->bus->self) -- pcie_aspm_pm_state_change(dev->bus->self); -+ pcie_aspm_pm_state_change(dev->bus->self, locked); - - return 0; - } -@@ -1365,10 +1366,22 @@ void pci_bus_set_current_state(struct pci_bus *bus, pci_power_t state) - pci_walk_bus(bus, __pci_dev_set_current_state, &state); - } - -+static void __pci_bus_set_current_state(struct pci_bus *bus, pci_power_t state, bool locked) -+{ -+ if (!bus) -+ return; -+ -+ if (locked) -+ pci_walk_bus_locked(bus, __pci_dev_set_current_state, &state); -+ else -+ pci_walk_bus(bus, __pci_dev_set_current_state, &state); -+} -+ - /** - * pci_set_low_power_state - Put a PCI device into a low-power state. - * @dev: PCI device to handle. - * @state: PCI power state (D1, D2, D3hot) to put the device into. -+ * @locked: whether pci_bus_sem is held - * - * Use the device's PCI_PM_CTRL register to put it into a low-power state. - * -@@ -1379,7 +1392,7 @@ void pci_bus_set_current_state(struct pci_bus *bus, pci_power_t state) - * 0 if device already is in the requested state. - * 0 if device's power state has been successfully changed. - */ --static int pci_set_low_power_state(struct pci_dev *dev, pci_power_t state) -+static int pci_set_low_power_state(struct pci_dev *dev, pci_power_t state, bool locked) - { - u16 pmcsr; - -@@ -1433,29 +1446,12 @@ static int pci_set_low_power_state(struct pci_dev *dev, pci_power_t state) - pci_power_name(state)); - - if (dev->bus->self) -- pcie_aspm_pm_state_change(dev->bus->self); -+ pcie_aspm_pm_state_change(dev->bus->self, locked); - - return 0; - } - --/** -- * pci_set_power_state - Set the power state of a PCI device -- * @dev: PCI device to handle. -- * @state: PCI power state (D0, D1, D2, D3hot) to put the device into. -- * -- * Transition a device to a new power state, using the platform firmware and/or -- * the device's PCI PM registers. -- * -- * RETURN VALUE: -- * -EINVAL if the requested state is invalid. -- * -EIO if device does not support PCI PM or its PM capabilities register has a -- * wrong version, or device doesn't support the requested state. -- * 0 if the transition is to D1 or D2 but D1 and D2 are not supported. -- * 0 if device already is in the requested state. -- * 0 if the transition is to D3 but D3 is not supported. -- * 0 if device's power state has been successfully changed. -- */ --int pci_set_power_state(struct pci_dev *dev, pci_power_t state) -+static int __pci_set_power_state(struct pci_dev *dev, pci_power_t state, bool locked) - { - int error; - -@@ -1479,7 +1475,7 @@ int pci_set_power_state(struct pci_dev *dev, pci_power_t state) - return 0; - - if (state == PCI_D0) -- return pci_set_full_power_state(dev); -+ return pci_set_full_power_state(dev, locked); - - /* - * This device is quirked not to be put into D3, so don't put it in -@@ -1493,16 +1489,16 @@ int pci_set_power_state(struct pci_dev *dev, pci_power_t state) - * To put the device in D3cold, put it into D3hot in the native - * way, then put it into D3cold using platform ops. - */ -- error = pci_set_low_power_state(dev, PCI_D3hot); -+ error = pci_set_low_power_state(dev, PCI_D3hot, locked); - - if (pci_platform_power_transition(dev, PCI_D3cold)) - return error; - - /* Powering off a bridge may power off the whole hierarchy */ - if (dev->current_state == PCI_D3cold) -- pci_bus_set_current_state(dev->subordinate, PCI_D3cold); -+ __pci_bus_set_current_state(dev->subordinate, PCI_D3cold, locked); - } else { -- error = pci_set_low_power_state(dev, state); -+ error = pci_set_low_power_state(dev, state, locked); - - if (pci_platform_power_transition(dev, state)) - return error; -@@ -1510,8 +1506,38 @@ int pci_set_power_state(struct pci_dev *dev, pci_power_t state) - - return 0; - } -+ -+/** -+ * pci_set_power_state - Set the power state of a PCI device -+ * @dev: PCI device to handle. -+ * @state: PCI power state (D0, D1, D2, D3hot) to put the device into. -+ * -+ * Transition a device to a new power state, using the platform firmware and/or -+ * the device's PCI PM registers. -+ * -+ * RETURN VALUE: -+ * -EINVAL if the requested state is invalid. -+ * -EIO if device does not support PCI PM or its PM capabilities register has a -+ * wrong version, or device doesn't support the requested state. -+ * 0 if the transition is to D1 or D2 but D1 and D2 are not supported. -+ * 0 if device already is in the requested state. -+ * 0 if the transition is to D3 but D3 is not supported. -+ * 0 if device's power state has been successfully changed. -+ */ -+int pci_set_power_state(struct pci_dev *dev, pci_power_t state) -+{ -+ return __pci_set_power_state(dev, state, false); -+} - EXPORT_SYMBOL(pci_set_power_state); - -+int pci_set_power_state_locked(struct pci_dev *dev, pci_power_t state) -+{ -+ lockdep_assert_held(&pci_bus_sem); -+ -+ return __pci_set_power_state(dev, state, true); -+} -+EXPORT_SYMBOL(pci_set_power_state_locked); -+ - #define PCI_EXP_SAVE_REGS 7 - - static struct pci_cap_saved_state *_pci_find_saved_cap(struct pci_dev *pci_dev, -diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h -index c6283ba78197..24ae29f0d36d 100644 ---- a/drivers/pci/pci.h -+++ b/drivers/pci/pci.h -@@ -569,12 +569,12 @@ int pcie_retrain_link(struct pci_dev *pdev, bool use_lt); - #ifdef CONFIG_PCIEASPM - void pcie_aspm_init_link_state(struct pci_dev *pdev); - void pcie_aspm_exit_link_state(struct pci_dev *pdev); --void pcie_aspm_pm_state_change(struct pci_dev *pdev); -+void pcie_aspm_pm_state_change(struct pci_dev *pdev, bool locked); - void pcie_aspm_powersave_config_link(struct pci_dev *pdev); - #else - static inline void pcie_aspm_init_link_state(struct pci_dev *pdev) { } - static inline void pcie_aspm_exit_link_state(struct pci_dev *pdev) { } --static inline void pcie_aspm_pm_state_change(struct pci_dev *pdev) { } -+static inline void pcie_aspm_pm_state_change(struct pci_dev *pdev, bool locked) { } - static inline void pcie_aspm_powersave_config_link(struct pci_dev *pdev) { } - #endif - -diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c -index 060f4b3c8698..eb2c77d522cb 100644 ---- a/drivers/pci/pcie/aspm.c -+++ b/drivers/pci/pcie/aspm.c -@@ -1008,8 +1008,11 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) - up_read(&pci_bus_sem); - } - --/* @pdev: the root port or switch downstream port */ --void pcie_aspm_pm_state_change(struct pci_dev *pdev) -+/* -+ * @pdev: the root port or switch downstream port -+ * @locked: whether pci_bus_sem is held -+ */ -+void pcie_aspm_pm_state_change(struct pci_dev *pdev, bool locked) - { - struct pcie_link_state *link = pdev->link_state; - -@@ -1019,12 +1022,14 @@ void pcie_aspm_pm_state_change(struct pci_dev *pdev) - * Devices changed PM state, we should recheck if latency - * meets all functions' requirement - */ -- down_read(&pci_bus_sem); -+ if (!locked) -+ down_read(&pci_bus_sem); - mutex_lock(&aspm_lock); - pcie_update_aspm_capable(link->root); - pcie_config_aspm_path(link); - mutex_unlock(&aspm_lock); -- up_read(&pci_bus_sem); -+ if (!locked) -+ up_read(&pci_bus_sem); - } - - void pcie_aspm_powersave_config_link(struct pci_dev *pdev) -diff --git a/include/linux/pci.h b/include/linux/pci.h -index bc80960fad7c..675937a5bd7c 100644 ---- a/include/linux/pci.h -+++ b/include/linux/pci.h -@@ -1417,6 +1417,7 @@ int pci_load_and_free_saved_state(struct pci_dev *dev, - struct pci_saved_state **state); - int pci_platform_power_transition(struct pci_dev *dev, pci_power_t state); - int pci_set_power_state(struct pci_dev *dev, pci_power_t state); -+int pci_set_power_state_locked(struct pci_dev *dev, pci_power_t state); - pci_power_t pci_choose_state(struct pci_dev *dev, pm_message_t state); - bool pci_pme_capable(struct pci_dev *dev, pci_power_t state); - void pci_pme_active(struct pci_dev *dev, bool enable); -@@ -1620,6 +1621,8 @@ int pci_scan_bridge(struct pci_bus *bus, struct pci_dev *dev, int max, - - void pci_walk_bus(struct pci_bus *top, int (*cb)(struct pci_dev *, void *), - void *userdata); -+void pci_walk_bus_locked(struct pci_bus *top, int (*cb)(struct pci_dev *, void *), -+ void *userdata); - int pci_cfg_space_size(struct pci_dev *dev); - unsigned char pci_bus_max_busnr(struct pci_bus *bus); - void pci_setup_bridge(struct pci_bus *bus); -@@ -2019,6 +2022,8 @@ static inline int pci_save_state(struct pci_dev *dev) { return 0; } - static inline void pci_restore_state(struct pci_dev *dev) { } - static inline int pci_set_power_state(struct pci_dev *dev, pci_power_t state) - { return 0; } -+static inline int pci_set_power_state_locked(struct pci_dev *dev, pci_power_t state) -+{ return 0; } - static inline int pci_wake_from_d3(struct pci_dev *dev, bool enable) - { return 0; } - static inline pci_power_t pci_choose_state(struct pci_dev *dev, --- -2.43.2 - -From 9b9a2f1a67f26a3ed66e672b7bad8f369a4b4a02 Mon Sep 17 00:00:00 2001 -From: Al Viro <viro@zeniv.linux.org.uk> -Date: Wed, 15 Nov 2023 22:41:27 -0500 -Subject: [PATCH 1482/1501] new helper: user_path_locked_at() -Content-Length: 2658 -Lines: 70 - -commit 74d016ecc1a7974664e98d1afbf649cd4e0e0423 upstream. - -Equivalent of kern_path_locked() taking dfd/userland name. -User introduced in the next commit. - -Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/namei.c | 16 +++++++++++++--- - include/linux/namei.h | 1 + - 2 files changed, 14 insertions(+), 3 deletions(-) - -diff --git a/fs/namei.c b/fs/namei.c -index 29bafbdb44ca..c981dec3c582 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -2573,13 +2573,13 @@ static int filename_parentat(int dfd, struct filename *name, - } - - /* does lookup, returns the object with parent locked */ --static struct dentry *__kern_path_locked(struct filename *name, struct path *path) -+static struct dentry *__kern_path_locked(int dfd, struct filename *name, struct path *path) - { - struct dentry *d; - struct qstr last; - int type, error; - -- error = filename_parentat(AT_FDCWD, name, 0, path, &last, &type); -+ error = filename_parentat(dfd, name, 0, path, &last, &type); - if (error) - return ERR_PTR(error); - if (unlikely(type != LAST_NORM)) { -@@ -2598,12 +2598,22 @@ static struct dentry *__kern_path_locked(struct filename *name, struct path *pat - struct dentry *kern_path_locked(const char *name, struct path *path) - { - struct filename *filename = getname_kernel(name); -- struct dentry *res = __kern_path_locked(filename, path); -+ struct dentry *res = __kern_path_locked(AT_FDCWD, filename, path); - - putname(filename); - return res; - } - -+struct dentry *user_path_locked_at(int dfd, const char __user *name, struct path *path) -+{ -+ struct filename *filename = getname(name); -+ struct dentry *res = __kern_path_locked(dfd, filename, path); -+ -+ putname(filename); -+ return res; -+} -+EXPORT_SYMBOL(user_path_locked_at); -+ - int kern_path(const char *name, unsigned int flags, struct path *path) - { - struct filename *filename = getname_kernel(name); -diff --git a/include/linux/namei.h b/include/linux/namei.h -index 3100371b5e32..74e0cc14ebf8 100644 ---- a/include/linux/namei.h -+++ b/include/linux/namei.h -@@ -66,6 +66,7 @@ extern struct dentry *kern_path_create(int, const char *, struct path *, unsigne - extern struct dentry *user_path_create(int, const char __user *, struct path *, unsigned int); - extern void done_path_create(struct path *, struct dentry *); - extern struct dentry *kern_path_locked(const char *, struct path *); -+extern struct dentry *user_path_locked_at(int , const char __user *, struct path *); - int vfs_path_parent_lookup(struct filename *filename, unsigned int flags, - struct path *parent, struct qstr *last, int *type, - const struct path *root); --- -2.43.2 - -From dc610c441b0e072ee01abf8910fda350df5136fa Mon Sep 17 00:00:00 2001 -From: Al Viro <viro@zeniv.linux.org.uk> -Date: Tue, 14 Nov 2023 18:52:42 -0500 -Subject: [PATCH 1483/1501] bch2_ioctl_subvolume_destroy(): fix locking -Content-Length: 1827 -Lines: 68 - -commit bbe6a7c899e7f265c5a6d01a178336a405e98ed6 upstream. - -make it use user_path_locked_at() to get the normal directory protection -for modifications, as well as stable ->d_parent and ->d_name in victim - -Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/bcachefs/fs-ioctl.c | 31 +++++++++++++++++-------------- - 1 file changed, 17 insertions(+), 14 deletions(-) - -diff --git a/fs/bcachefs/fs-ioctl.c b/fs/bcachefs/fs-ioctl.c -index 14d5cc6f90d7..1b9298dc8717 100644 ---- a/fs/bcachefs/fs-ioctl.c -+++ b/fs/bcachefs/fs-ioctl.c -@@ -451,33 +451,36 @@ static long bch2_ioctl_subvolume_create(struct bch_fs *c, struct file *filp, - static long bch2_ioctl_subvolume_destroy(struct bch_fs *c, struct file *filp, - struct bch_ioctl_subvolume arg) - { -+ const char __user *name = (void __user *)(unsigned long)arg.dst_ptr; - struct path path; - struct inode *dir; -+ struct dentry *victim; - int ret = 0; - - if (arg.flags) - return -EINVAL; - -- ret = user_path_at(arg.dirfd, -- (const char __user *)(unsigned long)arg.dst_ptr, -- LOOKUP_FOLLOW, &path); -- if (ret) -- return ret; -+ victim = user_path_locked_at(arg.dirfd, name, &path); -+ if (IS_ERR(victim)) -+ return PTR_ERR(victim); - -- if (path.dentry->d_sb->s_fs_info != c) { -+ if (victim->d_sb->s_fs_info != c) { - ret = -EXDEV; - goto err; - } -- -- dir = path.dentry->d_parent->d_inode; -- -- ret = __bch2_unlink(dir, path.dentry, true); -- if (ret) -+ if (!d_is_positive(victim)) { -+ ret = -ENOENT; - goto err; -- -- fsnotify_rmdir(dir, path.dentry); -- d_delete(path.dentry); -+ } -+ dir = d_inode(path.dentry); -+ ret = __bch2_unlink(dir, victim, true); -+ if (!ret) { -+ fsnotify_rmdir(dir, victim); -+ d_delete(victim); -+ } -+ inode_unlock(dir); - err: -+ dput(victim); - path_put(&path); - return ret; - } --- -2.43.2 - -From f114cfc8083a50f457c94eea43de4e56bab98cb0 Mon Sep 17 00:00:00 2001 -From: Kent Overstreet <kent.overstreet@linux.dev> -Date: Mon, 15 Jan 2024 14:12:43 -0500 -Subject: [PATCH 1484/1501] bcachefs: Don't pass memcmp() as a pointer -Content-Length: 1607 -Lines: 48 - -commit 0124f42da70c513dc371b73688663c54e5a9666f upstream. - -Some (buggy!) compilers have issues with this. - -Fixes: https://github.com/koverstreet/bcachefs/issues/625 -Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/bcachefs/replicas.c | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - -diff --git a/fs/bcachefs/replicas.c b/fs/bcachefs/replicas.c -index 2008fe8bf706..1c4a8f5c92c6 100644 ---- a/fs/bcachefs/replicas.c -+++ b/fs/bcachefs/replicas.c -@@ -9,6 +9,12 @@ - static int bch2_cpu_replicas_to_sb_replicas(struct bch_fs *, - struct bch_replicas_cpu *); - -+/* Some (buggy!) compilers don't allow memcmp to be passed as a pointer */ -+static int bch2_memcmp(const void *l, const void *r, size_t size) -+{ -+ return memcmp(l, r, size); -+} -+ - /* Replicas tracking - in memory: */ - - static void verify_replicas_entry(struct bch_replicas_entry *e) -@@ -33,7 +39,7 @@ void bch2_replicas_entry_sort(struct bch_replicas_entry *e) - - static void bch2_cpu_replicas_sort(struct bch_replicas_cpu *r) - { -- eytzinger0_sort(r->entries, r->nr, r->entry_size, memcmp, NULL); -+ eytzinger0_sort(r->entries, r->nr, r->entry_size, bch2_memcmp, NULL); - } - - static void bch2_replicas_entry_v0_to_text(struct printbuf *out, -@@ -833,7 +839,7 @@ static int bch2_cpu_replicas_validate(struct bch_replicas_cpu *cpu_r, - sort_cmp_size(cpu_r->entries, - cpu_r->nr, - cpu_r->entry_size, -- memcmp, NULL); -+ bch2_memcmp, NULL); - - for (i = 0; i < cpu_r->nr; i++) { - struct bch_replicas_entry *e = --- -2.43.2 - -From 6763051bea3a316c2043a3b66246010391def00a Mon Sep 17 00:00:00 2001 -From: Daniel Hill <daniel@gluo.nz> -Date: Sun, 26 Nov 2023 19:33:31 +1300 -Subject: [PATCH 1485/1501] bcachefs: rebalance should wakeup on shutdown if - disabled -Content-Length: 2245 -Lines: 61 - -commit 0c069781ddfa4e31c169a8eced1ee90b8929d522 upstream. - -Signed-off-by: Daniel Hill <daniel@gluo.nz> -Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/bcachefs/move.c | 2 +- - fs/bcachefs/move.h | 1 + - fs/bcachefs/rebalance.c | 12 ++++++++++-- - 3 files changed, 12 insertions(+), 3 deletions(-) - -diff --git a/fs/bcachefs/move.c b/fs/bcachefs/move.c -index 54830ee0ed88..f3dac4511af1 100644 ---- a/fs/bcachefs/move.c -+++ b/fs/bcachefs/move.c -@@ -152,7 +152,7 @@ void bch2_move_ctxt_wait_for_io(struct moving_context *ctxt) - atomic_read(&ctxt->write_sectors) != sectors_pending); - } - --static void bch2_moving_ctxt_flush_all(struct moving_context *ctxt) -+void bch2_moving_ctxt_flush_all(struct moving_context *ctxt) - { - move_ctxt_wait_event(ctxt, list_empty(&ctxt->reads)); - bch2_trans_unlock_long(ctxt->trans); -diff --git a/fs/bcachefs/move.h b/fs/bcachefs/move.h -index 0906aa2d1de2..c5a7aed2e1ae 100644 ---- a/fs/bcachefs/move.h -+++ b/fs/bcachefs/move.h -@@ -81,6 +81,7 @@ void bch2_moving_ctxt_init(struct moving_context *, struct bch_fs *, - struct write_point_specifier, bool); - struct moving_io *bch2_moving_ctxt_next_pending_write(struct moving_context *); - void bch2_moving_ctxt_do_pending_writes(struct moving_context *); -+void bch2_moving_ctxt_flush_all(struct moving_context *); - void bch2_move_ctxt_wait_for_io(struct moving_context *); - int bch2_move_ratelimit(struct moving_context *); - -diff --git a/fs/bcachefs/rebalance.c b/fs/bcachefs/rebalance.c -index 3319190b8d9c..ba2606a067d0 100644 ---- a/fs/bcachefs/rebalance.c -+++ b/fs/bcachefs/rebalance.c -@@ -317,8 +317,16 @@ static int do_rebalance(struct moving_context *ctxt) - BTREE_ID_rebalance_work, POS_MIN, - BTREE_ITER_ALL_SNAPSHOTS); - -- while (!bch2_move_ratelimit(ctxt) && -- !kthread_wait_freezable(r->enabled)) { -+ while (!bch2_move_ratelimit(ctxt)) { -+ if (!r->enabled) { -+ bch2_moving_ctxt_flush_all(ctxt); -+ kthread_wait_freezable(r->enabled || -+ kthread_should_stop()); -+ } -+ -+ if (kthread_should_stop()) -+ break; -+ - bch2_trans_begin(trans); - - ret = bkey_err(k = next_rebalance_entry(trans, &rebalance_work_iter)); --- -2.43.2 - -From 9a269387a0a962f9eb7c5974409ec6cdb390fc50 Mon Sep 17 00:00:00 2001 -From: Kent Overstreet <kent.overstreet@linux.dev> -Date: Mon, 15 Jan 2024 15:06:43 -0500 -Subject: [PATCH 1486/1501] bcachefs: Add missing bch2_moving_ctxt_flush_all() -Content-Length: 835 -Lines: 25 - -commit ef740a1e2939376ea4cc11cc8b923214dc1f4a41 upstream. - -This fixes a bug with rebalance IOs getting stuck with reads completed, -but writes never being issued. - -Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/bcachefs/rebalance.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/fs/bcachefs/rebalance.c b/fs/bcachefs/rebalance.c -index ba2606a067d0..dd6fed258100 100644 ---- a/fs/bcachefs/rebalance.c -+++ b/fs/bcachefs/rebalance.c -@@ -356,6 +356,7 @@ static int do_rebalance(struct moving_context *ctxt) - !kthread_should_stop() && - !atomic64_read(&r->work_stats.sectors_seen) && - !atomic64_read(&r->scan_stats.sectors_seen)) { -+ bch2_moving_ctxt_flush_all(ctxt); - bch2_trans_unlock_long(trans); - rebalance_wait(c); - } --- -2.43.2 - -From a12bbb494faea1625e96768a0caa9c7ab67517d4 Mon Sep 17 00:00:00 2001 -From: Kent Overstreet <kent.overstreet@linux.dev> -Date: Mon, 15 Jan 2024 14:15:26 -0500 -Subject: [PATCH 1487/1501] bcachefs: bch2_kthread_io_clock_wait() no longer - sleeps until full amount -Content-Length: 1228 -Lines: 39 - -commit d92b83f592d810aded2e5f90db5f560cc8cf577b upstream. - -Drop t he loop in bch2_kthread_io_clock_wait(): this allows the code -that uses it to be woken up for other reasons, and fixes a bug where -rebalance wouldn't wake up when a scan was requested. - -This raises the possibility of spurious wakeups, but callers should -always be able to handle that reasonably well. - -Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/bcachefs/clock.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/fs/bcachefs/clock.c b/fs/bcachefs/clock.c -index f41889093a2c..363644451106 100644 ---- a/fs/bcachefs/clock.c -+++ b/fs/bcachefs/clock.c -@@ -109,7 +109,7 @@ void bch2_kthread_io_clock_wait(struct io_clock *clock, - if (cpu_timeout != MAX_SCHEDULE_TIMEOUT) - mod_timer(&wait.cpu_timer, cpu_timeout + jiffies); - -- while (1) { -+ do { - set_current_state(TASK_INTERRUPTIBLE); - if (kthread && kthread_should_stop()) - break; -@@ -119,7 +119,7 @@ void bch2_kthread_io_clock_wait(struct io_clock *clock, - - schedule(); - try_to_freeze(); -- } -+ } while (0); - - __set_current_state(TASK_RUNNING); - del_timer_sync(&wait.cpu_timer); --- -2.43.2 - -From 56590678791119b9a655202e49898edfb9307271 Mon Sep 17 00:00:00 2001 -From: Su Yue <glass.su@suse.com> -Date: Tue, 16 Jan 2024 19:05:37 +0800 -Subject: [PATCH 1488/1501] bcachefs: kvfree bch_fs::snapshots in - bch2_fs_snapshots_exit -Content-Length: 3226 -Lines: 66 - -commit 369acf97d6fd5da620d053d0f1878ffe32eff555 upstream. - -bch_fs::snapshots is allocated by kvzalloc in __snapshot_t_mut. -It should be freed by kvfree not kfree. -Or umount will triger: - -[ 406.829178 ] BUG: unable to handle page fault for address: ffffe7b487148008 -[ 406.830676 ] #PF: supervisor read access in kernel mode -[ 406.831643 ] #PF: error_code(0x0000) - not-present page -[ 406.832487 ] PGD 0 P4D 0 -[ 406.832898 ] Oops: 0000 [#1] PREEMPT SMP PTI -[ 406.833512 ] CPU: 2 PID: 1754 Comm: umount Kdump: loaded Tainted: G OE 6.7.0-rc7-custom+ #90 -[ 406.834746 ] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 -[ 406.835796 ] RIP: 0010:kfree+0x62/0x140 -[ 406.836197 ] Code: 80 48 01 d8 0f 82 e9 00 00 00 48 c7 c2 00 00 00 80 48 2b 15 78 9f 1f 01 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 56 9f 1f 01 <48> 8b 50 08 48 89 c7 f6 c2 01 0f 85 b0 00 00 00 66 90 48 8b 07 f6 -[ 406.837810 ] RSP: 0018:ffffb9d641607e48 EFLAGS: 00010286 -[ 406.838213 ] RAX: ffffe7b487148000 RBX: ffffb9d645200000 RCX: ffffb9d641607dc4 -[ 406.838738 ] RDX: 000065bb00000000 RSI: ffffffffc0d88b84 RDI: ffffb9d645200000 -[ 406.839217 ] RBP: ffff9a4625d00068 R08: 0000000000000001 R09: 0000000000000001 -[ 406.839650 ] R10: 0000000000000001 R11: 000000000000001f R12: ffff9a4625d4da80 -[ 406.840055 ] R13: ffff9a4625d00000 R14: ffffffffc0e2eb20 R15: 0000000000000000 -[ 406.840451 ] FS: 00007f0a264ffb80(0000) GS:ffff9a4e2d500000(0000) knlGS:0000000000000000 -[ 406.840851 ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -[ 406.841125 ] CR2: ffffe7b487148008 CR3: 000000018c4d2000 CR4: 00000000000006f0 -[ 406.841464 ] Call Trace: -[ 406.841583 ] <TASK> -[ 406.841682 ] ? __die+0x1f/0x70 -[ 406.841828 ] ? page_fault_oops+0x159/0x470 -[ 406.842014 ] ? fixup_exception+0x22/0x310 -[ 406.842198 ] ? exc_page_fault+0x1ed/0x200 -[ 406.842382 ] ? asm_exc_page_fault+0x22/0x30 -[ 406.842574 ] ? bch2_fs_release+0x54/0x280 [bcachefs] -[ 406.842842 ] ? kfree+0x62/0x140 -[ 406.842988 ] ? kfree+0x104/0x140 -[ 406.843138 ] bch2_fs_release+0x54/0x280 [bcachefs] -[ 406.843390 ] kobject_put+0xb7/0x170 -[ 406.843552 ] deactivate_locked_super+0x2f/0xa0 -[ 406.843756 ] cleanup_mnt+0xba/0x150 -[ 406.843917 ] task_work_run+0x59/0xa0 -[ 406.844083 ] exit_to_user_mode_prepare+0x197/0x1a0 -[ 406.844302 ] syscall_exit_to_user_mode+0x16/0x40 -[ 406.844510 ] do_syscall_64+0x4e/0xf0 -[ 406.844675 ] entry_SYSCALL_64_after_hwframe+0x6e/0x76 -[ 406.844907 ] RIP: 0033:0x7f0a2664e4fb - -Signed-off-by: Su Yue <glass.su@suse.com> -Reviewed-by: Brian Foster <bfoster@redhat.com> -Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/bcachefs/snapshot.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/fs/bcachefs/snapshot.c b/fs/bcachefs/snapshot.c -index 5dac038f0851..bf5d6f4e9abc 100644 ---- a/fs/bcachefs/snapshot.c -+++ b/fs/bcachefs/snapshot.c -@@ -1709,5 +1709,5 @@ int bch2_snapshots_read(struct bch_fs *c) - - void bch2_fs_snapshots_exit(struct bch_fs *c) - { -- kfree(rcu_dereference_protected(c->snapshots, true)); -+ kvfree(rcu_dereference_protected(c->snapshots, true)); - } --- -2.43.2 - -From 5b41d3fd04c6757b9c2a60a0c5b2609cae9999df Mon Sep 17 00:00:00 2001 -From: Su Yue <glass.su@suse.com> -Date: Mon, 15 Jan 2024 10:21:25 +0800 -Subject: [PATCH 1489/1501] bcachefs: grab s_umount only if snapshotting -Content-Length: 7225 -Lines: 181 - -commit 2acc59dd88d27ad69b66ded80df16c042b04eeec upstream. - -When I was testing mongodb over bcachefs with compression, -there is a lockdep warning when snapshotting mongodb data volume. - -$ cat test.sh -prog=bcachefs - -$prog subvolume create /mnt/data -$prog subvolume create /mnt/data/snapshots - -while true;do - $prog subvolume snapshot /mnt/data /mnt/data/snapshots/$(date +%s) - sleep 1s -done - -$ cat /etc/mongodb.conf -systemLog: - destination: file - logAppend: true - path: /mnt/data/mongod.log - -storage: - dbPath: /mnt/data/ - -lockdep reports: -[ 3437.452330] ====================================================== -[ 3437.452750] WARNING: possible circular locking dependency detected -[ 3437.453168] 6.7.0-rc7-custom+ #85 Tainted: G E -[ 3437.453562] ------------------------------------------------------ -[ 3437.453981] bcachefs/35533 is trying to acquire lock: -[ 3437.454325] ffffa0a02b2b1418 (sb_writers#10){.+.+}-{0:0}, at: filename_create+0x62/0x190 -[ 3437.454875] - but task is already holding lock: -[ 3437.455268] ffffa0a02b2b10e0 (&type->s_umount_key#48){.+.+}-{3:3}, at: bch2_fs_file_ioctl+0x232/0xc90 [bcachefs] -[ 3437.456009] - which lock already depends on the new lock. - -[ 3437.456553] - the existing dependency chain (in reverse order) is: -[ 3437.457054] - -> #3 (&type->s_umount_key#48){.+.+}-{3:3}: -[ 3437.457507] down_read+0x3e/0x170 -[ 3437.457772] bch2_fs_file_ioctl+0x232/0xc90 [bcachefs] -[ 3437.458206] __x64_sys_ioctl+0x93/0xd0 -[ 3437.458498] do_syscall_64+0x42/0xf0 -[ 3437.458779] entry_SYSCALL_64_after_hwframe+0x6e/0x76 -[ 3437.459155] - -> #2 (&c->snapshot_create_lock){++++}-{3:3}: -[ 3437.459615] down_read+0x3e/0x170 -[ 3437.459878] bch2_truncate+0x82/0x110 [bcachefs] -[ 3437.460276] bchfs_truncate+0x254/0x3c0 [bcachefs] -[ 3437.460686] notify_change+0x1f1/0x4a0 -[ 3437.461283] do_truncate+0x7f/0xd0 -[ 3437.461555] path_openat+0xa57/0xce0 -[ 3437.461836] do_filp_open+0xb4/0x160 -[ 3437.462116] do_sys_openat2+0x91/0xc0 -[ 3437.462402] __x64_sys_openat+0x53/0xa0 -[ 3437.462701] do_syscall_64+0x42/0xf0 -[ 3437.462982] entry_SYSCALL_64_after_hwframe+0x6e/0x76 -[ 3437.463359] - -> #1 (&sb->s_type->i_mutex_key#15){+.+.}-{3:3}: -[ 3437.463843] down_write+0x3b/0xc0 -[ 3437.464223] bch2_write_iter+0x5b/0xcc0 [bcachefs] -[ 3437.464493] vfs_write+0x21b/0x4c0 -[ 3437.464653] ksys_write+0x69/0xf0 -[ 3437.464839] do_syscall_64+0x42/0xf0 -[ 3437.465009] entry_SYSCALL_64_after_hwframe+0x6e/0x76 -[ 3437.465231] - -> #0 (sb_writers#10){.+.+}-{0:0}: -[ 3437.465471] __lock_acquire+0x1455/0x21b0 -[ 3437.465656] lock_acquire+0xc6/0x2b0 -[ 3437.465822] mnt_want_write+0x46/0x1a0 -[ 3437.465996] filename_create+0x62/0x190 -[ 3437.466175] user_path_create+0x2d/0x50 -[ 3437.466352] bch2_fs_file_ioctl+0x2ec/0xc90 [bcachefs] -[ 3437.466617] __x64_sys_ioctl+0x93/0xd0 -[ 3437.466791] do_syscall_64+0x42/0xf0 -[ 3437.466957] entry_SYSCALL_64_after_hwframe+0x6e/0x76 -[ 3437.467180] - other info that might help us debug this: - -[ 3437.469670] 2 locks held by bcachefs/35533: - other info that might help us debug this: - -[ 3437.467507] Chain exists of: - sb_writers#10 --> &c->snapshot_create_lock --> &type->s_umount_key#48 - -[ 3437.467979] Possible unsafe locking scenario: - -[ 3437.468223] CPU0 CPU1 -[ 3437.468405] ---- ---- -[ 3437.468585] rlock(&type->s_umount_key#48); -[ 3437.468758] lock(&c->snapshot_create_lock); -[ 3437.469030] lock(&type->s_umount_key#48); -[ 3437.469291] rlock(sb_writers#10); -[ 3437.469434] - *** DEADLOCK *** - -[ 3437.469670] 2 locks held by bcachefs/35533: -[ 3437.469838] #0: ffffa0a02ce00a88 (&c->snapshot_create_lock){++++}-{3:3}, at: bch2_fs_file_ioctl+0x1e3/0xc90 [bcachefs] -[ 3437.470294] #1: ffffa0a02b2b10e0 (&type->s_umount_key#48){.+.+}-{3:3}, at: bch2_fs_file_ioctl+0x232/0xc90 [bcachefs] -[ 3437.470744] - stack backtrace: -[ 3437.470922] CPU: 7 PID: 35533 Comm: bcachefs Kdump: loaded Tainted: G E 6.7.0-rc7-custom+ #85 -[ 3437.471313] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 -[ 3437.471694] Call Trace: -[ 3437.471795] <TASK> -[ 3437.471884] dump_stack_lvl+0x57/0x90 -[ 3437.472035] check_noncircular+0x132/0x150 -[ 3437.472202] __lock_acquire+0x1455/0x21b0 -[ 3437.472369] lock_acquire+0xc6/0x2b0 -[ 3437.472518] ? filename_create+0x62/0x190 -[ 3437.472683] ? lock_is_held_type+0x97/0x110 -[ 3437.472856] mnt_want_write+0x46/0x1a0 -[ 3437.473025] ? filename_create+0x62/0x190 -[ 3437.473204] filename_create+0x62/0x190 -[ 3437.473380] user_path_create+0x2d/0x50 -[ 3437.473555] bch2_fs_file_ioctl+0x2ec/0xc90 [bcachefs] -[ 3437.473819] ? lock_acquire+0xc6/0x2b0 -[ 3437.474002] ? __fget_files+0x2a/0x190 -[ 3437.474195] ? __fget_files+0xbc/0x190 -[ 3437.474380] ? lock_release+0xc5/0x270 -[ 3437.474567] ? __x64_sys_ioctl+0x93/0xd0 -[ 3437.474764] ? __pfx_bch2_fs_file_ioctl+0x10/0x10 [bcachefs] -[ 3437.475090] __x64_sys_ioctl+0x93/0xd0 -[ 3437.475277] do_syscall_64+0x42/0xf0 -[ 3437.475454] entry_SYSCALL_64_after_hwframe+0x6e/0x76 -[ 3437.475691] RIP: 0033:0x7f2743c313af -====================================================== - -In __bch2_ioctl_subvolume_create(), we grab s_umount unconditionally -and unlock it at the end of the function. There is a comment -"why do we need this lock?" about the lock coming from -commit 42d237320e98 ("bcachefs: Snapshot creation, deletion") -The reason is that __bch2_ioctl_subvolume_create() calls -sync_inodes_sb() which enforce locked s_umount to writeback all dirty -nodes before doing snapshot works. - -Fix it by read locking s_umount for snapshotting only and unlocking -s_umount after sync_inodes_sb(). - -Signed-off-by: Su Yue <glass.su@suse.com> -Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/bcachefs/fs-ioctl.c | 11 +++++------ - 1 file changed, 5 insertions(+), 6 deletions(-) - -diff --git a/fs/bcachefs/fs-ioctl.c b/fs/bcachefs/fs-ioctl.c -index 1b9298dc8717..99f157534404 100644 ---- a/fs/bcachefs/fs-ioctl.c -+++ b/fs/bcachefs/fs-ioctl.c -@@ -345,11 +345,12 @@ static long __bch2_ioctl_subvolume_create(struct bch_fs *c, struct file *filp, - if (arg.flags & BCH_SUBVOL_SNAPSHOT_RO) - create_flags |= BCH_CREATE_SNAPSHOT_RO; - -- /* why do we need this lock? */ -- down_read(&c->vfs_sb->s_umount); -- -- if (arg.flags & BCH_SUBVOL_SNAPSHOT_CREATE) -+ if (arg.flags & BCH_SUBVOL_SNAPSHOT_CREATE) { -+ /* sync_inodes_sb enforce s_umount is locked */ -+ down_read(&c->vfs_sb->s_umount); - sync_inodes_sb(c->vfs_sb); -+ up_read(&c->vfs_sb->s_umount); -+ } - retry: - if (arg.src_ptr) { - error = user_path_at(arg.dirfd, -@@ -433,8 +434,6 @@ static long __bch2_ioctl_subvolume_create(struct bch_fs *c, struct file *filp, - goto retry; - } - err1: -- up_read(&c->vfs_sb->s_umount); -- - return error; - } - --- -2.43.2 - -From 4571eb9bead1116305cb4910b224836770dce4bb Mon Sep 17 00:00:00 2001 -From: Christoph Hellwig <hch@lst.de> -Date: Thu, 11 Jan 2024 08:36:55 +0100 -Subject: [PATCH 1490/1501] bcachefs: fix incorrect usage of REQ_OP_FLUSH -Content-Length: 2150 -Lines: 61 - -commit 3e44f325f6f75078cdcd44cd337f517ba3650d05 upstream. - -REQ_OP_FLUSH is only for internal use in the blk-mq and request based -drivers. File systems and other block layer consumers must use -REQ_OP_WRITE | REQ_PREFLUSH as documented in -Documentation/block/writeback_cache_control.rst. - -While REQ_OP_FLUSH appears to work for blk-mq drivers it does not -get the proper flush state machine handling, and completely fails -for any bio based drivers, including all the stacking drivers. The -block layer will also get a check in 6.8 to reject this use case -entirely. - -[Note: completely untested, but as this never got fixed since the -original bug report in November: - - https://bugzilla.kernel.org/show_bug.cgi?id=218184 - -and the the discussion in December: - - https://lore.kernel.org/all/20231221053016.72cqcfg46vxwohcj@moria.home.lan/T/ - -this seems to be best way to force it] - -Signed-off-by: Christoph Hellwig <hch@lst.de> -Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/bcachefs/fs-io.c | 2 +- - fs/bcachefs/journal_io.c | 3 ++- - 2 files changed, 3 insertions(+), 2 deletions(-) - -diff --git a/fs/bcachefs/fs-io.c b/fs/bcachefs/fs-io.c -index b0e8144ec550..fffa1743dfd2 100644 ---- a/fs/bcachefs/fs-io.c -+++ b/fs/bcachefs/fs-io.c -@@ -79,7 +79,7 @@ void bch2_inode_flush_nocow_writes_async(struct bch_fs *c, - continue; - - bio = container_of(bio_alloc_bioset(ca->disk_sb.bdev, 0, -- REQ_OP_FLUSH, -+ REQ_OP_WRITE|REQ_PREFLUSH, - GFP_KERNEL, - &c->nocow_flush_bioset), - struct nocow_flush, bio); -diff --git a/fs/bcachefs/journal_io.c b/fs/bcachefs/journal_io.c -index 3eb6c3f62a81..6ab756a48535 100644 ---- a/fs/bcachefs/journal_io.c -+++ b/fs/bcachefs/journal_io.c -@@ -1948,7 +1948,8 @@ CLOSURE_CALLBACK(bch2_journal_write) - percpu_ref_get(&ca->io_ref); - - bio = ca->journal.bio; -- bio_reset(bio, ca->disk_sb.bdev, REQ_OP_FLUSH); -+ bio_reset(bio, ca->disk_sb.bdev, -+ REQ_OP_WRITE|REQ_PREFLUSH); - bio->bi_end_io = journal_write_endio; - bio->bi_private = ca; - closure_bio_submit(bio, cl); --- -2.43.2 - -From a18ae02db4d5a4129739bbe44396b0e946192d0a Mon Sep 17 00:00:00 2001 -From: Guoyu Ou <benogy@gmail.com> -Date: Sun, 28 Jan 2024 16:46:17 +0800 -Subject: [PATCH 1491/1501] bcachefs: unlock parent dir if entry is not found - in subvolume deletion -Content-Length: 1510 -Lines: 52 - -commit 6bb3f7f4c3f4da8e09de188f2f63e8f741bba3bd upstream. - -Parent dir is locked by user_path_locked_at() before validating the -required dentry. It should be unlocked if we can not perform the -deletion. - -This fixes the problem: - -$ bcachefs subvolume delete not-exist-entry -BCH_IOCTL_SUBVOLUME_DESTROY ioctl error: No such file or directory -$ bcachefs subvolume delete not-exist-entry - -the second will stuck because the parent dir is locked in the previous -deletion. - -Signed-off-by: Guoyu Ou <benogy@gmail.com> -Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/bcachefs/fs-ioctl.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/fs/bcachefs/fs-ioctl.c b/fs/bcachefs/fs-ioctl.c -index 99f157534404..dbc87747eaaf 100644 ---- a/fs/bcachefs/fs-ioctl.c -+++ b/fs/bcachefs/fs-ioctl.c -@@ -463,6 +463,7 @@ static long bch2_ioctl_subvolume_destroy(struct bch_fs *c, struct file *filp, - if (IS_ERR(victim)) - return PTR_ERR(victim); - -+ dir = d_inode(path.dentry); - if (victim->d_sb->s_fs_info != c) { - ret = -EXDEV; - goto err; -@@ -471,14 +472,13 @@ static long bch2_ioctl_subvolume_destroy(struct bch_fs *c, struct file *filp, - ret = -ENOENT; - goto err; - } -- dir = d_inode(path.dentry); - ret = __bch2_unlink(dir, victim, true); - if (!ret) { - fsnotify_rmdir(dir, victim); - d_delete(victim); - } -- inode_unlock(dir); - err: -+ inode_unlock(dir); - dput(victim); - path_put(&path); - return ret; --- -2.43.2 - -From 3183d7aa418b69462179016e711cc34a0220dc70 Mon Sep 17 00:00:00 2001 -From: Kent Overstreet <kent.overstreet@linux.dev> -Date: Thu, 1 Feb 2024 21:01:02 -0500 -Subject: [PATCH 1492/1501] bcachefs: time_stats: Check for last_event == 0 - when updating freq stats -Content-Length: 1155 -Lines: 34 - -commit 7b508b323b2ec45be59769bd4e4aeba729c52cf6 upstream. - -This fixes spurious outliers in the frequency stats. - -Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - fs/bcachefs/util.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/fs/bcachefs/util.c b/fs/bcachefs/util.c -index 84b142fcc3df..3b7c349f2665 100644 ---- a/fs/bcachefs/util.c -+++ b/fs/bcachefs/util.c -@@ -362,14 +362,15 @@ static inline void bch2_time_stats_update_one(struct bch2_time_stats *stats, - bch2_quantiles_update(&stats->quantiles, duration); - } - -- if (time_after64(end, stats->last_event)) { -+ if (stats->last_event && time_after64(end, stats->last_event)) { - freq = end - stats->last_event; - mean_and_variance_update(&stats->freq_stats, freq); - mean_and_variance_weighted_update(&stats->freq_stats_weighted, freq); - stats->max_freq = max(stats->max_freq, freq); - stats->min_freq = min(stats->min_freq, freq); -- stats->last_event = end; - } -+ -+ stats->last_event = end; - } - - static noinline void bch2_time_stats_clear_buffer(struct bch2_time_stats *stats, --- -2.43.2 - -From e8fd56fd42ebea41dd22c366967211be05d42d6f Mon Sep 17 00:00:00 2001 -From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Date: Tue, 13 Feb 2024 15:44:48 +0100 -Subject: [PATCH 1493/1501] Revert "ASoC: amd: Add new dmi entries for acp5x - platform" -Content-Length: 1529 -Lines: 49 - -This reverts commit 4b6986b170f2f23e390bbd2d50784caa9cb67093 which is -commit c3ab23a10771bbe06300e5374efa809789c65455 upstream. - -Link: https://lore.kernel.org/r/CAD_nV8BG0t7US=+C28kQOR==712MPfZ9m-fuKksgoZCgrEByCw@mail.gmail.com -Reported-by: Ted Chang <tedchang2010@gmail.com> -Cc: Takashi Iwai <tiwai@suse.de> -Cc: Venkata Prasad Potturu <venkataprasad.potturu@amd.com> -Cc: Mark Brown <broonie@kernel.org> -Cc: Sasha Levin <sashal@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - sound/soc/amd/acp-config.c | 15 +-------------- - 1 file changed, 1 insertion(+), 14 deletions(-) - -diff --git a/sound/soc/amd/acp-config.c b/sound/soc/amd/acp-config.c -index dea6d367b9e8..3bc4b2e41650 100644 ---- a/sound/soc/amd/acp-config.c -+++ b/sound/soc/amd/acp-config.c -@@ -3,7 +3,7 @@ - // This file is provided under a dual BSD/GPLv2 license. When using or - // redistributing this file, you may do so under either license. - // --// Copyright(c) 2021, 2023 Advanced Micro Devices, Inc. -+// Copyright(c) 2021 Advanced Micro Devices, Inc. - // - // Authors: Ajit Kumar Pandey <AjitKumar.Pandey@amd.com> - // -@@ -47,19 +47,6 @@ static const struct config_entry config_table[] = { - {} - }, - }, -- { -- .flags = FLAG_AMD_LEGACY, -- .device = ACP_PCI_DEV_ID, -- .dmi_table = (const struct dmi_system_id []) { -- { -- .matches = { -- DMI_MATCH(DMI_SYS_VENDOR, "Valve"), -- DMI_MATCH(DMI_PRODUCT_NAME, "Jupiter"), -- }, -- }, -- {} -- }, -- }, - { - .flags = FLAG_AMD_SOF, - .device = ACP_PCI_DEV_ID, --- -2.43.2 - -From 4023b7b210710dbd78949fac9f2332cd10887423 Mon Sep 17 00:00:00 2001 -From: Jens Axboe <axboe@kernel.dk> -Date: Mon, 29 Jan 2024 11:57:11 -0700 -Subject: [PATCH 1494/1501] io_uring/poll: add requeue return code from poll - multishot handling -Content-Length: 2433 -Lines: 75 - -Commit 704ea888d646cb9d715662944cf389c823252ee0 upstream. - -Since our poll handling is edge triggered, multishot handlers retry -internally until they know that no more data is available. In -preparation for limiting these retries, add an internal return code, -IOU_REQUEUE, which can be used to inform the poll backend about the -handler wanting to retry, but that this should happen through a normal -task_work requeue rather than keep hammering on the issue side for this -one request. - -No functional changes in this patch, nobody is using this return code -just yet. - -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - io_uring/io_uring.h | 7 +++++++ - io_uring/poll.c | 9 ++++++++- - 2 files changed, 15 insertions(+), 1 deletion(-) - -diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h -index ed84f2737b3a..c9992cd7f138 100644 ---- a/io_uring/io_uring.h -+++ b/io_uring/io_uring.h -@@ -30,6 +30,13 @@ enum { - IOU_OK = 0, - IOU_ISSUE_SKIP_COMPLETE = -EIOCBQUEUED, - -+ /* -+ * Requeue the task_work to restart operations on this request. The -+ * actual value isn't important, should just be not an otherwise -+ * valid error code, yet less than -MAX_ERRNO and valid internally. -+ */ -+ IOU_REQUEUE = -3072, -+ - /* - * Intended only when both IO_URING_F_MULTISHOT is passed - * to indicate to the poll runner that multishot should be -diff --git a/io_uring/poll.c b/io_uring/poll.c -index 785a5b191003..7513afc7b702 100644 ---- a/io_uring/poll.c -+++ b/io_uring/poll.c -@@ -226,6 +226,7 @@ enum { - IOU_POLL_NO_ACTION = 1, - IOU_POLL_REMOVE_POLL_USE_RES = 2, - IOU_POLL_REISSUE = 3, -+ IOU_POLL_REQUEUE = 4, - }; - - static void __io_poll_execute(struct io_kiocb *req, int mask) -@@ -329,6 +330,8 @@ static int io_poll_check_events(struct io_kiocb *req, struct io_tw_state *ts) - int ret = io_poll_issue(req, ts); - if (ret == IOU_STOP_MULTISHOT) - return IOU_POLL_REMOVE_POLL_USE_RES; -+ else if (ret == IOU_REQUEUE) -+ return IOU_POLL_REQUEUE; - if (ret < 0) - return ret; - } -@@ -351,8 +354,12 @@ void io_poll_task_func(struct io_kiocb *req, struct io_tw_state *ts) - int ret; - - ret = io_poll_check_events(req, ts); -- if (ret == IOU_POLL_NO_ACTION) -+ if (ret == IOU_POLL_NO_ACTION) { - return; -+ } else if (ret == IOU_POLL_REQUEUE) { -+ __io_poll_execute(req, 0); -+ return; -+ } - io_poll_remove_entries(req); - io_poll_tw_hash_eject(req, ts); - --- -2.43.2 - -From 3438de322e549183126d9bafe131e9dd80348811 Mon Sep 17 00:00:00 2001 -From: Jens Axboe <axboe@kernel.dk> -Date: Mon, 29 Jan 2024 12:00:58 -0700 -Subject: [PATCH 1495/1501] io_uring/net: limit inline multishot retries -Content-Length: 3172 -Lines: 86 - -Commit 76b367a2d83163cf19173d5cb0b562acbabc8eac upstream. - -If we have multiple clients and some/all are flooding the receives to -such an extent that we can retry a LOT handling multishot receives, then -we can be starving some clients and hence serving traffic in an -imbalanced fashion. - -Limit multishot retry attempts to some arbitrary value, whose only -purpose serves to ensure that we don't keep serving a single connection -for way too long. We default to 32 retries, which should be more than -enough to provide fairness, yet not so small that we'll spend too much -time requeuing rather than handling traffic. - -Cc: stable@vger.kernel.org -Depends-on: 704ea888d646 ("io_uring/poll: add requeue return code from poll multishot handling") -Depends-on: 1e5d765a82f ("io_uring/net: un-indent mshot retry path in io_recv_finish()") -Depends-on: e84b01a880f6 ("io_uring/poll: move poll execution helpers higher up") -Fixes: b3fdea6ecb55 ("io_uring: multishot recv") -Fixes: 9bb66906f23e ("io_uring: support multishot in recvmsg") -Link: https://github.com/axboe/liburing/issues/1043 -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - io_uring/net.c | 23 ++++++++++++++++++++--- - 1 file changed, 20 insertions(+), 3 deletions(-) - -diff --git a/io_uring/net.c b/io_uring/net.c -index 5662733f5eed..43bc9a5f96f9 100644 ---- a/io_uring/net.c -+++ b/io_uring/net.c -@@ -60,6 +60,7 @@ struct io_sr_msg { - unsigned len; - unsigned done_io; - unsigned msg_flags; -+ unsigned nr_multishot_loops; - u16 flags; - /* initialised and used only by !msg send variants */ - u16 addr_len; -@@ -70,6 +71,13 @@ struct io_sr_msg { - struct io_kiocb *notif; - }; - -+/* -+ * Number of times we'll try and do receives if there's more data. If we -+ * exceed this limit, then add us to the back of the queue and retry from -+ * there. This helps fairness between flooding clients. -+ */ -+#define MULTISHOT_MAX_RETRY 32 -+ - static inline bool io_check_multishot(struct io_kiocb *req, - unsigned int issue_flags) - { -@@ -611,6 +619,7 @@ int io_recvmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) - sr->msg_flags |= MSG_CMSG_COMPAT; - #endif - sr->done_io = 0; -+ sr->nr_multishot_loops = 0; - return 0; - } - -@@ -654,12 +663,20 @@ static inline bool io_recv_finish(struct io_kiocb *req, int *ret, - */ - if (io_fill_cqe_req_aux(req, issue_flags & IO_URING_F_COMPLETE_DEFER, - *ret, cflags | IORING_CQE_F_MORE)) { -+ struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg); -+ int mshot_retry_ret = IOU_ISSUE_SKIP_COMPLETE; -+ - io_recv_prep_retry(req); - /* Known not-empty or unknown state, retry */ -- if (cflags & IORING_CQE_F_SOCK_NONEMPTY || msg->msg_inq == -1) -- return false; -+ if (cflags & IORING_CQE_F_SOCK_NONEMPTY || msg->msg_inq == -1) { -+ if (sr->nr_multishot_loops++ < MULTISHOT_MAX_RETRY) -+ return false; -+ /* mshot retries exceeded, force a requeue */ -+ sr->nr_multishot_loops = 0; -+ mshot_retry_ret = IOU_REQUEUE; -+ } - if (issue_flags & IO_URING_F_MULTISHOT) -- *ret = IOU_ISSUE_SKIP_COMPLETE; -+ *ret = mshot_retry_ret; - else - *ret = -EAGAIN; - return true; --- -2.43.2 - -From 50d0dff3f706ff4a71df99b7526341ae9fa83e09 Mon Sep 17 00:00:00 2001 -From: Michael Lass <bevan@bi-co.net> -Date: Wed, 31 Jan 2024 16:52:20 +0100 -Subject: [PATCH 1496/1501] net: Fix from address in memcpy_to_iter_csum() -Content-Length: 1316 -Lines: 35 - -commit fe92f874f09145a6951deacaa4961390238bbe0d upstream. - -While inlining csum_and_memcpy() into memcpy_to_iter_csum(), the from -address passed to csum_partial_copy_nocheck() was accidentally changed. -This causes a regression in applications using UDP, as for example -OpenAFS, causing loss of datagrams. - -Fixes: dc32bff195b4 ("iov_iter, net: Fold in csum_and_memcpy()") -Cc: David Howells <dhowells@redhat.com> -Cc: stable@vger.kernel.org -Cc: regressions@lists.linux.dev -Signed-off-by: Michael Lass <bevan@bi-co.net> -Reviewed-by: Jeffrey Altman <jaltman@auristor.com> -Acked-by: David Howells <dhowells@redhat.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - net/core/datagram.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/core/datagram.c b/net/core/datagram.c -index 103d46fa0eeb..a8b625abe242 100644 ---- a/net/core/datagram.c -+++ b/net/core/datagram.c -@@ -751,7 +751,7 @@ size_t memcpy_to_iter_csum(void *iter_to, size_t progress, - size_t len, void *from, void *priv2) - { - __wsum *csum = priv2; -- __wsum next = csum_partial_copy_nocheck(from, iter_to, len); -+ __wsum next = csum_partial_copy_nocheck(from + progress, iter_to, len); - - *csum = csum_block_add(*csum, next, progress); - return 0; --- -2.43.2 - -From 9b16230a81aaa0b93734ad7c8b9f9c5b97b27920 Mon Sep 17 00:00:00 2001 -From: Simon Horman <horms@kernel.org> -Date: Thu, 8 Feb 2024 09:48:27 +0000 -Subject: [PATCH 1497/1501] net: stmmac: xgmac: use #define for string - constants -Content-Length: 4667 -Lines: 121 - -commit 1692b9775e745f84b69dc8ad0075b0855a43db4e upstream. - -The cited commit introduces and uses the string constants dpp_tx_err and -dpp_rx_err. These are assigned to constant fields of the array -dwxgmac3_error_desc. - -It has been reported that on GCC 6 and 7.5.0 this results in warnings -such as: - - .../dwxgmac2_core.c:836:20: error: initialiser element is not constant - { true, "TDPES0", dpp_tx_err }, - -I have been able to reproduce this using: GCC 7.5.0, 8.4.0, 9.4.0 and 10.5.0. -But not GCC 13.2.0. - -So it seems this effects older compilers but not newer ones. -As Jon points out in his report, the minimum compiler supported by -the kernel is GCC 5.1, so it does seem that this ought to be fixed. - -It is not clear to me what combination of 'const', if any, would address -this problem. So this patch takes of using #defines for the string -constants - -Compile tested only. - -Fixes: 46eba193d04f ("net: stmmac: xgmac: fix handling of DPP safety error for DMA channels") -Reported-by: Jon Hunter <jonathanh@nvidia.com> -Closes: https://lore.kernel.org/netdev/c25eb595-8d91-40ea-9f52-efa15ebafdbc@nvidia.com/ -Reported-by: kernel test robot <lkp@intel.com> -Closes: https://lore.kernel.org/oe-kbuild-all/202402081135.lAxxBXHk-lkp@intel.com/ -Signed-off-by: Simon Horman <horms@kernel.org> -Link: https://lore.kernel.org/r/20240208-xgmac-const-v1-1-e69a1eeabfc8@kernel.org -Signed-off-by: Jakub Kicinski <kuba@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - .../ethernet/stmicro/stmmac/dwxgmac2_core.c | 69 ++++++++++--------- - 1 file changed, 35 insertions(+), 34 deletions(-) - -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c -index e7eccc0c406f..6b83541cb5ed 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c -@@ -830,41 +830,42 @@ static const struct dwxgmac3_error_desc dwxgmac3_dma_errors[32]= { - { false, "UNKNOWN", "Unknown Error" }, /* 31 */ - }; - --static const char * const dpp_rx_err = "Read Rx Descriptor Parity checker Error"; --static const char * const dpp_tx_err = "Read Tx Descriptor Parity checker Error"; -+#define DPP_RX_ERR "Read Rx Descriptor Parity checker Error" -+#define DPP_TX_ERR "Read Tx Descriptor Parity checker Error" -+ - static const struct dwxgmac3_error_desc dwxgmac3_dma_dpp_errors[32] = { -- { true, "TDPES0", dpp_tx_err }, -- { true, "TDPES1", dpp_tx_err }, -- { true, "TDPES2", dpp_tx_err }, -- { true, "TDPES3", dpp_tx_err }, -- { true, "TDPES4", dpp_tx_err }, -- { true, "TDPES5", dpp_tx_err }, -- { true, "TDPES6", dpp_tx_err }, -- { true, "TDPES7", dpp_tx_err }, -- { true, "TDPES8", dpp_tx_err }, -- { true, "TDPES9", dpp_tx_err }, -- { true, "TDPES10", dpp_tx_err }, -- { true, "TDPES11", dpp_tx_err }, -- { true, "TDPES12", dpp_tx_err }, -- { true, "TDPES13", dpp_tx_err }, -- { true, "TDPES14", dpp_tx_err }, -- { true, "TDPES15", dpp_tx_err }, -- { true, "RDPES0", dpp_rx_err }, -- { true, "RDPES1", dpp_rx_err }, -- { true, "RDPES2", dpp_rx_err }, -- { true, "RDPES3", dpp_rx_err }, -- { true, "RDPES4", dpp_rx_err }, -- { true, "RDPES5", dpp_rx_err }, -- { true, "RDPES6", dpp_rx_err }, -- { true, "RDPES7", dpp_rx_err }, -- { true, "RDPES8", dpp_rx_err }, -- { true, "RDPES9", dpp_rx_err }, -- { true, "RDPES10", dpp_rx_err }, -- { true, "RDPES11", dpp_rx_err }, -- { true, "RDPES12", dpp_rx_err }, -- { true, "RDPES13", dpp_rx_err }, -- { true, "RDPES14", dpp_rx_err }, -- { true, "RDPES15", dpp_rx_err }, -+ { true, "TDPES0", DPP_TX_ERR }, -+ { true, "TDPES1", DPP_TX_ERR }, -+ { true, "TDPES2", DPP_TX_ERR }, -+ { true, "TDPES3", DPP_TX_ERR }, -+ { true, "TDPES4", DPP_TX_ERR }, -+ { true, "TDPES5", DPP_TX_ERR }, -+ { true, "TDPES6", DPP_TX_ERR }, -+ { true, "TDPES7", DPP_TX_ERR }, -+ { true, "TDPES8", DPP_TX_ERR }, -+ { true, "TDPES9", DPP_TX_ERR }, -+ { true, "TDPES10", DPP_TX_ERR }, -+ { true, "TDPES11", DPP_TX_ERR }, -+ { true, "TDPES12", DPP_TX_ERR }, -+ { true, "TDPES13", DPP_TX_ERR }, -+ { true, "TDPES14", DPP_TX_ERR }, -+ { true, "TDPES15", DPP_TX_ERR }, -+ { true, "RDPES0", DPP_RX_ERR }, -+ { true, "RDPES1", DPP_RX_ERR }, -+ { true, "RDPES2", DPP_RX_ERR }, -+ { true, "RDPES3", DPP_RX_ERR }, -+ { true, "RDPES4", DPP_RX_ERR }, -+ { true, "RDPES5", DPP_RX_ERR }, -+ { true, "RDPES6", DPP_RX_ERR }, -+ { true, "RDPES7", DPP_RX_ERR }, -+ { true, "RDPES8", DPP_RX_ERR }, -+ { true, "RDPES9", DPP_RX_ERR }, -+ { true, "RDPES10", DPP_RX_ERR }, -+ { true, "RDPES11", DPP_RX_ERR }, -+ { true, "RDPES12", DPP_RX_ERR }, -+ { true, "RDPES13", DPP_RX_ERR }, -+ { true, "RDPES14", DPP_RX_ERR }, -+ { true, "RDPES15", DPP_RX_ERR }, - }; - - static void dwxgmac3_handle_dma_err(struct net_device *ndev, --- -2.43.2 - -From e7495662d720d143dd3b3b05cd8e56cec9291f26 Mon Sep 17 00:00:00 2001 -From: Furong Xu <0x1207@gmail.com> -Date: Sat, 3 Feb 2024 13:31:33 +0800 -Subject: [PATCH 1499/1501] net: stmmac: xgmac: fix a typo of register name in - DPP safety handling -Content-Length: 2108 -Lines: 49 - -commit 1ce2654d87e2fb91fea83b288bd9b2641045e42a upstream. - -DDPP is copied from Synopsys Data book: - -DDPP: Disable Data path Parity Protection. - When it is 0x0, Data path Parity Protection is enabled. - When it is 0x1, Data path Parity Protection is disabled. - -The macro name should be XGMAC_DPP_DISABLE. - -Fixes: 46eba193d04f ("net: stmmac: xgmac: fix handling of DPP safety error for DMA channels") -Signed-off-by: Furong Xu <0x1207@gmail.com> -Reviewed-by: Serge Semin <fancer.lancer@gmail.com> -Link: https://lore.kernel.org/r/20240203053133.1129236-1-0x1207@gmail.com -Signed-off-by: Paolo Abeni <pabeni@redhat.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h | 2 +- - drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h -index 7d7133ef4994..17394847476f 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h -+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h -@@ -320,7 +320,7 @@ - #define XGMAC_TXCEIE BIT(0) - #define XGMAC_MTL_ECC_INT_STATUS 0x000010cc - #define XGMAC_MTL_DPP_CONTROL 0x000010e0 --#define XGMAC_DDPP_DISABLE BIT(0) -+#define XGMAC_DPP_DISABLE BIT(0) - #define XGMAC_MTL_TXQ_OPMODE(x) (0x00001100 + (0x80 * (x))) - #define XGMAC_TQS GENMASK(25, 16) - #define XGMAC_TQS_SHIFT 16 -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c -index 6b83541cb5ed..b5509f244ecd 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c -@@ -929,7 +929,7 @@ dwxgmac3_safety_feat_config(void __iomem *ioaddr, unsigned int asp, - /* 5. Enable Data Path Parity Protection */ - value = readl(ioaddr + XGMAC_MTL_DPP_CONTROL); - /* already enabled by default, explicit enable it again */ -- value &= ~XGMAC_DDPP_DISABLE; -+ value &= ~XGMAC_DPP_DISABLE; - writel(value, ioaddr + XGMAC_MTL_DPP_CONTROL); - - return 0; --- -2.43.2 - -From 004dcea13dc10acaf1486d9939be4c793834c13c Mon Sep 17 00:00:00 2001 -From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Date: Fri, 16 Feb 2024 19:14:32 +0100 -Subject: [PATCH 1501/1501] Linux 6.7.5 -Content-Length: 1470 -Lines: 40 - -Link: https://lore.kernel.org/r/20240213171853.722912593@linuxfoundation.org -Tested-by: Ronald Warsow <rwarsow@gmx.de> -Tested-by: Luna Jernberg <droidbittin@gmail.com> -Tested-by: SeongJae Park <sj@kernel.org> -Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> -Tested-by: Allen Pais <apais@linux.microsoft.com> -Tested-by: Shuah Khan <skhan@linuxfoundation.org> -Tested-by: Bagas Sanjaya <bagasdotme@gmail.com> -Tested-by: Linux Kernel Functional Testing <lkft@linaro.org> -Tested-by: Salvatore Bonaccorso <carnil@debian.org> -Tested-by: Ron Economos <re@w6rz.net> -Tested-by: Ricardo B. Marliere <ricardo@marliere.net> -Link: https://lore.kernel.org/r/20240214142244.209814342@linuxfoundation.org -Tested-by: Luna Jernberg <droidbittin@gmail.com> -Tested-by: Ronald Warsow <rwarsow@gmx.de> -Tested-by: Allen Pais <apais@linux.microsoft.com> -Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> -Tested-by: Linux Kernel Functional Testing <lkft@linaro.org> -Tested-by: Jon Hunter <jonathanh@nvidia.com> -Tested-by: Justin M. Forbes <jforbes@fedoraproject.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - Makefile | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Makefile b/Makefile -index 73a208d9d4c4..0f5bb9ddc98f 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 7 --SUBLEVEL = 4 -+SUBLEVEL = 5 - EXTRAVERSION = - NAME = Hurr durr I'ma ninja sloth - --- -2.43.2 - diff --git a/cve/review/mbox.6.7.1 b/cve/review/mbox.6.7.1 new file mode 100644 index 00000000..000b1705 --- /dev/null +++ b/cve/review/mbox.6.7.1 @@ -0,0 +1,2396 @@ +From ba4593e47982b71a6a49d6120c938395bb2f1543 Mon Sep 17 00:00:00 2001 +From: Stefan Binding <sbinding@opensource.cirrus.com> +Date: Thu, 21 Dec 2023 13:25:18 +0000 +Subject: [PATCH 02/29] ALSA: hda/realtek: Add quirks for Dell models +Status: RO +Content-Length: 3389 +Lines: 70 + +commit 423206604b28174698d77bf5ea81365cdd6c0f77 upstream. + +These models use 2 or 4 CS35L41 amps with HDA using SPI and I2C. +Models use internal and external boost. +All models require DSD support to be added inside +cs35l41_hda_property.c + +Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com> +Cc: <stable@vger.kernel.org> # v6.7+ +Link: https://lore.kernel.org/r/20231221132518.3213-4-sbinding@opensource.cirrus.com +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + sound/pci/hda/patch_realtek.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 70b17b08d4ff..942722a04e80 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6956,6 +6956,11 @@ static void cs35l41_fixup_i2c_two(struct hda_codec *cdc, const struct hda_fixup + cs35l41_generic_fixup(cdc, action, "i2c", "CSC3551", 2); + } + ++static void cs35l41_fixup_i2c_four(struct hda_codec *cdc, const struct hda_fixup *fix, int action) ++{ ++ cs35l41_generic_fixup(cdc, action, "i2c", "CSC3551", 4); ++} ++ + static void cs35l41_fixup_spi_two(struct hda_codec *codec, const struct hda_fixup *fix, int action) + { + cs35l41_generic_fixup(codec, action, "spi", "CSC3551", 2); +@@ -7441,6 +7446,7 @@ enum { + ALC287_FIXUP_LEGION_16ACHG6, + ALC287_FIXUP_CS35L41_I2C_2, + ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED, ++ ALC287_FIXUP_CS35L41_I2C_4, + ALC245_FIXUP_CS35L41_SPI_2, + ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED, + ALC245_FIXUP_CS35L41_SPI_4, +@@ -9427,6 +9433,10 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC285_FIXUP_HP_MUTE_LED, + }, ++ [ALC287_FIXUP_CS35L41_I2C_4] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = cs35l41_fixup_i2c_four, ++ }, + [ALC245_FIXUP_CS35L41_SPI_2] = { + .type = HDA_FIXUP_FUNC, + .v.func = cs35l41_fixup_spi_two, +@@ -9703,6 +9713,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x0a9e, "Dell Latitude 5430", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x0b19, "Dell XPS 15 9520", ALC289_FIXUP_DUAL_SPK), + SND_PCI_QUIRK(0x1028, 0x0b1a, "Dell Precision 5570", ALC289_FIXUP_DUAL_SPK), ++ SND_PCI_QUIRK(0x1028, 0x0b27, "Dell", ALC245_FIXUP_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1028, 0x0b28, "Dell", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1028, 0x0b37, "Dell Inspiron 16 Plus 7620 2-in-1", ALC295_FIXUP_DELL_INSPIRON_TOP_SPEAKERS), + SND_PCI_QUIRK(0x1028, 0x0b71, "Dell Inspiron 16 Plus 7620", ALC295_FIXUP_DELL_INSPIRON_TOP_SPEAKERS), + SND_PCI_QUIRK(0x1028, 0x0beb, "Dell XPS 15 9530 (2023)", ALC289_FIXUP_DELL_CS35L41_SPI_2), +@@ -9713,6 +9725,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x0c1c, "Dell Precision 3540", ALC236_FIXUP_DELL_DUAL_CODECS), + SND_PCI_QUIRK(0x1028, 0x0c1d, "Dell Precision 3440", ALC236_FIXUP_DELL_DUAL_CODECS), + SND_PCI_QUIRK(0x1028, 0x0c1e, "Dell Precision 3540", ALC236_FIXUP_DELL_DUAL_CODECS), ++ SND_PCI_QUIRK(0x1028, 0x0c4d, "Dell", ALC287_FIXUP_CS35L41_I2C_4), + SND_PCI_QUIRK(0x1028, 0x0cbd, "Dell Oasis 13 CS MTL-U", ALC289_FIXUP_DELL_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1028, 0x0cbe, "Dell Oasis 13 2-IN-1 MTL-U", ALC289_FIXUP_DELL_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1028, 0x0cbf, "Dell Oasis 13 Low Weight MTU-L", ALC289_FIXUP_DELL_CS35L41_SPI_2), +-- +2.43.2 + +From fdcf3681347c3a42762428c86fa087b787e9b1b2 Mon Sep 17 00:00:00 2001 +From: Stefan Binding <sbinding@opensource.cirrus.com> +Date: Thu, 21 Dec 2023 13:25:16 +0000 +Subject: [PATCH 03/29] ALSA: hda: cs35l41: Support additional Dell models + without _DSD +Status: RO +Content-Length: 1952 +Lines: 41 + +commit ee694e7db47e1af00ffb29f569904a9ed576868f upstream. + +Add new model entries into configuration table. + +Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com> +Cc: <stable@vger.kernel.org> # v6.7+ +Link: https://lore.kernel.org/r/20231221132518.3213-2-sbinding@opensource.cirrus.com +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + sound/pci/hda/cs35l41_hda_property.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/sound/pci/hda/cs35l41_hda_property.c b/sound/pci/hda/cs35l41_hda_property.c +index c1afb721b4c6..cbc9db5a3a8d 100644 +--- a/sound/pci/hda/cs35l41_hda_property.c ++++ b/sound/pci/hda/cs35l41_hda_property.c +@@ -35,6 +35,10 @@ struct cs35l41_config { + }; + + static const struct cs35l41_config cs35l41_config_table[] = { ++ { "10280B27", SPI, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, ++ { "10280B28", SPI, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, ++ { "10280BEB", SPI, 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, -1, 0, 0, 0, 0 }, ++ { "10280C4D", I2C, 4, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, CS35L41_LEFT, CS35L41_RIGHT }, 0, 1, -1, 1000, 4500, 24 }, + /* + * Device 103C89C6 does have _DSD, however it is setup to use the wrong boost type. + * We can override the _DSD to correct the boost type here. +@@ -345,6 +349,10 @@ struct cs35l41_prop_model { + static const struct cs35l41_prop_model cs35l41_prop_model_table[] = { + { "CLSA0100", NULL, lenovo_legion_no_acpi }, + { "CLSA0101", NULL, lenovo_legion_no_acpi }, ++ { "CSC3551", "10280B27", generic_dsd_config }, ++ { "CSC3551", "10280B28", generic_dsd_config }, ++ { "CSC3551", "10280BEB", generic_dsd_config }, ++ { "CSC3551", "10280C4D", generic_dsd_config }, + { "CSC3551", "103C89C6", generic_dsd_config }, + { "CSC3551", "104312AF", generic_dsd_config }, + { "CSC3551", "10431433", generic_dsd_config }, +-- +2.43.2 + +From 40a3bf7824062928596816dff1fd9a457974335b Mon Sep 17 00:00:00 2001 +From: Stefan Binding <sbinding@opensource.cirrus.com> +Date: Thu, 21 Dec 2023 13:25:17 +0000 +Subject: [PATCH 04/29] ALSA: hda: cs35l41: Prevent firmware load if SPI speed + too low +Status: RO +Content-Length: 13791 +Lines: 286 + +commit d110858a6925827609d11db8513d76750483ec06 upstream. + +Some laptops without _DSD have the SPI speed set very low in the BIOS. +Since the SPI controller uses this speed as its max speed, the SPI +transactions are very slow. Firmware download writes to many registers, +and if the SPI speed is too slow, it can take a long time to download. +For this reason, disable firmware loading if the maximum SPI speed is +too low. Without Firmware, audio playback will work, but the volume +will be low to ensure safe operation of the CS35L41. + +Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com> +Cc: <stable@vger.kernel.org> # v6.7+ +Link: https://lore.kernel.org/r/20231221132518.3213-3-sbinding@opensource.cirrus.com +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + sound/pci/hda/cs35l41_hda.c | 25 ++++++++-- + sound/pci/hda/cs35l41_hda.h | 12 ++++- + sound/pci/hda/cs35l41_hda_i2c.c | 2 +- + sound/pci/hda/cs35l41_hda_property.c | 74 +++++++++++++--------------- + sound/pci/hda/cs35l41_hda_spi.c | 2 +- + 5 files changed, 70 insertions(+), 45 deletions(-) + +diff --git a/sound/pci/hda/cs35l41_hda.c b/sound/pci/hda/cs35l41_hda.c +index 92ca2b3b6c92..d3fa6e136744 100644 +--- a/sound/pci/hda/cs35l41_hda.c ++++ b/sound/pci/hda/cs35l41_hda.c +@@ -12,6 +12,7 @@ + #include <sound/hda_codec.h> + #include <sound/soc.h> + #include <linux/pm_runtime.h> ++#include <linux/spi/spi.h> + #include "hda_local.h" + #include "hda_auto_parser.h" + #include "hda_jack.h" +@@ -996,6 +997,11 @@ static int cs35l41_smart_amp(struct cs35l41_hda *cs35l41) + __be32 halo_sts; + int ret; + ++ if (cs35l41->bypass_fw) { ++ dev_warn(cs35l41->dev, "Bypassing Firmware.\n"); ++ return 0; ++ } ++ + ret = cs35l41_init_dsp(cs35l41); + if (ret) { + dev_warn(cs35l41->dev, "Cannot Initialize Firmware. Error: %d\n", ret); +@@ -1588,6 +1594,7 @@ static int cs35l41_hda_read_acpi(struct cs35l41_hda *cs35l41, const char *hid, i + u32 values[HDA_MAX_COMPONENTS]; + struct acpi_device *adev; + struct device *physdev; ++ struct spi_device *spi; + const char *sub; + char *property; + size_t nval; +@@ -1610,7 +1617,7 @@ static int cs35l41_hda_read_acpi(struct cs35l41_hda *cs35l41, const char *hid, i + ret = cs35l41_add_dsd_properties(cs35l41, physdev, id, hid); + if (!ret) { + dev_info(cs35l41->dev, "Using extra _DSD properties, bypassing _DSD in ACPI\n"); +- goto put_physdev; ++ goto out; + } + + property = "cirrus,dev-index"; +@@ -1701,8 +1708,20 @@ static int cs35l41_hda_read_acpi(struct cs35l41_hda *cs35l41, const char *hid, i + hw_cfg->bst_type = CS35L41_EXT_BOOST; + + hw_cfg->valid = true; ++out: + put_device(physdev); + ++ cs35l41->bypass_fw = false; ++ if (cs35l41->control_bus == SPI) { ++ spi = to_spi_device(cs35l41->dev); ++ if (spi->max_speed_hz < CS35L41_MAX_ACCEPTABLE_SPI_SPEED_HZ) { ++ dev_warn(cs35l41->dev, ++ "SPI speed is too slow to support firmware download: %d Hz.\n", ++ spi->max_speed_hz); ++ cs35l41->bypass_fw = true; ++ } ++ } ++ + return 0; + + err: +@@ -1711,14 +1730,13 @@ static int cs35l41_hda_read_acpi(struct cs35l41_hda *cs35l41, const char *hid, i + hw_cfg->gpio1.valid = false; + hw_cfg->gpio2.valid = false; + acpi_dev_put(cs35l41->dacpi); +-put_physdev: + put_device(physdev); + + return ret; + } + + int cs35l41_hda_probe(struct device *dev, const char *device_name, int id, int irq, +- struct regmap *regmap) ++ struct regmap *regmap, enum control_bus control_bus) + { + unsigned int regid, reg_revid; + struct cs35l41_hda *cs35l41; +@@ -1737,6 +1755,7 @@ int cs35l41_hda_probe(struct device *dev, const char *device_name, int id, int i + cs35l41->dev = dev; + cs35l41->irq = irq; + cs35l41->regmap = regmap; ++ cs35l41->control_bus = control_bus; + dev_set_drvdata(dev, cs35l41); + + ret = cs35l41_hda_read_acpi(cs35l41, device_name, id); +diff --git a/sound/pci/hda/cs35l41_hda.h b/sound/pci/hda/cs35l41_hda.h +index 3d925d677213..43d55292b327 100644 +--- a/sound/pci/hda/cs35l41_hda.h ++++ b/sound/pci/hda/cs35l41_hda.h +@@ -20,6 +20,8 @@ + #include <linux/firmware/cirrus/cs_dsp.h> + #include <linux/firmware/cirrus/wmfw.h> + ++#define CS35L41_MAX_ACCEPTABLE_SPI_SPEED_HZ 1000000 ++ + struct cs35l41_amp_cal_data { + u32 calTarget[2]; + u32 calTime[2]; +@@ -46,6 +48,11 @@ enum cs35l41_hda_gpio_function { + CS35l41_SYNC, + }; + ++enum control_bus { ++ I2C, ++ SPI ++}; ++ + struct cs35l41_hda { + struct device *dev; + struct regmap *regmap; +@@ -74,6 +81,9 @@ struct cs35l41_hda { + struct cs_dsp cs_dsp; + struct acpi_device *dacpi; + bool mute_override; ++ enum control_bus control_bus; ++ bool bypass_fw; ++ + }; + + enum halo_state { +@@ -85,7 +95,7 @@ enum halo_state { + extern const struct dev_pm_ops cs35l41_hda_pm_ops; + + int cs35l41_hda_probe(struct device *dev, const char *device_name, int id, int irq, +- struct regmap *regmap); ++ struct regmap *regmap, enum control_bus control_bus); + void cs35l41_hda_remove(struct device *dev); + int cs35l41_get_speaker_id(struct device *dev, int amp_index, int num_amps, int fixed_gpio_id); + +diff --git a/sound/pci/hda/cs35l41_hda_i2c.c b/sound/pci/hda/cs35l41_hda_i2c.c +index b44536fbba17..603e9bff3a71 100644 +--- a/sound/pci/hda/cs35l41_hda_i2c.c ++++ b/sound/pci/hda/cs35l41_hda_i2c.c +@@ -30,7 +30,7 @@ static int cs35l41_hda_i2c_probe(struct i2c_client *clt) + return -ENODEV; + + return cs35l41_hda_probe(&clt->dev, device_name, clt->addr, clt->irq, +- devm_regmap_init_i2c(clt, &cs35l41_regmap_i2c)); ++ devm_regmap_init_i2c(clt, &cs35l41_regmap_i2c), I2C); + } + + static void cs35l41_hda_i2c_remove(struct i2c_client *clt) +diff --git a/sound/pci/hda/cs35l41_hda_property.c b/sound/pci/hda/cs35l41_hda_property.c +index cbc9db5a3a8d..fb15fa21abf4 100644 +--- a/sound/pci/hda/cs35l41_hda_property.c ++++ b/sound/pci/hda/cs35l41_hda_property.c +@@ -16,10 +16,6 @@ + + struct cs35l41_config { + const char *ssid; +- enum { +- SPI, +- I2C +- } bus; + int num_amps; + enum { + INTERNAL, +@@ -35,46 +31,46 @@ struct cs35l41_config { + }; + + static const struct cs35l41_config cs35l41_config_table[] = { +- { "10280B27", SPI, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, +- { "10280B28", SPI, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, +- { "10280BEB", SPI, 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, -1, 0, 0, 0, 0 }, +- { "10280C4D", I2C, 4, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, CS35L41_LEFT, CS35L41_RIGHT }, 0, 1, -1, 1000, 4500, 24 }, ++ { "10280B27", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, ++ { "10280B28", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, ++ { "10280BEB", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, -1, 0, 0, 0, 0 }, ++ { "10280C4D", 4, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, CS35L41_LEFT, CS35L41_RIGHT }, 0, 1, -1, 1000, 4500, 24 }, + /* + * Device 103C89C6 does have _DSD, however it is setup to use the wrong boost type. + * We can override the _DSD to correct the boost type here. + * Since this laptop has valid ACPI, we do not need to handle cs-gpios, since that already exists + * in the ACPI. The Reset GPIO is also valid, so we can use the Reset defined in _DSD. + */ +- { "103C89C6", SPI, 2, INTERNAL, { CS35L41_RIGHT, CS35L41_LEFT, 0, 0 }, -1, -1, -1, 1000, 4500, 24 }, +- { "104312AF", SPI, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, +- { "10431433", I2C, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, +- { "10431463", I2C, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, +- { "10431473", SPI, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, -1, 0, 1000, 4500, 24 }, +- { "10431483", SPI, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, -1, 0, 1000, 4500, 24 }, +- { "10431493", SPI, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, +- { "104314D3", SPI, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, +- { "104314E3", I2C, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, +- { "10431503", I2C, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, +- { "10431533", I2C, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, +- { "10431573", SPI, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, +- { "10431663", SPI, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, -1, 0, 1000, 4500, 24 }, +- { "104316D3", SPI, 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 0, 0, 0 }, +- { "104316F3", SPI, 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 0, 0, 0 }, +- { "104317F3", I2C, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, +- { "10431863", SPI, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, +- { "104318D3", I2C, 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 0, 0, 0 }, +- { "10431C9F", SPI, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, +- { "10431CAF", SPI, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, +- { "10431CCF", SPI, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, +- { "10431CDF", SPI, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, +- { "10431CEF", SPI, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, +- { "10431D1F", I2C, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, +- { "10431DA2", SPI, 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 0, 0, 0 }, +- { "10431E02", SPI, 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 0, 0, 0 }, +- { "10431EE2", I2C, 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, -1, -1, 0, 0, 0 }, +- { "10431F12", I2C, 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, +- { "10431F1F", SPI, 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, -1, 0, 0, 0, 0 }, +- { "10431F62", SPI, 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 0, 0, 0 }, ++ { "103C89C6", 2, INTERNAL, { CS35L41_RIGHT, CS35L41_LEFT, 0, 0 }, -1, -1, -1, 1000, 4500, 24 }, ++ { "104312AF", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, ++ { "10431433", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, ++ { "10431463", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, ++ { "10431473", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, -1, 0, 1000, 4500, 24 }, ++ { "10431483", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, -1, 0, 1000, 4500, 24 }, ++ { "10431493", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, ++ { "104314D3", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, ++ { "104314E3", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, ++ { "10431503", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, ++ { "10431533", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, ++ { "10431573", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, ++ { "10431663", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, -1, 0, 1000, 4500, 24 }, ++ { "104316D3", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 0, 0, 0 }, ++ { "104316F3", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 0, 0, 0 }, ++ { "104317F3", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, ++ { "10431863", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, ++ { "104318D3", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 0, 0, 0 }, ++ { "10431C9F", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, ++ { "10431CAF", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, ++ { "10431CCF", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, ++ { "10431CDF", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, ++ { "10431CEF", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, ++ { "10431D1F", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, ++ { "10431DA2", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 0, 0, 0 }, ++ { "10431E02", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 0, 0, 0 }, ++ { "10431EE2", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, -1, -1, 0, 0, 0 }, ++ { "10431F12", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, ++ { "10431F1F", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, -1, 0, 0, 0, 0 }, ++ { "10431F62", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 0, 0, 0 }, + {} + }; + +@@ -212,7 +208,7 @@ static int generic_dsd_config(struct cs35l41_hda *cs35l41, struct device *physde + "_DSD already exists.\n"); + } + +- if (cfg->bus == SPI) { ++ if (cs35l41->control_bus == SPI) { + cs35l41->index = id; + + /* +diff --git a/sound/pci/hda/cs35l41_hda_spi.c b/sound/pci/hda/cs35l41_hda_spi.c +index eb287aa5f782..b76c0dfd5fef 100644 +--- a/sound/pci/hda/cs35l41_hda_spi.c ++++ b/sound/pci/hda/cs35l41_hda_spi.c +@@ -26,7 +26,7 @@ static int cs35l41_hda_spi_probe(struct spi_device *spi) + return -ENODEV; + + return cs35l41_hda_probe(&spi->dev, device_name, spi_get_chipselect(spi, 0), spi->irq, +- devm_regmap_init_spi(spi, &cs35l41_regmap_spi)); ++ devm_regmap_init_spi(spi, &cs35l41_regmap_spi), SPI); + } + + static void cs35l41_hda_spi_remove(struct spi_device *spi) +-- +2.43.2 + +From 576145977b774f8a313702cf070d0ae690b7eed7 Mon Sep 17 00:00:00 2001 +From: Dorian Cruveiller <doriancruveiller@gmail.com> +Date: Sat, 30 Dec 2023 12:43:12 +0100 +Subject: [PATCH 05/29] ALSA: hda: Add driver properties for cs35l41 for Lenovo + Legion Slim 7 Gen 8 serie +Status: RO +Content-Length: 1928 +Lines: 42 + +commit ba7053b4b4a4ddcf530fa2b897e697004715d086 upstream. + +Add driver properties on 4 models of this laptop serie since they don't +have _DSD in the ACPI table + +Signed-off-by: Dorian Cruveiller <doriancruveiller@gmail.com> +Cc: <stable@vger.kernel.org> # v6.7 +Link: https://lore.kernel.org/r/20231230114312.22118-1-doriancruveiller@gmail.com +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + sound/pci/hda/cs35l41_hda_property.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/sound/pci/hda/cs35l41_hda_property.c b/sound/pci/hda/cs35l41_hda_property.c +index fb15fa21abf4..a51fb6b0f56d 100644 +--- a/sound/pci/hda/cs35l41_hda_property.c ++++ b/sound/pci/hda/cs35l41_hda_property.c +@@ -71,6 +71,10 @@ static const struct cs35l41_config cs35l41_config_table[] = { + { "10431F12", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, + { "10431F1F", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, -1, 0, 0, 0, 0 }, + { "10431F62", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 0, 0, 0 }, ++ { "17AA38B4", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 0, 0, 0 }, ++ { "17AA38B5", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 0, 0, 0 }, ++ { "17AA38B6", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 0, 0, 0 }, ++ { "17AA38B7", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 0, 0, 0 }, + {} + }; + +@@ -379,6 +383,10 @@ static const struct cs35l41_prop_model cs35l41_prop_model_table[] = { + { "CSC3551", "10431F12", generic_dsd_config }, + { "CSC3551", "10431F1F", generic_dsd_config }, + { "CSC3551", "10431F62", generic_dsd_config }, ++ { "CSC3551", "17AA38B4", generic_dsd_config }, ++ { "CSC3551", "17AA38B5", generic_dsd_config }, ++ { "CSC3551", "17AA38B6", generic_dsd_config }, ++ { "CSC3551", "17AA38B7", generic_dsd_config }, + {} + }; + +-- +2.43.2 + +From 6f33a312264f77c4371e1eeaea65da5030d89698 Mon Sep 17 00:00:00 2001 +From: Dorian Cruveiller <doriancruveiller@gmail.com> +Date: Sat, 30 Dec 2023 12:40:01 +0100 +Subject: [PATCH 06/29] ALSA: hda/realtek: enable SND_PCI_QUIRK for Lenovo + Legion Slim 7 Gen 8 (2023) serie +Status: RO +Content-Length: 1851 +Lines: 38 + +commit 99af5b11c57d33c32d761797f6308b40936c22ed upstream. + +Link up the realtek audio chip to the cirrus cs35l41 sound amplifier chip +on 4 models of the Lenovo legion slim 7 gen 8 (2023). These models are +16IRH8 (2 differents subsystem id) and 16APH8 (2 differents subsystem ids). + +Subsystem ids list: + - 17AA38B4 + - 17AA38B5 + - 17AA38B6 + - 17AA38B7 + +Signed-off-by: Dorian Cruveiller <doriancruveiller@gmail.com> +Cc: <stable@vger.kernel.org> # v6.7 +Link: https://lore.kernel.org/r/20231230114001.19855-1-doriancruveiller@gmail.com +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + sound/pci/hda/patch_realtek.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 942722a04e80..296a8f695e30 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10242,6 +10242,10 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x3886, "Y780 VECO DUAL", ALC287_FIXUP_TAS2781_I2C), + SND_PCI_QUIRK(0x17aa, 0x38a7, "Y780P AMD YG dual", ALC287_FIXUP_TAS2781_I2C), + SND_PCI_QUIRK(0x17aa, 0x38a8, "Y780P AMD VECO dual", ALC287_FIXUP_TAS2781_I2C), ++ SND_PCI_QUIRK(0x17aa, 0x38b4, "Legion Slim 7 16IRH8", ALC287_FIXUP_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x17aa, 0x38b5, "Legion Slim 7 16IRH8", ALC287_FIXUP_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x17aa, 0x38b6, "Legion Slim 7 16APH8", ALC287_FIXUP_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x17aa, 0x38b7, "Legion Slim 7 16APH8", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x17aa, 0x38ba, "Yoga S780-14.5 Air AMD quad YC", ALC287_FIXUP_TAS2781_I2C), + SND_PCI_QUIRK(0x17aa, 0x38bb, "Yoga S780-14.5 Air AMD quad AAC", ALC287_FIXUP_TAS2781_I2C), + SND_PCI_QUIRK(0x17aa, 0x38be, "Yoga S980-14.5 proX YC Dual", ALC287_FIXUP_TAS2781_I2C), +-- +2.43.2 + +From 8a975bfe02e8bdab70c1900cb1725c27f1ecbbd8 Mon Sep 17 00:00:00 2001 +From: Tom Jason Schwanke <tom@catboys.cloud> +Date: Mon, 8 Jan 2024 16:15:21 +0100 +Subject: [PATCH 07/29] ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP + Envy X360 13-ay0xxx +Status: RO +Content-Length: 1454 +Lines: 31 + +commit 6b3d14b7f9b1acaf7303d8499836bf78ee9c470c upstream. + +This enables the mute and mic-mute LEDs on the HP Envy X360 13-ay0xxx +convertibles. +The quirk 'ALC245_FIXUP_HP_X360_MUTE_LEDS' already exists and is now +enabled for this device. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216197 +Signed-off-by: Tom Jason Schwanke <tom@catboys.cloud> +Cc: <stable@vger.kernel.org> +Link: https://lore.kernel.org/r/651b26e9-e86b-45dd-aa90-3e43d6b99823@catboys.cloud +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 296a8f695e30..04a3dffcb412 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9829,6 +9829,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8735, "HP ProBook 435 G7", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), + SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_AMP_INIT), + SND_PCI_QUIRK(0x103c, 0x8760, "HP", ALC285_FIXUP_HP_MUTE_LED), ++ SND_PCI_QUIRK(0x103c, 0x876e, "HP ENVY x360 Convertible 13-ay0xxx", ALC245_FIXUP_HP_X360_MUTE_LEDS), + SND_PCI_QUIRK(0x103c, 0x877a, "HP", ALC285_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x877d, "HP", ALC236_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x8780, "HP ZBook Fury 17 G7 Mobile Workstation", +-- +2.43.2 + +From 2b12fe9daa3e2ae2c637ad6f25de7436bbfa6571 Mon Sep 17 00:00:00 2001 +From: Lorenz Brun <lorenz@brun.one> +Date: Tue, 2 Jan 2024 22:48:20 +0100 +Subject: [PATCH 08/29] ALSA: hda: cs35l41: Support more HP models without _DSD +Status: RO +Content-Length: 5064 +Lines: 82 + +commit 7d65d70161ef75a3991480c91668ac11acedf211 upstream. + +This adds overrides for a series of notebooks using a common config +taken from HP's proprietary Windows driver. + +This has been tested on a HP 15-ey0xxxx device (subsystem 103C8A31) +together with another Realtek quirk and the calibration files from the +proprietary driver. + +Signed-off-by: Lorenz Brun <lorenz@brun.one> +Cc: <stable@vger.kernel.org> # v6.7 +Link: https://lore.kernel.org/r/20240102214821.3394810-1-lorenz@brun.one +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + sound/pci/hda/cs35l41_hda_property.c | 44 ++++++++++++++++++++++++++++ + 1 file changed, 44 insertions(+) + +diff --git a/sound/pci/hda/cs35l41_hda_property.c b/sound/pci/hda/cs35l41_hda_property.c +index a51fb6b0f56d..35277ce890a4 100644 +--- a/sound/pci/hda/cs35l41_hda_property.c ++++ b/sound/pci/hda/cs35l41_hda_property.c +@@ -42,6 +42,28 @@ static const struct cs35l41_config cs35l41_config_table[] = { + * in the ACPI. The Reset GPIO is also valid, so we can use the Reset defined in _DSD. + */ + { "103C89C6", 2, INTERNAL, { CS35L41_RIGHT, CS35L41_LEFT, 0, 0 }, -1, -1, -1, 1000, 4500, 24 }, ++ { "103C8A28", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8A29", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8A2A", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8A2B", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8A2C", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8A2D", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8A2E", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8A30", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8A31", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8BB3", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8BB4", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8BDF", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8BE0", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8BE1", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8BE2", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8BE9", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8BDD", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8BDE", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8BE3", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8BE5", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8BE6", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, ++ { "103C8B3A", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4100, 24 }, + { "104312AF", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, + { "10431433", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, + { "10431463", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, +@@ -354,6 +376,28 @@ static const struct cs35l41_prop_model cs35l41_prop_model_table[] = { + { "CSC3551", "10280BEB", generic_dsd_config }, + { "CSC3551", "10280C4D", generic_dsd_config }, + { "CSC3551", "103C89C6", generic_dsd_config }, ++ { "CSC3551", "103C8A28", generic_dsd_config }, ++ { "CSC3551", "103C8A29", generic_dsd_config }, ++ { "CSC3551", "103C8A2A", generic_dsd_config }, ++ { "CSC3551", "103C8A2B", generic_dsd_config }, ++ { "CSC3551", "103C8A2C", generic_dsd_config }, ++ { "CSC3551", "103C8A2D", generic_dsd_config }, ++ { "CSC3551", "103C8A2E", generic_dsd_config }, ++ { "CSC3551", "103C8A30", generic_dsd_config }, ++ { "CSC3551", "103C8A31", generic_dsd_config }, ++ { "CSC3551", "103C8BB3", generic_dsd_config }, ++ { "CSC3551", "103C8BB4", generic_dsd_config }, ++ { "CSC3551", "103C8BDF", generic_dsd_config }, ++ { "CSC3551", "103C8BE0", generic_dsd_config }, ++ { "CSC3551", "103C8BE1", generic_dsd_config }, ++ { "CSC3551", "103C8BE2", generic_dsd_config }, ++ { "CSC3551", "103C8BE9", generic_dsd_config }, ++ { "CSC3551", "103C8BDD", generic_dsd_config }, ++ { "CSC3551", "103C8BDE", generic_dsd_config }, ++ { "CSC3551", "103C8BE3", generic_dsd_config }, ++ { "CSC3551", "103C8BE5", generic_dsd_config }, ++ { "CSC3551", "103C8BE6", generic_dsd_config }, ++ { "CSC3551", "103C8B3A", generic_dsd_config }, + { "CSC3551", "104312AF", generic_dsd_config }, + { "CSC3551", "10431433", generic_dsd_config }, + { "CSC3551", "10431463", generic_dsd_config }, +-- +2.43.2 + +From e848c4bb56d9b0bf0d222bf311f5eea72d06b1e7 Mon Sep 17 00:00:00 2001 +From: Hans de Goede <hdegoede@redhat.com> +Date: Sat, 23 Dec 2023 15:57:06 +0100 +Subject: [PATCH 09/29] ACPI: resource: Add another DMI match for the TongFang + GMxXGxx +Status: RO +Content-Length: 1268 +Lines: 38 + +commit df0cced74159c79e36ce7971f0bf250673296d93 upstream. + +The TongFang GMxXGxx, which needs IRQ overriding for the keyboard to work, +is also sold as the Eluktronics RP-15 which does not use the standard +TongFang GMxXGxx DMI board_name. + +Add an entry for this laptop to the irq1_edge_low_force_override[] DMI +table to make the internal keyboard functional. + +Reported-by: Luis Acuna <ldacuna@gmail.com> +Signed-off-by: Hans de Goede <hdegoede@redhat.com> +Cc: All applicable <stable@vger.kernel.org> +Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/acpi/resource.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index 9bd9f79cd409..c3536c236be9 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -510,6 +510,13 @@ static const struct dmi_system_id irq1_edge_low_force_override[] = { + DMI_MATCH(DMI_BOARD_NAME, "GMxXGxx"), + }, + }, ++ { ++ /* TongFang GMxXGxx sold as Eluktronics Inc. RP-15 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Eluktronics Inc."), ++ DMI_MATCH(DMI_BOARD_NAME, "RP-15"), ++ }, ++ }, + { + /* TongFang GM6XGxX/TUXEDO Stellaris 16 Gen5 AMD */ + .matches = { +-- +2.43.2 + +From ba0bc8bf90c9d84807024cfe6b008138ea970981 Mon Sep 17 00:00:00 2001 +From: Sjoerd Simons <sjoerd@collabora.com> +Date: Tue, 28 Nov 2023 22:35:04 +0100 +Subject: [PATCH 10/29] bus: moxtet: Mark the irq as shared +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Status: RO +Content-Length: 1112 +Lines: 32 + +commit e7830f5a83e96d8cb8efc0412902a03008f8fbe3 upstream. + +The Turris Mox shares the moxtet IRQ with various devices on the board, +so mark the IRQ as shared in the driver as well. + +Without this loading the module will fail with: + genirq: Flags mismatch irq 40. 00002002 (moxtet) vs. 00002080 (mcp7940x) + +Signed-off-by: Sjoerd Simons <sjoerd@collabora.com> +Cc: <stable@vger.kernel.org> # v6.2+ +Reviewed-by: Marek Behún <kabel@kernel.org> +Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/bus/moxtet.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bus/moxtet.c b/drivers/bus/moxtet.c +index 5eb0fe73ddc4..48c18f95660a 100644 +--- a/drivers/bus/moxtet.c ++++ b/drivers/bus/moxtet.c +@@ -755,7 +755,7 @@ static int moxtet_irq_setup(struct moxtet *moxtet) + moxtet->irq.masked = ~0; + + ret = request_threaded_irq(moxtet->dev_irq, NULL, moxtet_irq_thread_fn, +- IRQF_ONESHOT, "moxtet", moxtet); ++ IRQF_SHARED | IRQF_ONESHOT, "moxtet", moxtet); + if (ret < 0) + goto err_free; + +-- +2.43.2 + +From dc272a4d63025dba31fbdec2ec2043c591942d66 Mon Sep 17 00:00:00 2001 +From: Sjoerd Simons <sjoerd@collabora.com> +Date: Tue, 28 Nov 2023 22:35:05 +0100 +Subject: [PATCH 11/29] bus: moxtet: Add spi device table +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Status: RO +Content-Length: 1177 +Lines: 41 + +commit aaafe88d5500ba18b33be72458439367ef878788 upstream. + +The moxtet module fails to auto-load on. Add a SPI id table to +allow it to do so. + +Signed-off-by: Sjoerd Simons <sjoerd@collabora.com> +Cc: <stable@vger.kernel.org> +Reviewed-by: Marek Behún <kabel@kernel.org> +Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/bus/moxtet.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/bus/moxtet.c b/drivers/bus/moxtet.c +index 48c18f95660a..e384fbc6c1d9 100644 +--- a/drivers/bus/moxtet.c ++++ b/drivers/bus/moxtet.c +@@ -830,6 +830,12 @@ static void moxtet_remove(struct spi_device *spi) + mutex_destroy(&moxtet->lock); + } + ++static const struct spi_device_id moxtet_spi_ids[] = { ++ { "moxtet" }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(spi, moxtet_spi_ids); ++ + static const struct of_device_id moxtet_dt_ids[] = { + { .compatible = "cznic,moxtet" }, + {}, +@@ -841,6 +847,7 @@ static struct spi_driver moxtet_spi_driver = { + .name = "moxtet", + .of_match_table = moxtet_dt_ids, + }, ++ .id_table = moxtet_spi_ids, + .probe = moxtet_probe, + .remove = moxtet_remove, + }; +-- +2.43.2 + +From f90fb3a482d1d4705603ab6c320de0ccd611055c Mon Sep 17 00:00:00 2001 +From: Lewis Huang <lewis.huang@amd.com> +Date: Fri, 1 Dec 2023 06:25:02 -0700 +Subject: [PATCH 12/29] drm/amd/display: Pass pwrseq inst for backlight and ABM +Status: RO +Content-Length: 21219 +Lines: 535 + +commit b17ef04bf3a4346d66404454d6a646343ddc9749 upstream. + +[Why] +OTG inst and pwrseq inst mapping is not align therefore we cannot use +otg_inst as pwrseq inst to get DCIO register. + +[How] +1. Pass the correct pwrseq instance to dmub when set abm pipe. +2. LVTMA control index change from panel_inst to pwrseq_inst. + +Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> +Reviewed-by: Phil Hsieh <phil.hsieh@amd.com> +Acked-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com> +Signed-off-by: Lewis Huang <lewis.huang@amd.com> +Signed-off-by: Alex Deucher <alexander.deucher@amd.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + .../drm/amd/display/dc/bios/bios_parser2.c | 4 +- + .../drm/amd/display/dc/bios/command_table2.c | 12 ++-- + .../drm/amd/display/dc/bios/command_table2.h | 2 +- + .../gpu/drm/amd/display/dc/dc_bios_types.h | 2 +- + drivers/gpu/drm/amd/display/dc/dce/dmub_abm.c | 8 ++- + .../gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c | 7 ++- + .../gpu/drm/amd/display/dc/dce/dmub_abm_lcd.h | 2 +- + .../amd/display/dc/dcn31/dcn31_panel_cntl.c | 5 +- + .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 16 ++--- + .../amd/display/dc/hwss/dcn21/dcn21_hwseq.c | 36 ++++++++--- + drivers/gpu/drm/amd/display/dc/inc/hw/abm.h | 3 +- + .../drm/amd/display/dc/inc/hw/panel_cntl.h | 2 + + .../drm/amd/display/dc/link/link_factory.c | 59 +++++++++++++------ + .../gpu/drm/amd/display/dmub/inc/dmub_cmd.h | 14 ++++- + 14 files changed, 119 insertions(+), 53 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +index 2d1f5efa9091..b5b29451d2db 100644 +--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c ++++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +@@ -1698,7 +1698,7 @@ static enum bp_result bios_parser_enable_disp_power_gating( + static enum bp_result bios_parser_enable_lvtma_control( + struct dc_bios *dcb, + uint8_t uc_pwr_on, +- uint8_t panel_instance, ++ uint8_t pwrseq_instance, + uint8_t bypass_panel_control_wait) + { + struct bios_parser *bp = BP_FROM_DCB(dcb); +@@ -1706,7 +1706,7 @@ static enum bp_result bios_parser_enable_lvtma_control( + if (!bp->cmd_tbl.enable_lvtma_control) + return BP_RESULT_FAILURE; + +- return bp->cmd_tbl.enable_lvtma_control(bp, uc_pwr_on, panel_instance, bypass_panel_control_wait); ++ return bp->cmd_tbl.enable_lvtma_control(bp, uc_pwr_on, pwrseq_instance, bypass_panel_control_wait); + } + + static bool bios_parser_is_accelerated_mode( +diff --git a/drivers/gpu/drm/amd/display/dc/bios/command_table2.c b/drivers/gpu/drm/amd/display/dc/bios/command_table2.c +index 90a02d7bd3da..ab0adabf9dd4 100644 +--- a/drivers/gpu/drm/amd/display/dc/bios/command_table2.c ++++ b/drivers/gpu/drm/amd/display/dc/bios/command_table2.c +@@ -976,7 +976,7 @@ static unsigned int get_smu_clock_info_v3_1(struct bios_parser *bp, uint8_t id) + static enum bp_result enable_lvtma_control( + struct bios_parser *bp, + uint8_t uc_pwr_on, +- uint8_t panel_instance, ++ uint8_t pwrseq_instance, + uint8_t bypass_panel_control_wait); + + static void init_enable_lvtma_control(struct bios_parser *bp) +@@ -989,7 +989,7 @@ static void init_enable_lvtma_control(struct bios_parser *bp) + static void enable_lvtma_control_dmcub( + struct dc_dmub_srv *dmcub, + uint8_t uc_pwr_on, +- uint8_t panel_instance, ++ uint8_t pwrseq_instance, + uint8_t bypass_panel_control_wait) + { + +@@ -1002,8 +1002,8 @@ static void enable_lvtma_control_dmcub( + DMUB_CMD__VBIOS_LVTMA_CONTROL; + cmd.lvtma_control.data.uc_pwr_action = + uc_pwr_on; +- cmd.lvtma_control.data.panel_inst = +- panel_instance; ++ cmd.lvtma_control.data.pwrseq_inst = ++ pwrseq_instance; + cmd.lvtma_control.data.bypass_panel_control_wait = + bypass_panel_control_wait; + dm_execute_dmub_cmd(dmcub->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT); +@@ -1012,7 +1012,7 @@ static void enable_lvtma_control_dmcub( + static enum bp_result enable_lvtma_control( + struct bios_parser *bp, + uint8_t uc_pwr_on, +- uint8_t panel_instance, ++ uint8_t pwrseq_instance, + uint8_t bypass_panel_control_wait) + { + enum bp_result result = BP_RESULT_FAILURE; +@@ -1021,7 +1021,7 @@ static enum bp_result enable_lvtma_control( + bp->base.ctx->dc->debug.dmub_command_table) { + enable_lvtma_control_dmcub(bp->base.ctx->dmub_srv, + uc_pwr_on, +- panel_instance, ++ pwrseq_instance, + bypass_panel_control_wait); + return BP_RESULT_OK; + } +diff --git a/drivers/gpu/drm/amd/display/dc/bios/command_table2.h b/drivers/gpu/drm/amd/display/dc/bios/command_table2.h +index b6d09bf6cf72..41c8c014397f 100644 +--- a/drivers/gpu/drm/amd/display/dc/bios/command_table2.h ++++ b/drivers/gpu/drm/amd/display/dc/bios/command_table2.h +@@ -96,7 +96,7 @@ struct cmd_tbl { + struct bios_parser *bp, uint8_t id); + enum bp_result (*enable_lvtma_control)(struct bios_parser *bp, + uint8_t uc_pwr_on, +- uint8_t panel_instance, ++ uint8_t pwrseq_instance, + uint8_t bypass_panel_control_wait); + }; + +diff --git a/drivers/gpu/drm/amd/display/dc/dc_bios_types.h b/drivers/gpu/drm/amd/display/dc/dc_bios_types.h +index be9aa1a71847..26940d94d8fb 100644 +--- a/drivers/gpu/drm/amd/display/dc/dc_bios_types.h ++++ b/drivers/gpu/drm/amd/display/dc/dc_bios_types.h +@@ -140,7 +140,7 @@ struct dc_vbios_funcs { + enum bp_result (*enable_lvtma_control)( + struct dc_bios *bios, + uint8_t uc_pwr_on, +- uint8_t panel_instance, ++ uint8_t pwrseq_instance, + uint8_t bypass_panel_control_wait); + + enum bp_result (*get_soc_bb_info)( +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_abm.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_abm.c +index d3e6544022b7..930fd929e93a 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dmub_abm.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_abm.c +@@ -145,7 +145,11 @@ static bool dmub_abm_save_restore_ex( + return ret; + } + +-static bool dmub_abm_set_pipe_ex(struct abm *abm, uint32_t otg_inst, uint32_t option, uint32_t panel_inst) ++static bool dmub_abm_set_pipe_ex(struct abm *abm, ++ uint32_t otg_inst, ++ uint32_t option, ++ uint32_t panel_inst, ++ uint32_t pwrseq_inst) + { + bool ret = false; + unsigned int feature_support; +@@ -153,7 +157,7 @@ static bool dmub_abm_set_pipe_ex(struct abm *abm, uint32_t otg_inst, uint32_t op + feature_support = abm_feature_support(abm, panel_inst); + + if (feature_support == ABM_LCD_SUPPORT) +- ret = dmub_abm_set_pipe(abm, otg_inst, option, panel_inst); ++ ret = dmub_abm_set_pipe(abm, otg_inst, option, panel_inst, pwrseq_inst); + + return ret; + } +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c +index 592a8f7a1c6d..42c802afc468 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c +@@ -254,7 +254,11 @@ bool dmub_abm_save_restore( + return true; + } + +-bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, uint32_t option, uint32_t panel_inst) ++bool dmub_abm_set_pipe(struct abm *abm, ++ uint32_t otg_inst, ++ uint32_t option, ++ uint32_t panel_inst, ++ uint32_t pwrseq_inst) + { + union dmub_rb_cmd cmd; + struct dc_context *dc = abm->ctx; +@@ -264,6 +268,7 @@ bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, uint32_t option, uint + cmd.abm_set_pipe.header.type = DMUB_CMD__ABM; + cmd.abm_set_pipe.header.sub_type = DMUB_CMD__ABM_SET_PIPE; + cmd.abm_set_pipe.abm_set_pipe_data.otg_inst = otg_inst; ++ cmd.abm_set_pipe.abm_set_pipe_data.pwrseq_inst = pwrseq_inst; + cmd.abm_set_pipe.abm_set_pipe_data.set_pipe_option = option; + cmd.abm_set_pipe.abm_set_pipe_data.panel_inst = panel_inst; + cmd.abm_set_pipe.abm_set_pipe_data.ramping_boundary = ramping_boundary; +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.h b/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.h +index 853564d7f471..07ea6c8d414f 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.h ++++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.h +@@ -44,7 +44,7 @@ bool dmub_abm_save_restore( + struct dc_context *dc, + unsigned int panel_inst, + struct abm_save_restore *pData); +-bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, uint32_t option, uint32_t panel_inst); ++bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, uint32_t option, uint32_t panel_inst, uint32_t pwrseq_inst); + bool dmub_abm_set_backlight_level(struct abm *abm, + unsigned int backlight_pwm_u16_16, + unsigned int frame_ramp, +diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_panel_cntl.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_panel_cntl.c +index 217acd4e292a..d849b1eaa4a5 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_panel_cntl.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_panel_cntl.c +@@ -50,7 +50,7 @@ static bool dcn31_query_backlight_info(struct panel_cntl *panel_cntl, union dmub + cmd->panel_cntl.header.type = DMUB_CMD__PANEL_CNTL; + cmd->panel_cntl.header.sub_type = DMUB_CMD__PANEL_CNTL_QUERY_BACKLIGHT_INFO; + cmd->panel_cntl.header.payload_bytes = sizeof(cmd->panel_cntl.data); +- cmd->panel_cntl.data.inst = dcn31_panel_cntl->base.inst; ++ cmd->panel_cntl.data.pwrseq_inst = dcn31_panel_cntl->base.pwrseq_inst; + + return dm_execute_dmub_cmd(dc_dmub_srv->ctx, cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY); + } +@@ -78,7 +78,7 @@ static uint32_t dcn31_panel_cntl_hw_init(struct panel_cntl *panel_cntl) + cmd.panel_cntl.header.type = DMUB_CMD__PANEL_CNTL; + cmd.panel_cntl.header.sub_type = DMUB_CMD__PANEL_CNTL_HW_INIT; + cmd.panel_cntl.header.payload_bytes = sizeof(cmd.panel_cntl.data); +- cmd.panel_cntl.data.inst = dcn31_panel_cntl->base.inst; ++ cmd.panel_cntl.data.pwrseq_inst = dcn31_panel_cntl->base.pwrseq_inst; + cmd.panel_cntl.data.bl_pwm_cntl = panel_cntl->stored_backlight_registers.BL_PWM_CNTL; + cmd.panel_cntl.data.bl_pwm_period_cntl = panel_cntl->stored_backlight_registers.BL_PWM_PERIOD_CNTL; + cmd.panel_cntl.data.bl_pwm_ref_div1 = +@@ -157,4 +157,5 @@ void dcn31_panel_cntl_construct( + dcn31_panel_cntl->base.funcs = &dcn31_link_panel_cntl_funcs; + dcn31_panel_cntl->base.ctx = init_data->ctx; + dcn31_panel_cntl->base.inst = init_data->inst; ++ dcn31_panel_cntl->base.pwrseq_inst = init_data->pwrseq_inst; + } +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +index 960a55e06375..9b8299d97e40 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +@@ -790,7 +790,7 @@ void dce110_edp_power_control( + struct dc_context *ctx = link->ctx; + struct bp_transmitter_control cntl = { 0 }; + enum bp_result bp_result; +- uint8_t panel_instance; ++ uint8_t pwrseq_instance; + + + if (dal_graphics_object_id_get_connector_id(link->link_enc->connector) +@@ -873,7 +873,7 @@ void dce110_edp_power_control( + cntl.coherent = false; + cntl.lanes_number = LANE_COUNT_FOUR; + cntl.hpd_sel = link->link_enc->hpd_source; +- panel_instance = link->panel_cntl->inst; ++ pwrseq_instance = link->panel_cntl->pwrseq_inst; + + if (ctx->dc->ctx->dmub_srv && + ctx->dc->debug.dmub_command_table) { +@@ -881,11 +881,11 @@ void dce110_edp_power_control( + if (cntl.action == TRANSMITTER_CONTROL_POWER_ON) { + bp_result = ctx->dc_bios->funcs->enable_lvtma_control(ctx->dc_bios, + LVTMA_CONTROL_POWER_ON, +- panel_instance, link->link_powered_externally); ++ pwrseq_instance, link->link_powered_externally); + } else { + bp_result = ctx->dc_bios->funcs->enable_lvtma_control(ctx->dc_bios, + LVTMA_CONTROL_POWER_OFF, +- panel_instance, link->link_powered_externally); ++ pwrseq_instance, link->link_powered_externally); + } + } + +@@ -956,7 +956,7 @@ void dce110_edp_backlight_control( + { + struct dc_context *ctx = link->ctx; + struct bp_transmitter_control cntl = { 0 }; +- uint8_t panel_instance; ++ uint8_t pwrseq_instance; + unsigned int pre_T11_delay = OLED_PRE_T11_DELAY; + unsigned int post_T7_delay = OLED_POST_T7_DELAY; + +@@ -1009,7 +1009,7 @@ void dce110_edp_backlight_control( + */ + /* dc_service_sleep_in_milliseconds(50); */ + /*edp 1.2*/ +- panel_instance = link->panel_cntl->inst; ++ pwrseq_instance = link->panel_cntl->pwrseq_inst; + + if (cntl.action == TRANSMITTER_CONTROL_BACKLIGHT_ON) { + if (!link->dc->config.edp_no_power_sequencing) +@@ -1034,11 +1034,11 @@ void dce110_edp_backlight_control( + if (cntl.action == TRANSMITTER_CONTROL_BACKLIGHT_ON) + ctx->dc_bios->funcs->enable_lvtma_control(ctx->dc_bios, + LVTMA_CONTROL_LCD_BLON, +- panel_instance, link->link_powered_externally); ++ pwrseq_instance, link->link_powered_externally); + else + ctx->dc_bios->funcs->enable_lvtma_control(ctx->dc_bios, + LVTMA_CONTROL_LCD_BLOFF, +- panel_instance, link->link_powered_externally); ++ pwrseq_instance, link->link_powered_externally); + } + + link_transmitter_control(ctx->dc_bios, &cntl); +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c +index 467812cf3368..08783ad097d2 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c +@@ -137,7 +137,8 @@ void dcn21_PLAT_58856_wa(struct dc_state *context, struct pipe_ctx *pipe_ctx) + pipe_ctx->stream->dpms_off = true; + } + +-static bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, uint32_t option, uint32_t panel_inst) ++static bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, ++ uint32_t option, uint32_t panel_inst, uint32_t pwrseq_inst) + { + union dmub_rb_cmd cmd; + struct dc_context *dc = abm->ctx; +@@ -147,6 +148,7 @@ static bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, uint32_t optio + cmd.abm_set_pipe.header.type = DMUB_CMD__ABM; + cmd.abm_set_pipe.header.sub_type = DMUB_CMD__ABM_SET_PIPE; + cmd.abm_set_pipe.abm_set_pipe_data.otg_inst = otg_inst; ++ cmd.abm_set_pipe.abm_set_pipe_data.pwrseq_inst = pwrseq_inst; + cmd.abm_set_pipe.abm_set_pipe_data.set_pipe_option = option; + cmd.abm_set_pipe.abm_set_pipe_data.panel_inst = panel_inst; + cmd.abm_set_pipe.abm_set_pipe_data.ramping_boundary = ramping_boundary; +@@ -179,7 +181,6 @@ void dcn21_set_abm_immediate_disable(struct pipe_ctx *pipe_ctx) + struct abm *abm = pipe_ctx->stream_res.abm; + uint32_t otg_inst = pipe_ctx->stream_res.tg->inst; + struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl; +- + struct dmcu *dmcu = pipe_ctx->stream->ctx->dc->res_pool->dmcu; + + if (dmcu) { +@@ -190,9 +191,13 @@ void dcn21_set_abm_immediate_disable(struct pipe_ctx *pipe_ctx) + if (abm && panel_cntl) { + if (abm->funcs && abm->funcs->set_pipe_ex) { + abm->funcs->set_pipe_ex(abm, otg_inst, SET_ABM_PIPE_IMMEDIATELY_DISABLE, +- panel_cntl->inst); ++ panel_cntl->inst, panel_cntl->pwrseq_inst); + } else { +- dmub_abm_set_pipe(abm, otg_inst, SET_ABM_PIPE_IMMEDIATELY_DISABLE, panel_cntl->inst); ++ dmub_abm_set_pipe(abm, ++ otg_inst, ++ SET_ABM_PIPE_IMMEDIATELY_DISABLE, ++ panel_cntl->inst, ++ panel_cntl->pwrseq_inst); + } + panel_cntl->funcs->store_backlight_level(panel_cntl); + } +@@ -212,9 +217,16 @@ void dcn21_set_pipe(struct pipe_ctx *pipe_ctx) + + if (abm && panel_cntl) { + if (abm->funcs && abm->funcs->set_pipe_ex) { +- abm->funcs->set_pipe_ex(abm, otg_inst, SET_ABM_PIPE_NORMAL, panel_cntl->inst); ++ abm->funcs->set_pipe_ex(abm, ++ otg_inst, ++ SET_ABM_PIPE_NORMAL, ++ panel_cntl->inst, ++ panel_cntl->pwrseq_inst); + } else { +- dmub_abm_set_pipe(abm, otg_inst, SET_ABM_PIPE_NORMAL, panel_cntl->inst); ++ dmub_abm_set_pipe(abm, otg_inst, ++ SET_ABM_PIPE_NORMAL, ++ panel_cntl->inst, ++ panel_cntl->pwrseq_inst); + } + } + } +@@ -237,9 +249,17 @@ bool dcn21_set_backlight_level(struct pipe_ctx *pipe_ctx, + + if (abm && panel_cntl) { + if (abm->funcs && abm->funcs->set_pipe_ex) { +- abm->funcs->set_pipe_ex(abm, otg_inst, SET_ABM_PIPE_NORMAL, panel_cntl->inst); ++ abm->funcs->set_pipe_ex(abm, ++ otg_inst, ++ SET_ABM_PIPE_NORMAL, ++ panel_cntl->inst, ++ panel_cntl->pwrseq_inst); + } else { +- dmub_abm_set_pipe(abm, otg_inst, SET_ABM_PIPE_NORMAL, panel_cntl->inst); ++ dmub_abm_set_pipe(abm, ++ otg_inst, ++ SET_ABM_PIPE_NORMAL, ++ panel_cntl->inst, ++ panel_cntl->pwrseq_inst); + } + } + } +diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/abm.h b/drivers/gpu/drm/amd/display/dc/inc/hw/abm.h +index 33db15d69f23..9f521cf0fc5a 100644 +--- a/drivers/gpu/drm/amd/display/dc/inc/hw/abm.h ++++ b/drivers/gpu/drm/amd/display/dc/inc/hw/abm.h +@@ -64,7 +64,8 @@ struct abm_funcs { + bool (*set_pipe_ex)(struct abm *abm, + unsigned int otg_inst, + unsigned int option, +- unsigned int panel_inst); ++ unsigned int panel_inst, ++ unsigned int pwrseq_inst); + }; + + #endif +diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/panel_cntl.h b/drivers/gpu/drm/amd/display/dc/inc/hw/panel_cntl.h +index 24af9d80b937..248adc1705e3 100644 +--- a/drivers/gpu/drm/amd/display/dc/inc/hw/panel_cntl.h ++++ b/drivers/gpu/drm/amd/display/dc/inc/hw/panel_cntl.h +@@ -56,12 +56,14 @@ struct panel_cntl_funcs { + struct panel_cntl_init_data { + struct dc_context *ctx; + uint32_t inst; ++ uint32_t pwrseq_inst; + }; + + struct panel_cntl { + const struct panel_cntl_funcs *funcs; + struct dc_context *ctx; + uint32_t inst; ++ uint32_t pwrseq_inst; + /* registers setting needs to be saved and restored at InitBacklight */ + struct panel_cntl_backlight_registers stored_backlight_registers; + }; +diff --git a/drivers/gpu/drm/amd/display/dc/link/link_factory.c b/drivers/gpu/drm/amd/display/dc/link/link_factory.c +index 7abfc67d10a6..ff7801aa552a 100644 +--- a/drivers/gpu/drm/amd/display/dc/link/link_factory.c ++++ b/drivers/gpu/drm/amd/display/dc/link/link_factory.c +@@ -368,6 +368,30 @@ static enum transmitter translate_encoder_to_transmitter( + } + } + ++static uint8_t translate_dig_inst_to_pwrseq_inst(struct dc_link *link) ++{ ++ uint8_t pwrseq_inst = 0xF; ++ struct dc_context *dc_ctx = link->dc->ctx; ++ ++ DC_LOGGER_INIT(dc_ctx->logger); ++ ++ switch (link->eng_id) { ++ case ENGINE_ID_DIGA: ++ pwrseq_inst = 0; ++ break; ++ case ENGINE_ID_DIGB: ++ pwrseq_inst = 1; ++ break; ++ default: ++ DC_LOG_WARNING("Unsupported pwrseq engine id: %d!\n", link->eng_id); ++ ASSERT(false); ++ break; ++ } ++ ++ return pwrseq_inst; ++} ++ ++ + static void link_destruct(struct dc_link *link) + { + int i; +@@ -595,24 +619,6 @@ static bool construct_phy(struct dc_link *link, + link->ddc_hw_inst = + dal_ddc_get_line(get_ddc_pin(link->ddc)); + +- +- if (link->dc->res_pool->funcs->panel_cntl_create && +- (link->link_id.id == CONNECTOR_ID_EDP || +- link->link_id.id == CONNECTOR_ID_LVDS)) { +- panel_cntl_init_data.ctx = dc_ctx; +- panel_cntl_init_data.inst = +- panel_cntl_init_data.ctx->dc_edp_id_count; +- link->panel_cntl = +- link->dc->res_pool->funcs->panel_cntl_create( +- &panel_cntl_init_data); +- panel_cntl_init_data.ctx->dc_edp_id_count++; +- +- if (link->panel_cntl == NULL) { +- DC_ERROR("Failed to create link panel_cntl!\n"); +- goto panel_cntl_create_fail; +- } +- } +- + enc_init_data.ctx = dc_ctx; + bp_funcs->get_src_obj(dc_ctx->dc_bios, link->link_id, 0, + &enc_init_data.encoder); +@@ -643,6 +649,23 @@ static bool construct_phy(struct dc_link *link, + link->dc->res_pool->dig_link_enc_count++; + + link->link_enc_hw_inst = link->link_enc->transmitter; ++ ++ if (link->dc->res_pool->funcs->panel_cntl_create && ++ (link->link_id.id == CONNECTOR_ID_EDP || ++ link->link_id.id == CONNECTOR_ID_LVDS)) { ++ panel_cntl_init_data.ctx = dc_ctx; ++ panel_cntl_init_data.inst = panel_cntl_init_data.ctx->dc_edp_id_count; ++ panel_cntl_init_data.pwrseq_inst = translate_dig_inst_to_pwrseq_inst(link); ++ link->panel_cntl = ++ link->dc->res_pool->funcs->panel_cntl_create( ++ &panel_cntl_init_data); ++ panel_cntl_init_data.ctx->dc_edp_id_count++; ++ ++ if (link->panel_cntl == NULL) { ++ DC_ERROR("Failed to create link panel_cntl!\n"); ++ goto panel_cntl_create_fail; ++ } ++ } + for (i = 0; i < 4; i++) { + if (bp_funcs->get_device_tag(dc_ctx->dc_bios, + link->link_id, i, +diff --git a/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h b/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h +index ed4379c04715..3cea96a36432 100644 +--- a/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h ++++ b/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h +@@ -3357,6 +3357,16 @@ struct dmub_cmd_abm_set_pipe_data { + * TODO: Remove. + */ + uint8_t ramping_boundary; ++ ++ /** ++ * PwrSeq HW Instance. ++ */ ++ uint8_t pwrseq_inst; ++ ++ /** ++ * Explicit padding to 4 byte boundary. ++ */ ++ uint8_t pad[3]; + }; + + /** +@@ -3737,7 +3747,7 @@ enum dmub_cmd_panel_cntl_type { + * struct dmub_cmd_panel_cntl_data - Panel control data. + */ + struct dmub_cmd_panel_cntl_data { +- uint32_t inst; /**< panel instance */ ++ uint32_t pwrseq_inst; /**< pwrseq instance */ + uint32_t current_backlight; /* in/out */ + uint32_t bl_pwm_cntl; /* in/out */ + uint32_t bl_pwm_period_cntl; /* in/out */ +@@ -3796,7 +3806,7 @@ struct dmub_cmd_lvtma_control_data { + uint8_t uc_pwr_action; /**< LVTMA_ACTION */ + uint8_t bypass_panel_control_wait; + uint8_t reserved_0[2]; /**< For future use */ +- uint8_t panel_inst; /**< LVTMA control instance */ ++ uint8_t pwrseq_inst; /**< LVTMA control instance */ + uint8_t reserved_1[3]; /**< For future use */ + }; + +-- +2.43.2 + +From 68f9b0945b19e8140239c6043f7a9b01f1d1a529 Mon Sep 17 00:00:00 2001 +From: Fedor Pchelkin <pchelkin@ispras.ru> +Date: Tue, 9 Jan 2024 17:14:44 +0300 +Subject: [PATCH 14/29] ksmbd: free ppace array on error in parse_dacl +Status: RO +Content-Length: 1685 +Lines: 53 + +commit 8cf9bedfc3c47d24bb0de386f808f925dc52863e upstream. + +The ppace array is not freed if one of the init_acl_state() calls inside +parse_dacl() fails. At the moment the function may fail only due to the +memory allocation errors so it's highly unlikely in this case but +nevertheless a fix is needed. + +Move ppace allocation after the init_acl_state() calls with proper error +handling. + +Found by Linux Verification Center (linuxtesting.org). + +Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") +Cc: stable@vger.kernel.org +Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> +Acked-by: Namjae Jeon <linkinjeon@kernel.org> +Signed-off-by: Steve French <stfrench@microsoft.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + fs/smb/server/smbacl.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c +index 1164365533f0..1c9775f1efa5 100644 +--- a/fs/smb/server/smbacl.c ++++ b/fs/smb/server/smbacl.c +@@ -401,10 +401,6 @@ static void parse_dacl(struct mnt_idmap *idmap, + if (num_aces > ULONG_MAX / sizeof(struct smb_ace *)) + return; + +- ppace = kmalloc_array(num_aces, sizeof(struct smb_ace *), GFP_KERNEL); +- if (!ppace) +- return; +- + ret = init_acl_state(&acl_state, num_aces); + if (ret) + return; +@@ -414,6 +410,13 @@ static void parse_dacl(struct mnt_idmap *idmap, + return; + } + ++ ppace = kmalloc_array(num_aces, sizeof(struct smb_ace *), GFP_KERNEL); ++ if (!ppace) { ++ free_acl_state(&default_acl_state); ++ free_acl_state(&acl_state); ++ return; ++ } ++ + /* + * reset rwx permissions for user/group/other. + * Also, if num_aces is 0 i.e. DACL has no ACEs, +-- +2.43.2 + +From 4a6eefb46b5f9dda9e7d4cde45efdbacf0c4b4ec Mon Sep 17 00:00:00 2001 +From: Carlos Llamas <cmllamas@google.com> +Date: Fri, 1 Dec 2023 17:21:30 +0000 +Subject: [PATCH 16/29] binder: use EPOLLERR from eventpoll.h +Status: RO +Content-Length: 1313 +Lines: 35 + +commit 6ac061db9c58ca5b9270b1b3940d2464fb3ff183 upstream. + +Use EPOLLERR instead of POLLERR to make sure it is cast to the correct +__poll_t type. This fixes the following sparse issue: + + drivers/android/binder.c:5030:24: warning: incorrect type in return expression (different base types) + drivers/android/binder.c:5030:24: expected restricted __poll_t + drivers/android/binder.c:5030:24: got int + +Fixes: f88982679f54 ("binder: check for binder_thread allocation failure in binder_poll()") +Cc: stable@vger.kernel.org +Cc: Eric Biggers <ebiggers@google.com> +Reviewed-by: Alice Ryhl <aliceryhl@google.com> +Signed-off-by: Carlos Llamas <cmllamas@google.com> +Link: https://lore.kernel.org/r/20231201172212.1813387-2-cmllamas@google.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/android/binder.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/android/binder.c b/drivers/android/binder.c +index 92128aae2d06..71a40a4c546f 100644 +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -5030,7 +5030,7 @@ static __poll_t binder_poll(struct file *filp, + + thread = binder_get_thread(proc); + if (!thread) +- return POLLERR; ++ return EPOLLERR; + + binder_inner_proc_lock(thread->proc); + thread->looper |= BINDER_LOOPER_STATE_POLL; +-- +2.43.2 + +From 220f3a317bb6f865a3ab8f078bf7bfa1eaf9f34a Mon Sep 17 00:00:00 2001 +From: Carlos Llamas <cmllamas@google.com> +Date: Fri, 1 Dec 2023 17:21:35 +0000 +Subject: [PATCH 18/29] binder: fix trivial typo of binder_free_buf_locked() +Status: RO +Content-Length: 1256 +Lines: 31 + +commit 122a3c1cb0ff304c2b8934584fcfea4edb2fe5e3 upstream. + +Fix minor misspelling of the function in the comment section. + +No functional changes in this patch. + +Cc: stable@vger.kernel.org +Fixes: 0f966cba95c7 ("binder: add flag to clear buffer on txn complete") +Reviewed-by: Alice Ryhl <aliceryhl@google.com> +Signed-off-by: Carlos Llamas <cmllamas@google.com> +Link: https://lore.kernel.org/r/20231201172212.1813387-7-cmllamas@google.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/android/binder_alloc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c +index 9d2eff70c3ba..db340f0575a8 100644 +--- a/drivers/android/binder_alloc.c ++++ b/drivers/android/binder_alloc.c +@@ -706,7 +706,7 @@ void binder_alloc_free_buf(struct binder_alloc *alloc, + /* + * We could eliminate the call to binder_alloc_clear_buf() + * from binder_alloc_deferred_release() by moving this to +- * binder_alloc_free_buf_locked(). However, that could ++ * binder_free_buf_locked(). However, that could + * increase contention for the alloc mutex if clear_on_free + * is used frequently for large buffers. The mutex is not + * needed for correctness here. +-- +2.43.2 + +From 9eae760e748ccb0512ef9a9836161cd3cc98f277 Mon Sep 17 00:00:00 2001 +From: Carlos Llamas <cmllamas@google.com> +Date: Fri, 1 Dec 2023 17:21:36 +0000 +Subject: [PATCH 19/29] binder: fix comment on binder_alloc_new_buf() return + value +Status: RO +Content-Length: 1257 +Lines: 32 + +commit e1090371e02b601cbfcea175c2a6cc7c955fa830 upstream. + +Update the comments of binder_alloc_new_buf() to reflect that the return +value of the function is now ERR_PTR(-errno) on failure. + +No functional changes in this patch. + +Cc: stable@vger.kernel.org +Fixes: 57ada2fb2250 ("binder: add log information for binder transaction failures") +Reviewed-by: Alice Ryhl <aliceryhl@google.com> +Signed-off-by: Carlos Llamas <cmllamas@google.com> +Link: https://lore.kernel.org/r/20231201172212.1813387-8-cmllamas@google.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/android/binder_alloc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c +index db340f0575a8..e5fa2042585a 100644 +--- a/drivers/android/binder_alloc.c ++++ b/drivers/android/binder_alloc.c +@@ -557,7 +557,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked( + * is the sum of the three given sizes (each rounded up to + * pointer-sized boundary) + * +- * Return: The allocated buffer or %NULL if error ++ * Return: The allocated buffer or %ERR_PTR(-errno) if error + */ + struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc, + size_t data_size, +-- +2.43.2 + +From 2d4b32c0d4aba59b9ffd5998123fa831fd5d341d Mon Sep 17 00:00:00 2001 +From: Cameron Williams <cang1@live.co.uk> +Date: Thu, 2 Nov 2023 21:07:05 +0000 +Subject: [PATCH 21/29] parport: parport_serial: Add Brainboxes BAR details +Status: RO +Content-Length: 1409 +Lines: 41 + +commit 65fde134b0a4ffe838729f9ee11b459a2f6f2815 upstream. + +Add BAR/enum entries for Brainboxes serial/parallel cards. + +Cc: <stable@vger.kernel.org> +Signed-off-by: Cameron Williams <cang1@live.co.uk> +Acked-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com> +Link: https://lore.kernel.org/r/AS4PR02MB79035155C2D5C3333AE6FA52C4A6A@AS4PR02MB7903.eurprd02.prod.outlook.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/parport/parport_serial.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/parport/parport_serial.c b/drivers/parport/parport_serial.c +index 9f5d784cd95d..11989368611a 100644 +--- a/drivers/parport/parport_serial.c ++++ b/drivers/parport/parport_serial.c +@@ -65,6 +65,10 @@ enum parport_pc_pci_cards { + sunix_5069a, + sunix_5079a, + sunix_5099a, ++ brainboxes_uc257, ++ brainboxes_is300, ++ brainboxes_uc414, ++ brainboxes_px263, + }; + + /* each element directly indexed from enum list, above */ +@@ -158,6 +162,10 @@ static struct parport_pc_pci cards[] = { + /* sunix_5069a */ { 1, { { 1, 2 }, } }, + /* sunix_5079a */ { 1, { { 1, 2 }, } }, + /* sunix_5099a */ { 1, { { 1, 2 }, } }, ++ /* brainboxes_uc257 */ { 1, { { 3, -1 }, } }, ++ /* brainboxes_is300 */ { 1, { { 3, -1 }, } }, ++ /* brainboxes_uc414 */ { 1, { { 3, -1 }, } }, ++ /* brainboxes_px263 */ { 1, { { 3, -1 }, } }, + }; + + static struct pci_device_id parport_serial_pci_tbl[] = { +-- +2.43.2 + +From dc927d3fa5ea6a86806c674a04b30aedd40a0c44 Mon Sep 17 00:00:00 2001 +From: Cameron Williams <cang1@live.co.uk> +Date: Thu, 2 Nov 2023 21:07:06 +0000 +Subject: [PATCH 22/29] parport: parport_serial: Add Brainboxes device IDs and + geometry +Status: RO +Content-Length: 2900 +Lines: 92 + +commit 6aa1fc5a8085bbc01687aa708dcf2dbe637a5ee3 upstream. + +Add device IDs for the Brainboxes UC-203, UC-257, UC-414, UC-475, +IS-300/IS-500 and PX-263/PX-295 and define the relevant "geometry" +for the cards. +This patch requires part 1 of this series. + +Cc: <stable@vger.kernel.org> +Signed-off-by: Cameron Williams <cang1@live.co.uk> +Acked-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com> +Link: https://lore.kernel.org/r/AS4PR02MB7903A4094564BE28F1F926A6C4A6A@AS4PR02MB7903.eurprd02.prod.outlook.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/parport/parport_serial.c | 56 ++++++++++++++++++++++++++++++++ + 1 file changed, 56 insertions(+) + +diff --git a/drivers/parport/parport_serial.c b/drivers/parport/parport_serial.c +index 11989368611a..3644997a8342 100644 +--- a/drivers/parport/parport_serial.c ++++ b/drivers/parport/parport_serial.c +@@ -285,6 +285,38 @@ static struct pci_device_id parport_serial_pci_tbl[] = { + { PCI_VENDOR_ID_SUNIX, PCI_DEVICE_ID_SUNIX_1999, PCI_VENDOR_ID_SUNIX, + 0x0104, 0, 0, sunix_5099a }, + ++ /* Brainboxes UC-203 */ ++ { PCI_VENDOR_ID_INTASHIELD, 0x0bc1, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, ++ { PCI_VENDOR_ID_INTASHIELD, 0x0bc2, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, ++ ++ /* Brainboxes UC-257 */ ++ { PCI_VENDOR_ID_INTASHIELD, 0x0861, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, ++ { PCI_VENDOR_ID_INTASHIELD, 0x0862, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, ++ { PCI_VENDOR_ID_INTASHIELD, 0x0863, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, ++ ++ /* Brainboxes UC-414 */ ++ { PCI_VENDOR_ID_INTASHIELD, 0x0e61, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc414 }, ++ ++ /* Brainboxes UC-475 */ ++ { PCI_VENDOR_ID_INTASHIELD, 0x0981, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, ++ { PCI_VENDOR_ID_INTASHIELD, 0x0982, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, ++ ++ /* Brainboxes IS-300/IS-500 */ ++ { PCI_VENDOR_ID_INTASHIELD, 0x0da0, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_is300 }, ++ ++ /* Brainboxes PX-263/PX-295 */ ++ { PCI_VENDOR_ID_INTASHIELD, 0x402c, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_px263 }, ++ + { 0, } /* terminate list */ + }; + MODULE_DEVICE_TABLE(pci,parport_serial_pci_tbl); +@@ -550,6 +582,30 @@ static struct pciserial_board pci_parport_serial_boards[] = { + .base_baud = 921600, + .uart_offset = 0x8, + }, ++ [brainboxes_uc257] = { ++ .flags = FL_BASE2, ++ .num_ports = 2, ++ .base_baud = 115200, ++ .uart_offset = 8, ++ }, ++ [brainboxes_is300] = { ++ .flags = FL_BASE2, ++ .num_ports = 1, ++ .base_baud = 115200, ++ .uart_offset = 8, ++ }, ++ [brainboxes_uc414] = { ++ .flags = FL_BASE2, ++ .num_ports = 4, ++ .base_baud = 115200, ++ .uart_offset = 8, ++ }, ++ [brainboxes_px263] = { ++ .flags = FL_BASE2, ++ .num_ports = 4, ++ .base_baud = 921600, ++ .uart_offset = 8, ++ }, + }; + + struct parport_serial_private { +-- +2.43.2 + +From 54a298fa028c8d8072532f19fbb54599c3492bc8 Mon Sep 17 00:00:00 2001 +From: Florian Eckert <fe@dev.tdt.de> +Date: Mon, 27 Nov 2023 09:16:21 +0100 +Subject: [PATCH 23/29] leds: ledtrig-tty: Free allocated ttyname buffer on + deactivate +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Status: RO +Content-Length: 1398 +Lines: 38 + +commit 25054b232681c286fca9c678854f56494d1352cc upstream. + +The ttyname buffer for the ledtrig_tty_data struct is allocated in the +sysfs ttyname_store() function. This buffer must be released on trigger +deactivation. This was missing and is thus a memory leak. + +While we are at it, the TTY handler in the ledtrig_tty_data struct should +also be returned in case of the trigger deactivation call. + +Cc: stable@vger.kernel.org +Fixes: fd4a641ac88f ("leds: trigger: implement a tty trigger") +Signed-off-by: Florian Eckert <fe@dev.tdt.de> +Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> +Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Link: https://lore.kernel.org/r/20231127081621.774866-1-fe@dev.tdt.de +Signed-off-by: Lee Jones <lee@kernel.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/leds/trigger/ledtrig-tty.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/leds/trigger/ledtrig-tty.c b/drivers/leds/trigger/ledtrig-tty.c +index 8ae0d2d284af..3e69a7bde928 100644 +--- a/drivers/leds/trigger/ledtrig-tty.c ++++ b/drivers/leds/trigger/ledtrig-tty.c +@@ -168,6 +168,10 @@ static void ledtrig_tty_deactivate(struct led_classdev *led_cdev) + + cancel_delayed_work_sync(&trigger_data->dwork); + ++ kfree(trigger_data->ttyname); ++ tty_kref_put(trigger_data->tty); ++ trigger_data->tty = NULL; ++ + kfree(trigger_data); + } + +-- +2.43.2 + +From 2498b0bbb736ac26aae799bf3d9582abab644d2b Mon Sep 17 00:00:00 2001 +From: LeoLiuoc <LeoLiu-oc@zhaoxin.com> +Date: Mon, 11 Dec 2023 17:15:43 +0800 +Subject: [PATCH 24/29] PCI: Add ACS quirk for more Zhaoxin Root Ports +Status: RO +Content-Length: 1769 +Lines: 47 + +commit e367e3c765f5477b2e79da0f1399aed49e2d1e37 upstream. + +Add more Root Port Device IDs to pci_quirk_zhaoxin_pcie_ports_acs() for +some new Zhaoxin platforms. + +Fixes: 299bd044a6f3 ("PCI: Add ACS quirk for Zhaoxin Root/Downstream Ports") +Link: https://lore.kernel.org/r/20231211091543.735903-1-LeoLiu-oc@zhaoxin.com +Signed-off-by: LeoLiuoc <LeoLiu-oc@zhaoxin.com> +[bhelgaas: update subject, drop changelog, add Fixes, add stable tag, fix +whitespace, wrap code comment] +Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> +Cc: <stable@vger.kernel.org> # 5.7 +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/pci/quirks.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index ea476252280a..d55a3ffae4b8 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4699,17 +4699,21 @@ static int pci_quirk_xgene_acs(struct pci_dev *dev, u16 acs_flags) + * But the implementation could block peer-to-peer transactions between them + * and provide ACS-like functionality. + */ +-static int pci_quirk_zhaoxin_pcie_ports_acs(struct pci_dev *dev, u16 acs_flags) ++static int pci_quirk_zhaoxin_pcie_ports_acs(struct pci_dev *dev, u16 acs_flags) + { + if (!pci_is_pcie(dev) || + ((pci_pcie_type(dev) != PCI_EXP_TYPE_ROOT_PORT) && + (pci_pcie_type(dev) != PCI_EXP_TYPE_DOWNSTREAM))) + return -ENOTTY; + ++ /* ++ * Future Zhaoxin Root Ports and Switch Downstream Ports will ++ * implement ACS capability in accordance with the PCIe Spec. ++ */ + switch (dev->device) { + case 0x0710 ... 0x071e: + case 0x0721: +- case 0x0723 ... 0x0732: ++ case 0x0723 ... 0x0752: + return pci_acs_ctrl_enabled(acs_flags, + PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF); + } +-- +2.43.2 + +From a6d3eb9d4ed5e561cfe7a7e3ce7c71357bd196b7 Mon Sep 17 00:00:00 2001 +From: James Clark <james.clark@arm.com> +Date: Wed, 1 Nov 2023 11:52:06 +0000 +Subject: [PATCH 25/29] coresight: etm4x: Fix width of CCITMIN field +Status: RO +Content-Length: 1737 +Lines: 44 + +commit cc0271a339cc70cae914c3ec20edc2a8058407da upstream. + +CCITMIN is a 12 bit field and doesn't fit in a u8, so extend it to u16. +This probably wasn't an issue previously because values higher than 255 +never occurred. + +But since commit 4aff040bcc8d ("coresight: etm: Override TRCIDR3.CCITMIN +on errata affected cpus"), a comparison with 256 was done to enable the +errata, generating the following W=1 build error: + + coresight-etm4x-core.c:1188:24: error: result of comparison of + constant 256 with expression of type 'u8' (aka 'unsigned char') is + always false [-Werror,-Wtautological-constant-out-of-range-compare] + + if (drvdata->ccitmin == 256) + +Cc: stable@vger.kernel.org +Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver") +Reported-by: kernel test robot <lkp@intel.com> +Closes: https://lore.kernel.org/oe-kbuild-all/202310302043.as36UFED-lkp@intel.com/ +Reviewed-by: Mike Leach <mike.leach@linaro.org> +Signed-off-by: James Clark <james.clark@arm.com> +Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> +Link: https://lore.kernel.org/r/20231101115206.70810-1-james.clark@arm.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/hwtracing/coresight/coresight-etm4x.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h +index 20e2e4cb7614..da17b6c49b0f 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.h ++++ b/drivers/hwtracing/coresight/coresight-etm4x.h +@@ -1036,7 +1036,7 @@ struct etmv4_drvdata { + u8 ctxid_size; + u8 vmid_size; + u8 ccsize; +- u8 ccitmin; ++ u16 ccitmin; + u8 s_ex_level; + u8 ns_ex_level; + u8 q_support; +-- +2.43.2 + +From 2f2eb48bbe34f5b70d8da7d2e26b9222399d367f Mon Sep 17 00:00:00 2001 +From: Carlos Llamas <cmllamas@google.com> +Date: Fri, 29 Sep 2023 03:48:17 +0000 +Subject: [PATCH 26/29] scripts/decode_stacktrace.sh: optionally use LLVM + utilities +Status: RO +Content-Length: 3322 +Lines: 94 + +commit efbd6398353315b7018e6943e41fee9ec35e875f upstream. + +GNU's addr2line can have problems parsing a vmlinux built with LLVM, +particularly when LTO was used. In order to decode the traces correctly +this patch adds the ability to switch to LLVM's utilities readelf and +addr2line. The same approach is followed by Will in [1]. + +Before: + $ scripts/decode_stacktrace.sh vmlinux < kernel.log + [17716.240635] Call trace: + [17716.240646] skb_cow_data (??:?) + [17716.240654] esp6_input (ld-temp.o:?) + [17716.240666] xfrm_input (ld-temp.o:?) + [17716.240674] xfrm6_rcv (??:?) + [...] + +After: + $ LLVM=1 scripts/decode_stacktrace.sh vmlinux < kernel.log + [17716.240635] Call trace: + [17716.240646] skb_cow_data (include/linux/skbuff.h:2172 net/core/skbuff.c:4503) + [17716.240654] esp6_input (net/ipv6/esp6.c:977) + [17716.240666] xfrm_input (net/xfrm/xfrm_input.c:659) + [17716.240674] xfrm6_rcv (net/ipv6/xfrm6_input.c:172) + [...] + +Note that one could set CROSS_COMPILE=llvm- instead to hack around this +issue. However, doing so can break the decodecode routine as it will +force the selection of other LLVM utilities down the line e.g. llvm-as. + +[1] https://lore.kernel.org/all/20230914131225.13415-3-will@kernel.org/ + +Link: https://lkml.kernel.org/r/20230929034836.403735-1-cmllamas@google.com +Signed-off-by: Carlos Llamas <cmllamas@google.com> +Reviewed-by: Nick Desaulniers <ndesaulniers@google.com> +Reviewed-by: Elliot Berman <quic_eberman@quicinc.com> +Tested-by: Justin Stitt <justinstitt@google.com> +Cc: Will Deacon <will@kernel.org> +Cc: John Stultz <jstultz@google.com> +Cc: Masahiro Yamada <masahiroy@kernel.org> +Cc: Nathan Chancellor <nathan@kernel.org> +Cc: Tom Rix <trix@redhat.com> +Cc: <stable@vger.kernel.org> +Signed-off-by: Andrew Morton <akpm@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + scripts/decode_stacktrace.sh | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh +index 564c5632e1a2..bfe5a4082d8e 100755 +--- a/scripts/decode_stacktrace.sh ++++ b/scripts/decode_stacktrace.sh +@@ -16,6 +16,21 @@ elif type c++filt >/dev/null 2>&1 ; then + cppfilt_opts=-i + fi + ++UTIL_SUFFIX= ++if [[ -z ${LLVM:-} ]]; then ++ UTIL_PREFIX=${CROSS_COMPILE:-} ++else ++ UTIL_PREFIX=llvm- ++ if [[ ${LLVM} == */ ]]; then ++ UTIL_PREFIX=${LLVM}${UTIL_PREFIX} ++ elif [[ ${LLVM} == -* ]]; then ++ UTIL_SUFFIX=${LLVM} ++ fi ++fi ++ ++READELF=${UTIL_PREFIX}readelf${UTIL_SUFFIX} ++ADDR2LINE=${UTIL_PREFIX}addr2line${UTIL_SUFFIX} ++ + if [[ $1 == "-r" ]] ; then + vmlinux="" + basepath="auto" +@@ -75,7 +90,7 @@ find_module() { + + if [[ "$modpath" != "" ]] ; then + for fn in $(find "$modpath" -name "${module//_/[-_]}.ko*") ; do +- if readelf -WS "$fn" | grep -qwF .debug_line ; then ++ if ${READELF} -WS "$fn" | grep -qwF .debug_line ; then + echo $fn + return + fi +@@ -169,7 +184,7 @@ parse_symbol() { + if [[ $aarray_support == true && "${cache[$module,$address]+isset}" == "isset" ]]; then + local code=${cache[$module,$address]} + else +- local code=$(${CROSS_COMPILE}addr2line -i -e "$objfile" "$address" 2>/dev/null) ++ local code=$(${ADDR2LINE} -i -e "$objfile" "$address" 2>/dev/null) + if [[ $aarray_support == true ]]; then + cache[$module,$address]=$code + fi +-- +2.43.2 + +From f7f4ff54c440c5324229e5ee204698f95487ae73 Mon Sep 17 00:00:00 2001 +From: Vegard Nossum <vegard.nossum@oracle.com> +Date: Wed, 10 Jan 2024 18:47:58 +0100 +Subject: [PATCH 27/29] docs: kernel_feat.py: fix potential command injection +Status: RO +Content-Length: 13280 +Lines: 333 + +commit c48a7c44a1d02516309015b6134c9bb982e17008 upstream. + +The kernel-feat directive passes its argument straight to the shell. +This is unfortunate and unnecessary. + +Let's always use paths relative to $srctree/Documentation/ and use +subprocess.check_call() instead of subprocess.Popen(shell=True). + +This also makes the code shorter. + +This is analogous to commit 3231dd586277 ("docs: kernel_abi.py: fix +command injection") where we did exactly the same thing for +kernel_abi.py, somehow I completely missed this one. + +Link: https://fosstodon.org/@jani/111676532203641247 +Reported-by: Jani Nikula <jani.nikula@intel.com> +Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com> +Cc: stable@vger.kernel.org +Signed-off-by: Jonathan Corbet <corbet@lwn.net> +Link: https://lore.kernel.org/r/20240110174758.3680506-1-vegard.nossum@oracle.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + Documentation/admin-guide/features.rst | 2 +- + Documentation/arch/arc/features.rst | 2 +- + Documentation/arch/arm/features.rst | 2 +- + Documentation/arch/arm64/features.rst | 2 +- + Documentation/arch/loongarch/features.rst | 2 +- + Documentation/arch/m68k/features.rst | 2 +- + Documentation/arch/mips/features.rst | 2 +- + Documentation/arch/nios2/features.rst | 2 +- + Documentation/arch/openrisc/features.rst | 2 +- + Documentation/arch/parisc/features.rst | 2 +- + Documentation/arch/powerpc/features.rst | 2 +- + Documentation/arch/riscv/features.rst | 2 +- + Documentation/arch/s390/features.rst | 2 +- + Documentation/arch/sh/features.rst | 2 +- + Documentation/arch/sparc/features.rst | 2 +- + Documentation/arch/x86/features.rst | 2 +- + Documentation/arch/xtensa/features.rst | 2 +- + Documentation/sphinx/kernel_feat.py | 57 ++++--------------- + .../zh_CN/arch/loongarch/features.rst | 2 +- + .../translations/zh_CN/arch/mips/features.rst | 2 +- + .../zh_TW/arch/loongarch/features.rst | 2 +- + .../translations/zh_TW/arch/mips/features.rst | 2 +- + 22 files changed, 33 insertions(+), 66 deletions(-) + +diff --git a/Documentation/admin-guide/features.rst b/Documentation/admin-guide/features.rst +index 8c167082a84f..7651eca38227 100644 +--- a/Documentation/admin-guide/features.rst ++++ b/Documentation/admin-guide/features.rst +@@ -1,3 +1,3 @@ + .. SPDX-License-Identifier: GPL-2.0 + +-.. kernel-feat:: $srctree/Documentation/features ++.. kernel-feat:: features +diff --git a/Documentation/arch/arc/features.rst b/Documentation/arch/arc/features.rst +index b793583d688a..49ff446ff744 100644 +--- a/Documentation/arch/arc/features.rst ++++ b/Documentation/arch/arc/features.rst +@@ -1,3 +1,3 @@ + .. SPDX-License-Identifier: GPL-2.0 + +-.. kernel-feat:: $srctree/Documentation/features arc ++.. kernel-feat:: features arc +diff --git a/Documentation/arch/arm/features.rst b/Documentation/arch/arm/features.rst +index 7414ec03dd15..0e76aaf68eca 100644 +--- a/Documentation/arch/arm/features.rst ++++ b/Documentation/arch/arm/features.rst +@@ -1,3 +1,3 @@ + .. SPDX-License-Identifier: GPL-2.0 + +-.. kernel-feat:: $srctree/Documentation/features arm ++.. kernel-feat:: features arm +diff --git a/Documentation/arch/arm64/features.rst b/Documentation/arch/arm64/features.rst +index dfa4cb3cd3ef..03321f4309d0 100644 +--- a/Documentation/arch/arm64/features.rst ++++ b/Documentation/arch/arm64/features.rst +@@ -1,3 +1,3 @@ + .. SPDX-License-Identifier: GPL-2.0 + +-.. kernel-feat:: $srctree/Documentation/features arm64 ++.. kernel-feat:: features arm64 +diff --git a/Documentation/arch/loongarch/features.rst b/Documentation/arch/loongarch/features.rst +index ebacade3ea45..009f44c7951f 100644 +--- a/Documentation/arch/loongarch/features.rst ++++ b/Documentation/arch/loongarch/features.rst +@@ -1,3 +1,3 @@ + .. SPDX-License-Identifier: GPL-2.0 + +-.. kernel-feat:: $srctree/Documentation/features loongarch ++.. kernel-feat:: features loongarch +diff --git a/Documentation/arch/m68k/features.rst b/Documentation/arch/m68k/features.rst +index 5107a2119472..de7f0ccf7fc8 100644 +--- a/Documentation/arch/m68k/features.rst ++++ b/Documentation/arch/m68k/features.rst +@@ -1,3 +1,3 @@ + .. SPDX-License-Identifier: GPL-2.0 + +-.. kernel-feat:: $srctree/Documentation/features m68k ++.. kernel-feat:: features m68k +diff --git a/Documentation/arch/mips/features.rst b/Documentation/arch/mips/features.rst +index 1973d729b29a..6e0ffe3e7354 100644 +--- a/Documentation/arch/mips/features.rst ++++ b/Documentation/arch/mips/features.rst +@@ -1,3 +1,3 @@ + .. SPDX-License-Identifier: GPL-2.0 + +-.. kernel-feat:: $srctree/Documentation/features mips ++.. kernel-feat:: features mips +diff --git a/Documentation/arch/nios2/features.rst b/Documentation/arch/nios2/features.rst +index 8449e63f69b2..89913810ccb5 100644 +--- a/Documentation/arch/nios2/features.rst ++++ b/Documentation/arch/nios2/features.rst +@@ -1,3 +1,3 @@ + .. SPDX-License-Identifier: GPL-2.0 + +-.. kernel-feat:: $srctree/Documentation/features nios2 ++.. kernel-feat:: features nios2 +diff --git a/Documentation/arch/openrisc/features.rst b/Documentation/arch/openrisc/features.rst +index 3f7c40d219f2..bae2e25adfd6 100644 +--- a/Documentation/arch/openrisc/features.rst ++++ b/Documentation/arch/openrisc/features.rst +@@ -1,3 +1,3 @@ + .. SPDX-License-Identifier: GPL-2.0 + +-.. kernel-feat:: $srctree/Documentation/features openrisc ++.. kernel-feat:: features openrisc +diff --git a/Documentation/arch/parisc/features.rst b/Documentation/arch/parisc/features.rst +index 501d7c450037..b3aa4d243b93 100644 +--- a/Documentation/arch/parisc/features.rst ++++ b/Documentation/arch/parisc/features.rst +@@ -1,3 +1,3 @@ + .. SPDX-License-Identifier: GPL-2.0 + +-.. kernel-feat:: $srctree/Documentation/features parisc ++.. kernel-feat:: features parisc +diff --git a/Documentation/arch/powerpc/features.rst b/Documentation/arch/powerpc/features.rst +index aeae73df86b0..ee4b95e04202 100644 +--- a/Documentation/arch/powerpc/features.rst ++++ b/Documentation/arch/powerpc/features.rst +@@ -1,3 +1,3 @@ + .. SPDX-License-Identifier: GPL-2.0 + +-.. kernel-feat:: $srctree/Documentation/features powerpc ++.. kernel-feat:: features powerpc +diff --git a/Documentation/arch/riscv/features.rst b/Documentation/arch/riscv/features.rst +index c70ef6ac2368..36e90144adab 100644 +--- a/Documentation/arch/riscv/features.rst ++++ b/Documentation/arch/riscv/features.rst +@@ -1,3 +1,3 @@ + .. SPDX-License-Identifier: GPL-2.0 + +-.. kernel-feat:: $srctree/Documentation/features riscv ++.. kernel-feat:: features riscv +diff --git a/Documentation/arch/s390/features.rst b/Documentation/arch/s390/features.rst +index 57c296a9d8f3..2883dc950681 100644 +--- a/Documentation/arch/s390/features.rst ++++ b/Documentation/arch/s390/features.rst +@@ -1,3 +1,3 @@ + .. SPDX-License-Identifier: GPL-2.0 + +-.. kernel-feat:: $srctree/Documentation/features s390 ++.. kernel-feat:: features s390 +diff --git a/Documentation/arch/sh/features.rst b/Documentation/arch/sh/features.rst +index f722af3b6c99..fae48fe81e9b 100644 +--- a/Documentation/arch/sh/features.rst ++++ b/Documentation/arch/sh/features.rst +@@ -1,3 +1,3 @@ + .. SPDX-License-Identifier: GPL-2.0 + +-.. kernel-feat:: $srctree/Documentation/features sh ++.. kernel-feat:: features sh +diff --git a/Documentation/arch/sparc/features.rst b/Documentation/arch/sparc/features.rst +index c0c92468b0fe..96835b6d598a 100644 +--- a/Documentation/arch/sparc/features.rst ++++ b/Documentation/arch/sparc/features.rst +@@ -1,3 +1,3 @@ + .. SPDX-License-Identifier: GPL-2.0 + +-.. kernel-feat:: $srctree/Documentation/features sparc ++.. kernel-feat:: features sparc +diff --git a/Documentation/arch/x86/features.rst b/Documentation/arch/x86/features.rst +index b663f15053ce..a33616346a38 100644 +--- a/Documentation/arch/x86/features.rst ++++ b/Documentation/arch/x86/features.rst +@@ -1,3 +1,3 @@ + .. SPDX-License-Identifier: GPL-2.0 + +-.. kernel-feat:: $srctree/Documentation/features x86 ++.. kernel-feat:: features x86 +diff --git a/Documentation/arch/xtensa/features.rst b/Documentation/arch/xtensa/features.rst +index 6b92c7bfa19d..28dcce1759be 100644 +--- a/Documentation/arch/xtensa/features.rst ++++ b/Documentation/arch/xtensa/features.rst +@@ -1,3 +1,3 @@ + .. SPDX-License-Identifier: GPL-2.0 + +-.. kernel-feat:: $srctree/Documentation/features xtensa ++.. kernel-feat:: features xtensa +diff --git a/Documentation/sphinx/kernel_feat.py b/Documentation/sphinx/kernel_feat.py +index b5fa2f0542a5..b9df61eb4501 100644 +--- a/Documentation/sphinx/kernel_feat.py ++++ b/Documentation/sphinx/kernel_feat.py +@@ -37,8 +37,6 @@ import re + import subprocess + import sys + +-from os import path +- + from docutils import nodes, statemachine + from docutils.statemachine import ViewList + from docutils.parsers.rst import directives, Directive +@@ -76,33 +74,26 @@ class KernelFeat(Directive): + self.state.document.settings.env.app.warn(message, prefix="") + + def run(self): +- + doc = self.state.document + if not doc.settings.file_insertion_enabled: + raise self.warning("docutils: file insertion disabled") + + env = doc.settings.env +- cwd = path.dirname(doc.current_source) +- cmd = "get_feat.pl rest --enable-fname --dir " +- cmd += self.arguments[0] ++ ++ srctree = os.path.abspath(os.environ["srctree"]) ++ ++ args = [ ++ os.path.join(srctree, 'scripts/get_feat.pl'), ++ 'rest', ++ '--enable-fname', ++ '--dir', ++ os.path.join(srctree, 'Documentation', self.arguments[0]), ++ ] + + if len(self.arguments) > 1: +- cmd += " --arch " + self.arguments[1] ++ args.extend(['--arch', self.arguments[1]]) + +- srctree = path.abspath(os.environ["srctree"]) +- +- fname = cmd +- +- # extend PATH with $(srctree)/scripts +- path_env = os.pathsep.join([ +- srctree + os.sep + "scripts", +- os.environ["PATH"] +- ]) +- shell_env = os.environ.copy() +- shell_env["PATH"] = path_env +- shell_env["srctree"] = srctree +- +- lines = self.runCmd(cmd, shell=True, cwd=cwd, env=shell_env) ++ lines = subprocess.check_output(args, cwd=os.path.dirname(doc.current_source)).decode('utf-8') + + line_regex = re.compile(r"^\.\. FILE (\S+)$") + +@@ -121,30 +112,6 @@ class KernelFeat(Directive): + nodeList = self.nestedParse(out_lines, fname) + return nodeList + +- def runCmd(self, cmd, **kwargs): +- u"""Run command ``cmd`` and return its stdout as unicode.""" +- +- try: +- proc = subprocess.Popen( +- cmd +- , stdout = subprocess.PIPE +- , stderr = subprocess.PIPE +- , **kwargs +- ) +- out, err = proc.communicate() +- +- out, err = codecs.decode(out, 'utf-8'), codecs.decode(err, 'utf-8') +- +- if proc.returncode != 0: +- raise self.severe( +- u"command '%s' failed with return code %d" +- % (cmd, proc.returncode) +- ) +- except OSError as exc: +- raise self.severe(u"problems with '%s' directive: %s." +- % (self.name, ErrorString(exc))) +- return out +- + def nestedParse(self, lines, fname): + content = ViewList() + node = nodes.section() +diff --git a/Documentation/translations/zh_CN/arch/loongarch/features.rst b/Documentation/translations/zh_CN/arch/loongarch/features.rst +index 82bfac180bdc..cec38dda8298 100644 +--- a/Documentation/translations/zh_CN/arch/loongarch/features.rst ++++ b/Documentation/translations/zh_CN/arch/loongarch/features.rst +@@ -5,4 +5,4 @@ + :Original: Documentation/arch/loongarch/features.rst + :Translator: Huacai Chen <chenhuacai@loongson.cn> + +-.. kernel-feat:: $srctree/Documentation/features loongarch ++.. kernel-feat:: features loongarch +diff --git a/Documentation/translations/zh_CN/arch/mips/features.rst b/Documentation/translations/zh_CN/arch/mips/features.rst +index da1b956e4a40..0d6df97db069 100644 +--- a/Documentation/translations/zh_CN/arch/mips/features.rst ++++ b/Documentation/translations/zh_CN/arch/mips/features.rst +@@ -10,4 +10,4 @@ + + .. _cn_features: + +-.. kernel-feat:: $srctree/Documentation/features mips ++.. kernel-feat:: features mips +diff --git a/Documentation/translations/zh_TW/arch/loongarch/features.rst b/Documentation/translations/zh_TW/arch/loongarch/features.rst +index b64e430f55ae..c2175fd32b54 100644 +--- a/Documentation/translations/zh_TW/arch/loongarch/features.rst ++++ b/Documentation/translations/zh_TW/arch/loongarch/features.rst +@@ -5,5 +5,5 @@ + :Original: Documentation/arch/loongarch/features.rst + :Translator: Huacai Chen <chenhuacai@loongson.cn> + +-.. kernel-feat:: $srctree/Documentation/features loongarch ++.. kernel-feat:: features loongarch + +diff --git a/Documentation/translations/zh_TW/arch/mips/features.rst b/Documentation/translations/zh_TW/arch/mips/features.rst +index f69410420035..3d3906c4d08e 100644 +--- a/Documentation/translations/zh_TW/arch/mips/features.rst ++++ b/Documentation/translations/zh_TW/arch/mips/features.rst +@@ -10,5 +10,5 @@ + + .. _tw_features: + +-.. kernel-feat:: $srctree/Documentation/features mips ++.. kernel-feat:: features mips + +-- +2.43.2 + +From 0f91df0c0fae1a88f11be3eabb1f20f73a88c90a Mon Sep 17 00:00:00 2001 +From: Sumanth Korikkar <sumanthk@linux.ibm.com> +Date: Wed, 10 Jan 2024 15:01:27 +0100 +Subject: [PATCH 28/29] mm/memory_hotplug: fix memmap_on_memory sysfs value + retrieval +Status: RO +Content-Length: 2153 +Lines: 52 + +commit 11684134140bb708b6e6de969a060535630b1b53 upstream. + +set_memmap_mode() stores the kernel parameter memmap mode as an integer. +However, the get_memmap_mode() function utilizes param_get_bool() to fetch +the value as a boolean, leading to potential endianness issue. On +Big-endian architectures, the memmap_on_memory is consistently displayed +as 'N' regardless of its actual status. + +To address this endianness problem, the solution involves obtaining the +mode as an integer. This adjustment ensures the proper display of the +memmap_on_memory parameter, presenting it as one of the following options: +Force, Y, or N. + +Link: https://lkml.kernel.org/r/20240110140127.241451-1-sumanthk@linux.ibm.com +Fixes: 2d1f649c7c08 ("mm/memory_hotplug: support memmap_on_memory when memmap is not aligned to pageblocks") +Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com> +Suggested-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com> +Acked-by: David Hildenbrand <david@redhat.com> +Cc: Alexander Gordeev <agordeev@linux.ibm.com> +Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com> +Cc: Heiko Carstens <hca@linux.ibm.com> +Cc: Michal Hocko <mhocko@suse.com> +Cc: Oscar Salvador <osalvador@suse.de> +Cc: Vasily Gorbik <gor@linux.ibm.com> +Cc: <stable@vger.kernel.org> [6.6+] +Signed-off-by: Andrew Morton <akpm@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + mm/memory_hotplug.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c +index 7a5fc89a8652..c9c2ad5e2681 100644 +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -101,9 +101,11 @@ static int set_memmap_mode(const char *val, const struct kernel_param *kp) + + static int get_memmap_mode(char *buffer, const struct kernel_param *kp) + { +- if (*((int *)kp->arg) == MEMMAP_ON_MEMORY_FORCE) +- return sprintf(buffer, "force\n"); +- return param_get_bool(buffer, kp); ++ int mode = *((int *)kp->arg); ++ ++ if (mode == MEMMAP_ON_MEMORY_FORCE) ++ return sprintf(buffer, "force\n"); ++ return sprintf(buffer, "%c\n", mode ? 'Y' : 'N'); + } + + static const struct kernel_param_ops memmap_mode_ops = { +-- +2.43.2 + +From a91fdae50a6d65ee57378d31284ddec7e9a7ba1b Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Date: Sat, 20 Jan 2024 11:53:02 +0100 +Subject: [PATCH 29/29] Linux 6.7.1 +Status: RO +Content-Length: 1018 +Lines: 32 + +Link: https://lore.kernel.org/r/20240118104301.249503558@linuxfoundation.org +Tested-by: Ronald Warsow <rwarsow@gmx.de> +Tested-by: Allen Pais <apais@linux.microsoft.com> +Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> +Tested-by: SeongJae Park <sj@kernel.org> +Tested-by: Shuah Khan <skhan@linuxfoundation.org> +Tested-by: Ron Economos <re@w6rz.net> +Tested-by: Bagas Sanjaya <bagasdotme@gmail.com> +Tested-by: Ricardo B. Marliere <ricardo@marliere.net> +Tested-by: Jon Hunter <jonathanh@nvidia.com> +Tested-by: Luna Jernberg <droidbittin@gmail.com> +Tested-by: Justin M. Forbes <jforbes@fedoraproject.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Makefile b/Makefile +index c6f549f6a4ae..186da2386a06 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 6 + PATCHLEVEL = 7 +-SUBLEVEL = 0 ++SUBLEVEL = 1 + EXTRAVERSION = + NAME = Hurr durr I'ma ninja sloth + +-- +2.43.2 + diff --git a/cve/review/mbox.6.7.1.cve b/cve/review/mbox.6.7.1.cve new file mode 100644 index 00000000..dd942f83 --- /dev/null +++ b/cve/review/mbox.6.7.1.cve @@ -0,0 +1,393 @@ +From f6c30bfe5a49bc38cae985083a11016800708fea Mon Sep 17 00:00:00 2001 +From: Eric Biggers <ebiggers@google.com> +Date: Mon, 6 Nov 2023 20:44:34 -0800 +Subject: [PATCH 01/29] f2fs: explicitly null-terminate the xattr list +Status: RO +Content-Length: 1091 +Lines: 33 + +commit e26b6d39270f5eab0087453d9b544189a38c8564 upstream. + +When setting an xattr, explicitly null-terminate the xattr list. This +eliminates the fragile assumption that the unused xattr space is always +zeroed. + +Signed-off-by: Eric Biggers <ebiggers@google.com> +Reviewed-by: Chao Yu <chao@kernel.org> +Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + fs/f2fs/xattr.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c +index 47e88b4d4e7d..a8fc2cac6879 100644 +--- a/fs/f2fs/xattr.c ++++ b/fs/f2fs/xattr.c +@@ -754,6 +754,12 @@ static int __f2fs_setxattr(struct inode *inode, int index, + memcpy(pval, value, size); + last->e_value_size = cpu_to_le16(size); + new_hsize += newsize; ++ /* ++ * Explicitly add the null terminator. The unused xattr space ++ * is supposed to always be zeroed, which would make this ++ * unnecessary, but don't depend on that. ++ */ ++ *(u32 *)((u8 *)last + newsize) = 0; + } + + error = write_all_xattrs(inode, new_hsize, base_addr, ipage); +-- +2.43.2 + +From 4f6638562db5f9568dbfbe3a2a6ac80c4832f19e Mon Sep 17 00:00:00 2001 +From: Namjae Jeon <linkinjeon@kernel.org> +Date: Sun, 7 Jan 2024 21:24:07 +0900 +Subject: [PATCH 13/29] ksmbd: don't allow O_TRUNC open on read-only share +Status: RO +Content-Length: 2688 +Lines: 80 + +commit d592a9158a112d419f341f035d18d02f8d232def upstream. + +When file is changed using notepad on read-only share(read_only = yes in +ksmbd.conf), There is a problem where existing data is truncated. +notepad in windows try to O_TRUNC open(FILE_OVERWRITE_IF) and all data +in file is truncated. This patch don't allow O_TRUNC open on read-only +share and add KSMBD_TREE_CONN_FLAG_WRITABLE check in smb2_set_info(). + +Cc: stable@vger.kernel.org +Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> +Signed-off-by: Steve French <stfrench@microsoft.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + fs/smb/server/smb2pdu.c | 23 +++++++++-------------- + 1 file changed, 9 insertions(+), 14 deletions(-) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index 652ab429bf2e..ca2c528c9de3 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -2971,7 +2971,7 @@ int smb2_open(struct ksmbd_work *work) + &may_flags); + + if (!test_tree_conn_flag(tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { +- if (open_flags & O_CREAT) { ++ if (open_flags & (O_CREAT | O_TRUNC)) { + ksmbd_debug(SMB, + "User does not have write permission\n"); + rc = -EACCES; +@@ -5943,12 +5943,6 @@ static int smb2_set_info_file(struct ksmbd_work *work, struct ksmbd_file *fp, + } + case FILE_RENAME_INFORMATION: + { +- if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { +- ksmbd_debug(SMB, +- "User does not have write permission\n"); +- return -EACCES; +- } +- + if (buf_len < sizeof(struct smb2_file_rename_info)) + return -EINVAL; + +@@ -5968,12 +5962,6 @@ static int smb2_set_info_file(struct ksmbd_work *work, struct ksmbd_file *fp, + } + case FILE_DISPOSITION_INFORMATION: + { +- if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { +- ksmbd_debug(SMB, +- "User does not have write permission\n"); +- return -EACCES; +- } +- + if (buf_len < sizeof(struct smb2_file_disposition_info)) + return -EINVAL; + +@@ -6035,7 +6023,7 @@ int smb2_set_info(struct ksmbd_work *work) + { + struct smb2_set_info_req *req; + struct smb2_set_info_rsp *rsp; +- struct ksmbd_file *fp; ++ struct ksmbd_file *fp = NULL; + int rc = 0; + unsigned int id = KSMBD_NO_FID, pid = KSMBD_NO_FID; + +@@ -6055,6 +6043,13 @@ int smb2_set_info(struct ksmbd_work *work) + rsp = smb2_get_msg(work->response_buf); + } + ++ if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { ++ ksmbd_debug(SMB, "User does not have write permission\n"); ++ pr_err("User does not have write permission\n"); ++ rc = -EACCES; ++ goto err_out; ++ } ++ + if (!has_file_id(id)) { + id = req->VolatileFileId; + pid = req->PersistentFileId; +-- +2.43.2 + +From 0de40f76d567133b871cd6ad46bb87afbce46983 Mon Sep 17 00:00:00 2001 +From: Junxiao Bi <junxiao.bi@oracle.com> +Date: Wed, 8 Nov 2023 10:22:16 -0800 +Subject: [PATCH 15/29] Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in + raid5d" +Status: RO +Content-Length: 1980 +Lines: 64 + +commit bed9e27baf52a09b7ba2a3714f1e24e17ced386d upstream. + +This reverts commit 5e2cf333b7bd5d3e62595a44d598a254c697cd74. + +That commit introduced the following race and can cause system hung. + + md_write_start: raid5d: + // mddev->in_sync == 1 + set "MD_SB_CHANGE_PENDING" + // running before md_write_start wakeup it + waiting "MD_SB_CHANGE_PENDING" cleared + >>>>>>>>> hung + wakeup mddev->thread + ... + waiting "MD_SB_CHANGE_PENDING" cleared + >>>> hung, raid5d should clear this flag + but get hung by same flag. + +The issue reverted commit fixing is fixed by last patch in a new way. + +Fixes: 5e2cf333b7bd ("md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d") +Cc: stable@vger.kernel.org # v5.19+ +Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com> +Reviewed-by: Yu Kuai <yukuai3@huawei.com> +Signed-off-by: Song Liu <song@kernel.org> +Link: https://lore.kernel.org/r/20231108182216.73611-2-junxiao.bi@oracle.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/md/raid5.c | 12 ------------ + 1 file changed, 12 deletions(-) + +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 26e1e8a5e941..b02b1a3010f7 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -36,7 +36,6 @@ + */ + + #include <linux/blkdev.h> +-#include <linux/delay.h> + #include <linux/kthread.h> + #include <linux/raid/pq.h> + #include <linux/async_tx.h> +@@ -6820,18 +6819,7 @@ static void raid5d(struct md_thread *thread) + spin_unlock_irq(&conf->device_lock); + md_check_recovery(mddev); + spin_lock_irq(&conf->device_lock); +- +- /* +- * Waiting on MD_SB_CHANGE_PENDING below may deadlock +- * seeing md_check_recovery() is needed to clear +- * the flag when using mdmon. +- */ +- continue; + } +- +- wait_event_lock_irq(mddev->sb_wait, +- !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags), +- conf->device_lock); + } + pr_debug("%d stripes handled\n", handled); + +-- +2.43.2 + +From e074686e993ff1be5f21b085a3b1b4275ccd5727 Mon Sep 17 00:00:00 2001 +From: Carlos Llamas <cmllamas@google.com> +Date: Fri, 1 Dec 2023 17:21:31 +0000 +Subject: [PATCH 17/29] binder: fix use-after-free in shinker's callback +Status: RO +Content-Length: 3511 +Lines: 99 + +commit 3f489c2067c5824528212b0fc18b28d51332d906 upstream. + +The mmap read lock is used during the shrinker's callback, which means +that using alloc->vma pointer isn't safe as it can race with munmap(). +As of commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in +munmap") the mmap lock is downgraded after the vma has been isolated. + +I was able to reproduce this issue by manually adding some delays and +triggering page reclaiming through the shrinker's debug sysfs. The +following KASAN report confirms the UAF: + + ================================================================== + BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8 + Read of size 8 at addr ffff356ed50e50f0 by task bash/478 + + CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70 + Hardware name: linux,dummy-virt (DT) + Call trace: + zap_page_range_single+0x470/0x4b8 + binder_alloc_free_page+0x608/0xadc + __list_lru_walk_one+0x130/0x3b0 + list_lru_walk_node+0xc4/0x22c + binder_shrink_scan+0x108/0x1dc + shrinker_debugfs_scan_write+0x2b4/0x500 + full_proxy_write+0xd4/0x140 + vfs_write+0x1ac/0x758 + ksys_write+0xf0/0x1dc + __arm64_sys_write+0x6c/0x9c + + Allocated by task 492: + kmem_cache_alloc+0x130/0x368 + vm_area_alloc+0x2c/0x190 + mmap_region+0x258/0x18bc + do_mmap+0x694/0xa60 + vm_mmap_pgoff+0x170/0x29c + ksys_mmap_pgoff+0x290/0x3a0 + __arm64_sys_mmap+0xcc/0x144 + + Freed by task 491: + kmem_cache_free+0x17c/0x3c8 + vm_area_free_rcu_cb+0x74/0x98 + rcu_core+0xa38/0x26d4 + rcu_core_si+0x10/0x1c + __do_softirq+0x2fc/0xd24 + + Last potentially related work creation: + __call_rcu_common.constprop.0+0x6c/0xba0 + call_rcu+0x10/0x1c + vm_area_free+0x18/0x24 + remove_vma+0xe4/0x118 + do_vmi_align_munmap.isra.0+0x718/0xb5c + do_vmi_munmap+0xdc/0x1fc + __vm_munmap+0x10c/0x278 + __arm64_sys_munmap+0x58/0x7c + +Fix this issue by performing instead a vma_lookup() which will fail to +find the vma that was isolated before the mmap lock downgrade. Note that +this option has better performance than upgrading to a mmap write lock +which would increase contention. Plus, mmap_write_trylock() has been +recently removed anyway. + +Fixes: dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap") +Cc: stable@vger.kernel.org +Cc: Liam Howlett <liam.howlett@oracle.com> +Cc: Minchan Kim <minchan@kernel.org> +Reviewed-by: Alice Ryhl <aliceryhl@google.com> +Signed-off-by: Carlos Llamas <cmllamas@google.com> +Link: https://lore.kernel.org/r/20231201172212.1813387-3-cmllamas@google.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/android/binder_alloc.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c +index 138f6d43d13b..9d2eff70c3ba 100644 +--- a/drivers/android/binder_alloc.c ++++ b/drivers/android/binder_alloc.c +@@ -1005,7 +1005,9 @@ enum lru_status binder_alloc_free_page(struct list_head *item, + goto err_mmget; + if (!mmap_read_trylock(mm)) + goto err_mmap_read_lock_failed; +- vma = binder_alloc_get_vma(alloc); ++ vma = vma_lookup(mm, page_addr); ++ if (vma && vma != binder_alloc_get_vma(alloc)) ++ goto err_invalid_vma; + + list_lru_isolate(lru, item); + spin_unlock(lock); +@@ -1031,6 +1033,8 @@ enum lru_status binder_alloc_free_page(struct list_head *item, + mutex_unlock(&alloc->mutex); + return LRU_REMOVED_RETRY; + ++err_invalid_vma: ++ mmap_read_unlock(mm); + err_mmap_read_lock_failed: + mmput_async(mm); + err_mmget: +-- +2.43.2 + +From 913205930da6213305616ac539447702eaa85e41 Mon Sep 17 00:00:00 2001 +From: Guanghui Feng <guanghuifeng@linux.alibaba.com> +Date: Thu, 21 Dec 2023 17:57:43 +0800 +Subject: [PATCH 20/29] uio: Fix use-after-free in uio_open +Status: RO +Content-Length: 2160 +Lines: 71 + +commit 0c9ae0b8605078eafc3bea053cc78791e97ba2e2 upstream. + +core-1 core-2 +------------------------------------------------------- +uio_unregister_device uio_open + idev = idr_find() +device_unregister(&idev->dev) +put_device(&idev->dev) +uio_device_release + get_device(&idev->dev) +kfree(idev) +uio_free_minor(minor) + uio_release + put_device(&idev->dev) + kfree(idev) +------------------------------------------------------- + +In the core-1 uio_unregister_device(), the device_unregister will kfree +idev when the idev->dev kobject ref is 1. But after core-1 +device_unregister, put_device and before doing kfree, the core-2 may +get_device. Then: +1. After core-1 kfree idev, the core-2 will do use-after-free for idev. +2. When core-2 do uio_release and put_device, the idev will be double + freed. + +To address this issue, we can get idev atomic & inc idev reference with +minor_lock. + +Fixes: 57c5f4df0a5a ("uio: fix crash after the device is unregistered") +Cc: stable <stable@kernel.org> +Signed-off-by: Guanghui Feng <guanghuifeng@linux.alibaba.com> +Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com> +Link: https://lore.kernel.org/r/1703152663-59949-1-git-send-email-guanghuifeng@linux.alibaba.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/uio/uio.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c +index 62082d64ece0..2d572f6c8ec8 100644 +--- a/drivers/uio/uio.c ++++ b/drivers/uio/uio.c +@@ -466,13 +466,13 @@ static int uio_open(struct inode *inode, struct file *filep) + + mutex_lock(&minor_lock); + idev = idr_find(&uio_idr, iminor(inode)); +- mutex_unlock(&minor_lock); + if (!idev) { + ret = -ENODEV; ++ mutex_unlock(&minor_lock); + goto out; + } +- + get_device(&idev->dev); ++ mutex_unlock(&minor_lock); + + if (!try_module_get(idev->owner)) { + ret = -ENODEV; +@@ -1064,9 +1064,8 @@ void uio_unregister_device(struct uio_info *info) + wake_up_interruptible(&idev->wait); + kill_fasync(&idev->async_queue, SIGIO, POLL_HUP); + +- device_unregister(&idev->dev); +- + uio_free_minor(minor); ++ device_unregister(&idev->dev); + + return; + } +-- +2.43.2 + |